@tangle-network/braid 0.1.0

package/dist/adapters/connections/production-connection-types.js

@@ -0,0 +1,2 @@
+export const DEFAULT_TANGLE_SANDBOX_ENDPOINT = 'https://sandbox.tangle.tools';
+//# sourceMappingURL=production-connection-types.js.map

package/dist/adapters/connections/production-connection-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-connection-types.js","sourceRoot":"","sources":["../../../src/adapters/connections/production-connection-types.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,MAAM,+BAA+B,GAAG,8BAA8B,CAAA"}

package/dist/adapters/connections/production-connections.d.ts

@@ -0,0 +1,8 @@
+import type { ConnectionRecord } from '../../domain/entities.js';
+import type { ProductionConnectionAdapter, ProductionConnectionOptions } from './production-connection-types.js';
+export { readConnectionCredential } from './production-connection-credentials.js';
+export { connectionEndpoint, DEFAULT_TANGLE_INFERENCE_ENDPOINT, normalizeCliBridgeRuntimeBaseUrl, } from './production-connection-endpoints.js';
+export { createTangleSandboxClient } from './production-connection-providers.js';
+export { type ConnectionCapabilityAction, type ConnectionCapabilityReport, type ConnectionHealthOptions, type ConnectionModelVerificationOptions, type ConnectionProviderMethods, type ConnectionRuntimeCapabilities, DEFAULT_TANGLE_SANDBOX_ENDPOINT, type ProductionConnectionAdapter, type ProductionConnectionOptions, type SandboxClientFactory, type SandboxClientFactoryInput, } from './production-connection-types.js';
+export declare function createProductionConnectionAdapter(record: ConnectionRecord, options?: ProductionConnectionOptions): ProductionConnectionAdapter;
+//# sourceMappingURL=production-connections.d.ts.map

package/dist/adapters/connections/production-connections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-connections.d.ts","sourceRoot":"","sources":["../../../src/adapters/connections/production-connections.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAGhE,OAAO,KAAK,EAGV,2BAA2B,EAC3B,2BAA2B,EAC5B,MAAM,kCAAkC,CAAA;AAEzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAA;AACjF,OAAO,EACL,kBAAkB,EAClB,iCAAiC,EACjC,gCAAgC,GACjC,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AAChF,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAC/B,KAAK,uBAAuB,EAC5B,KAAK,kCAAkC,EACvC,KAAK,yBAAyB,EAC9B,KAAK,6BAA6B,EAClC,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,GAC/B,MAAM,kCAAkC,CAAA;AAEzC,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,gBAAgB,EACxB,OAAO,GAAE,2BAAgC,GACxC,2BAA2B,CAS7B"}

package/dist/adapters/connections/production-connections.js

@@ -0,0 +1,15 @@
+import { healthForConnection, verifyModelForConnection } from './production-connection-health.js';
+import { capabilitiesForConnection } from './production-connection-providers.js';
+export { readConnectionCredential } from './production-connection-credentials.js';
+export { connectionEndpoint, DEFAULT_TANGLE_INFERENCE_ENDPOINT, normalizeCliBridgeRuntimeBaseUrl, } from './production-connection-endpoints.js';
+export { createTangleSandboxClient } from './production-connection-providers.js';
+export { DEFAULT_TANGLE_SANDBOX_ENDPOINT, } from './production-connection-types.js';
+export function createProductionConnectionAdapter(record, options = {}) {
+    return Object.freeze({
+        record,
+        capabilities: () => capabilitiesForConnection(record, options),
+        health: (healthOptions = {}) => healthForConnection(record, options, healthOptions),
+        verifyModel: (model, verificationOptions = {}) => verifyModelForConnection(record, options, model, verificationOptions),
+    });
+}
+//# sourceMappingURL=production-connections.js.map

package/dist/adapters/connections/production-connections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-connections.js","sourceRoot":"","sources":["../../../src/adapters/connections/production-connections.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAA;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AAQhF,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAA;AACjF,OAAO,EACL,kBAAkB,EAClB,iCAAiC,EACjC,gCAAgC,GACjC,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AAChF,OAAO,EAOL,+BAA+B,GAKhC,MAAM,kCAAkC,CAAA;AAEzC,MAAM,UAAU,iCAAiC,CAC/C,MAAwB,EACxB,OAAO,GAAgC,EAAE;IAEzC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM;QACN,YAAY,EAAE,GAAG,EAAE,CAAC,yBAAyB,CAAC,MAAM,EAAE,OAAO,CAAC;QAC9D,MAAM,EAAE,CAAC,aAAa,GAA4B,EAAE,EAAE,EAAE,CACtD,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC;QACrD,WAAW,EAAE,CAAC,KAAa,EAAE,mBAAmB,GAAuC,EAAE,EAAE,EAAE,CAC3F,wBAAwB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC;KACxE,CAAC,CAAA;AACJ,CAAC"}

