@tickernelz/paperclip-pro-adapter-utils 2026.925.0

package/dist/local-process-sandbox.test.js

@@ -0,0 +1,399 @@
+import fs from "node:fs/promises";
+import http from "node:http";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { buildLocalProcessSandboxSpawnTarget, parseLocalProcessFilesystemScope, parseLocalProcessNetworkAllowlist, parseLocalProcessNetworkScope, parseLocalProcessSandboxExtraPaths, } from "./local-process-sandbox.js";
+import { runChildProcess } from "./server-utils.js";
+const cleanup = [];
+async function withTmpDir(tmpDir, run) {
+    const previousTmpDir = process.env.TMPDIR;
+    process.env.TMPDIR = tmpDir;
+    try {
+        return await run();
+    }
+    finally {
+        if (previousTmpDir === undefined)
+            delete process.env.TMPDIR;
+        else
+            process.env.TMPDIR = previousTmpDir;
+    }
+}
+afterEach(async () => {
+    await Promise.all(cleanup.splice(0).map((candidate) => fs.rm(candidate, { recursive: true, force: true })));
+});
+describe("local process sandbox", () => {
+    it.runIf(process.platform !== "linux")("rejects sandbox scopes on unsupported hosts", async () => {
+        await expect(buildLocalProcessSandboxSpawnTarget({
+            executable: process.execPath, args: ["-e", "process.exit(0)"], cwd: process.cwd(),
+            options: { workspaceDir: process.cwd(), networkScope: "deny" },
+        })).rejects.toThrow("supported only on Linux");
+    });
+    it("parses read-only and writable extra paths", () => {
+        expect(parseLocalProcessSandboxExtraPaths(["/opt/cache", { path: "/var/lib/tool", access: "rw" }])).toEqual([
+            { path: "/opt/cache", access: "ro" },
+            { path: "/var/lib/tool", access: "rw" },
+        ]);
+        expect(() => parseLocalProcessSandboxExtraPaths(["relative"])).toThrow("must be an absolute path");
+    });
+    it("parses network scopes and exact-host allowlists", () => {
+        expect(parseLocalProcessFilesystemScope("workspace")).toBe("workspace");
+        expect(parseLocalProcessFilesystemScope(undefined)).toBeNull();
+        expect(() => parseLocalProcessFilesystemScope("workpace")).toThrow('filesystemScope must be "workspace"');
+        expect(parseLocalProcessNetworkScope("deny")).toBe("deny");
+        expect(parseLocalProcessNetworkScope("allowlist")).toBe("allowlist");
+        expect(parseLocalProcessNetworkScope(undefined)).toBeNull();
+        expect(parseLocalProcessNetworkAllowlist(["api.openai.com", "https://api.anthropic.com", "gateway.test:8443"]))
+            .toEqual(["api.openai.com", "api.anthropic.com", "gateway.test:8443"]);
+        expect(() => parseLocalProcessNetworkAllowlist(["*.example.com"])).toThrow("exact hostname");
+        expect(() => parseLocalProcessNetworkScope("public")).toThrow('"deny" or "allowlist"');
+    });
+    it.runIf(process.platform === "linux")("describes every valid allowlist input when no proxy rules remain", async () => {
+        const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-network-rules-"));
+        cleanup.push(workspace);
+        await expect(buildLocalProcessSandboxSpawnTarget({
+            executable: process.execPath,
+            args: ["-e", "process.exit(0)"],
+            cwd: workspace,
+            options: {
+                workspaceDir: workspace,
+                networkScope: "allowlist",
+                networkAllowlist: [],
+                networkTrustedUrls: ["file:///not-a-network-target"],
+            },
+        })).rejects.toThrow("valid networkAllowlist hostname or HTTP(S) networkTrustedUrl");
+    });
+    it.runIf(process.platform === "linux")("builds a fresh-root bubblewrap command with workspace access", async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-fs-sandbox-"));
+        cleanup.push(root);
+        const workspace = path.join(root, "workspace");
+        const managedHome = path.join(root, "managed-home");
+        await fs.mkdir(workspace);
+        await fs.mkdir(managedHome);
+        const target = await buildLocalProcessSandboxSpawnTarget({
+            executable: process.execPath,
+            args: ["-e", "console.log('ok')"],
+            cwd: workspace,
+            options: {
+                workspaceDir: workspace,
+                filesystemScope: "workspace",
+                managedPaths: [{ path: managedHome, access: "rw" }],
+                homeDir: managedHome,
+            },
+        });
+        expect(target.command).toBe("bwrap");
+        expect(target.args).toContain("--tmpfs");
+        expect(target.args).toContain(workspace);
+        expect(target.args).toContain(managedHome);
+        expect(target.args.slice(-3)).toEqual([process.execPath, "-e", "console.log('ok')"]);
+    });
+    it.runIf(process.platform === "linux")("binds a confined absolute alias to the synchronized workspace", async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-fs-alias-"));
+        cleanup.push(root);
+        const workspace = path.join(root, "workspace");
+        await fs.mkdir(workspace);
+        const target = await buildLocalProcessSandboxSpawnTarget({
+            executable: process.execPath,
+            args: ["-e", "process.exit(0)"],
+            cwd: workspace,
+            options: {
+                workspaceDir: workspace,
+                filesystemScope: "workspace",
+                pathAliases: [{ path: "/app", target: workspace }],
+            },
+        });
