@amaretto-software-labs/borealis-cli 0.1.0

package/dist/output.d.ts

@@ -0,0 +1 @@
+export declare function writeResult(result: unknown, json: boolean): void;

package/dist/output.js

@@ -0,0 +1,32 @@
+export function writeResult(result, json) {
+    if (result instanceof Uint8Array) {
+        process.stdout.write(Buffer.from(result));
+        return;
+    }
+    if (json) {
+        process.stdout.write(`${JSON.stringify(result)}\n`);
+        return;
+    }
+    if (Array.isArray(result)) {
+        for (const item of result)
+            process.stdout.write(`${formatItem(item)}\n`);
+        return;
+    }
+    if (result &&
+        typeof result === "object" &&
+        Array.isArray(result.items)) {
+        for (const item of result.items)
+            process.stdout.write(`${formatItem(item)}\n`);
+        return;
+    }
+    process.stdout.write(`${typeof result === "string" ? result : JSON.stringify(result, null, 2)}\n`);
+}
+function formatItem(value) {
+    if (!value || typeof value !== "object")
+        return String(value);
+    return Object.values(value)
+        .filter((item) => typeof item !== "object")
+        .slice(0, 5)
+        .join("\t");
+}
+//# sourceMappingURL=output.js.map

package/dist/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,WAAW,CAAC,MAAe,EAAE,IAAa;IACxD,IAAI,MAAM,YAAY,UAAU,EAAE,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IACD,IACE,MAAM;QACN,OAAO,MAAM,KAAK,QAAQ;QAC1B,KAAK,CAAC,OAAO,CAAE,MAAgC,CAAC,KAAK,CAAC,EACtD,CAAC;QACD,KAAK,MAAM,IAAI,IAAK,MAA+B,CAAC,KAAK;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC7E,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;SACnD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;SAC1C,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/secret-file.d.ts

@@ -0,0 +1 @@
+export declare function readOwnerOnlySecretFile(path: string): Promise<string>;

package/dist/secret-file.js

@@ -0,0 +1,19 @@
+import { lstat, readFile } from "node:fs/promises";
+export async function readOwnerOnlySecretFile(path) {
+    const metadata = await lstat(path);
+    if (!metadata.isFile() || metadata.isSymbolicLink())
+        throw new Error(`Secret file '${path}' must be a regular file, not a symlink.`);
+    if (metadata.size > 65_536)
+        throw new Error(`Secret file '${path}' exceeds 64 KiB.`);
+    if (process.platform !== "win32") {
+        if ((metadata.mode & 0o077) !== 0)
+            throw new Error(`Secret file '${path}' must not be readable or writable by group or other users.`);
+        if (process.getuid && metadata.uid !== process.getuid())
+            throw new Error(`Secret file '${path}' must be owned by the current user.`);
+    }
+    const value = (await readFile(path, "utf8")).trim();
+    if (!value)
+        throw new Error(`Secret file '${path}' is empty.`);
+    return value;
+}
+//# sourceMappingURL=secret-file.js.map

package/dist/secret-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-file.js","sourceRoot":"","sources":["../src/secret-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY;IACxD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE;QACjD,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,0CAA0C,CAC/D,CAAC;IACJ,IAAI,QAAQ,CAAC,IAAI,GAAG,MAAM;QACxB,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,mBAAmB,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,6DAA6D,CAClF,CAAC;QACJ,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE;YACrD,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,sCAAsC,CAC3D,CAAC;IACN,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,aAAa,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/session-store.d.ts

@@ -0,0 +1,54 @@
+import { type Session } from "./types.js";
+export interface NativeCommandOptions {
+    env?: NodeJS.ProcessEnv;
+    input?: string;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}
+export type NativeCommandExecutor = (file: string, arguments_: readonly string[], options?: NativeCommandOptions) => Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+export declare const executeBoundedNativeCommand: NativeCommandExecutor;
+export type CredentialFileDescriptorExecutor = (file: string, arguments_: readonly string[], program: string, secret: string, signal?: AbortSignal) => Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+export interface SessionSecretStore {
+    read(signal?: AbortSignal): Promise<string | undefined>;
