@tickernelz/paperclip-pro-adapter-claude-local 2026.925.0

package/dist/server/setup-token-runner.d.ts

@@ -0,0 +1,115 @@
+import { type LoginRunnerDisposable, type LoginRunnerLifecycleOptions, type LoginRunnerOutcome, type LoginRunnerResult } from "@tickernelz/paperclip-pro-adapter-utils";
+import { type SetupTokenPrompt } from "./setup-token-parse.js";
+/** The fixed Claude setup-token command. The login flow needs a PTY. */
+export declare const CLAUDE_SETUP_TOKEN_COMMAND = "claude setup-token";
+/**
+ * The submission terminator for the browser code. The interactive login UI reads
+ * the code on a PTY and submits it on a carriage return. The runner writes this
+ * terminator as its own write, after the code write and a short settle delay.
+ * The live characterization showed that a single write of `code + "\r"` does not
+ * submit: the input is an Ink text field with paste handling, so a glued
+ * carriage return folds into the pasted text instead of a Return key, and the
+ * login stalls at the prompt. Two writes with a settle gap submit on the first
+ * Return.
+ */
+export declare const CODE_SUBMISSION_TERMINATOR = "\r";
+/**
+ * The default settle delay in milliseconds between the code write and the
+ * terminator write. The delay lets the Ink paste buffer settle, so the terminator
+ * arrives as a distinct Return key. A caller can override it; a test sets it to 0.
+ */
+export declare const CODE_SUBMIT_SETTLE_MS = 150;
+/**
+ * The maximum number of characters the runner keeps for the next chunk. The
+ * login prompt is small and puts the URL and the prompt line close together. A
+ * sandbox can stream a large volume of output before the prompt. So after each
+ * parse the runner keeps only the most recent characters up to this limit. The
+ * retained buffer cannot grow without a bound across many chunks. The limit is
+ * far larger than the prompt, so the trailing window never drops a real prompt
+ * that spans a chunk boundary.
+ */
+export declare const CLAUDE_SETUP_TOKEN_MAX_BUFFER_CHARS: number;
+/**
+ * The child side of the setup-token run. The runner never spawns the PTY
+ * directly; a caller injects a concrete driver. A production driver binds these
+ * methods to a PTY child that runs {@link CLAUDE_SETUP_TOKEN_COMMAND}.
+ */
+export interface SetupTokenPtyDriver extends LoginRunnerDisposable {
+    /**
+     * Starts `command` in a PTY and streams the terminal output to `onData` in
+     * memory. Resolves with the child exit code when the child ends. A driver must
+     * not persist the raw output to any durable log.
+     */
+    start(command: string, onData: (chunk: string) => void): Promise<{
+        exitCode: number | null;
+    }>;
+    /**
+     * Writes `input` to the child PTY. The runner writes the browser code plus the
+     * submission terminator one time, only after it matches the prompt.
+     */
+    write(input: string): void;
+    /**
+     * Stops the child process with a direct child stop. The characterization showed
+     * that the child needs `SIGKILL`. The method must be safe to call before start
+     * and safe to call more than one time.
+     */
+    stop(): void;
+}
+/** Receives the parsed prompt one time in memory. The caller displays it. */
+export type SetupTokenPromptSink = (prompt: SetupTokenPrompt) => void;
+/**
+ * Returns the one browser code the user pastes from the sign-in page. The runner
+ * calls it one time, only after it surfaces the prompt. The runner passes an
+ * abort signal, so the provider can stop when the runner cancels or times out.
+ */
+export type SetupTokenCodeProvider = (signal: AbortSignal) => Promise<string>;
+/**
+ * Receives the credential bytes one time in memory on success. The runner binds
+ * the token from the success record, then it awaits this sink one time with the
+ * token bytes. The sink is mandatory and it returns a promise; the runner awaits
+ * that promise before it reports success. A sink rejection ends the run as a
+ * failure. The runner never logs the bytes and never stores them on the result.
