super-secret 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matthew Preucil
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,220 @@
-# Temporary Holding Version
+# super-secret
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Import, push and rotate a project's secrets with 1Password as the store.
+One manifest per repository says which env vars exist, where each one is
+consumed (a Railway service, a Cloudflare Worker, GitHub Actions, a local
+`.env`) and how it is rotated. Dry run is the default; nothing is written
+without `--apply`; values never appear in output.
+
+```bash
+npx super-secret status                       # what is where, and whether it matches the store
+npx super-secret import --from env:.env --apply   # one-time: the current values into the vault
+npx super-secret push --apply                 # the store's values to every target, redeploy what changed
+npx super-secret plan                         # what a rotation would do
+npx super-secret rotate worker-token --apply  # provision → store → push → deploy → probe → revoke
+npx super-secret verify --previous --expect-dead  # the backup slot must be dead afterwards
+```
+
+Node 22.6 or newer. No runtime dependencies; the CLIs it drives are
+[`op`](https://developer.1password.com/docs/cli/), `gh` and `wrangler`, whichever the manifest uses.
+
+## The manifest
+
+`super-secret.config.ts` (or `.mjs`, or `super-secret.json` for projects that are
+not TypeScript) in the repository root, or anywhere with `--manifest`:
+
+```ts
+import { defineManifest } from 'super-secret';
+
+export default defineManifest({
+	store: { kind: 'op', vault: 'my-app', item: 'production', account: 'my.1password.com' },
+	targets: {
+		cloudflare: { kind: 'cloudflare', cwd: 'worker' },
+		github: { kind: 'github', repo: 'me/my-app' },
+		railway: {
+			kind: 'railway',
+			project: '${RAILWAY_PROJECT_ID}',          // read from the store
+			environment: '${RAILWAY_ENVIRONMENT_ID}',
+			services: ['api', 'worker'],
+			token: '${RAILWAY_ACCOUNT_TOKEN}',
+		},
+		env: { kind: 'env-file', path: '.env' },      // the developer's local copy, kept in step
+	},
+	secrets: [
+		{
+			id: 'worker-token',
+			description: 'Shared bearer token the API checks on every worker request',
+			keys: ['WORKER_TOKEN'],
+			targets: { cloudflare: true, railway: true, env: true },
+			rotator: { kind: 'generated', length: 48 },
+		},
+		{
+			id: 'railway-account-token',
+			keys: ['RAILWAY_ACCOUNT_TOKEN'],
+			targets: { github: true, env: true },
+			rotator: {
+				kind: 'manual',
+				create: 'Railway → Account settings → Tokens → Create token',
+				retire: 'Railway → Account settings → Tokens → delete the previous token',
+				probe: { kind: 'railway-account' },
+			},
+		},
+		{
+			id: 'stripe',
+			keys: ['STRIPE_SECRET_KEY', 'STRIPE_WEBHOOK_SECRET'],
+			targets: { cloudflare: true },
+			rotator: { kind: 'stripe-webhook-secret', url: 'https://api.example.com/stripe/webhook' },
+		},
+	],
+});
+```
+
+A secret is a set of env-var names (`keys`) with one rotator and a map of the
+targets that receive them. `true` keeps the names; `{ STORE_KEY: 'TARGET_KEY' }`
+renames on the way (the same token called `RAILWAY_USAGE_TOKEN` by the app and
+`RAILWAY_ACCOUNT_TOKEN` by CI).
+
+Relative paths (`cwd`, `path`, `stateDir`) resolve against the manifest's directory, or against `root` when set (`root: '..'` for a manifest kept in `infra/`).
+
+Config strings may read `${KEY}` from the store or the operator env, so IDs
+and tokens live in the vault, not in the manifest.
