@vectle/cli 1.0.0 → 1.1.0

package/dist/runtime.js

@@ -0,0 +1,276 @@
+import { createHash } from 'node:crypto';
+import { chmodSync, cpSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync } from 'node:fs';
+import { dirname, isAbsolute, join, relative, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { atomicWriteJson } from './state.js';
+import { CLI_VERSION } from './constants.js';
+const forbiddenSegments = [
+    '/.npm/_npx/',
+    '/node_modules/.cache/',
+    '/.cache/node/',
+    '/npm/_cacache/',
+    '/.volta/tools/image/',
+    '/.asdf/installs/nodejs/',
+    '/.nvm/versions/node/',
+    '/.mise/installs/node/',
+    '/homebrew/cellar/',
+    '/tmp/',
+    '/var/folders/',
+];
+function normalizedPath(value) { return value.replaceAll('\\', '/').toLowerCase(); }
+export function digestFile(path) {
+    const hash = createHash('sha256');
+    hash.update(readFileSync(path));
+    return `sha256:${hash.digest('hex')}`;
+}
+export function isEphemeralPath(path) {
+    const normalized = normalizedPath(path);
+    return forbiddenSegments.some(segment => normalized.includes(segment));
+}
+function nodeMajor(version) {
+    const match = /^v?(\d+)(?:\.|$)/u.exec(version);
+    return match ? Number(match[1]) : 0;
+}
+function safeRealpath(path) {
+    try {
+        if (!isAbsolute(path) || !existsSync(path))
+            return null;
+        const resolved = realpathSync(path);
+        const stats = statSync(resolved);
+        return stats.isFile() ? resolved : null;
+    }
+    catch {
+        return null;
+    }
+}
+function stableParentChain(path, boundary) {
+    const boundaryReal = boundary ? (() => { try {
+        return realpathSync(boundary);
+    }
+    catch {
+        return null;
+    } })() : null;
+    let current = dirname(path);
+    for (let index = 0; index < 32; index += 1) {
+        try {
+            const stats = statSync(current);
+            if (process.platform !== 'win32' && typeof process.getuid === 'function' && stats.uid !== process.getuid() && stats.uid !== 0)
+                return false;
+            if (process.platform !== 'win32' && (stats.mode & 0o022) !== 0)
+                return false;
+            if (boundaryReal && current === boundaryReal)
+                return true;
+            const parent = dirname(current);
+            if (parent === current)
+                return true;
+            current = parent;
+        }
+        catch {
+            return false;
+        }
+    }
+    return false;
+}
+function pathWithin(root, candidate) {
+    try {
+        const rootReal = realpathSync(root);
+        const candidateReal = realpathSync(candidate);
+        const remainder = relative(rootReal, candidateReal);
+        return remainder !== '' && remainder !== '..' && !remainder.startsWith(`..${sep}`) && !isAbsolute(remainder);
+    }
+    catch {
+        return false;
+    }
+}
+export function classifyPackageSource(entryPath = process.argv[1] ?? fileURLToPath(import.meta.url)) {
+    const real = safeRealpath(entryPath) ?? entryPath;
+    const normalized = normalizedPath(real);
+    if (normalized.includes('/.npm/_npx/') || normalized.includes('/node_modules/.cache/'))
+        return 'npx_cache';
+    if (normalized.includes('/runtime/cli/'))
+        return 'managed';
+    if (normalized.includes('/node_modules/'))
+        return normalized.includes('/node_modules/@vectle/cli/') ? 'stable_local' : 'unknown';
+    if (normalized.includes('/bin/') || normalized.includes('/lib/'))
+        return 'global';
+    return 'unknown';
+}
+export function inspectCurrentRuntime(options = {}) {
+    const nodePath = options.nodePath ?? process.execPath;
+    const cliEntry = options.cliEntry ?? fileURLToPath(import.meta.url);
+    const nodeReal = safeRealpath(nodePath);
+    const cliReal = safeRealpath(cliEntry);
+    const packageSource = classifyPackageSource(cliEntry);
+    const nodeVersion = process.version;
+    const versionOkay = nodeMajor(nodeVersion) >= 20;
+    const managed = Boolean(options.stateRoot && nodeReal && cliReal && pathWithin(join(options.stateRoot, 'runtime'), nodeReal) && pathWithin(join(options.stateRoot, 'runtime'), cliReal));
+    const nodeEphemeral = !managed && (!nodeReal || isEphemeralPath(nodeReal) || !stableParentChain(nodeReal));
+    const packageEphemeral = !managed && (!cliReal || isEphemeralPath(cliReal) || packageSource === 'npx_cache');
+    const managedBoundary = managed && options.stateRoot ? options.stateRoot : undefined;
+    const provider = managed ? 'vectle_managed' : nodeEphemeral || packageEphemeral ? 'ephemeral' : 'stable_external';
+    let reason_code = 'verified';
+    if (!versionOkay)
+        reason_code = 'node_version_unsupported';
