crewly 1.20.122 → 1.20.124

package/dist/cli/backend/src/services/harness/login-broker.service.js

@@ -0,0 +1,495 @@
+/**
+ * Login broker — runs a harness's own login command in a PTY and relays it.
+ *
+ * The broker knows nothing about harness APIs. It spawns the login command
+ * (`claude setup-token`, `codex login --device-auth`) in a very wide PTY,
+ * normalizes the screen and applies the harness's rule set (login-rules.ts)
+ * to find the sign-in URL, a one-time code, a "paste the code" prompt,
+ * success and failure. Front ends read the resulting {@link LoginSession}
+ * and send the user's reply back with {@link LoginBrokerService.input}.
+ *
+ * Front ends are consumers of the same events: the REST API polls
+ * {@link LoginBrokerService.get}, the CLI awaits
+ * {@link LoginBrokerService.waitForCompletion}, and Phase 2 (re-login over
+ * Slack DM) subscribes to the `update` / `finished` events.
+ *
+ * Secrets: Claude's long-lived token is captured from the screen, stored with
+ * {@link HarnessCredentialsStore.setClaudeOauthToken}, redacted from every
+ * exposed screen and scrubbed from the raw buffer. It is never logged or
+ * emitted.
+ *
+ * State machine:
+ * `starting` → `awaiting_user` (URL / code / prompt seen) → `verifying`
+ * (input sent, or the command reported success and is being confirmed) →
+ * `succeeded` | `failed`; any live state → `timed_out` (15 min) | `cancelled`.
+ * A prompt that reappears after input returns the session to `awaiting_user`.
+ *
+ * @module services/harness/login-broker.service
+ */
+import { randomUUID } from 'crypto';
+import { EventEmitter } from 'events';
+import * as os from 'os';
+import * as pty from 'node-pty';
+import { API_SECURITY_CONSTANTS, HARNESS_CONSTANTS } from '../../constants.js';
+import { stripNestedClaudeSessionEnv } from '../agent/runtime-session-recovery.js';
+import { prepareClaudeConfigForCrewlyLogin } from './claude-config.utils.js';
+import { getHarnessCredentialsStore } from './harness-credentials.store.js';
+import { buildHarnessPath, resolveExecutable } from './harness-exec.utils.js';
+import { getHarnessDefinition, getLoginMethod } from './harness-registry.js';
+import { SILENT_HARNESS_LOGGER, isTerminalLoginState, } from './harness.types.js';
+import { evaluateLoginRules, getLoginRules, normalizeTerminalOutput, redactSecrets } from './login-rules.js';
+/** Events emitted by the broker. Listeners receive a {@link LoginSession} (never a secret). */
+export const LOGIN_BROKER_EVENTS = {
+    /** Any change to a session */
+    UPDATE: 'update',
+    /** A session reached a terminal state */
+    FINISHED: 'finished',
+};
+/** Broker error with a machine-readable code. */
+export class LoginBrokerError extends Error {
+    code;
+    /**
+     * @param code - Machine-readable code
+     * @param message - Human-readable message (never contains a secret)
+     */
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'LoginBrokerError';
+    }
+}
+/**
+ * Default PTY spawner (node-pty).
+ *
+ * @param file - Executable
+ * @param args - Arguments
+ * @param options - Size, cwd, env
+ * @returns The PTY
+ */
+const defaultSpawnPty = (file, args, options) => pty.spawn(file, args, { name: 'xterm-256color', cols: options.cols, rows: options.rows, cwd: options.cwd, env: options.env });
+/** Runs harness login commands in PTYs and tracks their sessions. */
+export class LoginBrokerService extends EventEmitter {
+    spawnPty;
+    resolveCommand;
+    env;
+    homeDir;
+    credentials;
+    verify;
+    prepareClaudeConfig;
+    now;
+    idFactory;
+    logger;
+    timeoutMs;
+    sessions = new Map();
+    /** Sessions whose verification is in flight. */
+    verifying = new Set();
+    /**
+     * @param deps - Injectable dependencies (all optional)
+     */
+    constructor(deps = {}) {
+        super();
+        this.spawnPty = deps.spawnPty ?? defaultSpawnPty;
+        this.resolveCommand = deps.resolveCommand ?? ((command, envPath) => resolveExecutable(command, envPath));
+        this.env = deps.env ?? process.env;
+        this.homeDir = deps.homeDir ?? os.homedir();
+        this.credentials = deps.credentials ?? getHarnessCredentialsStore();
+        this.verify = deps.verify ?? (async () => true);
+        this.prepareClaudeConfig = deps.prepareClaudeConfig ?? (() => void prepareClaudeConfigForCrewlyLogin());
+        this.now = deps.now ?? Date.now;
+        this.idFactory = deps.idFactory ?? randomUUID;
+        this.logger = deps.logger ?? SILENT_HARNESS_LOGGER;
+        this.timeoutMs = deps.timeoutMs ?? HARNESS_CONSTANTS.LOGIN.TIMEOUT_MS;
+    }
+    /**
+     * Environment for the login PTY: the harness PATH, no owner API token, no
+     * nested-Claude-session markers, and a no-op BROWSER so the harness does
+     * not try to open a browser on the server.
