@indemn/cli 1.7.7 → 1.7.8

package/dist/sdk/access.d.ts

@@ -0,0 +1,60 @@
+import { IndemnClient } from './client.js';
+/**
+ * What the signed-in person may do, as copilot-server reports it
+ * (GET /auth/me/access). Display information only: copilot-server and
+ * darwin-service still decide every request. The CLI uses it to hide MCP
+ * tools the person can't use anywhere and to explain refusals by role.
+ * Unknown access (older server, offline) hides nothing.
+ */
+export interface AccessProject {
+    project_id: string;
+    name: string | null;
+    role: string;
+    capabilities: string[];
+}
+export interface AccessOrg {
+    org_id: string;
+    org_name: string;
+    role: string | null;
+    is_org_admin: boolean;
+    capabilities: string[];
+    projects: AccessProject[];
+}
+export interface Access {
+    user: {
+        id: string;
+        email: string;
+        name: string | null;
+    };
+    is_indemn_staff: boolean;
+    capabilities: string[];
+    orgs: AccessOrg[];
+    fetched_at?: string;
+}
+type Scope = 'user' | 'org' | 'project';
+/** MCP tools whose use depends on a role, staff email or org setting (copilot config/cliCapabilities.js). */
+export declare const TOOL_REQUIRES: Readonly<Record<string, {
+    scope: Scope;
+    capability: string;
+}>>;
+/** The last known access: this process's, else the one saved with the login (config credential only). */
+export declare function currentAccess(client?: IndemnClient): Access | null;
+/** Forget the in-process copy (tests, logout). */
+export declare function resetAccess(): void;
+/**
+ * Ask copilot again. Saved with the login only when the credential is the saved
+ * login; a host's session (INDEMN_TOKEN) never writes to this machine's config.
+ * Returns null when it can't be read (older server, offline): callers then hide nothing.
+ */
+export declare function refreshAccess(client: IndemnClient): Promise<Access | null>;
+/** True unless access is known and says the tool can't be used in any org/project in view. */
+export declare function usableSomewhere(tool: string, access: Access | null, onlyOrgId?: string): boolean;
+/** The person's role in an org, for messages ("agent in Acme"). */
+export declare function roleIn(access: Access | null, orgId: string | undefined): string | null;
+/**
+ * For org-scoped requirements: why this org can't be used, or null. Project-scoped
+ * requirements are decided by the server (the project comes from the agent).
+ */
+export declare function orgDenial(tool: string, access: Access | null, orgId: string | undefined): string | null;
+export {};
+//# sourceMappingURL=access.d.ts.map

package/dist/sdk/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/sdk/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACzD,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,KAAK,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;AAExC,6GAA6G;AAC7G,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAcvF,CAAC;AAIH,yGAAyG;AACzG,wBAAgB,aAAa,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAKlE;AAiBD,kDAAkD;AAClD,wBAAgB,WAAW,IAAI,IAAI,CAElC;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWhF;AAMD,8FAA8F;AAC9F,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAOhG;AAED,mEAAmE;AACnE,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAKtF;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAgBvG"}

