@vendure/cloud 0.3.2 → 0.4.0

package/dist/cli/lib/commit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commit.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/commit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAKlF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5C;AASD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,0BAA0B,GAAG,MAAM,GAAG,IAAI,CASnF"}

package/dist/cli/lib/commit.js

@@ -0,0 +1,22 @@
+// Reading commits off a branch mapping, for the two command families that show them.
+// The first seven characters, which is how a commit is written everywhere a customer reads one.
+export function shortSha(sha) {
+    return sha.slice(0, 7);
+}
+// The commit a mapping wants deployed that no successful trigger has deployed, or null when the
+// mapping is up to date. Anything other than a success on that exact SHA leaves it pending, so a
+// failed or queued trigger still counts.
+//
+// Falsiness rather than `=== null`, because the mapping is a `client.get<T>` cast rather than a
+// parsed value: a control plane that omits the field entirely would otherwise return `undefined`
+// from a function declaring `string | null`, and the caller's own null check would pass it on.
+export function pendingCommitSha(mapping) {
+    if (!mapping.desiredCommitSha)
+        return null;
+    if (mapping.lastTriggerStatus === "SUCCESS" &&
+        mapping.lastTriggerCommitSha === mapping.desiredCommitSha) {
+        return null;
+    }
+    return mapping.desiredCommitSha;
+}
+//# sourceMappingURL=commit.js.map

package/dist/cli/lib/commit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commit.js","sourceRoot":"","sources":["../../../src/cli/lib/commit.ts"],"names":[],"mappings":"AAEA,qFAAqF;AAErF,gGAAgG;AAChG,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,gGAAgG;AAChG,iGAAiG;AACjG,yCAAyC;AACzC,EAAE;AACF,gGAAgG;AAChG,iGAAiG;AACjG,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAAC,OAAmC;IAClE,IAAI,CAAC,OAAO,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC3C,IACE,OAAO,CAAC,iBAAiB,KAAK,SAAS;QACvC,OAAO,CAAC,oBAAoB,KAAK,OAAO,CAAC,gBAAgB,EACzD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC,gBAAgB,CAAC;AAClC,CAAC"}

package/dist/cli/lib/console-credential.d.ts

@@ -0,0 +1,55 @@
+export interface StoredConsoleCredential {
+    schemaVersion: 2;
+    /** The Console app that issued the session. A session from another Console reads as absent. */
+    origin: string;
+    /** The Console API that issued both tokens, and the only one a refresh may call. */
+    apiOrigin: string;
+    accessToken: string;
+    /** Absolute expiry of the access token, ISO-8601. */
+    expiresAt: string;
+    refreshToken?: string;
+}
+/** `~/.vendure`. Not `~/.vendure-cloud`: this credential belongs to Console, not to Cloud. */
+export declare function consoleConfigDir(home?: string): string;
+export declare function consoleCredentialPath(home?: string): string;
+export interface ConsoleCredentialLocation {
+    home?: string;
+    appOrigin?: string;
+    apiOrigin?: string;
+}
+/**
+ * The stored credential, or `undefined`.
+ *
+ * Every failure reads as "no credential": a missing file, an unreadable one, malformed JSON, a
+ * schema version this build does not know, a session issued by a different Console, an untrusted
+ * origin named by the caller, and a machine whose control plane names no trusted Console. The
+ * answer to all of them is the same, which is that this machine has no shared session to reuse, and
+ * the caller falls back to the Cloud login it had before. Nothing here throws, including for a
+ * caller that names an origin this build does not trust.
+ *
+ * Expiry is deliberately not checked here. An expired credential may still carry a usable refresh
+ * token, so that decision belongs to the caller.
+ *
+ * A caller that names neither origin gets the Console its control plane pairs with, so the reader
+ * exported at the CLI boundary resolves the same Console as the session path (CLO-641).
+ */
+export declare function readConsoleCredential(location?: ConsoleCredentialLocation): StoredConsoleCredential | undefined;
+/** Whether the access token is past its expiry, counting the skew. */
+export declare function isConsoleCredentialExpired(credential: StoredConsoleCredential, now: Date): boolean;
+/**
+ * Replace the stored credential.
+ *
+ * Only the refresh path calls this, and only while holding the session lock. Written through a
+ * temporary file and a rename, so a reader never sees half a token: a plain write truncates in
+ * place, and a crash inside it leaves unparseable JSON where a rotated refresh token used to be.
+ */
+export declare function writeConsoleCredential(credential: StoredConsoleCredential, location?: Pick<ConsoleCredentialLocation, "home">): void;
+/**
+ * Remove the stored credential.
+ *
+ * The one caller is a refresh that Console refused, under the lock, against a refresh token that
+ * is still the stored one. Nothing else may reach it: a credential removed on a guess sends a
+ * person to the browser to log in over a session that was fine.
+ */
+export declare function discardConsoleCredential(location?: Pick<ConsoleCredentialLocation, "home">): void;
+//# sourceMappingURL=console-credential.d.ts.map

