wicked-crew 0.7.39 → 0.7.45

package/dist/cli/mcp.js

@@ -13,26 +13,56 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
+import { missingBearerAdvice, withBearerHeader } from './bearer.js';
 // ─── Crew daemon client ───────────────────────────────────────────────────────
+/** The daemon ANSWERED and refused — distinct from "no daemon there", which is a transport error. */
+export class CrewHttpError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.name = 'CrewHttpError';
+        this.status = status;
+    }
+}
+/**
+ * What to say when the startup health probe fails. A refusal is not unreachability: reporting
+ * "Cannot reach daemon" for a 401 is false AND it throws away the bearer advice the refusal
+ * carries (#637, codex review of #723).
+ */
+export function probeFailureMessage(err, port) {
+    if (err instanceof CrewHttpError) {
+        return `[wicked-crew mcp] the daemon at port ${port} answered the health probe with ${err.status}: ${err.message}`;
+    }
+    return (`[wicked-crew mcp] Cannot reach daemon at port ${port}. ` +
+        `Start it first with: wicked-crew serve --port ${port}`);
+}
 class CrewClient {
     base;
     constructor(port) {
         this.base = `http://127.0.0.1:${port}/api/v1`;
     }
+    /** The failure for a non-2xx: under a team runtime with no bearer, name the variable (#637). */
+    static async failure(verb, path, res) {
+        const head = `${verb} ${path} → ${res.status}: ${await res.text()}`;
+        const advice = res.status === 401 || res.status === 403 ? missingBearerAdvice() : null;
+        return new CrewHttpError(advice === null ? head : `${head}\n${advice}`, res.status);
+    }
     async get(path) {
-        const res = await fetch(`${this.base}${path}`);
+        // withBearerHeader: these verbs bypassed it entirely, so every one of them 401'd under a team
+        // runtime with nothing said about why (#637, same class as the `wicked-crew start` regression).
+        const res = await fetch(`${this.base}${path}`, withBearerHeader(undefined));
         if (!res.ok)
-            throw new Error(`GET ${path} → ${res.status}: ${await res.text()}`);
+            throw await CrewClient.failure('GET', path, res);
         return res.json();
     }
     async post(path, body) {
-        const res = await fetch(`${this.base}${path}`, {
+        const res = await fetch(`${this.base}${path}`, withBearerHeader({
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(body),
-        });
+        }));
         if (!res.ok)
-            throw new Error(`POST ${path} → ${res.status}: ${await res.text()}`);
+            throw await CrewClient.failure('POST', path, res);
         return res.json();
     }
 }
@@ -45,22 +75,23 @@ export async function runMcpServer(port) {
     const client = new CrewClient(port);
     // Probe the daemon before advertising ourselves — fail loudly if unreachable.
     // Capture the version from the health response so serverInfo stays in sync with the daemon.
+    // `/api/v1/health` IS a protected path (api/auth.ts `isProtectedPath`), so under a team runtime
+    // with no bearer this probe gets a 401, not a transport failure — hence probeFailureMessage.
     let daemonVersion = '0.0.0';
     try {
         const health = await client.get('/health');
         if (typeof health.version === 'string')
             daemonVersion = health.version;
     }
-    catch {
-        throw new Error(`[wicked-crew mcp] Cannot reach daemon at port ${port}. ` +
-            `Start it first with: wicked-crew serve --port ${port}`);
+    catch (err) {
+        throw new Error(probeFailureMessage(err, port));
     }
     const server = new McpServer({ name: 'wicked-crew', version: daemonVersion });
     // ── launch_run ─────────────────────────────────────────────────────────────
     server.tool('launch_run', 'Launch a new governed workflow run on the wicked-crew daemon. ' +
         'Returns the run ID which can be used with the other tools.', {
         problem: z.string().min(1).describe('The task description / problem statement for the run'),
-        workflow: z.string().optional().describe('Workflow id (e.g. "feature", "bug", "survey-repo"). ' +
+        workflow: z.string().optional().describe('Workflow id (e.g. "feature", "bug", "domain-extraction"). ' +
             'Use list_workflows to see available ids.'),
         repo: z.string().optional().describe('Registered repo reference (id returned by the daemon registry). ' +
             'Required for workflows that need a code graph.'),

