@tokenfactory/acc-runner 0.43.0 → 0.44.0

package/dist/local-repo/index.js

@@ -0,0 +1,141 @@
+/**
+ * LOCAL-REPO-CLI — the decidable half of `acc repo add-local`.
+ *
+ * Everything here is pure: given a path on disk and a few probe results, decide
+ * what to register, what to refuse, and what to warn about. The plumbing that
+ * needs a keychain, a network and a filesystem lives in ./command.ts, the same
+ * split serve-scope uses — so every rule below is unit-testable without either.
+ *
+ * WHAT A "LOCAL REPO" IS, AND WHAT IT IS NOT
+ * ----------------------------------------------------------------------------
+ * It is a git working copy on THIS machine that ACC may run tasks in, attached
+ * to a project without the GitHub App being installed anywhere. That is the
+ * whole of it. In particular it is NOT:
+ *
+ *   * a mirror of a GitHub repo ACC will keep in sync — nothing here clones,
+ *     fetches or pushes on the server's behalf;
+ *   * a repo other people on the team can work. The grant the server records is
+ *     scoped to the registering user, and the path is known only to this
+ *     machine, so a teammate's runner has neither the right nor the directory;
+ *   * a way to skip a GitHub write grant on a repo that IS on GitHub. The
+ *     server derives the slug from the caller's user id into a reserved
+ *     `local.…` namespace precisely so this cannot be that.
+ *
+ * WHY THE PATH NEVER LEAVES THE MACHINE
+ * ----------------------------------------------------------------------------
+ * The server needs to know "machine M serves repo R" to route a task; it does
+ * not need to know that R is at /Users/priya/code/side-project. Sending the path
+ * would put a filesystem layout — usernames, project names, directory
+ * structure — into a shared database for no routing benefit, so the path stays
+ * in this machine's own config.json (`local-repos`) and the runner resolves it
+ * at task time. See docs/acc/LOCAL_REPO_CLI_SETUP.md.
+ */
+/** The reserved namespace the server mints local slugs into (acc.local_repo_slug). */
+export const LOCAL_REPO_PREFIX = "local.";
+/**
+ * Is this slug in the reserved local/CLI namespace? Mirrors
+ * acc.is_local_repo_slug (migration 0318) and src/lib/local-repo.ts. A GitHub
+ * owner segment can never contain a '.', so the two namespaces cannot collide.
+ */
+export function isLocalRepoSlug(repo) {
+    const slug = (repo ?? "").trim().toLowerCase();
+    const slash = slug.indexOf("/");
+    if (slash <= 0 || slash === slug.length - 1)
+        return false;
+    return slug.slice(0, slash).startsWith(LOCAL_REPO_PREFIX);
+}
+/**
+ * The human-facing name of a local repo — the part after the '/', without the
+ * per-user hash fragment that makes the slug unique. `local.9f2c1a/my-app` reads
+ * as "my-app (local)" in a list; the full slug is still what gets matched.
+ */
+export function localRepoDisplayName(repo) {
+    const slash = repo.lastIndexOf("/");
+    return slash >= 0 ? repo.slice(slash + 1) : repo;
+}
+/**
+ * Slugify a repo NAME the way acc.local_repo_slug does server-side, so the CLI
+ * can predict (and preview) the slug it is about to be handed. Kept in sync
+ * deliberately — the server is authoritative and the CLI stores whatever comes
+ * back, so a drift here is a cosmetic preview bug, never a wrong write.
+ */
+export function sanitizeLocalRepoName(raw) {
+    let name = (raw ?? "").trim().toLowerCase();
+    name = name.replace(/[^a-z0-9._-]+/g, "-");
+    name = name.replace(/^[-._]+|[-._]+$/g, "");
+    name = name.slice(0, 64);
+    name = name.replace(/^[-._]+|[-._]+$/g, "");
+    return name;
+}
+/**
+ * Decide what to register for a probed directory, or throw with the reason it
+ * cannot be registered.
+ *
+ * Refusals are limited to the two facts that make registration meaningless: the
+ * path is not a directory, or it is not a git repository (the runner's whole
+ * task loop is `git` — branch, commit, diff — so a plain folder would fail at
+ * the first step rather than at a legible place).
+ *
+ * A missing `origin` is NOT a refusal. Running tasks in a local working copy is
+ * useful on its own; it is opening a PR at the end that needs a remote, and the
+ * warning says exactly that instead of pre-emptively blocking the register.
+ */
+export function planLocalRepoRegistration(probe) {
+    if (!probe.isDirectory) {
+        throw new Error(`${probe.path} is not a directory — point at a git working copy`);
+    }
+    if (!probe.isGitRepo) {
+        throw new Error(`${probe.path} is not a git repository (no .git) — run \`git init\` there first, ` +
+            "or point at the repo root");
+    }
+    const rawName = probe.nameOverride?.trim() || basename(probe.path);
+    const name = sanitizeLocalRepoName(rawName);
+    if (!name) {
+        throw new Error(`could not derive a repo name from ${probe.path} — pass --name with letters or digits`);
+    }
+    const warnings = [];
+    if (!probe.originUrl) {
+        warnings.push("This repo has no `origin` remote. Tasks will run and commit here, but the " +
+            "runner cannot push a branch or open a PR — add a remote if you want PRs.");
+    }
+    warnings.push("The code stays on this machine. Only your own runner can work this repo, " +
+        "and only while it is online.");
+    return {
+        name,
+        path: probe.path,
+        // A preview, not a claim: the server mints the authoritative slug from the
+        // caller's user id, which this side deliberately does not know.
+        previewSlug: `${LOCAL_REPO_PREFIX}<you>/${name}`,
+        warnings,
+    };
+}
+/**
+ * Last path segment, tolerating a trailing separator (`~/code/my-app/` must
+ * yield "my-app", not ""). Local rather than node:path so this module stays
+ * dependency-free and testable as pure text.
+ */
+function basename(p) {
+    const parts = p.replace(/[\\/]+$/, "").split(/[\\/]/);
+    return parts[parts.length - 1] ?? "";
+}
+/**
+ * Is this error the "migration 0318 has not been applied here yet" shape?
+ * HALT-before-apply means every environment has a window where this command
+ * ships and the RPC does not exist; "run psql" and "something is broken" have
+ * different remedies, so the command says which. Mirrors serve-scope's
+ * isMigrationPending.
+ */
+export function isMigrationPending(err) {
+    if (!err)
+        return false;
+    // PostgREST: 404 + PGRST202 for an unknown RPC; Postgres 42883 for an
+    // undefined function reached another way.
+    if (err.code === "PGRST202" || err.code === "42883")
+        return true;
+    const msg = (err.message ?? "").toLowerCase();
+    return (msg.includes("register_local_repo") &&
+        (msg.includes("does not exist") ||
+            msg.includes("not find") ||
+            msg.includes("schema cache")));
+}
+//# sourceMappingURL=index.js.map

