@huaweidevtools/aishell-dsh-credentials-store 0.0.7 → 0.0.8

package/LICENSE

@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2024 Huawei Cloud AI Shell
+   Copyright 2026 Huawei Cloud AI Shell
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/README.md

@@ -1,6 +1,16 @@
 # @huaweidevtools/aishell-dsh-credentials-store
 
-Credential storage abstraction for aishell DSH plugins. Upper layers call `createCredentialsStore()` and receive a `CredentialsStore` — they never learn which backend is serving. The factory probes backends in priority order and returns the first that answers.
+Credential storage for aishell DSH plugins, plus the vocabulary they share: the
+account names, the credential bundle, and IAM verification.
+
+The store keeps **one** record — `aishell-credential` — holding the Huawei Cloud
+pair and the e2b API key as one base64-encoded JSON bundle. One write, so a
+credential set can never be left half-replaced; one read, so a new AK can never
+pair with an old SK.
+
+Upper layers call `createCredentialsStore()` and receive a `CredentialsStore` —
+they never learn which backend is serving. The factory probes backends in
+priority order and returns the first that answers.
 
 This is a **tool library**, not a DSH plugin — no `dsh.client`, no `cordis.patch.yml`, no `apply`.
 
@@ -12,7 +22,7 @@ This is a **tool library**, not a DSH plugin — no `dsh.client`, no `cordis.pat
 | 2 | `FingerprintBackend` | Yes (same-machine, survives reboot) | `node-machine-id` can resolve a machine UUID |
 | 3 | `MemoryBackend` | No (process-scoped) | None — always available, last resort |
 
-When the OS keyring is unavailable (headless Linux without D-Bus, keychain locked, container), the factory falls back to the fingerprint backend — a machine-fingerprint-bound AES-256-GCM encrypted file at `~/.<service>/credentials.enc`. The encryption key is derived from the machine UUID via scrypt; the ciphertext is useless on a different machine. If the machine UUID is also unavailable, the factory falls back to the in-memory backend so a single DSH session still works.
+When the OS keyring is unavailable (headless Linux without D-Bus, keychain locked, container), the factory falls back to the fingerprint backend — a machine-fingerprint-bound AES-256-GCM encrypted file, `$DSH_HOME/credentials/<scope>.credentials.enc` (`<DSH_HOME>` falls back to `~/.aishell`). The encryption key is derived from the machine UUID via scrypt; the ciphertext is useless on a different machine. If the machine UUID is also unavailable, the factory falls back to the in-memory backend so a single DSH session still works.
 
 ### Linux: the store is required, not preferred
 
@@ -33,24 +43,53 @@ The construction probe can only detect a keyring that cannot be *read*. A GNOME
 
 The record lives in the fallback backend — the encrypted file in practice — so it survives the restart the failure mode requires: the keyring is locked *now*, and the read that would resurrect the credential happens in a later session, after it has unlocked. On a machine whose keyring has never failed the fallback has written nothing, and each read pays a sub-millisecond check against an absent file.
 
+## Credential scope
+
+One build-time constant decides where credentials live, and it decides both
+names at once:
+
+| | default |
+|---|---|
+| keyring service | `aishell-dsh-plugins` |
+| encrypted file | `plugins.credentials.enc` |
+
+```sh
+AISHELL_CREDENTIAL_SCOPE=staging pnpm run build
+# → keyring service `aishell-dsh-staging`, file `staging.credentials.enc`
+```
+
+It is **not** a runtime setting, and not a plugin config option. A scope set on
+a reader but not on the writer stores credentials in one namespace and looks for
+them in another: the form says "saved" while every tool says "not
+authenticated". A build-time constant cannot be set on one side only, and two
+deployments that should not see each other's credentials differ by being built
+differently — which is the honest place for a persistence boundary.
+
 ## Usage
 
 ```typescript
 import { createCredentialsStore } from '@huaweidevtools/aishell-dsh-credentials-store'
+import { readStoredPair, writeHuaweiCloud } from '@huaweidevtools/aishell-dsh-credentials-store/accounts'
 
 const store = createCredentialsStore()          // probes keyring → fingerprint → memory
-store.set('HW_ACCESS_KEY', 'LTAIxxxx')          // durable if keyring or fingerprint is up
-const ak = store.get('HW_ACCESS_KEY')           // 'LTAIxxxx'
-store.has('HW_ACCESS_KEY')                       // true
-store.delete('HW_ACCESS_KEY')
-```
 
-A custom service name isolates entries from other applications sharing the same keyring:
+// Read the pair: one snapshot of one record.
+const pair = readStoredPair(store)              // { ak, sk, securityToken? } | undefined
 
-```typescript
-const store = createCredentialsStore({ service: 'my-app' })
+// Write it: one atomic replacement. A save without a token drops the old one.
+writeHuaweiCloud(store, { ak, sk })
 ```
 
+Other entries:
+
+| Subpath | What it is |
+|---|---|
+| `.` | The store factory and backend chain |
+| `./accounts` | Account names, the credential bundle, the pair reader/writer |
+| `./verify` | IAM verification (`GET /v3/projects`), one answer for one credential set |
+| `./signer` | SDK-HMAC-SHA256 request signing |
+| `./scope` | The build scope, and the two names derived from it |
+
 ## Security properties
 
 - **No plaintext files**: nothing on disk is readable with `cat`.

