@noy-db/hub 0.3.0-pre.9 → 0.3.0

package/dist/chunk-CIE2BASH.js

@@ -0,0 +1,404 @@
+import {
+  DecryptionError,
+  InvalidKeyError,
+  TamperedError
+} from "./chunk-BIOUI4HL.js";
+
+// src/kernel/enclave/crypto.ts
+var PBKDF2_ITERATIONS = 6e5;
+var SALT_BYTES = 32;
+var IV_BYTES = 12;
+var KEY_BITS = 256;
+var subtle = globalThis.crypto.subtle;
+async function deriveKey(passphrase, salt) {
+  const keyMaterial = await subtle.importKey(
+    "raw",
+    new TextEncoder().encode(passphrase),
+    "PBKDF2",
+    false,
+    ["deriveKey"]
+  );
+  return subtle.deriveKey(
+    {
+      name: "PBKDF2",
+      salt,
+      iterations: PBKDF2_ITERATIONS,
+      hash: "SHA-256"
+    },
+    keyMaterial,
+    { name: "AES-KW", length: KEY_BITS },
+    false,
+    ["wrapKey", "unwrapKey"]
+  );
+}
+async function derivePassphraseKey(passphrase, salt, params) {
+  const keyMaterial = await subtle.importKey(
+    "raw",
+    new TextEncoder().encode(passphrase),
+    "PBKDF2",
+    false,
+    ["deriveKey"]
+  );
+  return params.keyUsage === "aes-gcm" ? subtle.deriveKey(
+    {
+      name: "PBKDF2",
+      salt,
+      iterations: params.iterations,
+      hash: "SHA-256"
+    },
+    keyMaterial,
+    { name: "AES-GCM", length: KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  ) : subtle.deriveKey(
+    {
+      name: "PBKDF2",
+      salt,
+      iterations: params.iterations,
+      hash: "SHA-256"
+    },
+    keyMaterial,
+    { name: "AES-KW", length: KEY_BITS },
+    false,
+    ["wrapKey", "unwrapKey"]
+  );
+}
+async function generateDEK() {
+  return subtle.generateKey(
+    { name: "AES-GCM", length: KEY_BITS },
+    true,
+    // extractable — needed for AES-KW wrapping
+    ["encrypt", "decrypt"]
+  );
+}
+async function wrapKey(dek, kek) {
+  const wrapped = await subtle.wrapKey("raw", dek, kek, "AES-KW");
+  return bufferToBase64(wrapped);
+}
+async function unwrapKey(wrappedBase64, kek) {
+  try {
+    return await subtle.unwrapKey(
+      "raw",
+      base64ToBuffer(wrappedBase64),
+      kek,
+      "AES-KW",
+      { name: "AES-GCM", length: KEY_BITS },
+      true,
+      ["encrypt", "decrypt"]
+    );
+  } catch {
+    throw new InvalidKeyError();
+  }
+}
+async function asKwKey(dek) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-cek-wrap");
+  const info = new TextEncoder().encode("v1");
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle.importKey("raw", bits, "AES-KW", false, ["wrapKey", "unwrapKey"]);
+}
+async function wrapCek(cek, dek) {
+  const kw = await asKwKey(dek);
+  const wrapped = await subtle.wrapKey("raw", cek, kw, "AES-KW");
+  return bufferToBase64(wrapped);
+}
+async function unwrapCek(wrappedBase64, dek) {
+  const kw = await asKwKey(dek);
+  try {
+    return await subtle.unwrapKey(
+      "raw",
+      base64ToBuffer(wrappedBase64),
+      kw,
+      "AES-KW",
+      { name: "AES-GCM", length: KEY_BITS },
+      true,
+      ["encrypt", "decrypt"]
+    );
+  } catch {
+    throw new InvalidKeyError();
+  }
+}
+async function importCek(rawKey) {
+  return subtle.importKey("raw", rawKey, { name: "AES-GCM", length: KEY_BITS }, false, ["decrypt"]);
+}
+async function encrypt(plaintext, dek) {
+  const iv = generateIV();
+  const encoded = new TextEncoder().encode(plaintext);
+  const ciphertext = await subtle.encrypt(
+    { name: "AES-GCM", iv },
+    dek,
+    encoded
+  );
+  return {
+    iv: bufferToBase64(iv),
+    data: bufferToBase64(ciphertext)
+  };
+}
+async function decrypt(ivBase64, dataBase64, dek) {
+  const iv = base64ToBuffer(ivBase64);
+  const ciphertext = base64ToBuffer(dataBase64);
+  try {
+    const plaintext = await subtle.decrypt(
+      { name: "AES-GCM", iv },
+      dek,
+      ciphertext
+    );
+    return new TextDecoder().decode(plaintext);
+  } catch (err) {
+    if (err instanceof Error && err.name === "OperationError") {
+      throw new TamperedError();
+    }
+    throw new DecryptionError(
+      err instanceof Error ? err.message : "Decryption failed"
+    );
+  }
+}
+async function encryptBytes(data, dek) {
+  const iv = generateIV();
+  const ciphertext = await subtle.encrypt(
+    { name: "AES-GCM", iv },
+    dek,
+    data
+  );
+  return {
+    iv: bufferToBase64(iv),
+    data: bufferToBase64(ciphertext)
+  };
+}
+async function decryptBytes(ivBase64, dataBase64, dek) {
+  const iv = base64ToBuffer(ivBase64);
+  const ciphertext = base64ToBuffer(dataBase64);
+  try {
+    const plaintext = await subtle.decrypt(
+      { name: "AES-GCM", iv },
+      dek,
+      ciphertext
+    );
+    return new Uint8Array(plaintext);
+  } catch (err) {
+    if (err instanceof Error && err.name === "OperationError") {
+      throw new TamperedError();
+    }
+    throw new DecryptionError(
+      err instanceof Error ? err.message : "Decryption failed"
+    );
+  }
+}
+async function sha256Hex(data) {
