@tangle-network/agent-runtime 0.128.0 → 0.131.0

package/dist/materialization-COJ1UYQ-.js

@@ -0,0 +1,272 @@
+import { u as ValidationError } from "./errors-DEAvWQPy.js";
+import { t as detachedSnapshot } from "./snapshot-CXiiuHhL.js";
+import { t as assertExecutableAgentProfile } from "./model-policy-CqziaqS1.js";
+import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest } from "@tangle-network/agent-interface";
+import { randomUUID } from "node:crypto";
+//#region src/runtime/supervise/executable-spec.ts
+/**
+* Parse one untrusted profile into the exact immutable value execution may consume.
+*
+* Snapshotting before schema parsing reads caller-owned fields once. Snapshotting the parsed
+* result prevents downstream custom code from changing any identity or authority field.
+*/
+function executableAgentProfileSnapshot(raw, context) {
+	const input = detachedSnapshot(raw, `${context}: AgentProfile input`);
+	const profile = agentProfileSchema.parse(input);
+	assertExecutableAgentProfile(profile, context);
+	return detachedSnapshot(profile, `${context}: parsed AgentProfile`);
+}
+/** Snapshot an executable spec while retaining trusted callbacks by reference. */
+function executableAgentSpecSnapshot(raw, context) {
+	const { profile: rawProfile, harness, execution: rawExecution, ...runtimeExtensions } = raw;
+	const profile = executableAgentProfileSnapshot(rawProfile, context);
+	const execution = rawExecution === void 0 ? void 0 : detachedSnapshot(rawExecution, `${context}: execution attribution`);
+	return Object.freeze({
+		...runtimeExtensions,
+		profile,
+		harness,
+		...execution === void 0 ? {} : { execution }
+	});
+}
+//#endregion
+//#region src/runtime/supervise/materialization.ts
+const runtimeOwnedExecutorMaterializations = /* @__PURE__ */ new WeakMap();
+const runtimeOwnedScopeOwners = /* @__PURE__ */ new WeakMap();
+const declarationKeys = /* @__PURE__ */ new Set([
+	"effectiveProfile",
+	"backend",
+	"model",
+	"execution",
+	"materializer",
+	"plan",
+	"platformAttachments"
+]);
+/**
+* Bind a declaration to a runtime-owned executor without putting an attestable method on the
+* public Executor interface. This module is not a package export: arbitrary caller executors stay
+* unknown even if they add a lookalike `materialization()` property.
+*/
+function attestRuntimeOwnedExecutor(executor, declaration, binding) {
+	runtimeOwnedExecutorMaterializations.set(executor, { current: Object.freeze({
+		kind: "known",
+		declaration: detachedSnapshot(declaration, "runtime-owned executor materialization"),
+		...binding === void 0 ? {} : { binding: detachedSnapshot(binding, "runtime-owned executor execution binding") }
+	}) });
+	return executor;
+}
+/** Brand an external Runtime executor whose exact remote materialization is provable only after
+* its terminal protocol acknowledgement. The declaration is a planned authority check, never a
+* known receipt; callers must finalize this same object after validating the acknowledgement. */
+function attestRuntimeOwnedPendingExecutor(executor, runtime, declaration, binding) {
+	runtimeOwnedExecutorMaterializations.set(executor, { current: Object.freeze({
+		kind: "pending",
+		runtime,
+		declaration: detachedSnapshot(declaration, "pending executor materialization"),
+		binding: detachedSnapshot(binding, "pending executor execution binding")
+	}) });
+	return executor;
+}
+/** Replace a private pending brand with terminally acknowledged evidence. A caller-owned executor
+* cannot enter this path because only this module can create the pending WeakMap entry. */
+function finalizeRuntimeOwnedPendingExecutor(executor, declaration, binding) {
+	const ref = runtimeOwnedExecutorMaterializations.get(executor);
+	if (ref?.current.kind !== "pending" || ref.current.runtime !== executor.runtime) throw new ValidationError("executor materialization: terminal acknowledgement has no matching Runtime-owned pending executor");
+	ref.current = Object.freeze({
+		kind: "known",
+		declaration: detachedSnapshot(declaration, "runtime-owned executor materialization"),
+		binding: detachedSnapshot(binding, "runtime-owned executor execution binding")
+	});
+	return executor;
+}
+/** Mark a runtime-owned orchestration executor whose exact leaf declaration is published through
+* its private nested Scope before the first backend inference. Arbitrary executors cannot opt in. */
+function attestRuntimeOwnedDeferredExecutor(executor, runtime) {
+	runtimeOwnedExecutorMaterializations.set(executor, { current: Object.freeze({
+		kind: "deferred",
+		runtime
+	}) });
+	return executor;
+}
+/** Preserve the runtime-owned attestation when a trusted wrapper changes result semantics only. */
+function inheritRuntimeOwnedExecutorAttestation(source, wrapper) {
+	const ref = runtimeOwnedExecutorMaterializations.get(source);
+	if (ref !== void 0) runtimeOwnedExecutorMaterializations.set(wrapper, ref);
+	return wrapper;
+}
+/** Read a declaration only when Runtime itself branded this exact executor object. */
+function runtimeOwnedExecutorMaterialization(executor) {
+	const attestation = runtimeOwnedExecutorMaterializations.get(executor)?.current;
+	return attestation?.kind === "known" ? attestation.declaration : void 0;
+}
+/** Read one attempt binding only from the private brand on this exact executor object. */
+function runtimeOwnedExecutorExecutionBinding(executor) {
+	const attestation = runtimeOwnedExecutorMaterializations.get(executor)?.current;
+	return attestation?.kind === "known" ? attestation.binding : void 0;
+}
+/** Read a planned external declaration only for Runtime's private pending brand. This is useful for
+* pre-execution authority checks, but must never be turned into a known durable receipt. */
+function runtimeOwnedPendingExecutorMaterialization(executor) {
+	const attestation = runtimeOwnedExecutorMaterializations.get(executor)?.current;
+	return attestation?.kind === "pending" ? {
+		runtime: attestation.runtime,
+		declaration: attestation.declaration,
+		binding: attestation.binding
+	} : void 0;
+}
+/** Read the expected leaf runtime only for a privately branded deferred orchestration executor. */
+function runtimeOwnedDeferredExecutorRuntime(executor) {
+	const attestation = runtimeOwnedExecutorMaterializations.get(executor)?.current;
+	return attestation?.kind === "deferred" ? attestation.runtime : void 0;
+}
+/** Propagate trust from a built-in driver adapter to the Agent and recursive executor it owns. */
+function attestRuntimeOwnedScopeOwner(owner, runtime) {
+	runtimeOwnedScopeOwners.set(owner, runtime);
+	return owner;
+}
+/** Return a built-in scope owner's expected concrete leaf runtime; caller-owned functions/Agents
+* deliberately have no entry even if they add lookalike fields. */
+function runtimeOwnedScopeOwnerRuntime(owner) {
+	return runtimeOwnedScopeOwners.get(owner);
+}
+/** Build one kernel-owned known receipt from a data-only executor declaration. */
+function knownMaterializationReceipt(input) {
+	const declaration = detachedSnapshot(input.declaration, "executor materialization");
+	assertExactDeclaration(declaration);
+	const effectiveProfile = agentProfileSchema.safeParse(declaration.effectiveProfile);
+	if (!effectiveProfile.success) throw new ValidationError("executor materialization: effectiveProfile must be an AgentProfile");
+	assertNonEmpty(declaration.backend, "backend");
+	assertNonEmpty(declaration.materializer, "materializer");
+	assertNonEmpty(declaration.execution?.kind, "execution.kind");
+	assertNonEmpty(declaration.execution?.id, "execution.id");
+	assertModel(declaration.model);
+	let effectiveProfileDigest;
+	let materializationPlanDigest;
+	let platformAttachmentsDigest;
+	try {
+		effectiveProfileDigest = canonicalAgentProfileDigest(effectiveProfile.data);
+		materializationPlanDigest = canonicalCandidateDigest(jsonWireSnapshot(declaration.plan));
+		platformAttachmentsDigest = declaration.platformAttachments === void 0 ? void 0 : canonicalCandidateDigest(jsonWireSnapshot(declaration.platformAttachments));
+	} catch (error) {
+		throw new ValidationError("executor materialization: profile, plan, and attachments must be finite RFC 8785 JSON", { cause: error });
+	}
+	return Object.freeze({
+		status: "known",
+		authoredProfileDigest: input.authoredProfileDigest,
+		effectiveProfileDigest,
+		materializationPlanDigest,
+		...platformAttachmentsDigest === void 0 ? {} : { platformAttachmentsDigest },
+		runtime: input.runtime,
+		backend: declaration.backend,
+		model: declaration.model,
+		execution: declaration.execution,
+		materializer: declaration.materializer
+	});
+}
+/** Build an explicit unknown receipt without fabricating any executor-owned identity. */
+function unknownMaterializationReceipt(input) {
+	return Object.freeze({
+		status: "unknown",
+		...input.authoredProfileDigest === void 0 ? {} : { authoredProfileDigest: input.authoredProfileDigest },
+		runtime: input.runtime,
+		reason: input.reason
+	});
+}
+/** Mint a process-unique attempt id before executor construction. */
+function newExecutionAttemptId(nodeId) {
+	return `${nodeId}:attempt:${randomUUID()}`;
+}
+/** Build the immutable safe receipt for a full, transient execution binding. */
+function knownExecutionBindingReceipt(materialization, bindingInput) {
+	const binding = detachedSnapshot(bindingInput, "executor execution binding");
+	assertNonEmpty(binding.attemptId, "binding.attemptId");
+	assertSafeDescriptor(binding.descriptor);
+	let materializationReceiptDigest;
+	let bindingDigest;
+	try {
+		materializationReceiptDigest = canonicalCandidateDigest(materialization);
+		bindingDigest = canonicalCandidateDigest(jsonWireSnapshot(binding.binding));
+	} catch (error) {
+		throw new ValidationError("executor binding must be finite RFC 8785 JSON", { cause: error });
+	}
+	return Object.freeze({
+		status: "known",
+		attemptId: binding.attemptId,
+		materializationReceiptDigest,
+		bindingDigest,
+		descriptor: binding.descriptor
+	});
+}
+/** Preserve an attempt boundary even when its caller-owned transport cannot be attested. */
+function unknownExecutionBindingReceipt(materialization, attemptId, reason) {
+	assertNonEmpty(attemptId, "binding.attemptId");
+	return Object.freeze({
+		status: "unknown",
+		attemptId,
+		materializationReceiptDigest: canonicalCandidateDigest(materialization),
+		reason
+	});
+}
+/** Derive an authored-profile digest without turning non-canonical input into a fake identity. */
+function authoredProfileDigest(profile) {
+	try {
+		return canonicalAgentProfileDigest(agentProfileSchema.parse(profile));
+	} catch {
+		return;
+	}
+}
