@algosuite/vo-mcp 0.2.0-beta.10 → 0.2.0-beta.11

package/dist/runner-supervisor.js

@@ -333,9 +333,12 @@ function createControlPlaneClient({
 
 // ../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs
 import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { win32 } from "node:path";
 var DEFAULT_RUNNER_PACKAGE = "@algosuite/vo-mcp@beta";
 var PACKAGE_SPEC_RE = /^@algosuite\/vo-mcp@(beta|latest|\d+(?:\.\d+){0,2}(?:-[\w.-]+)?)$/u;
 var MAX_DIAGNOSTIC_CHARS = 800;
+var NPM_CLI_SUFFIX = `\\${win32.join("node_modules", "npm", "bin", "npm-cli.js").toLowerCase()}`;
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
 }
@@ -351,11 +354,46 @@ function sanitizeMaintenanceDiagnostic(raw, env = {}) {
   if (value.length <= MAX_DIAGNOSTIC_CHARS) return value;
   return `${value.slice(0, MAX_DIAGNOSTIC_CHARS - 1)}\u2026`;
 }
-function buildMaintenanceCommand(kind, { platform = process.platform, packageSpec = DEFAULT_RUNNER_PACKAGE } = {}) {
+function isNpmCliPath(value) {
+  return typeof value === "string" && win32.isAbsolute(value) && win32.normalize(value).toLowerCase().endsWith(NPM_CLI_SUFFIX);
+}
+function resolveNpmCli({
+  env = process.env,
+  execPath = process.execPath,
+  fileExists = existsSync
+} = {}) {
+  const candidates = [];
+  if (isNpmCliPath(env.npm_execpath)) candidates.push(env.npm_execpath);
+  candidates.push(win32.join(win32.dirname(execPath), "node_modules", "npm", "bin", "npm-cli.js"));
+  const pathValue = env.PATH ?? env.Path ?? env.path ?? "";
+  for (const entry of pathValue.split(";")) {
+    const trimmed = entry.trim();
+    if (!win32.isAbsolute(trimmed)) continue;
+    candidates.push(win32.join(trimmed, "node_modules", "npm", "bin", "npm-cli.js"));
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const candidate of candidates) {
+    const normalized = win32.normalize(candidate);
+    const key = normalized.toLowerCase();
+    if (seen.has(key) || !isNpmCliPath(normalized)) continue;
+    seen.add(key);
+    if (fileExists(normalized)) return normalized;
+  }
+  return null;
+}
+function buildMaintenanceCommand(kind, {
+  platform = process.platform,
+  packageSpec = DEFAULT_RUNNER_PACKAGE,
+  env = process.env,
+  execPath = process.execPath,
+  fileExists = existsSync
+} = {}) {
   if (!["update", "reinstall"].includes(kind)) return null;
   if (!PACKAGE_SPEC_RE.test(packageSpec)) throw new Error("unsafe runner package spec");
-  const command = platform === "win32" ? "npm.cmd" : "npm";
-  const args = ["install", "-g", packageSpec];
+  const npmCli = platform === "win32" ? resolveNpmCli({ env, execPath, fileExists }) : null;
+  if (platform === "win32" && !npmCli) throw new Error("trusted npm CLI not found");
+  const command = platform === "win32" ? execPath : "npm";
+  const args = [...npmCli ? [npmCli] : [], "install", "-g", packageSpec];
   if (kind === "reinstall") args.push("--force");
   return { command, args };
 }
@@ -363,12 +401,25 @@ function runHostMaintenance(kind, {
   platform = process.platform,
   packageSpec = DEFAULT_RUNNER_PACKAGE,
   env = process.env,
+  execPath = process.execPath,
+  fileExists = existsSync,
   spawn: spawn2 = spawnSync,
   log = () => {
   }
 } = {}) {
   if (kind === "reconnect") return { ok: true, status: 0, command: null, args: [] };
-  const command = buildMaintenanceCommand(kind, { platform, packageSpec });
+  let command;
+  try {
+    command = buildMaintenanceCommand(kind, { platform, packageSpec, env, execPath, fileExists });
+  } catch (error) {
+    return {
+      ok: false,
+      status: 2,
+      command: null,
+      args: [],
+      detail: sanitizeMaintenanceDiagnostic(error instanceof Error ? error.message : String(error), env)
+    };
+  }
   if (!command) return { ok: false, status: 2, command: null, args: [] };
   log(`runner maintenance: ${command.command} ${command.args.join(" ")}`);
   const result = spawn2(command.command, command.args, {
@@ -568,14 +619,14 @@ async function prepareSupervisorAuth({
 
 // src/runner/supervisor-credential-reader.mjs
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync as existsSync2 } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 function defaultCredentialHelperPath(metaUrl = import.meta.url) {
   const moduleDir = dirname(fileURLToPath(metaUrl));
   const bundled = join(moduleDir, "supervisor-credential-helper.js");
   const source = join(moduleDir, "..", "supervisor-credential-helper.mjs");
-  return existsSync(source) ? source : bundled;
+  return existsSync2(source) ? source : bundled;
 }
 function readStoredCredentialIsolated({
   spawn: spawn2 = spawnSync2,

package/dist/runner-supervisor.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/runner/control-plane-auth-stub.mjs", "../src/runner-supervisor.mjs", "../../../scripts/virtual-office/code-runner/control-plane-client.mjs", "../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs", "../src/runner/supervisor-child-env.mjs", "../src/runner-readiness.mjs", "../src/runner/supervisor-credential-reader.mjs"],
-  "sourcesContent": ["/**\n * Control-plane auth stub for the bundled `vo-mcp runner`.\n *\n * Replaces the daemon's lazy Firebase/SMOKE_* fallback\n * (`scripts/virtual-office/orchestrator-firestore/auth.mjs`), which pulls\n * `vo-config.mjs` (hardcoded Nexus Firebase project) + the firebase-admin chain.\n * A BYO runner ALWAYS authenticates with its own scoped `vo_credential` \u2014 read\n * from the OS keychain by `runner-cli.mjs` and injected as\n * `VO_CONTROL_PLANE_ADMIN_TOKEN` \u2014 so `control-plane-client.mjs`'s `resolveBearer`\n * returns early on the token and NEVER reaches this fallback. It exists only so\n * the bundle has nothing to resolve into the firebase chain; if it ever runs,\n * it fails LOUDLY with the fix.\n *\n * esbuild swaps this in for the heavy original at bundle time (see scripts/bundle.mjs).\n */\nexport async function getFirebaseAuth() {\n  throw new Error(\n    'vo-mcp runner: no control-plane credential. Run `vo-mcp login` first \u2014 the runner ' +\n      'authenticates with your stored vo_credential (or set VO_CONTROL_PLANE_ADMIN_TOKEN).',\n  );\n}\n", "/**\n * Persistent host supervisor for remote Mission Control maintenance.\n * The task daemon is a replaceable child; this process stays alive while it is\n * updated or repaired. Pairing credentials remain in the existing OS store.\n */\nimport { spawn } from 'node:child_process';\nimport { createRequire } from 'node:module';\nimport { fileURLToPath } from 'node:url';\nimport { dirname, join } from 'node:path';\nimport { createControlPlaneClient } from '../../../scripts/virtual-office/code-runner/control-plane-client.mjs';\nimport { runHostMaintenance } from '../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs';\nimport { prepareSupervisorAuth, resolveSupervisorRunnerId } from './runner/supervisor-child-env.mjs';\nimport { readStoredCredentialIsolated } from './runner/supervisor-credential-reader.mjs';\n\nconst DEFAULT_CONTROL_PLANE_URL = 'https://vo-control-plane-bzjphrajaq-uc.a.run.app';\nconst POLL_MS = 5000;\nconst CHILD_START_MS = 1500;\nconst childEntry = join(dirname(fileURLToPath(import.meta.url)), 'runner-cli.js');\nconst sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));\n\nconst runnerId = resolveSupervisorRunnerId(process.env);\n\nfunction packageVersion() {\n  try { return createRequire(import.meta.url)('../package.json').version || 'unknown'; } catch { return 'unknown'; }\n}\n\nfunction spawnChild(childEnv) {\n  return spawn(process.execPath, [childEntry], {\n    env: childEnv,\n    stdio: 'inherit',\n    windowsHide: true,\n  });\n}\n\nasync function localStatus() {\n  try {\n    const port = Number(process.env.VO_CODE_RUNNER_CONTROL_PORT || 7787);\n    const response = await fetch(`http://127.0.0.1:${port}/status`, { signal: AbortSignal.timeout(800) });\n    if (!response.ok) return null;\n    const body = await response.json();\n    return body?.ok === true ? body : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function waitForLocalRunner(child) {\n  const deadline = Date.now() + 15_000;\n  while (Date.now() < deadline) {\n    if (child.exitCode !== null) return false;\n    if ((await localStatus())?.running === true) return true;\n    await sleep(500);\n  }\n  return false;\n}\n\nasync function stopChild(child) {\n  if (!child || child.exitCode !== null) return;\n  child.kill(process.platform === 'win32' ? undefined : 'SIGTERM');\n  await Promise.race([\n    new Promise((resolve) => child.once('exit', resolve)),\n    sleep(15_000),\n  ]);\n  if (child.exitCode === null) child.kill('SIGKILL');\n}\n\nasync function main() {\n  // Read keychain-backed credentials in a process that exits before npm ever\n  // attempts to replace this package. Windows otherwise keeps the keyring DLL\n  // locked for the full supervisor lifetime and global self-updates fail.\n  const stored = readStoredCredentialIsolated();\n  const controlPlaneUrl = process.env.VO_CONTROL_PLANE_URL || DEFAULT_CONTROL_PLANE_URL;\n  const { childEnv, clientEnv, operatorId } = await prepareSupervisorAuth({\n    baseEnv: process.env,\n    storedCredential: stored,\n    controlPlaneUrl,\n  });\n  const client = createControlPlaneClient({ baseUrl: controlPlaneUrl, env: clientEnv });\n  let child = spawnChild(childEnv);\n  let stopping = false;\n  let handling = false;\n\n  const respawn = () => {\n    if (!stopping && !handling && (!child || child.exitCode !== null)) child = spawnChild(childEnv);\n  };\n  child.on('exit', () => setTimeout(respawn, 2000));\n\n  const shutdown = async () => {\n    if (stopping) return;\n    stopping = true;\n    await stopChild(child);\n  };\n  process.on('SIGINT', () => { void shutdown().finally(() => process.exit(0)); });\n  process.on('SIGTERM', () => { void shutdown().finally(() => process.exit(0)); });\n\n  while (!stopping) {\n    try {\n      const action = await client.pollRunnerControl({ runnerId, ...(operatorId ? { operatorId } : {}) });\n      if (!action) {\n        await sleep(POLL_MS);\n        continue;\n      }\n      handling = true;\n      const beforeStop = await localStatus();\n      if (beforeStop && Number(beforeStop.activeTasks || 0) > 0) {\n        await client.completeRunnerControl(action.actionId, {\n          runnerId,\n          ...(operatorId ? { operatorId } : {}),\n          status: 'failed',\n          detail: `deferred safely: ${beforeStop.activeTasks} active task(s); retry when the runner is idle`,\n        });\n        handling = false;\n        continue;\n      }\n      await stopChild(child);\n      const result = runHostMaintenance(action.kind, {\n        env: clientEnv,\n        log: (message) => console.warn(`[vo-runner supervisor] ${message}`),\n      });\n      child = spawnChild(childEnv);\n      await sleep(CHILD_START_MS);\n      if (child.exitCode !== null || !(await waitForLocalRunner(child))) result.ok = false;\n      await client.completeRunnerControl(action.actionId, {\n        runnerId,\n        ...(operatorId ? { operatorId } : {}),\n        status: result.ok ? 'succeeded' : 'failed',\n        detail: result.ok\n          ? `runner ${packageVersion()} reconnected`\n          : `maintenance exited ${result.status}${result.detail ? `: ${result.detail}` : ''}`,\n      });\n      handling = false;\n    } catch (error) {\n      console.error(`[vo-runner supervisor] ${error instanceof Error ? error.message : String(error)}`);\n      handling = false;\n      await sleep(POLL_MS);\n    }\n  }\n}\n\nmain().catch((error) => {\n  console.error(`[vo-runner supervisor] fatal: ${error instanceof Error ? error.message : String(error)}`);\n  process.exitCode = 1;\n});\n", "/**\n * control-plane-client \u2014 the runner's OUTBOUND link to vo-control-plane.\n *\n * Increment 6 (Code-from-Anywhere). The daemon never exposes a port; it reaches\n * OUT to the control-plane (no inbound hole, no Tailscale \u2014 design \u00A72). Auth:\n * prefer the static admin token (`VO_CONTROL_PLANE_ADMIN_TOKEN`, the V1 local\n * dogfood path); fall back to a per-user Firebase ID token via the shared\n * orchestrator auth (`SMOKE_*` creds \u2192 allow-listed operator \u2192 admin).\n *\n * Endpoints used:\n *   POST  /api/v1/code-task/claim          \u2192 claim the next pending task\n *   PATCH /api/v1/code-task/:id/progress   \u2192 stream progress / set terminal\n *   GET   /api/v1/code-task/:id            \u2192 poll status (cancel detection)\n *   POST  /api/v1/code-task/:id/resume     \u2192 continue a partial/max-turn task\n *   POST  /api/v1/admin/pr/merge            \u2192 CI-green exact-SHA consensus merge\n */\n\nlet cachedFirebaseToken = null;\n\nasync function resolveBearer(env) {\n  const adminToken = env.VO_CONTROL_PLANE_ADMIN_TOKEN;\n  if (adminToken) return adminToken;\n  if (cachedFirebaseToken) return cachedFirebaseToken;\n  // Lazy import \u2014 Firebase auth is only needed when no admin token is present.\n  const { getFirebaseAuth } = await import('../orchestrator-firestore/auth.mjs');\n  const auth = await getFirebaseAuth({ env });\n  if (!auth || !auth.idToken) {\n    throw new Error(\n      'no control-plane credential: set VO_CONTROL_PLANE_ADMIN_TOKEN, or SMOKE_EMAIL/SMOKE_PASSWORD/SMOKE_API_KEY',\n    );\n  }\n  cachedFirebaseToken = auth.idToken;\n  return cachedFirebaseToken;\n}\n\n/**\n * Build a client. `baseUrl` defaults to `VO_CONTROL_PLANE_URL`. `fetchImpl`\n * and `env` are injectable for tests.\n */\nexport function createControlPlaneClient({\n  baseUrl = process.env.VO_CONTROL_PLANE_URL || '',\n  env = process.env,\n  fetchImpl = fetch,\n} = {}) {\n  if (!baseUrl) {\n    throw new Error('VO_CONTROL_PLANE_URL is required for the code-runner daemon');\n  }\n  const root = baseUrl.replace(/\\/+$/, '');\n\n  async function req(method, path, body) {\n    const bearer = await resolveBearer(env);\n    return fetchImpl(`${root}${path}`, {\n      method,\n      headers: {\n        'content-type': 'application/json',\n        authorization: `Bearer ${bearer}`,\n      },\n      body: body === undefined ? undefined : JSON.stringify(body),\n    });\n  }\n\n  return {\n    /**\n     * Claim the next pending task. Returns the task or null (empty queue).\n     * `repos` (optional `owner/name` list) and `operatorIds` (optional\n     * `operator_id` list) scope the claim so this daemon only picks up tasks it\n     * serves \u2014 the control-plane filters by both (logical AND), so another\n     * operator's task never lands on (or bills) this machine.\n     */\n    async claim(runnerId, repos, operatorIds, session = {}) {\n      const body = { runner_id: runnerId };\n      if (Array.isArray(repos) && repos.length > 0) body.repos = repos;\n      if (Array.isArray(operatorIds) && operatorIds.length > 0) body.operator_ids = operatorIds;\n      if (session.runnerInstanceId) body.runner_instance_id = session.runnerInstanceId;\n      if (session.runnerInstanceId && session.reconcileStale) body.reconcile_stale = true;\n      const res = await req('POST', '/api/v1/code-task/claim', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null; // force re-auth next call\n        throw new Error('claim unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`claim failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json && json.task ? json.task : null;\n    },\n\n    /**\n     * Enqueue a new code-task (used by the PR watcher to auto-dispatch a CI fix).\n     * Server derives operator/tenant from the daemon's authenticated principal.\n     * Returns the created task, or throws on a non-2xx response.\n     */\n    async enqueueCodeTask({ repo, prompt, max_budget_usd, max_turns }) {\n      const body = { repo, prompt };\n      if (typeof max_budget_usd === 'number') body.max_budget_usd = max_budget_usd;\n      if (typeof max_turns === 'number') body.max_turns = max_turns;\n      const res = await req('POST', '/api/v1/code-task', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('enqueue unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`enqueue failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json && json.task ? json.task : null;\n    },\n\n    /**\n     * Resume a failed/cancelled/max-turn partial code-task. The PR watcher uses\n     * this after the runner opens a partial draft PR and CI is no longer pending.\n     */\n    async resumeCodeTask(taskId) {\n      const res = await req('POST', `/api/v1/code-task/${encodeURIComponent(taskId)}/resume`, {});\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('resume unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`resume failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json && json.task ? json.task : null;\n    },\n\n    /**\n     * Send a CI-green PR through the production verify-before-act merge route.