+  const hash = await subtle.digest("SHA-256", data);
+  return Array.from(new Uint8Array(hash)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function hmacSha256Hex(key, data) {
+  const rawKey = await subtle.exportKey("raw", key);
+  const hmacKey = await subtle.importKey(
+    "raw",
+    rawKey,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sig = await subtle.sign("HMAC", hmacKey, data);
+  return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function encryptBytesWithAAD(data, dek, aad) {
+  const iv = generateIV();
+  const ciphertext = await subtle.encrypt(
+    {
+      name: "AES-GCM",
+      iv,
+      additionalData: aad
+    },
+    dek,
+    data
+  );
+  return {
+    iv: bufferToBase64(iv),
+    data: bufferToBase64(ciphertext)
+  };
+}
+async function decryptBytesWithAAD(ivBase64, dataBase64, dek, aad) {
+  const iv = base64ToBuffer(ivBase64);
+  const ciphertext = base64ToBuffer(dataBase64);
+  try {
+    const plaintext = await subtle.decrypt(
+      {
+        name: "AES-GCM",
+        iv,
+        additionalData: aad
+      },
+      dek,
+      ciphertext
+    );
+    return new Uint8Array(plaintext);
+  } catch (err) {
+    if (err instanceof Error && err.name === "OperationError") {
+      throw new TamperedError();
+    }
+    throw new DecryptionError(
+      err instanceof Error ? err.message : "Decryption failed"
+    );
+  }
+}
+async function derivePresenceKey(dek, collectionName) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey(
+    "raw",
+    rawDek,
+    "HKDF",
+    false,
+    ["deriveBits"]
+  );
+  const salt = new TextEncoder().encode("noydb-presence");
+  const info = new TextEncoder().encode(collectionName);
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle.importKey(
+    "raw",
+    bits,
+    { name: "AES-GCM", length: KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function deriveSealedFieldKey(dek, collectionName, field) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-sealed");
+  const info = new TextEncoder().encode(JSON.stringify(["noydb-sealed", collectionName, field]));
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle.importKey(
+    "raw",
+    bits,
+    { name: "AES-GCM", length: KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function deriveSealedFieldKeyFromCek(cek, collectionName, field) {
+  const rawCek = await subtle.exportKey("raw", cek);
+  const hkdfKey = await subtle.importKey("raw", rawCek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-sealed-cek");
+  const info = new TextEncoder().encode(JSON.stringify(["noydb-sealed-cek", collectionName, field]));
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle.importKey(
+    "raw",
+    bits,
+    { name: "AES-GCM", length: KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function deriveDeterministicKey(dek) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-det");
+  const info = new TextEncoder().encode(JSON.stringify(["noydb-det"]));
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle.importKey(
+    "raw",
+    bits,
+    { name: "AES-GCM", length: KEY_BITS },
+    true,
+    ["encrypt", "decrypt"]
+  );
+}
+async function deriveDeterministicIV(dek, context, plaintext) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-deterministic-v1");
+  const info = new TextEncoder().encode(`${context}\0${plaintext}`);
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    IV_BYTES * 8
+  );
+  return new Uint8Array(bits);
+}
+async function encryptDeterministic(plaintext, dek, context) {
+  const iv = await deriveDeterministicIV(dek, context, plaintext);
+  const encoded = new TextEncoder().encode(plaintext);
+  const ciphertext = await subtle.encrypt(
+    { name: "AES-GCM", iv },
+    dek,
+    encoded
+  );
+  return {
+    iv: bufferToBase64(iv),
+    data: bufferToBase64(ciphertext)
+  };
+}
+async function decryptDeterministic(ivBase64, dataBase64, dek) {
+  return decrypt(ivBase64, dataBase64, dek);
+}
+function generateIV() {
+  return globalThis.crypto.getRandomValues(new Uint8Array(IV_BYTES));
+}
+function generateSalt() {
+  return globalThis.crypto.getRandomValues(new Uint8Array(SALT_BYTES));
+}
+function bufferToBase64(buffer) {
+  const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary);
+}
+function base64ToBuffer(base64) {
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+
+export {
+  deriveKey,
+  derivePassphraseKey,
+  generateDEK,
+  wrapKey,
+  unwrapKey,
+  wrapCek,
+  unwrapCek,
+  importCek,
+  encrypt,
+  decrypt,
+  encryptBytes,
+  decryptBytes,
+  sha256Hex,
+  hmacSha256Hex,
+  encryptBytesWithAAD,
+  decryptBytesWithAAD,
+  derivePresenceKey,
+  deriveSealedFieldKey,
+  deriveSealedFieldKeyFromCek,
+  deriveDeterministicKey,
+  encryptDeterministic,
+  decryptDeterministic,
+  generateIV,
+  generateSalt,
+  bufferToBase64,
+  base64ToBuffer
+};
+//# sourceMappingURL=chunk-CIE2BASH.js.map

