@algosuite/vo-mcp 0.2.0-beta.25 → 0.2.0-beta.27

package/dist/agent-auth-probe-cli.mjs

@@ -177,27 +177,46 @@ function getAnthropicKey({ EntryCtor = defaultEntryCtor() } = {}) {
 }
 var PREFER_LOGIN_ENV = "VO_RUNNER_PREFER_LOGIN";
 var CLAUDE_PREFER_LOGIN_ENV = "VO_RUNNER_CLAUDE_PREFER_LOGIN";
+var PREFER_KEY_ENV = "VO_RUNNER_PREFER_KEY";
+var CLAUDE_PREFER_KEY_ENV = "VO_RUNNER_CLAUDE_PREFER_KEY";
 function isTruthyFlag(v) {
   const s = String(v ?? "").trim().toLowerCase();
   return s === "1" || s === "true" || s === "yes" || s === "on";
 }
-function withAnthropicKey(baseEnv = {}, { getKey = getAnthropicKey } = {}) {
-  if (isTruthyFlag(baseEnv[CLAUDE_PREFER_LOGIN_ENV]) || isTruthyFlag(baseEnv[PREFER_LOGIN_ENV])) {
+function wantsLogin(env) {
+  return isTruthyFlag(env[CLAUDE_PREFER_LOGIN_ENV]) || isTruthyFlag(env[PREFER_LOGIN_ENV]);
+}
+function wantsKey(env) {
+  return isTruthyFlag(env[CLAUDE_PREFER_KEY_ENV]) || isTruthyFlag(env[PREFER_KEY_ENV]);
+}
+function withAnthropicKey(baseEnv = {}, { getKey = getAnthropicKey, probeLogin = probeClaudeLoginState } = {}) {
+  if (wantsLogin(baseEnv)) {
     const next = { ...baseEnv };
     delete next.ANTHROPIC_API_KEY;
     return next;
   }
   if (baseEnv.ANTHROPIC_API_KEY) return { ...baseEnv };
   const key = getKey();
-  return key ? { ...baseEnv, ANTHROPIC_API_KEY: key } : { ...baseEnv };
+  if (!key) return { ...baseEnv };
+  if (!wantsKey(baseEnv) && probeLogin() === true) return { ...baseEnv };
+  return { ...baseEnv, ANTHROPIC_API_KEY: key };
+}
+function claudeCostBasis(env = process.env) {
+  return String(env.ANTHROPIC_API_KEY || "").trim() ? "vendor_billed" : "subscription_api_equivalent";
 }
-function describeAnthropicAuthSource(baseEnv = {}, { getKey = getAnthropicKey } = {}) {
-  if (isTruthyFlag(baseEnv[CLAUDE_PREFER_LOGIN_ENV]) || isTruthyFlag(baseEnv[PREFER_LOGIN_ENV])) {
+function describeAnthropicAuthSource(baseEnv = {}, { getKey = getAnthropicKey, probeLogin = probeClaudeLoginState } = {}) {
+  if (wantsLogin(baseEnv)) {
     return "claude auth login (VO_RUNNER_PREFER_LOGIN set \u2014 any API key ignored)";
   }
   if (baseEnv.ANTHROPIC_API_KEY) return "ANTHROPIC_API_KEY from environment";
-  if (getKey()) return "ANTHROPIC_API_KEY from OS keychain";
-  return "claude auth login session (no API key set)";
+  if (!getKey()) return "claude auth login session (no API key set)";
+  if (wantsKey(baseEnv)) {
+    return "ANTHROPIC_API_KEY from OS keychain (VO_RUNNER_PREFER_KEY set \u2014 subscription ignored)";
+  }
+  if (probeLogin() === true) {
+    return "claude auth login session (subscription beats the stored keychain key)";
+  }
+  return "ANTHROPIC_API_KEY from OS keychain";
 }
 function probeClaudeLoginState({
   spawn: spawn2 = spawnSync2,
@@ -375,6 +394,36 @@ function parseClaudeStreamEvent(line) {
   return event.type === "result" ? buildResultEvent(event) : null;
 }
 
+// ../../scripts/virtual-office/code-runner/agent-auth-tier.mjs
+var AUTH_TIER_SUBSCRIPTION = "subscription";
+var AUTH_TIER_API_KEY = "api_key";
+var AUTH_TIER_LOCAL = "local";
+var AUTH_TIER_UNKNOWN = "unknown";
+var AUTH_TIERS = Object.freeze([
+  AUTH_TIER_SUBSCRIPTION,
+  AUTH_TIER_API_KEY,
+  AUTH_TIER_LOCAL,
+  AUTH_TIER_UNKNOWN
+]);
+var COST_BASIS_TO_TIER = Object.freeze({
+  subscription_api_equivalent: AUTH_TIER_SUBSCRIPTION,
