@agentteams/cli 0.1.95 → 0.1.97

package/dist/auth/fileCredentialStore.js

@@ -0,0 +1,445 @@
+/**
+ * Last-resort credential storage: one permission-protected file per slot.
+ *
+ * The OS credential stores in `credentialStore.ts` are the preferred home for the
+ * personal refresh token, but every one of them can be unavailable in exactly the
+ * situation a personal login matters most — a remote session:
+ *
+ *   Linux    no Secret Service on the bus, so `secret-tool` has nothing to talk to
+ *   macOS    the login keychain of an SSH session is locked, so writes are refused
+ *   Windows  PasswordVault rejects the write for a session with no interactive logon
+ *
+ * Before this backend existed all three ended the same way: the user walked to
+ * another device, approved the request, and was then told the login could not be
+ * saved — after which it was revoked. A protected file is a weaker secret than a
+ * keyring, and this module never pretends otherwise; it is a deliberate trade
+ * against losing the login entirely.
+ *
+ * What it does not trade away is the protection it *can* enforce, which is where
+ * the two platform paths come from:
+ *
+ *   POSIX    0700 directory, 0600 file, plus an ownership / symlink / node-type
+ *            check before every read and write.
+ *   Windows  `fs.chmod` only moves the read-only bit there, so `0600` would be a
+ *            lie. `icacls` strips inheritance and grants the current user alone,
+ *            and an ACL that cannot be set or verified disables the backend
+ *            rather than downgrading it to an unprotected file.
+ *
+ * Every failure here is closed: when the protection cannot be proven, no token is
+ * read and none is written. The caller then behaves exactly as it did before this
+ * module existed.
+ */
+import { randomUUID } from 'node:crypto';
+import { chmodSync, lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { credentialSlotHash } from './slotHash.js';
+/** Shown to the user wherever a backend name is reported. */
+export const FILE_CREDENTIAL_BACKEND = 'protected-file';
+/** Same `.agentteams` directory the rotation locks live in, one level down. */
+export const CREDENTIAL_DIR = ['.agentteams', 'credentials'];
+/**
+ * Opt-out for organisations that forbid a plaintext secret on disk at any
+ * protection level. Setting it restores the pre-fallback behaviour for every new
+ * login, including the refusal to start device authorization.
+ *
+ * It gates **writing**, not seeing. A file this CLI wrote before the opt-out was
+ * set stays readable and removable, so `auth logout` can still revoke that token
+ * and delete it; blinding the store instead would strand a live refresh token on
+ * disk with no CLI path left to reach it.
+ */
+export const FILE_CREDENTIALS_DISABLED_ENV = 'AGENTTEAMS_DISABLE_FILE_CREDENTIALS';
+const DIRECTORY_MODE = 0o700;
+const FILE_MODE = 0o600;
+/** Bits that must be clear: anything reachable by group or other. */
+const SHARED_ACCESS_MASK = 0o077;
+/** Bumped only if the on-disk shape changes; an unknown version is refused. */
+const FILE_FORMAT_VERSION = 1;
+export function isFileCredentialFallbackDisabled(env = process.env) {
+    const value = env[FILE_CREDENTIALS_DISABLED_ENV];
+    return value !== undefined && value !== '' && value !== '0' && value.toLowerCase() !== 'false';
+}
+/** `personal-token-<hash>.cred` — the rotation lock's name with a different suffix. */
+export function credentialFileName(account) {
+    return `personal-token-${credentialSlotHash(account)}.cred`;
+}
+/**
+ * Whether a POSIX path is safe to hold, or hand back, a token.
+ *
+ * Split out from the filesystem so the ownership case is testable: a file owned
+ * by another user is the one condition that cannot be staged in a temp directory
+ * without root.
