@tokenfactory/acc-runner 0.47.7 → 0.47.8

package/dist/program.js.map

@@ -1 +1 @@
-{"version":3,"file":"program.js","sourceRoot":"","sources":["../src/program.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAwB,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE9D,OAAO,EAAE,oCAAoC,EAAE,MAAM,iCAAiC,CAAC;AACvF,OAAO,EAAE,uCAAuC,EAAE,MAAM,oCAAoC,CAAC;AAE7F,0EAA0E;AAC1E,MAAM,kBAAkB,GACtB,4CAA4C,YAAY,KAAK;IAC7D,sEAAsE,CAAC;AAEzE,mFAAmF;AACnF,SAAS,KAAK,CAAC,EAA0B;IACvC,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,EAA0B;IAC7C,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;QACtB,MAAM,qBAAqB,EAAE,CAAC;QAC9B,MAAM,EAAE,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,MAAM,UAAU,YAAY,CAAC,UAA+B,EAAE;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IACpD,MAAM,OAAO,GAAG,SAAS,KAAK,KAAK,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,SAAS,CAAC;SACf,WAAW,CACV,OAAO;QACL,CAAC,CAAC,yFAAyF;QAC3F,CAAC,CAAC,mHAAmH,CACxH;SACA,OAAO,CAAC,GAAG,eAAe,eAAe,gBAAgB,GAAG,CAAC,CAAC;IAEjE,2EAA2E;IAC3E,qEAAqE;IACrE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE;QACnD,mBAAmB,CAAE,aAAa,CAAC,IAAI,EAA4B,CAAC,QAAQ,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,kBAAkB,GAAG,CAAC,MAAe,EAAE,KAAyB,EAAE,EAAE;QACxE,MAAM;aACH,OAAO,CAAC,OAAO,CAAC;aAChB,WAAW,CAAC,sEAAsE,CAAC;aACnF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM;aACH,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;aACrB,WAAW,CAAC,yCAAyC,CAAC;aACtD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM;aACH,OAAO,CAAC,QAAQ,CAAC;aACjB,WAAW,CAAC,mEAAmE,CAAC;aAChF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sDAAsD,CAAC,CAAC;IACvE,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAElD,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,CAAC,MAAe,EAAE,EAAE;QAC9C,MAAM;aACH,OAAO,CAAC,OAAO,CAAC;aAChB,WAAW,CAAC,0DAA0D,CAAC;aACvE,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;aAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QACvC,MAAM;aACH,OAAO,CAAC,QAAQ,CAAC;aACjB,WAAW,CAAC,uDAAuD,CAAC;aACpE,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;aAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,mBAAmB,CACjB,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wDAAwD,CAAC,CACzE,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,6EAA6E;IAC7E,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,8CAA8C,CAAC,CAAC;IAE/D,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,mBAAmB,EAAE,+CAA+C,CAAC;SAC5E,MAAM,CAAC,eAAe,EAAE,wCAAwC,CAAC;SACjE,MAAM,CAAC,aAAa,EAAE,oCAAoC,CAAC;SAC3D,MAAM,CAAC,QAAQ,EAAE,mCAAmC,CAAC;SACrD,MAAM,CAAC,CAAC,IAAqB,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAEjF,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,wBAAwB,CAAC;SACrC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;SACzC,MAAM,CAAC,QAAQ,EAAE,kCAAkC,CAAC;SACpD,MAAM,CAAC,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAC/C,WAAW,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,CAC/C,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,mEAAmE,CAAC;SAChF,QAAQ,CAAC,cAAc,EAAE,gDAAgD,CAAC;SAC1E,MAAM,CAAC,qBAAqB,EAAE,oCAAoC,CAAC;SACnE,MAAM,CAAC,QAAQ,EAAE,gDAAgD,CAAC;SAClE,MAAM,CAAC,CAAC,KAAe,EAAE,IAAiB,EAAE,EAAE,CAC7C,WAAW,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,CACpD,CAAC;IAEJ,6EAA6E;IAC7E,8EAA8E;IAC9E,kEAAkE;IAClE,+EAA+E;IAC/E,oDAAoD;IACpD,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gEAAgE,CAAC,CAAC;IAEjF,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,+DAA+D,CAAC;SAC5E,QAAQ,CAAC,QAAQ,EAAE,2CAA2C,CAAC;SAC/D,MAAM,CAAC,eAAe,EAAE,qDAAqD,CAAC;SAC9E,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC;SAC7D,MAAM,CAAC,CAAC,QAAgB,EAAE,IAAyC,EAAE,EAAE,CACtE,WAAW,CAAC,GAAG,EAAE,CACf,mBAAmB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAC1E,EAAE,CACJ,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,QAAQ,EAAE,mCAAmC,CAAC;SACrD,MAAM,CAAC,CAAC,IAAwB,EAAE,EAAE,CACnC,WAAW,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAChE,CAAC;IAEJ,6EAA6E;IAC7E,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,8DAA8D;QAC9D,kEAAkE;QAClE,kCAAkC;QAClC,MAAM,YAAY,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,YAAY,EAAE,CAAC;QACrB,8DAA8D;QAC9D,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CACH,CAAC;IAEJ,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,YAAY,GAAG,OAAO;SACzB,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,0EAA0E,CAAC;SACvF,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChC,kEAAkE;QAClE,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CACH,CAAC;IAEJ,YAAY;SACT,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;IAEjD,YAAY;SACT,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC;IAElD,YAAY;SACT,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,mCAAmC,CAAC;SAChD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;IAEpD,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,gCAAgC;IAChC,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,qEAAqE,CAAC;SAClF,QAAQ,CAAC,SAAS,EAAE,mEAAmE,CAAC;SACxF,MAAM,CAAC,OAAO,EAAE,oEAAoE,CAAC;SACrF,MAAM,CAAC,iBAAiB,EAAE,qCAAqC,CAAC;SAChE,MAAM,CAAC,CAAC,KAAyB,EAAE,IAAwC,EAAE,EAAE,CAC9E,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAChF,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,2DAA2D,CAAC;SACxE,MAAM,CACL,UAAU,EACV,uFAAuF,CACxF;SACA,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,IAA0B,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,MAAM,aAAa,GAAG,OAAO;SAC1B,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,mEAAmE,CAAC,CAAC;IACpF,aAAa;SACV,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,4EAA4E,CAAC;SACzF,QAAQ,CAAC,WAAW,EAAE,uCAAuC,CAAC;SAC9D,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,oCAAoC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3F,aAAa;SACV,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,yEAAyE,CAAC;SACtF,QAAQ,CAAC,gBAAgB,EAAE,+CAA+C,CAAC;SAC3E,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CAAC,CAAC,WAAmB,EAAE,EAAE,CAC9B,KAAK,CAAC,GAAG,EAAE,CAAC,uCAAuC,CAAC,WAAW,CAAC,CAAC,EAAE,CACpE,CAAC;IAEJ,yEAAyE;IACzE,+EAA+E;IAC/E,gFAAgF;IAChF,gFAAgF;IAChF,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,gFAAgF,CACjF;SACA,cAAc,CAAC,aAAa,EAAE,gDAAgD,CAAC;SAC/E,cAAc,CAAC,mBAAmB,EAAE,uDAAuD,CAAC;SAC5F,MAAM,CAAC,kBAAkB,EAAE,oDAAoD,CAAC;SAChF,MAAM,CAAC,CAAC,IAA4D,EAAE,EAAE,CACvE,KAAK,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CACpC,CAAC;IAEJ,6EAA6E;IAC7E