@sponson/adapters 0.0.0-stage → 0.5.0

package/dist/secrets.js

@@ -0,0 +1,476 @@
+import { execFile } from "node:child_process";
+import { SponsonError } from "@sponson/core";
+import { apiClient, isProviderError } from "./http.js";
+/**
+ * Runs the real binary from PATH; rejects with its stderr when it fails. A binary that cannot be started keeps the
+ * system error's `code` (`ENOENT`, `EACCES`), so the caller can say what is wrong instead of echoing it.
+ */
+export const defaultExec = (file, args, env) => new Promise((resolve, reject) => {
+    execFile(file, args, { env, maxBuffer: 1024 * 1024 }, (err, stdout, stderr) => {
+        if (!err)
+            return resolve(stdout);
+        const spawnCode = typeof err.code === "string" ? err.code : undefined;
+        const failure = new Error(`${file} ${args[0] ?? ""} failed: ${String(stderr || err.message).trim()}`);
+        if (spawnCode)
+            failure.code = spawnCode;
+        reject(failure);
+    });
+});
+/**
+ * The one shape of every SECRET_UNRESOLVED a built-in source throws: the reason only. The engine prefixes the
+ * reference when it reports the line (`aws-sm://x: <reason>`), so the message never names the ref twice; the ref is
+ * in `details.ref` for callers that use a source directly. Never put the value, or any part of it, in `why`.
+ */
+function unresolved(ref, why, details = {}) {
+    return new SponsonError("SECRET_UNRESOLVED", why, { ref, ...details });
+}
+function stripScheme(ref, scheme) {
+    const prefix = `${scheme}://`;
+    if (!ref.startsWith(prefix))
+        throw unresolved(ref, `expected ${prefix}…`);
+    return ref.slice(prefix.length);
+}
+/** CLIs end their output with one newline (LF or CRLF); the secret is what comes before it. */
+function stripTrailingNewline(out) {
+    return out.replace(/(\r\n|\n|\r)$/, "");
+}
+/**
+ * Run a secret CLI; any failure is SECRET_UNRESOLVED. Every CLI-backed source goes through here, so a missing binary
+ * reads the same for all of them ("the `aws` CLI is not installed or not on PATH"), and any other failure (not signed
+ * in, unknown item) carries the CLI's own error text, which never contains the value it failed to read.
+ *
+ * `fromRef` lists every argument taken from the reference. A plan is reviewed as data, so none of them may read as an
+ * option to the CLI: one starting with `-` is refused before anything runs.
+ */
+async function runCli(exec, ref, file, args, env, fromRef) {
+    const flag = fromRef.find((a) => a.startsWith("-"));
+    if (flag !== undefined)
+        throw unresolved(ref, `a reference segment may not start with "-" (it would reach the \`${file}\` CLI as an option)`);
+    try {
+        return stripTrailingNewline(await exec(file, args, env));
+    }
+    catch (e) {
+        const code = e.code;
+        if (code === "ENOENT")
+            throw unresolved(ref, `the \`${file}\` CLI is not installed or not on PATH`);
+        if (code === "EACCES")
+            throw unresolved(ref, `the \`${file}\` CLI on PATH is not executable`);
+        throw unresolved(ref, e.message);
+    }
+}
+/** `env://NAME` → process environment. Zero configuration; the CI default. */
+export const envSecretSource = {
+    scheme: "env",
+    form: "`env://NAME`",
+    resolvedBy: "the process environment; unset or empty is `SECRET_UNRESOLVED`",
+    async resolve(ref, env) {
+        const name = stripScheme(ref, "env");
+        const v = env[name];
+        if (v === undefined || v === "")
+            throw unresolved(ref, `environment variable ${name} is not set`, { variable: name });
+        return v;
+    },
+};
+/** `doppler://project/config/NAME` → `doppler secrets get`. Uses the CLI's login or DOPPLER_TOKEN from the env. */
+export function dopplerSecretSource(exec = defaultExec) {
+    return {
+        scheme: "doppler",
+        form: "`doppler://project/config/NAME`",
+        resolvedBy: "`doppler secrets get NAME --project project --config config --plain` (Doppler CLI)",
+        async resolve(ref, env) {
+            const parts = stripScheme(ref, "doppler").split("/");
+            if (parts.length !== 3 || parts.some((p) => p === ""))
+                throw unresolved(ref, "expected doppler://project/config/NAME");
+            const [project, config, name] = parts;
+            return runCli(exec, ref, "doppler", ["secrets", "get", name, "--project", project, "--config", config, "--plain"], env, [name, project, config]);
+        },
+    };
+}
+/** `op://vault/item/field` → `op read`, which accepts the reference as-is. */
+export function opSecretSource(exec = defaultExec) {
+    return {
+        scheme: "op",
+        form: "`op://vault/item/field`",
+        resolvedBy: "`op read op://vault/item/field --no-newline` (1Password CLI)",
+        async resolve(ref, env) {
+            const path = stripScheme(ref, "op");
+            if (path.split("/").length < 3)
+                throw unresolved(ref, "expected op://vault/item/field");
+            // The reference is passed whole and always starts with `op://`, so it can never read as an option.
