@nebulr-group/bridge-cli 0.6.6 → 1.0.0-alpha.0

package/dist/commands/user.command.js

@@ -1,117 +0,0 @@
-import { getManagementClient, resolveTenantId } from '../config.js';
-import { outputSuccess, outputError } from '../output.js';
-import { resolveUserId } from '../resolve.js';
-import { dryRunPreview } from '../preview.js';
-import { DecisionNeededError, decisionField } from '../product-decisions.js';
-/**
- * TBP-713 — the role an invitee gets is the developer's decision. Without
- * --role the API would apply the app's default role (Member on a new app, often
- * Owner on older ones), so
- * stop and offer the role keys instead, naming the current default.
- */
-async function roleDecision() {
-    const field = decisionField('invite_user', 'role', '--role <key>');
-    try {
-        const roles = (await getManagementClient().roles.list());
-        const keys = roles.map((r) => r.key).filter((k) => typeof k === 'string');
-        const fallback = roles.find((r) => r.isDefault)?.key;
-        return new DecisionNeededError('bridge user invite', [keys.length ? { ...field, type: 'enum', options: keys } : field], fallback ? `The app's default role is ${fallback}; pass it explicitly if that is what the developer wants.` : undefined);
-    }
-    catch {
-        return new DecisionNeededError('bridge user invite', [field], '`bridge role list` shows the role keys.');
-    }
-}
-export function registerUserCommands(program) {
-    const user = program.command('user').description('Manage tenant users');
-    user.command('list')
-        .description('List users in a tenant')
-        .option('--tenant-id <id>', 'Tenant ID (or set BRIDGE_TENANT_ID)')
-        .action(async (opts) => {
-        try {
-            const tenantId = resolveTenantId(opts);
-            outputSuccess(await getManagementClient().users.list(tenantId));
-        }
-        catch (err) {
-            outputError(err);
-        }
-    });
-    user.command('get')
-        .description('Get user details by --email or --user-id')
-        .option('--email <email>', 'User email to address (alternative to --user-id)')
-        .option('--user-id <id>', 'User ID to address (alternative to --email)')
-        .option('--tenant-id <id>', 'Tenant ID (or set BRIDGE_TENANT_ID)')
-        .action(async (opts) => {
-        try {
-            const tenantId = resolveTenantId(opts);
-            const userId = await resolveUserId({ id: opts.userId, key: opts.email }, tenantId);
-            outputSuccess(await getManagementClient().users.get(tenantId, userId));
-        }
-        catch (err) {
-            outputError(err);
-        }
-    });
-    user.command('invite')
-        .description('Invite a user to a tenant')
-        .requiredOption('--email <email>', 'User email')
-        .option('--role <role>', 'Role key (see `bridge role list`). Required: which role invitees get is the developer\'s decision')
-        .option('--first-name <name>', 'First name')
-        .option('--last-name <name>', 'Last name')
-        .option('--tenant-id <id>', 'Tenant ID (or set BRIDGE_TENANT_ID)')
-        .action(async (opts) => {
-        try {
-            const tenantId = resolveTenantId(opts);
-            if (opts.role === undefined)
-                throw await roleDecision();
-            outputSuccess(await getManagementClient().users.invite(tenantId, {
-                username: opts.email,
-                role: opts.role,
-                firstName: opts.firstName,
-                lastName: opts.lastName,
-            }));
-        }
-        catch (err) {
-            outputError(err);
-        }
-    });
-    user.command('update')
-        .description('Update a user by --email or --user-id')
-        .option('--email <email>', 'User email to address (alternative to --user-id)')
-        .option('--user-id <id>', 'User ID to address (alternative to --email)')
-        .option('--role <role>', 'Role key')