,+EAA+E;IAC/E,8DAA8D;IAC9D,MAAM,aAAa,GAAG,OAAO;SAC1B,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,+CAA+C,CAAC,CAAC;IAEhE,aAAa;SACV,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,CAAC,GAAG,MAAM,aAAa,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;QAC5C,iEAAiE;QACjE,qEAAqE;QACrE,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,WAAW,oCAAoC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,4BAA4B,CAAC,CAAC,KAAK,sBAAsB,SAAS,sBAAsB;YACtF,8EAA8E;YAC9E,8DAA8D,CACjE,CACF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CACH,CAAC;IAEJ,aAAa;SACV,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,iEAAiE,CAAC;SAC9E,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,eAAe,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CACT,gFAAgF;YAC9E,4FAA4F,CAC/F,CACF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEJ,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,cAAc,GAAG,OAAO;SAC3B,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,wEAAwE,CAAC,CAAC;IAEzF,cAAc;SACX,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0BAA0B,CAAC;SACvC,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,CAAC,GAAG,MAAM,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,4BAA4B,CAAC,CAAC,KAAK,sBAAsB,SAAS,yBAAyB;YACzF,mCAAmC,CACtC,CACF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CACH,CAAC;IAEJ,cAAc;SACX,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,4EAA4E,CAAC;SACzF,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,gBAAgB,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAC9E,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEJ,wEAAwE;IACxE,+EAA+E;IAC/E,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,2BAA2B;IAC3B,OAAO;SACJ,OAAO,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAC7C,WAAW,CAAC,iEAAiE,CAAC;SAC9E,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC9B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2EAA2E;YAC3E,sEAAsE;YACtE,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,MAAM,CAAC,0CAA2C,GAAa,CAAC,OAAO,EAAE,CAAC,CACjF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,iGAAiG,CAClG;SACA,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,wBAAwB,CAAC,UAAU,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,wBAAwB,CAAC,WAAW,EAAE,CAAC,CAAC;QAE/E,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,qEAAqE;QACrE,+CAA+C;QAC/C,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,gBAAgB,EAAE,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CACT,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,SAAS,sCAAsC,CAC9G,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,OAAO,EAAE,WAAW,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,MAAM;gBACxG,uEAAuE,CAC1E,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACzF,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"program.js","sourceRoot":"","sources":["../src/program.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,eAAe,EAAwB,MAAM,qBAAqB,CAAC;AACzH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE9D,OAAO,EAAE,oCAAoC,EAAE,MAAM,iCAAiC,CAAC;AACvF,OAAO,EAAE,uCAAuC,EAAE,MAAM,oCAAoC,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,kBAAkB,GACtB,4CAA4C,YAAY,KAAK;IAC7D,sEAAsE,CAAC;AAEzE,mFAAmF;AACnF,SAAS,KAAK,CAAC,EAA0B;IACvC,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,EAA0B;IAC7C,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;QACtB,MAAM,qBAAqB,EAAE,CAAC;QAC9B,MAAM,EAAE,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,MAAM,UAAU,YAAY,CAAC,UAA+B,EAAE;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IACpD,MAAM,OAAO,GAAG,SAAS,KAAK,KAAK,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,SAAS,CAAC;SACf,WAAW,CACV,OAAO;QACL,CAAC,CAAC,yFAAyF;QAC3F,CAAC,CAAC,mHAAmH,CACxH;SACA,OAAO,CAAC,GAAG,eAAe,eAAe,gBAAgB,GAAG,CAAC,CAAC;IAEjE,2EAA2E;IAC3E,qEAAqE;IACrE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE;QACnD,mBAAmB,CAAE,aAAa,CAAC,IAAI,EAA4B,CAAC,QAAQ,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,kBAAkB,GAAG,CAAC,MAAe,EAAE,KAAyB,EAAE,EAAE;QACxE,MAAM;aACH,OAAO,CAAC,OAAO,CAAC;aAChB,WAAW,CAAC,sEAAsE,CAAC;aACnF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM;aACH,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;aACrB,WAAW,CAAC,yCAAyC,CAAC;aACtD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM;aACH,OAAO,CAAC,QAAQ,CAAC;aACjB,WAAW,CAAC,mEAAmE,CAAC;aAChF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sDAAsD,CAAC,CAAC;IACvE,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAElD,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,CAAC,MAAe,EAAE,EAAE;QAC9C,MAAM;aACH,OAAO,CAAC,OAAO,CAAC;aAChB,WAAW,CAAC,0DAA0D,CAAC;aACvE,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;aAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QACvC,MAAM;aACH,OAAO,CAAC,QAAQ,CAAC;aACjB,WAAW,CAAC,uDAAuD,CAAC;aACpE,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;aAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,mBAAmB,CACjB,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wDAAwD,CAAC,CACzE,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,6EAA6E;IAC7E,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,8CAA8C,CAAC,CAAC;IAE/D,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,mBAAmB,EAAE,+CAA+C,CAAC;SAC5E,MAAM,CAAC,eAAe,EAAE,wCAAwC,CAAC;SACjE,MAAM,CAAC,aAAa,EAAE,oCAAoC,CAAC;SAC3D,MAAM,CAAC,QAAQ,EAAE,mCAAmC,CAAC;SACrD,MAAM,CAAC,CAAC,IAAqB,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAEjF,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,wBAAwB,CAAC;SACrC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;SACzC,MAAM,CAAC,QAAQ,EAAE,kCAAkC,CAAC;SACpD,MAAM,CAAC,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAC/C,WAAW,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,CAC/C,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,2HAA2H,CAAC;SACxI,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;SACzC,MAAM,CAAC,QAAQ,EAAE,yCAAyC,CAAC;SAC3D,MAAM,CAAC,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAC/C,WAAW,CAAC,GAAG,EAAE,CAAC,0BAA0B,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,CAC1D,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,mEAAmE,CAAC;SAChF,QAAQ,CAAC,cAAc,EAAE,gDAAgD,CAAC;SAC1E,MAAM,CAAC,qBAAqB,EAAE,oCAAoC,CAAC;SACnE,MAAM,CAAC,QAAQ,EAAE,gDAAgD,CAAC;SAClE,MAAM,CAAC,CAAC,KAAe,EAAE,IAAiB,EAAE,EAAE,CAC7C,WAAW,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,CACpD,CAAC;IAEJ,6EAA6E;IAC7E,8EAA8E;IAC9E,kEAAkE;IAClE,+EAA+E;IAC/E,oDAAoD;IACpD,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gEAAgE,CAAC,CAAC;IAEjF,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,+DAA+D,CAAC;SAC5E,QAAQ,CAAC,QAAQ,EAAE,2CAA2C,CAAC;SAC/D,MAAM,CAAC,eAAe,EAAE,qDAAqD,CAAC;SAC9E,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC;SAC7D,MAAM,CAAC,CAAC,QAAgB,EAAE,IAAyC,EAAE,EAAE,CACtE,WAAW,CAAC,GAAG,EAAE,CACf,mBAAmB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAC1E,EAAE,CACJ,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,QAAQ,EAAE,mCAAmC,CAAC;SACrD,MAAM,CAAC,CAAC,IAAwB,EAAE,EAAE,CACnC,WAAW,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAChE,CAAC;IAEJ,6EAA6E;IAC7E,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,8DAA8D;QAC9D,kEAAkE;QAClE,kCAAkC;QAClC,MAAM,YAAY,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,YAAY,EAAE,CAAC;QACrB,8DAA8D;QAC9D,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CACH,CAAC;IAEJ,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,YAAY,GAAG,OAAO;SACzB,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,0EAA0E,CAAC;SACvF,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChC,kEAAkE;QAClE,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CACH,CAAC;IAEJ,YAAY;SACT,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;IAEjD,YAAY;SACT,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC;IAElD,YAAY;SACT,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,mCAAmC,CAAC;SAChD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;IAEpD,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,gCAAgC;IAChC,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,qEAAqE,CAAC;SAClF,QAAQ,CAAC,SAAS,EAAE,mEAAmE,CAAC;SACxF,MAAM,CAAC,OAAO,EAAE,oEAAoE,CAAC;SACrF,MAAM,CAAC,iBAAiB,EAAE,qCAAqC,CAAC;SAChE,MAAM,CAAC,CAAC,KAAyB,EAAE,IAAwC,EAAE,EAAE,CAC9E,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAChF,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,2DAA2D,CAAC;SACxE,MAAM,CACL,UAAU,EACV,uFAAuF,CACxF;SACA,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,IAA0B,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,8EAA8E;IAC9E,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,YAAY,GAAG,OAAO;SACzB,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,wEAAwE,CAAC,CAAC;IACzF,YAAY;SACT,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,kFAAkF,CAAC;SAC/F,MAAM,CACL,iBAAiB,EACjB,iDAAiD,UAAU,4BAA4B,CACxF;SACA,MAAM,CAAC,aAAa,EAAE,uEAAuE,CAAC;SAC9F,MAAM,CAAC,CAAC,IAA6C,EAAE,EAAE,CACxD,KAAK,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAChG,CAAC;IAEJ,MAAM,aAAa,GAAG,OAAO;SAC1B,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,mEAAmE,CAAC,CAAC;IACpF,aAAa;SACV,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,4EAA4E,CAAC;SACzF,QAAQ,CAAC,WAAW,EAAE,uCAAuC,CAAC;SAC9D,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,oCAAoC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3F,aAAa;SACV,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,yEAAyE,CAAC;SACtF,QAAQ,CAAC,gBAAgB,EAAE,+CAA+C,CAAC;SAC3E,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CAAC,CAAC,WAAmB,EAAE,EAAE,CAC9B,KAAK,CAAC,GAAG,EAAE,CAAC,uCAAuC,CAAC,WAAW,CAAC,CAAC,EAAE,CACpE,CAAC;IAEJ,yEAAyE;IACzE,+EAA+E;IAC/E,gFAAgF;IAChF,gFAAgF;IAChF,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,gFAAgF,CACjF;SACA,cAAc,CAAC,aAAa,EAAE,gDAAgD,CAAC;SAC/E,cAAc,CAAC,mBAAmB,EAAE,uDAAuD,CAAC;SAC5F,MAAM,CAAC,kBAAkB,EAAE,oDAAoD,CAAC;SAChF,MAAM,CAAC,CAAC,IAA4D,EAAE,EAAE,CACvE,KAAK,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CACpC,CAAC;IAEJ,6EAA6E;IAC7E,+EAA+E;IAC/E,8DAA8D;IAC9D,MAAM,aAAa,GAAG,OAAO;SAC1B,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,+CAA+C,CAAC,CAAC;IAEhE,aAAa;SACV,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,CAAC,GAAG,MAAM,aAAa,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;QAC5C,iEAAiE;QACjE,qEAAqE;QACrE,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,WAAW,oCAAoC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,4BAA4B,CAAC,CAAC,KAAK,sBAAsB,SAAS,sBAAsB;YACtF,8EAA8E;YAC9E,8DAA8D,CACjE,CACF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CACH,CAAC;IAEJ,aAAa;SACV,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,iEAAiE,CAAC;SAC9E,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,eAAe,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CACT,gFAAgF;YAC9E,4FAA4F,CAC/F,CACF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEJ,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,cAAc,GAAG,OAAO;SAC3B,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,wEAAwE,CAAC,CAAC;IAEzF,cAAc;SACX,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0BAA0B,CAAC;SACvC,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,CAAC,GAAG,MAAM,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,4BAA4B,CAAC,CAAC,KAAK,sBAAsB,SAAS,yBAAyB;YACzF,mCAAmC,CACtC,CACF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CACH,CAAC;IAEJ,cAAc;SACX,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,4EAA4E,CAAC;SACzF,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,gBAAgB,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAC9E,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEJ,wEAAwE;IACxE,+EAA+E;IAC/E,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,2BAA2B;IAC3B,OAAO;SACJ,OAAO,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAC7C,WAAW,CAAC,iEAAiE,CAAC;SAC9E,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC9B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2EAA2E;YAC3E,sEAAsE;YACtE,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,MAAM,CAAC,0CAA2C,GAAa,CAAC,OAAO,EAAE,CAAC,CACjF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,iGAAiG,CAClG;SACA,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,wBAAwB,CAAC,UAAU,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,wBAAwB,CAAC,WAAW,EAAE,CAAC,CAAC;QAE/E,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,qEAAqE;QACrE,+CAA+C;QAC/C,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,gBAAgB,EAAE,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CACT,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,SAAS,sCAAsC,CAC9G,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,OAAO,EAAE,WAAW,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,MAAM;gBACxG,uEAAuE,CAC1E,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACzF,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/remote-ops/command.d.ts