package/dist/sdk/access.js

@@ -0,0 +1,115 @@
+import { IndemnClient } from './client.js';
+/** MCP tools whose use depends on a role, staff email or org setting (copilot config/cliCapabilities.js). */
+export const TOOL_REQUIRES = Object.freeze({
+    create_sandbox_org: { scope: 'user', capability: 'org:sandbox_create' },
+    set_org_admin_settings: { scope: 'user', capability: 'org:admin_settings' },
+    get_conversation: { scope: 'project', capability: 'conversations:read' },
+    chat_with_agent: { scope: 'project', capability: 'conversations:read' },
+    mark_conversation_test: { scope: 'project', capability: 'conversations:mark_test' },
+    list_tickets: { scope: 'org', capability: 'tickets' },
+    get_ticket: { scope: 'org', capability: 'tickets' },
+    create_ticket: { scope: 'org', capability: 'tickets' },
+    update_ticket: { scope: 'org', capability: 'tickets' },
+    archive_ticket: { scope: 'org', capability: 'tickets' },
+    list_ticket_rules: { scope: 'org', capability: 'tickets' },
+    save_ticket_rule: { scope: 'org', capability: 'tickets' },
+    delete_ticket_rule: { scope: 'org', capability: 'tickets' },
+});
+let memo = null;
+/** The last known access: this process's, else the one saved with the login (config credential only). */
+export function currentAccess(client) {
+    if (memo)
+        return memo;
+    // A host session (INDEMN_TOKEN) may be a different identity than the saved login; don't use its access.
+    const source = (client ?? new IndemnClient()).getCredential()?.source;
+    return source === 'config' ? IndemnClient.loadConfig()?.access ?? null : null;
+}
+/** Defend against a malformed payload: every array field defaults to empty, bad orgs are dropped. */
+function normalize(raw) {
+    const strings = (v) => (Array.isArray(v) ? v.filter((x) => typeof x === 'string') : []);
+    const orgs = (Array.isArray(raw.orgs) ? raw.orgs : [])
+        .filter((o) => Boolean(o) && typeof o.org_id === 'string')
+        .map((o) => ({
+        ...o,
+        capabilities: strings(o.capabilities),
+        projects: (Array.isArray(o.projects) ? o.projects : [])
+            .filter((pr) => Boolean(pr) && typeof pr.project_id === 'string')
+            .map((pr) => ({ ...pr, capabilities: strings(pr.capabilities) })),
+    }));
+    return { capabilities: strings(raw.capabilities), orgs };
+}
+/** Forget the in-process copy (tests, logout). */
+export function resetAccess() {
+    memo = null;
+}
+/**
+ * Ask copilot again. Saved with the login only when the credential is the saved
+ * login; a host's session (INDEMN_TOKEN) never writes to this machine's config.
+ * Returns null when it can't be read (older server, offline): callers then hide nothing.
+ */
+export async function refreshAccess(client) {
+    try {
+        const raw = await client.copilotGet('/auth/me/access');
+        if (!raw || !Array.isArray(raw.orgs))
+            return null;
+        const stamped = { ...raw, ...normalize(raw), fetched_at: new Date().toISOString() };
+        memo = stamped;
+        if (client.getCredential()?.source === 'config')
+            IndemnClient.saveConfig({ access: stamped });
+        return stamped;
+    }
+    catch {
+        return null;
+    }
+}
+function orgsInView(access, onlyOrgId) {
+    return onlyOrgId ? access.orgs.filter((o) => o.org_id === onlyOrgId) : access.orgs;
+}
+/** True unless access is known and says the tool can't be used in any org/project in view. */
+export function usableSomewhere(tool, access, onlyOrgId) {
+    const rule = TOOL_REQUIRES[tool];
+    if (!rule || !access)
+        return true;
+    if (rule.scope === 'user')
+        return access.capabilities.includes(rule.capability);
+    const orgs = orgsInView(access, onlyOrgId);
+    if (rule.scope === 'org')
+        return orgs.some((o) => o.capabilities.includes(rule.capability));
+    return orgs.some((o) => o.projects.some((p) => p.capabilities.includes(rule.capability)));
+}
+/** The person's role in an org, for messages ("agent in Acme"). */
+export function roleIn(access, orgId) {
+    if (!access || !orgId)
+        return null;
+    const org = access.orgs.find((o) => o.org_id === orgId);
+    if (!org)
+        return null;
+    return `${org.role ?? 'member'} in ${org.org_name}`;
+}
+/**
+ * For org-scoped requirements: why this org can't be used, or null. Project-scoped
+ * requirements are decided by the server (the project comes from the agent).
+ */
+export function orgDenial(tool, access, orgId) {
+    const rule = TOOL_REQUIRES[tool];
+    if (!rule || !access || rule.scope === 'project')
+        return null;
+    if (rule.scope === 'user') {
+        if (access.capabilities.includes(rule.capability))
+            return null;
+        return rule.capability === 'org:sandbox_create'
+            ? 'Only the Indemn support account can create sandbox organizations.'
+            : 'This is for Indemn staff only.';
+    }
+    if (!orgId)
+        return null;
+    const org = access.orgs.find((o) => o.org_id === orgId);
+    if (!org)
+        return null; // not in the list: let the server answer
+    if (org.capabilities.includes(rule.capability))
+        return null;
+    return rule.capability === 'tickets'
+        ? `Tickets are not turned on for ${org.org_name}.`
+        : `Your role (${org.role ?? 'member'} in ${org.org_name}) does not allow this.`;
+}
+//# sourceMappingURL=access.js.map

package/dist/sdk/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/sdk/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAmC3C,6GAA6G;AAC7G,MAAM,CAAC,MAAM,aAAa,GAAmE,MAAM,CAAC,MAAM,CAAC;IACzG,kBAAkB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE;IACvE,sBAAsB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE;IAC3E,gBAAgB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE;IACxE,eAAe,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE;IACvE,sBAAsB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,yBAAyB,EAAE;IACnF,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE;IACrD,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE;IACnD,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE;IACtD,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE;IACtD,cAAc,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE;IACvD,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE;IAC1D,gBAAgB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE;IACzD,kBAAkB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE;CAC5D,CAAC,CAAC;AAEH,IAAI,IAAI,GAAkB,IAAI,CAAC;AAE/B,yGAAyG;AACzG,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,wGAAwG;IACxG,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC;IACtE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChF,CAAC;AAED,qGAAqG;AACrG,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,OAAO,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxH,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,MAAM,CAAC,CAAC,CAAC,EAAkB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;SACzE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,GAAG,CAAC;QACJ,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;QACrC,QAAQ,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,MAAM,CAAC,CAAC,EAAE,EAAuB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ,CAAC;aACrF,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;KACpE,CAAC,CAAC,CAAC;IACN,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,WAAW;IACzB,IAAI,GAAG,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAoB;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAS,iBAAiB,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,OAAO,GAAW,EAAE,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5F,IAAI,GAAG,OAAO,CAAC;QACf,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE,MAAM,KAAK,QAAQ;YAAE,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9F,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,SAAkB;IACpD,OAAO,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;AACrF,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAAqB,EAAE,SAAkB;IACrF,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,MAAM,CAAC,MAAqB,EAAE,KAAyB;IACrE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,QAAQ,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,MAAqB,EAAE,KAAyB;IACtF,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC1B,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/D,OAAO,IAAI,CAAC,UAAU,KAAK,oBAAoB;YAC7C,CAAC,CAAC,mEAAmE;YACrE,CAAC,CAAC,gCAAgC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,yCAAyC;IAChE,IAAI,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,IAAI,CAAC,UAAU,KAAK,SAAS;QAClC,CAAC,CAAC,iCAAiC,GAAG,CAAC,QAAQ,GAAG;QAClD,CAAC,CAAC,cAAc,GAAG,CAAC,IAAI,IAAI,QAAQ,OAAO,GAAG,CAAC,QAAQ,wBAAwB,CAAC;AACpF,CAAC"}

