@heychunky/core 0.1.0

package/dist/admin/run.js

@@ -0,0 +1,218 @@
+/**
+ * Execute one registry action.
+ *
+ * The registry says what exists and what it costs; this says how to perform it.
+ * They are separate so `registry.ts` stays isomorphic — an app, or a web UI,
+ * can list what the factory can do without pulling twelve Node clients into
+ * its bundle.
+ *
+ * Credentials are resolved here and handed to the client, never read from the
+ * environment inside one. That is what lets a worker run two apps at once.
+ */
+import { findAction } from "../registry.js";
+import { github } from "./services/github.js";
+import { vercel } from "./services/vercel.js";
+import { neon } from "./services/neon.js";
+import { cloudflare } from "./services/cloudflare.js";
+import { bunny } from "./services/bunny.js";
+import { resend } from "./services/resend.js";
+import { agentmail } from "./services/agentmail.js";
+import { elevenlabs } from "./services/elevenlabs.js";
+import { aiGateway } from "./services/ai-gateway.js";
+import { togetherai } from "./services/togetherai.js";
+import { fireworks } from "./services/fireworks.js";
+import { firecrawl } from "./services/firecrawl.js";
+import { db } from "./services/db.js";
+import { folderFor } from "./syncenv.js";
+/** Which env var each service's factory key is stored under. */
+export const KEY_FOR = {
+    github: "GH_TOKEN",
+    vercel: "VERCEL_TOKEN",
+    neon: "NEON_API_KEY",
+    cloudflare: "CLOUDFLARE_API_TOKEN",
+    resend: "RESEND_API_KEY",
+    agentmail: "AGENTMAIL_API_KEY",
+    bunny: "BUNNY_API_KEY",
+    elevenlabs: "ELEVENLABS_API_KEY",
+    "ai-gateway": "AI_GATEWAY_API_KEY",
+    togetherai: "TOGETHER_API_KEY",
+    fireworks: "FIREWORKS_API_KEY",
+    firecrawl: "FIRECRAWL_API_KEY",
+};
+/** Every client, built from a token. */
+const CLIENTS = {
+    github, vercel, neon, cloudflare, bunny, resend,
+    agentmail, elevenlabs, "ai-gateway": aiGateway,
+    togetherai, fireworks, firecrawl,
+};
+/** A write aimed at production without the separate opt-in. */
+export class ProductionWriteError extends Error {
+    action;
+    constructor(action) {
+        super(`${action.service} ${action.action} would change production data. ` +
+            `That needs its own opt-in, not only --confirm.`);
+        this.name = "ProductionWriteError";
+        this.action = action;
+    }
+}
+export class GateError extends Error {
+    action;
+    constructor(action) {
+        super(action.gate === "danger"
+            ? `${action.service} ${action.action} is destructive and needs an explicit confirmation. ` +
+                `It ${action.summary.toLowerCase()}.`
+            : `${action.service} ${action.action} changes something and needs confirmation.`);
+        this.name = "GateError";
+        this.action = action;
+    }
+}
+export class UnknownActionError extends Error {
+    constructor(service, action) {
+        super(`No action "${action}" on ${service}`);
+        this.name = "UnknownActionError";
+    }
+}
+/**
+ * Build a client for an `app`-tier action: the app's own database, reached by
+ * its connection string rather than by any factory key.
+ */
+async function appClientFor(service, ctx) {
+    if (service !== "neon")
+        throw new Error(`No app-tier client for service "${service}"`);
+    if (!ctx.app) {
+        throw new Error("This action reads one app's data, so it needs an app and an environment.");
+    }
+    const ref = `${folderFor(ctx.app.name, ctx.app.environment)}DATABASE_URL`;
+    return db(await ctx.secrets.get(ref));
+}
+/** Build a service's client with its credential resolved from the store. */
+async function clientFor(service, ctx) {
+    const envVar = KEY_FOR[service];
+    if (!envVar)
+        throw new Error(`No credential mapping for service "${service}"`);
+    const token = await ctx.secrets.get(ctx.reference(envVar));
+    const make = CLIENTS[service];
+    if (!make)
+        throw new Error(`No client for service "${service}"`);
+    return make(token);
+}
+const PERFORM = {
+    "github list-repos": (c) => c.listRepos(),
+    "github list-public-repos": (c) => c.listPublicRepos(),
+    "github create-repo": (c, a) => c.createRepo(a[0], { org: a[1] }),
+    "github delete-repo": (c, a) => c.deleteRepo(a[0], { confirmed: true }),
+    "github create-branch": (c, a) => c.createBranch(a[0], a[1], a[2] ?? "main"),
+    "vercel list-projects": (c) => c.projects(),
+    "vercel list-deployments": (c, a) => c.deployments(a[0]),
+    "vercel list-env-keys": (c, a) => c.envVars(a[0]),
+    "vercel create-project": (c, a) => c.createProject(a[0], { repo: a[1] }),
+    "vercel set-env-var": (c, a) => c.setEnv(a[0], a[1], a[2], { target: a[3] ?? "production" }),
+    "neon list-projects": (c) => c.projects(),
+    "neon list-branches": (c, a) => c.branches(a[0]),
+    "neon create-project": (c, a) => c.createProject(a[0]),
+    "neon create-branch": (c, a) => c.createBranch(a[0], a[1], a[2]),
+    "neon reset-branch": (c, a) => c.resetFromParent(a[0], a[1], { confirmed: true }),
