tapimo 0.15.1 → 0.18.0

package/dist/cli/Cli.js

@@ -1,19 +1,68 @@
-import { Cli as incur_Cli, Fetch } from 'incur';
-import * as Admin from './commands/admin.js';
-/** Tool patterns hidden from MCP clients: super admin, partner-shaped gecko mirrors, browser session flows. */
-const excludedTools = ['admin_*', 'gecko_*', 'v1_auth_*'];
+import * as path from 'node:path';
+import { Cli as incur_Cli, Openapi } from 'incur';
+import * as Client from '../Client.js';
+import * as ApiKeys from './ApiKeys.js';
+import * as Auth from './commands/auth.js';
+import * as Keys from './commands/keys.js';
+import * as Credentials from './Credentials.js';
+import * as Spec from './Spec.js';
+/** Tool patterns hidden from MCP clients: super admin, partner-shaped gecko mirrors, browser and interactive session flows. */
+const excludedTools = ['admin_*', 'gecko_*', 'login', 'logout', 'v1_auth_*'];
+// Commands cover the versioned API; partner mirrors, `/rpc`, and `/mcp` stay reachable through the raw gateway.
+const openapiConfig = {
+    groups: { v1: 'Call any Tempo API endpoint.' },
+    include: ({ path }) => path.startsWith('/v1/'),
+    mode: 'namespace',
+};
 /** Usage guidance surfaced to MCP clients on initialize (`<cli> --mcp`). */
-const instructions = 'Tempo MCP provides access to the hosted Tempo API and documentation. Authenticated tools accept an `authorization` input (`Bearer <api key>`). List endpoints paginate via `cursor`/`nextCursor`. `docs_*` tools search the Tempo documentation.';
+const instructions = 'Tempo MCP provides access to the hosted Tempo API and documentation. Authenticated tools accept an `authorization` input (`Bearer <api key>`); after `login`, management tools use the stored CLI session and protected API tools infer scoped project credentials. List endpoints paginate via `cursor`/`nextCursor`. `docs_*` tools search the Tempo documentation.';
+// Explicit credentials always win over stored ones.
+const credentialHeaders = ['authorization', 'cookie', 'tempo-api-key', 'x-api-key'];
+const credentialQuery = 'key';
 /**
- * Creates an incur CLI backed by a hosted Tempo API, plus the super admin
- * commands (`<cli> admin …`) and the remote Tempo docs tools (`<cli> docs …`).
+ * Creates an incur CLI backed by a hosted Tempo API: generated API commands,
+ * session commands (`login`, `logout`, `whoami`), `keys create`, and the remote
+ * Tempo docs tools (`<cli> docs …`).
  */
 export function from(url, options = {}) {
-    const { description = 'Tempo API CLI', docs = 'https://mcp.tempo.xyz/mcp', name = 'tapimo', openapi = 'openapi.json', request, version = '0.0.0', } = options;
+    const { apiKey, credentials = Credentials.store(), description = 'Tempo API CLI', docs = 'https://mcp.tempo.xyz/mcp', environment, fetch = (request) => globalThis.fetch(request), name = 'tapimo', openapi = 'openapi.json', orgId, projectId, request, sourceKeyId, update, version = '0.0.0', } = options;
+    const apiUrl = new URL(url);
+    const send = (incoming) => {
+        const { headers: configuredHeaders, ...options } = request ?? {};
+        const headers = new Headers(configuredHeaders);
+        // Gateway headers accompany prerequisite requests, but credentials belong to each operation.
+        for (const name of credentialHeaders)
+            headers.delete(name);
+        incoming.headers.forEach((value, key) => headers.set(key, value));
+        return fetch(new Request(incoming, { ...options, headers }));
+    };
+    const context = {
+        api: Client.create({
+            fetch: (input, init) => send(new Request(input, init)),
+            url: apiUrl.href.replace(/\/$/, ''),
+        }),
+        apiUrl,
+        credentials,
+        fetch: send,
+        name: `${name} ${version}`,
+    };
     const cli = incur_Cli
         .create(name, {
         description,
-        fetch: Fetch.fromRequest(url, request),
+        fetch: source({
+            apiKey,
+            apiUrl,
+            context,
+            credentials,
+            environment,
+            fetch,
+            name,
+            openapi,
+            orgId,
+            projectId,
+            request,
+            sourceKeyId,
+        }),
         mcp: {
             instructions,
             name: 'tempo',
@@ -21,12 +70,140 @@ export function from(url, options = {}) {
             tools: { exclude: excludedTools },
         },
         openapi,
-        openapiConfig: options.openapiConfig ?? { mode: 'namespace' },
+        openapiConfig: options.openapiConfig ?? openapiConfig,
+        ...(update === undefined ? {} : { update }),
         version,
     })
-        .command(Admin.admin);
+        .command(Auth.login(context))
+        .command(Auth.logout(context))
+        .command(Auth.whoami(context))
+        .command(Keys.keys(context));
     if (docs !== false)
         cli.command('docs', { description: 'Search the Tempo documentation.', mcp: docs });
     return cli;
 }
+/**
+ * Creates the CLI for the API at `TEMPO_API_URL` (default: hosted), sending
+ * `TEMPO_API_KEY` where sessions do not apply and storing sessions under `TEMPO_HOME`.
+ */
+export async function fromEnv(env, options = {}) {
+    if (env.TEMPO_API_ENV && env.TEMPO_API_ENV !== 'production' && env.TEMPO_API_ENV !== 'sandbox')
+        throw new Error('TEMPO_API_ENV must be production or sandbox.');
+    const url = env.TEMPO_API_URL || Client.defaultUrl;
+    const credentialsFile = Credentials.defaultFile({ home: env.TEMPO_HOME });
+    // Loaded once, from a revalidated disk cache, so generated commands and session
+    // attachment share it and unchanged documents cost a 304. A supplied document skips it.
+    const openapi = options.openapi ??
+        (await (async () => {
+            const spec = await Spec.load({