package/dist/sdk/auth.d.ts

@@ -1,4 +1,5 @@
 import type { Credential } from './credentials.js';
+import { type BrowserLoginOptions } from './browser-login.js';
 import type { Environment, EnvironmentHosts, OrgSummary } from './types.js';
 export declare const FIREBASE_CONFIGS: Record<Environment, Record<string, string>>;
 export type FirebaseSignIn = (email: string, password: string, env: Environment) => Promise<{
@@ -21,6 +22,12 @@ export declare function login(email: string, password: string, env?: Environment
     mfaCodePrompt?: () => Promise<string>;
     firebaseSignIn?: FirebaseSignIn;
 }): Promise<LoginResult>;
+/**
+ * Log in through the browser: the dashboard's sign-in (with the emailed code when
+ * the account uses it) approves this computer, and the CLI gets its own 24-hour
+ * session. Same storage and same rules as the password login.
+ */
+export declare function loginWithBrowser(env?: Environment, opts?: BrowserLoginOptions): Promise<LoginResult>;
 /** Revoke the session on the server, then forget it locally. */
 export declare function logout(): Promise<{
     revoked: boolean;

package/dist/sdk/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/sdk/auth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI5E,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBxE,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAWvI,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAE,WAAmB,EAAE,IAAI,CAAC,EAAE;IAC5F,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC,GAAG,OAAO,CAAC,WAAW,CAAC,CA2BvB;AAED,gEAAgE;AAChE,wBAAsB,MAAM,IAAI,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAc5D;AAED,MAAM,WAAW,MAAM;IACrB,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,SAAS,GAAG,SAAS,CAAC;IAClC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED,yCAAyC;AACzC,wBAAgB,MAAM,IAAI,MAAM,GAAG,IAAI,CAgBtC;AAED,mHAAmH;AACnH,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAMhH"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/sdk/auth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAiB,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI5E,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBxE,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAWvI,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAE,WAAmB,EAAE,IAAI,CAAC,EAAE;IAC5F,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC,GAAG,OAAO,CAAC,WAAW,CAAC,CAUvB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,GAAE,WAAmB,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAGjH;AA2BD,gEAAgE;AAChE,wBAAsB,MAAM,IAAI,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAe5D;AAED,MAAM,WAAW,MAAM;IACrB,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,SAAS,GAAG,SAAS,CAAC;IAClC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED,yCAAyC;AACzC,wBAAgB,MAAM,IAAI,MAAM,GAAG,IAAI,CAgBtC;AAED,mHAAmH;AACnH,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAMhH"}

package/dist/sdk/auth.js

@@ -2,6 +2,8 @@ import { initializeApp, getApp } from '@firebase/app';
 import { getAuth, signInWithEmailAndPassword } from '@firebase/auth';
 import { DEFAULT_HOSTS, IndemnClient } from './client.js';
 import { exchangeIdToken, toStoredSession } from './session.js';
+import { browserSignIn } from './browser-login.js';
+import { refreshAccess, resetAccess } from './access.js';
 // Firebase client configs per environment — public configuration (not secrets),
 // bundled the same way the Copilot Dashboard bundles them via envsubst
 export const FIREBASE_CONFIGS = {
@@ -44,6 +46,19 @@ export async function login(email, password, env = 'dev', opts) {
     const { idToken } = await (opts?.firebaseSignIn ?? firebaseSignIn)(email, password, env);
     const unauth = new IndemnClient({ environment: env });
     const session = await exchangeIdToken((path, body, headers) => unauth.copilotPostUnauth(path, body, headers), idToken, opts?.mfaCodePrompt);
+    return saveLogin(env, { ...session, email: session.email ?? email });
+}
+/**
+ * Log in through the browser: the dashboard's sign-in (with the emailed code when
+ * the account uses it) approves this computer, and the CLI gets its own 24-hour
+ * session. Same storage and same rules as the password login.
+ */
+export async function loginWithBrowser(env = 'dev', opts) {
+    const session = await browserSignIn(env, opts);
+    return saveLogin(env, session);
+}
+/** Keep a fresh copilot session with the person's orgs, replacing any earlier login. */
+async function saveLogin(env, session) {
     // Which orgs this person belongs to, asked with the new session itself.
     const authed = new IndemnClient({ environment: env, token: session.token });
     const res = await authed.copilotGet('/organization');
@@ -53,12 +68,15 @@ export async function login(email, password, env = 'dev', opts) {
     IndemnClient.saveConfig({
         environment: env,
         user_id: session.userId,
-        email: session.email ?? email,
+        email: session.email,
         session: stored,
         orgs,
         hosts: DEFAULT_HOSTS,
     });
-    return { userId: session.userId, email: session.email ?? email, environment: env, orgs, expiresAt: stored.expires_at };
+    // What the person may do, kept with the login (best effort: an older server has no such endpoint).
+    resetAccess();
+    await refreshAccess(new IndemnClient({ environment: env }));
+    return { userId: session.userId, email: session.email ?? '', environment: env, orgs, expiresAt: stored.expires_at };
 }
 /** Revoke the session on the server, then forget it locally. */
 export async function logout() {
@@ -75,6 +93,7 @@ export async function logout() {
         }
     }
     IndemnClient.clearConfig();
+    resetAccess();
     return { revoked };
 }
 /** Who and where, without any secret. */

