@tokenfactory/acc-runner 0.42.0 → 0.44.0

package/dist/serve-scope/command.js

@@ -0,0 +1,89 @@
+/**
+ * AX-H2 (SERVE-SCOPE-CONSENT): the `acc-runner serve-scope` command.
+ *
+ * The plumbing around ./index.ts's pure decision tree — load the session, read
+ * THIS machine's row, plan, print, and (only then) send. Deliberately thin: every
+ * rule worth testing lives in planServeScopeChange, and this file is the part
+ * that needs a keychain and a network.
+ *
+ * The read is a plain PostgREST select on acc.runners rather than a new RPC. The
+ * columns are readable through the existing `runners_select` policy, so adding a
+ * reader would have meant a new browser-reachable STABLE SECURITY DEFINER
+ * function and a fight with migration 0299 §4.1 for no gain.
+ */
+import chalk from "chalk";
+import { loadConfig } from "../config.js";
+import { createRunnerClient } from "../supabase.js";
+import { getTokenProvider } from "../token-provider.js";
+import { expiresSoon, refreshAccessToken } from "../runtime/auth-lifecycle.js";
+import { describeServeScope, isMigrationPending, planServeScopeChange, serveScopeOf, submitServeScope, } from "./index.js";
+const SELECT_COLUMNS = "id, machine, bound_user_id, serve_scope, serve_scope_source, serve_scope_consent_at";
+export async function serveScopeCommand(opts = {}) {
+    const out = opts.out ?? ((line) => console.log(line));
+    const cfg = loadConfig();
+    const tokenProvider = getTokenProvider();
+    let session = await tokenProvider.load();
+    if (!session) {
+        throw new Error("not signed in — run `acc-runner login` first");
+    }
+    if (tokenProvider.canRefresh() && expiresSoon(session)) {
+        session = await refreshAccessToken(cfg, session);
+        await tokenProvider.save(session);
+    }
+    const sb = createRunnerClient(cfg, session.access_token, session.realtime_config);
+    const { data, error } = await sb
+        .from("runners")
+        .select(SELECT_COLUMNS)
+        .eq("id", session.runner_id)
+        .maybeSingle();
+    if (error) {
+        // HALT-before-apply means every environment has a window where this command
+        // is merged and the columns are not there yet. Say which it is: "run psql"
+        // and "something is broken" have different remedies.
+        if (isMigrationPending(error)) {
+            throw new Error("serve-scope is unavailable — migration 0314 has not been applied to this environment yet. " +
+                "Until it is, this machine keeps serving exactly what it serves today.");
+        }
+        throw new Error(`could not read this machine's serve scope: ${error.message}`);
+    }
+    if (!data) {
+        throw new Error(`runner ${session.runner_id} is not visible to this session — re-run \`acc-runner login\``);
+    }
+    const row = data;
+    const current = serveScopeOf(row.serve_scope);
+    const viewerIsOwner = typeof row.bound_user_id === "string" && row.bound_user_id === session.user_id;
+    out(describeServeScope(row));
+    const plan = planServeScopeChange({
+        requested: opts.scope ?? null,
+        current,
+        confirmed: opts.yes === true,
+        viewerIsOwner,
+    });
+    switch (plan.action) {
+        case "show":
+            if (current === "owner" && viewerIsOwner) {
+                out(chalk.dim("  Consent to serve the whole org with `acc-runner serve-scope org --yes`."));
+            }
+            return;
+        case "refuse":
+            // A refusal is the product working, so it exits non-zero via the caller's
+            // guard but reads as an explanation rather than a stack trace.