+ */
+export function checkPosixProtection(facts, expected, options = {}) {
+    if (facts.isSymbolicLink) {
+        return { ok: false, detail: 'it is a symbolic link, which could point anywhere' };
+    }
+    if (expected.kind === 'file' && !facts.isFile) {
+        return { ok: false, detail: 'it is not a regular file' };
+    }
+    if (expected.kind === 'directory' && !facts.isDirectory) {
+        return { ok: false, detail: 'it is not a directory' };
+    }
+    if (facts.uid !== expected.uid) {
+        return { ok: false, detail: 'it is owned by a different user' };
+    }
+    if (!options.ignoreSharedAccess && (facts.mode & SHARED_ACCESS_MASK) !== 0) {
+        return { ok: false, detail: 'it is readable or writable by other users' };
+    }
+    return { ok: true };
+}
+/** Every `[path ]principal:(perm)(perm)` entry `icacls` printed, in order. */
+export function parseAclEntries(output) {
+    const entries = [];
+    for (const line of output.split(/\r?\n/)) {
+        // The permission groups are the anchor: they run to the end of the line, so
+        // the last colon in front of them is the one that separates the subject.
+        const match = /^(.*):((?:\([^()]*\))+)\s*$/.exec(line);
+        if (!match)
+            continue;
+        const permissions = [...(match[2] ?? '').matchAll(/\(([^()]*)\)/g)].map((group) => group[1] ?? '');
+        entries.push({ subject: (match[1] ?? '').trim(), permissions });
+    }
+    return entries;
+}
+/**
+ * Whether an entry grants the expected account and nobody else.
+ *
+ * `icacls` echoes the path it was given in front of the first ACE, and both the
+ * path and the account name may contain spaces — `C:\Users\John Smith\...` and
+ * `DOMAIN\John Smith` are both ordinary, and nothing in the line says where one
+ * ends and the other begins. Removing exactly the path this call passed is what
+ * makes the comparison precise; the suffix form is the fallback for a listing
+ * that echoed the path in some other shape, and its leading space is what keeps
+ * `DESK\dev` from matching an entry for `OTHERDESK\dev`.
+ */
+function grantsOnly(subject, principal, path) {
+    const found = subject.toLowerCase();
+    const expected = principal.toLowerCase();
+    if (path !== null) {
+        const prefix = `${path.toLowerCase()} `;
+        // The echo removed exactly: what remains is the account and nothing else.
+        if (found.startsWith(prefix))
+            return found.slice(prefix.length) === expected;
+        // No prefix to remove — a listing that echoed the path in some other shape.
+        // Tolerated, but only here, and only with the separating space.
+        return found === expected || found.endsWith(` ${expected}`);
+    }
+    return found === expected;
+}
+/**
+ * Whether an `icacls` listing shows exactly "this user, explicitly, and nobody
+ * else". Anything unreadable, inherited, or shared fails.
+ *
+ * @param path - The path `icacls` was asked about, so its echo can be told apart
+ *   from the account name that follows it.
+ */
+export function verifyAclOutput(output, principal, path) {
+    const entries = parseAclEntries(output);
+    if (entries.length === 0) {
+        return { ok: false, detail: 'its access control list could not be read' };
+    }
+    for (const [index, entry] of entries.entries()) {
+        // `(I)` marks an inherited ACE. `(OI)` / `(CI)` are propagation flags on an
+        // explicit one, which is what a directory grant is supposed to look like.
+        if (entry.permissions.includes('I')) {
+            return { ok: false, detail: 'it still inherits permissions from its parent directory' };
+        }
+        // Only the first entry carries the path; every later line is an account on
+        // its own and is compared as one, so `NT AUTHORITY\SYSTEM` can never pass as
+        // a principal that happens to end the same way.
+        if (!grantsOnly(entry.subject, principal, index === 0 ? path : null)) {
+            return { ok: false, detail: 'its access control list grants another account' };
+        }
+    }
+    return { ok: true };
+}
+export function buildAclHardenCommand(path, principal, kind) {
+    // `/inheritance:r` converts inherited entries away and then removes them;
+    // `/grant:r` replaces any existing grant for the principal rather than adding
+    // to it, so re-running this is idempotent.
+    const grant = kind === 'directory' ? `${principal}:(OI)(CI)(F)` : `${principal}:(F)`;
+    return { command: 'icacls', args: [path, '/inheritance:r', '/grant:r', grant, '/Q', '/C'] };
+}
+export function buildAclInspectCommand(path) {
+    return { command: 'icacls', args: [path] };
+}
+/** `DOMAIN\user`, the form `icacls` prints. */
+function resolveWindowsPrincipal(env) {
+    const user = env.USERNAME?.trim();
+    if (!user)
+        return null;
+    const domain = env.USERDOMAIN?.trim();
+    return domain ? `${domain}\\${user}` : user;
+}
+function fileSystemDetail(error) {
+    // `code` is stable across locales; `message` embeds the path, which is not a
+    // secret but is noise in a user-facing line.
