@vendure/cloud 0.4.0 → 0.5.0-dev.20261016123507.ge07a06e

package/dist/cli/lib/auth.js

@@ -1,525 +1,18 @@
-import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
-import { basename, join } from "node:path";
-import { AUTH_FILE, CONFIG_DIR, REFRESH_LOCK_FILE, WORKOS_AUTHENTICATE_URL, getApiUrl, } from "./config.js";
-import { isSharedConsoleSessionEnabled, resolveConsoleSession } from "./console-session.js";
+import { getUserAccessToken } from "./cli-login.js";
 import { classifyForeignCredential } from "./contract/foreign-credentials.js";
-import { ForeignCredentialError, RefreshTokenRejectedError, RefreshUnavailableError, SessionRefreshError, SessionUnstorableError, } from "./errors.js";
-import { withFileLock } from "./file-lock.js";
-import { cloudInvocation } from "./invocation.js";
-import { logger } from "./logger.js";
-export const API_AUTH_CONFIG_TIMEOUT_MS = 15_000;
-export const WORKOS_AUTH_REQUEST_TIMEOUT_MS = 60_000;
-/**
- * Precedence: the explicit `--token`, then `VENDURE_CLOUD_TOKEN`, then the
- * shared Console session, then the stored Cloud login. Returns null when the
- * machine has no credential at all, so each caller can word its own "not logged
- * in" response.
- *
- * The shared session comes before the stored Cloud login because it is the one
- * a developer just approved, and reusing it is the point of CLO-641. It comes
- * after an explicit token for the same reason the stored login does: a
- * credential someone named on the command line is the one they meant.
- *
- * `~/.vendure-cloud/auth.json` keeps working underneath it. A machine that has
- * only that file resolves exactly as it did before, and so does every machine
- * while the shared path stays switched off.
- *
- * An explicitly supplied credential is never mixed with the stored session:
- * spending the session's single-use refresh token on a credential that does
- * not own it strands the login (CLO-164), and sending the locally selected
- * organization alongside a key that resolves its own would contradict it.
- *
- * Throws rather than returns null for a credential another Vendure product
- * issued. Someone who set `--token` to their project's environment credential
- * has made a specific mistake, and falling back to the stored session would
- * answer it with whatever that session happens to be — or with "not logged in",
- * which is not what went wrong. Refusing here is also what keeps the value on
- * the machine; the control plane refuses it again for callers that are not
- * this CLI.
- */
-export function resolveCredential(options) {
+import { ForeignCredentialError } from "./errors.js";
+// Precedence: `--token`, `VENDURE_CLOUD_TOKEN`, then the Vendure CLI login. An explicit API key
+// never reads or renews the login. A credential another Vendure product issued is rejected here, so
+// it never leaves the machine and never falls back to whichever account the login holds.
+export async function resolveCredential(options) {
     const explicitToken = options.token ?? process.env.VENDURE_CLOUD_TOKEN;
     if (explicitToken) {
         const foreign = classifyForeignCredential(explicitToken);
         if (foreign) {
             throw new ForeignCredentialError(foreign);
         }
-        return { kind: "apiKey", token: explicitToken };
+        return { kind: "apiKey", key: explicitToken };
     }
-    if (isSharedConsoleSessionEnabled()) {
-        const shared = resolveConsoleSession();
-        // A session that has expired and cannot be renewed without a browser is not one to run on. It
-        // would fail every command with "sign in again" while a working Cloud login sat unused in
-        // `~/.vendure-cloud/auth.json`, so it is passed over as if it were not there.
-        if (shared && (shared.refreshable || !shared.expired)) {
-            return { kind: "consoleSession", token: shared.accessToken };
-        }
-    }
-    const config = readAuthConfig();
-    if (!config?.accessToken) {
-        return null;
-    }
-    return {
-        kind: "session",
-        token: config.accessToken,
-        organizationId: config.activeOrganizationId,
-    };
-}
-export function readAuthConfig() {
-    if (!existsSync(AUTH_FILE)) {
-        return null;
-    }
-    try {
-        const raw = readFileSync(AUTH_FILE, "utf-8");
-        return JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Write via a temp file + rename so the config is replaced atomically.