+
+### Rotator kinds
+
+| kind | provision | revoke |
+|---|---|---|
+| `generated` | a random value (`length`, `alphabet`: alnum, hex, base64url) | nothing: the old value dies when every consumer has the new one |
+| `static` | never: identifiers, usernames, public DSNs | |
+| `manual` | the operator mints it where `create` says and pastes it (hidden, or on stdin); checked against `pattern` and `probe` | `retire` is queued as a manual step |
+| `stripe-secret-key` | manual roll in the Dashboard, paste; checked against the same account and mode | manual expire |
+| `stripe-webhook-secret` | a twin endpoint at `url`; its secret ships | the old endpoint is deleted |
+| `cloudflare-api-token` | the token rolls itself in place (needs "API Tokens: Edit") | none |
+
+Probes (`probe` on `generated` and `manual`): `{ kind: 'http', url, headers, bearer, basic, expect }`,
+or a preset: `railway-account`, `railway-project`, `github-token`, `stripe-key`,
+`anthropic`, `openai`, `openrouter`, `sentry`, `resend`, `synoptic`, `cloudflare-token`.
+
+A TypeScript manifest may pass a `Rotator` or `Target` object instead of a spec for anything
+provider-specific (see `src/types.ts`).
+
+### Targets
+
+| kind | writes | reads back | deploy |
+|---|---|---|---|
+| `railway` | GraphQL `variableCollectionUpsert` per service, `skipDeploys`; optional registry credentials (`registryCredentials: { username, password }` store keys) | values per service | `serviceInstanceRedeploy`, waits for the deployment to settle (`deploy: false` to skip) |
+| `cloudflare` | `wrangler secret bulk` in `cwd` | names only | none needed |
+| `github` | `gh secret set` (stdin), optional `environment` | names only | |
+| `env-file` | a local env file (0600, timestamped backup) | values | |
+
+Readable targets get only the keys that differ from the store. Write-only
+targets get every bound key on `push`; `status` shows present/missing for them.
+
+## The store
+
+One Secure Note per deployment target in one vault, with three sections:
+
+| section | field | holds |
+|---|---|---|
+| `current` | `<KEY>` | the value in use (reference: `op://vault/item/current/KEY`) |
+| `previous` | `<KEY>` | the value it replaced, the backup slot |
+| `meta` | `<KEY>_rotated_at` | when `current` took over |
+
+Every write moves the live value to `previous` first. `layout: 'flat'` uses
+`KEY`, `KEY_previous`, `KEY_rotated_at` without sections instead (an existing
+vault laid out that way keeps working). `store: { kind: 'env', file }` is the
+bootstrap store for a project that has not moved to 1Password yet.
+
+A second item, `operator` by default, holds what the tooling itself
+authenticates with (a Railway account token, `GH_TOKEN`, `CLOUDFLARE_API_TOKEN`,
+provider admin keys). The shell env wins; otherwise they are read from that
+item, so CI needs exactly one secret, `OP_SERVICE_ACCOUNT_TOKEN`.
+`import --operator NAME… --apply` fills it from the shell env.
+
+`op` needs a session: the desktop app's CLI integration locally (set
+`store.account` when several accounts are signed in), `OP_SERVICE_ACCOUNT_TOKEN`
+in CI. New items are created through a 0600 JSON template so values stay off
+argv; `op item edit` only takes assignments on argv, which is acceptable on a
+single-user machine or an ephemeral runner.
+
+## What a rotation does
+
+For each selected secret, in manifest order: **provision** the new value;
+**queue** the old credential in `.super-secret/pending-revocations.json`
+(git-ignore it) so a crash never leaves it live and forgotten; **store** it,
+moving the old value to `previous`; **push** it to every bound target without
+deploying. Then once: **deploy** each touched target; **probe** every new value;
+**revoke** the queued credentials. A failed probe stops before revocation;
+`revoke-pending --apply` drains the queue later, `--ack-manual` clears manual
+steps you have done by hand.
+
+`--no-deploy`, `--no-revoke`, `--targets a,b` and `--skip-manual` narrow a run.
+Manual rotators need a terminal; without one (CI) they are skipped.
