dedalus-cli 0.0.0-stage → 0.8.0

package/dist/cjs/cli/credentials.js

@@ -0,0 +1,630 @@
+"use strict";
+// File generated from our OpenAPI spec by Scalar. See README.md for details.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clearAll = exports.deleteProfile = exports.takeWarnings = exports.warn = exports.refreshProfile = exports.writeProfile = exports.readProfile = exports.storeDescription = exports.profileKey = exports.deleteStore = exports.writeStore = exports.readStore = exports.storePath = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const keychain_1 = require("./keychain");
+const STORE_VERSION = 1;
+const EMPTY_STORE = { version: STORE_VERSION, profiles: {} };
+// A generated CLI can be invoked by two shells at once. The short synchronous critical sections
+// below need a cross-process lock, not an in-memory mutex that only coordinates one invocation.
+const lockPause = new Int32Array(new SharedArrayBuffer(4));
+const STORE_LOCK_STALE_MS = 30_000;
+// Consecutive filesystem errors while taking the lock before the attempt is abandoned. A lost race
+// produces one; a path the filesystem will not answer for produces them without end.
+const STORE_LOCK_MAX_ERRORS = 100;
+/**
+ * The store file path.
+ *
+ * The environment override wins outright so a credential can be pointed at a scratch file (a test
+ * harness, a container with no writable home) without touching the real one.
+ */
+const storePath = (location) => {
+    const override = process.env[location.storeEnv];
+    if (override)
+        return override;
+    return (0, node_path_1.join)(stateDirectory(), location.storeName, 'credentials.json');
+};
+exports.storePath = storePath;
+// Per-user state, not config: the file holds tokens the CLI rewrites on its own (a refreshed access
+// token) rather than settings a user edits, which is exactly what XDG_STATE_HOME is for.
+const stateDirectory = () => {
+    if (process.platform === 'win32')
+        return process.env['APPDATA'] || (0, node_path_1.join)((0, node_os_1.homedir)(), 'AppData', 'Roaming');
+    return process.env['XDG_STATE_HOME'] || (0, node_path_1.join)((0, node_os_1.homedir)(), '.local', 'state');
+};
+/**
+ * Reads the whole store, treating anything unreadable as empty.
+ *
+ * A missing file is the normal first-run case, and a corrupt one must not wedge every command in
+ * the CLI: the worst outcome of ignoring it is one `login` the user has to run again, whereas
+ * throwing would take out commands that were never going to need a stored credential at all.
+ */
+const readStore = (location) => {
+    let text;
+    try {
+        text = (0, node_fs_1.readFileSync)((0, exports.storePath)(location), 'utf8');
+    }
+    catch {
+        return EMPTY_STORE;
+    }
+    try {
+        const parsed = JSON.parse(text);
+        if (!parsed || typeof parsed !== 'object')
+            return EMPTY_STORE;
+        const profiles = parsed.profiles;
+        if (!profiles || typeof profiles !== 'object')
+            return EMPTY_STORE;
+        return { version: STORE_VERSION, profiles: profiles };
+    }
+    catch {
+        return EMPTY_STORE;
+    }
+};
+exports.readStore = readStore;
+/**
+ * Replaces the store file.
+ *
+ * Written to a sibling temp file and renamed so an interrupted write cannot leave a truncated store
+ * behind; the rename carries the temp file's narrow permissions onto the final path.
+ */
+const writeStore = (location, store) => {
+    assertLockHeld(location);
+    const path = (0, exports.storePath)(location);
+    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(path), { recursive: true, mode: 0o700 });
+    // `wx` and a random suffix together, not `writeFileSync` with a mode. That call applies the mode
+    // only when it creates the file and follows a symlink when it does not, so a predictable temp name
+    // — the pid was the only variable — let anyone who could write this directory pre-create the path
+    // and be handed the credentials, or leave it `0644` and read them in the window before a chmod.
+    // Creating it exclusively fails instead, and the descriptor is what is written, so there is no
+    // second lookup of the name between the check and the write.
+    const temp = path + '.' + (0, node_crypto_1.randomBytes)(8).toString('hex') + '.tmp';
+    const descriptor = (0, node_fs_1.openSync)(temp, 'wx', 0o600);
+    try {
+        (0, node_fs_1.writeFileSync)(descriptor, JSON.stringify(store, null, 2) + '\n');
+    }
+    finally {
+        (0, node_fs_1.closeSync)(descriptor);
+    }
+    try {
+        (0, node_fs_1.renameSync)(temp, path);
+    }
+    catch (error) {
+        // The rename is what publishes the store; a temp file left behind after it failed is a copy of
+        // the credentials under a name nothing will ever read again.
+        (0, node_fs_1.rmSync)(temp, { force: true });
+        throw error;
+    }
+};
+exports.writeStore = writeStore;
+/** Deletes the store file entirely. */
+const deleteStore = (location) => {
+    assertLockHeld(location);
+    (0, node_fs_1.rmSync)((0, exports.storePath)(location), { force: true });
+};
+exports.deleteStore = deleteStore;
+/**
+ * Serializes index rewrites across CLI processes.
+ *
+ * Token acquisition happens before the lock. The lock spans the keychain operation and its index
+ * update together, so a concurrent logout cannot clear a newly written secret while it still sees
+ * the old index entry. Long-running keychain helpers renew the lock lease before each command.
+ */
+const withStoreLock = (location, operation) => {
+    const path = (0, exports.storePath)(location);
+    const lockPath = path + '.lock';
+    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(path), { recursive: true, mode: 0o700 });
+    // Written into the lock file and checked back on release. A lock this process was too slow to
+    // renew can be reclaimed as stale by another one, and after that it is no longer this process's
+    // to delete: unlinking it on the way out would drop the new holder's lock and leave two processes
+    // rewriting the store at once, where `writeStore` replaces the file wholesale and one of the two
+    // profiles is simply lost.
