@sanoma-ai/workflows 0.10.2 → 0.10.3

package/dist/runtime-ops.js

@@ -0,0 +1,222 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { keyBytes } from "./deployment-key.js";
+import { defineConnector, defineDriver, DriverError, retryableStatus } from "./op.js";
+import { generateSecret, SECRET_NAME } from "./secret.js";
+import { sealInvite } from "./seal.js";
+import { errorMessage } from "./shared.js";
+import { sourceKeyPair, sshPublicKey } from "./ssh-key.js";
+import { memoryTokens } from "./tokens.js";
+// What a workflow cannot do itself and the runtime does for it, as operations of the vendor
+// `sanoma` (`sanoma.secret.*`, `sanoma.invite.mint`, `sanoma.token.*`): named in `uses`, decided by
+// the policy, recorded in the ledger, and never answering a secret's value. `resolveConfig`
+// registers them in every config with their driver (`runtimeDriver`), so a policy may name them;
+// a sandbox run calls `sandboxRuntimeDriver`, over its own secrets and tokens, posting nothing.
+/** A secret's name, as the store takes it (upper case), other than the runtime's own (`SANOMA_…`: its keys and credentials). */
+const SecretName = z
+    .string()
+    .regex(SECRET_NAME, "a secret's name: upper case, A-Z, 0-9 and _")
+    .refine((name) => !name.startsWith("SANOMA_"), "a SANOMA_ name is the runtime's own, not a workflow's to use");
+/** How long an instance gets to answer `POST /auth/invite`. */
+const INVITE_TIMEOUT_MS = 10_000;
+/**
+ * The runtime's own operations a workflow calls: `import { sanoma } from "sanoma"`, then
+ * `uses: [sanoma.secret.generate]` and `ctx.sanoma.secret.generate({ name, kind })`.
+ */
+export const sanoma = defineConnector("sanoma", {
+    secret: {
+        generate: {
+            effect: "write",
+            // A value stored is kept: a retry answers what the first try stored.
+            idempotent: true,
+            description: "Make a secret and store it under a name: a random value, or an RSA key pair whose private half (PEM) is stored and whose public half (OpenSSH) is answered. A name stored already is kept",
+            input: z.object({
+                name: SecretName,
+                kind: z.enum(["random", "ssh-rsa"]).describe("random: 32 random bytes; ssh-rsa: an RSA deploy key"),
+            }),
+            output: z.object({
+                name: z.string(),
+                publicKey: z.string().optional().describe("For ssh-rsa: the public half, `ssh-rsa <base64>`"),
+            }),
+            target: ({ name }) => name,
+            createsSecrets: ({ name }) => [name],
+        },
+        delete: {
+            effect: "write",
+            idempotent: true,
+            description: "Delete a stored secret; one not stored is nothing to do",
+            input: z.object({ name: SecretName }),
+            output: z.object({}),
+            target: ({ name }) => name,
+            createsSecrets: ({ name }) => [name],
+        },
+    },
+    invite: {
+        mint: {
+            effect: "access",
+            // Each try seals a new request (good for `sealInvite`'s few minutes), and the instance's newest
+            // invite for an email replaces the last.
+            idempotent: true,
+            description: "Ask an instance for an invite link that signs a declared person in: a request sealed under the instance's signing key, named by a secret marker, posted to its /auth/invite",
+            input: z.object({
+                host: z.url({ protocol: /^https?$/ }).describe("The instance's address, such as https://acme.sanoma.work"),
+                email: z.email().describe("The email the instance's people file declares"),
+                key: z
+                    .strictObject({ $secret: SecretName })
+                    .describe('The instance\'s SANOMA_SIGNING_KEY, as stored here: secret("NAME")'),
+            }),
+            output: z.object({ url: z.string().describe("The one-use invite link the instance minted") }),
+            target: ({ host }) => host,
+            // A link that signs someone in: the ledger records that there was one, not what it was.
+            opaque: ["url"],
+        },
+    },
+    token: {
+        mint: {
+            effect: "access",
+            description: "Mint an api token acting for a subject in groups, store it under a name, and answer its id (never the token)",
+            input: z.object({
+                subject: z.string().regex(/^\S+$/, "a principal's id, such as visitor:better-auth:<id>"),
+                groups: z.array(z.string().min(1)),
+                store: SecretName.describe("The secret the token is stored under"),
+            }),
+            output: z.object({ id: z.string() }),
+            target: ({ subject }) => subject,
+            createsSecrets: ({ store }) => [store],
+        },
+        revoke: {
+            effect: "access",
+            idempotent: true,
+            description: "Revoke an api token: it resolves to nobody from now on",
+            input: z.object({ id: z.string().min(1) }),
+            output: z.object({}),
+            target: ({ id }) => `token:${id}`,
+        },
+    },
+});
+/** A `DriverError` that a retry would not change. */
+const refuse = (message) => new DriverError(`sanoma: ${message}`, { retryable: false });
+/** The token id a call mints, from its idempotency key: the same on every try of one call, so a retry finds its own. */
+function tokenIdOf(call) {
+    const hex = createHash("sha256").update(call.idempotencyKey).digest("hex");
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+/** The 32 bytes of a signing key stored as text (base64, or base64url as `generate` makes one), or a refusal. */
+function signingKeyOf(secret, text) {
+    if (text === undefined)
+        throw refuse(`the secret ${secret} is not set: store the instance's signing key under it`);
+    const key = keyBytes(text);
+    if (!key)
+        throw refuse(`${secret} is not a signing key: 32 bytes in base64`);
+    return key;
+}
+/**
+ * Posts the sealed `request` to the instance's `/auth/invite`, and answers the link it minted
+ * (`sanoma.invite.mint`, and going live's sign-in); a `DriverError` otherwise, retryable by status.
+ */
+export async function postInvite(host, request) {
+    const at = new URL("/auth/invite", host);
+    let res;
+    try {
+        res = await fetch(at, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ request }),
+            // A redirect is answered as it is (a 3xx, not retried): the sealed request goes to `host` alone.
+            redirect: "manual",
+            signal: AbortSignal.timeout(INVITE_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        throw new DriverError(`sanoma: ${at.host} could not be reached: ${errorMessage(err)}`, {
+            retryable: true,
+            cause: err,
+        });
+    }
+    const body = (await res.json().catch(() => undefined));
+    if (res.ok && typeof body?.url === "string")
+        return { url: body.url };
+    const why = typeof body?.error === "string" ? `: ${body.error}` : res.ok ? ": no url" : "";
+    throw new DriverError(`sanoma: ${at.host} answered ${res.status} to POST /auth/invite${why}`, {
+        retryable: !res.ok && retryableStatus(res.status),
+        status: res.status,
+    });
+}
+/**
+ * The driver of the runtime's own operations, over the call's secrets and `tokens` (the config's
+ * database's, `tokenStore`); `invite` posts a sealed request to an instance (`postInvite` by default).
+ */
+export function runtimeDriver({ tokens, invite = postInvite, }) {
+    return defineDriver(sanoma, {
+        secret: {
+            async generate({ name, kind }, call) {
+                if (kind === "random") {
+                    await call.secrets.ensure(name, generateSecret);
+                    return { name };
+                }
+                // A pair made only when none is stored: the public half is always derived from what is.
+                let stored = await call.secrets.get(name);
+                if (stored === undefined) {
+                    const pair = await sourceKeyPair();
+                    stored = await call.secrets.ensure(name, () => pair.privateKey);
+                }
+                const publicKey = sshPublicKey(stored);
+                if (!publicKey)
+                    throw refuse(`${name} holds a value that is not an RSA private key: delete it, or name another`);
+                return { name, publicKey };
+            },
+            async delete({ name }, call) {
+                await call.secrets.delete(name);
+                return {};
+            },
+        },
+        invite: {
+            async mint({ host, email, key }, call) {
+                const signingKey = signingKeyOf(key.$secret, await call.secrets.get(key.$secret));
+                const request = sealInvite({ email }, signingKey);
+                return invite(host, request, call);
+            },
+        },
+        token: {
+            async mint({ subject, groups, store }, call) {
+                const id = tokenIdOf(call);
+                const held = await call.secrets.get(store);
+                if (held !== undefined) {
+                    // This call's own, stored by a try whose answer was lost.
+                    if ((await tokens.resolve(held))?.principal.id === `token:${id}`)
+                        return { id };
+                    throw refuse(`${store} holds a value already: delete it, or store the token under another name`);
+                }
+                let token;
+                try {
+                    ({ token } = await tokens.mint({ id, subject, groups }));
+                }
+                catch (err) {
+                    // A try that minted this id and stopped before storing it left a token nobody holds: revoked here.
+                    if ((await tokens.subjectOf(id)) === undefined)
+                        throw err;
+                    await tokens.revoke({ id });
+                    throw refuse(`an earlier try minted token ${id} and stopped before storing it: it is revoked, start again`);
+                }
+                if ((await call.secrets.ensure(store, () => token)) !== token) {
+                    await tokens.revoke({ id });
+                    throw refuse(`${store} was stored by someone else meanwhile: the token minted is revoked`);
+                }
+                return { id };
+            },
+            async revoke({ id }) {
+                await tokens.revoke({ id });
+                return {};
+            },
+        },
+    });
+}
+/**
+ * The runtime's own operations for one sandbox run: the run's secrets (in memory), tokens in
+ * memory, and an invite that posts nothing, answering a link on the host named.
+ */
+export const sandboxRuntimeDriver = () => runtimeDriver({
+    tokens: memoryTokens(),
+    invite: async (host, _request, call) => ({ url: new URL(`/auth/invite/sandbox-${tokenIdOf(call)}`, host).href }),
+});
+//# sourceMappingURL=runtime-ops.js.map