+    else if (!nodeReal || !cliReal)
+        reason_code = 'missing_entry';
+    else if (nodeEphemeral)
+        reason_code = 'ephemeral_node';
+    else if (packageEphemeral)
+        reason_code = 'ephemeral_package';
+    else if (!stableParentChain(cliReal, managedBoundary))
+        reason_code = 'unsafe_path';
+    let nodeSha = null;
+    let cliSha = null;
+    try {
+        if (nodeReal)
+            nodeSha = digestFile(nodeReal);
+        if (cliReal)
+            cliSha = digestFile(cliReal);
+    }
+    catch {
+        reason_code = 'unreadable';
+    }
+    return {
+        schema_version: 'runtime-descriptor-v1',
+        provider,
+        package_source: packageSource,
+        node_path: nodeReal ?? nodePath,
+        node_version: nodeVersion,
+        platform: process.platform,
+        architecture: process.arch,
+        node_sha256: nodeSha,
+        cli_entry: cliReal ?? cliEntry,
+        cli_sha256: cliSha,
+        durable: versionOkay && reason_code === 'verified' && (provider === 'stable_external' || provider === 'vectle_managed'),
+        reason_code,
+    };
+}
+export function managedRuntimeRoot(stateRoot) { return join(stateRoot, 'runtime'); }
+export function managedRuntimePointerPath(stateRoot) { return join(managedRuntimeRoot(stateRoot), 'current.json'); }
+function validPointer(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const item = value;
+    return Object.keys(item).length === 8
+        && item.schema_version === 'managed-runtime-v1'
+        && typeof item.state_root === 'string' && isAbsolute(item.state_root)
+        && typeof item.node_path === 'string' && isAbsolute(item.node_path)
+        && typeof item.cli_entry === 'string' && isAbsolute(item.cli_entry)
+        && /^sha256:[0-9a-f]{64}$/u.test(String(item.node_sha256))
+        && /^sha256:[0-9a-f]{64}$/u.test(String(item.cli_sha256))
+        && typeof item.cli_version === 'string' && /^\d+\.\d+\.\d+$/u.test(item.cli_version)
+        && typeof item.updated_at === 'string' && Number.isFinite(Date.parse(item.updated_at));
+}
+export function readManagedRuntime(stateRoot) {
+    try {
+        const value = JSON.parse(readFileSync(managedRuntimePointerPath(stateRoot), 'utf8'));
+        if (!validPointer(value) || value.state_root !== stateRoot)
+            return null;
+        const node = safeRealpath(value.node_path);
+        const entry = safeRealpath(value.cli_entry);
+        if (!node || !entry || digestFile(node) !== value.node_sha256 || digestFile(entry) !== value.cli_sha256)
+            return null;
+        return value;
+    }
+    catch {
+        return null;
+    }
+}
+export function writeManagedRuntimePointer(pointer) {
+    if (!validPointer(pointer))
+        throw new Error('invalid_managed_runtime_pointer');
+    if (!isAbsolute(pointer.state_root))
+        throw new Error('unsafe_managed_runtime_root');
+    if (!safeRealpath(pointer.node_path) || !safeRealpath(pointer.cli_entry))
+        throw new Error('managed_runtime_missing');
+    if (digestFile(pointer.node_path) !== pointer.node_sha256 || digestFile(pointer.cli_entry) !== pointer.cli_sha256)
+        throw new Error('managed_runtime_digest_mismatch');
+    mkdirSync(managedRuntimeRoot(pointer.state_root), { recursive: true, mode: 0o700 });
+    atomicWriteJson(managedRuntimePointerPath(pointer.state_root), pointer);
+}
+export function durableRuntimeForSetup(stateRoot) {
+    const managed = readManagedRuntime(stateRoot);
+    if (managed)
+        return { descriptor: { ...inspectCurrentRuntime({ nodePath: managed.node_path, cliEntry: managed.cli_entry, stateRoot }), provider: 'vectle_managed', durable: true, reason_code: 'verified' }, action: null };
+    const current = inspectCurrentRuntime({ stateRoot });
+    if (current.durable)
+        return { descriptor: current, action: null };
+    try {
+        const provisioned = provisionManagedRuntime(stateRoot, { nodePath: current.node_path, cliEntry: current.cli_entry });
+        const descriptor = inspectCurrentRuntime({ nodePath: provisioned.node_path, cliEntry: provisioned.cli_entry, stateRoot });
+        return { descriptor: { ...descriptor, provider: 'vectle_managed', durable: true, reason_code: 'verified' }, action: null };
+    }
+    catch {
+        return { descriptor: current, action: 'Install a stable Node.js runtime or rerun `vectle setup --repair` after one is available.' };
+    }
+}
+/**
+ * Copy the currently resolved runtime into a Vectle-owned, digest-addressed
+ * directory. This is deliberately local-only: setup never downloads code or
+ * changes a user's package manager. A valid pointer makes later setup/status
+ * runs independent of npx caches, Homebrew upgrades, or version-manager GC.
