dedalus-cli 0.0.0-stage → 0.7.0

package/dist/cjs/cli/keychain.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Absolute path to Windows PowerShell.
+ *
+ * Never the bare name: on Windows a command name with no separator is resolved against the *current
+ * working directory* before `PATH`, so `spawn('powershell', ...)` inside a checked-out repository
+ * that happens to contain `powershell.exe` would run that instead — and hand it the secret.
+ */
+export declare const windowsPowerShell: () => string;
+/** Whether this platform has a credential helper the CLI can drive at all. */
+export declare const keychainSupported: () => boolean;
+/**
+ * Reads one secret back, saying which kind of nothing it got when there is no secret.
+ *
+ * `unavailable` is the distinction a plain lookup cannot make: the helper never ran (missing,
+ * timed out, no session bus over ssh) rather than ran and reported no such item. A caller about to
+ * *replace* a profile needs it, because merging into the empty result of a failed read and writing
+ * that back is how the other credentials under the same key get dropped.
+ */
+export declare const keychainRead: (service: string, account: string) => {
+    readonly secret?: string;
+    readonly unavailable: boolean;
+};
+/** Reads one secret back, or `undefined` when the helper has no such item (or cannot run). */
+export declare const keychainLookup: (service: string, account: string) => string | undefined;
+/** Writes one secret, reporting whether the helper accepted it. */
+export declare const keychainStore: (service: string, account: string, secret: string) => boolean;
+/**
+ * Removes one secret, reporting whether the helper accepted the removal.
+ *
+ * A helper asked for an item it does not have reports failure, so callers establish that the item
+ * exists first and read this as "the secret is gone" only when it is `true`.
+ */
+export declare const keychainClear: (service: string, account: string) => boolean;
+//# sourceMappingURL=keychain.d.ts.map

package/dist/cjs/cli/keychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../../../src/cli/keychain.ts"],"names":[],"mappings":"AAmDA;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAAO,MACiE,CAAC;AAiEvG,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,QAAO,OAAkD,CAAC;AAmGxF;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GACvB,SAAS,MAAM,EACf,SAAS,MAAM,KACd;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAQ3D,CAAC;AAEF,8FAA8F;AAC9F,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,EAAE,SAAS,MAAM,KAAG,MAAM,GAAG,SACpC,CAAC;AAExC,mEAAmE;AACnE,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,EAAE,SAAS,MAAM,EAAE,QAAQ,MAAM,KAAG,OACtC,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,EAAE,SAAS,MAAM,KAAG,OAA4C,CAAC"}

package/dist/cjs/cli/keychain.js

@@ -0,0 +1,246 @@
+"use strict";
+// File generated from our OpenAPI spec by Scalar. See README.md for details.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keychainClear = exports.keychainStore = exports.keychainLookup = exports.keychainRead = exports.keychainSupported = exports.windowsPowerShell = void 0;
+const node_child_process_1 = require("node:child_process");
+/**
+ * Absolute path to Windows PowerShell.
+ *
+ * Never the bare name: on Windows a command name with no separator is resolved against the *current
+ * working directory* before `PATH`, so `spawn('powershell', ...)` inside a checked-out repository
+ * that happens to contain `powershell.exe` would run that instead — and hand it the secret.
+ */
+const windowsPowerShell = () => (process.env['SystemRoot'] ?? 'C:\\Windows') + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
+exports.windowsPowerShell = windowsPowerShell;
+/**
+ * The secret NEVER travels in argv.
+ *
+ * A process's command line is readable by other processes — `ps`, `/proc/<pid>/cmdline` — so a
+ * credential passed as an argument is exposed to every other program running as that user, and on
+ * many systems to other users too.
+ *
+ * That rule is what decides which platforms are here. `secret-tool store` reads the secret from
+ * standard input by design. The Windows helper cannot — `powershell -Command -` reads *all* of
+ * standard input as the script to run, leaving nothing for the script itself to read — so its secret
+ * goes through the environment instead, which on Windows one process cannot read from another
+ * without debug privileges, unlike a command line.
