credvault 0.14.0 → 0.15.0

package/README.md

@@ -30,14 +30,15 @@ npm install credvault
 | `newPassword()` | 24 characters, every class, no look-alikes. |
 | `ownerCredentials({ roleArn, owner, region })` | One app, many owners: an AWS session tagged `owner=<owner>` from one shared role, renewed before it ends. `ownerSsmClient` wraps it; `ownerPath("/myapp", "acme")` = `/myapp/owners/acme`. |
 | `apiKeySchema`, `ApiKey` | An API key as a credential: vendor (`site`), label (`account`), `owner`, `secret`, `purposes`, `status` (`live`, `spent` until a date, `revoked`), `via`, `vendorId`, `cap`, `previous`. The address is `site@account` (`keyAddress`, `parseKeyAddress`). No use count is stored: the audit has it. |
-| `env` on a key | Env names a key fills besides its vendor's ring names (`env: ["CLOUDFLARE_API_TOKEN"]`). The projection writes them. One env name, one key per owner. A new secret at a held address is refused unless `previous` names the old id: a second key takes its own label. |
+| `env` on a key | Env names a key fills besides its vendor's ring names (`env: ["CLOUDFLARE_API_TOKEN"]`). The projection writes them. One env name, one key per owner. A key with env names and no purpose is in no ring (`inRing`): it fills its own names only, so scoped tokens of one vendor are not a pool. A purpose puts it back. A new secret at a held address is refused unless `previous` names the old id: a second key takes its own label. |
 | `keyId(secret)`, `keyInfo(key)`, `liveAt(key, now)` | `keyId` is 12 hex characters of the secret's sha256: it names a key in a log. `keyInfo` is a key without its secret, with `address` and `id`; every listing returns that. `liveAt` is true for `live`, and for `spent` once `spentUntil` has passed. |
 | `envKeys(store)`, `memoryKeys(init?)` | Keys in an `EnvStore`, one row per key (the key as JSON, named `keyRowName(address)`: `exa@env-1` is `EXA__ENV_1`). Point the store at its own SSM path: SSM keeps 100 versions of each row, which is the key's history. `put` refuses a purpose another unrevoked key of the same vendor and owner holds. `list` has no secrets. |
 | `movePurposes(store, address, purposes)` | Gives a key purposes and takes them off the other keys of the same vendor and owner, in one call. The explicit move that `put` asks for. |
-| `keysFor(store, { owner, vendor, purpose?, now? })` | The ring: the live keys of a vendor for an owner. The key with the purpose first, then the `default` key, then the rest by `madeAt` (ties by account, `env-2` before `env-10`). Each key once. |
+| `keysFor(store, { owner, vendor, purpose?, now? })` | The ring: the live keys of a vendor for an owner (`inRing`). The key with the purpose first, then the `default` key, then the rest by `madeAt` (ties by account, `env-2` before `env-10`). Each key once. |
 | `projectKeys(keys)`, `applyProjection(store, keys)`, `projectionDiff(store, keys)` | The env view of the keys, one way. Per vendor: `<BASE>_API_KEY` from the `default` key, `<BASE>_API_KEY_1..n` from the rest in ring order, `NUM_<BASE>` = n. `applyProjection` writes only names that differ and removes stale ones. `projectionDiff` lists what would change as ids, never values: empty means env equals the vault. `parseVendorKeyName` and `isProjectedName` tell a projected name from any other. |
 | `keyUses(uses)` | From the audit: per key id, the count of allowed uses and the time of the last. A key use is a `SecretUse` with `keyId`, `owner` and `reason` set. |
 | `keysFromEnv(entries, { owner, madeAt })` | The migration piece. Each `<BASE>_API_KEY` is account `env-0` with purpose `default`, each `<BASE>_API_KEY_<n>` is `env-<n>`. A name above `NUM_<BASE>`, or a second name with the same value, is skipped and listed with its reason. Pure. |
+| `credvault gate --config <file>`, `gate(config)` | The key gate. Each role's processes hold sentinels (`wsk_…`, `sentinel(gateKey, role, name)`, stable) in `<dir>/<role>.env`, never keys. mitmproxy (pinned, upstream mode to the role's egress proxy) ends TLS only on keyed vendor hosts (`VENDOR_HOSTS`, or `hosts` in the config) and swaps a sentinel in a header, the query or the body for the real key. A sentinel on another role or host: 403 and an alert. Every swap and refusal is a `fileAudit` line with the `keyId`. Clients trust `<dir>/ca.pem` (`NODE_EXTRA_CA_CERTS`) or `<dir>/ca-bundle.pem` (`SSL_CERT_FILE`). Design: `designs/2026-11-08-gate.md`. |
 
 ## Example
 

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+/** `credvault gate --config <file>`: runs the key gate until stopped. */
+import { gate, loadGateConfig } from "./gate/run.js";
+const USAGE = "usage: credvault gate --config <file>";
+async function main(argv) {
+    const [cmd, ...rest] = argv;
+    if (cmd !== "gate") {
+        console.error(USAGE);
+        return 2;
+    }
+    const i = rest.indexOf("--config");
+    const path = i >= 0 ? rest[i + 1] : undefined;
+    if (!path) {
+        console.error(USAGE);
+        return 2;
+    }
+    const g = await gate(await loadGateConfig(path));
+    const roles = [...g.plan.files.keys()].join(", ");
+    console.error(`credvault gate: up; roles ${roles}; ${g.plan.keys.size} keys on ${g.plan.hosts.length} hosts`);
+    for (const sig of ["SIGTERM", "SIGINT"])
+        process.on(sig, () => g.stop());
+    return g.done;
+}
+main(process.argv.slice(2)).then((code) => process.exit(code), (err) => {
+    console.error(`credvault gate: ${err.message}`);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,yEAAyE;AACzE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,KAAK,GAAG,uCAAuC,CAAC;AAEtD,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,CAAC,KAAK,CACX,6BAA6B,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAC/F,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAU;QAAE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClF,OAAO,CAAC,CAAC,IAAI,CAAC;AAChB,CAAC;AAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,CAAC,GAAG,EAAE,EAAE;IACN,OAAO,CAAC,KAAK,CAAC,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CACF,CAAC"}

package/dist/gate/plan.d.ts

@@ -0,0 +1,48 @@
+import { z } from "zod";
+import { type EnvEntry } from "../env-store.js";
+/** Where each vendor's keys may go. A key whose vendor is not here needs a `hosts` entry in the config. */
+export declare const VENDOR_HOSTS: Readonly<Record<string, readonly string[]>>;
+/** `wsk_` + 28 base32 characters: what a process holds in place of a key. */
+export declare const SENTINEL: RegExp;
+export declare const gateConfigSchema: z.ZodObject<{
+    dir: z.ZodString;
+    mitmdump: z.ZodString;
+    audit: z.ZodString;
+    keychain: z.ZodDefault<z.ZodObject<{
+        service: z.ZodString;
+        account: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    sources: z.ZodArray<z.ZodString>;
+    hosts: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    roles: z.ZodRecord<z.ZodString, z.ZodObject<{
+        port: z.ZodNumber;
+        upstream: z.ZodString;
+        keys: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        plain: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type GateConfig = z.infer<typeof gateConfigSchema>;
+export interface GateKey {
+    role: string;
+    name: string;
+    value: string;
+    hosts: string[];
+    /** The vendor, or the first host for a key with none. */
+    site: string;
+    keyId: string;
+}
+export interface GatePlan {
+    /** Per role: the env file's entries, sentinels in place of keys. */
+    files: Map<string, EnvEntry[]>;
+    /** Sentinel → the real key. Only the gate and its addon hold this. */
+    keys: Map<string, GateKey>;
+    /** Every host a sentinel may go to: the proxy ends TLS on these only. */
+    hosts: string[];
+}
+/** Stable per gate key, role and name: a restart or a rotated value keeps the file as it is. */
+export declare function sentinel(gateKey: Buffer, role: string, name: string): string;
+/** Layers the sources: an earlier file wins a name. */
+export declare function layer(sources: EnvEntry[][]): Map<string, string>;
+export declare function planGate(config: GateConfig, values: Map<string, string>, gateKey: Buffer): GatePlan;
+/** mitmproxy's `allow_hosts`: TLS is ended on these hosts only; the rest pass as opaque tunnels. */
+export declare function allowHostsRegex(hosts: string[]): string;