- * A plain `writeFileSync` truncates in place: a crash mid-write leaves
- * unparseable JSON, which reads back as "not logged in" while the rotated
- * refresh token — already consumed at the authentication service — is gone
- * for good. Rename is atomic within a directory, so a reader sees either the
- * whole old config or the whole new one.
- */
-export function writeAuthConfig(config) {
-    mkdirSync(CONFIG_DIR, { recursive: true });
-    const tempFile = `${AUTH_FILE}.${process.pid}.tmp`;
-    try {
-        writeFileSync(tempFile, serializeAuthConfig(config), { mode: 0o600 });
-        renameSync(tempFile, AUTH_FILE);
-    }
-    catch (error) {
-        try {
-            unlinkSync(tempFile);
-        }
-        catch {
-            // The write may have failed before the temp file existed at all.
-        }
-        throw error;
-    }
-    sweepStaleTempFiles();
-}
-function serializeAuthConfig(config) {
-    return JSON.stringify(config, null, 2);
-}
-// Long enough that no in-flight write can still be inside it: a temp file this
-// old belongs to a process that was killed between the write and the rename,
-// and it holds live tokens at 0600 until something removes it.
-const STALE_TEMP_FILE_MS = 60 * 60 * 1000;
-function sweepStaleTempFiles() {
-    const prefix = `${basename(AUTH_FILE)}.`;
-    const cutoff = Date.now() - STALE_TEMP_FILE_MS;
-    let entries;
-    try {
-        entries = readdirSync(CONFIG_DIR);
-    }
-    catch (error) {
-        // Opportunistic: a session that cannot list the directory is not a failed
-        // write, so the caller never hears about it.
-        logger.debug({ error }, "Could not scan for stale auth temp files");
-        return;
-    }
-    for (const entry of entries) {
-        if (!entry.startsWith(prefix) || !entry.endsWith(".tmp")) {
-            continue;
-        }
-        const path = join(CONFIG_DIR, entry);
-        try {
-            if (statSync(path).mtimeMs > cutoff) {
-                continue;
-            }
-            unlinkSync(path);
-        }
-        catch (error) {
-            // Raced with its owner, or not ours to remove.
-            logger.debug({ path, error }, "Could not remove stale auth temp file");
-        }
-    }
-}
-// A refresh token is single-use, so a write that fails after the exchange
-// leaves the consumed token as the machine's only credential (CLO-703). An
-// exchange cannot be undone, so each one proves storability first.
-//
-// The probe creates and renames beside `auth.json`, then removes itself. Never
-// `auth.json` itself, so no stored credential is read or replaced.
-// Mode bits are not consulted: root writes a 0500 directory, and a read-only
-// mount refuses a 0700 one.
-//
-// Limits. The filler is sized from the config being replaced, not from the
-// unknown-length pair. The probe's own unlink can refuse where the write would
-// not have needed one. Write access can still disappear after this returns.
-function assertReplacementIsStorable(configToReplace) {
-    const probeFile = `${AUTH_FILE}.${process.pid}.probe.tmp`;
-    const probeTarget = `${AUTH_FILE}.${process.pid}.probed.tmp`;
-    try {
-        mkdirSync(CONFIG_DIR, { recursive: true });
-        // Bytes, not code units: a non-ASCII name would undersize the filler and
-        // let a nearly full directory through.
-        const filler = "0".repeat(Buffer.byteLength(serializeAuthConfig(configToReplace)));
-        writeFileSync(probeFile, filler, { mode: 0o600 });
-        renameSync(probeFile, probeTarget);
-        unlinkSync(probeTarget);
-    }
-    catch (error) {
-        removeProbeFiles(probeFile, probeTarget);
-        logger.debug({ error }, "Cannot store a renewed session; not spending the refresh token");
-        throw new SessionUnstorableError(CONFIG_DIR, { cause: error });
-    }
-}
-// Whichever name the failure left behind. A directory too broken to remove them
-// is the failure being reported, and both names match `sweepStaleTempFiles`.
