things-api 0.17.0 → 0.18.0

package/dist/deputy/install.js

@@ -0,0 +1,467 @@
+/**
+ * things-helpers lifecycle: install/uninstall the launchd LaunchAgents for
+ * both helper halves, restart them, run the reader's grant ceremony, and
+ * report status. launchd owns both processes end-to-end (RunAtLoad +
+ * KeepAlive) — there is never a detached or self-daemonized process, and a
+ * crashed helper relaunches with its identity (and therefore its macOS
+ * permission grants) intact.
+ *
+ * Both halves ship inside ONE bundle (Things API Helper.app): things-deputy
+ * (automation, unsandboxed) is the bundle's main executable and the sandboxed
+ * things-reader.app nests under Contents/Helpers with its own bundle identity
+ * — that identity (com.pixelcog.things-reader) keys the user's security-scoped
+ * bookmark grant and must never change.
+ */
+import { execFileSync, spawnSync } from "node:child_process";
+import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { THINGS_GROUP_CONTAINER } from "../db/locate.js";
+import { DeputySyncBridge } from "./bridge.js";
+import { DEPUTY_LAUNCHD_LABEL, HELPERS_BUNDLE_ID, READER_LAUNCHD_LABEL, DEPUTY_PROTOCOL_VERSION, deputyInstalledBinaryPath, deputySocketPath, deputyStateDir, deputyTokenPath, helpersInstallDir, helpersInstalledBundlePath, readerInstalledAppPath, readerSocketPath, readerTokenPath, } from "./protocol.js";
+export function deputyPlistPath() {
+    return join(homedir(), "Library/LaunchAgents", `${DEPUTY_LAUNCHD_LABEL}.plist`);
+}
+export function readerPlistPath() {
+    return join(homedir(), "Library/LaunchAgents", `${READER_LAUNCHD_LABEL}.plist`);
+}
+/**
+ * Where an install looks for the bundle when the caller names no path, in
+ * preference order: `deputy/prebuilt` — the signed + notarized bundle the
+ * release workflow stages into the published tarball, so an npm install needs
+ * neither Xcode nor a certificate — then `deputy/build`, the output of
+ * scripts/build-helpers.sh in a source checkout.
+ */
+export function helpersBundleCandidates() {
+    return [
+        fileURLToPath(new URL("../../deputy/prebuilt/Things API Helper.app", import.meta.url)),
+        fileURLToPath(new URL("../../deputy/build/Things API Helper.app", import.meta.url)),
+    ];
+}
+/**
+ * The first candidate bundle that carries a deputy executable; null when none
+ * does. Both candidates are READ only — nothing in the `things helpers` path
+ * ever writes inside the package directory, so the CLI works from a read-only
+ * package root (an npx cache); BUILDING a bundle there is the one operation
+ * that needs a writable checkout, and `--bundle <path>` covers a prebuilt one.
+ */
+export function helpersDefaultBuildPath() {
+    return (helpersBundleCandidates().find((path) => existsSync(join(path, "Contents/MacOS/things-deputy"))) ?? null);
+}
+/**
+ * The INSTALLED bundle's version, read prompt-free from its Info.plist
+ * (CFBundleShortVersionString, stamped from deputy/VERSION at build time).
+ * Null when nothing is installed or the plist is unreadable/unstamped. This is
+ * the version a passive upgrade notice compares against
+ * {@link EXPECTED_HELPERS_VERSION} without needing a running helper.
+ */
+export function installedHelpersVersion(env = process.env) {
+    const plist = join(helpersInstalledBundlePath(env), "Contents/Info.plist");
+    try {
+        const xml = readFileSync(plist, "utf8");
+        const match = /<key>CFBundleShortVersionString<\/key>\s*<string>([^<]*)<\/string>/.exec(xml);
+        const value = match?.[1]?.trim();
+        return value !== undefined && value !== "" ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function readerLaunchTarget() {
+    return `gui/${process.getuid?.() ?? 501}/${READER_LAUNCHD_LABEL}`;
+}
+function readerExecPath(appPath) {
+    return join(appPath, "Contents/MacOS/things-reader");
+}
+function renderReaderPlist(appPath) {
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${READER_LAUNCHD_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${readerExecPath(appPath)}</string>
+    <string>--serve</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <!-- Background Task Management groups the login item under the helper
+       bundle's display name ("Things API Helper") instead of the signing
+       certificate's personal name. -->
+  <key>AssociatedBundleIdentifiers</key>
+  <array>
+    <string>${HELPERS_BUNDLE_ID}</string>
+  </array>
+</dict>
+</plist>
+`;
+}
+function launchTarget() {
+    return `gui/${process.getuid?.() ?? 501}/${DEPUTY_LAUNCHD_LABEL}`;
+}
+function launchctl(args) {
+    try {
+        // stderr must be captured, never inherited: a routine negative probe
+        // ("Could not find service … in domain") is a state we REPORT, not noise
+        // the child gets to print over our own output.