+            throw new Error(plan.reason);
+        default: {
+            const result = await submitServeScope(sb, {
+                runnerId: session.runner_id,
+                scope: plan.scope,
+                reason: opts.reason ?? null,
+                source: "cli",
+            });
+            const verb = result.decision === "granted"
+                ? "consented — this machine now serves the whole org"
+                : result.decision === "revoked"
+                    ? "revoked — this machine now serves its owner only"
+                    : `unchanged (${result.serve_scope})`;
+            out(chalk.green(`✓ ${verb}. Recorded in the consent ledger.`));
+            return;
+        }
+    }
+}
+//# sourceMappingURL=command.js.map

package/dist/serve-scope/command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../../src/serve-scope/command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAEL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAapB,MAAM,cAAc,GAClB,qFAAqF,CAAC;AAExF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAiC,EAAE;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAE9D,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IACzC,IAAI,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,aAAa,CAAC,UAAU,EAAE,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,EAAE,GAAG,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAClF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE;SAC7B,IAAI,CAAC,SAAS,CAAC;SACf,MAAM,CAAC,cAAc,CAAC;SACtB,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;SAC3B,WAAW,EAAE,CAAC;IACjB,IAAI,KAAK,EAAE,CAAC;QACV,4EAA4E;QAC5E,2EAA2E;QAC3E,qDAAqD;QACrD,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,4FAA4F;gBAC1F,uEAAuE,CAC1E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,UAAU,OAAO,CAAC,SAAS,+DAA+D,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAsC,CAAC;IACnD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,aAAa,GACjB,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC;IAEjF,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7B,MAAM,IAAI,GAAG,oBAAoB,CAAC;QAChC,SAAS,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QAC7B,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI;QAC5B,aAAa;KACd,CAAC,CAAC;IAEH,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,MAAM;YACT,IAAI,OAAO,KAAK,OAAO,IAAI,aAAa,EAAE,CAAC;gBACzC,GAAG,CACD,KAAK,CAAC,GAAG,CACP,2EAA2E,CAC5E,CACF,CAAC;YACJ,CAAC;YACD,OAAO;QAET,KAAK,QAAQ;YACX,0EAA0E;YAC1E,+DAA+D;YAC/D,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE;gBACxC,QAAQ,EAAE,OAAO,CAAC,SAAS;gBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;gBAC3B,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YACH,MAAM,IAAI,GACR,MAAM,CAAC,QAAQ,KAAK,SAAS;gBAC3B,CAAC,CAAC,mDAAmD;gBACrD,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;oBAC7B,CAAC,CAAC,kDAAkD;oBACpD,CAAC,CAAC,cAAc,MAAM,CAAC,WAAW,GAAG,CAAC;YAC5C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,mCAAmC,CAAC,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/serve-scope/index.d.ts

@@ -0,0 +1,130 @@
+/**
+ * AX-H2 (SERVE-SCOPE-CONSENT): the machine's own half of the consent.
+ * AUTH_APPROVAL_BRIEF.md §7.2, Phase H, gap G-18.
+ *
+ * `acc-runner serve-scope` is where the person sitting at the machine decides
+ * whether it serves only their work or the whole org's. That placement is the
+ * point, not a convenience: the thing being consented to — this laptop's gh
+ * credential, git identity and Claude subscription — is in front of them, and
+ * migration 0314 §5 will only accept the answer from the machine's bound owner
+ * anyway. A web form an admin could fill in on their behalf would be a checkbox,
+ * not a consent.
+ *
+ * THREE RULES THIS MODULE ENFORCES ON ITS CALLERS
+ * ----------------------------------------------------------------------------
+ *  1. WIDENING IS NEVER SILENT. {@link planServeScopeChange} refuses to widen to
+ *     `org` unless the caller passed an explicit confirmation. `--yes` is
+ *     accepted for scripted enrolment, but the DEFAULT of a bare
+ *     `acc-runner serve-scope org` is a refusal with the consequences printed,
+ *     not a shrug-and-apply.
+ *  2. NARROWING IS ALWAYS ALLOWED. Revoking needs no confirmation and no flag.
+ *     Withdrawal must never be harder than the grant — that asymmetry is
+ *     deliberate and it matches 0314 §5's server-side rule.
+ *  3. THE SERVER IS THE GATE. Everything here is a convenience over
+ *     `acc.set_runner_serve_scope`, which re-checks ownership in the database.
+ *     A refusal printed by this file is courtesy; a refusal from the RPC is
+ *     security.
+ *
+ * The command is fully injectable (transport / stdout / confirm) so the whole
+ * decision tree is asserted with no network, no keychain and no database.