-function removeProbeFiles(...paths) {
-    for (const path of paths) {
-        try {
-            unlinkSync(path);
-        }
-        catch {
-            // Never existed, or the directory that just refused a write refuses this.
-        }
-    }
-}
-export function clearAuthConfig() {
-    if (existsSync(AUTH_FILE)) {
-        unlinkSync(AUTH_FILE);
-    }
-}
-/**
- * Exchange a refresh token for a fresh access/refresh token pair via WorkOS.
- *
- * Pass `workosOrgId` to scope the new token to a specific organization:
- * WorkOS bakes the user's role + permissions for that org into the access
- * token's claims at issue time. Without it, WorkOS returns a token for the
- * user's current/default org. This is the mechanism that keeps the JWT's
- * `org_id` + `permissions` in step with the CLI's active org — see
- * `org switch` and the multi-org branch of `login`.
- *
- * Note: `workosOrgId` is the WorkOS organization id (`org_…`), NOT the
- * internal DB UUID stored in `AuthConfig.activeOrganizationId`.
- */
-export async function exchangeRefreshToken(refreshToken, workosOrgId) {
-    const cliConfigResponse = await fetchOrUnavailable(`${getApiUrl()}/auth/cli-config`, {
-        signal: AbortSignal.timeout(API_AUTH_CONFIG_TIMEOUT_MS),
-    });
-    if (!cliConfigResponse.ok) {
-        // The control plane, not the token — never a reason to discard credentials.
-        logger.debug({ status: cliConfigResponse.status }, "CLI config fetch failed during refresh");
-        throw new RefreshUnavailableError();
-    }
-    const { workosClientId } = (await cliConfigResponse.json());
-    const response = await fetchOrUnavailable(WORKOS_AUTHENTICATE_URL, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        signal: AbortSignal.timeout(WORKOS_AUTH_REQUEST_TIMEOUT_MS),
-        body: JSON.stringify({
-            grant_type: "refresh_token",
-            client_id: workosClientId,
-            refresh_token: refreshToken,
-            ...(workosOrgId ? { organization_id: workosOrgId } : {}),
-        }),
-    });
-    if (!response.ok) {
-        throw await classifyRefreshFailure(response);
-    }
-    const result = (await response.json());
-    return { accessToken: result.access_token, refreshToken: result.refresh_token };
-}
-async function fetchOrUnavailable(url, init) {
-    try {
-        return await fetch(url, init);
-    }
-    catch (error) {
-        // DNS failure, connection reset, timeout abort — all transient.
-        throw new RefreshUnavailableError({ cause: error });
-    }
-}
-// The OAuth 2.0 (RFC 6749 §5.2) error code that means this grant will never
-// work again: the refresh token was revoked, has expired, or was already
-// consumed.
-const REJECTED_GRANT_ERROR_CODE = "invalid_grant";
-/**
- * Fail safe: only a recognised "this token is dead" code counts as definitive.
- * Rate limits, 5xx, and unrecognised codes stay transient so a bad guess costs
- * the user a retry rather than their whole session. The authentication service
- * does not document its refresh-grant error codes, so what we recognise is
- * deliberately narrow.
- */
-async function classifyRefreshFailure(response) {
-    const body = await response.json().catch(() => null);
-    const errorCode = extractErrorCode(body);
-    logger.debug({ status: response.status, errorCode }, "Token refresh rejected");
-    if (errorCode === REJECTED_GRANT_ERROR_CODE) {
-        return new RefreshTokenRejectedError();
-    }
-    return new RefreshUnavailableError();
-}
-function extractErrorCode(body) {
-    if (body && typeof body === "object" && "error" in body && typeof body.error === "string") {
-        return body.error;
-    }
-    return undefined;
-}
-// Skew margin so a token that expires while the retried request is in flight
-// counts as unusable.
-const ACCESS_TOKEN_REUSE_SKEW_MS = 30_000;
-/**
- * Whether an access token another process stored is worth handing back instead
- * of running an exchange. "Different from the token that just 401'd" is not the
- * same as "valid": access tokens live minutes, so a long-running command can
- * find a pair that rotated — and then expired — while it worked. The API client
- * retries exactly once, so reusing a dead token spends that retry and surfaces
- * as a logged-out command (CLO-164).