package/dist/runtime-ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-ops.js","sourceRoot":"","sources":["../src/runtime-ops.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAoB,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AACxG,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAe,MAAM,aAAa,CAAC;AAExD,4FAA4F;AAC5F,oGAAoG;AACpG,4FAA4F;AAC5F,iGAAiG;AACjG,gGAAgG;AAEhG,gIAAgI;AAChI,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,EAAE;KACR,KAAK,CAAC,WAAW,EAAE,6CAA6C,CAAC;KACjE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,8DAA8D,CAAC,CAAC;AAEjH,+DAA+D;AAC/D,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;;GAGG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE;IAC9C,MAAM,EAAE;QACN,QAAQ,EAAE;YACR,MAAM,EAAE,OAAO;YACf,qEAAqE;YACrE,UAAU,EAAE,IAAI;YAChB,WAAW,EACT,2LAA2L;YAC7L,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;gBACd,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,qDAAqD,CAAC;aACpG,CAAC;YACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;gBACf,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;gBAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;aAC9F,CAAC;YACF,MAAM,EAAE,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE,CAAC,IAAI;YAC5C,cAAc,EAAE,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;SACvD;QACD,MAAM,EAAE;YACN,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,yDAAyD;YACtE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YACrC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE,CAAC,IAAI;YAC5C,cAAc,EAAE,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;SACvD;KACF;IACD,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,MAAM,EAAE,QAAQ;YAChB,gGAAgG;YAChG,yCAAyC;YACzC,UAAU,EAAE,IAAI;YAChB,WAAW,EACT,6KAA6K;YAC/K,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;gBACd,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,0DAA0D,CAAC;gBAC1G,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;gBAC1E,GAAG,EAAE,CAAC;qBACH,YAAY,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;qBACrC,QAAQ,CAAC,oEAAoE,CAAC;aAClF,CAAC;YACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC,EAAE,CAAC;YAC7F,MAAM,EAAE,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE,CAAC,IAAI;YAC5C,wFAAwF;YACxF,MAAM,EAAE,CAAC,KAAK,CAAC;SAChB;KACF;IACD,KAAK,EAAE;QACL,IAAI,EAAE;YACJ,MAAM,EAAE,QAAQ;YAChB,WAAW,EACT,8GAA8G;YAChH,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;gBACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,oDAAoD,CAAC;gBACxF,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAClC,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,sCAAsC,CAAC;aACnE,CAAC;YACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAuB,EAAE,EAAE,CAAC,OAAO;YACrD,cAAc,EAAE,CAAC,EAAE,KAAK,EAAqB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;SAC1D;QACD,MAAM,EAAE;YACN,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,wDAAwD;YACrE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,MAAM,EAAE,CAAC,EAAE,EAAE,EAAkB,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE;SAClD;KACF;CACF,CAAC,CAAC;AAEH,qDAAqD;AACrD,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,WAAW,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAEhG,wHAAwH;AACxH,SAAS,SAAS,CAAC,IAAiB;IAClC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3E,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACjH,CAAC;AAED,iHAAiH;AACjH,SAAS,YAAY,CAAC,MAAc,EAAE,IAAwB;IAC5D,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,MAAM,CAAC,cAAc,MAAM,wDAAwD,CAAC,CAAC;IACnH,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG;QAAE,MAAM,MAAM,CAAC,GAAG,MAAM,2CAA2C,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,OAAe;IAC5D,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,EAAE,EAAE;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;YACjC,iGAAiG;YACjG,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC,IAAI,0BAA0B,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE;YACrF,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAmD,CAAC;IACzG,IAAI,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC,IAAI,aAAa,GAAG,CAAC,MAAM,wBAAwB,GAAG,EAAE,EAAE;QAC5F,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;QACjD,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,EAC5B,MAAM,EACN,MAAM,GAAG,UAAU,GAIpB;IACC,OAAO,YAAY,CAAC,MAAM,EAAE;QAC1B,MAAM,EAAE;YACN,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI;gBACjC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;oBAChD,OAAO,EAAE,IAAI,EAAE,CAAC;gBAClB,CAAC;gBACD,wFAAwF;gBACxF,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,IAAI,GAAG,MAAM,aAAa,EAAE,CAAC;oBACnC,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAClE,CAAC;gBACD,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;gBACvC,IAAI,CAAC,SAAS;oBACZ,MAAM,MAAM,CAAC,GAAG,IAAI,2EAA2E,CAAC,CAAC;gBACnG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC7B,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI;gBACzB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAChC,OAAO,EAAE,CAAC;YACZ,CAAC;SACF;QACD,MAAM,EAAE;YACN,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI;gBACnC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAClF,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;gBAClD,OAAO,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC;SACF;QACD,KAAK,EAAE;YACL,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI;gBACzC,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC3C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,0DAA0D;oBAC1D,IAAI,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,KAAK,SAAS,EAAE,EAAE;wBAAE,OAAO,EAAE,EAAE,EAAE,CAAC;oBAChF,MAAM,MAAM,CAAC,GAAG,KAAK,0EAA0E,CAAC,CAAC;gBACnG,CAAC;gBACD,IAAI,KAAa,CAAC;gBAClB,IAAI,CAAC;oBACH,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC3D,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,mGAAmG;oBACnG,IAAI,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS;wBAAE,MAAM,GAAG,CAAC;oBAC1D,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC5B,MAAM,MAAM,CAAC,+BAA+B,EAAE,4DAA4D,CAAC,CAAC;gBAC9G,CAAC;gBACD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBAC9D,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC5B,MAAM,MAAM,CAAC,GAAG,KAAK,oEAAoE,CAAC,CAAC;gBAC7F,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,CAAC;YAChB,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;gBACjB,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,EAAE,CACvC,aAAa,CAAC;IACZ,MAAM,EAAE,YAAY,EAAE;IACtB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,wBAAwB,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;CACjH,CAAC,CAAC"}