+ *
+ * macOS's `security add-generic-password` takes the password only as the argument to `-w`, so it is
+ * never run with one. `security -i` reads whole commands from standard input instead, and the store
+ * goes through that: the secret sits on a line of stdin rather than in any process's argv. See
+ * {@link securityStoreCommand} for what that line has to survive.
+ */
+const HELPERS = {
+    // Linux: the freedesktop Secret Service, which GNOME Keyring and KWallet both implement.
+    // Spawned by bare name only because Linux has no fixed place for it, so whatever comes first on
+    // `PATH` answers; Windows and macOS, which do have one, use an absolute path.
+    linux: {
+        file: 'secret-tool',
+        lookup: (service, account) => ['lookup', 'service', service, 'account', account],
+        store: (service, account) => ['store', '--label=' + service, 'service', service, 'account', account],
+        clear: (service, account) => ['clear', 'service', service, 'account', account],
+    },
+    // Windows Credential Manager, through the PasswordVault WinRT API that Windows PowerShell exposes.
+    // The script arrives on standard input (`-Command -`) so neither it nor the secret reaches argv.
+    win32: {
+        file: (0, exports.windowsPowerShell)(),
+        lookup: () => ['-NoProfile', '-NonInteractive', '-Command', '-'],
+        store: () => ['-NoProfile', '-NonInteractive', '-Command', '-'],
+        clear: () => ['-NoProfile', '-NonInteractive', '-Command', '-'],
+        script: (mode) => windowsScript(mode),
+    },
+    // macOS: the user's default keychain, through the `security` tool every Mac ships. Spawned by
+    // absolute path, unlike `secret-tool`: a Mac always has it at `/usr/bin/security`, where SIP keeps
+    // it Apple's, while a bare name resolves through `PATH` — and Homebrew's user-writable
+    // `/opt/homebrew/bin` or a project's `node_modules/.bin` usually sits ahead of `/usr/bin`, so a
+    // stray `security` there would be handed the whole profile. It is also the binary the items it
+    // writes trust, which is what lets every install read them without a prompt. Only the store runs
+    // interactively; a lookup and a clear carry nothing but the service and account, which are no more
+    // secret here than on Linux.
+    darwin: {
+        file: '/usr/bin/security',
+        lookup: (service, account) => ['find-generic-password', '-s', service, '-a', account, '-w'],
+        store: () => ['-i'],
+        clear: (service, account) => ['delete-generic-password', '-s', service, '-a', account],
+        input: (mode, service, account, secret) => mode === 'store' && secret !== undefined ? securityStoreCommand(service, account, secret) : '',
+        decode: (stored) => stored.startsWith(SECURITY_SECRET_PREFIX)
+            ? Buffer.from(stored.slice(SECURITY_SECRET_PREFIX.length), 'base64').toString('utf8')
+            : stored,
+        // `security` exits with the low byte of the OSStatus it hit, and errSecItemNotFound (-25300)
+        // comes out as 44. Anything else — a locked keychain over ssh is errSecInteractionNotAllowed,
+        // 36 — means the keychain could not be asked, not that it has nothing under this key.
+        notFound: (status) => status === 44,
+    },
+};
+/** Whether this platform has a credential helper the CLI can drive at all. */
+const keychainSupported = () => HELPERS[process.platform] !== undefined;
+exports.keychainSupported = keychainSupported;
+/**
+ * Marks a secret stored base64-encoded, so a lookup knows to decode it.
+ *
+ * `security find-generic-password -w` prints a password containing any byte that is not printable
+ * ASCII as hex instead, with nothing to say it did. A profile with one non-ASCII character in it
+ * would then come back as a hex string — not JSON, so the stored credential would be unreadable.
+ * Base64 is printable throughout, so it always comes back exactly as written.
+ */
+const SECURITY_SECRET_PREFIX = 'base64:';
+/**
+ * The longest command line `security -i` reads whole, newline included.
+ *
+ * It reads each line into a 4096-byte buffer, and a line that does not fit is not rejected: the
+ * rest is read as the *next* command. Staying well inside the buffer is the only safe answer, and a
+ * profile that cannot fit fails the store, which `auto` turns into the file.