+        expect(target.args).toEqual(expect.arrayContaining(["--bind", workspace, "/app"]));
+    });
+    it.runIf(process.platform === "linux")("rejects writable out-of-tree paths without an outbound restore mapping", async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-fs-outbound-"));
+        cleanup.push(root);
+        const workspace = path.join(root, "workspace");
+        const outside = path.join(root, "outside");
+        await fs.mkdir(workspace);
+        await fs.mkdir(outside);
+        await expect(buildLocalProcessSandboxSpawnTarget({
+            executable: process.execPath,
+            args: ["-e", "process.exit(0)"],
+            cwd: workspace,
+            options: {
+                workspaceDir: workspace,
+                filesystemScope: "workspace",
+                extraPaths: [{ path: outside, access: "rw" }],
+            },
+        })).rejects.toThrow("has no outbound restore mapping");
+    });
+    it.runIf(process.platform === "linux")("builds a network-only namespace without changing filesystem visibility", async () => {
+        const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-network-sandbox-"));
+        cleanup.push(workspace);
+        const target = await buildLocalProcessSandboxSpawnTarget({
+            executable: process.execPath,
+            args: ["-e", "console.log('ok')"],
+            cwd: workspace,
+            options: { workspaceDir: workspace, networkScope: "deny" },
+        });
+        expect(target.args).toContain("--unshare-net");
+        expect(target.args).toContain("--bind");
+        expect(target.args).not.toContain("--tmpfs");
+        expect(target.env?.HTTP_PROXY).toBeUndefined();
+    });
+    it.runIf(process.platform === "linux")("forwards allowed proxy targets with a deep TMPDIR and rejects other hosts", async () => {
+        const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-network-proxy-"));
+        cleanup.push(workspace);
+        const deepTmpDir = path.join(workspace, ...Array.from({ length: 6 }, () => "deep-temporary-directory-segment"));
+        await fs.mkdir(deepTmpDir, { recursive: true });
+        const server = http.createServer((_request, response) => response.end("allowed-response"));
+        await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+        const address = server.address();
+        if (!address || typeof address === "string")
+            throw new Error("Expected TCP test server address.");
+        const target = await withTmpDir(deepTmpDir, () => buildLocalProcessSandboxSpawnTarget({
+            executable: process.execPath,
+            args: ["-e", "process.exit(0)"],
+            cwd: workspace,
+            options: {
+                workspaceDir: workspace,
+                filesystemScope: "workspace",
+                networkScope: "allowlist",
+                networkAllowlist: [`127.0.0.1:${address.port}`],
+            },
+        }));
+        const delimiterIndex = target.args.indexOf("--");
+        const socketPath = target.args[delimiterIndex + 3];
+        expect(Buffer.byteLength(path.join(deepTmpDir, "paperclip-network-sandbox-XXXXXX", "proxy.sock"))).toBeGreaterThan(107);
+        expect(Buffer.byteLength(socketPath)).toBeLessThanOrEqual(107);
+        expect(socketPath).toMatch(/^\/tmp\/paperclip-network-sandbox-/);
+        expect(target.args).toContain(path.dirname(socketPath));
+        const request = (url) => new Promise((resolve, reject) => {
+            const outgoing = http.request({ socketPath, path: url, headers: { host: new URL(url).host } }, (response) => {
+                let body = "";
+                response.on("data", (chunk) => {
+                    body += chunk;
+                });
+                response.on("end", () => resolve({
+                    status: response.statusCode ?? 0,
+                    contentType: typeof response.headers["content-type"] === "string" ? response.headers["content-type"] : null,
+                    body,
+                }));
+            });
+            outgoing.on("error", reject);
+            outgoing.end();
+        });
+        try {
+            await expect(request(`http://127.0.0.1:${address.port}/canary`)).resolves.toEqual({
+                status: 200,
+                contentType: null,
+                body: "allowed-response",
+            });
+            await expect(request("http://example.com/")).resolves.toEqual({
+                status: 403,
+                contentType: "application/json; charset=utf-8",
+                body: '{"error":{"code":"network_target_denied","message":"Network target denied by Paperclip sandbox policy."}}\n',
+            });
+            const connectResponse = await new Promise((resolve, reject) => {
+                const socket = net.createConnection(socketPath, () => {
+                    socket.end("CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\n\r\n");
+                });
+                let response = "";
+                socket.setEncoding("utf8");
+                socket.on("data", (chunk) => { response += chunk; });
+                socket.on("end", () => resolve(response));
+                socket.on("error", reject);
+            });
+            expect(connectResponse).toContain("HTTP/1.1 403 Forbidden\r\n");
+            expect(connectResponse).toContain("Content-Type: application/json; charset=utf-8\r\n");
+            expect(connectResponse).toContain('{"error":{"code":"network_target_denied","message":"Network target denied by Paperclip sandbox policy."}}\n');
