@tokenfactory/acc-runner 0.39.0 → 0.40.1

package/dist/companion-mirror-socket.js

@@ -0,0 +1,196 @@
+/**
+ * CC-3C (COMPANION): the localhost mirror socket.
+ *
+ * A companion runner already streams its chat-turn output to the control plane
+ * over the `chat:<conversation_id>` Realtime topic (chat-transport.ts) — that
+ * path is authoritative: the server-side consumer persists deltas into
+ * acc.chat_turn_deltas and the DB stays the SINGLE source of truth. This module
+ * adds a SECOND, purely-local delivery of the same frames over a loopback-only
+ * WebSocket so the operator's browser — running on the same machine as the
+ * companion — can paint the reply with sub-round-trip latency instead of waiting
+ * on the Realtime fan-out.
+ *
+ * Two invariants make the fast path safe, and both are enforced structurally so
+ * a conformance test can assert them:
+ *
+ *   1. AUTHENTICATED — the server binds to 127.0.0.1 ONLY (never a routable
+ *      interface) and every upgrade must present the session-bound handshake
+ *      token. A missing/blank/wrong token is closed with 1008 before a single
+ *      frame is delivered. The expected token is injected (bound to the runner's
+ *      current keychain session, rotated on logout), so the socket can never
+ *      outlive the session it mirrors.
+ *
+ *   2. MIRROR-ONLY — the server is constructed with an OUTBOUND broadcast source
+ *      and nothing else. It holds no Supabase client, no `ChatLaneTransport`, no
+ *      RPC handle: there is literally no method by which an inbound frame could
+ *      mutate DB state. Inbound frames are accepted (so the browser may send
+ *      liveness pings) but routed to a no-op sink; the module exposes an
+ *      `inboundCount()` so the conformance test can prove traffic arrived AND
+ *      that arrival changed nothing. The `mirror_only: true` flag stamped on
+ *      every frame tells the browser the same thing on the wire: treat the DB
+ *      read as truth; this is a latency shim.
+ *
+ * The whole surface (server factory, clock, log sink) is injectable so the
+ * conformance suite exercises it against a real loopback socket without any
+ * network or `claude` binary.
+ */
+import { createServer } from "node:http";
+import { timingSafeEqual } from "node:crypto";
+import { WebSocketServer } from "ws";
+import { CHAT_LANE_PROTOCOL_VERSION } from "./chat-lane.js";
+/** The loopback address the mirror socket binds to — never a routable interface. */
+export const MIRROR_SOCKET_HOST = "127.0.0.1";
+/** Query-string key the browser passes the session-bound handshake token under. */
+export const MIRROR_TOKEN_QUERY_KEY = "token";
+/** WebSocket close code for an unauthenticated / unauthorised upgrade (policy violation). */
+export const MIRROR_CLOSE_UNAUTHORIZED = 1008;
+/** Constant-time token compare that tolerates length mismatch without throwing. */
+export function tokensMatch(a, b) {
+    if (a.length === 0 || b.length === 0)
+        return false;
+    const ba = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ba.length !== bb.length)
+        return false;
+    return timingSafeEqual(ba, bb);
+}
+/**
+ * Extract the handshake token from an upgrade request URL's query string.
+ * Returns "" when absent so the caller's compare fails closed.
+ */
+export function extractMirrorToken(url) {
+    if (!url)
+        return "";
+    const q = url.indexOf("?");
+    if (q === -1)
+        return "";
+    const params = new URLSearchParams(url.slice(q + 1));
+    return params.get(MIRROR_TOKEN_QUERY_KEY) ?? "";
+}
+/**
+ * The loopback mirror server. Construct it with an OUTBOUND broadcast source
+ * only: `mirror()` fans a frame to every authed browser client; there is no
+ * inbound → mutation path by construction (see module header, invariant 2).
+ */
+export class CompanionMirrorSocket {
+    opts;
+    http = null;
+    wss = null;
+    clients = new Set();
+    inbound = 0;
+    boundPort = 0;
+    now;
+    constructor(opts) {
+        this.opts = opts;
+        this.now = opts.now ?? Date.now;
+    }
+    /** Bind the loopback server and begin accepting authed upgrades. */
+    async start() {
+        if (this.wss)
+            return;
+        const http = (this.opts.createHttpServer ?? createServer)();
+        // `noServer` + manual upgrade so we authorise BEFORE completing the handshake
+        // (an unauthorised client is closed without ever joining the client set).