+ */
+/** The vocabulary, mirroring `acc.runner_serve_scopes()` (0314 §2). */
+export declare const SERVE_SCOPES: readonly ["owner", "org"];
+export type ServeScope = (typeof SERVE_SCOPES)[number];
+/** What a machine is until somebody decides otherwise. */
+export declare const DEFAULT_SERVE_SCOPE: ServeScope;
+/** The RPC surface this module needs — a supabase-js client satisfies it. */
+export interface ServeScopeTransport {
+    rpc(fn: string, args: Record<string, unknown>): PromiseLike<{
+        data?: unknown;
+        error?: {
+            message: string;
+        } | null;
+    }>;
+}
+/**
+ * True when a PostgREST error means "migration 0314 is not applied here yet"
+ * rather than a genuine fault. The HALT-before-apply rule guarantees this window
+ * exists on every environment between merge and promotion, and the two cases
+ * have different remedies — "a human runs psql" versus "something is broken".
+ * PostgREST reports an unknown column as 42703 and an unknown relation as 42P01;
+ * the message check is the belt for clients that do not surface the code.
+ */
+export declare function isMigrationPending(error: unknown): boolean;
+/** The row shape `acc.runners` hands back for this machine. */
+export interface ServeScopeRunnerRow {
+    id: string;
+    machine?: string | null;
+    bound_user_id?: string | null;
+    serve_scope?: unknown;
+    serve_scope_source?: unknown;
+    serve_scope_consent_at?: string | null;
+}
+/** Narrow an unknown to a ServeScope, or null when it is not one. */
+export declare function parseServeScope(value: unknown): ServeScope | null;
+/**
+ * The scope to treat a row as having. Anything unreadable folds to `owner`, NOT
+ * to `org`: an unreadable consent is an ungiven consent. The fold direction is
+ * the safety property — a CLI talking to a server that predates migration 0314
+ * (no column, `undefined`) must report owner-only rather than invent agreement.
+ */
+export declare function serveScopeOf(value: unknown): ServeScope;
+/** What one `serve-scope` invocation should do, before anything is sent. */
+export type ServeScopePlan = 
+/** Print the current posture; no write. */
+{
+    action: "show";
+}
+/** Widening was asked for without confirmation — refuse and explain. */
+ | {
+    action: "refuse";
+    reason: string;
+}
+/** Already there. Still sent, so the re-affirmation is recorded (0314 §5). */
+ | {
+    action: "reaffirm";
+    scope: ServeScope;
+} | {
+    action: "grant";
+    scope: "org";
+} | {
+    action: "revoke";
+    scope: "owner";
+};
+export interface ServeScopeChangeInput {
+    /** The scope the operator asked for. Absent ⇒ show. */
+    requested?: string | null;
+    /** The machine's current scope, as the server reports it. */
+    current: ServeScope;
+    /** The operator passed --yes (or answered an interactive prompt). */
+    confirmed?: boolean;
+    /** True when the signed-in session owns this machine. */
+    viewerIsOwner: boolean;
+}
+/**
+ * The whole decision tree, as a pure function. Ordered most-refusing first, so a
+ * case that falls through has been considered rather than defaulted into.
+ */
+export declare function planServeScopeChange(input: ServeScopeChangeInput): ServeScopePlan;
+/** What the RPC hands back (0314 §5's RETURNS TABLE). */
+export interface ServeScopeResult {
+    runner_id: string;
+    serve_scope: ServeScope;
+    previous_scope: ServeScope | null;
+    decision: string;
+    consent_at: string | null;
+}
+/**
+ * Send one decision. Thin by design: the argument names are the RPC's, so a
+ * signature change is a compile-time break here rather than a runtime error on
+ * somebody's laptop.
