@cortexkit/antigravity-auth-core 2.2.1 → 3.0.0

package/dist/vault-provider-state.d.ts

@@ -0,0 +1,162 @@
+/**
+ * Provider-state file ("sidecar") for vault accounts: non-credential
+ * Antigravity metadata (label, usage, cooldowns, verification, tier,
+ * fingerprint, quota) keyed by the account identity the vault asserted, with
+ * the route, credential and record version that last wrote it.
+ *
+ * The roster (the Claustrum library's non-secret list of vault accounts this
+ * host may route to) keeps only the fields the library defines and drops any
+ * other field when it rewrites the file, so Antigravity's own state lives in
+ * this separate file. Keying by asserted account means a different account
+ * inherits nothing, while the same account keeps its state across token
+ * refreshes. The file never holds a bearer, refresh or enrollment secret, a
+ * receipt or a project (a vault send's project comes from the receipt
+ * Claustrum serves for that send attempt); such input is refused, not
+ * stripped. The fingerprint `sessionToken` is locally generated tracking
+ * metadata, not a credential, and is kept.
+ *
+ * A write holds the roster lock as an ownership guard (the roster is not
+ * rewritten), then this file's lock, re-checks the roster binding and asks the
+ * vault for a fresh receipt for the same version, and re-asserts both locks
+ * just before the atomic rename.
+ *
+ * A write must carry the record version its observation was served under.
+ * Once the vault serves a newer record version, even for the same account,
+ * that write is refused and the observation (usage, quota) is dropped; it is
+ * never re-attributed to the newer version.
+ */
+import type { JsonObject, ProviderMetadata, QuotaState } from './account-repository-types.ts';
+import type { CommonAuthFsModule } from './common-auth-runtime.ts';
+import type { VaultClaustrumPort } from './vault-account-source.ts';
+export declare const VAULT_PROVIDER_STATE_SCHEMA_VERSION = 1;
+/**
+ * File lock (`./fs` `withLock`) a commit holds on the state file, so two
+ * writers cannot interleave their read and rename.
+ */
+export declare const VAULT_PROVIDER_STATE_LOCK: Readonly<{
+    name: "antigravity-vault-state";
+    ttlMs: 10000;
+    timeoutMs: 10000;
+    renew: true;
+}>;
+/**
+ * The `./fs` lock and atomic-write functions `commitVaultProviderState`
+ * uses.
+ */
+export type AntigravityVaultStateFs = Pick<CommonAuthFsModule, 'withLock' | 'writeJsonAtomic'>;
+/**
+ * The `./claustrum` functions `commitVaultProviderState` uses: the roster write
+ * lock as an ownership guard and the decline check.
+ */
+export type VaultRosterGuardModule = Pick<VaultClaustrumPort, 'mutateVaultRoster' | 'isDeclined'>;
+/**
+ * Non-secret facts tying an observation (usage, quota) to the send attempt
+ * that produced it: the selected route, the credential id and asserted
+ * account, and the record version Claustrum served. Carries no token and no
+ * project.
+ */
+export interface VaultStateAttribution {
+    readonly routeId: string;
+    readonly credentialId: string;
+    readonly accountIdentity: string;
+    readonly recordVersion: number;
+}
+/**
+ * Provider metadata a vault account may keep. The project fields are left
+ * out because a send's project comes only from the receipt Claustrum serves
+ * for that attempt, and
+ * `enabled` because the roster owns whether an account routes.
+ */
+export type VaultProviderMetadata = Omit<ProviderMetadata, 'projectId' | 'managedProjectId' | 'enabled'>;
+/**
+ * The route, credential and served record version of the send whose
+ * observation last wrote this state. Kept as a record only; never counted or
+ * compared as a local version number.
+ */
+export interface VaultStateProvenance {
+    readonly routeId: string;
+    readonly credentialId: string;
+    readonly recordVersion: number;
+}
+export interface VaultAccountState {
+    readonly observed: VaultStateProvenance;
+    readonly metadata?: VaultProviderMetadata;
+    readonly quota?: QuotaState;
+    readonly extensions?: JsonObject;
+}
+export interface VaultProviderStateFile {
+    readonly schemaVersion: typeof VAULT_PROVIDER_STATE_SCHEMA_VERSION;
+    readonly accounts: Readonly<Record<string, VaultAccountState>>;
+    readonly extensions?: JsonObject;
+}
+/**
+ * What an update asks to store for the account. `observed` is not part of it:
+ * `commitVaultProviderState` sets it from the attribution.
+ */
+export interface VaultAccountStateValue {
+    metadata?: VaultProviderMetadata;
+    quota?: QuotaState;
+    extensions?: JsonObject;
+}
+/**
+ * Computes the account's next state from its current one. The function must
+ * be synchronous and must not start another commit. Return `undefined` to
+ * leave the state as it is and `null` to remove the account's entry.