+        //
+        // The timeout must clear the helpers' DRAIN bound: `bootout`/`kickstart -k`
+        // block until the old process exits, and a helper with a request in flight
+        // takes up to HELPERS_DRAIN_TIMEOUT_MS to finish it before exiting.
+        const output = execFileSync("launchctl", args, {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: 30_000,
+        });
+        return { ok: true, output };
+    }
+    catch (err) {
+        const e = err;
+        return { ok: false, output: `${e.stdout ?? ""}${e.stderr ?? ""}` || (e.message ?? "failed") };
+    }
+}
+function renderPlist(binaryPath, stateDir) {
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${DEPUTY_LAUNCHD_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${binaryPath}</string>
+    <string>--state-dir</string>
+    <string>${stateDir}</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <!-- Interactive: the deputy fronts GUI accessibility work; keep it out of
+       background-QoS throttling so drives stay as fast as direct execution. -->
+  <key>ProcessType</key>
+  <string>Interactive</string>
+  <key>StandardErrorPath</key>
+  <string>${stateDir}/deputy.stderr.log</string>
+  <!-- Background Task Management groups the login item under the helper
+       bundle's display name ("Things API Helper") instead of the signing
+       certificate's personal name. -->
+  <key>AssociatedBundleIdentifiers</key>
+  <array>
+    <string>${HELPERS_BUNDLE_ID}</string>
+  </array>
+</dict>
+</plist>
+`;
+}
+/** codesign facts about a binary (diagnostic output — may name mechanisms). */
+export function deputySigningInfo(binaryPath) {
+    // spawnSync, not execFileSync: codesign prints its details on STDERR while
+    // exiting 0, and execFileSync only surfaces stderr on the failure path — the
+    // success case must read both streams.
+    const res = spawnSync("codesign", ["-dvv", binaryPath], { encoding: "utf8", timeout: 10_000 });
+    const out = `${res.stdout ?? ""}${res.stderr ?? ""}`;
+    if (res.error !== undefined || out === "")
+        return { state: "unknown", authority: null };
+    if (/not signed at all/i.test(out))
+        return { state: "unsigned", authority: null };
+    if (/Signature=adhoc/i.test(out))
+        return { state: "adhoc", authority: null };
+    const authority = /Authority=(.+)/.exec(out)?.[1]?.trim() ?? null;
+    return authority !== null
+        ? { state: "signed", authority }
+        : { state: "unknown", authority: null };
+}
+/** One handshake against the reader's socket; null when it cannot complete. */
+function readerHelloProbe(env) {
+    const socketPath = readerSocketPath(env);
+    const tokenPath = readerTokenPath(env);
+    if (!existsSync(socketPath) || !existsSync(tokenPath))
+        return null;
+    const token = readFileSync(tokenPath, "utf8").trim();
+    const bridge = new DeputySyncBridge(socketPath);
+    try {
+        const res = bridge.request({ v: DEPUTY_PROTOCOL_VERSION, token, verb: "hello" }, 2000);
+        return res["ok"] === true ? res : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        bridge.close();
+    }
+}
+/**
+ * Install (or reinstall) the helpers: copy the built bundle to its stable
+ * path, write both LaunchAgent plists, and (re)bootstrap them under launchd.
+ */
+export function installHelpers(options = {}, env = process.env) {
+    const source = options.bundlePath ?? helpersDefaultBuildPath();
+    if (source === null) {
+        throw new Error(`helpers bundle not found — looked for ${helpersBundleCandidates().join(" and ")}. ` +
+            `Build it first: bash scripts/build-helpers.sh`);
+    }
+    if (!existsSync(join(source, "Contents/MacOS/things-deputy"))) {
+        throw new Error(`helpers bundle not found at ${source} — build it first: bash scripts/build-helpers.sh`);
+    }
+    const readerInBuild = existsSync(join(source, "Contents/Helpers/things-reader.app"));
+    const installDir = helpersInstallDir(env);
+    const bundlePath = helpersInstalledBundlePath(env);
+    const stateDir = deputyStateDir(env);
+    // Stop both halves before replacing the bundle (ignore "not loaded"), then
+    // recreate the install dir from scratch: install owns bin/ WHOLESALE — a
+    // fresh copy every time erases any previous layout without migration logic
+    // and resets the kernel's per-vnode code-signature cache.
