@sanoma-ai/workflows 0.9.1 → 0.10.0

package/dist/connection.js

@@ -0,0 +1,327 @@
+import { createHash, randomUUID } from "node:crypto";
+import { z } from "zod";
+import { checkAuthenticationStore, defineAuthentication } from "./authentication.js";
+import { setupOf, VENDOR, defineConnector, defineDriver } from "./op.js";
+import { isSecret } from "./secret.js";
+import { SanomaError } from "./errors.js";
+const idPart = /^[a-z][a-z0-9-]{0,63}$/;
+function refuse(message) {
+    throw new SanomaError("invalid_input", message);
+}
+export const connectionRefSchema = z.object({
+    $connection: z.string().min(1),
+    vendor: z.string().min(1),
+    revision: z.string().optional(),
+});
+const snapshotSchema = z.object({
+    id: z.string(),
+    vendor: z.string(),
+    method: z.string(),
+    account: z.string(),
+    scopes: z.array(z.string()),
+    revision: z.string(),
+    definition: z.string(),
+    credentials: z.object({ $secret: z.string() }).optional(),
+});
+export function defineConnection(connector, options) {
+    if (!idPart.test(options.name))
+        refuse("A connection needs a stable lowercase name");
+    const vendor = connector[VENDOR].id;
+    const auth = setupOf(connector).authentication?.[options.method];
+    if (!auth)
+        refuse("The connector does not declare this authentication method");
+    if (auth.kind === "workload-identity" ? options.credentials !== undefined : !isSecret(options.credentials))
+        refuse("Credentials must match the authentication method");
+    return Object.freeze({
+        $connection: `${vendor}/${options.name}`,
+        vendor,
+        name: options.name,
+        method: options.method,
+        ...(options.credentials && { credentials: Object.freeze({ $secret: options.credentials.$secret }) }),
+        scopes: Object.freeze([...(options.scopes ?? [])]),
+        ...(options.account && { account: options.account }),
+        default: options.default ?? false,
+    });
+}
+export function defineConnectionRule(connector, options) {
+    if (!idPart.test(options.name) ||
+        !options.createBy.length ||
+        options.createBy.some((x) => typeof x === "string" ? !x.trim() : !x || typeof x.group !== "string" || !x.group.trim()))
+        refuse("A connection rule needs a name and allowed creators");
+    if (!setupOf(connector).authentication?.[options.method])
+        refuse("The connector does not declare this authentication method");
+    return Object.freeze({
+        name: options.name,
+        vendor: connector[VENDOR].id,
+        method: options.method,
+        createBy: Object.freeze(options.createBy.map((x) => (typeof x === "string" ? x : Object.freeze({ ...x })))),
+        scopes: Object.freeze([...(options.scopes ?? [])]),
+    });
+}
+/** Reconstitutes a dynamic reference; authority is checked from the persisted record on every call. */
+export function connectionRef(rule, id) {
+    if (!id.startsWith(`${rule.vendor}/${rule.name}/`))
+        refuse("The connection is outside this rule");
+    return Object.freeze({ $connection: id, vendor: rule.vendor });
+}
+export function connectionCatalog(connectors, definitions = [], rules = []) {
+    const methods = new Map();
+    for (const connector of connectors) {
+        const vendor = connector[VENDOR].id;
+        const entries = methods.get(vendor) ?? {};
+        for (const [name, method] of Object.entries(setupOf(connector).authentication ?? {})) {
+            if (entries[name] && entries[name] !== method)
+                refuse("Conflicting authentication methods for a connector");
+            defineAuthentication(method);
+            entries[name] = method;
+        }
+        methods.set(vendor, entries);
+    }
+    const defined = new Map();
+    const defaults = new Set();
+    for (const d of definitions) {
+        if (!d ||
+            !idPart.test(d.name) ||