package/dist/seal.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A sign-in code sealed with the email it is for, for a `login-code` run's input, so the run's
+ * input never shows it and a copy of it opens for no one else.
+ */
+export declare const sealLoginCode: (to: string, code: string) => string;
+/** The code `sealLoginCode` sealed for `to`; throws for anything else, a code sealed for another email among it. */
+export declare function openLoginCode(sealed: string, to: string): string;
+/** A request for an invite (`POST /auth/invite { request }`): for whom, until when (ms since the epoch), and a nonce. */
+export interface InviteRequest {
+    email: string;
+    exp: number;
+    nonce: string;
+}
+/**
+ * A request for `email`'s invite, sealed under a key derived from `SANOMA_SIGNING_KEY` (purpose
+ * `invite request`), or from `signingKey`, another deployment's signing key (its 32 bytes): what
+ * a holder of the deployment's signing key sends the instance as `POST /auth/invite { request }`
+ * (going live, and Sanoma Cloud's birth invite, `sanoma.invite.mint`). `exp` defaults to five
+ * minutes from now, `nonce` to 16 random bytes.
+ */
+export declare function sealInvite({ email, exp, nonce }: {
+    email: string;
+    exp?: number;
+    nonce?: string;
+}, signingKey?: Buffer): string;
+/** The request `sealInvite` sealed, while `exp` is after `now`; undefined for anything else, or once it expired. */
+export declare function openInvite(sealed: string, now?: number): InviteRequest | undefined;

