@credibledata/cred-cli 0.0.103 → 0.0.105

package/dist/setup-core/readylines.js

@@ -0,0 +1,169 @@
+"use strict";
+/**
+ * Reading the Publisher server's boot signals.
+ *
+ * ## Use the machine-readable line, not the log lines
+ *
+ * The server prints human log lines per listener:
+ *
+ *     info: Publisher server listening at http://127.0.0.1:4000
+ *     info: MCP server listening at http://127.0.0.1:4040
+ *
+ * and, once initialization finishes, one line meant for exactly this purpose:
+ *
+ *     PUBLISHER_READY url=http://127.0.0.1:4000 mcp=http://127.0.0.1:4040 environments=1 packages=1 load_errors=0
+ *     PUBLISHER_INIT_FAILED error="..."          (on stderr)
+ *
+ * The counts are the point. Both listeners bind and both log lines print even
+ * when every configured environment failed to load — a server that is running
+ * and serving nothing. Waiting on the log lines alone would have setup announce
+ * success over an empty server, which is the single most misleading thing it
+ * could do. `load_errors` and `packages` are what distinguish the two, and
+ * upstream added them for that reason.
+ *
+ * One caveat on the readiness line's URLs: they are built from the *requested*
+ * port, not the bound one. That is safe for us only because we never ask for an
+ * ephemeral port (see `ports.ts`); the log lines carry the truly-bound ports and
+ * remain the source for those.
+ *
+ * Treating another project's stdout as an API is a real coupling, so it lives in
+ * this one file with fixture tests taken from a real run. If upstream changes
+ * the wording, one file breaks and its test says which line moved.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripAnsi = stripAnsi;
+exports.parseReadyLine = parseReadyLine;
+exports.parseReadinessLine = parseReadinessLine;
+exports.parseInitFailedLine = parseInitFailedLine;
+exports.readinessVerdict = readinessVerdict;
+exports.dialableHost = dialableHost;
+/**
+ * Strip ANSI SGR sequences — the server colourises its log level.
+ *
+ * The escape introducer is not optional in this pattern. Matching only `[32m`
+ * leaves the escape byte behind: parsing still works, but the "cleaned" line
+ * carries a control character into anything that echoes it.
+ */
+function stripAnsi(line) {
+    // eslint-disable-next-line no-control-regex
+    return line.replace(/\[[0-9;]*m/g, "");
+}
+const READY_PATTERNS = [
+    // Bracketed IPv6 literals are possible, so the host group is permissive and
+    // the brackets are trimmed afterwards.
+    { which: "ui", re: /Publisher server listening at https?:\/\/(\S+):(\d+)/ },
+    { which: "mcp", re: /MCP server listening at https?:\/\/(\S+):(\d+)/ },
+];
+/**
+ * Extract a bound listener address from one output line.
+ *
+ * Use this for the ports actually bound. Use {@link parseReadinessLine} to
+ * decide whether the server is usable.
+ */
+function parseReadyLine(line) {
+    const clean = stripAnsi(line);
+    for (const { which, re } of READY_PATTERNS) {
+        const match = clean.match(re);
+        if (match) {
+            return {
+                which,
+                host: match[1].replace(/^\[|\]$/g, ""),
+                port: Number(match[2]),
+            };
+        }
+    }
+    return undefined;
+}
+/** Parse the `PUBLISHER_READY` line, or `undefined` for any other line. */
+function parseReadinessLine(line) {
+    const clean = stripAnsi(line);
+    if (!clean.includes("PUBLISHER_READY")) {
+        return undefined;
+    }
+    // Anchored to a field boundary, so `url=` never matches inside a later
+    // `mcp_url=`.
+    const field = (name) => { var _a; return (_a = clean.match(new RegExp(`(?:^|\\s)${name}=(\\S+)`))) === null || _a === void 0 ? void 0 : _a[1]; };
+    // A count has to parse as a non-negative integer to be one. Anything else is
+    // not a count we can reason about, and the failure has to land here rather
+    // than downstream: `readinessVerdict` compares with `===` and `>`, every one
+    // of which is false for NaN, so a `packages=n/a` from a changed upstream
+    // format would fall through all of its guards to `serving` — the exact
+    // fail-open this file exists to prevent. Returning undefined instead keeps
+    // the verdict unreachable, which the supervisor reports as a boot failure.
+    const count = (name) => {
+        const raw = field(name);
+        if (!raw)
+            return undefined;
+        const value = Number(raw);
+        return Number.isInteger(value) && value >= 0 ? value : undefined;
+    };
+    const url = field("url");
+    const mcpUrl = field("mcp");
+    const environments = count("environments");
+    const packages = count("packages");
+    const loadErrors = count("load_errors");
+    if (!url ||
+        !mcpUrl ||
+        environments === undefined ||
+        packages === undefined ||
+        loadErrors === undefined) {
+        return undefined;
+    }
+    return { url, mcpUrl, environments, packages, loadErrors };
+}
+/**
+ * Parse the `PUBLISHER_INIT_FAILED` line, returning the error it reports.