+        const wss = new WebSocketServer({ noServer: true });
+        http.on("upgrade", (req, socket, head) => {
+            const token = extractMirrorToken(req.url);
+            if (!tokensMatch(token, this.opts.expectedToken)) {
+                this.opts.onLog?.("[acc-runner] mirror socket: rejected unauthorised upgrade");
+                // Refuse the handshake outright — the browser never becomes a client.
+                socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
+                socket.destroy();
+                return;
+            }
+            wss.handleUpgrade(req, socket, head, (ws) => this.accept(ws));
+        });
+        await new Promise((resolve, reject) => {
+            http.once("error", reject);
+            http.listen(this.opts.port, MIRROR_SOCKET_HOST, () => {
+                http.off("error", reject);
+                const addr = http.address();
+                this.boundPort = typeof addr === "object" && addr ? addr.port : this.opts.port;
+                resolve();
+            });
+        });
+        this.http = http;
+        this.wss = wss;
+    }
+    /** The bound loopback port (meaningful only after `start`; resolves an ephemeral 0). */
+    port() {
+        return this.boundPort;
+    }
+    /** Live authed browser client count. */
+    clientCount() {
+        return this.clients.size;
+    }
+    /** Total inbound frames received (all routed to the no-op sink — proof of mirror-only). */
+    inboundCount() {
+        return this.inbound;
+    }
+    /**
+     * Fan one chat-lane frame to every connected browser. Best-effort: a send
+     * failure to one stale client never blocks the others or the turn. Returns
+     * the number of clients the frame was written to.
+     */
+    mirror(event, conversationId, turnId, payload) {
+        if (!this.wss || this.clients.size === 0)
+            return 0;
+        const frame = {
+            protocol_version: CHAT_LANE_PROTOCOL_VERSION,
+            source: "companion-mirror",
+            mirror_only: true,
+            conversation_id: conversationId,
+            turn_id: turnId,
+            event,
+            payload,
+            ts: new Date(this.now()).toISOString(),
+        };
+        const text = JSON.stringify(frame);
+        let sent = 0;
+        for (const ws of this.clients) {
+            if (ws.readyState !== ws.OPEN)
+                continue;
+            try {
+                ws.send(text);
+                sent += 1;
+            }
+            catch (err) {
+                this.opts.onLog?.(`[acc-runner] mirror send failed: ${err.message}`);
+            }
+        }
+        return sent;
+    }
+    /** Tear the server down: close every client, then the WS + HTTP servers. */
+    async close() {
+        for (const ws of this.clients) {
+            try {
+                ws.close(1001, "runner shutdown");
+            }
+            catch {
+                /* best-effort */
+            }
+        }
+        this.clients.clear();
+        const wss = this.wss;
+        const http = this.http;
+        this.wss = null;
+        this.http = null;
+        if (wss)
+            await new Promise((resolve) => wss.close(() => resolve()));
+        if (http)
+            await new Promise((resolve) => http.close(() => resolve()));
+    }
+    accept(ws) {
+        this.clients.add(ws);
+        // INBOUND is a dead end: count it, hand it to the pure sink, and drop it.
+        // No branch here reaches a transport / RPC / DB write — that is the
+        // mirror-only invariant, enforced by construction (this class holds none).