package/dist/gate/plan.js

@@ -0,0 +1,151 @@
+/**
+ * The key gate's plan: which names each role holds, as stand-ins (sentinels)
+ * or as plain values, and the sentinel → real key map the proxy addon swaps
+ * from. Pure: the gate key and the source entries come in, nothing is read here.
+ */
+import { createHmac } from "node:crypto";
+import { z } from "zod";
+import { ENV_KEY } from "../env-store.js";
+import { keyId, parseVendorKeyName } from "../keys.js";
+/** Where each vendor's keys may go. A key whose vendor is not here needs a `hosts` entry in the config. */
+export const VENDOR_HOSTS = {
+    anthropic: ["api.anthropic.com"],
+    cerebras: ["api.cerebras.ai"],
+    cohere: ["api.cohere.com", "api.cohere.ai"],
+    exa: ["api.exa.ai"],
+    gemini: ["generativelanguage.googleapis.com"],
+    groq: ["api.groq.com"],
+    mistral: ["api.mistral.ai"],
+    openai: ["api.openai.com"],
+    openalex: ["api.openalex.org"],
+    openrouter: ["openrouter.ai"],
+    perplexity: ["api.perplexity.ai"],
+    typesafe: ["api.typesafe.ai"],
+    youtube: ["www.googleapis.com", "youtube.googleapis.com"],
+};
+/** `wsk_` + 28 base32 characters: what a process holds in place of a key. */
+export const SENTINEL = /wsk_[a-z2-7]{28}/g;
+const HOST = /^(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
+/** A name, or a name with `*` in it (`EXA_API_KEY*`). */
+const NAME_GLOB = /^[A-Z*][A-Z0-9_*]*$/;
+const roleSchema = z.object({
+    /** The port this role's processes send through (`HTTPS_PROXY`). */
+    port: z.number().int().min(1024).max(65535),
+    /** The role's own egress proxy (smokescreen): every request leaves through it. */
+    upstream: z.string().url(),
+    /** Names the role holds as sentinels. */
+    keys: z.array(z.string().regex(NAME_GLOB)).default([]),
+    /** Names the role holds as they are (`NUM_EXA`, a URL). Never a key. */
+    plain: z.array(z.string().regex(NAME_GLOB)).default([]),
+});
+export const gateConfigSchema = z.object({
+    /** Where the role env files, the CA and its bundle go. 0700. */
+    dir: z.string().min(1),
+    /** The `mitmdump` binary (a pinned venv). */
+    mitmdump: z.string().min(1),
+    /** The hash-chained audit file (`fileAudit`). */
+    audit: z.string().min(1),
+    /** The Keychain item that holds the gate key: sentinels are an HMAC of it. */
+    keychain: z.object({ service: z.string().min(1), account: z.string().optional() }).default({
+        service: "credvault-gate",
+    }),
+    /** Env files with the real values. An earlier file wins a name. */
+    sources: z.array(z.string().min(1)).min(1),
+    /** Hosts per name or glob, for a key with no vendor (`RESTATE_AUTH_TOKEN`), or to replace the vendor's list. */
+    hosts: z.record(z.string().regex(NAME_GLOB), z.array(z.string().regex(HOST)).min(1)).default({}),
+    roles: z.record(z.string().regex(/^[a-z][a-z0-9-]{0,31}$/), roleSchema),
+});
+const glob = (pattern) => new RegExp(`^${pattern.replace(/\*/g, "[A-Z0-9_]*")}$`);
+const matchesAny = (name, patterns) => patterns.some((p) => glob(p).test(name));
+const BASE32 = "abcdefghijklmnopqrstuvwxyz234567";
+function base32(buf) {
+    let bits = 0;
+    let acc = 0;
+    let out = "";
+    for (const byte of buf) {
+        acc = (acc << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            out += BASE32[(acc >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    return out;
+}
+/** Stable per gate key, role and name: a restart or a rotated value keeps the file as it is. */
+export function sentinel(gateKey, role, name) {
+    const mac = createHmac("sha256", gateKey).update(`${role}/${name}`).digest();
+    return `wsk_${base32(mac).slice(0, 28)}`;
+}
+function hostsFor(name, overrides) {
+    const exact = overrides[name];
+    if (exact)
+        return exact;
+    const byGlob = Object.entries(overrides).find(([p]) => p.includes("*") && glob(p).test(name));
+    if (byGlob)
+        return byGlob[1];
+    const vendor = parseVendorKeyName(name)?.vendor;
+    const listed = vendor ? VENDOR_HOSTS[vendor] : undefined;
+    return listed ? [...listed] : null;
+}
+/** Layers the sources: an earlier file wins a name. */
+export function layer(sources) {
+    const out = new Map();
+    for (const entries of sources)
+        for (const { name, value } of entries)
+            if (!out.has(name))
+                out.set(name, value);
+    return out;
+}
+export function planGate(config, values, gateKey) {
+    const files = new Map();
+    const keys = new Map();
+    const hosts = new Set();
+    const ports = new Set();
+    for (const [role, r] of Object.entries(config.roles)) {
+        if (ports.has(r.port))
+            throw new Error(`role ${role}: port ${r.port} is taken by another role`);
+        ports.add(r.port);
+        const entries = [];
+        for (const name of [...values.keys()].sort()) {
+            const value = values.get(name);
+            if (!ENV_KEY.test(name))
+                continue;
+            if (matchesAny(name, r.keys)) {
+                const to = hostsFor(name, config.hosts);
+                if (!to)
+                    throw new Error(`role ${role}: ${name} has no hosts; add it to "hosts"`);
+                const s = sentinel(gateKey, role, name);
+                const vendor = parseVendorKeyName(name)?.vendor;
+                keys.set(s, {
+                    role,
+                    name,
+                    value,
+                    hosts: to,
+                    site: vendor ?? to[0],
+                    keyId: keyId(value),
+                });
+                for (const h of to)
+                    hosts.add(h);
+                entries.push({ name, value: s });
+            }
+            else if (matchesAny(name, r.plain)) {
+                if (hostsFor(name, config.hosts) && parseVendorKeyName(name))
+                    throw new Error(`role ${role}: ${name} is a key; list it in "keys", not "plain"`);
+                entries.push({ name, value });
+            }
+        }
+        files.set(role, entries);
+    }
+    return { files, keys, hosts: [...hosts].sort() };
+}
+/** mitmproxy's `allow_hosts`: TLS is ended on these hosts only; the rest pass as opaque tunnels. */
+export function allowHostsRegex(hosts) {
+    const alt = hosts
+        .map((h) => h.startsWith("*.")
+        ? `(?:[a-z0-9-]+\\.)+${h.slice(2).replace(/\./g, "\\.")}`
+        : h.replace(/\./g, "\\."))
+        .join("|");
+    return `^(?:${alt})(?::\\d+)?$`;
+}
+//# sourceMappingURL=plan.js.map