package/dist/adapters/credentials/headless-key.d.ts

@@ -0,0 +1,18 @@
+export interface HeadlessKeyFileSource {
+    readonly type: 'file';
+    readonly path: string;
+    readonly workspaceRoot: string;
+}
+export interface HeadlessKeyFdSource {
+    readonly type: 'fd';
+    readonly fd: number;
+    readonly workspaceRoot: string;
+}
+export type HeadlessKeySource = HeadlessKeyFileSource | HeadlessKeyFdSource;
+/** Resolves a configured key relative to its protected Braid config directory. */
+export declare function resolveHeadlessKeyPath(path: string, configDirectory: string, workspaceRoot: string): string;
+export declare function readHeadlessKey(source: HeadlessKeySource): Buffer;
+export declare function openHeadlessKeyFile(path: string, workspaceRoot: string): number;
+export declare function closeHeadlessKeyFile(fd: number): void;
+export declare function rejectEnvironmentKeySource(value: unknown): never;
+//# sourceMappingURL=headless-key.d.ts.map

package/dist/adapters/credentials/headless-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless-key.d.ts","sourceRoot":"","sources":["../../../src/adapters/credentials/headless-key.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,GAAG,mBAAmB,CAAA;AAkB3E,kFAAkF;AAClF,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,MAAM,EACvB,aAAa,EAAE,MAAM,GACpB,MAAM,CAOR;AAiLD,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAyBjE;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAc/E;AAED,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAErD;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAKhE"}