+     *
+     * @returns String-only env map
+     */
+    buildEnv() {
+        const cleaned = stripNestedClaudeSessionEnv({ ...this.env });
+        const env = {};
+        for (const [key, value] of Object.entries(cleaned)) {
+            if (value !== undefined && key !== API_SECURITY_CONSTANTS.ENV.API_TOKEN)
+                env[key] = value;
+        }
+        env.PATH = buildHarnessPath(this.env.PATH, this.homeDir);
+        env.BROWSER = HARNESS_CONSTANTS.LOGIN.BROWSER_SUPPRESS_VALUE;
+        env.TERM = 'xterm-256color';
+        return env;
+    }
+    /**
+     * Start a login session, or return the live one for this harness.
+     *
+     * @param harnessId - Harness id
+     * @param method - Broker login method (`subscription`, `device`)
+     * @returns The session
+     * @throws LoginBrokerError unknown_harness | unsupported_method | not_installed | spawn_failed
+     */
+    start(harnessId, method) {
+        const def = getHarnessDefinition(harnessId);
+        if (!def)
+            throw new LoginBrokerError('unknown_harness', `Unknown harness: ${harnessId}`);
+        const methodDef = getLoginMethod(def.id, method);
+        const rules = getLoginRules(def.id, method);
+        if (!methodDef || methodDef.kind !== 'broker' || !methodDef.broker || !rules) {
+            throw new LoginBrokerError('unsupported_method', `${def.displayName} has no "${method}" login that Crewly can run`);
+        }
+        const live = this.getActiveSession(def.id);
+        if (live)
+            return live;
+        this.prune();
+        const env = this.buildEnv();
+        const binary = this.resolveCommand(methodDef.broker.command, env.PATH);
+        if (!binary) {
+            throw new LoginBrokerError('not_installed', `${def.displayName} is not installed (\`${methodDef.broker.command}\` not found)`);
+        }
+        const nowIso = new Date(this.now()).toISOString();
+        let resolveDone = () => undefined;
+        const done = new Promise((resolve) => {
+            resolveDone = resolve;
+        });
+        const record = {
+            session: {
+                id: this.idFactory(),
+                harnessId: def.id,
+                method: method,
+                state: 'starting',
+                url: null,
+                userCode: null,
+                needsInput: false,
+                message: null,
+                screen: '',
+                startedAt: nowIso,
+                updatedAt: nowIso,
+            },
+            rules,
+            pty: null,
+            raw: '',
+            inputOffset: 0,
+            secrets: [],
+            timer: null,
+            exited: false,
+            finishedAt: null,
+            done,
+            resolveDone,
+        };
+        try {
+            record.pty = this.spawnPty(binary, [...methodDef.broker.args], {
+                cols: HARNESS_CONSTANTS.LOGIN.PTY_COLS,
+                rows: HARNESS_CONSTANTS.LOGIN.PTY_ROWS,
+                cwd: this.homeDir,
+                env,
+            });
+        }
+        catch (error) {
+            throw new LoginBrokerError('spawn_failed', `Could not start \`${methodDef.broker.command}\`: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        this.sessions.set(record.session.id, record);
+        record.pty.onData((data) => this.handleData(record, data));
+        record.pty.onExit(({ exitCode }) => {
+            void this.handleExit(record, exitCode);
+        });
+        record.timer = setTimeout(() => this.finish(record, 'timed_out', 'The login was not completed in time.'), this.timeoutMs);
+        record.timer.unref?.();
+        this.logger.info('Login broker session started', { sessionId: record.session.id, harnessId: def.id, method });
+        return { ...record.session };
+    }
+    /**
+     * Read a session.