+        }
+        finally {
+            await target.cleanup?.();
+            await new Promise((resolve) => server.close(() => resolve()));
+        }
+    });
+    it.runIf(process.platform === "linux")("always permits trusted Paperclip control-plane URLs", async () => {
+        const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-network-trusted-"));
+        cleanup.push(workspace);
+        const server = http.createServer((_request, response) => response.end("control-plane-response"));
+        await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+        const address = server.address();
+        if (!address || typeof address === "string")
+            throw new Error("Expected TCP test server address.");
+        const target = await buildLocalProcessSandboxSpawnTarget({
+            executable: process.execPath,
+            args: ["-e", "process.exit(0)"],
+            cwd: workspace,
+            options: {
+                workspaceDir: workspace,
+                networkScope: "allowlist",
+                networkAllowlist: ["api.openai.com"],
+                networkTrustedUrls: [`http://127.0.0.1:${address.port}/api/issues/issue-1`],
+            },
+        });
+        const delimiterIndex = target.args.indexOf("--");
+        const socketPath = target.args[delimiterIndex + 3];
+        try {
+            const response = await new Promise((resolve, reject) => {
+                const outgoing = http.request({
+                    socketPath,
+                    path: `http://127.0.0.1:${address.port}/api/issues/issue-1`,
+                    headers: { host: `127.0.0.1:${address.port}` },
+                }, (incoming) => {
+                    let body = "";
+                    incoming.on("data", (chunk) => { body += chunk; });
+                    incoming.on("end", () => resolve({ status: incoming.statusCode ?? 0, body }));
+                });
+                outgoing.on("error", reject);
+                outgoing.end();
+            });
+            expect(response).toEqual({ status: 200, body: "control-plane-response" });
+        }
+        finally {
+            await target.cleanup?.();
+            await new Promise((resolve) => server.close(() => resolve()));
+        }
+    });
+    it("fails clearly when Bubblewrap is unavailable", async () => {
+        const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-fs-sandbox-missing-"));
+        cleanup.push(workspace);
+        await expect(runChildProcess("filesystem-sandbox-missing", process.execPath, ["-e", "process.exit(0)"], {
+            cwd: workspace,
+            env: {},
+            timeoutSec: 10,
+            graceSec: 1,
+            onLog: async () => { },
+            localProcessSandbox: {
+                workspaceDir: workspace,
+                filesystemScope: "workspace",
+                command: path.join(workspace, "missing-bwrap"),
+            },
+        })).rejects.toThrow("requires Bubblewrap");
+    });
+    it.runIf(Boolean(process.env.PAPERCLIP_TEST_BWRAP))("prevents reads outside the workspace while allowing workspace writes", async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-fs-sandbox-integration-"));
+        cleanup.push(root);
+        const workspace = path.join(root, "workspace");
+        const outside = path.join(root, "canary.txt");
+        const allowed = path.join(root, "allowed.txt");
+        await fs.mkdir(workspace);
+        await fs.writeFile(outside, "host-secret", "utf8");
+        await fs.writeFile(allowed, "allowed-value", "utf8");
+        const script = [
+            "const fs = require('node:fs');",
+            `try { fs.readFileSync(${JSON.stringify(outside)}, 'utf8'); process.exit(9); } catch (error) {`,
+            "  if (!['ENOENT', 'EACCES'].includes(error.code)) throw error;",
+            "}",
+            `if (fs.readFileSync(${JSON.stringify(allowed)}, 'utf8') !== 'allowed-value') process.exit(8);`,
+            "fs.writeFileSync('workspace-ok.txt', 'ok');",
+        ].join("\n");
+        const result = await runChildProcess("filesystem-sandbox-test", process.execPath, ["-e", script], {
+            cwd: workspace,
+            env: {},
+            timeoutSec: 10,
+            graceSec: 1,
+            onLog: async () => { },
+            localProcessSandbox: {
+                workspaceDir: workspace,
+                filesystemScope: "workspace",
+                extraPaths: [{ path: allowed, access: "ro" }],
+                command: process.env.PAPERCLIP_TEST_BWRAP,
+            },
+        });
+        expect(result.exitCode, result.stderr).toBe(0);
+        await expect(fs.readFile(path.join(workspace, "workspace-ok.txt"), "utf8")).resolves.toBe("ok");
+    });
+    it.runIf(Boolean(process.env.PAPERCLIP_TEST_BWRAP && process.env.PAPERCLIP_TEST_SANDBOX_BUILD))("runs the adapter-utils TypeScript build inside the confined workspace", async () => {
+        const workspace = process.cwd();
+        const result = await runChildProcess("filesystem-sandbox-build-test", path.join(workspace, "node_modules", ".bin", "tsc"), ["--noEmit", "-p", "packages/adapter-utils/tsconfig.json"], {
+            cwd: workspace,
+            env: {},
+            timeoutSec: 60,
+            graceSec: 2,
+            onLog: async () => { },
+            localProcessSandbox: {
+                workspaceDir: workspace,
+                filesystemScope: "workspace",