-        .option('--enabled <bool>', 'Enable/disable user', (v) => v === 'true')
-        .option('--tenant-id <id>', 'Tenant ID (or set BRIDGE_TENANT_ID)')
-        .action(async (opts) => {
-        try {
-            const tenantId = resolveTenantId(opts);
-            const userId = await resolveUserId({ id: opts.userId, key: opts.email }, tenantId);
-            const data = Object.fromEntries(Object.entries({ role: opts.role, enabled: opts.enabled })
-                .filter(([, v]) => v !== undefined));
-            outputSuccess(await getManagementClient().users.update(tenantId, userId, data));
-        }
-        catch (err) {
-            outputError(err);
-        }
-    });
-    user.command('remove')
-        .description('Remove a user from a tenant by --email or --user-id')
-        .option('--email <email>', 'User email to address (alternative to --user-id)')
-        .option('--user-id <id>', 'User ID to address (alternative to --email)')
-        .option('--tenant-id <id>', 'Tenant ID (or set BRIDGE_TENANT_ID)')
-        .option('--dry-run', 'Show whether their login account goes too and whether they are the last owner, and remove nothing')
-        .action(async (opts) => {
-        try {
-            const tenantId = resolveTenantId(opts);
-            const userId = await resolveUserId({ id: opts.userId, key: opts.email }, tenantId);
-            if (opts.dryRun) {
-                outputSuccess(await dryRunPreview(`/v1/account/tenant/user/${encodeURIComponent(userId)}`, { 'x-tenant-id': tenantId }));
-                return;
-            }
-            await getManagementClient().users.remove(tenantId, userId);
-            outputSuccess({ removed: true, userId });
-        }
-        catch (err) {
-            outputError(err);
-        }
-    });
-}
-//# sourceMappingURL=user.command.js.map

package/dist/commands/user.command.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"user.command.js","sourceRoot":"","sources":["../../src/commands/user.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE7E;;;;;GAKG;AACH,KAAK,UAAU,YAAY;IACzB,MAAM,KAAK,GAAG,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAiD,CAAC;QACzG,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC;QACrD,OAAO,IAAI,mBAAmB,CAC5B,oBAAoB,EACpB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EACjE,QAAQ,CAAC,CAAC,CAAC,6BAA6B,QAAQ,2DAA2D,CAAC,CAAC,CAAC,SAAS,CACxH,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,mBAAmB,CAAC,oBAAoB,EAAE,CAAC,KAAK,CAAC,EAAE,yCAAyC,CAAC,CAAC;IAC3G,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAExE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;SACjB,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CAAC,kBAAkB,EAAE,qCAAqC,CAAC;SACjE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACvC,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;SAChB,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;SAC7E,MAAM,CAAC,gBAAgB,EAAE,6CAA6C,CAAC;SACvE,MAAM,CAAC,kBAAkB,EAAE,qCAAqC,CAAC;SACjE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;YACnF,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;SACnB,WAAW,CAAC,2BAA2B,CAAC;SACxC,cAAc,CAAC,iBAAiB,EAAE,YAAY,CAAC;SAC/C,MAAM,CAAC,eAAe,EAAE,mGAAmG,CAAC;SAC5H,MAAM,CAAC,qBAAqB,EAAE,YAAY,CAAC;SAC3C,MAAM,CAAC,oBAAoB,EAAE,WAAW,CAAC;SACzC,MAAM,CAAC,kBAAkB,EAAE,qCAAqC,CAAC;SACjE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,MAAM,YAAY,EAAE,CAAC;YACxD,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC/D,QAAQ,EAAE,IAAI,CAAC,KAAK;gBACpB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;SACnB,WAAW,CAAC,uCAAuC,CAAC;SACpD,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;SAC7E,MAAM,CAAC,gBAAgB,EAAE,6CAA6C,CAAC;SACvE,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;SACnC,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;SACtE,MAAM,CAAC,kBAAkB,EAAE,qCAAqC,CAAC;SACjE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAC7B,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;iBACvD