package/dist/sdk/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/sdk/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAIhE,gFAAgF;AAChF,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAgD;IAC3E,GAAG,EAAE;QACH,MAAM,EAAE,yCAAyC;QACjD,UAAU,EAAE,8BAA8B;QAC1C,SAAS,EAAE,oBAAoB;QAC/B,aAAa,EAAE,wCAAwC;QACvD,iBAAiB,EAAE,eAAe;QAClC,KAAK,EAAE,4CAA4C;KACpD;IACD,UAAU,EAAE;QACV,MAAM,EAAE,yCAAyC;QACjD,UAAU,EAAE,oCAAoC;QAChD,SAAS,EAAE,oBAAoB;QAC/B,aAAa,EAAE,wCAAwC;QACvD,iBAAiB,EAAE,cAAc;QACjC,KAAK,EAAE,2CAA2C;KACnD;CACF,CAAC;AAIF,mFAAmF;AACnF,MAAM,cAAc,GAAmB,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;IACpE,MAAM,OAAO,GAAG,cAAc,GAAG,EAAE,CAAC;IACpC,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,GAAG,GAAG,aAAa,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACnF,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;AACrG,CAAC,CAAC;AAUF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,KAAa,EAAE,QAAgB,EAAE,MAAmB,KAAK,EAAE,IAGtF;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,cAAc,IAAI,cAAc,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAEzF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,eAAe,CACnC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EACtE,OAAO,EACP,IAAI,EAAE,aAAa,CACpB,CAAC;IAEF,wEAAwE;IACxE,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAA+D,eAAe,CAAC,CAAC;IACnH,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAE7F,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,YAAY,CAAC,WAAW,EAAE,CAAC;IAC3B,YAAY,CAAC,UAAU,CAAC;QACtB,WAAW,EAAE,GAAG;QAChB,OAAO,EAAE,OAAO,CAAC,MAAM;QACvB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK;QAC7B,OAAO,EAAE,MAAM;QACf,IAAI;QACJ,KAAK,EAAE,aAAa;KACrB,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;AACzH,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,MAAM;IAC1B,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YACrE,MAAM,MAAM,CAAC,iBAAiB,CAAC,uBAAuB,EAAE,SAAS,EAAE,EAAE,aAAa,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACrH,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;IACH,CAAC;IACD,YAAY,CAAC,WAAW,EAAE,CAAC;IAC3B,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAaD,yCAAyC;AACzC,MAAM,UAAU,MAAM;IACpB,MAAM,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC;IAC5C,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE;QACpC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS;QAC7C,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;QAChD,UAAU,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACzD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,gBAAgB,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS;QAC/F,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,WAAW,CAAC,IAA2D;IACrF,MAAM,MAAM,GAA2C,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC7J,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjD,OAAQ,MAAM,CAAC,IAAI,CAAC,MAAM,CAAmC;SAC1D,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC;SACrE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/sdk/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,aAAa,EAA4B,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGzD,gFAAgF;AAChF,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAgD;IAC3E,GAAG,EAAE;QACH,MAAM,EAAE,yCAAyC;QACjD,UAAU,EAAE,8BAA8B;QAC1C,SAAS,EAAE,oBAAoB;QAC/B,aAAa,EAAE,wCAAwC;QACvD,iBAAiB,EAAE,eAAe;QAClC,KAAK,EAAE,4CAA4C;KACpD;IACD,UAAU,EAAE;QACV,MAAM,EAAE,yCAAyC;QACjD,UAAU,EAAE,oCAAoC;QAChD,SAAS,EAAE,oBAAoB;QAC/B,aAAa,EAAE,wCAAwC;QACvD,iBAAiB,EAAE,cAAc;QACjC,KAAK,EAAE,2CAA2C;KACnD;CACF,CAAC;AAIF,mFAAmF;AACnF,MAAM,cAAc,GAAmB,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;IACpE,MAAM,OAAO,GAAG,cAAc,GAAG,EAAE,CAAC;IACpC,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,GAAG,GAAG,aAAa,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACnF,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;AACrG,CAAC,CAAC;AAUF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,KAAa,EAAE,QAAgB,EAAE,MAAmB,KAAK,EAAE,IAGtF;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,cAAc,IAAI,cAAc,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAEzF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,eAAe,CACnC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EACtE,OAAO,EACP,IAAI,EAAE,aAAa,CACpB,CAAC;IACF,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAmB,KAAK,EAAE,IAA0B;IACzF,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/C,OAAO,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,SAAS,CAAC,GAAgB,EAAE,OAA0D;IACnG,wEAAwE;IACxE,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAA+D,eAAe,CAAC,CAAC;IACnH,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAE7F,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,YAAY,CAAC,WAAW,EAAE,CAAC;IAC3B,YAAY,CAAC,UAAU,CAAC;QACtB,WAAW,EAAE,GAAG;QAChB,OAAO,EAAE,OAAO,CAAC,MAAM;QACvB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,MAAM;QACf,IAAI;QACJ,KAAK,EAAE,aAAa;KACrB,CAAC,CAAC;IAEH,mGAAmG;IACnG,WAAW,EAAE,CAAC;IACd,MAAM,aAAa,CAAC,IAAI,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAE5D,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;AACtH,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,MAAM;IAC1B,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YACrE,MAAM,MAAM,CAAC,iBAAiB,CAAC,uBAAuB,EAAE,SAAS,EAAE,EAAE,aAAa,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACrH,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;IACH,CAAC;IACD,YAAY,CAAC,WAAW,EAAE,CAAC;IAC3B,WAAW,EAAE,CAAC;IACd,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAaD,yCAAyC;AACzC,MAAM,UAAU,MAAM;IACpB,MAAM,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC;IAC5C,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE;QACpC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS;QAC7C,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;QAChD,UAAU,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACzD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,gBAAgB,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS;QAC/F,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,WAAW,CAAC,IAA2D;IACrF,MAAM,MAAM,GAA2C,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC7J,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjD,OAAQ,MAAM,CAAC,IAAI,CAAC,MAAM,CAAmC;SAC1D,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC;SACrE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/sdk/browser-login.d.ts