- *
- * Fails toward the exchange: no `exp`, a non-numeric one, or a token we cannot
- * decode is not provably valid, and an unnecessary exchange only costs the
- * round trip.
- */
-function hasUsableLifetime(accessToken) {
-    const expiresAtMs = readJwtExpiryMs(accessToken);
-    if (expiresAtMs === null) {
-        return false;
-    }
-    return expiresAtMs - Date.now() > ACCESS_TOKEN_REUSE_SKEW_MS;
-}
-// No signature verification: the issuer validates that, we only need `exp`.
-function readJwtExpiryMs(token) {
-    const payloadSegment = token.split(".")[1];
-    if (!payloadSegment) {
-        return null;
-    }
-    try {
-        const payload = JSON.parse(Buffer.from(payloadSegment, "base64url").toString("utf-8"));
-        if (!payload || typeof payload !== "object" || !("exp" in payload)) {
-            return null;
-        }
-        const { exp } = payload;
-        if (typeof exp !== "number" || !Number.isFinite(exp)) {
-            return null;
-        }
-        return exp * 1000;
-    }
-    catch {
-        return null;
-    }
-}
-let activeRefresh = null;
-/**
- * Exported so the `waitMs >= staleMs` invariant below can be asserted — it is
- * the load-bearing relationship in this whole mechanism and nothing else
- * enforces it.
- *
- * `staleMs` covers the worst case of both refresh requests timing out, so a
- * waiter never breaks a lock that is still doing useful work.
- *
- * `waitMs` must not be shorter. A waiter that gives up early goes down the
- * unlocked path *before* the holder has written its rotated pair, so the
- * already-rotated checks below still see the old token and spend it a second
- * time — the single-use double-spend this lock exists to prevent (CLO-164).
- * Equality is what makes "gave up" and "the holder is dead" the same condition.
- */
-export const SESSION_LOCK_OPTIONS = {
-    staleMs: API_AUTH_CONFIG_TIMEOUT_MS + WORKOS_AUTH_REQUEST_TIMEOUT_MS + 15_000,
-    waitMs: API_AUTH_CONFIG_TIMEOUT_MS + WORKOS_AUTH_REQUEST_TIMEOUT_MS + 15_000,
-    // That wait budget is 90s, so silence is not an option. Straight to stderr:
-    // `logger` writes to a file nobody is watching, and clack would assume an
-    // interactive command context that `lib/` does not have — while stderr keeps
-    // `--json` stdout parseable.
-    onWait: () => {
-        process.stderr.write(`Waiting for another ${cloudInvocation()} command to finish refreshing the session...\n`);
-    },
-};
-/**
- * Serializes everything that spends the single-use refresh token or rewrites
- * `auth.json`, across processes. Every such call site must go through this —
- * guarding one of them leaves the double-spend fully reachable via the others.
- *
- * The callback receives whether the lock was actually held; see `withFileLock`.
- */
-export function withSessionLock(fn) {
-    return withFileLock(REFRESH_LOCK_FILE, SESSION_LOCK_OPTIONS, fn);
-}
-/**
- * Pass the access token that got the 401. If the stored config has moved on
- * from it, another process (or an earlier command) already rotated the pair and
- * its access token is reused — refresh tokens are single-use, so spending ours
- * on a redundant exchange is what strands sessions. Reuse requires provable
- * lifetime left; see `hasUsableLifetime`.
- */
-export async function refreshAccessToken(failedAccessToken) {
-    if (activeRefresh) {
-        return activeRefresh;
-    }
-    activeRefresh = withSessionLock((held) => doRefresh(failedAccessToken, held)).finally(() => {
-        activeRefresh = null;
-    });
-    return activeRefresh;
-}
-/**
- * Re-mint the stored session scoped to a different organization, then persist
- * it. The read-exchange-write runs as one locked unit and re-reads inside the
- * lock: a concurrent refresh may have rotated the pair since the caller last
- * looked, and spreading a stale snapshot over it would write back a refresh
- * token the authentication service has already retired. Atomic rename stops
- * torn files; it does nothing about lost updates.
