@huaweidevtools/aishell-dsh-credentials-store 0.0.14 → 0.0.16

package/lib/types/accounts.js

@@ -1,18 +1,15 @@
 /**
  * The Huawei Cloud credential vocabulary every plugin in this set shares.
  *
- * ## Why this module exists
+ * ## Why one module owns the account names
  *
- * This repo once read the same keyring entries from four places, each declaring
- * the account names itself and re-implementing "read AK and SK as a pair". The
- * account names are a *persistence* contract, so a divergence would not fail a
- * build — it would surface as one plugin working and another reporting "not
- * authenticated" on a machine where the person had stored exactly one pair, and
- * the cause would be invisible in the diff that introduced it.
+ * The account names and the "AK and SK are one unit" rule are a *persistence*
+ * contract. A second declaration of either does not fail a build: it surfaces
+ * as one plugin working and another reporting "not authenticated" on a machine
+ * where exactly one pair is stored, and the diff that introduced it looks
+ * harmless. Keeping them in one file makes the contract have one owner.
  *
- * Everything now goes through this file.
- *
- * ## One entry, not three
+ * ## One record, holding the whole bundle
  *
  * The store holds **one** record, `aishell-credential`, whose value is a single
  * JSON bundle encoded as base64:
@@ -24,18 +21,16 @@
  * }
  * ```
  *
- * The earlier layout was three separate entries (`HW_ACCESS_KEY`,
- * `HW_SECRET_KEY`, `HW_SECURITY_TOKEN`). That had two problems this fixes:
- *
- *   - **A save was four operations.** Clear, then write AK, then SK, then
- *     token. Every backend is per-entry, so a failure between them left a
- *     half-set behind, and nothing rolled it back.
- *   - **A read was three reads.** A concurrent write landing between them could
- *     hand back a new AK with an old SK — a pair that passes "both present" and
- *     then fails at the gateway with 401, pointing nowhere near the cause.
+ * One record is what makes a save one operation and a read one consistent
+ * snapshot:
  *
- * One entry makes a write one atomic operation and a read one consistent
- * snapshot.
+ *   - **A save is one write.** Splitting the pair across entries makes every
+ *     save a sequence, and every backend is per-entry, so a failure between two
+ *     of them leaves a half-set behind that nothing rolls back.
+ *   - **A read is one read.** Reading the AK and the SK separately lets a
+ *     concurrent write land between them: the caller gets a new AK with an old
+ *     SK, which passes "both present" and then fails at the gateway with 401,
+ *     pointing nowhere near the cause.
  *
  * ## base64 is an encoding, not encryption
  *
@@ -50,9 +45,25 @@
  * back. Two processes doing that concurrently can lose one of the changes. That
  * is accepted rather than solved: the only writer is a person via the
  * credential form, and both the e2b key and the AK/SK are refreshed by that
- * same person. A lost update would be corrected by the next save. Solving it
+ * same person, so a lost update is corrected by the next save. Solving it
  * properly needs compare-and-swap, which the keyring API does not offer.
  *
+ * ## One accepted consequence: a partial bundle can overwrite an unreadable one
+ *
+ * A read that cannot decrypt the file reports "nothing stored", so an
+ * {@link updateCredentials} built on it computes its next bundle from an empty
+ * one and writes that. For `clearE2BKey` that means the written record carries
+ * only whatever the updater added, and the section it could not read is no
+ * longer in the live file.
+ *
+ * That is not repaired here, because there is nothing to repair it *from* — the
+ * bytes are unreadable. What limits the damage is the file backend's write path:
+ * an unreadable file is moved to `<name>.unreadable-<timestamp>` rather than
+ * overwritten, so the old record survives on disk and the next successful save
+ * starts from an empty map. A reader who cannot decrypt the file has already
+ * lost those credentials; the guarantee is only that the file they were in is
+ * not destroyed.
+ *
  * @module @huaweidevtools/aishell-dsh-credentials-store/accounts
  */
 import { createHash } from 'node:crypto';
@@ -64,18 +75,22 @@ import { createHash } from 'node:crypto';
  */
 export const CREDENTIAL_ACCOUNT = 'aishell-credential';
 /**
- * Entries written by the earlier three-key layout, in the order they are read
- * during migration.
+ * The per-field account names a store may still hold beside the bundle.
+ *
+ * These are the read-side names of a store written field-by-field instead of
+ * as one record. {@link readCredentials} folds them into
+ * {@link CREDENTIAL_ACCOUNT} on first read, so a machine that holds them keeps
+ * working; nothing writes them.
  *
- * Kept only so an existing install keeps working: see {@link readCredentials}.
- * New writes never touch these.
+ * The order is the order the migration reads them: access key, secret key,
+ * token.
  */
 export const LEGACY_ACCOUNTS = ['HW_ACCESS_KEY', 'HW_SECRET_KEY', 'HW_SECURITY_TOKEN'];
 /**
- * The legacy entry holding an e2b API key on its own.
+ * The standalone e2b key entry, beside the per-field names above.
  *
- * Folded into the bundle by {@link readCredentials}. Kept as a constant because
- * the migration has to name it.
