@almadar/shell-runtime 0.0.0-stage → 1.0.0

package/dist/chunk-A2JJT4GA.js

@@ -0,0 +1,56 @@
+// src/client/state-book.ts
+function findInitialState(trait) {
+  const markedInitial = trait.states?.find((s) => s.isInitial)?.name;
+  return markedInitial ?? trait.states?.[0]?.name ?? "unknown";
+}
+function createInitialTraitState(trait) {
+  return {
+    traitName: trait.name,
+    currentState: findInitialState(trait),
+    previousState: null,
+    lastEvent: null,
+    context: {}
+  };
+}
+var SINGLETON_SCOPE = "__singleton__";
+var key = (traitName, entityId) => `${traitName}::${entityId ?? SINGLETON_SCOPE}`;
+var StateBook = class {
+  constructor(traits = [], observer) {
+    this.observer = observer;
+    for (const trait of traits) this.traits.set(trait.name, trait);
+  }
+  observer;
+  traits = /* @__PURE__ */ new Map();
+  states = /* @__PURE__ */ new Map();
+  /** The trait's state, its initial state until the kernel reports one; `undefined` for a trait not on the page. */
+  getState(traitName, entityId) {
+    const recorded = this.states.get(key(traitName, entityId));
+    if (recorded !== void 0) return recorded;
+    const trait = this.traits.get(traitName);
+    return trait === void 0 ? void 0 : createInitialTraitState(trait);
+  }
+  /** Each trait's singleton-scope state. */
+  getAllStates() {
+    const out = /* @__PURE__ */ new Map();
+    for (const name of this.traits.keys()) {
+      const state = this.getState(name);
+      if (state !== void 0) out.set(name, state);
+    }
+    return out;
+  }
+  /** Record the state the kernel reports. No-op for a trait not on the page. */
+  seedState(traitName, currentState, entityId) {
+    const trait = this.traits.get(traitName);
+    if (trait === void 0) return;
+    const existing = this.states.get(key(traitName, entityId)) ?? createInitialTraitState(trait);
+    this.states.set(key(traitName, entityId), { ...existing, currentState, previousState: existing.currentState });
+  }
+  /** Undo an optimistic commit, reporting the hop back to the observer. */
+  rollbackState(traitName, toState, entityId, cause) {
+    const from = this.getState(traitName, entityId)?.currentState;
+    this.seedState(traitName, toState, entityId);
+    if (from !== void 0 && from !== toState) this.observer?.onRollback?.({ traitName, from, to: toState, cause });
+  }
+};
+
+export { StateBook, createInitialTraitState, findInitialState };

package/dist/chunk-BAS26HBN.js

@@ -0,0 +1,10 @@
+// src/runtime/entities/declaredCollections.ts
+function bindDeclaredCollections(store, entities) {
+  for (const entity of entities) {
+    if (entity.name && entity.collection && entity.browser !== true && entity.persistence !== "runtime") {
+      store.bindCollection?.(entity.name, entity.collection);
+    }
+  }
+}
+
+export { bindDeclaredCollections };

