@better-forge/vault 0.0.0-stage → 0.1.1

package/dist/vaultRoutes.js

@@ -0,0 +1,408 @@
+import { and, eq } from 'drizzle-orm';
+import { vaults, vaultSecrets } from './tables.js';
+import { HashicorpVaultError, encodePath, parseConnection, publicConnection } from './hashicorp.js';
+const VALID_SECRET_TYPES = ['userpass', 'value', 'json'];
+const DUPLICATE_SECRET_ERROR = 'A secret with this name already exists in the vault';
+/** Drizzle wraps driver errors ("Failed query: …"); the SQLite constraint text lives on `cause`. */
+function isUniqueViolation(error) {
+    for (let current = error; current instanceof Error; current = current.cause) {
+        if (current.message.includes('UNIQUE constraint failed'))
+            return true;
+    }
+    return false;
+}
+export function createVaultRoutes(ctx, parts) {
+    const { db, audit } = ctx;
+    const { encrypt, decrypt } = ctx.secretBox;
+    const requestIdentity = ctx.identity;
+    const { loadSecretPayload } = parts.resolver;
+    const { forgetHashicorpVault, openConnection, readKvSecret, sealConnection, testConnection, testDraftConnection, verifyCredentialsRef, forgetCredentialDependents } = parts.hashicorp;
+    function serializePayload(type, payload) {
+        if (type === 'userpass') {
+            if (!payload.userpass)
+                throw new Error('userpass requires username and password');
+            return JSON.stringify(payload.userpass);
+        }
+        if (type === 'value') {
+            if (payload.value === undefined)
+                throw new Error('value is required');
+            return JSON.stringify({ value: payload.value });
+        }
+        if (type === 'json') {
+            if (payload.json === undefined)
+                throw new Error('json is required');
+            // Validate it's actually JSON
+            JSON.parse(payload.json);
+            return JSON.stringify({ value: payload.json });
+        }
+        throw new Error('Unknown type');
+    }
+    /** Validates a HashiCorp secret reference from the request body. */
+    function parseReference(type, body) {
+        if (typeof body.path !== 'string' || !body.path.trim())
+            throw new HashicorpVaultError('Path is required');
+        const path = body.path.trim().replace(/^\/+|\/+$/g, '');
+        encodePath(path, 'Path');
+        if (type !== 'value')
+            return { path };
+        if (typeof body.key !== 'string' || !body.key.trim())
+            throw new HashicorpVaultError('Key is required for a Secure Value');
+        return { path, key: body.key.trim() };
+    }
+    /** Fails when Vault cannot serve the reference, so typos surface while the admin is still in the form. */
+    async function verifyReference(vault, type, ref) {
+        const kv = await readKvSecret(vault, ref.path);
+        if (type === 'userpass' && (typeof kv['username'] !== 'string' || typeof kv['password'] !== 'string')) {
+            throw new HashicorpVaultError('keys "username" and "password" are required at the path');
+        }
+        if (type === 'value' && (kv[ref.key] === undefined || kv[ref.key] === null)) {
+            throw new HashicorpVaultError(`key "${ref.key}" not found`);
+        }
+    }
+    /** Vault columns safe to return: never the encrypted connection. */
+    function publicVault(row) {
+        const { connectionConfig: _cc, ...safe } = row;
+        return safe;
+    }
+    /** Audit view of a HashiCorp connection; credentials are never included. */
+    function connectionAudit(row) {
+        if (row.type !== 'hashicorp')
+            return { name: row.name, type: row.type };
+        let c;
+        try {
+            c = publicConnection(openConnection(row.connectionConfig));
+        }
+        catch {
+            return { name: row.name, type: row.type }; // connection undecryptable (key changed): still allow repair and delete
+        }
+        return { name: row.name, type: row.type, address: c.address, namespace: c.namespace, mount: c.mount, authMethod: c.authMethod, approleMount: c.approleMount, credentialsRef: c.credentialsRef };
+    }
+    function safeDecrypt(encryptedValue) {
+        try {
+            return JSON.parse(decrypt(encryptedValue));
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Read-only vault catalogue: vault and secret names/types, never values. Whoever may configure things that use secrets gets it too so
+     * they can pick a secret; creating, editing and revealing secrets stays
+     * in {@link vaultRoutes} (admin only).