+    const token = (0, node_crypto_1.randomBytes)(16).toString('hex');
+    let descriptor;
+    let consecutiveErrors = 0;
+    while (descriptor === undefined) {
+        try {
+            descriptor = (0, node_fs_1.openSync)(lockPath, 'wx', 0o600);
+            try {
+                (0, node_fs_1.writeFileSync)(descriptor, token);
+            }
+            catch (error) {
+                // An unstamped lock is worse than none: this process is about to throw, its release will
+                // never run, and every other CLI would wait out the full stale window on a file nobody
+                // holds. Take it back out first.
+                (0, node_fs_1.closeSync)(descriptor);
+                // And give the handle back, so the loop guard still reads "not acquired". Leaving it set
+                // would let an error the outer catch decided to swallow fall out of the loop and run the
+                // operation with no lock at all, then close this handle a second time on the way out.
+                descriptor = undefined;
+                (0, node_fs_1.rmSync)(lockPath, { force: true });
+                throw error;
+            }
+        }
+        catch (error) {
+            if (!(error && typeof error === 'object' && 'code' in error && error.code === 'EEXIST'))
+                throw error;
+            try {
+                const stale = (0, node_fs_1.statSync)(lockPath);
+                if (Date.now() - stale.mtimeMs > STORE_LOCK_STALE_MS) {
+                    // Moved aside rather than unlinked outright, and only then removed. An unconditional
+                    // `rmSync` deletes whatever is at the path *now*, which after a pause between the stat
+                    // and the call is a fresh lock a waiter has just taken — two processes in the critical
+                    // section. `renameSync` moves one specific directory entry, so re-checking the inode and
+                    // mtime afterwards establishes that what moved is the file that was found stale; anything
+                    // else is put straight back.
+                    const salvage = lockPath + '.' + token;
+                    (0, node_fs_1.renameSync)(lockPath, salvage);
+                    const moved = (0, node_fs_1.statSync)(salvage);
+                    if (moved.ino === stale.ino && moved.mtimeMs === stale.mtimeMs)
+                        (0, node_fs_1.rmSync)(salvage, { force: true });
+                    else
+                        (0, node_fs_1.renameSync)(salvage, lockPath);
+                }
+                consecutiveErrors = 0;
+            }
+            catch {
+                // Either the lock was released or reclaimed between the open and the stat — the benign race,
+                // which the next attempt wins — or the filesystem will not answer for this path at all, which
+                // retrying never fixes. Only a run of them means the second, so only a run gives up.
+                consecutiveErrors += 1;
+                if (consecutiveErrors > STORE_LOCK_MAX_ERRORS) {
+                    throw new Error('Could not take the credential store lock at ' + lockPath + '.');
+                }
+            }
+            // Every path waits, including the two that used to loop straight back to `openSync`. Without
+            // this a lock that cannot be stat'd or unlinked spins open+stat at full tilt with nothing on
+            // screen — usually for a token refresh the user never asked to watch.
+            Atomics.wait(lockPause, 0, 0, 10);
+        }
+    }
+    const previous = heldLock;
+    heldLock = { path: lockPath, token };
+    try {
+        return operation();
+    }
+    finally {
+        heldLock = previous;
+        (0, node_fs_1.closeSync)(descriptor);
+        try {
+            // Only this acquisition's own lock comes off; see `token` above.
+            if ((0, node_fs_1.readFileSync)(lockPath, 'utf8') === token)
+                (0, node_fs_1.rmSync)(lockPath, { force: true });
+        }
+        catch {
+            // Already gone, which is the outcome this wanted anyway.
+        }
+    }
+};
+/** The lock this process currently holds, for {@link assertLockHeld} to check a write against. */
+let heldLock;
+/**
+ * Refuses a store rewrite this process no longer holds the lock for.
+ *
+ * Taking the lock is not the same as still having it. A holder stopped long enough to pass
+ * `STORE_LOCK_STALE_MS` — a suspended laptop, a SIGSTOP, a filesystem that blocked — has its lock
+ * reclaimed and another process completes a whole read-modify-write; if the first then resumes and
+ * writes the snapshot it read beforehand, the second's profile is gone, and under the keychain
+ * backend its index entry was the only record of a live keyring item. `writeStore` replaces the
+ * file wholesale, so there is no merge to save it. Checking the stamp again here is what makes the
+ * window survivable: the late writer fails loudly instead of quietly winning.
+ */
+const assertLockHeld = (location) => {
+    const lock = heldLock;
+    if (!lock || lock.path !== (0, exports.storePath)(location) + '.lock')
+        return;
+    let stamp;
+    try {
+        stamp = (0, node_fs_1.readFileSync)(lock.path, 'utf8');
+    }
+    catch {
+        stamp = '';
+    }
+    if (stamp !== lock.token) {
+        throw new Error('The credential store changed underneath this command. Nothing was written; run it again.');
+    }
+};
+/** Renews a held lock before a keychain helper can spend up to ten seconds waiting for the OS. */
+const refreshStoreLock = (location) => {
+    const now = new Date();
+    try {
+        (0, node_fs_1.utimesSync)((0, exports.storePath)(location) + '.lock', now, now);
+    }
+    catch {
+        // The lock holder may already be unwinding after an interrupted filesystem operation.
+    }
+};
+/**
+ * The key one base URL's credentials are filed under.
+ *
+ * Keying on the URL is what keeps a sandbox token from being sent to production: a request with a
+ * different `--base-url` looks up a different profile and simply finds nothing.