+        ws.on("message", (data) => {
+            this.inbound += 1;
+            this.opts.onInbound?.(typeof data === "string" ? data : data.toString());
+        });
+        ws.on("close", () => this.clients.delete(ws));
+        ws.on("error", () => this.clients.delete(ws));
+    }
+}
+//# sourceMappingURL=companion-mirror-socket.js.map

package/dist/companion-mirror-socket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"companion-mirror-socket.js","sourceRoot":"","sources":["../src/companion-mirror-socket.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAkB,MAAM,IAAI,CAAC;AACrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAE5D,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAoB,CAAC;AAEvD,mFAAmF;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAgB,CAAC;AAEvD,6FAA6F;AAC7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAa,CAAC;AAuBvD,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC;AA0BD;;;;GAIG;AACH,MAAM,OAAO,qBAAqB;IAQH;IAPrB,IAAI,GAAkB,IAAI,CAAC;IAC3B,GAAG,GAA2B,IAAI,CAAC;IAC1B,OAAO,GAAG,IAAI,GAAG,EAAa,CAAC;IACxC,OAAO,GAAG,CAAC,CAAC;IACZ,SAAS,GAAG,CAAC,CAAC;IACL,GAAG,CAAe;IAEnC,YAA6B,IAAkC;QAAlC,SAAI,GAAJ,IAAI,CAA8B;QAC7D,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,CAAC;IAED,oEAAoE;IACpE,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,GAAG;YAAE,OAAO;QACrB,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,YAAY,CAAC,EAAE,CAAC;QAC5D,8EAA8E;QAC9E,0EAA0E;QAC1E,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpD,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YACvC,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,2DAA2D,CAAC,CAAC;gBAC/E,sEAAsE;gBACtE,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBAClD,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE;gBACnD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,SAAS,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC/E,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,wFAAwF;IACxF,IAAI;QACF,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,wCAAwC;IACxC,WAAW;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,2FAA2F;IAC3F,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,KAAuB,EAAE,cAAsB,EAAE,MAAc,EAAE,OAAgB;QACtF,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QACnD,MAAM,KAAK,GAAgB;YACzB,gBAAgB,EAAE,0BAA0B;YAC5C,MAAM,EAAE,kBAAkB;YAC1B,WAAW,EAAE,IAAI;YACjB,eAAe,EAAE,cAAc;YAC/B,OAAO,EAAE,MAAM;YACf,KAAK;YACL,OAAO;YACP,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;SACvC,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,EAAE,CAAC,UAAU,KAAK,EAAE,CAAC,IAAI;gBAAE,SAAS;YACxC,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACd,IAAI,IAAI,CAAC,CAAC;YACZ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,oCAAqC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,KAAK;QACT,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,GAAG;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC1E,IAAI,IAAI;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC;IAEO,MAAM,CAAC,EAAa;QAC1B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrB,0EAA0E;QAC1E,oEAAoE;QACpE,2EAA2E;QAC3E,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9C,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;CACF"}

package/dist/companion-run.d.ts

@@ -0,0 +1,19 @@
+/** A running companion; `stop()` requeues in-flight turns and flips offline. */
+export interface CompanionHandle {
+    stop(): Promise<void>;
+}
+/** Env var seeding the owner's conversations the companion should serve at boot. */
+export declare const COMPANION_CONVERSATIONS_ENV = "ACC_RUNNER_COMPANION_CONVERSATIONS";
+/**
+ * Start companion mode. Registers the owner-bound identity, serves the owner's
+ * chat turns (chat lane only), and returns a handle whose `stop()` requeues
+ * in-flight turns to the fleet and flips the identity offline.
+ */
+export declare function companionCommand(): Promise<CompanionHandle>;
+/** Print the one-line companion status (menu-bar friendly). */
+export declare function companionStatusCommand(): Promise<void>;
+/** Install the companion login agent (autostart at login). */
+export declare function companionInstallCommand(): Promise<void>;
+/** Remove the companion login agent. */
+export declare function companionUninstallCommand(): Promise<void>;
+//# sourceMappingURL=companion-run.d.ts.map

package/dist/companion-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"companion-run.d.ts","sourceRoot":"","sources":["../src/companion-run.ts"],"names":[],"mappings":"AAgCA,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,oFAAoF;AACpF,eAAO,MAAM,2BAA2B,uCAAuC,CAAC;AAEhF;;;;GAIG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,eAAe,CAAC,CAgFjE;AAED,+DAA+D;AAC/D,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAmB5D;AAED,8DAA8D;AAC9D,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAK7D;AAED,wCAAwC;AACxC,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAK/D"}

package/dist/companion-run.js

@@ -0,0 +1,132 @@
+/**
+ * CC-3C (COMPANION): production wiring for the `acc-runner companion` command.
+ *
+ * Thin glue that builds the live dependencies (session, Supabase client, chat
+ * engine, transport, circuit breaker, mirror socket, identity broadcaster) and
+ * drives `CompanionRunner`. Kept out of cli.ts so cli.ts stays a pure command
+ * table, and out of companion.ts so the orchestrator stays free of I/O and
+ * unit-testable with injected fakes.