- */
-export function rotateActiveOrganization(target) {
-    return withSessionLock(async (held) => {
-        const config = readAuthConfig();
-        if (!config?.refreshToken) {
-            throw new SessionRefreshError(`No refresh token available. Run \`${cloudInvocation()} login\` to authenticate.`);
-        }
-        assertReplacementIsStorable(withActiveOrganization(config, target));
-        let pair;
-        try {
-            pair = await exchangeRefreshToken(config.refreshToken, target.workosOrgId);
-        }
-        catch (error) {
-            if (!(error instanceof RefreshTokenRejectedError)) {
-                throw error;
-            }
-            // Ran unlocked and lost the race: another process spent our refresh
-            // token. Its replacement is on disk, so the switch can still succeed.
-            const rotated = readRotatedConfig(config.refreshToken);
-            if (!rotated) {
-                discardIfRevoked(config.refreshToken, held);
-                throw error;
-            }
-            // A second single-use token needs its own proof.
-            assertReplacementIsStorable(withActiveOrganization(rotated, target));
-            logger.debug("Refresh token was consumed by another process; retrying org switch");
-            pair = await exchangeRefreshToken(rotated.refreshToken, target.workosOrgId);
-        }
-        const next = {
-            // Re-read once more: the exchange is the slow part, and a retry above
-            // means another process wrote in the meantime.
-            ...withActiveOrganization(readAuthConfig() ?? config, target),
-            accessToken: pair.accessToken,
-            refreshToken: pair.refreshToken,
-        };
-        writeAuthConfig(next);
-        return next;
-    });
-}
-// One shape, so the probe measures what the write stores.
-// `target.organizations` can be longer than the list on disk.
-function withActiveOrganization(base, target) {
-    return {
-        ...base,
-        activeOrganizationId: target.organizationId,
-        organizations: target.organizations,
-    };
-}
-async function doRefresh(failedAccessToken, held) {
-    const config = readAuthConfig();
-    if (!config?.refreshToken) {
-        // A SessionRefreshError so the specific message survives the API client's
-        // wrapping instead of being flattened to the generic one.
-        throw new SessionRefreshError(`No refresh token available. Run \`${cloudInvocation()} login\` to authenticate.`);
-    }
-    // When the lock was held this sees whatever the process ahead of us in the
-    // queue wrote. Unlocked it is only an optimisation, and the rejection path
-    // below carries the recovery.
-    //
-    // Falling through when the stored token has no life left is safe: `config`
-    // was just re-read, so `config.refreshToken` is the rotated one, not the
-    // caller's stale snapshot.
-    if (failedAccessToken &&
-        config.accessToken &&
-        config.accessToken !== failedAccessToken &&
-        hasUsableLifetime(config.accessToken)) {
-        logger.debug("Another process already refreshed the session; reusing its access token");
-        return config.accessToken;
-    }
-    // Preserve the active org across a routine refresh: re-mint for the same
-    // WorkOS org so the token's permissions stay scoped to it. An unscoped
-    // refresh would fall back to the user's WorkOS default org — the exact
-    // split-state this whole mechanism exists to prevent — so when an active
-    // org is set we require its workosOrgId. A config that predates the
-    // workosOrgId field (and so can't be scoped) is treated as stale: better
-    // a clear "re-login" error than a silently mis-scoped token that 403s on
-    // every permissioned call.
-    let activeWorkosOrgId;
-    if (config.activeOrganizationId) {
-        const activeOrg = config.organizations.find((o) => o.id === config.activeOrganizationId);
-        if (!activeOrg?.workosOrgId) {
-            throw new SessionRefreshError(`Your CLI session predates organization scoping. Run \`${cloudInvocation()} login\` to re-authenticate.`);
-        }
-        activeWorkosOrgId = activeOrg.workosOrgId;
-    }
-    // After the reuse check above, which writes nothing and so must not be
-    // refused for an unwritable directory.
-    assertReplacementIsStorable(config);
-    // The config the fresh pair is spread over. Replaced on the recovery path
-    // below, where another process wrote after we read.