package/lib/accounts.d.ts

@@ -0,0 +1,187 @@
+import "./scope-CFetnbG3.js";
+import { CredentialsStore } from "./index-JlyJE1E8.js";
+import { SignCredentials } from "./signer-Et0DIH6o.js";
+
+//#region src/accounts.d.ts
+/**
+* The one store entry holding every credential this repo manages.
+*
+* Part of the persistence contract: renaming it orphans every stored entry
+* while looking like a harmless constant change.
+*/
+
+/**
+ * The one store entry holding every credential this repo manages.
+ *
+ * Part of the persistence contract: renaming it orphans every stored entry
+ * while looking like a harmless constant change.
+ */
+declare const CREDENTIAL_ACCOUNT = "aishell-credential";
+/**
+ * Entries written by the earlier three-key layout, in the order they are read
+ * during migration.
+ *
+ * Kept only so an existing install keeps working: see {@link readCredentials}.
+ * New writes never touch these.
+ */
+declare const LEGACY_ACCOUNTS: readonly ["HW_ACCESS_KEY", "HW_SECRET_KEY", "HW_SECURITY_TOKEN"];
+/**
+ * The legacy entry holding an e2b API key on its own.
+ *
+ * Folded into the bundle by {@link readCredentials}. Kept as a constant because
+ * the migration has to name it.
+ */
+declare const LEGACY_E2B_ACCOUNT = "AISHELL_E2B_API_KEY";
+/** The Huawei Cloud pair, as the bundle stores it. Snake-case on disk. */
+interface HuaweiCloudSection {
+  readonly access_key: string;
+  readonly secret_key: string;
+  readonly security_token?: string;
+}
+/**
+ * An e2b API key, as the bundle stores it.
+ *
+ * `ak_fingerprint` is not part of the key the gateway issued — it is a digest
+ * of the AK that minted it, so a reader can tell whether the key still belongs
+ * to the credentials in hand. Without it, an AK rotation would leave the old
+ * key (and so the old tenant, with all its sandboxes) alive. It lives here
+ * rather than only in the reader's memory because it has to survive a restart.
+ */
+interface E2BSection {
+  readonly api_key: string;
+  /** ISO 8601; `9999-12-31T23:59:59.000Z` when the key does not expire. */
+  readonly expired_at: string;
+  /** {@link fingerprint} of the AK that minted this key, when known. */
+  readonly ak_fingerprint?: string;
+}
+/** The whole bundle. Either section may be absent. */
+interface CredentialBundle {
+  readonly huaweicloud?: HuaweiCloudSection;
+  readonly aishell_e2b?: E2BSection;
+}
+/**
+ * Encode a bundle for storage.
+ *
+ * @param bundle - the bundle to store.
+ * @returns base64 of its JSON form.
+ */
+declare function encodeBundle(bundle: CredentialBundle): string;
+/**
+ * Decode a stored value.
+ *
+ * Anything unreadable reads as an empty bundle rather than throwing: a corrupt
+ * entry should behave like "nothing stored" so the person is asked to
+ * authenticate again, not so every tool call fails on a parse error.
+ *
+ * A value that is not base64 is tried as raw JSON first — that is what the
+ * legacy e2b entry held, and migration reads it through here.
+ *
+ * @param raw - the stored string, if any.
+ * @returns the decoded bundle; empty when nothing usable is there.
+ */
+declare function decodeBundle(raw: string | undefined): CredentialBundle;
+/**
+ * Read the whole bundle, migrating a legacy layout on the way.
+ *
+ * Migration is lazy and idempotent: the first read that finds no bundle but
+ * finds legacy entries merges them into one record, writes it, and removes the
+ * old entries. A failed write leaves the legacy entries alone, so the next read
+ * tries again — the person is never left with neither layout.
+ *
+ * @param store - the caller's credential store.
+ * @returns the bundle; empty when nothing is stored.
+ */
+declare function readCredentials(store: CredentialsStore): CredentialBundle;
+/** The expiry recorded for a key that does not expire. */
+declare const FOREVER_EXPIRY = "9999-12-31T23:59:59.000Z";
+/**
+ * Read the Huawei Cloud pair.
+ *
+ * AK and SK are read together and treated as one unit: half a pair reads as no
+ * credentials rather than an error, so a partially-configured machine gets
+ * "authenticate first" instead of a signing failure with no remedy. The
+ * SecurityToken is optional and is omitted entirely when absent — an empty
+ * string would sign as a third header the gateway then rejects.
+ *
+ * @param store - the caller's credential store.
+ * @returns the pair, or `undefined` when the AK/SK pair is incomplete.
+ */
+declare function readStoredPair(store: CredentialsStore): SignCredentials | undefined;
+/**
+ * Whether a complete Huawei Cloud pair is stored.
+ *
+ * @param store - the caller's credential store.
+ */
+declare function hasStoredPair(store: CredentialsStore): boolean;
+/**
+ * Read the stored e2b key.
+ *
+ * @param store - the caller's credential store.
+ * @returns the section, or `undefined` when no key is stored.
+ */
+declare function readE2BKey(store: CredentialsStore): E2BSection | undefined;
+/**
+ * Apply one change to the bundle and write it back.
+ *
+ * The updater receives the current bundle and returns the next one. Returning
+ * `undefined` aborts the write, which is how a caller says "nothing changed" —
+ * that matters because every write is a full re-encode, and needlessly
+ * rewriting a record while another process reads it is how a spurious
+ * "credentials changed" is produced.
+ *
+ * @param store - the caller's credential store.
+ * @param update - computes the next bundle.
+ * @returns the bundle now stored.
+ */
+declare function updateCredentials(store: CredentialsStore, update: (current: CredentialBundle) => CredentialBundle | undefined): CredentialBundle;
+/**
+ * Store the Huawei Cloud pair, replacing any previous one.
+ *
+ * One write, so the pair can never be left half-replaced. A save without a
+ * token removes a previously stored one: a token belongs to the credential set
+ * that carried it, and inheriting a stale one would sign the next request with
+ * someone else's session.
+ *
+ * @param store - the caller's credential store.
+ * @param credentials - the verified pair.
+ */
+declare function writeHuaweiCloud(store: CredentialsStore, credentials: SignCredentials): void;
+/**
+ * Store an e2b key.
+ *
+ * @param store - the caller's credential store.
+ * @param key - the section to store.
+ */
+declare function writeE2BKey(store: CredentialsStore, key: E2BSection): void;
+/**
+ * Remove the stored e2b key, leaving the Huawei Cloud pair alone.
+ *
+ * @param store - the caller's credential store.
+ */
+declare function clearE2BKey(store: CredentialsStore): void;
+/**
+ * Remove every credential this repo writes.
+ *
+ * The whole record goes, so a clear cannot leave a token or a key behind for
+ * the next pair to inherit. Deleting an absent entry is a no-op in every
+ * backend, and the legacy entries are removed too so a half-migrated store does
+ * not come back.
+ *
+ * @param store - the caller's credential store.
+ */
+declare function clearCredentials(store: CredentialsStore): void;
+/**
+ * A short, stable digest of an AK, for recording which identity minted a key.
+ *
+ * The AK rather than the pair: the SK can be rotated independently while the
+ * account stays the same, and the tenant the gateway derives is the account. A
+ * digest rather than the AK itself keeps the bundle from carrying a second
+ * readable copy of a credential identifier.
+ *
+ * @param ak - the access key.
+ */
+declare function fingerprint(ak: string): string; //#endregion
+
+//# sourceMappingURL=accounts.d.ts.map
+export { CREDENTIAL_ACCOUNT, CredentialBundle, E2BSection, FOREVER_EXPIRY, HuaweiCloudSection, LEGACY_ACCOUNTS, LEGACY_E2B_ACCOUNT, clearCredentials, clearE2BKey, decodeBundle, encodeBundle, fingerprint, hasStoredPair, readCredentials, readE2BKey, readStoredPair, updateCredentials, writeE2BKey, writeHuaweiCloud };
+//# sourceMappingURL=accounts.d.ts.map

