alchemy 2.0.0-beta.76 → 2.0.0-beta.78

package/lib/Auth/Demand.d.ts

@@ -6,17 +6,29 @@
  * out of local emulation via `Alchemy.remote()`, a local Worker binding
  * that proxies to a remote resource (`dev: { remote: true }`), or the
  * deletion of a row that was last reconciled live — credentials are
- * demanded exactly once, up front, in the exec process (which owns the
- * tty), BEFORE apply begins:
+ * validated up front, BEFORE apply begins: the gate resolves each demanded
+ * provider's credentials through the same precedence the run will use. The
+ * seam never starts a login flow: missing credentials fail with the typed
+ * {@link CredentialsRequired} error naming the demanding resources and
+ * pointing at `alchemy profile edit` — the profile command is the only
+ * place logins happen.
  *
- *   - interactive: the provider's existing `configure` flow runs, prefixed
- *     with a human-readable reason naming the demanding resources
- *     (threaded via {@link ConfigureContext}'s `reason`).
- *   - non-interactive: fail with the typed {@link CredentialsRequired}
- *     error naming the demanding resources and pointing at `alchemy login`.
+ * How deep the up-front resolution goes is PROVIDER-DEPENDENT — it runs
+ * the provider's `read`, no more:
  *
- * The RPC sidecar never prompts — its stdio is piped and it only ever
- * reads credentials persisted by this seam (or a prior `alchemy login`).
+ * - Cloudflare's `read` eagerly checks OAuth expiry, silently refreshes,
+ *   and persists under the profile lock — so a dead refresh token fails
+ *   here as a typed `NeedsReauth`, and child processes (which only ever
+ *   read what a parent persisted) start with a warm token.
+ * - AWS's `read` returns a credentials RECIPE whose inner effect stays
+ *   unevaluated (SSO tokens are loaded lazily by consumers), so an
+ *   expired SSO token passes the gate and still surfaces mid-run. Local-mode
+ *   AWS providers carry a floci-scoped environment of their own (see
+ *   `AWS/Local/FlociServices.ts`) and ensure the emulator there.
+ *
+ * The demand scan keys on provider MODE, not plan action — noop live rows
+ * still demand (their runtime proxies need live credentials to serve), so
+ * a watch restart re-runs this resolution even for an unchanged plan.
  *
  * Non-dev runs (`alchemy deploy` / `destroy`) never enter this seam:
  * state-store init and live providers drive the pre-existing lazy
@@ -25,6 +37,7 @@
 import * as Config from "effect/Config";
 import * as Effect from "effect/Effect";
 import type { Plan } from "../Plan.ts";
+import { AuthError, NeedsReauth } from "./AuthProvider.ts";
 /** Why a plan row demands live (cloud) credentials during a dev run. */
 export type CredentialDemandReason = 
 /** The resource's resolved provider mode is `"live"` (`Alchemy.remote()`). */
@@ -52,9 +65,9 @@ declare const CredentialsRequired_base: new <A extends Record<string, any> = {}>
     readonly _tag: "CredentialsRequired";
 } & Readonly<A>;
 /**
- * A dev-mode plan needs cloud credentials, none are configured for the
- * active profile, and the process is non-interactive so the configure flow
- * cannot run. The message names the demanding resources and the fix.
+ * A dev-mode plan needs cloud credentials and none are configured for the
+ * active profile. The message names the demanding resources and the exact
+ * `alchemy profile edit` invocation that fixes it.
  */
 export declare class CredentialsRequired extends CredentialsRequired_base<{
     message: string;
@@ -70,7 +83,7 @@ export declare class CredentialsRequired extends CredentialsRequired_base<{
  * Build the typed {@link CredentialsRequired} failure for a demand.
  * Exported so tests can pin the message format.
  */
-export declare const credentialsRequired: (demand: CredentialDemand, profileName: string) => CredentialsRequired;
+export declare const credentialsRequired: (demand: CredentialDemand, profileName: string) => Effect.Effect<never, CredentialsRequired>;
 /**
  * Scan a plan for rows that need live (cloud) credentials during a dev
  * run, grouped by cloud provider:
@@ -89,36 +102,48 @@ export declare const credentialsRequired: (demand: CredentialDemand, profileName
  * they resolve credentials lazily exactly as they do today.
  */
 export declare const collectCredentialDemands: (plan: Plan) => CredentialDemand[];
-export interface DemandCredentialsOptions {
-    /**
-     * Overrides {@link isNonInteractive} — a test seam. When `true`, a
-     * missing profile fails with {@link CredentialsRequired} instead of
-     * driving the interactive configure flow.
-     */
-    readonly nonInteractive?: boolean;
-}
 /**
- * Ensure credentials exist for every demand, prompting at most once per
- * provider and only when nothing is configured yet:
+ * Validate credentials for every demand. Never starts a login flow —
+ * logging in belongs to `alchemy profile edit` exclusively:
  *
- *   - already configured for the active profile → no-op (never re-prompts)
- *   - missing + interactive → the provider's `configure` flow runs (via
- *     `AlchemyProfile.loadOrConfigure`), prefixed with a reason naming the
- *     demanding resources
- *   - missing + non-interactive (and not CI) → typed
- *     {@link CredentialsRequired} failure
- *   - CI → `loadOrConfigure` picks the provider's non-interactive default
- *     (env-var credentials), matching every other CI path
+ *   - configured for the active profile → resolve the credentials through
+ *     the exact precedence the run will use ({@link resolveProviderConfig}:
+ *     CI environment, explicit env vars, then the profile). Resolution
+ *     runs the provider's `read` — how much that validates and warms is
+ *     provider-dependent (see the module header): Cloudflare eagerly
+ *     refreshes and persists so a dead refresh token fails HERE as a
+ *     typed {@link NeedsReauth} naming the demanding resources, while
+ *     AWS's lazy credential recipe defers SSO-token failures to mid-run.
+ *   - missing → typed {@link CredentialsRequired} failure with the exact
+ *     `alchemy profile edit` invocation to run
+ *   - CI → validates the provider's environment credentials directly,
+ *     matching every other CI path without creating profile state
  *
  * Demands whose cloud has no registered auth provider are skipped (bare
  * engine runs with test providers demand nothing). All context is
- * resolved optionally, so the effect is safe to run in any environment.
+ * resolved optionally, so the effect is safe to run in any environment —
+ * and a plan with zero demand touches no credentials at all.
+ */
+export declare const demandCredentials: (demands: readonly CredentialDemand[]) => Effect.Effect<void, AuthError | Config.ConfigError | CredentialsRequired | NeedsReauth | import("effect/PlatformError").PlatformError | import("./Profile.ts").ProfileError, never>;
+/**
+ * Plan-time seam for `Alchemy.remote()` rows. The planner probes every new
+ * resource with its provider's `read` (engine-level adoption) — for a
+ * live-mode row in a dev run that is a real cloud call, made BEFORE
+ * {@link demandPlanCredentials} could run in apply. Demanding here first
+ * turns "nothing configured" into the typed {@link CredentialsRequired}
+ * (naming the rows and the exact `alchemy profile edit` command) instead
+ * of whatever raw error the first credential-less read produces. Bindings
+ * and live deletions are still gated in apply — nothing reads for them
+ * during plan.
  */
-export declare const demandCredentials: (demands: readonly CredentialDemand[], options?: DemandCredentialsOptions | undefined) => Effect.Effect<undefined, import("./AuthProvider.ts").AuthError | Config.ConfigError | CredentialsRequired | import("effect/PlatformError").PlatformError, never>;
+export declare const demandRemoteCredentials: (resources: ReadonlyArray<{
+    readonly Type: string;
+    readonly FQN: string;
+}>) => Effect.Effect<void, AuthError | Config.ConfigError | CredentialsRequired | NeedsReauth | import("effect/PlatformError").PlatformError | import("./Profile.ts").ProfileError, never>;
 /**
  * The one-call seam wired into the dev path: scan the plan for live
  * demand and, if any, run {@link demandCredentials} BEFORE apply begins.
  */
-export declare const demandPlanCredentials: (plan: Plan, options?: DemandCredentialsOptions) => Effect.Effect<undefined, import("./AuthProvider.ts").AuthError | Config.ConfigError | CredentialsRequired | import("effect/PlatformError").PlatformError, never>;
+export declare const demandPlanCredentials: (plan: Plan) => Effect.Effect<void, AuthError | Config.ConfigError | CredentialsRequired | NeedsReauth | import("effect/PlatformError").PlatformError | import("./Profile.ts").ProfileError, never>;
 export {};
 //# sourceMappingURL=Demand.d.ts.map

