@bigfootai/sdk 1.17.0 → 1.19.0

package/dist/auth-state.d.ts

@@ -0,0 +1,38 @@
+export interface AuthStatePayload {
+    [key: string]: unknown;
+}
+export interface EncodeAuthStateOptions {
+    /** Connection id from the platform; becomes `state.split('.')[0]`. */
+    connectionId: string;
+    /** Application from the platform; becomes `state.split('.')[1]`. */
+    application: string;
+    /** Values to seal, e.g. `{ verifier }`. */
+    payload: AuthStatePayload;
+    /**
+     * Secret to derive the key from. Pass `process.env.BIGFOOT_API_KEY` — the var
+     * the provider already holds and that both directions of the platform channel
+     * use.
+     */
+    secret: string;
+    /** How long the sealed state stays valid. Defaults to ten minutes. */
+    ttlSeconds?: number;
+}
+export interface DecodedAuthState {
+    connectionId: string;
+    application: string;
+    payload: AuthStatePayload;
+}
+/**
+ * Seals a payload into a state value the platform's `/auth/callback` can hand
+ * back. Returns `${connectionId}.${application}.${token}`, where the token is
+ * age- and tamper-evident.
+ */
+export declare const encodeAuthState: ({ connectionId, application, payload, secret, ttlSeconds, }: EncodeAuthStateOptions) => Promise<string>;
+/**
+ * Opens a state value produced by {@link encodeAuthState}. Returns `undefined`
+ * — never throws — when the value is malformed, was sealed with a different
+ * key, has expired, or its plain parts no longer match the sealed ones, so a
+ * caller can fail the connection closed with one branch.
+ */
+export declare const decodeAuthState: (state: string, secret: string) => Promise<DecodedAuthState | undefined>;
+//# sourceMappingURL=auth-state.d.ts.map

package/dist/auth-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-state.d.ts","sourceRoot":"","sources":["../src/auth-state.ts"],"names":[],"mappings":"AAwCA,MAAM,WAAW,gBAAgB;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACtC,sEAAsE;IACtE,YAAY,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,OAAO,EAAE,gBAAgB,CAAC;IAC1B;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,gBAAgB,CAAC;CAC1B;AAWD;;;;GAIG;AACH,eAAO,MAAM,eAAe,gEAMzB,sBAAsB,KAAG,OAAO,CAAC,MAAM,CAUzC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,UAAiB,MAAM,UAAU,MAAM,KAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAqBzG,CAAC"}