@@ -0,0 +1,49 @@
+import type { Environment } from './types.js';
+/**
+ * `indemn login` through the browser (OAuth-style loopback + PKCE):
+ * 1. listen on 127.0.0.1 (random port) and open the dashboard's /cli-login page
+ *    with a random `state` and the SHA-256 challenge of a secret verifier;
+ * 2. the person signs in there (with the emailed code if their account uses it)
+ *    and approves; the browser comes back to 127.0.0.1 with a one-time code;
+ * 3. the CLI trades code + verifier for its own 24-hour session.
+ * No token ever travels in a URL, and the verifier never leaves this process.
+ */
+export declare const LOGIN_TIMEOUT_MS: number;
+export interface Pkce {
+    verifier: string;
+    challenge: string;
+    state: string;
+}
+export declare function createPkce(): Pkce;
+/** The dashboard that serves /cli-login: INDEMN_DASHBOARD_URL, else the copilot host without `/api`. */
+export declare function dashboardUrl(copilotHost: string): string;
+export declare function approveUrl(dashboard: string, port: number, pkce: Pkce): string;
+export type CallbackResult = {
+    code: string;
+} | {
+    error: string;
+};
+export interface Loopback {
+    port: number;
+    /** First callback whose `state` matches; others are refused and ignored. */
+    result: Promise<CallbackResult>;
+    close: () => void;
+}
+/** Listen on 127.0.0.1 only, for one `GET /callback` carrying our `state`. */
+export declare function startLoopback(state: string, timeoutMs?: number): Promise<Loopback>;
+/** Open a URL in the default browser without a shell. Resolves false if nothing could be started. */
+export declare function openBrowser(url: string): Promise<boolean>;
+export interface BrowserLoginOptions {
+    /** Opens the approve page; defaults to the system browser. */
+    open?: (url: string) => Promise<boolean>;
+    /** Told the URL (always), so it can be opened by hand. */
+    showUrl?: (url: string, opened: boolean) => void;
+    timeoutMs?: number;
+}
+/** Run the browser flow; returns the copilot session (without the "JWT " prefix). */
+export declare function browserSignIn(env: Environment, opts?: BrowserLoginOptions): Promise<{
+    token: string;
+    userId: string;
+    email?: string;
+}>;
+//# sourceMappingURL=browser-login.d.ts.map

package/dist/sdk/browser-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-login.d.ts","sourceRoot":"","sources":["../../src/sdk/browser-login.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;;GAQG;AAEH,eAAO,MAAM,gBAAgB,QAAa,CAAC;AAE3C,MAAM,WAAW,IAAI;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,UAAU,IAAI,IAAI,CAKjC;AAQD,wGAAwG;AACxG,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAIxD;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,MAAM,CAG9E;AAED,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAOD,8EAA8E;AAC9E,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,GAAE,MAAyB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwE1G;AAED,qGAAqG;AACrG,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBzD;AAED,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,0DAA0D;IAC1D,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qFAAqF;AACrF,wBAAsB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAuBhJ"}