+    "resend create-domain": (c, a) => c.createDomain(a[0]),
+    "resend verify-domain": (c, a) => c.verifyDomain(a[0]),
+    "resend create-sending-key": (c, a) => c.createSendingKey(a[0], a[1]),
+    "cloudflare set-dns-record": (c, a) => c.setDnsRecord(a[0], { type: a[1], name: a[2], content: a[3], ...(a[4] ? { priority: Number(a[4]) } : {}) }),
+    "vercel list-domains": async (c, a) => c.projectDomains((await c.findProject(a[0]))?.id, await c.teamId()),
+    "vercel add-domain": async (c, a) => c.addDomain((await c.findProject(a[0]))?.id, a[1], await c.teamId()),
+    "vercel create-deployment": async (c, a) => c.deploy(a[0], { repo: a[1], ref: a[2] ?? "production", target: a[3] ?? "production", teamId: await c.teamId() }),
+    "vercel promote-deployment": async (c, a) => c.promote((await c.findProject(a[0]))?.id, a[1], await c.teamId()),
+    "neon delete-branch": (c, a) => c.deleteBranch(a[0], a[1], { confirmed: true }),
+    "neon list-tables": (c) => c.tables(),
+    "neon list-columns": (c, a) => c.columns(a[0]),
+    "neon run-query": (c, a) => c.query(a[0]),
+    "neon run-write": (c, a) => c.write(a[0]),
+    "cloudflare list-zones": (c) => c.zones(),
+    "cloudflare list-dns-records": (c, a) => c.dnsRecords(a[0]),
+    "resend list-domains": (c) => c.domains(),
+    "resend list-keys": (c) => c.apiKeys(),
+    "agentmail list-inboxes": (c) => c.inboxes(),
+    "agentmail list-domains": (c) => c.domains(),
+    "bunny list-zones": (c) => c.storageZones(),
+    "bunny list-app-zones": (c, a) => c.zonesForApp(a[0]),
+    "elevenlabs list-voices": (c) => c.voices(),
+    "elevenlabs list-models": (c) => c.models(),
+    "ai-gateway list-models": (c) => c.models(),
+    "ai-gateway get-credits": (c) => c.credits(),
+    "togetherai list-models": (c) => c.models(),
+    "fireworks list-models": (c) => c.models(),
+    "firecrawl get-credits": (c) => c.credits(),
+    "firecrawl scrape-url": (c, a) => c.scrape(a[0]),
+};
+/**
+ * Run an action, refusing anything gated that has not been confirmed.
+ *
+ * This is the *interface* guard — it lets a caller ask before failing. The
+ * guarantee is separate and lives in the clients, which refuse without an
+ * explicit flag whatever this decides.
+ */
+export async function runAction(service, action, args, ctx) {
+    const declared = findAction(service, action);
+    if (!declared)
+        throw new UnknownActionError(service, action);
+    if (declared.gate !== "none" && !ctx.confirmed)
+        throw new GateError(declared);
+    const perform = PERFORM[`${service} ${action}`];
+    if (!perform)
+        throw new Error(`"${service} ${action}" is declared but not wired to a client`);
+    // The registry promises production needs a separate opt-in. Enforced here
+    // rather than in the CLI, so the API cannot reach live data more easily than
+    // a terminal can.
+    if (declared.tier === "app" && declared.gate !== "none" &&
+        ctx.app?.environment === "production" && !ctx.productionWrite) {
+        throw new ProductionWriteError(declared);
+    }
+    // The tier decides which credential the action gets, which is the whole
+    // point of declaring it: `admin` acts as the factory, `app` acts inside one
+    // app's data and can reach nothing else.
+    const client = declared.tier === "app"
+        ? await appClientFor(service, ctx)
+        : await clientFor(service, ctx);
+    return perform(client, args);
+}
+/**
+ * What every key enables, in parallel.
+ *
+ * The evidence tier is the honest part: most providers will not say what a key
+ * may do, and rendering "it authenticated" the same as "these are its declared
+ * scopes" implies an assurance nobody obtained.
+ */
+export async function accessAll(ctx) {
+    return Promise.all(Object.keys(CLIENTS).map(async (service) => {
+        try {
+            const c = await clientFor(service, ctx);
+            const access = c.access;
+            if (!access)
+                throw new Error(`${service} has no access probe`);
+            return (await access());
+        }
+        catch (err) {
+            return {
+                service, ok: false, evidence: "reachability", can: [], notes: [],
+                error: err instanceof Error ? err.message.slice(0, 120) : String(err),
+            };
+        }
+    }));
+}
+/** Every service's health, in parallel. */
+export async function statusAll(ctx) {
+    return Promise.all(Object.keys(CLIENTS).map(async (service) => {
+        try {
+            const c = await clientFor(service, ctx);
+            const status = c.status;
+            if (!status)
+                throw new Error(`${service} has no status probe`);
+            return (await status());
+        }
+        catch (err) {
+            return {
+                service, ok: false, detail: "unreachable",
+                error: err instanceof Error ? err.message.slice(0, 120) : String(err),
+            };
+        }
+    }));
+}
+//# sourceMappingURL=run.js.map