+ */
+export function provisionManagedRuntime(stateRoot, source) {
+    if (!isAbsolute(stateRoot) || !isAbsolute(source.nodePath) || !isAbsolute(source.cliEntry))
+        throw new Error('runtime_not_durable');
+    const nodeSource = safeRealpath(source.nodePath);
+    const cliSource = safeRealpath(source.cliEntry);
+    if (!nodeSource || !cliSource)
+        throw new Error('runtime_not_durable');
+    const nodeDigest = digestFile(nodeSource);
+    const cliDigest = digestFile(cliSource);
+    const versionRoot = join(managedRuntimeRoot(stateRoot), 'versions', `${nodeDigest.slice(7, 23)}-${cliDigest.slice(7, 23)}`);
+    const nodePrefix = join(versionRoot, 'node');
+    const nodeTarget = join(nodePrefix, 'bin', process.platform === 'win32' ? 'node.exe' : 'node');
+    const cliTargetDir = join(versionRoot, 'cli');
+    const cliTarget = join(cliTargetDir, 'index.js');
+    const pointer = { schema_version: 'managed-runtime-v1', state_root: stateRoot, node_path: nodeTarget, cli_entry: cliTarget, node_sha256: nodeDigest, cli_sha256: cliDigest, cli_version: CLI_VERSION, updated_at: new Date().toISOString() };
+    const existing = readManagedRuntime(stateRoot);
+    if (existing && existing.node_sha256 === nodeDigest && existing.cli_sha256 === cliDigest)
+        return existing;
+    const temporary = `${versionRoot}.tmp-${Date.now().toString(36)}`;
+    mkdirSync(temporary, { recursive: true, mode: 0o700 });
+    try {
+        const sourcePrefix = dirname(dirname(nodeSource));
+        const temporaryNodePrefix = nodePrefix.replace(versionRoot, temporary);
+        if (existsSync(join(sourcePrefix, 'lib')) && sourcePrefix !== dirname(sourcePrefix) && sourcePrefix !== '/usr' && sourcePrefix !== '/opt' && sourcePrefix !== '/System') {
+            cpSync(sourcePrefix, temporaryNodePrefix, { recursive: true, dereference: true });
+        }
+        else {
+            mkdirSync(join(temporaryNodePrefix, 'bin'), { recursive: true, mode: 0o700 });
+            cpSync(nodeSource, nodeTarget.replace(versionRoot, temporary), { dereference: true });
+        }
+        const copiedNode = nodeTarget.replace(versionRoot, temporary);
+        try {
+            const copiedStats = lstatSync(copiedNode);
+            if (copiedStats.isSymbolicLink() || !copiedStats.isFile())
+                unlinkSync(copiedNode);
+        }
+        catch { /* copyFileSync below reports the missing target */ }
+        if (!existsSync(copiedNode) || digestFile(copiedNode) !== nodeDigest)
+            copyFileSync(nodeSource, copiedNode);
+        chmodSync(copiedNode, 0o700);
+        if (!pathWithin(temporary, copiedNode))
+            throw new Error('runtime_copy_failed');
+        cpSync(dirname(cliSource), cliTargetDir.replace(versionRoot, temporary), { recursive: true, dereference: true });
+        const copiedCli = join(cliTargetDir.replace(versionRoot, temporary), 'index.js');
+        if (!existsSync(copiedCli) || digestFile(copiedCli) !== cliDigest)
+            throw new Error('runtime_copy_failed');
+        renameSync(temporary, versionRoot);
+    }
+    catch (error) {
+        try {
+            renameSync(temporary, `${temporary}.failed`);
+        }
+        catch { /* best effort; the temp name is unique */ }
+        throw error;
+    }
+    writeManagedRuntimePointer(pointer);
+    return pointer;
+}
+export function runtimeTestPaths(stateRoot, version, platform = process.platform, architecture = process.arch) {
+    if (!isAbsolute(stateRoot) || !/^\d+\.\d+\.\d+$/u.test(version))
+        throw new Error('invalid_runtime_path');
+    return { node: join(stateRoot, 'runtime', 'node', `${version}-${platform}-${architecture}`), cli: join(stateRoot, 'runtime', 'cli', version), launcher: join(stateRoot, 'runtime', 'bin', 'vectle') };
+}
+//# sourceMappingURL=runtime.js.map

package/dist/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1J,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AA+B7C,MAAM,iBAAiB,GAAG;IACxB,aAAa;IACb,uBAAuB;IACvB,eAAe;IACf,gBAAgB;IAChB,sBAAsB;IACtB,yBAAyB;IACzB,sBAAsB;IACtB,uBAAuB;IACvB,mBAAmB;IACnB,OAAO;IACP,eAAe;CAChB,CAAC;AAEF,SAAS,cAAc,CAAC,KAAa,IAAI,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAE5F,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,OAAO,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAiB;IACxD,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnH,IAAI,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC5I,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC7E,IAAI,YAAY,IAAI,OAAO,KAAK,YAAY;gBAAE,OAAO,IAAI,CAAC;YAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAC;YACpC,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAiB;IACjD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACpD,OAAO,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC/G,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;IACjG,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;IAClD,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QAAE,OAAO,WAAW,CAAC;IAC3G,IAAI,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3D,IAAI,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IACjI,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAwE,EAAE;IAC9G,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IACpC,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,QAAQ,IAAI,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAU,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAU,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3L,MAAM,aAAa,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