package/dist/chunk-BOVU4TCQ.js

@@ -0,0 +1,65 @@
+// src/kernel/os-port.ts
+function kernelOsTls(server) {
+  return {
+    complete: (key, outcome) => {
+      const step = JSON.parse(server().tlsComplete(key, JSON.stringify(outcome)));
+      return step;
+    }
+  };
+}
+function kernelOsCompletions(kernel) {
+  const deferring = JSON.parse(kernel.osDeferringOps());
+  const streaming = JSON.parse(kernel.osStreamOps());
+  return {
+    defers: (op) => deferring.includes(op),
+    streams: (op) => streaming.includes(op),
+    event: (site, key, outcome) => {
+      const fired = JSON.parse(kernel.osCompletionEvent(JSON.stringify(site), key, JSON.stringify(outcome)));
+      return fired;
+    }
+  };
+}
+function kernelOsGrants(matchers, server) {
+  return {
+    allows: (need, orbital) => server().osAllows(JSON.stringify(need), orbital),
+    globMatches: (glob, path) => matchers.osGlobMatches(glob, path),
+    isPublicAddress: (ip) => matchers.isPublicAddress(ip),
+    anchor: (anchors) => {
+      const problems = JSON.parse(server().setOsAnchors(JSON.stringify(anchors)));
+      return problems;
+    },
+    resolveArgs: (op, args) => {
+      const resolved = JSON.parse(server().osResolveArgs(op, JSON.stringify(args)));
+      return resolved;
+    }
+  };
+}
+function expandAnchor(anchors, text) {
+  const home = text === "~" ? "" : text.startsWith("~/") ? text.slice(2) : void 0;
+  const start = text === "." ? "" : text.startsWith("./") ? text.slice(2) : void 0;
+  const rest = home ?? start;
+  if (rest === void 0) return { kind: "plain" };
+  const dir = home !== void 0 ? anchors.home : anchors.start;
+  if (dir === void 0) return { kind: "unknown", message: `${text}: this host has no ${home !== void 0 ? "home" : "start"} directory` };
+  return { kind: "anchored", path: rest === "" ? dir : `${dir.replace(/\/+$/, "")}/${rest}` };
+}
+function anchoredForms(anchors, path) {
+  const forms = [path];
+  const under = (dir, prefix) => {
+    if (dir === void 0) return;
+    const root = dir.replace(/\/+$/, "");
+    if (path === root) forms.push(prefix);
+    else if (path.startsWith(`${root}/`)) forms.push(`${prefix}${path.slice(root.length + 1)}`);
+  };
+  under(anchors.home, "~/");
+  under(anchors.start, "./");
+  return forms;
+}
+function anchoredGrants(grants, anchors) {
+  return {
+    ...grants,
+    allows: (need, orbital) => need.need === "fs" ? anchoredForms(anchors, need.path).some((path) => grants.allows({ ...need, path }, orbital)) : grants.allows(need, orbital)
+  };
+}
+
+export { anchoredGrants, expandAnchor, kernelOsCompletions, kernelOsGrants, kernelOsTls };

package/dist/chunk-BY5G4225.js

@@ -0,0 +1,6 @@
+// src/runtime/events/identity/routing.ts
+function eventRouteKey(eventName, eventId) {
+  return eventId ? `@evt:${eventId}` : eventName;
+}
+
+export { eventRouteKey };