package/dist/seal.js

@@ -0,0 +1,76 @@
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { deriveSigningKey, signingKeyFor } from "./deployment-key.js";
+// Small values sealed under a key of their own, derived from the deployment's SANOMA_SIGNING_KEY
+// for one purpose (HKDF-SHA256): a sign-in code in a `login-code` run's input, and a request for
+// an invite that a holder of the key sends to the instance (`POST /auth/invite`). AES-256-GCM, the
+// purpose as its additional data, so a value sealed for one purpose never opens for another.
+const IV = 12;
+const TAG = 16;
+/** The key for `purpose`: derived from `signingKey`, a deployment's signing key, else from this process's own. */
+const keyFor = (purpose, signingKey) => signingKey ? deriveSigningKey(signingKey, purpose) : signingKeyFor(purpose);
+/**
+ * `value` as JSON, sealed for `purpose` under `signingKey` (this process's own by default): base64url
+ * of the IV, the tag and the ciphertext.
+ */
+function seal(purpose, value, signingKey) {
+    const iv = randomBytes(IV);
+    const cipher = createCipheriv("aes-256-gcm", keyFor(purpose, signingKey), iv).setAAD(Buffer.from(purpose));
+    const text = Buffer.concat([cipher.update(JSON.stringify(value), "utf8"), cipher.final()]);
+    return Buffer.concat([iv, cipher.getAuthTag(), text]).toString("base64url");
+}
+/** What `seal(purpose, …)` sealed, or undefined for anything else: another key, another purpose, a change. */
+function unseal(purpose, sealed) {
+    const bytes = Buffer.from(sealed, "base64url");
+    if (bytes.length <= IV + TAG)
+        return undefined;
+    try {
+        const decipher = createDecipheriv("aes-256-gcm", keyFor(purpose), bytes.subarray(0, IV))
+            .setAAD(Buffer.from(purpose))
+            .setAuthTag(bytes.subarray(IV, IV + TAG));
+        const text = Buffer.concat([decipher.update(bytes.subarray(IV + TAG)), decipher.final()]);
+        return JSON.parse(text.toString("utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+const CODE = "login code";
+const INVITE = "invite request";
+/**
+ * A sign-in code sealed with the email it is for, for a `login-code` run's input, so the run's
+ * input never shows it and a copy of it opens for no one else.
+ */
+export const sealLoginCode = (to, code) => seal(CODE, { to, code });
+/** The code `sealLoginCode` sealed for `to`; throws for anything else, a code sealed for another email among it. */
+export function openLoginCode(sealed, to) {
+    const opened = unseal(CODE, sealed);
+    if (typeof opened?.code !== "string" || opened.to !== to) {
+        throw new Error(`The sign-in code is not one this deployment sealed for ${to}`);
+    }
+    return opened.code;
+}
+/** How long a sealed invite request is good for when `exp` is not given: five minutes. */
+const INVITE_REQUEST_MS = 5 * 60_000;
+/**
+ * A request for `email`'s invite, sealed under a key derived from `SANOMA_SIGNING_KEY` (purpose
+ * `invite request`), or from `signingKey`, another deployment's signing key (its 32 bytes): what
+ * a holder of the deployment's signing key sends the instance as `POST /auth/invite { request }`
+ * (going live, and Sanoma Cloud's birth invite, `sanoma.invite.mint`). `exp` defaults to five
+ * minutes from now, `nonce` to 16 random bytes.
+ */
+export function sealInvite({ email, exp, nonce }, signingKey) {
+    const request = {
+        email,
+        exp: exp ?? Date.now() + INVITE_REQUEST_MS,
+        nonce: nonce ?? randomBytes(16).toString("base64url"),
+    };
+    return seal(INVITE, request, signingKey);
+}
+/** The request `sealInvite` sealed, while `exp` is after `now`; undefined for anything else, or once it expired. */
+export function openInvite(sealed, now = Date.now()) {
+    const request = unseal(INVITE, sealed);
+    if (typeof request?.email !== "string" || typeof request.exp !== "number" || typeof request.nonce !== "string")
+        return undefined;
+    return request.exp > now ? request : undefined;
+}
+//# sourceMappingURL=seal.js.map

package/dist/seal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal.js","sourceRoot":"","sources":["../src/seal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEtE,iGAAiG;AACjG,iGAAiG;AACjG,mGAAmG;AACnG,6FAA6F;AAE7F,MAAM,EAAE,GAAG,EAAE,CAAC;AACd,MAAM,GAAG,GAAG,EAAE,CAAC;AAEf,kHAAkH;AAClH,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,UAAmB,EAAE,EAAE,CACtD,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;AAE9E;;;GAGG;AACH,SAAS,IAAI,CAAC,OAAe,EAAE,KAAc,EAAE,UAAmB;IAChE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3G,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9E,CAAC;AAED,8GAA8G;AAC9G,SAAS,MAAM,CAAC,OAAe,EAAE,MAAc;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;aACrF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;aAC5B,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,IAAI,GAAG,YAAY,CAAC;AAC1B,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAEhC;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAU,EAAE,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAE5F,oHAAoH;AACpH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,EAAU;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAiD,CAAC;IACpF,IAAI,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,0DAA0D,EAAE,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AASD,0FAA0F;AAC1F,MAAM,iBAAiB,GAAG,CAAC,GAAG,MAAM,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAmD,EACtE,UAAmB;IAEnB,MAAM,OAAO,GAAG;QACd,KAAK;QACL,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB;QAC1C,KAAK,EAAE,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC9B,CAAC;IAC1B,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAuC,CAAC;IAC7E,IAAI,OAAO,OAAO,EAAE,KAAK,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QAC5G,OAAO,SAAS,CAAC;IACnB,OAAO,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAE,OAAyB,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC"}