+ */
+export declare function submitServeScope(transport: ServeScopeTransport, args: {
+    runnerId: string;
+    scope: ServeScope;
+    reason?: string | null;
+    source?: string;
+}): Promise<ServeScopeResult>;
+/** The one-line posture a person reads at the terminal. */
+export declare function describeServeScope(row: ServeScopeRunnerRow): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/serve-scope/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/serve-scope/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,uEAAuE;AACvE,eAAO,MAAM,YAAY,2BAA4B,CAAC;AACtD,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,EAAE,UAAoB,CAAC;AAEvD,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,GAAG,CACD,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,WAAW,CAAC;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CACxE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAW1D;AAED,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,qEAAqE;AACrE,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAOjE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAEvD;AAED,4EAA4E;AAC5E,MAAM,MAAM,cAAc;AACxB,2CAA2C;AACzC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE;AACpB,wEAAwE;GACtE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACtC,8EAA8E;GAC5E;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACjC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzC,MAAM,WAAW,qBAAqB;IACpC,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,6DAA6D;IAC7D,OAAO,EAAE,UAAU,CAAC;IACpB,qEAAqE;IACrE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,yDAAyD;IACzD,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,GAAG,cAAc,CAkCjF;AAED,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,UAAU,CAAC;IACxB,cAAc,EAAE,UAAU,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,mBAAmB,EAC9B,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACrF,OAAO,CAAC,gBAAgB,CAAC,CAkB3B;AAED,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAUnE"}

package/dist/serve-scope/index.js

@@ -0,0 +1,148 @@
+/**
+ * AX-H2 (SERVE-SCOPE-CONSENT): the machine's own half of the consent.
+ * AUTH_APPROVAL_BRIEF.md §7.2, Phase H, gap G-18.
+ *
+ * `acc-runner serve-scope` is where the person sitting at the machine decides
+ * whether it serves only their work or the whole org's. That placement is the
+ * point, not a convenience: the thing being consented to — this laptop's gh
+ * credential, git identity and Claude subscription — is in front of them, and
+ * migration 0314 §5 will only accept the answer from the machine's bound owner
+ * anyway. A web form an admin could fill in on their behalf would be a checkbox,
+ * not a consent.
+ *
+ * THREE RULES THIS MODULE ENFORCES ON ITS CALLERS
+ * ----------------------------------------------------------------------------
+ *  1. WIDENING IS NEVER SILENT. {@link planServeScopeChange} refuses to widen to
+ *     `org` unless the caller passed an explicit confirmation. `--yes` is
+ *     accepted for scripted enrolment, but the DEFAULT of a bare
+ *     `acc-runner serve-scope org` is a refusal with the consequences printed,
+ *     not a shrug-and-apply.
+ *  2. NARROWING IS ALWAYS ALLOWED. Revoking needs no confirmation and no flag.
+ *     Withdrawal must never be harder than the grant — that asymmetry is
+ *     deliberate and it matches 0314 §5's server-side rule.
+ *  3. THE SERVER IS THE GATE. Everything here is a convenience over
+ *     `acc.set_runner_serve_scope`, which re-checks ownership in the database.
+ *     A refusal printed by this file is courtesy; a refusal from the RPC is
+ *     security.
+ *
+ * The command is fully injectable (transport / stdout / confirm) so the whole
+ * decision tree is asserted with no network, no keychain and no database.
+ */
+/** The vocabulary, mirroring `acc.runner_serve_scopes()` (0314 §2). */
+export const SERVE_SCOPES = ["owner", "org"];
+/** What a machine is until somebody decides otherwise. */
+export const DEFAULT_SERVE_SCOPE = "owner";
+/**
+ * True when a PostgREST error means "migration 0314 is not applied here yet"
+ * rather than a genuine fault. The HALT-before-apply rule guarantees this window
+ * exists on every environment between merge and promotion, and the two cases
+ * have different remedies — "a human runs psql" versus "something is broken".
+ * PostgREST reports an unknown column as 42703 and an unknown relation as 42P01;
+ * the message check is the belt for clients that do not surface the code.
+ */
+export function isMigrationPending(error) {
+    if (!error || typeof error !== "object")
+        return false;
+    const e = error;
+    if (e.code === "42703" || e.code === "42P01" || e.code === "PGRST204")
+        return true;
+    const msg = typeof e.message === "string" ? e.message.toLowerCase() : "";
+    return (msg.includes("serve_scope") &&
+        (msg.includes("does not exist") ||
+            msg.includes("could not find") ||
+            msg.includes("schema cache")));
+}
+/** Narrow an unknown to a ServeScope, or null when it is not one. */
+export function parseServeScope(value) {
+    if (typeof value !== "string")
+        return null;
+    const v = value.trim().toLowerCase();
+    // The two spellings a person actually types at a terminal.
