@ratelkey/burrow-sdk 0.1.0

package/README.md

@@ -0,0 +1,108 @@
+# Burrow SDK for Node.js
+
+Read secrets from a self-hosted [RatelKey](https://ratelkey.com) Burrow with a machine identity.
+
+This is the Node.js SDK. It lives under `tools/SDKs/<language>/`, one directory per language; each SDK is a
+standalone, independently-published artifact that speaks the same signed machine data-plane protocol. Its API
+mirrors the Kotlin/JVM SDK one-for-one, so a Burrow reads the same way in either language.
+
+## What it does
+
+A machine authenticates to a Burrow with a per-request **Ed25519 signature** — no session, no long-lived
+bearer token. The private key is generated on the machine during bootstrap and never leaves it. This SDK
+signs each read the same way the `ratel` CLI does, so a machine bootstrapped once works with both.
+
+- Single and structured secrets, and individual fields of a structured secret.
+- The machine's own access map (which projects/environments it can read).
+- Trust-on-first-use certificate pinning for the default self-signed Burrow (shared pin store with the CLI),
+  or standard CA trust for a Burrow on a real domain.
+
+## Requirements
+
+- Node 18.17+ (native Ed25519 in `node:crypto`, no crypto dependency).
+- Zero runtime dependencies. Ships ESM and CommonJS, with TypeScript types.
+
+## Bootstrap a machine
+
+From the Burrow dashboard, open **Machines → Add machine** and run the one-line install on the target host.
+It generates the keypair locally, registers the public key, and writes the identity to
+`~/.burrow/burrows/<slug>/identity.json`. Grant the machine access to the projects/environments it needs.
+
+## Quick start
+
+```ts
+import { Burrow } from "@ratelkey/burrow-sdk";
+
+// The single machine identity on this host (under ~/.burrow, or $BURROW_HOME).
+const burrow = Burrow();
+
+// A single-value secret:
+const apiKey = (await burrow.getSecret("payments/prod/API_KEY")).value;
+
+// A structured secret — one read, projected locally (no re-fetch):
+const db = await burrow.getSecret("payments/prod/DATABASE");
+const all = db.toMap();                                       // every field as name → value
+const host = db.getField("host");                             // one field
+const [user, pass] = db.getFields("username", "password");    // in order — destructures
+
+// What this machine can read:
+for (const p of await burrow.listProjects()) console.log(`${p.project}: ${p.categories}`);
+```
+
+Resolving the identity and loading its key are synchronous; only the reads themselves are async.
+
+Point it at a specific identity by selector or path:
+
+```ts
+Burrow("burrow-a1b2c3d4e5f60718");                          // slug / name / machine id / URL
+Burrow("/home/you/.burrow/burrows/burrow-a1b2c3d4e5f60718"); // path (a burrow dir or identity.json)
+```
+
+## Without `~/.burrow`
+
+For an app that manages its own key material:
+
+```ts
+const burrow = Burrow.connect({
+  burrowUrl: "https://burrow.internal:12010",
+  machineId: "…",
+  privateKeyPem: process.env.BURROW_MACHINE_KEY, // PKCS#8 PEM
+});
+```
+
+## Certificate trust
+
+Burrows serve HTTPS self-signed by default, so the SDK pins the Burrow's **public key** rather than
+disabling verification. The key, not the certificate: a Burrow that adds a custom domain or renews its
+certificate is still the same Burrow, and pinning the certificate would refuse it.
+
+- `TlsMode.Pinned` (default) — trust-on-first-use; pins on first contact, refuses a changed key. Kept beside
+  that Burrow's identity at `~/.burrow/burrows/<slug>/known_cert`, shared with the CLI.
+- `TlsMode.PinnedTo("aa:bb:…")` — pin to a known fingerprint (the SHA-256 the Burrow shows in its network
+  settings). No first-use trust.
+- `TlsMode.SystemTrust` — standard CA + hostname verification, for a Burrow on a custom domain or Let's
+  Encrypt.
+
+The handshake completes and the pin is checked before the HTTP request is written, so a mismatched
+certificate never sees the signed request.
+
+```ts
+import { Burrow, TlsMode } from "@ratelkey/burrow-sdk";
+
+const burrow = Burrow(null, { tls: TlsMode.SystemTrust });
+```
+
+## Errors
+
+Every failure is a `BurrowException`: `BurrowAuthException` (401), `BurrowForbiddenException` (403, no grant),
+`BurrowNotFoundException` (404), `BurrowServerException` (5xx), `BurrowCertificateException` (pin mismatch),
+`BurrowTransportException` (unreachable / unparsable), `BurrowIdentityException` (no/ambiguous/invalid
+identity), plus two projection errors on the result handle — `SecretShapeException` (e.g. `.value` on a
+structured secret) and `FieldNotFoundException`. The message carries the Burrow's own reason.
