@true-and-useful/janee 0.8.3 → 0.8.5

package/dist/providers/filesystem.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Filesystem Secrets Provider
+ *
+ * Wraps Janee's existing AES-256-GCM encrypted local storage.
+ * This is the default provider -- backward compatible with existing configs.
+ */
+import { SecretsProvider, HealthCheckResult, ProviderConfig } from './types';
+export declare class FilesystemProvider implements SecretsProvider {
+    readonly name: string;
+    readonly type = "filesystem";
+    private secretsDir;
+    private masterKey;
+    private initialized;
+    constructor(config: ProviderConfig);
+    initialize(): Promise<void>;
+    getSecret(secretPath: string): Promise<string | null>;
+    setSecret(secretPath: string, value: string): Promise<void>;
+    deleteSecret(secretPath: string): Promise<void>;
+    listSecrets(prefix?: string): Promise<string[]>;
+    dispose(): Promise<void>;
+    healthCheck(): Promise<HealthCheckResult>;
+    private ensureInitialized;
+    /**
+     * Securely resolve a secret path to a filesystem path.
+     *
+     * Security: Uses path.resolve + prefix check to guarantee the resolved
+     * path is contained within secretsDir. Rejects absolute paths and
+     * traversal attempts via validateSecretPath() and a post-resolution
+     * containment check.
+     */
+    private resolvePath;
+    private walkDir;
+}
+//# sourceMappingURL=filesystem.d.ts.map

package/dist/providers/filesystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.d.ts","sourceRoot":"","sources":["../../src/providers/filesystem.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAoD,MAAM,SAAS,CAAC;AAU/H,qBAAa,kBAAmB,YAAW,eAAe;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,gBAAgB;IAE7B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,WAAW,CAAS;gBAEhB,MAAM,EAAE,cAAc;IAoB5B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ3B,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAqBrD,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc3D,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU/C,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgB/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,WAAW,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAqB/C,OAAO,CAAC,iBAAiB;IAUzB;;;;;;;OAOG;IACH,OAAO,CAAC,WAAW;IAuBnB,OAAO,CAAC,OAAO;CAchB"}