package/dist/gate/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/gate/plan.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAiB,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEvD,2GAA2G;AAC3G,MAAM,CAAC,MAAM,YAAY,GAAgD;IACvE,SAAS,EAAE,CAAC,mBAAmB,CAAC;IAChC,QAAQ,EAAE,CAAC,iBAAiB,CAAC;IAC7B,MAAM,EAAE,CAAC,gBAAgB,EAAE,eAAe,CAAC;IAC3C,GAAG,EAAE,CAAC,YAAY,CAAC;IACnB,MAAM,EAAE,CAAC,mCAAmC,CAAC;IAC7C,IAAI,EAAE,CAAC,cAAc,CAAC;IACtB,OAAO,EAAE,CAAC,gBAAgB,CAAC;IAC3B,MAAM,EAAE,CAAC,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,CAAC,kBAAkB,CAAC;IAC9B,UAAU,EAAE,CAAC,eAAe,CAAC;IAC7B,UAAU,EAAE,CAAC,mBAAmB,CAAC;IACjC,QAAQ,EAAE,CAAC,iBAAiB,CAAC;IAC7B,OAAO,EAAE,CAAC,oBAAoB,EAAE,wBAAwB,CAAC;CAC1D,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AAE5C,MAAM,IAAI,GAAG,0EAA0E,CAAC;AACxF,yDAAyD;AACzD,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAExC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,mEAAmE;IACnE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAC3C,kFAAkF;IAClF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B,yCAAyC;IACzC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,wEAAwE;IACxE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACxD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,gEAAgE;IAChE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,6CAA6C;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,iDAAiD;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC;QACzF,OAAO,EAAE,gBAAgB;KAC1B,CAAC;IACF,mEAAmE;IACnE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,gHAAgH;IAChH,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChG,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,UAAU,CAAC;CACxE,CAAC,CAAC;AAsBH,MAAM,IAAI,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC;AAClG,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,QAAkB,EAAW,EAAE,CAC/D,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAE3C,MAAM,MAAM,GAAG,kCAAkC,CAAC;AAClD,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACxB,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACzC,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,IAAY,EAAE,IAAY;IAClE,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7E,OAAO,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAmC;IACjE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9F,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,KAAK,CAAC,OAAqB;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,OAAO;QAC3B,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,MAAkB,EAClB,MAA2B,EAC3B,OAAe;IAEf,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC,IAAI,2BAA2B,CAAC,CAAC;QAChG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,OAAO,GAAe,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAW,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxC,IAAI,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,IAAI,kCAAkC,CAAC,CAAC;gBAClF,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;gBAChD,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE;oBACV,IAAI;oBACJ,IAAI;oBACJ,KAAK;oBACL,KAAK,EAAE,EAAE;oBACT,IAAI,EAAE,MAAM,IAAK,EAAE,CAAC,CAAC,CAAY;oBACjC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;iBACpB,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,IAAI,EAAE;oBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YACnC,CAAC;iBAAM,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC;oBAC1D,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,IAAI,2CAA2C,CAAC,CAAC;gBACpF,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,eAAe,CAAC,KAAe;IAC7C,MAAM,GAAG,GAAG,KAAK;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAChB,CAAC,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE;QACzD,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAC5B;SACA,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,OAAO,GAAG,cAAc,CAAC;AAClC,CAAC"}

package/dist/gate/run.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The key gate process: plans from the sources, writes each role's env file
+ * (sentinels), starts mitmdump with one listener per keyed role, hands the map
+ * to the addon over fd 3 and audits each swap or refusal it reports on fd 4.
+ * Real values live in this process and the addon only.
+ */
+import { type ChildProcess } from "node:child_process";
+import { type SecretAudit } from "../audit.js";
+import { type GateConfig, type GatePlan } from "./plan.js";
+export interface GateEvent {
+    t: "use" | "deny";
+    role: string | null;
+    host: string;
+    path: string;
+    /** The key's name; none for an unknown sentinel. */
+    name?: string | null;
+    /** The role the key belongs to (differs from `role` on a refusal). */
+    key_role?: string | null;
+    why?: string;
+}
+export declare function loadGateConfig(path: string): Promise<GateConfig>;
+export declare function readSources(paths: string[]): Promise<Map<string, string>>;
+/** `<dir>/<role>.env` per role, 0600. */
+export declare function writeRoleFiles(dir: string, plan: GatePlan): Promise<string[]>;
+/** The audit line for one addon event. No value, no query. */
+export declare function auditLine(e: GateEvent, plan: GatePlan): Parameters<SecretAudit["record"]>[0];
+export interface RunningGate {
+    child: ChildProcess;
+    plan: GatePlan;
+    /** Resolves with the child's exit code. */
+    done: Promise<number>;
+    stop(): void;
+}
+export interface GateOptions {
+    /** Defaults to the config's Keychain item. */
+    gateKey?: Buffer;
+    audit?: SecretAudit;
+    /** A refused sentinel: a canary. Default: one stderr line. */
+    onDeny?: (e: GateEvent) => void;
+}
+/** Writes the role files and the CA bundle, starts mitmdump; returns once it runs. */
+export declare function gate(config: GateConfig, o?: GateOptions): Promise<RunningGate>;

