@claudexor/cli 3.2.1 → 3.3.7

package/dist/setup-login-completion.d.ts

@@ -0,0 +1,27 @@
+import { type ControlSetupJob } from "@claudexor/schema";
+import { type SetupLoginManifest } from "./setup-login-protocol.js";
+/** The two daemon-hosted vendor-CLI login modes (owner directive 2026-08-04). */
+export declare function isUrlDisclosureLoginMode(mode: string | undefined): mode is "url_disclosure" | "url_disclosure_with_input";
+export interface SetupLoginInputDeps {
+    status: (jobId: string) => ControlSetupJob;
+    manifestFor: (jobId: string) => SetupLoginManifest | null;
+    update: (jobId: string, patch: Record<string, unknown>) => ControlSetupJob;
+    iso: () => string;
+}
+export declare function submitSetupLoginInput(deps: SetupLoginInputDeps, input: unknown): ControlSetupJob;
+/** Post-deadline grace verification: one bounded final probe after the verify
+ * window closed. Returns which oracle confirmed, or null (the honest timeout
+ * stands). Probe failures read as null — the grace pass is best-effort. */
+export declare function graceVerifyAfterDeadline(input: {
+    profileId: string | null;
+    probeProfile: () => Promise<{
+        availability?: string;
+        verification?: string;
+    } | null>;
+    probeNative: () => Promise<{
+        source?: string;
+        availability?: string;
+        verification?: string;
+    } | null>;
+}): Promise<"profile_verified" | "native_verified" | null>;
+//# sourceMappingURL=setup-login-completion.d.ts.map

package/dist/setup-login-completion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-login-completion.d.ts","sourceRoot":"","sources":["../src/setup-login-completion.ts"],"names":[],"mappings":"AAQA,OAAO,EAA+B,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEtF,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,iFAAiF;AACjF,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,IAAI,IAAI,gBAAgB,GAAG,2BAA2B,CAExD;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,eAAe,CAAC;IAC3C,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,kBAAkB,GAAG,IAAI,CAAC;IAC1D,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,eAAe,CAAC;IAC3E,GAAG,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,OAAO,GAAG,eAAe,CAkDhG;AAED;;2EAE2E;AAC3E,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,OAAO,CAAC;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACrF,WAAW,EAAE,MAAM,OAAO,CAAC;QACzB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,IAAI,CAAC,CAAC;CACX,GAAG,OAAO,CAAC,kBAAkB,GAAG,iBAAiB,GAAG,IAAI,CAAC,CAiBzD"}

