@credibledata/cred-cli 0.0.103 → 0.0.105

package/dist/setup-core/refresh.spec.js

@@ -0,0 +1,501 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importStar(require("path"));
+const sinon_1 = __importDefault(require("sinon"));
+const credstore_1 = require("./credstore");
+const environments_1 = require("./environments");
+const refresh_1 = require("./refresh");
+const PROD = environments_1.auth0ConfigsByEnv.production;
+function jwt(claims) {
+    const part = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+    return `${part({ alg: "HS256", typ: "JWT" })}.${part(claims)}.signature`;
+}
+/** An access token that expires `seconds` from now. */
+function accessTokenExpiringIn(seconds) {
+    return jwt({
+        aud: PROD.audience,
+        exp: Math.floor(Date.now() / 1000) + seconds,
+    });
+}
+// Minted per test, not at load: mocha loads every spec before running any, so
+// a token minted at load has already aged by however long the earlier specs
+// took, and NEARLY_DEAD_TOKEN (110s of life) is dead by the time CI gets here.
+let LIVE_TOKEN;
+let NEARLY_DEAD_TOKEN;
+let FRESH_TOKEN;
+describe("ensureFreshTokens", () => {
+    beforeEach(() => {
+        LIVE_TOKEN = accessTokenExpiringIn(3600);
+        NEARLY_DEAD_TOKEN = accessTokenExpiringIn(refresh_1.REFRESH_SKEW_SECONDS - 10);
+        FRESH_TOKEN = accessTokenExpiringIn(7200);
+    });
+    let configPath;
+    let fetchStub;
+    beforeEach(() => {
+        configPath = (0, path_1.join)(fs_1.default.mkdtempSync((0, path_1.join)(os_1.default.tmpdir(), "refresh-")), ".cred");
+        fetchStub = sinon_1.default.stub(globalThis, "fetch");
+    });
+    afterEach(() => {
+        sinon_1.default.restore();
+        fs_1.default.rmSync(configPath, { force: true });
+        fs_1.default.rmSync(`${configPath}.lock`, { force: true });
+    });
+    function write(envConfig) {
+        fs_1.default.writeFileSync(configPath, JSON.stringify({
+            configPerEnvironment: { production: envConfig },
+            activeEnvironment: "production",
+        }));
+        return new credstore_1.ClientConfiguration(configPath);
+    }
+    /** A `fetch` Response carrying `body` as JSON. */
+    function jsonResponse(body, status = 200) {
+        return {
+            status,
+            json: () => __awaiter(this, void 0, void 0, function* () { return body; }),
+        };
+    }
+    it("does not call Auth0 when the token has more than the skew left", () => __awaiter(void 0, void 0, void 0, function* () {
+        const config = write({
+            jwtAccessToken: LIVE_TOKEN,
+            refreshToken: "r",
+        });
+        (0, chai_1.expect)(yield (0, refresh_1.ensureFreshTokens)(config)).to.eql({ status: "fresh" });
+        (0, chai_1.expect)(fetchStub.called).to.equal(false);
+    }));
+    it("refreshes proactively, before the token has actually expired", () => __awaiter(void 0, void 0, void 0, function* () {
+        // The extension only refreshed once a token was already dead, which turns
+        // the first request past the deadline into a user-visible failure. This is
+        // the behaviour change: a still-valid-but-nearly-dead token is renewed.
+        const config = write({
+            jwtAccessToken: NEARLY_DEAD_TOKEN,
+            refreshToken: "r",
+        });
+        fetchStub.resolves(jsonResponse({
+            access_token: FRESH_TOKEN,
+            id_token: jwt({ aud: PROD.clientId }),
+        }));
+        (0, chai_1.expect)(yield (0, refresh_1.ensureFreshTokens)(config)).to.eql({ status: "fresh" });
+        (0, chai_1.expect)(fetchStub.calledOnce).to.equal(true);
+        (0, chai_1.expect)(fetchStub.getCall(0).args[0]).to.equal(`${PROD.domain}/oauth/token`);
+        (0, chai_1.expect)(JSON.parse(fetchStub.getCall(0).args[1].body)).to.eql({
+            grant_type: "refresh_token",
+            client_id: PROD.clientId,
+            refresh_token: "r",
+        });
+        (0, chai_1.expect)(config.getApiAccessToken()).to.equal(FRESH_TOKEN);
+    }));
+    it("stores a rotated refresh token when Auth0 issues one", () => __awaiter(void 0, void 0, void 0, function* () {
+        const config = write({
+            jwtAccessToken: NEARLY_DEAD_TOKEN,
+            refreshToken: "old",
+        });
+        fetchStub.resolves(jsonResponse({ access_token: FRESH_TOKEN, refresh_token: "new" }));
+        yield (0, refresh_1.ensureFreshTokens)(config);
+        (0, chai_1.expect)(config.getRefreshToken()).to.equal("new");
+    }));
+    // The POST can take seconds. An unpinned store resolved `activeEnvironment`
+    // again when it wrote, so `ms2ad set-env` in another terminal mid-request
+    // sent production's new tokens into another deployment's slot.