+ */
+const SECURITY_LINE_LIMIT = 4000;
+/**
+ * Quotes one argument for `security -i`.
+ *
+ * Its line parser is not a shell. Inside double quotes a backslash escapes the next character and
+ * the closing quote ends the argument, and nothing else is special — no variables, no globbing, and
+ * no joining of adjacent quoted pieces, so the shell trick of `'...'"'"'...'` would split one
+ * argument into three. Escaping every backslash and double quote is therefore complete.
+ */
+const securityQuote = (value) => '"' + value.replace(/[\\"]/gu, '\\$&') + '"';
+/**
+ * The single `add-generic-password` line that stores one secret through `security -i`.
+ *
+ * `-U` updates an existing item in place, so signing in again replaces the credential rather than
+ * failing on a duplicate. The service and account are quoted rather than encoded, so the item reads
+ * the same in Keychain Access as the lookup and clear that address it in argv. A control character
+ * in either is refused: a newline would end the command early and start another, and a NUL ends the
+ * argument where C reads it. The base URL key never carries one in practice; refusing it keeps a
+ * hostile `--base-url` from writing a second command.
+ */
+const securityStoreCommand = (service, account, secret) => {
+    if (/[\u0000-\u001f\u007f]/u.test(service + account))
+        return undefined;
+    const encoded = SECURITY_SECRET_PREFIX + Buffer.from(secret, 'utf8').toString('base64');
+    const line = [
+        'add-generic-password',
+        '-U',
+        '-s',
+        securityQuote(service),
+        '-a',
+        securityQuote(account),
+        '-w',
+        securityQuote(encoded),
+    ].join(' ') + '\n';
+    return Buffer.byteLength(line, 'utf8') <= SECURITY_LINE_LIMIT ? line : undefined;
+};
+/**
+ * PowerShell for one Credential Manager operation.
+ *
+ * The service, the account and — for a store — the secret are all read from environment variables
+ * rather than pasted into the script, so a base URL can never close a quote and become PowerShell.
+ * Standard input is not available for any of them: the shell has already taken it for this script.
+ */
+const windowsScript = (mode) => {
+    const prelude = [
+        '$ErrorActionPreference = "Stop"',
+        // Windows PowerShell encodes `[Console]::Out` with the console output code page (an OEM page
+        // such as CP850) when stdout is a pipe, while `spawnSync` here decodes it as UTF-8. Without
+        // this, a stored credential carrying any non-ASCII character comes back mangled — and a
+        // credential that is wrong but still parses is worse than one that fails to, because every
+        // command then authenticates with it, and `login` appears to fix it while storing a correct
+        // value that is read back wrong again.
+        '[Console]::OutputEncoding = [System.Text.Encoding]::UTF8',
+        '[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]',
+        '$vault = New-Object Windows.Security.Credentials.PasswordVault',
+        '$svc = $env:SCALAR_KEYCHAIN_SERVICE',
+        '$acct = $env:SCALAR_KEYCHAIN_ACCOUNT',
+    ];
+    if (mode === 'lookup') {
+        return [
+            ...prelude,
+            '$item = $vault.Retrieve($svc, $acct)',
+            '$item.RetrievePassword()',
+            '[Console]::Out.Write($item.Password)',
+        ].join('\n');
+    }
+    if (mode === 'clear') {
+        return [...prelude, '$item = $vault.Retrieve($svc, $acct)', '$vault.Remove($item)'].join('\n');
+    }
+    return [
+        ...prelude,
+        '$secret = $env:SCALAR_KEYCHAIN_SECRET',
+        'try { $vault.Remove($vault.Retrieve($svc, $acct)) } catch { }',
+        '$vault.Add((New-Object Windows.Security.Credentials.PasswordCredential($svc, $acct, $secret)))',
+    ].join('\n');
+};
+/**
+ * Reads one secret back, saying which kind of nothing it got when there is no secret.
+ *
+ * `unavailable` is the distinction a plain lookup cannot make: the helper never ran (missing,
+ * timed out, no session bus over ssh) rather than ran and reported no such item. A caller about to
+ * *replace* a profile needs it, because merging into the empty result of a failed read and writing
+ * that back is how the other credentials under the same key get dropped.