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACtC,CAAC;YACF,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;SACnB,WAAW,CAAC,qDAAqD,CAAC;SAClE,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;SAC7E,MAAM,CAAC,gBAAgB,EAAE,6CAA6C,CAAC;SACvE,MAAM,CAAC,kBAAkB,EAAE,qCAAqC,CAAC;SACjE,MAAM,CAAC,WAAW,EAAE,mGAAmG,CAAC;SACxH,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;YACnF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,aAAa,CAAC,MAAM,aAAa,CAC/B,2BAA2B,kBAAkB,CAAC,MAAM,CAAC,EAAE,EACvD,EAAE,aAAa,EAAE,QAAQ,EAAE,CAC5B,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC3D,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/credentials.d.ts

@@ -1,141 +0,0 @@
-export interface StoredCredentials {
-    /** The JWT to send as `x-api-key`. Same shape as `BRIDGE_API_KEY`. */
-    apiKey: string;
-    /** ISO 8601 timestamp at which `apiKey` becomes invalid. */
-    expiresAt: string;
-    /** ISO 8601 timestamp the token was issued (for diagnostics). */
-    issuedAt: string;
-    /** App the token is scoped to. */
-    app: {
-        id: string;
-        name: string;
-    };
-    /** User who authorized the token. */
-    user: {
-        id: string;
-        email: string;
-    };
-    /** Base URL of the bridge-api this token is valid against. */
-    baseUrl: string;
-    /** Optional human-friendly label set via `bridge auth login --label`. */
-    label?: string;
-    /**
-     * TBP-769 — what the login covers, as chosen on the consent screen:
-     * `workspace` = every app of the workspace (`app` above is the HOME app),
-     * `app` = only `app`. Absent on credentials stored before TBP-769; those are
-     * treated as `app` until the server says otherwise.
-     */
-    appAccess?: 'app' | 'workspace';
-    /**
-     * TBP-769 — the app commands act on by default within a workspace login,
-     * set by `bridge app use`. Absent = the home app. Only ever an id + name:
-     * per-app tokens are fetched per run and never written to disk.
-     */
-    currentApp?: {
-        id: string;
-        name: string;
-    };
-}
-/** Current on-disk shape. See the module docstring for why it is a map. */
-export interface CredentialsFile {
-    version: 2;
-    /** App id of the credential commands use by default. `null` when empty. */
-    active: string | null;
-    /** All stored credentials, keyed by `app.id`. */
-    credentials: Record<string, StoredCredentials>;
-}
-/** One entry, as `bridge auth status` and the selector logic see it. */
-export interface CredentialEntry {
-    /** The map key — always `creds.app.id`. */
-    key: string;
-    creds: StoredCredentials;
-    isActive: boolean;
-}
-/**
- * Returns the absolute path to the credentials file based on the current
- * environment. Does not create directories or files — pure path resolution.
- *
- * Resolution (per XDG Base Directory spec):
- *   1. `$XDG_CONFIG_HOME/bridge/credentials.json` if XDG_CONFIG_HOME is set.
- *   2. `$HOME/.config/bridge/credentials.json` otherwise.
- *   3. `os.homedir()/.config/bridge/credentials.json` if HOME is unset
- *      (Windows / corner cases).
- *
- * We deliberately prefer `process.env.HOME` over `os.homedir()` because (a)
- * the XDG spec is defined in terms of `$HOME`, and (b) Node's `os.homedir()`
- * on some test runners (jest) bypasses the `HOME` env var via libuv, which
- * makes overriding it for tests impossible without a wrapper like this.
- */
-export declare function credentialsPath(): string;
-/**
- * Read the whole store, migrating a v1 file in memory. `null` if no file.
- *
- * Throws if the file exists but is unreadable or malformed — a corrupt store is
- * not the same as an absent one, and silently treating it as absent would make
- * `bridge auth status` report "not logged in" to somebody who very much is.
- */
-export declare function readCredentialsFile(): CredentialsFile | null;
-/**
- * The credential commands act on by default: the active one.