+ */
+import chalk from "chalk";
+import { applyBootstrapConfig, loadConfig, resolveRunnerConcurrency } from "./config.js";
+import { getTokenProvider } from "./token-provider.js";
+import { createRunnerClient } from "./supabase.js";
+import { createSupabaseChatTransport } from "./chat-transport.js";
+import { getChatEngine } from "./engines/registry.js";
+import { ChatCircuitBreaker, getChatCircuit } from "./runtime/chat-circuit-breaker.js";
+import { CompanionMirrorSocket } from "./companion-mirror-socket.js";
+import { CompanionRunner, OwnerConversationSource, createIdentityBroadcaster, deriveMirrorToken, resolveCompanionConfig, } from "./companion.js";
+import { companionStatusLine, defaultAutostartHost, installAutostart, uninstallAutostart, } from "./companion-autostart.js";
+import { PACKAGE_VERSION } from "./pkg-version.js";
+/** Env var seeding the owner's conversations the companion should serve at boot. */
+export const COMPANION_CONVERSATIONS_ENV = "ACC_RUNNER_COMPANION_CONVERSATIONS";
+/**
+ * Start companion mode. Registers the owner-bound identity, serves the owner's
+ * chat turns (chat lane only), and returns a handle whose `stop()` requeues
+ * in-flight turns to the fleet and flips the identity offline.
+ */
+export async function companionCommand() {
+    let cfg = loadConfig();
+    const session = await getTokenProvider().load();
+    if (!session) {
+        throw new Error("Not logged in. Run `acc-runner login` first.");
+    }
+    cfg = applyBootstrapConfig(cfg, session);
+    const supabase = createRunnerClient(cfg, session.access_token, session.realtime_config);
+    const breaker = new ChatCircuitBreaker();
+    await breaker.load();
+    const engine = getChatEngine();
+    const transport = createSupabaseChatTransport(supabase);
+    const companionCfg = resolveCompanionConfig();
+    const conc = resolveRunnerConcurrency();
+    const mirror = companionCfg.mirrorEnabled
+        ? new CompanionMirrorSocket({
+            expectedToken: companionCfg.mirrorToken ?? deriveMirrorToken(session),
+            port: companionCfg.mirrorPort,
+            onLog: (line) => console.log(chalk.gray(line)),
+        })
+        : null;
+    // Owner-affinity: only conversations owned by this user are servable. Seeded
+    // from the env allowlist (owner == this session's user); the control plane
+    // adds/removes more over the authenticated identity topic.
+    const seedIds = (process.env[COMPANION_CONVERSATIONS_ENV] ?? "")
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean)
+        .map((conversationId) => ({ conversationId, ownerUserId: session.user_id }));
+    const conversations = new OwnerConversationSource(session.user_id, seedIds);
+    const broadcaster = createIdentityBroadcaster(supabase, session.user_id, {
+        onLog: (line) => console.log(chalk.gray(line)),
+    });
+    const runner = new CompanionRunner({
+        runnerId: session.runner_id,
+        boundUserId: session.user_id,
+        engine,
+        transport,
+        breaker,
+        conversations,
+        concurrencyLimit: conc.concurrency,
+        // A dedicated companion has no code lane, so the whole runner is chat's
+        // (the budget still reserves ≥1 slot internally).
+        maxShare: 1,
+        leaseMs: 60_000,
+        mirror,
+        announce: (event, payload) => broadcaster.announce(event, payload),
+        heartbeat: async () => {
+            const { error } = await supabase.rpc("heartbeat_runner", {
+                p_id: session.runner_id,
+                p_version: PACKAGE_VERSION,
+            });
+            if (error)
+                throw new Error(error.message);
+        },
+        cwd: cfg.repoPath,
+        onLog: (line) => console.log(chalk.gray(line)),
+    });
+    await runner.start();
+    console.log(chalk.green(`✓ Companion online for ${session.email ?? session.user_id}`));
+    console.log(chalk.gray(`  serving ${conversations.size()} conversation(s)` +
+        (mirror ? `; mirror on 127.0.0.1:${mirror.port()}` : "; mirror disabled")));
+    return {
+        async stop() {
+            await runner.stop();
+            await broadcaster.close();
+        },
+    };
+}
+/** Print the one-line companion status (menu-bar friendly). */
+export async function companionStatusCommand() {
+    const session = await getTokenProvider().load();
+    const circuit = await getChatCircuit();
+    const cfg = resolveCompanionConfig();
+    // A `status` invocation is a separate process from the running companion, so
+    // it reports what it can see locally: login state, the chat-circuit sentinel,
+    // and the mirror config. Live turn/conversation counts belong to the running
+    // process and are shown as 0 here.