+ */
+const keychainRead = (service, account) => {
+    const result = run('lookup', service, account);
+    // `secret-tool` terminates its output with a newline the stored value never had; `security`
+    // does the same. Nothing this stores is meant to end in one, so a single trailing newline comes off.
+    if (!result.ok)
+        return { unavailable: result.unavailable };
+    const stored = result.stdout.replace(/\n$/u, '');
+    const decode = HELPERS[process.platform]?.decode;
+    return { secret: decode ? decode(stored) : stored, unavailable: false };
+};
+exports.keychainRead = keychainRead;
+/** Reads one secret back, or `undefined` when the helper has no such item (or cannot run). */
+const keychainLookup = (service, account) => (0, exports.keychainRead)(service, account).secret;
+exports.keychainLookup = keychainLookup;
+/** Writes one secret, reporting whether the helper accepted it. */
+const keychainStore = (service, account, secret) => run('store', service, account, secret).ok;
+exports.keychainStore = keychainStore;
+/**
+ * Removes one secret, reporting whether the helper accepted the removal.
+ *
+ * A helper asked for an item it does not have reports failure, so callers establish that the item
+ * exists first and read this as "the secret is gone" only when it is `true`.
+ */
+const keychainClear = (service, account) => run('clear', service, account).ok;
+exports.keychainClear = keychainClear;
+const run = (mode, service, account, secret) => {
+    const helper = HELPERS[process.platform];
+    if (!helper)
+        return { ok: false, stdout: '', unavailable: true };
+    const script = helper.script?.(mode);
+    // A scripted helper consumes the whole of standard input as its script, so its secret travels in
+    // the environment beside the service and account; a direct helper takes the secret on stdin, and
+    // an interactive one takes it inside the command it reads there.
+    const input = helper.input ? helper.input(mode, service, account, secret) : (script ?? secret ?? '');
+    if (input === undefined)
+        return { ok: false, stdout: '', unavailable: false };
+    try {
+        const result = (0, node_child_process_1.spawnSync)(helper.file, [...helper[mode](service, account)], {
+            input,
+            encoding: 'utf8',
+            // A helper that blocks — a locked keychain putting up a dialog, a Secret Service with no
+            // daemon answering — must not hang every command. The timeout turns that into a fallback.
+            timeout: 10000,
+            env: {
+                ...process.env,
+                SCALAR_KEYCHAIN_SERVICE: service,
+                SCALAR_KEYCHAIN_ACCOUNT: account,
+                ...(script !== undefined && secret !== undefined ? { SCALAR_KEYCHAIN_SECRET: secret } : {}),
+            },
+        });
+        // A spawn that reports an `error` never delivered the question — the helper is missing, or the
+        // timeout above fired. A non-zero status is the helper answering, which for a lookup or a clear
+        // is how every implementation spells "no such item" — and, for a helper that also has a status
+        // for "could not open the store", only that one status means it.
+        if (result.error)
+            return { ok: false, stdout: '', unavailable: true };
+        if (result.status !== 0) {
+            const unavailable = helper.notFound !== undefined && !helper.notFound(result.status ?? -1);
+            return { ok: false, stdout: '', unavailable };
+        }
+        return { ok: true, stdout: result.stdout ?? '', unavailable: false };
+    }
+    catch {
+        // ENOENT for a helper this machine does not have is the common case, and it is not an error:
+        // it is the signal to fall back.