+     */
+    async function vaultCatalogRoutes(app) {
+        app.get('/', async () => {
+            const rows = await db.select().from(vaults);
+            return rows.map(publicVault);
+        });
+        app.get('/:id/secrets', async (req, reply) => {
+            const vaultId = Number(req.params.id);
+            const vault = (await db.select().from(vaults).where(eq(vaults.id, vaultId)))[0];
+            if (!vault)
+                return reply.code(404).send({ error: 'Vault not found' });
+            const secrets = await db
+                .select({ id: vaultSecrets.id, vaultId: vaultSecrets.vaultId, name: vaultSecrets.name, type: vaultSecrets.type, createdAt: vaultSecrets.createdAt, updatedAt: vaultSecrets.updatedAt })
+                .from(vaultSecrets)
+                .where(eq(vaultSecrets.vaultId, vaultId));
+            return secrets;
+        });
+    }
+    async function vaultRoutes(app) {
+        // ── Vaults ──────────────────────────────────────────────────────────────────
+        app.post('/', async (req, reply) => {
+            if (!req.body.name?.trim())
+                return reply.code(400).send({ error: 'Name is required' });
+            const type = req.body.type ?? 'local';
+            if (type !== 'local' && type !== 'hashicorp')
+                return reply.code(400).send({ error: 'Type must be local or hashicorp' });
+            let connectionConfig = null;
+            if (type === 'hashicorp') {
+                try {
+                    const cfg = parseConnection(req.body.connection);
+                    await verifyCredentialsRef(cfg);
+                    connectionConfig = sealConnection(cfg);
+                }
+                catch (e) {
+                    if (e instanceof HashicorpVaultError)
+                        return reply.code(400).send({ error: e.message });
+                    throw e;
+                }
+            }
+            const now = Date.now();
+            const [row] = await db.insert(vaults).values({
+                name: req.body.name.trim(),
+                type,
+                description: req.body.description?.trim() ?? null,
+                connectionConfig,
+                createdAt: now,
+                updatedAt: now,
+            }).returning();
+            const actor = requestIdentity(req);
+            audit.write(audit.actor(actor), 'create', 'vault', row.id, row.name, audit.snapshot(connectionAudit(row)));
+            return publicVault(row);
+        });
+        app.get('/:id', async (req, reply) => {
+            const vault = (await db.select().from(vaults).where(eq(vaults.id, Number(req.params.id))))[0];
+            if (!vault)
+                return reply.code(404).send({ error: 'Vault not found' });
+            if (vault.type !== 'hashicorp')
+                return publicVault(vault);
+            try {
+                return { ...publicVault(vault), connection: publicConnection(openConnection(vault.connectionConfig)) };
+            }
+            catch (e) {
+                if (e instanceof HashicorpVaultError)
+                    return reply.code(500).send({ error: e.message });
+                throw e;
+            }
+        });
+        // Tests settings from the form before they are saved. With vaultId, blank credentials fall back to the saved ones
+        // (parseConnection refuses that fallback when the connection target changed, so a saved secret never reaches a new server).
+        app.post('/test-connection', async (req, reply) => {
+            let cfg;
+            try {
+                let existing;
+                if (req.body.vaultId !== undefined) {
+                    const vault = (await db.select().from(vaults).where(eq(vaults.id, Number(req.body.vaultId))))[0];
+                    if (!vault)
+                        return reply.code(404).send({ error: 'Vault not found' });
+                    if (vault.type !== 'hashicorp')
+                        return reply.code(400).send({ error: 'Only HashiCorp vaults have a connection to test' });
+                    try {
+                        existing = openConnection(vault.connectionConfig);
+                    }
+                    catch { /* undecryptable: full credentials required */ }
+                }
+                cfg = parseConnection(req.body.connection, existing);
+                await verifyCredentialsRef(cfg);
+            }
+            catch (e) {
+                if (e instanceof HashicorpVaultError)
+                    return reply.code(400).send({ error: e.message });
+                throw e;
+            }
+            try {
+                return { ok: true, ...(await testDraftConnection(cfg)) };
+            }
+            catch (e) {
+                if (e instanceof HashicorpVaultError)
+                    return reply.code(502).send({ error: e.message });
+                throw e;
+            }
+        });
+        app.post('/:id/test', async (req, reply) => {
+            const vault = (await db.select().from(vaults).where(eq(vaults.id, Number(req.params.id))))[0];
+            if (!vault)
+                return reply.code(404).send({ error: 'Vault not found' });
+            if (vault.type !== 'hashicorp')