package/dist/local-repo/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/local-repo/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,sFAAsF;AACtF,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAA+B;IAC7D,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzB,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC;AAiCD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAqB;IAC7D,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,mDAAmD,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,IAAI,qEAAqE;YAChF,2BAA2B,CAC9B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,CAAC,IAAI,uCAAuC,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CACX,4EAA4E;YAC1E,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,IAAI,CACX,2EAA2E;QACzE,8BAA8B,CACjC,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,2EAA2E;QAC3E,gEAAgE;QAChE,WAAW,EAAE,GAAG,iBAAiB,SAAS,IAAI,EAAE;QAChD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAcD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAA+C;IAChF,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,sEAAsE;IACtE,0CAA0C;IAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACnC,CAAC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC7B,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;YACxB,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAChC,CAAC;AACJ,CAAC"}

package/dist/mcp-spawn.d.ts

@@ -1,4 +1,8 @@
 export declare const ACC_MCP_KEY = "acc";
+/** Env var acc-mcp-server reads the per-turn delegation JWT from (see cli.ts). */
+export declare const ACC_MCP_DELEGATION_TOKEN_ENV = "ACC_MCP_DELEGATION_TOKEN";
+/** Env var acc-mcp-server (future-facing) reads the calling agent's id from. */
+export declare const ACC_AGENT_ID_ENV = "ACC_AGENT_ID";
 export interface McpSpawnOptions {
     cwd: string;
     taskId: string;
@@ -7,6 +11,21 @@ export interface McpSpawnOptions {
     publicUrl: string;
     supabaseUrl: string;
     supabaseAnonKey: string;
+    /**
+     * Optional per-turn delegation JWT (FU-5), narrower than `accessToken`.
+     * Env-only — never written to argv. Blank/whitespace-only is treated as
+     * absent.
+     */
+    delegationToken?: string;
+    /**
+     * Optional id of the agent this session is acting for, used for
+     * attribution of mutating tool calls. Forwarded via env
+     * (`ACC_AGENT_ID`) AND `--agent-id` argv (acc-mcp-server's current CLI
+     * only reads argv for this one; the env copy is forward-compatible, per
+     * the same pattern already used for `ACC_TASK_ID`/`ACC_RUNNER_ID`).
+     * Blank/whitespace-only is treated as absent.
+     */
+    agentId?: string;
 }
 export interface McpConfigCleanup {
     /** Restore .mcp.json to its pre-spawn state (or delete if we created it). */

package/dist/mcp-spawn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-spawn.d.ts","sourceRoot":"","sources":["../src/mcp-spawn.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,WAAW,QAAQ,CAAC;AAKjC,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAMD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUtE;AA+ED,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAClD;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,eAAe,EACrB,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CA4B3B"}
+{"version":3,"file":"mcp-spawn.d.ts","sourceRoot":"","sources":["../src/mcp-spawn.ts"],"names":[],"mappings":"AAmCA,eAAO,MAAM,WAAW,QAAQ,CAAC;AAKjC,kFAAkF;AAClF,eAAO,MAAM,4BAA4B,6BAA6B,CAAC;AACvE,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAMD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUtE;AAmFD,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAClD;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,eAAe,EACrB,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CA4B3B"}

package/dist/mcp-spawn.js

@@ -12,6 +12,22 @@
  * merging our entry under `mcpServers.acc`, and restoring the prior
  * contents on cleanup. If our entry is the only one, we delete the
  * file entirely.
+ *
+ * NS MCP-2: the acc-mcp-server subprocess's argv is visible for its whole
+ * lifetime to anything that can run `ps` on the host. The access token is a
+ * broad runner JWT — it MUST NOT appear there. It travels via env only
+ * (`ACC_MCP_ACCESS_TOKEN`); acc-mcp-server's `cli.ts` already falls back to
+ * that env var when `--access-token` is absent from argv, so dropping the
+ * argv copy is a pure hardening change, not a protocol break.
+ *
+ * When a caller has a narrower per-turn delegation token (FU-5) and/or a
+ * calling agent's id available, forwarding them lets acc-mcp-server (a) swap
+ * the delegation token in as the Supabase Bearer — scoping tool calls to the
+ * delegation's claims instead of the full runner JWT, and gating them at the
+ * MC-12 bus risk gate under that narrower identity — and (b) attribute the
+ * turn's mutating calls to the right `agent_id` instead of falling back to
+ * the task's current agent. Both are OPTIONAL and env-only: no caller is
+ * required to supply them today, and neither is ever written to argv.
  */
 import { promises as fs } from "node:fs";
 import path from "node:path";
@@ -20,6 +36,10 @@ export const ACC_MCP_KEY = "acc";
 const MCP_CONFIG_FILENAME = ".mcp.json";
 const ACC_MCP_PACKAGE = "@tokenfactory/acc-mcp-server";
 const ACC_MCP_BIN = "acc-mcp-server";
+/** Env var acc-mcp-server reads the per-turn delegation JWT from (see cli.ts). */
+export const ACC_MCP_DELEGATION_TOKEN_ENV = "ACC_MCP_DELEGATION_TOKEN";
+/** Env var acc-mcp-server (future-facing) reads the calling agent's id from. */
+export const ACC_AGENT_ID_ENV = "ACC_AGENT_ID";
 /**
  * Locate a globally installed binary by name. Returns the absolute
  * path when found, or null otherwise. Used to skip the per-task
@@ -43,12 +63,13 @@ export async function whichBinary(name) {
     }
 }
 function buildEnvBlock(opts) {
-    return {
+    const env = {
         SUPABASE_URL: opts.supabaseUrl,
         SUPABASE_ANON_KEY: opts.supabaseAnonKey,
-        // Token in env is preferable to argv (no ps-output visibility);
-        // we still pass --access-token for back-compat with the current
-        // acc-mcp-server build.
+        // NS MCP-2: env-only. acc-mcp-server's cli.ts falls back to this var
+        // whenever `--access-token` is absent from argv, so the broad runner
+        // JWT never has to appear in argv (`ps`-visible for the subprocess's
+        // whole lifetime).
         ACC_MCP_ACCESS_TOKEN: opts.accessToken,
         ACC_PUBLIC_URL: opts.publicUrl,
         // Task + runner IDs are CLI-passed today (cli > env > default at
@@ -59,39 +80,44 @@ function buildEnvBlock(opts) {
         ACC_TASK_ID: opts.taskId,
         ACC_RUNNER_ID: opts.runnerId,
     };
+    // NS MCP-2: forwarded ONLY via env, never argv — mirrors the chat lane's
+    // ACC_MCP_DELEGATION_TOKEN_ENV convention (engines/claude-code-chat.ts) so
+    // acc-mcp-server swaps this narrower per-turn identity in as the Supabase
+    // Bearer in place of the broad access token.
+    const delegationToken = (opts.delegationToken ?? "").trim();
+    if (delegationToken)
+        env[ACC_MCP_DELEGATION_TOKEN_ENV] = delegationToken;
+    // NS MCP-2: forward-compatible env copy of the agent id also passed via
+    // --agent-id below, so mutating tool calls attribute to the right agent.
+    const agentId = (opts.agentId ?? "").trim();
+    if (agentId)
+        env[ACC_AGENT_ID_ENV] = agentId;
+    return env;
+}
+/** Non-secret coordinate flags shared by both the global-bin and npx spawn shapes. */
+function coordinateArgs(opts) {
+    const args = ["--task-id", opts.taskId, "--runner-id", opts.runnerId, "--public-url", opts.publicUrl];
+    const agentId = (opts.agentId ?? "").trim();
+    if (agentId)
+        args.push("--agent-id", agentId);
+    return args;
 }
 async function buildEntry(opts, which) {
     const globalBin = await which(ACC_MCP_BIN);
+    // NS MCP-2: neither the access token nor the delegation token is ever
+    // written to argv — both travel exclusively via buildEnvBlock()'s env
+    // block (ps shows only non-secret coordinates: task/runner/agent ids and
+    // the public URL).
     if (globalBin) {
         return {
             command: globalBin,
-            args: [
-                "--task-id",
-                opts.taskId,
-                "--runner-id",
-                opts.runnerId,
-                "--access-token",
-                opts.accessToken,
-                "--public-url",
-                opts.publicUrl,
-            ],
+            args: coordinateArgs(opts),
             env: buildEnvBlock(opts),
         };
     }
     return {
         command: "npx",
-        args: [
-            "-y",
-            ACC_MCP_PACKAGE,
-            "--task-id",
-            opts.taskId,
-            "--runner-id",
-            opts.runnerId,
-            "--access-token",
-            opts.accessToken,
-            "--public-url",
-            opts.publicUrl,
-        ],
+        args: ["-y", ACC_MCP_PACKAGE, ...coordinateArgs(opts)],
         env: buildEnvBlock(opts),
     };
 }