- *
- * Kept with its original name and signature because every existing caller wants
- * exactly this, and because "which credential is in force" is a question with
- * one answer whether the file holds one app or ten.
- */
-export declare function readCredentials(): StoredCredentials | null;
-/** Every stored credential, active one first, then by app name. */
-export declare function listCredentials(): CredentialEntry[];
-/** Raised when a selector matches nothing, or matches more than one entry. */
-export declare class CredentialSelectorError extends Error {
-    constructor(message: string);
-}
-/**
- * Find one stored credential by label, app id, or app name.
- *
- * Label first: users think in environments, not in 24-character object ids, and
- * `--label` exists precisely so they can name one. App id is exact and always
- * works. App name is last because two apps may share one.
- *
- * An ambiguous selector is an ERROR, never a first match. Picking one of two
- * candidate apps silently is the whole failure mode this ticket is about.
- */
-export declare function findCredential(selector: string): CredentialEntry;
-/**
- * Upsert a credential by app id and make it active.
- *
- * Same name and signature as before: `bridge auth login` still ends with one
- * call, and still leaves the app it just authorised in force.
- */
-export declare function writeCredentials(creds: StoredCredentials): void;
-/** Point the persisted default at an already-stored credential. Offline. */
-export declare function setActiveCredential(key: string): void;
-/**
- * Update fields of ONE stored credential in place (TBP-769: `currentApp`,
- * `appAccess`). `undefined` values remove the field. Does not move `active`.
- */
-export declare function updateCredential(key: string, patch: Partial<Pick<StoredCredentials, 'currentApp' | 'appAccess'>>): StoredCredentials;
-/** Persist the store atomically with mode 0600, dir 0700. */
-export declare function writeCredentialsFile(file: CredentialsFile): void;
-/**
- * Remove ONE credential. Deletes the file entirely when it was the last.
- *
- * Returns the remaining count so a caller can tell the user what is left.
- * Removing the active one moves `active` to another entry rather than leaving a
- * dangling pointer — with credentials still stored, "logged out of everything"
- * would be a lie.
- */
-export declare function removeCredential(key: string): number;
-/** Delete the whole credentials file. No-op if it does not exist. */
-export declare function deleteAllCredentials(): void;
-/**
- * Back-compat alias for the single-app era: remove the active credential.
- *
- * @deprecated Prefer `removeCredential(key)` or `deleteAllCredentials()`, which
- * say which of the two things they do.
- */
-export declare function deleteCredentials(): void;
-/**
- * True if the credentials' `expiresAt` is in the past relative to `now`.
- */
-export declare function isExpired(creds: StoredCredentials, now?: Date): boolean;
-//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AA6CA,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,qCAAqC;IACrC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,2EAA2E;IAC3E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAChD;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,iBAAiB,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAQxC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,eAAe,GAAG,IAAI,CAyB5D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAU1D;AAED,mEAAmE;AACnE,wBAAgB,eAAe,IAAI,eAAe,EAAE,CASnD;AAED,8EAA8E;AAC9E,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAmChE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAK/D;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAOrD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,WAAW,CAAC,CAAC,GAClE,iBAAiB,CAcnB;AAED,6DAA6D;AAC7D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CA4BhE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAWpD;AAED,qEAAqE;AACrE,wBAAgB,oBAAoB,IAAI,IAAI,CAQ3C;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAOxC;AAsBD;;GAEG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAInF"}

package/dist/credentials.js

@@ -1,348 +0,0 @@
-/**
- * Credentials file management for bridge-cli.
- *
- * Stores the long-lived CLI JWT obtained via `bridge auth login` so subsequent
- * commands can authenticate without `BRIDGE_API_KEY`. The token is sent to
- * bridge-api as `x-api-key: <jwt>` (same path as `BRIDGE_API_KEY`).