+            d.$connection !== `${d.vendor}/${d.name}` ||
+            !methods.get(d.vendor)?.[d.method] ||
+            defined.has(d.$connection))
+            refuse("Invalid or duplicate connection declaration");
+        const auth = methods.get(d.vendor)[d.method];
+        if (auth.kind === "workload-identity" ? d.credentials !== undefined : !isSecret(d.credentials))
+            refuse("Credentials must match the authentication method");
+        if (d.default && defaults.has(d.vendor))
+            refuse("A connector can have only one explicit default connection");
+        if (d.default)
+            defaults.add(d.vendor);
+        defined.set(d.$connection, d);
+    }
+    const dynamic = new Map();
+    for (const r of rules) {
+        const id = `${r.vendor}/${r.name}`;
+        if (!idPart.test(r.name) ||
+            !methods.get(r.vendor)?.[r.method] ||
+            dynamic.has(id) ||
+            defined.has(id) ||
+            !r.createBy.length)
+            refuse("Invalid or duplicate connection rule");
+        dynamic.set(id, r);
+    }
+    return { definitions: defined, rules: dynamic, methods };
+}
+const snapshot = (r) => ({
+    id: r.id,
+    vendor: r.vendor,
+    method: r.method,
+    account: r.account,
+    scopes: r.scopes,
+    revision: r.revision,
+    definition: r.definition,
+    ...(r.credential && { credentials: { $secret: r.credential } }),
+});
+const fingerprint = (declaration, method) => createHash("sha256")
+    .update(JSON.stringify({ declaration, kind: method.kind, version: method.version, storage: method.storage }))
+    .digest("hex");
+/** Persists account metadata only. Secret values are handled outside these operations. */
+export class ConnectionRegistry {
+    catalog;
+    db;
+    secrets;
+    constructor(catalog, db, secrets) {
+        this.catalog = catalog;
+        this.db = db;
+        this.secrets = secrets;
+    }
+    /** A direct metadata write uses the same transaction as its default ledger record. */
+    onDatabase(db) {
+        return new ConnectionRegistry(this.catalog, async () => db, this.secrets);
+    }
+    bindingFingerprint(declaration, method, credential) {
+        const name = credential ?? ("credentials" in declaration ? declaration.credentials?.$secret : undefined);
+        const location = name ? this.secrets?.location(name) : undefined;
+        return createHash("sha256")
+            .update(JSON.stringify({ contract: fingerprint(declaration, method), location }))
+            .digest("hex");
+    }
+    checkStore(method, credential) {
+        if (!this.secrets || !credential)
+            return;
+        const location = this.secrets.location(credential);
+        const caps = location.namespace === ""
+            ? {
+                writable: false,
+                maxBytes: Number.MAX_SAFE_INTEGER,
+                conditionalWrites: "none",
+                deletion: "unsupported",
+                changeDetection: "read",
+            }
+            : this.secrets.store.capabilities;
+        checkAuthenticationStore(method, caps, location.management);
+    }
+    async row(id) {
+        return (await (await this.db()).query("SELECT * FROM sanoma_connections WHERE id=$1", [id])).rows[0];
+    }
+    async select(vendor, ref, actor) {
+        if (!ref) {
+            const defaults = [...this.catalog.definitions.values()].filter((d) => d.vendor === vendor && d.default);
+            if (defaults[0])
+                ref = defaults[0];
+            else if (Object.keys(this.catalog.methods.get(vendor) ?? {}).length ||
+                [...this.catalog.definitions.values()].some((d) => d.vendor === vendor))
+                refuse("Select a named connection or declare an explicit default");
+            else
+                return undefined; // Operations without an authentication method need no connection.