+    it("writes to the deployment that was active when the refresh started", () => __awaiter(void 0, void 0, void 0, function* () {
+        fs_1.default.writeFileSync(configPath, JSON.stringify({
+            configPerEnvironment: {
+                production: {
+                    jwtAccessToken: NEARLY_DEAD_TOKEN,
+                    refreshToken: "r",
+                },
+                staging: { organization: "untouched" },
+            },
+            activeEnvironment: "production",
+        }));
+        const config = new credstore_1.ClientConfiguration(configPath);
+        fetchStub.callsFake(() => __awaiter(void 0, void 0, void 0, function* () {
+            const file = JSON.parse(fs_1.default.readFileSync(configPath, "utf-8"));
+            file.activeEnvironment = "staging";
+            fs_1.default.writeFileSync(configPath, JSON.stringify(file));
+            return jsonResponse({
+                access_token: FRESH_TOKEN,
+                refresh_token: "new",
+            });
+        }));
+        (0, chai_1.expect)(yield (0, refresh_1.ensureFreshTokens)(config)).to.eql({ status: "fresh" });
+        const file = JSON.parse(fs_1.default.readFileSync(configPath, "utf-8"));
+        (0, chai_1.expect)(file.configPerEnvironment.production.refreshToken).to.equal("new");
+        (0, chai_1.expect)(file.configPerEnvironment.staging).to.eql({
+            organization: "untouched",
+        });
+    }));
+    it("clears credentials when the refresh token itself is dead", () => __awaiter(void 0, void 0, void 0, function* () {
+        const config = write({
+            jwtAccessToken: NEARLY_DEAD_TOKEN,
+            refreshToken: "revoked",
+        });
+        fetchStub.resolves(jsonResponse({ error: "invalid_grant" }));
+        const outcome = yield (0, refresh_1.ensureFreshTokens)(config);
+        (0, chai_1.expect)(outcome.status).to.equal("logged-out");
+        (0, chai_1.expect)(outcome).to.have.property("reason").that.contains("cred login");
+        // Nothing on disk can recover from a dead refresh token, so leaving it
+        // would just fail every later call with a confusing error.
+        (0, chai_1.expect)(config.getApiAccessToken()).to.equal(undefined);
+        (0, chai_1.expect)(config.getRefreshToken()).to.equal(undefined);
+    }));
+    // The session is over, but where the user was working is not: `cred login`
+    // signs back in to the same organization and environment.
+    it("keeps the organization and environment when the refresh token is dead", () => __awaiter(void 0, void 0, void 0, function* () {
+        const config = write({
+            organization: "acme",
+            project: "analytics",
+            accessToken: NEARLY_DEAD_TOKEN,
+            jwtAccessToken: NEARLY_DEAD_TOKEN,
+            idToken: "id",
+            refreshToken: "revoked",
+        });
+        fetchStub.resolves(jsonResponse({ error: "invalid_grant" }));
+        (0, chai_1.expect)((yield (0, refresh_1.ensureFreshTokens)(config)).status).to.equal("logged-out");
+        const file = JSON.parse(fs_1.default.readFileSync(configPath, "utf-8"));
+        (0, chai_1.expect)(file.activeEnvironment).to.equal("production");
+        (0, chai_1.expect)(file.configPerEnvironment.production).to.eql({
+            organization: "acme",
+            project: "analytics",
+        });
+    }));
+    it("keeps the session when another process rotated the token first", () => __awaiter(void 0, void 0, void 0, function* () {
+        // The refresh lock keeps other `cred` processes out, but the VS Code
+        // extension shares `~/.cred` and refreshes without it. When it redeems
+        // the same refresh token first, we are told `invalid_grant`.
+        //
+        // Destroying on that wiped the organization, the environment and the token
+        // the extension had just written, over a renewal that had in fact
+        // succeeded. The on-disk token is the evidence: it is no longer the one we
+        // sent.
+        const config = write({
+            jwtAccessToken: NEARLY_DEAD_TOKEN,
+            refreshToken: "ours",
+            organization: "acme",
+            project: "prod-bars",
+        });
+        fetchStub.callsFake(() => __awaiter(void 0, void 0, void 0, function* () {
+            // The winner lands between our read and Auth0's answer.
+            write({
+                jwtAccessToken: FRESH_TOKEN,
+                refreshToken: "rotated-by-the-winner",
+                organization: "acme",
+                project: "prod-bars",
+            });
+            return jsonResponse({ error: "invalid_grant" });
+        }));
+        const outcome = yield (0, refresh_1.ensureFreshTokens)(config);
+        (0, chai_1.expect)(outcome).to.eql({ status: "fresh" });
+        (0, chai_1.expect)(config.getRefreshToken()).to.equal("rotated-by-the-winner");
+        (0, chai_1.expect)(config.getApiAccessToken()).to.equal(FRESH_TOKEN);
+        (0, chai_1.expect)(config.getOrganization()).to.equal("acme");
+        (0, chai_1.expect)(config.getProject()).to.equal("prod-bars");
+    }));
+    it("logs out when the on-disk refresh token was cleared rather than rotated", () => __awaiter(void 0, void 0, void 0, function* () {
+        // The VS Code extension's `clearState()` writes `''` on sign-out and on
+        // most refresh errors. An empty value differs from the one we sent, but
+        // nobody rotated anything, so it must not count as a winner's write.