package/dist/admin/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/admin/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAe,MAAM,gBAAgB,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,gEAAgE;AAChE,MAAM,CAAC,MAAM,OAAO,GAA2B;IAC7C,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,cAAc;IACtB,IAAI,EAAE,cAAc;IACpB,UAAU,EAAE,sBAAsB;IAClC,MAAM,EAAE,gBAAgB;IACxB,SAAS,EAAE,mBAAmB;IAC9B,KAAK,EAAE,eAAe;IACtB,UAAU,EAAE,oBAAoB;IAChC,YAAY,EAAE,oBAAoB;IAClC,UAAU,EAAE,kBAAkB;IAC9B,SAAS,EAAE,mBAAmB;IAC9B,SAAS,EAAE,mBAAmB;CAC/B,CAAC;AAEF,wCAAwC;AACxC,MAAM,OAAO,GAAG;IACd,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM;IAC/C,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS;IAC9C,UAAU,EAAE,SAAS,EAAE,SAAS;CACxB,CAAC;AA6BX,+DAA+D;AAC/D,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,MAAM,CAAS;IACxB,YAAY,MAAc;QACxB,KAAK,CACH,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,iCAAiC;YACjE,gDAAgD,CACnD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,MAAM,CAAS;IACxB,YAAY,MAAc;QACxB,KAAK,CACH,MAAM,CAAC,IAAI,KAAK,QAAQ;YACtB,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,sDAAsD;gBACxF,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG;YACvC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,4CAA4C,CACnF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe,EAAE,MAAc;QACzC,KAAK,CAAC,cAAc,MAAM,QAAQ,OAAO,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,GAAe;IAC1D,IAAI,OAAO,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,GAAG,CAAC,CAAC;IACvF,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,cAAc,CAAC;IAC1E,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAEnC,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,SAAS,CAAC,OAAe,EAAE,GAAe;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,GAAG,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,OAA+B,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,GAAG,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,KAAK,CAAwD,CAAC;AAC5E,CAAC;AAQD,MAAM,OAAO,GAA4B;IACvC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE;IACzC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE;IACtD,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACvE,sBAAsB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAE5E,sBAAsB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,yBAAyB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,sBAAsB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,uBAAuB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;IAE5F,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,qBAAqB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,mBAAmB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACjF,sBAAsB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,sBAAsB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,2BAA2B,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,2BAA2B,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACpC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9G,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1G,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAClC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACtE,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CACzC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACnH,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAC1C,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACpE,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC/E,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;IACrC,mBAAmB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzC,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE;IACzC,6BAA6B,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3D,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE;IACzC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE;IAEtC,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE;IAC5C,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE;IAE5C,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE;IAC3C,sBAAsB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErD,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;IAC3C,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;IAC3C,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;IAC3C,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE;IAC5C,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;IAC3C,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;IAC1C,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE;IAC3C,sBAAsB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACjD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAe,EACf,MAAc,EACd,IAAc,EACd,GAAe;IAEf,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC;IAE9E,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,OAAO,IAAI,MAAM,yCAAyC,CAAC,CAAC;IAE9F,0EAA0E;IAC1E,6EAA6E;IAC7E,kBAAkB;IAClB,IACE,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;QACnD,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,YAAY,IAAI,CAAC,GAAG,CAAC,eAAe,EAC7D,CAAC;QACD,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,wEAAwE;IACxE,4EAA4E;IAC5E,yCAAyC;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,KAAK,KAAK;QACpC,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC;QAClC,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAe;IAC7C,OAAO,OAAO,CAAC,GAAG,CAChB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACzC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;YACxB,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,sBAAsB,CAAC,CAAC;YAC/D,OAAO,CAAC,MAAM,MAAM,EAAE,CAGrB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE;gBAChE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACtE,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAe;IAC7C,OAAO,OAAO,CAAC,GAAG,CAChB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACzC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;YACxB,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,sBAAsB,CAAC,CAAC;YAC/D,OAAO,CAAC,MAAM,MAAM,EAAE,CAAqE,CAAC;QAC9F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa;gBACzC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACtE,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/admin/secrets/infisical.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Infisical as a SecretStore.
+ *
+ * References look like:
+ *   infisical://heychunky-main/main//GH_TOKEN
+ *   infisical://heychunky-apps/production/codelambs/DATABASE_URL
+ *              └─ project ──┘ └─ env ──┘ └ folder ┘ └── key ──┘
+ *
+ * The folder segment may be empty (two slashes) for secrets at the root of an
+ * environment, which is how the factory project is laid out — one environment,
+ * no folders.
+ *
+ * Written against `fetch` rather than @infisical/sdk on purpose: the Core ships
+ * to other people, and a secrets library should not drag a dependency tree
+ * behind it. The API surface used here is three endpoints.
+ */
+import type { SecretStore } from "../../secrets/store.ts";
+export interface InfisicalRef {
+    project: string;
+    environment: string;
+    /** Folder path without leading slash. Empty string means the root. */
+    folder: string;
+    key: string;
+}
+export declare class InfisicalError extends Error {
+    readonly status: number | undefined;
+    constructor(message: string, status?: number);
+}
+/** Parse `infisical://project/environment/folder/KEY`. */
+export declare function parseInfisicalRef(raw: string): InfisicalRef;
+export interface InfisicalCredentials {
+    clientId: string;
+    clientSecret: string;
+    /** Override for self-hosted instances. */
+    host?: string;
+}
+/**
+ * A SecretStore backed by Infisical.
+ *
+ * Authenticates lazily on first use and reuses the access token for the
+ * lifetime of the process — one login per run rather than one per secret.
+ * Project slugs are resolved to ids once and cached for the same reason.
+ */
+export declare function infisicalStore(creds: InfisicalCredentials): SecretStore;
+//# sourceMappingURL=infisical.d.ts.map

