@vendure/cloud 0.2.0 → 0.3.0

package/dist/cli/index.d.ts

@@ -0,0 +1,29 @@
+export { readSingleValue, requiredArgument, variadicArgument } from "./arguments.js";
+export { type CloudCommandDefinition, type CloudCommandGroup, type CloudCommandInput, type CloudCommandRun, defineCloudCommand, defineCloudCommandGroup, } from "./command.js";
+export { CLOUD_ROOT_OPTIONS, type CredentialOptions, type GlobalOptions, readGlobalOptions, } from "./root-options.js";
+export { type ApiClient, createApiClient } from "./lib/api-client.js";
+export { API_AUTH_CONFIG_TIMEOUT_MS, type AuthConfig, type AuthOrganization, type CliCredential, clearAuthConfig, exchangeRefreshToken, readAuthConfig, refreshAccessToken, resolveCredential, rotateActiveOrganization, SESSION_LOCK_OPTIONS, type TokenPair, WORKOS_AUTH_REQUEST_TIMEOUT_MS, withSessionLock, writeAuthConfig, } from "./lib/auth.js";
+export { AUTH_FILE, CONFIG_DIR, getApiUrl, REFRESH_LOCK_FILE, WORKOS_AUTHENTICATE_URL, WORKOS_DEVICE_AUTHORIZE_URL, } from "./lib/config.js";
+export { parseDotEnv } from "./lib/dotenv.js";
+export { CONTEXT_FILE, type ProjectContext, readContext, setActiveEnvironment, writeContext, } from "./lib/context.js";
+export { ApiError, ForeignCredentialError, formatCommandErrorMessage, RefreshTokenRejectedError, RefreshUnavailableError, reportCommandError, SessionRefreshError, SessionUnstorableError, toSessionRefreshError, } from "./lib/errors.js";
+export { type DeploymentResourceLabelContext, formatInlineUserFacingErrorReason, formatUserFacingErrorDetails, } from "./lib/error-output.js";
+export { type FileLockOptions, withFileLock } from "./lib/file-lock.js";
+export { formatBytes, formatDateTime, formatDuration, formatTable, writeJson, } from "./lib/format.js";
+export { DEFAULT_NODE_MAJOR, PACKAGE_MANAGERS, type PackageManager, type ResolvedBuildSettings, SUPPORTED_NODE_MAJORS, type SourceBuildSettings, type SourceBuildSettingsResponse, type SupportedNodeMajor, appDirSchema, sourceBuildSettingsSchema, } from "./lib/contract/build-settings.js";
+export type { CreateEnvironmentResponse, EnvironmentDetailsResponse, InitialSuperadminCredentials, } from "./lib/contract/deployments.js";
+export { DEFAULT_SERVER_HEALTH_CHECK_PATH, DEFAULT_SERVER_PORT, type DesiredStateResponse, type EnvironmentDesiredState, VC_ADDON_PLANS, VC_REGIONS, type VcAddonPlan, type VcRegion, environmentDesiredStateSchema, vcAddonPlanSchema, vcEnvironmentTypeSchema, vcRegionSchema, } from "./lib/contract/desired-state.js";
+export type { ProjectDetailsResponse, ProjectEnvironmentSummaryResponse, ProjectResponse, ResourceDeletionResponse, } from "./lib/contract/projects.js";
+export type { SourceBranchMappingDetails, SourceBranchMappingStatus, SourceDisconnectReason, SourceRepositoryLinkDetails, SourceRepositoryLinkStatus, SourceRepositorySummary, SourceTriggerReason, SourceTriggerStatus, VcsInstallationSummary, VcsLinkSessionResponse, VcsLinkSessionStatus, VcsLinkSessionStatusValue, } from "./lib/contract/source-repository.js";
+export { type Identifiable, isIdPrefix, resolveUniqueIdPrefix } from "./lib/id-prefix.js";
+export { CLOUD_INVOCATIONS, type CloudInvocation, cloudInvocation, setCloudInvocation, underCurrentInvocation, } from "./lib/invocation.js";
+export { logger, LOG_FILE_ENV_VAR, resolveLogFile } from "./lib/logger.js";
+export { openBrowser } from "./lib/open-browser.js";
+export { getAuthenticatedOrganizationSlug } from "./lib/organization.js";
+export { findProjectLink, findProjectRoot, PROJECT_LINK_DIR, PROJECT_LINK_FILENAME, type ProjectLink, readProjectLink, removeProjectLink, writeProjectLink, } from "./lib/project-link.js";
+export { createAuthenticatedClient, findEnvironmentOrNull, findProject, findProjectOrNull, listEnvironments, listProjects, resolveEnvironment, resolveProject, } from "./lib/resolve.js";
+export { getBranchMappingOrNull, getRepositoryLinkOrNull, } from "./lib/source-repository-link.js";
+export { slugToName, toSlug } from "./lib/slug.js";