+ */
+export type AntigravityVaultStateUpdate = (current: VaultAccountState | undefined) => VaultAccountStateValue | null | undefined;
+export type VaultProviderStateCommitResult = {
+    status: 'written';
+    state: VaultAccountState;
+} | {
+    status: 'cleared';
+} | {
+    status: 'unchanged';
+    state?: VaultAccountState;
+}
+/**
+ * The write failed part-way; the file may or may not hold the new state.
+ * The write is not retried. `state` is what a reload of the file found,
+ * when the reload could read it.
+ */
+ | {
+    status: 'uncertain';
+    error: unknown;
+    state?: VaultAccountState;
+};
+export type VaultProviderStateFailureKind = 'invalid-attribution' | 'binding-stale' | 'malformed' | 'newer-schema' | 'credential-material' | 'project-field' | 'invalid-update';
+/**
+ * A refused read or commit. Messages name the field path or step that was
+ * refused, never the stored value.
+ */
+export declare class VaultProviderStateError extends Error {
+    readonly kind: VaultProviderStateFailureKind;
+    constructor(kind: VaultProviderStateFailureKind, message: string);
+}
+/**
+ * Reads a sidecar value. A newer schema, an unknown field, a credential or a
+ * project anywhere in it is refused; nothing is silently dropped.
+ */
+export declare function decodeVaultProviderState(raw: unknown): VaultProviderStateFile;
+export declare function encodeVaultProviderState(file: VaultProviderStateFile): JsonObject;
+/** Reads the sidecar; a missing file is an empty one, anything unreadable is refused. */
+export declare function readVaultProviderState(statePath: string): Promise<VaultProviderStateFile>;
+/** The stored state of one asserted account, if any. */
+export declare function vaultAccountState(file: VaultProviderStateFile, accountIdentity: string): VaultAccountState | undefined;
+export interface CommitVaultProviderStateInput {
+    claustrum: VaultRosterGuardModule;
+    fs: AntigravityVaultStateFs;
+    rosterPath: string;
+    statePath: string;
+    attribution: VaultStateAttribution;
+    /**
+     * Fresh proof, while the roster write lock and the state-file lock are both
+     * held, that custody is still active, the host's stored credential record
+     * is still not a real login, and the vault still serves the attributed
+     * credential, account and record version. Throws to refuse. Must not use
+     * or keep the proving receipt's token or project.
+     */
+    verify: (attribution: VaultStateAttribution) => Promise<void>;
+    update: AntigravityVaultStateUpdate;
+}
+export declare function commitVaultProviderState(input: CommitVaultProviderStateInput): Promise<VaultProviderStateCommitResult>;
+//# sourceMappingURL=vault-provider-state.d.ts.map

package/dist/vault-provider-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-provider-state.d.ts","sourceRoot":"","sources":["../src/vault-provider-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAWH,OAAO,KAAK,EACV,UAAU,EAEV,gBAAgB,EAChB,UAAU,EACX,MAAM,+BAA+B,CAAA;AACtC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAe,MAAM,2BAA2B,CAAA;AAEhF,eAAO,MAAM,mCAAmC,IAAI,CAAA;AAEpD;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;;;EAKpC,CAAA;AAEF;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG,IAAI,CACxC,kBAAkB,EAClB,UAAU,GAAG,iBAAiB,CAC/B,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG,IAAI,CACvC,kBAAkB,EAClB,mBAAmB,GAAG,YAAY,CACnC,CAAA;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CACtC,gBAAgB,EAChB,WAAW,GAAG,kBAAkB,GAAG,SAAS,CAC7C,CAAA;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;CACjC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,aAAa,EAAE,OAAO,mCAAmC,CAAA;IAClE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAA;IAC9D,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IAChC,KAAK,CAAC,EAAE,UAAU,CAAA;IAClB,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB;AAED;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GAAG,CACxC,OAAO,EAAE,iBAAiB,GAAG,SAAS,KACnC,sBAAsB,GAAG,IAAI,GAAG,SAAS,CAAA;AAE9C,MAAM,MAAM,8BAA8B,GACtC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,KAAK,CAAC,EAAE,iBAAiB,CAAA;CAAE;AACpD;;;;GAIG;GACD;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,iBAAiB,CAAA;CAAE,CAAA;AAEtE,MAAM,MAAM,6BAA6B,GACrC,qBAAqB,GACrB,eAAe,GACf,WAAW,GACX,cAAc,GACd,qBAAqB,GACrB,eAAe,GACf,gBAAgB,CAAA;AAEpB;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAA;gBAEhC,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,MAAM;CAKjE;AAsMD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CAiC7E;AAgBD,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,sBAAsB,GAC3B,UAAU,CAYZ;AAOD,yFAAyF;AACzF,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,sBAAsB,CAAC,CAejC;AAED,wDAAwD;AACxD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,sBAAsB,EAC5B,eAAe,EAAE,MAAM,GACtB,iBAAiB,GAAG,SAAS,CAI/B;AAwFD,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,sBAAsB,CAAA;IACjC,EAAE,EAAE,uBAAuB,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,qBAAqB,CAAA;IAClC;;;;;;OAMG;IACH,MAAM,EAAE,CAAC,WAAW,EAAE,qBAAqB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7D,MAAM,EAAE,2BAA2B,CAAA;CACpC;AAED,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,8BAA8B,CAAC,CA4EzC"}

package/dist/vault-provider-state.js

@@ -0,0 +1,422 @@
+/**
+ * Provider-state file ("sidecar") for vault accounts: non-credential
+ * Antigravity metadata (label, usage, cooldowns, verification, tier,
+ * fingerprint, quota) keyed by the account identity the vault asserted, with
+ * the route, credential and record version that last wrote it.