3G,MAAM,gBAAgB,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,aAAa,KAAK,WAAW,CAAC,CAAC;IAC7G,MAAM,eAAe,GAAG,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,QAAQ,GAAoB,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,IAAI,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACnI,IAAI,WAAW,GAAqC,UAAU,CAAC;IAC/D,IAAI,CAAC,WAAW;QAAE,WAAW,GAAG,0BAA0B,CAAC;SACtD,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO;QAAE,WAAW,GAAG,eAAe,CAAC;SACzD,IAAI,aAAa;QAAE,WAAW,GAAG,gBAAgB,CAAC;SAClD,IAAI,gBAAgB;QAAE,WAAW,GAAG,mBAAmB,CAAC;SACxD,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,eAAe,CAAC;QAAE,WAAW,GAAG,aAAa,CAAC;IACnF,IAAI,OAAO,GAAqC,IAAI,CAAC;IACrD,IAAI,MAAM,GAAoC,IAAI,CAAC;IACnD,IAAI,CAAC;QAAC,IAAI,QAAQ;YAAE,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAC,IAAI,OAAO;YAAE,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,WAAW,GAAG,YAAY,CAAC;IAAC,CAAC;IACtI,OAAO;QACL,cAAc,EAAE,uBAAuB;QACvC,QAAQ;QACR,cAAc,EAAE,aAAa;QAC7B,SAAS,EAAE,QAAQ,IAAI,QAAQ;QAC/B,YAAY,EAAE,WAAW;QACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,IAAI;QAC1B,WAAW,EAAE,OAAO;QACpB,SAAS,EAAE,OAAO,IAAI,QAAQ;QAC9B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,WAAW,IAAI,WAAW,KAAK,UAAU,IAAI,CAAC,QAAQ,KAAK,iBAAiB,IAAI,QAAQ,KAAK,gBAAgB,CAAC;QACvH,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,SAAiB,IAAI,OAAO,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;AAC5F,MAAM,UAAU,yBAAyB,CAAC,SAAiB,IAAI,OAAO,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;AAE5H,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,IAAI,GAAG,KAAgC,CAAC;IAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;WAChC,IAAI,CAAC,cAAc,KAAK,oBAAoB;WAC5C,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;WAClE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;WAChE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;WAChE,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;WACvD,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;WACtD,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;WACjF,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAY,CAAC;QAChG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACxE,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,WAAW,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QACrH,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAA8B;IACvE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC/E,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpF,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACrH,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACtK,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,eAAe,CAAC,yBAAyB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,OAAO;QAAE,OAAO,EAAE,UAAU,EAAE,EAAE,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,gBAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9O,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,uBAAuB,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QACrH,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1H,OAAO,EAAE,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,gBAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/I,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,2FAA2F,EAAE,CAAC;IACtI,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAiB,EAAE,MAA8C;IACvG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACnI,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5H,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/F,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACjD,MAAM,OAAO,GAA0B,EAAE,cAAc,EAAE,oBAAoB,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACpQ,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,QAAQ,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC1G,MAAM,SAAS,GAAG,GAAG,WAAW,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;IAClE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAClD,MAAM,mBAAmB,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACvE,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,IAAI,YAAY,KAAK,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YACxK,MAAM,CAAC,YAAY,EAAE,mBAAmB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9E,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;YAC1C,IAAI,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE;gBAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC,CAAC,mDAAmD,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,UAAU;YAAE,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC3G,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC/E,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACjH,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;QACjF,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC1G,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YAAC,UAAU,CAAC,SAAS,EAAE,GAAG,SAAS,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,0CAA0C,CAAC,CAAC;QAC1G,MAAM,KAAK,CAAC;IACd,CAAC;IACD,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,OAAe,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI;IAC3H,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACzG,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;AACxM,CAAC"}

package/dist/secure-store.d.ts

@@ -0,0 +1,36 @@
+export type SecureBackend = 'keychain' | 'secret_service' | 'credential_manager' | 'file' | 'environment';
+export type InstallationCredentialBackend = 'macos_keychain' | 'linux_secret_service' | 'windows_credential_manager' | 'file';
+export type SecurePurpose = 'refresh' | 'access' | 'device_code' | 'setup_report' | 'rotation_candidate';