+export { sleep } from "./lib/sleep.js";
+export { type Deployment, type DeploymentApplicationSource, type DeploymentSummary, type DeploymentSummaryAction, type DeploymentSummaryCleanup, type DeploymentSummaryCleanupFailure, type DeploymentSummaryResourceRef, type Environment, type EnvVarSummary, FAILED_STATUSES, type IdentityEnvironmentType, type PaginatedDeployments, type Project, type ProtectedResource, type RollbackTarget, type RuntimeIntent, type RuntimeState, SUCCESS_STATUSES, TERMINAL_STATUSES, type VcEnvironmentType, } from "./lib/types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,KAAK,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EACL,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,KAAK,SAAS,EACd,8BAA8B,EAC9B,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACL,YAAY,EACZ,KAAK,cAAc,EACnB,WAAW,EACX,oBAAoB,EACpB,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,QAAQ,EACR,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,8BAA8B,EACnC,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,WAAW,EACX,cAAc,EACd,cAAc,EACd,WAAW,EACX,SAAS,GACV,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,YAAY,EACZ,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC;AAG1C,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EACL,gCAAgC,EAChC,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,cAAc,EACd,UAAU,EACV,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,6BAA6B,EAC7B,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,GACf,MAAM,iCAAiC,CAAC;AAMzC,YAAY,EACV,sBAAsB,EACtB,iCAAiC,EACjC,eAAe,EACf,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AAIpC,YAAY,EACV,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,EACtB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,KAAK,YAAY,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EACL,iBAAiB,EACjB,KAAK,eAAe,EACpB,eAAe,EACf,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,WAAW,EAChB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EACL,KAAK,UAAU,EACf,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,+BAA+B,EACpC,KAAK,4BAA4B,EACjC,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,eAAe,EACf,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,iBAAiB,GACvB,MAAM,gBAAgB,CAAC"}

package/dist/cli/index.js

@@ -0,0 +1,60 @@
+// The boundary a hosted Cloud command family builds against.
+//
+// A command family owns a directory under `./commands/`, declares its commands with
+// `defineCloudCommand` and `defineCloudCommandGroup`, and reaches everything else it needs through
+// this module. Nothing in a family's directory should import `./lib/**` directly: this file is what
+// stays the same while the modules behind it move, and it is the list to add to — rather than
+// `./lib/**` to edit — when a family needs a primitive that is not here yet.
+//
+// This module is not part of the `@vendure/cloud` package's public exports. A Cloud application
+// imports `@vendure/cloud`, which is the Cloud Config surface and has nothing to do with the CLI.
+// The Vendure CLI host reaches the commands through `vendure.cliPlugin` instead.
+//
+// Importing this module pulls in the whole foundation, including `pino`, `zod` and
+// `@clack/prompts`. Do that from a command's `run`, not from the module that declares the command
+// tree — see `defineCloudCommand` for why, and `test/cli-published-surface.test.ts` for what holds
+// the line.
+//
+// What is deliberately not here, because one command family uses it rather than all of them:
+// build detection and the `init` flow, environment-variable preflight, the deploy plan renderer,
+// log streaming, and the initial superadmin. Those belong in the directory of the family that owns
+// them. `apps/cli/src/lib/` still holds each of them, as the version to port from.
+//
+// `update-check.ts` and `commands.ts` have no equivalent here on purpose: the host owns version
+// notices, and `commands.ts` existed to find or create a Commander command, which the declarative
+// tree replaces.
