@algosuite/vo-mcp 0.2.0-beta.11 → 0.2.0-beta.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/dist/cli.js +6 -0
  2. package/dist/cli.js.map +2 -2
  3. package/dist/index.js +6 -0
  4. package/dist/index.js.map +2 -2
  5. package/dist/install-cli.js.map +2 -2
  6. package/dist/login-cli.js.map +2 -2
  7. package/dist/pair-cli.js.map +2 -2
  8. package/dist/runner-cli.js +183 -19
  9. package/dist/runner-cli.js.map +3 -3
  10. package/dist/runner-supervisor.js +890 -28
  11. package/dist/runner-supervisor.js.map +4 -4
  12. package/dist/supervisor-credential-helper.js +8 -2
  13. package/dist/supervisor-credential-helper.js.map +2 -2
  14. package/package.json +1 -1
package/dist/runner-supervisor.js.map CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "version": 3,
3
- "sources": ["../src/runner/control-plane-auth-stub.mjs", "../src/runner-supervisor.mjs", "../../../scripts/virtual-office/code-runner/control-plane-client.mjs", "../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs", "../src/runner/supervisor-child-env.mjs", "../src/runner-readiness.mjs", "../src/runner/supervisor-credential-reader.mjs"],
4
- "sourcesContent": ["/**\n * Control-plane auth stub for the bundled `vo-mcp runner`.\n *\n * Replaces the daemon's lazy Firebase/SMOKE_* fallback\n * (`scripts/virtual-office/orchestrator-firestore/auth.mjs`), which pulls\n * `vo-config.mjs` (hardcoded Nexus Firebase project) + the firebase-admin chain.\n * A BYO runner ALWAYS authenticates with its own scoped `vo_credential` \u2014 read\n * from the OS keychain by `runner-cli.mjs` and injected as\n * `VO_CONTROL_PLANE_ADMIN_TOKEN` \u2014 so `control-plane-client.mjs`'s `resolveBearer`\n * returns early on the token and NEVER reaches this fallback. It exists only so\n * the bundle has nothing to resolve into the firebase chain; if it ever runs,\n * it fails LOUDLY with the fix.\n *\n * esbuild swaps this in for the heavy original at bundle time (see scripts/bundle.mjs).\n */\nexport async function getFirebaseAuth() {\n throw new Error(\n 'vo-mcp runner: no control-plane credential. Run `vo-mcp login` first \u2014 the runner ' +\n 'authenticates with your stored vo_credential (or set VO_CONTROL_PLANE_ADMIN_TOKEN).',\n );\n}\n", "/**\n * Persistent host supervisor for remote Mission Control maintenance.\n * The task daemon is a replaceable child; this process stays alive while it is\n * updated or repaired. Pairing credentials remain in the existing OS store.\n */\nimport { spawn } from 'node:child_process';\nimport { createRequire } from 'node:module';\nimport { fileURLToPath } from 'node:url';\nimport { dirname, join } from 'node:path';\nimport { createControlPlaneClient } from '../../../scripts/virtual-office/code-runner/control-plane-client.mjs';\nimport { runHostMaintenance } from '../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs';\nimport { prepareSupervisorAuth, resolveSupervisorRunnerId } from './runner/supervisor-child-env.mjs';\nimport { readStoredCredentialIsolated } from './runner/supervisor-credential-reader.mjs';\n\nconst DEFAULT_CONTROL_PLANE_URL = 'https://vo-control-plane-bzjphrajaq-uc.a.run.app';\nconst POLL_MS = 5000;\nconst CHILD_START_MS = 1500;\nconst childEntry = join(dirname(fileURLToPath(import.meta.url)), 'runner-cli.js');\nconst sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));\n\nconst runnerId = resolveSupervisorRunnerId(process.env);\n\nfunction packageVersion() {\n try { return createRequire(import.meta.url)('../package.json').version || 'unknown'; } catch { return 'unknown'; }\n}\n\nfunction spawnChild(childEnv) {\n return spawn(process.execPath, [childEntry], {\n env: childEnv,\n stdio: 'inherit',\n windowsHide: true,\n });\n}\n\nasync function localStatus() {\n try {\n const port = Number(process.env.VO_CODE_RUNNER_CONTROL_PORT || 7787);\n const response = await fetch(`http://127.0.0.1:${port}/status`, { signal: AbortSignal.timeout(800) });\n if (!response.ok) return null;\n const body = await response.json();\n return body?.ok === true ? body : null;\n } catch {\n return null;\n }\n}\n\nasync function waitForLocalRunner(child) {\n const deadline = Date.now() + 15_000;\n while (Date.now() < deadline) {\n if (child.exitCode !== null) return false;\n if ((await localStatus())?.running === true) return true;\n await sleep(500);\n }\n return false;\n}\n\nasync function stopChild(child) {\n if (!child || child.exitCode !== null) return;\n child.kill(process.platform === 'win32' ? undefined : 'SIGTERM');\n await Promise.race([\n new Promise((resolve) => child.once('exit', resolve)),\n sleep(15_000),\n ]);\n if (child.exitCode === null) child.kill('SIGKILL');\n}\n\nasync function main() {\n // Read keychain-backed credentials in a process that exits before npm ever\n // attempts to replace this package. Windows otherwise keeps the keyring DLL\n // locked for the full supervisor lifetime and global self-updates fail.\n const stored = readStoredCredentialIsolated();\n const controlPlaneUrl = process.env.VO_CONTROL_PLANE_URL || DEFAULT_CONTROL_PLANE_URL;\n const { childEnv, clientEnv, operatorId } = await prepareSupervisorAuth({\n baseEnv: process.env,\n storedCredential: stored,\n controlPlaneUrl,\n });\n const client = createControlPlaneClient({ baseUrl: controlPlaneUrl, env: clientEnv });\n let child = spawnChild(childEnv);\n let stopping = false;\n let handling = false;\n\n const respawn = () => {\n if (!stopping && !handling && (!child || child.exitCode !== null)) child = spawnChild(childEnv);\n };\n child.on('exit', () => setTimeout(respawn, 2000));\n\n const shutdown = async () => {\n if (stopping) return;\n stopping = true;\n await stopChild(child);\n };\n process.on('SIGINT', () => { void shutdown().finally(() => process.exit(0)); });\n process.on('SIGTERM', () => { void shutdown().finally(() => process.exit(0)); });\n\n while (!stopping) {\n try {\n const action = await client.pollRunnerControl({ runnerId, ...(operatorId ? { operatorId } : {}) });\n if (!action) {\n await sleep(POLL_MS);\n continue;\n }\n handling = true;\n const beforeStop = await localStatus();\n if (beforeStop && Number(beforeStop.activeTasks || 0) > 0) {\n await client.completeRunnerControl(action.actionId, {\n runnerId,\n ...(operatorId ? { operatorId } : {}),\n status: 'failed',\n detail: `deferred safely: ${beforeStop.activeTasks} active task(s); retry when the runner is idle`,\n });\n handling = false;\n continue;\n }\n await stopChild(child);\n const result = runHostMaintenance(action.kind, {\n env: clientEnv,\n log: (message) => console.warn(`[vo-runner supervisor] ${message}`),\n });\n child = spawnChild(childEnv);\n await sleep(CHILD_START_MS);\n if (child.exitCode !== null || !(await waitForLocalRunner(child))) result.ok = false;\n await client.completeRunnerControl(action.actionId, {\n runnerId,\n ...(operatorId ? { operatorId } : {}),\n status: result.ok ? 'succeeded' : 'failed',\n detail: result.ok\n ? `runner ${packageVersion()} reconnected`\n : `maintenance exited ${result.status}${result.detail ? `: ${result.detail}` : ''}`,\n });\n handling = false;\n } catch (error) {\n console.error(`[vo-runner supervisor] ${error instanceof Error ? error.message : String(error)}`);\n handling = false;\n await sleep(POLL_MS);\n }\n }\n}\n\nmain().catch((error) => {\n console.error(`[vo-runner supervisor] fatal: ${error instanceof Error ? error.message : String(error)}`);\n process.exitCode = 1;\n});\n", "/**\n * control-plane-client \u2014 the runner's OUTBOUND link to vo-control-plane.\n *\n * Increment 6 (Code-from-Anywhere). The daemon never exposes a port; it reaches\n * OUT to the control-plane (no inbound hole, no Tailscale \u2014 design \u00A72). Auth:\n * prefer the static admin token (`VO_CONTROL_PLANE_ADMIN_TOKEN`, the V1 local\n * dogfood path); fall back to a per-user Firebase ID token via the shared\n * orchestrator auth (`SMOKE_*` creds \u2192 allow-listed operator \u2192 admin).\n *\n * Endpoints used:\n * POST /api/v1/code-task/claim \u2192 claim the next pending task\n * PATCH /api/v1/code-task/:id/progress \u2192 stream progress / set terminal\n * GET /api/v1/code-task/:id \u2192 poll status (cancel detection)\n * POST /api/v1/code-task/:id/resume \u2192 continue a partial/max-turn task\n * POST /api/v1/admin/pr/merge \u2192 CI-green exact-SHA consensus merge\n */\n\nlet cachedFirebaseToken = null;\n\nasync function resolveBearer(env) {\n const adminToken = env.VO_CONTROL_PLANE_ADMIN_TOKEN;\n if (adminToken) return adminToken;\n if (cachedFirebaseToken) return cachedFirebaseToken;\n // Lazy import \u2014 Firebase auth is only needed when no admin token is present.\n const { getFirebaseAuth } = await import('../orchestrator-firestore/auth.mjs');\n const auth = await getFirebaseAuth({ env });\n if (!auth || !auth.idToken) {\n throw new Error(\n 'no control-plane credential: set VO_CONTROL_PLANE_ADMIN_TOKEN, or SMOKE_EMAIL/SMOKE_PASSWORD/SMOKE_API_KEY',\n );\n }\n cachedFirebaseToken = auth.idToken;\n return cachedFirebaseToken;\n}\n\n/**\n * Build a client. `baseUrl` defaults to `VO_CONTROL_PLANE_URL`. `fetchImpl`\n * and `env` are injectable for tests.\n */\nexport function createControlPlaneClient({\n baseUrl = process.env.VO_CONTROL_PLANE_URL || '',\n env = process.env,\n fetchImpl = fetch,\n} = {}) {\n if (!baseUrl) {\n throw new Error('VO_CONTROL_PLANE_URL is required for the code-runner daemon');\n }\n const root = baseUrl.replace(/\\/+$/, '');\n\n async function req(method, path, body) {\n const bearer = await resolveBearer(env);\n return fetchImpl(`${root}${path}`, {\n method,\n headers: {\n 'content-type': 'application/json',\n authorization: `Bearer ${bearer}`,\n },\n body: body === undefined ? undefined : JSON.stringify(body),\n });\n }\n\n return {\n /**\n * Claim the next pending task. Returns the task or null (empty queue).\n * `repos` (optional `owner/name` list) and `operatorIds` (optional\n * `operator_id` list) scope the claim so this daemon only picks up tasks it\n * serves \u2014 the control-plane filters by both (logical AND), so another\n * operator's task never lands on (or bills) this machine.\n */\n async claim(runnerId, repos, operatorIds, session = {}) {\n const body = { runner_id: runnerId };\n if (Array.isArray(repos) && repos.length > 0) body.repos = repos;\n if (Array.isArray(operatorIds) && operatorIds.length > 0) body.operator_ids = operatorIds;\n if (session.runnerInstanceId) body.runner_instance_id = session.runnerInstanceId;\n if (session.runnerInstanceId && session.reconcileStale) body.reconcile_stale = true;\n const res = await req('POST', '/api/v1/code-task/claim', body);\n if (res.status === 401) {\n cachedFirebaseToken = null; // force re-auth next call\n throw new Error('claim unauthorized (401)');\n }\n if (!res.ok) throw new Error(`claim failed: HTTP ${res.status}`);\n const json = await res.json();\n return json && json.task ? json.task : null;\n },\n\n /**\n * Enqueue a new code-task (used by the PR watcher to auto-dispatch a CI fix).\n * Server derives operator/tenant from the daemon's authenticated principal.\n * Returns the created task, or throws on a non-2xx response.\n */\n async enqueueCodeTask({ repo, prompt, max_budget_usd, max_turns }) {\n const body = { repo, prompt };\n if (typeof max_budget_usd === 'number') body.max_budget_usd = max_budget_usd;\n if (typeof max_turns === 'number') body.max_turns = max_turns;\n const res = await req('POST', '/api/v1/code-task', body);\n if (res.status === 401) {\n cachedFirebaseToken = null;\n throw new Error('enqueue unauthorized (401)');\n }\n if (!res.ok) throw new Error(`enqueue failed: HTTP ${res.status}`);\n const json = await res.json();\n return json && json.task ? json.task : null;\n },\n\n /**\n * Resume a failed/cancelled/max-turn partial code-task. The PR watcher uses\n * this after the runner opens a partial draft PR and CI is no longer pending.\n */\n async resumeCodeTask(taskId) {\n const res = await req('POST', `/api/v1/code-task/${encodeURIComponent(taskId)}/resume`, {});\n if (res.status === 401) {\n cachedFirebaseToken = null;\n throw new Error('resume unauthorized (401)');\n }\n if (!res.ok) throw new Error(`resume failed: HTTP ${res.status}`);\n const json = await res.json();\n return json && json.task ? json.task : null;\n },\n\n /**\n * Send a CI-green PR through the production verify-before-act merge route.\n * The server inspects the current diff, applies deterministic blockers, runs\n * consensus, records a receipt, and direct-merges only the inspected SHA.\n */\n async mergeVerifiedPr(prNumber, automationContext) {\n const res = await req('POST', '/api/v1/admin/pr/merge', { prNumber, automationContext });\n if (res.status === 401) {\n cachedFirebaseToken = null;\n throw new Error('gated merge unauthorized (401)');\n }\n const json = await res.json().catch(() => ({}));\n if (res.ok && json?.ok === true) {\n const result = json?.result && typeof json.result === 'object' ? json.result : {};\n const status = result.merged === true || result.status === 'merged'\n ? 'merged'\n : result.status === 'auto-merge-enabled' || String(result.action || '').includes('auto-merge')\n ? 'queued'\n : 'accepted';\n return {\n status,\n detail: typeof result.detail === 'string' ? result.detail : null,\n actionReceiptId: typeof json.action_receipt_id === 'string' ? json.action_receipt_id : null,\n };\n }\n if (res.status === 503 && json?.error === 'verify_unavailable') {\n return { status: 'retry', reason: json.reason || 'verification unavailable' };\n }\n return {\n status: 'blocked',\n reason: json?.reason || json?.message || json?.error || `HTTP ${res.status}`,\n actionReceiptId: typeof json?.action_receipt_id === 'string' ? json.action_receipt_id : null,\n };\n },\n\n /**\n * Append progress / set terminal status. Returns\n * { task } \u2014 applied\n * { terminal: true } \u2014 task already terminal (operator cancelled): STOP\n */\n async postProgress(taskId, patch) {\n const res = await req('PATCH', `/api/v1/code-task/${taskId}/progress`, patch);\n if (res.status === 409) return { terminal: true };\n if (res.status === 404) return { terminal: true, missing: true };\n if (!res.ok) throw new Error(`progress failed: HTTP ${res.status}`);\n const json = await res.json();\n return { task: json && json.task };\n },\n\n /** Read the current task (cancel detection). Null on 404. */\n async getTask(taskId) {\n const res = await req('GET', `/api/v1/code-task/${taskId}`);\n if (res.status === 404) return null;\n if (!res.ok) throw new Error(`getTask failed: HTTP ${res.status}`);\n const json = await res.json();\n return json ? json.task : null;\n },\n\n /** Fetch bounded, prompt-ready AlgoHQ knowledge snippets for this task. */\n async getTaskKnowledgeContext(taskId, { query } = {}) {\n const body = {};\n if (typeof query === 'string' && query.trim()) body.query = query;\n const res = await req('POST', `/api/v1/code-task/${encodeURIComponent(taskId)}/knowledge-context`, body);\n if (res.status === 401) {\n cachedFirebaseToken = null;\n throw new Error('knowledge-context unauthorized (401)');\n }\n if (res.status === 404) return null;\n if (!res.ok) throw new Error(`knowledge-context failed: HTTP ${res.status}`);\n return res.json();\n },\n\n /**\n * Report this machine's rolling-7-day Claude Code token usage (the real\n * weekly-capacity gauge) PLUS the operator's real Claude weekly % (when\n * available). The daemon authenticates as admin, so the target `operatorId`\n * is named explicitly. Best-effort; throws on a non-2xx so the caller can\n * log + move on.\n *\n * `tokens` = { input_tokens, output_tokens, cache_creation_tokens, cache_read_tokens }.\n * Optional: `claudeWeeklyPct` (number) + `claudeWeeklyResetsAt` (ISO string | null).\n */\n async postWeeklyTokens({ operatorId, runnerId, tokens, claudeWeeklyPct, claudeWeeklyResetsAt }) {\n const body = {\n operator_id: operatorId,\n runner_id: runnerId,\n input_tokens: tokens.input_tokens,\n output_tokens: tokens.output_tokens,\n cache_creation_tokens: tokens.cache_creation_tokens,\n cache_read_tokens: tokens.cache_read_tokens,\n };\n if (typeof claudeWeeklyPct === 'number') {\n body.claude_weekly_pct = claudeWeeklyPct;\n }\n if (claudeWeeklyResetsAt !== undefined) {\n body.claude_weekly_resets_at = claudeWeeklyResetsAt;\n }\n const res = await req('POST', '/api/v1/weekly-tokens', body);\n if (res.status === 401) {\n cachedFirebaseToken = null;\n throw new Error('weekly-tokens unauthorized (401)');\n }\n if (!res.ok) throw new Error(`weekly-tokens failed: HTTP ${res.status}`);\n return true;\n },\n\n /**\n * Send a liveness heartbeat (M2). The control-plane upserts it under the\n * authenticated operator so the web shows a TRUE \"runner online\" signal.\n * Best-effort caller; throws on 401/non-ok so the daemon can log + retry.\n */\n async postHeartbeat({ runnerId, operatorId, uptimeSec, activeTasks, version, daemonVersion, servedRepos, servedOperators, availableAgents, accountUsage }) {\n const body = { runner_id: runnerId };\n if (operatorId) body.operator_id = operatorId;\n if (typeof uptimeSec === 'number') body.uptime_sec = uptimeSec;\n if (typeof activeTasks === 'number') body.active_tasks = activeTasks;\n if (version) body.version = version;\n if (daemonVersion) body.daemon_version = daemonVersion;\n if (Array.isArray(servedRepos) && servedRepos.length > 0) body.served_repos = servedRepos;\n if (Array.isArray(servedOperators) && servedOperators.length > 0) {\n body.served_operator_ids = servedOperators;\n }\n if (Array.isArray(availableAgents) && availableAgents.length > 0) {\n body.available_agents = availableAgents;\n }\n if (Array.isArray(accountUsage) && accountUsage.length > 0) {\n body.account_usage = accountUsage;\n }\n const res = await req('POST', '/api/v1/runner/heartbeat', body);\n if (res.status === 401) {\n cachedFirebaseToken = null;\n throw new Error('heartbeat unauthorized (401)');\n }\n if (!res.ok) throw new Error(`heartbeat failed: HTTP ${res.status}`);\n return true;\n },\n\n /** Poll one authenticated runner's durable Mission Control action queue. */\n async pollRunnerControl({ runnerId, operatorId }) {\n const body = { runner_id: runnerId };\n if (operatorId) body.operator_id = operatorId;\n const res = await req('POST', '/api/v1/runner/control/poll', body);\n if (res.status === 401) {\n cachedFirebaseToken = null;\n throw new Error('runner control poll unauthorized (401)');\n }\n if (!res.ok) throw new Error(`runner control poll failed: HTTP ${res.status}`);\n const json = await res.json();\n const action = json?.action;\n return action && typeof action.action_id === 'string' && action.action_id\n ? { ...action, actionId: action.action_id }\n : null;\n },\n\n /** Acknowledge a maintenance action after the host has restarted the child. */\n async completeRunnerControl(actionId, { runnerId, operatorId, status, detail }) {\n const body = { runner_id: runnerId, status };\n if (operatorId) body.operator_id = operatorId;\n if (detail) body.detail = detail;\n const res = await req('POST', `/api/v1/runner/control/${encodeURIComponent(actionId)}/complete`, body);\n if (res.status === 401) {\n cachedFirebaseToken = null;\n throw new Error('runner control completion unauthorized (401)');\n }\n if (!res.ok) throw new Error(`runner control completion failed: HTTP ${res.status}`);\n const json = await res.json();\n return json?.action || null;\n },\n\n /**\n * Mint a short-lived (~1h), repo-scoped GitHub App installation token for\n * THIS runner's operator (M3). The control-plane keys the mint on the\n * authenticated operator (ctx.operator_id), so the token covers only that\n * operator's installation.\n *\n * Returns { token, expiresAt } on success. In legacy/admin mode it returns\n * null on a miss so the caller may use ambient `gh`. In scoped-operator mode\n * callers pass `{ required: true }`, which fails closed instead of letting a\n * missing/mis-scoped installation fall through to the runner machine's `gh`.\n *\n * The minted token is only usable for push + PR if the GitHub App grants\n * BOTH `Contents: write` (git push) AND `Pull requests: write` (gh pr\n * create) \u2014 see docs/vo/github-app-setup-2026-06-18.md. A token missing\n * either scope fails at push (\u2192 ambient fallback) or at `gh pr create`.\n */\n async getInstallationToken({ required = false } = {}) {\n const fail = (reason) => {\n if (required) throw new Error(`installation-token required: ${reason}`);\n return null;\n };\n try {\n const res = await req('POST', '/api/v1/github/installation-token', {});\n if (!res.ok) return fail(`HTTP ${res.status}`);\n const json = await res.json();\n if (!json || !json.token) return fail('missing token');\n return { token: json.token, expiresAt: json.expires_at || null };\n } catch (err) {\n if (required) throw err;\n return null;\n }\n },\n\n /**\n * Read the operator's dispatch-mode config (Fast\u2192Ultracode effort setting).\n * Returns the mode string ('fast'|'standard'|'deep'|'ultra'|'ultracode'),\n * defaulting to 'standard' on any error. Never throws \u2014 best-effort.\n */\n async getDispatchMode() {\n try {\n const res = await req('GET', '/api/v1/dispatch-mode-config');\n if (!res.ok) return 'standard';\n const json = await res.json();\n return json?.dispatchMode || 'standard';\n } catch {\n return 'standard';\n }\n },\n };\n}\n", "/** Allow-listed host maintenance operations used by the runner supervisor. */\nimport { spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { win32 } from 'node:path';\n\nexport const DEFAULT_RUNNER_PACKAGE = '@algosuite/vo-mcp@beta';\nconst PACKAGE_SPEC_RE = /^@algosuite\\/vo-mcp@(beta|latest|\\d+(?:\\.