+    write(value: string, signal?: AbortSignal): Promise<void>;
+    clear(signal?: AbortSignal): Promise<void>;
+}
+export declare class NativeSessionSecretStore implements SessionSecretStore {
+    private readonly account;
+    private readonly platform;
+    private readonly encryptedPath;
+    private readonly execute;
+    constructor(account: string, platform?: NodeJS.Platform, encryptedPath?: string, execute?: NativeCommandExecutor);
+    read(signal?: AbortSignal): Promise<string | undefined>;
+    write(value: string, signal?: AbortSignal): Promise<void>;
+    clear(signal?: AbortSignal): Promise<void>;
+    private powerShell;
+}
+export declare class FileSessionSecretStore implements SessionSecretStore {
+    private readonly path;
+    constructor(path: string);
+    read(signal?: AbortSignal): Promise<string | undefined>;
+    write(value: string, signal?: AbortSignal): Promise<void>;
+    clear(signal?: AbortSignal): Promise<void>;
+}
+export declare class SecureFallbackSessionSecretStore implements SessionSecretStore {
+    private readonly secure;
+    private readonly insecure;
+    private readonly allowInsecure;
+    constructor(secure: SessionSecretStore, insecure: SessionSecretStore, allowInsecure?: () => boolean);
+    read(signal?: AbortSignal): Promise<string | undefined>;
+    write(value: string, signal?: AbortSignal): Promise<void>;
+    clear(signal?: AbortSignal): Promise<void>;
+}
+export declare function loadSession(profile: string, signal?: AbortSignal): Promise<Session | undefined>;
+export declare function saveSession(profile: string, session: Session, signal?: AbortSignal): Promise<void>;
+export declare function deleteSession(profile: string, signal?: AbortSignal): Promise<void>;
+export declare function writeMacOSKeychainCredential(serviceName: string, account: string, secret: string, execute?: CredentialFileDescriptorExecutor, signal?: AbortSignal): Promise<void>;
+export declare function readMacOSKeychainCredential(serviceName: string, account: string, execute?: CredentialFileDescriptorExecutor, signal?: AbortSignal): Promise<string | null>;
+export declare function deleteMacOSKeychainCredential(serviceName: string, account: string, execute?: CredentialFileDescriptorExecutor, signal?: AbortSignal): Promise<void>;

package/dist/session-store.js

@@ -0,0 +1,470 @@
+import { spawn } from "node:child_process";
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { configDirectory } from "./config.js";
+import { sessionSchema } from "./types.js";
+const service = "com.amarettosoftwarelabs.borealis-cli";
+const profilePattern = /^[A-Za-z0-9._-]{1,64}$/;
+const insecureFileOptIn = "BOREALIS_CLI_ALLOW_INSECURE_FILE_SESSION";
+function terminateProcessTree(child, platform = process.platform) {
+    if (!child.pid) {
+        child.kill("SIGKILL");
+        return;
+    }
+    if (platform === "win32") {
+        const killer = spawn("taskkill.exe", ["/pid", String(child.pid), "/t", "/f"], { stdio: "ignore", windowsHide: true });
+        killer.once("error", () => child.kill("SIGKILL"));
+        killer.unref();
+        return;
+    }
+    try {
+        process.kill(-child.pid, "SIGKILL");
+    }
+    catch {
+        child.kill("SIGKILL");
+    }
+}
+export const executeBoundedNativeCommand = async (file, arguments_, options = {}) => {
+    options.signal?.throwIfAborted();
+    return await new Promise((resolvePromise, reject) => {
+        const child = spawn(file, arguments_, {
+            detached: true,
+            env: options.env,
+            stdio: ["pipe", "pipe", "pipe"],
+            windowsHide: true,
+        });
+        let settled = false;
+        let outputBytes = 0;
+        const stdout = [];
+        const stderr = [];
+        const cleanup = () => {
+            clearTimeout(timeout);
+            options.signal?.removeEventListener("abort", onAbort);
+        };
+        const finish = (error, terminate = true) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            if (error) {
+                if (terminate)
+                    terminateProcessTree(child);
+                reject(error);
+            }
+            else {
+                resolvePromise({
+                    stdout: Buffer.concat(stdout).toString("utf8"),
+                    stderr: Buffer.concat(stderr).toString("utf8"),
+                });
+            }
+        };
+        const onAbort = () => finish(options.signal?.reason instanceof Error