+ *
+ * Upstream emits this so a script waiting on `PUBLISHER_READY` fails fast rather
+ * than hanging on a broken config — which is exactly what a supervisor watching
+ * only for success would do.
+ */
+function parseInitFailedLine(line) {
+    var _a, _b;
+    const clean = stripAnsi(line);
+    if (!clean.includes("PUBLISHER_INIT_FAILED")) {
+        return undefined;
+    }
+    const raw = (_b = (_a = clean.match(/error=(.*)$/)) === null || _a === void 0 ? void 0 : _a[1]) === null || _b === void 0 ? void 0 : _b.trim();
+    if (!raw)
+        return "the server did not say why";
+    try {
+        // The value is JSON-encoded, so it survives quotes and newlines.
+        return String(JSON.parse(raw));
+    }
+    catch (_c) {
+        return raw;
+    }
+}
+function readinessVerdict(readiness) {
+    if (readiness.environments === 0) {
+        return {
+            kind: "fatal",
+            reason: `the server started but no environment loaded${readiness.loadErrors > 0 ? ` (${readiness.loadErrors} failed)` : ""}, so it has no connections and nothing to query`,
+        };
+    }
+    if (readiness.loadErrors > 0 || readiness.packages === 0) {
+        return {
+            kind: "degraded",
+            reason: readiness.loadErrors > 0
+                ? `the environment loaded, but ${readiness.loadErrors} package${readiness.loadErrors === 1 ? "" : "s"} failed to compile — the errors are above`
+                : "the environment loaded, but no package is being served yet",
+        };
+    }
+    return { kind: "serving" };
+}
+/**
+ * The address to dial, given what the server bound.
+ *
+ * A wildcard bind (`0.0.0.0` / `::`) is not dialable, and the server prints the
+ * bind address deliberately — it is how a mistyped `--hostt`, which silently
+ * falls back to `0.0.0.0`, gets noticed. So we map the wildcard to loopback for
+ * the dialable form while leaving the printed line alone.
+ */
+function dialableHost(boundHost) {
+    if (boundHost === "0.0.0.0" || boundHost === "::" || boundHost === "") {
+        return "127.0.0.1";
+    }
+    return boundHost;
+}
+//# sourceMappingURL=readylines.js.map

package/dist/setup-core/readylines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readylines.js","sourceRoot":"","sources":["../../src/setup-core/readylines.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;;AASH,8BAGC;AAqBD,wCAaC;AAWD,gDAuCC;AASD,kDAaC;AA6BD,4CAqBC;AAUD,oCAKC;AArLD;;;;;;GAMG;AACH,SAAgB,SAAS,CAAC,IAAY;IACnC,4CAA4C;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAQD,MAAM,cAAc,GAAoD;IACrE,4EAA4E;IAC5E,uCAAuC;IACvC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,sDAAsD,EAAE;IAC3E,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,gDAAgD,EAAE;CACxE,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,KAAK,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,cAAc,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,KAAK,EAAE,CAAC;YACT,OAAO;gBACJ,KAAK;gBACL,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;gBACtC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;aACxB,CAAC;QACL,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACpB,CAAC;AAUD,2EAA2E;AAC3E,SAAgB,kBAAkB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACpB,CAAC;IACD,uEAAuE;IACvE,cAAc;IACd,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,WAC5B,OAAA,MAAA,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,YAAY,IAAI,SAAS,CAAC,CAAC,0CAAG,CAAC,CAAC,CAAA,EAAA,CAAC;IAE3D,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,KAAK,GAAG,CAAC,IAAY,EAAsB,EAAE;QAChD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;IACxC,IACG,CAAC,GAAG;QACJ,CAAC,MAAM;QACP,YAAY,KAAK,SAAS;QAC1B,QAAQ,KAAK,SAAS;QACtB,UAAU,KAAK,SAAS,EACzB,CAAC;QACA,OAAO,SAAS,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAC,IAAY;;IAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC;IACpB,CAAC;IACD,MAAM,GAAG,GAAG,MAAA,MAAA,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,0CAAG,CAAC,CAAC,0CAAE,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,4BAA4B,CAAC;IAC9C,IAAI,CAAC;QACF,iEAAiE;QACjE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,CAAC;IAAC,WAAM,CAAC;QACN,OAAO,GAAG,CAAC;IACd,CAAC;AACJ,CAAC;AA6BD,SAAgB,gBAAgB,CAAC,SAAoB;IAClD,IAAI,SAAS,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO;YACJ,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,+CACL,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,UAAU,UAAU,CAAC,CAAC,CAAC,EACpE,iDAAiD;SACnD,CAAC;IACL,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO;YACJ,IAAI,EAAE,UAAU;YAChB,MAAM,EACH,SAAS,CAAC,UAAU,GAAG,CAAC;gBACrB,CAAC,CAAC,+BAA+B,SAAS,CAAC,UAAU,WAChD,SAAS,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACrC,2CAA2C;gBAC7C,CAAC,CAAC,4DAA4D;SACtE,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,YAAY,CAAC,SAAiB;IAC3C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO,WAAW,CAAC;IACtB,CAAC;IACD,OAAO,SAAS,CAAC;AACpB,CAAC"}

package/dist/setup-core/readylines.spec.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const readylines_1 = require("./readylines");
+/**
+ * Fixtures captured from a real run of `@malloy-publisher/server@0.0.248` (the
+ * version pinned when they were captured; the pin in
+ * infrastructure/malloy-versions.json has moved on since), launched with
+ * `--host 127.0.0.1 --port 0 --mcp_port 0`. Copied verbatim, colour codes
+ * included, because the colour codes are exactly what a naive parser trips on.