+
+## Build
+
+```
+npm install
+npm run build
+```

package/dist/cjs/Burrow.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Burrow = exports.DEFAULT_CLIENT_TAG = exports.SDK_VERSION = void 0;
+const BurrowClient_js_1 = require("./BurrowClient.js");
+const Identity_js_1 = require("./Identity.js");
+const Tls_js_1 = require("./Tls.js");
+/** The SDK version, reported in the `Ratel-Client` header for the Burrow's audit trail. */
+exports.SDK_VERSION = "0.1.0";
+/** The default `Ratel-Client` tag. It contains "sdk", so the Burrow classifies reads as the SDK channel. */
+exports.DEFAULT_CLIENT_TAG = `ratel-sdk-node/${exports.SDK_VERSION}`;
+/**
+ * Open a client. `target` is one of:
+ *  - omitted — the single identity on this host (under `~/.burrow`, or `$BURROW_HOME`);
+ *  - a selector — a burrow slug, name, machine id, or URL;
+ *  - a filesystem path — a burrow identity directory or an `identity.json` file.
+ */
+function open(target, options = {}) {
+    const id = Identity_js_1.Identities.select(target);
+    return new BurrowClient_js_1.DefaultBurrowClient(id.burrowUrl, id.machineId, id.loadPrivateKey(), options.clientTag ?? exports.DEFAULT_CLIENT_TAG, options.tls ?? Tls_js_1.TlsMode.Pinned, id.directory);
+}
+/**
+ * Connect with an explicit identity — for an app that manages its own key material rather than reading the
+ * `~/.burrow` file.
+ */
+function connect(options) {
+    const key = (0, Identity_js_1.parseEd25519PrivateKey)(options.privateKeyPem, "provided PEM");
+    return new BurrowClient_js_1.DefaultBurrowClient(options.burrowUrl, options.machineId, key, options.clientTag ?? exports.DEFAULT_CLIENT_TAG, options.tls ?? Tls_js_1.TlsMode.Pinned, options.pinStoreDir ?? null);
+}
+exports.Burrow = Object.assign(open, { DEFAULT_CLIENT_TAG: exports.DEFAULT_CLIENT_TAG, connect });
+//# sourceMappingURL=Burrow.js.map

package/dist/cjs/Burrow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Burrow.js","sourceRoot":"","sources":["../../src/Burrow.ts"],"names":[],"mappings":";;;AAAA,uDAA2E;AAC3E,+CAAmE;AACnE,qCAAmC;AAEnC,2FAA2F;AAC9E,QAAA,WAAW,GAAG,OAAO,CAAC;AAEnC,4GAA4G;AAC/F,QAAA,kBAAkB,GAAG,kBAAkB,mBAAW,EAAE,CAAC;AA2BlE;;;;;GAKG;AACH,SAAS,IAAI,CAAC,MAAsB,EAAE,UAAyB,EAAE;IAC/D,MAAM,EAAE,GAAG,wBAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,IAAI,qCAAmB,CAC5B,EAAE,CAAC,SAAS,EACZ,EAAE,CAAC,SAAS,EACZ,EAAE,CAAC,cAAc,EAAE,EACnB,OAAO,CAAC,SAAS,IAAI,0BAAkB,EACvC,OAAO,CAAC,GAAG,IAAI,gBAAO,CAAC,MAAM,EAC7B,EAAE,CAAC,SAAS,CACb,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,OAAuB;IACtC,MAAM,GAAG,GAAG,IAAA,oCAAsB,EAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAC1E,OAAO,IAAI,qCAAmB,CAC5B,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,SAAS,EACjB,GAAG,EACH,OAAO,CAAC,SAAS,IAAI,0BAAkB,EACvC,OAAO,CAAC,GAAG,IAAI,gBAAO,CAAC,MAAM,EAC7B,OAAO,CAAC,WAAW,IAAI,IAAI,CAC5B,CAAC;AACJ,CAAC;AAiCY,QAAA,MAAM,GAAkB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAlB,0BAAkB,EAAE,OAAO,EAAE,CAAC,CAAC"}

package/dist/cjs/BurrowClient.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DefaultBurrowClient = void 0;
+const Errors_js_1 = require("./Errors.js");
+const Model_js_1 = require("./Model.js");
+const Signer_js_1 = require("./Signer.js");
+const Transport_js_1 = require("./Transport.js");
+/** The default {@link BurrowClient}: signs each request and talks to the Burrow over the pinned transport. */
+class DefaultBurrowClient {
+    burrowUrl;
+    machineId;
+    key;
+    clientTag;
+    now;
+    transport;
+    constructor(burrowUrl, machineId, key, clientTag, tls, 
+    /** Where this Burrow's pinned key is kept — its identity directory. Null for a caller that has none. */
+    pinStoreDir, now = Date.now) {
+        this.burrowUrl = burrowUrl;
+        this.machineId = machineId;
