@centient/secrets 0.10.0 → 0.11.0

package/dist/vault/policy.d.ts

@@ -1,42 +1,50 @@
 /**
  * SecretsPolicy — Middleware layer for credential operations.
  *
- * Policies are cross-cutting concerns (audit, rate limiting, access
- * control, attestation) applied to every credential operation via
- * `setSecretsPolicies([...])`. In 0.5.0 only the audit policy is
- * shipped; the API shape is designed to grow into the full policy
- * stack described in ADR-002.
+ * Policies are cross-cutting concerns (audit, rate limiting, access control,
+ * attestation) applied to every credential operation. Explicit clients own an
+ * isolated stack supplied to `createSecretsClient`; `setSecretsPolicies`
+ * remains as the deprecated configuration path for the module-level shims and
+ * SessionVault. The API shape is designed for the full stack in ADR-002.
  *
  * Execution model:
  *   1. `before` hooks run top-to-bottom. If one throws, the operation
  *      is aborted and the error propagates to the caller — but the
- *      `after` hooks of already-entered policies (those whose `before`
- *      hook already completed) still fire with a `*_rejected` event, so
+ *      rejecting policy and already-entered policies still fire their
+ *      `after` hooks with a `*_rejected` event, so
  *      a policy-denied operation is audited rather than vanishing
- *      (ADR-002 §1.0.0). The rejecting policy's own `after` hook does
- *      not fire — its `before` hook did not complete.
+ *      (issue #98). Policies not yet reached do not fire.
  *   2. The backend operation executes.
  *   3. `after` hooks run bottom-to-top with a structured event
  *      describing the outcome. Exceptions in `after` hooks are
  *      swallowed with a one-time stderr warning — audit infrastructure
  *      failures must never break credential operations.
  */
-import type { VaultType } from "./types.js";
 export type SecretsEventType = "credential_read" | "credential_read_missing" | "credential_read_failed" | "credential_read_rejected" | "credential_written" | "credential_write_failed" | "credential_write_rejected" | "credential_deleted" | "credential_delete_failed" | "credential_delete_rejected" | "credential_enumerated" | "credential_enumerate_failed" | "credential_enumerate_rejected";
 export interface SecretsEvent {
-    type: SecretsEventType;
-    timestamp: string;
-    backend: VaultType;
-    key?: string;
-    keyCount?: number;
-    prefix?: string;
-    error?: string;
-    durationMs: number;
+    readonly type: SecretsEventType;
+    readonly timestamp: string;
+    readonly backend: string;
+    /** Full value-free operation descriptor supplied to policy hooks. */
+    readonly operation: SecretsOperation;
+    readonly key?: string;
+    readonly keyCount?: number;
+    readonly prefix?: string;
+    readonly error?: string;
+    readonly durationMs: number;
+}
+export interface SecretsCaller {
+    readonly id: string;
+    readonly kind?: string;
+}
+export interface SecretsOperationContext {
+    readonly caller?: SecretsCaller;
 }
 export interface SecretsOperation {
-    type: "read" | "write" | "delete" | "enumerate";
-    key?: string;
-    prefix?: string;
+    readonly type: "read" | "write" | "delete" | "enumerate";
+    readonly key?: string;
+    readonly prefix?: string;
+    readonly caller?: SecretsCaller;
 }
 /**
  * The audit event type emitted when a `before` hook rejects an
@@ -46,6 +54,12 @@ export interface SecretsOperation {
 export declare function rejectedEventType(op: SecretsOperation): SecretsEventType;
 export interface SecretsPolicy {
     readonly name: string;
+    /**
+     * Set by policies whose contract includes observing every policy denial.
+     * Such a policy must appear before every `before` hook, because a preceding
+     * hook can reject before the observer is entered.