+  vendor_billed: AUTH_TIER_API_KEY,
+  local_zero: AUTH_TIER_LOCAL
+});
+function authTierFromCostBasis(costBasis) {
+  return COST_BASIS_TO_TIER[String(costBasis ?? "")] ?? AUTH_TIER_UNKNOWN;
+}
+function safeAuthTier(compute) {
+  try {
+    return normalizeAuthTier(compute());
+  } catch {
+    return AUTH_TIER_UNKNOWN;
+  }
+}
+function normalizeAuthTier(value) {
+  return AUTH_TIERS.includes(value) ? value : AUTH_TIER_UNKNOWN;
+}
+
 // ../../scripts/virtual-office/code-runner/cli-version-floor.mjs
 var MIN_CLAUDE_CLI_VERSION = "2.1.218";
 var SECURITY_RATIONALE = "Claude Code 2.1.211/2.1.213 fixed a PreToolUse-hook bypass on unsandboxed Bash (our destructive-fs/git/cloud tripwires DO NOT FIRE on older CLIs) and worktree-subagents mutating the main checkout. 2.1.218 fixed Windows paths with a lowercase-\\u segment (e.g. ...\\utils\\, ...\\ui\\) being corrupted into CJK in tool inputs, making those files silently inaccessible \u2014 the fleet is Windows and 1,376 tracked files sit under utils/ alone. Update: npm install -g @anthropic-ai/claude-code (or the native installer).";
@@ -440,9 +489,22 @@ function isTimeout(probe) {
 function notFound(probe) {
   return errorCode(probe?.error) === "ENOENT";
 }
+function resolveClaudeAuthTier({
+  env = process.env,
+  loggedIn = null,
+  getStoredKey = getAnthropicKey
+} = {}) {
+  return safeAuthTier(() => {
+    const spawnEnv = withAnthropicKey(env, { getKey: getStoredKey, probeLogin: () => loggedIn });
+    const tier = authTierFromCostBasis(claudeCostBasis(spawnEnv));
+    if (tier === AUTH_TIER_SUBSCRIPTION && loggedIn !== true) return AUTH_TIER_UNKNOWN;
+    return tier;
+  });
+}
 async function checkClaudeAuth({
   spawnVersion = spawnClaudeSync,
   probeLogin = probeClaudeLoginState,
+  getStoredKey = getAnthropicKey,
   env = process.env
 } = {}) {
   try {
@@ -492,6 +554,10 @@ async function checkClaudeAuth({
     return {
       installed: true,
       authenticated: true,
+      // Dispatch-time billing signal, carried on the same probe that already
+      // paid for the login read. Never sent for a non-authenticated result:
+      // there is no tier without a working credential.
+      authTier: resolveClaudeAuthTier({ env, loggedIn, getStoredKey }),
       message: loggedIn === true ? "claude CLI installed and logged in (claude auth status)" : "claude binary found (login state unknown \u2014 auth check is best-effort)"
     };
   } catch (error) {
@@ -536,7 +602,7 @@ var ClaudeRunner = class {
     return withAnthropicKey(env);
   }
   costBasis(env = process.env) {
-    return String(env.ANTHROPIC_API_KEY || "").trim() ? "vendor_billed" : "subscription_api_equivalent";
+    return claudeCostBasis(env);
   }
   /** Describe which Anthropic auth source the spawn will use (for runner logs). */
   describeAuth(env = process.env) {
@@ -811,6 +877,19 @@ var CodexRunner = class {
   costBasis(env = process.env) {
     return String(env.OPENAI_API_KEY || env.CODEX_API_KEY || "").trim() ? "vendor_billed" : "subscription_api_equivalent";
   }
+  /**
+   * Dispatch-time billing tier for the NEXT codex spawn, from the SAME facts
+   * checkAuth() already gathered — no extra subprocess. applyAuthEnv() is a
+   * keychain read in this process (@napi-rs/keyring), not a spawn.
