@tokenfactory/acc-runner 0.41.7 → 0.42.0

package/dist/program.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"program.js","sourceRoot":"","sources":["../src/program.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAwB,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGnD,mFAAmF;AACnF,SAAS,KAAK,CAAC,EAA0B;IACvC,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,EAA0B;IAC7C,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;QACtB,MAAM,qBAAqB,EAAE,CAAC;QAC9B,MAAM,EAAE,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,MAAM,UAAU,YAAY,CAAC,UAA+B,EAAE;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IACpD,MAAM,OAAO,GAAG,SAAS,KAAK,KAAK,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,SAAS,CAAC;SACf,WAAW,CACV,OAAO;QACL,CAAC,CAAC,yFAAyF;QAC3F,CAAC,CAAC,mHAAmH,CACxH;SACA,OAAO,CAAC,GAAG,eAAe,eAAe,gBAAgB,GAAG,CAAC,CAAC;IAEjE,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,kBAAkB,GAAG,CAAC,MAAe,EAAE,KAAyB,EAAE,EAAE;QACxE,MAAM;aACH,OAAO,CAAC,OAAO,CAAC;aAChB,WAAW,CAAC,sEAAsE,CAAC;aACnF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM;aACH,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;aACrB,WAAW,CAAC,yCAAyC,CAAC;aACtD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM;aACH,OAAO,CAAC,QAAQ,CAAC;aACjB,WAAW,CAAC,mEAAmE,CAAC;aAChF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sDAAsD,CAAC,CAAC;IACvE,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAElD,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,CAAC,MAAe,EAAE,EAAE;QAC9C,MAAM;aACH,OAAO,CAAC,OAAO,CAAC;aAChB,WAAW,CAAC,0DAA0D,CAAC;aACvE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QACvC,MAAM;aACH,OAAO,CAAC,QAAQ,CAAC;aACjB,WAAW,CAAC,uDAAuD,CAAC;aACpE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,mBAAmB,CACjB,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wDAAwD,CAAC,CACzE,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,6EAA6E;IAC7E,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,8CAA8C,CAAC,CAAC;IAE/D,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,mBAAmB,EAAE,+CAA+C,CAAC;SAC5E,MAAM,CAAC,eAAe,EAAE,wCAAwC,CAAC;SACjE,MAAM,CAAC,aAAa,EAAE,oCAAoC,CAAC;SAC3D,MAAM,CAAC,QAAQ,EAAE,mCAAmC,CAAC;SACrD,MAAM,CAAC,CAAC,IAAqB,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAEjF,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,wBAAwB,CAAC;SACrC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;SACzC,MAAM,CAAC,QAAQ,EAAE,kCAAkC,CAAC;SACpD,MAAM,CAAC,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAC/C,WAAW,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,CAC/C,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,mEAAmE,CAAC;SAChF,QAAQ,CAAC,cAAc,EAAE,gDAAgD,CAAC;SAC1E,MAAM,CAAC,qBAAqB,EAAE,oCAAoC,CAAC;SACnE,MAAM,CAAC,QAAQ,EAAE,gDAAgD,CAAC;SAClE,MAAM,CAAC,CAAC,KAAe,EAAE,IAAiB,EAAE,EAAE,CAC7C,WAAW,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,CACpD,CAAC;IAEJ,6EAA6E;IAC7E,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,8DAA8D;QAC9D,kEAAkE;QAClE,kCAAkC;QAClC,MAAM,YAAY,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,YAAY,EAAE,CAAC;QACrB,8DAA8D;QAC9D,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CACH,CAAC;IAEJ,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,YAAY,GAAG,OAAO;SACzB,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,0EAA0E,CAAC;SACvF,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChC,kEAAkE;QAClE,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CACH,CAAC;IAEJ,YAAY;SACT,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;IAEjD,YAAY;SACT,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC;IAElD,YAAY;SACT,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,mCAAmC,CAAC;SAChD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;IAEpD,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,2DAA2D,CAAC;SACxE,MAAM,CACL,UAAU,EACV,uFAAuF,CACxF;SACA,MAAM,CAAC,KAAK,EAAE,IAA0B,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,yEAAyE;IACzE,+EAA+E;IAC/E,gFAAgF;IAChF,gFAAgF;IAChF,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,gFAAgF,CACjF;SACA,cAAc,CAAC,aAAa,EAAE,gDAAgD,CAAC;SAC/E,cAAc,CAAC,mBAAmB,EAAE,uDAAuD,CAAC;SAC5F,MAAM,CAAC,kBAAkB,EAAE,oDAAoD,CAAC;SAChF,MAAM,CAAC,CAAC,IAA4D,EAAE,EAAE,CACvE,KAAK,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CACpC,CAAC;IAEJ,6EAA6E;IAC7E,+EAA+E;IAC/E,8DAA8D;IAC9D,MAAM,aAAa,GAAG,OAAO;SAC1B,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,+CAA+C,CAAC,CAAC;IAEhE,aAAa;SACV,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