\\d+){0,2}(?:-[\\w.-]+)?)$/u;\nconst MAX_DIAGNOSTIC_CHARS = 800;\nconst NPM_CLI_SUFFIX = `\\\\${win32.join('node_modules', 'npm', 'bin', 'npm-cli.js').toLowerCase()}`;\n\nfunction escapeRegExp(value) {\n return value.replace(/[.*+?^${}()|[\\]\\\\]/gu, '\\\\$&');\n}\n\n/** Keep action detail useful without ever returning credentials or tokens. */\nexport function sanitizeMaintenanceDiagnostic(raw, env = {}) {\n let value = String(raw || '')\n .replace(/\\b(?:vocred|npm|gh[oprsu])_[A-Za-z0-9._-]+\\b/gu, '[REDACTED]')\n .replace(/\\bBearer\\s+\\S+/giu, 'Bearer [REDACTED]')\n .replace(/\\b(_?authToken|token|password|secret|credential)(\\s*[=:]\\s*)\\S+/giu, '$1$2[REDACTED]');\n for (const [name, secret] of Object.entries(env)) {\n if (!/(?:TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL)/iu.test(name)) continue;\n const text = String(secret || '');\n if (text.length < 4) continue;\n value = value.replace(new RegExp(escapeRegExp(text), 'gu'), '[REDACTED]');\n }\n value = value.replace(/\\s+/gu, ' ').trim();\n if (value.length <= MAX_DIAGNOSTIC_CHARS) return value;\n return `${value.slice(0, MAX_DIAGNOSTIC_CHARS - 1)}\u2026`;\n}\n\nfunction isNpmCliPath(value) {\n return typeof value === 'string'\n && win32.isAbsolute(value)\n && win32.normalize(value).toLowerCase().endsWith(NPM_CLI_SUFFIX);\n}\n\n/**\n * Resolve npm's JavaScript entrypoint without executing a Windows `.cmd` shim.\n *\n * The desktop app can run from a bundled node.exe that does not carry npm, so\n * resolution also checks the exact npm layout below absolute PATH entries. No\n * candidate controls the executable or package argv: process.execPath remains\n * the executable and the package spec remains allow-listed below.\n */\nexport function resolveNpmCli({\n env = process.env,\n execPath = process.execPath,\n fileExists = existsSync,\n} = {}) {\n const candidates = [];\n if (isNpmCliPath(env.npm_execpath)) candidates.push(env.npm_execpath);\n candidates.push(win32.join(win32.dirname(execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js'));\n\n const pathValue = env.PATH ?? env.Path ?? env.path ?? '';\n for (const entry of pathValue.split(';')) {\n const trimmed = entry.trim();\n if (!win32.isAbsolute(trimmed)) continue;\n candidates.push(win32.join(trimmed, 'node_modules', 'npm', 'bin', 'npm-cli.js'));\n }\n\n const seen = new Set();\n for (const candidate of candidates) {\n const normalized = win32.normalize(candidate);\n const key = normalized.toLowerCase();\n if (seen.has(key) || !isNpmCliPath(normalized)) continue;\n seen.add(key);\n if (fileExists(normalized)) return normalized;\n }\n return null;\n}\n\nexport function buildMaintenanceCommand(kind, {\n platform = process.platform,\n packageSpec = DEFAULT_RUNNER_PACKAGE,\n env = process.env,\n execPath = process.execPath,\n fileExists = existsSync,\n} = {}) {\n if (!['update', 'reinstall'].includes(kind)) return null;\n if (!PACKAGE_SPEC_RE.test(packageSpec)) throw new Error('unsafe runner package spec');\n const npmCli = platform === 'win32' ? resolveNpmCli({ env, execPath, fileExists }) : null;\n if (platform === 'win32' && !npmCli) throw new Error('trusted npm CLI not found');\n const command = platform === 'win32' ? execPath : 'npm';\n const args = [...(npmCli ? [npmCli] : []), 'install', '-g', packageSpec];\n if (kind === 'reinstall') args.push('--force');\n return { command, args };\n}\n\nexport function runHostMaintenance(kind, {\n platform = process.platform,\n packageSpec = DEFAULT_RUNNER_PACKAGE,\n env = process.env,\n execPath = process.execPath,\n fileExists = existsSync,\n spawn = spawnSync,\n log = () => {},\n} = {}) {\n if (kind === 'reconnect') return { ok: true, status: 0, command: null, args: [] };\n let command;\n try {\n command = buildMaintenanceCommand(kind, { platform, packageSpec, env, execPath, fileExists });\n } catch (error) {\n return {\n ok: false,\n status: 2,\n command: null,\n args: [],\n detail: sanitizeMaintenanceDiagnostic(error instanceof Error ? error.message : String(error), env),\n };\n }\n if (!command) return { ok: false, status: 2, command: null, args: [] };\n log(`runner maintenance: ${command.command} ${command.args.join(' ')}`);\n const result = spawn(command.command, command.args, {\n stdio: ['ignore', 'pipe', 'pipe'],\n encoding: 'utf8',\n env,\n shell: false,\n windowsHide: true,\n });\n const status = typeof result.status === 'number' ? result.status : 1;\n const detail = sanitizeMaintenanceDiagnostic(\n [result.stderr, result.stdout, result.error?.message].filter(Boolean).join('\\n'),\n env,\n );\n if (detail) log(`runner maintenance result: ${detail}`);\n return { ok: status === 0, status, command: command.command, args: command.args, detail };\n}\n", "import { hostname as systemHostname } from 'node:os';\nimport { pairedOperatorScope, probeRunnerReadiness } from '../runner-readiness.mjs';\n\n/** Keep the supervisor's control-queue identity byte-identical to the daemon. */\nexport function resolveSupervisorRunnerId(env = {}, hostname = systemHostname) {\n const explicit = String(env.VO_CODE_RUNNER_ID || '').trim();\n return explicit || `vo-code-runner-${hostname()}`;\n}\n\n/** Build the daemon environment without mislabeling a paired credential as admin. */\nexport function buildSupervisorChildEnv({\n baseEnv = {},\n controlPlaneUrl,\n explicitAdminToken = null,\n pairedOperatorId = null,\n} = {}) {\n const childEnv = {\n ...baseEnv,\n VO_CONTROL_PLANE_URL: controlPlaneUrl,\n };\n const adminToken = typeof explicitAdminToken === 'string' ? explicitAdminToken.trim() : '';\n const operatorId = typeof pairedOperatorId === 'string' ? pairedOperatorId.trim() : '';\n\n if (adminToken) childEnv.VO_CONTROL_PLANE_ADMIN_TOKEN = adminToken;\n else delete childEnv.VO_CONTROL_PLANE_ADMIN_TOKEN;\n\n if (operatorId) childEnv.VO_CODE_RUNNER_OPERATOR_IDS = operatorId;\n return childEnv;\n}\n\n/** Resolve auth provenance once so the supervisor and child use the same scope. */\nexport async function prepareSupervisorAuth({\n baseEnv = {},\n storedCredential = null,\n controlPlaneUrl,\n probeReadiness = probeRunnerReadiness,\n} = {}) {\n const explicitAdminToken = baseEnv.VO_CONTROL_PLANE_ADMIN_TOKEN?.trim();\n const token = explicitAdminToken || storedCredential?.vo_credential;\n if (!token) throw new Error('runner is not paired; run `vo-mcp pair` once on this host');\n\n let operatorId = String(baseEnv.VO_CODE_RUNNER_OPERATOR_IDS || '')\n .split(/[\\s,]+/u)\n .filter(Boolean)[0] || undefined;\n if (!explicitAdminToken) {\n const readiness = await probeReadiness({ controlPlaneUrl, token, requireGithub: true });\n if (!readiness.ok) throw new Error(`runner readiness failed: ${readiness.message}`);\n operatorId = pairedOperatorScope(readiness) || undefined;\n if (!operatorId) throw new Error('runner readiness failed: paired operator scope is missing');\n }\n\n const childEnv = buildSupervisorChildEnv({\n baseEnv,\n controlPlaneUrl,\n explicitAdminToken,\n pairedOperatorId: explicitAdminToken ? null : operatorId,\n });\n const clientEnv = {\n ...baseEnv,\n VO_CONTROL_PLANE_ADMIN_TOKEN: token,\n VO_CONTROL_PLANE_URL: controlPlaneUrl,\n ...(operatorId ? { VO_CODE_RUNNER_OPERATOR_IDS: operatorId } : {}),\n };\n return { childEnv, clientEnv, operatorId };\n}\n", "/**\n * Server-backed readiness probe for a paired BYO runner.\n *\n * The credential itself is opaque, so its mere presence is not proof that it is\n * usable or still bound to an operator. `/auth/me` supplies that truth from the\n * authenticated control-plane context. Before daemon startup, the optional\n * GitHub probe also proves the operator can mint an installation token, so a\n * task is never claimed only to fail at publication setup.\n */\n\nfunction failed({ paired = false, operatorId = null, tenantId = null, githubReady = null, error, message }) {\n return { ok: false, paired, operatorId, tenantId, githubReady, error, message };\n}\n\nasync function responseBody(response) {\n try {\n const value = await response.json();\n return value && typeof value === 'object' ? value : {};\n } catch {\n return {};\n }\n}\n\nfunction serverMessage(body, fallback) {\n return typeof body.message === 'string' && body.message.trim() ? body.message.trim() : fallback;\n}\n\nasync function fetchWithTimeout(fetchImpl, url, init, timeoutMs) {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), timeoutMs);\n try {\n return await fetchImpl(url, { ...init, signal: controller.signal });\n } finally {\n clearTimeout(timer);\n }\n}\n\n/**\n * @param {{\n * controlPlaneUrl: string,\n * token: string,\n * fetchImpl?: typeof fetch,\n * requireGithub?: boolean,\n * timeoutMs?: number,\n * }} input\n */\nexport async function probeRunnerReadiness({\n controlPlaneUrl,\n token,\n fetchImpl = fetch,\n requireGithub = false,\n timeoutMs = 10_000,\n}) {\n const base = controlPlaneUrl.replace(/\\/+$/u, '');\n const headers = { authorization: `Bearer ${token}` };\n let identityResponse;\n try {\n identityResponse = await fetchWithTimeout(\n fetchImpl,\n `${base}/api/v1/auth/me`,\n { headers },\n timeoutMs,\n );\n } catch (error) {\n const detail = error instanceof Error ? error.message : String(error);\n return failed({\n error: 'control_plane_unreachable',\n message: `AlgoHQ could not be reached: ${detail}`,\n });\n }\n\n const identity = await responseBody(identityResponse);\n if (!identityResponse.ok) {\n return failed({\n error: 'credential_rejected',\n message: 'The saved pairing is expired or revoked. Pair this computer again.',\n });\n }\n if (\n identity.provisioned !== true ||\n identity.role !== 'operator' ||\n typeof identity.operator_id !== 'string' ||\n !identity.operator_id.trim() ||\n typeof identity.tenant_id !== 'string' ||\n !identity.tenant_id.trim()\n ) {\n return failed({\n error: 'operator_identity_missing',\n message: 'The pairing credential is valid but has no operator identity. Pair this computer again.',\n });\n }\n\n const operatorId = identity.operator_id.trim();\n const tenantId = identity.tenant_id.trim();\n if (!requireGithub) {\n return {\n ok: true,\n paired: true,\n operatorId,\n tenantId,\n githubReady: null,\n error: null,\n message: 'Paired to AlgoHQ.',\n };\n }\n\n let githubResponse;\n try {\n githubResponse = await fetchWithTimeout(\n fetchImpl,\n `${base}/api/v1/github/installation-token`,\n {\n method: 'POST',\n headers: { ...headers, 'content-type': 'application/json' },\n body: '{}',\n },\n timeoutMs,\n );\n } catch (error) {\n const detail = error instanceof Error ? error.message : String(error);\n return failed({\n paired: true,\n operatorId,\n tenantId,\n githubReady: false,\n error: 'github_preflight_unreachable',\n message: `GitHub publication readiness could not be checked: ${detail}`,\n });\n }\n\n const github = await responseBody(githubResponse);\n if (!githubResponse.ok || typeof github.token !== 'string' || !github.token) {\n const error = typeof github.error === 'string' && github.error ? github.error : 'github_not_ready';\n return failed({\n paired: true,\n operatorId,\n tenantId,\n githubReady: false,\n error,\n message: serverMessage(github, `GitHub publication preflight failed (HTTP ${githubResponse.status}).`),\n });\n }\n\n return {\n ok: true,\n paired: true,\n operatorId,\n tenantId,\n githubReady: true,\n error: null,\n message: 'Paired and ready to publish through the Algosuite GitHub App.',\n };\n}\n\nexport function pairedOperatorScope(readiness) {\n return readiness?.ok === true &&\n readiness?.paired === true &&\n typeof readiness.operatorId === 'string' &&\n readiness.operatorId.trim()\n ? readiness.operatorId.trim()\n : null;\n}\n", "import { spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport function defaultCredentialHelperPath(metaUrl = import.meta.url) {\n const moduleDir = dirname(fileURLToPath(metaUrl));\n const bundled = join(moduleDir, 'supervisor-credential-helper.js');\n const source = join(moduleDir, '..', 'supervisor-credential-helper.mjs');\n return existsSync(source) ? source : bundled;\n}\n\n/** Read the OS-keychain credential without loading its native module here. */\nexport function readStoredCredentialIsolated({\n spawn = spawnSync,\n execPath = process.execPath,\n helperPath = defaultCredentialHelperPath(),\n env = process.env,\n} = {}) {\n const result = spawn(execPath, [helperPath], {\n env,\n encoding: 'utf8',\n stdio: ['ignore', 'pipe', 'pipe'],\n shell: false,\n windowsHide: true,\n timeout: 10_000,\n });\n if (result.status !== 0) {\n throw new Error('runner credential helper could not read the paired credential');\n }\n try {\n const parsed = JSON.parse(String(result.stdout || ''));\n return parsed && typeof parsed === 'object' ? parsed : null;\n } catch {\n throw new Error('runner credential helper returned an invalid credential');\n }\n}\n"],
5
- "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAeA,eAAsB,kBAAkB;AACtC,QAAM,IAAI;AAAA,IACR;AAAA,EAEF;AACF;AApBA;AAAA;AAAA;AAAA;;;ACKA,SAAS,aAAa;AACtB,SAAS,qBAAqB;AAC9B,SAAS,iBAAAA,sBAAqB;AAC9B,SAAS,WAAAC,UAAS,QAAAC,aAAY;;;ACS9B,IAAI,sBAAsB;AAE1B,eAAe,cAAc,KAAK;AAChC,QAAM,aAAa,IAAI;AACvB,MAAI,WAAY,QAAO;AACvB,MAAI,oBAAqB,QAAO;AAEhC,QAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM;AAClC,QAAM,OAAO,MAAMA,iBAAgB,EAAE,IAAI,CAAC;AAC1C,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAS;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,wBAAsB,KAAK;AAC3B,SAAO;AACT;AAMO,SAAS,yBAAyB;AAAA,EACvC,UAAU,QAAQ,IAAI,wBAAwB;AAAA,EAC9C,MAAM,QAAQ;AAAA,EACd,YAAY;AACd,IAAI,CAAC,GAAG;AACN,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,QAAM,OAAO,QAAQ,QAAQ,QAAQ,EAAE;AAEvC,iBAAe,IAAI,QAAQ,MAAM,MAAM;AACrC,UAAM,SAAS,MAAM,cAAc,GAAG;AACtC,WAAO,UAAU,GAAG,IAAI,GAAG,IAAI,IAAI;AAAA,MACjC;AAAA,MACA,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,UAAU,MAAM;AAAA,MACjC;AAAA,MACA,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,IAC5D,CAAC;AAAA,EACH;AAEA,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQL,MAAM,MAAMC,WAAU,OAAO,aAAa,UAAU,CAAC,GAAG;AACtD,YAAM,OAAO,EAAE,WAAWA,UAAS;AACnC,UAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,MAAK,QAAQ;AAC3D,UAAI,MAAM,QAAQ,WAAW,KAAK,YAAY,SAAS,EAAG,MAAK,eAAe;AAC9E,UAAI,QAAQ,iBAAkB,MAAK,qBAAqB,QAAQ;AAChE,UAAI,QAAQ,oBAAoB,QAAQ,eAAgB,MAAK,kBAAkB;AAC/E,YAAM,MAAM,MAAM,IAAI,QAAQ,2BAA2B,IAAI;AAC7D,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,0BAA0B;AAAA,MAC5C;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,sBAAsB,IAAI,MAAM,EAAE;AAC/D,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAAA,IACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,gBAAgB,EAAE,MAAM,QAAQ,gBAAgB,UAAU,GAAG;AACjE,YAAM,OAAO,EAAE,MAAM,OAAO;AAC5B,UAAI,OAAO,mBAAmB,SAAU,MAAK,iBAAiB;AAC9D,UAAI,OAAO,cAAc,SAAU,MAAK,YAAY;AACpD,YAAM,MAAM,MAAM,IAAI,QAAQ,qBAAqB,IAAI;AACvD,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,4BAA4B;AAAA,MAC9C;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,wBAAwB,IAAI,MAAM,EAAE;AACjE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAAA,IACzC;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,eAAe,QAAQ;AAC3B,YAAM,MAAM,MAAM,IAAI,QAAQ,qBAAqB,mBAAmB,MAAM,CAAC,WAAW,CAAC,CAAC;AAC1F,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,2BAA2B;AAAA,MAC7C;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,uBAAuB,IAAI,MAAM,EAAE;AAChE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAAA,IACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,gBAAgB,UAAU,mBAAmB;AACjD,YAAM,MAAM,MAAM,IAAI,QAAQ,0BAA0B,EAAE,UAAU,kBAAkB,CAAC;AACvF,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,gCAAgC;AAAA,MAClD;AACA,YAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAI,IAAI,MAAM,MAAM,OAAO,MAAM;AAC/B,cAAM,SAAS,MAAM,UAAU,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,CAAC;AAChF,cAAM,SAAS,OAAO,WAAW,QAAQ,OAAO,WAAW,WACvD,WACA,OAAO,WAAW,wBAAwB,OAAO,OAAO,UAAU,EAAE,EAAE,SAAS,YAAY,IACzF,WACA;AACN,eAAO;AAAA,UACL;AAAA,UACA,QAAQ,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AAAA,UAC5D,iBAAiB,OAAO,KAAK,sBAAsB,WAAW,KAAK,oBAAoB;AAAA,QACzF;AAAA,MACF;AACA,UAAI,IAAI,WAAW,OAAO,MAAM,UAAU,sBAAsB;AAC9D,eAAO,EAAE,QAAQ,SAAS,QAAQ,KAAK,UAAU,2BAA2B;AAAA,MAC9E;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ,MAAM,UAAU,MAAM,WAAW,MAAM,SAAS,QAAQ,IAAI,MAAM;AAAA,QAC1E,iBAAiB,OAAO,MAAM,sBAAsB,WAAW,KAAK,oBAAoB;AAAA,MAC1F;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,aAAa,QAAQ,OAAO;AAChC,YAAM,MAAM,MAAM,IAAI,SAAS,qBAAqB,MAAM,aAAa,KAAK;AAC5E,UAAI,IAAI,WAAW,IAAK,QAAO,EAAE,UAAU,KAAK;AAChD,UAAI,IAAI,WAAW,IAAK,QAAO,EAAE,UAAU,MAAM,SAAS,KAAK;AAC/D,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,yBAAyB,IAAI,MAAM,EAAE;AAClE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,EAAE,MAAM,QAAQ,KAAK,KAAK;AAAA,IACnC;AAAA;AAAA,IAGA,MAAM,QAAQ,QAAQ;AACpB,YAAM,MAAM,MAAM,IAAI,OAAO,qBAAqB,MAAM,EAAE;AAC1D,UAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,wBAAwB,IAAI,MAAM,EAAE;AACjE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,OAAO,KAAK,OAAO;AAAA,IAC5B;AAAA;AAAA,IAGA,MAAM,wBAAwB,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAG;AACpD,YAAM,OAAO,CAAC;AACd,UAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAG,MAAK,QAAQ;AAC5D,YAAM,MAAM,MAAM,IAAI,QAAQ,qBAAqB,mBAAmB,MAAM,CAAC,sBAAsB,IAAI;AACvG,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,sCAAsC;AAAA,MACxD;AACA,UAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,kCAAkC,IAAI,MAAM,EAAE;AAC3E,aAAO,IAAI,KAAK;AAAA,IAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYA,MAAM,iBAAiB,EAAE,YAAY,UAAAA,WAAU,QAAQ,iBAAiB,qBAAqB,GAAG;AAC9F,YAAM,OAAO;AAAA,QACX,aAAa;AAAA,QACb,WAAWA;AAAA,QACX,cAAc,OAAO;AAAA,QACrB,eAAe,OAAO;AAAA,QACtB,uBAAuB,OAAO;AAAA,QAC9B,mBAAmB,OAAO;AAAA,MAC5B;AACA,UAAI,OAAO,oBAAoB,UAAU;AACvC,aAAK,oBAAoB;AAAA,MAC3B;AACA,UAAI,yBAAyB,QAAW;AACtC,aAAK,0BAA0B;AAAA,MACjC;AACA,YAAM,MAAM,MAAM,IAAI,QAAQ,yBAAyB,IAAI;AAC3D,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,kCAAkC;AAAA,MACpD;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,8BAA8B,IAAI,MAAM,EAAE;AACvE,aAAO;AAAA,IACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,cAAc,EAAE,UAAAA,WAAU,YAAY,WAAW,aAAa,SAAS,eAAe,aAAa,iBAAiB,iBAAiB,aAAa,GAAG;AACzJ,YAAM,OAAO,EAAE,WAAWA,UAAS;AACnC,UAAI,WAAY,MAAK,cAAc;AACnC,UAAI,OAAO,cAAc,SAAU,MAAK,aAAa;AACrD,UAAI,OAAO,gBAAgB,SAAU,MAAK,eAAe;AACzD,UAAI,QAAS,MAAK,UAAU;AAC5B,UAAI,cAAe,MAAK,iBAAiB;AACzC,UAAI,MAAM,QAAQ,WAAW,KAAK,YAAY,SAAS,EAAG,MAAK,eAAe;AAC9E,UAAI,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,GAAG;AAChE,aAAK,sBAAsB;AAAA,MAC7B;AACA,UAAI,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,GAAG;AAChE,aAAK,mBAAmB;AAAA,MAC1B;AACA,UAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,GAAG;AAC1D,aAAK,gBAAgB;AAAA,MACvB;AACA,YAAM,MAAM,MAAM,IAAI,QAAQ,4BAA4B,IAAI;AAC9D,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,8BAA8B;AAAA,MAChD;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0BAA0B,IAAI,MAAM,EAAE;AACnE,aAAO;AAAA,IACT;AAAA;AAAA,IAGA,MAAM,kBAAkB,EAAE,UAAAA,WAAU,WAAW,GAAG;AAChD,YAAM,OAAO,EAAE,WAAWA,UAAS;AACnC,UAAI,WAAY,MAAK,cAAc;AACnC,YAAM,MAAM,MAAM,IAAI,QAAQ,+BAA+B,IAAI;AACjE,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,wCAAwC;AAAA,MAC1D;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,oCAAoC,IAAI,MAAM,EAAE;AAC7E,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,SAAS,MAAM;AACrB,aAAO,UAAU,OAAO,OAAO,cAAc,YAAY,OAAO,YAC5D,EAAE,GAAG,QAAQ,UAAU,OAAO,UAAU,IACxC;AAAA,IACN;AAAA;AAAA,IAGA,MAAM,sBAAsB,UAAU,EAAE,UAAAA,WAAU,YAAY,QAAQ,OAAO,GAAG;AAC9E,YAAM,OAAO,EAAE,WAAWA,WAAU,OAAO;AAC3C,UAAI,WAAY,MAAK,cAAc;AACnC,UAAI,OAAQ,MAAK,SAAS;AAC1B,YAAM,MAAM,MAAM,IAAI,QAAQ,0BAA0B,mBAAmB,QAAQ,CAAC,aAAa,IAAI;AACrG,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0CAA0C,IAAI,MAAM,EAAE;AACnF,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,MAAM,UAAU;AAAA,IACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAkBA,MAAM,qBAAqB,EAAE,WAAW,MAAM,IAAI,CAAC,GAAG;AACpD,YAAM,OAAO,CAAC,WAAW;AACvB,YAAI,SAAU,OAAM,IAAI,MAAM,gCAAgC,MAAM,EAAE;AACtE,eAAO;AAAA,MACT;AACA,UAAI;AACF,cAAM,MAAM,MAAM,IAAI,QAAQ,qCAAqC,CAAC,CAAC;AACrE,YAAI,CAAC,IAAI,GAAI,QAAO,KAAK,QAAQ,IAAI,MAAM,EAAE;AAC7C,cAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAI,CAAC,QAAQ,CAAC,KAAK,MAAO,QAAO,KAAK,eAAe;AACrD,eAAO,EAAE,OAAO,KAAK,OAAO,WAAW,KAAK,cAAc,KAAK;AAAA,MACjE,SAAS,KAAK;AACZ,YAAI,SAAU,OAAM;AACpB,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,kBAAkB;AACtB,UAAI;AACF,cAAM,MAAM,MAAM,IAAI,OAAO,8BAA8B;AAC3D,YAAI,CAAC,IAAI,GAAI,QAAO;AACpB,cAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,eAAO,MAAM,gBAAgB;AAAA,MAC/B,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;AChVA,SAAS,iBAAiB;AAC1B,SAAS,kBAAkB;AAC3B,SAAS,aAAa;AAEf,IAAM,yBAAyB;AACtC,IAAM,kBAAkB;AACxB,IAAM,uBAAuB;AAC7B,IAAM,iBAAiB,KAAK,MAAM,KAAK,gBAAgB,OAAO,OAAO,YAAY,EAAE,YAAY,CAAC;AAEhG,SAAS,aAAa,OAAO;AAC3B,SAAO,MAAM,QAAQ,wBAAwB,MAAM;AACrD;AAGO,SAAS,8BAA8B,KAAK,MAAM,CAAC,GAAG;AAC3D,MAAI,QAAQ,OAAO,OAAO,EAAE,EACzB,QAAQ,kDAAkD,YAAY,EACtE,QAAQ,qBAAqB,mBAAmB,EAChD,QAAQ,sEAAsE,gBAAgB;AACjG,aAAW,CAAC,MAAM,MAAM,KAAK,OAAO,QAAQ,GAAG,GAAG;AAChD,QAAI,CAAC,6CAA6C,KAAK,IAAI,EAAG;AAC9D,UAAM,OAAO,OAAO,UAAU,EAAE;AAChC,QAAI,KAAK,SAAS,EAAG;AACrB,YAAQ,MAAM,QAAQ,IAAI,OAAO,aAAa,IAAI,GAAG,IAAI,GAAG,YAAY;AAAA,EAC1E;AACA,UAAQ,MAAM,QAAQ,SAAS,GAAG,EAAE,KAAK;AACzC,MAAI,MAAM,UAAU,qBAAsB,QAAO;AACjD,SAAO,GAAG,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC;AACpD;AAEA,SAAS,aAAa,OAAO;AAC3B,SAAO,OAAO,UAAU,YACnB,MAAM,WAAW,KAAK,KACtB,MAAM,UAAU,KAAK,EAAE,YAAY,EAAE,SAAS,cAAc;AACnE;AAUO,SAAS,cAAc;AAAA,EAC5B,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AACf,IAAI,CAAC,GAAG;AACN,QAAM,aAAa,CAAC;AACpB,MAAI,aAAa,IAAI,YAAY,EAAG,YAAW,KAAK,IAAI,YAAY;AACpE,aAAW,KAAK,MAAM,KAAK,MAAM,QAAQ,QAAQ,GAAG,gBAAgB,OAAO,OAAO,YAAY,CAAC;AAE/F,QAAM,YAAY,IAAI,QAAQ,IAAI,QAAQ,IAAI,QAAQ;AACtD,aAAW,SAAS,UAAU,MAAM,GAAG,GAAG;AACxC,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,MAAM,WAAW,OAAO,EAAG;AAChC,eAAW,KAAK,MAAM,KAAK,SAAS,gBAAgB,OAAO,OAAO,YAAY,CAAC;AAAA,EACjF;AAEA,QAAM,OAAO,oBAAI,IAAI;AACrB,aAAW,aAAa,YAAY;AAClC,UAAM,aAAa,MAAM,UAAU,SAAS;AAC5C,UAAM,MAAM,WAAW,YAAY;AACnC,QAAI,KAAK,IAAI,GAAG,KAAK,CAAC,aAAa,UAAU,EAAG;AAChD,SAAK,IAAI,GAAG;AACZ,QAAI,WAAW,UAAU,EAAG,QAAO;AAAA,EACrC;AACA,SAAO;AACT;AAEO,SAAS,wBAAwB,MAAM;AAAA,EAC5C,WAAW,QAAQ;AAAA,EACnB,cAAc;AAAA,EACd,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AACf,IAAI,CAAC,GAAG;AACN,MAAI,CAAC,CAAC,UAAU,WAAW,EAAE,SAAS,IAAI,EAAG,QAAO;AACpD,MAAI,CAAC,gBAAgB,KAAK,WAAW,EAAG,OAAM,IAAI,MAAM,4BAA4B;AACpF,QAAM,SAAS,aAAa,UAAU,cAAc,EAAE,KAAK,UAAU,WAAW,CAAC,IAAI;AACrF,MAAI,aAAa,WAAW,CAAC,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AAChF,QAAM,UAAU,aAAa,UAAU,WAAW;AAClD,QAAM,OAAO,CAAC,GAAI,SAAS,CAAC,MAAM,IAAI,CAAC,GAAI,WAAW,MAAM,WAAW;AACvE,MAAI,SAAS,YAAa,MAAK,KAAK,SAAS;AAC7C,SAAO,EAAE,SAAS,KAAK;AACzB;AAEO,SAAS,mBAAmB,MAAM;AAAA,EACvC,WAAW,QAAQ;AAAA,EACnB,cAAc;AAAA,EACd,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AAAA,EACb,OAAAC,SAAQ;AAAA,EACR,MAAM,MAAM;AAAA,EAAC;AACf,IAAI,CAAC,GAAG;AACN,MAAI,SAAS,YAAa,QAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,SAAS,MAAM,MAAM,CAAC,EAAE;AAChF,MAAI;AACJ,MAAI;AACF,cAAU,wBAAwB,MAAM,EAAE,UAAU,aAAa,KAAK,UAAU,WAAW,CAAC;AAAA,EAC9F,SAAS,OAAO;AACd,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,MAAM,CAAC;AAAA,MACP,QAAQ,8BAA8B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,GAAG;AAAA,IACnG;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,SAAS,MAAM,MAAM,CAAC,EAAE;AACrE,MAAI,uBAAuB,QAAQ,OAAO,IAAI,QAAQ,KAAK,KAAK,GAAG,CAAC,EAAE;AACtE,QAAM,SAASA,OAAM,QAAQ,SAAS,QAAQ,MAAM;AAAA,IAClD,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,UAAU;AAAA,IACV;AAAA,IACA,OAAO;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACD,QAAM,SAAS,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AACnE,QAAM,SAAS;AAAA,IACb,CAAC,OAAO,QAAQ,OAAO,QAAQ,OAAO,OAAO,OAAO,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAAA,IAC/E;AAAA,EACF;AACA,MAAI,OAAQ,KAAI,8BAA8B,MAAM,EAAE;AACtD,SAAO,EAAE,IAAI,WAAW,GAAG,QAAQ,SAAS,QAAQ,SAAS,MAAM,QAAQ,MAAM,OAAO;AAC1F;;;AC/HA,SAAS,YAAY,sBAAsB;;;ACU3C,SAAS,OAAO,EAAE,SAAS,OAAO,aAAa,MAAM,WAAW,MAAM,cAAc,MAAM,OAAO,QAAQ,GAAG;AAC1G,SAAO,EAAE,IAAI,OAAO,QAAQ,YAAY,UAAU,aAAa,OAAO,QAAQ;AAChF;AAEA,eAAe,aAAa,UAAU;AACpC,MAAI;AACF,UAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,WAAO,SAAS,OAAO,UAAU,WAAW,QAAQ,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,cAAc,MAAM,UAAU;AACrC,SAAO,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,KAAK,IAAI,KAAK,QAAQ,KAAK,IAAI;AACzF;AAEA,eAAe,iBAAiB,WAAW,KAAK,MAAM,WAAW;AAC/D,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAC5D,MAAI;AACF,WAAO,MAAM,UAAU,KAAK,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,CAAC;AAAA,EACpE,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAWA,eAAsB,qBAAqB;AAAA,EACzC;AAAA,EACA;AAAA,EACA,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,YAAY;AACd,GAAG;AACD,QAAM,OAAO,gBAAgB,QAAQ,SAAS,EAAE;AAChD,QAAM,UAAU,EAAE,eAAe,UAAU,KAAK,GAAG;AACnD,MAAI;AACJ,MAAI;AACF,uBAAmB,MAAM;AAAA,MACvB;AAAA,MACA,GAAG,IAAI;AAAA,MACP,EAAE,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS,gCAAgC,MAAM;AAAA,IACjD,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,MAAM,aAAa,gBAAgB;AACpD,MAAI,CAAC,iBAAiB,IAAI;AACxB,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,SAAS,gBAAgB,QACzB,SAAS,SAAS,cAClB,OAAO,SAAS,gBAAgB,YAChC,CAAC,SAAS,YAAY,KAAK,KAC3B,OAAO,SAAS,cAAc,YAC9B,CAAC,SAAS,UAAU,KAAK,GACzB;AACA,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,SAAS,YAAY,KAAK;AAC7C,QAAM,WAAW,SAAS,UAAU,KAAK;AACzC,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,OAAO;AAAA,MACP,SAAS;AAAA,IACX;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,qBAAiB,MAAM;AAAA,MACrB;AAAA,MACA,GAAG,IAAI;AAAA,MACP;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,SAAS,gBAAgB,mBAAmB;AAAA,QAC1D,MAAM;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,WAAO,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,OAAO;AAAA,MACP,SAAS,sDAAsD,MAAM;AAAA,IACvE,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,MAAM,aAAa,cAAc;AAChD,MAAI,CAAC,eAAe,MAAM,OAAO,OAAO,UAAU,YAAY,CAAC,OAAO,OAAO;AAC3E,UAAM,QAAQ,OAAO,OAAO,UAAU,YAAY,OAAO,QAAQ,OAAO,QAAQ;AAChF,WAAO,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb;AAAA,MACA,SAAS,cAAc,QAAQ,6CAA6C,eAAe,MAAM,IAAI;AAAA,IACvG,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,EACX;AACF;AAEO,SAAS,oBAAoB,WAAW;AAC7C,SAAO,WAAW,OAAO,QACvB,WAAW,WAAW,QACtB,OAAO,UAAU,eAAe,YAChC,UAAU,WAAW,KAAK,IACxB,UAAU,WAAW,KAAK,IAC1B;AACN;;;AD7JO,SAAS,0BAA0B,MAAM,CAAC,GAAG,WAAW,gBAAgB;AAC7E,QAAM,WAAW,OAAO,IAAI,qBAAqB,EAAE,EAAE,KAAK;AAC1D,SAAO,YAAY,kBAAkB,SAAS,CAAC;AACjD;AAGO,SAAS,wBAAwB;AAAA,EACtC,UAAU,CAAC;AAAA,EACX;AAAA,EACA,qBAAqB;AAAA,EACrB,mBAAmB;AACrB,IAAI,CAAC,GAAG;AACN,QAAM,WAAW;AAAA,IACf,GAAG;AAAA,IACH,sBAAsB;AAAA,EACxB;AACA,QAAM,aAAa,OAAO,uBAAuB,WAAW,mBAAmB,KAAK,IAAI;AACxF,QAAM,aAAa,OAAO,qBAAqB,WAAW,iBAAiB,KAAK,IAAI;AAEpF,MAAI,WAAY,UAAS,+BAA+B;AAAA,MACnD,QAAO,SAAS;AAErB,MAAI,WAAY,UAAS,8BAA8B;AACvD,SAAO;AACT;AAGA,eAAsB,sBAAsB;AAAA,EAC1C,UAAU,CAAC;AAAA,EACX,mBAAmB;AAAA,EACnB;AAAA,EACA,iBAAiB;AACnB,IAAI,CAAC,GAAG;AACN,QAAM,qBAAqB,QAAQ,8BAA8B,KAAK;AACtE,QAAM,QAAQ,sBAAsB,kBAAkB;AACtD,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,2DAA2D;AAEvF,MAAI,aAAa,OAAO,QAAQ,+BAA+B,EAAE,EAC9D,MAAM,SAAS,EACf,OAAO,OAAO,EAAE,CAAC,KAAK;AACzB,MAAI,CAAC,oBAAoB;AACvB,UAAM,YAAY,MAAM,eAAe,EAAE,iBAAiB,OAAO,eAAe,KAAK,CAAC;AACtF,QAAI,CAAC,UAAU,GAAI,OAAM,IAAI,MAAM,4BAA4B,UAAU,OAAO,EAAE;AAClF,iBAAa,oBAAoB,SAAS,KAAK;AAC/C,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,2DAA2D;AAAA,EAC9F;AAEA,QAAM,WAAW,wBAAwB;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,qBAAqB,OAAO;AAAA,EAChD,CAAC;AACD,QAAM,YAAY;AAAA,IAChB,GAAG;AAAA,IACH,8BAA8B;AAAA,IAC9B,sBAAsB;AAAA,IACtB,GAAI,aAAa,EAAE,6BAA6B,WAAW,IAAI,CAAC;AAAA,EAClE;AACA,SAAO,EAAE,UAAU,WAAW,WAAW;AAC3C;;;AEhEA,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAEvB,SAAS,4BAA4B,UAAU,YAAY,KAAK;AACrE,QAAM,YAAY,QAAQ,cAAc,OAAO,CAAC;AAChD,QAAM,UAAU,KAAK,WAAW,iCAAiC;AACjE,QAAM,SAAS,KAAK,WAAW,MAAM,kCAAkC;AACvE,SAAOA,YAAW,MAAM,IAAI,SAAS;AACvC;AAGO,SAAS,6BAA6B;AAAA,EAC3C,OAAAC,SAAQF;AAAA,EACR,WAAW,QAAQ;AAAA,EACnB,aAAa,4BAA4B;AAAA,EACzC,MAAM,QAAQ;AAChB,IAAI,CAAC,GAAG;AACN,QAAM,SAASE,OAAM,UAAU,CAAC,UAAU,GAAG;AAAA,IAC3C;AAAA,IACA,UAAU;AAAA,IACV,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,EACX,CAAC;AACD,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO,OAAO,UAAU,EAAE,CAAC;AACrD,WAAO,UAAU,OAAO,WAAW,WAAW,SAAS;AAAA,EACzD,QAAQ;AACN,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACF;;;ALtBA,IAAM,4BAA4B;AAClC,IAAM,UAAU;AAChB,IAAM,iBAAiB;AACvB,IAAM,aAAaC,MAAKC,SAAQC,eAAc,YAAY,GAAG,CAAC,GAAG,eAAe;AAChF,IAAM,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAEtE,IAAM,WAAW,0BAA0B,QAAQ,GAAG;AAEtD,SAAS,iBAAiB;AACxB,MAAI;AAAE,WAAO,cAAc,YAAY,GAAG,EAAE,iBAAiB,EAAE,WAAW;AAAA,EAAW,QAAQ;AAAE,WAAO;AAAA,EAAW;AACnH;AAEA,SAAS,WAAW,UAAU;AAC5B,SAAO,MAAM,QAAQ,UAAU,CAAC,UAAU,GAAG;AAAA,IAC3C,KAAK;AAAA,IACL,OAAO;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACH;AAEA,eAAe,cAAc;AAC3B,MAAI;AACF,UAAM,OAAO,OAAO,QAAQ,IAAI,+BAA+B,IAAI;AACnE,UAAM,WAAW,MAAM,MAAM,oBAAoB,IAAI,WAAW,EAAE,QAAQ,YAAY,QAAQ,GAAG,EAAE,CAAC;AACpG,QAAI,CAAC,SAAS,GAAI,QAAO;AACzB,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,WAAO,MAAM,OAAO,OAAO,OAAO;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,mBAAmB,OAAO;AACvC,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,QAAI,MAAM,aAAa,KAAM,QAAO;AACpC,SAAK,MAAM,YAAY,IAAI,YAAY,KAAM,QAAO;AACpD,UAAM,MAAM,GAAG;AAAA,EACjB;AACA,SAAO;AACT;AAEA,eAAe,UAAU,OAAO;AAC9B,MAAI,CAAC,SAAS,MAAM,aAAa,KAAM;AACvC,QAAM,KAAK,QAAQ,aAAa,UAAU,SAAY,SAAS;AAC/D,QAAM,QAAQ,KAAK;AAAA,IACjB,IAAI,QAAQ,CAAC,YAAY,MAAM,KAAK,QAAQ,OAAO,CAAC;AAAA,IACpD,MAAM,IAAM;AAAA,EACd,CAAC;AACD,MAAI,MAAM,aAAa,KAAM,OAAM,KAAK,SAAS;AACnD;AAEA,eAAe,OAAO;AAIpB,QAAM,SAAS,6BAA6B;AAC5C,QAAM,kBAAkB,QAAQ,IAAI,wBAAwB;AAC5D,QAAM,EAAE,UAAU,WAAW,WAAW,IAAI,MAAM,sBAAsB;AAAA,IACtE,SAAS,QAAQ;AAAA,IACjB,kBAAkB;AAAA,IAClB;AAAA,EACF,CAAC;AACD,QAAM,SAAS,yBAAyB,EAAE,SAAS,iBAAiB,KAAK,UAAU,CAAC;AACpF,MAAI,QAAQ,WAAW,QAAQ;AAC/B,MAAI,WAAW;AACf,MAAI,WAAW;AAEf,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,YAAY,CAAC,aAAa,CAAC,SAAS,MAAM,aAAa,MAAO,SAAQ,WAAW,QAAQ;AAAA,EAChG;AACA,QAAM,GAAG,QAAQ,MAAM,WAAW,SAAS,GAAI,CAAC;AAEhD,QAAM,WAAW,YAAY;AAC3B,QAAI,SAAU;AACd,eAAW;AACX,UAAM,UAAU,KAAK;AAAA,EACvB;AACA,UAAQ,GAAG,UAAU,MAAM;AAAE,SAAK,SAAS,EAAE,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,EAAG,CAAC;AAC9E,UAAQ,GAAG,WAAW,MAAM;AAAE,SAAK,SAAS,EAAE,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,EAAG,CAAC;AAE/E,SAAO,CAAC,UAAU;AAChB,QAAI;AACF,YAAM,SAAS,MAAM,OAAO,kBAAkB,EAAE,UAAU,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC,EAAG,CAAC;AACjG,UAAI,CAAC,QAAQ;AACX,cAAM,MAAM,OAAO;AACnB;AAAA,MACF;AACA,iBAAW;AACX,YAAM,aAAa,MAAM,YAAY;AACrC,UAAI,cAAc,OAAO,WAAW,eAAe,CAAC,IAAI,GAAG;AACzD,cAAM,OAAO,sBAAsB,OAAO,UAAU;AAAA,UAClD;AAAA,UACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,UACnC,QAAQ;AAAA,UACR,QAAQ,oBAAoB,WAAW,WAAW;AAAA,QACpD,CAAC;AACD,mBAAW;AACX;AAAA,MACF;AACA,YAAM,UAAU,KAAK;AACrB,YAAM,SAAS,mBAAmB,OAAO,MAAM;AAAA,QAC7C,KAAK;AAAA,QACL,KAAK,CAAC,YAAY,QAAQ,KAAK,0BAA0B,OAAO,EAAE;AAAA,MACpE,CAAC;AACD,cAAQ,WAAW,QAAQ;AAC3B,YAAM,MAAM,cAAc;AAC1B,UAAI,MAAM,aAAa,QAAQ,CAAE,MAAM,mBAAmB,KAAK,EAAI,QAAO,KAAK;AAC/E,YAAM,OAAO,sBAAsB,OAAO,UAAU;AAAA,QAClD;AAAA,QACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,QACnC,QAAQ,OAAO,KAAK,cAAc;AAAA,QAClC,QAAQ,OAAO,KACX,UAAU,eAAe,CAAC,iBAC1B,sBAAsB,OAAO,MAAM,GAAG,OAAO,SAAS,KAAK,OAAO,MAAM,KAAK,EAAE;AAAA,MACrF,CAAC;AACD,iBAAW;AAAA,IACb,SAAS,OAAO;AACd,cAAQ,MAAM,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAChG,iBAAW;AACX,YAAM,MAAM,OAAO;AAAA,IACrB;AAAA,EACF;AACF;AAEA,KAAK,EAAE,MAAM,CAAC,UAAU;AACtB,UAAQ,MAAM,iCAAiC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AACvG,UAAQ,WAAW;AACrB,CAAC;",
6
- "names": ["fileURLToPath", "dirname", "join", "getFirebaseAuth", "runnerId", "spawn", "spawnSync", "existsSync", "spawn", "join", "dirname", "fileURLToPath"]
3
+ "sources": ["../src/runner/control-plane-auth-stub.mjs", "../src/runner-supervisor.mjs", "../../../scripts/virtual-office/code-runner/control-plane-client.mjs", "../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs", "../src/runner/bundled-runtime-updater.mjs", "../src/runner/bundled-runtime-store.mjs", "../src/runner/supervisor-activation.mjs", "../src/runner/supervisor-child-env.mjs", "../src/runner-readiness.mjs", "../src/runner/supervisor-credential-reader.mjs"],
4
+ "sourcesContent": ["/**\n * Control-plane auth stub for the bundled `vo-mcp runner`.\n *\n * Replaces the daemon's lazy Firebase/SMOKE_* fallback\n * (`scripts/virtual-office/orchestrator-firestore/auth.mjs`), which pulls\n * `vo-config.mjs` (hardcoded Nexus Firebase project) + the firebase-admin chain.\n * A BYO runner ALWAYS authenticates with its own scoped `vo_credential` \u2014 read\n * from the OS keychain by `runner-cli.mjs` and injected as\n * `VO_CONTROL_PLANE_ADMIN_TOKEN` \u2014 so `control-plane-client.mjs`'s `resolveBearer`\n * returns early on the token and NEVER reaches this fallback. It exists only so\n * the bundle has nothing to resolve into the firebase chain; if it ever runs,\n * it fails LOUDLY with the fix.\n *\n * esbuild swaps this in for the heavy original at bundle time (see scripts/bundle.mjs).\n */\nexport async function getFirebaseAuth() {\n throw new Error(\n 'vo-mcp runner: no control-plane credential. Run `vo-mcp login` first \u2014 the runner ' +\n 'authenticates with your stored vo_credential (or set VO_CONTROL_PLANE_ADMIN_TOKEN).',\n );\n}\n", "/**\n * Persistent host supervisor for remote Mission Control maintenance.\n * The task daemon is a replaceable child; this process stays alive while it is\n * updated or repaired. Pairing credentials remain in the existing OS store.\n */\nimport { spawn } from 'node:child_process';\nimport { randomUUID } from 'node:crypto';\nimport { createRequire } from 'node:module';\nimport { fileURLToPath } from 'node:url';\nimport { dirname, join } from 'node:path';\nimport { createControlPlaneClient } from '../../../scripts/virtual-office/code-runner/control-plane-client.mjs';\nimport { runHostMaintenance } from '../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs';\nimport { stageAndActivateBundledUpdate } from './runner/bundled-runtime-updater.mjs';\nimport { activationSupervisorInstanceId, runtimeRootFromEnv } from './runner/bundled-runtime-store.mjs';\nimport { finishPendingActivation } from './runner/supervisor-activation.mjs';\nimport { prepareSupervisorAuth, resolveSupervisorRunnerId } from './runner/supervisor-child-env.mjs';\nimport { readStoredCredentialIsolated } from './runner/supervisor-credential-reader.mjs';\n\nconst DEFAULT_CONTROL_PLANE_URL = 'https://vo-control-plane-bzjphrajaq-uc.a.run.app';\nconst POLL_MS = 5000;\nconst CHILD_START_MS = 1500;\nconst SUPERVISOR_CAPABILITIES = ['bundled-runtime-slots-v1'];\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;\nconst selfPath = fileURLToPath(import.meta.url);\nconst childEntry = join(dirname(selfPath), 'runner-cli.js');\nconst sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));\n\nconst runnerId = resolveSupervisorRunnerId(process.env);\n\nfunction packageVersion() {\n try { return createRequire(import.meta.url)('../package.json').version || 'unknown'; } catch { return 'unknown'; }\n}\n\nconst requestedSupervisorInstanceId = UUID_RE.test(String(process.env.VO_RUNNER_SUPERVISOR_INSTANCE_ID || ''))\n ? process.env.VO_RUNNER_SUPERVISOR_INSTANCE_ID\n : randomUUID();\nconst supervisorInstanceId = activationSupervisorInstanceId(\n runtimeRootFromEnv(process.env), requestedSupervisorInstanceId,\n);\nconst supervisorVersion = packageVersion();\nconst supervisorControlIdentity = {\n supervisorInstanceId,\n supervisorVersion,\n capabilities: SUPERVISOR_CAPABILITIES,\n};\n\nfunction spawnChild(childEnv) {\n return spawn(process.execPath, [childEntry], {\n env: childEnv,\n stdio: 'inherit',\n windowsHide: true,\n });\n}\n\nfunction spawnPreviousChild(entry, childEnv) {\n return spawn(process.execPath, [entry, 'runner'], {\n env: childEnv,\n stdio: 'inherit',\n windowsHide: true,\n });\n}\n\nasync function localStatus() {\n try {\n const port = Number(process.env.VO_CODE_RUNNER_CONTROL_PORT || 7787);\n const response = await fetch(`http://127.0.0.1:${port}/status`, { signal: AbortSignal.timeout(800) });\n if (!response.ok) return null;\n const body = await response.json();\n return body?.ok === true ? body : null;\n } catch {\n return null;\n }\n}\n\nasync function waitForLocalRunner(child) {\n const deadline = Date.now() + 15_000;\n while (Date.now() < deadline) {\n if (child.exitCode !== null) return false;\n const status = await localStatus();\n if (status?.running === true && Number(status.pid) === Number(child.pid)) return true;\n await sleep(500);\n }\n return false;\n}\n\nasync function stopChild(child) {\n if (!child || child.exitCode !== null) return;\n child.kill(process.platform === 'win32' ? undefined : 'SIGTERM');\n await Promise.race([\n new Promise((resolve) => child.once('exit', resolve)),\n sleep(15_000),\n ]);\n if (child.exitCode === null) child.kill('SIGKILL');\n}\n\nasync function main() {\n // Read keychain-backed credentials in a process that exits before npm ever\n // attempts to replace this package. Windows otherwise keeps the keyring DLL\n // locked for the full supervisor lifetime and global self-updates fail.\n const stored = readStoredCredentialIsolated();\n const controlPlaneUrl = process.env.VO_CONTROL_PLANE_URL || DEFAULT_CONTROL_PLANE_URL;\n const { childEnv, clientEnv, operatorId } = await prepareSupervisorAuth({\n baseEnv: process.env,\n storedCredential: stored,\n controlPlaneUrl,\n });\n Object.assign(childEnv, {\n VO_RUNNER_SUPERVISOR_INSTANCE_ID: supervisorInstanceId,\n VO_RUNNER_SUPERVISOR_VERSION: supervisorVersion,\n VO_RUNNER_SUPERVISOR_CAPABILITIES: SUPERVISOR_CAPABILITIES.join(','),\n });\n const client = createControlPlaneClient({ baseUrl: controlPlaneUrl, env: clientEnv });\n const runtimeRoot = runtimeRootFromEnv(process.env);\n let child = null;\n let stopping = false;\n let handling = false;\n\n const respawn = () => {\n if (!stopping && !handling && (!child || child.exitCode !== null)) child = launchChild();\n };\n const launchChild = () => {\n const next = spawnChild(childEnv);\n next.on('exit', () => setTimeout(respawn, 2000));\n return next;\n };\n child = launchChild();\n\n if (!(await finishPendingActivation({\n client,\n child,\n runtimeRoot,\n operatorId,\n runnerId,\n selfPath,\n packageVersion: supervisorVersion,\n supervisorIdentity: supervisorControlIdentity,\n waitForLocalRunner,\n localStatus,\n stopChild,\n launchPreviousChild: (entry) => spawnPreviousChild(entry, childEnv),\n log: (message) => console.error(`[vo-runner supervisor] ${message}`),\n }))) {\n stopping = true;\n return;\n }\n\n const shutdown = async () => {\n if (stopping) return;\n stopping = true;\n await stopChild(child);\n };\n process.on('SIGINT', () => { void shutdown().finally(() => process.exit(0)); });\n process.on('SIGTERM', () => { void shutdown().finally(() => process.exit(0)); });\n\n while (!stopping) {\n try {\n const action = await client.pollRunnerControl({\n runnerId,\n ...(operatorId ? { operatorId } : {}),\n ...supervisorControlIdentity,\n });\n if (!action) {\n await sleep(POLL_MS);\n continue;\n }\n handling = true;\n const beforeStop = await localStatus();\n if (beforeStop && Number(beforeStop.activeTasks || 0) > 0) {\n await client.completeRunnerControl(action.actionId, {\n runnerId,\n ...(operatorId ? { operatorId } : {}),\n ...supervisorControlIdentity,\n status: 'failed',\n detail: `deferred safely: ${beforeStop.activeTasks} active task(s); retry when the runner is idle`,\n });\n handling = false;\n continue;\n }\n await stopChild(child);\n const bundledAction = action.kind === 'update' || action.kind === 'reinstall';\n const result = bundledAction\n ? stageAndActivateBundledUpdate({\n runtimeRoot,\n packageSpec: `@algosuite/vo-mcp@${action.desired_package_version}`,\n expectedVersion: action.desired_package_version,\n expectedIntegrity: action.desired_package_integrity,\n action: {\n actionId: action.actionId,\n runnerId,\n operatorId: operatorId || '',\n supervisorInstanceId,\n },\n env: process.env,\n force: action.kind === 'reinstall',\n })\n : runHostMaintenance(action.kind, {\n env: clientEnv,\n log: (message) => console.warn(`[vo-runner supervisor] ${message}`),\n });\n if (result.ok && result.handoff) {\n console.warn(`[vo-runner supervisor] activated ${result.active.version}; exiting for new-process attestation`);\n return;\n }\n child = launchChild();\n await sleep(CHILD_START_MS);\n if (child.exitCode !== null || !(await waitForLocalRunner(child))) result.ok = false;\n await client.completeRunnerControl(action.actionId, {\n runnerId,\n ...(operatorId ? { operatorId } : {}),\n ...supervisorControlIdentity,\n status: result.ok ? 'succeeded' : 'failed',\n detail: result.ok\n ? `runner ${packageVersion()} reconnected`\n : `maintenance exited ${result.status}${result.detail ? `: ${result.detail}` : ''}`,\n });\n handling = false;\n } catch (error) {\n console.error(`[vo-runner supervisor] ${error instanceof Error ? error.message : String(error)}`);\n handling = false;\n await sleep(POLL_MS);\n }\n }\n}\n\nmain().catch((error) => {\n console.error(`[vo-runner supervisor] fatal: ${error instanceof Error ? error.message : String(error)}`);\n process.exitCode = 1;\n});\n", "/**\n * control-plane-client \u2014 the runner's OUTBOUND link to vo-control-plane.\n *\n * Increment 6 (Code-from-Anywhere). The daemon never exposes a port; it reaches\n * OUT to the control-plane (no inbound hole, no Tailscale \u2014 design \u00A72). Auth:\n * prefer the static admin token (`VO_CONTROL_PLANE_ADMIN_TOKEN`, the V1 local\n * dogfood path); fall back to a per-user Firebase ID token via the shared\n * orchestrator auth (`SMOKE_*` creds \u2192 allow-listed operator \u2192 admin).\n *\n * Endpoints used:\n * POST /api/v1/code-task/claim \u2192 claim the next pending task\n * PATCH /api/v1/code-task/:id/progress \u2192 stream progress / set terminal\n * GET /api/v1/code-task/:id \u2192 poll status (cancel detection)\n * POST /api/v1/code-task/:id/resume \u2192 continue a partial/max-turn task\n * POST /api/v1/admin/pr/merge \u2192 CI-green exact-SHA consensus merge\n */\n\nlet cachedFirebaseToken = null;\n\nasync function resolveBearer(env) {\n const adminToken = env.VO_CONTROL_PLANE_ADMIN_TOKEN;\n if (adminToken) return adminToken;\n if (cachedFirebaseToken) return cachedFirebaseToken;\n // Lazy import \u2014 Firebase auth is only needed when no admin token is present.\n const { getFirebaseAuth } = await import('../orchestrator-firestore/auth.mjs');\n const auth = await getFirebaseAuth({ env });\n if (!auth || !auth.idToken) {\n throw new Error(\n 'no control-plane credential: set VO_CONTROL_PLANE_ADMIN_TOKEN, or SMOKE_EMAIL/SMOKE_PASSWORD/SMOKE_API_KEY',\n );\n }\n cachedFirebaseToken = auth.idToken;\n return cachedFirebaseToken;\n}\n\n/**\n * Build a client. `baseUrl` defaults to `VO_CONTROL_PLANE_URL`. `fetchImpl`\n * and `env` are injectable for tests.