+                ...(options.fetch ? { fetch: options.fetch } : {}),
+                file: Spec.cacheFile({ directory: path.join(path.dirname(credentialsFile), 'cache'), url }),
+                url,
+            });
+            if (spec.status !== 'current') {
+                const reason = spec.error instanceof Error ? spec.error.message : String(spec.error);
+                // Unreachable: help, version, and session commands still work, plus cached API commands.
+                process.stderr.write(spec.status === 'cached'
+                    ? `Could not reach ${url} (${reason}); using cached API commands.\n`
+                    : `Could not load API commands from ${url}: ${reason}\n`);
+            }
+            return spec.document;
+        })());
+    return from(url, {
+        ...(env.TEMPO_API_KEY ? { apiKey: env.TEMPO_API_KEY } : {}),
+        environment: env.TEMPO_API_ENV,
+        orgId: env.TEMPO_API_ORG,
+        projectId: env.TEMPO_API_PROJECT,
+        sourceKeyId: env.TEMPO_API_SOURCE_KEY,
+        credentials: Credentials.store({ file: credentialsFile }),
+        ...options,
+        openapi,
+    });
+}
+/**
+ * Hosted request source for generated commands. Operations whose OpenAPI
+ * security accepts a session get the stored CLI session, and those accepting
+ * API keys get the configured key or scoped credentials inferred from login.
+ * Sign-in-only operations fail locally when signed out.
+ */
+function source(parameters) {
+    const { apiKey, apiUrl, context, credentials, environment, fetch, name, openapi, orgId, projectId, request = {}, sourceKeyId, } = parameters;
+    const { headers: defaultHeaders, ...init } = request;
+    // Resolved once; a document that fails to load leaves every operation unknown.
+    const lanesFor = (async () => operationLanes(await Openapi.resolve(openapi, { baseUrl: apiUrl })))().catch(() => () => undefined);
+    return {
+        url: apiUrl,
+        async fetch(incoming) {
+            const { pathname, search } = new URL(incoming.url);
+            const target = new URL(apiUrl);
+            target.pathname = `${apiUrl.pathname.replace(/\/$/, '')}${pathname}`;
+            target.search = search;
+            const headers = new Headers(defaultHeaders);
+            incoming.headers.forEach((value, key) => headers.set(key, value));
+            const explicit = credentialHeaders.some((name) => headers.has(name)) ||
+                target.searchParams.has(credentialQuery);
+            if (!explicit) {
+                const lanes = (await lanesFor)(incoming.method, pathname);
+                const session = lanes?.session ? await credentials.get(apiUrl) : undefined;
+                if (session)
+                    headers.set('authorization', `Bearer ${session.token}`);
+                // Unknown operations still get the key and let the API decide.
+                else if (apiKey && (lanes?.apiKey ?? true))
+                    headers.set('tempo-api-key', apiKey);
+                else if (lanes?.apiKey && !lanes.public) {
+                    const inferred = await ApiKeys.resolve(context, {
+                        environment,
+                        orgId,
+                        projectId,
+                        scopes: lanes.scopes,
+                        sourceKeyId,
+                    });
+                    if (inferred && typeof inferred !== 'string')
+                        return inferred;
+                    if (inferred)
+                        headers.set('tempo-api-key', inferred);
+                }
+                // Sending nothing (or an API key) would earn an unhelpful 401 or 403.
+                else if (lanes?.session && !lanes.apiKey && !lanes.public) {
+                    const message = `Not signed in, or the session expired. Run \`${name} login\`.`;
+                    return Response.json({ error: { code: 'not_signed_in', message } }, { status: 401 });
+                }
+            }
+            return fetch(new Request(new Request(target, incoming), { ...init, headers }));
+        },
+    };
+}
+/** Builds a lookup of the credentials each operation accepts, from its OpenAPI security requirements. */
+function operationLanes(spec) {
+    const paths = (spec.paths ?? {});
+    const operations = Object.entries(paths).flatMap(([path, item]) => Object.entries(item).map(([method, operation]) => {
+        const requirements = operation.security ?? spec.security ?? [];
+        const has = (scheme) => requirements.some((requirement) => scheme in requirement);
+        return {
+            lanes: {
+                apiKey: has('apiKey') || has('queryApiKey'),
+                // An empty requirement (or none at all) admits anonymous callers.
+                public: requirements.length === 0 ||
+                    requirements.some((requirement) => Object.keys(requirement).length === 0),
+                session: has('session'),
+                scopes: operation['x-required-scopes'] ?? ['*'],
+            },
+            method: method.toUpperCase(),
+            pattern: pathPattern(path),
+            templated: path.split('{').length - 1,
+        };
+    }));
+    // Literal paths win over templated ones (`/v1/webhooks/event-types` over `/v1/webhooks/{id}`).
+    operations.sort((a, b) => a.templated - b.templated);
+    return (method, pathname) => operations.find((operation) => operation.method === method && operation.pattern.test(pathname))
+        ?.lanes;
+}
+// `/v1/orgs/{orgId}` matches `/v1/orgs/org_123`.
+function pathPattern(path) {
+    const source = path
+        .split(/(\{[^}]+\})/)
+        .map((part) => (part.startsWith('{') ? '[^/]+' : part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')))
+        .join('');
+    return new RegExp(`^${source}$`);
+}
 //# sourceMappingURL=Cli.js.map