+     *
+     * @param sessionId - Session id
+     * @returns The session
+     * @throws LoginBrokerError not_found
+     */
+    get(sessionId) {
+        return { ...this.requireRecord(sessionId).session };
+    }
+    /**
+     * The live (non-terminal) session for a harness, if any.
+     *
+     * @param harnessId - Harness id
+     * @returns The session, or null
+     */
+    getActiveSession(harnessId) {
+        for (const record of this.sessions.values()) {
+            if (record.session.harnessId === harnessId && !isTerminalLoginState(record.session.state))
+                return { ...record.session };
+        }
+        return null;
+    }
+    /**
+     * Type the user's reply into the PTY, followed by Enter.
+     *
+     * @param sessionId - Session id
+     * @param text - What the user typed (e.g. the code from platform.claude.com)
+     * @returns The session
+     * @throws LoginBrokerError not_found | not_active
+     */
+    input(sessionId, text) {
+        const record = this.requireRecord(sessionId);
+        if (isTerminalLoginState(record.session.state) || !record.pty || record.exited) {
+            throw new LoginBrokerError('not_active', 'This login has already finished');
+        }
+        record.inputOffset = record.raw.length;
+        record.pty.write(`${text.replace(/[\r\n]+/g, '')}${HARNESS_CONSTANTS.LOGIN.ENTER}`);
+        this.update(record, { state: 'verifying', needsInput: false, message: null });
+        return { ...record.session };
+    }
+    /**
+     * Cancel a session (kills the PTY). Cancelling a finished session is a no-op.
+     *
+     * @param sessionId - Session id
+     * @returns The session
+     * @throws LoginBrokerError not_found
+     */
+    cancel(sessionId) {
+        const record = this.requireRecord(sessionId);
+        if (!isTerminalLoginState(record.session.state))
+            this.finish(record, 'cancelled', 'Login cancelled.');
+        return { ...record.session };
+    }
+    /**
+     * Resolve when the session reaches a terminal state.
+     *
+     * @param sessionId - Session id
+     * @returns The final session
+     * @throws LoginBrokerError not_found
+     */
+    async waitForCompletion(sessionId) {
+        const record = this.requireRecord(sessionId);
+        if (isTerminalLoginState(record.session.state))
+            return { ...record.session };
+        return record.done;
+    }
+    /** Cancel every live session (backend shutdown, CLI exit). */
+    shutdown() {
+        for (const record of this.sessions.values()) {
+            if (!isTerminalLoginState(record.session.state))
+                this.finish(record, 'cancelled', 'Login cancelled: Crewly is shutting down.');
+        }
+    }
+    /**
+     * Session record or a not_found error.
+     *
+     * @param sessionId - Session id
+     * @returns The record
+     * @throws LoginBrokerError not_found
+     */
+    requireRecord(sessionId) {
+        const record = this.sessions.get(sessionId);
+        if (!record)
+            throw new LoginBrokerError('not_found', `Login session not found: ${sessionId}`);
+        return record;
+    }
+    /**
+     * Append PTY output and re-evaluate the rules.
+     *
+     * @param record - Session record
+     * @param data - Output chunk
+     */
+    handleData(record, data) {
+        if (isTerminalLoginState(record.session.state))
+            return;
+        record.raw += data;
+        const max = HARNESS_CONSTANTS.LOGIN.RAW_BUFFER_MAX_CHARS;
+        if (record.raw.length > max) {
+            const drop = record.raw.length - max;
+            record.raw = record.raw.slice(drop);
+            record.inputOffset = Math.max(0, record.inputOffset - drop);
+        }
+        this.evaluate(record, false);
+    }
+    /**
+     * Apply the rule set to the current screen and move the state machine.
