approval-md 0.0.1 → 0.2.0

package/dist/src/adapters/smtp.js

@@ -0,0 +1,499 @@
+/**
+ * A minimal SMTP client, for the email adapter and nothing else (APRV-69).
+ *
+ * ## Why this exists rather than a dependency
+ *
+ * `CLAUDE.md` and SPEC.md §14 both put minimal dependencies among this
+ * repository's invariants, and a mail library is a large surface to take on for
+ * one send: nodemailer pulls a templating layer, an attachment pipeline, a DKIM
+ * signer, OAuth2 token refresh, and a plugin system, all of it running inside
+ * the one call this project spends its whole design protecting. What is actually
+ * needed is RFC 5321's client half of a single transaction — greeting, EHLO,
+ * optionally STARTTLS, optionally AUTH, MAIL FROM, RCPT TO, DATA, QUIT — which
+ * is this file. `node:net` and `node:tls` and nothing else.
+ *
+ * ## What it deliberately does not do
+ *
+ * No connection pooling, no pipelining, no CHUNKING/BDAT, no SMTPUTF8, no DSN,
+ * no retry. One transaction per {@link sendMail} call, one message per
+ * transaction, and a failure is reported rather than retried: a retry inside an
+ * adapter would be a second side effect under one consumed token, and deciding
+ * to send again is a decision the gate exists to make.
+ *
+ * ## The probe, and the limit of what it proves
+ *
+ * {@link probeSmtp} runs the same session as {@link sendMail} up to and
+ * including AUTH, then says QUIT. It is the same code, one call away
+ * (`runSession` with no envelope), because a setup check that exercises a
+ * different client than the send does is a check that can pass while the send
+ * fails.
+ *
+ * A successful probe proves three things and no more: the host and port accept
+ * a connection, the requested transport security (implicit TLS, or the STARTTLS
+ * upgrade, with the same no-downgrade rule the send obeys) was actually
+ * established, and this server accepts this credential.
+ *
+ * It does **not** prove that a message would be accepted. MAIL FROM, RCPT TO
+ * and DATA are never issued, so nothing about the server's sender policy, its
+ * relaying rules, its recipient validation, its size limits or its content
+ * filtering is exercised. A probe that succeeds against a server which will
+ * later refuse `MAIL FROM:<…>` with a 550 is a probe behaving correctly. Any
+ * caller reporting the result to an operator (`setup adapter email` says
+ * "verified") owes them that distinction: the transport and the login are
+ * verified, the delivery is not.
+ *
+ * ## Failure vocabulary
+ *
+ * Everything is reported, nothing is thrown out of {@link sendMail}. Two
+ * families:
+ *
+ * - the transport codes in {@link SMTP_TRANSPORT_FAILURE_CODES}, which are a
+ *   frozen, additive union (SPEC.md §11.1(6)); and
+ * - a reply-code family, `smtp-<NNN>`, minted from the server's own three-digit
+ *   reply whenever the far side refuses a verb. It is a family rather than an
+ *   enumeration because RFC 5321 lets a server answer with codes this repository
+ *   cannot list in advance, and collapsing "mailbox unavailable" and
+ *   "authentication failed" into one local name would throw away the one piece
+ *   of information an operator needs. {@link SMTP_REPLY_CODE_PATTERN} pins the
+ *   shape.
+ *
+ * ## What may appear in a failure message
+ *
+ * The verb, the reply code, and **the first line of the server's reply text**.
+ * Not the whole reply: a multi-line refusal can run to a screen of banner text,
+ * and everything after the first line is the server explaining itself to a human
+ * rather than telling the client what happened. Not the command: an `AUTH PLAIN
+ * <base64>` echoed into a diagnostic would publish the credential in the one
+ * string the adapter's caller is most likely to print.
+ *
+ * And even the first line is passed through {@link SmtpTransportOptions.redact}
+ * before it is returned, because a server is entitled to quote back the username
+ * it just refused ("535 5.7.8 authentication failed for bot@example.com"), and a
+ * deployment whose username IS the credential would otherwise leak it through a
+ * channel the adapter contract's own guard also covers but which this module
+ * should not be relying on. Two independent scrubs, by design.
+ *
+ * Deterministic apart from the network and the clock it does not read: no
+ * randomness, no ambient configuration, no environment reads.
+ */
+import { connect as netConnect } from "node:net";
+import { connect as tlsConnect } from "node:tls";
+export function isSmtpSecurity(value) {
+    return value === "implicit" || value === "starttls" || value === "none";
+}
+/**
+ * Transport failures this client can report. Frozen union, additive only
+ * (SPEC.md §11.1(6)).