+                return reply.code(400).send({ error: 'Only HashiCorp vaults have a connection to test' });
+            try {
+                return { ok: true, ...(await testConnection(vault)) };
+            }
+            catch (e) {
+                if (e instanceof HashicorpVaultError)
+                    return reply.code(502).send({ error: e.message });
+                throw e;
+            }
+        });
+        app.patch('/:id', async (req, reply) => {
+            const id = Number(req.params.id);
+            const existing = (await db.select().from(vaults).where(eq(vaults.id, id)))[0];
+            if (!existing)
+                return reply.code(404).send({ error: 'Vault not found' });
+            const updates = { updatedAt: Date.now() };
+            if (req.body.name !== undefined)
+                updates['name'] = req.body.name.trim();
+            if (req.body.description !== undefined)
+                updates['description'] = req.body.description.trim() || null;
+            let credentialsChanged = false;
+            if (req.body.connection !== undefined) {
+                if (existing.type !== 'hashicorp')
+                    return reply.code(400).send({ error: 'Only HashiCorp vaults have connection settings' });
+                try {
+                    let old;
+                    try {
+                        old = openConnection(existing.connectionConfig);
+                    }
+                    catch { /* undecryptable: full credentials required */ }
+                    const next = parseConnection(req.body.connection, old);
+                    await verifyCredentialsRef(next);
+                    credentialsChanged = old?.token !== next.token || old?.roleId !== next.roleId || old?.secretId !== next.secretId;
+                    updates['connectionConfig'] = sealConnection(next);
+                }
+                catch (e) {
+                    if (e instanceof HashicorpVaultError)
+                        return reply.code(400).send({ error: e.message });
+                    throw e;
+                }
+            }
+            const [row] = await db.update(vaults).set(updates).where(eq(vaults.id, id)).returning();
+            forgetHashicorpVault(id);
+            const actor = requestIdentity(req);
+            const before = { ...connectionAudit(existing), description: existing.description };
+            const after = { ...connectionAudit(row), description: row.description };
+            const diff = audit.diffObjects(before, after);
+            if (credentialsChanged)
+                diff['credentials'] = { from: '[redacted]', to: '[redacted]' };
+            if (Object.keys(diff).length)
+                audit.write(audit.actor(actor), 'update', 'vault', id, existing.name, diff);
+            return publicVault(row);
+        });
+        app.delete('/:id', async (req, reply) => {
+            const id = Number(req.params.id);
+            const existing = (await db.select().from(vaults).where(eq(vaults.id, id)))[0];
+            if (!existing)
+                return reply.code(404).send({ error: 'Vault not found' });
+            await db.delete(vaults).where(eq(vaults.id, id));
+            forgetHashicorpVault(id);
+            forgetCredentialDependents(id);
+            const actor = requestIdentity(req);
+            audit.write(audit.actor(actor), 'delete', 'vault', id, existing.name, audit.snapshot(connectionAudit(existing)));
+            return reply.code(204).send();
+        });
+        // ── Secrets ─────────────────────────────────────────────────────────────────
+        app.post('/:id/secrets', async (req, reply) => {
+            const vaultId = Number(req.params.id);
+            const vault = (await db.select().from(vaults).where(eq(vaults.id, vaultId)))[0];
+            if (!vault)
+                return reply.code(404).send({ error: 'Vault not found' });
+            if (!req.body.name?.trim())
+                return reply.code(400).send({ error: 'Name is required' });
+            if (!VALID_SECRET_TYPES.includes(req.body.type)) {
+                return reply.code(400).send({ error: `Type must be one of: ${VALID_SECRET_TYPES.join(', ')}` });
+            }
+            const type = req.body.type;
+            let plaintext;
+            let reference;
+            try {
+                if (vault.type === 'hashicorp') {
+                    reference = parseReference(type, req.body);
+                    await verifyReference(vault, type, reference);
+                    plaintext = JSON.stringify(reference);
+                }
+                else {
+                    plaintext = serializePayload(type, req.body);
+                }
+            }
+            catch (e) {
+                return reply.code(400).send({ error: e.message });
+            }
+            const now = Date.now();
+            try {
+                const [row] = await db.insert(vaultSecrets).values({
+                    vaultId,
+                    name: req.body.name.trim(),
+                    type,
+                    encryptedValue: encrypt(plaintext),
+                    createdAt: now,
+                    updatedAt: now,
+                }).returning();
+                const actor = requestIdentity(req);