+     */
+    readonly observesPolicyRejections?: true;
     /** `before` hooks may be async; they are awaited before the operation runs. */
     before?(op: SecretsOperation): void | Promise<void>;
     /**
@@ -59,23 +73,39 @@ export interface SecretsPolicy {
      */
     after?(event: SecretsEvent): void;
 }
+export type PolicyStackFrame = readonly SecretsPolicy[];
+export interface PolicyRunner {
+    runBefore(op: SecretsOperation, makeRejectionEvent: (error: string) => SecretsEvent): Promise<PolicyStackFrame>;
+    runAfter(event: SecretsEvent, frame?: PolicyStackFrame): void;
+    getPolicies(): readonly SecretsPolicy[];
+    replacePolicies(policies: readonly SecretsPolicy[]): void;
+}
+/**
+ * Build an isolated policy runner. Its input is snapshotted immediately, and
+ * every operation captures the current immutable frame so replacement cannot
+ * splice two different stacks across an await boundary.
+ */
+export declare function createPolicyRunner(initialPolicies?: readonly SecretsPolicy[]): PolicyRunner;
+/** Global runner retained only for legacy module APIs and SessionVault. */
+export declare const defaultPolicyRunner: PolicyRunner;
+/**
+ * @deprecated Configure policies on an isolated client created with
+ * `createSecretsClient`. This setter remains for module-level shims and
+ * SessionVault compatibility through the 1.x deprecation window.
+ */
 export declare function setSecretsPolicies(policies: SecretsPolicy[]): void;
+/** @deprecated Inspect the policy list owned by the legacy default client. */
 export declare function getActivePolicies(): readonly SecretsPolicy[];
 /**
  * Run `before` hooks top-to-bottom. If a hook throws, the operation is
- * rejected: the `after` hooks of the already-entered policies (indices
- * `0..i-1`, bottom-to-top) fire with the event built by
+ * rejected: the rejecting policy and already-entered policies (indices
+ * `0..i`, bottom-to-top) fire `after` with the event built by
  * `makeRejectionEvent` so the denied operation is still audited, then the
- * original error is re-thrown to abort the operation. The rejecting
- * policy's own `after` hook is intentionally skipped — its `before` hook
- * did not complete, so the policy was not fully entered. See ADR-002
- * §1.0.0.
+ * original error is re-thrown to abort the operation. This follows issue
+ * #98's acceptance contract; policies after the rejector are never entered.
  */
-export declare function runBeforeHooks(op: SecretsOperation, makeRejectionEvent: (error: string) => SecretsEvent): Promise<void>;
-export declare function runAfterHooks(event: SecretsEvent): void;
-export interface AuditTrailOptions {
-    sink: (event: SecretsEvent) => void;
-    includeReads?: boolean;
-}
-export declare function auditTrail(opts: AuditTrailOptions): SecretsPolicy;
+export declare function runBeforeHooks(op: SecretsOperation, makeRejectionEvent: (error: string) => SecretsEvent): Promise<PolicyStackFrame>;
+export declare function runAfterHooks(event: SecretsEvent, frame?: PolicyStackFrame): void;
+export { auditTrail } from "../policies/audit-trail.js";
+export type { AuditEventChain, AuditTrailOptions, } from "../policies/audit-trail.js";
 //# sourceMappingURL=policy.d.ts.map

package/dist/vault/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/vault/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAM5C,MAAM,MAAM,gBAAgB,GACxB,iBAAiB,GACjB,yBAAyB,GACzB,wBAAwB,GACxB,0BAA0B,GAC1B,oBAAoB,GACpB,yBAAyB,GACzB,2BAA2B,GAC3B,oBAAoB,GACpB,0BAA0B,GAC1B,4BAA4B,GAC5B,uBAAuB,GACvB,6BAA6B,GAC7B,+BAA+B,CAAC;AAEpC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,gBAAgB,GAAG,gBAAgB,CAiBxE;AAMD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,MAAM,CAAC,CAAC,EAAE,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;;;;;;OAQG;IACH,KAAK,CAAC,