@@ -0,0 +1,7 @@
+export interface RemoteOpsServeOptions {
+    listen?: string;
+    readOnly?: boolean;
+}
+/** Start the listener and resolve only when it closes (long-running). */
+export declare function remoteOpsServeCommand(opts?: RemoteOpsServeOptions): Promise<void>;
+//# sourceMappingURL=command.d.ts.map

package/dist/remote-ops/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/remote-ops/command.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,yEAAyE;AACzE,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBrF"}

package/dist/remote-ops/command.js

@@ -0,0 +1,34 @@
+/**
+ * RUNNER-REMOTE-OPS-2 — `acc-runner remote-ops serve`. Long-running; binds the
+ * loopback remote-ops listener. The operator fronts it with an SSH tunnel /
+ * reverse proxy and registers that URL in the server's
+ * ACC_RUNNER_REMOTE_OPS_URLS; this process never listens on a routable iface.
+ */
+import { REMOTE_OPS_DEFAULT_PORT, REMOTE_OPS_HOST, createRemoteOpsServer, } from "./daemon.js";
+function describe(binding) {
+    if (binding.socketPath)
+        return `unix:${binding.socketPath}`;
+    return `${binding.host ?? REMOTE_OPS_HOST}:${binding.port ?? REMOTE_OPS_DEFAULT_PORT}`;
+}
+/** Start the listener and resolve only when it closes (long-running). */
+export function remoteOpsServeCommand(opts = {}) {
+    const { server, binding } = createRemoteOpsServer({
+        listen: opts.listen,
+        readOnly: opts.readOnly,
+    });
+    return new Promise((resolve, reject) => {
+        server.on("error", reject);
+        server.on("close", resolve);
+        const onListening = () => {
+            process.stderr.write(`acc-runner remote-ops listening on ${describe(binding)} ` +
+                `(allowlisted verbs only — not a shell)\n`);
+        };
+        if (binding.socketPath) {
+            server.listen(binding.socketPath, onListening);
+        }
+        else {
+            server.listen(binding.port, binding.host, onListening);
+        }
+    });
+}
+//# sourceMappingURL=command.js.map

package/dist/remote-ops/command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../../src/remote-ops/command.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,qBAAqB,GAEtB,MAAM,aAAa,CAAC;AAErB,SAAS,QAAQ,CAAC,OAAyB;IACzC,IAAI,OAAO,CAAC,UAAU;QAAE,OAAO,QAAQ,OAAO,CAAC,UAAU,EAAE,CAAC;IAC5D,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,eAAe,IAAI,OAAO,CAAC,IAAI,IAAI,uBAAuB,EAAE,CAAC;AACzF,CAAC;AAOD,yEAAyE;AACzE,MAAM,UAAU,qBAAqB,CAAC,OAA8B,EAAE;IACpE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,qBAAqB,CAAC;QAChD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;IACH,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,GAAG,EAAE;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,QAAQ,CAAC,OAAO,CAAC,GAAG;gBACxD,0CAA0C,CAC7C,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/remote-ops/daemon.d.ts

@@ -0,0 +1,62 @@
+import { type Server } from "node:http";
+/** Default loopback address — never a routable interface. */
+export declare const REMOTE_OPS_HOST: "127.0.0.1";
+export declare const REMOTE_OPS_DEFAULT_PORT = 8787;
+export declare const REMOTE_OPS_TIMEOUT_MS = 30000;
+export declare const REMOTE_OPS_MAX_OUTPUT: number;
+export declare const READ_ONLY_MODE_ENV = "ACC_RUNNER_REMOTE_OPS_MODE";
+export declare const TOKEN_ENV = "ACC_RUNNER_REMOTE_OPS_TOKEN";
+export declare const LISTEN_ENV = "ACC_RUNNER_REMOTE_OPS_LISTEN";
+type Raw = Record<string, unknown>;
+/** Minimal result shape the injected executor must return. */
+export interface ExecResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+export type RemoteOpsExec = (file: string, args: string[]) => Promise<ExecResult>;
+export interface RemoteOpsHandlerDeps {
+    /** Executor. Default: execa with shell:false + timeout + reject:false (a
+     *  non-zero exit becomes structured output, not a throw). */
+    exec?: RemoteOpsExec;
+    /** Host-local ceiling. Default: ACC_RUNNER_REMOTE_OPS_MODE === "read-only"
+     *  disables every mutating verb regardless of the forwarded grant. */
+    readOnly?: boolean;
+}
+export interface RemoteOpsHttpResult {
+    status: number;
+    body: Raw;
+}
+/**
+ * Validate, grant-gate and execute one remote-ops request body. Pure except for
+ * the injected `exec`, so every refusal path and the resolved argv are unit
+ * testable without a socket. `grant` is the capability the server forwards
+ * (it already grant-gated the caller); honoured defensively — a mutate verb
+ * with a read-only grant is refused, and the host-local `readOnly` ceiling
+ * applies regardless. An invalid grant on a mutating verb is treated as refused.
+ */
+export declare function handleRemoteOpsRequest(body: unknown, deps?: RemoteOpsHandlerDeps): Promise<RemoteOpsHttpResult>;
+export interface RemoteOpsServerOptions extends RemoteOpsHandlerDeps {
+    /** `host:port`, `:port`, or a unix socket path. Default:
+     *  ACC_RUNNER_REMOTE_OPS_LISTEN, else 127.0.0.1:8787. */
+    listen?: string;
+    /** Log sink. Default: one JSON line to stderr. Never sees the body/output. */
+    log?: (entry: Raw) => void;
+}
+export interface RemoteOpsBinding {
+    host?: string;
+    port?: number;
+    socketPath?: string;
+}
+export declare function isLoopbackHost(host: string): boolean;
+/** Parse the listen spec into node `server.listen` arguments. Throws
+ *  `remote_ops_listen_not_loopback` for any TCP host that is not loopback. */
+export declare function parseListenSpec(spec: string | undefined): RemoteOpsBinding;
+/** Build (not start) the loopback listener; call `.listen()` to bind. Returns
+ *  the node Server + resolved binding so a caller/test can read the address. */
+export declare function createRemoteOpsServer(opts?: RemoteOpsServerOptions): {
+    server: Server;
+    binding: RemoteOpsBinding;
+};
+export {};
+//# sourceMappingURL=daemon.d.ts.map

package/dist/remote-ops/daemon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../src/remote-ops/daemon.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAKjG,6DAA6D;AAC7D,eAAO,MAAM,eAAe,EAAG,WAAoB,CAAC;AACpD,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAC5C,eAAO,MAAM,qBAAqB,QAAY,CAAC;AAE/C,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAC/D,eAAO,MAAM,SAAS,gCAAgC,CAAC;AACvD,eAAO,MAAM,UAAU,iCAAiC,CAAC;AAEzD,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC,8DAA8D;AAC9D,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAElF,MAAM,WAAW,oBAAoB;IACnC;iEAC6D;IAC7D,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB;0EACsE;IACtE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,GAAG,CAAC;CACX;AAkBD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,OAAO,EACb,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAiC9B;AAiCD,MAAM,WAAW,sBAAuB,SAAQ,oBAAoB;IAClE;6DACyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAQD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;8EAC8E;AAC9E,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,CAqB1E;AAED;gFACgF;AAChF,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,sBAA2B,GAAG;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,gBAAgB,CAAC;CAC3B,CAwCA"}