package/dist/cli/lib/console-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console-credential.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/console-credential.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,CAAC,CAAC;IACjB,+FAA+F;IAC/F,MAAM,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAQD,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEjE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEtE;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,GAAE,yBAA8B,GACvC,uBAAuB,GAAG,SAAS,CAgCrC;AA+CD,sEAAsE;AACtE,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,uBAAuB,EACnC,GAAG,EAAE,IAAI,GACR,OAAO,CAOT;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,uBAAuB,EACnC,QAAQ,GAAE,IAAI,CAAC,yBAAyB,EAAE,MAAM,CAAM,GACrD,IAAI,CAgBN;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,GAAE,IAAI,CAAC,yBAAyB,EAAE,MAAM,CAAM,GACrD,IAAI,CAWN"}

package/dist/cli/lib/console-credential.js

@@ -0,0 +1,164 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { consoleOrigins } from "./console-origins.js";
+import { pairedConsoleOrigins } from "./console-pairing.js";
+import { logger } from "./logger.js";
+/**
+ * Treat a session as expired slightly early, so a token that passes this check and then expires
+ * while the request is in flight does not surface as a failure somewhere further down.
+ */
+const EXPIRY_SKEW_MS = 60_000;
+/** `~/.vendure`. Not `~/.vendure-cloud`: this credential belongs to Console, not to Cloud. */
+export function consoleConfigDir(home = homedir()) {
+    return join(home, ".vendure");
+}
+export function consoleCredentialPath(home = homedir()) {
+    return join(consoleConfigDir(home), "console-credentials.json");
+}
+/**
+ * The stored credential, or `undefined`.
+ *
+ * Every failure reads as "no credential": a missing file, an unreadable one, malformed JSON, a
+ * schema version this build does not know, a session issued by a different Console, an untrusted
+ * origin named by the caller, and a machine whose control plane names no trusted Console. The
+ * answer to all of them is the same, which is that this machine has no shared session to reuse, and
+ * the caller falls back to the Cloud login it had before. Nothing here throws, including for a
+ * caller that names an origin this build does not trust.
+ *
+ * Expiry is deliberately not checked here. An expired credential may still carry a usable refresh
+ * token, so that decision belongs to the caller.
+ *
+ * A caller that names neither origin gets the Console its control plane pairs with, so the reader
+ * exported at the CLI boundary resolves the same Console as the session path (CLO-641).
+ */
+export function readConsoleCredential(location = {}) {
+    const expected = expectedOrigins(location);
+    if (!expected) {
+        return undefined;
+    }
+    const { appOrigin, apiOrigin } = expected;
+    let raw;
+    try {
+        raw = readFileSync(consoleCredentialPath(location.home), "utf-8");
+    }
+    catch {
+        return undefined;
+    }
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+    if (!isStoredConsoleCredential(value)) {
+        return undefined;
+    }
+    // Both halves have to match. A token minted against a local development Console must never be
+    // replayed against production, and the app origin alone does not say which API issued it.
+    if (!originsMatch(value.origin, appOrigin) || !originsMatch(value.apiOrigin, apiOrigin)) {
+        // Named because it is the one case with a usable session on disk behind it.
+        logger.debug({ storedApiOrigin: value.apiOrigin, expectedApiOrigin: apiOrigin }, "Ignoring a Console session another Console issued");
+        return undefined;
+    }
+    return { ...value, origin: appOrigin, apiOrigin };
+}
+function expectedOrigins(location) {