package/dist/admin/secrets/infisical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infisical.d.ts","sourceRoot":"","sources":["../../../src/admin/secrets/infisical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAI1D,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;gBAExB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAK7C;AAED,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAO3D;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,oBAAoB,GAAG,WAAW,CAmLvE"}

package/dist/admin/secrets/infisical.js

@@ -0,0 +1,182 @@
+const DEFAULT_HOST = "https://app.infisical.com";
+export class InfisicalError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.name = "InfisicalError";
+        this.status = status;
+    }
+}
+/** Parse `infisical://project/environment/folder/KEY`. */
+export function parseInfisicalRef(raw) {
+    const m = /^infisical:\/\/([^/]+)\/([^/]+)\/(.*)\/([^/]+)$/.exec(raw.trim());
+    if (!m)
+        throw new InfisicalError(`Not an infisical:// reference: ${raw}`);
+    const [, project, environment, folder, key] = m;
+    return { project, environment, folder, key };
+}
+/**
+ * A SecretStore backed by Infisical.
+ *
+ * Authenticates lazily on first use and reuses the access token for the
+ * lifetime of the process — one login per run rather than one per secret.
+ * Project slugs are resolved to ids once and cached for the same reason.
+ */
+export function infisicalStore(creds) {
+    const host = creds.host ?? DEFAULT_HOST;
+    let token;
+    const projectIds = new Map();
+    async function login() {
+        const res = await fetch(`${host}/api/v1/auth/universal-auth/login`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                clientId: creds.clientId,
+                clientSecret: creds.clientSecret,
+            }),
+        });
+        if (!res.ok) {
+            throw new InfisicalError(`Infisical login failed (${res.status}). Check the client id and secret ` +
+                `for this identity, and that it has not been locked out.`, res.status);
+        }
+        const body = (await res.json());
+        if (!body.accessToken)
+            throw new InfisicalError("Login returned no access token");
+        return body.accessToken;
+    }
+    async function auth() {
+        token ??= login();
+        return token;
+    }
+    async function api(path, init = {}) {
+        const method = init.method ?? "GET";
+        const res = await fetch(`${host}${path}`, {
+            method,
+            headers: {
+                authorization: `Bearer ${await auth()}`,
+                ...(init.body ? { "content-type": "application/json" } : {}),
+            },
+            ...(init.body ? { body: JSON.stringify(init.body) } : {}),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            throw new InfisicalError(`${method} ${path} → ${res.status}${text ? `: ${text.slice(0, 200)}` : ""}`, res.status);
+        }
+        return (await res.json());
+    }
+    /** Project slug → id. Cached: the id never changes for a given slug. */
+    async function projectId(slug) {
+        let hit = projectIds.get(slug);
+        if (!hit) {
+            hit = (async () => {
+                const body = await api("/api/v1/workspace");
+                const found = (body.workspaces ?? []).find((w) => w.slug === slug || w.name === slug);
+                if (!found) {
+                    const names = (body.workspaces ?? []).map((w) => w.slug).join(", ");
+                    throw new InfisicalError(`No Infisical project "${slug}" visible to this identity. ` +
+                        `It can see: ${names || "none"}. Check the identity is added to the project.`);
+                }
+                return found.id;
+            })();
+            projectIds.set(slug, hit);
+        }
+        return hit;
+    }
+    return {
+        owns(ref) {
+            return ref.trimStart().startsWith("infisical://");
+        },
+        async get(ref) {
+            const { project, environment, folder, key } = parseInfisicalRef(ref);
+            const id = await projectId(project);