package/dist/auth-state.js

@@ -0,0 +1,84 @@
+import { hkdfSync } from 'node:crypto';
+import { EncryptJWT, jwtDecrypt } from 'jose';
+import { BIGFOOT_API_KEY_VAR } from './platform-auth.js';
+/**
+ * Seals the values an OAuth round trip needs into the `state` query parameter.
+ *
+ * A deployed provider may serve `/auth/connect` and `/auth/callback` from
+ * different instances, so nothing short-lived can live in process memory: a
+ * module-level constant is shared by every authorization request on that
+ * instance, and an in-process map is invisible to whichever instance the
+ * callback lands on. The SDK hands the provider's `auth.callback` the raw
+ * `state`, so the provider can carry what it needs inside that value and read
+ * it back with {@link decodeAuthState}.
+ *
+ * The SDK parses `state.split('.')`, taking `[0]` as the connection id and `[1]`
+ * as the application, so the sealed token is appended as a third part. A JWE
+ * compact serialization contains `.` of its own, so it is base64url-encoded to
+ * keep the state exactly three parts.
+ *
+ * Sealing is a `jose` JWE (`dir` + `A256GCM`), which gives a standard,
+ * reviewable token format, authenticated encryption, and `exp` validation
+ * instead of a hand-rolled one.
+ *
+ * The key is derived from the provider's existing platform key
+ * (`BIGFOOT_API_KEY`) instead of a new secret: it is already present in every
+ * deployment and stable across instances. HKDF with a distinct label keeps the
+ * derived key independent of the one that authenticates the platform channel,
+ * so a sealed state cannot be replayed as a bearer token or the reverse.
+ *
+ * Rotating `BIGFOOT_API_KEY` invalidates states already in flight. They are
+ * single-use and short-lived, so the worst case is a connection attempt the
+ * user starts again.
+ */
+/** Domain separation: a value derived for one purpose must never be reused for another. */
+const KEY_INFO = 'bigfoot-auth-state/v1';
+const DEFAULT_TTL_SECONDS = 600;
+const KEY_LENGTH = 32;
+const deriveKey = (secret) => {
+    if (secret.trim().length === 0) {
+        throw new Error(`Cannot seal the auth state: ${BIGFOOT_API_KEY_VAR} is not set. It is the provider's platform key and the source of the state key.`);
+    }
+    return new Uint8Array(hkdfSync('sha256', secret, '', KEY_INFO, KEY_LENGTH));
+};
+/**
+ * Seals a payload into a state value the platform's `/auth/callback` can hand
+ * back. Returns `${connectionId}.${application}.${token}`, where the token is
+ * age- and tamper-evident.
+ */
+export const encodeAuthState = async ({ connectionId, application, payload, secret, ttlSeconds, }) => {
+    const key = deriveKey(secret);
+    const token = await new EncryptJWT({ connectionId, application, data: payload })
+        .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
+        .setIssuedAt()
+        .setExpirationTime(`${ttlSeconds ?? DEFAULT_TTL_SECONDS}s`)
+        .encrypt(key);
+    return `${connectionId}.${application}.${Buffer.from(token, 'utf8').toString('base64url')}`;
+};
+/**
+ * Opens a state value produced by {@link encodeAuthState}. Returns `undefined`
+ * — never throws — when the value is malformed, was sealed with a different
+ * key, has expired, or its plain parts no longer match the sealed ones, so a
+ * caller can fail the connection closed with one branch.
+ */
+export const decodeAuthState = async (state, secret) => {
+    const [connectionId, application, token] = state.split('.');
+    if (!connectionId || !application || !token) {
+        return undefined;
+    }
+    try {
+        const key = deriveKey(secret);
+        const { payload } = await jwtDecrypt(Buffer.from(token, 'base64url').toString('utf8'), key);
+        if (payload.connectionId !== connectionId || payload.application !== application) {
+            return undefined;
+        }
+        if (typeof payload.data !== 'object' || payload.data === null) {
+            return undefined;
+        }
+        return { connectionId, application, payload: payload.data };
+    }
+    catch {
+        return undefined;
+    }
+};
+//# sourceMappingURL=auth-state.js.map

package/dist/auth-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-state.js","sourceRoot":"","sources":["../src/auth-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,2FAA2F;AAC3F,MAAM,QAAQ,GAAG,uBAAuB,CAAC;AACzC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,UAAU,GAAG,EAAE,CAAC;AA6BtB,MAAM,SAAS,GAAG,CAAC,MAAc,EAAc,EAAE;IAChD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACd,+BAA+B,mBAAmB,iFAAiF,CACnI,CAAC;IACH,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAC7E,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,EACrC,YAAY,EACZ,WAAW,EACX,OAAO,EACP,MAAM,EACN,UAAU,GACc,EAAmB,EAAE;IAC7C,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAE9B,MAAM,KAAK,GAAG,MAAM,IAAI,UAAU,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;SAC9E,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;SAClD,WAAW,EAAE;SACb,iBAAiB,CAAC,GAAG,UAAU,IAAI,mBAAmB,GAAG,CAAC;SAC1D,OAAO,CAAC,GAAG,CAAC,CAAC;IAEf,OAAO,GAAG,YAAY,IAAI,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC7F,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,KAAa,EAAE,MAAc,EAAyC,EAAE;IAC7G,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5D,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAE5F,IAAI,OAAO,CAAC,YAAY,KAAK,YAAY,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YAClF,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/D,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,IAAwB,EAAE,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC,CAAC"}

package/dist/auth-state.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth-state.test.d.ts.map

package/dist/auth-state.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-state.test.d.ts","sourceRoot":"","sources":["../src/auth-state.test.ts"],"names":[],"mappings":""}