+            return runCli(exec, ref, "op", ["read", ref, "--no-newline"], env, [ref]);
+        },
+    };
+}
+/**
+ * `aws-sm://<secret-id>` → `aws secretsmanager get-secret-value`, through the `aws` CLI so the AWS SDK stays out of
+ * the dependency tree. The secret id is a name or an ARN; region, profile and credentials come from the CLI's own
+ * conventions (`AWS_REGION`, `AWS_PROFILE`, ...). `aws-sm://<secret-id>#<key>` picks one key of a JSON secret, the
+ * shape the AWS console creates for key/value secrets.
+ */
+export function awsSecretsManagerSource(exec = defaultExec) {
+    return {
+        scheme: "aws-sm",
+        form: "`aws-sm://secret-id` or `aws-sm://secret-id#KEY`",
+        resolvedBy: "`aws secretsmanager get-secret-value --secret-id secret-id --query SecretString --output json` (AWS CLI; region and credentials from `AWS_REGION`, `AWS_PROFILE` and the CLI's other conventions). `secret-id` is a name or an ARN; `#KEY` picks one key of a JSON key/value secret. Binary secrets are not supported.",
+        async resolve(ref, env) {
+            const path = stripScheme(ref, "aws-sm");
+            const hash = path.indexOf("#");
+            const id = hash < 0 ? path : path.slice(0, hash);
+            const key = hash < 0 ? undefined : path.slice(hash + 1);
+            if (id === "" || key === "")
+                throw unresolved(ref, "expected aws-sm://<secret-id> or aws-sm://<secret-id>#<key>");
+            // JSON output, not text: text prints a binary secret's missing SecretString as the word "None".
+            const out = await runCli(exec, ref, "aws", ["secretsmanager", "get-secret-value", "--secret-id", id, "--query", "SecretString", "--output", "json"], env, [id]);
+            const value = parseJson(out);
+            if (typeof value !== "string")
+                throw unresolved(ref, "the secret has no string value (binary secrets are not supported)");
+            if (key === undefined)
+                return value;
+            // Never echo the secret (or a fragment of it) in these messages: they end up in the receipt.
+            const fields = parseJson(value);
+            if (typeof fields !== "object" || fields === null || Array.isArray(fields))
+                throw unresolved(ref, `#${key} needs a JSON object secret, and this one is not`);
+            const picked = fields[key];
+            if (picked === undefined)
+                throw unresolved(ref, `the secret has no key ${key}`);
+            if (typeof picked !== "string" && typeof picked !== "number" && typeof picked !== "boolean")
+                throw unresolved(ref, `key ${key} is not a string, number or boolean`);
+            return String(picked);
+        },
+    };
+}
+const GCP_SM_FORM = "expected gcp-sm://<project>/<secret> or gcp-sm://<project>/<secret>/<version>";
+/** Project ids (including domain-scoped `example.com:proj`) and project numbers; no leading `-`, so never a flag. */
+const GCP_PROJECT = /^[a-z0-9][a-z0-9.:-]*$/;
+/** Secret Manager's own rule for secret ids. */
+const GCP_SECRET = /^[A-Za-z0-9_-]{1,255}$/;
+const GCP_VERSION = /^(latest|[1-9][0-9]*)$/;
+/**
+ * `gcp-sm://<project>/<secret>[/<version>]` → `gcloud secrets versions access`, through the `gcloud` CLI so the Google
+ * SDK stays out of the dependency tree. The version defaults to `latest`; credentials come from the CLI's own
+ * conventions (`gcloud auth`, `CLOUDSDK_*`, `GOOGLE_APPLICATION_CREDENTIALS`). The project is part of the reference
+ * so a plan never depends on whichever project the runner's gcloud happens to have configured.
+ */
+export function gcpSecretManagerSource(exec = defaultExec) {
+    return {
+        scheme: "gcp-sm",
+        form: "`gcp-sm://project/secret` or `gcp-sm://project/secret/version`",
+        resolvedBy: "`gcloud secrets versions access version --secret=secret --project=project --format=json` (Google Cloud CLI; credentials from `gcloud auth` and the CLI's other conventions). `version` is a number or `latest` (the default). The payload must be UTF-8 text.",
+        async resolve(ref, env) {
+            const parts = stripScheme(ref, "gcp-sm").split("/");
+            if (parts.length < 2 || parts.length > 3)
+                throw unresolved(ref, GCP_SM_FORM);
+            const [project, secret, version = "latest"] = parts;
+            if (!GCP_PROJECT.test(project) || !GCP_SECRET.test(secret) || !GCP_VERSION.test(version))
+                throw unresolved(ref, GCP_SM_FORM);
+            // JSON, not the default raw output: the payload arrives base64-encoded, so a value ending in a newline survives
+            // and a binary payload is recognised instead of being passed on as mangled text.
+            const out = await runCli(exec, ref, "gcloud", ["secrets", "versions", "access", version, `--secret=${secret}`, `--project=${project}`, "--format=json"], env, [version, secret, project]);
+            const response = parseJson(out);
+            const data = isRecord(response) && isRecord(response.payload) ? response.payload.data : undefined;
+            if (typeof data !== "string")
+                throw unresolved(ref, "gcloud returned no payload");
+            // Never echo the payload (or a fragment of it) in these messages: they end up in the receipt.