+//
+// A family that needs a primitive this module does not expose should add it here rather than reach
+// past it into `./lib/**`. A second copy of an authentication or output rule is the thing this
+// boundary exists to prevent, and one that starts as a local helper in a command directory is the
+// way it usually arrives. (CLO-684 established the boundary.)
+export { readSingleValue, requiredArgument, variadicArgument } from "./arguments.js";
+export { defineCloudCommand, defineCloudCommandGroup, } from "./command.js";
+export { CLOUD_ROOT_OPTIONS, readGlobalOptions, } from "./root-options.js";
+export { createApiClient } from "./lib/api-client.js";
+export { API_AUTH_CONFIG_TIMEOUT_MS, clearAuthConfig, exchangeRefreshToken, readAuthConfig, refreshAccessToken, resolveCredential, rotateActiveOrganization, SESSION_LOCK_OPTIONS, WORKOS_AUTH_REQUEST_TIMEOUT_MS, withSessionLock, writeAuthConfig, } from "./lib/auth.js";
+export { AUTH_FILE, CONFIG_DIR, getApiUrl, REFRESH_LOCK_FILE, WORKOS_AUTHENTICATE_URL, WORKOS_DEVICE_AUTHORIZE_URL, } from "./lib/config.js";
+export { parseDotEnv } from "./lib/dotenv.js";
+export { CONTEXT_FILE, readContext, setActiveEnvironment, writeContext, } from "./lib/context.js";
+export { ApiError, ForeignCredentialError, formatCommandErrorMessage, RefreshTokenRejectedError, RefreshUnavailableError, reportCommandError, SessionRefreshError, SessionUnstorableError, toSessionRefreshError, } from "./lib/errors.js";
+export { formatInlineUserFacingErrorReason, formatUserFacingErrorDetails, } from "./lib/error-output.js";
+export { withFileLock } from "./lib/file-lock.js";
+export { formatBytes, formatDateTime, formatDuration, formatTable, writeJson, } from "./lib/format.js";
+// The build-settings half of `config`, and the `appDir` rule `init` reads to place a detected app.
+export { DEFAULT_NODE_MAJOR, PACKAGE_MANAGERS, SUPPORTED_NODE_MAJORS, appDirSchema, sourceBuildSettingsSchema, } from "./lib/contract/build-settings.js";
+// Desired State: the schemas `config` validates against and the response it reads. The schemas are
+// runtime values, so this module is reached from inside a command's `run` and never from the module
+// that declares the command tree.
+export { DEFAULT_SERVER_HEALTH_CHECK_PATH, DEFAULT_SERVER_PORT, VC_ADDON_PLANS, VC_REGIONS, environmentDesiredStateSchema, vcAddonPlanSchema, vcEnvironmentTypeSchema, vcRegionSchema, } from "./lib/contract/desired-state.js";
+export { isIdPrefix, resolveUniqueIdPrefix } from "./lib/id-prefix.js";
+export { CLOUD_INVOCATIONS, cloudInvocation, setCloudInvocation, underCurrentInvocation, } from "./lib/invocation.js";
+export { logger, LOG_FILE_ENV_VAR, resolveLogFile } from "./lib/logger.js";
+export { openBrowser } from "./lib/open-browser.js";
+export { getAuthenticatedOrganizationSlug } from "./lib/organization.js";
+export { findProjectLink, findProjectRoot, PROJECT_LINK_DIR, PROJECT_LINK_FILENAME, readProjectLink, removeProjectLink, writeProjectLink, } from "./lib/project-link.js";
+export { createAuthenticatedClient, findEnvironmentOrNull, findProject, findProjectOrNull, listEnvironments, listProjects, resolveEnvironment, resolveProject, } from "./lib/resolve.js";
+export { getBranchMappingOrNull, getRepositoryLinkOrNull, } from "./lib/source-repository-link.js";
+export { slugToName, toSlug } from "./lib/slug.js";
+export { sleep } from "./lib/sleep.js";
+export { FAILED_STATUSES, SUCCESS_STATUSES, TERMINAL_STATUSES, } from "./lib/types.js";