+ */
+const REAL_UI_LINE = "\u001b[32minfo\u001b[39m: Publisher server listening at http://127.0.0.1:55571";
+const REAL_MCP_LINE = "\u001b[32minfo\u001b[39m: MCP server listening at http://127.0.0.1:55572";
+/** Also from that run: the server refusing to save an ephemeral port. */
+const REAL_SKIP_LINE = "\u001b[32minfo\u001b[39m: Did not write .mcp.json: this server asked for MCP port 0 and got 55572, so the port changes from run to run and a saved config would be wrong next boot.";
+describe("readylines", () => {
+    describe("parseReadyLine", () => {
+        it("reads the UI port out of a real, colourised ready line", () => {
+            (0, chai_1.expect)((0, readylines_1.parseReadyLine)(REAL_UI_LINE)).to.eql({
+                which: "ui",
+                host: "127.0.0.1",
+                port: 55571,
+            });
+        });
+        it("reads the MCP port out of a real, colourised ready line", () => {
+            (0, chai_1.expect)((0, readylines_1.parseReadyLine)(REAL_MCP_LINE)).to.eql({
+                which: "mcp",
+                host: "127.0.0.1",
+                port: 55572,
+            });
+        });
+        it("does not mistake the mcp.json skip notice for a ready line", () => {
+            // That line mentions an MCP port too. Matching it would have the
+            // supervisor announce readiness against a port nothing is serving.
+            (0, chai_1.expect)((0, readylines_1.parseReadyLine)(REAL_SKIP_LINE)).to.equal(undefined);
+        });
+        it("ignores unrelated output", () => {
+            (0, chai_1.expect)((0, readylines_1.parseReadyLine)("info: loading package storefront")).to.equal(undefined);
+            (0, chai_1.expect)((0, readylines_1.parseReadyLine)("")).to.equal(undefined);
+        });
+        it("handles a bracketed IPv6 bind address", () => {
+            (0, chai_1.expect)((0, readylines_1.parseReadyLine)("info: MCP server listening at http://[::1]:4040")).to.eql({ which: "mcp", host: "::1", port: 4040 });
+        });
+        it("reads the default ports when no --port was passed", () => {
+            (0, chai_1.expect)((0, readylines_1.parseReadyLine)("info: Publisher server listening at http://0.0.0.0:4000")).to.eql({ which: "ui", host: "0.0.0.0", port: 4000 });
+        });
+    });
+    describe("stripAnsi", () => {
+        it("leaves a plain line untouched", () => {
+            (0, chai_1.expect)((0, readylines_1.stripAnsi)("info: hello")).to.equal("info: hello");
+        });
+        it("removes the level colouring", () => {
+            (0, chai_1.expect)((0, readylines_1.stripAnsi)(REAL_UI_LINE)).to.equal("info: Publisher server listening at http://127.0.0.1:55571");
+        });
+    });
+    describe("dialableHost", () => {
+        it("maps a wildcard bind to loopback", () => {
+            // The server prints the bind address on purpose, so a mistyped
+            // `--hostt` that silently binds 0.0.0.0 is visible. We must not repeat
+            // the wildcard in a URL we hand to a browser or an agent.
