@tangle-network/braid 0.1.0

package/dist/bin/production-connection-credential-cleanup.d.ts

@@ -0,0 +1,39 @@
+import type { ProductionConnectionOptions } from '../adapters/connections/production-connections.js';
+import type { BraidApplication } from '../app/application.js';
+import type { ConnectionRecord } from '../domain/entities.js';
+import type { CredentialPort } from '../ports/credentials.js';
+import { type ProductionConfigMutationLock } from './production-config-mutation-lock.js';
+import type { ProductionCredentialContext } from './production-credential-context.js';
+import { type ProductionCredentialMapping } from './production-credential-reference.js';
+interface CredentialRecoveryOptions {
+    readonly credentialStore?: CredentialPort;
+    readonly credentialContext?: ProductionCredentialContext;
+    readonly credentialRefResolver?: ProductionConnectionOptions['credentialRefResolver'];
+}
+export interface PreparedConnectionCredentialRemoval {
+    readonly commit: (app: BraidApplication) => Promise<void>;
+    readonly rollback: () => Promise<void>;
+}
+/** Completes deletion recorded before connection metadata was removed. */
+export declare function recoverPendingConnectionCredentialRemoval(configPath: string, options?: CredentialRecoveryOptions): Promise<void>;
+export declare function prepareUnsharedConnectionCredentialRemoval(input: {
+    readonly operationId: string;
+    readonly configPath: string;
+    readonly mutationLock: ProductionConfigMutationLock;
+    readonly credentialMapping: ProductionCredentialMapping;
+    readonly record: ConnectionRecord;
+    readonly remaining: readonly ConnectionRecord[];
+    readonly connectionOptions: ProductionConnectionOptions;
+}): Promise<PreparedConnectionCredentialRemoval>;
+export declare function removeUnsharedConnectionCredential(input: {
+    readonly app: BraidApplication;
+    readonly operationId: string;
+    readonly configPath: string;
+    readonly mutationLock: ProductionConfigMutationLock;
+    readonly credentialMapping: ProductionCredentialMapping;
+    readonly record: ConnectionRecord;
+    readonly remaining: readonly ConnectionRecord[];
+    readonly connectionOptions: ProductionConnectionOptions;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=production-connection-credential-cleanup.d.ts.map

package/dist/bin/production-connection-credential-cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-connection-credential-cleanup.d.ts","sourceRoot":"","sources":["../../src/bin/production-connection-credential-cleanup.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAA;AASpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAS7D,OAAO,EAEL,KAAK,4BAA4B,EAElC,MAAM,sCAAsC,CAAA;AAC7C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAA;AACrF,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,sCAAsC,CAAA;AAE7C,UAAU,yBAAyB;IACjC,QAAQ,CAAC,eAAe,CAAC,EAAE,cAAc,CAAA;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,2BAA2B,CAAA;IACxD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,2BAA2B,CAAC,uBAAuB,CAAC,CAAA;CACtF;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACvC;AAgDD,0EAA0E;AAC1E,wBAAsB,yCAAyC,CAC7D,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAsB,0CAA0C,CAAC,KAAK,EAAE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,4BAA4B,CAAA;IACnD,QAAQ,CAAC,iBAAiB,EAAE,2BAA2B,CAAA;IACvD,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC/C,QAAQ,CAAC,iBAAiB,EAAE,2BAA2B,CAAA;CACxD,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAyE/C;AAED,wBAAsB,kCAAkC,CAAC,KAAK,EAAE;IAC9D,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAA;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,4BAA4B,CAAA;IACnD,QAAQ,CAAC,iBAAiB,EAAE,2BAA2B,CAAA;IACvD,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC/C,QAAQ,CAAC,iBAAiB,EAAE,2BAA2B,CAAA;CACxD,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhB"}

