@happyvertical/smrt-secrets 0.37.4 → 0.37.5

package/dist/chunks/{SecretService-DL05eyeI.js → SecretService-Bbef8TvJ.js}

@@ -1,4 +1,4 @@
-import { i as createAuditEntry, n as Secret, r as SecretAuditLog, t as TenantKey } from "./TenantKey-Dvz3zbCm.js";
+import { i as createAuditEntry, n as Secret, r as SecretAuditLog, t as TenantKey } from "./TenantKey-DgZpXU-g.js";
 import { SmrtCollection } from "@happyvertical/smrt-core";
 import { AMKUnavailableError, DecryptionError, EncryptionError, EnvelopeEncryption, TenantKeyMissingError, getSecretStore } from "@happyvertical/secrets";
 import { loadEnvConfig } from "@happyvertical/utils";
@@ -1138,4 +1138,4 @@ var SecretService = class SecretService {
 //#endregion
 export { SecretAuditLogCollection as a, SecretCollection as i, SecretService as n, TenantKeyCollection as r, SecretKeyDriftError as t };
 
-//# sourceMappingURL=SecretService-DL05eyeI.js.map
+//# sourceMappingURL=SecretService-Bbef8TvJ.js.map

package/dist/chunks/{SecretService-DL05eyeI.js.map → SecretService-Bbef8TvJ.js.map}

@@ -1 +1 @@
-{"version":3,"file":"SecretService-DL05eyeI.js","names":[],"sources":["../../src/collections/SecretAuditLogCollection.ts","../../src/collections/SecretCollection.ts","../../src/collections/TenantKeyCollection.ts","../../../../node_modules/.pnpm/@happyvertical+logger@0.74.11_@sentry+node@10.62.0_@opentelemetry+core@2.7.0_@opentelemetry+api@1.9.1__/node_modules/@happyvertical/logger/dist/index.js","../../src/services/SecretService.ts"],"sourcesContent":["/**\n * SecretAuditLogCollection - Collection manager for SecretAuditLog objects\n * @packageDocumentation\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport {\n  type SecretAuditAction,\n  SecretAuditLog,\n  type SecretAuditResult,\n} from '../models/SecretAuditLog.js';\n\n/**\n * Options for listing audit logs\n */\nexport interface ListAuditLogsOptions {\n  /**\n   * Scope results to a single tenant's audit trail. Tenant-facing callers\n   * (e.g. SecretService.getAuditLogs) must always set this — audit rows\n   * reference secret names and must not leak across tenants (issue #1501).\n   * Omit only for cross-tenant compliance tooling running under\n   * withSuperAdminBypass().\n   */\n  tenantId?: string;\n  /** Filter by secret name */\n  secretName?: string;\n  /** Filter by user ID */\n  userId?: string;\n  /** Filter by action type */\n  action?: SecretAuditAction;\n  /** Filter by result */\n  result?: SecretAuditResult;\n  /** Filter by date range start */\n  since?: Date;\n  /** Filter by date range end */\n  until?: Date;\n  /** Maximum number of results */\n  limit?: number;\n  /** Offset for pagination */\n  offset?: number;\n}\n\n/**\n * Collection for managing SecretAuditLog objects\n */\nexport class SecretAuditLogCollection extends SmrtCollection<SecretAuditLog> {\n  static readonly _itemClass = SecretAuditLog;\n\n  /**\n   * List audit logs with filtering options\n   */\n  async listLogs(\n    options: ListAuditLogsOptions = {},\n  ): Promise<SecretAuditLog[]> {\n    const where: Record<string, unknown> = {};\n\n    if (options.tenantId) {\n      where.tenantId = options.tenantId;\n    }\n\n    if (options.secretName) {\n      where.secretName = options.secretName;\n    }\n\n    if (options.userId) {\n      where.userId = options.userId;\n    }\n\n    if (options.action) {\n      where.action = options.action;\n    }\n\n    if (options.result) {\n      where.result = options.result;\n    }\n\n    if (options.since) {\n      where['created_at >'] = options.since.toISOString();\n    }\n\n    if (options.until) {\n      where['created_at <'] = options.until.toISOString();\n    }\n\n    return this.list({\n      where,\n      limit: options.limit ?? 100,\n      offset: options.offset,\n      orderBy: 'created_at DESC',\n    });\n  }\n\n  /**\n   * Get audit logs for a specific secret.\n   *\n   * @param tenantId - Scope to this tenant's audit trail, or `null` for a\n   *   cross-tenant compliance query (which must run under\n   *   `withSuperAdminBypass()` from `@happyvertical/smrt-tenancy`). Audit rows\n   *   reference secret names and must not leak across tenants (#1503).\n   */\n  async getSecretHistory(\n    tenantId: string | null,\n    secretName: string,\n    limit: number = 50,\n  ): Promise<SecretAuditLog[]> {\n    return this.listLogs({ tenantId: tenantId ?? undefined, secretName, limit });\n  }\n\n  /**\n   * Get audit logs for a specific user.\n   *\n   * @param tenantId - Scope to this tenant's audit trail, or `null` for a\n   *   cross-tenant compliance query under `withSuperAdminBypass()` (#1503).\n   */\n  async getUserActivity(\n    tenantId: string | null,\n    userId: string,\n    limit: number = 50,\n  ): Promise<SecretAuditLog[]> {\n    return this.listLogs({ tenantId: tenantId ?? undefined, userId, limit });\n  }\n\n  /**\n   * Get recent failures.\n   *\n   * @param tenantId - Scope to this tenant's audit trail, or `null` for a\n   *   cross-tenant compliance query under `withSuperAdminBypass()` (#1503).\n   */\n  async getRecentFailures(\n    tenantId: string | null,\n    limit: number = 20,\n  ): Promise<SecretAuditLog[]> {\n    return this.listLogs({\n      tenantId: tenantId ?? undefined,\n      result: 'failure',\n      limit,\n    });\n  }\n\n  /**\n   * Get recent denied access attempts.\n   *\n   * @param tenantId - Scope to this tenant's audit trail, or `null` for a\n   *   cross-tenant compliance query under `withSuperAdminBypass()` (#1503).\n   */\n  async getRecentDenials(\n    tenantId: string | null,\n    limit: number = 20,\n  ): Promise<SecretAuditLog[]> {\n    return this.listLogs({\n      tenantId: tenantId ?? undefined,\n      result: 'denied',\n      limit,\n    });\n  }\n\n  /**\n   * Count operations by action type.\n   *\n   * @param tenantId - Scope to this tenant's audit trail, or `null` for a\n   *   cross-tenant compliance count under `withSuperAdminBypass()` (#1503).\n   */\n  async countByAction(\n    tenantId: string | null,\n    since?: Date,\n  ): Promise<Record<SecretAuditAction, number>> {\n    const logs = await this.listLogs({\n      tenantId: tenantId ?? undefined,\n      since,\n      limit: 10000,\n    });\n\n    const counts: Record<SecretAuditAction, number> = {\n      create: 0,\n      read: 0,\n      update: 0,\n      delete: 0,\n      rotate_key: 0,\n      disable: 0,\n      enable: 0,\n      expire: 0,\n    };\n\n    for (const log of logs) {\n      counts[log.action]++;\n    }\n\n    return counts;\n  }\n\n  /**\n   * Count operations by result.\n   *\n   * @param tenantId - Scope to this tenant's audit trail, or `null` for a\n   *   cross-tenant compliance count under `withSuperAdminBypass()` (#1503).\n   */\n  async countByResult(\n    tenantId: string | null,\n    since?: Date,\n  ): Promise<Record<SecretAuditResult, number>> {\n    const logs = await this.listLogs({\n      tenantId: tenantId ?? undefined,\n      since,\n      limit: 10000,\n    });\n\n    const counts: Record<SecretAuditResult, number> = {\n      success: 0,\n      failure: 0,\n      denied: 0,\n    };\n\n    for (const log of logs) {\n      counts[log.result]++;\n    }\n\n    return counts;\n  }\n\n  /**\n   * Delete old audit logs\n   * @param olderThanDays Delete logs older than this many days\n   */\n  async cleanup(olderThanDays: number = 365): Promise<number> {\n    const cutoffDate = new Date();\n    cutoffDate.setDate(cutoffDate.getDate() - olderThanDays);\n\n    const oldLogs = await this.list({\n      where: {\n        'created_at <': cutoffDate.toISOString(),\n      },\n    });\n\n    let count = 0;\n    for (const log of oldLogs) {\n      await log.delete();\n      count++;\n    }\n\n    return count;\n  }\n}\n","/**\n * SecretCollection - Collection manager for Secret objects\n * @packageDocumentation\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { Secret, type SecretStatus } from '../models/Secret.js';\n\n/**\n * Options for listing secrets\n */\nexport interface ListSecretsOptions {\n  /** Filter by category */\n  category?: string;\n  /** Filter by status */\n  status?: SecretStatus;\n  /** Include expired secrets */\n  includeExpired?: boolean;\n  /** Maximum number of results */\n  limit?: number;\n  /** Offset for pagination */\n  offset?: number;\n}\n\n/**\n * Collection for managing Secret objects\n *\n * All lookups take an explicit `tenantId` and scope on the authoritative\n * `tenant_id` column. Scoping must NOT rely on the tenancy interceptor\n * (which may be disabled in the host application) and must NOT use the\n * `context` column: `context = tenantId` is only a convention applied on\n * the create path, so pre-convention rows may have a divergent `context`.\n * See https://github.com/happyvertical/smrt/issues/1501\n */\nexport class SecretCollection extends SmrtCollection<Secret> {\n  static readonly _itemClass = Secret;\n\n  /**\n   * Find a secret by name within the given tenant\n   */\n  async findByName(tenantId: string, name: string): Promise<Secret | null> {\n    return this.get({ name, tenantId });\n  }\n\n  /**\n   * List secrets for a tenant with filtering options\n   */\n  async listSecrets(\n    tenantId: string,\n    options: ListSecretsOptions = {},\n  ): Promise<Secret[]> {\n    const where: Record<string, unknown> = { tenantId };\n\n    if (options.category) {\n      where.category = options.category;\n    }\n\n    if (options.status) {\n      where.status = options.status;\n    }\n\n    const secrets = await this.list({\n      where,\n      limit: options.limit,\n      offset: options.offset,\n      orderBy: 'name ASC',\n    });\n\n    // Filter out expired secrets unless explicitly included\n    if (!options.includeExpired) {\n      return secrets.filter((secret) => !secret.isExpired());\n    }\n\n    return secrets;\n  }\n\n  /**\n   * List all active secrets for a tenant\n   */\n  async listActive(tenantId: string): Promise<Secret[]> {\n    return this.listSecrets(tenantId, { status: 'active' });\n  }\n\n  /**\n   * List a tenant's secrets by category\n   */\n  async listByCategory(tenantId: string, category: string): Promise<Secret[]> {\n    return this.listSecrets(tenantId, { category, status: 'active' });\n  }\n\n  /**\n   * List a tenant's secrets that need attention (expired or about to expire)\n   */\n  async listExpiring(\n    tenantId: string,\n    daysAhead: number = 30,\n  ): Promise<Secret[]> {\n    const futureDate = new Date();\n    futureDate.setDate(futureDate.getDate() + daysAhead);\n\n    const secrets = await this.list({\n      where: {\n        tenantId,\n        status: 'active',\n        'expiresAt !=': null,\n        'expiresAt <': futureDate.toISOString(),\n      },\n      orderBy: 'expiresAt ASC',\n    });\n\n    return secrets;\n  }\n\n  /**\n   * Get categories used in a tenant's secrets\n   */\n  async getCategories(tenantId: string): Promise<string[]> {\n    const secrets = await this.list({ where: { tenantId } });\n    const categories = new Set(secrets.map((s) => s.category).filter(Boolean));\n    return Array.from(categories).sort();\n  }\n\n  /**\n   * Count a tenant's secrets by status\n   */\n  async countByStatus(tenantId: string): Promise<Record<SecretStatus, number>> {\n    const secrets = await this.list({ where: { tenantId } });\n\n    const counts: Record<SecretStatus, number> = {\n      active: 0,\n      disabled: 0,\n      expired: 0,\n    };\n\n    for (const secret of secrets) {\n      if (secret.isExpired()) {\n        counts.expired++;\n      } else {\n        counts[secret.status]++;\n      }\n    }\n\n    return counts;\n  }\n\n  /**\n   * Delete a tenant's secret by name\n   */\n  async deleteByName(tenantId: string, name: string): Promise<boolean> {\n    const secret = await this.findByName(tenantId, name);\n    if (!secret) return false;\n\n    await secret.delete();\n    return true;\n  }\n}\n","/**\n * TenantKeyCollection - Collection manager for TenantKey objects\n * @packageDocumentation\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { TenantKey, type TenantKeyStatus } from '../models/TenantKey.js';\n\n/**\n * Collection for managing TenantKey objects\n */\nexport class TenantKeyCollection extends SmrtCollection<TenantKey> {\n  static readonly _itemClass = TenantKey;\n\n  /**\n   * Get the active key for a tenant\n   */\n  async getActiveKey(tenantId: string): Promise<TenantKey | null> {\n    return this.get({\n      tenantId,\n      status: 'active',\n    });\n  }\n\n  /**\n   * List all key versions for a tenant\n   */\n  async listKeyVersions(tenantId: string): Promise<TenantKey[]> {\n    return this.list({\n      where: { tenantId },\n      orderBy: 'version DESC',\n    });\n  }\n\n  /**\n   * Get a specific key version for a tenant\n   */\n  async getKeyVersion(\n    tenantId: string,\n    version: number,\n  ): Promise<TenantKey | null> {\n    return this.get({\n      tenantId,\n      version,\n    });\n  }\n\n  /**\n   * Find keys that need rotation\n   */\n  async findKeysNeedingRotation(): Promise<TenantKey[]> {\n    const now = new Date();\n\n    return this.list({\n      where: {\n        status: 'active',\n        'rotateAfter !=': null,\n        'rotateAfter <': now.toISOString(),\n      },\n      orderBy: 'rotateAfter ASC',\n    });\n  }\n\n  /**\n   * List all active keys across all tenants\n   */\n  async listAllActiveKeys(): Promise<TenantKey[]> {\n    return this.list({\n      where: { status: 'active' },\n      orderBy: 'created_at DESC',\n    });\n  }\n\n  /**\n   * Count keys by status\n   */\n  async countByStatus(): Promise<Record<TenantKeyStatus, number>> {\n    const keys = await this.list({});\n\n    const counts: Record<TenantKeyStatus, number> = {\n      active: 0,\n      rotating: 0,\n      retired: 0,\n      compromised: 0,\n    };\n\n    for (const key of keys) {\n      counts[key.status]++;\n    }\n\n    return counts;\n  }\n\n  /**\n   * Mark a key as compromised (should trigger re-encryption)\n   */\n  async markCompromised(tenantId: string, keyId: string): Promise<boolean> {\n    const key = await this.get({\n      id: keyId,\n      tenantId,\n    });\n\n    if (!key) return false;\n\n    key.markCompromised();\n    await key.save();\n    return true;\n  }\n\n  /**\n   * Delete old retired keys that are no longer needed\n   * @param olderThanDays Delete keys retired more than this many days ago\n   */\n  async cleanupRetiredKeys(olderThanDays: number = 90): Promise<number> {\n    const cutoffDate = new Date();\n    cutoffDate.setDate(cutoffDate.getDate() - olderThanDays);\n\n    const oldKeys = await this.list({\n      where: {\n        status: 'retired',\n        'retiredAt <': cutoffDate.toISOString(),\n      },\n    });\n\n    let count = 0;\n    for (const key of oldKeys) {\n      await key.delete();\n      count++;\n    }\n\n    return count;\n  }\n}\n","import { loadEnvConfig } from \"@happyvertical/utils\";\nclass LoggerAdapter {\n  constructor(logger) {\n    this.logger = logger;\n  }\n  /**\n   * Handle a signal and log appropriately\n   *\n   * @param signal - Signal to log\n   */\n  async handle(signal) {\n    const context = {\n      id: signal.id,\n      objectId: signal.objectId,\n      className: signal.className,\n      method: signal.method,\n      timestamp: signal.timestamp\n    };\n    if (signal.duration !== void 0) {\n      context.duration = signal.duration;\n    }\n    if (signal.metadata) {\n      context.metadata = signal.metadata;\n    }\n    switch (signal.type) {\n      case \"start\":\n        this.logger.debug(\n          `${signal.className}.${signal.method}() started`,\n          context\n        );\n        break;\n      case \"step\":\n        this.logger.debug(\n          `${signal.className}.${signal.method}() step: ${signal.step || \"unknown\"}`,\n          context\n        );\n        break;\n      case \"end\":\n        this.logger.info(\n          `${signal.className}.${signal.method}() completed in ${signal.duration}ms`,\n          {\n            ...context,\n            result: signal.result !== void 0 ? \"present\" : \"none\"\n          }\n        );\n        break;\n      case \"error\":\n        this.logger.error(\n          `${signal.className}.${signal.method}() failed: ${signal.error?.message || \"Unknown error\"}`,\n          {\n            ...context,\n            error: signal.error ? {\n              message: signal.error.message,\n              name: signal.error.name,\n              stack: signal.error.stack\n            } : void 0\n          }\n        );\n        break;\n    }\n  }\n}\nclass ConsoleLogger {\n  constructor(level = \"info\") {\n    this.level = level;\n  }\n  static LEVELS = [\n    \"debug\",\n    \"info\",\n    \"warn\",\n    \"error\"\n  ];\n  /**\n   * Check if a log level should be output\n   *\n   * @param level - Log level to check\n   * @returns True if level meets threshold\n   */\n  shouldLog(level) {\n    const currentIndex = ConsoleLogger.LEVELS.indexOf(this.level);\n    const messageIndex = ConsoleLogger.LEVELS.indexOf(level);\n    return messageIndex >= currentIndex;\n  }\n  /**\n   * Format context for console output\n   *\n   * @param context - Structured metadata\n   * @returns Formatted context string\n   */\n  formatContext(context) {\n    if (!context || Object.keys(context).length === 0) {\n      return \"\";\n    }\n    return ` ${JSON.stringify(context)}`;\n  }\n  debug(message, context) {\n    if (this.shouldLog(\"debug\")) {\n      console.debug(`[DEBUG] ${message}${this.formatContext(context)}`);\n    }\n  }\n  info(message, context) {\n    if (this.shouldLog(\"info\")) {\n      console.info(`[INFO] ${message}${this.formatContext(context)}`);\n    }\n  }\n  warn(message, context) {\n    if (this.shouldLog(\"warn\")) {\n      console.warn(`[WARN] ${message}${this.formatContext(context)}`);\n    }\n  }\n  error(message, context) {\n    if (this.shouldLog(\"error\")) {\n      console.error(`[ERROR] ${message}${this.formatContext(context)}`);\n    }\n  }\n}\nclass NoopLogger {\n  debug(_message, _context) {\n  }\n  info(_message, _context) {\n  }\n  warn(_message, _context) {\n  }\n  error(_message, _context) {\n  }\n}\nfunction createLogger(config) {\n  if (typeof config === \"boolean\") {\n    if (!config) {\n      return new NoopLogger();\n    }\n    const envConfig = loadEnvConfig(\n      {},\n      {\n        packageName: \"logger\",\n        schema: { level: \"string\" }\n      }\n    );\n    return new ConsoleLogger(envConfig.level || \"info\");\n  }\n  const mergedConfig = loadEnvConfig(config, {\n    packageName: \"logger\",\n    schema: { level: \"string\" }\n  });\n  const level = mergedConfig.level || \"info\";\n  return new ConsoleLogger(level);\n}\nconst PACKAGE_VERSION_INITIALIZED = true;\nexport {\n  ConsoleLogger,\n  LoggerAdapter,\n  PACKAGE_VERSION_INITIALIZED,\n  createLogger\n};\n//# sourceMappingURL=index.js.map\n","/**\n * SecretService - High-level API for per-tenant secret management\n * @packageDocumentation\n */\n\n// Self-register this package's manifest for consumers that import via this\n// subpath without the main entry. See src/__smrt-register__.ts (issue #1132).