package/dist/cli/Cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"Cli.js","sourceRoot":"","sources":["../../src/cli/Cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,IAAI,SAAS,EAAE,KAAK,EAAgB,MAAM,OAAO,CAAA;AAG7D,OAAO,KAAK,KAAK,MAAM,qBAAqB,CAAA;AAE5C,+GAA+G;AAC/G,MAAM,aAAa,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;AAEzD,4EAA4E;AAC5E,MAAM,YAAY,GAChB,kPAAkP,CAAA;AAEpP;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,GAAiB,EAAE,OAAO,GAAiB,EAAE;IAChE,MAAM,EACJ,WAAW,GAAG,eAAe,EAC7B,IAAI,GAAG,2BAA2B,EAClC,IAAI,GAAG,QAAQ,EACf,OAAO,GAAG,cAAc,EACxB,OAAO,EACP,OAAO,GAAG,OAAO,GAClB,GAAG,OAAO,CAAA;IAEX,MAAM,GAAG,GAAG,SAAS;SAClB,MAAM,CAAC,IAAI,EAAE;QACZ,WAAW;QACX,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC;QACtC,GAAG,EAAE;YACH,YAAY;YACZ,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE;SAClC;QACD,OAAO;QACP,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE;QAC7D,OAAO;KACR,CAAC;SACD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACvB,IAAI,IAAI,KAAK,KAAK;QAChB,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;IACpF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"Cli.js","sourceRoot":"","sources":["../../src/cli/Cli.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,GAAG,IAAI,SAAS,EAAc,OAAO,EAAE,MAAM,OAAO,CAAA;AAG7D,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,IAAI,MAAM,oBAAoB,CAAA;AAC1C,OAAO,KAAK,IAAI,MAAM,oBAAoB,CAAA;AAC1C,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAA;AAC/C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAEjC,+HAA+H;AAC/H,MAAM,aAAa,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;AAE5E,gHAAgH;AAChH,MAAM,aAAa,GAAmB;IACpC,MAAM,EAAE,EAAE,EAAE,EAAE,8BAA8B,EAAE;IAC9C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,WAAW;CAClB,CAAA;AAED,4EAA4E;AAC5E,MAAM,YAAY,GAChB,uWAAuW,CAAA;AAEzW,oDAAoD;AACpD,MAAM,iBAAiB,GAAG,CAAC,eAAe,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,CAAC,CAAA;AACnF,MAAM,eAAe,GAAG,KAAK,CAAA;AAE7B;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAAC,GAAiB,EAAE,OAAO,GAAiB,EAAE;IAChE,MAAM,EACJ,MAAM,EACN,WAAW,GAAG,WAAW,CAAC,KAAK,EAAE,EACjC,WAAW,GAAG,eAAe,EAC7B,IAAI,GAAG,2BAA2B,EAClC,WAAW,EACX,KAAK,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,EAC9C,IAAI,GAAG,QAAQ,EACf,OAAO,GAAG,cAAc,EACxB,KAAK,EACL,SAAS,EACT,OAAO,EACP,WAAW,EACX,MAAM,EACN,OAAO,GAAG,OAAO,GAClB,GAAG,OAAO,CAAA;IACX,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IAC3B,MAAM,IAAI,GAAG,CAAC,QAAiB,EAAE,EAAE;QACjC,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;QAChE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAA;QAC9C,6FAA6F;QAC7F,KAAK,MAAM,IAAI,IAAI,iBAAiB;YAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC1D,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;QACjE,OAAO,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;IAC9D,CAAC,CAAA;IACD,MAAM,OAAO,GAAiB;QAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;YACjB,KAAK,EAAE,CAAC,KAA6B,EAAE,IAAkB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC5F,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SACpC,CAAC;QACF,MAAM;QACN,WAAW;QACX,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE;KAC3B,CAAA;IAED,MAAM,GAAG,GAAG,SAAS;SAClB,MAAM,CAAC,IAAI,EAAE;QACZ,WAAW;QACX,KAAK,EAAE,MAAM,CAAC;YACZ,MAAM;YACN,MAAM;YACN,OAAO;YACP,WAAW;YACX,WAAW;YACX,KAAK;YACL,IAAI;YACJ,OAAO;YACP,KAAK;YACL,SAAS;YACT,OAAO;YACP,WAAW;SACZ,CAAC;QACF,GAAG,EAAE;YACH,YAAY;YACZ,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE;SAClC;QACD,OAAO;QACP,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,aAAa;QACrD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,OAAO;KACR,CAAC;SACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;SAC5B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;SAC7B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;SAC7B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9B,IAAI,IAAI,KAAK,KAAK;QAChB,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;IACpF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAgB,EAAE,OAAO,GAAiB,EAAE;IACxE,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,KAAK,YAAY,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS;QAC5F,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,MAAM,GAAG,GAAG,GAAG,CAAC,aAAa,IAAI,MAAM,CAAC,UAAU,CAAA;IAClD,MAAM,eAAe,GAAG,WAAW,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