package/dist/setup-login-completion.js

@@ -0,0 +1,85 @@
+/**
+ * One-shot sign-in input delivery for url_disclosure_with_input logins
+ * (owner directive 2026-08-04): POST /v2/setup/jobs/:id/input lands the
+ * user's pasted completion value in a transient 0600 job-dir sidecar the
+ * runner writes to the vendor CLI's stdin. The value is NEVER journaled,
+ * logged, or persisted anywhere durable (the userCode rule, INV-062).
+ */
+import { existsSync } from "node:fs";
+import { ControlSetupJobInputRequest } from "@claudexor/schema";
+import { ACTIVE_SETUP_STATES } from "./setup-job-store.js";
+import { SETUP_LOGIN_PROTOCOL_VERSION, atomicPrivateJson, } from "./setup-login-protocol.js";
+/** The two daemon-hosted vendor-CLI login modes (owner directive 2026-08-04). */
+export function isUrlDisclosureLoginMode(mode) {
+    return mode === "url_disclosure" || mode === "url_disclosure_with_input";
+}
+export function submitSetupLoginInput(deps, input) {
+    const p = (input ?? {});
+    const jobId = typeof p.jobId === "string" ? p.jobId : "";
+    const value = ControlSetupJobInputRequest.parse({ value: p.value }).value;
+    const job = deps.status(jobId);
+    if (job.action !== "login" ||
+        !ACTIVE_SETUP_STATES.has(job.state) ||
+        !["launching", "awaiting_user"].includes(job.phase ?? "") ||
+        !job.authorization) {
+        throw Object.assign(new Error("setup job is not awaiting sign-in input"), {
+            code: "setup_input_not_applicable",
+            status: 409,
+        });
+    }
+    const manifest = deps.manifestFor(jobId);
+    if (!manifest ||
+        manifest.loginMode !== "url_disclosure_with_input" ||
+        !manifest.inputPath ||
+        manifest.executionId !== job.authorization.executionId) {
+        throw Object.assign(new Error("this login flow does not accept sign-in input"), {
+            code: "setup_input_not_applicable",
+            status: 409,
+        });
+    }
+    // One-shot: a second submission conflicts instead of silently replacing
+    // a value the runner may already be delivering. (atomicPrivateJson
+    // renames over its target, so the guard is this pre-check; the residual
+    // same-instant race only affects the submitter's own double-click.) The
+    // value itself is TRANSIENT: sidecar + vendor stdin only, never
+    // journaled or logged.
+    if (existsSync(manifest.inputPath)) {
+        throw Object.assign(new Error("sign-in input was already submitted for this login"), {
+            code: "setup_input_already_submitted",
+            status: 409,
+        });
+    }
+    atomicPrivateJson(manifest.inputPath, {
+        version: SETUP_LOGIN_PROTOCOL_VERSION,
+        jobId,
+        executionId: manifest.executionId,
+        value,
+        submittedAt: deps.iso(),
+    });
+    return deps.update(jobId, {
+        message: `${job.harness} sign-in input received — completing the vendor login.`,
+    });
+}
+/** Post-deadline grace verification: one bounded final probe after the verify
+ * window closed. Returns which oracle confirmed, or null (the honest timeout
+ * stands). Probe failures read as null — the grace pass is best-effort. */
+export async function graceVerifyAfterDeadline(input) {
+    try {
+        if (input.profileId) {
+            const status = await input.probeProfile();
+            return status?.availability === "available" && status.verification === "passed"
+                ? "profile_verified"
+                : null;
+        }
+        const readiness = await input.probeNative();
+        return readiness?.source === "native_session" &&
+            readiness.availability === "available" &&
+            readiness.verification === "passed"
+            ? "native_verified"
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=setup-login-completion.js.map