package/dist/providers/filesystem.js

@@ -0,0 +1,143 @@
+"use strict";
+/**
+ * Filesystem Secrets Provider
+ *
+ * Wraps Janee's existing AES-256-GCM encrypted local storage.
+ * This is the default provider -- backward compatible with existing configs.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FilesystemProvider = void 0;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const types_1 = require("./types");
+const crypto_1 = require("../core/crypto");
+class FilesystemProvider {
+    name;
+    type = 'filesystem';
+    secretsDir;
+    masterKey;
+    initialized = false;
+    constructor(config) {
+        this.name = config.name;
+        const fsConfig = config.config;
+        if (!fsConfig.masterKey) {
+            throw new types_1.SecretError(types_1.SecretErrorCode.CONFIG_ERROR, `FilesystemProvider "${config.name}": masterKey is required`, { provider: config.name });
+        }
+        this.masterKey = fsConfig.masterKey;
+        this.secretsDir = path_1.default.resolve(fsConfig.path || path_1.default.join(process.env.HOME || process.env.USERPROFILE || '/tmp', '.janee', 'credentials'));
+    }
+    async initialize() {
+        // Ensure directory exists
+        if (!fs_1.default.existsSync(this.secretsDir)) {
+            fs_1.default.mkdirSync(this.secretsDir, { recursive: true, mode: 0o700 });
+        }
+        this.initialized = true;
+    }
+    async getSecret(secretPath) {
+        this.ensureInitialized();
+        const filePath = this.resolvePath(secretPath);
+        if (!fs_1.default.existsSync(filePath)) {
+            return null;
+        }
+        try {
+            const encrypted = fs_1.default.readFileSync(filePath, 'utf8').trim();
+            return (0, crypto_1.decryptSecret)(encrypted, this.masterKey);
+        }
+        catch (err) {
+            throw new types_1.SecretError(types_1.SecretErrorCode.CRYPTO_ERROR, `FilesystemProvider "${this.name}": failed to decrypt "${secretPath}": ${err.message}`, { provider: this.name, secretPath, cause: err });
+        }
+    }
+    async setSecret(secretPath, value) {
+        this.ensureInitialized();
+        const filePath = this.resolvePath(secretPath);
+        const dir = path_1.default.dirname(filePath);
+        if (!fs_1.default.existsSync(dir)) {
+            fs_1.default.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        }
+        const encrypted = (0, crypto_1.encryptSecret)(value, this.masterKey);
+        fs_1.default.writeFileSync(filePath, encrypted, { mode: 0o600 });
+    }
+    async deleteSecret(secretPath) {
+        this.ensureInitialized();
+        const filePath = this.resolvePath(secretPath);
+        if (fs_1.default.existsSync(filePath)) {
+            fs_1.default.unlinkSync(filePath);
+        }
+    }
+    async listSecrets(prefix) {
+        this.ensureInitialized();
+        const searchDir = prefix
+            ? path_1.default.join(this.secretsDir, prefix)
+            : this.secretsDir;
+        if (!fs_1.default.existsSync(searchDir)) {
+            return [];
+        }
+        return this.walkDir(searchDir).map(filePath => path_1.default.relative(this.secretsDir, filePath));
+    }
+    async dispose() {
+        this.initialized = false;
+    }
+    async healthCheck() {
+        const start = Date.now();
+        try {
+            // Check directory exists and is writable
+            if (!fs_1.default.existsSync(this.secretsDir)) {
+                return { healthy: false, error: `Directory not found: ${this.secretsDir}` };
+            }
+            fs_1.default.accessSync(this.secretsDir, fs_1.default.constants.R_OK | fs_1.default.constants.W_OK);
+            return { healthy: true, latencyMs: Date.now() - start };
+        }
+        catch (err) {
+            return {
+                healthy: false,
+                error: `Cannot access ${this.secretsDir}: ${err.message}`,
+                latencyMs: Date.now() - start
+            };
+        }
+    }
+    ensureInitialized() {
+        if (!this.initialized) {
+            throw new types_1.SecretError(types_1.SecretErrorCode.NOT_INITIALIZED, `FilesystemProvider "${this.name}": not initialized. Call initialize() first.`, { provider: this.name });
+        }
+    }
+    /**
+     * Securely resolve a secret path to a filesystem path.
+     *
+     * Security: Uses path.resolve + prefix check to guarantee the resolved
+     * path is contained within secretsDir. Rejects absolute paths and
+     * traversal attempts via validateSecretPath() and a post-resolution
+     * containment check.
+     */
+    resolvePath(secretPath) {
+        // Validate path structure (rejects .., absolute paths, etc.)
+        (0, types_1.validateSecretPath)(secretPath);
+        // Resolve to absolute path
+        const resolved = path_1.default.resolve(this.secretsDir, secretPath);
+        // Containment check: resolved path MUST be inside secretsDir
+        const secretsDirWithSep = this.secretsDir.endsWith(path_1.default.sep)
+            ? this.secretsDir
+            : this.secretsDir + path_1.default.sep;
+        if (!resolved.startsWith(secretsDirWithSep) && resolved !== this.secretsDir) {
+            throw new types_1.SecretError(types_1.SecretErrorCode.INVALID_PATH, `Path "${secretPath}" resolves outside secrets directory`, { provider: this.name, secretPath });
+        }
+        return resolved;
+    }
+    walkDir(dir) {
+        const results = [];
+        for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
+            const fullPath = path_1.default.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                results.push(...this.walkDir(fullPath));
+            }
+            else if (entry.isFile()) {
+                results.push(fullPath);
+            }
+        }
+        return results;
+    }
+}
+exports.FilesystemProvider = FilesystemProvider;
+//# sourceMappingURL=filesystem.js.map