package/dist/cli/mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/cli/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,iFAAiF;AAEjF,MAAM,UAAU;IACG,IAAI,CAAS;IAE9B,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI,GAAG,oBAAoB,IAAI,SAAS,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,MAAM,GAAG,CAAC,MAAM,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjF,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAa;QACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,MAAM,GAAG,CAAC,MAAM,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAClF,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;CACF;AAED,iFAAiF;AAEjF,SAAS,EAAE,CAAC,IAAa;IACvB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAEpC,8EAA8E;IAC9E,4FAA4F;IAC5F,IAAI,aAAa,GAAG,OAAO,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,CAAyB,CAAC;QACnE,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAAE,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,iDAAiD,IAAI,IAAI;YACzD,iDAAiD,IAAI,EAAE,CACxD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IAE9E,8EAA8E;IAC9E,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,gEAAgE;QAChE,4DAA4D,EAC5D;QACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sDAAsD,CAAC;QAC3F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtC,sDAAsD;YACtD,0CAA0C,CAC3C;QACD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAClC,kEAAkE;YAClE,gDAAgD,CACjD;QACD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACxC,oEAAoE,CACrE;KACF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE;QAChD,MAAM,IAAI,GAA2B,EAAE,OAAO,EAAE,CAAC;QACjD,IAAI,QAAQ;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC;QAC1C,IAAI,IAAI;YAAE,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;QACjC,IAAI,UAAU;YAAE,IAAI,CAAC,WAAW,CAAC,GAAG,UAAU,CAAC;QAC/C,OAAO,EAAE,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC,CACF,CAAC;IAEF,8EAA8E;IAC9E,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,oDAAoD;QACpD,+CAA+C,EAC/C;QACE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC;KACxE,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC,CAC9D,CAAC;IAEF,8EAA8E;IAC9E,MAAM,CAAC,IAAI,CACT,WAAW,EACX,uFAAuF;QACvF,+BAA+B,EAC/B,EAAE,EACF,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAC1C,CAAC;IAEF,8EAA8E;IAC9E,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,4CAA4C;QAC5C,0EAA0E;QAC1E,kFAAkF,EAClF;QACE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QAChD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC1D,0FAA0F,CAC3F;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;QAC1B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,MAAM,SAAS,CAErD,CAAC;QACF,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAC7E,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC,CACF,CAAC;IAEF,8EAA8E;IAC9E,MAAM,CAAC,IAAI,CACT,aAAa,EACb,6CAA6C;QAC7C,mFAAmF,EACnF;QACE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;QACjE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACnC,2EAA2E,CAC5E;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;QACnC,MAAM,IAAI,GAA4B,EAAE,OAAO,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;QAC/C,OAAO,EAAE,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,MAAM,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC,CACF,CAAC;IAEF,8EAA8E;IAC9E,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,qEAAqE,EACrE;QACE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;KAC3D,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,MAAM,SAAS,EAAE,EAAE,CAAC,CAAC,CAC1E,CAAC;IAEF,8EAA8E;IAC9E,MAAM,CAAC,IAAI,CACT,gBAAgB,EAChB,8CAA8C;QAC9C,yDAAyD,EACzD,EAAE,EACF,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAC/C,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/cli/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpE,iFAAiF;AAEjF,qGAAqG;AACrG,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,MAAM,CAAS;IACxB,YAAY,OAAe,EAAE,MAAc;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY,EAAE,IAAY;IAC5D,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;QACjC,OAAO,wCAAwC,IAAI,mCAAmC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;IACrH,CAAC;IACD,OAAO,CACL,iDAAiD,IAAI,IAAI;QACzD,iDAAiD,IAAI,EAAE,CACxD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU;IACG,IAAI,CAAS;IAE9B,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI,GAAG,oBAAoB,IAAI,SAAS,CAAC;IAChD,CAAC;IAED,gGAAgG;IACxF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAY,EAAE,GAAa;QACpE,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,IAAI,MAAM,GAAG,CAAC,MAAM,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvF,OAAO,IAAI,aAAa,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,8FAA8F;QAC9F,gGAAgG;QAChG,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,MAAM,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9D,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAa;QACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,EAAE,gBAAgB,CAAC;YAC9D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;CACF;AAED,iFAAiF;AAEjF,SAAS,EAAE,CAAC,IAAa;IACvB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAEpC,8EAA8E;IAC9E,4FAA4F;IAC5F,gGAAgG;IAChG,6FAA6F;IAC7F,IAAI,aAAa,GAAG,OAAO,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,CAAyB,CAAC;QACnE,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAAE,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;IACzE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IAE9E,8EAA8E;IAC9E,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,gEAAgE;QAChE,4DAA4D,EAC5D;QACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sDAAsD,CAAC;QAC3F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtC,4DAA4D;YAC5D,0CAA0C,CAC3C;QACD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAClC,kEAAkE;YAClE,gDAAgD,CACjD;QACD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACxC,oEAAoE,CACrE;KACF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE;QAChD,MAAM,IAAI,GAA2B,EAAE,OAAO,EAAE,CAAC;QACjD,IAAI,QAAQ;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC;QAC1C,IAAI,IAAI;YAAE,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;QACjC,IAAI,UAAU;YAAE,IAAI,CAAC,WAAW,