package/lib/Auth/Demand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Demand.d.ts","sourceRoot":"","sources":["../../src/Auth/Demand.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAe,IAAI,EAAE,MAAM,YAAY,CAAC;AAKpD,wEAAwE;AACxE,MAAM,MAAM,sBAAsB;AAChC,8EAA8E;AAC5E,QAAQ;AACV,kHAAkH;GAChH,gBAAgB;AAClB,uGAAuG;GACrG,aAAa,CAAC;AAElB,MAAM,WAAW,iBAAiB;IAChC,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;CACzC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAClD;;;;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,yBAEvC;IACA,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;CAAG;AAqBL;;;GAGG;AACH,eAAO,MAAM,mBAAmB,WACtB,gBAAgB,eACX,MAAM,KAClB,mBAaC,CAAC;AA8BL;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,SAAU,IAAI,KAAG,gBAAgB,EAgCrE,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,4PA4B7B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,SAC1B,IAAI,YACA,wBAAwB,qKAC2B,CAAC"}
+{"version":3,"file":"Demand.d.ts","sourceRoot":"","sources":["../../src/Auth/Demand.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,EAAe,IAAI,EAAE,MAAM,YAAY,CAAC;AAEpD,OAAO,EACL,SAAS,EAET,WAAW,EAEZ,MAAM,mBAAmB,CAAC;AAS3B,wEAAwE;AACxE,MAAM,MAAM,sBAAsB;AAChC,8EAA8E;AAC5E,QAAQ;AACV,kHAAkH;GAChH,gBAAgB;AAClB,uGAAuG;GACrG,aAAa,CAAC;AAElB,MAAM,WAAW,iBAAiB;IAChC,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;CACzC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAClD;;;;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,yBAEvC;IACA,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;CAAG;AAqBL;;;GAGG;AACH,eAAO,MAAM,mBAAmB,WACtB,gBAAgB,eACX,MAAM,KAClB,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,mBAAmB,CAiBvC,CAAC;AA4BL;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,SAAU,IAAI,KAAG,gBAAgB,EAgCrE,CAAC;AA6BF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,iBAAiB,+NA2E7B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,cACvB,aAAa,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,wLAgB1E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,SAAU,IAAI,wLACG,CAAC"}

