@alchemy.run/boat 0.0.0-stage → 2.0.0-beta.86

package/lib/ApiKey.js

@@ -0,0 +1,134 @@
+import * as boat from "@distilled.cloud/boat-dev/boat";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { boatName, isGeneratedName } from "./internal/Ownership.js";
+/**
+ * A scoped Boat API key: the actions it may take, and the sandboxes or
+ * environments it reaches. Give each app or CI system its own key with
+ * only what it needs.
+ *
+ * Boat shows a key once, when it is created, so Alchemy keeps it in state
+ * as a `Redacted` value. Changing any prop creates a new key and revokes
+ * the old one; destroying the resource revokes it.
+ *
+ * Creating a key needs a key with `account.admin`, such as the one
+ * `alchemy profile edit --add Boat` signs in with. A new key cannot have
+ * more actions, more sandboxes or a later expiry than the key creating it.
+ * The key a browser sign-in gets lasts a year, so keys it creates expire
+ * with it. An expired key is minted again on the next deploy.
+ *
+ * ### Creating an API key
+ * **Example:** A key for CI that manages the sandboxes it creates
+ * ```typescript
+ * export const Ci = Boat.ApiKey("Ci", { preset: "ci", ttl: "90d" });
+ * ```
+ *
+ * **Example:** A key that only runs commands in one sandbox
+ * ```typescript
+ * const box = yield* Boat.Sandbox("Box", {});
+ * const key = yield* Boat.ApiKey("BoxExec", {
+ *   actions: ["sandbox.read", "exec", "file.read", "file.write"],
+ *   sandboxIds: [box.sandboxId],
+ * });
+ * ```
+ *
+ * @resource
+ * @product API key
+ */
+export const ApiKey = Resource("Boat.ApiKey");
+const redact = (value) => Redacted.isRedacted(value) ? value : Redacted.make(value);
+const findById = (apiKeyId) => boat
+    .listApiKeys({})
+    .pipe(Effect.map((listed) => listed.apiKeys.find((key) => key.id === apiKeyId)));
+/** The props that decide what a key is; Boat can't change any of them on a key. */
+const scopeOf = (props) => JSON.stringify({
+    name: props.name,
+    preset: props.preset,
+    actions: props.actions === undefined ? undefined : [...props.actions].sort(),
+    sandboxIds: props.sandboxIds === undefined ? undefined : [...props.sandboxIds].sort(),
+    environmentIds: props.environmentIds === undefined ? undefined : [...props.environmentIds].sort(),
+    ttl: props.ttl ?? "never",
+});
+const attributesOf = (key, secret) => ({
+    apiKeyId: key.id,
+    name: key.name,
+    key: secret,
+    keyPrefix: key.keyPrefix,
+    keyLastFour: key.keyLastFour,
+    expiresAt: key.expiresAt ?? undefined,
+});
+/**
+ * Seconds until the signing key expires, from Boat's refusal ("…signed
+ * with an API key that expires 2027-11-07T16:21:12.757Z…"), less a minute;
+ * Boat's 90-day default when the message names no date.
+ */
+const ttlUntilSignerExpires = (message) => {
+    const expires = /expires (\S+?Z)/.exec(message ?? "")?.[1];
+    const seconds = expires === undefined ? Number.NaN : (Date.parse(expires) - Date.now()) / 1000 - 60;
+    return Number.isFinite(seconds) && seconds > 60 ? String(Math.floor(seconds)) : "90d";
+};
+/** Revoke a key; revoking one that is gone succeeds. */
+export const revokeApiKey = (apiKeyId) => boat.revokeApiKey({ apiKeyId }).pipe(Effect.asVoid, Effect.catchTag("NotFound", () => Effect.void));
+export const ApiKeyProvider = () => Provider.effect(ApiKey, Effect.gen(function* () {
+    return {
+        stables: ["apiKeyId", "key", "keyPrefix", "keyLastFour"],
+        diff: Effect.fn(function* ({ news, olds }) {
+            if (!isResolved(news) || olds === undefined)
+                return undefined;
+            if (scopeOf(news) !== scopeOf(olds))
+                return { action: "replace" };
+            return undefined;
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+            // Boat never returns a key's value after creation, so a key is
+            // only usable through state.
+            if (output === undefined)
+                return undefined;
+            const key = yield* findById(output.apiKeyId);
+            if (key === undefined || key.expired === true)
+                return undefined;
+            const attrs = attributesOf(key, output.key);
+            return olds !== undefined || isGeneratedName(key.name) ? attrs : Unowned(attrs);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+            const name = yield* boatName(id, news.name ?? output?.name);
+            // Observe — a key is usable only while its value is in state.
+            const observed = output === undefined ? undefined : yield* findById(output.apiKeyId);
+            if (output !== undefined && observed !== undefined && observed.expired !== true) {
+                return attributesOf(observed, output.key);
+            }
+            // Ensure
+            yield* session.note(`Creating API key ${name}...`);
+            const create = (ttl) => boat.createScopedApiKey({
+                name,
+                ttl,
+                ...(news.preset === undefined ? {} : { preset: news.preset }),
+                ...(news.actions === undefined ? {} : { actions: news.actions }),
+                ...(news.sandboxIds === undefined ? {} : { sandboxIds: news.sandboxIds }),
+                ...(news.environmentIds === undefined ? {} : { environmentIds: news.environmentIds }),
+            });
+            const created = yield* create(news.ttl ?? "never").pipe(
+            // Without a `ttl`, the longest Boat allows: as long as the key
+            // signing the request, whose expiry Boat names in the refusal.