+                audit.write(audit.actor(actor), 'create', 'vault_secret', row.id, `${vault.name} / ${row.name}`, audit.snapshot({ name: row.name, type: row.type, vault: vault.name, ...(reference && { path: reference.path, key: reference.key }) }));
+                // Return without encrypted value
+                const { encryptedValue: _ev, ...safe } = row;
+                return safe;
+            }
+            catch (e) {
+                if (isUniqueViolation(e))
+                    return reply.code(409).send({ error: DUPLICATE_SECRET_ERROR });
+                throw e;
+            }
+        });
+        app.patch('/:id/secrets/:secretId', async (req, reply) => {
+            const vaultId = Number(req.params.id);
+            const secretId = Number(req.params.secretId);
+            const secret = (await db.select().from(vaultSecrets).where(and(eq(vaultSecrets.id, secretId), eq(vaultSecrets.vaultId, vaultId))))[0];
+            if (!secret)
+                return reply.code(404).send({ error: 'Secret not found' });
+            const updates = { updatedAt: Date.now() };
+            if (req.body.name !== undefined)
+                updates['name'] = req.body.name.trim();
+            // Re-encrypt if any secret field provided
+            const vaultForSecret = (await db.select().from(vaults).where(eq(vaults.id, vaultId)))[0];
+            const isReference = vaultForSecret.type === 'hashicorp';
+            const hasNewValue = isReference
+                ? req.body.path !== undefined || req.body.key !== undefined
+                : req.body.userpass !== undefined || req.body.value !== undefined || req.body.json !== undefined;
+            if (hasNewValue) {
+                try {
+                    if (isReference) {
+                        const old = JSON.parse(decrypt(secret.encryptedValue));
+                        const ref = parseReference(secret.type, { path: req.body.path ?? old.path, key: req.body.key ?? old.key });
+                        await verifyReference(vaultForSecret, secret.type, ref);
+                        updates['encryptedValue'] = encrypt(JSON.stringify(ref));
+                    }
+                    else {
+                        updates['encryptedValue'] = encrypt(serializePayload(secret.type, req.body));
+                    }
+                }
+                catch (e) {
+                    return reply.code(400).send({ error: e.message });
+                }
+            }
+            try {
+                const [row] = await db.update(vaultSecrets).set(updates).where(eq(vaultSecrets.id, secretId)).returning();
+                forgetCredentialDependents(vaultId, secretId);
+                const actor = requestIdentity(req);
+                const vaultRow = (await db.select().from(vaults).where(eq(vaults.id, vaultId)))[0];
+                const diff = {};
+                if (req.body.name !== undefined && req.body.name !== secret.name)
+                    diff['name'] = { from: secret.name, to: req.body.name };
+                if (hasNewValue)
+                    diff[isReference ? 'reference' : 'value'] = { from: '[redacted]', to: '[redacted]' };
+                if (Object.keys(diff).length)
+                    audit.write(audit.actor(actor), 'update', 'vault_secret', secretId, `${vaultRow?.name ?? vaultId} / ${secret.name}`, diff);
+                const { encryptedValue: _ev, ...safe } = row;
+                return safe;
+            }
+            catch (e) {
+                if (isUniqueViolation(e))
+                    return reply.code(409).send({ error: DUPLICATE_SECRET_ERROR });
+                throw e;
+            }
+        });
+        app.delete('/:id/secrets/:secretId', async (req, reply) => {
+            const vaultId = Number(req.params.id);
+            const secretId = Number(req.params.secretId);
+            const secret = (await db.select().from(vaultSecrets).where(and(eq(vaultSecrets.id, secretId), eq(vaultSecrets.vaultId, vaultId))))[0];
+            if (!secret)
+                return reply.code(404).send({ error: 'Secret not found' });
+            await db.delete(vaultSecrets).where(eq(vaultSecrets.id, secretId));
+            forgetCredentialDependents(vaultId, secretId);
+            const actor = requestIdentity(req);
+            const vaultRow = (await db.select().from(vaults).where(eq(vaults.id, vaultId)))[0];
+            audit.write(audit.actor(actor), 'delete', 'vault_secret', secretId, `${vaultRow?.name ?? vaultId} / ${secret.name}`, audit.snapshot({ name: secret.name, type: secret.type }));
+            return reply.code(204).send();
+        });
+        app.get('/:id/secrets/:secretId/reveal', async (req, reply) => {
+            const vaultId = Number(req.params.id);
+            const secretId = Number(req.params.secretId);
+            const secret = (await db.select().from(vaultSecrets).where(and(eq(vaultSecrets.id, secretId), eq(vaultSecrets.vaultId, vaultId))))[0];
+            if (!secret)
+                return reply.code(404).send({ error: 'Secret not found' });
+            const vault = (await db.select().from(vaults).where(eq(vaults.id, vaultId)))[0];
+            // The value itself never goes into the log, only the fact that it was shown and to whom.