package/dist/chunk-DFDNHVDW.js

@@ -0,0 +1,284 @@
+import { isJsonObject, credentialStorageKey, EntityRowSchema } from '@almadar/core';
+
+// src/credentials/vault.ts
+var CredentialExchangeError = class extends Error {
+  constructor(kind, message) {
+    super(message);
+    this.kind = kind;
+    this.name = "CredentialExchangeError";
+  }
+  kind;
+};
+var FAILURE_KINDS = ["unavailable", "unsigned", "denied", "invalid_grant", "invalid_client", "transport", "malformed", "refused"];
+function failureOf(value) {
+  if (value === void 0 || !isJsonObject(value)) throw new Error("the kernel connect failure is not an object");
+  const kind = FAILURE_KINDS.find((known) => known === value.kind);
+  if (kind === void 0) throw new Error("the kernel connect failure has an unknown kind");
+  return { kind, message: textOf(value.message, "failure message") };
+}
+function standingOf(value) {
+  if (value === void 0 || !isJsonObject(value) || typeof value.connected !== "boolean") throw new Error("the kernel credential standing is malformed");
+  return { connected: value.connected, ...typeof value.label === "string" ? { label: value.label } : {} };
+}
+function requestOf(value) {
+  if (value === void 0 || !isJsonObject(value) || !Array.isArray(value.headers)) throw new Error("the kernel token request is malformed");
+  const headers = value.headers.map((pair) => {
+    if (!Array.isArray(pair) || pair.length !== 2) throw new Error("the kernel token request header is malformed");
+    return [textOf(pair[0], "header name"), textOf(pair[1], "header value")];
+  });
+  return { request: { endpoint: textOf(value.endpoint, "token endpoint"), headers, body: textOf(value.body, "token body") }, ticket: numberOf(value.ticket, "exchange ticket") };
+}
+function parsed(json) {
+  return JSON.parse(json);
+}
+function objectOf(json, what) {
+  const value = parsed(json);
+  if (!isJsonObject(value)) throw new Error(`the kernel ${what} is not an object`);
+  return value;
+}
+function textOf(value, what) {
+  if (typeof value !== "string") throw new Error(`the kernel ${what} is not text`);
+  return value;
+}
+function numberOf(value, what) {
+  if (typeof value !== "number") throw new Error(`the kernel ${what} is not a number`);
+  return value;
+}
+function entryOf(value) {
+  if (!isJsonObject(value)) throw new Error("the kernel credential entry is not an object");
+  return {
+    service: textOf(value.service, "entry service"),
+    envVar: textOf(value.envVar, "entry name"),
+    last4: textOf(value.last4, "entry last4"),
+    updatedAt: numberOf(value.updatedAt, "entry updatedAt"),
+    ...value.principal !== void 0 ? { principal: textOf(value.principal, "entry principal") } : {}
+  };
+}
+function writeOf(item) {
+  if (!isJsonObject(item)) throw new Error("the kernel credential write is not an object");
+  const id = textOf(item.id, "write id");
+  if (item.write === "delete") return { write: "delete", id };
+  const data = EntityRowSchema.parse(item.data);
+  if (item.write === "update") return { write: "update", id, data };
+  if (item.write === "create") return { write: "create", id, data: { ...data, id } };
+  throw new Error("the kernel credential write is neither create, update nor delete");
+}
+var CredentialVault = class _CredentialVault {
+  constructor(kernel, rows) {
+    this.kernel = kernel;
+    this.rows = rows;
+  }
+  kernel;
+  rows;
+  listeners = /* @__PURE__ */ new Set();
+  queue = Promise.resolve();
+  broken = false;
+  /** List the host's rows into the kernel and read them; rejects naming the rows it cannot read. */
+  static async open(kernel, rows) {
+    const vault = new _CredentialVault(kernel, rows);
+    await vault.reload();
+    return vault;
+  }
+  /** True when a valid master key is present (writes and decryption enabled). */
+  get enabled() {
+    return this.kernel.enabled;
+  }
+  /** Subscribe to credential changes; returns an unsubscribe function. */
+  subscribe(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  notify(principal) {
+    for (const listener of this.listeners) listener(principal);
+  }
+  async reload() {
+    try {
+      this.kernel.load(JSON.stringify(await this.rows.list()));
+      this.broken = false;
+    } catch (error) {
+      this.broken = true;
+      throw error;
+    }
+  }
+  current() {
+    if (this.broken) throw new Error("the credential store could not be read or written; reload it");
+    return this.kernel;
+  }
+  async apply() {
+    const writes = parsed(this.kernel.takeWrites());
+    if (!Array.isArray(writes)) throw new Error("the kernel credential writes are not a list");
+    try {
+      for (const item of writes) {
+        const write = writeOf(item);
+        if (write.write === "create") await this.rows.create(write.data);
+        else if (write.write === "update") await this.rows.update(write.id, write.data);
+        else await this.rows.delete(write.id);
+      }
+    } catch (error) {
+      this.broken = true;
+      throw error;
+    }
+  }
+  /** One operation at a time: the kernel runs it, then its writes reach the medium before the next begins. */
+  serial(run) {
+    const next = this.queue.then(run);
+    this.queue = next.then(
+      () => void 0,
+      () => void 0
+    );
+    return next;
+  }
+  exclusive(fresh, work, principal) {
+    return this.serial(async () => {
+      if (fresh || this.broken) await this.reload();
+      let result;
+      try {
+        result = work();
+      } catch (error) {
+        if (this.kernel.takeWrites() !== "[]") this.broken = true;
+        throw error;
+      }
+      await this.apply();
+      this.notify(principal);
+      return result;
+    });
+  }
+  /** Resolve one credential by name (warmed values only). */
+  resolve(envVar, principal) {
+    return this.current().resolve(envVar, principal);
+  }
+  /** The non-secret account label stored in the clear beside a credential's ciphertext; undefined when its row carries none. */
+  label(envVar, principal) {
+    return this.current().label(envVar, principal);
+  }
+  /** All app-wide values as an env-shaped map, for merging over the process env. */
+  snapshotEnv() {
+    const env = {};
+    for (const [name, value] of Object.entries(objectOf(this.current().snapshotEnv(), "environment"))) env[name] = textOf(value, "environment value");
+    return env;