\n */\nexport function createControlPlaneClient({\n baseUrl = process.env.VO_CONTROL_PLANE_URL || '',\n env = process.env,\n fetchImpl = fetch,\n heartbeatTimeoutMs = Math.min(\n Math.max(Number(env.VO_CODE_RUNNER_HEARTBEAT_TIMEOUT_MS) || 15_000, 1_000),\n 60_000,\n ),\n} = {}) {\n if (!baseUrl) {\n throw new Error('VO_CONTROL_PLANE_URL is required for the code-runner daemon');\n }\n const root = baseUrl.replace(/\\/+$/, '');\n\n async function req(method, path, body, { timeoutMs } = {}) {\n const bearer = await resolveBearer(env);\n const controller = timeoutMs ? new AbortController() : null;\n let timeoutId;\n const request = Promise.resolve(fetchImpl(`${root}${path}`, {\n method,\n headers: {\n 'content-type': 'application/json',\n authorization: `Bearer ${bearer}`,\n },\n body: body === undefined ? undefined : JSON.stringify(body),\n ...(controller ? { signal: controller.signal } : {}),\n }));\n if (!timeoutMs) return request;\n const timeout = new Promise((_, reject) => {\n timeoutId = setTimeout(() => {\n controller.abort();\n reject(new Error(`control-plane ${path} timed out after ${timeoutMs}ms`));\n }, timeoutMs);\n });\n try {\n return await Promise.race([request, timeout]);\n } finally {\n clearTimeout(timeoutId);\n }\n }\n\n return {\n /**\n * Claim the next pending task. Returns the task or null (empty queue).\n * `repos` (optional `owner/name` list) and `operatorIds` (optional\n * `operator_id` list) scope the claim so this daemon only picks up tasks it\n * serves \u2014 the control-plane filters by both (logical AND), so another\n * operator's task never lands on (or bills) this machine.\n */\n async claim(runnerId, repos, operatorIds, session = {}) {\n const body = { runner_id: runnerId };\n if (Array.isArray(repos) && repos.length > 0) body.repos = repos;\n if (Array.isArray(operatorIds) && operatorIds.length > 0) body.operator_ids = operatorIds;\n if (session.runnerInstanceId) body.runner_instance_id = session.runnerInstanceId;\n if (session.runnerInstanceId && session.reconcileStale) body.reconcile_stale = true;\n if (session.defaultAgent) body.default_agent = session.defaultAgent;\n if (Array.isArray(session.availableAgents)) {\n body.available_agents = session.availableAgents\n .filter((entry) => entry?.installed === true && entry?.authenticated === true)\n .map((entry) => entry.agent);\n }\n const res = await req('POST', '/api/v1/code-task/claim', body);\n if (res.status === 401) {\n cachedFirebaseToken = null; // force re-auth next call\n throw new Error('claim unauthorized (401)');\n }\n if (!res.ok) throw new Error(`claim failed: HTTP ${res.status}`);\n const json = await res.json();\n return json && json.task ? json.task : null;\n },\n\n /**\n * Enqueue a new code-task (used by the PR watcher to auto-dispatch a CI fix).\n * Server derives operator/tenant from the daemon's authenticated principal.\n * Returns the created task, or throws on a non-2xx response.\n */\n async enqueueCodeTask({ repo, prompt, max_budget_usd, max_turns }) {\n const body = { repo, prompt };\n if (typeof max_budget_usd === 'number') body.max_budget_usd = max_budget_usd;\n if (typeof max_turns === 'number') body.max_turns = max_turns;\n const res = await req('POST', '/api/v1/code-task', body);\n if (res.status === 401) {\n cachedFirebaseToken = null;\n throw new Error('enqueue unauthorized (401)');\n }\n if (!res.ok) throw new Error(`enqueue failed: HTTP ${res.status}`);\n const json = await res.json();\n return json && json.task ? json.task : null;\n },\n\n /**\n * Resume a failed/cancelled/max-turn partial code-task. The PR watcher uses\n * this after the runner opens a partial draft PR and CI is no longer pending.\n */\n async resumeCodeTask(taskId) {\n const res = await req('POST', `/api/v1/code-task/${encodeURIComponent(taskId)}/resume`, {});\n if (res.status === 401) {\n cachedFirebaseToken = null;\n throw new Error('resume unauthorized (401)');\n }\n if (!res.ok) throw new Error(`resume failed: HTTP ${res.status}`);\n const json = await res.json();\n return json && json.task ? json.task : null;\n },\n\n /**\n * Send a CI-green PR through the production verify-before-act merge route.\n * The server inspects the current diff, applies deterministic blockers, runs\n * consensus, records a receipt, and direct-merges only the inspected SHA.\n */\n async mergeVerifiedPr(prNumber, automationContext) {\n const res = await req('POST', '/api/v1/admin/pr/merge', { prNumber, automationContext });\n if (res.status === 401) {\n cachedFirebaseToken = null;\n throw new Error('gated merge unauthorized (401)');\n }\n const json = await res.json().catch(() => ({}));\n if (res.ok && json?.ok === true) {\n const result = json?.result && typeof json.result === 'object' ? json.result : {};\n const status = result.merged === true || result.status === 'merged'\n ? 'merged'\n : result.status === 'auto-merge-enabled' || String(result.action || '').includes('auto-merge')\n ? 'queued'\n : 'accepted';\n return {\n status,\n detail: typeof result.detail === 'string' ? result.detail : null,\n actionReceiptId: typeof json.action_receipt_id === 'string' ? json.action_receipt_id : null,\n };\n }\n if (res.status === 503 && json?.error === 'verify_unavailable') {\n return { status: 'retry', reason: json.reason || 'verification unavailable' };\n }\n return {\n status: 'blocked',\n reason: json?.reason || json?.message || json?.error || `HTTP ${res.status}`,\n actionReceiptId: typeof json?.action_receipt_id === 'string' ? json.action_receipt_id : null,\n };\n },\n\n /**\n * Append progress / set terminal status. Returns\n * { task } \u2014 applied\n * { terminal: true } \u2014 task already terminal (operator cancelled): STOP\n */\n async postProgress(taskId, patch) {\n const res = await req('PATCH', `/api/v1/code-task/${taskId}/progress`, patch);\n if (res.status === 409) return { terminal: true };\n if (res.status === 404) return { terminal: true, missing: true };\n if (!res.ok) throw new Error(`progress failed: HTTP ${res.status}`);\n const json = await res.json();\n return { task: json && json.task };\n },\n\n /** Read the current task (cancel detection). Null on 404. */\n async getTask(taskId) {\n const res = await req('GET', `/api/v1/code-task/${taskId}`);\n if (res.status === 404) return null;\n if (!res.ok) throw new Error(`getTask failed: HTTP ${res.status}`);\n const json = await res.json();\n return json ? json.task : null;\n },\n\n /** Fetch bounded, prompt-ready AlgoHQ knowledge snippets for this task. */\n async getTaskKnowledgeContext(taskId, { query } = {}) {\n const body = {};\n if (typeof query === 'string' && query.trim()) body.query = query;\n const res = await req('POST', `/api/v1/code-task/${encodeURIComponent(taskId)}/knowledge-context`, body);\n if (res.status === 401) {\n cachedFirebaseToken = null;\n throw new Error('knowledge-context unauthorized (401)');\n }\n if (res.status === 404) return null;\n if (!res.ok) throw new Error(`knowledge-context failed: HTTP ${res.status}`);\n return res.json();\n },\n\n /**\n * Report this machine's rolling-7-day Claude Code token usage (the real\n * weekly-capacity gauge) PLUS the operator's real Claude weekly % (when\n * available). The daemon authenticates as admin, so the target `operatorId`\n * is named explicitly. Best-effort; throws on a non-2xx so the caller can\n * log + move on.\n *\n * `tokens` = { input_tokens, output_tokens, cache_creation_tokens, cache_read_tokens }.\n * Optional: `claudeWeeklyPct` (number) + `claudeWeeklyResetsAt` (ISO string | null).\n */\n async postWeeklyTokens({ operatorId, runnerId, tokens, claudeWeeklyPct, claudeWeeklyResetsAt }) {\n const body = {\n operator_id: operatorId,\n runner_id: runnerId,\n input_tokens: tokens.input_tokens,\n output_tokens: tokens.output_tokens,\n cache_creation_tokens: tokens.cache_creation_tokens,\n cache_read_tokens: tokens.cache_read_tokens,\n };\n if (typeof claudeWeeklyPct === 'number') {\n body.claude_weekly_pct = claudeWeeklyPct;\n }\n if (claudeWeeklyResetsAt !== undefined) {\n body.claude_weekly_resets_at = claudeWeeklyResetsAt;\n }\n const res = await req('POST', '/api/v1/weekly-tokens', body);\n if (res.status === 401) {\n cachedFirebaseToken = null;\n throw new Error('weekly-tokens unauthorized (401)');\n }\n if (!res.ok) throw new Error(`weekly-tokens failed: HTTP ${res.status}`);\n return true;\n },\n\n /**\n * Send a liveness heartbeat (M2). The control-plane upserts it under the\n * authenticated operator so the web shows a TRUE \"runner online\" signal.\n * Best-effort caller; throws on 401/non-ok so the daemon can log + retry.\n */\n async postHeartbeat({ runnerId, runnerInstanceId, operatorId, uptimeSec, activeTasks, version, daemonVersion, defaultAgent, supervisorInstanceId, supervisorVersion, supervisorCapabilities, servedRepos, servedOperators, availableAgents, accountUsage }) {\n const body = { runner_id: runnerId };\n if (runnerInstanceId) body.runner_instance_id = runnerInstanceId;\n if (operatorId) body.operator_id = operatorId;\n if (typeof uptimeSec === 'number') body.uptime_sec = uptimeSec;\n if (typeof activeTasks === 'number') body.active_tasks = activeTasks;\n if (version) body.version = version;\n if (daemonVersion) body.daemon_version = daemonVersion;\n if (defaultAgent) body.default_agent = defaultAgent;\n if (supervisorInstanceId) body.supervisor_instance_id = supervisorInstanceId;\n if (supervisorVersion) body.supervisor_version = supervisorVersion;\n if (Array.isArray(supervisorCapabilities) && supervisorCapabilities.length > 0) {\n body.supervisor_capabilities = supervisorCapabilities;\n }\n if (Array.isArray(servedRepos) && servedRepos.length > 0) body.served_repos = servedRepos;\n if (Array.isArray(servedOperators) && servedOperators.length > 0) {\n body.served_operator_ids = servedOperators;\n }\n if (Array.isArray(availableAgents) && availableAgents.length > 0) {\n body.available_agents = availableAgents;\n }\n if (Array.isArray(accountUsage) && accountUsage.length > 0) {\n body.account_usage = accountUsage;\n }\n const res = await req('POST', '/api/v1/runner/heartbeat', body, {\n timeoutMs: heartbeatTimeoutMs,\n });\n if (res.status === 401) {\n cachedFirebaseToken = null;\n throw new Error('heartbeat unauthorized (401)');\n }\n if (!res.ok) throw new Error(`heartbeat failed: HTTP ${res.status}`);\n return true;\n },\n\n /** Read the server-authoritative heartbeat ledger without mutating it. */\n async getRunnerStatus({ operatorId } = {}) {\n const query = operatorId ? `?operator_id=${encodeURIComponent(operatorId)}` : '';\n const res = await req('GET', `/api/v1/runner/status${query}`, undefined, {\n timeoutMs: heartbeatTimeoutMs,\n });\n if (res.status === 401) {\n cachedFirebaseToken = null;\n throw new Error('runner status unauthorized (401)');\n }\n if (!res.ok) throw new Error(`runner status failed: HTTP ${res.status}`);\n const body = await res.json();\n return Array.isArray(body?.runners) ? body.runners : [];\n },\n\n /** Poll one authenticated runner's durable Mission Control action queue. */\n async pollRunnerControl({ runnerId, operatorId, supervisorInstanceId, supervisorVersion, capabilities }) {\n const body = { runner_id: runnerId };\n if (operatorId) body.operator_id = operatorId;\n if (supervisorInstanceId) body.supervisor_instance_id = supervisorInstanceId;\n if (supervisorVersion) body.supervisor_version = supervisorVersion;\n if (Array.isArray(capabilities) && capabilities.length > 0) body.capabilities = capabilities;\n const res = await req('POST', '/api/v1/runner/control/poll', body);\n if (res.status === 401) {\n cachedFirebaseToken = null;\n throw new Error('runner control poll unauthorized (401)');\n }\n if (!res.ok) throw new Error(`runner control poll failed: HTTP ${res.status}`);\n const json = await res.json();\n const action = json?.action;\n return action && typeof action.action_id === 'string' && action.action_id\n ? { ...action, actionId: action.action_id }\n : null;\n },\n\n /** Acknowledge a maintenance action after the host has restarted the child. */\n async completeRunnerControl(actionId, { runnerId, operatorId, supervisorInstanceId, supervisorVersion, capabilities, status, detail }) {\n const body = { runner_id: runnerId, status };\n if (operatorId) body.operator_id = operatorId;\n if (supervisorInstanceId) body.supervisor_instance_id = supervisorInstanceId;\n if (supervisorVersion) body.supervisor_version = supervisorVersion;\n if (Array.isArray(capabilities) && capabilities.length > 0) body.capabilities = capabilities;\n if (detail) body.detail = detail;\n const res = await req('POST', `/api/v1/runner/control/${encodeURIComponent(actionId)}/complete`, body);\n if (res.status === 401) {\n cachedFirebaseToken = null;\n throw new Error('runner control completion unauthorized (401)');\n }\n if (!res.ok) throw new Error(`runner control completion failed: HTTP ${res.status}`);\n const json = await res.json();\n return json?.action || null;\n },\n\n /**\n * Mint a short-lived (~1h), repo-scoped GitHub App installation token for\n * THIS runner's operator (M3). The control-plane keys the mint on the\n * authenticated operator (ctx.operator_id), so the token covers only that\n * operator's installation.\n *\n * Returns { token, expiresAt } on success. In legacy/admin mode it returns\n * null on a miss so the caller may use ambient `gh`. In scoped-operator mode\n * callers pass `{ required: true }`, which fails closed instead of letting a\n * missing/mis-scoped installation fall through to the runner machine's `gh`.\n *\n * The minted token is only usable for push + PR if the GitHub App grants\n * BOTH `Contents: write` (git push) AND `Pull requests: write` (gh pr\n * create) \u2014 see docs/vo/github-app-setup-2026-06-18.md. A token missing\n * either scope fails at push (\u2192 ambient fallback) or at `gh pr create`.\n */\n async getInstallationToken({ required = false } = {}) {\n const fail = (reason) => {\n if (required) throw new Error(`installation-token required: ${reason}`);\n return null;\n };\n try {\n const res = await req('POST', '/api/v1/github/installation-token', {});\n if (!res.ok) return fail(`HTTP ${res.status}`);\n const json = await res.json();\n if (!json || !json.token) return fail('missing token');\n return { token: json.token, expiresAt: json.expires_at || null };\n } catch (err) {\n if (required) throw err;\n return null;\n }\n },\n\n /**\n * Read the operator's dispatch-mode config (Fast\u2192Ultracode effort setting).\n * Returns the mode string ('fast'|'standard'|'deep'|'ultra'|'ultracode'),\n * defaulting to 'standard' on any error. Never throws \u2014 best-effort.\n */\n async getDispatchMode() {\n try {\n const res = await req('GET', '/api/v1/dispatch-mode-config');\n if (!res.ok) return 'standard';\n const json = await res.json();\n return json?.dispatchMode || 'standard';\n } catch {\n return 'standard';\n }\n },\n };\n}\n", "/** Allow-listed host maintenance operations used by the runner supervisor. */\nimport { spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { win32 } from 'node:path';\n\nexport const DEFAULT_RUNNER_PACKAGE = '@algosuite/vo-mcp@beta';\nconst PACKAGE_SPEC_RE = /^@algosuite\\/vo-mcp@(beta|latest|\\d+(?:\\.\\d+){0,2}(?:-[\\w.-]+)?)$/u;\nconst MAX_DIAGNOSTIC_CHARS = 800;\nconst NPM_CLI_SUFFIX = `\\\\${win32.join('node_modules', 'npm', 'bin', 'npm-cli.js').toLowerCase()}`;\n\nfunction escapeRegExp(value) {\n return value.replace(/[.*+?^${}()|[\\]\\\\]/gu, '\\\\$&');\n}\n\n/** Keep action detail useful without ever returning credentials or tokens. */\nexport function sanitizeMaintenanceDiagnostic(raw, env = {}) {\n let value = String(raw || '')\n .replace(/\\b(?:vocred|npm|gh[oprsu])_[A-Za-z0-9._-]+\\b/gu, '[REDACTED]')\n .replace(/\\bBearer\\s+\\S+/giu, 'Bearer [REDACTED]')\n .replace(/\\b(_?authToken|token|password|secret|credential)(\\s*[=:]\\s*)\\S+/giu, '$1$2[REDACTED]');\n for (const [name, secret] of Object.entries(env)) {\n if (!/(?:TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL)/iu.test(name)) continue;\n const text = String(secret || '');\n if (text.length < 4) continue;\n value = value.replace(new RegExp(escapeRegExp(text), 'gu'), '[REDACTED]');\n }\n value = value.replace(/\\s+/gu, ' ').trim();\n if (value.length <= MAX_DIAGNOSTIC_CHARS) return value;\n return `${value.slice(0, MAX_DIAGNOSTIC_CHARS - 1)}\u2026`;\n}\n\nfunction isNpmCliPath(value) {\n return typeof value === 'string'\n && win32.isAbsolute(value)\n && win32.normalize(value).toLowerCase().endsWith(NPM_CLI_SUFFIX);\n}\n\n/**\n * Resolve npm's JavaScript entrypoint without executing a Windows `.cmd` shim.\n *\n * The desktop app can run from a bundled node.exe that does not carry npm, so\n * resolution also checks the exact npm layout below absolute PATH entries. No\n * candidate controls the executable or package argv: process.execPath remains\n * the executable and the package spec remains allow-listed below.\n */\nexport function resolveNpmCli({\n env = process.env,\n execPath = process.execPath,\n fileExists = existsSync,\n} = {}) {\n const candidates = [];\n if (isNpmCliPath(env.npm_execpath)) candidates.push(env.npm_execpath);\n candidates.push(win32.join(win32.dirname(execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js'));\n\n const pathValue = env.PATH ?? env.Path ?? env.path ?? '';\n for (const entry of pathValue.split(';')) {\n const trimmed = entry.trim();\n if (!win32.isAbsolute(trimmed)) continue;\n candidates.push(win32.join(trimmed, 'node_modules', 'npm', 'bin', 'npm-cli.js'));\n }\n\n const seen = new Set();\n for (const candidate of candidates) {\n const normalized = win32.normalize(candidate);\n const key = normalized.toLowerCase();\n if (seen.has(key) || !isNpmCliPath(normalized)) continue;\n seen.add(key);\n if (fileExists(normalized)) return normalized;\n }\n return null;\n}\n\nexport function buildMaintenanceCommand(kind, {\n platform = process.platform,\n packageSpec = DEFAULT_RUNNER_PACKAGE,\n env = process.env,\n execPath = process.execPath,\n fileExists = existsSync,\n} = {}) {\n if (!['update', 'reinstall'].includes(kind)) return null;\n if (!PACKAGE_SPEC_RE.test(packageSpec)) throw new Error('unsafe runner package spec');\n const npmCli = platform === 'win32' ? resolveNpmCli({ env, execPath, fileExists }) : null;\n if (platform === 'win32' && !npmCli) throw new Error('trusted npm CLI not found');\n const command = platform === 'win32' ? execPath : 'npm';\n const args = [...(npmCli ? [npmCli] : []), 'install', '-g', packageSpec];\n if (kind === 'reinstall') args.push('--force');\n return { command, args };\n}\n\nexport function runHostMaintenance(kind, {\n platform = process.platform,\n packageSpec = DEFAULT_RUNNER_PACKAGE,\n env = process.env,\n execPath = process.execPath,\n fileExists = existsSync,\n spawn = spawnSync,\n log = () => {},\n} = {}) {\n if (kind === 'reconnect') return { ok: true, status: 0, command: null, args: [] };\n let command;\n try {\n command = buildMaintenanceCommand(kind, { platform, packageSpec, env, execPath, fileExists });\n } catch (error) {\n return {\n ok: false,\n status: 2,\n command: null,\n args: [],\n detail: sanitizeMaintenanceDiagnostic(error instanceof Error ? error.message : String(error), env),\n };\n }\n if (!command) return { ok: false, status: 2, command: null, args: [] };\n log(`runner maintenance: ${command.command} ${command.args.join(' ')}`);\n const result = spawn(command.command, command.args, {\n stdio: ['ignore', 'pipe', 'pipe'],\n encoding: 'utf8',\n env,\n shell: false,\n windowsHide: true,\n });\n const status = typeof result.status === 'number' ? result.status : 1;\n const detail = sanitizeMaintenanceDiagnostic(\n [result.stderr, result.stdout, result.error?.message].filter(Boolean).join('\\n'),\n env,\n );\n if (detail) log(`runner maintenance result: ${detail}`);\n return { ok: status === 0, status, command: command.command, args: command.args, detail };\n}\n", "import { createHash, randomUUID } from 'node:crypto';\nimport {\n existsSync,\n lstatSync,\n mkdirSync,\n readFileSync,\n readdirSync,\n renameSync,\n rmSync,\n writeFileSync,\n} from 'node:fs';\nimport { basename, isAbsolute, join, resolve } from 'node:path';\nimport { spawnSync } from 'node:child_process';\nimport { resolveNpmCli, sanitizeMaintenanceDiagnostic } from '../../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs';\nimport { activateSlot, atomicWriteJson, hashFileSha512, hashRuntimeTree, slotPaths, validateSlot } from './bundled-runtime-store.mjs';\n\nconst PACKAGE_NAME = '@algosuite/vo-mcp';\nconst PACKAGE_SPEC_RE = /^@algosuite\\/vo-mcp@\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/u;\nconst INTEGRITY_RE = /^sha512-[A-Za-z0-9+/]{86}==$/u;\nconst MAX_TARBALL_BYTES = 100 * 1024 * 1024;\nconst PUBLIC_REGISTRY = 'https://registry.npmjs.org/';\n\nexport function buildMinimalMaintenanceEnv(env = process.env, runtimeRoot = '') {\n const allowed = new Set([\n 'PATH', 'Path', 'path', 'PATHEXT', 'SystemRoot', 'SYSTEMROOT', 'WINDIR', 'COMSPEC',\n 'TEMP', 'TMP', 'TMPDIR', 'HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA',\n 'ProgramFiles', 'ProgramFiles(x86)', 'ProgramW6432', 'LANG', 'LC_ALL',\n ]);\n const clean = {};\n for (const [key, value] of Object.entries(env)) {\n if (allowed.has(key) && typeof value === 'string') clean[key] = value;\n }\n return {\n ...clean,\n npm_config_ignore_scripts: 'true',\n npm_config_bin_links: 'false',\n npm_config_audit: 'false',\n npm_config_fund: 'false',\n npm_config_update_notifier: 'false',\n npm_config_registry: PUBLIC_REGISTRY,\n ...(runtimeRoot ? {\n npm_config_userconfig: join(runtimeRoot, 'maintenance', 'user.npmrc'),\n npm_config_globalconfig: join(runtimeRoot, 'maintenance', 'global.npmrc'),\n npm_config_cache: join(runtimeRoot, 'maintenance', 'npm-cache'),\n } : {}),\n };\n}\n\nfunction defaultRun(command, args, options) {\n return spawnSync(command, args, {\n cwd: options.cwd,\n encoding: 'utf8',\n env: options.env,\n shell: false,\n windowsHide: true,\n stdio: ['ignore', 'pipe', 'pipe'],\n timeout: options.timeout ?? 