+            const recordReveal = () => audit.write(audit.actor(requestIdentity(req)), 'allow', 'vault_secret', secretId, `${vault.name} / ${secret.name}`, { access: 'revealed' });
+            if (vault.type === 'hashicorp') {
+                const ref = safeDecrypt(secret.encryptedValue);
+                if (!ref)
+                    return reply.code(500).send({ error: 'Failed to decrypt secret' });
+                try {
+                    const value = await loadSecretPayload(secret, vault);
+                    await recordReveal();
+                    return { id: secret.id, name: secret.name, type: secret.type, value, source: ref };
+                }
+                catch (e) {
+                    return reply.code(502).send({ error: e.message });
+                }
+            }
+            const value = safeDecrypt(secret.encryptedValue);
+            if (value === null)
+                return reply.code(500).send({ error: 'Failed to decrypt secret' });
+            await recordReveal();
+            return { id: secret.id, name: secret.name, type: secret.type, value };
+        });
+    }
+    return { vaultCatalogRoutes, vaultRoutes };
+}
+//# sourceMappingURL=vaultRoutes.js.map

package/dist/vaultRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vaultRoutes.js","sourceRoot":"","sources":["../src/vaultRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAGrC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAKnG,MAAM,kBAAkB,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAU,CAAA;AAUjE,MAAM,sBAAsB,GAAG,qDAAqD,CAAA;AAEpF,oGAAoG;AACpG,SAAS,iBAAiB,CAAC,KAAc;IACvC,KAAK,IAAI,OAAO,GAAG,KAAK,EAAE,OAAO,YAAY,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC5E,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC;YAAE,OAAO,IAAI,CAAA;IACvE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAID,MAAM,UAAU,iBAAiB,CAAC,GAMjC,EAAE,KAAyD;IAC1D,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,GAAG,CAAA;IACzB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,SAAS,CAAA;IAC1C,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAAA;IACpC,MAAM,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAA;IAC5C,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,GAAG,KAAK,CAAC,SAAS,CAAA;IAErL,SAAS,gBAAgB,CAAC,IAAgB,EAAE,OAAsB;QAChE,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;YACjF,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QACzC,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;YACrE,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QACjD,CAAC;QACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACnE,8BAA8B;YAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACxB,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;QAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;IACjC,CAAC;IAED,oEAAoE;IACpE,SAAS,cAAc,CAAC,IAAgB,EAAE,IAAsB;QAC9D,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAA;QACzG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;QACvD,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACxB,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QACrC,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,CAAC,CAAA;QACzH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAA;IACvC,CAAC;IAED,0GAA0G;IAC1G,KAAK,UAAU,eAAe,CAC5B,KAAiC,EAAE,IAAgB,EAAE,GAAmC;QAExF,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,mBAAmB,CAAC,yDAAyD,CAAC,CAAA;QAC1F,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,GAAI,CAAC,KAAK,SAAS,IAAI,EAAE,CAAC,GAAG,CAAC,GAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,mBAAmB,CAAC,QAAQ,GAAG,CAAC,GAAG,aAAa,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,SAAS,WAAW,CAAC,GAA+B;QAClD,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAA;QAC9C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,4EAA4E;IAC5E,SAAS,eAAe,CAAC,GAA+B;QACtD,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAA;QACvE,IAAI,CAAsC,CAAA;QAC1C,IAAI,CAAC;YACH,CAAC,GAAG,gBAAgB,CAAC,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAA;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAA,CAAC,wEAAwE;QACpH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAA;IACjM,CAAC;IAED,SAAS,WAAW,CAAC,cAAsB;QACzC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAA;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,kBAAkB,CAAC,GAAoB;QACpD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;YACtB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC9B,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,GAAG,CAA6B,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACvE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACrC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC/E,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAA;YACrE,MAAM,OAAO,GAAG,MAAM,EAAE;iBACrB,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC;iBACtL,IAAI,CAAC,YAAY,CAAC;iBAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;YAC3C,OAAO,OAAO,CAAA;QAChB,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,GAAoB;QAC7C,+EAA+E;QAE/E,GAAG,CAAC,IAAI,CAAwF,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACxH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;YACtF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAA;YACrC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,WAAW;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAA;YACvH,IAAI,gBAAgB,GAAkB,IAAI,CAAA;YAC1C,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;oBAChD,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAA;oBAC/B,gBAAgB,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;gBACxC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,YAAY,mBAAmB;wBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;oBACvF,MAAM,CAAC,CAAA;gBACT,CAAC;YACH,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACtB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;gBAC3C,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAC1B,IAAI;gBACJ,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI;gBACjD,gBAAgB;gBAChB,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACf,CAAC,CAAC,SAAS,EAAE,CAAA;YACd,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAI,CAAC,EAAE,EAAE,GAAI,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAI,CAAC,CAAC,CAAC,CAAA;YAC7G,OAAO,WAAW,CAAC,GAAI,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,GAAG,CAA6B,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC/D,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7F,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAA;YACrE,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAA;YACzD,IAAI,CAAC;gBACH,OAAO,