+   *
+   * Codex is the agent where this signal was already computed and then thrown
+   * away: checkAuth() distinguished "API key available (no persisted ChatGPT
+   * login)" from a real login, but only inside a `message` string that the
+   * heartbeat schema strips before storage. This gives that fact a typed home.
+   */
+  authTier(env = this.env) {
+    return safeAuthTier(() => authTierFromCostBasis(this.costBasis(this.applyAuthEnv(env))));
+  }
   /** Best-effort binary + persisted-login probe. Never throws or spends tokens. */
   async checkAuth() {
     try {
@@ -844,6 +923,7 @@ ${login.stderr || ""}`.trim();
             installed: true,
             authenticated: true,
             ...versionField,
+            authTier: this.authTier(),
             message: "codex API key available (no persisted ChatGPT login)"
           };
         }
@@ -858,6 +938,7 @@ ${login.stderr || ""}`.trim();
         installed: true,
         authenticated: true,
         ...versionField,
+        authTier: this.authTier(),
         message: output || "codex login status succeeded"
       };
     } catch (err) {
@@ -960,6 +1041,16 @@ var CursorRunner = class {
   costBasis(env = process.env) {
     return env.CURSOR_API_KEY ? "vendor_billed" : "unknown";
   }
+  /**
+   * Dispatch-time billing tier. Inherits costBasis()'s deliberate refusal to
+   * guess: a prior interactive `cursor-agent login` has undocumented
+   * subscription semantics, so it reports 'unknown' rather than claiming a
+   * flat-cost seat the runner cannot actually prove. Keychain read only — the
+   * heartbeat never pays for a subprocess to answer this.
+   */
+  authTier(env = process.env) {
+    return safeAuthTier(() => authTierFromCostBasis(this.costBasis(this.applyAuthEnv(env))));
+  }
   /** Best-effort: is `cursor-agent` on PATH? Never throws. */
   async checkAuth() {
     try {
@@ -985,6 +1076,7 @@ var CursorRunner = class {
       return {
         installed: true,
         authenticated: true,
+        authTier: this.authTier(),
         message: "cursor-agent found (EXPERIMENTAL: headless mode may need a TTY; auth check is best-effort)"
       };
     } catch (err) {
@@ -1121,6 +1213,10 @@ var LocalModelRunner = class {
   costBasis() {
     return "local_zero";
   }
+  /** Dispatch-time billing tier: local inference is never billed by a vendor. */
+  authTier() {
+    return safeAuthTier(() => authTierFromCostBasis(this.costBasis()));
+  }
   describeAuth(env = process.env) {
     const authEnv = this.applyAuthEnv(env);
     const provider = resolveLocalProvider(this.env);
@@ -1178,6 +1274,7 @@ var LocalModelRunner = class {
     return {
       installed: true,
       authenticated: true,
+      authTier: this.authTier(),
       message: `${provider} reachable; model "${model}" configured (local-only, no cloud spend)`
     };
   }

package/dist/cli.js

@@ -4474,7 +4474,7 @@ async function buildCloudOrStubResponse(args) {
 
 // src/tools/heal/common-heal.ts
 init_common();
-var HEAL_STUB_REASON = 'cloud-mode not yet wired; tool surface is live, admin-callable wiring pending vo-cloud-tenant-model dispatch (see packages/vo-mcp/src/modes/cloud.ts + EXTRACTION_AUDIT.md "Stub remaining")';
+var HEAL_STUB_REASON = "cloud mode is not configured on this session, so the admin callable was not reached. The wiring exists (see buildCloudOrStubResponse); sign in with `vo-mcp login` to route this tool to the control plane. Note that /api/v1/admin/* additionally requires a founding-operator credential.";
 var HEAL_GATE_TYPE = "admin-action";
 
 // src/tools/heal/trigger-heal.ts
@@ -4495,7 +4495,7 @@ var inputSchema8 = {
   },
   additionalProperties: false
 };