+
+## Hosts and pods: `render`
+
+Projects that run on plain hosts or GPU pods keep a committed template of
+references and render it where the values are needed:
+
+```
+# secrets/prod.env.tpl
+API_SECRET=op://my-app/production/current/API_SECRET
+DATABASE_URL=op://my-app/production/current/DATABASE_URL
+TLS_KEY_B64=op://my-app/production/current/TLS_KEY     # multi-line → base64
+PUBLIC_URL=https://example.com                         # literals pass through
+```
+
+```bash
+npx super-secret render --template secrets/prod.env.tpl --check
+npx super-secret render --template secrets/prod.env.tpl --out /run/app/prod.env   # 0600, atomic
+```
+
+## From GitHub Actions
+
+```yaml
+- uses: 1password/install-cli-action@v4
+- run: npx super-secret push --apply --skip-manual
+  env:
+    OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+```
+
+The service account needs read/write on the vault; everything else comes from
+the `operator` item.
+
+## Rules the code keeps
+
+- Secret values never appear in output; `redact()` prints a prefix, a length and a short hash.
+- Values reach CLIs over stdin or a 0600 file, never argv (the `op item edit` assignments are the one exception).
+- Read-only calls are fine in a dry run; anything that writes checks `ctx.apply` first.
+- The manifest is the inventory: a key that is not in it is not managed.
+
+## Releasing
+
+Releases are cut by [semantic-release](https://semantic-release.gitbook.io/) from
+`main` in CI (`.github/workflows/ci.yml`), so commits follow
+[Conventional Commits](https://www.conventionalcommits.org/): `feat:` bumps the
+minor version, `fix:` the patch, a `BREAKING CHANGE:` footer or `feat!:` the
+major; `docs:`, `ci:`, `chore:`, `refactor:` and `test:` publish nothing. The
+version in `package.json` is a placeholder; the tag, the npm version and the
+GitHub release notes come from the commits.
+
+npm authenticates the workflow by [trusted publishing](https://docs.npmjs.com/trusted-publishers)
+(OIDC), so no npm token is stored anywhere. Bootstrap, once:
+
+1. From a laptop signed in to npm (`npm login`) and GitHub (`gh auth login`),
+   cut the first release with the same machinery:
+   `GITHUB_TOKEN=$(gh auth token) npx semantic-release --no-ci`
+2. On npmjs.com → the package → Settings → Trusted publisher: GitHub Actions,
+   repository `randymarsh77/super-secret`, workflow `ci.yml`.
+3. Set the repository variable `NPM_TRUSTED_PUBLISHING` to `true`
+   (`gh variable set NPM_TRUSTED_PUBLISHING -b true`). From then on every
+   release-worthy push to `main` publishes from CI with provenance.
+
+## Lineage
+
+Extracted from the secrets tooling in two private projects: a TypeScript
+pipeline (store interface, rotators, Railway and GitHub targets, revocation
+queue) and a Python one (op-backed vault items, `op://` templates rendered on
+hosts, dual-password datastore rotation). Datastore rotators (MySQL `RETAIN
+CURRENT PASSWORD`, Redis ACL) are the next thing to port.
+
+MIT.

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,249 @@
+#!/usr/bin/env node
+/**
+ * super-secret — import, push and rotate a project's secrets with 1Password as
+ * the store. Dry run is the default; nothing is written without --apply.
+ *
+ *   super-secret status [--probe]                      what is where (store vs each target), pending revocations
+ *   super-secret init                                  write a starter super-secret.json
+ *   super-secret import [ids|KEYS…] [--from env:.env] [--apply]
+ *                                                      copy values from an env file into the store
+ *   super-secret import --paste KEY… [--apply]         paste values (hidden) into the store
+ *   super-secret import --operator NAME… [--apply]     copy operator credentials from the shell env into the operator item
+ *   super-secret pull <target> [ids…] [--apply]        copy a readable target's values into the store (one-time sync)
+ *   super-secret push [ids…] [--targets a,b] [--no-deploy] [--force] [--apply]
+ *                                                      deploy the store's values to the targets, redeploy what changed
+ *   super-secret plan [ids…]                           dry run of rotate
+ *   super-secret rotate [ids…] --apply [--targets a,b] [--no-deploy] [--no-revoke] [--skip-manual]
+ *   super-secret verify [ids…] [--previous] [--expect-dead]
+ *   super-secret revoke-pending [--apply] [--ack-manual]
+ *   super-secret deploy <target>… --apply
+ *   super-secret render --template FILE (--check | --out FILE [--format env|json])
+ *
+ * --manifest PATH picks the manifest (default: super-secret.config.{ts,mts,mjs,js} or super-secret.json in the cwd).