package/dist/adapters/credentials/headless-key.js

@@ -0,0 +1,203 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, readlinkSync, readSync, realpathSync, statSync, } from 'node:fs';
+import { isAbsolute, join, parse, relative, resolve, sep } from 'node:path';
+import { CredentialError } from '../../ports/credentials.js';
+const MAX_KEY_BYTES = 128;
+function isInside(path, root) {
+    const child = relative(resolve(root), resolve(path));
+    return child === '' || (child !== '..' && !child.startsWith(`..${sep}`) && !isAbsolute(child));
+}
+function assertWorkspaceExternal(path, workspaceRoot) {
+    if (isInside(path, workspaceRoot)) {
+        throw new CredentialError('HEADLESS_KEY_IN_WORKSPACE', 'Headless key files must be outside the workspace');
+    }
+}
+/** Resolves a configured key relative to its protected Braid config directory. */
+export function resolveHeadlessKeyPath(path, configDirectory, workspaceRoot) {
+    if (path.trim().length === 0) {
+        throw new CredentialError('HEADLESS_KEY_SOURCE', 'A protected headless key file is required');
+    }
+    const absolute = isAbsolute(path) ? resolve(path) : resolve(configDirectory, path);
+    assertWorkspaceExternal(absolute, workspaceRoot);
+    return absolute;
+}
+function canonicalWorkspaceRoot(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch (error) {
+        throw new CredentialError('HEADLESS_KEY_WORKSPACE', 'The workspace root could not be resolved', { cause: error });
+    }
+}
+function assertNoSymlinkComponents(path) {
+    const absolute = resolve(path);
+    const root = parse(absolute).root;
+    let current = root;
+    for (const component of absolute.slice(root.length).split(sep).filter(Boolean)) {
+        current = join(current, component);
+        let stat;
+        try {
+            stat = lstatSync(current);
+        }
+        catch (error) {
+            throw new CredentialError('HEADLESS_KEY_UNREADABLE', `Cannot inspect key path ${current}`, {
+                cause: error,
+            });
+        }
+        if (stat.isSymbolicLink()) {
+            throw new CredentialError('HEADLESS_KEY_SYMLINK', 'Symlinked headless key paths are rejected');
+        }
+    }
+}
+function assertOwnerAndMode(stat) {
+    if (!stat.isFile()) {
+        throw new CredentialError('HEADLESS_KEY_NOT_FILE', 'Headless key source must be a regular file');
+    }
+    if ((stat.mode & 0o777) !== 0o600) {
+        throw new CredentialError('HEADLESS_KEY_PERMISSIONS', 'Headless key files must have mode 0600');
+    }
+    if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
+        throw new CredentialError('HEADLESS_KEY_OWNER', 'Headless key file ownership does not match the process');
+    }
+    if (stat.nlink !== 1) {
+        throw new CredentialError('HEADLESS_KEY_LINK_COUNT', 'Headless key files must have exactly one filesystem link');
+    }
+}
+function parseKey(bytes) {
+    if (bytes.length === 32)
+        return Buffer.from(bytes);
+    if (bytes.length > MAX_KEY_BYTES) {
+        throw new CredentialError('HEADLESS_KEY_SIZE', 'Headless key input is too large');
+    }
+    const text = bytes.toString('utf8').trim();
+    if (!/^[0-9a-f]{64}$/iu.test(text)) {
+        throw new CredentialError('HEADLESS_KEY_FORMAT', 'Headless keys must be 32 bytes or 64 hexadecimal characters');
+    }
+    return Buffer.from(text, 'hex');
+}
+function descriptorPath(fd) {
+    try {
+        const path = readlinkSync(`/proc/self/fd/${fd}`);
+        if (path.includes(' (deleted)')) {
+            throw new CredentialError('HEADLESS_KEY_FD_DELETED', 'Deleted headless key files are rejected');
+        }
+        return isAbsolute(path) ? resolve(path) : undefined;
+    }
+    catch (error) {
+        if (error instanceof CredentialError)
+            throw error;
+        return undefined;
+    }
+}
+function assertDescriptorPath(fd, sourcePath, workspaceRoot, descriptorStat) {
+    const canonicalWorkspace = canonicalWorkspaceRoot(workspaceRoot);
+    const actualPath = descriptorPath(fd);
+    if (actualPath) {
+        assertWorkspaceExternal(actualPath, canonicalWorkspace);
+        return;
+    }
+    let canonicalPath;
+    let pathStat;
+    try {
+        canonicalPath = realpathSync(sourcePath);
+        pathStat = statSync(canonicalPath);
+    }
+    catch (error) {
+        throw new CredentialError('HEADLESS_KEY_PATH_CHANGED', 'The headless key path changed while it was being opened', { cause: error });
+    }
+    if (pathStat.dev !== descriptorStat.dev || pathStat.ino !== descriptorStat.ino) {
+        throw new CredentialError('HEADLESS_KEY_PATH_CHANGED', 'The headless key path changed while it was being opened');
+    }
+    assertWorkspaceExternal(canonicalPath, canonicalWorkspace);
+}
+function inspectFd(fd) {
+    if (!Number.isInteger(fd) || fd < 3) {
+        throw new CredentialError('HEADLESS_KEY_FD', 'Headless key file descriptors must be integers >= 3');
+    }
+    let stat;
+    try {
+        stat = fstatSync(fd);
+    }
+    catch (error) {
+        throw new CredentialError('HEADLESS_KEY_FD', 'The inherited headless key descriptor is invalid', {
+            cause: error,
+        });
+    }
+    if (stat.nlink === 0) {
+        throw new CredentialError('HEADLESS_KEY_FD_DELETED', 'Deleted headless key files are rejected');
+    }
+    assertOwnerAndMode(stat);
+    if (stat.size > MAX_KEY_BYTES) {
+        throw new CredentialError('HEADLESS_KEY_SIZE', 'Headless key input is too large');
+    }
+    return stat;
+}
+function readFd(fd, workspaceRoot) {
+    inspectFd(fd);
+    const actualPath = descriptorPath(fd);
+    if (!actualPath) {
+        throw new CredentialError('HEADLESS_KEY_FD_PATH', 'The inherited headless key descriptor path could not be verified');
+    }
+    assertWorkspaceExternal(actualPath, canonicalWorkspaceRoot(workspaceRoot));
+    const buffer = Buffer.alloc(MAX_KEY_BYTES + 1);
+    let length = 0;
+    while (length < buffer.length) {
+        const count = readSync(fd, buffer, length, buffer.length - length, length);
+        if (count === 0)
+            break;
+        length += count;
+    }
+    if (length > MAX_KEY_BYTES) {
+        buffer.fill(0);
+        throw new CredentialError('HEADLESS_KEY_SIZE', 'Headless key input is too large');
+    }
+    try {
+        return parseKey(buffer.subarray(0, length));
+    }
+    finally {
+        buffer.fill(0);
+    }
+}
+export function readHeadlessKey(source) {
+    if (!source || typeof source !== 'object') {
+        throw new CredentialError('HEADLESS_KEY_SOURCE', 'A protected file or descriptor is required');
+    }
+    if (source.type === 'fd') {
+        if (!source.workspaceRoot) {
+            throw new CredentialError('HEADLESS_KEY_SOURCE', 'Headless key descriptors require a workspace root');
+        }
+        return readFd(source.fd, source.workspaceRoot);
+    }
+    if (source.type !== 'file' || !isAbsolute(source.path) || !source.workspaceRoot) {
+        throw new CredentialError('HEADLESS_KEY_SOURCE', 'Headless keys require an absolute mode-0600 file path and workspace root');
+    }
+    const fd = openHeadlessKeyFile(source.path, source.workspaceRoot);
+    try {
+        return readFd(fd, source.workspaceRoot);
+    }
+    finally {
+        closeHeadlessKeyFile(fd);
+    }
+}
+export function openHeadlessKeyFile(path, workspaceRoot) {
+    if (!isAbsolute(path))
+        throw new CredentialError('HEADLESS_KEY_SOURCE', 'Headless key paths must be absolute');
+    assertNoSymlinkComponents(path);
+    const fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const stat = fstatSync(fd);
+        assertOwnerAndMode(stat);
+        assertDescriptorPath(fd, path, workspaceRoot, stat);
+        return fd;
+    }
+    catch (error) {
+        closeSync(fd);
+        throw error;
+    }
+}
+export function closeHeadlessKeyFile(fd) {
+    closeSync(fd);
+}
+export function rejectEnvironmentKeySource(value) {
+    throw new CredentialError('HEADLESS_KEY_ENV_REJECTED', `Environment key sources are rejected (${typeof value === 'string' ? 'string' : 'unknown'})`);
+}
+//# sourceMappingURL=headless-key.js.map