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,cAAc,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAA;YACxG,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,mBAAmB;oBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;gBACvF,MAAM,CAAC,CAAA;YACT,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,kHAAkH;QAClH,4HAA4H;QAC5H,GAAG,CAAC,IAAI,CAAuD,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACtG,IAAI,GAAuC,CAAA;YAC3C,IAAI,CAAC;gBACH,IAAI,QAAuD,CAAA;gBAC3D,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBACnC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;oBAChG,IAAI,CAAC,KAAK;wBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAA;oBACrE,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;wBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC,CAAA;oBACzH,IAAI,CAAC;wBAAC,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,8CAA8C,CAAC,CAAC;gBACpH,CAAC;gBACD,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;gBACpD,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAA;YACjC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,mBAAmB;oBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;gBACvF,MAAM,CAAC,CAAA;YACT,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAA;YAC1D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,mBAAmB;oBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;gBACvF,MAAM,CAAC,CAAA;YACT,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,IAAI,CAA6B,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACrE,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7F,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAA;YACrE,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC,CAAA;YACzH,IAAI,CAAC;gBACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAA;YACvD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,mBAAmB;oBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;gBACvF,MAAM,CAAC,CAAA;YACT,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,KAAK,CACP,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC3B,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7E,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAA;YACxE,MAAM,OAAO,GAA4B,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;YAClE,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;YACvE,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;gBAAE,OAAO,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,IAAI,CAAA;YACpG,IAAI,kBAAkB,GAAG,KAAK,CAAA;YAC9B,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;oBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAA;gBAC3H,IAAI,CAAC;oBACH,IAAI,GAAkD,CAAA;oBACtD,IAAI,CAAC;wBAAC,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,8CAA8C,CAAC,CAAC;oBAChH,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;oBACtD,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAA;oBAChC,kBAAkB,GAAG,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAA;oBAChH,OAAO,CAAC,kBAAkB,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,YAAY,mBAAmB;wBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;oBACvF,MAAM,CAAC,CAAA;gBACT,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;YACvF,oBAAoB,CAAC,EAAE,CAAC,CAAA;YACxB,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,MAAM,MAAM,GAAG,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAA;YAClF,MAAM,KAAK,GAAI,EAAE,GAAG,eAAe,CAAC,GAAI,CAAC,EAAE,WAAW,EAAE,GAAI,CAAC,WAAW,EAAE,CAAA;YAC1E,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAC7C,IAAI,kBAAkB;gBAAE,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,EAAE,CAAA;YACtF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM;gBAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACzG,OAAO,WAAW,CAAC,GAAI,CAAC,CAAA;QAC1B,CAAC,CACF,CAAA;QAED,GAAG,CAAC,MAAM,CAA6B,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAClE,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7E,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAA;YACxE,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;YAChD,oBAAoB,CAAC,EAAE,CAAC,CAAA;YACxB,0BAA0B,CAAC,EAAE,CAAC,CAAA;YAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;YAChH,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QAC/B,CAAC,CAAC,CAAA;QAEF,+EAA+E;QAE/E,GAAG,CAAC,IAAI,CACN,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACrC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC/E,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAA;YACrE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;YACtF,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAkB,CAAC,EAAE,CAAC;gBAC9D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;YACjG,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAkB,CAAA;YACxC,IAAI,SAAiB,CAAA;YACrB,IAAI,SAAqD,CAAA;YACzD,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBAC/B,SAAS,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;oBAC1C,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;oBAC7C,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;gBACvC,CAAC;qBAAM,CAAC;oBACN,SAAS,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;gBAC9C,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;YAC9D,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACtB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;oBACjD,OAAO;oBACP,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;oBAC1B,IAAI;oBACJ,cAAc,EAAE,OAAO,CAAC,SAAS,CAAC;oBAClC,SAAS,EAAE,GAAG;oBACd,SAAS,EAAE,GAAG;iBACf,CAAC,CAAC,SAAS,EAAE,CAAA;gBACd,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;gBAClC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAI,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,MAAM,GAAI,CAAC,IAAI,EAAE,EAC/F,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,GAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;gBAC1I,iCAAiC;gBACjC,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,GAAI,CAAA;gBAC7C,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,IAAI,iBAAiB,CAAC,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAA;gBACxF,MAAM,CAAC,CAAA;YACT,CAAC;QACH,CAAC,CACF,CAAA;QAED,GAAG,CAAC,KAAK,CACP,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC5C,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CACxD,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CACtE,CAAC,CAAC,CAAC,CAAC,CAAA;YACL,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAEvE,MAAM,OAAO,GAA4B,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;YAClE,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;YAEvE,0CAA0C;YAC1C,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAA;YACzF,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,KAAK,WAAW,CAAA;YACvD,MAAM,WAAW,GAAG,WAAW;gBAC7B,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS;gBAC3D,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAA;YAClG,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,IAAI,WAAW,EAAE,CAAC;wBAChB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAmC,CAAA;wBACxF,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,IAAkB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,CAAA;wBACxH,MAAM,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,IAAkB,EAAE,GAAG,CAAC,CAAA;wBACrE,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;oBAC1D,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAkB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;oBAC5F,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC9D,CAAC;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;gBACzG,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;gBAC7C,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;gBAClC,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;gBAClF,MAAM,IAAI,GAA4B,EAAE,CAAA;gBACxC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;oBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;gBACzH,IAAI,WAAW;oBAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,EAAE,CAAA;gBACrG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM;oBAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,IAAI,IAAI,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAA;gBACxJ,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,GAAI,CAAA;gBAC7C,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,IAAI,iBAAiB,CAAC,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAA;gBACxF,MAAM,CAAC,CAAA;YACT,CAAC;QACH,CAAC,CACF,CAAA;QAED,GAAG,CAAC,MAAM,CACR,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC5C,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CACxD,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CACtE,CAAC,CAAC,CAAC,CAAC,CAAA;YACL,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;YACvE,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAA;YAClE,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC7C,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAClF,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,IAAI,IAAI,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,EACjH,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QAC/B,CAAC,CACF,CAAA;QAED,GAAG,CAAC,GAAG,CACL,+BAA+B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACpD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC5C,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CACxD,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CACtE,CAAC,CAAC,CAAC,CAAC,CAAA;YACL,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;YACvE,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAA;YAChF,yFAAyF;YACzF,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,EAC3I,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;YACzB,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,cAAc,CAA0C,CAAA;gBACvF,IAAI,CAAC,GAAG;oBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAA;gBAC5E,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;oBACpD,MAAM,YAAY,EAAE,CAAA;oBACpB,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;gBACpF,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC9D,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;YAChD,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAA;YACtF,MAAM,YAAY,EAAE,CAAA;YACpB,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;QACvE,CAAC,CACF,CAAA;IACH,CAAC;IAED,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAA;AAC5C,CAAC"}

package/dist/vaultUse.d.ts

@@ -0,0 +1,15 @@
+/** The same text for the same value, whatever the order of keys. */
+export declare function canonical(value: unknown): string;
+/**
+ * The check that keeps a token without the permission to use vault secrets away from them. `target` names what a
+ * vault reference sits in, in the application's words (for example "job or channel"), for the refusal message.
+ */
+export declare function createVaultUseGuard(options: {
+    target: string;
+}): {
+    refused: string;
+    vaultUseProblem: (token: {
+        scopes: readonly string[];
+    } | undefined, incoming: unknown, stored: unknown) => string | null;
+};
+//# sourceMappingURL=vaultUse.d.ts.map

package/dist/vaultUse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vaultUse.d.ts","sourceRoot":"","sources":["../src/vaultUse.ts"],"names":[],"mappings":"AAYA,oEAAoE;AACpE,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIhD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE;;6BAW7B;QAAE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,SAAS,YAAY,OAAO,UAAU,OAAO,KAAG,MAAM,GAAG,IAAI;EAM9H"}

package/dist/vaultUse.js

@@ -0,0 +1,39 @@
+import { tokenAllows, VAULT_USE_SCOPE } from '@better-forge/contracts';
+const isObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+/** Whether anything under a `vault` key is set, whatever its shape: a reference that is malformed is still treated as one. */
+function holdsVault(value) {
+    if (Array.isArray(value))
+        return value.some(holdsVault);
+    if (!isObject(value))
+        return false;
+    return Object.entries(value).some(([key, inner]) => (key === 'vault' && inner !== undefined && inner !== null && inner !== false) || holdsVault(inner));
+}
+/** The same text for the same value, whatever the order of keys. */
+export function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    if (isObject(value))
+        return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}`;
+    return JSON.stringify(value) ?? 'null';
+}
+/**
+ * The check that keeps a token without the permission to use vault secrets away from them. `target` names what a
+ * vault reference sits in, in the application's words (for example "job or channel"), for the refusal message.
+ */
+export function createVaultUseGuard(options) {
+    const refused = `This token does not have the "${VAULT_USE_SCOPE}" permission, which it needs to add a vault reference or to change the configuration of a ${options.target} that has one`;
+    /**
+     * A vault secret is sent wherever the configuration that references it points, and what the target answers (a query
+     * result, an error message) comes back to the caller. A token that may edit such a configuration but may not use vault
+     * secrets therefore can neither add a reference nor change anything in a configuration that has one: it can edit the
+     * rest or remove the reference. `stored` is the configuration as it is saved now, or undefined for a new one.