package/dist/sdk/browser-login.js

@@ -0,0 +1,159 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+import { IndemnClient } from './client.js';
+import { CliError, indemnHost } from '../core/runtime.js';
+/**
+ * `indemn login` through the browser (OAuth-style loopback + PKCE):
+ * 1. listen on 127.0.0.1 (random port) and open the dashboard's /cli-login page
+ *    with a random `state` and the SHA-256 challenge of a secret verifier;
+ * 2. the person signs in there (with the emailed code if their account uses it)
+ *    and approves; the browser comes back to 127.0.0.1 with a one-time code;
+ * 3. the CLI trades code + verifier for its own 24-hour session.
+ * No token ever travels in a URL, and the verifier never leaves this process.
+ */
+export const LOGIN_TIMEOUT_MS = 5 * 60_000;
+export function createPkce() {
+    const verifier = randomBytes(32).toString('base64url');
+    const challenge = createHash('sha256').update(verifier).digest('base64url');
+    const state = randomBytes(32).toString('base64url');
+    return { verifier, challenge, state };
+}
+function sameSecret(a, b) {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && timingSafeEqual(x, y);
+}
+/** The dashboard that serves /cli-login: INDEMN_DASHBOARD_URL, else the copilot host without `/api`. */
+export function dashboardUrl(copilotHost) {
+    const explicit = process.env.INDEMN_DASHBOARD_URL;
+    if (explicit)
+        return indemnHost(explicit, 'INDEMN_DASHBOARD_URL').replace(/\/+$/, '');
+    return copilotHost.replace(/\/+$/, '').replace(/\/api$/, '');
+}
+export function approveUrl(dashboard, port, pkce) {
+    const query = new URLSearchParams({ port: String(port), state: pkce.state, challenge: pkce.challenge });
+    return `${dashboard}/#/cli-login?${query.toString()}`;
+}
+const PAGE = (title, body) => `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head>` +
+    `<body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem">` +
+    `<h1 style="font-size:1.1rem">${title}</h1><p>${body}</p></body></html>`;
+/** Listen on 127.0.0.1 only, for one `GET /callback` carrying our `state`. */
+export async function startLoopback(state, timeoutMs = LOGIN_TIMEOUT_MS) {
+    let settle;
+    let fail;
+    const result = new Promise((resolve, reject) => {
+        settle = resolve;
+        fail = reject;
+    });
+    let done = false;
+    const server = createServer((req, res) => {
+        res.setHeader('Cache-Control', 'no-store');
+        res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        // The page has no subresources and echoes nothing; these just harden it.
+        res.setHeader('Referrer-Policy', 'no-referrer');
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        res.setHeader('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'");
+        // A raw socket can send a target that URL() rejects; never let that crash login.
+        let url;
+        try {
+            url = new URL(req.url ?? '/', 'http://127.0.0.1');
+        }
+        catch {
+            res.writeHead(400).end(PAGE('Bad request', 'Nothing to see here.'));
+            return;
+        }
+        // DNS-rebinding defence: only our own loopback Host is served.
+        const host = (req.headers.host ?? '').toLowerCase();
+        if (host && !/^(127\.0\.0\.1|localhost)(:\d+)?$/.test(host)) {
+            res.writeHead(400).end(PAGE('Bad request', 'Nothing to see here.'));
+            return;
+        }
+        if (req.method !== 'GET' || url.pathname !== '/callback' || done) {
+            res.writeHead(404).end(PAGE('Not found', 'Nothing to see here.'));
+            return;
+        }
+        const got = url.searchParams.get('state') ?? '';
+        if (!sameSecret(got, state)) {
+            res.writeHead(400).end(PAGE('Sign-in link mismatch', 'This sign-in did not come from your terminal. Run <code>indemn login</code> again.'));
+            return;
+        }
+        const code = url.searchParams.get('code');
+        const error = url.searchParams.get('error');
+        done = true;
+        if (code) {
+            res.writeHead(200).end(PAGE('Signed in to the Indemn CLI', 'You can close this tab and return to your terminal.'));
+            settle({ code });
+        }
+        else {
+            res.writeHead(200).end(PAGE('Sign-in cancelled', 'The CLI was not signed in. You can close this tab.'));
+            settle({ error: error || 'access_denied' });
+        }
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => resolve());
+    });
+    const { port } = server.address();
+    const timer = setTimeout(() => {
+        if (!done) {
+            done = true;
+            fail(new CliError('Timed out waiting for the browser (5 minutes). Run `indemn login` again.'));
+        }
+    }, timeoutMs);
+    timer.unref();
+    const close = () => {
+        clearTimeout(timer);
+        server.closeAllConnections?.();
+        server.close();
+    };
+    result.then(close, close);
+    return { port, result, close };
+}
+/** Open a URL in the default browser without a shell. Resolves false if nothing could be started. */
+export function openBrowser(url) {
+    const [cmd, args] = process.platform === 'darwin' ? ['open', [url]]
+        : process.platform === 'win32' ? ['rundll32', ['url.dll,FileProtocolHandler', url]]
+            : ['xdg-open', [url]];
+    return new Promise((resolve) => {
+        try {
+            const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+            child.once('error', () => resolve(false));
+            child.once('spawn', () => {
+                child.unref();
+                resolve(true);
+            });
+        }
+        catch {
+            resolve(false);
+        }
+    });
+}
+/** Run the browser flow; returns the copilot session (without the "JWT " prefix). */
+export async function browserSignIn(env, opts = {}) {
+    const client = new IndemnClient({ environment: env });
+    const pkce = createPkce();
+    const loop = await startLoopback(pkce.state, opts.timeoutMs);
+    try {
+        const url = approveUrl(dashboardUrl(client.getHosts().copilot), loop.port, pkce);
+        const opened = await (opts.open ?? openBrowser)(url);
+        opts.showUrl?.(url, opened);
+        const outcome = await loop.result;
+        if ('error' in outcome)
+            throw new CliError('Sign-in was cancelled in the browser.');
+        let res;
+        try {
+            res = await client.copilotPostUnauth('/auth/cli/token', { code: outcome.code, code_verifier: pkce.verifier });
+        }
+        catch {
+            throw new CliError('The sign-in code was not accepted (it may have expired). Run `indemn login` again.');
+        }
+        if (!res?.token || !res.user?._id)
+            throw new CliError('Sign-in returned no session. Run `indemn login` again.');
+        return { token: res.token.replace(/^JWT\s+/i, ''), userId: String(res.user._id), email: res.user.email };
+    }
+    finally {
+        loop.close();
+    }
+}
+//# sourceMappingURL=browser-login.js.map