package/dist/auth-state.test.js

@@ -0,0 +1,64 @@
+import { describe, expect, it } from 'vitest';
+import { decodeAuthState, encodeAuthState } from './auth-state.js';
+const SECRET = 'platform-key-value';
+const OTHER_SECRET = 'a-different-platform-key';
+const VERIFIER = 'super-secret-code-verifier-value';
+const encode = (overrides = {}) => encodeAuthState({
+    connectionId: 'conn-1',
+    application: 'app-1',
+    payload: { verifier: VERIFIER },
+    secret: SECRET,
+    ...overrides,
+});
+describe('encodeAuthState', () => {
+    it('prefixes the state with the connection id and application the SDK parses', async () => {
+        const parts = (await encode()).split('.');
+        expect(parts[0]).toBe('conn-1');
+        expect(parts[1]).toBe('app-1');
+        expect(parts).toHaveLength(3);
+    });
+    it('keeps the sealed token free of the delimiter the SDK splits on', async () => {
+        expect((await encode()).split('.')[2]).not.toContain('.');
+    });
+    it('does not leave the payload in the clear', async () => {
+        expect(await encode()).not.toContain(VERIFIER);
+    });
+    it('produces a different token every time (fresh iv)', async () => {
+        expect(await encode()).not.toBe(await encode());
+    });
+    it('rejects an empty secret', async () => {
+        await expect(encode({ secret: '' })).rejects.toThrow(/BIGFOOT_API_KEY/);
+    });
+});
+describe('decodeAuthState', () => {
+    it('round-trips the payload', async () => {
+        await expect(decodeAuthState(await encode(), SECRET)).resolves.toEqual({
+            connectionId: 'conn-1',
+            application: 'app-1',
+            payload: { verifier: VERIFIER },
+        });
+    });
+    it('returns undefined for a state sealed with another secret', async () => {
+        await expect(decodeAuthState(await encode(), OTHER_SECRET)).resolves.toBeUndefined();
+    });
+    it('returns undefined when the sealed token is tampered with', async () => {
+        const [connectionId, application, token] = (await encode()).split('.');
+        const flipped = `${token.slice(0, -1)}${token.endsWith('A') ? 'B' : 'A'}`;
+        await expect(decodeAuthState(`${connectionId}.${application}.${flipped}`, SECRET)).resolves.toBeUndefined();
+    });
+    it('returns undefined when the plain parts are swapped for another connection', async () => {
+        const [, application, token] = (await encode()).split('.');
+        await expect(decodeAuthState(`conn-2.${application}.${token}`, SECRET)).resolves.toBeUndefined();
+    });
+    it('returns undefined once the state has expired', async () => {
+        await expect(decodeAuthState(await encode({ ttlSeconds: -1 }), SECRET)).resolves.toBeUndefined();
+    });
+    it('returns undefined for a state with no sealed part', async () => {
+        await expect(decodeAuthState('conn-1.app-1', SECRET)).resolves.toBeUndefined();
+        await expect(decodeAuthState('', SECRET)).resolves.toBeUndefined();
+    });
+    it('returns undefined for a token that is not a JWE', async () => {
+        await expect(decodeAuthState('conn-1.app-1.not-a-jwe', SECRET)).resolves.toBeUndefined();
+    });
+});
+//# sourceMappingURL=auth-state.test.js.map

package/dist/auth-state.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-state.test.js","sourceRoot":"","sources":["../src/auth-state.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEnE,MAAM,MAAM,GAAG,oBAAoB,CAAC;AACpC,MAAM,YAAY,GAAG,0BAA0B,CAAC;AAChD,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAEpD,MAAM,MAAM,GAAG,CAAC,YAA4D,EAAE,EAAmB,EAAE,CAClG,eAAe,CAAC;IACf,YAAY,EAAE,QAAQ;IACtB,WAAW,EAAE,OAAO;IACpB,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC/B,MAAM,EAAE,MAAM;IACd,GAAG,SAAS;CACZ,CAAC,CAAC;AAEJ,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,MAAM,CAAC,eAAe,CAAC,MAAM,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACtE,YAAY,EAAE,QAAQ;YACtB,WAAW,EAAE,OAAO;YACpB,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;SAC/B,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,CAAC,eAAe,CAAC,MAAM,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC1E,MAAM,MAAM,CAAC,eAAe,CAAC,GAAG,YAAY,IAAI,WAAW,IAAI,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IAC7G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,MAAM,CAAC,eAAe,CAAC,UAAU,WAAW,IAAI,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,MAAM,CAAC,eAAe,CAAC,MAAM,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,MAAM,CAAC,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC/E,MAAM,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,MAAM,CAAC,eAAe,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IAC1F,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/configuration.d.ts