+    console.log(companionStatusLine({
+        online: session !== null,
+        ownerEmail: session?.email ?? null,
+        conversations: 0,
+        activeTurns: 0,
+        capacity: null,
+        circuitOpen: circuit !== null,
+        mirror: cfg.mirrorEnabled,
+    }));
+}
+/** Install the companion login agent (autostart at login). */
+export async function companionInstallCommand() {
+    const binPath = process.argv[1] ?? "acc-runner";
+    const res = await installAutostart(defaultAutostartHost(binPath));
+    console.log(res.ok ? chalk.green(`✓ ${res.detail}`) : chalk.red(`✗ ${res.detail}`));
+    if (!res.ok)
+        process.exitCode = 1;
+}
+/** Remove the companion login agent. */
+export async function companionUninstallCommand() {
+    const binPath = process.argv[1] ?? "acc-runner";
+    const res = await uninstallAutostart(defaultAutostartHost(binPath));
+    console.log(res.ok ? chalk.green(`✓ ${res.detail}`) : chalk.red(`✗ ${res.detail}`));
+    if (!res.ok)
+        process.exitCode = 1;
+}
+//# sourceMappingURL=companion-run.js.map

package/dist/companion-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"companion-run.js","sourceRoot":"","sources":["../src/companion-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EACzB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAOnD,oFAAoF;AACpF,MAAM,CAAC,MAAM,2BAA2B,GAAG,oCAAoC,CAAC;AAEhF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,GAAG,GAAG,UAAU,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,MAAM,gBAAgB,EAAE,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACzC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAExD,MAAM,YAAY,GAAG,sBAAsB,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IAExC,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa;QACvC,CAAC,CAAC,IAAI,qBAAqB,CAAC;YACxB,aAAa,EAAE,YAAY,CAAC,WAAW,IAAI,iBAAiB,CAAC,OAAO,CAAC;YACrE,IAAI,EAAE,YAAY,CAAC,UAAU;YAC7B,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC/C,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IAET,6EAA6E;IAC7E,2EAA2E;IAC3E,2DAA2D;IAC3D,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC;SAC7D,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,IAAI,uBAAuB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE5E,MAAM,WAAW,GAAG,yBAAyB,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE;QACvE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KAC/C,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,QAAQ,EAAE,OAAO,CAAC,SAAS;QAC3B,WAAW,EAAE,OAAO,CAAC,OAAO;QAC5B,MAAM;QACN,SAAS;QACT,OAAO;QACP,aAAa;QACb,gBAAgB,EAAE,IAAI,CAAC,WAAW;QAClC,wEAAwE;QACxE,kDAAkD;QAClD,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,MAAM;QACf,MAAM;QACN,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAClE,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE;gBACvD,IAAI,EAAE,OAAO,CAAC,SAAS;gBACvB,SAAS,EAAE,eAAe;aAC3B,CAAC,CAAC;YACH,IAAI,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QACD,GAAG,EAAE,GAAG,CAAC,QAAQ;QACjB,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KAC/C,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAErB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,0BAA0B,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,aAAa,aAAa,CAAC,IAAI,EAAE,kBAAkB;QACjD,CAAC,MAAM,CAAC,CAAC,CAAC,yBAAyB,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAC5E,CACF,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,OAAO,GAAG,MAAM,gBAAgB,EAAE,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,sBAAsB,EAAE,CAAC;IACrC,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,mCAAmC;IACnC,OAAO,CAAC,GAAG,CACT,mBAAmB,CAAC;QAClB,MAAM,EAAE,OAAO,KAAK,IAAI;QACxB,UAAU,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI;QAClC,aAAa,EAAE,CAAC;QAChB,WAAW,EAAE,CAAC;QACd,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,OAAO,KAAK,IAAI;QAC7B,MAAM,EAAE,GAAG,CAAC,aAAa;KAC1B,CAAC,CACH,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,wCAAwC;AACxC,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACpC,CAAC"}