+            let value;
+            try {
+                value = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.from(data, "base64"));
+            }
+            catch {
+                throw unresolved(ref, "the secret is not UTF-8 text (binary secrets are not supported)");
+            }
+            if (value === "")
+                throw unresolved(ref, "the secret is empty");
+            return value;
+        },
+    };
+}
+const INFISICAL_FORM = "expected infisical://<projectId>/<env>/<NAME> or infisical://<projectId>/<env>/<folder>/…/<NAME>";
+/**
+ * What `infisical secrets get` prints for a name the folder does not hold, in place of a value (Infisical CLI,
+ * packages/cmd/secrets.go `getSecretsByNames`). It exits 0 with it, so it must be recognised here, never passed on.
+ */
+const INFISICAL_NOT_FOUND = "*not found*";
+/**
+ * `infisical://<projectId>/<env>/[<folder>/…/]<NAME>` → `infisical secrets get`, through the Infisical CLI
+ * (https://infisical.com/docs/cli/commands/secrets). The folders become `--path` (default `/`). Credentials come
+ * from the CLI's own conventions: `INFISICAL_TOKEN` (or `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`) for a machine
+ * identity, else the CLI's login; `INFISICAL_DOMAIN` for EU Cloud or a self-hosted instance. The project id is part of
+ * the reference because a machine identity has no `.infisical.json` to take it from.
+ *
+ * JSON output, not `--plain`: with `--plain` an unknown name prints nothing at all (exit 0), indistinguishable from
+ * an empty secret; with `--output json` it prints the entry with the value `*not found*`, which is refused here.
+ */
+export function infisicalSecretSource(exec = defaultExec) {
+    return {
+        scheme: "infisical",
+        form: "`infisical://projectId/env/NAME` or `infisical://projectId/env/folder/…/NAME`",
+        resolvedBy: "`infisical secrets get NAME --projectId projectId --env env --path /folder/… --output json --silent` (Infisical CLI; credentials from `INFISICAL_TOKEN` or the CLI's login, the instance from `INFISICAL_DOMAIN`). A name the folder does not hold is `SECRET_UNRESOLVED`, never a value.",
+        async resolve(ref, env) {
+            const parts = stripScheme(ref, "infisical").split("/");
+            if (parts.length < 3 || parts.some((p) => p === ""))
+                throw unresolved(ref, INFISICAL_FORM);
+            const [projectId, environment, ...rest] = parts;
+            const name = rest.pop();
+            const path = `/${rest.join("/")}`;
+            const args = ["secrets", "get", name, "--projectId", projectId, "--env", environment, "--path", path, "--output", "json", "--silent"];
+            const out = await runCli(exec, ref, "infisical", args, env, [name, projectId, environment, ...rest]);
+            // Never echo the output (or a fragment of it) in these messages: it holds the value.
+            const entries = parseJson(out);
+            const entry = Array.isArray(entries) ? entries.find((e) => isRecord(e) && e.secretKey === name) : undefined;
+            const value = isRecord(entry) ? entry.secretValue : undefined;
+            if (entry === undefined || value === INFISICAL_NOT_FOUND)
+                throw unresolved(ref, `no secret ${name} in environment ${environment} at ${path}`);
+            if (typeof value !== "string")
+                throw unresolved(ref, "the Infisical CLI returned no value");
+            return value;
+        },
+    };
+}
+const AZURE_KV_FORM = "expected azure-kv://<vault>/<name> or azure-kv://<vault>/<name>/<version>";
+/** Key Vault's own rules: vault names 3-24 of 0-9 a-z A-Z and non-consecutive `-`; secret names 1-127 of 0-9 a-z A-Z `-`; versions 32 characters. */
+const AZURE_VAULT = /^(?!.*--)[A-Za-z0-9-]{3,24}$/;
+const AZURE_SECRET = /^[A-Za-z0-9-]{1,127}$/;
+const AZURE_VERSION = /^[A-Za-z0-9]{32}$/;
+/**
+ * `azure-kv://<vault>/<name>[/<version>]` → `az keyvault secret show`, through the Azure CLI so neither the Azure SDK
+ * nor an Entra ID token flow enters the dependency tree. The CLI rather than `GET {vault}/secrets/{name}` with a token
+ * from `az account get-access-token`: one process instead of two, and the CLI already knows the vault DNS suffix of
+ * the signed-in cloud (`vault.azure.net`, `vault.azure.cn`, `vault.usgovcloudapi.net`) and every way to sign in
+ * (`az login`, a service principal, a managed identity, federated CI credentials).