package/dist/secret-store.d.ts

@@ -1,3 +1,4 @@
+import { type DeploymentKeyName } from "./deployment-key.ts";
 /** Opaque values belong only in trusted runtime code, never workflow history or descriptions. */
 export interface SecretValue {
     value: string;
@@ -55,7 +56,7 @@ export type SecretBinding = {
     path?: never;
     bootstrap?: never;
 } | {
-    bootstrap: "SANOMA_SIGNING_KEY" | "SANOMA_SECRETS_KEY";
+    bootstrap: DeploymentKeyName;
     management?: "external";
     env?: never;
     path?: never;
@@ -92,9 +93,10 @@ export declare class SecretAccess {
         expectedVersion: string | null;
         by: string;
     }): Promise<SecretValue>;
-    delete(name: string, options: {
-        expectedVersion: string;
-        by: string;
+    /** Deletes the value at `expectedVersion`; without one, the value stored now, and none stored is nothing to do. */
+    delete(name: string, options?: {
+        expectedVersion?: string;
+        by?: string;
     }): Promise<void>;
     ensure(name: string, make: () => string): Promise<string>;
     private writable;

package/dist/secret-store.js

@@ -1,4 +1,4 @@
-import { deploymentKey } from "./deployment-key.js";
+import { DEPLOYMENT_KEYS, deploymentKey } from "./deployment-key.js";
 /** Intentionally carries no provider message, cause, path or value. */
 export class SecretStoreError extends Error {
     code;
@@ -68,10 +68,10 @@ export function checkSecretConfiguration(config) {
     for (const [name, b] of Object.entries(config.bindings ?? {})) {
         if (!namePattern.test(name) || !b || typeof b !== "object")
             invalid();
-        if (["SANOMA_SIGNING_KEY", "SANOMA_SECRETS_KEY"].includes(name) && !("env" in b) && !("bootstrap" in b))
+        if (DEPLOYMENT_KEYS.includes(name) && !("env" in b) && !("bootstrap" in b))
             invalid();
         if ("bootstrap" in b) {
-            if (!["SANOMA_SIGNING_KEY", "SANOMA_SECRETS_KEY"].includes(b.bootstrap) ||
+            if (!DEPLOYMENT_KEYS.includes(b.bootstrap) ||
                 b.path !== undefined ||
                 b.env !== undefined ||
                 (b.management !== undefined && b.management !== "external"))
@@ -108,7 +108,7 @@ export class SecretAccess {
         const binding = Object.hasOwn(this.bindings, name) ? this.bindings[name] : undefined;
         if (binding?.bootstrap !== undefined)
             return { store: "bootstrap", namespace: "", path: binding.bootstrap, management: "external" };
-        if (["SANOMA_SIGNING_KEY", "SANOMA_SECRETS_KEY"].includes(name) && !binding)
+        if (DEPLOYMENT_KEYS.includes(name) && !binding)
             throw new SecretStoreError("invalid_configuration");
         if (binding?.env !== undefined)
             return { store: "environment", namespace: "", path: binding.env, management: "external" };
@@ -144,11 +144,16 @@ export class SecretAccess {
             throw new SecretStoreError("too_large");
         return secretStoreCall(() => this.store.write(location, value, options));
     }
-    async delete(name, options) {
+    /** Deletes the value at `expectedVersion`; without one, the value stored now, and none stored is nothing to do. */
+    async delete(name, options = {}) {
         const location = this.writable(name);
         if (this.store.capabilities.deletion === "unsupported")
             throw new SecretStoreError("unsupported");
-        await secretStoreCall(() => this.store.delete(location, options));
+        const expectedVersion = options.expectedVersion ?? (await this.read(name))?.version;
+        if (expectedVersion === undefined)
+            return;
+        const by = options.by ?? "sanoma";
+        await secretStoreCall(() => this.store.delete(location, { expectedVersion, by }));
     }
     async ensure(name, make) {
         const stored = await this.read(name);