package/dist/providers/filesystem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.js","sourceRoot":"","sources":["../../src/providers/filesystem.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;AAEH,4CAAoB;AACpB,gDAAwB;AACxB,mCAA+H;AAC/H,2CAA8D;AAS9D,MAAa,kBAAkB;IACpB,IAAI,CAAS;IACb,IAAI,GAAG,YAAY,CAAC;IAErB,UAAU,CAAS;IACnB,SAAS,CAAS;IAClB,WAAW,GAAG,KAAK,CAAC;IAE5B,YAAY,MAAsB;QAChC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAqC,CAAC;QAE9D,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mBAAW,CACnB,uBAAe,CAAC,YAAY,EAC5B,uBAAuB,MAAM,CAAC,IAAI,0BAA0B,EAC5D,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAC1B,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,cAAI,CAAC,IAAI,CACvD,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,EACrD,QAAQ,EACR,aAAa,CACd,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU;QACd,0BAA0B;QAC1B,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,YAAE,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAE9C,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,YAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,OAAO,IAAA,sBAAa,EAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,mBAAW,CACnB,uBAAe,CAAC,YAAY,EAC5B,uBAAuB,IAAI,CAAC,IAAI,yBAAyB,UAAU,MAAO,GAAa,CAAC,OAAO,EAAE,EACjG,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAY,EAAE,CACzD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,KAAa;QAC/C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEnC,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,YAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,SAAS,GAAG,IAAA,sBAAa,EAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvD,YAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAAkB;QACnC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAE9C,IAAI,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAe;QAC/B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,SAAS,GAAG,MAAM;YACtB,CAAC,CAAC,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC;YACpC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;QAEpB,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAChC,QAAQ,CAAC,EAAE,CAAC,cAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CACrD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,IAAI,CAAC;YACH,yCAAyC;YACzC,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAC9E,CAAC;YAED,YAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,YAAE,CAAC,SAAS,CAAC,IAAI,GAAG,YAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAEtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,iBAAiB,IAAI,CAAC,UAAU,KAAM,GAAa,CAAC,OAAO,EAAE;gBACpE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,mBAAW,CACnB,uBAAe,CAAC,eAAe,EAC/B,uBAAuB,IAAI,CAAC,IAAI,8CAA8C,EAC9E,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,WAAW,CAAC,UAAkB;QACpC,6DAA6D;QAC7D,IAAA,0BAAkB,EAAC,UAAU,CAAC,CAAC;QAE/B,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAE3D,6DAA6D;QAC7D,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAI,CAAC,GAAG,CAAC;YAC1D,CAAC,CAAC,IAAI,CAAC,UAAU;YACjB,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,cAAI,CAAC,GAAG,CAAC;QAE/B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,QAAQ,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAC5E,MAAM,IAAI,mBAAW,CACnB,uBAAe,CAAC,YAAY,EAC5B,SAAS,UAAU,sCAAsC,EACzD,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,CACpC,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,OAAO,CAAC,GAAW;QACzB,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,KAAK,IAAI,YAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACjE,MAAM,QAAQ,GAAG,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1C,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAjLD,gDAiLC"}

package/dist/providers/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Janee Secrets Provider System
+ *
+ * Plugin architecture for multiple secrets backends.
+ * See RFC 0005: docs/rfcs/0005-plugin-architecture.md
+ *
+ * Built-in providers:
+ *   - filesystem: AES-256-GCM encrypted local storage (default)
+ *   - env: Environment variables
+ *
+ * Usage:
+ *   import { createProvider, resolveSecret } from './providers';
+ *
+ *   await createProvider({ name: 'local', type: 'filesystem', config: { masterKey: '...' } });
+ *   await createProvider({ name: 'ci', type: 'env', config: { prefix: 'JANEE_' } });
+ *
+ *   const key = await resolveSecret('local://stripe/api-key');
+ *   const token = await resolveSecret('ci://GITHUB_TOKEN');
+ */
+export { createProvider, getProvider, resolveSecret, healthCheckAll, disposeAll, registerProviderType, parseProviderURI, } from './registry';
+export type { SecretsProvider, ProviderConfig, ProviderFactory, HealthCheckResult, } from './types';
+export { SecretError, SecretErrorCode, validateSecretPath, } from './types';
+export { FilesystemProvider } from './filesystem';
+export { EnvProvider } from './env';
+//# sourceMappingURL=index.d.ts.map

package/dist/providers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EACL,cAAc,EACd,WAAW,EACX,aAAa,EACb,cAAc,EACd,UAAU,EACV,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,eAAe,EACf,cAAc,EACd,eAAe,EACf,iBAAiB,GAClB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,WAAW,EACX,eAAe,EACf,kBAAkB,GACnB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC"}