package/dist/mcp-spawn.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-spawn.js","sourceRoot":"","sources":["../src/mcp-spawn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAE9B,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC;AACjC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AACxC,MAAM,eAAe,GAAG,8BAA8B,CAAC;AACvD,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAqBrC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAqB;IAC1C,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,iBAAiB,EAAE,IAAI,CAAC,eAAe;QACvC,gEAAgE;QAChE,gEAAgE;QAChE,wBAAwB;QACxB,oBAAoB,EAAE,IAAI,CAAC,WAAW;QACtC,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,iEAAiE;QACjE,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,oBAAoB;QACpB,WAAW,EAAE,IAAI,CAAC,MAAM;QACxB,aAAa,EAAE,IAAI,CAAC,QAAQ;KAC7B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAqB,EACrB,KAA+C;IAE/C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE;gBACJ,WAAW;gBACX,IAAI,CAAC,MAAM;gBACX,aAAa;gBACb,IAAI,CAAC,QAAQ;gBACb,gBAAgB;gBAChB,IAAI,CAAC,WAAW;gBAChB,cAAc;gBACd,IAAI,CAAC,SAAS;aACf;YACD,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC;SACzB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,IAAI,EAAE;YACJ,IAAI;YACJ,eAAe;YACf,WAAW;YACX,IAAI,CAAC,MAAM;YACX,aAAa;YACb,IAAI,CAAC,QAAQ;YACb,gBAAgB;YAChB,IAAI,CAAC,WAAW;YAChB,cAAc;YACd,IAAI,CAAC,SAAS;SACf;QACD,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC;KACzB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;YAClD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,kEAAkE;YAClE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACtC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAqB,EACrB,OAA2B,EAAE;IAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC;IAExC,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,MAAM,GAAmB,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IACrD,MAAM,OAAO,GAA4B,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;IAC1E,OAAO,CAAC,WAAW,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC;IAC5B,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEtF,OAAO;QACL,KAAK,CAAC,OAAO;YACX,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC3B,4CAA4C;gBAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBACnC,kBAAkB;gBACpB,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,+DAA+D;YAC/D,gEAAgE;YAChE,8BAA8B;YAC9B,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mcp-spawn.js","sourceRoot":"","sources":["../src/mcp-spawn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAE9B,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC;AACjC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AACxC,MAAM,eAAe,GAAG,8BAA8B,CAAC;AACvD,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAErC,kFAAkF;AAClF,MAAM,CAAC,MAAM,4BAA4B,GAAG,0BAA0B,CAAC;AACvE,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAoC/C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAqB;IAC1C,MAAM,GAAG,GAA2B;QAClC,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,iBAAiB,EAAE,IAAI,CAAC,eAAe;QACvC,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,mBAAmB;QACnB,oBAAoB,EAAE,IAAI,CAAC,WAAW;QACtC,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,iEAAiE;QACjE,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,oBAAoB;QACpB,WAAW,EAAE,IAAI,CAAC,MAAM;QACxB,aAAa,EAAE,IAAI,CAAC,QAAQ;KAC7B,CAAC;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,6CAA6C;IAC7C,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,eAAe;QAAE,GAAG,CAAC,4BAA4B,CAAC,GAAG,eAAe,CAAC;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,OAAO;QAAE,GAAG,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC;IAC7C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sFAAsF;AACtF,SAAS,cAAc,CAAC,IAAqB;IAC3C,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAqB,EACrB,KAA+C;IAE/C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3C,sEAAsE;IACtE,sEAAsE;IACtE,yEAAyE;IACzE,mBAAmB;IACnB,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC;YAC1B,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC;SACzB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACtD,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC;KACzB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;YAClD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,kEAAkE;YAClE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACtC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAqB,EACrB,OAA2B,EAAE;IAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC;IAExC,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,MAAM,GAAmB,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IACrD,MAAM,OAAO,GAA4B,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;IAC1E,OAAO,CAAC,WAAW,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC;IAC5B,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEtF,OAAO;QACL,KAAK,CAAC,OAAO;YACX,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC3B,4CAA4C;gBAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBACnC,kBAAkB;gBACpB,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,+DAA+D;YAC/D,gEAAgE;YAChE,8BAA8B;YAC9B,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/program.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../src/program.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6BpC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AA8B7C,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CA4TvE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAQvD;AAED,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAKjD"}
+{"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../src/program.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8BpC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AA8B7C,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAyVvE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAQvD;AAED,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAKjD"}

package/dist/program.js

@@ -46,6 +46,7 @@ import { ensureUserSessionLive } from "./user-auth/liveness.js";
 import { chatCommand } from "./user-cli/chat.js";
 import { taskListCommand, taskShowCommand } from "./user-cli/tasks.js";
 import { doctorCommand } from "./doctor.js";
+import { addLocalRepoCommand, listLocalReposCommand } from "./local-repo/command.js";
 import { serveScopeCommand } from "./serve-scope/command.js";
 import { clarifyCommand } from "./clarification.js";
 import { clearQuarantine, getQuarantine } from "./runtime/quarantine.js";
@@ -157,6 +158,26 @@ export function buildProgram(options = {}) {
         .option("--conversation <id>", "Continue an existing conversation.")
         .option("--json", "Emit the turn as JSON instead of streaming it.")
         .action((words, opts) => personGuard(() => chatCommand(words ?? [], opts))());
+    // ── Attaching repos ───────────────────────────────────────────────────────
+    // LOCAL-REPO-CLI: the second way to attach a repo, for people who will not or
+    // cannot grant the GitHub App. Registered in the PERSON lane (see
+    // local-repo/command.ts) because the grant being written is the operator's own
+    // — a machine credential has nobody to scope it to.
+    const repoCmd = program
+        .command("repo")
+        .description("Attach a repo on this machine to ACC (no GitHub App required).");
+    repoCmd
+        .command("add-local")
+        .description("Register a local git working copy so your runner can work it.")
+        .argument("<path>", "Path to the git repo, e.g. ~/code/my-app.")
+        .option("--name <name>", "Name for the repo (defaults to the directory name).")
+        .option("--project <slug>", "Also attach it to this project.")
+        .action((repoPath, opts) => personGuard(() => addLocalRepoCommand(repoPath, { name: opts.name, project: opts.project }))());
+    repoCmd
+        .command("list-local")
+        .description("List the local repos registered on this machine.")
+        .option("--json", "Emit raw JSON instead of a table.")
+        .action((opts) => personGuard(() => listLocalReposCommand({ json: opts.json }))());
     // ── Running agents on this machine ────────────────────────────────────────
     program
         .command("watch")