+    if (location.appOrigin === undefined && location.apiOrigin === undefined) {
+        return pairedConsoleOrigins();
+    }
+    try {
+        return consoleOrigins(location);
+    }
+    catch (error) {
+        // Same answer as an untrusted `VENDURE_CLOUD_CONSOLE_API_URL`: no Console can be named, so
+        // there is no session to read. A raw throw from here would pass the `ConsoleSession*Error`
+        // taxonomy that every caller on the refresh path handles.
+        logger.debug({ error }, "Untrusted Console origins named by the caller; ignoring the session");
+        return undefined;
+    }
+}
+// Compared as origins rather than as strings, so a stored trailing slash or an explicit default
+// port is the same credential. An unparseable stored value is not this file's to repair.
+function originsMatch(stored, expected) {
+    try {
+        return new URL(stored).origin === expected;
+    }
+    catch {
+        return false;
+    }
+}
+function isStoredConsoleCredential(value) {
+    if (!value || typeof value !== "object") {
+        return false;
+    }
+    const candidate = value;
+    return (candidate.schemaVersion === 2 &&
+        typeof candidate.origin === "string" &&
+        !!candidate.origin &&
+        typeof candidate.apiOrigin === "string" &&
+        !!candidate.apiOrigin &&
+        typeof candidate.accessToken === "string" &&
+        !!candidate.accessToken &&
+        typeof candidate.expiresAt === "string" &&
+        !!candidate.expiresAt &&
+        (candidate.refreshToken === undefined ||
+            (typeof candidate.refreshToken === "string" && !!candidate.refreshToken)));
+}
+/** Whether the access token is past its expiry, counting the skew. */
+export function isConsoleCredentialExpired(credential, now) {
+    const expiresAt = Date.parse(credential.expiresAt);
+    if (Number.isNaN(expiresAt)) {
+        // An expiry this build cannot read is not a session it can vouch for.
+        return true;
+    }
+    return expiresAt - EXPIRY_SKEW_MS <= now.getTime();
+}
+/**
+ * Replace the stored credential.
+ *
+ * Only the refresh path calls this, and only while holding the session lock. Written through a
+ * temporary file and a rename, so a reader never sees half a token: a plain write truncates in
+ * place, and a crash inside it leaves unparseable JSON where a rotated refresh token used to be.
+ */
+export function writeConsoleCredential(credential, location = {}) {
+    const directory = consoleConfigDir(location.home);
+    const destination = consoleCredentialPath(location.home);
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const temporary = `${destination}.${process.pid}.tmp`;
+    try {
+        writeFileSync(temporary, `${JSON.stringify(credential, null, 2)}\n`, { mode: 0o600 });
+        renameSync(temporary, destination);
+    }
+    catch (error) {
+        try {
+            unlinkSync(temporary);
+        }
+        catch {
+            // The write may have failed before the temporary file existed at all.
+        }
+        throw error;
+    }
+}
+/**
+ * Remove the stored credential.
+ *
+ * The one caller is a refresh that Console refused, under the lock, against a refresh token that
+ * is still the stored one. Nothing else may reach it: a credential removed on a guess sends a
+ * person to the browser to log in over a session that was fine.
+ */
+export function discardConsoleCredential(location = {}) {
+    const path = consoleCredentialPath(location.home);
+    if (!existsSync(path)) {
+        return;
+    }
+    try {
+        unlinkSync(path);
+    }
+    catch {
+        // Another participant removed it first, or it is not ours to remove. Either way the session is
+        // gone as far as this process is concerned.
+    }
+}
+//# sourceMappingURL=console-credential.js.map