+            ? options.signal.reason
+            : new DOMException("Aborted", "AbortError"));
+        const timeout = setTimeout(() => finish(new DOMException(`'${file}' timed out.`, "TimeoutError")), options.timeoutMs ?? 15_000);
+        timeout.unref();
+        const trackOutput = (target) => (chunk) => {
+            outputBytes += chunk.length;
+            if (outputBytes > 1024 * 1024)
+                finish(new Error(`'${file}' produced too much output.`));
+            else
+                target.push(chunk);
+        };
+        child.stdout?.on("data", trackOutput(stdout));
+        child.stderr?.on("data", trackOutput(stderr));
+        child.stdin?.once("error", (error) => finish(error));
+        child.once("error", (error) => finish(error, false));
+        child.once("close", (code) => {
+            if (code === 0) {
+                finish();
+                return;
+            }
+            const error = new Error(`'${file}' exited with status ${code ?? -1}.`);
+            error.code = code ?? -1;
+            error.stderr = Buffer.concat(stderr).toString("utf8");
+            finish(error, false);
+        });
+        options.signal?.addEventListener("abort", onAbort, { once: true });
+        if (options.signal?.aborted) {
+            onAbort();
+            return;
+        }
+        child.stdin?.end(options.input ?? "");
+    });
+};
+const macOSCredentialProgram = String.raw `ObjC.import("Foundation");
+ObjC.import("Security");
+
+function run(argv) {
+  if (argv.length !== 3) throw new Error("Expected operation, service, and account.");
+  const operation = argv[0];
+  const value = (item) => $.NSString.stringWithString(item);
+  const constant = (item) => ObjC.castRefToObject(item);
+  const query = $.NSMutableDictionary.alloc.init;
+  query.setObjectForKey(constant($.kSecClassGenericPassword), constant($.kSecClass));
+  query.setObjectForKey(value(argv[1]), constant($.kSecAttrService));
+  query.setObjectForKey(value(argv[2]), constant($.kSecAttrAccount));
+
+  if (operation === "get") {
+    query.setObjectForKey($.NSNumber.numberWithBool(true), constant($.kSecReturnData));
+    query.setObjectForKey(constant($.kSecMatchLimitOne), constant($.kSecMatchLimit));
+    const result = Ref();
+    const status = Number($.SecItemCopyMatching(query, result));
+    if (status === Number($.errSecItemNotFound)) return "missing";
+    if (status !== Number($.errSecSuccess))
+      throw new Error("Keychain read failed with status " + status + ".");
+    const secretData = ObjC.castRefToObject(result[0]);
+    return "value:" + ObjC.unwrap(secretData.base64EncodedStringWithOptions(0));
+  }
+
+  if (operation === "delete") {
+    const status = Number($.SecItemDelete(query));
+    if (status !== Number($.errSecSuccess) && status !== Number($.errSecItemNotFound))
+      throw new Error("Keychain deletion failed with status " + status + ".");
+    return "deleted";
+  }
+
+  if (operation !== "set") throw new Error("Unsupported Keychain operation.");
+  const secretHandle = $.NSFileHandle.alloc.initWithFileDescriptorCloseOnDealloc(3, false);
+  const secretData = secretHandle.readDataToEndOfFile;
+  if (Number(secretData.length) === 0) throw new Error("Credential data is empty.");
+  const attributes = $.NSMutableDictionary.alloc.init;
+  attributes.setObjectForKey(secretData, constant($.kSecValueData));
+  let status = Number($.SecItemUpdate(query, attributes));
+  if (status === Number($.errSecItemNotFound)) {
+    query.setObjectForKey(secretData, constant($.kSecValueData));
+    status = Number($.SecItemAdd(query, null));
+  }
+  if (status !== Number($.errSecSuccess))
+    throw new Error("Keychain write failed with status " + status + ".");
+  return "stored";
+}
+`;
+const executeCredentialFileDescriptorCommand = async (file, arguments_, program, secret, signal) => {
+    signal?.throwIfAborted();
+    return await new Promise((resolvePromise, reject) => {
+        const child = spawn(file, arguments_, {
+            detached: true,
+            stdio: ["pipe", "pipe", "pipe", "pipe"],
+        });
+        let settled = false;
+        let outputBytes = 0;
+        const stdout = [];
+        const stderr = [];
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeout);
+            signal?.removeEventListener("abort", onAbort);
+            if (error) {
+                try {
+                    if (child.pid)