- *
- * Path resolution (XDG-compliant, RFC 8252-friendly):
- *   1. `$XDG_CONFIG_HOME/bridge/credentials.json` if env is set
- *   2. `~/.config/bridge/credentials.json` otherwise
- *
- * File mode: 0600 (owner read/write only). Containing dir created with 0700.
- *
- * ## The file holds MANY apps (TBP-628)
- *
- * It used to hold exactly one. Anyone running the same product as several apps
- * — one appId per environment — had to `logout` + `login` through the browser
- * to move between them, even though the token they already held had days left
- * on it. Worse, nothing in a read command's output said which app answered, so
- * a session holding a prod token could run `role list` believing it described
- * local, and the next step would have rewritten production roles.
- *
- * So the on-disk shape is now a map keyed by app id, plus a pointer at the
- * active one:
- *
- * ```json
- * {
- *   "version": 2,
- *   "active": "606b4416fabdc800087d09ec",
- *   "credentials": { "606b4416fabdc800087d09ec": { …StoredCredentials } }
- * }
- * ```
- *
- * Keyed by app id, not by label: the label is optional and user-chosen, so it
- * is a fine way to SELECT a credential and a bad way to key one.
- *
- * A v1 file (a bare `StoredCredentials` object) is migrated on read, in memory
- * only. Reading never rewrites the file — a read command must not mutate state
- * another process is reading. The v2 shape is persisted the next time
- * something writes.
- */
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import * as os from 'node:os';
-/**
- * Returns the absolute path to the credentials file based on the current
- * environment. Does not create directories or files — pure path resolution.
- *
- * Resolution (per XDG Base Directory spec):
- *   1. `$XDG_CONFIG_HOME/bridge/credentials.json` if XDG_CONFIG_HOME is set.
- *   2. `$HOME/.config/bridge/credentials.json` otherwise.
- *   3. `os.homedir()/.config/bridge/credentials.json` if HOME is unset
- *      (Windows / corner cases).
- *
- * We deliberately prefer `process.env.HOME` over `os.homedir()` because (a)
- * the XDG spec is defined in terms of `$HOME`, and (b) Node's `os.homedir()`
- * on some test runners (jest) bypasses the `HOME` env var via libuv, which
- * makes overriding it for tests impossible without a wrapper like this.
- */
-export function credentialsPath() {
-    const xdg = process.env.XDG_CONFIG_HOME?.trim();
-    if (xdg && xdg.length > 0) {
-        return path.join(xdg, 'bridge', 'credentials.json');
-    }
-    const home = process.env.HOME?.trim();
-    const base = home && home.length > 0 ? home : os.homedir();
-    return path.join(base, '.config', 'bridge', 'credentials.json');
-}
-/**
- * Read the whole store, migrating a v1 file in memory. `null` if no file.
- *
- * Throws if the file exists but is unreadable or malformed — a corrupt store is
- * not the same as an absent one, and silently treating it as absent would make
- * `bridge auth status` report "not logged in" to somebody who very much is.
- */
-export function readCredentialsFile() {
-    const filePath = credentialsPath();
-    if (!fs.existsSync(filePath))
-        return null;
-    const raw = fs.readFileSync(filePath, 'utf-8');
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        throw new Error(`Credentials file at ${filePath} is not valid JSON.`);
-    }
-    // v2 — the current shape.
-    if (isCredentialsFile(parsed))
-        return parsed;
-    // v1 — a bare StoredCredentials object. Migrate in memory; do NOT write.
-    if (isStoredCredentials(parsed)) {
-        return {
-            version: 2,
-            active: parsed.app.id,
-            credentials: { [parsed.app.id]: parsed },
-        };
-    }
-    throw new Error(`Credentials file at ${filePath} is missing required fields.`);
-}
-/**
- * The credential commands act on by default: the active one.
- *
- * Kept with its original name and signature because every existing caller wants
- * exactly this, and because "which credential is in force" is a question with
- * one answer whether the file holds one app or ten.
