@harperfast/harper 5.1.20 → 5.2.0-alpha.5

package/dist/components/operationsValidation.js

@@ -8,8 +8,12 @@ const hdbLogger = require("../utility/logging/harper_logger.js");
 const configUtils = require("../config/configUtils.js");
 const { hdbErrors } = require("../utility/errors/hdbError.js");
 const { HDB_ERROR_MSGS } = hdbErrors;
+const { ENV_ENCRYPTED_PREFIX } = require("../utility/envFile.js");
 // File name can only be alphanumeric, dash and underscores
 const PROJECT_FILE_NAME_REGEX = /^[a-zA-Z0-9-_]+$/;
+// dotenv's accepted key character set. Restricting keys to this prevents a crafted key (e.g. one
+// containing `=` or a newline) from injecting extra assignments into a .env file.
+const ENV_KEY_REGEX = /^[\w.-]+$/;
 module.exports = {
     getDropCustomFunctionValidator,
     setCustomFunctionValidator,
@@ -20,6 +24,12 @@ module.exports = {
     setComponentFileValidator,
     getComponentFileValidator,
     dropComponentFileValidator,
+    getEnvKeysValidator,
+    setEnvValueValidator,
+    deleteEnvValueValidator,
+    setSecretValidator,
+    grantSecretValidator,
+    deleteSecretValidator,
 };
 /**
  * Check to see if a project dir exists in the custom functions dir.
@@ -150,6 +160,126 @@ function getComponentFileValidator(req) {
     });
     return validator.validateBySchema(req, getCompSchema);
 }
+/**
+ * Validate get_env_keys requests. `file` is optional and defaults to `.env` in the handler.
+ * @param req
+ * @returns {*}
+ */
+function getEnvKeysValidator(req) {
+    const schema = Joi.object({
+        // Patterned like the env writers (not the looser getComponentFile) so a `project` containing
+        // `..` can't traverse out of the components root when joined in resolveEnvFilePath.
+        project: Joi.string()
+            .pattern(PROJECT_FILE_NAME_REGEX)
+            .required()
+            .messages({ 'string.pattern.base': HDB_ERROR_MSGS.BAD_PROJECT_NAME }),
+        file: Joi.string().custom(checkFilePath).optional(),
+    });
+    return validator.validateBySchema(req, schema);
+}
+/**
+ * Validate set_env_value requests: exactly one of (`key` + `value`) or `values` (a key→value map).
+ * @param req
+ * @returns {*}
+ */
+function setEnvValueValidator(req) {
+    const schema = Joi.object({
+        project: Joi.string()
+            .pattern(PROJECT_FILE_NAME_REGEX)
+            .required()
+            .messages({ 'string.pattern.base': HDB_ERROR_MSGS.BAD_PROJECT_NAME }),
+        file: Joi.string().custom(checkFilePath).optional(),
+        key: Joi.string().pattern(ENV_KEY_REGEX),
+        value: Joi.string().allow(''),
+        // `.unknown(false)` rejects keys that don't match ENV_KEY_REGEX. Without it the schema-wide
+        // `allowUnknown: true` (see validateBySchema) would let an invalid key (e.g. with a space or
+        // newline) pass through unvalidated and corrupt the file.
+        values: Joi.object().pattern(ENV_KEY_REGEX, Joi.string().allow('')).unknown(false),
+    })
+        .with('key', 'value')
+        .with('value', 'key')
+        .xor('key', 'values');
+    return validator.validateBySchema(req, schema);
+}
+/**
+ * Validate delete_env_value requests: exactly one of `key` or `keys` (an array of key names).
+ * @param req
+ * @returns {*}
+ */
+function deleteEnvValueValidator(req) {
+    const schema = Joi.object({
+        project: Joi.string()
+            .pattern(PROJECT_FILE_NAME_REGEX)
+            .required()
+            .messages({ 'string.pattern.base': HDB_ERROR_MSGS.BAD_PROJECT_NAME }),
+        file: Joi.string().custom(checkFilePath).optional(),
+        key: Joi.string().pattern(ENV_KEY_REGEX),
+        keys: Joi.array().items(Joi.string().pattern(ENV_KEY_REGEX)).min(1),
+    }).xor('key', 'keys');
+    return validator.validateBySchema(req, schema);
+}
+// A secret name doubles as an env key when materialized, so it is held to the same character set.