+     *
+     * @param record - Session record
+     * @param final - The process has exited
+     */
+    evaluate(record, final) {
+        const screen = normalizeTerminalOutput(record.raw);
+        const promptScreen = normalizeTerminalOutput(record.raw.slice(record.inputOffset));
+        const match = evaluateLoginRules(record.rules, screen, { promptScreen, final });
+        if (match.secret && !record.secrets.includes(match.secret))
+            record.secrets.push(match.secret);
+        const patch = {
+            url: match.url ?? record.session.url,
+            userCode: match.userCode ?? record.session.userCode,
+            needsInput: match.needsInput,
+            screen: this.exposedScreen(record, screen.text),
+        };
+        if (match.succeeded) {
+            this.update(record, patch);
+            void this.complete(record, match.secret);
+            return;
+        }
+        if (match.failureMessage) {
+            if (match.needsInput) {
+                // The harness rejected the reply and asks again.
+                this.update(record, { ...patch, state: 'awaiting_user', message: match.failureMessage });
+            }
+            else {
+                this.update(record, patch);
+                this.finish(record, 'failed', match.failureMessage);
+            }
+            return;
+        }
+        let state = record.session.state;
+        if (state === 'starting' && (patch.url || patch.userCode || match.needsInput))
+            state = 'awaiting_user';
+        if (state === 'verifying' && match.needsInput)
+            state = 'awaiting_user';
+        this.update(record, { ...patch, state });
+    }
+    /**
+     * Handle a reported success: store the secret (Claude) or confirm (Codex).
+     *
+     * @param record - Session record
+     * @param secret - Captured credential, when the rule set has one
+     */
+    async complete(record, secret) {
+        if (isTerminalLoginState(record.session.state))
+            return;
+        if (record.rules.successRequiresSecret) {
+            if (!secret)
+                return;
+            try {
+                this.storeSecret(record, secret);
+            }
+            catch (error) {
+                this.finish(record, 'failed', `Login worked, but Crewly could not save the token: ${error instanceof Error ? error.message : String(error)}`);
+                return;
+            }
+            this.finish(record, 'succeeded', 'Logged in. Crewly saved the token for its agents.');
+            return;
+        }
+        await this.confirm(record);
+    }
+    /**
+     * Confirm a login with the harness's status command.
+     *
+     * @param record - Session record
+     */
+    async confirm(record) {
+        if (this.verifying.has(record.session.id) || isTerminalLoginState(record.session.state))
+            return;
+        this.verifying.add(record.session.id);
+        this.update(record, { state: 'verifying', needsInput: false });
+        try {
+            const ok = record.rules.verifyAfterSuccess ? await this.verify(record.session.harnessId) : true;
+            if (isTerminalLoginState(record.session.state))
+                return;
+            if (ok)
+                this.finish(record, 'succeeded', 'Logged in.');
+            else
+                this.finish(record, 'failed', 'The login command finished, but the harness still reports it is not logged in.');
+        }
+        catch (error) {
+            if (!isTerminalLoginState(record.session.state)) {
+                this.finish(record, 'failed', `Could not confirm the login: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        finally {
+            this.verifying.delete(record.session.id);
+        }
+    }
+    /**
+     * Save a captured credential. Never logs it.
+     *
+     * @param record - Session record
+     * @param secret - The credential
+     */
+    storeSecret(record, secret) {
+        if (record.session.harnessId === HARNESS_CONSTANTS.IDS.CLAUDE_CODE) {
+            this.credentials.setClaudeOauthToken(secret);
+            try {
+                this.prepareClaudeConfig();
+            }
+            catch (error) {
+                this.logger.warn('Could not update Claude config after login', { error: error instanceof Error ? error.message : String(error) });
+            }
+        }
+        // Scrub the secret from the raw buffer now that it is stored.
+        record.raw = record.raw.split(secret).join(HARNESS_CONSTANTS.LOGIN.REDACTED);
+        this.logger.info('Harness credential stored', { sessionId: record.session.id, harnessId: record.session.harnessId });
+    }
+    /**
+     * The login command exited.
+     *
+     * @param record - Session record
+     * @param exitCode - Process exit code
+     */
+    async handleExit(record, exitCode) {
+        record.exited = true;
+        if (isTerminalLoginState(record.session.state))
+            return;
+        this.evaluate(record, true);
+        if (isTerminalLoginState(record.session.state) || this.verifying.has(record.session.id))
+            return;
+        if (record.rules.successOnExitZero && exitCode === 0) {
+            await this.confirm(record);
+            return;
+        }
+        this.finish(record, 'failed', record.session.message ?? `The login command exited (code ${exitCode}) before the login finished.`);
+    }
+    /**
+     * Move a session to a terminal state and release the PTY.
