starmux 0.13.0 → 0.14.0

package/dist/src/instance-migration.js

@@ -1,138 +0,0 @@
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-import { homedir } from 'node:os';
-import { rm } from 'node:fs/promises';
-import path from 'node:path';
-import { legacyProfileDetails } from './operator-cli.js';
-import { globalStop, connectOwner } from './global-core-control.js';
-import { defaultSetupPath, loadSetupConfig } from './release1-onboarding.js';
-import { atomicPrivate, availablePort, changeRegistry, createInstance, exists, instanceConfigSchema, instancePaths, instancesRoot, parseConfig, readRegistry, readTrusted, validateConfig, withLock } from './instance-store.js';
-const exec = promisify(execFile);
-async function discover(profile) {
-    const details = await legacyProfileDetails(profile);
-    const env = details.env;
-    let config;
-    if (profile === 'setup')
-        config = parseConfig(JSON.stringify(await loadSetupConfig(defaultSetupPath())));
-    else
-        config = instanceConfigSchema.parse({ schemaVersion: 1, projectRoot: env.MAC_MCP_PROJECT_ROOT, port: Number(env.MAC_MCP_PROJECT_PORT), mode: env.MAC_MCP_WORKSPACE_MODE ?? 'read-only',
-            accessRole: env.MAC_MCP_DC_ACCESS_MODE === 'native' ? 'trusted' : 'restricted', writeScope: env.MAC_MCP_DC_WRITE_SCOPE ?? 'unrestricted', connection: 'local', gitMode: env.MAC_MCP_GIT_MODE ?? 'off', worktreeMode: env.MAC_MCP_WORKTREE_MODE ?? 'off' });
-    const secrets = {};
-    if (env.MAC_MCP_UPSTREAMS_FILE) {
-        const { readConfiguredUpstreams } = await import('./configured-mcp-upstreams.js');
-        config.upstreams = (await readConfiguredUpstreams(env.MAC_MCP_UPSTREAMS_FILE)).map(u => {
-            const envRefs = {};
-            for (const [key, value] of Object.entries(u.env)) {
-                const ref = u.id + '_' + key;
-                secrets[ref] = value;
-                envRefs[key] = ref;
-            }
-            return { id: u.id, transport: 'stdio', command: u.command, args: [...u.args], allowTools: [...u.allowTools], envRefs };
-        });
-    }
-    const known = new Set(['MAC_MCP_PROJECT_ROOT', 'MAC_MCP_PROJECT_PORT', 'MAC_MCP_WORKSPACE_MODE', 'MAC_MCP_DEV_COMMANDS', 'MAC_MCP_DC_ACCESS_MODE', 'MAC_MCP_DC_WRITE_SCOPE', 'MAC_MCP_GIT_MODE', 'MAC_MCP_WORKTREE_MODE', 'MAC_MCP_ACCESS_FILE', 'MAC_MCP_GRANTS_FILE', 'MAC_MCP_DENY_FILE', 'MAC_MCP_UPSTREAMS_FILE', 'MAC_MCP_PRIVATE_ACTIVITY_OBSERVER']);
-    const unsupported = Object.keys(env).filter(k => k.startsWith('MAC_MCP_') && !known.has(k));
-    if (unsupported.length)
-        throw Error('LEGACY_SETTINGS_REQUIRE_MANUAL_IMPORT: ' + unsupported.join(', '));
-    await validateConfig(config);
-    const root = path.join(homedir(), '.config', 'mac-mcp-gateway');
-    const files = { access: env.MAC_MCP_ACCESS_FILE ?? path.join(root, 'access-v1.json'), grants: env.MAC_MCP_GRANTS_FILE ?? path.join(root, 'workspace-grants-v1.json'), deny: env.MAC_MCP_DENY_FILE ?? path.join(root, 'deny-rules-v1.json') };
-    let accessMode = 'ingress';
-    if (await exists(files.access)) {
-        const state = JSON.parse(await readTrusted(files.access));
-        accessMode = state.mode;
-    }
-    else if (await exists(files.access + '.initialized'))
-        throw Error('ACCESS_STORE_MISSING');
-    return { details, config, files, secrets, accessMode };
-}
-export async function migrateLegacy(profile, confirm = false, name) {
-    if (profile && profile !== 'setup' && profile !== 'live')
-        throw Error('MIGRATION_PROFILE_REQUIRED: setup or live');
-    const found = [];
-    const errors = [];
-    for (const p of ['setup', 'live']) {
-        if (p === 'live' && process.platform !== 'darwin')
-            continue;
-        try {
-            found.push(await discover(p));
-        }
-        catch (e) {
-            errors.push({ profile: p, error: e.message });
-        }
-    }
-    const preview = found.map(f => ({ profile: f.details.kind, source: f.details.source, port: f.config.port, projectRoot: f.config.projectRoot, accessRole: f.config.accessRole, accessMode: f.accessMode, registered: f.details.registered }));
-    if (!confirm)
-        return { schemaVersion: 1, result: 'PREVIEW', sources: preview, errors, message: 'Choose a source, then repeat with --confirm. Running legacy instances using these stores will be stopped; original files are retained.' };
-    const selected = profile ? found.find(f => f.details.kind === profile) : found.length === 1 ? found[0] : null;
-    if (!selected)
-        throw Error('MIGRATION_SOURCE_REQUIRED: select setup or live from the preview');
-    const root = instancesRoot();
-    return withLock(path.join(root, '.migration-lock'), async () => {
-        const registry = await readRegistry();
-        if (registry.instances.some(i => i.legacy))
-            throw Error('LEGACY_STATE_ALREADY_MIGRATED: import another configuration without copying credentials');
-        const related = found.filter(f => Object.values(f.files).some(file => Object.values(selected.files).includes(file)));
-        for (const f of related) {
-            if (!await availablePort(f.config.port) && !f.details.registered && !await connectOwner(f.config.port))
-                throw Error('LEGACY_LISTENER_UNTRUSTED: stop it using its original launcher');
-        }
-        const stopped = [];
-        let instance;
-        try {
-            for (const f of related) {
-                if (f.details.registered) {
-                    await exec('/bin/launchctl', ['disable', `gui/${process.getuid()}/${f.details.label}`]);
-                    await exec('/bin/launchctl', ['bootout', `gui/${process.getuid()}`, f.details.plist]);
-                }
-                else
-                    await globalStop(f.config.port);
-                stopped.push(f);
-                for (let i = 0; i < 60 && !await availablePort(f.config.port); i++)
-                    await new Promise(r => setTimeout(r, 200));
-                if (!await availablePort(f.config.port))
-                    throw Error('LEGACY_STOP_UNVERIFIED');
-            }
-            // Lock every shared access store before copying its live credential state.
-            const accessFile = selected.files.access;
-            return await withLock(accessFile + '.lock', async () => {
-                instance = await createInstance(name ?? 'default', { config: selected.config, legacy: selected.details.kind, requiredAccess: selected.accessMode });
-                const p = instancePaths(instance);
-                for (const key of ['access', 'grants', 'deny']) {
-                    for (const suffix of ['', '.initialized', '.owner-token']) {
-                        const source = selected.files[key] + suffix;
-                        if (await exists(source))
-                            await atomicPrivate(p[key] + suffix, await readTrusted(source));
-                    }
-                }
-                if (Object.keys(selected.secrets).length)
-                    await atomicPrivate(path.join(p.state, 'secrets.json'), JSON.stringify(selected.secrets));
-                await atomicPrivate(path.join(p.root, 'migration.json'), JSON.stringify({ schemaVersion: 1, at: new Date().toISOString(), sources: preview, sourcePaths: selected.files, oldFilesRetained: true }, null, 2));
-                return { result: 'MIGRATED_NOT_STARTED', instance, oldFilesRetained: true, message: 'Start this instance explicitly. Old automatic starts were disabled.' };
-            });
-        }
-        catch (error) {
-            if (instance) {
-                await changeRegistry(async (r) => { r.instances = r.instances.filter(i => i.id !== instance.id); if (r.defaultInstanceId === instance.id)
-                    r.defaultInstanceId = null; });
-                await rm(instancePaths(instance).root, { recursive: true, force: true });
-            }
-            const recovery = [];
-            for (const f of stopped) {
-                if (f.details.registered) {
-                    try {
-                        await exec('/bin/launchctl', ['enable', `gui/${process.getuid()}/${f.details.label}`]);
-                        await exec('/bin/launchctl', ['bootstrap', `gui/${process.getuid()}`, f.details.plist]);
-                    }
-                    catch {
-                        recovery.push('Restore legacy service ' + f.details.label);
-                    }
-                }
-                else
-                    recovery.push('mac-mcp-gateway run --profile ' + f.details.kind);
-            }
-            throw Error('MIGRATION_FAILED: ' + error.message + '; originals retained; recovery: ' + recovery.join('; '));
-        }
-    });
-}
-//# sourceMappingURL=instance-migration.js.map

package/dist/src/instance-migration.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"instance-migration.js","sourceRoot":"","sources":["../../src/instance-migration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,QAAQ,EAAC,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAC,SAAS,EAAC,MAAM,WAAW,CAAC;AACpC,OAAO,EAAC,OAAO,EAAC,MAAM,SAAS,CAAC;AAChC,OAAO,EAAC,EAAE,EAAC,MAAM,kBAAkB,CAAC;AACpC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAC,oBAAoB,EAAC,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAC,UAAU,EAAC,YAAY,EAAC,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAC,gBAAgB,EAAC,eAAe,EAAC,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAC,aAAa,EAAC,aAAa,EAAC,cAAc,EAAC,cAAc,EAAC,MAAM,EAAC,oBAAoB,EAAC,aAAa,EAAC,aAAa,EAAC,WAAW,EAAC,YAAY,EAAC,WAAW,EAAC,cAAc,EAAC,QAAQ,EAAmC,MAAM,qBAAqB,CAAC;AAErP,MAAM,IAAI,GAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC/B,KAAK,UAAU,QAAQ,CAAC,OAAsB;IAC5C,MAAM,OAAO,GAAC,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAAA,MAAM,GAAG,GAAC,OAAO,CAAC,GAAG,CAAC;IACxE,IAAI,MAAqB,CAAC;IAC1B,IAAG,OAAO,KAAG,OAAO;QAAC,MAAM,GAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,eAAe,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;;QAC9F,MAAM,GAAC,oBAAoB,CAAC,KAAK,CAAC,EAAC,aAAa,EAAC,CAAC,EAAC,WAAW,EAAC,GAAG,CAAC,oBAAoB,EAAC,IAAI,EAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAC,IAAI,EAAC,GAAG,CAAC,sBAAsB,IAAE,WAAW;YAC7K,UAAU,EAAC,GAAG,CAAC,sBAAsB,KAAG,QAAQ,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,YAAY,EAAC,UAAU,EAAC,GAAG,CAAC,sBAAsB,IAAE,cAAc,EAAC,UAAU,EAAC,OAAO,EAAC,OAAO,EAAC,GAAG,CAAC,gBAAgB,IAAE,KAAK,EAAC,YAAY,EAAC,GAAG,CAAC,qBAAqB,IAAE,KAAK,EAAC,CAAC,CAAC;IACvO,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,IAAG,GAAG,CAAC,sBAAsB,EAAC,CAAC;QAC7B,MAAM,EAAC,uBAAuB,EAAC,GAAC,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAC9E,MAAM,CAAC,SAAS,GAAC,CAAC,MAAM,uBAAuB,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE;YAClF,MAAM,OAAO,GAAuB,EAAE,CAAC;YAAA,KAAI,MAAM,CAAC,GAAG,EAAC,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAC,CAAC;gBAAA,MAAM,GAAG,GAAC,CAAC,CAAC,EAAE,GAAC,GAAG,GAAC,GAAG,CAAC;gBAAA,OAAO,CAAC,GAAG,CAAC,GAAC,KAAK,CAAC;gBAAA,OAAO,CAAC,GAAG,CAAC,GAAC,GAAG,CAAC;YAAA,CAAC;YACnJ,OAAO,EAAC,EAAE,EAAC,CAAC,CAAC,EAAE,EAAC,SAAS,EAAC,OAAO,EAAC,OAAO,EAAC,CAAC,CAAC,OAAO,EAAC,IAAI,EAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,UAAU,EAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,EAAC,OAAO,EAAC,CAAC;QAC7G,CAAC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAC,IAAI,GAAG,CAAC,CAAC,sBAAsB,EAAC,sBAAsB,EAAC,wBAAwB,EAAC,sBAAsB,EAAC,wBAAwB,EAAC,wBAAwB,EAAC,kBAAkB,EAAC,uBAAuB,EAAC,qBAAqB,EAAC,qBAAqB,EAAC,mBAAmB,EAAC,wBAAwB,EAAC,mCAAmC,CAAC,CAAC,CAAC;IAC/U,MAAM,WAAW,GAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,IAAG,WAAW,CAAC,MAAM;QAAC,MAAM,KAAK,CAAC,yCAAyC,GAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAC,SAAS,EAAC,iBAAiB,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAC,EAAC,MAAM,EAAC,GAAG,CAAC,mBAAmB,IAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,gBAAgB,CAAC,EAAC,MAAM,EAAC,GAAG,CAAC,mBAAmB,IAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,0BAA0B,CAAC,EAAC,IAAI,EAAC,GAAG,CAAC,iBAAiB,IAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,oBAAoB,CAAC,EAAC,CAAC;IAC3N,IAAI,UAAU,GAA6B,SAAS,CAAC;IACrD,IAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAC,CAAC;QAAA,MAAM,KAAK,GAAC,IAAI,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAA6B,CAAC;QAAA,UAAU,GAAC,KAAK,CAAC,IAAI,CAAC;IAAA,CAAC;SACrI,IAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,GAAC,cAAc,CAAC;QAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACtF,OAAO,EAAC,OAAO,EAAC,MAAM,EAAC,KAAK,EAAC,OAAO,EAAC,UAAU,EAAC,CAAC;AACnD,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAC,OAAO,GAAC,KAAK,EAAC,IAAY;IAC5E,IAAG,OAAO,IAAE,OAAO,KAAG,OAAO,IAAE,OAAO,KAAG,MAAM;QAAC,MAAM,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACzG,MAAM,KAAK,GAAwC,EAAE,CAAC;IAAA,MAAM,MAAM,GAAiC,EAAE,CAAC;IACtG,KAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAC,MAAM,CAAU,EAAC,CAAC;QACxC,IAAG,CAAC,KAAG,MAAM,IAAE,OAAO,CAAC,QAAQ,KAAG,QAAQ;YAAC,SAAS;QACpD,IAAG,CAAC;YAAA,KAAK,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAAA,CAAC;QAAA,OAAM,CAAC,EAAC,CAAC;YAAA,MAAM,CAAC,IAAI,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,KAAK,EAAE,CAAW,CAAC,OAAO,EAAC,CAAC,CAAC;QAAA,CAAC;IACnG,CAAC;IACD,MAAM,OAAO,GAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,EAAC,OAAO,EAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAC,MAAM,EAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAC,WAAW,EAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAC,UAAU,EAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAC,UAAU,EAAC,CAAC,CAAC,UAAU,EAAC,UAAU,EAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAC,CAAC,CAAC,CAAC;IAC1N,IAAG,CAAC,OAAO;QAAC,OAAO,EAAC,aAAa,EAAC,CAAC,EAAC,MAAM,EAAC,SAAS,EAAC,OAAO,EAAC,OAAO,EAAC,MAAM,EAAC,OAAO,EAAC,wIAAwI,EAAC,CAAC;IAC9N,MAAM,QAAQ,GAAC,OAAO,CAAA,CAAC,CAAA,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,OAAO,CAAC,IAAI,KAAG,OAAO,CAAC,CAAA,CAAC,CAAA,KAAK,CAAC,MAAM,KAAG,CAAC,CAAA,CAAC,CAAA,KAAK,CAAC,CAAC,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC;IAC9F,IAAG,CAAC,QAAQ;QAAC,MAAM,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAC,aAAa,EAAE,CAAC;IAC3B,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,iBAAiB,CAAC,EAAC,KAAK,IAAE,EAAE;QACzD,MAAM,QAAQ,GAAC,MAAM,YAAY,EAAE,CAAC;QACpC,IAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,MAAM,CAAC;YAAC,MAAM,KAAK,CAAC,yFAAyF,CAAC,CAAC;QAC/I,MAAM,OAAO,GAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA,EAAE,CAAA,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/G,KAAI,MAAM,CAAC,IAAI,OAAO,EAAC,CAAC;YACtB,IAAG,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,IAAE,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAClL,CAAC;QACD,MAAM,OAAO,GAAgB,EAAE,CAAC;QAAA,IAAI,QAA2B,CAAC;QAChE,IAAG,CAAC;YACF,KAAI,MAAM,CAAC,IAAI,OAAO,EAAC,CAAC;gBACtB,IAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAC,CAAC;oBACvB,MAAM,IAAI,CAAC,gBAAgB,EAAC,CAAC,SAAS,EAAC,OAAO,OAAO,CAAC,MAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;oBACvF,MAAM,IAAI,CAAC,gBAAgB,EAAC,CAAC,SAAS,EAAC,OAAO,OAAO,CAAC,MAAO,EAAE,EAAE,EAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtF,CAAC;;oBAAK,MAAM,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,KAAI,IAAI,CAAC,GAAC,CAAC,EAAC,CAAC,GAAC,EAAE,IAAE,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAC,CAAC,EAAE;oBAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAA,EAAE,CAAA,UAAU,CAAC,CAAC,EAAC,GAAG,CAAC,CAAC,CAAC;gBAClG,IAAG,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;oBAAC,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC/E,CAAC;YACD,2EAA2E;YAC3E,MAAM,UAAU,GAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YACvC,OAAO,MAAM,QAAQ,CAAC,UAAU,GAAC,OAAO,EAAC,KAAK,IAAE,EAAE;gBAChD,QAAQ,GAAC,MAAM,cAAc,CAAC,IAAI,IAAE,SAAS,EAAC,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM,EAAC,MAAM,EAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAC,cAAc,EAAC,QAAQ,CAAC,UAAU,EAAC,CAAC,CAAC;gBACxI,MAAM,CAAC,GAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAChC,KAAI,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAC,QAAQ,EAAC,MAAM,CAAU,EAAC,CAAC;oBACpD,KAAI,MAAM,MAAM,IAAI,CAAC,EAAE,EAAE,cAAc,EAAC,cAAc,CAAC,EAAC,CAAC;wBACvD,MAAM,MAAM,GAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,GAAC,MAAM,CAAC;wBAAA,IAAG,MAAM,MAAM,CAAC,MAAM,CAAC;4BAAC,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAC,MAAM,EAAC,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC/H,CAAC;gBACH,CAAC;gBACD,IAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM;oBAAC,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAC,cAAc,CAAC,EAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;gBAChI,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAC,gBAAgB,CAAC,EAAC,IAAI,CAAC,SAAS,CAAC,EAAC,aAAa,EAAC,CAAC,EAAC,EAAE,EAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAC,OAAO,EAAC,OAAO,EAAC,WAAW,EAAC,QAAQ,CAAC,KAAK,EAAC,gBAAgB,EAAC,IAAI,EAAC,EAAC,IAAI,EAAC,CAAC,CAAC,CAAC,CAAC;gBAC9L,OAAO,EAAC,MAAM,EAAC,sBAAsB,EAAC,QAAQ,EAAC,gBAAgB,EAAC,IAAI,EAAC,OAAO,EAAC,qEAAqE,EAAC,CAAC;YACtJ,CAAC,CAAC,CAAC;QACL,CAAC;QAAA,OAAM,KAAK,EAAC,CAAC;YACZ,IAAG,QAAQ,EAAC,CAAC;gBAAA,MAAM,cAAc,CAAC,KAAK,EAAC,CAAC,EAAA,EAAE,GAAC,CAAC,CAAC,SAAS,GAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,QAAS,CAAC,EAAE,CAAC,CAAC,CAAA,IAAG,CAAC,CAAC,iBAAiB,KAAG,QAAS,CAAC,EAAE;oBAAC,CAAC,CAAC,iBAAiB,GAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC;gBAAA,MAAM,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC;YAAA,CAAC;YACzO,MAAM,QAAQ,GAAU,EAAE,CAAC;YAC3B,KAAI,MAAM,CAAC,IAAI,OAAO,EAAC,CAAC;gBACtB,IAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAC,CAAC;oBAAA,IAAG,CAAC;wBAAA,MAAM,IAAI,CAAC,gBAAgB,EAAC,CAAC,QAAQ,EAAC,OAAO,OAAO,CAAC,MAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;wBAAA,MAAM,IAAI,CAAC,gBAAgB,EAAC,CAAC,WAAW,EAAC,OAAO,OAAO,CAAC,MAAO,EAAE,EAAE,EAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;oBAAA,CAAC;oBAAA,MAAK,CAAC;wBAAA,QAAQ,CAAC,IAAI,CAAC,yBAAyB,GAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;oBAAA,CAAC;gBAAA,CAAC;;oBACtQ,QAAQ,CAAC,IAAI,CAAC,gCAAgC,GAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,KAAK,CAAC,oBAAoB,GAAE,KAAe,CAAC,OAAO,GAAC,kCAAkC,GAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {execFile} from 'node:child_process';\nimport {promisify} from 'node:util';\nimport {homedir} from 'node:os';\nimport {rm} from 'node:fs/promises';\nimport path from 'node:path';\nimport {legacyProfileDetails} from './operator-cli.js';\nimport {globalStop,connectOwner} from './global-core-control.js';\nimport {defaultSetupPath,loadSetupConfig} from './release1-onboarding.js';\nimport {atomicPrivate,availablePort,changeRegistry,createInstance,exists,instanceConfigSchema,instancePaths,instancesRoot,parseConfig,readRegistry,readTrusted,validateConfig,withLock,type Instance,type InstanceConfig} from './instance-store.js';\n\nconst exec=promisify(execFile);\nasync function discover(profile:'setup'|'live'){\n  const details=await legacyProfileDetails(profile);const env=details.env;\n  let config:InstanceConfig;\n  if(profile==='setup')config=parseConfig(JSON.stringify(await loadSetupConfig(defaultSetupPath())));\n  else config=instanceConfigSchema.parse({schemaVersion:1,projectRoot:env.MAC_MCP_PROJECT_ROOT,port:Number(env.MAC_MCP_PROJECT_PORT),mode:env.MAC_MCP_WORKSPACE_MODE??'read-only',\n    accessRole:env.MAC_MCP_DC_ACCESS_MODE==='native'?'trusted':'restricted',writeScope:env.MAC_MCP_DC_WRITE_SCOPE??'unrestricted',connection:'local',gitMode:env.MAC_MCP_GIT_MODE??'off',worktreeMode:env.MAC_MCP_WORKTREE_MODE??'off'});\n  const secrets:Record<string,string>={};\n  if(env.MAC_MCP_UPSTREAMS_FILE){\n    const {readConfiguredUpstreams}=await import('./configured-mcp-upstreams.js');\n    config.upstreams=(await readConfiguredUpstreams(env.MAC_MCP_UPSTREAMS_FILE)).map(u=>{\n      const envRefs:Record<string,string>={};for(const [key,value] of Object.entries(u.env)){const ref=u.id+'_'+key;secrets[ref]=value;envRefs[key]=ref;}\n      return {id:u.id,transport:'stdio',command:u.command,args:[...u.args],allowTools:[...u.allowTools],envRefs};\n    });\n  }\n  const known=new Set(['MAC_MCP_PROJECT_ROOT','MAC_MCP_PROJECT_PORT','MAC_MCP_WORKSPACE_MODE','MAC_MCP_DEV_COMMANDS','MAC_MCP_DC_ACCESS_MODE','MAC_MCP_DC_WRITE_SCOPE','MAC_MCP_GIT_MODE','MAC_MCP_WORKTREE_MODE','MAC_MCP_ACCESS_FILE','MAC_MCP_GRANTS_FILE','MAC_MCP_DENY_FILE','MAC_MCP_UPSTREAMS_FILE','MAC_MCP_PRIVATE_ACTIVITY_OBSERVER']);\n  const unsupported=Object.keys(env).filter(k=>k.startsWith('MAC_MCP_')&&!known.has(k));\n  if(unsupported.length)throw Error('LEGACY_SETTINGS_REQUIRE_MANUAL_IMPORT: '+unsupported.join(', '));\n  await validateConfig(config);\n  const root=path.join(homedir(),'.config','mac-mcp-gateway');\n  const files={access:env.MAC_MCP_ACCESS_FILE??path.join(root,'access-v1.json'),grants:env.MAC_MCP_GRANTS_FILE??path.join(root,'workspace-grants-v1.json'),deny:env.MAC_MCP_DENY_FILE??path.join(root,'deny-rules-v1.json')};\n  let accessMode:'ingress'|'api-key'|'oauth'='ingress';\n  if(await exists(files.access)){const state=JSON.parse(await readTrusted(files.access)) as {mode:typeof accessMode};accessMode=state.mode;}\n  else if(await exists(files.access+'.initialized'))throw Error('ACCESS_STORE_MISSING');\n  return {details,config,files,secrets,accessMode};\n}\nexport async function migrateLegacy(profile?:string,confirm=false,name?:string){\n  if(profile&&profile!