+            (0, chai_1.expect)((0, readylines_1.dialableHost)("0.0.0.0")).to.equal("127.0.0.1");
+            (0, chai_1.expect)((0, readylines_1.dialableHost)("::")).to.equal("127.0.0.1");
+        });
+        it("leaves a real address alone", () => {
+            (0, chai_1.expect)((0, readylines_1.dialableHost)("127.0.0.1")).to.equal("127.0.0.1");
+            (0, chai_1.expect)((0, readylines_1.dialableHost)("::1")).to.equal("::1");
+        });
+    });
+});
+//# sourceMappingURL=readylines.spec.js.map

package/dist/setup-core/readylines.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readylines.spec.js","sourceRoot":"","sources":["../../src/setup-core/readylines.spec.ts"],"names":[],"mappings":";;AAAA,+BAA8B;AAC9B,6CAAuE;AAEvE;;;;;;GAMG;AACH,MAAM,YAAY,GACf,gFAAgF,CAAC;AACpF,MAAM,aAAa,GAChB,0EAA0E,CAAC;AAC9E,yEAAyE;AACzE,MAAM,cAAc,GACjB,qLAAqL,CAAC;AAEzL,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IACzB,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAC/D,IAAA,aAAM,EAAC,IAAA,2BAAc,EAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC;gBACzC,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,KAAK;aACb,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;YAChE,IAAA,aAAM,EAAC,IAAA,2BAAc,EAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC;gBAC1C,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,KAAK;aACb,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,IAAA,aAAM,EAAC,IAAA,2BAAc,EAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;YACjC,IAAA,aAAM,EAAC,IAAA,2BAAc,EAAC,kCAAkC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAChE,SAAS,CACX,CAAC;YACF,IAAA,aAAM,EAAC,IAAA,2BAAc,EAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC9C,IAAA,aAAM,EACH,IAAA,2BAAc,EAAC,iDAAiD,CAAC,CACnE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC1D,IAAA,aAAM,EACH,IAAA,2BAAc,EACX,yDAAyD,CAC3D,CACH,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;QACxB,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACtC,IAAA,aAAM,EAAC,IAAA,sBAAS,EAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACpC,IAAA,aAAM,EAAC,IAAA,sBAAS,EAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CACrC,4DAA4D,CAC9D,CAAC;QACL,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC3B,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YACzC,+DAA+D;YAC/D,uEAAuE;YACvE,0DAA0D;YAC1D,IAAA,aAAM,EAAC,IAAA,yBAAY,EAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACtD,IAAA,aAAM,EAAC,IAAA,yBAAY,EAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACpC,IAAA,aAAM,EAAC,IAAA,yBAAY,EAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACxD,IAAA,aAAM,EAAC,IAAA,yBAAY,EAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;AACN,CAAC,CAAC,CAAC"}

package/dist/setup-core/refresh.js

@@ -0,0 +1,348 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REFRESH_LOCK_STALE_MS = exports.REFRESH_SKEW_SECONDS = void 0;
+exports.ensureFreshTokens = ensureFreshTokens;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const environments_1 = require("./environments");
+/**
+ * Refresh the stored Auth0 tokens before they expire.
+ *
+ * Ported from the VS Code extension's `user.ts::refreshAccessTokensIfExpired`,
+ * which until now was the only implementation — the CLI persisted a refresh
+ * token and never exchanged it, so `getRefreshToken()` had no non-test callers
+ * and every session died at the access token's `exp`.
+ *
+ * One deliberate behavioural change from the extension: refresh happens BEFORE
+ * expiry, not after. The extension only acts once a token has already expired,
+ * which turns the first request after the deadline into a failure the user sees.
+ * A local publisher session holds a token for hours, so proactive refresh is
+ * required rather than nicer — and once it exists there is no reason for
+ * anything else to wait for a 401.
+ */
+/**
+ * How long before `exp` to refresh. Two minutes covers a slow request that
+ * started while the token was still valid, plus modest clock skew between this
+ * machine and Auth0.
+ */
+exports.REFRESH_SKEW_SECONDS = 120;
+/**
+ * How long to wait for the token endpoint before giving up and continuing on the
+ * token we already hold. Comfortably longer than a healthy round trip, short
+ * enough that a command still prints something promptly on a wedged network.
+ */
+const REFRESH_TIMEOUT_MS = 10000;
+/**
+ * A refresh lock older than this belongs to a process that died holding it.
+ * A live holder keeps it for one token request, which gives up after
+ * {@link REFRESH_TIMEOUT_MS}, so twice that leaves room for the file read and
+ * write on either side.
+ */
+exports.REFRESH_LOCK_STALE_MS = 2 * REFRESH_TIMEOUT_MS;
+/**
+ * How long to wait for another process's refresh before giving up. Longer than
+ * {@link REFRESH_LOCK_STALE_MS}, so a lock left by a crashed process is always
+ * broken before the wait runs out.
+ */
+const REFRESH_LOCK_WAIT_MS = exports.REFRESH_LOCK_STALE_MS + 5000;
+const REFRESH_LOCK_POLL_MS = 50;
+function isOfflineError(error) {
+    var _a, _b;
+    const code = (_a = error === null || error === void 0 ? void 0 : error.code) !== null && _a !== void 0 ? _a : (_b = error === null || error === void 0 ? void 0 : error.cause) === null || _b === void 0 ? void 0 : _b.code;
+    return (code === "ENOTFOUND" ||
+        code === "EAI_AGAIN" ||
+        code === "ECONNREFUSED" ||
+        code === "ETIMEDOUT");
+}
+/**
+ * Take the refresh lock: a file beside `~/.cred`, created only if it does not
+ * exist, so exactly one process at a time gets past this.
+ *
+ * Returns a release function, or `undefined` if another process kept the lock
+ * for longer than {@link REFRESH_LOCK_WAIT_MS}. A lock older than
+ * {@link REFRESH_LOCK_STALE_MS} is removed and retaken, so a process that
+ * crashed mid-refresh cannot block every later one.
