@tokenfactory/acc-runner 0.41.7 → 0.42.0

package/dist/keychain.js

@@ -38,6 +38,42 @@ export async function clearSession() {
     const k = await getKeytar();
     return k.deletePassword(RUNNER_KEYCHAIN_SERVICE, ACCOUNT);
 }
+/**
+ * AX-G1: a SECOND entry in the same keychain service, under a different account.
+ *
+ * The runner session lives at (service "acc-runner", account "default") and its
+ * JSON shape is a frozen contract. A person's CLI session is a different
+ * credential with a different shape and a different lifecycle — it is the
+ * human's own Supabase session, not a runner impersonation token — so it gets
+ * its own account slot rather than being squeezed into the frozen one. A machine
+ * that is both a runner and a signed-in workstation holds both, independently,
+ * and `acc-runner logout` still only clears the runner's.
+ *
+ * Same rule as the runner slot: the keychain is the ONLY writable surface for a
+ * credential. Nothing here ever touches the filesystem.
+ */
+export async function saveSlot(account, value) {
+    const k = await getKeytar();
+    await k.setPassword(RUNNER_KEYCHAIN_SERVICE, account, JSON.stringify(value));
+}
+export async function loadSlot(account) {
+    const k = await getKeytar();
+    const raw = await k.getPassword(RUNNER_KEYCHAIN_SERVICE, account);
+    if (!raw)
+        return null;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        // Corrupted entry — treat as "not present" rather than crashing, matching
+        // loadSession above.
+        return null;
+    }
+}
+export async function clearSlot(account) {
+    const k = await getKeytar();
+    return k.deletePassword(RUNNER_KEYCHAIN_SERVICE, account);
+}
 /** Test-only seam used by the keychain test (overrides the lazy import). */
 export function __setKeytar(impl) {
     cached = impl;

package/dist/keychain.js.map

@@ -1 +1 @@
-{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,uBAAuB,EAAsB,MAAM,YAAY,CAAC;AAEzE,MAAM,OAAO,GAAG,SAAkB,CAAC;AAQnC,IAAI,MAAM,GAAsB,IAAI,CAAC;AAErC,KAAK,UAAU,SAAS;IACtB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,qEAAqE;IACrE,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAqD,CAAC;IACzF,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAe,CAAC;IAC5C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB;IACtD,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,OAAO,CAAC,CAAC,cAAc,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC"}
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,uBAAuB,EAAsB,MAAM,YAAY,CAAC;AAEzE,MAAM,OAAO,GAAG,SAAkB,CAAC;AAQnC,IAAI,MAAM,GAAsB,IAAI,CAAC;AAErC,KAAK,UAAU,SAAS;IACtB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,qEAAqE;IACrE,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAqD,CAAC;IACzF,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAe,CAAC;IAC5C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB;IACtD,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,OAAO,CAAC,CAAC,cAAc,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe,EAAE,KAAc;IAC5D,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAI,OAAe;IAC/C,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,qBAAqB;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAe;IAC7C,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,OAAO,CAAC,CAAC,cAAc,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC"}