- */
-export function readCredentials() {
-    const file = readCredentialsFile();
-    if (!file)
-        return null;
-    if (file.active && file.credentials[file.active])
-        return file.credentials[file.active];
-    // A pointer at a credential that is gone. Fall back to the only entry if
-    // there is exactly one — otherwise there is no defensible default, and
-    // guessing would pick an app on the user's behalf, which is the failure this
-    // ticket exists to stop.
-    const keys = Object.keys(file.credentials);
-    return keys.length === 1 ? file.credentials[keys[0]] : null;
-}
-/** Every stored credential, active one first, then by app name. */
-export function listCredentials() {
-    const file = readCredentialsFile();
-    if (!file)
-        return [];
-    return Object.entries(file.credentials)
-        .map(([key, creds]) => ({ key, creds, isActive: key === file.active }))
-        .sort((a, b) => {
-        if (a.isActive !== b.isActive)
-            return a.isActive ? -1 : 1;
-        return a.creds.app.name.localeCompare(b.creds.app.name);
-    });
-}
-/** Raised when a selector matches nothing, or matches more than one entry. */
-export class CredentialSelectorError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'CredentialSelectorError';
-    }
-}
-/**
- * Find one stored credential by label, app id, or app name.
- *
- * Label first: users think in environments, not in 24-character object ids, and
- * `--label` exists precisely so they can name one. App id is exact and always
- * works. App name is last because two apps may share one.
- *
- * An ambiguous selector is an ERROR, never a first match. Picking one of two
- * candidate apps silently is the whole failure mode this ticket is about.
- */
-export function findCredential(selector) {
-    const needle = selector.trim();
-    if (!needle)
-        throw new CredentialSelectorError('Empty profile selector.');
-    const entries = listCredentials();
-    if (entries.length === 0) {
-        throw new CredentialSelectorError('No stored credentials. Run `bridge auth login` first.');
-    }
-    const lower = needle.toLowerCase();
-    const byLabel = entries.filter((e) => e.creds.label?.toLowerCase() === lower);
-    const byId = entries.filter((e) => e.key === needle);
-    const byName = entries.filter((e) => e.creds.app.name.toLowerCase() === lower);
-    for (const [what, matches] of [
-        ['label', byLabel],
-        ['app id', byId],
-        ['app name', byName],
-    ]) {
-        if (matches.length === 1)
-            return matches[0];
-        if (matches.length > 1) {
-            throw new CredentialSelectorError(`"${needle}" matches ${matches.length} stored credentials by ${what} ` +
-                `(${matches.map((m) => m.key).join(', ')}). Select by app id instead.`);
-        }
-    }
-    throw new CredentialSelectorError(`No stored credential matches "${needle}". Known: ` +
-        entries.map((e) => e.creds.label ?? e.creds.app.name).join(', ') +
-        '. Run `bridge auth status` to see them all.');
-}
-/**
- * Upsert a credential by app id and make it active.
- *
- * Same name and signature as before: `bridge auth login` still ends with one
- * call, and still leaves the app it just authorised in force.
- */
-export function writeCredentials(creds) {
-    const file = readCredentialsFileOrEmpty();
-    file.credentials[creds.app.id] = creds;
-    file.active = creds.app.id;
-    writeCredentialsFile(file);
-}
-/** Point the persisted default at an already-stored credential. Offline. */
-export function setActiveCredential(key) {
-    const file = readCredentialsFileOrEmpty();
-    if (!file.credentials[key]) {
-        throw new CredentialSelectorError(`No stored credential with app id ${key}.`);
-    }
-    file.active = key;
-    writeCredentialsFile(file);
-}
-/**
- * Update fields of ONE stored credential in place (TBP-769: `currentApp`,
- * `appAccess`). `undefined` values remove the field. Does not move `active`.