,CAAC,GAAG,MAAM,aAAa,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;QAC5C,iEAAiE;QACjE,qEAAqE;QACrE,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,WAAW,oCAAoC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,4BAA4B,CAAC,CAAC,KAAK,sBAAsB,SAAS,sBAAsB,CACzF,CACF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CACH,CAAC;IAEJ,aAAa;SACV,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,iEAAiE,CAAC;SAC9E,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,eAAe,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CAAC,mEAAmE,CAAC,CACjF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEJ,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,cAAc,GAAG,OAAO;SAC3B,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,wEAAwE,CAAC,CAAC;IAEzF,cAAc;SACX,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0BAA0B,CAAC;SACvC,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,CAAC,GAAG,MAAM,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,4BAA4B,CAAC,CAAC,KAAK,sBAAsB,SAAS,yBAAyB;YACzF,mCAAmC,CACtC,CACF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CACH,CAAC;IAEJ,cAAc;SACX,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,4EAA4E,CAAC;SACzF,MAAM,CACL,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,gBAAgB,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAC9E,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEJ,wEAAwE;IACxE,+EAA+E;IAC/E,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,2BAA2B;IAC3B,OAAO;SACJ,OAAO,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAC7C,WAAW,CAAC,iEAAiE,CAAC;SAC9E,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC9B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2EAA2E;YAC3E,sEAAsE;YACtE,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,MAAM,CAAC,0CAA2C,GAAa,CAAC,OAAO,EAAE,CAAC,CACjF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,gCAAgC,CAAC;SAC7C,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/user-auth/device-login.d.ts

@@ -0,0 +1,47 @@
+import { type GoTrueDeps, type StoredUserSession } from "./session.js";
+export declare const DEVICE_CODE_PATH = "/api/auth/device-code";
+/** Consecutive transient exchange failures tolerated before giving up. */
+export declare const MAX_POLL_FAILURES = 5;
+export interface DeviceLoginDeps extends GoTrueDeps {
+    sleep?: (ms: number) => Promise<unknown>;
+    openBrowser?: (url: string) => Promise<unknown>;
+    log?: (line: string) => void;
+    /** Override the polling cadence / deadline (tests). */
+    intervalSeconds?: number;
+    timeoutSeconds?: number;
+}
+/**
+ * Run the whole handshake and return the session, WITHOUT persisting it — so the
+ * flow is testable end to end and the keychain write stays one explicit step in
+ * the command below.
+ *
+ * A transient failure (503 `retry`, a cold function, a pooler hiccup) must not
+ * abort a login whose code is still valid: it is counted, not fatal, and the
+ * real deadline is the code's TTL. This is the DEVICE-BIND-FIX rule the runner
+ * lane learned the hard way — only `expired` is terminal.
+ */
+export declare function deviceLogin(deps?: DeviceLoginDeps): Promise<StoredUserSession>;
+export declare function authLoginCommand(deps?: DeviceLoginDeps): Promise<void>;
+/**
+ * "Am I still signed in?" — which is a question about the SERVER's copy of the
+ * session, not this machine's. A keychain entry alone proves nothing: the session
+ * may have been revoked from Settings → Sessions while this terminal was closed,
+ * and the stored access token would still look perfectly valid. So the local facts
+ * are printed first (they work offline) and then the server is asked.
+ */
+export declare function authStatusCommand(deps?: DeviceLoginDeps): Promise<void>;
+/**
+ * Sign out for real. Deleting the keychain entry alone would leave the session
+ * live in `auth.sessions` — visible on the sessions surface, refreshable by
+ * anyone who had copied the token. So GoTrue is told first, and the local copy
+ * is removed whether or not that call reached it (an offline machine must still
+ * be able to drop its credential).
+ *
+ * `scope=local` is not a nicety, it is the whole contract of this command:
+ * GoTrue's default scope is GLOBAL, which would also sign the operator out of
+ * their browser and every other terminal. "Log this terminal out" must mean
+ * exactly one session — the one this keychain entry holds.