-var description8 = "Triggers a self-heal pass against open PRs. Optionally scope to a `focus_page` (priority queue for one tester) or omit to fire the auto-process queue. Wraps the `voTriggerHeal` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` with structured normalized_input \u2014 cloud-mode wiring is pending. The contract is locked; consumers can call this tool today and get the correct surface without working execution.";
+var description8 = "Triggers a self-heal pass against open PRs. Optionally scope to a `focus_page` (priority queue for one tester) or omit to fire the auto-process queue. Wraps the `voTriggerHeal` admin Cloud Function. Requires a founding-operator credential: the control plane's scoped-operator gate refuses `/api/v1/admin/*` for tenant-scoped accounts, which receive HTTP 403 `scoped_operator_forbidden`. Falls back to a clearly-marked `unimplemented` envelope with structured normalized_input when cloud mode is not configured.";
 function isToolInput8(v) {
   if (typeof v !== "object" || v === null) return false;
   const o = v;
@@ -4553,7 +4553,7 @@ var inputSchema9 = {
   },
   additionalProperties: false
 };
-var description9 = "Retries one or more failed fix attempts by id. Pass `attempt_id` for the single case or `attempt_ids` (up to 50) for the batch case. Wraps `voRetryFixAttempt` / `voRetryFixAttempts` admin Cloud Functions. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description9 = "Retries one or more failed fix attempts by id. Pass `attempt_id` for the single case or `attempt_ids` (up to 50) for the batch case. Wraps `voRetryFixAttempt` / `voRetryFixAttempts` admin Cloud Functions. Requires a founding-operator credential: the control plane's scoped-operator gate refuses `/api/v1/admin/*` for tenant-scoped accounts, which receive HTTP 403 `scoped_operator_forbidden`. Falls back to a clearly-marked `unimplemented` envelope when cloud mode is not configured.";
 function isToolInput9(v) {
   if (typeof v !== "object" || v === null) return false;
   const o = v;
@@ -4641,7 +4641,7 @@ var inputSchema10 = {
   required: ["attempt_id"],
   additionalProperties: false
 };
-var description10 = "Clears (cancels) a single fix attempt by id. Wraps `voClearFixAttempt` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description10 = "Clears (cancels) a single fix attempt by id. Wraps `voClearFixAttempt` admin Cloud Function. Requires a founding-operator credential: the control plane's scoped-operator gate refuses `/api/v1/admin/*` for tenant-scoped accounts, which receive HTTP 403 `scoped_operator_forbidden`. Falls back to a clearly-marked `unimplemented` envelope when cloud mode is not configured.";
 function isToolInput10(v) {
   if (typeof v !== "object" || v === null) return false;
   const o = v;
@@ -4689,7 +4689,7 @@ var inputSchema11 = {
   required: ["run_id"],
   additionalProperties: false
 };
-var description11 = "Cancels a running GitHub Actions workflow by run id. Wraps `voStopWorkflow` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description11 = "Cancels a running GitHub Actions workflow by run id. Wraps `voStopWorkflow` admin Cloud Function. Requires a founding-operator credential: the control plane's scoped-operator gate refuses `/api/v1/admin/*` for tenant-scoped accounts, which receive HTTP 403 `scoped_operator_forbidden`. Falls back to a clearly-marked `unimplemented` envelope when cloud mode is not configured.";
 function isToolInput11(v) {
   if (typeof v !== "object" || v === null) return false;
   const o = v;
@@ -4735,7 +4735,7 @@ var inputSchema12 = {
   properties: {},
   additionalProperties: false
 };