package/dist/program.js.map

@@ -1 +1 @@
-{"version":3,"file":"program.js","sourceRoot":"","sources":["../src/program.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAwB,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGnD,mFAAmF;AACnF,SAAS,KAAK,CAAC,EAA0B;IACvC,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,EAA0B;IAC7C,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;QACtB,MAAM,qBAAqB,EAAE,CAAC;QAC9B,MAAM,EAAE,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,MAAM,UAAU,YAAY,CAAC,UAA+B,EAAE;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IACpD,MAAM,OAAO,GAAG,SAAS,KAAK,KAAK,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,SAAS,CAAC;SACf,WAAW,CACV,OAAO;QACL,CAAC,CAAC,yFAAyF;QAC3F,CAAC,CAAC,mHAAmH,CACxH;SACA,OAAO,CAAC,GAAG,eAAe,eAAe,gBAAgB,GAAG,CAAC,CAAC;IAEjE,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,kBAAkB,GAAG,CAAC,MAAe,EAAE,KAAyB,EAAE,EAAE;QACxE,MAAM;aACH,OAAO,CAAC,OAAO,CAAC;aAChB,WAAW,CAAC,sEAAsE,CAAC;aACnF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM;aACH,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;aACrB,WAAW,CAAC,yCAAyC,CAAC;aACtD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM;aACH,OAAO,CAAC,QAAQ,CAAC;aACjB,WAAW,CAAC,mEAAmE,CAAC;aAChF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sDAAsD,CAAC,CAAC;IACvE,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAElD,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,CAAC,MAAe,EAAE,EAAE;QAC9C,MAAM;aACH,OAAO,CAAC,OAAO,CAAC;aAChB,WAAW,CAAC,0DAA0D,CAAC;aACvE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QACvC,MAAM;aACH,OAAO,CAAC,QAAQ,CAAC;aACjB,WAAW,CAAC,uDAAuD,CAAC;aACpE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,mBAAmB,CACjB,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wDAAwD,CAAC,CACzE,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,6EAA6E;IAC7E,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,8CAA8C,CAAC,CAAC;IAE/D,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,mBAAmB,EAAE,+CAA+C,CAAC;SAC5E,MAAM,CAAC,eAAe,EAAE,wCAAwC,CAAC;SACjE,MAAM,CAAC,aAAa,EAAE,oCAAoC,CAAC;SAC3D,MAAM,CAAC,QAAQ,EAAE,mCAAmC,CAAC;SACrD,MAAM,CAAC,CAAC,IAAqB,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAEjF,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,wBAAwB,CAAC;SACrC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;SACzC,MAAM,CAAC,QAAQ,EAAE,kCAAkC,CAAC;SACpD,MAAM,CAAC,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAC/C,WAAW,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,CAC/C,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,mEAAmE,CAAC;SAChF,QAAQ,CAAC,cAAc,EAAE,gDAAgD,CAAC;SAC1E,MAAM,CAAC,qBAAqB,EAAE,oCAAoC,CAAC;SACnE,MAAM,CAAC,QAAQ,EAAE,gDAAgD,CAAC;SAClE,MAAM,CAAC,CAAC,KAAe,EAAE,IAAiB,EAAE,EAAE,CAC7C,WAAW,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,CACpD,CAAC;IAEJ,6EAA6E;IAC7E,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,8DAA8D;QAC9D,kEAAkE;QAClE,kCAAkC;QAClC,MAAM,YAAY,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,YAAY,EAAE,CAAC;QACrB,8DAA8D;QAC9D,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CACH,CAAC;IAEJ,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,YAAY,GAAG,OAAO;SACzB,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,0EAA0E,CAAC;SACvF,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChC,kEAAkE;QAClE,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CACH,CAAC;IAEJ,YAAY;SACT,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;IAEjD,YAAY;SACT,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC;IAElD,YAAY;SACT,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,mCAAmC,CAAC;SAChD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;IAEpD,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,gCAAgC;IAChC,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,qEAAqE,CAAC;SAClF,QAAQ,CAAC,SAAS,EAAE,mEAAmE,CAAC;SACxF,MAAM,CAAC,OAAO,EAAE,oEAAoE,CAAC;SACrF,MAAM,CAAC,iBAAiB,EAAE,qCAAqC,CAAC;SAChE,MAAM,CAAC,CAAC,KAAyB,EAAE,IAAwC,EAAE,EAAE,CAC9E,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAChF,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,2DAA2D,CAAC;SACxE,MAAM,CACL,UAAU,EACV,uFAAuF,CACxF;SACA,MAAM,CAAC,KAAK,EAAE,IAA0B,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,yEAAyE;IACzE,+EAA+E;IAC/E,gFAAgF;IAChF,gFAAgF;IAChF,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,gFAAgF,CACjF;SACA,cAAc,CAAC,aAAa,EAAE,gDAAgD,CAAC;SAC/E,cAAc,CAAC,mBAAmB,EAAE,uDAAuD,CAAC;SAC5F,MAAM,CAAC,kBAAkB,EAAE,oDAAoD,CAAC;SAChF,MAAM,CAAC,CAAC,IAA4D,EAAE,EAAE,CACvE,KAAK,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CACpC,CAAC;IAEJ,6EAA6E;IAC7E,+EAA+E;IAC/E,8DAA8D;IAC9D,MAAM,aAAa,GAAG,OAAO;SAC1B,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,+CAA+C,CAAC,CAAC;IAEhE,aAAa;SACV,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,CAAC,GAAG,MAAM,aAAa,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;QAC5C,iEAAiE;QACjE,qEAAqE;QACrE,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,WAAW,oCAAoC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,4BAA4B,CAAC,CAAC,KAAK,sBAAsB,SAAS,sBAAsB,CACzF,CACF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CACH,CAAC;IAEJ,aAAa;SACV,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,iEAAiE,CAAC;SAC9E,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,eAAe,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CAAC,mEAAmE,CAAC,CACjF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEJ,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,cAAc,GAAG,OAAO;SAC3B,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,wEAAwE,CAAC,CAAC;IAEzF,cAAc;SACX,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0BAA0B,CAAC;SACvC,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,CAAC,GAAG,MAAM,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,4BAA4B,CAAC,CAAC,KAAK,sBAAsB,SAAS,yBAAyB;YACzF,mCAAmC,CACtC,CACF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CACH,CAAC;IAEJ,cAAc;SACX,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,4EAA4E,CAAC;SACzF,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,gBAAgB,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAC9E,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEJ,wEAAwE;IACxE,+EAA+E;IAC/E,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,2BAA2B;IAC3B,OAAO;SACJ,OAAO,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAC7C,WAAW,CAAC,iEAAiE,CAAC;SAC9E,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC9B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2EAA2E;YAC3E,sEAAsE;YACtE,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,MAAM,CAAC,0CAA2C,GAAa,CAAC,OAAO,EAAE,CAAC,CACjF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,gCAAgC,CAAC;SAC7C,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"program.js","sourceRoot":"","sources":["../src/program.