;IACzE,gFAAgF;IAChF,wFAAwF;IACxF,MAAM,OAAO,GACX,OAAO,CAAC,OAAO;QACf,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YACjB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC;gBAC3B,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;gBAC3F,GAAG;aACJ,CAAC,CAAA;YACF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACpF,yFAAyF;gBACzF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,MAAM,KAAK,QAAQ;oBACtB,CAAC,CAAC,mBAAmB,GAAG,KAAK,MAAM,iCAAiC;oBACpE,CAAC,CAAC,oCAAoC,GAAG,KAAK,MAAM,IAAI,CAC3D,CAAA;YACH,CAAC;YACD,OAAO,IAAI,CAAC,QAAQ,CAAA;QACtB,CAAC,CAAC,EAAE,CAAC,CAAA;IACP,OAAO,IAAI,CAAC,GAAG,EAAE;QACf,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,GAAG,CAAC,aAAqD;QACtE,KAAK,EAAE,GAAG,CAAC,aAAa;QACxB,SAAS,EAAE,GAAG,CAAC,iBAAiB;QAChC,WAAW,EAAE,GAAG,CAAC,oBAAoB;QACrC,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QACzD,GAAG,OAAO;QACV,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AA0DD;;;;;GAKG;AACH,SAAS,MAAM,CAAC,UAA6B;IAC3C,MAAM,EACJ,MAAM,EACN,MAAM,EACN,OAAO,EACP,WAAW,EACX,WAAW,EACX,KAAK,EACL,IAAI,EACJ,OAAO,EACP,KAAK,EACL,SAAS,EACT,OAAO,GAAG,EAAE,EACZ,WAAW,GACZ,GAAG,UAAU,CAAA;IACd,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IACpD,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE,CAC3B,cAAc,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAC5E,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CACtB,CAAA;IAED,OAAO;QACL,GAAG,EAAE,MAAM;QACX,KAAK,CAAC,KAAK,CAAC,QAAQ;YAClB,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;YAClD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;YAC9B,MAAM,CAAC,QAAQ,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAA;YACpE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAA;YACtB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,cAAc,CAAC,CAAA;YAC3C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;YACjE,MAAM,QAAQ,GACZ,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;YAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;gBACzD,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBAC1E,IAAI,OAAO;oBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;gBACpE,+DAA+D;qBAC1D,IAAI,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;qBAC3E,IAAI,KAAK,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;oBACxC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE;wBAC9C,WAAW;wBACX,KAAK;wBACL,SAAS;wBACT,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,WAAW;qBACZ,CAAC,CAAA;oBACF,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;wBAAE,OAAO,QAAoB,CAAA;oBACzE,IAAI,QAAQ;wBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAA;gBACtD,CAAC;gBACD,sEAAsE;qBACjE,IAAI,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC1D,MAAM,OAAO,GAAG,gDAAgD,IAAI,WAAW,CAAA;oBAC/E,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBACtF,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;QAChF,CAAC;KACF,CAAA;AACH,CAAC;AAmBD,yGAAyG;AACzG,SAAS,cAAc,CAAC,IAAyB;IAK/C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAA8C,CAAA;IAC7E,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAChE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE;QAC/C,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAA;QAC9D,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,IAAI,WAAW,CAAC,CAAA;QACzF,OAAO;YACL,KAAK,EAAE;gBACL,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC;gBAC3C,kEAAkE;gBAClE,MAAM,EACJ,YAAY,CAAC,MAAM,KAAK,CAAC;oBACzB,YAAY,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;gBAC3E,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC;gBACvB,MAAM,EAAE,SAAS,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;aAChD;YACD,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;YAC5B,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC;YAC1B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;SACtC,CAAA;IACH,CAAC,CAAC,CACH,CAAA;IACD,+FAA+F;IAC/F,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAA;IACpD,OAAO,CAAC,MAAc,EAAE,QAAgB,EAAE,EAAE,CAC1C,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7F,EAAE,KAAK,CAAA;AACb,CAAC;AAED,iDAAiD;AACjD,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,MAAM,GAAG,IAAI;SAChB,KAAK,CAAC,aAAa,CAAC;SACpB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC;SAC7F,IAAI,CAAC,EAAE,CAAC,CAAA;IACX,OAAO,IAAI,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAA;AAClC,CAAC"}