+            const path = folder ? `/${folder}` : "/";
+            const query = new URLSearchParams({
+                workspaceId: id,
+                environment,
+                secretPath: path,
+            });
+            const body = await api(`/api/v3/secrets/raw/${encodeURIComponent(key)}?${query}`);
+            const value = body.secret?.secretValue;
+            if (value === undefined) {
+                throw new InfisicalError(`No secret "${key}" at ${project}/${environment}${path}`);
+            }
+            return value;
+        },
+        /**
+         * Every secret in one folder.
+         *
+         * The prefix names the folder, so it ends where a key would begin:
+         * `infisical://heychunky-apps/production/carmelcity/`. Asking for a value
+         * instead is a caller error rather than an empty result.
+         */
+        async list(prefix) {
+            const trimmed = prefix.trimStart();
+            if (!trimmed.endsWith("/")) {
+                throw new InfisicalError(`Not a folder reference: ${prefix} — it must end with "/"`);
+            }
+            const { project, environment, folder } = parseInfisicalRef(`${trimmed}_`);
+            const id = await projectId(project);
+            const query = new URLSearchParams({
+                workspaceId: id,
+                environment,
+                secretPath: folder ? `/${folder}` : "/",
+            });
+            // A folder holding nothing does not exist, as far as Infisical is
+            // concerned — it is created by the first secret put in it. An app that
+            // has no values for an environment is an ordinary state, not an error,
+            // so an absent folder lists as empty rather than throwing.
+            let body;
+            try {
+                body = await api(`/api/v3/secrets/raw?${query}`);
+            }
+            catch (err) {
+                if (err instanceof InfisicalError && err.status === 404)
+                    return {};
+                throw err;
+            }
+            const out = {};
+            for (const s of body.secrets ?? [])
+                out[s.secretKey] = s.secretValue;
+            return out;
+        },
+        /**
+         * Write one value.
+         *
+         * The folder is made first. Infisical has no folder until a secret is put
+         * in one, so writing to an app's environment for the first time would
+         * otherwise fail on a path the caller has every reason to think exists.
+         *
+         * Create, then update on conflict: Infisical distinguishes the two and a
+         * caller should not have to. Idempotent either way, which is what a
+         * provisioning run that died halfway needs.
+         */
+        async set(ref, value) {
+            const { project, environment, folder, key } = parseInfisicalRef(ref);
+            const workspaceId = await projectId(project);
+            const secretPath = folder ? `/${folder}` : "/";
+            if (folder) {
+                try {
+                    await api("/api/v1/folders", {
+                        method: "POST",
+                        body: { workspaceId, environment, path: "/", name: folder },
+                    });
+                }
+                catch (err) {
+                    // Already there is the ordinary case on every write after the first.
+                    if (!(err instanceof InfisicalError) || err.status !== 400)
+                        throw err;
+                }
+            }
+            const body = { workspaceId, environment, secretPath, secretValue: value };
+            try {
+                await api(`/api/v3/secrets/raw/${encodeURIComponent(key)}`, { method: "POST", body });
+            }
+            catch (err) {
+                if (!(err instanceof InfisicalError) || err.status !== 400)
+                    throw err;
+                await api(`/api/v3/secrets/raw/${encodeURIComponent(key)}`, { method: "PATCH", body });
+            }
+        },
+    };
+}
+//# sourceMappingURL=infisical.js.map