package/dist/login.d.ts

@@ -42,11 +42,55 @@ export declare function runnerCapsWithRepos(repos: readonly string[] | undefined
 };
 export declare function machineIdentity(): string;
 export declare function detectInstalledModels(): Promise<string[]>;
-export interface LoginOptions {
+/**
+ * RUNNER-NO-OPEN — the browser-open gate.
+ *
+ * `open(verification_url)` used to run unconditionally, which meant an agent or
+ * a test that merely EXERCISED the login flow launched the browser on whatever
+ * machine the process happened to be running on. That is exactly what happened:
+ * fixture logins against `https://acc.test` with the placeholder code
+ * `ABCD-1234` opened dead tabs on an operator's Mac, over and over, while
+ * agents worked the CLI login surfaces. A side-effect that reaches out of the
+ * process and onto the host has to be opt-out-able, and the default has to be
+ * "only when a human is plausibly watching".
+ *
+ * "A human is plausibly watching" is approximated by: stdout is a TTY, no
+ * explicit suppression, and no test/CI marker in the environment. Everything
+ * else falls back to the printed URL + code, which is the primary instruction
+ * anyway — the browser-open has always been a convenience layered on top of it.
+ */
+export declare const NO_OPEN_ENV = "ACC_RUNNER_NO_OPEN";
+export interface BrowserOpenContext {
+    /** Environment to read the suppression markers from. Defaults to `process.env`. */
+    env?: NodeJS.ProcessEnv;
+    /** Whether stdout is a terminal. Defaults to `process.stdout.isTTY`. */
+    isTty?: boolean;
+}
+/**
+ * The reason the browser-open is suppressed, or `null` when it may proceed.
+ * Returning the reason rather than a bare boolean keeps the gate debuggable —
+ * "why did/didn't it open?" is answerable without re-deriving the conditions.
+ */
+export declare function browserOpenBlockedBy(ctx?: BrowserOpenContext): string | null;
+export declare function shouldOpenBrowser(ctx?: BrowserOpenContext): boolean;
+export interface MaybeOpenBrowserOptions extends BrowserOpenContext {
+    /** Injectable `open` (tests). Defaults to the real `open` package. */
+    openBrowser?: (url: string) => Promise<unknown>;
+}
+/**
+ * Open `url` in the host's browser IF the gate allows it. Resolves `true` when
+ * the browser was actually launched, `false` when it was suppressed or the
+ * launch failed (headless box, no default handler) — either way the caller has
+ * already printed the URL, so a `false` is never an error.
+ */
+export declare function maybeOpenBrowser(url: string, options?: MaybeOpenBrowserOptions): Promise<boolean>;
+export interface LoginOptions extends BrowserOpenContext {
     /** Override the polling interval seconds (mostly for tests). */
     intervalSeconds?: number;
     /** Override the timeout (seconds) to abort polling. */
     timeoutSeconds?: number;
+    /** Injectable `open` (tests). Defaults to the real `open` package. */
+    openBrowser?: (url: string) => Promise<unknown>;
 }
 export declare function loginCommand(options?: LoginOptions): Promise<void>;
 //# sourceMappingURL=login.d.ts.map

package/dist/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAaA,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AAIrB,OAAO,KAAK,EAGV,UAAU,EACX,MAAM,YAAY,CAAC;AAOpB,eAAO,MAAM,WAAW,EAAE,UAczB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACpC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACvC,IAAI,GAAE,iBAA8C,EAKpD,MAAM,GAAE,iBAAgE,GACvE,UAAU,GAAG;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,kBAAkB,EAAE,iBAAiB,CAAC;CACvC,CASA;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAGD,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAe/D;AAiBD,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAsB,YAAY,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwG5E"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAaA,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AAIrB,OAAO,KAAK,EAGV,UAAU,EACX,MAAM,YAAY,CAAC;AAOpB,eAAO,MAAM,WAAW,EAAE,UAczB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACpC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACvC,IAAI,GAAE,iBAA8C,EAKpD,MAAM,GAAE,iBAAgE,GACvE,UAAU,GAAG;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,kBAAkB,EAAE,iBAAiB,CAAC;CACvC,CASA;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAGD,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAe/D;AAoBD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,WAAW,uBAAuB,CAAC;AAEhD,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,wEAAwE;IACxE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AASD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,kBAAuB,GAAG,MAAM,GAAG,IAAI,CAWhF;AAED,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,kBAAuB,GAAG,OAAO,CAEvE;AAED,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB;IACjE,sEAAsE;IACtE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACjD;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,OAAO,CAAC,CASlB;AAED,MAAM,WAAW,YAAa,SAAQ,kBAAkB;IACtD,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACjD;AAED,wBAAsB,YAAY,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0H5E"}