package/lib/accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.d.ts","names":[],"sources":["../../src/accounts.ts"],"sourcesContent":null,"mappings":";;;;;;;;;;;;;;;;;;AA4IgB,cAxEH,kBAAA,GAwE0C,oBAAgB;;;;;;;;cA/D1D;;;;AAkIb;;;AAA0D,cA1H7C,kBAAA,GA0H6C,qBAAA;AAAgB;UAvHzD,kBAAA;EAqMJ,SAAA,UAAc,EAAA,MAAA;;;;;;;;;;;;;AAcX,UApMC,UAAA,CAoMa;EAAA,SAAA,OAAA,EAAA,MAAA;EAAA;EAAwB,SAAG,UAAA,EAAA,MAAA;EAAe;;;;UA3LvD,gBAAA;yBACQ;EAyMT,SAAA,WAAa,CAAA,EAxMJ,UAwMY;;;;;;;AAUrC;AAA0B,iBAzMV,YAAA,CAyMU,MAAA,EAzMW,gBAyMX,CAAA,EAAA,MAAA;;;AAAqC;;;;;;;;;;;iBAxL/C,YAAA,2BAAuC;;;AAyMvD;;;;;;AAGmB;;;iBAzIH,eAAA,QAAuB,mBAAmB;;cA8E7C,cAAA;;;;;;;AA8Eb;;;;AAAsF;;iBAhEtE,cAAA,QAAsB,mBAAmB;;;;;AAiFzD;AAA2B,iBAlEX,aAAA,CAkEW,KAAA,EAlEU,gBAkEV,CAAA,EAAA,OAAA;;;AAAyC;;;;iBAxDpD,UAAA,QAAkB,mBAAmB;;AAiErD;;;;;;;;;;;AAkBA;iBAlEgB,iBAAA,QACP,oCACW,qBAAqB,+BACtC;;;;;;;;;;AA+EH;;iBA5DgB,gBAAA,QAAwB,+BAA+B;;;;;;;iBAiBvD,WAAA,QAAmB,uBAAuB;;;;;;iBAS1C,WAAA,QAAmB;;;;;;;;;;;iBAkBnB,gBAAA,QAAwB;;;;;;;;;;;iBAgBxB,WAAA"}