+                        process.kill(-child.pid, "SIGKILL");
+                    else
+                        child.kill("SIGKILL");
+                }
+                catch {
+                    child.kill("SIGKILL");
+                }
+                reject(error);
+            }
+            else {
+                resolvePromise({
+                    stdout: Buffer.concat(stdout).toString("utf8"),
+                    stderr: Buffer.concat(stderr).toString("utf8"),
+                });
+            }
+        };
+        const timeout = setTimeout(() => finish(new Error(`'${file}' timed out.`)), 15_000);
+        timeout.unref();
+        const onAbort = () => finish(signal?.reason instanceof Error
+            ? signal.reason
+            : new DOMException("Aborted", "AbortError"));
+        const trackOutput = (target) => (chunk) => {
+            outputBytes += chunk.length;
+            if (outputBytes > 64 * 1024)
+                finish(new Error(`'${file}' produced too much output.`));
+            else
+                target.push(chunk);
+        };
+        child.stdout?.on("data", trackOutput(stdout));
+        child.stderr?.on("data", trackOutput(stderr));
+        child.once("error", finish);
+        child.once("close", (code) => code === 0
+            ? finish()
+            : finish(new Error(`'${file}' exited with status ${code ?? -1}.`)));
+        signal?.addEventListener("abort", onAbort, { once: true });
+        if (signal?.aborted) {
+            onAbort();
+            return;
+        }
+        const secretPipe = child.stdio[3];
+        if (!child.stdin || !secretPipe) {
+            finish(new Error("Unable to open credential process pipes."));
+            return;
+        }
+        child.stdin.once("error", finish);
+        secretPipe.once("error", finish);
+        child.stdin.end(program);
+        secretPipe.end(secret);
+    });
+};
+export class NativeSessionSecretStore {
+    account;
+    platform;
+    encryptedPath;
+    execute;
+    constructor(account, platform = process.platform, encryptedPath = join(configDirectory, `${account.replace(/[^A-Za-z0-9._-]/g, "_")}.session.dpapi`), execute = executeBoundedNativeCommand) {
+        this.account = account;
+        this.platform = platform;
+        this.encryptedPath = encryptedPath;
+        this.execute = execute;
+    }
+    async read(signal) {
+        signal?.throwIfAborted();
+        try {
+            if (this.platform === "darwin") {
+                return ((await readMacOSKeychainCredential(service, this.account, executeCredentialFileDescriptorCommand, signal)) ?? undefined);
+            }
+            if (this.platform === "linux") {
+                const { stdout } = await this.execute("secret-tool", ["lookup", "service", service, "account", this.account], { ...(signal ? { signal } : {}) });
+                return stdout.replace(/\r?\n$/, "") || undefined;
+            }
+            if (this.platform === "win32") {
+                const { stdout } = await this.powerShell(`
+Add-Type -AssemblyName System.Security
+if (-not [IO.File]::Exists($env:BOREALIS_CLI_SECRET_PATH)) { exit 44 }
+$raw = [IO.File]::ReadAllText($env:BOREALIS_CLI_SECRET_PATH)
+$protected = [Convert]::FromBase64String($raw)
+$bytes = [Security.Cryptography.ProtectedData]::Unprotect($protected, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser)
+[Console]::Out.Write([Text.Encoding]::UTF8.GetString($bytes))
+`, {}, signal);
+                return stdout || undefined;
+            }
+            return undefined;
+        }
+        catch (error) {
+            if (signal?.aborted)
+                throw signal.reason;
+            if (this.platform === "linux" && isMissingLinuxSecret(error))
+                return undefined;
+            if (this.platform === "win32" && isMissingWindowsSecret(error))
+                return undefined;
+            throw error;
+        }
+    }
+    async write(value, signal) {
+        signal?.throwIfAborted();
+        try {
+            if (this.platform === "darwin") {
+                await writeMacOSKeychainCredential(service, this.account, value, executeCredentialFileDescriptorCommand, signal);
+                return;
+            }
+            if (this.platform === "linux") {
+                await this.execute("secret-tool", [
+                    "store",
+                    "--label",
+                    "Borealis CLI auth session",