package/dist/setup-login-completion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-login-completion.js","sourceRoot":"","sources":["../src/setup-login-completion.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAwB,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,GAElB,MAAM,2BAA2B,CAAC;AAEnC,iFAAiF;AACjF,MAAM,UAAU,wBAAwB,CACtC,IAAwB;IAExB,OAAO,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,2BAA2B,CAAC;AAC3E,CAAC;AASD,MAAM,UAAU,qBAAqB,CAAC,IAAyB,EAAE,KAAc;IAC7E,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,2BAA2B,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,IACE,GAAG,CAAC,MAAM,KAAK,OAAO;QACtB,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;QACnC,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACzD,CAAC,GAAG,CAAC,aAAa,EAClB,CAAC;QACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,EAAE;YACxE,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,IACE,CAAC,QAAQ;QACT,QAAQ,CAAC,SAAS,KAAK,2BAA2B;QAClD,CAAC,QAAQ,CAAC,SAAS;QACnB,QAAQ,CAAC,WAAW,KAAK,GAAG,CAAC,aAAa,CAAC,WAAW,EACtD,CAAC;QACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+CAA+C,CAAC,EAAE;YAC9E,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;IACD,wEAAwE;IACxE,mEAAmE;IACnE,wEAAwE;IACxE,wEAAwE;IACxE,gEAAgE;IAChE,uBAAuB;IACvB,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oDAAoD,CAAC,EAAE;YACnF,IAAI,EAAE,+BAA+B;YACrC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;IACD,iBAAiB,CAAC,QAAQ,CAAC,SAAS,EAAE;QACpC,OAAO,EAAE,4BAA4B;QACrC,KAAK;QACL,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK;QACL,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;KACxB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;QACxB,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,wDAAwD;KAChF,CAAC,CAAC;AACL,CAAC;AAED;;2EAE2E;AAC3E,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAQ9C;IACC,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;YAC1C,OAAO,MAAM,EAAE,YAAY,KAAK,WAAW,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ;gBAC7E,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,SAAS,EAAE,MAAM,KAAK,gBAAgB;YAC3C,SAAS,CAAC,YAAY,KAAK,WAAW;YACtC,SAAS,CAAC,YAAY,KAAK,QAAQ;YACnC,CAAC,CAAC,iBAAiB;YACnB,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/setup-login-io.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Login-runner IO hygiene and delivery helpers (owner directive 2026-08-04):
+ * the bounded ANSI-stripped, secret-redacted, URL-query-redacted output tail
+ * that is the ONLY vendor output allowed near a durable surface (INV-062),
+ * and the one-shot input-sidecar-to-stdin delivery for
+ * url_disclosure_with_input logins.
+ */
+import type { ChildProcess } from "node:child_process";
+import { type SetupLoginManifest } from "./setup-login-protocol.js";
+export declare const OUTPUT_TAIL_BYTES = 4096;
+/**
+ * OAuth-URL capture for TERMINAL-mode logins (claude/cursor, and codex's
+ * legacy fallback): the vendor CLI prints its sign-in URL to its own output;
+ * detecting it lets the runner surface a STRUCTURED `oauth_url` disclosure on
+ * the job — the same sidecar + card shape as codex's device-code flow — so a
+ * UI can render "open this link" with no terminal. Bounded rolling window: a
+ * URL split across chunks is still caught, memory stays capped.
+ */
+export declare const TERM_ESCAPE_RE: RegExp;
+export declare const C0_CONTROL_RE: RegExp;
+/** One-shot delivery of the daemon-written input sidecar to the vendor CLI's
+ * stdin (url_disclosure_with_input — claude's pasted OAuth code). The value
+ * exists only in the 0600 job-dir sidecar and the child's stdin; it never
+ * touches the tail, the result, or any durable record. */
+export declare function watchLoginInput(manifest: SetupLoginManifest, child: ChildProcess, now: () => Date): () => void;
+/** Ring buffer of the last OUTPUT_TAIL_BYTES of tee'd vendor output. */
+export declare function createTailBuffer(): {
+    push(chunk: Buffer): void;
+    text(): string;
+};
+/** Strip terminal escapes (CSI, OSC, bare ESC, C0 controls except newline),
+ * redact secret-like tokens and URL queries, and clamp - diagnostic evidence
+ * entering a durable journal/API surface, never a raw vendor log copy
+ * (INV-062). */
+export declare function boundedTail(text: string, truncated?: boolean): string;
+//# sourceMappingURL=setup-login-io.d.ts.map

package/dist/setup-login-io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-login-io.d.ts","sourceRoot":"","sources":["../src/setup-login-io.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE1F,eAAO,MAAM,iBAAiB,OAAO,CAAC;AAEtC;;;;;;;GAOG;AAEH,eAAO,MAAM,cAAc,QACgD,CAAC;AAE5E,eAAO,MAAM,aAAa,QAAwC,CAAC;AAInE;;;0DAG0D;AAC1D,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,kBAAkB,EAC5B,KAAK,EAAE,YAAY,EACnB,GAAG,EAAE,MAAM,IAAI,GACd,MAAM,IAAI,CAiBZ;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,IAAI;IAAE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,IAAI,MAAM,CAAA;CAAE,CAsBhF;AAMD;;;gBAGgB;AAChB,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,UAAQ,GAAG,MAAM,CAqBnE"}