\nimport '../__smrt-register__.js';\n\nimport { createLogger } from '@happyvertical/logger';\nimport {\n  AMKUnavailableError,\n  DecryptionError,\n  type EncryptedEnvelope,\n  EncryptionError,\n  EnvelopeEncryption,\n  getSecretStore,\n  type SecretStore,\n  TenantKeyMissingError,\n} from '@happyvertical/secrets';\nimport {\n  getCurrentTenant,\n  requireTenantId,\n  withTenant,\n} from '@happyvertical/smrt-tenancy';\nimport type { DatabaseInterface } from '@happyvertical/sql';\nimport { SecretAuditLogCollection } from '../collections/SecretAuditLogCollection.js';\nimport { SecretCollection } from '../collections/SecretCollection.js';\nimport { TenantKeyCollection } from '../collections/TenantKeyCollection.js';\nimport type { Secret } from '../models/Secret.js';\nimport {\n  createAuditEntry,\n  type SecretAuditAction,\n  type SecretAuditLog,\n} from '../models/SecretAuditLog.js';\nimport type { TenantKey } from '../models/TenantKey.js';\n\nconst logger = createLogger({ level: 'info' });\n\n/**\n * Options for creating a SecretService\n */\nexport interface SecretServiceOptions {\n  /** Database connection */\n  db: DatabaseInterface;\n  /** Environment variable containing the AMK (64 hex chars) */\n  amkEnvVar?: string;\n  /** AMK key identifier */\n  amkKeyId?: string;\n  /** Enable audit logging (default: true) */\n  auditEnabled?: boolean;\n}\n\n/**\n * Options for storing a secret\n */\nexport interface StoreSecretOptions {\n  /** Human-readable description */\n  description?: string;\n  /** Category for organization */\n  category?: string;\n  /** Optional expiration date */\n  expiresAt?: Date;\n  /** Additional metadata */\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Result of retrieving a secret\n */\nexport interface RetrievedSecret {\n  /** The decrypted secret value */\n  value: string;\n  /** Secret metadata */\n  name: string;\n  description: string;\n  category: string;\n  expiresAt: Date | null;\n  createdAt: Date;\n  lastAccessedAt: Date | null;\n  accessCount: number;\n  metadata: Record<string, unknown>;\n}\n\nexport type SecretKeyDriftIssueSeverity = 'info' | 'warning' | 'error';\n\nexport type SecretKeyDriftIssueCode =\n  | 'amk_unavailable'\n  | 'active_secrets_without_usable_active_key'\n  | 'missing_active_tenant_encryption_key'\n  | 'multiple_active_tenant_encryption_keys'\n  | 'active_tenant_encryption_key_amk_mismatch'\n  | 'active_tenant_encryption_key_unwrap_failed'\n  | 'secret_envelope_invalid_json'\n  | 'secret_envelope_invalid_wrapped_key'\n  | 'secret_envelope_missing_tenant_encryption_key'\n  | 'secret_envelope_unwrap_failed'\n  | 'smrt_tenant_keys_query_failed'\n  | 'smrt_tenant_keys_not_mirrored';\n\nexport type SecretKeyDriftRepairAction =\n  | 'delete-unrecoverable-secret'\n  | 'delete-unusable-tenant-encryption-key'\n  | 'store-fresh-secret-value'\n  | 'none';\n\nexport interface SecretKeyDriftIssue {\n  code: SecretKeyDriftIssueCode;\n  severity: SecretKeyDriftIssueSeverity;\n  message: string;\n  repairAction: SecretKeyDriftRepairAction;\n  secretId?: string;\n  secretName?: string;\n  keyId?: string;\n  sourceTable?: 'secrets' | 'tenant_encryption_keys' | 'tenant_keys';\n  details?: Record<string, string | number | boolean | null>;\n}\n\nexport interface DiagnoseTenantSecretKeyDriftOptions {\n  /**\n   * Limit secret-envelope checks to these names. Tenant key checks still run.\n   */\n  secretNames?: string[];\n}\n\nexport interface SecretKeyDriftReport {\n  tenantId: string;\n  checkedAt: Date;\n  ok: boolean;\n  summary: {\n    activeSecretCount: number;\n    tenantEncryptionKeyCount: number;\n    activeTenantEncryptionKeyCount: number;\n    usableActiveTenantEncryptionKeyCount: number;\n    smrtTenantKeyCount: number;\n    activeSmrtTenantKeyCount: number;\n  };\n  issues: SecretKeyDriftIssue[];\n}\n\nexport interface RepairTenantSecretKeyDriftOptions\n  extends DiagnoseTenantSecretKeyDriftOptions {\n  /**\n   * Preview affected rows without deleting anything.\n   */\n  dryRun?: boolean;\n  /**\n   * Required for destructive repair. This deletes encrypted values/key rows\n   * that cannot be used with the currently configured AMK.\n   */\n  confirmDeleteUnrecoverableData?: boolean;\n}\n\nexport interface SecretKeyDriftRepairResult {\n  tenantId: string;\n  dryRun: boolean;\n  issuesBefore: SecretKeyDriftIssue[];\n  remainingIssues: SecretKeyDriftIssue[];\n  wouldDeleteSecrets: number;\n  wouldDeleteTenantEncryptionKeys: number;\n  deletedSecrets: number;\n  deletedTenantEncryptionKeys: number;\n  secretNames: string[];\n  tenantEncryptionKeyIds: string[];\n}\n\nexport class SecretKeyDriftError extends Error {\n  readonly code = 'SECRET_KEY_DRIFT';\n  readonly tenantId: string;\n  readonly report: SecretKeyDriftReport;\n  readonly cause?: Error;\n\n  constructor(\n    message: string,\n    tenantId: string,\n    report: SecretKeyDriftReport,\n    cause?: Error,\n  ) {\n    super(message);\n    this.name = 'SecretKeyDriftError';\n    this.tenantId = tenantId;\n    this.report = report;\n    this.cause = cause;\n  }\n}\n\ninterface TenantEncryptionKeyRow {\n  id: string;\n  tenant_id: string;\n  wrapped_key: string;\n  amk_key_id: string;\n  status: string;\n  version: number;\n  rotate_after: string | null;\n  retired_at: string | null;\n  created_at: string;\n  updated_at: string;\n}\n\ninterface SecretDiagnosisRow {\n  id: string;\n  name: string;\n  encrypted_value: string;\n  status: string;\n  tenant_id: string;\n}\n\ninterface WrappedKeyCheck {\n  usable: boolean;\n  error?: string;\n  fingerprint?: string;\n}\n\ninterface SmrtTenantKeyDiagnosisRows {\n  keys: TenantKey[];\n  error?: Error;\n}\n\ntype TransactionCapableDatabase = DatabaseInterface & {\n  transaction?: <T>(\n    callback: (tx: DatabaseInterface) => Promise<T>,\n  ) => Promise<T>;\n};\n\n/**\n * SecretService provides high-level operations for managing per-tenant secrets.\n *\n * It integrates with:\n * - `@happyvertical/secrets` for envelope encryption\n * - `@happyvertical/smrt-tenancy` for tenant context\n * - Audit logging for compliance\n *\n * @example\n * ```typescript\n * import { SecretService } from '@happyvertical/smrt-secrets';\n * import { withTenant } from '@happyvertical/smrt-tenancy';\n *\n * const service = await SecretService.create({ db });\n *\n * await withTenant({ tenantId: 'tenant-123' }, async () => {\n *   // Store a secret\n *   await service.store('stripe-api-key', 'sk_live_xxx', {\n *     category: 'api-keys',\n *     description: 'Stripe production API key'\n *   });\n *\n *   // Retrieve the secret\n *   const secret = await service.retrieve('stripe-api-key');\n *   console.log(secret.value); // 'sk_live_xxx'\n *\n *   // List secret names (without values)\n *   const secrets = await service.list();\n *\n *   // Rotate tenant's encryption key\n *   await service.rotateKey();\n *\n *   // Delete a secret\n *   await service.delete('stripe-api-key');\n * });\n * ```\n */\nexport class SecretService {\n  private db: DatabaseInterface;\n  private secretStore: SecretStore;\n  private secrets: SecretCollection;\n  private tenantKeys: TenantKeyCollection;\n  private auditLogs: SecretAuditLogCollection;\n  private auditEnabled: boolean;\n  private amkEnvVar: string;\n  private amkKeyId: string;\n\n  private constructor(\n    db: DatabaseInterface,\n    secretStore: SecretStore,\n    secrets: SecretCollection,\n    tenantKeys: TenantKeyCollection,\n    auditLogs: SecretAuditLogCollection,\n    auditEnabled: boolean,\n    amkEnvVar: string,\n    amkKeyId: string,\n  ) {\n    this.db = db;\n    this.secretStore = secretStore;\n    this.secrets = secrets;\n    this.tenantKeys = tenantKeys;\n    this.auditLogs = auditLogs;\n    this.auditEnabled = auditEnabled;\n    this.amkEnvVar = amkEnvVar;\n    this.amkKeyId = amkKeyId;\n  }\n\n  /**\n   * Create a new SecretService instance\n   */\n  static async create(options: SecretServiceOptions): Promise<SecretService> {\n    const {\n      db,\n      amkEnvVar = 'SMRT_SECRET_MASTER_KEY',\n      amkKeyId = 'smrt-amk-v1',\n      auditEnabled = true,\n    } = options;\n\n    // Create the underlying secret store\n    const secretStore = await getSecretStore({\n      type: 'database',\n      db,\n      amk: {\n        provider: 'env',\n        keyEnvVar: amkEnvVar,\n        keyId: amkKeyId,\n      },\n    });\n\n    // Create collections - pass db directly (DatabaseConfig accepts DatabaseInterface)\n    const baseOptions = { db };\n    const secrets = await SecretCollection.create(baseOptions);\n    const tenantKeys = await TenantKeyCollection.create(baseOptions);\n    const auditLogs = await SecretAuditLogCollection.create(baseOptions);\n\n    return new SecretService(\n      db,\n      secretStore,\n      secrets,\n      tenantKeys,\n      auditLogs,\n      auditEnabled,\n      amkEnvVar,\n      amkKeyId,\n    );\n  }\n\n  /**\n   * Store a secret for the current tenant\n   */\n  async store(\n    name: string,\n    value: string,\n    options: StoreSecretOptions = {},\n  ): Promise<Secret> {\n    const tenantId = requireTenantId();\n    const userId = this.getCurrentUserId();\n\n    // Track whether this is an update to use correct audit action on error\n    let isUpdate = false;\n\n    try {\n      // Check if secret already exists for THIS tenant (issue #1501: an\n      // unscoped lookup here used to find another tenant's same-named row and\n      // clobber it with an envelope encrypted under the caller's TDEK).\n      let existing = await this.secrets.findByName(tenantId, name);\n      // Defense-in-depth: even if a lookup regression ever returns a foreign\n      // row again, never save over it — fall through to the create path,\n      // which is tenant-scoped via the (slug, context=tenantId) upsert key.\n      if (existing && existing.tenantId !== tenantId) {\n        existing = null;\n      }\n      isUpdate = existing !== null;\n\n      // Encrypt the value\n      const envelope = await this.secretStore.encrypt(tenantId, name, value, {\n        metadata: options.metadata\n          ? this.serializeMetadata(options.metadata)\n          : undefined,\n      });\n\n      if (existing) {\n        // Update existing secret\n        existing.encryptedValue = JSON.stringify(envelope);\n        existing.description = options.description ?? existing.description;\n        existing.category = options.category ?? existing.category;\n        existing.expiresAt = options.expiresAt ?? existing.expiresAt;\n        existing.metadata = options.metadata ?? existing.metadata;\n        await existing.save();\n\n        await this.audit(\n          existing.id ?? null,\n          name,\n          userId,\n          'update',\n          'success',\n        );\n        return existing;\n      }\n\n      // Create new secret\n      // Set context to tenantId for per-tenant uniqueness\n      // The UPSERT uses (slug, context) as conflict columns, so different tenants\n      // can have secrets with the same name\n      const secret = await this.secrets.create({\n        name,\n        description: options.description ?? '',\n        category: options.category ?? '',\n        encryptedValue: JSON.stringify(envelope),\n        keyVersion: 1,\n        status: 'active',\n        expiresAt: options.expiresAt ?? null,\n        metadata: options.metadata ?? {},\n        context: tenantId, // Per-tenant uniqueness\n        tenantId,\n      });\n\n      await this.audit(secret.id ?? null, name, userId, 'create', 'success');\n      return secret;\n    } catch (error) {\n      const classifiedError = await this.classifyTenantKeyFailure(\n        tenantId,\n        name,\n        error,\n      );\n      await this.audit(\n        null,\n        name,\n        userId,\n        isUpdate ? 'update' : 'create',\n        'failure',\n        {\n          error: classifiedError.message,\n        },\n      );\n      throw classifiedError;\n    }\n  }\n\n  /**\n   * Store a secret for a specific tenant.\n   *\n   * This is useful for integrations that already resolved tenant ownership but\n   * may be running outside the application's ambient tenant context.\n   */\n  async storeForTenant(\n    tenantId: string,\n    name: string,\n    value: string,\n    options: StoreSecretOptions = {},\n  ): Promise<Secret> {\n    return withTenant({ tenantId }, () => this.store(name, value, options));\n  }\n\n  /**\n   * Retrieve a secret for the current tenant\n   */\n  async retrieve(name: string): Promise<RetrievedSecret> {\n    const tenantId = requireTenantId();\n    const userId = this.getCurrentUserId();\n\n    // Track whether we've already audited to avoid double-auditing\n    let audited = false;\n\n    try {\n      const secret = await this.secrets.findByName(tenantId, name);\n      // Ownership check before any decrypt attempt (issue #1501): a row owned\n      // by another tenant must behave exactly like \"not found\", never surface\n      // as a cross-tenant decrypt failure.\n      if (!secret || secret.tenantId !== tenantId) {\n        await this.audit(null, name, userId, 'read', 'failure', {\n          error: 'Secret not found',\n        });\n        audited = true;\n        throw new Error(`Secret '${name}' not found`);\n      }\n\n      if (!secret.isUsable()) {\n        const reason = secret.isExpired()\n          ? 'Secret expired'\n          : 'Secret disabled';\n        await this.audit(secret.id ?? null, name, userId, 'read', 'failure', {\n          error: reason,\n        });\n        audited = true;\n        throw new Error(reason);\n      }\n\n      // Decrypt the value\n      const envelope: EncryptedEnvelope = JSON.parse(secret.encryptedValue);\n      const decrypted = await this.secretStore.decrypt(tenantId, envelope);\n\n      // Access tracking is operational telemetry. Retrieval should still\n      // succeed if the decrypted value is available but this write fails.\n      const previousLastAccessedAt = secret.lastAccessedAt;\n      const previousAccessCount = secret.accessCount;\n      try {\n        secret.recordAccess();\n        await secret.save();\n      } catch (trackingError) {\n        secret.lastAccessedAt = previousLastAccessedAt;\n        secret.accessCount = previousAccessCount;\n        logger.error('Failed to update secret access tracking', {\n          error: trackingError,\n        });\n      }\n\n      await this.audit(secret.id ?? null, name, userId, 'read', 'success');\n\n      return {\n        value: decrypted.value,\n        name: secret.name,\n        description: secret.description,\n        category: secret.category,\n        expiresAt: secret.expiresAt,\n        createdAt: secret.created_at ?? new Date(),\n        lastAccessedAt: secret.lastAccessedAt,\n        accessCount: secret.accessCount,\n        metadata: secret.metadata,\n      };\n    } catch (error) {\n      const classifiedError = await this.classifyTenantKeyFailure(\n        tenantId,\n        name,\n        error,\n      );\n      // Only audit if we haven't already audited this error\n      if (!audited) {\n        await this.audit(null, name, userId, 'read', 'failure', {\n          error: classifiedError.message,\n        });\n      }\n      throw classifiedError;\n    }\n  }\n\n  /**\n   * Retrieve a secret for a specific tenant.\n   */\n  async retrieveForTenant(\n    tenantId: string,\n    name: string,\n  ): Promise<RetrievedSecret> {\n    return withTenant({ tenantId }, () => this.retrieve(name));\n  }\n\n  /**\n   * Diagnose tenant secret/key drift without exposing decrypted values.\n   */\n  async diagnoseTenantSecretKeyDrift(\n    tenantId: string,\n    options: DiagnoseTenantSecretKeyDriftOptions = {},\n  ): Promise<SecretKeyDriftReport> {\n    const activeSecrets = await this.listActiveSecretRowsForDiagnosis(\n      tenantId,\n      options.secretNames,\n    );\n    const tenantEncryptionKeys =\n      await this.listTenantEncryptionKeyRows(tenantId);\n    const smrtTenantKeyRows =\n      await this.listSmrtTenantKeysForDiagnosis(tenantId);\n    const smrtTenantKeys = smrtTenantKeyRows.keys;\n    const issues: SecretKeyDriftIssue[] = [];\n\n    const activeTenantEncryptionKeys = tenantEncryptionKeys.filter(\n      (key) => key.status === 'active',\n    );\n    const activeSmrtTenantKeys = smrtTenantKeys.filter(\n      (key) => key.status === 'active',\n    );\n    const amk = this.getConfiguredAmkForDiagnosis();\n\n    if (!amk.usable) {\n      issues.push({\n        code: 'amk_unavailable',\n        severity: 'error',\n        message: amk.error ?? `AMK ${this.amkEnvVar} is unavailable`,\n        repairAction: 'none',\n        details: {\n          amkEnvVar: this.amkEnvVar,\n          amkKeyId: this.amkKeyId,\n        },\n      });\n    }\n\n    if (activeSecrets.length > 0 && activeTenantEncryptionKeys.length === 0) {\n      issues.push({\n        code: 'missing_active_tenant_encryption_key',\n        severity: 'error',\n        message:\n          'Active tenant secrets exist, but tenant_encryption_keys has no active key for encryption.',\n        repairAction: 'store-fresh-secret-value',\n        sourceTable: 'tenant_encryption_keys',\n        details: {\n          activeSecretCount: activeSecrets.length,\n        },\n      });\n    }\n\n    if (smrtTenantKeyRows.error) {\n      issues.push({\n        code: 'smrt_tenant_keys_query_failed',\n        severity: 'error',\n        message:\n          'Unable to query SMRT tenant_keys while diagnosing tenant secret key drift.',\n        repairAction: 'none',\n        sourceTable: 'tenant_keys',\n        details: {\n          error: smrtTenantKeyRows.error.message,\n        },\n      });\n    }\n\n    if (activeTenantEncryptionKeys.length > 1) {\n      issues.push({\n        code: 'multiple_active_tenant_encryption_keys',\n        severity: 'error',\n        message:\n          'tenant_encryption_keys has multiple active keys for this tenant; encryption may use an arbitrary active key.',\n        repairAction: 'none',\n        sourceTable: 'tenant_encryption_keys',\n        details: {\n          activeTenantEncryptionKeyCount: activeTenantEncryptionKeys.length,\n        },\n      });\n    }\n\n    const activeKeyChecks: WrappedKeyCheck[] = [];\n\n    for (const key of tenantEncryptionKeys) {\n      const check = amk.value\n        ? this.checkWrappedKey(key.wrapped_key, amk.value)\n        : { usable: false, error: amk.error };\n\n      if (key.status === 'active') {\n        activeKeyChecks.push(check);\n      }\n\n      if (key.status === 'active' && key.amk_key_id !