+        }
+        if (!ref || ref.vendor !== vendor)
+            refuse("The selected connection belongs to another connector");
+        const row = await this.row(ref.$connection);
+        if (!row || row.vendor !== vendor || row.status !== "connected")
+            refuse("The connection is missing or disconnected");
+        if (ref.revision !== undefined && ref.revision !== row.revision)
+            refuse("The connection changed after authorization; start a new call");
+        const declaration = row.rule ? this.catalog.rules.get(row.rule) : this.catalog.definitions.get(row.id);
+        if (!declaration || declaration.vendor !== vendor || declaration.method !== row.method)
+            refuse("The connection is not declared");
+        if (row.rule && row.owner !== actor)
+            throw new SanomaError("policy_denied", "The connection belongs to another principal");
+        const method = this.catalog.methods.get(vendor)?.[row.method];
+        if (!method || row.definition !== this.bindingFingerprint(declaration, method, row.credential))
+            refuse("The connection declaration changed; reconnect before use");
+        this.checkStore(method, row.credential);
+        return snapshot(row);
+    }
+    async assertCurrent(selected, actor) {
+        if (!selected)
+            return;
+        const current = await this.select(selected.vendor, { vendor: selected.vendor, $connection: selected.id }, actor);
+        if (!current || current.revision !== selected.revision || current.definition !== selected.definition)
+            refuse("The connection changed after authorization; start a new call");
+    }
+    async bind(ref, account, scopes, expectedRevision, actor) {
+        const declaration = this.catalog.definitions.get(ref.$connection);
+        if (!declaration || declaration.vendor !== ref.vendor)
+            refuse("The connection is not declared");
+        if (declaration.account && account !== declaration.account)
+            refuse("The account does not match the connection requirement");
+        if (declaration.scopes.some((s) => !scopes.includes(s)))
+            refuse("The account has not granted the required scopes");
+        const method = this.catalog.methods.get(ref.vendor)[declaration.method];
+        const row = {
+            id: ref.$connection,
+            vendor: ref.vendor,
+            method: declaration.method,
+            owner: null,
+            rule: null,
+            account,
+            scopes,
+            revision: randomUUID(),
+            definition: this.bindingFingerprint(declaration, method),
+            credential: declaration.credentials?.$secret ?? null,
+            status: "connected",
+        };
+        this.checkStore(method, row.credential);
+        await this.save(row, expectedRevision, actor);
+        return snapshot(row);
+    }
+    async create(ruleId, account, scopes, actor) {
+        const rule = this.catalog.rules.get(ruleId);
+        const person = typeof actor === "string" ? { id: actor } : actor;
+        if (!rule ||
+            !rule.createBy.some((by) => (typeof by === "string" ? by === person.id : person.groups?.includes(by.group))))
+            throw new SanomaError("policy_denied", "This principal cannot create connections under this rule");
+        if (rule.scopes.some((s) => !scopes.includes(s)))
+            refuse("The account has not granted the required scopes");
+        const method = this.catalog.methods.get(rule.vendor)[rule.method];
+        const id = `${ruleId}/${randomUUID()}`;
+        const credential = method.kind === "workload-identity" ? null : `CONNECTION_${randomUUID().replaceAll("-", "").toUpperCase()}`;
+        const row = {
+            id,
+            vendor: rule.vendor,
+            method: rule.method,
+            owner: person.id,
+            rule: ruleId,
+            account,
+            scopes,
+            revision: randomUUID(),
+            definition: this.bindingFingerprint(rule, method, credential),
+            credential,
+            status: "connected",
+        };
+        this.checkStore(method, row.credential);
+        await this.save(row, null, person.id);
+        return snapshot(row);
+    }
+    async disconnect(ref, expectedRevision, actor) {
+        const row = await this.row(ref.$connection);
+        if (!row ||
+            row.vendor !== ref.vendor ||
+            (row.rule ? !this.catalog.rules.has(row.rule) : !this.catalog.definitions.has(row.id)))
+            refuse("The connection is not declared");
+        if (row.rule && row.owner !== actor)
+            throw new SanomaError("policy_denied", "The connection belongs to another principal");
+        const revision = randomUUID();