+const SECRET_NAME = Joi.string()
+    .pattern(ENV_KEY_REGEX)
+    .required()
+    .messages({ 'string.pattern.base': `'name' must only contain word characters, dots and dashes` });
+// The encrypted-value marker followed by a base64url envelope body (structural validation of the
+// decoded JSON happens in the handler via parseEnvelopeFields). Derived from the shared prefix
+// constant so validator and handler can't drift; the prefix contains no regex metacharacters.
+// Trailing `=` padding is tolerated — some browser encoders emit padded base64url, and Node's
+// base64url decoder accepts either form.
+const SECRET_ENVELOPE_REGEX = new RegExp(`^${ENV_ENCRYPTED_PREFIX}[A-Za-z0-9_-]+={0,2}$`);
+// Size cap for secret values and envelopes: rows live forever in a replicated, audited system
+// table, so unbounded payloads are a storage/replication hazard, not a feature.
+const SECRET_MAX_LENGTH = 256 * 1024;
+/**
+ * Validate set_secret requests: `name` plus exactly one of `value` (plaintext) or `envelope`
+ * (`enc:v1:` ciphertext), with optional `metadata`, and a tier of either `processEnv` or `grants`
+ * (the handler rejects the two together — a processEnv secret is global, so scoping it is meaningless).
+ * @param req
+ * @returns {*}
+ */
+function setSecretValidator(req) {
+    const schema = Joi.object({
+        name: SECRET_NAME,
+        value: Joi.string().allow('').max(SECRET_MAX_LENGTH),
+        envelope: Joi.string()
+            .max(SECRET_MAX_LENGTH)
+            .pattern(SECRET_ENVELOPE_REGEX)
+            .messages({ 'string.pattern.base': `'envelope' must be an '${ENV_ENCRYPTED_PREFIX}' base64url envelope` }),
+        // Modest structural caps: metadata is a small free-form label object, not a payload store,
+        // and grants is a set (explicit duplicates rejected here; write paths also dedupe dirty state).
+        metadata: Joi.object().max(100),
+        grants: Joi.array().items(Joi.string().min(1)).max(100).unique(),
+        // process.env delivery tier; mutually exclusive with grants (enforced in the handler so the
+        // check also covers a grants add against an already-processEnv stored row).
+        processEnv: Joi.boolean(),
+    }).xor('value', 'envelope');
+    return validator.validateBySchema(req, schema);
+}
+/**
+ * Validate grant_secret / revoke_secret requests (same shape: `name` + `component`).
+ * @param req
+ * @returns {*}
+ */
+function grantSecretValidator(req) {
+    const schema = Joi.object({
+        name: SECRET_NAME,
+        component: Joi.string().min(1).required(),
+    });
+    return validator.validateBySchema(req, schema);
+}
+/**
+ * Validate delete_secret requests.
+ * @param req
+ * @returns {*}
+ */
+function deleteSecretValidator(req) {
+    const schema = Joi.object({
+        name: SECRET_NAME,
+    });
+    return validator.validateBySchema(req, schema);
+}
 /**
  * Validate addCustomFunctionProject requests.
  * @param req
@@ -228,6 +358,31 @@ function deployComponentValidator(req) {
         })
             .optional()
             .messages({ 'any.invalid': 'urlPath must not contain ".."' }),
+        // Private-registry auth. Each entry supplies its credential exactly one of two ways:
+        //   - `token`: a literal token, used only for this node's npm pack/install and never
+        //     persisted or replicated (stripped from req before replicateOperation).
+        //   - `secret`: the name of an hdb_secret row (#1550); the token is resolved by decrypting
+        //     that row on this node at deploy time, so the credential lives in the secrets store
+        //     (reference, not embed) instead of travelling in the operation body.