package/dist/remote-ops/daemon.js

@@ -0,0 +1,192 @@
+/**
+ * RUNNER-REMOTE-OPS-2 — the host-side listener.
+ *
+ * A small loopback (or unix-socket) HTTP listener the runner host exposes. The
+ * server half (PR #3307) POSTs `{ runner_id, host, command }` (optionally with a
+ * `grant`) to the URL an operator registers in `ACC_RUNNER_REMOTE_OPS_URLS`;
+ * this listener re-validates the verb, honours the grant, maps the verb to a
+ * fixed argv and returns structured output. Explicitly NOT a web shell: no
+ * command string in the request, nothing ever handed to a shell.
+ *
+ * Trust model: binds 127.0.0.1 (or a unix socket) by DEFAULT, never a routable
+ * interface — remote reach is an operator's SSH tunnel / reverse proxy, not this
+ * listener's job. An optional ACC_RUNNER_REMOTE_OPS_TOKEN is enforced as a
+ * Bearer when set. Never logs the request body, grant, env or command output
+ * (only verb + runner_id + host + status), so a credential stuffed in a field or
+ * printed by a child can never reach the daemon log.
+ */
+import { createHash, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { execa } from "execa";
+import { runnerRemoteCapability, validateHostRunnerRemoteCommand } from "./validate.js";
+import { resolveRemoteOpsInvocation } from "./invocation.js";
+/** Default loopback address — never a routable interface. */
+export const REMOTE_OPS_HOST = "127.0.0.1";
+export const REMOTE_OPS_DEFAULT_PORT = 8787; // when LISTEN_ENV is unset
+export const REMOTE_OPS_TIMEOUT_MS = 30_000; // per-verb wall-clock cap
+export const REMOTE_OPS_MAX_OUTPUT = 64 * 1024; // clip chatty child output
+export const READ_ONLY_MODE_ENV = "ACC_RUNNER_REMOTE_OPS_MODE";
+export const TOKEN_ENV = "ACC_RUNNER_REMOTE_OPS_TOKEN";
+export const LISTEN_ENV = "ACC_RUNNER_REMOTE_OPS_LISTEN";
+const clip = (s) => s.length > REMOTE_OPS_MAX_OUTPUT ? `${s.slice(0, REMOTE_OPS_MAX_OUTPUT)}\n…[truncated]` : s;
+const defaultExec = async (file, args) => {
+    const r = await execa(file, args, {
+        timeout: REMOTE_OPS_TIMEOUT_MS,
+        reject: false,
+        env: process.env,
+    });
+    return {
+        exitCode: typeof r.exitCode === "number" ? r.exitCode : 1,
+        stdout: clip(r.stdout ?? ""),
+        stderr: clip(r.stderr ?? ""),
+    };
+};
+/**
+ * Validate, grant-gate and execute one remote-ops request body. Pure except for
+ * the injected `exec`, so every refusal path and the resolved argv are unit
+ * testable without a socket. `grant` is the capability the server forwards
+ * (it already grant-gated the caller); honoured defensively — a mutate verb
+ * with a read-only grant is refused, and the host-local `readOnly` ceiling
+ * applies regardless. An invalid grant on a mutating verb is treated as refused.
+ */
+export async function handleRemoteOpsRequest(body, deps = {}) {
+    // The server (#3307) forwards `{ runner_id, host, command, grant }` — `grant` is
+    // the capability it checked the caller against and is REQUIRED for a mutating
+    // verb (see below); the verb lives under `command` (fall back to the bare body
+    // for a flat payload).
+    const envelope = (body ?? {});
+    const command = validateHostRunnerRemoteCommand(envelope.command ?? body);
+    if (!command) {
+        return { status: 400, body: { ok: false, error: "unsupported_runner_remote_command" } };
+    }
+    const capability = runnerRemoteCapability(command.verb);
+    const readOnly = deps.readOnly ?? process.env[READ_ONLY_MODE_ENV]?.trim().toLowerCase() === "read-only";
+    if (capability === "mutate" && readOnly) {
+        return { status: 403, body: { ok: false, error: "host_read_only_mode" } };
+    }
+    // The server (#3307) forwards the grant it checked the caller against. A
+    // mutating verb runs ONLY with an explicit `mutate` grant: a read grant, a
+    // malformed grant and an ABSENT grant are all refused, so an envelope that
+    // skipped the server's grant gate cannot mutate the host.
+    const grant = typeof envelope.grant === "string" ? envelope.grant : undefined;
+    if (capability === "mutate" && grant !== "mutate") {
+        return { status: 403, body: { ok: false, error: "mutate_grant_required" } };
+    }
+    const { file, args } = resolveRemoteOpsInvocation(command);
+    const { exitCode, stdout, stderr } = await (deps.exec ?? defaultExec)(file, args);
+    return {
+        status: 200,
+        body: { ok: true, verb: command.verb, capability, exit_code: exitCode, stdout, stderr },
+    };
+}
+/** Read a request body up to a small cap (requests are tiny JSON objects). */
+function readBody(req, limit = 16_384) {
+    return new Promise((resolve, reject) => {
+        let data = "";
+        let over = false;
+        req.on("data", (chunk) => {
+            if (over)
+                return;
+            data += chunk;
+            if (data.length > limit) {
+                over = true;
+                reject(new Error("request_too_large"));
+            }
+        });
+        req.on("end", () => !over && resolve(data));
+        req.on("error", reject);
+    });
+}
+/** Constant-time bearer check against the optional shared secret: both sides
+ *  are hashed to a fixed length first, so neither the comparison nor the length
+ *  check leaks how much of the presented token matched. */
+function authorized(req) {
+    const expected = process.env[TOKEN_ENV]?.trim();
+    if (!expected)
+        return true; // no token configured ⇒ loopback is the only gate
+    const header = String(req.headers.authorization ?? "").replace(/^Bearer\s+/i, "").trim();
+    if (header.length === 0)
+        return false;
+    const a = createHash("sha256").update(header).digest();
+    const b = createHash("sha256").update(expected).digest();
+    return timingSafeEqual(a, b);
+}
+/** The only TCP hosts the listener will bind: loopback. A routable interface
+ *  (0.0.0.0, ::, a LAN address, a hostname) is refused outright — the trust
+ *  model is "loopback or a unix socket, fronted by an operator-managed tunnel",
+ *  never a port the network can reach. */
+const LOOPBACK_HOSTS = new Set(["127.0.0.1", "::1", "localhost", "[::1]"]);
+export function isLoopbackHost(host) {
+    return LOOPBACK_HOSTS.has(host.trim().toLowerCase());
+}
+/** Parse the listen spec into node `server.listen` arguments. Throws
+ *  `remote_ops_listen_not_loopback` for any TCP host that is not loopback. */
+export function parseListenSpec(spec) {
+    const value = spec?.trim();
+    if (!value)
+        return { host: REMOTE_OPS_HOST, port: REMOTE_OPS_DEFAULT_PORT };
+    if (value.startsWith("/") || value.startsWith("./") || value.startsWith("unix:")) {
+        return { socketPath: value.replace(/^unix:/, "") };
+    }
+    const idx = value.lastIndexOf(":");
+    if (idx === -1) {
+        // A bare value is a PORT. A bare hostname (`runner.example.net`) is a
+        // misconfiguration, never silently rewritten to loopback: refuse it.
+        if (!/^\d{1,5}$/.test(value)) {
+            throw new Error(`remote_ops_listen_not_loopback: refusing to bind ${value}; use 127.0.0.1:<port>, ::1, a bare port or a unix socket`);
+        }
+        return { host: REMOTE_OPS_HOST, port: Number(value) || REMOTE_OPS_DEFAULT_PORT };
+    }
+    const host = value.slice(0, idx) || REMOTE_OPS_HOST;
+    if (!isLoopbackHost(host)) {
+        throw new Error(`remote_ops_listen_not_loopback: refusing to bind ${host}; use 127.0.0.1, ::1 or a unix socket`);
+    }
+    const port = Number(value.slice(idx + 1)) || REMOTE_OPS_DEFAULT_PORT;
+    return { host, port };
+}
+/** Build (not start) the loopback listener; call `.listen()` to bind. Returns
+ *  the node Server + resolved binding so a caller/test can read the address. */
+export function createRemoteOpsServer(opts = {}) {
+    const binding = parseListenSpec(opts.listen ?? process.env[LISTEN_ENV]);
+    const log = opts.log ?? ((e) => process.stderr.write(`${JSON.stringify(e)}\n`));
+    const server = createServer((req, res) => {
+        void (async () => {
+            const send = (status, obj) => {
+                res.statusCode = status;
+                res.setHeader("Content-Type", "application/json");
+                res.setHeader("Cache-Control", "private, no-store");
+                res.end(JSON.stringify(obj));
+            };
+            try {
+                if (req.method !== "POST")
+                    return send(405, { ok: false, error: "method_not_allowed" });
+                if (!authorized(req))
+                    return send(401, { ok: false, error: "unauthorized" });
+                let parsed;
+                try {
+                    parsed = JSON.parse(await readBody(req));
+                }
+                catch {
+                    return send(400, { ok: false, error: "invalid_json" });
+                }
+                const result = await handleRemoteOpsRequest(parsed, opts);
+                // Log the decision WITHOUT the body or output — never a credential.
+                const p = (parsed ?? {});
+                const cmd = (p.command ?? {});
+                log({
+                    at: new Date().toISOString(),
+                    verb: typeof cmd.verb === "string" ? cmd.verb : null,
+                    runner_id: typeof p.runner_id === "string" ? p.runner_id : null,
+                    host: typeof p.host === "string" ? p.host : null,
+                    status: result.status,
+                });
+                return send(result.status, result.body);
+            }
+            catch (e) {
+                return send(500, { ok: false, error: e instanceof Error ? e.message : "runner_remote_ops_failed" });
+            }
+        })();
+    });
+    return { server, binding };
+}
+//# sourceMappingURL=daemon.js.map