+ *
+ * The roster (the Claustrum library's non-secret list of vault accounts this
+ * host may route to) keeps only the fields the library defines and drops any
+ * other field when it rewrites the file, so Antigravity's own state lives in
+ * this separate file. Keying by asserted account means a different account
+ * inherits nothing, while the same account keeps its state across token
+ * refreshes. The file never holds a bearer, refresh or enrollment secret, a
+ * receipt or a project (a vault send's project comes from the receipt
+ * Claustrum serves for that send attempt); such input is refused, not
+ * stripped. The fingerprint `sessionToken` is locally generated tracking
+ * metadata, not a credential, and is kept.
+ *
+ * A write holds the roster lock as an ownership guard (the roster is not
+ * rewritten), then this file's lock, re-checks the roster binding and asks the
+ * vault for a fresh receipt for the same version, and re-asserts both locks
+ * just before the atomic rename.
+ *
+ * A write must carry the record version its observation was served under.
+ * Once the vault serves a newer record version, even for the same account,
+ * that write is refused and the observation (usage, quota) is dropped; it is
+ * never re-attributed to the newer version.
+ */
+import { readFile } from 'node:fs/promises';
+import { AccountCodecError, decodeProviderMetadata, decodeQuotaState, encodeProviderMetadata, encodeQuotaState, } from "./account-repository-codecs.js";
+export const VAULT_PROVIDER_STATE_SCHEMA_VERSION = 1;
+/**
+ * File lock (`./fs` `withLock`) a commit holds on the state file, so two
+ * writers cannot interleave their read and rename.
+ */
+export const VAULT_PROVIDER_STATE_LOCK = Object.freeze({
+    name: 'antigravity-vault-state',
+    ttlMs: 10_000,
+    timeoutMs: 10_000,
+    renew: true,
+});
+/**
+ * A refused read or commit. Messages name the field path or step that was
+ * refused, never the stored value.
+ */
+export class VaultProviderStateError extends Error {
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.name = 'VaultProviderStateError';
+        this.kind = kind;
+    }
+}
+// ---------------------------------------------------------------------------
+// Validation
+// ---------------------------------------------------------------------------
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isNonEmpty(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+/**
+ * Key names refused anywhere in the file because they hold credentials. Keys
+ * are compared lower-case with punctuation removed, so `access_token`,
+ * `accessToken` and `access-token` all match `accesstoken`.
+ */
+const CREDENTIAL_KEYS = new Set([
+    'access',
+    'accesstoken',
+    'refresh',
+    'refreshtoken',
+    'idtoken',
+    'token',
+    'bearer',
+    'authorization',
+    'apikey',
+    'key',
+    'secret',
+    'clientsecret',
+    'password',
+    'enrollmenttoken',
+    'cookie',
+    'receipt',
+]);
+/**
+ * String values refused anywhere in the file: those starting like a Google
+ * access token (`ya29.`), a Google refresh token (`1//`) or an Authorization
+ * header (`Bearer `).
+ */
+const CREDENTIAL_VALUE = /^(?:ya29\.|1\/\/|bearer\s)/i;
+const PROJECT_KEYS = new Set(['projectid', 'managedprojectid', 'project']);
+function normalizedKey(key) {
+    return key.toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+/**
+ * True for `metadata.fingerprint.sessionToken` and for the same field in each
+ * `metadata.fingerprintHistory` entry: the one token-named field the file may
+ * keep, because it is local tracking metadata.