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAwB,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGnD,mFAAmF;AACnF,SAAS,KAAK,CAAC,EAA0B;IACvC,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,EAA0B;IAC7C,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;QACtB,MAAM,qBAAqB,EAAE,CAAC;QAC9B,MAAM,EAAE,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,MAAM,UAAU,YAAY,CAAC,UAA+B,EAAE;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IACpD,MAAM,OAAO,GAAG,SAAS,KAAK,KAAK,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,SAAS,CAAC;SACf,WAAW,CACV,OAAO;QACL,CAAC,CAAC,yFAAyF;QAC3F,CAAC,CAAC,mHAAmH,CACxH;SACA,OAAO,CAAC,GAAG,eAAe,eAAe,gBAAgB,GAAG,CAAC,CAAC;IAEjE,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,kBAAkB,GAAG,CAAC,MAAe,EAAE,KAAyB,EAAE,EAAE;QACxE,MAAM;aACH,OAAO,CAAC,OAAO,CAAC;aAChB,WAAW,CAAC,sEAAsE,CAAC;aACnF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM;aACH,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;aACrB,WAAW,CAAC,yCAAyC,CAAC;aACtD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM;aACH,OAAO,CAAC,QAAQ,CAAC;aACjB,WAAW,CAAC,mEAAmE,CAAC;aAChF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sDAAsD,CAAC,CAAC;IACvE,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAElD,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,CAAC,MAAe,EAAE,EAAE;QAC9C,MAAM;aACH,OAAO,CAAC,OAAO,CAAC;aAChB,WAAW,CAAC,0DAA0D,CAAC;aACvE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QACvC,MAAM;aACH,OAAO,CAAC,QAAQ,CAAC;aACjB,WAAW,CAAC,uDAAuD,CAAC;aACpE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,mBAAmB,CACjB,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wDAAwD,CAAC,CACzE,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,6EAA6E;IAC7E,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,8CAA8C,CAAC,CAAC;IAE/D,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,mBAAmB,EAAE,+CAA+C,CAAC;SAC5E,MAAM,CAAC,eAAe,EAAE,wCAAwC,CAAC;SACjE,MAAM,CAAC,aAAa,EAAE,oCAAoC,CAAC;SAC3D,MAAM,CAAC,QAAQ,EAAE,mCAAmC,CAAC;SACrD,MAAM,CAAC,CAAC,IAAqB,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAEjF,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,wBAAwB,CAAC;SACrC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;SACzC,MAAM,CAAC,QAAQ,EAAE,kCAAkC,CAAC;SACpD,MAAM,CAAC,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAC/C,WAAW,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,CAC/C,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,mEAAmE,CAAC;SAChF,QAAQ,CAAC,cAAc,EAAE,gDAAgD,CAAC;SAC1E,MAAM,CAAC,qBAAqB,EAAE,oCAAoC,CAAC;SACnE,MAAM,CAAC,QAAQ,EAAE,gDAAgD,CAAC;SAClE,MAAM,CAAC,CAAC,KAAe,EAAE,IAAiB,EAAE,EAAE,CAC7C,WAAW,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,CACpD,CAAC;IAEJ,6EAA6E;IAC7E,8EAA8E;IAC9E,kEAAkE;IAClE,+EAA+E;IAC/E,oDAAoD;IACpD,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gEAAgE,CAAC,CAAC;IAEjF,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,+DAA+D,CAAC;SAC5E,QAAQ,CAAC,QAAQ,EAAE,2CAA2C,CAAC;SAC/D,MAAM,CAAC,eAAe,EAAE,qDAAqD,CAAC;SAC9E,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC;SAC7D,MAAM,CAAC,CAAC,QAAgB,EAAE,IAAyC,EAAE,EAAE,CACtE,WAAW,CAAC,GAAG,EAAE,CACf,mBAAmB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAC1E,EAAE,CACJ,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,QAAQ,EAAE,mCAAmC,CAAC;SACrD,MAAM,CAAC,CAAC,IAAwB,EAAE,EAAE,CACnC,WAAW,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAChE,CAAC;IAEJ,6EAA6E;IAC7E,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,8DAA8D;QAC9D,kEAAkE;QAClE,kCAAkC;QAClC,MAAM,YAAY,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,YAAY,EAAE,CAAC;QACrB,8DAA8D;QAC9D,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CACH,CAAC;IAEJ,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,YAAY,GAAG,OAAO;SACzB,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,0EAA0E,CAAC;SACvF,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChC,kEAAkE;QAClE,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CACH,CAAC;IAEJ,YAAY;SACT,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;IAEjD,YAAY;SACT,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC;IAElD,YAAY;SACT,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,mCAAmC,CAAC;SAChD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;IAEpD,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,gCAAgC;IAChC,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,qEAAqE,CAAC;SAClF,QAAQ,CAAC,SAAS,EAAE,mEAAmE,CAAC;SACxF,MAAM,CAAC,OAAO,EAAE,oEAAoE,CAAC;SACrF,MAAM,CAAC,iBAAiB,EAAE,qCAAqC,CAAC;SAChE,MAAM,CAAC,CAAC,KAAyB,EAAE,IAAwC,EAAE,EAAE,CAC9E,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAChF,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,2DAA2D,CAAC;SACxE,MAAM,CACL,UAAU,EACV,uFAAuF,CACxF;SACA,MAAM,CAAC,KAAK,EAAE,IAA0B,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,yEAAyE;IACzE,+EAA+E;IAC/E,gFAAgF;IAChF,gFAAgF;IAChF,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,gFAAgF,CACjF;SACA,cAAc,CAAC,aAAa,EAAE,gDAAgD,CAAC;SAC/E,cAAc,CAAC,mBAAmB,EAAE,uDAAuD,CAAC;SAC5F,MAAM,CAAC,kBAAkB,EAAE,oDAAoD,CAAC;SAChF,MAAM,CAAC,CAAC,IAA4D,EAAE,EAAE,CACvE,KAAK,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CACpC,CAAC;IAEJ,6EAA6E;IAC7E,+EAA+E;IAC/E,8DAA8D;IAC9D,MAAM,aAAa,GAAG,OAAO;SAC1B,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,+CAA+C,CAAC,CAAC;IAEhE,aAAa;SACV,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,CAAC,GAAG,MAAM,aAAa,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;QAC5C,iEAAiE;QACjE,qEAAqE;QACrE,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,WAAW,oCAAoC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,4BAA4B,CAAC,CAAC,KAAK,sBAAsB,SAAS,sBAAsB,CACzF,CACF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CACH,CAAC;IAEJ,aAAa;SACV,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,iEAAiE,CAAC;SAC9E,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,eAAe,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CAAC,mEAAmE,CAAC,CACjF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEJ,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,cAAc,GAAG,OAAO;SAC3B,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,wEAAwE,CAAC,CAAC;IAEzF,cAAc;SACX,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0BAA0B,CAAC;SACvC,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,CAAC,GAAG,MAAM,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,4BAA4B,CAAC,CAAC,KAAK,sBAAsB,SAAS,yBAAyB;YACzF,mCAAmC,CACtC,CACF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CACH,CAAC;IAEJ,cAAc;SACX,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,4EAA4E,CAAC;SACzF,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,gBAAgB,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAC9E,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEJ,wEAAwE;IACxE,+EAA+E;IAC/E,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,2BAA2B;IAC3B,OAAO;SACJ,OAAO,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAC7C,WAAW,CAAC,iEAAiE,CAAC;SAC9E,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC9B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2EAA2E;YAC3E,sEAAsE;YACtE,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,MAAM,CAAC,0CAA2C,GAAa,CAAC,OAAO,EAAE,CAAC,CACjF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,gCAAgC,CAAC;SAC7C,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/provider-auth.d.ts