== this.amkKeyId) {\n        issues.push({\n          code: 'active_tenant_encryption_key_amk_mismatch',\n          severity: 'warning',\n          message:\n            'Active tenant_encryption_keys row was wrapped by a different AMK key id than this SecretService is configured to use.',\n          repairAction: 'none',\n          keyId: key.id,\n          sourceTable: 'tenant_encryption_keys',\n          details: {\n            rowAmkKeyId: key.amk_key_id,\n            configuredAmkKeyId: this.amkKeyId,\n          },\n        });\n      }\n\n      if (key.status === 'active' && !check.usable && amk.value) {\n        issues.push({\n          code: 'active_tenant_encryption_key_unwrap_failed',\n          severity: 'error',\n          message:\n            'Active tenant_encryption_keys row cannot be unwrapped by the currently configured AMK.',\n          repairAction: 'delete-unusable-tenant-encryption-key',\n          keyId: key.id,\n          sourceTable: 'tenant_encryption_keys',\n          details: {\n            version: key.version,\n            error: check.error ?? null,\n          },\n        });\n      }\n    }\n\n    const usableActiveTenantEncryptionKeyCount = activeKeyChecks.filter(\n      (check) => check.usable,\n    ).length;\n\n    if (\n      activeSecrets.length > 0 &&\n      usableActiveTenantEncryptionKeyCount === 0\n    ) {\n      issues.push({\n        code: 'active_secrets_without_usable_active_key',\n        severity: 'error',\n        message:\n          'Active secrets exist, but no active tenant_encryption_keys row can be used with the current AMK.',\n        repairAction: 'store-fresh-secret-value',\n        sourceTable: 'tenant_encryption_keys',\n        details: {\n          activeSecretCount: activeSecrets.length,\n          activeTenantEncryptionKeyCount: activeTenantEncryptionKeys.length,\n        },\n      });\n    }\n\n    const keyFingerprintToRow = new Map<string, TenantEncryptionKeyRow>();\n    for (const key of tenantEncryptionKeys) {\n      const fingerprint = this.getWrappedKeyFingerprint(key.wrapped_key);\n      if (fingerprint) {\n        keyFingerprintToRow.set(fingerprint, key);\n      }\n    }\n\n    for (const secret of activeSecrets) {\n      const envelope = this.parseSecretEnvelopeForDiagnosis(secret, issues);\n      if (!envelope) continue;\n\n      const envelopeFingerprint = this.getWrappedKeyFingerprint(\n        envelope.wrappedKey,\n      );\n      const envelopeCheck = amk.value\n        ? this.checkWrappedKey(envelope.wrappedKey, amk.value)\n        : {\n            usable: false,\n            error: amk.error,\n            fingerprint: envelopeFingerprint,\n          };\n\n      if (!envelopeCheck.fingerprint) {\n        issues.push({\n          code: 'secret_envelope_invalid_wrapped_key',\n          severity: 'error',\n          message:\n            'Secret encryptedValue contains an invalid wrapped key format.',\n          repairAction: 'delete-unrecoverable-secret',\n          secretId: secret.id,\n          secretName: secret.name,\n          sourceTable: 'secrets',\n          details: {\n            error: envelopeCheck.error ?? null,\n          },\n        });\n        continue;\n      }\n\n      const matchingKey = keyFingerprintToRow.get(envelopeCheck.fingerprint);\n      if (!matchingKey) {\n        issues.push({\n          code: 'secret_envelope_missing_tenant_encryption_key',\n          severity: 'error',\n          message:\n            'Secret envelope does not match any tenant_encryption_keys row for this tenant.',\n          repairAction: !amk.value\n            ? 'none'\n            : envelopeCheck.usable\n              ? 'none'\n              : 'delete-unrecoverable-secret',\n          secretId: secret.id,\n          secretName: secret.name,\n          sourceTable: 'secrets',\n        });\n      }\n\n      if (!envelopeCheck.usable && amk.value) {\n        issues.push({\n          code: 'secret_envelope_unwrap_failed',\n          severity: 'error',\n          message:\n            'Secret envelope cannot be unwrapped by the currently configured AMK.',\n          repairAction: 'delete-unrecoverable-secret',\n          secretId: secret.id,\n          secretName: secret.name,\n          keyId: matchingKey?.id,\n          sourceTable: 'secrets',\n          details: {\n            error: envelopeCheck.error ?? null,\n          },\n        });\n      }\n    }\n\n    if (\n      activeSecrets.length > 0 &&\n      tenantEncryptionKeys.length > 0 &&\n      smrtTenantKeys.length === 0 &&\n      !smrtTenantKeyRows.error\n    ) {\n      issues.push({\n        code: 'smrt_tenant_keys_not_mirrored',\n        severity: 'info',\n        message:\n          'SMRT tenant_keys has no rows for this tenant, while the lower-level tenant_encryption_keys table does. SecretService uses tenant_encryption_keys for encryption.',\n        repairAction: 'none',\n        sourceTable: 'tenant_keys',\n      });\n    }\n\n    return {\n      tenantId,\n      checkedAt: new Date(),\n      ok: !issues.some((issue) => issue.severity === 'error'),\n      summary: {\n        activeSecretCount: activeSecrets.length,\n        tenantEncryptionKeyCount: tenantEncryptionKeys.length,\n        activeTenantEncryptionKeyCount: activeTenantEncryptionKeys.length,\n        usableActiveTenantEncryptionKeyCount,\n        smrtTenantKeyCount: smrtTenantKeys.length,\n        activeSmrtTenantKeyCount: activeSmrtTenantKeys.length,\n      },\n      issues,\n    };\n  }\n\n  /**\n   * Diagnose drift for the current tenant context.\n   */\n  async diagnoseCurrentTenantSecretKeyDrift(\n    options: DiagnoseTenantSecretKeyDriftOptions = {},\n  ): Promise<SecretKeyDriftReport> {\n    return this.diagnoseTenantSecretKeyDrift(requireTenantId(), options);\n  }\n\n  /**\n   * Delete unrecoverable secret/key rows identified by diagnosis.\n   *\n   * This never attempts to recover or expose secret values. Use dryRun first\n   * to preview destructive changes.\n   */\n  async repairTenantSecretKeyDrift(\n    tenantId: string,\n    options: RepairTenantSecretKeyDriftOptions = {},\n  ): Promise<SecretKeyDriftRepairResult> {\n    const dryRun = options.dryRun ?? false;\n    const before = await this.diagnoseTenantSecretKeyDrift(tenantId, options);\n    const secretIds = new Set<string>();\n    const secretNames = new Map<string, string>();\n    const tenantEncryptionKeyIds = new Set<string>();\n\n    for (const issue of before.issues) {\n      if (\n        issue.repairAction === 'delete-unrecoverable-secret' &&\n        issue.secretId\n      ) {\n        secretIds.add(issue.secretId);\n        if (issue.secretName) {\n          secretNames.set(issue.secretId, issue.secretName);\n        }\n      }\n\n      if (\n        issue.repairAction === 'delete-unusable-tenant-encryption-key' &&\n        issue.keyId\n      ) {\n        tenantEncryptionKeyIds.add(issue.keyId);\n      }\n    }\n\n    const wouldDeleteSecrets = secretIds.size;\n    const wouldDeleteTenantEncryptionKeys = tenantEncryptionKeyIds.size;\n    const wouldDeleteUnrecoverableData =\n      wouldDeleteSecrets + wouldDeleteTenantEncryptionKeys > 0;\n\n    if (\n      !dryRun &&\n      wouldDeleteUnrecoverableData &&\n      !options.confirmDeleteUnrecoverableData\n    ) {\n      throw new Error(\n        'repairTenantSecretKeyDrift requires confirmDeleteUnrecoverableData: true before deleting encrypted secrets or tenant key rows.',\n      );\n    }\n\n    let deletedSecrets = 0;\n    let deletedTenantEncryptionKeys = 0;\n\n    if (!dryRun) {\n      const runDeletes = async (db: DatabaseInterface) => {\n        const deletedSecretRows = await this.deleteRowsByIds(\n          'secrets',\n          tenantId,\n          secretIds,\n          db,\n        );\n        const deletedTenantEncryptionKeyRows = await this.deleteRowsByIds(\n          'tenant_encryption_keys',\n          tenantId,\n          tenantEncryptionKeyIds,\n          db,\n        );\n        return {\n          deletedSecrets: deletedSecretRows,\n          deletedTenantEncryptionKeys: deletedTenantEncryptionKeyRows,\n        };\n      };\n      const txDb = this.db as TransactionCapableDatabase;\n      const deleteResult =\n        typeof txDb.transaction === 'function'\n          ? await txDb.transaction((db) => runDeletes(db))\n          : await runDeletes(this.db);\n\n      deletedSecrets = deleteResult.deletedSecrets;\n      deletedTenantEncryptionKeys = deleteResult.deletedTenantEncryptionKeys;\n      await this.auditSecretDriftRepairDeletes(\n        tenantId,\n        secretIds,\n        secretNames,\n      );\n    }\n\n    const after = dryRun\n      ? before\n      : await this.diagnoseTenantSecretKeyDrift(tenantId, options);\n\n    return {\n      tenantId,\n      dryRun,\n      issuesBefore: before.issues,\n      remainingIssues: after.issues,\n      wouldDeleteSecrets,\n      wouldDeleteTenantEncryptionKeys,\n      deletedSecrets,\n      deletedTenantEncryptionKeys,\n      secretNames: Array.from(secretNames.values()).sort(),\n      tenantEncryptionKeyIds: Array.from(tenantEncryptionKeyIds).sort(),\n    };\n  }\n\n  /**\n   * List secrets for the current tenant (names only, not values)\n   */\n  async list(options: { category?: string } = {}): Promise<Secret[]> {\n    return this.secrets.listSecrets(requireTenantId(), {\n      category: options.category,\n      status: 'active',\n    });\n  }\n\n  /**\n   * Delete a secret\n   */\n  async delete(name: string): Promise<boolean> {\n    const tenantId = requireTenantId();\n    const userId = this.getCurrentUserId();\n\n    const secret = await this.secrets.findByName(tenantId, name);\n    // Ownership check (issue #1501): never delete another tenant's row\n    if (!secret || secret.tenantId !== tenantId) {\n      return false;\n    }\n\n    try {\n      await secret.delete();\n      await this.audit(secret.id ?? null, name, userId, 'delete', 'success');\n      return true;\n    } catch (error) {\n      await this.audit(secret.id ?? null, name, userId, 'delete', 'failure', {\n        error: (error as Error).message,\n      });\n      throw error;\n    }\n  }\n\n  /**\n   * Disable a secret (soft delete)\n   */\n  async disable(name: string): Promise<boolean> {\n    const tenantId = requireTenantId();\n    const userId = this.getCurrentUserId();\n\n    const secret = await this.secrets.findByName(tenantId, name);\n    // Ownership check (issue #1501): never mutate another tenant's row\n    if (!secret || secret.tenantId !== tenantId) {\n      return false;\n    }\n\n    secret.disable();\n    await secret.save();\n    await this.audit(secret.id ?? null, name, userId, 'disable', 'success');\n    return true;\n  }\n\n  /**\n   * Enable a disabled secret\n   */\n  async enable(name: string): Promise<boolean> {\n    const tenantId = requireTenantId();\n    const userId = this.getCurrentUserId();\n\n    const secret = await this.secrets.findByName(tenantId, name);\n    // Ownership check (issue #1501): never mutate another tenant's row\n    if (!secret || secret.tenantId !== tenantId) {\n      return false;\n    }\n\n    secret.enable();\n    await secret.save();\n    await this.audit(secret.id ?? null, name, userId, 'enable', 'success');\n    return true;\n  }\n\n  /**\n   * Rotate the tenant's encryption key\n   *\n   * This creates a new TDEK and marks the old one as retired.\n   * Existing secrets remain encrypted with the old key and can still\n   * be decrypted (the old key is kept in retired state).\n   *\n   * For full re-encryption, call reencryptAll() after rotation.\n   */\n  async rotateKey(): Promise<void> {\n    const tenantId = requireTenantId();\n    const userId = this.getCurrentUserId();\n\n    try {\n      await this.secretStore.rotateTenantKey(tenantId);\n      await this.audit(null, '', userId, 'rotate_key', 'success', {\n        tenantId,\n      });\n    } catch (error) {\n      await this.audit(null, '', userId, 'rotate_key', 'failure', {\n        tenantId,\n        error: (error as Error).message,\n      });\n      throw error;\n    }\n  }\n\n  /**\n   * Re-encrypt all secrets with the current active key\n   *\n   * Call this after key rotation to ensure all secrets use the new key.\n   * This is optional but recommended for security.\n   */\n  async reencryptAll(): Promise<{ success: number; failed: number }> {\n    const tenantId = requireTenantId();\n    const userId = this.getCurrentUserId();\n\n    // Scope to the current tenant (issue #1501): re-encryption must never\n    // touch (or attempt to decrypt) other tenants' rows.\n    const secrets = await this.secrets.list({ where: { tenantId } });\n    let success = 0;\n    let failed = 0;\n\n    for (const secret of secrets) {\n      try {\n        // Decrypt with old key\n        const envelope: EncryptedEnvelope = JSON.parse(secret.encryptedValue);\n        const decrypted = await this.secretStore.decrypt(tenantId, envelope);\n\n        // Re-encrypt with new key\n        const newEnvelope = await this.secretStore.encrypt(\n          tenantId,\n          secret.name,\n          decrypted.value,\n        );\n\n        secret.encryptedValue = JSON.stringify(newEnvelope);\n        await secret.save();\n\n        success++;\n      } catch (error) {\n        failed++;\n        await this.audit(\n          secret.id ?? null,\n          secret.name,\n          userId,\n          'update',\n          'failure',\n          {\n            action: 'reencrypt',\n            error: (error as Error).message,\n          },\n        );\n      }\n    }\n\n    return { success, failed };\n  }\n\n  /**\n   * Get audit logs for the current tenant\n   */\n  async getAuditLogs(\n    options: { secretName?: string; limit?: number } = {},\n  ): Promise<SecretAuditLog[]> {\n    return this.auditLogs.listLogs({\n      // Scope to the current tenant (issue #1501): audit logs reference\n      // secret names and must not leak across tenants.\n      tenantId: requireTenantId(),\n      secretName: options.secretName,\n      limit: options.limit ?? 100,\n    });\n  }\n\n  /**\n   * Get secret categories for the current tenant\n   */\n  async getCategories(): Promise<string[]> {\n    return this.secrets.getCategories(requireTenantId());\n  }\n\n  /**\n   * Check if a secret exists for the current tenant\n   */\n  async exists(name: string): Promise<boolean> {\n    const tenantId = requireTenantId();\n    const secret = await this.secrets.findByName(tenantId, name);\n    return secret !== null && secret.tenantId === tenantId;\n  }\n\n  // Private methods\n\n  private async listActiveSecretRowsForDiagnosis(\n    tenantId: string,\n    secretNames?: string[],\n  ): Promise<SecretDiagnosisRow[]> {\n    const params: unknown[] = [tenantId];\n    let nameFilter = '';\n\n    if (secretNames && secretNames.length > 0) {\n      const placeholders = secretNames.map(() => '?').join(', ');\n      nameFilter = ` AND name IN (${placeholders})`;\n      params.push(...secretNames);\n    }\n\n    const result = await this.db.query(\n      `\n        SELECT id, name, encrypted_value, status, tenant_id\n        FROM \"secrets\"\n        WHERE tenant_id = ? AND status = 'active'${nameFilter}\n        ORDER BY name ASC\n      `,\n      ...params,\n    );\n\n    return this.rowsFromResult<SecretDiagnosisRow>(result);\n  }\n\n  private async listTenantEncryptionKeyRows(\n    tenantId: string,\n  ): Promise<TenantEncryptionKeyRow[]> {\n    const result = await this.db.query(\n      `\n        SELECT id, tenant_id, wrapped_key, amk_key_id, status, version,\n          rotate_after, retired_at, created_at, updated_at\n        FROM \"tenant_encryption_keys\"\n        WHERE tenant_id = ?