-    let baseConfig = config;
-    let pair;
-    try {
-        pair = await exchangeRefreshToken(config.refreshToken, activeWorkosOrgId);
-    }
-    catch (error) {
-        if (!(error instanceof RefreshTokenRejectedError)) {
-            throw error;
-        }
-        // Consumed, not revoked: a process that raced past the lock spent our
-        // refresh token and stored a working pair, so the session lives on.
-        const rotated = readRotatedConfig(config.refreshToken);
-        if (!rotated) {
-            discardIfRevoked(config.refreshToken, held);
-            throw error;
-        }
-        if (hasUsableLifetime(rotated.accessToken)) {
-            logger.debug("Refresh token was consumed by another process; reusing its access token");
-            return rotated.accessToken;
-        }
-        // Its access token has aged out, so returning it would only burn the
-        // command's single retry. Spend its refresh token instead — the session
-        // lock is what keeps that second spend serialized.
-        // A second single-use token needs its own proof.
-        assertReplacementIsStorable(rotated);
-        logger.debug("Refresh token was consumed by another process; retrying with its rotated token");
-        pair = await exchangeRefreshToken(rotated.refreshToken, activeWorkosOrgId);
-        baseConfig = readAuthConfig() ?? rotated;
-    }
-    writeAuthConfig({
-        ...baseConfig,
-        accessToken: pair.accessToken,
-        refreshToken: pair.refreshToken,
-    });
-    return pair.accessToken;
-}
-function readRotatedConfig(usedRefreshToken) {
-    const latest = readAuthConfig();
-    if (!latest?.accessToken || latest.refreshToken === usedRefreshToken) {
-        return null;
-    }
-    return latest;
-}
-/**
- * The only path that discards credentials, so both guards matter.
- *
- * `held` — without the lock we may have raced past a process that legitimately
- * spent the token, and an `invalid_grant` becomes unattributable: it means
- * "dead token" and "someone beat me to it" equally. Deleting on a guess is how
- * a recoverable race turns into a forced browser login.
- *
- * The re-read — compare-and-clear immediately before unlinking, so a pair the
- * winner wrote between the rejection and here survives. Not airtight (there is
- * no atomic compare-and-unlink), but the window shrinks to microseconds and the
- * `held` gate covers the case that actually produced CLO-164.
- */
-function discardIfRevoked(spentRefreshToken, held) {
-    if (!held) {
-        logger.debug("Refresh rejected while unlocked; keeping credentials for the next attempt");
-        return;
-    }
-    const latest = readAuthConfig();
-    if (!latest || latest.refreshToken !== spentRefreshToken) {
-        logger.debug("Stored refresh token already moved on; keeping credentials");
-        return;
-    }
-    clearAuthConfig();
+    return { kind: "userLogin", accessToken: await getUserAccessToken() };
 }
 //# sourceMappingURL=auth.js.map

package/dist/cli/lib/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/cli/lib/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,WAAW,EACX,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EACL,SAAS,EACT,UAAU,EACV,iBAAiB,EACjB,uBAAuB,EACvB,SAAS,GACV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAwB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAuBrC,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AACjD,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAsBrD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA0B;IAC1D,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACvE,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,6BAA6B,EAAE,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,8FAA8F;QAC9F,0FAA0F;QAC1F,8EAA8E;QAC9E,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,MAAM,CAAC,WAAW;QACzB,cAAc,EAAE,MAAM,CAAC,oBAAoB;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAkB;IAChD,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACnD,IAAI,CAAC;QACH,aAAa,CAAC,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,mBAAmB,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAkB;IAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,+DAA+D;AAC/D,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1C,SAAS,mBAAmB;IAC1B,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC;IAC/C,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