+ *
+ * They are distinguished because they call for four different responses: fix
+ * the address, fix the TLS configuration, look at why the far side is slow, and
+ * report a server that is not speaking SMTP.
+ */
+export const SMTP_TRANSPORT_FAILURE_CODES = [
+    /** The TCP connection could not be established at all. */
+    "smtp-connect-failed",
+    /** TLS could not be established, or the server would not offer STARTTLS. */
+    "smtp-tls-failed",
+    /** The session exceeded its whole-transaction budget. */
+    "smtp-timeout",
+    /** The far side sent something that is not an SMTP reply, or hung up. */
+    "smtp-protocol-error",
+];
+/** The shape of a minted reply-code failure: `smtp-` and three digits. */
+export const SMTP_REPLY_CODE_PATTERN = /^smtp-[1-5]\d\d$/u;
+/** The default whole-session budget, in milliseconds. */
+export const DEFAULT_SMTP_TIMEOUT_MS = 30_000;
+// ---------------------------------------------------------------------------
+// Internals
+// ---------------------------------------------------------------------------
+const CRLF = "\r\n";
+/** An internal control-flow carrier. Never escapes {@link sendMail}. */
+class SmtpError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "SmtpError";
+    }
+}
+/**
+ * The reply reader.
+ *
+ * SMTP framing is line-oriented: a reply is one or more lines, each opening
+ * with the same three-digit code, continuation lines separated from the last by
+ * a hyphen (`250-STARTTLS`) rather than a space (`250 HELP`). Bytes are
+ * accumulated as a Buffer and decoded per complete line, so a multi-byte UTF-8
+ * character split across two TCP segments cannot become a replacement character
+ * in a diagnostic.
+ */
+class ReplyReader {
+    raw = Buffer.alloc(0);
+    lines = [];
+    ready = [];
+    waiting = null;
+    failure = null;
+    /** Feed bytes. Called from the socket's `data` handler. */
+    push(chunk) {
+        this.raw = this.raw.length === 0 ? chunk : Buffer.concat([this.raw, chunk]);
+        for (;;) {
+            const index = this.raw.indexOf(0x0a);
+            if (index === -1)
+                break;
+            const line = this.raw.subarray(0, index).toString("utf8").replace(/\r$/u, "");
+            this.raw = this.raw.subarray(index + 1);
+            this.consume(line);
+        }
+    }
+    /** Bytes received but not yet forming a line. Non-empty is a violation. */
+    get pendingBytes() {
+        return this.raw.length;
+    }
+    /** Replies parsed but not yet awaited. Non-empty before STARTTLS is fatal. */
+    get pendingReplies() {
+        return this.ready.length;
+    }
+    consume(line) {
+        const match = /^(\d{3})([ -]?)(.*)$/u.exec(line);
+        if (match === null) {
+            this.fail(new SmtpError("smtp-protocol-error", `the server sent a line that is not an SMTP reply (${JSON.stringify(line.slice(0, 120))})`));
+            return;
+        }
+        const code = Number(match[1]);
+        const last = match[2] !== "-";
+        this.lines.push({ code, text: match[3] ?? "", last });
+        if (!last)
+            return;
+        const texts = this.lines.map((entry) => entry.text);
+        const reply = { code, lines: texts, first: texts[0] ?? "" };
+        this.lines = [];
+        const waiter = this.waiting;
+        if (waiter === null)
+            this.ready.push(reply);
+        else {
+            this.waiting = null;
+            waiter.resolve(reply);
+        }
+    }
+    /** Terminate every pending and future read with `error`. Idempotent. */
+    fail(error) {
+        if (this.failure === null)
+            this.failure = error;
+        const waiter = this.waiting;
+        if (waiter !== null) {
+            this.waiting = null;
+            waiter.reject(this.failure);
+        }
+    }
+    /** The next complete reply. Rejects with the session's failure, if any. */
+    next() {
+        const queued = this.ready.shift();
+        if (queued !== undefined)
+            return Promise.resolve(queued);
+        if (this.failure !== null)
+            return Promise.reject(this.failure);
+        return new Promise((resolve, reject) => {
+            this.waiting = { resolve, reject };
+        });
+    }
+}
+/** Is `code` a success for this verb? RFC 5321: 2yz, plus 3yz where expected. */
+function expected(reply, codes) {
+    return codes.includes(reply.code) || codes.includes(Math.floor(reply.code / 100));
+}
+function replyFailure(verb, reply, redact) {
+    return new SmtpError(`smtp-${reply.code}`, 
+    // The whole vocabulary of a reply-code failure, and its whole content: the
+    // verb, the code, the FIRST line of the reply, redacted. See the header.