+ * Folded into the bundle by {@link readCredentials}, for the same reason: a
+ * store written before the bundle existed keeps working. Nothing writes it.
  */
 export const LEGACY_E2B_ACCOUNT = 'AISHELL_E2B_API_KEY';
 /**
@@ -161,12 +176,12 @@ function isE2BSection(value) {
         && (section.ak_fingerprint === undefined || typeof section.ak_fingerprint === 'string');
 }
 /**
- * Read the whole bundle, migrating a legacy layout on the way.
+ * Read the whole bundle, folding a per-field store into it on the way.
  *
- * Migration is lazy and idempotent: the first read that finds no bundle but
- * finds legacy entries merges them into one record, writes it, and removes the
- * old entries. A failed write leaves the legacy entries alone, so the next read
- * tries again — the person is never left with neither layout.
+ * The fold is lazy and idempotent: a read that finds no bundle but finds the
+ * per-field names merges them into one record, writes it, and removes the old
+ * entries. A failed write leaves them in place so the next read tries again —
+ * a store is never left with neither layout.
  *
  * @param store - the caller's credential store.
  * @returns the bundle; empty when nothing is stored.
@@ -181,10 +196,10 @@ export function readCredentials(store) {
     return migrated;
 }
 /**
- * Merge the legacy entries into one record and remove the old ones.
+ * Merge the per-field entries into one record and remove the old ones.
  *
  * @param store - the caller's credential store.
- * @returns the migrated bundle, or `undefined` when there was nothing to move.
+ * @returns the merged bundle, or `undefined` when there was nothing to move.
  */
 function migrateLegacy(store) {
     const ak = store.get(LEGACY_ACCOUNTS[0]);
@@ -198,9 +213,10 @@ function migrateLegacy(store) {
             ...(token === undefined || token === '' ? {} : { security_token: token }),
         }
         : undefined;
-    // The legacy e2b entry held `{ key, expiresAt, akFingerprint }`. Re-keyed to
-    // the bundle's snake-case spelling; an older bare key still reads as one that
-    // never expires, which is how the reader treated it.
+    // The standalone entry carries `{ key, expiresAt, akFingerprint }`; it is
+    // re-keyed to the bundle's snake-case spelling here. A bare key with no JSON
+    // around it reads as one that never expires, which is the reading the rest of
+    // the store gives an unknown expiry.
     const aisleE2B = legacyE2BSection(legacyKey);
     if (huaweicloud === undefined && aisleE2B === undefined)
         return undefined;
@@ -212,16 +228,24 @@ function migrateLegacy(store) {
         store.set(CREDENTIAL_ACCOUNT, encodeBundle(bundle));
     }
     catch {
-        // Could not write the merged record — leave the legacy entries in place so
-        // the next read retries rather than losing the credentials.
+        // Could not write the merged record — leave the per-field entries in place
+        // so the next read retries rather than losing the credentials.
         return bundle;
     }
-    for (const account of LEGACY_ACCOUNTS)
-        store.delete(account);
-    store.delete(LEGACY_E2B_ACCOUNT);
+    // The merged record is durable, so the old entries are redundant now. Each
+    // delete is best-effort: a locked keyring rejects deletes as well as writes,
+    // and letting that propagate would make a **successful** migration look like
+    // a failed read to the caller. A leftover entry costs nothing — a read
+    // returns the bundle as soon as it exists, and `clearCredentials` removes
+    // these names too — whereas an exception here surfaces as "could not read
+    // credentials" on a store that is fine.
+    for (const account of LEGACY_ACCOUNTS) {
+        tryDelete(store, account);
+    }
+    tryDelete(store, LEGACY_E2B_ACCOUNT);
     return bundle;
 }
-/** Read one legacy e2b entry into its bundle section. */
+/** Read one standalone e2b entry into its bundle section. */
 function legacyE2BSection(raw) {
     if (raw === undefined || raw === '')
         return undefined;
@@ -249,6 +273,31 @@ function legacyE2BSection(raw) {
 }
 /** The expiry recorded for a key that does not expire. */
 export const FOREVER_EXPIRY = '9999-12-31T23:59:59.000Z';
+/**
+ * Delete an entry, swallowing a backend refusal.
+ *
+ * For every caller whose success does not depend on the delete landing — the
+ * migration's cleanup above, and `clearCredentials` below it. The store is
+ * allowed to refuse (a locked keyring rejects deletes, a read-only backend has
+ * nothing to delete from), and in each of those cases the entry is either
+ * already gone or will be superseded; throwing would report a failure for work
+ * that is not needed.
+ *
+ * Not used where the delete *is* the operation — a save route clearing before
+ * it writes must know the clear happened, and that path calls `store.delete`
+ * directly.
+ *
+ * @param store - the caller's credential store.
+ * @param account - the entry to remove.
+ */
+function tryDelete(store, account) {
+    try {
+        store.delete(account);
+    }
+    catch {
+        // Best-effort: see the note above.
+    }
+}
 /**
  * Read the Huawei Cloud pair.