+        return { ok: false, stdout: '', unavailable: true };
+    }
+};
+//# sourceMappingURL=keychain.js.map

package/dist/cjs/cli/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../../src/cli/keychain.ts"],"names":[],"mappings":";AAAA,6EAA6E;;;AAE7E,2DAA+C;AAiD/C;;;;;;GAMG;AACI,MAAM,iBAAiB,GAAG,GAAW,EAAE,CAC5C,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,aAAa,CAAC,GAAG,qDAAqD,CAAC;AAD1F,QAAA,iBAAiB,qBACyE;AAEvG;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,GAA6C;IACxD,yFAAyF;IACzF,gGAAgG;IAChG,8EAA8E;IAC9E,KAAK,EAAE;QACL,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;QAChF,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;QACpG,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;KAC/E;IACD,mGAAmG;IACnG,iGAAiG;IACjG,KAAK,EAAE;QACL,IAAI,EAAE,IAAA,yBAAiB,GAAE;QACzB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,CAAC;QAChE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,CAAC;QAC/D,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,CAAC;QAC/D,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC;KACtC;IACD,8FAA8F;IAC9F,mGAAmG;IACnG,uFAAuF;IACvF,gGAAgG;IAChG,+FAA+F;IAC/F,iGAAiG;IACjG,mGAAmG;IACnG,6BAA6B;IAC7B,MAAM,EAAE;QACN,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;QAC3F,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC;QACnB,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC;QACtF,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CACxC,IAAI,KAAK,OAAO,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;QAChG,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CACjB,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC;YACvC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACrF,CAAC,CAAC,MAAM;QACZ,6FAA6F;QAC7F,8FAA8F;QAC9F,sFAAsF;QACtF,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,EAAE;KACpC;CACF,CAAC;AAEF,8EAA8E;AACvE,MAAM,iBAAiB,GAAG,GAAY,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;AAA3E,QAAA,iBAAiB,qBAA0D;AAExF;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC;AAE9F;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GAAG,CAAC,OAAe,EAAE,OAAe,EAAE,MAAc,EAAsB,EAAE;IACpG,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACvE,MAAM,OAAO,GAAG,sBAAsB,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxF,MAAM,IAAI,GACR;QACE,sBAAsB;QACtB,IAAI;QACJ,IAAI;QACJ,aAAa,CAAC,OAAO,CAAC;QACtB,IAAI;QACJ,aAAa,CAAC,OAAO,CAAC;QACtB,IAAI;QACJ,aAAa,CAAC,OAAO,CAAC;KACvB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IACrB,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACnF,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,CAAC,IAAkC,EAAU,EAAE;IACnE,MAAM,OAAO,GAAG;QACd,iCAAiC;QACjC,6FAA6F;QAC7F,4FAA4F;QAC5F,wFAAwF;QACxF,2FAA2F;QAC3F,4FAA4F;QAC5F,uCAAuC;QACvC,0DAA0D;QAC1D,4GAA4G;QAC5G,gEAAgE;QAChE,qCAAqC;QACrC,sCAAsC;KACvC,CAAC;IACF,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,GAAG,OAAO;YACV,sCAAsC;YACtC,0BAA0B;YAC1B,sCAAsC;SACvC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,OAAO,EAAE,sCAAsC,EAAE,sBAAsB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjG,CAAC;IACD,OAAO;QACL,GAAG,OAAO;QACV,uCAAuC;QACvC,+DAA+D;QAC/D,gGAAgG;KACjG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;GAOG;AACI,MAAM,YAAY,GAAG,CAC1B,OAAe,EACf,OAAe,EAC8C,EAAE;IAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,4FAA4F;IAC5F,qGAAqG;IACrG,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IACjD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC1E,CAAC,CAAC;AAXW,QAAA,YAAY,gBAWvB;AAEF,8FAA8F;AACvF,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,OAAe,EAAsB,EAAE,CACrF,IAAA,oBAAY,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC;AAD3B,QAAA,cAAc,kBACa;AAExC,mEAAmE;AAC5D,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,OAAe,EAAE,MAAc,EAAW,EAAE,CACzF,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;AAD/B,QAAA,aAAa,iBACkB;AAE5C;;;;;GAKG;AACI,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,OAAe,EAAW,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;AAAjG,QAAA,aAAa,iBAAoF;AAE9G,MAAM,GAAG,GAAG,CACV,IAAkC,EAClC,OAAe,EACf,OAAe,EACf,MAAe,EACmE,EAAE;IACpF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IACrC,iGAAiG;IACjG,iGAAiG;IACjG,iEAAiE;IACjE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,MAAM,IAAI,EAAE,CAAC,CAAC;IACrG,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,8BAAS,EAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE;YACzE,KAAK;YACL,QAAQ,EAAE,MAAM;YAChB,yFAAyF;YACzF,0FAA0F;YAC1F,OAAO,EAAE,KAAK;YACd,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,uBAAuB,EAAE,OAAO;gBAChC,uBAAuB,EAAE,OAAO;gBAChC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5F;SACF,CAAC,CAAC;QACH,+FAA+F;QAC/F,gGAAgG;QAChG,+FAA+F;QAC/F,iEAAiE;QACjE,IAAI,MAAM,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACtE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,6FAA6F;QAC7F,iCAAiC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACtD,CAAC;AACH,CAAC,CAAC"}

package/dist/cjs/cli/list.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Cuts a line to the terminal's width.