package/dist/secret-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../src/secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAmCpD,uEAAuE;AACvE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAuB;IAC3B,SAAS,CAAU;IAC5B,YAAY,IAA0B;QACpC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,IAAI,KAAK,aAAa,CAAC;IAC1C,CAAC;CACF;AAwCD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS;IACjC,uBAAuB;IACvB,aAAa;IACb,QAAQ;IACR,UAAU;IACV,WAAW;IACX,aAAa;IACb,WAAW;IACX,eAAe;CAChB,CAAC,CAAC;AACH,MAAM,UAAU,GAAG,CAAC,KAAc,EAA6B,EAAE,CAC/D,OAAO,KAAK,KAAK,QAAQ;IACzB,KAAK,KAAK,IAAI;IACb,KAA0B,CAAC,IAAI,KAAK,kBAAkB;IACvD,UAAU,CAAC,GAAG,CAAE,KAA0B,CAAC,IAAI,CAAC,CAAC;AAEnD,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,eAAe,CAAI,GAAqB;IAC5D,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AACtD,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAmB,EAAE,CACnD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAEhF,yFAAyF;AACzF,MAAM,OAAO,GAAG,GAAG,EAAE;IACnB,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;AACtD,CAAC,CAAC;AACF,MAAM,UAAU,wBAAwB,CAAC,MAA2B;IAClE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9E,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7E,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;QAC1B,IACE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;YAChB,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,CAAC,CAAC;YACF,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS;YAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;YACjC,CAAC,CAAC,QAAQ,GAAG,CAAC;YACd,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC;YAChE,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC/D,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC;YAC9C,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,UAAU,CAAC;YAE9E,OAAO,EAAE,CAAC;IACd,CAAC;IACD,IACE,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC7B,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE3F,OAAO,EAAE,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACtE,IAAI,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QACnH,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACrB,IACE,CAAC,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAU,CAAC;gBACpE,CAAC,CAAC,IAAI,KAAK,SAAS;gBACpB,CAAC,CAAC,GAAG,KAAK,SAAS;gBACnB,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC;gBAE3D,OAAO,EAAE,CAAC;QACd,CAAC;aAAM,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACtB,IACE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;gBACzB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC/B,CAAC,CAAC,IAAI,KAAK,SAAS;gBACpB,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC;gBAE3D,OAAO,EAAE,CAAC;QACd,CAAC;aAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,CAAC;IAC5F,CAAC;AACH,CAAC;AAED,yGAAyG;AACzG,MAAM,OAAO,YAAY;IACd,KAAK,CAAc;IACnB,SAAS,CAAS;IACV,QAAQ,CAA0C;IAElD,GAAG,CAAuC;IAE3D,YACE,MAA2B,EAC3B,YAAyB,EACzB,GAAG,GAAyC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAEvE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,YAAY,CAAC;QAC1C,wBAAwB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC;QAC/C,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CACvF,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS;YAClC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QAChG,IAAI,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;YACzE,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QACtD,IAAI,OAAO,EAAE,GAAG,KAAK,SAAS;YAC5B,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QAC5F,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACpB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI;YAC3B,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,QAAQ;SAC5C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,QAAQ,CAAC,KAAK,KAAK,WAAW,IAAI,QAAQ,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAChE,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAmD,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC7G,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,KAAK,aAAa,IAAI,QAAQ,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACtC,oFAAoF;YACpF,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;QAC7E,CAAC;QACD,OAAO,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,KAAK,CACT,IAAY,EACZ,KAAa,EACb,OAAuD;QAEvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACjH,OAAO,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,OAAgD;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,KAAK,aAAa;YAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAClG,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,IAAkB;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;gBAAE,MAAM,KAAK,CAAC;YACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;YAChC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ;YACzE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,iBAAiB,KAAK,MAAM;YAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACpG,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,GAAG,GAAG,CAAC,CAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACxE,MAAM,UAAU,iBAAiB,CAC/B,OAAO,GAAoF,EAAE;IAE7F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,YAAY,GAA4B;QAC5C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,MAAM;QACpC,iBAAiB,EAAE,QAAQ;QAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS;QACvC,eAAe,EAAE,MAAM;KACxB,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,CAAC,YAAY,CAAC,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACtE,CAAC,CAAC;IACF,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,KAAK,CAAC,QAAQ,CAAC,SAAS;YACtB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QAChF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACvC,OAAO,KAAK,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;QAC/B,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE;YACjD,OAAO,EAAE,CAAC;YACV,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ;gBAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACtG,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,KAAK,eAAe;gBAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAC3F,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5G,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;YACjC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE;YACvC,OAAO,EAAE,CAAC;YACV,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,KAAK,eAAe;gBAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAClG,IAAI,YAAY,CAAC,QAAQ,KAAK,aAAa;gBAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAE,CAAC,CAAC;YACtG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../src/secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA0B,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAmC7F,uEAAuE;AACvE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAuB;IAC3B,SAAS,CAAU;IAC5B,YAAY,IAA0B;QACpC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,IAAI,KAAK,aAAa,CAAC;IAC1C,CAAC;CACF;AAwCD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS;IACjC,uBAAuB;IACvB,aAAa;IACb,QAAQ;IACR,UAAU;IACV,WAAW;IACX,aAAa;IACb,WAAW;IACX,eAAe;CAChB,CAAC,CAAC;AACH,MAAM,UAAU,GAAG,CAAC,KAAc,EAA6B,EAAE,CAC/D,OAAO,KAAK,KAAK,QAAQ;IACzB,KAAK,KAAK,IAAI;IACb,KAA0B,CAAC,IAAI,KAAK,kBAAkB;IACvD,UAAU,CAAC,GAAG,CAAE,KAA0B,CAAC,IAAI,CAAC,CAAC;AAEnD,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,eAAe,CAAI,GAAqB;IAC5D,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AACtD,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAmB,EAAE,CACnD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAEhF,yFAAyF;AACzF,MAAM,OAAO,GAAG,GAAG,EAAE;IACnB,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;AACtD,CAAC,CAAC;AACF,MAAM,UAAU,wBAAwB,CAAC,MAA2B;IAClE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9E,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7E,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;QAC1B,IACE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;YAChB,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,CAAC,CAAC;YACF,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS;YAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;YACjC,CAAC,CAAC,QAAQ,GAAG,CAAC;YACd,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC;YAChE,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC/D,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC;YAC9C,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,UAAU,CAAC;YAE9E,OAAO,EAAE,CAAC;IACd,CAAC;IACD,IACE,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC7B,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE3F,OAAO,EAAE,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACtE,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QACtF,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACrB,IACE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAU,CAAC;gBACvC,CAAC,CAAC,IAAI,KAAK,SAAS;gBACpB,CAAC,CAAC,GAAG,KAAK,SAAS;gBACnB,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC;gBAE3D,OAAO,EAAE,CAAC;QACd,CAAC;aAAM,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACtB,IACE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;gBACzB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC/B,CAAC,CAAC,IAAI,KAAK,SAAS;gBACpB,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC;gBAE3D,OAAO,EAAE,CAAC;QACd,CAAC;aAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,CAAC;IAC5F,CAAC;AACH,CAAC;AAED,yGAAyG;AACzG,MAAM,OAAO,YAAY;IACd,KAAK,CAAc;IACnB,SAAS,CAAS;IACV,QAAQ,CAA0C;IAElD,GAAG,CAAuC;IAE3D,YACE,MAA2B,EAC3B,YAAyB,EACzB,GAAG,GAAyC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAEvE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,YAAY,CAAC;QAC1C,wBAAwB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC;QAC/C,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CACvF,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS;YAClC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QAChG,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QACpG,IAAI,OAAO,EAAE,GAAG,KAAK,SAAS;YAC5B,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QAC5F,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACpB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI;YAC3B,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,QAAQ;SAC5C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,QAAQ,CAAC,KAAK,KAAK,WAAW,IAAI,QAAQ,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAChE,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAyB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,KAAK,aAAa,IAAI,QAAQ,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACtC,oFAAoF;YACpF,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;QAC7E,CAAC;QACD,OAAO,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,KAAK,CACT,IAAY,EACZ,KAAa,EACb,OAAuD;QAEvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACjH,OAAO,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,mHAAmH;IACnH,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,OAAO,GAA8C,EAAE;QAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,KAAK,aAAa;YAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAClG,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC;QACpF,IAAI,eAAe,KAAK,SAAS;YAAE,OAAO;QAC1C,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,QAAQ,CAAC;QAClC,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,IAAkB;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;gBAAE,MAAM,KAAK,CAAC;YACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;YAChC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ;YACzE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,iBAAiB,KAAK,MAAM;YAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACpG,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,GAAG,GAAG,CAAC,CAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACxE,MAAM,UAAU,iBAAiB,CAC/B,OAAO,GAAoF,EAAE;IAE7F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,YAAY,GAA4B;QAC5C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,MAAM;QACpC,iBAAiB,EAAE,QAAQ;QAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS;QACvC,eAAe,EAAE,MAAM;KACxB,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,CAAC,YAAY,CAAC,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACtE,CAAC,CAAC;IACF,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,KAAK,CAAC,QAAQ,CAAC,SAAS;YACtB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QAChF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACvC,OAAO,KAAK,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;QAC/B,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE;YACjD,OAAO,EAAE,CAAC;YACV,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ;gBAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACtG,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,KAAK,eAAe;gBAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAC3F,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5G,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;YACjC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE;YACvC,OAAO,EAAE,CAAC;YACV,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,KAAK,eAAe;gBAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAClG,IAAI,YAAY,CAAC,QAAQ,KAAK,aAAa;gBAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAE,CAAC,CAAC;YACtG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/secret.d.ts