+        registryAuth: Joi.array()
+            .items(Joi.object({
+            // registry and token are written verbatim into the transient .npmrc, which is
+            // line-based; forbid CR/LF so a super_user can't inject extra npm config lines.
+            // (registry also accepts bare hosts and //host/ forms, so a strict URI validator
+            // would reject supported inputs — the newline guard is the right scope here.)
+            registry: Joi.string()
+                .pattern(/^[^\r\n]+$/)
+                .required(),
+            token: Joi.string().pattern(/^[^\r\n]+$/),
+            // A reference into the hdb_secret store; same name grammar as set_secret's `name`.
+            secret: Joi.string()
+                .pattern(ENV_KEY_REGEX)
+                .messages({ 'string.pattern.base': `'secret' must only contain word characters, dots and dashes` }),
+            scope: Joi.string()
+                .pattern(/^@[a-z0-9-_.]+$/)
+                .optional(),
+        }).xor('token', 'secret'))
+            .optional(),
     }).with('urlPath', 'package');
     return validator.validateBySchema(req, deployProjSchema);
 }

package/dist/components/operationsValidation.js.map

@@ -1 +1 @@
-{"version":3,"file":"operationsValidation.js","sourceRoot":"","sources":["../../components/operationsValidation.js"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,oCAAoC,CAAC,CAAC;AAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;AACnD,MAAM,SAAS,GAAG,OAAO,CAAC,qCAAqC,CAAC,CAAC;AACjE,MAAM,WAAW,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;AACxD,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;AAC/D,MAAM,EAAE,cAAc,EAAE,GAAG,SAAS,CAAC;AAErC,2DAA2D;AAC3D,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAEnD,MAAM,CAAC,OAAO,GAAG;IAChB,8BAA8B;IAC9B,0BAA0B;IAC1B,qBAAqB;IACrB,kCAAkC;IAClC,yBAAyB;IACzB,wBAAwB;IACxB,yBAAyB;IACzB,yBAAyB;IACzB,0BAA0B;CAC1B,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO;IACxD,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAC/E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,IAAI,WAAW,EAAE,CAAC;gBACjB,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;YACnD,CAAC;YAED,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YACjB,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;IACvD,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,IAAI,EAAE,OAAO;IACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO;IACpD,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;IACvD,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,8BAA8B,CAAC,GAAG;IAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aAC3C,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACtE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE;QACxD,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE;aAChB,OAAO,CAAC,uBAAuB,CAAC;aAChC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;aACzD,MAAM,CAAC,aAAa,CAAC;aACrB,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,aAAa,EAAE,CAAC;KACnE,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,0BAA0B,CAAC,GAAG;IACtC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aAC3C,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACtE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE;QACxD,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QACnD,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,GAAG;IACrC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACtE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QACnD,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC1C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE;KAChH,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAG;IACtC,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC;QACjC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACtE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;KACnD,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAG;IACrC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QACnD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE;KAChH,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,GAAG;IACjC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;aAC5C,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACtE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACxC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACxC,qBAAqB,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC/C,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,kCAAkC,CAAC,GAAG;IAC9C,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC;QACjC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aAC3C,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;KACtE,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,GAAG;IACrC,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,CAAC;QACpC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACtE,iBAAiB,EAAE,GAAG,CAAC,OAAO,EAAE;QAChC,aAAa,EAAE,GAAG,CAAC,OAAO,EAAE;KAC5B,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,GAAG;IACpC,MAAM,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC;QACnC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACtE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;QACxF,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACxC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACxC,qBAAqB,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/C,