+ *
+ * An error other than "already exists" (a read-only home directory, say), on
+ * the create or on breaking a stale lock, skips the lock rather than failing
+ * the refresh. The lock narrows the race below; it
+ * is not a precondition for renewing a token.
+ */
+function acquireRefreshLock(lockPath) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const owner = crypto_1.default.randomBytes(16).toString("hex");
+        const release = () => {
+            // Remove the lock only while it is still ours. If it was broken as stale
+            // and retaken, the file now belongs to another process.
+            try {
+                if (fs_1.default.readFileSync(lockPath, "utf-8") === owner) {
+                    fs_1.default.unlinkSync(lockPath);
+                }
+            }
+            catch (_a) {
+                // Already gone.
+            }
+        };
+        const deadline = Date.now() + REFRESH_LOCK_WAIT_MS;
+        for (;;) {
+            try {
+                fs_1.default.writeFileSync(lockPath, owner, { flag: "wx", mode: 0o600 });
+                return release;
+            }
+            catch (error) {
+                if ((error === null || error === void 0 ? void 0 : error.code) !== "EEXIST") {
+                    return () => { };
+                }
+            }
+            try {
+                const age = Date.now() - fs_1.default.statSync(lockPath).mtimeMs;
+                if (age > exports.REFRESH_LOCK_STALE_MS) {
+                    // Break it by renaming, not unlinking: when two waiters see the
+                    // same stale lock, only one rename succeeds. The other gets ENOENT
+                    // and retries, so it cannot delete the lock the winner just took.
+                    const broken = `${lockPath}.stale-${owner}`;
+                    fs_1.default.renameSync(lockPath, broken);
+                    fs_1.default.unlinkSync(broken);
+                    continue;
+                }
+            }
+            catch (error) {
+                // ENOENT: the lock was released, or another waiter broke it, between
+                // our create and here. Try again at once. Anything else (a read-only
+                // or sticky home, a Windows scanner holding the file) will not clear
+                // on retry, and retrying at once would spin without ever yielding.
+                // Skip the lock instead, as for a failed create above.
+                if ((error === null || error === void 0 ? void 0 : error.code) === "ENOENT") {
+                    continue;
+                }
+                return () => { };
+            }
+            if (Date.now() >= deadline) {
+                return undefined;
+            }
+            yield new Promise((resolve) => setTimeout(resolve, REFRESH_LOCK_POLL_MS));
+        }
+    });
+}
+/**
+ * Ensure the stored API access token is valid for at least
+ * {@link REFRESH_SKEW_SECONDS} more seconds, exchanging the refresh token if not.
+ *
+ * Never throws: every failure mode is a returned outcome, because the callers
+ * are command entry points that need to decide between "stop and tell the user
+ * to log in" and "warn and continue".
+ */
+function ensureFreshTokens(store) {
+    return __awaiter(this, void 0, void 0, function* () {
+        // One deployment for the whole exchange. The POST below can take up to
+        // REFRESH_TIMEOUT_MS, and an unpinned store resolves `activeEnvironment`
+        // again on every read and write — so an `ms2ad set-env` in another terminal
+        // during the request would write this deployment's new tokens into (or
+        // clear) another deployment's slot.
+        const config = store.pinnedToCurrentEnvironment();
+        if (config.isServiceAccountToken()) {
+            return { status: "service-account" };
+        }
+        if (hasTimeLeft(config)) {
+            return { status: "fresh" };
+        }
+        // Several `cred` processes share one `~/.cred` entry per deployment, and
+        // with refresh-token rotation a refresh token can be redeemed once. Without
+        // the lock, two processes whose tokens near expiry together both POST the
+        // same refresh token. The loser gets `invalid_grant`, possibly before the
+        // winner has written its new pair, and would then clear the tokens over a
+        // renewal that succeeded.
+        // So the read, the POST and the write happen under one lock.
+        const release = yield acquireRefreshLock(`${config.getConfigPath()}.lock`);
+        if (!release) {
+            return {
+                status: "offline",
+                reason: `Another cred process has been renewing your session for over ${Math.round(REFRESH_LOCK_WAIT_MS / 1000)}s.`,
+                retry: "Run the command again in a moment.",
+            };
+        }
+        try {
+            return yield refreshHoldingLock(config);
+        }
+        finally {
+            release();
+        }
+    });
+}
+function hasTimeLeft(config) {
+    const remaining = config.secondsUntilExpiry();
+    return remaining !== undefined && remaining > exports.REFRESH_SKEW_SECONDS;
+}
+function refreshHoldingLock(config) {
+    return __awaiter(this, void 0, void 0, function* () {
+        // Read again now that the lock is ours: whoever held it may have just
+        // renewed the token, and then there is nothing to send. Every read goes to
+        // the file, so this sees their write.