=='setup'&&profile!=='live')throw Error('MIGRATION_PROFILE_REQUIRED: setup or live');\n  const found:Awaited<ReturnType<typeof discover>>[]=[];const errors:{profile:string;error:string}[]=[];\n  for(const p of ['setup','live'] as const){\n    if(p==='live'&&process.platform!=='darwin')continue;\n    try{found.push(await discover(p));}catch(e){errors.push({profile:p,error:(e as Error).message});}\n  }\n  const preview=found.map(f=>({profile:f.details.kind,source:f.details.source,port:f.config.port,projectRoot:f.config.projectRoot,accessRole:f.config.accessRole,accessMode:f.accessMode,registered:f.details.registered}));\n  if(!confirm)return {schemaVersion:1,result:'PREVIEW',sources:preview,errors,message:'Choose a source, then repeat with --confirm. Running legacy instances using these stores will be stopped; original files are retained.'};\n  const selected=profile?found.find(f=>f.details.kind===profile):found.length===1?found[0]:null;\n  if(!selected)throw Error('MIGRATION_SOURCE_REQUIRED: select setup or live from the preview');\n  const root=instancesRoot();\n  return withLock(path.join(root,'.migration-lock'),async()=>{\n    const registry=await readRegistry();\n    if(registry.instances.some(i=>i.legacy))throw Error('LEGACY_STATE_ALREADY_MIGRATED: import another configuration without copying credentials');\n    const related=found.filter(f=>Object.values(f.files).some(file=>Object.values(selected.files).includes(file)));\n    for(const f of related){\n      if(!await availablePort(f.config.port)&&!f.details.registered&&!await connectOwner(f.config.port))throw Error('LEGACY_LISTENER_UNTRUSTED: stop it using its original launcher');\n    }\n    const stopped:typeof related=[];let instance:Instance|undefined;\n    try{\n      for(const f of related){\n        if(f.details.registered){\n          await exec('/bin/launchctl',['disable',`gui/${process.getuid!()}/${f.details.label}`]);\n          await exec('/bin/launchctl',['bootout',`gui/${process.getuid!()}`,f.details.plist]);\n        }else await globalStop(f.config.port);\n        stopped.push(f);\n        for(let i=0;i<60&&!await availablePort(f.config.port);i++)await new Promise(r=>setTimeout(r,200));\n        if(!await availablePort(f.config.port))throw Error('LEGACY_STOP_UNVERIFIED');\n      }\n      // Lock every shared access store before copying its live credential state.\n      const accessFile=selected.files.access;\n      return await withLock(accessFile+'.lock',async()=>{\n        instance=await createInstance(name??'default',{config:selected.config,legacy:selected.details.kind,requiredAccess:selected.accessMode});\n        const p=instancePaths(instance);\n        for(const key of ['access','grants','deny'] as const){\n          for(const suffix of ['', '.initialized','.owner-token']){\n            const source=selected.files[key]+suffix;if(await exists(source))await atomicPrivate(p[key]+suffix,await readTrusted(source));\n          }\n        }\n        if(Object.keys(selected.secrets).length)await atomicPrivate(path.join(p.state,'secrets.json'),JSON.stringify(selected.secrets));\n        await atomicPrivate(path.join(p.root,'migration.json'),JSON.stringify({schemaVersion:1,at:new Date().toISOString(),sources:preview,sourcePaths:selected.files,oldFilesRetained:true},null,2));\n        return {result:'MIGRATED_NOT_STARTED',instance,oldFilesRetained:true,message:'Start this instance explicitly. Old automatic starts were disabled.'};\n      });\n    }catch(error){\n      if(instance){await changeRegistry(async r=>{r.instances=r.instances.filter(i=>i.id!==instance!.id);if(r.defaultInstanceId===instance!.id)r.defaultInstanceId=null;});await rm(instancePaths(instance).root,{recursive:true,force:true});}\n      const recovery:string[]=[];\n      for(const f of stopped){\n        if(f.details.registered){try{await exec('/bin/launchctl',['enable',`gui/${process.getuid!()}/${f.details.label}`]);await exec('/bin/launchctl',['bootstrap',`gui/${process.getuid!()}`,f.details.plist]);}catch{recovery.push('Restore legacy service '+f.details.label);}}\n        else recovery.push('mac-mcp-gateway run --profile '+f.details.kind);\n      }\n      throw Error('MIGRATION_FAILED: '+(error as Error).message+'; originals retained; recovery: '+recovery.join('; '));\n    }\n  });\n}\n"]}

package/dist/src/instance-runtime.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"instance-runtime.js","sourceRoot":"","sources":["../../src/instance-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,UAAU,EAAC,UAAU,EAAC,WAAW,EAAC,eAAe,EAAC,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAC,YAAY,EAAC,gBAAgB,EAAa,MAAM,UAAU,CAAC;AACnE,OAAO,EAAC,IAAI,EAAmB,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAC,KAAK,EAAC,EAAE,EAAC,QAAQ,EAAC,IAAI,EAAC,KAAK,EAAC,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAC,aAAa,EAAC,MAAM,UAAU,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAC,OAAO,EAAC,MAAM,SAAS,CAAC;AAChC,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AACtB,OAAO,EAAC,WAAW,EAAC,sBAAsB,EAAC,YAAY,EAAC,OAAO,EAAC,MAAM,eAAe,CAAC;AACtF,OAAO,EAAC,cAAc,EAAC,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAC,aAAa,EAAC,cAAc,EAAC,aAAa,EAAC,iBAAiB,EAAC,MAAM,EAAC,WAAW,EAAC,aAAa,EAAC,kBAAkB,EAAC,gBAAgB,EAAC,WAAW,EAAC,eAAe,EAAmC,MAAM,qBAAqB,CAAC;AAEpO,MAAM,cAAc,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,UAAU,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAC,KAAK,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAC,GAAG,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAC,KAAK,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAC,QAAQ,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAC,KAAK,CAAC,CAAC,EAAC,YAAY,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAK7P,SAAS,YAAY,CAAC,EAAS;IAC7B,MAAM,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAC,IAAI,GAAC,EAAE,CAAC,CAAC;IAAA,MAAM,MAAM,GAAC,OAAO,CAAA,CAAC,CAAA,gCAAgC,GAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,EAAE,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,cAAc,CAAC,CAAC;IAC7L,OAAO,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,YAAY,CAAC,EAAC,CAAC;AACzD,CAAC;AACD,MAAM,SAAS,GAAC,CAAC,GAAU,EAAC,OAAc,EAAC,EAAE,CAAA,UAAU,CAAC,QAAQ,EAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpG,SAAS,KAAK,CAAC,CAAS,EAAC,CAAQ,IAAE,OAAO,OAAO,CAAC,KAAG,QAAQ,IAAE,CAAC,CAAC,MAAM,KAAG,CAAC,CAAC,MAAM,IAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC;AACpI,SAAS,KAAK,CAAC,GAAU,IAAE,IAAG,CAAC;IAAA,OAAO,CAAC,IAAI,CAAC,GAAG,EAAC,CAAC,CAAC,CAAC;IAAA,OAAO,IAAI,CAAC;AAAA,CAAC;AAAA,OAAM,CAAC,EAAC,CAAC;IAAA,OAAQ,CAA2B,CAAC,IAAI,KAAG,OAAO,CAAC;AAAA,CAAC,CAAA,CAAC;AAC9H,KAAK,UAAU,QAAQ,CAAC,QAAiB;IACvC,MAAM,CAAC,GAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAAA,IAAG,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC;IACvE,MAAM,KAAK,GAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAY,CAAC,CAAC;IACnF,IAAG,KAAK,CAAC,UAAU,KAAG,QAAQ,CAAC,EAAE;QAAC,MAAM,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAAA,OAAO,KAAK,CAAC;AAClG,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAiB,EAAC,MAA8B,EAAC,QAAgB;IACrG,MAAM,KAAK,GAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAAA,IAAG,CAAC,KAAK,IAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;QAAC,OAAO,IAAI,CAAC;IAC9E,MAAM,KAAK,GAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAAA,MAAM,IAAI,GAAC,IAAI,CAAC,SAAS,CAAC,EAAC,MAAM,EAAC,QAAQ,EAAC,QAAQ,IAAE,IAAI,EAAC,KAAK,EAAC,KAAK,CAAC,KAAK,EAAC,KAAK,EAAC,CAAC,CAAC;IAChI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAC,MAAM,EAAC,EAAE;QACnC,MAAM,MAAM,GAAC,gBAAgB,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QAAA,IAAI,GAAG,GAAC,EAAE,CAAC;QAC3E,MAAM,CAAC,UAAU,CAAC,MAAM,KAAG,QAAQ,CAAA,CAAC,CAAA,IAAI,CAAA,CAAC,CAAA,KAAK,EAAC,GAAE,EAAE,CAAA,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC;QACtG,MAAM,CAAC,EAAE,CAAC,OAAO,EAAC,MAAM,CAAC,CAAC;QAAA,MAAM,CAAC,EAAE,CAAC,SAAS,EAAC,GAAE,EAAE,CAAA,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,IAAI,EAAC,KAAK,EAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAC,IAAI,CAAC,EAAC,CAAC,GAAC,IAAI,CAAC,CAAC,CAAC;QAC7H,MAAM,CAAC,EAAE,CAAC,MAAM,EAAC,IAAI,CAAA,EAAE,GAAC,GAAG,IAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA,IAAG,GAAG,CAAC,MAAM,GAAC,MAAM;YAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;QAC5H,MAAM,CAAC,EAAE,CAAC,KAAK,EAAC,GAAE,EAAE;YAAC,IAAG,CAAC;gBACvB,MAAM,KAAK,GAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAA+B,CAAC;gBAC1D,IAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAC,KAAK,GAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAAC,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAC/G,MAAM,IAAI,GAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAuC,CAAC;gBACxE,IAAG,IAAI,CAAC,KAAK;oBAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACtC,IAAG,IAAI,CAAC,KAAK,CAAC,UAAU,KAAG,QAAQ,CAAC,EAAE,IAAE,IAAI,CAAC,KAAK,CAAC,KAAK,KAAG,KAAK,CAAC,KAAK;oBAAC,MAAM,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBACxH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YAAA,OAAM,CAAC,EAAC,CAAC;gBAAA,MAAM,CAAC,CAAC,CAAC,CAAC;YAAA,CAAC;QAAA,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAiB,EAAC,IAAI,GAAC,OAAO,EAAE;IACnE,IAAI,OAAO,GAAmB,IAAI,CAAC;IAAA,IAAI,cAAc,GAAa,IAAI,CAAC;IACvE,IAAG,CAAC;QAAA,OAAO,GAAC,MAAM,eAAe,CAAC,QAAQ,EAAC,QAAQ,CAAC,CAAC;IAAA,CAAC;IAAA,OAAM,CAAC,EAAC,CAAC;QAAA,cAAc,GAAE,CAAW,CAAC,OAAO,CAAC;IAAA,CAAC;IACpG,IAAI,KAAK,GAAqD,IAAI,CAAC;IAAA,IAAI,aAAa,GAAa,IAAI,CAAC;IACtG,IAAG,CAAC;QAAA,KAAK,GAAC,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAAA,CAAC;IAAA,OAAM,CAAC,EAAC,CAAC;QAAA,aAAa,GAAE,CAAW,CAAC,OAAO,CAAC;IAAA,CAAC;IAC3F,IAAI,WAAW,GAAmB,IAAI,CAAC;IACvC,IAAG,CAAC,OAAO;QAAC,IAAG,CAAC;YAAA,WAAW,GAAC,IAAI,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAC,IAAI,CAAC,CAAC,SAAS,EAAC,mBAAmB,CAAC,CAAC,CAAiB,CAAC;QAAA,CAAC;QAAA,MAAK,CAAC,CAAA,CAAC;IACzJ,IAAG,CAAC,OAAO,IAAE,WAAW,EAAE,OAAO;QAAC,cAAc,KAAG,WAAW,CAAC,OAAO,CAAC;IACvE,IAAI,MAAM,GAAC,aAAa,CAAC;IAAA,IAAI,UAAU,GAAa,IAAI,CAAC;IAAA,IAAI,cAAc,GAAa,IAAI,CAAC;IAC7F,IAAG,OAAO,EAAE,KAAK,KAAG,SAAS,IAAE,OAAO,CAAC,IAAI,EAAC,CAAC;QAC3C,IAAG,CAAC;YACF,MAAM,QAAQ,GAAC,MAAM,KAAK,CAAC,oBAAoB,OAAO,CAAC,IAAI,UAAU,EAAC,EAAC,MAAM,EAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC;YAC1G,MAAM,IAAI,GAAC,MAAM,QAAQ,CAAC,IAAI,EAA4D,CAAC;YAC3F,MAAM,GAAC,QAAQ,CAAC,EAAE,IAAE,IAAI,CAAC,MAAM,KAAG,IAAI,IAAE,IAAI,CAAC,UAAU,KAAG,QAAQ,CAAC,EAAE,CAAA,CAAC,CAAA,IAAI,CAAA,CAAC,CAAA,cAAc,CAAC;YAAA,UAAU,GAAC,IAAI,CAAC,UAAU,IAAE,IAAI,CAAC;YAC3H,MAAM,QAAQ,GAAC,MAAM,KAAK,CAAC,oBAAoB,OAAO,CAAC,IAAI,gBAAgB,EAAC,EAAC,MAAM,EAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,EAAE,CAA6B,CAAC;YAC9J,cAAc,GAAC,OAAO,QAAQ,CAAC,cAAc,KAAG,QAAQ,CAAA,CAAC,CAAA,QAAQ,CAAC,cAAc,CAAA,CAAC,CAAA,IAAI,CAAC;QACxF,CAAC;QAAA,MAAK,CAAC;YAAA,MAAM,GAAC,aAAa,CAAC;QAAA,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,GAAC,OAAO,EAAE,MAAM,IAAE,IAAI,CAAC;IACjC,IAAG,CAAC,MAAM;QAAC,IAAG,CAAC;YAAA,MAAM,GAAC,IAAI,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAC,IAAI,CAAC,CAAC,SAAS,EAAC,aAAa,CAAC,CAAC,CAAiB,CAAC;QAAA,CAAC;QAAA,MAAK,CAAC,CAAA,CAAC;IAC7I,MAAM,WAAW,GAAC,aAAa,CAAA,CAAC,CAAA,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,SAAS,CAAC,CAAA,CAAC,CAAA,OAAO,EAAE,KAAK,KAAG,SAAS,CAAA,CAAC,CAAA,CAAC,KAAK,EAAE,iBAAiB,KAAG,MAAM,EAAE,iBAAiB,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,SAAS,CAAC,CAAA,CAAC,CAAA,eAAe,CAAC;IAC7M,OAAO,EAAC,aAAa,EAAC,CAAC,EAAC,KAAK,EAAC,gBAAgB,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,IAAI,EAAC,QAAQ,CAAC,IAAI,EAAC,QAAQ,EAAC,QAAQ,CAAC,QAAQ,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM;QACxI,KAAK,EAAC,OAAO,EAAE,KAAK,IAAE,CAAC,cAAc,CAAA,CAAC,CAAA,OAAO,CAAA,CAAC,CAAA,SAAS,CAAC,EAAC,WAAW,EAAC,aAAa,EAAC,cAAc,EAAC,OAAO;QACzG,IAAI,EAAC,OAAO,EAAE,IAAI,IAAE,KAAK,EAAE,MAAM,CAAC,IAAI,IAAE,IAAI,EAAC,cAAc,EAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAE,IAAI,EAAC,MAAM,EAAC,QAAQ,EAAC,KAAK,EAAE,QAAQ,IAAE,IAAI;QAC1H,MAAM,EAAC,UAAU,EAAC,cAAc,EAAC,OAAO,EAAC,QAAQ,CAAC,MAAM,IAAE,OAAO,EAAC,SAAS,EAAC,KAAK,EAAC,UAAU,EAAC,KAAK;QAClG,KAAK,EAAC,QAAQ,CAAC,IAAI,EAAC,aAAa,EAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,IAAE,KAAK,EAAE,MAAM,CAAC,IAAI,IAAE,IAAI;QACxF,UAAU,EAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,IAAE,KAAK,EAAE,MAAM,CAAC,UAAU,IAAE,IAAI,EAAC,WAAW,EAAC,OAAO,EAAE,KAAK,KAAG,SAAS,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,aAAa;QAC5I,YAAY,EAAC,OAAO,EAAE,QAAQ,IAAE,SAAS,EAAC,YAAY,EAAC,OAAO,EAAE,GAAG,IAAE,IAAI,EAAC,WAAW,EAAC,OAAO,EAAE,GAAG,IAAE,IAAI;QACxG,aAAa,EAAC,OAAO,EAAE,KAAK,KAAG,SAAS,CAAA,CAAC,CAAA,CAAC,OAAO,CAAC,aAAa,KAAG,YAAY,CAAA,CAAC,CAAA,YAAY,CAAA,CAAC,CAAA,kBAAkB,CAAC,CAAA,CAAC,CAAA,SAAS,EAAC,cAAc,EAAC,UAAU;QACnJ,eAAe,EAAC,MAAM,KAAG,IAAI,CAAA,CAAC,CAAA,CAAC,cAAc,CAAA,CAAC,CAAA,+BAA+B,CAAA,CAAC,CAAA,+BAA+B,CAAC,CAAA,CAAC,CAAA,MAAM,EAAC,cAAc,EAAC,QAAQ,CAAC,cAAc,EAAC,CAAC;AAClK,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAiB,EAAC,UAA2H,EAAE;IAC/K,MAAM,IAAI,GAAC,OAAO,CAAC,IAAI,IAAE,OAAO,EAAE,CAAC;IAAA,MAAM,MAAM,GAAC,OAAO,CAAC,YAAY,CAAC;IACrE,IAAG,MAAM,KAAG,SAAS,IAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAE,MAAM,GAAC,CAAC,IAAE,OAAO,CAAC,IAAI,KAAG,MAAM,CAAC;QAAC,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACpI,IAAG,QAAQ,CAAC,QAAQ;QAAC,MAAM,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACtD,MAAM,OAAO,GAAC,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAAA,MAAM,iBAAiB,CAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAC,IAAI,CAAC,EAAC,IAAI,CAAC,CAAC;IACvH,MAAM,CAAC,GAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAAA,sBAAsB,CAAC,WAAW,EAAE,CAAC,CAAC;IACxE,MAAM,KAAK,GAAO,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,KAAK,EAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAC,GAAG,EAAC,OAAO,CAAC,GAAG,EAAC,KAAK,EAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAC,QAAQ,EAAC,MAAM,CAAA,CAAC,CAAA,KAAK,CAAA,CAAC,CAAA,KAAK,EAAC,YAAY,EAAC,MAAM,IAAE,IAAI,EAAC,CAAC;IAC7L,MAAM,cAAc,CAAC,KAAK,EAAC,QAAQ,EAAA,EAAE;QACnC,MAAM,UAAU,GAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QAChE,IAAG,CAAC,UAAU,IAAE,UAAU,CAAC,QAAQ;YAAC,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClF,IAAG,CAAC;YAAA,MAAM,KAAK,CAAC,CAAC,CAAC,IAAI,EAAC,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;QAAA,CAAC;QAAA,OAAM,CAAC,EAAC,CAAC;YAC7C,IAAI,CAA2B,CAAC,IAAI,KAAG,QAAQ;gBAAC,MAAM,CAAC,CAAC;YACxD,MAAM,GAAG,GAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAAA,IAAG,CAAC,GAAG,IAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAC,MAAM,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACnH,6EAA6E;YAC7E,MAAM,QAAQ,GAAC,CAAC,CAAC,IAAI,GAAC,WAAW,CAAC;YAAA,MAAM,KAAK,CAAC,QAAQ,EAAC,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;YACrE,IAAG,CAAC;gBAAA,MAAM,KAAK,GAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAAA,IAAG,CAAC,KAAK,IAAE,KAAK,CAAC,KAAK,KAAG,GAAG,CAAC,KAAK,IAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;oBAAC,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBACpI,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,CAAC,CAAC;gBAAA,MAAM,KAAK,CAAC,CAAC,CAAC,IAAI,EAAC,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;YACrE,CAAC;oBAAO,CAAC;gBAAA,MAAM,EAAE,CAAC,QAAQ,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC;YAAA,CAAC;QAC3D,CAAC;QACD,MAAM,aAAa,CAAC,CAAC,CAAC,IAAI,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,CAAC,EAAC,IAAI,CAAC,CAAC;IACR,MAAM,QAAQ,GAAC,MAAM,eAAe,EAAE,CAAC;IACvC,MAAM,KAAK,GAAc,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,KAAK,EAAC,KAAK,CAAC,KAAK,EAAC,GAAG,EAAC,OAAO,CAAC,GAAG,EAAC,QAAQ,EAAC,KAAK,CAAC,QAAQ,EAAC,YAAY,EAAC,MAAM,IAAE,IAAI,EAAC,aAAa,EAAC,OAAO,CAAC,UAAU,CAAA,CAAC,CAAA,YAAY,CAAA,CAAC,CAAA,YAAY,EAAC,KAAK,EAAC,UAAU,EAAC,IAAI,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,IAAI,EAAC,GAAG,QAAQ,EAAC,CAAC;IACjQ,IAAI,MAAM,GAAmB,IAAI,CAAC;IAAA,IAAI,SAAS,GAAiD,IAAI,CAAC;IAAA,IAAI,MAAM,GAAa,IAAI,CAAC;IACjI,IAAI,MAAM,GAAC,KAAK,CAAC;IAAA,IAAI,kBAAkB,GAAC,KAAK,CAAC;IAAA,IAAI,QAAQ,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC9F,IAAI,MAAgB,CAAC;IAAA,MAAM,QAAQ,GAAC,IAAI,OAAO,CAAO,CAAC,CAAA,EAAE,GAAC,MAAM,GAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;IACtE,MAAM,SAAS,GAAC,CAAI,EAAiB,EAAY,EAAE,GAAC,MAAM,IAAI,GAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA,QAAQ,GAAC,IAAI,CAAC,KAAK,CAAC,GAAE,EAAE,GAAC,CAAC,CAAC,CAAC,CAAA,OAAO,IAAI,CAAC,CAAA,CAAC,CAAC;IAC3H,SAAS,IAAI,CAAC,KAAY;QACxB,IAAG,OAAO,CAAC,IAAI,IAAE,CAAC,OAAO,CAAC,OAAO;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,KAAK,EAAC,GAAG,KAAK,EAAC,CAAC,GAAC,IAAI,CAAC,CAAC;aACzF,IAAG,KAAK,KAAG,gBAAgB,IAAE,KAAK,KAAG,uBAAuB;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,mCAAmC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;aAC1K,IAAG,KAAK,KAAG,kBAAkB;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,UAAU,UAAU;QACvB,MAAM,KAAK,GAAC,MAAM,CAAC;QAAA,IAAG,CAAC,KAAK;YAAC,OAAO;QAAA,kBAAkB,GAAC,IAAI,CAAC;QAC5D,MAAM,IAAI,OAAO,CAAO,OAAO,CAAA,EAAE;YAC/B,IAAG,KAAK,CAAC,QAAQ,KAAG,IAAI,IAAE,KAAK,CAAC,UAAU,KAAG,IAAI,EAAC,CAAC;gBAAA,OAAO,EAAE,CAAC;gBAAA,OAAO;YAAA,CAAC;YACrE,IAAI,MAAM,GAAC,KAAK,CAAC;YACjB,MAAM,KAAK,GAAC,UAAU,CAAC,GAAE,EAAE,GAAC,MAAM,GAAC,IAAI,CAAC,CAAA,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA,CAAC,EAAC,IAAI,CAAC,CAAC;YACtE,KAAK,CAAC,IAAI,CAAC,MAAM,EAAC,GAAE,EAAE,GAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA,IAAG,MAAM;gBAAC,KAAK,CAAC,OAAO,GAAC,oBAAoB,CAAC,CAAA,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC;YACrG,IAAG,KAAK,CAAC,SAAS;gBAAC,KAAK,CAAC,IAAI,CAAC,EAAC,IAAI,EAAC,cAAc,EAAC,CAAC,CAAC;;gBAAK,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QAAA,MAAM,GAAC,IAAI,CAAC;QAAA,kBAAkB,GAAC,KAAK,CAAC;IAC1C,CAAC;IACD,KAAK,UAAU,QAAQ,CAAC,MAAc;QACpC,IAAG,MAAM;YAAC,OAAO;QAAA,MAAM,GAAC,IAAI,CAAC;QAAA,KAAK,CAAC,OAAO,GAAC,MAAM,IAAE,IAAI,CAAC;QAAA,KAAK,CAAC,KAAK,GAAC,UAAU,CAAC;QAAA,MAAM,UAAU,EAAE,CAAC;QAClG,MAAM,SAAS,EAAE,OAAO,EAAE,CAAC;QAAA,SAAS,GAAC,IAAI,CAAC;QAAA,KAAK,CAAC,KAAK,GAAC,SAAS,CAAC;QAAA,KAAK,CAAC,IAAI,GAAC,IAAI,CAAC;QAAA,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAAA,MAAM,EAAE,CAAC;IACpH,CAAC;IACD,KAAK,UAAU,WAAW,CAAC,MAAmB,EAAC,KAAgD;QAC7F,MAAM,iBAAiB,CAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAC,IAAI,CAAC,EAAC,IAAI,CAAC,CAAC;QACtE,IAAG,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,eAAe,GAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5F,MAAM,GAAG,GAAmB,EAAE,CAAC;QAAA,KAAI,MAAM,GAAG,IAAI,YAAY;YAAC,IAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAC,GAAG,CAAC,GAAG,CAAC,GAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAC5G,MAAM,CAAC,MAAM,CAAC,GAAG,EAAC,WAAW,CAAC,QAAQ,EAAC,MAAM,CAAC,MAAM,EAAC,IAAI,CAAC,EAAC,EAAC,gCAAgC,EAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAC,6BAA6B,EAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAC,4BAA4B,EAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAC,CAAC,CAAC;QAClN,MAAM,YAAY,GAAC,MAAM,gBAAgB,CAAC,QAAQ,EAAC,MAAM,CAAC,MAAM,EAAC,IAAI,CAAC,CAAC;QAAA,IAAG,YAAY;YAAC,GAAG,CAAC,sBAAsB,GAAC,YAAY,CAAC;QAC/H,MAAM,GAAG,GAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAC,IAAI,CAAC,CAAC,IAAI,EAAC,UAAU,CAAC,CAAC;QAClE,IAAG,MAAM,MAAM,CAAC,GAAG,CAAC;YAAC,MAAM,WAAW,CAAC,GAAG,EAAC,IAAI,EAAC,EAAE,GAAC,IAAI,GAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAC,MAAM,IAAI,CAAC,GAAG,EAAC,GAAG,EAAC,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,IAAE,IAAI,GAAG,CAAC,sBAAsB,EAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAC,EAAE,EAAC,EAAC,GAAG,EAAC,KAAK,EAAC,CAAC,QAAQ,EAAC,MAAM,CAAC,EAAE,EAAC,MAAM,CAAC,EAAE,EAAC,KAAK,CAAC,EAAC,CAAC,CAAC;QAAA,MAAM,GAAC,KAAK,CAAC;QAAA,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7L,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAC,MAAM,EAAC,EAAE;YACxC,MAAM,KAAK,GAAC,UAAU,CAAC,GAAE,EAAE,CAAA,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAC,KAAK,CAAC,CAAC;YAC1E,MAAM,KAAK,GAAC,CAAC,OAAe,EAAC,EAAE,GAAC,IAAG,OAAO,IAAE,OAAO,OAAO,KAAG,QAAQ,IAAE,MAAM,IAAI,OAAO,IAAE,OAAO,CAAC,IAAI,KAAG,eAAe,EAAC,CAAC;gBAAA,YAAY,CAAC,KAAK,CAAC,CAAC;gBAAA,KAAK,CAAC,GAAG,CAAC,MAAM,EAAC,MAAM,CAAC,CAAC;gBAAA,KAAK,CAAC,GAAG,CAAC,OAAO,EAAC,MAAM,CAAC,CAAC;gBAAA,KAAK,CAAC,GAAG,CAAC,SAAS,EAAC,KAAK,CAAC,CAAC;gBAAA,OAAO,EAAE,CAAC;YAAA,CAAC,CAAA,CAAC,CAAC;YACzO,MAAM,MAAM,GAAC,GAAE,EAAE,GAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA,KAAK,CAAC,GAAG,CAAC,SAAS,EAAC,KAAK,CAAC,CAAC,CAAA,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC;YACjI,KAAK,CAAC,IAAI,CAAC,OAAO,EAAC,MAAM,CAAC,CAAC;YAAA,KAAK,CAAC,IAAI,CAAC,MAAM,EAAC,MAAM,CAAC,CAAC;YAAA,KAAK,CAAC,EAAE,CAAC,SAAS,EAAC,KAAK,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,GAAC,MAAM,CAAC;QAAA,KAAK,CAAC,IAAI,GAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAAA,KAAK,CAAC,KAAK,GAAC,SAAS,CAAC;QAAA,KAAK,CAAC,WAAW,EAAE,CAAC;QAC5F,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAC,IAAI,CAAC,CAAC,SAAS,EAAC,aAAa,CAAC,EAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAC,IAAI,EAAC,CAAC,CAAC,CAAC,CAAC;QACnH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAC,GAAE,EAAE,GAAC,IAAG,CAAC,kBAAkB,IAAE,CAAC,MAAM,EAAC,CAAC;YAAA,KAAK,CAAC,KAAK,GAAC,OAAO,CAAC;YAAA,KAAK,CAAC,OAAO,GAAC,wBAAwB,CAAC;YAAA,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAAA,KAAK,SAAS,CAAC,GAAE,EAAE,CAAA,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAAA,CAAC,CAAA,CAAC,CAAC,CAAC;QACrM,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,MAAM,GAAC,CAAC,MAAqB,EAAc,EAAE,CAAA,CAAC,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,EAAC,QAAQ,EAAC,MAAM,CAAC,QAAQ,EAAC,iBAAiB,EAAC,MAAM,CAAC,iBAAiB,EAAC,UAAU,EAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAC,CAAC,CAAC;IAC9K,KAAK,UAAU,KAAK,CAAC,QAAoB;QACvC,IAAG,MAAM;YAAC,MAAM,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAC,IAAI,CAAC,CAAC;QAAA,MAAM,IAAI,GAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACnG,IAAG,CAAC,QAAQ,IAAE,IAAI,CAAC,QAAQ,KAAG,QAAQ;YAAC,MAAM,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC1G,MAAM,iBAAiB,CAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAC,IAAI,CAAC,EAAC,IAAI,CAAC,CAAC;QAAA,MAAM,gBAAgB,CAAC,QAAQ,EAAC,IAAI,CAAC,MAAM,EAAC,IAAI,CAAC,CAAC;QACxH,MAAM,QAAQ,GAAC,KAAK,CAAC,MAAM,CAAC;QAAA,IAAG,CAAC,QAAQ,IAAE,CAAC,SAAS;YAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACzF,MAAM,QAAQ,GAAC,SAAS,CAAC;QAAA,IAAI,cAAc,GAAC,QAAQ,CAAC;QACrD,IAAG,IAAI,CAAC,MAAM,CAAC,IAAI,KAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAC,CAAC;YAC1C,IAAG,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,eAAe,GAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACxF,cAAc,GAAC,MAAM,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAC,EAAC,QAAQ,EAAC,KAAK,CAAC,QAAQ,EAAC,CAAC,CAAC;YAAA,cAAc,CAAC,MAAM,CAAC,KAAK,IAAE,EAAE,GAAC,KAAK,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA,OAAO,SAAS,CAAC,CAAA,CAAC,CAAC,CAAC;QAC/J,CAAC;QACD,KAAK,CAAC,KAAK,GAAC,UAAU,CAAC;QAAA,MAAM,UAAU,EAAE,CAAC;QAAA,KAAK,CAAC,OAAO,GAAC,IAAI,CAAC;QAC7D,IAAG,CAAC;YACF,MAAM,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAC,cAAc,CAAC,CAAC;YAAA,SAAS,GAAC,cAAc,CAAC;YACxE,IAAG,cAAc,KAAG,QAAQ;gBAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;QACxD,CAAC;QAAA,OAAM,KAAK,EAAC,CAAC;YACZ,MAAM,UAAU,EAAE,CAAC;YAAA,IAAG,cAAc,KAAG,QAAQ;gBAAC,MAAM,cAAc,CAAC,OAAO,EAAE,CAAC;YAAA,SAAS,GAAC,QAAQ,CAAC;YAClG,KAAK,CAAC,OAAO,GAAC,yBAAyB,GAAE,KAAe,CAAC,OAAO,CAAC;YACjE,IAAG,CAAC;gBAAA,MAAM,WAAW,CAAC,QAAQ,EAAC,QAAQ,CAAC,CAAC;YAAA,CAAC;YAAA,MAAK,CAAC;gBAC9C,MAAM,UAAU,EAAE,CAAC;gBAAA,KAAK,CAAC,KAAK,GAAC,OAAO,CAAC;gBAAA,KAAK,CAAC,OAAO,GAAC,iDAAiD,CAAC;YACzG,CAAC;YACD,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAAA,MAAM,KAAK,CAAC,KAAK,CAAC,OAAQ,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAC,GAAE,EAAE,GAAC,KAAK,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAC,MAAM,CAAA,CAAC,CAAA,WAAW,CAAC,GAAE,EAAE,GAAC,IAAG,OAAO,CAAC,IAAI,KAAG,MAAM;QAAC,MAAM,EAAE,CAAC,CAAA,CAAC,EAAC,GAAG,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC;IACxF,WAAW,EAAE,KAAK,EAAE,CAAC;IAAA,OAAO,CAAC,EAAE,CAAC,SAAS,EAAC,MAAM,CAAC,CAAC;IAAA,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAC,MAAM,CAAC,CAAC;IAC9E,IAAG,CAAC;QACF,MAAM,GAAC,YAAY,CAAC,EAAC,aAAa,EAAC,IAAI,EAAC,EAAC,MAAM,CAAA,EAAE;YAC/C,MAAM,CAAC,UAAU,CAAC,KAAK,EAAC,GAAE,EAAE,CAAA,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAAA,IAAI,GAAG,GAAC,EAAE,CAAC;YAAA,IAAI,OAAO,GAAC,KAAK,CAAC;YAC3E,MAAM,CAAC,EAAE,CAAC,OAAO,EAAC,GAAE,EAAE,GAAC,CAAC,CAAC,CAAC;YAAA,MAAM,CAAC,EAAE,CAAC,MAAM,EAAC,KAAK,CAAA,EAAE;gBAChD,IAAG,OAAO;oBAAC,OAAO;gBAAA,GAAG,IAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAA,IAAG,GAAG,CAAC,MAAM,GAAC,IAAI,EAAC,CAAC;oBAAA,MAAM,CAAC,OAAO,EAAE,CAAC;oBAAA,OAAO;gBAAA,CAAC;gBAAA,IAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAC,OAAO;gBAAA,OAAO,GAAC,IAAI,CAAC;gBAC7H,KAAK,CAAC,KAAK,IAAE,EAAE;oBACb,IAAI,KAAK,GAAC,EAAE,CAAC;oBAAA,IAAG,CAAC;wBACf,MAAM,QAAQ,GAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAA+B,CAAC;wBAC7D,IAAG,OAAO,QAAQ,CAAC,IAAI,KAAG,QAAQ,IAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;4BAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;wBAC9H,MAAM,GAAG,GAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAmE,CAAC;wBAAA,KAAK,GAAC,GAAG,CAAC,KAAK,CAAC;wBACtH,IAAG,GAAG,CAAC,KAAK,KAAG,KAAK,CAAC,KAAK,IAAE,CAAE,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;4BAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;wBACzF,IAAG,GAAG,CAAC,MAAM,KAAG,MAAM;4BAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;6BAC5C,IAAG,GAAG,CAAC,MAAM,KAAG,OAAO;4BAAC,MAAM,SAAS,CAAC,GAAE,EAAE,CAAA,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;6BACjE,IAAG,GAAG,CAAC,MAAM,KAAG,QAAQ;4BAAC,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;wBACpE,MAAM,IAAI,GAAC,IAAI,CAAC,SAAS,CAAC,EAAC,KAAK,EAAC,CAAC,CAAC;wBAAA,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,IAAI,EAAC,KAAK,EAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAC,KAAK,GAAC,IAAI,CAAC,EAAC,CAAC,GAAC,IAAI,CAAC,CAAC;oBACrH,CAAC;oBAAA,OAAM,KAAK,EAAC,CAAC;wBAAA,MAAM,IAAI,GAAC,IAAI,CAAC,SAAS,CAAC,EAAC,KAAK,EAAC,KAAK,EAAE,KAAe,CAAC,OAAO,EAAC,CAAC,CAAC;wBAAA,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,IAAI,EAAC,KAAK,EAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAC,KAAK,GAAC,IAAI,CAAC,EAAC,CAAC,GAAC,IAAI,CAAC,CAAC;oBAAA,CAAC;gBACnK,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAC,MAAM,EAAC,EAAE,GAAC,MAAO,CAAC,IAAI,CAAC,OAAO,EAAC,MAAM,CAAC,CAAC,CAAA,MAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAC,GAAE,EAAE,CAAA,OAAO,EAAE,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;QAClH,SAAS,GAAC,MAAM,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAC,EAAC,QAAQ,EAAC,KAAK,CAAC,QAAQ,EAAC,CAAC,CAAC;QAC9E,SAAS,CAAC,MAAM,CAAC,KAAK,IAAE,EAAE,GAAC,KAAK,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA,OAAO,SAAS,CAAC,CAAA,CAAC,CAAC,CAAC;QACxE,MAAM,SAAS,CAAC,GAAE,EAAE,CAAA,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAC,SAAU,CAAC,CAAC,CAAC;QAC7D,IAAG,OAAO,CAAC,OAAO;YAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;aACtC,IAAG,CAAC,OAAO,CAAC,IAAI;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,IAAI,sBAAsB,KAAK,CAAC,IAAI,iBAAiB,QAAQ,CAAC,MAAM,CAAC,IAAI,iCAAiC,CAAC,CAAC;QACrK,MAAM,QAAQ,CAAC;IACjB,CAAC;IAAA,OAAM,KAAK,EAAC,CAAC;QAAA,KAAK,CAAC,KAAK,GAAC,OAAO,CAAC;QAAA,KAAK,CAAC,OAAO,GAAE,KAAe,CAAC,OAAO,CAAC;QAAA,MAAM,KAAK,CAAC;IAAA,CAAC;YAAO,CAAC;QAC5F,IAAG,WAAW;YAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAAA,OAAO,CAAC,GAAG,CAAC,SAAS,EAAC,MAAM,CAAC,CAAC;QAAA,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAC,MAAM,CAAC,CAAC;QACrG,MAAM,UAAU,EAAE,CAAC;QAAA,MAAM,SAAS,EAAE,OAAO,EAAE,CAAC;QAC9C,IAAG,MAAM;YAAC,MAAM,IAAI,OAAO,CAAO,OAAO,CAAA,EAAE,CAAA,MAAO,CAAC,KAAK,CAAC,GAAE,EAAE,CAAA,OAAO,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAC,IAAI,CAAC,CAAC,SAAS,EAAC,mBAAmB,CAAC,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACjH,MAAM,OAAO,GAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAAA,IAAG,OAAO,EAAE,KAAK,KAAG,KAAK,CAAC,KAAK;YAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC;IACtH,CAAC;AACH,CAAC","sourcesContent":["import {createHash,createHmac,randomBytes,timingSafeEqual} from 'node:crypto';\nimport {createServer,createConnection,type Server} from 'node:net';\nimport {fork,type ChildProcess} from 'node:child_process';\nimport {mkdir,rm,readFile,open,lstat} from 'node:fs/promises';\nimport {fileURLToPath} from 'node:url';\nimport path from 'node:path';\nimport {homedir} from 'node:os';\nimport {z} from 'zod';\nimport {controlRoot,createPrivateDirectory,childEnvKeys,windows} from './platform.js';\nimport {acquireControl} from './global-core-control.js';\nimport {runtimeIdentity} from './runtime-identity.js';\nimport {atomicPrivate,changeRegistry,availablePort,ensureAccessReady,exists,instanceEnv,instancePaths,loadInstanceConfig,prepareUpstreams,readTrusted,resolveInstance,type Instance,type InstanceConfig} from './instance-store.js';\n\nconst metadataSchema=z.object({instanceId:z.string().uuid(),runId:z.string().regex(/^[a-f0-9]{32}$/),pid:z.number().int().min(2),token:z.string().regex(/^[a-f0-9]{64}$/),launcher:z.enum(['cli','app']),appParentPid:z.number().int().nullable()}).strict();\ntype Owner=z.infer<typeof metadataSchema>;\nexport type ActiveConfig={config:InstanceConfig;revision:string;effectiveRevision:string;sourcePath:string};\nexport type RuntimeState={instanceId:string;runId:string;pid:number;launcher:'cli'|'app';appParentPid:number|null;executionMode?:'foreground'|'background';\n  phase:'starting'|'running'|'stopping'|'stopped'|'error';port:number|null;active:ActiveConfig|null;problem:string|null;coreProgram:string;buildVersion:string};\nfunction runtimePaths(id:string){\n  const root=path.join(controlRoot(),'i-'+id);const socket=windows?'\\\\\\\\.\\\\pipe\\\\gateway-instance-'+createHash('sha256').update(root).digest('hex').slice(0,28):path.join(root,'control.sock');\n  return {root,socket,meta:path.join(root,'owner.json')};\n}\nconst signature=(key:string,message:string)=>createHmac('sha256',key).update(message).digest('hex');\nfunction equal(a:unknown,b:string){return typeof a==='string'&&a.length===b.length&&timingSafeEqual(Buffer.from(a),Buffer.from(b));}\nfunction alive(pid:number){try{process.kill(pid,0);return true;}catch(e){return (e as NodeJS.ErrnoException).code!=='ESRCH';}}\nasync function ownerFor(instance:Instance){\n  const p=runtimePaths(instance.id);if(!await exists(p.root))return null;\n  const owner=metadataSchema.parse(JSON.parse(await readTrusted(p.meta)) as unknown);\n  if(owner.instanceId!==instance.id)throw Error('INSTANCE_CONTROL_IDENTITY_INVALID');return owner;\n}\nexport async function instanceRequest(instance:Instance,method:'status'|'stop'|'apply',revision?:string):Promise<RuntimeState|null>{\n  const owner=await ownerFor(instance);if(!owner||!alive(owner.pid))return null;\n  const nonce=randomBytes(24).toString('hex');const body=JSON.stringify({method,revision:revision??null,runId:owner.runId,nonce});\n  return new Promise((resolve,reject)=>{\n    const socket=createConnection(runtimePaths(instance.id).socket);let raw='';\n    socket.setTimeout(method==='status'?2000:65000,()=>socket.destroy(Error('INSTANCE_CONTROL_TIMEOUT')));\n    socket.on('error',reject);socket.on('connect',()=>socket.end(JSON.stringify({body,proof:signature(owner.token,body)})+'\\n'));\n    socket.on('data',data=>{raw+=String(data);if(raw.length>524288)socket.destroy(Error('INSTANCE_CONTROL_REPLY_TOO_LARGE'));});\n    socket.on('end',()=>{try{\n      const reply=JSON.parse(raw) as {body:string;proof:string};\n      if(!equal(reply.proof,signature(owner.token,nonce+reply.body)))throw Error('INSTANCE_CONTROL_REPLY_UNTRUSTED');\n      const data=JSON.parse(reply.body) as {state:RuntimeState;error?:string};\n      if(data.error)throw Error(data.error);\n      if(data.state.instanceId!==instance.id||data.state.runId!==owner.runId)throw Error('INSTANCE_CONTROL_IDENTITY_CHANGED');\n      resolve(data.state);\n    }catch(e){reject(e);}});\n  });\n}\nexport async function instanceStatus(instance:Instance,home=homedir()){\n  let runtime:RuntimeState|null=null;let runtimeProblem:string|null=null;\n  try{runtime=await instanceRequest(instance,'status');}catch(e){runtimeProblem=(e as Error).message;}\n  let saved:Awaited<ReturnType<typeof loadInstanceConfig>>|null=null;let configProblem:string|null=null;\n  try{saved=await loadInstanceConfig(instance);}catch(e){configProblem=(e as Error).message;}\n  let lastRuntime:RuntimeState|null=null;\n  if(!runtime)try{lastRuntime=JSON.parse(await readTrusted(path.join(instancePaths(instance,home).snapshots,'last-runtime.json'))) as RuntimeState;}catch{}\n  if(!runtime&&lastRuntime?.problem)runtimeProblem??=lastRuntime.problem;\n  let health='not-running';let accessMode:string|null=null;let lastToolCallAt:string|null=null;\n  if(runtime?.phase==='running'&&runtime.port){\n    try{\n      const response=await fetch(`http://127.0.0.1:${runtime.port}/healthz`,{signal:AbortSignal.timeout(1500)});\n      const data=await response.json() as {status?:string;instanceId?:string;accessMode?:string};\n      health=response.ok&&data.status==='ok'&&data.instanceId===instance.id?'ok':'unrecognized';accessMode=data.accessMode??null;\n      const activity=await fetch(`http://127.0.0.1:${runtime.port}/activity.json`,{signal:AbortSignal.timeout(1000)}).then(r=>r.json()) as {lastToolCallAt?:string};\n      lastToolCallAt=typeof activity.lastToolCallAt==='string'?activity.lastToolCallAt:null;\n    }catch{health='unreachable';}\n  }\n  let active=runtime?.active??null;\n  if(!active)try{active=JSON.parse(await readTrusted(path.join(instancePaths(instance,home).snapshots,'active.json'))) as ActiveConfig;}catch{}\n  const configState=configProblem?(configProblem.includes('ENOENT')?'missing':'invalid'):runtime?.phase==='running'?(saved?.effectiveRevision===active?.effectiveRevision?'applied':'pending'):'on-next-start';\n  return {schemaVersion:1,event:'GATEWAY_STATUS',instanceId:instance.id,name:instance.name,archived:instance.archived,source:instance.source,\n    phase:runtime?.phase??(runtimeProblem?'error':'stopped'),configState,configProblem,runtimeProblem,runtime,\n    port:runtime?.port??saved?.config.port??null,configuredPort:saved?.config.port??null,active,revision:saved?.revision??null,\n    health,accessMode,lastToolCallAt,profile:instance.legacy??'setup',installed:false,registered:false,\n    label:instance.name,workspaceMode:runtime?.active?.config.mode??saved?.config.mode??null,\n    writeScope:runtime?.active?.config.writeScope??saved?.config.writeScope??null,coreControl:runtime?.phase==='running'?'RUNNING':'unavailable',\n    coreLauncher:runtime?.launcher??'unknown',coreOwnerPid:runtime?.pid??null,listenerPid:runtime?.pid??null,\n    executionMode:runtime?.phase==='running'?(runtime.executionMode==='background'?'background':'foreground-owned'):'stopped',loginAutostart:'disabled',\n    connectionState:health==='ok'?(lastToolCallAt?'local-ready-activity-recorded':'local-ready-remote-unverified'):health,requiredAccess:instance.requiredAccess};\n}\nexport async function runInstance(instance:Instance,options:{home?:string;appParentPid?:number;json?:boolean;background?:boolean;workerModule?:URL;onReady?:()=>Promise<void>}={}){\n  const home=options.home??homedir();const parent=options.appParentPid;\n  if(parent!==undefined&&(!Number.isSafeInteger(parent)||parent<2||process.ppid!==parent))throw Error('APP_PARENT_IDENTITY_MISMATCH');\n  if(instance.archived)throw Error('INSTANCE_ARCHIVED');\n  const initial=await loadInstanceConfig(instance);await ensureAccessReady(await resolveInstance(instance.id,home),home);\n  const p=runtimePaths(instance.id);createPrivateDirectory(controlRoot());\n  const owner:Owner={instanceId:instance.id,runId:randomBytes(16).toString('hex'),pid:process.pid,token:randomBytes(32).toString('hex'),launcher:parent?'app':'cli',appParentPid:parent??null};\n  await changeRegistry(async registry=>{\n    const registered=registry.instances.find(i=>i.id===instance.id);\n    if(!registered||registered.archived)throw Error('INSTANCE_ARCHIVED_OR_REMOVED');\n  try{await mkdir(p.root,{mode:0o700});}catch(e){\n    if((e as NodeJS.ErrnoException).code!=='EEXIST')throw e;\n    const old=await ownerFor(instance);if(!old||alive(old.pid))throw Error('INSTANCE_ALREADY_RUNNING_OR_CONTROL_BUSY');\n    // Serialise stale recovery independently; never remove a live owner's lease.