+function assertExactDeclaration(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new ValidationError("executor materialization: declaration must be an object");
+	const unknown = Object.keys(value).filter((key) => !declarationKeys.has(key));
+	if (unknown.length > 0) throw new ValidationError(`executor materialization: unknown declaration fields: ${unknown.sort().join(", ")}`);
+	if (!Object.hasOwn(value, "plan")) throw new ValidationError("executor materialization: plan is required");
+}
+function assertModel(model) {
+	if (typeof model !== "object" || model === null || Array.isArray(model)) throw new ValidationError("executor materialization: model must be a known/unknown identity");
+	const keys = Object.keys(model).sort();
+	if (model.status === "known") {
+		if (keys.join(",") !== "id,status") throw new ValidationError("executor materialization: known model accepts only status and id");
+		assertNonEmpty(model.id, "model.id");
+		return;
+	}
+	if (model.status === "unknown") {
+		if (keys.join(",") !== "reason,status") throw new ValidationError("executor materialization: unknown model accepts only status and reason");
+		assertNonEmpty(model.reason, "model.reason");
+		return;
+	}
+	throw new ValidationError("executor materialization: model.status must be known or unknown");
+}
+function assertNonEmpty(value, field) {
+	if (typeof value !== "string" || value.trim().length === 0) throw new ValidationError(`executor materialization: ${field} must be a non-empty string`);
+}
+function assertSafeDescriptor(descriptor) {
+	if (typeof descriptor !== "object" || descriptor === null || Array.isArray(descriptor)) throw new ValidationError("executor binding: descriptor must be an object");
+	for (const [key, value] of Object.entries(descriptor)) {
+		if (/(url|uri|token|key|secret|bearer|credential|authorization)/i.test(key)) throw new ValidationError(`executor binding: unsafe descriptor key ${JSON.stringify(key)}`);
+		if (value !== null && typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") throw new ValidationError(`executor binding: descriptor ${JSON.stringify(key)} must be scalar`);
+		if (typeof value === "string" && (value.includes("://") || value.includes("@"))) throw new ValidationError(`executor binding: descriptor ${JSON.stringify(key)} contains transport or credential text`);
+	}
+}
+function jsonWireSnapshot(value, path = "$") {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) throw new ValidationError(`executor binding: ${path} must be finite`);
+		return value;
+	}
+	if (Array.isArray(value)) return value.map((item, index) => {
+		if (item === void 0) throw new ValidationError(`executor binding: ${path}[${index}] cannot be undefined`);
+		return jsonWireSnapshot(item, `${path}[${index}]`);
+	});
+	if (typeof value !== "object" || value === null) throw new ValidationError(`executor binding: ${path} must be JSON data`);
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== Object.prototype && prototype !== null) throw new ValidationError(`executor binding: ${path} must be a plain object`);
+	const out = {};
+	for (const [key, item] of Object.entries(value)) {
+		if (item === void 0) continue;
+		out[key] = jsonWireSnapshot(item, `${path}.${key}`);
+	}
+	return out;
+}
+//#endregion
+export { unknownMaterializationReceipt as _, authoredProfileDigest as a, knownExecutionBindingReceipt as c, runtimeOwnedDeferredExecutorRuntime as d, runtimeOwnedExecutorExecutionBinding as f, unknownExecutionBindingReceipt as g, runtimeOwnedScopeOwnerRuntime as h, attestRuntimeOwnedScopeOwner as i, knownMaterializationReceipt as l, runtimeOwnedPendingExecutorMaterialization as m, attestRuntimeOwnedExecutor as n, finalizeRuntimeOwnedPendingExecutor as o, runtimeOwnedExecutorMaterialization as p, attestRuntimeOwnedPendingExecutor as r, inheritRuntimeOwnedExecutorAttestation as s, attestRuntimeOwnedDeferredExecutor as t, newExecutionAttemptId as u, executableAgentProfileSnapshot as v, executableAgentSpecSnapshot as y };
+
+//# sourceMappingURL=materialization-COJ1UYQ-.js.map

package/dist/materialization-COJ1UYQ-.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"materialization-COJ1UYQ-.js","names":[],"sources":["../src/runtime/supervise/executable-spec.ts","../src/runtime/supervise/materialization.ts"],"sourcesContent":["import { type AgentProfile, agentProfileSchema } from '@tangle-network/agent-interface'\nimport { assertExecutableAgentProfile } from './model-policy'\nimport { detachedSnapshot } from './snapshot'\nimport type { AgentSpec } from './types'\n\n/**\n * Parse one untrusted profile into the exact immutable value execution may consume.\n *\n * Snapshotting before schema parsing reads caller-owned fields once. Snapshotting the parsed\n * result prevents downstream custom code from changing any identity or authority field.\n */\nexport function executableAgentProfileSnapshot(raw: unknown, context: string): AgentProfile {\n  const input = detachedSnapshot(raw, `${context}: AgentProfile input`)\n  const profile = agentProfileSchema.parse(input)\n  assertExecutableAgentProfile(profile, context)\n  return detachedSnapshot(profile, `${context}: parsed AgentProfile`)\n}\n\n/** Snapshot an executable spec while retaining trusted callbacks by reference. */\nexport function executableAgentSpecSnapshot(raw: AgentSpec, context: string): AgentSpec {\n  const {\n    profile: rawProfile,\n    harness,\n    execution: rawExecution,\n    ...runtimeExtensions\n  } = raw as AgentSpec & Readonly<Record<string, unknown>>\n  const profile = executableAgentProfileSnapshot(rawProfile, context)\n  const execution =\n    rawExecution === undefined\n      ? undefined\n      : detachedSnapshot(rawExecution, `${context}: execution attribution`)\n  return Object.freeze({\n    ...runtimeExtensions,\n    profile,\n    harness,\n    ...(execution === undefined ? {} : { execution }),\n  }) as AgentSpec\n}\n","import { randomUUID } from 'node:crypto'\nimport {\n  agentProfileSchema,\n  canonicalAgentProfileDigest,\n  canonicalCandidateDigest,\n  type Sha256Digest,\n} from '@tangle-network/agent-interface'\nimport { ValidationError } from '../../errors'\nimport { detachedSnapshot } from './snapshot'\nimport type {\n  ExecutionBindingReceipt,\n  Executor,\n  ExecutorExecutionBinding,\n  ExecutorMaterialization,\n  ProfileMaterializationReceipt,\n  Runtime,\n  UnknownMaterializationReason,\n} from './types'\n\ntype RuntimeOwnedExecutorMaterialization =\n  | {\n      readonly kind: 'known'\n      readonly declaration: ExecutorMaterialization\n      readonly binding?: ExecutorExecutionBinding\n    }\n  | {\n      /** A Runtime-owned external executor whose exact launch is known, but whose remote\n       * materializer has not yet returned its terminal acknowledgement. This private state lets\n       * Runtime validate the planned authority before execution without presenting it as proof\n       * that the remote process actually used that plan. */\n      readonly kind: 'pending'\n      readonly runtime: Runtime\n      readonly declaration: ExecutorMaterialization\n      readonly binding: ExecutorExecutionBinding\n    }\n  | { readonly kind: 'deferred'; readonly runtime: Runtime }\n\ninterface RuntimeOwnedExecutorMaterializationRef {\n  current: RuntimeOwnedExecutorMaterialization\n}\n\nconst runtimeOwnedExecutorMaterializations = new WeakMap<\n  object,\n  RuntimeOwnedExecutorMaterializationRef\n>()\nconst runtimeOwnedScopeOwners = new WeakMap<object, Runtime>()\n\ninterface KnownReceiptInput {\n  readonly authoredProfileDigest: Sha256Digest\n  readonly runtime: Runtime\n  readonly declaration: ExecutorMaterialization\n}\n\ninterface UnknownReceiptInput {\n  readonly authoredProfileDigest?: Sha256Digest\n  readonly runtime: Runtime\n  readonly reason: UnknownMaterializationReason\n}\n\nconst declarationKeys = new Set([\n  'effectiveProfile',\n  'backend',\n  'model',\n  'execution',\n  'materializer',\n  'plan',\n  'platformAttachments',\n])\n\n/**\n * Bind a declaration to a runtime-owned executor without putting an attestable method on the\n * public Executor interface. This module is not a package export: arbitrary caller executors stay\n * unknown even if they add a lookalike `materialization()` property.\n */\nexport function attestRuntimeOwnedExecutor<Out>(\n  executor: Executor<Out>,\n  declaration: ExecutorMaterialization,\n  binding?: ExecutorExecutionBinding,\n): Executor<Out> {\n  runtimeOwnedExecutorMaterializations.set(executor as object, {\n    current: Object.freeze({\n      kind: 'known',\n      declaration: detachedSnapshot(declaration, 'runtime-owned executor materialization'),\n      ...(binding === undefined\n        ? {}\n        : {\n            binding: detachedSnapshot(binding, 'runtime-owned executor execution binding'),\n          }),\n    }),\n  })\n  return executor\n}\n\n/** Brand an external Runtime executor whose exact remote materialization is provable only after\n * its terminal protocol acknowledgement. The declaration is a planned authority check, never a\n * known receipt; callers must finalize this same object after validating the acknowledgement. */\nexport function attestRuntimeOwnedPendingExecutor<Out>(\n  executor: Executor<Out>,\n  runtime: Runtime,\n  declaration: ExecutorMaterialization,\n  binding: ExecutorExecutionBinding,\n): Executor<Out> {\n  runtimeOwnedExecutorMaterializations.set(executor as object, {\n    current: Object.freeze({\n      kind: 'pending',\n      runtime,\n      declaration: detachedSnapshot(declaration, 'pending executor materialization'),\n      binding: detachedSnapshot(binding, 'pending executor execution binding'),\n    }),\n  })\n  return executor\n}\n\n/** Replace a private pending brand with terminally acknowledged evidence. A caller-owned executor\n * cannot enter this path because only this module can create the pending WeakMap entry. */\nexport function finalizeRuntimeOwnedPendingExecutor<Out>(\n  executor: Executor<Out>,\n  declaration: ExecutorMaterialization,\n  binding: ExecutorExecutionBinding,\n): Executor<Out> {\n  const ref = runtimeOwnedExecutorMaterializations.get(executor as object)\n  if (ref?.current.kind !== 'pending' || ref.current.runtime !