CAAC,GAAG,UAAU,CAAC;QAC/C,OAAO,EAAE,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC,CACF,CAAC;IAEF,8EAA8E;IAC9E,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,oDAAoD;QACpD,+CAA+C,EAC/C;QACE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC;KACxE,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC,CAC9D,CAAC;IAEF,8EAA8E;IAC9E,MAAM,CAAC,IAAI,CACT,WAAW,EACX,uFAAuF;QACvF,+BAA+B,EAC/B,EAAE,EACF,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAC1C,CAAC;IAEF,8EAA8E;IAC9E,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,4CAA4C;QAC5C,0EAA0E;QAC1E,kFAAkF,EAClF;QACE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QAChD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC1D,0FAA0F,CAC3F;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;QAC1B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,MAAM,SAAS,CAErD,CAAC;QACF,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAC7E,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC,CACF,CAAC;IAEF,8EAA8E;IAC9E,MAAM,CAAC,IAAI,CACT,aAAa,EACb,6CAA6C;QAC7C,mFAAmF,EACnF;QACE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;QACjE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACnC,2EAA2E,CAC5E;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;QACnC,MAAM,IAAI,GAA4B,EAAE,OAAO,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;QAC/C,OAAO,EAAE,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,MAAM,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC,CACF,CAAC;IAEF,8EAA8E;IAC9E,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,qEAAqE,EACrE;QACE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;KAC3D,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,MAAM,SAAS,EAAE,EAAE,CAAC,CAAC,CAC1E,CAAC;IAEF,8EAA8E;IAC9E,MAAM,CAAC,IAAI,CACT,gBAAgB,EAChB,8CAA8C;QAC9C,yDAAyD,EACzD,EAAE,EACF,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAC/C,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}

package/dist/cli/service.d.ts

@@ -0,0 +1,78 @@
+export declare const SERVICE_LABEL = "com.wickedagile.wicked-crew";
+export declare const SYSTEMD_UNIT_NAME = "wicked-crew.service";
+export declare const INSTALL_SERVICE_FLAG = "--install-service";
+export declare const UNINSTALL_SERVICE_FLAG = "--uninstall-service";
+export type ServicePlatform = 'darwin' | 'linux' | 'other';
+export declare function servicePlatform(platform?: NodeJS.Platform): ServicePlatform;
+/** Where the unit file lives for this platform, or `null` where nothing is automated. */
+export declare function serviceUnitPath(platform: ServicePlatform, home?: string): string | null;
+export interface CapturedEnv {
+    env: Record<string, string>;
+    /** Names that would have been carried but look like secrets — reported, never written. */
+    omitted: string[];
+}
+/** The service environment: the allowlist + every `WICKED_*` variable, minus anything secret-shaped. */
+export declare function captureServiceEnv(source?: NodeJS.ProcessEnv): CapturedEnv;
+export interface ServiceSpec {
+    /** Absolute argv: the node binary, the CLI entry, `serve`, and the forwarded serve options. */
+    program: string[];
+    env: Record<string, string>;
+    /** stdout + stderr of the daemon. */
+    logPath: string;
+    workingDir: string;
+}
+/** The serve options the service re-runs with: argv minus the two service flags. */
+export declare function forwardedServeArgs(argv: string[]): string[];
+export declare function renderPlist(spec: ServiceSpec): string;
+export declare function renderSystemdUnit(spec: ServiceSpec): string;
+/** The daemon log an installed unit writes to — read back from the unit text (`status` names it). */
+export declare function logPathFromUnit(text: string): string | null;
+/** An installed service on this host: its unit path and the log it writes, or `null`. */
+export declare function installedService(platform?: ServicePlatform, home?: string): {
+    unitPath: string;
+    logPath: string | null;
+} | null;
+/** Printed where nothing is automated (Windows): a Task Scheduler recipe for the same command. */
+export declare function windowsRecipe(spec: ServiceSpec): string;
+export interface CommandResult {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+}
+export type CommandRunner = (cmd: string, args: string[]) => CommandResult;
+export declare const runCommand: CommandRunner;
+export interface ServiceDeps {
+    platform: ServicePlatform;
+    home: string;
+    uid: number;
+    run: CommandRunner;
+    /** A process already listening on the daemon port (`null` = nothing answering). */
+    portHolder: () => Promise<{
+        pid: number | null;
+    } | null>;
+    log: (line: string) => void;
+}
+export interface InstallInput {
+    /** The CLI entry the service runs (`process.argv[1]`). */
+    cliPath: string;
+    nodePath: string;
+    serveArgs: string[];
+    env: NodeJS.ProcessEnv;
+    /** The daemon's state home (the `--db` parent or `~/.wicked-crew`) — the log lands there. */
+    stateHome: string;
+    port: number;
+}
+/**
+ * The node binary the unit names. `process.execPath` is the resolved binary (Homebrew:
+ * `/opt/homebrew/Cellar/node/<version>/bin/node`), which a node upgrade deletes. When a `node` on
+ * the captured PATH resolves to that same binary, name the PATH entry instead (the stable symlink).