package/dist/chunk-CRI4OUV4.js

@@ -0,0 +1,42 @@
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-JNAI2HN2.js";
+
+// src/with-party/policy/storage.ts
+var META_COLLECTION = "_meta";
+var POLICY_RECORD_ID = "policy";
+async function loadVaultPolicy(store, vault) {
+  const envelope = await store.get(vault, META_COLLECTION, POLICY_RECORD_ID);
+  if (!envelope) return void 0;
+  try {
+    const parsed = JSON.parse(envelope._data);
+    if (!isVaultPolicy(parsed)) return void 0;
+    return parsed;
+  } catch {
+    return void 0;
+  }
+}
+async function saveVaultPolicy(store, vault, policy) {
+  const envelope = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: JSON.stringify(policy)
+  };
+  await store.put(vault, META_COLLECTION, POLICY_RECORD_ID, envelope);
+}
+function isVaultPolicy(x) {
+  if (x === null || typeof x !== "object") return false;
+  if (!("gates" in x)) return false;
+  const gates = x.gates;
+  return gates !== null && typeof gates === "object";
+}
+
+export {
+  META_COLLECTION,
+  POLICY_RECORD_ID,
+  loadVaultPolicy,
+  saveVaultPolicy
+};
+//# sourceMappingURL=chunk-CRI4OUV4.js.map