-var description12 = "Returns the current Command Center workflow-runs snapshot (Heal, Manager, Auto-Merge, Deploy on Merge, etc.). Wraps `voGetWorkflowRuns` admin Cloud Function. Read-only diagnostic. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description12 = "Returns the current Command Center workflow-runs snapshot (Heal, Manager, Auto-Merge, Deploy on Merge, etc.). Wraps `voGetWorkflowRuns` admin Cloud Function. Read-only diagnostic. Requires a founding-operator credential: the control plane's scoped-operator gate refuses `/api/v1/admin/*` for tenant-scoped accounts, which receive HTTP 403 `scoped_operator_forbidden`. Falls back to a clearly-marked `unimplemented` envelope when cloud mode is not configured.";
 function isToolInput12(v) {
   if (typeof v !== "object" || v === null) return false;
   return true;
@@ -4762,7 +4762,7 @@ init_common();
 
 // src/tools/pr/common-pr.ts
 init_common();
-var PR_STUB_REASON = 'cloud-mode not yet wired; tool surface is live, admin-callable wiring pending vo-cloud-tenant-model dispatch (see packages/vo-mcp/src/modes/cloud.ts + EXTRACTION_AUDIT.md "Stub remaining")';
+var PR_STUB_REASON = "cloud mode is not configured on this session, so the admin callable was not reached. The wiring exists (see buildCloudOrStubResponse); sign in with `vo-mcp login` to route this tool to the control plane. Note that /api/v1/admin/* additionally requires a founding-operator credential.";
 var PR_GATE_TYPE = "admin-action";
 
 // src/tools/pr/list-pending-prs.ts
@@ -4774,7 +4774,7 @@ var inputSchema13 = {
   properties: {},
   additionalProperties: false
 };
-var description13 = "Lists open AlgoHQ-source pull requests with blocker / source / tester / specialist-context metadata. Read-only diagnostic for Command Center reads. Wraps `voListPendingPRs` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description13 = "Lists open AlgoHQ-source pull requests with blocker / source / tester / specialist-context metadata. Read-only diagnostic for Command Center reads. Wraps `voListPendingPRs` admin Cloud Function. Requires a founding-operator credential: the control plane's scoped-operator gate refuses `/api/v1/admin/*` for tenant-scoped accounts, which receive HTTP 403 `scoped_operator_forbidden`. Falls back to a clearly-marked `unimplemented` envelope when cloud mode is not configured.";
 function isToolInput13(v) {
   return typeof v === "object" && v !== null;
 }
@@ -4811,7 +4811,7 @@ var inputSchema14 = {
   required: ["pr_number"],
   additionalProperties: false
 };
-var description14 = "Approves + merges a single AlgoHQ-source pull request by number. Wraps `voMergePR` admin Cloud Function (server-side refuses non-AlgoHQ PRs with permission-denied). V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description14 = "Approves + merges a single AlgoHQ-source pull request by number. Wraps `voMergePR` admin Cloud Function (server-side refuses non-AlgoHQ PRs with permission-denied). Requires a founding-operator credential: the control plane's scoped-operator gate refuses `/api/v1/admin/*` for tenant-scoped accounts, which receive HTTP 403 `scoped_operator_forbidden`. Falls back to a clearly-marked `unimplemented` envelope when cloud mode is not configured.";
 function isToolInput14(v) {
   if (typeof v !== "object" || v === null) return false;
   const o = v;
@@ -4856,7 +4856,7 @@ var inputSchema15 = {
   required: ["pr_number"],
   additionalProperties: false
 };
-var description15 = "Closes a pull request without merging. No retry dispatched \u2014 use `vo_reject_and_retry` for close+retry. Wraps `voRejectPR` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description15 = "Closes a pull request without merging. No retry dispatched \u2014 use `vo_reject_and_retry` for close+retry. Wraps `voRejectPR` admin Cloud Function. Requires a founding-operator credential: the control plane's scoped-operator gate refuses `/api/v1/admin/*` for tenant-scoped accounts, which receive HTTP 403 `scoped_operator_forbidden`. Falls back to a clearly-marked `unimplemented` envelope when cloud mode is not configured.";
 function isToolInput15(v) {
   if (typeof v !== "object" || v === null) return false;
   const o = v;