+                    "service",
+                    service,
+                    "account",
+                    this.account,
+                ], { input: value, ...(signal ? { signal } : {}) });
+                return;
+            }
+            if (this.platform === "win32") {
+                await mkdir(configDirectory, { recursive: true });
+                await this.powerShell(`
+Add-Type -AssemblyName System.Security
+$bytes = [Text.Encoding]::UTF8.GetBytes($env:BOREALIS_CLI_SECRET_VALUE)
+$protected = [Security.Cryptography.ProtectedData]::Protect($bytes, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser)
+[IO.File]::WriteAllText($env:BOREALIS_CLI_SECRET_PATH, [Convert]::ToBase64String($protected))
+          `, { BOREALIS_CLI_SECRET_VALUE: value }, signal);
+                return;
+            }
+            throw new Error(`Unsupported platform '${this.platform}'.`);
+        }
+        catch (error) {
+            if (signal?.aborted)
+                throw signal.reason;
+            throw new Error(`Native Borealis CLI credential storage is unavailable.${error instanceof Error && error.message ? ` ${error.message}` : ""}`);
+        }
+    }
+    async clear(signal) {
+        signal?.throwIfAborted();
+        try {
+            if (this.platform === "darwin")
+                await deleteMacOSKeychainCredential(service, this.account, executeCredentialFileDescriptorCommand, signal);
+            else if (this.platform === "linux")
+                await this.execute("secret-tool", ["clear", "service", service, "account", this.account], { ...(signal ? { signal } : {}) });
+            else if (this.platform === "win32") {
+                await rm(this.encryptedPath, { force: true });
+                signal?.throwIfAborted();
+            }
+        }
+        catch (error) {
+            if (signal?.aborted)
+                throw signal.reason;
+            if (this.platform === "linux" && isMissingLinuxSecret(error))
+                return;
+            throw error;
+        }
+    }
+    async powerShell(script, environment = {}, signal) {
+        return await this.execute("powershell.exe", [
+            "-NoProfile",
+            "-NonInteractive",
+            "-ExecutionPolicy",
+            "Bypass",
+            "-Command",
+            script,
+        ], {
+            env: {
+                ...process.env,
+                BOREALIS_CLI_SECRET_PATH: resolve(this.encryptedPath),
+                ...environment,
+            },
+            ...(signal ? { signal } : {}),
+        });
+    }
+}
+function isMissingLinuxSecret(error) {
+    const failure = error;
+    return failure.code === 1 && !failure.stderr?.trim();
+}
+function isMissingWindowsSecret(error) {
+    return error.code === 44;
+}
+export class FileSessionSecretStore {
+    path;
+    constructor(path) {
+        this.path = path;
+    }
+    async read(signal) {
+        signal?.throwIfAborted();
+        const value = await readFile(this.path, "utf8").catch(() => undefined);
+        signal?.throwIfAborted();
+        return value;
+    }
+    async write(value, signal) {
+        signal?.throwIfAborted();
+        await mkdir(configDirectory, { recursive: true, mode: 0o700 });
+        if (process.platform !== "win32")
+            await chmod(configDirectory, 0o700);
+        await writeFile(this.path, value, { mode: 0o600, flag: "w" });
+        if (process.platform !== "win32")
+            await chmod(this.path, 0o600);
+        signal?.throwIfAborted();
+    }
+    async clear(signal) {
+        signal?.throwIfAborted();
+        await rm(this.path, { force: true });
+        signal?.throwIfAborted();
+    }
+}
+export class SecureFallbackSessionSecretStore {
+    secure;
+    insecure;
+    allowInsecure;
+    constructor(secure, insecure, allowInsecure = () => process.env[insecureFileOptIn] === "1") {
+        this.secure = secure;
+        this.insecure = insecure;
+        this.allowInsecure = allowInsecure;
+    }
+    async read(signal) {
+        try {
+            const value = await this.secure.read(signal);
+            if (value)
+                return value;
+        }
+        catch (error) {
+            if (signal?.aborted)
+                throw error;
+            if (error instanceof DOMException && error.name === "TimeoutError")
+                throw error;
+            // A missing platform keychain is treated as no stored session.