package/lib/accounts.js

@@ -0,0 +1,298 @@
+import { createHash } from "node:crypto";
+
+//#region src/accounts.ts
+/**
+* The one store entry holding every credential this repo manages.
+*
+* Part of the persistence contract: renaming it orphans every stored entry
+* while looking like a harmless constant change.
+*/
+const CREDENTIAL_ACCOUNT = "aishell-credential";
+/**
+* Entries written by the earlier three-key layout, in the order they are read
+* during migration.
+*
+* Kept only so an existing install keeps working: see {@link readCredentials}.
+* New writes never touch these.
+*/
+const LEGACY_ACCOUNTS = [
+	"HW_ACCESS_KEY",
+	"HW_SECRET_KEY",
+	"HW_SECURITY_TOKEN"
+];
+/**
+* The legacy entry holding an e2b API key on its own.
+*
+* Folded into the bundle by {@link readCredentials}. Kept as a constant because
+* the migration has to name it.
+*/
+const LEGACY_E2B_ACCOUNT = "AISHELL_E2B_API_KEY";
+/**
+* Encode a bundle for storage.
+*
+* @param bundle - the bundle to store.
+* @returns base64 of its JSON form.
+*/
+function encodeBundle(bundle) {
+	return Buffer.from(JSON.stringify(bundle), "utf8").toString("base64");
+}
+/**
+* Decode a stored value.
+*
+* Anything unreadable reads as an empty bundle rather than throwing: a corrupt
+* entry should behave like "nothing stored" so the person is asked to
+* authenticate again, not so every tool call fails on a parse error.
+*
+* A value that is not base64 is tried as raw JSON first — that is what the
+* legacy e2b entry held, and migration reads it through here.
+*
+* @param raw - the stored string, if any.
+* @returns the decoded bundle; empty when nothing usable is there.
+*/
+function decodeBundle(raw) {
+	if (raw === void 0 || raw === "") return {};
+	const text = decodeText(raw);
+	if (text === void 0) return {};
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return {};
+	}
+	if (parsed === null || typeof parsed !== "object") return {};
+	const candidate = parsed;
+	return {
+		...isHuaweiCloudSection(candidate.huaweicloud) ? { huaweicloud: candidate.huaweicloud } : {},
+		...isE2BSection(candidate.aishell_e2b) ? { aishell_e2b: candidate.aishell_e2b } : {}
+	};
+}
+/** Decode base64, falling back to the raw string when it is already text. */
+function decodeText(raw) {
+	try {
+		const decoded = Buffer.from(raw, "base64");
+		if (decoded.toString("base64") === raw.replace(/\s/g, "")) {
+			const text = decoded.toString("utf8");
+			if (text.trimStart().startsWith("{")) return text;
+		}
+	} catch {}
+	return raw.trimStart().startsWith("{") ? raw : void 0;
+}
+/** Whether a decoded field is a usable Huawei Cloud section. */
+function isHuaweiCloudSection(value) {
+	if (value === null || typeof value !== "object") return false;
+	const section = value;
+	return typeof section.access_key === "string" && section.access_key !== "" && typeof section.secret_key === "string" && section.secret_key !== "" && (section.security_token === void 0 || typeof section.security_token === "string");
+}
+/** Whether a decoded field is a usable e2b section. */
+function isE2BSection(value) {
+	if (value === null || typeof value !== "object") return false;
+	const section = value;
+	return typeof section.api_key === "string" && section.api_key !== "" && typeof section.expired_at === "string" && section.expired_at !== "" && (section.ak_fingerprint === void 0 || typeof section.ak_fingerprint === "string");
+}
+/**
+* Read the whole bundle, migrating a legacy layout on the way.
+*
+* Migration is lazy and idempotent: the first read that finds no bundle but
+* finds legacy entries merges them into one record, writes it, and removes the
+* old entries. A failed write leaves the legacy entries alone, so the next read
+* tries again — the person is never left with neither layout.
+*
+* @param store - the caller's credential store.
+* @returns the bundle; empty when nothing is stored.
+*/
+function readCredentials(store) {
+	const stored = store.get(CREDENTIAL_ACCOUNT);
+	if (stored !== void 0) return decodeBundle(stored);
+	const migrated = migrateLegacy(store);
+	if (migrated === void 0) return {};
+	return migrated;
+}
+/**
+* Merge the legacy entries into one record and remove the old ones.
+*
+* @param store - the caller's credential store.
+* @returns the migrated bundle, or `undefined` when there was nothing to move.
+*/
+function migrateLegacy(store) {
+	const ak = store.get(LEGACY_ACCOUNTS[0]);
+	const sk = store.get(LEGACY_ACCOUNTS[1]);
+	const token = store.get(LEGACY_ACCOUNTS[2]);
+	const legacyKey = store.get(LEGACY_E2B_ACCOUNT);
+	const huaweicloud = ak !== void 0 && ak !== "" && sk !== void 0 && sk !== "" ? {
+		access_key: ak,
+		secret_key: sk,
+		...token === void 0 || token === "" ? {} : { security_token: token }
+	} : void 0;
+	const aisleE2B = legacyE2BSection(legacyKey);
+	if (huaweicloud === void 0 && aisleE2B === void 0) return void 0;
+	const bundle = {
+		...huaweicloud === void 0 ? {} : { huaweicloud },
+		...aisleE2B === void 0 ? {} : { aishell_e2b: aisleE2B }
+	};
+	try {
+		store.set(CREDENTIAL_ACCOUNT, encodeBundle(bundle));
+	} catch {
+		return bundle;
+	}
+	for (const account of LEGACY_ACCOUNTS) store.delete(account);
+	store.delete(LEGACY_E2B_ACCOUNT);
+	return bundle;
+}
+/** Read one legacy e2b entry into its bundle section. */
+function legacyE2BSection(raw) {
+	if (raw === void 0 || raw === "") return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return {
+			api_key: raw,
+			expired_at: FOREVER_EXPIRY
+		};
+	}
+	const candidate = parsed;
+	if (candidate === null || typeof candidate !== "object") return void 0;
+	if (typeof candidate.key !== "string" || candidate.key === "") return void 0;
+	return {
+		api_key: candidate.key,
+		expired_at: typeof candidate.expiresAt === "string" ? candidate.expiresAt : FOREVER_EXPIRY,
+		...typeof candidate.akFingerprint === "string" && candidate.akFingerprint !== "" ? { ak_fingerprint: candidate.akFingerprint } : {}
+	};
+}
+/** The expiry recorded for a key that does not expire. */
+const FOREVER_EXPIRY = "9999-12-31T23:59:59.000Z";
+/**
+* Read the Huawei Cloud pair.
+*
+* AK and SK are read together and treated as one unit: half a pair reads as no
+* credentials rather than an error, so a partially-configured machine gets
+* "authenticate first" instead of a signing failure with no remedy. The
+* SecurityToken is optional and is omitted entirely when absent — an empty
+* string would sign as a third header the gateway then rejects.
+*
+* @param store - the caller's credential store.
+* @returns the pair, or `undefined` when the AK/SK pair is incomplete.
+*/
+function readStoredPair(store) {
+	const section = readCredentials(store).huaweicloud;
+	if (section === void 0) return void 0;
+	return {
+		ak: section.access_key,
+		sk: section.secret_key,
+		...section.security_token === void 0 ? {} : { securityToken: section.security_token }
+	};
+}
+/**
+* Whether a complete Huawei Cloud pair is stored.
+*
+* @param store - the caller's credential store.
+*/
+function hasStoredPair(store) {
+	return readStoredPair(store) !== void 0;
+}
+/**
+* Read the stored e2b key.
+*
+* @param store - the caller's credential store.
+* @returns the section, or `undefined` when no key is stored.
+*/
+function readE2BKey(store) {
+	return readCredentials(store).aishell_e2b;
+}
+/**
+* Apply one change to the bundle and write it back.
+*
+* The updater receives the current bundle and returns the next one. Returning
+* `undefined` aborts the write, which is how a caller says "nothing changed" —
+* that matters because every write is a full re-encode, and needlessly
+* rewriting a record while another process reads it is how a spurious
+* "credentials changed" is produced.
+*
+* @param store - the caller's credential store.
+* @param update - computes the next bundle.
+* @returns the bundle now stored.
+*/
+function updateCredentials(store, update) {
+	const current = readCredentials(store);
+	const next = update(current);
+	if (next === void 0) return current;
+	store.set(CREDENTIAL_ACCOUNT, encodeBundle(next));
+	return next;
+}
+/**
+* Store the Huawei Cloud pair, replacing any previous one.
+*
+* One write, so the pair can never be left half-replaced. A save without a
+* token removes a previously stored one: a token belongs to the credential set
+* that carried it, and inheriting a stale one would sign the next request with
+* someone else's session.
+*
+* @param store - the caller's credential store.
+* @param credentials - the verified pair.
+*/
+function writeHuaweiCloud(store, credentials) {
+	updateCredentials(store, (current) => ({
+		...current,
+		huaweicloud: {
+			access_key: credentials.ak,
+			secret_key: credentials.sk,
+			...credentials.securityToken === void 0 ? {} : { security_token: credentials.securityToken }
+		}
+	}));
+}
+/**
+* Store an e2b key.
+*
+* @param store - the caller's credential store.
+* @param key - the section to store.
+*/
+function writeE2BKey(store, key) {
+	updateCredentials(store, (current) => ({
+		...current,
+		aishell_e2b: key
+	}));
+}
+/**
+* Remove the stored e2b key, leaving the Huawei Cloud pair alone.
+*
+* @param store - the caller's credential store.
+*/
+function clearE2BKey(store) {
+	updateCredentials(store, (current) => {
+		if (current.aishell_e2b === void 0) return void 0;
+		const { aishell_e2b: _removed,...rest } = current;
+		return rest;
+	});
+}
+/**
+* Remove every credential this repo writes.
+*
+* The whole record goes, so a clear cannot leave a token or a key behind for
+* the next pair to inherit. Deleting an absent entry is a no-op in every
+* backend, and the legacy entries are removed too so a half-migrated store does
+* not come back.
+*
+* @param store - the caller's credential store.
+*/
+function clearCredentials(store) {
+	store.delete(CREDENTIAL_ACCOUNT);
+	for (const account of LEGACY_ACCOUNTS) store.delete(account);
+	store.delete(LEGACY_E2B_ACCOUNT);
+}
+/**
+* A short, stable digest of an AK, for recording which identity minted a key.
+*
+* The AK rather than the pair: the SK can be rotated independently while the
+* account stays the same, and the tenant the gateway derives is the account. A
+* digest rather than the AK itself keeps the bundle from carrying a second
+* readable copy of a credential identifier.
+*
+* @param ak - the access key.
+*/
+function fingerprint(ak) {
+	return createHash("sha256").update(ak, "utf8").digest("hex");
+}
+
+//#endregion
+export { CREDENTIAL_ACCOUNT, FOREVER_EXPIRY, LEGACY_ACCOUNTS, LEGACY_E2B_ACCOUNT, clearCredentials, clearE2BKey, decodeBundle, encodeBundle, fingerprint, hasStoredPair, readCredentials, readE2BKey, readStoredPair, updateCredentials, writeE2BKey, writeHuaweiCloud };
+//# sourceMappingURL=accounts.js.map