package/dist/sdk/browser-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-login.js","sourceRoot":"","sources":["../../src/sdk/browser-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAG1D;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC;AAQ3C,MAAM,UAAU,UAAU;IACxB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAClD,IAAI,QAAQ;QAAE,OAAO,UAAU,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtF,OAAO,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE,IAAY,EAAE,IAAU;IACpE,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACxG,OAAO,GAAG,SAAS,gBAAgB,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;AACxD,CAAC;AAWD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,EAAE,CAC3C,2DAA2D,KAAK,iBAAiB;IACjF,iGAAiG;IACjG,gCAAgC,KAAK,WAAW,IAAI,oBAAoB,CAAC;AAE3E,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa,EAAE,YAAoB,gBAAgB;IACrF,IAAI,MAAoC,CAAC;IACzC,IAAI,IAAyB,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7D,MAAM,GAAG,OAAO,CAAC;QACjB,IAAI,GAAG,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;QAC1D,yEAAyE;QACzE,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAChD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,+CAA+C,CAAC,CAAC;QAC1F,iFAAiF;QACjF,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QACD,+DAA+D;QAC/D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,IAAI,IAAI,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,IAAI,EAAE,CAAC;YACjE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,oFAAoF,CAAC,CAAC,CAAC;YAC5I,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,GAAG,IAAI,CAAC;QACZ,IAAI,IAAI,EAAE,CAAC;YACT,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,qDAAqD,CAAC,CAAC,CAAC;YACnH,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,oDAAoD,CAAC,CAAC,CAAC;YACxG,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,eAAe,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IAEjD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,CAAC,IAAI,QAAQ,CAAC,0EAA0E,CAAC,CAAC,CAAC;QACjG,CAAC;IACH,CAAC,EAAE,SAAS,CAAC,CAAC;IACd,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACjC,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GACf,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YACjF,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAgB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACvB,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAUD,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAgB,EAAE,OAA4B,EAAE;IAClF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAE5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;QAClC,IAAI,OAAO,IAAI,OAAO;YAAE,MAAM,IAAI,QAAQ,CAAC,uCAAuC,CAAC,CAAC;QAEpF,IAAI,GAA6D,CAAC;QAClE,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAAC,oFAAoF,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG;YAAE,MAAM,IAAI,QAAQ,CAAC,wDAAwD,CAAC,CAAC;QAChH,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3G,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/sdk/client.d.ts

@@ -21,6 +21,8 @@ export declare class IndemnClient {
     private environment;
     private hosts;
     private resolvedOrg?;
+    /** The org `resolvedOrg` settled on, readable without waiting or asking. */
+    private settledOrgId?;
     private linkCache?;
     private membershipCache?;
     private ignoreLink;