+ */
+function isFingerprintSessionToken(path) {
+    const n = path.length;
+    if (path[n - 1] !== 'sessionToken' || path[n - 2] !== 'fingerprint')
+        return false;
+    if (n === 3 && path[0] === 'metadata')
+        return true;
+    return n === 5 && path[0] === 'metadata' && path[1] === 'fingerprintHistory';
+}
+function scanForSecrets(value, path) {
+    if (typeof value === 'string') {
+        if (CREDENTIAL_VALUE.test(value.trim()) && !isFingerprintSessionToken(path))
+            throw new VaultProviderStateError('credential-material', `${path.join('.')} holds credential material`);
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const [index, item] of value.entries())
+            scanForSecrets(item, [...path, `${index}`]);
+        return;
+    }
+    if (!isRecord(value))
+        return;
+    for (const [key, item] of Object.entries(value)) {
+        const next = [...path, key];
+        const name = normalizedKey(key);
+        if (CREDENTIAL_KEYS.has(name) && !isFingerprintSessionToken(next))
+            throw new VaultProviderStateError('credential-material', `${next.join('.')} is a credential field`);
+        if (name === 'sessiontoken' && !isFingerprintSessionToken(next))
+            throw new VaultProviderStateError('credential-material', `${next.join('.')} is a credential field`);
+        if (PROJECT_KEYS.has(name))
+            throw new VaultProviderStateError('project-field', `${next.join('.')} would persist an Antigravity project`);
+        scanForSecrets(item, next);
+    }
+}
+function decodeProvenance(raw, path) {
+    if (!isRecord(raw) ||
+        Object.keys(raw).some((key) => !['routeId', 'credentialId', 'recordVersion'].includes(key)) ||
+        !isNonEmpty(raw.routeId) ||
+        !isNonEmpty(raw.credentialId) ||
+        typeof raw.recordVersion !== 'number' ||
+        !Number.isSafeInteger(raw.recordVersion) ||
+        raw.recordVersion < 0)
+        throw new VaultProviderStateError('malformed', `${path} is not a valid provenance`);
+    return Object.freeze({
+        routeId: raw.routeId,
+        credentialId: raw.credentialId,
+        recordVersion: raw.recordVersion,
+    });
+}
+function codecRefusal(error, path) {
+    if (error instanceof AccountCodecError)
+        throw new VaultProviderStateError('malformed', `${path}: ${error.problem} at ${error.path}`);
+    throw error;
+}
+function decodeExtensions(raw, path) {
+    if (raw === undefined)
+        return undefined;
+    if (!isRecord(raw))
+        throw new VaultProviderStateError('malformed', `${path} must be an object`);
+    return JSON.parse(JSON.stringify(raw));
+}
+/**
+ * Decodes the parts of an account entry an update may set: `metadata`,
+ * `quota` and `extensions` (never `observed`). `stored` is the JSON form read
+ * from the file; `typed` is the in-memory form an update returns, which is
+ * encoded first so both pass the same codec checks.
+ */
+function decodeValue(raw, path, form) {
+    if (!isRecord(raw))
+        throw new VaultProviderStateError('malformed', `${path} must be an object`);
+    for (const key of Object.keys(raw))
+        if (!['metadata', 'quota', 'extensions'].includes(key))
+            throw new VaultProviderStateError('malformed', `${path} has an unknown field`);
+    scanForSecrets(raw, []);
+    const value = {};
+    if (raw.metadata !== undefined) {
+        try {
+            value.metadata = decodeProviderMetadata(form === 'typed'
+                ? encodeProviderMetadata(raw.metadata)
+                : raw.metadata);
+        }
+        catch (error) {
+            codecRefusal(error, `${path}.metadata`);
+        }
+    }
+    if (raw.quota !== undefined) {
+        try {
+            value.quota = decodeQuotaState(form === 'typed'
+                ? encodeQuotaState(raw.quota)
+                : raw.quota);
+        }
+        catch (error) {
+            codecRefusal(error, `${path}.quota`);
+        }
+    }
+    const extensions = decodeExtensions(raw.extensions, `${path}.extensions`);
+    if (extensions)
+        value.extensions = extensions;
+    return value;
+}
+function decodeAccount(raw, path) {
+    if (!isRecord(raw))
+        throw new VaultProviderStateError('malformed', `${path} must be an object`);
+    const { observed, ...rest } = raw;
+    return Object.freeze({
+        observed: decodeProvenance(observed, `${path}.observed`),
+        ...decodeValue(rest, path, 'stored'),
+    });
+}
+/**
+ * Reads a sidecar value. A newer schema, an unknown field, a credential or a
+ * project anywhere in it is refused; nothing is silently dropped.