\n        ORDER BY version DESC\n      `,\n      tenantId,\n    );\n\n    return this.rowsFromResult<TenantEncryptionKeyRow>(result);\n  }\n\n  private async listSmrtTenantKeysForDiagnosis(\n    tenantId: string,\n  ): Promise<SmrtTenantKeyDiagnosisRows> {\n    try {\n      return { keys: await this.tenantKeys.listKeyVersions(tenantId) };\n    } catch (error) {\n      return { keys: [], error: this.toError(error) };\n    }\n  }\n\n  private getConfiguredAmkForDiagnosis():\n    | { usable: true; value: Buffer }\n    | { usable: false; error: string; value?: undefined } {\n    const keyHex = process.env[this.amkEnvVar];\n    if (!keyHex) {\n      return {\n        usable: false,\n        error: `Application Master Key not found in environment variable: ${this.amkEnvVar}`,\n      };\n    }\n\n    try {\n      return {\n        usable: true,\n        value: EnvelopeEncryption.parseHexKey(keyHex),\n      };\n    } catch (error) {\n      return {\n        usable: false,\n        error: `Invalid AMK in ${this.amkEnvVar}: ${\n          this.toError(error).message\n        }`,\n      };\n    }\n  }\n\n  private checkWrappedKey(wrappedKey: string, amk: Buffer): WrappedKeyCheck {\n    const fingerprint = this.getWrappedKeyFingerprint(wrappedKey);\n\n    try {\n      const parsed = EnvelopeEncryption.parseWrappedKey(wrappedKey);\n      const dataKey = EnvelopeEncryption.unwrapKey(\n        parsed.wrappedKey,\n        parsed.iv,\n        parsed.authTag,\n        amk,\n      );\n      dataKey.fill(0);\n      return { usable: true, fingerprint };\n    } catch (error) {\n      return {\n        usable: false,\n        fingerprint,\n        error: this.toError(error).message,\n      };\n    }\n  }\n\n  private getWrappedKeyFingerprint(wrappedKey: string): string | undefined {\n    try {\n      return EnvelopeEncryption.parseWrappedKey(wrappedKey).wrappedKey;\n    } catch {\n      return undefined;\n    }\n  }\n\n  private parseSecretEnvelopeForDiagnosis(\n    secret: SecretDiagnosisRow,\n    issues: SecretKeyDriftIssue[],\n  ): EncryptedEnvelope | null {\n    try {\n      return JSON.parse(secret.encrypted_value) as EncryptedEnvelope;\n    } catch (error) {\n      issues.push({\n        code: 'secret_envelope_invalid_json',\n        severity: 'error',\n        message: 'Secret encryptedValue is not valid EncryptedEnvelope JSON.',\n        repairAction: 'delete-unrecoverable-secret',\n        secretId: secret.id,\n        secretName: secret.name,\n        sourceTable: 'secrets',\n        details: {\n          error: this.toError(error).message,\n        },\n      });\n      return null;\n    }\n  }\n\n  private async deleteRowsByIds(\n    tableName: 'secrets' | 'tenant_encryption_keys',\n    tenantId: string,\n    ids: Set<string>,\n    db: DatabaseInterface = this.db,\n  ): Promise<number> {\n    if (ids.size === 0) return 0;\n\n    const idList = Array.from(ids);\n    const placeholders = idList.map(() => '?').join(', ');\n    const result = await db.query(\n      `DELETE FROM \"${tableName}\" WHERE tenant_id = ? AND id IN (${placeholders})`,\n      tenantId,\n      ...idList,\n    );\n\n    return typeof result.rowCount === 'number'\n      ? result.rowCount\n      : idList.length;\n  }\n\n  private async auditSecretDriftRepairDeletes(\n    tenantId: string,\n    secretIds: Set<string>,\n    secretNames: Map<string, string>,\n  ): Promise<void> {\n    if (secretIds.size === 0) return;\n\n    const userId = this.getCurrentUserId();\n    await withTenant({ tenantId }, async () => {\n      for (const secretId of secretIds) {\n        await this.audit(\n          secretId,\n          secretNames.get(secretId) ?? '',\n          userId,\n          'delete',\n          'success',\n          {\n            action: 'repairTenantSecretKeyDrift',\n            reason: 'unrecoverable-secret-key-drift',\n          },\n        );\n      }\n    });\n  }\n\n  private rowsFromResult<T>(result: unknown): T[] {\n    if (Array.isArray(result)) return result as T[];\n    if (\n      result &&\n      typeof result === 'object' &&\n      Array.isArray((result as { rows?: unknown }).rows)\n    ) {\n      return (result as { rows: T[] }).rows;\n    }\n    return [];\n  }\n\n  private async classifyTenantKeyFailure(\n    tenantId: string,\n    secretName: string,\n    error: unknown,\n  ): Promise<Error> {\n    const normalized = this.toError(error);\n    if (!this.shouldClassifyTenantKeyFailure(normalized)) {\n      return normalized;\n    }\n\n    try {\n      const report = await this.diagnoseTenantSecretKeyDrift(tenantId, {\n        secretNames: [secretName],\n      });\n      const errorCodes = report.issues\n        .filter((issue) => issue.severity === 'error')\n        .map((issue) => issue.code);\n\n      if (errorCodes.length === 0) {\n        return normalized;\n      }\n\n      return new SecretKeyDriftError(\n        `Secret '${secretName}' for tenant '${tenantId}' failed because secret key drift was detected: ${[\n          ...new Set(errorCodes),\n        ].join(\n          ', ',\n        )}. Run diagnoseTenantSecretKeyDrift() for details and repairTenantSecretKeyDrift() for explicit cleanup of unrecoverable rows.`,\n        tenantId,\n        report,\n        normalized,\n      );\n    } catch {\n      return normalized;\n    }\n  }\n\n  private shouldClassifyTenantKeyFailure(error: Error): boolean {\n    const code = this.getSecretErrorCode(error);\n    if (error instanceof AMKUnavailableError || code === 'AMK_UNAVAILABLE') {\n      return false;\n    }\n\n    return (\n      error instanceof TenantKeyMissingError ||\n      error instanceof EncryptionError ||\n      error instanceof DecryptionError ||\n      code === 'TENANT_KEY_MISSING' ||\n      code === 'ENCRYPTION_FAILED' ||\n      code === 'DECRYPTION_FAILED'\n    );\n  }\n\n  private getSecretErrorCode(error: Error): string | undefined {\n    const code = (error as { code?: unknown }).code;\n    return typeof code === 'string' ? code : undefined;\n  }\n\n  private toError(error: unknown): Error {\n    return error instanceof Error ? error : new Error(String(error));\n  }\n\n  private getCurrentUserId(): string {\n    const ctx = getCurrentTenant();\n    return ctx?.userId ?? 'system';\n  }\n\n  private async audit(\n    secretId: string | null,\n    secretName: string,\n    userId: string,\n    action: SecretAuditAction,\n    result: 'success' | 'failure' | 'denied',\n    details?: Record<string, unknown>,\n  ): Promise<void> {\n    if (!this.auditEnabled) return;\n\n    try {\n      const tenantId = getCurrentTenant()?.tenantId ?? null;\n      const log = await this.auditLogs.create(\n        createAuditEntry({\n          secretId,\n          secretName,\n          userId,\n          action,\n          result,\n          details,\n          tenantId,\n        }),\n      );\n      await log.save();\n    } catch (error) {\n      // Don't throw on audit failure - log and continue\n      logger.error('Failed to write audit log', { error });\n    }\n  }\n\n  private serializeMetadata(\n    metadata: Record<string, unknown>,\n  ): Record<string, string> {\n    const result: Record<string, string> = {};\n    for (const [key, value] of Object.entries(metadata)) {\n      result[key] = typeof value === 'string' ? value : JSON.stringify(value);\n    }\n    return result;\n  }\n}\n"],"x_google_ignoreList":[3],"mappings":";;;;;;;;;;;;;AA6CA,IAAa,2BAAb,cAA8C,eAA+B;CAC3E,OAAgB,aAAa;;;;CAK7B,MAAM,SACJ,UAAgC,CAAC,GACN;EAC3B,MAAM,QAAiC,CAAC;EAExC,IAAI,QAAQ,UACV,MAAM,WAAW,QAAQ;EAG3B,IAAI,QAAQ,YACV,MAAM,aAAa,QAAQ;EAG7B,IAAI,QAAQ,QACV,MAAM,SAAS,QAAQ;EAGzB,IAAI,QAAQ,QACV,MAAM,SAAS,QAAQ;EAGzB,IAAI,QAAQ,QACV,MAAM,SAAS,QAAQ;EAGzB,IAAI,QAAQ,OACV,MAAM,kBAAkB,QAAQ,MAAM,YAAY;EAGpD,IAAI,QAAQ,OACV,MAAM,kBAAkB,QAAQ,MAAM,YAAY;EAGpD,OAAO,KAAK,KAAK;GACf;GACA,OAAO,QAAQ,SAAS;GACxB,QAAQ,QAAQ;GAChB,SAAS;EACX,CAAC;CACH;;;;;;;;;CAUA,MAAM,iBACJ,UACA,YACA,QAAgB,IACW;EAC3B,OAAO,KAAK,SAAS;GAAE,UAAU,YAAY,KAAA;GAAW;GAAY;EAAM,CAAC;CAC7E;;;;;;;CAQA,MAAM,gBACJ,UACA,QACA,QAAgB,IACW;EAC3B,OAAO,KAAK,SAAS;GAAE,UAAU,YAAY,KAAA;GAAW;GAAQ;EAAM,CAAC;CACzE;;;;;;;CAQA,MAAM,kBACJ,UACA,QAAgB,IACW;EAC3B,OAAO,KAAK,SAAS;GACnB,UAAU,YAAY,KAAA;GACtB,QAAQ;GACR;EACF,CAAC;CACH;;;;;;;CAQA,MAAM,iBACJ,UACA,QAAgB,IACW;EAC3B,OAAO,KAAK,SAAS;GACnB,UAAU,YAAY,KAAA;GACtB,QAAQ;GACR;EACF,CAAC;CACH;;;;;;;CAQA,MAAM,cACJ,UACA,OAC4C;EAC5C,MAAM,OAAO,MAAM,KAAK,SAAS;GAC/B,UAAU,YAAY,KAAA;GACtB;GACA,OAAO;EACT,CAAC;EAED,MAAM,SAA4C;GAChD,QAAQ;GACR,MAAM;GACN,QAAQ;GACR,QAAQ;GACR,YAAY;GACZ,SAAS;GACT,QAAQ;GACR,QAAQ;EACV;EAEA,KAAK,MAAM,OAAO,MAChB,OAAO,IAAI,OAAO;EAGpB,OAAO;CACT;;;;;;;CAQA,MAAM,cACJ,UACA,OAC4C;EAC5C,MAAM,OAAO,MAAM,KAAK,SAAS;GAC/B,UAAU,YAAY,KAAA;GACtB;GACA,OAAO;EACT,CAAC;EAED,MAAM,SAA4C;GAChD,SAAS;GACT,SAAS;GACT,QAAQ;EACV;EAEA,KAAK,MAAM,OAAO,MAChB,OAAO,IAAI,OAAO;EAGpB,OAAO;CACT;;;;;CAMA,MAAM,QAAQ,gBAAwB,KAAsB;EAC1D,MAAM,6BAAa,IAAI,KAAK;EAC5B,WAAW,QAAQ,WAAW,QAAQ,IAAI,aAAa;EAEvD,MAAM,UAAU,MAAM,KAAK,KAAK,EAC9B,OAAO,EACL,gBAAgB,WAAW,YAAY,EACzC,EACF,CAAC;EAED,IAAI,QAAQ;EACZ,KAAK,MAAM,OAAO,SAAS;GACzB,MAAM,IAAI,OAAO;GACjB;EACF;EAEA,OAAO;CACT;AACF;;;;;;;;;;;;;;;;;AC/MA,IAAa,mBAAb,cAAsC,eAAuB;CAC3D,OAAgB,aAAa;;;;CAK7B,MAAM,WAAW,UAAkB,MAAsC;EACvE,OAAO,KAAK,IAAI;GAAE;GAAM;EAAS,CAAC;CACpC;;;;CAKA,MAAM,YACJ,UACA,UAA8B,CAAC,GACZ;EACnB,MAAM,QAAiC,EAAE,SAAS;EAElD,IAAI,QAAQ,UACV,MAAM,WAAW,QAAQ;EAG3B,IAAI,QAAQ,QACV,MAAM,SAAS,QAAQ;EAGzB,MAAM,UAAU,MAAM,KAAK,KAAK;GAC9B;GACA,OAAO,QAAQ;GACf,QAAQ,QAAQ;GAChB,SAAS;EACX,CAAC;EAGD,IAAI,CAAC,QAAQ,gBACX,OAAO,QAAQ,QAAQ,WAAW,CAAC,OAAO,UAAU,CAAC;EAGvD,OAAO;CACT;;;;CAKA,MAAM,WAAW,UAAqC;EACpD,OAAO,KAAK,YAAY,UAAU,EAAE,QAAQ,SAAS,CAAC;CACxD;;;;CAKA,MAAM,eAAe,UAAkB,UAAqC;EAC1E,OAAO,KAAK,YAAY,UAAU;GAAE;GAAU,QAAQ;EAAS,CAAC;CAClE;;;;CAKA,MAAM,aACJ,UACA,YAAoB,IACD;EACnB,MAAM,6BAAa,IAAI,KAAK;EAC5B,WAAW,QAAQ,WAAW,QAAQ,IAAI,SAAS;EAYnD,OAAO,MAVe,KAAK,KAAK;GAC9B,OAAO;IACL;IACA,QAAQ;IACR,gBAAgB;IAChB,eAAe,WAAW,YAAY;GACxC;GACA,SAAS;EACX,CAAC;CAGH;;;;CAKA,MAAM,cAAc,UAAqC;EACvD,MAAM,UAAU,MAAM,KAAK,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;EACvD,MAAM,aAAa,IAAI,IAAI,QAAQ,KAAK,MAAM,EAAE,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC;EACzE,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,KAAK;CACrC;;;;CAKA,MAAM,cAAc,UAAyD;EAC3E,MAAM,UAAU,MAAM,KAAK,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;EAEvD,MAAM,SAAuC;GAC3C,QAAQ;GACR,UAAU;GACV,SAAS;EACX;EAEA,KAAK,MAAM,UAAU,SACnB,IAAI,OAAO,UAAU,GACnB,OAAO;OAEP,OAAO,OAAO,OAAO;EAIzB,OAAO;CACT;;;;CAKA,MAAM,aAAa,UAAkB,MAAgC;EACnE,MAAM,SAAS,MAAM,KAAK,WAAW,UAAU,IAAI;EACnD,IAAI,CAAC,QAAQ,OAAO;EAEpB,MAAM,OAAO,OAAO;EACpB,OAAO;CACT;AACF;;;;;;;;;;AChJA,IAAa,sBAAb,cAAyC,eAA0B;CACjE,OAAgB,aAAa;;;;CAK7B,MAAM,aAAa,UAA6C;EAC9D,OAAO,KAAK,IAAI;GACd;GACA,QAAQ;EACV,CAAC;CACH;;;;CAKA,MAAM,gBAAgB,UAAwC;EAC5D,OAAO,KAAK,KAAK;GACf,OAAO,EAAE,SAAS;GAClB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,cACJ,UACA,SAC2B;EAC3B,OAAO,KAAK,IAAI;GACd;GACA;EACF,CAAC;CACH;;;;CAKA,MAAM,0BAAgD;EACpD,MAAM,sBAAM,IAAI,KAAK;EAErB,OAAO,KAAK,KAAK;GACf,OAAO;IACL,QAAQ;IACR,kBAAkB;IAClB,iBAAiB,IAAI,YAAY;GACnC;GACA,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,oBAA0C;EAC9C,OAAO,KAAK,KAAK;GACf,OAAO,EAAE,QAAQ,SAAS;GAC1B,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,gBAA0D;EAC9D,MAAM,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC;EAE/B,MAAM,SAA0C;GAC9C,QAAQ;GACR,UAAU;GACV,SAAS;GACT,aAAa;EACf;EAEA,KAAK,MAAM,OAAO,MAChB,OAAO,IAAI,OAAO;EAGpB,OAAO;CACT;;;;CAKA,MAAM,gBAAgB,UAAkB,OAAiC;EACvE,MAAM,MAAM,MAAM,KAAK,IAAI;GACzB,IAAI;GACJ;EACF,CAAC;EAED,IAAI,CAAC,KAAK,OAAO;EAEjB,IAAI,gBAAgB;EACpB,MAAM,IAAI,KAAK;EACf,OAAO;CACT;;;;;CAMA,MAAM,mBAAmB,gBAAwB,IAAqB;EACpE,MAAM,6BAAa,IAAI,KAAK;EAC5B,WAAW,QAAQ,WAAW,QAAQ,IAAI,aAAa;EAEvD,MAAM,UAAU,MAAM,KAAK,KAAK,EAC9B,OAAO;GACL,QAAQ;GACR,eAAe,WAAW,YAAY;EACxC,EACF,CAAC;EAED,IAAI,QAAQ;EACZ,KAAK,MAAM,OAAO,SAAS;GACzB,MAAM,IAAI,OAAO;GACjB;EACF;EAEA,OAAO;CACT;AACF;;;ACtEA,IAAM,gBAAN,MAAM,cAAc;CAClB,YAAY,QAAQ,QAAQ;EAC1B,KAAK,QAAQ;CACf;CACA,OAAO,SAAS;EACd;EACA;EACA;EACA;CACF;;;;;;;CAOA,UAAU,OAAO;EACf,MAAM,eAAe,cAAc,OAAO,QAAQ,KAAK,KAAK;EAE5D,OADqB,cAAc,OAAO,QAAQ,KAChC,KAAK;CACzB;;;;;;;CAOA,cAAc,SAAS;EACrB,IAAI,CAAC,WAAW,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,GAC9C,OAAO;EAET,OAAO,IAAI,KAAK,UAAU,OAAO;CACnC;CACA,MAAM,SAAS,SAAS;EACtB,IAAI,KAAK,UAAU,OAAO,GACxB,QAAQ,MAAM,WAAW,UAAU,KAAK,cAAc,OAAO,GAAG;CAEpE;CACA,KAAK,SAAS,SAAS;EACrB,IAAI,KAAK,UAAU,MAAM,GACvB,QAAQ,KAAK,UAAU,UAAU,KAAK,cAAc,OAAO,GAAG;CAElE;CACA,KAAK,SAAS,SAAS;EACrB,IAAI,KAAK,UAAU,MAAM,GACvB,QAAQ,KAAK,UAAU,UAAU,KAAK,cAAc,OAAO,GAAG;CAElE;CACA,MAAM,SAAS,SAAS;EACtB,IAAI,KAAK,UAAU,OAAO,GACxB,QAAQ,MAAM,WAAW,UAAU,KAAK,cAAc,OAAO,GAAG;CAEpE;AACF;AACA,IAAM,aAAN,MAAiB;CACf,MAAM,UAAU,UAAU,CAC1B;CACA,KAAK,UAAU,UAAU,CACzB;CACA,KAAK,UAAU,UAAU,CACzB;CACA,MAAM,UAAU,UAAU,CAC1B;AACF;AACA,SAAS,aAAa,QAAQ;CAC5B,IAAI,OAAO,WAAW,WAAW;EAC/B,IAAI,CAAC,QACH,OAAO,IAAI,WAAW;EASxB,OAAO,IAAI,cAPO,cAChB,CAAC,GACD;GACE,aAAa;GACb,QAAQ,EAAE,OAAO,SAAS;EAC5B,CAE+B,CAAC,CAAC,SAAS,MAAM;CACpD;CAMA,OAAO,IAAI,cALU,cAAc,QAAQ;EACzC,aAAa;EACb,QAAQ,EAAE,OAAO,SAAS;CAC5B,CACyB,CAAC,CAAC,SAAS,MACN;AAChC;;;AC7GA,IAAM,SAAS,aAAa,EAAE,OAAO,OAAO,CAAC;AAiI7C,IAAa,sBAAb,cAAyC,MAAM;CAC7C,OAAgB;CAChB;CACA;CACA;CAEA,YACE,SACA,UACA,QACA,OACA;EACA,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,WAAW;EAChB,KAAK,SAAS;EACd,KAAK,QAAQ;CACf;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6EA,IAAa,gBAAb,MAAa,cAAc;CACzB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YACE,IACA,aACA,SACA,YACA,WACA,cACA,WACA,UACA;EACA,KAAK,KAAK;EACV,KAAK,cAAc;EACnB,KAAK,UAAU;EACf,KAAK,aAAa;EAClB,KAAK,YAAY;EACjB,KAAK,eAAe;EACpB,KAAK,YAAY;EACjB,KAAK,WAAW;CAClB;;;;CAKA,aAAa,OAAO,SAAuD;EACzE,MAAM,EACJ,IACA,YAAY,0BACZ,WAAW,eACX,eAAe,SACb;EAGJ,MAAM,cAAc,MAAM,eAAe;GACvC,MAAM;GACN;GACA,KAAK;IACH,UAAU;IACV,WAAW;IACX,OAAO;GACT;EACF,CAAC;EAGD,MAAM,cAAc,EAAE,GAAG;EAKzB,OAAO,IAAI,cACT,IACA,aACA,MAPoB,iBAAiB,OAAO,WAAW,GAQvD,MAPuB,oBAAoB,OAAO,WAAW,GAQ7D,MAPsB,yBAAyB,OAAO,WAAW,GAQjE,cACA,WACA,QACF;CACF;;;;CAKA,MAAM,MACJ,MACA,OACA,UAA8B,CAAC,GACd;EACjB,MAAM,WAAW,gBAAgB;EACjC,MAAM,SAAS,KAAK,iBAAiB;EAGrC,IAAI,WAAW;EAEf,IAAI;GAIF,IAAI,WAAW,MAAM,KAAK,QAAQ,WAAW,UAAU,IAAI;GAI3D,IAAI,YAAY,SAAS,aAAa,UACpC,WAAW;GAEb,WAAW,aAAa;GAGxB,MAAM,WAAW,MAAM,KAAK,YAAY,QAAQ,UAAU,MAAM,OAAO,EACrE,UAAU,QAAQ,WACd,KAAK,kBAAkB,QAAQ,QAAQ,IACvC,KAAA,EACN,CAAC;GAED,IAAI,UAAU;IAEZ,SAAS,iBAAiB,KAAK,UAAU,QAAQ;IACjD,SAAS,cAAc,QAAQ,eAAe,SAAS;IACvD,SAAS,WAAW,QAAQ,YAAY,SAAS;IACjD,SAAS,YAAY,QAAQ,aAAa,SAAS;IACnD,SAAS,WAAW,QAAQ,YAAY,SAAS;IACjD,MAAM,SAAS,KAAK;IAEpB,MAAM,KAAK,MACT,SAAS,MAAM,MACf,MACA,QACA,UACA,SACF;IACA,OAAO;GACT;GAMA,MAAM,SAAS,MAAM,KAAK,QAAQ,OAAO;IACvC;IACA,aAAa,QAAQ,eAAe;IACpC,UAAU,QAAQ,YAAY;IAC9B,gBAAgB,KAAK,UAAU,QAAQ;IACvC,YAAY;IACZ,QAAQ;IACR,WAAW,QAAQ,aAAa;IAChC,UAAU,QAAQ,YAAY,CAAC;IAC/B,SAAS;IACT;GACF,CAAC;GAED,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,MAAM,QAAQ,UAAU,SAAS;GACrE,OAAO;EACT,SAAS,OAAO;GACd,MAAM,kBAAkB,MAAM,KAAK,yBACjC,UACA,MACA,KACF;GACA,MAAM,KAAK,MACT,MACA,MACA,QACA,WAAW,WAAW,UACtB,WACA,EACE,OAAO,gBAAgB,QACzB,CACF;GACA,MAAM;EACR;CACF;;;;;;;CAQA,MAAM,eACJ,UACA,MACA,OACA,UAA8B,CAAC,GACd;EACjB,OAAO,WAAW,EAAE,SAAS,SAAS,KAAK,MAAM,MAAM,OAAO,OAAO,CAAC;CACxE;;;;CAKA,MAAM,SAAS,MAAwC;EACrD,MAAM,WAAW,gBAAgB;EACjC,MAAM,SAAS,KAAK,iBAAiB;EAGrC,IAAI,UAAU;EAEd,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,UAAU,IAAI;GAI3D,IAAI,CAAC,UAAU,OAAO,aAAa,UAAU;IAC3C,MAAM,KAAK,MAAM,MAAM,MAAM,QAAQ,QAAQ,WAAW,EACtD,OAAO,mBACT,CAAC;IACD,UAAU;IACV,MAAM,IAAI,MAAM,WAAW,KAAK,YAAY;GAC9C;GAEA,IAAI,CAAC,OAAO,SAAS,GAAG;IACtB,MAAM,SAAS,OAAO,UAAU,IAC5B,mBACA;IACJ,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,MAAM,QAAQ,QAAQ,WAAW,EACnE,OAAO,OACT,CAAC;IACD,UAAU;IACV,MAAM,IAAI,MAAM,MAAM;GACxB;GAGA,MAAM,WAA8B,KAAK,MAAM,OAAO,cAAc;GACpE,MAAM,YAAY,MAAM,KAAK,YAAY,QAAQ,UAAU,QAAQ;GAInE,MAAM,yBAAyB,OAAO;GACtC,MAAM,sBAAsB,OAAO;GACnC,IAAI;IACF,OAAO,aAAa;IACpB,MAAM,OAAO,KAAK;GACpB,SAAS,eAAe;IACtB,OAAO,iBAAiB;IACxB,OAAO,cAAc;IACrB,OAAO,MAAM,2CAA2C,EACtD,OAAO,cACT,CAAC;GACH;GAEA,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,MAAM,QAAQ,QAAQ,SAAS;GAEnE,OAAO;IACL,OAAO,UAAU;IACjB,MAAM,OAAO;IACb,aAAa,OAAO;IACpB,UAAU,OAAO;IACjB,WAAW,OAAO;IAClB,WAAW,OAAO,8BAAc,IAAI,KAAK;IACzC,gBAAgB,OAAO;IACvB,aAAa,OAAO;IACpB,UAAU,OAAO;GACnB;EACF,SAAS,OAAO;GACd,MAAM,kBAAkB,MAAM,KAAK,yBACjC,UACA,MACA,KACF;GAEA,IAAI,CAAC,SACH,MAAM,KAAK,MAAM,MAAM,MAAM,QAAQ,QAAQ,WAAW,EACtD,OAAO,gBAAgB,QACzB,CAAC;GAEH,MAAM;EACR;CACF;;;;CAKA,MAAM,kBACJ,UACA,MAC0B;EAC1B,OAAO,WAAW,EAAE,SAAS,SAAS,KAAK,SAAS,IAAI,CAAC;CAC3D;;;;CAKA,MAAM,6BACJ,UACA,UAA+C,CAAC,GACjB;EAC/B,MAAM,gBAAgB,MAAM,KAAK,iCAC/B,UACA,QAAQ,WACV;EACA,MAAM,uBACJ,MAAM,KAAK,4BAA4B,QAAQ;EACjD,MAAM,oBACJ,MAAM,KAAK,+BAA+B,QAAQ;EACpD,MAAM,iBAAiB,kBAAkB;EACzC,MAAM,SAAgC,CAAC;EAEvC,MAAM,6BAA6B,qBAAqB,QACrD,QAAQ,IAAI,WAAW,QAC1B;EACA,MAAM,uBAAuB,eAAe,QACzC,QAAQ,IAAI,WAAW,QAC1B;EACA,MAAM,MAAM,KAAK,6BAA6B;EAE9C,IAAI,CAAC,IAAI,QACP,OAAO,KAAK;GACV,MAAM;GACN,UAAU;GACV,SAAS,IAAI,SAAS,OAAO,KAAK,UAAU;GAC5C,cAAc;GACd,SAAS;IACP,WAAW,KAAK;IAChB,UAAU,KAAK;GACjB;EACF,CAAC;EAGH,IAAI,cAAc,SAAS,KAAK,2BAA2B,WAAW,GACpE,OAAO,KAAK;GACV,MAAM;GACN,UAAU;GACV,SACE;GACF,cAAc;GACd,aAAa;GACb,SAAS,EACP,mBAAmB,cAAc,OACnC;EACF,CAAC;EAGH,IAAI,kBAAkB,OACpB,OAAO,KAAK;GACV,MAAM;GACN,UAAU;GACV,SACE;GACF,cAAc;GACd,aAAa;GACb,SAAS,EACP,OAAO,kBAAkB,MAAM,QACjC;EACF,CAAC;EAGH,IAAI,2BAA2B,SAAS,GACtC,OAAO,KAAK;GACV,MAAM;GACN,UAAU;GACV,SACE;GACF,cAAc;GACd,aAAa;GACb,SAAS,EACP,gCAAgC,2BAA2B,OAC7D;EACF,CAAC;EAGH,MAAM,kBAAqC,CAAC;EAE5C,KAAK,MAAM,OAAO,sBAAsB;GACtC,MAAM,QAAQ,IAAI,QACd,KAAK,gBAAgB,IAAI,aAAa,IAAI,KAAK,IAC/C;IAAE,QAAQ;IAAO,OAAO,IAAI;GAAM;GAEtC,IAAI,IAAI,WAAW,UACjB,gBAAgB,KAAK,KAAK;GAG5B,IAAI,IAAI,WAAW,YAAY,IAAI,eAAe,KAAK,UACrD,OAAO,KAAK;IACV,MAAM;IACN,UAAU;IACV,SACE;IACF,cAAc;IACd,OAAO,IAAI;IACX,aAAa;IACb,SAAS;KACP,aAAa,IAAI;KACjB,oBAAoB,KAAK;IAC3B;GACF,CAAC;GAGH,IAAI,IAAI,WAAW,YAAY,CAAC,MAAM,UAAU,IAAI,OAClD,OAAO,KAAK;IACV,MAAM;IACN,UAAU;IACV,SACE;IACF,cAAc;IACd,OAAO,IAAI;IACX,aAAa;IACb,SAAS;KACP,SAAS,IAAI;KACb,OAAO,MAAM,SAAS;IACxB;GACF,CAAC;EAEL;EAEA,MAAM,uCAAuC,gBAAgB,QAC1D,UAAU,MAAM,MACnB,CAAC,CAAC;EAEF,IACE,cAAc,SAAS,KACvB,yCAAyC,GAEzC,OAAO,KAAK;GACV,MAAM;GACN,UAAU;GACV,SACE;GACF,cAAc;GACd,aAAa;GACb,SAAS;IACP,mBAAmB,cAAc;IACjC,gCAAgC,2BAA2B;GAC7D;EACF,CAAC;EAGH,MAAM,sCAAsB,IAAI,IAAoC;EACpE,KAAK,MAAM,OAAO,sBAAsB;GACtC,MAAM,cAAc,KAAK,yBAAyB,IAAI,WAAW;GACjE,IAAI,aACF,oBAAoB,IAAI,aAAa,GAAG;EAE5C;EAEA,KAAK,MAAM,UAAU,eAAe;GAClC,MAAM,WAAW,KAAK,gCAAgC,QAAQ,MAAM;GACpE,IAAI,CAAC,UAAU;GAEf,MAAM,sBAAsB,KAAK,yBAC/B,SAAS,UACX;GACA,MAAM,gBAAgB,IAAI,QACtB,KAAK,gBAAgB,SAAS,YAAY,IAAI,KAAK,IACnD;IACE,QAAQ;IACR,OAAO,IAAI;IACX,aAAa;GACf;GAEJ,IAAI,CAAC,cAAc,aAAa;IAC9B,OAAO,KAAK;KACV,MAAM;KACN,UAAU;KACV,SACE;KACF,cAAc;KACd,UAAU,OAAO;KACjB,YAAY,OAAO;KACnB,aAAa;KACb,SAAS,EACP,OAAO,cAAc,SAAS,KAChC;IACF,CAAC;IACD;GACF;GAEA,MAAM,cAAc,oBAAoB,IAAI,cAAc,WAAW;GACrE,IAAI,CAAC,aACH,OAAO,KAAK;IACV,MAAM;IACN,UAAU;IACV,SACE;IACF,cAAc,CAAC,IAAI,QACf,SACA,cAAc,SACZ,SACA;IACN,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,aAAa;GACf,CAAC;GAGH,IAAI,CAAC,cAAc,UAAU,IAAI,OAC/B,OAAO,KAAK;IACV,MAAM;IACN,UAAU;IACV,SACE;IACF,cAAc;IACd,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,OAAO,aAAa;IACpB,aAAa;IACb,SAAS,EACP,OAAO,cAAc,SAAS,KAChC;GACF,CAAC;EAEL;EAEA,IACE,cAAc,SAAS,KACvB,qBAAqB,SAAS,KAC9B,eAAe,WAAW,KAC1B,CAAC,kBAAkB,OAEnB,OAAO,KAAK;GACV,MAAM;GACN,UAAU;GACV,SACE;GACF,cAAc;GACd,aAAa;EACf,CAAC;EAGH,OAAO;GACL;GACA,2BAAW,IAAI,KAAK;GACpB,IAAI,CAAC,OAAO,MAAM,UAAU,MAAM,aAAa,OAAO;GACtD,SAAS;IACP,mBAAmB,cAAc;IACjC,0BAA0B,qBAAqB;IAC/C,gCAAgC,2BAA2B;IAC3D;IACA,oBAAoB,eAAe;IACnC,0BAA0B,qBAAqB;GACjD;GACA;EACF;CACF;;;;CAKA,MAAM,oCACJ,UAA+C,CAAC,GACjB;EAC/B,OAAO,KAAK,6BAA6B,gBAAgB,GAAG,OAAO;CACrE;;;;;;;CAQA,MAAM,2BACJ,UACA,UAA6C,CAAC,GACT;EACrC,MAAM,SAAS,QAAQ,UAAU;EACjC,MAAM,SAAS,MAAM,KAAK,6BAA6B,UAAU,OAAO;EACxE,MAAM,4BAAY,IAAI,IAAY;EAClC,MAAM,8BAAc,IAAI,IAAoB;EAC5C,MAAM,yCAAyB,IAAI,IAAY;EAE/C,KAAK,MAAM,SAAS,OAAO,QAAQ;GACjC,IACE,MAAM,iBAAiB,iCACvB,MAAM,UACN;IACA,UAAU,IAAI,MAAM,QAAQ;IAC5B,IAAI,MAAM,YACR,YAAY,IAAI,MAAM,UAAU,MAAM,UAAU;GAEpD;GAEA,IACE,MAAM,iBAAiB,2CACvB,MAAM,OAEN,uBAAuB,IAAI,MAAM,KAAK;EAE1C;EAEA,MAAM,qBAAqB,UAAU;EACrC,MAAM,kCAAkC,uBAAuB;EAC/D,MAAM,+BACJ,qBAAqB,kCAAkC;EAEzD,IACE,CAAC,UACD,gCACA,CAAC,QAAQ,gCAET,MAAM,IAAI,MACR,gIACF;EAGF,IAAI,iBAAiB;EACrB,IAAI,8BAA8B;EAElC,IAAI,CAAC,QAAQ;GACX,MAAM,aAAa,OAAO,OAA0B;IAalD,OAAO;KACL,gBAAgB,MAbc,KAAK,gBACnC,WACA,UACA,WACA,EACF;KASE,6BAA6B,MARc,KAAK,gBAChD,0BACA,UACA,wBACA,EACF;IAIA;GACF;GACA,MAAM,OAAO,KAAK;GAClB,MAAM,eACJ,OAAO,KAAK,gBAAgB,aACxB,MAAM,KAAK,aAAa,OAAO,WAAW,EAAE,CAAC,IAC7C,MAAM,WAAW,KAAK,EAAE;GAE9B,iBAAiB,aAAa;GAC9B,8BAA8B,aAAa;GAC3C,MAAM,KAAK,8BACT,UACA,WACA,WACF;EACF;EAEA,MAAM,QAAQ,SACV,SACA,MAAM,KAAK,6BAA6B,UAAU,OAAO;EAE7D,OAAO;GACL;GACA;GACA,cAAc,OAAO;GACrB,iBAAiB,MAAM;GACvB;GACA;GACA;GACA;GACA,aAAa,MAAM,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK;GACnD,wBAAwB,MAAM,KAAK,sBAAsB,CAAC,CAAC,KAAK;EAClE;CACF;;;;CAKA,MAAM,KAAK,UAAiC,CAAC,GAAsB;EACjE,OAAO,KAAK,QAAQ,YAAY,gBAAgB,GAAG;GACjD,UAAU,QAAQ;GAClB,QAAQ;EACV,CAAC;CACH;;;;CAKA,MAAM,OAAO,MAAgC;EAC3C,MAAM,WAAW,gBAAgB;EACjC,MAAM,SAAS,KAAK,iBAAiB;EAErC,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,UAAU,IAAI;EAE3D,IAAI,CAAC,UAAU,OAAO,aAAa,UACjC,OAAO;EAGT,IAAI;GACF,MAAM,OAAO,OAAO;GACpB,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,MAAM,QAAQ,UAAU,SAAS;GACrE,OAAO;EACT,SAAS,OAAO;GACd,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,MAAM,QAAQ,UAAU,WAAW,EACrE,OAAQ,MAAgB,QAC1B,CAAC;GACD,MAAM;EACR;CACF;;;;CAKA,MAAM,QAAQ,MAAgC;EAC5C,MAAM,WAAW,gBAAgB;EACjC,MAAM,SAAS,KAAK,iBAAiB;EAErC,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,UAAU,IAAI;EAE3D,IAAI,CAAC,UAAU,OAAO,aAAa,UACjC,OAAO;EAGT,OAAO,QAAQ;EACf,MAAM,OAAO,KAAK;EAClB,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,MAAM,QAAQ,WAAW,SAAS;EACtE,OAAO;CACT;;;;CAKA,MAAM,OAAO,MAAgC;EAC3C,MAAM,WAAW,gBAAgB;EACjC,MAAM,SAAS,KAAK,iBAAiB;EAErC,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,UAAU,IAAI;EAE3D,IAAI,CAAC,UAAU,OAAO,aAAa,UACjC,OAAO;EAGT,OAAO,OAAO;EACd,MAAM,OAAO,KAAK;EAClB,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,MAAM,QAAQ,UAAU,SAAS;EACrE,OAAO;CACT;;;;;;;;;;CAWA,MAAM,YAA2B;EAC/B,MAAM,WAAW,gBAAgB;EACjC,MAAM,SAAS,KAAK,iBAAiB;EAErC,IAAI;GACF,MAAM,KAAK,YAAY,gBAAgB,QAAQ;GAC/C,MAAM,KAAK,MAAM,MAAM,IAAI,QAAQ,cAAc,WAAW,EAC1D,SACF,CAAC;EACH,SAAS,OAAO;GACd,MAAM,KAAK,MAAM,MAAM,IAAI,QAAQ,cAAc,WAAW;IAC1D;IACA,OAAQ,MAAgB;GAC1B,CAAC;GACD,MAAM;EACR;CACF;;;;;;;CAQA,MAAM,eAA6D;EACjE,MAAM,WAAW,gBAAgB;EACjC,MAAM,SAAS,KAAK,iBAAiB;EAIrC,MAAM,UAAU,MAAM,KAAK,QAAQ,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;EAC/D,IAAI,UAAU;EACd,IAAI,SAAS;EAEb,KAAK,MAAM,UAAU,SACnB,IAAI;GAEF,MAAM,WAA8B,KAAK,MAAM,OAAO,cAAc;GACpE,MAAM,YAAY,MAAM,KAAK,YAAY,QAAQ,UAAU,QAAQ;GAGnE,MAAM,cAAc,MAAM,KAAK,YAAY,QACzC,UACA,OAAO,MACP,UAAU,KACZ;GAEA,OAAO,iBAAiB,KAAK,UAAU,WAAW;GAClD,MAAM,OAAO,KAAK;GAElB;EACF,SAAS,OAAO;GACd;GACA,MAAM,KAAK,MACT,OAAO,MAAM,MACb,OAAO,MACP,QACA,UACA,WACA;IACE,QAAQ;IACR,OAAQ,MAAgB;GAC1B,CACF;EACF;EAGF,OAAO;GAAE;GAAS;EAAO;CAC3B;;;;CAKA,MAAM,aACJ,UAAmD,CAAC,GACzB;EAC3B,OAAO,KAAK,UAAU,SAAS;GAG7B,UAAU,gBAAgB;GAC1B,YAAY,QAAQ;GACpB,OAAO,QAAQ,SAAS;EAC1B,CAAC;CACH;;;;CAKA,MAAM,gBAAmC;EACvC,OAAO,KAAK,QAAQ,cAAc,gBAAgB,CAAC;CACrD;;;;CAKA,MAAM,OAAO,MAAgC;EAC3C,MAAM,WAAW,gBAAgB;EACjC,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,UAAU,IAAI;EAC3D,OAAO,WAAW,QAAQ,OAAO,aAAa;CAChD;CAIA,MAAc,iCACZ,UACA,aAC+B;EAC/B,MAAM,SAAoB,CAAC,QAAQ;EACnC,IAAI,aAAa;EAEjB,IAAI,eAAe,YAAY,SAAS,GAAG;GAEzC,aAAa,iBADQ,YAAY,UAAU,GAAG,CAAC,CAAC,KAAK,IACvB,EAAa;GAC3C,OAAO,KAAK,GAAG,WAAW;EAC5B;EAEA,MAAM,SAAS,MAAM,KAAK,GAAG,MAC3B;;;mDAG6C,WAAW;;SAGxD,GAAG,MACL;EAEA,OAAO,KAAK,eAAmC,MAAM;CACvD;CAEA,MAAc,4BACZ,UACmC;EACnC,MAAM,SAAS,MAAM,KAAK,GAAG,MAC3B;;;;;;SAOA,QACF;EAEA,OAAO,KAAK,eAAuC,MAAM;CAC3D;CAEA,MAAc,+BACZ,UACqC;EACrC,IAAI;GACF,OAAO,EAAE,MAAM,MAAM,KAAK,WAAW,gBAAgB,QAAQ,EAAE;EACjE,SAAS,OAAO;GACd,OAAO;IAAE,MAAM,CAAC;IAAG,OAAO,KAAK,QAAQ,KAAK;GAAE;EAChD;CACF;CAEA,+BAEwD;EACtD,MAAM,SAAS,QAAQ,IAAI,KAAK;EAChC,IAAI,CAAC,QACH,OAAO;GACL,QAAQ;GACR,OAAO,6DAA6D,KAAK;EAC3E;EAGF,IAAI;GACF,OAAO;IACL,QAAQ;IACR,OAAO,mBAAmB,YAAY,MAAM;GAC9C;EACF,SAAS,OAAO;GACd,OAAO;IACL,QAAQ;IACR,OAAO,kBAAkB,KAAK,UAAU,IACtC,KAAK,QAAQ,KAAK,CAAC,CAAC;GAExB;EACF;CACF;CAEA,gBAAwB,YAAoB,KAA8B;EACxE,MAAM,cAAc,KAAK,yBAAyB,UAAU;EAE5D,IAAI;GACF,MAAM,SAAS,mBAAmB,gBAAgB,UAAU;GAO5D,mBANmC,UACjC,OAAO,YACP,OAAO,IACP,OAAO,SACP,GAEF,CAAA,CAAQ,KAAK,CAAC;GACd,OAAO;IAAE,QAAQ;IAAM;GAAY;EACrC,SAAS,OAAO;GACd,OAAO;IACL,QAAQ;IACR;IACA,OAAO,KAAK,QAAQ,KAAK,CAAC,CAAC;GAC7B;EACF;CACF;CAEA,yBAAiC,YAAwC;EACvE,IAAI;GACF,OAAO,mBAAmB,gBAAgB,UAAU,CAAC,CAAC;EACxD,QAAQ;GACN;EACF;CACF;CAEA,gCACE,QACA,QAC0B;EAC1B,IAAI;GACF,OAAO,KAAK,MAAM,OAAO,eAAe;EAC1C,SAAS,OAAO;GACd,OAAO,KAAK;IACV,MAAM;IACN,UAAU;IACV,SAAS;IACT,cAAc;IACd,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,aAAa;IACb,SAAS,EACP,OAAO,KAAK,QAAQ,KAAK,CAAC,CAAC,QAC7B;GACF,CAAC;GACD,OAAO;EACT;CACF;CAEA,MAAc,gBACZ,WACA,UACA,KACA,KAAwB,KAAK,IACZ;EACjB,IAAI,IAAI,SAAS,GAAG,OAAO;EAE3B,MAAM,SAAS,MAAM,KAAK,GAAG;EAC7B,MAAM,eAAe,OAAO,UAAU,GAAG,CAAC,CAAC,KAAK,IAAI;EACpD,MAAM,SAAS,MAAM,GAAG,MACtB,gBAAgB,UAAU,mCAAmC,aAAa,IAC1E,UACA,GAAG,MACL;EAEA,OAAO,OAAO,OAAO,aAAa,WAC9B,OAAO,WACP,OAAO;CACb;CAEA,MAAc,8BACZ,UACA,WACA,aACe;EACf,IAAI,UAAU,SAAS,GAAG;EAE1B,MAAM,SAAS,KAAK,iBAAiB;EACrC,MAAM,WAAW,EAAE,SAAS,GAAG,YAAY;GACzC,KAAK,MAAM,YAAY,WACrB,MAAM,KAAK,MACT,UACA,YAAY,IAAI,QAAQ,KAAK,IAC7B,QACA,UACA,WACA;IACE,QAAQ;IACR,QAAQ;GACV,CACF;EAEJ,CAAC;CACH;CAEA,eAA0B,QAAsB;EAC9C,IAAI,MAAM,QAAQ,MAAM,GAAG,OAAO;EAClC,IACE,UACA,OAAO,WAAW,YAClB,MAAM,QAAS,OAA8B,IAAI,GAEjD,OAAQ,OAAyB;EAEnC,OAAO,CAAC;CACV;CAEA,MAAc,yBACZ,UACA,YACA,OACgB;EAChB,MAAM,aAAa,KAAK,QAAQ,KAAK;EACrC,IAAI,CAAC,KAAK,+BAA+B,UAAU,GACjD,OAAO;EAGT,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,6BAA6B,UAAU,EAC/D,aAAa,CAAC,UAAU,EAC1B,CAAC;GACD,MAAM,aAAa,OAAO,OACvB,QAAQ,UAAU,MAAM,aAAa,OAAO,CAAC,CAC7C,KAAK,UAAU,MAAM,IAAI;GAE5B,IAAI,WAAW,WAAW,GACxB,OAAO;GAGT,OAAO,IAAI,oBACT,WAAW,WAAW,gBAAgB,SAAS,kDAAkD,CAC/F,GAAG,IAAI,IAAI,UAAU,CACvB,CAAC,CAAC,KACA,IACF,EAAE,gIACF,UACA,QACA,UACF;EACF,QAAQ;GACN,OAAO;EACT;CACF;CAEA,+BAAuC,OAAuB;EAC5D,MAAM,OAAO,KAAK,mBAAmB,KAAK;EAC1C,IAAI,iBAAiB,uBAAuB,SAAS,mBACnD,OAAO;EAGT,OACE,iBAAiB,yBACjB,iBAAiB,mBACjB,iBAAiB,mBACjB,SAAS,wBACT,SAAS,uBACT,SAAS;CAEb;CAEA,mBAA2B,OAAkC;EAC3D,MAAM,OAAQ,MAA6B;EAC3C,OAAO,OAAO,SAAS,WAAW,OAAO,KAAA;CAC3C;CAEA,QAAgB,OAAuB;EACrC,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;CACjE;CAEA,mBAAmC;EAEjC,OADY,iBACL,CAAA,EAAK,UAAU;CACxB;CAEA,MAAc,MACZ,UACA,YACA,QACA,QACA,QACA,SACe;EACf,IAAI,CAAC,KAAK,cAAc;EAExB,IAAI;GACF,MAAM,WAAW,iBAAiB,CAAC,EAAE,YAAY;GAYjD,OAAM,MAXY,KAAK,UAAU,OAC/B,iBAAiB;IACf;IACA;IACA;IACA;IACA;IACA;IACA;GACF,CAAC,CACH,EAAA,CACU,KAAK;EACjB,SAAS,OAAO;GAEd,OAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC;EACrD;CACF;CAEA,kBACE,UACwB;EACxB,MAAM,SAAiC,CAAC;EACxC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,GAChD,OAAO,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;EAExE,OAAO;CACT;AACF"}
+{"version":3,"file":"SecretService-Bbef8TvJ.js","names":[],"sources":["../../src/collections/SecretAuditLogCollection.ts","../../src/collections/SecretCollection.ts","../../src/collections/TenantKeyCollection.ts","../../../../node_modules/.pnpm/@happyvertical+logger@0.74.11_@sentry+node@10.62.0_@opentelemetry+core@2.7.0_@opentelemetry+api@1.9.1__/node_modules/@happyvertical/logger/dist/index.js","../../src/services/SecretService.ts"],"sourcesContent":["/**\n * SecretAuditLogCollection - Collection manager for SecretAuditLog objects\n * @packageDocumentation\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport {\n  type SecretAuditAction,\n  SecretAuditLog,\n  type SecretAuditResult,\n} from '../models/SecretAuditLog.js';\n\n/**\n * Options for listing audit logs\n */\nexport interface ListAuditLogsOptions {\n  /**\n   * Scope results to a single tenant's audit trail. Tenant-facing callers\n   * (e.g. SecretService.getAuditLogs) must always set this — audit rows\n   * reference secret names and must not leak across tenants (issue #1501).\n   * Omit only for cross-tenant compliance tooling running under\n   * withSuperAdminBypass().\n   */\n  tenantId?: string;\n  /** Filter by secret name */\n  secretName?: string;\n  /** Filter by user ID */\n  userId?: string;\n  /** Filter by action type */\n  action?: SecretAuditAction;\n  /** Filter by result */\n  result?: SecretAuditResult;\n  /** Filter by date range start */\n  since?: Date;\n  /** Filter by date range end */\n  until?: Date;\n  /** Maximum number of results */\n  limit?: number;\n  /** Offset for pagination */\n  offset?: number;\n}\n\n/**\n * Collection for managing SecretAuditLog objects\n */\nexport class SecretAuditLogCollection extends SmrtCollection<SecretAuditLog> {\n  static readonly _itemClass = SecretAuditLog;\n\n  /**\n   * List audit logs with filtering options\n   */\n  async listLogs(\n    options: ListAuditLogsOptions = {},\n  ): Promise<SecretAuditLog[]> {\n    const where: Record<string, unknown> = {};\n\n    if (options.tenantId) {\n      where.tenantId = options.tenantId;\n    }\n\n    if (options.secretName) {\n      where.secretName = options.secretName;\n    }\n\n    if (options.userId) {\n      where.userId = options.userId;\n    }\n\n    if (options.action) {\n      where.action = options.action;\n    }\n\n    if (options.result) {\n      where.result = options.result;\n    }\n\n    if (options.since) {\n      where['created_at >'] = options.since.toISOString();\n    }\n\n    if (options.until) {\n      where['created_at <'] = options.until.toISOString();\n    }\n\n    return this.list({\n      where,\n      limit: options.limit ?? 100,\n      offset: options.offset,\n      orderBy: 'created_at DESC',\n    });\n  }\n\n  /**\n   * Get audit logs for a specific secret.\n   *\n   * @param tenantId - Scope to this tenant's audit trail, or `null` for a\n   *   cross-tenant compliance query (which must run under\n   *   `withSuperAdminBypass()` from `@happyvertical/smrt-tenancy`). Audit rows\n   *   reference secret names and must not leak across tenants (#1503).\n   */\n  async getSecretHistory(\n    tenantId: string | null,\n    secretName: string,\n    limit: number = 50,\n  ): Promise<SecretAuditLog[]> {\n    return this.listLogs({ tenantId: tenantId ?? undefined, secretName, limit });\n  }\n\n  /**\n   * Get audit logs for a specific user.\n   *\n   * @param tenantId - Scope to this tenant's audit trail, or `null` for a\n   *   cross-tenant compliance query under `withSuperAdminBypass()` (#1503).\n   */\n  async getUserActivity(\n    tenantId: string | null,\n    userId: string,\n    limit: number = 50,\n  ): Promise<SecretAuditLog[]> {\n    return this.listLogs({ tenantId: tenantId ?? undefined, userId, limit });\n  }\n\n  /**\n   * Get recent failures.\n   *\n   * @param tenantId - Scope to this tenant's audit trail, or `null` for a\n   *   cross-tenant compliance query under `withSuperAdminBypass()` (#1503).\n   */\n  async getRecentFailures(\n    tenantId: string | null,\n    limit: number = 20,\n  ): Promise<SecretAuditLog[]> {\n    return this.listLogs({\n      tenantId: tenantId ?? undefined,\n      result: 'failure',\n      limit,\n    });\n  }\n\n  /**\n   * Get recent denied access attempts.\n   *\n   * @param tenantId - Scope to this tenant's audit trail, or `null` for a\n   *   cross-tenant compliance query under `withSuperAdminBypass()` (#1503).\n   */\n  async getRecentDenials(\n    tenantId: string | null,\n    limit: number = 20,\n  ): Promise<SecretAuditLog[]> {\n    return this.listLogs({\n      tenantId: tenantId ?? undefined,\n      result: 'denied',\n      limit,\n    });\n  }\n\n  /**\n   * Count operations by action type.\n   *\n   * @param tenantId - Scope to this tenant's audit trail, or `null` for a\n   *   cross-tenant compliance count under `withSuperAdminBypass()` (#1503).\n   */\n  async countByAction(\n    tenantId: string | null,\n    since?: Date,\n  ): Promise<Record<SecretAuditAction, number>> {\n    const logs = await this.listLogs({\n      tenantId: tenantId ?? undefined,\n      since,\n      limit: 10000,\n    });\n\n    const counts: Record<SecretAuditAction, number> = {\n      create: 0,\n      read: 0,\n      update: 0,\n      delete: 0,\n      rotate_key: 0,\n      disable: 0,\n      enable: 0,\n      expire: 0,\n    };\n\n    for (const log of logs) {\n      counts[log.action]++;\n    }\n\n    return counts;\n  }\n\n  /**\n   * Count operations by result.\n   *\n   * @param tenantId - Scope to this tenant's audit trail, or `null` for a\n   *   cross-tenant compliance count under `withSuperAdminBypass()` (#1503).\n   */\n  async countByResult(\n    tenantId: string | null,\n    since?: Date,\n  ): Promise<Record<SecretAuditResult, number>> {\n    const logs = await this.listLogs({\n      tenantId: tenantId ?? undefined,\n      since,\n      limit: 10000,\n    });\n\n    const counts: Record<SecretAuditResult, number> = {\n      success: 0,\n      failure: 0,\n      denied: 0,\n    };\n\n    for (const log of logs) {\n      counts[log.result]++;\n    }\n\n    return counts;\n  }\n\n  /**\n   * Delete old audit logs\n   * @param olderThanDays Delete logs older than this many days\n   */\n  async cleanup(olderThanDays: number = 365): Promise<number> {\n    const cutoffDate = new Date();\n    cutoffDate.setDate(cutoffDate.getDate() - olderThanDays);\n\n    const oldLogs = await this.list({\n      where: {\n        'created_at <': cutoffDate.toISOString(),\n      },\n    });\n\n    let count = 0;\n    for (const log of oldLogs) {\n      await log.delete();\n      count++;\n    }\n\n    return count;\n  }\n}\n","/**\n * SecretCollection - Collection manager for Secret objects\n * @packageDocumentation\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { Secret, type SecretStatus } from '../models/Secret.js';\n\n/**\n * Options for listing secrets\n */\nexport interface ListSecretsOptions {\n  /** Filter by category */\n  category?: string;\n  /** Filter by status */\n  status?: SecretStatus;\n  /** Include expired secrets */\n  includeExpired?: boolean;\n  /** Maximum number of results */\n  limit?: number;\n  /** Offset for pagination */\n  offset?: number;\n}\n\n/**\n * Collection for managing Secret objects\n *\n * All lookups take an explicit `tenantId` and scope on the authoritative\n * `tenant_id` column. Scoping must NOT rely on the tenancy interceptor\n * (which may be disabled in the host application) and must NOT use the\n * `context` column: `context = tenantId` is only a convention applied on\n * the create path, so pre-convention rows may have a divergent `context`.\n * See https://github.com/happyvertical/smrt/issues/1501\n */\nexport class SecretCollection extends SmrtCollection<Secret> {\n  static readonly _itemClass = Secret;\n\n  /**\n   * Find a secret by name within the given tenant\n   */\n  async findByName(tenantId: string, name: string): Promise<Secret | null> {\n    return this.get({ name, tenantId });\n  }\n\n  /**\n   * List secrets for a tenant with filtering options\n   */\n  async listSecrets(\n    tenantId: string,\n    options: ListSecretsOptions = {},\n  ): Promise<Secret[]> {\n    const where: Record<string, unknown> = { tenantId };\n\n    if (options.category) {\n      where.category = options.category;\n    }\n\n    if (options.status) {\n      where.status = options.status;\n    }\n\n    const secrets = await this.list({\n      where,\n      limit: options.limit,\n      offset: options.offset,\n      orderBy: 'name ASC',\n    });\n\n    // Filter out expired secrets unless explicitly included\n    if (!options.includeExpired) {\n      return secrets.filter((secret) => !secret.isExpired());\n    }\n\n    return secrets;\n  }\n\n  /**\n   * List all active secrets for a tenant\n   */\n  async listActive(tenantId: string): Promise<Secret[]> {\n    return this.listSecrets(tenantId, { status: 'active' });\n  }\n\n  /**\n   * List a tenant's secrets by category\n   */\n  async listByCategory(tenantId: string, category: string): Promise<Secret[]> {\n    return this.listSecrets(tenantId, { category, status: 'active' });\n  }\n\n  /**\n   * List a tenant's secrets that need attention (expired or about to expire)\n   */\n  async listExpiring(\n    tenantId: string,\n    daysAhead: number = 30,\n  ): Promise<Secret[]> {\n    const futureDate = new Date();\n    futureDate.setDate(futureDate.getDate() + daysAhead);\n\n    const secrets = await this.list({\n      where: {\n        tenantId,\n        status: 'active',\n        'expiresAt !=': null,\n        'expiresAt <': futureDate.toISOString(),\n      },\n      orderBy: 'expiresAt ASC',\n    });\n\n    return secrets;\n  }\n\n  /**\n   * Get categories used in a tenant's secrets\n   */\n  async getCategories(tenantId: string): Promise<string[]> {\n    const secrets = await this.list({ where: { tenantId } });\n    const categories = new Set(secrets.map((s) => s.category).filter(Boolean));\n    return Array.from(categories).sort();\n  }\n\n  /**\n   * Count a tenant's secrets by status\n   */\n  async countByStatus(tenantId: string): Promise<Record<SecretStatus, number>> {\n    const secrets = await this.list({ where: { tenantId } });\n\n    const counts: Record<SecretStatus, number> = {\n      active: 0,\n      disabled: 0,\n      expired: 0,\n    };\n\n    for (const secret of secrets) {\n      if (secret.isExpired()) {\n        counts.expired++;\n      } else {\n        counts[secret.status]++;\n      }\n    }\n\n    return counts;\n  }\n\n  /**\n   * Delete a tenant's secret by name\n   */\n  async deleteByName(tenantId: string, name: string): Promise<boolean> {\n    const secret = await this.findByName(tenantId, name);\n    if (!secret) return false;\n\n    await secret.delete();\n    return true;\n  }\n}\n","/**\n * TenantKeyCollection - Collection manager for TenantKey objects\n * @packageDocumentation\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { TenantKey, type TenantKeyStatus } from '../models/TenantKey.js';\n\n/**\n * Collection for managing TenantKey objects\n */\nexport class TenantKeyCollection extends SmrtCollection<TenantKey> {\n  static readonly _itemClass = TenantKey;\n\n  /**\n   * Get the active key for a tenant\n   */\n  async getActiveKey(tenantId: string): Promise<TenantKey | null> {\n    return this.get({\n      tenantId,\n      status: 'active',\n    });\n  }\n\n  /**\n   * List all key versions for a tenant\n   */\n  async listKeyVersions(tenantId: string): Promise<TenantKey[]> {\n    return this.list({\n      where: { tenantId },\n      orderBy: 'version DESC',\n    });\n  }\n\n  /**\n   * Get a specific key version for a tenant\n   */\n  async getKeyVersion(\n    tenantId: string,\n    version: number,\n  ): Promise<TenantKey | null> {\n    return this.get({\n      tenantId,\n      version,\n    });\n  }\n\n  /**\n   * Find keys that need rotation\n   */\n  async findKeysNeedingRotation(): Promise<TenantKey[]> {\n    const now = new Date();\n\n    return this.list({\n      where: {\n        status: 'active',\n        'rotateAfter !