+ *
+ * A row that wrapped would occupy two of them, and the picker's redraw counts rows rather than
+ * measuring them, so one wrapped label would put every following frame a line out of place.
+ */
+export declare const clip: (text: string, width: number) => string;
+export type ListRowOptions = {
+    readonly columns: number;
+    readonly selected?: boolean;
+    readonly color?: boolean;
+};
+/**
+ * Renders one row: a two-column marker, the label, then the detail dimmed behind it.
+ *
+ * The detail carries what tells otherwise-identical labels apart — a flow name for the picker, a
+ * base URL for the environments list — so it is on every row rather than only the marked one, and
+ * dimmed so the labels still read as the list. A row too narrow to hold it is emitted as plain
+ * clipped text instead: the dimming would otherwise wrap a fragment whose closing bracket the clip
+ * has already removed.
+ */
+export declare const listRow: (label: string, detail: string, options: ListRowOptions) => string;
+//# sourceMappingURL=list.d.ts.map

package/dist/cjs/cli/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../src/cli/list.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,eAAO,MAAM,IAAI,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,KAAG,MAC0B,CAAC;AAE9E,MAAM,MAAM,cAAc,GAAG;IAE3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAGzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAG5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,OAAO,MAAM,EAAE,QAAQ,MAAM,EAAE,SAAS,cAAc,KAAG,MAOhF,CAAC"}

package/dist/cjs/cli/list.js

@@ -0,0 +1,32 @@
+"use strict";
+// File generated from our OpenAPI spec by Scalar. See README.md for details.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listRow = exports.clip = void 0;
+/**
+ * Cuts a line to the terminal's width.
+ *
+ * A row that wrapped would occupy two of them, and the picker's redraw counts rows rather than
+ * measuring them, so one wrapped label would put every following frame a line out of place.
+ */
+const clip = (text, width) => text.length <= width ? text : text.slice(0, Math.max(0, width - 3)) + '...';
+exports.clip = clip;
+/**
+ * Renders one row: a two-column marker, the label, then the detail dimmed behind it.
+ *
+ * The detail carries what tells otherwise-identical labels apart — a flow name for the picker, a
+ * base URL for the environments list — so it is on every row rather than only the marked one, and
+ * dimmed so the labels still read as the list. A row too narrow to hold it is emitted as plain
+ * clipped text instead: the dimming would otherwise wrap a fragment whose closing bracket the clip
+ * has already removed.