+        this.key = key;
+        this.clientTag = clientTag;
+        this.now = now;
+        this.transport = new Transport_js_1.Transport(burrowUrl, tls, pinStoreDir);
+    }
+    async getSecret(coordinate) {
+        const c = Model_js_1.SecretCoordinate.parse(coordinate);
+        if (c.project.length === 0 || c.environment.length === 0 || c.name.length === 0) {
+            throw new TypeError(`secret coordinate must be 'project/environment/NAME', got '${coordinate}'`);
+        }
+        const body = await this.signedGet("secret.read", [c.project, c.environment, c.name], `/v1/machine/secrets/${encode(c.project)}/${encode(c.environment)}/${encode(c.name)}`);
+        return parseSecret(body);
+    }
+    async listSecrets() {
+        const body = await this.signedGet("secrets.list", [], "/v1/machine/secrets");
+        const dto = decode(body);
+        const secrets = dto["secrets"];
+        if (!Array.isArray(secrets))
+            return [];
+        return secrets.filter((s) => typeof s === "string").map((s) => Model_js_1.SecretCoordinate.parse(s));
+    }
+    async listProjects() {
+        const body = await this.signedGet("projects.list", [], "/v1/machine/projects");
+        const dto = decode(body);
+        const projects = dto["projects"];
+        if (!Array.isArray(projects))
+            return [];
+        return projects.map((p) => {
+            const o = (p ?? {});
+            const categories = o["categories"];
+            return new Model_js_1.ProjectAccess(typeof o["project"] === "string" ? o["project"] : "", Array.isArray(categories) ? categories.filter((c) => typeof c === "string") : []);
+        });
+    }
+    signedGet(action, resource, path) {
+        const headers = Signer_js_1.MachineSigner.sign(this.machineId, this.key, action, resource, this.clientTag, this.now());
+        return this.transport.get(path, headers);
+    }
+}
+exports.DefaultBurrowClient = DefaultBurrowClient;
+/**
+ * The read response. `value`/`version` are present for a single value, `fields` for a whole structured
+ * secret. Mirrors the Burrow's MachineSecretView / MachineStructuredView; unknown keys are ignored.
+ */
+function parseSecret(body) {
+    const dto = decode(body);
+    const name = typeof dto["name"] === "string" ? dto["name"] : "";
+    const rawFields = dto["fields"];
+    if (Array.isArray(rawFields)) {
+        const fields = new Map();
+        for (const raw of rawFields) {
+            const f = (raw ?? {});
+            const fieldName = typeof f["name"] === "string" ? f["name"] : "";
+            fields.set(fieldName, {
+                name: fieldName,
+                value: typeof f["value"] === "string" ? f["value"] : "",
+                type: typeof f["type"] === "string" ? f["type"] : "",
+            });
+        }
+        return Model_js_1.Secret.structured(name, fields);
+    }
+    return Model_js_1.Secret.single(name, typeof dto["value"] === "string" ? dto["value"] : "", typeof dto["type"] === "string" ? dto["type"] : "", typeof dto["version"] === "number" ? dto["version"] : 0);
+}
+function decode(body) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch (e) {
+        throw new Errors_js_1.BurrowTransportException(`decoding burrow response: ${e instanceof Error ? e.message : String(e)}`, { cause: e });
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Errors_js_1.BurrowTransportException("decoding burrow response: expected a JSON object");
+    }
+    return parsed;
+}
+/**
+ * Percent-encode one URL path segment (RFC 3986 unreserved set), so a coordinate reaches the Burrow intact
+ * and decodes back to the exact value the signature covers. `encodeURIComponent` leaves `!'()*` unescaped,
+ * which is why this is spelled out.