package/dist/gate/run.js

@@ -0,0 +1,170 @@
+/**
+ * The key gate process: plans from the sources, writes each role's env file
+ * (sentinels), starts mitmdump with one listener per keyed role, hands the map
+ * to the addon over fd 3 and audits each swap or refusal it reports on fd 4.
+ * Real values live in this process and the addon only.
+ */
+import { spawn } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { connect } from "node:net";
+import { join } from "node:path";
+import { createInterface } from "node:readline";
+import { fileAudit } from "../audit.js";
+import { keychainKey } from "../cipher.js";
+import { parseDotenv, toDotenv } from "../env-store.js";
+import { allowHostsRegex, gateConfigSchema, layer, planGate, } from "./plan.js";
+/** Shipped beside dist: `<package>/gate/addon.py`. */
+const ADDON = new URL("../../gate/addon.py", import.meta.url).pathname;
+const CA_CERT = "mitmproxy-ca-cert.pem";
+/** macOS's roots; Python and curl read `SSL_CERT_FILE` as the whole store, so the bundle adds the gate CA to them. */
+const SYSTEM_ROOTS = "/etc/ssl/cert.pem";
+async function writePrivate(path, text) {
+    const tmp = `${path}.${process.pid}.tmp`;
+    await writeFile(tmp, text, { mode: 0o600 });
+    await rename(tmp, path);
+}
+export async function loadGateConfig(path) {
+    return gateConfigSchema.parse(JSON.parse(await readFile(path, "utf8")));
+}
+export async function readSources(paths) {
+    const read = (p) => (existsSync(p) ? readFileSync(p, "utf8") : null);
+    return layer(await Promise.all(paths.map(async (p) => {
+        if (!existsSync(p))
+            throw new Error(`gate source ${p} is missing`);
+        return parseDotenv(await readFile(p, "utf8"), read);
+    })));
+}
+/** `<dir>/<role>.env` per role, 0600. */
+export async function writeRoleFiles(dir, plan) {
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    await chmod(dir, 0o700);
+    const out = [];
+    for (const [role, entries] of plan.files) {
+        const path = join(dir, `${role}.env`);
+        await writePrivate(path, toDotenv(entries));
+        out.push(path);
+    }
+    return out;
+}
+/** The audit line for one addon event. No value, no query. */
+export function auditLine(e, plan) {
+    const name = e.name ?? "unknown";
+    const k = [...plan.keys.values()].find((x) => x.name === name && x.role === e.key_role);
+    return {
+        at: new Date().toISOString(),
+        credential: name,
+        field: "secret",
+        site: k?.site ?? e.host,
+        url: `https://${e.host}${e.path}`,
+        by: `gate:${e.role ?? "?"}`,
+        allowed: e.t === "use",
+        owner: "wren",
+        ...(k ? { keyId: k.keyId } : {}),
+        ...(e.why ? { reason: e.why } : {}),
+    };
+}
+/** Writes the role files and the CA bundle, starts mitmdump; returns once it runs. */
+export async function gate(config, o = {}) {
+    const { service, account } = config.keychain;
+    const key = o.gateKey ?? keychainKey(account ? { service, account } : { service });
+    const plan = planGate(config, await readSources(config.sources), key);
+    await writeRoleFiles(config.dir, plan);
+    const confdir = join(config.dir, "ca");
+    await mkdir(confdir, { recursive: true, mode: 0o700 });
+    const keyed = Object.entries(config.roles).filter(([role]) => [...plan.keys.values()].some((k) => k.role === role));
+    if (!keyed.length)
+        throw new Error("no role holds a key: nothing to gate");
+    const args = [
+        "-q",
+        ...keyed.flatMap(([, r]) => ["--mode", `upstream:${r.upstream}@127.0.0.1:${r.port}`]),
+        "--set",
+        `confdir=${confdir}`,
+        "--set",
+        `allow_hosts=${allowHostsRegex(plan.hosts)}`,
+        "--set",
+        "termlog_verbosity=warn",
+        "--set",
+        "flow_detail=0",
+        "-s",
+        ADDON,
+    ];
+    const child = spawn(config.mitmdump, args, {
+        stdio: ["ignore", "inherit", "inherit", "pipe", "pipe"],
+    });
+    const map = {
+        ports: Object.fromEntries(keyed.map(([role, r]) => [String(r.port), role])),
+        keys: Object.fromEntries([...plan.keys].map(([s, k]) => [
+            s,
+            { role: k.role, name: k.name, value: k.value, hosts: k.hosts },
+        ])),
+    };
+    child.stdio[3].end(JSON.stringify(map));
+    const audit = o.audit ?? fileAudit(config.audit);
+    const onDeny = o.onDeny ??
+        ((e) => console.error(`credvault gate: ALERT ${e.name ?? "unknown sentinel"} refused on ${e.host}${e.path} (role ${e.role}): ${e.why}`));
+    createInterface({ input: child.stdio[4] }).on("line", (line) => {
+        let e;
+        try {
+            e = JSON.parse(line);
+        }
+        catch {
+            return;
+        }
+        if (e.t === "deny")
+            onDeny(e);
+        void audit
+            .record(auditLine(e, plan))
+            .catch((err) => console.error(`credvault gate: audit failed: ${err.message}`));
+    });
+    const done = new Promise((resolve) => child.on("exit", (code) => resolve(code ?? 1)));
+    await waitFor(() => existsSync(join(confdir, CA_CERT)), done, "the gate CA");
+    await writeBundle(config.dir, confdir);
+    for (const [role, r] of keyed)
+        await waitPort(r.port, done, `role ${role}`);
+    return { child, plan, done, stop: () => child.kill("SIGTERM") };
+}
+/** `<dir>/ca.pem` (the gate CA, for `NODE_EXTRA_CA_CERTS`) and `<dir>/ca-bundle.pem` (system roots + it). */
+async function writeBundle(dir, confdir) {
+    const ca = await readFile(join(confdir, CA_CERT), "utf8");
+    const roots = existsSync(SYSTEM_ROOTS) ? await readFile(SYSTEM_ROOTS, "utf8") : "";
+    await writeFile(join(dir, "ca.pem"), ca, { mode: 0o644 });
+    await writeFile(join(dir, "ca-bundle.pem"), `${roots.trimEnd()}\n${ca}`, { mode: 0o644 });
+}
+async function waitFor(ok, died, what) {
+    let dead = false;
+    void died.then(() => {
+        dead = true;
+    });
+    for (let i = 0; i < 300; i++) {
+        if (ok())
+            return;
+        if (dead)
+            throw new Error(`mitmdump exited before ${what} was ready`);
+        await new Promise((r) => setTimeout(r, 100));
+    }
+    throw new Error(`${what} not ready after 30 s`);
+}
+async function waitPort(port, died, what) {
+    let dead = false;
+    void died.then(() => {
+        dead = true;
+    });
+    const probe = () => new Promise((resolve) => {
+        const s = connect(port, "127.0.0.1");
+        s.once("connect", () => {
+            s.destroy();
+            resolve(true);
+        });
+        s.once("error", () => resolve(false));
+    });
+    for (let i = 0; i < 300; i++) {
+        if (await probe())
+            return;
+        if (dead)
+            throw new Error(`mitmdump exited before ${what} listened`);
+        await new Promise((r) => setTimeout(r, 100));
+    }
+    throw new Error(`${what}: port ${port} not listening after 30 s`);
+}
+//# sourceMappingURL=run.js.map

package/dist/gate/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/gate/run.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAqB,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,SAAS,EAAoB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,eAAe,EAGf,gBAAgB,EAChB,KAAK,EACL,QAAQ,GACT,MAAM,WAAW,CAAC;AAEnB,sDAAsD;AACtD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;AACvE,MAAM,OAAO,GAAG,uBAAuB,CAAC;AACxC,sHAAsH;AACtH,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAczC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY;IACpD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAe;IAC/C,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,KAAK,CACV,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACnE,OAAO,WAAW,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,IAAc;IAC9D,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;QACtC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,SAAS,CAAC,CAAY,EAAE,IAAc;IACpD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC;IACjC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxF,OAAO;QACL,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,UAAU,EAAE,IAAI;QAChB,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,IAAI;QACvB,GAAG,EAAE,WAAW,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE;QACjC,EAAE,EAAE,QAAQ,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE;QAC3B,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK;QACtB,KAAK,EAAE,MAAM;QACb,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAkBD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,MAAkB,EAAE,IAAiB,EAAE;IAChE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7C,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IACtE,MAAM,cAAc,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEvD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAC3D,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CACrD,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG;QACX,IAAI;QACJ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,QAAQ,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACrF,OAAO;QACP,WAAW,OAAO,EAAE;QACpB,OAAO;QACP,eAAe,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAC5C,OAAO;QACP,wBAAwB;QACxB,OAAO;QACP,eAAe;QACf,IAAI;QACJ,KAAK;KACN,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE;QACzC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;KACxD,CAAC,CAAC;IACH,MAAM,GAAG,GAAG;QACV,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3E,IAAI,EAAE,MAAM,CAAC,WAAW,CACtB,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7B,CAAC;YACD,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;SAC/D,CAAC,CACH;KACF,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,CAAC,CAAc,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,MAAM,GACV,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,CAAY,EAAE,EAAE,CAChB,OAAO,CAAC,KAAK,CACX,yBAAyB,CAAC,CAAC,IAAI,IAAI,kBAAkB,eAAe,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,EAAE,CACjH,CAAC,CAAC;IACP,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAa,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACzE,IAAI,CAAY,CAAC;QACjB,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;YAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9B,KAAK,KAAK;aACP,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;aAC1B,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IAC7E,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK;QAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,6GAA6G;AAC7G,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAe;IACrD,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,EAAiB,EAAE,IAAqB,EAAE,IAAY;IAC3E,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;QAClB,IAAI,GAAG,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,EAAE,EAAE;YAAE,OAAO;QACjB,IAAI,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,YAAY,CAAC,CAAC;QACtE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,IAAqB,EAAE,IAAY;IACvE,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;QAClB,IAAI,GAAG,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,GAAG,EAAE,CACjB,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,CAAC,CAAC,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACL,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,MAAM,KAAK,EAAE;YAAE,OAAO;QAC1B,IAAI,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,WAAW,CAAC,CAAC;QACrE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,UAAU,IAAI,2BAA2B,CAAC,CAAC;AACpE,CAAC"}