+  }
+  /** Masked entries for display — never includes plaintext. */
+  entries(principal) {
+    const entries = parsed(this.current().entries(principal));
+    if (!Array.isArray(entries)) throw new Error("the kernel credential entries are not a list");
+    return entries.map(entryOf);
+  }
+  /** Whether the store can encrypt and the service and name of every app-wide row. */
+  listing() {
+    const listing = objectOf(this.current().listing(), "listing");
+    const entries = listing.entries;
+    if (!Array.isArray(entries) || typeof listing.enabled !== "boolean") throw new Error("the kernel credential listing is malformed");
+    return {
+      enabled: listing.enabled,
+      entries: entries.map((entry) => {
+        if (!isJsonObject(entry)) throw new Error("the kernel credential listing holds a row that is not an object");
+        const row = { service: textOf(entry.service, "listing service"), name: textOf(entry.name, "listing name") };
+        return entry.last4 === void 0 ? row : { ...row, last4: textOf(entry.last4, "listing last4") };
+      })
+    };
+  }
+  /** Upsert one credential; `label` is a non-secret account name kept in the clear beside it, left out it stays as it is. */
+  async set(service, envVar, value, principal, label) {
+    return entryOf(parsed(await this.exclusive(false, () => this.kernel.set(service, envVar, value, principal, label), principal)));
+  }
+  /** Replace the value of a credential already stored, keeping its service (a rotated refresh token). */
+  async replace(envVar, value, principal) {
+    return entryOf(parsed(await this.exclusive(false, () => this.kernel.replace(envVar, value, principal), principal)));
+  }
+  /** Keep `value` as the credential until it is forgotten, creating it when absent. */
+  async persist(envVar, value, principal, label) {
+    return entryOf(parsed(await this.exclusive(false, () => this.kernel.persist(envVar, value, principal, label), principal)));
+  }
+  /** Delete one credential row; whether one existed. */
+  remove(envVar, principal) {
+    return this.exclusive(false, () => this.kernel.remove(envVar, principal), principal);
+  }
+  flights = /* @__PURE__ */ new Map();
+  turns = /* @__PURE__ */ new Map();
+  async post(post, begun) {
+    try {
+      return await post(begun.request);
+    } catch (error) {
+      this.kernel.connectAbandon(begun.ticket);
+      throw new CredentialExchangeError("transport", error instanceof Error ? error.message : "the token endpoint could not be reached");
+    }
+  }
+  async finish(ticket, reply) {
+    const settled = objectOf(await this.exclusive(false, () => this.kernel.connectFinish(ticket, reply.status, reply.body)), "connect outcome");
+    if (settled.error !== void 0) {
+      const failure = failureOf(settled.error);
+      throw new CredentialExchangeError(failure.kind, failure.message);
+    }
+    return standingOf(settled.ok);
+  }
+  /** Exchange `grant` at its token endpoint through `post` and keep the result as the credential: the kernel builds the request and settles the reply, the host only sends. */
+  async connect(grant, post) {
+    try {
+      const run = async () => {
+        const begun = objectOf(this.current().connectBegin(JSON.stringify(grant)), "connect request");
+        if (begun.error !== void 0) {
+          const failure = failureOf(begun.error);
+          throw new CredentialExchangeError(failure.kind, failure.message);
+        }
+        const request = requestOf(begun.ok);
+        return this.finish(request.ticket, await this.post(post, request));
+      };
+      if (grant.grant !== "refresh_token") return { ok: await run() };
+      const key = credentialStorageKey({ name: grant.name, ...grant.principal !== void 0 ? { principal: grant.principal } : {} });
+      const previous = this.turns.get(key);
+      const mine = (async () => {
+        await previous?.catch(() => void 0);
+        return run();
+      })();
+      this.turns.set(key, mine);
+      try {
+        return { ok: await mine };
+      } finally {
+        if (this.turns.get(key) === mine) this.turns.delete(key);
+      }
+    } catch (error) {
+      if (error instanceof CredentialExchangeError) return { error: { kind: error.kind, message: error.message } };
+      throw error;
+    }
+  }
+  /** The credential `envVar` for `principal`, refreshed first through `post` when it is past its expiry; concurrent resolves share one refresh. Undefined when nothing is held, nothing can renew it, or the provider refused (which drops the row). */
+  async resolveFresh(envVar, principal, post) {
+    const begun = objectOf(this.current().refreshBegin(envVar, principal), "refresh outcome");
+    if (begun.error !== void 0) {
+      const failure = failureOf(begun.error);
+      throw new CredentialExchangeError(failure.kind, failure.message);
+    }
+    const ok = begun.ok;
+    if (!isJsonObject(ok)) throw new Error("the kernel refresh outcome is malformed");
+    if (ok.exchange === void 0) return typeof ok.resolved === "string" ? ok.resolved : void 0;
+    const key = credentialStorageKey({ name: envVar, ...principal !== void 0 ? { principal } : {} });
+    const running = this.flights.get(key);
+    if (running !== void 0) {
+      this.current().connectAbandon(requestOf(ok.exchange).ticket);
+      return running;
+    }
+    const request = requestOf(ok.exchange);
+    const flight = (async () => {
+      try {
+        await this.finish(request.ticket, await this.post(post, request));
+      } catch (error) {
+        if (error instanceof CredentialExchangeError && error.kind === "invalid_grant") return void 0;
+        throw error;
+      }
+      return this.resolve(envVar, principal);
+    })();
+    this.flights.set(key, flight);
+    try {
+      return await flight;
+    } finally {
+      this.flights.delete(key);
+    }
+  }
+  /** Re-encrypt every row under the current master key; a row the kernel cannot read fails it before any row changes. */
+  async rotate() {
+    const counts = objectOf(await this.exclusive(true, () => this.kernel.rotate()), "rotation");
+    return { rotated: numberOf(counts.rotated, "rotated"), alreadyCurrent: numberOf(counts.alreadyCurrent, "alreadyCurrent"), unreadable: numberOf(counts.unreadable, "unreadable") };
+  }
+};
+
+export { CredentialExchangeError, CredentialVault };