package/dist/remote-ops/daemon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.js","sourceRoot":"","sources":["../../src/remote-ops/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,MAAM,eAAe,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAE7D,6DAA6D;AAC7D,MAAM,CAAC,MAAM,eAAe,GAAG,WAAoB,CAAC;AACpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC,CAAC,2BAA2B;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,CAAC,0BAA0B;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,2BAA2B;AAE3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,CAAC,MAAM,SAAS,GAAG,6BAA6B,CAAC;AACvD,MAAM,CAAC,MAAM,UAAU,GAAG,8BAA8B,CAAC;AA0BzD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CACjC,CAAC,CAAC,MAAM,GAAG,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,WAAW,GAAkB,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IACtD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE;QAChC,OAAO,EAAE,qBAAqB;QAC9B,MAAM,EAAE,KAAK;QACb,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAC5B,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;KAC7B,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAa,EACb,OAA6B,EAAE;IAE/B,iFAAiF;IACjF,8EAA8E;IAC9E,+EAA+E;IAC/E,uBAAuB;IACvB,MAAM,QAAQ,GAAG,CAAC,IAAI,IAAI,EAAE,CAAQ,CAAC;IACrC,MAAM,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IAC1E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAExD,MAAM,QAAQ,GACZ,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC;IACzF,IAAI,UAAU,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,CAAC;IAC5E,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,0DAA0D;IAC1D,MAAM,KAAK,GAAG,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,IAAI,UAAU,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClF,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;KACxF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,QAAQ,CAAC,GAAoB,EAAE,KAAK,GAAG,MAAM;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACvB,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,IAAI,KAAK,CAAC;YACd,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;gBACxB,IAAI,GAAG,IAAI,CAAC;gBACZ,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;YACzC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;2DAE2D;AAC3D,SAAS,UAAU,CAAC,GAAoB;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,CAAC,kDAAkD;IAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACvD,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;IACzD,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAgBD;;;0CAG0C;AAC1C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3E,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;8EAC8E;AAC9E,MAAM,UAAU,eAAe,CAAC,IAAwB;IACtD,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;IAC5E,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,sEAAsE;QACtE,qEAAqE;QACrE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oDAAoD,KAAK,2DAA2D,CAAC,CAAC;QACxI,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,uBAAuB,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,eAAe,CAAC;IACpD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,uCAAuC,CAAC,CAAC;IACnH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC;IACrE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;gFACgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,OAA+B,EAAE;IAIrE,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAErF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACxE,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,GAAQ,EAAE,EAAE;gBACxC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;gBACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBAClD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,CAAC,CAAC;YACF,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACxF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC7E,IAAI,MAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3C,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBACzD,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC1D,oEAAoE;gBACpE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAQ,CAAC;gBAChC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAQ,CAAC;gBACrC,GAAG,CAAC;oBACF,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC5B,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;oBACpD,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;oBAC/D,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;oBAChD,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC;YACtG,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}