+    `${verb} refused: ${String(reply.code)} ${redact(reply.first)}`);
+}
+/** `\0user\0password`, base64. RFC 4616 over RFC 4954. */
+function plainToken(user, password) {
+    return Buffer.from(`\u0000${user}\u0000${password}`, "utf8").toString("base64");
+}
+/** The mechanisms the server advertised on its EHLO `AUTH` line, uppercased. */
+function authMechanisms(capabilities) {
+    for (const line of capabilities) {
+        const match = /^AUTH(?:[ =])(.*)$/iu.exec(line.trim());
+        if (match === null)
+            continue;
+        return (match[1] ?? "")
+            .split(/\s+/u)
+            .filter((entry) => entry.length > 0)
+            .map((entry) => entry.toUpperCase());
+    }
+    return [];
+}
+function advertises(capabilities, keyword) {
+    return capabilities.some((line) => line.trim().toUpperCase().split(/\s+/u)[0] === keyword);
+}
+async function runSession(options, envelope, message) {
+    const redact = options.redact ?? ((text) => text);
+    const timeoutMs = options.timeoutMs ?? DEFAULT_SMTP_TIMEOUT_MS;
+    const clientName = options.clientName ?? "approval.md";
+    const rejectUnauthorized = options.tlsRejectUnauthorized ?? true;
+    const transcript = [];
+    const reader = new ReplyReader();
+    let socket = null;
+    let secure = options.security === "implicit";
+    let authenticated = null;
+    // The one timer. Firing it poisons the reader, so whichever await is in
+    // flight rejects with the timeout rather than hanging until the socket does.
+    let expired = false;
+    const deadline = setTimeout(() => {
+        expired = true;
+        reader.fail(new SmtpError("smtp-timeout", `the SMTP session exceeded its ${String(timeoutMs)}ms budget; the message may or may not have been accepted, so the execution is recorded as failed and a human decides whether to send again`));
+        socket?.destroy();
+    }, timeoutMs);
+    // A timer must never hold the process open on its own.
+    deadline.unref?.();
+    /** Attach the reader to `next`, replacing any previous attachment. */
+    const attach = (next) => {
+        socket = next;
+        next.on("data", (chunk) => reader.push(chunk));
+        next.on("error", (cause) => {
+            reader.fail(expired
+                ? new SmtpError("smtp-timeout", "the SMTP session timed out")
+                : new SmtpError("smtp-protocol-error", `the connection failed: ${redact(cause.message)}`));
+        });
+        next.on("close", () => {
+            reader.fail(new SmtpError("smtp-protocol-error", "the server closed the connection before the transaction finished"));
+        });
+    };
+    /** Detach every listener, so a TLS wrapper can take the socket over. */
+    const detach = (from) => {
+        from.removeAllListeners("data");
+        from.removeAllListeners("error");
+        from.removeAllListeners("close");
+    };
+    /**
+     * Detach, then swallow. A socket this function has finished with can still
+     * emit `ECONNRESET` when the far side goes away, and an unhandled `error` on
+     * a socket is an uncaught exception that would take the process down — which
+     * for an adapter means a crash *after* a message was already delivered.
+     */
+    const abandon = (from) => {
+        detach(from);
+        from.on("error", () => {
+            /* the transaction is over; there is nothing left to report */
+        });
+    };
+    const write = (line) => {
+        socket?.write(`${line}${CRLF}`);
+    };
+    /** Send `line`, read one reply, and insist it is in `codes`. */
+    const say = async (verb, line, codes) => {
+        if (line !== null)
+            write(line);
+        const reply = await reader.next();
+        transcript.push(`${verb} ${String(reply.code)}`);
+        if (!expected(reply, codes))
+            throw replyFailure(verb, reply, redact);
+        return reply;
+    };
+    try {
+        // (1) The connection.
+        socket = await new Promise((resolve, reject) => {
+            const onError = (cause) => {
+                reject(new SmtpError(options.security === "implicit" ? "smtp-tls-failed" : "smtp-connect-failed", 
+                // The address is NOT interpolated: it came from the vault, and
+                // every value the vault handed over is redacted out of anything
+                // this adapter returns (see the email adapter's header). Naming the
+                // CREDENTIAL leaves the operator a diagnostic that survives the
+                // scrub and points at the thing to fix.
+                `could not connect to the SMTP host named by smtp.host, on the port named by smtp.port: ${redact(cause.message)}`));
+            };
+            if (options.security === "implicit") {
+                const tlsOptions = {
+                    host: options.host,
+                    port: options.port,
+                    rejectUnauthorized,
+                    servername: options.host,
+                };
+                const created = tlsConnect(tlsOptions, () => {
+                    created.removeListener("error", onError);
+                    resolve(created);
+                });
+                created.once("error", onError);
+            }
+            else {
+                const created = netConnect({ host: options.host, port: options.port }, () => {
+                    created.removeListener("error", onError);
+                    resolve(created);
+                });
+                created.once("error", onError);
+            }
+        });
+        attach(socket);
+        // (2) The greeting, then EHLO.