package/dist/admin/secrets/infisical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infisical.js","sourceRoot":"","sources":["../../../src/admin/secrets/infisical.ts"],"names":[],"mappings":"AAkBA,MAAM,YAAY,GAAG,2BAA2B,CAAC;AAUjD,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,MAAM,CAAqB;IAEpC,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,0DAA0D;AAC1D,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,CAAC,GAAG,iDAAiD,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAE7C,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC/C,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,KAA2B;IACxD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,YAAY,CAAC;IACxC,IAAI,KAAkC,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEtD,KAAK,UAAU,KAAK;QAClB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,mCAAmC,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,cAAc,CACtB,2BAA2B,GAAG,CAAC,MAAM,oCAAoC;gBACvE,yDAAyD,EAC3D,GAAG,CAAC,MAAM,CACX,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA6B,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,cAAc,CAAC,gCAAgC,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,KAAK,UAAU,IAAI;QACjB,KAAK,KAAK,KAAK,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,UAAU,GAAG,CAChB,IAAY,EACZ,OAA8D,EAAE;QAEhE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;YACxC,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,IAAI,EAAE,EAAE;gBACvC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D;YACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,cAAc,CACtB,GAAG,MAAM,IAAI,IAAI,MAAM,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAC3E,GAAG,CAAC,MAAM,CACX,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IAED,wEAAwE;IACxE,KAAK,UAAU,SAAS,CAAC,IAAY;QACnC,IAAI,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE;gBAChB,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB,mBAAmB,CACpB,CAAC;gBACF,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CACxC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAC1C,CAAC;gBACF,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACpE,MAAM,IAAI,cAAc,CACtB,yBAAyB,IAAI,8BAA8B;wBACzD,eAAe,KAAK,IAAI,MAAM,+CAA+C,CAChF,CAAC;gBACJ,CAAC;gBACD,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,CAAC,CAAC,EAAE,CAAC;YACL,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO;QACL,IAAI,CAAC,GAAW;YACd,OAAO,GAAG,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QACpD,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAW;YACnB,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACrE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;gBAChC,WAAW,EAAE,EAAE;gBACf,WAAW;gBACX,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB,uBAAuB,kBAAkB,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAC1D,CAAC;YACF,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;YACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,cAAc,CACtB,cAAc,GAAG,QAAQ,OAAO,IAAI,WAAW,GAAG,IAAI,EAAE,CACzD,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD;;;;;;WAMG;QACH,KAAK,CAAC,IAAI,CAAC,MAAc;YACvB,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,cAAc,CACtB,2BAA2B,MAAM,yBAAyB,CAC3D,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;YAC1E,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;gBAChC,WAAW,EAAE,EAAE;gBACf,WAAW;gBACX,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG;aACxC,CAAC,CAAC;YACH,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,2DAA2D;YAC3D,IAAI,IAAgE,CAAC;YACrE,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,GAAG,CACd,uBAAuB,KAAK,EAAE,CAC/B,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAAE,OAAO,EAAE,CAAC;gBACnE,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE;gBAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC;YACrE,OAAO,GAAG,CAAC;QACb,CAAC;QAED;;;;;;;;;;WAUG;QACH,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;YAClC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACrE,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAE/C,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,iBAAiB,EAAE;wBAC3B,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE;qBAC5D,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,qEAAqE;oBACrE,IAAI,CAAC,CAAC,GAAG,YAAY,cAAc,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;wBAAE,MAAM,GAAG,CAAC;gBACxE,CAAC;YACH,CAAC;YAED,MAAM,IAAI,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAC1E,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,uBAAuB,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACxF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,cAAc,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAAE,MAAM,GAAG,CAAC;gBACtE,MAAM,GAAG,CAAC,uBAAuB,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/admin/services/agentmail.d.ts