0EAA0E;QAC1E,6CAA6C;QAC7C,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,0CAA0C,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC;gBACpC,SAAS;YACX,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,+CAA+C;YAC/C,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,uCAAuC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,mEAAmE;AACnE,EAAE;AACF,+EAA+E;AAC/E,mEAAmE;AACnE,6EAA6E;AAC7E,4BAA4B;AAC5B,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,SAAS,2BAA2B,CAAC,eAA2B;IAC9D,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,YAAY,CAAC;IAC1D,MAAM,WAAW,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,aAAa,CAAC;IAC7D,IAAI,CAAC;QACH,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,yEAAyE;QACzE,uCAAuC;QACvC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACnF,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACnC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gBAAgB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,gEAAgE,CAAC,CAAC;QAC1F,MAAM,IAAI,sBAAsB,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,6EAA6E;AAC7E,SAAS,gBAAgB,CAAC,GAAG,KAAe;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,UAAU,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB,EACpB,WAAoB;IAEpB,MAAM,iBAAiB,GAAG,MAAM,kBAAkB,CAAC,GAAG,SAAS,EAAE,kBAAkB,EAAE;QACnF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,0BAA0B,CAAC;KACxD,CAAC,CAAC;IACH,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC;QAC1B,4EAA4E;QAC5E,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,EAAE,wCAAwC,CAAC,CAAC;QAC7F,MAAM,IAAI,uBAAuB,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,CAA+B,CAAC;IAE1F,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,uBAAuB,EAAE;QACjE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,8BAA8B,CAAC;QAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,cAAc;YACzB,aAAa,EAAE,YAAY;YAC3B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGpC,CAAC;IAEF,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,IAAiB;IAC9D,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gEAAgE;QAChE,MAAM,IAAI,uBAAuB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,yEAAyE;AACzE,YAAY;AACZ,MAAM,yBAAyB,GAAG,eAAe,CAAC;AAElD;;;;;;GAMG;AACH,KAAK,UAAU,sBAAsB,CAAC,QAAkB;IACtD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,wBAAwB,CAAC,CAAC;IAE/E,IAAI,SAAS,KAAK,yBAAyB,EAAE,CAAC;QAC5C,OAAO,IAAI,yBAAyB,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,uBAAuB,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,sBAAsB;AACtB,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,MAAM,WAAW,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,0BAA0B,CAAC;AAC/D,CAAC;AAED,4EAA4E;AAC5E,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,OAA2B,CAAC;QAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,GAAG,IAAI,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,IAAI,aAAa,GAA2B,IAAI,CAAC;AAEjD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAoB;IACnD,OAAO,EAAE,0BAA0B,GAAG,8BAA8B,GAAG,MAAM;IAC7E,MAAM,EAAE,0BAA0B,GAAG,8BAA8B,GAAG,MAAM;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,6BAA6B;IAC7B,MAAM,EAAE,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uBAAuB,eAAe,EAAE,gDAAgD,CACzF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAI,EAAiC;IAClE,OAAO,YAAY,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,iBAA0B;IACjE,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,aAAa,GAAG,eAAe,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACzF,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAIxC;IACC,OAAO,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;YAC1B,MAAM,IAAI,mBAAmB,CAC3B,qCAAqC,eAAe,EAAE,2BAA2B,CAClF,CAAC;QACJ,CAAC;QAED,2BAA2B,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAEpE,IAAI,IAAe,CAAC;QACpB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,yBAAyB,CAAC,EAAE,CAAC;gBAClD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,oEAAoE;YACpE,sEAAsE;YACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACvD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,iDAAiD;YACjD,2BAA2B,CAAC,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YACrE,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;YACnF,IAAI,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,IAAI,GAAe;YACvB,sEAAsE;YACtE,+CAA+C;YAC/C,GAAG,sBAAsB,CAAC,cAAc,EAAE,IAAI,MAAM,EAAE,MAAM,CAAC;YAC7D,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;QACF,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