\n    const recovery=p.root+'.recovery';await mkdir(recovery,{mode:0o700});\n    try{const check=await ownerFor(instance);if(!check||check.runId!==old.runId||alive(check.pid))throw Error('INSTANCE_CONTROL_CHANGED');\n      await rm(p.root,{recursive:true});await mkdir(p.root,{mode:0o700});\n    }finally{await rm(recovery,{recursive:true,force:true});}\n  }\n  await atomicPrivate(p.meta,JSON.stringify(owner));\n  },home);\n  const identity=await runtimeIdentity();\n  const state:RuntimeState={instanceId:instance.id,runId:owner.runId,pid:process.pid,launcher:owner.launcher,appParentPid:parent??null,executionMode:options.background?'background':'foreground',phase:'starting',port:null,active:null,problem:null,...identity};\n  let worker:ChildProcess|null=null;let portLease:Awaited<ReturnType<typeof acquireControl>>|null=null;let server:Server|null=null;\n  let ending=false;let expectedWorkerExit=false;let sequence:Promise<unknown>=Promise.resolve();\n  let finish!:()=>void;const finished=new Promise<void>(r=>{finish=r;});\n  const serialize=<T>(fn:()=>Promise<T>):Promise<T>=>{const next=sequence.then(fn);sequence=next.catch(()=>{});return next;};\n  function emit(event:string){\n    if(options.json||!options.onReady)process.stdout.write(JSON.stringify({event,...state})+'\\n');\n    else if(event==='INSTANCE_ERROR'||event==='INSTANCE_APPLY_FAILED')process.stderr.write(`\\n${instance.name}: ${state.problem}\\nInspect logs: starmux logs -i ${instance.id}\\n`);\n    else if(event==='INSTANCE_STOPPED')process.stdout.write(`\\nStopped ${instance.name}.\\n`);\n  }\n  async function stopWorker(){\n    const child=worker;if(!child)return;expectedWorkerExit=true;\n    await new Promise<void>(resolve=>{\n      if(child.exitCode!==null||child.signalCode!==null){resolve();return;}\n      let forced=false;\n      const timer=setTimeout(()=>{forced=true;child.kill('SIGKILL');},8000);\n      child.once('exit',()=>{clearTimeout(timer);if(forced)state.problem='WORKER_STOP_FORCED';resolve();});\n      if(child.connected)child.send({type:'gateway-stop'});else child.kill('SIGTERM');\n    });worker=null;expectedWorkerExit=false;\n  }\n  async function shutdown(reason?:string){\n    if(ending)return;ending=true;state.problem=reason??null;state.phase='stopping';await stopWorker();\n    await portLease?.release();portLease=null;state.phase='stopped';state.port=null;emit('INSTANCE_STOPPED');finish();\n  }\n  async function startWorker(config:ActiveConfig,lease:Awaited<ReturnType<typeof acquireControl>>){\n    await ensureAccessReady(await resolveInstance(instance.id,home),home);\n    if(!await availablePort(config.config.port))throw Error('PORT_IN_USE: '+config.config.port);\n    const env:NodeJS.ProcessEnv={};for(const key of childEnvKeys)if(process.env[key])env[key]=process.env[key]!;\n    Object.assign(env,instanceEnv(instance,config.config,home),{MAC_MCP_INTERNAL_SETUP_OWNER_PID:String(process.pid),MAC_MCP_INTERNAL_SETUP_RUN_ID:lease.owner.runId,MAC_MCP_INTERNAL_SETUP_TOKEN:lease.owner.token});\n    const upstreamFile=await prepareUpstreams(instance,config.config,home);if(upstreamFile)env.MAC_MCP_UPSTREAMS_FILE=upstreamFile;\n    const log=path.join(instancePaths(instance,home).logs,'core.log');\n    if(await exists(log))await readTrusted(log,true,32*1024*1024);\n    const output=await open(log,'a',0o600);\n    const child=fork(fileURLToPath(options.workerModule??new URL('./instance-worker.js',import.meta.url)),[],{env,stdio:['ignore',output.fd,output.fd,'ipc']});worker=child;await output.close();\n    await new Promise<void>((resolve,reject)=>{\n      const timer=setTimeout(()=>reject(Error('INSTANCE_START_TIMEOUT')),20000);\n      const ready=(message:unknown)=>{if(message&&typeof message==='object'&&'type' in message&&message.type==='gateway-ready'){clearTimeout(timer);child.off('exit',failed);child.off('error',failed);child.off('message',ready);resolve();}};\n      const failed=()=>{clearTimeout(timer);child.off('message',ready);reject(Error('INSTANCE_START_FAILED: inspect instance logs'));};\n      child.once('error',failed);child.once('exit',failed);child.on('message',ready);\n    });\n    state.active=config;state.port=config.config.port;state.phase='running';lease.markRunning();\n    await atomicPrivate(path.join(instancePaths(instance,home).snapshots,'active.json'),JSON.stringify(config,null,2));\n    child.once('exit',()=>{if(!expectedWorkerExit&&!ending){state.phase='error';state.problem='INSTANCE_WORKER_EXITED';emit('INSTANCE_ERROR');void serialize(()=>shutdown('INSTANCE_WORKER_EXITED'));}});\n    emit('INSTANCE_RUNNING');\n  }\n  const active=(loaded:typeof initial):ActiveConfig=>({config:loaded.config,revision:loaded.revision,effectiveRevision:loaded.effectiveRevision,sourcePath:loaded.source.path});\n  async function apply(revision:string|null){\n    if(ending)throw Error('INSTANCE_STOPPING');\n    const current=await resolveInstance(instance.id,home);const next=await loadInstanceConfig(current);\n    if(!revision||next.revision!==revision)throw Error('CONFIG_CONFLICT: configuration changed before apply');\n    await ensureAccessReady(await resolveInstance(instance.id,home),home);await prepareUpstreams(instance,next.config,home);\n    const previous=state.active;if(!previous||!portLease)throw Error('INSTANCE_NOT_RUNNING');\n    const oldLease=portLease;let candidateLease=oldLease;\n    if(next.config.port!==previous.config.port){\n      if(!await availablePort(next.config.port))throw Error('PORT_IN_USE: '+next.config.port);\n      candidateLease=await acquireControl(next.config.port,{launcher:owner.launcher});candidateLease.onStop(async()=>{void serialize(shutdown);return 'STOPPED';});\n    }\n    state.phase='starting';await stopWorker();state.problem=null;\n    try{\n      await startWorker(active(next),candidateLease);portLease=candidateLease;\n      if(candidateLease!==oldLease)await oldLease.release();\n    }catch(error){\n      await stopWorker();if(candidateLease!==oldLease)await candidateLease.release();portLease=oldLease;\n      state.problem='APPLY_FAILED_RESTORED: '+(error as Error).message;\n      try{await startWorker(previous,oldLease);}catch{\n        await stopWorker();state.phase='error';state.problem='APPLY_AND_RESTORE_FAILED: inspect instance logs';\n      }\n      emit('INSTANCE_APPLY_FAILED');throw Error(state.problem!);\n    }\n  }\n  const signal=()=>{void serialize(shutdown);};\n  const parentTimer=parent?setInterval(()=>{if(process.ppid!==parent)signal();},400):null;\n  parentTimer?.unref();process.on('SIGTERM',signal);process.on('SIGINT',signal);\n  try{\n    server=createServer({allowHalfOpen:true},socket=>{\n      socket.setTimeout(65000,()=>socket.destroy());let raw='';let handled=false;\n      socket.on('error',()=>{});socket.on('data',chunk=>{\n        if(handled)return;raw+=String(chunk);if(raw.length>8192){socket.destroy();return;}if(!raw.includes('\\n'))return;handled=true;\n        void (async()=>{\n          let nonce='';try{\n            const envelope=JSON.parse(raw) as {body:string;proof:string};\n            if(typeof envelope.body!=='string'||!equal(envelope.proof,signature(owner.token,envelope.body)))throw Error('CONTROL_DENIED');\n            const req=JSON.parse(envelope.body) as {method:string;revision:string|null;runId:string;nonce:string};nonce=req.nonce;\n            if(req.runId!==owner.runId||! /^[a-f0-9]{48}$/.test(nonce))throw Error('CONTROL_DENIED');\n            if(req.method==='stop')await serialize(shutdown);\n            else if(req.method==='apply')await serialize(()=>apply(req.revision));\n            else if(req.method!=='status')throw Error('CONTROL_INVALID_METHOD');\n            const body=JSON.stringify({state});socket.end(JSON.stringify({body,proof:signature(owner.token,nonce+body)})+'\\n');\n          }catch(error){const body=JSON.stringify({state,error:(error as Error).message});socket.end(JSON.stringify({body,proof:signature(owner.token,nonce+body)})+'\\n');}\n        })();\n      });\n    });\n    await new Promise<void>((resolve,reject)=>{server!.once('error',reject);server!.listen(p.socket,()=>resolve());});\n    portLease=await acquireControl(initial.config.port,{launcher:owner.launcher});\n    portLease.onStop(async()=>{void serialize(shutdown);return 'STOPPED';});\n    await serialize(()=>startWorker(active(initial),portLease!));\n    if(options.onReady)await options.onReady();\n    else if(!options.json)process.stderr.write(`\\n${instance.name}: http://127.0.0.1:${state.port}/mcp\\nConfig: ${instance.source.path}\\nCtrl+C stops this instance.\\n`);\n    await finished;\n  }catch(error){state.phase='error';state.problem=(error as Error).message;throw error;}finally{\n    if(parentTimer)clearInterval(parentTimer);process.off('SIGTERM',signal);process.off('SIGINT',signal);\n    await stopWorker();await portLease?.release();\n    if(server)await new Promise<void>(resolve=>server!.close(()=>resolve()));\n    await atomicPrivate(path.join(instancePaths(instance,home).snapshots,'last-runtime.json'),JSON.stringify(state));\n    const current=await ownerFor(instance);if(current?.runId===owner.runId)await rm(p.root,{recursive:true,force:true});\n  }\n}\n"]}

package/dist/src/instance-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"instance-store.js","sourceRoot":"","sources":["../../src/instance-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,eAAe,IAAI,QAAQ,EAAC,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAC,eAAe,IAAI,QAAQ,EAAC,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAC,UAAU,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AAClD,OAAO,EAAC,KAAK,EAAC,QAAQ,EAAC,SAAS,EAAC,MAAM,EAAC,EAAE,EAAC,KAAK,EAAC,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAC,OAAO,EAAC,MAAM,SAAS,CAAC;AAChC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAC,YAAY,EAAC,MAAM,UAAU,CAAC;AACtC,OAAO,EAAC,KAAK,EAAC,MAAM,EAAC,UAAU,EAAC,mBAAmB,EAAiB,MAAM,cAAc,CAAC;AACzF,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AACtB,OAAO,EAAC,eAAe,EAAC,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAC,2BAA2B,EAAC,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAC,sBAAsB,EAAC,WAAW,EAAC,MAAM,eAAe,CAAC;AACjE,OAAO,EAAC,gBAAgB,EAAC,eAAe,EAAC,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAC,mBAAmB,EAAC,MAAM,qBAAqB,CAAC;AAExD,MAAM,UAAU,GAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAClF,MAAM,YAAY,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAC,QAAQ,CAAC,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAC1F,MAAM,CAAC,MAAM,cAAc,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,EAAE,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAC,IAAI,EAAC,UAAU,EAAC,MAAM,EAAC,YAAY,EAAC,QAAQ,EAAC,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChI,cAAc,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAC,SAAS,EAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAChI,MAAM,CAAC,MAAM,cAAc,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,aAAa,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAC,iBAAiB,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAC,SAAS,EAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAG7J,MAAM,QAAQ,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,EAAE,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAC,SAAS,EAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAC,OAAO,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrJ,UAAU,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAC,OAAO,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5H,MAAM,CAAC,MAAM,oBAAoB,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,OAAO,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAC,aAAa,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAC,WAAW,EAAC,CAAC,CAAC,MAAM,EAAE;IACzH,IAAI,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IACvG,UAAU,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAC,UAAU,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IACzI,UAAU,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAC,OAAO,EAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAC,OAAO,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAC,QAAQ,EAAC,OAAO,EAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7H,YAAY,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAC,SAAS,EAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAE1G,MAAM,CAAC,MAAM,WAAW,GAAC,CAAC,KAAY,EAAC,EAAE,CAAA,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,aAAa,GAAC,CAAC,IAAI,GAAC,OAAO,EAAE,EAAC,EAAE,CAAA,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,SAAS,EAAC,SAAS,CAAC,CAAC;AACjF,MAAM,UAAU,aAAa,CAAC,QAAiB,EAAC,IAAI,GAAC,OAAO,EAAE;IAC5D,MAAM,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAC,WAAW,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAClE,OAAO,EAAC,IAAI,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAC,KAAK,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,OAAO,CAAC,EAAC,IAAI,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,MAAM,CAAC,EAAC,SAAS,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,WAAW,CAAC;QACtI,MAAM,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,OAAO,EAAC,gBAAgB,CAAC,EAAC,MAAM,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,OAAO,EAAC,0BAA0B,CAAC,EAAC,IAAI,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,OAAO,EAAC,oBAAoB,CAAC,EAAC,CAAC;AACjK,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAW,IAAE,IAAG,CAAC;IAAA,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAAA,OAAO,IAAI,CAAC;AAAA,CAAC;AAAA,OAAM,CAAC,EAAC,CAAC;IAAA,IAAI,CAA2B,CAAC,IAAI,KAAG,QAAQ;QAAC,OAAO,KAAK,CAAC;IAAA,MAAM,CAAC,CAAC;AAAA,CAAC,CAAA,CAAC;AAC7J,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAW,EAAC,WAAW,GAAC,IAAI,EAAC,GAAG,GAAC,MAAM;IACvE,IAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACvE,MAAM,IAAI,GAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAE,IAAI,CAAC,KAAK,KAAG,CAAC,IAAE,CAAC,WAAW,CAAC,IAAI,EAAC,IAAI,EAAC,WAAW,CAAC,IAAE,CAAC,CAAC,WAAW,IAAE,OAAO,CAAC,QAAQ,KAAG,OAAO,IAAE,CAAC,IAAI,CAAC,IAAI,GAAC,KAAK,CAAC,KAAG,CAAC,CAAC,IAAE,IAAI,CAAC,IAAI,GAAC,GAAG;QACtJ,MAAM,KAAK,CAAC,oGAAoG,CAAC,CAAC;IACpH,6EAA6E;IAC7E,IAAI,MAAM,GAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAM,IAAI,EAAC,CAAC;QACV,MAAM,EAAE,GAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAG,EAAE,CAAC,cAAc,EAAE,IAAE,CAAC,EAAE,CAAC,WAAW,EAAE;YAAC,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACjF,0FAA0F;QAC1F,IAAG,OAAO,CAAC,QAAQ,KAAG,OAAO,IAAE,CAAC,EAAE,CAAC,IAAI,GAAC,KAAK,CAAC,KAAG,CAAC,IAAE,CAAC,EAAE,CAAC,IAAI,GAAC,MAAM,CAAC,KAAG,CAAC;YAAC,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAChH,MAAM,IAAI,GAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAA,IAAG,IAAI,KAAG,MAAM;YAAC,MAAM;QAAA,MAAM,GAAC,IAAI,CAAC;IACrE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAW,EAAC,IAAW;IACzD,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,IAAG,MAAM,MAAM,CAAC,IAAI,CAAC;QAAC,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAC,IAAI,GAAC,GAAG,GAAC,UAAU,EAAE,GAAC,MAAM,CAAC;IAC7C,IAAG,CAAC;QAAA,MAAM,SAAS,CAAC,SAAS,EAAC,IAAI,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;QAAA,MAAM,MAAM,CAAC,SAAS,EAAC,IAAI,CAAC,CAAC;IAAA,CAAC;YAAO,CAAC;QAAA,MAAM,EAAE,CAAC,SAAS,EAAC,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC;IAAA,CAAC;AACrI,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAI,GAAC,OAAO,EAAE;IAC/C,MAAM,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAC,eAAe,CAAC,CAAC;IAC1D,IAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC;QAAC,OAAO,EAAC,aAAa,EAAC,CAAC,EAAC,iBAAiB,EAAC,IAAI,EAAC,SAAS,EAAC,EAAE,EAAC,CAAC;IACpF,MAAM,QAAQ,GAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,CAAY,CAAC,CAAC;IACpF,IAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,IAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAG,QAAQ,CAAC,SAAS,CAAC,MAAM;QACvJ,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC7C,KAAI,MAAM,CAAC,IAAI,QAAQ,CAAC,SAAS,EAAC,CAAC;QACjC,IAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC1E,IAAG,CAAC,CAAC,MAAM,CAAC,IAAI,KAAG,SAAS,IAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAC,WAAW,EAAC,CAAC,CAAC,EAAE,EAAC,cAAc,CAAC;YAAC,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACtJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAI,MAAsC,EAAC,IAAI,GAAC,OAAO,EAAE;IAC3F,MAAM,IAAI,GAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAAA,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC5D,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,gBAAgB,CAAC,EAAC,KAAK,IAAE,EAAE;QACxD,MAAM,QAAQ,GAAC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QAAA,MAAM,MAAM,GAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,eAAe,CAAC,EAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,GAAC,IAAI,CAAC,CAAC;QAAA,OAAO,MAAM,CAAC;IAChI,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAC,IAAI,GAAC,OAAO,EAAE,EAAC,eAAe,GAAC,KAAK;IACzF,MAAM,QAAQ,GAAC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAAA,MAAM,IAAI,GAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,eAAe,IAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9G,MAAM,MAAM,GAAC,QAAQ,CAAA,CAAC,CAAA,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,QAAQ,IAAE,CAAC,CAAC,IAAI,KAAG,QAAQ,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,QAAQ,CAAC,iBAAiB,CAAC,IAAE,CAAC,IAAI,CAAC,MAAM,KAAG,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,CAAA,SAAS,CAAC,CAAC;IAC5J,IAAG,CAAC,MAAM;QAAC,MAAM,KAAK,CAAC,QAAQ,CAAA,CAAC,CAAA,sBAAsB,GAAC,QAAQ,CAAA,CAAC,CAAA,QAAQ,CAAC,SAAS,CAAC,MAAM;YACvF,CAAC,CAAA,sGAAsG;YACvG,CAAC,CAAA,kEAAkE,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,IAAW;IACrC,MAAM,MAAM,GAAc,EAAE,CAAC;IAAA,IAAI,KAAK,GAAS,KAAK,CAAC,IAAI,EAAC,MAAM,EAAC,EAAC,kBAAkB,EAAC,IAAI,EAAC,CAAC,CAAC;IAC5F,IAAG,MAAM,CAAC,MAAM,EAAC,CAAC;QAAA,MAAM,CAAC,GAAC,MAAM,CAAC,CAAC,CAAE,CAAC;QAAA,MAAM,MAAM,GAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAAA,MAAM,KAAK,CAAC,4BAA4B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,MAAM,GAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAC,CAAC,CAAC,GAAC,CAAC,KAAK,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAAA,CAAC;IACnO,mFAAmF;IACnF,IAAG,KAAK,IAAE,OAAO,KAAK,KAAG,QAAQ,IAAE,SAAS,IAAI,KAAK,EAAC,CAAC;QACrD,MAAM,MAAM,GAAC,KAA+B,CAAC;QAC7C,IAAG,CAAC,CAAC,CAAC,EAAC,CAAC,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACvF,MAAM,OAAO,GAAC,IAAI,GAAG,CAAC,CAAC,SAAS,EAAC,aAAa,EAAC,MAAM,EAAC,YAAY,EAAC,MAAM,EAAC,YAAY,EAAC,YAAY,CAAC,CAAC,CAAC;QACtG,IAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC3F,KAAK,GAAC,EAAC,aAAa,EAAC,CAAC,EAAC,WAAW,EAAC,MAAM,CAAC,WAAW,EAAC,IAAI,EAAC,MAAM,CAAC,IAAI,EAAC,UAAU,EAAC,MAAM,CAAC,UAAU,EAAC,IAAI,EAAC,MAAM,CAAC,IAAI;YAClH,UAAU,EAAC,MAAM,CAAC,OAAO,KAAG,CAAC,CAAA,CAAC,CAAA,YAAY,CAAA,CAAC,CAAA,MAAM,CAAC,UAAU,EAAC,UAAU,EAAC,MAAM,CAAC,OAAO,KAAG,CAAC,CAAA,CAAC,CAAA,WAAW,CAAA,CAAC,CAAA,cAAc,EAAC,CAAC;IAC3H,CAAC;IACD,MAAM,MAAM,GAAC,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnD,IAAG,CAAC,MAAM,CAAC,OAAO;QAAC,MAAM,KAAK,CAAC,kBAAkB,GAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAE,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACxI,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAqB;IACxD,MAAM,EAAC,UAAU,EAAC,UAAU,EAAC,GAAC,MAAM,CAAC;IACrC,IAAG,UAAU,KAAG,WAAW,IAAE,CAAC,UAAU,KAAG,SAAS,IAAE,MAAM,CAAC,SAAS,CAAC,MAAM,IAAE,MAAM,CAAC,OAAO,KAAG,KAAK,CAAC;QACpG,MAAM,KAAK,CAAC,mGAAmG,CAAC,CAAC;IACnH,MAAM,MAAM,GAAC,EAAC,WAAW,EAAC,MAAM,CAAC,WAAW,EAAC,IAAI,EAAC,MAAM,CAAC,IAAI,EAAC,IAAI,EAAC,MAAM,CAAC,IAAI,EAAC,UAAU,EAAC,MAAM,CAAC,UAAU,KAAG,OAAO,CAAA,CAAC,CAAA,OAAO,CAAA,CAAC,CAAA,MAAM,CAAC,UAAU,EAAC,CAAC;IACjJ,MAAM,gBAAgB,CAAC,UAAU,KAAG,YAAY,IAAE,MAAM,CAAC,IAAI,KAAG,YAAY,CAAA,CAAC,CAAA,EAAC,GAAG,MAAM,EAAC,OAAO,EAAC,CAAC,EAAC,CAAA,CAAC,CAAA,UAAU,KAAG,WAAW,CAAA,CAAC,CAAA,EAAC,GAAG,MAAM,EAAC,OAAO,EAAC,CAAC,EAAC,UAAU,EAAC,UAAU,EAAC,CAAA,CAAC,CAAA,EAAC,GAAG,MAAM,EAAC,OAAO,EAAC,CAAC,EAAC,UAAU,EAAC,CAAC,CAAC;IAC1M,2BAA2B,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,SAAS,EAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAC,OAAO,EAAC,GAAG,CAAC,EAAC,EAAC,EAAE,CAAA,CAAC,EAAC,GAAG,CAAC,EAAC,GAAG,EAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAC,WAAW,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC,EAAC,CAAC,CAAC;IACzK,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,CAAC,MAAM,cAAc,GAAC,CAAC,IAAW,EAAC,IAAW,EAAC,EAAE,CAAA,WAAW,CAAC,IAAI,GAAC,IAAI,GAAC,IAAI,CAAC,CAAC;AACnF,MAAM,UAAU,gBAAgB,KAAG,OAAO,eAAe,CAAC,oBAAoB,EAAC,EAAC,IAAI,EAAC,iBAAiB,EAAC,CAAC,CAAC,CAAA,CAAC;AAC1G,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAiB;IACxD,MAAM,IAAI,GAAC,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAG,SAAS,CAAC,CAAC;IACpF,MAAM,MAAM,GAAC,MAAM,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,OAAO,EAAC,IAAI,EAAC,MAAM,EAAC,QAAQ,EAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAC,IAAI,CAAC,EAAC,iBAAiB,EAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,GAAG,MAAM,EAAC,OAAO,EAAC,SAAS,EAAC,CAAC,CAAC,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM,EAAC,CAAC;AAC9K,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAW;IAC7C,OAAO,IAAI,OAAO,CAAU,OAAO,CAAA,EAAE,GAAC,MAAM,MAAM,GAAC,YAAY,EAAE,CAAC,CAAA,MAAM,CAAC,IAAI,CAAC,OAAO,EAAC,GAAE,EAAE,CAAA,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA,MAAM,CAAC,MAAM,CAAC,IAAI,EAAC,WAAW,EAAC,GAAE,EAAE,CAAA,MAAM,CAAC,KAAK,CAAC,GAAE,EAAE,CAAA,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;AACnL,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAI,GAAC,OAAO,EAAE;IAC9C,MAAM,IAAI,GAAC,IAAI,GAAG,EAAU,CAAC;IAC7B,KAAI,MAAM,QAAQ,IAAI,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAC,CAAC;QAAA,IAAG,CAAC,QAAQ,CAAC,QAAQ;YAAC,IAAG,CAAC;gBAAA,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAAA,CAAC;YAAA,MAAK,CAAC,CAAA,CAAC;IAAA,CAAC;IAC1J,KAAI,IAAI,IAAI,GAAC,KAAK,EAAC,IAAI,GAAC,KAAK,EAAC,IAAI,EAAE;QAAC,IAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAE,MAAM,aAAa,CAAC,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC;IAC/F,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAC5C,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,MAAqB,IAAE,OAAO,oJAAoJ,GAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAC,IAAI,EAAC,CAAC,CAAC,GAAC,IAAI,CAAC,CAAA,CAAC;AACtP,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAW,EAAC,UAA8H,EAAE,EAAC,IAAI,GAAC,OAAO,EAAE;IAC9L,IAAI,GAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAC,OAAO,CAAC,IAAI,CAAA,CAAC,CAAA,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA,CAAC,CAAA,SAAS,CAAC;IAC9D,IAAG,OAAO,CAAC,IAAI,IAAE,CAAC,KAAK;QAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAC,KAAK,CAAA,CAAC,CAAA,MAAM,WAAW,CAAC,KAAK,EAAC,KAAK,CAAC,CAAA,CAAC,CAAA,SAAS,CAAC;IAC1D,IAAG,CAAC,OAAO,CAAC,MAAM,IAAE,CAAC,IAAI;QAAC,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAClE,MAAM,MAAM,GAAC,MAAM,cAAc,CAAC,OAAO,CAAC,MAAM,IAAE,WAAW,CAAC,IAAK,CAAC,CAAC,CAAC;IACtE,OAAO,cAAc,CAAC,KAAK,EAAC,QAAQ,EAAA,EAAE;QACpC,IAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,KAAG,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACjF,IAAG,KAAK,IAAE,OAAO,CAAC,IAAI,IAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,MAAM,CAAC,IAAI,KAAG,KAAK,CAAC;YAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9G,MAAM,EAAE,GAAC,UAAU,EAAE,CAAC;QAAA,MAAM,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAC,WAAW,EAAC,EAAE,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAC,cAAc,CAAC,KAAK,CAAC,EAAC,EAAE,EAAC,IAAI,EAAC,QAAQ,EAAC,KAAK,EAAC,cAAc,EAAC,OAAO,CAAC,cAAc,IAAE,SAAS;YAC1G,MAAM,EAAC,EAAC,IAAI,EAAC,OAAO,CAAC,IAAI,CAAA,CAAC,CAAA,QAAQ,CAAA,CAAC,CAAA,SAAS,EAAC,IAAI,EAAC,OAAO,CAAC,IAAI,CAAA,CAAC,CAAA,KAAM,CAAA,CAAC,CAAA,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,cAAc,CAAC,EAAC,EAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAA,CAAC,CAAA,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,CAAC,CAAC;QACzJ,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAC,WAAW,CAAC,CAAC,CAAC;QAAA,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAChG,KAAI,MAAM,GAAG,IAAI,CAAC,OAAO,EAAC,MAAM,EAAC,WAAW,CAAC;YAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,GAAG,CAAC,CAAC,CAAC;QAC1F,IAAG,CAAC;YACF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAC,qBAAqB,CAAC,EAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,EAAC,IAAI,EAAC,CAAC,CAAC,GAAC,IAAI,CAAC,CAAC;YACzH,IAAG,CAAC,OAAO,CAAC,IAAI,EAAC,CAAC;gBAChB,MAAM,QAAQ,GAAC,IAAI,IAAE,CAAC,CAAC,SAAS,IAAK,KAAK,CAAC,IAAI,CAAY,CAAC,CAAA,CAAC,CAAA,IAAI,CAAA,CAAC,CAAA,cAAc,CAAC,MAAM,CAAC,CAAC;gBACzF,MAAM,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAC,UAAU,CAAC,QAAQ,EAAC,MAAM,CAAC,QAAQ,EAAC,CAAC,SAAS,CAAC,EAAC,2BAA2B,EAAC,EAAC,iBAAiB,EAAC,EAAC,YAAY,EAAC,IAAI,EAAC,OAAO,EAAC,CAAC,EAAC,EAAC,CAAC,CAAC,CAAC,CAAC;YAC5K,CAAC;YACD,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAA,IAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAG,CAAC;gBAAC,QAAQ,CAAC,iBAAiB,GAAC,EAAE,CAAC;YACjG,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAA,OAAM,CAAC,EAAC,CAAC;YAAA,MAAM,EAAE,CAAC,IAAI,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC;YAAA,MAAM,CAAC,CAAC;QAAA,CAAC;IAChE,CAAC,EAAC,IAAI,CAAC,CAAC;AACV,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAiB,EAAC,IAAW,EAAC,gBAAuB,EAAC,IAAI,GAAC,OAAO,EAAE;IAC3G,MAAM,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,MAAM,KAAK,GAAC,aAAa,CAAC,QAAQ,EAAC,IAAI,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAC,cAAc,CAAC,EAAC,KAAK,IAAE,EAAE;QAC5D,MAAM,UAAU,GAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAC,IAAI,CAAC,CAAC;QACzD,IAAG,UAAU,CAAC,MAAM,CAAC,IAAI,KAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAE,UAAU,CAAC,MAAM,CAAC,IAAI,KAAG,QAAQ,CAAC,MAAM,CAAC,IAAI;YAAC,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC3J,MAAM,OAAO,GAAC,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAG,SAAS,CAAC,CAAC;QACvF,IAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAC,OAAO,CAAC,KAAG,gBAAgB;YAAC,MAAM,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC3I,MAAM,SAAS,GAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAC,GAAG,GAAC,UAAU,EAAE,GAAC,MAAM,CAAC;QAC7D,IAAG,CAAC;YAAA,MAAM,SAAS,CAAC,SAAS,EAAC,IAAI,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;YAAA,MAAM,MAAM,CAAC,SAAS,EAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAA,CAAC;gBAAO,CAAC;YAAA,MAAM,EAAE,CAAC,SAAS,EAAC,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC;QAAA,CAAC;QACnJ,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAiB,EAAC,KAA4B,EAAC,QAAe,EAAC,IAAI,GAAC,OAAO,EAAE;IACrH,IAAI,IAAI,GAAC,CAAC,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,KAAI,MAAM,CAAC,GAAG,EAAC,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAC,IAAI,GAAC,UAAU,CAAC,IAAI,EAAC,MAAM,CAAC,IAAI,EAAC,CAAC,GAAG,CAAC,EAAC,KAAK,EAAC,EAAC,iBAAiB,EAAC,EAAC,YAAY,EAAC,IAAI,EAAC,OAAO,EAAC,CAAC,EAAC,EAAC,CAAC,CAAC,CAAC;IAChJ,OAAO,kBAAkB,CAAC,QAAQ,EAAC,IAAI,EAAC,QAAQ,EAAC,IAAI,CAAC,CAAC;AACzD,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,QAAiB,EAAC,MAAqB,EAAC,IAAI,GAAC,OAAO,EAAE;IAChF,MAAM,MAAM,GAAC,EAAC,WAAW,EAAC,MAAM,CAAC,WAAW,EAAC,IAAI,EAAC,MAAM,CAAC,IAAI,EAAC,IAAI,EAAC,MAAM,CAAC,IAAI,EAAC,UAAU,EAAC,MAAM,CAAC,UAAU,KAAG,OAAO,CAAA,CAAC,CAAA,OAAO,CAAA,CAAC,CAAA,MAAM,CAAC,UAAU;QAC7I,GAAG,CAAC,MAAM,CAAC,UAAU,KAAG,YAAY,IAAE,MAAM,CAAC,IAAI,KAAG,YAAY,CAAA,CAAC,CAAA,EAAC,OAAO,EAAC,CAAC,EAAC,CAAA,CAAC,CAAA,MAAM,CAAC,UAAU,KAAG,WAAW,CAAA,CAAC,CAAA,EAAC,OAAO,EAAC,CAAC,EAAC,UAAU,EAAC,MAAM,CAAC,UAAU,EAAC,UAAU,EAAC,WAAW,EAAC,CAAA,CAAC,CAAA,EAAC,OAAO,EAAC,CAAC,EAAC,UAAU,EAAC,MAAM,CAAC,UAAU,EAAC,CAAC,EAAC,CAAC;IAC1N,MAAM,CAAC,GAAC,aAAa,CAAC,QAAQ,EAAC,IAAI,CAAC,CAAC;IACrC,OAAO,EAAC,GAAG,eAAe,CAAC,MAAM,CAAC,EAAC,mBAAmB,EAAC,CAAC,CAAC,MAAM,EAAC,mBAAmB,EAAC,CAAC,CAAC,MAAM,EAAC,iBAAiB,EAAC,CAAC,CAAC,IAAI;QACnH,gBAAgB,EAAC,MAAM,CAAC,OAAO,EAAC,qBAAqB,EAAC,MAAM,CAAC,YAAY,EAAC,mBAAmB,EAAC,QAAQ,CAAC,EAAE,EAAC,qBAAqB,EAAC,QAAQ,CAAC,IAAI;QAC7I,iCAAiC,EAAC,GAAG,EAAC,CAAC;AAC3C,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAiB,EAAC,IAAI,GAAC,OAAO,EAAE;IACtE,MAAM,MAAM,GAAC,MAAM,mBAAmB,CAAC,aAAa,CAAC,QAAQ,EAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;IAAA,MAAM,KAAK,GAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;IAChH,IAAG,QAAQ,CAAC,cAAc,KAAG,SAAS,IAAE,KAAK,CAAC,IAAI,KAAG,QAAQ,CAAC,cAAc;QAAC,MAAM,KAAK,CAAC,wCAAwC,GAAC,QAAQ,CAAC,cAAc,GAAC,oCAAoC,CAAC,CAAC;IAChM,IAAG,KAAK,CAAC,IAAI,KAAG,SAAS,IAAE,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,MAAM,KAAG,QAAQ,CAAC;QAAC,MAAM,KAAK,CAAC,sDAAsD,CAAC,CAAC;AACjJ,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAiB,EAAC,MAAqB,EAAC,IAAI,GAAC,OAAO,EAAE;IAC3F,IAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM;QAAC,OAAO,SAAS,CAAC;IAC7C,MAAM,CAAC,GAAC,aAAa,CAAC,QAAQ,EAAC,IAAI,CAAC,CAAC;IAAA,MAAM,UAAU,GAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAC,cAAc,CAAC,CAAC;IACxF,MAAM,YAAY,GAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAC,YAAY,CAAA,CAAC,CAAA,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,CAAY,CAAC,CAAA,CAAC,CAAA,EAAE,CAAC;IAC/G,MAAM,WAAW,GAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAC,OAAO,EAAC,GAAG,CAAC,EAAC,EAAC,EAAE,CAAA,CAAC,EAAC,GAAG,CAAC,EAAC,GAAG,EAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAC,GAAG,CAAC,EAAC,EAAE;YAC9H,IAAG,OAAO,CAAC,GAAG,CAAC,KAAG,SAAS;gBAAC,MAAM,KAAK,CAAC,2BAA2B,GAAC,GAAG,CAAC,CAAC;YAAA,OAAO,CAAC,GAAG,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACrG,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC,CAAC;IACP,MAAM,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAC,yBAAyB,CAAC,CAAC;IAAA,MAAM,aAAa,CAAC,IAAI,EAAC,IAAI,CAAC,SAAS,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,SAAS,EAAC,WAAW,EAAC,CAAC,CAAC,CAAC;IAAA,OAAO,IAAI,CAAC;AAClJ,CAAC","sourcesContent":["import {withPrivateLock as withLock} from './private-store-lock.js';\nexport {withPrivateLock as withLock} from './private-store-lock.js';\nimport {randomUUID,createHash} from 'node:crypto';\nimport {lstat,readFile,writeFile,rename,rm,mkdir,realpath} from 'node:fs/promises';\nimport {homedir} from 'node:os';\nimport path from 'node:path';\nimport {createServer} from 'node:net';\nimport {parse,modify,applyEdits,printParseErrorCode,type ParseError} from 'jsonc-parser';\nimport {z} from 'zod';\nimport {zodToJsonSchema} from 'zod-to-json-schema';\nimport {validateConfiguredUpstreams} from './configured-mcp-upstreams.js';\nimport {createPrivateDirectory,ownedByUser} from './platform.js';\nimport {checkSetupValues,setupRuntimeEnv} from './release1-onboarding.js';\nimport {createAccessControl} from './access-control.js';\n\nconst nameSchema=z.string().trim().min(1).max(80).regex(/^[^\\x00-\\x1f\\x7f/\\\\]+$/);\nconst sourceSchema=z.object({kind:z.enum(['managed','linked']),path:z.string()}).strict();\nexport const instanceSchema=z.object({id:z.string().uuid(),name:nameSchema,source:sourceSchema,archived:z.boolean().default(false),\n  requiredAccess:z.enum(['ingress','api-key','oauth']).default('ingress'),legacy:z.enum(['setup','live']).optional()}).strict();\nexport const registrySchema=z.object({schemaVersion:z.literal(1),defaultInstanceId:z.string().uuid().nullable(),instances:z.array(instanceSchema)}).strict();\nexport type Instance=z.infer<typeof instanceSchema>;\ntype Registry=z.infer<typeof registrySchema>;\nconst upstream=z.object({id:z.string().regex(/^[a-z][a-z0-9_-]{0,39}$/),transport:z.literal('stdio'),command:z.string().min(1),args:z.array(z.string()),\n  allowTools:z.array(z.string()),envRefs:z.record(z.string().regex(/^[A-Za-z][A-Za-z0-9_-]{0,79}$/)).default({})}).strict();\nexport const instanceConfigSchema=z.object({$schema:z.string().optional(),schemaVersion:z.literal(1),projectRoot:z.string(),\n  port:z.number().int().min(1024).max(65535),mode:z.enum(['read-only','read-write']).default('read-only'),\n  accessRole:z.enum(['restricted','trusted']).default('restricted'),writeScope:z.enum(['home-only','unrestricted']).default('unrestricted'),\n  connection:z.enum(['local','https','tunnel']).default('local'),gitMode:z.enum(['off','review','write','push']).default('off'),\n  worktreeMode:z.enum(['off','linked']).default('off'),upstreams:z.array(upstream).default([])}).strict();\nexport type InstanceConfig=z.infer<typeof instanceConfigSchema>;\nexport const fingerprint=(value:string)=>createHash('sha256').update(value).digest('hex');\nexport const instancesRoot=(home=homedir())=>path.join(home,'.config','starmux');\nexport function instancePaths(instance:Instance,home=homedir()){\n  const root=path.join(instancesRoot(home),'instances',instance.id);\n  return {root,config:instance.source.path,state:path.join(root,'state'),logs:path.join(root,'logs'),snapshots:path.join(root,'snapshots'),\n    access:path.join(root,'state','access-v1.json'),grants:path.join(root,'state','workspace-grants-v1.json'),deny:path.join(root,'state','deny-rules-v1.json')};\n}\nexport async function exists(file:string){try{await lstat(file);return true;}catch(e){if((e as NodeJS.ErrnoException).code==='ENOENT')return false;throw e;}}\nexport async function readTrusted(file:string,privateFile=true,max=262144){\n  if(!path.isAbsolute(file))throw Error('CONFIG_PATH_ABSOLUTE_REQUIRED');\n  const stat=await lstat(file);\n  if(!stat.isFile()||stat.nlink!==1||!ownedByUser(file,stat,privateFile)||(!privateFile&&process.platform!=='win32'&&(stat.mode&0o022)!==0)||stat.size>max)\n    throw Error('CONFIG_FILE_UNSAFE: use an owner-owned regular file; private state requires owner-only permissions');\n  // Refuse symlinked ancestors and writable shared source directories as well.\n  let parent=path.dirname(file);\n  while(true){\n    const st=await lstat(parent);\n    if(st.isSymbolicLink()||!st.isDirectory())throw Error('CONFIG_DIRECTORY_UNSAFE');\n    // Sticky system temporary directories are allowed; other shared writable parents are not.\n    if(process.platform!=='win32'&&(st.mode&0o022)!==0&&(st.mode&0o1000)===0)throw Error('CONFIG_DIRECTORY_UNSAFE');\n    const next=path.dirname(parent);if(next===parent)break;parent=next;\n  }\n  return readFile(file,'utf8');\n}\nexport async function atomicPrivate(file:string,text:string){\n  createPrivateDirectory(path.dirname(file));\n  if(await exists(file))await readTrusted(file);\n  const temporary=file+'.'+randomUUID()+'.tmp';\n  try{await writeFile(temporary,text,{flag:'wx',mode:0o600});await rename(temporary,file);}finally{await rm(temporary,{force:true});}\n}\nexport async function readRegistry(home=homedir()):Promise<Registry>{\n  const file=path.join(instancesRoot(home),'registry.json');\n  if(!await exists(file))return {schemaVersion:1,defaultInstanceId:null,instances:[]};\n  const registry=registrySchema.parse(JSON.parse(await readTrusted(file)) as unknown);\n  if(new Set(registry.instances.map(i=>i.id)).size!==registry.instances.length||new Set(registry.instances.map(i=>i.name)).size!==registry.instances.length)\n    throw Error('REGISTRY_DUPLICATE_INSTANCE');\n  for(const i of registry.instances){\n    if(!path.isAbsolute(i.source.path))throw Error('REGISTRY_SOURCE_INVALID');\n    if(i.source.kind==='managed'&&i.source.path!==path.join(instancesRoot(home),'instances',i.id,'config.jsonc'))throw Error('REGISTRY_SOURCE_INVALID');\n  }\n  return registry;\n}\nexport async function changeRegistry<T>(action:(registry:Registry)=>Promise<T>,home=homedir()){\n  const root=instancesRoot(home);createPrivateDirectory(root);\n  return withLock(path.join(root,'.registry-lock'),async()=>{\n    const registry=await readRegistry(home);const result=await action(registry);\n    await atomicPrivate(path.join(root,'registry.json'),JSON.stringify(registrySchema.parse(registry),null,2)+'\\n');return result;\n  });\n}\nexport async function resolveInstance(selector?:string,home=homedir(),includeArchived=false){\n  const registry=await readRegistry(home);const rows=registry.instances.filter(i=>includeArchived||!i.archived);\n  const result=selector?rows.find(i=>i.id===selector||i.name===selector):rows.find(i=>i.id===registry.defaultInstanceId)??(rows.length===1?rows[0]:undefined);\n  if(!result)throw Error(selector?'INSTANCE_NOT_FOUND: '+selector:registry.instances.length\n    ?'INSTANCE_REQUIRED: select an instance with -i NAME or set a default with starmux config default NAME'\n    :'INSTANCE_REQUIRED: no instances. Run starmux up in your project.');\n  return result;\n}\nexport function parseConfig(text:string):InstanceConfig{\n  const errors:ParseError[]=[];let value:unknown=parse(text,errors,{allowTrailingComma:true});\n  if(errors.length){const e=errors[0]!;const prefix=text.slice(0,e.offset);throw Error(`CONFIG_JSON_INVALID line ${prefix.split('\\n').length}, column ${e.offset-(prefix.lastIndexOf('\\n')+1)+1}: ${printParseErrorCode(e.error)}`);}\n  // Import the three historical onboarding formats without changing their authority.\n  if(value&&typeof value==='object'&&'version' in value){\n    const legacy=value as Record<string,unknown>;\n    if(![1,2,3].includes(Number(legacy.version)))throw Error('CONFIG_VERSION_UNSUPPORTED');\n    const allowed=new Set(['version','projectRoot','mode','connection','port','accessRole','writeScope']);\n    if(Object.keys(legacy).some(k=>!allowed.has(k)))throw Error('CONFIG_UNKNOWN_LEGACY_FIELD');\n    value={schemaVersion:1,projectRoot:legacy.projectRoot,mode:legacy.mode,connection:legacy.connection,port:legacy.port,\n      accessRole:legacy.version===1?'restricted':legacy.accessRole,writeScope:legacy.version===3?'home-only':'unrestricted'};\n  }\n  const result=instanceConfigSchema.safeParse(value);\n  if(!result.success)throw Error('CONFIG_INVALID: '+result.error.issues.map(i=>`${i.path.join('.')||'config'}: ${i.message}`).join('; '));\n  return result.data;\n}\nexport async function validateConfig(config:InstanceConfig){\n  const {accessRole,writeScope}=config;\n  if(writeScope==='home-only'&&(accessRole!=='trusted'||config.upstreams.length||config.gitMode!=='off'))\n    throw Error('CONFIG_INVALID writeScope: home-only requires trusted mode without extra upstreams or Gateway Git');\n  const legacy={projectRoot:config.projectRoot,mode:config.mode,port:config.port,connection:config.connection==='local'?'https':config.connection};\n  await checkSetupValues(accessRole==='restricted'&&config.mode==='read-write'?{...legacy,version:1}:writeScope==='home-only'?