120_000,\n });\n}\n\nfunction commandRunner({ platform, execPath, env, fileExists, run }) {\n const npmCli = platform === 'win32' ? resolveNpmCli({ env, execPath, fileExists }) : null;\n if (platform === 'win32' && !npmCli) throw new Error('trusted npm CLI not found');\n const npmCommand = platform === 'win32' ? execPath : 'npm';\n const prefix = npmCli ? [npmCli] : [];\n return {\n npm(args, options) { return run(npmCommand, [...prefix, ...args], options); },\n node(args, options) { return run(execPath, args, options); },\n };\n}\n\nfunction parseJsonOutput(result, operation) {\n if (result?.status !== 0) {\n throw new Error(`${operation} failed: ${String(result?.stderr || result?.error?.message || `exit ${result?.status ?? 1}`)}`);\n }\n try { return JSON.parse(String(result.stdout || '')); } catch { throw new Error(`${operation} returned invalid JSON`); }\n}\n\nfunction tarballIntegrity(file) {\n return `sha512-${createHash('sha512').update(readFileSync(file)).digest('base64')}`;\n}\n\nfunction assertNoLinks(root) {\n const pending = [root];\n while (pending.length) {\n const current = pending.pop();\n const stat = lstatSync(current);\n if (stat.isSymbolicLink()) throw new Error('installed runtime contains a link/reparse point');\n if (!stat.isDirectory()) continue;\n for (const entry of readdirSync(current)) pending.push(join(current, entry));\n }\n}\n\nexport function validateDependencyLock(payloadRoot, expected) {\n const lock = JSON.parse(readFileSync(join(payloadRoot, 'package-lock.json'), 'utf8'));\n if (Number(lock.lockfileVersion) < 3 || !lock.packages || typeof lock.packages !== 'object') {\n throw new Error('runtime dependency lock is missing or unsupported');\n }\n let foundPackage = false;\n for (const [key, item] of Object.entries(lock.packages)) {\n if (!key) continue;\n if (item?.link === true) throw new Error(`runtime dependency lock contains link: ${key}`);\n const isRunner = key.replaceAll('\\\\', '/').endsWith('node_modules/@algosuite/vo-mcp');\n if (isRunner) {\n foundPackage = item.version === expected.version && item.integrity === expected.integrity;\n continue;\n }\n if (!INTEGRITY_RE.test(String(item?.integrity || ''))) throw new Error(`dependency lacks sha512 integrity: ${key}`);\n if (!String(item?.resolved || '').startsWith('https://registry.npmjs.org/')) {\n throw new Error(`dependency is not registry-pinned: ${key}`);\n }\n }\n if (!foundPackage) throw new Error('installed runner package does not match registry integrity');\n}\n\nfunction buildActive(slotId, metadata, paths) {\n return {\n slot_id: slotId,\n version: metadata.version,\n integrity: metadata.integrity,\n entry_sha512: hashFileSha512(paths.entry),\n supervisor_sha512: hashFileSha512(paths.supervisor),\n tree_sha512: hashRuntimeTree(paths.slotRoot ?? paths.payloadRoot),\n };\n}\n\nfunction installSlot({ runtimeRoot, metadata, tarball, runner, npmEnv, runOptions, force }) {\n const digest = createHash('sha256').update(metadata.integrity).digest('hex').slice(0, 16);\n const suffix = force ? `${digest}-${randomUUID().slice(0, 8)}` : digest;\n const slotId = `vo-mcp-${metadata.version}-${suffix}`;\n const finalPaths = slotPaths(runtimeRoot, slotId);\n if (!force && existsSync(finalPaths.slotRoot)) {\n const manifest = JSON.parse(readFileSync(finalPaths.manifest, 'utf8'));\n const active = buildActive(slotId, metadata, finalPaths);\n const validated = validateSlot(runtimeRoot, active);\n if (validated.ok && manifest.integrity === metadata.integrity) return { active, created: false };\n }\n\n const staging = join(runtimeRoot, 'staging', randomUUID());\n const payload = join(staging, 'payload');\n let installedSlot = false;\n try {\n mkdirSync(payload, { recursive: true });\n writeFileSync(join(payload, 'package.json'), `${JSON.stringify({ name: 'algohq-runner-runtime', version: '0.0.0', private: true })}\\n`);\n const install = runner.npm([\n 'install', '--ignore-scripts', '--no-bin-links', '--no-audit', '--no-fund',\n '--package-lock=true', '--save-exact', `--registry=${PUBLIC_REGISTRY}`, tarball,\n ], { ...runOptions, cwd: payload, env: npmEnv, timeout: 180_000 });\n if (install.status !== 0) throw new Error(`npm install failed: ${install.stderr || install.error?.message || install.status}`);\n assertNoLinks(payload);\n validateDependencyLock(payload, metadata);\n\n const stagedPaths = {\n entry: join(payload, 'node_modules', '@algosuite', 'vo-mcp', 'bin', 'vo-mcp'),\n supervisor: join(payload, 'node_modules', '@algosuite', 'vo-mcp', 'dist', 'runner-supervisor.js'),\n packageJson: join(payload, 'node_modules', '@algosuite', 'vo-mcp', 'package.json'),\n credentialHelper: join(payload, 'node_modules', '@algosuite', 'vo-mcp', 'dist', 'supervisor-credential-helper.js'),\n slotRoot: payload,\n };\n const pkg = JSON.parse(readFileSync(stagedPaths.packageJson, 'utf8'));\n if (pkg.name !== PACKAGE_NAME || pkg.version !== metadata.version) throw new Error('installed package identity mismatch');\n if (!lstatSync(stagedPaths.credentialHelper).isFile()) throw new Error('installed credential helper is missing');\n const smoke = runner.node([stagedPaths.entry, 'runner', '--version'], { ...runOptions, cwd: payload, env: npmEnv, timeout: 30_000 });\n if (smoke.status !== 0 || String(smoke.stdout || '').trim() !== `vo-mcp runner ${metadata.version}`) {\n throw new Error('bundled runtime smoke check failed');\n }\n const active = buildActive(slotId, metadata, stagedPaths);\n atomicWriteJson(join(payload, 'runtime-manifest.json'), { schema_version: 1, ...active });\n mkdirSync(join(runtimeRoot, 'slots'), { recursive: true });\n if (existsSync(finalPaths.slotRoot)) throw new Error('immutable runtime slot already exists');\n renameSync(payload, finalPaths.slotRoot);\n installedSlot = true;\n const validated = validateSlot(runtimeRoot, active);\n if (!validated.ok) throw new Error(`staged runtime validation failed: ${validated.detail}`);\n return { active, created: true };\n } catch (error) {\n if (installedSlot) rmSync(finalPaths.slotRoot, { recursive: true, force: true });\n throw error;\n } finally {\n rmSync(staging, { recursive: true, force: true });\n }\n}\n\nexport function stageBundledRuntimeSlot(options) {\n const {\n runtimeRoot,\n packageSpec,\n expectedVersion,\n expectedIntegrity,\n platform = process.platform,\n execPath = process.execPath,\n env = process.env,\n fileExists = existsSync,\n run = defaultRun,\n force = false,\n } = options;\n if (!runtimeRoot || !isAbsolute(runtimeRoot)) return { ok: false, status: 2, detail: 'bundled runtime root unavailable' };\n if (!expectedVersion || !PACKAGE_SPEC_RE.test(`${PACKAGE_NAME}@${expectedVersion}`)) {\n return { ok: false, status: 2, detail: 'invalid expected runner version' };\n }\n if (!expectedIntegrity || !INTEGRITY_RE.test(expectedIntegrity)) {\n return { ok: false, status: 2, detail: 'invalid expected runner integrity' };\n }\n const exactSpec = `${PACKAGE_NAME}@${expectedVersion}`;\n if (packageSpec !== exactSpec) return { ok: false, status: 2, detail: 'runner package spec does not match authorized version' };\n const resolvedRoot = resolve(runtimeRoot);\n const npmEnv = buildMinimalMaintenanceEnv(env, resolvedRoot);\n const runOptions = { env: npmEnv, cwd: resolvedRoot };\n let tarDir = null;\n try {\n mkdirSync(resolvedRoot, { recursive: true });\n mkdirSync(join(resolvedRoot, 'maintenance'), { recursive: true });\n writeFileSync(npmEnv.npm_config_userconfig, '', { mode: 0o600 });\n writeFileSync(npmEnv.npm_config_globalconfig, '', { mode: 0o600 });\n const runner = commandRunner({ platform, execPath, env: npmEnv, fileExists, run });\n const metadata = { version: expectedVersion, integrity: expectedIntegrity };\n tarDir = join(resolvedRoot, 'staging', randomUUID());\n mkdirSync(tarDir, { recursive: true });\n const packed = parseJsonOutput(runner.npm([\n 'pack', exactSpec, '--ignore-scripts', '--json', '--pack-destination', tarDir, `--registry=${PUBLIC_REGISTRY}`,\n ], runOptions), 'npm pack');\n const record = Array.isArray(packed) ? packed[0] : packed;\n const tarball = join(tarDir, basename(String(record?.filename || '')));\n if (!existsSync(tarball) || !basename(tarball).endsWith('.tgz')) throw new Error('npm pack returned no tarball');\n if (lstatSync(tarball).size > MAX_TARBALL_BYTES) throw new Error('runner package tarball exceeds size limit');\n if (record.integrity !== metadata.integrity || tarballIntegrity(tarball) !== metadata.integrity) {\n throw new Error('runner package sha512 integrity mismatch');\n }\n const installed = installSlot({ runtimeRoot: resolvedRoot, metadata, tarball, runner, npmEnv, runOptions, force });\n return { ok: true, status: 0, ...installed };\n } catch (error) {\n return { ok: false, status: 1, detail: sanitizeMaintenanceDiagnostic(error instanceof Error ? error.message : String(error), env) };\n } finally {\n if (tarDir) rmSync(tarDir, { recursive: true, force: true });\n }\n}\n\nexport function stageAndActivateBundledUpdate(options) {\n const staged = stageBundledRuntimeSlot(options);\n if (!staged.ok) return staged;\n try {\n activateSlot(resolve(options.runtimeRoot), staged.active, options.action);\n return { ...staged, handoff: true };\n } catch (error) {\n return {\n ok: false,\n status: 1,\n detail: sanitizeMaintenanceDiagnostic(error instanceof Error ? error.message : String(error), options.env ?? process.env),\n };\n }\n}\n\nexport const __test = { INTEGRITY_RE, PACKAGE_SPEC_RE, PUBLIC_REGISTRY, assertNoLinks, tarballIntegrity };\n", "import { createHash, randomUUID } from 'node:crypto';\nimport {\n closeSync,\n existsSync,\n fsyncSync,\n lstatSync,\n mkdirSync,\n openSync,\n readFileSync,\n readdirSync,\n realpathSync,\n renameSync,\n rmSync,\n writeFileSync,\n} from 'node:fs';\nimport { dirname, isAbsolute, join, relative, resolve } from 'node:path';\n\nconst SLOT_ID_RE = /^vo-mcp-[0-9A-Za-z._-]{1,96}$/u;\nconst ACTION_ID_RE = /^[0-9A-Za-z._-]{1,128}$/u;\nconst INTEGRITY_RE = /^sha512-[A-Za-z0-9+/]{86}==$/u;\nconst VERSION_RE = /^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/u;\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;\nconst ENTRY_REL = join('node_modules', '@algosuite', 'vo-mcp', 'bin', 'vo-mcp');\nconst SUPERVISOR_REL = join('node_modules', '@algosuite', 'vo-mcp', 'dist', 'runner-supervisor.js');\nconst PACKAGE_REL = join('node_modules', '@algosuite', 'vo-mcp', 'package.json');\nconst CREDENTIAL_HELPER_REL = join('node_modules', '@algosuite', 'vo-mcp', 'dist', 'supervisor-credential-helper.js');\nconst MANIFEST_FILE = 'runtime-manifest.json';\n\nfunction within(parent, candidate) {\n const rel = relative(resolve(parent), resolve(candidate));\n return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));\n}\n\nexport function runtimeRootFromEnv(env = process.env) {\n const value = String(env.VO_RUNNER_RUNTIME_ROOT || '').trim();\n return value && isAbsolute(value) ? resolve(value) : null;\n}\n\nexport function hashFileSha512(file) {\n return `sha512-${createHash('sha512').update(readFileSync(file)).digest('base64')}`;\n}\n\n/** Digest every executable payload byte and relative path, excluding only the self-referential manifest. */\nexport function hashRuntimeTree(root) {\n const hasher = createHash('sha512');\n const files = [];\n const visit = (directory, prefix = '') => {\n const rootStat = lstatSync(directory);\n if (rootStat.isSymbolicLink()) throw new Error('runtime tree contains a link/reparse point');\n if (!rootStat.isDirectory()) throw new Error('runtime tree root is not a directory');\n for (const name of readdirSync(directory).sort((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)))) {\n const absolute = join(directory, name);\n const relativePath = prefix ? `${prefix}/${name}` : name;\n const stat = lstatSync(absolute);\n if (stat.isSymbolicLink()) throw new Error('runtime tree contains a link/reparse point');\n if (stat.isDirectory()) visit(absolute, relativePath);\n else if (stat.isFile() && relativePath !== MANIFEST_FILE) files.push({ absolute, relativePath, size: stat.size });\n else if (!stat.isFile()) throw new Error('runtime tree contains a non-regular file');\n }\n };\n visit(root);\n files.sort((a, b) => Buffer.compare(Buffer.from(a.relativePath), Buffer.from(b.relativePath)));\n for (const file of files) {\n const pathBytes = Buffer.from(file.relativePath, 'utf8');\n hasher.update(`${pathBytes.length}:`);\n hasher.update(pathBytes);\n hasher.update(`:${file.size}:`);\n hasher.update(readFileSync(file.absolute));\n hasher.update('\\n');\n }\n return `sha512-${hasher.digest('base64')}`;\n}\n\nexport function atomicWriteJson(file, value) {\n mkdirSync(dirname(file), { recursive: true });\n const temp = join(dirname(file), `.${randomUUID()}.tmp`);\n const fd = openSync(temp, 'wx', 0o600);\n try {\n writeFileSync(fd, `${JSON.stringify(value, null, 2)}\\n`, 'utf8');\n fsyncSync(fd);\n } finally {\n closeSync(fd);\n }\n try {\n renameSync(temp, file);\n // A file fsync does not make the directory entry durable on POSIX. Windows\n // cannot open directories this way, so keep the durability upgrade best-effort.\n if (process.platform !== 'win32') {\n try {\n const parentFd = openSync(dirname(file), 'r');\n try { fsyncSync(parentFd); } finally { closeSync(parentFd); }\n } catch { /* current.json remains atomically committed */ }\n }\n } finally {\n rmSync(temp, { force: true });\n }\n}\n\nexport function readActivation(runtimeRoot) {\n const file = join(runtimeRoot, 'current.json');\n if (!existsSync(file)) return null;\n try {\n const value = JSON.parse(readFileSync(file, 'utf8'));\n return value?.schema_version === 1 ? value : null;\n } catch {\n return null;\n }\n}\n\nexport function slotPaths(runtimeRoot, slotId) {\n if (!SLOT_ID_RE.test(slotId)) throw new Error('invalid runtime slot id');\n const slotRoot = join(runtimeRoot, 'slots', slotId);\n return {\n slotRoot,\n entry: join(slotRoot, ENTRY_REL),\n supervisor: join(slotRoot, SUPERVISOR_REL),\n packageJson: join(slotRoot, PACKAGE_REL),\n credentialHelper: join(slotRoot, CREDENTIAL_HELPER_REL),\n manifest: join(slotRoot, MANIFEST_FILE),\n };\n}\n\nfunction validActive(active) {\n return active\n && SLOT_ID_RE.test(active.slot_id)\n && VERSION_RE.test(active.version)\n && INTEGRITY_RE.test(active.integrity)\n && INTEGRITY_RE.test(active.entry_sha512)\n && INTEGRITY_RE.test(active.supervisor_sha512)\n && INTEGRITY_RE.test(active.tree_sha512);\n}\n\nexport function validateSlot(runtimeRoot, active) {\n if (!validActive(active)) return { ok: false, detail: 'invalid activation metadata' };\n const paths = slotPaths(runtimeRoot, active.slot_id);\n try {\n const manifest = JSON.parse(readFileSync(paths.manifest, 'utf8'));\n const pkg = JSON.parse(readFileSync(paths.packageJson, 'utf8'));\n const expected = {\n slot_id: active.slot_id,\n version: active.version,\n integrity: active.integrity,\n entry_sha512: active.entry_sha512,\n supervisor_sha512: active.supervisor_sha512,\n tree_sha512: active.tree_sha512,\n };\n for (const [key, value] of Object.entries(expected)) {\n if (manifest?.[key] !== value) return { ok: false, detail: `manifest ${key} mismatch` };\n }\n if (manifest?.schema_version !== 1 || pkg?.name !== '@algosuite/vo-mcp' || pkg?.version !== active.version) {\n return { ok: false, detail: 'package identity mismatch' };\n }\n if (lstatSync(paths.entry).isSymbolicLink() || lstatSync(paths.supervisor).isSymbolicLink()\n || lstatSync(paths.credentialHelper).isSymbolicLink()) {\n return { ok: false, detail: 'runtime entry cannot be a link' };\n }\n if (!within(paths.slotRoot, realpathSync(paths.entry)) || !within(paths.slotRoot, realpathSync(paths.supervisor))\n || !within(paths.slotRoot, realpathSync(paths.credentialHelper))) {\n return { ok: false, detail: 'runtime entry escaped its slot' };\n }\n if (hashFileSha512(paths.entry) !== active.entry_sha512) return { ok: false, detail: 'entry hash mismatch' };\n if (hashFileSha512(paths.supervisor) !== active.supervisor_sha512) return { ok: false, detail: 'supervisor hash mismatch' };\n if (hashRuntimeTree(paths.slotRoot) !== active.tree_sha512) return { ok: false, detail: 'runtime tree hash mismatch' };\n return { ok: true, paths, manifest };\n } catch (error) {\n return { ok: false, detail: error instanceof Error ? error.message : String(error) };\n }\n}\n\nexport function journalActivation(runtimeRoot, actionId, state, detail = '') {\n if (!ACTION_ID_RE.test(actionId)) throw new Error('invalid runner action id');\n atomicWriteJson(join(runtimeRoot, 'transactions', `${actionId}.json`), {\n schema_version: 1,\n action_id: actionId,\n state,\n detail: String(detail).slice(0, 400),\n updated_at: new Date().toISOString(),\n });\n}\n\nexport function activateSlot(runtimeRoot, active, action) {\n if (!validActive(active)) throw new Error('cannot activate invalid runtime metadata');\n if (!ACTION_ID_RE.test(action.actionId)) throw new Error('invalid runner action id');\n if (!UUID_RE.test(String(action.supervisorInstanceId || ''))) throw new Error('invalid claiming supervisor instance id');\n const validated = validateSlot(runtimeRoot, active);\n if (!validated.ok) throw new Error(`cannot activate invalid runtime slot: ${validated.detail}`);\n const current = readActivation(runtimeRoot);\n if (current?.pending) throw new Error('another runtime activation is still pending');\n const pointer = {\n schema_version: 1,\n generation: randomUUID(),\n active,\n previous: validActive(current?.active) ? current.active : null,\n pending: {\n action_id: action.actionId,\n runner_id: String(action.runnerId || ''),\n operator_id: String(action.operatorId || ''),\n supervisor_instance_id: action.supervisorInstanceId,\n activated_at: new Date().toISOString(),\n ack_attempts: 0,\n },\n };\n // The pointer rename is the transaction commit and therefore the last\n // fallible write. A crash before it leaves the previous runtime selected.\n journalActivation(runtimeRoot, action.actionId, 'prepared', `${active.version} ${active.integrity}`);\n atomicWriteJson(join(runtimeRoot, 'current.json'), pointer);\n return pointer;\n}\n\nexport function activationSupervisorInstanceId(runtimeRoot, fallback) {\n const current = runtimeRoot ? readActivation(runtimeRoot) : null;\n const pending = String(current?.pending?.supervisor_instance_id || '');\n if (UUID_RE.test(pending)) return pending;\n return UUID_RE.test(String(fallback || '')) ? fallback : null;\n}\n\nexport function recordActivationRetry(runtimeRoot, pointer, detail) {\n const current = readActivation(runtimeRoot);\n if (current?.generation !== pointer?.generation\n || current?.pending?.action_id !== pointer?.pending?.action_id) {\n throw new Error('runtime activation generation changed before retry');\n }\n const attempts = Math.max(0, Number(current.pending.ack_attempts || 0)) + 1;\n const updated = {\n ...current,\n pending: { ...current.pending, ack_attempts: attempts, last_error: String(detail).slice(0, 240) },\n };\n atomicWriteJson(join(runtimeRoot, 'current.json'), updated);\n journalActivation(runtimeRoot, current.pending.action_id, 'ack-retry', `attempt ${attempts}: ${detail}`);\n return updated;\n}\n\n/** One-time migration for an old desktop launcher that has no control action. */\nexport function bootstrapSlot(runtimeRoot, active, bootstrapId) {\n if (!ACTION_ID_RE.test(bootstrapId)) throw new Error('invalid bootstrap id');\n const validated = validateSlot(runtimeRoot, active);\n if (!validated.ok) throw new Error(`cannot bootstrap invalid runtime slot: ${validated.detail}`);\n const current = readActivation(runtimeRoot);\n if (current?.pending) throw new Error('another runtime activation is still pending');\n if (current?.active?.slot_id === active.slot_id && current.active.integrity === active.integrity) return current;\n const pointer = {\n schema_version: 1,\n generation: randomUUID(),\n active,\n previous: validActive(current?.active) ? current.active : null,\n pending: null,\n };\n journalActivation(runtimeRoot, bootstrapId, 'bootstrap-prepared', `${active.version} ${active.integrity}`);\n atomicWriteJson(join(runtimeRoot, 'current.json'), pointer);\n try { journalActivation(runtimeRoot, bootstrapId, 'bootstrap-activated', `${active.version} active`); } catch { /* best effort */ }\n return pointer;\n}\n\n/** Restore the exact pre-bootstrap pointer without overwriting a newer activation. */\nexport function restoreBootstrapActivation(runtimeRoot, expectedActive, prior, rollbackId) {\n if (!ACTION_ID_RE.test(rollbackId)) throw new Error('invalid bootstrap rollback id');\n const current = readActivation(runtimeRoot);\n if (current?.active?.slot_id !== expectedActive?.slot_id\n || current?.active?.tree_sha512 !== expectedActive?.tree_sha512) {\n throw new Error('bootstrap activation changed before rollback');\n }\n if (prior?.schema_version === 1) {\n atomicWriteJson(join(runtimeRoot, 'current.json'), prior);\n } else {\n const quarantine = join(runtimeRoot, 'quarantine', `${rollbackId}-current.json`);\n mkdirSync(dirname(quarantine), { recursive: true });\n renameSync(join(runtimeRoot, 'current.json'), quarantine);\n }\n try { journalActivation(runtimeRoot, rollbackId, 'bootstrap-pointer-restored', expectedActive.version); }\n catch { /* the restored pointer is authoritative */ }\n}\n\nexport function attestCurrentSupervisor({ runtimeRoot, selfPath, version }) {\n const pointer = readActivation(runtimeRoot);\n if (!pointer?.pending || !validActive(pointer.active)) return { ok: false, detail: 'no pending activation' };\n const validated = validateSlot(runtimeRoot, pointer.active);\n if (!validated.ok) return validated;\n try {\n if (realpathSync(selfPath) !