package/dist/adapters/credentials/headless-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless-key.js","sourceRoot":"","sources":["../../../src/adapters/credentials/headless-key.ts"],"names":[],"mappings":"AACA,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,QAAQ,GACT,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAgB5D,MAAM,aAAa,GAAG,GAAG,CAAA;AAEzB,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IACpD,OAAO,KAAK,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;AAChG,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY,EAAE,aAAqB;IAClE,IAAI,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CACvB,2BAA2B,EAC3B,kDAAkD,CACnD,CAAA;IACH,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CACpC,IAAY,EACZ,eAAuB,EACvB,aAAqB;IAErB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAA;IAC/F,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;IAClF,uBAAuB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;IAChD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,wBAAwB,EACxB,0CAA0C,EAC1C,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAA;IACjC,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/E,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAClC,IAAI,IAAW,CAAA;QACf,IAAI,CAAC;YACH,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,eAAe,CAAC,yBAAyB,EAAE,2BAA2B,OAAO,EAAE,EAAE;gBACzF,KAAK,EAAE,KAAK;aACb,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CAAC,sBAAsB,EAAE,2CAA2C,CAAC,CAAA;QAChG,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAW;IACrC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,eAAe,CAAC,uBAAuB,EAAE,4CAA4C,CAAC,CAAA;IAClG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CAAC,0BAA0B,EAAE,wCAAwC,CAAC,CAAA;IACjG,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1E,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,wDAAwD,CACzD,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CACvB,yBAAyB,EACzB,0DAA0D,CAC3D,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClD,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IAC1C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,6DAA6D,CAC9D,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,EAAU;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAA;QAChD,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,eAAe,CACvB,yBAAyB,EACzB,yCAAyC,CAC1C,CAAA;QACH,CAAC;QACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAA;QACjD,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,EAAU,EACV,UAAkB,EAClB,aAAqB,EACrB,cAAqB;IAErB,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAA;IAChE,MAAM,UAAU,GAAG,cAAc,CAAC,EAAE,CAAC,CAAA;IACrC,IAAI,UAAU,EAAE,CAAC;QACf,uBAAuB,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAA;QACvD,OAAM;IACR,CAAC;IAED,IAAI,aAAqB,CAAA;IACzB,IAAI,QAAe,CAAA;IACnB,IAAI,CAAC;QACH,aAAa,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;QACxC,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAA;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,2BAA2B,EAC3B,yDAAyD,EACzD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,KAAK,cAAc,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,KAAK,cAAc,CAAC,GAAG,EAAE,CAAC;QAC/E,MAAM,IAAI,eAAe,CACvB,2BAA2B,EAC3B,yDAAyD,CAC1D,CAAA;IACH,CAAC;IACD,uBAAuB,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAA;AAC5D,CAAC;AAED,SAAS,SAAS,CAAC,EAAU;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,qDAAqD,CACtD,CAAA;IACH,CAAC;IACD,IAAI,IAAW,CAAA;IACf,IAAI,CAAC;QACH,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,kDAAkD,EAClD;YACE,KAAK,EAAE,KAAK;SACb,CACF,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CAAC,yBAAyB,EAAE,yCAAyC,CAAC,CAAA;IACjG,CAAC;IACD,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACxB,IAAI,IAAI,CAAC,IAAI,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,CAAA;IACnF,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,MAAM,CAAC,EAAU,EAAE,aAAqB;IAC/C,SAAS,CAAC,EAAE,CAAC,CAAA;IACb,MAAM,UAAU,GAAG,cAAc,CAAC,EAAE,CAAC,CAAA;IACrC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,eAAe,CACvB,sBAAsB,EACtB,kEAAkE,CACnE,CAAA;IACH,CAAC;IACD,uBAAuB,CAAC,UAAU,EAAE,sBAAsB,CAAC,aAAa,CAAC,CAAC,CAAA;IAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAA;IAC9C,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,CAAA;QAC1E,IAAI,KAAK,KAAK,CAAC;YAAE,MAAK;QACtB,MAAM,IAAI,KAAK,CAAA;IACjB,CAAC;IACD,IAAI,MAAM,GAAG,aAAa,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACd,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,CAAA;IACnF,CAAC;IACD,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;IAC7C,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAyB;IACvD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAA;IAChG,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,mDAAmD,CACpD,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAChF,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,0EAA0E,CAC3E,CAAA;IACH,CAAC;IACD,MAAM,EAAE,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,CAAA;IACjE,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAA;IACzC,CAAC;YAAS,CAAC;QACT,oBAAoB,CAAC,EAAE,CAAC,CAAA;IAC1B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,aAAqB;IACrE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACnB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,qCAAqC,CAAC,CAAA;IACzF,yBAAyB,CAAC,IAAI,CAAC,CAAA;IAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAA;IAC3E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;QAC1B,kBAAkB,CAAC,IAAI,CAAC,CAAA;QACxB,oBAAoB,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;QACnD,OAAO,EAAE,CAAA;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,CAAC,EAAE,CAAC,CAAA;QACb,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,EAAU;IAC7C,SAAS,CAAC,EAAE,CAAC,CAAA;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,MAAM,IAAI,eAAe,CACvB,2BAA2B,EAC3B,yCAAyC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,CAC7F,CAAA;AACH,CAAC"}