package/dist/companion.d.ts

@@ -0,0 +1,181 @@
+import { resolveChatLaneConfig, type ChatLaneTransport, type ClaimedChatTurn } from "./chat-lane.js";
+import type { CompanionMirrorSocket } from "./companion-mirror-socket.js";
+import type { ChatCircuitBreaker } from "./runtime/chat-circuit-breaker.js";
+import type { ConformantAgentEngine, EngineCapabilityMatrix, RunnerCapacityClass } from "./engines/types.js";
+import type { StoredSession } from "./types.js";
+/** Identity-topic events (mirror of the web-app `IdentityTopicEvent`). */
+export type IdentityTopicEvent = "capacity_changed" | "companion_registered" | "companion_lost";
+/** runner → server: register/refresh a companion bound to its owner. */
+export interface CompanionRegisterPayload {
+    mode: "companion";
+    bound_user_id: string;
+    /** Engines this companion can drive, richest tier first. */
+    engine_ids: string[];
+    capability_matrix: EngineCapabilityMatrix;
+    capacity: RunnerCapacityClass;
+}
+/** Payload of an `identity:<user_id>` capacity broadcast. */
+export interface IdentityCapacityEvent {
+    runner_id: string;
+    capacity: RunnerCapacityClass;
+    /** Engines still claimable on this runner at report time. */
+    available_engine_ids: string[];
+    ts: string;
+}
+/** Build the per-identity capacity Realtime topic (mirror of the web builder). */
+export declare function identityTopic(userId: string): `identity:${string}`;
+/** Opt the runner's chat lane into serving code tasks too (default: chat only). */
+export declare const COMPANION_CODE_TASKS_ENV = "ACC_RUNNER_COMPANION_CODE_TASKS";
+/** Disable the localhost mirror socket (default: enabled). */
+export declare const COMPANION_MIRROR_ENV = "ACC_RUNNER_COMPANION_MIRROR";
+/** Loopback port the mirror socket binds to. */
+export declare const COMPANION_MIRROR_PORT_ENV = "ACC_RUNNER_COMPANION_MIRROR_PORT";
+/** Explicit mirror handshake token override (else derived from the session). */
+export declare const COMPANION_MIRROR_TOKEN_ENV = "ACC_RUNNER_COMPANION_MIRROR_TOKEN";
+/** Default loopback port for the mirror socket. */
+export declare const DEFAULT_COMPANION_MIRROR_PORT = 7717;
+/** The resolved companion knobs. */
+export interface CompanionConfig {
+    /** Whether the companion also claims code/review tasks (default false). */
+    codeTasksEnabled: boolean;
+    /** Whether the localhost mirror socket is served (default true). */
+    mirrorEnabled: boolean;
+    /** Loopback port the mirror socket binds to. */
+    mirrorPort: number;
+    /** Explicit mirror handshake token, or null to derive from the session. */
+    mirrorToken: string | null;
+}
+/** Resolve companion knobs from the environment in one place. */
+export declare function resolveCompanionConfig(env?: NodeJS.ProcessEnv): CompanionConfig;
+/**
+ * Derive the loopback mirror handshake token from the session. Bound to the
+ * refresh token (stable across hourly access-token refreshes, rotated on
+ * re-login / logout) + the runner id, one-way hashed so the token never leaks
+ * either. The same-machine browser obtains the matching token through the
+ * authenticated control plane; this keeps the mirror strictly session-bound —
+ * it cannot outlive the session it reflects.
+ */
+export declare function deriveMirrorToken(session: Pick<StoredSession, "refresh_token" | "runner_id">): string;
+/**
+ * The set of conversations a companion is allowed to serve — the OWNER-AFFINITY
+ * guarantee. A conversation enters the set only when its owner is the bound
+ * user; `add` returns false and no-ops for any other owner, so the companion's
+ * claim loop can never present a foreign operator's conversation to the claim
+ * RPC. Fed by the control plane (the browser announces which conversation the
+ * operator is active in over the authenticated `identity:<user>` topic); an
+ * optional seed lists conversations known at boot.