== realpathSync(validated.paths.supervisor)) {\n return { ok: false, detail: 'running supervisor is not the activated supervisor' };\n }\n } catch {\n return { ok: false, detail: 'could not resolve running supervisor path' };\n }\n if (version !== pointer.active.version) return { ok: false, detail: 'running supervisor version mismatch' };\n return { ok: true, pointer, active: pointer.active, paths: validated.paths };\n}\n\nexport function finalizeActivation(runtimeRoot, pointer) {\n const current = readActivation(runtimeRoot);\n if (current?.generation !== pointer?.generation\n || current?.pending?.action_id !== pointer?.pending?.action_id) {\n throw new Error('runtime activation generation changed before finalization');\n }\n journalActivation(runtimeRoot, pointer.pending.action_id, 'attesting', `${pointer.active.version} verified`);\n atomicWriteJson(join(runtimeRoot, 'current.json'), {\n schema_version: 1,\n generation: pointer.generation,\n active: pointer.active,\n previous: pointer.previous || null,\n pending: null,\n });\n // current.json is authoritative. A journal-only failure must never turn a\n // committed activation into a false update failure.\n try { journalActivation(runtimeRoot, pointer.pending.action_id, 'attested', `${pointer.active.version} active`); } catch { /* best effort */ }\n}\n\nexport function rollbackActivation(runtimeRoot, pointer, detail) {\n const current = readActivation(runtimeRoot);\n if (current?.generation !== pointer?.generation\n || current?.pending?.action_id !== pointer?.pending?.action_id) {\n throw new Error('runtime activation generation changed before rollback');\n }\n journalActivation(runtimeRoot, pointer.pending.action_id, 'rolling-back', detail);\n const rolledBack = {\n schema_version: 1,\n generation: randomUUID(),\n active: validActive(pointer?.previous) ? pointer.previous : null,\n previous: null,\n pending: {\n ...pointer.pending,\n terminal_status: 'failed',\n terminal_detail: String(detail).slice(0, 400),\n rolled_back_at: new Date().toISOString(),\n },\n };\n atomicWriteJson(join(runtimeRoot, 'current.json'), rolledBack);\n try { journalActivation(runtimeRoot, pointer.pending.action_id, 'rolled-back', detail); } catch { /* best effort */ }\n return rolledBack;\n}\n\nexport function acknowledgeActivationFailure(runtimeRoot, pointer) {\n const current = readActivation(runtimeRoot);\n if (current?.generation !== pointer?.generation\n || current?.pending?.action_id !== pointer?.pending?.action_id\n || current?.pending?.terminal_status !== 'failed') {\n throw new Error('runtime rollback acknowledgement obligation changed');\n }\n atomicWriteJson(join(runtimeRoot, 'current.json'), { ...current, pending: null });\n try { journalActivation(runtimeRoot, pointer.pending.action_id, 'failure-acknowledged', pointer.pending.terminal_detail); }\n catch { /* current.json is authoritative */ }\n}\n\nexport const __test = { ACTION_ID_RE, ENTRY_REL, INTEGRITY_RE, SLOT_ID_RE, SUPERVISOR_REL, UUID_RE, VERSION_RE, validActive, within };\n", "import {\n acknowledgeActivationFailure,\n attestCurrentSupervisor,\n finalizeActivation,\n readActivation,\n recordActivationRetry,\n rollbackActivation,\n validateSlot,\n} from './bundled-runtime-store.mjs';\n\nconst MAX_ACK_ATTEMPTS = 3;\nconst delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));\n\nexport async function waitForAuthoritativeRunnerHeartbeat({\n client,\n runnerId,\n operatorId,\n runnerInstanceId,\n excludeRunnerInstanceId,\n daemonVersion,\n supervisorIdentity,\n timeoutMs = 60_000,\n pollMs = 1_000,\n}) {\n if (!runnerInstanceId && !excludeRunnerInstanceId) throw new Error('runner instance identity proof unavailable');\n const deadline = Date.now() + timeoutMs;\n while (Date.now() < deadline) {\n try {\n const runners = await client.getRunnerStatus({ ...(operatorId ? { operatorId } : {}) });\n const runner = runners.find((item) => item?.runner_id === runnerId\n && item.status === 'online'\n && (runnerInstanceId\n ? item.runner_meta?.runner_instance_id === runnerInstanceId\n : Boolean(item.runner_meta?.runner_instance_id)\n && item.runner_meta.runner_instance_id !== excludeRunnerInstanceId)\n && item.runner_meta?.daemon_version === daemonVersion\n && item.runner_meta?.supervisor_instance_id === supervisorIdentity.supervisorInstanceId\n && item.runner_meta?.supervisor_version === supervisorIdentity.supervisorVersion\n && supervisorIdentity.capabilities.every((value) => item.runner_meta?.supervisor_capabilities?.includes(value))\n && Array.isArray(item.runner_meta?.available_agents)\n && item.runner_meta.available_agents.some((agent) => agent.agent === item.runner_meta.default_agent\n && agent.installed === true && agent.authenticated === true));\n if (runner) return runner;\n } catch { /* bounded retry */ }\n await delay(pollMs);\n }\n throw new Error('authoritative child heartbeat attestation timed out');\n}\n\n/**\n * Complete a slot handoff only from the activated package and logical Tauri\n * supervisor lease. Local path/version/hash and child readiness are proven\n * before a cloud heartbeat or terminal action acknowledgement is emitted.\n */\nexport async function finishPendingActivation({\n client,\n child,\n runtimeRoot,\n operatorId,\n runnerId,\n selfPath,\n packageVersion,\n supervisorIdentity,\n waitForLocalRunner,\n localStatus,\n waitForCloudRunner = waitForAuthoritativeRunnerHeartbeat,\n cloudTimeoutMs,\n cloudPollMs,\n stopChild,\n launchPreviousChild,\n log = () => {},\n}) {\n const pointer = runtimeRoot ? readActivation(runtimeRoot) : null;\n if (!pointer?.pending) return true;\n const runnerIdForAction = pointer.pending.runner_id || runnerId;\n const operatorIdForAction = pointer.pending.operator_id || operatorId;\n if (pointer.pending.terminal_status === 'failed') {\n try {\n await client.completeRunnerControl(pointer.pending.action_id, {\n runnerId: runnerIdForAction,\n ...(operatorIdForAction ? { operatorId: operatorIdForAction } : {}),\n ...supervisorIdentity,\n status: 'failed',\n detail: pointer.pending.terminal_detail,\n });\n acknowledgeActivationFailure(runtimeRoot, pointer);\n return true;\n } catch (error) {\n log(`activation failure acknowledgement remains pending: ${error instanceof Error ? error.message : String(error)}`);\n await stopChild(child);\n return false;\n }\n }\n let attestation;\n try {\n attestation = attestCurrentSupervisor({ runtimeRoot, selfPath, version: packageVersion });\n if (!attestation.ok) throw new Error(attestation.detail);\n if (!(await waitForLocalRunner(child))) throw new Error('activated runner did not become locally ready');\n } catch (error) {\n let detail = `activation attestation failed: ${error instanceof Error ? error.message : String(error)}`.slice(0, 400);\n let rolledBack = null;\n try {\n rolledBack = rollbackActivation(runtimeRoot, pointer, detail);\n } catch (rollbackError) {\n detail = `${detail}; rollback pending: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`.slice(0, 400);\n }\n try {\n await client.completeRunnerControl(pointer.pending.action_id, {\n runnerId: runnerIdForAction,\n ...(operatorIdForAction ? { operatorId: operatorIdForAction } : {}),\n ...supervisorIdentity,\n status: 'failed',\n detail,\n });\n if (rolledBack) acknowledgeActivationFailure(runtimeRoot, rolledBack);\n } catch {\n // current.json retains the terminal acknowledgement obligation.\n } finally {\n await stopChild(child);\n }\n return false;\n }\n\n let activatedRunnerInstanceId = null;\n try {\n const status = await localStatus();\n activatedRunnerInstanceId = status?.runnerInstanceId || null;\n await waitForCloudRunner({\n client,\n runnerId: runnerIdForAction,\n operatorId: operatorIdForAction,\n runnerInstanceId: status?.runnerInstanceId,\n daemonVersion: `vo-mcp/${attestation.active.version}`,\n supervisorIdentity,\n timeoutMs: cloudTimeoutMs,\n pollMs: cloudPollMs,\n });\n await client.completeRunnerControl(pointer.pending.action_id, {\n runnerId: runnerIdForAction,\n ...(operatorIdForAction ? { operatorId: operatorIdForAction } : {}),\n ...supervisorIdentity,\n status: 'succeeded',\n detail: `attested new supervisor ${attestation.active.version} ${attestation.active.integrity}`,\n });\n finalizeActivation(runtimeRoot, attestation.pointer);\n return true;\n } catch (error) {\n const failure = `activation acknowledgement failed: ${error instanceof Error ? error.message : String(error)}`.slice(0, 400);\n let retry;\n try { retry = recordActivationRetry(runtimeRoot, attestation.pointer, failure); }\n catch (retryError) {\n log(`activation retry could not be recorded: ${retryError instanceof Error ? retryError.message : String(retryError)}`);\n await stopChild(child);\n return false;\n }\n if (retry.pending.ack_attempts < MAX_ACK_ATTEMPTS) {\n log(`activation acknowledgement pending (${retry.pending.ack_attempts}/${MAX_ACK_ATTEMPTS})`);\n await stopChild(child);\n return false;\n }\n\n const previous = validateSlot(runtimeRoot, retry.previous);\n let detail = `${failure}; retry limit reached; previous runtime restored`.slice(0, 400);\n let rollbackChild = null;\n let rolledBack = null;\n try {\n if (!previous.ok) throw new Error(`previous runtime invalid: ${previous.detail}`, { cause: error });\n rolledBack = rollbackActivation(runtimeRoot, retry, detail);\n await stopChild(child);\n rollbackChild = launchPreviousChild(previous.paths.entry);\n if (!(await waitForLocalRunner(rollbackChild))) throw new Error('previous runner did not become locally ready', { cause: error });\n const status = await localStatus();\n await waitForCloudRunner({\n client,\n runnerId: runnerIdForAction,\n operatorId: operatorIdForAction,\n runnerInstanceId: status?.runnerInstanceId,\n excludeRunnerInstanceId: status?.runnerInstanceId ? undefined : activatedRunnerInstanceId,\n daemonVersion: `vo-mcp/${retry.previous.version}`,\n supervisorIdentity,\n timeoutMs: cloudTimeoutMs,\n pollMs: cloudPollMs,\n });\n } catch (rollbackError) {\n detail = `${detail}; rollback proof failed: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`.slice(0, 400);\n }\n try {\n await client.completeRunnerControl(retry.pending.action_id, {\n runnerId: runnerIdForAction,\n ...(operatorIdForAction ? { operatorId: operatorIdForAction } : {}),\n ...supervisorIdentity,\n status: 'failed',\n detail,\n });\n if (rolledBack) acknowledgeActivationFailure(runtimeRoot, rolledBack);\n } catch { /* current.json retains the terminal acknowledgement obligation */ }\n if (rollbackChild) await stopChild(rollbackChild);\n else await stopChild(child);\n return false;\n }\n}\n\nexport const __test = { MAX_ACK_ATTEMPTS };\n", "import { hostname as systemHostname } from 'node:os';\nimport { pairedOperatorScope, probeRunnerReadiness } from '../runner-readiness.mjs';\n\n/** Keep the supervisor's control-queue identity byte-identical to the daemon. */\nexport function resolveSupervisorRunnerId(env = {}, hostname = systemHostname) {\n const explicit = String(env.VO_CODE_RUNNER_ID || '').trim();\n return explicit || `vo-code-runner-${hostname()}`;\n}\n\n/** Build the daemon environment without mislabeling a paired credential as admin. */\nexport function buildSupervisorChildEnv({\n baseEnv = {},\n controlPlaneUrl,\n explicitAdminToken = null,\n pairedOperatorId = null,\n} = {}) {\n const childEnv = {\n ...baseEnv,\n VO_CONTROL_PLANE_URL: controlPlaneUrl,\n };\n const adminToken = typeof explicitAdminToken === 'string' ? explicitAdminToken.trim() : '';\n const operatorId = typeof pairedOperatorId === 'string' ? pairedOperatorId.trim() : '';\n\n if (adminToken) childEnv.VO_CONTROL_PLANE_ADMIN_TOKEN = adminToken;\n else delete childEnv.VO_CONTROL_PLANE_ADMIN_TOKEN;\n\n if (operatorId) childEnv.VO_CODE_RUNNER_OPERATOR_IDS = operatorId;\n return childEnv;\n}\n\n/** Resolve auth provenance once so the supervisor and child use the same scope. */\nexport async function prepareSupervisorAuth({\n baseEnv = {},\n storedCredential = null,\n controlPlaneUrl,\n probeReadiness = probeRunnerReadiness,\n} = {}) {\n const explicitAdminToken = baseEnv.VO_CONTROL_PLANE_ADMIN_TOKEN?.trim();\n const token = explicitAdminToken || storedCredential?.vo_credential;\n if (!token) throw new Error('runner is not paired; run `vo-mcp pair` once on this host');\n\n let operatorId = String(baseEnv.VO_CODE_RUNNER_OPERATOR_IDS || '')\n .split(/[\\s,]+/u)\n .filter(Boolean)[0] || undefined;\n if (!explicitAdminToken) {\n const readiness = await probeReadiness({ controlPlaneUrl, token, requireGithub: true });\n if (!readiness.ok) throw new Error(`runner readiness failed: ${readiness.message}`);\n operatorId = pairedOperatorScope(readiness) || undefined;\n if (!operatorId) throw new Error('runner readiness failed: paired operator scope is missing');\n }\n\n const childEnv = buildSupervisorChildEnv({\n baseEnv,\n controlPlaneUrl,\n explicitAdminToken,\n pairedOperatorId: explicitAdminToken ? null : operatorId,\n });\n const clientEnv = {\n ...baseEnv,\n VO_CONTROL_PLANE_ADMIN_TOKEN: token,\n VO_CONTROL_PLANE_URL: controlPlaneUrl,\n ...(operatorId ? { VO_CODE_RUNNER_OPERATOR_IDS: operatorId } : {}),\n };\n return { childEnv, clientEnv, operatorId };\n}\n", "/**\n * Server-backed readiness probe for a paired BYO runner.\n *\n * The credential itself is opaque, so its mere presence is not proof that it is\n * usable or still bound to an operator. `/auth/me` supplies that truth from the\n * authenticated control-plane context. Before daemon startup, the optional\n * GitHub probe also proves the operator can mint an installation token, so a\n * task is never claimed only to fail at publication setup.\n */\n\nfunction failed({ paired = false, operatorId = null, tenantId = null, githubReady = null, error, message }) {\n return { ok: false, paired, operatorId, tenantId, githubReady, error, message };\n}\n\nasync function responseBody(response) {\n try {\n const value = await response.json();\n return value && typeof value === 'object' ? value : {};\n } catch {\n return {};\n }\n}\n\nfunction serverMessage(body, fallback) {\n return typeof body.message === 'string' && body.message.trim() ? body.message.trim() : fallback;\n}\n\nasync function fetchWithTimeout(fetchImpl, url, init, timeoutMs) {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), timeoutMs);\n try {\n return await fetchImpl(url, { ...init, signal: controller.signal });\n } finally {\n clearTimeout(timer);\n }\n}\n\n/**\n * @param {{\n * controlPlaneUrl: string,\n * token: string,\n * fetchImpl?: typeof fetch,\n * requireGithub?: boolean,\n * timeoutMs?: number,\n * }} input\n */\nexport async function probeRunnerReadiness({\n controlPlaneUrl,\n token,\n fetchImpl = fetch,\n requireGithub = false,\n timeoutMs = 10_000,\n}) {\n const base = controlPlaneUrl.replace(/\\/+$/u, '');\n const headers = { authorization: `Bearer ${token}` };\n let identityResponse;\n try {\n identityResponse = await fetchWithTimeout(\n fetchImpl,\n `${base}/api/v1/auth/me`,\n { headers },\n timeoutMs,\n );\n } catch (error) {\n const detail = error instanceof Error ? error.message : String(error);\n return failed({\n error: 'control_plane_unreachable',\n message: `AlgoHQ could not be reached: ${detail}`,\n });\n }\n\n const identity = await responseBody(identityResponse);\n if (!identityResponse.ok) {\n return failed({\n error: 'credential_rejected',\n message: 'The saved pairing is expired or revoked. Pair this computer again.',\n });\n }\n if (\n identity.provisioned !== true ||\n identity.role !== 'operator' ||\n typeof identity.operator_id !== 'string' ||\n !identity.operator_id.trim() ||\n typeof identity.tenant_id !== 'string' ||\n !identity.tenant_id.trim()\n ) {\n return failed({\n error: 'operator_identity_missing',\n message: 'The pairing credential is valid but has no operator identity. Pair this computer again.',\n });\n }\n\n const operatorId = identity.operator_id.trim();\n const tenantId = identity.tenant_id.trim();\n if (!requireGithub) {\n return {\n ok: true,\n paired: true,\n operatorId,\n tenantId,\n githubReady: null,\n error: null,\n message: 'Paired to AlgoHQ.',\n };\n }\n\n let githubResponse;\n try {\n githubResponse = await fetchWithTimeout(\n fetchImpl,\n `${base}/api/v1/github/installation-token`,\n {\n method: 'POST',\n headers: { ...headers, 'content-type': 'application/json' },\n body: '{}',\n },\n timeoutMs,\n );\n } catch (error) {\n const detail = error instanceof Error ? error.message : String(error);\n return failed({\n paired: true,\n operatorId,\n tenantId,\n githubReady: false,\n error: 'github_preflight_unreachable',\n message: `GitHub publication readiness could not be checked: ${detail}`,\n });\n }\n\n const github = await responseBody(githubResponse);\n if (!githubResponse.ok || typeof github.token !== 'string' || !github.token) {\n const error = typeof github.error === 'string' && github.error ? github.error : 'github_not_ready';\n return failed({\n paired: true,\n operatorId,\n tenantId,\n githubReady: false,\n error,\n message: serverMessage(github, `GitHub publication preflight failed (HTTP ${githubResponse.status}).`),\n });\n }\n\n return {\n ok: true,\n paired: true,\n operatorId,\n tenantId,\n githubReady: true,\n error: null,\n message: 'Paired and ready to publish through the Algosuite GitHub App.',\n };\n}\n\nexport function pairedOperatorScope(readiness) {\n return readiness?.ok === true &&\n readiness?.paired === true &&\n typeof readiness.operatorId === 'string' &&\n readiness.operatorId.trim()\n ? readiness.operatorId.trim()\n : null;\n}\n", "import { spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport function defaultCredentialHelperPath(metaUrl = import.meta.url) {\n const moduleDir = dirname(fileURLToPath(metaUrl));\n const bundled = join(moduleDir, 'supervisor-credential-helper.js');\n const source = join(moduleDir, '..', 'supervisor-credential-helper.mjs');\n return existsSync(source) ? source : bundled;\n}\n\n/** Read the OS-keychain credential without loading its native module here. */\nexport function readStoredCredentialIsolated({\n spawn = spawnSync,\n execPath = process.execPath,\n helperPath = defaultCredentialHelperPath(),\n helperArgs = [],\n env = process.env,\n} = {}) {\n const result = spawn(execPath, [helperPath, ...helperArgs], {\n env,\n encoding: 'utf8',\n stdio: ['ignore', 'pipe', 'pipe'],\n shell: false,\n windowsHide: true,\n timeout: 10_000,\n });\n if (result.status !== 0) {\n throw new Error('runner credential helper could not read the paired credential');\n }\n try {\n const parsed = JSON.parse(String(result.stdout || ''));\n return parsed && typeof parsed === 'object' ? parsed : null;\n } catch {\n throw new Error('runner credential helper returned an invalid credential');\n }\n}\n"],
5