- */
-export function updateCredential(key, patch) {
-    const file = readCredentialsFileOrEmpty();
-    const existing = file.credentials[key];
-    if (!existing) {
-        throw new CredentialSelectorError(`No stored credential with app id ${key}.`);
-    }
-    const next = { ...existing };
-    for (const [k, v] of Object.entries(patch)) {
-        if (v === undefined)
-            delete next[k];
-        else
-            next[k] = v;
-    }
-    file.credentials[key] = next;
-    writeCredentialsFile(file);
-    return next;
-}
-/** Persist the store atomically with mode 0600, dir 0700. */
-export function writeCredentialsFile(file) {
-    const filePath = credentialsPath();
-    const dir = path.dirname(filePath);
-    // Create dir with restrictive perms. mkdirSync `mode` is masked by umask, so
-    // we explicitly chmod after to guarantee 0700 regardless of inherited umask.
-    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    try {
-        fs.chmodSync(dir, 0o700);
-    }
-    catch {
-        // chmod fails on Windows for non-NTFS fs — non-fatal there.
-    }
-    // Write to a tmp file then rename for atomicity. Open with mode 0600 from
-    // the start so the JWT is never world-readable, even briefly.
-    const tmpPath = `${filePath}.${process.pid}.tmp`;
-    const fd = fs.openSync(tmpPath, 'w', 0o600);
-    try {
-        fs.writeFileSync(fd, JSON.stringify(file, null, 2) + '\n');
-    }
-    finally {
-        fs.closeSync(fd);
-    }
-    try {
-        fs.chmodSync(tmpPath, 0o600);
-    }
-    catch {
-        // best-effort; openSync's mode arg already set perms.
-    }
-    fs.renameSync(tmpPath, filePath);
-}
-/**
- * Remove ONE credential. Deletes the file entirely when it was the last.
- *
- * Returns the remaining count so a caller can tell the user what is left.
- * Removing the active one moves `active` to another entry rather than leaving a
- * dangling pointer — with credentials still stored, "logged out of everything"
- * would be a lie.
- */
-export function removeCredential(key) {
-    const file = readCredentialsFileOrEmpty();
-    delete file.credentials[key];
-    const remaining = Object.keys(file.credentials);
-    if (remaining.length === 0) {
-        deleteAllCredentials();
-        return 0;
-    }
-    if (file.active === key)
-        file.active = remaining[0];
-    writeCredentialsFile(file);
-    return remaining.length;
-}
-/** Delete the whole credentials file. No-op if it does not exist. */
-export function deleteAllCredentials() {
-    const filePath = credentialsPath();
-    try {
-        fs.unlinkSync(filePath);
-    }
-    catch (err) {
-        if (err.code === 'ENOENT')
-            return;
-        throw err;
-    }
-}
-/**
- * Back-compat alias for the single-app era: remove the active credential.
- *
- * @deprecated Prefer `removeCredential(key)` or `deleteAllCredentials()`, which
- * say which of the two things they do.
- */
-export function deleteCredentials() {
-    const file = readCredentialsFileOrEmpty();
-    if (file.active) {
-        removeCredential(file.active);
-        return;
-    }
-    deleteAllCredentials();
-}
-/** The store, or an empty one — for the write paths, which create on demand. */
-function readCredentialsFileOrEmpty() {
-    try {
-        return readCredentialsFile() ?? { version: 2, active: null, credentials: {} };
-    }
-    catch {
-        // A corrupt file must not wedge `login` — overwriting it is how the user
-        // gets unstuck, and the token in it is unusable anyway.
-        return { version: 2, active: null, credentials: {} };
-    }
-}
-function isCredentialsFile(value) {
-    if (!value || typeof value !== 'object')
-        return false;
-    const v = value;
-    if (v.version !== 2)
-        return false;
-    if (v.active !== null && typeof v.active !== 'string')
-        return false;
-    if (!v.credentials || typeof v.credentials !== 'object')
-        return false;
-    return Object.values(v.credentials).every(isStoredCredentials);
-}
-/**
- * True if the credentials' `expiresAt` is in the past relative to `now`.