package/dist/adapters/credentials/headless-store.d.ts

@@ -0,0 +1,22 @@
+import type { CredentialPort, CredentialRef, CredentialStoreInput, SecretHandle } from '../../ports/credentials.js';
+import { type HeadlessKeySource } from './headless-key.js';
+/**
+ * Stores credential-port values encrypted with a key derived from the explicit headless
+ * database key. The key file remains the only external secret input; credential values
+ * never enter config.
+ */
+export declare class HeadlessCredentialStore implements CredentialPort {
+    #private;
+    constructor(options: {
+        readonly root: string;
+        readonly keySource: HeadlessKeySource;
+        /** Stable workspace/config identity, normally the credential-directory digest. */
+        readonly storeIdentity: string;
+    });
+    available(): Promise<boolean>;
+    store(input: CredentialStoreInput): Promise<CredentialRef>;
+    resolve(ref: CredentialRef): Promise<SecretHandle>;
+    remove(ref: CredentialRef): Promise<void>;
+    dispose(): void;
+}
+//# sourceMappingURL=headless-store.d.ts.map

package/dist/adapters/credentials/headless-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless-store.d.ts","sourceRoot":"","sources":["../../../src/adapters/credentials/headless-store.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,YAAY,EACb,MAAM,4BAA4B,CAAA;AAUnC,OAAO,EAAE,KAAK,iBAAiB,EAAmB,MAAM,mBAAmB,CAAA;AAiC3E;;;;GAIG;AACH,qBAAa,uBAAwB,YAAW,cAAc;;IAK5D,YAAY,OAAO,EAAE;QACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;QACrC,kFAAkF;QAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC/B,EAeA;IAEK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAYlC;IAEK,KAAK,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,CAiC/D;IAEK,OAAO,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAuBvD;IAEK,MAAM,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAI9C;IAED,OAAO,IAAI,IAAI,CAGd;CAgBF"}