+    const code = error?.code;
+    return code ? `the filesystem refused the operation (${code})` : 'the filesystem refused the operation';
+}
+export function createFileCredentialStore(options = {}) {
+    const platform = options.platform ?? process.platform;
+    const env = options.env ?? process.env;
+    const runner = options.runner;
+    const hardenDirectoryMode = options.hardenDirectory ?? true;
+    const directory = options.directory ?? join(options.homeDir ?? homedir(), ...CREDENTIAL_DIR);
+    const isWindows = platform === 'win32';
+    const windowsPrincipal = isWindows ? resolveWindowsPrincipal(env) : null;
+    const pathFor = (account) => join(directory, credentialFileName(account));
+    const runIcacls = (command) => {
+        if (!runner)
+            return { ok: false, stdout: '' };
+        const result = runner(command);
+        return { ok: result.status === 0, stdout: result.stdout };
+    };
+    /** Set, then prove, the protection on a path that already exists. */
+    const protectPath = (path, kind) => {
+        if (isWindows) {
+            if (!windowsPrincipal) {
+                return { ok: false, detail: 'Windows did not report which account is running this command' };
+            }
+            if (!runIcacls(buildAclHardenCommand(path, windowsPrincipal, kind)).ok) {
+                return { ok: false, detail: 'its access control list could not be set with icacls' };
+            }
+            const inspected = runIcacls(buildAclInspectCommand(path));
+            if (!inspected.ok) {
+                return { ok: false, detail: 'its access control list could not be read with icacls' };
+            }
+            return verifyAclOutput(inspected.stdout, windowsPrincipal, path);
+        }
+        let facts;
+        try {
+            facts = lstatSync(path);
+        }
+        catch (error) {
+            return { ok: false, detail: fileSystemDetail(error) };
+        }
+        // Never chmod through a link: that would apply the mode to whatever it points
+        // at. The check below rejects the link itself.
+        if (!facts.isSymbolicLink() && ((kind === 'directory' && hardenDirectoryMode) || kind === 'file')) {
+            try {
+                chmodSync(path, kind === 'directory' ? DIRECTORY_MODE : FILE_MODE);
+            }
+            catch {
+                // Not ours to tighten. The verification below is what decides.
+            }
+            try {
+                facts = lstatSync(path);
+            }
+            catch (error) {
+                return { ok: false, detail: fileSystemDetail(error) };
+            }
+        }
+        return checkPosixProtection({
+            isSymbolicLink: facts.isSymbolicLink(),
+            isDirectory: facts.isDirectory(),
+            isFile: facts.isFile(),
+            mode: facts.mode,
+            uid: facts.uid,
+        }, { kind, uid: process.getuid?.() ?? facts.uid });
+    };
+    /**
+     * Inspect an existing path without touching it.
+     *
+     * Used before a read and before a write: a path that is already wrong must be
+     * reported, not silently repaired, because a credential file this CLI did not
+     * write is evidence of tampering rather than of a stale umask.