+        const changed = await (await this.db()).query("UPDATE sanoma_connections SET status='disconnected',revision=$2,updated_by=$3,updated_at=now() WHERE id=$1 AND revision=$4 RETURNING id", [row.id, revision, actor, expectedRevision]);
+        if (!changed.rowCount)
+            refuse("The connection changed; reload before disconnecting it");
+        return { id: row.id, revision, status: "disconnected" };
+    }
+    async save(row, expected, actor) {
+        const values = [
+            row.id,
+            row.vendor,
+            row.method,
+            row.owner,
+            row.rule,
+            row.account,
+            JSON.stringify(row.scopes),
+            row.revision,
+            row.definition,
+            row.credential,
+            actor,
+        ];
+        const query = expected === null
+            ? "INSERT INTO sanoma_connections (id,vendor,method,owner,rule,account,scopes,revision,definition,credential,updated_by) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11) ON CONFLICT(id) DO NOTHING RETURNING id"
+            : "UPDATE sanoma_connections SET vendor=$2,method=$3,owner=$4,rule=$5,account=$6,scopes=$7,revision=$8,definition=$9,credential=$10,updated_by=$11,updated_at=now(),status='connected' WHERE id=$1 AND revision=$12 RETURNING id";
+        const result = await (await this.db()).query(query, [...values, ...(expected === null ? [] : [expected])]);
+        if (!result.rowCount)
+            refuse("The connection changed; reload before binding it");
+    }
+}
+/** Metadata mutations are access operations, so they are policy-reviewed and audited like other effects. */
+export const connectionOps = defineConnector("sanoma", {
+    connection: {
+        disconnect: {
+            effect: "access",
+            input: z.object({ connection: connectionRefSchema, expectedRevision: z.string() }),
+            output: z.object({ id: z.string(), revision: z.string(), status: z.literal("disconnected") }),
+            target: (input) => input.connection.$connection,
+        },
+        bind: {
+            effect: "access",
+            input: z.object({
+                connection: connectionRefSchema,
+                account: z.string().min(1),
+                scopes: z.array(z.string()),
+                expectedRevision: z.string().nullable(),
+            }),
+            output: snapshotSchema,
+            target: (input) => input.connection.$connection,
+        },
+        create: {
+            effect: "access",
+            input: z.object({ rule: z.string(), account: z.string().min(1), scopes: z.array(z.string()) }),
+            output: snapshotSchema,
+            target: (input) => input.rule,
+        },
+    },
+});
+const actor = (call) => call.principal ?? refuse("Connection mutation needs an authenticated principal");
+export function connectionDriver(registry) {
+    return defineDriver(connectionOps, {
+        connection: {
+            disconnect: (input, call) => registry.disconnect(input.connection, input.expectedRevision, actor(call).id),
+            bind: (input, call) => registry.bind(input.connection, input.account, input.scopes, input.expectedRevision, actor(call).id),
+            create: (input, call) => registry.create(input.rule, input.account, input.scopes, actor(call)),
+        },
+    });
+}
+//# sourceMappingURL=connection.js.map

package/dist/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../src/connection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAuB,MAAM,qBAAqB,CAAC;AAC1G,OAAO,EAAkB,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,EAAoB,MAAM,SAAS,CAAC;AAC3G,OAAO,EAAE,QAAQ,EAAe,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAoC1C,MAAM,MAAM,GAAG,wBAAwB,CAAC;AACxC,SAAS,MAAM,CAAC,OAAe;IAC7B,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AACD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAEH,MAAM,UAAU,gBAAgB,CAC9B,SAAY,EACZ,OAOC;IAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,4CAA4C,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI;QAAE,MAAM,CAAC,2DAA2D,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;QACxG,MAAM,CAAC,kDAAkD,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,GAAG,MAAM,IAAI,OAAO,CAAC,IAAI,EAAE;QACxC,MAAM;QACN,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACpG,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QACpD,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,SAAY,EACZ,OAKC;IAED,IACE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1B,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM;QACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1B,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CACzF;QAED,MAAM,CAAC,qDAAqD,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