package/lib/accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.js","names":["bundle: CredentialBundle","raw: string | undefined","parsed: unknown","raw: string","value: unknown","store: CredentialsStore","huaweicloud: HuaweiCloudSection | undefined","update: (current: CredentialBundle) => CredentialBundle | undefined","credentials: SignCredentials","key: E2BSection","ak: string"],"sources":["../src/accounts.ts"],"sourcesContent":["/**\n * The Huawei Cloud credential vocabulary every plugin in this set shares.\n *\n * ## Why this module exists\n *\n * This repo once read the same keyring entries from four places, each declaring\n * the account names itself and re-implementing \"read AK and SK as a pair\". The\n * account names are a *persistence* contract, so a divergence would not fail a\n * build — it would surface as one plugin working and another reporting \"not\n * authenticated\" on a machine where the person had stored exactly one pair, and\n * the cause would be invisible in the diff that introduced it.\n *\n * Everything now goes through this file.\n *\n * ## One entry, not three\n *\n * The store holds **one** record, `aishell-credential`, whose value is a single\n * JSON bundle encoded as base64:\n *\n * ```json\n * {\n *   \"huaweicloud\": { \"access_key\": \"…\", \"secret_key\": \"…\", \"security_token\": \"…\" },\n *   \"aishell_e2b\": { \"api_key\": \"…\", \"expired_at\": \"…\", \"ak_fingerprint\": \"…\" }\n * }\n * ```\n *\n * The earlier layout was three separate entries (`HW_ACCESS_KEY`,\n * `HW_SECRET_KEY`, `HW_SECURITY_TOKEN`). That had two problems this fixes:\n *\n *   - **A save was four operations.** Clear, then write AK, then SK, then\n *     token. Every backend is per-entry, so a failure between them left a\n *     half-set behind, and nothing rolled it back.\n *   - **A read was three reads.** A concurrent write landing between them could\n *     hand back a new AK with an old SK — a pair that passes \"both present\" and\n *     then fails at the gateway with 401, pointing nowhere near the cause.\n *\n * One entry makes a write one atomic operation and a read one consistent\n * snapshot.\n *\n * ## base64 is an encoding, not encryption\n *\n * It keeps the secret from sitting in a plaintext field a person or a log\n * prints while poking at the store. It is **not** a security boundary: anyone\n * who can read the entry can decode it. The actual protection is the backend —\n * the OS keyring, or AES-256-GCM in the file backend.\n *\n * ## Read-modify-write is not atomic across processes\n *\n * {@link updateCredentials} reads the bundle, applies a change and writes it\n * back. Two processes doing that concurrently can lose one of the changes. That\n * is accepted rather than solved: the only writer is a person via the\n * credential form, and both the e2b key and the AK/SK are refreshed by that\n * same person. A lost update would be corrected by the next save. Solving it\n * properly needs compare-and-swap, which the keyring API does not offer.\n *\n * @module @huaweidevtools/aishell-dsh-credentials-store/accounts\n */\n\nimport { createHash } from 'node:crypto'\nimport type { CredentialsStore } from './index.ts'\nimport type { SignCredentials } from './signer.ts'\n\n/**\n * The one store entry holding every credential this repo manages.\n *\n * Part of the persistence contract: renaming it orphans every stored entry\n * while looking like a harmless constant change.\n */\nexport const CREDENTIAL_ACCOUNT = 'aishell-credential'\n\n/**\n * Entries written by the earlier three-key layout, in the order they are read\n * during migration.\n *\n * Kept only so an existing install keeps working: see {@link readCredentials}.\n * New writes never touch these.\n */\nexport const LEGACY_ACCOUNTS = ['HW_ACCESS_KEY', 'HW_SECRET_KEY', 'HW_SECURITY_TOKEN'] as const\n\n/**\n * The legacy entry holding an e2b API key on its own.\n *\n * Folded into the bundle by {@link readCredentials}. Kept as a constant because\n * the migration has to name it.\n */\nexport const LEGACY_E2B_ACCOUNT = 'AISHELL_E2B_API_KEY'\n\n/** The Huawei Cloud pair, as the bundle stores it. Snake-case on disk. */\nexport interface HuaweiCloudSection {\n  readonly access_key: string\n  readonly secret_key: string\n  readonly security_token?: string\n}\n\n/**\n * An e2b API key, as the bundle stores it.\n *\n * `ak_fingerprint` is not part of the key the gateway issued — it is a digest\n * of the AK that minted it, so a reader can tell whether the key still belongs\n * to the credentials in hand. Without it, an AK rotation would leave the old\n * key (and so the old tenant, with all its sandboxes) alive. It lives here\n * rather than only in the reader's memory because it has to survive a restart.\n */\nexport interface E2BSection {\n  readonly api_key: string\n  /** ISO 8601; `9999-12-31T23:59:59.000Z` when the key does not expire. */\n  readonly expired_at: string\n  /** {@link fingerprint} of the AK that minted this key, when known. */\n  readonly ak_fingerprint?: string\n}\n\n/** The whole bundle. Either section may be absent. */\nexport interface CredentialBundle {\n  readonly huaweicloud?: HuaweiCloudSection\n  readonly aishell_e2b?: E2BSection\n}\n\n/**\n * Encode a bundle for storage.