+ */
+export declare function stableNodePath(execPath: string, path: string | undefined): string;
+/** `0` on success, `1` on a refusal or a failed service-manager call (the reason is logged). */
+export declare function installService(input: InstallInput, deps: ServiceDeps): Promise<number>;
+/** The pid of the loaded service's running process, or `null` (not loaded, not running, unknown). */
+export declare function runningServicePid(deps: Pick<ServiceDeps, 'platform' | 'uid' | 'run'>): number | null;
+export declare function uninstallService(deps: Pick<ServiceDeps, 'platform' | 'home' | 'uid' | 'run' | 'log'>): number;
+/** The pid listening on a TCP port (lsof; best-effort, `null` when unknown). */
+export declare function listeningPid(port: number, run?: CommandRunner): number | null;
+//# sourceMappingURL=service.d.ts.map

package/dist/cli/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/cli/service.ts"],"names":[],"mappings":"AAyBA,eAAO,MAAM,aAAa,gCAAgC,CAAC;AAC3D,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AACvD,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AACxD,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAE5D,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;AAE3D,wBAAgB,eAAe,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,eAAe,CAE7F;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,GAAE,MAAkB,GAAG,MAAM,GAAG,IAAI,CAIlG;AAsBD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,0FAA0F;IAC1F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wGAAwG;AACxG,wBAAgB,iBAAiB,CAAC,MAAM,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CActF;AAED,MAAM,WAAW,WAAW;IAC1B,+FAA+F;IAC/F,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAE3D;AAMD,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAoCrD;AAOD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAqB3D;AAED,qGAAqG;AACrG,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO3D;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAC9B,QAAQ,GAAE,eAAmC,EAC7C,IAAI,GAAE,MAAkB,GACvB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAUrD;AAED,kGAAkG;AAClG,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAOvD;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,aAAa,CAAC;AAE3E,eAAO,MAAM,UAAU,EAAE,aAGxB,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,aAAa,CAAC;IACnB,mFAAmF;IACnF,UAAU,EAAE,MAAM,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACzD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAiBjF;AAED,gGAAgG;AAChG,wBAAsB,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAuF5F;AAED,qGAAqG;AACrG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG,MAAM,GAAG,IAAI,CAYpG;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG,MAAM,CAoB7G;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,aAA0B,GAAG,MAAM,GAAG,IAAI,CAIzF"}

package/dist/cli/service.js

@@ -0,0 +1,334 @@
+// `wicked-crew serve --install-service` / `--uninstall-service` — crew#551 (F-RC1-044).
+//
+// A hand-started daemon dies with the machine, and after a reboot the product is simply down. This
+// registers the daemon as a per-user login service so it comes back on its own:
+//   - macOS: a LaunchAgent (`~/Library/LaunchAgents/com.wickedagile.wicked-crew.plist`), RunAtLoad +
+//     KeepAlive, loaded with `launchctl bootstrap gui/<uid>`.
+//   - Linux: a systemd user unit (`~/.config/systemd/user/wicked-crew.service`), Restart=on-failure,
+//     enabled with `systemctl --user enable --now`.
+//   - anything else: the recipe is printed, nothing is automated.
+//
+// The service environment is captured ONCE at install time from an allowlist — a service manager
+// starts the daemon with a near-empty environment, and the daemon's worker fence for a non-default
+// Claude config dir is derived from ITS OWN `CLAUDE_CONFIG_DIR` (core#403), so that variable must
+// travel with the service. Secrets (names carrying TOKEN/SECRET/PASSWORD/KEY/CREDENTIAL) are NEVER
+// written into the unit file: they are named in the install output, not persisted.
+//
+// Pure renderers + one installer with an injectable command runner, so the unit text and the
+// command sequence are unit-tested without touching the host's service manager.
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync, realpathSync, unlinkSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { delimiter, dirname, join } from 'node:path';
+import { childEnvWithBootEstateDb } from '../core/governance-store.js';
+export const SERVICE_LABEL = 'com.wickedagile.wicked-crew';
+export const SYSTEMD_UNIT_NAME = 'wicked-crew.service';
+export const INSTALL_SERVICE_FLAG = '--install-service';
+export const UNINSTALL_SERVICE_FLAG = '--uninstall-service';
+export function servicePlatform(platform = process.platform) {
+    return platform === 'darwin' ? 'darwin' : platform === 'linux' ? 'linux' : 'other';
+}
+/** Where the unit file lives for this platform, or `null` where nothing is automated. */
+export function serviceUnitPath(platform, home = homedir()) {
+    if (platform === 'darwin')
+        return join(home, 'Library', 'LaunchAgents', `${SERVICE_LABEL}.plist`);
+    if (platform === 'linux')
+        return join(home, '.config', 'systemd', 'user', SYSTEMD_UNIT_NAME);
+    return null;
+}
+/** Exact names carried into the service environment (besides the `WICKED_*` prefix). */
+const ENV_ALLOW = new Set([
+    'PATH',
+    'HOME',
+    'USER',
+    'LANG',
+    'LC_ALL',
+    'XDG_CONFIG_HOME',
+    // core#403: the daemon derives the worker fence for the operator's Claude config dir from its own
+    // CLAUDE_CONFIG_DIR — without it a service-managed daemon stops fencing a non-default dir.
+    'CLAUDE_CONFIG_DIR',
+    'CODEX_HOME',
+    'CREW_PORT',
+    // The deliver push identity pin (crew#549 / F-RC1-010) — an account NAME, not a credential.