package/dist/bin/production-connection-credential-cleanup.js

@@ -0,0 +1,122 @@
+import { mkdir } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { createOperatingSystemCredentialStore } from '../adapters/credentials/os.js';
+import { assertNoSymlinkPath, assertSafeDirectory, readNoFollow, removePrivateFile, writePrivateFile, } from '../adapters/persistence/safe-file.js';
+import { credentialRef } from '../ports/credentials.js';
+import { MAX_PENDING_REMOVAL_BYTES, parsePendingCredentialRemoval, pendingCredentialRemovalBytes, pendingCredentialRemovalPath, savedConfigReferencesPendingCredential, } from './production-connection-credential-removal-record.js';
+import { assertProductionConfigMutationLock, withProductionConfigMutationLock, } from './production-config-mutation-lock.js';
+import { defaultProductionCredentialRefResolver, } from './production-credential-reference.js';
+async function removeMarker(path, expected) {
+    const current = readNoFollow(path, MAX_PENDING_REMOVAL_BYTES);
+    if (current?.equals(expected))
+        removePrivateFile(path);
+}
+async function credentialStore(input) {
+    try {
+        return (input.credentialStore ??
+            input.credentialContext?.store ??
+            createOperatingSystemCredentialStore());
+    }
+    catch (error) {
+        throw new Error('Pending connection credential cleanup requires a secure credential store', {
+            cause: error,
+        });
+    }
+}
+async function recoverPendingRemovalLocked(configPath, options, mutationLock) {
+    assertProductionConfigMutationLock(mutationLock, configPath);
+    const path = pendingCredentialRemovalPath(configPath);
+    const bytes = readNoFollow(path, MAX_PENDING_REMOVAL_BYTES);
+    if (bytes === undefined)
+        return;
+    const marker = parsePendingCredentialRemoval(bytes, path);
+    if (await savedConfigReferencesPendingCredential(configPath, marker, options.credentialRefResolver)) {
+        await removeMarker(path, bytes);
+        return;
+    }
+    const store = await credentialStore(options);
+    try {
+        await store.remove(marker.portRef);
+    }
+    catch (error) {
+        throw new Error('Pending connection credential cleanup could not be completed', {
+            cause: error,
+        });
+    }
+    await removeMarker(path, bytes);
+}
+/** Completes deletion recorded before connection metadata was removed. */
+export async function recoverPendingConnectionCredentialRemoval(configPath, options = {}) {
+    if (readNoFollow(pendingCredentialRemovalPath(configPath), MAX_PENDING_REMOVAL_BYTES) === undefined) {
+        return;
+    }
+    await withProductionConfigMutationLock(configPath, (mutationLock) => recoverPendingRemovalLocked(configPath, options, mutationLock));
+}
+export async function prepareUnsharedConnectionCredentialRemoval(input) {
+    assertProductionConfigMutationLock(input.mutationLock, input.configPath);
+    await recoverPendingRemovalLocked(input.configPath, {
+        ...(input.connectionOptions.credentials === undefined
+            ? {}
+            : { credentialStore: input.connectionOptions.credentials }),
+        ...(input.connectionOptions.credentialRefResolver === undefined
+            ? {}
+            : { credentialRefResolver: input.connectionOptions.credentialRefResolver }),
+    }, input.mutationLock);
+    const reference = input.record.credentialRef;
+    if (reference === undefined ||
+        input.remaining.some((candidate) => candidate.credentialRef === reference)) {
+        return { commit: async () => undefined, rollback: async () => undefined };
+    }
+    const store = input.connectionOptions.credentials;
+    const configuredResolver = input.connectionOptions.credentialRefResolver;
+    const resolver = input.credentialMapping === 'default'
+        ? defaultProductionCredentialRefResolver
+        : configuredResolver;
+    if (store === undefined || resolver === undefined) {
+        throw new Error('The connection credential has no secure store mapping');
+    }
+    const portRef = credentialRef(await resolver(reference));
+    for (const candidate of input.remaining) {
+        if (candidate.credentialRef === undefined)
+            continue;
+        const candidatePortRef = credentialRef(await resolver(candidate.credentialRef));
+        if (candidatePortRef === portRef) {
+            return { commit: async () => undefined, rollback: async () => undefined };
+        }
+    }
+    const path = pendingCredentialRemovalPath(input.configPath);
+    const directory = dirname(path);
+    assertNoSymlinkPath(directory);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    assertNoSymlinkPath(directory);
+    assertSafeDirectory(directory);
+    const bytes = pendingCredentialRemovalBytes({
+        operationId: input.operationId,
+        connectionId: input.record.id,
+        credentialId: reference,
+        portRef,
+        mapping: input.credentialMapping,
+    });
+    writePrivateFile(path, bytes);
+    return {
+        commit: async (app) => {
+            try {
+                await recoverPendingRemovalLocked(input.configPath, { credentialStore: store, credentialRefResolver: configuredResolver }, input.mutationLock);
+            }
+            catch (error) {
+                app.markCleanupUncertain(error instanceof Error
+                    ? `Connection removed; credential cleanup is pending: ${error.message}`
+                    : 'Connection removed; credential cleanup is pending');
+            }
+        },
+        rollback: async () => {
+            assertProductionConfigMutationLock(input.mutationLock, input.configPath);
+            await removeMarker(path, bytes);
+        },
+    };
+}
+export async function removeUnsharedConnectionCredential(input) {
+    const prepared = await prepareUnsharedConnectionCredentialRemoval(input);
+    await prepared.commit(input.app);
+}
+//# sourceMappingURL=production-connection-credential-cleanup.js.map