+export type SecureStoreHandle = {
+    schema_version: 'secure-store-handle-v1';
+    backend: SecureBackend;
+    account: string;
+    purpose: SecurePurpose;
+    expires_at: string | null;
+};
+export declare function credentialAccountHandle(origin: string, supportCode: string): string;
+export declare function legacyCredentialHandle(source: SecureBackend, token: string, selectedRoot: string): string;
+export declare function windowsCredentialTarget(account: string): string;
+export declare function installationBackendName(backend: SecureBackend): InstallationCredentialBackend;
+export declare function secureBackendForInstallationName(name: InstallationCredentialBackend): SecureBackend;
+export declare function availableSecureBackend(options?: {
+    allowFileFallback?: boolean;
+    preferEnvironment?: boolean;
+}): SecureBackend | null;
+export declare function writeLegacyNativeSecret(secret: string, backend: SecureBackend, purpose: SecurePurpose): void;
+export declare function readLegacyNativeSecret(backend: SecureBackend, purpose: SecurePurpose): string | null;
+export declare function deleteLegacyNativeSecret(backend: SecureBackend): void;
+export type SecureStoreOptions = {
+    baseDirectory: string;
+    account: string;
+    purpose: SecurePurpose;
+    operationId?: string;
+    expiresAt?: string | null;
+    backend?: SecureBackend;
+    allowFileFallback?: boolean;
+};
+export declare function writeSecureSecret(secret: string, options: SecureStoreOptions): SecureStoreHandle;
+export declare function readSecureSecret(options: SecureStoreOptions): string | null;
+export declare function deleteSecureSecret(options: SecureStoreOptions): void;
+export declare function secureStoreFilePath(options: SecureStoreOptions): string;
+export declare function removeCredentialTree(baseDirectory: string, account: string): void;

package/dist/secure-store.js

@@ -0,0 +1,282 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { chmodSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { dirname, isAbsolute, join } from 'node:path';
+const INSTALLATION_SERVICE = 'com.vectle.cli.installation';
+const LEGACY_SERVICE = 'com.vectle.cli';
+const FILE_SCHEMA = 'secure-store-entry-v1';
+const tokenPattern = /^(?:(?:vctd|vctk|vctir|vctia|vctis)_[A-Za-z0-9_-]{43}|vro_[A-Za-z0-9_-]{22})$/u;
+const accountPattern = /^vci-[0-9a-f]{32}$/u;
+const purposePrefixes = {
+    refresh: /^vctir_[A-Za-z0-9_-]{43}$/u,
+    access: /^vctia_[A-Za-z0-9_-]{43}$/u,
+    device_code: /^vctd_[A-Za-z0-9_-]{43}$/u,
+    setup_report: /^vctis_[A-Za-z0-9_-]{43}$/u,
+    rotation_candidate: /^vctir_[A-Za-z0-9_-]{43}$/u,
+};
+export function credentialAccountHandle(origin, supportCode) {
+    const normalizedOrigin = new URL(origin).origin;
+    if (!/^vci_[A-Za-z0-9_-]{22}$/u.test(supportCode))
+        throw new Error('invalid_installation_support_code');
+    const preimage = `secure-credential-binding-v1\0${normalizedOrigin}\0${supportCode}`;
+    return `vci-${createHash('sha256').update(preimage, 'utf8').digest('hex').slice(0, 32)}`;
+}
+export function legacyCredentialHandle(source, token, selectedRoot) {
+    return `sha256:${createHash('sha256').update(`${source}\0${token}\0${selectedRoot}`, 'utf8').digest('hex')}`;
+}
+export function windowsCredentialTarget(account) {
+    if (!accountPattern.test(account))
+        throw new Error('invalid_secure_store_account');
+    return `Vectle/CLI/${account}`;
+}
+export function installationBackendName(backend) {
+    if (backend === 'keychain')
+        return 'macos_keychain';
+    if (backend === 'secret_service')
+        return 'linux_secret_service';
+    if (backend === 'credential_manager')
+        return 'windows_credential_manager';
+    if (backend === 'file')
+        return 'file';
+    throw new Error('unsupported_secure_backend');
+}
+export function secureBackendForInstallationName(name) {
+    if (name === 'macos_keychain')
+        return 'keychain';
+    if (name === 'linux_secret_service')
+        return 'secret_service';
+    if (name === 'windows_credential_manager')
+        return 'credential_manager';
+    return 'file';
+}
+const operationPattern = /^[A-Za-z][A-Za-z0-9-]{1,95}$/u;
+function fileBase(baseDirectory) {
+    if (!isAbsolute(baseDirectory))
+        throw new Error('unsafe_secure_store_root');
+    return join(baseDirectory, 'credentials');
+}
+function currentFile(baseDirectory, account) { return join(fileBase(baseDirectory), 'current', `${account}.json`); }
+function pendingFile(baseDirectory, purpose, operationId) {
+    if (!operationPattern.test(operationId))
+        throw new Error('invalid_secure_store_operation');
+    return join(fileBase(baseDirectory), 'pending', purpose, `${operationId}.json`);
+}
+function privateMkdir(path) { mkdirSync(path, { recursive: true, mode: 0o700 }); try {
+    chmodSync(path, 0o700);
+}
+catch { /* Windows ACLs are inherited. */ } }
+function atomicSecretFile(path, value, expiresAt, purpose, account) {
+    privateMkdir(dirname(path));
+    const temporary = `${path}.tmp-${randomBytes(8).toString('hex')}`;
+    const fd = openSync(temporary, 'wx', 0o600);
+    try {
+        writeFileSync(fd, `${JSON.stringify({ schema_version: FILE_SCHEMA, purpose, account, secret: value, expires_at: expiresAt })}\n`, { encoding: 'utf8' });
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    const parent = dirname(path);
+    // Rename is intentionally same-directory: a crash leaves either the old
+    // slot or the new slot, never a partially written credential.