+ */
+export type SetupTokenCredentialSink = (authBytes: Buffer) => Promise<void>;
+/** The setup-token runner outcome. It is a fixed, non-secret status. */
+export type SetupTokenOutcome = LoginRunnerOutcome;
+/**
+ * The runner result. It never carries a URL, a code, or a token byte. It extends
+ * the base result with the two setup-token status fields.
+ */
+export interface SetupTokenLoginResult extends LoginRunnerResult {
+    codeSubmitted: boolean;
+    /** True when the runner bound the token and invoked `onCredential` one time. */
+    credentialDelivered: boolean;
+}
+export interface RunSetupTokenLoginOptions extends LoginRunnerLifecycleOptions {
+    /** The login command. Defaults to {@link CLAUDE_SETUP_TOKEN_COMMAND}. */
+    command?: string;
+    /** Receives the parsed prompt one time in memory. The caller displays it. */
+    onPrompt: SetupTokenPromptSink;
+    /** Returns the one browser code. The runner writes it to the matched prompt. */
+    provideCode: SetupTokenCodeProvider;
+    /**
+     * The credential sink. The runner awaits it one time with the token bytes and
+     * reports success only after it resolves. The sink is mandatory for a
+     * successful run: a missing sink ends the run as a failure. The option stays
+     * optional so a caller can drive a fail-closed path with no sink.
+     */
+    onCredential?: SetupTokenCredentialSink;
+    /**
+     * The settle delay in milliseconds between the code write and the terminator
+     * write. Defaults to {@link CODE_SUBMIT_SETTLE_MS}. A test sets it to 0.
+     */
+    codeSubmitSettleMs?: number;
+}
+/**
+ * Runs the setup-token login through `driver`. Surfaces the prompt one time
+ * through `onPrompt`. Reads the browser code one time through `provideCode` and
+ * writes it to the matched prompt. Binds the minted token from the success
+ * record and delivers it one time through `onCredential`. Returns a fixed status.
+ * Stops the child and disposes the driver for every terminal state. Never logs
+ * the raw stream, and never puts a URL, a code, or a token into a log line, the
+ * result, or a thrown error.
+ */
+export declare function runSetupTokenLogin(driver: SetupTokenPtyDriver, options: RunSetupTokenLoginOptions): Promise<SetupTokenLoginResult>;
+//# sourceMappingURL=setup-token-runner.d.ts.map

package/dist/server/setup-token-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-token-runner.d.ts","sourceRoot":"","sources":["../../src/server/setup-token-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAC;AA6BhC,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAE/D;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,QAAY,CAAC;AAE7D;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,qBAAqB;IAChE;;;;OAIG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC9F;;;OAGG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;OAIG;IACH,IAAI,IAAI,IAAI,CAAC;CACd;AAED,6EAA6E;AAC7E,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC;AAEtE;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5E,wEAAwE;AACxE,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAEnD;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB;IAC9D,aAAa,EAAE,OAAO,CAAC;IACvB,gFAAgF;IAChF,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,yBAA0B,SAAQ,2BAA2B;IAC5E,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,gFAAgF;IAChF,WAAW,EAAE,sBAAsB,CAAC;IACpC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,wBAAwB,CAAC;IACxC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAyCD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,mBAAmB,EAC3B,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,qBAAqB,CAAC,CA+MhC"}

package/dist/server/setup-token-runner.js

@@ -0,0 +1,317 @@
+import { raceLoginRunnerExit, } from "@tickernelz/paperclip-pro-adapter-utils";
+import { parseSetupTokenCredential, parseSetupTokenPrompt, } from "./setup-token-parse.js";
+// The Claude `setup-token` login runner. It starts `claude setup-token` through
+// an injected {@link SetupTokenPtyDriver}, surfaces the sign-in prompt one time
+// in memory, accepts one browser code, sends the code to the matched prompt, and
+// delivers the minted OAuth token one time. It handles a timeout and a
+// cancellation, and it stops the child for every terminal state.