package/dist/setup-login-io.js

@@ -0,0 +1,99 @@
+import { redactSecrets } from "@claudexor/util";
+import { readRunnerLoginInput } from "./setup-login-protocol.js";
+export const OUTPUT_TAIL_BYTES = 4096;
+/**
+ * OAuth-URL capture for TERMINAL-mode logins (claude/cursor, and codex's
+ * legacy fallback): the vendor CLI prints its sign-in URL to its own output;
+ * detecting it lets the runner surface a STRUCTURED `oauth_url` disclosure on
+ * the job — the same sidecar + card shape as codex's device-code flow — so a
+ * UI can render "open this link" with no terminal. Bounded rolling window: a
+ * URL split across chunks is still caught, memory stays capped.
+ */
+// eslint-disable-next-line no-control-regex
+export const TERM_ESCAPE_RE = /\u001b(?:\[[0-9;?]*[ -/]*[@-~]|\][^\u0007\u001b]*(?:\u0007|\u001b\\)?)/g;
+// eslint-disable-next-line no-control-regex
+export const C0_CONTROL_RE = /[\u0000-\u0009\u000b-\u001f\u007f]/g;
+const INPUT_POLL_MS = 300;
+/** One-shot delivery of the daemon-written input sidecar to the vendor CLI's
+ * stdin (url_disclosure_with_input — claude's pasted OAuth code). The value
+ * exists only in the 0600 job-dir sidecar and the child's stdin; it never
+ * touches the tail, the result, or any durable record. */
+export function watchLoginInput(manifest, child, now) {
+    let delivered = false;
+    const timer = setInterval(() => {
+        if (delivered || !manifest.inputPath || !child.stdin || child.stdin.destroyed)
+            return;
+        const input = readRunnerLoginInput(manifest.inputPath, manifest.jobId, manifest.executionId);
+        if (!input)
+            return;
+        delivered = true;
+        try {
+            child.stdin.write(`${input.value}\n`);
+        }
+        catch {
+            // A dead stdin means the vendor already exited; the result receipt
+            // carries the real outcome.
+        }
+    }, INPUT_POLL_MS);
+    timer.unref?.();
+    void now;
+    return () => clearInterval(timer);
+}
+/** Ring buffer of the last OUTPUT_TAIL_BYTES of tee'd vendor output. */
+export function createTailBuffer() {
+    // Byte-accurate ring: keep the final OUTPUT_TAIL_BYTES RAW bytes, decode
+    // ONCE in text() (per-chunk String() splits multibyte UTF-8; UTF-16 .slice
+    // miscounts the byte bound).
+    let tail = Buffer.alloc(0);
+    // Ring overflow is tracked HERE and handed to boundedTail — the decoded
+    // string's length (already <= the cap) cannot recover it (X224).
+    let overflowed = false;
+    return {
+        push(chunk) {
+            const combined = Buffer.concat([tail, chunk]);
+            if (combined.length > OUTPUT_TAIL_BYTES)
+                overflowed = true;
+            tail = combined.subarray(-OUTPUT_TAIL_BYTES);
+        },
+        text() {
+            // The ring can start mid-codepoint: drop leading continuation bytes
+            // (0b10xxxxxx) so the decode never opens with a replacement char.
+            let start = 0;
+            while (start < tail.length && (tail[start] & 0b1100_0000) === 0b1000_0000)
+                start += 1;
+            return boundedTail(tail.subarray(start).toString("utf8"), overflowed || start > 0);
+        },
+    };
+}
+// Live sign-in material rides a URL's QUERY (state/code_challenge/user_code):
+// transient-sidecar-only, never durable (f-78414434ad00). Host+path stay.
+const URL_QUERY_RE = /(https?:\/\/[^\s"'<>?#]+)\?[^\s"'<>]*/g;
+/** Strip terminal escapes (CSI, OSC, bare ESC, C0 controls except newline),
+ * redact secret-like tokens and URL queries, and clamp - diagnostic evidence
+ * entering a durable journal/API surface, never a raw vendor log copy
+ * (INV-062). */
+export function boundedTail(text, truncated = false) {
+    const plain = text
+        .replace(TERM_ESCAPE_RE, "")
+        .replace(C0_CONTROL_RE, "")
+        .replace(URL_QUERY_RE, "$1?[redacted]");
+    // Redact the complete sanitized input before any boundary is selected: a
+    // tail-first clamp can strip the prefix a token detector needs to anchor.
+    const redacted = redactSecrets(plain);
+    // When the source was truncated at the front (ring overflow, or a
+    // direct-string caller over the byte budget), a secret split by that
+    // boundary could leave a prefix-less fragment redactSecrets cannot anchor —
+    // drop the leading partial token. The caller's flag is authoritative (a
+    // ring string is already <= the cap, so length cannot see the cut).
+    const bytes = Buffer.from(redacted, "utf8");
+    const cut = truncated || bytes.length > OUTPUT_TAIL_BYTES;
+    const tail = bytes.subarray(Math.max(0, bytes.length - OUTPUT_TAIL_BYTES));
+    let start = 0;
+    while (start < tail.length && (tail[start] & 0b1100_0000) === 0b1000_0000)
+        start += 1;
+    let bounded = tail.subarray(start).toString("utf8");
+    if (cut)
+        bounded = bounded.replace(/^\S+/, "");
+    return bounded.trim();
+}
+//# sourceMappingURL=setup-login-io.js.map

