things-api 0.16.0 → 0.18.0

package/deputy/src/osascript.swift

@@ -0,0 +1,102 @@
+/**
+ * osascript execution with a hard timeout. The deputy owns the child process:
+ * a caller (or its whole harness) dying mid-request never orphans an
+ * osascript — the deputy's timer terminates it at the requested deadline
+ * (SIGTERM, then SIGKILL after a 2s grace). Argv shapes are fixed here; the
+ * client supplies only the script text, language, and timeout.
+ */
+import CryptoKit
+import Foundation
+
+private final class Flag {
+  private let lock = NSLock()
+  private var value = false
+  func set() {
+    lock.lock()
+    value = true
+    lock.unlock()
+  }
+  func get() -> Bool {
+    lock.lock()
+    defer { lock.unlock() }
+    return value
+  }
+}
+
+func runOsascript(script: String, lang: String, timeoutMs: Int, binPath: String, id: Any?)
+  -> [String: Any]
+{
+  runChildTool(
+    binPath: binPath,
+    args: lang == "javascript" ? ["-l", "JavaScript", "-e", script] : ["-e", script],
+    timeoutMs: timeoutMs, id: id)
+}
+
+/// Generic deadline-bounded child runner shared by the osascript and
+/// shortcuts verbs. Argv is always assembled deputy-side from a fixed shape.
+func runChildTool(binPath: String, args: [String], timeoutMs: Int, id: Any?) -> [String: Any] {
+  let process = Process()
+  process.executableURL = URL(fileURLWithPath: binPath)
+  process.arguments = args
+  let outPipe = Pipe()
+  let errPipe = Pipe()
+  process.standardOutput = outPipe
+  process.standardError = errPipe
+  process.standardInput = FileHandle.nullDevice
+
+  do {
+    try process.run()
+  } catch {
+    return [
+      "id": id ?? NSNull(), "ok": false,
+      "error": ["code": "internal", "message": "cannot launch \(binPath): \(error.localizedDescription)"],
+    ]
+  }
+
+  let timedOut = Flag()
+  let pid = process.processIdentifier
+  let killer = DispatchWorkItem {
+    timedOut.set()
+    process.terminate()
+    DispatchQueue.global().asyncAfter(deadline: .now() + 2.0) {
+      if process.isRunning { kill(pid, SIGKILL) }
+    }
+  }
+  DispatchQueue.global().asyncAfter(
+    deadline: .now() + .milliseconds(max(1, timeoutMs)), execute: killer)
+
+  // Drain both pipes off-thread so a chatty script never deadlocks the wait.
+  var outData = Data()
+  var errData = Data()
+  let group = DispatchGroup()
+  group.enter()
+  DispatchQueue.global().async {
+    outData = outPipe.fileHandleForReading.readDataToEndOfFile()
+    group.leave()
+  }
+  group.enter()
+  DispatchQueue.global().async {
+    errData = errPipe.fileHandleForReading.readDataToEndOfFile()
+    group.leave()
+  }
+  process.waitUntilExit()
+  killer.cancel()
+  group.wait()
+
+  var result: [String: Any] = [
+    "id": id ?? NSNull(),
+    "ok": true,
+    "exitCode": Int(process.terminationStatus),
+    "stdout": String(decoding: outData, as: UTF8.self),
+    "stderr": String(decoding: errData, as: UTF8.self),
+  ]
+  if process.terminationReason == .uncaughtSignal {
+    result["signal"] = Int(process.terminationStatus)
+  }
+  if timedOut.get() { result["timedOut"] = true }
+  return result
+}
+
+func sha256Hex(_ text: String) -> String {
+  SHA256.hash(data: Data(text.utf8)).map { String(format: "%02x", $0) }.joined()
+}

package/deputy/src/server.swift

@@ -0,0 +1,350 @@
+/**
+ * Socket server: accept loop, peer verification, JSON-lines framing, request
+ * dispatch, and the local JSONL audit log. One thread per connection;
+ * osascript/shortcuts execution is funneled through one serial queue.
+ *
+ * MUTATIONS ONLY: the deputy serves the automation verbs (osascript,
+ * shortcuts). File verbs (sql / read-file / locate) live exclusively on the
+ * sandboxed things-reader — the deputy's own container access would ride the
+ * per-process AppData consent class (a prompt per process instance, measured
+ * 2026-08-21), which is precisely the churn this pair exists to end.
+ */
+import Foundation
+
+/// How long a shutting-down deputy waits for requests already in flight. An
+/// upgrade (`things helpers install` / `restart`) boots the old process out
+/// mid-flight; without a drain the in-flight request dies with it. launchd's
+/// own bootout wait, and the CLI's `launchctl` timeout, both clear this bound.