+ */
+const profileKey = (baseUrl) => {
+    const trimmed = baseUrl.replace(/\/+$/u, '');
+    if (!trimmed)
+        return 'default';
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        // Not a URL this can take apart — an unusual `--base-url`, or the `default` case above. Keyed
+        // verbatim, which still files it consistently; it simply gets none of the normalization below.
+        return trimmed;
+    }
+    // Credentials never belong in the key. A `--base-url https://user:pass@host` would otherwise put
+    // them in the keychain account, which the Linux helper passes on its command line for any other
+    // process to read — the one thing this whole module is arranged to prevent.
+    url.username = '';
+    url.password = '';
+    // `URL` lower-cases the host and drops a port that is the scheme's default, so two spellings of
+    // one host cannot end up as two profiles — a `login` under one and a request under the other
+    // would look, to the user, like the sign-in simply had not taken.
+    url.hash = '';
+    url.search = '';
+    return url.toString().replace(/\/+$/u, '');
+};
+exports.profileKey = profileKey;
+/**
+ * Whether this run may use the operating system's store at all.
+ *
+ * Nothing is probed here. Under `auto` the real operation decides: a keychain write that fails
+ * falls back to the file, and a keychain read that finds nothing falls through to it. That is both
+ * cheaper than a probe — which costs three subprocess spawns on every command — and more honest,
+ * since the thing that has to work is the operation itself, not a proxy for it.
+ */
+const mayUseKeychain = (location) => location.backend !== 'file';
+/** Human-readable name for where a credential landed, for `login` and `logout` to print. */
+const storeDescription = (location, backend) => backend === 'keychain'
+    ? 'your ' + osStoreName() + ' (the index of signed-in hosts is at ' + (0, exports.storePath)(location) + ')'
+    : (0, exports.storePath)(location);
+exports.storeDescription = storeDescription;
+const osStoreName = () => {
+    if (process.platform === 'win32')
+        return 'Windows Credential Manager';
+    if (process.platform === 'darwin')
+        return 'macOS Keychain';
+    return 'system keyring';
+};
+/**
+ * One stored profile.
+ *
+ * When the secret is in the OS store the file holds only the *index* — which base URLs are signed
+ * in, and for each one which store has it. That split is what makes `logout --all` possible: a
+ * keychain offers no portable way to list what is in it, so the set of profiles has to be recorded
+ * somewhere, and a list of hostnames is not a secret.
+ *
+ * The index also decides where to look, rather than the OS store being tried first and the file
+ * second. Trying in turn cannot tell an unreachable helper from an empty one, so it would answer
+ * with a file copy while a different, live secret sat in the OS store.
+ */
+const readProfile = (location, key) => readProfileResult(location, key).profile;
+exports.readProfile = readProfile;
+/**
+ * A profile read, and whether the store actually answered.
+ *
+ * `unreadable` says the marker points at the OS store and the helper never answered, so the empty
+ * profile beside it is the absence of an answer rather than the answer "nothing is stored". A read
+ * can treat the two alike — both send the user to `login` — but a write cannot: merging an update
+ * into an empty profile and storing the result replaces whatever was really under that key, so a
+ * keyring that is momentarily unreachable would cost the user every *other* credential filed there.
+ */
+const readProfileResult = (location, key) => {
+    const entry = indexEntry(location, key);
+    if (entry.backend !== 'keychain') {
+        // `keychain` exists to keep secrets out of a file, so one an earlier build left there is not a
+        // credential this may send — an organisation that chose the setting to forbid secrets at rest
+        // would otherwise keep authenticating from exactly the file it banned. It is left where it is
+        // rather than deleted, because a read is not the place to destroy anything; the next `login`
+        // replaces it.
+        return { profile: location.backend === 'keychain' ? {} : entry, unreadable: false };
+    }
+    // Nothing falls through to the file: the index says the secret is not there. A helper that cannot
+    // run reads as "no credential", which sends the user to `login` rather than to a stale one — but
+    // it is reported alongside, so a *write* can refuse rather than overwrite what it could not see.
+    if (!mayUseKeychain(location)) {
+        // The configured backend is the file while the marker still says keychain. Replacing the entry
+        // is the intended migration here, not a loss, so this is not unreadable.
+        return { profile: {}, unreadable: false };
+    }
+    const read = (0, keychain_1.keychainRead)(location.storeName, key);
+    if (read.secret === undefined)
+        return { profile: {}, unreadable: read.unavailable };
+    return { profile: parseSecret(read.secret), unreadable: false };
+};
+/**
+ * A keychain item's JSON, as a profile.
+ *
+ * An item this cannot parse is treated as absent, for the same reason a corrupt file is: one
+ * `login` again beats taking out every command that needed no credential.
+ */
+const parseSecret = (secret) => {
+    try {
+        const parsed = JSON.parse(secret);
+        if (parsed && typeof parsed === 'object')
+            return parsed;
+    }
+    catch {
+        // Absent; see above.
+    }
+    return {};
+};
+/** The file entry for one profile: the credential itself, or the marker saying where it really is. */
+const indexEntry = (location, key) => {
+    const { profiles } = (0, exports.readStore)(location);
+    // Own-property lookup only: a store carrying a key like `constructor` would otherwise resolve to
+    // something off `Object.prototype` that is not a profile at all.
+    if (!Object.prototype.hasOwnProperty.call(profiles, key))
+        return {};
+    const profile = profiles[key];
+    return profile && typeof profile === 'object' ? profile : {};
+};
+/** Merges an update into one stored profile under the transaction lock, reporting where it landed. */
+const writeProfile = (location, key, update) => 
+// The keychain write and the index write are one transaction. Locking only the file rewrite leaves
+// a logout able to clear a newly stored secret while still reading the index entry that predates
+// it, so both go inside the same lock.