package/dist/chunk-ELBLT2HZ.js

@@ -0,0 +1 @@
+

package/dist/chunk-EZZYLTWY.js

@@ -0,0 +1 @@
+

package/dist/chunk-FWA5K7Q2.js

@@ -0,0 +1,48 @@
+// src/effects/on-device-model.ts
+var NO_ON_DEVICE_MODEL = "browser/prompt: no on-device model is wired into this host";
+var NO_ON_DEVICE_EMBEDDER = "browser/embed: no on-device embedder is wired into this host";
+var OnDeviceModelFailure = class extends Error {
+  kind;
+  payload;
+  constructor(kind, message, key) {
+    super(message);
+    this.name = "OnDeviceModelFailure";
+    this.kind = kind;
+    this.payload = { error: message, kind, key };
+  }
+};
+function failureMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function promptOnDevice(ports, text, schemaText, key, signal) {
+  const model = ports?.model;
+  if (model === void 0) throw new OnDeviceModelFailure("unconfigured", NO_ON_DEVICE_MODEL, key);
+  let schema;
+  try {
+    const parsed = JSON.parse(schemaText);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("not an object");
+    schema = parsed;
+  } catch {
+    throw new OnDeviceModelFailure("failed", "browser/prompt: the response schema must be JSON Schema text: a JSON object", key);
+  }
+  try {
+    const state = await model.availability();
+    if (state !== "available") throw new OnDeviceModelFailure("unavailable", `The on-device model is ${state}`, key);
+    return await model.prompt(text, schema, signal);
+  } catch (error) {
+    if (error instanceof OnDeviceModelFailure) throw error;
+    throw new OnDeviceModelFailure("failed", failureMessage(error), key);
+  }
+}
+async function embedOnDevice(ports, texts, key, signal) {
+  if (texts.length === 0) return [];
+  const embedder = ports?.embedder;
+  if (embedder === void 0) throw new OnDeviceModelFailure("unconfigured", NO_ON_DEVICE_EMBEDDER, key);
+  try {
+    return await embedder.embed([...texts], signal);
+  } catch (error) {
+    throw new OnDeviceModelFailure("failed", failureMessage(error), key);
+  }
+}
+
+export { NO_ON_DEVICE_EMBEDDER, NO_ON_DEVICE_MODEL, OnDeviceModelFailure, embedOnDevice, promptOnDevice };