+let DRAIN_TIMEOUT_SECONDS: TimeInterval = 10
+
+final class Server {
+  let paths: DeputyPaths
+  let config: DeputyConfig
+  let token: String
+  let startedAt = Date()
+  private let osaQueue = DispatchQueue(label: "things-deputy.osa")
+  private let logQueue = DispatchQueue(label: "things-deputy.log")
+  private var listenFd: Int32 = -1
+  /// Requests between dispatch and their written response. Guarded by
+  /// `inflightCond`, which the drain waits on.
+  private let inflightCond = NSCondition()
+  private var inflight = 0
+
+  init(paths: DeputyPaths, config: DeputyConfig, token: String) {
+    self.paths = paths
+    self.config = config
+    self.token = token
+  }
+
+  func run() {
+    let fd = socket(AF_UNIX, SOCK_STREAM, 0)
+    guard fd >= 0 else { fatalDie("socket() failed: errno \(errno)") }
+    listenFd = fd
+
+    let sockPath = paths.socket
+    guard sockPath.utf8.count <= 103 else {
+      fatalDie("socket path too long for sockaddr_un (\(sockPath.utf8.count) bytes): \(sockPath)")
+    }
+    unlink(sockPath)
+    var addr = sockaddr_un()
+    addr.sun_family = sa_family_t(AF_UNIX)
+    let pathCapacity = MemoryLayout.size(ofValue: addr.sun_path)
+    _ = withUnsafeMutablePointer(to: &addr.sun_path) { pathPtr in
+      sockPath.withCString { cstr in
+        strncpy(
+          UnsafeMutableRawPointer(pathPtr).assumingMemoryBound(to: CChar.self), cstr,
+          pathCapacity - 1)
+      }
+    }
+    let bindResult = withUnsafePointer(to: &addr) { ptr in
+      ptr.withMemoryRebound(to: sockaddr.self, capacity: 1) { sa in
+        bind(fd, sa, socklen_t(MemoryLayout<sockaddr_un>.size))
+      }
+    }
+    guard bindResult == 0 else { fatalDie("bind(\(sockPath)) failed: errno \(errno)") }
+    chmod(sockPath, 0o600)
+    guard listen(fd, 16) == 0 else { fatalDie("listen() failed: errno \(errno)") }
+
+    audit(["event": "started", "pid": Int(getpid()), "version": DEPUTY_VERSION])
+
+    while true {
+      let conn = accept(fd, nil, nil)
+      if conn < 0 {
+        if errno == EINTR { continue }
+        break
+      }
+      var uid: uid_t = 0
+      var gid: gid_t = 0
+      if getpeereid(conn, &uid, &gid) != 0 || uid != getuid() {
+        audit(["event": "rejected-peer", "uid": Int(uid)])
+        close(conn)
+        continue
+      }
+      let thread = Thread { [weak self] in self?.handleConnection(conn) }
+      thread.name = "things-deputy.conn"
+      thread.start()
+    }
+  }
+
+  /**
+   * Graceful drain, then teardown. Order matters:
+   *
+   * 1. unlink the socket path FIRST — a new client cannot even find us, which
+   *    is deterministic where waking a thread blocked in accept() is not.
+   * 2. close the listener so no further connection is accepted.
+   * 3. wait (bounded) for requests already dispatched to write their response.
+   * 4. flush the audit log and return; the caller exits 0.
+   *
+   * SIGKILL remains the hard stop — nothing here tries to survive it.
+   */
+  func drainAndShutdown(timeout: TimeInterval = DRAIN_TIMEOUT_SECONDS) {
+    unlink(paths.socket)
+    if listenFd >= 0 {
+      Darwin.shutdown(listenFd, SHUT_RDWR)
+      close(listenFd)
+      listenFd = -1
+    }
+    let deadline = Date().addingTimeInterval(timeout)
+    inflightCond.lock()
+    while inflight > 0 && Date() < deadline {
+      _ = inflightCond.wait(until: deadline)
+    }
+    let remaining = inflight
+    inflightCond.unlock()
+    audit(["event": "stopped", "drained": remaining == 0, "inflight": remaining])
+    // The audit log is written asynchronously; a barrier makes "stopped" the
+    // last thing on disk instead of a line lost to exit().