+withStoreLock(location, () => writeProfileLocked(location, key, update));
+exports.writeProfile = writeProfile;
+/**
+ * Merges a refreshed token into a profile that is still signed in, and does nothing when it is not.
+ *
+ * The silent refresh runs on the request path of an ordinary command: it reads the profile, spends a
+ * network round trip on the exchange, and only then writes the result back. A `logout` in another
+ * shell fits comfortably inside that window. Writing unconditionally there would file a freshly
+ * issued credential under a host the user has just signed out of — and under the keychain backend
+ * that means planting a new secret in their keyring *after* a sign-out that reported success, with
+ * an index entry to match. The lock serializes the two writes; this is what makes the later one
+ * conditional on what the earlier one left behind.
+ */
+const refreshProfile = (location, key, update) => {
+    withStoreLock(location, () => {
+        if (!Object.prototype.hasOwnProperty.call((0, exports.readStore)(location).profiles, key))
+            return;
+        // A refresh is preparation for a command, not the command, so a store that cannot be read is a
+        // reason to leave the credential where it is rather than to fail what the user asked for. The
+        // write below would refuse anyway; catching it here keeps that refusal off the request path.
+        if (readProfileResult(location, key).unreadable)
+            return;
+        writeProfileLocked(location, key, update);
+    });
+};
+exports.refreshProfile = refreshProfile;
+/** The body of a profile write, for the callers above that have already taken the store lock. */
+const writeProfileLocked = (location, key, update) => {
+    const marker = indexEntry(location, key);
+    // Merging only after acquiring the lock preserves credentials captured by another flow while
+    // this flow was waiting to save its own result.
+    if (marker.backend === 'keychain')
+        refreshStoreLock(location);
+    const existing = readProfileResult(location, key);
+    // Refused rather than merged into nothing. The write below replaces the whole profile, so going
+    // ahead on a read that never answered would file this one credential over however many were
+    // already there — silently, on a keyring hiccup no louder than a daemon restart.
+    if (existing.unreadable) {
+        throw new Error('Could not read the credentials already saved for this host from your ' +
+            osStoreName() +
+            '. Nothing was written. Try again, or run logout for this host first.');
+    }
+    const profile = mergeProfile(existing.profile, update);
+    if (mayUseKeychain(location)) {
+        refreshStoreLock(location);
+        if ((0, keychain_1.keychainStore)(location.storeName, key, JSON.stringify(withoutMarker(profile)))) {
+            try {
+                // The file records only that this base URL is signed in and which store has it — no secret
+                // — so `logout --all` can find it without one ever reaching disk.
+                writeIndex(location, key, { backend: 'keychain' });
+            }
+            catch (error) {
+                // The secret reached the OS store but nothing on disk points at it, and the index is the
+                // only thing `logout --all` can enumerate. Take it back out rather than leaving a
+                // credential in the user's keyring that this CLI can neither find nor remove — but only
+                // when this write is what put it there. `keychainStore` overwrites, so if the store was
+                // already holding this key the item here is the user's working credential, and clearing it
+                // would destroy the very thing the failed sign-in was meant to replace.
+                if (marker.backend !== 'keychain') {
+                    refreshStoreLock(location);
+                    (0, keychain_1.keychainClear)(location.storeName, key);
+                }
+                throw error;
+            }
+            return 'keychain';
+        }
+        if (location.backend === 'keychain') {
+            throw new Error((0, keychain_1.keychainSupported)()
+                ? 'Could not save the credential to your ' + osStoreName() + '.'
+                : 'This system has no credential store ' + location.storeName + ' can use.');
+        }
+    }
+    // Whatever this key already had in the OS store comes out before the file takes over, so the two
+    // cannot disagree. Only the marker decides what a later read uses, so an item left behind can no
+    // longer shadow this one — which is why a helper that will not answer is not worth failing the
+    // sign-in over. It is reported instead: wedging `login` would leave the user no way forward at
+    // all, since `logout` would be refusing for exactly the same reason.
+    if (marker.backend === 'keychain' && removeSecret(location, key) !== 'removed') {
+        (0, exports.warn)('Your ' + osStoreName() + ' may still hold an older credential for this host; remove it there if so.');
+    }
+    writeIndex(location, key, { ...withoutMarker(profile), backend: 'file' });
+    return 'file';
+};
+const warnings = [];
+/**
+ * Notes something the user should know without failing what they asked for.
+ *
+ * Collected rather than printed. The same store code runs under `login` and under the silent token
+ * refresh that precedes an ordinary command, and writing to standard error there would interleave
+ * prose with the JSON document `--format-error json` puts on that same stream. Only `login` and
+ * `logout` drain this, so a warning reaches the one place a user is already reading sentences.
+ */
+const warn = (message) => {
+    if (!warnings.includes(message))
+        warnings.push(message);
+};
+exports.warn = warn;
+/** Takes the warnings collected so far, leaving none behind. */
+const takeWarnings = () => warnings.splice(0, warnings.length);
+exports.takeWarnings = takeWarnings;
+/**
+ * Takes one secret out of the OS store, reporting what could be established.
+ *
+ * `keychainClear` answers `false` both for an item that is not there and for a helper that cannot
+ * run, so its word alone is never enough. A lookup afterwards settles the only question that
+ * matters: `kept` means the secret is still retrievable, and so removing the index entry would be a
+ * lie. Anything else means this CLI can no longer get at it, which is what being signed out is —
+ * `unconfirmed` says so while admitting the store may still hold something, because a helper that
+ * could not run cannot prove otherwise.