+        const config = write({
+            jwtAccessToken: NEARLY_DEAD_TOKEN,
+            refreshToken: "ours",
+        });
+        fetchStub.callsFake(() => __awaiter(void 0, void 0, void 0, function* () {
+            write({ jwtAccessToken: NEARLY_DEAD_TOKEN, refreshToken: "" });
+            return jsonResponse({ error: "invalid_grant" });
+        }));
+        const outcome = yield (0, refresh_1.ensureFreshTokens)(config);
+        (0, chai_1.expect)(outcome.status).to.equal("logged-out");
+        (0, chai_1.expect)(config.getApiAccessToken()).to.equal(undefined);
+    }));
+    it("keeps the session when Auth0 is unreachable", () => __awaiter(void 0, void 0, void 0, function* () {
+        const config = write({
+            jwtAccessToken: NEARLY_DEAD_TOKEN,
+            refreshToken: "r",
+        });
+        const offline = Object.assign(new Error("getaddrinfo ENOTFOUND"), {
+            cause: { code: "ENOTFOUND" },
+        });
+        fetchStub.rejects(offline);
+        const outcome = yield (0, refresh_1.ensureFreshTokens)(config);
+        (0, chai_1.expect)(outcome.status).to.equal("offline");
+        // Being offline is not being logged out.
+        (0, chai_1.expect)(config.getApiAccessToken()).to.equal(NEARLY_DEAD_TOKEN);
+        (0, chai_1.expect)(config.getRefreshToken()).to.equal("r");
+        // A failed refresh still lets the next process in.
+        (0, chai_1.expect)(fs_1.default.existsSync(`${configPath}.lock`)).to.equal(false);
+    }));
+    it("keeps the session when Auth0 refuses for a reason other than a dead token", () => __awaiter(void 0, void 0, void 0, function* () {
+        const config = write({
+            jwtAccessToken: NEARLY_DEAD_TOKEN,
+            refreshToken: "r",
+        });
+        fetchStub.resolves(jsonResponse({
+            error: "too_many_requests",
+            error_description: "Rate limited",
+        }));
+        const outcome = yield (0, refresh_1.ensureFreshTokens)(config);
+        (0, chai_1.expect)(outcome.status).to.equal("offline");
+        (0, chai_1.expect)(outcome).to.have.property("reason").that.contains("Rate limited");
+        (0, chai_1.expect)(config.getApiAccessToken()).to.equal(NEARLY_DEAD_TOKEN);
+    }));
+    it("distinguishes never-logged-in from a session that ended", () => __awaiter(void 0, void 0, void 0, function* () {
+        const neverLoggedIn = write({});
+        const first = yield (0, refresh_1.ensureFreshTokens)(neverLoggedIn);
+        (0, chai_1.expect)(first.status).to.equal("logged-out");
+        (0, chai_1.expect)(first).to.have.property("reason").that.contains("not logged in");
+        const sessionEnded = write({
+            jwtAccessToken: accessTokenExpiringIn(-60),
+            organization: "acme",
+            project: "prod-bars",
+        });
+        const second = yield (0, refresh_1.ensureFreshTokens)(sessionEnded);
+        (0, chai_1.expect)(second.status).to.equal("logged-out");
+        (0, chai_1.expect)(second)
+            .to.have.property("reason")
+            .that.contains("no refresh token");
+        // Nothing proved the session dead, so nothing is cleared: the
+        // organization and environment survive the `cred login` that fixes it.
+        (0, chai_1.expect)(sessionEnded.getOrganization()).to.equal("acme");
+        (0, chai_1.expect)(sessionEnded.getProject()).to.equal("prod-bars");
+        (0, chai_1.expect)(fetchStub.called).to.equal(false);
+    }));
+    // The client-credentials token `cred login` stores on e2e-test: marked as a
+    // user token, with no refresh token. Near expiry it used to be destroyed,
+    // logging out a run that still had a valid token.
+    it("keeps a still-valid token that has no refresh token", () => __awaiter(void 0, void 0, void 0, function* () {
+        const config = write({
+            accessToken: NEARLY_DEAD_TOKEN,
+            isServiceAccountToken: false,
+            organization: "demo",
+        });
+        const outcome = yield (0, refresh_1.ensureFreshTokens)(config);
+        (0, chai_1.expect)(outcome.status).to.equal("not-renewable");
+        (0, chai_1.expect)(outcome)
+            .to.have.property("reason")
+            .that.contains("no refresh token");
+        (0, chai_1.expect)(config.getApiAccessToken()).to.equal(NEARLY_DEAD_TOKEN);
+        (0, chai_1.expect)(config.getOrganization()).to.equal("demo");
+        (0, chai_1.expect)(fetchStub.called).to.equal(false);
+    }));
+    it("leaves a service-account token alone", () => __awaiter(void 0, void 0, void 0, function* () {
+        const config = write({
+            accessToken: "sa-token",
+            isServiceAccountToken: true,
+        });
+        (0, chai_1.expect)(yield (0, refresh_1.ensureFreshTokens)(config)).to.eql({
+            status: "service-account",
+        });
+        (0, chai_1.expect)(fetchStub.called).to.equal(false);
+        (0, chai_1.expect)(config.getApiAccessToken()).to.equal("sa-token");
+    }));
+    it("treats an unreadable refresh response as offline rather than logging out", () => __awaiter(void 0, void 0, void 0, function* () {
+        const config = write({
+            jwtAccessToken: NEARLY_DEAD_TOKEN,
+            refreshToken: "r",
+        });
+        fetchStub.resolves({
+            status: 502,
+            json: () => __awaiter(void 0, void 0, void 0, function* () {
+                throw new Error("not JSON");
+            }),
+        });
+        const outcome = yield (0, refresh_1.ensureFreshTokens)(config);
+        (0, chai_1.expect)(outcome.status).to.equal("offline");
+        (0, chai_1.expect)(config.getApiAccessToken()).to.equal(NEARLY_DEAD_TOKEN);
+    }));
+    // An error page from a proxy in front of Auth0 parses as JSON and carries
+    // neither an error code nor a token. That is not evidence the refresh token
+    // is dead, so it must not clear credentials — only the explicit
+    // `invalid_grant` / `invalid_token` above proves that.