== executor.runtime) {\n    throw new ValidationError(\n      'executor materialization: terminal acknowledgement has no matching Runtime-owned pending executor',\n    )\n  }\n  ref.current = Object.freeze({\n    kind: 'known',\n    declaration: detachedSnapshot(declaration, 'runtime-owned executor materialization'),\n    binding: detachedSnapshot(binding, 'runtime-owned executor execution binding'),\n  })\n  return executor\n}\n\n/** Mark a runtime-owned orchestration executor whose exact leaf declaration is published through\n * its private nested Scope before the first backend inference. Arbitrary executors cannot opt in. */\nexport function attestRuntimeOwnedDeferredExecutor<Out>(\n  executor: Executor<Out>,\n  runtime: Runtime,\n): Executor<Out> {\n  runtimeOwnedExecutorMaterializations.set(executor as object, {\n    current: Object.freeze({ kind: 'deferred', runtime }),\n  })\n  return executor\n}\n\n/** Preserve the runtime-owned attestation when a trusted wrapper changes result semantics only. */\nexport function inheritRuntimeOwnedExecutorAttestation<In, Out>(\n  source: Executor<In>,\n  wrapper: Executor<Out>,\n): Executor<Out> {\n  const ref = runtimeOwnedExecutorMaterializations.get(source as object)\n  if (ref !== undefined) {\n    runtimeOwnedExecutorMaterializations.set(wrapper as object, ref)\n  }\n  return wrapper\n}\n\n/** Read a declaration only when Runtime itself branded this exact executor object. */\nexport function runtimeOwnedExecutorMaterialization<Out>(\n  executor: Executor<Out>,\n): ExecutorMaterialization | undefined {\n  const attestation = runtimeOwnedExecutorMaterializations.get(executor as object)?.current\n  return attestation?.kind === 'known' ? attestation.declaration : undefined\n}\n\n/** Read one attempt binding only from the private brand on this exact executor object. */\nexport function runtimeOwnedExecutorExecutionBinding<Out>(\n  executor: Executor<Out>,\n): ExecutorExecutionBinding | undefined {\n  const attestation = runtimeOwnedExecutorMaterializations.get(executor as object)?.current\n  return attestation?.kind === 'known' ? attestation.binding : undefined\n}\n\n/** Read a planned external declaration only for Runtime's private pending brand. This is useful for\n * pre-execution authority checks, but must never be turned into a known durable receipt. */\nexport function runtimeOwnedPendingExecutorMaterialization<Out>(executor: Executor<Out>):\n  | {\n      readonly runtime: Runtime\n      readonly declaration: ExecutorMaterialization\n      readonly binding: ExecutorExecutionBinding\n    }\n  | undefined {\n  const attestation = runtimeOwnedExecutorMaterializations.get(executor as object)?.current\n  return attestation?.kind === 'pending'\n    ? {\n        runtime: attestation.runtime,\n        declaration: attestation.declaration,\n        binding: attestation.binding,\n      }\n    : undefined\n}\n\n/** Read the expected leaf runtime only for a privately branded deferred orchestration executor. */\nexport function runtimeOwnedDeferredExecutorRuntime<Out>(\n  executor: Executor<Out>,\n): Runtime | undefined {\n  const attestation = runtimeOwnedExecutorMaterializations.get(executor as object)?.current\n  return attestation?.kind === 'deferred' ? attestation.runtime : undefined\n}\n\n/** Propagate trust from a built-in driver adapter to the Agent and recursive executor it owns. */\nexport function attestRuntimeOwnedScopeOwner<T extends object>(owner: T, runtime: Runtime): T {\n  runtimeOwnedScopeOwners.set(owner, runtime)\n  return owner\n}\n\n/** Return a built-in scope owner's expected concrete leaf runtime; caller-owned functions/Agents\n * deliberately have no entry even if they add lookalike fields. */\nexport function runtimeOwnedScopeOwnerRuntime(owner: object): Runtime | undefined {\n  return runtimeOwnedScopeOwners.get(owner)\n}\n\n/** Build one kernel-owned known receipt from a data-only executor declaration. */\nexport function knownMaterializationReceipt(\n  input: KnownReceiptInput,\n): ProfileMaterializationReceipt {\n  const declaration = detachedSnapshot(input.declaration, 'executor materialization')\n  assertExactDeclaration(declaration)\n  const effectiveProfile = agentProfileSchema.safeParse(declaration.effectiveProfile)\n  if (!effectiveProfile.success) {\n    throw new ValidationError('executor materialization: effectiveProfile must be an AgentProfile')\n  }\n  assertNonEmpty(declaration.backend, 'backend')\n  assertNonEmpty(declaration.materializer, 'materializer')\n  assertNonEmpty(declaration.execution?.kind, 'execution.kind')\n  assertNonEmpty(declaration.execution?.id, 'execution.id')\n  assertModel(declaration.model)\n\n  let effectiveProfileDigest: Sha256Digest\n  let materializationPlanDigest: Sha256Digest\n  let platformAttachmentsDigest: Sha256Digest | undefined\n  try {\n    effectiveProfileDigest = canonicalAgentProfileDigest(effectiveProfile.data)\n    materializationPlanDigest = canonicalCandidateDigest(jsonWireSnapshot(declaration.plan))\n    platformAttachmentsDigest =\n      declaration.platformAttachments === undefined\n        ? undefined\n        : canonicalCandidateDigest(jsonWireSnapshot(declaration.platformAttachments))\n  } catch (error) {\n    throw new ValidationError(\n      'executor materialization: profile, plan, and attachments must be finite RFC 8785 JSON',\n      { cause: error },\n    )\n  }\n\n  return Object.freeze({\n    status: 'known' as const,\n    authoredProfileDigest: input.authoredProfileDigest,\n    effectiveProfileDigest,\n    materializationPlanDigest,\n    ...(platformAttachmentsDigest === undefined ? {} : { platformAttachmentsDigest }),\n    runtime: input.runtime,\n    backend: declaration.backend,\n    model: declaration.model,\n    execution: declaration.execution,\n    materializer: declaration.materializer,\n  })\n}\n\n/** Build an explicit unknown receipt without fabricating any executor-owned identity. */\nexport function unknownMaterializationReceipt(\n  input: UnknownReceiptInput,\n): ProfileMaterializationReceipt {\n  return Object.freeze({\n    status: 'unknown' as const,\n    ...(input.authoredProfileDigest === undefined\n      ? {}\n      : { authoredProfileDigest: input.authoredProfileDigest }),\n    runtime: input.runtime,\n    reason: input.reason,\n  })\n}\n\n/** Mint a process-unique attempt id before executor construction. */\nexport function newExecutionAttemptId(nodeId: string): string {\n  return `${nodeId}:attempt:${randomUUID()}`\n}\n\n/** Build the immutable safe receipt for a full, transient execution binding. */\nexport function knownExecutionBindingReceipt(\n  materialization: ProfileMaterializationReceipt,\n  bindingInput: ExecutorExecutionBinding,\n): ExecutionBindingReceipt {\n  const binding = detachedSnapshot(bindingInput, 'executor execution binding')\n  assertNonEmpty(binding.attemptId, 'binding.attemptId')\n  assertSafeDescriptor(binding.descriptor)\n  let materializationReceiptDigest: Sha256Digest\n  let bindingDigest: Sha256Digest\n  try {\n    materializationReceiptDigest = canonicalCandidateDigest(materialization)\n    // Bind the exact JSON document a backend receives. Optional AgentProfile fields are represented\n    // as `undefined` in memory but omitted by JSON transport; normalize that one distinction while\n    // rejecting every non-finite/non-data value instead of silently coercing it.\n    bindingDigest = canonicalCandidateDigest(jsonWireSnapshot(binding.binding))\n  } catch (error) {\n    throw new ValidationError('executor binding must be finite RFC 8785 JSON', { cause: error })\n  }\n  return Object.freeze({\n    status: 'known' as const,\n    attemptId: binding.attemptId,\n    materializationReceiptDigest,\n    bindingDigest,\n    descriptor: binding.descriptor,\n  })\n}\n\n/** Preserve an attempt boundary even when its caller-owned transport cannot be attested. */\nexport function unknownExecutionBindingReceipt(\n  materialization: ProfileMaterializationReceipt,\n  attemptId: string,\n  reason: UnknownMaterializationReason,\n): ExecutionBindingReceipt {\n  assertNonEmpty(attemptId, 'binding.attemptId')\n  return Object.freeze({\n    status: 'unknown' as const,\n    attemptId,\n    materializationReceiptDigest: canonicalCandidateDigest(materialization),\n    reason,\n  })\n}\n\n/** Derive an authored-profile digest without turning non-canonical input into a fake identity. */\nexport function authoredProfileDigest(profile: unknown): Sha256Digest | undefined {\n  try {\n    return canonicalAgentProfileDigest(agentProfileSchema.parse(profile))\n  } catch {\n    return undefined\n  }\n}\n\nfunction assertExactDeclaration(value: ExecutorMaterialization): void {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n    throw new ValidationError('executor materialization: declaration must be an object')\n  }\n  const unknown = Object.keys(value).filter((key) => !declarationKeys.has(key))\n  if (unknown.length > 0) {\n    throw new ValidationError(\n      `executor materialization: unknown declaration fields: ${unknown.sort().join(', ')}`,\n    )\n  }\n  if (!Object.hasOwn(value, 'plan')) {\n    throw new ValidationError('executor materialization: plan is required')\n  }\n}\n\nfunction assertModel(model: ExecutorMaterialization['model']): void {\n  if (typeof model !== 'object' || model === null || Array.isArray(model)) {\n    throw new ValidationError('executor materialization: model must be a known/unknown identity')\n  }\n  const keys = Object.keys(model).sort()\n  if (model.status === 'known') {\n    if (keys.join(',') !== 'id,status') {\n      throw new ValidationError('executor materialization: known model accepts only status and id')\n    }\n    assertNonEmpty(model.id, 'model.id')\n    return\n  }\n  if (model.status === 'unknown') {\n    if (keys.join(',') !== 'reason,status') {\n      throw new ValidationError(\n        'executor materialization: unknown model accepts only status and reason',\n      )\n    }\n    assertNonEmpty(model.reason, 'model.reason')\n    return\n  }\n  throw new ValidationError('executor materialization: model.status must be known or unknown')\n}\n\nfunction assertNonEmpty(value: unknown, field: string): asserts value is string {\n  if (typeof value !== 'string' || value.trim().length === 0) {\n    throw new ValidationError(`executor materialization: ${field} must be a non-empty string`)\n  }\n}\n\nfunction assertSafeDescriptor(descriptor: ExecutorExecutionBinding['descriptor']): void {\n  if (typeof descriptor !== 'object' || descriptor === null || Array.isArray(descriptor)) {\n    throw new ValidationError('executor binding: descriptor must be an object')\n  }\n  for (const [key, value] of Object.entries(descriptor)) {\n    if (/(url|uri|token|key|secret|bearer|credential|authorization)/i.test(key)) {\n      throw new ValidationError(`executor binding: unsafe descriptor key ${JSON.stringify(key)}`)\n    }\n    if (\n      value !== null &&\n      typeof value !== 'string' &&\n      typeof value !== 'number' &&\n      typeof value !