\n *\n * @param bundle - the bundle to store.\n * @returns base64 of its JSON form.\n */\nexport function encodeBundle(bundle: CredentialBundle): string {\n  return Buffer.from(JSON.stringify(bundle), 'utf8').toString('base64')\n}\n\n/**\n * Decode a stored value.\n *\n * Anything unreadable reads as an empty bundle rather than throwing: a corrupt\n * entry should behave like \"nothing stored\" so the person is asked to\n * authenticate again, not so every tool call fails on a parse error.\n *\n * A value that is not base64 is tried as raw JSON first — that is what the\n * legacy e2b entry held, and migration reads it through here.\n *\n * @param raw - the stored string, if any.\n * @returns the decoded bundle; empty when nothing usable is there.\n */\nexport function decodeBundle(raw: string | undefined): CredentialBundle {\n  if (raw === undefined || raw === '') return {}\n  const text = decodeText(raw)\n  if (text === undefined) return {}\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(text)\n  } catch {\n    return {}\n  }\n  if (parsed === null || typeof parsed !== 'object') return {}\n  const candidate = parsed as { huaweicloud?: unknown, aishell_e2b?: unknown }\n  return {\n    ...(isHuaweiCloudSection(candidate.huaweicloud)\n      ? { huaweicloud: candidate.huaweicloud }\n      : {}),\n    ...(isE2BSection(candidate.aishell_e2b)\n      ? { aishell_e2b: candidate.aishell_e2b }\n      : {}),\n  }\n}\n\n/** Decode base64, falling back to the raw string when it is already text. */\nfunction decodeText(raw: string): string | undefined {\n  try {\n    const decoded = Buffer.from(raw, 'base64')\n    // `Buffer.from` never throws on bad base64 — it drops the unusable tail. So\n    // the round-trip check is what distinguishes real base64 from legacy JSON.\n    if (decoded.toString('base64') === raw.replace(/\\s/g, '')) {\n      const text = decoded.toString('utf8')\n      if (text.trimStart().startsWith('{')) return text\n    }\n  } catch {\n    // Fall through to raw.\n  }\n  return raw.trimStart().startsWith('{') ? raw : undefined\n}\n\n/** Whether a decoded field is a usable Huawei Cloud section. */\nfunction isHuaweiCloudSection(value: unknown): value is HuaweiCloudSection {\n  if (value === null || typeof value !== 'object') return false\n  const section = value as Record<string, unknown>\n  return typeof section.access_key === 'string' && section.access_key !== ''\n    && typeof section.secret_key === 'string' && section.secret_key !== ''\n    && (section.security_token === undefined || typeof section.security_token === 'string')\n}\n\n/** Whether a decoded field is a usable e2b section. */\nfunction isE2BSection(value: unknown): value is E2BSection {\n  if (value === null || typeof value !== 'object') return false\n  const section = value as Record<string, unknown>\n  return typeof section.api_key === 'string' && section.api_key !== ''\n    && typeof section.expired_at === 'string' && section.expired_at !== ''\n    && (section.ak_fingerprint === undefined || typeof section.ak_fingerprint === 'string')\n}\n\n/**\n * Read the whole bundle, migrating a legacy layout on the way.\n *\n * Migration is lazy and idempotent: the first read that finds no bundle but\n * finds legacy entries merges them into one record, writes it, and removes the\n * old entries. A failed write leaves the legacy entries alone, so the next read\n * tries again — the person is never left with neither layout.\n *\n * @param store - the caller's credential store.\n * @returns the bundle; empty when nothing is stored.\n */\nexport function readCredentials(store: CredentialsStore): CredentialBundle {\n  const stored = store.get(CREDENTIAL_ACCOUNT)\n  if (stored !== undefined) return decodeBundle(stored)\n\n  const migrated = migrateLegacy(store)\n  if (migrated === undefined) return {}\n  return migrated\n}\n\n/**\n * Merge the legacy entries into one record and remove the old ones.\n *\n * @param store - the caller's credential store.\n * @returns the migrated bundle, or `undefined` when there was nothing to move.\n */\nfunction migrateLegacy(store: CredentialsStore): CredentialBundle | undefined {\n  const ak = store.get(LEGACY_ACCOUNTS[0])\n  const sk = store.get(LEGACY_ACCOUNTS[1])\n  const token = store.get(LEGACY_ACCOUNTS[2])\n  const legacyKey = store.get(LEGACY_E2B_ACCOUNT)\n\n  const huaweicloud: HuaweiCloudSection | undefined =\n    ak !== undefined && ak !== '' && sk !== undefined && sk !== ''\n      ? {\n        access_key: ak,\n        secret_key: sk,\n        ...(token === undefined || token === '' ? {} : { security_token: token }),\n      }\n      : undefined\n\n  // The legacy e2b entry held `{ key, expiresAt, akFingerprint }`. Re-keyed to\n  // the bundle's snake-case spelling; an older bare key still reads as one that\n  // never expires, which is how the reader treated it.\n  const aisleE2B = legacyE2BSection(legacyKey)\n\n  if (huaweicloud === undefined && aisleE2B === undefined) return undefined\n\n  const bundle: CredentialBundle = {\n    ...