+ */
+const listRow = (label, detail, options) => {
+    const head = (options.selected ? '> ' : '  ') + label;
+    const tail = detail ? '  ' + detail : '';
+    const plain = (0, exports.clip)(head + tail, options.columns);
+    if (!options.color)
+        return plain;
+    const row = plain === head + tail ? head + '\u001b[2m' + tail + '\u001b[22m' : plain;
+    return options.selected ? '\u001b[36m' + row + '\u001b[39m' : row;
+};
+exports.listRow = listRow;
+//# sourceMappingURL=list.js.map

package/dist/cjs/cli/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../../src/cli/list.ts"],"names":[],"mappings":";AAAA,6EAA6E;;;AAE7E;;;;;GAKG;AACI,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAC1D,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AADjE,QAAA,IAAI,QAC6D;AAa9E;;;;;;;;GAQG;AACI,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,OAAuB,EAAU,EAAE;IACxF,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,IAAA,YAAI,EAAC,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,GAAG,GAAG,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,WAAW,GAAG,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;IACrF,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,GAAG,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC;AACpE,CAAC,CAAC;AAPW,QAAA,OAAO,WAOlB"}

package/dist/cjs/cli/login.d.ts

@@ -0,0 +1,137 @@
+/** Which API an OAuth token is for. Mirrors the emitter's `CliOauthTargetDefinition`. */
+export type CliOauthTargetDefinition = {
+    readonly resource?: readonly string[];
+    readonly audience?: string;
+};
+/** One way `login` can obtain a credential. Mirrors the emitter's `CliAuthMethodDefinition`. */
+export type CliAuthMethodDefinition = {
+    readonly name: string;
+    readonly label: string;
+} & ({
+    readonly kind: 'token';
+    readonly clientKey: string;
+    readonly prompt: string;
+} | {
+    readonly kind: 'basic';
+    readonly usernameKey: string;
+    readonly passwordKey: string;
+} | (CliOauthTargetDefinition & {
+    readonly kind: 'oauth';
+    readonly grant: 'authorizationCode';
+    readonly clientKey: string;
+    readonly tokenUrl: string;
+    readonly refreshUrl: string;
+    readonly authorizationUrl: string;
+    readonly scopes: readonly string[];
+    readonly clientId: string;
+    readonly redirectPort: number;
+    readonly revocationUrl?: string;
+    /** RFC 8414 metadata read after sign-in for its `revocation_endpoint`; see {@link metadataRevocation}. */
+    readonly revocationMetadataUrl?: string;
+    /** Issuer the redirect's `iss` must name (RFC 9207); absent means an `iss` is not checked. */
+    readonly issuer?: string;
+}) | (CliOauthTargetDefinition & {
+    readonly kind: 'oauth';
+    readonly grant: 'clientCredentials' | 'password';
+    readonly clientKey: string;
+    readonly tokenUrl: string;
+    readonly refreshUrl: string;
+    readonly scopes: readonly string[];
+    readonly clientId?: string;
+    readonly revocationUrl?: string;
+    readonly revocationMetadataUrl?: string;
+    /** Configured issuer the revocation metadata's `issuer` must match. */
+    readonly issuer?: string;
+}) | (CliOauthTargetDefinition & {
+    readonly kind: 'oauth';
+    readonly grant: 'deviceAuthorization';
+    readonly clientKey: string;
+    readonly scopes: readonly string[];
+    readonly clientId?: string;
+    readonly revocationUrl?: string;
+} & ({
+    readonly deviceAuthorizationUrl: string;
+    readonly tokenUrl: string;
+    readonly refreshUrl: string;
+    readonly revocationMetadataUrl?: string;
+    readonly issuer?: string;
+} | {
+    /** RFC 8414 metadata the endpoints are read from at sign-in, for a flow that names none. */
+    readonly metadataUrl: string;
+    /** Configured issuer the metadata's `issuer` must match; absent trusts the one its URL names. */
+    readonly issuer?: string;
+})) | (CliOauthTargetDefinition & {
+    readonly kind: 'oauth';
+    readonly grant: 'openIdConnect';
+    readonly clientKey: string;
+    readonly discoveryUrl: string;
+    readonly scopes: readonly string[];
+    readonly clientId: string;
+    readonly redirectPort: number;
+    readonly revocationUrl?: string;
+    /** Configured issuer the discovered one must match; absent trusts the one discovery verifies. */
+    readonly issuer?: string;
+}));
+/** Everything `login` and `logout` need. Mirrors the emitter's `CliAuthDefinition`. */
+export type CliAuthDefinition = {
+    readonly loginPath: readonly string[];
+    readonly logoutPath: readonly string[];
+    readonly loginCommand: string;
+    readonly storeName: string;
+    readonly storeEnv: string;
+    readonly baseUrlEnv: string;
+    readonly backend: 'auto' | 'keychain' | 'file';
+    readonly defaultBaseUrl: string;
+    /** Named environments and the URL each sends requests to; absent when there is no `--environment`. */
+    readonly environments?: readonly {
+        readonly name: string;
+        readonly url: string;
+    }[];
+    readonly requirements: readonly (readonly string[])[];
+    readonly envByKey: Readonly<Record<string, string>>;
+    readonly methods: readonly CliAuthMethodDefinition[];
+    /** Publisher logo for the browser sign-in page; absent means the page shows none. */
+    readonly logo?: string;
+};
+/**
+ * Runs an interactive sign-in and saves the result, returning the line to print.