== 'boolean'\n    ) {\n      throw new ValidationError(\n        `executor binding: descriptor ${JSON.stringify(key)} must be scalar`,\n      )\n    }\n    if (typeof value === 'string' && (value.includes('://') || value.includes('@'))) {\n      throw new ValidationError(\n        `executor binding: descriptor ${JSON.stringify(key)} contains transport or credential text`,\n      )\n    }\n  }\n}\n\nfunction jsonWireSnapshot(value: unknown, path = '$'): unknown {\n  if (value === null || typeof value === 'string' || typeof value === 'boolean') return value\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) {\n      throw new ValidationError(`executor binding: ${path} must be finite`)\n    }\n    return value\n  }\n  if (Array.isArray(value)) {\n    return value.map((item, index) => {\n      if (item === undefined) {\n        throw new ValidationError(`executor binding: ${path}[${index}] cannot be undefined`)\n      }\n      return jsonWireSnapshot(item, `${path}[${index}]`)\n    })\n  }\n  if (typeof value !== 'object' || value === null) {\n    throw new ValidationError(`executor binding: ${path} must be JSON data`)\n  }\n  const prototype = Object.getPrototypeOf(value)\n  if (prototype !== Object.prototype && prototype !== null) {\n    throw new ValidationError(`executor binding: ${path} must be a plain object`)\n  }\n  const out: Record<string, unknown> = {}\n  for (const [key, item] of Object.entries(value as Record<string, unknown>)) {\n    if (item === undefined) continue\n    out[key] = jsonWireSnapshot(item, `${path}.${key}`)\n  }\n  return out\n}\n"],"mappings":";;;;;;;;;;;;AAWA,SAAgB,+BAA+B,KAAc,SAA+B;CAC1F,MAAM,QAAQ,iBAAiB,KAAK,GAAG,QAAQ,qBAAqB;CACpE,MAAM,UAAU,mBAAmB,MAAM,KAAK;CAC9C,6BAA6B,SAAS,OAAO;CAC7C,OAAO,iBAAiB,SAAS,GAAG,QAAQ,sBAAsB;AACpE;;AAGA,SAAgB,4BAA4B,KAAgB,SAA4B;CACtF,MAAM,EACJ,SAAS,YACT,SACA,WAAW,cACX,GAAG,sBACD;CACJ,MAAM,UAAU,+BAA+B,YAAY,OAAO;CAClE,MAAM,YACJ,iBAAiB,KAAA,IACb,KAAA,IACA,iBAAiB,cAAc,GAAG,QAAQ,wBAAwB;CACxE,OAAO,OAAO,OAAO;EACnB,GAAG;EACH;EACA;EACA,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU;CACjD,CAAC;AACH;;;ACIA,MAAM,uDAAuC,IAAI,QAG/C;AACF,MAAM,0CAA0B,IAAI,QAAyB;AAc7D,MAAM,kCAAkB,IAAI,IAAI;CAC9B;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,SAAgB,2BACd,UACA,aACA,SACe;CACf,qCAAqC,IAAI,UAAoB,EAC3D,SAAS,OAAO,OAAO;EACrB,MAAM;EACN,aAAa,iBAAiB,aAAa,wCAAwC;EACnF,GAAI,YAAY,KAAA,IACZ,CAAC,IACD,EACE,SAAS,iBAAiB,SAAS,0CAA0C,EAC/E;CACN,CAAC,EACH,CAAC;CACD,OAAO;AACT;;;;AAKA,SAAgB,kCACd,UACA,SACA,aACA,SACe;CACf,qCAAqC,IAAI,UAAoB,EAC3D,SAAS,OAAO,OAAO;EACrB,MAAM;EACN;EACA,aAAa,iBAAiB,aAAa,kCAAkC;EAC7E,SAAS,iBAAiB,SAAS,oCAAoC;CACzE,CAAC,EACH,CAAC;CACD,OAAO;AACT;;;AAIA,SAAgB,oCACd,UACA,aACA,SACe;CACf,MAAM,MAAM,qCAAqC,IAAI,QAAkB;CACvE,IAAI,KAAK,QAAQ,SAAS,aAAa,IAAI,QAAQ,YAAY,SAAS,SACtE,MAAM,IAAI,gBACR,mGACF;CAEF,IAAI,UAAU,OAAO,OAAO;EAC1B,MAAM;EACN,aAAa,iBAAiB,aAAa,wCAAwC;EACnF,SAAS,iBAAiB,SAAS,0CAA0C;CAC/E,CAAC;CACD,OAAO;AACT;;;AAIA,SAAgB,mCACd,UACA,SACe;CACf,qCAAqC,IAAI,UAAoB,EAC3D,SAAS,OAAO,OAAO;EAAE,MAAM;EAAY;CAAQ,CAAC,EACtD,CAAC;CACD,OAAO;AACT;;AAGA,SAAgB,uCACd,QACA,SACe;CACf,MAAM,MAAM,qCAAqC,IAAI,MAAgB;CACrE,IAAI,QAAQ,KAAA,GACV,qCAAqC,IAAI,SAAmB,GAAG;CAEjE,OAAO;AACT;;AAGA,SAAgB,oCACd,UACqC;CACrC,MAAM,cAAc,qCAAqC,IAAI,QAAkB,CAAC,EAAE;CAClF,OAAO,aAAa,SAAS,UAAU,YAAY,cAAc,KAAA;AACnE;;AAGA,SAAgB,qCACd,UACsC;CACtC,MAAM,cAAc,qCAAqC,IAAI,QAAkB,CAAC,EAAE;CAClF,OAAO,aAAa,SAAS,UAAU,YAAY,UAAU,KAAA;AAC/D;;;AAIA,SAAgB,2CAAgD,UAMlD;CACZ,MAAM,cAAc,qCAAqC,IAAI,QAAkB,CAAC,EAAE;CAClF,OAAO,aAAa,SAAS,YACzB;EACE,SAAS,YAAY;EACrB,aAAa,YAAY;EACzB,SAAS,YAAY;CACvB,IACA,KAAA;AACN;;AAGA,SAAgB,oCACd,UACqB;CACrB,MAAM,cAAc,qCAAqC,IAAI,QAAkB,CAAC,EAAE;CAClF,OAAO,aAAa,SAAS,aAAa,YAAY,UAAU,KAAA;AAClE;;AAGA,SAAgB,6BAA+C,OAAU,SAAqB;CAC5F,wBAAwB,IAAI,OAAO,OAAO;CAC1C,OAAO;AACT;;;AAIA,SAAgB,8BAA8B,OAAoC;CAChF,OAAO,wBAAwB,IAAI,KAAK;AAC1C;;AAGA,SAAgB,4BACd,OAC+B;CAC/B,MAAM,cAAc,iBAAiB,MAAM,aAAa,0BAA0B;CAClF,uBAAuB,WAAW;CAClC,MAAM,mBAAmB,mBAAmB,UAAU,YAAY,gBAAgB;CAClF,IAAI,CAAC,iBAAiB,SACpB,MAAM,IAAI,gBAAgB,oEAAoE;CAEhG,eAAe,YAAY,SAAS,SAAS;CAC7C,eAAe,YAAY,cAAc,cAAc;CACvD,eAAe,YAAY,WAAW,MAAM,gBAAgB;CAC5D,eAAe,YAAY,WAAW,IAAI,cAAc;CACxD,YAAY,YAAY,KAAK;CAE7B,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,yBAAyB,4BAA4B,iBAAiB,IAAI;EAC1E,4BAA4B,yBAAyB,iBAAiB,YAAY,IAAI,CAAC;EACvF,4BACE,YAAY,wBAAwB,KAAA,IAChC,KAAA,IACA,yBAAyB,iBAAiB,YAAY,mBAAmB,CAAC;CAClF,SAAS,OAAO;EACd,MAAM,IAAI,gBACR,yFACA,EAAE,OAAO,MAAM,CACjB;CACF;CAEA,OAAO,OAAO,OAAO;EACnB,QAAQ;EACR,uBAAuB,MAAM;EAC7B;EACA;EACA,GAAI,8BAA8B,KAAA,IAAY,CAAC,IAAI,EAAE,0BAA0B;EAC/E,SAAS,MAAM;EACf,SAAS,YAAY;EACrB,OAAO,YAAY;EACnB,WAAW,YAAY;EACvB,cAAc,YAAY;CAC5B,CAAC;AACH;;AAGA,SAAgB,8BACd,OAC+B;CAC/B,OAAO,OAAO,OAAO;EACnB,QAAQ;EACR,GAAI,MAAM,0BAA0B,KAAA,IAChC,CAAC,IACD,EAAE,uBAAuB,MAAM,sBAAsB;EACzD,SAAS,MAAM;EACf,QAAQ,MAAM;CAChB,CAAC;AACH;;AAGA,SAAgB,sBAAsB,QAAwB;CAC5D,OAAO,GAAG,OAAO,WAAW,WAAW;AACzC;;AAGA,SAAgB,6BACd,iBACA,cACyB;CACzB,MAAM,UAAU,iBAAiB,cAAc,4BAA4B;CAC3E,eAAe,QAAQ,WAAW,mBAAmB;CACrD,qBAAqB,QAAQ,UAAU;CACvC,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,+BAA+B,yBAAyB,eAAe;EAIvE,gBAAgB,yBAAyB,iBAAiB,QAAQ,OAAO,CAAC;CAC5E,SAAS,OAAO;EACd,MAAM,IAAI,gBAAgB,iDAAiD,EAAE,OAAO,MAAM,CAAC;CAC7F;CACA,OAAO,OAAO,OAAO;EACnB,QAAQ;EACR,WAAW,QAAQ;EACnB;EACA;EACA,YAAY,QAAQ;CACtB,CAAC;AACH;;AAGA,SAAgB,+BACd,iBACA,WACA,QACyB;CACzB,eAAe,WAAW,mBAAmB;CAC7C,OAAO,OAAO,OAAO;EACnB,QAAQ;EACR;EACA,8BAA8B,yBAAyB,eAAe;EACtE;CACF,CAAC;AACH;;AAGA,SAAgB,sBAAsB,SAA4C;CAChF,IAAI;EACF,OAAO,4BAA4B,mBAAmB,MAAM,OAAO,CAAC;CACtE,QAAQ;EACN;CACF;AACF;AAEA,SAAS,uBAAuB,OAAsC;CACpE,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,gBAAgB,yDAAyD;CAErF,MAAM,UAAU,OAAO,KAAK,KAAK,CAAC,CAAC,QAAQ,QAAQ,CAAC,gBAAgB,IAAI,GAAG,CAAC;CAC5E,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,gBACR,yDAAyD,QAAQ,KAAK,CAAC,CAAC,KAAK,IAAI,GACnF;CAEF,IAAI,CAAC,OAAO,OAAO,OAAO,MAAM,GAC9B,MAAM,IAAI,gBAAgB,4CAA4C;AAE1E;AAEA,SAAS,YAAY,OAA+C;CAClE,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,gBAAgB,kEAAkE;CAE9F,MAAM,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,KAAK;CACrC,IAAI,MAAM,WAAW,SAAS;EAC5B,IAAI,KAAK,KAAK,GAAG,MAAM,aACrB,MAAM,IAAI,gBAAgB,kEAAkE;EAE9F,eAAe,MAAM,IAAI,UAAU;EACnC;CACF;CACA,IAAI,MAAM,WAAW,WAAW;EAC9B,IAAI,KAAK,KAAK,GAAG,MAAM,iBACrB,MAAM,IAAI,gBACR,wEACF;EAEF,eAAe,MAAM,QAAQ,cAAc;EAC3C;CACF;CACA,MAAM,IAAI,gBAAgB,iEAAiE;AAC7F;AAEA,SAAS,eAAe,OAAgB,OAAwC;CAC9E,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,WAAW,GACvD,MAAM,IAAI,gBAAgB,6BAA6B,MAAM,4BAA4B;AAE7F;AAEA,SAAS,qBAAqB,YAA0D;CACtF,IAAI,OAAO,eAAe,YAAY,eAAe,QAAQ,MAAM,QAAQ,UAAU,GACnF,MAAM,IAAI,gBAAgB,gDAAgD;CAE5E,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,UAAU,GAAG;EACrD,IAAI,8DAA8D,KAAK,GAAG,GACxE,MAAM,IAAI,gBAAgB,2CAA2C,KAAK,UAAU,GAAG,GAAG;EAE5F,IACE,UAAU,QACV,OAAO,UAAU,YACjB,OAAO,UAAU,YACjB,OAAO,UAAU,WAEjB,MAAM,IAAI,gBACR,gCAAgC,KAAK,UAAU,GAAG,EAAE,gBACtD;EAEF,IAAI,OAAO,UAAU,aAAa,MAAM,SAAS,KAAK,KAAK,MAAM,SAAS,GAAG,IAC3E,MAAM,IAAI,gBACR,gCAAgC,KAAK,UAAU,GAAG,EAAE,uCACtD;CAEJ;AACF;AAEA,SAAS,iBAAiB,OAAgB,OAAO,KAAc;CAC7D,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW,OAAO;CACtF,IAAI,OAAO,UAAU,UAAU;EAC7B,IAAI,CAAC,OAAO,SAAS,KAAK,GACxB,MAAM,IAAI,gBAAgB,qBAAqB,KAAK,gBAAgB;EAEtE,OAAO;CACT;CACA,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,KAAK,MAAM,UAAU;EAChC,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,gBAAgB,qBAAqB,KAAK,GAAG,MAAM,sBAAsB;EAErF,OAAO,iBAAiB,MAAM,GAAG,KAAK,GAAG,MAAM,EAAE;CACnD,CAAC;CAEH,IAAI,OAAO,UAAU,YAAY,UAAU,MACzC,MAAM,IAAI,gBAAgB,qBAAqB,KAAK,mBAAmB;CAEzE,MAAM,YAAY,OAAO,eAAe,KAAK;CAC7C,IAAI,cAAc,OAAO,aAAa,cAAc,MAClD,MAAM,IAAI,gBAAgB,qBAAqB,KAAK,wBAAwB;CAE9E,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,KAAgC,GAAG;EAC1E,IAAI,SAAS,KAAA,GAAW;EACxB,IAAI,OAAO,iBAAiB,MAAM,GAAG,KAAK,GAAG,KAAK;CACpD;CACA,OAAO;AACT"}

package/dist/mcp/bin.js

@@ -1,74 +1,66 @@
 #!/usr/bin/env node
 import { i as ConfigError } from "../errors-DEAvWQPy.js";
-import { x as readTraceContextFromEnv } from "../supervisor-DpjO0Gmy.js";
-import { L as DelegationTaskQueue, l as createMcpServer, q as FileDelegationStore } from "../supervise-CsTKbH9R.js";
-import { a as resolveRouterBaseUrl } from "../model-resolution-Btd9iIKV.js";
+import { ot as readTraceContextFromEnv } from "../supervisor-CV6Jh28D.js";
+import { C as createMcpServer, Z as DelegationTaskQueue, st as FileDelegationStore } from "../supervise-iPN27pO0.js";
+import { a as supervisorInstructions } from "../authoring-CvHwo1oW.js";
 //#region src/mcp/delegate-supervisor-provisioning.ts
-const DEFAULT_WORKER_HARNESS = "opencode";
 function trimmed(value) {
 	const v = value?.trim();
 	return v ? v : void 0;
 }
+function requiredEnv(env, name) {
+	const value = trimmed(env[name]);
+	if (value) return value;
+	throw new ConfigError(`agent-runtime-mcp: ${name} is required when MCP_ENABLE_DELEGATE=1`);
+}
 /** True when the operator opted the generic `delegate` verb in (`MCP_ENABLE_DELEGATE=1`). Default off:
 *  the wiring is additive, so consumers that do not enable it are unaffected. */
 function delegateEnabled(env = process.env) {
 	return env.MCP_ENABLE_DELEGATE === "1";
 }
 /**
-* Resolve the supervisor brain's router substrate from env. The base reuses `resolveRouterBaseUrl`,
-* normalised to `/v1`.
-*
-* The KEY is the one for INFERENCE, which inside a sandbox is not the one for the sandbox. A box
-* carries both: an inference credential for the OpenAI-compatible endpoint the brain calls, and
-* `TANGLE_API_KEY`, which authenticates the sandbox CONTROL API — create a box, run a process —
-* and which the router answers `403`. The brain therefore prefers the inference credential and
-* keeps the platform key as the last rung, for a host that runs one key for both.
-*
-* `TANGLE_INFERENCE_KEY` leads because it is Tangle's own name for that credential. `OPENAI_API_KEY`
-* holds the identical value and stays on the ladder for boxes provisioned before the Tangle-native
-* name existed, and for a BYO OpenAI key — but it is a vendor spelling of a Tangle credential, and
-* naming it first made this ladder read as "prefer OpenAI over Tangle" to the people who own the
-* product (agent-dev-container#4614). A name that needs a paragraph to disclaim is the wrong name.
-*
-* The order is not a preference between vendors. It is: what the caller explicitly set, then the
-* inference credential, then the control-plane key as a single-key-host fallback.
-*
-* The MODEL is NAMED, never guessed. Which ids a given router serves is deployment state this
-* package cannot know, and a wrong guess is invisible until the supervisor's first completion
-* rejects — after the tool has been advertised to an agent, from inside a child process whose
-* stderr nobody reads. `TANGLE_ROUTER_MODEL` is on the ladder because the sandbox platform sets it
-* on every box: a delegate child running there inherits the model its own host declared. When
-* nothing names one, fail at startup with the ladder in the message.