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,oFAAoF;AACpF,mGAAmG;AACnG,oGAAoG;AACpG,8FAA8F;AAC9F,6EAA6E;AAC7E,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,iFAAiF;AACjF,EAAE;AACF,mFAAmF;AACnF,kGAAkG;AAClG,mGAAmG;AACnG,YAAY;AACZ,EAAE;AACF,6FAA6F;AAC7F,iGAAiG;AACjG,mGAAmG;AACnG,mFAAmF;AACnF,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,iBAAiB;AACjB,EAAE;AACF,mGAAmG;AACnG,+FAA+F;AAC/F,kGAAkG;AAClG,8DAA8D;AAE9D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,EAKL,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAGlB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAkB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EACL,0BAA0B,EAI1B,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EAEpB,8BAA8B,EAC9B,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACL,YAAY,EAEZ,WAAW,EACX,oBAAoB,EACpB,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,QAAQ,EACR,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAwB,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,WAAW,EACX,cAAc,EACd,cAAc,EACd,WAAW,EACX,SAAS,GACV,MAAM,iBAAiB,CAAC;AACzB,mGAAmG;AACnG,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAGhB,qBAAqB,EAIrB,YAAY,EACZ,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC;AAQ1C,mGAAmG;AACnG,oGAAoG;AACpG,kCAAkC;AAClC,OAAO,EACL,gCAAgC,EAChC,mBAAmB,EAGnB,cAAc,EACd,UAAU,EAGV,6BAA6B,EAC7B,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,GACf,MAAM,iCAAiC,CAAC;AA6BzC,OAAO,EAAqB,UAAU,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EACL,iBAAiB,EAEjB,eAAe,EACf,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EAErB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAUL,eAAe,EAQf,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,gBAAgB,CAAC"}

package/dist/cli/lib/api-client.d.ts

@@ -0,0 +1,19 @@
+interface ApiClientOptions {
+    baseUrl: string;
+    token?: string;
+    apiKey?: string;
+    organizationId?: string;
+    onUnauthorized?: (failedToken: string | undefined) => Promise<string>;
+}
+export interface ApiClient {
+    readonly organizationId?: string;
+    get<T>(path: string): Promise<T>;
+    post<T>(path: string, body?: unknown): Promise<T>;
+    put<T>(path: string, body?: unknown): Promise<T>;
+    patch<T>(path: string, body?: unknown): Promise<T>;
+    delete<T>(path: string): Promise<T>;
+    stream(path: string, signal?: AbortSignal): Promise<Response>;
+}
+export declare function createApiClient(options: ApiClientOptions): ApiClient;
+export {};
+//# sourceMappingURL=api-client.d.ts.map

package/dist/cli/lib/api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/api-client.ts"],"names":[],"mappings":"AAGA,UAAU,gBAAgB;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,cAAc,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,SAAS;IAIxB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC/D;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAuIpE"}

package/dist/cli/lib/api-client.js

@@ -0,0 +1,111 @@
+import { ApiError, toSessionRefreshError } from "./errors.js";
+import { logger } from "./logger.js";
+export function createApiClient(options) {
+    const { baseUrl, token, apiKey, organizationId, onUnauthorized } = options;
+    let currentToken = token;
+    let refreshPromise;
+    function buildHeaders(bearerToken) {
+        const headers = {};
+        if (apiKey) {
+            headers["x-api-key"] = apiKey;
+        }
+        else if (bearerToken) {
+            headers.authorization = `Bearer ${bearerToken}`;
+        }
+        if (organizationId) {
+            headers["x-organization-id"] = organizationId;
+        }
+        return headers;
+    }
+    async function doFetch(method, path, bearerToken, body, signal) {
+        const headers = buildHeaders(bearerToken);
+        if (body) {
+            headers["content-type"] = "application/json";
+        }
+        return fetch(`${baseUrl}${path}`, {
+            method,
+            headers,
+            body: body ? JSON.stringify(body) : undefined,
+            signal,
+        });
+    }
+    // The first of two dedup layers, and the only one this file can see. It collapses the concurrent
+    // 401s of one client into a single `refresh` call, keyed on the token that failed.