+     *
+     * @param record - Session record
+     * @param state - Terminal state
+     * @param message - Message for the user
+     */
+    finish(record, state, message) {
+        if (isTerminalLoginState(record.session.state))
+            return;
+        if (record.timer)
+            clearTimeout(record.timer);
+        record.timer = null;
+        record.finishedAt = this.now();
+        this.update(record, { state, message, needsInput: false });
+        if (record.pty && !record.exited) {
+            try {
+                record.pty.kill();
+            }
+            catch {
+                // Already gone.
+            }
+        }
+        this.logger.info('Login broker session finished', { sessionId: record.session.id, harnessId: record.session.harnessId, state });
+        const snapshot = { ...record.session };
+        record.resolveDone(snapshot);
+        this.emit(LOGIN_BROKER_EVENTS.FINISHED, snapshot);
+    }
+    /**
+     * Apply a patch, bump `updatedAt` and emit `update`.
+     *
+     * @param record - Session record
+     * @param patch - Fields to change
+     */
+    update(record, patch) {
+        record.session = { ...record.session, ...patch, updatedAt: new Date(this.now()).toISOString() };
+        this.emit(LOGIN_BROKER_EVENTS.UPDATE, { ...record.session });
+    }
+    /**
+     * Tail of the screen, secrets redacted.
+     *
+     * @param record - Session record
+     * @param text - Normalized text
+     * @returns Exposed screen text
+     */
+    exposedScreen(record, text) {
+        const redacted = redactSecrets(text, record.secrets);
+        const max = HARNESS_CONSTANTS.LOGIN.SCREEN_MAX_CHARS;
+        return redacted.length > max ? redacted.slice(redacted.length - max) : redacted;
+    }
+    /** Forget finished sessions older than the retention window. */
+    prune() {
+        const cutoff = this.now() - HARNESS_CONSTANTS.LOGIN.SESSION_RETENTION_MS;
+        for (const [id, record] of this.sessions) {
+            if (record.finishedAt !== null && record.finishedAt < cutoff)
+                this.sessions.delete(id);
+        }
+    }
+}
+//# sourceMappingURL=login-broker.service.js.map

package/dist/cli/backend/src/services/harness/login-broker.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-broker.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/login-broker.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,iCAAiC,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAA2B,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EACN,qBAAqB,EACrB,oBAAoB,GAMpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,uBAAuB,EAAE,aAAa,EAAqB,MAAM,kBAAkB,CAAC;AAiBhI,+FAA+F;AAC/F,MAAM,CAAC,MAAM,mBAAmB,GAAG;IAClC,8BAA8B;IAC9B,MAAM,EAAE,QAAQ;IAChB,yCAAyC;IACzC,QAAQ,EAAE,UAAU;CACX,CAAC;AAKX,iDAAiD;AACjD,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAMzB;IALjB;;;OAGG;IACH,YACiB,IAA0B,EAC1C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAsB;QAI1C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IAChC,CAAC;CACD;AAoCD;;;;;;;GAOG;AACH,MAAM,eAAe,GAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CACjE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;AAE/H,qEAAqE;AACrE,MAAM,OAAO,kBAAmB,SAAQ,YAAY;IAClC,QAAQ,CAAmB;IAC3B,cAAc,CAAsD;IACpE,GAAG,CAAoB;IACvB,OAAO,CAAS;IAChB,WAAW,CAA0B;IACrC,MAAM,CAA6C;IACnD,mBAAmB,CAAa;IAChC,GAAG,CAAe;IAClB,SAAS,CAAe;IACxB,MAAM,CAAgB;IACtB,SAAS,CAAS;IAClB,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7D,gDAAgD;IAC/B,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/C;;OAEG;IACH,YAAY,OAAwB,EAAE;QACrC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC;QACjD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,0BAA0B,EAAE,CAAC;QACpE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,iCAAiC,EAAE,CAAC,CAAC;QACxG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,qBAAqB,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC;IACvE,CAAC;IAED;;;;;;OAMG;IACH,QAAQ;QACP,MAAM,OAAO,GAAG,2BAA2B,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,KAAK,sBAAsB,CAAC,GAAG,CAAC,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC3F,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,GAAG,CAAC,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAC7D,GAAG,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC5B,OAAO,GAAG,CAAC;IACZ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,SAAiB,EAAE,MAAc;QACtC,MAAM,GAAG,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,oBAAoB,SAAS,EAAE,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9E,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,EAAE,GAAG,GAAG,CAAC,WAAW,YAAY,MAAM,6BAA6B,CAAC,CAAC;QACrH,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;QAEb,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,GAAG,GAAG,CAAC,WAAW,wBAAwB,SAAS,CAAC,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;QAChI,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAClD,IAAI,WAAW,GAAoC,GAAG,EAAE,CAAC,SAAS,CAAC;QACnE,MAAM,IAAI,GAAG,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,EAAE;YAClD,WAAW,GAAG,OAAO,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAkB;YAC7B,OAAO,EAAE;gBACR,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE;gBACpB,SAAS,EAAE,GAAG,CAAC,EAAE;gBACjB,MAAM,EAAE,MAAuB;gBAC/B,KAAK,EAAE,UAAU;gBACjB,GAAG,EAAE,IAAI;gBACT,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,KAAK;gBACjB,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,EAAE;gBACV,SAAS,EAAE,MAAM;gBACjB,SAAS,EAAE,MAAM;aACjB;YACD,KAAK;YACL,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,EAAE;YACP,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI;YAChB,IAAI;YACJ,WAAW;SACX,CAAC;QAEF,IAAI,CAAC;YACJ,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;gBAC9D,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ;gBACtC,