package/dist/adapters/credentials/headless-store.js

@@ -0,0 +1,216 @@
+import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes, randomUUID, } from 'node:crypto';
+import { statSync } from 'node:fs';
+import { join } from 'node:path';
+import { CredentialError, credentialRef } from '../../ports/credentials.js';
+import { assertSafeDirectory, ensurePrivateDirectory, readNoFollow, removePrivateFile, replacePrivateFile, writePrivateFile, } from '../persistence/safe-file.js';
+import { readHeadlessKey } from './headless-key.js';
+const CREDENTIAL_FILE_VERSION = 1;
+const NONCE_BYTES = 12;
+const TAG_BYTES = 16;
+const MAX_CREDENTIAL_BYTES = 64 * 1024;
+const MAX_ENCODED_BYTES = 1 + NONCE_BYTES + TAG_BYTES + MAX_CREDENTIAL_BYTES;
+const KEY_DERIVATION_PURPOSE = 'braid-headless-credential-encryption:v1';
+const AAD_PURPOSE = 'braid-headless-credential-aad:v1';
+const STORE_IDENTITY_PATTERN = /^[0-9a-f]{64}$/u;
+class HeadlessSecretHandle {
+    ref;
+    #value;
+    constructor(ref, value) {
+        this.ref = ref;
+        this.#value = Buffer.from(value);
+    }
+    read() {
+        if (this.#value === undefined) {
+            throw new CredentialError('SECRET_HANDLE_CLOSED', 'The headless secret handle is closed');
+        }
+        return Buffer.from(this.#value);
+    }
+    dispose() {
+        this.#value?.fill(0);
+        this.#value = undefined;
+    }
+}
+/**
+ * Stores credential-port values encrypted with a key derived from the explicit headless
+ * database key. The key file remains the only external secret input; credential values
+ * never enter config.
+ */
+export class HeadlessCredentialStore {
+    #root;
+    #storeIdentity;
+    #key;
+    constructor(options) {
+        if (!STORE_IDENTITY_PATTERN.test(options.storeIdentity)) {
+            throw new CredentialError('CREDENTIAL_STORE_IDENTITY', 'Headless credential stores require a canonical workspace/config identity');
+        }
+        this.#root = options.root;
+        this.#storeIdentity = options.storeIdentity;
+        const sourceKey = readHeadlessKey(options.keySource);
+        try {
+            this.#key = deriveCredentialKey(sourceKey, this.#storeIdentity);
+        }
+        finally {
+            sourceKey.fill(0);
+        }
+    }
+    async available() {
+        this.#assertOpen();
+        ensurePrivateDirectory(this.#root);
+        assertSafeDirectory(this.#root);
+        const stat = statSync(this.#root);
+        if ((stat.mode & 0o777) !== 0o700) {
+            throw new CredentialError('CREDENTIAL_STORE_PERMISSIONS', 'The headless credential directory must have mode 0700');
+        }
+        return true;
+    }
+    async store(input) {
+        const key = this.#assertOpen();
+        await this.available();
+        if (input.value.length === 0) {
+            throw new CredentialError('EMPTY_SECRET', 'Credential values must not be empty');
+        }
+        if (input.value.length > MAX_CREDENTIAL_BYTES) {
+            throw new CredentialError('SECRET_TOO_LARGE', 'Credential values exceed the headless limit');
+        }
+        const ref = input.ref ?? credentialRef(`cred:v1:headless-${randomUUID()}`);
+        const encoded = encryptCredential(key, this.#storeIdentity, ref, input.value);
+        try {
+            const path = this.#path(ref);
+            const previous = readNoFollow(path, MAX_ENCODED_BYTES);
+            if (previous === undefined)
+                writePrivateFile(path, encoded);
+            else {
+                replacePrivateFile(path, encoded, {
+                    overwrite: true,
+                    expected: (current) => {
+                        if (current === undefined || !current.equals(previous)) {
+                            throw new CredentialError('CREDENTIAL_CONFLICT', 'The headless credential changed while it was being written');
+                        }
+                    },
+                    maxExistingBytes: MAX_ENCODED_BYTES,
+                });
+            }
+        }
+        finally {
+            encoded.fill(0);
+        }
+        return ref;
+    }
+    async resolve(ref) {
+        const key = this.#assertOpen();
+        await this.available();
+        const encoded = readNoFollow(this.#path(ref), MAX_ENCODED_BYTES);
+        if (encoded === undefined) {
+            throw new CredentialError('CREDENTIAL_NOT_FOUND', `Credential ${ref} was not found`);
+        }
+        let value;
+        try {
+            value = decryptCredential(key, this.#storeIdentity, ref, encoded);
+            return new HeadlessSecretHandle(ref, value);
+        }
+        catch (error) {
+            throw new CredentialError('CREDENTIAL_INVALID', 'The encrypted headless credential is invalid', {
+                cause: error,
+            });
+        }
+        finally {
+            encoded.fill(0);
+            value?.fill(0);
+        }
+    }
+    async remove(ref) {
+        this.#assertOpen();
+        await this.available();
+        removePrivateFile(this.#path(ref));
+    }
+    dispose() {
+        this.#key?.fill(0);
+        this.#key = undefined;
+    }
+    #assertOpen() {
+        if (this.#key === undefined) {
+            throw new CredentialError('CREDENTIAL_STORE_UNAVAILABLE', 'The headless credential store is closed');
+        }
+        return this.#key;
+    }
+    #path(ref) {
+        const digest = createHash('sha256').update(ref).digest('hex');
+        return join(this.#root, `${digest}.credential`);
+    }
+}
+function deriveCredentialKey(sourceKey, storeIdentity) {
+    const identity = Buffer.from(storeIdentity, 'utf8');
+    const salt = createHash('sha256')
+        .update(`${KEY_DERIVATION_PURPOSE}:salt\u0000`, 'utf8')
+        .update(identity)
+        .digest();
+    const info = Buffer.concat([Buffer.from(`${KEY_DERIVATION_PURPOSE}\u0000`, 'utf8'), identity]);
+    try {
+        return Buffer.from(hkdfSync('sha256', sourceKey, salt, info, 32));
+    }
+    finally {
+        identity.fill(0);
+        salt.fill(0);
+        info.fill(0);
+    }
+}
+function encodeAadSegment(value) {
+    const bytes = Buffer.from(value, 'utf8');
+    const length = Buffer.from(`${bytes.length}:`, 'utf8');
+    const encoded = Buffer.concat([length, bytes]);
+    length.fill(0);
+    bytes.fill(0);
+    return encoded;
+}
+function associatedData(storeIdentity, ref) {
+    const prefix = Buffer.from(`${AAD_PURPOSE}\u0000`, 'utf8');
+    const identity = encodeAadSegment(storeIdentity);
+    const credential = encodeAadSegment(ref);
+    const aad = Buffer.concat([prefix, identity, credential]);
+    prefix.fill(0);
+    identity.fill(0);
+    credential.fill(0);
+    return aad;
+}
+function encryptCredential(key, storeIdentity, ref, value) {
+    const nonce = randomBytes(NONCE_BYTES);
+    const cipher = createCipheriv('aes-256-gcm', key, nonce);
+    const aad = associatedData(storeIdentity, ref);
+    let ciphertext;
+    try {
+        cipher.setAAD(aad);
+        ciphertext = Buffer.concat([cipher.update(value), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return Buffer.concat([Buffer.from([CREDENTIAL_FILE_VERSION]), nonce, tag, ciphertext]);
+    }
+    finally {
+        aad.fill(0);
+        ciphertext?.fill(0);
+    }
+}
+function decryptCredential(key, storeIdentity, ref, encoded) {
+    if (encoded.length < 1 + NONCE_BYTES + TAG_BYTES || encoded[0] !== CREDENTIAL_FILE_VERSION) {
+        throw new Error('Unsupported encrypted credential format');
+    }
+    const nonce = encoded.subarray(1, 1 + NONCE_BYTES);
+    const tag = encoded.subarray(1 + NONCE_BYTES, 1 + NONCE_BYTES + TAG_BYTES);
+    const ciphertext = encoded.subarray(1 + NONCE_BYTES + TAG_BYTES);
+    const decipher = createDecipheriv('aes-256-gcm', key, nonce);
+    const aad = associatedData(storeIdentity, ref);
+    let value;
+    try {
+        decipher.setAAD(aad);
+        decipher.setAuthTag(tag);
+        value = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        if (value.length > MAX_CREDENTIAL_BYTES) {
+            value.fill(0);
+            value = undefined;
+            throw new Error('Encrypted credential exceeds the headless limit');
+        }
+        return value;
+    }
+    finally {
+        aad.fill(0);
+    }
+}
+//# sourceMappingURL=headless-store.js.map