\n     * The server inspects the current diff, applies deterministic blockers, runs\n     * consensus, records a receipt, and direct-merges only the inspected SHA.\n     */\n    async mergeVerifiedPr(prNumber, automationContext) {\n      const res = await req('POST', '/api/v1/admin/pr/merge', { prNumber, automationContext });\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('gated merge unauthorized (401)');\n      }\n      const json = await res.json().catch(() => ({}));\n      if (res.ok && json?.ok === true) {\n        const result = json?.result && typeof json.result === 'object' ? json.result : {};\n        const status = result.merged === true || result.status === 'merged'\n          ? 'merged'\n          : result.status === 'auto-merge-enabled' || String(result.action || '').includes('auto-merge')\n            ? 'queued'\n            : 'accepted';\n        return {\n          status,\n          detail: typeof result.detail === 'string' ? result.detail : null,\n          actionReceiptId: typeof json.action_receipt_id === 'string' ? json.action_receipt_id : null,\n        };\n      }\n      if (res.status === 503 && json?.error === 'verify_unavailable') {\n        return { status: 'retry', reason: json.reason || 'verification unavailable' };\n      }\n      return {\n        status: 'blocked',\n        reason: json?.reason || json?.message || json?.error || `HTTP ${res.status}`,\n        actionReceiptId: typeof json?.action_receipt_id === 'string' ? json.action_receipt_id : null,\n      };\n    },\n\n    /**\n     * Append progress / set terminal status. Returns\n     *   { task }            \u2014 applied\n     *   { terminal: true }  \u2014 task already terminal (operator cancelled): STOP\n     */\n    async postProgress(taskId, patch) {\n      const res = await req('PATCH', `/api/v1/code-task/${taskId}/progress`, patch);\n      if (res.status === 409) return { terminal: true };\n      if (res.status === 404) return { terminal: true, missing: true };\n      if (!res.ok) throw new Error(`progress failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return { task: json && json.task };\n    },\n\n    /** Read the current task (cancel detection). Null on 404. */\n    async getTask(taskId) {\n      const res = await req('GET', `/api/v1/code-task/${taskId}`);\n      if (res.status === 404) return null;\n      if (!res.ok) throw new Error(`getTask failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json ? json.task : null;\n    },\n\n    /** Fetch bounded, prompt-ready AlgoHQ knowledge snippets for this task. */\n    async getTaskKnowledgeContext(taskId, { query } = {}) {\n      const body = {};\n      if (typeof query === 'string' && query.trim()) body.query = query;\n      const res = await req('POST', `/api/v1/code-task/${encodeURIComponent(taskId)}/knowledge-context`, body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('knowledge-context unauthorized (401)');\n      }\n      if (res.status === 404) return null;\n      if (!res.ok) throw new Error(`knowledge-context failed: HTTP ${res.status}`);\n      return res.json();\n    },\n\n    /**\n     * Report this machine's rolling-7-day Claude Code token usage (the real\n     * weekly-capacity gauge) PLUS the operator's real Claude weekly % (when\n     * available). The daemon authenticates as admin, so the target `operatorId`\n     * is named explicitly. Best-effort; throws on a non-2xx so the caller can\n     * log + move on.\n     *\n     * `tokens` = { input_tokens, output_tokens, cache_creation_tokens, cache_read_tokens }.\n     * Optional: `claudeWeeklyPct` (number) + `claudeWeeklyResetsAt` (ISO string | null).\n     */\n    async postWeeklyTokens({ operatorId, runnerId, tokens, claudeWeeklyPct, claudeWeeklyResetsAt }) {\n      const body = {\n        operator_id: operatorId,\n        runner_id: runnerId,\n        input_tokens: tokens.input_tokens,\n        output_tokens: tokens.output_tokens,\n        cache_creation_tokens: tokens.cache_creation_tokens,\n        cache_read_tokens: tokens.cache_read_tokens,\n      };\n      if (typeof claudeWeeklyPct === 'number') {\n        body.claude_weekly_pct = claudeWeeklyPct;\n      }\n      if (claudeWeeklyResetsAt !== undefined) {\n        body.claude_weekly_resets_at = claudeWeeklyResetsAt;\n      }\n      const res = await req('POST', '/api/v1/weekly-tokens', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('weekly-tokens unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`weekly-tokens failed: HTTP ${res.status}`);\n      return true;\n    },\n\n    /**\n     * Send a liveness heartbeat (M2). The control-plane upserts it under the\n     * authenticated operator so the web shows a TRUE \"runner online\" signal.\n     * Best-effort caller; throws on 401/non-ok so the daemon can log + retry.\n     */\n    async postHeartbeat({ runnerId, operatorId, uptimeSec, activeTasks, version, daemonVersion, servedRepos, servedOperators, availableAgents, accountUsage }) {\n      const body = { runner_id: runnerId };\n      if (operatorId) body.operator_id = operatorId;\n      if (typeof uptimeSec === 'number') body.uptime_sec = uptimeSec;\n      if (typeof activeTasks === 'number') body.active_tasks = activeTasks;\n      if (version) body.version = version;\n      if (daemonVersion) body.daemon_version = daemonVersion;\n      if (Array.isArray(servedRepos) && servedRepos.length > 0) body.served_repos = servedRepos;\n      if (Array.isArray(servedOperators) && servedOperators.length > 0) {\n        body.served_operator_ids = servedOperators;\n      }\n      if (Array.isArray(availableAgents) && availableAgents.length > 0) {\n        body.available_agents = availableAgents;\n      }\n      if (Array.isArray(accountUsage) && accountUsage.length > 0) {\n        body.account_usage = accountUsage;\n      }\n      const res = await req('POST', '/api/v1/runner/heartbeat', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('heartbeat unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`heartbeat failed: HTTP ${res.status}`);\n      return true;\n    },\n\n    /** Poll one authenticated runner's durable Mission Control action queue. */\n    async pollRunnerControl({ runnerId, operatorId }) {\n      const body = { runner_id: runnerId };\n      if (operatorId) body.operator_id = operatorId;\n      const res = await req('POST', '/api/v1/runner/control/poll', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('runner control poll unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`runner control poll failed: HTTP ${res.status}`);\n      const json = await res.json();\n      const action = json?.action;\n      return action && typeof action.action_id === 'string' && action.action_id\n        ? { ...action, actionId: action.action_id }\n        : null;\n    },\n\n    /** Acknowledge a maintenance action after the host has restarted the child. */\n    async completeRunnerControl(actionId, { runnerId, operatorId, status, detail }) {\n      const body = { runner_id: runnerId, status };\n      if (operatorId) body.operator_id = operatorId;\n      if (detail) body.detail = detail;\n      const res = await req('POST', `/api/v1/runner/control/${encodeURIComponent(actionId)}/complete`, body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('runner control completion unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`runner control completion failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json?.action || null;\n    },\n\n    /**\n     * Mint a short-lived (~1h), repo-scoped GitHub App installation token for\n     * THIS runner's operator (M3). The control-plane keys the mint on the\n     * authenticated operator (ctx.operator_id), so the token covers only that\n     * operator's installation.\n     *\n     * Returns { token, expiresAt } on success. In legacy/admin mode it returns\n     * null on a miss so the caller may use ambient `gh`. In scoped-operator mode\n     * callers pass `{ required: true }`, which fails closed instead of letting a\n     * missing/mis-scoped installation fall through to the runner machine's `gh`.\n     *\n     * The minted token is only usable for push + PR if the GitHub App grants\n     * BOTH `Contents: write` (git push) AND `Pull requests: write` (gh pr\n     * create) \u2014 see docs/vo/github-app-setup-2026-06-18.md. A token missing\n     * either scope fails at push (\u2192 ambient fallback) or at `gh pr create`.\n     */\n    async getInstallationToken({ required = false } = {}) {\n      const fail = (reason) => {\n        if (required) throw new Error(`installation-token required: ${reason}`);\n        return null;\n      };\n      try {\n        const res = await req('POST', '/api/v1/github/installation-token', {});\n        if (!res.ok) return fail(`HTTP ${res.status}`);\n        const json = await res.json();\n        if (!json || !json.token) return fail('missing token');\n        return { token: json.token, expiresAt: json.expires_at || null };\n      } catch (err) {\n        if (required) throw err;\n        return null;\n      }\n    },\n\n    /**\n     * Read the operator's dispatch-mode config (Fast\u2192Ultracode effort setting).\n     * Returns the mode string ('fast'|'standard'|'deep'|'ultra'|'ultracode'),\n     * defaulting to 'standard' on any error. Never throws \u2014 best-effort.\n     */\n    async getDispatchMode() {\n      try {\n        const res = await req('GET', '/api/v1/dispatch-mode-config');\n        if (!res.ok) return 'standard';\n        const json = await res.json();\n        return json?.dispatchMode || 'standard';\n      } catch {\n        return 'standard';\n      }\n    },\n  };\n}\n", "/** Allow-listed host maintenance operations used by the runner supervisor. */\nimport { spawnSync } from 'node:child_process';\n\nexport const DEFAULT_RUNNER_PACKAGE = '@algosuite/vo-mcp@beta';\nconst PACKAGE_SPEC_RE = /^@algosuite\\/vo-mcp@(beta|latest|\\d+(?:\\.\\d+){0,2}(?:-[\\w.-]+)?)$/u;\nconst MAX_DIAGNOSTIC_CHARS = 800;\n\nfunction escapeRegExp(value) {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/gu, '\\\\$&');\n}\n\n/** Keep action detail useful without ever returning credentials or tokens. */\nexport function sanitizeMaintenanceDiagnostic(raw, env = {}) {\n  let value = String(raw || '')\n    .replace(/\\b(?:vocred|npm|gh[oprsu])_[A-Za-z0-9._-]+\\b/gu, '[REDACTED]')\n    .replace(/\\bBearer\\s+\\S+/giu, 'Bearer [REDACTED]')\n    .replace(/\\b(_?authToken|token|password|secret|credential)(\\s*[=:]\\s*)\\S+/giu, '$1$2[REDACTED]');\n  for (const [name, secret] of Object.entries(env)) {\n    if (!/(?:TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL)/iu.test(name)) continue;\n    const text = String(secret || '');\n    if (text.length < 4) continue;\n    value = value.replace(new RegExp(escapeRegExp(text), 'gu'), '[REDACTED]');\n  }\n  value = value.replace(/\\s+/gu, ' ').trim();\n  if (value.length <= MAX_DIAGNOSTIC_CHARS) return value;\n  return `${value.slice(0, MAX_DIAGNOSTIC_CHARS - 1)}\u2026`;\n}\n\nexport function buildMaintenanceCommand(kind, { platform = process.platform, packageSpec = DEFAULT_RUNNER_PACKAGE } = {}) {\n  if (!['update', 'reinstall'].includes(kind)) return null;\n  if (!PACKAGE_SPEC_RE.test(packageSpec)) throw new Error('unsafe runner package spec');\n  const command = platform === 'win32' ? 'npm.cmd' : 'npm';\n  const args = ['install', '-g', packageSpec];\n  if (kind === 'reinstall') args.push('--force');\n  return { command, args };\n}\n\nexport function runHostMaintenance(kind, {\n  platform = process.platform,\n  packageSpec = DEFAULT_RUNNER_PACKAGE,\n  env = process.env,\n  spawn = spawnSync,\n  log = () => {},\n} = {}) {\n  if (kind === 'reconnect') return { ok: true, status: 0, command: null, args: [] };\n  const command = buildMaintenanceCommand(kind, { platform, packageSpec });\n  if (!command) return { ok: false, status: 2, command: null, args: [] };\n  log(`runner maintenance: ${command.command} ${command.args.join(' ')}`);\n  const result = spawn(command.command, command.args, {\n    stdio: ['ignore', 'pipe', 'pipe'],\n    encoding: 'utf8',\n    env,\n    shell: false,\n    windowsHide: true,\n  });\n  const status = typeof result.status === 'number' ? result.status : 1;\n  const detail = sanitizeMaintenanceDiagnostic(\n    [result.stderr, result.stdout, result.error?.message].filter(Boolean).join('\\n'),\n    env,\n  );\n  if (detail) log(`runner maintenance result: ${detail}`);\n  return { ok: status === 0, status, command: command.command, args: command.args, detail };\n}\n", "import { hostname as systemHostname } from 'node:os';\nimport { pairedOperatorScope, probeRunnerReadiness } from '../runner-readiness.mjs';\n\n/** Keep the supervisor's control-queue identity byte-identical to the daemon. */\nexport function resolveSupervisorRunnerId(env = {}, hostname = systemHostname) {\n  const explicit = String(env.VO_CODE_RUNNER_ID || '').trim();\n  return explicit || `vo-code-runner-${hostname()}`;\n}\n\n/** Build the daemon environment without mislabeling a paired credential as admin. */\nexport function buildSupervisorChildEnv({\n  baseEnv = {},\n  controlPlaneUrl,\n  explicitAdminToken = null,\n  pairedOperatorId = null,\n} = {}) {\n  const childEnv = {\n    ...baseEnv,\n    VO_CONTROL_PLANE_URL: controlPlaneUrl,\n  };\n  const adminToken = typeof explicitAdminToken === 'string' ? explicitAdminToken.trim() : '';\n  const operatorId = typeof pairedOperatorId === 'string' ? pairedOperatorId.trim() : '';\n\n  if (adminToken) childEnv.VO_CONTROL_PLANE_ADMIN_TOKEN = adminToken;\n  else delete childEnv.VO_CONTROL_PLANE_ADMIN_TOKEN;\n\n  if (operatorId) childEnv.VO_CODE_RUNNER_OPERATOR_IDS = operatorId;\n  return childEnv;\n}\n\n/** Resolve auth provenance once so the supervisor and child use the same scope. */\nexport async function prepareSupervisorAuth({\n  baseEnv = {},\n  storedCredential = null,\n  controlPlaneUrl,\n  probeReadiness = probeRunnerReadiness,\n} = {}) {\n  const explicitAdminToken = baseEnv.VO_CONTROL_PLANE_ADMIN_TOKEN?.trim();\n  const token = explicitAdminToken || storedCredential?.vo_credential;\n  if (!token) throw new Error('runner is not paired; run `vo-mcp pair` once on this host');\n\n  let operatorId = String(baseEnv.VO_CODE_RUNNER_OPERATOR_IDS || '')\n    .split(/[\\s,]+/u)\n    .filter(Boolean)[0] || undefined;\n  if (!explicitAdminToken) {\n    const readiness = await probeReadiness({ controlPlaneUrl, token, requireGithub: true });\n    if (!readiness.ok) throw new Error(`runner readiness failed: ${readiness.message}`);\n    operatorId = pairedOperatorScope(readiness) || undefined;\n    if (!operatorId) throw new Error('runner readiness failed: paired operator scope is missing');\n  }\n\n  const childEnv = buildSupervisorChildEnv({\n    baseEnv,\n    controlPlaneUrl,\n    explicitAdminToken,\n    pairedOperatorId: explicitAdminToken ? null : operatorId,\n  });\n  const clientEnv = {\n    ...baseEnv,\n    VO_CONTROL_PLANE_ADMIN_TOKEN: token,\n    VO_CONTROL_PLANE_URL: controlPlaneUrl,\n    ...(operatorId ? { VO_CODE_RUNNER_OPERATOR_IDS: operatorId } : {}),\n  };\n  return { childEnv, clientEnv, operatorId };\n}\n", "/**\n * Server-backed readiness probe for a paired BYO runner.\n *\n * The credential itself is opaque, so its mere presence is not proof that it is\n * usable or still bound to an operator. `/auth/me` supplies that truth from the\n * authenticated control-plane context. Before daemon startup, the optional\n * GitHub probe also proves the operator can mint an installation token, so a\n * task is never claimed only to fail at publication setup.