+    renameSync(temporary, path);
+    chmodSync(path, 0o600);
+    try {
+        const directoryFd = openSync(parent, 'r');
+        fsyncSync(directoryFd);
+        closeSync(directoryFd);
+    }
+    catch { /* Windows. */ }
+}
+function fileSecret(path, purpose, account) {
+    try {
+        const raw = JSON.parse(readFileSync(path, 'utf8'));
+        if (Object.keys(raw).length !== 5 || raw.schema_version !== FILE_SCHEMA || raw.purpose !== purpose || raw.account !== account || typeof raw.secret !== 'string' || !purposePrefixes[purpose].test(raw.secret) || (raw.expires_at !== null && typeof raw.expires_at !== 'string'))
+            return null;
+        if (typeof raw.expires_at === 'string' && Date.parse(raw.expires_at) <= Date.now())
+            return null;
+        const mode = statSync(path).mode & 0o777;
+        if (process.platform !== 'win32' && mode !== 0o600)
+            return null;
+        return raw.secret;
+    }
+    catch {
+        return null;
+    }
+}
+function backendFromEnvironment() {
+    if (process.env.VECTLE_TEST_CREDENTIAL_BACKEND === 'file')
+        return 'file';
+    if (process.platform === 'darwin')
+        return existsSync('/usr/bin/security') ? 'keychain' : null;
+    if (process.platform === 'linux') {
+        const result = spawnSync('secret-tool', ['--help'], { stdio: 'ignore' });
+        return result.status === 0 ? 'secret_service' : null;
+    }
+    if (process.platform === 'win32')
+        return 'credential_manager';
+    return null;
+}
+export function availableSecureBackend(options = {}) {
+    if (options.preferEnvironment && typeof process.env.VECTLE_TOKEN === 'string' && process.env.VECTLE_TOKEN.trim())
+        return 'environment';
+    return backendFromEnvironment() ?? (options.allowFileFallback ? 'file' : null);
+}
+function keychainWrite(backend, account, secret, service = INSTALLATION_SERVICE) {
+    if (backend === 'keychain') {
+        execFileSync('/usr/bin/security', ['add-generic-password', '-a', account, '-s', service, '-w', secret, '-U'], { stdio: 'ignore' });
+        return;
+    }
+    if (backend === 'secret_service') {
+        const result = spawnSync('secret-tool', ['store', '--label=Vectle CLI installation', 'service', service, 'account', account], { input: secret, encoding: 'utf8', stdio: ['pipe', 'ignore', 'ignore'] });
+        if (result.status !== 0)
+            throw new Error('secure_store_write_failed');
+        return;
+    }
+    if (backend === 'credential_manager') {
+        const target = service === INSTALLATION_SERVICE ? windowsCredentialTarget(account) : `${service}/${account}`;
+        const result = spawnSync('cmdkey.exe', [`/generic:${target}`, '/user:', `/pass:${secret}`], { stdio: 'ignore' });
+        if (result.status !== 0)
+            throw new Error('secure_store_write_failed');
+        return;
+    }
+    throw new Error('unsupported_secure_backend');
+}
+function keychainRead(backend, account, service = INSTALLATION_SERVICE) {
+    if (backend === 'keychain') {
+        try {
+            return execFileSync('/usr/bin/security', ['find-generic-password', '-a', account, '-s', service, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim() || null;
+        }
+        catch {
+            return null;
+        }
+    }
+    if (backend === 'secret_service') {
+        const result = spawnSync('secret-tool', ['lookup', 'service', service, 'account', account], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+        return result.status === 0 ? result.stdout.trim() || null : null;
+    }
+    // Windows Credential Manager deliberately has no portable command-line
+    // read API. The native adapter is represented by the target contract; a
+    // host implementation can replace this function without changing callers.