package/dist/chunk-DLG74CNB.js

@@ -0,0 +1,91 @@
+import {
+  canonicalJson,
+  sha256Hex
+} from "./chunk-Q5VNKNE5.js";
+import {
+  PeriodClosedError,
+  ValidationError
+} from "./chunk-BIOUI4HL.js";
+
+// src/with-audit/periods/periods.ts
+var PERIODS_COLLECTION = "_periods";
+var PERIOD_FREEZES_COLLECTION = "_period_freezes";
+var PERIOD_ARCHIVES_COLLECTION = "_period_archives";
+var PERIOD_TARGET_PURGES_COLLECTION = "_period_target_purges";
+function periodExclusiveUpperBound(endDate) {
+  const ms = Date.parse(endDate);
+  if (Number.isNaN(ms)) throw new ValidationError(`freezePeriod: unparseable period endDate "${endDate}".`);
+  const dateOnly = /^\d{4}-\d{2}-\d{2}$/.test(endDate);
+  return new Date(ms + (dateOnly ? 864e5 : 1)).toISOString();
+}
+async function loadPeriods(adapter, vault, decrypt) {
+  const ids = await adapter.list(vault, PERIODS_COLLECTION);
+  const records = [];
+  for (const id of ids) {
+    const env = await adapter.get(vault, PERIODS_COLLECTION, id);
+    if (env) records.push(await decrypt(env));
+  }
+  records.sort((a, b) => a.closedAt.localeCompare(b.closedAt));
+  return records;
+}
+async function chainAnchor(records) {
+  const last = records[records.length - 1];
+  if (!last) return { priorPeriodHash: "" };
+  const hash = await sha256Hex(canonicalJson(last));
+  return { priorPeriodName: last.name, priorPeriodHash: hash };
+}
+function assertTsWritable(existing, incomingRecord, closedPeriods) {
+  for (const p of closedPeriods) {
+    if (p.kind !== "closed") continue;
+    if (p.dateField) {
+      const checkRecord = (label, r) => {
+        if (!r) return;
+        const v = r[p.dateField];
+        if (typeof v === "string" && v <= p.endDate) {
+          throw new PeriodClosedError(p.name, p.endDate, `${label}[${p.dateField}]=${v}`);
+        }
+      };
+      checkRecord("existing", existing?.record ?? null);
+      checkRecord("incoming", incomingRecord);
+      continue;
+    }
+    const existingTs = existing?.ts ?? null;
+    if (existingTs !== null && existingTs <= p.endDate) {
+      throw new PeriodClosedError(p.name, p.endDate, existingTs);
+    }
+  }
+}
+function validatePeriodName(name, existing) {
+  if (name.length === 0) {
+    throw new ValidationError("Period name cannot be empty.");
+  }
+  if (existing.some((p) => p.name === name)) {
+    throw new ValidationError(`Period "${name}" already exists.`);
+  }
+}
+async function appendPeriodLedgerEntry(ledger, actor, envelope, name, collection = PERIODS_COLLECTION) {
+  if (!ledger) return;
+  const { envelopePayloadHash } = await import("./ledger-GFBKVPV4.js");
+  await ledger.append({
+    op: "put",
+    collection,
+    id: name,
+    version: envelope._v,
+    actor,
+    payloadHash: await envelopePayloadHash(envelope)
+  });
+}
+
+export {
+  PERIODS_COLLECTION,
+  PERIOD_FREEZES_COLLECTION,
+  PERIOD_ARCHIVES_COLLECTION,
+  PERIOD_TARGET_PURGES_COLLECTION,
+  periodExclusiveUpperBound,
+  loadPeriods,
+  chainAnchor,
+  assertTsWritable,
+  validatePeriodName,
+  appendPeriodLedgerEntry
+};
+//# sourceMappingURL=chunk-DLG74CNB.js.map

package/dist/chunk-E5ZQT5KX.js

@@ -0,0 +1,30 @@
+import {
+  BrokerNotEnabledError
+} from "./chunk-BIOUI4HL.js";
+
+// src/port/with/broker-strategy.ts
+var NO_BROKER = {
+  async enroll() {
+    throw new BrokerNotEnabledError();
+  },
+  async rotate() {
+    throw new BrokerNotEnabledError();
+  },
+  credentialSource() {
+    throw new BrokerNotEnabledError();
+  }
+};
+function buildCredentialBrokerHandle(strategy, store, vault, getKeyring) {
+  const ctx = () => ({ store, vault, keyring: getKeyring() });
+  return {
+    enroll: () => strategy.enroll(ctx()),
+    rotate: () => strategy.rotate(ctx()),
+    credentialSource: (profile) => strategy.credentialSource(ctx(), profile)
+  };
+}
+
+export {
+  NO_BROKER,
+  buildCredentialBrokerHandle
+};
+//# sourceMappingURL=chunk-E5ZQT5KX.js.map