@@ -26,8 +26,15 @@
  * already mirrors this "strip the key unless the chosen mode is api-key"
  * discipline; REVIEW-SUBS brings the Anthropic path in line with it.
  */
+import type { SecretFetcher } from "./secrets/inject.js";
 export type AnthropicAuthMode = "api-key" | "interactive-session";
-/** Trimmed ANTHROPIC_API_KEY from `env`, or "" when unset/blank. */
+/** Test-only: clear the vault-sourced key cache between tests. */
+export declare function __resetVaultAnthropicApiKeyForTests(): void;
+/**
+ * Trimmed ANTHROPIC_API_KEY from `env`, or the NS RUN-3 vault-sourced key
+ * (see hydrateAnthropicApiKey) when `env` doesn't carry one, or "" when
+ * neither is set. An explicit value in `env` always wins.
+ */
 export declare function anthropicApiKey(env?: NodeJS.ProcessEnv): string;
 /**
  * Opt-in claude-config isolation. Even with ANTHROPIC_API_KEY
@@ -102,6 +109,49 @@ export declare function describeAuthMode(mode: AnthropicAuthMode): string;
  * login from shadowing the key and causing 429s.
  */
 export declare function authPrecedenceHint(env?: NodeJS.ProcessEnv): string | null;
+export type AnthropicKeySource = "env" | "secret-store";
+export declare const ANTHROPIC_KEY_SOURCE_ENV: "ACC_RUNNER_ANTHROPIC_KEY_SOURCE";
+/** Vault secret name the operator stores the Anthropic key under. */
+export declare const ANTHROPIC_API_KEY_SECRET_NAME: "ANTHROPIC_API_KEY";
+/**
+ * Resolve which source ANTHROPIC_API_KEY should come from. Defaults to
+ * "env" (today's behaviour, unchanged) so existing desktop runners and
+ * containers with the key baked into their launch env see no change — the
+ * secret-store path is opt-in via ACC_RUNNER_ANTHROPIC_KEY_SOURCE=secret-store.
+ */
+export declare function resolveAnthropicKeySource(env?: NodeJS.ProcessEnv): AnthropicKeySource;
+export interface AnthropicSecretStoreOptions {
+    /**
+     * Fetches vault secrets by name. Production wires this to
+     * `makeHttpSecretFetcher` (secrets/inject.ts) against the runner's own
+     * JWT; tests pass a stub.
+     */
+    fetcher: SecretFetcher;
+    /** agent_id the fetch is attributed to for telemetry (see secrets/inject.ts). */
+    agentId: string;
+    toolName?: string;
+}
+/**
+ * Fetch ANTHROPIC_API_KEY from the vault via the supplied fetcher and trim
+ * it. Propagates the fetcher's `secret_unavailable: …` error verbatim on
+ * failure — never adds the plaintext to a message.
+ */
+export declare function anthropicApiKeyFromSecretStore(opts: AnthropicSecretStoreOptions): Promise<string>;
+/**
+ * Startup-time env hydration: when ACC_RUNNER_ANTHROPIC_KEY_SOURCE is
+ * "secret-store", resolves ANTHROPIC_API_KEY from the vault, caches it (see
+ * vaultAnthropicApiKey above) so anthropicApiKey()'s fallback picks it up for
+ * every later call, and returns `base` with it set too; otherwise returns
+ * `base` unchanged. An ANTHROPIC_API_KEY already present in `base` always
+ * wins and is never clobbered, so a local override for debugging still works
+ * even with the source flag flipped. Never mutates `base`.
+ *
+ * Wired into watch.ts's and companion-run.ts's startup paths (both call this
+ * ONCE at process startup, before the first withAnthropicAuth call / claude
+ * spawn, and rely on the module cache rather than assigning the result to
+ * process.env — see the ambient-key guard note above anthropicApiKey()).
+ */
+export declare function hydrateAnthropicApiKey(base?: NodeJS.ProcessEnv, storeOpts?: AnthropicSecretStoreOptions): Promise<NodeJS.ProcessEnv>;
 /** How the codex CLI authenticates for a given spawn. */
 export type CodexAuthMode = "api-key" | "subscription";
 /**