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;CACnC;AASD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,IAAI,CAGlE;AAED,wBAAgB,iBAAiB,IAAI,SAAS,aAAa,EAAE,CAE5D;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,gBAAgB,EACpB,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,YAAY,GAClD,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAEvD;AAkCD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACpC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CAejE"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/vault/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH,MAAM,MAAM,gBAAgB,GACxB,iBAAiB,GACjB,yBAAyB,GACzB,wBAAwB,GACxB,0BAA0B,GAC1B,oBAAoB,GACpB,yBAAyB,GACzB,2BAA2B,GAC3B,oBAAoB,GACpB,0BAA0B,GAC1B,4BAA4B,GAC5B,uBAAuB,GACvB,6BAA6B,GAC7B,+BAA+B,CAAC;AAEpC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAMD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;IACzD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,gBAAgB,GAAG,gBAAgB,CAiBxE;AAMD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC;IACzC,+EAA+E;IAC/E,MAAM,CAAC,CAAC,EAAE,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;;;;;;OAQG;IACH,KAAK,CAAC,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;CACnC;AAMD,MAAM,MAAM,gBAAgB,GAAG,SAAS,aAAa,EAAE,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B,SAAS,CACP,EAAE,EAAE,gBAAgB,EACpB,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,YAAY,GAClD,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC9D,WAAW,IAAI,SAAS,aAAa,EAAE,CAAC;IACxC,eAAe,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,GAAG,IAAI,CAAC;CAC3D;AAkDD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,eAAe,GAAE,SAAS,aAAa,EAAO,GAC7C,YAAY,CAkDd;AAED,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,cAAuB,CAAC;AAExD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,IAAI,CAElE;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,IAAI,SAAS,aAAa,EAAE,CAE5D;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,gBAAgB,EACpB,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,YAAY,GAClD,OAAO,CAAC,gBAAgB,CAAC,CAE3B;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,gBAAgB,GACvB,IAAI,CAEN;AAGD,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,YAAY,EACV,eAAe,EACf,iBAAiB,GAClB,MAAM,4BAA4B,CAAC"}

package/dist/vault/policy.js

@@ -1,20 +1,19 @@
 /**
  * SecretsPolicy — Middleware layer for credential operations.
  *
- * Policies are cross-cutting concerns (audit, rate limiting, access
- * control, attestation) applied to every credential operation via
- * `setSecretsPolicies([...])`. In 0.5.0 only the audit policy is
- * shipped; the API shape is designed to grow into the full policy
- * stack described in ADR-002.
+ * Policies are cross-cutting concerns (audit, rate limiting, access control,
+ * attestation) applied to every credential operation. Explicit clients own an
+ * isolated stack supplied to `createSecretsClient`; `setSecretsPolicies`
+ * remains as the deprecated configuration path for the module-level shims and
+ * SessionVault. The API shape is designed for the full stack in ADR-002.
  *
  * Execution model:
  *   1. `before` hooks run top-to-bottom. If one throws, the operation
  *      is aborted and the error propagates to the caller — but the
- *      `after` hooks of already-entered policies (those whose `before`
- *      hook already completed) still fire with a `*_rejected` event, so
+ *      rejecting policy and already-entered policies still fire their
+ *      `after` hooks with a `*_rejected` event, so
  *      a policy-denied operation is audited rather than vanishing
- *      (ADR-002 §1.0.0). The rejecting policy's own `after` hook does
- *      not fire — its `before` hook did not complete.
+ *      (issue #98). Policies not yet reached do not fire.
  *   2. The backend operation executes.