package/dist/providers/index.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * Janee Secrets Provider System
+ *
+ * Plugin architecture for multiple secrets backends.
+ * See RFC 0005: docs/rfcs/0005-plugin-architecture.md
+ *
+ * Built-in providers:
+ *   - filesystem: AES-256-GCM encrypted local storage (default)
+ *   - env: Environment variables
+ *
+ * Usage:
+ *   import { createProvider, resolveSecret } from './providers';
+ *
+ *   await createProvider({ name: 'local', type: 'filesystem', config: { masterKey: '...' } });
+ *   await createProvider({ name: 'ci', type: 'env', config: { prefix: 'JANEE_' } });
+ *
+ *   const key = await resolveSecret('local://stripe/api-key');
+ *   const token = await resolveSecret('ci://GITHUB_TOKEN');
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnvProvider = exports.FilesystemProvider = exports.validateSecretPath = exports.SecretErrorCode = exports.SecretError = exports.parseProviderURI = exports.registerProviderType = exports.disposeAll = exports.healthCheckAll = exports.resolveSecret = exports.getProvider = exports.createProvider = void 0;
+var registry_1 = require("./registry");
+Object.defineProperty(exports, "createProvider", { enumerable: true, get: function () { return registry_1.createProvider; } });
+Object.defineProperty(exports, "getProvider", { enumerable: true, get: function () { return registry_1.getProvider; } });
+Object.defineProperty(exports, "resolveSecret", { enumerable: true, get: function () { return registry_1.resolveSecret; } });
+Object.defineProperty(exports, "healthCheckAll", { enumerable: true, get: function () { return registry_1.healthCheckAll; } });
+Object.defineProperty(exports, "disposeAll", { enumerable: true, get: function () { return registry_1.disposeAll; } });
+Object.defineProperty(exports, "registerProviderType", { enumerable: true, get: function () { return registry_1.registerProviderType; } });
+Object.defineProperty(exports, "parseProviderURI", { enumerable: true, get: function () { return registry_1.parseProviderURI; } });
+var types_1 = require("./types");
+Object.defineProperty(exports, "SecretError", { enumerable: true, get: function () { return types_1.SecretError; } });
+Object.defineProperty(exports, "SecretErrorCode", { enumerable: true, get: function () { return types_1.SecretErrorCode; } });
+Object.defineProperty(exports, "validateSecretPath", { enumerable: true, get: function () { return types_1.validateSecretPath; } });
+var filesystem_1 = require("./filesystem");
+Object.defineProperty(exports, "FilesystemProvider", { enumerable: true, get: function () { return filesystem_1.FilesystemProvider; } });
+var env_1 = require("./env");
+Object.defineProperty(exports, "EnvProvider", { enumerable: true, get: function () { return env_1.EnvProvider; } });
+//# sourceMappingURL=index.js.map

package/dist/providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AAEH,uCAQoB;AAPlB,0GAAA,cAAc,OAAA;AACd,uGAAA,WAAW,OAAA;AACX,yGAAA,aAAa,OAAA;AACb,0GAAA,cAAc,OAAA;AACd,sGAAA,UAAU,OAAA;AACV,gHAAA,oBAAoB,OAAA;AACpB,4GAAA,gBAAgB,OAAA;AAUlB,iCAIiB;AAHf,oGAAA,WAAW,OAAA;AACX,wGAAA,eAAe,OAAA;AACf,2GAAA,kBAAkB,OAAA;AAGpB,2CAAkD;AAAzC,gHAAA,kBAAkB,OAAA;AAC3B,6BAAoC;AAA3B,kGAAA,WAAW,OAAA"}

package/dist/providers/registry.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Provider Registry
+ *
+ * Central registry for secrets provider factories.
+ * Resolves provider URIs and manages provider lifecycle.
+ */
+import { SecretsProvider, ProviderConfig, ProviderFactory } from './types';
+/**
+ * Register a built-in provider factory.
+ */
+export declare function registerProviderType(type: string, factory: ProviderFactory): void;
+/**
+ * Create and register a provider instance from config.
+ */
+export declare function createProvider(config: ProviderConfig): Promise<SecretsProvider>;
+/**
+ * Get a registered provider instance by name.
+ */
+export declare function getProvider(name: string): SecretsProvider | undefined;
+/**
+ * Resolve a secret value from a URI like "vault://path/to/secret"
+ * or a plain path (uses the default provider).
+ *
+ * @param uri - Provider URI or plain secret path
+ * @param defaultProvider - Provider name to use when no scheme is specified
+ */
+export declare function resolveSecret(uri: string, defaultProvider?: string): Promise<string | null>;
+/**
+ * Run health checks on all registered providers.
+ */
+export declare function healthCheckAll(): Promise<Map<string, {
+    healthy: boolean;
+    error?: string;
+}>>;
+/**
+ * Dispose all provider instances and clear registries.
+ */
+export declare function disposeAll(): Promise<void>;
+export { parseProviderURI } from './types';
+//# sourceMappingURL=registry.d.ts.map