+ */
+export declare const LOGOUT_PATH = "/auth/v1/logout?scope=local";
+export declare function authLogoutCommand(deps?: DeviceLoginDeps): Promise<void>;
+//# sourceMappingURL=device-login.d.ts.map

package/dist/user-auth/device-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-login.d.ts","sourceRoot":"","sources":["../../src/user-auth/device-login.ts"],"names":[],"mappings":"AAqBA,OAAO,EAML,KAAK,UAAU,EACf,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAGtB,eAAO,MAAM,gBAAgB,0BAA0B,CAAC;AAuBxD,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAwBD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAiExF;AAED,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAahF;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBjF;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,gCAAgC,CAAC;AAEzD,wBAAsB,iBAAiB,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BjF"}

package/dist/user-auth/device-login.js

@@ -0,0 +1,189 @@
+/**
+ * `acc-runner auth login|status|logout` — the device-code flow for a PERSON
+ * (AX-G1 DEVICE-FLOW-GENERALIZE, gap G-16).
+ *
+ * Same three beats as `acc-runner login`, and deliberately so — an operator who
+ * has enrolled a runner already knows this flow:
+ *
+ *   1. ask /api/auth/device-code for a pair, print the short code
+ *   2. poll the exchange while the human binds it in a browser
+ *   3. spend the returned one-time grant against GoTrue, keychain the session
+ *
+ * What is NOT here is the fourth beat the runner flow has: no runner row, no
+ * `register_runner`, no fleet membership. This terminal is a person, not a
+ * machine, and `acc-runner login` is untouched by it.
+ */
+import chalk from "chalk";
+import open from "open";
+import { setTimeout as sleep } from "node:timers/promises";
+import { loadConfig } from "../config.js";
+import { cliName, signInCommand } from "../cli-name.js";
+import { PROTOCOL_VERSION } from "../types.js";
+import { clearUserSession, cliUserAgent, loadUserSession, saveUserSession, verifyEmailOtp, } from "./session.js";
+import { probeUserSession, revokedMessage } from "./liveness.js";
+export const DEVICE_CODE_PATH = "/api/auth/device-code";
+/** Consecutive transient exchange failures tolerated before giving up. */
+export const MAX_POLL_FAILURES = 5;
+async function post(doFetch, url, body) {
+    const res = await doFetch(url, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            "User-Agent": `acc-runner/${PROTOCOL_VERSION}`,
+        },
+        body: JSON.stringify(body ?? {}),
+    });
+    let json = {};
+    try {
+        json = (await res.json());
+    }
+    catch {
+        /* callers judge on status + shape */
+    }
+    return { status: res.status, json };
+}
+/**
+ * Run the whole handshake and return the session, WITHOUT persisting it — so the
+ * flow is testable end to end and the keychain write stays one explicit step in
+ * the command below.
+ *
+ * A transient failure (503 `retry`, a cold function, a pooler hiccup) must not
+ * abort a login whose code is still valid: it is counted, not fatal, and the
+ * real deadline is the code's TTL. This is the DEVICE-BIND-FIX rule the runner
+ * lane learned the hard way — only `expired` is terminal.