package/dist/cli/Credentials.d.ts

@@ -0,0 +1,95 @@
+import * as z from 'zod/mini';
+/** Stored CLI credentials: one CLI session per API origin. */
+export type Store = {
+    /** Reads the unexpired session for an API URL. */
+    get: (apiUrl: string | URL) => Promise<Session | undefined>;
+    /** Forgets the session for an API URL. */
+    remove: (apiUrl: string | URL) => Promise<void>;
+    /** Saves the session for an API URL. */
+    set: (apiUrl: string | URL, session: Session) => Promise<void>;
+    /** Serializes credential operations across processes, passing an unlocked store to the callback. */
+    withLock?: (<result>(fn: (store: Store) => Promise<result>) => Promise<result>) | undefined;
+};
+/** Storage schemas for the credentials file. */
+export declare namespace schema {
+    /** A project API key inferred from the approved CLI session. */
+    const ApiKey: z.ZodMiniObject<{
+        environment: z.ZodMiniEnum<{
+            production: "production";
+            sandbox: "sandbox";
+        }>;
+        expiresAt: z.ZodMiniOptional<z.ZodMiniString<string>>;
+        id: z.ZodMiniString<string>;
+        orgId: z.ZodMiniString<string>;
+        projectId: z.ZodMiniString<string>;
+        scopes: z.ZodMiniArray<z.ZodMiniString<string>>;
+        sourceKeyId: z.ZodMiniOptional<z.ZodMiniString<string>>;
+        token: z.ZodMiniString<string>;
+    }, z.core.$strip>;
+    /** A signed-in CLI session. */
+    const Session: z.ZodMiniObject<{
+        apiKeys: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniObject<{
+            environment: z.ZodMiniEnum<{
+                production: "production";
+                sandbox: "sandbox";
+            }>;
+            expiresAt: z.ZodMiniOptional<z.ZodMiniString<string>>;
+            id: z.ZodMiniString<string>;
+            orgId: z.ZodMiniString<string>;
+            projectId: z.ZodMiniString<string>;
+            scopes: z.ZodMiniArray<z.ZodMiniString<string>>;
+            sourceKeyId: z.ZodMiniOptional<z.ZodMiniString<string>>;
+            token: z.ZodMiniString<string>;
+        }, z.core.$strip>>>;
+        email: z.ZodMiniOptional<z.ZodMiniString<string>>;
+        expiresAt: z.ZodMiniString<string>;
+        scopes: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniString<string>>>;
+        token: z.ZodMiniString<string>;
+        userId: z.ZodMiniString<string>;
+    }, z.core.$strip>;
+    /** The credentials file. */
+    const File: z.ZodMiniObject<{
+        sessions: z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniObject<{
+            apiKeys: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniObject<{
+                environment: z.ZodMiniEnum<{
+                    production: "production";
+                    sandbox: "sandbox";
+                }>;
+                expiresAt: z.ZodMiniOptional<z.ZodMiniString<string>>;
+                id: z.ZodMiniString<string>;
+                orgId: z.ZodMiniString<string>;
+                projectId: z.ZodMiniString<string>;
+                scopes: z.ZodMiniArray<z.ZodMiniString<string>>;
+                sourceKeyId: z.ZodMiniOptional<z.ZodMiniString<string>>;
+                token: z.ZodMiniString<string>;
+            }, z.core.$strip>>>;
+            email: z.ZodMiniOptional<z.ZodMiniString<string>>;
+            expiresAt: z.ZodMiniString<string>;
+            scopes: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniString<string>>>;
+            token: z.ZodMiniString<string>;
+            userId: z.ZodMiniString<string>;
+        }, z.core.$strip>>;
+        version: z.ZodMiniLiteral<1>;
+    }, z.core.$strip>;
+}
+/** A signed-in CLI session. */
+export type Session = z.output<typeof schema.Session>;
+/** Default credentials file: `<home>/api/credentials.json`, with `home` defaulting to `~/.tempo`. */
+export declare function defaultFile(options?: defaultFile.Options): string;
+export declare namespace defaultFile {
+    /** Options for {@link defaultFile}. */
+    type Options = {
+        /** Tempo CLI home directory. @default '~/.tempo' */
+        home?: string | undefined;
+    };
+}
+/** Creates a credentials store backed by a private JSON file. */
+export declare function store(options?: store.Options): Store;
+export declare namespace store {
+    /** Options for {@link store}. */
+    type Options = {
+        /** Credentials file path. @default defaultFile() */
+        file?: string | undefined;
+    };
+}
+//# sourceMappingURL=Credentials.d.ts.map

package/dist/cli/Credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Credentials.d.ts","sourceRoot":"","sources":["../../src/cli/Credentials.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAE7B,8DAA8D;AAC9D,MAAM,MAAM,KAAK,GAAG;IAClB,kDAAkD;IAClD,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;IAC3D,0CAA0C;IAC1C,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,wCAAwC;IACxC,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,oGAAoG;IACpG,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;CAC5F,CAAA;AAED,gDAAgD;AAChD,yBAAiB,MAAM,CAAC;IACtB,gEAAgE;IACzD,MAAM,MAAM;;;;;;;;;;;;qBASjB,CAAA;IACF,+BAA+B;IACxB,MAAM,OAAO;;;;;;;;;;;;;;;;;;;qBAOlB,CAAA;IAEF,4BAA4B;IACrB,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;qBAGf,CAAA;CACH;AAED,+BAA+B;AAC/B,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;AAIrD,qGAAqG;AACrG,wBAAgB,WAAW,CAAC,OAAO,GAAE,WAAW,CAAC,OAAY,GAAG,MAAM,CAErE;AAED,MAAM,CAAC,OAAO,WAAW,WAAW,CAAC;IACnC,uCAAuC;IACvC,KAAK,OAAO,GAAG;QACb,oDAAoD;QACpD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC1B,CAAA;CACF;AAED,iEAAiE;AACjE,wBAAgB,KAAK,CAAC,OAAO,GAAE,KAAK,CAAC,OAAY,GAAG,KAAK,CAoExD;AAED,MAAM,CAAC,OAAO,WAAW,KAAK,CAAC;IAC7B,iCAAiC;IACjC,KAAK,OAAO,GAAG;QACb,oDAAoD;QACpD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC1B,CAAA;CACF"}