package/dist/bin/production-connection-credential-cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-connection-credential-cleanup.js","sourceRoot":"","sources":["../../src/bin/production-connection-credential-cleanup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAA;AACpF,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,sCAAsC,CAAA;AAI7C,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,4BAA4B,EAC5B,sCAAsC,GACvC,MAAM,sDAAsD,CAAA;AAC7D,OAAO,EACL,kCAAkC,EAElC,gCAAgC,GACjC,MAAM,sCAAsC,CAAA;AAE7C,OAAO,EACL,sCAAsC,GAEvC,MAAM,sCAAsC,CAAA;AAa7C,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IACxD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAA;IAC7D,IAAI,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC;QAAE,iBAAiB,CAAC,IAAI,CAAC,CAAA;AACxD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAgC;IAC7D,IAAI,CAAC;QACH,OAAO,CACL,KAAK,CAAC,eAAe;YACrB,KAAK,CAAC,iBAAiB,EAAE,KAAK;YAC9B,oCAAoC,EAAE,CACvC,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0EAA0E,EAAE;YAC1F,KAAK,EAAE,KAAK;SACb,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,UAAkB,EAClB,OAAkC,EAClC,YAA0C;IAE1C,kCAAkC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IAC5D,MAAM,IAAI,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAA;IAC3D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAM;IAC/B,MAAM,MAAM,GAAG,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACzD,IACE,MAAM,sCAAsC,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,qBAAqB,CAAC,EAC/F,CAAC;QACD,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC/B,OAAM;IACR,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAA;IAC5C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,8DAA8D,EAAE;YAC9E,KAAK,EAAE,KAAK;SACb,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,UAAkB,EAClB,OAAO,GAA8B,EAAE;IAEvC,IACE,YAAY,CAAC,4BAA4B,CAAC,UAAU,CAAC,EAAE,yBAAyB,CAAC,KAAK,SAAS,EAC/F,CAAC;QACD,OAAM;IACR,CAAC;IACD,MAAM,gCAAgC,CAAC,UAAU,EAAE,CAAC,YAAY,EAAE,EAAE,CAClE,2BAA2B,CAAC,UAAU,EAAE,OAAO,EAAE,YAAY,CAAC,CAC/D,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAAC,KAQhE;IACC,kCAAkC,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IACxE,MAAM,2BAA2B,CAC/B,KAAK,CAAC,UAAU,EAChB;QACE,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,WAAW,KAAK,SAAS;YACnD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAC7D,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,qBAAqB,KAAK,SAAS;YAC7D,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,CAAC;KAC9E,EACD,KAAK,CAAC,YAAY,CACnB,CAAA;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,aAAa,CAAA;IAC5C,IACE,SAAS,KAAK,SAAS;QACvB,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,aAAa,KAAK,SAAS,CAAC,EAC1E,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,CAAA;IAC3E,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAA;IACjD,MAAM,kBAAkB,GAAG,KAAK,CAAC,iBAAiB,CAAC,qBAAqB,CAAA;IACxE,MAAM,QAAQ,GACZ,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACnC,CAAC,CAAC,sCAAsC;QACxC,CAAC,CAAC,kBAAkB,CAAA;IACxB,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;IACxD,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,SAAS,CAAC,aAAa,KAAK,SAAS;YAAE,SAAQ;QACnD,MAAM,gBAAgB,GAAG,aAAa,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAA;QAC/E,IAAI,gBAAgB,KAAK,OAAO,EAAE,CAAC;YACjC,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,CAAA;QAC3E,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,4BAA4B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B,mBAAmB,CAAC,SAAS,CAAC,CAAA;IAC9B,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACxD,mBAAmB,CAAC,SAAS,CAAC,CAAA;IAC9B,mBAAmB,CAAC,SAAS,CAAC,CAAA;IAC9B,MAAM,KAAK,GAAG,6BAA6B,CAAC;QAC1C,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QAC7B,YAAY,EAAE,SAAS;QACvB,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,iBAAiB;KACjC,CAAC,CAAA;IACF,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC7B,OAAO;QACL,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACpB,IAAI,CAAC;gBACH,MAAM,2BAA2B,CAC/B,KAAK,CAAC,UAAU,EAChB,EAAE,eAAe,EAAE,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,EACrE,KAAK,CAAC,YAAY,CACnB,CAAA;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,oBAAoB,CACtB,KAAK,YAAY,KAAK;oBACpB,CAAC,CAAC,sDAAsD,KAAK,CAAC,OAAO,EAAE;oBACvE,CAAC,CAAC,mDAAmD,CACxD,CAAA;YACH,CAAC;QACH,CAAC;QACD,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,kCAAkC,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;YACxE,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACjC,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KASxD;IACC,MAAM,QAAQ,GAAG,MAAM,0CAA0C,CAAC,KAAK,CAAC,CAAA;IACxE,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;AAClC,CAAC"}

package/dist/bin/production-connection-credential-removal-record.d.ts

@@ -0,0 +1,24 @@
+import type { ProductionConnectionOptions } from '../adapters/connections/production-connections.js';
+import type { CredentialRef } from '../ports/credentials.js';
+import { type ProductionCredentialMapping } from './production-credential-reference.js';
+export declare const MAX_PENDING_REMOVAL_BYTES: number;
+export interface PendingCredentialRemoval {
+    readonly format: 'braid-pending-connection-credential-removal';
+    readonly schemaVersion: 2;
+    readonly operationId: string;
+    readonly connectionId: string;
+    readonly credentialId: string;
+    readonly portRef: CredentialRef;
+    readonly mapping: ProductionCredentialMapping;
+}
+export declare function pendingCredentialRemovalPath(configPath: string): string;
+export declare function parsePendingCredentialRemoval(bytes: Buffer, path: string): PendingCredentialRemoval;
+export declare function pendingCredentialRemovalBytes(input: {
+    readonly operationId: string;
+    readonly connectionId: string;
+    readonly credentialId: string;
+    readonly portRef: CredentialRef;
+    readonly mapping: ProductionCredentialMapping;
+}): Buffer;
+export declare function savedConfigReferencesPendingCredential(configPath: string, marker: PendingCredentialRemoval, suppliedResolver: ProductionConnectionOptions['credentialRefResolver']): Promise<boolean>;
+//# sourceMappingURL=production-connection-credential-removal-record.d.ts.map

package/dist/bin/production-connection-credential-removal-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-connection-credential-removal-record.d.ts","sourceRoot":"","sources":["../../src/bin/production-connection-credential-removal-record.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAA;AAGpG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAE5D,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,sCAAsC,CAAA;AAE7C,eAAO,MAAM,yBAAyB,QAAY,CAAA;AAGlD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,6CAA6C,CAAA;IAC9D,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAA;CAC9C;AAED,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,wBAAwB,CAuC1B;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAA;CAC9C,GAAG,MAAM,CAaT;AA0DD,wBAAsB,sCAAsC,CAC1D,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,wBAAwB,EAChC,gBAAgB,EAAE,2BAA2B,CAAC,uBAAuB,CAAC,GACrE,OAAO,CAAC,OAAO,CAAC,CASlB"}