{...legacy,version:3,accessRole,writeScope}:{...legacy,version:2,accessRole});\n  validateConfiguredUpstreams({version:1,upstreams:config.upstreams.map(({envRefs,...u})=>({...u,env:Object.fromEntries(Object.keys(envRefs).map(k=>[k,'reference']))}))});\n  return config;\n}\nexport const sourceRevision=(file:string,text:string)=>fingerprint(file+'\\0'+text);\nexport function configJSONSchema(){return zodToJsonSchema(instanceConfigSchema,{name:'GatewayInstance'});}\nexport async function loadInstanceConfig(instance:Instance){\n  const text=await readTrusted(instance.source.path,instance.source.kind==='managed');\n  const config=await validateConfig(parseConfig(text));\n  return {text,config,revision:sourceRevision(instance.source.path,text),effectiveRevision:fingerprint(JSON.stringify({...config,$schema:undefined})),source:instance.source};\n}\nexport async function availablePort(port:number){\n  return new Promise<boolean>(resolve=>{const server=createServer();server.once('error',()=>resolve(false));server.listen(port,'127.0.0.1',()=>server.close(()=>resolve(true)));});\n}\nexport async function suggestPort(home=homedir()){\n  const used=new Set<number>();\n  for(const instance of (await readRegistry(home)).instances){if(!instance.archived)try{used.add((await loadInstanceConfig(instance)).config.port);}catch{}}\n  for(let port=18893;port<19893;port++)if(!used.has(port)&&await availablePort(port))return port;\n  throw Error('NO_AVAILABLE_INSTANCE_PORT');\n}\nexport function configTemplate(config:InstanceConfig){return '// Gateway startup settings. Save, then apply to restart this instance.\\n// Credentials and grants live in the private instance state directory.\\n'+JSON.stringify(config,null,2)+'\\n';}\nexport async function createInstance(name:string,options:{config?:InstanceConfig;file?:string;link?:boolean;requiredAccess?:Instance['requiredAccess'];legacy?:'setup'|'live'}={},home=homedir()){\n  name=nameSchema.parse(name);\n  const input=options.file?path.resolve(options.file):undefined;\n  if(options.link&&!input)throw Error('LINK_SOURCE_REQUIRED');\n  const text=input?await readTrusted(input,false):undefined;\n  if(!options.config&&!text)throw Error('INSTANCE_CONFIG_REQUIRED');\n  const config=await validateConfig(options.config??parseConfig(text!));\n  return changeRegistry(async registry=>{\n    if(registry.instances.some(i=>i.name===name))throw Error('INSTANCE_NAME_EXISTS');\n    if(input&&options.link&&registry.instances.some(i=>i.source.path===input))throw Error('CONFIG_ALREADY_BOUND');\n    const id=randomUUID();const root=path.join(instancesRoot(home),'instances',id);\n    const instance=instanceSchema.parse({id,name,archived:false,requiredAccess:options.requiredAccess??'ingress',\n      source:{kind:options.link?'linked':'managed',path:options.link?input!:path.join(root,'config.jsonc')},...(options.legacy?{legacy:options.legacy}:{})});\n    createPrivateDirectory(path.join(instancesRoot(home),'instances'));createPrivateDirectory(root);\n    for(const dir of ['state','logs','snapshots'])createPrivateDirectory(path.join(root,dir));\n    try{\n      await atomicPrivate(path.join(instancesRoot(home),'gateway.schema.json'),JSON.stringify(configJSONSchema(),null,2)+'\\n');\n      if(!options.link){\n        const original=text&&!('version' in (parse(text) as object))?text:configTemplate(config);\n        await atomicPrivate(instance.source.path,applyEdits(original,modify(original,['$schema'],'../../gateway.schema.json',{formattingOptions:{insertSpaces:true,tabSize:2}})));\n      }\n      registry.instances.push(instance);if(registry.instances.length===1)registry.defaultInstanceId=id;\n      return instance;\n    }catch(e){await rm(root,{recursive:true,force:true});throw e;}\n  },home);\n}\nexport async function saveInstanceConfig(instance:Instance,text:string,expectedRevision:string,home=homedir()){\n  await validateConfig(parseConfig(text));\n  const paths=instancePaths(instance,home);\n  return withLock(path.join(paths.root,'.config-lock'),async()=>{\n    const registered=await resolveInstance(instance.id,home);\n    if(registered.source.path!==instance.source.path||registered.source.kind!==instance.source.kind)throw Error('CONFIG_SOURCE_CHANGED: reload before saving');\n    const current=await readTrusted(instance.source.path,instance.source.kind==='managed');\n    if(sourceRevision(instance.source.path,current)!==expectedRevision)throw Error('CONFIG_CONFLICT: reload and review changes before saving');\n    const temporary=instance.source.path+'.'+randomUUID()+'.tmp';\n    try{await writeFile(temporary,text,{flag:'wx',mode:0o600});await rename(temporary,instance.source.path);}finally{await rm(temporary,{force:true});}\n    return loadInstanceConfig(instance);\n  });\n}\nexport async function patchInstanceConfig(instance:Instance,patch:Record<string,unknown>,revision:string,home=homedir()){\n  let text=(await loadInstanceConfig(instance)).text;\n  for(const [key,value] of Object.entries(patch))text=applyEdits(text,modify(text,[key],value,{formattingOptions:{insertSpaces:true,tabSize:2}}));\n  return saveInstanceConfig(instance,text,revision,home);\n}\nexport function instanceEnv(instance:Instance,config:InstanceConfig,home=homedir()):NodeJS.ProcessEnv{\n  const legacy={projectRoot:config.projectRoot,mode:config.mode,port:config.port,connection:config.connection==='local'?'https':config.connection,\n    ...(config.accessRole==='restricted'&&config.mode==='read-write'?{version:1}:config.writeScope==='home-only'?{version:3,accessRole:config.accessRole,writeScope:'home-only'}:{version:2,accessRole:config.accessRole})};\n  const p=instancePaths(instance,home);\n  return {...setupRuntimeEnv(legacy),MAC_MCP_ACCESS_FILE:p.access,MAC_MCP_GRANTS_FILE:p.grants,MAC_MCP_DENY_FILE:p.deny,\n    MAC_MCP_GIT_MODE:config.gitMode,MAC_MCP_WORKTREE_MODE:config.worktreeMode,MAC_MCP_INSTANCE_ID:instance.id,MAC_MCP_INSTANCE_NAME:instance.name,\n    MAC_MCP_PRIVATE_ACTIVITY_OBSERVER:'1'};\n}\nexport async function ensureAccessReady(instance:Instance,home=homedir()){\n  const access=await createAccessControl(instancePaths(instance,home).access);const state=await access.snapshot();\n  if(instance.requiredAccess!=='ingress'&&state.mode!==instance.requiredAccess)throw Error('INSTANCE_ACCESS_INCOMPLETE: configure '+instance.requiredAccess+' for this instance before starting');\n  if(state.mode==='api-key'&&!state.credentials.some(c=>c.status==='active'))throw Error('INSTANCE_ACCESS_INCOMPLETE: create an active API key');\n}\nexport async function prepareUpstreams(instance:Instance,config:InstanceConfig,home=homedir()){\n  if(!config.upstreams.length)return undefined;\n  const p=instancePaths(instance,home);const secretFile=path.join(p.state,'secrets.json');\n  const needsSecrets=config.upstreams.some(u=>Object.keys(u.envRefs).length);\n  const secrets=needsSecrets?z.record(z.string()).parse(JSON.parse(await readTrusted(secretFile)) as unknown):{};\n  const definitions=config.upstreams.map(({envRefs,...u})=>({...u,env:Object.fromEntries(Object.entries(envRefs).map(([key,ref])=>{\n    if(secrets[ref]===undefined)throw Error('INSTANCE_SECRET_MISSING: '+ref);return [key,secrets[ref]];\n  }))}));\n  const file=path.join(p.state,'resolved-upstreams.json');await atomicPrivate(file,JSON.stringify({version:1,upstreams:definitions}));return file;\n}\n"]}

package/dist/src/instance-worker.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"instance-worker.js","sourceRoot":"","sources":["../../src/instance-worker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,yBAAyB,EAAC,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAC,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAClD,IAAG,CAAC,OAAO,CAAC,IAAI;IAAC,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACpE,yBAAyB,CAAC,EAAC,IAAI,EAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAC,QAAQ,EAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;IACpI,KAAK,EAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAC,KAAK,EAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAC,CAAC,CAAC;AACnG,MAAM,UAAU,EAAE,CAAC;AACnB,OAAO,CAAC,IAAI,CAAC,EAAC,IAAI,EAAC,eAAe,EAAC,CAAC,CAAC","sourcesContent":["import {verifyInternalSetupWorker} from './global-core-control.js';\nimport {runGateway} from './dc-workspace-http.js';\nif(!process.send)throw Error('INSTANCE_WORKER_REQUIRES_SUPERVISOR');\nverifyInternalSetupWorker({port:Number(process.env.MAC_MCP_PROJECT_PORT),ownerPid:Number(process.env.MAC_MCP_INTERNAL_SETUP_OWNER_PID),\n  runId:process.env.MAC_MCP_INTERNAL_SETUP_RUN_ID,token:process.env.MAC_MCP_INTERNAL_SETUP_TOKEN});\nawait runGateway();\nprocess.send({type:'gateway-ready'});\n"]}

package/dist/src/invocation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"invocation.js","sourceRoot":"","sources":["../../src/invocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAC,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAYzD,mFAAmF;AACnF,+EAA+E;AAC/E,MAAM,UAAU,GAAG,IAAI,OAAO,EAAwC,CAAC;AACvE,MAAM,KAAK,GAAkB,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAG7D,MAAM,UAAU,mBAAmB,CAAC,UAA0B;IAC5D,MAAM,UAAU,GAAyB,MAAM,CAAC,MAAM,CAAC,EAAC,CAAC,KAAK,CAAC,EAAE,IAAa,EAAC,CAAC,CAAC;IACjF,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;IACxD,OAAO,UAAU,CAAC;AACpB,CAAC;AACD,MAAM,UAAU,wBAAwB,CAAC,QAAqB;IAC5D,OAAO,KAAK,EAAE,UAAgC,EAA2B,EAAE;QACzE,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,YAAY,CAAC,uCAAuC,CAAC,CAAC;QACjF,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,yDAAyD;QACxF,OAAO,QAAQ,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC;IACzD,CAAC,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,aAAa,CAAC,KAAgB;IAC5C,OAAO,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC;AACD,MAAM,UAAU,aAAa,CAAC,QAAoB,EAAE,KAAgB,EAAE,OAAuB;IAC3F,IAAI,CAAC;QAAC,QAAQ,EAAE,CAAC;IAAC,CAAC;IACnB,MAAM,CAAC;QAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAC,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAC,CAAC,CAAC;IAAC,CAAC;AAChG,CAAC;AACD,SAAS,UAAU,CAAI,KAAQ;IAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,SAAS,MAAM,CAAC,IAAa;QAC3B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,IAAuB,CAAC;AACjC,CAAC;AACD,MAAM,UAAU,wBAAwB,CAAC,OAMxC;IACC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9C,OAAO,KAAK,EAAE,MAAsB,EAA2B,EAAE;QAC/D,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,gFAAgF;QAChF,kFAAkF;QAClF,MAAM,OAAO,GAAmB,OAAO,CAAC,OAAO,IAAI,EAAC,SAAS,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAC,IAAI,EAAE,kBAAkB,EAAC,EAAC,CAAC;QACnH,MAAM,OAAO,GAAG,UAAU,CAAC,EAAC,OAAO,EAAE,UAAU,EAAC,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YAC5E,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,wBAAwB,CAAC;YAC5D,KAAK,CAAC,EAAC,KAAK,EAAC,wBAAwB,EAAC,SAAS,EAAC,OAAO,CAAC,SAAS,EAAC,IAAI,EAAC,UAAU,CAAC,IAAI,EAAC,MAAM,EAAC,CAAC,CAAC;YAChG,OAAO,EAAC,OAAO,EAAC,IAAI,EAAC,OAAO,EAAC,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,MAAM,GAAC,sDAAsD,EAAC,CAAC,EAAC,CAAC;QACnH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,SAAS;YAC9B,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAAC,CAAC;YAC1D,MAAM,CAAC;gBAAC,KAAK,CAAC,EAAC,KAAK,EAAC,sBAAsB,EAAC,SAAS,EAAC,OAAO,CAAC,SAAS,EAAC,CAAC,CAAC;YAAC,CAAC;QAC9E,CAAC;QACD,OAAO,MAAM,CAAC,CAAC,0DAA0D;IAC3E,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport type { AuditSink,CallToolResult,DenyRules,McpUpstream,RequestContext,ToolInvocation } from './contracts.js';\nimport { errorCode,GatewayError } from './validation.js';\n\ntype DeepReadonly<T> = T extends object ? {readonly [K in keyof T]: DeepReadonly<T[K]>} : T;\nexport interface ToolCallContext {\n  readonly request: DeepReadonly<RequestContext>;\n  readonly invocation: DeepReadonly<ToolInvocation>;\n}\nexport interface InvocationMiddleware {\n  beforeCall?(context: ToolCallContext): void | Promise<void>;\n  afterCall?(context: ToolCallContext, result: DeepReadonly<CallToolResult>): void | Promise<void>;\n}\n\n// Internal capability; only policy/dispatch code issues these after authorization.\n// It is deliberately not a package export or an authorization API for plugins.\nconst authorized = new WeakMap<AuthorizedInvocation, ToolInvocation>();\nconst brand: unique symbol = Symbol('authorized invocation');\nexport interface AuthorizedInvocation {readonly [brand]: true}\nexport type AuthorizationDecision = {allowed: true; invocation: AuthorizedInvocation} | {allowed: false; reason: string};\nexport function authorizeInvocation(invocation: ToolInvocation): AuthorizedInvocation {\n  const capability: AuthorizedInvocation = Object.freeze({[brand]: true as const});\n  authorized.set(capability, structuredClone(invocation));\n  return capability;\n}\nexport function createInvocationExecutor(upstream: McpUpstream) {\n  return async (capability: AuthorizedInvocation): Promise<CallToolResult> => {\n    const invocation = authorized.get(capability);\n    if (!invocation) throw new GatewayError('INVOCATION_NOT_AUTHORIZED_OR_CONSUMED');\n    authorized.delete(capability); // consume before awaiting; uncertain calls cannot replay\n    return upstream.forwardWorkspaceInvocation(invocation);\n  };\n}\nexport function safeAuditSink(audit: AuditSink): AuditSink {\n  return event => { try { audit(event); } catch { /* Observation must not change execution. */ } };\n}\nexport function observeSafely(observer: () => void, audit: AuditSink, context: RequestContext): void {\n  try { observer(); }\n  catch { safeAuditSink(audit)({event: 'TOOL_OBSERVER_FAILED', requestId: context.requestId}); }\n}\nfunction frozenCopy<T>(value: T): DeepReadonly<T> {\n  const copy = structuredClone(value);\n  function freeze(item: unknown): void {\n    if (item && typeof item === 'object') {\n      for (const child of Object.values(item)) freeze(child);\n      Object.freeze(item);\n    }\n  }\n  freeze(copy);\n  return copy as DeepReadonly<T>;\n}\nexport function createInvocationPipeline(options: {\n  dispatch: (invocation: ToolInvocation, context: RequestContext) => Promise<CallToolResult>;\n  audit?: AuditSink;\n  denyRules?: Pick<DenyRules, 'check'>;\n  middleware?: readonly InvocationMiddleware[];\n  request?: RequestContext;\n}) {\n  const audit = safeAuditSink(options.audit || (() => {}));\n  const hooks = [...(options.middleware || [])];\n  return async (params: ToolInvocation): Promise<CallToolResult> => {\n    const invocation = structuredClone(params);\n    // Only the authenticated HTTP boundary supplies identity. Direct internal calls\n    // remain unverified; loopback and caller-supplied identity headers are not proof.\n    const request: RequestContext = options.request ?? {requestId: randomUUID(), identity: {kind: 'unverified-local'}};\n    const context = frozenCopy({request, invocation});\n    try {\n      await options.denyRules?.check(invocation.name, invocation.arguments || {});\n      for (const hook of hooks) await hook.beforeCall?.(context);\n    } catch (error) {\n      const reason = errorCode(error) || 'DENY_RULE_CHECK_FAILED';\n      audit({event:'TOOL_EXPLICITLY_DENIED',requestId:request.requestId,tool:invocation.name,reason});\n      return {isError:true,content:[{type:'text',text:reason+': Review filters on the Mac owner Dashboard /filters'}]};\n    }\n    const result = await options.dispatch(invocation, request);\n    for (const hook of hooks) {\n      if (!hook.afterCall) continue;\n      try { await hook.afterCall(context, frozenCopy(result)); }\n      catch { audit({event:'TOOL_OBSERVER_FAILED',requestId:request.requestId}); }\n    }\n    return result; // original MCP result, including unknown extension fields\n  };\n}\n"]}

package/dist/src/live-profile-home-settings.js

@@ -1,80 +0,0 @@
-import { privateAgentSchema } from "./config-schemas.js";
-import { currentUid, GatewayError, parseJSON } from "./validation.js";
-// Only the local Mac owner may migrate an existing foreground "live" profile.
-// This never creates a second Core, edits TCC, or alters upstream DC settings.
-import { execFile } from "node:child_process";
-import { chmod, lstat, open, rename, rm, writeFile } from "node:fs/promises";
-import path from "node:path";
-import { promisify } from "node:util";
-const exec = promisify(execFile);
-const LABEL = "ai.home.mac-mcp-project-workspace";
-function fail(code) { const e = new GatewayError(code); throw e; }
-;
-export function makeHomeScopedLiveProfile(value, home) {
-    const parsed = privateAgentSchema.safeParse(value);
-    if (!parsed.success)
-        fail("LIVE_PROFILE_UNRECOGNIZED");
-    const data = parsed.data;
-    if (typeof home !== "string" || !path.isAbsolute(home) || home === "/" || home === "/Users")
-        fail("LIVE_HOME_INVALID");
-    if (data?.Label !== LABEL || !Array.isArray(data.ProgramArguments) ||
-        data.ProgramArguments.length !== 2 || !data.EnvironmentVariables ||
-        data.EnvironmentVariables.MAC_MCP_PROJECT_PORT !== "8793" ||
-        data.EnvironmentVariables.MAC_MCP_DC_ACCESS_MODE !== "native" ||
-        data.EnvironmentVariables.MAC_MCP_DEV_COMMANDS !== "trusted-project" ||
-        data.EnvironmentVariables.MAC_MCP_WORKSPACE_MODE !== "read-write")
-        fail("LIVE_PROFILE_UNRECOGNIZED");
-    const env = data.EnvironmentVariables;
-    if (env.MAC_MCP_UPSTREAMS_FILE || !(["off", undefined].includes(env.MAC_MCP_GIT_MODE)))
-        fail("LIVE_HOME_SCOPE_EXTRA_EXECUTORS_UNSAFE");
-    if (!data.ProgramArguments[1].startsWith(path.join(home, "Library", "Application Support", "Mac-MCP-Gateway", "releases") + path.sep) ||
-        path.basename(data.ProgramArguments[1]) !== "dc-workspace-http.mjs" ||
-        data.WorkingDirectory !== path.dirname(path.dirname(data.ProgramArguments[1])))
-        fail("LIVE_RUNTIME_UNRECOGNIZED");
-    return { ...data, EnvironmentVariables: {
-            ...env, MAC_MCP_PROJECT_ROOT: home, MAC_MCP_DC_WRITE_SCOPE: "home-only"
-        } };
-}
-export async function applyLiveHomeScope({ home, verifyStopped, plist = path.join(home, "Library/LaunchAgents", LABEL + ".plist") }) {
-    if (typeof verifyStopped !== "function")
-        fail("LIVE_STOP_VERIFIER_REQUIRED");
-    const original = await lstat(plist);
-    if (!original.isFile() || original.isSymbolicLink() || original.nlink !== 1 ||
-        original.uid !== currentUid() || (original.mode & 0o022) !== 0)
-        fail("LIVE_PLIST_UNTRUSTED");
-    if (!await verifyStopped())
-        fail("LIVE_CORE_MUST_BE_STOPPED");
-    const { stdout } = await exec("/usr/bin/plutil", ["-convert", "json", "-o", "-", plist], { timeout: 5000, maxBuffer: 40000 });
-    const current = parseJSON(stdout);
-    const updated = makeHomeScopedLiveProfile(current, home);
-    const dir = path.dirname(plist);
-    const tmp = path.join(dir, ".mac-mcp-live-settings-" + process.pid + "-" + Date.now() + ".plist");
-    let handle;
-    try {
-        // plutil serializes the checked object, not user-provided XML.
-        const raw = JSON.stringify(updated);
-        const tmpJson = tmp + ".json";
-        await writeFile(tmpJson, raw, { flag: "wx", mode: 0o600 });
-        try {
-            await exec("/usr/bin/plutil", ["-convert", "xml1", "-o", tmp, tmpJson], { timeout: 5000, maxBuffer: 12000 });
-        }
-        finally {
-            await rm(tmpJson, { force: true });
-        }
-        await chmod(tmp, original.mode & 0o777);
-        handle = await open(tmp, "r");
-        await handle.sync();
-        await handle.close();
-        handle = null;
-        // Verify the Core remains stopped at the moment of atomic replacement.