@@ -0,0 +1,114 @@
+import { type Logger } from './logger.js';
+/**
+ * Resolves a provider's configuration before the HTTP server starts, whichever
+ * runtime the provider is running on.
+ *
+ * - **ECS** injects the values as environment variables through the task
+ *   definition's `secrets` block. The task agent resolves the Secrets Manager
+ *   reference at task start, so the value never lands in Terraform state or in
+ *   the service definition. This module finds them already in `process.env`.
+ * - **Lambda** has no equivalent injection, so the image carries the AWS
+ *   Parameters and Secrets Lambda Extension. It serves the secret as JSON over
+ *   `http://localhost:2773` and caches it (five minutes by default). This module
+ *   reads it from there and merges the keys into `process.env`.
+ *
+ * A provider therefore makes one call — `await loadConfiguration({ required })`
+ * — and does not know which runtime it is on. `SECRETS_MANAGER_SECRET_ID` names
+ * the secret to read on Lambda; it is not a secret value and may live in the
+ * function configuration.
+ *
+ * Missing values fail closed: if a required key is absent after resolution (or
+ * the secret cannot be read or parsed) startup throws, naming the key but never
+ * the value.
+ */
+/**
+ * Names the Secrets Manager secret holding the provider's secret-shaped
+ * configuration, as a flat JSON object of string key/value pairs. Unset locally,
+ * and set on Lambda in the function configuration. On ECS the values are injected
+ * directly and this variable carries no meaning, so it may be left unset.
+ */
+export declare const SECRET_ID_VAR = "SECRETS_MANAGER_SECRET_ID";
+/** Set by the Lambda runtime. Its presence is how the SDK tells Lambda from ECS. */
+export declare const LAMBDA_FUNCTION_NAME_VAR = "AWS_LAMBDA_FUNCTION_NAME";
+/**
+ * The token the extension requires on every request. The Lambda runtime sets it
+ * in the execution environment; it authenticates the caller as this function and
+ * is never the secret value itself.
+ */
+export declare const EXTENSION_TOKEN_VAR = "AWS_SESSION_TOKEN";
+/** Port of the extension's local HTTP server. Defaults in the extension to 2773. */
+export declare const EXTENSION_PORT_VAR = "PARAMETERS_SECRETS_EXTENSION_HTTP_PORT";
+export declare const DEFAULT_EXTENSION_PORT = 2773;
+/**
+ * A configuration requirement. A bare string names one required key; an array
+ * names alternatives, and the requirement is met when any one of them is
+ * present (`['AIRTABLE_CLIENT_SECRET', 'AIRTABLE_PKCE_SECRET']`).
+ */
+export type ConfigurationRequirement = string | readonly string[];
+export interface LoadConfigurationOptions {
+    /**
+     * The keys the provider cannot run without. Anything absent after resolution
+     * aborts startup. Each entry is one key, or a set of alternatives.
+     */
+    required?: readonly ConfigurationRequirement[];
+    /**
+     * The secret to read on Lambda. Defaults to `SECRETS_MANAGER_SECRET_ID`.
+     * Exposed for tests and for a provider that reads more than one secret.
+     */
+    secretId?: string;
+    /** Overrides the default logger. */
+    logger?: Logger;
+    /** The number of times to try the extension before giving up. Defaults to 5. */
+    attempts?: number;
+    /** Delay between extension attempts, in milliseconds. Defaults to 200. */
+    retryDelayMs?: number;
+    /**
+     * Reads the raw `SecretString` for a secret id from the extension. Injectable
+     * so the tests exercise the resolution logic with no network and no Lambda.
+     */
+    fetchSecret?: (secretId: string) => Promise<string>;
+}
+/** Reads the raw `SecretString` for a secret id from somewhere. */
+export type SecretFetcher = (secretId: string) => Promise<string>;
+/**
+ * Reads a secret from the extension, retrying the retryable failures. The
+ * extension only reports ready after the runtime bootstraps, so the first read
+ * after a cold start can race it.
+ */
+export declare const readSecretFromExtension: (secretId: string, { attempts, retryDelayMs }?: {
+    attempts?: number;
+    retryDelayMs?: number;
+}) => Promise<string>;
+/** Reads the raw `SecretString` for a secret id from the extension. */
+export declare const fetchSecretFromExtension: SecretFetcher;
+/**
+ * Parses the secret payload into key/value pairs, rejecting anything that is not
+ * a flat JSON object of strings. Error messages describe the shape problem only —
+ * they never quote the payload, which would put secret material into logs and
+ * stack traces.
+ */
+export declare const parseSecretPayload: (raw: string) => Record<string, string>;
+/**
+ * Merges resolved values into the environment. Secrets Manager is authoritative:
+ * a stale value left behind in the task definition must never win over the
+ * managed one, so this overwrites rather than filling in gaps.
+ */
+export declare const applyConfiguration: (values: Record<string, string>, env?: NodeJS.ProcessEnv) => void;
+/**
+ * The requirements still unmet, each named by its alternatives ("A or B").
+ * Names only — never values.
+ */
+export declare const findMissingConfiguration: (required: readonly ConfigurationRequirement[], env?: NodeJS.ProcessEnv) => string[];
+/** True when the process is running as a Lambda function. */
+export declare const isLambda: (env?: NodeJS.ProcessEnv) => boolean;
+/**
+ * Resolves the provider's configuration and fails closed when it is incomplete.
+ *
+ * On Lambda the secret named by `SECRETS_MANAGER_SECRET_ID` is read through the
+ * extension and merged into `process.env`, so every provider continues to read
+ * its settings from the environment. On ECS the values are already injected
+ * there. Either way a missing required key throws, naming the key but never the
+ * value.
+ */
+export declare const loadConfiguration: (options?: LoadConfigurationOptions) => Promise<void>;
+//# sourceMappingURL=configuration.d.ts.map