+ * https://learn.microsoft.com/en-us/cli/azure/keyvault/secret#az-keyvault-secret-show
+ */
+export function azureKeyVaultSource(exec = defaultExec) {
+    return {
+        scheme: "azure-kv",
+        form: "`azure-kv://vault/name` or `azure-kv://vault/name/version`",
+        resolvedBy: "`az keyvault secret show --vault-name vault --name name [--version version] --query value --output json` (Azure CLI; credentials and cloud from `az login` and the CLI's other conventions). The version defaults to the latest.",
+        async resolve(ref, env) {
+            const parts = stripScheme(ref, "azure-kv").split("/");
+            if (parts.length < 2 || parts.length > 3)
+                throw unresolved(ref, AZURE_KV_FORM);
+            const [vault, name, version] = parts;
+            if (!AZURE_VAULT.test(vault) || !AZURE_SECRET.test(name) || (version !== undefined && !AZURE_VERSION.test(version)))
+                throw unresolved(ref, AZURE_KV_FORM);
+            const pinned = version === undefined ? [] : [version];
+            // JSON, not `-o tsv`: tsv cannot tell a value's own trailing newline from the one the CLI ends its output with.
+            const args = ["keyvault", "secret", "show", "--vault-name", vault, "--name", name, ...pinned.flatMap((v) => ["--version", v]), "--query", "value", "--output", "json"];
+            const value = parseJson(await runCli(exec, ref, "az", args, env, [vault, name, ...pinned]));
+            if (typeof value !== "string")
+                throw unresolved(ref, "the secret has no value");
+            return value;
+        },
+    };
+}
+/** Bitwarden secret ids are UUIDs (`bws secret get` parses its argument as one). */
+const BWS_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * `bws://<secret-id>` → `bws secret get`, through the Bitwarden Secrets Manager CLI
+ * (https://bitwarden.com/help/secrets-manager-cli/). The machine account's access token comes from
+ * `BWS_ACCESS_TOKEN`, a self-hosted server from `BWS_SERVER_URL` (both read by the CLI itself: crates/bws/src/cli.rs
+ * in bitwarden/sdk-sm). `--color no`: the CLI colours its JSON whenever it believes the terminal supports colour,
+ * which `FORCE_COLOR` in CI makes it believe.
+ */
+export function bitwardenSecretsManagerSource(exec = defaultExec) {
+    return {
+        scheme: "bws",
+        form: "`bws://secret-id`",
+        resolvedBy: "`bws secret get secret-id --output json --color no` (Bitwarden Secrets Manager CLI; the machine account's token from `BWS_ACCESS_TOKEN`, a self-hosted server from `BWS_SERVER_URL`). `secret-id` is the secret's UUID.",
+        async resolve(ref, env) {
+            const id = stripScheme(ref, "bws");
+            if (!BWS_ID.test(id))
+                throw unresolved(ref, "expected bws://<secret-id>, the secret's UUID");
+            const response = parseJson(await runCli(exec, ref, "bws", ["secret", "get", id, "--output", "json", "--color", "no"], env, [id]));
+            // Never echo the response (or a fragment of it) in these messages: it holds the value.
+            const value = isRecord(response) ? response.value : undefined;
+            if (typeof value !== "string")
+                throw unresolved(ref, "the Bitwarden CLI returned no value");
+            return value;
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// HTTP-backed sources: HashiCorp Vault, 1Password Connect
+// ---------------------------------------------------------------------------
+/** A variable the source cannot work without; unset or empty is SECRET_UNRESOLVED naming it. */
+function requiredVar(ref, env, name) {
+    const v = env[name];
+    if (v === undefined || v === "")
+        throw unresolved(ref, `${name} is not set`, { variable: name });
+    return v;
+}
+/** A server address from the environment: an absolute http(s) URL. */
+function requiredUrl(ref, env, name) {
+    const v = requiredVar(ref, env, name);
+    let url;
+    try {
+        url = new URL(v);
+    }
+    catch {
+        url = undefined;
+    }
+    if (url?.protocol !== "http:" && url?.protocol !== "https:")
+        throw unresolved(ref, `${name} is not an http(s) URL`, { variable: name });
+    return v;
+}
+/**
+ * The adapters' HTTP client for a secret service: its timeout (SPONSON_HTTP_TIMEOUT_MS), its retries of a 5xx or a
+ * dropped connection (SPONSON_HTTP_RETRIES), and the token masked in any error text it builds.
+ */
+function secretClient(service, baseUrl, token, authHeader, headers, env) {
+    return apiClient({ adapter: service, baseUrl, token, authHeader, headers, env, redact: (s) => s.split(token).join("***") });
+}
+/**
+ * GET a path; any failure is SECRET_UNRESOLVED. A 404 reads as `notFound`. An answer that is not JSON is reported
+ * without its text, which is where the value would be; every other failure keeps the client's message (method,
+ * path, status and the service's own error, which never holds the value; the token is masked).
+ */
+async function httpRead(ref, api, path, notFound) {
+    try {
+        return await api.get(path);
+    }
+    catch (e) {
+        if (isProviderError(e, "PROVIDER_NOT_FOUND"))
+            throw unresolved(ref, notFound, { status: 404 });
+        if (isProviderError(e, "PROVIDER_RESPONSE"))
+            throw unresolved(ref, `${api.adapter}: GET ${path} answered with something that is not JSON`);
+        if (isProviderError(e))
+            throw unresolved(ref, e.message, e.details.status === undefined ? {} : { status: e.details.status });
+        throw unresolved(ref, e.message);
+    }
+}
+const VAULT_FORM = "expected vault://<mount>/<path>#<key>";
+/** `vault://<mount>/<path>#<key>`, split; `.` and `..` segments are refused so a reference cannot climb out of the mount. */
+function vaultRef(ref) {
+    const body = stripScheme(ref, "vault");
+    const hash = body.indexOf("#");
+    const segments = (hash < 0 ? body : body.slice(0, hash)).split("/");
+    const key = hash < 0 ? "" : body.slice(hash + 1);
+    if (key === "" || segments.length < 2 || segments.some((s) => s === "" || s === "." || s === ".."))