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAClD,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,yBAAyB,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACnD,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,GAAG,CAAC,CAAC,CAAC;aACN,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC1B,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAC9D,OAAO,KAAK,CAAC;QACd,CAAC,CAAC;aACD,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,aAAa,EAAE,+BAA+B,EAAE,CAAC;KAC9D,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAE9B,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"operationsValidation.js","sourceRoot":"","sources":["../../components/operationsValidation.js"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,oCAAoC,CAAC,CAAC;AAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;AACnD,MAAM,SAAS,GAAG,OAAO,CAAC,qCAAqC,CAAC,CAAC;AACjE,MAAM,WAAW,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;AACxD,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;AAC/D,MAAM,EAAE,cAAc,EAAE,GAAG,SAAS,CAAC;AACrC,MAAM,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAElE,2DAA2D;AAC3D,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAEnD,iGAAiG;AACjG,kFAAkF;AAClF,MAAM,aAAa,GAAG,WAAW,CAAC;AAElC,MAAM,CAAC,OAAO,GAAG;IAChB,8BAA8B;IAC9B,0BAA0B;IAC1B,qBAAqB;IACrB,kCAAkC;IAClC,yBAAyB;IACzB,wBAAwB;IACxB,yBAAyB;IACzB,yBAAyB;IACzB,0BAA0B;IAC1B,mBAAmB;IACnB,oBAAoB;IACpB,uBAAuB;IACvB,kBAAkB;IAClB,oBAAoB;IACpB,qBAAqB;CACrB,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO;IACxD,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAC/E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,IAAI,WAAW,EAAE,CAAC;gBACjB,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;YACnD,CAAC;YAED,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YACjB,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;IACvD,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,IAAI,EAAE,OAAO;IACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO;IACpD,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;IACvD,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,8BAA8B,CAAC,GAAG;IAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aAC3C,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACtE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE;QACxD,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE;aAChB,OAAO,CAAC,uBAAuB,CAAC;aAChC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;aACzD,MAAM,CAAC,aAAa,CAAC;aACrB,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,aAAa,EAAE,CAAC;KACnE,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,0BAA0B,CAAC,GAAG;IACtC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aAC3C,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACtE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE;QACxD,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QACnD,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,GAAG;IACrC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACtE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QACnD,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC1C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE;KAChH,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAG;IACtC,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC;QACjC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACtE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;KACnD,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAG;IACrC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QACnD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE;KAChH,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAG;IAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACzB,6FAA6F;QAC7F,oFAAoF;QACpF,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACtE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;KACnD,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,GAAG;IAChC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACzB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACtE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QACnD,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;QACxC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,4FAA4F;QAC5F,6FAA6F;QAC7F,0DAA0D;QAC1D,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;KAClF,CAAC;SACA,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC;SACpB,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC;SACpB,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAEvB,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,GAAG;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACzB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACtE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;QACnD,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;QACxC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACnE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEtB,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,kGAAkG;AAClG,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE;KAC9B,OAAO,CAAC,aAAa,CAAC;KACtB,QAAQ,EAAE;KACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,2DAA2D,EAAE,CAAC,CAAC;AAEnG,iGAAiG;AACjG,+FAA+F;AAC/F,8FAA8F;AAC9F,8FAA8F;AAC9F,yCAAyC;AACzC,MAAM,qBAAqB,GAAG,IAAI,MAAM,CAAC,IAAI,oBAAoB,uBAAuB,CAAC,CAAC;AAE1F,8FAA8F;AAC9F,gFAAgF;AAChF,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAC;AAErC;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,GAAG;IAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACpD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;aACpB,GAAG,CAAC,iBAAiB,CAAC;aACtB,OAAO,CAAC,qBAAqB,CAAC;aAC9B,QAAQ,CAAC,EAAE,qBAAqB,EAAE,0BAA0B,oBAAoB,sBAAsB,EAAE,CAAC;QAC3G,2FAA2F;QAC3F,gGAAgG;QAChG,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;QAC/B,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;QAChE,4FAA4F;QAC5F,4EAA4E;QAC5E,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE;KACzB,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAE5B,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,GAAG;IAChC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACzC,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,GAAG;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,WAAW;KACjB,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,GAAG;IACjC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;aAC5C,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACtE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACxC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACxC,qBAAqB,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC/C,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,kCAAkC,CAAC,GAAG;IAC9C,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC;QACjC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aAC3C,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;KACtE,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,GAAG;IACrC,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,CAAC;QACpC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACtE,iBAAiB,EAAE,GAAG,CAAC,OAAO,EAAE;QAChC,aAAa,EAAE,GAAG,CAAC,OAAO,EAAE;KAC5B,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,GAAG;IACpC,MAAM,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC;QACnC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,OAAO,CAAC,uBAAuB,CAAC;aAChC,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,qBAAqB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACtE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;QACxF,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACxC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACxC,qBAAqB,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/C,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAClD,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,yBAAyB,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACnD,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;aACnB,GAAG,CAAC,CAAC,CAAC;aACN,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC1B,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAC9D,OAAO,KAAK,CAAC;QACd,CAAC,CAAC;aACD,QAAQ,EAAE;aACV,QAAQ,CAAC,EAAE,aAAa,EAAE,+BAA+B,EAAE,CAAC;QAC9D,qFAAqF;QACrF,qFAAqF;QACrF,6EAA6E;QAC7E,2FAA2F;QAC3F,yFAAyF;QACzF,0EAA0E;QAC1E,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE;aACvB,KAAK,CACL,GAAG,CAAC,MAAM,CAAC;YACV,8EAA8E;YAC9E,gFAAgF;YAChF,iFAAiF;YACjF,8EAA8E;YAC9E,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;iBACpB,OAAO,CAAC,YAAY,CAAC;iBACrB,QAAQ,EAAE;YACZ,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;YACzC,mFAAmF;YACnF,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;iBAClB,OAAO,CAAC,aAAa,CAAC;iBACtB,QAAQ,CAAC,EAAE,qBAAqB,EAAE,6DAA6D,EAAE,CAAC;YACpG,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE;iBACjB,OAAO,CAAC,iBAAiB,CAAC;iBAC1B,QAAQ,EAAE;SACZ,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CACzB;aACA,QAAQ,EAAE;KACZ,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAE9B,OAAO,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;AAC1D,CAAC"}

package/dist/components/secretOperations.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Upsert a secret. Exactly one of `value` (plaintext, encrypted immediately — requires custody)
+ * or `envelope` (`enc:v1:...` ciphertext, encrypted client-side against get_secrets_public_key).
+ * `kid` is derived from the envelope server-side; a client-supplied kid field is never trusted.
+ * Never returns or logs plaintext.
+ *
+ * The delivery tier is explicit and mutually exclusive (a process-env secret is already global, so
+ * scoping it is meaningless):
+ *   - `processEnv: true` — materialized into the real `process.env` at component load, inherited by
+ *     child processes (`.env` semantics). No isolation promise.
+ *   - `grants: [...]` — scoped: never in `process.env`, exposed only to the listed components via the
+ *     `secrets` accessor.
+ * Both default to the stored row so a value rotation preserves the tier without re-specifying it.
+ */
+export declare function setSecret(req: any): Promise<{
+    name: any;
+    kid: string;
+    created: boolean;
+}>;
+/** Add a component to a secret's grants list (idempotent). */
+export declare function grantSecret(req: any): Promise<{
+    name: any;
+    grants: string[];
+    changed: boolean;
+}>;
+/** Remove a component from a secret's grants list (idempotent). */
+export declare function revokeSecret(req: any): Promise<{
+    name: any;
+    grants: string[];
+    changed: boolean;
+}>;
+/**
+ * List secret metadata: never envelopes, never values. Includes the node's current custody
+ * fingerprint (null when custody is absent) and a per-row kid_matches_custody flag so stale rows
+ * on a cloned/rekeyed node are immediately visible.