+        await say("greeting", null, [220]);
+        let ehlo = await say("EHLO", `EHLO ${clientName}`, [250]);
+        let capabilities = ehlo.lines.slice(1);
+        // (3) The STARTTLS upgrade, when the caller asked for one. A server that
+        //     does not offer it is a failure and never a silent downgrade: the
+        //     caller asked for an encrypted session and would otherwise get a
+        //     plaintext one carrying a password.
+        if (options.security === "starttls") {
+            if (!advertises(capabilities, "STARTTLS")) {
+                throw new SmtpError("smtp-tls-failed", "the server named by smtp.host does not advertise STARTTLS, and this adapter will not silently downgrade to a plaintext session carrying a password");
+            }
+            await say("STARTTLS", "STARTTLS", [220]);
+            // Anything already buffered here was injected by something that is not
+            // the server's TLS layer, and accepting it would be the classic STARTTLS
+            // command-injection hole. Refuse, loudly.
+            if (reader.pendingBytes > 0 || reader.pendingReplies > 0) {
+                throw new SmtpError("smtp-protocol-error", "bytes arrived after the STARTTLS reply and before the handshake; they were injected by something that is not the TLS session, and the transaction was abandoned");
+            }
+            const plain = socket;
+            detach(plain);
+            socket = await new Promise((resolve, reject) => {
+                const onError = (cause) => {
+                    reject(new SmtpError("smtp-tls-failed", `the STARTTLS handshake failed: ${redact(cause.message)}`));
+                };
+                const upgraded = tlsConnect({ socket: plain, rejectUnauthorized, servername: options.host }, () => {
+                    upgraded.removeListener("error", onError);
+                    resolve(upgraded);
+                });
+                upgraded.once("error", onError);
+            });
+            attach(socket);
+            secure = true;
+            // RFC 3207: the client MUST discard everything it learned before the
+            // upgrade and re-issue EHLO. A capability list from the plaintext phase
+            // is a capability list an attacker could have written.
+            ehlo = await say("EHLO", `EHLO ${clientName}`, [250]);
+            capabilities = ehlo.lines.slice(1);
+        }
+        // (4) AUTH, when a credential was supplied. PLAIN first, LOGIN as the
+        //     fallback, because some servers advertise both and accept only one.
+        const user = options.user ?? "";
+        const password = options.password ?? "";
+        if (user.length > 0 && password.length > 0) {
+            if (!secure) {
+                throw new SmtpError("smtp-tls-failed", 'a credential was supplied for a session with security "none"; this adapter will not send a password over a cleartext socket. Use "starttls" or "implicit", or store no smtp.user/smtp.password for a local relay that needs none');
+            }
+            const mechanisms = authMechanisms(capabilities);
+            const allow = (name) => mechanisms.length === 0 || mechanisms.includes(name);
+            let authError = null;
+            if (allow("PLAIN")) {
+                try {
+                    await say("AUTH", `AUTH PLAIN ${plainToken(user, password)}`, [235]);
+                    authenticated = "PLAIN";
+                }
+                catch (cause) {
+                    if (!(cause instanceof SmtpError))
+                        throw cause;
+                    // Only a REFUSAL is worth a second mechanism. A timeout or a dropped
+                    // socket has nothing left to fall back onto.
+                    if (!SMTP_REPLY_CODE_PATTERN.test(cause.code))
+                        throw cause;
+                    authError = cause;
+                }
+            }
+            if (authenticated === null && allow("LOGIN")) {
+                await say("AUTH", "AUTH LOGIN", [334]);
+                await say("AUTH", Buffer.from(user, "utf8").toString("base64"), [334]);
+                await say("AUTH", Buffer.from(password, "utf8").toString("base64"), [235]);
+                authenticated = "LOGIN";
+            }
+            if (authenticated === null) {
+                throw (authError ??
+                    new SmtpError("smtp-protocol-error", `a credential was supplied but the server advertises no mechanism this adapter speaks (it offers ${mechanisms.length === 0 ? "none" : mechanisms.join(", ")}; PLAIN and LOGIN are implemented)`));
+            }
+        }
+        // (5) The envelope. Bcc recipients are here and in no header.
+        //     A probe stops before this line: MAIL FROM is the first verb that
+        //     tells the server a message is coming, and a probe has nothing to say.