+    logQueue.sync {}
+  }
+
+  private func beginRequest() {
+    inflightCond.lock()
+    inflight += 1
+    inflightCond.unlock()
+  }
+
+  private func endRequest() {
+    inflightCond.lock()
+    inflight -= 1
+    if inflight == 0 { inflightCond.broadcast() }
+    inflightCond.unlock()
+  }
+
+  private func fatalDie(_ message: String) -> Never {
+    FileHandle.standardError.write(Data("things-deputy: \(message)\n".utf8))
+    exit(1)
+  }
+
+  // --- connection handling ---
+
+  private func handleConnection(_ conn: Int32) {
+    defer { close(conn) }
+    var peerPid: pid_t = 0
+    var pidLen = socklen_t(MemoryLayout<pid_t>.size)
+    _ = getsockopt(conn, SOL_LOCAL, LOCAL_PEERPID, &peerPid, &pidLen)
+
+    var buffer = Data()
+    var chunk = [UInt8](repeating: 0, count: 65536)
+    while true {
+      let n = read(conn, &chunk, chunk.count)
+      if n <= 0 { return }
+      buffer.append(contentsOf: chunk[0..<n])
+      if buffer.count > MAX_REQUEST_BYTES {
+        writeLine(conn, errorResponse(id: nil, code: "too-large", message: "request exceeds \(MAX_REQUEST_BYTES) bytes"))
+        return
+      }
+      while let nl = buffer.firstIndex(of: 0x0A) {
+        let line = buffer.subdata(in: buffer.startIndex..<nl)
+        buffer.removeSubrange(buffer.startIndex...nl)
+        // In flight from dispatch until the response is on the wire — that
+        // span is exactly what a drain must not cut short.
+        beginRequest()
+        let response = dispatch(line: line, peerPid: peerPid)
+        let written = writeLine(conn, response)
+        endRequest()
+        if !written { return }
+      }
+    }
+  }
+
+  @discardableResult
+  private func writeLine(_ conn: Int32, _ obj: [String: Any]) -> Bool {
+    guard var data = try? JSONSerialization.data(withJSONObject: obj) else { return false }
+    data.append(0x0A)
+    return data.withUnsafeBytes { raw in
+      var offset = 0
+      while offset < raw.count {
+        let n = write(conn, raw.baseAddress!.advanced(by: offset), raw.count - offset)
+        if n <= 0 { return false }
+        offset += n
+      }
+      return true
+    }
+  }
+
+  private func errorResponse(id: Any?, code: String, message: String) -> [String: Any] {
+    ["id": id ?? NSNull(), "ok": false, "error": ["code": code, "message": message]]
+  }
+
+  // --- dispatch ---
+
+  private func dispatch(line: Data, peerPid: pid_t) -> [String: Any] {
+    guard let obj = (try? JSONSerialization.jsonObject(with: line)) as? [String: Any] else {
+      return errorResponse(id: nil, code: "bad-request", message: "request is not a JSON object")
+    }
+    let id = obj["id"]
+    guard let v = obj["v"] as? Int, v == PROTOCOL_VERSION else {
+      return errorResponse(
+        id: id, code: "unsupported-protocol",
+        message: "deputy speaks protocol \(PROTOCOL_VERSION); restart or rebuild the deputy (things helpers restart)")
+    }
+    guard let reqToken = obj["token"] as? String, reqToken == token else {
+      audit(["event": "rejected-token", "peerPid": Int(peerPid)])
+      return errorResponse(id: id, code: "bad-token", message: "request token does not match the deputy token file")
+    }
+    guard let verb = obj["verb"] as? String else {
+      return errorResponse(id: id, code: "bad-request", message: "missing verb")
+    }
+
+    let started = Date()
+    var result: [String: Any]
+    var auditExtra: [String: Any] = [:]
+    switch verb {
+    case "hello":
+      result = handleHello(id: id)
+    case "osascript":
+      guard let script = obj["script"] as? String else {
+        result = errorResponse(id: id, code: "bad-request", message: "osascript verb requires a script string")
+        break
+      }
+      let lang = obj["lang"] as? String ?? "applescript"
+      guard lang == "applescript" || lang == "javascript" else {
+        result = errorResponse(id: id, code: "bad-request", message: "lang must be applescript or javascript")
+        break
+      }
+      let timeoutMs = obj["timeoutMs"] as? Int ?? 30_000
+      if let guardError = scriptGuard(script) {
+        audit(["event": "rejected-script", "reason": guardError, "peerPid": Int(peerPid)])
+        result = errorResponse(id: id, code: "script-denied", message: guardError)
+        break
+      }
+      auditExtra["scriptSha256"] = sha256Hex(script)
+      auditExtra["scriptBytes"] = script.utf8.count
+      result = osaQueue.sync {
+        runOsascript(
+          script: script, lang: lang, timeoutMs: timeoutMs,
+          binPath: config.osascriptPath ?? "/usr/bin/osascript", id: id)
+      }
+    case "shortcuts":
+      let op = obj["op"] as? String
+      let timeoutMs = obj["timeoutMs"] as? Int ?? 30_000
+      let bin = config.shortcutsPath ?? "/usr/bin/shortcuts"
+      if op == "list" {
+        result = osaQueue.sync { runChildTool(binPath: bin, args: ["list"], timeoutMs: timeoutMs, id: id) }
+        break
+      }
+      guard op == "run", let name = obj["name"] as? String,
+        let inputPath = obj["inputPath"] as? String,
+        let outputPath = obj["outputPath"] as? String
+      else {
+        result = errorResponse(
+          id: id, code: "bad-request",
+          message: "shortcuts verb requires op=list, or op=run with name/inputPath/outputPath")
+        break
+      }
+      // The deputy only runs this library's bundled proxy shortcuts — it is a
+      // paired tool, not a general shortcut runner. (Same spirit as the
+      // osascript shell-execution lint: a same-user process could run
+      // arbitrary shortcuts itself; it just cannot do so AS the deputy.)