+    'GH_ACCOUNT',
+]);
+const SECRET_NAME = /TOKEN|SECRET|PASS|KEY|CREDENTIAL|BEARER|COOKIE|SESSION/i;
+/** A value carrying a credential in URL userinfo (`postgres://user:pass@host/db`). */
+const SECRET_VALUE = /^[a-z][a-z0-9+.-]*:\/\/[^/@\s]*:[^/@\s]*@/i;
+/** The service environment: the allowlist + every `WICKED_*` variable, minus anything secret-shaped. */
+export function captureServiceEnv(source = process.env) {
+    const env = {};
+    const omitted = [];
+    for (const name of Object.keys(source).sort()) {
+        const value = source[name];
+        if (value === undefined)
+            continue;
+        const wanted = ENV_ALLOW.has(name) || name.startsWith('WICKED_');
+        if (SECRET_NAME.test(name) || (wanted && SECRET_VALUE.test(value))) {
+            if (wanted || name === 'GH_TOKEN' || name === 'GITHUB_TOKEN')
+                omitted.push(name);
+            continue;
+        }
+        if (wanted)
+            env[name] = value;
+    }
+    return { env, omitted };
+}
+/** The serve options the service re-runs with: argv minus the two service flags. */
+export function forwardedServeArgs(argv) {
+    return argv.filter((a) => a !== INSTALL_SERVICE_FLAG && a !== UNINSTALL_SERVICE_FLAG);
+}
+function xml(s) {
+    return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&apos;');
+}
+export function renderPlist(spec) {
+    const args = spec.program.map((a) => `    <string>${xml(a)}</string>`).join('\n');
+    const env = Object.entries(spec.env)
+        .map(([k, v]) => `    <key>${xml(k)}</key>\n    <string>${xml(v)}</string>`)
+        .join('\n');
+    return [
+        '<?xml version="1.0" encoding="UTF-8"?>',
+        '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+        '<plist version="1.0">',
+        '<dict>',
+        '  <key>Label</key>',
+        `  <string>${SERVICE_LABEL}</string>`,
+        '  <key>ProgramArguments</key>',
+        '  <array>',
+        args,
+        '  </array>',
+        '  <key>EnvironmentVariables</key>',
+        '  <dict>',
+        env,
+        '  </dict>',
+        '  <key>WorkingDirectory</key>',
+        `  <string>${xml(spec.workingDir)}</string>`,
+        '  <key>RunAtLoad</key>',
+        '  <true/>',
+        '  <key>KeepAlive</key>',
+        '  <true/>',
+        // No `ProcessType: Background`: launchd throttles a Background job's disk I/O, and on a busy
+        // host the daemon then took minutes to open its own module files. The default (Standard) is right.
+        '  <key>StandardOutPath</key>',
+        `  <string>${xml(spec.logPath)}</string>`,
+        '  <key>StandardErrorPath</key>',
+        `  <string>${xml(spec.logPath)}</string>`,
+        '</dict>',
+        '</plist>',
+        '',
+    ].join('\n');
+}
+/** A systemd-quoted word: double quotes, `\` and `"` escaped, `%` doubled (specifier escape). */
+function sdQuote(s) {
+    return `"${s.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/%/g, '%%')}"`;
+}
+export function renderSystemdUnit(spec) {
+    return [
+        '[Unit]',
+        'Description=wicked-crew daemon (governed agent runs + the studio console)',
+        'After=network-online.target',
+        '',
+        '[Service]',
+        'Type=simple',
+        `ExecStart=${spec.program.map(sdQuote).join(' ')}`,
+        `WorkingDirectory=${sdQuote(spec.workingDir)}`,
+        ...Object.entries(spec.env).map(([k, v]) => `Environment=${sdQuote(`${k}=${v}`)}`),
+        // `append:` takes the rest of the line as the path (no quoting); `%` is a specifier, so doubled.