package/dist/bin/production-connection-credential-removal-record.js

@@ -0,0 +1,129 @@
+import { resolve } from 'node:path';
+import { canonicalCandidateJson } from '../adapters/agent-interface/profile-runtime.js';
+import { readNoFollow } from '../adapters/persistence/safe-file.js';
+import { createCredentialRefId, parseConnectionId, parseOperationId } from '../domain/ids.js';
+import { credentialRef } from '../ports/credentials.js';
+import { defaultProductionCredentialRefResolver, } from './production-credential-reference.js';
+export const MAX_PENDING_REMOVAL_BYTES = 16 * 1024;
+const MAX_CONFIG_BYTES = 2 * 1024 * 1024;
+export function pendingCredentialRemovalPath(configPath) {
+    return `${resolve(configPath)}.pending-credential-removal`;
+}
+export function parsePendingCredentialRemoval(bytes, path) {
+    let parsed;
+    try {
+        parsed = JSON.parse(bytes.toString('utf8'));
+    }
+    catch (error) {
+        throw new Error(`The pending credential removal record is not valid JSON: ${path}`, {
+            cause: error,
+        });
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error(`The pending credential removal record is invalid: ${path}`);
+    }
+    const candidate = parsed;
+    if (candidate.format !== 'braid-pending-connection-credential-removal' ||
+        candidate.schemaVersion !== 2 ||
+        typeof candidate.operationId !== 'string' ||
+        typeof candidate.connectionId !== 'string' ||
+        typeof candidate.credentialId !== 'string' ||
+        typeof candidate.portRef !== 'string' ||
+        (candidate.mapping !== 'default' && candidate.mapping !== 'custom')) {
+        throw new Error(`The pending credential removal record is incomplete: ${path}`);
+    }
+    try {
+        return {
+            format: 'braid-pending-connection-credential-removal',
+            schemaVersion: 2,
+            operationId: parseOperationId(candidate.operationId),
+            connectionId: parseConnectionId(candidate.connectionId),
+            credentialId: createCredentialRefId(candidate.credentialId),
+            portRef: credentialRef(candidate.portRef),
+            mapping: candidate.mapping,
+        };
+    }
+    catch (error) {
+        throw new Error(`The pending credential removal record has invalid references: ${path}`, {
+            cause: error,
+        });
+    }
+}
+export function pendingCredentialRemovalBytes(input) {
+    return Buffer.from(`${canonicalCandidateJson({
+        format: 'braid-pending-connection-credential-removal',
+        schemaVersion: 2,
+        operationId: parseOperationId(input.operationId),
+        connectionId: parseConnectionId(input.connectionId),
+        credentialId: createCredentialRefId(input.credentialId),
+        portRef: input.portRef,
+        mapping: input.mapping,
+    })}\n`, 'utf8');
+}
+function configuredCredentialIds(configPath) {
+    const bytes = readNoFollow(configPath, MAX_CONFIG_BYTES);
+    if (bytes === undefined)
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(bytes.toString('utf8'));
+    }
+    catch (error) {
+        throw new Error('Saved connection configuration is invalid during credential cleanup', {
+            cause: error,
+        });
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('Saved connection configuration is invalid during credential cleanup');
+    }
+    const connections = parsed.connections;
+    if (connections === undefined)
+        return [];
+    if (!Array.isArray(connections)) {
+        throw new Error('Saved connection configuration has an invalid connection catalog');
+    }
+    return connections.flatMap((record) => {
+        if (record === null || typeof record !== 'object' || Array.isArray(record)) {
+            throw new Error('Saved connection configuration has an invalid connection record');
+        }
+        const value = record.credentialRef;
+        if (value === undefined)
+            return [];
+        if (typeof value !== 'string') {
+            throw new Error('Saved connection configuration has an invalid credential reference');
+        }
+        return [createCredentialRefId(value)];
+    });
+}
+async function markerResolver(marker, supplied) {
+    const resolver = marker.mapping === 'default' ? defaultProductionCredentialRefResolver : supplied;
+    if (resolver === undefined) {
+        throw new Error('Pending credential cleanup requires the custom credential reference resolver that created it');
+    }
+    let resolved;
+    try {
+        resolved = credentialRef(await resolver(createCredentialRefId(marker.credentialId)));
+    }
+    catch (error) {
+        throw new Error('Pending credential cleanup could not resolve its protected reference', {
+            cause: error,
+        });
+    }
+    if (resolved !== marker.portRef) {
+        throw new Error('Pending credential cleanup has a mismatched protected reference');
+    }
+    return resolver;
+}
+export async function savedConfigReferencesPendingCredential(configPath, marker, suppliedResolver) {
+    const durableRefs = configuredCredentialIds(configPath);
+    if (durableRefs.includes(marker.credentialId))
+        return true;
+    const resolver = await markerResolver(marker, suppliedResolver);
+    for (const durableRef of durableRefs) {
+        const mapped = credentialRef(await resolver(createCredentialRefId(durableRef)));
+        if (mapped === marker.portRef)
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=production-connection-credential-removal-record.js.map