+                command: process.env.PAPERCLIP_TEST_BWRAP,
+            },
+        });
+        expect(result.exitCode, result.stderr).toBe(0);
+    });
+    it.runIf(Boolean(process.env.PAPERCLIP_TEST_BWRAP))("denies direct network egress", async () => {
+        const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-network-deny-"));
+        cleanup.push(workspace);
+        const server = http.createServer((_request, response) => response.end("host-network"));
+        await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+        const address = server.address();
+        if (!address || typeof address === "string")
+            throw new Error("Expected TCP test server address.");
+        const script = `require("node:http").get("http://127.0.0.1:${address.port}", () => process.exit(9)).on("error", () => process.exit(0));`;
+        try {
+            const result = await runChildProcess("network-sandbox-deny-test", process.execPath, ["-e", script], {
+                cwd: workspace,
+                env: {},
+                timeoutSec: 10,
+                graceSec: 1,
+                onLog: async () => { },
+                localProcessSandbox: {
+                    workspaceDir: workspace,
+                    networkScope: "deny",
+                    command: process.env.PAPERCLIP_TEST_BWRAP,
+                },
+            });
+            expect(result.exitCode, result.stderr).toBe(0);
+        }
+        finally {
+            await new Promise((resolve) => server.close(() => resolve()));
+        }
+    });
+    it.runIf(Boolean(process.env.PAPERCLIP_TEST_BWRAP))("allows only configured network targets through the proxy bridge", async () => {
+        const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-network-allowlist-"));
+        cleanup.push(workspace);
+        const server = http.createServer((_request, response) => response.end("allowed-response"));
+        await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+        const address = server.address();
+        if (!address || typeof address === "string")
+            throw new Error("Expected TCP test server address.");
+        const targetUrl = `http://127.0.0.1:${address.port}/canary`;
+        const deniedUrl = "http://example.com/";
+        const script = `
+const http = require("node:http");
+const proxy = new URL(process.env.HTTP_PROXY);
+function request(url) {
+  return new Promise((resolve, reject) => {
+    http.get({ hostname: proxy.hostname, port: proxy.port, path: url }, (response) => {
+      let body = "";
+      response.on("data", (chunk) => body += chunk);
+      response.on("end", () => resolve({ status: response.statusCode, body }));
+    }).on("error", reject);
+  });
+}
+(async () => {
+  const allowed = await request(${JSON.stringify(targetUrl)});
+  const denied = await request(${JSON.stringify(deniedUrl)});
+  if (allowed.status !== 200 || allowed.body !== "allowed-response" || denied.status !== 403) process.exit(8);
+})().catch((error) => { console.error(error); process.exit(7); });
+`;
+        try {
+            const deepTmpDir = path.join(workspace, ...Array.from({ length: 6 }, () => "deep-temporary-directory-segment"));
+            await fs.mkdir(deepTmpDir, { recursive: true });
+            const result = await withTmpDir(deepTmpDir, () => runChildProcess("network-sandbox-allowlist-test", process.execPath, ["-e", script], {
+                cwd: workspace,
+                env: {},
+                timeoutSec: 10,
+                graceSec: 1,
+                onLog: async () => { },
+                localProcessSandbox: {
+                    workspaceDir: workspace,
+                    filesystemScope: "workspace",
+                    networkScope: "allowlist",
+                    networkAllowlist: [`127.0.0.1:${address.port}`],
+                    command: process.env.PAPERCLIP_TEST_BWRAP,
+                },
+            }));
+            expect(result.exitCode, result.stderr).toBe(0);
+        }
+        finally {
+            await new Promise((resolve) => server.close(() => resolve()));
+        }
+    });
+});
+//# sourceMappingURL=local-process-sandbox.test.js.map

package/dist/local-process-sandbox.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-process-sandbox.test.js","sourceRoot":"","sources":["../src/local-process-sandbox.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EACL,mCAAmC,EACnC,gCAAgC,EAChC,iCAAiC,EACjC,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,OAAO,GAAa,EAAE,CAAC;AAE7B,KAAK,UAAU,UAAU,CAAI,MAAc,EAAE,GAAqB;IAChE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;;YACvD,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,cAAc,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9G,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,MAAM,CAAC,mCAAmC,CAAC;YAC/C,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;YACjF,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;SAC/D,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,kCAAkC,CAAC,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1G,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE;YACpC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE;SACxC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,CAAC,kCAAkC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,gCAAgC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxE,MAAM,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC/D,MAAM,CAAC,GAAG,EAAE,CAAC,gCAAgC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