package/dist/providers/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/providers/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,EAAkD,MAAM,SAAS,CAAC;AAc3H;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,IAAI,CAQjF;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAerF;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAErE;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,eAAe,GAAE,MAAgB,GAChC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB;AAED;;GAEG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAYjG;AAED;;GAEG;AACH,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAoBhD;AAGD,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC"}

package/dist/providers/registry.js

@@ -0,0 +1,113 @@
+"use strict";
+/**
+ * Provider Registry
+ *
+ * Central registry for secrets provider factories.
+ * Resolves provider URIs and manages provider lifecycle.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseProviderURI = void 0;
+exports.registerProviderType = registerProviderType;
+exports.createProvider = createProvider;
+exports.getProvider = getProvider;
+exports.resolveSecret = resolveSecret;
+exports.healthCheckAll = healthCheckAll;
+exports.disposeAll = disposeAll;
+const types_1 = require("./types");
+const filesystem_1 = require("./filesystem");
+const env_1 = require("./env");
+/**
+ * Registry of provider factories by type name.
+ */
+const factories = new Map();
+/**
+ * Active provider instances by name.
+ */
+const instances = new Map();
+/**
+ * Register a built-in provider factory.
+ */
+function registerProviderType(type, factory) {
+    if (factories.has(type)) {
+        throw new types_1.SecretError(types_1.SecretErrorCode.CONFIG_ERROR, `Provider type "${type}" is already registered`);
+    }
+    factories.set(type, factory);
+}
+/**
+ * Create and register a provider instance from config.
+ */
+async function createProvider(config) {
+    const factory = factories.get(config.type);
+    if (!factory) {
+        const available = Array.from(factories.keys()).join(', ');
+        throw new types_1.SecretError(types_1.SecretErrorCode.CONFIG_ERROR, `Unknown provider type "${config.type}". Available types: ${available}`, { provider: config.name });
+    }
+    const provider = factory(config);
+    await provider.initialize();
+    instances.set(config.name, provider);
+    return provider;
+}
+/**
+ * Get a registered provider instance by name.
+ */
+function getProvider(name) {
+    return instances.get(name);
+}
+/**
+ * Resolve a secret value from a URI like "vault://path/to/secret"
+ * or a plain path (uses the default provider).
+ *
+ * @param uri - Provider URI or plain secret path
+ * @param defaultProvider - Provider name to use when no scheme is specified
+ */
+async function resolveSecret(uri, defaultProvider = 'local') {
+    const { provider: providerName, path } = (0, types_1.parseProviderURI)(uri);
+    const name = providerName || defaultProvider;
+    const provider = instances.get(name);
+    if (!provider) {
+        const available = Array.from(instances.keys()).join(', ');
+        throw new types_1.SecretError(types_1.SecretErrorCode.CONFIG_ERROR, `Provider "${name}" not found. Registered providers: ${available}`, { provider: name, secretPath: path });
+    }
+    return provider.getSecret(path);
+}
+/**
+ * Run health checks on all registered providers.
+ */
+async function healthCheckAll() {
+    const results = new Map();
+    for (const [name, provider] of instances) {
+        try {
+            results.set(name, await provider.healthCheck());
+        }
+        catch (err) {
+            results.set(name, { healthy: false, error: err.message });
+        }
+    }
+    return results;
+}
+/**
+ * Dispose all provider instances and clear registries.
+ */
+async function disposeAll() {
+    const errors = [];
+    for (const [name, provider] of instances) {
+        try {
+            await provider.dispose();
+        }
+        catch (err) {
+            errors.push(err);
+        }
+    }
+    instances.clear();
+    factories.clear();
+    if (errors.length > 0) {
+        throw new types_1.SecretError(types_1.SecretErrorCode.INTERNAL, `Failed to dispose ${errors.length} provider(s): ${errors.map(e => e.message).join('; ')}`);
+    }
+}
+// Re-export parseProviderURI from types
+var types_2 = require("./types");
+Object.defineProperty(exports, "parseProviderURI", { enumerable: true, get: function () { return types_2.parseProviderURI; } });
+// Register built-in provider types
+registerProviderType('filesystem', (config) => new filesystem_1.FilesystemProvider(config));
+registerProviderType('env', (config) => new env_1.EnvProvider(config));
+//# sourceMappingURL=registry.js.map