+    it("keeps the session when a readable response carries neither a token nor an error", () => __awaiter(void 0, void 0, void 0, function* () {
+        const config = write({
+            jwtAccessToken: NEARLY_DEAD_TOKEN,
+            refreshToken: "r",
+        });
+        fetchStub.resolves(jsonResponse({ message: "Bad Gateway" }, 502));
+        const outcome = yield (0, refresh_1.ensureFreshTokens)(config);
+        (0, chai_1.expect)(outcome.status).to.equal("offline");
+        (0, chai_1.expect)(outcome)
+            .to.have.property("reason")
+            .that.contains("no access token and no error");
+        (0, chai_1.expect)(outcome).to.have.property("reason").that.contains("502");
+        // The credential survives: this is the whole point.
+        (0, chai_1.expect)(config.getApiAccessToken()).to.equal(NEARLY_DEAD_TOKEN);
+        (0, chai_1.expect)(config.getRefreshToken()).to.equal("r");
+    }));
+    it("gives the token request a deadline rather than hanging forever", () => __awaiter(void 0, void 0, void 0, function* () {
+        const config = write({
+            jwtAccessToken: NEARLY_DEAD_TOKEN,
+            refreshToken: "r",
+        });
+        fetchStub.resolves(jsonResponse({ access_token: FRESH_TOKEN }));
+        yield (0, refresh_1.ensureFreshTokens)(config);
+        const init = fetchStub.firstCall.args[1];
+        (0, chai_1.expect)(init.signal, "no AbortSignal on the refresh fetch").to.not.equal(undefined);
+    }));
+    describe("the refresh lock", () => {
+        const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+        // With refresh-token rotation a refresh token can be redeemed once. Two
+        // processes that both POST it get one success and one `invalid_grant`,
+        // and the loser could clear the store before the winner wrote its pair.
+        it("lets only one of two concurrent refreshes call Auth0", () => __awaiter(void 0, void 0, void 0, function* () {
+            const first = write({
+                jwtAccessToken: NEARLY_DEAD_TOKEN,
+                refreshToken: "ours",
+                organization: "acme",
+            });
+            const second = new credstore_1.ClientConfiguration(configPath);
+            fetchStub.callsFake(() => __awaiter(void 0, void 0, void 0, function* () {
+                yield sleep(100);
+                return jsonResponse({
+                    access_token: FRESH_TOKEN,
+                    refresh_token: "rotated",
+                });
+            }));
+            const outcomes = yield Promise.all([
+                (0, refresh_1.ensureFreshTokens)(first),
+                (0, refresh_1.ensureFreshTokens)(second),
+            ]);
+            (0, chai_1.expect)(outcomes).to.eql([{ status: "fresh" }, { status: "fresh" }]);
+            (0, chai_1.expect)(fetchStub.callCount).to.equal(1);
+            (0, chai_1.expect)(second.getRefreshToken()).to.equal("rotated");
+            (0, chai_1.expect)(second.getOrganization()).to.equal("acme");
+        }));
+        it("waits for a held lock, then uses the token its holder wrote", () => __awaiter(void 0, void 0, void 0, function* () {
+            const config = write({
+                jwtAccessToken: NEARLY_DEAD_TOKEN,
+                refreshToken: "ours",
+            });
+            fs_1.default.writeFileSync(`${configPath}.lock`, "another process");
+            const refreshing = (0, refresh_1.ensureFreshTokens)(config);
+            yield sleep(150);
+            // The holder finishes: a fresh pair on disk, then the lock released.
+            write({ jwtAccessToken: FRESH_TOKEN, refreshToken: "theirs" });
+            fs_1.default.unlinkSync(`${configPath}.lock`);
+            (0, chai_1.expect)(yield refreshing).to.eql({ status: "fresh" });
+            (0, chai_1.expect)(fetchStub.called, "sent a refresh token already redeemed").to.be
+                .false;
+            (0, chai_1.expect)(config.getRefreshToken()).to.equal("theirs");
+        }));
+        it("breaks a lock left behind by a process that died holding it", () => __awaiter(void 0, void 0, void 0, function* () {
+            const config = write({
+                jwtAccessToken: NEARLY_DEAD_TOKEN,
+                refreshToken: "ours",
+            });
+            const lockPath = `${configPath}.lock`;
+            fs_1.default.writeFileSync(lockPath, "a crashed process");
+            const longAgo = (Date.now() - refresh_1.REFRESH_LOCK_STALE_MS - 1000) / 1000;
+            fs_1.default.utimesSync(lockPath, longAgo, longAgo);
+            fetchStub.resolves(jsonResponse({ access_token: FRESH_TOKEN }));
+            const started = Date.now();
+            (0, chai_1.expect)(yield (0, refresh_1.ensureFreshTokens)(config)).to.eql({ status: "fresh" });
+            (0, chai_1.expect)(Date.now() - started).to.be.below(1000);
+            (0, chai_1.expect)(fetchStub.calledOnce).to.equal(true);
+            (0, chai_1.expect)(config.getApiAccessToken()).to.equal(FRESH_TOKEN);
+            (0, chai_1.expect)(fs_1.default.existsSync(lockPath)).to.equal(false);
+        }));
+        // Nathan's setup: the folder holding ~/.cred is read-only. The lock is
+        // skipped, Auth0 renews, and then the save fails. That used to throw a
+        // bare EACCES out of a function whose callers expect an outcome.