+        if (hasTimeLeft(config)) {
+            return { status: "fresh" };
+        }
+        const remaining = config.secondsUntilExpiry();
+        const refreshToken = config.getRefreshToken();
+        if (!refreshToken) {
+            // No refresh token means nothing to renew with, and no answer from Auth0
+            // about whether the session is dead — so nothing here is proof enough to
+            // clear the store. Destroying it would also take the organization and
+            // environment with it, which the `cred login` that fixes this reuses.
+            if (config.getApiAccessToken() === undefined) {
+                return {
+                    status: "logged-out",
+                    reason: "You are not logged in. Run `cred login`.",
+                };
+            }
+            if (remaining !== undefined && remaining > 0) {
+                return {
+                    status: "not-renewable",
+                    reason: `Your session expires in ${remaining}s and has no refresh token to renew it. Run \`cred login\` to start a new one.`,
+                };
+            }
+            return {
+                status: "logged-out",
+                reason: "Your session expired and there is no refresh token. Run `cred login`.",
+            };
+        }
+        const environment = config.getEnvironment();
+        const { domain, clientId } = environments_1.auth0ConfigsByEnv[environment];
+        // `fetch`, not the `axios` every other HTTP call in `cli/src` uses — and
+        // deliberately, so the choice is not read as a slip. `setup-core` is a
+        // library to be lifted into the VS Code extension by `git mv`, and its only
+        // dependencies should be ones both hosts already have. `fetch` is in the
+        // Node and VS Code runtimes; axios would make the extension inherit a
+        // dependency for two requests. The cost is that `printOutError` /
+        // `isAxiosError` do not apply here, which is why `isOfflineError` above
+        // classifies by `code` instead.
+        let response;
+        try {
+            response = yield fetch(`${domain}/oauth/token`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({
+                    grant_type: "refresh_token",
+                    client_id: clientId,
+                    refresh_token: refreshToken,
+                }),
+                // A refresh with no deadline can hang for as long as the OS lets the
+                // socket live. Every caller is a command entry point that has to decide
+                // something, and "continue on the token we have" is a good answer after
+                // 10s — whereas a silent multi-minute stall before any output is not.
+                signal: AbortSignal.timeout(REFRESH_TIMEOUT_MS),
+            });
+        }
+        catch (error) {
+            if (isOfflineError(error)) {
+                return {
+                    status: "offline",
+                    reason: `Could not reach ${domain} to refresh your session.`,
+                };
+            }
+            return {
+                status: "offline",
+                reason: `Refreshing your session failed: ${error instanceof Error ? error.message : String(error)}.`,
+            };
+        }
+        let payload;
+        try {
+            payload = yield response.json();
+        }
+        catch (_a) {
+            return {
+                status: "offline",
+                reason: `${domain} returned an unreadable refresh response (HTTP ${response.status}).`,
+            };
+        }
+        // `invalid_grant` means the token WE sent is dead — revoked, rotated, or
+        // expired. That is usually terminal, so clear the tokens rather than leave
+        // credentials that will fail every subsequent call. But "rotated" has a
+        // second cause: another process redeemed the same refresh token first and
+        // wrote its replacement.
+        //
+        // The lock above keeps other `cred` processes out, but not the VS Code
+        // extension, which shares `~/.cred` and refreshes without it. So check the
+        // file before clearing it: a refresh token there that is no longer the one
+        // we sent means someone else rotated it, and the store already holds a fresh
+        // pair.
+        //
+        // An EMPTY on-disk token is not a rotation: the VS Code extension's
+        // `clearState()` writes `''` on sign-out and on most refresh errors. Counting
+        // that as a rotation would report `fresh` and send the stale access token.
+        if (payload.error === "invalid_grant" || payload.error === "invalid_token") {
+            const onDisk = config.getRefreshToken();
+            if (onDisk && onDisk !== refreshToken) {
+                return { status: "fresh" };
+            }
+            try {
+                // Only the tokens: the organization and environment stay, so the
+                // `cred login` this asks for signs back in to the same place.
+                config.clearTokens();
+            }
+            catch (_b) {
+                // An unwritable `~/.cred` keeps the dead tokens on disk. The session
+                // is over either way, and this function must not throw.
+            }
+            return {
+                status: "logged-out",
+                reason: `Your session is no longer valid (${payload.error}). Run \`cred login\`.`,
+            };
+        }
+        if (payload.error) {
+            return {
+                status: "offline",
+                reason: `Auth0 refused the refresh (${payload.error}${payload.error_description ? `: ${payload.error_description}` : ""}).`,
+            };
+        }
+        // A response carrying neither an error code nor a token tells us nothing
+        // about the refresh token: an HTTP error page from a proxy in front of Auth0
+        // parses as JSON and lands exactly here. Destroying credentials needs proof
+        // they are dead, and the only proof is the explicit `invalid_grant` /
+        // `invalid_token` above. So keep the token and report the HTTP status —
+        // whoever debugs this needs to know a 502 is not a logout.