;QAC1G,MAAM,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,CAAC,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrE,MAAM,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5D,MAAM,CAAC,iCAAiC,CAAC,CAAC,gBAAgB,EAAE,2BAA2B,EAAE,mBAAmB,CAAC,CAAC,CAAC;aAC5G,OAAO,CAAC,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACzE,MAAM,CAAC,GAAG,EAAE,CAAC,iCAAiC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC7F,MAAM,CAAC,GAAG,EAAE,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QACpH,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAExB,MAAM,MAAM,CAAC,mCAAmC,CAAC;YAC/C,UAAU,EAAE,OAAO,CAAC,QAAQ;YAC5B,IAAI,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC;YAC/B,GAAG,EAAE,SAAS;YACd,OAAO,EAAE;gBACP,YAAY,EAAE,SAAS;gBACvB,YAAY,EAAE,WAAW;gBACzB,gBAAgB,EAAE,EAAE;gBACpB,kBAAkB,EAAE,CAAC,8BAA8B,CAAC;aACrD;SACF,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,8DAA8D,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAChH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACpD,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1B,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAE5B,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC;YACvD,UAAU,EAAE,OAAO,CAAC,QAAQ;YAC5B,IAAI,EAAE,CAAC,IAAI,EAAE,mBAAmB,CAAC;YACjC,GAAG,EAAE,SAAS;YACd,OAAO,EAAE;gBACP,YAAY,EAAE,SAAS;gBACvB,eAAe,EAAE,WAAW;gBAC5B,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACnD,OAAO,EAAE,WAAW;aACrB;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QACjH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAE1B,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC;YACvD,UAAU,EAAE,OAAO,CAAC,QAAQ;YAC5B,IAAI,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC;YAC/B,GAAG,EAAE,SAAS;YACd,OAAO,EAAE;gBACP,YAAY,EAAE,SAAS;gBACvB,eAAe,EAAE,WAAW;gBAC5B,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;aACnD;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QAC1H,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;QAChF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1B,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAExB,MAAM,MAAM,CAAC,mCAAmC,CAAC;YAC/C,UAAU,EAAE,OAAO,CAAC,QAAQ;YAC5B,IAAI,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC;YAC/B,GAAG,EAAE,SAAS;YACd,OAAO,EAAE;gBACP,YAAY,EAAE,SAAS;gBACvB,eAAe,EAAE,WAAW;gBAC5B,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;aAC9C;SACF,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QAC1H,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAC;QACzF,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC;YACvD,UAAU,EAAE,OAAO,CAAC,QAAQ;YAC5B,IAAI,EAAE,CAAC,IAAI,EAAE,mBAAmB,CAAC;YACjC,GAAG,EAAE,SAAS;YACd,OAAO,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE;SAC3D,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QAC7H,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,kCAAkC,CAAC,CAAC,CAAC;QAChH,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC3F,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/C,mCAAmC,CAAC;YAClC,UAAU,EAAE,OAAO,CAAC,QAAQ;YAC5B,IAAI,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC;YAC/B,GAAG,EAAE,SAAS;YACd,OAAO,EAAE;gBACP,YAAY,EAAE,SAAS;gBACvB,eAAe,EAAE,WAAW;gBAC5B,YAAY,EAAE,WAAW;gBACzB,gBAAgB,EAAE,CAAC,aAAa,OAAO,CAAC,IAAI,EAAE,CAAC;aAChD;SACF,CAAC,CACH,CAAC;QACF,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kCAAkC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACxH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,OAAO,CAA+D,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7H,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC1G,IAAI,IAAI,GAAG,EAAE,CAAC;gBACd,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;oBAC5B,IAAI,IAAI,KAAK,CAAC;gBAChB,CAAC,CAAC,CAAC;gBACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC;oBAC/B,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC;oBAChC,WAAW,EAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI;oBAC3G,IAAI;iBACL,CAAC,CAAC,CAAC;YACN,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,OAAO,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAChF,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,IAAI;gBACjB,IAAI,EAAE,kBAAkB;aACzB,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC5D,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,iCAAiC;gBAC9C,IAAI,EAAE,6GAA6G;aACpH,CAAC,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACpE,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE;oBACnD,MAAM,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;gBAClF,CAAC,CAAC,CAAC;gBACH,IAAI,QAAQ,GAAG,EAAE,CAAC;gBAClB,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC1C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;YAChE,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,mDAAmD,CAAC,CAAC;YACvF,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,6GAA6G,CAC9G,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAC;QACzF,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC;QACjG,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClG,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC;YACvD,UAAU,EAAE,OAAO,CAAC,QAAQ;YAC5B,IAAI,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC;YAC/B,GAAG,EAAE,SAAS;YACd,OAAO,EAAE;gBACP,YAAY,EAAE,SAAS;gBACvB,YAAY,EAAE,WAAW;gBACzB,gBAAgB,EAAE,CAAC,gBAAgB,CAAC;gBACpC,kBAAkB,EAAE,CAAC,oBAAoB,OAAO,CAAC,IAAI,qBAAqB,CAAC;aAC5E;SACF,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;QAEnD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAmC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;oBAC5B,UAAU;oBACV,IAAI,EAAE,oBAAoB,OAAO,CAAC,IAAI,qBAAqB;oBAC3D,