+    launchctl(["bootout", launchTarget()]);
+    launchctl(["bootout", readerLaunchTarget()]);
+    rmSync(installDir, { recursive: true, force: true });
+    mkdirSync(installDir, { recursive: true, mode: 0o700 });
+    cpSync(source, bundlePath, { recursive: true });
+    const plistPath = deputyPlistPath();
+    mkdirSync(dirname(plistPath), { recursive: true });
+    writeFileSync(plistPath, renderPlist(deputyInstalledBinaryPath(env), stateDir));
+    const warnings = [];
+    const boot = launchctl(["bootstrap", `gui/${process.getuid?.() ?? 501}`, plistPath]);
+    if (!boot.ok) {
+        warnings.push(`launchctl bootstrap failed: ${boot.output.trim()}`);
+    }
+    const signing = deputySigningInfo(deputyInstalledBinaryPath(env));
+    if (signing.state !== "signed") {
+        warnings.push(`bundle is ${signing.state} — macOS permission grants will NOT survive rebuilds. ` +
+            `Mint the persistent certificate once (scripts/deputy-cert-setup.sh), rebuild, reinstall.`);
+    }
+    let readerGranted = null;
+    if (readerInBuild) {
+        const readerPlist = readerPlistPath();
+        writeFileSync(readerPlist, renderReaderPlist(readerInstalledAppPath(env)));
+        const readerBoot = launchctl(["bootstrap", `gui/${process.getuid?.() ?? 501}`, readerPlist]);
+        if (!readerBoot.ok) {
+            warnings.push(`reader launchctl bootstrap failed: ${readerBoot.output.trim()}`);
+        }
+        else {
+            // Report the ACTUAL grant state instead of a "run it if you have not"
+            // hedge — the reader knows, so ask it (bounded: it just booted).
+            const deadline = Date.now() + 4000;
+            while (Date.now() < deadline) {
+                const hello = readerHelloProbe(env);
+                if (hello !== null) {
+                    readerGranted = hello.granted === true;
+                    break;
+                }
+                syncSleepMs(250);
+            }
+        }
+    }
+    else {
+        warnings.push("the bundle was built without things-reader (no Apple-issued signing identity?) — file reads run direct. Build with an Apple-chain identity, reinstall, then run `things helpers grant`.");
+    }
+    return {
+        bundlePath,
+        plistPath,
+        stateDir,
+        signing,
+        readerInstalled: readerInBuild,
+        readerGranted,
+        warnings,
+    };
+}
+/** Stop both halves and remove LaunchAgents + the installed bundle (state — tokens, logs, the reader's grant — is kept). */
+export function uninstallHelpers(env = process.env) {
+    const removed = [];
+    launchctl(["bootout", launchTarget()]);
+    launchctl(["bootout", readerLaunchTarget()]);
+    for (const path of [deputyPlistPath(), readerPlistPath()]) {
+        if (existsSync(path)) {
+            rmSync(path);
+            removed.push(path);
+        }
+    }
+    const installDir = helpersInstallDir(env);
+    if (existsSync(installDir)) {
+        rmSync(installDir, { recursive: true });
+        removed.push(installDir);
+    }
+    return { removed };
+}
+/** Restart the launchd-managed helpers (picks up a rebuilt installed bundle). */
+export function restartHelpers() {
+    const res = launchctl(["kickstart", "-k", launchTarget()]);
+    if (!res.ok) {
+        throw new Error(`launchctl kickstart failed (${res.output.trim() || "unknown"}) — are the helpers installed? Run: things helpers install`);
+    }
+    // Reader restart is best-effort: it may legitimately not be installed.