+ *
+ * Nothing here throws. Earlier versions failed the command when a clear did not succeed, which
+ * wedged `login` and `logout` together for anyone whose item had simply been removed by hand or
+ * whose helper had gone: both refused, and nothing the CLI offered could ever clear the entry.
+ */
+const removeSecret = (location, key) => {
+    refreshStoreLock(location);
+    if ((0, keychain_1.keychainClear)(location.storeName, key))
+        return 'removed';
+    refreshStoreLock(location);
+    return (0, keychain_1.keychainLookup)(location.storeName, key) === undefined ? 'unconfirmed' : 'kept';
+};
+/** The profile without the index's own bookkeeping, which is not part of the secret. */
+const withoutMarker = (profile) => ({
+    ...(profile.credentials ? { credentials: profile.credentials } : {}),
+    ...(profile.oauth ? { oauth: profile.oauth } : {}),
+});
+/**
+ * Removes one stored profile, reporting what became of it and what it held.
+ *
+ * A secret the OS store will not give up fails the whole removal rather than being written off.
+ * `readProfile` looks the OS store up by key and never through the index, so dropping the index
+ * entry while the secret stays behind would leave a credential that still authenticates every
+ * command — and that `logout --all`, which enumerates the index, could no longer even find.
+ *
+ * `held` is the removed profile's content, read before its secret goes so `logout` can revoke its
+ * tokens afterwards; it is empty when nothing was removed or `readHeld` is false (see
+ * {@link heldProfile}).
+ */
+const deleteProfile = (location, key, readHeld) => withStoreLock(location, () => {
+    const entry = indexEntry(location, key);
+    const held = heldProfile(location, key, readHeld);
+    if (entry.backend === 'keychain') {
+        const outcome = removeSecret(location, key);
+        if (outcome === 'kept') {
+            // The one case worth refusing: the secret answered a lookup after the clear, so it is still
+            // there and still usable. Dropping the entry would report a sign-out over a live credential
+            // and lose the only record of where it is.
+            throw new Error('Could not remove the credential from your ' + osStoreName() + '.');
+        }
+        if (outcome === 'unconfirmed') {
+            (0, exports.warn)('Your ' + osStoreName() + ' may still hold a credential for this host; remove it there if so.');
+        }
+    }
+    const store = (0, exports.readStore)(location);
+    if (!Object.prototype.hasOwnProperty.call(store.profiles, key)) {
+        return { outcome: 'absent', held: { profile: {}, unreadable: false } };
+    }
+    const profiles = { ...store.profiles };
+    delete profiles[key];
+    (0, exports.writeStore)(location, { version: STORE_VERSION, profiles });
+    return { outcome: 'removed', held };
+});
+exports.deleteProfile = deleteProfile;
+/**
+ * What a profile holds, read for `logout` inside the lock that is about to remove it.
+ *
+ * `logout` revokes what it removes, and once the secret is gone there is nothing left to read it
+ * from. Reading under the removal's own lock, rather than before taking it, means a sign-in that
+ * landed in between is the credential revoked — not the one it had already replaced.
+ *
+ * It reads wherever the index says the secret is, whatever the configured backend — unlike
+ * `readProfileResult`, which will not *send* a file-held secret under `keychain` or look in the
+ * OS store under `file`. Revoking is the opposite of using a credential: a token left in the file
+ * by an earlier build is still live at its provider, and this removal is the last chance to end it.
+ *
+ * `readHeld` is false for a CLI with no OAuth sign-in: nothing it stores can be revoked, so it
+ * skips the read, which under the keychain backend is one more helper spawn per profile.
+ */
+const heldProfile = (location, key, readHeld) => {
+    if (!readHeld)
+        return { profile: {}, unreadable: false };
+    const entry = indexEntry(location, key);
+    if (entry.backend !== 'keychain')
+        return { profile: withoutMarker(entry), unreadable: false };
+    refreshStoreLock(location);
+    const read = (0, keychain_1.keychainRead)(location.storeName, key);
+    const profile = read.secret === undefined ? {} : withoutMarker(parseSecret(read.secret));
+    // The index says the OS store holds a secret here, so an empty answer is not "nothing to revoke":
+    // the helper would not answer (a helper that fails looks the same as one with no such item) or
+    // the item went by hand. Either way a token may still be live, and `logout` has to say so.
+    return { profile, unreadable: Object.keys(profile).length === 0 };
+};
+/**
+ * Forgets everything, in both places, returning what was removed so `logout --all` can revoke it.
+ *
+ * The keychain items go one by one, taken from the index, before the index itself does: deleting the
+ * file first would strand the secrets in the OS store with nothing left pointing at them — invisible
+ * to this CLI and never cleaned up.
+ *
+ * A secret the OS store would not give up is reported through `failure` rather than thrown, so the
+ * profiles that *were* removed still reach revocation before the command fails.
+ */
+const clearAll = (location, readHeld) => {
+    const { kept, removed } = withStoreLock(location, () => {
+        // The keychain clears and the index rewrite share one lock with login. It can hold the lock for
+        // several helper calls, but that is preferable to acknowledging a logout that strands a secret.