+            Effect.catchTag("ApiKeyOutlivesSigner", (error) => news.ttl === undefined
+                ? Effect.suspend(() => create(ttlUntilSignerExpires(error.message)))
+                : Effect.fail(error)));
+            return attributesOf(created.apiKey, redact(created.secret));
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            yield* revokeApiKey(output.apiKeyId);
+        }),
+        // For nuke. Listed keys carry no value; delete needs only the id.
+        list: Effect.fn(function* () {
+            const listed = yield* boat.listApiKeys({});
+            return listed.apiKeys
+                .filter((key) => isGeneratedName(key.name))
+                .map((key) => attributesOf(key, Redacted.make("")));
+        }),
+    };
+}));
+//# sourceMappingURL=ApiKey.js.map

package/lib/ApiKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKey.js","sources":["../src/ApiKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,gCAAgC,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAgGpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAS,aAAa,CAAC,CAAC;AAEtD,MAAM,MAAM,GAAG,CAAC,KAAyC,EAAE,EAAE,CAC3D,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAE5D,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,EAAE,CACpC,IAAI;KACD,WAAW,CAAC,EAAE,CAAC;KACf,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC;AAErF,mFAAmF;AACnF,MAAM,OAAO,GAAG,CAAC,KAAkB,EAAE,EAAE,CACrC,IAAI,CAAC,SAAS,CAAC;IACb,IAAI,EAAE,KAAK,CAAC,IAAI;IAChB,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;IAC5E,UAAU,EAAE,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE;IACrF,cAAc,EACZ,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE;IACnF,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO;CAC1B,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,CAAC,GAAgB,EAAE,MAAiC,EAAoB,EAAE,CAAC,CAAC;IAC/F,QAAQ,EAAE,GAAG,CAAC,EAAE;IAChB,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,GAAG,EAAE,MAAM;IACX,SAAS,EAAE,GAAG,CAAC,SAAS;IACxB,WAAW,EAAE,GAAG,CAAC,WAAW;IAC5B,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;CACtC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,CAAC,OAA2B,EAAE,EAAE;IAC5D,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,OAAO,GACX,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;IACtF,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACxF,CAAC,CAAC;AAEF,wDAAwD;AACxD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAE,EAAE,CAC/C,IAAI,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAClC,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/C,CAAC;AAEJ,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,EAAE,CACjC,QAAQ,CAAC,MAAM,CACb,MAAM,EACN,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO;QACL,OAAO,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,CAAC;QACxD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC9D,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YAC3E,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACzC,+DAA+D;YAC/D,6BAA6B;YAC7B,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YAChE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5C,OAAO,IAAI,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClF,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,IAAI,CAAC,CAAC;YAE5D,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrF,IAAI,MAAM,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAChF,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5C,CAAC;YAED,SAAS;YACT,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,IAAI,KAAK,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7B,IAAI,CAAC,kBAAkB,CAAC;gBACtB,IAAI;gBACJ,GAAG;gBACH,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC7D,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAChE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzE,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;aACtF,CAAC,CAAC;YACL,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,IAAI;YACrD,+DAA+D;YAC/D,+DAA+D;YAC/D,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,EAAE,CAChD,IAAI,CAAC,GAAG,KAAK,SAAS;gBACpB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBACpE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CACvB,CACF,CAAC;YACF,OAAO,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,CAAC;QACF,kEAAkE;QAClE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;YACvB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC,OAAO;iBAClB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;iBAC1C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/AuthProvider.d.ts

@@ -0,0 +1,71 @@
+import * as Layer from "effect/Layer";
+import type { ChildProcessSpawner } from "effect/process/ChildProcessSpawner";
+import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
+/**
+ * Canonical name registered in the AuthProviders registry. Use this key to
+ * look up the Boat AuthProvider from inside provider Layers.
+ */
+export declare const BOAT_AUTH_PROVIDER_NAME = "Boat";
+/**
+ * A Boat profile entry. Both methods store a Boat API key (`boat_…`):
+ *
+ * - `browser`: Boat's agent sign-in (https://boat.dev/auth.md). You sign in
+ *   to boat.dev with GitHub, Google or an email code, type the code Alchemy
+ *   shows, and Boat issues a key. The identity assertion that comes with it
+ *   mints the next key when this one expires.
+ * - `stored`: you paste a key created with `boat api-keys create` or on the
+ *   dashboard.
+ *
+ * Either may pin `org`, the organization Alchemy works in, the way the
+ * dashboard's organization select or `boat --org` do: every call bills it
+ * (`X-Boat-Org`), and `Boat.Environment` manages its shared environments.
+ * Sign-in picks the account's organization (asking only when it belongs
+ * to several) and stores its id (`team_…`), which survives renames, with
+ * `orgName` for display.
+ * Without it, sandboxes bill the account's active wallet (`boat org
+ * switch`) and environments are personal.
+ *
+ * A revoked key fails with Boat's `unauthorized` error; run
+ * `alchemy profile edit --reconfigure Boat` to sign in again.