+      guard name.hasPrefix("things-proxy-"), !inputPath.hasPrefix("-"), !outputPath.hasPrefix("-")
+      else {
+        audit(["event": "rejected-shortcut", "name": name, "peerPid": Int(peerPid)])
+        result = errorResponse(
+          id: id, code: "shortcut-denied",
+          message: "the deputy only runs bundled things-proxy-* shortcuts")
+        break
+      }
+      auditExtra["shortcut"] = name
+      result = osaQueue.sync {
+        runChildTool(
+          binPath: bin,
+          args: ["run", name, "--input-path", inputPath, "--output-path", outputPath],
+          timeoutMs: timeoutMs, id: id)
+      }
+    case "sql", "read-file", "locate":
+      // File verbs live exclusively on the sandboxed things-reader.
+      result = errorResponse(
+        id: id, code: "unsupported-verb",
+        message: "the deputy serves automation verbs only — file access rides things-reader (things helpers grant)")
+    default:
+      result = errorResponse(id: id, code: "bad-request", message: "unknown verb \(verb)")
+    }
+
+    var entry: [String: Any] = [
+      "ts": iso8601(Date()),
+      "verb": verb,
+      "peerPid": Int(peerPid),
+      "ok": (result["ok"] as? Bool) ?? false,
+      "ms": Int(Date().timeIntervalSince(started) * 1000),
+    ]
+    for (k, v) in auditExtra { entry[k] = v }
+    audit(entry)
+    return result
+  }
+
+  /**
+   * Defense-in-depth lint, not a security boundary (a same-user process that
+   * can read the token can also run osascript itself — what the deputy adds is
+   * only its OWN TCC grants). The lint refuses the constructs that would turn
+   * "drive the Things GUI" into "run arbitrary shell": every legitimate script
+   * this library generates talks AppleScript/JXA to Things and System Events
+   * and never shells out.
+   */
+  private func scriptGuard(_ script: String) -> String? {
+    let lowered = script.lowercased()
+    for banned in ["do shell script", "do script"] {
+      if lowered.contains(banned) {
+        return "script rejected: contains \"\(banned)\" — the deputy only brokers GUI/AppleEvent scripts, never shell execution"
+      }
+    }
+    return nil
+  }
+
+  // --- verb handlers ---
+
+  private func handleHello(id: Any?) -> [String: Any] {
+    [
+      "id": id ?? NSNull(),
+      "ok": true,
+      "protocol": PROTOCOL_VERSION,
+      "deputyVersion": DEPUTY_VERSION,
+      "role": "deputy",
+      "pid": Int(getpid()),
+      "uptimeMs": Int(Date().timeIntervalSince(startedAt) * 1000),
+    ]
+  }
+
+  // --- audit log ---
+
+  private func audit(_ entry: [String: Any]) {
+    var withTs = entry
+    if withTs["ts"] == nil { withTs["ts"] = iso8601(Date()) }
+    guard var data = try? JSONSerialization.data(withJSONObject: withTs) else { return }
+    data.append(0x0A)
+    let path = paths.log
+    logQueue.async {
+      if let handle = FileHandle(forWritingAtPath: path) {
+        handle.seekToEndOfFile()
+        handle.write(data)
+        try? handle.close()
+      } else {
+        FileManager.default.createFile(
+          atPath: path, contents: data, attributes: [.posixPermissions: 0o600])
+      }
+    }
+  }
+}
+
+func iso8601(_ date: Date) -> String {
+  ISO8601DateFormatter().string(from: date)
+}

package/deputy/src/sqlite.swift

@@ -0,0 +1,121 @@
+/**
+ * Read-only SQLite executor. Mirrors the library's WAL policy
+ * (docs/design/architecture.md §0): SQLITE_OPEN_READONLY, never immutable, a
+ * fresh WAL read snapshot per statement outside any transaction — the deputy
+ * never opens a transaction, so the CLI's verification poller sees fresh state
+ * on every poll exactly as it does with a local connection. An authorizer
+ * denies ATTACH so the read-only handle cannot be aimed at other files.
+ */
+import Foundation
+import SQLite3
+
+let SQLITE_TRANSIENT = unsafeBitCast(-1, to: sqlite3_destructor_type.self)
+
+struct SqliteError: Error {
+  let message: String
+}
+
+final class SqliteReader {
+  private var handle: OpaquePointer?
+
+  init(path: String) throws {
+    var h: OpaquePointer?