  *
@@ -310,11 +359,11 @@ export function updateCredentials(store, update) {
     return next;
 }
 /**
- * Store the Huawei Cloud pair, replacing any previous one.
+ * Store the Huawei Cloud pair, replacing whatever is there.
  *
  * One write, so the pair can never be left half-replaced. A save without a
- * token removes a previously stored one: a token belongs to the credential set
- * that carried it, and inheriting a stale one would sign the next request with
+ * token removes a stored one: a token belongs to the credential set that
+ * carried it, and inheriting a stale one would sign the next request with
  * someone else's session.
  *
  * @param store - the caller's credential store.
@@ -357,16 +406,23 @@ export function clearE2BKey(store) {
  *
  * The whole record goes, so a clear cannot leave a token or a key behind for
  * the next pair to inherit. Deleting an absent entry is a no-op in every
- * backend, and the legacy entries are removed too so a half-migrated store does
- * not come back.
+ * backend.
+ *
+ * The per-field names are removed as well, so a store the fold never reached
+ * does not keep answering after a clear. Those deletes are best-effort and the
+ * main record's is not: a refusal on `CREDENTIAL_ACCOUNT` means the credentials
+ * are still there and the person has to be told, while the per-field names are
+ * leftovers whose removal nothing depends on. Swallowing the first would report
+ * a clear that did not happen.
  *
  * @param store - the caller's credential store.
+ * @throws when the backend refused to remove the main record.
  */
 export function clearCredentials(store) {
     store.delete(CREDENTIAL_ACCOUNT);
     for (const account of LEGACY_ACCOUNTS)
-        store.delete(account);
-    store.delete(LEGACY_E2B_ACCOUNT);
+        tryDelete(store, account);
+    tryDelete(store, LEGACY_E2B_ACCOUNT);
 }
 /**
  * A short, stable digest of an AK, for recording which identity minted a key.

package/lib/types/accounts.js.map

@@ -1 +1 @@
-{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../../src/accounts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIxC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AAEtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,eAAe,EAAE,eAAe,EAAE,mBAAmB,CAAU,CAAA;AAE/F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAA;AAgCvD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,MAAwB;IACnD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AACvE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,GAAuB;IAClD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IACjC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IAC5D,MAAM,SAAS,GAAG,MAA0D,CAAA;IAC5E,OAAO;QACL,GAAG,CAAC,oBAAoB,CAAC,SAAS,CAAC,WAAW,CAAC;YAC7C,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,WAAW,CAAC;YACrC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC1C,4EAA4E;QAC5E,2EAA2E;QAC3E,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;QACnD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;IACD,OAAO,GAAG,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1D,CAAC;AAED,gEAAgE;AAChE,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,OAAO,GAAG,KAAgC,CAAA;IAChD,OAAO,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,KAAK,EAAE;WACrE,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,KAAK,EAAE;WACnE,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAA;AAC3F,CAAC;AAED,uDAAuD;AACvD,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,OAAO,GAAG,KAAgC,CAAA;IAChD,OAAO,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,KAAK,EAAE;WAC/D,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,KAAK,EAAE;WACnE,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAA;AAC3F,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,KAAuB;IACrD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC5C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC,CAAA;IAErD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;IACrC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IACrC,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAuB;IAC5C,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;IACxC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAE/C,MAAM,WAAW,GACf,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE;QAC5D,CAAC,CAAC;YACA,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,EAAE;YACd,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;SAC1E;QACD,CAAC,CAAC,SAAS,CAAA;IAEf,6EAA6E;IAC7E,8EAA8E;IAC9E,qDAAqD;IACrD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IAE5C,IAAI,WAAW,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAEzE,MAAM,MAAM,GAAqB;QAC/B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;KAC7D,CAAA;IAED,IAAI,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,4DAA4D;QAC5D,OAAO,MAAM,CAAA;IACf,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,eAAe;QAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5D,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAChC,OAAO,MAAM,CAAA;AACf,CAAC;AAED,yDAAyD;AACzD,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IACrD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,sEAAsE;QACtE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,cAAc,EAAE,CAAA;IACrD,CAAC;IACD,MAAM,SAAS,GAAG,MAAgF,CAAA;IAClG,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACzE,IAAI,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAC/E,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,GAAG;QACtB,UAAU,EAAE,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc;QAC1F,GAAG,CAAC,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,IAAI,SAAS,CAAC,aAAa,KAAK,EAAE;YAC/E,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,aAAa,EAAE;YAC7C,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,cAAc,GAAG,0BAA0B,CAAA;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,KAAuB;IACpD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,WAAW,CAAA;IAClD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC3C,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,UAAU;QACtB,EAAE,EAAE,OAAO,CAAC,UAAU;QACtB,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;KAC3F,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAuB;IACnD,OAAO,cAAc,CAAC,KAAK,CAAC,KAAK,SAAS,CAAA;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAuB;IAChD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,WAAW,CAAA;AAC3C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAuB,EACvB,MAAmE;IAEnE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAA;IACtC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;IACjD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB,EAAE,WAA4B;IACpF,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,GAAG,OAAO;QACV,WAAW,EAAE;YACX,UAAU,EAAE,WAAW,CAAC,EAAE;YAC1B,UAAU,EAAE,WAAW,CAAC,EAAE;YAC1B,GAAG,CAAC,WAAW,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC;SAClG;KACF,CAAC,CAAC,CAAA;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB,EAAE,GAAe;IAClE,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB;IACjD,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;QACjC,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACvD,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAChC,KAAK,MAAM,OAAO,IAAI,eAAe;QAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5D,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC9D,CAAC"}