package/lib/Auth/Demand.js

@@ -6,17 +6,29 @@
  * out of local emulation via `Alchemy.remote()`, a local Worker binding
  * that proxies to a remote resource (`dev: { remote: true }`), or the
  * deletion of a row that was last reconciled live — credentials are
- * demanded exactly once, up front, in the exec process (which owns the
- * tty), BEFORE apply begins:
+ * validated up front, BEFORE apply begins: the gate resolves each demanded
+ * provider's credentials through the same precedence the run will use. The
+ * seam never starts a login flow: missing credentials fail with the typed
+ * {@link CredentialsRequired} error naming the demanding resources and
+ * pointing at `alchemy profile edit` — the profile command is the only
+ * place logins happen.
  *
- *   - interactive: the provider's existing `configure` flow runs, prefixed
- *     with a human-readable reason naming the demanding resources
- *     (threaded via {@link ConfigureContext}'s `reason`).
- *   - non-interactive: fail with the typed {@link CredentialsRequired}
- *     error naming the demanding resources and pointing at `alchemy login`.
+ * How deep the up-front resolution goes is PROVIDER-DEPENDENT — it runs
+ * the provider's `read`, no more:
  *
- * The RPC sidecar never prompts — its stdio is piped and it only ever
- * reads credentials persisted by this seam (or a prior `alchemy login`).
+ * - Cloudflare's `read` eagerly checks OAuth expiry, silently refreshes,
+ *   and persists under the profile lock — so a dead refresh token fails
+ *   here as a typed `NeedsReauth`, and child processes (which only ever
+ *   read what a parent persisted) start with a warm token.
+ * - AWS's `read` returns a credentials RECIPE whose inner effect stays
+ *   unevaluated (SSO tokens are loaded lazily by consumers), so an
+ *   expired SSO token passes the gate and still surfaces mid-run. Local-mode
+ *   AWS providers carry a floci-scoped environment of their own (see
+ *   `AWS/Local/FlociServices.ts`) and ensure the emulator there.
+ *
+ * The demand scan keys on provider MODE, not plan action — noop live rows
+ * still demand (their runtime proxies need live credentials to serve), so
+ * a watch restart re-runs this resolution even for an unchanged plan.
  *
  * Non-dev runs (`alchemy deploy` / `destroy`) never enter this seam:
  * state-store init and live providers drive the pre-existing lazy
@@ -26,13 +38,16 @@ import * as Config from "effect/Config";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
-import { isNonInteractive } from "../Util/interactive.js";
-import { AuthProviders } from "./AuthProvider.js";
-import { ALCHEMY_PROFILE, AlchemyProfile } from "./Profile.js";
+import * as Result from "effect/Result";
+import * as Schema from "effect/Schema";
+import { profileCommandHint } from "../Util/interactive.js";
+import { AuthError, AuthProviders, NeedsReauth, presentEnvironment, } from "./AuthProvider.js";
+import { ALCHEMY_PROFILE, DEFAULT_PROFILE_NAME, ProfileStore, SuppressMissingProviderConfig, } from "./Profile.js";
+import { resolveProviderConfig } from "./Resolve.js";
 /**
- * A dev-mode plan needs cloud credentials, none are configured for the
- * active profile, and the process is non-interactive so the configure flow
- * cannot run. The message names the demanding resources and the fix.
+ * A dev-mode plan needs cloud credentials and none are configured for the
+ * active profile. The message names the demanding resources and the exact
+ * `alchemy profile edit` invocation that fixes it.
  */
 export class CredentialsRequired extends Data.TaggedError("CredentialsRequired") {
 }
@@ -55,35 +70,36 @@ const resourceLines = (demand) => demand.resources
  * Build the typed {@link CredentialsRequired} failure for a demand.
  * Exported so tests can pin the message format.
  */
-export const credentialsRequired = (demand, profileName) => new CredentialsRequired({
-    provider: demand.provider,
-    resources: demand.resources.map((r) => r.fqn),
-    reason: [...new Set(demand.resources.map((r) => r.reason))].join(", "),
-    message: `${demand.provider} credentials are required, but none are configured ` +
-        `for profile '${profileName}' and this process is non-interactive so ` +
-        "they can't be configured now.\n" +
-        `These resources require ${demand.provider} credentials:\n` +
-        `${resourceLines(demand)}\n` +
-        `Run \`alchemy login --profile ${profileName}\` to configure ` +
-        "credentials, or set CI=1 to use environment-variable credentials.",
+export const credentialsRequired = (demand, profileName) => Effect.gen(function* () {
+    const command = yield* profileCommandHint(`alchemy profile edit --profile ${profileName} --add ${demand.provider}`);
+    return yield* new CredentialsRequired({
+        provider: demand.provider,
+        resources: demand.resources.map((r) => r.fqn),
+        reason: [...new Set(demand.resources.map((r) => r.reason))].join(", "),
+        message: `${demand.provider} credentials are required, but none are configured ` +