+    return null;
+}
+function keychainDelete(backend, account, service = INSTALLATION_SERVICE) {
+    if (backend === 'keychain') {
+        try {
+            execFileSync('/usr/bin/security', ['delete-generic-password', '-a', account, '-s', service], { stdio: 'ignore' });
+        }
+        catch { /* already absent */ }
+        return;
+    }
+    if (backend === 'secret_service') {
+        spawnSync('secret-tool', ['clear', 'service', service, 'account', account], { stdio: 'ignore' });
+        return;
+    }
+    if (backend === 'credential_manager') {
+        const target = service === INSTALLATION_SERVICE ? windowsCredentialTarget(account) : `${service}/${account}`;
+        spawnSync('cmdkey.exe', [`/delete:${target}`], { stdio: 'ignore' });
+    }
+}
+function validateNativeSecret(secret, purpose) {
+    if (!purposePrefixes[purpose].test(secret))
+        throw new Error('invalid_secure_secret');
+}
+export function writeLegacyNativeSecret(secret, backend, purpose) {
+    validateNativeSecret(secret, purpose);
+    if (!['keychain', 'secret_service', 'credential_manager'].includes(backend))
+        throw new Error('unsupported_secure_backend');
+    keychainWrite(backend, 'default', secret, LEGACY_SERVICE);
+}
+export function readLegacyNativeSecret(backend, purpose) {
+    if (!['keychain', 'secret_service', 'credential_manager'].includes(backend))
+        return null;
+    const value = keychainRead(backend, 'default', LEGACY_SERVICE);
+    return value && purposePrefixes[purpose].test(value) ? value : null;
+}
+export function deleteLegacyNativeSecret(backend) {
+    if (['keychain', 'secret_service', 'credential_manager'].includes(backend))
+        keychainDelete(backend, 'default', LEGACY_SERVICE);
+}
+function chooseBackend(options) {
+    if (options.backend)
+        return options.backend;
+    const selected = availableSecureBackend({ allowFileFallback: options.allowFileFallback });
+    if (!selected || selected === 'environment')
+        throw new Error('secure_store_unavailable');
+    return selected;
+}
+export function writeSecureSecret(secret, options) {
+    if (!purposePrefixes[options.purpose].test(secret))
+        throw new Error('invalid_secure_secret');
+    if (!accountPattern.test(options.account))
+        throw new Error('invalid_secure_store_account');
+    const backend = chooseBackend(options);
+    const expiresAt = options.expiresAt ?? null;
+    if (backend === 'file') {
+        const path = options.operationId ? pendingFile(options.baseDirectory, options.purpose, options.operationId) : currentFile(options.baseDirectory, options.account);
+        atomicSecretFile(path, secret, expiresAt, options.purpose, options.account);
+    }
+    else
+        keychainWrite(backend, options.operationId ? `${options.account}:${options.purpose}:${options.operationId}` : options.account, secret);
+    return { schema_version: 'secure-store-handle-v1', backend, account: options.account, purpose: options.purpose, expires_at: expiresAt };
+}
+export function readSecureSecret(options) {
+    if (!accountPattern.test(options.account))
+        return null;
+    const backend = options.backend ?? availableSecureBackend({ allowFileFallback: true });
+    if (!backend || backend === 'environment')
+        return null;
+    if (backend === 'file')
+        return fileSecret(options.operationId ? pendingFile(options.baseDirectory, options.purpose, options.operationId) : currentFile(options.baseDirectory, options.account), options.purpose, options.account);
+    const value = keychainRead(backend, options.operationId ? `${options.account}:${options.purpose}:${options.operationId}` : options.account);
+    return value && tokenPattern.test(value) ? value : null;
+}
+export function deleteSecureSecret(options) {
+    if (!accountPattern.test(options.account))
+        return;
+    const backend = options.backend ?? availableSecureBackend({ allowFileFallback: true });
+    if (!backend || backend === 'environment')
+        return;
+    if (backend === 'file') {
+        const path = options.operationId ? pendingFile(options.baseDirectory, options.purpose, options.operationId) : currentFile(options.baseDirectory, options.account);
+        try {
+            unlinkSync(path);
+        }
+        catch { /* idempotent removal */ }
+        return;
+    }
+    keychainDelete(backend, options.operationId ? `${options.account}:${options.purpose}:${options.operationId}` : options.account);
+}
+export function secureStoreFilePath(options) {
+    if (!accountPattern.test(options.account))
+        throw new Error('invalid_secure_store_account');
+    return options.operationId ? pendingFile(options.baseDirectory, options.purpose, options.operationId) : currentFile(options.baseDirectory, options.account);
+}
+export function removeCredentialTree(baseDirectory, account) {
+    if (!accountPattern.test(account))
+        throw new Error('invalid_secure_store_account');
+    const root = fileBase(baseDirectory);
+    const current = currentFile(baseDirectory, account);
+    try {
+        rmSync(current, { force: true });
+    }
+    catch { /* idempotent */ }
+    // Only the selected account's pending children are removed. No recursive
+    // delete is performed over the credentials root.