package/dist/chunk-E5ZQT5KX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/port/with/broker-strategy.ts"],"sourcesContent":["/**\n * Credential-broker strategy seam (#479, credential-broker spec §5). Lives\n * on the `/with` port (the one seam the kernel spine may import statically)\n * so `Vault` can hold the `NO_BROKER` floor default without a spine→service\n * static import — the same idiom as `port/with/team-strategy.ts`.\n *\n * `BrokerCtx` bundles what the `_broker` seed lifecycle needs (`store`/\n * `vault`/`keyring`) into one argument, so `BrokerStrategy`'s three methods\n * stay uniform. The `BrokerConfig` a strategy was built with is NOT part of\n * this port-level ctx — `withBroker(config)` (`with-party/broker/active.ts`)\n * keeps it in its own closure and injects it into the richer\n * {@link BrokerSeedCtx} it passes to the `_broker` seed ops\n * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`). `NO_BROKER` (the floor\n * default) never builds a ctx — every method throws first.\n * @internal\n */\nimport type { NoydbStore, StoreCredentialSource } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport { BrokerNotEnabledError } from '../../kernel/errors.js'\n\n/** Construction-time options for `withBroker(config)` (spec §5 client surface). */\nexport interface BrokerConfig {\n  /**\n   * Stable id; part of the HKDF info tag AND the proof canonical. MUST be\n   * globally-unique / endpoint-derived (spec F4) — reusing one `brokerId`\n   * across two endpoints enables a cross-endpoint relay.\n   */\n  readonly brokerId: string\n  /** https broker base URL; its origin is bound into the proof MAC (F4). */\n  readonly endpoint: string\n  /** Dev-backend session token for `/enroll` (spec decision 1). */\n  readonly attestation?: (() => string | Promise<string>) | undefined\n  /** DI for tests / non-window runtimes. */\n  readonly fetch?: typeof fetch | undefined\n  /** Refresh margin in ms, default 60_000. */\n  readonly skewMs?: number | undefined\n}\n\n/**\n * Per-call context a {@link BrokerStrategy} method needs: the seed API's\n * `store`/`vault`/`keyring`.\n */\nexport interface BrokerCtx {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly keyring: UnlockedKeyring\n}\n\n/**\n * {@link BrokerCtx} augmented with the `BrokerConfig` the `_broker` seed ops\n * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`) need. `withBroker(config)`\n * (`with-party/broker/active.ts`) builds this by injecting its closed-over\n * `config` into the port-level `BrokerCtx` it receives — the port interface\n * itself never carries `config`.\n */\nexport interface BrokerSeedCtx extends BrokerCtx {\n  readonly config: BrokerConfig\n}\n\n/** The vault-bound handle `vault.broker()` returns (spec §5). */\nexport interface CredentialBrokerHandle {\n  /** Generate+persist the `_broker` seed (idempotent), register its proof key. */\n  enroll(): Promise<void>\n  /** Rotate the seed + re-register (revokes the old proof key after a grace window). */\n  rotate(): Promise<void>\n  /** Single-flight, per-profile cache of a `StoreCredentialSource`. */\n  credentialSource(profile?: string): StoreCredentialSource\n}\n\n/** The opt-in strategy contract `withBroker(config)` implements. */\nexport interface BrokerStrategy {\n  enroll(ctx: BrokerCtx): Promise<void>\n  rotate(ctx: BrokerCtx): Promise<void>\n  credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource\n}\n\n/**\n * No-op stub — the floor default. Every broker operation throws\n * {@link BrokerNotEnabledError}; opt in with `brokerStrategy: withBroker(config)`\n * (from `@noy-db/hub/broker`) in `createNoydb()`.\n * @internal\n */\nexport const NO_BROKER: BrokerStrategy = {\n  async enroll() { throw new BrokerNotEnabledError() },\n  async rotate() { throw new BrokerNotEnabledError() },\n  credentialSource() { throw new BrokerNotEnabledError() },\n}\n\n/**\n * Build the vault-bound {@link CredentialBrokerHandle} `vault.broker()`\n * returns — factored out of `kernel/vault.ts` to keep that file's footprint\n * to a single accessor line (the kernel-surface ceiling). `getKeyring` is a\n * thunk, not a snapshot: the active keyring can change after `vault.load()`,\n * so each handle method re-reads it fresh at call time.\n */\nexport function buildCredentialBrokerHandle(\n  strategy: BrokerStrategy,\n  store: NoydbStore,\n  vault: string,\n  getKeyring: () => UnlockedKeyring,\n): CredentialBrokerHandle {\n  const ctx = (): BrokerCtx => ({ store, vault, keyring: getKeyring() })\n  return {\n    enroll: () => strategy.enroll(ctx()),\n    rotate: () => strategy.rotate(ctx()),\n    credentialSource: (profile) => strategy.credentialSource(ctx(), profile),\n  }\n}\n"],"mappings":";;;;;AAkFO,IAAM,YAA4B;AAAA,EACvC,MAAM,SAAS;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACnD,MAAM,SAAS;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACnD,mBAAmB;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AACzD;AASO,SAAS,4BACd,UACA,OACA,OACA,YACwB;AACxB,QAAM,MAAM,OAAkB,EAAE,OAAO,OAAO,SAAS,WAAW,EAAE;AACpE,SAAO;AAAA,IACL,QAAQ,MAAM,SAAS,OAAO,IAAI,CAAC;AAAA,IACnC,QAAQ,MAAM,SAAS,OAAO,IAAI,CAAC;AAAA,IACnC,kBAAkB,CAAC,YAAY,SAAS,iBAAiB,IAAI,GAAG,OAAO;AAAA,EACzE;AACF;","names":[]}