+    launchctl(["kickstart", "-k", readerLaunchTarget()]);
+}
+/**
+ * The one-time grant ceremony: open the reader in `--grant` mode (the panel
+ * must be presented by the SANDBOXED process — that is what makes the grant
+ * durable) and wait for the bookmark to land, confirmed via the reader's
+ * handshake. The panel opens INSIDE the Things data folder when it exists, so
+ * accepting is the only click. Interactive by design; returns when granted or
+ * on timeout, and verifies the database actually resolves inside the granted
+ * scope so a wrong-folder grant reports loudly instead of half-working.
+ */
+export function grantReader(env = process.env) {
+    const appPath = readerInstalledAppPath(env);
+    if (!existsSync(appPath)) {
+        return {
+            granted: false,
+            detail: "things-reader is not installed — run `things helpers install` first",
+        };
+    }
+    const thingsContainer = join(homedir(), THINGS_GROUP_CONTAINER);
+    const startDir = existsSync(thingsContainer)
+        ? thingsContainer
+        : join(homedir(), "Library/Group Containers");
+    try {
+        execFileSync("open", ["-W", appPath, "--args", "--grant", startDir], {
+            stdio: "ignore",
+            timeout: 300_000,
+        });
+    }
+    catch (err) {
+        return {
+            granted: false,
+            detail: `could not open the grant panel: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    // The serving reader re-checks its bookmark per request — no restart needed.
+    const socketPath = readerSocketPath(env);
+    const tokenPath = readerTokenPath(env);
+    const deadline = Date.now() + 15_000;
+    let detail = "the reader is not running — `things helpers status`";
+    while (Date.now() < deadline) {
+        if (existsSync(socketPath) && existsSync(tokenPath)) {
+            const token = readFileSync(tokenPath, "utf8").trim();
+            const bridge = new DeputySyncBridge(socketPath);
+            try {
+                const res = bridge.request({ v: DEPUTY_PROTOCOL_VERSION, token, verb: "hello" }, 2000);
+                if (res["ok"] === true && res.granted === true) {
+                    const locate = bridge.request({ v: DEPUTY_PROTOCOL_VERSION, token, verb: "locate" }, 5000);
+                    bridge.close();
+                    if (locate["ok"] === true)
+                        return { granted: true, detail: "granted" };
+                    return {
+                        granted: false,
+                        detail: "the grant landed, but the Things database was not found inside the granted folder — rerun `things helpers grant` and grant the Things data folder",
+                    };
+                }
+                detail = "the panel closed but no grant landed (canceled?) — rerun `things helpers grant`";
+            }
+            catch {
+                detail = "the reader socket is not answering — `things helpers status`";
+            }
+            finally {
+                bridge.close();
+            }
+        }
+        syncSleepMs(500);
+    }
+    return { granted: false, detail };
+}
+function syncSleepMs(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/**
+ * Prompt-free status for both halves: launchd load state, a live handshake
+ * when each socket answers, and the installed bundle's signing facts. Works
+ * with routing disabled — inspect first, enable after.
+ */
+export function helpersStatus(mode, env = process.env) {
+    const binaryPath = deputyInstalledBinaryPath(env);
+    const binaryInstalled = existsSync(binaryPath);
+    const socketPath = deputySocketPath(env);
+    let hello = null;
+    let detail = "";
+    const socketPresent = existsSync(socketPath) && existsSync(deputyTokenPath(env));
+    if (socketPresent) {
+        const token = readFileSync(deputyTokenPath(env), "utf8").trim();
+        const bridge = new DeputySyncBridge(socketPath);
+        try {
+            const res = bridge.request({ v: DEPUTY_PROTOCOL_VERSION, token, verb: "hello" }, 2000);
+            if (res["ok"] === true) {
+                hello = res;
+            }
+            else {
+                detail = `handshake refused: ${JSON.stringify(res["error"])}`;
+            }
+        }
+        catch (err) {
+            detail = `socket present but not answering: ${err instanceof Error ? err.message : String(err)}`;
+        }
+        finally {
+            bridge.close();
+        }
+    }
+    else {
+        detail = "not running (no socket)";
+    }
+    return {
+        mode,
+        bundleInstalled: binaryInstalled,
+        installedVersion: installedHelpersVersion(env),
+        deputy: {
+            plistInstalled: existsSync(deputyPlistPath()),
+            loaded: launchctl(["print", launchTarget()]).ok,
+            running: hello !== null,
+            socketPath,
+            hungSocket: socketPresent && hello === null,
+            hello,
+            signing: binaryInstalled ? deputySigningInfo(binaryPath) : null,
+            detail: hello !== null ? "running" : detail,
+        },
+        reader: readerStatus(env),
+    };
+}
+function readerStatus(env) {
+    const appPath = readerInstalledAppPath(env);
+    const installed = existsSync(appPath);
+    const loaded = launchctl(["print", readerLaunchTarget()]).ok;
+    const socketPath = readerSocketPath(env);
+    const tokenPath = readerTokenPath(env);