package/dist/bin/production-connection-credential-removal-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-connection-credential-removal-record.js","sourceRoot":"","sources":["../../src/bin/production-connection-credential-removal-record.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAA;AAEvF,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAA;AACnE,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAE7F,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EACL,sCAAsC,GAEvC,MAAM,sCAAsC,CAAA;AAE7C,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAA;AAClD,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAYxC,MAAM,UAAU,4BAA4B,CAAC,UAAkB;IAC7D,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,6BAA6B,CAAA;AAC5D,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAAa,EACb,IAAY;IAEZ,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4DAA4D,IAAI,EAAE,EAAE;YAClF,KAAK,EAAE,KAAK;SACb,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,qDAAqD,IAAI,EAAE,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,SAAS,GAAG,MAAiC,CAAA;IACnD,IACE,SAAS,CAAC,MAAM,KAAK,6CAA6C;QAClE,SAAS,CAAC,aAAa,KAAK,CAAC;QAC7B,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ;QACzC,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ;QAC1C,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ;QAC1C,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;QACrC,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,EACnE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,IAAI,EAAE,CAAC,CAAA;IACjF,CAAC;IACD,IAAI,CAAC;QACH,OAAO;YACL,MAAM,EAAE,6CAA6C;YACrD,aAAa,EAAE,CAAC;YAChB,WAAW,EAAE,gBAAgB,CAAC,SAAS,CAAC,WAAW,CAAC;YACpD,YAAY,EAAE,iBAAiB,CAAC,SAAS,CAAC,YAAY,CAAC;YACvD,YAAY,EAAE,qBAAqB,CAAC,SAAS,CAAC,YAAY,CAAC;YAC3D,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC;YACzC,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,iEAAiE,IAAI,EAAE,EAAE;YACvF,KAAK,EAAE,KAAK;SACb,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAM7C;IACC,OAAO,MAAM,CAAC,IAAI,CAChB,GAAG,sBAAsB,CAAC;QACxB,MAAM,EAAE,6CAA6C;QACrD,aAAa,EAAE,CAAC;QAChB,WAAW,EAAE,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC;QAChD,YAAY,EAAE,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC;QACnD,YAAY,EAAE,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC;QACvD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,IAAI,EACN,MAAM,CACP,CAAA;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,UAAkB;IACjD,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;IACxD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IAClC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qEAAqE,EAAE;YACrF,KAAK,EAAE,KAAK;SACb,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAA;IACxF,CAAC;IACD,MAAM,WAAW,GAAI,MAA6C,CAAC,WAAW,CAAA;IAC9E,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,EAAY,EAAE;QAC9C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;QACpF,CAAC;QACD,MAAM,KAAK,GAAI,MAA+C,CAAC,aAAa,CAAA;QAC5E,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,CAAA;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;QACvF,CAAC;QACD,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,MAAgC,EAChC,QAA8D;IAE9D,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,QAAQ,CAAA;IACjG,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAA;IACH,CAAC;IACD,IAAI,QAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,QAAQ,GAAG,aAAa,CAAC,MAAM,QAAQ,CAAC,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sEAAsE,EAAE;YACtF,KAAK,EAAE,KAAK;SACb,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IACpF,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,UAAkB,EAClB,MAAgC,EAChC,gBAAsE;IAEtE,MAAM,WAAW,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAA;IACvD,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;IAC/D,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,QAAQ,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC/E,IAAI,MAAM,KAAK,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;IAC5C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/bin/production-connection-removal.d.ts

@@ -0,0 +1,21 @@
+import type { ProductionConnectionOptions } from '../adapters/connections/production-connections.js';
+import type { BraidApplication } from '../app/application.js';
+import type { ConfigurationSelection } from '../app/configuration-session.js';
+import type { ConnectionRemovalInput, ConnectionRemovalResult } from '../app/connection-action-types.js';
+import type { ConnectionActionService } from '../app/connection-actions.js';
+import { ConnectionRegistry } from '../app/connections.js';
+import type { ConnectionRecord } from '../domain/entities.js';
+import type { ProductionConfigMutationLock } from './production-config-mutation-lock.js';
+import type { ProductionCredentialMapping } from './production-credential-reference.js';
+export interface ProductionConnectionRemovalContext {
+    readonly app: BraidApplication;
+    readonly catalog: ConnectionRegistry;
+    readonly configPath: string;
+    readonly mutationLock: ProductionConfigMutationLock;
+    readonly credentialMapping: ProductionCredentialMapping;
+    readonly connectionOptions: ProductionConnectionOptions;
+    readonly service: (catalog?: () => readonly ConnectionRecord[]) => ConnectionActionService;
+    readonly persist: <T>(selection: ConfigurationSelection, connections: readonly ConnectionRecord[], action: () => Promise<T>) => Promise<T>;
+}
+export declare function removeProductionConnection(input: ConnectionRemovalInput, context: ProductionConnectionRemovalContext): Promise<ConnectionRemovalResult>;
+//# sourceMappingURL=production-connection-removal.d.ts.map

package/dist/bin/production-connection-removal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-connection-removal.d.ts","sourceRoot":"","sources":["../../src/bin/production-connection-removal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAA;AACpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAC7E,OAAO,KAAK,EACV,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAE3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAA;AACxF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAA;AAYvF,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,4BAA4B,CAAA;IACnD,QAAQ,CAAC,iBAAiB,EAAE,2BAA2B,CAAA;IACvD,QAAQ,CAAC,iBAAiB,EAAE,2BAA2B,CAAA;IACvD,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,SAAS,gBAAgB,EAAE,KAAK,uBAAuB,CAAA;IAC1F,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAClB,SAAS,EAAE,sBAAsB,EACjC,WAAW,EAAE,SAAS,gBAAgB,EAAE,EACxC,MAAM,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KACrB,OAAO,CAAC,CAAC,CAAC,CAAA;CAChB;AAED,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,sBAAsB,EAC7B,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,uBAAuB,CAAC,CAyElC"}