@@ -4895,7 +4895,7 @@ var inputSchema16 = {
   properties: {},
   additionalProperties: false
 };
-var description16 = "Iterates all open AlgoHQ-source pull requests and merges (or arms auto-merge) on each. Returns counts of merged / accepted / total plus per-PR results. Wraps `voApproveAllFixes` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description16 = "Iterates all open AlgoHQ-source pull requests and merges (or arms auto-merge) on each. Returns counts of merged / accepted / total plus per-PR results. Wraps `voApproveAllFixes` admin Cloud Function. Requires a founding-operator credential: the control plane's scoped-operator gate refuses `/api/v1/admin/*` for tenant-scoped accounts, which receive HTTP 403 `scoped_operator_forbidden`. Falls back to a clearly-marked `unimplemented` envelope when cloud mode is not configured.";
 function isToolInput16(v) {
   return typeof v === "object" && v !== null;
 }
@@ -4930,7 +4930,7 @@ var inputSchema17 = {
   required: ["pr_number"],
   additionalProperties: false
 };
-var description17 = "Closes an AlgoHQ pull request and dispatches a self-heal pass to retry the same focus page. Cloud callable refuses non-AlgoHQ PRs and respects the self-heal kill switch + per-PR retry block. Wraps `voRejectAndRetry` admin Cloud Function. V1 stub: returns `verdict: 'unimplemented'` \u2014 cloud-mode wiring pending.";
+var description17 = "Closes an AlgoHQ pull request and dispatches a self-heal pass to retry the same focus page. Cloud callable refuses non-AlgoHQ PRs and respects the self-heal kill switch + per-PR retry block. Wraps `voRejectAndRetry` admin Cloud Function. Requires a founding-operator credential: the control plane's scoped-operator gate refuses `/api/v1/admin/*` for tenant-scoped accounts, which receive HTTP 403 `scoped_operator_forbidden`. Falls back to a clearly-marked `unimplemented` envelope when cloud mode is not configured.";
 function isToolInput17(v) {
   if (typeof v !== "object" || v === null) return false;
   const o = v;
@@ -6613,8 +6613,26 @@ var callMetaWithMetrics = createMetaModelCaller();
 
 // src/consensus/consensus-panel.ts
 var VO_MCP_CONSENSUS_PANEL = {
-  anthropic: "claude-opus-4-7",
-  openai: "gpt-5",
+  // claude-opus-5 (2026-07-24). Opus 4.7 was STRICTLY DOMINATED, not merely old:
+  // Opus 5 is $5/$25 per MTok vs Opus 4.7's $15/$75 — a 3x cost cut on this slot,
+  // corroborated by our own catalog (constants/pricing/sciencePricing.ts prices
+  // claude-opus-5 at 0.010 vs claude-opus-4-7 at 0.030) — AND the same 2026-07-24
+  // release note REMOVED fast mode from Opus 4.7 outright: `speed: "fast"` now
+  // returns an error there rather than degrading, unlike the Opus 4.6 removal.
+  // Verified served: GET /v1/models/claude-opus-5 -> HTTP 200 (2026-07-30).
+  //
+  // Claude-5 API safety checked before this swap: Opus 5 rejects `temperature` /
+  // `top_p` / `top_k` and manual `thinking.budget_tokens` with HTTP 400. Neither
+  // the consensus-engine Anthropic adapter nor functions-shared `callAnthropic`
+  // sends any of them, and buildAdaptiveThinking emits `thinking: {type:'adaptive'}`
+  // (the supported form) — so this swap cannot 400.
+  anthropic: "claude-opus-5",
+  // gpt-5.6-terra (GA 2026-07-09; −20% price cut 2026-07-30). NOTE the real IDs
+  // are tiered — `gpt-5.6-sol` / `-terra` / `-luna`; there is NO bare `gpt-5.6`
+  // alias (verified against the served model list, 2026-07-30). Terra is the
+  // cost/capability balance point and the right default for a judgment panel;
+  // Sol is available if verdict quality ever needs it.
+  openai: "gpt-5.6-terra",
   // gemini-2.5-FLASH (not -pro): flash accepts the default thinkingBudget=0 from
   // callGeminiWithMetrics; 2.5-pro REJECTS budget 0 ("only works in thinking mode").
   // Flash is also ~10x cheaper. 2026-06-02.