+        throw unresolved(ref, VAULT_FORM);
+    const [mount, ...path] = segments;
+    return { mount, path, key };
+}
+/**
+ * `vault://<mount>/<path>#<key>` → HashiCorp Vault's KV v2 "read secret version", `GET /v1/<mount>/data/<path>`
+ * (https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2), over the adapters' HTTP client, no SDK. The
+ * address is `VAULT_ADDR`, the token `VAULT_TOKEN` (sent as `X-Vault-Token`), and `VAULT_NAMESPACE`, when set, is
+ * sent as `X-Vault-Namespace` (Vault Enterprise, HCP Vault Dedicated: https://developer.hashicorp.com/vault/api-docs).
+ * The mount is the first segment; the latest version is read. `#key` picks one key of the secret's map.
+ */
+export const vaultSecretSource = {
+    scheme: "vault",
+    form: "`vault://mount/path#KEY`",
+    resolvedBy: "HashiCorp Vault KV v2, `GET $VAULT_ADDR/v1/mount/data/path` with `X-Vault-Token: $VAULT_TOKEN` (and `X-Vault-Namespace: $VAULT_NAMESPACE` when set); the latest version's `KEY`. The mount is the first segment.",
+    async resolve(ref, env) {
+        const { mount, path, key } = vaultRef(ref);
+        const addr = requiredUrl(ref, env, "VAULT_ADDR");
+        const token = requiredVar(ref, env, "VAULT_TOKEN");
+        const namespace = env.VAULT_NAMESPACE;
+        const api = secretClient("vault", addr, token, "header:X-Vault-Token", namespace ? { "X-Vault-Namespace": namespace } : {}, env);
+        const url = `/v1/${encodeURIComponent(mount)}/data/${path.map(encodeURIComponent).join("/")}`;
+        const where = `${mount}/${path.join("/")}`;
+        // Vault answers 404 both for a path that does not exist and for one the token may not see.
+        const body = await httpRead(ref, api, url, `no secret at ${where} (or the token may not read it; a KV v1 mount is not supported)`);
+        // Never echo the body (or a fragment of it) in these messages: it holds the values.
+        const data = isRecord(body) && isRecord(body.data) ? body.data.data : undefined;
+        if (!isRecord(data))
+            throw unresolved(ref, `the latest version of ${where} is deleted or destroyed, or the answer is not a KV v2 secret`);
+        return scalarField(ref, data, key, where);
+    },
+};
+/** One key of a secret's map as a string; numbers and booleans are written as JSON writes them. */
+function scalarField(ref, fields, key, where) {
+    const v = fields[key];
+    if (v === undefined)
+        throw unresolved(ref, `${where} has no key ${key}`);
+    if (typeof v !== "string" && typeof v !== "number" && typeof v !== "boolean")
+        throw unresolved(ref, `key ${key} of ${where} is not a string, number or boolean`);
+    return String(v);
+}
+const OP_CONNECT_FORM = "expected op-connect://<vault>/<item>/<field> or op-connect://<vault>/<item>/<section>/<field>";
+/** Vault and item ids as Connect shows them (`ytrfte14kw1uex5txaore1emkz`); anything else is looked up by name. */
+const OP_ID = /^[a-z0-9]{26}$/;
+function opConnectRef(ref) {
+    const parts = stripScheme(ref, "op-connect").split("/");
+    if (parts.length < 3 || parts.length > 4 || parts.some((p) => p === ""))
+        throw unresolved(ref, OP_CONNECT_FORM);
+    const [vault, item] = parts;
+    return parts.length === 4 ? { vault, item, section: parts[2], field: parts[3] } : { vault, item, field: parts[2] };
+}
+/** A filter value in Connect's SCIM-style `filter` (`name eq "Demo Vault"`), quotes and backslashes escaped. */
+function scimString(s) {
+    return `"${s.replace(/[\\"]/g, (c) => `\\${c}`)}"`;
+}
+/**
+ * The id of the one vault (`attr` = `name`) or item (`title`) called `name`. The filter narrows the list; the exact
+ * comparison here decides, so a server that ignored the filter would not change the answer.