package/dist/configuration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.d.ts","sourceRoot":"","sources":["../src/configuration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAuB,MAAM,aAAa,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,aAAa,8BAA8B,CAAC;AAEzD,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,sBAAsB,CAAC;AAEvD,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,2CAA2C,CAAC;AAE3E,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;AAElE,MAAM,WAAW,wBAAwB;IACxC;;;OAGG;IACH,QAAQ,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACpD;AASD,mEAAmE;AACnE,MAAM,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAiDlE;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,aACzB,MAAM,+BACsB;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,KAChF,OAAO,CAAC,MAAM,CAyBhB,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,wBAAwB,EAAE,aAA+D,CAAC;AAEvG;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAS,MAAM,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAqBrE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,WAAY,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAO,MAAM,CAAC,UAAU,KAAiB,IAIzG,CAAC;AAIF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,aAC1B,SAAS,wBAAwB,EAAE,QACxC,MAAM,CAAC,UAAU,KACpB,MAAM,EAOR,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,QAAQ,SAAS,MAAM,CAAC,UAAU,KAAiB,OACR,CAAC;AAEzD;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,aAAmB,wBAAwB,KAAQ,OAAO,CAAC,IAAI,CAwC5F,CAAC"}

package/dist/configuration.js

@@ -0,0 +1,210 @@
+import { logger as sdkLogger } from './logger.js';
+/**
+ * Resolves a provider's configuration before the HTTP server starts, whichever
+ * runtime the provider is running on.
+ *
+ * - **ECS** injects the values as environment variables through the task
+ *   definition's `secrets` block. The task agent resolves the Secrets Manager
+ *   reference at task start, so the value never lands in Terraform state or in
+ *   the service definition. This module finds them already in `process.env`.
+ * - **Lambda** has no equivalent injection, so the image carries the AWS
+ *   Parameters and Secrets Lambda Extension. It serves the secret as JSON over
+ *   `http://localhost:2773` and caches it (five minutes by default). This module
+ *   reads it from there and merges the keys into `process.env`.
+ *
+ * A provider therefore makes one call — `await loadConfiguration({ required })`
+ * — and does not know which runtime it is on. `SECRETS_MANAGER_SECRET_ID` names
+ * the secret to read on Lambda; it is not a secret value and may live in the
+ * function configuration.
+ *
+ * Missing values fail closed: if a required key is absent after resolution (or
+ * the secret cannot be read or parsed) startup throws, naming the key but never
+ * the value.
+ */
+/**
+ * Names the Secrets Manager secret holding the provider's secret-shaped
+ * configuration, as a flat JSON object of string key/value pairs. Unset locally,
+ * and set on Lambda in the function configuration. On ECS the values are injected
+ * directly and this variable carries no meaning, so it may be left unset.
+ */
+export const SECRET_ID_VAR = 'SECRETS_MANAGER_SECRET_ID';
+/** Set by the Lambda runtime. Its presence is how the SDK tells Lambda from ECS. */
+export const LAMBDA_FUNCTION_NAME_VAR = 'AWS_LAMBDA_FUNCTION_NAME';
+/**
+ * The token the extension requires on every request. The Lambda runtime sets it
+ * in the execution environment; it authenticates the caller as this function and
+ * is never the secret value itself.
+ */
+export const EXTENSION_TOKEN_VAR = 'AWS_SESSION_TOKEN';
+/** Port of the extension's local HTTP server. Defaults in the extension to 2773. */