=': null,\n        'rotateAfter <': now.toISOString(),\n      },\n      orderBy: 'rotateAfter ASC',\n    });\n  }\n\n  /**\n   * List all active keys across all tenants\n   */\n  async listAllActiveKeys(): Promise<TenantKey[]> {\n    return this.list({\n      where: { status: 'active' },\n      orderBy: 'created_at DESC',\n    });\n  }\n\n  /**\n   * Count keys by status\n   */\n  async countByStatus(): Promise<Record<TenantKeyStatus, number>> {\n    const keys = await this.list({});\n\n    const counts: Record<TenantKeyStatus, number> = {\n      active: 0,\n      rotating: 0,\n      retired: 0,\n      compromised: 0,\n    };\n\n    for (const key of keys) {\n      counts[key.status]++;\n    }\n\n    return counts;\n  }\n\n  /**\n   * Mark a key as compromised (should trigger re-encryption)\n   */\n  async markCompromised(tenantId: string, keyId: string): Promise<boolean> {\n    const key = await this.get({\n      id: keyId,\n      tenantId,\n    });\n\n    if (!key) return false;\n\n    key.markCompromised();\n    await key.save();\n    return true;\n  }\n\n  /**\n   * Delete old retired keys that are no longer needed\n   * @param olderThanDays Delete keys retired more than this many days ago\n   */\n  async cleanupRetiredKeys(olderThanDays: number = 90): Promise<number> {\n    const cutoffDate = new Date();\n    cutoffDate.setDate(cutoffDate.getDate() - olderThanDays);\n\n    const oldKeys = await this.list({\n      where: {\n        status: 'retired',\n        'retiredAt <': cutoffDate.toISOString(),\n      },\n    });\n\n    let count = 0;\n    for (const key of oldKeys) {\n      await key.delete();\n      count++;\n    }\n\n    return count;\n  }\n}\n","import { loadEnvConfig } from \"@happyvertical/utils\";\nclass LoggerAdapter {\n  constructor(logger) {\n    this.logger = logger;\n  }\n  /**\n   * Handle a signal and log appropriately\n   *\n   * @param signal - Signal to log\n   */\n  async handle(signal) {\n    const context = {\n      id: signal.id,\n      objectId: signal.objectId,\n      className: signal.className,\n      method: signal.method,\n      timestamp: signal.timestamp\n    };\n    if (signal.duration !== void 0) {\n      context.duration = signal.duration;\n    }\n    if (signal.metadata) {\n      context.metadata = signal.metadata;\n    }\n    switch (signal.type) {\n      case \"start\":\n        this.logger.debug(\n          `${signal.className}.${signal.method}() started`,\n          context\n        );\n        break;\n      case \"step\":\n        this.logger.debug(\n          `${signal.className}.${signal.method}() step: ${signal.step || \"unknown\"}`,\n          context\n        );\n        break;\n      case \"end\":\n        this.logger.info(\n          `${signal.className}.${signal.method}() completed in ${signal.duration}ms`,\n          {\n            ...context,\n            result: signal.result !== void 0 ? \"present\" : \"none\"\n          }\n        );\n        break;\n      case \"error\":\n        this.logger.error(\n          `${signal.className}.${signal.method}() failed: ${signal.error?.message || \"Unknown error\"}`,\n          {\n            ...context,\n            error: signal.error ? {\n              message: signal.error.message,\n              name: signal.error.name,\n              stack: signal.error.stack\n            } : void 0\n          }\n        );\n        break;\n    }\n  }\n}\nclass ConsoleLogger {\n  constructor(level = \"info\") {\n    this.level = level;\n  }\n  static LEVELS = [\n    \"debug\",\n    \"info\",\n    \"warn\",\n    \"error\"\n  ];\n  /**\n   * Check if a log level should be output\n   *\n   * @param level - Log level to check\n   * @returns True if level meets threshold\n   */\n  shouldLog(level) {\n    const currentIndex = ConsoleLogger.LEVELS.indexOf(this.level);\n    const messageIndex = ConsoleLogger.LEVELS.indexOf(level);\n    return messageIndex >= currentIndex;\n  }\n  /**\n   * Format context for console output\n   *\n   * @param context - Structured metadata\n   * @returns Formatted context string\n   */\n  formatContext(context) {\n    if (!context || Object.keys(context).length === 0) {\n      return \"\";\n    }\n    return ` ${JSON.stringify(context)}`;\n  }\n  debug(message, context) {\n    if (this.shouldLog(\"debug\")) {\n      console.debug(`[DEBUG] ${message}${this.formatContext(context)}`);\n    }\n  }\n  info(message, context) {\n    if (this.shouldLog(\"info\")) {\n      console.info(`[INFO] ${message}${this.formatContext(context)}`);\n    }\n  }\n  warn(message, context) {\n    if (this.shouldLog(\"warn\")) {\n      console.warn(`[WARN] ${message}${this.formatContext(context)}`);\n    }\n  }\n  error(message, context) {\n    if (this.shouldLog(\"error\")) {\n      console.error(`[ERROR] ${message}${this.formatContext(context)}`);\n    }\n  }\n}\nclass NoopLogger {\n  debug(_message, _context) {\n  }\n  info(_message, _context) {\n  }\n  warn(_message, _context) {\n  }\n  error(_message, _context) {\n  }\n}\nfunction createLogger(config) {\n  if (typeof config === \"boolean\") {\n    if (!config) {\n      return new NoopLogger();\n    }\n    const envConfig = loadEnvConfig(\n      {},\n      {\n        packageName: \"logger\",\n        schema: { level: \"string\" }\n      }\n    );\n    return new ConsoleLogger(envConfig.level || \"info\");\n  }\n  const mergedConfig = loadEnvConfig(config, {\n    packageName: \"logger\",\n    schema: { level: \"string\" }\n  });\n  const level = mergedConfig.level || \"info\";\n  return new ConsoleLogger(level);\n}\nconst PACKAGE_VERSION_INITIALIZED = true;\nexport {\n  ConsoleLogger,\n  LoggerAdapter,\n  PACKAGE_VERSION_INITIALIZED,\n  createLogger\n};\n//# sourceMappingURL=index.js.map\n","/**\n * SecretService - High-level API for per-tenant secret management\n * @packageDocumentation\n */\n\n// Self-register this package's manifest for consumers that import via this\n// subpath without the main entry. See src/__smrt-register__.ts (issue #1132).\nimport '../__smrt-register__.js';\n\nimport { createLogger } from '@happyvertical/logger';\nimport {\n  AMKUnavailableError,\n  DecryptionError,\n  type EncryptedEnvelope,\n  EncryptionError,\n  EnvelopeEncryption,\n  getSecretStore,\n  type SecretStore,\n  TenantKeyMissingError,\n} from '@happyvertical/secrets';\nimport {\n  getCurrentTenant,\n  requireTenantId,\n  withTenant,\n} from '@happyvertical/smrt-tenancy';\nimport type { DatabaseInterface } from '@happyvertical/sql';\nimport { SecretAuditLogCollection } from '../collections/SecretAuditLogCollection.js';\nimport { SecretCollection } from '../collections/SecretCollection.js';\nimport { TenantKeyCollection } from '../collections/TenantKeyCollection.js';\nimport type { Secret } from '../models/Secret.js';\nimport {\n  createAuditEntry,\n  type SecretAuditAction,\n  type SecretAuditLog,\n} from '../models/SecretAuditLog.js';\nimport type { TenantKey } from '../models/TenantKey.js';\n\nconst logger = createLogger({ level: 'info' });\n\n/**\n * Options for creating a SecretService\n */\nexport interface SecretServiceOptions {\n  /** Database connection */\n  db: DatabaseInterface;\n  /** Environment variable containing the AMK (64 hex chars) */\n  amkEnvVar?: string;\n  /** AMK key identifier */\n  amkKeyId?: string;\n  /** Enable audit logging (default: true) */\n  auditEnabled?: boolean;\n}\n\n/**\n * Options for storing a secret\n */\nexport interface StoreSecretOptions {\n  /** Human-readable description */\n  description?: string;\n  /** Category for organization */\n  category?: string;\n  /** Optional expiration date */\n  expiresAt?: Date;\n  /** Additional metadata */\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Result of retrieving a secret\n */\nexport interface RetrievedSecret {\n  /** The decrypted secret value */\n  value: string;\n  /** Secret metadata */\n  name: string;\n  description: string;\n  category: string;\n  expiresAt: Date | null;\n  createdAt: Date;\n  lastAccessedAt: Date | null;\n  accessCount: number;\n  metadata: Record<string, unknown>;\n}\n\nexport type SecretKeyDriftIssueSeverity = 'info' | 'warning' | 'error';\n\nexport type SecretKeyDriftIssueCode =\n  | 'amk_unavailable'\n  | 'active_secrets_without_usable_active_key'\n  | 'missing_active_tenant_encryption_key'\n  | 'multiple_active_tenant_encryption_keys'\n  | 'active_tenant_encryption_key_amk_mismatch'\n  | 'active_tenant_encryption_key_unwrap_failed'\n  | 'secret_envelope_invalid_json'\n  | 'secret_envelope_invalid_wrapped_key'\n  | 'secret_envelope_missing_tenant_encryption_key'\n  | 'secret_envelope_unwrap_failed'\n  | 'smrt_tenant_keys_query_failed'\n  | 'smrt_tenant_keys_not_mirrored';\n\nexport type SecretKeyDriftRepairAction =\n  | 'delete-unrecoverable-secret'\n  | 'delete-unusable-tenant-encryption-key'\n  | 'store-fresh-secret-value'\n  | 'none';\n\nexport interface SecretKeyDriftIssue {\n  code: SecretKeyDriftIssueCode;\n  severity: SecretKeyDriftIssueSeverity;\n  message: string;\n  repairAction: SecretKeyDriftRepairAction;\n  secretId?: string;\n  secretName?: string;\n  keyId?: string;\n  sourceTable?: 'secrets' | 'tenant_encryption_keys' | 'tenant_keys';\n  details?: Record<string, string | number | boolean | null>;\n}\n\nexport interface DiagnoseTenantSecretKeyDriftOptions {\n  /**\n   * Limit secret-envelope checks to these names. Tenant key checks still run.\n   */\n  secretNames?: string[];\n}\n\nexport interface SecretKeyDriftReport {\n  tenantId: string;\n  checkedAt: Date;\n  ok: boolean;\n  summary: {\n    activeSecretCount: number;\n    tenantEncryptionKeyCount: number;\n    activeTenantEncryptionKeyCount: number;\n    usableActiveTenantEncryptionKeyCount: number;\n    smrtTenantKeyCount: number;\n    activeSmrtTenantKeyCount: number;\n  };\n  issues: SecretKeyDriftIssue[];\n}\n\nexport interface RepairTenantSecretKeyDriftOptions\n  extends DiagnoseTenantSecretKeyDriftOptions {\n  /**\n   * Preview affected rows without deleting anything.\n   */\n  dryRun?: boolean;\n  /**\n   * Required for destructive repair. This deletes encrypted values/key rows\n   * that cannot be used with the currently configured AMK.\n   */\n  confirmDeleteUnrecoverableData?: boolean;\n}\n\nexport interface SecretKeyDriftRepairResult {\n  tenantId: string;\n  dryRun: boolean;\n  issuesBefore: SecretKeyDriftIssue[];\n  remainingIssues: SecretKeyDriftIssue[];\n  wouldDeleteSecrets: number;\n  wouldDeleteTenantEncryptionKeys: number;\n  deletedSecrets: number;\n  deletedTenantEncryptionKeys: number;\n  secretNames: string[];\n  tenantEncryptionKeyIds: string[];\n}\n\nexport class SecretKeyDriftError extends Error {\n  readonly code = 'SECRET_KEY_DRIFT';\n  readonly tenantId: string;\n  readonly report: SecretKeyDriftReport;\n  readonly cause?: Error;\n\n  constructor(\n    message: string,\n    tenantId: string,\n    report: SecretKeyDriftReport,\n    cause?: Error,\n  ) {\n    super(message);\n    this.name = 'SecretKeyDriftError';\n    this.tenantId = tenantId;\n    this.report = report;\n    this.cause = cause;\n  }\n}\n\ninterface TenantEncryptionKeyRow {\n  id: string;\n  tenant_id: string;\n  wrapped_key: string;\n  amk_key_id: string;\n  status: string;\n  version: number;\n  rotate_after: string | null;\n  retired_at: string | null;\n  created_at: string;\n  updated_at: string;\n}\n\ninterface SecretDiagnosisRow {\n  id: string;\n  name: string;\n  encrypted_value: string;\n  status: string;\n  tenant_id: string;\n}\n\ninterface WrappedKeyCheck {\n  usable: boolean;\n  error?: string;\n  fingerprint?: string;\n}\n\ninterface SmrtTenantKeyDiagnosisRows {\n  keys: TenantKey[];\n  error?: Error;\n}\n\ntype TransactionCapableDatabase = DatabaseInterface & {\n  transaction?: <T>(\n    callback: (tx: DatabaseInterface) => Promise<T>,\n  ) => Promise<T>;\n};\n\n/**\n * SecretService provides high-level operations for managing per-tenant secrets.\n *\n * It integrates with:\n * - `@happyvertical/secrets` for envelope encryption\n * - `@happyvertical/smrt-tenancy` for tenant context\n * - Audit logging for compliance\n *\n * @example\n * ```typescript\n * import { SecretService } from '@happyvertical/smrt-secrets';\n * import { withTenant } from '@happyvertical/smrt-tenancy';\n *\n * const service = await SecretService.create({ db });\n *\n * await withTenant({ tenantId: 'tenant-123' }, async () => {\n *   // Store a secret\n *   await service.store('stripe-api-key', 'sk_live_xxx', {\n *     category: 'api-keys',\n *     description: 'Stripe production API key'\n *   });\n *\n *   // Retrieve the secret\n *   const secret = await service.retrieve('stripe-api-key');\n *   console.log(secret.value); // 'sk_live_xxx'\n *\n *   // List secret names (without values)\n *   const secrets = await service.list();\n *\n *   // Rotate tenant's encryption key\n *   await service.rotateKey();\n *\n *   // Delete a secret\n *   await service.delete('stripe-api-key');\n * });\n * ```\n */\nexport class SecretService {\n  private db: DatabaseInterface;\n  private secretStore: SecretStore;\n  private secrets: SecretCollection;\n  private tenantKeys: TenantKeyCollection;\n  private auditLogs: SecretAuditLogCollection;\n  private auditEnabled: boolean;\n  private amkEnvVar: string;\n  private amkKeyId: string;\n\n  private constructor(\n    db: DatabaseInterface,\n    secretStore: SecretStore,\n    secrets: SecretCollection,\n    tenantKeys: TenantKeyCollection,\n    auditLogs: SecretAuditLogCollection,\n    auditEnabled: boolean,\n    amkEnvVar: string,\n    amkKeyId: string,\n  ) {\n    this.db = db;\n    this.secretStore = secretStore;\n    this.secrets = secrets;\n    this.tenantKeys = tenantKeys;\n    this.auditLogs = auditLogs;\n    this.auditEnabled = auditEnabled;\n    this.amkEnvVar = amkEnvVar;\n    this.amkKeyId = amkKeyId;\n  }\n\n  /**\n   * Create a new SecretService instance\n   */\n  static async create(options: SecretServiceOptions): Promise<SecretService> {\n    const {\n      db,\n      amkEnvVar = 'SMRT_SECRET_MASTER_KEY',\n      amkKeyId = 'smrt-amk-v1',\n      auditEnabled = true,\n    } = options;\n\n    // Create the underlying secret store\n    const secretStore = await getSecretStore({\n      type: 'database',\n      db,\n      amk: {\n        provider: 'env',\n        keyEnvVar: amkEnvVar,\n        keyId: amkKeyId,\n      },\n    });\n\n    // Create collections - pass db directly (DatabaseConfig accepts DatabaseInterface)\n    const baseOptions = { db };\n    const secrets = await SecretCollection.create(baseOptions);\n    const tenantKeys = await TenantKeyCollection.create(baseOptions);\n    const auditLogs = await SecretAuditLogCollection.create(baseOptions);\n\n    return new SecretService(\n      db,\n      secretStore,\n      secrets,\n      tenantKeys,\n      auditLogs,\n      auditEnabled,\n      amkEnvVar,\n      amkKeyId,\n    );\n  }\n\n  /**\n   * Store a secret for the current tenant\n   */\n  async store(\n    name: string,\n    value: string,\n    options: StoreSecretOptions = {},\n  ): Promise<Secret> {\n    const tenantId = requireTenantId();\n    const userId = this.getCurrentUserId();\n\n    // Track whether this is an update to use correct audit action on error\n    let isUpdate = false;\n\n    try {\n      // Check if secret already exists for THIS tenant (issue #1501: an\n      // unscoped lookup here used to find another tenant's same-named row and\n      // clobber it with an envelope encrypted under the caller's TDEK).\n      let existing = await this.secrets.findByName(tenantId, name);\n      // Defense-in-depth: even if a lookup regression ever returns a foreign\n      // row again, never save over it — fall through to the create path,\n      // which is tenant-scoped via the (slug, context=tenantId) upsert key.\n      if (existing && existing.tenantId !== tenantId) {\n        existing = null;\n      }\n      isUpdate = existing !== null;\n\n      // Encrypt the value\n      const envelope = await this.secretStore.encrypt(tenantId, name, value, {\n        metadata: options.metadata\n          ? this.serializeMetadata(options.metadata)\n          : undefined,\n      });\n\n      if (existing) {\n        // Update existing secret\n        existing.encryptedValue = JSON.stringify(envelope);\n        existing.description = options.description ?? existing.description;\n        existing.category = options.category ?? existing.category;\n        existing.expiresAt = options.expiresAt ?? existing.expiresAt;\n        existing.metadata = options.metadata ?? existing.metadata;\n        await existing.save();\n\n        await this.audit(\n          existing.id ?? null,\n          name,\n          userId,\n          'update',\n          'success',\n        );\n        return existing;\n      }\n\n      // Create new secret\n      // Set context to tenantId for per-tenant uniqueness\n      // The UPSERT uses (slug, context) as conflict columns, so different tenants\n      // can have secrets with the same name\n      const secret = await this.secrets.create({\n        name,\n        description: options.description ?? '',\n        category: options.category ?? '',\n        encryptedValue: JSON.stringify(envelope),\n        keyVersion: 1,\n        status: 'active',\n        expiresAt: options.expiresAt ?? null,\n        metadata: options.metadata ?? {},\n        context: tenantId, // Per-tenant uniqueness\n        tenantId,\n      });\n\n      await this.audit(secret.id ?? null, name, userId, 'create', 'success');\n      return secret;\n    } catch (error) {\n      const classifiedError = await this.classifyTenantKeyFailure(\n        tenantId,\n        name,\n        error,\n      );\n      await this.audit(\n        null,\n        name,\n        userId,\n        isUpdate ? 'update' : 'create',\n        'failure',\n        {\n          error: classifiedError.message,\n        },\n      );\n      throw classifiedError;\n    }\n  }\n\n  /**\n   * Store a secret for a specific tenant.\n   *\n   * This is useful for integrations that already resolved tenant ownership but\n   * may be running outside the application's ambient tenant context.