+ */
+export async function deviceLogin(deps = {}) {
+    const cfg = loadConfig();
+    const doFetch = deps.fetch ?? fetch;
+    const nap = deps.sleep ?? ((ms) => sleep(ms));
+    const say = deps.log ?? ((line) => console.log(line));
+    const endpoint = `${cfg.publicUrl.replace(/\/+$/, "")}${DEVICE_CODE_PATH}`;
+    const created = await post(doFetch, endpoint, { action: "create" });
+    if (created.status !== 200 || !created.json.device_code) {
+        throw new Error(`Could not start device login (HTTP ${created.status}).`);
+    }
+    const start = created.json;
+    say("");
+    say(chalk.bold("To sign in to ACC from this terminal:"));
+    say("");
+    say(`  ${chalk.cyan("1.")} Visit  ${chalk.underline(start.verification_url)}`);
+    say(`  ${chalk.cyan("2.")} Enter code:  ${chalk.bold.green(start.user_code)}`);
+    say("");
+    say(chalk.gray("Waiting for confirmation…"));
+    const openBrowser = deps.openBrowser ?? ((url) => open(url));
+    void Promise.resolve(openBrowser(start.verification_url)).catch(() => {
+        /* headless box; the printed URL is the fallback */
+    });
+    const interval = (deps.intervalSeconds ?? start.interval) * 1000;
+    const now = () => deps.now?.() ?? Date.now();
+    const deadline = now() + (deps.timeoutSeconds ?? start.expires_in) * 1000;
+    let failures = 0;
+    let lastFailure = null;
+    while (now() < deadline) {
+        await nap(interval);
+        const { status, json } = await post(doFetch, endpoint, {
+            action: "exchange",
+            device_code: start.device_code,
+        });
+        if (status !== 200 || json.status === "retry") {
+            failures += 1;
+            lastFailure = json.status === "retry" ? (json.error ?? "retry") : `HTTP ${status}`;
+            if (failures >= MAX_POLL_FAILURES) {
+                throw new Error(`Device-code exchange failed ${failures} times in a row: ${lastFailure}`);
+            }
+            continue;
+        }
+        failures = 0;
+        if (json.status === "expired") {
+            throw new Error("Device code expired before sign-in completed. Run the command again.");
+        }
+        if (json.status === "ok") {
+            if (!json.email) {
+                throw new Error("This account has no email address, so a CLI session cannot be issued.");
+            }
+            // The grant is spent from HERE, not on the server: GoTrue records this
+            // machine's agent and address on the session row, which is what makes the
+            // session recognisable (and therefore revocable) on Settings → Sessions.
+            return verifyEmailOtp({ supabaseUrl: json.supabase_url, anonKey: json.anon_key }, { email: json.email, token: json.token }, deps);
+        }
+    }
+    throw new Error("Device code timed out before sign-in completed.");
+}
+export async function authLoginCommand(deps = {}) {
+    const session = await deviceLogin(deps);
+    await saveUserSession(session);
+    const say = deps.log ?? ((line) => console.log(line));
+    say(chalk.green(`✓ Signed in as ${session.email ?? session.user_id}`));
+    say(chalk.green("✓ Stored session in OS keychain (acc-runner · user)"));
+    say("");
+    say(chalk.gray(`This session appears on Settings → Sessions as "${cliUserAgent()}".`));
+    say(chalk.gray(`Revoke it there, or run \`${cliName() === "acc" ? "acc logout" : "acc-runner auth logout"}\`.`));
+}
+/**
+ * "Am I still signed in?" — which is a question about the SERVER's copy of the
+ * session, not this machine's. A keychain entry alone proves nothing: the session
+ * may have been revoked from Settings → Sessions while this terminal was closed,
+ * and the stored access token would still look perfectly valid. So the local facts
+ * are printed first (they work offline) and then the server is asked.
+ */
+export async function authStatusCommand(deps = {}) {
+    const say = deps.log ?? ((line) => console.log(line));
+    const session = await loadUserSession();
+    if (!session) {
+        say(`Not signed in. Run \`${signInCommand()}\`.`);
+        return;
+    }
+    say(`Signed in as ${session.email ?? session.user_id}`);
+    say(`Access token expires ${session.access_expires_at}`);
+    const verdict = await probeUserSession(session, deps);
+    if (!verdict.live) {
+        await clearUserSession();
+        say(chalk.yellow(`✗ ${revokedMessage()}`));
+        return;
+    }
+    say(verdict.verified
+        ? chalk.green("✓ The session is still live server-side.")
+        : chalk.gray("Could not reach ACC to confirm the session; treating it as live."));
+}
+/**
+ * Sign out for real. Deleting the keychain entry alone would leave the session
+ * live in `auth.sessions` — visible on the sessions surface, refreshable by
+ * anyone who had copied the token. So GoTrue is told first, and the local copy
+ * is removed whether or not that call reached it (an offline machine must still
+ * be able to drop its credential).
+ *
+ * `scope=local` is not a nicety, it is the whole contract of this command:
+ * GoTrue's default scope is GLOBAL, which would also sign the operator out of
+ * their browser and every other terminal. "Log this terminal out" must mean
+ * exactly one session — the one this keychain entry holds.