package/dist/login.js

@@ -118,6 +118,76 @@ async function postJson(url, body) {
     }
     return (await res.json());
 }
+/** Consecutive transient exchange failures tolerated before we give up. */
+const MAX_POLL_FAILURES = 5;
+/**
+ * RUNNER-NO-OPEN — the browser-open gate.
+ *
+ * `open(verification_url)` used to run unconditionally, which meant an agent or
+ * a test that merely EXERCISED the login flow launched the browser on whatever
+ * machine the process happened to be running on. That is exactly what happened:
+ * fixture logins against `https://acc.test` with the placeholder code
+ * `ABCD-1234` opened dead tabs on an operator's Mac, over and over, while
+ * agents worked the CLI login surfaces. A side-effect that reaches out of the
+ * process and onto the host has to be opt-out-able, and the default has to be
+ * "only when a human is plausibly watching".
+ *
+ * "A human is plausibly watching" is approximated by: stdout is a TTY, no
+ * explicit suppression, and no test/CI marker in the environment. Everything
+ * else falls back to the printed URL + code, which is the primary instruction
+ * anyway — the browser-open has always been a convenience layered on top of it.
+ */
+export const NO_OPEN_ENV = "ACC_RUNNER_NO_OPEN";
+/** `1` / `true` / any other non-empty value except `0` / `false` counts as set. */
+function envFlag(value) {
+    if (value === undefined)
+        return false;
+    const v = value.trim().toLowerCase();
+    return v !== "" && v !== "0" && v !== "false";
+}
+/**
+ * The reason the browser-open is suppressed, or `null` when it may proceed.
+ * Returning the reason rather than a bare boolean keeps the gate debuggable —
+ * "why did/didn't it open?" is answerable without re-deriving the conditions.
+ */
+export function browserOpenBlockedBy(ctx = {}) {
+    const env = ctx.env ?? process.env;
+    if (envFlag(env[NO_OPEN_ENV]))
+        return NO_OPEN_ENV;
+    // Vitest sets both; VITEST_WORKER_ID is present even when a suite has
+    // deliberately overwritten NODE_ENV, so check it independently.
+    if (envFlag(env.VITEST) || env.VITEST_WORKER_ID !== undefined)
+        return "VITEST";
+    if ((env.NODE_ENV ?? "").trim().toLowerCase() === "test")
+        return "NODE_ENV=test";
+    if (envFlag(env.CI))
+        return "CI";
+    const isTty = ctx.isTty ?? Boolean(process.stdout.isTTY);
+    if (!isTty)
+        return "non-TTY stdout";
+    return null;
+}
+export function shouldOpenBrowser(ctx = {}) {
+    return browserOpenBlockedBy(ctx) === null;
+}
+/**
+ * Open `url` in the host's browser IF the gate allows it. Resolves `true` when
+ * the browser was actually launched, `false` when it was suppressed or the
+ * launch failed (headless box, no default handler) — either way the caller has
+ * already printed the URL, so a `false` is never an error.
+ */
+export async function maybeOpenBrowser(url, options = {}) {
+    if (!shouldOpenBrowser(options))
+        return false;
+    try {
+        await (options.openBrowser ?? open)(url);
+        return true;
+    }
+    catch {
+        /* no browser available; the user falls back to the printed URL */
+        return false;
+    }
+}
 export async function loginCommand(options = {}) {
     const cfg = loadConfig();
     // 1. Request a device code.
@@ -129,18 +199,35 @@ export async function loginCommand(options = {}) {
     console.log(`  ${chalk.cyan("2.")} Enter code:  ${chalk.bold.green(start.user_code)}`);
     console.log("");
     console.log(chalk.gray("Waiting for confirmation…"));
-    open(start.verification_url).catch(() => {
-        /* no browser available; user falls back to the printed URL */
-    });
+    // Fire-and-forget, as before: the poll below must start immediately and must
+    // never be blocked by a browser that is slow to spawn (or by the gate itself).
+    void maybeOpenBrowser(start.verification_url, options);
     const machine = machineIdentity();
     const hostname = os.hostname();
     // 2. Poll the exchange endpoint.
     const interval = (options.intervalSeconds ?? start.interval) * 1000;
     const deadline = Date.now() + (options.timeoutSeconds ?? start.expires_in) * 1000;
     let exchanged = null;
+    // A transient exchange failure (pooler hiccup, cold function, 5xx) must not
+    // abort a login whose code is still valid — poll through it and only give up
+    // when the failures are persistent or the real TTL runs out.
+    let consecutiveFailures = 0;
+    let lastFailure = null;
     while (Date.now() < deadline) {
         await sleep(interval);
-        const exchange = await postJson(`${cfg.publicUrl.replace(/\/+$/, "")}/api/runner/device-code/exchange`, { device_code: start.device_code, machine, hostname });
+        let exchange;
+        try {
+            exchange = await postJson(`${cfg.publicUrl.replace(/\/+$/, "")}/api/runner/device-code/exchange`, { device_code: start.device_code, machine, hostname });
+        }
+        catch (err) {
+            consecutiveFailures += 1;
+            lastFailure = err.message;
+            if (consecutiveFailures >= MAX_POLL_FAILURES) {
+                throw new Error(`Device-code exchange failed ${consecutiveFailures} times in a row: ${lastFailure}`);
+            }
+            continue;
+        }
+        consecutiveFailures = 0;
         if (exchange.status === "expired") {
             throw new Error("Device code expired before sign-in completed. Run `acc-runner login` again.");
         }