package/dist/bin/production-connection-removal.js

@@ -0,0 +1,80 @@
+import { ConnectionRemovalError } from '../app/connection-errors.js';
+import { ConnectionRegistry } from '../app/connections.js';
+import { connectionRemovalBlockers } from '../domain/connection-removal.js';
+import { activeConnectionSelection, assertConnectionRevision, copyConnectionCatalog, } from './production-connection-catalog.js';
+import { prepareUnsharedConnectionCredentialRemoval, removeUnsharedConnectionCredential, } from './production-connection-credential-cleanup.js';
+import { hasDurableOperation, historicalConnectionRecord } from './production-connection-replay.js';
+export async function removeProductionConnection(input, context) {
+    const { app, catalog } = context;
+    if (hasDurableOperation(app, input.operationId)) {
+        const replayed = await context.service().remove(input);
+        const historical = historicalConnectionRecord(app, input.connectionId);
+        if (historical !== undefined) {
+            await removeUnsharedConnectionCredential({
+                app,
+                operationId: input.operationId,
+                configPath: context.configPath,
+                mutationLock: context.mutationLock,
+                credentialMapping: context.credentialMapping,
+                record: historical,
+                remaining: catalog.list(),
+                connectionOptions: context.connectionOptions,
+            });
+        }
+        return replayed;
+    }
+    assertConnectionRevision(app, input.expectedRevision);
+    const configured = catalog.get(input.connectionId);
+    if (configured === undefined) {
+        const historical = historicalConnectionRecord(app, input.connectionId);
+        const recoveryCatalog = historical === undefined ? catalog : new ConnectionRegistry([...catalog.list(), historical]);
+        const replayed = await context.service(() => recoveryCatalog.list()).remove(input);
+        if (historical !== undefined) {
+            await removeUnsharedConnectionCredential({
+                app,
+                operationId: input.operationId,
+                configPath: context.configPath,
+                mutationLock: context.mutationLock,
+                credentialMapping: context.credentialMapping,
+                record: historical,
+                remaining: catalog.list(),
+                connectionOptions: context.connectionOptions,
+            });
+        }
+        return replayed;
+    }
+    const blockers = connectionRemovalBlockers(app.state(), configured.id);
+    if (blockers.length > 0)
+        throw new ConnectionRemovalError(configured.id, blockers);
+    const proposed = copyConnectionCatalog(catalog);
+    proposed.remove({ connectionId: configured.id });
+    const selection = activeConnectionSelection(app, proposed);
+    const credentialRemoval = await prepareUnsharedConnectionCredentialRemoval({
+        operationId: input.operationId,
+        configPath: context.configPath,
+        mutationLock: context.mutationLock,
+        credentialMapping: context.credentialMapping,
+        record: configured,
+        remaining: proposed.list(),
+        connectionOptions: context.connectionOptions,
+    });
+    try {
+        const result = await context.persist(selection, proposed.list(), async () => {
+            const removed = await context.service().remove(input);
+            catalog.remove({ connectionId: configured.id });
+            return removed;
+        });
+        await credentialRemoval.commit(app);
+        return result;
+    }
+    catch (error) {
+        try {
+            await credentialRemoval.rollback();
+        }
+        catch (rollbackError) {
+            throw new AggregateError([error, rollbackError], 'Connection removal failed and its credential cleanup record could not be rolled back');
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=production-connection-removal.js.map

package/dist/bin/production-connection-removal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-connection-removal.js","sourceRoot":"","sources":["../../src/bin/production-connection-removal.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAA;AAI3E,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,0CAA0C,EAC1C,kCAAkC,GACnC,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AAiBnG,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA6B,EAC7B,OAA2C;IAE3C,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAChC,IAAI,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtD,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,CAAA;QACtE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,kCAAkC,CAAC;gBACvC,GAAG;gBACH,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC5C,MAAM,EAAE,UAAU;gBAClB,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE;gBACzB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;aAC7C,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,wBAAwB,CAAC,GAAG,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAA;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAClD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,CAAA;QACtE,MAAM,eAAe,GACnB,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC,CAAA;QAC9F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAClF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,kCAAkC,CAAC;gBACvC,GAAG;gBACH,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC5C,MAAM,EAAE,UAAU;gBAClB,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE;gBACzB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;aAC7C,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAA;IACtE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;IAClF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;IAChD,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IAC1D,MAAM,iBAAiB,GAAG,MAAM,0CAA0C,CAAC;QACzE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;QAC1B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAA;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE;YAC1E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACrD,OAAO,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;YAC/C,OAAO,OAAO,CAAA;QAChB,CAAC,CAAC,CAAA;QACF,MAAM,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACnC,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,QAAQ,EAAE,CAAA;QACpC,CAAC;QAAC,OAAO,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,aAAa,CAAC,EACtB,sFAAsF,CACvF,CAAA;QACH,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/bin/production-connection-replay.d.ts