+        `StandardOutput=append:${spec.logPath.replace(/%/g, '%%')}`,
+        `StandardError=append:${spec.logPath.replace(/%/g, '%%')}`,
+        'Restart=on-failure',
+        'RestartSec=5',
+        '',
+        '[Install]',
+        'WantedBy=default.target',
+        '',
+    ].join('\n');
+}
+/** The daemon log an installed unit writes to — read back from the unit text (`status` names it). */
+export function logPathFromUnit(text) {
+    const plist = /<key>StandardErrorPath<\/key>\s*<string>([^<]*)<\/string>/.exec(text);
+    if (plist?.[1] !== undefined) {
+        return plist[1].replace(/&apos;/g, "'").replace(/&quot;/g, '"').replace(/&gt;/g, '>').replace(/&lt;/g, '<').replace(/&amp;/g, '&');
+    }
+    const unit = /^StandardError=append:(.+)$/m.exec(text);
+    return unit?.[1]?.replace(/%%/g, '%') ?? null;
+}
+/** An installed service on this host: its unit path and the log it writes, or `null`. */
+export function installedService(platform = servicePlatform(), home = homedir()) {
+    const unitPath = serviceUnitPath(platform, home);
+    if (unitPath === null || !existsSync(unitPath))
+        return null;
+    let text = '';
+    try {
+        text = readFileSync(unitPath, 'utf8');
+    }
+    catch {
+        /* unreadable unit: still installed */
+    }
+    return { unitPath, logPath: logPathFromUnit(text) };
+}
+/** Printed where nothing is automated (Windows): a Task Scheduler recipe for the same command. */
+export function windowsRecipe(spec) {
+    const cmd = spec.program.map((a) => (/\s/.test(a) ? `"${a}"` : a)).join(' ');
+    return [
+        'wicked-crew: a login service is not automated on this platform. Register it with Task Scheduler:',
+        `  schtasks /Create /SC ONLOGON /TN wicked-crew /TR "${cmd.replace(/"/g, '\\"')}" /RL LIMITED`,
+        'and set the same environment variables for your user first (setx NAME value).',
+    ].join('\n');
+}
+export const runCommand = (cmd, args) => {
+    const r = spawnSync(cmd, args, { encoding: 'utf8', env: childEnvWithBootEstateDb(process.env) });
+    return { status: r.error ? 127 : r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? (r.error?.message ?? '') };
+};
+/**
+ * The node binary the unit names. `process.execPath` is the resolved binary (Homebrew:
+ * `/opt/homebrew/Cellar/node/<version>/bin/node`), which a node upgrade deletes. When a `node` on
+ * the captured PATH resolves to that same binary, name the PATH entry instead (the stable symlink).
+ */
+export function stableNodePath(execPath, path) {
+    let target = execPath;
+    try {
+        target = realpathSync(execPath);
+    }
+    catch {
+        return execPath;
+    }
+    for (const dir of (path ?? '').split(delimiter)) {
+        if (dir === '')
+            continue;
+        const candidate = join(dir, 'node');
+        try {
+            if (realpathSync(candidate) === target)
+                return candidate;
+        }
+        catch {
+            /* not here */
+        }
+    }
+    return execPath;
+}
+/** `0` on success, `1` on a refusal or a failed service-manager call (the reason is logged). */
+export async function installService(input, deps) {
+    const unitPath = serviceUnitPath(deps.platform, deps.home);
+    let cli = input.cliPath;
+    try {
+        cli = realpathSync(input.cliPath);
+    }
+    catch {
+        /* keep as given */
+    }
+    if (/[\\/]_npx[\\/]/.test(cli)) {
+        deps.log('wicked-crew: refusing to install a login service that runs from the npx cache (it is not durable). ' +
+            'Install crew first — `npm install -g wicked-crew` — then run `wicked-crew serve --install-service`.');
+        return 1;
+    }
+    const { env, omitted } = captureServiceEnv(input.env);
+    const nodePath = stableNodePath(input.nodePath, env['PATH']);
+    const logPath = join(input.stateHome, 'daemon-stdout.log');
+    const spec = {
+        program: [nodePath, cli, 'serve', ...forwardedServeArgs(input.serveArgs)],
+        env,
+        logPath,
+        workingDir: deps.home,
+    };
+    if (unitPath === null) {
+        deps.log(windowsRecipe(spec));
+        return 0;
+    }
+    const alreadyInstalled = existsSync(unitPath);
+    // Never touch a hand-started daemon on the same port: refuse and name its pid.
+    const holder = await deps.portHolder();
+    // Only the installed service's own process may hold the port (a re-install reloads it). Anything
+    // else (a hand-started daemon, another program) is refused, named by pid, and left alone.
+    if (holder !== null) {
+        const servicePid = alreadyInstalled ? runningServicePid(deps) : null;
+        const isService = servicePid !== null && (holder.pid === null || holder.pid === servicePid);
+        if (!isService) {
+            const who = holder.pid !== null ? `pid ${holder.pid}` : 'a process lsof could not name';
+            deps.log(`wicked-crew: 127.0.0.1:${input.port} is already held by ${who}, which is not the login service. ` +
+                'Stop it first (a hand-started daemon: its terminal, or `kill <pid>`), then run `wicked-crew serve --install-service` again.');
+            return 1;
+        }
+    }
+    mkdirSync(dirname(unitPath), { recursive: true });
+    mkdirSync(dirname(logPath), { recursive: true });
+    const text = deps.platform === 'darwin' ? renderPlist(spec) : renderSystemdUnit(spec);
+    writeFileSync(unitPath, text, { mode: 0o600 });
+    const steps = deps.platform === 'darwin'
+        ? [
+            // An installed agent is reloaded (bootout tolerates "not loaded").