+    let rc = sqlite3_open_v2(path, &h, SQLITE_OPEN_READONLY, nil)
+    guard rc == SQLITE_OK, let opened = h else {
+      let message = h.map { String(cString: sqlite3_errmsg($0)) } ?? "sqlite rc \(rc)"
+      sqlite3_close(h)
+      throw SqliteError(message: message)
+    }
+    handle = opened
+    sqlite3_busy_timeout(opened, 2000)
+    sqlite3_set_authorizer(
+      opened,
+      { _, action, _, _, _, _ in
+        action == SQLITE_ATTACH ? SQLITE_DENY : SQLITE_OK
+      }, nil)
+  }
+
+  deinit {
+    if let h = handle { sqlite3_close_v2(h) }
+  }
+
+  func query(sql: String, params: [Any]) throws -> [[String: Any]] {
+    guard let h = handle else { throw SqliteError(message: "connection closed") }
+    var stmt: OpaquePointer?
+    // The tail pointer aims into the C string handed to prepare, so it MUST be
+    // read inside withCString — Swift's implicit bridging buffer is deallocated
+    // the moment the call returns (a read-after-free otherwise).
+    var trailingStatement = false
+    let rc = sql.withCString { (cSql: UnsafePointer<CChar>) -> Int32 in
+      var tail: UnsafePointer<CChar>? = nil
+      let result = sqlite3_prepare_v2(h, cSql, -1, &stmt, &tail)
+      if let t = tail {
+        trailingStatement = !String(cString: t)
+          .trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
+      }
+      return result
+    }
+    guard rc == SQLITE_OK, let prepared = stmt else {
+      throw SqliteError(message: String(cString: sqlite3_errmsg(h)))
+    }
+    defer { sqlite3_finalize(prepared) }
+    if trailingStatement {
+      throw SqliteError(message: "only a single SQL statement is accepted per request")
+    }
+
+    for (index, param) in params.enumerated() {
+      let slot = Int32(index + 1)
+      let rc: Int32
+      switch param {
+      case is NSNull:
+        rc = sqlite3_bind_null(prepared, slot)
+      case let text as String:
+        rc = sqlite3_bind_text(prepared, slot, text, -1, SQLITE_TRANSIENT)
+      case let number as NSNumber:
+        if CFNumberIsFloatType(number) {
+          rc = sqlite3_bind_double(prepared, slot, number.doubleValue)
+        } else {
+          rc = sqlite3_bind_int64(prepared, slot, number.int64Value)
+        }
+      default:
+        throw SqliteError(message: "unsupported parameter type at index \(index)")
+      }
+      guard rc == SQLITE_OK else {
+        throw SqliteError(message: String(cString: sqlite3_errmsg(h)))
+      }
+    }
+
+    var rows: [[String: Any]] = []
+    let columnCount = sqlite3_column_count(prepared)
+    while true {
+      let rc = sqlite3_step(prepared)
+      if rc == SQLITE_DONE { break }
+      guard rc == SQLITE_ROW else {
+        throw SqliteError(message: String(cString: sqlite3_errmsg(h)))
+      }
+      var row: [String: Any] = [:]
+      for col in 0..<columnCount {
+        let name = String(cString: sqlite3_column_name(prepared, col))
+        switch sqlite3_column_type(prepared, col) {
+        case SQLITE_INTEGER:
+          row[name] = sqlite3_column_int64(prepared, col)
+        case SQLITE_FLOAT:
+          row[name] = sqlite3_column_double(prepared, col)
+        case SQLITE_TEXT:
+          row[name] = String(cString: sqlite3_column_text(prepared, col))
+        case SQLITE_BLOB:
+          let bytes = sqlite3_column_bytes(prepared, col)
+          let data =
+            bytes > 0
+            ? Data(bytes: sqlite3_column_blob(prepared, col), count: Int(bytes))
+            : Data()
+          row[name] = ["$b64": data.base64EncodedString()]
+        default:
+          row[name] = NSNull()
+        }
+      }
+      rows.append(row)
+    }
+    return rows
+  }
+}

package/dist/cli/commands/doctor.js

@@ -21,6 +21,57 @@ function syncHealthLines(sh) {
         `cloud:       ${sh.cloud.verdict}`,
     ];
 }
+/** One half's line: liveness, launchd registration, version, signing. */
+function helperHalfLine(half, running) {
+    const facts = [
+        half.plistInstalled
+            ? half.loaded
+                ? "launchd loaded"
+                : "launchd registered, NOT loaded"
+            : "no launchd registration",
+    ];
+    if (half.hello !== null)
+        facts.push(`v${half.hello.deputyVersion}, protocol ${half.hello.protocol}, pid ${half.hello.pid}`);
+    if (half.signing !== null) {
+        facts.push(half.signing.state === "signed"
+            ? `signed (${half.signing.authority ?? "unknown authority"})`
+            : `${half.signing.state} — macOS grants will NOT survive rebuilds`);
+    }
+    return `${running} · ${facts.join(" · ")}`;
+}
+/** The `── Helpers ──` section: routing resolution + both halves' health. */
+function helpersLines(helpers) {
+    const { status, routing } = helpers;
+    const resolved = helpers.mode === "false"
+        ? "direct (routing off)"