@@ -26,11 +26,18 @@ export interface Secrets {
     get(name: string): Promise<string | undefined>;
     /** The stored value; when there is none, `make()`'s, stored first. */
     ensure(name: string, make: () => string): Promise<string>;
+    /** Deletes the stored value; none stored is nothing to do. The runtime's own `sanoma.secret.delete` calls it. */
+    delete(name: string): Promise<void>;
 }
 /** A named call can resolve only the auxiliary secret markers present in its authorized input. */
 export declare function secretsForInput(input: unknown, secrets: Secrets, creates?: readonly string[]): Secrets;
 /** A value for a secret with `generate`: 32 random bytes, base64url. */
 export declare const generateSecret: () => string;
+/**
+ * A bearer token's sha256, hex: all a table keeps of one (the wakeup service's, the api tokens). A
+ * token is found by its hash (a unique index), so the secret itself is never compared.
+ */
+export declare const tokenHash: (token: string) => string;
 /** `T` with each secret marker's place holding its value: what `resolveSecrets` returns. */
 export type Resolved<T> = T extends Secret ? string : T extends readonly (infer I)[] ? Resolved<I>[] : T extends object ? {
     [K in keyof T]: Resolved<T[K]>;

package/dist/secret.js

@@ -1,4 +1,4 @@
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { DriverError } from "./op.js";
 /** A secret's name: an environment variable's, upper case. */
 export const SECRET_NAME = /^[A-Z][A-Z0-9_]*$/;
@@ -49,10 +49,19 @@ export function secretsForInput(input, secrets, creates = []) {
             check(name, true);
             return secrets.ensure(name, make);
         },
+        async delete(name) {
+            check(name, true);
+            return secrets.delete(name);
+        },
     };
 }
 /** A value for a secret with `generate`: 32 random bytes, base64url. */
 export const generateSecret = () => randomBytes(32).toString("base64url");
+/**
+ * A bearer token's sha256, hex: all a table keeps of one (the wakeup service's, the api tokens). A
+ * token is found by its hash (a unique index), so the secret itself is never compared.
+ */
+export const tokenHash = (token) => createHash("sha256").update(token).digest("hex");
 /**
  * `value` with each secret marker in it replaced by the stored value: generated and stored first
  * for one with `generate` and none stored. A marker naming nothing stored fails the call, for good.
@@ -85,6 +94,9 @@ export function memorySecrets(initial = {}) {
                 values.set(name, make());
             return values.get(name);
         },
+        async delete(name) {
+            values.delete(name);
+        },
     };
 }
 //# sourceMappingURL=secret.js.map