@@ -0,0 +1,16 @@
+import { type ServiceAccess, type ServiceStatus } from "../../services/types.ts";
+export interface Inbox {
+    inbox_id: string;
+    email: string;
+    display_name?: string;
+}
+export declare function agentmail(token: string): {
+    inboxes: () => Promise<Inbox[]>;
+    domains: () => Promise<{
+        domain: string;
+        status: string;
+    }[]>;
+    status(): Promise<ServiceStatus>;
+    access(): Promise<ServiceAccess>;
+};
+//# sourceMappingURL=agentmail.d.ts.map

package/dist/admin/services/agentmail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentmail.d.ts","sourceRoot":"","sources":["../../../src/admin/services/agentmail.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAErG,MAAM,WAAW,KAAK;IAAG,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE;AAEjF,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM;;;gBAM2B,MAAM;gBAAU,MAAM;;cAKpE,OAAO,CAAC,aAAa,CAAC;cAQtB,OAAO,CAAC,aAAa,CAAC;EAmBzC"}

package/dist/admin/services/agentmail.js

@@ -0,0 +1,43 @@
+/**
+ * AgentMail — agent inboxes. API base is /v0, not /v1.
+ */
+import { request } from "../../http/request.js";
+import { probe, probeAccess } from "../../services/types.js";
+export function agentmail(token) {
+    const creds = { token };
+    // v0, not v1 — /v1/inboxes is a 404.
+    const BASE = "https://api.agentmail.to/v0";
+    const inboxes = async () => (await request(`${BASE}/inboxes`, { credentials: creds })).inboxes;
+    const domains = async () => (await request(`${BASE}/domains`, { credentials: creds })).domains;
+    return {
+        inboxes,
+        domains,
+        async status() {
+            return probe("agentmail", async () => {
+                const [b, d] = await Promise.all([inboxes(), domains()]);
+                const unverified = d.filter((x) => x.status !== "VERIFIED").length;
+                return `${b.length} inbox${b.length === 1 ? "" : "es"}, ${d.length} domain${d.length === 1 ? "" : "s"}` +
+                    (unverified ? ` ⚠️ ${unverified} unverified` : "");
+            });
+        },
+        async access() {
+            return probeAccess("agentmail", async () => {
+                const [b, d] = await Promise.all([inboxes(), domains()]);
+                const verified = d.filter((x) => x.status === "VERIFIED");
+                return {
+                    evidence: "identity",
+                    can: [
+                        `read and manage ${b.length} inboxes: ${b.map((x) => x.email).join(", ")}`,
+                        `send from ${verified.length} verified domains: ${verified.map((x) => x.domain).join(", ")}`,
+                        "create domains and inboxes, and read every thread on them",
+                    ],
+                    notes: [
+                        "keys can be scoped to a single inbox with granular permissions — this one is organisation-wide",
+                        "an unverified domain fails at send time, not at creation time",
+                    ],
+                };
+            });
+        },
+    };
+}
+//# sourceMappingURL=agentmail.js.map

package/dist/admin/services/agentmail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentmail.js","sourceRoot":"","sources":["../../../src/admin/services/agentmail.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,OAAO,EAAoB,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,WAAW,EAA0C,MAAM,yBAAyB,CAAC;AAIrG,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAgB,EAAE,KAAK,EAAE,CAAC;IACrC,qCAAqC;IACrC,MAAM,IAAI,GAAG,6BAA6B,CAAC;IAE3C,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,OAAO,CAAuB,GAAG,IAAI,UAAU,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACrH,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,OAAO,CAAoD,GAAG,IAAI,UAAU,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAElJ,OAAO;QACL,OAAO;QACP,OAAO;QACP,KAAK,CAAC,MAAM;YACV,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;gBACnC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;gBACzD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;gBACnE,OAAO,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;oBACrG,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,UAAU,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvD,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,MAAM;YACV,OAAO,WAAW,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;gBACzC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;gBACzD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;gBAC1D,OAAO;oBACL,QAAQ,EAAE,UAAmB;oBAC7B,GAAG,EAAE;wBACH,mBAAmB,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;wBAC1E,aAAa,QAAQ,CAAC,MAAM,sBAAsB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;wBAC5F,2DAA2D;qBAC5D;oBACD,KAAK,EAAE;wBACL,gGAAgG;wBAChG,+DAA+D;qBAChE;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/admin/services/ai-gateway.d.ts