+    //
+    // `refresh` is `refreshAccessToken` in `auth.ts`, which dedups again on its own terms: a
+    // process-wide `activeRefresh` and, under that, a `refresh.lock` file that serializes the WorkOS
+    // exchange across processes. The two are not redundant — this one knows which request already
+    // retried, that one knows whether an exchange is in flight anywhere on the machine — but neither
+    // is enough alone, and the single-use refresh token that CLO-164 stranded is what both exist for.
+    async function getRetryToken(failedToken, refresh) {
+        if (currentToken !== failedToken) {
+            // Another request already refreshed; retry this stale 401 with the current token.
+            return currentToken;
+        }
+        if (!refreshPromise) {
+            refreshPromise = (async () => {
+                try {
+                    const refreshedToken = await refresh(failedToken);
+                    currentToken = refreshedToken;
+                    return refreshedToken;
+                }
+                catch (error) {
+                    // Keep the classified session errors intact — whether the failure
+                    // was definitive decides the message and whether credentials were
+                    // discarded. Anything unclassified keeps its cause for the logs.
+                    throw toSessionRefreshError(error);
+                }
+            })();
+        }
+        const activeRefresh = refreshPromise;
+        try {
+            return await activeRefresh;
+        }
+        finally {
+            // Let a later token expiry start a new refresh instead of reusing this settled result.
+            if (refreshPromise === activeRefresh) {
+                refreshPromise = undefined;
+            }
+        }
+    }
+    async function doAuthenticatedFetch(method, path, body, signal) {
+        const requestToken = currentToken;
+        const response = await doFetch(method, path, requestToken, body, signal);
+        if (response.status !== 401 || !onUnauthorized) {
+            return response;
+        }
+        const retryToken = await getRetryToken(requestToken, onUnauthorized);
+        return doFetch(method, path, retryToken, body, signal);
+    }
+    async function request(method, path, body) {
+        logger.debug({ method, path, body }, "API request");
+        const response = await doAuthenticatedFetch(method, path, body);
+        if (!response.ok) {
+            const responseBody = await response.json().catch(() => null);
+            logger.error({ method, path, status: response.status, responseBody }, "API error");
+            throw new ApiError(response.status, responseBody);
+        }
+        logger.debug({ method, path, status: response.status }, "API response");
+        return response.json();
+    }
+    async function stream(path, signal) {
+        logger.debug({ method: "GET", path }, "API stream request");
+        const response = await doAuthenticatedFetch("GET", path, undefined, signal);
+        if (!response.ok) {
+            const responseBody = await response.text().catch(() => null);
+            logger.error({ method: "GET", path, status: response.status, responseBody }, "API stream error");
+            throw new ApiError(response.status, responseBody);
+        }
+        return response;
+    }
+    return {
+        organizationId,
+        get: (path) => request("GET", path),
+        post: (path, body) => request("POST", path, body),
+        put: (path, body) => request("PUT", path, body),
+        patch: (path, body) => request("PATCH", path, body),
+        delete: (path) => request("DELETE", path),
+        stream,
+    };
+}
+//# sourceMappingURL=api-client.js.map

package/dist/cli/lib/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../../src/cli/lib/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAyBrC,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAC3E,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,cAA2C,CAAC;IAEhD,SAAS,YAAY,CAAC,WAAoB;QACxC,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC;QAChC,CAAC;aAAM,IAAI,WAAW,EAAE,CAAC;YACvB,OAAO,CAAC,aAAa,GAAG,UAAU,WAAW,EAAE,CAAC;QAClD,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,mBAAmB,CAAC,GAAG,cAAc,CAAC;QAChD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,OAAO,CACpB,MAAc,EACd,IAAY,EACZ,WAAoB,EACpB,IAAc,EACd,MAAoB;QAEpB,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QACD,OAAO,KAAK,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE;YAChC,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7C,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,iGAAiG;IACjG,mFAAmF;IACnF,EAAE;IACF