package/dist/secret.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret.js","sourceRoot":"","sources":["../src/secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAetC,8DAA8D;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AAE3E;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,OAA4B;IAC/D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,8EAA8E,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3G,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAmB,EAAE,CAC1D,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAQ,KAA+B,CAAC,OAAO,KAAK,QAAQ,CAAC;AAU9G,kGAAkG;AAClG,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,OAAgB,EAAE,OAAO,GAAsB,EAAE;IAC/F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,sCAAsC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACjH,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,EAAE;QAC/B,IAAI,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;aAC3G,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;aAC/C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC,CAAC;IACF,KAAK,CAAC,KAAK,CAAC,CAAC;IACb,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,QAAiB,EAAE,EAAE;QAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,IAAI,WAAW,CAAC,gDAAgD,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAClG,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACnB,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI;YACrB,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAClB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,cAAc,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAWlF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAI,KAAQ,EAAE,OAAgB;IAChE,MAAM,OAAO,GAAG,KAAK,EAAE,CAAU,EAAoB,EAAE;QACrD,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3G,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC,OAAO,uCAAuC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAU,CAAC,CAAC,CAAC;QACjH,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,OAAO,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAgB,CAAC;AAC/C,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,OAAO,GAA2B,EAAE;IAChE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,OAAO;QACL,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QACrC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI;YACrB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../src/secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAetC,8DAA8D;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AAE3E;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,OAA4B;IAC/D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,8EAA8E,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3G,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAmB,EAAE,CAC1D,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAQ,KAA+B,CAAC,OAAO,KAAK,QAAQ,CAAC;AAY9G,kGAAkG;AAClG,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,OAAgB,EAAE,OAAO,GAAsB,EAAE;IAC/F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,sCAAsC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACjH,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,EAAE;QAC/B,IAAI,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;aAC3G,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;aAC/C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC,CAAC;IACF,KAAK,CAAC,KAAK,CAAC,CAAC;IACb,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,QAAiB,EAAE,EAAE;QAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,IAAI,WAAW,CAAC,gDAAgD,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAClG,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACnB,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI;YACrB,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAClB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAClB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,cAAc,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAElF;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAWrG;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAI,KAAQ,EAAE,OAAgB;IAChE,MAAM,OAAO,GAAG,KAAK,EAAE,CAAU,EAAoB,EAAE;QACrD,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3G,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC,OAAO,uCAAuC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAU,CAAC,CAAC,CAAC;QACjH,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,OAAO,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAgB,CAAC;AAC/C,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,OAAO,GAA2B,EAAE;IAChE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,OAAO;QACL,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QACrC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI;YACrB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/shared.d.ts

@@ -173,7 +173,13 @@ export declare const CHANGE_EVENT = "change";
 export declare const CHANGE_TOPIC = "change:event";
 /** Lists the apps on GitHub with Sanoma's claims: the one runtime operation a page may call (`isDirect`). */
 export declare const APPS_LIST = "sanoma.apps.list";
-/** The workflows the runtime adds itself, which a config's own may not be named: drift, apply, call and change. */
+/**
+ * The built-in workflow that sends a staff or visitor sign-in code through the config's
+ * `login.sender`, started by the runtime's agent `login` (`LOGIN_AGENT`): its input's code is
+ * sealed, and the mail's body is recorded as `<text>` and `<html>`.
+ */
+export declare const LOGIN_CODE_WORKFLOW = "login-code";
+/** The workflows the runtime adds itself, which a config's own may not be named: drift, apply, call, change and login-code. */
 export declare const BUILT_IN_WORKFLOWS: ReadonlySet<string>;
 /**
  * Every run status, in the order a run may pass through them: waiting on the queue, running,
@@ -213,10 +219,13 @@ export declare const VISITORS = "visitors";
 /** The principal a public page runs as when nobody is signed in: no groups. */
 export declare const ANONYMOUS = "anonymous";
 /**
- * True for `anonymous` and for a visitor's id: a principal no data file declares and the staff
- * logins never admit. Marked by the id alone, since a principal crosses to the worker as JSON.
+ * True for `anonymous`, a visitor's id and a token's (`token:<id>`): a principal no data file
+ * declares and the staff logins never admit. Marked by the id alone, since a principal crosses to
+ * the worker as JSON.
  */
 export declare const isVisitor: (p: Pick<Principal, "id">) => boolean;
+/** True for an api token's principal (`token:<id>`), whose groups are its row's. */
+export declare const isToken: (p: Pick<Principal, "id">) => boolean;
 /**
  * The visitor a public site's login vouches for: `subject` from the provider behind the `login`
  * connector, in `visitors`. Throws for a login or subject that would make an id `isVisitor` does not tell.
@@ -230,7 +239,9 @@ export declare const WAKEUP_AGENT = "wakeup";
 export declare const SCHEDULE_AGENT = "schedule";
 /** The runtime's agent that checks and deploys the hosts: drift's, and apply's after a push to `main` (`SanomaClient.remoteEvent`). */
 export declare const HOST_CHECK_AGENT = "host-check";
-/** The runtime's own agents (scenarios, the host check, scheduled runs, the wakeup's registration), declared whether a data file names them or not. */
+/** The runtime's agent that sends a sign-in code (`LOGIN_CODE_WORKFLOW`): a company's policy exempts it from its holds on sending. */
+export declare const LOGIN_AGENT = "login";
+/** The runtime's own agents (scenarios, the host check, scheduled runs, the wakeup's registration, sign-in codes), declared whether a data file names them or not. */
 export declare const RUNTIME_AGENTS: readonly string[];
 type PersonFields = {
     id: string;