package/dist/setup-login-io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-login-io.js","sourceRoot":"","sources":["../src/setup-login-io.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAA2B,MAAM,2BAA2B,CAAC;AAE1F,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAEtC;;;;;;;GAOG;AACH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,cAAc,GACzB,yEAAyE,CAAC;AAC5E,4CAA4C;AAC5C,MAAM,CAAC,MAAM,aAAa,GAAG,qCAAqC,CAAC;AAEnE,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B;;;0DAG0D;AAC1D,MAAM,UAAU,eAAe,CAC7B,QAA4B,EAC5B,KAAmB,EACnB,GAAe;IAEf,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,IAAI,SAAS,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS;YAAE,OAAO;QACtF,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC7F,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,SAAS,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,4BAA4B;QAC9B,CAAC;IACH,CAAC,EAAE,aAAa,CAAC,CAAC;IAClB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,KAAK,GAAG,CAAC;IACT,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,gBAAgB;IAC9B,yEAAyE;IACzE,2EAA2E;IAC3E,6BAA6B;IAC7B,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,OAAO;QACL,IAAI,CAAC,KAAK;YACR,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC9C,IAAI,QAAQ,CAAC,MAAM,GAAG,iBAAiB;gBAAE,UAAU,GAAG,IAAI,CAAC;YAC3D,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI;YACF,oEAAoE;YACpE,kEAAkE;YAClE,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAE,GAAG,WAAW,CAAC,KAAK,WAAW;gBAAE,KAAK,IAAI,CAAC,CAAC;YACvF,OAAO,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,MAAM,YAAY,GAAG,wCAAwC,CAAC;AAE9D;;;gBAGgB;AAChB,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,SAAS,GAAG,KAAK;IACzD,MAAM,KAAK,GAAG,IAAI;SACf,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;SAC1B,OAAO,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAC1C,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,kEAAkE;IAClE,qEAAqE;IACrE,4EAA4E;IAC5E,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB,CAAC;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC;IAC3E,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAE,GAAG,WAAW,CAAC,KAAK,WAAW;QAAE,KAAK,IAAI,CAAC,CAAC;IACvF,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,GAAG;QAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC"}

package/dist/setup-login-protocol.d.ts

@@ -1,4 +1,4 @@
-import { type SetupLoginDeviceCode, type SetupLoginManifest, type SetupLoginPermit, type SetupLoginRunnerResult, type SetupLoginRunnerState, type SetupExecutableEvidence } from "@claudexor/schema";
+import { type SetupLoginDeviceCode, type SetupLoginInput, type SetupLoginManifest, type SetupLoginPermit, type SetupLoginRunnerResult, type SetupLoginRunnerState, type SetupExecutableEvidence } from "@claudexor/schema";
 export type { SetupLoginDeviceCode, SetupLoginManifest, SetupLoginPermit, SetupLoginRunnerResult, SetupLoginRunnerState, SetupExecutableEvidence, };
 export declare const SETUP_LOGIN_PROTOCOL_VERSION: 2;
 export declare function readLoginManifest(path: string): SetupLoginManifest;
@@ -10,5 +10,8 @@ export declare function readRunnerState(path: string): SetupLoginRunnerState | n
 export declare function readRunnerResult(path: string): SetupLoginRunnerResult | null;
 export declare function readRunnerPermit(path: string): SetupLoginPermit | null;
 export declare function readRunnerDeviceCode(path: string): SetupLoginDeviceCode | null;
+/** One-shot input sidecar read, bound to the exact job execution: a stale or
+ * foreign file (wrong jobId/executionId) reads as absent, never as input. */
+export declare function readRunnerLoginInput(path: string, jobId: string, executionId: string): SetupLoginInput | null;
 export declare function atomicPrivateJson(path: string, value: unknown): void;
 //# sourceMappingURL=setup-login-protocol.d.ts.map