\n */\n\nfunction failed({ paired = false, operatorId = null, tenantId = null, githubReady = null, error, message }) {\n  return { ok: false, paired, operatorId, tenantId, githubReady, error, message };\n}\n\nasync function responseBody(response) {\n  try {\n    const value = await response.json();\n    return value && typeof value === 'object' ? value : {};\n  } catch {\n    return {};\n  }\n}\n\nfunction serverMessage(body, fallback) {\n  return typeof body.message === 'string' && body.message.trim() ? body.message.trim() : fallback;\n}\n\nasync function fetchWithTimeout(fetchImpl, url, init, timeoutMs) {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), timeoutMs);\n  try {\n    return await fetchImpl(url, { ...init, signal: controller.signal });\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\n/**\n * @param {{\n *   controlPlaneUrl: string,\n *   token: string,\n *   fetchImpl?: typeof fetch,\n *   requireGithub?: boolean,\n *   timeoutMs?: number,\n * }} input\n */\nexport async function probeRunnerReadiness({\n  controlPlaneUrl,\n  token,\n  fetchImpl = fetch,\n  requireGithub = false,\n  timeoutMs = 10_000,\n}) {\n  const base = controlPlaneUrl.replace(/\\/+$/u, '');\n  const headers = { authorization: `Bearer ${token}` };\n  let identityResponse;\n  try {\n    identityResponse = await fetchWithTimeout(\n      fetchImpl,\n      `${base}/api/v1/auth/me`,\n      { headers },\n      timeoutMs,\n    );\n  } catch (error) {\n    const detail = error instanceof Error ? error.message : String(error);\n    return failed({\n      error: 'control_plane_unreachable',\n      message: `AlgoHQ could not be reached: ${detail}`,\n    });\n  }\n\n  const identity = await responseBody(identityResponse);\n  if (!identityResponse.ok) {\n    return failed({\n      error: 'credential_rejected',\n      message: 'The saved pairing is expired or revoked. Pair this computer again.',\n    });\n  }\n  if (\n    identity.provisioned !== true ||\n    identity.role !== 'operator' ||\n    typeof identity.operator_id !== 'string' ||\n    !identity.operator_id.trim() ||\n    typeof identity.tenant_id !== 'string' ||\n    !identity.tenant_id.trim()\n  ) {\n    return failed({\n      error: 'operator_identity_missing',\n      message: 'The pairing credential is valid but has no operator identity. Pair this computer again.',\n    });\n  }\n\n  const operatorId = identity.operator_id.trim();\n  const tenantId = identity.tenant_id.trim();\n  if (!requireGithub) {\n    return {\n      ok: true,\n      paired: true,\n      operatorId,\n      tenantId,\n      githubReady: null,\n      error: null,\n      message: 'Paired to AlgoHQ.',\n    };\n  }\n\n  let githubResponse;\n  try {\n    githubResponse = await fetchWithTimeout(\n      fetchImpl,\n      `${base}/api/v1/github/installation-token`,\n      {\n        method: 'POST',\n        headers: { ...headers, 'content-type': 'application/json' },\n        body: '{}',\n      },\n      timeoutMs,\n    );\n  } catch (error) {\n    const detail = error instanceof Error ? error.message : String(error);\n    return failed({\n      paired: true,\n      operatorId,\n      tenantId,\n      githubReady: false,\n      error: 'github_preflight_unreachable',\n      message: `GitHub publication readiness could not be checked: ${detail}`,\n    });\n  }\n\n  const github = await responseBody(githubResponse);\n  if (!githubResponse.ok || typeof github.token !== 'string' || !github.token) {\n    const error = typeof github.error === 'string' && github.error ? github.error : 'github_not_ready';\n    return failed({\n      paired: true,\n      operatorId,\n      tenantId,\n      githubReady: false,\n      error,\n      message: serverMessage(github, `GitHub publication preflight failed (HTTP ${githubResponse.status}).`),\n    });\n  }\n\n  return {\n    ok: true,\n    paired: true,\n    operatorId,\n    tenantId,\n    githubReady: true,\n    error: null,\n    message: 'Paired and ready to publish through the Algosuite GitHub App.',\n  };\n}\n\nexport function pairedOperatorScope(readiness) {\n  return readiness?.ok === true &&\n    readiness?.paired === true &&\n    typeof readiness.operatorId === 'string' &&\n    readiness.operatorId.trim()\n    ? readiness.operatorId.trim()\n    : null;\n}\n", "import { spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport function defaultCredentialHelperPath(metaUrl = import.meta.url) {\n  const moduleDir = dirname(fileURLToPath(metaUrl));\n  const bundled = join(moduleDir, 'supervisor-credential-helper.js');\n  const source = join(moduleDir, '..', 'supervisor-credential-helper.mjs');\n  return existsSync(source) ? source : bundled;\n}\n\n/** Read the OS-keychain credential without loading its native module here. */\nexport function readStoredCredentialIsolated({\n  spawn = spawnSync,\n  execPath = process.execPath,\n  helperPath = defaultCredentialHelperPath(),\n  env = process.env,\n} = {}) {\n  const result = spawn(execPath, [helperPath], {\n    env,\n    encoding: 'utf8',\n    stdio: ['ignore', 'pipe', 'pipe'],\n    shell: false,\n    windowsHide: true,\n    timeout: 10_000,\n  });\n  if (result.status !== 0) {\n    throw new Error('runner credential helper could not read the paired credential');\n  }\n  try {\n    const parsed = JSON.parse(String(result.stdout || ''));\n    return parsed && typeof parsed === 'object' ? parsed : null;\n  } catch {\n    throw new Error('runner credential helper returned an invalid credential');\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAeA,eAAsB,kBAAkB;AACtC,QAAM,IAAI;AAAA,IACR;AAAA,EAEF;AACF;AApBA;AAAA;AAAA;AAAA;;;ACKA,SAAS,aAAa;AACtB,SAAS,qBAAqB;AAC9B,SAAS,iBAAAA,sBAAqB;AAC9B,SAAS,WAAAC,UAAS,QAAAC,aAAY;;;ACS9B,IAAI,sBAAsB;AAE1B,eAAe,cAAc,KAAK;AAChC,QAAM,aAAa,IAAI;AACvB,MAAI,WAAY,QAAO;AACvB,MAAI,oBAAqB,QAAO;AAEhC,QAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM;AAClC,QAAM,OAAO,MAAMA,iBAAgB,EAAE,IAAI,CAAC;AAC1C,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAS;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,wBAAsB,KAAK;AAC3B,SAAO;AACT;AAMO,SAAS,yBAAyB;AAAA,EACvC,UAAU,QAAQ,IAAI,wBAAwB;AAAA,EAC9C,MAAM,QAAQ;AAAA,EACd,YAAY;AACd,IAAI,CAAC,GAAG;AACN,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,QAAM,OAAO,QAAQ,QAAQ,QAAQ,EAAE;AAEvC,iBAAe,IAAI,QAAQ,MAAM,MAAM;AACrC,UAAM,SAAS,MAAM,cAAc,GAAG;AACtC,WAAO,UAAU,GAAG,IAAI,GAAG,IAAI,IAAI;AAAA,MACjC;AAAA,MACA,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,UAAU,MAAM;AAAA,MACjC;AAAA,MACA,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,IAC5D,CAAC;AAAA,EACH;AAEA,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQL,MAAM,MAAMC,WAAU,OAAO,aAAa,UAAU,CAAC,GAAG;AACtD,YAAM,OAAO,EAAE,WAAWA,UAAS;AACnC,UAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,MAAK,QAAQ;AAC3D,UAAI,MAAM,QAAQ,WAAW,KAAK,YAAY,SAAS,EAAG,MAAK,eAAe;AAC9E,UAAI,QAAQ,iBAAkB,MAAK,qBAAqB,QAAQ;AAChE,UAAI,QAAQ,oBAAoB,QAAQ,eAAgB,MAAK,kBAAkB;AAC/E,YAAM,MAAM,MAAM,IAAI,QAAQ,2BAA2B,IAAI;AAC7D,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,0BAA0B;AAAA,MAC5C;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,sBAAsB,IAAI,MAAM,EAAE;AAC/D,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAAA,IACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,gBAAgB,EAAE,MAAM,QAAQ,gBAAgB,UAAU,GAAG;AACjE,YAAM,OAAO,EAAE,MAAM,OAAO;AAC5B,UAAI,OAAO,mBAAmB,SAAU,MAAK,iBAAiB;AAC9D,UAAI,OAAO,cAAc,SAAU,MAAK,YAAY;AACpD,YAAM,MAAM,MAAM,IAAI,QAAQ,qBAAqB,IAAI;AACvD,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,4BAA4B;AAAA,MAC9C;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,wBAAwB,IAAI,MAAM,EAAE;AACjE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAAA,IACzC;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,eAAe,QAAQ;AAC3B,YAAM,MAAM,MAAM,IAAI,QAAQ,qBAAqB,mBAAmB,MAAM,CAAC,WAAW,CAAC,CAAC;AAC1F,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,2BAA2B;AAAA,MAC7C;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,uBAAuB,IAAI,MAAM,EAAE;AAChE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAAA,IACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,gBAAgB,UAAU,mBAAmB;AACjD,YAAM,MAAM,MAAM,IAAI,QAAQ,0BAA0B,EAAE,UAAU,kBAAkB,CAAC;AACvF,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,gCAAgC;AAAA,MAClD;AACA,YAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAI,IAAI,MAAM,MAAM,OAAO,MAAM;AAC/B,cAAM,SAAS,MAAM,UAAU,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,CAAC;AAChF,cAAM,SAAS,OAAO,WAAW,QAAQ,OAAO,WAAW,WACvD,WACA,OAAO,WAAW,wBAAwB,OAAO,OAAO,UAAU,EAAE,EAAE,SAAS,YAAY,IACzF,WACA;AACN,eAAO;AAAA,UACL;AAAA,UACA,QAAQ,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AAAA,UAC5D,iBAAiB,OAAO,KAAK,sBAAsB,WAAW,KAAK,oBAAoB;AAAA,QACzF;AAAA,MACF;AACA,UAAI,IAAI,WAAW,OAAO,MAAM,UAAU,sBAAsB;AAC9D,eAAO,EAAE,QAAQ,SAAS,QAAQ,KAAK,UAAU,2BAA2B;AAAA,MAC9E;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ,MAAM,UAAU,MAAM,WAAW,MAAM,SAAS,QAAQ,IAAI,MAAM;AAAA,QAC1E,iBAAiB,OAAO,MAAM,sBAAsB,WAAW,KAAK,oBAAoB;AAAA,MAC1F;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,aAAa,QAAQ,OAAO;AAChC,YAAM,MAAM,MAAM,IAAI,SAAS,qBAAqB,MAAM,aAAa,KAAK;AAC5E,UAAI,IAAI,WAAW,IAAK,QAAO,EAAE,UAAU,KAAK;AAChD,UAAI,IAAI,WAAW,IAAK,QAAO,EAAE,UAAU,MAAM,SAAS,KAAK;AAC/D,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,yBAAyB,IAAI,MAAM,EAAE;AAClE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,EAAE,MAAM,QAAQ,KAAK,KAAK;AAAA,IACnC;AAAA;AAAA,IAGA,MAAM,QAAQ,QAAQ;AACpB,YAAM,MAAM,MAAM,IAAI,OAAO,qBAAqB,MAAM,EAAE;AAC1D,UAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,wBAAwB,IAAI,MAAM,EAAE;AACjE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,OAAO,KAAK,OAAO;AAAA,IAC5B;AAAA;AAAA,IAGA,MAAM,wBAAwB,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAG;AACpD,YAAM,OAAO,CAAC;AACd,UAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAG,MAAK,QAAQ;AAC5D,YAAM,MAAM,MAAM,IAAI,QAAQ,qBAAqB,mBAAmB,MAAM,CAAC,sBAAsB,IAAI;AACvG,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,sCAAsC;AAAA,MACxD;AACA,UAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,kCAAkC,IAAI,MAAM,EAAE;AAC3E,aAAO,IAAI,KAAK;AAAA,IAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYA,MAAM,iBAAiB,EAAE,YAAY,UAAAA,WAAU,QAAQ,iBAAiB,qBAAqB,GAAG;AAC9F,YAAM,OAAO;AAAA,QACX,aAAa;AAAA,QACb,WAAWA;AAAA,QACX,cAAc,OAAO;AAAA,QACrB,eAAe,OAAO;AAAA,QACtB,uBAAuB,OAAO;AAAA,QAC9B,mBAAmB,OAAO;AAAA,MAC5B;AACA,UAAI,OAAO,oBAAoB,UAAU;AACvC,aAAK,oBAAoB;AAAA,MAC3B;AACA,UAAI,yBAAyB,QAAW;AACtC,aAAK,0BAA0B;AAAA,MACjC;AACA,YAAM,MAAM,MAAM,IAAI,QAAQ,yBAAyB,IAAI;AAC3D,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,kCAAkC;AAAA,MACpD;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,8BAA8B,IAAI,MAAM,EAAE;AACvE,aAAO;AAAA,IACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,cAAc,EAAE,UAAAA,WAAU,YAAY,WAAW,aAAa,SAAS,eAAe,aAAa,iBAAiB,iBAAiB,aAAa,GAAG;AACzJ,YAAM,OAAO,EAAE,WAAWA,UAAS;AACnC,UAAI,WAAY,MAAK,cAAc;AACnC,UAAI,OAAO,cAAc,SAAU,MAAK,aAAa;AACrD,UAAI,OAAO,gBAAgB,SAAU,MAAK,eAAe;AACzD,UAAI,QAAS,MAAK,UAAU;AAC5B,UAAI,cAAe,MAAK,iBAAiB;AACzC,UAAI,MAAM,QAAQ,WAAW,KAAK,YAAY,SAAS,EAAG,MAAK,eAAe;AAC9E,UAAI,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,GAAG;AAChE,aAAK,sBAAsB;AAAA,MAC7B;AACA,UAAI,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,GAAG;AAChE,aAAK,mBAAmB;AAAA,MAC1B;AACA,UAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,GAAG;AAC1D,aAAK,gBAAgB;AAAA,MACvB;AACA,YAAM,MAAM,MAAM,IAAI,QAAQ,4BAA4B,IAAI;AAC9D,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,8BAA8B;AAAA,MAChD;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0BAA0B,IAAI,MAAM,EAAE;AACnE,aAAO;AAAA,IACT;AAAA;AAAA,IAGA,MAAM,kBAAkB,EAAE,UAAAA,WAAU,WAAW,GAAG;AAChD,YAAM,OAAO,EAAE,WAAWA,UAAS;AACnC,UAAI,WAAY,MAAK,cAAc;AACnC,YAAM,MAAM,MAAM,IAAI,QAAQ,+BAA+B,IAAI;AACjE,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,wCAAwC;AAAA,MAC1D;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,oCAAoC,IAAI,MAAM,EAAE;AAC7E,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,SAAS,MAAM;AACrB,aAAO,UAAU,OAAO,OAAO,cAAc,YAAY,OAAO,YAC5D,EAAE,GAAG,QAAQ,UAAU,OAAO,UAAU,IACxC;AAAA,IACN;AAAA;AAAA,IAGA,MAAM,sBAAsB,UAAU,EAAE,UAAAA,WAAU,YAAY,QAAQ,OAAO,GAAG;AAC9E,YAAM,OAAO,EAAE,WAAWA,WAAU,OAAO;AAC3C,UAAI,WAAY,MAAK,cAAc;AACnC,UAAI,OAAQ,MAAK,SAAS;AAC1B,YAAM,MAAM,MAAM,IAAI,QAAQ,0BAA0B,mBAAmB,QAAQ,CAAC,aAAa,IAAI;AACrG,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0CAA0C,IAAI,MAAM,EAAE;AACnF,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,MAAM,UAAU;AAAA,IACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAkBA,MAAM,qBAAqB,EAAE,WAAW,MAAM,IAAI,CAAC,GAAG;AACpD,YAAM,OAAO,CAAC,WAAW;AACvB,YAAI,SAAU,OAAM,IAAI,MAAM,gCAAgC,MAAM,EAAE;AACtE,eAAO;AAAA,MACT;AACA,UAAI;AACF,cAAM,MAAM,MAAM,IAAI,QAAQ,qCAAqC,CAAC,CAAC;AACrE,YAAI,CAAC,IAAI,GAAI,QAAO,KAAK,QAAQ,IAAI,MAAM,EAAE;AAC7C,cAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAI,CAAC,QAAQ,CAAC,KAAK,MAAO,QAAO,KAAK,eAAe;AACrD,eAAO,EAAE,OAAO,KAAK,OAAO,WAAW,KAAK,cAAc,KAAK;AAAA,MACjE,SAAS,KAAK;AACZ,YAAI,SAAU,OAAM;AACpB,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,kBAAkB;AACtB,UAAI;AACF,cAAM,MAAM,MAAM,IAAI,OAAO,8BAA8B;AAC3D,YAAI,CAAC,IAAI,GAAI,QAAO;AACpB,cAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,eAAO,MAAM,gBAAgB;AAAA,MAC/B,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;AChVA,SAAS,iBAAiB;AAEnB,IAAM,yBAAyB;AACtC,IAAM,kBAAkB;AACxB,IAAM,uBAAuB;AAE7B,SAAS,aAAa,OAAO;AAC3B,SAAO,MAAM,QAAQ,wBAAwB,MAAM;AACrD;AAGO,SAAS,8BAA8B,KAAK,MAAM,CAAC,GAAG;AAC3D,MAAI,QAAQ,OAAO,OAAO,EAAE,EACzB,QAAQ,kDAAkD,YAAY,EACtE,QAAQ,qBAAqB,mBAAmB,EAChD,QAAQ,sEAAsE,gBAAgB;AACjG,aAAW,CAAC,MAAM,MAAM,KAAK,OAAO,QAAQ,GAAG,GAAG;AAChD,QAAI,CAAC,6CAA6C,KAAK,IAAI,EAAG;AAC9D,UAAM,OAAO,OAAO,UAAU,EAAE;AAChC,QAAI,KAAK,SAAS,EAAG;AACrB,YAAQ,MAAM,QAAQ,IAAI,OAAO,aAAa,IAAI,GAAG,IAAI,GAAG,YAAY;AAAA,EAC1E;AACA,UAAQ,MAAM,QAAQ,SAAS,GAAG,EAAE,KAAK;AACzC,MAAI,MAAM,UAAU,qBAAsB,QAAO;AACjD,SAAO,GAAG,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC;AACpD;AAEO,SAAS,wBAAwB,MAAM,EAAE,WAAW,QAAQ,UAAU,cAAc,uBAAuB,IAAI,CAAC,GAAG;AACxH,MAAI,CAAC,CAAC,UAAU,WAAW,EAAE,SAAS,IAAI,EAAG,QAAO;AACpD,MAAI,CAAC,gBAAgB,KAAK,WAAW,EAAG,OAAM,IAAI,MAAM,4BAA4B;AACpF,QAAM,UAAU,aAAa,UAAU,YAAY;AACnD,QAAM,OAAO,CAAC,WAAW,MAAM,WAAW;AAC1C,MAAI,SAAS,YAAa,MAAK,KAAK,SAAS;AAC7C,SAAO,EAAE,SAAS,KAAK;AACzB;AAEO,SAAS,mBAAmB,MAAM;AAAA,EACvC,WAAW,QAAQ;AAAA,EACnB,cAAc;AAAA,EACd,MAAM,QAAQ;AAAA,EACd,OAAAC,SAAQ;AAAA,EACR,MAAM,MAAM;AAAA,EAAC;AACf,IAAI,CAAC,GAAG;AACN,MAAI,SAAS,YAAa,QAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,SAAS,MAAM,MAAM,CAAC,EAAE;AAChF,QAAM,UAAU,wBAAwB,MAAM,EAAE,UAAU,YAAY,CAAC;AACvE,MAAI,CAAC,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,SAAS,MAAM,MAAM,CAAC,EAAE;AACrE,MAAI,uBAAuB,QAAQ,OAAO,IAAI,QAAQ,KAAK,KAAK,GAAG,CAAC,EAAE;AACtE,QAAM,SAASA,OAAM,QAAQ,SAAS,QAAQ,MAAM;AAAA,IAClD,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,UAAU;AAAA,IACV;AAAA,IACA,OAAO;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACD,QAAM,SAAS,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AACnE,QAAM,SAAS;AAAA,IACb,CAAC,OAAO,QAAQ,OAAO,QAAQ,OAAO,OAAO,OAAO,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAAA,IAC/E;AAAA,EACF;AACA,MAAI,OAAQ,KAAI,8BAA8B,MAAM,EAAE;AACtD,SAAO,EAAE,IAAI,WAAW,GAAG,QAAQ,SAAS,QAAQ,SAAS,MAAM,QAAQ,MAAM,OAAO;AAC1F;;;AC9DA,SAAS,YAAY,sBAAsB;;;ACU3C,SAAS,OAAO,EAAE,SAAS,OAAO,aAAa,MAAM,WAAW,MAAM,cAAc,MAAM,OAAO,QAAQ,GAAG;AAC1G,SAAO,EAAE,IAAI,OAAO,QAAQ,YAAY,UAAU,aAAa,OAAO,QAAQ;AAChF;AAEA,eAAe,aAAa,UAAU;AACpC,MAAI;AACF,UAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,WAAO,SAAS,OAAO,UAAU,WAAW,QAAQ,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,cAAc,MAAM,UAAU;AACrC,SAAO,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,KAAK,IAAI,KAAK,QAAQ,KAAK,IAAI;AACzF;AAEA,eAAe,iBAAiB,WAAW,KAAK,MAAM,WAAW;AAC/D,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAC5D,MAAI;AACF,WAAO,MAAM,UAAU,KAAK,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,CAAC;AAAA,EACpE,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAWA,eAAsB,qBAAqB;AAAA,EACzC;AAAA,EACA;AAAA,EACA,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,YAAY;AACd,GAAG;AACD,QAAM,OAAO,gBAAgB,QAAQ,SAAS,EAAE;AAChD,QAAM,UAAU,EAAE,eAAe,UAAU,KAAK,GAAG;AACnD,MAAI;AACJ,MAAI;AACF,uBAAmB,MAAM;AAAA,MACvB;AAAA,MACA,GAAG,IAAI;AAAA,MACP,EAAE,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS,gCAAgC,MAAM;AAAA,IACjD,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,MAAM,aAAa,gBAAgB;AACpD,MAAI,CAAC,iBAAiB,IAAI;AACxB,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,SAAS,gBAAgB,QACzB,SAAS,SAAS,cAClB,OAAO,SAAS,gBAAgB,YAChC,CAAC,SAAS,YAAY,KAAK,KAC3B,OAAO,SAAS,cAAc,YAC9B,CAAC,SAAS,UAAU,KAAK,GACzB;AACA,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,SAAS,YAAY,KAAK;AAC7C,QAAM,WAAW,SAAS,UAAU,KAAK;AACzC,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,OAAO;AAAA,MACP,SAAS;AAAA,IACX;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,qBAAiB,MAAM;AAAA,MACrB;AAAA,MACA,GAAG,IAAI;AAAA,MACP;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,SAAS,gBAAgB,mBAAmB;AAAA,QAC1D,MAAM;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,WAAO,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,OAAO;AAAA,MACP,SAAS,sDAAsD,MAAM;AAAA,IACvE,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,MAAM,aAAa,cAAc;AAChD,MAAI,CAAC,eAAe,MAAM,OAAO,OAAO,UAAU,YAAY,CAAC,OAAO,OAAO;AAC3E,UAAM,QAAQ,OAAO,OAAO,UAAU,YAAY,OAAO,QAAQ,OAAO,QAAQ;AAChF,WAAO,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb;AAAA,MACA,SAAS,cAAc,QAAQ,6CAA6C,eAAe,MAAM,IAAI;AAAA,IACvG,