package/dist/index.d.ts

@@ -4,8 +4,10 @@ export { type Chained, type ChainedFile, chainedFile, rowHash, type Verification
 export { aesGcmCipher, type Cipher, isSealed, type KeychainItem, keychainKey, plainCipher, trustKeychainKey, } from "./cipher.js";
 export { CREDENTIAL_ENV_FIELDS, type Credential, type CredentialEnvStore, type CredentialInput, type CredentialStore, credentialEnv, credentialEnvName, credentialSchema, type EnvNaming, envCredentials, fileCredentials, layeredCredentials, memoryCredentials, type PushOptions, pullCredentials, pushCredentials, ROLE_NAME, type SeenVersions, type SharedCredentialStore, type SyncOptions, syncedCredentials, versionsFile, } from "./credentials.js";
 export { ENV_KEY, type EnvEntry, type EnvListing, type EnvStore, envFileStore, expiring, memoryEnvStore, memoryUnshared, type PutOptions, parseDotenv, REMOVED, type SyncedEnvStore, ssmEnvStore, syncedEnvStore, toDotenv, toExports, type Unshared, unsharedFile, upsertDotenv, WouldReplace, } from "./env-store.js";
+export { allowHostsRegex, type GateConfig, type GateKey, type GatePlan, gateConfigSchema, layer, planGate, SENTINEL, sentinel, VENDOR_HOSTS, } from "./gate/plan.js";
+export { auditLine, type GateEvent, type GateOptions, gate, loadGateConfig, type RunningGate, readSources, writeRoleFiles, } from "./gate/run.js";
 export { type CredentialHistory, type CredentialVersion, changedFields, memoryCredentialHistory, ssmCredentialHistory, } from "./history.js";
-export { type ApiKey, type ApiKeyInput, apiKeySchema, applyProjection, envKeys, isProjectedName, KEY_ACCOUNT, KEY_SITE, type KeyInfo, type KeyStore, type KeysForOptions, keyAddress, keyId, keyInfo, keyRowName, keysFor, keysFromEnv, keyUses, liveAt, memoryKeys, movePurposes, type ProjectionChange, type ProjectionOptions, parseKeyAddress, parseVendorKeyName, projectionDiff, projectKeys, vendorBase, } from "./keys.js";
+export { type ApiKey, type ApiKeyInput, apiKeySchema, applyProjection, envKeys, inRing, isProjectedName, KEY_ACCOUNT, KEY_SITE, type KeyInfo, type KeyStore, type KeysForOptions, keyAddress, keyId, keyInfo, keyRowName, keysFor, keysFromEnv, keyUses, liveAt, memoryKeys, movePurposes, type ProjectionChange, type ProjectionOptions, parseKeyAddress, parseVendorKeyName, projectionDiff, projectKeys, vendorBase, } from "./keys.js";
 export { type AwsCredentials, checkOwner, OWNER_NAME, type OwnerSession, ownerCredentials, ownerPath, ownerSsmClient, } from "./owner.js";
 export { newPassword } from "./passwords.js";
 export { envSecrets, memorySecrets, type SecretSource, type TrackingSecrets, trackingSecrets, } from "./secrets.js";

package/dist/index.js

@@ -4,8 +4,10 @@ export { chainedFile, rowHash, verifyChain, } from "./chain.js";
 export { aesGcmCipher, isSealed, keychainKey, plainCipher, trustKeychainKey, } from "./cipher.js";
 export { CREDENTIAL_ENV_FIELDS, credentialEnv, credentialEnvName, credentialSchema, envCredentials, fileCredentials, layeredCredentials, memoryCredentials, pullCredentials, pushCredentials, ROLE_NAME, syncedCredentials, versionsFile, } from "./credentials.js";
 export { ENV_KEY, envFileStore, expiring, memoryEnvStore, memoryUnshared, parseDotenv, REMOVED, ssmEnvStore, syncedEnvStore, toDotenv, toExports, unsharedFile, upsertDotenv, WouldReplace, } from "./env-store.js";
+export { allowHostsRegex, gateConfigSchema, layer, planGate, SENTINEL, sentinel, VENDOR_HOSTS, } from "./gate/plan.js";
+export { auditLine, gate, loadGateConfig, readSources, writeRoleFiles, } from "./gate/run.js";
 export { changedFields, memoryCredentialHistory, ssmCredentialHistory, } from "./history.js";
-export { apiKeySchema, applyProjection, envKeys, isProjectedName, KEY_ACCOUNT, KEY_SITE, keyAddress, keyId, keyInfo, keyRowName, keysFor, keysFromEnv, keyUses, liveAt, memoryKeys, movePurposes, parseKeyAddress, parseVendorKeyName, projectionDiff, projectKeys, vendorBase, } from "./keys.js";
+export { apiKeySchema, applyProjection, envKeys, inRing, isProjectedName, KEY_ACCOUNT, KEY_SITE, keyAddress, keyId, keyInfo, keyRowName, keysFor, keysFromEnv, keyUses, liveAt, memoryKeys, movePurposes, parseKeyAddress, parseVendorKeyName, projectionDiff, projectKeys, vendorBase, } from "./keys.js";
 export { checkOwner, OWNER_NAME, ownerCredentials, ownerPath, ownerSsmClient, } from "./owner.js";
 export { newPassword } from "./passwords.js";
 export { envSecrets, memorySecrets, trackingSecrets, } from "./secrets.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAoC,MAAM,YAAY,CAAC;AACtF,OAAO,EAEL,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAGL,WAAW,EACX,OAAO,EAEP,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EAEZ,QAAQ,EAER,WAAW,EACX,WAAW,EACX,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EAKrB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAEhB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EAEjB,eAAe,EACf,eAAe,EACf,SAAS,EAIT,iBAAiB,EACjB,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,OAAO,EAIP,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,cAAc,EAEd,WAAW,EACX,OAAO,EAEP,WAAW,EACX,cAAc,EACd,QAAQ,EACR,SAAS,EAET,YAAY,EACZ,YAAY,EACZ,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,aAAa,EACb,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAGL,YAAY,EACZ,eAAe,EACf,OAAO,EACP,eAAe,EACf,WAAW,EACX,QAAQ,EAIR,UAAU,EACV,KAAK,EACL,OAAO,EACP,UAAU,EACV,OAAO,EACP,WAAW,EACX,OAAO,EACP,MAAM,EACN,UAAU,EACV,YAAY,EAGZ,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,UAAU,GACX,MAAM,WAAW,CAAC;AACnB,OAAO,EAEL,UAAU,EACV,UAAU,EAEV,gBAAgB,EAChB,SAAS,EACT,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EACL,UAAU,EACV,aAAa,EAGb,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,YAAY,EAIZ,IAAI,EACJ,eAAe,GAChB,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAoC,MAAM,YAAY,CAAC;AACtF,OAAO,EAEL,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAGL,WAAW,EACX,OAAO,EAEP,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EAEZ,QAAQ,EAER,WAAW,EACX,WAAW,EACX,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EAKrB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAEhB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EAEjB,eAAe,EACf,eAAe,EACf,SAAS,EAIT,iBAAiB,EACjB,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,OAAO,EAIP,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,cAAc,EAEd,WAAW,EACX,OAAO,EAEP,WAAW,EACX,cAAc,EACd,QAAQ,EACR,SAAS,EAET,YAAY,EACZ,YAAY,EACZ,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,eAAe,EAIf,gBAAgB,EAChB,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,SAAS,EAGT,IAAI,EACJ,cAAc,EAEd,WAAW,EACX,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAGL,aAAa,EACb,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAGL,YAAY,EACZ,eAAe,EACf,OAAO,EACP,MAAM,EACN,eAAe,EACf,WAAW,EACX,QAAQ,EAIR,UAAU,EACV,KAAK,EACL,OAAO,EACP,UAAU,EACV,OAAO,EACP,WAAW,EACX,OAAO,EACP,MAAM,EACN,UAAU,EACV,YAAY,EAGZ,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,UAAU,GACX,MAAM,WAAW,CAAC;AACnB,OAAO,EAEL,UAAU,EACV,UAAU,EAEV,gBAAgB,EAChB,SAAS,EACT,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EACL,UAAU,EACV,aAAa,EAGb,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,YAAY,EAIZ,IAAI,EACJ,eAAe,GAChB,MAAM,WAAW,CAAC"}