package/dist/cli/lib/console-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"console-credential.js","sourceRoot":"","sources":["../../../src/cli/lib/console-credential.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAuB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA4BrC;;;GAGG;AACH,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,8FAA8F;AAC9F,MAAM,UAAU,gBAAgB,CAAC,OAAe,OAAO,EAAE;IACvD,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe,OAAO,EAAE;IAC5D,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,0BAA0B,CAAC,CAAC;AAClE,CAAC;AAQD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACnC,WAAsC,EAAE;IAExC,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;IAC1C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,8FAA8F;IAC9F,0FAA0F;IAC1F,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QACxF,4EAA4E;QAC5E,MAAM,CAAC,KAAK,CACV,EAAE,eAAe,EAAE,KAAK,CAAC,SAAS,EAAE,iBAAiB,EAAE,SAAS,EAAE,EAClE,mDAAmD,CACpD,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CAAC,QAAmC;IAC1D,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACzE,OAAO,oBAAoB,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2FAA2F;QAC3F,2FAA2F;QAC3F,0DAA0D;QAC1D,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,qEAAqE,CAAC,CAAC;QAC/F,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,yFAAyF;AACzF,SAAS,YAAY,CAAC,MAAc,EAAE,QAAgB;IACpD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,KAAyC,CAAC;IAC5D,OAAO,CACL,SAAS,CAAC,aAAa,KAAK,CAAC;QAC7B,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ;QACpC,CAAC,CAAC,SAAS,CAAC,MAAM;QAClB,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;QACvC,CAAC,CAAC,SAAS,CAAC,SAAS;QACrB,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ;QACzC,CAAC,CAAC,SAAS,CAAC,WAAW;QACvB,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;QACvC,CAAC,CAAC,SAAS,CAAC,SAAS;QACrB,CAAC,SAAS,CAAC,YAAY,KAAK,SAAS;YACnC,CAAC,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,0BAA0B,CACxC,UAAmC,EACnC,GAAS;IAET,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,sEAAsE;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAS,GAAG,cAAc,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAmC,EACnC,WAAoD,EAAE;IAEtD,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACtD,IAAI,CAAC;QACH,aAAa,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtF,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,UAAU,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAoD,EAAE;IAEtD,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,+FAA+F;QAC/F,4CAA4C;IAC9C,CAAC;AACH,CAAC"}

package/dist/cli/lib/console-origins.d.ts

@@ -0,0 +1,30 @@
+/** The Console web app. Cloud never opens it; the origin identifies which Console issued a token. */
+export declare const DEFAULT_CONSOLE_APP_ORIGIN = "https://console.vendure.io";
+/** The Console API. Cloud calls its token endpoint to refresh a shared session. */
+export declare const DEFAULT_CONSOLE_API_ORIGIN = "https://api.vendure.io";
+export declare const STAGING_CONSOLE_API_ORIGIN = "https://staging.api.vendure.io";
+export interface ConsoleOrigins {
+    appOrigin: string;
+    apiOrigin: string;
+}
+/** The two pairs by name, so a caller or a fixture never restates one of the four literals. */
+export declare const DEFAULT_CONSOLE_ORIGINS: ConsoleOrigins;
+export declare const STAGING_CONSOLE_ORIGINS: ConsoleOrigins;
+/** Exported so a caller deciding what a loopback URL pairs with uses this same list. */
+export declare function isLoopback(hostname: string): boolean;
+/** The Console web app origin. Loopback is allowed for local development and tests. */
+export declare function consoleAppOrigin(value?: string): string;
+/** The Console API origin a token request may call. */
+export declare function consoleApiOrigin(value?: string): string;
+/**
+ * Select a matching app and API pair.
+ *
+ * Naming one staging origin selects the other, so a developer cannot half-configure themselves
+ * onto production. An explicit mixed pair is refused rather than silently corrected, because
+ * neither half is more likely to be the mistake.
+ */
+export declare function consoleOrigins(options: {
+    appOrigin?: string;
+    apiOrigin?: string;
+}): ConsoleOrigins;
+//# sourceMappingURL=console-origins.d.ts.map

package/dist/cli/lib/console-origins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console-origins.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/console-origins.ts"],"names":[],"mappings":"AAeA,qGAAqG;AACrG,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AAEvE,mFAAmF;AACnF,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AAGnE,eAAO,MAAM,0BAA0B,mCAAmC,CAAC;AAE3E,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,+FAA+F;AAC/F,eAAO,MAAM,uBAAuB,EAAE,cAGrC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,cAGrC,CAAC;AAKF,wFAAwF;AACxF,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEpD;AA0BD,uFAAuF;AACvF,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,MAAmC,GAAG,MAAM,CAEnF;AAED,uDAAuD;AACvD,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,MAAmC,GAAG,MAAM,CAEnF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,cAAc,CAmBjB"}