package/dist/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,UAAU,EACV,wBAAwB,GAGzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAMnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,wEAAwE;AACxE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,WAAW,GAAe;IACrC,MAAM,EAAE,IAAI;IACZ,IAAI,EAAE,IAAI;IACV,EAAE,EAAE,IAAI;IACR,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;IACf,YAAY,EAAE,IAAI;IAClB,+EAA+E;IAC/E,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,CAAC,cAAc,CAAC,EAAE,IAAI;CACvB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAoC,EACpC,OAAuC,EACvC,OAA0B,wBAAwB,EAAE;AACpD,0EAA0E;AAC1E,4EAA4E;AAC5E,6EAA6E;AAC7E,uCAAuC;AACvC,SAA4B,sBAAsB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;IAQxE,OAAO;QACL,GAAG,WAAW;QACd,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;QAC9B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;QACpC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,qBAAqB,EAAE,IAAI,CAAC,mBAAmB;QAC/C,kBAAkB,EAAE,MAAM;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAU,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACtD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,GAAW,EAAE,IAAa;IACnD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,cAAc,gBAAgB,EAAE;SAC/C;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,YAAY,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAwB,EAAE;IAC3D,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IAEzB,4BAA4B;IAC5B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAC1B,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,gCAAgC,EACpE,EAAE,CACH,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAErD,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACtC,8DAA8D;IAChE,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAE/B,iCAAiC;IACjC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IAClF,IAAI,SAAS,GAAsC,IAAI,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC7B,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,kCAAkC,EACtE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,CACtD,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC7B,SAAS,GAAG,QAAQ,CAAC;YACrB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAEnF,qEAAqE;IACrE,sEAAsE;IACtE,iCAAiC;IACjC,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,iDAAiD;IACjD,MAAM,WAAW,CAAC;QAChB,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,iBAAiB,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QACtE,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,eAAe,EAAE,SAAS,CAAC,eAAe;KAC3C,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC;IAEvE,mEAAmE;IACnE,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,wEAAwE;IACxE,gFAAgF;IAChF,MAAM,eAAe,GAAG,oBAAoB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,kBAAkB,CACjC,eAAe,EACf,SAAS,CAAC,YAAY,EACtB,SAAS,CAAC,eAAe,CAC1B,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC7C,oEAAoE;IACpE,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,OAAO,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC7C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE;QACtD,IAAI,EAAE,SAAS,CAAC,SAAS;QACzB,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,OAAO,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;QACpE,OAAO,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,OAAO;QAC7C,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,MAAM;QAChB,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,+DAA+D;QAC/D,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC;QAC/C,SAAS,EAAE,eAAe;KAC3B,CAAC,CAAC;IACH,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;AACjF,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,UAAU,EACV,wBAAwB,GAGzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAMnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,wEAAwE;AACxE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,WAAW,GAAe;IACrC,MAAM,EAAE,IAAI;IACZ,IAAI,EAAE,IAAI;IACV,EAAE,EAAE,IAAI;IACR,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;IACf,YAAY,EAAE,IAAI;IAClB,+EAA+E;IAC/E,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,CAAC,cAAc,CAAC,EAAE,IAAI;CACvB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAoC,EACpC,OAAuC,EACvC,OAA0B,wBAAwB,EAAE;AACpD,0EAA0E;AAC1E,4EAA4E;AAC5E,6EAA6E;AAC7E,uCAAuC;AACvC,SAA4B,sBAAsB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;IAQxE,OAAO;QACL,GAAG,WAAW;QACd,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;QAC9B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;QACpC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,qBAAqB,EAAE,IAAI,CAAC,mBAAmB;QAC/C,kBAAkB,EAAE,MAAM;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAU,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACtD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,GAAW,EAAE,IAAa;IACnD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,cAAc,gBAAgB,EAAE;SAC/C;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,YAAY,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AAED,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAShD,mFAAmF;AACnF,SAAS,OAAO,CAAC,KAAyB;IACxC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA0B,EAAE;IAC/D,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACnC,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC;IAClD,sEAAsE;IACtE,gEAAgE;IAChE,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,gBAAgB,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC/E,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM;QAAE,OAAO,eAAe,CAAC;IACjF,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,gBAAgB,CAAC;IACpC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAA0B,EAAE;IAC5D,OAAO,oBAAoB,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AAC5C,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,UAAmC,EAAE;IAErC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAwB,EAAE;IAC3D,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IAEzB,4BAA4B;IAC5B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAC1B,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,gCAAgC,EACpE,EAAE,CACH,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAErD,6EAA6E;IAC7E,+EAA+E;IAC/E,KAAK,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAEvD,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAE/B,iCAAiC;IACjC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IAClF,IAAI,SAAS,GAAsC,IAAI,CAAC;IACxD,4EAA4E;IAC5E,6EAA6E;IAC7E,6DAA6D;IAC7D,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,IAAI,QAAoC,CAAC;QACzC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,QAAQ,CACvB,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,kCAAkC,EACtE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,CACtD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,IAAI,CAAC,CAAC;YACzB,WAAW,GAAI,GAAa,CAAC,OAAO,CAAC;YACrC,IAAI,mBAAmB,IAAI,iBAAiB,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CACb,+BAA+B,mBAAmB,oBAAoB,WAAW,EAAE,CACpF,CAAC;YACJ,CAAC;YACD,SAAS;QACX,CAAC;QACD,mBAAmB,GAAG,CAAC,CAAC;QACxB,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC7B,SAAS,GAAG,QAAQ,CAAC;YACrB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAEnF,qEAAqE;IACrE,sEAAsE;IACtE,iCAAiC;IACjC,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,iDAAiD;IACjD,MAAM,WAAW,CAAC;QAChB,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,iBAAiB,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QACtE,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,eAAe,EAAE,SAAS,CAAC,eAAe;KAC3C,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC;IAEvE,mEAAmE;IACnE,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,wEAAwE;IACxE,gFAAgF;IAChF,MAAM,eAAe,GAAG,oBAAoB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,kBAAkB,CACjC,eAAe,EACf,SAAS,CAAC,YAAY,EACtB,SAAS,CAAC,eAAe,CAC1B,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC7C,oEAAoE;IACpE,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,OAAO,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC7C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE;QACtD,IAAI,EAAE,SAAS,CAAC,SAAS;QACzB,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,OAAO,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;QACpE,OAAO,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,OAAO;QAC7C,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,MAAM;QAChB,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,+DAA+D;QAC/D,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC;QAC/C,SAAS,EAAE,eAAe;KAC3B,CAAC,CAAC;IACH,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;AACjF,CAAC"}