+//
+// Security (secret handling): the runner treats every byte of the terminal
+// stream as secret-bearing, untrusted input. It parses the stream in an in-memory
+// buffer only. It drops the prompt buffer as soon as it finds the prompt, and it
+// drops the token buffer as soon as it binds the token. It never forwards the raw
+// text to a log or an artifact, and it never stores the raw text on the result.
+// The runner reports only a fixed, non-secret status. It passes the prompt one
+// time through the in-memory `onPrompt` callback. It reads the browser code one
+// time through the in-memory `provideCode` callback and writes the code only to
+// the child, only after it matches the prompt. It delivers the token one time
+// through the in-memory `onCredential` sink. The runner keeps the URL, the code,
+// and any token byte out of every log line and every thrown error.
+//
+// Fail-closed credential delivery. The `onCredential` sink is mandatory and
+// awaited. The runner binds the token from the exact success record with
+// {@link parseSetupTokenCredential}, then it awaits the sink one time. It sets
+// `credentialDelivered` true only after the sink resolves. A missing sink, a
+// success stream with no token, and a sink rejection each end the run as a
+// failure; the runner never reports success without a resolved sink. The runner
+// zeros the token bytes in a `finally` block on every path, so the secret never
+// outlives the delivery.
+/** The fixed Claude setup-token command. The login flow needs a PTY. */
+export const CLAUDE_SETUP_TOKEN_COMMAND = "claude setup-token";
+/**
+ * The submission terminator for the browser code. The interactive login UI reads
+ * the code on a PTY and submits it on a carriage return. The runner writes this
+ * terminator as its own write, after the code write and a short settle delay.
+ * The live characterization showed that a single write of `code + "\r"` does not
+ * submit: the input is an Ink text field with paste handling, so a glued
+ * carriage return folds into the pasted text instead of a Return key, and the
+ * login stalls at the prompt. Two writes with a settle gap submit on the first
+ * Return.
+ */
+export const CODE_SUBMISSION_TERMINATOR = "\r";
+/**
+ * The default settle delay in milliseconds between the code write and the
+ * terminator write. The delay lets the Ink paste buffer settle, so the terminator
+ * arrives as a distinct Return key. A caller can override it; a test sets it to 0.
+ */
+export const CODE_SUBMIT_SETTLE_MS = 150;
+/**
+ * The maximum number of characters the runner keeps for the next chunk. The
+ * login prompt is small and puts the URL and the prompt line close together. A
+ * sandbox can stream a large volume of output before the prompt. So after each
+ * parse the runner keeps only the most recent characters up to this limit. The
+ * retained buffer cannot grow without a bound across many chunks. The limit is
+ * far larger than the prompt, so the trailing window never drops a real prompt
+ * that spans a chunk boundary.
+ */
+export const CLAUDE_SETUP_TOKEN_MAX_BUFFER_CHARS = 64 * 1024;
+/**
+ * Waits `ms` milliseconds, or resolves at once when the signal aborts. The
+ * routine lets the Ink paste buffer settle between the code write and the
+ * terminator write. It never rejects; a caller checks the signal after it
+ * resolves. A zero or negative delay resolves on the next microtask.
+ */
+function settleDelay(ms, signal) {
+    if (ms <= 0 || signal.aborted)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        const done = () => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", done);
+            resolve();
+        };
+        const timer = setTimeout(done, ms);
+        signal.addEventListener("abort", done, { once: true });
+    });
+}
+/**
+ * Stops the child and releases the driver for a terminal state. The runner calls
+ * this on every exit path: a normal exit, a non-zero exit, a timeout, a
+ * cancellation, and an error. It first runs a direct child stop, then it disposes
+ * the driver. A stop error or a dispose error must not leak or mask the result,
+ * so the function swallows each error and logs a fixed line.