package/dist/cli/lib/console-origins.js

@@ -0,0 +1,87 @@
+// The Console origins this machine may talk to, and the pairing rule between them.
+//
+// A vendored fork of `test/fixtures/console-auth/upstream/origins.ts` from
+// `vendurehq/vendure-platform@0d09dfd2`, adapted for this repository's quoting and formatting and
+// carrying no Cloud-specific logic. Local to this copy, and to be kept when syncing upstream: the
+// `export` on `STAGING_CONSOLE_API_ORIGIN`, `isLoopback` and the two origin-pair constants, which
+// exist so `console-pairing.ts` and its fixtures name a Console without restating its literals. Both tools have to agree on these origins exactly: the pair is
+// recorded in the credential file, and a disagreement reads as "no credential" on one side and a
+// usable session on the other. `test/cli-console-origins.test.ts` pins the cases upstream's README
+// names.
+//
+// The checks past the host list matter as much as the list. A URL carrying a path, a query, a
+// fragment, or credentials is a URL built to be appended to, and each of those points a request
+// somewhere else while the hostname still reads correctly.
+/** The Console web app. Cloud never opens it; the origin identifies which Console issued a token. */
+export const DEFAULT_CONSOLE_APP_ORIGIN = "https://console.vendure.io";
+/** The Console API. Cloud calls its token endpoint to refresh a shared session. */
+export const DEFAULT_CONSOLE_API_ORIGIN = "https://api.vendure.io";
+const STAGING_CONSOLE_APP_ORIGIN = "https://staging.console.vendure.io";
+export const STAGING_CONSOLE_API_ORIGIN = "https://staging.api.vendure.io";
+/** The two pairs by name, so a caller or a fixture never restates one of the four literals. */
+export const DEFAULT_CONSOLE_ORIGINS = {
+    appOrigin: DEFAULT_CONSOLE_APP_ORIGIN,
+    apiOrigin: DEFAULT_CONSOLE_API_ORIGIN,
+};
+export const STAGING_CONSOLE_ORIGINS = {
+    appOrigin: STAGING_CONSOLE_APP_ORIGIN,
+    apiOrigin: STAGING_CONSOLE_API_ORIGIN,
+};
+const TRUSTED_APP_HOSTS = ["console.vendure.io", "staging.console.vendure.io"];
+const TRUSTED_API_HOSTS = ["api.vendure.io", "staging.api.vendure.io"];
+/** Exported so a caller deciding what a loopback URL pairs with uses this same list. */
+export function isLoopback(hostname) {
+    return ["localhost", "127.0.0.1", "::1"].includes(hostname) || hostname.endsWith(".localhost");
+}
+function trustedOrigin(value, trustedHosts, subject) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`The ${subject} URL is invalid.`);
+    }
+    const trustedRemote = trustedHosts.includes(url.hostname);
+    const loopback = isLoopback(url.hostname);
+    if ((!trustedRemote && !loopback) ||
+        (trustedRemote && url.protocol !== "https:") ||
+        (loopback && !["http:", "https:"].includes(url.protocol)) ||
+        url.username ||
+        url.password ||
+        url.pathname !== "/" ||
+        url.search ||
+        url.hash) {
+        throw new Error(`The ${subject} URL is not trusted.`);
+    }
+    return url.origin;
+}
+/** The Console web app origin. Loopback is allowed for local development and tests. */
+export function consoleAppOrigin(value = DEFAULT_CONSOLE_APP_ORIGIN) {
+    return trustedOrigin(value, TRUSTED_APP_HOSTS, "Vendure Console");
+}
+/** The Console API origin a token request may call. */
+export function consoleApiOrigin(value = DEFAULT_CONSOLE_API_ORIGIN) {
+    return trustedOrigin(value, TRUSTED_API_HOSTS, "Vendure Console API");
+}
+/**
+ * Select a matching app and API pair.
+ *
+ * Naming one staging origin selects the other, so a developer cannot half-configure themselves
+ * onto production. An explicit mixed pair is refused rather than silently corrected, because
+ * neither half is more likely to be the mistake.
+ */
+export function consoleOrigins(options) {
+    const explicitApp = options.appOrigin === undefined ? undefined : consoleAppOrigin(options.appOrigin);
+    const apiOrigin = consoleApiOrigin(options.apiOrigin ??
+        (explicitApp === STAGING_CONSOLE_APP_ORIGIN ? STAGING_CONSOLE_API_ORIGIN : undefined));
+    const appOrigin = explicitApp ??
+        (apiOrigin === STAGING_CONSOLE_API_ORIGIN
+            ? STAGING_CONSOLE_APP_ORIGIN
+            : DEFAULT_CONSOLE_APP_ORIGIN);
+    if ((appOrigin === DEFAULT_CONSOLE_APP_ORIGIN && apiOrigin === STAGING_CONSOLE_API_ORIGIN) ||
+        (appOrigin === STAGING_CONSOLE_APP_ORIGIN && apiOrigin === DEFAULT_CONSOLE_API_ORIGIN)) {
+        throw new Error("The Vendure Console app and API origins must belong to the same environment.");
+    }
+    return { appOrigin, apiOrigin };
+}
+//# sourceMappingURL=console-origins.js.map