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,EACX;AACF;AAEO,SAAS,oBAAoB,WAAW;AAC7C,SAAO,WAAW,OAAO,QACvB,WAAW,WAAW,QACtB,OAAO,UAAU,eAAe,YAChC,UAAU,WAAW,KAAK,IACxB,UAAU,WAAW,KAAK,IAC1B;AACN;;;AD7JO,SAAS,0BAA0B,MAAM,CAAC,GAAG,WAAW,gBAAgB;AAC7E,QAAM,WAAW,OAAO,IAAI,qBAAqB,EAAE,EAAE,KAAK;AAC1D,SAAO,YAAY,kBAAkB,SAAS,CAAC;AACjD;AAGO,SAAS,wBAAwB;AAAA,EACtC,UAAU,CAAC;AAAA,EACX;AAAA,EACA,qBAAqB;AAAA,EACrB,mBAAmB;AACrB,IAAI,CAAC,GAAG;AACN,QAAM,WAAW;AAAA,IACf,GAAG;AAAA,IACH,sBAAsB;AAAA,EACxB;AACA,QAAM,aAAa,OAAO,uBAAuB,WAAW,mBAAmB,KAAK,IAAI;AACxF,QAAM,aAAa,OAAO,qBAAqB,WAAW,iBAAiB,KAAK,IAAI;AAEpF,MAAI,WAAY,UAAS,+BAA+B;AAAA,MACnD,QAAO,SAAS;AAErB,MAAI,WAAY,UAAS,8BAA8B;AACvD,SAAO;AACT;AAGA,eAAsB,sBAAsB;AAAA,EAC1C,UAAU,CAAC;AAAA,EACX,mBAAmB;AAAA,EACnB;AAAA,EACA,iBAAiB;AACnB,IAAI,CAAC,GAAG;AACN,QAAM,qBAAqB,QAAQ,8BAA8B,KAAK;AACtE,QAAM,QAAQ,sBAAsB,kBAAkB;AACtD,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,2DAA2D;AAEvF,MAAI,aAAa,OAAO,QAAQ,+BAA+B,EAAE,EAC9D,MAAM,SAAS,EACf,OAAO,OAAO,EAAE,CAAC,KAAK;AACzB,MAAI,CAAC,oBAAoB;AACvB,UAAM,YAAY,MAAM,eAAe,EAAE,iBAAiB,OAAO,eAAe,KAAK,CAAC;AACtF,QAAI,CAAC,UAAU,GAAI,OAAM,IAAI,MAAM,4BAA4B,UAAU,OAAO,EAAE;AAClF,iBAAa,oBAAoB,SAAS,KAAK;AAC/C,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,2DAA2D;AAAA,EAC9F;AAEA,QAAM,WAAW,wBAAwB;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,qBAAqB,OAAO;AAAA,EAChD,CAAC;AACD,QAAM,YAAY;AAAA,IAChB,GAAG;AAAA,IACH,8BAA8B;AAAA,IAC9B,sBAAsB;AAAA,IACtB,GAAI,aAAa,EAAE,6BAA6B,WAAW,IAAI,CAAC;AAAA,EAClE;AACA,SAAO,EAAE,UAAU,WAAW,WAAW;AAC3C;;;AEhEA,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,kBAAkB;AAC3B,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAEvB,SAAS,4BAA4B,UAAU,YAAY,KAAK;AACrE,QAAM,YAAY,QAAQ,cAAc,OAAO,CAAC;AAChD,QAAM,UAAU,KAAK,WAAW,iCAAiC;AACjE,QAAM,SAAS,KAAK,WAAW,MAAM,kCAAkC;AACvE,SAAO,WAAW,MAAM,IAAI,SAAS;AACvC;AAGO,SAAS,6BAA6B;AAAA,EAC3C,OAAAC,SAAQD;AAAA,EACR,WAAW,QAAQ;AAAA,EACnB,aAAa,4BAA4B;AAAA,EACzC,MAAM,QAAQ;AAChB,IAAI,CAAC,GAAG;AACN,QAAM,SAASC,OAAM,UAAU,CAAC,UAAU,GAAG;AAAA,IAC3C;AAAA,IACA,UAAU;AAAA,IACV,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,EACX,CAAC;AACD,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO,OAAO,UAAU,EAAE,CAAC;AACrD,WAAO,UAAU,OAAO,WAAW,WAAW,SAAS;AAAA,EACzD,QAAQ;AACN,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACF;;;ALtBA,IAAM,4BAA4B;AAClC,IAAM,UAAU;AAChB,IAAM,iBAAiB;AACvB,IAAM,aAAaC,MAAKC,SAAQC,eAAc,YAAY,GAAG,CAAC,GAAG,eAAe;AAChF,IAAM,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAEtE,IAAM,WAAW,0BAA0B,QAAQ,GAAG;AAEtD,SAAS,iBAAiB;AACxB,MAAI;AAAE,WAAO,cAAc,YAAY,GAAG,EAAE,iBAAiB,EAAE,WAAW;AAAA,EAAW,QAAQ;AAAE,WAAO;AAAA,EAAW;AACnH;AAEA,SAAS,WAAW,UAAU;AAC5B,SAAO,MAAM,QAAQ,UAAU,CAAC,UAAU,GAAG;AAAA,IAC3C,KAAK;AAAA,IACL,OAAO;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACH;AAEA,eAAe,cAAc;AAC3B,MAAI;AACF,UAAM,OAAO,OAAO,QAAQ,IAAI,+BAA+B,IAAI;AACnE,UAAM,WAAW,MAAM,MAAM,oBAAoB,IAAI,WAAW,EAAE,QAAQ,YAAY,QAAQ,GAAG,EAAE,CAAC;AACpG,QAAI,CAAC,SAAS,GAAI,QAAO;AACzB,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,WAAO,MAAM,OAAO,OAAO,OAAO;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,mBAAmB,OAAO;AACvC,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,QAAI,MAAM,aAAa,KAAM,QAAO;AACpC,SAAK,MAAM,YAAY,IAAI,YAAY,KAAM,QAAO;AACpD,UAAM,MAAM,GAAG;AAAA,EACjB;AACA,SAAO;AACT;AAEA,eAAe,UAAU,OAAO;AAC9B,MAAI,CAAC,SAAS,MAAM,aAAa,KAAM;AACvC,QAAM,KAAK,QAAQ,aAAa,UAAU,SAAY,SAAS;AAC/D,QAAM,QAAQ,KAAK;AAAA,IACjB,IAAI,QAAQ,CAAC,YAAY,MAAM,KAAK,QAAQ,OAAO,CAAC;AAAA,IACpD,MAAM,IAAM;AAAA,EACd,CAAC;AACD,MAAI,MAAM,aAAa,KAAM,OAAM,KAAK,SAAS;AACnD;AAEA,eAAe,OAAO;AAIpB,QAAM,SAAS,6BAA6B;AAC5C,QAAM,kBAAkB,QAAQ,IAAI,wBAAwB;AAC5D,QAAM,EAAE,UAAU,WAAW,WAAW,IAAI,MAAM,sBAAsB;AAAA,IACtE,SAAS,QAAQ;AAAA,IACjB,kBAAkB;AAAA,IAClB;AAAA,EACF,CAAC;AACD,QAAM,SAAS,yBAAyB,EAAE,SAAS,iBAAiB,KAAK,UAAU,CAAC;AACpF,MAAI,QAAQ,WAAW,QAAQ;AAC/B,MAAI,WAAW;AACf,MAAI,WAAW;AAEf,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,YAAY,CAAC,aAAa,CAAC,SAAS,MAAM,aAAa,MAAO,SAAQ,WAAW,QAAQ;AAAA,EAChG;AACA,QAAM,GAAG,QAAQ,MAAM,WAAW,SAAS,GAAI,CAAC;AAEhD,QAAM,WAAW,YAAY;AAC3B,QAAI,SAAU;AACd,eAAW;AACX,UAAM,UAAU,KAAK;AAAA,EACvB;AACA,UAAQ,GAAG,UAAU,MAAM;AAAE,SAAK,SAAS,EAAE,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,EAAG,CAAC;AAC9E,UAAQ,GAAG,WAAW,MAAM;AAAE,SAAK,SAAS,EAAE,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,EAAG,CAAC;AAE/E,SAAO,CAAC,UAAU;AAChB,QAAI;AACF,YAAM,SAAS,MAAM,OAAO,kBAAkB,EAAE,UAAU,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC,EAAG,CAAC;AACjG,UAAI,CAAC,QAAQ;AACX,cAAM,MAAM,OAAO;AACnB;AAAA,MACF;AACA,iBAAW;AACX,YAAM,aAAa,MAAM,YAAY;AACrC,UAAI,cAAc,OAAO,WAAW,eAAe,CAAC,IAAI,GAAG;AACzD,cAAM,OAAO,sBAAsB,OAAO,UAAU;AAAA,UAClD;AAAA,UACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,UACnC,QAAQ;AAAA,UACR,QAAQ,oBAAoB,WAAW,WAAW;AAAA,QACpD,CAAC;AACD,mBAAW;AACX;AAAA,MACF;AACA,YAAM,UAAU,KAAK;AACrB,YAAM,SAAS,mBAAmB,OAAO,MAAM;AAAA,QAC7C,KAAK;AAAA,QACL,KAAK,CAAC,YAAY,QAAQ,KAAK,0BAA0B,OAAO,EAAE;AAAA,MACpE,CAAC;AACD,cAAQ,WAAW,QAAQ;AAC3B,YAAM,MAAM,cAAc;AAC1B,UAAI,MAAM,aAAa,QAAQ,CAAE,MAAM,mBAAmB,KAAK,EAAI,QAAO,KAAK;AAC/E,YAAM,OAAO,sBAAsB,OAAO,UAAU;AAAA,QAClD;AAAA,QACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,QACnC,QAAQ,OAAO,KAAK,cAAc;AAAA,QAClC,QAAQ,OAAO,KACX,UAAU,eAAe,CAAC,iBAC1B,sBAAsB,OAAO,MAAM,GAAG,OAAO,SAAS,KAAK,OAAO,MAAM,KAAK,EAAE;AAAA,MACrF,CAAC;AACD,iBAAW;AAAA,IACb,SAAS,OAAO;AACd,cAAQ,MAAM,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAChG,iBAAW;AACX,YAAM,MAAM,OAAO;AAAA,IACrB;AAAA,EACF;AACF;AAEA,KAAK,EAAE,MAAM,CAAC,UAAU;AACtB,UAAQ,MAAM,iCAAiC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AACvG,UAAQ,WAAW;AACrB,CAAC;",
-  "names": ["fileURLToPath", "dirname", "join", "getFirebaseAuth", "runnerId", "spawn", "spawnSync", "spawn", "join", "dirname", "fileURLToPath"]
+  "sourcesContent": ["/**\n * Control-plane auth stub for the bundled `vo-mcp runner`.\n *\n * Replaces the daemon's lazy Firebase/SMOKE_* fallback\n * (`scripts/virtual-office/orchestrator-firestore/auth.mjs`), which pulls\n * `vo-config.mjs` (hardcoded Nexus Firebase project) + the firebase-admin chain.\n * A BYO runner ALWAYS authenticates with its own scoped `vo_credential` \u2014 read\n * from the OS keychain by `runner-cli.mjs` and injected as\n * `VO_CONTROL_PLANE_ADMIN_TOKEN` \u2014 so `control-plane-client.mjs`'s `resolveBearer`\n * returns early on the token and NEVER reaches this fallback. It exists only so\n * the bundle has nothing to resolve into the firebase chain; if it ever runs,\n * it fails LOUDLY with the fix.\n *\n * esbuild swaps this in for the heavy original at bundle time (see scripts/bundle.mjs).\n */\nexport async function getFirebaseAuth() {\n  throw new Error(\n    'vo-mcp runner: no control-plane credential. Run `vo-mcp login` first \u2014 the runner ' +\n      'authenticates with your stored vo_credential (or set VO_CONTROL_PLANE_ADMIN_TOKEN).',\n  );\n}\n", "/**\n * Persistent host supervisor for remote Mission Control maintenance.\n * The task daemon is a replaceable child; this process stays alive while it is\n * updated or repaired. Pairing credentials remain in the existing OS store.\n */\nimport { spawn } from 'node:child_process';\nimport { createRequire } from 'node:module';\nimport { fileURLToPath } from 'node:url';\nimport { dirname, join } from 'node:path';\nimport { createControlPlaneClient } from '../../../scripts/virtual-office/code-runner/control-plane-client.mjs';\nimport { runHostMaintenance } from '../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs';\nimport { prepareSupervisorAuth, resolveSupervisorRunnerId } from './runner/supervisor-child-env.mjs';\nimport { readStoredCredentialIsolated } from './runner/supervisor-credential-reader.mjs';\n\nconst DEFAULT_CONTROL_PLANE_URL = 'https://vo-control-plane-bzjphrajaq-uc.a.run.app';\nconst POLL_MS = 5000;\nconst CHILD_START_MS = 1500;\nconst childEntry = join(dirname(fileURLToPath(import.meta.url)), 'runner-cli.js');\nconst sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));\n\nconst runnerId = resolveSupervisorRunnerId(process.env);\n\nfunction packageVersion() {\n  try { return createRequire(import.meta.url)('../package.json').version || 'unknown'; } catch { return 'unknown'; }\n}\n\nfunction spawnChild(childEnv) {\n  return spawn(process.execPath, [childEntry], {\n    env: childEnv,\n    stdio: 'inherit',\n    windowsHide: true,\n  });\n}\n\nasync function localStatus() {\n  try {\n    const port = Number(process.env.VO_CODE_RUNNER_CONTROL_PORT || 7787);\n    const response = await fetch(`http://127.0.0.1:${port}/status`, { signal: AbortSignal.timeout(800) });\n    if (!response.ok) return null;\n    const body = await response.json();\n    return body?.ok === true ? body : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function waitForLocalRunner(child) {\n  const deadline = Date.now() + 15_000;\n  while (Date.now() < deadline) {\n    if (child.exitCode !== null) return false;\n    if ((await localStatus())?.running === true) return true;\n    await sleep(500);\n  }\n  return false;\n}\n\nasync function stopChild(child) {\n  if (!child || child.exitCode !== null) return;\n  child.kill(process.platform === 'win32' ? undefined : 'SIGTERM');\n  await Promise.race([\n    new Promise((resolve) => child.once('exit', resolve)),\n    sleep(15_000),\n  ]);\n  if (child.exitCode === null) child.kill('SIGKILL');\n}\n\nasync function main() {\n  // Read keychain-backed credentials in a process that exits before npm ever\n  // attempts to replace this package. Windows otherwise keeps the keyring DLL\n  // locked for the full supervisor lifetime and global self-updates fail.\n  const stored = readStoredCredentialIsolated();\n  const controlPlaneUrl = process.env.VO_CONTROL_PLANE_URL || DEFAULT_CONTROL_PLANE_URL;\n  const { childEnv, clientEnv, operatorId } = await prepareSupervisorAuth({\n    baseEnv: process.env,\n    storedCredential: stored,\n    controlPlaneUrl,\n  });\n  const client = createControlPlaneClient({ baseUrl: controlPlaneUrl, env: clientEnv });\n  let child = spawnChild(childEnv);\n  let stopping = false;\n  let handling = false;\n\n  const respawn = () => {\n    if (!stopping && !handling && (!child || child.exitCode !== null)) child = spawnChild(childEnv);\n  };\n  child.on('exit', () => setTimeout(respawn, 2000));\n\n  const shutdown = async () => {\n    if (stopping) return;\n    stopping = true;\n    await stopChild(child);\n  };\n  process.on('SIGINT', () => { void shutdown().finally(() => process.exit(0)); });\n  process.on('SIGTERM', () => { void shutdown().finally(() => process.exit(0)); });\n\n  while (!stopping) {\n    try {\n      const action = await client.pollRunnerControl({ runnerId, ...(operatorId ? { operatorId } : {}) });\n      if (!action) {\n        await sleep(POLL_MS);\n        continue;\n      }\n      handling = true;\n      const beforeStop = await localStatus();\n      if (beforeStop && Number(beforeStop.activeTasks || 0) > 0) {\n        await client.completeRunnerControl(action.actionId, {\n          runnerId,\n          ...(operatorId ? { operatorId } : {}),\n          status: 'failed',\n          detail: `deferred safely: ${beforeStop.activeTasks} active task(s); retry when the runner is idle`,\n        });\n        handling = false;\n        continue;\n      }\n      await stopChild(child);\n      const result = runHostMaintenance(action.kind, {\n        env: clientEnv,\n        log: (message) => console.warn(`[vo-runner supervisor] ${message}`),\n      });\n      child = spawnChild(childEnv);\n      await sleep(CHILD_START_MS);\n      if (child.exitCode !== null || !(await waitForLocalRunner(child))) result.ok = false;\n      await client.completeRunnerControl(action.actionId, {\n        runnerId,\n        ...(operatorId ? { operatorId } : {}),\n        status: result.ok ? 'succeeded' : 'failed',\n        detail: result.ok\n          ? `runner ${packageVersion()} reconnected`\n          : `maintenance exited ${result.status}${result.detail ? `: ${result.detail}` : ''}`,\n      });\n      handling = false;\n    } catch (error) {\n      console.error(`[vo-runner supervisor] ${error instanceof Error ? error.message : String(error)}`);\n      handling = false;\n      await sleep(POLL_MS);\n    }\n  }\n}\n\nmain().catch((error) => {\n  console.error(`[vo-runner supervisor] fatal: ${error instanceof Error ? error.message : String(error)}`);\n  process.exitCode = 1;\n});\n", "/**\n * control-plane-client \u2014 the runner's OUTBOUND link to vo-control-plane.\n *\n * Increment 6 (Code-from-Anywhere). The daemon never exposes a port; it reaches\n * OUT to the control-plane (no inbound hole, no Tailscale \u2014 design \u00A72). Auth:\n * prefer the static admin token (`VO_CONTROL_PLANE_ADMIN_TOKEN`, the V1 local\n * dogfood path); fall back to a per-user Firebase ID token via the shared\n * orchestrator auth (`SMOKE_*` creds \u2192 allow-listed operator \u2192 admin).\n *\n * Endpoints used:\n *   POST  /api/v1/code-task/claim          \u2192 claim the next pending task\n *   PATCH /api/v1/code-task/:id/progress   \u2192 stream progress / set terminal\n *   GET   /api/v1/code-task/:id            \u2192 poll status (cancel detection)\n *   POST  /api/v1/code-task/:id/resume     \u2192 continue a partial/max-turn task\n *   POST  /api/v1/admin/pr/merge            \u2192 CI-green exact-SHA consensus merge\n */\n\nlet cachedFirebaseToken = null;\n\nasync function resolveBearer(env) {\n  const adminToken = env.VO_CONTROL_PLANE_ADMIN_TOKEN;\n  if (adminToken) return adminToken;\n  if (cachedFirebaseToken) return cachedFirebaseToken;\n  // Lazy import \u2014 Firebase auth is only needed when no admin token is present.\n  const { getFirebaseAuth } = await import('../orchestrator-firestore/auth.mjs');\n  const auth = await getFirebaseAuth({ env });\n  if (!auth || !auth.idToken) {\n    throw new Error(\n      'no control-plane credential: set VO_CONTROL_PLANE_ADMIN_TOKEN, or SMOKE_EMAIL/SMOKE_PASSWORD/SMOKE_API_KEY',\n    );\n  }\n  cachedFirebaseToken = auth.idToken;\n  return cachedFirebaseToken;\n}\n\n/**\n * Build a client. `baseUrl` defaults to `VO_CONTROL_PLANE_URL`. `fetchImpl`\n * and `env` are injectable for tests.\n */\nexport function createControlPlaneClient({\n  baseUrl = process.env.VO_CONTROL_PLANE_URL || '',\n  env = process.env,\n  fetchImpl = fetch,\n} = {}) {\n  if (!baseUrl) {\n    throw new Error('VO_CONTROL_PLANE_URL is required for the code-runner daemon');\n  }\n  const root = baseUrl.replace(/\\/+$/, '');\n\n  async function req(method, path, body) {\n    const bearer = await resolveBearer(env);\n    return fetchImpl(`${root}${path}`, {\n      method,\n      headers: {\n        'content-type': 'application/json',\n        authorization: `Bearer ${bearer}`,\n      },\n      body: body === undefined ? undefined : JSON.stringify(body),\n    });\n  }\n\n  return {\n    /**\n     * Claim the next pending task. Returns the task or null (empty queue).\n     * `repos` (optional `owner/name` list) and `operatorIds` (optional\n     * `operator_id` list) scope the claim so this daemon only picks up tasks it\n     * serves \u2014 the control-plane filters by both (logical AND), so another\n     * operator's task never lands on (or bills) this machine.\n     */\n    async claim(runnerId, repos, operatorIds, session = {}) {\n      const body = { runner_id: runnerId };\n      if (Array.isArray(repos) && repos.length > 0) body.repos = repos;\n      if (Array.isArray(operatorIds) && operatorIds.length > 0) body.operator_ids = operatorIds;\n      if (session.runnerInstanceId) body.runner_instance_id = session.runnerInstanceId;\n      if (session.runnerInstanceId && session.reconcileStale) body.reconcile_stale = true;\n      const res = await req('POST', '/api/v1/code-task/claim', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null; // force re-auth next call\n        throw new Error('claim unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`claim failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json && json.task ? json.task : null;\n    },\n\n    /**\n     * Enqueue a new code-task (used by the PR watcher to auto-dispatch a CI fix).\n     * Server derives operator/tenant from the daemon's authenticated principal.\n     * Returns the created task, or throws on a non-2xx response.