+        it("returns offline, naming the fix, when the renewed token cannot be saved", function () {
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                if (process.platform === "win32" || ((_a = process.getuid) === null || _a === void 0 ? void 0 : _a.call(process)) === 0) {
+                    this.skip(); // chmod does not stop root, and means nothing on Windows
+                }
+                const config = write({
+                    jwtAccessToken: NEARLY_DEAD_TOKEN,
+                    refreshToken: "ours",
+                });
+                fetchStub.resolves(jsonResponse({ access_token: FRESH_TOKEN }));
+                const dir = path_1.default.dirname(configPath);
+                fs_1.default.chmodSync(dir, 0o555);
+                try {
+                    (0, chai_1.expect)(yield (0, refresh_1.ensureFreshTokens)(config)).to.eql({
+                        status: "offline",
+                        reason: `Renewed your session, but could not save it to ${configPath} (EACCES).`,
+                        retry: `Make ${dir} writable, then run the command again.`,
+                    });
+                    (0, chai_1.expect)(config.getApiAccessToken()).to.equal(NEARLY_DEAD_TOKEN);
+                }
+                finally {
+                    fs_1.default.chmodSync(dir, 0o755);
+                }
+            });
+        });
+        // Before, a stale lock that could not be removed sent the loop straight
+        // back to the create, synchronously, forever: 100% CPU and no output.
+        it("renews without the lock when a stale lock cannot be removed", () => __awaiter(void 0, void 0, void 0, function* () {
+            const config = write({
+                jwtAccessToken: NEARLY_DEAD_TOKEN,
+                refreshToken: "ours",
+            });
+            const lockPath = `${configPath}.lock`;
+            fs_1.default.writeFileSync(lockPath, "a crashed process");
+            const longAgo = (Date.now() - refresh_1.REFRESH_LOCK_STALE_MS - 1000) / 1000;
+            fs_1.default.utimesSync(lockPath, longAgo, longAgo);
+            const realRename = fs_1.default.renameSync;
+            sinon_1.default.stub(fs_1.default, "renameSync").callsFake((from, to) => {
+                if (from === lockPath) {
+                    throw Object.assign(new Error("permission denied"), {
+                        code: "EACCES",
+                    });
+                }
+                realRename(from, to);
+            });
+            fetchStub.resolves(jsonResponse({ access_token: FRESH_TOKEN }));
+            const started = Date.now();
+            (0, chai_1.expect)(yield (0, refresh_1.ensureFreshTokens)(config)).to.eql({ status: "fresh" });
+            (0, chai_1.expect)(Date.now() - started).to.be.below(1000);
+            (0, chai_1.expect)(config.getApiAccessToken()).to.equal(FRESH_TOKEN);
+        }));
+    });
+});
+//# sourceMappingURL=refresh.spec.js.map

package/dist/setup-core/refresh.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.spec.js","sourceRoot":"","sources":["../../src/setup-core/refresh.spec.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+BAA8B;AAC9B,4CAAoB;AACpB,4CAAoB;AACpB,6CAAkC;AAClC,kDAA0B;AAC1B,2CAAkD;AAClD,iDAAmD;AACnD,uCAImB;AAEnB,MAAM,IAAI,GAAG,gCAAiB,CAAC,UAAU,CAAC;AAE1C,SAAS,GAAG,CAAC,MAA+B;IACzC,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAC7B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5D,OAAO,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;AAC5E,CAAC;AAED,uDAAuD;AACvD,SAAS,qBAAqB,CAAC,OAAe;IAC3C,OAAO,GAAG,CAAC;QACR,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO;KAC9C,CAAC,CAAC;AACN,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,IAAI,UAAkB,CAAC;AACvB,IAAI,iBAAyB,CAAC;AAC9B,IAAI,WAAmB,CAAC;AAExB,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IAChC,UAAU,CAAC,GAAG,EAAE;QACb,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACzC,iBAAiB,GAAG,qBAAqB,CAAC,8BAAoB,GAAG,EAAE,CAAC,CAAC;QACrE,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAI,UAAkB,CAAC;IACvB,IAAI,SAA0B,CAAC;IAE/B,UAAU,CAAC,GAAG,EAAE;QACb,UAAU,GAAG,IAAA,WAAI,EAAC,YAAE,CAAC,WAAW,CAAC,IAAA,WAAI,EAAC,YAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1E,SAAS,GAAG,eAAK,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACZ,eAAK,CAAC,OAAO,EAAE,CAAC;QAChB,YAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,YAAE,CAAC,MAAM,CAAC,GAAG,UAAU,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,SAAS,KAAK,CAAC,SAAkC;QAC9C,YAAE,CAAC,aAAa,CACb,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;YACZ,oBAAoB,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;YAC/C,iBAAiB,EAAE,YAAY;SACjC,CAAC,CACJ,CAAC;QACF,OAAO,IAAI,+BAAmB,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IAED,kDAAkD;IAClD,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;QAC9C,OAAO;YACJ,MAAM;YACN,IAAI,EAAE,GAAS,EAAE,gDAAC,OAAA,IAAI,CAAA,GAAA;SACD,CAAC;IAC5B,CAAC;IAED