+        if (!payload.access_token) {
+            return {
+                status: "offline",
+                reason: `${domain} returned no access token and no error on refresh (HTTP ${response.status}).`,
+            };
+        }
+        try {
+            config.setTokenPair({
+                accessToken: payload.access_token,
+                idToken: payload.id_token,
+                // Auth0 rotates refresh tokens when rotation is enabled; keep the new
+                // one when offered, otherwise the stored one stays valid.
+                refreshToken: payload.refresh_token,
+            });
+        }
+        catch (error) {
+            // A read-only home directory (or `~/.cred` itself): Auth0 renewed the
+            // session, but nothing can be saved. Thrown, this escaped a function
+            // whose callers rely on it returning, and printed a bare EACCES. As an
+            // `offline` outcome the command carries on while the old token is valid,
+            // then stops with a message that names the fix.
+            const configPath = config.getConfigPath();
+            const code = error === null || error === void 0 ? void 0 : error.code;
+            return {
+                status: "offline",
+                reason: `Renewed your session, but could not save it to ${configPath}${code ? ` (${code})` : ""}.`,
+                retry: `Make ${path_1.default.dirname(configPath)} writable, then run the command again.`,
+            };
+        }
+        return { status: "fresh" };
+    });
+}
+//# sourceMappingURL=refresh.js.map

package/dist/setup-core/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../src/setup-core/refresh.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AA6KA,8CAsCC;AAnND,oDAA4B;AAC5B,4CAAoB;AACpB,gDAAwB;AAExB,iDAAmD;AAEnD;;;;;;;;;;;;;;GAcG;AAEH;;;;GAIG;AACU,QAAA,oBAAoB,GAAG,GAAG,CAAC;AAExC;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAElC;;;;;GAKG;AACU,QAAA,qBAAqB,GAAG,CAAC,GAAG,kBAAkB,CAAC;AAE5D;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,6BAAqB,GAAG,IAAK,CAAC;AAE3D,MAAM,oBAAoB,GAAG,EAAE,CAAC;AA+BhC,SAAS,cAAc,CAAC,KAAc;;IACnC,MAAM,IAAI,GACP,MAAC,KAA2B,aAA3B,KAAK,uBAAL,KAAK,CAAwB,IAAI,mCAClC,MAAC,KAAuC,aAAvC,KAAK,uBAAL,KAAK,CAAoC,KAAK,0CAAE,IAAI,CAAC;IACzD,OAAO,CACJ,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,cAAc;QACvB,IAAI,KAAK,WAAW,CACtB,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAe,kBAAkB,CAC9B,QAAgB;;QAEhB,MAAM,KAAK,GAAG,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,GAAG,EAAE;YAClB,yEAAyE;YACzE,wDAAwD;YACxD,IAAI,CAAC;gBACF,IAAI,YAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;oBAChD,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC3B,CAAC;YACJ,CAAC;YAAC,WAAM,CAAC;gBACN,gBAAgB;YACnB,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC;QACnD,SAAS,CAAC;YACP,IAAI,CAAC;gBACF,YAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC/D,OAAO,OAAO,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACd,IAAI,CAAC,KAA+B,aAA/B,KAAK,uBAAL,KAAK,CAA4B,IAAI,MAAK,QAAQ,EAAE,CAAC;oBACvD,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;gBACnB,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;gBACvD,IAAI,GAAG,GAAG,6BAAqB,EAAE,CAAC;oBAC/B,gEAAgE;oBAChE,mEAAmE;oBACnE,kEAAkE;oBAClE,MAAM,MAAM,GAAG,GAAG,QAAQ,UAAU,KAAK,EAAE,CAAC;oBAC5C,YAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;oBAChC,YAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;oBACtB,SAAS;gBACZ,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACd,qEAAqE;gBACrE,qEAAqE;gBACrE,qEAAqE;gBACrE,mEAAmE;gBACnE,uDAAuD;gBACvD,IAAI,CAAC,KAA+B,aAA/B,KAAK,uBAAL,KAAK,CAA4B,IAAI,MAAK,QAAQ,EAAE,CAAC;oBACvD,SAAS;gBACZ,CAAC;gBACD,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;YACnB,CAAC;YAED,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC1B,OAAO,SAAS,CAAC;YACpB,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAC7E,CAAC;IACJ,CAAC;CAAA;AAED;;;;;;;GAOG;AACH,SAAsB,iBAAiB,CACpC,KAA0B;;QAE1B,uEAAuE;QACvE,yEAAyE;QACzE,4EAA4E;QAC5E,uEAAuE;QACvE,oCAAoC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,0BAA0B,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACxC,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9B,CAAC;QAED,yEAAyE;QACzE,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,0BAA0B;QAC1B,6DAA6D;QAC7D,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACZ,OAAO;gBACJ,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,gEAAgE,IAAI,CAAC,KAAK,CAC/E,oBAAoB,GAAG,IAAI,CAC7B,IAAI;gBACL,KAAK,EAAE,oCAAoC;aAC7C,CAAC;QACL,CAAC;QACD,IAAI,CAAC;YACF,OAAO,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;gBAAS,CAAC;YACR,OAAO,EAAE,CAAC;QACb,CAAC;IACJ,CAAC;CAAA;AAED,SAAS,WAAW,CAAC,MAA2B;IAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAC;IAC9C,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,GAAG,4BAAoB,CAAC;AACtE,CAAC;AAED,SAAe,kBAAkB,CAC9B,MAA2B;;QAE3B,sEAAsE;QACtE,2EAA2E;QAC3E,sCAAsC;QACtC,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9B,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAE9C,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QAC9C,IAAI,CAAC,YAAY,EAAE,CAAC;YACjB,yEAAyE;YACzE,yEAAyE;YACzE,sEAAsE;YACtE,sEAAsE;YACtE,IAAI,MAAM,CAAC,iBAAiB,EAAE,KAAK,SAAS,EAAE,CAAC;gBAC5C,OAAO;oBACJ,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,0CAA0C;iBACpD,CAAC;YACL,CAAC;YACD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAC5C,OAAO;oBACJ,MAAM,EAAE,eAAe;oBACvB,MAAM,EAAE,2BAA2B,SAAS,gFAAgF;iBAC9H,CAAC;YACL,CAAC;YACD,OAAO;gBACJ,MAAM,EAAE,YAAY;gBACpB,MAAM,EACH,uEAAuE;aAC5E,CAAC;QACL,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;QAC5C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,gCAAiB,CAAC,WAAW,CAAC,CAAC;QAE5D,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,yEAAyE;QACzE,sEAAsE;QACtE,kEAAkE;QAClE,wEAAwE;QACxE,gCAAgC;QAChC,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACF,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,cAAc,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBAClB,UAAU,EAAE,eAAe;oBAC3B,SAAS,EAAE,QAAQ;oBACnB,aAAa,EAAE,YAAY;iBAC7B,CAAC;gBACF,qEAAqE;gBACrE,wEAAwE;gBACxE,wEAAwE;gBACxE,sEAAsE;gBACtE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;aACjD,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACd,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO;oBACJ,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,mBAAmB,MAAM,2BAA2B;iBAC9D,CAAC;YACL,CAAC;YACD,OAAO;gBACJ,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,mCACL,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACxD,GAAG;aACL,CAAC;QACL,CAAC;QAED,IAAI,OAMH,CAAC;QACF,IAAI,CAAC;YACF,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,CAAC;QAAC,WAAM,CAAC;YACN,OAAO;gBACJ,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,GAAG,MAAM,kDAAkD,QAAQ,CAAC,MAAM,IAAI;aACxF,CAAC;QACL,CAAC;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,yBAAyB;QACzB,EAAE;QACF,uEAAuE;QACvE,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,QAAQ;QACR,EAAE;QACF,oEAAoE;QACpE,8EAA8E;QAC9E,2EAA2E;QAC3E,IAAI,OAAO,CAAC,KAAK,KAAK,eAAe,IAAI,OAAO,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;YACxC,IAAI,MAAM,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBACrC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC9B,CAAC;YACD,IAAI,CAAC;gBACF,iEAAiE;gBACjE,8DAA8D;gBAC9D,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,CAAC;YAAC,WAAM,CAAC;gBACN,qEAAqE;gBACrE,wDAAwD;YAC3D,CAAC;YACD,OAAO;gBACJ,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,oCAAoC,OAAO,CAAC,KAAK,wBAAwB;aACnF,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO;gBACJ,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,8BAA8B,OAAO,CAAC,KAAK,GAChD,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAClE,IAAI;aACN,CAAC;QACL,CAAC;QAED,yEAAyE;QACzE,6EAA6E;QAC7E,4EAA4E;QAC5E,sEAAsE;QACtE,wEAAwE;QACxE,2DAA2D;QAC3D,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,OAAO;gBACJ,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,GAAG,MAAM,2DAA2D,QAAQ,CAAC,MAAM,IAAI;aACjG,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACF,MAAM,CAAC,YAAY,CAAC;gBACjB,WAAW,EAAE,OAAO,CAAC,YAAY;gBACjC,OAAO,EAAE,OAAO,CAAC,QAAQ;gBACzB,sEAAsE;gBACtE,0DAA0D;gBAC1D,YAAY,EAAE,OAAO,CAAC,aAAa;aACrC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACd,sEAAsE;YACtE,qEAAqE;YACrE,uEAAuE;YACvE,yEAAyE;YACzE,gDAAgD;YAChD,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAI,KAA+B,aAA/B,KAAK,uBAAL,KAAK,CAA4B,IAAI,CAAC;YACpD,OAAO;gBACJ,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,kDAAkD,UAAU,GACjE,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EACzB,GAAG;gBACH,KAAK,EAAE,QAAQ,cAAI,CAAC,OAAO,CAAC,UAAU,CAAC,wCAAwC;aACjF,CAAC;QACL,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;CAAA"}