+ */
+async function stopAndDispose(driver, log) {
+    try {
+        driver.stop();
+    }
+    catch {
+        log("[paperclip] Setup-token login: the process stop step errored.");
+    }
+    try {
+        await driver.dispose();
+    }
+    catch {
+        log("[paperclip] Setup-token login: the driver dispose step errored.");
+    }
+}
+/**
+ * Runs the setup-token login through `driver`. Surfaces the prompt one time
+ * through `onPrompt`. Reads the browser code one time through `provideCode` and
+ * writes it to the matched prompt. Binds the minted token from the success
+ * record and delivers it one time through `onCredential`. Returns a fixed status.
+ * Stops the child and disposes the driver for every terminal state. Never logs
+ * the raw stream, and never puts a URL, a code, or a token into a log line, the
+ * result, or a thrown error.
+ */
+export async function runSetupTokenLogin(driver, options) {
+    const { onPrompt, provideCode, onCredential, timeoutMs, signal } = options;
+    const command = options.command ?? CLAUDE_SETUP_TOKEN_COMMAND;
+    const codeSubmitSettleMs = options.codeSubmitSettleMs ?? CODE_SUBMIT_SETTLE_MS;
+    const log = options.log ?? (() => { });
+    // A private controller that fans a timeout or a cancellation into the
+    // code-input routine, so a pending `provideCode` stops when the run ends.
+    const controller = new AbortController();
+    const onExternalAbort = () => controller.abort();
+    if (signal) {
+        if (signal.aborted)
+            controller.abort();
+        else
+            signal.addEventListener("abort", onExternalAbort, { once: true });
+    }
+    let promptSurfaced = false;
+    let codeSubmitted = false;
+    let submitStarted = false;
+    // The runner sets this true one time, only after the mandatory sink resolves.
+    let credentialDelivered = false;
+    // The bound token bytes. The runner binds them from the success record during
+    // the stream, holds them in memory only, awaits the sink one time after a
+    // clean exit, and zeros them in a `finally` block on every path. A null value
+    // means the runner never bound a token.
+    let tokenBytes = null;
+    // The code-input routine runs beside the race. It is self-guarding and never
+    // rejects, so an unresolved provider cannot become an unhandled rejection.
+    let submitPromise = Promise.resolve();
+    // The in-memory prompt buffer. The runner drops it as soon as it finds the
+    // prompt, so the secret-bearing stream never lives longer than one parse. The
+    // runner parses the full buffer, and it includes the whole new chunk. So a
+    // prompt at the start of one large chunk still parses. The runner bounds only
+    // the buffer that it keeps for the next chunk to
+    // {@link CLAUDE_SETUP_TOKEN_MAX_BUFFER_CHARS}. The runner keeps the trailing
+    // window and drops the oldest characters.
+    let buffer = "";
+    // The in-memory token buffer. The runner accumulates the post-prompt stream
+    // here, parses the full buffer before any truncation, and drops it as soon as
+    // it binds the token. It bounds the retained window the same way as the prompt
+    // buffer, so the secret-bearing stream never grows without a bound.
+    let tokenBuffer = "";
+    // Reads the browser code and writes it to the matched prompt one time. The
+    // routine never throws: it logs a fixed line on a provider error or a write
+    // error, so the code never reaches a log or a thrown error.
+    const submitCode = async () => {
+        let code;
+        try {
+            code = await provideCode(controller.signal);
+        }
+        catch {
+            log("[paperclip] Setup-token login: the code input step errored.");
+            return;
+        }
+        if (controller.signal.aborted)
+            return;
+        try {
+            // Write the code, let the Ink paste buffer settle, then write the Return as
+            // its own write. A glued `code + "\r"` burst folds the Return into the
+            // pasted text and never submits (live characterization). Two writes with a
+            // settle gap submit on the first Return.
+            driver.write(code);
+            await settleDelay(codeSubmitSettleMs, controller.signal);
+            if (controller.signal.aborted)
+                return;
+            driver.write(CODE_SUBMISSION_TERMINATOR);
+            codeSubmitted = true;
+            log("[paperclip] Setup-token login: sent the browser code to the prompt.");
+        }
+        catch {
+            log("[paperclip] Setup-token login: the code input step errored.");
+        }
+    };
+    // Binds the token from the token buffer one time and holds the bytes in
+    // memory. The runner scans only when a caller provides an `onCredential` sink,
+    // so it never holds the secret-bearing stream without a need. It drops the
+    // token buffer as soon as the parser binds the token. The runner delivers the
+    // bytes later, after a clean exit, through {@link deliverCredential}.