+ */
+export declare const BoatAuthConfigSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly method: Schema.Literal<"browser">;
+    readonly email: Schema.String;
+    readonly apiKey: Schema.String;
+    readonly identityAssertion: Schema.optional<Schema.String>;
+    /** Epoch millis the key expires at, when Boat says. */
+    readonly expires: Schema.optional<Schema.Number>;
+    readonly account: Schema.optional<Schema.String>;
+    readonly org: Schema.optional<Schema.String>;
+    readonly orgName: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+    readonly method: Schema.Literal<"stored">;
+    readonly apiKey: Schema.String;
+    readonly org: Schema.optional<Schema.String>;
+    readonly orgName: Schema.optional<Schema.String>;
+}>]>;
+export type BoatAuthConfig = typeof BoatAuthConfigSchema.Type;
+/** Resolved Boat credentials: an API key sent as a bearer token. */
+export interface BoatResolvedCredentials {
+    type: "apiKey";
+    apiKey: Redacted.Redacted<string>;
+    apiBaseUrl: string;
+    /** The organization (wallet) calls bill, sent as `X-Boat-Org`. */
+    org?: string;
+    source: {
+        type: BoatAuthConfig["method"] | "env";
+        details?: string;
+    };
+}
+/**
+ * Layer that registers the Boat {@link AuthProvider} into the
+ * `AuthProviders` registry when built. Included in `Boat.providers()` so
+ * `alchemy profile edit` can configure it.
+ *
+ * Supported methods:
+ * - `browser`: Boat's browser sign-in with GitHub or Google (interactive only).
+ * - `stored`: a pasted API key (`--method stored --set apiKey=-`).
+ */
+export declare const BoatAuth: Layer.Layer<never, never, import("alchemy/Auth/Registry").AuthProviders | ChildProcessSpawner | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/crypto/SecureRandom").SecureRandom>;
+//# sourceMappingURL=AuthProvider.d.ts.map

package/lib/AuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.d.ts","sources":["../src/AuthProvider.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC;;;GAGG;AACH,eAAO,MAAM,uBAAuB,SAAS,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,oBAAoB;;;;;IAM7B,uDAAuD;;;;;;;;;;IAYzD,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAC;AAG9D,oEAAoE;AACpE,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE;QAAE,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAkPD;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,0NAkIpB,CAAC"}

package/lib/AuthProvider.js

@@ -0,0 +1,322 @@
+import * as boat from "@distilled.cloud/boat-dev";
+import { DEFAULT_API_BASE_URL, fromApiKey } from "@distilled.cloud/boat-dev/Credentials";
+import * as Login from "@distilled.cloud/boat-dev/Login";
+import { AuthError, AuthProviderLayer, NeedsReauth, refreshHint, } from "alchemy/Auth/AuthProvider";
+import { displayRedacted } from "alchemy/Auth/Credentials";
+import { getEnv, getEnvRedacted, mapPromptCancellation } from "alchemy/Auth/Env";
+import { collectFieldValues, storedSecret, storedValueText, validateFieldValues, } from "alchemy/Auth/StoredAuthProvider";
+import * as Interaction from "alchemy/Interaction";
+import * as Clock from "effect/Clock";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import * as Match from "effect/Match";
+import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
+/**
+ * Canonical name registered in the AuthProviders registry. Use this key to
+ * look up the Boat AuthProvider from inside provider Layers.
+ */
+export const BOAT_AUTH_PROVIDER_NAME = "Boat";
+/**
+ * A Boat profile entry. Both methods store a Boat API key (`boat_…`):
+ *
+ * - `browser`: Boat's agent sign-in (https://boat.dev/auth.md). You sign in
+ *   to boat.dev with GitHub, Google or an email code, type the code Alchemy
+ *   shows, and Boat issues a key. The identity assertion that comes with it
+ *   mints the next key when this one expires.
+ * - `stored`: you paste a key created with `boat api-keys create` or on the
+ *   dashboard.
+ *
+ * Either may pin `org`, the organization Alchemy works in, the way the
+ * dashboard's organization select or `boat --org` do: every call bills it
+ * (`X-Boat-Org`), and `Boat.Environment` manages its shared environments.
+ * Sign-in picks the account's organization (asking only when it belongs
+ * to several) and stores its id (`team_…`), which survives renames, with
+ * `orgName` for display.
+ * Without it, sandboxes bill the account's active wallet (`boat org
+ * switch`) and environments are personal.
+ *
+ * A revoked key fails with Boat's `unauthorized` error; run
+ * `alchemy profile edit --reconfigure Boat` to sign in again.