@@ -0,0 +1,8 @@
+import type { BraidApplication } from '../app/application.js';
+import type { ConnectionRecord } from '../domain/entities.js';
+export declare function hasDurableOperation(app: BraidApplication, operationId: string): boolean;
+/** Finds the last safe connection record even after its live catalog entry was removed. */
+export declare function historicalConnectionRecord(app: BraidApplication, connectionId: string): ConnectionRecord | undefined;
+/** Recovers the exact record committed beside one acknowledged connection operation. */
+export declare function connectionRecordForOperation(app: BraidApplication, operationId: string): ConnectionRecord | undefined;
+//# sourceMappingURL=production-connection-replay.d.ts.map

package/dist/bin/production-connection-replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-connection-replay.d.ts","sourceRoot":"","sources":["../../src/bin/production-connection-replay.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAE7D,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAEvF;AAED,2FAA2F;AAC3F,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,gBAAgB,EACrB,YAAY,EAAE,MAAM,GACnB,gBAAgB,GAAG,SAAS,CAS9B;AAED,wFAAwF;AACxF,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,gBAAgB,EACrB,WAAW,EAAE,MAAM,GAClB,gBAAgB,GAAG,SAAS,CAkB9B"}

package/dist/bin/production-connection-replay.js

@@ -0,0 +1,36 @@
+export function hasDurableOperation(app, operationId) {
+    return app.state().operations.some((operation) => operation.id === operationId);
+}
+/** Finds the last safe connection record even after its live catalog entry was removed. */
+export function historicalConnectionRecord(app, connectionId) {
+    const current = app.state().connections.find((record) => record.id === connectionId);
+    if (current !== undefined)
+        return current;
+    for (const { event } of [...app.events()].reverse()) {
+        if (event.kind === 'connection.upserted' && event.connection.id === connectionId) {
+            return event.connection;
+        }
+    }
+    return undefined;
+}
+/** Recovers the exact record committed beside one acknowledged connection operation. */
+export function connectionRecordForOperation(app, operationId) {
+    const events = app.events();
+    for (let index = events.length - 1; index >= 0; index -= 1) {
+        const event = events[index]?.event;
+        if (event?.kind !== 'operation.updated' || event.operation.id !== operationId)
+            continue;
+        const connectionId = event.operation.target?.id;
+        for (let candidateIndex = index - 1; candidateIndex >= 0; candidateIndex -= 1) {
+            const candidate = events[candidateIndex]?.event;
+            if (candidate?.kind === 'operation.updated')
+                break;
+            if (candidate?.kind === 'connection.upserted' &&
+                (connectionId === undefined || candidate.connection.id === connectionId)) {
+                return candidate.connection;
+            }
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=production-connection-replay.js.map

package/dist/bin/production-connection-replay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-connection-replay.js","sourceRoot":"","sources":["../../src/bin/production-connection-replay.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,mBAAmB,CAAC,GAAqB,EAAE,WAAmB;IAC5E,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,WAAW,CAAC,CAAA;AACjF,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,0BAA0B,CACxC,GAAqB,EACrB,YAAoB;IAEpB,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,YAAY,CAAC,CAAA;IACpF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAA;IACzC,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,IAAI,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC;YACjF,OAAO,KAAK,CAAC,UAAU,CAAA;QACzB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,4BAA4B,CAC1C,GAAqB,EACrB,WAAmB;IAEnB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAA;IAC3B,KAAK,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;QAClC,IAAI,KAAK,EAAE,IAAI,KAAK,mBAAmB,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,WAAW;YAAE,SAAQ;QACvF,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAA;QAC/C,KAAK,IAAI,cAAc,GAAG,KAAK,GAAG,CAAC,EAAE,cAAc,IAAI,CAAC,EAAE,cAAc,IAAI,CAAC,EAAE,CAAC;YAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,EAAE,KAAK,CAAA;YAC/C,IAAI,SAAS,EAAE,IAAI,KAAK,mBAAmB;gBAAE,MAAK;YAClD,IACE,SAAS,EAAE,IAAI,KAAK,qBAAqB;gBACzC,CAAC,YAAY,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,CAAC,EAAE,KAAK,YAAY,CAAC,EACxE,CAAC;gBACD,OAAO,SAAS,CAAC,UAAU,CAAA;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/bin/production-credential-context.d.ts

@@ -0,0 +1,19 @@
+import type { HeadlessKeySource } from '../adapters/credentials/headless-key.js';
+import type { CredentialPort } from '../ports/credentials.js';
+export interface ProductionCredentialContext {
+    readonly store: CredentialPort;
+    readonly databaseKeyFile: string;
+    readonly databaseKeySource: HeadlessKeySource;
+    acquire(): () => void;
+    dispose(): void;
+}
+interface ProductionCredentialContextOptions {
+    readonly workspace: string;
+    readonly configPath?: string;
+    readonly databaseKeyFile?: string;
+    readonly dataDirectory?: string;
+}
+/** Creates the one key-backed credential store shared by setup, recovery, and reopen. */
+export declare function createProductionCredentialContext(options: ProductionCredentialContextOptions): ProductionCredentialContext | undefined;
+export {};
+//# sourceMappingURL=production-credential-context.d.ts.map

package/dist/bin/production-credential-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-credential-context.d.ts","sourceRoot":"","sources":["../../src/bin/production-credential-context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAA;AAGhF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAM7D,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAA;IAC7C,OAAO,IAAI,MAAM,IAAI,CAAA;IACrB,OAAO,IAAI,IAAI,CAAA;CAChB;AAED,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAChC;AAoBD,yFAAyF;AACzF,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,kCAAkC,GAC1C,2BAA2B,GAAG,SAAS,CA4CzC"}