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ;gBACtC,GAAG,EAAE,IAAI,CAAC,OAAO;gBACjB,GAAG;aACH,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,qBAAqB,SAAS,CAAC,MAAM,CAAC,OAAO,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1J,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;YAClC,KAAK,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,sCAAsC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1H,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9G,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED;;;;;;OAMG;IACH,GAAG,CAAC,SAAiB;QACpB,OAAO,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,SAAiB;QACjC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACzH,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,SAAiB,EAAE,IAAY;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAChF,MAAM,IAAI,gBAAgB,CAAC,YAAY,EAAE,iCAAiC,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,SAAiB;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtG,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QAC7E,OAAO,MAAM,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,8DAA8D;IAC9D,QAAQ;QACP,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,2CAA2C,CAAC,CAAC;QAChI,CAAC;IACF,CAAC;IAED;;;;;;OAMG;IACK,aAAa,CAAC,SAAiB;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,4BAA4B,SAAS,EAAE,CAAC,CAAC;QAC9F,OAAO,MAAM,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACK,UAAU,CAAC,MAAqB,EAAE,IAAY;QACrD,IAAI,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO;QACvD,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC;QACnB,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,oBAAoB,CAAC;QACzD,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACrC,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACK,QAAQ,CAAC,MAAqB,EAAE,KAAc;QACrD,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,uBAAuB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAChF,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE9F,MAAM,KAAK,GAA0B;YACpC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG;YACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ;YACnD,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;SAC/C,CAAC;QAEF,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC3B,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACzC,OAAO;QACR,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBACtB,iDAAiD;gBACjD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;iBAAM,CAAC;gBACP,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;YACrD,CAAC;YACD,OAAO;QACR,CAAC;QACD,IAAI,KAAK,GAAsB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QACpD,IAAI,KAAK,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC;YAAE,KAAK,GAAG,eAAe,CAAC;QACvG,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,UAAU;YAAE,KAAK,GAAG,eAAe,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,QAAQ,CAAC,MAAqB,EAAE,MAAqB;QAClE,IAAI,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO;QACvD,IAAI,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,IAAI,CAAC;gBACJ,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,sDAAsD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC9I,OAAO;YACR,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,mDAAmD,CAAC,CAAC;YACtF,OAAO;QACR,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,OAAO,CAAC,MAAqB;QAC1C,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO;QAChG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC;YACJ,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChG,IAAI,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO;YACvD,IAAI,EAAE;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;;gBAClD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,gFAAgF,CAAC,CAAC;QACtH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzH,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1C,CAAC;IACF,CAAC;IAED;;;;;OAKG;IACK,WAAW,CAAC,MAAqB,EAAE,MAAc;QACxD,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,KAAK,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACpE,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC;gBACJ,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnI,CAAC;QACF,CAAC;QACD,8DAA8D;QAC9D,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACtH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,UAAU,CAAC,MAAqB,EAAE,QAAgB;QAC/D,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,IAAI,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO;QACvD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,IAAI,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAAE,OAAO;QAChG,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO;QACR,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,kCAAkC,QAAQ,8BAA8B,CAAC,CAAC;IACnI,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,MAAqB,EAAE,KAAwB,EAAE,OAAe;QAC9E,IAAI,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO;QACvD,IAAI,MAAM,CAAC,KAAK;YAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,CAAC;gBACJ,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACR,gBAAgB;YACjB,CAAC;QACF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAChI,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,MAAqB,EAAE,KAA4B;QACjE,MAAM,CAAC,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAChG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IACK,aAAa,CAAC,MAAqB,EAAE,IAAY;QACxD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACrD,OAAO,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjF,CAAC;IAED,gEAAgE;IACxD,KAAK;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,oBAAoB,CAAC;QACzE,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,GAAG,MAAM;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;IACF,CAAC;CACD"}

package/dist/cli/backend/src/services/harness/login-rules.d.ts

@@ -0,0 +1,162 @@
+/**
+ * Login rules — per-harness patterns the login broker applies to terminal text.