+export const EXTENSION_PORT_VAR = 'PARAMETERS_SECRETS_EXTENSION_HTTP_PORT';
+export const DEFAULT_EXTENSION_PORT = 2773;
+/**
+ * Raised when the extension is reachable but not yet serving — the connection
+ * was refused, or it answered as unavailable. Retried; every other failure is
+ * terminal.
+ */
+class ExtensionUnavailableError extends Error {
+}
+const isRetryableStatus = (status) => status === 429 || status >= 500;
+/**
+ * One round trip to the extension. Distinguishes "not ready yet" (retryable)
+ * from "this request will never succeed" (terminal), and never quotes the
+ * secret or the token in a message.
+ */
+const readSecretOnce = async (secretId, token, port) => {
+    const url = `http://localhost:${port}/secretsmanager/get?secretId=${encodeURIComponent(secretId)}`;
+    let response;
+    try {
+        response = await fetch(url, {
+            headers: { 'X-Aws-Parameters-Secrets-Token': token },
+        });
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new ExtensionUnavailableError(`the extension is not reachable yet: ${reason}`);
+    }
+    if (isRetryableStatus(response.status)) {
+        throw new ExtensionUnavailableError(`the extension answered HTTP ${response.status}`);
+    }
+    if (!response.ok) {
+        throw new Error(`the extension rejected the request for secret "${secretId}" with HTTP ${response.status}`);
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        throw new Error('the extension returned a response that is not JSON');
+    }
+    if (typeof body !== 'object' ||
+        body === null ||
+        !('SecretString' in body) ||
+        typeof body.SecretString !== 'string') {
+        throw new Error('the secret has no SecretString value (binary secrets are not supported)');
+    }
+    return body.SecretString;
+};
+/**
+ * Reads a secret from the extension, retrying the retryable failures. The
+ * extension only reports ready after the runtime bootstraps, so the first read
+ * after a cold start can race it.
+ */
+export const readSecretFromExtension = async (secretId, { attempts = 5, retryDelayMs = 200 } = {}) => {
+    const token = process.env[EXTENSION_TOKEN_VAR];
+    if (!token || token.trim().length === 0) {
+        throw new Error(`${EXTENSION_TOKEN_VAR} is not set, so the AWS Parameters and Secrets Lambda Extension cannot be authenticated. It is set by the Lambda runtime and must not be configured by hand.`);
+    }
+    const port = Number(process.env[EXTENSION_PORT_VAR]) || DEFAULT_EXTENSION_PORT;
+    let lastError;
+    for (let attempt = 1; attempt <= attempts; attempt += 1) {
+        try {
+            return await readSecretOnce(secretId, token, port);
+        }
+        catch (error) {
+            if (!(error instanceof ExtensionUnavailableError) || attempt === attempts) {
+                throw error;
+            }
+            lastError = error;
+            await new Promise((resolve) => setTimeout(resolve, retryDelayMs * attempt));
+        }
+    }
+    // Unreachable: the loop either returns or throws. Kept for the type checker.
+    throw lastError instanceof Error ? lastError : new Error('the extension could not be read');
+};
+/** Reads the raw `SecretString` for a secret id from the extension. */
+export const fetchSecretFromExtension = (secretId) => readSecretFromExtension(secretId);
+/**
+ * Parses the secret payload into key/value pairs, rejecting anything that is not
+ * a flat JSON object of strings. Error messages describe the shape problem only —
+ * they never quote the payload, which would put secret material into logs and
+ * stack traces.
+ */