+            `for profile '${profileName}'.\n` +
+            `These resources require ${demand.provider} credentials:\n` +
+            `${resourceLines(demand)}\n` +
+            `Run \`${command}\` to configure ` +
+            "credentials, or set CI=1 to use environment-variable credentials.",
+    });
 });
 /**
- * The human-readable reason shown at the top of an interactive configure
- * flow triggered by this seam (threaded via {@link ConfigureContext}).
+ * The slice of binding data the demand scan cares about: local runtimes
+ * mark cloud-proxied bindings with a truthy `devRemote` entry.
  */
-const demandBanner = (demand) => `This dev session requires ${demand.provider} credentials:\n` +
-    resourceLines(demand);
+const RemoteBindingData = Schema.Struct({
+    devRemote: Schema.optional(Schema.Record(Schema.String, Schema.Boolean)),
+});
+const decodeRemoteBindingData = Schema.decodeUnknownResult(RemoteBindingData);
 const bindingDemandsRemote = (bindings) => (bindings ?? []).some((binding) => {
     // A binding being REMOVED needs no runtime proxy — the restarted
     // local instance simply no longer carries it.
     if (binding.action === "delete")
         return false;
-    const data = binding.data;
-    return (data != null &&
-        typeof data === "object" &&
-        data.devRemote != null &&
-        typeof data.devRemote === "object" &&
-        Object.values(data.devRemote).some((remote) => remote === true));
+    const data = decodeRemoteBindingData(binding.data);
+    return (Result.isSuccess(data) &&
+        Object.values(data.success.devRemote ?? {}).some((remote) => remote === true));
 });
 /**
  * Scan a plan for rows that need live (cloud) credentials during a dev
@@ -133,49 +149,123 @@ export const collectCredentialDemands = (plan) => {
     }));
 };
 /**
- * Ensure credentials exist for every demand, prompting at most once per
- * provider and only when nothing is configured yet:
+ * Re-fail a warm-up resolution error with the demand attached, so the user
+ * sees WHY a dev run wanted cloud credentials. Tags are preserved —
+ * consumers match `NeedsReauth`/`AuthError` by tag, never by message.
+ */
+const attachDemandContext = (demand) => (self) => self.pipe(Effect.mapError((error) => {
+    const message = `${error.message}\n` +
+        `These resources require ${demand.provider} credentials:\n` +
+        resourceLines(demand);
+    return error._tag === "NeedsReauth"
+        ? new NeedsReauth({
+            provider: error.provider,
+            profile: error.profile,
+            message,
+            cause: error.cause,
+        })
+        : new AuthError({ message, cause: error.cause });
+}));
+/**
+ * Validate credentials for every demand. Never starts a login flow —
+ * logging in belongs to `alchemy profile edit` exclusively:
  *
- *   - already configured for the active profile → no-op (never re-prompts)
- *   - missing + interactive → the provider's `configure` flow runs (via
- *     `AlchemyProfile.loadOrConfigure`), prefixed with a reason naming the
- *     demanding resources
- *   - missing + non-interactive (and not CI) → typed
- *     {@link CredentialsRequired} failure
- *   - CI → `loadOrConfigure` picks the provider's non-interactive default
- *     (env-var credentials), matching every other CI path
+ *   - configured for the active profile → resolve the credentials through
+ *     the exact precedence the run will use ({@link resolveProviderConfig}:
+ *     CI environment, explicit env vars, then the profile). Resolution
+ *     runs the provider's `read` — how much that validates and warms is
+ *     provider-dependent (see the module header): Cloudflare eagerly
+ *     refreshes and persists so a dead refresh token fails HERE as a
+ *     typed {@link NeedsReauth} naming the demanding resources, while
+ *     AWS's lazy credential recipe defers SSO-token failures to mid-run.
+ *   - missing → typed {@link CredentialsRequired} failure with the exact
+ *     `alchemy profile edit` invocation to run
+ *   - CI → validates the provider's environment credentials directly,
+ *     matching every other CI path without creating profile state
  *
  * Demands whose cloud has no registered auth provider are skipped (bare
  * engine runs with test providers demand nothing). All context is
- * resolved optionally, so the effect is safe to run in any environment.
+ * resolved optionally, so the effect is safe to run in any environment —
+ * and a plan with zero demand touches no credentials at all.
  */
-export const demandCredentials = Effect.fn("Alchemy.demandCredentials")(function* (demands, options) {
+export const demandCredentials = Effect.fn("Alchemy.demandCredentials")(function* (demands) {
     if (demands.length === 0)
         return;
     const registry = Option.getOrUndefined(yield* Effect.serviceOption(AuthProviders));
-    const profile = Option.getOrUndefined(yield* Effect.serviceOption(AlchemyProfile));
+    const profile = Option.getOrUndefined(yield* Effect.serviceOption(ProfileStore));