package/dist/bin/production-credential-context.js

@@ -0,0 +1,73 @@
+import { join, resolve } from 'node:path';
+import { HeadlessCredentialStore } from '../adapters/credentials/headless-store.js';
+import { readNoFollow } from '../adapters/persistence/safe-file.js';
+import { productionConfigPath, resolveProductionDatabaseKeyFile } from './production-key-path.js';
+import { defaultBraidDataDirectory, productionWorkspaceConfigIdentity } from './state-path.js';
+const MAX_CONFIG_BYTES = 2 * 1024 * 1024;
+function configuredDatabaseKeyFile(configPath) {
+    const bytes = readNoFollow(configPath, MAX_CONFIG_BYTES);
+    if (bytes === undefined)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(bytes.toString('utf8'));
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+        return undefined;
+    const value = parsed.databaseKeyFile;
+    return typeof value === 'string' && value.trim().length > 0 ? value : undefined;
+}
+function credentialDirectory(dataDirectory, storeIdentity) {
+    return join(dataDirectory, 'credentials', storeIdentity);
+}
+/** Creates the one key-backed credential store shared by setup, recovery, and reopen. */
+export function createProductionCredentialContext(options) {
+    const configPath = productionConfigPath(options.workspace, options.configPath);
+    const configuredKeyFile = options.databaseKeyFile ?? configuredDatabaseKeyFile(configPath);
+    if (configuredKeyFile === undefined)
+        return undefined;
+    const storeIdentity = productionWorkspaceConfigIdentity(options.workspace, configPath);
+    const databaseKeyFile = resolveProductionDatabaseKeyFile(configuredKeyFile, configPath, options.workspace);
+    const databaseKeySource = {
+        type: 'file',
+        path: databaseKeyFile,
+        workspaceRoot: resolve(options.workspace),
+    };
+    const store = new HeadlessCredentialStore({
+        root: credentialDirectory(options.dataDirectory ?? defaultBraidDataDirectory(), storeIdentity),
+        keySource: databaseKeySource,
+        storeIdentity,
+    });
+    let references = 0;
+    let disposed = false;
+    const dispose = () => {
+        if (disposed)
+            return;
+        disposed = true;
+        store.dispose();
+    };
+    return {
+        store,
+        databaseKeyFile,
+        databaseKeySource,
+        acquire: () => {
+            if (disposed)
+                throw new Error('The headless production credential context is closed');
+            references += 1;
+            let released = false;
+            return () => {
+                if (released)
+                    return;
+                released = true;
+                references -= 1;
+                if (references === 0)
+                    dispose();
+            };
+        },
+        dispose,
+    };
+}
+//# sourceMappingURL=production-credential-context.js.map

package/dist/bin/production-credential-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-credential-context.js","sourceRoot":"","sources":["../../src/bin/production-credential-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAA;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAA;AAEnE,OAAO,EAAE,oBAAoB,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAA;AACjG,OAAO,EAAE,yBAAyB,EAAE,iCAAiC,EAAE,MAAM,iBAAiB,CAAA;AAE9F,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAiBxC,SAAS,yBAAyB,CAAC,UAAkB;IACnD,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;IACxD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAA;IAC5F,MAAM,KAAK,GAAI,MAAiD,CAAC,eAAe,CAAA;IAChF,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACjF,CAAC;AAED,SAAS,mBAAmB,CAAC,aAAqB,EAAE,aAAqB;IACvE,OAAO,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,aAAa,CAAC,CAAA;AAC1D,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iCAAiC,CAC/C,OAA2C;IAE3C,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IAC9E,MAAM,iBAAiB,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC,UAAU,CAAC,CAAA;IAC1F,IAAI,iBAAiB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACrD,MAAM,aAAa,GAAG,iCAAiC,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IACtF,MAAM,eAAe,GAAG,gCAAgC,CACtD,iBAAiB,EACjB,UAAU,EACV,OAAO,CAAC,SAAS,CAClB,CAAA;IACD,MAAM,iBAAiB,GAAsB;QAC3C,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,eAAe;QACrB,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;KAC1C,CAAA;IACD,MAAM,KAAK,GAAG,IAAI,uBAAuB,CAAC;QACxC,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,aAAa,IAAI,yBAAyB,EAAE,EAAE,aAAa,CAAC;QAC9F,SAAS,EAAE,iBAAiB;QAC5B,aAAa;KACd,CAAC,CAAA;IACF,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,QAAQ;YAAE,OAAM;QACpB,QAAQ,GAAG,IAAI,CAAA;QACf,KAAK,CAAC,OAAO,EAAE,CAAA;IACjB,CAAC,CAAA;IACD,OAAO;QACL,KAAK;QACL,eAAe;QACf,iBAAiB;QACjB,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;YACrF,UAAU,IAAI,CAAC,CAAA;YACf,IAAI,QAAQ,GAAG,KAAK,CAAA;YACpB,OAAO,GAAG,EAAE;gBACV,IAAI,QAAQ;oBAAE,OAAM;gBACpB,QAAQ,GAAG,IAAI,CAAA;gBACf,UAAU,IAAI,CAAC,CAAA;gBACf,IAAI,UAAU,KAAK,CAAC;oBAAE,OAAO,EAAE,CAAA;YACjC,CAAC,CAAA;QACH,CAAC;QACD,OAAO;KACR,CAAA;AACH,CAAC"}

package/dist/bin/production-credential-reference.d.ts

@@ -0,0 +1,5 @@
+import type { ProductionConnectionOptions } from '../adapters/connections/production-connections.js';
+export type ProductionCredentialMapping = 'default' | 'custom';
+export declare const defaultProductionCredentialRefResolver: NonNullable<ProductionConnectionOptions['credentialRefResolver']>;
+export declare function productionCredentialMapping(resolver: ProductionConnectionOptions['credentialRefResolver']): ProductionCredentialMapping;
+//# sourceMappingURL=production-credential-reference.d.ts.map