+* Resolve the supervisor brain from dedicated MCP configuration. The model is part of the exact
+* profile; the URL and key are transport-only. No generic worker/model/key variable may silently
+* select this paid execution path.
 */
-function resolveRouter(env) {
-	const routerKey = trimmed(env.MCP_SUPERVISOR_ROUTER_KEY) ?? trimmed(env.TANGLE_INFERENCE_KEY) ?? trimmed(env.OPENAI_API_KEY) ?? trimmed(env.TANGLE_API_KEY) ?? "";
-	const base = trimmed(env.MCP_SUPERVISOR_ROUTER_BASE_URL) ?? resolveRouterBaseUrl(env);
+function resolveRouterSupervisor(env) {
+	const routerKey = requiredEnv(env, "MCP_SUPERVISOR_ROUTER_KEY");
+	const base = requiredEnv(env, "MCP_SUPERVISOR_ROUTER_BASE_URL");
 	const routerBaseUrl = /\/v\d+\/?$/.test(base) ? base.replace(/\/$/, "") : `${base.replace(/\/$/, "")}/v1`;
-	const model = trimmed(env.MCP_SUPERVISOR_MODEL) ?? trimmed(env.MCP_WORKER_MODEL) ?? trimmed(env.WORKER_MODEL) ?? trimmed(env.TANGLE_ROUTER_MODEL);
-	if (!model) throw new ConfigError("agent-runtime-mcp: no supervisor brain model — set MCP_SUPERVISOR_MODEL (or MCP_WORKER_MODEL / WORKER_MODEL / TANGLE_ROUTER_MODEL) to a tool-calling model the router serves.");
+	const model = requiredEnv(env, "MCP_SUPERVISOR_MODEL");
 	return {
-		routerBaseUrl,
-		routerKey,
-		model
+		router: {
+			routerBaseUrl,
+			routerKey
+		},
+		profile: {
+			name: "delegate-supervisor",
+			harness: "cli-base",
+			model: {
+				provider: "tangle-router",
+				default: model
+			},
+			prompt: { systemPrompt: supervisorInstructions() }
+		}
 	};
 }
 /**
 * Build the `delegateSupervisor` substrate for `createMcpServer` from env + the bin's loaded
 * `SandboxClient`. Returns `undefined` when `delegate` is not opted in, so the caller mounts it only
-* when asked. The worker backend is `sandbox` (authored workers run as sub-sandboxes via the same
-* client) on the harness named by `MCP_DELEGATE_WORKER_HARNESS` (default `opencode`).
+* when asked. The worker backend is `sandbox`; every authored worker's exact profile selects its
+* own harness/provider/model.
 */
 function resolveDelegateSupervisor(sandboxClient, env = process.env) {
 	if (!delegateEnabled(env)) return void 0;
-	const router = resolveRouter(env);
+	const supervisor = resolveRouterSupervisor(env);
+	const backend = {
+		backend: "sandbox",
+		sandboxClient
+	};
 	return {
-		router,
-		backend: {
-			backend: "sandbox",
-			harness: trimmed(env.MCP_DELEGATE_WORKER_HARNESS) ?? DEFAULT_WORKER_HARNESS,
-			sandboxClient
-		},
-		model: router.model
+		router: supervisor.router,
+		supervisorProfile: supervisor.profile,
+		backend
 	};
 }
 //#endregion
@@ -94,7 +86,7 @@ async function main() {
 		process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
 		process.exit(2);
 	}
-	if (delegateSupervisor) process.stderr.write(`agent-runtime-mcp: delegate enabled — generic authoring supervisor on ${delegateSupervisor.router.model}\n`);
+	if (delegateSupervisor) process.stderr.write(`agent-runtime-mcp: delegate enabled — generic authoring supervisor on ${delegateSupervisor.supervisorProfile.model?.default}\n`);
 	const durableQueue = await buildDurableQueueFromEnv(traceContext);
 	const server = createMcpServer({
 		...delegateSupervisor ? { delegateSupervisor } : {},

package/dist/mcp/bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"bin.js","names":[],"sources":["../../src/mcp/delegate-supervisor-provisioning.ts","../../src/mcp/bin.ts"],"sourcesContent":["/**\n *\n * Resolve the `delegate` supervisor substrate (router brain + worker backend) from env, so the\n * `agent-runtime-mcp` bin can serve the ONE generic `delegate` verb by env, over the SAME stdio\n * invocation a consumer already mounts.\n *\n * `delegate` is wired into `createMcpServer` via `McpServerOptions.delegateSupervisor`, which needs a\n * router (the supervisor brain's substrate) and a backend (WHERE the authored workers run). Inside a\n * sandbox child the natural backend is `sandbox`: authored workers run as sub-sandboxes through the\n * SAME `SandboxClient` the bin already loads from `TANGLE_API_KEY`. The brain's router reuses the\n * repo's `resolveRouterBaseUrl` convention\n * (`TANGLE_ROUTER_URL` / `TANGLE_ROUTER_BASE_URL`), normalised to an OpenAI-compatible `/v1` endpoint,\n * keyed by `TANGLE_API_KEY`.\n *\n * @experimental\n */\n\nimport type { BackendType } from '@tangle-network/sandbox'\nimport { ConfigError } from '../errors'\nimport { type RouterEnv, resolveRouterBaseUrl } from '../model-resolution.js'\nimport type { SandboxClient } from '../runtime'\nimport type { RouterConfig } from '../runtime/router-client'\nimport type { ExecutorConfig } from '../runtime/supervise/runtime'\nimport type { DelegateHandlerOptions } from './tools/delegate'\n\n// Composition-root default: a worker must run on SOME harness, and the router-backed one is the\n// least vendor-locked choice. Not a capability claim — nothing here branches on the name.\nconst DEFAULT_WORKER_HARNESS = 'opencode'\n\nfunction trimmed(value: string | undefined): string | undefined {\n  const v = value?.trim()\n  return v ? v : undefined\n}\n\n/** True when the operator opted the generic `delegate` verb in (`MCP_ENABLE_DELEGATE=1`). Default off:\n *  the wiring is additive, so consumers that do not enable it are unaffected. */\nexport function delegateEnabled(env: NodeJS.ProcessEnv = process.env): boolean {\n  return env.MCP_ENABLE_DELEGATE === '1'\n}\n\n/**\n * Resolve the supervisor brain's router substrate from env. The base reuses `resolveRouterBaseUrl`,\n * normalised to `/v1`.\n *\n * The KEY is the one for INFERENCE, which inside a sandbox is not the one for the sandbox. A box\n * carries both: an inference credential for the OpenAI-compatible endpoint the brain calls, and\n * `TANGLE_API_KEY`, which authenticates the sandbox CONTROL API — create a box, run a process —\n * and which the router answers `403`. The brain therefore prefers the inference credential and\n * keeps the platform key as the last rung, for a host that runs one key for both.\n *\n * `TANGLE_INFERENCE_KEY` leads because it is Tangle's own name for that credential. `OPENAI_API_KEY`\n * holds the identical value and stays on the ladder for boxes provisioned before the Tangle-native\n * name existed, and for a BYO OpenAI key — but it is a vendor spelling of a Tangle credential, and\n * naming it first made this ladder read as \"prefer OpenAI over Tangle\" to the people who own the\n * product (agent-dev-container#4614). A name that needs a paragraph to disclaim is the wrong name.\n *\n * The order is not a preference between vendors. It is: what the caller explicitly set, then the\n * inference credential, then the control-plane key as a single-key-host fallback.\n *\n * The MODEL is NAMED, never guessed. Which ids a given router serves is deployment state this\n * package cannot know, and a wrong guess is invisible until the supervisor's first completion\n * rejects — after the tool has been advertised to an agent, from inside a child process whose\n * stderr nobody reads. `TANGLE_ROUTER_MODEL` is on the ladder because the sandbox platform sets it\n * on every box: a delegate child running there inherits the model its own host declared. When\n * nothing names one, fail at startup with the ladder in the message.\n */\nfunction resolveRouter(env: NodeJS.ProcessEnv): RouterConfig {\n  const routerKey =\n    trimmed(env.MCP_SUPERVISOR_ROUTER_KEY) ??\n    trimmed(env.TANGLE_INFERENCE_KEY) ??\n    trimmed(env.OPENAI_API_KEY) ??\n    trimmed(env.TANGLE_API_KEY) ??\n    ''\n  const base = trimmed(env.MCP_SUPERVISOR_ROUTER_BASE_URL) ?? resolveRouterBaseUrl(env as RouterEnv)\n  const routerBaseUrl = /\\/v\\d+\\/?$/.test(base)\n    ? base.replace(/\\/$/, '')\n    : `${base.replace(/\\/$/, '')}/v1`\n  const model =\n    trimmed(env.MCP_SUPERVISOR_MODEL) ??\n    trimmed(env.MCP_WORKER_MODEL) ??\n    trimmed(env.WORKER_MODEL) ??\n    trimmed(env.TANGLE_ROUTER_MODEL)\n  if (!model) {\n    throw new ConfigError(\n      'agent-runtime-mcp: no supervisor brain model — set MCP_SUPERVISOR_MODEL (or MCP_WORKER_MODEL / ' +\n        'WORKER_MODEL / TANGLE_ROUTER_MODEL) to a tool-calling model the router serves.',\n    )\n  }\n  return { routerBaseUrl, routerKey, model }\n}\n\n/**\n * Build the `delegateSupervisor` substrate for `createMcpServer` from env + the bin's loaded\n * `SandboxClient`. Returns `undefined` when `delegate` is not opted in, so the caller mounts it only\n * when asked. The worker backend is `sandbox` (authored workers run as sub-sandboxes via the same\n * client) on the harness named by `MCP_DELEGATE_WORKER_HARNESS` (default `opencode`).\n */\nexport function resolveDelegateSupervisor(\n  sandboxClient: SandboxClient,\n  env: NodeJS.ProcessEnv = process.env,\n): DelegateHandlerOptions | undefined {\n  if (!delegateEnabled(env)) return undefined\n  const router = resolveRouter(env)\n  const harness = (trimmed(env.MCP_DELEGATE_WORKER_HARNESS) ??\n    DEFAULT_WORKER_HARNESS) as BackendType\n  const backend: ExecutorConfig = {\n    backend: 'sandbox',\n    harness,\n    sandboxClient,\n  }\n  return {\n    router,\n    backend,\n    model: router.model,\n  }\n}\n","#!/usr/bin/env node\n\n/**\n *\n * `agent-runtime-mcp` — stdio MCP server entry point.\n *\n * Serves the ONE generic `delegate` verb (opt-in via `MCP_ENABLE_DELEGATE=1`): one intent → a\n * supervisor that authors + drives its own worker over `supervise()`, returning the delivered output\n * with its cost. The supervisor brain runs on the router; authored workers run as sub-sandboxes\n * through the same `SandboxClient` the bin loads from `TANGLE_API_KEY`. The queue-bound tools\n * (`delegate_feedback`, `delegation_status`, `delegation_history`) are always served.