+        : `automation ${routing.automation ? "via the deputy" : "DIRECT"}, database reads ${routing.files ? "via the reader" : "DIRECT"}`;
+    const lines = [
+        "── Helpers ──",
+        `mode:        ${helpers.mode} — ${helpers.detail}`,
+        `routing:     ${resolved}`,
+        `bundle:      ${status.bundleInstalled
+            ? `installed${helpers.installedVersion !== null ? ` (v${helpers.installedVersion})` : ""}${helpers.versionSkew ? `, this package expects v${helpers.expectedVersion}` : ""}`
+            : "not installed"}`,
+    ];
+    if (status.bundleInstalled || status.deputy.plistInstalled) {
+        lines.push(`deputy:      ${helperHalfLine(status.deputy, status.deputy.running
+            ? "running"
+            : status.deputy.hungSocket
+                ? "SOCKET PRESENT, NOT ANSWERING"
+                : "not running")}`, `reader:      ${status.reader.installed
+            ? helperHalfLine(status.reader, status.reader.running
+                ? status.reader.granted
+                    ? "running, granted"
+                    : "running, NOT granted"
+                : status.reader.hungSocket
+                    ? "SOCKET PRESENT, NOT ANSWERING"
+                    : "not running")
+            : "not installed (the bundle was built without an Apple-issued signing identity)"}`);
+    }
+    if (helpers.remedy !== null)
+        lines.push(`next:        ${helpers.remedy}`);
+    return lines;
+}
 /** The `── ui vector ──` section: config + app + Accessibility + certification. */
 function uiVectorLines(ui) {
     const total = ui.certification.length;
@@ -42,9 +93,10 @@ export function registerDoctor(program) {
         .description("Check environment health: database location, database schema compatibility, app " +
         "presence, any one-time setup still needed (macOS permissions, the app's " +
         "'Enable Things URLs' setting), whether the environment changed since the last " +
-        "successful write, and a sync-health summary (whether the app is running, how recently " +
+        "successful write, a sync-health summary (whether the app is running, how recently " +
         "the data changed, and — when a Things Cloud account is attached — the last sync " +
-        "attempt) — with steps to fix. " +
+        "attempt), and the state of the optional helpers (installed, running, granted, signed, " +
+        "and what routing resolved to) — with steps to fix. " +
         "Exit 0 healthy; 5 schema drift (writes disabled); 7 environment problem.")
         .option("--json", "emit versioned JSON envelope on stdout")
         .option("--db <path>", "explicit database path (overrides THINGS_DB and discovery)")
@@ -102,6 +154,7 @@ export function registerDoctor(program) {
                     ]
                     : []),
                 ...syncHealthLines(report.syncHealth),
+                ...helpersLines(report.helpers),
                 ...uiVectorLines(report.ui),
             ];
             process.stdout.write(`${lines.join("\n")}\n`);

package/dist/cli/commands/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/cli/commands/doctor.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,0BAA0B,EAC1B,QAAQ,EACR,aAAa,EACb,UAAU,GAIX,MAAM,gBAAgB,CAAC;AAExB,8DAA8D;AAC9D,MAAM,CAAC,MAAM,SAAS,GAAwC,QAAQ,CAAC;AAEvE,SAAS,eAAe,CAAC,GAAkC;IACzD,IAAI,GAAG,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACnC,OAAO,sFAAsF,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,yCAAyC,CAAC;IAC/E,OAAO,CACL,2CAA2C,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG;QACrF,mEAAmE,CACpE,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAS,eAAe,CAAC,EAAgC;IACvD,OAAO;QACL,mBAAmB;QACnB,gBAAgB,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE;QACvC,gBAAgB,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE;QAChC,gBAAgB,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE;QAC1C,gBAAgB,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE;QAC3C,gBAAgB,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,EAAwB;IAC7C,MAAM,KAAK,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;IACtC,MAAM,SAAS,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;IAClF,MAAM,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,MAAM,CAAC;IAChF,OAAO;QACL,qCAAqC;QACrC,kBAAkB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,MAAM,EAAE;QAC5D,kBAAkB,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QAChD,kBAAkB,EAAE,CAAC,aAAa,CAAC,MAAM,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE;QACxE,kBAAkB,SAAS,gBAAgB,GAAG,oBAAoB,KAAK,KAAK,EAAE,CAAC,oBAAoB,MAAM;YACvG,wFAAwF;YACxF,mDAAmD;KACtD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,kFAAkF;QAChF,0EAA0E;QAC1E,gFAAgF;QAChF,wFAAwF;QACxF,kFAAkF;QAClF,gCAAgC;QAChC,0EAA0E,CAC7E;SACA,MAAM,CAAC,QAAQ,EAAE,wCAAwC,CAAC;SAC1D,MAAM,CAAC,aAAa,EAAE,4DAA4D,CAAC;SACnF,MAAM,CACL,oBAAoB,EACpB,sFAAsF;QACpF,qDAAqD,CACxD