+ */
+export function decodeVaultProviderState(raw) {
+    if (!isRecord(raw) || typeof raw.schemaVersion !== 'number')
+        throw new VaultProviderStateError('malformed', 'state file is malformed');
+    if (raw.schemaVersion > VAULT_PROVIDER_STATE_SCHEMA_VERSION)
+        throw new VaultProviderStateError('newer-schema', 'state file was written by a newer version');
+    if (raw.schemaVersion !== VAULT_PROVIDER_STATE_SCHEMA_VERSION)
+        throw new VaultProviderStateError('malformed', 'state file version is invalid');
+    for (const key of Object.keys(raw))
+        if (!['schemaVersion', 'accounts', 'extensions'].includes(key))
+            throw new VaultProviderStateError('malformed', 'state file has an unknown field');
+    if (!isRecord(raw.accounts))
+        throw new VaultProviderStateError('malformed', 'accounts must be an object');
+    const accounts = {};
+    for (const [identity, entry] of Object.entries(raw.accounts)) {
+        if (!isNonEmpty(identity))
+            throw new VaultProviderStateError('malformed', 'blank account identity');
+        accounts[identity] = decodeAccount(entry, 'accounts[]');
+    }
+    const extensions = decodeExtensions(raw.extensions, 'extensions');
+    return Object.freeze({
+        schemaVersion: VAULT_PROVIDER_STATE_SCHEMA_VERSION,
+        accounts: Object.freeze(accounts),
+        ...(extensions && { extensions }),
+    });
+}
+function encodeAccount(state) {
+    const out = {
+        observed: {
+            routeId: state.observed.routeId,
+            credentialId: state.observed.credentialId,
+            recordVersion: state.observed.recordVersion,
+        },
+    };
+    if (state.metadata)
+        out.metadata = encodeProviderMetadata(state.metadata);
+    if (state.quota)
+        out.quota = encodeQuotaState(state.quota);
+    if (state.extensions)
+        out.extensions = state.extensions;
+    return out;
+}
+export function encodeVaultProviderState(file) {
+    const accounts = {};
+    for (const [identity, state] of Object.entries(file.accounts))
+        accounts[identity] = encodeAccount(state);
+    const out = {
+        schemaVersion: VAULT_PROVIDER_STATE_SCHEMA_VERSION,
+        accounts,
+    };
+    if (file.extensions)
+        out.extensions = file.extensions;
+    // Decoding what is about to be written enforces the same refusals on writes.
+    decodeVaultProviderState(out);
+    return out;
+}
+const EMPTY_FILE = Object.freeze({
+    schemaVersion: VAULT_PROVIDER_STATE_SCHEMA_VERSION,
+    accounts: Object.freeze({}),
+});
+/** Reads the sidecar; a missing file is an empty one, anything unreadable is refused. */
+export async function readVaultProviderState(statePath) {
+    let text;
+    try {
+        text = await readFile(statePath, 'utf8');
+    }
+    catch (error) {
+        if (isRecord(error) && error.code === 'ENOENT')
+            return EMPTY_FILE;
+        throw error;
+    }
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        throw new VaultProviderStateError('malformed', 'state file is not JSON');
+    }
+    return decodeVaultProviderState(raw);
+}
+/** The stored state of one asserted account, if any. */
+export function vaultAccountState(file, accountIdentity) {
+    return Object.hasOwn(file.accounts, accountIdentity)
+        ? file.accounts[accountIdentity]
+        : undefined;
+}
+// ---------------------------------------------------------------------------
+// Commit
+// ---------------------------------------------------------------------------
+const ATTRIBUTION_FIELDS = [
+    'accountIdentity',
+    'credentialId',
+    'recordVersion',
+    'routeId',
+];
+/**
+ * Copies an attribution after checking it is a plain object with exactly the
+ * four own data fields, non-blank strings and a non-negative integer version
+ * (a boolean, string or fraction is refused). Later checks use only the copy,
+ * so a getter or a later mutation cannot move the fence.
+ */
+function pinAttribution(raw) {
+    const invalid = () => new VaultProviderStateError('invalid-attribution', 'state commit needs exactly a route, credential, asserted account and record version');
+    if (!isRecord(raw) || Object.getPrototypeOf(raw) !== Object.prototype)
+        throw invalid();
+    const keys = Reflect.ownKeys(raw);
+    if (keys.length !== ATTRIBUTION_FIELDS.length ||
+        !ATTRIBUTION_FIELDS.every((key) => {
+            const field = Object.getOwnPropertyDescriptor(raw, key);
+            return field !== undefined && 'value' in field && field.enumerable;
+        }))
+        throw invalid();
+    const { routeId, credentialId, accountIdentity, recordVersion } = raw;
+    if (!isNonEmpty(routeId) ||
+        !isNonEmpty(credentialId) ||
+        !isNonEmpty(accountIdentity) ||
+        typeof recordVersion !== 'number' ||
+        !Number.isSafeInteger(recordVersion) ||
+        recordVersion < 0)
+        throw invalid();
+    return Object.freeze({
+        routeId,
+        credentialId,
+        accountIdentity,
+        recordVersion,
+    });
+}
+/**
+ * The roster must still route the attributed credential to the attributed
+ * account: the row exists, is enabled, active and not declined, and is
+ * neither stale nor unclaimed. A removed account is never brought back by a
+ * state write.