  *   3. `after` hooks run bottom-to-top with a structured event
  *      describing the outcome. Exceptions in `after` hooks are
@@ -44,59 +43,57 @@ export function rejectedEventType(op) {
         }
     }
 }
-// =============================================================================
-// Policy registry
-// =============================================================================
-let activePolicies = [];
-let afterWarningEmitted = false;
-export function setSecretsPolicies(policies) {
-    activePolicies = [...policies];
-    afterWarningEmitted = false;
-}
-export function getActivePolicies() {
-    return activePolicies;
-}
-/**
- * Run `before` hooks top-to-bottom. If a hook throws, the operation is
- * rejected: the `after` hooks of the already-entered policies (indices
- * `0..i-1`, bottom-to-top) fire with the event built by
- * `makeRejectionEvent` so the denied operation is still audited, then the
- * original error is re-thrown to abort the operation. The rejecting
- * policy's own `after` hook is intentionally skipped — its `before` hook
- * did not complete, so the policy was not fully entered. See ADR-002
- * §1.0.0.
- */
-export async function runBeforeHooks(op, makeRejectionEvent) {
-    for (let i = 0; i < activePolicies.length; i++) {
-        const policy = activePolicies[i];
-        if (!policy.before)
-            continue;
-        try {
-            await policy.before(op);
+function snapshotPolicies(configured) {
+    const snapshot = configured.map((policy) => {
+        // Capture the complete callable shape, not just the containing array.
+        // Otherwise a caller could add or replace a before hook after ordering
+        // validation and make a rejection observer silently miss denials.
+        const name = policy.name;
+        const observesPolicyRejections = policy.observesPolicyRejections;
+        const configuredBefore = policy.before;
+        const configuredAfter = policy.after;
+        // ADR-002 permits a policy object to retain mutable internal state. Bind
+        // the captured hooks to that original receiver while freezing only the
+        // validated public wrapper and its hook identities.
+        const before = configuredBefore?.bind(policy);
+        const after = configuredAfter?.bind(policy);
+        return Object.freeze({
+            name,
+            ...(observesPolicyRejections === true
+                ? { observesPolicyRejections: true }
+                : {}),
+            ...(before !== undefined ? { before } : {}),
+            ...(after !== undefined ? { after } : {}),
+        });
+    });
+    let precedingBeforePolicy;
+    for (const policy of snapshot) {
+        if (policy.observesPolicyRejections === true &&
+            precedingBeforePolicy !== undefined) {
+            throw new TypeError(`policy "${policy.name}" observes policy rejections and must precede ` +
+                `policy "${precedingBeforePolicy.name}" (and every other policy with a before hook)`);
         }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            runAfterHooksForRange(makeRejectionEvent(msg), i - 1);
-            throw err;
+        if (policy.before !== undefined && precedingBeforePolicy === undefined) {
+            precedingBeforePolicy = policy;
         }
     }
-}
-export function runAfterHooks(event) {
-    runAfterHooksForRange(event, activePolicies.length - 1);
+    // The registry's public inspection API returns this same value. Freeze the
+    // array so a cast to a mutable type cannot bypass replacement validation.
+    return Object.freeze(snapshot);
 }
 /**
- * Run `after` hooks for policies `fromIndex..0` (bottom-to-top). A
- * negative `fromIndex` is a no-op (no policy was entered). Synchronous
- * hook exceptions are swallowed best-effort with a one-time stderr
- * warning — audit-infrastructure failures must never break credential
- * operations. `after` hooks are synchronous by contract (see
- * `SecretsPolicy.after`); a hook that returns a rejected `Promise` is
- * not awaited here, so it would surface as an unhandled rejection.
+ * Build an isolated policy runner. Its input is snapshotted immediately, and
+ * every operation captures the current immutable frame so replacement cannot
+ * splice two different stacks across an await boundary.