+    for (const purpose of ['refresh', 'access', 'device_code', 'setup_report', 'rotation_candidate']) {
+        const directory = join(root, 'pending', purpose);
+        try {
+            for (const entry of readdirSync(directory)) {
+                const path = join(directory, entry);
+                try {
+                    const raw = JSON.parse(readFileSync(path, 'utf8'));
+                    if (raw.account === account)
+                        rmSync(path, { force: true });
+                }
+                catch { /* ignore malformed/unrelated transient entries */ }
+            }
+        }
+        catch { /* absent */ }
+    }
+}
+//# sourceMappingURL=secure-store.js.map

package/dist/secure-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-store.js","sourceRoot":"","sources":["../src/secure-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/K,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAatD,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAC3D,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAC5C,MAAM,YAAY,GAAG,gFAAgF,CAAC;AACtG,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAE7C,MAAM,eAAe,GAAkC;IACrD,OAAO,EAAE,4BAA4B;IACrC,MAAM,EAAE,4BAA4B;IACpC,WAAW,EAAE,2BAA2B;IACxC,YAAY,EAAE,4BAA4B;IAC1C,kBAAkB,EAAE,4BAA4B;CACjD,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAE,WAAmB;IACzE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACxG,MAAM,QAAQ,GAAG,iCAAiC,gBAAgB,KAAK,WAAW,EAAE,CAAC;IACrF,OAAO,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAqB,EAAE,KAAa,EAAE,YAAoB;IAC/F,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,KAAK,KAAK,KAAK,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACnF,OAAO,cAAc,OAAO,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAsB;IAC5D,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,gBAAgB,CAAC;IACpD,IAAI,OAAO,KAAK,gBAAgB;QAAE,OAAO,sBAAsB,CAAC;IAChE,IAAI,OAAO,KAAK,oBAAoB;QAAE,OAAO,4BAA4B,CAAC;IAC1E,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACtC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,IAAmC;IAClF,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,UAAU,CAAC;IACjD,IAAI,IAAI,KAAK,sBAAsB;QAAE,OAAO,gBAAgB,CAAC;IAC7D,IAAI,IAAI,KAAK,4BAA4B;QAAE,OAAO,oBAAoB,CAAC;IACvE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AAEzD,SAAS,QAAQ,CAAC,aAAqB;IACrC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AAC5C,CAAC;AACD,SAAS,WAAW,CAAC,aAAqB,EAAE,OAAe,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpI,SAAS,WAAW,CAAC,aAAqB,EAAE,OAAsB,EAAE,WAAmB;IACrF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,WAAW,OAAO,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAAC,CAAC;AAAC,MAAM,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC;AAEtK,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAa,EAAE,SAAwB,EAAE,OAAsB,EAAE,OAAe;IACtH,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5B,MAAM,SAAS,GAAG,GAAG,IAAI,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAClE,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,aAAa,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACxJ,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,wEAAwE;IACxE,8DAA8D;IAC9D,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5B,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,IAAI,CAAC;QAAC,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;AAC7H,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,OAAsB,EAAE,OAAe;IACvE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;QAC9E,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,cAAc,KAAK,WAAW,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9R,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAChG,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,SAAS,sBAAsB;IAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACzE,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,oBAAoB,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,UAAwE,EAAE;IAC/G,IAAI,OAAO,CAAC,iBAAiB,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE;QAAE,OAAO,aAAa,CAAC;IACvI,OAAO,sBAAsB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,aAAa,CAAC,OAAsB,EAAE,OAAe,EAAE,MAAc,EAAE,OAAO,GAAG,oBAAoB;IAC5G,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,YAAY,CAAC,mBAAmB,EAAE,CAAC,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnI,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,iCAAiC,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,oBAAoB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,KAAK,oBAAoB,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;QAC7G,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC,YAAY,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,OAAsB,EAAE,OAAe,EAAE,OAAO,GAAG,oBAAoB;IAC3F,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC;YAAC,OAAO,YAAY,CAAC,mBAAmB,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;IACnN,CAAC;IACD,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvJ,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,CAAC;IACD,uEAAuE;IACvE,wEAAwE;IACxE,0EAA0E;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,OAAsB,EAAE,OAAe,EAAE,OAAO,GAAG,oBAAoB;IAC7F,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,YAAY,CAAC,mBAAmB,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACjM,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;QAAC,SAAS,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAC/I,IAAI,OAAO,KAAK,oBAAoB,EAAE,CAAC;QAAC,MAAM,MAAM,GAAG,OAAO,KAAK,oBAAoB,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;QAAC,SAAS,CAAC,YAAY,EAAE,CAAC,WAAW,MAAM,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAAC,CAAC;AAC9N,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc,EAAE,OAAsB;IAClE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAE,OAAsB,EAAE,OAAsB;IACpG,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,UAAU,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC3H,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAsB,EAAE,OAAsB;IACnF,IAAI,CAAC,CAAC,UAAU,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IAC/D,OAAO,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAsB;IAC7D,IAAI,CAAC,UAAU,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AACjI,CAAC;AAYD,SAAS,aAAa,CAAC,OAA2B;IAChD,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC;IAC5C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACzF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,OAA2B;IAC3E,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7F,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAC5C,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAClK,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E,CAAC;;QAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9I,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AAC1I,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA2B;IAC1D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,sBAAsB,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAClO,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5I,OAAO,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA2B;IAC5D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,sBAAsB,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,aAAa;QAAE,OAAO;IAClD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAClK,IAAI,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IACD,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAClI,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAA2B;IAC7D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC3F,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;AAC9J,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,aAAqB,EAAE,OAAe;IACzE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,WAAW,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC;QAAC,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACpE,yEAAyE;IACzE,iDAAiD;IACjD,KAAK,MAAM,OAAO,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,oBAAoB,CAAoB,EAAE,CAAC;QACpH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,SAAS,CAAa,EAAE,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;oBAC9E,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO;wBAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC"}