+ */
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { parseArgs } from 'node:util';
+import { createStore, findManifest, loadManifest, resolveManifest, selectSecrets } from "./manifest.js";
+import { makeOperatorEnv, operatorStore } from "./operator.js";
+import { deployTargets, importStore, pullFromTarget, push, revokePending, rotate, status, verify } from "./pipeline.js";
+import { formatEnv, formatJson, opReader, parseTemplate, render, writePrivate } from "./render.js";
+import { EnvFileStore, memoryStore } from "./store/index.js";
+import { makeLogger, readHidden } from "./util.js";
+const { values: flags, positionals } = parseArgs({
+    args: process.argv.slice(2),
+    allowPositionals: true,
+    strict: true,
+    options: {
+        manifest: { type: 'string' },
+        apply: { type: 'boolean', default: false },
+        from: { type: 'string' },
+        paste: { type: 'boolean', default: false },
+        operator: { type: 'boolean', default: false },
+        targets: { type: 'string' },
+        'no-deploy': { type: 'boolean', default: false },
+        'no-revoke': { type: 'boolean', default: false },
+        'skip-manual': { type: 'boolean', default: false },
+        'ack-manual': { type: 'boolean', default: false },
+        'expect-dead': { type: 'boolean', default: false },
+        previous: { type: 'boolean', default: false },
+        probe: { type: 'boolean', default: false },
+        force: { type: 'boolean', default: false },
+        template: { type: 'string' },
+        out: { type: 'string' },
+        format: { type: 'string', default: 'env' },
+        check: { type: 'boolean', default: false },
+        help: { type: 'boolean', short: 'h', default: false },
+    },
+});
+const [command = 'status', ...rest] = positionals;
+function usage() {
+    const src = readFileSync(new URL(import.meta.url), 'utf8');
+    const header = src.split('*/')[0].split('\n').slice(2).map((l) => l.replace(/^ \* ?/, ''));
+    console.log(header.join('\n').trim());
+}
+if (flags.help || command === 'help') {
+    usage();
+    process.exit(0);
+}
+if (command === 'init') {
+    const file = resolve(process.cwd(), 'super-secret.json');
+    if (existsSync(file)) {
+        console.error(`${file} already exists`);
+        process.exit(1);
+    }
+    writeFileSync(file, JSON.stringify({
+        $schema: 'https://github.com/randymarsh77/super-secret#manifest',
+        store: { kind: 'op', vault: 'my-vault', item: 'production', account: 'my.1password.com' },
+        targets: {
+            github: { kind: 'github', repo: 'owner/repo' },
+        },
+        secrets: [
+            {
+                id: 'example-token',
+                description: 'Replace me: a shared bearer token the app verifies itself',
+                keys: ['EXAMPLE_TOKEN'],
+                targets: { github: true },
+                rotator: { kind: 'generated', length: 48 },
+            },
+        ],
+    }, null, 2) + '\n');
+    console.log(`wrote ${file}; add .super-secret/ to .gitignore`);
+    process.exit(0);
+}
+// A TypeScript manifest on a Node that does not strip types by default (22.x):
+// re-run ourselves with the flag so `import()` of the .ts file works.