@@ -0,0 +1,13 @@
+import { type ServiceAccess, type ServiceStatus } from "../../services/types.ts";
+export declare function aiGateway(token: string): {
+    credits: () => Promise<{
+        balance: string;
+        total_used: string;
+    }>;
+    models: () => Promise<{
+        id: string;
+    }[]>;
+    status(): Promise<ServiceStatus>;
+    access(): Promise<ServiceAccess>;
+};
+//# sourceMappingURL=ai-gateway.d.ts.map

package/dist/admin/services/ai-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-gateway.d.ts","sourceRoot":"","sources":["../../../src/admin/services/ai-gateway.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAErG,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM;;iBAII,MAAM;oBAAc,MAAM;;;YACX,MAAM;;cAK5C,OAAO,CAAC,aAAa,CAAC;cAMtB,OAAO,CAAC,aAAa,CAAC;EAWzC"}

package/dist/admin/services/ai-gateway.js

@@ -0,0 +1,32 @@
+/**
+ * Vercel AI Gateway — model routing across providers. Metered by balance.
+ */
+import { request } from "../../http/request.js";
+import { probe, probeAccess } from "../../services/types.js";
+export function aiGateway(token) {
+    const creds = { token };
+    const BASE = "https://ai-gateway.vercel.sh/v1";
+    const credits = () => request(`${BASE}/credits`, { credentials: creds });
+    const models = async () => (await request(`${BASE}/models`, { credentials: creds })).data;
+    return {
+        credits,
+        models,
+        async status() {
+            return probe("ai-gateway", async () => {
+                const [c, m] = await Promise.all([credits(), models()]);
+                return `$${c.balance} balance, $${c.total_used} used · ${m.length} models`;
+            });
+        },
+        async access() {
+            return probeAccess("ai-gateway", async () => {
+                const [c, m] = await Promise.all([credits(), models()]);
+                return {
+                    evidence: "identity",
+                    can: [`route inference to ${m.length} models`, `spend the $${c.balance} remaining balance`],
+                    notes: ["account-wide key; no per-app or per-model scoping", `$${c.total_used} used so far`],
+                };
+            });
+        },
+    };
+}
+//# sourceMappingURL=ai-gateway.js.map

package/dist/admin/services/ai-gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-gateway.js","sourceRoot":"","sources":["../../../src/admin/services/ai-gateway.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,OAAO,EAAoB,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,WAAW,EAA0C,MAAM,yBAAyB,CAAC;AAErG,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAgB,EAAE,KAAK,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,iCAAiC,CAAC;IAE/C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,CAA0C,GAAG,IAAI,UAAU,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAClH,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,OAAO,CAA6B,GAAG,IAAI,SAAS,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAEtH,OAAO;QACL,OAAO;QACP,MAAM;QACN,KAAK,CAAC,MAAM;YACV,OAAO,KAAK,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;gBACpC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACxD,OAAO,IAAI,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,UAAU,WAAW,CAAC,CAAC,MAAM,SAAS,CAAC;YAC7E,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,MAAM;YACV,OAAO,WAAW,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;gBAC1C,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACxD,OAAO;oBACL,QAAQ,EAAE,UAAU;oBACpB,GAAG,EAAE,CAAC,sBAAsB,CAAC,CAAC,MAAM,SAAS,EAAE,cAAc,CAAC,CAAC,OAAO,oBAAoB,CAAC;oBAC3F,KAAK,EAAE,CAAC,mDAAmD,EAAE,IAAI,CAAC,CAAC,UAAU,cAAc,CAAC;iBAC7F,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/admin/services/bunny.d.ts

@@ -0,0 +1,16 @@
+import { type ServiceAccess, type ServiceStatus } from "../../services/types.ts";
+export interface StorageZone {
+    Id: number;
+    Name: string;
+    Region: string;
+    StorageUsed: number;
+    FilesStored?: number;
+}
+export declare function bunny(token: string): {
+    storageZones: () => Promise<StorageZone[]>;
+    /** Zones for one app, by the `<app>` / `<app>-private` convention. */
+    zonesForApp(app: string): Promise<StorageZone[]>;
+    status(): Promise<ServiceStatus>;
+    access(): Promise<ServiceAccess>;
+};
+//# sourceMappingURL=bunny.d.ts.map

package/dist/admin/services/bunny.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bunny.d.ts","sourceRoot":"","sources":["../../../src/admin/services/bunny.ts"],"names":[],"mappings":"AAcA,OAAO,EAAsB,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAIrG,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM;wBAGF,OAAO,CAAC,WAAW,EAAE,CAAC;IAenD,sEAAsE;qBAC/C,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;cAKtC,OAAO,CAAC,aAAa,CAAC;cAQtB,OAAO,CAAC,aAAa,CAAC;EAczC"}