+            ...(alreadyInstalled ? [['launchctl', ['bootout', `gui/${deps.uid}/${SERVICE_LABEL}`], false]] : []),
+            ['launchctl', ['bootstrap', `gui/${deps.uid}`, unitPath], true],
+        ]
+        : [
+            ['systemctl', ['--user', 'daemon-reload'], true],
+            ['systemctl', ['--user', 'enable', SYSTEMD_UNIT_NAME], true],
+            ['systemctl', ['--user', 'restart', SYSTEMD_UNIT_NAME], true],
+        ];
+    for (const [cmd, args, required] of steps) {
+        const r = deps.run(cmd, args);
+        if (required && r.status !== 0) {
+            deps.log(`wicked-crew: \`${cmd} ${args.join(' ')}\` failed (exit ${r.status ?? 'signal'}): ${(r.stderr || r.stdout).trim()}`);
+            deps.log(`The unit file is at ${unitPath}; remove it with \`wicked-crew serve --uninstall-service\`.`);
+            return 1;
+        }
+    }
+    deps.log(`wicked-crew: login service installed — ${unitPath}`);
+    deps.log(`  runs: ${spec.program.join(' ')}`);
+    deps.log(`  log:  ${logPath}`);
+    deps.log(`  env:  ${Object.keys(env).join(', ') || '(none)'}`);
+    if (omitted.length > 0) {
+        deps.log(`  not written to the unit (secret-shaped): ${omitted.join(', ')} — the service runs without them` +
+            (omitted.includes('GH_TOKEN')
+                ? `; the deliver phase pushes with gh's keyring login${env['GH_ACCOUNT'] !== undefined ? ', checked against GH_ACCOUNT' : ''}`
+                : ''));
+    }
+    if (deps.platform === 'linux') {
+        deps.log('  to start it at boot without a login session: `loginctl enable-linger $USER`');
+    }
+    deps.log('The daemon is starting; `wicked-crew status` answers once it is up.');
+    return 0;
+}
+/** The pid of the loaded service's running process, or `null` (not loaded, not running, unknown). */
+export function runningServicePid(deps) {
+    if (deps.platform === 'darwin') {
+        const r = deps.run('launchctl', ['print', `gui/${deps.uid}/${SERVICE_LABEL}`]);
+        const m = r.status === 0 ? /^\s*pid = (\d+)$/m.exec(r.stdout) : null;
+        return m?.[1] !== undefined ? Number(m[1]) : null;
+    }
+    if (deps.platform === 'linux') {
+        const r = deps.run('systemctl', ['--user', 'show', '-p', 'MainPID', '--value', SYSTEMD_UNIT_NAME]);
+        const pid = Number(r.stdout.trim());
+        return r.status === 0 && Number.isInteger(pid) && pid > 0 ? pid : null;
+    }
+    return null;
+}
+export function uninstallService(deps) {
+    const unitPath = serviceUnitPath(deps.platform, deps.home);
+    if (unitPath === null) {
+        deps.log('wicked-crew: no login service is automated on this platform (remove the Task Scheduler task by hand).');
+        return 0;
+    }
+    if (!existsSync(unitPath)) {
+        deps.log(`wicked-crew: no login service installed (${unitPath} does not exist).`);
+        return 0;
+    }
+    if (deps.platform === 'darwin') {
+        deps.run('launchctl', ['bootout', `gui/${deps.uid}/${SERVICE_LABEL}`]);
+        unlinkSync(unitPath);
+    }
+    else {
+        deps.run('systemctl', ['--user', 'disable', '--now', SYSTEMD_UNIT_NAME]);
+        unlinkSync(unitPath);
+        deps.run('systemctl', ['--user', 'daemon-reload']);
+    }
+    deps.log(`wicked-crew: login service removed (${unitPath}); the daemon it ran is stopped.`);
+    return 0;
+}
+/** The pid listening on a TCP port (lsof; best-effort, `null` when unknown). */
+export function listeningPid(port, run = runCommand) {
+    const r = run('lsof', ['-nP', `-iTCP:${port}`, '-sTCP:LISTEN', '-t']);
+    const pid = Number((r.stdout.trim().split('\n')[0] ?? '').trim());
+    return r.status === 0 && Number.isInteger(pid) && pid > 0 ? pid : null;
+}
+//# sourceMappingURL=service.js.map

package/dist/cli/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/cli/service.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,EAAE;AACF,mGAAmG;AACnG,gFAAgF;AAChF,qGAAqG;AACrG,8DAA8D;AAC9D,qGAAqG;AACrG,oDAAoD;AACpD,kEAAkE;AAClE,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,kGAAkG;AAClG,mGAAmG;AACnG,mFAAmF;AACnF,EAAE;AACF,6FAA6F;AAC7F,gFAAgF;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvG,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,MAAM,CAAC,MAAM,aAAa,GAAG,6BAA6B,CAAC;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAI5D,MAAM,UAAU,eAAe,CAAC,WAA4B,OAAO,CAAC,QAAQ;IAC1E,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AACrF,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAAC,QAAyB,EAAE,OAAe,OAAO,EAAE;IACjF,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,aAAa,QAAQ,CAAC,CAAC;IAClG,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC7F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wFAAwF;AACxF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,iBAAiB;IACjB,kGAAkG;IAClG,2FAA2F;IAC3F,mBAAmB;IACnB,YAAY;IACZ,WAAW;IACX,4FAA4F;IAC5F,YAAY;CACb,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,yDAAyD,CAAC;AAC9E,sFAAsF;AACtF,MAAM,YAAY,GAAG,4CAA4C,CAAC;AAQlE,wGAAwG;AACxG,MAAM,UAAU,iBAAiB,CAAC,SAA4B,OAAO,CAAC,GAAG;IACvE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACnE,IAAI,MAAM,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,cAAc;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,IAAI,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAWD,oFAAoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,IAAc;IAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,oBAAoB,IAAI,CAAC,KAAK,sBAAsB,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