+export const parseSecretPayload = (raw) => {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('the secret is not valid JSON (expected a flat object, e.g. {"DATABASE_URL": "..."})');
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('the secret must be a flat JSON object of string key/value pairs');
+    }
+    const values = {};
+    for (const [key, value] of Object.entries(parsed)) {
+        if (typeof value !== 'string') {
+            throw new Error(`the secret value for "${key}" must be a string`);
+        }
+        values[key] = value;
+    }
+    return values;
+};
+/**
+ * Merges resolved values into the environment. Secrets Manager is authoritative:
+ * a stale value left behind in the task definition must never win over the
+ * managed one, so this overwrites rather than filling in gaps.
+ */
+export const applyConfiguration = (values, env = process.env) => {
+    for (const [key, value] of Object.entries(values)) {
+        env[key] = value;
+    }
+};
+const isPresent = (key, env) => (env[key] ?? '').trim().length > 0;
+/**
+ * The requirements still unmet, each named by its alternatives ("A or B").
+ * Names only — never values.
+ */
+export const findMissingConfiguration = (required, env = process.env) => {
+    const alternativesOf = (requirement) => typeof requirement === 'string' ? [requirement] : requirement;
+    return required
+        .filter((requirement) => !alternativesOf(requirement).some((key) => isPresent(key, env)))
+        .map((requirement) => alternativesOf(requirement).join(' or '));
+};
+/** True when the process is running as a Lambda function. */
+export const isLambda = (env = process.env) => (env[LAMBDA_FUNCTION_NAME_VAR] ?? '').trim().length > 0;
+/**
+ * Resolves the provider's configuration and fails closed when it is incomplete.
+ *
+ * On Lambda the secret named by `SECRETS_MANAGER_SECRET_ID` is read through the
+ * extension and merged into `process.env`, so every provider continues to read
+ * its settings from the environment. On ECS the values are already injected
+ * there. Either way a missing required key throws, naming the key but never the
+ * value.
+ */
+export const loadConfiguration = async (options = {}) => {
+    const log = options.logger ?? sdkLogger;
+    const secretId = (options.secretId ?? process.env[SECRET_ID_VAR])?.trim();
+    if (secretId && isLambda()) {
+        log.info({ secretId }, 'Reading provider configuration from the AWS Parameters and Secrets Lambda Extension');
+        let raw;
+        try {
+            raw = await (options.fetchSecret
+                ? options.fetchSecret(secretId)
+                : readSecretFromExtension(secretId, {
+                    attempts: options.attempts,
+                    retryDelayMs: options.retryDelayMs,
+                }));
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            throw new Error(`Unable to read configuration from secret "${secretId}": ${reason}`);
+        }
+        let values;
+        try {
+            values = parseSecretPayload(raw);
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            throw new Error(`The secret "${secretId}" could not be used: ${reason}`);
+        }
+        applyConfiguration(values);
+        // Key names only — never values.
+        log.info({ keys: Object.keys(values).sort(), secretId }, 'Loaded provider configuration');
+    }
+    const missing = findMissingConfiguration(options.required ?? []);
+    if (missing.length > 0) {
+        throw new Error(`The provider configuration is incomplete; missing: ${missing.join(', ')}. Supply these values in the environment, or on Lambda via the secret named by ${SECRET_ID_VAR}.`);
+    }
+};
+//# sourceMappingURL=configuration.js.map