  */
-function runAfterHooksForRange(event, fromIndex) {
-    for (let i = fromIndex; i >= 0; i--) {
-        const policy = activePolicies[i];
-        if (policy.after) {
+export function createPolicyRunner(initialPolicies = []) {
+    let policies = snapshotPolicies(initialPolicies);
+    let afterWarningEmitted = false;
+    const runAfterForFrame = (event, frame) => {
+        for (let i = frame.length - 1; i >= 0; i--) {
+            const policy = frame[i];
+            if (!policy.after)
+                continue;
             try {
                 policy.after(event);
             }
@@ -108,20 +105,65 @@ function runAfterHooksForRange(event, fromIndex) {
                 }
             }
         }
-    }
-}
-export function auditTrail(opts) {
-    const includeReads = opts.includeReads ?? true;
+    };
     return {
-        name: "auditTrail",
-        after(event) {
-            if (!includeReads &&
-                (event.type === "credential_read" ||
-                    event.type === "credential_read_missing")) {
-                return;
+        async runBefore(op, makeRejectionEvent) {
+            const frame = policies;
+            for (let i = 0; i < frame.length; i++) {
+                const policy = frame[i];
+                try {
+                    await policy.before?.(op);
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    // Issue #98 is authoritative: the rejecting policy is part of the
+                    // unwind, followed by already-entered outer policies.
+                    runAfterForFrame(makeRejectionEvent(msg), frame.slice(0, i + 1));
+                    throw err;
+                }
             }
-            opts.sink(event);
+            return frame;
+        },
+        runAfter(event, frame = policies) {
+            runAfterForFrame(event, frame);
+        },
+        getPolicies() {
+            return policies;
+        },
+        replacePolicies(nextPolicies) {
+            policies = snapshotPolicies(nextPolicies);
+            afterWarningEmitted = false;
         },
     };
 }
+/** Global runner retained only for legacy module APIs and SessionVault. */
+export const defaultPolicyRunner = createPolicyRunner();
+/**
+ * @deprecated Configure policies on an isolated client created with
+ * `createSecretsClient`. This setter remains for module-level shims and
+ * SessionVault compatibility through the 1.x deprecation window.
+ */
+export function setSecretsPolicies(policies) {
+    defaultPolicyRunner.replacePolicies(policies);
+}
+/** @deprecated Inspect the policy list owned by the legacy default client. */
+export function getActivePolicies() {
+    return defaultPolicyRunner.getPolicies();
+}
+/**
+ * Run `before` hooks top-to-bottom. If a hook throws, the operation is
+ * rejected: the rejecting policy and already-entered policies (indices
+ * `0..i`, bottom-to-top) fire `after` with the event built by
+ * `makeRejectionEvent` so the denied operation is still audited, then the
+ * original error is re-thrown to abort the operation. This follows issue
+ * #98's acceptance contract; policies after the rejector are never entered.
+ */
+export async function runBeforeHooks(op, makeRejectionEvent) {
+    return defaultPolicyRunner.runBefore(op, makeRejectionEvent);
+}
+export function runAfterHooks(event, frame) {
+    defaultPolicyRunner.runAfter(event, frame);
+}
+// Compatibility re-export: the built-in now lives with the other policies.