+{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../../src/accounts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIxC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AAEtD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,eAAe,EAAE,eAAe,EAAE,mBAAmB,CAAU,CAAA;AAE/F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAA;AAgCvD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,MAAwB;IACnD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AACvE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,GAAuB;IAClD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IACjC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IAC5D,MAAM,SAAS,GAAG,MAA0D,CAAA;IAC5E,OAAO;QACL,GAAG,CAAC,oBAAoB,CAAC,SAAS,CAAC,WAAW,CAAC;YAC7C,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,WAAW,CAAC;YACrC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC1C,4EAA4E;QAC5E,2EAA2E;QAC3E,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;QACnD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;IACD,OAAO,GAAG,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1D,CAAC;AAED,gEAAgE;AAChE,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,OAAO,GAAG,KAAgC,CAAA;IAChD,OAAO,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,KAAK,EAAE;WACrE,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,KAAK,EAAE;WACnE,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAA;AAC3F,CAAC;AAED,uDAAuD;AACvD,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,OAAO,GAAG,KAAgC,CAAA;IAChD,OAAO,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,KAAK,EAAE;WAC/D,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,KAAK,EAAE;WACnE,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAA;AAC3F,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,KAAuB;IACrD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC5C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC,CAAA;IAErD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;IACrC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IACrC,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAuB;IAC5C,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;IACxC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAE/C,MAAM,WAAW,GACf,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE;QAC5D,CAAC,CAAC;YACA,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,EAAE;YACd,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;SAC1E;QACD,CAAC,CAAC,SAAS,CAAA;IAEf,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,qCAAqC;IACrC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IAE5C,IAAI,WAAW,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAEzE,MAAM,MAAM,GAAqB;QAC/B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;KAC7D,CAAA;IAED,IAAI,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,+DAA+D;QAC/D,OAAO,MAAM,CAAA;IACf,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,uEAAuE;IACvE,0EAA0E;IAC1E,0EAA0E;IAC1E,wCAAwC;IACxC,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAAC,CAAC;IACpE,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAA;IACpC,OAAO,MAAM,CAAA;AACf,CAAC;AAED,6DAA6D;AAC7D,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IACrD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,sEAAsE;QACtE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,cAAc,EAAE,CAAA;IACrD,CAAC;IACD,MAAM,SAAS,GAAG,MAAgF,CAAA;IAClG,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACzE,IAAI,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAC/E,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,GAAG;QACtB,UAAU,EAAE,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc;QAC1F,GAAG,CAAC,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,IAAI,SAAS,CAAC,aAAa,KAAK,EAAE;YAC/E,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,aAAa,EAAE;YAC7C,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,cAAc,GAAG,0BAA0B,CAAA;AAExD;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,SAAS,CAAC,KAAuB,EAAE,OAAe;IACzD,IAAI,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,KAAuB;IACpD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,WAAW,CAAA;IAClD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC3C,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,UAAU;QACtB,EAAE,EAAE,OAAO,CAAC,UAAU;QACtB,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;KAC3F,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAuB;IACnD,OAAO,cAAc,CAAC,KAAK,CAAC,KAAK,SAAS,CAAA;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAuB;IAChD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,WAAW,CAAA;AAC3C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAuB,EACvB,MAAmE;IAEnE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAA;IACtC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;IACjD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB,EAAE,WAA4B;IACpF,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,GAAG,OAAO;QACV,WAAW,EAAE;YACX,UAAU,EAAE,WAAW,CAAC,EAAE;YAC1B,UAAU,EAAE,WAAW,CAAC,EAAE;YAC1B,GAAG,CAAC,WAAW,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC;SAClG;KACF,CAAC,CAAC,CAAA;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB,EAAE,GAAe;IAClE,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB;IACjD,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;QACjC,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACvD,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAChC,KAAK,MAAM,OAAO,IAAI,eAAe;QAAE,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAChE,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC9D,CAAC"}

package/lib/types/backends/fingerprint.d.ts

@@ -11,6 +11,23 @@
  * known limitation, not a security hole.
  */
 import type { CredentialsStore, CredentialsStoreConfig } from '../index.ts';
+/**
+ * A credentials file that exists but cannot be decrypted or parsed.
+ *
+ * Its own type rather than a plain `Error` because the write path has to tell
+ * this case from every other failure: this is the one where overwriting the
+ * file would destroy credentials the person still has, so `set` moves it aside
+ * first. Anything else propagates unchanged.