+    const captureCredential = () => {
+        if (!onCredential || tokenBytes)
+            return;
+        const token = parseSetupTokenCredential(tokenBuffer);
+        if (!token)
+            return;
+        tokenBytes = Buffer.from(token, "utf8");
+        tokenBuffer = "";
+    };
+    // Awaits the mandatory sink one time with the bound token bytes and reports
+    // whether the credential landed. It returns false when the sink is missing,
+    // when the runner bound no token, or when the sink rejects. It does not swallow
+    // a sink rejection: it maps the rejection to a false result, so the caller ends
+    // the run as a failure. It zeros the token bytes in a `finally` block on every
+    // path, so the secret never outlives the delivery.
+    const deliverCredential = async () => {
+        const bytes = tokenBytes;
+        tokenBytes = null;
+        if (!bytes)
+            return false;
+        try {
+            if (!onCredential)
+                return false;
+            await onCredential(bytes);
+            log("[paperclip] Setup-token login: delivered the credential to the sink.");
+            return true;
+        }
+        catch {
+            log("[paperclip] Setup-token login: the credential delivery step errored.");
+            return false;
+        }
+        finally {
+            bytes.fill(0);
+        }
+    };
+    const onData = (chunk) => {
+        if (!promptSurfaced) {
+            // Parse the full buffer before any truncation. This order finds an early
+            // prompt inside one large chunk, so the runner never drops it.
+            buffer += chunk;
+            const prompt = parseSetupTokenPrompt(buffer);
+            if (prompt) {
+                promptSurfaced = true;
+                buffer = "";
+                onPrompt(prompt);
+                log("[paperclip] Setup-token login: surfaced the sign-in prompt.");
+                if (!submitStarted) {
+                    submitStarted = true;
+                    submitPromise = submitCode();
+                }
+                return;
+            }
+            if (buffer.length > CLAUDE_SETUP_TOKEN_MAX_BUFFER_CHARS) {
+                buffer = buffer.slice(buffer.length - CLAUDE_SETUP_TOKEN_MAX_BUFFER_CHARS);
+            }
+            return;
+        }
+        // The prompt already surfaced. Scan the post-prompt stream for the success
+        // token. The runner scans only when a caller provides an `onCredential`
+        // sink, so it never holds the secret-bearing stream without a need.
+        if (!onCredential || tokenBytes)
+            return;
+        tokenBuffer += chunk;
+        captureCredential();
+        if (!tokenBytes && tokenBuffer.length > CLAUDE_SETUP_TOKEN_MAX_BUFFER_CHARS) {
+            tokenBuffer = tokenBuffer.slice(tokenBuffer.length - CLAUDE_SETUP_TOKEN_MAX_BUFFER_CHARS);
+        }
+    };
+    const result = (outcome, exitCode) => ({
+        outcome,
+        exitCode,
+        promptSurfaced,
+        codeSubmitted,
+        credentialDelivered,
+    });
+    try {
+        if (signal?.aborted) {
+            log("[paperclip] Setup-token login cancelled before start.");
+            return result("cancelled", null);
+        }
+        const start = driver.start(command, onData);
+        const raced = await raceLoginRunnerExit(start, timeoutMs, controller.signal);
+        // Release a pending code-input routine, then let it settle. The routine is
+        // self-guarding, so this await never rejects.