+ */
+function encode(s) {
+    let out = "";
+    for (const b of Buffer.from(s, "utf8")) {
+        const ch = String.fromCharCode(b);
+        out += UNRESERVED.test(ch) ? ch : `%${b.toString(16).toUpperCase().padStart(2, "0")}`;
+    }
+    return out;
+}
+const UNRESERVED = /^[A-Za-z0-9\-._~]$/;
+//# sourceMappingURL=BurrowClient.js.map

package/dist/cjs/BurrowClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BurrowClient.js","sourceRoot":"","sources":["../../src/BurrowClient.ts"],"names":[],"mappings":";;;AACA,2CAAuD;AACvD,yCAAuF;AACvF,2CAA4C;AAE5C,iDAA2C;AA2B3C,8GAA8G;AAC9G,MAAa,mBAAmB;IAInB;IACA;IACQ;IACA;IAIA;IAVF,SAAS,CAAY;IAEtC,YACW,SAAiB,EACjB,SAAiB,EACT,GAAc,EACd,SAAiB,EAClC,GAAY;IACZ,wGAAwG;IACxG,WAA0B,EACT,MAAoB,IAAI,CAAC,GAAG;QAPpC,cAAS,GAAT,SAAS,CAAQ;QACjB,cAAS,GAAT,SAAS,CAAQ;QACT,QAAG,GAAH,GAAG,CAAW;QACd,cAAS,GAAT,SAAS,CAAQ;QAIjB,QAAG,GAAH,GAAG,CAAyB;QAE7C,IAAI,CAAC,SAAS,GAAG,IAAI,wBAAS,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,CAAC,GAAG,2BAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,SAAS,CAAC,8DAA8D,UAAU,GAAG,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAC/B,aAAa,EACb,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,EAClC,uBAAuB,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;QACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC/C,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;YACnC,OAAO,IAAI,wBAAa,CACtB,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,QAAkB,EAAE,IAAY;QAChE,MAAM,OAAO,GAAG,yBAAa,CAAC,IAAI,CAChC,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,GAAG,EACR,MAAM,EACN,QAAQ,EACR,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF;AA/DD,kDA+DC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;YACjD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE;gBACpB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvD,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,iBAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,iBAAM,CAAC,MAAM,CAClB,IAAI,EACJ,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAClD,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,oCAAwB,CAChC,6BAA6B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EACzE,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,oCAAwB,CAAC,kDAAkD,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,CAAS;IACvB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,oBAAoB,CAAC"}

package/dist/cjs/Errors.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FieldNotFoundException = exports.SecretShapeException = exports.BurrowIdentityException = exports.BurrowTransportException = exports.BurrowCertificateException = exports.BurrowServerException = exports.BurrowNotFoundException = exports.BurrowForbiddenException = exports.BurrowAuthException = exports.BurrowException = void 0;
+/**
+ * Base type for every error the SDK raises. Catch this to handle any Burrow failure uniformly.
+ *
+ * The names mirror the Kotlin SDK's exception hierarchy one-for-one, so a failure means the same thing and
+ * is documented the same way in every language we ship.
+ */
+class BurrowException extends Error {
+    constructor(message, options) {
+        super(message, options);
+        // `new.target` is the concrete subclass, so every error reports its own name without each subclass
+        // having to restate it.
+        this.name = new.target.name;
+    }
+}
+exports.BurrowException = BurrowException;
+/**
+ * The Burrow rejected the signed request (HTTP 401). Every authentication failure collapses to one reason:
+ * an unknown or disabled machine, a bad signature, a replayed nonce, or a clock skew past the freshness
+ * window. The message is the Burrow's own verbatim reason.
+ */
+class BurrowAuthException extends BurrowException {
+}
+exports.BurrowAuthException = BurrowAuthException;
+/** The machine authenticated but holds no grant for the requested project/environment (HTTP 403). */
+class BurrowForbiddenException extends BurrowException {
+}
+exports.BurrowForbiddenException = BurrowForbiddenException;
+/** The requested project, environment, secret, or field does not exist (HTTP 404). */
+class BurrowNotFoundException extends BurrowException {
+}
+exports.BurrowNotFoundException = BurrowNotFoundException;
+/** The Burrow failed to serve the request (HTTP 5xx) — e.g. server-side decryption failed. */
+class BurrowServerException extends BurrowException {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+exports.BurrowServerException = BurrowServerException;
+/**
+ * The Burrow's TLS certificate did not match the pinned one. Either the Burrow's certificate was re-issued
+ * (remove its entry from the pin store and retry) or the connection is being intercepted.
+ */
+class BurrowCertificateException extends BurrowException {
+}
+exports.BurrowCertificateException = BurrowCertificateException;
+/** The Burrow could not be reached, or its response could not be parsed. */
+class BurrowTransportException extends BurrowException {
+}
+exports.BurrowTransportException = BurrowTransportException;
+/**
+ * The machine identity could not be resolved or loaded: no identity on this host, an ambiguous selector, a
+ * missing or invalid private key, or a malformed identity file.
+ */
+class BurrowIdentityException extends BurrowException {
+}
+exports.BurrowIdentityException = BurrowIdentityException;
+/**
+ * A projection didn't match the secret's shape — `Secret.value` on a structured secret, or
+ * `Secret.toMap()` / `Secret.getField()` / `Secret.getFields()` on a single-value one.