+    let running = false;
+    let granted = false;
+    let hello = null;
+    let detail = "not running (no socket)";
+    const socketPresent = existsSync(socketPath) && existsSync(tokenPath);
+    if (socketPresent) {
+        const token = readFileSync(tokenPath, "utf8").trim();
+        const bridge = new DeputySyncBridge(socketPath);
+        try {
+            const res = bridge.request({ v: DEPUTY_PROTOCOL_VERSION, token, verb: "hello" }, 2000);
+            if (res["ok"] === true) {
+                running = true;
+                hello = res;
+                granted = res.granted === true;
+                detail = granted ? "running, granted" : "running, NOT granted (things helpers grant)";
+            }
+            else {
+                detail = `handshake refused: ${JSON.stringify(res["error"])}`;
+            }
+        }
+        catch (err) {
+            detail = `socket present but not answering: ${err instanceof Error ? err.message : String(err)}`;
+        }
+        finally {
+            bridge.close();
+        }
+    }
+    return {
+        installed,
+        plistInstalled: existsSync(readerPlistPath()),
+        loaded,
+        running,
+        granted,
+        socketPath,
+        hungSocket: socketPresent && !running,
+        hello,
+        signing: installed ? deputySigningInfo(readerExecPath(appPath)) : null,
+        detail,
+    };
+}
+//# sourceMappingURL=install.js.map

package/dist/deputy/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/deputy/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7F,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EAGvB,yBAAyB,EACzB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,sBAAsB,EAAE,GAAG,oBAAoB,QAAQ,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,sBAAsB,EAAE,GAAG,oBAAoB,QAAQ,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,aAAa,CAAC,IAAI,GAAG,CAAC,6CAA6C,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtF,aAAa,CAAC,IAAI,GAAG,CAAC,0CAA0C,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KACpF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,CACL,uBAAuB,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACtC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAC,CACvD,IAAI,IAAI,CACV,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,oEAAoE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7F,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACjC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,OAAO,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,GAAG,IAAI,oBAAoB,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,IAAI,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO;;;;;YAKG,oBAAoB;;;cAGlB,cAAc,CAAC,OAAO,CAAC;;;;;;;;;;;;cAYvB,iBAAiB;;;;CAI9B,CAAC;AACF,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,OAAO,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,GAAG,IAAI,oBAAoB,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,IAAc;IAC/B,IAAI,CAAC;QACH,qEAAqE;QACrE,yEAAyE;QACzE,+CAA+C;QAC/C,EAAE;QACF,4EAA4E;QAC5E,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,IAAI,EAAE;YAC7C,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAA6D,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC,EAAE,CAAC;IAChG,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,QAAgB;IACvD,OAAO;;;;;YAKG,oBAAoB;;;cAGlB,UAAU;;cAEV,QAAQ;;;;;;;;;;;YAWV,QAAQ;;;;;;cAMN,iBAAiB;;;;CAI9B,CAAC;AACF,CAAC;AAOD,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,2EAA2E;IAC3E,6EAA6E;IAC7E,uCAAuC;IACvC,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/F,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IACrD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACxF,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClF,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC7E,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAClE,OAAO,SAAS,KAAK,IAAI;QACvB,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE;QAChC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAaD,+EAA+E;AAC/E,SAAS,gBAAgB,CAAC,GAAsB;IAC9C,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;QACvF,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAE,GAA8B,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,UAAmC,EAAE,EACrC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,IAAI,uBAAuB,EAAE,CAAC;IAC/D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,yCAAyC,uBAAuB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;YAClF,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,+BAA+B,MAAM,kDAAkD,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAErC,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,0DAA0D;IAC1D,SAAS,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IACvC,SAAS,CAAC,CAAC,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAC7C,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhD,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,aAAa,CAAC,SAAS,EAAE,WAAW,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEhF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,OAAO,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,+BAA+B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CACX,aAAa,OAAO,CAAC,KAAK,wDAAwD;YAChF,0FAA0F,CAC7F,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,GAAmB,IAAI,CAAC;IACzC,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,aAAa,CAAC,WAAW,EAAE,iBAAiB,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,OAAO,