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,OAAO,CAAC,IAAI,EAAE,EAAE;iBAC/C,EAAE,CAAC,QAAQ,EAAE,EAAE;oBACd,IAAI,IAAI,GAAG,EAAE,CAAC;oBACd,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnD,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAChF,CAAC,CAAC,CAAC;gBACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC7B,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAC5E,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC,CAAC;QAC5F,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,MAAM,MAAM,CACV,eAAe,CAAC,4BAA4B,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE;YACzF,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,EAAE;YACP,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,CAAC;YACX,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;YACrB,mBAAmB,EAAE;gBACnB,YAAY,EAAE,SAAS;gBACvB,eAAe,EAAE,WAAW;gBAC5B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;aAC/C;SACF,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CACjD,sEAAsE,EACtE,KAAK,IAAI,EAAE;QACT,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mCAAmC,CAAC,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1B,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG;YACb,gCAAgC;YAChC,yBAAyB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,+CAA+C;YAC/F,gEAAgE;YAChE,GAAG;YACH,uBAAuB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,iDAAiD;YAC/F,6CAA6C;SAC9C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,yBAAyB,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE;YAChG,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,EAAE;YACP,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,CAAC;YACX,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;YACrB,mBAAmB,EAAE;gBACnB,YAAY,EAAE,SAAS;gBACvB,eAAe,EAAE,WAAW;gBAC5B,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBAC7C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;aAC1C;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClG,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAC7F,uEAAuE,EACvE,KAAK,IAAI,EAAE;QACT,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,+BAA+B,EAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,EACnD,CAAC,UAAU,EAAE,IAAI,EAAE,sCAAsC,CAAC,EAC1D;YACE,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,EAAE;YACP,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,CAAC;YACX,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;YACrB,mBAAmB,EAAE;gBACnB,YAAY,EAAE,SAAS;gBACvB,eAAe,EAAE,WAAW;gBAC5B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;aAC1C;SACF,CACF,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CACjD,8BAA8B,EAC9B,KAAK,IAAI,EAAE;QACT,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QACvF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClG,MAAM,MAAM,GAAG,8CAA8C,OAAO,CAAC,IAAI,+DAA+D,CAAC;QACzI,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,2BAA2B,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE;gBAClG,GAAG,EAAE,SAAS;gBACd,GAAG,EAAE,EAAE;gBACP,UAAU,EAAE,EAAE;gBACd,QAAQ,EAAE,CAAC;gBACX,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;gBACrB,mBAAmB,EAAE;oBACnB,YAAY,EAAE,SAAS;oBACvB,YAAY,EAAE,MAAM;oBACpB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;iBAC1C;aACF,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CACjD,iEAAiE,EACjE,KAAK,IAAI,EAAE;QACT,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC3F,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClG,MAAM,SAAS,GAAG,oBAAoB,OAAO,CAAC,IAAI,SAAS,CAAC;QAC5D,MAAM,SAAS,GAAG,qBAAqB,CAAC;QACxC,MAAM,MAAM,GAAG;;;;;;;;;;;;;kCAaa,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;iCAC1B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;;;CAGzD,CAAC;QACI,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,kCAAkC,CAAC,CAAC,CAAC;YAChH,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/C,eAAe,CACb,gCAAgC,EAChC,OAAO,CAAC,QAAQ,EAChB,CAAC,IAAI,EAAE,MAAM,CAAC,EACd;gBACE,GAAG,EAAE,SAAS;gBACd,GAAG,EAAE,EAAE;gBACP,UAAU,EAAE,EAAE;gBACd,QAAQ,EAAE,CAAC;gBACX,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;gBACrB,mBAAmB,EAAE;oBACnB,YAAY,EAAE,SAAS;oBACvB,eAAe,EAAE,WAAW;oBAC5B,YAAY,EAAE,WAAW;oBACzB,gBAAgB,EAAE,CAAC,aAAa,OAAO,CAAC,IAAI,EAAE,CAAC;oBAC/C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;iBAC1C;aACF,CACF,CACF,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/log-redaction.d.ts

@@ -0,0 +1,9 @@
+import type { TranscriptEntry } from "./types.js";
+export declare const REDACTED_HOME_PATH_USER = "*";
+export interface HomePathRedactionOptions {
+    enabled?: boolean;
+}
+export declare function redactHomePathUserSegments(text: string, opts?: HomePathRedactionOptions): string;
+export declare function redactHomePathUserSegmentsInValue<T>(value: T, opts?: HomePathRedactionOptions): T;
+export declare function redactTranscriptEntryPaths(entry: TranscriptEntry, opts?: HomePathRedactionOptions): TranscriptEntry;
+//# sourceMappingURL=log-redaction.d.ts.map

package/dist/log-redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-redaction.d.ts","sourceRoot":"","sources":["../src/log-redaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AA6BD,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,wBAAwB,GAAG,MAAM,CAOhG;AAED,wBAAgB,iCAAiC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,wBAAwB,GAAG,CAAC,CAgBjG;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,wBAAwB,GAAG,eAAe,CAkCnH"}

package/dist/log-redaction.js

@@ -0,0 +1,88 @@
+export const REDACTED_HOME_PATH_USER = "*";
+function maskHomePathUserSegment(value) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        return REDACTED_HOME_PATH_USER;