\n *\n * Environment variables:\n *   TANGLE_API_KEY                   required — passed to `new Sandbox({ apiKey })`\n *   SANDBOX_BASE_URL                 optional — sandbox-SDK base URL override\n *   MCP_ENABLE_DELEGATE              set to `1` to serve the generic `delegate` verb. Its authoring\n *                                    supervisor runs the brain on the router and spawns authored\n *                                    workers as sub-sandboxes via the same client; needs TANGLE_API_KEY.\n *   MCP_SUPERVISOR_MODEL             supervisor brain model id (falls back to MCP_WORKER_MODEL, then\n *                                    WORKER_MODEL, then TANGLE_ROUTER_MODEL). Must be a tool-calling\n *                                    model the router serves; with none named the bin exits 2.\n *   MCP_SUPERVISOR_ROUTER_KEY        router key for the supervisor brain (falls back to the box's\n *                                    inference credential TANGLE_INFERENCE_KEY, then its vendor\n *                                    spelling OPENAI_API_KEY, then TANGLE_API_KEY — which\n *                                    authenticates the sandbox API, not the router)\n *   MCP_SUPERVISOR_ROUTER_BASE_URL   router base for the supervisor brain (defaults to the repo's\n *                                    resolveRouterBaseUrl, normalized to `/v1`)\n *   MCP_DELEGATE_WORKER_HARNESS      harness the authored workers run on (default `opencode`)\n *   AGENT_RUNTIME_DELEGATION_STATE_FILE\n *                                    optional — absolute path of a JSON state\n *                                    file. When set, delegation records persist\n *                                    across MCP restarts (FileDelegationStore):\n *                                    status/history survive and idempotency keys\n *                                    dedupe across processes.\n *   AGENT_RUNTIME_DELEGATION_STATE_RECOVER\n *                                    set to `1` to archive a corrupt state file\n *                                    (`<file>.corrupt-<ts>`) and start empty\n *                                    instead of refusing to boot.\n *   AGENT_RUNTIME_DELEGATION_RETAIN_TERMINAL\n *                                    optional — positive integer cap on retained\n *                                    terminal records. Unset = keep forever.\n *\n * @experimental\n */\n\nimport type { SandboxClient } from '../runtime'\nimport { delegateEnabled, resolveDelegateSupervisor } from './delegate-supervisor-provisioning'\nimport { FileDelegationStore } from './delegation-store'\nimport { createMcpServer } from './server'\nimport { DelegationTaskQueue } from './task-queue'\nimport type { DelegateHandlerOptions } from './tools/delegate'\nimport { readTraceContextFromEnv, type TraceContext } from './trace-propagation'\n\nconst DEFAULT_SANDBOX_BASE_URL = 'https://sandbox.tangle.tools'\n\nasync function main(): Promise<void> {\n  const wantDelegate = delegateEnabled(process.env)\n\n  // The generic `delegate` verb needs the sandbox client: its authored workers run as sub-sandboxes\n  // (the `sandbox` backend). When `delegate` is not opted in, the server runs the queue-only subset\n  // (feedback + status + history) with no sandbox.\n  let sandboxClient: SandboxClient | undefined\n  if (wantDelegate) {\n    const apiKey = process.env.TANGLE_API_KEY\n    if (!apiKey && !process.env.AGENT_RUNTIME_MCP_ALLOW_NO_KEY) {\n      process.stderr.write(\n        'agent-runtime-mcp: TANGLE_API_KEY is required to serve `delegate`. Set AGENT_RUNTIME_MCP_ALLOW_NO_KEY=1 to run without it for diagnostics, or unset MCP_ENABLE_DELEGATE to run the queue-only subset.\\n',\n      )\n      process.exit(2)\n    }\n    sandboxClient = await loadSandboxClient(apiKey)\n  }\n\n  // The supervisor's loop topology spans export to the OTLP / Tangle Intelligence sink when\n  // OTEL_EXPORTER_OTLP_ENDPOINT is set (+ TRACE_ID / PARENT_SPAN_ID for correlation). The same\n  // context is stamped onto every delegation record so journal consumers join records into the\n  // caller's trace.\n  const traceContext = readTraceContextFromEnv()\n  if (process.env.OTEL_EXPORTER_OTLP_ENDPOINT) {\n    process.stderr.write(\n      `agent-runtime-mcp: exporting loop topology → ${process.env.OTEL_EXPORTER_OTLP_ENDPOINT}\\n`,\n    )\n  }\n\n  // The ONE generic `delegate` verb — opt-in via MCP_ENABLE_DELEGATE=1. Its authoring supervisor\n  // runs the brain on the router and spawns authored workers as sub-sandboxes through the SAME\n  // client, so it needs the loaded `sandboxClient`. Gated on the client resolving (no key → no\n  // delegate, fail-closed).\n  let delegateSupervisor: DelegateHandlerOptions | undefined\n  if (wantDelegate && sandboxClient) {\n    try {\n      delegateSupervisor = resolveDelegateSupervisor(sandboxClient)\n    } catch (error) {\n      // Refuse to serve a verb that cannot work. Advertising `delegate` on an\n      // unresolvable substrate spends an agent's turn on a tool whose first\n      // inference is guaranteed to reject.\n      process.stderr.write(`${error instanceof Error ? error.message : String(error)}\\n`)\n      process.exit(2)\n    }\n  }\n  if (delegateSupervisor) {\n    process.stderr.write(\n      `agent-runtime-mcp: delegate enabled — generic authoring supervisor on ${delegateSupervisor.router.model}\\n`,\n    )\n  }\n\n  const durableQueue = await buildDurableQueueFromEnv(traceContext)\n  const server = createMcpServer({\n    ...(delegateSupervisor ? { delegateSupervisor } : {}),\n    traceContext,\n    ...(durableQueue ? { queue: durableQueue } : {}),\n  })\n\n  const shutdown = () => {\n    server.stop()\n    // Drain journal writes so the state file reflects the final record\n    // states before the process exits. A persist failure already routed\n    // through onPersistError; swallow the duplicate rejection here.\n    if (durableQueue) {\n      void durableQueue\n        .flush()\n        .catch(() => {})\n        .finally(() => process.exit(0))\n      return\n    }\n    process.exit(0)\n  }\n  process.on('SIGINT', shutdown)\n  process.on('SIGTERM', shutdown)\n\n  await server.serve()\n}\n\nasync function buildDurableQueueFromEnv(\n  traceContext: TraceContext,\n): Promise<DelegationTaskQueue | undefined> {\n  const stateFile = process.env.AGENT_RUNTIME_DELEGATION_STATE_FILE?.trim()\n  if (!stateFile) return undefined\n  const store = new FileDelegationStore({\n    filePath: stateFile,\n    recoverCorrupt: process.env.AGENT_RUNTIME_DELEGATION_STATE_RECOVER === '1',\n  })\n  const maxTerminalRecords = parseRetention(process.env.AGENT_RUNTIME_DELEGATION_RETAIN_TERMINAL)\n  const queue = await DelegationTaskQueue.restore({\n    store,\n    traceContext,\n    ...(maxTerminalRecords !== undefined ? { maxTerminalRecords } : {}),\n    onPersistError: (error) => {\n      // Durable mode that can no longer write is a broken contract: crash\n      // loud instead of degrading to memory-only behind the caller's back.\n      process.stderr.write(`agent-runtime-mcp: ${error.message}\\n`)\n      process.exit(1)\n    },\n  })\n  process.stderr.write(`agent-runtime-mcp: durable delegation state → ${stateFile}\\n`)\n  return queue\n}\n\nfunction parseRetention(raw: string | undefined): number | undefined {\n  if (raw === undefined || raw.trim() === '') return undefined\n  const n = Number(raw)\n  if (!Number.isInteger(n) || n < 1) {\n    process.stderr.write(\n      `agent-runtime-mcp: AGENT_RUNTIME_DELEGATION_RETAIN_TERMINAL must be a positive integer, got \"${raw}\"\\n`,\n    )\n    process.exit(2)\n  }\n  return n\n}\n\nasync function loadSandboxClient(apiKey: string | undefined): Promise<SandboxClient> {\n  // Diagnostic mode: AGENT_RUNTIME_MCP_ALLOW_NO_KEY=1 enables tools/list + the\n  // queue-bound tools (status / history / feedback) without sandbox creds.\n  // `delegate` requires a real client; the stub fails loud at create() so the\n  // agent observes the cause instead of silent success.\n  if (!apiKey) {\n    return {\n      async create() {\n        throw new Error(\n          'agent-runtime-mcp: TANGLE_API_KEY is unset; `delegate` is disabled in diagnostic mode. Set TANGLE_API_KEY or unset MCP_ENABLE_DELEGATE to remove the unsupported tool from the tool list.',\n        )\n      },\n    } satisfies SandboxClient\n  }\n  // Dynamic import keeps the bin importable in environments that haven't\n  // installed `@tangle-network/sandbox` yet (the runtime package lists it\n  // as a peer dep, not a hard dep).\n  const mod = await import('@tangle-network/sandbox').catch((err) => {\n    process.stderr.write(\n      `agent-runtime-mcp: failed to load @tangle-network/sandbox (${err.message}); install the peer dependency\\n`,\n    )\n    process.exit(2)\n  })\n  const SandboxCtor = (mod as { Sandbox?: new (config: unknown) => SandboxClient }).Sandbox\n  if (!SandboxCtor) {\n    process.stderr.write(\n      'agent-runtime-mcp: @tangle-network/sandbox does not export Sandbox; cannot construct client\\n',\n    )\n    process.exit(2)\n  }\n  // @tangle-network/sandbox ≥0.6 makes baseUrl required; default it so the MCP server\n  // starts without forcing every caller to set SANDBOX_BASE_URL. Treat empty/whitespace as\n  // unset (|| not ??) so `SANDBOX_BASE_URL=` still resolves to the default.