package/dist/setup-login-protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-login-protocol.d.ts","sourceRoot":"","sources":["../src/setup-login-protocol.ts"],"names":[],"mappings":"AAiBA,OAAO,EAML,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,GACxB,CAAC;AAEF,eAAO,MAAM,4BAA4B,EAAG,CAAU,CAAC;AAGvD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CA4ClE;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAqB/E;AAED,wBAAgB,aAAa,CAC3B,UAAU,EAAE,uBAAuB,EACnC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,MAAM,CAIR;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,GAChD,kBAAkB,CAUpB;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAQnF;AAiBD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAM1E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAM5E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAMtE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAM9E;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CA+BpE"}
+{"version":3,"file":"setup-login-protocol.d.ts","sourceRoot":"","sources":["../src/setup-login-protocol.ts"],"names":[],"mappings":"AAkBA,OAAO,EAOL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,GACxB,CAAC;AAEF,eAAO,MAAM,4BAA4B,EAAG,CAAU,CAAC;AAGvD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAoDlE;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAqB/E;AAED,wBAAgB,aAAa,CAC3B,UAAU,EAAE,uBAAuB,EACnC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,MAAM,CAIR;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,GAChD,kBAAkB,CAUpB;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAQnF;AAiBD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAM1E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAM5E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAMtE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAM9E;AAED;6EAC6E;AAC7E,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,eAAe,GAAG,IAAI,CAQxB;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CA+BpE"}

package/dist/setup-login-protocol.js

@@ -2,7 +2,8 @@ import { createHash, randomUUID } from "node:crypto";
 import { closeSync, constants, fchmodSync, fstatSync, fsyncSync, lstatSync, openSync, readFileSync, realpathSync, renameSync, rmSync, writeSync, } from "node:fs";
 import { basename, dirname, join, resolve, sep } from "node:path";
 import { withExecutableInspection, isBoundedRegularExecutable } from "@claudexor/core";
-import { SetupLoginDeviceCode as SetupLoginDeviceCodeSchema, SetupLoginManifest as SetupLoginManifestSchema, SetupLoginPermit as SetupLoginPermitSchema, SetupLoginRunnerResult as SetupLoginRunnerResultSchema, SetupLoginRunnerState as SetupLoginRunnerStateSchema, } from "@claudexor/schema";
+import { fsyncDirectory } from "@claudexor/util";
+import { SetupLoginDeviceCode as SetupLoginDeviceCodeSchema, SetupLoginInput as SetupLoginInputSchema, SetupLoginManifest as SetupLoginManifestSchema, SetupLoginPermit as SetupLoginPermitSchema, SetupLoginRunnerResult as SetupLoginRunnerResultSchema, SetupLoginRunnerState as SetupLoginRunnerStateSchema, } from "@claudexor/schema";
 export const SETUP_LOGIN_PROTOCOL_VERSION = 2;
 const MAX_SIDECAR_BYTES = 1024 * 1024;
 export function readLoginManifest(path) {
@@ -39,6 +40,12 @@ export function readLoginManifest(path) {
             throw new Error("setup-login device-code sidecar escapes or relocates its daemon-owned job directory");
         }
     }
+    if (manifest.inputPath !== undefined) {
+        const inputParent = realpathSync(dirname(resolve(manifest.inputPath)));
+        if (inputParent !== jobDir || basename(manifest.inputPath) !== "runner-input.json") {
+            throw new Error("setup-login input sidecar escapes or relocates its daemon-owned job directory");
+        }
+    }
     const cwd = realpathSync(manifest.cwd);
     if (cwd !== jobDir && !cwd.startsWith(jobDir + sep))
         throw new Error("setup-login cwd escapes its job directory");
@@ -135,6 +142,19 @@ export function readRunnerDeviceCode(path) {
         return null;
     }
 }
+/** One-shot input sidecar read, bound to the exact job execution: a stale or
+ * foreign file (wrong jobId/executionId) reads as absent, never as input. */
+export function readRunnerLoginInput(path, jobId, executionId) {
+    try {
+        const parsed = SetupLoginInputSchema.parse(readPrivateJson(path));
+        if (parsed.jobId !== jobId || parsed.executionId !== executionId)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
 export function atomicPrivateJson(path, value) {
     const absolute = resolve(path);
     const parent = dirname(absolute);
@@ -189,13 +209,4 @@ function readPrivateJson(path) {
         closeSync(fd);
     }
 }
-function fsyncDirectory(path) {
-    const fd = openSync(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
-    try {
-        fsyncSync(fd);
-    }
-    finally {
-        closeSync(fd);
-    }
-}
 //# sourceMappingURL=setup-login-protocol.js.map