+ */
+async function opConnectFind(ref, api, list, attr, name, what) {
+    const body = await httpRead(ref, api, `${list}?filter=${encodeURIComponent(`${attr} eq ${scimString(name)}`)}`, `no ${what} named ${name}`);
+    const found = (Array.isArray(body) ? body : []).filter((e) => isRecord(e) && e[attr] === name && typeof e.id === "string");
+    if (found.length === 0)
+        throw unresolved(ref, `no ${what} named ${name}`);
+    if (found.length > 1)
+        throw unresolved(ref, `${found.length} ${what}s are named ${name}; use the id instead`);
+    return found[0].id;
+}
+/** The fields of an item's section, matched by the section's id or label. */
+function inSection(ref, item, fields, section) {
+    const sections = (Array.isArray(item.sections) ? item.sections : []).filter(isRecord);
+    const ids = new Set(sections.filter((s) => s.id === section || s.label === section).map((s) => s.id));
+    if (ids.size === 0)
+        throw unresolved(ref, `the item has no section ${section}`);
+    return fields.filter((f) => isRecord(f.section) && ids.has(f.section.id));
+}
+/** The value of the one field matched by id, else by label, as `op read` matches them. */
+function opConnectField(ref, item, r) {
+    if (!isRecord(item) || !Array.isArray(item.fields))
+        throw unresolved(ref, "the item has no fields");
+    let fields = item.fields.filter(isRecord);
+    if (r.section !== undefined)
+        fields = inSection(ref, item, fields, r.section);
+    const byId = fields.filter((f) => f.id === r.field);
+    const matches = byId.length > 0 ? byId : fields.filter((f) => f.label === r.field);
+    if (matches.length === 0)
+        throw unresolved(ref, `the item has no field ${r.field}`);
+    if (matches.length > 1)
+        throw unresolved(ref, `${matches.length} fields of the item are labelled ${r.field}; name its section or use the field id`);
+    // Never echo the value (or a fragment of it) in these messages.
+    const value = matches[0].value;
+    if (typeof value !== "string" || value === "")
+        throw unresolved(ref, `field ${r.field} has no value`);
+    return value;
+}
+/**
+ * `op-connect://<vault>/<item>/[<section>/]<field>` → a 1Password Connect server's REST API
+ * (https://www.1password.dev/connect/api-reference/): `GET /v1/vaults/{vault}/items/{item}`, bearer
+ * `OP_CONNECT_TOKEN`, at `OP_CONNECT_HOST` (the variables 1Password's own Connect SDKs and `op` read). Vaults and
+ * items are named by id or by name / title (looked up with `GET /v1/vaults?filter=name eq "…"` and
+ * `GET /v1/vaults/{vault}/items?filter=title eq "…"`; a name must be unique); fields by id or label.
+ */
+export const opConnectSecretSource = {
+    scheme: "op-connect",
+    form: "`op-connect://vault/item/field` or `op-connect://vault/item/section/field`",
+    resolvedBy: "a 1Password Connect server, `GET $OP_CONNECT_HOST/v1/vaults/vault/items/item` with `Authorization: Bearer $OP_CONNECT_TOKEN`. `vault` and `item` are ids or unique names (looked up with `?filter=`); `section` and `field` are ids or labels.",
+    async resolve(ref, env) {
+        const r = opConnectRef(ref);
+        const host = requiredUrl(ref, env, "OP_CONNECT_HOST");
+        const api = secretClient("1password-connect", host, requiredVar(ref, env, "OP_CONNECT_TOKEN"), "bearer", {}, env);
+        const vaultId = OP_ID.test(r.vault) ? r.vault : await opConnectFind(ref, api, "/v1/vaults", "name", r.vault, "vault");
+        const itemId = OP_ID.test(r.item) ? r.item : await opConnectFind(ref, api, `/v1/vaults/${vaultId}/items`, "title", r.item, "item");
+        const item = await httpRead(ref, api, `/v1/vaults/${vaultId}/items/${itemId}`, `no item ${r.item} in vault ${r.vault} (or the token may not read it)`);
+        return opConnectField(ref, item, r);
+    },
+};
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAqB,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAyC,MAAM,WAAW,CAAC;AAK9F;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CACnD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QAC5E,IAAI,CAAC,GAAG;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAA0B,CAAC;QAC/H,IAAI,SAAS;YAAE,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,GAAW,EAAE,UAAmC,EAAE;IACjF,OAAO,IAAI,YAAY,CAAC,mBAAmB,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,MAAc;IAC9C,MAAM,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,YAAY,MAAM,GAAG,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,+FAA+F;AAC/F,SAAS,oBAAoB,CAAC,GAAW;IACvC,OAAO,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,MAAM,CAAC,IAAU,EAAE,GAAW,EAAE,IAAY,EAAE,IAAc,EAAE,GAAsB,EAAE,OAAiB;IACpH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,oEAAoE,IAAI,sBAAsB,CAAC,CAAC;IAC9I,IAAI,CAAC;QACH,OAAO,oBAAoB,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,UAAU,CAAC,GAAG,EAAE,SAAS,IAAI,wCAAwC,CAAC,CAAC;QACpG,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,UAAU,CAAC,GAAG,EAAE,SAAS,IAAI,kCAAkC,CAAC,CAAC;QAC9F,MAAM,UAAU,CAAC,GAAG,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAiB;IAC3C,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,cAAc;IACpB,UAAU,EAAE,gEAAgE;IAC5E,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;QACpB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;YAAE,MAAM,UAAU,CAAC,GAAG,EAAE,wBAAwB,IAAI,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtH,OAAO,CAAC,CAAC;IACX,CAAC;CACF,CAAC;AAEF,mHAAmH;AACnH,MAAM,UAAU,mBAAmB,CAAC,OAAa,WAAW;IAC1D,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,IAAI,EAAE,iCAAiC;QACvC,UAAU,EAAE,oFAAoF;QAChG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;YACvH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,KAAiC,CAAC;YAClE,OAAO,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACnJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,OAAa,WAAW;IACrD,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,yBAAyB;QAC/B,UAAU,EAAE,8DAA8D;QAC1E,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;YACxF,mGAAmG;YACnG,OAAO,