+        let accepted = null;
+        if (envelope !== null && message !== null) {
+            await say("MAIL FROM", `MAIL FROM:<${envelope.from}>`, [250]);
+            for (const recipient of envelope.recipients) {
+                await say("RCPT TO", `RCPT TO:<${recipient}>`, [250, 251]);
+            }
+            // (6) The message. Dot-stuffing and the terminator are transport framing.
+            await say("DATA", "DATA", [354]);
+            socket.write(dotStuff(message));
+            accepted = await say("message", ".", [250]);
+        }
+        // (7) QUIT is courtesy: the message is already accepted, and a server that
+        //     mishandles the goodbye has not unsent it. Failures here are ignored
+        //     on purpose — reporting one would turn a delivered message into a
+        //     failed execution, which is the worst lie this adapter could tell.
+        //     A probe has nothing to lose here either; it has already learned
+        //     everything the session can tell it.
+        clearTimeout(deadline);
+        abandon(socket);
+        // `end`, not `write` then `destroy`: a destroyed TLS socket discards the
+        // bytes still in its write buffer, and the far side would see the session
+        // vanish rather than end. The message is already accepted either way, so
+        // nothing here can turn a delivered message into a failed execution.
+        try {
+            socket.end(`QUIT${CRLF}`);
+        }
+        catch {
+            /* already delivered */
+        }
+        if (accepted === null)
+            return { ok: true, transcript, secure, authenticated };
+        return {
+            ok: true,
+            reply: { code: accepted.code, text: redact(accepted.first) },
+            transcript,
+            secure,
+            authenticated,
+        };
+    }
+    catch (cause) {
+        clearTimeout(deadline);
+        if (socket !== null) {
+            abandon(socket);
+            socket.destroy();
+        }
+        if (cause instanceof SmtpError) {
+            return { ok: false, code: cause.code, message: cause.message, transcript, secure };
+        }
+        return {
+            ok: false,
+            code: "smtp-protocol-error",
+            message: redact(cause instanceof Error ? cause.message : String(cause)),
+            transcript,
+            secure,
+        };
+    }
+}
+/**
+ * Run one SMTP transaction and report how it went. Never throws.
+ *
+ * The whole of it is {@link runSession}; this is the entry point that supplies
+ * an envelope and a message, and its result is unchanged from the day it was
+ * the whole function.
+ */
+export async function sendMail(options, envelope, message) {
+    return runSession(options, envelope, message);
+}
+/**
+ * Open a session, authenticate, send nothing, and report. Never throws.
+ *
+ * Exactly {@link sendMail}'s session up to AUTH — the same connection, the same
+ * STARTTLS rules including the no-downgrade refusal and the response-injection
+ * guard, the same refusal to put a password on a cleartext socket, the same
+ * one-session budget, the same redaction of every string it returns — and then
+ * QUIT. See this module's header for what a success does and does not prove:
+ * transport, TLS mode and credential, never that a message would be delivered.
+ */
+export async function probeSmtp(options) {
+    return runSession(options, null, null);
+}
+/**
+ * RFC 5321 §4.5.2: a line of the message that begins with `.` gets a second
+ * one, so the terminator cannot be forged by the message's own content. The
+ * terminating `.` line is NOT added here; {@link sendMail} sends it as its own
+ * command so the transcript records the reply to it.