\n     */\n    async enqueueCodeTask({ repo, prompt, max_budget_usd, max_turns }) {\n      const body = { repo, prompt };\n      if (typeof max_budget_usd === 'number') body.max_budget_usd = max_budget_usd;\n      if (typeof max_turns === 'number') body.max_turns = max_turns;\n      const res = await req('POST', '/api/v1/code-task', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('enqueue unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`enqueue failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json && json.task ? json.task : null;\n    },\n\n    /**\n     * Resume a failed/cancelled/max-turn partial code-task. The PR watcher uses\n     * this after the runner opens a partial draft PR and CI is no longer pending.\n     */\n    async resumeCodeTask(taskId) {\n      const res = await req('POST', `/api/v1/code-task/${encodeURIComponent(taskId)}/resume`, {});\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('resume unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`resume failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json && json.task ? json.task : null;\n    },\n\n    /**\n     * Send a CI-green PR through the production verify-before-act merge route.\n     * The server inspects the current diff, applies deterministic blockers, runs\n     * consensus, records a receipt, and direct-merges only the inspected SHA.\n     */\n    async mergeVerifiedPr(prNumber, automationContext) {\n      const res = await req('POST', '/api/v1/admin/pr/merge', { prNumber, automationContext });\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('gated merge unauthorized (401)');\n      }\n      const json = await res.json().catch(() => ({}));\n      if (res.ok && json?.ok === true) {\n        const result = json?.result && typeof json.result === 'object' ? json.result : {};\n        const status = result.merged === true || result.status === 'merged'\n          ? 'merged'\n          : result.status === 'auto-merge-enabled' || String(result.action || '').includes('auto-merge')\n            ? 'queued'\n            : 'accepted';\n        return {\n          status,\n          detail: typeof result.detail === 'string' ? result.detail : null,\n          actionReceiptId: typeof json.action_receipt_id === 'string' ? json.action_receipt_id : null,\n        };\n      }\n      if (res.status === 503 && json?.error === 'verify_unavailable') {\n        return { status: 'retry', reason: json.reason || 'verification unavailable' };\n      }\n      return {\n        status: 'blocked',\n        reason: json?.reason || json?.message || json?.error || `HTTP ${res.status}`,\n        actionReceiptId: typeof json?.action_receipt_id === 'string' ? json.action_receipt_id : null,\n      };\n    },\n\n    /**\n     * Append progress / set terminal status. Returns\n     *   { task }            \u2014 applied\n     *   { terminal: true }  \u2014 task already terminal (operator cancelled): STOP\n     */\n    async postProgress(taskId, patch) {\n      const res = await req('PATCH', `/api/v1/code-task/${taskId}/progress`, patch);\n      if (res.status === 409) return { terminal: true };\n      if (res.status === 404) return { terminal: true, missing: true };\n      if (!res.ok) throw new Error(`progress failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return { task: json && json.task };\n    },\n\n    /** Read the current task (cancel detection). Null on 404. */\n    async getTask(taskId) {\n      const res = await req('GET', `/api/v1/code-task/${taskId}`);\n      if (res.status === 404) return null;\n      if (!res.ok) throw new Error(`getTask failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json ? json.task : null;\n    },\n\n    /** Fetch bounded, prompt-ready AlgoHQ knowledge snippets for this task. */\n    async getTaskKnowledgeContext(taskId, { query } = {}) {\n      const body = {};\n      if (typeof query === 'string' && query.trim()) body.query = query;\n      const res = await req('POST', `/api/v1/code-task/${encodeURIComponent(taskId)}/knowledge-context`, body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('knowledge-context unauthorized (401)');\n      }\n      if (res.status === 404) return null;\n      if (!res.ok) throw new Error(`knowledge-context failed: HTTP ${res.status}`);\n      return res.json();\n    },\n\n    /**\n     * Report this machine's rolling-7-day Claude Code token usage (the real\n     * weekly-capacity gauge) PLUS the operator's real Claude weekly % (when\n     * available). The daemon authenticates as admin, so the target `operatorId`\n     * is named explicitly. Best-effort; throws on a non-2xx so the caller can\n     * log + move on.\n     *\n     * `tokens` = { input_tokens, output_tokens, cache_creation_tokens, cache_read_tokens }.\n     * Optional: `claudeWeeklyPct` (number) + `claudeWeeklyResetsAt` (ISO string | null).\n     */\n    async postWeeklyTokens({ operatorId, runnerId, tokens, claudeWeeklyPct, claudeWeeklyResetsAt }) {\n      const body = {\n        operator_id: operatorId,\n        runner_id: runnerId,\n        input_tokens: tokens.input_tokens,\n        output_tokens: tokens.output_tokens,\n        cache_creation_tokens: tokens.cache_creation_tokens,\n        cache_read_tokens: tokens.cache_read_tokens,\n      };\n      if (typeof claudeWeeklyPct === 'number') {\n        body.claude_weekly_pct = claudeWeeklyPct;\n      }\n      if (claudeWeeklyResetsAt !== undefined) {\n        body.claude_weekly_resets_at = claudeWeeklyResetsAt;\n      }\n      const res = await req('POST', '/api/v1/weekly-tokens', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('weekly-tokens unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`weekly-tokens failed: HTTP ${res.status}`);\n      return true;\n    },\n\n    /**\n     * Send a liveness heartbeat (M2). The control-plane upserts it under the\n     * authenticated operator so the web shows a TRUE \"runner online\" signal.\n     * Best-effort caller; throws on 401/non-ok so the daemon can log + retry.\n     */\n    async postHeartbeat({ runnerId, operatorId, uptimeSec, activeTasks, version, daemonVersion, servedRepos, servedOperators, availableAgents, accountUsage }) {\n      const body = { runner_id: runnerId };\n      if (operatorId) body.operator_id = operatorId;\n      if (typeof uptimeSec === 'number') body.uptime_sec = uptimeSec;\n      if (typeof activeTasks === 'number') body.active_tasks = activeTasks;\n      if (version) body.version = version;\n      if (daemonVersion) body.daemon_version = daemonVersion;\n      if (Array.isArray(servedRepos) && servedRepos.length > 0) body.served_repos = servedRepos;\n      if (Array.isArray(servedOperators) && servedOperators.length > 0) {\n        body.served_operator_ids = servedOperators;\n      }\n      if (Array.isArray(availableAgents) && availableAgents.length > 0) {\n        body.available_agents = availableAgents;\n      }\n      if (Array.isArray(accountUsage) && accountUsage.length > 0) {\n        body.account_usage = accountUsage;\n      }\n      const res = await req('POST', '/api/v1/runner/heartbeat', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('heartbeat unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`heartbeat failed: HTTP ${res.status}`);\n      return true;\n    },\n\n    /** Poll one authenticated runner's durable Mission Control action queue. */\n    async pollRunnerControl({ runnerId, operatorId }) {\n      const body = { runner_id: runnerId };\n      if (operatorId) body.operator_id = operatorId;\n      const res = await req('POST', '/api/v1/runner/control/poll', body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('runner control poll unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`runner control poll failed: HTTP ${res.status}`);\n      const json = await res.json();\n      const action = json?.action;\n      return action && typeof action.action_id === 'string' && action.action_id\n        ? { ...action, actionId: action.action_id }\n        : null;\n    },\n\n    /** Acknowledge a maintenance action after the host has restarted the child. */\n    async completeRunnerControl(actionId, { runnerId, operatorId, status, detail }) {\n      const body = { runner_id: runnerId, status };\n      if (operatorId) body.operator_id = operatorId;\n      if (detail) body.detail = detail;\n      const res = await req('POST', `/api/v1/runner/control/${encodeURIComponent(actionId)}/complete`, body);\n      if (res.status === 401) {\n        cachedFirebaseToken = null;\n        throw new Error('runner control completion unauthorized (401)');\n      }\n      if (!res.ok) throw new Error(`runner control completion failed: HTTP ${res.status}`);\n      const json = await res.json();\n      return json?.action || null;\n    },\n\n    /**\n     * Mint a short-lived (~1h), repo-scoped GitHub App installation token for\n     * THIS runner's operator (M3). The control-plane keys the mint on the\n     * authenticated operator (ctx.operator_id), so the token covers only that\n     * operator's installation.\n     *\n     * Returns { token, expiresAt } on success. In legacy/admin mode it returns\n     * null on a miss so the caller may use ambient `gh`. In scoped-operator mode\n     * callers pass `{ required: true }`, which fails closed instead of letting a\n     * missing/mis-scoped installation fall through to the runner machine's `gh`.\n     *\n     * The minted token is only usable for push + PR if the GitHub App grants\n     * BOTH `Contents: write` (git push) AND `Pull requests: write` (gh pr\n     * create) \u2014 see docs/vo/github-app-setup-2026-06-18.md. A token missing\n     * either scope fails at push (\u2192 ambient fallback) or at `gh pr create`.\n     */\n    async getInstallationToken({ required = false } = {}) {\n      const fail = (reason) => {\n        if (required) throw new Error(`installation-token required: ${reason}`);\n        return null;\n      };\n      try {\n        const res = await req('POST', '/api/v1/github/installation-token', {});\n        if (!res.ok) return fail(`HTTP ${res.status}`);\n        const json = await res.json();\n        if (!json || !json.token) return fail('missing token');\n        return { token: json.token, expiresAt: json.expires_at || null };\n      } catch (err) {\n        if (required) throw err;\n        return null;\n      }\n    },\n\n    /**\n     * Read the operator's dispatch-mode config (Fast\u2192Ultracode effort setting).\n     * Returns the mode string ('fast'|'standard'|'deep'|'ultra'|'ultracode'),\n     * defaulting to 'standard' on any error. Never throws \u2014 best-effort.\n     */\n    async getDispatchMode() {\n      try {\n        const res = await req('GET', '/api/v1/dispatch-mode-config');\n        if (!res.ok) return 'standard';\n        const json = await res.json();\n        return json?.dispatchMode || 'standard';\n      } catch {\n        return 'standard';\n      }\n    },\n  };\n}\n", "/** Allow-listed host maintenance operations used by the runner supervisor. */\nimport { spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { win32 } from 'node:path';\n\nexport const DEFAULT_RUNNER_PACKAGE = '@algosuite/vo-mcp@beta';\nconst PACKAGE_SPEC_RE = /^@algosuite\\/vo-mcp@(beta|latest|\\d+(?:\\.\\d+){0,2}(?:-[\\w.-]+)?)$/u;\nconst MAX_DIAGNOSTIC_CHARS = 800;\nconst NPM_CLI_SUFFIX = `\\\\${win32.join('node_modules', 'npm', 'bin', 'npm-cli.js').toLowerCase()}`;\n\nfunction escapeRegExp(value) {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/gu, '\\\\$&');\n}\n\n/** Keep action detail useful without ever returning credentials or tokens. */\nexport function sanitizeMaintenanceDiagnostic(raw, env = {}) {\n  let value = String(raw || '')\n    .replace(/\\b(?:vocred|npm|gh[oprsu])_[A-Za-z0-9._-]+\\b/gu, '[REDACTED]')\n    .replace(/\\bBearer\\s+\\S+/giu, 'Bearer [REDACTED]')\n    .replace(/\\b(_?authToken|token|password|secret|credential)(\\s*[=:]\\s*)\\S+/giu, '$1$2[REDACTED]');\n  for (const [name, secret] of Object.entries(env)) {\n    if (!/(?:TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL)/iu.test(name)) continue;\n    const text = String(secret || '');\n    if (text.length < 4) continue;\n    value = value.replace(new RegExp(escapeRegExp(text), 'gu'), '[REDACTED]');\n  }\n  value = value.replace(/\\s+/gu, ' ').trim();\n  if (value.length <= MAX_DIAGNOSTIC_CHARS) return value;\n  return `${value.slice(0, MAX_DIAGNOSTIC_CHARS - 1)}\u2026`;\n}\n\nfunction isNpmCliPath(value) {\n  return typeof value === 'string'\n    && win32.isAbsolute(value)\n    && win32.normalize(value).toLowerCase().endsWith(NPM_CLI_SUFFIX);\n}\n\n/**\n * Resolve npm's JavaScript entrypoint without executing a Windows `.cmd` shim.\n *\n * The desktop app can run from a bundled node.exe that does not carry npm, so\n * resolution also checks the exact npm layout below absolute PATH entries. No\n * candidate controls the executable or package argv: process.execPath remains\n * the executable and the package spec remains allow-listed below.\n */\nexport function resolveNpmCli({\n  env = process.env,\n  execPath = process.execPath,\n  fileExists = existsSync,\n} = {}) {\n  const candidates = [];\n  if (isNpmCliPath(env.npm_execpath)) candidates.push(env.npm_execpath);\n  candidates.push(win32.join(win32.dirname(execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js'));\n\n  const pathValue = env.PATH ?? env.Path ?? env.path ?? '';\n  for (const entry of pathValue.split(';')) {\n    const trimmed = entry.trim();\n    if (!win32.isAbsolute(trimmed)) continue;\n    candidates.push(win32.join(trimmed, 'node_modules', 'npm', 'bin', 'npm-cli.js'));\n  }\n\n  const seen = new Set();\n  for (const candidate of candidates) {\n    const normalized = win32.normalize(candidate);\n    const key = normalized.toLowerCase();\n    if (seen.has(key) || !isNpmCliPath(normalized)) continue;\n    seen.add(key);\n    if (fileExists(normalized)) return normalized;\n  }\n  return null;\n}\n\nexport function buildMaintenanceCommand(kind, {\n  platform = process.platform,\n  packageSpec = DEFAULT_RUNNER_PACKAGE,\n  env = process.env,\n  execPath = process.execPath,\n  fileExists = existsSync,\n} = {}) {\n  if (!['update', 'reinstall'].includes(kind)) return null;\n  if (!PACKAGE_SPEC_RE.test(packageSpec)) throw new Error('unsafe runner package spec');\n  const npmCli = platform === 'win32' ? resolveNpmCli({ env, execPath, fileExists }) : null;\n  if (platform === 'win32' && !npmCli) throw new Error('trusted npm CLI not found');\n  const command = platform === 'win32' ? execPath : 'npm';\n  const args = [...(npmCli ? [npmCli] : []), 'install', '-g', packageSpec];\n  if (kind === 'reinstall') args.push('--force');\n  return { command, args };\n}\n\nexport function runHostMaintenance(kind, {\n  platform = process.platform,\n  packageSpec = DEFAULT_RUNNER_PACKAGE,\n  env = process.env,\n  execPath = process.execPath,\n  fileExists = existsSync,\n  spawn = spawnSync,\n  log = () => {},\n} = {}) {\n  if (kind === 'reconnect') return { ok: true, status: 0, command: null, args: [] };\n  let command;\n  try {\n    command = buildMaintenanceCommand(kind, { platform, packageSpec, env, execPath, fileExists });\n  } catch (error) {\n    return {\n      ok: false,\n      status: 2,\n      command: null,\n      args: [],\n      detail: sanitizeMaintenanceDiagnostic(error instanceof Error ? error.message : String(error), env),\n    };\n  }\n  if (!command) return { ok: false, status: 2, command: null, args: [] };\n  log(`runner maintenance: ${command.command} ${command.args.join(' ')}`);\n  const result = spawn(command.command, command.args, {\n    stdio: ['ignore', 'pipe', 'pipe'],\n    encoding: 'utf8',\n    env,\n    shell: false,\n    windowsHide: true,\n  });\n  const status = typeof result.status === 'number' ? result.status : 1;\n  const detail = sanitizeMaintenanceDiagnostic(\n    [result.stderr, result.stdout, result.error?.message].filter(Boolean).join('\\n'),\n    env,\n  );\n  if (detail) log(`runner maintenance result: ${detail}`);\n  return { ok: status === 0, status, command: command.command, args: command.args, detail };\n}\n", "import { hostname as systemHostname } from 'node:os';\nimport { pairedOperatorScope, probeRunnerReadiness } from '../runner-readiness.mjs';\n\n/** Keep the supervisor's control-queue identity byte-identical to the daemon. */\nexport function resolveSupervisorRunnerId(env = {}, hostname = systemHostname) {\n  const explicit = String(env.VO_CODE_RUNNER_ID || '').trim();\n  return explicit || `vo-code-runner-${hostname()}`;\n}\n\n/** Build the daemon environment without mislabeling a paired credential as admin. */\nexport function buildSupervisorChildEnv({\n  baseEnv = {},\n  controlPlaneUrl,\n  explicitAdminToken = null,\n  pairedOperatorId = null,\n} = {}) {\n  const childEnv = {\n    ...baseEnv,\n    VO_CONTROL_PLANE_URL: controlPlaneUrl,\n  };\n  const adminToken = typeof explicitAdminToken === 'string' ? explicitAdminToken.trim() : '';\n  const operatorId = typeof pairedOperatorId === 'string' ? pairedOperatorId.trim() : '';\n\n  if (adminToken) childEnv.VO_CONTROL_PLANE_ADMIN_TOKEN = adminToken;\n  else delete childEnv.VO_CONTROL_PLANE_ADMIN_TOKEN;\n\n  if (operatorId) childEnv.VO_CODE_RUNNER_OPERATOR_IDS = operatorId;\n  return childEnv;\n}\n\n/** Resolve auth provenance once so the supervisor and child use the same scope. */\nexport async function prepareSupervisorAuth({\n  baseEnv = {},\n  storedCredential = null,\n  controlPlaneUrl,\n  probeReadiness = probeRunnerReadiness,\n} = {}) {\n  const explicitAdminToken = baseEnv.VO_CONTROL_PLANE_ADMIN_TOKEN?.trim();\n  const token = explicitAdminToken || storedCredential?.vo_credential;\n  if (!token) throw new Error('runner is not paired; run `vo-mcp pair` once on this host');\n\n  let operatorId = String(baseEnv.VO_CODE_RUNNER_OPERATOR_IDS || '')\n    .split(/[\\s,]+/u)\n    .filter(Boolean)[0] || undefined;\n  if (!explicitAdminToken) {\n    const readiness = await probeReadiness({ controlPlaneUrl, token, requireGithub: true });\n    if (!readiness.ok) throw new Error(`runner readiness failed: ${readiness.message}`);\n    operatorId = pairedOperatorScope(readiness) || undefined;\n    if (!operatorId) throw new Error('runner readiness failed: paired operator scope is missing');\n  }\n\n  const childEnv = buildSupervisorChildEnv({\n    baseEnv,\n    controlPlaneUrl,\n    explicitAdminToken,\n    pairedOperatorId: explicitAdminToken ? null : operatorId,\n  });\n  const clientEnv = {\n    ...baseEnv,\n    VO_CONTROL_PLANE_ADMIN_TOKEN: token,\n    VO_CONTROL_PLANE_URL: controlPlaneUrl,\n    ...