+     */
+    const inspectExistingFile = (path) => {
+        if (isWindows) {
+            try {
+                lstatSync(path);
+            }
+            catch (error) {
+                if (error?.code === 'ENOENT')
+                    return { kind: 'missing' };
+                return { ok: false, detail: fileSystemDetail(error) };
+            }
+            if (!windowsPrincipal) {
+                return { ok: false, detail: 'Windows did not report which account is running this command' };
+            }
+            const inspected = runIcacls(buildAclInspectCommand(path));
+            if (!inspected.ok)
+                return { ok: false, detail: 'its access control list could not be read with icacls' };
+            return verifyAclOutput(inspected.stdout, windowsPrincipal, path);
+        }
+        let facts;
+        try {
+            facts = lstatSync(path);
+        }
+        catch (error) {
+            if (error?.code === 'ENOENT')
+                return { kind: 'missing' };
+            return { ok: false, detail: fileSystemDetail(error) };
+        }
+        return checkPosixProtection({
+            isSymbolicLink: facts.isSymbolicLink(),
+            isDirectory: facts.isDirectory(),
+            isFile: facts.isFile(),
+            mode: facts.mode,
+            uid: facts.uid,
+        }, { kind: 'file', uid: process.getuid?.() ?? facts.uid });
+    };
+    let usable = null;
+    const ensureDirectory = () => {
+        if (usable !== null)
+            return usable;
+        try {
+            mkdirSync(directory, { recursive: true, mode: DIRECTORY_MODE });
+        }
+        catch (error) {
+            if (error?.code !== 'EEXIST') {
+                usable = { ok: false, detail: fileSystemDetail(error) };
+                return usable;
+            }
+        }
+        usable = protectPath(directory, 'directory');
+        return usable;
+    };
+    /**
+     * What the existing directory already rules out, without creating or changing
+     * anything.
+     *
+     * `auth status` is a read-only question and must not leave a credential
+     * directory on a machine that has never stored a login. An absent directory is
+     * therefore not a failure — `save()` creates it — and neither are the
+     * conditions `save()` repairs on the way (loose POSIX bits, an ACL that has
+     * not been applied yet). Only what no harden could fix is reported.
+     */
+    const inspectDirectory = () => {
+        // A real attempt already happened; its answer is the authoritative one.
+        if (usable !== null)
+            return usable;
+        if (isWindows && !windowsPrincipal) {
+            return { ok: false, detail: 'Windows did not report which account is running this command' };
+        }
+        let facts;
+        try {
+            facts = lstatSync(directory);
+        }
+        catch (error) {
+            if (error?.code === 'ENOENT')
+                return { ok: true };
+            return { ok: false, detail: fileSystemDetail(error) };
+        }
+        // The Windows ACL is applied by `save()`, and inspecting it here would say
+        // nothing about a directory that has never been hardened.
+        if (isWindows)
+            return { ok: true };
+        return checkPosixProtection({
+            isSymbolicLink: facts.isSymbolicLink(),
+            isDirectory: facts.isDirectory(),
+            isFile: facts.isFile(),
+            mode: facts.mode,
+            uid: facts.uid,
+        }, { kind: 'directory', uid: process.getuid?.() ?? facts.uid }, { ignoreSharedAccess: true });
+    };
+    const removeQuietly = (path) => {
+        try {
+            unlinkSync(path);
+        }
+        catch {
+            // Already gone, or never created. Either way there is nothing to clean up.
+        }
+    };
+    return {
+        backend: FILE_CREDENTIAL_BACKEND,
+        directory,
+        check(options) {
+            return options?.create === false ? inspectDirectory() : ensureDirectory();
+        },
+        isUsable() {
+            return ensureDirectory().ok;
+        },
+        has(account) {
+            try {
+                lstatSync(pathFor(account));
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+        read(account) {
+            const path = pathFor(account);
+            const inspected = inspectExistingFile(path);
+            if ('kind' in inspected)
+                return { kind: 'missing' };
+            if (!inspected.ok) {
+                return { kind: 'error', detail: `the stored login could not be trusted: ${inspected.detail}` };
+            }
+            let body;
+            try {
+                body = readFileSync(path, 'utf-8');
+            }
+            catch (error) {
+                return { kind: 'error', detail: fileSystemDetail(error) };
+            }
+            try {
+                const parsed = JSON.parse(body);
+                // The parse error and the parsed content are both withheld on purpose:
+                // whatever is in this file is either the token or something pretending to
+                // be it, and neither belongs in a message.
+                if (parsed.version !== FILE_FORMAT_VERSION) {
+                    return { kind: 'error', detail: 'the stored login is in a format this version does not understand' };
+                }
+                if (typeof parsed.secret !== 'string' || parsed.secret.length === 0) {
+                    return { kind: 'error', detail: 'the stored login file is incomplete' };
+                }
+                return { kind: 'found', secret: parsed.secret };
+            }
+            catch {
+                return { kind: 'error', detail: 'the stored login file is unreadable' };
+            }
+        },
+        save(account, secret) {
+            const directoryReady = ensureDirectory();
+            if (!directoryReady.ok) {
+                return { ok: false, detail: `a protected credential directory could not be created: ${directoryReady.detail}` };
+            }
+            const path = pathFor(account);
+            const existing = inspectExistingFile(path);
+            if (!('kind' in existing) && !existing.ok) {
+                // Replacing it would destroy evidence of whatever put it there, and
+                // renaming over a link or a directory has its own surprises.