package/dist/remote-ops/invocation.d.ts

@@ -0,0 +1,26 @@
+/**
+ * RUNNER-REMOTE-OPS-2 — the fixed verb → argv map.
+ *
+ * Each allowlisted verb resolves to ONE fixed executable + argv array. The only
+ * attacker-reachable slots (`<unit>`, `<N>`) are already constrained by
+ * `validateHostRunnerRemoteCommand` (unit ∈ a closed Set, lines ∈ 1..500) before
+ * they arrive. The command runs under execa's default `shell: false`, so the
+ * argv is passed to the OS as a vector — no string is ever handed to a shell.
+ * Pure on purpose: the per-verb argv is asserted in tests without executing.
+ */
+import type { RunnerRemoteCommand } from "./validate.js";
+export interface RemoteOpsInvocation {
+    /** The executable — a fixed bare binary name resolved on PATH by execa. */
+    file: string;
+    /** The argument vector. Never interpolated into a shell string. */
+    args: string[];
+}
+/** The `doctor` verb's bin. Bare `acc-runner` resolves on the host's PATH. */
+export declare const DOCTOR_BIN = "acc-runner";
+/**
+ * Resolve a validated command to its fixed invocation. Input MUST already have
+ * passed `validateHostRunnerRemoteCommand`; throws on an unexpected verb purely
+ * as a defensive invariant (never reached for valid input).
+ */
+export declare function resolveRemoteOpsInvocation(command: RunnerRemoteCommand): RemoteOpsInvocation;
+//# sourceMappingURL=invocation.d.ts.map

package/dist/remote-ops/invocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invocation.d.ts","sourceRoot":"","sources":["../../src/remote-ops/invocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,8EAA8E;AAC9E,eAAO,MAAM,UAAU,eAAe,CAAC;AAEvC;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,mBAAmB,GAAG,mBAAmB,CAsB5F"}

package/dist/remote-ops/invocation.js

@@ -0,0 +1,31 @@
+/** The `doctor` verb's bin. Bare `acc-runner` resolves on the host's PATH. */
+export const DOCTOR_BIN = "acc-runner";
+/**
+ * Resolve a validated command to its fixed invocation. Input MUST already have
+ * passed `validateHostRunnerRemoteCommand`; throws on an unexpected verb purely
+ * as a defensive invariant (never reached for valid input).
+ */
+export function resolveRemoteOpsInvocation(command) {
+    switch (command.verb) {
+        case "service.start":
+            return { file: "systemctl", args: ["--user", "start", command.service] };
+        case "service.stop":
+            return { file: "systemctl", args: ["--user", "stop", command.service] };
+        case "service.restart":
+            return { file: "systemctl", args: ["--user", "restart", command.service] };
+        case "journal.tail":
+            return {
+                file: "journalctl",
+                args: ["--user", "-u", command.service, "-n", String(command.lines ?? 100)],
+            };
+        case "doctor":
+            return { file: DOCTOR_BIN, args: ["doctor"] };
+        case "host.vitals":
+            return { file: "uptime", args: [] };
+        default: {
+            const never = command.verb; // exhaustive: unreachable for validated input
+            throw new Error(`no fixed invocation for remote-ops verb ${JSON.stringify(never)}`);
+        }
+    }
+}
+//# sourceMappingURL=invocation.js.map

package/dist/remote-ops/invocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invocation.js","sourceRoot":"","sources":["../../src/remote-ops/invocation.ts"],"names":[],"mappings":"AAmBA,8EAA8E;AAC9E,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAA4B;IACrE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAiB,CAAC,EAAE,CAAC;QACrF,KAAK,cAAc;YACjB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,OAAiB,CAAC,EAAE,CAAC;QACpF,KAAK,iBAAiB;YACpB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,OAAiB,CAAC,EAAE,CAAC;QACvF,KAAK,cAAc;YACjB,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,OAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;aACtF,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,KAAK,aAAa;YAChB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACtC,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,KAAK,GAAU,OAAO,CAAC,IAAI,CAAC,CAAC,8CAA8C;YACjF,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/remote-ops/validate.d.ts

@@ -0,0 +1,35 @@
+/**
+ * RUNNER-REMOTE-OPS-2 — host-side re-validation of the allowlisted remote-ops
+ * verb set. The HOST half of the feature whose server/UI half ships in
+ * RUNNER-REMOTE-OPS-1 (PR #3307, `src/lib/runnerRemoteOps.ts`).
+ *
+ * The server already validates + grant-gates a command before POSTing it, but
+ * the host re-validates from scratch — the server is a different trust domain
+ * over the network, so an injected/unknown verb is refused here regardless.
+ *
+ * The verb set, service/unit allowlists, name regex and `lines` bounds are a
+ * BYTE-FOR-BYTE mirror of `src/lib/runnerRemoteOps.ts`, duplicated because
+ * `@tokenfactory/acc-runner` is a standalone package whose tsconfig pins rootDir
+ * to `./src/` and cannot reach the web app's `src/lib/`. Change one, change the
+ * other. // keep in sync with src/lib/runnerRemoteOps.ts
+ */
+export declare const RUNNER_REMOTE_OPS: readonly ["service.start", "service.stop", "service.restart", "doctor", "journal.tail", "host.vitals"];
+export type RunnerRemoteVerb = (typeof RUNNER_REMOTE_OPS)[number];
+export type RunnerRemoteCapability = "read" | "mutate";
+export type RunnerRemoteCommand = {
+    verb: RunnerRemoteVerb;
+    service?: string;
+    lines?: number;
+};
+/** Mutating verbs (`service.*`) require a mutate grant; everything else is read. */
+export declare function runnerRemoteCapability(verb: RunnerRemoteVerb): RunnerRemoteCapability;
+/**
+ * Parse + allowlist-check an untrusted remote-ops request body. Returns a
+ * normalised `RunnerRemoteCommand`, or `null` when the input is not a recognised
+ * verb with valid, allowlisted arguments (verb outside the set, service/unit
+ * outside the allowlist, or `lines` outside 1..500). Never throws, never
+ * partially trusts. Exported under the `validateHostRunnerRemoteCommand` name
+ * the task contract / #3307 PR body call "the exported host-side validator".
+ */
+export declare function validateHostRunnerRemoteCommand(input: unknown): RunnerRemoteCommand | null;
+//# sourceMappingURL=validate.d.ts.map

package/dist/remote-ops/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/remote-ops/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,eAAO,MAAM,iBAAiB,wGAOpB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAClE,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvD,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAMF,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,gBAAgB,GAAG,sBAAsB,CAErF;AAKD;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAkB1F"}