(operatorId ? { VO_CODE_RUNNER_OPERATOR_IDS: operatorId } : {}),\n  };\n  return { childEnv, clientEnv, operatorId };\n}\n", "/**\n * Server-backed readiness probe for a paired BYO runner.\n *\n * The credential itself is opaque, so its mere presence is not proof that it is\n * usable or still bound to an operator. `/auth/me` supplies that truth from the\n * authenticated control-plane context. Before daemon startup, the optional\n * GitHub probe also proves the operator can mint an installation token, so a\n * task is never claimed only to fail at publication setup.\n */\n\nfunction failed({ paired = false, operatorId = null, tenantId = null, githubReady = null, error, message }) {\n  return { ok: false, paired, operatorId, tenantId, githubReady, error, message };\n}\n\nasync function responseBody(response) {\n  try {\n    const value = await response.json();\n    return value && typeof value === 'object' ? value : {};\n  } catch {\n    return {};\n  }\n}\n\nfunction serverMessage(body, fallback) {\n  return typeof body.message === 'string' && body.message.trim() ? body.message.trim() : fallback;\n}\n\nasync function fetchWithTimeout(fetchImpl, url, init, timeoutMs) {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), timeoutMs);\n  try {\n    return await fetchImpl(url, { ...init, signal: controller.signal });\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\n/**\n * @param {{\n *   controlPlaneUrl: string,\n *   token: string,\n *   fetchImpl?: typeof fetch,\n *   requireGithub?: boolean,\n *   timeoutMs?: number,\n * }} input\n */\nexport async function probeRunnerReadiness({\n  controlPlaneUrl,\n  token,\n  fetchImpl = fetch,\n  requireGithub = false,\n  timeoutMs = 10_000,\n}) {\n  const base = controlPlaneUrl.replace(/\\/+$/u, '');\n  const headers = { authorization: `Bearer ${token}` };\n  let identityResponse;\n  try {\n    identityResponse = await fetchWithTimeout(\n      fetchImpl,\n      `${base}/api/v1/auth/me`,\n      { headers },\n      timeoutMs,\n    );\n  } catch (error) {\n    const detail = error instanceof Error ? error.message : String(error);\n    return failed({\n      error: 'control_plane_unreachable',\n      message: `AlgoHQ could not be reached: ${detail}`,\n    });\n  }\n\n  const identity = await responseBody(identityResponse);\n  if (!identityResponse.ok) {\n    return failed({\n      error: 'credential_rejected',\n      message: 'The saved pairing is expired or revoked. Pair this computer again.',\n    });\n  }\n  if (\n    identity.provisioned !== true ||\n    identity.role !== 'operator' ||\n    typeof identity.operator_id !== 'string' ||\n    !identity.operator_id.trim() ||\n    typeof identity.tenant_id !== 'string' ||\n    !identity.tenant_id.trim()\n  ) {\n    return failed({\n      error: 'operator_identity_missing',\n      message: 'The pairing credential is valid but has no operator identity. Pair this computer again.',\n    });\n  }\n\n  const operatorId = identity.operator_id.trim();\n  const tenantId = identity.tenant_id.trim();\n  if (!requireGithub) {\n    return {\n      ok: true,\n      paired: true,\n      operatorId,\n      tenantId,\n      githubReady: null,\n      error: null,\n      message: 'Paired to AlgoHQ.',\n    };\n  }\n\n  let githubResponse;\n  try {\n    githubResponse = await fetchWithTimeout(\n      fetchImpl,\n      `${base}/api/v1/github/installation-token`,\n      {\n        method: 'POST',\n        headers: { ...headers, 'content-type': 'application/json' },\n        body: '{}',\n      },\n      timeoutMs,\n    );\n  } catch (error) {\n    const detail = error instanceof Error ? error.message : String(error);\n    return failed({\n      paired: true,\n      operatorId,\n      tenantId,\n      githubReady: false,\n      error: 'github_preflight_unreachable',\n      message: `GitHub publication readiness could not be checked: ${detail}`,\n    });\n  }\n\n  const github = await responseBody(githubResponse);\n  if (!githubResponse.ok || typeof github.token !== 'string' || !github.token) {\n    const error = typeof github.error === 'string' && github.error ? github.error : 'github_not_ready';\n    return failed({\n      paired: true,\n      operatorId,\n      tenantId,\n      githubReady: false,\n      error,\n      message: serverMessage(github, `GitHub publication preflight failed (HTTP ${githubResponse.status}).`),\n    });\n  }\n\n  return {\n    ok: true,\n    paired: true,\n    operatorId,\n    tenantId,\n    githubReady: true,\n    error: null,\n    message: 'Paired and ready to publish through the Algosuite GitHub App.',\n  };\n}\n\nexport function pairedOperatorScope(readiness) {\n  return readiness?.ok === true &&\n    readiness?.paired === true &&\n    typeof readiness.operatorId === 'string' &&\n    readiness.operatorId.trim()\n    ? readiness.operatorId.trim()\n    : null;\n}\n", "import { spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport function defaultCredentialHelperPath(metaUrl = import.meta.url) {\n  const moduleDir = dirname(fileURLToPath(metaUrl));\n  const bundled = join(moduleDir, 'supervisor-credential-helper.js');\n  const source = join(moduleDir, '..', 'supervisor-credential-helper.mjs');\n  return existsSync(source) ? source : bundled;\n}\n\n/** Read the OS-keychain credential without loading its native module here. */\nexport function readStoredCredentialIsolated({\n  spawn = spawnSync,\n  execPath = process.execPath,\n  helperPath = defaultCredentialHelperPath(),\n  env = process.env,\n} = {}) {\n  const result = spawn(execPath, [helperPath], {\n    env,\n    encoding: 'utf8',\n    stdio: ['ignore', 'pipe', 'pipe'],\n    shell: false,\n    windowsHide: true,\n    timeout: 10_000,\n  });\n  if (result.status !== 0) {\n    throw new Error('runner credential helper could not read the paired credential');\n  }\n  try {\n    const parsed = JSON.parse(String(result.stdout || ''));\n    return parsed && typeof parsed === 'object' ? parsed : null;\n  } catch {\n    throw new Error('runner credential helper returned an invalid credential');\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAeA,eAAsB,kBAAkB;AACtC,QAAM,IAAI;AAAA,IACR;AAAA,EAEF;AACF;AApBA;AAAA;AAAA;AAAA;;;ACKA,SAAS,aAAa;AACtB,SAAS,qBAAqB;AAC9B,SAAS,iBAAAA,sBAAqB;AAC9B,SAAS,WAAAC,UAAS,QAAAC,aAAY;;;ACS9B,IAAI,sBAAsB;AAE1B,eAAe,cAAc,KAAK;AAChC,QAAM,aAAa,IAAI;AACvB,MAAI,WAAY,QAAO;AACvB,MAAI,oBAAqB,QAAO;AAEhC,QAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM;AAClC,QAAM,OAAO,MAAMA,iBAAgB,EAAE,IAAI,CAAC;AAC1C,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAS;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,wBAAsB,KAAK;AAC3B,SAAO;AACT;AAMO,SAAS,yBAAyB;AAAA,EACvC,UAAU,QAAQ,IAAI,wBAAwB;AAAA,EAC9C,MAAM,QAAQ;AAAA,EACd,YAAY;AACd,IAAI,CAAC,GAAG;AACN,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,QAAM,OAAO,QAAQ,QAAQ,QAAQ,EAAE;AAEvC,iBAAe,IAAI,QAAQ,MAAM,MAAM;AACrC,UAAM,SAAS,MAAM,cAAc,GAAG;AACtC,WAAO,UAAU,GAAG,IAAI,GAAG,IAAI,IAAI;AAAA,MACjC;AAAA,MACA,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,UAAU,MAAM;AAAA,MACjC;AAAA,MACA,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,IAC5D,CAAC;AAAA,EACH;AAEA,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQL,MAAM,MAAMC,WAAU,OAAO,aAAa,UAAU,CAAC,GAAG;AACtD,YAAM,OAAO,EAAE,WAAWA,UAAS;AACnC,UAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,MAAK,QAAQ;AAC3D,UAAI,MAAM,QAAQ,WAAW,KAAK,YAAY,SAAS,EAAG,MAAK,eAAe;AAC9E,UAAI,QAAQ,iBAAkB,MAAK,qBAAqB,QAAQ;AAChE,UAAI,QAAQ,oBAAoB,QAAQ,eAAgB,MAAK,kBAAkB;AAC/E,YAAM,MAAM,MAAM,IAAI,QAAQ,2BAA2B,IAAI;AAC7D,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,0BAA0B;AAAA,MAC5C;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,sBAAsB,IAAI,MAAM,EAAE;AAC/D,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAAA,IACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,gBAAgB,EAAE,MAAM,QAAQ,gBAAgB,UAAU,GAAG;AACjE,YAAM,OAAO,EAAE,MAAM,OAAO;AAC5B,UAAI,OAAO,mBAAmB,SAAU,MAAK,iBAAiB;AAC9D,UAAI,OAAO,cAAc,SAAU,MAAK,YAAY;AACpD,YAAM,MAAM,MAAM,IAAI,QAAQ,qBAAqB,IAAI;AACvD,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,4BAA4B;AAAA,MAC9C;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,wBAAwB,IAAI,MAAM,EAAE;AACjE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAAA,IACzC;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,eAAe,QAAQ;AAC3B,YAAM,MAAM,MAAM,IAAI,QAAQ,qBAAqB,mBAAmB,MAAM,CAAC,WAAW,CAAC,CAAC;AAC1F,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,2BAA2B;AAAA,MAC7C;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,uBAAuB,IAAI,MAAM,EAAE;AAChE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAAA,IACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,gBAAgB,UAAU,mBAAmB;AACjD,YAAM,MAAM,MAAM,IAAI,QAAQ,0BAA0B,EAAE,UAAU,kBAAkB,CAAC;AACvF,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,gCAAgC;AAAA,MAClD;AACA,YAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAI,IAAI,MAAM,MAAM,OAAO,MAAM;AAC/B,cAAM,SAAS,MAAM,UAAU,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,CAAC;AAChF,cAAM,SAAS,OAAO,WAAW,QAAQ,OAAO,WAAW,WACvD,WACA,OAAO,WAAW,wBAAwB,OAAO,OAAO,UAAU,EAAE,EAAE,SAAS,YAAY,IACzF,WACA;AACN,eAAO;AAAA,UACL;AAAA,UACA,QAAQ,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AAAA,UAC5D,iBAAiB,OAAO,KAAK,sBAAsB,WAAW,KAAK,oBAAoB;AAAA,QACzF;AAAA,MACF;AACA,UAAI,IAAI,WAAW,OAAO,MAAM,UAAU,sBAAsB;AAC9D,eAAO,EAAE,QAAQ,SAAS,QAAQ,KAAK,UAAU,2BAA2B;AAAA,MAC9E;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ,MAAM,UAAU,MAAM,WAAW,MAAM,SAAS,QAAQ,IAAI,MAAM;AAAA,QAC1E,iBAAiB,OAAO,MAAM,sBAAsB,WAAW,KAAK,oBAAoB;AAAA,MAC1F;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,aAAa,QAAQ,OAAO;AAChC,YAAM,MAAM,MAAM,IAAI,SAAS,qBAAqB,MAAM,aAAa,KAAK;AAC5E,UAAI,IAAI,WAAW,IAAK,QAAO,EAAE,UAAU,KAAK;AAChD,UAAI,IAAI,WAAW,IAAK,QAAO,EAAE,UAAU,MAAM,SAAS,KAAK;AAC/D,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,yBAAyB,IAAI,MAAM,EAAE;AAClE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,EAAE,MAAM,QAAQ,KAAK,KAAK;AAAA,IACnC;AAAA;AAAA,IAGA,MAAM,QAAQ,QAAQ;AACpB,YAAM,MAAM,MAAM,IAAI,OAAO,qBAAqB,MAAM,EAAE;AAC1D,UAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,wBAAwB,IAAI,MAAM,EAAE;AACjE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,OAAO,KAAK,OAAO;AAAA,IAC5B;AAAA;AAAA,IAGA,MAAM,wBAAwB,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAG;AACpD,YAAM,OAAO,CAAC;AACd,UAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAG,MAAK,QAAQ;AAC5D,YAAM,MAAM,MAAM,IAAI,QAAQ,qBAAqB,mBAAmB,MAAM,CAAC,sBAAsB,IAAI;AACvG,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,sCAAsC;AAAA,MACxD;AACA,UAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,kCAAkC,IAAI,MAAM,EAAE;AAC3E,aAAO,IAAI,KAAK;AAAA,IAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYA,MAAM,iBAAiB,EAAE,YAAY,UAAAA,WAAU,QAAQ,iBAAiB,qBAAqB,GAAG;AAC9F,YAAM,OAAO;AAAA,QACX,aAAa;AAAA,QACb,WAAWA;AAAA,QACX,cAAc,OAAO;AAAA,QACrB,eAAe,OAAO;AAAA,QACtB,uBAAuB,OAAO;AAAA,QAC9B,mBAAmB,OAAO;AAAA,MAC5B;AACA,UAAI,OAAO,oBAAoB,UAAU;AACvC,aAAK,oBAAoB;AAAA,MAC3B;AACA,UAAI,yBAAyB,QAAW;AACtC,aAAK,0BAA0B;AAAA,MACjC;AACA,YAAM,MAAM,MAAM,IAAI,QAAQ,yBAAyB,IAAI;AAC3D,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,kCAAkC;AAAA,MACpD;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,8BAA8B,IAAI,MAAM,EAAE;AACvE,aAAO;AAAA,IACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,cAAc,EAAE,UAAAA,WAAU,YAAY,WAAW,aAAa,SAAS,eAAe,aAAa,iBAAiB,iBAAiB,aAAa,GAAG;AACzJ,YAAM,OAAO,EAAE,WAAWA,UAAS;AACnC,UAAI,WAAY,MAAK,cAAc;AACnC,UAAI,OAAO,cAAc,SAAU,MAAK,aAAa;AACrD,UAAI,OAAO,gBAAgB,SAAU,MAAK,eAAe;AACzD,UAAI,QAAS,MAAK,UAAU;AAC5B,UAAI,cAAe,MAAK,iBAAiB;AACzC,UAAI,MAAM,QAAQ,WAAW,KAAK,YAAY,SAAS,EAAG,MAAK,eAAe;AAC9E,UAAI,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,GAAG;AAChE,aAAK,sBAAsB;AAAA,MAC7B;AACA,UAAI,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,GAAG;AAChE,aAAK,mBAAmB;AAAA,MAC1B;AACA,UAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,GAAG;AAC1D,aAAK,gBAAgB;AAAA,MACvB;AACA,YAAM,MAAM,MAAM,IAAI,QAAQ,4BAA4B,IAAI;AAC9D,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,8BAA8B;AAAA,MAChD;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0BAA0B,IAAI,MAAM,EAAE;AACnE,aAAO;AAAA,IACT;AAAA;AAAA,IAGA,MAAM,kBAAkB,EAAE,UAAAA,WAAU,WAAW,GAAG;AAChD,YAAM,OAAO,EAAE,WAAWA,UAAS;AACnC,UAAI,WAAY,MAAK,cAAc;AACnC,YAAM,MAAM,MAAM,IAAI,QAAQ,+BAA+B,IAAI;AACjE,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,wCAAwC;AAAA,MAC1D;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,oCAAoC,IAAI,MAAM,EAAE;AAC7E,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,SAAS,MAAM;AACrB,aAAO,UAAU,OAAO,OAAO,cAAc,YAAY,OAAO,YAC5D,EAAE,GAAG,QAAQ,UAAU,OAAO,UAAU,IACxC;AAAA,IACN;AAAA;AAAA,IAGA,MAAM,sBAAsB,UAAU,EAAE,UAAAA,WAAU,YAAY,QAAQ,OAAO,GAAG;AAC9E,YAAM,OAAO,EAAE,WAAWA,WAAU,OAAO;AAC3C,UAAI,WAAY,MAAK,cAAc;AACnC,UAAI,OAAQ,MAAK,SAAS;AAC1B,YAAM,MAAM,MAAM,IAAI,QAAQ,0BAA0B,mBAAmB,QAAQ,CAAC,aAAa,IAAI;AACrG,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0CAA0C,IAAI,MAAM,EAAE;AACnF,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,MAAM,UAAU;AAAA,IACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAkBA,MAAM,qBAAqB,EAAE,WAAW,MAAM,IAAI,CAAC,GAAG;AACpD,YAAM,OAAO,CAAC,WAAW;AACvB,YAAI,SAAU,OAAM,IAAI,MAAM,gCAAgC,MAAM,EAAE;AACtE,eAAO;AAAA,MACT;AACA,UAAI;AACF,cAAM,MAAM,MAAM,IAAI,QAAQ,qCAAqC,CAAC,CAAC;AACrE,YAAI,CAAC,IAAI,GAAI,QAAO,KAAK,QAAQ,IAAI,MAAM,EAAE;AAC7C,cAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAI,CAAC,QAAQ,CAAC,KAAK,MAAO,QAAO,KAAK,eAAe;AACrD,eAAO,EAAE,OAAO,KAAK,OAAO,WAAW,KAAK,cAAc,KAAK;AAAA,MACjE,SAAS,KAAK;AACZ,YAAI,SAAU,OAAM;AACpB,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,kBAAkB;AACtB,UAAI;AACF,cAAM,MAAM,MAAM,IAAI,OAAO,8BAA8B;AAC3D,YAAI,CAAC,IAAI,GAAI,QAAO;AACpB,cAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,eAAO,MAAM,gBAAgB;AAAA,MAC/B,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;AChVA,SAAS,iBAAiB;AAC1B,SAAS,kBAAkB;AAC3B,SAAS,aAAa;AAEf,IAAM,yBAAyB;AACtC,IAAM,kBAAkB;AACxB,IAAM,uBAAuB;AAC7B,IAAM,iBAAiB,KAAK,MAAM,KAAK,gBAAgB,OAAO,OAAO,YAAY,EAAE,YAAY,CAAC;AAEhG,SAAS,aAAa,OAAO;AAC3B,SAAO,MAAM,QAAQ,wBAAwB,MAAM;AACrD;AAGO,SAAS,8BAA8B,KAAK,MAAM,CAAC,GAAG;AAC3D,MAAI,QAAQ,OAAO,OAAO,EAAE,EACzB,QAAQ,kDAAkD,YAAY,EACtE,QAAQ,qBAAqB,mBAAmB,EAChD,QAAQ,sEAAsE,gBAAgB;AACjG,aAAW,CAAC,MAAM,MAAM,KAAK,OAAO,QAAQ,GAAG,GAAG;AAChD,QAAI,CAAC,6CAA6C,KAAK,IAAI,EAAG;AAC9D,UAAM,OAAO,OAAO,UAAU,EAAE;AAChC,QAAI,KAAK,SAAS,EAAG;AACrB,YAAQ,MAAM,QAAQ,IAAI,OAAO,aAAa,IAAI,GAAG,IAAI,GAAG,YAAY;AAAA,EAC1E;AACA,UAAQ,MAAM,QAAQ,SAAS,GAAG,EAAE,KAAK;AACzC,MAAI,MAAM,UAAU,qBAAsB,QAAO;AACjD,SAAO,GAAG,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC;AACpD;AAEA,SAAS,aAAa,OAAO;AAC3B,SAAO,OAAO,UAAU,YACnB,MAAM,WAAW,KAAK,KACtB,MAAM,UAAU,KAAK,EAAE,YAAY,EAAE,SAAS,cAAc;AACnE;AAUO,SAAS,cAAc;AAAA,EAC5B,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AACf,IAAI,CAAC,GAAG;AACN,QAAM,aAAa,CAAC;AACpB,MAAI,aAAa,IAAI,YAAY,EAAG,YAAW,KAAK,IAAI,YAAY;AACpE,aAAW,KAAK,MAAM,KAAK,MAAM,QAAQ,QAAQ,GAAG,gBAAgB,OAAO,OAAO,YAAY,CAAC;AAE/F,QAAM,YAAY,