+    return `${trimmed[0]}${"*".repeat(Math.max(1, Array.from(trimmed).length - 1))}`;
+}
+const HOME_PATH_PATTERNS = [
+    {
+        regex: /\/Users\/([^/\\\s]+)/g,
+        replace: (_match, user) => `/Users/${maskHomePathUserSegment(user)}`,
+    },
+    {
+        regex: /\/home\/([^/\\\s]+)/g,
+        replace: (_match, user) => `/home/${maskHomePathUserSegment(user)}`,
+    },
+    {
+        regex: /([A-Za-z]:\\Users\\)([^\\/\s]+)/g,
+        replace: (_match, prefix, user) => `${prefix}${maskHomePathUserSegment(user)}`,
+    },
+];
+function isPlainObject(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+export function redactHomePathUserSegments(text, opts) {
+    if (opts?.enabled === false)
+        return text;
+    let result = text;
+    for (const pattern of HOME_PATH_PATTERNS) {
+        result = result.replace(pattern.regex, pattern.replace);
+    }
+    return result;
+}
+export function redactHomePathUserSegmentsInValue(value, opts) {
+    if (typeof value === "string") {
+        return redactHomePathUserSegments(value, opts);
+    }
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactHomePathUserSegmentsInValue(entry, opts));
+    }
+    if (!isPlainObject(value)) {
+        return value;
+    }
+    const redacted = {};
+    for (const [key, entry] of Object.entries(value)) {
+        redacted[key] = redactHomePathUserSegmentsInValue(entry, opts);
+    }
+    return redacted;
+}
+export function redactTranscriptEntryPaths(entry, opts) {
+    switch (entry.kind) {
+        case "assistant":
+        case "thinking":
+        case "user":
+        case "stderr":
+        case "system":
+        case "stdout":
+        case "diff":
+            return { ...entry, text: redactHomePathUserSegments(entry.text, opts) };
+        case "tool_call":
+            return {
+                ...entry,
+                name: redactHomePathUserSegments(entry.name, opts),
+                input: redactHomePathUserSegmentsInValue(entry.input, opts),
+            };
+        case "tool_result":
+            return { ...entry, content: redactHomePathUserSegments(entry.content, opts) };
+        case "init":
+            return {
+                ...entry,
+                model: redactHomePathUserSegments(entry.model, opts),
+                sessionId: redactHomePathUserSegments(entry.sessionId, opts),
+            };
+        case "result":
+            return {
+                ...entry,
+                text: redactHomePathUserSegments(entry.text, opts),
+                subtype: redactHomePathUserSegments(entry.subtype, opts),
+                errors: entry.errors.map((error) => redactHomePathUserSegments(error, opts)),
+            };
+        default:
+            return entry;
+    }
+}
+//# sourceMappingURL=log-redaction.js.map

package/dist/log-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-redaction.js","sourceRoot":"","sources":["../src/log-redaction.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAM3C,SAAS,uBAAuB,CAAC,KAAa;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,uBAAuB,CAAC;IAC7C,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,kBAAkB,GAAG;IACzB;QACE,KAAK,EAAE,uBAAuB;QAC9B,OAAO,EAAE,CAAC,MAAc,EAAE,IAAY,EAAE,EAAE,CAAC,UAAU,uBAAuB,CAAC,IAAI,CAAC,EAAE;KACrF;IACD;QACE,KAAK,EAAE,sBAAsB;QAC7B,OAAO,EAAE,CAAC,MAAc,EAAE,IAAY,EAAE,EAAE,CAAC,SAAS,uBAAuB,CAAC,IAAI,CAAC,EAAE;KACpF;IACD;QACE,KAAK,EAAE,kCAAkC;QACzC,OAAO,EAAE,CAAC,MAAc,EAAE,MAAc,EAAE,IAAY,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,EAAE;KACvG;CACO,CAAC;AAEX,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAAY,EAAE,IAA+B;IACtF,IAAI,IAAI,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAI,KAAQ,EAAE,IAA+B;IAC5F,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,0BAA0B,CAAC,KAAK,EAAE,IAAI,CAAM,CAAC;IACtD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iCAAiC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAM,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,QAAQ,CAAC,GAAG,CAAC,GAAG,iCAAiC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,QAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAsB,EAAE,IAA+B;IAChG,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,WAAW,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM;YACT,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,0BAA0B,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC1E,KAAK,WAAW;YACd,OAAO;gBACL,GAAG,KAAK;gBACR,IAAI,EAAE,0BAA0B,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC;gBAClD,KAAK,EAAE,iCAAiC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC;aAC5D,CAAC;QACJ,KAAK,aAAa;YAChB,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;QAChF,KAAK,MAAM;YACT,OAAO;gBACL,GAAG,KAAK;gBACR,KAAK,EAAE,0BAA0B,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC;gBACpD,SAAS,EAAE,0BAA0B,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC;aAC7D,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO;gBACL,GAAG,KAAK;gBACR,IAAI,EAAE,0BAA0B,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC;gBAClD,OAAO,EAAE,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC;gBACxD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;aAC7E,CAAC;QACJ;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/login-capability.d.ts

@@ -0,0 +1,88 @@
+/**
+ * The login panel mode. `displayed_code` shows a one-time code that the user
+ * enters in the browser. `submitted_browser_code` asks the user to paste a code
+ * from the browser back into the login flow.