+                return { ok: false, detail: `an existing credential file could not be trusted: ${existing.detail}` };
+            }
+            // Same directory as the target, so `rename` stays within one filesystem and
+            // is therefore atomic. `wx` guarantees the staging path is ours alone.
+            const staging = join(directory, `.${process.pid}-${randomUUID()}.tmp`);
+            const body = `${JSON.stringify({ version: FILE_FORMAT_VERSION, secret })}\n`;
+            try {
+                writeFileSync(staging, body, { encoding: 'utf-8', flag: 'wx', mode: FILE_MODE });
+                // `mode` on open is masked by umask, so the protection is restated — and
+                // on Windows this is where the ACL is applied, before any token is
+                // reachable under the final name.
+                const staged = protectPath(staging, 'file');
+                if (!staged.ok) {
+                    removeQuietly(staging);
+                    return { ok: false, detail: `the credential file could not be protected: ${staged.detail}` };
+                }
+                renameSync(staging, path);
+            }
+            catch (error) {
+                removeQuietly(staging);
+                return { ok: false, detail: fileSystemDetail(error) };
+            }
+            // A rename preserves POSIX modes and NTFS ACLs, but the whole point of this
+            // backend is that the protection is proven rather than assumed.
+            const published = protectPath(path, 'file');
+            if (!published.ok) {
+                removeQuietly(path);
+                return { ok: false, detail: `the credential file could not be protected: ${published.detail}` };
+            }
+            return { ok: true };
+        },
+        remove(account) {
+            // Deliberately does not create the directory: `remove` runs on every
+            // successful OS-backend write, and a logout on a healthy machine must not
+            // leave a credential directory behind.
+            removeQuietly(pathFor(account));
+        },
+    };
+}
+//# sourceMappingURL=fileCredentialStore.js.map

package/dist/auth/fileCredentialStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileCredentialStore.js","sourceRoot":"","sources":["../../src/auth/fileCredentialStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/G,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AAExD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AAE7D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,qCAAqC,CAAC;AAEnF,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,SAAS,GAAG,KAAK,CAAC;AAExB,qEAAqE;AACrE,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAqD9B,MAAM,UAAU,gCAAgC,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnF,MAAM,KAAK,GAAG,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACjD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;AACjG,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,kBAAkB,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC;AAC9D,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAqB,EACrB,QAAqD,EACrD,UAWI,EAAE;IAEN,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAgBD,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,OAAO,GAAe,EAAE,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACnG,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CAAC,OAAe,EAAE,SAAiB,EAAE,IAAmB;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAEzC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC;QACxC,0EAA0E;QAC1E,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC;QAC7E,4EAA4E;QAC5E,gEAAgE;QAChE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,KAAK,KAAK,QAAQ,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,SAAiB,EAAE,IAAY;IAC7E,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAC5E,CAAC;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,4EAA4E;QAC5E,0EAA0E;QAC1E,IAAI,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yDAAyD,EAAE,CAAC;QAC1F,CAAC;QACD,2EAA2E;QAC3E,6EAA6E;QAC7E,gDAAgD;QAChD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;QACjF,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,SAAiB,EAAE,IAA0B;IAC/F,0EAA0E;IAC1E,8EAA8E;IAC9E,2CAA2C;IAC3C,MAAM,KAAK,GAAG,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,SAAS,cAAc,CAAC,CAAC,CAAC,GAAG,SAAS,MAAM,CAAC;IACrF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,+CAA+C;AAC/C,SAAS,uBAAuB,CAAC,GAAsB;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IACtC,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,6EAA6E;IAC7E,6CAA6C;IAC7C,MAAM,IAAI,GAAI,KAAkC,EAAE,IAAI,CAAC;IACvD,OAAO,IAAI,CAAC,CAAC,CAAC,yCAAyC,IAAI,GAAG,CAAC,CAAC,CAAC,sCAAsC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,UAA4C,EAAE;IACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,mBAAmB,GAAG,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,EAAE,EAAE,GAAG,cAAc,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,QAAQ,KAAK,OAAO,CAAC;IACvC,MAAM,gBAAgB,GAAG,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEzE,MAAM,OAAO,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IAE1F,MAAM,SAAS,GAAG,CAAC,OAA0B,EAAmC,EAAE;QAChF,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5D,CAAC,CAAC;IAEF,qEAAqE;IACrE,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,IAA0B,EAAmB,EAAE;QAChF,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8DAA8D,EAAE,CAAC;YAC/F,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACvE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;YACvF,CAAC;YACD,MAAM,SAAS,GAAG,SAAS,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;YACxF,CAAC;YACD,OAAO,eAAe,CAAC,SAAS,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,KAAmC,CAAC;QACxC,IAAI,CAAC;YACH,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,CAAC;QAED,8EAA8E;QAC9E,+CAA+C;QAC/C,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,mBAAmB,CAAC,IAAI,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;YAClG,IAAI,CAAC;gBACH,SAAS,CAAC,IAAI,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACrE,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;YACjE,CAAC;YACD,IAAI,CAAC;gBACH,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,CAAC;QACH,CAAC;QAED,OAAO,oBAAoB,CACzB;YACE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE;YACtC,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,EACD,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,CAC/C,CAAC;IACJ,CAAC,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAyC,EAAE;QAClF,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,SAAS,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAAkC,EAAE,IAAI,KAAK,QAAQ;oBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;gBACvF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,CAAC;YACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8DAA8D,EAAE,CAAC;YAC/F,CAAC;YACD,MAAM,SAAS,GAAG,SAAS,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,SAAS,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;YACzG,OAAO,eAAe,CAAC,SAAS,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,KAAmC,CAAC;QACxC,IAAI,CAAC;YACH,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAAkC,EAAE,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACvF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,CAAC;QAED,OAAO,oBAAoB,CACzB;YACE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE;YACtC,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,EACD,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,CACvD,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,MAAM,GAA2B,IAAI,CAAC;IAE1C,MAAM,eAAe,GAAG,GAAoB,EAAE;QAC5C,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QAEnC,IAAI,CAAC;YACH,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAAkC,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3D,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,GAAG,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF;;;;;;;;;OASG;IACH,MAAM,gBAAgB,GAAG,GAAoB,EAAE;QAC7C,wEAAwE;QACxE,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QAEnC,IAAI,SAAS,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8DAA8D,EAAE,CAAC;QAC/F,CAAC;QAED,IAAI,KAAmC,CAAC;QACxC,IAAI,CAAC;YACH,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAAkC,EAAE,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,CAAC;QAED,2EAA2E;QAC3E,0DAA0D;QAC1D,IAAI,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAEnC,OAAO,oBAAoB,CACzB;YACE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE;YACtC,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,EACD,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,EAC3D,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAC7B,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,CAAC,IAAY,EAAQ,EAAE;QAC3C,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,uBAAuB;QAChC,SAAS;QAET,KAAK,CAAC,OAAO;YACX,OAAO,OAAO,EAAE,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;QAC5E,CAAC;QAED,QAAQ;YACN,OAAO,eAAe,EAAE,CAAC,EAAE,CAAC;QAC9B,CAAC;QAED,GAAG,CAAC,OAAO;YACT,IAAI,CAAC;gBACH,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,MAAM,IAAI,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACpD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,0CAA0C,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YACjG,CAAC;YAED,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4C,CAAC;gBAC3E,uEAAuE;gBACvE,0EAA0E;gBAC1E,2CAA2C;gBAC3C,IAAI,MAAM,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;oBAC3C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;gBACvG,CAAC;gBACD,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACpE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;gBAC1E,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,MAAM;YAClB,MAAM,cAAc,GAAG,eAAe,EAAE,CAAC;YACzC,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;gBACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0DAA0D,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;YAClH,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAC1C,oEAAoE;gBACpE,6DAA6D;gBAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qDAAqD,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACvG,CAAC;YAED,4EAA4E;YAC5E,uEAAuE;YACvE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;YACvE,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC;YAE7E,IAAI,CAAC;gBACH,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;gBACjF,yEAAyE;gBACzE,mEAAmE;gBACnE,kCAAkC;gBAClC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,aAAa,CAAC,OAAO,CAAC,CAAC;oBACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/F,CAAC;gBAED,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,aAAa,CAAC,OAAO,CAAC,CAAC;gBACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,CAAC;YAED,4EAA4E;YAC5E,gEAAgE;YAChE,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBAClB,aAAa,CAAC,IAAI,CAAC,CAAC;gBACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAClG,CAAC;YAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAED,MAAM,CAAC,OAAO;YACZ,qEAAqE;YACrE,0EAA0E;YAC1E,uCAAuC;YACvC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/personalTokenClient.d.ts

@@ -65,9 +65,15 @@ export interface PersonalTokenState {
     connected: boolean;
     /** false → the refresh token is session-memory only and disappears with this process. */
     persisted: boolean;
-    /** Which OS store is in play, regardless of whether it currently works. */
+    /** Which store holds this slot, regardless of whether it currently works. */
     storeBackend: CredentialBackendId;
     storeReason: CredentialStoreReason;
+    /**
+     * Why that backend, when the store had something to say — a rejected write, or
+     * the reason the OS store was skipped in favour of the file fallback. Absent
+     * on the ordinary path, where the backend name is the whole story.
+     */
+    storeDetail?: string;
     identity: PersonalTokenIdentity | null;
     expiresAt: number | null;
     /** The server rejected the refresh token; only a fresh login recovers. */
@@ -115,6 +121,40 @@ type ParsedTokenResponse = {
  * a truncated body). Only the first justifies destroying local credentials.
  */
 export declare function parseTokenResponse(response: Response): Promise<ParsedTokenResponse>;
+/** `flow: 'setup'` result the approval screen chose; `init` writes these into the project config. */
+export interface DeviceSetupResult {
+    teamId: string;
+    projectId: string;
+    agentConfigId: string;
+    agentName: string;
+    seedPlanId: string | null;
+}
+/**
+ * One poll's outcome, in the server's own vocabulary (RFC 8628 error codes).
+ *
+ * `transient` is deliberately separate from `denied`/`expired`: only the latter
+ * two are decisions, and treating a dropped connection as a decision would end a
+ * login the user is still completing.
+ */
+export type DevicePollOutcome = {
+    kind: 'approved';
+    session: PersonalTokenSession;
+    setup: DeviceSetupResult | null;
+} | {
+    kind: 'pending';
+} | {
+    kind: 'slowDown';
+    intervalSeconds: number | null;
+} | {
+    kind: 'denied';
+} | {
+    kind: 'expired';
+} | {
+    kind: 'invalid';
+} | {
+    kind: 'transient';
+    detail: string;
+};
 export declare class PersonalTokenClient {
     private readonly deps;
     private accessToken;
@@ -126,6 +166,16 @@ export declare class PersonalTokenClient {
     constructor(deps: PersonalTokenClientDeps);
     state(): PersonalTokenState;
     hasCredential(): boolean;
+    /**
+     * One poll of the RFC 8628 device token endpoint.
+     *
+     * Lives here rather than in the polling loop because the *storage* invariants
+     * are the same as a PKCE exchange: a credential the next process cannot find
+     * is not a login, so an unstorable token pair is revoked instead of orphaned.
+     * The loop only decides *when* to call this; the outcome vocabulary below is
+     * the server's error contract verbatim.
+     */
+    pollDeviceToken(deviceCode: string): Promise<DevicePollOutcome>;
     /**
      * Trade a PKCE authorization code for the first token pair.