(huaweicloud === undefined ? {} : { huaweicloud }),\n    ...(aisleE2B === undefined ? {} : { aishell_e2b: aisleE2B }),\n  }\n\n  try {\n    store.set(CREDENTIAL_ACCOUNT, encodeBundle(bundle))\n  } catch {\n    // Could not write the merged record — leave the legacy entries in place so\n    // the next read retries rather than losing the credentials.\n    return bundle\n  }\n  for (const account of LEGACY_ACCOUNTS) store.delete(account)\n  store.delete(LEGACY_E2B_ACCOUNT)\n  return bundle\n}\n\n/** Read one legacy e2b entry into its bundle section. */\nfunction legacyE2BSection(raw: string | undefined): E2BSection | undefined {\n  if (raw === undefined || raw === '') return undefined\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(raw)\n  } catch {\n    // Not JSON at all: a bare key. Its expiry is unknown, which reads the same\n    // as \"does not expire\"; the gateway's 401 path covers the difference.\n    return { api_key: raw, expired_at: FOREVER_EXPIRY }\n  }\n  const candidate = parsed as { key?: unknown, expiresAt?: unknown, akFingerprint?: unknown } | null\n  if (candidate === null || typeof candidate !== 'object') return undefined\n  if (typeof candidate.key !== 'string' || candidate.key === '') return undefined\n  return {\n    api_key: candidate.key,\n    expired_at: typeof candidate.expiresAt === 'string' ? candidate.expiresAt : FOREVER_EXPIRY,\n    ...(typeof candidate.akFingerprint === 'string' && candidate.akFingerprint !== ''\n      ? { ak_fingerprint: candidate.akFingerprint }\n      : {}),\n  }\n}\n\n/** The expiry recorded for a key that does not expire. */\nexport const FOREVER_EXPIRY = '9999-12-31T23:59:59.000Z'\n\n/**\n * Read the Huawei Cloud pair.\n *\n * AK and SK are read together and treated as one unit: half a pair reads as no\n * credentials rather than an error, so a partially-configured machine gets\n * \"authenticate first\" instead of a signing failure with no remedy. The\n * SecurityToken is optional and is omitted entirely when absent — an empty\n * string would sign as a third header the gateway then rejects.\n *\n * @param store - the caller's credential store.\n * @returns the pair, or `undefined` when the AK/SK pair is incomplete.\n */\nexport function readStoredPair(store: CredentialsStore): SignCredentials | undefined {\n  const section = readCredentials(store).huaweicloud\n  if (section === undefined) return undefined\n  return {\n    ak: section.access_key,\n    sk: section.secret_key,\n    ...(section.security_token === undefined ? {} : { securityToken: section.security_token }),\n  }\n}\n\n/**\n * Whether a complete Huawei Cloud pair is stored.\n *\n * @param store - the caller's credential store.\n */\nexport function hasStoredPair(store: CredentialsStore): boolean {\n  return readStoredPair(store) !== undefined\n}\n\n/**\n * Read the stored e2b key.\n *\n * @param store - the caller's credential store.\n * @returns the section, or `undefined` when no key is stored.\n */\nexport function readE2BKey(store: CredentialsStore): E2BSection | undefined {\n  return readCredentials(store).aishell_e2b\n}\n\n/**\n * Apply one change to the bundle and write it back.\n *\n * The updater receives the current bundle and returns the next one. Returning\n * `undefined` aborts the write, which is how a caller says \"nothing changed\" —\n * that matters because every write is a full re-encode, and needlessly\n * rewriting a record while another process reads it is how a spurious\n * \"credentials changed\" is produced.\n *\n * @param store - the caller's credential store.\n * @param update - computes the next bundle.\n * @returns the bundle now stored.\n */\nexport function updateCredentials(\n  store: CredentialsStore,\n  update: (current: CredentialBundle) => CredentialBundle | undefined,\n): CredentialBundle {\n  const current = readCredentials(store)\n  const next = update(current)\n  if (next === undefined) return current\n  store.set(CREDENTIAL_ACCOUNT, encodeBundle(next))\n  return next\n}\n\n/**\n * Store the Huawei Cloud pair, replacing any previous one.\n *\n * One write, so the pair can never be left half-replaced. A save without a\n * token removes a previously stored one: a token belongs to the credential set\n * that carried it, and inheriting a stale one would sign the next request with\n * someone else's session.\n *\n * @param store - the caller's credential store.\n * @param credentials - the verified pair.\n */\nexport function writeHuaweiCloud(store: CredentialsStore, credentials: SignCredentials): void {\n  updateCredentials(store, current => ({\n    ...current,\n    huaweicloud: {\n      access_key: credentials.ak,\n      secret_key: credentials.sk,\n      ...(credentials.securityToken === undefined ? {} : { security_token: credentials.securityToken }),\n    },\n  }))\n}\n\n/**\n * Store an e2b key.\n *\n * @param store - the caller's credential store.\n * @param key - the section to store.\n */\nexport function writeE2BKey(store: CredentialsStore, key: E2BSection): void {\n  updateCredentials(store, current => ({ ...current, aishell_e2b: key }))\n}\n\n/**\n * Remove the stored e2b key, leaving the Huawei Cloud pair alone.