+ *
+ * The broker runs a harness's own login command in a PTY and learns what is
+ * happening purely from the screen: the sign-in URL, a one-time code, a
+ * "paste the code" prompt, success and failure. Nothing here talks to a
+ * harness API.
+ *
+ * Terminal text is messy, so it is normalized first:
+ * - ANSI/OSC escapes are removed; OSC 8 hyperlink targets are kept as URL
+ *   candidates; cursor-forward (`CSI n C`) and cursor-to-column (`CSI n G`)
+ *   become spaces, which restores the gaps TUIs draw between words.
+ * - TUIs such as Claude Code's may render words without spaces, so prompt,
+ *   success and failure patterns are matched against both the normalized text
+ *   and a copy with all spaces removed (patterns use `\s*` between words).
+ * - A URL (or token) that a TUI wrapped at the terminal width continues on
+ *   the next line(s); {@link extractWrappedRuns} joins those back.
+ *
+ * Values are only accepted once they are complete — followed by more output —
+ * so a URL that arrives split across two PTY chunks is never exposed half-way.
+ *
+ * Rule sets are built from real output captured on 2026-09-25 (Claude Code
+ * 2.1.282 `claude setup-token`, codex-cli 0.156.1 `codex login --device-auth`);
+ * see login-rules.test.ts.
+ *
+ * @module services/harness/login-rules
+ */
+import type { HarnessId, LoginMethodId } from './harness.types.js';
+/** Normalized terminal text. */
+export interface NormalizedScreen {
+    /** Text with escapes removed, `\n` line breaks, trailing spaces trimmed */
+    text: string;
+    /** `text` with every space and tab removed (for TUIs that drop spaces) */
+    spaceless: string;
+    /** Targets of OSC 8 hyperlinks seen in the raw output */
+    hyperlinks: string[];
+}
+/** Patterns for one harness login method. */
+export interface LoginRuleSet {
+    harnessId: HarnessId;
+    method: LoginMethodId;
+    /** A URL candidate is the sign-in URL when this matches it */
+    urlPattern: RegExp;
+    /** Capture group 1 is the one-time code the user types elsewhere */
+    userCodePattern?: RegExp;
+    /** The harness is waiting for the user to type/paste something */
+    inputPromptPattern?: RegExp;
+    /** Success text */
+    successPattern?: RegExp;
+    /** Any match fails the login; the matched line becomes the message */
+    failurePatterns: readonly RegExp[];
+    /** A credential the harness prints on success (group 0), e.g. Claude's long-lived token */
+    secretPattern?: RegExp;
+    /** Success needs the secret: the harness does not store it itself (Claude setup-token) */
+    successRequiresSecret: boolean;
+    /** Exit code 0 counts as success (Codex writes its own credentials) */
+    successOnExitZero: boolean;
+    /** Confirm success with the harness's own status command before reporting it */
+    verifyAfterSuccess: boolean;
+}
+/** What the rules found on the screen. */
+export interface LoginRuleMatch {
+    url: string | null;
+    userCode: string | null;
+    needsInput: boolean;
+    succeeded: boolean;
+    /** Line that matched a failure pattern */
+    failureMessage: string | null;
+    /** Captured credential — never log or expose it */
+    secret: string | null;
+}
+/**
+ * Patterns that look like credentials. Screen text exposed to front ends has
+ * every match replaced with {@link HARNESS_CONSTANTS.LOGIN.REDACTED}.