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QAC7F,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,sCAAsC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;aAAM,CAAC;YACN,sEAAsE;YACtE,iEAAiE;YACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACnC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBACnB,aAAa,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;oBACvC,MAAM;gBACR,CAAC;gBACD,WAAW,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CACX,yLAAyL,CAC1L,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU;QACV,SAAS;QACT,QAAQ;QACR,OAAO;QACP,eAAe,EAAE,aAAa;QAC9B,aAAa;QACb,QAAQ;KACT,CAAC;AACJ,CAAC;AAMD,4HAA4H;AAC5H,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,SAAS,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IACvC,SAAS,CAAC,CAAC,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QAC1D,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,+BAA+B,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,SAAS,4DAA4D,CAC1H,CAAC;IACJ,CAAC;IACD,uEAAuE;IACvE,SAAS,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IAI9D,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,qEAAqE;SAC9E,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC;QAC1C,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,0BAA0B,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE;YACnE,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,mCAAmC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC9F,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,IAAI,MAAM,GAAG,qDAAqD,CAAC;IACnE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;gBACvF,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAK,GAA6B,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;oBAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAC3B,EAAE,CAAC,EAAE,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EACrD,IAAI,CACL,CAAC;oBACF,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI;wBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;oBACvE,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,MAAM,EACJ,mJAAmJ;qBACtJ,CAAC;gBACJ,CAAC;gBACD,MAAM,GAAG,iFAAiF,CAAC;YAC7F,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,8DAA8D,CAAC;YAC1E,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,EAAU;IAC7B,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACnE,CAAC;AAiCD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAiB,EACjB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,eAAe,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,KAAK,GAAuB,IAAI,CAAC;IACrC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,aAAa,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;YACvF,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvB,KAAK,GAAG,GAA6B,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,sBAAsB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAChE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACnG,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,yBAAyB,CAAC;IACrC,CAAC;IACD,OAAO;QACL,IAAI;QACJ,eAAe,EAAE,eAAe;QAChC,gBAAgB,EAAE,uBAAuB,CAAC,GAAG,CAAC;QAC9C,MAAM,EAAE;YACN,cAAc,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC;YAC7C,MAAM,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE;YAC/C,OAAO,EAAE,KAAK,KAAK,IAAI;YACvB,UAAU;YACV,UAAU,EAAE,aAAa,IAAI,KAAK,KAAK,IAAI;YAC3C,KAAK;YACL,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;YAC/D,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;SAC5C;QACD,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAsB;IAC1C,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,GAAuB,IAAI,CAAC;IACrC,IAAI,MAAM,GAAG,yBAAyB,CAAC;IACvC,MAAM,aAAa,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;YACvF,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvB,OAAO,GAAG,IAAI,CAAC;gBACf,KAAK,GAAG,GAA6B,CAAC;gBACtC,OAAO,GAAI,GAA6B,CAAC,OAAO,KAAK,IAAI,CAAC;gBAC1D,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,6CAA6C,CAAC;YACxF,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,sBAAsB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAChE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACnG,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO;QACL,SAAS;QACT,cAAc,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC;QAC7C,MAAM;QACN,OAAO;QACP,OAAO;QACP,UAAU;QACV,UAAU,EAAE,aAAa,IAAI,CAAC,OAAO;QACrC,KAAK;QACL,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QACtE,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/deputy/notice.d.ts

@@ -0,0 +1,6 @@
+/** Emit one helpers notice on stderr; later calls this process are dropped. */
+export declare function emitHelpersNotice(message: string, write?: (s: string) => void): void;
+/** True once this process has spent its one notice. */
+export declare function helpersNoticeSpent(): boolean;
+/** Test seam: forget that a notice was emitted. */
+export declare function resetHelpersNoticeForTests(): void;

package/dist/deputy/notice.js

@@ -0,0 +1,28 @@
+/**
+ * The single helpers stderr channel: AT MOST ONE line per process, whichever
+ * condition speaks first.
+ *
+ * Two producers share it — the routing layer (degradation caught at
+ * activation, src/deputy/routing.ts) and the CLI's passive install/upgrade
+ * check (src/cli/helpers-check.ts). One process can hit both (an installed but
+ * stale helper that also fails to answer), and two stacked lines about the same
+ * broken helper are noise, not information: the first one already names a
+ * remedy that resolves the state.
+ */
+let noticed = false;
+/** Emit one helpers notice on stderr; later calls this process are dropped. */
+export function emitHelpersNotice(message, write = (s) => void process.stderr.write(s)) {
+    if (noticed)
+        return;
+    noticed = true;
+    write(`things-api helpers: ${message}\n`);
+}
+/** True once this process has spent its one notice. */
+export function helpersNoticeSpent() {
+    return noticed;
+}
+/** Test seam: forget that a notice was emitted. */
+export function resetHelpersNoticeForTests() {
+    noticed = false;
+}
+//# sourceMappingURL=notice.js.map

package/dist/deputy/notice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notice.js","sourceRoot":"","sources":["../../src/deputy/notice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,IAAI,OAAO,GAAG,KAAK,CAAC;AAEpB,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,QAA6B,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAEhE,IAAI,OAAO;QAAE,OAAO;IACpB,OAAO,GAAG,IAAI,CAAC;IACf,KAAK,CAAC,uBAAuB,OAAO,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,0BAA0B;IACxC,OAAO,GAAG,KAAK,CAAC;AAClB,CAAC"}

package/dist/deputy/notices.d.ts

@@ -0,0 +1,31 @@
+/** How long the absence hint stays quiet after being shown once. */
+export declare const HELPERS_HINT_INTERVAL_DAYS = 14;
+export type HelpersNoticeKind = "version-skew" | "absent-hint";
+export interface HelpersNotice {
+    kind: HelpersNoticeKind;
+    /** The one line to print (no prefix — the notice sink adds it). */
+    text: string;
+}
+export interface HelpersNoticeOptions {
+    env?: NodeJS.ProcessEnv;
+    /** Wall clock (ms) for the hint throttle; defaults to now. */
+    now?: number;
+    /** Host platform; the helpers are macOS-only, so nothing fires elsewhere. */
+    platform?: string;
+    /**
+     * Test seam. Defaults to the real provenance: true when `helpers-enabled` is
+     * neither stored nor forced by the environment (nobody has ever answered the
+     * routing question on this host).
+     */
+    modeUntouched?: boolean;
+}
+/** When the absence hint was last shown (ms), or null when never/unreadable. */
+export declare function lastHelpersHintAt(env?: NodeJS.ProcessEnv): number | null;
+/** Record that the absence hint was shown, restarting its throttle window. */
+export declare function markHelpersHintShown(env?: NodeJS.ProcessEnv, now?: number): void;
+/**
+ * The notice this machine has earned, or null when it has nothing to say.
+ * Skew outranks the hint (they are mutually exclusive anyway: one needs an
+ * installed bundle, the other its absence).
+ */
+export declare function computeHelpersNotice(options?: HelpersNoticeOptions): HelpersNotice | null;

package/dist/deputy/notices.js

@@ -0,0 +1,94 @@
+/**
+ * The PASSIVE helpers notices — what a human sees on a command they were
+ * running anyway, without asking about the helpers at all (the skill-drift
+ * precedent, src/cli/skill-check.ts).
+ *
+ * Two conditions, both computed from disk with no handshake and no prompt:
+ *
+ *  - `version-skew`: routing is on (`auto`/`true`), a bundle IS installed, and
+ *    its version differs from the one this package expects. The remedy is a
+ *    rebuild + reinstall — the installed bundle is a COPY, so restarting it
+ *    would only restart the stale code.
+ *  - `absent-hint`: nothing is installed, the routing mode has never been set,
+ *    and the hint has not been shown for {@link HELPERS_HINT_INTERVAL_DAYS}
+ *    days. This one is a suggestion, not a fault, so it is throttled by a stamp
+ *    in the state dir and suppressible like the rest.