-        if (!await verifyStopped())
-            fail("LIVE_CORE_CHANGED_DURING_SAVE");
-        await rename(tmp, plist);
-        return { event: "LIVE_HOME_SCOPE_APPLIED", writeScope: "home-only" };
-    }
-    finally {
-        await handle?.close().catch(() => { });
-        await rm(tmp, { force: true });
-    }
-}
-//# sourceMappingURL=live-profile-home-settings.js.map

package/dist/src/live-profile-home-settings.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"live-profile-home-settings.js","sourceRoot":"","sources":["../../src/live-profile-home-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAC,YAAY,EAAC,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACpE,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAC,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,EAAE,EAAC,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,MAAM,IAAI,GAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC/B,MAAM,KAAK,GAAC,mCAAmC,CAAC;AAChD,SAAS,IAAI,CAAC,IAAY,IAAU,MAAM,CAAC,GAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA,MAAM,CAAC,CAAC,CAAA,CAAC;AAAA,CAAC;AAE7E,MAAM,UAAU,yBAAyB,CAAC,KAAc,EAAC,IAAY;IACnE,MAAM,MAAM,GAAC,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjD,IAAG,CAAC,MAAM,CAAC,OAAO;QAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACrD,MAAM,IAAI,GAAC,MAAM,CAAC,IAAI,CAAC;IACvB,IAAG,OAAO,IAAI,KAAG,QAAQ,IAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAE,IAAI,KAAG,GAAG,IAAE,IAAI,KAAG,QAAQ;QAC5E,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC5B,IAAG,IAAI,EAAE,KAAK,KAAG,KAAK,IAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAC1D,IAAI,CAAC,gBAAgB,CAAC,MAAM,KAAG,CAAC,IAAE,CAAC,IAAI,CAAC,oBAAoB;QAC5D,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,KAAG,MAAM;QACvD,IAAI,CAAC,oBAAoB,CAAC,sBAAsB,KAAG,QAAQ;QAC3D,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,KAAG,iBAAiB;QAClE,IAAI,CAAC,oBAAoB,CAAC,sBAAsB,KAAG,YAAY;QAChE,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACpC,MAAM,GAAG,GAAC,IAAI,CAAC,oBAAoB,CAAC;IACpC,IAAG,GAAG,CAAC,sBAAsB,IAAE,CAAC,CAAC,CAAC,KAAK,EAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAChF,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACjD,IAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,SAAS,EAAC,qBAAqB,EAAC,iBAAiB,EAAC,UAAU,CAAC,GAAC,IAAI,CAAC,GAAG,CAAC;QAC3H,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAG,uBAAuB;QACjE,IAAI,CAAC,gBAAgB,KAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACpC,OAAO,EAAC,GAAG,IAAI,EAAC,oBAAoB,EAAC;YACnC,GAAG,GAAG,EAAC,oBAAoB,EAAC,IAAI,EAAC,sBAAsB,EAAC,WAAW;SACpE,EAAC,CAAC;AACL,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACxC,IAAI,EAAE,aAAa,EACnB,KAAK,GAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,sBAAsB,EAAC,KAAK,GAAC,QAAQ,CAAC,EACU;IACpE,IAAG,OAAO,aAAa,KAAG,UAAU;QAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;IAClC,IAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAE,QAAQ,CAAC,cAAc,EAAE,IAAE,QAAQ,CAAC,KAAK,KAAG,CAAC;QACjE,QAAQ,CAAC,GAAG,KAAG,UAAU,EAAE,IAAE,CAAC,QAAQ,CAAC,IAAI,GAAC,KAAK,CAAC,KAAG,CAAC;QACvD,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC/B,IAAG,CAAC,MAAM,aAAa,EAAE;QAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC5D,MAAM,EAAC,MAAM,EAAC,GAAC,MAAM,IAAI,CAAC,iBAAiB,EAAC,CAAC,UAAU,EAAC,MAAM,EAAC,IAAI,EAAC,GAAG,EAAC,KAAK,CAAC,EAC5E,EAAC,OAAO,EAAC,IAAI,EAAC,SAAS,EAAC,KAAK,EAAC,CAAC,CAAC;IAClC,MAAM,OAAO,GAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,OAAO,GAAC,yBAAyB,CAAC,OAAO,EAAC,IAAI,CAAC,CAAC;IACtD,MAAM,GAAG,GAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAC,yBAAyB,GAAC,OAAO,CAAC,GAAG,GAAC,GAAG,GAAC,IAAI,CAAC,GAAG,EAAE,GAAC,QAAQ,CAAC,CAAC;IACvF,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,+DAA+D;QAC/D,MAAM,GAAG,GAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,OAAO,GAAC,GAAG,GAAC,OAAO,CAAC;QAC1B,MAAM,SAAS,CAAC,OAAO,EAAC,GAAG,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAC,CAAC,UAAU,EAAC,MAAM,EAAC,IAAI,EAAC,GAAG,EAAC,OAAO,CAAC,EAC/D,EAAC,OAAO,EAAC,IAAI,EAAC,SAAS,EAAC,KAAK,EAAC,CAAC,CAAC;QACpC,CAAC;gBAAO,CAAC;YAAA,MAAM,EAAE,CAAC,OAAO,EAAC,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC;QAAA,CAAC;QACzC,MAAM,KAAK,CAAC,GAAG,EAAC,QAAQ,CAAC,IAAI,GAAC,KAAK,CAAC,CAAC;QACrC,MAAM,GAAC,MAAM,IAAI,CAAC,GAAG,EAAC,GAAG,CAAC,CAAC;QAAA,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAAA,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAAA,MAAM,GAAC,IAAI,CAAC;QAChF,uEAAuE;QACvE,IAAG,CAAC,MAAM,aAAa,EAAE;YAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAChE,MAAM,MAAM,CAAC,GAAG,EAAC,KAAK,CAAC,CAAC;QACxB,OAAO,EAAC,KAAK,EAAC,yBAAyB,EAAC,UAAU,EAAC,WAAW,EAAC,CAAC;IAClE,CAAC;YAAO,CAAC;QACP,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAE,EAAE,GAAC,CAAC,CAAC,CAAC;QACpC,MAAM,EAAE,CAAC,GAAG,EAAC,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC","sourcesContent":["import { privateAgentSchema } from \"./config-schemas.js\";\nimport { currentUid,GatewayError,parseJSON } from \"./validation.js\";\n// Only the local Mac owner may migrate an existing foreground \"live\" profile.\n// This never creates a second Core, edits TCC, or alters upstream DC settings.\nimport { execFile } from \"node:child_process\";\nimport { chmod,lstat,open,rename,rm,writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { promisify } from \"node:util\";\nconst exec=promisify(execFile);\nconst LABEL=\"ai.home.mac-mcp-project-workspace\";\nfunction fail(code: string): never {const e=new GatewayError(code);throw e;};\n\nexport function makeHomeScopedLiveProfile(value: unknown,home: string){\n  const parsed=privateAgentSchema.safeParse(value);\n  if(!parsed.success)fail(\"LIVE_PROFILE_UNRECOGNIZED\");\n  const data=parsed.data;\n  if(typeof home!==\"string\"||!path.isAbsolute(home)||home===\"/\"||home===\"/Users\")\n    fail(\"LIVE_HOME_INVALID\");\n  if(data?.Label!==LABEL||!Array.isArray(data.ProgramArguments)||\n     data.ProgramArguments.length!==2||!data.EnvironmentVariables||\n     data.EnvironmentVariables.MAC_MCP_PROJECT_PORT!==\"8793\"||\n     data.EnvironmentVariables.MAC_MCP_DC_ACCESS_MODE!==\"native\"||\n     data.EnvironmentVariables.MAC_MCP_DEV_COMMANDS!==\"trusted-project\"||\n     data.EnvironmentVariables.MAC_MCP_WORKSPACE_MODE!==\"read-write\")\n    fail(\"LIVE_PROFILE_UNRECOGNIZED\");\n  const env=data.EnvironmentVariables;\n  if(env.MAC_MCP_UPSTREAMS_FILE||!([\"off\",undefined].includes(env.MAC_MCP_GIT_MODE)))\n    fail(\"LIVE_HOME_SCOPE_EXTRA_EXECUTORS_UNSAFE\");\n  if(!data.ProgramArguments[1].startsWith(path.join(home,\"Library\",\"Application Support\",\"Mac-MCP-Gateway\",\"releases\")+path.sep)||\n     path.basename(data.ProgramArguments[1])!==\"dc-workspace-http.mjs\"||\n     data.WorkingDirectory!==path.dirname(path.dirname(data.ProgramArguments[1])))\n    fail(\"LIVE_RUNTIME_UNRECOGNIZED\");\n  return {...data,EnvironmentVariables:{\n    ...env,MAC_MCP_PROJECT_ROOT:home,MAC_MCP_DC_WRITE_SCOPE:\"home-only\"\n  }};\n}\nexport async function applyLiveHomeScope({\n home, verifyStopped,\n plist=path.join(home,\"Library/LaunchAgents\",LABEL+\".plist\")\n}: {home: string; verifyStopped: ()=>Promise<boolean>; plist?: string}){\n  if(typeof verifyStopped!==\"function\")fail(\"LIVE_STOP_VERIFIER_REQUIRED\");\n  const original=await lstat(plist);\n  if(!original.isFile()||original.isSymbolicLink()||original.nlink!==1||\n     original.uid!==currentUid()||(original.mode&0o022)!==0)\n    fail(\"LIVE_PLIST_UNTRUSTED\");\n  if(!await verifyStopped())fail(\"LIVE_CORE_MUST_BE_STOPPED\");\n  const {stdout}=await exec(\"/usr/bin/plutil\",[\"-convert\",\"json\",\"-o\",\"-\",plist],\n    {timeout:5000,maxBuffer:40000});\n  const current=parseJSON(stdout);\n  const updated=makeHomeScopedLiveProfile(current,home);\n  const dir=path.dirname(plist);\n  const tmp=path.join(dir,\".mac-mcp-live-settings-\"+process.pid+\"-\"+Date.now()+\".plist\");\n  let handle;\n  try {\n    // plutil serializes the checked object, not user-provided XML.\n    const raw=JSON.stringify(updated);\n    const tmpJson=tmp+\".json\";\n    await writeFile(tmpJson,raw,{flag:\"wx\",mode:0o600});\n    try {\n      await exec(\"/usr/bin/plutil\",[\"-convert\",\"xml1\",\"-o\",tmp,tmpJson],\n        {timeout:5000,maxBuffer:12000});\n    }finally{await rm(tmpJson,{force:true});}\n    await chmod(tmp,original.mode&0o777);\n    handle=await open(tmp,\"r\");await handle.sync();await handle.close();handle=null;\n    // Verify the Core remains stopped at the moment of atomic replacement.\n    if(!await verifyStopped())fail(\"LIVE_CORE_CHANGED_DURING_SAVE\");\n    await rename(tmp,plist);\n    return {event:\"LIVE_HOME_SCOPE_APPLIED\",writeScope:\"home-only\"};\n  }finally{\n    await handle?.close().catch(()=>{});\n    await rm(tmp,{force:true});\n  }\n}\n"]}

package/dist/src/local-desktop-read-probe.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"local-desktop-read-probe.js","sourceRoot":"","sources":["../../src/local-desktop-read-probe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,QAAQ,EAAC,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAC,SAAS,EAAC,MAAM,WAAW,CAAC;AACpC,OAAO,EAAC,OAAO,EAAC,WAAW,EAAC,YAAY,EAAC,iBAAiB,EAAC,cAAc,EAAC,MAAM,eAAe,CAAC;AAEhG,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAC,WAAW,EAAC,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,kFAAkF;AAClF,mFAAmF;AACnF,yDAAyD;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,MAAM,EAAC,SAAS,EAAC,KAAK,EAAC,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,OAAO,GAAC,WAAW,CAAC;AAC1B,MAAM,QAAQ,GAAG,WAAW,CAAC;AAC7B,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,4EAA4E;AAC5E,8EAA8E;AAC9E,MAAM,UAAU,yBAAyB,CAAC,MAAM,GAAC,MAAM;IACrD,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AACrC,CAAC;AACD,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;AACzD,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,wBAAwB,GAAG,KAAK,CAAC,CAAC,iEAAiE;AAEzG,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,YAAY,CAAC;IAC3B,MAAM,GAAG,GAA0B,EAAE,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,KAAK;QAAE,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;IAC5E,sFAAsF;IACtF,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,mBAAmB,CAAC,GAA0B;IACrD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,MAAM,OAAO,qBAAqB;IAChC,OAAO,GAAgB,IAAI,CAAC;IAC5B,UAAU,GAA2B,IAAI,CAAC;IAC1C,UAAU,GAAa,EAAE,CAAC;IAC1B,gBAAgB,GAAW,EAAE,CAAC;IAC9B,WAAW,CAAS;IAEpB,YAAY,EAAC,UAAU,GAAC,cAAc,EAAC,GAAC,EAAE;QACxC,IAAG,CAAC,CAAC,cAAc,EAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;YACnD,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,GAAC,UAAU,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvD,MAAM,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;QAC3B,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,UAAU,GAAC,IAAI,CAAC,WAAW,KAAG,WAAW,CAAA,CAAC;YAC9C,MAAM,qBAAqB,CAAC;gBAC1B,IAAI,EAAC,GAAG,CAAC,IAAI,EAAE,UAAU,EAAC,OAAO,CAAC,QAAQ;gBAC1C,SAAS,EAAC,yBAAyB,EAAE;aACtC,CAAC,CAAA,CAAC;YACH,EAAC,OAAO,EAAC,OAAO,CAAC,QAAQ,EAAC,IAAI,EAAC,yBAAyB,EAAE,EAAC,CAAC;QAC9D,mEAAmE;QACnE,0EAA0E;QAC1E,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;YACzC,GAAG,UAAU,EAAC,GAAG,EAAC,MAAM,EAAC,MAAM;SAChC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,OAAO,EAAE,EACtD,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChF,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;gBACtF,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrD,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3E,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;YACtB,IAAI,CAAC,UAAU,GAAC,SAAS,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrC,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,KAAK,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,eAAe,KAAK,OAAO,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAExE,uEAAuE;IACvE,2EAA2E;IAC3E,yDAAyD;IACzD,KAAK,CAAC,mBAAmB;QACvB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACpD,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;IAC9D,CAAC;IACD,KAAK,CAAC,kBAAkB,CAAC,GAAW;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAC,GAAG,EAAC,CAAC,CAAC;IAC1C,CAAC;IACD,KAAK,CAAC,2BAA2B;QAC/B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACpD,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,0BAA0B,CAAC,UAA0B;QACzD,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,KAAG,UAAU,CAAC,IAAI,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,OAAO,UAAU,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,UAAkB;QACvC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACpD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,iBAAiB,CAAC;YAC/C,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU;YACxC,YAAY,EAAE,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,EAAE,QAAQ,EAAE,QAAQ;SAC7E,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,EAAC,IAAI,EAAE,YAAY,EAAC,EAAC,CAAC,CAAC,CAAC;IACvG,CAAC;IAED,KAAK,CAAC,uBAAuB;QAC3B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAClD,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC;YACrD,CAAC,WAAW,CAAC,SAAS,EAAC,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,wBAAwB;YAClE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,OAAO,UAAU,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAC,IAAI,EAAC,WAAW,EAAC,SAAS,EAAC,EAAC,IAAI,EAAC,SAAS,EAAC,EAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,OAAe;QAC3C,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACpD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,GAAG;YACjE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;YAC5C,CAAC,WAAW,CAAC,QAAQ,EAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YAChD,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3C,MAAM,CAAC,CAAC;QACV,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE;YAC5D,QAAQ,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAC,QAAQ,CAAC,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,OAAO,UAAU,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAC,IAAI,EAAC,YAAY,EAAC,SAAS,EAAC;gBACzE,IAAI,EAAC,SAAS,EAAC,OAAO,EAAC,IAAI,EAAC,SAAS;aACtC,EAAC,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACpD,OAAO,UAAU,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAC,IAAI,EAAC,eAAe,EAAC,SAAS,EAAC;gBAC5E,GAAG,cAAc,CAAC,iBAAiB,CAAC,EAAC,UAAU,EAAC,IAAI;aACrD,EAAC,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAQ,GAAG,gBAAgB;QAC3C,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACpD,IAAI,QAAQ,KAAK,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC7F,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,MAAM,iBAAiB,CAAC;YAC1D,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ;YACtC,YAAY,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,QAAQ;SACrD,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YACpD,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SAC/B,CAAC,CAAC,CAAC;QACJ,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC/D,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,MAAM,GAAG,GAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC;QAAA,IAAI,CAAC,UAAU,GAAC,IAAI,CAAC;QACpD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC;QAC3B,+EAA+E;QAC/E,IAAG,OAAO,IAAE,GAAG;YAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAC,CAAC,MAAM,EAAC,MAAM,CAAC,GAAG,CAAC,EAAC,IAAI,EAAC,IAAI,CAAC,EAAC,EAAC,WAAW,EAAC,IAAI,EAAC,OAAO,EAAC,IAAI,EAAC,CAAC,CAAC,KAAK,CAAC,GAAE,EAAE,GAAC,CAAC,CAAC,CAAC;QACvI,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnD,CAAC;CACF;AAED,0EAA0E;AAC1E,4EAA4E","sourcesContent":["import {execFile} from \"node:child_process\";\nimport {promisify} from \"node:util\";\nimport {windows,ownedByUser,childEnvKeys,systemNameCommand,commandOptions} from \"./platform.js\";\nimport type { Tool,ToolInvocation } from \"./contracts.js\";\nimport { toolResult } from \"./mcp-results.js\";\nimport { desktopCommanderEntry,fixtureRoot,packageRoot } from \"./runtime-paths.js\";\nimport { errorCode } from \"./validation.js\";\n// Desktop Commander stdio MCP client for fixture tests and the private P1 bridge.\n// NOT imported into public P0 src/server.mjs; only explicitly approved operations.\n// This adapter exposes no arbitrary callTool capability.\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { StdioClientTransport } from \"@modelcontextprotocol/sdk/client/stdio.js\";\nimport { access,constants,lstat,readFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { sandboxedDesktopSpawn } from \"./home-write-sandbox.js\";\nimport { resolveScopedRead } from \"./read-scope.js\";\n\nconst PROJECT=packageRoot;\nconst FIXTURES = fixtureRoot;\nconst DC_BIN = desktopCommanderEntry;\n// The embedded upstream must not launch browser onboarding on every Gateway\n// connection or after test/dev child restarts. Supported upstream CLI option.\nexport function desktopCommanderSpawnArgs(binary=DC_BIN) {\n  return [binary, \"--no-onboarding\"];\n}\nconst EXPOSED_LOCAL_TOOLS = Object.freeze([\"read_file\"]);\nconst MAX_READ = 4096;\nconst MAX_PROJECT_README_BYTES = 16384; // Project README may grow; synthetic fixture limit remains 4096.\n\nfunction sanitizedEnv() {\n  const allow = childEnvKeys;\n  const env: Record<string,string> = {};\n  for (const key of allow) if (process.env[key]) env[key] = process.env[key]!;\n  // no .zshrc loading; no ALIYUN_ACCESSKEY*, OPENAI_API_KEY, or other inherited secrets\n  return env;\n}\nfunction assertNoCredentials(env: Record<string,string>) {\n  for (const key of Object.keys(env)) {\n    if (/KEY|TOKEN|SECRET|PASSWORD|AUTH|PROXY/i.test(key))\n      throw new Error(\"Forbidden child-process environment key\");\n  }\n}\n\nexport class LocalDesktopReadProbe {\n  #client: Client|null = null;\n  #transport:StdioClientTransport|null=null;\n  #toolNames: string[] = [];\n  #upstreamCatalog: Tool[] = [];\n  #writeScope: string;\n\n  constructor({writeScope=\"unrestricted\"}={}){\n    if(![\"unrestricted\",\"home-only\"].includes(writeScope))\n      throw Error(\"INVALID_DC_WRITE_SCOPE\");\n    this.#writeScope=writeScope;\n  }\n\n  async connect() {\n    if (this.#client) throw new Error(\"Already connected\");\n    await access(DC_BIN, constants.R_OK);\n    const env = sanitizedEnv();\n    assertNoCredentials(env);\n    const executable=this.#writeScope===\"home-only\"?\n      await sandboxedDesktopSpawn({\n        home:env.HOME, nodeBinary:process.execPath,\n        entryArgs:desktopCommanderSpawnArgs()\n      }):\n      {command:process.execPath,args:desktopCommanderSpawnArgs()};\n    // The sandbox follows DC and every shell/process launched from DC.\n    // A failed sandbox launch must never fall back to unrestricted native DC.\n    const transport = new StdioClientTransport({\n      ...executable,env,stderr:\"pipe\"\n    });\n    const client = new Client({ name: \"mac-mcp-local-read-probe\", version: \"0.1.0\" },\n                              { capabilities: {} });\n    try {\n      await client.connect(transport);\n      const tools = await client.listTools();\n      const names = tools.tools.map(x => x.name);\n      if (!names.includes(\"read_file\")) throw new Error(\"Upstream read_file missing\");\n      if (new Set(names).size !== names.length || names.some(name => typeof name !== \"string\"))\n        throw new Error(\"Invalid upstream catalog\");\n      this.#upstreamCatalog = structuredClone(tools.tools);\n      this.#toolNames = names.filter(name => EXPOSED_LOCAL_TOOLS.includes(name));\n      this.#client = client;\n      this.#transport=transport;\n    } catch (e) {\n      await client.close().catch(() => {});\n      throw e;\n    }\n  }\n\n  get allowedToolNames() { return Object.freeze([...this.#toolNames]); }\n  get upstreamCatalog() { return structuredClone(this.#upstreamCatalog); }\n\n  // MCP Apps advertised by upstream tool _meta must remain available via\n  // resources/list and resources/read. This is static upstream-owned UI, not\n  // a Gateway reimplementation of Desktop Commander's app.\n  async listNativeResources() {\n    if (!this.#client) throw new Error(\"Not connected\");\n    return (await this.#client.listResources()).resources || [];\n  }\n  async readNativeResource(uri: string) {\n    if (!this.#client) throw new Error(\"Not connected\");\n    return this.#client.readResource({uri});\n  }\n  async listNativeResourceTemplates() {\n    if (!this.#client) throw new Error(\"Not connected\");\n    return (await this.#client.listResourceTemplates()).resourceTemplates || [];\n  }\n\n  async forwardWorkspaceInvocation(invocation: ToolInvocation) {\n    if (!this.#client) throw new Error(\"Not connected\");\n    if (!invocation || !this.#upstreamCatalog.some(t=>t.name===invocation.name))\n      throw new Error(\"Unknown upstream tool\");\n    return toolResult(await this.#client.callTool(invocation));\n  }\n\n  async callApprovedRead(pathToFile: string) {\n    if (!this.#client) throw new Error(\"Not connected\");\n    const { absolutePath } = await resolveScopedRead({\n      root: FIXTURES, relativePath: pathToFile,\n      allowedFiles: [\"p1-fixture.txt\", \"dc-bridge-canary.txt\"], maxBytes: MAX_READ\n    });\n    return toolResult(await this.