package/dist/provider-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-auth.d.ts","sourceRoot":"","sources":["../src/provider-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAMH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,qBAAqB,CAAC;AAElE,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAGT;AAED,qEAAqE;AACrE,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAGR;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,iBAAiB,CAEvF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAAG,8BAAuC,CAAC;AAE7E,wEAAwE;AACxE,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,OAAO,GACP,aAAa,GACb,cAAc,GACd,MAAM,CAAC;AAEX;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,eAAe,CAOrF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAEhF;AAED,+EAA+E;AAC/E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAarE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAsB1F;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAIhE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CASf;AAiBD,yDAAyD;AACzD,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,cAAc,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,eAAe,CAAC;AAEzE;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAG,iBAA0B,CAAC;AAElE,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEzE;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,CAAC,CAYhE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC7B,mBAAmB,CAMrB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,mBAAmB,EAC/B,SAAS,EAAE,OAAO,GACjB,aAAa,CAGf;AAED,oFAAoF;AACpF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAIjE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,aAAa,EACnB,IAAI,GAAE,MAAM,CAAC,UAAwB,GACpC,MAAM,CAAC,UAAU,CAUnB"}
+{"version":3,"file":"provider-auth.d.ts","sourceRoot":"","sources":["../src/provider-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,qBAAqB,CAAC;AAelE,kEAAkE;AAClE,wBAAgB,mCAAmC,IAAI,IAAI,CAE1D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAG5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAGT;AAED,qEAAqE;AACrE,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAGR;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,iBAAiB,CAEvF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAAG,8BAAuC,CAAC;AAE7E,wEAAwE;AACxE,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,OAAO,GACP,aAAa,GACb,cAAc,GACd,MAAM,CAAC;AAEX;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,eAAe,CAOrF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAEhF;AAED,+EAA+E;AAC/E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAarE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAsB1F;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAIhE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CASf;AAyBD,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,cAAc,CAAC;AAExD,eAAO,MAAM,wBAAwB,EAAG,iCAA0C,CAAC;AAEnF,qEAAqE;AACrE,eAAO,MAAM,6BAA6B,EAAG,mBAA4B,CAAC;AAE1E;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,kBAAkB,CAGpB;AAED,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,OAAO,EAAE,aAAa,CAAC;IACvB,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,GAAE,MAAM,CAAC,UAAwB,EACrC,SAAS,CAAC,EAAE,2BAA2B,GACtC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAyB5B;AAiBD,yDAAyD;AACzD,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,cAAc,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,eAAe,CAAC;AAEzE;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAG,iBAA0B,CAAC;AAElE,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEzE;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,CAAC,CAYhE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC7B,mBAAmB,CAMrB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,mBAAmB,EAC/B,SAAS,EAAE,OAAO,GACjB,aAAa,CAGf;AAED,oFAAoF;AACpF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAIjE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,aAAa,EACnB,IAAI,GAAE,MAAM,CAAC,UAAwB,GACpC,MAAM,CAAC,UAAU,CAUnB"}

package/dist/provider-auth.js

@@ -29,9 +29,30 @@
 import os from "node:os";
 import path from "node:path";
 import { RUNNER_KEYCHAIN_SERVICE } from "./types.js";
-/** Trimmed ANTHROPIC_API_KEY from `env`, or "" when unset/blank. */
+/**
+ * NS RUN-3: the vault-sourced key cached by hydrateAnthropicApiKey (below),
+ * when ACC_RUNNER_ANTHROPIC_KEY_SOURCE=secret-store resolved one at startup.
+ * Deliberately NOT process.env — the ambient-key guard
+ * (scripts/ci/no-ambient-anthropic-key.mjs) is STRICT for this tree: zero
+ * literal `process.env.ANTHROPIC_API_KEY` reads OR writes, no allowlist. A
+ * module-level cache, consulted only through the parameterised
+ * anthropicApiKey() below, keeps every consumer (resolveAuthMode,
+ * withAnthropicAuth, authPrecedenceHint) on the same sanctioned resolution
+ * path without ever touching the ambient global.
+ */
+let vaultAnthropicApiKey = null;
+/** Test-only: clear the vault-sourced key cache between tests. */
+export function __resetVaultAnthropicApiKeyForTests() {
+    vaultAnthropicApiKey = null;
+}
+/**
+ * Trimmed ANTHROPIC_API_KEY from `env`, or the NS RUN-3 vault-sourced key
+ * (see hydrateAnthropicApiKey) when `env` doesn't carry one, or "" when
+ * neither is set. An explicit value in `env` always wins.
+ */
 export function anthropicApiKey(env = process.env) {
-    return (env.ANTHROPIC_API_KEY ?? "").trim();
+    const fromEnv = (env.ANTHROPIC_API_KEY ?? "").trim();
+    return fromEnv || vaultAnthropicApiKey || "";
 }
 /**
  * Opt-in claude-config isolation. Even with ANTHROPIC_API_KEY
@@ -172,6 +193,66 @@ export function authPrecedenceHint(env = process.env) {
     return ("if you still hit 429 session caps, a claude.ai login is shadowing the API key — " +
         "run `claude /logout` or set ACC_RUNNER_ISOLATE_CLAUDE_CONFIG=1");
 }
+export const ANTHROPIC_KEY_SOURCE_ENV = "ACC_RUNNER_ANTHROPIC_KEY_SOURCE";
+/** Vault secret name the operator stores the Anthropic key under. */
+export const ANTHROPIC_API_KEY_SECRET_NAME = "ANTHROPIC_API_KEY";
+/**
+ * Resolve which source ANTHROPIC_API_KEY should come from. Defaults to
+ * "env" (today's behaviour, unchanged) so existing desktop runners and
+ * containers with the key baked into their launch env see no change — the
+ * secret-store path is opt-in via ACC_RUNNER_ANTHROPIC_KEY_SOURCE=secret-store.
+ */
+export function resolveAnthropicKeySource(env = process.env) {
+    const v = (env[ANTHROPIC_KEY_SOURCE_ENV] ?? "").trim().toLowerCase();
+    return v === "secret-store" || v === "secret_store" || v === "vault" ? "secret-store" : "env";
+}
+/**
+ * Fetch ANTHROPIC_API_KEY from the vault via the supplied fetcher and trim
+ * it. Propagates the fetcher's `secret_unavailable: …` error verbatim on
+ * failure — never adds the plaintext to a message.
+ */
+export async function anthropicApiKeyFromSecretStore(opts) {
+    const plaintext = await opts.fetcher(ANTHROPIC_API_KEY_SECRET_NAME, opts.agentId, opts.toolName);
+    return plaintext.trim();
+}
+/**
+ * Startup-time env hydration: when ACC_RUNNER_ANTHROPIC_KEY_SOURCE is
+ * "secret-store", resolves ANTHROPIC_API_KEY from the vault, caches it (see
+ * vaultAnthropicApiKey above) so anthropicApiKey()'s fallback picks it up for
+ * every later call, and returns `base` with it set too; otherwise returns
+ * `base` unchanged. An ANTHROPIC_API_KEY already present in `base` always
+ * wins and is never clobbered, so a local override for debugging still works
+ * even with the source flag flipped. Never mutates `base`.
+ *
+ * Wired into watch.ts's and companion-run.ts's startup paths (both call this
+ * ONCE at process startup, before the first withAnthropicAuth call / claude
+ * spawn, and rely on the module cache rather than assigning the result to
+ * process.env — see the ambient-key guard note above anthropicApiKey()).
+ */
+export async function hydrateAnthropicApiKey(base = process.env, storeOpts) {
+    if (resolveAnthropicKeySource(base) !== "secret-store")
+        return base;
+    // Local-override check: base's OWN property, not the vault-cache fallback
+    // anthropicApiKey() also consults — an explicit env value always wins here,
+    // regardless of anything already cached from a prior hydration.
+    if ((base.ANTHROPIC_API_KEY ?? "").trim())
+        return base;
+    if (!storeOpts) {
+        throw new Error(`${ANTHROPIC_KEY_SOURCE_ENV}=secret-store requires a vault fetcher at startup (agentId + fetcher)`);
+    }
+    const key = await anthropicApiKeyFromSecretStore(storeOpts);
+    if (!key) {
+        throw new Error(`anthropic_secret_unavailable: ${ANTHROPIC_API_KEY_SECRET_NAME} resolved to an empty value`);
+    }
+    // NS RUN-3: cache it for anthropicApiKey()'s fallback so downstream
+    // consumers (withAnthropicAuth, resolveAuthMode, …) resolve the vault key
+    // WITHOUT the runner ever writing process.env.ANTHROPIC_API_KEY directly
+    // (see the module-cache doc comment above anthropicApiKey()). The returned
+    // env object still carries it explicitly too, for a caller that reads the
+    // return value directly.
+    vaultAnthropicApiKey = key;
+    return { ...base, ANTHROPIC_API_KEY: key };
+}
 /**
  * The per-provider keychain account under the frozen `acc-runner` service.
  * FROZEN-CONTRACT EXTENSION (Track-A note): this ADDS a namespaced account