package/dist/chunk-HC6ERSAH.js

@@ -0,0 +1,55 @@
+// src/client/awaiting.ts
+var AwaitingRegistry = class {
+  entries = /* @__PURE__ */ new Map();
+  listeners = /* @__PURE__ */ new Map();
+  anyListeners = /* @__PURE__ */ new Set();
+  version = 0;
+  begin(list) {
+    for (const entry of list) {
+      this.entries.set(entry.trait, entry);
+      this.emit(entry.trait);
+    }
+  }
+  end(traits) {
+    for (const trait of traits) {
+      if (!this.entries.delete(trait)) continue;
+      this.emit(trait);
+    }
+  }
+  get(trait) {
+    return this.entries.get(trait);
+  }
+  list() {
+    return [...this.entries.values()];
+  }
+  subscribe(trait, listener) {
+    let set = this.listeners.get(trait);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      this.listeners.set(trait, set);
+    }
+    set.add(listener);
+    return () => {
+      set?.delete(listener);
+      if (set && set.size === 0) this.listeners.delete(trait);
+    };
+  }
+  /** Any trait's awaiting change (an empty slot does not know which trait will fill it). */
+  subscribeAll(listener) {
+    this.anyListeners.add(listener);
+    return () => {
+      this.anyListeners.delete(listener);
+    };
+  }
+  /** Bumped on every change — a stable snapshot key for `useSyncExternalStore`. */
+  getVersion() {
+    return this.version;
+  }
+  emit(trait) {
+    this.version += 1;
+    this.listeners.get(trait)?.forEach((listener) => listener());
+    this.anyListeners.forEach((listener) => listener());
+  }
+};
+
+export { AwaitingRegistry };

package/dist/chunk-HLOUDLPI.js

@@ -0,0 +1,48 @@
+// src/credentials/scope.ts
+function credentialModeFromEnv(env) {
+  return env.ALMADAR_INTEGRATIONS_MODE === "mock" || env.USE_MOCK_DATA === "true" ? "mock" : "real";
+}
+var installedStore = null;
+var modeControl = null;
+var tenantScope;
+function installCredentialScopeStorage(storage) {
+  tenantScope = storage;
+}
+function runWithCredentialScope(store, fn) {
+  if (tenantScope === void 0) throw new Error("runWithCredentialScope needs an installed CredentialScopeStorage (a Node host installs it through @almadar/shell-node)");
+  return tenantScope.run(store, fn);
+}
+function installModeControl(control) {
+  modeControl = control;
+}
+function getModeControl() {
+  return modeControl;
+}
+function installCredentialStore(store) {
+  installedStore = store;
+}
+function getInstalledCredentialStore() {
+  return installedStore;
+}
+function getEffectiveCredentialStore() {
+  return tenantScope?.getStore() ?? installedStore;
+}
+function uninstallCredentialStore() {
+  installedStore = null;
+}
+var CREDENTIALS_SOURCE_ENV = "ALMADAR_CREDENTIALS_SOURCE";
+var HOST_SETTING_VARS = /* @__PURE__ */ new Set(["ALMADAR_CREDENTIAL_ADMIN_ROLES", CREDENTIALS_SOURCE_ENV, "ALMADAR_INTEGRATIONS_MODE", "USE_MOCK_DATA"]);
+function credentialsFromStoreOnly(env) {
+  return env[CREDENTIALS_SOURCE_ENV] === "store";
+}
+function resolveCredentialRef(ref, env = typeof process === "undefined" ? {} : process.env, principal) {
+  const tenant = tenantScope?.getStore();
+  if (tenant) return tenant.resolve(ref, principal);
+  if (principal !== void 0) return installedStore?.resolve(ref, principal);
+  const stored = installedStore?.resolve(ref);
+  if (stored !== void 0) return stored;
+  if (credentialsFromStoreOnly(env) && !HOST_SETTING_VARS.has(ref)) return void 0;
+  return env[ref];
+}
+
+export { CREDENTIALS_SOURCE_ENV, credentialModeFromEnv, credentialsFromStoreOnly, getEffectiveCredentialStore, getInstalledCredentialStore, getModeControl, installCredentialScopeStorage, installCredentialStore, installModeControl, resolveCredentialRef, runWithCredentialScope, uninstallCredentialStore };