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAa,WAAW;IAC9D,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,kDAAkD;QACxD,UAAU,EACR,wTAAwT;QAC1T,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YACxD,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,KAAK,EAAE;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,6DAA6D,CAAC,CAAC;YAClH,gGAAgG;YAChG,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,aAAa,EAAE,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAChK,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,mEAAmE,CAAC,CAAC;YAC1H,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACpC,6FAA6F;YAC7F,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,GAAG,kDAAkD,CAAC,CAAC;YAC7J,MAAM,MAAM,GAAI,MAAkC,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,yBAAyB,GAAG,EAAE,CAAC,CAAC;YAChF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,SAAS;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,qCAAqC,CAAC,CAAC;YACpK,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAG,+EAA+E,CAAC;AACpG,qHAAqH;AACrH,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAC7C,gDAAgD;AAChD,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAC5C,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAa,WAAW;IAC7D,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,gEAAgE;QACtE,UAAU,EACR,+PAA+P;QACjQ,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC7E,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,KAAkC,CAAC;YACjF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC7H,gHAAgH;YAChH,iFAAiF;YACjF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,MAAM,EAAE,EAAE,aAAa,OAAO,EAAE,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1L,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;YAClF,8FAA8F;YAC9F,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACxF,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,UAAU,CAAC,GAAG,EAAE,iEAAiE,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,KAAK,KAAK,EAAE;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,kGAAkG,CAAC;AAC1H;;;GAGG;AACH,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAE1C;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAa,WAAW;IAC5D,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,+EAA+E;QACrF,UAAU,EACR,2RAA2R;QAC7R,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAC3F,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,GAAG,KAAsC,CAAC;YACjF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAY,CAAC;YAClC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YACtI,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;YACrG,qFAAqF;YACrF,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3H,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,mBAAmB;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,aAAa,IAAI,mBAAmB,WAAW,OAAO,IAAI,EAAE,CAAC,CAAC;YAC9I,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;YAC5F,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,2EAA2E,CAAC;AAClG,qJAAqJ;AACrJ,MAAM,WAAW,GAAG,8BAA8B,CAAC;AACnD,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAC7C,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAa,WAAW;IAC1D,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,4DAA4D;QAClE,UAAU,EACR,kOAAkO;QACpO,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YAC/E,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,KAAkC,CAAC;YAClE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YAC1J,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACtD,gHAAgH;YAChH,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACvK,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YAC5F,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAChF,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,MAAM,GAAG,iEAAiE,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAa,WAAW;IACpE,OAAO;QACL,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,mBAAmB;QACzB,UAAU,EACR,yNAAyN;QAC3N,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,+CAA+C,CAAC,CAAC;YAC7F,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClI,uFAAuF;YACvF,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;YAC5F,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E,gGAAgG;AAChG,SAAS,WAAW,CAAC,GAAW,EAAE,GAAsB,EAAE,IAAY;IACpE,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,OAAO,CAAC,CAAC;AACX,CAAC;AAED,sEAAsE;AACtE,SAAS,WAAW,CAAC,GAAW,EAAE,GAAsB,EAAE,IAAY;IACpE,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,GAAoB,CAAC;IACzB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,EAAE,QAAQ,KAAK,OAAO,IAAI,GAAG,EAAE,QAAQ,KAAK,QAAQ;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,wBAAwB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACxI,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,OAAe,EAAE,OAAe,EAAE,KAAa,EAAE,UAA0C,EAAE,OAA+B,EAAE,GAAsB;IACxK,OAAO,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC9H,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,GAAc,EAAE,IAAY,EAAE,QAAgB;IACjF,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,eAAe,CAAC,CAAC,EAAE,oBAAoB,CAAC;YAAE,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/F,IAAI,eAAe,CAAC,CAAC,EAAE,mBAAmB,CAAC;YAAE,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,SAAS,IAAI,2CAA2C,CAAC,CAAC;QAC3I,IAAI,eAAe,CAAC,CAAC,CAAC;YAAE,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7H,MAAM,UAAU,CAAC,GAAG,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAAG,uCAAuC,CAAC;AAE3D,6HAA6H;AAC7H,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACjD,IAAI,GAAG,KAAK,EAAE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACtI,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,QAAiC,CAAC;IAC3D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAiB;IAC7C,MAAM,EAAE,OAAO;IACf,IAAI,EAAE,0BAA0B;IAChC,UAAU,EACR,kNAAkN;IACpN,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;QACpB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,GAAG,CAAC,eAAe,CAAC;QACtC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,sBAAsB,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACjI,MAAM,GAAG,GAAG,OAAO,kBAAkB,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9F,MAAM,KAAK,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,2FAA2F;QAC3F,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,KAAK,iEAAiE,CAAC,CAAC;QACnI,oFAAoF;QACpF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,UAAU,CAAC,GAAG,EAAE,yBAAyB,KAAK,+DAA+D,CAAC,CAAC;QAC1I,OAAO,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;CACF,CAAC;AAEF,mGAAmG;AACnG,SAAS,WAAW,CAAC,GAAW,EAAE,MAA+B,EAAE,GAAW,EAAE,KAAa;IAC3F,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK,SAAS;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,eAAe,GAAG,EAAE,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,KAAK,qCAAqC,CAAC,CAAC;IACjK,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,eAAe,GAAG,+FAA+F,CAAC;AACxH,mHAAmH;AACnH,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAS/B,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAChH,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,KAAyB,CAAC;IAChD,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,CAAC;AACnJ,CAAC;AAED,gHAAgH;AAChH,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,GAAc,EAAE,IAAY,EAAE,IAAsB,EAAE,IAAY,EAAE,IAAY;IACxH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,WAAW,kBAAkB,CAAC,GAAG,IAAI,OAAO,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,UAAU,IAAI,EAAE,CAAC,CAAC;IAC5I,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAgC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;IACxK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,IAAI,UAAU,IAAI,EAAE,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,IAAI,sBAAsB,CAAC,CAAC;IAC9G,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC,EAAY,CAAC;AAChC,CAAC;AAED,6EAA6E;AAC7E,SAAS,SAAS,CAAC,GAAW,EAAE,IAA6B,EAAE,MAAsC,EAAE,OAAe;IACpH,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,QAAsB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtG,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,2BAA2B,OAAO,EAAE,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,0FAA0F;AAC1F,SAAS,cAAc,CAAC,GAAW,EAAE,IAAa,EAAE,CAAe;IACjE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACpG,IAAI,MAAM,GAAI,IAAI,CAAC,MAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,oCAAoC,CAAC,CAAC,KAAK,wCAAwC,CAAC,CAAC;IACpJ,gEAAgE;IAChE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC;IACtG,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAiB;IACjD,MAAM,EAAE,YAAY;IACpB,IAAI,EAAE,4EAA4E;IAClF,UAAU,EACR,gPAAgP;IAClP,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;QACpB,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAClH,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtH,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,OAAO,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnI,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,OAAO,UAAU,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,KAAK,iCAAiC,CAAC,CAAC;QACvJ,OAAO,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC;CACF,CAAC;AAEF,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/sigv4.d.ts

@@ -0,0 +1,56 @@
+/** The credentials a request is signed with. The secret never leaves this module except as an HMAC. */
+export interface SigV4Credentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    /** Temporary credentials (STS) also send their session token, as `X-Amz-Security-Token`. */
+    sessionToken?: string;
+}
+/** One request to sign: everything the signature covers. */
+export interface SigV4Request {
+    method: string;
+    /** The absolute URL as it will be sent (path already percent-encoded, query included). */
+    url: string;
+    /** Headers that will be sent (lower-case names); every one of them is signed. */
+    headers: Record<string, string>;
+    /** The body exactly as sent; empty when there is none. */
+    body: string;
+}
+/** Where and how to sign. */
+export interface SigV4Scope {
+    region: string;
+    service: string;
+    /** The signing time; `X-Amz-Date` is derived from it. */
+    date: Date;
+    /**
+     * Send and sign `X-Amz-Content-Sha256` (S3 requires it; other services accept it). Default true; AWS's generic
+     * test suite signs without it.
+     */
+    contentSha256Header?: boolean;
+}
+/** RFC 3986 encoding as SigV4 wants it: unreserved characters as they are, every other UTF-8 byte as `%XX`. */
+export declare function uriEncode(s: string): string;
+/**
+ * The canonical URI: each path segment encoded once (S3) or twice (every other service, as the AWS docs require),
+ * starting from the path as sent.
+ */
+export declare function canonicalUri(pathname: string, service: string): string;
+/** The canonical query string: every parameter encoded, sorted by name then value; `?cors` is `cors=`. */
+export declare function canonicalQuery(search: string): string;
+/** `YYYYMMDDTHHMMSSZ` */
+export declare function amzDate(d: Date): string;
+/** The canonical request, and the signed-headers list it names. `headers` must include `host`. */
+export declare function canonicalRequest(req: SigV4Request, service: string): {
+    request: string;
+    signedHeaders: string;
+};
+/** `<date>/<region>/<service>/aws4_request` */
+export declare function credentialScope(scope: Pick<SigV4Scope, "region" | "service" | "date">): string;
+/** The string to sign for a canonical request. */
+export declare function stringToSign(canonical: string, scope: Pick<SigV4Scope, "region" | "service" | "date">): string;
+/** The hex signature of a string to sign. */
+export declare function signature(secretAccessKey: string, scope: Pick<SigV4Scope, "region" | "service" | "date">, toSign: string): string;
+/**
+ * Sign a request: the headers to add to it (`x-amz-date`, `x-amz-content-sha256`, `x-amz-security-token` when the
+ * credentials are temporary, and `authorization`). Every header of `req` is signed, plus `host` from the URL.
+ */
+export declare function signRequest(req: SigV4Request, creds: SigV4Credentials, scope: SigV4Scope): Record<string, string>;