;SACA,MAAM,CACL,uBAAuB,EACvB,oFAAoF;QAClF,wFAAwF,CAC3F;SACA,MAAM,CACL,CAAC,IAKA,EAAE,EAAE;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE;YAC1D,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YAC/D,GAAG,CAAC,IAAI,CAAC,kBAAkB,KAAK,IAAI,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,QAAQ,GAAiB,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAC5E,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,MAAM;gBACrB,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACxC,CAAC,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAC;YACnF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;aAAM,IAAI,MAAM,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG;gBACZ,gBAAgB,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG;gBACtD,gBAAgB,MAAM,CAAC,EAAE,CAAC,eAAe,IAAI,SAAS,EAAE;gBACxD,gBAAgB,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI;gBACvF,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;gBACxD,gBAAgB,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,GAClE,MAAM,CAAC,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EACpE,EAAE;gBACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe;oBAC5B,CAAC,CAAC;wBACE,uBAAuB,MAAM,CAAC,GAAG,CAAC,OAAO,mCAAmC;4BAC1E,qBAAqB,MAAM,CAAC,GAAG,CAAC,gBAAgB,4BAA4B;4BAC5E,4EAA4E;4BAC5E,qBAAqB;qBACxB;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,gBAAgB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;gBAC1F,gBAAgB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE;gBACrC,iBAAiB,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE;gBAC7C,gBAAgB,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;gBACrD,gBAAgB,MAAM,CAAC,UAAU,CAAC,MAAM,GACtC,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,EAC9E,EAAE;gBACF,gBACE,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,KAAK,IAAI;oBAC5C,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,KAAK,KAAK;wBAC/C,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,SACR,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE;gBAC5C,gBAAgB,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,IAC1D,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM;oBAC5C,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,MACxC,wBAAwB,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE;gBAC9D,gBAAgB,MAAM,CAAC,UAAU,CAAC,SAAS,iBACzC,MAAM,CAAC,UAAU,CAAC,WACpB,eAAe,MAAM,CAAC,UAAU,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC1F,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC;oBAClC,CAAC,CAAC;wBACE,gBAAgB,MAAM,CAAC,KAAK,CAAC,eAAe,oCAAoC;4BAC9E,mCAAmC,MAAM,CAAC,KAAK,CAAC,kBAAkB,QAAQ;4BAC1E,0EAA0E;4BAC1E,+CAA+C;qBAClD;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC;gBACrC,GAAG,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;aAC5B,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YACnD,IAAI,KAAK,CAAC,WAAW;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC9B,CAAC,CACF,CAAC;AACN,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/cli/commands/doctor.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,0BAA0B,EAC1B,QAAQ,EACR,aAAa,EACb,UAAU,GAIX,MAAM,gBAAgB,CAAC;AAExB,8DAA8D;AAC9D,MAAM,CAAC,MAAM,SAAS,GAAwC,QAAQ,CAAC;AAEvE,SAAS,eAAe,CAAC,GAAkC;IACzD,IAAI,GAAG,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACnC,OAAO,sFAAsF,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,yCAAyC,CAAC;IAC/E,OAAO,CACL,2CAA2C,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG;QACrF,mEAAmE,CACpE,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAS,eAAe,CAAC,EAAgC;IACvD,OAAO;QACL,mBAAmB;QACnB,gBAAgB,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE;QACvC,gBAAgB,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE;QAChC,gBAAgB,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE;QAC1C,gBAAgB,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE;QAC3C,gBAAgB,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,SAAS,cAAc,CACrB,IAAgG,EAChG,OAAe;IAEf,MAAM,KAAK,GAAG;QACZ,IAAI,CAAC,cAAc;YACjB,CAAC,CAAC,IAAI,CAAC,MAAM;gBACX,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,gCAAgC;YACpC,CAAC,CAAC,yBAAyB;KAC9B,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;QACrB,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,cAAc,IAAI,CAAC,KAAK,CAAC,QAAQ,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACvF,CAAC;IACJ,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ;YAC7B,CAAC,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,mBAAmB,GAAG;YAC7D,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,2CAA2C,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,OAAkC;IACtD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACpC,MAAM,QAAQ,GACZ,OAAO,CAAC,IAAI,KAAK,OAAO;QACtB,CAAC,CAAC,sBAAsB;QACxB,CAAC,CAAC,cAAc,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,oBAC5D,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,QACrC,EAAE,CAAC;IACT,MAAM,KAAK,GAAG;QACZ,eAAe;QACf,gBAAgB,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