package/dist/sdk/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/sdk/client.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,KAAK,EAAe,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEvG,OAAO,EAA0D,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE3G,OAAO,EAA4B,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAGpG,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,WAAW,EAAE,gBAAgB,CAa/D,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,KAAK,CAAC;AAIvC,KAAK,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAgB1D;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAMjH;AAMD,iEAAiE;AAEjE,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,kBAAkB,CAAoB;IAC9C,OAAO,CAAC,WAAW,CAAC,CAAS;IAC7B,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,KAAK,CAAmB;IAChC,OAAO,CAAC,WAAW,CAAC,CAAsB;IAC1C,OAAO,CAAC,SAAS,CAAC,CAAkB;IACpC,OAAO,CAAC,eAAe,CAAC,CAAe;IAEvC,OAAO,CAAC,UAAU,CAAU;gBAEhB,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,WAAW,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE;IAqBvH,yFAAyF;IACzF,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;IAI5C,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,YAAY,CAAC;IAS3C,6GAA6G;IAC7G,MAAM,CAAC,UAAU,IAAI,YAAY,GAAG,IAAI;IAoBxC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI;IActD,MAAM,CAAC,WAAW,IAAI,IAAI;IAK1B,cAAc,IAAI,WAAW;IAC7B,QAAQ,IAAI,gBAAgB;IAE5B,4GAA4G;IAC5G,aAAa,IAAI,UAAU,GAAG,IAAI;IAIlC,OAAO,CAAC,iBAAiB;IAMzB;;;OAGG;YACW,eAAe;IAiB7B,kHAAkH;IAClH,OAAO,CAAC,UAAU;YAOJ,UAAU;IAMxB,uEAAuE;IACvE,OAAO,IAAI,QAAQ,GAAG,IAAI;IAM1B,6HAA6H;IACvH,WAAW,CAAC,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAevE;;;OAGG;IACG,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IA2BxF,6FAA6F;IACvF,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAIrC,8EAA8E;IACxE,gBAAgB,IAAI,OAAO,CAAC;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,WAAW,CAAA;KAAE,CAAC;IAQnG;;;OAGG;IACH,OAAO,CAAC,kBAAkB;YAeZ,eAAe;IAQ7B,OAAO,CAAC,aAAa;IAIrB;;;;OAIG;YACW,IAAI;IA2ClB,OAAO,CAAC,SAAS;IASjB;;;OAGG;YACW,cAAc;IAM5B,uFAAuF;IACjF,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIxG,4EAA4E;IACtE,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAQ3G,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAIjF,WAAW,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIxE,4DAA4D;IACtD,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC;IAItE,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIjE,aAAa,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAI1D;;;;OAIG;IACG,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAwB1J,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAK/E,SAAS,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAKhE,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAK/D,WAAW,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAMlD,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAKlG,qBAAqB;YAiCrB,mBAAmB;CAOlC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/sdk/client.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAGxB,OAAO,KAAK,EAAe,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEvG,OAAO,EAAiF,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAElI,OAAO,EAA4B,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAGpG,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,WAAW,EAAE,gBAAgB,CAa/D,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,KAAK,CAAC;AAIvC,KAAK,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAgB1D;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAMjH;AAMD,iEAAiE;AAEjE,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,kBAAkB,CAAoB;IAC9C,OAAO,CAAC,WAAW,CAAC,CAAS;IAC7B,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,KAAK,CAAmB;IAChC,OAAO,CAAC,WAAW,CAAC,CAAsB;IAC1C,4EAA4E;IAC5E,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,OAAO,CAAC,SAAS,CAAC,CAAkB;IACpC,OAAO,CAAC,eAAe,CAAC,CAAe;IAEvC,OAAO,CAAC,UAAU,CAAU;gBAEhB,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,WAAW,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE;IAqBvH,yFAAyF;IACzF,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;IAI5C,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,YAAY,CAAC;IAS3C,6GAA6G;IAC7G,MAAM,CAAC,UAAU,IAAI,YAAY,GAAG,IAAI;IAqBxC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI;IAetD,MAAM,CAAC,WAAW,IAAI,IAAI;IAK1B,cAAc,IAAI,WAAW;IAC7B,QAAQ,IAAI,gBAAgB;IAE5B,4GAA4G;IAC5G,aAAa,IAAI,UAAU,GAAG,IAAI;IAIlC,OAAO,CAAC,iBAAiB;IAMzB;;;OAGG;YACW,eAAe;IAiB7B,kHAAkH;IAClH,OAAO,CAAC,UAAU;YAOJ,UAAU;IAMxB,uEAAuE;IACvE,OAAO,IAAI,QAAQ,GAAG,IAAI;IAM1B,6HAA6H;IACvH,WAAW,CAAC,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAevE;;;OAGG;IACG,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IA4BxF,6FAA6F;IACvF,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAIrC,8EAA8E;IACxE,gBAAgB,IAAI,OAAO,CAAC;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,WAAW,CAAA;KAAE,CAAC;IAQnG;;;OAGG;IACH,OAAO,CAAC,kBAAkB;YAeZ,eAAe;IAQ7B,OAAO,CAAC,aAAa;IAIrB;;;;OAIG;YACW,IAAI;IAiDlB,OAAO,CAAC,SAAS;IASjB;;;OAGG;YACW,cAAc;IAM5B,uFAAuF;IACjF,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIxG,4EAA4E;IACtE,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAQ3G,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAIjF,WAAW,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIxE,4DAA4D;IACtD,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC;IAItE,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIjE,aAAa,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAI1D;;;;OAIG;IACG,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAwB1J,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAK/E,SAAS,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAKhE,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAK/D,WAAW,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAMlD,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAKlG,qBAAqB;YAiCrB,mBAAmB;CAiBlC"}