+    if (v === "owner-only" || v === "owner_only" || v === "me")
+        return "owner";
+    if (v === "org-wide" || v === "org_wide" || v === "team")
+        return "org";
+    return SERVE_SCOPES.includes(v) ? v : null;
+}
+/**
+ * The scope to treat a row as having. Anything unreadable folds to `owner`, NOT
+ * to `org`: an unreadable consent is an ungiven consent. The fold direction is
+ * the safety property — a CLI talking to a server that predates migration 0314
+ * (no column, `undefined`) must report owner-only rather than invent agreement.
+ */
+export function serveScopeOf(value) {
+    return parseServeScope(value) ?? DEFAULT_SERVE_SCOPE;
+}
+/**
+ * The whole decision tree, as a pure function. Ordered most-refusing first, so a
+ * case that falls through has been considered rather than defaulted into.
+ */
+export function planServeScopeChange(input) {
+    const requested = input.requested == null ? null : parseServeScope(input.requested);
+    if (input.requested != null && requested == null) {
+        return {
+            action: "refuse",
+            reason: `unknown serve scope "${input.requested}" — expected "owner" or "org"`,
+        };
+    }
+    if (requested == null)
+        return { action: "show" };
+    if (requested === "org") {
+        if (!input.viewerIsOwner) {
+            return {
+                action: "refuse",
+                reason: "only this machine's owner can consent to serving the whole org — sign in as the owner on this machine (`acc-runner login`)",
+            };
+        }
+        if (!input.confirmed) {
+            return {
+                action: "refuse",
+                reason: "org-wide serving lends this machine's gh credential, git identity and Claude subscription to everyone in the org. " +
+                    "Re-run with --yes to consent, or leave it owner-only.",
+            };
+        }
+        return input.current === "org" ? { action: "reaffirm", scope: "org" } : { action: "grant", scope: "org" };
+    }
+    // Narrowing. No confirmation, no flag, no owner check beyond what the server
+    // does — withdrawal must never be harder than the grant.
+    return input.current === "owner"
+        ? { action: "reaffirm", scope: "owner" }
+        : { action: "revoke", scope: "owner" };
+}
+/**
+ * Send one decision. Thin by design: the argument names are the RPC's, so a
+ * signature change is a compile-time break here rather than a runtime error on
+ * somebody's laptop.
+ */
+export async function submitServeScope(transport, args) {
+    const { data, error } = await transport.rpc("set_runner_serve_scope", {
+        p_runner_id: args.runnerId,
+        p_scope: args.scope,
+        p_reason: args.reason ?? null,
+        p_source: args.source ?? "cli",
+    });
+    if (error) {
+        throw new Error(`serve-scope update refused: ${error.message}`);
+    }
+    const row = Array.isArray(data) ? data[0] : undefined;
+    return {
+        runner_id: typeof row?.runner_id === "string" ? row.runner_id : args.runnerId,
+        serve_scope: serveScopeOf(row?.serve_scope),
+        previous_scope: parseServeScope(row?.previous_scope),
+        decision: typeof row?.decision === "string" ? row.decision : "unknown",
+        consent_at: typeof row?.consent_at === "string" ? row.consent_at : null,
+    };
+}
+/** The one-line posture a person reads at the terminal. */
+export function describeServeScope(row) {
+    const scope = serveScopeOf(row.serve_scope);
+    const machine = row.machine ?? row.id;
+    if (scope === "org") {
+        const consented = row.serve_scope_source === "owner_consent";
+        return consented
+            ? `${machine}: serving the WHOLE ORG — consented${row.serve_scope_consent_at ? ` ${row.serve_scope_consent_at.slice(0, 10)}` : ""}.`
+            : `${machine}: serving the WHOLE ORG — carried over from before consent was recorded, never explicitly agreed.`;
+    }
+    return `${machine}: serving its OWNER ONLY. Other people's tasks are not dispatched here.`;
+}
+//# sourceMappingURL=index.js.map