#client.callTool({name: \"read_file\", arguments: {path: absolutePath}}));\n  }\n\n  async callApprovedProjectRead() {\n    if (!this.#client) throw new Error(\"Not connected\");\n    const candidate = path.join(PROJECT, \"README.md\");\n    const st = await lstat(candidate);\n    if (!st.isFile() || st.isSymbolicLink() || st.nlink !== 1 ||\n        !ownedByUser(candidate,st) || st.size > MAX_PROJECT_README_BYTES)\n      throw new Error(\"Project file failed read approval\");\n    return toolResult(await this.#client.callTool({name:\"read_file\",arguments:{path:candidate}}));\n  }\n\n  async callApprovedCanaryWrite(content: string) {\n    if (!this.#client) throw new Error(\"Not connected\");\n    if (typeof content !== \"string\" || Buffer.byteLength(content) > 256)\n      throw new Error(\"Canary content exceeds approved bound\");\n    const root = await lstat(FIXTURES);\n    if (!root.isDirectory() || root.isSymbolicLink() ||\n        !ownedByUser(FIXTURES,root)) throw new Error(\"Fixture directory denied\");\n    const candidate = path.join(FIXTURES, \"dc-bridge-canary.txt\");\n    const existing = await lstat(candidate).catch(e => {\n      if (errorCode(e) === \"ENOENT\") return null;\n      throw e;\n    });\n    if (existing && (!existing.isFile() || existing.isSymbolicLink() ||\n        existing.nlink !== 1 || !ownedByUser(candidate,existing)))\n      throw new Error(\"Canary target denied\");\n    return toolResult(await this.#client.callTool({name:\"write_file\",arguments:{\n      path:candidate,content,mode:\"rewrite\"\n    }}));\n  }\n\n  async callApprovedSystemName() {\n    if (!this.#client) throw new Error(\"Not connected\");\n    return toolResult(await this.#client.callTool({name:\"start_process\",arguments:{\n      ...commandOptions(systemNameCommand),timeout_ms:3000\n    }}));\n  }\n\n  async readFixture(basename = \"p1-fixture.txt\") {\n    if (!this.#client) throw new Error(\"Not connected\");\n    if (basename !== \"p1-fixture.txt\") throw new Error(\"Only the synthetic fixture is approved\");\n    const { absolutePath: candidate } = await resolveScopedRead({\n      root: FIXTURES, relativePath: basename,\n      allowedFiles: [\"p1-fixture.txt\"], maxBytes: MAX_READ\n    });\n    const expected = await readFile(candidate, \"utf8\");\n    const result = toolResult(await this.#client.callTool({\n      name: \"read_file\",\n      arguments: { path: candidate }\n    }));\n    if (result.isError) throw new Error(\"Upstream read_file returned error\");\n    const combined = (result.content || []).filter(x => x.type === \"text\").map(x => x.text).join(\"\\n\");\n    if (!combined.includes(expected.trim())) {\n      throw new Error(\"Unexpected tool result; refusing to display private content\");\n    }\n    return { ok: true, fixture: basename, bytes: Buffer.byteLength(expected),\n             allowedToolNames: this.allowedToolNames };\n  }\n\n  async close() {\n    const client = this.#client;\n    const pid=this.#transport?.pid;this.#transport=null;\n    this.#client = null;\n    this.#upstreamCatalog = [];\n    // Only the upstream PID spawned by this instance is eligible for tree cleanup.\n    if(windows&&pid)await promisify(execFile)(\"taskkill.exe\",[\"/PID\",String(pid),\"/T\",\"/F\"],{windowsHide:true,timeout:8000}).catch(()=>{});\n    if (client) await client.close().catch(() => {});\n  }\n}\n\n// No general-purpose remote forwarding. All interactions live inside this\n// explicitly opted-in local test, not the public HTTP MCP request handlers.\n"]}

package/dist/src/managed-workspace-policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"managed-workspace-policy.js","sourceRoot":"","sources":["../../src/managed-workspace-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAC,cAAc,EAAC,gBAAgB,EAAC,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAC,SAAS,EAAC,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACvE,wEAAwE;AACxE,0EAA0E;AAC1E,OAAO,EAAE,KAAK,EAAC,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD,SAAS,IAAI,CAAC,MAAc,IAAU,MAAM,CAAC,GAAC,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA,MAAM,CAAC,CAAC,CAAA,CAAC;AAAA,CAAC;AACjF,MAAM,SAAS,GAAC,IAAI,GAAG,CAAC;IACtB,CAAC,WAAW,EAAC,MAAM,CAAC,EAAC,CAAC,eAAe,EAAC,MAAM,CAAC,EAAC,CAAC,gBAAgB,EAAC,MAAM,CAAC;IACvE,CAAC,YAAY,EAAC,MAAM,CAAC,EAAC,CAAC,YAAY,EAAC,WAAW,CAAC;CACjD,CAAC,CAAC;AACH,MAAM,SAAS,GAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAC,eAAe,EAAC,gBAAgB,CAAC,CAAC,CAAC;AACxE,MAAM,OAAO,GAAC,IAAI,GAAG,CAAC,CAAC,MAAM,EAAC,MAAM,EAAC,QAAQ,EAAC,SAAS,EAAC,OAAO,EAAC,SAAS;IACvE,QAAQ,EAAC,QAAQ,EAAC,MAAM,EAAC,SAAS,EAAC,aAAa,EAAC,WAAW;IAC5D,SAAS,EAAC,YAAY,EAAC,mBAAmB,CAAC,CAAC,CAAC;AAC/C,MAAM,UAAU,GAAC,uCAAuC,CAAC;AACzD,MAAM,YAAY,GAAC,CAAC,KAAa,EAAC,EAAE;IAClC,MAAM,KAAK,GAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,IAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AACtD,CAAC,CAAC;AACF,KAAK,UAAU,SAAS,CAAC,GAAY,EAAC,IAAY;IAChD,IAAG,OAAO,GAAG,KAAG,QAAQ,IAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAE,GAAG,CAAC,MAAM,GAAC,IAAI;QAC9D,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAE,CAAC,CAAC,OAAO,IAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAG,GAAG;QAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACrE,YAAY,CAAC,GAAG,CAAC,CAAC;IAClB,MAAM,SAAS,GAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpC,YAAY,CAAC,SAAS,CAAC,CAAC;IACxB,MAAM,EAAE,GAAC,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC,IAAG,EAAE,CAAC,cAAc,EAAE;QAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACxD,IAAG,IAAI,KAAG,MAAM,IAAE,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,IAAE,EAAE,CAAC,KAAK,KAAG,CAAC,IAAE,EAAE,CAAC,IAAI,GAAC,IAAI,GAAC,IAAI,CAAC;QAC/D,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACtC,IAAG,IAAI,KAAG,KAAK,IAAE,CAAC,EAAE,CAAC,WAAW,EAAE;QAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACxE,IAAG,IAAI,KAAG,MAAM,IAAE,CAAC,EAAE,CAAC,MAAM,EAAE,IAAE,CAAC,EAAE,CAAC,WAAW,EAAE;QAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACtF,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,SAAS,IAAI,CAAC,IAAmB,EAAC,QAAkB,EAAC,WAAmB,EAAE;IACxE,IAAG,CAAC,IAAI,IAAE,OAAO,IAAI,KAAG,QAAQ,IAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,GAAG,QAAQ,EAAC,GAAG,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,4BAA4B,CAAC,CAAC;AACvC,CAAC;AACD,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAC,IAAmB;IACtD,IAAG,IAAI,KAAG,gBAAgB,EAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,EAAC,CAAC,MAAM,CAAC,EAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9B,IAAG,IAAI,CAAC,KAAK,KAAG,SAAS,IAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;YAChD,IAAI,CAAC,KAAK,GAAC,CAAC,IAAE,IAAI,CAAC,KAAK,GAAC,CAAC,CAAC;YAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC5D,OAAO,EAAC,IAAI,EAAC,SAAS,EAAC,EAAC,IAAI,EAAC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAC,KAAK,CAAC,EAAC,KAAK,EAAC,IAAI,CAAC,KAAK,IAAE,CAAC,EAAC,EAAC,CAAC;IACtF,CAAC;IACD,IAAG,IAAI,KAAG,eAAe,EAAC,CAAC;QACzB,IAAI,CAAC,IAAI,EAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACpB,OAAO,EAAC,IAAI,EAAC,SAAS,EAAC,EAAC,IAAI,EAAC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAC,MAAM,CAAC,EAAC,EAAC,CAAC;IACnE,CAAC;IACD,IAAG,IAAI,KAAG,WAAW,EAAC,CAAC;QACrB,IAAI,CAAC,IAAI,EAAC,CAAC,MAAM,CAAC,EAAC,CAAC,QAAQ,EAAC,QAAQ,CAAC,CAAC,CAAC;QACxC,MAAM,MAAM,GAAC,IAAI,CAAC,MAAM,IAAE,CAAC,EAAC,MAAM,GAAC,IAAI,CAAC,MAAM,IAAE,GAAG,CAAC;QACpD,IAAG,CAAC,aAAa,CAAC,MAAM,CAAC,IAAE,MAAM,GAAC,CAAC;YACjC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAE,MAAM,GAAC,CAAC,IAAE,MAAM,GAAC,GAAG;YAC5C,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC/B,OAAO,EAAC,IAAI,EAAC,SAAS,EAAC,EAAC,IAAI,EAAC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAC,MAAM,CAAC,EAAC,MAAM,EAAC,MAAM,EAAC,EAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,8BAA8B,CAAC,CAAC;AACvC,CAAC;AACD,MAAM,KAAK,GAAC,CAAC,CAAS,EAAC,EAAE,CAAA,GAAG,GAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAC,OAAO,CAAC,GAAC,GAAG,CAAC;AAC3D,MAAM,UAAU,4BAA4B,CAAC,EAAC,UAAU,EAAC,MAAM,EAAyD;IACtH,IAAG,CAAC,UAAU,EAAE,IAAI,IAAE,CAAC,MAAM,EAAE,QAAQ,IAAE,CAAC,MAAM,CAAC,IAAI;QACnD,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAChC,MAAM,WAAW,GAAC,IAAI,GAAG,EAA2B,CAAC;IACrD,KAAK,UAAU,MAAM,CAAC,IAAY,EAAC,IAAmB;QACpD,MAAM,GAAG,GAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAG,CAAC,GAAG,IAAE,OAAO,IAAI,EAAE,CAAC,GAAG,CAAC,KAAG,QAAQ,IAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,UAAU,MAAM,CAAC,MAAc,EAAC,IAAkB;QACrD,kEAAkE;QAClE,IAAG,QAAQ,CAAC,MAAM,EAAC,UAAU,CAAC,IAAI,CAAC;YAAC,OAAO,EAAC,IAAI,EAAC,MAAM,EAAC,CAAC;QACzD,MAAM,MAAM,GAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,QAAQ,CAAC,MAAM,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aACxD,IAAI,CAAC,CAAC,CAAC,EAAC,CAAC,EAAC,EAAE,CAAA,CAAC,CAAC,IAAI,CAAC,MAAM,GAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAG,MAAM;YAAC,OAAO,EAAC,IAAI,EAAC,QAAQ,EAAC,GAAG,MAAM,EAAC,CAAC;QAC3C,IAAG,QAAQ,CAAC,MAAM,EAAC,MAAM,CAAC,IAAI,CAAC,IAAE,IAAI,CAAC,QAAQ;YAAC,OAAO,EAAC,IAAI,EAAC,WAAW,EAAC,CAAC;QACzE,IAAG,CAAC,QAAQ,CAAC,MAAM,EAAC,MAAM,CAAC,IAAI,CAAC,IAAE,IAAI,CAAC,WAAW;YAAC,OAAO,EAAC,IAAI,EAAC,WAAW,EAAC,CAAC;QAC7E,OAAO,EAAC,IAAI,EAAC,QAAQ,EAAC,CAAC;IACzB,CAAC;IACD,KAAK,UAAU,OAAO,CAAC,IAAY,EAAC,OAAoB,EAAE;QACxD,MAAM,MAAM,GAAC,MAAM,MAAM,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC;QACrC,IAAG,CAAC,MAAM;YAAC,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC;QAChD,MAAM,IAAI,GAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAC,MAAM,MAAM,CAAC,MAAM,EAAC,IAAI,CAAC,CAAC;QACzC,IAAG,QAAQ,CAAC,IAAI,KAAG,MAAM;YAAC,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC;QAC/D,8EAA8E;QAC9E,IAAG,QAAQ,CAAC,IAAI,KAAG,QAAQ,IAAE,QAAQ,CAAC,IAAI,KAAG,WAAW,EAAC,CAAC;YACxD,IAAG,CAAC;gBAAA,OAAO,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC;YAAA,CAAC;YAAA,MAAK,CAAC,CAAA,8BAA8B,CAAA,CAAC;QACvF,CAAC;QACD,IAAG,QAAQ,CAAC,IAAI,KAAG,QAAQ,EAAC,CAAC;YAC3B,MAAM,GAAG,GAAC,QAAQ,CAAC,IAAI,GAAC,GAAG,GAAC,QAAQ,CAAC,IAAI,CAAC;YAC1C,IAAI,MAAM,GAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAG,CAAC,MAAM,EAAC,CAAC;gBACV,MAAM,GAAC,MAAM,mBAAmB,CAAC,EAAC,IAAI,EAAC,QAAQ,CAAC,IAAI,EAAC,IAAI,EAAC,QAAQ,CAAC,IAAI;oBACrE,iBAAiB,EAAC,SAAS,EAAC,sBAAsB,EAAC,IAAI,EAAC,CAAC,CAAC;gBAC5D,WAAW,CAAC,GAAG,CAAC,GAAG,EAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,IAAG,QAAQ,CAAC,IAAI,KAAG,WAAW,EAAC,CAAC;YAC9B,IAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACpD,MAAM,UAAU,GAAC,MAAM,QAAQ,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC;YAC3C,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,SAAS,GAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1C,MAAM,UAAU,GAAC,QAAQ,CAAC,SAAS,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjD,IAAG,CAAC,UAAU,IAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAE,CAAC,CAAC,UAAU,IAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAC,CAAC;gBACjE,IAAG,CAAC,QAAQ,CAAC,SAAS,EAAC,UAAU,CAAC,IAAI,CAAC;oBACrC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,QAAQ,CAAC,SAAS,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBAChD,IAAI,CAAC,iCAAiC,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC5B,CAAC;IACD,KAAK,UAAU,gBAAgB,CAAC,GAAY,EAAC,QAAe,CAAC;QAC3D,IAAG,CAAC,SAAS,CAAC,KAAK,CAAC,IAAE,KAAK,GAAC,CAAC,IAAE,KAAK,GAAC,CAAC;YACpC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACrC,IAAG,OAAO,GAAG,KAAG,QAAQ,IAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACzF,MAAM,MAAM,GAAC,MAAM,SAAS,CAAC,GAAG,EAAC,KAAK,CAAC,CAAC;QACxC,IAAG,MAAM,KAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI;YAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrE,MAAM,OAAO,GAAC,MAAM,MAAM,CAAC,MAAM,EAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3D,IAAG,OAAO,CAAC,IAAI,KAAG,QAAQ;YAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACrD,yEAAyE;QACzE,OAAO,EAAC,IAAI,EAAC,eAAe,EAAC,SAAS,EAAC;gBACrC,GAAG,cAAc,CAAC,gBAAgB,CAAC,MAAM,EAAC,KAAK,CAAC,CAAC,EAAC,UAAU,EAAC,KAAK;aACnE,EAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAkB;QACpC,IAAI,EAAC,UAAU,CAAC,IAAI,EAAC,IAAI,EAAC,UAAU,CAAC,IAAI;QACzC,iBAAiB,EAAC,UAAU,CAAC,iBAAiB;QAC9C,eAAe,EAAC,CAAC,CAAA,EAAE,CAAA,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;QAChD,OAAO,EAAC,CAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,EAAE,CAAA,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,EAAC,MAAM,EAAC,IAAI,CAAC;QAClE,OAAO,EAAC,gBAAgB;QACxB,cAAc,EAAC,GAAE,EAAE,CAAA,MAAM,CAAC,QAAQ,EAAE;KACrC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {windows,commandOptions,diskUsageCommand} from \"./platform.js\";\nimport type { GrantsConfig,ToolArguments,WorkspaceGrants,WorkspacePolicy } from \"./contracts.js\";\nimport { GatewayError,isInteger,isSafeInteger } from \"./validation.js\";\n// Release 1 broad read-only inventory, narrow independent write grants.\n// No OS sandbox claim: trusted-project Shell remains same-UID privileged.\nimport { lstat,realpath } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { createProjectPolicy } from \"./project-workspace-policy.js\";\nimport { isInside } from \"./workspace-grants.js\";\n\nfunction fail(reason: string): never {const e=new GatewayError(reason);throw e;};\nconst fileTools=new Map([\n  [\"read_file\",\"path\"],[\"get_file_info\",\"path\"],[\"list_directory\",\"path\"],\n  [\"write_file\",\"path\"],[\"edit_block\",\"file_path\"]\n]);\nconst inventory=new Set([\"read_file\",\"get_file_info\",\"list_directory\"]);\nconst blocked=new Set([\".ssh\",\".aws\",\".gnupg\",\".config\",\".kube\",\".docker\",\n  \".npmrc\",\".netrc\",\".env\",\"secrets\",\"credentials\",\"keychains\",\n  \"cookies\",\"login data\",\"login.keychain-db\"]);\nconst blockedExt=/\\.(pem|key|p12|pfx|mobileprovision)$/i;\nconst safeSegments=(value: string)=>{\n  const parts=value.split(path.sep).filter(Boolean);\n  if(parts.some(x=>blocked.has(x.toLowerCase())||/^\\.env(\\.|$)/i.test(x)||\n    blockedExt.test(x)))fail(\"SENSITIVE_PATH_DENIED\");\n};\nasync function broadPath(raw: unknown,kind: string){\n  if(typeof raw!==\"string\"||!path.isAbsolute(raw)||raw.length>2048||\n    raw.includes(\"\\0\")||(!windows&&raw.includes(\"\\\\\"))||raw.split(path.sep).includes(\"..\")||\n    path.normalize(raw)!==raw)fail(\"INVENTORY_ABSOLUTE_PATH_REQUIRED\");\n  safeSegments(raw);\n  const canonical=await realpath(raw);\n  safeSegments(canonical);\n  const st=await lstat(canonical);\n  if(st.isSymbolicLink())fail(\"INVENTORY_SYMLINK_DENIED\");\n  if(kind===\"file\"&&(!st.isFile()||st.nlink!==1||st.size>1024*1024))\n    fail(\"INVENTORY_FILE_NOT_APPROVED\");\n  if(kind===\"dir\"&&!st.isDirectory())fail(\"INVENTORY_DIRECTORY_REQUIRED\");\n  if(kind===\"info\"&&!st.isFile()&&!st.isDirectory())fail(\"INVENTORY_NONREGULAR_DENIED\");\n  return canonical;\n}\nfunction keys(args: ToolArguments,required: string[],optional: string[]=[]){\n  if(!args||typeof args!==\"object\"||Array.isArray(args)||\n    required.some(k=>!Object.hasOwn(args,k))||\n    Object.keys(args).some(k=>![...required,...optional].includes(k)))\n    fail(\"INVENTORY_ARGUMENTS_DENIED\");\n}\nasync function readOnly(name: string,args: ToolArguments){\n  if(name===\"list_directory\"){\n    keys(args,[\"path\"],[\"depth\"]);\n    if(args.depth!==undefined&&(!isInteger(args.depth)||\n      args.depth<0||args.depth>1))fail(\"INVENTORY_DEPTH_LIMIT\");\n    return {name,arguments:{path:await broadPath(args.path,\"dir\"),depth:args.depth??1}};\n  }\n  if(name===\"get_file_info\"){\n    keys(args,[\"path\"]);\n    return {name,arguments:{path:await broadPath(args.path,\"info\")}};\n  }\n  if(name===\"read_file\"){\n    keys(args,[\"path\"],[\"offset\",\"length\"]);\n    const offset=args.offset??0,length=args.length??100;\n    if(!isSafeInteger(offset)||offset<0||\n      !isSafeInteger(length)||length<1||length>300)\n      fail(\"INVENTORY_READ_LIMIT\");\n    return {name,arguments:{path:await broadPath(args.path,\"file\"),offset,length}};\n  }\n  fail(\"INVENTORY_TOOL_NOT_READ_ONLY\");\n}\nconst quote=(s: string)=>\"'\"+s.replaceAll(\"'\",\"'\\\\''\")+\"'\";\nexport function createManagedWorkspacePolicy({basePolicy,grants}: {basePolicy: WorkspacePolicy; grants: WorkspaceGrants}): WorkspacePolicy{\n  if(!basePolicy?.root||!grants?.snapshot||!grants.home)\n    fail(\"GRANTS_POLICY_INVALID\");\n  const customCache=new Map<string, WorkspacePolicy>();\n  async function locate(name: string,args: ToolArguments){\n    const key=fileTools.get(name);\n    if(!key||typeof args?.[key]!==\"string\"||!path.isAbsolute(args[key]))\n      return null;\n    return path.resolve(args[key]);\n  }\n  async function select(target: string,data: GrantsConfig): Promise<{kind:\"base\"|\"inventory\"|\"denied\"}|({kind:\"custom\"}&GrantsConfig[\"custom\"][number])>{\n    // Main project always wins, including its sensitive-path denials.\n    if(isInside(target,basePolicy.root))return {kind:\"base\"};\n    const custom=data.custom.filter(x=>isInside(target,x.path))\n      .sort((a,b)=>b.path.length-a.path.length)[0];\n    if(custom)return {kind:\"custom\",...custom};\n    if(isInside(target,grants.home)&&data.homeRead)return {kind:\"inventory\"};\n    if(!isInside(target,grants.home)&&data.outsideRead)return {kind:\"inventory\"};\n    return {kind:\"denied\"};\n  }\n  async function prepare(name: string,args: ToolArguments={}){\n    const target=await locate(name,args);\n    if(!target)return basePolicy.prepare(name,args);\n    const data=await grants.snapshot();\n    const selected=await select(target,data);\n    if(selected.kind===\"base\")return basePolicy.prepare(name,args);\n    // Preserve linked Git worktree permissions where the base policy grants them.\n    if(selected.kind===\"denied\"||selected.kind===\"inventory\"){\n      try{return await basePolicy.prepare(name,args);}catch{/* check explicit inventory */}\n    }\n    if(selected.kind===\"custom\"){\n      const key=selected.path+\"|\"+selected.mode;\n      let policy=customCache.get(key);\n      if(!policy){\n        policy=await createProjectPolicy({root:selected.path,mode:selected.mode,\n          developerCommands:\"presets\",allowOwnerSelectedRoot:true});\n        customCache.set(key,policy);\n      }\n      return policy.prepare(name,args);\n    }\n    if(selected.kind===\"inventory\"){\n      if(!inventory.has(name))fail(\"INVENTORY_READ_ONLY\");\n      const invocation=await readOnly(name,args);\n      // A symlink inside an approved folder may resolve outside it. Check the\n      // actual canonical target against the independently authorized scope.\n      const canonical=invocation.arguments.path;\n      const homeTarget=isInside(canonical,grants.home);\n      if((homeTarget&&!data.homeRead)||(!homeTarget&&!data.outsideRead)){\n        if(!isInside(canonical,basePolicy.root)&&\n          !data.custom.some(c=>isInside(canonical,c.path)))\n          fail(\"INVENTORY_SYMLINK_ESCAPES_SCOPE\");\n      }\n      return invocation;\n    }\n    fail(\"SCOPE_NOT_GRANTED\");\n  }\n  async function prepareDiskUsage(raw: unknown,depth: unknown=1){\n    if(!isInteger(depth)||depth<0||depth>1)\n      fail(\"INVENTORY_DISK_DEPTH_LIMIT\");\n    if(typeof raw!==\"string\"||!path.isAbsolute(raw))fail(\"INVENTORY_ABSOLUTE_PATH_REQUIRED\");\n    const target=await broadPath(raw,\"dir\");\n    if(target===path.parse(target).root)fail(\"INVENTORY_SCAN_TOO_BROAD\");\n    const allowed=await select(target,await grants.snapshot());\n    if(allowed.kind===\"denied\")fail(\"SCOPE_NOT_GRANTED\");\n    // Does not permit user-provided shell text; quoted path only, no delete.\n    return {name:\"start_process\",arguments:{\n      ...commandOptions(diskUsageCommand(target,depth)),timeout_ms:30000\n    }};\n  }\n  return Object.freeze<WorkspacePolicy>({\n    root:basePolicy.root,mode:basePolicy.mode,\n    developerCommands:basePolicy.developerCommands,\n    validateGitPath:f=>basePolicy.validateGitPath(f),\n    observe:(name,result,args)=>basePolicy.observe?.(name,result,args),\n    prepare,prepareDiskUsage,\n    grantsSnapshot:()=>grants.snapshot()\n  });\n}\n"]}

package/dist/src/mcp-results.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-results.js","sourceRoot":"","sources":["../../src/mcp-results.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E,2FAA2F;AAC3F,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,gBAAgB,CAAC,KAAc;IACtC,MAAM,OAAO,GAAC,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpD,IAAG,CAAC,OAAO,CAAC,OAAO;QAAC,MAAM,OAAO,CAAC,KAAK,CAAC;AAC1C,CAAC","sourcesContent":["import { CallToolResultSchema } from '@modelcontextprotocol/sdk/types.js';\nimport type { CallToolResult } from './contracts.js';\n/** Validate the SDK envelope without returning a parsed copy that can strip extensions. */\nexport function toolResult(value: unknown): CallToolResult {\n  assertToolResult(value);\n  return value;\n}\nfunction assertToolResult(value: unknown): asserts value is CallToolResult {\n  const checked=CallToolResultSchema.safeParse(value);\n  if(!checked.success)throw checked.error;\n}\n"]}