;QACtD,MAAM,CAAC,2DAA2D,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3G,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,aAAa,CAAmB,IAAuB,EAAE,EAAU;IACjF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC;QAAE,MAAM,CAAC,qCAAqC,CAAC,CAAC;IAClG,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AACjE,CAAC;AAOD,MAAM,UAAU,iBAAiB,CAC/B,UAA0C,EAC1C,WAAW,GAAoC,EAAE,EACjD,KAAK,GAA8B,EAAE;IAErC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0C,CAAC;IAClE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC;YACrF,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,MAAM;gBAAE,MAAM,CAAC,oDAAoD,CAAC,CAAC;YAC5G,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;QACzB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAgC,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IACE,CAAC,CAAC;YACF,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACpB,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE;YACzC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;YAE1B,MAAM,CAAC,6CAA6C,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAE,CAAC,CAAC,CAAC,MAAM,CAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;YAC5F,MAAM,CAAC,kDAAkD,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,2DAA2D,CAAC,CAAC;QAC7G,IAAI,CAAC,CAAC,OAAO;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IACE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACpB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACf,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;YAElB,MAAM,CAAC,sCAAsC,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC3D,CAAC;AAeD,MAAM,QAAQ,GAAG,CAAC,CAAgB,EAAsB,EAAE,CAAC,CAAC;IAC1D,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,OAAO,EAAE,CAAC,CAAC,OAAO;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;CAChE,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,CAAC,WAAkD,EAAE,MAAsB,EAAU,EAAE,CACzG,UAAU,CAAC,QAAQ,CAAC;KACjB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;KAC5G,MAAM,CAAC,KAAK,CAAC,CAAC;AAEnB,0FAA0F;AAC1F,MAAM,OAAO,kBAAkB;IACpB,OAAO,CAAoB;IACnB,EAAE,CAAoB;IACtB,OAAO,CAAgB;IACxC,YAAY,OAA0B,EAAE,EAAqB,EAAE,OAAsB;QACnF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,sFAAsF;IACtF,UAAU,CAAC,EAAM;QACf,OAAO,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5E,CAAC;IAEO,kBAAkB,CACxB,WAAkD,EAClD,MAAsB,EACtB,UAA0B;QAE1B,MAAM,IAAI,GAAG,UAAU,IAAI,CAAC,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzG,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,OAAO,UAAU,CAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;aAChF,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAEO,UAAU,CAAC,MAAsB,EAAE,UAA0B;QACnE,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU;YAAE,OAAO;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,IAAI,GACR,QAAQ,CAAC,SAAS,KAAK,EAAE;YACvB,CAAC,CAAC;gBACE,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,MAAM,CAAC,gBAAgB;gBACjC,iBAAiB,EAAE,MAAe;gBAClC,QAAQ,EAAE,aAAsB;gBAChC,eAAe,EAAE,MAAe;aACjC;YACH,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;QACtC,wBAAwB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC9D,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,EAAU;QAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAgB,8CAA8C,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,GAA8B,EAAE,KAAa;QACxE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;YACxG,IAAI,QAAQ,CAAC,CAAC,CAAC;gBAAE,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;iBAC9B,IACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM;gBAC1D,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;gBAEvE,MAAM,CAAC,0DAA0D,CAAC,CAAC;;gBAChE,OAAO,SAAS,CAAC,CAAC,kEAAkE;QAC3F,CAAC;QACD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,CAAC,sDAAsD,CAAC,CAAC;QAClG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;YAC7D,MAAM,CAAC,2CAA2C,CAAC,CAAC;QACtD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAC7D,MAAM,CAAC,8DAA8D,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvG,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,IAAI,WAAW,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;YACpF,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;YACjC,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,6CAA6C,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC;YAC5F,MAAM,CAAC,0DAA0D,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QACxC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAwC,EAAE,KAAa;QACzE,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACjH,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;YAClG,MAAM,CAAC,8DAA8D,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,IAAI,CACR,GAAkB,EAClB,OAAe,EACf,MAAgB,EAChB,gBAA+B,EAC/B,KAAa;QAEb,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;YAAE,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAChG,IAAI,WAAW,CAAC,OAAO,IAAI,OAAO,KAAK,WAAW,CAAC,OAAO;YACxD,MAAM,CAAC,uDAAuD,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,iDAAiD,CAAC,CAAC;QACnH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,WAAW,CAAC,MAAM,CAAE,CAAC;QAC1E,MAAM,GAAG,GAAkB;YACzB,EAAE,EAAE,GAAG,CAAC,WAAW;YACnB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,IAAI;YACV,OAAO;YACP,MAAM;YACN,QAAQ,EAAE,UAAU,EAAE;YACtB,UAAU,EAAE,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC;YACxD,UAAU,EAAE,WAAW,CAAC,WAAW,EAAE,OAAO,IAAI,IAAI;YACpD,MAAM,EAAE,WAAW;SACpB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CACV,MAAc,EACd,OAAe,EACf,MAAgB,EAChB,KAAyB;QAEzB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACjE,IACE,CAAC,IAAI;YACL,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YAE5G,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,0DAA0D,CAAC,CAAC;QACrG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,iDAAiD,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAE,CAAC,IAAI,CAAC,MAAM,CAAE,CAAC;QACpE,MAAM,EAAE,GAAG,GAAG,MAAM,IAAI,UAAU,EAAE,EAAE,CAAC;QACvC,MAAM,UAAU,GACd,MAAM,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9G,MAAM,GAAG,GAAkB;YACzB,EAAE;YACF,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,MAAM,CAAC,EAAE;YAChB,IAAI,EAAE,MAAM;YACZ,OAAO;YACP,MAAM;YACN,QAAQ,EAAE,UAAU,EAAE;YACtB,UAAU,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC;YAC7D,UAAU;YACV,MAAM,EAAE,WAAW;SACpB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACtC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,UAAU,CACd,GAAkB,EAClB,gBAAwB,EACxB,KAAa;QAEb,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,IACE,CAAC,GAAG;YACJ,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;YACzB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEtF,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;YACjC,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,6CAA6C,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CACpB,MAAM,IAAI,CAAC,EAAE,EAAE,CAChB,CAAC,KAAK,CACL,yIAAyI,EACzI,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAC5C,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,MAAM,CAAC,wDAAwD,CAAC,CAAC;QACxF,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,GAAkB,EAAE,QAAuB,EAAE,KAAa;QAC3E,MAAM,MAAM,GAAG;YACb,GAAG,CAAC,EAAE;YACN,GAAG,CAAC,MAAM;YACV,GAAG,CAAC,MAAM;YACV,GAAG,CAAC,KAAK;YACT,GAAG,CAAC,IAAI;YACR,GAAG,CAAC,OAAO;YACX,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;YAC1B,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,UAAU;YACd,GAAG,CAAC,UAAU;YACd,KAAK;SACN,CAAC;QACF,MAAM,KAAK,GACT,QAAQ,KAAK,IAAI;YACf,CAAC,CAAC,2MAA2M;YAC7M,CAAC,CAAC,+NAA+N,CAAC;QACtO,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3G,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,CAAC,kDAAkD,CAAC,CAAC;IACnF,CAAC;CACF;AAED,4GAA4G;AAC5G,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC,QAAQ,EAAE;IACrD,UAAU,EAAE;QACV,UAAU,EAAE;YACV,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAClF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7F,MAAM,EAAE,CAAC,KAAoC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW;SAC/E;QACD,IAAI,EAAE;YACJ,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;gBACd,UAAU,EAAE,mBAAmB;gBAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC3B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;aACxC,CAAC;YACF,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,CAAC,KAAoC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW;SAC/E;QACD,MAAM,EAAE;YACN,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YAC9F,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,CAAC,KAAuB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI;SAChD;KACF;CACF,CAAC,CAAC;AACH,MAAM,KAAK,GAAG,CAAC,IAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,sDAAsD,CAAC,CAAC;AACtH,MAAM,UAAU,gBAAgB,CAAC,QAA4B;IAC3D,OAAO,YAAY,CAAC,aAAa,EAAE;QACjC,UAAU,EAAE;YACV,UAAU,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1G,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACpB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACtG,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;SAC/F;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/credentials.d.ts

@@ -1,55 +1,9 @@
 import { type Db } from "./db.ts";
-import type { Driver } from "./op.ts";
-import type { Secrets } from "./secret.ts";
-/** The variable holding the key the stored values are encrypted with: 32 bytes, base64. */
+import { SecretAccess, type SecretConfiguration, type SecretStore } from "./secret-store.ts";
 export declare const SECRETS_KEY = "SANOMA_SECRETS_KEY";
-/**
- * `name`'s value encrypted for the table: `v1:<iv, base64>:<ciphertext and tag, base64>`,
- * AES-256-GCM, with the name as associated data, so a value moved to another row does not decrypt.