package/dist/serve-scope/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/serve-scope/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,uEAAuE;AACvE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,KAAK,CAAU,CAAC;AAGtD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,mBAAmB,GAAe,OAAO,CAAC;AAUvD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAA8C,CAAC;IACzD,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACnF,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC3B,CAAC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC7B,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC9B,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAChC,CAAC;AACJ,CAAC;AAYD,qEAAqE;AACrE,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,2DAA2D;IAC3D,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAC3E,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACvE,OAAQ,YAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,eAAe,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC;AACvD,CAAC;AAwBD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA4B;IAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACpF,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACjD,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,wBAAwB,KAAK,CAAC,SAAS,+BAA+B;SAC/E,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,IAAI,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAEjD,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YACzB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,MAAM,EACJ,4HAA4H;aAC/H,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,MAAM,EACJ,oHAAoH;oBACpH,uDAAuD;aAC1D,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC5G,CAAC;IAED,6EAA6E;IAC7E,yDAAyD;IACzD,OAAO,KAAK,CAAC,OAAO,KAAK,OAAO;QAC9B,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE;QACxC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC3C,CAAC;AAWD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAA8B,EAC9B,IAAsF;IAEtF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,wBAAwB,EAAE;QACpE,WAAW,EAAE,IAAI,CAAC,QAAQ;QAC1B,OAAO,EAAE,IAAI,CAAC,KAAK;QACnB,QAAQ,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC7B,QAAQ,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;KAC/B,CAAC,CAAC;IACH,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,CAAyC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,OAAO;QACL,SAAS,EAAE,OAAO,GAAG,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ;QAC7E,WAAW,EAAE,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC;QAC3C,cAAc,EAAE,eAAe,CAAC,GAAG,EAAE,cAAc,CAAC;QACpD,QAAQ,EAAE,OAAO,GAAG,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACtE,UAAU,EAAE,OAAO,GAAG,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;KACxE,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,kBAAkB,CAAC,GAAwB;IACzD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;IACtC,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,GAAG,CAAC,kBAAkB,KAAK,eAAe,CAAC;QAC7D,OAAO,SAAS;YACd,CAAC,CAAC,GAAG,OAAO,sCAAsC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;YACpI,CAAC,CAAC,GAAG,OAAO,mGAAmG,CAAC;IACpH,CAAC;IACD,OAAO,GAAG,OAAO,yEAAyE,CAAC;AAC7F,CAAC"}

package/dist/task-runner.d.ts

@@ -13,6 +13,7 @@ import { type ConflictResolutionDeps } from "./runtime/conflict-resolver.js";
 import { type ReconcileResult, type ReconcileReworkOptions } from "./runtime/rework.js";
 import { type AssertResolutionOptions, type ResolutionIntegrityDeps, type ResolutionIntegrityResult } from "./runtime/resolution-integrity.js";
 import { type PreprGateResult } from "./prepr-gate.js";
+import { type SeqGuardOptions, type SeqGuardResult } from "./migration-seq-guard.js";
 import type { RunnerSupabaseClient } from "./supabase.js";
 export interface CostEventPayload extends NormalizedUsage {
     task_id: string;
@@ -191,6 +192,16 @@ export interface RunTaskDeps {
      * tests inject a stub so the rework path doesn't shell out to a real merge.
      */
     reconcileReworkBranch?: (opts: ReconcileReworkOptions) => Promise<ReconcileResult>;
+    /**
+     * MIG-SEQ-GUARD: re-validate this branch's NEW migration sequence against a
+     * FRESHLY-FETCHED integration head immediately before push, and auto-renumber
+     * it when a sibling migration merged and took the number since this worktree
+     * forked. Runs on BOTH push paths (fresh + rework). Defaults to
+     * `revalidateMigrationSeq`; tests inject a stub so the unit suite never
+     * fetches. Fail-open — it can only ever turn a PR CI would reject into one it
+     * accepts, never block a push.