+ */
+export const LOGOUT_PATH = "/auth/v1/logout?scope=local";
+export async function authLogoutCommand(deps = {}) {
+    const say = deps.log ?? ((line) => console.log(line));
+    const session = await loadUserSession();
+    if (!session) {
+        say("Not signed in.");
+        return;
+    }
+    let revoked = false;
+    try {
+        const doFetch = deps.fetch ?? fetch;
+        const res = await doFetch(`${session.supabase_url.replace(/\/+$/, "")}${LOGOUT_PATH}`, {
+            method: "POST",
+            headers: {
+                apikey: session.anon_key,
+                Authorization: `Bearer ${session.access_token}`,
+                "User-Agent": deps.userAgent ?? cliUserAgent(),
+            },
+        });
+        revoked = res.status < 400;
+    }
+    catch {
+        revoked = false;
+    }
+    await clearUserSession();
+    say(revoked
+        ? chalk.green("✓ Signed out (session revoked server-side).")
+        : chalk.yellow("✓ Local session cleared. The server session may still be live — revoke it on Settings → Sessions."));
+}
+//# sourceMappingURL=device-login.js.map

package/dist/user-auth/device-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-login.js","sourceRoot":"","sources":["../../src/user-auth/device-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,GAGf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAuBxD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAWnC,KAAK,UAAU,IAAI,CACjB,OAAqB,EACrB,GAAW,EACX,IAAa;IAEb,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,cAAc,gBAAgB,EAAE;SAC/C;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;KACjC,CAAC,CAAC;IACH,IAAI,IAAI,GAAG,EAAO,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAwB,EAAE;IAC1D,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAE3E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAiB,OAAO,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAE3B,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC/E,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC/E,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAE7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,KAAK,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACnE,mDAAmD;IACrD,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IACjE,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IAC1E,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,WAAW,GAAkB,IAAI,CAAC;IAEtC,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAmB,OAAO,EAAE,QAAQ,EAAE;YACvE,MAAM,EAAE,UAAU;YAClB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC9C,QAAQ,IAAI,CAAC,CAAC;YACd,WAAW,GAAG,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC;YACnF,IAAI,QAAQ,IAAI,iBAAiB,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,oBAAoB,WAAW,EAAE,CAAC,CAAC;YAC5F,CAAC;YACD,SAAS;QACX,CAAC;QACD,QAAQ,GAAG,CAAC,CAAC;QACb,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;YAC3F,CAAC;YACD,uEAAuE;YACvE,0EAA0E;YAC1E,yEAAyE;YACzE,OAAO,cAAc,CACnB,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,EAC1D,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EACxC,IAAI,CACL,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAwB,EAAE;IAC/D,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACvE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC,CAAC;IACxE,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mDAAmD,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,GAAG,CACD,KAAK,CAAC,IAAI,CACR,6BAA6B,OAAO,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,wBAAwB,KAAK,CAChG,CACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAwB,EAAE;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,wBAAwB,aAAa,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IACD,GAAG,CAAC,gBAAgB,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACxD,GAAG,CAAC,wBAAwB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAEzD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,gBAAgB,EAAE,CAAC;QACzB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,GAAG,CACD,OAAO,CAAC,QAAQ;QACd,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,0CAA0C,CAAC;QACzD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CACnF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,6BAA6B,CAAC;AAEzD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAwB,EAAE;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACtB,OAAO;IACT,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,WAAW,EAAE,EAAE;YACrF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE;gBAC/C,YAAY,EAAE,IAAI,CAAC,SAAS,IAAI,YAAY,EAAE;aAC/C;SACF,CAAC,CAAC;QACH,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,MAAM,gBAAgB,EAAE,CAAC;IACzB,GAAG,CACD,OAAO;QACL,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,6CAA6C,CAAC;QAC5D,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,mGAAmG,CAAC,CACtH,CAAC;AACJ,CAAC"}

package/dist/user-auth/liveness.d.ts

@@ -0,0 +1,27 @@
+import { type GoTrueDeps, type StoredUserSession } from "./session.js";
+export declare const SESSION_STATUS_PATH = "/api/auth/session-status";
+/** What the probe concluded. `verified` false means "could not check". */
+export interface LivenessVerdict {
+    live: boolean;
+    verified: boolean;
+    reason: string;
+}
+/**
+ * Map one HTTP answer onto a verdict. Pure, so every branch is asserted directly
+ * rather than through a fetch double.
+ */
+export declare function decideLiveness(status: number, body: unknown): LivenessVerdict;
+/** Ask the control plane about this session. Never throws — a transport failure
+ *  is an unverified verdict, not a sign-out. */
+export declare function probeUserSession(session: StoredUserSession, deps?: GoTrueDeps): Promise<LivenessVerdict>;
+/** The message an operator sees when their terminal was revoked from the web. */
+export declare function revokedMessage(): string;
+/** Test seam: forget the memoized verdict. */
+export declare function resetSessionLivenessProbe(): void;
+/**
+ * Called at the top of every person-lane command. Throws SignedOutError when the
+ * session has been revoked; returns silently in every other case, including every
+ * case where we could not tell.