+ *
+ * Every prompt is written to standard error, so the confirmation this returns is the only thing on
+ * standard output and `login` stays usable in a pipeline.
+ *
+ * `loginCommand` is the sign-in command for the environment this one selected (the bare command
+ * when none was); it names the next step when the API needs a further credential.
+ */
+export declare const runLogin: (auth: CliAuthDefinition, baseUrl: string, flow: string | undefined, loginCommand: string) => Promise<string>;
+/**
+ * Forgets stored credentials and revokes their OAuth tokens, returning the line to print.
+ *
+ * The local copy goes first, under the store lock, and only then is the provider asked to revoke.
+ * That order is what makes an interrupted or offline `logout` safe: whatever happens on the
+ * network, nothing is left on disk, and the refresh path's conditional write will not bring a
+ * deleted profile back. Revocation is best effort — a failure is a warning, never a failed logout,
+ * because the user asked to be signed out here and that part has already succeeded.
+ */
+export declare const runLogout: (auth: CliAuthDefinition, baseUrl: string, all: boolean) => Promise<string>;
+/**
+ * Stored credentials for one base URL, keyed by client-option name.
+ *
+ * An OAuth access token at or near its expiry is refreshed in place first, so a CLI left alone
+ * overnight keeps working without a second `login`. A refresh that fails is swallowed: the stale
+ * token still goes out, and the 401 that follows carries the runtime's own sign-in hint, which
+ * says more than a refresh error would.
+ *
+ * Refresh exchanges may overlap, but their results merge into the current profile under the same
+ * lock as interactive sign-in. A server that rotates refresh tokens can still reject one of two
+ * simultaneous exchanges; that is recoverable with one `login` and never loses another flow's key.
+ */
+export declare const storedCredentials: (auth: CliAuthDefinition, baseUrl: string) => Promise<Readonly<Record<string, string>>>;
+/**
+ * A failure the user can fix by invoking the command differently, reported as a usage error.
+ *
+ * Distinguished from an authentication failure so a script can tell "you typed the wrong flow name"
+ * (retrying will not help) from "the credential was rejected" (a fresh sign-in might).
+ */
+export declare class UsageError extends Error {
+}
+//# sourceMappingURL=login.d.ts.map

package/dist/cjs/cli/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/cli/login.ts"],"names":[],"mappings":"AAyBA,yFAAyF;AACzF,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,gGAAgG;AAChG,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GAAG,CACA;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACtF,CAAC,wBAAwB,GAAG;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,0GAA0G;IAC1G,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC,GACF,CAAC,wBAAwB,GAAG;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,GAAG,UAAU,CAAC;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC,GACF,CAAC,wBAAwB,GAAG;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,GAAG,CACE;IACE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,GACD;IACE,4FAA4F;IAC5F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iGAAiG;IACjG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CACJ,CAAC,GACJ,CAAC,wBAAwB,GAAG;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,iGAAiG;IACjG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC,CACL,CAAC;AAEF,uFAAuF;AACvF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IAC/C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,sGAAsG;IACtG,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACnF,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC;IACtD,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,OAAO,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACrD,qFAAqF;IACrF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAgKF;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,GACnB,MAAM,iBAAiB,EACvB,SAAS,MAAM,EACf,MAAM,MAAM,GAAG,SAAS,EACxB,cAAc,MAAM,KACnB,OAAO,CAAC,MAAM,CAmBhB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,GAAU,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,KAAG,OAAO,CAAC,MAAM,CA4BtG,CAAC;AAqPF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC5B,MAAM,iBAAiB,EACvB,SAAS,MAAM,KACd,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiD1C,CAAC;AAmlDF;;;;;GAKG;AACH,qBAAa,UAAW,SAAQ,KAAK;CAAG"}