IAAI,QAAQ,IAAI,QAAQ,IAAI,QAAQ;AACtD,aAAW,SAAS,UAAU,MAAM,GAAG,GAAG;AACxC,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,MAAM,WAAW,OAAO,EAAG;AAChC,eAAW,KAAK,MAAM,KAAK,SAAS,gBAAgB,OAAO,OAAO,YAAY,CAAC;AAAA,EACjF;AAEA,QAAM,OAAO,oBAAI,IAAI;AACrB,aAAW,aAAa,YAAY;AAClC,UAAM,aAAa,MAAM,UAAU,SAAS;AAC5C,UAAM,MAAM,WAAW,YAAY;AACnC,QAAI,KAAK,IAAI,GAAG,KAAK,CAAC,aAAa,UAAU,EAAG;AAChD,SAAK,IAAI,GAAG;AACZ,QAAI,WAAW,UAAU,EAAG,QAAO;AAAA,EACrC;AACA,SAAO;AACT;AAEO,SAAS,wBAAwB,MAAM;AAAA,EAC5C,WAAW,QAAQ;AAAA,EACnB,cAAc;AAAA,EACd,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AACf,IAAI,CAAC,GAAG;AACN,MAAI,CAAC,CAAC,UAAU,WAAW,EAAE,SAAS,IAAI,EAAG,QAAO;AACpD,MAAI,CAAC,gBAAgB,KAAK,WAAW,EAAG,OAAM,IAAI,MAAM,4BAA4B;AACpF,QAAM,SAAS,aAAa,UAAU,cAAc,EAAE,KAAK,UAAU,WAAW,CAAC,IAAI;AACrF,MAAI,aAAa,WAAW,CAAC,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AAChF,QAAM,UAAU,aAAa,UAAU,WAAW;AAClD,QAAM,OAAO,CAAC,GAAI,SAAS,CAAC,MAAM,IAAI,CAAC,GAAI,WAAW,MAAM,WAAW;AACvE,MAAI,SAAS,YAAa,MAAK,KAAK,SAAS;AAC7C,SAAO,EAAE,SAAS,KAAK;AACzB;AAEO,SAAS,mBAAmB,MAAM;AAAA,EACvC,WAAW,QAAQ;AAAA,EACnB,cAAc;AAAA,EACd,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AAAA,EACb,OAAAC,SAAQ;AAAA,EACR,MAAM,MAAM;AAAA,EAAC;AACf,IAAI,CAAC,GAAG;AACN,MAAI,SAAS,YAAa,QAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,SAAS,MAAM,MAAM,CAAC,EAAE;AAChF,MAAI;AACJ,MAAI;AACF,cAAU,wBAAwB,MAAM,EAAE,UAAU,aAAa,KAAK,UAAU,WAAW,CAAC;AAAA,EAC9F,SAAS,OAAO;AACd,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,MAAM,CAAC;AAAA,MACP,QAAQ,8BAA8B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,GAAG;AAAA,IACnG;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,SAAS,MAAM,MAAM,CAAC,EAAE;AACrE,MAAI,uBAAuB,QAAQ,OAAO,IAAI,QAAQ,KAAK,KAAK,GAAG,CAAC,EAAE;AACtE,QAAM,SAASA,OAAM,QAAQ,SAAS,QAAQ,MAAM;AAAA,IAClD,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,UAAU;AAAA,IACV;AAAA,IACA,OAAO;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACD,QAAM,SAAS,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AACnE,QAAM,SAAS;AAAA,IACb,CAAC,OAAO,QAAQ,OAAO,QAAQ,OAAO,OAAO,OAAO,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAAA,IAC/E;AAAA,EACF;AACA,MAAI,OAAQ,KAAI,8BAA8B,MAAM,EAAE;AACtD,SAAO,EAAE,IAAI,WAAW,GAAG,QAAQ,SAAS,QAAQ,SAAS,MAAM,QAAQ,MAAM,OAAO;AAC1F;;;AC/HA,SAAS,YAAY,sBAAsB;;;ACU3C,SAAS,OAAO,EAAE,SAAS,OAAO,aAAa,MAAM,WAAW,MAAM,cAAc,MAAM,OAAO,QAAQ,GAAG;AAC1G,SAAO,EAAE,IAAI,OAAO,QAAQ,YAAY,UAAU,aAAa,OAAO,QAAQ;AAChF;AAEA,eAAe,aAAa,UAAU;AACpC,MAAI;AACF,UAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,WAAO,SAAS,OAAO,UAAU,WAAW,QAAQ,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,cAAc,MAAM,UAAU;AACrC,SAAO,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,KAAK,IAAI,KAAK,QAAQ,KAAK,IAAI;AACzF;AAEA,eAAe,iBAAiB,WAAW,KAAK,MAAM,WAAW;AAC/D,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAC5D,MAAI;AACF,WAAO,MAAM,UAAU,KAAK,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,CAAC;AAAA,EACpE,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAWA,eAAsB,qBAAqB;AAAA,EACzC;AAAA,EACA;AAAA,EACA,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,YAAY;AACd,GAAG;AACD,QAAM,OAAO,gBAAgB,QAAQ,SAAS,EAAE;AAChD,QAAM,UAAU,EAAE,eAAe,UAAU,KAAK,GAAG;AACnD,MAAI;AACJ,MAAI;AACF,uBAAmB,MAAM;AAAA,MACvB;AAAA,MACA,GAAG,IAAI;AAAA,MACP,EAAE,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS,gCAAgC,MAAM;AAAA,IACjD,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,MAAM,aAAa,gBAAgB;AACpD,MAAI,CAAC,iBAAiB,IAAI;AACxB,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,SAAS,gBAAgB,QACzB,SAAS,SAAS,cAClB,OAAO,SAAS,gBAAgB,YAChC,CAAC,SAAS,YAAY,KAAK,KAC3B,OAAO,SAAS,cAAc,YAC9B,CAAC,SAAS,UAAU,KAAK,GACzB;AACA,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,SAAS,YAAY,KAAK;AAC7C,QAAM,WAAW,SAAS,UAAU,KAAK;AACzC,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,OAAO;AAAA,MACP,SAAS;AAAA,IACX;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,qBAAiB,MAAM;AAAA,MACrB;AAAA,MACA,GAAG,IAAI;AAAA,MACP;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,SAAS,gBAAgB,mBAAmB;AAAA,QAC1D,MAAM;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,WAAO,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,OAAO;AAAA,MACP,SAAS,sDAAsD,MAAM;AAAA,IACvE,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,MAAM,aAAa,cAAc;AAChD,MAAI,CAAC,eAAe,MAAM,OAAO,OAAO,UAAU,YAAY,CAAC,OAAO,OAAO;AAC3E,UAAM,QAAQ,OAAO,OAAO,UAAU,YAAY,OAAO,QAAQ,OAAO,QAAQ;AAChF,WAAO,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb;AAAA,MACA,SAAS,cAAc,QAAQ,6CAA6C,eAAe,MAAM,IAAI;AAAA,IACvG,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,EACX;AACF;AAEO,SAAS,oBAAoB,WAAW;AAC7C,SAAO,WAAW,OAAO,QACvB,WAAW,WAAW,QACtB,OAAO,UAAU,eAAe,YAChC,UAAU,WAAW,KAAK,IACxB,UAAU,WAAW,KAAK,IAC1B;AACN;;;AD7JO,SAAS,0BAA0B,MAAM,CAAC,GAAG,WAAW,gBAAgB;AAC7E,QAAM,WAAW,OAAO,IAAI,qBAAqB,EAAE,EAAE,KAAK;AAC1D,SAAO,YAAY,kBAAkB,SAAS,CAAC;AACjD;AAGO,SAAS,wBAAwB;AAAA,EACtC,UAAU,CAAC;AAAA,EACX;AAAA,EACA,qBAAqB;AAAA,EACrB,mBAAmB;AACrB,IAAI,CAAC,GAAG;AACN,QAAM,WAAW;AAAA,IACf,GAAG;AAAA,IACH,sBAAsB;AAAA,EACxB;AACA,QAAM,aAAa,OAAO,uBAAuB,WAAW,mBAAmB,KAAK,IAAI;AACxF,QAAM,aAAa,OAAO,qBAAqB,WAAW,iBAAiB,KAAK,IAAI;AAEpF,MAAI,WAAY,UAAS,+BAA+B;AAAA,MACnD,QAAO,SAAS;AAErB,MAAI,WAAY,UAAS,8BAA8B;AACvD,SAAO;AACT;AAGA,eAAsB,sBAAsB;AAAA,EAC1C,UAAU,CAAC;AAAA,EACX,mBAAmB;AAAA,EACnB;AAAA,EACA,iBAAiB;AACnB,IAAI,CAAC,GAAG;AACN,QAAM,qBAAqB,QAAQ,8BAA8B,KAAK;AACtE,QAAM,QAAQ,sBAAsB,kBAAkB;AACtD,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,2DAA2D;AAEvF,MAAI,aAAa,OAAO,QAAQ,+BAA+B,EAAE,EAC9D,MAAM,SAAS,EACf,OAAO,OAAO,EAAE,CAAC,KAAK;AACzB,MAAI,CAAC,oBAAoB;AACvB,UAAM,YAAY,MAAM,eAAe,EAAE,iBAAiB,OAAO,eAAe,KAAK,CAAC;AACtF,QAAI,CAAC,UAAU,GAAI,OAAM,IAAI,MAAM,4BAA4B,UAAU,OAAO,EAAE;AAClF,iBAAa,oBAAoB,SAAS,KAAK;AAC/C,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,2DAA2D;AAAA,EAC9F;AAEA,QAAM,WAAW,wBAAwB;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,qBAAqB,OAAO;AAAA,EAChD,CAAC;AACD,QAAM,YAAY;AAAA,IAChB,GAAG;AAAA,IACH,8BAA8B;AAAA,IAC9B,sBAAsB;AAAA,IACtB,GAAI,aAAa,EAAE,6BAA6B,WAAW,IAAI,CAAC;AAAA,EAClE;AACA,SAAO,EAAE,UAAU,WAAW,WAAW;AAC3C;;;AEhEA,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAEvB,SAAS,4BAA4B,UAAU,YAAY,KAAK;AACrE,QAAM,YAAY,QAAQ,cAAc,OAAO,CAAC;AAChD,QAAM,UAAU,KAAK,WAAW,iCAAiC;AACjE,QAAM,SAAS,KAAK,WAAW,MAAM,kCAAkC;AACvE,SAAOA,YAAW,MAAM,IAAI,SAAS;AACvC;AAGO,SAAS,6BAA6B;AAAA,EAC3C,OAAAC,SAAQF;AAAA,EACR,WAAW,QAAQ;AAAA,EACnB,aAAa,4BAA4B;AAAA,EACzC,MAAM,QAAQ;AAChB,IAAI,CAAC,GAAG;AACN,QAAM,SAASE,OAAM,UAAU,CAAC,UAAU,GAAG;AAAA,IAC3C;AAAA,IACA,UAAU;AAAA,IACV,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,EACX,CAAC;AACD,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO,OAAO,UAAU,EAAE,CAAC;AACrD,WAAO,UAAU,OAAO,WAAW,WAAW,SAAS;AAAA,EACzD,QAAQ;AACN,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACF;;;ALtBA,IAAM,4BAA4B;AAClC,IAAM,UAAU;AAChB,IAAM,iBAAiB;AACvB,IAAM,aAAaC,MAAKC,SAAQC,eAAc,YAAY,GAAG,CAAC,GAAG,eAAe;AAChF,IAAM,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAEtE,IAAM,WAAW,0BAA0B,QAAQ,GAAG;AAEtD,SAAS,iBAAiB;AACxB,MAAI;AAAE,WAAO,cAAc,YAAY,GAAG,EAAE,iBAAiB,EAAE,WAAW;AAAA,EAAW,QAAQ;AAAE,WAAO;AAAA,EAAW;AACnH;AAEA,SAAS,WAAW,UAAU;AAC5B,SAAO,MAAM,QAAQ,UAAU,CAAC,UAAU,GAAG;AAAA,IAC3C,KAAK;AAAA,IACL,OAAO;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACH;AAEA,eAAe,cAAc;AAC3B,MAAI;AACF,UAAM,OAAO,OAAO,QAAQ,IAAI,+BAA+B,IAAI;AACnE,UAAM,WAAW,MAAM,MAAM,oBAAoB,IAAI,WAAW,EAAE,QAAQ,YAAY,QAAQ,GAAG,EAAE,CAAC;AACpG,QAAI,CAAC,SAAS,GAAI,QAAO;AACzB,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,WAAO,MAAM,OAAO,OAAO,OAAO;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,mBAAmB,OAAO;AACvC,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,QAAI,MAAM,aAAa,KAAM,QAAO;AACpC,SAAK,MAAM,YAAY,IAAI,YAAY,KAAM,QAAO;AACpD,UAAM,MAAM,GAAG;AAAA,EACjB;AACA,SAAO;AACT;AAEA,eAAe,UAAU,OAAO;AAC9B,MAAI,CAAC,SAAS,MAAM,aAAa,KAAM;AACvC,QAAM,KAAK,QAAQ,aAAa,UAAU,SAAY,SAAS;AAC/D,QAAM,QAAQ,KAAK;AAAA,IACjB,IAAI,QAAQ,CAAC,YAAY,MAAM,KAAK,QAAQ,OAAO,CAAC;AAAA,IACpD,MAAM,IAAM;AAAA,EACd,CAAC;AACD,MAAI,MAAM,aAAa,KAAM,OAAM,KAAK,SAAS;AACnD;AAEA,eAAe,OAAO;AAIpB,QAAM,SAAS,6BAA6B;AAC5C,QAAM,kBAAkB,QAAQ,IAAI,wBAAwB;AAC5D,QAAM,EAAE,UAAU,WAAW,WAAW,IAAI,MAAM,sBAAsB;AAAA,IACtE,SAAS,QAAQ;AAAA,IACjB,kBAAkB;AAAA,IAClB;AAAA,EACF,CAAC;AACD,QAAM,SAAS,yBAAyB,EAAE,SAAS,iBAAiB,KAAK,UAAU,CAAC;AACpF,MAAI,QAAQ,WAAW,QAAQ;AAC/B,MAAI,WAAW;AACf,MAAI,WAAW;AAEf,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,YAAY,CAAC,aAAa,CAAC,SAAS,MAAM,aAAa,MAAO,SAAQ,WAAW,QAAQ;AAAA,EAChG;AACA,QAAM,GAAG,QAAQ,MAAM,WAAW,SAAS,GAAI,CAAC;AAEhD,QAAM,WAAW,YAAY;AAC3B,QAAI,SAAU;AACd,eAAW;AACX,UAAM,UAAU,KAAK;AAAA,EACvB;AACA,UAAQ,GAAG,UAAU,MAAM;AAAE,SAAK,SAAS,EAAE,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,EAAG,CAAC;AAC9E,UAAQ,GAAG,WAAW,MAAM;AAAE,SAAK,SAAS,EAAE,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,EAAG,CAAC;AAE/E,SAAO,CAAC,UAAU;AAChB,QAAI;AACF,YAAM,SAAS,MAAM,OAAO,kBAAkB,EAAE,UAAU,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC,EAAG,CAAC;AACjG,UAAI,CAAC,QAAQ;AACX,cAAM,MAAM,OAAO;AACnB;AAAA,MACF;AACA,iBAAW;AACX,YAAM,aAAa,MAAM,YAAY;AACrC,UAAI,cAAc,OAAO,WAAW,eAAe,CAAC,IAAI,GAAG;AACzD,cAAM,OAAO,sBAAsB,OAAO,UAAU;AAAA,UAClD;AAAA,UACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,UACnC,QAAQ;AAAA,UACR,QAAQ,oBAAoB,WAAW,WAAW;AAAA,QACpD,CAAC;AACD,mBAAW;AACX;AAAA,MACF;AACA,YAAM,UAAU,KAAK;AACrB,YAAM,SAAS,mBAAmB,OAAO,MAAM;AAAA,QAC7C,KAAK;AAAA,QACL,KAAK,CAAC,YAAY,QAAQ,KAAK,0BAA0B,OAAO,EAAE;AAAA,MACpE,CAAC;AACD,cAAQ,WAAW,QAAQ;AAC3B,YAAM,MAAM,cAAc;AAC1B,UAAI,MAAM,aAAa,QAAQ,CAAE,MAAM,mBAAmB,KAAK,EAAI,QAAO,KAAK;AAC/E,YAAM,OAAO,sBAAsB,OAAO,UAAU;AAAA,QAClD;AAAA,QACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,QACnC,QAAQ,OAAO,KAAK,cAAc;AAAA,QAClC,QAAQ,OAAO,KACX,UAAU,eAAe,CAAC,iBAC1B,sBAAsB,OAAO,MAAM,GAAG,OAAO,SAAS,KAAK,OAAO,MAAM,KAAK,EAAE;AAAA,MACrF,CAAC;AACD,iBAAW;AAAA,IACb,SAAS,OAAO;AACd,cAAQ,MAAM,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAChG,iBAAW;AACX,YAAM,MAAM,OAAO;AAAA,IACrB;AAAA,EACF;AACF;AAEA,KAAK,EAAE,MAAM,CAAC,UAAU;AACtB,UAAQ,MAAM,iCAAiC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AACvG,UAAQ,WAAW;AACrB,CAAC;",
+  "names": ["fileURLToPath", "dirname", "join", "getFirebaseAuth", "runnerId", "spawn", "spawnSync", "existsSync", "spawn", "join", "dirname", "fileURLToPath"]
 }

package/dist/update-cli.js

@@ -2,8 +2,61 @@
 import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
 
 // src/update.ts
-import { spawnSync } from "node:child_process";
+import { spawnSync as spawnSync2 } from "node:child_process";
 import { createRequire } from "node:module";
+
+// ../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { win32 } from "node:path";
+var DEFAULT_RUNNER_PACKAGE = "@algosuite/vo-mcp@beta";
+var PACKAGE_SPEC_RE = /^@algosuite\/vo-mcp@(beta|latest|\d+(?:\.\d+){0,2}(?:-[\w.-]+)?)$/u;
+var NPM_CLI_SUFFIX = `\\${win32.join("node_modules", "npm", "bin", "npm-cli.js").toLowerCase()}`;
+function isNpmCliPath(value) {
+  return typeof value === "string" && win32.isAbsolute(value) && win32.normalize(value).toLowerCase().endsWith(NPM_CLI_SUFFIX);
+}
+function resolveNpmCli({
+  env = process.env,
+  execPath = process.execPath,
+  fileExists = existsSync
+} = {}) {
+  const candidates = [];
+  if (isNpmCliPath(env.npm_execpath)) candidates.push(env.npm_execpath);
+  candidates.push(win32.join(win32.dirname(execPath), "node_modules", "npm", "bin", "npm-cli.js"));
+  const pathValue = env.PATH ?? env.Path ?? env.path ?? "";
+  for (const entry of pathValue.split(";")) {
+    const trimmed = entry.trim();
+    if (!win32.isAbsolute(trimmed)) continue;
+    candidates.push(win32.join(trimmed, "node_modules", "npm", "bin", "npm-cli.js"));
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const candidate of candidates) {
+    const normalized = win32.normalize(candidate);
+    const key = normalized.toLowerCase();
+    if (seen.has(key) || !isNpmCliPath(normalized)) continue;
+    seen.add(key);
+    if (fileExists(normalized)) return normalized;
+  }
+  return null;
+}
+function buildMaintenanceCommand(kind, {
+  platform = process.platform,
+  packageSpec: packageSpec2 = DEFAULT_RUNNER_PACKAGE,
+  env = process.env,
+  execPath = process.execPath,
+  fileExists = existsSync
+} = {}) {
+  if (!["update", "reinstall"].includes(kind)) return null;
+  if (!PACKAGE_SPEC_RE.test(packageSpec2)) throw new Error("unsafe runner package spec");
+  const npmCli = platform === "win32" ? resolveNpmCli({ env, execPath, fileExists }) : null;
+  if (platform === "win32" && !npmCli) throw new Error("trusted npm CLI not found");
+  const command = platform === "win32" ? execPath : "npm";
+  const args = [...npmCli ? [npmCli] : [], "install", "-g", packageSpec2];
+  if (kind === "reinstall") args.push("--force");
+  return { command, args };
+}
+
+// src/update.ts
 var DEFAULT_UPDATE_SPEC = "@algosuite/vo-mcp@beta";
 function packageVersion() {
   try {
@@ -12,20 +65,29 @@ function packageVersion() {
     return "unknown";
   }
 }
-function npmCommand(platform) {
-  return platform === "win32" ? "npm.cmd" : "npm";
-}
-function buildUpdateCommand(packageSpec2 = DEFAULT_UPDATE_SPEC, platform = process.platform) {
-  return {
-    command: npmCommand(platform),
-    args: ["install", "-g", packageSpec2]
-  };
+function buildUpdateCommand(packageSpec2 = DEFAULT_UPDATE_SPEC, platform = process.platform, runtime = {}) {
+  const command = buildMaintenanceCommand("update", {
+    packageSpec: packageSpec2,
+    platform,
+    env: runtime.env,
+    execPath: runtime.execPath,
+    fileExists: runtime.fileExists
+  });
+  if (!command) throw new Error("update command unavailable");
+  return command;
 }
 function updateVoMcp(opts = {}) {
   const log = opts.log ?? ((message) => console.error(message));
   const platform = opts.platform ?? process.platform;
   const packageSpec2 = opts.packageSpec?.trim() || DEFAULT_UPDATE_SPEC;
-  const { command, args } = buildUpdateCommand(packageSpec2, platform);
+  let command;
+  let args;
+  try {
+    ({ command, args } = buildUpdateCommand(packageSpec2, platform, opts));
+  } catch (error) {
+    log(`Update unavailable: ${error instanceof Error ? error.message : String(error)}`);
+    return { ok: false, status: 2, command: "", args: [], skipped: false };
+  }
   log("=== vo-mcp updater ===");
   log(`Current installed package version: ${packageVersion()}`);
   log(`Updating MCP + runner with: ${command} ${args.join(" ")}`);
@@ -33,10 +95,11 @@ function updateVoMcp(opts = {}) {
     log("Dry run only - no package changes made.");
     return { ok: true, status: 0, command, args, skipped: true };
   }
-  const run = opts.spawn ?? spawnSync;
+  const run = opts.spawn ?? spawnSync2;
   const result2 = run(command, args, {
     stdio: "inherit",
-    shell: platform === "win32",
+    shell: false,
+    windowsHide: true,
     env: opts.env ?? process.env
   });
   const status = typeof result2.status === "number" ? result2.status : 1;

package/dist/update-cli.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
-  "sources": ["../src/update.ts", "../src/update-cli.ts"],