,yFAAyF;IACzF,iGAAiG;IACjG,8FAA8F;IAC9F,iGAAiG;IACjG,kGAAkG;IAClG,KAAK,UAAU,aAAa,CAC1B,WAA+B,EAC/B,OAA6D;QAE7D,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;YACjC,kFAAkF;YAClF,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC3B,IAAI,CAAC;oBACH,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;oBAClD,YAAY,GAAG,cAAc,CAAC;oBAC9B,OAAO,cAAc,CAAC;gBACxB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,kEAAkE;oBAClE,kEAAkE;oBAClE,iEAAiE;oBACjE,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QAED,MAAM,aAAa,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACT,uFAAuF;YACvF,IAAI,cAAc,KAAK,aAAa,EAAE,CAAC;gBACrC,cAAc,GAAG,SAAS,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,UAAU,oBAAoB,CACjC,MAAc,EACd,IAAY,EACZ,IAAc,EACd,MAAoB;QAEpB,MAAM,YAAY,GAAG,YAAY,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QACrE,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,UAAU,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACpE,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAEhE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,WAAW,CAAC,CAAC;YACnF,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;QACxE,OAAO,QAAQ,CAAC,IAAI,EAAgB,CAAC;IACvC,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,MAAoB;QACtD,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAE5E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CACV,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAC9D,kBAAkB,CACnB,CAAC;YACF,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO;QACL,cAAc;QACd,GAAG,EAAE,CAAI,IAAY,EAAE,EAAE,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC;QACjD,IAAI,EAAE,CAAI,IAAY,EAAE,IAAc,EAAE,EAAE,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QACzE,GAAG,EAAE,CAAI,IAAY,EAAE,IAAc,EAAE,EAAE,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QACvE,KAAK,EAAE,CAAI,IAAY,EAAE,IAAc,EAAE,EAAE,CAAC,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;QAC3E,MAAM,EAAE,CAAI,IAAY,EAAE,EAAE,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC;QACvD,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/cli/lib/auth.d.ts

@@ -0,0 +1,132 @@
+import type { CredentialOptions } from "../root-options.js";
+import { type FileLockOptions } from "./file-lock.js";
+export interface AuthOrganization {
+    id: string;
+    workosOrgId: string;
+    name: string;
+    slug: string;
+    role: string;
+}
+export interface AuthConfig {
+    accessToken: string;
+    refreshToken: string;
+    user: {
+        id: string;
+        email: string;
+        name: string | null;
+    };
+    activeOrganizationId: string | null;
+    organizations: AuthOrganization[];
+}
+export interface TokenPair {
+    accessToken: string;
+    refreshToken: string;
+}
+export declare const API_AUTH_CONFIG_TIMEOUT_MS = 15000;
+export declare const WORKOS_AUTH_REQUEST_TIMEOUT_MS = 60000;
+/**
+ * The credential a single CLI invocation runs under.
+ *
+ * `apiKey` covers both `--token` and `VENDURE_CLOUD_TOKEN`: the control plane
+ * validates those as WorkOS API keys, resolves the organization they belong to
+ * itself, and never issues a refresh token for them. `session` is the stored
+ * browser login, which does have a refresh token and does carry an active
+ * organization the CLI selected locally.
+ */
+export type CliCredential = {
+    kind: "apiKey";
+    token: string;
+} | {
+    kind: "session";
+    token: string;
+    organizationId: string | null;
+};
+/**
+ * Precedence: the explicit `--token`, then `VENDURE_CLOUD_TOKEN`, then the
+ * stored session. Returns null when the machine has no credential at all, so
+ * each caller can word its own "not logged in" response.
+ *
+ * An explicitly supplied credential is never mixed with the stored session:
+ * spending the session's single-use refresh token on a credential that does
+ * not own it strands the login (CLO-164), and sending the locally selected
+ * organization alongside a key that resolves its own would contradict it.
+ *
+ * Throws rather than returns null for a credential another Vendure product
+ * issued. Someone who set `--token` to their project's environment credential
+ * has made a specific mistake, and falling back to the stored session would
+ * answer it with whatever that session happens to be — or with "not logged in",
+ * which is not what went wrong. Refusing here is also what keeps the value on
+ * the machine; the control plane refuses it again for callers that are not
+ * this CLI.
+ */
+export declare function resolveCredential(options: CredentialOptions): CliCredential | null;
+export declare function readAuthConfig(): AuthConfig | null;
+/**
+ * Write via a temp file + rename so the config is replaced atomically.