     if (registry === undefined || profile === undefined)
         return;
-    const profileName = yield* ALCHEMY_PROFILE;
-    const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
-    const nonInteractive = options?.nonInteractive ?? isNonInteractive();
-    for (const demand of demands) {
+    const ci = yield* Config.Boolean("CI").pipe(Config.withDefault(false));
+    // CI credentials come exclusively from the environment. Do not require
+    // or inspect a local profile first: CI runners intentionally have no
+    // profile manifest, and doing so would also risk consulting a developer's
+    // stored profiles when this path is exercised locally under Doppler.
+    const configuredProfile = yield* Config.option(ALCHEMY_PROFILE);
+    const profileName = Option.getOrElse(configuredProfile, () => DEFAULT_PROFILE_NAME);
+    yield* Effect.forEach(demands, (demand) => Effect.gen(function* () {
         const auth = registry[demand.provider];
         if (auth == null)
-            continue;
+            return;
+        if (ci) {
+            if (auth.readEnvironment === undefined) {
+                return yield* credentialsRequired(demand, profileName);
+            }
+            return yield* auth.readEnvironment.pipe(attachDemandContext(demand));
+        }
+        // Read-only precheck of the two non-CI configuration sources the
+        // resolution precedence below consults: environment credentials
+        // (which win regardless of the selected profile), or a profile
+        // entry. "Nothing configured" fails with the actionable
+        // {@link CredentialsRequired} here, WITHOUT entering
+        // `resolveProviderConfig`: its profile path goes through
+        // `ensureProfile`, which fails a nonexistent profile with a
+        // generic ProfileError that would bury which resources demanded
+        // credentials and what command fixes it.
+        const envUsable = auth.readEnvironment !== undefined &&
+            (yield* presentEnvironment(auth.environment)) !== undefined;
         const existing = yield* profile.getProfile(profileName);
-        if (existing?.[auth.name] != null)
-            continue;
-        if (!ci && nonInteractive) {
+        if (existing?.providers[auth.name] == null && !envUsable) {
             return yield* credentialsRequired(demand, profileName);
         }
-        const ctx = { ci, reason: demandBanner(demand) };
-        yield* profile.loadOrConfigure(auth, profileName, ctx);
-    }
+        // Something IS configured — resolve through the same precedence
+        // the run's lazy credential flow uses, so the gate can never
+        // pass something resolution would later reject (or vice versa).
+        // Suppressed missing-config mode turns a check/resolve race into
+        // the typed tag below instead of a generic AuthError; it also
+        // mutes the env-credentials warning here — the run's own
+        // resolution still emits it.
+        const resolved = yield* resolveProviderConfig(demand.provider).pipe(Effect.provideService(AuthProviders, registry), Effect.provideService(ProfileStore, profile), Effect.provideService(SuppressMissingProviderConfig, true), Effect.catchTag("MissingProviderConfig", () => credentialsRequired(demand, profileName)), Effect.catchTag("ProfileError", (error) => new AuthError({ message: error.message, cause: error })));
+        yield* resolved.resolve.pipe(attachDemandContext(demand));
+    }), { concurrency: 4, discard: true });
 });
+/**
+ * Plan-time seam for `Alchemy.remote()` rows. The planner probes every new
+ * resource with its provider's `read` (engine-level adoption) — for a
+ * live-mode row in a dev run that is a real cloud call, made BEFORE
+ * {@link demandPlanCredentials} could run in apply. Demanding here first
+ * turns "nothing configured" into the typed {@link CredentialsRequired}
+ * (naming the rows and the exact `alchemy profile edit` command) instead
+ * of whatever raw error the first credential-less read produces. Bindings
+ * and live deletions are still gated in apply — nothing reads for them
+ * during plan.
+ */
+export const demandRemoteCredentials = (resources) => {
+    const byProvider = new Map();
+    for (const resource of resources) {
+        const provider = cloudOf(resource.Type);
+        byProvider.set(provider, [
+            ...(byProvider.get(provider) ?? []),
+            { fqn: resource.FQN, reason: "remote" },
+        ]);
+    }
+    return demandCredentials([...byProvider.entries()].map(([provider, resources]) => ({
+        provider,
+        resources,
+    })));
+};
 /**
  * The one-call seam wired into the dev path: scan the plan for live
  * demand and, if any, run {@link demandCredentials} BEFORE apply begins.
  */
-export const demandPlanCredentials = (plan, options) => demandCredentials(collectCredentialDemands(plan), options);
+export const demandPlanCredentials = (plan) => demandCredentials(collectCredentialDemands(plan));
 //# sourceMappingURL=Demand.js.map