+export { auditTrail } from "../policies/audit-trail.js";
 //# sourceMappingURL=policy.js.map

package/dist/vault/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/vault/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AA4CH;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAoB;IACpD,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,0BAA0B,CAAC;QACpC,KAAK,OAAO;YACV,OAAO,2BAA2B,CAAC;QACrC,KAAK,QAAQ;YACX,OAAO,4BAA4B,CAAC;QACtC,KAAK,WAAW;YACd,OAAO,+BAA+B,CAAC;QACzC,OAAO,CAAC,CAAC,CAAC;YACR,mEAAmE;YACnE,yDAAyD;YACzD,MAAM,WAAW,GAAU,EAAE,CAAC,IAAI,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;AACH,CAAC;AAsBD,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF,IAAI,cAAc,GAAoB,EAAE,CAAC;AACzC,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAEhC,MAAM,UAAU,kBAAkB,CAAC,QAAyB;IAC1D,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/B,mBAAmB,GAAG,KAAK,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAoB,EACpB,kBAAmD;IAEnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,SAAS;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,qBAAqB,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,qBAAqB,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,KAAmB,EAAE,SAAiB;IACnE,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAE,CAAC;QAClC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,mBAAmB,GAAG,IAAI,CAAC;oBAC3B,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qBAAqB,MAAM,CAAC,IAAI,mCAAmC,GAAG,IAAI,CAC3E,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAWD,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAC/C,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,KAAK,CAAC,KAAmB;YACvB,IACE,CAAC,YAAY;gBACb,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB;oBAC/B,KAAK,CAAC,IAAI,KAAK,yBAAyB,CAAC,EAC3C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/vault/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAsDH;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAoB;IACpD,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,0BAA0B,CAAC;QACpC,KAAK,OAAO;YACV,OAAO,2BAA2B,CAAC;QACrC,KAAK,QAAQ;YACX,OAAO,4BAA4B,CAAC;QACtC,KAAK,WAAW;YACd,OAAO,+BAA+B,CAAC;QACzC,OAAO,CAAC,CAAC,CAAC;YACR,mEAAmE;YACnE,yDAAyD;YACzD,MAAM,WAAW,GAAU,EAAE,CAAC,IAAI,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;AACH,CAAC;AA4CD,SAAS,gBAAgB,CACvB,UAAoC;IAEpC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAiB,EAAE;QACxD,sEAAsE;QACtE,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,wBAAwB,GAAG,MAAM,CAAC,wBAAwB,CAAC;QACjE,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;QACvC,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC;QACrC,yEAAyE;QACzE,uEAAuE;QACvE,oDAAoD;QACpD,MAAM,MAAM,GAAG,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE5C,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI;YACJ,GAAG,CAAC,wBAAwB,KAAK,IAAI;gBACnC,CAAC,CAAC,EAAE,wBAAwB,EAAE,IAAa,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,qBAAgD,CAAC;IAErD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,IACE,MAAM,CAAC,wBAAwB,KAAK,IAAI;YACxC,qBAAqB,KAAK,SAAS,EACnC,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,WAAW,MAAM,CAAC,IAAI,gDAAgD;gBACpE,WAAW,qBAAqB,CAAC,IAAI,+CAA+C,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACvE,qBAAqB,GAAG,MAAM,CAAC;QACjC,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,kBAA4C,EAAE;IAE9C,IAAI,QAAQ,GAA6B,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC3E,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAEhC,MAAM,gBAAgB,GAAG,CAAC,KAAmB,EAAE,KAAuB,EAAQ,EAAE;QAC9E,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,KAAK;gBAAE,SAAS;YAC5B,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,mBAAmB,GAAG,IAAI,CAAC;oBAC3B,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qBAAqB,MAAM,CAAC,IAAI,mCAAmC,GAAG,IAAI,CAC3E,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,kBAAkB;YACpC,MAAM,KAAK,GAAG,QAAQ,CAAC;YACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC5B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7D,kEAAkE;oBAClE,sDAAsD;oBACtD,gBAAgB,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACjE,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ;YAC9B,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,WAAW;YACT,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,eAAe,CAAC,YAAY;YAC1B,QAAQ,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC1C,mBAAmB,GAAG,KAAK,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,EAAE,CAAC;AAExD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAyB;IAC1D,mBAAmB,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB;IAC/B,OAAO,mBAAmB,CAAC,WAAW,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAoB,EACpB,kBAAmD;IAEnD,OAAO,mBAAmB,CAAC,SAAS,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAmB,EACnB,KAAwB;IAExB,mBAAmB,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,2EAA2E;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/vault/session-vault.d.ts

@@ -123,6 +123,29 @@ export interface OpenVaultOptions {
      */
     keychain?: KeychainProviderOptions;
 }
+/** Options for {@link createVault}. */
+export interface CreateVaultOptions {
+    /** Alternate vault file path. Defaults to the same path the CLI uses. */
+    path?: string;
+    /** Alternate sidecar path. Defaults to vault directory + `vault.seen-version`. */
+    sidecarPath?: string;
+    /**
+     * Caller-owned AES-256 key used to encrypt the empty vault.