+ */
+function assertRosterBinding(roster, attribution, claustrum) {
+    const row = roster?.rows.find((entry) => entry.routeId === attribution.routeId);
+    if (!roster ||
+        !row?.enabled ||
+        row.state !== 'active' ||
+        row.stale === true ||
+        row.unclaimed === true ||
+        row.credentialId !== attribution.credentialId ||
+        row.accountIdentity !== attribution.accountIdentity ||
+        claustrum.isDeclined(roster.declined, attribution.credentialId, attribution.accountIdentity))
+        throw new VaultProviderStateError('binding-stale', 'the vault route no longer serves the attributed credential and account');
+}
+export async function commitVaultProviderState(input) {
+    const { claustrum, fs, statePath } = input;
+    const attribution = pinAttribution(input.attribution);
+    const identity = attribution.accountIdentity;
+    return claustrum.mutateVaultRoster(input.rosterPath, async (roster, rosterLock) => {
+        assertRosterBinding(roster, attribution, claustrum);
+        const result = await fs.withLock(statePath, VAULT_PROVIDER_STATE_LOCK, async (stateLock) => {
+            await input.verify(attribution);
+            const file = await readVaultProviderState(statePath);
+            const current = vaultAccountState(file, identity);
+            const requested = input.update(current);
+            if (isRecord(requested) &&
+                typeof requested.then === 'function')
+                throw new VaultProviderStateError('invalid-update', 'a state update must be synchronous');
+            if (requested === undefined)
+                return current
+                    ? { status: 'unchanged', state: current }
+                    : { status: 'unchanged' };
+            const accounts = {
+                ...file.accounts,
+            };
+            let next;
+            if (requested === null) {
+                if (!current)
+                    return { status: 'unchanged' };
+                delete accounts[identity];
+            }
+            else {
+                next = Object.freeze({
+                    observed: Object.freeze({
+                        routeId: attribution.routeId,
+                        credentialId: attribution.credentialId,
+                        recordVersion: attribution.recordVersion,
+                    }),
+                    ...decodeValue(requested, 'update', 'typed'),
+                });
+                accounts[identity] = next;
+            }
+            const encoded = encodeVaultProviderState({ ...file, accounts });
+            try {
+                await fs.writeJsonAtomic(statePath, encoded, {
+                    beforeRename: async () => {
+                        await rosterLock.assertOwned();
+                        await stateLock.assertOwned();
+                    },
+                });
+            }
+            catch (error) {
+                let reloaded;
+                try {
+                    reloaded = vaultAccountState(await readVaultProviderState(statePath), identity);
+                }
+                catch {
+                    reloaded = undefined;
+                }
+                return reloaded
+                    ? { status: 'uncertain', error, state: reloaded }
+                    : { status: 'uncertain', error };
+            }
+            return next
+                ? { status: 'written', state: next }
+                : { status: 'cleared' };
+        });
+        return { result };
+    });
+}
+//# sourceMappingURL=vault-provider-state.js.map

package/dist/vault-provider-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-provider-state.js","sourceRoot":"","sources":["../src/vault-provider-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AAUvC,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAA;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,yBAAyB;IAC/B,KAAK,EAAE,MAAM;IACb,SAAS,EAAE,MAAM;IACjB,KAAK,EAAE,IAAI;CACZ,CAAC,CAAA;AA2GF;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAA+B;IAE5C,YAAY,IAAmC,EAAE,OAAe;QAC9D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,QAAQ;IACR,aAAa;IACb,SAAS;IACT,cAAc;IACd,SAAS;IACT,OAAO;IACP,QAAQ;IACR,eAAe;IACf,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,cAAc;IACd,UAAU;IACV,iBAAiB;IACjB,QAAQ;IACR,SAAS;CACV,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,6BAA6B,CAAA;AAEtD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,kBAAkB,EAAE,SAAS,CAAC,CAAC,CAAA;AAE1E,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,IAAuB;IACxD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAA;IACrB,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,cAAc,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,aAAa;QACjE,OAAO,KAAK,CAAA;IACd,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU;QAAE,OAAO,IAAI,CAAA;IAClD,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAA;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,IAAc;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC;YACzE,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAC9C,CAAA;QACH,OAAM;IACR,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE;YACzC,cAAc,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAA;QAC7C,OAAM;IACR,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAM;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAA;QAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC;YAC/D,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAC1C,CAAA;QACH,IAAI,IAAI,KAAK,cAAc,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC;YAC7D,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAC1C,CAAA;QACH,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,uCAAuC,CACzD,CAAA;QACH,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY,EAAE,IAAY;IAClD,IACE,CAAC,QAAQ,CAAC,GAAG,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CACnB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CACrE;QACD,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC;QACxB,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;QAC7B,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QACrC,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC;QACxC,GAAG,CAAC,aAAa,GAAG,CAAC;QAErB,MAAM,IAAI,uBAAuB,CAC/B,WAAW,EACX,GAAG,IAAI,4BAA4B,CACpC,CAAA;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,aAAa,EAAE,GAAG,CAAC,aAAa;KACjC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAChD,IAAI,KAAK,YAAY,iBAAiB;QACpC,MAAM,IAAI,uBAAuB,CAC/B,WAAW,EACX,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,OAAO,KAAK,CAAC,IAAI,EAAE,CAC7C,CAAA;IACH,MAAM,KAAK,CAAA;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY,EAAE,IAAY;IAClD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAChB,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAA;IAC7E,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAe,CAAA;AACtD,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAClB,GAAY,EACZ,IAAY,EACZ,IAAwB;IAExB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAChB,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAA;IAC7E,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YACpD,MAAM,IAAI,uBAAuB,CAC/B,WAAW,EACX,GAAG,IAAI,uBAAuB,CAC/B,CAAA;IACL,cAAc,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACvB,MAAM,KAAK,GAA2B,EAAE,CAAA;IACxC,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,KAAK,CAAC,QAAQ,GAAG,sBAAsB,CACrC,IAAI,KAAK,OAAO;gBACd,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,QAA4B,CAAC;gBAC1D,CAAC,CAAC,GAAG,CAAC,QAAQ,CACjB,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,KAAK,EAAE,GAAG,IAAI,WAAW,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,GAAG,gBAAgB,CAC5B,IAAI,KAAK,OAAO;gBACd,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAmB,CAAC;gBAC3C,CAAC,CAAC,GAAG,CAAC,KAAK,CACd,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,IAAI,aAAa,CAAC,CAAA;IACzE,IAAI,UAAU;QAAE,KAAK,CAAC,UAAU,GAAG,UAAU,CAAA;IAC7C,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,aAAa,CAAC,GAAY,EAAE,IAAY;IAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAChB,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAA;IAC7E,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAA;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,EAAE,GAAG,IAAI,WAAW,CAAC;QACxD,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;KACrC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAY;IACnD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QACzD,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAA;IAC3E,IAAI,GAAG,CAAC,aAAa,GAAG,mCAAmC;QACzD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,2CAA2C,CAC5C,CAAA;IACH,IAAI,GAAG,CAAC,aAAa,KAAK,mCAAmC;QAC3D,MAAM,IAAI,uBAAuB,CAC/B,WAAW,EACX,+BAA+B,CAChC,CAAA;IACH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,CAAC,eAAe,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC5D,MAAM,IAAI,uBAAuB,CAC/B,WAAW,EACX,iCAAiC,CAClC,CAAA;IACL,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAA;IAC9E,MAAM,QAAQ,GAAsC,EAAE,CAAA;IACtD,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YACvB,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAA;QAC1E,QAAQ,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;IACzD,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IACjE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,mCAAmC;QAClD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjC,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,CAAC;KAClC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAwB;IAC7C,MAAM,GAAG,GAAe;QACtB,QAAQ,EAAE;YACR,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;YAC/B,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;YACzC,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa;SAC5C;KACF,CAAA;IACD,IAAI,KAAK,CAAC,QAAQ;QAAE,GAAG,CAAC,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACzE,IAAI,KAAK,CAAC,KAAK;QAAE,GAAG,CAAC,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC1D,IAAI,KAAK,CAAC,UAAU;QAAE,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,UAAuB,CAAA;IACpE,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,IAA4B;IAE5B,MAAM,QAAQ,GAAe,EAAE,CAAA;IAC/B,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC3D,QAAQ,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;IAC3C,MAAM,GAAG,GAAe;QACtB,aAAa,EAAE,mCAAmC;QAClD,QAAQ;KACT,CAAA;IACD,IAAI,IAAI,CAAC,UAAU;QAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;IACrD,6EAA6E;IAC7E,wBAAwB,CAAC,GAAG,CAAC,CAAA;IAC7B,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,GAA2B,MAAM,CAAC,MAAM,CAAC;IACvD,aAAa,EAAE,mCAAmC;IAClD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;CAC5B,CAAC,CAAA;AAEF,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAiB;IAEjB,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAA;QACjE,MAAM,KAAK,CAAA;IACb,CAAC;IACD,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,wBAAwB,CAAC,GAAG,CAAC,CAAA;AACtC,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,iBAAiB,CAC/B,IAA4B,EAC5B,eAAuB;IAEvB,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC;QAClD,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;QAChC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG;IACzB,iBAAiB;IACjB,cAAc;IACd,eAAe;IACf,SAAS;CACD,CAAA;AAEV;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,IAAI,uBAAuB,CACzB,qBAAqB,EACrB,qFAAqF,CACtF,CAAA;IACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,SAAS;QACnE,MAAM,OAAO,EAAE,CAAA;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACjC,IACE,IAAI,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM;QACzC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YACvD,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;QACpE,CAAC,CAAC;QAEF,MAAM,OAAO,EAAE,CAAA;IACjB,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,GAAG,CAAA;IACrE,IACE,CAAC,UAAU,CAAC,OAAO,CAAC;QACpB,CAAC,UAAU,CAAC,YAAY,CAAC;QACzB,CAAC,UAAU,CAAC,eAAe,CAAC;QAC5B,OAAO,aAAa,KAAK,QAAQ;QACjC,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC;QACpC,aAAa,GAAG,CAAC;QAEjB,MAAM,OAAO,EAAE,CAAA;IACjB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO;QACP,YAAY;QACZ,eAAe;QACf,aAAa;KACd,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,MAA+B,EAC/B,WAAkC,EAClC,SAAiC;IAEjC,MAAM,GAAG,GAAG,MAAM,EAAE,IAAI,CAAC,IAAI,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,WAAW,CAAC,OAAO,CACjD,CAAA;IACD,IACE,CAAC,MAAM;QACP,CAAC,GAAG,EAAE,OAAO;QACb,GAAG,CAAC,KAAK,KAAK,QAAQ;QACtB,GAAG,CAAC,KAAK,KAAK,IAAI;QAClB,GAAG,CAAC,SAAS,KAAK,IAAI;QACtB,GAAG,CAAC,YAAY,KAAK,WAAW,CAAC,YAAY;QAC7C,GAAG,CAAC,eAAe,KAAK,WAAW,CAAC,eAAe;QACnD,SAAS,CAAC,UAAU,CAClB,MAAM,CAAC,QAAQ,EACf,WAAW,CAAC,YAAY,EACxB,WAAW,CAAC,eAAe,CAC5B;QAED,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,wEAAwE,CACzE,CAAA;AACL,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAoC;IAEpC,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,KAAK,CAAA;IAC1C,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACrD,MAAM,QAAQ,GAAG,WAAW,CAAC,eAAe,CAAA;IAC5C,OAAO,SAAS,CAAC,iBAAiB,CAChC,KAAK,CAAC,UAAU,EAChB,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE;QAC3B,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;QACnD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAC9B,SAAS,EACT,yBAAyB,EACzB,KAAK,EAAE,SAAS,EAA2C,EAAE;YAC3D,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;YAC/B,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,SAAS,CAAC,CAAA;YACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YACjD,MAAM,SAAS,GAAY,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAChD,IACE,QAAQ,CAAC,SAAS,CAAC;gBACnB,OAAQ,SAAgC,CAAC,IAAI,KAAK,UAAU;gBAE5D,MAAM,IAAI,uBAAuB,CAC/B,gBAAgB,EAChB,oCAAoC,CACrC,CAAA;YACH,IAAI,SAAS,KAAK,SAAS;gBACzB,OAAO,OAAO;oBACZ,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE;oBACzC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;YAC7B,MAAM,QAAQ,GAAsC;gBAClD,GAAG,IAAI,CAAC,QAAQ;aACjB,CAAA;YACD,IAAI,IAAmC,CAAA;YACvC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC,OAAO;oBAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;gBAC5C,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAC3B,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;oBACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;wBACtB,OAAO,EAAE,WAAW,CAAC,OAAO;wBAC5B,YAAY,EAAE,WAAW,CAAC,YAAY;wBACtC,aAAa,EAAE,WAAW,CAAC,aAAa;qBACzC,CAAC;oBACF,GAAG,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC;iBAC7C,CAAC,CAAA;gBACF,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAA;YAC3B,CAAC;YACD,MAAM,OAAO,GAAG,wBAAwB,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC/D,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE;oBAC3C,YAAY,EAAE,KAAK,IAAI,EAAE;wBACvB,MAAM,UAAU,CAAC,WAAW,EAAE,CAAA;wBAC9B,MAAM,SAAS,CAAC,WAAW,EAAE,CAAA;oBAC/B,CAAC;iBACF,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,QAAuC,CAAA;gBAC3C,IAAI,CAAC;oBACH,QAAQ,GAAG,iBAAiB,CAC1B,MAAM,sBAAsB,CAAC,SAAS,CAAC,EACvC,QAAQ,CACT,CAAA;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAA;gBACtB,CAAC;gBACD,OAAO,QAAQ;oBACb,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE;oBACjD,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;YACpC,CAAC;YACD,OAAO,IAAI;gBACT,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE;gBACpC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QAC3B,CAAC,CACF,CAAA;QACD,OAAO,EAAE,MAAM,EAAE,CAAA;IACnB,CAAC,CACF,CAAA;AACH,CAAC"}