\n  const baseUrl = process.env.SANDBOX_BASE_URL?.trim() || DEFAULT_SANDBOX_BASE_URL\n  return new SandboxCtor({ apiKey, baseUrl })\n}\n\nmain().catch((err) => {\n  process.stderr.write(`agent-runtime-mcp: ${err instanceof Error ? err.stack : String(err)}\\n`)\n  process.exit(1)\n})\n"],"mappings":";;;;;;AA2BA,MAAM,yBAAyB;AAE/B,SAAS,QAAQ,OAA+C;CAC9D,MAAM,IAAI,OAAO,KAAK;CACtB,OAAO,IAAI,IAAI,KAAA;AACjB;;;AAIA,SAAgB,gBAAgB,MAAyB,QAAQ,KAAc;CAC7E,OAAO,IAAI,wBAAwB;AACrC;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,cAAc,KAAsC;CAC3D,MAAM,YACJ,QAAQ,IAAI,yBAAyB,KACrC,QAAQ,IAAI,oBAAoB,KAChC,QAAQ,IAAI,cAAc,KAC1B,QAAQ,IAAI,cAAc,KAC1B;CACF,MAAM,OAAO,QAAQ,IAAI,8BAA8B,KAAK,qBAAqB,GAAgB;CACjG,MAAM,gBAAgB,aAAa,KAAK,IAAI,IACxC,KAAK,QAAQ,OAAO,EAAE,IACtB,GAAG,KAAK,QAAQ,OAAO,EAAE,EAAE;CAC/B,MAAM,QACJ,QAAQ,IAAI,oBAAoB,KAChC,QAAQ,IAAI,gBAAgB,KAC5B,QAAQ,IAAI,YAAY,KACxB,QAAQ,IAAI,mBAAmB;CACjC,IAAI,CAAC,OACH,MAAM,IAAI,YACR,+KAEF;CAEF,OAAO;EAAE;EAAe;EAAW;CAAM;AAC3C;;;;;;;AAQA,SAAgB,0BACd,eACA,MAAyB,QAAQ,KACG;CACpC,IAAI,CAAC,gBAAgB,GAAG,GAAG,OAAO,KAAA;CAClC,MAAM,SAAS,cAAc,GAAG;CAQhC,OAAO;EACL;EACA,SAAA;GANA,SAAS;GACT,SAJe,QAAQ,IAAI,2BAA2B,KACtD;GAIA;EAIM;EACN,OAAO,OAAO;CAChB;AACF;;;AC9DA,MAAM,2BAA2B;AAEjC,eAAe,OAAsB;CACnC,MAAM,eAAe,gBAAgB,QAAQ,GAAG;CAKhD,IAAI;CACJ,IAAI,cAAc;EAChB,MAAM,SAAS,QAAQ,IAAI;EAC3B,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,gCAAgC;GAC1D,QAAQ,OAAO,MACb,yMACF;GACA,QAAQ,KAAK,CAAC;EAChB;EACA,gBAAgB,MAAM,kBAAkB,MAAM;CAChD;CAMA,MAAM,eAAe,wBAAwB;CAC7C,IAAI,QAAQ,IAAI,6BACd,QAAQ,OAAO,MACb,gDAAgD,QAAQ,IAAI,4BAA4B,GAC1F;CAOF,IAAI;CACJ,IAAI,gBAAgB,eAClB,IAAI;EACF,qBAAqB,0BAA0B,aAAa;CAC9D,SAAS,OAAO;EAId,QAAQ,OAAO,MAAM,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG;EAClF,QAAQ,KAAK,CAAC;CAChB;CAEF,IAAI,oBACF,QAAQ,OAAO,MACb,yEAAyE,mBAAmB,OAAO,MAAM,GAC3G;CAGF,MAAM,eAAe,MAAM,yBAAyB,YAAY;CAChE,MAAM,SAAS,gBAAgB;EAC7B,GAAI,qBAAqB,EAAE,mBAAmB,IAAI,CAAC;EACnD;EACA,GAAI,eAAe,EAAE,OAAO,aAAa,IAAI,CAAC;CAChD,CAAC;CAED,MAAM,iBAAiB;EACrB,OAAO,KAAK;EAIZ,IAAI,cAAc;GAChB,aACG,MAAM,CAAC,CACP,YAAY,CAAC,CAAC,CAAC,CACf,cAAc,QAAQ,KAAK,CAAC,CAAC;GAChC;EACF;EACA,QAAQ,KAAK,CAAC;CAChB;CACA,QAAQ,GAAG,UAAU,QAAQ;CAC7B,QAAQ,GAAG,WAAW,QAAQ;CAE9B,MAAM,OAAO,MAAM;AACrB;AAEA,eAAe,yBACb,cAC0C;CAC1C,MAAM,YAAY,QAAQ,IAAI,qCAAqC,KAAK;CACxE,IAAI,CAAC,WAAW,OAAO,KAAA;CACvB,MAAM,QAAQ,IAAI,oBAAoB;EACpC,UAAU;EACV,gBAAgB,QAAQ,IAAI,2CAA2C;CACzE,CAAC;CACD,MAAM,qBAAqB,eAAe,QAAQ,IAAI,wCAAwC;CAC9F,MAAM,QAAQ,MAAM,oBAAoB,QAAQ;EAC9C;EACA;EACA,GAAI,uBAAuB,KAAA,IAAY,EAAE,mBAAmB,IAAI,CAAC;EACjE,iBAAiB,UAAU;GAGzB,QAAQ,OAAO,MAAM,sBAAsB,MAAM,QAAQ,GAAG;GAC5D,QAAQ,KAAK,CAAC;EAChB;CACF,CAAC;CACD,QAAQ,OAAO,MAAM,iDAAiD,UAAU,GAAG;CACnF,OAAO;AACT;AAEA,SAAS,eAAe,KAA6C;CACnE,IAAI,QAAQ,KAAA,KAAa,IAAI,KAAK,MAAM,IAAI,OAAO,KAAA;CACnD,MAAM,IAAI,OAAO,GAAG;CACpB,IAAI,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,GAAG;EACjC,QAAQ,OAAO,MACb,gGAAgG,IAAI,IACtG;EACA,QAAQ,KAAK,CAAC;CAChB;CACA,OAAO;AACT;AAEA,eAAe,kBAAkB,QAAoD;CAKnF,IAAI,CAAC,QACH,OAAO,EACL,MAAM,SAAS;EACb,MAAM,IAAI,MACR,2LACF;CACF,EACF;CAWF,MAAM,eAAe,MANH,OAAO,0BAA0B,CAAC,OAAO,QAAQ;EACjE,QAAQ,OAAO,MACb,8DAA8D,IAAI,QAAQ,iCAC5E;EACA,QAAQ,KAAK,CAAC;CAChB,CAAC,EAAA,CACiF;CAClF,IAAI,CAAC,aAAa;EAChB,QAAQ,OAAO,MACb,+FACF;EACA,QAAQ,KAAK,CAAC;CAChB;CAKA,OAAO,IAAI,YAAY;EAAE;EAAQ,SADjB,QAAQ,IAAI,kBAAkB,KAAK,KAAK;CACf,CAAC;AAC5C;AAEA,KAAK,CAAC,CAAC,OAAO,QAAQ;CACpB,QAAQ,OAAO,MAAM,sBAAsB,eAAe,QAAQ,IAAI,QAAQ,OAAO,GAAG,EAAE,GAAG;CAC7F,QAAQ,KAAK,CAAC;AAChB,CAAC"}
+{"version":3,"file":"bin.js","names":[],"sources":["../../src/mcp/delegate-supervisor-provisioning.ts","../../src/mcp/bin.ts"],"sourcesContent":["/**\n *\n * Resolve the `delegate` supervisor substrate (router brain + worker backend) from env, so the\n * `agent-runtime-mcp` bin can serve the ONE generic `delegate` verb by env, over the SAME stdio\n * invocation a consumer already mounts.\n *\n * `delegate` is wired into `createMcpServer` via `McpServerOptions.delegateSupervisor`, which needs a\n * router (the supervisor brain's transport) and a backend (WHERE the authored workers run). Inside a\n * sandbox child the natural backend is `sandbox`: authored workers run as sub-sandboxes through the\n * SAME `SandboxClient` the bin already loads from `TANGLE_API_KEY`. Dedicated MCP variables name\n * the supervisor's router connection and exact model; inherited worker/model aliases are rejected.\n *\n * @experimental\n */\n\nimport type { AgentProfile } from '@tangle-network/agent-interface'\nimport { ConfigError } from '../errors'\nimport type { SandboxClient } from '../runtime'\nimport type { RouterTransportConfig } from '../runtime/router-client'\nimport { supervisorInstructions } from '../runtime/supervise/authoring'\nimport type { ExecutorConfig } from '../runtime/supervise/runtime'\nimport type { DelegateHandlerOptions } from './tools/delegate'\n\nfunction trimmed(value: string | undefined): string | undefined {\n  const v = value?.trim()\n  return v ? v : undefined\n}\n\nfunction requiredEnv(env: NodeJS.ProcessEnv, name: string): string {\n  const value = trimmed(env[name])\n  if (value) return value\n  throw new ConfigError(`agent-runtime-mcp: ${name} is required when MCP_ENABLE_DELEGATE=1`)\n}\n\n/** True when the operator opted the generic `delegate` verb in (`MCP_ENABLE_DELEGATE=1`). Default off:\n *  the wiring is additive, so consumers that do not enable it are unaffected. */\nexport function delegateEnabled(env: NodeJS.ProcessEnv = process.env): boolean {\n  return env.MCP_ENABLE_DELEGATE === '1'\n}\n\n/**\n * Resolve the supervisor brain from dedicated MCP configuration. The model is part of the exact\n * profile; the URL and key are transport-only. No generic worker/model/key variable may silently\n * select this paid execution path.\n */\nfunction resolveRouterSupervisor(env: NodeJS.ProcessEnv): {\n  router: RouterTransportConfig\n  profile: AgentProfile\n} {\n  const routerKey = requiredEnv(env, 'MCP_SUPERVISOR_ROUTER_KEY')\n  const base = requiredEnv(env, 'MCP_SUPERVISOR_ROUTER_BASE_URL')\n  const routerBaseUrl = /\\/v\\d+\\/?$/.test(base)\n    ? base.replace(/\\/$/, '')\n    : `${base.replace(/\\/$/, '')}/v1`\n  const model = requiredEnv(env, 'MCP_SUPERVISOR_MODEL')\n  return {\n    router: { routerBaseUrl, routerKey },\n    profile: {\n      name: 'delegate-supervisor',\n      harness: 'cli-base',\n      model: { provider: 'tangle-router', default: model },\n      prompt: { systemPrompt: supervisorInstructions() },\n    },\n  }\n}\n\n/**\n * Build the `delegateSupervisor` substrate for `createMcpServer` from env + the bin's loaded\n * `SandboxClient`. Returns `undefined` when `delegate` is not opted in, so the caller mounts it only\n * when asked. The worker backend is `sandbox`; every authored worker's exact profile selects its\n * own harness/provider/model.\n */\nexport function resolveDelegateSupervisor(\n  sandboxClient: SandboxClient,\n  env: NodeJS.ProcessEnv = process.env,\n): DelegateHandlerOptions | undefined {\n  if (!delegateEnabled(env)) return undefined\n  const supervisor = resolveRouterSupervisor(env)\n  const backend: ExecutorConfig = {\n    backend: 'sandbox',\n    sandboxClient,\n  }\n  return {\n    router: supervisor.router,\n    supervisorProfile: supervisor.profile,\n    backend,\n  }\n}\n","#!/usr/bin/env node\n\n/**\n *\n * `agent-runtime-mcp` — stdio MCP server entry point.\n *\n * Serves the ONE generic `delegate` verb (opt-in via `MCP_ENABLE_DELEGATE=1`): one intent → a\n * supervisor that authors + drives its own worker over `supervise()`, returning the delivered output\n * with its cost. The supervisor brain runs on the router; authored workers run as sub-sandboxes\n * through the same `SandboxClient` the bin loads from `TANGLE_API_KEY`. The queue-bound tools\n * (`delegate_feedback`, `delegation_status`, `delegation_history`) are always served.\n *\n * Environment variables:\n *   TANGLE_API_KEY                   required — passed to `new Sandbox({ apiKey })`\n *   SANDBOX_BASE_URL                 optional — sandbox-SDK base URL override\n *   MCP_ENABLE_DELEGATE              set to `1` to serve the generic `delegate` verb. Its authoring\n *                                    supervisor runs the brain on the router and spawns authored\n *                                    workers as sub-sandboxes via the same client; needs TANGLE_API_KEY.\n *   MCP_SUPERVISOR_MODEL             required exact supervisor brain model id\n *   MCP_SUPERVISOR_ROUTER_KEY        required router key for the supervisor brain\n *   MCP_SUPERVISOR_ROUTER_BASE_URL   required router base, normalized to `/v1`\n *   AGENT_RUNTIME_DELEGATION_STATE_FILE\n *                                    optional — absolute path of a JSON state\n *                                    file. When set, delegation records persist\n *                                    across MCP restarts (FileDelegationStore):\n *                                    status/history survive and idempotency keys\n *                                    dedupe across processes.\n *   AGENT_RUNTIME_DELEGATION_STATE_RECOVER\n *                                    set to `1` to archive a corrupt state file\n *                                    (`<file>.corrupt-<ts>`) and start empty\n *                                    instead of refusing to boot.\n *   AGENT_RUNTIME_DELEGATION_RETAIN_TERMINAL\n *                                    optional — positive integer cap on retained\n *                                    terminal records. Unset = keep forever.\n *\n * @experimental\n */\n\nimport type { SandboxClient } from '../runtime'\nimport { delegateEnabled, resolveDelegateSupervisor } from './delegate-supervisor-provisioning'\nimport { FileDelegationStore } from './delegation-store'\nimport { createMcpServer } from './server'\nimport { DelegationTaskQueue } from './task-queue'\nimport type { DelegateHandlerOptions } from './tools/delegate'\nimport { readTraceContextFromEnv, type TraceContext } from './trace-propagation'\n\nconst DEFAULT_SANDBOX_BASE_URL = 'https://sandbox.tangle.tools'\n\nasync function main(): Promise<void> {\n  const wantDelegate = delegateEnabled(process.env)\n\n  // The generic `delegate` verb needs the sandbox client: its authored workers run as sub-sandboxes\n  // (the `sandbox` backend). When `delegate` is not opted in, the server runs the queue-only subset\n  // (feedback + status + history) with no sandbox.