+        controller.abort();
+        await submitPromise;
+        if (raced.kind === "timeout") {
+            log("[paperclip] Setup-token login timed out; stopping the process.");
+            return result("timeout", null);
+        }
+        if (raced.kind === "cancelled") {
+            log("[paperclip] Setup-token login cancelled; stopping the process.");
+            return result("cancelled", null);
+        }
+        const exitCode = raced.exitCode;
+        if (exitCode !== 0) {
+            log("[paperclip] Setup-token login command ended with a non-zero exit code.");
+            return result("failure", exitCode);
+        }
+        // The command exited cleanly. Deliver the bound token through the mandatory
+        // sink and await it. The runner fails closed: a missing sink, a clean exit
+        // with no bound token, and a sink rejection each end the run as a failure. It
+        // reports success only after the sink resolves.
+        const delivered = await deliverCredential();
+        if (!delivered) {
+            log("[paperclip] Setup-token login: the credential did not land; treating the run as a failure.");
+            return result("failure", exitCode);
+        }
+        credentialDelivered = true;
+        log("[paperclip] Setup-token login command ended successfully.");
+        return result("success", exitCode);
+    }
+    catch {
+        // Convert any driver error to a fixed, non-secret error. The original error
+        // may embed streamed bytes, so the runner never propagates its message.
+        throw new Error("setup-token login failed: the sandbox login command errored.");
+    }
+    finally {
+        if (signal)
+            signal.removeEventListener("abort", onExternalAbort);
+        // Zero any bound token bytes that the delivery path did not consume, so a
+        // timeout, a cancellation, or an error never leaves the secret in memory. The
+        // cast restores the type that the closure assignment widens away.
+        const leftover = tokenBytes;
+        if (leftover) {
+            leftover.fill(0);
+            tokenBytes = null;
+        }
+        // Stop a pending code-input routine, then stop the child and dispose.
+        controller.abort();
+        await stopAndDispose(driver, log);
+    }
+}
+//# sourceMappingURL=setup-token-runner.js.map

package/dist/server/setup-token-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-token-runner.js","sourceRoot":"","sources":["../../src/server/setup-token-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAKpB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GAEtB,MAAM,wBAAwB,CAAC;AAEhC,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,uEAAuE;AACvE,iEAAiE;AACjE,EAAE;AACF,2EAA2E;AAC3E,kFAAkF;AAClF,iFAAiF;AACjF,kFAAkF;AAClF,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,8EAA8E;AAC9E,iFAAiF;AACjF,mEAAmE;AACnE,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,+EAA+E;AAC/E,6EAA6E;AAC7E,2EAA2E;AAC3E,gFAAgF;AAChF,gFAAgF;AAChF,yBAAyB;AAEzB,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAE/C;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAEzC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,GAAG,IAAI,CAAC;AAgF7D;;;;;GAKG;AACH,SAAS,WAAW,CAAC,EAAU,EAAE,MAAmB;IAClD,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAAC,MAA2B,EAAE,GAA2B;IACpF,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,+DAA+D,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,iEAAiE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAA2B,EAC3B,OAAkC;IAElC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,0BAA0B,CAAC;IAC9D,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,qBAAqB,CAAC;IAC/E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEtC,sEAAsE;IACtE,0EAA0E;IAC1E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACjD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,MAAM,CAAC,OAAO;YAAE,UAAU,CAAC,KAAK,EAAE,CAAC;;YAClC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,8EAA8E;IAC9E,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,8EAA8E;IAC9E,0EAA0E;IAC1E,8EAA8E;IAC9E,wCAAwC;IACxC,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,aAAa,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAErD,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,8EAA8E;IAC9E,iDAAiD;IACjD,6EAA6E;IAC7E,0CAA0C;IAC1C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,oEAAoE;IACpE,IAAI,WAAW,GAAG,EAAE,CAAC;IAErB,2EAA2E;IAC3E,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,UAAU,GAAG,KAAK,IAAmB,EAAE;QAC3C,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,6DAA6D,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACtC,IAAI,CAAC;YACH,4EAA4E;YAC5E,uEAAuE;YACvE,2EAA2E;YAC3E,yCAAyC;YACzC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACnB,MAAM,WAAW,CAAC,kBAAkB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YACzD,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO;YACtC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACzC,aAAa,GAAG,IAAI,CAAC;YACrB,GAAG,CAAC,qEAAqE,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,6DAA6D,CAAC,CAAC;QACrE,CAAC;IACH,CAAC,CAAC;IAEF,wEAAwE;IACxE,+EAA+E;IAC/E,2EAA2E;IAC3E,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,iBAAiB,GAAG,GAAS,EAAE;QACnC,IAAI,CAAC,YAAY,IAAI,UAAU;YAAE,OAAO;QACxC,MAAM,KAAK,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxC,WAAW,GAAG,EAAE,CAAC;IACnB,CAAC,CAAC;IAEF,4EAA4E;IAC5E,4EAA4E;IAC5E,gFAAgF;IAChF,gFAAgF;IAChF,+EAA+E;IAC/E,mDAAmD;IACnD,MAAM,iBAAiB,GAAG,KAAK,IAAsB,EAAE;QACrD,MAAM,KAAK,GAAG,UAAU,CAAC;QACzB,UAAU,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,CAAC,YAAY;gBAAE,OAAO,KAAK,CAAC;YAChC,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;YAC1B,GAAG,CAAC,sEAAsE,CAAC,CAAC;YAC5E,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,sEAAsE,CAAC,CAAC;YAC5E,OAAO,KAAK,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;QACrC,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,yEAAyE;YACzE,+DAA+D;YAC/D,MAAM,IAAI,KAAK,CAAC;YAChB,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,MAAM,EAAE,CAAC;gBACX,cAAc,GAAG,IAAI,CAAC;gBACtB,MAAM,GAAG,EAAE,CAAC;gBACZ,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACjB,GAAG,CAAC,6DAA6D,CAAC,CAAC;gBACnE,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,aAAa,GAAG,IAAI,CAAC;oBACrB,aAAa,GAAG,UAAU,EAAE,CAAC;gBAC/B,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,GAAG,mCAAmC,EAAE,CAAC;gBACxD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,mCAAmC,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO;QACT,CAAC;QACD,2EAA2E;QAC3E,wEAAwE;QACxE,oEAAoE;QACpE,IAAI,CAAC,YAAY,IAAI,UAAU;YAAE,OAAO;QACxC,WAAW,IAAI,KAAK,CAAC;QACrB,iBAAiB,EAAE,CAAC;QACpB,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC,MAAM,GAAG,mCAAmC,EAAE,CAAC;YAC5E,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,mCAAmC,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,OAA0B,EAAE,QAAuB,EAAyB,EAAE,CAAC,CAAC;QAC9F,OAAO;QACP,QAAQ;QACR,cAAc;QACd,aAAa;QACb,mBAAmB;KACpB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,uDAAuD,CAAC,CAAC;YAC7D,OAAO,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC7E,2EAA2E;QAC3E,8CAA8C;QAC9C,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,aAAa,CAAC;QAEpB,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,gEAAgE,CAAC,CAAC;YACtE,OAAO,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/B,GAAG,CAAC,gEAAgE,CAAC,CAAC;YACtE,OAAO,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,GAAG,CAAC,wEAAwE,CAAC,CAAC;YAC9E,OAAO,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;QAED,4EAA4E;QAC5E,2EAA2E;QAC3E,8EAA8E;QAC9E,gDAAgD;QAChD,MAAM,SAAS,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,4FAA4F,CAAC,CAAC;YAClG,OAAO,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;QACD,mBAAmB,GAAG,IAAI,CAAC;QAE3B,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;YAAS,CAAC;QACT,IAAI,MAAM;YAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACjE,0EAA0E;QAC1E,8EAA8E;QAC9E,kEAAkE;QAClE,MAAM,QAAQ,GAAG,UAA2B,CAAC;QAC7C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,sEAAsE;QACtE,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;AACH,CAAC"}

package/dist/server/setup-token-runner.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=setup-token-runner.test.d.ts.map

package/dist/server/setup-token-runner.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-token-runner.test.d.ts","sourceRoot":"","sources":["../../src/server/setup-token-runner.test.ts"],"names":[],"mappings":""}