+ */
+export declare const ADAPTER_LOGIN_PANEL_MODES: readonly ["displayed_code", "submitted_browser_code"];
+export type AdapterLoginPanelMode = (typeof ADAPTER_LOGIN_PANEL_MODES)[number];
+/**
+ * The host-side timeout policy. `caller_bounded` lets the caller set the
+ * timeout. `fixed` binds the timeout to a fixed adapter value.
+ */
+export declare const ADAPTER_LOGIN_TIMEOUT_POLICIES: readonly ["caller_bounded", "fixed"];
+export type AdapterLoginTimeoutPolicy = (typeof ADAPTER_LOGIN_TIMEOUT_POLICIES)[number];
+/**
+ * The optional completion claim that the login flow records on success.
+ * `storedSessionId` marks that the flow stored a session identifier.
+ */
+export declare const ADAPTER_LOGIN_COMPLETION_CLAIMS: readonly ["storedSessionId"];
+export type AdapterLoginCompletionClaim = (typeof ADAPTER_LOGIN_COMPLETION_CLAIMS)[number];
+/**
+ * The normalized login prompt. `url` is the validated authorization URL. `code`
+ * is the one-time code to show, present only in `displayed_code` mode. A prompt
+ * carries no credential secret.
+ */
+export interface AdapterLoginPrompt {
+    url: string;
+    code?: string;
+}
+/**
+ * The completion context. The server passes it to the completion hook. It
+ * carries the non-secret completion state. It carries no credential byte.
+ */
+export interface AdapterLoginCompletionContext {
+    /** The session identifier that the flow stored, when it stored one. */
+    storedSessionId?: string;
+}
+/**
+ * The optional adapter login capability. It declares how the server drives an
+ * interactive sandbox login for the adapter. The capability data holds no
+ * secret. An adapter with no interactive login (for example an API-key-only
+ * vendor) declares no capability.
+ */
+export interface AdapterLoginCapability {
+    /** The login panel mode. */
+    panelMode: AdapterLoginPanelMode;
+    /** The host-side timeout policy. */
+    timeoutPolicy: AdapterLoginTimeoutPolicy;
+    /** Returns the fixed, non-secret login command. */
+    getCommand: () => string;
+    /**
+     * Parses the authorization prompt from the login output. Returns null when the
+     * output holds no prompt yet. The parser keeps every input byte out of its
+     * result and out of every thrown error.
+     */
+    parsePrompt: (output: string) => AdapterLoginPrompt | null;
+    /**
+     * Captures the minted credential from the login output. Returns the raw
+     * credential bytes, or null when the output holds no credential yet. Only a
+     * flow that prints the credential to the terminal sets it. The result is a
+     * runtime secret; the capability data never stores it.
+     */
+    captureCredential?: (output: string) => Buffer | null;
+    /**
+     * Runs after a successful login. It records the non-secret completion state.
+     * It carries no credential byte.
+     */
+    onComplete?: (ctx: AdapterLoginCompletionContext) => Promise<void>;
+    /** The optional completion claim that the flow records on success. */
+    completionClaim?: AdapterLoginCompletionClaim;
+}
+/**
+ * Validates one login capability. The function fails closed: it throws a clear
+ * error for a malformed shape. It checks each scalar field against its fixed
+ * value set, checks each required function member, and checks each optional
+ * member only when the member is present. `adapterType` names the adapter in the
+ * error text.
+ */
+export declare function assertValidAdapterLoginCapability(value: unknown, adapterType: string): asserts value is AdapterLoginCapability;
+/**
+ * Validates the optional login capability of an adapter module. The function is
+ * a no-op when the module declares no login capability. It throws a clear error
+ * when the module declares a malformed capability, so the loader fails closed.
+ */
+export declare function validateAdapterLoginCapability(mod: {
+    type?: unknown;
+    loginCapability?: unknown;
+}): void;
+//# sourceMappingURL=login-capability.d.ts.map

package/dist/login-capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-capability.d.ts","sourceRoot":"","sources":["../src/login-capability.ts"],"names":[],"mappings":"AAYA;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,YAAI,gBAAgB,EAAE,wBAAwB,CAAU,CAAC;AAC/F,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,8BAA8B,YAAI,gBAAgB,EAAE,OAAO,CAAU,CAAC;AACnF,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC;AAExF;;;GAGG;AACH,eAAO,MAAM,+BAA+B,YAAI,iBAAiB,CAAU,CAAC;AAC5E,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3F;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,6BAA6B;IAC5C,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,4BAA4B;IAC5B,SAAS,EAAE,qBAAqB,CAAC;IACjC,oCAAoC;IACpC,aAAa,EAAE,yBAAyB,CAAC;IACzC,mDAAmD;IACnD,UAAU,EAAE,MAAM,MAAM,CAAC;IACzB;;;;OAIG;IACH,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,kBAAkB,GAAG,IAAI,CAAC;IAC3D;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACtD;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,6BAA6B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,sEAAsE;IACtE,eAAe,CAAC,EAAE,2BAA2B,CAAC;CAC/C;AAMD;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,OAAO,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,KAAK,IAAI,sBAAsB,CAqCzC;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE;IAClD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,IAAI,CAIP"}