package/dist/adapters/credentials/headless-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless-store.js","sourceRoot":"","sources":["../../../src/adapters/credentials/headless-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,QAAQ,EACR,WAAW,EACX,UAAU,GACX,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAOhC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC3E,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAA0B,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAE3E,MAAM,uBAAuB,GAAG,CAAC,CAAA;AACjC,MAAM,WAAW,GAAG,EAAE,CAAA;AACtB,MAAM,SAAS,GAAG,EAAE,CAAA;AACpB,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAA;AACtC,MAAM,iBAAiB,GAAG,CAAC,GAAG,WAAW,GAAG,SAAS,GAAG,oBAAoB,CAAA;AAC5E,MAAM,sBAAsB,GAAG,yCAAyC,CAAA;AACxE,MAAM,WAAW,GAAG,kCAAkC,CAAA;AACtD,MAAM,sBAAsB,GAAG,iBAAiB,CAAA;AAEhD,MAAM,oBAAoB;IACf,GAAG,CAAe;IAC3B,MAAM,CAAoB;IAE1B,YAAY,GAAkB,EAAE,KAAiB;QAC/C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CAAC,sBAAsB,EAAE,sCAAsC,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;QACpB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;IACzB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,uBAAuB;IACzB,KAAK,CAAQ;IACb,cAAc,CAAQ;IAC/B,IAAI,CAAoB;IAExB,YAAY,OAKX;QACC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,eAAe,CACvB,2BAA2B,EAC3B,0EAA0E,CAC3E,CAAA;QACH,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAA;QACzB,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAA;QAC3C,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACpD,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;QACjE,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,WAAW,EAAE,CAAA;QAClB,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,eAAe,CACvB,8BAA8B,EAC9B,uDAAuD,CACxD,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAA2B;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAC9B,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QACtB,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,qCAAqC,CAAC,CAAA;QAClF,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;YAC9C,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,6CAA6C,CAAC,CAAA;QAC9F,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,aAAa,CAAC,oBAAoB,UAAU,EAAE,EAAE,CAAC,CAAA;QAC1E,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;QAC7E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC5B,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;YACtD,IAAI,QAAQ,KAAK,SAAS;gBAAE,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;iBACtD,CAAC;gBACJ,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE;oBAChC,SAAS,EAAE,IAAI;oBACf,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;wBACpB,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;4BACvD,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,4DAA4D,CAC7D,CAAA;wBACH,CAAC;oBACH,CAAC;oBACD,gBAAgB,EAAE,iBAAiB;iBACpC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAkB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAC9B,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QACtB,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,iBAAiB,CAAC,CAAA;QAChE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CAAC,sBAAsB,EAAE,cAAc,GAAG,gBAAgB,CAAC,CAAA;QACtF,CAAC;QACD,IAAI,KAAyB,CAAA;QAC7B,IAAI,CAAC;YACH,KAAK,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;YACjE,OAAO,IAAI,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,8CAA8C,EAC9C;gBACE,KAAK,EAAE,KAAK;aACb,CACF,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACf,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAkB;QAC7B,IAAI,CAAC,WAAW,EAAE,CAAA;QAClB,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QACtB,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IACpC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;QAClB,IAAI,CAAC,IAAI,GAAG,SAAS,CAAA;IACvB,CAAC;IAED,WAAW;QACT,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,eAAe,CACvB,8BAA8B,EAC9B,yCAAyC,CAC1C,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED,KAAK,CAAC,GAAkB;QACtB,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,CAAA;IACjD,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,SAAiB,EAAE,aAAqB;IACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC9B,MAAM,CAAC,GAAG,sBAAsB,aAAa,EAAE,MAAM,CAAC;SACtD,MAAM,CAAC,QAAQ,CAAC;SAChB,MAAM,EAAE,CAAA;IACX,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,sBAAsB,QAAQ,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC9F,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;IACnE,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACZ,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,MAAM,CAAC,CAAA;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;IAC9C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACd,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACb,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,aAAqB,EAAE,GAAkB;IAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC1D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAA;IACzD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACd,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChB,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAClB,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAW,EACX,aAAqB,EACrB,GAAkB,EAClB,KAAiB;IAEjB,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACxD,MAAM,GAAG,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,CAAC,CAAA;IAC9C,IAAI,UAA8B,CAAA;IAClC,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAClB,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAA;IACxF,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACX,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IACrB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAW,EACX,aAAqB,EACrB,GAAkB,EAClB,OAAe;IAEf,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,WAAW,GAAG,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,uBAAuB,EAAE,CAAC;QAC3F,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CAAA;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,WAAW,EAAE,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC,CAAA;IAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC,CAAA;IAChE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IAC5D,MAAM,GAAG,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,CAAC,CAAA;IAC9C,IAAI,KAAyB,CAAA;IAC7B,IAAI,CAAC;QACH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACpB,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QACxB,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QACtE,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACb,KAAK,GAAG,SAAS,CAAA;YACjB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/adapters/credentials/memory.d.ts