package/dist/cli/lib/console-origins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"console-origins.js","sourceRoot":"","sources":["../../../src/cli/lib/console-origins.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,EAAE;AACF,2EAA2E;AAC3E,kGAAkG;AAClG,kGAAkG;AAClG,kGAAkG;AAClG,+JAA+J;AAC/J,iGAAiG;AACjG,mGAAmG;AACnG,SAAS;AACT,EAAE;AACF,8FAA8F;AAC9F,gGAAgG;AAChG,2DAA2D;AAE3D,qGAAqG;AACrG,MAAM,CAAC,MAAM,0BAA0B,GAAG,4BAA4B,CAAC;AAEvE,mFAAmF;AACnF,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAEnE,MAAM,0BAA0B,GAAG,oCAAoC,CAAC;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;AAO3E,+FAA+F;AAC/F,MAAM,CAAC,MAAM,uBAAuB,GAAmB;IACrD,SAAS,EAAE,0BAA0B;IACrC,SAAS,EAAE,0BAA0B;CACtC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAmB;IACrD,SAAS,EAAE,0BAA0B;IACrC,SAAS,EAAE,0BAA0B;CACtC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,CAAC;AAC/E,MAAM,iBAAiB,GAAG,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;AAEvE,wFAAwF;AACxF,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,YAAsB,EAAE,OAAe;IAC3E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,OAAO,OAAO,kBAAkB,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,IACE,CAAC,CAAC,aAAa,IAAI,CAAC,QAAQ,CAAC;QAC7B,CAAC,aAAa,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC5C,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzD,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ,KAAK,GAAG;QACpB,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,IAAI,EACR,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,OAAO,sBAAsB,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,gBAAgB,CAAC,QAAgB,0BAA0B;IACzE,OAAO,aAAa,CAAC,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AACpE,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,gBAAgB,CAAC,QAAgB,0BAA0B;IACzE,OAAO,aAAa,CAAC,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAG9B;IACC,MAAM,WAAW,GACf,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,gBAAgB,CAChC,OAAO,CAAC,SAAS;QACf,CAAC,WAAW,KAAK,0BAA0B,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS,CAAC,CACxF,CAAC;IACF,MAAM,SAAS,GACb,WAAW;QACX,CAAC,SAAS,KAAK,0BAA0B;YACvC,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,0BAA0B,CAAC,CAAC;IAClC,IACE,CAAC,SAAS,KAAK,0BAA0B,IAAI,SAAS,KAAK,0BAA0B,CAAC;QACtF,CAAC,SAAS,KAAK,0BAA0B,IAAI,SAAS,KAAK,0BAA0B,CAAC,EACtF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC"}