\n  let sandboxClient: SandboxClient | undefined\n  if (wantDelegate) {\n    const apiKey = process.env.TANGLE_API_KEY\n    if (!apiKey && !process.env.AGENT_RUNTIME_MCP_ALLOW_NO_KEY) {\n      process.stderr.write(\n        'agent-runtime-mcp: TANGLE_API_KEY is required to serve `delegate`. Set AGENT_RUNTIME_MCP_ALLOW_NO_KEY=1 to run without it for diagnostics, or unset MCP_ENABLE_DELEGATE to run the queue-only subset.\\n',\n      )\n      process.exit(2)\n    }\n    sandboxClient = await loadSandboxClient(apiKey)\n  }\n\n  // The supervisor's loop topology spans export to the OTLP / Tangle Intelligence sink when\n  // OTEL_EXPORTER_OTLP_ENDPOINT is set (+ TRACE_ID / PARENT_SPAN_ID for correlation). The same\n  // context is stamped onto every delegation record so journal consumers join records into the\n  // caller's trace.\n  const traceContext = readTraceContextFromEnv()\n  if (process.env.OTEL_EXPORTER_OTLP_ENDPOINT) {\n    process.stderr.write(\n      `agent-runtime-mcp: exporting loop topology → ${process.env.OTEL_EXPORTER_OTLP_ENDPOINT}\\n`,\n    )\n  }\n\n  // The ONE generic `delegate` verb — opt-in via MCP_ENABLE_DELEGATE=1. Its authoring supervisor\n  // runs the brain on the router and spawns authored workers as sub-sandboxes through the SAME\n  // client, so it needs the loaded `sandboxClient`. Gated on the client resolving (no key → no\n  // delegate, fail-closed).\n  let delegateSupervisor: DelegateHandlerOptions | undefined\n  if (wantDelegate && sandboxClient) {\n    try {\n      delegateSupervisor = resolveDelegateSupervisor(sandboxClient)\n    } catch (error) {\n      // Refuse to serve a verb that cannot work. Advertising `delegate` on an\n      // unresolvable substrate spends an agent's turn on a tool whose first\n      // inference is guaranteed to reject.\n      process.stderr.write(`${error instanceof Error ? error.message : String(error)}\\n`)\n      process.exit(2)\n    }\n  }\n  if (delegateSupervisor) {\n    process.stderr.write(\n      `agent-runtime-mcp: delegate enabled — generic authoring supervisor on ${delegateSupervisor.supervisorProfile.model?.default}\\n`,\n    )\n  }\n\n  const durableQueue = await buildDurableQueueFromEnv(traceContext)\n  const server = createMcpServer({\n    ...(delegateSupervisor ? { delegateSupervisor } : {}),\n    traceContext,\n    ...(durableQueue ? { queue: durableQueue } : {}),\n  })\n\n  const shutdown = () => {\n    server.stop()\n    // Drain journal writes so the state file reflects the final record\n    // states before the process exits. A persist failure already routed\n    // through onPersistError; swallow the duplicate rejection here.\n    if (durableQueue) {\n      void durableQueue\n        .flush()\n        .catch(() => {})\n        .finally(() => process.exit(0))\n      return\n    }\n    process.exit(0)\n  }\n  process.on('SIGINT', shutdown)\n  process.on('SIGTERM', shutdown)\n\n  await server.serve()\n}\n\nasync function buildDurableQueueFromEnv(\n  traceContext: TraceContext,\n): Promise<DelegationTaskQueue | undefined> {\n  const stateFile = process.env.AGENT_RUNTIME_DELEGATION_STATE_FILE?.trim()\n  if (!stateFile) return undefined\n  const store = new FileDelegationStore({\n    filePath: stateFile,\n    recoverCorrupt: process.env.AGENT_RUNTIME_DELEGATION_STATE_RECOVER === '1',\n  })\n  const maxTerminalRecords = parseRetention(process.env.AGENT_RUNTIME_DELEGATION_RETAIN_TERMINAL)\n  const queue = await DelegationTaskQueue.restore({\n    store,\n    traceContext,\n    ...(maxTerminalRecords !== undefined ? { maxTerminalRecords } : {}),\n    onPersistError: (error) => {\n      // Durable mode that can no longer write is a broken contract: crash\n      // loud instead of degrading to memory-only behind the caller's back.\n      process.stderr.write(`agent-runtime-mcp: ${error.message}\\n`)\n      process.exit(1)\n    },\n  })\n  process.stderr.write(`agent-runtime-mcp: durable delegation state → ${stateFile}\\n`)\n  return queue\n}\n\nfunction parseRetention(raw: string | undefined): number | undefined {\n  if (raw === undefined || raw.trim() === '') return undefined\n  const n = Number(raw)\n  if (!Number.isInteger(n) || n < 1) {\n    process.stderr.write(\n      `agent-runtime-mcp: AGENT_RUNTIME_DELEGATION_RETAIN_TERMINAL must be a positive integer, got \"${raw}\"\\n`,\n    )\n    process.exit(2)\n  }\n  return n\n}\n\nasync function loadSandboxClient(apiKey: string | undefined): Promise<SandboxClient> {\n  // Diagnostic mode: AGENT_RUNTIME_MCP_ALLOW_NO_KEY=1 enables tools/list + the\n  // queue-bound tools (status / history / feedback) without sandbox creds.\n  // `delegate` requires a real client; the stub fails loud at create() so the\n  // agent observes the cause instead of silent success.\n  if (!apiKey) {\n    return {\n      async create() {\n        throw new Error(\n          'agent-runtime-mcp: TANGLE_API_KEY is unset; `delegate` is disabled in diagnostic mode. Set TANGLE_API_KEY or unset MCP_ENABLE_DELEGATE to remove the unsupported tool from the tool list.',\n        )\n      },\n    } satisfies SandboxClient\n  }\n  // Dynamic import keeps the bin importable in environments that haven't\n  // installed `@tangle-network/sandbox` yet (the runtime package lists it\n  // as a peer dep, not a hard dep).\n  const mod = await import('@tangle-network/sandbox').catch((err) => {\n    process.stderr.write(\n      `agent-runtime-mcp: failed to load @tangle-network/sandbox (${err.message}); install the peer dependency\\n`,\n    )\n    process.exit(2)\n  })\n  const SandboxCtor = (mod as { Sandbox?: new (config: unknown) => SandboxClient }).Sandbox\n  if (!SandboxCtor) {\n    process.stderr.write(\n      'agent-runtime-mcp: @tangle-network/sandbox does not export Sandbox; cannot construct client\\n',\n    )\n    process.exit(2)\n  }\n  // @tangle-network/sandbox ≥0.6 makes baseUrl required; default it so the MCP server\n  // starts without forcing every caller to set SANDBOX_BASE_URL. Treat empty/whitespace as\n  // unset (|| not ??) so `SANDBOX_BASE_URL=` still resolves to the default.\n  const baseUrl = process.env.SANDBOX_BASE_URL?.trim() || DEFAULT_SANDBOX_BASE_URL\n  return new SandboxCtor({ apiKey, baseUrl })\n}\n\nmain().catch((err) => {\n  process.stderr.write(`agent-runtime-mcp: ${err instanceof Error ? err.stack : String(err)}\\n`)\n  process.exit(1)\n})\n"],"mappings":";;;;;;AAuBA,SAAS,QAAQ,OAA+C;CAC9D,MAAM,IAAI,OAAO,KAAK;CACtB,OAAO,IAAI,IAAI,KAAA;AACjB;AAEA,SAAS,YAAY,KAAwB,MAAsB;CACjE,MAAM,QAAQ,QAAQ,IAAI,KAAK;CAC/B,IAAI,OAAO,OAAO;CAClB,MAAM,IAAI,YAAY,sBAAsB,KAAK,wCAAwC;AAC3F;;;AAIA,SAAgB,gBAAgB,MAAyB,QAAQ,KAAc;CAC7E,OAAO,IAAI,wBAAwB;AACrC;;;;;;AAOA,SAAS,wBAAwB,KAG/B;CACA,MAAM,YAAY,YAAY,KAAK,2BAA2B;CAC9D,MAAM,OAAO,YAAY,KAAK,gCAAgC;CAC9D,MAAM,gBAAgB,aAAa,KAAK,IAAI,IACxC,KAAK,QAAQ,OAAO,EAAE,IACtB,GAAG,KAAK,QAAQ,OAAO,EAAE,EAAE;CAC/B,MAAM,QAAQ,YAAY,KAAK,sBAAsB;CACrD,OAAO;EACL,QAAQ;GAAE;GAAe;EAAU;EACnC,SAAS;GACP,MAAM;GACN,SAAS;GACT,OAAO;IAAE,UAAU;IAAiB,SAAS;GAAM;GACnD,QAAQ,EAAE,cAAc,uBAAuB,EAAE;EACnD;CACF;AACF;;;;;;;AAQA,SAAgB,0BACd,eACA,MAAyB,QAAQ,KACG;CACpC,IAAI,CAAC,gBAAgB,GAAG,GAAG,OAAO,KAAA;CAClC,MAAM,aAAa,wBAAwB,GAAG;CAC9C,MAAM,UAA0B;EAC9B,SAAS;EACT;CACF;CACA,OAAO;EACL,QAAQ,WAAW;EACnB,mBAAmB,WAAW;EAC9B;CACF;AACF;;;ACzCA,MAAM,2BAA2B;AAEjC,eAAe,OAAsB;CACnC,MAAM,eAAe,gBAAgB,QAAQ,GAAG;CAKhD,IAAI;CACJ,IAAI,cAAc;EAChB,MAAM,SAAS,QAAQ,IAAI;EAC3B,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,gCAAgC;GAC1D,QAAQ,OAAO,MACb,yMACF;GACA,QAAQ,KAAK,CAAC;EAChB;EACA,gBAAgB,MAAM,kBAAkB,MAAM;CAChD;CAMA,MAAM,eAAe,wBAAwB;CAC7C,IAAI,QAAQ,IAAI,6BACd,QAAQ,OAAO,MACb,gDAAgD,QAAQ,IAAI,4BAA4B,GAC1F;CAOF,IAAI;CACJ,IAAI,gBAAgB,eAClB,IAAI;EACF,qBAAqB,0BAA0B,aAAa;CAC9D,SAAS,OAAO;EAId,QAAQ,OAAO,MAAM,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG;EAClF,QAAQ,KAAK,CAAC;CAChB;CAEF,IAAI,oBACF,QAAQ,OAAO,MACb,yEAAyE,mBAAmB,kBAAkB,OAAO,QAAQ,GAC/H;CAGF,MAAM,eAAe,MAAM,yBAAyB,YAAY;CAChE,MAAM,SAAS,gBAAgB;EAC7B,GAAI,qBAAqB,EAAE,mBAAmB,IAAI,CAAC;EACnD;EACA,GAAI,eAAe,EAAE,OAAO,aAAa,IAAI,CAAC;CAChD,CAAC;CAED,MAAM,iBAAiB;EACrB,OAAO,KAAK;EAIZ,IAAI,cAAc;GAChB,aACG,MAAM,CAAC,CACP,YAAY,CAAC,CAAC,CAAC,CACf,cAAc,QAAQ,KAAK,CAAC,CAAC;GAChC;EACF;EACA,QAAQ,KAAK,CAAC;CAChB;CACA,QAAQ,GAAG,UAAU,QAAQ;CAC7B,QAAQ,GAAG,WAAW,QAAQ;CAE9B,MAAM,OAAO,MAAM;AACrB;AAEA,eAAe,yBACb,cAC0C;CAC1C,MAAM,YAAY,QAAQ,IAAI,qCAAqC,KAAK;CACxE,IAAI,CAAC,WAAW,OAAO,KAAA;CACvB,MAAM,QAAQ,IAAI,oBAAoB;EACpC,UAAU;EACV,gBAAgB,QAAQ,IAAI,2CAA2C;CACzE,CAAC;CACD,MAAM,qBAAqB,eAAe,QAAQ,IAAI,wCAAwC;CAC9F,MAAM,QAAQ,MAAM,oBAAoB,QAAQ;EAC9C;EACA;EACA,GAAI,uBAAuB,KAAA,IAAY,EAAE,mBAAmB,IAAI,CAAC;EACjE,iBAAiB,UAAU;GAGzB,QAAQ,OAAO,MAAM,sBAAsB,MAAM,QAAQ,GAAG;GAC5D,QAAQ,KAAK,CAAC;EAChB;CACF,CAAC;CACD,QAAQ,OAAO,MAAM,iDAAiD,UAAU,GAAG;CACnF,OAAO;AACT;AAEA,SAAS,eAAe,KAA6C;CACnE,IAAI,QAAQ,KAAA,KAAa,IAAI,KAAK,MAAM,IAAI,OAAO,KAAA;CACnD,MAAM,IAAI,OAAO,GAAG;CACpB,IAAI,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,GAAG;EACjC,QAAQ,OAAO,MACb,gGAAgG,IAAI,IACtG;EACA,QAAQ,KAAK,CAAC;CAChB;CACA,OAAO;AACT;AAEA,eAAe,kBAAkB,QAAoD;CAKnF,IAAI,CAAC,QACH,OAAO,EACL,MAAM,SAAS;EACb,MAAM,IAAI,MACR,2LACF;CACF,EACF;CAWF,MAAM,eAAe,MANH,OAAO,0BAA0B,CAAC,OAAO,QAAQ;EACjE,QAAQ,OAAO,MACb,8DAA8D,IAAI,QAAQ,iCAC5E;EACA,QAAQ,KAAK,CAAC;CAChB,CAAC,EAAA,CACiF;CAClF,IAAI,CAAC,aAAa;EAChB,QAAQ,OAAO,MACb,+FACF;EACA,QAAQ,KAAK,CAAC;CAChB;CAKA,OAAO,IAAI,YAAY;EAAE;EAAQ,SADjB,QAAQ,IAAI,kBAAkB,KAAK,KAAK;CACf,CAAC;AAC5C;AAEA,KAAK,CAAC,CAAC,OAAO,QAAQ;CACpB,QAAQ,OAAO,MAAM,sBAAsB,eAAe,QAAQ,IAAI,QAAQ,OAAO,GAAG,EAAE,GAAG;CAC7F,QAAQ,KAAK,CAAC;AAChB,CAAC"}