+ */
+export const BoatAuthConfigSchema = Schema.Union([
+    Schema.Struct({
+        method: Schema.Literal("browser"),
+        email: Schema.String,
+        apiKey: Schema.String,
+        identityAssertion: Schema.optional(Schema.String),
+        /** Epoch millis the key expires at, when Boat says. */
+        expires: Schema.optional(Schema.Number),
+        account: Schema.optional(Schema.String),
+        org: Schema.optional(Schema.String),
+        orgName: Schema.optional(Schema.String),
+    }),
+    Schema.Struct({
+        method: Schema.Literal("stored"),
+        apiKey: Schema.String,
+        org: Schema.optional(Schema.String),
+        orgName: Schema.optional(Schema.String),
+    }),
+]);
+const apiKeyField = {
+    name: "apiKey",
+    label: "Boat API key",
+    description: "Create one with `boat api-keys create` or at https://boat.dev/dashboard.",
+    secret: true,
+    validate: (value) => (value.trim().startsWith("boat_") ? undefined : "Expected a boat_… key"),
+};
+const orgField = {
+    name: "org",
+    label: "Boat organization",
+    description: "The organization to work in: its id (team_…), its name, or `personal`. Leave it out to follow your active wallet.",
+    optional: true,
+};
+/** `--set` fields; interactively the org is picked from a list instead. */
+const keyFields = [apiKeyField, orgField];
+/** A set org, trimmed; blank means the active wallet. */
+const orgOf = (value) => {
+    const org = value?.trim();
+    return org ? { org } : {};
+};
+const storedConfig = (values) => ({
+    method: "stored",
+    apiKey: Redacted.value(storedSecret(values.apiKey) ?? Redacted.make("")).trim(),
+    ...orgOf(storedValueText(values.org)),
+});
+/** Sentinel choice: pin nothing and follow the account's active wallet. */
+const ACTIVE_WALLET = "";
+/**
+ * The organization to work in. An account in no organization works
+ * personally and one in exactly one works in it, without a question;
+ * only an account in several is asked to pick.
+ */
+const chooseOrg = Effect.fn(function* (apiKey, current) {
+    const { orgs } = yield* boat.listOrganizations({}).pipe(Effect.provide(Layer.mergeAll(fromApiKey({ apiKey }), FetchHttpClient.layer)), Effect.mapError((cause) => AuthError.make({ message: "Boat: could not list your organizations.", cause })));
+    const teams = orgs.filter((org) => org.type === "org");
+    if (teams.length === 0)
+        return {};
+    if (teams.length === 1) {
+        const [team] = teams;
+        yield* Interaction.info(`Boat: working in ${team.name}.`);
+        return { org: team.id, orgName: team.name };
+    }
+    const active = orgs.find((org) => org.active);
+    const org = yield* Interaction.select({
+        message: "Boat organization to work in",
+        options: [
+            ...teams.map((team) => ({
+                value: team.id,
+                label: team.name,
+                description: `${team.role ?? "member"}: sandboxes bill it, environments are its shared ones`,
+            })),
+            {
+                value: "personal",
+                label: "Personal",
+                description: "your own wallet and your personal environments",
+            },
+            {
+                value: ACTIVE_WALLET,
+                label: "Follow the active wallet",
+                description: `whatever \`boat org switch\` picks (now ${active?.name ?? "Personal"}); environments stay personal`,
+            },
+        ],
+        initialValue: current ?? (active?.type === "org" ? active.id : teams[0].id),
+    }).pipe(mapPromptCancellation);
+    if (org === ACTIVE_WALLET)
+        return {};
+    const orgName = org === "personal" ? "Personal" : teams.find((team) => team.id === org)?.name;
+    return { org, ...(orgName ? { orgName } : {}) };
+});
+const loginFailed = (cause) => AuthError.make({ message: `Boat: browser sign-in failed: ${cause.message}`, cause });
+/** The account a key acts for, as `boat whoami` shows it. */
+const accountOf = (apiKey) => boat.getCurrentUser({}).pipe(Effect.provide(Layer.mergeAll(fromApiKey({ apiKey }), FetchHttpClient.layer)), Effect.map(({ user }) => user.email ?? user.login ?? user.displayName ?? user.id), Effect.mapError((cause) => AuthError.make({ message: "Boat: the new API key was refused.", cause })));
+/** Fresh codes the sign-in hands out before it gives up. */
+const CODE_ROUNDS = 6;
+/** Polls give up after this many attempts: about fifteen minutes at 5s. */
+const POLL_ATTEMPTS = 180;
+const expiryOf = (now, expiresIn) => expiresIn === undefined ? {} : { expires: now + expiresIn * 1000 };
+/**
+ * Boat's agent sign-in: register for the account with the user's email,
+ * open the claim page, where the user signs in with any method and types the
+ * code, then poll until Boat issues a key.
+ */
+const browserLogin = (initialEmail, initialOrg) => Effect.gen(function* () {
+    const email = (yield* Interaction.text({
+        message: "Email of your Boat account",
+        description: "You sign in on boat.dev next, with GitHub, Google or an email code.",
+        ...(initialEmail ? { initialValue: initialEmail } : {}),
+        validate: (value) => (value.includes("@") ? undefined : "Expected an email address"),
+    }).pipe(mapPromptCancellation)).trim();
+    const http = FetchHttpClient.layer;
+    const registered = yield* Login.registerAgent({ email }).pipe(Effect.provide(http), Effect.mapError(loginFailed));
+    const poll = (claim, interval, attempt) => Effect.sleep(Duration.seconds(interval)).pipe(Effect.andThen(Login.pollClaim({ claimToken: claim.claimToken, interval }).pipe(Effect.provide(http))), Effect.flatMap((result) => result._tag === "Issued"
+        ? Effect.succeed(result.key)
+        : attempt >= POLL_ATTEMPTS
+            ? Effect.fail(AuthError.make({ message: "Boat: the sign-in wasn't completed in time." }))
+            : poll(claim, result.interval, attempt + 1)));
+    // A code lapses after about ten minutes (`expired_token`); the claim
+    // then hands out a fresh one, shown in a new sign-in prompt.