+ */
+export declare class UnreadableCredentialsFile extends Error {
+    /** The file that could not be read. */
+    readonly filePath: string;
+    constructor(
+    /** The file that could not be read. */
+    filePath: string, 
+    /** What decryption or parsing reported. */
+    cause: unknown);
+}
 /**
  * Encrypted-file {@link CredentialsStore}. Each account is one entry in a
  * single JSON map, encrypted as one file under the resolved credentials
@@ -29,12 +46,73 @@ export declare class FingerprintBackend implements CredentialsStore {
      * read, used, and dropped so plaintext does not linger in memory between
      * operations. The file I/O + scrypt decrypt per call is acceptable: this is
      * not a hot path (once per chat request, not per token).
+     *
+     * @throws {@link UnreadableCredentialsFile} when the file exists but cannot be
+     *   decrypted or parsed. Callers decide what that means; see the note on
+     *   {@link FingerprintBackend.loadForWrite}.
      */
     private load;
+    /**
+     * Load for a write, where an unreadable file must not be silently replaced.
+     *
+     * ## Why this is not just `load()` with the error swallowed
+     *
+     * `set` re-encrypts and rewrites the *whole* map. If load failed and returned
+     * empty, the next save would write a one-entry file over every other
+     * credential the person had stored — with no error, no backup and nothing to
+     * recover from. An unreadable file is not proof of an empty one: a truncated
+     * write, a machine-id that changed under the file, or a build whose salt
+     * moved all look identical from here.
+     *
+     * So the unreadable file is moved aside instead of overwritten. Saving
+     * therefore keeps working on a machine that inherited someone else's file —
+     * the documented VM-clone case — while whatever was in it stays on disk under
+     * a name that says what happened to it.
+     *
+     * @returns the current entries, or an empty map when the old file was moved
+     *   aside.
+     */
+    private loadForWrite;
+    /**
+     * Move an unreadable file out of the way.
+     *
+     * The suffix carries a timestamp and, if that name is taken, a counter — the
+     * quarantine must never itself throw over a name collision and must never
+     * overwrite a previous one, since the files it preserves are the only copy of
+     * what was there. The counter is bounded because an unbounded retry loop over
+     * a filesystem is a hang, not a fallback; reaching the bound means something
+     * outside this process is wrong and saying so is better than spinning.
+     */
+    private quarantine;
     /** Encrypt + write the map to disk with owner-only permissions. */
     private persist;
+    /**
+     * Read one entry.
+     *
+     * An unreadable file reads as absent rather than throwing. The alternative —
+     * failing every tool call on a parse error — leaves the person with no
+     * working path; "not authenticated" at least routes them to the form that can
+     * fix it. The write path is where the difference is preserved; see
+     * {@link FingerprintBackend.loadForWrite}.
+     */
     get(account: string): string | undefined;
     set(account: string, value: string): void;
+    /**
+     * Remove one entry.
+     *
+     * An unreadable file **throws** rather than being a silent no-op. There is
+     * nothing to remove from a map that cannot be read, and answering "done"
+     * would be a clear that did not clear: the file stays on disk, and the
+     * moment whatever made it unreadable is undone — a restored machine id, a
+     * repaired file — the credential reads back. `clearCredentials` relies on
+     * exactly this signal to tell the person the clear failed.
+     *
+     * Quarantining instead is not an option here: it would move the file out of
+     * the way, which is the destruction this method must not perform — a delete
+     * asked for one entry, not for every entry.
+     *
+     * @throws {@link UnreadableCredentialsFile} when the file cannot be read.
+     */
     delete(account: string): void;
     has(account: string): boolean;
 }

package/lib/types/backends/fingerprint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../../src/backends/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AA0D3E;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,YAAW,gBAAgB;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;gBAEpB,MAAM,GAAE,sBAA2B;IAQ/C;;;;;OAKG;IACH,OAAO,CAAC,IAAI;IAYZ,mEAAmE;IACnE,OAAO,CAAC,OAAO;IAQf,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIxC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAOzC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAO7B,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;CAG9B"}
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../../src/backends/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAmF3E;;;;;;;GAOG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAEhD,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM;;IADzB,uCAAuC;IAC9B,QAAQ,EAAE,MAAM;IACzB,2CAA2C;IAC3C,KAAK,EAAE,OAAO;CAQjB;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,YAAW,gBAAgB;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;gBAEpB,MAAM,GAAE,sBAA2B;IAQ/C;;;;;;;;;OASG;IACH,OAAO,CAAC,IAAI;IAWZ;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,YAAY;IAUpB;;;;;;;;;OASG;IACH,OAAO,CAAC,UAAU;IA0BlB,mEAAmE;IACnE,OAAO,CAAC,OAAO;IAQf;;;;;;;;OAQG;IACH,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAQxC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAOzC;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAO7B,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;CAO9B"}

package/lib/types/backends/fingerprint.js

@@ -11,7 +11,7 @@
  * known limitation, not a security hole.
  */
 import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync } from 'node:fs';
 import { join } from 'node:path';
 import machineIdModule from 'node-machine-id';
 import { CREDENTIALS_FILE_NAME } from "../scope.js";
@@ -25,10 +25,33 @@ const SALT = 'aishell-dsh/credentials/v1';
 const KEY_LEN = 32; // AES-256
 const NONCE_LEN = 12; // GCM standard (96-bit nonce)
 const TAG_LEN = 16; // 128-bit auth tag
+/**
+ * scrypt cost parameters, stated rather than inherited.