+ */
+export declare class OwnerConversationSource {
+    private readonly boundUserId;
+    private readonly ids;
+    constructor(boundUserId: string, seed?: Array<{
+        conversationId: string;
+        ownerUserId: string;
+    }>);
+    /**
+     * Register a conversation IF and only if its owner is the bound user. Returns
+     * true when it was added (owner match), false when rejected (foreign owner or
+     * blank id). This is the single enforcement point for owner-affinity.
+     */
+    add(conversationId: string, ownerUserId: string): boolean;
+    /** Drop a conversation (operator closed it / it moved to another owner). */
+    remove(conversationId: string): void;
+    /** True when the conversation is currently served by this companion. */
+    has(conversationId: string): boolean;
+    /** Stable snapshot of the served conversations (for the claim loop). */
+    snapshot(): string[];
+    /** Count of served conversations. */
+    size(): number;
+}
+/**
+ * Wrap a `ChatLaneTransport` so every OUTBOUND lifecycle message (stream /
+ * complete / requeue) is ALSO pushed to the loopback mirror socket after the
+ * authoritative transport call succeeds. This is a strict tee: the wrapper only
+ * reads the payloads the driver already sends to the DB path — it introduces no
+ * new mutation and no inbound path. With no mirror socket it is the identity
+ * wrapper. `claim` / `markStreaming` pass straight through (nothing to mirror).
+ */
+export declare function mirrorTee(transport: ChatLaneTransport, mirror: CompanionMirrorSocket | null | undefined): ChatLaneTransport;
+export interface CompanionRunnerDeps {
+    /** This runner's id. */
+    runnerId: string;
+    /** The owner this companion is bound to (acc.users id). */
+    boundUserId: string;
+    /** The chat-conformant engine driving replies. */
+    engine: ConformantAgentEngine;
+    /** The chat-lane wire seam (claim/stream/complete/requeue). */
+    transport: ChatLaneTransport;
+    /** The chat-capability circuit breaker. */
+    breaker: ChatCircuitBreaker;
+    /** Owner-affinity conversation source (the served-conversation set). */
+    conversations: OwnerConversationSource;
+    /** Runner concurrency ceiling shared with the max-share budget. */
+    concurrencyLimit: number;
+    /** Chat-lane max share of that ceiling (0..1). */
+    maxShare: number;
+    /** Requested per-turn lease (ms). */
+    leaseMs: number;
+    /** The loopback mirror socket, or null when disabled. */
+    mirror?: CompanionMirrorSocket | null;
+    /** Broadcast an identity-topic event (companion_registered / capacity_changed / companion_lost). */
+    announce: (event: IdentityTopicEvent, payload: unknown) => Promise<void>;
+    /** Keep the runner identity online (typically acc.heartbeat_runner). */
+    heartbeat: () => Promise<void>;
+    /** Working directory forwarded to the engine per turn. */
+    cwd?: string;
+    /** Mint a per-turn delegation token (narrowly-scoped identity) — optional. */
+    mintDelegation?: (turn: ClaimedChatTurn) => Promise<string | undefined>;
+    /** Pump cadence (ms) between claim attempts. */
+    pumpMs?: number;
+    /** Heartbeat cadence (ms). */
+    heartbeatMs?: number;
+    /** Clock (test seam). */
+    now?: () => number;
+    /** Best-effort log sink. */
+    onLog?: (line: string) => void;
+}
+/**
+ * Drive companion mode: register the owner-bound identity, serve the owner's
+ * chat turns through a `ChatCompanion` (chat lane only — `activeCodeTasks` is
+ * always 0), tee the stream to the loopback mirror, heartbeat the identity
+ * online, and on stop requeue in-flight turns + flip the identity offline so an
+ * Auto turn fails over to the fleet.
+ */
+export declare class CompanionRunner {
+    private readonly deps;
+    private companion;
+    private heartbeatTimer;
+    private lastCapacity;
+    private stopped;
+    private readonly now;
+    constructor(deps: CompanionRunnerDeps);
+    /** Chat turns currently in flight on this companion. */
+    activeChatTurns(): number;
+    /** Register the owner-bound identity, start the pump + mirror + heartbeat. */
+    start(): Promise<void>;
+    /**
+     * Stop the companion: requeue in-flight turns (clean fail-over — the driver
+     * emits exactly one requeue, no duplicate completion), flip the identity
+     * offline so Auto routes to the fleet, and tear the mirror down.