package/dist/keys.d.ts

@@ -53,6 +53,12 @@ export declare function parseKeyAddress(address: string): {
 export declare function keyInfo(key: ApiKey): KeyInfo;
 /** Live now: `live`, or `spent` with a `spentUntil` that has passed. `now` is epoch ms. */
 export declare function liveAt(key: Pick<ApiKey, "status" | "spentUntil">, now?: number): boolean;
+/**
+ * A key with its own env name and no purpose is read by that name alone: it is in no ring.
+ * Scoped tokens of one vendor (a Pages token, a tunnel token) are not one pool (WA-1129).
+ * A purpose puts a named key back in the ring.
+ */
+export declare const inRing: (k: Pick<ApiKey, "env" | "purposes">) => boolean;
 export interface KeyStore {
     get(address: string): Promise<ApiKey | null>;
     /** The address comes from `site` and `account`. Refuses a purpose another live key of the owner holds. */
@@ -86,7 +92,7 @@ export interface KeysForOptions {
     now?: number | undefined;
 }
 /**
- * The live keys of `vendor` for `owner`, in ring order: the key holding
+ * The live ring keys of `vendor` for `owner` (`inRing`), in ring order: the key holding
  * `purpose`, then the `default` key, then the rest by `madeAt` (ties by
  * account, `env-2` before `env-10`). The same key id appears once.
  */
@@ -107,7 +113,8 @@ export declare function isProjectedName(name: string): boolean;
  * The env names for a set of keys of one owner, per vendor: `<BASE>_API_KEY`
  * from the first key in ring order (the `default` one when there is one),
  * `<BASE>_API_KEY_1..n` from the rest, `NUM_<BASE>` = n when n > 0, then each
- * key's own `env` names. Revoked keys are left out; a vendor whose keys are
+ * key's own `env` names. A key with `env` names and no purpose is out of the ring
+ * (`inRing`) and fills its own names only. Revoked keys are left out; a vendor whose keys are
  * all revoked answers an empty list. Keys of several owners throw: project one
  * owner at a time.
  */

package/dist/keys.js

@@ -135,6 +135,12 @@ function ringOrder(keys, purpose) {
         Date.parse(a.madeAt) - Date.parse(b.madeAt) ||
         naturalCompare(a.account, b.account));
 }
+/**
+ * A key with its own env name and no purpose is read by that name alone: it is in no ring.
+ * Scoped tokens of one vendor (a Pages token, a tunnel token) are not one pool (WA-1129).
+ * A purpose puts a named key back in the ring.
+ */
+export const inRing = (k) => k.env.length === 0 || k.purposes.length > 0;
 /** The row a key sits in: the address as an env name (`exa@env-1` is `EXA__ENV_1`). */
 export function keyRowName(address) {
     parseKeyAddress(address);
@@ -281,13 +287,13 @@ export async function movePurposes(store, address, purposes) {
     return changed;
 }
 /**
- * The live keys of `vendor` for `owner`, in ring order: the key holding
+ * The live ring keys of `vendor` for `owner` (`inRing`), in ring order: the key holding
  * `purpose`, then the `default` key, then the rest by `madeAt` (ties by
  * account, `env-2` before `env-10`). The same key id appears once.
  */
 export async function keysFor(store, o) {
     const now = o.now ?? Date.now();
-    const ring = ringOrder((await store.list()).filter((k) => k.site === o.vendor && k.owner === o.owner && liveAt(k, now)), o.purpose);
+    const ring = ringOrder((await store.list()).filter((k) => k.site === o.vendor && k.owner === o.owner && liveAt(k, now) && inRing(k)), o.purpose);
     const out = [];
     const seen = new Set();
     for (const info of ring) {
@@ -333,7 +339,8 @@ export function isProjectedName(name) {
  * The env names for a set of keys of one owner, per vendor: `<BASE>_API_KEY`
  * from the first key in ring order (the `default` one when there is one),
  * `<BASE>_API_KEY_1..n` from the rest, `NUM_<BASE>` = n when n > 0, then each
- * key's own `env` names. Revoked keys are left out; a vendor whose keys are
+ * key's own `env` names. A key with `env` names and no purpose is out of the ring
+ * (`inRing`) and fills its own names only. Revoked keys are left out; a vendor whose keys are
  * all revoked answers an empty list. Keys of several owners throw: project one
  * owner at a time.
  */
@@ -347,14 +354,15 @@ export function projectKeys(keys) {
     const out = new Map();
     for (const site of [...bySite.keys()].sort()) {
         const base = vendorBase(site);
-        const ring = ringOrder((bySite.get(site) ?? []).filter((k) => k.status !== "revoked"));
+        const usable = (bySite.get(site) ?? []).filter((k) => k.status !== "revoked");
+        const ring = ringOrder(usable.filter(inRing));
         const entries = ring.map((k, i) => ({
             name: i === 0 ? `${base}_API_KEY` : `${base}_API_KEY_${i}`,
             value: k.secret,
         }));
         if (ring.length > 1)
             entries.push({ name: `NUM_${base}`, value: String(ring.length - 1) });
-        for (const k of ring)
+        for (const k of ringOrder(usable))
             for (const name of k.env)
                 entries.push({ name, value: k.secret });
         out.set(site, entries);