+ */
+class SecretShapeException extends BurrowException {
+}
+exports.SecretShapeException = SecretShapeException;
+/** A requested field is not present in a structured secret. */
+class FieldNotFoundException extends BurrowException {
+    secret;
+    field;
+    constructor(secret, field, available) {
+        super(`no field '${field}' in '${secret}' (has: ${[...available].sort().join(", ")})`);
+        this.secret = secret;
+        this.field = field;
+    }
+}
+exports.FieldNotFoundException = FieldNotFoundException;
+//# sourceMappingURL=Errors.js.map

package/dist/cjs/Errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Errors.js","sourceRoot":"","sources":["../../src/Errors.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,MAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,mGAAmG;QACnG,wBAAwB;QACxB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAPD,0CAOC;AAED;;;;GAIG;AACH,MAAa,mBAAoB,SAAQ,eAAe;CAAG;AAA3D,kDAA2D;AAE3D,qGAAqG;AACrG,MAAa,wBAAyB,SAAQ,eAAe;CAAG;AAAhE,4DAAgE;AAEhE,sFAAsF;AACtF,MAAa,uBAAwB,SAAQ,eAAe;CAAG;AAA/D,0DAA+D;AAE/D,8FAA8F;AAC9F,MAAa,qBAAsB,SAAQ,eAAe;IAE7C;IADX,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;IAIzB,CAAC;CACF;AAPD,sDAOC;AAED;;;GAGG;AACH,MAAa,0BAA2B,SAAQ,eAAe;CAAG;AAAlE,gEAAkE;AAElE,4EAA4E;AAC5E,MAAa,wBAAyB,SAAQ,eAAe;CAAG;AAAhE,4DAAgE;AAEhE;;;GAGG;AACH,MAAa,uBAAwB,SAAQ,eAAe;CAAG;AAA/D,0DAA+D;AAE/D;;;GAGG;AACH,MAAa,oBAAqB,SAAQ,eAAe;CAAG;AAA5D,oDAA4D;AAE5D,+DAA+D;AAC/D,MAAa,sBAAuB,SAAQ,eAAe;IAE9C;IACA;IAFX,YACW,MAAc,EACd,KAAa,EACtB,SAA2B;QAE3B,KAAK,CAAC,aAAa,KAAK,SAAS,MAAM,WAAW,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAJ9E,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAQ;IAIxB,CAAC;CACF;AARD,wDAQC"}

package/dist/cjs/Identity.js

@@ -0,0 +1,274 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Identities = exports.MachineIdentity = void 0;
+exports.parseEd25519PrivateKey = parseEd25519PrivateKey;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const Errors_js_1 = require("./Errors.js");
+/**
+ * A machine identity for one Burrow — the record the `curl | sh` bootstrap writes to
+ * `~/.burrow/burrows/<slug>/identity.json`, plus a reference to the Ed25519 private key it generated. One
+ * identity per Burrow; a client acts as exactly one of them.
+ *
+ * The private key never leaves the machine: it stays in the referenced PEM file and only signs requests.
+ */
+class MachineIdentity {
+    burrowUrl;
+    machineId;
+    privateKeyPath;
+    slug;
+    burrowName;
+    name;
+    constructor(burrowUrl, machineId, privateKeyPath, slug = "", burrowName = "", name = "") {
+        this.burrowUrl = burrowUrl;
+        this.machineId = machineId;
+        this.privateKeyPath = privateKeyPath;
+        this.slug = slug;
+        this.burrowName = burrowName;
+        this.name = name;
+    }
+    /** The Burrow's shown label, falling back to slug, then the URL host. */
+    get label() {
+        return (blankTo(this.burrowName, blankTo(this.slug, blankTo(hostOf(this.burrowUrl), "(unnamed burrow)"))));
+    }
+    /**
+     * The directory this identity lives in — `<home>/burrows/<slug>/`, where its pinned key sits beside it.
+     *
+     * Derived from `privateKeyPath` rather than recorded, because identity.json does not carry it: the
+     * bootstrap writes the key as `<dir>/identity.pem`, so the parent IS the directory.
+     *
+     * @internal
+     */
+    get directory() {
+        return (0, node_path_1.dirname)(this.privateKeyPath);
+    }
+    /** @internal */
+    matches(selector) {
+        const s = selector.trim();
+        return (eq(s, this.burrowName) ||
+            eq(s, this.slug) ||
+            eq(s, this.machineId) ||
+            eq(s, this.burrowUrl) ||
+            eq(s, this.label));
+    }
+    /** Load and parse the Ed25519 private key (PKCS#8 PEM) this identity references. */
+    loadPrivateKey() {
+        let pem;
+        try {
+            pem = (0, node_fs_1.readFileSync)(this.privateKeyPath, "utf8");
+        }
+        catch (e) {
+            throw new Errors_js_1.BurrowIdentityException(`reading private key ${this.privateKeyPath}: ${messageOf(e)}`, { cause: e });
+        }
+        return parseEd25519PrivateKey(pem, this.privateKeyPath);
+    }
+    /**
+     * Read one identity record. The three fields the bootstrap always writes are required; the rest are
+     * display metadata that a hand-written file may omit.