package/dist/program.d.ts

@@ -0,0 +1,16 @@
+import { Command } from "commander";
+import type { CliName } from "./cli-name.js";
+export interface BuildProgramOptions {
+    /** Which bin the operator typed. Drives the `login` mapping and the help text. */
+    invokedAs?: CliName;
+}
+export declare function buildProgram(options?: BuildProgramOptions): Command;
+/**
+ * True when `moduleUrl` is the process entry point — NOT when it is imported by
+ * a test. realpath resolves the npm bin symlink to the built file so the compare
+ * holds for a globally-installed CLI.
+ */
+export declare function isMainModule(moduleUrl: string): boolean;
+/** Parse argv and turn a thrown error into a red line + exit 1. */
+export declare function runProgram(program: Command): void;
+//# sourceMappingURL=program.d.ts.map

package/dist/program.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../src/program.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA4BpC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AA8B7C,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CA6SvE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAQvD;AAED,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAKjD"}

package/dist/program.js

@@ -0,0 +1,342 @@
+/**
+ * The ONE command tree, built for whichever binary name invoked it.
+ *
+ * The package ships two bins — `acc` (unified) and `acc-runner` (the original
+ * name, kept as a deprecated alias) — over this single tree. Almost every
+ * command is registered identically for both; the exception is `login` /
+ * `logout`, and the reason is compatibility rather than taste.
+ *
+ * WHY `login` IS NAME-DEPENDENT
+ * ----------------------------------------------------------------------------
+ * There are two lanes, and the published meaning of the old name is already
+ * spoken for:
+ *
+ *   * the MACHINE lane — enrol this host into the fleet, mint an ACC-signed JWT
+ *     that impersonates its owner, create a runner row. That is what
+ *     `acc-runner login` has always meant, and it is baked into docker
+ *     entrypoints, launchd plists and the enrollment guidance the UI prints.
+ *   * the PERSON lane — sign the human at the keyboard in as themselves, via the
+ *     generalized device flow, with no runner row. That is what a command called
+ *     `acc login` must mean; a unified CLI whose `login` enrolled a server would
+ *     be actively misleading.
+ *
+ * Silently redefining `acc-runner login` to the person lane would be a breaking
+ * change wearing an alias costume — every existing enrollment script would stop
+ * producing a runner and start producing a session. So the mapping is:
+ *
+ *   acc login            → person       acc runner login       → machine
+ *   acc-runner login     → machine      acc-runner auth login  → person
+ *
+ * Both spellings of each lane exist under both names, so nothing an operator or
+ * a script types today changes meaning, and `acc runner login` is the forward
+ * name for what the alias called `login`.
+ */
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { Command } from "commander";
+import chalk from "chalk";
+import { loadConfig } from "./config.js";
+import { fetchPricing } from "./cost-pricing.js";
+import { loginCommand } from "./login.js";
+import { logoutCommand } from "./logout.js";
+import { watchCommand } from "./watch.js";
+import { companionCommand, companionInstallCommand, companionStatusCommand, companionUninstallCommand, } from "./companion-run.js";
+import { authLoginCommand, authLogoutCommand, authStatusCommand, } from "./user-auth/device-login.js";
+import { ensureUserSessionLive } from "./user-auth/liveness.js";
+import { chatCommand } from "./user-cli/chat.js";
+import { taskListCommand, taskShowCommand } from "./user-cli/tasks.js";
+import { doctorCommand } from "./doctor.js";
+import { clarifyCommand } from "./clarification.js";
+import { clearQuarantine, getQuarantine } from "./runtime/quarantine.js";
+import { clearChatCircuit, getChatCircuit } from "./runtime/chat-circuit-breaker.js";
+import { runCommitGuardHook } from "./commit-guard.js";
+import { PROTOCOL_VERSION } from "./types.js";
+import { PACKAGE_VERSION } from "./pkg-version.js";
+/** Every action shares this shape: report the message, set a failing exit code. */
+function guard(fn) {
+    return async () => {
+        try {
+            await fn();
+        }
+        catch (err) {
+            console.error(chalk.red(`✗ ${err.message}`));
+            process.exitCode = 1;