+ *
+ * Emission (gating, kill switch, the one-line-per-process budget) belongs to
+ * the caller — src/cli/helpers-check.ts. These functions only decide.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { getConfigKey, loadConfig } from "../config.js";
+import { stateDir } from "../paths.js";
+import { installedHelpersVersion } from "./install.js";
+import { EXPECTED_HELPERS_VERSION, helpersInstalledBundlePath } from "./protocol.js";
+/** How long the absence hint stays quiet after being shown once. */
+export const HELPERS_HINT_INTERVAL_DAYS = 14;
+function hintStampPath(env) {
+    return join(stateDir(env), "helpers-hint.json");
+}
+/** When the absence hint was last shown (ms), or null when never/unreadable. */
+export function lastHelpersHintAt(env = process.env) {
+    try {
+        const raw = JSON.parse(readFileSync(hintStampPath(env), "utf8"));
+        const parsed = typeof raw.shownAt === "string" ? Date.parse(raw.shownAt) : NaN;
+        return Number.isNaN(parsed) ? null : parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/** Record that the absence hint was shown, restarting its throttle window. */
+export function markHelpersHintShown(env = process.env, now = Date.now()) {
+    try {
+        mkdirSync(stateDir(env), { recursive: true });
+        writeFileSync(hintStampPath(env), `${JSON.stringify({ shownAt: new Date(now).toISOString() }, null, 2)}\n`);
+    }
+    catch {
+        // A hint that cannot remember itself is still better than a broken command.
+    }
+}
+/**
+ * The notice this machine has earned, or null when it has nothing to say.
+ * Skew outranks the hint (they are mutually exclusive anyway: one needs an
+ * installed bundle, the other its absence).
+ */
+export function computeHelpersNotice(options = {}) {
+    const env = options.env ?? process.env;
+    const platform = options.platform ?? process.platform;
+    if (platform !== "darwin")
+        return null;
+    const mode = loadConfig(env).helpersMode;
+    if (mode === "false")
+        return null;
+    const installed = existsSync(helpersInstalledBundlePath(env));
+    if (installed) {
+        const version = installedHelpersVersion(env);
+        if (version === null || version === EXPECTED_HELPERS_VERSION)
+            return null;
+        return {
+            kind: "version-skew",
+            text: `helpers v${version} installed, this package expects v${EXPECTED_HELPERS_VERSION} — ` +
+                "rebuild with `bash scripts/build-helpers.sh` and rerun `things helpers install` " +
+                "(THINGS_API_NO_HELPERS_CHECK=1 silences this)",
+        };
+    }
+    // Nothing installed: a suggestion, and only for a host that has never
+    // expressed an opinion — an explicit `auto`/`true` owner is mid-setup, not
+    // in need of an introduction.
+    const untouched = options.modeUntouched ?? getConfigKey("helpers-enabled", env)?.source === "default";
+    if (!untouched)
+        return null;
+    const last = lastHelpersHintAt(env);
+    const now = options.now ?? Date.now();
+    if (last !== null && now - last < HELPERS_HINT_INTERVAL_DAYS * 86_400_000)
+        return null;
+    return {
+        kind: "absent-hint",
+        text: "database reads and app automation run in THIS process, so macOS permission grants " +
+            "follow whichever terminal or agent runtime started it — `things helpers install` moves " +
+            "them onto two stable helpers (THINGS_API_NO_HELPERS_CHECK=1 silences this)",
+    };
+}
+//# sourceMappingURL=notices.js.map

package/dist/deputy/notices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notices.js","sourceRoot":"","sources":["../../src/deputy/notices.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAoB,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAErF,oEAAoE;AACpE,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAwB7C,SAAS,aAAa,CAAC,GAAsB;IAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,mBAAmB,CAAC,CAAC;AAClD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAA0B,CAAC;QAC1F,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/E,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAClC,MAAyB,OAAO,CAAC,GAAG,EACpC,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,CAAC;QACH,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,aAAa,CACX,aAAa,CAAC,GAAG,CAAC,EAClB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACzE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAgC,EAAE;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,IAAI,GAAgB,UAAU,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC;IACtD,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,SAAS,GAAG,UAAU,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,wBAAwB;YAAE,OAAO,IAAI,CAAC;QAC1E,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,IAAI,EACF,YAAY,OAAO,qCAAqC,wBAAwB,KAAK;gBACrF,kFAAkF;gBAClF,+CAA+C;SAClD,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,2EAA2E;IAC3E,8BAA8B;IAC9B,MAAM,SAAS,GACb,OAAO,CAAC,aAAa,IAAI,YAAY,CAAC,iBAAiB,EAAE,GAAG,CAAC,EAAE,MAAM,KAAK,SAAS,CAAC;IACtF,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,GAAG,IAAI,GAAG,0BAA0B,GAAG,UAAU;QAAE,OAAO,IAAI,CAAC;IACvF,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,IAAI,EACF,oFAAoF;YACpF,yFAAyF;YACzF,4EAA4E;KAC/E,CAAC;AACJ,CAAC"}