+ */
+export function dotStuff(message) {
+    const body = message
+        .split(CRLF)
+        .map((line) => (line.startsWith(".") ? `.${line}` : line))
+        .join(CRLF);
+    return body.endsWith(CRLF) ? body : `${body}${CRLF}`;
+}
+//# sourceMappingURL=smtp.js.map

package/dist/src/adapters/smtp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smtp.js","sourceRoot":"","sources":["../../../src/adapters/smtp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AAEH,OAAO,EAAE,OAAO,IAAI,UAAU,EAAe,MAAM,UAAU,CAAC;AAC9D,OAAO,EAAE,OAAO,IAAI,UAAU,EAA0C,MAAM,UAAU,CAAC;AAmBzF,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,MAAM,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,0DAA0D;IAC1D,qBAAqB;IACrB,4EAA4E;IAC5E,iBAAiB;IACjB,yDAAyD;IACzD,cAAc;IACd,yEAAyE;IACzE,qBAAqB;CACb,CAAC;AAIX,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D,yDAAyD;AACzD,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAkF9C,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,IAAI,GAAG,MAAM,CAAC;AAEpB,wEAAwE;AACxE,MAAM,SAAU,SAAQ,KAAK;IAEhB,IAAI;IADf,YACW,IAAiD,EAC1D,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;oBAHN,IAAI;QAIb,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW;IACP,GAAG,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,KAAK,GAAoD,EAAE,CAAC;IAC5D,KAAK,GAAgB,EAAE,CAAC;IACxB,OAAO,GAA2E,IAAI,CAAC;IACvF,OAAO,GAAiB,IAAI,CAAC;IAErC,2DAA2D;IAC3D,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC5E,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,KAAK,KAAK,CAAC,CAAC;gBAAE,MAAM;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9E,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,8EAA8E;IAC9E,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3B,CAAC;IAEO,OAAO,CAAC,IAAY;QAC1B,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CACP,IAAI,SAAS,CACX,qBAAqB,EACrB,qDAAqD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAC3F,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,KAAK,GAAc,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACvE,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,MAAM,KAAK,IAAI;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aACvC,CAAC;YACJ,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,IAAI,CAAC,KAAY;QACf,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,IAAI;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/D,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChD,IAAI,CAAC,OAAO,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,iFAAiF;AACjF,SAAS,QAAQ,CAAC,KAAgB,EAAE,KAAwB;IAC1D,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAgB,EAAE,MAAgC;IACpF,OAAO,IAAI,SAAS,CAClB,QAAQ,KAAK,CAAC,IAAI,EAAsB;IACxC,2EAA2E;IAC3E,yEAAyE;IACzE,GAAG,IAAI,aAAa,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAChE,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,SAAS,UAAU,CAAC,IAAY,EAAE,QAAgB;IAChD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAClF,CAAC;AAED,gFAAgF;AAChF,SAAS,cAAc,CAAC,YAA+B;IACrD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,KAAK,CAAC,MAAM,CAAC;aACb,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;aACnC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,YAA+B,EAAE,OAAe;IAClE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;AAC7F,CAAC;AAoCD,KAAK,UAAU,UAAU,CACvB,OAA6B,EAC7B,QAA6B,EAC7B,OAAsB;IAEtB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC;IACvD,MAAM,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,IAAI,IAAI,CAAC;IAEjE,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;IACjC,IAAI,MAAM,GAA8B,IAAI,CAAC;IAC7C,IAAI,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC;IAC7C,IAAI,aAAa,GAA6B,IAAI,CAAC;IAEnD,wEAAwE;IACxE,6EAA6E;IAC7E,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;QAC/B,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,CAAC,IAAI,CACT,IAAI,SAAS,CACX,cAAc,EACd,iCAAiC,MAAM,CAAC,SAAS,CAAC,4IAA4I,CAC/L,CACF,CAAC;QACF,MAAM,EAAE,OAAO,EAAE,CAAC;IACpB,CAAC,EAAE,SAAS,CAAC,CAAC;IACd,uDAAuD;IACvD,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IAEnB,sEAAsE;IACtE,MAAM,MAAM,GAAG,CAAC,IAAwB,EAAQ,EAAE;QAChD,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YAChC,MAAM,CAAC,IAAI,CACT,OAAO;gBACL,CAAC,CAAC,IAAI,SAAS,CAAC,cAAc,EAAE,4BAA4B,CAAC;gBAC7D,CAAC,CAAC,IAAI,SAAS,CAAC,qBAAqB,EAAE,0BAA0B,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAC5F,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,MAAM,CAAC,IAAI,CACT,IAAI,SAAS,CACX,qBAAqB,EACrB,kEAAkE,CACnE,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,wEAAwE;IACxE,MAAM,MAAM,GAAG,CAAC,IAAwB,EAAQ,EAAE;QAChD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC;IAEF;;;;;OAKG;IACH,MAAM,OAAO,GAAG,CAAC,IAAwB,EAAQ,EAAE;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC;QACb,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,8DAA8D;QAChE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAQ,EAAE;QACnC,MAAM,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,gEAAgE;IAChE,MAAM,GAAG,GAAG,KAAK,EACf,IAAY,EACZ,IAAmB,EACnB,KAAwB,EACJ,EAAE;QACtB,IAAI,IAAI,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,sBAAsB;QACtB,MAAM,GAAG,MAAM,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjE,MAAM,OAAO,GAAG,CAAC,KAAY,EAAQ,EAAE;gBACrC,MAAM,CACJ,IAAI,SAAS,CACX,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,qBAAqB;gBAC3E,+DAA+D;gBAC/D,gEAAgE;gBAChE,oEAAoE;gBACpE,gEAAgE;gBAChE,wCAAwC;gBACxC,0FAA0F,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAClH,CACF,CAAC;YACJ,CAAC,CAAC;YACF,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACpC,MAAM,UAAU,GAAsB;oBACpC,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,kBAAkB;oBAClB,UAAU,EAAE,OAAO,CAAC,IAAI;iBACzB,CAAC;gBACF,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