\n   */\n  async storeForTenant(\n    tenantId: string,\n    name: string,\n    value: string,\n    options: StoreSecretOptions = {},\n  ): Promise<Secret> {\n    return withTenant({ tenantId }, () => this.store(name, value, options));\n  }\n\n  /**\n   * Retrieve a secret for the current tenant\n   */\n  async retrieve(name: string): Promise<RetrievedSecret> {\n    const tenantId = requireTenantId();\n    const userId = this.getCurrentUserId();\n\n    // Track whether we've already audited to avoid double-auditing\n    let audited = false;\n\n    try {\n      const secret = await this.secrets.findByName(tenantId, name);\n      // Ownership check before any decrypt attempt (issue #1501): a row owned\n      // by another tenant must behave exactly like \"not found\", never surface\n      // as a cross-tenant decrypt failure.\n      if (!secret || secret.tenantId !== tenantId) {\n        await this.audit(null, name, userId, 'read', 'failure', {\n          error: 'Secret not found',\n        });\n        audited = true;\n        throw new Error(`Secret '${name}' not found`);\n      }\n\n      if (!secret.isUsable()) {\n        const reason = secret.isExpired()\n          ? 'Secret expired'\n          : 'Secret disabled';\n        await this.audit(secret.id ?? null, name, userId, 'read', 'failure', {\n          error: reason,\n        });\n        audited = true;\n        throw new Error(reason);\n      }\n\n      // Decrypt the value\n      const envelope: EncryptedEnvelope = JSON.parse(secret.encryptedValue);\n      const decrypted = await this.secretStore.decrypt(tenantId, envelope);\n\n      // Access tracking is operational telemetry. Retrieval should still\n      // succeed if the decrypted value is available but this write fails.\n      const previousLastAccessedAt = secret.lastAccessedAt;\n      const previousAccessCount = secret.accessCount;\n      try {\n        secret.recordAccess();\n        await secret.save();\n      } catch (trackingError) {\n        secret.lastAccessedAt = previousLastAccessedAt;\n        secret.accessCount = previousAccessCount;\n        logger.error('Failed to update secret access tracking', {\n          error: trackingError,\n        });\n      }\n\n      await this.audit(secret.id ?? null, name, userId, 'read', 'success');\n\n      return {\n        value: decrypted.value,\n        name: secret.name,\n        description: secret.description,\n        category: secret.category,\n        expiresAt: secret.expiresAt,\n        createdAt: secret.created_at ?? new Date(),\n        lastAccessedAt: secret.lastAccessedAt,\n        accessCount: secret.accessCount,\n        metadata: secret.metadata,\n      };\n    } catch (error) {\n      const classifiedError = await this.classifyTenantKeyFailure(\n        tenantId,\n        name,\n        error,\n      );\n      // Only audit if we haven't already audited this error\n      if (!audited) {\n        await this.audit(null, name, userId, 'read', 'failure', {\n          error: classifiedError.message,\n        });\n      }\n      throw classifiedError;\n    }\n  }\n\n  /**\n   * Retrieve a secret for a specific tenant.\n   */\n  async retrieveForTenant(\n    tenantId: string,\n    name: string,\n  ): Promise<RetrievedSecret> {\n    return withTenant({ tenantId }, () => this.retrieve(name));\n  }\n\n  /**\n   * Diagnose tenant secret/key drift without exposing decrypted values.\n   */\n  async diagnoseTenantSecretKeyDrift(\n    tenantId: string,\n    options: DiagnoseTenantSecretKeyDriftOptions = {},\n  ): Promise<SecretKeyDriftReport> {\n    const activeSecrets = await this.listActiveSecretRowsForDiagnosis(\n      tenantId,\n      options.secretNames,\n    );\n    const tenantEncryptionKeys =\n      await this.listTenantEncryptionKeyRows(tenantId);\n    const smrtTenantKeyRows =\n      await this.listSmrtTenantKeysForDiagnosis(tenantId);\n    const smrtTenantKeys = smrtTenantKeyRows.keys;\n    const issues: SecretKeyDriftIssue[] = [];\n\n    const activeTenantEncryptionKeys = tenantEncryptionKeys.filter(\n      (key) => key.status === 'active',\n    );\n    const activeSmrtTenantKeys = smrtTenantKeys.filter(\n      (key) => key.status === 'active',\n    );\n    const amk = this.getConfiguredAmkForDiagnosis();\n\n    if (!amk.usable) {\n      issues.push({\n        code: 'amk_unavailable',\n        severity: 'error',\n        message: amk.error ?? `AMK ${this.amkEnvVar} is unavailable`,\n        repairAction: 'none',\n        details: {\n          amkEnvVar: this.amkEnvVar,\n          amkKeyId: this.amkKeyId,\n        },\n      });\n    }\n\n    if (activeSecrets.length > 0 && activeTenantEncryptionKeys.length === 0) {\n      issues.push({\n        code: 'missing_active_tenant_encryption_key',\n        severity: 'error',\n        message:\n          'Active tenant secrets exist, but tenant_encryption_keys has no active key for encryption.',\n        repairAction: 'store-fresh-secret-value',\n        sourceTable: 'tenant_encryption_keys',\n        details: {\n          activeSecretCount: activeSecrets.length,\n        },\n      });\n    }\n\n    if (smrtTenantKeyRows.error) {\n      issues.push({\n        code: 'smrt_tenant_keys_query_failed',\n        severity: 'error',\n        message:\n          'Unable to query SMRT tenant_keys while diagnosing tenant secret key drift.',\n        repairAction: 'none',\n        sourceTable: 'tenant_keys',\n        details: {\n          error: smrtTenantKeyRows.error.message,\n        },\n      });\n    }\n\n    if (activeTenantEncryptionKeys.length > 1) {\n      issues.push({\n        code: 'multiple_active_tenant_encryption_keys',\n        severity: 'error',\n        message:\n          'tenant_encryption_keys has multiple active keys for this tenant; encryption may use an arbitrary active key.',\n        repairAction: 'none',\n        sourceTable: 'tenant_encryption_keys',\n        details: {\n          activeTenantEncryptionKeyCount: activeTenantEncryptionKeys.length,\n        },\n      });\n    }\n\n    const activeKeyChecks: WrappedKeyCheck[] = [];\n\n    for (const key of tenantEncryptionKeys) {\n      const check = amk.value\n        ? this.checkWrappedKey(key.wrapped_key, amk.value)\n        : { usable: false, error: amk.error };\n\n      if (key.status === 'active') {\n        activeKeyChecks.push(check);\n      }\n\n      if (key.status === 'active' && key.amk_key_id !== this.amkKeyId) {\n        issues.push({\n          code: 'active_tenant_encryption_key_amk_mismatch',\n          severity: 'warning',\n          message:\n            'Active tenant_encryption_keys row was wrapped by a different AMK key id than this SecretService is configured to use.',\n          repairAction: 'none',\n          keyId: key.id,\n          sourceTable: 'tenant_encryption_keys',\n          details: {\n            rowAmkKeyId: key.amk_key_id,\n            configuredAmkKeyId: this.amkKeyId,\n          },\n        });\n      }\n\n      if (key.status === 'active' && !check.usable && amk.value) {\n        issues.push({\n          code: 'active_tenant_encryption_key_unwrap_failed',\n          severity: 'error',\n          message:\n            'Active tenant_encryption_keys row cannot be unwrapped by the currently configured AMK.',\n          repairAction: 'delete-unusable-tenant-encryption-key',\n          keyId: key.id,\n          sourceTable: 'tenant_encryption_keys',\n          details: {\n            version: key.version,\n            error: check.error ?? null,\n          },\n        });\n      }\n    }\n\n    const usableActiveTenantEncryptionKeyCount = activeKeyChecks.filter(\n      (check) => check.usable,\n    ).length;\n\n    if (\n      activeSecrets.length > 0 &&\n      usableActiveTenantEncryptionKeyCount === 0\n    ) {\n      issues.push({\n        code: 'active_secrets_without_usable_active_key',\n        severity: 'error',\n        message:\n          'Active secrets exist, but no active tenant_encryption_keys row can be used with the current AMK.',\n        repairAction: 'store-fresh-secret-value',\n        sourceTable: 'tenant_encryption_keys',\n        details: {\n          activeSecretCount: activeSecrets.length,\n          activeTenantEncryptionKeyCount: activeTenantEncryptionKeys.length,\n        },\n      });\n    }\n\n    const keyFingerprintToRow = new Map<string, TenantEncryptionKeyRow>();\n    for (const key of tenantEncryptionKeys) {\n      const fingerprint = this.getWrappedKeyFingerprint(key.wrapped_key);\n      if (fingerprint) {\n        keyFingerprintToRow.set(fingerprint, key);\n      }\n    }\n\n    for (const secret of activeSecrets) {\n      const envelope = this.parseSecretEnvelopeForDiagnosis(secret, issues);\n      if (!envelope) continue;\n\n      const envelopeFingerprint = this.getWrappedKeyFingerprint(\n        envelope.wrappedKey,\n      );\n      const envelopeCheck = amk.value\n        ? this.checkWrappedKey(envelope.wrappedKey, amk.value)\n        : {\n            usable: false,\n            error: amk.error,\n            fingerprint: envelopeFingerprint,\n          };\n\n      if (!envelopeCheck.fingerprint) {\n        issues.push({\n          code: 'secret_envelope_invalid_wrapped_key',\n          severity: 'error',\n          message:\n            'Secret encryptedValue contains an invalid wrapped key format.',\n          repairAction: 'delete-unrecoverable-secret',\n          secretId: secret.id,\n          secretName: secret.name,\n          sourceTable: 'secrets',\n          details: {\n            error: envelopeCheck.error ?? null,\n          },\n        });\n        continue;\n      }\n\n      const matchingKey = keyFingerprintToRow.get(envelopeCheck.fingerprint);\n      if (!matchingKey) {\n        issues.push({\n          code: 'secret_envelope_missing_tenant_encryption_key',\n          severity: 'error',\n          message:\n            'Secret envelope does not match any tenant_encryption_keys row for this tenant.',\n          repairAction: !amk.value\n            ? 'none'\n            : envelopeCheck.usable\n              ? 'none'\n              : 'delete-unrecoverable-secret',\n          secretId: secret.id,\n          secretName: secret.name,\n          sourceTable: 'secrets',\n        });\n      }\n\n      if (!envelopeCheck.usable && amk.value) {\n        issues.push({\n          code: 'secret_envelope_unwrap_failed',\n          severity: 'error',\n          message:\n            'Secret envelope cannot be unwrapped by the currently configured AMK.',\n          repairAction: 'delete-unrecoverable-secret',\n          secretId: secret.id,\n          secretName: secret.name,\n          keyId: matchingKey?.id,\n          sourceTable: 'secrets',\n          details: {\n            error: envelopeCheck.error ?? null,\n          },\n        });\n      }\n    }\n\n    if (\n      activeSecrets.length > 0 &&\n      tenantEncryptionKeys.length > 0 &&\n      smrtTenantKeys.length === 0 &&\n      !smrtTenantKeyRows.error\n    ) {\n      issues.push({\n        code: 'smrt_tenant_keys_not_mirrored',\n        severity: 'info',\n        message:\n          'SMRT tenant_keys has no rows for this tenant, while the lower-level tenant_encryption_keys table does. SecretService uses tenant_encryption_keys for encryption.',\n        repairAction: 'none',\n        sourceTable: 'tenant_keys',\n      });\n    }\n\n    return {\n      tenantId,\n      checkedAt: new Date(),\n      ok: !issues.some((issue) => issue.severity === 'error'),\n      summary: {\n        activeSecretCount: activeSecrets.length,\n        tenantEncryptionKeyCount: tenantEncryptionKeys.length,\n        activeTenantEncryptionKeyCount: activeTenantEncryptionKeys.length,\n        usableActiveTenantEncryptionKeyCount,\n        smrtTenantKeyCount: smrtTenantKeys.length,\n        activeSmrtTenantKeyCount: activeSmrtTenantKeys.length,\n      },\n      issues,\n    };\n  }\n\n  /**\n   * Diagnose drift for the current tenant context.\n   */\n  async diagnoseCurrentTenantSecretKeyDrift(\n    options: DiagnoseTenantSecretKeyDriftOptions = {},\n  ): Promise<SecretKeyDriftReport> {\n    return this.diagnoseTenantSecretKeyDrift(requireTenantId(), options);\n  }\n\n  /**\n   * Delete unrecoverable secret/key rows identified by diagnosis.\n   *\n   * This never attempts to recover or expose secret values. Use dryRun first\n   * to preview destructive changes.\n   */\n  async repairTenantSecretKeyDrift(\n    tenantId: string,\n    options: RepairTenantSecretKeyDriftOptions = {},\n  ): Promise<SecretKeyDriftRepairResult> {\n    const dryRun = options.dryRun ?? false;\n    const before = await this.diagnoseTenantSecretKeyDrift(tenantId, options);\n    const secretIds = new Set<string>();\n    const secretNames = new Map<string, string>();\n    const tenantEncryptionKeyIds = new Set<string>();\n\n    for (const issue of before.issues) {\n      if (\n        issue.repairAction === 'delete-unrecoverable-secret' &&\n        issue.secretId\n      ) {\n        secretIds.add(issue.secretId);\n        if (issue.secretName) {\n          secretNames.set(issue.secretId, issue.secretName);\n        }\n      }\n\n      if (\n        issue.repairAction === 'delete-unusable-tenant-encryption-key' &&\n        issue.keyId\n      ) {\n        tenantEncryptionKeyIds.add(issue.keyId);\n      }\n    }\n\n    const wouldDeleteSecrets = secretIds.size;\n    const wouldDeleteTenantEncryptionKeys = tenantEncryptionKeyIds.size;\n    const wouldDeleteUnrecoverableData =\n      wouldDeleteSecrets + wouldDeleteTenantEncryptionKeys > 0;\n\n    if (\n      !dryRun &&\n      wouldDeleteUnrecoverableData &&\n      !options.confirmDeleteUnrecoverableData\n    ) {\n      throw new Error(\n        'repairTenantSecretKeyDrift requires confirmDeleteUnrecoverableData: true before deleting encrypted secrets or tenant key rows.',\n      );\n    }\n\n    let deletedSecrets = 0;\n    let deletedTenantEncryptionKeys = 0;\n\n    if (!dryRun) {\n      const runDeletes = async (db: DatabaseInterface) => {\n        const deletedSecretRows = await this.deleteRowsByIds(\n          'secrets',\n          tenantId,\n          secretIds,\n          db,\n        );\n        const deletedTenantEncryptionKeyRows = await this.deleteRowsByIds(\n          'tenant_encryption_keys',\n          tenantId,\n          tenantEncryptionKeyIds,\n          db,\n        );\n        return {\n          deletedSecrets: deletedSecretRows,\n          deletedTenantEncryptionKeys: deletedTenantEncryptionKeyRows,\n        };\n      };\n      const txDb = this.db as TransactionCapableDatabase;\n      const deleteResult =\n        typeof txDb.transaction === 'function'\n          ? await txDb.transaction((db) => runDeletes(db))\n          : await runDeletes(this.db);\n\n      deletedSecrets = deleteResult.deletedSecrets;\n      deletedTenantEncryptionKeys = deleteResult.deletedTenantEncryptionKeys;\n      await this.auditSecretDriftRepairDeletes(\n        tenantId,\n        secretIds,\n        secretNames,\n      );\n    }\n\n    const after = dryRun\n      ? before\n      : await this.diagnoseTenantSecretKeyDrift(tenantId, options);\n\n    return {\n      tenantId,\n      dryRun,\n      issuesBefore: before.issues,\n      remainingIssues: after.issues,\n      wouldDeleteSecrets,\n      wouldDeleteTenantEncryptionKeys,\n      deletedSecrets,\n      deletedTenantEncryptionKeys,\n      secretNames: Array.from(secretNames.values()).sort(),\n      tenantEncryptionKeyIds: Array.from(tenantEncryptionKeyIds).sort(),\n    };\n  }\n\n  /**\n   * List secrets for the current tenant (names only, not values)\n   */\n  async list(options: { category?: string } = {}): Promise<Secret[]> {\n    return this.secrets.listSecrets(requireTenantId(), {\n      category: options.category,\n      status: 'active',\n    });\n  }\n\n  /**\n   * Delete a secret\n   */\n  async delete(name: string): Promise<boolean> {\n    const tenantId = requireTenantId();\n    const userId = this.getCurrentUserId();\n\n    const secret = await this.secrets.findByName(tenantId, name);\n    // Ownership check (issue #1501): never delete another tenant's row\n    if (!secret || secret.tenantId !== tenantId) {\n      return false;\n    }\n\n    try {\n      await secret.delete();\n      await this.audit(secret.id ?? null, name, userId, 'delete', 'success');\n      return true;\n    } catch (error) {\n      await this.audit(secret.id ?? null, name, userId, 'delete', 'failure', {\n        error: (error as Error).message,\n      });\n      throw error;\n    }\n  }\n\n  /**\n   * Disable a secret (soft delete)\n   */\n  async disable(name: string): Promise<boolean> {\n    const tenantId = requireTenantId();\n    const userId = this.getCurrentUserId();\n\n    const secret = await this.secrets.findByName(tenantId, name);\n    // Ownership check (issue #1501): never mutate another tenant's row\n    if (!secret || secret.tenantId !== tenantId) {\n      return false;\n    }\n\n    secret.disable();\n    await secret.save();\n    await this.audit(secret.id ?? null, name, userId, 'disable', 'success');\n    return true;\n  }\n\n  /**\n   * Enable a disabled secret\n   */\n  async enable(name: string): Promise<boolean> {\n    const tenantId = requireTenantId();\n    const userId = this.getCurrentUserId();\n\n    const secret = await this.secrets.findByName(tenantId, name);\n    // Ownership check (issue #1501): never mutate another tenant's row\n    if (!secret || secret.tenantId !== tenantId) {\n      return false;\n    }\n\n    secret.enable();\n    await secret.save();\n    await this.audit(secret.id ?? null, name, userId, 'enable', 'success');\n    return true;\n  }\n\n  /**\n   * Rotate the tenant's encryption key\n   *\n   * This creates a new TDEK and marks the old one as retired.\n   * Existing secrets remain encrypted with the old key and can still\n   * be decrypted (the old key is kept in retired state).\n   *\n   * For full re-encryption, call reencryptAll() after rotation.\n   */\n  async rotateKey(): Promise<void> {\n    const tenantId = requireTenantId();\n    const userId = this.getCurrentUserId();\n\n    try {\n      await this.secretStore.rotateTenantKey(tenantId);\n      await this.audit(null, '', userId, 'rotate_key', 'success', {\n        tenantId,\n      });\n    } catch (error) {\n      await this.audit(null, '', userId, 'rotate_key', 'failure', {\n        tenantId,\n        error: (error as Error).message,\n      });\n      throw error;\n    }\n  }\n\n  /**\n   * Re-encrypt all secrets with the current active key\n   *\n   * Call this after key rotation to ensure all secrets use the new key.