+ *
+ * Passing no options lets the runtime's defaults decide, and those are not a
+ * promise: Node documents the defaults but does not freeze them, so a runtime
+ * that changed them would silently derive a different key and make every
+ * existing `credentials.enc` undecryptable. They are part of the on-disk
+ * format for the same reason {@link SALT} is — **changing any of them is a
+ * breaking change to every stored file**, not a tuning knob.
+ *
+ * These are the values the format was defined with, so writing them down keeps
+ * every existing file readable while removing the runtime from the equation.
+ */
+const SCRYPT_PARAMS = { N: 16384, r: 8, p: 1 };
+/**
+ * How many quarantine filenames to try before giving up.
+ *
+ * Collisions are only possible when several saves land in the same millisecond
+ * on a machine whose last few saves all quarantined — which is already an
+ * unhealthy machine. The bound exists so that case reports itself instead of
+ * looping.
+ */
+const QUARANTINE_NAME_ATTEMPTS = 16;
 /** Derive a 32-byte key from the machine UUID via scrypt. */
 function deriveKey() {
     const machineId = machineIdSync();
-    return scryptSync(machineId, SALT, KEY_LEN);
+    return scryptSync(machineId, SALT, KEY_LEN, SCRYPT_PARAMS);
 }
 /** Encrypt plaintext → [nonce][tag][ciphertext] as a Buffer. */
 function fingerprintEncrypt(plaintext) {
@@ -66,6 +89,27 @@ function fingerprintDecrypt(data) {
 function resolveCredentialsDir(config) {
     return config.credentialsDir ?? credentialsDir();
 }
+/**
+ * A credentials file that exists but cannot be decrypted or parsed.
+ *
+ * Its own type rather than a plain `Error` because the write path has to tell
+ * this case from every other failure: this is the one where overwriting the
+ * file would destroy credentials the person still has, so `set` moves it aside
+ * first. Anything else propagates unchanged.
+ */
+export class UnreadableCredentialsFile extends Error {
+    filePath;
+    constructor(
+    /** The file that could not be read. */
+    filePath, 
+    /** What decryption or parsing reported. */
+    cause) {
+        super(`credentials file ${filePath} exists but could not be decrypted: `
+            + (cause instanceof Error ? cause.message : String(cause)));
+        this.filePath = filePath;
+        this.name = 'UnreadableCredentialsFile';
+    }
+}
 /**
  * Encrypted-file {@link CredentialsStore}. Each account is one entry in a
  * single JSON map, encrypted as one file under the resolved credentials
@@ -90,20 +134,88 @@ export class FingerprintBackend {
      * read, used, and dropped so plaintext does not linger in memory between
      * operations. The file I/O + scrypt decrypt per call is acceptable: this is
      * not a hot path (once per chat request, not per token).
+     *
+     * @throws {@link UnreadableCredentialsFile} when the file exists but cannot be
+     *   decrypted or parsed. Callers decide what that means; see the note on
+     *   {@link FingerprintBackend.loadForWrite}.
      */
     load() {
         if (!existsSync(this.filePath))
             return new Map();
+        const encrypted = readFileSync(this.filePath);
         try {
-            const encrypted = readFileSync(this.filePath);
             const plaintext = fingerprintDecrypt(encrypted);
             return new Map(Object.entries(JSON.parse(plaintext)));
         }
-        catch {
-            // Corrupted or wrong machine — treat as empty.
+        catch (error) {
+            throw new UnreadableCredentialsFile(this.filePath, error);
+        }
+    }
+    /**
+     * Load for a write, where an unreadable file must not be silently replaced.
+     *
+     * ## Why this is not just `load()` with the error swallowed
+     *
+     * `set` re-encrypts and rewrites the *whole* map. If load failed and returned
+     * empty, the next save would write a one-entry file over every other
+     * credential the person had stored — with no error, no backup and nothing to
+     * recover from. An unreadable file is not proof of an empty one: a truncated
+     * write, a machine-id that changed under the file, or a build whose salt
+     * moved all look identical from here.
+     *
+     * So the unreadable file is moved aside instead of overwritten. Saving
+     * therefore keeps working on a machine that inherited someone else's file —
+     * the documented VM-clone case — while whatever was in it stays on disk under
+     * a name that says what happened to it.
+     *
+     * @returns the current entries, or an empty map when the old file was moved
+     *   aside.
+     */
+    loadForWrite() {
+        try {
+            return this.load();
+        }
+        catch (error) {
+            if (!(error instanceof UnreadableCredentialsFile))
+                throw error;
+            this.quarantine(error);
             return new Map();
         }
     }
+    /**
+     * Move an unreadable file out of the way.
+     *
+     * The suffix carries a timestamp and, if that name is taken, a counter — the
+     * quarantine must never itself throw over a name collision and must never
+     * overwrite a previous one, since the files it preserves are the only copy of
+     * what was there. The counter is bounded because an unbounded retry loop over
+     * a filesystem is a hang, not a fallback; reaching the bound means something
+     * outside this process is wrong and saying so is better than spinning.