package/dist/cli/Credentials.js

@@ -0,0 +1,110 @@
+import * as fs from 'node:fs/promises';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import * as lockfile from 'proper-lockfile';
+import * as z from 'zod/mini';
+/** Storage schemas for the credentials file. */
+export var schema;
+(function (schema) {
+    /** A project API key inferred from the approved CLI session. */
+    schema.ApiKey = z.object({
+        environment: z.enum(['production', 'sandbox']),
+        expiresAt: z.optional(z.string()),
+        id: z.string(),
+        orgId: z.string(),
+        projectId: z.string(),
+        scopes: z.array(z.string()),
+        sourceKeyId: z.optional(z.string()),
+        token: z.string(),
+    });
+    /** A signed-in CLI session. */
+    schema.Session = z.object({
+        apiKeys: z.optional(z.array(schema.ApiKey)),
+        email: z.optional(z.string()),
+        expiresAt: z.string(),
+        scopes: z.optional(z.array(z.string())),
+        token: z.string(),
+        userId: z.string(),
+    });
+    /** The credentials file. */
+    schema.File = z.object({
+        sessions: z.record(z.string(), schema.Session),
+        version: z.literal(1),
+    });
+})(schema || (schema = {}));
+/** Default credentials file: `<home>/api/credentials.json`, with `home` defaulting to `~/.tempo`. */
+export function defaultFile(options = {}) {
+    return path.join(options.home || path.join(os.homedir(), '.tempo'), 'api', 'credentials.json');
+}
+/** Creates a credentials store backed by a private JSON file. */
+export function store(options = {}) {
+    const { file = defaultFile() } = options;
+    async function read() {
+        const text = await fs.readFile(file, 'utf8').catch((error) => {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        });
+        if (text === undefined)
+            return { sessions: {}, version: 1 };
+        // An unreadable file is treated as signed out rather than blocking every command.
+        const parsed = (() => {
+            try {
+                return schema.File.safeParse(JSON.parse(text));
+            }
+            catch {
+                return undefined;
+            }
+        })();
+        return parsed?.success ? parsed.data : { sessions: {}, version: 1 };
+    }
+    async function write(value) {
+        await fs.mkdir(path.dirname(file), { mode: 0o700, recursive: true });
+        // Write then rename so a crash never leaves a truncated file; 0600 keeps tokens private.
+        const temporary = `${file}.${process.pid}.tmp`;
+        await fs.writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+        await fs.rename(temporary, file);
+    }
+    const unlocked = {
+        async get(apiUrl) {
+            const session = (await read()).sessions[new URL(apiUrl).origin];
+            if (!session || Date.parse(session.expiresAt) <= Date.now())
+                return undefined;
+            return session;
+        },
+        async remove(apiUrl) {
+            const value = await read();
+            const origin = new URL(apiUrl).origin;
+            if (!(origin in value.sessions))
+                return;
+            delete value.sessions[origin];
+            await write(value);
+        },
+        async set(apiUrl, session) {
+            const value = await read();
+            value.sessions[new URL(apiUrl).origin] = session;
+            await write(value);
+        },
+    };
+    async function withLock(fn) {
+        await fs.mkdir(path.dirname(file), { mode: 0o700, recursive: true });
+        const directory = await fs.realpath(path.dirname(file));
+        const release = await lockfile.lock(path.join(directory, path.basename(file)), {
+            realpath: false,
+            retries: { factor: 1, maxTimeout: 100, minTimeout: 100, retries: 600 },
+        });
+        try {
+            return await fn(unlocked);
+        }
+        finally {
+            await release();
+        }
+    }
+    return {
+        get: unlocked.get,
+        remove: (apiUrl) => withLock((store) => store.remove(apiUrl)),
+        set: (apiUrl, session) => withLock((store) => store.set(apiUrl, session)),
+        withLock,
+    };
+}
+//# sourceMappingURL=Credentials.js.map

package/dist/cli/Credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Credentials.js","sourceRoot":"","sources":["../../src/cli/Credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAc7B,gDAAgD;AAChD,MAAM,KAAW,MAAM,CA2BtB;AA3BD,WAAiB,MAAM;IACrB,gEAAgE;IACnD,aAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAC7B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC9C,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACjC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KAClB,CAAC,CAAA;IACF,+BAA+B;IAClB,cAAO,GAAG,CAAC,CAAC,MAAM,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,aAAM,CAAC,CAAC;QACpC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC,CAAA;IAEF,4BAA4B;IACf,WAAI,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,cAAO,CAAC;QACvC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACtB,CAAC,CAAA;AACJ,CAAC,EA3BgB,MAAM,KAAN,MAAM,QA2BtB;AAOD,qGAAqG;AACrG,MAAM,UAAU,WAAW,CAAC,OAAO,GAAwB,EAAE;IAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAA;AAChG,CAAC;AAUD,iEAAiE;AACjE,MAAM,UAAU,KAAK,CAAC,OAAO,GAAkB,EAAE;IAC/C,MAAM,EAAE,IAAI,GAAG,WAAW,EAAE,EAAE,GAAG,OAAO,CAAA;IAExC,KAAK,UAAU,IAAI;QACjB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE;YAClF,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAA;YAC7C,MAAM,KAAK,CAAA;QACb,CAAC,CAAC,CAAA;QACF,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA;QAC3D,kFAAkF;QAClF,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE;YACnB,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAA;YAClB,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,OAAO,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA;IACrE,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,KAAW;QAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACpE,yFAAyF;QACzF,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAA;QAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACrF,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAClC,CAAC;IAED,MAAM,QAAQ,GAAU;QACtB,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAA;YAC/D,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,OAAO,SAAS,CAAA;YAC7E,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAA;YAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAA;YACrC,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC;gBAAE,OAAM;YACvC,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC7B,MAAM,KAAK,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO;YACvB,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAA;YAC1B,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,CAAA;YAChD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;KACF,CAAA;IAED,KAAK,UAAU,QAAQ,CAAS,EAAqC;QACnE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACpE,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QACvD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE;YAC7E,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;SACvE,CAAC,CAAA;QACF,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAA;QAC3B,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,EAAE,CAAA;QACjB,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7D,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,QAAQ;KACT,CAAA;AACH,CAAC"}