@@ -0,0 +1,11 @@
+import type { CredentialPort, CredentialRef, CredentialStoreInput, SecretHandle } from '../../ports/credentials.js';
+export declare class MemoryCredentialStore implements CredentialPort {
+    #private;
+    setAvailable(available: boolean): void;
+    store(input: CredentialStoreInput): Promise<CredentialRef>;
+    resolve(ref: CredentialRef): Promise<SecretHandle>;
+    remove(ref: CredentialRef): Promise<void>;
+    available(): Promise<boolean>;
+    has(ref: CredentialRef): boolean;
+}
+//# sourceMappingURL=memory.d.ts.map

package/dist/adapters/credentials/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../src/adapters/credentials/memory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,YAAY,EACb,MAAM,4BAA4B,CAAA;AAuBnC,qBAAa,qBAAsB,YAAW,cAAc;;IAI1D,YAAY,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAErC;IAEK,KAAK,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,CAU/D;IAEK,OAAO,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAKvD;IAEK,MAAM,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9C;IAEK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAElC;IAED,GAAG,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAE/B;CAUF"}

package/dist/adapters/credentials/memory.js

@@ -0,0 +1,63 @@
+import { randomUUID } from 'node:crypto';
+import { CredentialError, credentialRef } from '../../ports/credentials.js';
+class MemorySecretHandle {
+    ref;
+    #value;
+    constructor(ref, value) {
+        this.ref = ref;
+        this.#value = Buffer.from(value);
+    }
+    read() {
+        if (!this.#value)
+            throw new CredentialError('SECRET_HANDLE_CLOSED', 'Secret handle is closed');
+        return Buffer.from(this.#value);
+    }
+    dispose() {
+        this.#value?.fill(0);
+        this.#value = undefined;
+    }
+}
+export class MemoryCredentialStore {
+    #values = new Map();
+    #available = true;
+    setAvailable(available) {
+        this.#available = available;
+    }
+    async store(input) {
+        this.#assertAvailable();
+        const ref = input.ref ?? credentialRef(`cred:v1:memory-${randomUUID()}`);
+        const value = Buffer.from(input.value);
+        if (value.length === 0)
+            throw new CredentialError('EMPTY_SECRET', 'Credential values must not be empty');
+        const previous = this.#values.get(ref);
+        previous?.fill(0);
+        this.#values.set(ref, value);
+        return ref;
+    }
+    async resolve(ref) {
+        this.#assertAvailable();
+        const value = this.#values.get(ref);
+        if (!value)
+            throw new CredentialError('CREDENTIAL_NOT_FOUND', `Credential ${ref} was not found`);
+        return new MemorySecretHandle(ref, value);
+    }
+    async remove(ref) {
+        this.#assertAvailable();
+        const value = this.#values.get(ref);
+        if (value)
+            value.fill(0);
+        this.#values.delete(ref);
+    }
+    async available() {
+        return this.#available;
+    }
+    has(ref) {
+        return this.#values.has(ref);
+    }
+    #assertAvailable() {
+        if (!this.#available) {
+            throw new CredentialError('CREDENTIAL_STORE_UNAVAILABLE', 'The in-memory credential store has been disabled');
+        }
+    }
+}
+//# sourceMappingURL=memory.js.map

package/dist/adapters/credentials/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../../src/adapters/credentials/memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAOxC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE3E,MAAM,kBAAkB;IACb,GAAG,CAAe;IAC3B,MAAM,CAAoB;IAE1B,YAAY,GAAkB,EAAE,KAAiB;QAC/C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,IAAI;QACF,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,CAAA;QAC9F,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;QACpB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;IACzB,CAAC;CACF;AAED,MAAM,OAAO,qBAAqB;IACvB,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAA;IACnD,UAAU,GAAG,IAAI,CAAA;IAEjB,YAAY,CAAC,SAAkB;QAC7B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAA;IAC7B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAA2B;QACrC,IAAI,CAAC,gBAAgB,EAAE,CAAA;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,aAAa,CAAC,kBAAkB,UAAU,EAAE,EAAE,CAAC,CAAA;QACxE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YACpB,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,qCAAqC,CAAC,CAAA;QAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACtC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC5B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAkB;QAC9B,IAAI,CAAC,gBAAgB,EAAE,CAAA;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,eAAe,CAAC,sBAAsB,EAAE,cAAc,GAAG,gBAAgB,CAAC,CAAA;QAChG,OAAO,IAAI,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAkB;QAC7B,IAAI,CAAC,gBAAgB,EAAE,CAAA;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACxB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAED,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,GAAG,CAAC,GAAkB;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC;IAED,gBAAgB;QACd,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,eAAe,CACvB,8BAA8B,EAC9B,kDAAkD,CACnD,CAAA;QACH,CAAC;IACH,CAAC;CACF"}