+ "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAeA,eAAsB,kBAAkB;AACtC,QAAM,IAAI;AAAA,IACR;AAAA,EAEF;AACF;AApBA;AAAA;AAAA;AAAA;;;ACKA,SAAS,aAAa;AACtB,SAAS,cAAAA,mBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,iBAAAC,sBAAqB;AAC9B,SAAS,WAAAC,UAAS,QAAAC,aAAY;;;ACQ9B,IAAI,sBAAsB;AAE1B,eAAe,cAAc,KAAK;AAChC,QAAM,aAAa,IAAI;AACvB,MAAI,WAAY,QAAO;AACvB,MAAI,oBAAqB,QAAO;AAEhC,QAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM;AAClC,QAAM,OAAO,MAAMA,iBAAgB,EAAE,IAAI,CAAC;AAC1C,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAS;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,wBAAsB,KAAK;AAC3B,SAAO;AACT;AAMO,SAAS,yBAAyB;AAAA,EACvC,UAAU,QAAQ,IAAI,wBAAwB;AAAA,EAC9C,MAAM,QAAQ;AAAA,EACd,YAAY;AAAA,EACZ,qBAAqB,KAAK;AAAA,IACxB,KAAK,IAAI,OAAO,IAAI,mCAAmC,KAAK,MAAQ,GAAK;AAAA,IACzE;AAAA,EACF;AACF,IAAI,CAAC,GAAG;AACN,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,QAAM,OAAO,QAAQ,QAAQ,QAAQ,EAAE;AAEvC,iBAAe,IAAI,QAAQ,MAAM,MAAM,EAAE,UAAU,IAAI,CAAC,GAAG;AACzD,UAAM,SAAS,MAAM,cAAc,GAAG;AACtC,UAAM,aAAa,YAAY,IAAI,gBAAgB,IAAI;AACvD,QAAI;AACJ,UAAM,UAAU,QAAQ,QAAQ,UAAU,GAAG,IAAI,GAAG,IAAI,IAAI;AAAA,MAC1D;AAAA,MACA,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,UAAU,MAAM;AAAA,MACjC;AAAA,MACA,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,MAC1D,GAAI,aAAa,EAAE,QAAQ,WAAW,OAAO,IAAI,CAAC;AAAA,IACpD,CAAC,CAAC;AACF,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,UAAU,IAAI,QAAQ,CAAC,GAAG,WAAW;AACzC,kBAAY,WAAW,MAAM;AAC3B,mBAAW,MAAM;AACjB,eAAO,IAAI,MAAM,iBAAiB,IAAI,oBAAoB,SAAS,IAAI,CAAC;AAAA,MAC1E,GAAG,SAAS;AAAA,IACd,CAAC;AACD,QAAI;AACF,aAAO,MAAM,QAAQ,KAAK,CAAC,SAAS,OAAO,CAAC;AAAA,IAC9C,UAAE;AACA,mBAAa,SAAS;AAAA,IACxB;AAAA,EACF;AAEA,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQL,MAAM,MAAMC,WAAU,OAAO,aAAa,UAAU,CAAC,GAAG;AACtD,YAAM,OAAO,EAAE,WAAWA,UAAS;AACnC,UAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,MAAK,QAAQ;AAC3D,UAAI,MAAM,QAAQ,WAAW,KAAK,YAAY,SAAS,EAAG,MAAK,eAAe;AAC9E,UAAI,QAAQ,iBAAkB,MAAK,qBAAqB,QAAQ;AAChE,UAAI,QAAQ,oBAAoB,QAAQ,eAAgB,MAAK,kBAAkB;AAC/E,UAAI,QAAQ,aAAc,MAAK,gBAAgB,QAAQ;AACvD,UAAI,MAAM,QAAQ,QAAQ,eAAe,GAAG;AAC1C,aAAK,mBAAmB,QAAQ,gBAC7B,OAAO,CAAC,UAAU,OAAO,cAAc,QAAQ,OAAO,kBAAkB,IAAI,EAC5E,IAAI,CAAC,UAAU,MAAM,KAAK;AAAA,MAC/B;AACA,YAAM,MAAM,MAAM,IAAI,QAAQ,2BAA2B,IAAI;AAC7D,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,0BAA0B;AAAA,MAC5C;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,sBAAsB,IAAI,MAAM,EAAE;AAC/D,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAAA,IACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,gBAAgB,EAAE,MAAM,QAAQ,gBAAgB,UAAU,GAAG;AACjE,YAAM,OAAO,EAAE,MAAM,OAAO;AAC5B,UAAI,OAAO,mBAAmB,SAAU,MAAK,iBAAiB;AAC9D,UAAI,OAAO,cAAc,SAAU,MAAK,YAAY;AACpD,YAAM,MAAM,MAAM,IAAI,QAAQ,qBAAqB,IAAI;AACvD,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,4BAA4B;AAAA,MAC9C;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,wBAAwB,IAAI,MAAM,EAAE;AACjE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAAA,IACzC;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,eAAe,QAAQ;AAC3B,YAAM,MAAM,MAAM,IAAI,QAAQ,qBAAqB,mBAAmB,MAAM,CAAC,WAAW,CAAC,CAAC;AAC1F,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,2BAA2B;AAAA,MAC7C;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,uBAAuB,IAAI,MAAM,EAAE;AAChE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;AAAA,IACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,gBAAgB,UAAU,mBAAmB;AACjD,YAAM,MAAM,MAAM,IAAI,QAAQ,0BAA0B,EAAE,UAAU,kBAAkB,CAAC;AACvF,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,gCAAgC;AAAA,MAClD;AACA,YAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAI,IAAI,MAAM,MAAM,OAAO,MAAM;AAC/B,cAAM,SAAS,MAAM,UAAU,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,CAAC;AAChF,cAAM,SAAS,OAAO,WAAW,QAAQ,OAAO,WAAW,WACvD,WACA,OAAO,WAAW,wBAAwB,OAAO,OAAO,UAAU,EAAE,EAAE,SAAS,YAAY,IACzF,WACA;AACN,eAAO;AAAA,UACL;AAAA,UACA,QAAQ,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AAAA,UAC5D,iBAAiB,OAAO,KAAK,sBAAsB,WAAW,KAAK,oBAAoB;AAAA,QACzF;AAAA,MACF;AACA,UAAI,IAAI,WAAW,OAAO,MAAM,UAAU,sBAAsB;AAC9D,eAAO,EAAE,QAAQ,SAAS,QAAQ,KAAK,UAAU,2BAA2B;AAAA,MAC9E;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ,MAAM,UAAU,MAAM,WAAW,MAAM,SAAS,QAAQ,IAAI,MAAM;AAAA,QAC1E,iBAAiB,OAAO,MAAM,sBAAsB,WAAW,KAAK,oBAAoB;AAAA,MAC1F;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,aAAa,QAAQ,OAAO;AAChC,YAAM,MAAM,MAAM,IAAI,SAAS,qBAAqB,MAAM,aAAa,KAAK;AAC5E,UAAI,IAAI,WAAW,IAAK,QAAO,EAAE,UAAU,KAAK;AAChD,UAAI,IAAI,WAAW,IAAK,QAAO,EAAE,UAAU,MAAM,SAAS,KAAK;AAC/D,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,yBAAyB,IAAI,MAAM,EAAE;AAClE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,EAAE,MAAM,QAAQ,KAAK,KAAK;AAAA,IACnC;AAAA;AAAA,IAGA,MAAM,QAAQ,QAAQ;AACpB,YAAM,MAAM,MAAM,IAAI,OAAO,qBAAqB,MAAM,EAAE;AAC1D,UAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,wBAAwB,IAAI,MAAM,EAAE;AACjE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,OAAO,KAAK,OAAO;AAAA,IAC5B;AAAA;AAAA,IAGA,MAAM,wBAAwB,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAG;AACpD,YAAM,OAAO,CAAC;AACd,UAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAG,MAAK,QAAQ;AAC5D,YAAM,MAAM,MAAM,IAAI,QAAQ,qBAAqB,mBAAmB,MAAM,CAAC,sBAAsB,IAAI;AACvG,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,sCAAsC;AAAA,MACxD;AACA,UAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,kCAAkC,IAAI,MAAM,EAAE;AAC3E,aAAO,IAAI,KAAK;AAAA,IAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYA,MAAM,iBAAiB,EAAE,YAAY,UAAAA,WAAU,QAAQ,iBAAiB,qBAAqB,GAAG;AAC9F,YAAM,OAAO;AAAA,QACX,aAAa;AAAA,QACb,WAAWA;AAAA,QACX,cAAc,OAAO;AAAA,QACrB,eAAe,OAAO;AAAA,QACtB,uBAAuB,OAAO;AAAA,QAC9B,mBAAmB,OAAO;AAAA,MAC5B;AACA,UAAI,OAAO,oBAAoB,UAAU;AACvC,aAAK,oBAAoB;AAAA,MAC3B;AACA,UAAI,yBAAyB,QAAW;AACtC,aAAK,0BAA0B;AAAA,MACjC;AACA,YAAM,MAAM,MAAM,IAAI,QAAQ,yBAAyB,IAAI;AAC3D,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,kCAAkC;AAAA,MACpD;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,8BAA8B,IAAI,MAAM,EAAE;AACvE,aAAO;AAAA,IACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,cAAc,EAAE,UAAAA,WAAU,kBAAkB,YAAY,WAAW,aAAa,SAAS,eAAe,cAAc,sBAAAC,uBAAsB,mBAAAC,oBAAmB,wBAAwB,aAAa,iBAAiB,iBAAiB,aAAa,GAAG;AAC1P,YAAM,OAAO,EAAE,WAAWF,UAAS;AACnC,UAAI,iBAAkB,MAAK,qBAAqB;AAChD,UAAI,WAAY,MAAK,cAAc;AACnC,UAAI,OAAO,cAAc,SAAU,MAAK,aAAa;AACrD,UAAI,OAAO,gBAAgB,SAAU,MAAK,eAAe;AACzD,UAAI,QAAS,MAAK,UAAU;AAC5B,UAAI,cAAe,MAAK,iBAAiB;AACzC,UAAI,aAAc,MAAK,gBAAgB;AACvC,UAAIC,sBAAsB,MAAK,yBAAyBA;AACxD,UAAIC,mBAAmB,MAAK,qBAAqBA;AACjD,UAAI,MAAM,QAAQ,sBAAsB,KAAK,uBAAuB,SAAS,GAAG;AAC9E,aAAK,0BAA0B;AAAA,MACjC;AACA,UAAI,MAAM,QAAQ,WAAW,KAAK,YAAY,SAAS,EAAG,MAAK,eAAe;AAC9E,UAAI,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,GAAG;AAChE,aAAK,sBAAsB;AAAA,MAC7B;AACA,UAAI,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,GAAG;AAChE,aAAK,mBAAmB;AAAA,MAC1B;AACA,UAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,GAAG;AAC1D,aAAK,gBAAgB;AAAA,MACvB;AACA,YAAM,MAAM,MAAM,IAAI,QAAQ,4BAA4B,MAAM;AAAA,QAC9D,WAAW;AAAA,MACb,CAAC;AACD,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,8BAA8B;AAAA,MAChD;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0BAA0B,IAAI,MAAM,EAAE;AACnE,aAAO;AAAA,IACT;AAAA;AAAA,IAGA,MAAM,gBAAgB,EAAE,WAAW,IAAI,CAAC,GAAG;AACzC,YAAM,QAAQ,aAAa,gBAAgB,mBAAmB,UAAU,CAAC,KAAK;AAC9E,YAAM,MAAM,MAAM,IAAI,OAAO,wBAAwB,KAAK,IAAI,QAAW;AAAA,QACvE,WAAW;AAAA,MACb,CAAC;AACD,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,kCAAkC;AAAA,MACpD;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,8BAA8B,IAAI,MAAM,EAAE;AACvE,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,MAAM,QAAQ,MAAM,OAAO,IAAI,KAAK,UAAU,CAAC;AAAA,IACxD;AAAA;AAAA,IAGA,MAAM,kBAAkB,EAAE,UAAAF,WAAU,YAAY,sBAAAC,uBAAsB,mBAAAC,oBAAmB,aAAa,GAAG;AACvG,YAAM,OAAO,EAAE,WAAWF,UAAS;AACnC,UAAI,WAAY,MAAK,cAAc;AACnC,UAAIC,sBAAsB,MAAK,yBAAyBA;AACxD,UAAIC,mBAAmB,MAAK,qBAAqBA;AACjD,UAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,EAAG,MAAK,eAAe;AAChF,YAAM,MAAM,MAAM,IAAI,QAAQ,+BAA+B,IAAI;AACjE,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,wCAAwC;AAAA,MAC1D;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,oCAAoC,IAAI,MAAM,EAAE;AAC7E,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,SAAS,MAAM;AACrB,aAAO,UAAU,OAAO,OAAO,cAAc,YAAY,OAAO,YAC5D,EAAE,GAAG,QAAQ,UAAU,OAAO,UAAU,IACxC;AAAA,IACN;AAAA;AAAA,IAGA,MAAM,sBAAsB,UAAU,EAAE,UAAAF,WAAU,YAAY,sBAAAC,uBAAsB,mBAAAC,oBAAmB,cAAc,QAAQ,OAAO,GAAG;AACrI,YAAM,OAAO,EAAE,WAAWF,WAAU,OAAO;AAC3C,UAAI,WAAY,MAAK,cAAc;AACnC,UAAIC,sBAAsB,MAAK,yBAAyBA;AACxD,UAAIC,mBAAmB,MAAK,qBAAqBA;AACjD,UAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,EAAG,MAAK,eAAe;AAChF,UAAI,OAAQ,MAAK,SAAS;AAC1B,YAAM,MAAM,MAAM,IAAI,QAAQ,0BAA0B,mBAAmB,QAAQ,CAAC,aAAa,IAAI;AACrG,UAAI,IAAI,WAAW,KAAK;AACtB,8BAAsB;AACtB,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0CAA0C,IAAI,MAAM,EAAE;AACnF,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,MAAM,UAAU;AAAA,IACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAkBA,MAAM,qBAAqB,EAAE,WAAW,MAAM,IAAI,CAAC,GAAG;AACpD,YAAM,OAAO,CAAC,WAAW;AACvB,YAAI,SAAU,OAAM,IAAI,MAAM,gCAAgC,MAAM,EAAE;AACtE,eAAO;AAAA,MACT;AACA,UAAI;AACF,cAAM,MAAM,MAAM,IAAI,QAAQ,qCAAqC,CAAC,CAAC;AACrE,YAAI,CAAC,IAAI,GAAI,QAAO,KAAK,QAAQ,IAAI,MAAM,EAAE;AAC7C,cAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAI,CAAC,QAAQ,CAAC,KAAK,MAAO,QAAO,KAAK,eAAe;AACrD,eAAO,EAAE,OAAO,KAAK,OAAO,WAAW,KAAK,cAAc,KAAK;AAAA,MACjE,SAAS,KAAK;AACZ,YAAI,SAAU,OAAM;AACpB,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,kBAAkB;AACtB,UAAI;AACF,cAAM,MAAM,MAAM,IAAI,OAAO,8BAA8B;AAC3D,YAAI,CAAC,IAAI,GAAI,QAAO;AACpB,cAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,eAAO,MAAM,gBAAgB;AAAA,MAC/B,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;;;ACvYA,SAAS,iBAAiB;AAC1B,SAAS,kBAAkB;AAC3B,SAAS,aAAa;AAEf,IAAM,yBAAyB;AACtC,IAAM,kBAAkB;AACxB,IAAM,uBAAuB;AAC7B,IAAM,iBAAiB,KAAK,MAAM,KAAK,gBAAgB,OAAO,OAAO,YAAY,EAAE,YAAY,CAAC;AAEhG,SAAS,aAAa,OAAO;AAC3B,SAAO,MAAM,QAAQ,wBAAwB,MAAM;AACrD;AAGO,SAAS,8BAA8B,KAAK,MAAM,CAAC,GAAG;AAC3D,MAAI,QAAQ,OAAO,OAAO,EAAE,EACzB,QAAQ,kDAAkD,YAAY,EACtE,QAAQ,qBAAqB,mBAAmB,EAChD,QAAQ,sEAAsE,gBAAgB;AACjG,aAAW,CAAC,MAAM,MAAM,KAAK,OAAO,QAAQ,GAAG,GAAG;AAChD,QAAI,CAAC,6CAA6C,KAAK,IAAI,EAAG;AAC9D,UAAM,OAAO,OAAO,UAAU,EAAE;AAChC,QAAI,KAAK,SAAS,EAAG;AACrB,YAAQ,MAAM,QAAQ,IAAI,OAAO,aAAa,IAAI,GAAG,IAAI,GAAG,YAAY;AAAA,EAC1E;AACA,UAAQ,MAAM,QAAQ,SAAS,GAAG,EAAE,KAAK;AACzC,MAAI,MAAM,UAAU,qBAAsB,QAAO;AACjD,SAAO,GAAG,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC;AACpD;AAEA,SAAS,aAAa,OAAO;AAC3B,SAAO,OAAO,UAAU,YACnB,MAAM,WAAW,KAAK,KACtB,MAAM,UAAU,KAAK,EAAE,YAAY,EAAE,SAAS,cAAc;AACnE;AAUO,SAAS,cAAc;AAAA,EAC5B,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AACf,IAAI,CAAC,GAAG;AACN,QAAM,aAAa,CAAC;AACpB,MAAI,aAAa,IAAI,YAAY,EAAG,YAAW,KAAK,IAAI,YAAY;AACpE,aAAW,KAAK,MAAM,KAAK,MAAM,QAAQ,QAAQ,GAAG,gBAAgB,OAAO,OAAO,YAAY,CAAC;AAE/F,QAAM,YAAY,IAAI,QAAQ,IAAI,QAAQ,IAAI,QAAQ;AACtD,aAAW,SAAS,UAAU,MAAM,GAAG,GAAG;AACxC,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,MAAM,WAAW,OAAO,EAAG;AAChC,eAAW,KAAK,MAAM,KAAK,SAAS,gBAAgB,OAAO,OAAO,YAAY,CAAC;AAAA,EACjF;AAEA,QAAM,OAAO,oBAAI,IAAI;AACrB,aAAW,aAAa,YAAY;AAClC,UAAM,aAAa,MAAM,UAAU,SAAS;AAC5C,UAAM,MAAM,WAAW,YAAY;AACnC,QAAI,KAAK,IAAI,GAAG,KAAK,CAAC,aAAa,UAAU,EAAG;AAChD,SAAK,IAAI,GAAG;AACZ,QAAI,WAAW,UAAU,EAAG,QAAO;AAAA,EACrC;AACA,SAAO;AACT;AAEO,SAAS,wBAAwB,MAAM;AAAA,EAC5C,WAAW,QAAQ;AAAA,EACnB,cAAc;AAAA,EACd,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AACf,IAAI,CAAC,GAAG;AACN,MAAI,CAAC,CAAC,UAAU,WAAW,EAAE,SAAS,IAAI,EAAG,QAAO;AACpD,MAAI,CAAC,gBAAgB,KAAK,WAAW,EAAG,OAAM,IAAI,MAAM,4BAA4B;AACpF,QAAM,SAAS,aAAa,UAAU,cAAc,EAAE,KAAK,UAAU,WAAW,CAAC,IAAI;AACrF,MAAI,aAAa,WAAW,CAAC,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AAChF,QAAM,UAAU,aAAa,UAAU,WAAW;AAClD,QAAM,OAAO,CAAC,GAAI,SAAS,CAAC,MAAM,IAAI,CAAC,GAAI,WAAW,MAAM,WAAW;AACvE,MAAI,SAAS,YAAa,MAAK,KAAK,SAAS;AAC7C,SAAO,EAAE,SAAS,KAAK;AACzB;AAEO,SAAS,mBAAmB,MAAM;AAAA,EACvC,WAAW,QAAQ;AAAA,EACnB,cAAc;AAAA,EACd,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AAAA,EACb,OAAAC,SAAQ;AAAA,EACR,MAAM,MAAM;AAAA,EAAC;AACf,IAAI,CAAC,GAAG;AACN,MAAI,SAAS,YAAa,QAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,SAAS,MAAM,MAAM,CAAC,EAAE;AAChF,MAAI;AACJ,MAAI;AACF,cAAU,wBAAwB,MAAM,EAAE,UAAU,aAAa,KAAK,UAAU,WAAW,CAAC;AAAA,EAC9F,SAAS,OAAO;AACd,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,MAAM,CAAC;AAAA,MACP,QAAQ,8BAA8B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,GAAG;AAAA,IACnG;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,SAAS,MAAM,MAAM,CAAC,EAAE;AACrE,MAAI,uBAAuB,QAAQ,OAAO,IAAI,QAAQ,KAAK,KAAK,GAAG,CAAC,EAAE;AACtE,QAAM,SAASA,OAAM,QAAQ,SAAS,QAAQ,MAAM;AAAA,IAClD,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,UAAU;AAAA,IACV;AAAA,IACA,OAAO;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACD,QAAM,SAAS,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AACnE,QAAM,SAAS;AAAA,IACb,CAAC,OAAO,QAAQ,OAAO,QAAQ,OAAO,OAAO,OAAO,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAAA,IAC/E;AAAA,EACF;AACA,MAAI,OAAQ,KAAI,8BAA8B,MAAM,EAAE;AACtD,SAAO,EAAE,IAAI,WAAW,GAAG,QAAQ,SAAS,QAAQ,SAAS,MAAM,QAAQ,MAAM,OAAO;AAC1F;;;AC/HA,SAAS,cAAAC,aAAY,cAAAC,mBAAkB;AACvC;AAAA,EACE,cAAAC;AAAA,EACA,aAAAC;AAAA,EACA,aAAAC;AAAA,EACA,gBAAAC;AAAA,EACA,eAAAC;AAAA,EACA,cAAAC;AAAA,EACA,UAAAC;AAAA,EACA,iBAAAC;AAAA,OACK;AACP,SAAS,UAAU,cAAAC,aAAY,QAAAC,OAAM,WAAAC,gBAAe;AACpD,SAAS,aAAAC,kBAAiB;;;ACZ1B,SAAS,YAAY,kBAAkB;AACvC;AAAA,EACE;AAAA,EACA,cAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,SAAS,YAAY,MAAM,UAAU,eAAe;AAE7D,IAAM,aAAa;AACnB,IAAM,eAAe;AACrB,IAAM,eAAe;AACrB,IAAM,aAAa;AACnB,IAAM,UAAU;AAChB,IAAM,YAAY,KAAK,gBAAgB,cAAc,UAAU,OAAO,QAAQ;AAC9E,IAAM,iBAAiB,KAAK,gBAAgB,cAAc,UAAU,QAAQ,sBAAsB;AAClG,IAAM,cAAc,KAAK,gBAAgB,cAAc,UAAU,cAAc;AAC/E,IAAM,wBAAwB,KAAK,gBAAgB,cAAc,UAAU,QAAQ,iCAAiC;AACpH,IAAM,gBAAgB;AAEtB,SAAS,OAAO,QAAQ,WAAW;AACjC,QAAM,MAAM,SAAS,QAAQ,MAAM,GAAG,QAAQ,SAAS,CAAC;AACxD,SAAO,QAAQ,MAAO,CAAC,IAAI,WAAW,IAAI,KAAK,CAAC,WAAW,GAAG;AAChE;AAEO,SAAS,mBAAmB,MAAM,QAAQ,KAAK;AACpD,QAAM,QAAQ,OAAO,IAAI,0BAA0B,EAAE,EAAE,KAAK;AAC5D,SAAO,SAAS,WAAW,KAAK,IAAI,QAAQ,KAAK,IAAI;AACvD;AAEO,SAAS,eAAe,MAAM;AACnC,SAAO,UAAU,WAAW,QAAQ,EAAE,OAAO,aAAa,IAAI,CAAC,EAAE,OAAO,QAAQ,CAAC;AACnF;AAGO,SAAS,gBAAgB,MAAM;AACpC,QAAM,SAAS,WAAW,QAAQ;AAClC,QAAM,QAAQ,CAAC;AACf,QAAM,QAAQ,CAAC,WAAW,SAAS,OAAO;AACxC,UAAM,WAAW,UAAU,SAAS;AACpC,QAAI,SAAS,eAAe,EAAG,OAAM,IAAI,MAAM,4CAA4C;AAC3F,QAAI,CAAC,SAAS,YAAY,EAAG,OAAM,IAAI,MAAM,sCAAsC;AACnF,eAAW,QAAQ,YAAY,SAAS,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG;AACxG,YAAM,WAAW,KAAK,WAAW,IAAI;AACrC,YAAM,eAAe,SAAS,GAAG,MAAM,IAAI,IAAI,KAAK;AACpD,YAAM,OAAO,UAAU,QAAQ;AAC/B,UAAI,KAAK,eAAe,EAAG,OAAM,IAAI,MAAM,4CAA4C;AACvF,UAAI,KAAK,YAAY,EAAG,OAAM,UAAU,YAAY;AAAA,eAC3C,KAAK,OAAO,KAAK,iBAAiB,cAAe,OAAM,KAAK,EAAE,UAAU,cAAc,MAAM,KAAK,KAAK,CAAC;AAAA,eACvG,CAAC,KAAK,OAAO,EAAG,OAAM,IAAI,MAAM,0CAA0C;AAAA,IACrF;AAAA,EACF;AACA,QAAM,IAAI;AACV,QAAM,KAAK,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,KAAK,EAAE,YAAY,GAAG,OAAO,KAAK,EAAE,YAAY,CAAC,CAAC;AAC7F,aAAW,QAAQ,OAAO;AACxB,UAAM,YAAY,OAAO,KAAK,KAAK,cAAc,MAAM;AACvD,WAAO,OAAO,GAAG,UAAU,MAAM,GAAG;AACpC,WAAO,OAAO,SAAS;AACvB,WAAO,OAAO,IAAI,KAAK,IAAI,GAAG;AAC9B,WAAO,OAAO,aAAa,KAAK,QAAQ,CAAC;AACzC,WAAO,OAAO,IAAI;AAAA,EACpB;AACA,SAAO,UAAU,OAAO,OAAO,QAAQ,CAAC;AAC1C;AAEO,SAAS,gBAAgB,MAAM,OAAO;AAC3C,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,QAAM,OAAO,KAAK,QAAQ,IAAI,GAAG,IAAI,WAAW,CAAC,MAAM;AACvD,QAAM,KAAK,SAAS,MAAM,MAAM,GAAK;AACrC,MAAI;AACF,kBAAc,IAAI,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,GAAM,MAAM;AAC/D,cAAU,EAAE;AAAA,EACd,UAAE;AACA,cAAU,EAAE;AAAA,EACd;AACA,MAAI;AACF,eAAW,MAAM,IAAI;AAGrB,QAAI,QAAQ,aAAa,SAAS;AAChC,UAAI;AACF,cAAM,WAAW,SAAS,QAAQ,IAAI,GAAG,GAAG;AAC5C,YAAI;AAAE,oBAAU,QAAQ;AAAA,QAAG,UAAE;AAAU,oBAAU,QAAQ;AAAA,QAAG;AAAA,MAC9D,QAAQ;AAAA,MAAkD;AAAA,IAC5D;AAAA,EACF,UAAE;AACA,WAAO,MAAM,EAAE,OAAO,KAAK,CAAC;AAAA,EAC9B;AACF;AAEO,SAAS,eAAe,aAAa;AAC1C,QAAM,OAAO,KAAK,aAAa,cAAc;AAC7C,MAAI,CAACA,YAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,QAAQ,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AACnD,WAAO,OAAO,mBAAmB,IAAI,QAAQ;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,UAAU,aAAa,QAAQ;AAC7C,MAAI,CAAC,WAAW,KAAK,MAAM,EAAG,OAAM,IAAI,MAAM,yBAAyB;AACvE,QAAM,WAAW,KAAK,aAAa,SAAS,MAAM;AAClD,SAAO;AAAA,IACL;AAAA,IACA,OAAO,KAAK,UAAU,SAAS;AAAA,IAC/B,YAAY,KAAK,UAAU,cAAc;AAAA,IACzC,aAAa,KAAK,UAAU,WAAW;AAAA,IACvC,kBAAkB,KAAK,UAAU,qBAAqB;AAAA,IACtD,UAAU,KAAK,UAAU,aAAa;AAAA,EACxC;AACF;AAEA,SAAS,YAAY,QAAQ;AAC3B,SAAO,UACF,WAAW,KAAK,OAAO,OAAO,KAC9B,WAAW,KAAK,OAAO,OAAO,KAC9B,aAAa,KAAK,OAAO,SAAS,KAClC,aAAa,KAAK,OAAO,YAAY,KACrC,aAAa,KAAK,OAAO,iBAAiB,KAC1C,aAAa,KAAK,OAAO,WAAW;AAC3C;AAEO,SAAS,aAAa,aAAa,QAAQ;AAChD,MAAI,CAAC,YAAY,MAAM,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,8BAA8B;AACpF,QAAM,QAAQ,UAAU,aAAa,OAAO,OAAO;AACnD,MAAI;AACF,UAAM,WAAW,KAAK,MAAM,aAAa,MAAM,UAAU,MAAM,CAAC;AAChE,UAAM,MAAM,KAAK,MAAM,aAAa,MAAM,aAAa,MAAM,CAAC;AAC9D,UAAM,WAAW;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,SAAS,OAAO;AAAA,MAChB,WAAW,OAAO;AAAA,MAClB,cAAc,OAAO;AAAA,MACrB,mBAAmB,OAAO;AAAA,MAC1B,aAAa,OAAO;AAAA,IACtB;AACA,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,UAAI,WAAW,GAAG,MAAM,MAAO,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY,GAAG,YAAY;AAAA,IACxF;AACA,QAAI,UAAU,mBAAmB,KAAK,KAAK,SAAS,uBAAuB,KAAK,YAAY,OAAO,SAAS;AAC1G,aAAO,EAAE,IAAI,OAAO,QAAQ,4BAA4B;AAAA,IAC1D;AACA,QAAI,UAAU,MAAM,KAAK,EAAE,eAAe,KAAK,UAAU,MAAM,UAAU,EAAE,eAAe,KACrF,UAAU,MAAM,gBAAgB,EAAE,eAAe,GAAG;AACvD,aAAO,EAAE,IAAI,OAAO,QAAQ,iCAAiC;AAAA,IAC/D;AACA,QAAI,CAAC,OAAO,MAAM,UAAU,aAAa,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,MAAM,UAAU,aAAa,MAAM,UAAU,CAAC,KAC3G,CAAC,OAAO,MAAM,UAAU,aAAa,MAAM,gBAAgB,CAAC,GAAG;AAClE,aAAO,EAAE,IAAI,OAAO,QAAQ,iCAAiC;AAAA,IAC/D;AACA,QAAI,eAAe,MAAM,KAAK,MAAM,OAAO,aAAc,QAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB;AAC3G,QAAI,eAAe,MAAM,UAAU,MAAM,OAAO,kBAAmB,QAAO,EAAE,IAAI,OAAO,QAAQ,2BAA2B;AAC1H,QAAI,gBAAgB,MAAM,QAAQ,MAAM,OAAO,YAAa,QAAO,EAAE,IAAI,OAAO,QAAQ,6BAA6B;AACrH,WAAO,EAAE,IAAI,MAAM,OAAO,SAAS;AAAA,EACrC,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;AAAA,EACrF;AACF;AAEO,SAAS,kBAAkB,aAAa,UAAU,OAAO,SAAS,IAAI;AAC3E,MAAI,CAAC,aAAa,KAAK,QAAQ,EAAG,OAAM,IAAI,MAAM,0BAA0B;AAC5E,kBAAgB,KAAK,aAAa,gBAAgB,GAAG,QAAQ,OAAO,GAAG;AAAA,IACrE,gBAAgB;AAAA,IAChB,WAAW;AAAA,IACX;AAAA,IACA,QAAQ,OAAO,MAAM,EAAE,MAAM,GAAG,GAAG;AAAA,IACnC,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrC,CAAC;AACH;AAEO,SAAS,aAAa,aAAa,QAAQ,QAAQ;AACxD,MAAI,CAAC,YAAY,MAAM,EAAG,OAAM,IAAI,MAAM,0CAA0C;AACpF,MAAI,CAAC,aAAa,KAAK,OAAO,QAAQ,EAAG,OAAM,IAAI,MAAM,0BAA0B;AACnF,MAAI,CAAC,QAAQ,KAAK,OAAO,OAAO,wBAAwB,EAAE,CAAC,EAAG,OAAM,IAAI,MAAM,yCAAyC;AACvH,QAAM,YAAY,aAAa,aAAa,MAAM;AAClD,MAAI,CAAC,UAAU,GAAI,OAAM,IAAI,MAAM,yCAAyC,UAAU,MAAM,EAAE;AAC9F,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,QAAS,OAAM,IAAI,MAAM,6CAA6C;AACnF,QAAM,UAAU;AAAA,IACd,gBAAgB;AAAA,IAChB,YAAY,WAAW;AAAA,IACvB;AAAA,IACA,UAAU,YAAY,SAAS,MAAM,IAAI,QAAQ,SAAS;AAAA,IAC1D,SAAS;AAAA,MACP,WAAW,OAAO;AAAA,MAClB,WAAW,OAAO,OAAO,YAAY,EAAE;AAAA,MACvC,aAAa,OAAO,OAAO,cAAc,EAAE;AAAA,MAC3C,wBAAwB,OAAO;AAAA,MAC/B,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,MACrC,cAAc;AAAA,IAChB;AAAA,EACF;AAGA,oBAAkB,aAAa,OAAO,UAAU,YAAY,GAAG,OAAO,OAAO,IAAI,OAAO,SAAS,EAAE;AACnG,kBAAgB,KAAK,aAAa,cAAc,GAAG,OAAO;AAC1D,SAAO;AACT;AAEO,SAAS,+BAA+B,aAAa,UAAU;AACpE,QAAM,UAAU,cAAc,eAAe,WAAW,IAAI;AAC5D,QAAM,UAAU,OAAO,SAAS,SAAS,0BAA0B,EAAE;AACrE,MAAI,QAAQ,KAAK,OAAO,EAAG,QAAO;AAClC,SAAO,QAAQ,KAAK,OAAO,YAAY,EAAE,CAAC,IAAI,WAAW;AAC3D;AAEO,SAAS,sBAAsB,aAAa,SAAS,QAAQ;AAClE,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,eAAe,SAAS,cAChC,SAAS,SAAS,cAAc,SAAS,SAAS,WAAW;AAChE,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,QAAM,WAAW,KAAK,IAAI,GAAG,OAAO,QAAQ,QAAQ,gBAAgB,CAAC,CAAC,IAAI;AAC1E,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,SAAS,EAAE,GAAG,QAAQ,SAAS,cAAc,UAAU,YAAY,OAAO,MAAM,EAAE,MAAM,GAAG,GAAG,EAAE;AAAA,EAClG;AACA,kBAAgB,KAAK,aAAa,cAAc,GAAG,OAAO;AAC1D,oBAAkB,aAAa,QAAQ,QAAQ,WAAW,aAAa,WAAW,QAAQ,KAAK,MAAM,EAAE;AACvG,SAAO;AACT;AA0CO,SAAS,wBAAwB,EAAE,aAAa,UAAAC,WAAU,QAAQ,GAAG;AAC1E,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,CAAC,SAAS,WAAW,CAAC,YAAY,QAAQ,MAAM,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB;AAC3G,QAAM,YAAY,aAAa,aAAa,QAAQ,MAAM;AAC1D,MAAI,CAAC,UAAU,GAAI,QAAO;AAC1B,MAAI;AACF,QAAI,aAAaA,SAAQ,MAAM,aAAa,UAAU,MAAM,UAAU,GAAG;AACvE,aAAO,EAAE,IAAI,OAAO,QAAQ,qDAAqD;AAAA,IACnF;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,4CAA4C;AAAA,EAC1E;AACA,MAAI,YAAY,QAAQ,OAAO,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,sCAAsC;AAC1G,SAAO,EAAE,IAAI,MAAM,SAAS,QAAQ,QAAQ,QAAQ,OAAO,UAAU,MAAM;AAC7E;AAEO,SAAS,mBAAmB,aAAa,SAAS;AACvD,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,eAAe,SAAS,cAChC,SAAS,SAAS,cAAc,SAAS,SAAS,WAAW;AAChE,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,oBAAkB,aAAa,QAAQ,QAAQ,WAAW,aAAa,GAAG,QAAQ,OAAO,OAAO,WAAW;AAC3G,kBAAgB,KAAK,aAAa,cAAc,GAAG;AAAA,IACjD,gBAAgB;AAAA,IAChB,YAAY,QAAQ;AAAA,IACpB,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ,YAAY;AAAA,IAC9B,SAAS;AAAA,EACX,CAAC;AAGD,MAAI;AAAE,sBAAkB,aAAa,QAAQ,QAAQ,WAAW,YAAY,GAAG,QAAQ,OAAO,OAAO,SAAS;AAAA,EAAG,QAAQ;AAAA,EAAoB;AAC/I;AAEO,SAAS,mBAAmB,aAAa,SAAS,QAAQ;AAC/D,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,eAAe,SAAS,cAChC,SAAS,SAAS,cAAc,SAAS,SAAS,WAAW;AAChE,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,oBAAkB,aAAa,QAAQ,QAAQ,WAAW,gBAAgB,MAAM;AAChF,QAAM,aAAa;AAAA,IACjB,gBAAgB;AAAA,IAChB,YAAY,WAAW;AAAA,IACvB,QAAQ,YAAY,SAAS,QAAQ,IAAI,QAAQ,WAAW;AAAA,IAC5D,UAAU;AAAA,IACV,SAAS;AAAA,MACP,GAAG,QAAQ;AAAA,MACX,iBAAiB;AAAA,MACjB,iBAAiB,OAAO,MAAM,EAAE,MAAM,GAAG,GAAG;AAAA,MAC5C,iBAAgB,oBAAI,KAAK,GAAE,YAAY;AAAA,IACzC;AAAA,EACF;AACA,kBAAgB,KAAK,aAAa,cAAc,GAAG,UAAU;AAC7D,MAAI;AAAE,sBAAkB,aAAa,QAAQ,QAAQ,WAAW,eAAe,MAAM;AAAA,EAAG,QAAQ;AAAA,EAAoB;AACpH,SAAO;AACT;AAEO,SAAS,6BAA6B,aAAa,SAAS;AACjE,QAAM,UAAU,eAAe,WAAW;AAC1C,MAAI,SAAS,eAAe,SAAS,cAChC,SAAS,SAAS,cAAc,SAAS,SAAS,aAClD,SAAS,SAAS,oBAAoB,UAAU;AACnD,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,kBAAgB,KAAK,aAAa,cAAc,GAAG,EAAE,GAAG,SAAS,SAAS,KAAK,CAAC;AAChF,MAAI;AAAE,sBAAkB,aAAa,QAAQ,QAAQ,WAAW,wBAAwB,QAAQ,QAAQ,eAAe;AAAA,EAAG,QACpH;AAAA,EAAsC;AAC9C;;;ADrUA,IAAM,eAAe;AACrB,IAAMC,mBAAkB;AACxB,IAAMC,gBAAe;AACrB,IAAM,oBAAoB,MAAM,OAAO;AACvC,IAAM,kBAAkB;AAEjB,SAAS,2BAA2B,MAAM,QAAQ,KAAK,cAAc,IAAI;AAC9E,QAAM,UAAU,oBAAI,IAAI;AAAA,IACtB;AAAA,IAAQ;AAAA,IAAQ;AAAA,IAAQ;AAAA,IAAW;AAAA,IAAc;AAAA,IAAc;AAAA,IAAU;AAAA,IACzE;AAAA,IAAQ;AAAA,IAAO;AAAA,IAAU;AAAA,IAAQ;AAAA,IAAe;AAAA,IAAW;AAAA,IAC3D;AAAA,IAAgB;AAAA,IAAqB;AAAA,IAAgB;AAAA,IAAQ;AAAA,EAC/D,CAAC;AACD,QAAM,QAAQ,CAAC;AACf,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC9C,QAAI,QAAQ,IAAI,GAAG,KAAK,OAAO,UAAU,SAAU,OAAM,GAAG,IAAI;AAAA,EAClE;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,2BAA2B;AAAA,IAC3B,sBAAsB;AAAA,IACtB,kBAAkB;AAAA,IAClB,iBAAiB;AAAA,IACjB,4BAA4B;AAAA,IAC5B,qBAAqB;AAAA,IACrB,GAAI,cAAc;AAAA,MAChB,uBAAuBC,MAAK,aAAa,eAAe,YAAY;AAAA,MACpE,yBAAyBA,MAAK,aAAa,eAAe,cAAc;AAAA,MACxE,kBAAkBA,MAAK,aAAa,eAAe,WAAW;AAAA,IAChE,IAAI,CAAC;AAAA,EACP;AACF;AAEA,SAAS,WAAW,SAAS,MAAM,SAAS;AAC1C,SAAOC,WAAU,SAAS,MAAM;AAAA,IAC9B,KAAK,QAAQ;AAAA,IACb,UAAU;AAAA,IACV,KAAK,QAAQ;AAAA,IACb,OAAO;AAAA,IACP,aAAa;AAAA,IACb,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,SAAS,QAAQ,WAAW;AAAA,EAC9B,CAAC;AACH;AAEA,SAAS,cAAc,EAAE,UAAU,UAAU,KAAK,YAAY,IAAI,GAAG;AACnE,QAAM,SAAS,aAAa,UAAU,cAAc,EAAE,KAAK,UAAU,WAAW,CAAC,IAAI;AACrF,MAAI,aAAa,WAAW,CAAC,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AAChF,QAAM,aAAa,aAAa,UAAU,WAAW;AACrD,QAAM,SAAS,SAAS,CAAC,MAAM,IAAI,CAAC;AACpC,SAAO;AAAA,IACL,IAAI,MAAM,SAAS;AAAE,aAAO,IAAI,YAAY,CAAC,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO;AAAA,IAAG;AAAA,IAC5E,KAAK,MAAM,SAAS;AAAE,aAAO,IAAI,UAAU,MAAM,OAAO;AAAA,IAAG;AAAA,EAC7D;AACF;AAEA,SAAS,gBAAgB,QAAQ,WAAW;AAC1C,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,IAAI,MAAM,GAAG,SAAS,YAAY,OAAO,QAAQ,UAAU,QAAQ,OAAO,WAAW,QAAQ,QAAQ,UAAU,CAAC,EAAE,CAAC,EAAE;AAAA,EAC7H;AACA,MAAI;AAAE,WAAO,KAAK,MAAM,OAAO,OAAO,UAAU,EAAE,CAAC;AAAA,EAAG,QAAQ;AAAE,UAAM,IAAI,MAAM,GAAG,SAAS,wBAAwB;AAAA,EAAG;AACzH;AAEA,SAAS,iBAAiB,MAAM;AAC9B,SAAO,UAAUC,YAAW,QAAQ,EAAE,OAAOC,cAAa,IAAI,CAAC,EAAE,OAAO,QAAQ,CAAC;AACnF;AAEA,SAAS,cAAc,MAAM;AAC3B,QAAM,UAAU,CAAC,IAAI;AACrB,SAAO,QAAQ,QAAQ;AACrB,UAAM,UAAU,QAAQ,IAAI;AAC5B,UAAM,OAAOC,WAAU,OAAO;AAC9B,QAAI,KAAK,eAAe,EAAG,OAAM,IAAI,MAAM,iDAAiD;AAC5F,QAAI,CAAC,KAAK,YAAY,EAAG;AACzB,eAAW,SAASC,aAAY,OAAO,EAAG,SAAQ,KAAKL,MAAK,SAAS,KAAK,CAAC;AAAA,EAC7E;AACF;AAEO,SAAS,uBAAuB,aAAa,UAAU;AAC5D,QAAM,OAAO,KAAK,MAAMG,cAAaH,MAAK,aAAa,mBAAmB,GAAG,MAAM,CAAC;AACpF,MAAI,OAAO,KAAK,eAAe,IAAI,KAAK,CAAC,KAAK,YAAY,OAAO,KAAK,aAAa,UAAU;AAC3F,