+     */
+    revalidateMigrationSeq?: (workdir: string, opts: SeqGuardOptions) => Promise<SeqGuardResult>;
 }
 export interface RunTaskController {
     taskId: string;
@@ -348,8 +359,13 @@ export declare function recordClaudeUnavailable(now: number): ClaudeUnavailableD
  * both `--output-format=json` (extracts .result) and plain text. Falls
  * back to the entire stdout (capped) if no `## Summary` heading is
  * present — that way the PR body still tells the reviewer what happened.
+ *
+ * NS MM-2: `engineId` is optional and appended last so every pre-existing
+ * caller (api/github/webhook.ts, the packages/acc-runner test suite) keeps
+ * compiling unchanged and keeps resolving `claude-code` — only the in-file
+ * per-task call site now forwards `task.engine`.
  */
-export declare function extractReportFromOutput(stdout: string): string;
+export declare function extractReportFromOutput(stdout: string, engineId?: string | null): string;
 /**
  * v0.35-B: extract the PR number from a `gh pr create` URL. Returns null
  * when the URL doesn't carry a `/pull/<int>` segment so the caller can
@@ -361,8 +377,12 @@ export declare function parsePrNumber(url: string | null | undefined): number |
  * Build a cost event from claude's stdout. Always returns a payload
  * (zero-cost when usage isn't parseable) so the cap-tracking surface
  * stays consistent: one cost_events row per attempt.
+ *
+ * NS MM-2: `engineId` is optional and appended last for the same reason as
+ * `extractReportFromOutput` — every pre-existing caller keeps resolving
+ * `claude-code` unchanged.
  */
-export declare function buildCostEvent(taskId: string, stdout: string, fallbackModel: string | null | undefined, runnerId: string | null | undefined): CostEventPayload;
+export declare function buildCostEvent(taskId: string, stdout: string, fallbackModel: string | null | undefined, runnerId: string | null | undefined, engineId?: string | null): CostEventPayload;
 /**
  * v0.14-MESSAGING-RUNTIME-WIRE — dynamic-import the prelude module
  * referenced by a runner profile and return its default-exported string.

package/dist/task-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-runner.d.ts","sourceRoot":"","sources":["../src/task-runner.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAS,KAAK,iBAAiB,EAAE,MAAM,OAAO,CAAC;AACtD,OAAO,EAAsE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACxI,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAIL,KAAK,eAAe,EAErB,MAAM,yBAAyB,CAAC;AAOjC,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEzD,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EAGL,KAAK,QAAQ,EACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAS/B,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAIL,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,iBAAiB,CAAC;AAMzB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAI1D,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,OAAO,EAAK,MAAM,CAAC;IACnB,KAAK,EAAO,MAAM,CAAC;IACnB,SAAS,EAAG,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,GAAG,EAAE,YAAY,CAAC;IAClB,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,EAAE,CAAC,EAAE,QAAQ,CAAC;IACd;;;;;;;oDAOgD;IAChD,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,iBAAiB,CAAC;IACnE;;;;0CAIsC;IACtC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;;;;OAMG;IACH,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtE;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9E;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,aAAa,GAAG,IAAI,CAAC;IACzC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACzD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D;;;;;;;OAOG;IACH,yBAAyB,CAAC,EAAE,CAC1B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,uBAAuB,EAC7B,IAAI,CAAC,EAAE,uBAAuB,KAC3B,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACxC;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC/E;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9F;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,MAAM,IAAI,IAAI,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB,aAAa,GACb,uBAAuB,GACvB,OAAO,GAIP,OAAO,GACP,eAAe,GACf,KAAK,GACL,aAAa,GAKb,YAAY,GACZ,MAAM,GAIN,QAAQ,GAIR,YAAY,GAMZ,iBAAiB,CAAC;AAEtB,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,WAAW,GAAG,iBAAiB,GAAG,UAAU,GAAG,SAAS,CAAC;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;qCAEiC;IACjC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAYD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AA+B3D;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAIhD;AAsBD,iFAAiF;AACjF,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,6DAA6D;IAC7D,SAAS,EAAE,OAAO,CAAC;IACnB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AA0ElE;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IACJ,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACpB,GACL,OAAO,CAAC,wBAAwB,CAAC,CAkEnC;AA4BD;;;;;;;;;GASG;AACH,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC,EACjC,SAAS,EAAE,MAAM,EAAE,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,EAAE,CAAC,CA2BnB;AAMD;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,cAAc,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,aAAa,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;CACtB;AAkBD,8EAA8E;AAC9E,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAEzF;AAED,yEAAyE;AACzE,wBAAgB,2BAA2B,IAAI,IAAI,CAIlD;AAED,MAAM,WAAW,yBAAyB;IACxC,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,KAAK,EAAE,OAAO,CAAC;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,yBAAyB,CAgB9E;AA6DD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAU9D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAM3E;AA8ED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACxC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,gBAAgB,CAWlB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAwB/E;AA+KD,wBAAgB,OAAO,CACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,GAChB,iBAAiB,CAi4DnB"}
+{"version":3,"file":"task-runner.d.ts","sourceRoot":"","sources":["../src/task-runner.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAS,KAAK,iBAAiB,EAAE,MAAM,OAAO,CAAC;AACtD,OAAO,EAAwF,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1J,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAIL,KAAK,eAAe,EAErB,MAAM,yBAAyB,CAAC;AAQjC,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEzD,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EAGL,KAAK,QAAQ,EACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAS/B,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAIL,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,0BAA0B,CAAC;AAMlC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAkB1D,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,OAAO,EAAK,MAAM,CAAC;IACnB,KAAK,EAAO,MAAM,CAAC;IACnB,SAAS,EAAG,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,GAAG,EAAE,YAAY,CAAC;IAClB,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,EAAE,CAAC,EAAE,QAAQ,CAAC;IACd;;;;;;;oDAOgD;IAChD,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,iBAAiB,CAAC;IACnE;;;;0CAIsC;IACtC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;;;;OAMG;IACH,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtE;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9E;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,aAAa,GAAG,IAAI,CAAC;IACzC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACzD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D;;;;;;;OAOG;IACH,yBAAyB,CAAC,EAAE,CAC1B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,uBAAuB,EAC7B,IAAI,CAAC,EAAE,uBAAuB,KAC3B,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACxC;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC/E;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9F;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACnF;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,CACvB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,eAAe,KAClB,OAAO,CAAC,cAAc,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,MAAM,IAAI,IAAI,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB,aAAa,GACb,uBAAuB,GACvB,OAAO,GAIP,OAAO,GACP,eAAe,GACf,KAAK,GACL,aAAa,GAKb,YAAY,GACZ,MAAM,GAIN,QAAQ,GAIR,YAAY,GAMZ,iBAAiB,CAAC;AAEtB,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,WAAW,GAAG,iBAAiB,GAAG,UAAU,GAAG,SAAS,CAAC;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;qCAEiC;IACjC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAkBD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAmC3D;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAIhD;AAsBD,iFAAiF;AACjF,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,6DAA6D;IAC7D,SAAS,EAAE,OAAO,CAAC;IACnB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AA0ElE;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IACJ,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACpB,GACL,OAAO,CAAC,wBAAwB,CAAC,CAkEnC;AA4BD;;;;;;;;;GASG;AACH,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC,EACjC,SAAS,EAAE,MAAM,EAAE,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,EAAE,CAAC,CA2BnB;AAQD;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,cAAc,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,aAAa,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;CACtB;AAkBD,8EAA8E;AAC9E,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAEzF;AAED,yEAAyE;AACzE,wBAAgB,2BAA2B,IAAI,IAAI,CAIlD;AAED,MAAM,WAAW,yBAAyB;IACxC,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,KAAK,EAAE,OAAO,CAAC;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,yBAAyB,CAgB9E;AA6DD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAUxF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAM3E;AA8ED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACxC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GACvB,gBAAgB,CAWlB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAwB/E;AA+KD,wBAAgB,OAAO,CACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,GAChB,iBAAiB,CA8+DnB"}