package/dist/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EACL,OAAO,EAGP,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,qFAAqF;AACrF,MAAM,CAAC,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AACjD,wGAAwG;AACxG,MAAM,CAAC,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAExD,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;AAElC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,kBAAkB;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,yDAAyD,CAAC;IAC3F,oEAAoE;IACpE,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,KAAK,CAAC,WAAW,EAAE,8DAA8D,CAAC;IACrF,8CAA8C;IAC9C,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,KAAK,CAAC,UAAU,EAAE,qEAAqE,CAAC;IAC3F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,0EAA0E;IAC1E,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,sEAAsE;IACtE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,iFAAiF;IACjF,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,mDAAmD,CAAC,CAAC;SACvF,OAAO,CAAC,EAAE,CAAC;IACd,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5D,6FAA6F;IAC7F,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE;IAC1B,MAAM,EAAE,GAAG;IACX,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE;IACzB,qBAAqB;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9F;;;OAGG;IACH,GAAG,EAAE,CAAC;SACH,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,8CAA8C,CAAC,CAAC;SAChF,OAAO,CAAC,EAAE,CAAC;IACd,iEAAiE;IACjE,QAAQ,EAAE,CAAC;SACR,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,4BAA4B,CAAC;QACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACtC,SAAS,EAAE,GAAG;KACf,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE;IACjE,OAAO,EAAE,wCAAwC;IACjD,IAAI,EAAE,CAAC,YAAY,CAAC;CACrB,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE;IAClE,OAAO,EAAE,yCAAyC;IAClD,IAAI,EAAE,CAAC,WAAW,CAAC;CACpB,CAAC,CAAC;AAQL,2FAA2F;AAC3F,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,MAAc,EAAU,EAAE,CAC9C,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAEjE,qFAAqF;AACrF,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,OAAe;IACtD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,kDAAkD,CAAC,CAAC;IACvF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,gBAAgB,OAAO,oFAAoF,CAC5G,CAAC;IACJ,OAAO,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,EAAE,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,yBAAyB,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACtC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IAChC,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,MAAM,CAAC,GAA0C,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACjF,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,CACL,GAAG,CAAC,MAAM,KAAK,OAAO,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAC5F,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,SAAS,cAAc,CAAC,CAAS,EAAE,CAAS;IAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAW,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAW,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACtB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACtC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;gBAAE,OAAO,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;YAC1D,IAAI,EAAE,KAAK,EAAE;gBAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAChB,IAAkB,EAClB,OAAgB;IAEhB,MAAM,IAAI,GAAG,CAAC,CAAI,EAAE,EAAE,CACpB,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;QACnD,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC9B,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CACnB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3C,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CACvC,CAAC;AACJ,CAAC;AAeD,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAmC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;AAEzF;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,KAAe;IACrC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,GAAW,EAAU,EAAE;QACrD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;YAC7D,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,YAAY,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,OAAO;YACjB,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7G,CAAC;QACJ,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,IAAI,IAAI,KAAK,IAAI;YACf,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,UAAU,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;QAC/F,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,IAAuB,EAAE,CAC5C,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAE5D,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,OAAO;YACf,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAChC,sFAAsF;YACtF,OAAO,SAAS,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,KAAK;YACb,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACrC,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;gBAC/B,IAAI,IAAI,KAAK,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,OAAO,SAAS,IAAI,kBAAkB,IAAI,EAAE,CAAC,CAAC;gBAC3F,8EAA8E;gBAC9E,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjC,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC;oBACzE,MAAM,IAAI,KAAK,CACb,OAAO,OAAO,kCAAkC,GAAG,8EAA8E,GAAG,kBAAkB,CACvJ,CAAC;YACN,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG;gBACrB,IAAI,eAAe,CAAC,CAAC,CAAC;oBACpB,MAAM,IAAI,KAAK,CAAC,OAAO,OAAO,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAClF,0EAA0E;YAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,EAAE,EAAE,CAAC;oBACpC,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;wBAAE,SAAS;oBACtE,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;oBACtC,IAAI,YAAY,KAAK,OAAO;wBAAE,SAAS;oBACvC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC3D,IAAI,KAAK,CAAC,MAAM;wBACd,MAAM,IAAI,KAAK,CACb,OAAO,OAAO,KAAK,YAAY,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,KAAK,yBAAyB,CAC5G,CAAC;oBACJ,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;wBAAE,SAAS;oBACtC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;oBACtE,IAAI,MAAM,CAAC,MAAM;wBACf,MAAM,IAAI,KAAK,CACb,OAAO,OAAO,KAAK,YAAY,kBAAkB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,KAAK,yBAAyB,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,aAAa,CAC9I,CAAC;gBACN,CAAC;YACH,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAChC,0EAA0E;YAC1E,qEAAqE;YACrE,IAAI,KAAK,KAAK,GAAG;gBAAE,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,OAAO,GAAG,CAAC;QACb,CAAC;QAED,KAAK,CAAC,IAAI;YACR,OAAO,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7F,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC/B,IAAI,CAAC;gBACH,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,OAAO;oBAAE,OAAO,KAAK,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,UAAU,CAAC,OAAsB,EAAE;IACjD,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAe,EACf,OAAe,EACf,QAAkB;IAElB,KAAK,MAAM,CAAC,IAAI,QAAQ;QACtB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,yCAAyC,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAC7B,MAAM,IAAI,KAAK,CAAC,OAAO,OAAO,kCAAkC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACtC,IACE,IAAI,CAAC,OAAO,KAAK,OAAO;YACxB,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;YACzB,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;YAC3B,IAAI,CAAC,MAAM,KAAK,SAAS;YACzB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAEhD,SAAS;QACX,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;QACxC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO,OAAO,CAAC;AACjB,CAAC;AAcD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAe,EAAE,CAAiB;IAC9D,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,SAAS,CACpB,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CACpE,EACD,CAAC,CAAC,OAAO,CACV,CAAC;IACF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS;QAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,iEAAiE;AACjE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAE1F,MAAM,QAAQ,GAAG,gDAAgD,CAAC;AAClE,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAC3C,MAAM,YAAY,GAAG,CAAC,IAAY,EAAiB,EAAE;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC,CAAC;AAEF,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,IAAc;IACxC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC;QACvF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,YAAY,CAAC,EAAE;YAC1D,KAAK,EAAE,CAAC,CAAC,MAAM;SAChB,CAAC,CAAC,CAAC;QACJ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3F,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACxF,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAmBD,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE;IACzC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC;IACzD,OAAO,kBAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,KAAK,UAAU,cAAc,CAC3B,KAAe,EACf,IAAc,EACd,CAAoB;IAEpB,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,wBAAwB,CAAC,CAAC;QAC5F,MAAM,GAAG,GAAG,OAAO,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAC1D,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CACtC,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzC,yFAAyF;QACzF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAqB,EAAE,EAAE,CACnD,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,IAAI;gBACf,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAID;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAe,EACf,IAAc,EACd,IAAuB,EAAE;IAEzB,OAAO,CAAC,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3E,IAAI;QACJ,IAAI;QACJ,IAAI;KACL,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAe,EACf,IAAc,EACd,IAAuB,EAAE;IAEzB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,CAAC,CAAC,OAAO;QACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC;YAC5F,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC;gBACvC,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAClE,CAAC;IACH,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI;YAAE,SAAS;QAC/B,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI;YAAE,SAAS;QAC/B,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,IAAiB;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAgD,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,SAAS;QACrC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;;YAExD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;gBACf,IAAI,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC;gBAClB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU;aAClF,CAAC,CAAC;IACP,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CACzB,OAAmB,EACnB,CAAoC;IAEpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAoC,EAAE,CAAC;IACpD,MAAM,KAAK,GAA2E,EAAE,CAAC;IACzF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;aACvC,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;QAChD,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,eAAe,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,CAAC,CAAC,MAAM;YACd,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE;YAC7B,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM;YACN,QAAQ,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EACL,OAAO,EAGP,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,qFAAqF;AACrF,MAAM,CAAC,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AACjD,wGAAwG;AACxG,MAAM,CAAC,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAExD,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;AAElC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,kBAAkB;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,yDAAyD,CAAC;IAC3F,oEAAoE;IACpE,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,KAAK,CAAC,WAAW,EAAE,8DAA8D,CAAC;IACrF,8CAA8C;IAC9C,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,KAAK,CAAC,UAAU,EAAE,qEAAqE,CAAC;IAC3F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,0EAA0E;IAC1E,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,sEAAsE;IACtE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,iFAAiF;IACjF,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,mDAAmD,CAAC,CAAC;SACvF,OAAO,CAAC,EAAE,CAAC;IACd,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5D,6FAA6F;IAC7F,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE;IAC1B,MAAM,EAAE,GAAG;IACX,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE;IACzB,qBAAqB;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9F;;;OAGG;IACH,GAAG,EAAE,CAAC;SACH,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,8CAA8C,CAAC,CAAC;SAChF,OAAO,CAAC,EAAE,CAAC;IACd,iEAAiE;IACjE,QAAQ,EAAE,CAAC;SACR,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,4BAA4B,CAAC;QACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACtC,SAAS,EAAE,GAAG;KACf,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE;IACjE,OAAO,EAAE,wCAAwC;IACjD,IAAI,EAAE,CAAC,YAAY,CAAC;CACrB,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE;IAClE,OAAO,EAAE,yCAAyC;IAClD,IAAI,EAAE,CAAC,WAAW,CAAC;CACpB,CAAC,CAAC;AAQL,2FAA2F;AAC3F,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,MAAc,EAAU,EAAE,CAC9C,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAEjE,qFAAqF;AACrF,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,OAAe;IACtD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,kDAAkD,CAAC,CAAC;IACvF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,gBAAgB,OAAO,oFAAoF,CAC5G,CAAC;IACJ,OAAO,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,EAAE,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,yBAAyB,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACtC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IAChC,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,MAAM,CAAC,GAA0C,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACjF,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,CACL,GAAG,CAAC,MAAM,KAAK,OAAO,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAC5F,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,SAAS,cAAc,CAAC,CAAS,EAAE,CAAS;IAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAW,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAW,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACtB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACtC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;gBAAE,OAAO,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;YAC1D,IAAI,EAAE,KAAK,EAAE;gBAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAChB,IAAkB,EAClB,OAAgB;IAEhB,MAAM,IAAI,GAAG,CAAC,CAAI,EAAE,EAAE,CACpB,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;QACnD,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC9B,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CACnB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3C,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CACvC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAmC,EAAW,EAAE,CACrE,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;AAe9C,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAmC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;AAEzF;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,KAAe;IACrC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,GAAW,EAAU,EAAE;QACrD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;YAC7D,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,YAAY,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,OAAO;YACjB,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7G,CAAC;QACJ,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,IAAI,IAAI,KAAK,IAAI;YACf,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,UAAU,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;QAC/F,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,IAAuB,EAAE,CAC5C,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAE5D,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,OAAO;YACf,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAChC,sFAAsF;YACtF,OAAO,SAAS,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,KAAK;YACb,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACrC,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;gBAC/B,IAAI,IAAI,KAAK,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,OAAO,SAAS,IAAI,kBAAkB,IAAI,EAAE,CAAC,CAAC;gBAC3F,8EAA8E;gBAC9E,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjC,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC;oBACzE,MAAM,IAAI,KAAK,CACb,OAAO,OAAO,kCAAkC,GAAG,8EAA8E,GAAG,kBAAkB,CACvJ,CAAC;YACN,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG;gBACrB,IAAI,eAAe,CAAC,CAAC,CAAC;oBACpB,MAAM,IAAI,KAAK,CAAC,OAAO,OAAO,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAClF,0EAA0E;YAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,EAAE,EAAE,CAAC;oBACpC,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;wBAAE,SAAS;oBACtE,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;oBACtC,IAAI,YAAY,KAAK,OAAO;wBAAE,SAAS;oBACvC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC3D,IAAI,KAAK,CAAC,MAAM;wBACd,MAAM,IAAI,KAAK,CACb,OAAO,OAAO,KAAK,YAAY,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,KAAK,yBAAyB,CAC5G,CAAC;oBACJ,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;wBAAE,SAAS;oBACtC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;oBACtE,IAAI,MAAM,CAAC,MAAM;wBACf,MAAM,IAAI,KAAK,CACb,OAAO,OAAO,KAAK,YAAY,kBAAkB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,KAAK,yBAAyB,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,aAAa,CAC9I,CAAC;gBACN,CAAC;YACH,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAChC,0EAA0E;YAC1E,qEAAqE;YACrE,IAAI,KAAK,KAAK,GAAG;gBAAE,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,OAAO,GAAG,CAAC;QACb,CAAC;QAED,KAAK,CAAC,IAAI;YACR,OAAO,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7F,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC/B,IAAI,CAAC;gBACH,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,OAAO;oBAAE,OAAO,KAAK,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,UAAU,CAAC,OAAsB,EAAE;IACjD,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAe,EACf,OAAe,EACf,QAAkB;IAElB,KAAK,MAAM,CAAC,IAAI,QAAQ;QACtB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,yCAAyC,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAC7B,MAAM,IAAI,KAAK,CAAC,OAAO,OAAO,kCAAkC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACtC,IACE,IAAI,CAAC,OAAO,KAAK,OAAO;YACxB,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;YACzB,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;YAC3B,IAAI,CAAC,MAAM,KAAK,SAAS;YACzB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAEhD,SAAS;QACX,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;QACxC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO,OAAO,CAAC;AACjB,CAAC;AAcD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAe,EAAE,CAAiB;IAC9D,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,SAAS,CACpB,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CACjF,EACD,CAAC,CAAC,OAAO,CACV,CAAC;IACF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS;QAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,iEAAiE;AACjE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAE1F,MAAM,QAAQ,GAAG,gDAAgD,CAAC;AAClE,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAC3C,MAAM,YAAY,GAAG,CAAC,IAAY,EAAiB,EAAE;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC,CAAC;AAEF,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,IAAc;IACxC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,YAAY,CAAC,EAAE;YAC1D,KAAK,EAAE,CAAC,CAAC,MAAM;SAChB,CAAC,CAAC,CAAC;QACJ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3F,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAmBD,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE;IACzC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC;IACzD,OAAO,kBAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,KAAK,UAAU,cAAc,CAC3B,KAAe,EACf,IAAc,EACd,CAAoB;IAEpB,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,wBAAwB,CAAC,CAAC;QAC5F,MAAM,GAAG,GAAG,OAAO,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAC1D,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CACtC,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzC,yFAAyF;QACzF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAqB,EAAE,EAAE,CACnD,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,IAAI;gBACf,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAID;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAe,EACf,IAAc,EACd,IAAuB,EAAE;IAEzB,OAAO,CAAC,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3E,IAAI;QACJ,IAAI;QACJ,IAAI;KACL,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAe,EACf,IAAc,EACd,IAAuB,EAAE;IAEzB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,CAAC,CAAC,OAAO;QACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC;YAC5F,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC;gBACvC,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAClE,CAAC;IACH,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI;YAAE,SAAS;QAC/B,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI;YAAE,SAAS;QAC/B,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,IAAiB;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAgD,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,SAAS;QACrC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;;YAExD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;gBACf,IAAI,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC;gBAClB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU;aAClF,CAAC,CAAC;IACP,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CACzB,OAAmB,EACnB,CAAoC;IAEpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAoC,EAAE,CAAC;IACpD,MAAM,KAAK,GAA2E,EAAE,CAAC;IACzF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;aACvC,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;QAChD,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,eAAe,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,CAAC,CAAC,MAAM;YACd,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE;YAC7B,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM;YACN,QAAQ,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC"}