package/lib/Auth/Demand.js.map

@@ -1 +1 @@
-{"version":3,"file":"Demand.js","sourceRoot":"","sources":["../../src/Auth/Demand.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAyB,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AA4B/D;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,IAAI,CAAC,WAAW,CACvD,qBAAqB,CASrB;CAAG;AAEL,MAAM,cAAc,GAAG,CAAC,MAA8B,EAAU,EAAE;IAChE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,kDAAkD,CAAC;QAC5D,KAAK,gBAAgB;YACnB,OAAO,yEAAyE,CAAC;QACnF,KAAK,aAAa;YAChB,OAAO,yDAAyD,CAAC;IACrE,CAAC;AACH,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAErE,MAAM,aAAa,GAAG,CAAC,MAAwB,EAAU,EAAE,CACzD,MAAM,CAAC,SAAS;KACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;KACxD,IAAI,CAAC,IAAI,CAAC,CAAC;AAEhB;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,MAAwB,EACxB,WAAmB,EACE,EAAE,CACvB,IAAI,mBAAmB,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7C,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACtE,OAAO,EACL,GAAG,MAAM,CAAC,QAAQ,qDAAqD;QACvE,gBAAgB,WAAW,2CAA2C;QACtE,iCAAiC;QACjC,2BAA2B,MAAM,CAAC,QAAQ,iBAAiB;QAC3D,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI;QAC5B,iCAAiC,WAAW,kBAAkB;QAC9D,mEAAmE;CACtE,CAAC,CAAC;AAEL;;;GAGG;AACH,MAAM,YAAY,GAAG,CAAC,MAAwB,EAAU,EAAE,CACxD,6BAA6B,MAAM,CAAC,QAAQ,iBAAiB;IAC7D,aAAa,CAAC,MAAM,CAAC,CAAC;AAExB,MAAM,oBAAoB,GAAG,CAC3B,QAA4C,EACnC,EAAE,CACX,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;IAChC,iEAAiE;IACjE,8CAA8C;IAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,IAGR,CAAC;IACd,OAAO,CACL,IAAI,IAAI,IAAI;QACZ,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,CAAC,SAAS,IAAI,IAAI;QACtB,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAChE,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,IAAU,EAAsB,EAAE;IACzE,MAAM,UAAU,GAAG,IAAI,GAAG,EAA+C,CAAC;IAC1E,MAAM,GAAG,GAAG,CACV,IAAY,EACZ,GAAW,EACX,MAA8B,EACxB,EAAE;QACR,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,SAAS,GACb,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAkC,CAAC;QACxE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpD,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACtC,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC;aAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/D,QAAQ;QACR,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1D,GAAG;YACH,MAAM;SACP,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;AACN,CAAC,CAAC;AAWF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,2BAA2B,CAAC,CACrE,QAAQ,CAAC,EACP,OAAoC,EACpC,OAAkC;IAElC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CACpC,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,CAC3C,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CACnC,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAC5C,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO;IAC5D,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IAC3C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,gBAAgB,EAAE,CAAC;IACrE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,IAAI,IAAI,IAAI;YAAE,SAAS;QAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI;YAAE,SAAS;QAC5C,IAAI,CAAC,EAAE,IAAI,cAAc,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,GAAG,GAAqB,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,IAAU,EACV,OAAkC,EAClC,EAAE,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC"}
+{"version":3,"file":"Demand.js","sourceRoot":"","sources":["../../src/Auth/Demand.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EACL,SAAS,EACT,aAAa,EACb,WAAW,EACX,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,YAAY,EACZ,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AA4BrD;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,IAAI,CAAC,WAAW,CACvD,qBAAqB,CASrB;CAAG;AAEL,MAAM,cAAc,GAAG,CAAC,MAA8B,EAAU,EAAE;IAChE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,kDAAkD,CAAC;QAC5D,KAAK,gBAAgB;YACnB,OAAO,yEAAyE,CAAC;QACnF,KAAK,aAAa;YAChB,OAAO,yDAAyD,CAAC;IACrE,CAAC;AACH,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAErE,MAAM,aAAa,GAAG,CAAC,MAAwB,EAAU,EAAE,CACzD,MAAM,CAAC,SAAS;KACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;KACxD,IAAI,CAAC,IAAI,CAAC,CAAC;AAEhB;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,MAAwB,EACxB,WAAmB,EACwB,EAAE,CAC7C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,kBAAkB,CACvC,kCAAkC,WAAW,UAAU,MAAM,CAAC,QAAQ,EAAE,CACzE,CAAC;IACF,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC;QACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7C,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACtE,OAAO,EACL,GAAG,MAAM,CAAC,QAAQ,qDAAqD;YACvE,gBAAgB,WAAW,MAAM;YACjC,2BAA2B,MAAM,CAAC,QAAQ,iBAAiB;YAC3D,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI;YAC5B,SAAS,OAAO,kBAAkB;YAClC,mEAAmE;KACtE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL;;;GAGG;AACH,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;CACzE,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;AAE9E,MAAM,oBAAoB,GAAG,CAC3B,QAA4C,EACnC,EAAE,CACX,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;IAChC,iEAAiE;IACjE,8CAA8C;IAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,IAAI,GAAG,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,CACL,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;QACtB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAC9C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,IAAI,CAC5B,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,IAAU,EAAsB,EAAE;IACzE,MAAM,UAAU,GAAG,IAAI,GAAG,EAA+C,CAAC;IAC1E,MAAM,GAAG,GAAG,CACV,IAAY,EACZ,GAAW,EACX,MAA8B,EACxB,EAAE;QACR,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,SAAS,GACb,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAkC,CAAC;QACxE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpD,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACtC,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC;aAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/D,QAAQ;QACR,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1D,GAAG;YACH,MAAM;SACP,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;AACN,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,mBAAmB,GACvB,CAAC,MAAwB,EAAE,EAAE,CAC7B,CACE,IAAkD,EACJ,EAAE,CAChD,IAAI,CAAC,IAAI,CACP,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE;IACxB,MAAM,OAAO,GACX,GAAG,KAAK,CAAC,OAAO,IAAI;QACpB,2BAA2B,MAAM,CAAC,QAAQ,iBAAiB;QAC3D,aAAa,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC,IAAI,KAAK,aAAa;QACjC,CAAC,CAAC,IAAI,WAAW,CAAC;YACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO;YACP,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACJ,CAAC,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;AACrD,CAAC,CAAC,CACH,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,2BAA2B,CAAC,CACrE,QAAQ,CAAC,EAAE,OAAoC;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CACpC,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,CAC3C,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CACnC,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAC1C,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO;IAC5D,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAClC,iBAAiB,EACjB,GAAG,EAAE,CAAC,oBAAoB,CAC3B,CAAC;IACF,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,OAAO,EACP,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO;QACzB,IAAI,EAAE,EAAE,CAAC;YACP,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO,KAAK,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CACrC,mBAAmB,CAAC,MAAM,CAAC,CAC5B,CAAC;QACJ,CAAC;QACD,iEAAiE;QACjE,gEAAgE;QAChE,+DAA+D;QAC/D,wDAAwD;QACxD,qDAAqD;QACrD,yDAAyD;QACzD,4DAA4D;QAC5D,gEAAgE;QAChE,yCAAyC;QACzC,MAAM,SAAS,GACb,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,SAAS,CAAC;QAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;QACD,gEAAgE;QAChE,6DAA6D;QAC7D,gEAAgE;QAChE,iEAAiE;QACjE,8DAA8D;QAC9D,yDAAyD;QACzD,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CACjE,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,QAAQ,CAAC,EAC9C,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,EAC5C,MAAM,CAAC,cAAc,CAAC,6BAA6B,EAAE,IAAI,CAAC,EAC1D,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC5C,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,CACzC,EACD,MAAM,CAAC,QAAQ,CACb,cAAc,EACd,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAC1D,CACF,CAAC;QACF,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,EACJ,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAClC,CAAC;AACJ,CAAC,CACF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,SAAyE,EACzE,EAAE;IACF,MAAM,UAAU,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC1D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE;YACvB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,iBAAiB,CACtB,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,QAAQ;QACR,SAAS;KACV,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAU,EAAE,EAAE,CAClD,iBAAiB,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC"}