+{
+    const path = flags.manifest ? resolve(process.cwd(), flags.manifest) : findManifest();
+    const isTs = !!path && /\.(mts|ts)$/.test(path);
+    const features = process.features;
+    if (isTs && !features.typescript && !process.execArgv.includes('--experimental-strip-types')) {
+        const r = spawnSync(process.execPath, ['--experimental-strip-types', '--no-warnings', ...process.argv.slice(1)], { stdio: 'inherit' });
+        process.exit(r.status ?? 1);
+    }
+}
+const apply = flags.apply && command !== 'plan';
+const log = makeLogger(!apply);
+const onlyTargets = flags.targets?.split(',').map((s) => s.trim()).filter(Boolean);
+function splitIdsAndKeys(tokens, defs) {
+    const ids = [];
+    const keys = [];
+    for (const t of tokens)
+        (/^[A-Z][A-Z0-9_]*$/.test(t) ? keys : ids).push(t);
+    const selected = selectSecrets(defs, ids);
+    const known = new Set(defs.flatMap((d) => d.keys));
+    const unknownKeys = keys.filter((k) => !known.has(k));
+    if (unknownKeys.length)
+        throw new Error(`key(s) not in the manifest: ${unknownKeys.join(', ')}`);
+    return { ids, keys: keys.length ? keys : selected.flatMap((d) => d.keys) };
+}
+try {
+    if (command === 'render') {
+        if (!flags.template)
+            throw new Error('render needs --template FILE');
+        if (!flags.check && !flags.out)
+            throw new Error('render needs --check or --out FILE');
+        const manifest = await loadManifest(flags.manifest).catch(() => undefined);
+        const account = manifest?.config.store.kind === 'op' ? manifest.config.store.account : undefined;
+        const entries = parseTemplate(readFileSync(resolve(process.cwd(), flags.template), 'utf8'), flags.template);
+        const values = await render(entries, opReader(account));
+        for (const e of entries)
+            console.log(`   ${e.key.padEnd(28)} ok  ${e.source.startsWith('op://') ? 'reference' : 'literal'}${e.key.endsWith('_B64') ? ' (base64)' : ''}`);
+        if (flags.check)
+            console.log(`== ${entries.length} keys resolve from ${flags.template}`);
+        else {
+            writePrivate(flags.out, flags.format === 'json' ? formatJson(values) : formatEnv(values));
+            console.log(`== wrote ${entries.length} keys to ${flags.out} (mode 0600); delete it when it has been consumed`);
+        }
+        process.exit(0);
+    }
+    const manifest = await loadManifest(flags.manifest);
+    const { targets, secrets } = resolveManifest(manifest.config);
+    const store = createStore(manifest.config.store, apply, log, manifest.root);
+    const operator = makeOperatorEnv(manifest.config.store, manifest.config.operator, log);
+    const ctx = {
+        store,
+        apply,
+        log,
+        operator,
+        targets,
+        root: manifest.root,
+        stateDir: resolve(manifest.root, manifest.config.stateDir ?? '.super-secret'),
+    };
+    const dryRunHint = (verb) => {
+        if (!apply)
+            log.info(`\nDry run. Re-run with --apply to ${verb}.`);
+    };
+    switch (command) {
+        case 'status':
+            await status(selectSecrets(secrets, rest), ctx, { probe: flags.probe });
+            break;
+        case 'plan':
+        case 'rotate':
+            await rotate(selectSecrets(secrets, rest), ctx, {
+                deploy: !flags['no-deploy'],
+                revoke: !flags['no-revoke'],
+                targets: onlyTargets,
+                skipManual: flags['skip-manual'],
+            });
+            if (!apply)
+                log.info('\nDry run. Re-run `rotate … --apply` to execute.');
+            break;
+        case 'import': {
+            if (flags.operator) {
+                const names = rest;
+                if (!names.length)
+                    throw new Error('import --operator needs the variable names to copy');
+                const present = {};
+                for (const n of names) {
+                    const v = process.env[n] ?? (flags.paste ? await readHidden(`Paste ${n} (hidden): `) : undefined);
+                    if (v)
+                        present[n] = v;
+                    else
+                        log.note(`${n}: not in the shell env, skipped (use --paste to enter it)`);
+                }
+                const to = operatorStore(manifest.config.store, manifest.config.operator, apply, log);
+                await importStore(memoryStore(present, 'shell env'), to, names, ctx);
+                dryRunHint('write the operator item');
+                break;
+            }
+            const { keys } = splitIdsAndKeys(rest, secrets);
+            if (flags.paste) {