,EAAE,CAAC,gEAAgE,EAAE,GAAS,EAAE;QAC7E,MAAM,MAAM,GAAG,KAAK,CAAC;YAClB,cAAc,EAAE,UAAU;YAC1B,YAAY,EAAE,GAAG;SACnB,CAAC,CAAC;QACH,IAAA,aAAM,EAAC,MAAM,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACpE,IAAA,aAAM,EAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAA,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAS,EAAE;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,MAAM,GAAG,KAAK,CAAC;YAClB,cAAc,EAAE,iBAAiB;YACjC,YAAY,EAAE,GAAG;SACnB,CAAC,CAAC;QACH,SAAS,CAAC,QAAQ,CACf,YAAY,CAAC;YACV,YAAY,EAAE,WAAW;YACzB,QAAQ,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;SACvC,CAAC,CACJ,CAAC;QAEF,IAAA,aAAM,EAAC,MAAM,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACpE,IAAA,aAAM,EAAC,SAAS,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAA,aAAM,EAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAC1C,GAAG,IAAI,CAAC,MAAM,cAAc,CAC9B,CAAC;QACF,IAAA,aAAM,EAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC;YAC1D,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,aAAa,EAAE,GAAG;SACpB,CAAC,CAAC;QACH,IAAA,aAAM,EAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5D,CAAC,CAAA,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAS,EAAE;QACnE,MAAM,MAAM,GAAG,KAAK,CAAC;YAClB,cAAc,EAAE,iBAAiB;YACjC,YAAY,EAAE,KAAK;SACrB,CAAC,CAAC;QACH,SAAS,CAAC,QAAQ,CACf,YAAY,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CACnE,CAAC;QAEF,MAAM,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC;QAChC,IAAA,aAAM,EAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC,CAAA,CAAC,CAAC;IAEH,4EAA4E;IAC5E,0EAA0E;IAC1E,+DAA+D;IAC/D,EAAE,CAAC,mEAAmE,EAAE,GAAS,EAAE;QAChF,YAAE,CAAC,aAAa,CACb,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;YACZ,oBAAoB,EAAE;gBACnB,UAAU,EAAE;oBACT,cAAc,EAAE,iBAAiB;oBACjC,YAAY,EAAE,GAAG;iBACnB;gBACD,OAAO,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE;aACxC;YACD,iBAAiB,EAAE,YAAY;SACjC,CAAC,CACJ,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,+BAAmB,CAAC,UAAU,CAAC,CAAC;QACnD,SAAS,CAAC,SAAS,CAAC,GAAS,EAAE;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;YACnC,YAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,OAAO,YAAY,CAAC;gBACjB,YAAY,EAAE,WAAW;gBACzB,aAAa,EAAE,KAAK;aACtB,CAAC,CAAC;QACN,CAAC,CAAA,CAAC,CAAC;QAEH,IAAA,aAAM,EAAC,MAAM,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAEpE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9D,IAAA,aAAM,EAAC,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1E,IAAA,aAAM,EAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC;YAC9C,YAAY,EAAE,WAAW;SAC3B,CAAC,CAAC;IACN,CAAC,CAAA,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAS,EAAE;QACvE,MAAM,MAAM,GAAG,KAAK,CAAC;YAClB,cAAc,EAAE,iBAAiB;YACjC,YAAY,EAAE,SAAS;SACzB,CAAC,CAAC;QACH,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QAE7D,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC;QAChD,IAAA,aAAM,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAA,aAAM,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvE,uEAAuE;QACvE,2DAA2D;QAC3D,IAAA,aAAM,EAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvD,IAAA,aAAM,EAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC,CAAA,CAAC,CAAC;IAEH,2EAA2E;IAC3E,0DAA0D;IAC1D,EAAE,CAAC,uEAAuE,EAAE,GAAS,EAAE;QACpF,MAAM,MAAM,GAAG,KAAK,CAAC;YAClB,YAAY,EAAE,MAAM;YACpB,OAAO,EAAE,WAAW;YACpB,WAAW,EAAE,iBAAiB;YAC9B,cAAc,EAAE,iBAAiB;YACjC,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,SAAS;SACzB,CAAC,CAAC;QACH,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QAE7D,IAAA,aAAM,EAAC,CAAC,MAAM,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAExE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9D,IAAA,aAAM,EAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACtD,IAAA,aAAM,EAAC,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC;YACjD,YAAY,EAAE,MAAM;YACpB,OAAO,EAAE,WAAW;SACtB,CAAC,CAAC;IACN,CAAC,CAAA,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAS,EAAE;QAC7E,qEAAqE;QACrE,uEAAuE;QACvE,6DAA6D;QAC7D,EAAE;QACF,2EAA2E;QAC3E,kEAAkE;QAClE,2EAA2E;QAC3E,QAAQ;QACR,MAAM,MAAM,GAAG,KAAK,CAAC;YAClB,cAAc,EAAE,iBAAiB;YACjC,YAAY,EAAE,MAAM;YACpB,YAAY,EAAE,MAAM;YACpB,OAAO,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,SAAS,CAAC,SAAS,CAAC,GAAS,EAAE;YAC5B,wDAAwD;YACxD,KAAK,CAAC;gBACH,cAAc,EAAE,WAAW;gBAC3B,YAAY,EAAE,uBAAuB;gBACrC,YAAY,EAAE,MAAM;gBACpB,OAAO,EAAE,WAAW;aACtB,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QACnD,CAAC,CAAA,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC;QAEhD,IAAA,aAAM,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,IAAA,aAAM,EAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACnE,IAAA,aAAM,EAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACzD,IAAA,aAAM,EAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClD,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC,CAAA,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAS,EAAE;QACtF,wEAAwE;QACxE,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,MAAM,GAAG,KAAK,CAAC;YAClB,cAAc,EAAE,iBAAiB;YACjC,YAAY,EAAE,MAAM;SACtB,CAAC,CAAC;QACH,SAAS,CAAC,SAAS,CAAC,GAAS,EAAE;YAC5B,KAAK,CAAC,EAAE,cAAc,EAAE,iBAAiB,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/D,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QACnD,CAAC,CAAA,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC;QAEhD,IAAA,aAAM,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAA,aAAM,EAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC,CAAA,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAS,EAAE;QAC1D,MAAM,MAAM,GAAG,KAAK,CAAC;YAClB,cAAc,EAAE,iBAAiB;YACjC,YAAY,EAAE,GAAG;SACnB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,EAAE;YAC/D,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;SAC9B,CAAC,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE3B,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC;QAChD,IAAA,aAAM,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3C,yCAAyC;QACzC,IAAA,aAAM,EAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC/D,IAAA,aAAM,EAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,mDAAmD;QACnD,IAAA,aAAM,EAAC,YAAE,CAAC,UAAU,CAAC,GAAG,UAAU,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAA,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,GAAS,EAAE;QACxF,MAAM,MAAM,GAAG,KAAK,CAAC;YAClB,cAAc,EAAE,iBAAiB;YACjC,YAAY,EAAE,GAAG;SACnB,CAAC,CAAC;QACH,SAAS,CAAC,QAAQ,CACf,YAAY,CAAC;YACV,KAAK,EAAE,mBAAmB;YAC1B,iBAAiB,EAAE,cAAc;SACnC,CAAC,CACJ,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC;QAChD,IAAA,aAAM,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACzE,IAAA,aAAM,EAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAClE,CAAC,CAAA,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAS,EAAE;QACtE,MAAM,aAAa,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,IAAA,2BAAiB,EAAC,aAAa,CAAC,CAAC;QACrD,IAAA,aAAM,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAA,aAAM,EAAC,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAExE,MAAM,YAAY,GAAG,KAAK,CAAC;YACxB,cAAc,EAAE,qBAAqB,CAAC,CAAC,EAAE,CAAC;YAC1C,YAAY,EAAE,MAAM;YACpB,OAAO,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAiB,EAAC,YAAY,CAAC,CAAC;QACrD,IAAA,aAAM,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7C,IAAA,aAAM,EAAC,MAAM,CAAC;aACV,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC1B,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QACtC,8DAA8D;QAC9D,uEAAuE;QACvE,IAAA,aAAM,EAAC,YAAY,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxD,IAAA,aAAM,EAAC,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACxD,IAAA,aAAM,EAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAA,CAAC,CAAC;IAEH,4EAA4E;IAC5E,0EAA0E;IAC1E,kDAAkD;IAClD,EAAE,CAAC,qDAAqD,EAAE,GAAS,EAAE;QAClE,MAAM,MAAM,GAAG,KAAK,CAAC;YAClB,WAAW,EAAE,iBAAiB;YAC9B,qBAAqB,EAAE,KAAK;YAC5B,YAAY,EAAE,MAAM;SACtB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC;QAChD,IAAA,aAAM,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACjD,IAAA,aAAM,EAAC,OAAO,CAAC;aACX,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC1B,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QACtC,IAAA,aAAM,EAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC/D,IAAA,aAAM,EAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClD,IAAA,aAAM,EAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAA,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAS,EAAE;QACnD,MAAM,MAAM,GAAG,KAAK,CAAC;YAClB,WAAW,EAAE,UAAU;YACvB,qBAAqB,EAAE,IAAI;SAC7B,CAAC,CAAC;QACH,IAAA,aAAM,EAAC,MAAM,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC;YAC5C,MAAM,EAAE,iBAAiB;SAC3B,CAAC,CAAC;QACH,IAAA,aAAM,EAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3D,CAAC,CAAA,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAS,EAAE;QACvF,MAAM,MAAM,GAAG,KAAK,CAAC;YAClB,cAAc,EAAE,iBAAiB;YACjC,YAAY,EAAE,GAAG;SACnB,CAAC,CAAC;QACH,SAAS,CAAC,QAAQ,CAAC;YAChB,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,GAAS,EAAE;gBACd,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/B,CAAC,CAAA;SACoB,CAAC,CAAC;QAE1B,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC;QAChD,IAAA,aAAM,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAClE,CAAC,CAAA,CAAC,CAAC;IAEH,0EAA0E;IAC1E,4EAA4E;IAC5E,gEAAgE;IAChE,uDAAuD;IACvD,EAAE,CAAC,iFAAiF,EAAE,GAAS,EAAE;QAC9F,MAAM,MAAM,GAAG,KAAK,CAAC;YAClB,cAAc,EAAE,iBAAiB;YACjC,YAAY,EAAE,GAAG;SACnB,CAAC,CAAC;QACH,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAElE,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC;QAChD,IAAA,aAAM,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAC,OAAO,CAAC;aACX,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC1B,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;QAClD,IAAA,aAAM,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChE,oDAAoD;QACpD,IAAA,aAAM,EAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC/D,IAAA,aAAM,EAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC,CAAA,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAS,EAAE;QAC7E,MAAM,MAAM,GAAG,KAAK,CAAC;YAClB,cAAc,EAAE,iBAAiB;YACjC,YAAY,EAAE,GAAG;SACnB,CAAC,CAAC;QACH,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAEhE,MAAM,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC;QAEhC,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAgB,CAAC;QACxD,IAAA,aAAM,EAAC,IAAI,CAAC,MAAM,EAAE,qCAAqC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CACpE,SAAS,CACX,CAAC;IACL,CAAC,CAAA,CAAC,CAAC;IACH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC/B,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAC1B,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAErD,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,EAAE,CAAC,sDAAsD,EAAE,GAAS,EAAE;YACnE,MAAM,KAAK,GAAG,KAAK,CAAC;gBACjB,cAAc,EAAE,iBAAiB;gBACjC,YAAY,EAAE,MAAM;gBACpB,YAAY,EAAE,MAAM;aACtB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,+BAAmB,CAAC,UAAU,CAAC,CAAC;YACnD,SAAS,CAAC,SAAS,CAAC,GAAS,EAAE;gBAC5B,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;gBACjB,OAAO,YAAY,CAAC;oBACjB,YAAY,EAAE,WAAW;oBACzB,aAAa,EAAE,SAAS;iBAC1B,CAAC,CAAC;YACN,CAAC,CAAA,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChC,IAAA,2BAAiB,EAAC,KAAK,CAAC;gBACxB,IAAA,2BAAiB,EAAC,MAAM,CAAC;aAC3B,CAAC,CAAC;YAEH,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YACpE,IAAA,aAAM,EAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxC,IAAA,aAAM,EAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACrD,IAAA,aAAM,EAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC,CAAA,CAAC,CAAC;QAEH,EAAE,CAAC,6DAA6D,EAAE,GAAS,EAAE;YAC1E,MAAM,MAAM,GAAG,KAAK,CAAC;gBAClB,cAAc,EAAE,iBAAiB;gBACjC,YAAY,EAAE,MAAM;aACtB,CAAC,CAAC;YACH,YAAE,CAAC,aAAa,CAAC,GAAG,UAAU,OAAO,EAAE,iBAAiB,CAAC,CAAC;YAE1D,MAAM,UAAU,GAAG,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YACjB,qEAAqE;YACrE,KAAK,CAAC,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC/D,YAAE,CAAC,UAAU,CAAC,GAAG,UAAU,OAAO,CAAC,CAAC;YAEpC,IAAA,aAAM,EAAC,MAAM,UAAU,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACrD,IAAA,aAAM,EAAC,SAAS,CAAC,MAAM,EAAE,uCAAuC,CAAC,CAAC,EAAE,CAAC,EAAE;iBACnE,KAAK,CAAC;YACV,IAAA,aAAM,EAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvD,CAAC,CAAA,CAAC,CAAC;QAEH,EAAE,CAAC,6DAA6D,EAAE,GAAS,EAAE;YAC1E,MAAM,MAAM,GAAG,KAAK,CAAC;gBAClB,cAAc,EAAE,iBAAiB;gBACjC,YAAY,EAAE,MAAM;aACtB,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,GAAG,UAAU,OAAO,CAAC;YACtC,YAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,+BAAqB,GAAG,IAAK,CAAC,GAAG,IAAI,CAAC;YACpE,YAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC1C,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YAEhE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAA,aAAM,EAAC,MAAM,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAEpE,IAAA,aAAM,EAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAK,CAAC,CAAC;YAChD,IAAA,aAAM,EAAC,SAAS,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAA,aAAM,EAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACzD,IAAA,aAAM,EAAC,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,CAAC,CAAA,CAAC,CAAC;QAEH,uEAAuE;QACvE,uEAAuE;QACvE,iEAAiE;QACjE,EAAE,CAAC,yEAAyE,EAAE;;;gBAC3E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAA,MAAA,OAAO,CAAC,MAAM,uDAAI,MAAK,CAAC,EAAE,CAAC;oBAC5D,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,yDAAyD;gBACzE,CAAC;gBACD,MAAM,MAAM,GAAG,KAAK,CAAC;oBAClB,cAAc,EAAE,iBAAiB;oBACjC,YAAY,EAAE,MAAM;iBACtB,CAAC,CAAC;gBACH,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;gBAChE,MAAM,GAAG,GAAG,cAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBACrC,YAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACzB,IAAI,CAAC;oBACF,IAAA,aAAM,EAAC,MAAM,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC;wBAC5C,MAAM,EAAE,SAAS;wBACjB,MAAM,EAAE,kDAAkD,UAAU,YAAY;wBAChF,KAAK,EAAE,QAAQ,GAAG,wCAAwC;qBAC5D,CAAC,CAAC;oBACH,IAAA,aAAM,EAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBAClE,CAAC;wBAAS,CAAC;oBACR,YAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC5B,CAAC;YACJ,CAAC;SAAA,CAAC,CAAC;QAEH,wEAAwE;QACxE,sEAAsE;QACtE,EAAE,CAAC,6DAA6D,EAAE,GAAS,EAAE;YAC1E,MAAM,MAAM,GAAG,KAAK,CAAC;gBAClB,cAAc,EAAE,iBAAiB;gBACjC,YAAY,EAAE,MAAM;aACtB,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,GAAG,UAAU,OAAO,CAAC;YACtC,YAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,+BAAqB,GAAG,IAAK,CAAC,GAAG,IAAI,CAAC;YACpE,YAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,YAAE,CAAC,UAAU,CAAC;YACjC,eAAK,CAAC,IAAI,CAAC,YAAE,EAAE,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;gBACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,EAAE;wBACjD,IAAI,EAAE,QAAQ;qBAChB,CAAC,CAAC;gBACN,CAAC;gBACD,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC;YACH,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YAEhE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAA,aAAM,EAAC,MAAM,IAAA,2BAAiB,EAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAEpE,IAAA,aAAM,EAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAK,CAAC,CAAC;YAChD,IAAA,aAAM,EAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC5D,CAAC,CAAA,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;AACN,CAAC,CAAC,CAAC"}