\n *\n * @param store - the caller's credential store.\n */\nexport function clearE2BKey(store: CredentialsStore): void {\n  updateCredentials(store, current => {\n    if (current.aishell_e2b === undefined) return undefined\n    const { aishell_e2b: _removed, ...rest } = current\n    return rest\n  })\n}\n\n/**\n * Remove every credential this repo writes.\n *\n * The whole record goes, so a clear cannot leave a token or a key behind for\n * the next pair to inherit. Deleting an absent entry is a no-op in every\n * backend, and the legacy entries are removed too so a half-migrated store does\n * not come back.\n *\n * @param store - the caller's credential store.\n */\nexport function clearCredentials(store: CredentialsStore): void {\n  store.delete(CREDENTIAL_ACCOUNT)\n  for (const account of LEGACY_ACCOUNTS) store.delete(account)\n  store.delete(LEGACY_E2B_ACCOUNT)\n}\n\n/**\n * A short, stable digest of an AK, for recording which identity minted a key.\n *\n * The AK rather than the pair: the SK can be rotated independently while the\n * account stays the same, and the tenant the gateway derives is the account. A\n * digest rather than the AK itself keeps the bundle from carrying a second\n * readable copy of a credential identifier.\n *\n * @param ak - the access key.\n */\nexport function fingerprint(ak: string): string {\n  return createHash('sha256').update(ak, 'utf8').digest('hex')\n}"],"mappings":";;;;;;;;;AAoEA,MAAa,qBAAqB;;;;;;;;AASlC,MAAa,kBAAkB;CAAC;CAAiB;CAAiB;AAAoB;;;;;;;AAQtF,MAAa,qBAAqB;;;;;;;AAsClC,SAAgB,aAAaA,QAAkC;AAC7D,QAAO,OAAO,KAAK,KAAK,UAAU,OAAO,EAAE,OAAO,CAAC,SAAS,SAAS;AACtE;;;;;;;;;;;;;;AAeD,SAAgB,aAAaC,KAA2C;AACtE,KAAI,kBAAqB,QAAQ,GAAI,QAAO,CAAE;CAC9C,MAAM,OAAO,WAAW,IAAI;AAC5B,KAAI,gBAAoB,QAAO,CAAE;CACjC,IAAIC;AACJ,KAAI;AACF,WAAS,KAAK,MAAM,KAAK;CAC1B,QAAO;AACN,SAAO,CAAE;CACV;AACD,KAAI,WAAW,eAAe,WAAW,SAAU,QAAO,CAAE;CAC5D,MAAM,YAAY;AAClB,QAAO;EACL,GAAI,qBAAqB,UAAU,YAAY,GAC3C,EAAE,aAAa,UAAU,YAAa,IACtC,CAAE;EACN,GAAI,aAAa,UAAU,YAAY,GACnC,EAAE,aAAa,UAAU,YAAa,IACtC,CAAE;CACP;AACF;;AAGD,SAAS,WAAWC,KAAiC;AACnD,KAAI;EACF,MAAM,UAAU,OAAO,KAAK,KAAK,SAAS;AAG1C,MAAI,QAAQ,SAAS,SAAS,KAAK,IAAI,QAAQ,OAAO,GAAG,EAAE;GACzD,MAAM,OAAO,QAAQ,SAAS,OAAO;AACrC,OAAI,KAAK,WAAW,CAAC,WAAW,IAAI,CAAE,QAAO;EAC9C;CACF,QAAO,CAEP;AACD,QAAO,IAAI,WAAW,CAAC,WAAW,IAAI,GAAG;AAC1C;;AAGD,SAAS,qBAAqBC,OAA6C;AACzE,KAAI,UAAU,eAAe,UAAU,SAAU,QAAO;CACxD,MAAM,UAAU;AAChB,eAAc,QAAQ,eAAe,YAAY,QAAQ,eAAe,aAC5D,QAAQ,eAAe,YAAY,QAAQ,eAAe,OAChE,QAAQ,oCAAuC,QAAQ,mBAAmB;AACjF;;AAGD,SAAS,aAAaA,OAAqC;AACzD,KAAI,UAAU,eAAe,UAAU,SAAU,QAAO;CACxD,MAAM,UAAU;AAChB,eAAc,QAAQ,YAAY,YAAY,QAAQ,YAAY,aACtD,QAAQ,eAAe,YAAY,QAAQ,eAAe,OAChE,QAAQ,oCAAuC,QAAQ,mBAAmB;AACjF;;;;;;;;;;;;AAaD,SAAgB,gBAAgBC,OAA2C;CACzE,MAAM,SAAS,MAAM,IAAI,mBAAmB;AAC5C,KAAI,kBAAsB,QAAO,aAAa,OAAO;CAErD,MAAM,WAAW,cAAc,MAAM;AACrC,KAAI,oBAAwB,QAAO,CAAE;AACrC,QAAO;AACR;;;;;;;AAQD,SAAS,cAAcA,OAAuD;CAC5E,MAAM,KAAK,MAAM,IAAI,gBAAgB,GAAG;CACxC,MAAM,KAAK,MAAM,IAAI,gBAAgB,GAAG;CACxC,MAAM,QAAQ,MAAM,IAAI,gBAAgB,GAAG;CAC3C,MAAM,YAAY,MAAM,IAAI,mBAAmB;CAE/C,MAAMC,cACJ,iBAAoB,OAAO,MAAM,iBAAoB,OAAO,KACxD;EACA,YAAY;EACZ,YAAY;EACZ,GAAI,oBAAuB,UAAU,KAAK,CAAE,IAAG,EAAE,gBAAgB,MAAO;CACzE;CAML,MAAM,WAAW,iBAAiB,UAAU;AAE5C,KAAI,0BAA6B,oBAAwB;CAEzD,MAAMN,SAA2B;EAC/B,GAAI,yBAA4B,CAAE,IAAG,EAAE,YAAa;EACpD,GAAI,sBAAyB,CAAE,IAAG,EAAE,aAAa,SAAU;CAC5D;AAED,KAAI;AACF,QAAM,IAAI,oBAAoB,aAAa,OAAO,CAAC;CACpD,QAAO;AAGN,SAAO;CACR;AACD,MAAK,MAAM,WAAW,gBAAiB,OAAM,OAAO,QAAQ;AAC5D,OAAM,OAAO,mBAAmB;AAChC,QAAO;AACR;;AAGD,SAAS,iBAAiBC,KAAiD;AACzE,KAAI,kBAAqB,QAAQ,GAAI;CACrC,IAAIC;AACJ,KAAI;AACF,WAAS,KAAK,MAAM,IAAI;CACzB,QAAO;AAGN,SAAO;GAAE,SAAS;GAAK,YAAY;EAAgB;CACpD;CACD,MAAM,YAAY;AAClB,KAAI,cAAc,eAAe,cAAc,SAAU;AACzD,YAAW,UAAU,QAAQ,YAAY,UAAU,QAAQ,GAAI;AAC/D,QAAO;EACL,SAAS,UAAU;EACnB,mBAAmB,UAAU,cAAc,WAAW,UAAU,YAAY;EAC5E,UAAW,UAAU,kBAAkB,YAAY,UAAU,kBAAkB,KAC3E,EAAE,gBAAgB,UAAU,cAAe,IAC3C,CAAE;CACP;AACF;;AAGD,MAAa,iBAAiB;;;;;;;;;;;;;AAc9B,SAAgB,eAAeG,OAAsD;CACnF,MAAM,UAAU,gBAAgB,MAAM,CAAC;AACvC,KAAI,mBAAuB;AAC3B,QAAO;EACL,IAAI,QAAQ;EACZ,IAAI,QAAQ;EACZ,GAAI,QAAQ,4BAA+B,CAAE,IAAG,EAAE,eAAe,QAAQ,eAAgB;CAC1F;AACF;;;;;;AAOD,SAAgB,cAAcA,OAAkC;AAC9D,QAAO,eAAe,MAAM;AAC7B;;;;;;;AAQD,SAAgB,WAAWA,OAAiD;AAC1E,QAAO,gBAAgB,MAAM,CAAC;AAC/B;;;;;;;;;;;;;;AAeD,SAAgB,kBACdA,OACAE,QACkB;CAClB,MAAM,UAAU,gBAAgB,MAAM;CACtC,MAAM,OAAO,OAAO,QAAQ;AAC5B,KAAI,gBAAoB,QAAO;AAC/B,OAAM,IAAI,oBAAoB,aAAa,KAAK,CAAC;AACjD,QAAO;AACR;;;;;;;;;;;;AAaD,SAAgB,iBAAiBF,OAAyBG,aAAoC;AAC5F,mBAAkB,OAAO,CAAA,aAAY;EACnC,GAAG;EACH,aAAa;GACX,YAAY,YAAY;GACxB,YAAY,YAAY;GACxB,GAAI,YAAY,2BAA8B,CAAE,IAAG,EAAE,gBAAgB,YAAY,cAAe;EACjG;CACF,GAAE;AACJ;;;;;;;AAQD,SAAgB,YAAYH,OAAyBI,KAAuB;AAC1E,mBAAkB,OAAO,CAAA,aAAY;EAAE,GAAG;EAAS,aAAa;CAAK,GAAE;AACxE;;;;;;AAOD,SAAgB,YAAYJ,OAA+B;AACzD,mBAAkB,OAAO,CAAA,YAAW;AAClC,MAAI,QAAQ,uBAA2B;EACvC,MAAM,EAAE,aAAa,SAAU,GAAG,MAAM,GAAG;AAC3C,SAAO;CACR,EAAC;AACH;;;;;;;;;;;AAYD,SAAgB,iBAAiBA,OAA+B;AAC9D,OAAM,OAAO,mBAAmB;AAChC,MAAK,MAAM,WAAW,gBAAiB,OAAM,OAAO,QAAQ;AAC5D,OAAM,OAAO,mBAAmB;AACjC;;;;;;;;;;;AAYD,SAAgB,YAAYK,IAAoB;AAC9C,QAAO,WAAW,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,MAAM;AAC7D"}