+                const pasted = {};
+                for (const k of keys) {
+                    const v = await readHidden(`Paste ${k} (hidden, empty to skip): `);
+                    if (v)
+                        pasted[k] = v;
+                }
+                await importStore(memoryStore(pasted, 'pasted values'), store, Object.keys(pasted), ctx);
+            }
+            else {
+                const spec = flags.from ?? 'env:.env';
+                const [kind, arg] = spec.includes(':') ? [spec.slice(0, spec.indexOf(':')), spec.slice(spec.indexOf(':') + 1)] : [spec, ''];
+                if (kind !== 'env')
+                    throw new Error(`--from must be env:<file> (for a target, use \`pull <target>\`)`);
+                const from = new EnvFileStore(resolve(manifest.root, arg || '.env'), false, log);
+                await importStore(from, store, keys, ctx);
+            }
+            dryRunHint('write the store');
+            break;
+        }
+        case 'pull': {
+            const [target, ...ids] = rest;
+            if (!target)
+                throw new Error('pull needs a target name');
+            await pullFromTarget(selectSecrets(secrets, ids), target, ctx);
+            dryRunHint('write the store');
+            break;
+        }
+        case 'push':
+            await push(selectSecrets(secrets, rest), ctx, { deploy: !flags['no-deploy'], targets: onlyTargets, force: flags.force });
+            dryRunHint('push');
+            break;
+        case 'verify': {
+            const ok = await verify(selectSecrets(secrets, rest), ctx, flags['expect-dead'], flags.previous ? 'previous' : 'current');
+            process.exit(ok ? 0 : 1);
+        }
+        // eslint-disable-next-line no-fallthrough
+        case 'revoke-pending':
+            await revokePending(secrets, ctx, { ackManual: flags['ack-manual'] });
+            dryRunHint('revoke');
+            break;
+        case 'deploy':
+            if (!rest.length)
+                throw new Error('deploy needs target name(s)');
+            await deployTargets(ctx, rest);
+            dryRunHint('deploy');
+            break;
+        default:
+            console.error(`Unknown command "${command}".\n`);
+            usage();
+            process.exit(2);
+    }
+}
+catch (e) {
+    console.error(`\n✗ ${e.message}`);
+    process.exit(1);
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACxG,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACnG,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEnD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;IAChD,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3B,gBAAgB,EAAE,IAAI;IACtB,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE;QACR,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;QAC1C,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;QAC1C,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC3B,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;QAChD,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;QAChD,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;QAClD,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;QACjD,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;QAClD,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7C,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;QAC1C,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;QAC1C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC5B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QAC1C,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;QAC1C,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;KACrD;CACD,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC;AAElD,SAAS,KAAK;IACb,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,IAAI,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;IACtC,KAAK,EAAE,CAAC;IACR,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,mBAAmB,CAAC,CAAC;IACzD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,aAAa,CACZ,IAAI,EACJ,IAAI,CAAC,SAAS,CACb;QACC,OAAO,EAAE,uDAAuD;QAChE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE;QACzF,OAAO,EAAE;YACR,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE;SAC9C;QACD,OAAO,EAAE;YACR;gBACC,EAAE,EAAE,eAAe;gBACnB,WAAW,EAAE,2DAA2D;gBACxE,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;gBACzB,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;aAC1C;SACD;KACD,EACD,IAAI,EACJ,CAAC,CACD,GAAG,IAAI,CACR,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,oCAAoC,CAAC,CAAC;IAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,sEAAsE;AACtE,CAAC;IACA,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IACtF