+        }
+        return this.allowInsecure() ? await this.insecure.read(signal) : undefined;
+    }
+    async write(value, signal) {
+        try {
+            await this.secure.write(value, signal);
+            await this.insecure.clear(signal);
+            return;
+        }
+        catch (error) {
+            if (signal?.aborted)
+                throw error;
+            if (!this.allowInsecure())
+                throw new Error(`Secure Borealis CLI credential storage is unavailable. Install platform keychain support, or explicitly set ${insecureFileOptIn}=1 to opt in to plaintext local session storage.`, { cause: error });
+        }
+        await this.insecure.write(value, signal);
+    }
+    async clear(signal) {
+        let secureFailure;
+        try {
+            await this.secure.clear(signal);
+        }
+        catch (error) {
+            if (signal?.aborted)
+                throw error;
+            secureFailure = error;
+        }
+        let insecureFailure;
+        try {
+            await this.insecure.clear(signal);
+        }
+        catch (error) {
+            if (signal?.aborted)
+                throw error;
+            insecureFailure = error;
+        }
+        if (secureFailure && insecureFailure)
+            throw new AggregateError([secureFailure, insecureFailure], "Secure and fallback session deletion both failed.");
+        if (secureFailure)
+            throw secureFailure;
+        if (insecureFailure)
+            throw insecureFailure;
+    }
+}
+function validateProfile(profile) {
+    if (!profilePattern.test(profile))
+        throw new Error("Profile names may contain only 1-64 letters, digits, dots, underscores, or hyphens.");
+}
+function sessionStore(profile) {
+    const account = `auth-session:${profile}`;
+    return new SecureFallbackSessionSecretStore(new NativeSessionSecretStore(account), new FileSessionSecretStore(join(configDirectory, `${profile}.json`)));
+}
+export async function loadSession(profile, signal) {
+    validateProfile(profile);
+    const stored = await sessionStore(profile).read(signal);
+    return stored ? sessionSchema.parse(JSON.parse(stored)) : undefined;
+}
+export async function saveSession(profile, session, signal) {
+    validateProfile(profile);
+    await sessionStore(profile).write(JSON.stringify(session), signal);
+}
+export async function deleteSession(profile, signal) {
+    validateProfile(profile);
+    await sessionStore(profile).clear(signal);
+}
+export async function writeMacOSKeychainCredential(serviceName, account, secret, execute = executeCredentialFileDescriptorCommand, signal) {
+    await executeMacOSKeychainCredential("set", serviceName, account, secret, execute, signal);
+}
+export async function readMacOSKeychainCredential(serviceName, account, execute = executeCredentialFileDescriptorCommand, signal) {
+    const value = await executeMacOSKeychainCredential("get", serviceName, account, "", execute, signal);
+    if (value === "missing")
+        return null;
+    if (!value.startsWith("value:"))
+        throw new Error("Keychain returned an invalid response.");
+    return Buffer.from(value.slice("value:".length), "base64").toString("utf8");
+}
+export async function deleteMacOSKeychainCredential(serviceName, account, execute = executeCredentialFileDescriptorCommand, signal) {
+    await executeMacOSKeychainCredential("delete", serviceName, account, "", execute, signal);
+}
+async function executeMacOSKeychainCredential(operation, serviceName, account, secret, execute, signal) {
+    const result = await execute("/usr/bin/osascript", ["-l", "JavaScript", "-", operation, serviceName, account], macOSCredentialProgram, secret, signal);
+    return result.stdout.replace(/\r?\n$/, "");
+}
+//# sourceMappingURL=session-store.js.map

package/dist/session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.js","sourceRoot":"","sources":["../src/session-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAgB,MAAM,YAAY,CAAC;AAEzD,MAAM,OAAO,GAAG,uCAAuC,CAAC;AACxD,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAChD,MAAM,iBAAiB,GAAG,0CAA0C,CAAC;AAerE,SAAS,oBAAoB,CAC3B,KAA+B,EAC/B,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,KAAK,CAClB,cAAc,EACd,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EACvC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CACvC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,2BAA2B,GAA0B,KAAK,EACrE,IAAI,EACJ,UAAU,EACV,OAAO,GAAG,EAAE,EACZ,EAAE;IACF,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;IACjC,OAAO,MAAM,IAAI,OAAO,CACtB,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE;YACpC,QAAQ,EAAE,IAAI;YACd,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,SAAS,GAAG,IAAI,EAAQ,EAAE;YACvD,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,SAAS;oBAAE,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBAC3C,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC;oBACb,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;iBAC/C,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAS,EAAE,CACzB,MAAM,CACJ,OAAO,CAAC,MAAM,EAAE,MAAM,YAAY,KAAK;YACrC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM;YACvB,CAAC,CAAC,IAAI,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAC9C,CAAC;QACJ,MAAM,OAAO,GAAG,UAAU,CACxB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,IAAI,IAAI,cAAc,EAAE,cAAc,CAAC,CAAC,EACtE,OAAO,CAAC,SAAS,IAAI,MAAM,CAC5B,CAAC;QACF,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,WAAW,GAAG,CAAC,MAAgB,EAAE,EAAE,CAAC,CAAC,KAAa,EAAE,EAAE;YAC1D,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;YAC5B,IAAI,WAAW,GAAG,IAAI,GAAG,IAAI;gBAC3B,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,6BAA6B,CAAC,CAAC,CAAC;;gBACtD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3B,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,MAAM,EAAE,CAAC;gBACT,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,IAAI,IAAI,wBAAwB,IAAI,IAAI,CAAC,CAAC,GAAG,CACS,CAAC;YACzD,KAAK,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;YACxB,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC5B,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AAUF,MAAM,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CxC,CAAC;AAEF,MAAM,sCAAsC,GAC1C,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IAClD,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,OAAO,MAAM,IAAI,OAAO,CACtB,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE;YACpC,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SACxC,CAAC,CAAC;QACH,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC;oBACH,IAAI,KAAK,CAAC,GAAG;wBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;;wBAC9C,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC;oBACb,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;iBAC/C,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,UAAU,CACxB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,cAAc,CAAC,CAAC,EAC/C,MAAM,CACP,CAAC;QACF,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,GAAS,EAAE,CACzB,MAAM,CACJ,MAAM,EAAE,MAAM,YAAY,KAAK;YAC7B,CAAC,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,IAAI,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAC9C,CAAC;QACJ,MAAM,WAAW,GAAG,CAAC,MAAgB,EAAE,EAAE,CAAC,CAAC,KAAa,EAAE,EAAE;YAC1D,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;YAC5B,IAAI,WAAW,GAAG,EAAE,GAAG,IAAI;gBACzB,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,6BAA6B,CAAC,CAAC,CAAC;;gBACtD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3B,IAAI,KAAK,CAAC;YACR,CAAC,CAAC,MAAM,EAAE;YACV,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,wBAAwB,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CACrE,CAAC;QACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAC+B,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzB,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AAQJ,MAAM,OAAO,wBAAwB;IAEhB;IACA;IACA;IAIA;IAPnB,YACmB,OAAe,EACf,WAAW,OAAO,CAAC,QAAQ,EAC3B,gBAAgB,IAAI,CACnC,eAAe,EACf,GAAG,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,gBAAgB,CAC5D,EACgB,UAAiC,2BAA2B;QAN5D,YAAO,GAAP,OAAO,CAAQ;QACf,aAAQ,GAAR,QAAQ,CAAmB;QAC3B,kBAAa,GAAb,aAAa,CAG7B;QACgB,YAAO,GAAP,OAAO,CAAqD;IAC5E,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,MAAoB;QAC7B,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO,CACL,CAAC,MAAM,2BAA2B,CAChC,OAAO,EACP,IAAI,CAAC,OAAO,EACZ,sCAAsC,EACtC,MAAM,CACP,CAAC,IAAI,SAAS,CAChB,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CACnC,aAAa,EACb,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EACvD,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAClC,CAAC;gBACF,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;YACnD,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CACtC;;;;;;;CAOT,EACS,EAAE,EACF,MAAM,CACP,CAAC;gBACF,OAAO,MAAM,IAAI,SAAS,CAAC;YAC7B,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,MAAM,CAAC,MAAM,CAAC;YACzC,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,oBAAoB,CAAC,KAAK,CAAC;gBAC1D,OAAO,SAAS,CAAC;YACnB,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,sBAAsB,CAAC,KAAK,CAAC;gBAC5D,OAAO,SAAS,CAAC;YACnB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,MAAoB;QAC7C,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,4BAA4B,CAChC,OAAO,EACP,IAAI,CAAC,OAAO,EACZ,KAAK,EACL,sCAAsC,EACtC,MAAM,CACP,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,OAAO,CAChB,aAAa,EACb;oBACE,OAAO;oBACP,SAAS;oBACT,2BAA2B;oBAC3B,SAAS;oBACT,OAAO;oBACP,SAAS;oBACT,IAAI,CAAC,OAAO;iBACb,EACD,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAChD,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,UAAU,CACnB;;;;;WAKC,EACD,EAAE,yBAAyB,EAAE,KAAK,EAAE,EACpC,MAAM,CACP,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,MAAM,CAAC,MAAM,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,yDAAyD,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9H,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAAoB;QAC9B,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;gBAC5B,MAAM,6BAA6B,CACjC,OAAO,EACP,IAAI,CAAC,OAAO,EACZ,sCAAsC,EACtC,MAAM,CACP,CAAC;iBACC,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;gBAChC,MAAM,IAAI,CAAC,OAAO,CAChB,aAAa,EACb,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EACtD,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAClC,CAAC;iBACC,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACnC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9C,MAAM,EAAE,cAAc,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,MAAM,CAAC,MAAM,CAAC;YACzC,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,oBAAoB,CAAC,KAAK,CAAC;gBAAE,OAAO;YACrE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAAc,EACd,cAAsC,EAAE,EACxC,MAAoB;QAEpB,OAAO,MAAM,IAAI,CAAC,OAAO,CACvB,gBAAgB,EAChB;YACE,YAAY;YACZ,iBAAiB;YACjB,kBAAkB;YAClB,QAAQ;YACR,UAAU;YACV,MAAM;SACP,EACD;YACE,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,wBAAwB,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;gBACrD,GAAG,WAAW;aACf;YACD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CACF,CAAC;IACJ,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,OAAO,GAAG,KAAoD,CAAC;IACrE,OAAO,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAQ,KAAoC,CAAC,IAAI,KAAK,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,OAAO,sBAAsB;IACJ;IAA7B,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAE7C,KAAK,CAAC,IAAI,CAAC,MAAoB;QAC7B,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvE,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,MAAoB;QAC7C,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACtE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAAoB;QAC9B,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,MAAM,EAAE,cAAc,EAAE,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,gCAAgC;IAExB;IACA;IACA;IAHnB,YACmB,MAA0B,EAC1B,QAA4B,EAC5B,gBAAgB,GAAG,EAAE,CACpC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,GAAG;QAHvB,WAAM,GAAN,MAAM,CAAoB;QAC1B,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,kBAAa,GAAb,aAAa,CACU;IACvC,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,MAAoB;QAC7B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,KAAK,CAAC;YACjC,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;gBAChE,MAAM,KAAK,CAAC;YACd,+DAA+D;QACjE,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,MAAoB;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,KAAK,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE;gBACvB,MAAM,IAAI,KAAK,CACb,+GAA+G,iBAAiB,kDAAkD,EAClL,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACN,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAAoB;QAC9B,IAAI,aAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,KAAK,CAAC;YACjC,aAAa,GAAG,KAAK,CAAC;QACxB,CAAC;QACD,IAAI,eAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,KAAK,CAAC;YACjC,eAAe,GAAG,KAAK,CAAC;QAC1B,CAAC;QACD,IAAI,aAAa,IAAI,eAAe;YAClC,MAAM,IAAI,cAAc,CACtB,CAAC,aAAa,EAAE,eAAe,CAAC,EAChC,mDAAmD,CACpD,CAAC;QACJ,IAAI,aAAa;YAAE,MAAM,aAAa,CAAC;QACvC,IAAI,eAAe;YAAE,MAAM,eAAe,CAAC;IAC7C,CAAC;CACF;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;AACN,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,OAAO,GAAG,gBAAgB,OAAO,EAAE,CAAC;IAC1C,OAAO,IAAI,gCAAgC,CACzC,IAAI,wBAAwB,CAAC,OAAO,CAAC,EACrC,IAAI,sBAAsB,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,MAAoB;IAEpB,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,OAAgB,EAChB,MAAoB;IAEpB,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,MAAoB;IAEpB,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,WAAmB,EACnB,OAAe,EACf,MAAc,EACd,UAA4C,sCAAsC,EAClF,MAAoB;IAEpB,MAAM,8BAA8B,CAClC,KAAK,EACL,WAAW,EACX,OAAO,EACP,MAAM,EACN,OAAO,EACP,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,WAAmB,EACnB,OAAe,EACf,UAA4C,sCAAsC,EAClF,MAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAChD,KAAK,EACL,WAAW,EACX,OAAO,EACP,EAAE,EACF,OAAO,EACP,MAAM,CACP,CAAC;IACF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,WAAmB,EACnB,OAAe,EACf,UAA4C,sCAAsC,EAClF,MAAoB;IAEpB,MAAM,8BAA8B,CAClC,QAAQ,EACR,WAAW,EACX,OAAO,EACP,EAAE,EACF,OAAO,EACP,MAAM,CACP,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,SAAmC,EACnC,WAAmB,EACnB,OAAe,EACf,MAAc,EACd,OAAyC,EACzC,MAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,oBAAoB,EACpB,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,EAC1D,sBAAsB,EACtB,MAAM,EACN,MAAM,CACP,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC"}