+ */
+export declare function ensureUserSessionLive(deps?: GoTrueDeps): Promise<void>;
+//# sourceMappingURL=liveness.d.ts.map

package/dist/user-auth/liveness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"liveness.d.ts","sourceRoot":"","sources":["../../src/user-auth/liveness.ts"],"names":[],"mappings":"AA0BA,OAAO,EAML,KAAK,UAAU,EACf,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAEtB,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAE9D,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,eAAe,CAuB7E;AAED;gDACgD;AAChD,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,iBAAiB,EAC1B,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,eAAe,CAAC,CAqB1B;AAED,iFAAiF;AACjF,wBAAgB,cAAc,IAAI,MAAM,CAKvC;AASD,8CAA8C;AAC9C,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAoBD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAK1E"}

package/dist/user-auth/liveness.js

@@ -0,0 +1,128 @@
+/**
+ * Does this terminal's session still exist server-side? (AX-G3, gap G-16.)
+ *
+ * THE PROBLEM. Revoking a CLI login on Settings → Sessions deletes the
+ * `auth.sessions` row and cascades its refresh-token family, so this machine can
+ * never mint another access token. But the access token already in the keychain
+ * stays cryptographically valid until it expires — and PostgREST, which every
+ * `acc task` read goes through, verifies a JWT's signature without ever looking at
+ * the session table. So a revoked terminal would keep reading the board for the
+ * rest of the token's life, which is up to an hour of a revoke not being a revoke.
+ *
+ * The refresh path already handles the other half: once the token IS stale,
+ * refreshUserSession gets a 4xx and raises SignedOutError. This module covers the
+ * window before that — one cheap read of /api/auth/session-status per command.
+ *
+ * FAIL OPEN, ON PURPOSE. Only a positive `live: false` signs the operator out.
+ * An unreachable control plane, a 5xx, a deployment that predates the endpoint
+ * (404), an unwired session directory, a token with no session claim — all of
+ * those leave the session alone. The alternative is a pooler hiccup logging out
+ * every terminal in the fleet at once, which is a worse failure than the one this
+ * module exists to fix. The only thing we treat as definitive besides `live:false`
+ * is a 401 whose reason is `invalid_token`: that is the auth authority itself
+ * saying this credential is not a credential.
+ */
+import { loadConfig } from "../config.js";
+import { signInCommand } from "../cli-name.js";
+import { accessTokenIsFresh, clearUserSession, cliUserAgent, loadUserSession, SignedOutError, } from "./session.js";
+export const SESSION_STATUS_PATH = "/api/auth/session-status";
+/**
+ * Map one HTTP answer onto a verdict. Pure, so every branch is asserted directly
+ * rather than through a fetch double.
+ */
+export function decideLiveness(status, body) {
+    const b = (body ?? {});
+    if (status === 401) {
+        // requireUser answers 401 with a discriminated reason. `invalid_token` is the
+        // authority rejecting the credential — definitive. `auth_unreachable` and the
+        // header-shape classes are not about this session at all.
+        const reason = typeof b.reason === "string" ? b.reason : "unauthenticated";
+        if (reason === "invalid_token")
+            return { live: false, verified: true, reason };
+        return { live: true, verified: false, reason };
+    }
+    if (status !== 200) {
+        // 404 = an older deployment without this endpoint. 5xx = the control plane.
+        // Neither is evidence about the session.