package/lib/Auth/Env.d.ts

@@ -1,9 +1,9 @@
 import * as Effect from "effect/Effect";
-import * as Clank from "../Util/Clank.ts";
+import * as Interaction from "../Interaction.ts";
 import { AuthError } from "./AuthProvider.ts";
-export declare const getEnv: (key: string) => Effect.Effect<string | undefined, never, never>;
+export declare const getEnv: (key: string) => Effect.Effect<string | undefined, AuthError, never>;
 export declare const getEnvRequired: (key: string) => Effect.Effect<string, AuthError, never>;
-export declare const getEnvRedacted: (key: string) => Effect.Effect<import("effect/Redacted").Redacted<string> | undefined, never, never>;
+export declare const getEnvRedacted: (key: string) => Effect.Effect<import("effect/Redacted").Redacted<string> | undefined, AuthError, never>;
 export declare const getEnvRedactedRequired: (key: string) => Effect.Effect<import("effect/Redacted").Redacted<string>, AuthError, never>;
-export declare const retryOnce: <A, R>(self: Effect.Effect<A, Clank.PromptCancelled, R>) => Effect.Effect<A, AuthError, R>;
+export declare const mapPromptCancellation: <A, R>(self: Effect.Effect<A, Interaction.InteractionError, R>) => Effect.Effect<A, AuthError, R>;
 //# sourceMappingURL=Env.d.ts.map

package/lib/Auth/Env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Env.d.ts","sourceRoot":"","sources":["../../src/Auth/Env.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,eAAO,MAAM,MAAM,QAAS,MAAM,oDAC8B,CAAC;AAEjE,eAAO,MAAM,cAAc,QAAS,MAAM,4CAKvC,CAAC;AAEJ,eAAO,MAAM,cAAc,QAAS,MAAM,wFACwB,CAAC;AAEnE,eAAO,MAAM,sBAAsB,QAAS,MAAM,gFAK/C,CAAC;AAEJ,eAAO,MAAM,SAAS,GAAI,CAAC,EAAE,CAAC,QACtB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,mCAU/C,CAAC"}
+{"version":3,"file":"Env.d.ts","sourceRoot":"","sources":["../../src/Auth/Env.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,eAAO,MAAM,MAAM,QAAS,MAAM,wDAU/B,CAAC;AAEJ,eAAO,MAAM,cAAc,QAAS,MAAM,4CAMvC,CAAC;AAEJ,eAAO,MAAM,cAAc,QAAS,MAAM,4FAUvC,CAAC;AAEJ,eAAO,MAAM,sBAAsB,QAAS,MAAM,gFAM/C,CAAC;AAEJ,eAAO,MAAM,qBAAqB,GAAI,CAAC,EAAE,CAAC,QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,gBAAgB,EAAE,CAAC,CAAC,mCAatD,CAAC"}

package/lib/Auth/Env.js

@@ -1,13 +1,22 @@
 import * as Config from "effect/Config";
 import * as Effect from "effect/Effect";
-import * as Clank from "../Util/Clank.js";
+import * as Option from "effect/Option";
+import * as Interaction from "../Interaction.js";
 import { AuthError } from "./AuthProvider.js";
-export const getEnv = (key) => Config.string(key).pipe(Effect.orElseSucceed(() => undefined));
-export const getEnvRequired = (key) => Config.string(key).pipe(Effect.catch(() => Effect.fail(new AuthError({ message: `Missing required env: ${key}` }))));
-export const getEnvRedacted = (key) => Config.redacted(key).pipe(Effect.orElseSucceed(() => undefined));
-export const getEnvRedactedRequired = (key) => Config.redacted(key).pipe(Effect.catch(() => Effect.fail(new AuthError({ message: `Missing required env: ${key}` }))));
-export const retryOnce = (self) => self.pipe(Effect.retry({
-    times: 1,
-    while: (e) => e instanceof Clank.PromptCancelled,
-}), Effect.mapError((e) => new AuthError({ message: "User cancelled prompt", cause: e })));
+export const getEnv = (key) => Config.option(Config.String(key)).pipe(Effect.map(Option.getOrUndefined), Effect.mapError((cause) => new AuthError({
+    message: `Could not read optional env: ${key}`,
+    cause,
+})));
+export const getEnvRequired = (key) => Config.String(key).pipe(Effect.mapError((cause) => new AuthError({ message: `Missing required env: ${key}`, cause })));
+export const getEnvRedacted = (key) => Config.option(Config.Redacted(key)).pipe(Effect.map(Option.getOrUndefined), Effect.mapError((cause) => new AuthError({
+    message: `Could not read optional env: ${key}`,
+    cause,
+})));
+export const getEnvRedactedRequired = (key) => Config.Redacted(key).pipe(Effect.mapError((cause) => new AuthError({ message: `Missing required env: ${key}`, cause })));
+export const mapPromptCancellation = (self) => self.pipe(Effect.mapError((cause) => new AuthError({
+    message: cause._tag === "TerminalCancelled"
+        ? "User cancelled prompt"
+        : cause.message,
+    cause,
+})));
 //# sourceMappingURL=Env.js.map