+ * A plain `writeFileSync` truncates in place: a crash mid-write leaves
+ * unparseable JSON, which reads back as "not logged in" while the rotated
+ * refresh token — already consumed at the authentication service — is gone
+ * for good. Rename is atomic within a directory, so a reader sees either the
+ * whole old config or the whole new one.
+ */
+export declare function writeAuthConfig(config: AuthConfig): void;
+export declare function clearAuthConfig(): void;
+/**
+ * Exchange a refresh token for a fresh access/refresh token pair via WorkOS.
+ *
+ * Pass `workosOrgId` to scope the new token to a specific organization:
+ * WorkOS bakes the user's role + permissions for that org into the access
+ * token's claims at issue time. Without it, WorkOS returns a token for the
+ * user's current/default org. This is the mechanism that keeps the JWT's
+ * `org_id` + `permissions` in step with the CLI's active org — see
+ * `org switch` and the multi-org branch of `login`.
+ *
+ * Note: `workosOrgId` is the WorkOS organization id (`org_…`), NOT the
+ * internal DB UUID stored in `AuthConfig.activeOrganizationId`.
+ */
+export declare function exchangeRefreshToken(refreshToken: string, workosOrgId?: string): Promise<TokenPair>;
+/**
+ * Exported so the `waitMs >= staleMs` invariant below can be asserted — it is
+ * the load-bearing relationship in this whole mechanism and nothing else
+ * enforces it.
+ *
+ * `staleMs` covers the worst case of both refresh requests timing out, so a
+ * waiter never breaks a lock that is still doing useful work.
+ *
+ * `waitMs` must not be shorter. A waiter that gives up early goes down the
+ * unlocked path *before* the holder has written its rotated pair, so the
+ * already-rotated checks below still see the old token and spend it a second
+ * time — the single-use double-spend this lock exists to prevent (CLO-164).
+ * Equality is what makes "gave up" and "the holder is dead" the same condition.
+ */
+export declare const SESSION_LOCK_OPTIONS: FileLockOptions;
+/**
+ * Serializes everything that spends the single-use refresh token or rewrites
+ * `auth.json`, across processes. Every such call site must go through this —
+ * guarding one of them leaves the double-spend fully reachable via the others.
+ *
+ * The callback receives whether the lock was actually held; see `withFileLock`.
+ */
+export declare function withSessionLock<T>(fn: (held: boolean) => Promise<T>): Promise<T>;
+/**
+ * Pass the access token that got the 401. If the stored config has moved on
+ * from it, another process (or an earlier command) already rotated the pair and
+ * its access token is reused — refresh tokens are single-use, so spending ours
+ * on a redundant exchange is what strands sessions. Reuse requires provable
+ * lifetime left; see `hasUsableLifetime`.
+ */
+export declare function refreshAccessToken(failedAccessToken?: string): Promise<string>;
+/**
+ * Re-mint the stored session scoped to a different organization, then persist
+ * it. The read-exchange-write runs as one locked unit and re-reads inside the
+ * lock: a concurrent refresh may have rotated the pair since the caller last
+ * looked, and spreading a stale snapshot over it would write back a refresh
+ * token the authentication service has already retired. Atomic rename stops
+ * torn files; it does nothing about lost updates.
+ */
+export declare function rotateActiveOrganization(target: {
+    organizationId: string;
+    workosOrgId: string;
+    organizations: AuthOrganization[];
+}): Promise<AuthConfig>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/cli/lib/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/auth.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAgB5D,OAAO,EAAE,KAAK,eAAe,EAAgB,MAAM,gBAAgB,CAAC;AAIpE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACzD,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,aAAa,EAAE,gBAAgB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,eAAO,MAAM,8BAA8B,QAAS,CAAC;AAErD;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEtE;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa,GAAG,IAAI,CAkBlF;AAED,wBAAgB,cAAc,IAAI,UAAU,GAAG,IAAI,CAUlD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAexD;AAmFD,wBAAgB,eAAe,IAAI,IAAI,CAItC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,SAAS,CAAC,CAiCpB;AAwFD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,EAAE,eAYlC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEhF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUpF;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,gBAAgB,EAAE,CAAC;CACnC,GAAG,OAAO,CAAC,UAAU,CAAC,CAyCtB"}