package/dist/cli/lib/console-pairing.d.ts

@@ -0,0 +1,15 @@
+import { type ConsoleOrigins } from "./console-origins.js";
+/**
+ * The Console origin pair for the control plane this invocation talks to, or `undefined` when no
+ * trusted Console can be named for it.
+ *
+ * `VENDURE_CLOUD_CONSOLE_API_URL` wins when set. Otherwise the hosted development control plane and
+ * any loopback one take the staging Console, and everything else takes production.
+ *
+ * Loopback takes staging as a default rather than as a configured pairing. `CONSOLE_API_URL` is
+ * commented out in `apps/control-plane/.env.example`, so a control plane run from this repository
+ * names no Console until someone sets it; staging is the value that example shows, and that control
+ * plane cannot pair with production because it runs on the test identity provider.
+ */
+export declare function pairedConsoleOrigins(cloudApiUrl?: string): ConsoleOrigins | undefined;
+//# sourceMappingURL=console-pairing.d.ts.map

package/dist/cli/lib/console-pairing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console-pairing.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/console-pairing.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,cAAc,EAMpB,MAAM,sBAAsB,CAAC;AAkB9B;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,GAAE,MAAoB,GAChC,cAAc,GAAG,SAAS,CAiB5B"}

package/dist/cli/lib/console-pairing.js

@@ -0,0 +1,70 @@
+import { getApiUrl } from "./config.js";
+import { DEFAULT_CONSOLE_ORIGINS, STAGING_CONSOLE_ORIGINS, consoleApiOrigin, consoleOrigins, isLoopback, } from "./console-origins.js";
+import { logger } from "./logger.js";
+// Which Console issued the session a given Cloud control plane accepts.
+//
+// A control plane resolves a Console session against the single Console its own `CONSOLE_API_URL`
+// names, so the credential this machine reads has to be the one that Console wrote. When no Console
+// can be named, there is no shared session and the command uses the Cloud login it used before.
+//
+// A table here rather than a field on `/auth/cli-config`, which already publishes deployment facts
+// to this CLI and could publish this one without drifting. The reason is the call path, not the
+// design: `resolveConsoleSession` is synchronous and runs before every command does any work, so
+// serving this would put a network round trip in front of all of them. Worth revisiting if the
+// table ever drifts.
+const DEVELOPMENT_CLOUD_API_ORIGIN = "https://api.cloud.vendure.dev";
+const CONSOLE_API_URL_ENV_VAR = "VENDURE_CLOUD_CONSOLE_API_URL";
+/**
+ * The Console origin pair for the control plane this invocation talks to, or `undefined` when no
+ * trusted Console can be named for it.
+ *
+ * `VENDURE_CLOUD_CONSOLE_API_URL` wins when set. Otherwise the hosted development control plane and
+ * any loopback one take the staging Console, and everything else takes production.
+ *
+ * Loopback takes staging as a default rather than as a configured pairing. `CONSOLE_API_URL` is
+ * commented out in `apps/control-plane/.env.example`, so a control plane run from this repository
+ * names no Console until someone sets it; staging is the value that example shows, and that control
+ * plane cannot pair with production because it runs on the test identity provider.
+ */
+export function pairedConsoleOrigins(cloudApiUrl = getApiUrl()) {
+    const configured = process.env[CONSOLE_API_URL_ENV_VAR];
+    if (configured) {
+        return overrideOrigins(configured);
+    }
+    let url;
+    try {
+        url = new URL(cloudApiUrl);
+    }
+    catch {
+        // Quiet: the request that uses this URL reports it, with the URL in hand.
+        logger.debug({ cloudApiUrl }, "Unreadable control-plane URL; ignoring any shared Console session");
+        return undefined;
+    }
+    return pairsWithStaging(url) ? STAGING_CONSOLE_ORIGINS : DEFAULT_CONSOLE_ORIGINS;
+}
+/**
+ * The Console named by the variable, or `undefined` with a warning.
+ *
+ * Warned rather than logged quietly: somebody set this deliberately, and the symptom of ignoring it
+ * is the browser login CLO-641 exists to remove.
+ */
+function overrideOrigins(configured) {
+    try {
+        const apiOrigin = consoleApiOrigin(configured);
+        if (isLoopback(new URL(apiOrigin).hostname)) {
+            // One variable names one origin, and `consoleOrigins` answers a loopback API origin with a
+            // remote app origin, which is a pair no credential can match. A locally run Console has to be
+            // named by both of its origins, and there is nowhere here to say the second.
+            throw new Error("a loopback Console cannot be named by its API origin alone");
+        }
+        return consoleOrigins({ apiOrigin });
+    }
+    catch (error) {
+        logger.warn({ error, VENDURE_CLOUD_CONSOLE_API_URL: configured }, "VENDURE_CLOUD_CONSOLE_API_URL does not name a usable Vendure Console API; ignoring the shared Console session");
+        return undefined;
+    }
+}
+function pairsWithStaging(url) {
+    return url.origin === DEVELOPMENT_CLOUD_API_ORIGIN || isLoopback(url.hostname);
+}
+//# sourceMappingURL=console-pairing.js.map