+        const entries = Object.entries((0, exports.readStore)(location).profiles);
+        const outcomes = entries.map(([key, profile]) => [
+            key,
+            heldProfile(location, key, readHeld),
+            profile?.backend === 'keychain' ? removeSecret(location, key) : 'removed',
+        ]);
+        const kept = outcomes.filter(([, , outcome]) => outcome === 'kept').map(([key]) => key);
+        if (outcomes.some(([, , outcome]) => outcome === 'unconfirmed')) {
+            (0, exports.warn)('Your ' + osStoreName() + ' may still hold credentials this could not remove.');
+        }
+        const remaining = entries.filter(([key]) => kept.includes(key));
+        if (remaining.length === 0)
+            (0, exports.deleteStore)(location);
+        else
+            (0, exports.writeStore)(location, { version: STORE_VERSION, profiles: Object.fromEntries(remaining) });
+        const removed = outcomes
+            .filter(([, , outcome]) => outcome !== 'kept')
+            .map(([key, held]) => ({ key, held }));
+        return { kept, removed };
+    });
+    if (kept.length === 0)
+        return { removed };
+    // The index entry is the only record of which base URLs have a secret in the OS store, so one
+    // still holding a retrievable secret keeps its entry: dropping it would strand the credential
+    // there — still live, and invisible to this CLI for good.
+    return {
+        removed,
+        failure: 'Could not remove every credential from your ' +
+            osStoreName() +
+            '; ' +
+            String(kept.length) +
+            ' still there.',
+    };
+};
+exports.clearAll = clearAll;
+/** Writes one profile into the on-disk store while the caller holds the credential-store lock. */
+const writeIndex = (location, key, profile) => {
+    const store = (0, exports.readStore)(location);
+    (0, exports.writeStore)(location, {
+        version: STORE_VERSION,
+        profiles: { ...store.profiles, [key]: profile },
+    });
+};
+// Empty maps are dropped rather than written as `{}`: a store a user opens should show what is
+// actually saved, and a token-only sign-in has no OAuth metadata to speak of.
+const mergeProfile = (existing, update) => {
+    const credentials = { ...(existing.credentials ?? {}), ...(update.credentials ?? {}) };
+    const oauth = { ...(existing.oauth ?? {}), ...(update.oauth ?? {}) };
+    return {
+        ...(Object.keys(credentials).length > 0 ? { credentials } : {}),
+        ...(Object.keys(oauth).length > 0 ? { oauth } : {}),
+    };
+};
+//# sourceMappingURL=credentials.js.map

package/dist/cjs/cli/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/cli/credentials.ts"],"names":[],"mappings":";AAAA,6EAA6E;;;AAE7E,6CAA0C;AAC1C,qCAUiB;AACjB,qCAAkC;AAClC,yCAA0C;AAE1C,yCAA2G;AAyD3G,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB,MAAM,WAAW,GAAwB,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAElF,gGAAgG;AAChG,gGAAgG;AAChG,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3D,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,mGAAmG;AACnG,qFAAqF;AACrF,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC;;;;;GAKG;AACI,MAAM,SAAS,GAAG,CAAC,QAAiC,EAAU,EAAE;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,IAAA,gBAAI,EAAC,cAAc,EAAE,EAAE,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;AACxE,CAAC,CAAC;AAJW,QAAA,SAAS,aAIpB;AAEF,oGAAoG;AACpG,yFAAyF;AACzF,MAAM,cAAc,GAAG,GAAW,EAAE;IAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACzG,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC7E,CAAC,CAAC;AAEF;;;;;;GAMG;AACI,MAAM,SAAS,GAAG,CAAC,QAAiC,EAAuB,EAAE;IAClF,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,sBAAY,EAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,WAAW,CAAC;QAC9D,MAAM,QAAQ,GAAI,MAAiC,CAAC,QAAQ,CAAC;QAC7D,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,WAAW,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAyC,EAAE,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC,CAAC;AAhBW,QAAA,SAAS,aAgBpB;AAEF;;;;;GAKG;AACI,MAAM,UAAU,GAAG,CAAC,QAAiC,EAAE,KAA0B,EAAQ,EAAE;IAChG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC;IACjC,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,iGAAiG;IACjG,mGAAmG;IACnG,kGAAkG;IAClG,gGAAgG;IAChG,+FAA+F;IAC/F,6DAA6D;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,IAAA,yBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;IAClE,MAAM,UAAU,GAAG,IAAA,kBAAQ,EAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,IAAA,uBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACnE,CAAC;YAAS,CAAC;QACT,IAAA,mBAAS,EAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC;QACH,IAAA,oBAAU,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+FAA+F;QAC/F,6DAA6D;QAC7D,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAzBW,QAAA,UAAU,cAyBrB;AAEF,uCAAuC;AAChC,MAAM,WAAW,GAAG,CAAC,QAAiC,EAAQ,EAAE;IACrE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAA,gBAAM,EAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/C,CAAC,CAAC;AAHW,QAAA,WAAW,eAGtB;AAEF;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,CAAI,QAAiC,EAAE,SAAkB,EAAK,EAAE;IACpF,MAAM,IAAI,GAAG,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC;IAChC,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,8FAA8F;IAC9F,gGAAgG;IAChG,kGAAkG;IAClG,iGAAiG;IACjG,2BAA2B;IAC3B,MAAM,KAAK,