package/dist/cli/Spec.d.ts

@@ -0,0 +1,59 @@
+import type { Openapi } from 'incur';
+import * as z from 'zod/mini';
+/** Storage schemas for the cached API document. */
+export declare namespace schema {
+    /** A cached document and the entity tag it was served with. */
+    const Entry: z.ZodMiniObject<{
+        document: z.ZodMiniCustom<Openapi.OpenAPISpec, Openapi.OpenAPISpec>;
+        etag: z.ZodMiniString<string>;
+    }, z.core.$strip>;
+}
+/** Cache file for an API's document under the CLI cache directory (`<directory>/<host>.openapi.json`). */
+export declare function cacheFile(options: cacheFile.Options): string;
+export declare namespace cacheFile {
+    /** Options for {@link cacheFile}. */
+    type Options = {
+        /** CLI cache directory. */
+        directory: string;
+        /** Tempo API origin. */
+        url: string | URL;
+    };
+}
+/**
+ * Loads a hosted API's OpenAPI document, revalidating the cached copy with its ETag so an
+ * unchanged document costs a 304. When the API is unreachable or slow to respond, the cached copy is served.
+ */
+export declare function load(options: load.Options): Promise<load.Result>;
+export declare namespace load {
+    /** Options for {@link load}. */
+    type Options = {
+        /** Sends requests to the Tempo API. @default globalThis.fetch */
+        fetch?: ((request: Request) => Promise<Response>) | undefined;
+        /** Cache file for this API's document. */
+        file: string;
+        /** Tempo API origin. */
+        url: string | URL;
+    };
+    /** The loaded document and where it came from. */
+    type Result = {
+        /** The API's current document. */
+        document: Openapi.OpenAPISpec;
+        /** Served by the API, or confirmed unchanged by a 304. */
+        status: 'current';
+    } | {
+        /** The last cached document. */
+        document: Openapi.OpenAPISpec;
+        /** Why the API could not be reached. */
+        error: unknown;
+        /** The API was unreachable, so the cached copy was served. */
+        status: 'cached';
+    } | {
+        /** An empty document, so only built-in commands are available. */
+        document: Openapi.OpenAPISpec;
+        /** Why the API could not be reached. */
+        error: unknown;
+        /** The API was unreachable and nothing was cached. */
+        status: 'missing';
+    };
+}
+//# sourceMappingURL=Spec.d.ts.map

package/dist/cli/Spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Spec.d.ts","sourceRoot":"","sources":["../../src/cli/Spec.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AACpC,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAK7B,mDAAmD;AACnD,yBAAiB,MAAM,CAAC;IACtB,+DAA+D;IACxD,MAAM,KAAK;;;qBAKhB,CAAA;CACH;AAED,0GAA0G;AAC1G,wBAAgB,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,GAAG,MAAM,CAG5D;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,qCAAqC;IACrC,KAAK,OAAO,GAAG;QACb,2BAA2B;QAC3B,SAAS,EAAE,MAAM,CAAA;QACjB,wBAAwB;QACxB,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAClB,CAAA;CACF;AAED;;;GAGG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CA8BtE;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,gCAAgC;IAChC,KAAK,OAAO,GAAG;QACb,iEAAiE;QACjE,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,SAAS,CAAA;QAC7D,0CAA0C;QAC1C,IAAI,EAAE,MAAM,CAAA;QACZ,wBAAwB;QACxB,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAClB,CAAA;IAED,kDAAkD;IAClD,KAAK,MAAM,GACP;QACE,kCAAkC;QAClC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAA;QAC7B,0DAA0D;QAC1D,MAAM,EAAE,SAAS,CAAA;KAClB,GACD;QACE,gCAAgC;QAChC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAA;QAC7B,wCAAwC;QACxC,KAAK,EAAE,OAAO,CAAA;QACd,8DAA8D;QAC9D,MAAM,EAAE,QAAQ,CAAA;KACjB,GACD;QACE,kEAAkE;QAClE,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAA;QAC7B,wCAAwC;QACxC,KAAK,EAAE,OAAO,CAAA;QACd,sDAAsD;QACtD,MAAM,EAAE,SAAS,CAAA;KAClB,CAAA;CACN"}