package/dist/cli/lib/console-pairing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"console-pairing.js","sourceRoot":"","sources":["../../../src/cli/lib/console-pairing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAEL,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,cAAc,EACd,UAAU,GACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,wEAAwE;AACxE,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,gGAAgG;AAChG,EAAE;AACF,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,+FAA+F;AAC/F,qBAAqB;AAErB,MAAM,4BAA4B,GAAG,+BAA+B,CAAC;AACrE,MAAM,uBAAuB,GAAG,+BAA+B,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,cAAsB,SAAS,EAAE;IAEjC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACxD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,MAAM,CAAC,KAAK,CACV,EAAE,WAAW,EAAE,EACf,mEAAmE,CACpE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,uBAAuB,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,UAAkB;IACzC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,2FAA2F;YAC3F,8FAA8F;YAC9F,6EAA6E;YAC7E,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,cAAc,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,6BAA6B,EAAE,UAAU,EAAE,EACpD,+GAA+G,CAChH,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAQ;IAChC,OAAO,GAAG,CAAC,MAAM,KAAK,4BAA4B,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACjF,CAAC"}

package/dist/cli/lib/console-session-lock.d.ts

@@ -0,0 +1,39 @@
+/**
+ * How long a lock file may sit untouched before another participant may take it over.
+ *
+ * A holder touches its own lock while it works, so this measures a holder that has stopped rather
+ * than one that is slow.
+ */
+export declare const CONSOLE_SESSION_LOCK_STALE_MS = 30000;
+/**
+ * How long to wait for a lock somebody else holds.
+ *
+ * Never shorter than the stale budget. A waiter that gave up sooner could give up while the holder
+ * is dead but not yet stale, and then "I gave up waiting" would stop meaning "the holder is gone".
+ */
+export declare const CONSOLE_SESSION_LOCK_WAIT_MS = 30000;
+/** The lock file, beside the credential it guards. */
+export declare function consoleSessionLockPath(home?: string): string;
+export interface ConsoleSessionLockOptions {
+    /** Overrides `os.homedir()`. Tests point this at a temporary directory. */
+    home?: string;
+    /**
+     * The budgets belong to the protocol rather than to a caller. They are open here so a test can
+     * drive the stale and give-up paths without waiting half a minute for each one. A `waitMs` below
+     * `staleMs` is raised, because the protocol does not allow the shorter of the two.
+     */
+    staleMs?: number;
+    waitMs?: number;
+    pollMs?: number;
+}
+/**
+ * Run `work` while holding the Console session lock.
+ *
+ * Every step that spends a refresh token or rewrites the credential file goes through here,
+ * including the ones in the other tool. Guarding only some of the call sites leaves the double
+ * spend reachable through the rest.
+ *
+ * The lock is not reentrant.
+ */
+export declare function withConsoleSessionLock<T>(options: ConsoleSessionLockOptions, work: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=console-session-lock.d.ts.map

package/dist/cli/lib/console-session-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console-session-lock.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/console-session-lock.ts"],"names":[],"mappings":"AAkCA;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AAEpD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAInD,sDAAsD;AACtD,wBAAgB,sBAAsB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,MAAM,WAAW,yBAAyB;IACxC,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAYD;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,OAAO,EAAE,yBAAyB,EAClC,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACrB,OAAO,CAAC,CAAC,CAAC,CASZ"}