package/dist/provider-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-auth.js","sourceRoot":"","sources":["../src/provider-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAIrD,oEAAoE;AACpE,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5E,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC;AAChE,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,uBAAuB,CACrC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjE,OAAO,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,8BAAuC,CAAC;AAU7E;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAClC,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,aAAa;QAAE,OAAO,aAAa,CAAC;IACrE,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAChC,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,OAAO,eAAe,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;AAC5C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CAAC,IAAqB;IAC3D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,kFAAkF,CAAC;QAC5F,KAAK,OAAO;YACV,OAAO,0EAA0E,CAAC;QACpF,KAAK,aAAa;YAChB,OAAO,gFAAgF,CAAC;QAC1F,KAAK,MAAM;YACT,OAAO,wEAAwE,CAAC;QAClF;YACE,OAAO,8EAA8E,CAAC;IAC1F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA0B,OAAO,CAAC,GAAG;IACrE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,wEAAwE;QACxE,IAAI,CAAC,CAAC,mBAAmB,IAAI,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,QAAQ,GAAsB,EAAE,GAAG,IAAI,EAAE,CAAC;QAChD,OAAO,QAAQ,CAAC,iBAAiB,CAAC;QAClC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,8EAA8E;IAC9E,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,IAAI,GAAsB,EAAE,GAAG,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC;IACpE,6DAA6D;IAC7D,sEAAsE;IACtE,6EAA6E;IAC7E,IACE,4BAA4B,CAAC,IAAI,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EACtC,CAAC;QACD,IAAI,CAAC,iBAAiB,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,kDAAkD;QACpD,CAAC,CAAC,0EAA0E,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,4BAA4B,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,6BAA6B,uBAAuB,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACtF,CAAC;IACD,OAAO,CACL,kFAAkF;QAClF,gEAAgE,CACjE,CAAC;AACJ,CAAC;AA6BD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAA0B,CAAC;AAElE,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAGlC,CAAC;QACF,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAA8B;IAE9B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,CAAC,KAAK,eAAe,IAAI,CAAC,KAAK,eAAe,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACtE,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAA+B,EAC/B,SAAkB;IAElB,IAAI,UAAU,KAAK,eAAe;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC;IAClF,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,qBAAqB,CAAC,IAAmB;IACvD,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,2EAA2E;QAC7E,CAAC,CAAC,2EAA2E,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAmB,EACnB,OAA0B,OAAO,CAAC,GAAG;IAErC,MAAM,IAAI,GAAsB,EAAE,GAAG,IAAI,EAAE,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,GAAG;YAAE,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,uEAAuE;IACvE,OAAO,IAAI,CAAC,cAAc,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"provider-auth.js","sourceRoot":"","sources":["../src/provider-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAKrD;;;;;;;;;;GAUG;AACH,IAAI,oBAAoB,GAAkB,IAAI,CAAC;AAE/C,kEAAkE;AAClE,MAAM,UAAU,mCAAmC;IACjD,oBAAoB,GAAG,IAAI,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,OAAO,IAAI,oBAAoB,IAAI,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5E,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC;AAChE,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,uBAAuB,CACrC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjE,OAAO,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,8BAAuC,CAAC;AAU7E;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAClC,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,aAAa;QAAE,OAAO,aAAa,CAAC;IACrE,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAChC,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,OAAO,eAAe,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;AAC5C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CAAC,IAAqB;IAC3D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,kFAAkF,CAAC;QAC5F,KAAK,OAAO;YACV,OAAO,0EAA0E,CAAC;QACpF,KAAK,aAAa;YAChB,OAAO,gFAAgF,CAAC;QAC1F,KAAK,MAAM;YACT,OAAO,wEAAwE,CAAC;QAClF;YACE,OAAO,8EAA8E,CAAC;IAC1F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA0B,OAAO,CAAC,GAAG;IACrE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,wEAAwE;QACxE,IAAI,CAAC,CAAC,mBAAmB,IAAI,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,QAAQ,GAAsB,EAAE,GAAG,IAAI,EAAE,CAAC;QAChD,OAAO,QAAQ,CAAC,iBAAiB,CAAC;QAClC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,8EAA8E;IAC9E,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,IAAI,GAAsB,EAAE,GAAG,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC;IACpE,6DAA6D;IAC7D,sEAAsE;IACtE,6EAA6E;IAC7E,IACE,4BAA4B,CAAC,IAAI,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EACtC,CAAC;QACD,IAAI,CAAC,iBAAiB,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,kDAAkD;QACpD,CAAC,CAAC,0EAA0E,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,4BAA4B,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,6BAA6B,uBAAuB,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACtF,CAAC;IACD,OAAO,CACL,kFAAkF;QAClF,gEAAgE,CACjE,CAAC;AACJ,CAAC;AA2BD,MAAM,CAAC,MAAM,wBAAwB,GAAG,iCAA0C,CAAC;AAEnF,qEAAqE;AACrE,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAA4B,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,OAAO,CAAC,KAAK,cAAc,IAAI,CAAC,KAAK,cAAc,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC;AAChG,CAAC;AAcD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,IAAiC;IAEjC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAClC,6BAA6B,EAC7B,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,QAAQ,CACd,CAAC;IACF,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA0B,OAAO,CAAC,GAAG,EACrC,SAAuC;IAEvC,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IACpE,0EAA0E;IAC1E,4EAA4E;IAC5E,gEAAgE;IAChE,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,GAAG,wBAAwB,uEAAuE,CACnG,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,8BAA8B,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,iCAAiC,6BAA6B,6BAA6B,CAC5F,CAAC;IACJ,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,yBAAyB;IACzB,oBAAoB,GAAG,GAAG,CAAC;IAC3B,OAAO,EAAE,GAAG,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC;AAC7C,CAAC;AA6BD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAA0B,CAAC;AAElE,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAGlC,CAAC;QACF,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAA8B;IAE9B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,CAAC,KAAK,eAAe,IAAI,CAAC,KAAK,eAAe,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACtE,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAA+B,EAC/B,SAAkB;IAElB,IAAI,UAAU,KAAK,eAAe;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC;IAClF,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,qBAAqB,CAAC,IAAmB;IACvD,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,2EAA2E;QAC7E,CAAC,CAAC,2EAA2E,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAmB,EACnB,OAA0B,OAAO,CAAC,GAAG;IAErC,MAAM,IAAI,GAAsB,EAAE,GAAG,IAAI,EAAE,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,GAAG;YAAE,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,uEAAuE;IACvE,OAAO,IAAI,CAAC,cAAc,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC"}