- */
-export function isExpired(creds, now = new Date()) {
-    const expiry = Date.parse(creds.expiresAt);
-    if (Number.isNaN(expiry))
-        return true;
-    return expiry <= now.getTime();
-}
-function isStoredCredentials(value) {
-    if (!value || typeof value !== 'object')
-        return false;
-    const v = value;
-    return (typeof v.apiKey === 'string' &&
-        typeof v.expiresAt === 'string' &&
-        typeof v.issuedAt === 'string' &&
-        typeof v.baseUrl === 'string' &&
-        typeof v.app === 'object' &&
-        v.app !== null &&
-        typeof v.app.id === 'string' &&
-        typeof v.app.name === 'string' &&
-        typeof v.user === 'object' &&
-        v.user !== null &&
-        typeof v.user.id === 'string' &&
-        typeof v.user.email === 'string');
-}
-//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAiD9B;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,qBAAqB,CAAC,CAAC;IACxE,CAAC;IAED,0BAA0B;IAC1B,IAAI,iBAAiB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAE7C,yEAAyE;IACzE,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;YACrB,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,8BAA8B,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,yEAAyE;IACzE,uEAAuE;IACvE,6EAA6E;IAC7E,yBAAyB;IACzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;SACtE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACP,CAAC;AAED,8EAA8E;AAC9E,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,uBAAuB,CAAC,yBAAyB,CAAC,CAAC;IAE1E,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,uBAAuB,CAC/B,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAE/E,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI;QAC5B,CAAC,OAAO,EAAE,OAAO,CAAC;QAClB,CAAC,QAAQ,EAAE,IAAI,CAAC;QAChB,CAAC,UAAU,EAAE,MAAM,CAAC;KACZ,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,uBAAuB,CAC/B,IAAI,MAAM,aAAa,OAAO,CAAC,MAAM,0BAA0B,IAAI,GAAG;gBACpE,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,uBAAuB,CAC/B,iCAAiC,MAAM,YAAY;QACjD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAChE,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAwB;IACvD,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC;IAC1C,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;IACvC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3B,oBAAoB,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAAC,oCAAoC,GAAG,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC;IAClB,oBAAoB,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,KAAmE;IAEnE,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,uBAAuB,CAAC,oCAAoC,GAAG,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,IAAI,GAAsB,EAAE,GAAG,QAAQ,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAyC,EAAE,CAAC;QACnF,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;;YAC9B,IAA2C,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAC7B,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,oBAAoB,CAAC,IAAqB;IACxD,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEnC,6EAA6E;IAC7E,6EAA6E;IAC7E,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;IAED,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACjD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7D,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IACD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC;IAC1C,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,oBAAoB,EAAE,CAAC;QACvB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;QAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACpD,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,SAAS,CAAC,MAAM,CAAC;AAC1B,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,oBAAoB;IAClC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC7D,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,oBAAoB,EAAE,CAAC;AACzB,CAAC;AAED,gFAAgF;AAChF,SAAS,0BAA0B;IACjC,IAAI,CAAC;QACH,OAAO,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,wDAAwD;QACxD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpE,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,WAAsC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAC5F,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,KAAwB,EAAE,MAAY,IAAI,IAAI,EAAE;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC9B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,CAAC,CAAC,GAAG,KAAK,IAAI;QACd,OAAQ,CAAC,CAAC,GAA+B,CAAC,EAAE,KAAK,QAAQ;QACzD,OAAQ,CAAC,CAAC,GAA+B,CAAC,IAAI,KAAK,QAAQ;QAC3D,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,CAAC,CAAC,IAAI,KAAK,IAAI;QACf,OAAQ,CAAC,CAAC,IAAgC,CAAC,EAAE,KAAK,QAAQ;QAC1D,OAAQ,CAAC,CAAC,IAAgC,CAAC,KAAK,KAAK,QAAQ,CAC9D,CAAC;AACJ,CAAC"}