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,UAA8B,CAAC;IACnC,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,OAAO,UAAU,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,UAAU,GAAG,IAAA,kBAAQ,EAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC;gBACH,IAAA,uBAAa,EAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,yFAAyF;gBACzF,uFAAuF;gBACvF,iCAAiC;gBACjC,IAAA,mBAAS,EAAC,UAAU,CAAC,CAAC;gBACtB,yFAAyF;gBACzF,yFAAyF;gBACzF,sFAAsF;gBACtF,UAAU,GAAG,SAAS,CAAC;gBACvB,IAAA,gBAAM,EAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClC,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;gBAAE,MAAM,KAAK,CAAC;YACrG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAA,kBAAQ,EAAC,QAAQ,CAAC,CAAC;gBACjC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,GAAG,mBAAmB,EAAE,CAAC;oBACrD,qFAAqF;oBACrF,uFAAuF;oBACvF,uFAAuF;oBACvF,yFAAyF;oBACzF,0FAA0F;oBAC1F,6BAA6B;oBAC7B,MAAM,OAAO,GAAG,QAAQ,GAAG,GAAG,GAAG,KAAK,CAAC;oBACvC,IAAA,oBAAU,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;oBAC9B,MAAM,KAAK,GAAG,IAAA,kBAAQ,EAAC,OAAO,CAAC,CAAC;oBAChC,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;wBAAE,IAAA,gBAAM,EAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;;wBAC5F,IAAA,oBAAU,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACrC,CAAC;gBACD,iBAAiB,GAAG,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,6FAA6F;gBAC7F,8FAA8F;gBAC9F,qFAAqF;gBACrF,iBAAiB,IAAI,CAAC,CAAC;gBACvB,IAAI,iBAAiB,GAAG,qBAAqB,EAAE,CAAC;oBAC9C,MAAM,IAAI,KAAK,CAAC,8CAA8C,GAAG,QAAQ,GAAG,GAAG,CAAC,CAAC;gBACnF,CAAC;YACH,CAAC;YACD,6FAA6F;YAC7F,6FAA6F;YAC7F,sEAAsE;YACtE,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC;IAC1B,QAAQ,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,QAAQ,GAAG,QAAQ,CAAC;QACpB,IAAA,mBAAS,EAAC,UAAU,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,iEAAiE;YACjE,IAAI,IAAA,sBAAY,EAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,KAAK;gBAAE,IAAA,gBAAM,EAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF,kGAAkG;AAClG,IAAI,QAAuE,CAAC;AAE5E;;;;;;;;;;GAUG;AACH,MAAM,cAAc,GAAG,CAAC,QAAiC,EAAQ,EAAE;IACjE,MAAM,IAAI,GAAG,QAAQ,CAAC;IACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAA,iBAAS,EAAC,QAAQ,CAAC,GAAG,OAAO;QAAE,OAAO;IACjE,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,sBAAY,EAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,EAAE,CAAC;IACb,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,kGAAkG;AAClG,MAAM,gBAAgB,GAAG,CAAC,QAAiC,EAAQ,EAAE;IACnE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,IAAA,oBAAU,EAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,sFAAsF;IACxF,CAAC;AACH,CAAC,CAAC;AAEF;;;;;GAKG;AACI,MAAM,UAAU,GAAG,CAAC,OAAe,EAAU,EAAE;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,8FAA8F;QAC9F,+FAA+F;QAC/F,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,iGAAiG;IACjG,gGAAgG;IAChG,4EAA4E;IAC5E,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,gGAAgG;IAChG,6FAA6F;IAC7F,kEAAkE;IAClE,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC,CAAC;AAtBW,QAAA,UAAU,cAsBrB;AAKF;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,CAAC,QAAiC,EAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC;AAEnG,4FAA4F;AACrF,MAAM,gBAAgB,GAAG,CAAC,QAAiC,EAAE,OAAqB,EAAU,EAAE,CACnG,OAAO,KAAK,UAAU;IACpB,CAAC,CAAC,OAAO,GAAG,WAAW,EAAE,GAAG,uCAAuC,GAAG,IAAA,iBAAS,EAAC,QAAQ,CAAC,GAAG,GAAG;IAC/F,CAAC,CAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC;AAHb,QAAA,gBAAgB,oBAGH;AAE1B,MAAM,WAAW,GAAG,GAAW,EAAE;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,4BAA4B,CAAC;IACtE,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC;IAC3D,OAAO,gBAAgB,CAAC;AAC1B,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACI,MAAM,WAAW,GAAG,CAAC,QAAiC,EAAE,GAAW,EAAiB,EAAE,CAC3F,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;AAD9B,QAAA,WAAW,eACmB;AAE3C;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,CACxB,QAAiC,EACjC,GAAW,EACwD,EAAE;IACrE,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACjC,+FAA+F;QAC/F,8FAA8F;QAC9F,8FAA8F;QAC9F,6FAA6F;QAC7F,eAAe;QACf,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACtF,CAAC;IACD,kGAAkG;IAClG,iGAAiG;IACjG,iGAAiG;IACjG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,+FAA+F;QAC/F,yEAAyE;QACzE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,uBAAY,EAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;IACpF,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAClE,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,GAAG,CAAC,MAAc,EAAiB,EAAE;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,MAAuB,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,sGAAsG;AACtG,MAAM,UAAU,GAAG,CAAC,QAAiC,EAAE,GAAW,EAAiB,EAAE;IACnF,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC;IACzC,iGAAiG;IACjG,iEAAiE;IACjE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC,CAAC;AAEF,sGAAsG;AAC/F,MAAM,YAAY,GAAG,CAC1B,QAAiC,EACjC,GAAW,EACX,MAAqB,EACP,EAAE;AAChB,mGAAmG;AACnG,iGAAiG;AACjG,uCAAuC;AACvC,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;AAR9D,QAAA,YAAY,gBAQkD;AAE3E;;;;;;;;;;GAUG;AACI,MAAM,cAAc,GAAG,CAC5B,QAAiC,EACjC,GAAW,EACX,MAAqB,EACf,EAAE;IACR,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE;QAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC;YAAE,OAAO;QACrF,+FAA+F;QAC/F,8FAA8F;QAC9F,6FAA6F;QAC7F,IAAI,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,UAAU;YAAE,OAAO;QACxD,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAbW,QAAA,cAAc,kBAazB;AAEF,iGAAiG;AACjG,MAAM,kBAAkB,GAAG,CACzB,QAAiC,EACjC,GAAW,EACX,MAAqB,EACP,EAAE;IAChB,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACzC,6FAA6F;IAC7F,gDAAgD;IAChD,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU;QAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAClD,gGAAgG;IAChG,4FAA4F;IAC5F,iFAAiF;IACjF,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,WAAW,EAAE;YACb,sEAAsE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,IAAA,wBAAa,EAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,IAAI,CAAC;gBACH,2FAA2F;gBAC3F,kEAAkE;gBAClE,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,yFAAyF;gBACzF,kFAAkF;gBAClF,wFAAwF;gBACxF,wFAAwF;gBACxF,2FAA2F;gBAC3F,wEAAwE;gBACxE,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;oBAClC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;oBAC3B,IAAA,wBAAa,EAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBACzC,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,IAAA,4BAAiB,GAAE;gBACjB,CAAC,CAAC,wCAAwC,GAAG,WAAW,EAAE,GAAG,GAAG;gBAChE,CAAC,CAAC,sCAAsC,GAAG,QAAQ,CAAC,SAAS,GAAG,WAAW,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,iGAAiG;IACjG,iGAAiG;IACjG,+FAA+F;IAC/F,+FAA+F;IAC/F,qEAAqE;IACrE,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU,IAAI,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;QAC/E,IAAA,YAAI,EACF,OAAO,GAAG,WAAW,EAAE,GAAG,2EAA2E,CACtG,CAAC;IACJ,CAAC;IACD,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAa,EAAE,CAAC;AAE9B;;;;;;;GAOG;AACI,MAAM,IAAI,GAAG,CAAC,OAAe,EAAQ,EAAE;IAC5C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC1D,CAAC,CAAC;AAFW,QAAA,IAAI,QAEf;AAEF,gEAAgE;AACzD,MAAM,YAAY,GAAG,GAAsB,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;AAA5E,QAAA,YAAY,gBAAgE;AAEzF;;;;;;;;;;;;;GAaG;AACH,MAAM,YAAY,GAAG,CAAC,QAAiC,EAAE,GAAW,EAAsC,EAAE;IAC1G,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,IAAI,IAAA,wBAAa,EAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7D,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,OAAO,IAAA,yBAAc,EAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC;AACxF,CAAC,CAAC;AAEF,wFAAwF;AACxF,MAAM,aAAa,GAAG,CAAC,OAAsB,EAAiB,EAAE,CAAC,CAAC;IAChE,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACnD,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACI,MAAM,aAAa,GAAG,CAC3B,QAAiC,EACjC,GAAW,EACX,QAAiB,EACuD,EAAE,CAC1E,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE;IAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,4FAA4F;YAC5F,4FAA4F;YAC5F,2CAA2C;YAC3C,MAAM,IAAI,KAAK,CAAC,4CAA4C,GAAG,WAAW,EAAE,GAAG,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;YAC9B,IAAA,YAAI,EAAC,OAAO,GAAG,WAAW,EAAE,GAAG,oEAAoE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IACvC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrB,IAAA,kBAAU,EAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3D,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC,CAAC,CAAC;AA5BQ,QAAA,aAAa,iBA4BrB;AAeL;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,GAAG,CAAC,QAAiC,EAAE,GAAW,EAAE,QAAiB,EAAe,EAAE;IACrG,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9F,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAA,uBAAY,EAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACzF,kGAAkG;IAClG,+FAA+F;IAC/F,2FAA2F;IAC3F,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;AACpE,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACI,MAAM,QAAQ,GAAG,CACtB,QAAiC,EACjC,QAAiB,EAC2D,EAAE;IAC9E,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE;QACrD,gGAAgG;QAChG,gGAAgG;QAChG,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAC1B,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CACjB;YACE,GAAG;YACH,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC;YACpC,OAAO,EAAE,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;SACjE,CACb,CAAC;QACF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,AAAD,EAAG,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACxF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,AAAD,EAAG,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,aAAa,CAAC,EAAE,CAAC;YAChE,IAAA,YAAI,EAAC,OAAO,GAAG,WAAW,EAAE,GAAG,oDAAoD,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,IAAA,mBAAW,EAAC,QAAQ,CAAC,CAAC;;YAC7C,IAAA,kBAAU,EAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC/F,MAAM,OAAO,GAAG,QAAQ;aACrB,MAAM,CAAC,CAAC,CAAC,EAAE,AAAD,EAAG,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,MAAM,CAAC;aAC7C,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAkB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC1C,8FAA8F;IAC9F,8FAA8F;IAC9F,0DAA0D;IAC1D,OAAO;QACL,OAAO;QACP,OAAO,EACL,8CAA8C;YAC9C,WAAW,EAAE;YACb,IAAI;YACJ,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YACnB,eAAe;KAClB,CAAC;AACJ,CAAC,CAAC;AAzCW,QAAA,QAAQ,YAyCnB;AAEF,kGAAkG;AAClG,MAAM,UAAU,GAAG,CAAC,QAAiC,EAAE,GAAW,EAAE,OAAsB,EAAQ,EAAE;IAClG,MAAM,KAAK,GAAG,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC;IAClC,IAAA,kBAAU,EAAC,QAAQ,EAAE;QACnB,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE;KAChD,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,+FAA+F;AAC/F,8EAA8E;AAC9E,MAAM,YAAY,GAAG,CAAC,QAAuB,EAAE,MAAqB,EAAiB,EAAE;IACrF,MAAM,WAAW,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;IACvF,MAAM,KAAK,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;IACrE,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC,CAAC"}