      *

package/dist/auth/personalTokenClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"personalTokenClient.d.ts","sourceRoot":"","sources":["../../src/auth/personalTokenClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAyB,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC9G,OAAO,EAA+C,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC/G,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAE1B,kGAAkG;AAClG,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAAyC,CAAC;AAE/E,MAAM,MAAM,sBAAsB,GAC9B,eAAe,GACf,WAAW,GACX,eAAe,GACf,oBAAoB,GACpB,eAAe;AACjB,qFAAqF;GACnF,mBAAmB,CAAC;AAExB,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,IAAI,EAAE,sBAAsB;gBAA5B,IAAI,EAAE,sBAAsB,EACrC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,2BAA2B,GAAG,SAAS,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;AAE7F,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,SAAS,EAAE,OAAO,CAAC;IACnB,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,YAAY,EAAE,mBAAmB,CAAC;IAClC,WAAW,EAAE,qBAAqB,CAAC;IACnC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACvC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0EAA0E;IAC1E,iBAAiB,EAAE,OAAO,CAAC;IAC3B,kFAAkF;IAClF,cAAc,EAAE,2BAA2B,GAAG,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;OAIG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED,UAAU,aAAa;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED,KAAK,mBAAmB,GACpB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+CzF;AAED,qBAAa,mBAAmB;IAQlB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPjC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,cAAc,CAA4C;IAClE,OAAO,CAAC,eAAe,CAAuC;gBAEjC,IAAI,EAAE,uBAAuB;IAE1D,KAAK,IAAI,kBAAkB;IAc3B,aAAa,IAAI,OAAO;IAIxB;;;;;;;;;OASG;IACG,yBAAyB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyC7F;;;;;;OAMG;YACW,uBAAuB;IAwBrC;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAc9C,6FAA6F;IAC7F,qBAAqB,IAAI,IAAI;IAK7B;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAuC7B;;;;;OAKG;IACH,qBAAqB,IAAI,IAAI;YAIf,OAAO;IA0BrB,kEAAkE;YACpD,MAAM;YAmCN,SAAS;IAWvB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,KAAK;IASb,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,OAAO;CAGhB;AAWD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAc1E;AAED,6EAA6E;AAC7E,wBAAgB,iCAAiC,IAAI,IAAI,CAExD"}
+{"version":3,"file":"personalTokenClient.d.ts","sourceRoot":"","sources":["../../src/auth/personalTokenClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAyB,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE9G,OAAO,EAA+C,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC/G,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAE1B,kGAAkG;AAClG,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAAyC,CAAC;AAE/E,MAAM,MAAM,sBAAsB,GAC9B,eAAe,GACf,WAAW,GACX,eAAe,GACf,oBAAoB,GACpB,eAAe;AACjB,qFAAqF;GACnF,mBAAmB,CAAC;AAExB,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,IAAI,EAAE,sBAAsB;gBAA5B,IAAI,EAAE,sBAAsB,EACrC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,2BAA2B,GAAG,SAAS,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;AAE7F,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,SAAS,EAAE,OAAO,CAAC;IACnB,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAC;IACnB,6EAA6E;IAC7E,YAAY,EAAE,mBAAmB,CAAC;IAClC,WAAW,EAAE,qBAAqB,CAAC;IACnC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACvC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0EAA0E;IAC1E,iBAAiB,EAAE,OAAO,CAAC;IAC3B,kFAAkF;IAClF,cAAc,EAAE,2BAA2B,GAAG,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;OAIG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED,UAAU,aAAa;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED,KAAK,mBAAmB,GACpB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+CzF;AAED,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAAE,GACpF;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAwB1C,qBAAa,mBAAmB;IAQlB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPjC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,cAAc,CAA4C;IAClE,OAAO,CAAC,eAAe,CAAuC;gBAEjC,IAAI,EAAE,uBAAuB;IAE1D,KAAK,IAAI,kBAAkB;IAe3B,aAAa,IAAI,OAAO;IAIxB;;;;;;;;OAQG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAoGrE;;;;;;;;;OASG;IACG,yBAAyB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyC7F;;;;;;OAMG;YACW,uBAAuB;IAsCrC;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAc9C,6FAA6F;IAC7F,qBAAqB,IAAI,IAAI;IAK7B;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAuC7B;;;;;OAKG;IACH,qBAAqB,IAAI,IAAI;YAIf,OAAO;IA0BrB,kEAAkE;YACpD,MAAM;YAmCN,SAAS;IAWvB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,KAAK;IASb,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,OAAO;CAGhB;AAWD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAc1E;AAED,6EAA6E;AAC7E,wBAAgB,iCAAiC,IAAI,IAAI,CAExD"}