+    const signIn = (claim, round) => Interaction.browserLogin({
+        provider: "Boat",
+        url: claim.verificationUri,
+        code: claim.userCode,
+        waitFor: poll(claim, claim.interval, 1),
+    }).pipe(Effect.catchIf((e) => e._tag === "BoatLoginError" && e.code === "expired_token" && round < CODE_ROUNDS, () => Login.refreshClaim({ claimToken: claim.claimToken, email }).pipe(Effect.provide(http), Effect.mapError(loginFailed), Effect.tap(() => Interaction.info("Boat: the code expired; here is a new one.")), Effect.flatMap((next) => signIn(next, round + 1)))), Effect.mapError((e) => (e._tag === "AuthError" ? e : loginFailed(e))));
+    const key = yield* signIn(registered, 1);
+    const account = yield* accountOf(key.apiKey);
+    yield* Interaction.success(`Boat: signed in as ${account ?? email}.`);
+    const org = yield* chooseOrg(key.apiKey, initialOrg);
+    const now = yield* Clock.currentTimeMillis;
+    return {
+        method: "browser",
+        email,
+        apiKey: Redacted.value(key.apiKey),
+        ...(key.identityAssertion
+            ? { identityAssertion: Redacted.value(key.identityAssertion) }
+            : {}),
+        ...expiryOf(now, key.expiresIn),
+        ...(account ? { account } : {}),
+        ...org,
+    };
+});
+/** Mints a new key from the assertion when the stored one is within a minute of expiring. */
+const freshKey = Effect.fn(function* (profileName, config) {
+    const now = yield* Clock.currentTimeMillis;
+    if (config.expires === undefined || config.expires > now + 60_000)
+        return config;
+    if (config.identityAssertion === undefined) {
+        return yield* NeedsReauth.make({
+            provider: BOAT_AUTH_PROVIDER_NAME,
+            profile: profileName,
+            message: `Boat API key expired. ${refreshHint(BOAT_AUTH_PROVIDER_NAME, profileName)}`,
+        });
+    }
+    const key = yield* Login.exchangeAssertion({
+        identityAssertion: Redacted.make(config.identityAssertion),
+    }).pipe(Effect.provide(FetchHttpClient.layer), Effect.mapError((cause) => NeedsReauth.make({
+        provider: BOAT_AUTH_PROVIDER_NAME,
+        profile: profileName,
+        message: `Boat sign-in expired. ${refreshHint(BOAT_AUTH_PROVIDER_NAME, profileName)}`,
+        cause,
+    })));
+    return {
+        ...config,
+        apiKey: Redacted.value(key.apiKey),
+        ...(key.identityAssertion ? { identityAssertion: Redacted.value(key.identityAssertion) } : {}),
+        expires: key.expiresIn === undefined ? undefined : now + key.expiresIn * 1000,
+    };
+});
+const readEnvironment = Effect.gen(function* () {
+    const apiKey = yield* getEnvRedacted("BOAT_API_KEY");
+    if (apiKey === undefined || Redacted.value(apiKey).trim().length === 0) {
+        return yield* AuthError.make({
+            message: "Boat CI credentials not found. Set BOAT_API_KEY.",
+        });
+    }
+    return {
+        type: "apiKey",
+        apiKey: Redacted.make(Redacted.value(apiKey).trim()),
+        apiBaseUrl: (yield* getEnv("BOAT_API_BASE_URL")) ?? DEFAULT_API_BASE_URL,
+        ...orgOf(yield* getEnv("BOAT_ORG")),
+        source: { type: "env", details: "BOAT_API_KEY" },
+    };
+});
+const resolve = (config) => ({
+    type: "apiKey",
+    apiKey: Redacted.make(config.apiKey),
+    apiBaseUrl: DEFAULT_API_BASE_URL,
+    ...orgOf(config.org),
+    source: {
+        type: config.method,
+        details: config.method === "browser" ? (config.account ?? config.email) : undefined,
+    },
+});
+/**
+ * Layer that registers the Boat {@link AuthProvider} into the
+ * `AuthProviders` registry when built. Included in `Boat.providers()` so
+ * `alchemy profile edit` can configure it.
+ *
+ * Supported methods:
+ * - `browser`: Boat's browser sign-in with GitHub or Google (interactive only).
+ * - `stored`: a pasted API key (`--method stored --set apiKey=-`).
+ */
+export const BoatAuth = AuthProviderLayer()(BOAT_AUTH_PROVIDER_NAME, Effect.gen(function* () {
+    const pasteKey = collectFieldValues([apiKeyField]).pipe(Effect.map(storedConfig), Effect.flatMap((config) => chooseOrg(Redacted.make(config.apiKey)).pipe(Effect.map((org) => ({ ...config, ...org })))), Effect.tap(() => Interaction.success("Boat: credentials saved.")));
+    const configure = (_profileName) => Interaction.select({
+        message: "Boat authentication method",
+        options: [
+            {
+                value: "browser",
+                label: "Browser sign-in",
+                description: "recommended — sign in on boat.dev with GitHub, Google or email",
+            },
+            {
+                value: "stored",
+                label: "API key",
+                description: "paste a boat_… key",
+            },
+        ],
+    }).pipe(mapPromptCancellation, Effect.flatMap((method) => Match.value(method).pipe(Match.when("browser", () => browserLogin()), Match.when("stored", () => pasteKey), Match.exhaustive)), Effect.mapError((e) => e._tag === "AuthError"
+        ? e
+        : AuthError.make({ message: "Boat: failed to configure credentials", cause: e })));
+    /** The browser sign-in needs a person, so only `stored` takes flags. */
+    const configureMethods = [
+        { method: "stored", fields: keyFields },
+    ];
+    const configureWith = (_profileName, input) => input.method === "stored"
+        ? validateFieldValues(BOAT_AUTH_PROVIDER_NAME, keyFields, input.values).pipe(Effect.map(storedConfig), Effect.tap(() => Interaction.success("Boat: credentials saved.")))