+        }
+    };
+}
+/**
+ * A person-lane command that ACTS on the operator's credential, rather than one
+ * that manages it. These check first that the credential still exists server-side,
+ * because a revoke on Settings → Sessions cannot reach into this machine's
+ * keychain: without the check, a revoked terminal keeps reading the board until
+ * its access token expires (see user-auth/liveness.ts). Login / logout / whoami
+ * are deliberately NOT wrapped — logging in has nothing to check yet, and logging
+ * out of a session that is already gone must still clear the keychain.
+ */
+function personGuard(fn) {
+    return guard(async () => {
+        await ensureUserSessionLive();
+        await fn();
+    });
+}
+export function buildProgram(options = {}) {
+    const invokedAs = options.invokedAs ?? "acc-runner";
+    const unified = invokedAs === "acc";
+    const program = new Command();
+    program
+        .name(invokedAs)
+        .description(unified
+        ? "Agent Control Center. Sign in, read the board, ask ACC, and run agents on this machine."
+        : "Agent Control Center local runner. Subscribes to ACC, spawns Claude Code on assignment, and opens a PR when done.")
+        .version(`${PACKAGE_VERSION} (protocol v${PROTOCOL_VERSION})`);
+    // ── The person lane ───────────────────────────────────────────────────────
+    // Registered under `auth <verb>` for BOTH names (so `acc-runner auth login`
+    // is untouched), and additionally promoted to the top level under `acc`,
+    // where `login` is free to mean what a person expects it to mean.
+    const registerPersonLane = (parent, verbs) => {
+        parent
+            .command("login")
+            .description("Sign in via device-code and store a user session in the OS keychain.")
+            .action(guard(() => authLoginCommand()));
+        parent
+            .command(verbs.status)
+            .description("Show who this terminal is signed in as.")
+            .action(guard(() => authStatusCommand()));
+        parent
+            .command("logout")
+            .description("Revoke this terminal's user session and clear the keychain entry.")
+            .action(guard(() => authLogoutCommand()));
+    };
+    const authCmd = program
+        .command("auth")
+        .description("Sign in to ACC as yourself (no runner registration).");
+    registerPersonLane(authCmd, { status: "status" });
+    // ── The machine lane ──────────────────────────────────────────────────────
+    const registerMachineLane = (parent) => {
+        parent
+            .command("login")
+            .description("Sign in via device-code OAuth and register this machine.")
+            .action(guard(() => loginCommand()));
+        parent
+            .command("logout")
+            .description("Clear the local session and mark this runner offline.")
+            .action(guard(() => logoutCommand()));
+    };
+    registerMachineLane(program
+        .command("runner")
+        .description("Enrol or retire THIS machine as a runner in the fleet."));
+    if (unified) {
+        registerPersonLane(program, { status: "whoami" });
+    }
+    else {
+        registerMachineLane(program);
+    }
+    // ── Reading the board ─────────────────────────────────────────────────────
+    const taskCmd = program
+        .command("task")
+        .description("Read the task board as yourself (read-only).");
+    taskCmd
+        .command("list")
+        .description("List tasks visible to you, newest first.")
+        .option("--status <status>", "Only tasks in this status (e.g. in_progress).")
+        .option("--repo <slug>", "Only tasks for this repo (owner/name).")
+        .option("--limit <n>", "How many rows (1-100, default 25).")
+        .option("--json", "Emit raw JSON instead of a table.")
+        .action((opts) => personGuard(() => taskListCommand(opts))());
+    taskCmd
+        .command("show")
+        .description("Show one task in full.")
+        .argument("<id>", "Task id, e.g. T-1234.")
+        .option("--json", "Emit raw JSON instead of fields.")
+        .action((id, opts) => personGuard(() => taskShowCommand(id, opts))());
+    program
+        .command("chat")
+        .description("Ask ACC. Pass a question, pipe one in, or run bare for a session.")
+        .argument("[message...]", "The question. Omit for an interactive session.")
+        .option("--conversation <id>", "Continue an existing conversation.")