package/lib/Auth/Env.js.map

@@ -1 +1 @@
-{"version":3,"file":"Env.js","sourceRoot":"","sources":["../../src/Auth/Env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CACpC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAW,EAAE,EAAE,CAC5C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACrB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAChB,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,yBAAyB,GAAG,EAAE,EAAE,CAAC,CAAC,CACxE,CACF,CAAC;AAEJ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAW,EAAE,EAAE,CAC5C,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAW,EAAE,EAAE,CACpD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CACvB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAChB,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,yBAAyB,GAAG,EAAE,EAAE,CAAC,CAAC,CACxE,CACF,CAAC;AAEJ,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,IAAgD,EAChD,EAAE,CACF,IAAI,CAAC,IAAI,CACP,MAAM,CAAC,KAAK,CAAC;IACX,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,eAAe;CACjD,CAAC,EACF,MAAM,CAAC,QAAQ,CACb,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CACrE,CACF,CAAC"}
+{"version":3,"file":"Env.js","sourceRoot":"","sources":["../../src/Auth/Env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CACpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CACpC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,EACjC,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,SAAS,CAAC;IACZ,OAAO,EAAE,gCAAgC,GAAG,EAAE;IAC9C,KAAK;CACN,CAAC,CACL,CACF,CAAC;AAEJ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAW,EAAE,EAAE,CAC5C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACrB,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,yBAAyB,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CACpE,CACF,CAAC;AAEJ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAW,EAAE,EAAE,CAC5C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CACtC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,EACjC,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,SAAS,CAAC;IACZ,OAAO,EAAE,gCAAgC,GAAG,EAAE;IAC9C,KAAK;CACN,CAAC,CACL,CACF,CAAC;AAEJ,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAW,EAAE,EAAE,CACpD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CACvB,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,yBAAyB,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CACpE,CACF,CAAC;AAEJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,IAAuD,EACvD,EAAE,CACF,IAAI,CAAC,IAAI,CACP,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,SAAS,CAAC;IACZ,OAAO,EACL,KAAK,CAAC,IAAI,KAAK,mBAAmB;QAChC,CAAC,CAAC,uBAAuB;QACzB,CAAC,CAAC,KAAK,CAAC,OAAO;IACnB,KAAK;CACN,CAAC,CACL,CACF,CAAC"}

package/lib/Auth/Inspect.d.ts

@@ -0,0 +1,33 @@
+import * as Effect from "effect/Effect";
+import { type AuthError, type ProviderDetailLine } from "./AuthProvider.ts";
+import type { ProviderConfig } from "./Profile.ts";
+/**
+ * What a connected provider looks like right now. Establishing this means
+ * decoding the stored config and asking the provider to describe itself,
+ * either of which can fail — which is the point: a profile listing has to
+ * show a broken connection rather than fail because of one.
+ */
+export interface ProviderConnection {
+    readonly name: string;
+    /** How credentials were supplied (`oauth`, `api-token`, …). */
+    readonly method: string;
+    readonly status: "connected" | "needs-reauth" | "needs-reconfigure" | "invalid" | "unavailable";
+    readonly details: ReadonlyArray<ProviderDetailLine>;
+    /** Present whenever `status` is anything but `connected`. */
+    readonly diagnostic?: {
+        readonly severity: "warning" | "error";
+        readonly code: string;
+        readonly message: string;
+    };
+}
+/**
+ * Resolve one stored provider's live connection status. Never fails: every
+ * way this can go wrong is reported as a `status` + `diagnostic` so a listing
+ * can show the whole profile.
+ */
+export declare const inspectProvider: (profile: string, name: string, config: ProviderConfig, registered: {
+    [providerName: string]: import("./AuthProvider.ts").AuthProvider<{
+        method: string;
+    }, unknown>;
+}, updateConfig?: ((config: ProviderConfig) => Effect.Effect<void, AuthError>) | undefined) => Effect.Effect<ProviderConnection, never, import("../Interaction.ts").Interaction>;
+//# sourceMappingURL=Inspect.d.ts.map

package/lib/Auth/Inspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Inspect.d.ts","sourceRoot":"","sources":["../../src/Auth/Inspect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EACL,KAAK,SAAS,EAGd,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EACX,WAAW,GACX,cAAc,GACd,mBAAmB,GACnB,SAAS,GACT,aAAa,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACpD,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,QAAQ,EAAE,SAAS,GAAG,OAAO,CAAC;QACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAgBD;;;;GAIG;AACH,eAAO,MAAM,eAAe;;;;4BAKF,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,mGAoEzE,CAAC"}