package/dist/remote-ops/validate.js

@@ -0,0 +1,60 @@
+/**
+ * RUNNER-REMOTE-OPS-2 — host-side re-validation of the allowlisted remote-ops
+ * verb set. The HOST half of the feature whose server/UI half ships in
+ * RUNNER-REMOTE-OPS-1 (PR #3307, `src/lib/runnerRemoteOps.ts`).
+ *
+ * The server already validates + grant-gates a command before POSTing it, but
+ * the host re-validates from scratch — the server is a different trust domain
+ * over the network, so an injected/unknown verb is refused here regardless.
+ *
+ * The verb set, service/unit allowlists, name regex and `lines` bounds are a
+ * BYTE-FOR-BYTE mirror of `src/lib/runnerRemoteOps.ts`, duplicated because
+ * `@tokenfactory/acc-runner` is a standalone package whose tsconfig pins rootDir
+ * to `./src/` and cannot reach the web app's `src/lib/`. Change one, change the
+ * other. // keep in sync with src/lib/runnerRemoteOps.ts
+ */
+export const RUNNER_REMOTE_OPS = [
+    "service.start",
+    "service.stop",
+    "service.restart",
+    "doctor",
+    "journal.tail",
+    "host.vitals",
+];
+const SERVICES = new Set(["acc-runner", "acc-runner-health", "github-actions-runner"]);
+const UNITS = new Set(["acc-runner", "acc-runner-health", "github-actions-runner"]);
+const VERBS = new Set(RUNNER_REMOTE_OPS);
+/** Mutating verbs (`service.*`) require a mutate grant; everything else is read. */
+export function runnerRemoteCapability(verb) {
+    return verb.startsWith("service.") ? "mutate" : "read";
+}
+const cleanName = (value) => typeof value === "string" && /^[a-zA-Z0-9_.@-]{1,80}$/.test(value) ? value : "";
+/**
+ * Parse + allowlist-check an untrusted remote-ops request body. Returns a
+ * normalised `RunnerRemoteCommand`, or `null` when the input is not a recognised
+ * verb with valid, allowlisted arguments (verb outside the set, service/unit
+ * outside the allowlist, or `lines` outside 1..500). Never throws, never
+ * partially trusts. Exported under the `validateHostRunnerRemoteCommand` name
+ * the task contract / #3307 PR body call "the exported host-side validator".
+ */
+export function validateHostRunnerRemoteCommand(input) {
+    if (!input || typeof input !== "object")
+        return null;
+    const raw = input;
+    const verb = typeof raw.verb === "string" && VERBS.has(raw.verb) ? raw.verb : null;
+    if (!verb)
+        return null;
+    if (verb.startsWith("service.")) {
+        const service = cleanName(raw.service);
+        return service && SERVICES.has(service) ? { verb, service } : null;
+    }
+    if (verb === "journal.tail") {
+        const service = cleanName(raw.service);
+        const lines = Number(raw.lines ?? 100);
+        return service && UNITS.has(service) && Number.isInteger(lines) && lines >= 1 && lines <= 500
+            ? { verb, service, lines }
+            : null;
+    }
+    return { verb };
+}
+//# sourceMappingURL=validate.js.map

package/dist/remote-ops/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/remote-ops/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,eAAe;IACf,cAAc;IACd,iBAAiB;IACjB,QAAQ;IACR,cAAc;IACd,aAAa;CACL,CAAC;AAWX,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,CAAC,CAAC,CAAC;AACvF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,CAAC,CAAC,CAAC;AACpF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,iBAAiB,CAAC,CAAC;AAEjD,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,IAAsB;IAC3D,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;AACzD,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,EAAE,CACnC,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAElF;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GACR,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,IAAyB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;QACvC,OAAO,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,GAAG;YAC3F,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;YAC1B,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC"}

package/dist/runtime/rework.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rework.d.ts","sourceRoot":"","sources":["../../src/runtime/rework.ts"],"names":[],"mappings":"AAgCA,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf;oEACgE;IAChE,cAAc,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,MAAM,EAAE,QAAQ,GAAG,YAAY,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,gEAAgE;AAChE,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAgCnC;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,QAAQ,CAAC,EAAE;IACT,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,GACA,UAAU,GAAG,IAAI,CA8BnB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IACF,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAkGT;AAgBD,iFAAiF;AACjF,MAAM,MAAM,aAAa,GAAG,CAC1B,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,KACR,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B;qFACiF;IACjF,MAAM,EAAE,YAAY,GAAG,MAAM,CAAC;IAC9B,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,MAAM,EAAE,OAAO,CAAC;IAChB,sEAAsE;IACtE,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,qEAAqE;IACrE,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,iBAAiB,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB;4EACwE;IACxE,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;CACxE;AAsDD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EAAE,GACd,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAYtB;AAED;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAUf;AA6ED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,eAAe,CAAC,CA+G1B"}
+{"version":3,"file":"rework.d.ts","sourceRoot":"","sources":["../../src/runtime/rework.ts"],"names":[],"mappings":"AAgCA,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf;oEACgE;IAChE,cAAc,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,MAAM,EAAE,QAAQ,GAAG,YAAY,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,gEAAgE;AAChE,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAgCnC;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,QAAQ,CAAC,EAAE;IACT,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,GACA,UAAU,GAAG,IAAI,CA8BnB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IACF,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAqHT;AAgBD,iFAAiF;AACjF,MAAM,MAAM,aAAa,GAAG,CAC1B,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,KACR,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B;qFACiF;IACjF,MAAM,EAAE,YAAY,GAAG,MAAM,CAAC;IAC9B,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,MAAM,EAAE,OAAO,CAAC;IAChB,sEAAsE;IACtE,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,qEAAqE;IACrE,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,iBAAiB,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB;4EACwE;IACxE,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;CACxE;AAsDD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EAAE,GACd,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAYtB;AAED;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAUf;AA6ED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,eAAe,CAAC,CA+G1B"}

package/dist/runtime/rework.js

@@ -148,6 +148,22 @@ export function renderReworkPrompt(args) {
     lines.push("## Forbidden files (DO NOT TOUCH)");
     lines.push(...(task.forbidden.length ? task.forbidden.map((f) => `- ${f}`) : ["- (none)"]));
     lines.push("");
+    // REWORK-ON-APPLIED-MIGRATION-1: a belt-and-braces standing guardrail. A
+    // migration already applied to staging must never be edited or renumbered by a
+    // rework — doing so orphans or desyncs the applied ledger row. The CI-failure
+    // router already suppresses reworks for applied-migration PRs, but a rework
+    // session that reaches here for any reason must not cross this line itself.
+    lines.push("## Migration safety (MANDATORY)");
+    lines.push("Do NOT edit, rename, or renumber a migration under " +
+        "`supabase/migrations/` if its sequence is already APPLIED to staging or " +
+        "the parent ledger; changing it would orphan or desync the applied row. " +
+        "If you cannot establish whether a sequence is applied, STOP and ask for " +
+        "ledger reconciliation before changing that file. Unapplied migrations " +
+        "still follow the normal forward-only rules. If the ONLY CI failure is a migration SEQUENCE GAP " +
+        "(a lower seq is missing), do NOT renumber your migration to close it: the " +
+        "gap is a merge-order artifact that clears itself once the predecessor PR " +
+        "merges. STOP and say so in your final output instead of renumbering.");
+    lines.push("");
     lines.push("## Gates");
     lines.push(`Run \`${task.typecheck_cmd?.trim() || "pnpm typecheck && pnpm lint && pnpm build"}\` ` +
         "after your edits. All gates must pass before you commit. If a gate " +