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAI,OAA4D,CAAC,QAAQ,CAAC;IACxF,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;QAC9F,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,4BAA4B,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACvI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAC7B,CAAC;AACF,CAAC;AAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,MAAM,CAAC;AAChD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC;AAC/B,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAEnF,SAAS,eAAe,CAAC,MAAgB,EAAE,IAAiB;IAC3D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,WAAW,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjG,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,IAAI,CAAC;IACJ,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACtF,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,MAAM,OAAO,GAAG,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACxD,KAAK,MAAM,CAAC,IAAI,OAAO;YACtB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjJ,IAAI,KAAK,CAAC,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,sBAAsB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;aACpF,CAAC;YACL,YAAY,CAAC,KAAK,CAAC,GAAI,EAAE,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3F,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,MAAM,YAAY,KAAK,CAAC,GAAG,mDAAmD,CAAC,CAAC;QACjH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACvF,MAAM,GAAG,GAAQ;QAChB,KAAK;QACL,KAAK;QACL,GAAG;QACH,QAAQ;QACR,OAAO;QACP,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,IAAI,eAAe,CAAC;KAC7E,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE;QACnC,IAAI,CAAC,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,qCAAqC,IAAI,GAAG,CAAC,CAAC;IACpE,CAAC,CAAC;IAEF,QAAQ,OAAO,EAAE,CAAC;QACjB,KAAK,QAAQ;YACZ,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACxE,MAAM;QACP,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ;YACZ,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE;gBAC/C,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;gBAC3B,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;gBAC3B,OAAO,EAAE,WAAW;gBACpB,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC;aAChC,CAAC,CAAC;YACH,IAAI,CAAC,KAAK;gBAAE,GAAG,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YACzE,MAAM;QACP,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACpB,MAAM,KAAK,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBACzF,MAAM,OAAO,GAAW,EAAE,CAAC;gBAC3B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACvB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;oBAClG,IAAI,CAAC;wBAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;;wBACjB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;gBAChF,CAAC;gBACD,MAAM,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBACtF,MAAM,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBACrE,UAAU,CAAC,yBAAyB,CAAC,CAAC;gBACtC,MAAM;YACP,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAChD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAW,EAAE,CAAC;gBAC1B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;oBACtB,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;oBACnE,IAAI,CAAC;wBAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACtB,CAAC;gBACD,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1F,CAAC;iBAAM,CAAC;gBACP,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,UAAU,CAAC;gBACtC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC5H,IAAI,IAAI,KAAK,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;gBACvG,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBACjF,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3C,CAAC;YACD,UAAU,CAAC,iBAAiB,CAAC,CAAC;YAC9B,MAAM;QACP,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACb,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACzD,MAAM,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC/D,UAAU,CAAC,iBAAiB,CAAC,CAAC;YAC9B,MAAM;QACP,CAAC;QACD,KAAK,MAAM;YACV,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACzH,UAAU,CAAC,MAAM,CAAC,CAAC;YACnB,MAAM;QACP,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC1H,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,0CAA0C;QAC1C,KAAK,gBAAgB;YACpB,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACtE,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrB,MAAM;QACP,KAAK,QAAQ;YACZ,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjE,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC/B,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrB,MAAM;QACP;YACC,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,MAAM,CAAC,CAAC;YACjD,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACF,CAAC;AAAC,OAAO,CAAC,EAAE,CAAC;IACZ,OAAO,CAAC,KAAK,CAAC,OAAQ,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export * from './types.ts';