,GAAG,CAAC,CAAS;IACpB,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC9H,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAiB;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,uBAAuB,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;SAC3E,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;QACL,wCAAwC;QACxC,wGAAwG;QACxG,uBAAuB;QACvB,QAAQ;QACR,oBAAoB;QACpB,aAAa,aAAa,WAAW;QACrC,+BAA+B;QAC/B,WAAW;QACX,IAAI;QACJ,YAAY;QACZ,mCAAmC;QACnC,UAAU;QACV,GAAG;QACH,WAAW;QACX,+BAA+B;QAC/B,aAAa,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW;QAC5C,wBAAwB;QACxB,WAAW;QACX,wBAAwB;QACxB,WAAW;QACX,6FAA6F;QAC7F,mGAAmG;QACnG,8BAA8B;QAC9B,aAAa,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;QACzC,gCAAgC;QAChC,aAAa,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;QACzC,SAAS;QACT,UAAU;QACV,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,iGAAiG;AACjG,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAiB;IACjD,OAAO;QACL,QAAQ;QACR,2EAA2E;QAC3E,6BAA6B;QAC7B,EAAE;QACF,WAAW;QACX,aAAa;QACb,aAAa,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAClD,oBAAoB,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;QAC9C,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAClF,iGAAiG;QACjG,yBAAyB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE;QAC3D,wBAAwB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE;QAC1D,oBAAoB;QACpB,cAAc;QACd,EAAE;QACF,WAAW;QACX,yBAAyB;QACzB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAG,2DAA2D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACrI,CAAC;IACD,MAAM,IAAI,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC;AAChD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,gBAAgB,CAC9B,WAA4B,eAAe,EAAE,EAC7C,OAAe,OAAO,EAAE;IAExB,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,aAAa,CAAC,IAAiB;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7E,OAAO;QACL,kGAAkG;QAClG,uDAAuD,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,eAAe;QAC9F,+EAA+E;KAChF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AASD,MAAM,CAAC,MAAM,UAAU,GAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;IACrD,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,wBAAwB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjG,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;AACpH,CAAC,CAAC;AAuBF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAwB;IACvE,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,IAAI,YAAY,CAAC,SAAS,CAAC,KAAK,MAAM;gBAAE,OAAO,SAAS,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAmB,EAAE,IAAiB;IACzE,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;IACxB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,mBAAmB;IACrB,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CACN,qGAAqG;YACnG,qGAAqG,CACxG,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAgB;QACxB,OAAO,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzE,GAAG;QACH,OAAO;QACP,UAAU,EAAE,IAAI,CAAC,IAAI;KACtB,CAAC;IACF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9C,+EAA+E;IAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;IACvC,iGAAiG;IACjG,0FAA0F;IAC1F,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC;QAC5F,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,+BAA+B,CAAC;YACxF,IAAI,CAAC,GAAG,CACN,0BAA0B,KAAK,CAAC,IAAI,uBAAuB,GAAG,oCAAoC;gBAChG,6HAA6H,CAChI,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtF,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE/C,MAAM,KAAK,GACT,IAAI,CAAC,QAAQ,KAAK,QAAQ;QACxB,CAAC,CAAC;YACE,mEAAmE;YACnE,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,OAAO,IAAI,CAAC,GAAG,IAAI,aAAa,EAAE,CAAC,EAAE,KAAK,CAAgC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnI,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC;SAChE;QACH,CAAC,CAAC;YACE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC;YAChD,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,CAAC,EAAE,IAAI,CAAC;YAC5D,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,iBAAiB,CAAC,EAAE,IAAI,CAAC;SAC9D,CAAC;IACR,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,kBAAkB,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,MAAM,IAAI,QAAQ,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9H,IAAI,CAAC,GAAG,CAAC,uBAAuB,QAAQ,6DAA6D,CAAC,CAAC;YACvG,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,0CAA0C,QAAQ,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CACN,8CAA8C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC;YAChG,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC3B,CAAC,CAAC,qDAAqD,GAAG,CAAC,YAAY,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC9H,CAAC,CAAC,EAAE,CAAC,CACV,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;IAChF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,iBAAiB,CAAC,IAAmD;IACnF,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,GAAG,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACnG,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAoE;IACnG,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,uGAAuG,CAAC,CAAC;QAClH,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,4CAA4C,QAAQ,mBAAmB,CAAC,CAAC;QAClF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,OAAO,IAAI,CAAC,GAAG,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC;QACvE,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACzE,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,uCAAuC,QAAQ,kCAAkC,CAAC,CAAC;IAC5F,OAAO,CAAC,CAAC;AACX,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAqB,UAAU;IACxE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC"}