,EAAE,GAAG,EAAE;oBAC1C,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACzC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACnB,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE;oBAC1E,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACzC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACnB,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC;QAEf,+BAA+B;QAC/B,MAAM,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,QAAQ,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,IAAI,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEvC,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,yCAAyC;QACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YACpC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,SAAS,CACjB,iBAAiB,EACjB,oJAAoJ,CACrJ,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAEzC,uEAAuE;YACvE,yEAAyE;YACzE,0CAA0C;YAC1C,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,IAAI,MAAM,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,SAAS,CACjB,qBAAqB,EACrB,iKAAiK,CAClK,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC;YACrB,MAAM,CAAC,KAAK,CAAC,CAAC;YACd,MAAM,GAAG,MAAM,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACxD,MAAM,OAAO,GAAG,CAAC,KAAY,EAAQ,EAAE;oBACrC,MAAM,CAAC,IAAI,SAAS,CAAC,iBAAiB,EAAE,kCAAkC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;gBACtG,CAAC,CAAC;gBACF,MAAM,QAAQ,GAAG,UAAU,CACzB,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,EAC/D,GAAG,EAAE;oBACH,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAC1C,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACpB,CAAC,CACF,CAAC;gBACF,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,CAAC;YACf,MAAM,GAAG,IAAI,CAAC;YAEd,qEAAqE;YACrE,wEAAwE;YACxE,uDAAuD;YACvD,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,QAAQ,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;QAED,sEAAsE;QACtE,yEAAyE;QACzE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,SAAS,CACjB,iBAAiB,EACjB,kOAAkO,CACnO,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAE9F,IAAI,SAAS,GAAqB,IAAI,CAAC;YACvC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,MAAM,EAAE,cAAc,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;oBACrE,aAAa,GAAG,OAAO,CAAC;gBAC1B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,CAAC,KAAK,YAAY,SAAS,CAAC;wBAAE,MAAM,KAAK,CAAC;oBAC/C,qEAAqE;oBACrE,6CAA6C;oBAC7C,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;wBAAE,MAAM,KAAK,CAAC;oBAC3D,SAAS,GAAG,KAAK,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,IAAI,aAAa,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7C,MAAM,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBACvC,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBACvE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3E,aAAa,GAAG,OAAO,CAAC;YAC1B,CAAC;YACD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,MAAM,CACJ,SAAS;oBACT,IAAI,SAAS,CACX,qBAAqB,EACrB,mGAAmG,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC,CAChM,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,8DAA8D;QAC9D,uEAAuE;QACvE,4EAA4E;QAC5E,IAAI,QAAQ,GAAqB,IAAI,CAAC;QACtC,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,GAAG,CAAC,WAAW,EAAE,cAAc,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9D,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,GAAG,CAAC,SAAS,EAAE,YAAY,SAAS,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAC7D,CAAC;YAED,0EAA0E;YAC1E,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAChC,QAAQ,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,CAAC;QAED,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,0CAA0C;QAC1C,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,CAAC;QAChB,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAC9E,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YAC5D,UAAU;YACV,MAAM;YACN,aAAa;SACd,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,CAAC;YAChB,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACrF,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,UAAU;YACV,MAAM;SACP,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAA6B,EAC7B,QAAsB,EACtB,OAAe;IAEf,OAAO,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA6B;IAC3D,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,OAAO;SACjB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACzD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AACvD,CAAC"}

package/dist/src/adapters/vault-provider.d.ts

@@ -0,0 +1,114 @@
+/**
+ * The vault as a {@link CredentialProvider} (SPEC.md §10.4; APRV-68).
+ *
+ * `adapters/contract.ts` left one seam open and named the task that would fill
+ * it: "No vault. {@link CredentialProvider} is the seam a real vault implements
+ * (APRV-68)." This module is that implementation, and it is deliberately thin.
+ * Everything about *when* a credential may be read belongs to the contract;
+ * everything about *how* the bytes are stored belongs to `core/vault.ts`. What
+ * is left here is the translation between the two vocabularies.
+ *
+ * ## The structural rule
+ *
+ * A provider built here is only ever handed to
+ * {@link executeThroughAdapter} through {@link AdapterExecuteOptions.credentials}.
+ * The contract wraps it in a window that closes the instant `act` returns, so
+ * every read during `act` is inside a verified execution. Manual and selected
+ * live paths consume a token; explicitly authorized supervised or autonomous
+ * paths do not. Three things hold that rule up, and none is a convention:
+ *
+ * 1. `core/vault.ts` exports exactly one function that returns a credential
+ *    value (`getCredential`), and this module is its only caller in the
+ *    repository. `tests/vault.test.ts` pins both halves.