-  "sourcesContent": ["/**\n * `vo-mcp update` - product-level updater for the MCP + runner package.\n *\n * Users should not have to uninstall/reinstall to pick up a new bundled runner.\n * The package is installed globally, so updating the single npm package updates\n * both `vo-mcp` and `vo-mcp runner` together.\n */\nimport { spawnSync } from 'node:child_process';\nimport { createRequire } from 'node:module';\n\nexport const DEFAULT_UPDATE_SPEC = '@algosuite/vo-mcp@beta';\n\nexport interface UpdateOptions {\n  readonly packageSpec?: string;\n  readonly dryRun?: boolean;\n  readonly log?: (message: string) => void;\n  readonly spawn?: typeof spawnSync;\n  readonly platform?: NodeJS.Platform;\n  readonly env?: NodeJS.ProcessEnv;\n}\n\nexport interface UpdateResult {\n  readonly ok: boolean;\n  readonly status: number;\n  readonly command: string;\n  readonly args: readonly string[];\n  readonly skipped: boolean;\n}\n\nfunction packageVersion(): string {\n  try {\n    return createRequire(import.meta.url)('../package.json').version || 'unknown';\n  } catch {\n    return 'unknown';\n  }\n}\n\nfunction npmCommand(platform: NodeJS.Platform): string {\n  return platform === 'win32' ? 'npm.cmd' : 'npm';\n}\n\nexport function buildUpdateCommand(\n  packageSpec = DEFAULT_UPDATE_SPEC,\n  platform: NodeJS.Platform = process.platform,\n): { command: string; args: string[] } {\n  return {\n    command: npmCommand(platform),\n    args: ['install', '-g', packageSpec],\n  };\n}\n\nexport function updateVoMcp(opts: UpdateOptions = {}): UpdateResult {\n  const log = opts.log ?? ((message: string) => console.error(message));\n  const platform = opts.platform ?? process.platform;\n  const packageSpec = opts.packageSpec?.trim() || DEFAULT_UPDATE_SPEC;\n  const { command, args } = buildUpdateCommand(packageSpec, platform);\n\n  log('=== vo-mcp updater ===');\n  log(`Current installed package version: ${packageVersion()}`);\n  log(`Updating MCP + runner with: ${command} ${args.join(' ')}`);\n\n  if (opts.dryRun) {\n    log('Dry run only - no package changes made.');\n    return { ok: true, status: 0, command, args, skipped: true };\n  }\n\n  const run = opts.spawn ?? spawnSync;\n  const result = run(command, args, {\n    stdio: 'inherit',\n    shell: platform === 'win32',\n    env: opts.env ?? process.env,\n  });\n  const status = typeof result.status === 'number' ? result.status : 1;\n  if (status !== 0) {\n    log(`Update failed with exit code ${status}.`);\n    return { ok: false, status, command, args, skipped: false };\n  }\n\n  log('\\nUpdate complete.');\n  log('Restart any running `vo-mcp runner` process so it loads the new bundle.');\n  log('If Claude Desktop / Claude Code was open, restart it to reload the MCP server.');\n  return { ok: true, status: 0, command, args, skipped: false };\n}\n", "#!/usr/bin/env node\n/**\n * `vo-mcp update` CLI entry point.\n */\nimport { updateVoMcp, DEFAULT_UPDATE_SPEC } from './update.js';\n\nfunction argValue(name: string): string | undefined {\n  const index = process.argv.indexOf(name);\n  return index >= 0 ? process.argv[index + 1] : undefined;\n}\n\nconst packageSpec = argValue('--package') || DEFAULT_UPDATE_SPEC;\nconst dryRun = process.argv.includes('--dry-run');\nconst result = updateVoMcp({ packageSpec, dryRun });\n\nprocess.exit(result.ok ? 0 : result.status || 1);\n"],
-  "mappings": ";;;;AAOA,SAAS,iBAAiB;AAC1B,SAAS,qBAAqB;AAEvB,IAAM,sBAAsB;AAmBnC,SAAS,iBAAyB;AAChC,MAAI;AACF,WAAO,cAAc,YAAY,GAAG,EAAE,iBAAiB,EAAE,WAAW;AAAA,EACtE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,WAAW,UAAmC;AACrD,SAAO,aAAa,UAAU,YAAY;AAC5C;AAEO,SAAS,mBACdA,eAAc,qBACd,WAA4B,QAAQ,UACC;AACrC,SAAO;AAAA,IACL,SAAS,WAAW,QAAQ;AAAA,IAC5B,MAAM,CAAC,WAAW,MAAMA,YAAW;AAAA,EACrC;AACF;AAEO,SAAS,YAAY,OAAsB,CAAC,GAAiB;AAClE,QAAM,MAAM,KAAK,QAAQ,CAAC,YAAoB,QAAQ,MAAM,OAAO;AACnE,QAAM,WAAW,KAAK,YAAY,QAAQ;AAC1C,QAAMA,eAAc,KAAK,aAAa,KAAK,KAAK;AAChD,QAAM,EAAE,SAAS,KAAK,IAAI,mBAAmBA,cAAa,QAAQ;AAElE,MAAI,wBAAwB;AAC5B,MAAI,sCAAsC,eAAe,CAAC,EAAE;AAC5D,MAAI,+BAA+B,OAAO,IAAI,KAAK,KAAK,GAAG,CAAC,EAAE;AAE9D,MAAI,KAAK,QAAQ;AACf,QAAI,yCAAyC;AAC7C,WAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,SAAS,MAAM,SAAS,KAAK;AAAA,EAC7D;AAEA,QAAM,MAAM,KAAK,SAAS;AAC1B,QAAMC,UAAS,IAAI,SAAS,MAAM;AAAA,IAChC,OAAO;AAAA,IACP,OAAO,aAAa;AAAA,IACpB,KAAK,KAAK,OAAO,QAAQ;AAAA,EAC3B,CAAC;AACD,QAAM,SAAS,OAAOA,QAAO,WAAW,WAAWA,QAAO,SAAS;AACnE,MAAI,WAAW,GAAG;AAChB,QAAI,gCAAgC,MAAM,GAAG;AAC7C,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS,MAAM,SAAS,MAAM;AAAA,EAC5D;AAEA,MAAI,oBAAoB;AACxB,MAAI,yEAAyE;AAC7E,MAAI,gFAAgF;AACpF,SAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,SAAS,MAAM,SAAS,MAAM;AAC9D;;;AC5EA,SAAS,SAAS,MAAkC;AAClD,QAAM,QAAQ,QAAQ,KAAK,QAAQ,IAAI;AACvC,SAAO,SAAS,IAAI,QAAQ,KAAK,QAAQ,CAAC,IAAI;AAChD;AAEA,IAAM,cAAc,SAAS,WAAW,KAAK;AAC7C,IAAM,SAAS,QAAQ,KAAK,SAAS,WAAW;AAChD,IAAM,SAAS,YAAY,EAAE,aAAa,OAAO,CAAC;AAElD,QAAQ,KAAK,OAAO,KAAK,IAAI,OAAO,UAAU,CAAC;",
-  "names": ["packageSpec", "result"]
+  "sources": ["../src/update.ts", "../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs", "../src/update-cli.ts"],
+  "sourcesContent": ["/**\n * `vo-mcp update` - product-level updater for the MCP + runner package.\n *\n * Users should not have to uninstall/reinstall to pick up a new bundled runner.\n * The package is installed globally, so updating the single npm package updates\n * both `vo-mcp` and `vo-mcp runner` together.\n */\nimport { spawnSync } from 'node:child_process';\nimport { createRequire } from 'node:module';\nimport { buildMaintenanceCommand } from '../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs';\n\nexport const DEFAULT_UPDATE_SPEC = '@algosuite/vo-mcp@beta';\n\nexport interface UpdateOptions {\n  readonly packageSpec?: string;\n  readonly dryRun?: boolean;\n  readonly log?: (message: string) => void;\n  readonly spawn?: typeof spawnSync;\n  readonly platform?: NodeJS.Platform;\n  readonly env?: NodeJS.ProcessEnv;\n  readonly execPath?: string;\n  readonly fileExists?: (path: string) => boolean;\n}\n\nexport interface UpdateResult {\n  readonly ok: boolean;\n  readonly status: number;\n  readonly command: string;\n  readonly args: readonly string[];\n  readonly skipped: boolean;\n}\n\nfunction packageVersion(): string {\n  try {\n    return createRequire(import.meta.url)('../package.json').version || 'unknown';\n  } catch {\n    return 'unknown';\n  }\n}\n\nexport function buildUpdateCommand(\n  packageSpec = DEFAULT_UPDATE_SPEC,\n  platform: NodeJS.Platform = process.platform,\n  runtime: Pick<UpdateOptions, 'env' | 'execPath' | 'fileExists'> = {},\n): { command: string; args: string[] } {\n  const command = buildMaintenanceCommand('update', {\n    packageSpec,\n    platform,\n    env: runtime.env,\n    execPath: runtime.execPath,\n    fileExists: runtime.fileExists,\n  });\n  if (!command) throw new Error('update command unavailable');\n  return command;\n}\n\nexport function updateVoMcp(opts: UpdateOptions = {}): UpdateResult {\n  const log = opts.log ?? ((message: string) => console.error(message));\n  const platform = opts.platform ?? process.platform;\n  const packageSpec = opts.packageSpec?.trim() || DEFAULT_UPDATE_SPEC;\n  let command: string;\n  let args: string[];\n  try {\n    ({ command, args } = buildUpdateCommand(packageSpec, platform, opts));\n  } catch (error) {\n    log(`Update unavailable: ${error instanceof Error ? error.message : String(error)}`);\n    return { ok: false, status: 2, command: '', args: [], skipped: false };\n  }\n\n  log('=== vo-mcp updater ===');\n  log(`Current installed package version: ${packageVersion()}`);\n  log(`Updating MCP + runner with: ${command} ${args.join(' ')}`);\n\n  if (opts.dryRun) {\n    log('Dry run only - no package changes made.');\n    return { ok: true, status: 0, command, args, skipped: true };\n  }\n\n  const run = opts.spawn ?? spawnSync;\n  const result = run(command, args, {\n    stdio: 'inherit',\n    shell: false,\n    windowsHide: true,\n    env: opts.env ?? process.env,\n  });\n  const status = typeof result.status === 'number' ? result.status : 1;\n  if (status !== 0) {\n    log(`Update failed with exit code ${status}.`);\n    return { ok: false, status, command, args, skipped: false };\n  }\n\n  log('\\nUpdate complete.');\n  log('Restart any running `vo-mcp runner` process so it loads the new bundle.');\n  log('If Claude Desktop / Claude Code was open, restart it to reload the MCP server.');\n  return { ok: true, status: 0, command, args, skipped: false };\n}\n", "/** Allow-listed host maintenance operations used by the runner supervisor. */\nimport { spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { win32 } from 'node:path';\n\nexport const DEFAULT_RUNNER_PACKAGE = '@algosuite/vo-mcp@beta';\nconst PACKAGE_SPEC_RE = /^@algosuite\\/vo-mcp@(beta|latest|\\d+(?:\\.\\d+){0,2}(?:-[\\w.-]+)?)$/u;\nconst MAX_DIAGNOSTIC_CHARS = 800;\nconst NPM_CLI_SUFFIX = `\\\\${win32.join('node_modules', 'npm', 'bin', 'npm-cli.js').toLowerCase()}`;\n\nfunction escapeRegExp(value) {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/gu, '\\\\$&');\n}\n\n/** Keep action detail useful without ever returning credentials or tokens. */\nexport function sanitizeMaintenanceDiagnostic(raw, env = {}) {\n  let value = String(raw || '')\n    .replace(/\\b(?:vocred|npm|gh[oprsu])_[A-Za-z0-9._-]+\\b/gu, '[REDACTED]')\n    .replace(/\\bBearer\\s+\\S+/giu, 'Bearer [REDACTED]')\n    .replace(/\\b(_?authToken|token|password|secret|credential)(\\s*[=:]\\s*)\\S+/giu, '$1$2[REDACTED]');\n  for (const [name, secret] of Object.entries(env)) {\n    if (!/(?:TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL)/iu.test(name)) continue;\n    const text = String(secret || '');\n    if (text.length < 4) continue;\n    value = value.replace(new RegExp(escapeRegExp(text), 'gu'), '[REDACTED]');\n  }\n  value = value.replace(/\\s+/gu, ' ').trim();\n  if (value.length <= MAX_DIAGNOSTIC_CHARS) return value;\n  return `${value.slice(0, MAX_DIAGNOSTIC_CHARS - 1)}\u2026`;\n}\n\nfunction isNpmCliPath(value) {\n  return typeof value === 'string'\n    && win32.isAbsolute(value)\n    && win32.normalize(value).toLowerCase().endsWith(NPM_CLI_SUFFIX);\n}\n\n/**\n * Resolve npm's JavaScript entrypoint without executing a Windows `.cmd` shim.\n *\n * The desktop app can run from a bundled node.exe that does not carry npm, so\n * resolution also checks the exact npm layout below absolute PATH entries. No\n * candidate controls the executable or package argv: process.execPath remains\n * the executable and the package spec remains allow-listed below.\n */\nexport function resolveNpmCli({\n  env = process.env,\n  execPath = process.execPath,\n  fileExists = existsSync,\n} = {}) {\n  const candidates = [];\n  if (isNpmCliPath(env.npm_execpath)) candidates.push(env.npm_execpath);\n  candidates.push(win32.join(win32.dirname(execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js'));\n\n  const pathValue = env.PATH ?? env.Path ?? env.path ?? '';\n  for (const entry of pathValue.split(';')) {\n    const trimmed = entry.trim();\n    if (!win32.isAbsolute(trimmed)) continue;\n    candidates.push(win32.join(trimmed, 'node_modules', 'npm', 'bin', 'npm-cli.js'));\n  }\n\n  const seen = new Set();\n  for (const candidate of candidates) {\n    const normalized = win32.normalize(candidate);\n    const key = normalized.toLowerCase();\n    if (seen.has(key) || !isNpmCliPath(normalized)) continue;\n    seen.add(key);\n    if (fileExists(normalized)) return normalized;\n  }\n  return null;\n}\n\nexport function buildMaintenanceCommand(kind, {\n  platform = process.platform,\n  packageSpec = DEFAULT_RUNNER_PACKAGE,\n  env = process.env,\n  execPath = process.execPath,\n  fileExists = existsSync,\n} = {}) {\n  if (!['update', 'reinstall'].includes(kind)) return null;\n  if (!PACKAGE_SPEC_RE.test(packageSpec)) throw new Error('unsafe runner package spec');\n  const npmCli = platform === 'win32' ? resolveNpmCli({ env, execPath, fileExists }) : null;\n  if (platform === 'win32' && !npmCli) throw new Error('trusted npm CLI not found');\n  const command = platform === 'win32' ? execPath : 'npm';\n  const args = [...(npmCli ? [npmCli] : []), 'install', '-g', packageSpec];\n  if (kind === 'reinstall') args.push('--force');\n  return { command, args };\n}\n\nexport function runHostMaintenance(kind, {\n  platform = process.platform,\n  packageSpec = DEFAULT_RUNNER_PACKAGE,\n  env = process.env,\n  execPath = process.execPath,\n  fileExists = existsSync,\n  spawn = spawnSync,\n  log = () => {},\n} = {}) {\n  if (kind === 'reconnect') return { ok: true, status: 0, command: null, args: [] };\n  let command;\n  try {\n    command = buildMaintenanceCommand(kind, { platform, packageSpec, env, execPath, fileExists });\n  } catch (error) {\n    return {\n      ok: false,\n      status: 2,\n      command: null,\n      args: [],\n      detail: sanitizeMaintenanceDiagnostic(error instanceof Error ? error.message : String(error), env),\n    };\n  }\n  if (!command) return { ok: false, status: 2, command: null, args: [] };\n  log(`runner maintenance: ${command.command} ${command.args.join(' ')}`);\n  const result = spawn(command.command, command.args, {\n    stdio: ['ignore', 'pipe', 'pipe'],\n    encoding: 'utf8',\n    env,\n    shell: false,\n    windowsHide: true,\n  });\n  const status = typeof result.status === 'number' ? result.status : 1;\n  const detail = sanitizeMaintenanceDiagnostic(\n    [result.stderr, result.stdout, result.error?.message].filter(Boolean).join('\\n'),\n    env,\n  );\n  if (detail) log(`runner maintenance result: ${detail}`);\n  return { ok: status === 0, status, command: command.command, args: command.args, detail };\n}\n", "#!/usr/bin/env node\n/**\n * `vo-mcp update` CLI entry point.\n */\nimport { updateVoMcp, DEFAULT_UPDATE_SPEC } from './update.js';\n\nfunction argValue(name: string): string | undefined {\n  const index = process.argv.indexOf(name);\n  return index >= 0 ? process.argv[index + 1] : undefined;\n}\n\nconst packageSpec = argValue('--package') || DEFAULT_UPDATE_SPEC;\nconst dryRun = process.argv.includes('--dry-run');\nconst result = updateVoMcp({ packageSpec, dryRun });\n\nprocess.exit(result.ok ? 0 : result.status || 1);\n"],
+  "mappings": ";;;;AAOA,SAAS,aAAAA,kBAAiB;AAC1B,SAAS,qBAAqB;;;ACP9B,SAAS,iBAAiB;AAC1B,SAAS,kBAAkB;AAC3B,SAAS,aAAa;AAEf,IAAM,yBAAyB;AACtC,IAAM,kBAAkB;AAExB,IAAM,iBAAiB,KAAK,MAAM,KAAK,gBAAgB,OAAO,OAAO,YAAY,EAAE,YAAY,CAAC;AAuBhG,SAAS,aAAa,OAAO;AAC3B,SAAO,OAAO,UAAU,YACnB,MAAM,WAAW,KAAK,KACtB,MAAM,UAAU,KAAK,EAAE,YAAY,EAAE,SAAS,cAAc;AACnE;AAUO,SAAS,cAAc;AAAA,EAC5B,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AACf,IAAI,CAAC,GAAG;AACN,QAAM,aAAa,CAAC;AACpB,MAAI,aAAa,IAAI,YAAY,EAAG,YAAW,KAAK,IAAI,YAAY;AACpE,aAAW,KAAK,MAAM,KAAK,MAAM,QAAQ,QAAQ,GAAG,gBAAgB,OAAO,OAAO,YAAY,CAAC;AAE/F,QAAM,YAAY,IAAI,QAAQ,IAAI,QAAQ,IAAI,QAAQ;AACtD,aAAW,SAAS,UAAU,MAAM,GAAG,GAAG;AACxC,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,MAAM,WAAW,OAAO,EAAG;AAChC,eAAW,KAAK,MAAM,KAAK,SAAS,gBAAgB,OAAO,OAAO,YAAY,CAAC;AAAA,EACjF;AAEA,QAAM,OAAO,oBAAI,IAAI;AACrB,aAAW,aAAa,YAAY;AAClC,UAAM,aAAa,MAAM,UAAU,SAAS;AAC5C,UAAM,MAAM,WAAW,YAAY;AACnC,QAAI,KAAK,IAAI,GAAG,KAAK,CAAC,aAAa,UAAU,EAAG;AAChD,SAAK,IAAI,GAAG;AACZ,QAAI,WAAW,UAAU,EAAG,QAAO;AAAA,EACrC;AACA,SAAO;AACT;AAEO,SAAS,wBAAwB,MAAM;AAAA,EAC5C,WAAW,QAAQ;AAAA,EACnB,aAAAC,eAAc;AAAA,EACd,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AACf,IAAI,CAAC,GAAG;AACN,MAAI,CAAC,CAAC,UAAU,WAAW,EAAE,SAAS,IAAI,EAAG,QAAO;AACpD,MAAI,CAAC,gBAAgB,KAAKA,YAAW,EAAG,OAAM,IAAI,MAAM,4BAA4B;AACpF,QAAM,SAAS,aAAa,UAAU,cAAc,EAAE,KAAK,UAAU,WAAW,CAAC,IAAI;AACrF,MAAI,aAAa,WAAW,CAAC,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AAChF,QAAM,UAAU,aAAa,UAAU,WAAW;AAClD,QAAM,OAAO,CAAC,GAAI,SAAS,CAAC,MAAM,IAAI,CAAC,GAAI,WAAW,MAAMA,YAAW;AACvE,MAAI,SAAS,YAAa,MAAK,KAAK,SAAS;AAC7C,SAAO,EAAE,SAAS,KAAK;AACzB;;;AD5EO,IAAM,sBAAsB;AAqBnC,SAAS,iBAAyB;AAChC,MAAI;AACF,WAAO,cAAc,YAAY,GAAG,EAAE,iBAAiB,EAAE,WAAW;AAAA,EACtE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,mBACdC,eAAc,qBACd,WAA4B,QAAQ,UACpC,UAAkE,CAAC,GAC9B;AACrC,QAAM,UAAU,wBAAwB,UAAU;AAAA,IAChD,aAAAA;AAAA,IACA;AAAA,IACA,KAAK,QAAQ;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB,YAAY,QAAQ;AAAA,EACtB,CAAC;AACD,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,4BAA4B;AAC1D,SAAO;AACT;AAEO,SAAS,YAAY,OAAsB,CAAC,GAAiB;AAClE,QAAM,MAAM,KAAK,QAAQ,CAAC,YAAoB,QAAQ,MAAM,OAAO;AACnE,QAAM,WAAW,KAAK,YAAY,QAAQ;AAC1C,QAAMA,eAAc,KAAK,aAAa,KAAK,KAAK;AAChD,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,KAAC,EAAE,SAAS,KAAK,IAAI,mBAAmBA,cAAa,UAAU,IAAI;AAAA,EACrE,SAAS,OAAO;AACd,QAAI,uBAAuB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AACnF,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,SAAS,IAAI,MAAM,CAAC,GAAG,SAAS,MAAM;AAAA,EACvE;AAEA,MAAI,wBAAwB;AAC5B,MAAI,sCAAsC,eAAe,CAAC,EAAE;AAC5D,MAAI,+BAA+B,OAAO,IAAI,KAAK,KAAK,GAAG,CAAC,EAAE;AAE9D,MAAI,KAAK,QAAQ;AACf,QAAI,yCAAyC;AAC7C,WAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,SAAS,MAAM,SAAS,KAAK;AAAA,EAC7D;AAEA,QAAM,MAAM,KAAK,SAASC;AAC1B,QAAMC,UAAS,IAAI,SAAS,MAAM;AAAA,IAChC,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK,KAAK,OAAO,QAAQ;AAAA,EAC3B,CAAC;AACD,QAAM,SAAS,OAAOA,QAAO,WAAW,WAAWA,QAAO,SAAS;AACnE,MAAI,WAAW,GAAG;AAChB,QAAI,gCAAgC,MAAM,GAAG;AAC7C,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS,MAAM,SAAS,MAAM;AAAA,EAC5D;AAEA,MAAI,oBAAoB;AACxB,MAAI,yEAAyE;AAC7E,MAAI,gFAAgF;AACpF,SAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,SAAS,MAAM,SAAS,MAAM;AAC9D;;;AEzFA,SAAS,SAAS,MAAkC;AAClD,QAAM,QAAQ,QAAQ,KAAK,QAAQ,IAAI;AACvC,SAAO,SAAS,IAAI,QAAQ,KAAK,QAAQ,CAAC,IAAI;AAChD;AAEA,IAAM,cAAc,SAAS,WAAW,KAAK;AAC7C,IAAM,SAAS,QAAQ,KAAK,SAAS,WAAW;AAChD,IAAM,SAAS,YAAY,EAAE,aAAa,OAAO,CAAC;AAElD,QAAQ,KAAK,OAAO,KAAK,IAAI,OAAO,UAAU,CAAC;",
+  "names": ["spawnSync", "packageSpec", "packageSpec", "spawnSync", "result"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@algosuite/vo-mcp",
-  "version": "0.2.0-beta.10",
+  "version": "0.2.0-beta.11",
   "description": "AlgoHQ MCP server — open protocol surface for the HQ consensus and ratchet tool family. Stdio transport, cross-vendor MCP client compatible (Claude Code, Claude Desktop, Codex, Cursor, Continue).",
   "license": "Apache-2.0",
   "type": "module",