+     */
+    quarantine(cause) {
+        const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+        for (let attempt = 0; attempt < QUARANTINE_NAME_ATTEMPTS; attempt += 1) {
+            const suffix = attempt === 0 ? '' : `-${attempt}`;
+            const target = `${this.filePath}.unreadable-${stamp}${suffix}`;
+            if (existsSync(target))
+                continue;
+            try {
+                renameSync(this.filePath, target);
+                return;
+            }
+            catch (error) {
+                // Another process quarantined it first: nothing left to move, and the
+                // write that follows is against a fresh file either way.
+                if (error instanceof Error && 'code' in error && error.code === 'ENOENT')
+                    return;
+                throw new Error(`credentials file ${this.filePath} could not be read (${cause.message}), `
+                    + `and could not be moved aside to ${target} either: ${String(error)}`);
+            }
+        }
+        throw new Error(`credentials file ${this.filePath} could not be read (${cause.message}), and every `
+            + `quarantine name is taken up to ${QUARANTINE_NAME_ATTEMPTS} attempts — `
+            + 'move the file aside by hand before saving again.');
+    }
     /** Encrypt + write the map to disk with owner-only permissions. */
     persist(entries) {
         const plaintext = JSON.stringify(Object.fromEntries(entries));
@@ -112,16 +224,46 @@ export class FingerprintBackend {
         // the file is still encrypted, and ACLs inherit from the profile dir.
         writeFileSync(this.filePath, fingerprintEncrypt(plaintext), { mode: 0o600 });
     }
+    /**
+     * Read one entry.
+     *
+     * An unreadable file reads as absent rather than throwing. The alternative —
+     * failing every tool call on a parse error — leaves the person with no
+     * working path; "not authenticated" at least routes them to the form that can
+     * fix it. The write path is where the difference is preserved; see
+     * {@link FingerprintBackend.loadForWrite}.
+     */
     get(account) {
-        return this.load().get(account);
+        try {
+            return this.load().get(account);
+        }
+        catch {
+            return undefined;
+        }
     }
     set(account, value) {
         if (value.length === 0)
             throw new Error('credential value must be non-empty');
-        const entries = this.load();
+        const entries = this.loadForWrite();
         entries.set(account, value);
         this.persist(entries);
     }
+    /**
+     * Remove one entry.
+     *
+     * An unreadable file **throws** rather than being a silent no-op. There is
+     * nothing to remove from a map that cannot be read, and answering "done"
+     * would be a clear that did not clear: the file stays on disk, and the
+     * moment whatever made it unreadable is undone — a restored machine id, a
+     * repaired file — the credential reads back. `clearCredentials` relies on
+     * exactly this signal to tell the person the clear failed.
+     *
+     * Quarantining instead is not an option here: it would move the file out of
+     * the way, which is the destruction this method must not perform — a delete
+     * asked for one entry, not for every entry.
+     *
+     * @throws {@link UnreadableCredentialsFile} when the file cannot be read.
+     */
     delete(account) {
         const entries = this.load();
         if (entries.delete(account)) {
@@ -129,7 +271,12 @@ export class FingerprintBackend {
         }
     }
     has(account) {
-        return this.load().has(account);
+        try {
+            return this.load().has(account);
+        }
+        catch {
+            return false;
+        }
     }
 }
 //# sourceMappingURL=fingerprint.js.map

package/lib/types/backends/fingerprint.js.map

@@ -1 +1 @@
-{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../../src/backends/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACvF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,eAAe,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAG5C,MAAM,aAAa,GAAiB,eAAe,CAAC,aAAa,CAAA;AAEjE,yEAAyE;AACzE,gEAAgE;AAChE,yEAAyE;AACzE,gDAAgD;AAChD,MAAM,IAAI,GAAG,4BAA4B,CAAA;AACzC,MAAM,OAAO,GAAG,EAAE,CAAA,CAAC,UAAU;AAC7B,MAAM,SAAS,GAAG,EAAE,CAAA,CAAC,8BAA8B;AACnD,MAAM,OAAO,GAAG,EAAE,CAAA,CAAC,mBAAmB;AAEtC,6DAA6D;AAC7D,SAAS,SAAS;IAChB,MAAM,SAAS,GAAG,aAAa,EAAE,CAAA;IACjC,OAAO,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;AAC7C,CAAC;AAED,gEAAgE;AAChE,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,MAAM,GAAG,GAAG,SAAS,EAAE,CAAA;IACvB,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACxD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACpF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAA;AAChD,CAAC;AAED,oFAAoF;AACpF,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAA;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,CAAA;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,OAAO,CAAC,CAAA;IACrD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IAC5D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IACxB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAChF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAAC,MAA8B;IAC3D,OAAO,MAAM,CAAC,cAAc,IAAI,cAAc,EAAE,CAAA;AAClD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IACZ,QAAQ,CAAQ;IAChB,OAAO,CAAQ;IAEhC,YAAY,SAAiC,EAAE;QAC7C,IAAI,CAAC,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;QAC5C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAA;QACzD,wEAAwE;QACxE,+BAA+B;QAC/B,SAAS,EAAE,CAAA;IACb,CAAC;IAED;;;;;OAKG;IACK,IAAI;QACV,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAA;QAChD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC7C,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;YAC/C,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAA2B,CAAC,CAAC,CAAA;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;YAC/C,OAAO,IAAI,GAAG,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IAED,mEAAmE;IAC3D,OAAO,CAAC,OAA4B;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAA;QAC7D,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACzD,uEAAuE;QACvE,sEAAsE;QACtE,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,GAAG,CAAC,OAAe;QACjB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACjC,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,KAAa;QAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAC3B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;IAED,MAAM,CAAC,OAAe;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACvB,CAAC;IACH,CAAC;IAED,GAAG,CAAC,OAAe;QACjB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACjC,CAAC;CACF"}
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../../src/backends/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACvF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACxF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,eAAe,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAG5C,MAAM,aAAa,GAAiB,eAAe,CAAC,aAAa,CAAA;AAEjE,yEAAyE;AACzE,gEAAgE;AAChE,yEAAyE;AACzE,gDAAgD;AAChD,MAAM,IAAI,GAAG,4BAA4B,CAAA;AACzC,MAAM,OAAO,GAAG,EAAE,CAAA,CAAC,UAAU;AAC7B,MAAM,SAAS,GAAG,EAAE,CAAA,CAAC,8BAA8B;AACnD,MAAM,OAAO,GAAG,EAAE,CAAA,CAAC,mBAAmB;AAEtC;;;;;;;;;;;;GAYG;AACH,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAW,CAAA;AAEvD;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAG,EAAE,CAAA;AAEnC,6DAA6D;AAC7D,SAAS,SAAS;IAChB,MAAM,SAAS,GAAG,aAAa,EAAE,CAAA;IACjC,OAAO,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;AAC5D,CAAC;AAED,gEAAgE;AAChE,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,MAAM,GAAG,GAAG,SAAS,EAAE,CAAA;IACvB,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACxD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACpF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAA;AAChD,CAAC;AAED,oFAAoF;AACpF,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAA;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,CAAA;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,OAAO,CAAC,CAAA;IACrD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IAC5D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IACxB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAChF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAAC,MAA8B;IAC3D,OAAO,MAAM,CAAC,cAAc,IAAI,cAAc,EAAE,CAAA;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAGvC;IAFX;IACE,uCAAuC;IAC9B,QAAgB;IACzB,2CAA2C;IAC3C,KAAc;QAEd,KAAK,CACH,oBAAoB,QAAQ,sCAAsC;cAChE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC3D,CAAA;QAPQ,aAAQ,GAAR,QAAQ,CAAQ;QAQzB,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IACZ,QAAQ,CAAQ;IAChB,OAAO,CAAQ;IAEhC,YAAY,SAAiC,EAAE;QAC7C,IAAI,CAAC,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;QAC5C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAA;QACzD,wEAAwE;QACxE,+BAA+B;QAC/B,SAAS,EAAE,CAAA;IACb,CAAC;IAED;;;;;;;;;OASG;IACK,IAAI;QACV,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAA;QAChD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC7C,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;YAC/C,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAA2B,CAAC,CAAC,CAAA;QACjF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,YAAY;QAClB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,EAAE,CAAA;QACpB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,KAAK,YAAY,yBAAyB,CAAC;gBAAE,MAAM,KAAK,CAAA;YAC9D,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;YACtB,OAAO,IAAI,GAAG,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,UAAU,CAAC,KAAY;QAC7B,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC5D,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,wBAAwB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACvE,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAA;YACjD,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,eAAe,KAAK,GAAG,MAAM,EAAE,CAAA;YAC9D,IAAI,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAQ;YAChC,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;gBACjC,OAAM;YACR,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,sEAAsE;gBACtE,yDAAyD;gBACzD,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAM;gBAChF,MAAM,IAAI,KAAK,CACb,oBAAoB,IAAI,CAAC,QAAQ,uBAAuB,KAAK,CAAC,OAAO,KAAK;sBACxE,mCAAmC,MAAM,YAAY,MAAM,CAAC,KAAK,CAAC,EAAE,CACvE,CAAA;YACH,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oBAAoB,IAAI,CAAC,QAAQ,uBAAuB,KAAK,CAAC,OAAO,eAAe;cAClF,kCAAkC,wBAAwB,cAAc;cACxE,kDAAkD,CACrD,CAAA;IACH,CAAC;IAED,mEAAmE;IAC3D,OAAO,CAAC,OAA4B;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAA;QAC7D,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACzD,uEAAuE;QACvE,sEAAsE;QACtE,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED;;;;;;;;OAQG;IACH,GAAG,CAAC,OAAe;QACjB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,KAAa;QAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;QACnC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAC3B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,OAAe;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACvB,CAAC;IACH,CAAC;IAED,GAAG,CAAC,OAAe;QACjB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;CACF"}