+ * 2. There is no CLI verb that prints a value. `approval vault` can set, list
+ *    (names), and remove; it cannot show. See `src/cli/vault.ts`.
+ * 3. The contract scans everything an adapter returns for the values the
+ *    provider handed out and redacts them, so a leak by a careless adapter is
+ *    caught mechanically rather than reviewed for.
+ *
+ * ## What this defends, and what it does not
+ *
+ * Exactly what the vault module's own threat model says, restated because a
+ * reader arriving from the adapter side deserves it here too. **Defended:**
+ * credentials at rest, and casual reads by an agent that can read files in the
+ * working tree — the ciphertext hides the names as well as the values.
+ * **Not defended (SPEC.md §11, plainly):** a compromised host, and an agent that
+ * can read the passphrase environment variable. Such an agent does not need this
+ * provider; it can decrypt the file directly. The vault raises the cost of a
+ * leak from reading a file to owning the session, and claims nothing beyond
+ * that.
+ *
+ * Total and synchronous, as {@link CredentialProvider} requires: nothing here
+ * throws, nothing blocks on a human, and every failure is one of the three
+ * {@link CREDENTIAL_REFUSAL_CODES}.
+ */
+import { type SourceRunner } from "../core/env-file.js";
+import type { CredentialProvider } from "./contract.js";
+/**
+ * How to reach the vault. Either the vault file directly, or the log path the
+ * convention derives it from — never both, so there is one answer to "which
+ * file".
+ */
+export type VaultLocation = {
+    vaultPath: string;
+} | {
+    logPath: string;
+};
+export interface VaultProviderOptions {
+    /**
+     * The NAME of the environment variable holding the passphrase. Callers get
+     * this from `passphraseEnvFor(loadPolicy(...))`, so the policy's declaration
+     * is honoured and the default applies when it declares nothing.
+     */
+    passphraseEnv: string;
+    /** Injectable for tests. Defaults to this process's environment. */
+    env?: NodeJS.ProcessEnv;
+    /**
+     * The instance's `.approval/env`, enabling the scoped passphrase fallback
+     * (APRV-168). Absent, and the provider behaves exactly as it always did:
+     * the passphrase comes from the environment or it comes from nowhere.
+     *
+     * Supplied by `approval adapter <name>`, which executes through the contract
+     * and therefore inside a consumed-token window. It is deliberately NOT
+     * supplied by `approval setup adapter <name>`, `approval vault`, or anything
+     * else: those hold no token, so the fallback would have no authority behind
+     * it. See `adapters/env-passphrase.ts` for the whole argument.
+     */
+    envFilePath?: string;
+    /** The keychain / secret-service seam, injectable exactly as it is there. */
+    sourceRunner?: SourceRunner;
+}
+/**
+ * A provider that answers from the encrypted vault.
+ *
+ * **Lazy, and cached for the life of the provider.** The vault is not opened
+ * until an adapter actually asks for something, so an execution that needs no
+ * credential pays no scrypt cost and touches no ciphertext. Once opened, the
+ * derived value for a name is remembered, because a provider's life *is* one
+ * `act` call: the contract closes it when `act` returns, so the cache cannot
+ * outlive the token window it was built for, and the alternative — a fresh
+ * ~100 ms key derivation per credential — would put a visible tax on an adapter
+ * that needs two.
+ *
+ * The passphrase is read from the environment on every open rather than
+ * captured at construction, so a provider built before the operator exported the
+ * variable is not permanently poisoned.
+ *
+ * **The scoped fallback (APRV-168).** When {@link VaultProviderOptions.envFilePath}
+ * is supplied AND the contract has told this provider it is inside a token
+ * window, a passphrase absent from the environment is resolved from the
+ * instance's `.approval/env` instead. That is the one narrowing of
+ * `core/env-file.ts`'s "no verb reads this file" rule, and the whole argument
+ * for it lives in `adapters/env-passphrase.ts`. The short form: the authority is
+ * the token, and a human tapped Approve for exactly this action. The value is
+ * used to derive one key and reaches no environment, no argv, no log, and no
+ * message; the cache is dropped when the window closes, so a passphrase resolved
+ * under one grant opens nothing under the next.
+ *
+ * Messages name the environment VARIABLE and the credential NAME, and never a
+ * value: an adapter's failure message is one of the strings the contract hands
+ * back to a caller, and a diagnostic that quoted the secret would defeat the
+ * redaction guard by putting the secret in the one place the guard cannot know
+ * to look for it.
+ */
+export declare function vaultCredentialProvider(location: VaultLocation, options: VaultProviderOptions): CredentialProvider;