package/dist/providers/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/providers/registry.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAmBH,oDAQC;AAKD,wCAeC;AAKD,kCAEC;AASD,sCAkBC;AAKD,wCAYC;AAKD,gCAoBC;AAzHD,mCAA2H;AAC3H,6CAAkD;AAClD,+BAAoC;AAEpC;;GAEG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;AAErD;;GAEG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;AAErD;;GAEG;AACH,SAAgB,oBAAoB,CAAC,IAAY,EAAE,OAAwB;IACzE,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,mBAAW,CACnB,uBAAe,CAAC,YAAY,EAC5B,kBAAkB,IAAI,yBAAyB,CAChD,CAAC;IACJ,CAAC;IACD,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,cAAc,CAAC,MAAsB;IACzD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,IAAI,mBAAW,CACnB,uBAAe,CAAC,YAAY,EAC5B,0BAA0B,MAAM,CAAC,IAAI,uBAAuB,SAAS,EAAE,EACvE,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;IAC5B,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW,CAAC,IAAY;IACtC,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,kBAA0B,OAAO;IAEjC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,IAAA,wBAAgB,EAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,YAAY,IAAI,eAAe,CAAC;IAE7C,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,IAAI,mBAAW,CACnB,uBAAe,CAAC,YAAY,EAC5B,aAAa,IAAI,sCAAsC,SAAS,EAAE,EAClE,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CACrC,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,cAAc;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAgD,CAAC;IAExE,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,UAAU;IAC9B,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,GAAY,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,SAAS,CAAC,KAAK,EAAE,CAAC;IAElB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,mBAAW,CACnB,uBAAe,CAAC,QAAQ,EACxB,qBAAqB,MAAM,CAAC,MAAM,iBAAiB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,wCAAwC;AACxC,iCAA2C;AAAlC,yGAAA,gBAAgB,OAAA;AAEzB,mCAAmC;AACnC,oBAAoB,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,+BAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/E,oBAAoB,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,iBAAW,CAAC,MAAM,CAAC,CAAC,CAAC"}