+        .option("--json", "Emit the turn as JSON instead of streaming it.")
+        .action((words, opts) => personGuard(() => chatCommand(words ?? [], opts))());
+    // ── Running agents on this machine ────────────────────────────────────────
+    program
+        .command("watch")
+        .description("Long-running. Receive task assignments and execute them.")
+        .action(guard(async () => {
+        // Warm the cost-pricing cache before the realtime loop opens.
+        // fetchPricing handles its own logging; embedded fallback governs
+        // if the endpoint is unreachable.
+        await fetchPricing(loadConfig().publicUrl);
+        await watchCommand();
+        // Keep the process alive — stop() runs in the SIGINT handler.
+        await new Promise(() => { });
+    }));
+    // COMPANION: companion mode — an owner-affinity chat runner. Serves ONLY the
+    // logged-in owner's interactive chat turns (no code tasks), mirrors the turn
+    // stream to the same-machine browser over a loopback socket, and on exit
+    // requeues in-flight turns so an Auto turn fails over to the fleet.
+    const companionCmd = program
+        .command("companion")
+        .description("Long-running. Serve the owner's interactive chat turns (companion mode).")
+        .action(guard(async () => {
+        const handle = await companionCommand();
+        const shutdown = () => {
+            void handle.stop().finally(() => process.exit(0));
+        };
+        process.on("SIGINT", shutdown);
+        process.on("SIGTERM", shutdown);
+        // Keep the process alive; the loop runs on timers until a signal.
+        await new Promise(() => { });
+    }));
+    companionCmd
+        .command("status")
+        .description("Print the one-line companion status (menu-bar friendly).")
+        .action(guard(() => companionStatusCommand()));
+    companionCmd
+        .command("install")
+        .description("Install the companion login agent (autostart at login).")
+        .action(guard(() => companionInstallCommand()));
+    companionCmd
+        .command("uninstall")
+        .description("Remove the companion login agent.")
+        .action(guard(() => companionUninstallCommand()));
+    program
+        .command("doctor")
+        .description("Run environment checks. Exit 0 if all green, 1 otherwise.")
+        .option("--strict", "Treat advisory warnings (missing ANTHROPIC_API_KEY, version drift, etc.) as failures.")
+        .action(async (opts) => {
+        const code = await doctorCommand({ strict: opts.strict === true });
+        process.exitCode = code;
+    });
+    // NEEDS-INFO-HALT: a spawned agent that needs clarification / approval /
+    // missing information raises a needs_clarification halt for its task and hands
+    // the question off to JOJO, instead of guessing or dead-lettering. The operator
+    // answers by resolving the halt, which resumes the SAME task blocked -> queued.
+    program
+        .command("clarify")
+        .description("Raise a needs_clarification halt for a task and hand the question off to JOJO.")
+        .requiredOption("--task <id>", "Task id the agent is blocked on (e.g. T-1234).")
+        .requiredOption("--question <text>", "The question / missing info the operator must answer.")
+        .option("--context <json>", "Optional JSON object merged into the halt payload.")
+        .action((opts) => guard(() => clarifyCommand(opts))());
+    // Quarantine management. The runner enters quarantine automatically when the
+    // failure classifier detects a machine-level failure. An operator resolves the
+    // underlying issue then clears the quarantine to resume work.
+    const quarantineCmd = program
+        .command("quarantine")
+        .description("Inspect or clear the runner quarantine state.");
+    quarantineCmd
+        .command("status")
+        .description("Show quarantine state.")
+        .action(guard(async () => {
+        const q = await getQuarantine();
+        if (!q) {
+            console.log("Runner is not quarantined.");
+            return;
+        }
+        console.log(chalk.red.bold(`QUARANTINED (${q.cause})`));
+        console.log(`  Detail:  ${q.detail}`);
+        console.log(`  Task:    ${q.taskId}`);
+        console.log(`  Since:   ${q.classifiedAt}`);
+        // Consecutive instant-empty count (1 = definitive, 2 = heuristic
+        // confirmed by retry). Omitted for states written before it existed.
+        if (q.consecutive !== undefined) {