+export { redact, sha, randomSecret, run, http, statusOf, probeFromStatus, makeLogger, readHidden, interpolate, HttpError } from './util.ts';
+export { resolveRef } from './resolve.ts';
+export * from './store/index.ts';
+export * from './targets/index.ts';
+export * from './rotators/index.ts';
+export { defineManifest, loadManifest, findManifest, validateManifest, resolveManifest, selectSecrets, createStore, MANIFEST_NAMES, type ManifestConfig, type SecretConfig, type StoreConfig, type OperatorConfig, type LoadedManifest, type Resolved, } from './manifest.ts';
+export { makeOperatorEnv, operatorStore, OPERATOR_ITEM } from './operator.ts';
+export { RevocationQueue, type PendingRevocation } from './state.ts';
+export * from './pipeline.ts';
+export * from './render.ts';

package/dist/index.js

@@ -0,0 +1,12 @@
+export * from "./types.js";
+export { redact, sha, randomSecret, run, http, statusOf, probeFromStatus, makeLogger, readHidden, interpolate, HttpError } from "./util.js";
+export { resolveRef } from "./resolve.js";
+export * from "./store/index.js";
+export * from "./targets/index.js";
+export * from "./rotators/index.js";
+export { defineManifest, loadManifest, findManifest, validateManifest, resolveManifest, selectSecrets, createStore, MANIFEST_NAMES, } from "./manifest.js";
+export { makeOperatorEnv, operatorStore, OPERATOR_ITEM } from "./operator.js";
+export { RevocationQueue } from "./state.js";
+export * from "./pipeline.js";
+export * from "./render.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC5I,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,OAAO,EACN,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,WAAW,EACX,cAAc,GAOd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,eAAe,EAA0B,MAAM,YAAY,CAAC;AACrE,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC"}

package/dist/manifest.d.ts

@@ -0,0 +1,65 @@
+import { type RotatorSpec } from './rotators/index.ts';
+import { type OpLayout } from './store/index.ts';
+import { type TargetConfig } from './targets/index.ts';
+import type { Logger, Rotator, SecretDef, SecretStore, Target, TargetBinding } from './types.ts';
+export type StoreConfig = {
+    kind: 'op';
+    vault: string;
+    /** One Secure Note per deployment target, e.g. `production`. */
+    item: string;
+    /** 1Password account (sign-in address or shorthand) when several are signed in. */
+    account?: string;
+    layout?: OpLayout;
+} | {
+    kind: 'env';
+    /** Relative to the manifest. */
+    file: string;
+};
+export interface OperatorConfig {
+    /** 1Password item in the store's vault holding operator credentials (default `operator`). */
+    item?: string;
+    layout?: OpLayout;
+}
+export interface SecretConfig {
+    id: string;
+    description?: string;
+    keys: string[];
+    /** target name → true (same names) or {storeKey: targetKey}. */
+    targets?: Record<string, TargetBinding>;
+    rotator: RotatorSpec | Rotator;
+    disruption?: string;
+}
+export interface ManifestConfig {
+    store: StoreConfig;
+    /** false: operator credentials come from the shell env only. */
+    operator?: OperatorConfig | false;
+    targets?: Record<string, TargetConfig | Target>;
+    secrets: SecretConfig[];
+    /** Pending revocations live here, relative to the root (default `.super-secret`). Git-ignore it. */
+    stateDir?: string;
+    /**
+     * The directory relative paths resolve against (targets' cwd and files,
+     * stateDir), relative to the manifest file. Default: the manifest's own
+     * directory; a manifest kept in `infra/` sets `root: '..'`.
+     */
+    root?: string;
+}
+/** Identity helper so a TypeScript manifest gets completion and checking. */
+export declare function defineManifest(config: ManifestConfig): ManifestConfig;
+export declare const MANIFEST_NAMES: string[];
+export interface LoadedManifest {
+    config: ManifestConfig;
+    path: string;
+    /** `config.root` resolved: relative paths resolve against it. */
+    root: string;
+}
+export declare function findManifest(cwd?: string): string | undefined;
+export declare function loadManifest(path?: string, cwd?: string): Promise<LoadedManifest>;
+export declare function validateManifest(cfg: ManifestConfig): string[];
+export declare function createStore(cfg: StoreConfig, apply: boolean, log: Logger, root: string): SecretStore;
+export interface Resolved {
+    targets: Record<string, Target>;
+    secrets: SecretDef[];
+}
+export declare function resolveManifest(cfg: ManifestConfig): Resolved;
+export declare function selectSecrets(defs: SecretDef[], ids: string[]): SecretDef[];