package/dist/setup-login-protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-login-protocol.js","sourceRoot":"","sources":["../src/setup-login-protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,MAAM,EACN,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EACL,oBAAoB,IAAI,0BAA0B,EAClD,kBAAkB,IAAI,wBAAwB,EAC9C,gBAAgB,IAAI,sBAAsB,EAC1C,sBAAsB,IAAI,4BAA4B,EACtD,qBAAqB,IAAI,2BAA2B,GAOrD,MAAM,mBAAmB,CAAC;AAW3B,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAU,CAAC;AACvD,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtC,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/E,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,eAAe,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACzE,IACE,WAAW,KAAK,MAAM;QACtB,YAAY,KAAK,MAAM;QACvB,YAAY,KAAK,MAAM;QACvB,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,mBAAmB;QACpD,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,oBAAoB;QACtD,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,oBAAoB,EACtD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QACjF,IACE,gBAAgB,KAAK,MAAM;YAC3B,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,wBAAwB,EAC9D,CAAC;YACD,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,gFAAgF;IAChF,6EAA6E;IAC7E,2EAA2E;IAC3E,OAAO,wBAAwB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;QACjD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACxD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,UAAmC,EACnC,IAAuB;IAEvB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;SACvD,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAiD;IAEjD,6EAA6E;IAC7E,0EAA0E;IAC1E,sDAAsD;IACtD,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC;QAC5C,GAAG,KAAK;QACR,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KAC/B,CAAC,CAAC;IACH,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC7D,OAAO,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAiC;IACxE,IAAI,CAAC;QACH,OAAO,CACL,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAC1F,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,QAA4B;IACzD,MAAM,EAAE,cAAc,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC;IACjD,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,cAAc;QACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,CAAC,QAAQ;QAClD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,IAAI,aAAa,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,OAAO,4BAA4B,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC;QACH,OAAO,0BAA0B,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAc;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAChG,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CACX,GAAG,EACH,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,EAChF,KAAK,CACN,CAAC;QACF,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC3F,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAO,OAAO,GAAG,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;QAChG,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,EAAE,GAAG,SAAS,CAAC;QACf,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1B,cAAc,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAClC,IACE,KAAK,CAAC,cAAc,EAAE;YACtB,CAAC,KAAK,CAAC,MAAM,EAAE;YACf,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YACxB,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EACxB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7F,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC"}
+{"version":3,"file":"setup-login-protocol.js","sourceRoot":"","sources":["../src/setup-login-protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,MAAM,EACN,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,oBAAoB,IAAI,0BAA0B,EAClD,eAAe,IAAI,qBAAqB,EACxC,kBAAkB,IAAI,wBAAwB,EAC9C,gBAAgB,IAAI,sBAAsB,EAC1C,sBAAsB,IAAI,4BAA4B,EACtD,qBAAqB,IAAI,2BAA2B,GAQrD,MAAM,mBAAmB,CAAC;AAW3B,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAU,CAAC;AACvD,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtC,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/E,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,eAAe,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACzE,IACE,WAAW,KAAK,MAAM;QACtB,YAAY,KAAK,MAAM;QACvB,YAAY,KAAK,MAAM;QACvB,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,mBAAmB;QACpD,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,oBAAoB;QACtD,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,oBAAoB,EACtD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QACjF,IACE,gBAAgB,KAAK,MAAM;YAC3B,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,wBAAwB,EAC9D,CAAC;YACD,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,WAAW,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,mBAAmB,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,gFAAgF;IAChF,6EAA6E;IAC7E,2EAA2E;IAC3E,OAAO,wBAAwB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;QACjD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACxD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,UAAmC,EACnC,IAAuB;IAEvB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;SACvD,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAiD;IAEjD,6EAA6E;IAC7E,0EAA0E;IAC1E,sDAAsD;IACtD,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC;QAC5C,GAAG,KAAK;QACR,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KAC/B,CAAC,CAAC;IACH,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC7D,OAAO,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAiC;IACxE,IAAI,CAAC;QACH,OAAO,CACL,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAC1F,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,QAA4B;IACzD,MAAM,EAAE,cAAc,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC;IACjD,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,cAAc;QACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,CAAC,QAAQ;QAClD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,IAAI,aAAa,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,OAAO,4BAA4B,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC;QACH,OAAO,0BAA0B,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;6EAC6E;AAC7E,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,KAAa,EACb,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAC9E,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAc;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAChG,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CACX,GAAG,EACH,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,EAChF,KAAK,CACN,CAAC;QACF,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC3F,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAO,OAAO,GAAG,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;QAChG,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,EAAE,GAAG,SAAS,CAAC;QACf,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1B,cAAc,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAClC,IACE,KAAK,CAAC,cAAc,EAAE;YACtB,CAAC,KAAK,CAAC,MAAM,EAAE;YACf,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YACxB,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EACxB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/setup-login-runner.d.ts