+     * Returns a message, or null if fine.
+     */
+    function vaultUseProblem(token, incoming, stored) {
+        if (!token || tokenAllows(token.scopes, VAULT_USE_SCOPE) || !holdsVault(incoming))
+            return null;
+        return stored !== undefined && canonical(incoming) === canonical(stored) ? null : refused;
+    }
+    return { refused, vaultUseProblem };
+}
+//# sourceMappingURL=vaultUse.js.map

package/dist/vaultUse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vaultUse.js","sourceRoot":"","sources":["../src/vaultUse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAGtE,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAiB,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAEjH,8HAA8H;AAC9H,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;AACzJ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACtE,IAAI,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACtI,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAA;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA2B;IAC7D,MAAM,OAAO,GACX,iCAAiC,eAAe,6FAA6F,OAAO,CAAC,MAAM,eAAe,CAAA;IAE5K;;;;;;OAMG;IACH,SAAS,eAAe,CAAC,KAAgD,EAAE,QAAiB,EAAE,MAAe;QAC3G,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAA;QAC9F,OAAO,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAA;IAC3F,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,CAAA;AACrC,CAAC"}

package/package.json

@@ -1,6 +1,56 @@
 {
   "name": "@better-forge/vault",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "Local vault crypto, HashiCorp client, secret resolution and vault routes.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/BElluu/Better-Forge.git",
+    "directory": "packages/vault"
+  },
+  "homepage": "https://github.com/BElluu/Better-Forge/tree/main/packages/vault#readme",
+  "bugs": {
+    "url": "https://github.com/BElluu/Better-Forge/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "src",
+    "!src/**/*.test.*"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsc -p tsconfig.json --watch --preserveWatchOutput"
+  },
+  "peerDependencies": {
+    "drizzle-orm": "^0.45.2",
+    "fastify": "^5.3.2",
+    "undici": "^7.4.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.2",
+    "drizzle-orm": "^0.45.2",
+    "fastify": "^5.3.2",
+    "typescript": "^5.7.3",
+    "undici": "^7.4.0"
+  },
+  "dependencies": {
+    "@better-forge/contracts": "0.1.1",
+    "@better-forge/db": "0.1.1"
+  },
+  "engines": {
+    "node": ">=26.10.0"
+  }
+}

package/src/createVault.ts

@@ -0,0 +1,45 @@
+import type { FastifyRequest } from 'fastify'
+import type { SqliteDatabase } from '@better-forge/db'
+import { createHashicorp } from './hashicorp.js'
+import { createSecretBox, type SecretBox } from './secretBox.js'
+import { createSecretResolver } from './resolveSecret.js'
+import { createVaultRoutes, type VaultAudit } from './vaultRoutes.js'
+
+export interface VaultOptions {
+  /** The application's database handle. It is used lazily, so it may be opened after this is created. */
+  db: SqliteDatabase
+  audit: VaultAudit
+  /** The signed-in caller of a request; the routes sit behind the application's own guards. */
+  identity: (req: FastifyRequest) => { userId: number; email: string }
+  /** Where the encryption key comes from. Defaults to the process environment. */
+  env?: NodeJS.ProcessEnv
+  /** A box the application already created, for the tables that seal their own columns; it is made from `env` when absent. */
+  secretBox?: SecretBox
+}
+
+/**
+ * Vaults of secrets (kept encrypted here, or read live from HashiCorp Vault), the lookup that turns a reference into
+ * its value, and the routes that manage them. Everything is built from `options` and kept in the returned closures.
+ */
+export function createVault(options: VaultOptions) {
+  const secretBox = options.secretBox ?? createSecretBox(options.env ? { env: options.env } : {})
+  const ctx = { db: options.db, secretBox }
+  const hashicorp = createHashicorp(ctx)
+  const resolver = createSecretResolver(ctx, hashicorp)
+  const routes = createVaultRoutes({ ...ctx, audit: options.audit, identity: options.identity }, { hashicorp, resolver })
+
+  return {
+    secretBox,
+    hashicorp,
+    resolver,
+    /** Plain plugins, so the hooks of the scope they are registered in apply to them. */
+    routes: {
+      /** Read-only catalogue of vault and secret names and types, never values. */
+      catalogue: routes.vaultCatalogRoutes,
+      /** Create, change, reveal and delete vaults and secrets. */
+      manage: routes.vaultRoutes,
+    },
+  }
+}
+
+export type Vault = ReturnType<typeof createVault>