package/gate/addon.py

@@ -0,0 +1,85 @@
+# credvault key gate: mitmproxy addon. Swaps a sentinel for its real key on the key's hosts only.
+# fd 3 in: the map (JSON, read once). fd 4 out: one JSON line per sentinel seen. Values never go out.
+import json
+import os
+import re
+
+from mitmproxy import http
+
+SENTINEL = re.compile(r"wsk_[a-z2-7]{28}")
+BODY_MAX = 1 << 20
+
+with os.fdopen(3, "r") as f:
+    _MAP = json.load(f)
+PORTS = {int(p): r for p, r in _MAP["ports"].items()}
+KEYS = _MAP["keys"]  # sentinel -> {role, name, value, hosts}
+_events = os.fdopen(4, "w", buffering=1)
+
+
+def _host_ok(host: str, hosts: list) -> bool:
+    for h in hosts:
+        if h == host or (h.startswith("*.") and host.endswith(h[1:])):
+            return True
+    return False
+
+
+def _emit(**e) -> None:
+    try:
+        _events.write(json.dumps(e) + "\n")
+    except (BrokenPipeError, ValueError):
+        pass
+
+
+def _deny(flow: http.HTTPFlow, why: str) -> None:
+    flow.response = http.Response.make(403, f"credvault gate: {why}\n".encode(), {"content-type": "text/plain"})
+
+
+def request(flow: http.HTTPFlow) -> None:
+    req = flow.request
+    role = PORTS.get(flow.client_conn.sockname[1]) if flow.client_conn.sockname else None
+    host = req.pretty_host.lower()
+    path = req.path.split("?", 1)[0]
+
+    found = set()
+    for _, v in req.headers.items(multi=True):
+        found.update(SENTINEL.findall(v))
+    for _, v in req.query.items(multi=True):
+        found.update(SENTINEL.findall(v))
+    body = None
+    if req.raw_content and len(req.raw_content) <= BODY_MAX:
+        try:
+            body = req.get_text(strict=False)
+        except ValueError:
+            body = None
+        if body:
+            found.update(SENTINEL.findall(body))
+    if not found:
+        return
+
+    for s in found:
+        k = KEYS.get(s)
+        why = None
+        if k is None:
+            why = "unknown sentinel"
+        elif k["role"] != role:
+            why = "key not for this role"
+        elif not _host_ok(host, k["hosts"]):
+            why = "key not for this host"
+        if why:
+            _emit(t="deny", name=(k or {}).get("name"), key_role=(k or {}).get("role"), role=role, host=host, path=path, why=why)
+            _deny(flow, why)
+            return
+
+    for s in found:
+        k = KEYS[s]
+        for name, v in list(req.headers.items(multi=True)):
+            if s in v:
+                req.headers.set_all(name, [x.replace(s, k["value"]) for x in req.headers.get_all(name)])
+        for name in list(req.query.keys()):
+            vals = req.query.get_all(name)
+            if any(s in x for x in vals):
+                req.query.set_all(name, [x.replace(s, k["value"]) for x in vals])
+        if body and s in body:
+            body = body.replace(s, k["value"])
+            req.set_text(body)
+        _emit(t="use", name=k["name"], key_role=k["role"], role=role, host=host, path=path)

package/package.json

@@ -1,12 +1,15 @@
 {
   "name": "credvault",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "license": "PolyForm-Strict-1.0.0",
   "packageManager": "pnpm@9.15.0",
   "description": "Keep the credentials an automation signs in with: sealed at rest, shared through SSM, every use audited, expiries watched.",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "bin": {
+    "credvault": "./dist/cli.js"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -15,6 +18,7 @@
   },
   "files": [
     "dist",
+    "gate",
     "README.md",
     "LICENSE.md"
   ],