@@ -18,13 +18,13 @@ export interface SetupLoginRunnerOptions {
 export declare function runSetupLogin(manifestPath: string, options?: SetupLoginRunnerOptions): Promise<number>;
 /** Worker entrypoint. Exported so the permit ordering can be fault-injected. */
 export declare function runSetupLoginWorker(manifestPath: string, options?: SetupLoginRunnerOptions): Promise<number>;
-/** Ring buffer of the last OUTPUT_TAIL_BYTES of tee'd vendor output. */
-export declare function createTailBuffer(): {
-    push(chunk: Buffer): void;
-    text(): string;
+export declare function extractOAuthUrl(text: string): string | null;
+/**
+ * Per-login detector. A match ending at the window's very end may be cut by a
+ * chunk boundary (wave finding): it is published PROVISIONALLY, superseded by
+ * a longer capture, and FINAL only once output continues past its end.
+ */
+export declare function createOAuthUrlDetector(): {
+    push(chunk: Buffer): string | null;
 };
-/** Strip terminal escapes (CSI, OSC, bare ESC, C0 controls except newline),
- * redact secret-like tokens, and clamp - diagnostic evidence entering a
- * durable journal/API surface, never a raw vendor log copy (INV-062). */
-export declare function boundedTail(text: string, truncated?: boolean): string;
 //# sourceMappingURL=setup-login-runner.d.ts.map

package/dist/setup-login-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-login-runner.d.ts","sourceRoot":"","sources":["../src/setup-login-runner.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,KAAK,EAAwC,MAAM,oBAAoB,CAAC;AAKjF,OAAO,EACL,mBAAmB,EAGpB,MAAM,iBAAiB,CAAC;AAQzB,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAc3E,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,YAAY,CAAC,EAAE,OAAO,KAAK,CAAC;IAC5B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED,gFAAgF;AAChF,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,MAAM,CAAC,CAiKjB;AAqKD,wEAAwE;AACxE,wBAAgB,gBAAgB,IAAI;IAAE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,IAAI,MAAM,CAAA;CAAE,CAuBhF;AAED;;yEAEyE;AACzE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,UAAQ,GAAG,MAAM,CAyBnE"}
+{"version":3,"file":"setup-login-runner.d.ts","sourceRoot":"","sources":["../src/setup-login-runner.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,KAAK,EAAwC,MAAM,oBAAoB,CAAC;AAKjF,OAAO,EAAE,mBAAmB,EAA8B,MAAM,iBAAiB,CAAC;AAOlF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAqB3E,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,YAAY,CAAC,EAAE,OAAO,KAAK,CAAC;IAC5B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED,gFAAgF;AAChF,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,MAAM,CAAC,CAkKjB;AA+ID,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO3D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI;IAAE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;CAAE,CAuB/E"}