package/dist/configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.js","sourceRoot":"","sources":["../src/configuration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,MAAM,IAAI,SAAS,EAAE,MAAM,aAAa,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAEzD,oFAAoF;AACpF,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAEnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEvD,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AAE3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAiC3C;;;;GAIG;AACH,MAAM,yBAA0B,SAAQ,KAAK;CAAG;AAKhD,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAW,EAAE,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;AAEvF;;;;GAIG;AACH,MAAM,cAAc,GAAG,KAAK,EAAE,QAAgB,EAAE,KAAa,EAAE,IAAY,EAAmB,EAAE;IAC/F,MAAM,GAAG,GAAG,oBAAoB,IAAI,gCAAgC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAEnG,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,gCAAgC,EAAE,KAAK,EAAE;SACpD,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,yBAAyB,CAAC,uCAAuC,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,yBAAyB,CAAC,+BAA+B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,kDAAkD,QAAQ,eAAe,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACvE,CAAC;IAED,IACC,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACb,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC;QACzB,OAAQ,IAAmC,CAAC,YAAY,KAAK,QAAQ,EACpE,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC5F,CAAC;IAED,OAAQ,IAAiC,CAAC,YAAY,CAAC;AACxD,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAC3C,QAAgB,EAChB,EAAE,QAAQ,GAAG,CAAC,EAAE,YAAY,GAAG,GAAG,KAAmD,EAAE,EACrE,EAAE;IACpB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACd,GAAG,mBAAmB,8JAA8J,CACpL,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,sBAAsB,CAAC;IAE/E,IAAI,SAAkB,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC;YACJ,OAAO,MAAM,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,YAAY,yBAAyB,CAAC,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC3E,MAAM,KAAK,CAAC;YACb,CAAC;YACD,SAAS,GAAG,KAAK,CAAC;YAClB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC;QAC7E,CAAC;IACF,CAAC;IAED,6EAA6E;IAC7E,MAAM,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AAC7F,CAAC,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,wBAAwB,GAAkB,CAAC,QAAQ,EAAE,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AAEvG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAW,EAA0B,EAAE;IACzE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACxG,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oBAAoB,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAA8B,EAAE,MAAyB,OAAO,CAAC,GAAG,EAAQ,EAAE;IAChH,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAClB,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,GAAsB,EAAW,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAEvG;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACvC,QAA6C,EAC7C,MAAyB,OAAO,CAAC,GAAG,EACzB,EAAE;IACb,MAAM,cAAc,GAAG,CAAC,WAAqC,EAAqB,EAAE,CACnF,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAE/D,OAAO,QAAQ;SACb,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;SACxF,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAClE,CAAC,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAW,EAAE,CACzE,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,UAAoC,EAAE,EAAiB,EAAE;IAChG,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC;IACxC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAE1E,IAAI,QAAQ,IAAI,QAAQ,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,qFAAqF,CAAC,CAAC;QAE9G,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACJ,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW;gBAC/B,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC;gBAC/B,CAAC,CAAC,uBAAuB,CAAC,QAAQ,EAAE;oBAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;iBAClC,CAAC,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,MAAM,MAAM,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,MAA8B,CAAC;QACnC,IAAI,CAAC;YACJ,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,wBAAwB,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAE3B,iCAAiC;QACjC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,+BAA+B,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACd,sDAAsD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kFAAkF,aAAa,GAAG,CAC1K,CAAC;IACH,CAAC;AACF,CAAC,CAAC"}

package/dist/configuration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=configuration.test.d.ts.map

package/dist/configuration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.test.d.ts","sourceRoot":"","sources":["../src/configuration.test.ts"],"names":[],"mappings":""}