+ */
+export declare const SECRET_PATTERNS: readonly RegExp[];
+/**
+ * Normalize raw PTY output for rule matching.
+ *
+ * @param raw - Raw bytes from the PTY, as a string
+ * @returns Normalized text, a spaceless copy and OSC 8 hyperlink targets
+ *
+ * @example
+ * ```ts
+ * normalizeTerminalOutput('\x1b[1mPaste\x1b[1Ccode\x1b[0m\r\n').text; // 'Paste code\n'
+ * ```
+ */
+export declare function normalizeTerminalOutput(raw: string): NormalizedScreen;
+/**
+ * Find runs (URLs, tokens) and join the ones a TUI wrapped across lines.
+ *
+ * A run that reaches the end of a line at least `minWrappedLineLength` long
+ * continues on the next line when that line consists only of continuation
+ * characters. Joining stops at the first line that is shorter than the
+ * minimum (the last piece of a wrapped run) or that is not a continuation.
+ *
+ * A run is only returned when it is complete: it ends before the end of its
+ * line, or a non-empty line follows it. A run still being written at the end
+ * of the buffer (possibly continued by the next PTY chunk) is skipped — unless
+ * `final` is set because the process has exited.
+ *
+ * @param text - Normalized text
+ * @param runPattern - Pattern matching a run on one line (the `g` flag is added)
+ * @param continuation - Pattern a whole continuation line must match
+ * @param options - `minWrappedLineLength` (Infinity disables joining), `final` (no more output will come)
+ * @returns Complete runs, in order of appearance
+ *
+ * @example
+ * ```ts
+ * extractWrappedRuns('https://x.io/' + 'a'.repeat(40) + '\nbcd\nnext line\n', /https:\/\/\S+/, /^[a-z]+$/);
+ * // ['https://x.io/aaaa…abcd']
+ * ```
+ */
+export declare function extractWrappedRuns(text: string, runPattern: RegExp, continuation: RegExp, options?: {
+    minWrappedLineLength?: number;
+    final?: boolean;
+}): string[];
+/**
+ * All complete URLs on the screen (wrapped ones joined), plus hyperlink targets.
+ *
+ * @param screen - Normalized screen
+ * @param final - The process has exited: accept runs at the end of the buffer
+ * @returns URL candidates
+ */
+export declare function extractUrlCandidates(screen: NormalizedScreen, final?: boolean): string[];
+/**
+ * Apply a rule set to the screen.
+ *
+ * @param rules - Rule set for the harness login method
+ * @param screen - Whole session screen, normalized
+ * @param options - `promptScreen`: screen since the user's last input (input prompt and failures are read
+ *   from it; defaults to `screen`); `final`: the process has exited
+ * @returns What was found
+ */
+export declare function evaluateLoginRules(rules: LoginRuleSet, screen: NormalizedScreen, options?: {
+    promptScreen?: NormalizedScreen;
+    final?: boolean;
+}): LoginRuleMatch;
+/**
+ * Replace anything that looks like a credential with a placeholder.
+ *
+ * Besides {@link SECRET_PATTERNS}, every known secret is removed — including
+ * the pieces of one a TUI wrapped over several lines.
+ *
+ * @param text - Text to redact
+ * @param knownSecrets - Secrets captured in this session
+ * @returns Redacted text
+ */
+export declare function redactSecrets(text: string, knownSecrets?: readonly string[]): string;
+/** Claude Code `claude setup-token` (subscription login). */
+export declare const CLAUDE_SETUP_TOKEN_RULES: LoginRuleSet;
+/** Codex `codex login --device-auth` (ChatGPT device-code login). */
+export declare const CODEX_DEVICE_AUTH_RULES: LoginRuleSet;
+/**
+ * The rule set for a harness login method.
+ *
+ * @param harnessId - Harness id
+ * @param method - Login method id
+ * @returns The rule set, or undefined when the method is not brokered
+ */
+export declare function getLoginRules(harnessId: string, method: string): LoginRuleSet | undefined;
+//# sourceMappingURL=login-rules.d.ts.map