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,MAAI,eAAe;AACnB,aAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAK,QAAQ,GAAG;AACvD,QAAI,CAAC,IAAK;AACV,QAAI,MAAM,SAAS,KAAM,OAAM,IAAI,MAAM,0CAA0C,GAAG,EAAE;AACxF,UAAM,WAAW,IAAI,WAAW,MAAM,GAAG,EAAE,SAAS,gCAAgC;AACpF,QAAI,UAAU;AACZ,qBAAe,KAAK,YAAY,SAAS,WAAW,KAAK,cAAc,SAAS;AAChF;AAAA,IACF;AACA,QAAI,CAACD,cAAa,KAAK,OAAO,MAAM,aAAa,EAAE,CAAC,EAAG,OAAM,IAAI,MAAM,sCAAsC,GAAG,EAAE;AAClH,QAAI,CAAC,OAAO,MAAM,YAAY,EAAE,EAAE,WAAW,6BAA6B,GAAG;AAC3E,YAAM,IAAI,MAAM,sCAAsC,GAAG,EAAE;AAAA,IAC7D;AAAA,EACF;AACA,MAAI,CAAC,aAAc,OAAM,IAAI,MAAM,4DAA4D;AACjG;AAEA,SAAS,YAAY,QAAQ,UAAU,OAAO;AAC5C,SAAO;AAAA,IACL,SAAS;AAAA,IACT,SAAS,SAAS;AAAA,IAClB,WAAW,SAAS;AAAA,IACpB,cAAc,eAAe,MAAM,KAAK;AAAA,IACxC,mBAAmB,eAAe,MAAM,UAAU;AAAA,IAClD,aAAa,gBAAgB,MAAM,YAAY,MAAM,WAAW;AAAA,EAClE;AACF;AAEA,SAAS,YAAY,EAAE,aAAa,UAAU,SAAS,QAAQ,QAAQ,YAAY,MAAM,GAAG;AAC1F,QAAM,SAASG,YAAW,QAAQ,EAAE,OAAO,SAAS,SAAS,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACxF,QAAM,SAAS,QAAQ,GAAG,MAAM,IAAII,YAAW,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK;AACjE,QAAM,SAAS,UAAU,SAAS,OAAO,IAAI,MAAM;AACnD,QAAM,aAAa,UAAU,aAAa,MAAM;AAChD,MAAI,CAAC,SAASC,YAAW,WAAW,QAAQ,GAAG;AAC7C,UAAM,WAAW,KAAK,MAAMJ,cAAa,WAAW,UAAU,MAAM,CAAC;AACrE,UAAM,SAAS,YAAY,QAAQ,UAAU,UAAU;AACvD,UAAM,YAAY,aAAa,aAAa,MAAM;AAClD,QAAI,UAAU,MAAM,SAAS,cAAc,SAAS,UAAW,QAAO,EAAE,QAAQ,SAAS,MAAM;AAAA,EACjG;AAEA,QAAM,UAAUH,MAAK,aAAa,WAAWM,YAAW,CAAC;AACzD,QAAM,UAAUN,MAAK,SAAS,SAAS;AACvC,MAAI,gBAAgB;AACpB,MAAI;AACF,IAAAQ,WAAU,SAAS,EAAE,WAAW,KAAK,CAAC;AACtC,IAAAC,eAAcT,MAAK,SAAS,cAAc,GAAG,GAAG,KAAK,UAAU,EAAE,MAAM,yBAAyB,SAAS,SAAS,SAAS,KAAK,CAAC,CAAC;AAAA,CAAI;AACtI,UAAM,UAAU,OAAO,IAAI;AAAA,MACzB;AAAA,MAAW;AAAA,MAAoB;AAAA,MAAkB;AAAA,MAAc;AAAA,MAC/D;AAAA,MAAuB;AAAA,MAAgB,cAAc,eAAe;AAAA,MAAI;AAAA,IAC1E,GAAG,EAAE,GAAG,YAAY,KAAK,SAAS,KAAK,QAAQ,SAAS,KAAQ,CAAC;AACjE,QAAI,QAAQ,WAAW,EAAG,OAAM,IAAI,MAAM,uBAAuB,QAAQ,UAAU,QAAQ,OAAO,WAAW,QAAQ,MAAM,EAAE;AAC7H,kBAAc,OAAO;AACrB,2BAAuB,SAAS,QAAQ;AAExC,UAAM,cAAc;AAAA,MAClB,OAAOA,MAAK,SAAS,gBAAgB,cAAc,UAAU,OAAO,QAAQ;AAAA,MAC5E,YAAYA,MAAK,SAAS,gBAAgB,cAAc,UAAU,QAAQ,sBAAsB;AAAA,MAChG,aAAaA,MAAK,SAAS,gBAAgB,cAAc,UAAU,cAAc;AAAA,MACjF,kBAAkBA,MAAK,SAAS,gBAAgB,cAAc,UAAU,QAAQ,iCAAiC;AAAA,MACjH,UAAU;AAAA,IACZ;AACA,UAAM,MAAM,KAAK,MAAMG,cAAa,YAAY,aAAa,MAAM,CAAC;AACpE,QAAI,IAAI,SAAS,gBAAgB,IAAI,YAAY,SAAS,QAAS,OAAM,IAAI,MAAM,qCAAqC;AACxH,QAAI,CAACC,WAAU,YAAY,gBAAgB,EAAE,OAAO,EAAG,OAAM,IAAI,MAAM,wCAAwC;AAC/G,UAAM,QAAQ,OAAO,KAAK,CAAC,YAAY,OAAO,UAAU,WAAW,GAAG,EAAE,GAAG,YAAY,KAAK,SAAS,KAAK,QAAQ,SAAS,IAAO,CAAC;AACnI,QAAI,MAAM,WAAW,KAAK,OAAO,MAAM,UAAU,EAAE,EAAE,KAAK,MAAM,iBAAiB,SAAS,OAAO,IAAI;AACnG,YAAM,IAAI,MAAM,oCAAoC;AAAA,IACtD;AACA,UAAM,SAAS,YAAY,QAAQ,UAAU,WAAW;AACxD,oBAAgBJ,MAAK,SAAS,uBAAuB,GAAG,EAAE,gBAAgB,GAAG,GAAG,OAAO,CAAC;AACxF,IAAAQ,WAAUR,MAAK,aAAa,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AACzD,QAAIO,YAAW,WAAW,QAAQ,EAAG,OAAM,IAAI,MAAM,uCAAuC;AAC5F,IAAAG,YAAW,SAAS,WAAW,QAAQ;AACvC,oBAAgB;AAChB,UAAM,YAAY,aAAa,aAAa,MAAM;AAClD,QAAI,CAAC,UAAU,GAAI,OAAM,IAAI,MAAM,qCAAqC,UAAU,MAAM,EAAE;AAC1F,WAAO,EAAE,QAAQ,SAAS,KAAK;AAAA,EACjC,SAAS,OAAO;AACd,QAAI,cAAe,CAAAC,QAAO,WAAW,UAAU,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC/E,UAAM;AAAA,EACR,UAAE;AACA,IAAAA,QAAO,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EAClD;AACF;AAEO,SAAS,wBAAwB,SAAS;AAC/C,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,QAAQ;AAAA,IACnB,WAAW,QAAQ;AAAA,IACnB,MAAM,QAAQ;AAAA,IACd,aAAaJ;AAAA,IACb,MAAM;AAAA,IACN,QAAQ;AAAA,EACV,IAAI;AACJ,MAAI,CAAC,eAAe,CAACK,YAAW,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,mCAAmC;AACxH,MAAI,CAAC,mBAAmB,CAACd,iBAAgB,KAAK,GAAG,YAAY,IAAI,eAAe,EAAE,GAAG;AACnF,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,kCAAkC;AAAA,EAC3E;AACA,MAAI,CAAC,qBAAqB,CAACC,cAAa,KAAK,iBAAiB,GAAG;AAC/D,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,oCAAoC;AAAA,EAC7E;AACA,QAAM,YAAY,GAAG,YAAY,IAAI,eAAe;AACpD,MAAI,gBAAgB,UAAW,QAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,wDAAwD;AAC9H,QAAM,eAAec,SAAQ,WAAW;AACxC,QAAM,SAAS,2BAA2B,KAAK,YAAY;AAC3D,QAAM,aAAa,EAAE,KAAK,QAAQ,KAAK,aAAa;AACpD,MAAI,SAAS;AACb,MAAI;AACF,IAAAL,WAAU,cAAc,EAAE,WAAW,KAAK,CAAC;AAC3C,IAAAA,WAAUR,MAAK,cAAc,aAAa,GAAG,EAAE,WAAW,KAAK,CAAC;AAChE,IAAAS,eAAc,OAAO,uBAAuB,IAAI,EAAE,MAAM,IAAM,CAAC;AAC/D,IAAAA,eAAc,OAAO,yBAAyB,IAAI,EAAE,MAAM,IAAM,CAAC;AACjE,UAAM,SAAS,cAAc,EAAE,UAAU,UAAU,KAAK,QAAQ,YAAY,IAAI,CAAC;AACjF,UAAM,WAAW,EAAE,SAAS,iBAAiB,WAAW,kBAAkB;AAC1E,aAAST,MAAK,cAAc,WAAWM,YAAW,CAAC;AACnD,IAAAE,WAAU,QAAQ,EAAE,WAAW,KAAK,CAAC;AACrC,UAAM,SAAS,gBAAgB,OAAO,IAAI;AAAA,MACxC;AAAA,MAAQ;AAAA,MAAW;AAAA,MAAoB;AAAA,MAAU;AAAA,MAAsB;AAAA,MAAQ,cAAc,eAAe;AAAA,IAC9G,GAAG,UAAU,GAAG,UAAU;AAC1B,UAAM,SAAS,MAAM,QAAQ,MAAM,IAAI,OAAO,CAAC,IAAI;AACnD,UAAM,UAAUR,MAAK,QAAQ,SAAS,OAAO,QAAQ,YAAY,EAAE,CAAC,CAAC;AACrE,QAAI,CAACO,YAAW,OAAO,KAAK,CAAC,SAAS,OAAO,EAAE,SAAS,MAAM,EAAG,OAAM,IAAI,MAAM,8BAA8B;AAC/G,QAAIH,WAAU,OAAO,EAAE,OAAO,kBAAmB,OAAM,IAAI,MAAM,2CAA2C;AAC5G,QAAI,OAAO,cAAc,SAAS,aAAa,iBAAiB,OAAO,MAAM,SAAS,WAAW;AAC/F,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AACA,UAAM,YAAY,YAAY,EAAE,aAAa,cAAc,UAAU,SAAS,QAAQ,QAAQ,YAAY,MAAM,CAAC;AACjH,WAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,GAAG,UAAU;AAAA,EAC7C,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,QAAQ,8BAA8B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,GAAG,EAAE;AAAA,EACpI,UAAE;AACA,QAAI,OAAQ,CAAAO,QAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EAC7D;AACF;AAEO,SAAS,8BAA8B,SAAS;AACrD,QAAM,SAAS,wBAAwB,OAAO;AAC9C,MAAI,CAAC,OAAO,GAAI,QAAO;AACvB,MAAI;AACF,iBAAaE,SAAQ,QAAQ,WAAW,GAAG,OAAO,QAAQ,QAAQ,MAAM;AACxE,WAAO,EAAE,GAAG,QAAQ,SAAS,KAAK;AAAA,EACpC,SAAS,OAAO;AACd,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,QAAQ,8BAA8B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,QAAQ,OAAO,QAAQ,GAAG;AAAA,IAC1H;AAAA,EACF;AACF;;;AEhPA,IAAM,mBAAmB;AACzB,IAAM,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,EAAE,CAAC;AAEtE,eAAsB,oCAAoC;AAAA,EACxD;AAAA,EACA,UAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAY;AAAA,EACZ,SAAS;AACX,GAAG;AACD,MAAI,CAAC,oBAAoB,CAAC,wBAAyB,OAAM,IAAI,MAAM,4CAA4C;AAC/G,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,QAAI;AACF,YAAM,UAAU,MAAM,OAAO,gBAAgB,EAAE,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC,EAAG,CAAC;AACtF,YAAM,SAAS,QAAQ,KAAK,CAAC,SAAS,MAAM,cAAcA,aACrD,KAAK,WAAW,aACf,mBACA,KAAK,aAAa,uBAAuB,mBACzC,QAAQ,KAAK,aAAa,kBAAkB,KACzC,KAAK,YAAY,uBAAuB,4BAC5C,KAAK,aAAa,mBAAmB,iBACrC,KAAK,aAAa,2BAA2B,mBAAmB,wBAChE,KAAK,aAAa,uBAAuB,mBAAmB,qBAC5D,mBAAmB,aAAa,MAAM,CAAC,UAAU,KAAK,aAAa,yBAAyB,SAAS,KAAK,CAAC,KAC3G,MAAM,QAAQ,KAAK,aAAa,gBAAgB,KAChD,KAAK,YAAY,iBAAiB,KAAK,CAAC,UAAU,MAAM,UAAU,KAAK,YAAY,iBACjF,MAAM,cAAc,QAAQ,MAAM,kBAAkB,IAAI,CAAC;AAChE,UAAI,OAAQ,QAAO;AAAA,IACrB,QAAQ;AAAA,IAAsB;AAC9B,UAAM,MAAM,MAAM;AAAA,EACpB;AACA,QAAM,IAAI,MAAM,qDAAqD;AACvE;AAOA,eAAsB,wBAAwB;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAAA;AAAA,EACA,UAAAC;AAAA,EACA,gBAAAC;AAAA,EACA;AAAA,EACA,oBAAAC;AAAA,EACA,aAAAC;AAAA,EACA,qBAAqB;AAAA,EACrB;AAAA,EACA;AAAA,EACA,WAAAC;AAAA,EACA;AAAA,EACA,MAAM,MAAM;AAAA,EAAC;AACf,GAAG;AACD,QAAM,UAAU,cAAc,eAAe,WAAW,IAAI;AAC5D,MAAI,CAAC,SAAS,QAAS,QAAO;AAC9B,QAAM,oBAAoB,QAAQ,QAAQ,aAAaL;AACvD,QAAM,sBAAsB,QAAQ,QAAQ,eAAe;AAC3D,MAAI,QAAQ,QAAQ,oBAAoB,UAAU;AAChD,QAAI;AACF,YAAM,OAAO,sBAAsB,QAAQ,QAAQ,WAAW;AAAA,QAC5D,UAAU;AAAA,QACV,GAAI,sBAAsB,EAAE,YAAY,oBAAoB,IAAI,CAAC;AAAA,QACjE,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,QAAQ,QAAQ,QAAQ;AAAA,MAC1B,CAAC;AACD,mCAA6B,aAAa,OAAO;AACjD,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,uDAAuD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AACnH,YAAMK,WAAU,KAAK;AACrB,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,kBAAc,wBAAwB,EAAE,aAAa,UAAAJ,WAAU,SAASC,gBAAe,CAAC;AACxF,QAAI,CAAC,YAAY,GAAI,OAAM,IAAI,MAAM,YAAY,MAAM;AACvD,QAAI,CAAE,MAAMC,oBAAmB,KAAK,EAAI,OAAM,IAAI,MAAM,+CAA+C;AAAA,EACzG,SAAS,OAAO;AACd,QAAI,SAAS,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG;AACpH,QAAI,aAAa;AACjB,QAAI;AACF,mBAAa,mBAAmB,aAAa,SAAS,MAAM;AAAA,IAC9D,SAAS,eAAe;AACtB,eAAS,GAAG,MAAM,uBAAuB,yBAAyB,QAAQ,cAAc,UAAU,OAAO,aAAa,CAAC,GAAG,MAAM,GAAG,GAAG;AAAA,IACxI;AACA,QAAI;AACF,YAAM,OAAO,sBAAsB,QAAQ,QAAQ,WAAW;AAAA,QAC5D,UAAU;AAAA,QACV,GAAI,sBAAsB,EAAE,YAAY,oBAAoB,IAAI,CAAC;AAAA,QACjE,GAAG;AAAA,QACH,QAAQ;AAAA,QACR;AAAA,MACF,CAAC;AACD,UAAI,WAAY,8BAA6B,aAAa,UAAU;AAAA,IACtE,QAAQ;AAAA,IAER,UAAE;AACA,YAAME,WAAU,KAAK;AAAA,IACvB;AACA,WAAO;AAAA,EACT;AAEA,MAAI,4BAA4B;AAChC,MAAI;AACF,UAAM,SAAS,MAAMD,aAAY;AACjC,gCAA4B,QAAQ,oBAAoB;AACxD,UAAM,mBAAmB;AAAA,MACvB;AAAA,MACA,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,kBAAkB,QAAQ;AAAA,MAC1B,eAAe,UAAU,YAAY,OAAO,OAAO;AAAA,MACnD;AAAA,MACA,WAAW;AAAA,MACX,QAAQ;AAAA,IACV,CAAC;AACD,UAAM,OAAO,sBAAsB,QAAQ,QAAQ,WAAW;AAAA,MAC5D,UAAU;AAAA,MACV,GAAI,sBAAsB,EAAE,YAAY,oBAAoB,IAAI,CAAC;AAAA,MACjE,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,QAAQ,2BAA2B,YAAY,OAAO,OAAO,IAAI,YAAY,OAAO,SAAS;AAAA,IAC/F,CAAC;AACD,uBAAmB,aAAa,YAAY,OAAO;AACnD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,sCAAsC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG;AAC3H,QAAI;AACJ,QAAI;AAAE,cAAQ,sBAAsB,aAAa,YAAY,SAAS,OAAO;AAAA,IAAG,SACzE,YAAY;AACjB,UAAI,2CAA2C,sBAAsB,QAAQ,WAAW,UAAU,OAAO,UAAU,CAAC,EAAE;AACtH,YAAMC,WAAU,KAAK;AACrB,aAAO;AAAA,IACT;AACA,QAAI,MAAM,QAAQ,eAAe,kBAAkB;AACjD,UAAI,uCAAuC,MAAM,QAAQ,YAAY,IAAI,gBAAgB,GAAG;AAC5F,YAAMA,WAAU,KAAK;AACrB,aAAO;AAAA,IACT;AAEA,UAAM,WAAW,aAAa,aAAa,MAAM,QAAQ;AACzD,QAAI,SAAS,GAAG,OAAO,mDAAmD,MAAM,GAAG,GAAG;AACtF,QAAI,gBAAgB;AACpB,QAAI,aAAa;AACjB,QAAI;AACF,UAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,6BAA6B,SAAS,MAAM,IAAI,EAAE,OAAO,MAAM,CAAC;AAClG,mBAAa,mBAAmB,aAAa,OAAO,MAAM;AAC1D,YAAMA,WAAU,KAAK;AACrB,sBAAgB,oBAAoB,SAAS,MAAM,KAAK;AACxD,UAAI,CAAE,MAAMF,oBAAmB,aAAa,EAAI,OAAM,IAAI,MAAM,gDAAgD,EAAE,OAAO,MAAM,CAAC;AAChI,YAAM,SAAS,MAAMC,aAAY;AACjC,YAAM,mBAAmB;AAAA,QACvB;AAAA,QACA,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,kBAAkB,QAAQ;AAAA,QAC1B,yBAAyB,QAAQ,mBAAmB,SAAY;AAAA,QAChE,eAAe,UAAU,MAAM,SAAS,OAAO;AAAA,QAC/C;AAAA,QACA,WAAW;AAAA,QACX,QAAQ;AAAA,MACV,CAAC;AAAA,IACH,SAAS,eAAe;AACtB,eAAS,GAAG,MAAM,4BAA4B,yBAAyB,QAAQ,cAAc,UAAU,OAAO,aAAa,CAAC,GAAG,MAAM,GAAG,GAAG;AAAA,IAC7I;AACA,QAAI;AACF,YAAM,OAAO,sBAAsB,MAAM,QAAQ,WAAW;AAAA,QAC1D,UAAU;AAAA,QACV,GAAI,sBAAsB,EAAE,YAAY,oBAAoB,IAAI,CAAC;AAAA,QACjE,GAAG;AAAA,QACH,QAAQ;AAAA,QACR;AAAA,MACF,CAAC;AACD,UAAI,WAAY,8BAA6B,aAAa,UAAU;AAAA,IACtE,QAAQ;AAAA,IAAqE;AAC7E,QAAI,cAAe,OAAMC,WAAU,aAAa;AAAA,QAC3C,OAAMA,WAAU,KAAK;AAC1B,WAAO;AAAA,EACT;AACF;;;ACxMA,SAAS,YAAY,sBAAsB;;;ACU3C,SAAS,OAAO,EAAE,SAAS,OAAO,aAAa,MAAM,WAAW,MAAM,cAAc,MAAM,OAAO,QAAQ,GAAG;AAC1G,SAAO,EAAE,IAAI,OAAO,QAAQ,YAAY,UAAU,aAAa,OAAO,QAAQ;AAChF;AAEA,eAAe,aAAa,UAAU;AACpC,MAAI;AACF,UAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,WAAO,SAAS,OAAO,UAAU,WAAW,QAAQ,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,cAAc,MAAM,UAAU;AACrC,SAAO,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,KAAK,IAAI,KAAK,QAAQ,KAAK,IAAI;AACzF;AAEA,eAAe,iBAAiB,WAAW,KAAK,MAAM,WAAW;AAC/D,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAC5D,MAAI;AACF,WAAO,MAAM,UAAU,KAAK,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,CAAC;AAAA,EACpE,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAWA,eAAsB,qBAAqB;AAAA,EACzC;AAAA,EACA;AAAA,EACA,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,YAAY;AACd,GAAG;AACD,QAAM,OAAO,gBAAgB,QAAQ,SAAS,EAAE;AAChD,QAAM,UAAU,EAAE,eAAe,UAAU,KAAK,GAAG;AACnD,MAAI;AACJ,MAAI;AACF,uBAAmB,MAAM;AAAA,MACvB;AAAA,MACA,GAAG,IAAI;AAAA,MACP,EAAE,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS,gCAAgC,MAAM;AAAA,IACjD,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,MAAM,aAAa,gBAAgB;AACpD,MAAI,CAAC,iBAAiB,IAAI;AACxB,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,SAAS,gBAAgB,QACzB,SAAS,SAAS,cAClB,OAAO,SAAS,gBAAgB,YAChC,CAAC,SAAS,YAAY,KAAK,KAC3B,OAAO,SAAS,cAAc,YAC9B,CAAC,SAAS,UAAU,KAAK,GACzB;AACA,WAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,SAAS,YAAY,KAAK;AAC7C,QAAM,WAAW,SAAS,UAAU,KAAK;AACzC,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,OAAO;AAAA,MACP,SAAS;AAAA,IACX;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,qBAAiB,MAAM;AAAA,MACrB;AAAA,MACA,GAAG,IAAI;AAAA,MACP;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,SAAS,gBAAgB,mBAAmB;AAAA,QAC1D,MAAM;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,WAAO,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,OAAO;AAAA,MACP,SAAS,sDAAsD,MAAM;AAAA,IACvE,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,MAAM,aAAa,cAAc;AAChD,MAAI,CAAC,eAAe,MAAM,OAAO,OAAO,UAAU,YAAY,CAAC,OAAO,OAAO;AAC3E,UAAM,QAAQ,OAAO,OAAO,UAAU,YAAY,OAAO,QAAQ,OAAO,QAAQ;AAChF,WAAO,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb;AAAA,MACA,SAAS,cAAc,QAAQ,6CAA6C,eAAe,MAAM,IAAI;AAAA,IACvG,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,EACX;AACF;AAEO,SAAS,oBAAoB,WAAW;AAC7C,SAAO,WAAW,OAAO,QACvB,WAAW,WAAW,QACtB,OAAO,UAAU,eAAe,YAChC,UAAU,WAAW,KAAK,IACxB,UAAU,WAAW,KAAK,IAC1B;AACN;;;AD7JO,SAAS,0BAA0B,MAAM,CAAC,GAAG,WAAW,gBAAgB;AAC7E,QAAM,WAAW,OAAO,IAAI,qBAAqB,EAAE,EAAE,KAAK;AAC1D,SAAO,YAAY,kBAAkB,SAAS,CAAC;AACjD;AAGO,SAAS,wBAAwB;AAAA,EACtC,UAAU,CAAC;AAAA,EACX;AAAA,EACA,qBAAqB;AAAA,EACrB,mBAAmB;AACrB,IAAI,CAAC,GAAG;AACN,QAAM,WAAW;AAAA,IACf,GAAG;AAAA,IACH,sBAAsB;AAAA,EACxB;AACA,QAAM,aAAa,OAAO,uBAAuB,WAAW,mBAAmB,KAAK,IAAI;AACxF,QAAM,aAAa,OAAO,qBAAqB,WAAW,iBAAiB,KAAK,IAAI;AAEpF,MAAI,WAAY,UAAS,+BAA+B;AAAA,MACnD,QAAO,SAAS;AAErB,MAAI,WAAY,UAAS,8BAA8B;AACvD,SAAO;AACT;AAGA,eAAsB,sBAAsB;AAAA,EAC1C,UAAU,CAAC;AAAA,EACX,mBAAmB;AAAA,EACnB;AAAA,EACA,iBAAiB;AACnB,IAAI,CAAC,GAAG;AACN,QAAM,qBAAqB,QAAQ,8BAA8B,KAAK;AACtE,QAAM,QAAQ,sBAAsB,kBAAkB;AACtD,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,2DAA2D;AAEvF,MAAI,aAAa,OAAO,QAAQ,+BAA+B,EAAE,EAC9D,MAAM,SAAS,EACf,OAAO,OAAO,EAAE,CAAC,KAAK;AACzB,MAAI,CAAC,oBAAoB;AACvB,UAAM,YAAY,MAAM,eAAe,EAAE,iBAAiB,OAAO,eAAe,KAAK,CAAC;AACtF,QAAI,CAAC,UAAU,GAAI,OAAM,IAAI,MAAM,4BAA4B,UAAU,OAAO,EAAE;AAClF,iBAAa,oBAAoB,SAAS,KAAK;AAC/C,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,2DAA2D;AAAA,EAC9F;AAEA,QAAM,WAAW,wBAAwB;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,qBAAqB,OAAO;AAAA,EAChD,CAAC;AACD,QAAM,YAAY;AAAA,IAChB,GAAG;AAAA,IACH,8BAA8B;AAAA,IAC9B,sBAAsB;AAAA,IACtB,GAAI,aAAa,EAAE,6BAA6B,WAAW,IAAI,CAAC;AAAA,EAClE;AACA,SAAO,EAAE,UAAU,WAAW,WAAW;AAC3C;;;AEhEA,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,WAAAC,UAAS,QAAAC,aAAY;AAC9B,SAAS,qBAAqB;AAEvB,SAAS,4BAA4B,UAAU,YAAY,KAAK;AACrE,QAAM,YAAYD,SAAQ,cAAc,OAAO,CAAC;AAChD,QAAM,UAAUC,MAAK,WAAW,iCAAiC;AACjE,QAAM,SAASA,MAAK,WAAW,MAAM,kCAAkC;AACvE,SAAOF,YAAW,MAAM,IAAI,SAAS;AACvC;AAGO,SAAS,6BAA6B;AAAA,EAC3C,OAAAG,SAAQJ;AAAA,EACR,WAAW,QAAQ;AAAA,EACnB,aAAa,4BAA4B;AAAA,EACzC,aAAa,CAAC;AAAA,EACd,MAAM,QAAQ;AAChB,IAAI,CAAC,GAAG;AACN,QAAM,SAASI,OAAM,UAAU,CAAC,YAAY,GAAG,UAAU,GAAG;AAAA,IAC1D;AAAA,IACA,UAAU;AAAA,IACV,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,EACX,CAAC;AACD,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO,OAAO,UAAU,EAAE,CAAC;AACrD,WAAO,UAAU,OAAO,WAAW,WAAW,SAAS;AAAA,EACzD,QAAQ;AACN,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACF;;;ARnBA,IAAM,4BAA4B;AAClC,IAAM,UAAU;AAChB,IAAM,iBAAiB;AACvB,IAAM,0BAA0B,CAAC,0BAA0B;AAC3D,IAAMC,WAAU;AAChB,IAAM,WAAWC,eAAc,YAAY,GAAG;AAC9C,IAAM,aAAaC,MAAKC,SAAQ,QAAQ,GAAG,eAAe;AAC1D,IAAM,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,EAAE,CAAC;AAEtE,IAAM,WAAW,0BAA0B,QAAQ,GAAG;AAEtD,SAAS,iBAAiB;AACxB,MAAI;AAAE,WAAO,cAAc,YAAY,GAAG,EAAE,iBAAiB,EAAE,WAAW;AAAA,EAAW,QAAQ;AAAE,WAAO;AAAA,EAAW;AACnH;AAEA,IAAM,gCAAgCJ,SAAQ,KAAK,OAAO,QAAQ,IAAI,oCAAoC,EAAE,CAAC,IACzG,QAAQ,IAAI,mCACZK,YAAW;AACf,IAAM,uBAAuB;AAAA,EAC3B,mBAAmB,QAAQ,GAAG;AAAA,EAAG;AACnC;AACA,IAAM,oBAAoB,eAAe;AACzC,IAAM,4BAA4B;AAAA,EAChC;AAAA,EACA;AAAA,EACA,cAAc;AAChB;AAEA,SAAS,WAAW,UAAU;AAC5B,SAAO,MAAM,QAAQ,UAAU,CAAC,UAAU,GAAG;AAAA,IAC3C,KAAK;AAAA,IACL,OAAO;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACH;AAEA,SAAS,mBAAmB,OAAO,UAAU;AAC3C,SAAO,MAAM,QAAQ,UAAU,CAAC,OAAO,QAAQ,GAAG;AAAA,IAChD,KAAK;AAAA,IACL,OAAO;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACH;AAEA,eAAe,cAAc;AAC3B,MAAI;AACF,UAAM,OAAO,OAAO,QAAQ,IAAI,+BAA+B,IAAI;AACnE,UAAM,WAAW,MAAM,MAAM,oBAAoB,IAAI,WAAW,EAAE,QAAQ,YAAY,QAAQ,GAAG,EAAE,CAAC;AACpG,QAAI,CAAC,SAAS,GAAI,QAAO;AACzB,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,WAAO,MAAM,OAAO,OAAO,OAAO;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,mBAAmB,OAAO;AACvC,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,QAAI,MAAM,aAAa,KAAM,QAAO;AACpC,UAAM,SAAS,MAAM,YAAY;AACjC,QAAI,QAAQ,YAAY,QAAQ,OAAO,OAAO,GAAG,MAAM,OAAO,MAAM,GAAG,EAAG,QAAO;AACjF,UAAM,MAAM,GAAG;AAAA,EACjB;AACA,SAAO;AACT;AAEA,eAAe,UAAU,OAAO;AAC9B,MAAI,CAAC,SAAS,MAAM,aAAa,KAAM;AACvC,QAAM,KAAK,QAAQ,aAAa,UAAU,SAAY,SAAS;AAC/D,QAAM,QAAQ,KAAK;AAAA,IACjB,IAAI,QAAQ,CAACD,aAAY,MAAM,KAAK,QAAQA,QAAO,CAAC;AAAA,IACpD,MAAM,IAAM;AAAA,EACd,CAAC;AACD,MAAI,MAAM,aAAa,KAAM,OAAM,KAAK,SAAS;AACnD;AAEA,eAAe,OAAO;AAIpB,QAAM,SAAS,6BAA6B;AAC5C,QAAM,kBAAkB,QAAQ,IAAI,wBAAwB;AAC5D,QAAM,EAAE,UAAU,WAAW,WAAW,IAAI,MAAM,sBAAsB;AAAA,IACtE,SAAS,QAAQ;AAAA,IACjB,kBAAkB;AAAA,IAClB;AAAA,EACF,CAAC;AACD,SAAO,OAAO,UAAU;AAAA,IACtB,kCAAkC;AAAA,IAClC,8BAA8B;AAAA,IAC9B,mCAAmC,wBAAwB,KAAK,GAAG;AAAA,EACrE,CAAC;AACD,QAAM,SAAS,yBAAyB,EAAE,SAAS,iBAAiB,KAAK,UAAU,CAAC;AACpF,QAAM,cAAc,mBAAmB,QAAQ,GAAG;AAClD,MAAI,QAAQ;AACZ,MAAI,WAAW;AACf,MAAI,WAAW;AAEf,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,YAAY,CAAC,aAAa,CAAC,SAAS,MAAM,aAAa,MAAO,SAAQ,YAAY;AAAA,EACzF;AACA,QAAM,cAAc,MAAM;AACxB,UAAM,OAAO,WAAW,QAAQ;AAChC,SAAK,GAAG,QAAQ,MAAM,WAAW,SAAS,GAAI,CAAC;AAC/C,WAAO;AAAA,EACT;AACA,UAAQ,YAAY;AAEpB,MAAI,CAAE,MAAM,wBAAwB;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,IACA,qBAAqB,CAAC,UAAU,mBAAmB,OAAO,QAAQ;AAAA,IAClE,KAAK,CAAC,YAAY,QAAQ,MAAM,0BAA0B,OAAO,EAAE;AAAA,EACrE,CAAC,GAAI;AACH,eAAW;AACX;AAAA,EACF;AAEA,QAAM,WAAW,YAAY;AAC3B,QAAI,SAAU;AACd,eAAW;AACX,UAAM,UAAU,KAAK;AAAA,EACvB;AACA,UAAQ,GAAG,UAAU,MAAM;AAAE,SAAK,SAAS,EAAE,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,EAAG,CAAC;AAC9E,UAAQ,GAAG,WAAW,MAAM;AAAE,SAAK,SAAS,EAAE,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,EAAG,CAAC;AAE/E,SAAO,CAAC,UAAU;AAChB,QAAI;AACF,YAAM,SAAS,MAAM,OAAO,kBAAkB;AAAA,QAC5C;AAAA,QACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,QACnC,GAAG;AAAA,MACL,CAAC;AACD,UAAI,CAAC,QAAQ;AACX,cAAM,MAAM,OAAO;AACnB;AAAA,MACF;AACA,iBAAW;AACX,YAAM,aAAa,MAAM,YAAY;AACrC,UAAI,cAAc,OAAO,WAAW,eAAe,CAAC,IAAI,GAAG;AACzD,cAAM,OAAO,sBAAsB,OAAO,UAAU;AAAA,UAClD;AAAA,UACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,UACnC,GAAG;AAAA,UACH,QAAQ;AAAA,UACR,QAAQ,oBAAoB,WAAW,WAAW;AAAA,QACpD,CAAC;AACD,mBAAW;AACX;AAAA,MACF;AACA,YAAM,UAAU,KAAK;AACrB,YAAM,gBAAgB,OAAO,SAAS,YAAY,OAAO,SAAS;AAClE,YAAM,SAAS,gBACX,8BAA8B;AAAA,QAC9B;AAAA,QACA,aAAa,qBAAqB,OAAO,uBAAuB;AAAA,QAChE,iBAAiB,OAAO;AAAA,QACxB,mBAAmB,OAAO;AAAA,QAC1B,QAAQ;AAAA,UACN,UAAU,OAAO;AAAA,UACjB;AAAA,UACA,YAAY,cAAc;AAAA,UAC1B;AAAA,QACF;AAAA,QACA,KAAK,QAAQ;AAAA,QACb,OAAO,OAAO,SAAS;AAAA,MACzB,CAAC,IACC,mBAAmB,OAAO,MAAM;AAAA,QAChC,KAAK;AAAA,QACL,KAAK,CAAC,YAAY,QAAQ,KAAK,0BAA0B,OAAO,EAAE;AAAA,MACpE,CAAC;AACH,UAAI,OAAO,MAAM,OAAO,SAAS;AAC/B,gBAAQ,KAAK,oCAAoC,OAAO,OAAO,OAAO,uCAAuC;AAC7G;AAAA,MACF;AACA,cAAQ,YAAY;AACpB,YAAM,MAAM,cAAc;AAC1B,UAAI,MAAM,aAAa,QAAQ,CAAE,MAAM,mBAAmB,KAAK,EAAI,QAAO,KAAK;AAC/E,YAAM,OAAO,sBAAsB,OAAO,UAAU;AAAA,QAClD;AAAA,QACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,QACnC,GAAG;AAAA,QACH,QAAQ,OAAO,KAAK,cAAc;AAAA,QAClC,QAAQ,OAAO,KACX,UAAU,eAAe,CAAC,iBAC1B,sBAAsB,OAAO,MAAM,GAAG,OAAO,SAAS,KAAK,OAAO,MAAM,KAAK,EAAE;AAAA,MACrF,CAAC;AACD,iBAAW;AAAA,IACb,SAAS,OAAO;AACd,cAAQ,MAAM,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAChG,iBAAW;AACX,YAAM,MAAM,OAAO;AAAA,IACrB;AAAA,EACF;AACF;AAEA,KAAK,EAAE,MAAM,CAAC,UAAU;AACtB,UAAQ,MAAM,iCAAiC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AACvG,UAAQ,WAAW;AACrB,CAAC;",
6
+ "names": ["randomUUID", "fileURLToPath", "dirname", "join", "getFirebaseAuth", "runnerId", "supervisorInstanceId", "supervisorVersion", "spawn", "createHash", "randomUUID", "existsSync", "lstatSync", "mkdirSync", "readFileSync", "readdirSync", "renameSync", "rmSync", "writeFileSync", "isAbsolute", "join", "resolve", "spawnSync", "existsSync", "selfPath", "PACKAGE_SPEC_RE", "INTEGRITY_RE", "join", "spawnSync", "createHash", "readFileSync", "lstatSync", "readdirSync", "randomUUID", "existsSync", "mkdirSync", "writeFileSync", "renameSync", "rmSync", "isAbsolute", "resolve", "resolve", "runnerId", "selfPath", "packageVersion", "waitForLocalRunner", "localStatus", "stopChild", "spawnSync", "existsSync", "dirname", "join", "spawn", "UUID_RE", "fileURLToPath", "join", "dirname", "resolve", "randomUUID"]
7
7
  }
package/dist/supervisor-credential-helper.js CHANGED
@@ -113,6 +113,11 @@ function readStoredCredential(env = process.env, keychain = realKeychain) {
113
113
  }
114
114
  return readFromFile(env);
115
115
  }
116
+ function readStoredCredentialKeychainOnly(env = process.env, keychain = realKeychain) {
117
+ if (!keychainEnabled(env, keychain)) return null;
118
+ const raw = keychain.get();
119
+ return raw ? deserialize(raw) : null;
120
+ }
116
121
 
117
122
  // src/cloud/auth-token-source.ts
118
123
  var FIREBASE_SECURETOKEN_URL = "https://securetoken.googleapis.com/v1/token";
@@ -208,8 +213,9 @@ function createAuthTokenSourceFromEnv(env = process.env, fetchFn, readStoredCred
208
213
  }
209
214
 
210
215
  // src/supervisor-credential-helper.mjs
211
- var credential = readStoredCredential();
212
- if (process.argv.includes("--control-plane-auth")) {
216
+ var keychainOnly = process.argv.includes("--control-plane-auth-keychain-only");
217
+ var credential = keychainOnly ? readStoredCredentialKeychainOnly() : readStoredCredential();
218
+ if (process.argv.includes("--control-plane-auth") || keychainOnly) {
213
219
  const source = createAuthTokenSourceFromEnv(process.env, void 0, () => credential);
214
220
  const token = await source?.getToken();
215
221
  if (!token) {