package/dist/providers/types.d.ts

@@ -0,0 +1,137 @@
+/**
+ * Secrets Provider Plugin Interface
+ *
+ * Defines the contract all secrets providers must implement.
+ * See RFC 0005 for full design: docs/rfcs/0005-plugin-architecture.md
+ */
+/**
+ * Error codes for categorizing secrets operation failures.
+ * Enables callers to handle errors programmatically without message matching.
+ */
+export declare enum SecretErrorCode {
+    /** Provider is not initialized (call initialize() first) */
+    NOT_INITIALIZED = "NOT_INITIALIZED",
+    /** Secret was not found (normal -- not an error for most callers) */
+    NOT_FOUND = "NOT_FOUND",
+    /** Authentication failure (bad credentials, expired token) */
+    AUTH_FAILED = "AUTH_FAILED",
+    /** Permission denied (authenticated but not authorized) */
+    ACCESS_DENIED = "ACCESS_DENIED",
+    /** Provider unreachable (network error, timeout) */
+    PROVIDER_UNAVAILABLE = "PROVIDER_UNAVAILABLE",
+    /** Secret path is invalid (traversal attempt, bad characters) */
+    INVALID_PATH = "INVALID_PATH",
+    /** URI format is invalid */
+    INVALID_URI = "INVALID_URI",
+    /** Encryption/decryption failure */
+    CRYPTO_ERROR = "CRYPTO_ERROR",
+    /** Provider-specific configuration error */
+    CONFIG_ERROR = "CONFIG_ERROR",
+    /** Generic internal error */
+    INTERNAL = "INTERNAL"
+}
+/**
+ * Typed error for secrets operations.
+ * Enables programmatic error handling without message parsing.
+ */
+export declare class SecretError extends Error {
+    readonly code: SecretErrorCode;
+    readonly provider?: string;
+    readonly secretPath?: string;
+    constructor(code: SecretErrorCode, message: string, options?: {
+        provider?: string;
+        secretPath?: string;
+        cause?: Error;
+    });
+}
+/**
+ * Core interface that all secrets providers must implement.
+ */
+export interface SecretsProvider {
+    /** Human-readable provider name (e.g., "my-vault") */
+    readonly name: string;
+    /** Provider type identifier (e.g., "hashicorp-vault", "aws-secrets-manager") */
+    readonly type: string;
+    /**
+     * Initialize the provider (connect, authenticate, validate config).
+     * Called once before any secret operations.
+     * @throws SecretError if provider cannot be initialized
+     */
+    initialize(): Promise<void>;
+    /**
+     * Retrieve a secret by path.
+     * @param path - Provider-specific path (e.g., "mcp/agents/stripe/api-key")
+     * @returns The secret value, or null if not found
+     * @throws SecretError on connection/auth errors (NOT on missing secrets)
+     */
+    getSecret(path: string): Promise<string | null>;
+    /**
+     * Store a secret. Optional -- not all providers support writes.
+     * @param path - Provider-specific path
+     * @param value - Secret value to store
+     */
+    setSecret?(path: string, value: string): Promise<void>;
+    /**
+     * Delete a secret. Optional.
+     */
+    deleteSecret?(path: string): Promise<void>;
+    /**
+     * List available secret paths. Optional -- useful for CLI tooling.
+     */
+    listSecrets?(prefix?: string): Promise<string[]>;
+    /**
+     * Clean up resources (close connections, etc.).
+     */
+    dispose(): Promise<void>;
+    /**
+     * Health check -- is the provider accessible and authenticated?
+     */
+    healthCheck(): Promise<HealthCheckResult>;
+}
+export interface HealthCheckResult {
+    healthy: boolean;
+    error?: string;
+    /** Optional latency in milliseconds */
+    latencyMs?: number;
+}
+/**
+ * Configuration for a provider instance.
+ * The `config` field is provider-type-specific.
+ */
+export interface ProviderConfig {
+    /** Instance name (referenced in service configs) */
+    name: string;
+    /** Provider type (determines which class to instantiate) */
+    type: string;
+    /** Type-specific configuration */
+    config: Record<string, unknown>;
+}
+/**
+ * Factory function type for creating provider instances.
+ */
+export type ProviderFactory = (config: ProviderConfig) => SecretsProvider;
+/**
+ * Parse a provider URI like "vault://mcp/stripe/api-key"
+ * Returns { provider: "vault", path: "mcp/stripe/api-key" }
+ * If no scheme, returns { provider: null, path: original }
+ *
+ * Enforces:
+ *   - Provider names normalized to lowercase, 1-64 chars
+ *   - Percent-decoding of path components
+ *   - Rejection of ".." path segments (traversal prevention)
+ *   - Max path length of 1024 characters
+ *
+ * @throws SecretError with INVALID_URI code on validation failure
+ */
+export declare function parseProviderURI(uri: string): {
+    provider: string | null;
+    path: string;
+};
+/**
+ * Validate a secret path for safety.
+ * Rejects traversal attempts, overly long paths, and empty paths.
+ *
+ * @throws SecretError with INVALID_PATH code on validation failure
+ */
+export declare function validateSecretPath(secretPath: string): void;
+//# sourceMappingURL=types.d.ts.map

package/dist/providers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/providers/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;GAGG;AACH,oBAAY,eAAe;IACzB,4DAA4D;IAC5D,eAAe,oBAAoB;IACnC,qEAAqE;IACrE,SAAS,cAAc;IACvB,8DAA8D;IAC9D,WAAW,gBAAgB;IAC3B,2DAA2D;IAC3D,aAAa,kBAAkB;IAC/B,oDAAoD;IACpD,oBAAoB,yBAAyB;IAC7C,iEAAiE;IACjE,YAAY,iBAAiB;IAC7B,4BAA4B;IAC5B,WAAW,gBAAgB;IAC3B,oCAAoC;IACpC,YAAY,iBAAiB;IAC7B,4CAA4C;IAC5C,YAAY,iBAAiB;IAC7B,6BAA6B;IAC7B,QAAQ,aAAa;CACtB;AAED;;;GAGG;AACH,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAG3B,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,KAAK,CAAA;KAAE;CAQtE;AAID;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;;OAIG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEhD;;;;OAIG;IACH,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD;;OAEG;IACH,YAAY,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3C;;OAEG;IACH,WAAW,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjD;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzB;;OAEG;IACH,WAAW,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,cAAc,KAAK,eAAe,CAAC;AAW1E;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAgDvF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CA8B3D"}