+     *
+     * This function neither stores nor zeroes the key. Key-provider setup is a
+     * separate, potentially irreversible transaction; keeping it outside this
+     * filesystem primitive prevents a failed create from deleting or replacing
+     * a key that another vault may share.
+     */
+    key: Buffer;
+}
+/** Result of an idempotent {@link createVault} call. */
+export interface CreateVaultResult {
+    /** True when this call created the vault/sidecar pair; false when both existed. */
+    created: boolean;
+    /** Canonical absolute vault path used for AAD binding. */
+    path: string;
+}
 /**
  * A long-lived handle to an unlocked vault. Construct with {@link openVault};
  * close with {@link SessionVault.close}. Operations are async so policy
@@ -148,6 +171,26 @@ export interface SessionVault {
     /** Diagnostic — the current in-memory vault version. */
     readonly vaultVersion: number;
 }
+/**
+ * Create an empty, AAD-bound session vault and its rollback sidecar.
+ *
+ * Creation is idempotent only for a complete pair: if both files already
+ * exist they are left byte-for-byte untouched and `created` is false. A
+ * vault-only or sidecar-only state is refused rather than "repaired" because
+ * replacing either half could erase rollback evidence or make existing
+ * ciphertext permanently unreadable.
+ *
+ * Both destinations use no-clobber publication: the completed vault temp is
+ * linked into place first, then the sidecar is the logical commit point. A
+ * successful return therefore means both public paths exist, and a competing
+ * destination is never replaced. This is temp-file/link crash safety, not an
+ * fsync or power-loss durability guarantee.
+ *
+ * The caller retains ownership of `opts.key`; this function snapshots it for
+ * the duration of the call, zeroes that private copy, and never mutates,
+ * zeroes, or stores the caller's buffer.
+ */
+export declare function createVault(opts: CreateVaultOptions): Promise<CreateVaultResult>;
 /**
  * Open an encrypted session vault.
  *

package/dist/vault/session-vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-vault.d.ts","sourceRoot":"","sources":["../../src/vault/session-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAkBH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAgB9E,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EAC1B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EAGjB,yBAAyB,GAC1B,CAAC;AAMF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,QAAuD,CAAC;AAEvF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,QAKhC,CAAC;AAKF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,2BAA2B,CAAC;AA2BzD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,QAAQ,GAAG,aAAa,CAAC;AAEzE,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;OAeG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1C,2EAA2E;IAC3E,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,uEAAuE;IACvE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,yEAAyE;IACzE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,4EAA4E;IAC5E,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,4EAA4E;IAC5E,KAAK,IAAI,IAAI,CAAC;IACd,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AA2ED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,SAAS,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,YAAY,CAAC,CAuIlF;AAMD,sCAAsC;AACtC,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAwJ3B"}
+{"version":3,"file":"session-vault.d.ts","sourceRoot":"","sources":["../../src/vault/session-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAkCH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAiB9E,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EAC1B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EAGjB,yBAAyB,GAC1B,CAAC;AAMF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,QAAuD,CAAC;AAEvF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,QAKhC,CAAC;AAKF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,2BAA2B,CAAC;AA2BzD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,QAAQ,GAAG,aAAa,CAAC;AAEzE,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;OAeG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1C,2EAA2E;IAC3E,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,uEAAuE;IACvE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,yEAAyE;IACzE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,4EAA4E;IAC5E,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,4EAA4E;IAC5E,KAAK,IAAI,IAAI,CAAC;IACd,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AA6KD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,iBAAiB,CAAC,CAgM5B;AAMD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,SAAS,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,YAAY,CAAC,CAuIlF;AAMD,sCAAsC;AACtC,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAwJ3B"}