+        return { live: true, verified: false, reason: `http_${status}` };
+    }
+    if (b.live === false && b.verified === true) {
+        return { live: false, verified: true, reason: typeof b.reason === "string" ? b.reason : "revoked" };
+    }
+    return {
+        live: true,
+        verified: b.verified === true,
+        reason: typeof b.reason === "string" ? b.reason : "live",
+    };
+}
+/** Ask the control plane about this session. Never throws — a transport failure
+ *  is an unverified verdict, not a sign-out. */
+export async function probeUserSession(session, deps = {}) {
+    const doFetch = deps.fetch ?? fetch;
+    const base = loadConfig().publicUrl.replace(/\/+$/, "");
+    try {
+        const res = await doFetch(`${base}${SESSION_STATUS_PATH}`, {
+            method: "GET",
+            headers: {
+                Accept: "application/json",
+                Authorization: `Bearer ${session.access_token}`,
+                "User-Agent": deps.userAgent ?? cliUserAgent(),
+            },
+        });
+        const body = await res.json().catch(() => ({}));
+        return decideLiveness(res.status, body);
+    }
+    catch (err) {
+        return {
+            live: true,
+            verified: false,
+            reason: `unreachable: ${err.message?.slice(0, 120) ?? "error"}`,
+        };
+    }
+}
+/** The message an operator sees when their terminal was revoked from the web. */
+export function revokedMessage() {
+    return ("This terminal's ACC session is no longer valid — it was revoked from " +
+        `Settings → Sessions, or it expired. Run \`${signInCommand()}\` to sign in again.`);
+}
+/**
+ * One probe per process, so two calls inside a single command do not both go to
+ * the network. A new command is a new process, which is what "takes effect on its
+ * next call" means for a CLI.
+ */
+let inFlight = null;
+/** Test seam: forget the memoized verdict. */
+export function resetSessionLivenessProbe() {
+    inFlight = null;
+}
+async function runCheck(deps) {
+    const session = await loadUserSession();
+    // No session at all: the command's own "not signed in" error is the right
+    // message, and it does not need a network call to say it.
+    if (!session)
+        return;
+    // A stale token is about to be refreshed, and a refresh against a revoked
+    // session already fails with the same error. Probing would be a second network
+    // call to learn what the first one is about to tell us.
+    if (!accessTokenIsFresh(session, deps.now?.() ?? Date.now()))
+        return;
+    const verdict = await probeUserSession(session, deps);
+    if (verdict.live)
+        return;
+    // Drop the dead credential: leaving it would make every later command fail the
+    // same way, and would make `whoami` claim a session that no longer exists.
+    await clearUserSession();
+    throw new SignedOutError(revokedMessage());
+}
+/**
+ * Called at the top of every person-lane command. Throws SignedOutError when the
+ * session has been revoked; returns silently in every other case, including every
+ * case where we could not tell.
+ */
+export function ensureUserSessionLive(deps = {}) {
+    // A rejected memo is deliberately kept: a second caller in the same process
+    // should see the same sign-out, not probe a session we already know is gone.
+    inFlight ??= runCheck(deps);
+    return inFlight;
+}
+//# sourceMappingURL=liveness.js.map

package/dist/user-auth/liveness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"liveness.js","sourceRoot":"","sources":["../../src/user-auth/liveness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,cAAc,GAGf,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAS9D;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,IAAa;IAC1D,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IAClD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,8EAA8E;QAC9E,8EAA8E;QAC9E,0DAA0D;QAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAC3E,IAAI,MAAM,KAAK,eAAe;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC/E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,4EAA4E;QAC5E,yCAAyC;QACzC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACtG,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,IAAI;QAC7B,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;KACzD,CAAC;AACJ,CAAC;AAED;gDACgD;AAChD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA0B,EAC1B,OAAmB,EAAE;IAErB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,mBAAmB,EAAE,EAAE;YACzD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE;gBAC/C,YAAY,EAAE,IAAI,CAAC,SAAS,IAAI,YAAY,EAAE;aAC/C;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,gBAAiB,GAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE;SAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc;IAC5B,OAAO,CACL,uEAAuE;QACvE,6CAA6C,aAAa,EAAE,sBAAsB,CACnF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,IAAI,QAAQ,GAAyB,IAAI,CAAC;AAE1C,8CAA8C;AAC9C,MAAM,UAAU,yBAAyB;IACvC,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAgB;IACtC,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;IACxC,0EAA0E;IAC1E,0DAA0D;IAC1D,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,0EAA0E;IAC1E,+EAA+E;IAC/E,wDAAwD;IACxD,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO;IAErE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO;IACzB,+EAA+E;IAC/E,2EAA2E;IAC3E,MAAM,gBAAgB,EAAE,CAAC;IACzB,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAmB,EAAE;IACzD,4EAA4E;IAC5E,6EAA6E;IAC7E,QAAQ,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/user-auth/session.d.ts

@@ -0,0 +1,82 @@
+/** Keychain account for the person session. The runner's is "default". */
+export declare const USER_SESSION_SLOT: "user";
+/** Refresh this far ahead of expiry, so a long RPC never straddles it. */
+export declare const REFRESH_SKEW_SECONDS = 120;
+export interface StoredUserSession {
+    access_token: string;
+    refresh_token: string;
+    /** ISO-8601 instant at which access_token expires. */
+    access_expires_at: string;
+    user_id: string;
+    email: string | null;
+    /** Resolved by the exchange, so a fresh machine needs no connection env. */
+    supabase_url: string;
+    anon_key: string;
+}
+/**
+ * `acc-cli/1.2.3 (darwin; my-laptop)`. The hostname is filtered to header-safe
+ * characters — a hostname with a stray byte must not make an auth call throw
+ * where it would otherwise have succeeded.