0DAA0D;AAC1D,8DAA8D;AAC9D,SAAS,sBAAsB,CAC7B,IAAgB,EAChB,MAAqE;IAErE,OAAO;QACL,GAAG,IAAI;QACP,oBAAoB,EAAE,MAAM,CAAC,cAAc;QAC3C,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,iBAAqC,EAAE,IAAa;IAC3E,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;QAC1B,0EAA0E;QAC1E,0DAA0D;QAC1D,MAAM,IAAI,mBAAmB,CAC3B,qCAAqC,eAAe,EAAE,2BAA2B,CAClF,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,8BAA8B;IAC9B,EAAE;IACF,2EAA2E;IAC3E,yEAAyE;IACzE,2BAA2B;IAC3B,IACE,iBAAiB;QACjB,MAAM,CAAC,WAAW;QAClB,MAAM,CAAC,WAAW,KAAK,iBAAiB;QACxC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,EACrC,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;QACxF,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,oEAAoE;IACpE,yEAAyE;IACzE,yEAAyE;IACzE,2BAA2B;IAC3B,IAAI,iBAAqC,CAAC;IAC1C,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACzF,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC;YAC5B,MAAM,IAAI,mBAAmB,CAC3B,yDAAyD,eAAe,EAAE,8BAA8B,CACzG,CAAC;QACJ,CAAC;QACD,iBAAiB,GAAG,SAAS,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED,uEAAuE;IACvE,uCAAuC;IACvC,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAEpC,0EAA0E;IAC1E,oDAAoD;IACpD,IAAI,UAAU,GAAG,MAAM,CAAC;IACxB,IAAI,IAAe,CAAC;IACpB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,yBAAyB,CAAC,EAAE,CAAC;YAClD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,sEAAsE;QACtE,oEAAoE;QACpE,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YAC5C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;YACxF,OAAO,OAAO,CAAC,WAAW,CAAC;QAC7B,CAAC;QACD,qEAAqE;QACrE,wEAAwE;QACxE,mDAAmD;QACnD,iDAAiD;QACjD,2BAA2B,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;QAC/F,IAAI,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QAC3E,UAAU,GAAG,cAAc,EAAE,IAAI,OAAO,CAAC;IAC3C,CAAC;IAED,eAAe,CAAC;QACd,GAAG,UAAU;QACb,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;KAChC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC,WAAW,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CAAC,gBAAwB;IACjD,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,IAAI,CAAC,MAAM,EAAE,WAAW,IAAI,MAAM,CAAC,YAAY,KAAK,gBAAgB,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB,CAAC,iBAAyB,EAAE,IAAa;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC1F,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,YAAY,KAAK,iBAAiB,EAAE,CAAC;QACzD,MAAM,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC3E,OAAO;IACT,CAAC;IACD,eAAe,EAAE,CAAC;AACpB,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/cli/lib/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAQrD,gGAAgG;AAChG,oGAAoG;AACpG,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA0B;IAChE,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACvE,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,EAAE,EAAE,CAAC;AACxE,CAAC"}

package/dist/cli/lib/cli-login.d.ts

@@ -0,0 +1,12 @@
+import { CliLoginFailure } from "./errors.js";
+export interface CliLogin {
+    getAccessToken(): Promise<string | undefined>;
+    refreshAccessToken(failedAccessToken: string): Promise<string>;
+    consoleApiUrl(): string;
+    classify(error: unknown): CliLoginFailure;
+}
+export declare const CORE_ERROR_FAILURES: readonly [readonly ["NotLoggedInError", "notLoggedIn"], readonly ["SessionRejectedError", "sessionRejected"], readonly ["ReauthenticationRequiredError", "reauthenticationRequired"], readonly ["SessionLockUnavailableError", "lockUnavailable"], readonly ["SessionUnstorableError", "unstorable"], readonly ["SessionRefreshUnavailableError", "refreshUnavailable"]];
+export declare function loadCliLogin(): CliLogin;
+export declare function getUserAccessToken(): Promise<string>;
+export declare function refreshUserAccessToken(failedAccessToken: string): Promise<string>;
+//# sourceMappingURL=cli-login.d.ts.map

package/dist/cli/lib/cli-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-login.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/cli-login.ts"],"names":[],"mappings":"AAGA,OAAO,EAAiB,eAAe,EAAE,MAAM,aAAa,CAAC;AAS7D,MAAM,WAAW,QAAQ;IACvB,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC9C,kBAAkB,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/D,aAAa,IAAI,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAAC;CAC3C;AAWD,eAAO,MAAM,mBAAmB,0WAOtB,CAAC;AAIX,wBAAgB,YAAY,IAAI,QAAQ,CAKvC;AAGD,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAc1D;AAID,wBAAsB,sBAAsB,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOvF"}