+            console.log(`  Streak:  ${q.consecutive} consecutive instant-empty exit(s)`);
+        }
+        console.log(chalk.gray(`\nResolve the underlying ${q.cause} issue, then run \`${invokedAs} quarantine clear\`.`));
+        process.exitCode = 1;
+    }));
+    quarantineCmd
+        .command("clear")
+        .description("Clear quarantine and allow the runner to resume claiming tasks.")
+        .action(guard(async () => {
+        await clearQuarantine();
+        console.log(chalk.green("✓ Quarantine cleared. Runner will resume on next task assignment."));
+    }));
+    // TURN-LANE: chat-circuit management. The runner opens the chat circuit
+    // automatically when a `claude_exit_1`-class fault surfaces while serving a
+    // chat turn — benching ONLY the chat lane (code/review keep running). An
+    // operator resolves the credential/host issue then clears it to resume chat.
+    const chatCircuitCmd = program
+        .command("chat-circuit")
+        .description("Inspect or clear the chat-capability circuit breaker (chat lane only).");
+    chatCircuitCmd
+        .command("status")
+        .description("Show chat circuit state.")
+        .action(guard(async () => {
+        const c = await getChatCircuit();
+        if (!c) {
+            console.log("Chat circuit is closed (chat lane serving).");
+            return;
+        }
+        console.log(chalk.red.bold(`CHAT CIRCUIT OPEN (${c.cause})`));
+        console.log(`  Detail:        ${c.detail}`);
+        console.log(`  Turn:          ${c.turnId}`);
+        console.log(`  Conversation:  ${c.conversationId}`);
+        console.log(`  Since:         ${c.trippedAt}`);
+        console.log(chalk.gray(`\nResolve the underlying ${c.cause} issue, then run \`${invokedAs} chat-circuit clear\`. ` +
+            `Code/review lanes are unaffected.`));
+        process.exitCode = 1;
+    }));
+    chatCircuitCmd
+        .command("clear")
+        .description("Close the chat circuit and allow the runner to resume claiming chat turns.")
+        .action(guard(async () => {
+        await clearChatCircuit();
+        console.log(chalk.green("✓ Chat circuit closed. Runner will resume claiming chat turns."));
+    }));
+    // The git pre-commit hook the runner installs into a task worktree (see
+    // commit-guard.ts) re-invokes this hidden subcommand. It scans the STAGED text
+    // files and exits non-zero (with an actionable message on stderr) when a NUL
+    // byte / invalid UTF-8 / binary-blob-where-text is found, so git aborts the
+    // commit and the agent fixes it in-session. Hidden — it is a hook entry point,
+    // not an operator command.
+    program
+        .command("_precommit-guard", { hidden: true })
+        .description("Internal: commit-time mechanical guard (pre-commit hook entry).")
+        .action(async () => {
+        try {
+            const result = await runCommitGuardHook();
+            if (!result.ok) {
+                console.error(result.message);
+                process.exitCode = 1;
+            }
+        }
+        catch (err) {
+            // Fail OPEN on an internal error: a guard bug must never wedge the agent's
+            // ability to commit. The pre-PR gate (prepr-gate.ts) is the backstop.
+            console.error(chalk.yellow(`commit-guard skipped (internal error): ${err.message}`));
+        }
+    });
+    program
+        .command("version")
+        .description("Print CLI + protocol versions.")
+        .action(() => {
+        const label = Math.max(invokedAs.length, "protocol".length);
+        console.log(`${invokedAs.padEnd(label)} ${PACKAGE_VERSION}`);
+        console.log(`${"protocol".padEnd(label)} ${PROTOCOL_VERSION}`);
+    });
+    return program;
+}
+/**
+ * True when `moduleUrl` is the process entry point — NOT when it is imported by
+ * a test. realpath resolves the npm bin symlink to the built file so the compare
+ * holds for a globally-installed CLI.
+ */
+export function isMainModule(moduleUrl) {
+    const entry = process.argv[1];
+    if (!entry)
+        return false;
+    try {
+        return realpathSync(entry) === realpathSync(fileURLToPath(moduleUrl));
+    }
+    catch {
+        return false;
+    }
+}
+/** Parse argv and turn a thrown error into a red line + exit 1. */
+export function runProgram(program) {
+    program.parseAsync(process.argv).catch((err) => {
+        console.error(chalk.red(`✗ ${err.message}`));
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=program.js.map