package/dist/cli/Spec.js

@@ -0,0 +1,77 @@
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as z from 'zod/mini';
+// A hung API must not stall every command, built-in ones included; past this the cached copy serves.
+const responseTimeout = 5_000;
+/** Storage schemas for the cached API document. */
+export var schema;
+(function (schema) {
+    /** A cached document and the entity tag it was served with. */
+    schema.Entry = z.object({
+        document: z.custom((value) => typeof value === 'object' && value !== null && !Array.isArray(value)),
+        etag: z.string(),
+    });
+})(schema || (schema = {}));
+/** Cache file for an API's document under the CLI cache directory (`<directory>/<host>.openapi.json`). */
+export function cacheFile(options) {
+    const host = new URL(options.url).host.replace(/[^a-z0-9.-]/gi, '_');
+    return path.join(options.directory, `${host}.openapi.json`);
+}
+/**
+ * Loads a hosted API's OpenAPI document, revalidating the cached copy with its ETag so an
+ * unchanged document costs a 304. When the API is unreachable or slow to respond, the cached copy is served.
+ */
+export async function load(options) {
+    const { fetch = (request) => globalThis.fetch(request), file, url } = options;
+    const cached = await read(file);
+    try {
+        const base = new URL(url);
+        if (!base.pathname.endsWith('/'))
+            base.pathname = `${base.pathname}/`;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(new Error(`No response within ${responseTimeout / 1_000}s`)), responseTimeout);
+        const response = await fetch(new Request(new URL('openapi.json', base), {
+            headers: cached ? { 'if-none-match': cached.etag } : {},
+            signal: controller.signal,
+        })).finally(() => clearTimeout(timer));
+        if (response.status === 304 && cached)
+            return { document: cached.document, status: 'current' };
+        if (!response.ok)
+            throw new Error(`Failed to fetch the OpenAPI document: HTTP ${response.status}`);
+        const document = (await response.json());
+        const etag = response.headers.get('etag');
+        // Without a validator the copy could never be revalidated, so it is not worth keeping.
+        if (etag)
+            await write(file, { document, etag });
+        return { document, status: 'current' };
+    }
+    catch (error) {
+        if (cached)
+            return { document: cached.document, error, status: 'cached' };
+        return { document: { paths: {} }, error, status: 'missing' };
+    }
+}
+async function read(file) {
+    const text = await fs.readFile(file, 'utf8').catch(() => undefined);
+    if (text === undefined)
+        return undefined;
+    // A corrupt cache is a miss, never an error.
+    const parsed = (() => {
+        try {
+            return schema.Entry.safeParse(JSON.parse(text));
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    return parsed?.success ? parsed.data : undefined;
+}
+async function write(file, entry) {
+    // Private like the credentials directory, which this may create first as a parent.
+    await fs.mkdir(path.dirname(file), { mode: 0o700, recursive: true });
+    // Write then rename so a concurrent run never reads a truncated document.
+    const temporary = `${file}.${process.pid}.tmp`;
+    await fs.writeFile(temporary, JSON.stringify(entry));
+    await fs.rename(temporary, file);
+}
+//# sourceMappingURL=Spec.js.map

package/dist/cli/Spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Spec.js","sourceRoot":"","sources":["../../src/cli/Spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAEjC,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAE7B,qGAAqG;AACrG,MAAM,eAAe,GAAG,KAAK,CAAA;AAE7B,mDAAmD;AACnD,MAAM,KAAW,MAAM,CAQtB;AARD,WAAiB,MAAM;IACrB,+DAA+D;IAClD,YAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAChB,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAChF;QACD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC,CAAA;AACJ,CAAC,EARgB,MAAM,KAAN,MAAM,QAQtB;AAED,0GAA0G;AAC1G,MAAM,UAAU,SAAS,CAAC,OAA0B;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAA;IACpE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,IAAI,eAAe,CAAC,CAAA;AAC7D,CAAC;AAYD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC9C,MAAM,EAAE,KAAK,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IAC7E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAA;IAE/B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,QAAQ,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAA;QACrE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,sBAAsB,eAAe,GAAG,KAAK,GAAG,CAAC,CAAC,EACnF,eAAe,CAChB,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE;YACzC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;YACvD,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CACH,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA;QACpC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM;YAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QAC9F,IAAI,CAAC,QAAQ,CAAC,EAAE;YACd,MAAM,IAAI,KAAK,CAAC,8CAA8C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAClF,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAA;QAC/D,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACzC,uFAAuF;QACvF,IAAI,IAAI;YAAE,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM;YAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;QACzE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC9D,CAAC;AACH,CAAC;AAyCD,KAAK,UAAU,IAAI,CAAC,IAAY;IAC9B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACnE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACxC,6CAA6C;IAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE;QACnB,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,OAAO,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAClD,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,IAAY,EAAE,KAAY;IAC7C,mFAAmF;IACnF,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACpE,0EAA0E;IAC1E,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAA;IAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IACpD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;AAClC,CAAC"}

package/dist/cli/bin.js

@@ -1,4 +1,8 @@
 #!/usr/bin/env node
 import * as Cli from './Cli.js';
-await Cli.from('https://api.tempo.xyz').serve();
+import * as Admin from './commands/admin.js';
+// Admin commands only need the database, so they never wait on the hosted API document.
+const admin = process.argv[2] === 'admin';
+const cli = await Cli.fromEnv(process.env, admin ? { openapi: { paths: {} } } : {});
+await cli.command(Admin.admin).serve();
 //# sourceMappingURL=bin.js.map

package/dist/cli/bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"bin.js","sourceRoot":"","sources":["../../src/cli/bin.ts"],"names":[],"mappings":";AACA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAE/B,MAAM,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,KAAK,EAAE,CAAA"}
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../../src/cli/bin.ts"],"names":[],"mappings":";AACA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,KAAK,MAAM,qBAAqB,CAAA;AAE5C,wFAAwF;AACxF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAA;AACzC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;AACnF,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAA"}