+ */
+export declare function listSecrets(req: any): Promise<{
+    secrets: any[];
+    custody_fingerprint: string;
+}>;
+/** Delete a secret row. Not cryptographic erasure — audit/txn logs and backups retain envelopes. */
+export declare function deleteSecret(req: any): Promise<{
+    message: string;
+}>;
+/** The cluster secrets public key, for client-side envelope encryption. */
+export declare function getSecretsPublicKey(req: any): {
+    public_key: string;
+    fingerprint: string;
+};
+/** A resolved registry-auth entry as consumed by the transient .npmrc writer. */
+export interface ResolvedRegistryAuthEntry {
+    registry: string;
+    token: string;
+    scope?: string;
+}
+/** A registry-auth entry after ingestion: a reference into hdb_secret, never a token. */
+export interface RegistryAuthReference {
+    registry: string;
+    secret: string;
+    scope?: string;
+}
+/**
+ * Deterministic name for the auto-minted secret backing a literal registry token: keyed by the
+ * deploying component and the registry, so re-supplying (or rotating) the token on a later deploy
+ * overwrites the same row rather than accumulating one per deploy. Sanitized to the set_secret name
+ * grammar (`\w.-`), since a registry can carry a scheme, port, or path.
+ */
+export declare function deriveRegistrySecretName(component: string, registry: string): string;
+/**
+ * Ingest deploy_component `registryAuth` into the secrets store so a provided registry token lives
+ * as ciphertext in the replicated, audited `hdb_secret` store (reference, not embed) rather than
+ * travelling in the operation body. Returns the entries in reference form (`{ registry, secret }`).
+ *
+ * - A literal `{ registry, token }` entry is encrypted (via `set_secret`, custody required) under a
+ *   derived name granted to `component`, and returned as a reference. Overwrites an existing
+ *   derived row so token rotation is idempotent.
+ * - An already-reference `{ registry, secret }` entry passes through unchanged (peers re-running a
+ *   replicated deploy already carry references — they never re-ingest).
+ * - With no custody on this node (OSS core, or key not held here), literal tokens CANNOT be sealed;
+ *   they pass through untouched so the caller can fall back to the transient, this-node-only path.
+ *   The reference-form result therefore contains only entries the caller may persist and replicate.
+ *
+ * Runs on the deploying main thread where custody is registered.
+ */
+export declare function ingestRegistryAuth(req: any, registryAuth: any[] | undefined, component: string): Promise<any[]>;
+/**
+ * Resolve deploy_component `registryAuth` entries that reference a stored secret
+ * (`{ registry, secret }`) into concrete token entries (`{ registry, token }`) by decrypting the
+ * named hdb_secret row on this thread. Entries that already carry a literal `token` pass through
+ * unchanged, so this is a no-op for the token-only fallback form.
+ *
+ * This is intentionally NOT a `get_secret` operation — the store never returns plaintext across the
+ * API boundary. The resolved token is handed back to the install path in-memory, fed to the
+ * transient .npmrc, and never written back to the request body, replicated, or logged.
+ *
+ * Authority mirrors the accessor model (#1550): the referenced secret must be usable by the
+ * component being deployed — either a `processEnv` (global) secret or a scoped secret granted to
+ * `component`. Without that, the deploy path would let a super_user pull an arbitrary scoped secret
+ * into an .npmrc, sidestepping the grant that is the store's authority. A missing row, missing
+ * grant, absent custody, or decrypt failure throws a ClientError naming the precise reason.
+ *
+ * `options.waitMs` gives a bounded grace period for a referenced row to replicate in (used on the
+ * peer side of a replicated deploy, where the deploy op can arrive just ahead of the hdb_secret
+ * row); it defaults to 0 (the origin wrote the row before it resolves, so no wait is needed).
+ *
+ * Runs on the main thread, where the operations API dispatches deploys and the Pro secrets
+ * component registers custody — the same place set_secret decrypts. On a node without custody
+ * (OSS core, or a custody key not held here) a referenced secret cannot be resolved and the deploy
+ * fails loudly rather than silently installing without auth.
+ */
+export declare function resolveRegistryAuth(registryAuth: any[] | undefined, component: string, options?: {
+    waitMs?: number;
+}): Promise<ResolvedRegistryAuthEntry[] | undefined>;