+     */
+    stop(): Promise<void>;
+    /** One heartbeat: keep the identity online + announce a capacity change. */
+    private beat;
+}
+/**
+ * Build the identity-topic broadcaster for a companion. Broadcasts on
+ * `identity:<userId>` via the runner's Supabase realtime client. Kept separate
+ * from the orchestrator so tests inject a recording fake instead.
+ */
+export declare function createIdentityBroadcaster(client: {
+    channel: (topic: string) => any;
+    removeChannel: (ch: any) => Promise<unknown>;
+}, userId: string, opts?: {
+    onLog?: (line: string) => void;
+}): {
+    announce: (event: IdentityTopicEvent, payload: unknown) => Promise<void>;
+    close: () => Promise<void>;
+};
+/** Re-export for callers that resolve chat-lane knobs alongside companion knobs. */
+export { resolveChatLaneConfig };
+//# sourceMappingURL=companion.d.ts.map

package/dist/companion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"companion.d.ts","sourceRoot":"","sources":["../src/companion.ts"],"names":[],"mappings":"AAsCA,OAAO,EACL,qBAAqB,EACrB,KAAK,iBAAiB,EAItB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAShD,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,GAAG,sBAAsB,GAAG,gBAAgB,CAAC;AAEhG,wEAAwE;AACxE,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,WAAW,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,6DAA6D;AAC7D,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,6DAA6D;IAC7D,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,MAAM,EAAE,CAElE;AAMD,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,oCAAoC,CAAC;AAC1E,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAClE,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,qCAAqC,CAAC;AAC5E,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,sCAAsC,CAAC;AAC9E,mDAAmD;AACnD,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAYlD,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oEAAoE;IACpE,aAAa,EAAE,OAAO,CAAC;IACvB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,iEAAiE;AACjE,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,eAAe,CAY5F;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,eAAe,GAAG,WAAW,CAAC,GAAG,MAAM,CAKrG;AAMD;;;;;;;;GAQG;AACH,qBAAa,uBAAuB;IAIhC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAH9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;gBAGtB,WAAW,EAAE,MAAM,EACpC,IAAI,GAAE,KAAK,CAAC;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAM;IAKnE;;;;OAIG;IACH,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO;IAQzD,4EAA4E;IAC5E,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;IAIpC,wEAAwE;IACxE,GAAG,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO;IAIpC,wEAAwE;IACxE,QAAQ,IAAI,MAAM,EAAE;IAIpB,qCAAqC;IACrC,IAAI,IAAI,MAAM;CAGf;AAMD;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,iBAAiB,EAC5B,MAAM,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,GAC/C,iBAAiB,CAoBnB;AAMD,MAAM,WAAW,mBAAmB;IAClC,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,MAAM,EAAE,qBAAqB,CAAC;IAC9B,+DAA+D;IAC/D,SAAS,EAAE,iBAAiB,CAAC;IAC7B,2CAA2C;IAC3C,OAAO,EAAE,kBAAkB,CAAC;IAC5B,wEAAwE;IACxE,aAAa,EAAE,uBAAuB,CAAC;IACvC,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,MAAM,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACtC,oGAAoG;IACpG,QAAQ,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,wEAAwE;IACxE,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACxE,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yBAAyB;IACzB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,4BAA4B;IAC5B,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED;;;;;;GAMG;AACH,qBAAa,eAAe;IAOd,OAAO,CAAC,QAAQ,CAAC,IAAI;IANjC,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,cAAc,CAA+C;IACrE,OAAO,CAAC,YAAY,CAAoC;IACxD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEN,IAAI,EAAE,mBAAmB;IAItD,wDAAwD;IACxD,eAAe,IAAI,MAAM;IAIzB,8EAA8E;IACxE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAkD5B;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB3B,4EAA4E;YAC9D,IAAI;CAkBnB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAEvC,MAAM,EAAE;IAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC;IAAC,aAAa,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,EACzF,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GAC5C;IAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAmC1G;AAED,oFAAoF;AACpF,OAAO,EAAE,qBAAqB,EAAE,CAAC"}