+        : Effect.fail(AuthError.make({
+            message: `Boat: unknown method '${input.method}'. Valid methods: stored. (Browser sign-in is interactive-only.)`,
+        }));
+    // A key doesn't refresh, so logging in again repeats the browser
+    // sign-in; a pasted key stays as it is.
+    const login = (_profileName, config) => config.method === "browser"
+        ? browserLogin(config.email, config.org).pipe(Effect.mapError((e) => e._tag === "AuthError"
+            ? e
+            : AuthError.make({ message: "Boat: login failed", cause: e })))
+        : Effect.succeed(config);
+    const details = (_profileName, config) => Effect.succeed({
+        lines: [
+            ...(config.method === "browser"
+                ? [{ key: "account", value: config.account ?? config.email }]
+                : []),
+            { key: "apiKey", value: displayRedacted(Redacted.make(config.apiKey)) },
+            ...(config.org ? [{ key: "org", value: config.orgName ?? config.org }] : []),
+            { key: "source", value: config.method },
+        ],
+    });
+    return {
+        configSchema: BoatAuthConfigSchema,
+        configure,
+        configureWith,
+        configureMethods,
+        login,
+        logout: () => Effect.void,
+        details,
+        read: (profileName, config, updateConfig) => config.method === "stored"
+            ? Effect.succeed(resolve(config))
+            : freshKey(profileName, config).pipe(Effect.tap((fresh) => fresh === config ? Effect.void : (updateConfig?.(fresh) ?? Effect.void)), Effect.map(resolve)),
+        readEnvironment,
+        environment: [
+            {
+                name: "BOAT_API_KEY",
+                required: true,
+                secret: true,
+                description: "Boat API key (`boat_…`).",
+            },
+            {
+                name: "BOAT_API_BASE_URL",
+                required: false,
+                description: `Boat API URL override. Defaults to ${DEFAULT_API_BASE_URL}.`,
+            },
+            {
+                name: "BOAT_ORG",
+                required: false,
+                description: "Boat organization (wallet) to bill: an org id (`team_…`), an org name, or `personal`. Defaults to the account's active wallet.",
+            },
+        ],
+    };
+}));
+//# sourceMappingURL=AuthProvider.js.map

package/lib/AuthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.js","sources":["../src/AuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,2BAA2B,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,KAAK,KAAK,MAAM,iCAAiC,CAAC;AACzD,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,WAAW,EACX,WAAW,GAIZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,mBAAmB,GAEpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,WAAW,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC;IAC/C,MAAM,CAAC,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACjC,KAAK,EAAE,MAAM,CAAC,MAAM;QACpB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QACjD,uDAAuD;QACvD,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QACvC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QACnC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;KACxC,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QACnC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;KACxC,CAAC;CACH,CAAC,CAAC;AAcH,MAAM,WAAW,GAAmB;IAClC,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,cAAc;IACrB,WAAW,EAAE,0EAA0E;IACvF,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC;CAC9F,CAAC;AAEF,MAAM,QAAQ,GAAmB;IAC/B,IAAI,EAAE,KAAK;IACX,KAAK,EAAE,mBAAmB;IAC1B,WAAW,EACT,mHAAmH;IACrH,QAAQ,EAAE,IAAI;CACf,CAAC;AAEF,2EAA2E;AAC3E,MAAM,SAAS,GAAkC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AAEzE,yDAAyD;AACzD,MAAM,KAAK,GAAG,CAAC,KAAyB,EAAE,EAAE;IAC1C,MAAM,GAAG,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC1B,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5B,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,MAAoB,EAAkB,EAAE,CAAC,CAAC;IAC9D,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IAC/E,GAAG,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;CACtC,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB;;;;GAIG;AACH,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAiC,EAAE,OAAgB;IACxF,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,IAAI,CACrD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,EAC7E,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,KAAK,EAAE,CAAC,CAC/E,CACF,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACrB,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,oBAAoB,IAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3D,OAAO,EAAE,GAAG,EAAE,IAAK,CAAC,EAAE,EAAE,OAAO,EAAE,IAAK,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC;QACpC,OAAO,EAAE,8BAA8B;QACvC,OAAO,EAAE;YACP,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACtB,KAAK,EAAE,IAAI,CAAC,EAAE;gBACd,KAAK,EAAE,IAAI,CAAC,IAAI;gBAChB,WAAW,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,uDAAuD;aAC7F,CAAC,CAAC;YACH;gBACE,KAAK,EAAE,UAAU;gBACjB,KAAK,EAAE,UAAU;gBACjB,WAAW,EAAE,gDAAgD;aAC9D;YACD;gBACE,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,0BAA0B;gBACjC,WAAW,EAAE,2CAA2C,MAAM,EAAE,IAAI,IAAI,UAAU,+BAA+B;aAClH;SACF;QACD,YAAY,EAAE,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,aAAa;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC;IAC9F,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,KAAmC,EAAE,EAAE,CAC1D,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iCAAiC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAEvF,6DAA6D;AAC7D,MAAM,SAAS,GAAG,CAAC,MAAiC,EAAE,EAAE,CACtD,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,IAAI,CAC1B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,EAC7E,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,EAAE,CAAC,EACjF,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,KAAK,EAAE,CAAC,CACzE,CACF,CAAC;AAEJ,4DAA4D;AAC5D,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB,2EAA2E;AAC3E,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,SAA6B,EAAE,EAAE,CAC9D,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,SAAS,GAAG,IAAI,EAAE,CAAC;AAErE;;;;GAIG;AACH,MAAM,YAAY,GAAG,CAAC,YAAqB,EAAE,UAAmB,EAAE,EAAE,CAClE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,OAAO,EAAE,4BAA4B;QACrC,WAAW,EAAE,qEAAqE;QAClF,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC;KACrF,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAC3D,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EACpB,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAC7B,CAAC;IACF,MAAM,IAAI,GAAG,CACX,KAAkB,EAClB,QAAgB,EAChB,OAAe,EACmD,EAAE,CACpE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAC3C,MAAM,CAAC,OAAO,CACZ,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CACvF,EACD,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,MAAM,CAAC,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;QAC5B,CAAC,CAAC,OAAO,IAAI,aAAa;YACxB,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC,CAC3E;YACH,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,GAAG,CAAC,CAAC,CAChD,CACF,CAAC;IACJ,qEAAqE;IACrE,6DAA6D;IAC7D,MAAM,MAAM,GAAG,CACb,KAAkB,EAClB,KAAa,EAC6E,EAAE,CAC5F,WAAW,CAAC,YAAY,CAAC;QACvB,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,KAAK,CAAC,eAAe;QAC1B,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;KACxC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CACZ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,KAAK,GAAG,WAAW,EACvF,GAAG,EAAE,CACH,KAAK,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAC9D,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EACpB,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC,EAChF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAClD,CACJ,EACD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CACtE,CAAC;IACJ,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,sBAAsB,OAAO,IAAI,KAAK,GAAG,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAC3C,OAAO;QACL,MAAM,EAAE,SAAkB;QAC1B,KAAK;QACL,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,iBAAiB;YACvB,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC;QAC/B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,GAAG;KACiB,CAAC;AAC5B,CAAC,CAAC,CAAC;AAEL,6FAA6F;AAC7F,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,WAAmB,EAAE,MAAqB;IAC9E,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAC3C,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,GAAG,GAAG,GAAG,MAAM;QAAE,OAAO,MAAM,CAAC;IACjF,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC;YAC7B,QAAQ,EAAE,uBAAuB;YACjC,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,yBAAyB,WAAW,CAAC,uBAAuB,EAAE,WAAW,CAAC,EAAE;SACtF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;QACzC,iBAAiB,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;KAC3D,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EACrC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,WAAW,CAAC,IAAI,CAAC;QACf,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,WAAW;QACpB,OAAO,EAAE,yBAAyB,WAAW,CAAC,uBAAuB,EAAE,WAAW,CAAC,EAAE;QACrF,KAAK;KACN,CAAC,CACH,CACF,CAAC;IACF,OAAO;QACL,GAAG,MAAM;QACT,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,OAAO,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,SAAS,GAAG,IAAI;KACtD,CAAC;AAC5B,CAAC,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;IACrD,IAAI,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3B,OAAO,EAAE,kDAAkD;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAiB;QACvB,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,oBAAoB;QACxE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAc,EAAE,OAAO,EAAE,cAAc,EAAE;KACxB,CAAC;AACtC,CAAC,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,CAAC,MAAsB,EAA2B,EAAE,CAAC,CAAC;IACpE,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IACpC,UAAU,EAAE,oBAAoB;IAChC,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;IACpB,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC,MAAM;QACnB,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;KACpF;CACF,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,iBAAiB,EAA2C,CAClF,uBAAuB,EACvB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CACrD,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EACxB,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAC3F,EACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAClE,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,YAAoB,EAAE,EAAE,CACzC,WAAW,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,4BAA4B;QACrC,OAAO,EAAE;YACP;gBACE,KAAK,EAAE,SAAkB;gBACzB,KAAK,EAAE,iBAAiB;gBACxB,WAAW,EAAE,gEAAgE;aAC9E;YACD;gBACE,KAAK,EAAE,QAAiB;gBACxB,KAAK,EAAE,SAAS;gBAChB,WAAW,EAAE,oBAAoB;aAClC;SACF;KACF,CAAC,CAAC,IAAI,CACL,qBAAqB,EACrB,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CACtB,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,EAC3C,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,EACpC,KAAK,CAAC,UAAU,CACjB,CACF,EACD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CACpB,CAAC,CAAC,IAAI,KAAK,WAAW;QACpB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CACnF,CACF,CAAC;IAEJ,wEAAwE;IACxE,MAAM,gBAAgB,GAAmC;QACvD,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE;KACxC,CAAC;IAEF,MAAM,aAAa,GAAG,CACpB,YAAoB,EACpB,KAA2E,EAC3E,EAAE,CACF,KAAK,CAAC,MAAM,KAAK,QAAQ;QACvB,CAAC,CAAC,mBAAmB,CAAC,uBAAuB,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CACxE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EACxB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAClE;QACH,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,SAAS,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,yBAAyB,KAAK,CAAC,MAAM,kEAAkE;SACjH,CAAC,CACH,CAAC;IAER,iEAAiE;IACjE,wCAAwC;IACxC,MAAM,KAAK,GAAG,CAAC,YAAoB,EAAE,MAAsB,EAAE,EAAE,CAC7D,MAAM,CAAC,MAAM,KAAK,SAAS;QACzB,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACzC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CACpB,CAAC,CAAC,IAAI,KAAK,WAAW;YACpB,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAChE,CACF;QACH,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7B,MAAM,OAAO,GAAG,CAAC,YAAoB,EAAE,MAAsB,EAAE,EAAE,CAC/D,MAAM,CAAC,OAAO,CAAkB;QAC9B,KAAK,EAAE;YACL,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS;gBAC7B,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC7D,CAAC,CAAC,EAAE,CAAC;YACP,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE;YACvE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;SACxC;KACF,CAAC,CAAC;IAEL,OAAO;QACL,YAAY,EAAE,oBAAoB;QAClC,SAAS;QACT,aAAa;QACb,gBAAgB;QAChB,KAAK;QACL,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;QACzB,OAAO;QACP,IAAI,EAAE,CACJ,WAAmB,EACnB,MAAsB,EACtB,YAAyE,EACR,EAAE,CACnE,MAAM,CAAC,MAAM,KAAK,QAAQ;YACxB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACjC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,CAChC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CACxE,EACD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CACpB;QACP,eAAe;QACf,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,0BAA0B;aACxC;YACD;gBACE,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,sCAAsC,oBAAoB,GAAG;aAC3E;YACD;gBACE,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,gIAAgI;aACnI;SACF;KACF,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/BoatBindings.d.ts

@@ -0,0 +1,52 @@
+/**
+ * How Boat bindings reach Boat from any host.
+ *
+ * Boat has scoped API keys and no identity federation, so every binding
+ * mints its own key at deploy, a `Boat.ApiKey` in the host's namespace,
+ * with only the actions it needs and, for a declared sandbox, only that
+ * sandbox. The key is deleted with the host. The deployer's credentials
+ * never reach a host. The binding captures the key as a named runtime
+ * Output; inside the deployed host it is read back from the host's env,
+ * still `Redacted`. Every runtime call provides `Credentials` from it, so
+ * nothing reads `process.env`. The deployer's org and API URL are bound
+ * alongside it (`BOAT_ORG`, `BOAT_API_BASE_URL`), so the host's calls bill
+ * the same wallet the deploy did.
+ *
+ * Bindings that create sandboxes at run time label them with the host's
+ * `alchemy.stack` / `alchemy.stage` / `alchemy.id`, computed at deploy and
+ * bound into the host (`bindOwnerLabels`). Destroying the stack does not
+ * delete them.
+ */
+import { Credentials } from "@distilled.cloud/boat-dev/Credentials";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import * as Effect from "effect/Effect";
+import type * as HttpClient from "effect/http/HttpClient";
+/** The `alchemy.*` labels on sandboxes a host creates at run time. */
+export type OwnerLabels = Readonly<Record<string, string>>;
+export interface BoatAuth {
+    /** Runs a distilled call with the binding's key and an HTTP client. */
+    readonly authorize: <A, E>(effect: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>) => Effect.Effect<A, E, RuntimeContext>;
+}
+/**
+ * Mints the binding's key (`<keyId>` in the host's namespace, with
+ * `scope`) and binds it onto the host as `<envName>`, and returns a runtime
+ * accessor for it. Without a host (a script) nothing is minted, and calls
+ * use the ambient credentials.
+ */
+export declare const bindBoat: (keyId: string, envName: string, scope: {
+    name?: import("alchemy/Input").Input<string | undefined>;
+    preset?: import("alchemy/Input").Input<import("./ApiKey.ts").ApiKeyPreset | undefined>;
+    actions?: import("alchemy/Input").Input<import("./ApiKey.ts").ApiKeyAction[] | undefined>;
+    sandboxIds?: import("alchemy/Input").Input<string[] | undefined>;
+    environmentIds?: import("alchemy/Input").Input<string[] | undefined>;
+    ttl?: import("alchemy/Input").Input<string | undefined>;
+}) => Effect.Effect<{
+    authorize: <A, E>(effect: Effect.Effect<A, E, Credentials | HttpClient.HttpClient>) => Effect.Effect<A, E, never>;
+}, never, never>;
+/**
+ * Binds the host's `alchemy.stack` / `alchemy.stage` / `alchemy.id` into
+ * it, and returns them at run time for `create` to label what it makes.
+ * Without a host (a script) there are none.
+ */
+export declare const bindOwnerLabels: Effect.Effect<Effect.Effect<Readonly<Record<string, string>>, never, never>, never, never>;
+//# sourceMappingURL=BoatBindings.d.ts.map

package/lib/BoatBindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BoatBindings.d.ts","sources":["../src/BoatBindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,WAAW,EAAwB,MAAM,uCAAuC,CAAC;AAM1F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAU1D,sEAAsE;AACtE,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE3D,MAAM,WAAW,QAAQ;IACvB,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,EACvB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,KAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;CAC1C;AAED;;;;;GAKG;AACH,eAAO,MAAM,QAAQ;;;;;;;;gBAXE,CAAC,EAAE,CAAC;gBAyDzB,CAAC;AAUH;;;;GAIG;AACH,eAAO,MAAM,eAAe,4FAkB1B,CAAC"}