,MAAM,EAAE;QAClD,gBAAgB,QAAQ,EAAE;QAC1B,gBACE,MAAM,CAAC,eAAe;YACpB,CAAC,CAAC,YAAY,OAAO,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,EAAE,GACpF,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,2BAA2B,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAC/E,EAAE;YACJ,CAAC,CAAC,eACN,EAAE;KACH,CAAC;IACF,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3D,KAAK,CAAC,IAAI,CACR,gBAAgB,cAAc,CAC5B,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,MAAM,CAAC,OAAO;YACnB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU;gBACxB,CAAC,CAAC,+BAA+B;gBACjC,CAAC,CAAC,aAAa,CACpB,EAAE,EACH,gBACE,MAAM,CAAC,MAAM,CAAC,SAAS;YACrB,CAAC,CAAC,cAAc,CACZ,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,MAAM,CAAC,OAAO;gBACnB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO;oBACrB,CAAC,CAAC,kBAAkB;oBACpB,CAAC,CAAC,sBAAsB;gBAC1B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU;oBACxB,CAAC,CAAC,+BAA+B;oBACjC,CAAC,CAAC,aAAa,CACpB;YACH,CAAC,CAAC,+EACN,EAAE,CACH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,EAAwB;IAC7C,MAAM,KAAK,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;IACtC,MAAM,SAAS,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;IAClF,MAAM,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,MAAM,CAAC;IAChF,OAAO;QACL,qCAAqC;QACrC,kBAAkB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,MAAM,EAAE;QAC5D,kBAAkB,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QAChD,kBAAkB,EAAE,CAAC,aAAa,CAAC,MAAM,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE;QACxE,kBAAkB,SAAS,gBAAgB,GAAG,oBAAoB,KAAK,KAAK,EAAE,CAAC,oBAAoB,MAAM;YACvG,wFAAwF;YACxF,mDAAmD;KACtD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,kFAAkF;QAChF,0EAA0E;QAC1E,gFAAgF;QAChF,oFAAoF;QACpF,kFAAkF;QAClF,wFAAwF;QACxF,qDAAqD;QACrD,0EAA0E,CAC7E;SACA,MAAM,CAAC,QAAQ,EAAE,wCAAwC,CAAC;SAC1D,MAAM,CAAC,aAAa,EAAE,4DAA4D,CAAC;SACnF,MAAM,CACL,oBAAoB,EACpB,sFAAsF;QACpF,qDAAqD,CACxD;SACA,MAAM,CACL,uBAAuB,EACvB,oFAAoF;QAClF,wFAAwF,CAC3F;SACA,MAAM,CACL,CAAC,IAKA,EAAE,EAAE;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE;YAC1D,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YAC/D,GAAG,CAAC,IAAI,CAAC,kBAAkB,KAAK,IAAI,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,QAAQ,GAAiB,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAC5E,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,MAAM;gBACrB,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACxC,CAAC,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAC;YACnF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;aAAM,IAAI,MAAM,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG;gBACZ,gBAAgB,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG;gBACtD,gBAAgB,MAAM,CAAC,EAAE,CAAC,eAAe,IAAI,SAAS,EAAE;gBACxD,gBAAgB,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI;gBACvF,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;gBACxD,gBAAgB,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,GAClE,MAAM,CAAC,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EACpE,EAAE;gBACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe;oBAC5B,CAAC,CAAC;wBACE,uBAAuB,MAAM,CAAC,GAAG,CAAC,OAAO,mCAAmC;4BAC1E,qBAAqB,MAAM,CAAC,GAAG,CAAC,gBAAgB,4BAA4B;4BAC5E,4EAA4E;4BAC5E,qBAAqB;qBACxB;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,gBAAgB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;gBAC1F,gBAAgB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE;gBACrC,iBAAiB,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE;gBAC7C,gBAAgB,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;gBACrD,gBAAgB,MAAM,CAAC,UAAU,CAAC,MAAM,GACtC,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,EAC9E,EAAE;gBACF,gBACE,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,KAAK,IAAI;oBAC5C,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,KAAK,KAAK;wBAC/C,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,SACR,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE;gBAC5C,gBAAgB,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,IAC1D,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM;oBAC5C,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,MACxC,wBAAwB,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE;gBAC9D,gBAAgB,MAAM,CAAC,UAAU,CAAC,SAAS,iBACzC,MAAM,CAAC,UAAU,CAAC,WACpB,eAAe,MAAM,CAAC,UAAU,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC1F,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC;oBAClC,CAAC,CAAC;wBACE,gBAAgB,MAAM,CAAC,KAAK,CAAC,eAAe,oCAAoC;4BAC9E,mCAAmC,MAAM,CAAC,KAAK,CAAC,kBAAkB,QAAQ;4BAC1E,0EAA0E;4BAC1E,+CAA+C;qBAClD;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC;gBACrC,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC/B,GAAG,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;aAC5B,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YACnD,IAAI,KAAK,CAAC,WAAW;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC9B,CAAC,CACF,CAAC;AACN,CAAC"}