+     */
+    /** @internal */
+    static fromJson(raw) {
+        if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+            throw new Errors_js_1.BurrowIdentityException("identity is not a JSON object");
+        }
+        const o = raw;
+        return new MachineIdentity(required(o, "burrowUrl"), required(o, "machineId"), required(o, "privateKeyPath"), optional(o, "slug"), optional(o, "burrowName"), optional(o, "name"));
+    }
+}
+exports.MachineIdentity = MachineIdentity;
+/** Discovers and resolves the machine identities the bootstrap writes under `~/.burrow`. */
+exports.Identities = {
+    /** The identity root: `$BURROW_HOME` if set, else `~/.burrow`. */
+    home() {
+        const env = process.env["BURROW_HOME"];
+        if (env !== undefined && env.trim().length > 0)
+            return env;
+        return (0, node_path_1.join)((0, node_os_1.homedir)(), ".burrow");
+    },
+    /**
+     * Every identity under `<home>/burrows/<slug>/identity.json`, sorted by label then machine id.
+     * Directories without a readable, well-formed identity.json are skipped.
+     */
+    discover(home = exports.Identities.home()) {
+        const burrows = (0, node_path_1.join)(home, "burrows");
+        if (!isDirectory(burrows))
+            return [];
+        let entries;
+        try {
+            entries = (0, node_fs_1.readdirSync)(burrows);
+        }
+        catch {
+            return [];
+        }
+        const found = [];
+        for (const entry of entries) {
+            const dir = (0, node_path_1.join)(burrows, entry);
+            if (!isDirectory(dir))
+                continue;
+            const file = (0, node_path_1.join)(dir, "identity.json");
+            if (!(0, node_fs_1.existsSync)(file))
+                continue;
+            try {
+                found.push(MachineIdentity.fromJson(JSON.parse((0, node_fs_1.readFileSync)(file, "utf8"))));
+            }
+            catch {
+                // A half-written or foreign file is not this host's identity; skip it rather than fail discovery.
+            }
+        }
+        // Ordinal, not locale-aware: the order has to be the same on every host that reads the same identities.
+        return found.sort((a, b) => ordinal(a.label.toLowerCase(), b.label.toLowerCase()) || ordinal(a.machineId, b.machineId));
+    },
+    /**
+     * Resolve the identity a client should act as. A single identity on file resolves automatically; with
+     * several, `selector` (a burrow name, slug, machine id, or URL) must disambiguate.
+     */
+    resolve(selector, home = exports.Identities.home()) {
+        const ids = exports.Identities.discover(home);
+        if (ids.length === 0) {
+            throw new Errors_js_1.BurrowIdentityException(`no Burrow identities under ${(0, node_path_1.join)(home, "burrows")}. Bootstrap this machine into a Burrow ` +
+                "first (its Machines page, Add machine).");
+        }
+        if (selector === undefined || selector === null || selector.trim().length === 0) {
+            const only = ids[0];
+            if (ids.length === 1 && only !== undefined)
+                return only;
+            throw new Errors_js_1.BurrowIdentityException(`this machine holds ${ids.length} Burrow identities; select one by name, slug, or machine id. ` +
+                `Known: ${ids.map((i) => i.label).join(", ")}`);
+        }
+        const matched = ids.filter((i) => i.matches(selector));
+        const first = matched[0];
+        if (matched.length === 1 && first !== undefined)
+            return first;
+        if (matched.length === 0) {
+            throw new Errors_js_1.BurrowIdentityException(`no Burrow identity matches "${selector}". Known: ${ids.map((i) => i.label).join(", ")}`);
+        }
+        throw new Errors_js_1.BurrowIdentityException(`"${selector}" matches more than one identity; select by machine id.`);
+    },
+    /**
+     * Resolve `target` to an identity for `Burrow`: null/undefined → the single identity (`resolve`); a
+     * filesystem path (a burrow directory or an identity.json) → load it directly; anything else → a selector
+     * (`resolve`). A URL (contains `://`) is always treated as a selector, never a path.