+ */
+export declare function cliUserAgent(hostname?: string): string;
+/** Raised when the session is gone for good — revoked, expired, or never there. */
+export declare class SignedOutError extends Error {
+    constructor(message: string);
+}
+export declare function saveUserSession(session: StoredUserSession): Promise<void>;
+export declare function loadUserSession(): Promise<StoredUserSession | null>;
+export declare function clearUserSession(): Promise<boolean>;
+/** The token payload GoTrue answers `/verify` and `/token` with. */
+export interface GoTrueTokenResponse {
+    access_token?: string;
+    refresh_token?: string;
+    expires_in?: number;
+    expires_at?: number;
+    user?: {
+        id?: string;
+        email?: string | null;
+    } | null;
+}
+export interface GoTrueTarget {
+    supabaseUrl: string;
+    anonKey: string;
+}
+/** Injectable so the tests drive the rules without a network. */
+export interface GoTrueDeps {
+    fetch?: typeof fetch;
+    now?: () => number;
+    userAgent?: string;
+}
+/**
+ * Fold a token response into a session, or fail loudly. A response missing
+ * either token, or the user id, is not a session however cheerful its status
+ * code was — better to refuse than to persist a credential we cannot refresh.
+ */
+export declare function toStoredSession(json: GoTrueTokenResponse, target: GoTrueTarget, now: number): StoredUserSession;
+/** Spend the one-time grant from /api/auth/device-code for a real session. */
+export declare function verifyEmailOtp(target: GoTrueTarget, params: {
+    email: string;
+    token: string;
+}, deps?: GoTrueDeps): Promise<StoredUserSession>;
+/**
+ * Trade the refresh token for a fresh pair. A 4xx here is the revocation path,
+ * not an outage: GoTrue answers 400/401 for a token that was revoked (the
+ * sessions surface deleted the row) or already rotated, and both mean the same
+ * thing to the operator — sign in again.
+ */
+export declare function refreshUserSession(session: StoredUserSession, deps?: GoTrueDeps): Promise<StoredUserSession>;
+export declare function accessTokenIsFresh(session: StoredUserSession, now?: number): boolean;
+/**
+ * The accessor everything downstream should use: a live access token for the
+ * signed-in human, refreshed and re-persisted when it is close to expiry.
+ *
+ * The rotated successor is written back BEFORE the token is returned, because a
+ * caller that used a token whose refresh partner never landed would be one crash
+ * away from replaying a spent token — which GoTrue treats as reuse.
+ *
+ * A revoked session clears the keychain slot on the way out. Leaving a dead
+ * credential in the keychain would make every later command fail the same way
+ * with nothing to show for it; removing it makes `auth status` honest.
+ */
+export declare function getUserAccessToken(deps?: GoTrueDeps): Promise<string>;
+//# sourceMappingURL=session.d.ts.map

package/dist/user-auth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/user-auth/session.ts"],"names":[],"mappings":"AAmCA,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,EAAG,MAAe,CAAC;AAEjD,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,GAAE,MAAsB,GAAG,MAAM,CAGrE;AAED,mFAAmF;AACnF,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAID,wBAAgB,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzE;AAED,wBAAgB,eAAe,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAEnE;AAED,wBAAgB,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAEnD;AAID,oEAAoE;AACpE,MAAM,WAAW,mBAAmB;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iEAAiE;AACjE,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA4BD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,MAAM,GACV,iBAAiB,CAoBnB;AAED,8EAA8E;AAC9E,wBAAsB,cAAc,CAClC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EACxC,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,iBAAiB,CAAC,CAW5B;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,iBAAiB,EAC1B,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,iBAAiB,CAAC,CAiB5B;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,iBAAiB,EAC1B,GAAG,GAAE,MAAmB,GACvB,OAAO,CAIT;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAc/E"}