- */
-export declare function encrypt(name: string, value: string): string;
-/** The value `name`'s row holds: decrypted, or a plaintext one as it is (it is encrypted on its next write). */
-export declare function decrypt(name: string, stored: string): string;
-/** The stored rows of these names, values included: for loading into an environment or checking, never for showing. */
-export declare function storedCredentials(db: Db, names: readonly string[]): Promise<Map<string, {
-    value: string;
-    setBy: string;
-    setAt: string;
-}>>;
-/** Upserts the value and announces it, in one statement, so a worker never hears of a change it cannot read. */
-export declare function storeCredential(db: Db, { name, value, setBy }: {
-    name: string;
-    value: string;
-    setBy: string;
-}): Promise<void>;
-/**
- * The stored value of `name`; when there is none, `make()`'s, stored first and announced. Of two
- * at once, the first stored wins, and both return it.
- */
-export declare function ensureCredential(db: Db, { name, make, setBy }: {
-    name: string;
-    make: () => string;
-    setBy: string;
-}): Promise<string>;
-/**
- * The secrets store a live driver is given (`CallContext.secrets`): a variable the environment
- * sets wins, as it does for a driver's `env`; else the stored value. `ensure` stores what it
- * makes as `setBy`.
- */
-export declare function storedSecrets(db: () => Promise<Db>, setBy: string): Secrets;
-/** Deletes the row, announcing it when there was one. */
-export declare function deleteCredential(db: Db, name: string): Promise<void>;
-/** Stops a worker's credentials listener. */
-export interface CredentialsWatch {
-    close(): Promise<void>;
-}
-/**
- * Loads the stored values of the declared variables the environment does not set into
- * `process.env`, then keeps them current: on each change announced, and on reconnecting, it
- * loads them again, so a value set replaces the one before and a value cleared is deleted. A
- * name the environment set when this started is never touched, and the names it did set are
- * deleted on `close`. Logs, per vendor, how many variables each load changed, never a value, and
- * warns of a reloaded value its schema refuses. A listener that drops reconnects, waiting longer
- * after each failure, up to 30 s, until it is closed. With no such variable, it connects to nothing.
- */
-export declare function watchCredentials(databaseUrl: string, drivers: ReadonlyMap<string, Driver>): Promise<CredentialsWatch>;
+/** AES-256-GCM authenticated to the complete namespace/path identity. No plaintext format. */
+export declare function encrypt(identity: string, value: string): string;
+export declare function decrypt(identity: string, stored: string): string;
+/** One company's database connection supplies authority; namespace separates deployments within it. */
+export declare function postgresSecretStore(db: () => Promise<Db>): SecretStore;
+export declare const configuredSecrets: (config: SecretConfiguration, db: () => Promise<Db>) => SecretAccess;