+     */
+    select(target, home = exports.Identities.home()) {
+        if (target === undefined || target === null || target.trim().length === 0) {
+            return exports.Identities.resolve(null, home);
+        }
+        if (!target.includes("://") && looksLikePath(target))
+            return loadFromPath(expandUser(target));
+        return exports.Identities.resolve(target, home);
+    },
+};
+/** Parse an Ed25519 private key from a PKCS#8 PEM string (what `openssl genpkey -algorithm ed25519` writes). */
+function parseEd25519PrivateKey(pem, source) {
+    const der = pemBody(pem);
+    if (der === null)
+        throw new Errors_js_1.BurrowIdentityException(`no PEM private-key block in ${source}`);
+    let key;
+    try {
+        // DER + pkcs8 explicitly, so a SEC1 or PKCS#1 body fails here rather than being silently accepted.
+        key = (0, node_crypto_1.createPrivateKey)({ key: der, format: "der", type: "pkcs8" });
+    }
+    catch (e) {
+        throw new Errors_js_1.BurrowIdentityException(`parsing Ed25519 private key in ${source}: ${messageOf(e)}`, { cause: e });
+    }
+    if (key.asymmetricKeyType !== "ed25519") {
+        throw new Errors_js_1.BurrowIdentityException(`parsing Ed25519 private key in ${source}: key is ${key.asymmetricKeyType ?? "of an unknown type"}, not Ed25519`);
+    }
+    return key;
+}
+/** Strip the PEM armor and base64-decode the body. Null when there is no PEM block. */
+function pemBody(pem) {
+    const begin = pem.indexOf("-----BEGIN");
+    if (begin < 0)
+        return null;
+    const afterBeginLine = pem.indexOf("\n", begin);
+    if (afterBeginLine < 0)
+        return null;
+    const end = pem.indexOf("-----END", afterBeginLine + 1);
+    if (end < 0)
+        return null;
+    const base64 = pem.slice(afterBeginLine + 1, end).replace(/\s/g, "");
+    try {
+        return Buffer.from(base64, "base64");
+    }
+    catch {
+        return null;
+    }
+}
+/** The host[:port] of a URL, for a display-only label fallback. */
+function hostOf(url) {
+    let s = url;
+    const scheme = s.indexOf("://");
+    if (scheme >= 0)
+        s = s.slice(scheme + 3);
+    const slash = s.indexOf("/");
+    if (slash >= 0)
+        s = s.slice(0, slash);
+    return s;
+}
+function looksLikePath(s) {
+    if (s.startsWith("/") || s.startsWith("~") || s.startsWith("./") || s.startsWith("../"))
+        return true;
+    if (s.endsWith(".json"))
+        return true;
+    if ((0, node_path_1.isAbsolute)(s))
+        return true;
+    try {
+        return (0, node_fs_1.existsSync)(s);
+    }
+    catch {
+        return false;
+    }
+}
+function expandUser(s) {
+    if (!s.startsWith("~"))
+        return s;
+    return (0, node_path_1.join)((0, node_os_1.homedir)(), s.slice(1).replace(/^\//, ""));
+}
+function loadFromPath(path) {
+    const file = isDirectory(path) ? (0, node_path_1.join)(path, "identity.json") : path;
+    if (!(0, node_fs_1.existsSync)(file))
+        throw new Errors_js_1.BurrowIdentityException(`no identity file at ${file}`);
+    try {
+        return MachineIdentity.fromJson(JSON.parse((0, node_fs_1.readFileSync)(file, "utf8")));
+    }
+    catch (e) {
+        throw new Errors_js_1.BurrowIdentityException(`failed to parse identity file ${file}: ${messageOf(e)}`, {
+            cause: e,
+        });
+    }
+}
+function isDirectory(path) {
+    try {
+        return (0, node_fs_1.statSync)(path).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function required(o, key) {
+    const v = o[key];
+    if (typeof v !== "string" || v.length === 0) {
+        throw new Errors_js_1.BurrowIdentityException(`identity is missing '${key}'`);
+    }
+    return v;
+}
+function optional(o, key) {
+    const v = o[key];
+    return typeof v === "string" ? v : "";
+}
+function blankTo(value, fallback) {
+    return value.trim().length > 0 ? value : fallback;
+}
+function eq(a, b) {
+    return a.toLowerCase() === b.toLowerCase();
+}
+function ordinal(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+function messageOf(e) {
+    return e instanceof Error ? e.message : String(e);
+}
+//# sourceMappingURL=Identity.js.map

package/dist/cjs/Identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Identity.js","sourceRoot":"","sources":["../../src/Identity.ts"],"names":[],"mappings":";;;AA+KA,wDAmBC;AAlMD,6CAA+D;AAC/D,qCAA0E;AAC1E,qCAAkC;AAClC,yCAAsD;AACtD,2CAAsD;AAEtD;;;;;;GAMG;AACH,MAAa,eAAe;IAEf;IACA;IACA;IACA;IACA;IACA;IANX,YACW,SAAiB,EACjB,SAAiB,EACjB,cAAsB,EACtB,OAAe,EAAE,EACjB,aAAqB,EAAE,EACvB,OAAe,EAAE;QALjB,cAAS,GAAT,SAAS,CAAQ;QACjB,cAAS,GAAT,SAAS,CAAQ;QACjB,mBAAc,GAAd,cAAc,CAAQ;QACtB,SAAI,GAAJ,IAAI,CAAa;QACjB,eAAU,GAAV,UAAU,CAAa;QACvB,SAAI,GAAJ,IAAI,CAAa;IACzB,CAAC;IAEJ,yEAAyE;IACzE,IAAI,KAAK;QACP,OAAO,CACL,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAClG,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,SAAS;QACX,OAAO,IAAA,mBAAO,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACtC,CAAC;IAED,gBAAgB;IAChB,OAAO,CAAC,QAAgB;QACtB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO,CACL,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC;YACtB,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC;YAChB,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;YACrB,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;YACrB,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAClB,CAAC;IACJ,CAAC;IAED,oFAAoF;IACpF,cAAc;QACZ,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,IAAA,sBAAY,EAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,mCAAuB,CAC/B,uBAAuB,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAC7D,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;QACJ,CAAC;QACD,OAAO,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,gBAAgB;IAChB,MAAM,CAAC,QAAQ,CAAC,GAAY;QAC1B,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,mCAAuB,CAAC,+BAA+B,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,GAAG,GAA8B,CAAC;QACzC,OAAO,IAAI,eAAe,CACxB,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,EACxB,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,EACxB,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,EAC7B,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,EACnB,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,EACzB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CACpB,CAAC;IACJ,CAAC;CACF;AA1ED,0CA0EC;AAED,4FAA4F;AAC/E,QAAA,UAAU,GAAG;IACxB,kEAAkE;IAClE,IAAI;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QAC3D,OAAO,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,SAAS,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,OAAe,kBAAU,CAAC,IAAI,EAAE;QACvC,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACrC,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,IAAA,qBAAW,EAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,GAAsB,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAA,gBAAI,EAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBAAE,SAAS;YAChC,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,eAAe,CAAC,CAAC;YACxC,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC;gBAAE,SAAS;YAChC,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/E,CAAC;YAAC,MAAM,CAAC;gBACP,kGAAkG;YACpG,CAAC;QACH,CAAC;QACD,wGAAwG;QACxG,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1H,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,QAAwB,EAAE,OAAe,kBAAU,CAAC,IAAI,EAAE;QAChE,MAAM,GAAG,GAAG,kBAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,mCAAuB,CAC/B,8BAA8B,IAAA,gBAAI,EAAC,IAAI,EAAE,SAAS,CAAC,yCAAyC;gBAC1F,yCAAyC,CAC5C,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACxD,MAAM,IAAI,mCAAuB,CAC/B,sBAAsB,GAAG,CAAC,MAAM,+DAA+D;gBAC7F,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,mCAAuB,CAC/B,+BAA+B,QAAQ,aAAa,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,mCAAuB,CAC/B,IAAI,QAAQ,yDAAyD,CACtE,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAsB,EAAE,OAAe,kBAAU,CAAC,IAAI,EAAE;QAC7D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1E,OAAO,kBAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9F,OAAO,kBAAU,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;CACF,CAAC;AAEF,gHAAgH;AAChH,SAAgB,sBAAsB,CAAC,GAAW,EAAE,MAAc;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,IAAI,mCAAuB,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;IAC7F,IAAI,GAAc,CAAC;IACnB,IAAI,CAAC;QACH,mGAAmG;QACnG,GAAG,GAAG,IAAA,8BAAgB,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,mCAAuB,CAC/B,kCAAkC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAC3D,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,mCAAuB,CAC/B,kCAAkC,MAAM,YAAY,GAAG,CAAC,iBAAiB,IAAI,oBAAoB,eAAe,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uFAAuF;AACvF,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACxC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,cAAc,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC;IACxD,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,CAAC,GAAG,GAAG,CAAC;IACZ,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,MAAM,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrG,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,IAAA,sBAAU,EAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,IAAA,oBAAU,EAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACjC,OAAO,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC;QAAE,MAAM,IAAI,mCAAuB,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,mCAAuB,CAAC,iCAAiC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1F,KAAK,EAAE,CAAC;SACT,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,IAAA,kBAAQ,EAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,CAA0B,EAAE,GAAW;IACvD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,mCAAuB,CAAC,wBAAwB,GAAG,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,CAA0B,EAAE,GAAW;IACvD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACjB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,QAAgB;IAC9C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpD,CAAC;AAED,SAAS,EAAE,CAAC,CAAS,EAAE,CAAS;IAC9B,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,OAAO,CAAC,CAAS,EAAE,CAAS;IACnC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}