\n   * This is optional but recommended for security.\n   */\n  async reencryptAll(): Promise<{ success: number; failed: number }> {\n    const tenantId = requireTenantId();\n    const userId = this.getCurrentUserId();\n\n    // Scope to the current tenant (issue #1501): re-encryption must never\n    // touch (or attempt to decrypt) other tenants' rows.\n    const secrets = await this.secrets.list({ where: { tenantId } });\n    let success = 0;\n    let failed = 0;\n\n    for (const secret of secrets) {\n      try {\n        // Decrypt with old key\n        const envelope: EncryptedEnvelope = JSON.parse(secret.encryptedValue);\n        const decrypted = await this.secretStore.decrypt(tenantId, envelope);\n\n        // Re-encrypt with new key\n        const newEnvelope = await this.secretStore.encrypt(\n          tenantId,\n          secret.name,\n          decrypted.value,\n        );\n\n        secret.encryptedValue = JSON.stringify(newEnvelope);\n        await secret.save();\n\n        success++;\n      } catch (error) {\n        failed++;\n        await this.audit(\n          secret.id ?? null,\n          secret.name,\n          userId,\n          'update',\n          'failure',\n          {\n            action: 'reencrypt',\n            error: (error as Error).message,\n          },\n        );\n      }\n    }\n\n    return { success, failed };\n  }\n\n  /**\n   * Get audit logs for the current tenant\n   */\n  async getAuditLogs(\n    options: { secretName?: string; limit?: number } = {},\n  ): Promise<SecretAuditLog[]> {\n    return this.auditLogs.listLogs({\n      // Scope to the current tenant (issue #1501): audit logs reference\n      // secret names and must not leak across tenants.\n      tenantId: requireTenantId(),\n      secretName: options.secretName,\n      limit: options.limit ?? 100,\n    });\n  }\n\n  /**\n   * Get secret categories for the current tenant\n   */\n  async getCategories(): Promise<string[]> {\n    return this.secrets.getCategories(requireTenantId());\n  }\n\n  /**\n   * Check if a secret exists for the current tenant\n   */\n  async exists(name: string): Promise<boolean> {\n    const tenantId = requireTenantId();\n    const secret = await this.secrets.findByName(tenantId, name);\n    return secret !== null && secret.tenantId === tenantId;\n  }\n\n  // Private methods\n\n  private async listActiveSecretRowsForDiagnosis(\n    tenantId: string,\n    secretNames?: string[],\n  ): Promise<SecretDiagnosisRow[]> {\n    const params: unknown[] = [tenantId];\n    let nameFilter = '';\n\n    if (secretNames && secretNames.length > 0) {\n      const placeholders = secretNames.map(() => '?').join(', ');\n      nameFilter = ` AND name IN (${placeholders})`;\n      params.push(...secretNames);\n    }\n\n    const result = await this.db.query(\n      `\n        SELECT id, name, encrypted_value, status, tenant_id\n        FROM \"secrets\"\n        WHERE tenant_id = ? AND status = 'active'${nameFilter}\n        ORDER BY name ASC\n      `,\n      ...params,\n    );\n\n    return this.rowsFromResult<SecretDiagnosisRow>(result);\n  }\n\n  private async listTenantEncryptionKeyRows(\n    tenantId: string,\n  ): Promise<TenantEncryptionKeyRow[]> {\n    const result = await this.db.query(\n      `\n        SELECT id, tenant_id, wrapped_key, amk_key_id, status, version,\n          rotate_after, retired_at, created_at, updated_at\n        FROM \"tenant_encryption_keys\"\n        WHERE tenant_id = ?\n        ORDER BY version DESC\n      `,\n      tenantId,\n    );\n\n    return this.rowsFromResult<TenantEncryptionKeyRow>(result);\n  }\n\n  private async listSmrtTenantKeysForDiagnosis(\n    tenantId: string,\n  ): Promise<SmrtTenantKeyDiagnosisRows> {\n    try {\n      return { keys: await this.tenantKeys.listKeyVersions(tenantId) };\n    } catch (error) {\n      return { keys: [], error: this.toError(error) };\n    }\n  }\n\n  private getConfiguredAmkForDiagnosis():\n    | { usable: true; value: Buffer }\n    | { usable: false; error: string; value?: undefined } {\n    const keyHex = process.env[this.amkEnvVar];\n    if (!keyHex) {\n      return {\n        usable: false,\n        error: `Application Master Key not found in environment variable: ${this.amkEnvVar}`,\n      };\n    }\n\n    try {\n      return {\n        usable: true,\n        value: EnvelopeEncryption.parseHexKey(keyHex),\n      };\n    } catch (error) {\n      return {\n        usable: false,\n        error: `Invalid AMK in ${this.amkEnvVar}: ${\n          this.toError(error).message\n        }`,\n      };\n    }\n  }\n\n  private checkWrappedKey(wrappedKey: string, amk: Buffer): WrappedKeyCheck {\n    const fingerprint = this.getWrappedKeyFingerprint(wrappedKey);\n\n    try {\n      const parsed = EnvelopeEncryption.parseWrappedKey(wrappedKey);\n      const dataKey = EnvelopeEncryption.unwrapKey(\n        parsed.wrappedKey,\n        parsed.iv,\n        parsed.authTag,\n        amk,\n      );\n      dataKey.fill(0);\n      return { usable: true, fingerprint };\n    } catch (error) {\n      return {\n        usable: false,\n        fingerprint,\n        error: this.toError(error).message,\n      };\n    }\n  }\n\n  private getWrappedKeyFingerprint(wrappedKey: string): string | undefined {\n    try {\n      return EnvelopeEncryption.parseWrappedKey(wrappedKey).wrappedKey;\n    } catch {\n      return undefined;\n    }\n  }\n\n  private parseSecretEnvelopeForDiagnosis(\n    secret: SecretDiagnosisRow,\n    issues: SecretKeyDriftIssue[],\n  ): EncryptedEnvelope | null {\n    try {\n      return JSON.parse(secret.encrypted_value) as EncryptedEnvelope;\n    } catch (error) {\n      issues.push({\n        code: 'secret_envelope_invalid_json',\n        severity: 'error',\n        message: 'Secret encryptedValue is not valid EncryptedEnvelope JSON.',\n        repairAction: 'delete-unrecoverable-secret',\n        secretId: secret.id,\n        secretName: secret.name,\n        sourceTable: 'secrets',\n        details: {\n          error: this.toError(error).message,\n        },\n      });\n      return null;\n    }\n  }\n\n  private async deleteRowsByIds(\n    tableName: 'secrets' | 'tenant_encryption_keys',\n    tenantId: string,\n    ids: Set<string>,\n    db: DatabaseInterface = this.db,\n  ): Promise<number> {\n    if (ids.size === 0) return 0;\n\n    const idList = Array.from(ids);\n    const placeholders = idList.map(() => '?').join(', ');\n    const result = await db.query(\n      `DELETE FROM \"${tableName}\" WHERE tenant_id = ? AND id IN (${placeholders})`,\n      tenantId,\n      ...idList,\n    );\n\n    return typeof result.rowCount === 'number'\n      ? result.rowCount\n      : idList.length;\n  }\n\n  private async auditSecretDriftRepairDeletes(\n    tenantId: string,\n    secretIds: Set<string>,\n    secretNames: Map<string, string>,\n  ): Promise<void> {\n    if (secretIds.size === 0) return;\n\n    const userId = this.getCurrentUserId();\n    await withTenant({ tenantId }, async () => {\n      for (const secretId of secretIds) {\n        await this.audit(\n          secretId,\n          secretNames.get(secretId) ?? '',\n          userId,\n          'delete',\n          'success',\n          {\n            action: 'repairTenantSecretKeyDrift',\n            reason: 'unrecoverable-secret-key-drift',\n          },\n        );\n      }\n    });\n  }\n\n  private rowsFromResult<T>(result: unknown): T[] {\n    if (Array.isArray(result)) return result as T[];\n    if (\n      result &&\n      typeof result === 'object' &&\n      Array.isArray((result as { rows?: unknown }).rows)\n    ) {\n      return (result as { rows: T[] }).rows;\n    }\n    return [];\n  }\n\n  private async classifyTenantKeyFailure(\n    tenantId: string,\n    secretName: string,\n    error: unknown,\n  ): Promise<Error> {\n    const normalized = this.toError(error);\n    if (!this.shouldClassifyTenantKeyFailure(normalized)) {\n      return normalized;\n    }\n\n    try {\n      const report = await this.diagnoseTenantSecretKeyDrift(tenantId, {\n        secretNames: [secretName],\n      });\n      const errorCodes = report.issues\n        .filter((issue) => issue.severity === 'error')\n        .map((issue) => issue.code);\n\n      if (errorCodes.length === 0) {\n        return normalized;\n      }\n\n      return new SecretKeyDriftError(\n        `Secret '${secretName}' for tenant '${tenantId}' failed because secret key drift was detected: ${[\n          ...new Set(errorCodes),\n        ].join(\n          ', ',\n        )}. Run diagnoseTenantSecretKeyDrift() for details and repairTenantSecretKeyDrift() for explicit cleanup of unrecoverable rows.`,\n        tenantId,\n        report,\n        normalized,\n      );\n    } catch {\n      return normalized;\n    }\n  }\n\n  private shouldClassifyTenantKeyFailure(error: Error): boolean {\n    const code = this.getSecretErrorCode(error);\n    if (error instanceof AMKUnavailableError || code === 'AMK_UNAVAILABLE') {\n      return false;\n    }\n\n    return (\n      error instanceof TenantKeyMissingError ||\n      error instanceof EncryptionError ||\n      error instanceof DecryptionError ||\n      code === 'TENANT_KEY_MISSING' ||\n      code === 'ENCRYPTION_FAILED' ||\n      code === 'DECRYPTION_FAILED'\n    );\n  }\n\n  private getSecretErrorCode(error: Error): string | undefined {\n    const code = (error as { code?: unknown }).code;\n    return typeof code === 'string' ? code : undefined;\n  }\n\n  private toError(error: unknown): Error {\n    return error instanceof Error ? error : new Error(String(error));\n  }\n\n  private getCurrentUserId(): string {\n    const ctx = getCurrentTenant();\n    return ctx?.userId ?? 'system';\n  }\n\n  private async audit(\n    secretId: string | null,\n    secretName: string,\n    userId: string,\n    action: SecretAuditAction,\n    result: 'success' | 'failure' | 'denied',\n    details?: Record<string, unknown>,\n  ): Promise<void> {\n    if (!this.auditEnabled) return;\n\n    try {\n      const tenantId = getCurrentTenant()?.tenantId ?? null;\n      const log = await this.auditLogs.create(\n        createAuditEntry({\n          secretId,\n          secretName,\n          userId,\n          action,\n          result,\n          details,\n          tenantId,\n        }),\n      );\n      await log.save();\n    } catch (error) {\n      // Don't throw on audit failure - log and continue\n      logger.error('Failed to write audit log', { error });\n    }\n  }\n\n  private serializeMetadata(\n    metadata: Record<string, unknown>,\n  ): Record<string, string> {\n    const result: Record<string, string> = {};\n    for (const [key, value] of Object.entries(metadata)) {\n      result[key] = typeof value === 'string' ? value : JSON.stringify(value);\n    }\n    return result;\n  }\n}\n"],"x_google_ignoreList":[3],"mappings":";;;;;;;;;;;;;AA6CA,IAAa,2BAAb,cAA8C,eAA+B;CAC3E,OAAgB,aAAa;;;;CAK7B,MAAM,SACJ,UAAgC,CAAC,GACN;EAC3B,MAAM,QAAiC,CAAC;EAExC,IAAI,QAAQ,UACV,MAAM,WAAW,QAAQ;EAG3B,IAAI,QAAQ,YACV,MAAM,aAAa,QAAQ;EAG7B,IAAI,QAAQ,QACV,MAAM,SAAS,QAAQ;EAGzB,IAAI,QAAQ,QACV,MAAM,SAAS,QAAQ;EAGzB,IAAI,QAAQ,QACV,MAAM,SAAS,QAAQ;EAGzB,IAAI,QAAQ,OACV,MAAM,kBAAkB,QAAQ,MAAM,YAAY;EAGpD,IAAI,QAAQ,OACV,MAAM,kBAAkB,QAAQ,MAAM,YAAY;EAGpD,OAAO,KAAK,KAAK;GACf;GACA,OAAO,QAAQ,SAAS;GACxB,QAAQ,QAAQ;GAChB,SAAS;EACX,CAAC;CACH;;;;;;;;;CAUA,MAAM,iBACJ,UACA,YACA,QAAgB,IACW;EAC3B,OAAO,KAAK,SAAS;GAAE,UAAU,YAAY,KAAA;GAAW;GAAY;EAAM,CAAC;CAC7E;;;;;;;CAQA,MAAM,gBACJ,UACA,QACA,QAAgB,IACW;EAC3B,OAAO,KAAK,SAAS;GAAE,UAAU,YAAY,KAAA;GAAW;GAAQ;EAAM,CAAC;CACzE;;;;;;;CAQA,MAAM,kBACJ,UACA,QAAgB,IACW;EAC3B,OAAO,KAAK,SAAS;GACnB,UAAU,YAAY,KAAA;GACtB,QAAQ;GACR;EACF,CAAC;CACH;;;;;;;CAQA,MAAM,iBACJ,UACA,QAAgB,IACW;EAC3B,OAAO,KAAK,SAAS;GACnB,UAAU,YAAY,KAAA;GACtB,QAAQ;GACR;EACF,CAAC;CACH;;;;;;;CAQA,MAAM,cACJ,UACA,OAC4C;EAC5C,MAAM,OAAO,MAAM,KAAK,SAAS;GAC/B,UAAU,YAAY,KAAA;GACtB;GACA,OAAO;EACT,CAAC;EAED,MAAM,SAA4C;GAChD,QAAQ;GACR,MAAM;GACN,QAAQ;GACR,QAAQ;GACR,YAAY;GACZ,SAAS;GACT,QAAQ;GACR,QAAQ;EACV;EAEA,KAAK,MAAM,OAAO,MAChB,OAAO,IAAI,OAAO;EAGpB,OAAO;CACT;;;;;;;CAQA,MAAM,cACJ,UACA,OAC4C;EAC5C,MAAM,OAAO,MAAM,KAAK,SAAS;GAC/B,UAAU,YAAY,KAAA;GACtB;GACA,OAAO;EACT,CAAC;EAED,MAAM,SAA4C;GAChD,SAAS;GACT,SAAS;GACT,QAAQ;EACV;EAEA,KAAK,MAAM,OAAO,MAChB,OAAO,IAAI,OAAO;EAGpB,OAAO;CACT;;;;;CAMA,MAAM,QAAQ,gBAAwB,KAAsB;EAC1D,MAAM,6BAAa,IAAI,KAAK;EAC5B,WAAW,QAAQ,WAAW,QAAQ,IAAI,aAAa;EAEvD,MAAM,UAAU,MAAM,KAAK,KAAK,EAC9B,OAAO,EACL,gBAAgB,WAAW,YAAY,EACzC,EACF,CAAC;EAED,IAAI,QAAQ;EACZ,KAAK,MAAM,OAAO,SAAS;GACzB,MAAM,IAAI,OAAO;GACjB;EACF;EAEA,OAAO;CACT;AACF;;;;;;;;;;;;;;;;;AC/MA,IAAa,mBAAb,cAAsC,eAAuB;CAC3D,OAAgB,aAAa;;;;CAK7B,MAAM,WAAW,UAAkB,MAAsC;EACvE,OAAO,KAAK,IAAI;GAAE;GAAM;EAAS,CAAC;CACpC;;;;CAKA,MAAM,YACJ,UACA,UAA8B,CAAC,GACZ;EACnB,MAAM,QAAiC,EAAE,SAAS;EAElD,IAAI,QAAQ,UACV,MAAM,WAAW,QAAQ;EAG3B,IAAI,QAAQ,QACV,MAAM,SAAS,QAAQ;EAGzB,MAAM,UAAU,MAAM,KAAK,KAAK;GAC9B;GACA,OAAO,QAAQ;GACf,QAAQ,QAAQ;GAChB,SAAS;EACX,CAAC;EAGD,IAAI,CAAC,QAAQ,gBACX,OAAO,QAAQ,QAAQ,WAAW,CAAC,OAAO,UAAU,CAAC;EAGvD,OAAO;CACT;;;;CAKA,MAAM,WAAW,UAAqC;EACpD,OAAO,KAAK,YAAY,UAAU,EAAE,QAAQ,SAAS,CAAC;CACxD;;;;CAKA,MAAM,eAAe,UAAkB,UAAqC;EAC1E,OAAO,KAAK,YAAY,UAAU;GAAE;GAAU,QAAQ;EAAS,CAAC;CAClE;;;;CAKA,MAAM,aACJ,UACA,YAAoB,IACD;EACnB,MAAM,6BAAa,IAAI,KAAK;EAC5B,WAAW,QAAQ,WAAW,QAAQ,IAAI,SAAS;EAYnD,OAAO,MAVe,KAAK,KAAK;GAC9B,OAAO;IACL;IACA,QAAQ;IACR,gBAAgB;IAChB,eAAe,WAAW,YAAY;GACxC;GACA,SAAS;EACX,CAAC;CAGH;;;;CAKA,MAAM,cAAc,UAAqC;EACvD,MAAM,UAAU,MAAM,KAAK,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;EACvD,MAAM,aAAa,IAAI,IAAI,QAAQ,KAAK,MAAM,EAAE,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC;EACzE,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,KAAK;CACrC;;;;CAKA,MAAM,cAAc,UAAyD;EAC3E,MAAM,UAAU,MAAM,KAAK,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;EAEvD,MAAM,SAAuC;GAC3C,QAAQ;GACR,UAAU;GACV,SAAS;EACX;EAEA,KAAK,MAAM,UAAU,SACnB,IAAI,OAAO,UAAU,GACnB,OAAO;OAEP,OAAO,OAAO,OAAO;EAIzB,OAAO;CACT;;;;CAKA,MAAM,aAAa,UAAkB,MAAgC;EACnE,MAAM,SAAS,MAAM,KAAK,WAAW,UAAU,IAAI;EACnD,IAAI,CAAC,QAAQ,OAAO;EAEpB,MAAM,OAAO,OAAO;EACpB,OAAO;CACT;AACF;;;;;;;;;;AChJA,IAAa,sBAAb,cAAyC,eAA0B;CACjE,OAAgB,aAAa;;;;CAK7B,MAAM,aAAa,UAA6C;EAC9D,OAAO,KAAK,IAAI;GACd;GACA,QAAQ;EACV,CAAC;CACH;;;;CAKA,MAAM,gBAAgB,UAAwC;EAC5D,OAAO,KAAK,KAAK;GACf,OAAO,EAAE,SAAS;GAClB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,cACJ,UACA,SAC2B;EAC3B,OAAO,KAAK,IAAI;GACd;GACA;EACF,CAAC;CACH;;;;CAKA,MAAM,0BAAgD;EACpD,MAAM,sBAAM,IAAI,KAAK;EAErB,OAAO,KAAK,KAAK;GACf,OAAO;IACL,QAAQ;IACR,kBAAkB;IAClB,iBAAiB,IAAI,YAAY;GACnC;GACA,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,oBAA0C;EAC9C,OAAO,KAAK,KAAK;GACf,OAAO,EAAE,QAAQ,SAAS;GAC1B,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,gBAA0D;EAC9D,MAAM,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC;EAE/B,MAAM,SAA0C;GAC9C,QAAQ;GACR,UAAU;GACV,SAAS;GACT,aAAa;EACf;EAEA,KAAK,MAAM,OAAO,MAChB,OAAO,IAAI,OAAO;EAGpB,OAAO;CACT;;;;CAKA,MAAM,gBAAgB,UAAkB,OAAiC;EACvE,MAAM,MAAM,MAAM,KAAK,IAAI;GACzB,IAAI;GACJ;EACF,CAAC;EAED,IAAI,CAAC,KAAK,OAAO;EAEjB,IAAI,gBAAgB;EACpB,MAAM,IAAI,KAAK;EACf,OAAO;CACT;;;;;CAMA,MAAM,mBAAmB,gBAAwB,IAAqB;EACpE,MAAM,6BAAa,IAAI,KAAK;EAC5B,WAAW,QAAQ,WAAW,QAAQ,IAAI,aAAa;EAEvD,MAAM,UAAU,MAAM,KAAK,KAAK,EAC9B,OAAO;GACL,QAAQ;GACR,eAAe,WAAW,YAAY;EACxC,EACF,CAAC;EAED,IAAI,QAAQ;EACZ,KAAK,MAAM,OAAO,SAAS;GACzB,MAAM,IAAI,OAAO;GACjB;EACF;EAEA,OAAO;CACT;AACF;;;ACtEA,IAAM,gBAAN,MAAM,cAAc;CAClB,YAAY,QAAQ,QAAQ;EAC1B,KAAK,QAAQ;CACf;CACA,OAAO,SAAS;EACd;EACA;EACA;EACA;CACF;;;;;;;CAOA,UAAU,OAAO;EACf,MAAM,eAAe,cAAc,OAAO,QAAQ,KAAK,KAAK;EAE5D,OADqB,cAAc,OAAO,QAAQ,KAChC,KAAK;CACzB;;;;;;;CAOA,cAAc,SAAS;EACrB,IAAI,CAAC,WAAW,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,GAC9C,OAAO;EAET,OAAO,IAAI,KAAK,UAAU,OAAO;CACnC;CACA,MAAM,SAAS,SAAS;EACtB,IAAI,KAAK,UAAU,OAAO,GACxB,QAAQ,MAAM,WAAW,UAAU,KAAK,cAAc,OAAO,GAAG;CAEpE;CACA,KAAK,SAAS,SAAS;EACrB,IAAI,KAAK,UAAU,MAAM,GACvB,QAAQ,KAAK,UAAU,UAAU,KAAK,cAAc,OAAO,GAAG;CAElE;CACA,KAAK,SAAS,SAAS;EACrB,IAAI,KAAK,UAAU,MAAM,GACvB,QAAQ,KAAK,UAAU,UAAU,KAAK,cAAc,OAAO,GAAG;CAElE;CACA,MAAM,SAAS,SAAS;EACtB,IAAI,KAAK,UAAU,OAAO,GACxB,QAAQ,MAAM,WAAW,UAAU,KAAK,cAAc,OAAO,GAAG;CAEpE;AACF;AACA,IAAM,aAAN,MAAiB;CACf,MAAM,UAAU,UAAU,CAC1B;CACA,KAAK,UAAU,UAAU,CACzB;CACA,KAAK,UAAU,UAAU,CACzB;CACA,MAAM,UAAU,UAAU,CAC1B;AACF;AACA,SAAS,aAAa,QAAQ;CAC5B,IAAI,OAAO,WAAW,WAAW;EAC/B,IAAI,CAAC,QACH,OAAO,IAAI,WAAW;EASxB,OAAO,IAAI,cAPO,cAChB,CAAC,GACD;GACE,aAAa;GACb,QAAQ,EAAE,OAAO,SAAS;EAC5B,CAE+B,CAAC,CAAC,SAAS,MAAM;CACpD;CAMA,OAAO,IAAI,cALU,cAAc,QAAQ;EACzC,aAAa;EACb,QAAQ,EAAE,OAAO,SAAS;CAC5B,CACyB,CAAC,CAAC,SAAS,MACN;AAChC;;;AC7GA,IAAM,SAAS,aAAa,EAAE,OAAO,OAAO,CAAC;AAiI7C,IAAa,sBAAb,cAAyC,MAAM;CAC7C,OAAgB;CAChB;CACA;CACA;CAEA,YACE,SACA,UACA,QACA,OACA;EACA,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,WAAW;EAChB,KAAK,SAAS;EACd,KAAK,QAAQ;CACf;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6EA,IAAa,gBAAb,MAAa,cAAc;CACzB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YACE,IACA,aACA,SACA,YACA,WACA,cACA,WACA,UACA;EACA,KAAK,KAAK;EACV,KAAK,cAAc;EACnB,KAAK,UAAU;EACf,KAAK,aAAa;EAClB,KAAK,YAAY;EACjB,KAAK,eAAe;EACpB,KAAK,YAAY;EACjB,KAAK,WAAW;CAClB;;;;CAKA,aAAa,OAAO,SAAuD;EACzE,MAAM,EACJ,IACA,YAAY,0BACZ,WAAW,eACX,eAAe,SACb;EAGJ,MAAM,cAAc,MAAM,eAAe;GACvC,MAAM;GACN;GACA,KAAK;IACH,UAAU;IACV,WAAW;IACX,OAAO;GACT;EACF,CAAC;EAGD,MAAM,cAAc,EAAE,GAAG;EAKzB,OAAO,IAAI,cACT,IACA,aACA,MAPoB,iBAAiB,OAAO,WAAW,GAQvD,MAPuB,oBAAoB,OAAO,WAAW,GAQ7D,MAPsB,yBAAyB,OAAO,WAAW,GAQjE,cACA,WACA,QACF;CACF;;;;CAKA,MAAM,MACJ,MACA,OACA,UAA8B,CAAC,GACd;EACjB,MAAM,WAAW,gBAAgB;EACjC,MAAM,SAAS,KAAK,iBAAiB;EAGrC,IAAI,WAAW;EAEf,IAAI;GAIF,IAAI,WAAW,MAAM,KAAK,QAAQ,WAAW,UAAU,IAAI;GAI3D,IAAI,YAAY,SAAS,aAAa,UACpC,WAAW;GAEb,WAAW,aAAa;GAGxB,MAAM,WAAW,MAAM,KAAK,YAAY,QAAQ,UAAU,MAAM,OAAO,EACrE,UAAU,QAAQ,WACd,KAAK,kBAAkB,QAAQ,QAAQ,IACvC,KAAA,EACN,CAAC;GAED,IAAI,UAAU;IAEZ,SAAS,iBAAiB,KAAK,UAAU,QAAQ;IACjD,SAAS,cAAc,QAAQ,eAAe,SAAS;IACvD,SAAS,WAAW,QAAQ,YAAY,SAAS;IACjD,SAAS,YAAY,QAAQ,aAAa,SAAS;IACnD,SAAS,WAAW,QAAQ,YAAY,SAAS;IACjD,MAAM,SAAS,KAAK;IAEpB,MAAM,KAAK,MACT,SAAS,MAAM,MACf,MACA,QACA,UACA,SACF;IACA,OAAO;GACT;GAMA,MAAM,SAAS,MAAM,KAAK,QAAQ,OAAO;IACvC;IACA,aAAa,QAAQ,eAAe;IACpC,UAAU,QAAQ,YAAY;IAC9B,gBAAgB,KAAK,UAAU,QAAQ;IACvC,YAAY;IACZ,QAAQ;IACR,WAAW,QAAQ,aAAa;IAChC,UAAU,QAAQ,YAAY,CAAC;IAC/B,SAAS;IACT;GACF,CAAC;GAED,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,MAAM,QAAQ,UAAU,SAAS;GACrE,OAAO;EACT,SAAS,OAAO;GACd,MAAM,kBAAkB,MAAM,KAAK,yBACjC,UACA,MACA,KACF;GACA,MAAM,KAAK,MACT,MACA,MACA,QACA,WAAW,WAAW,UACtB,WACA,EACE,OAAO,gBAAgB,QACzB,CACF;GACA,MAAM;EACR;CACF;;;;;;;CAQA,MAAM,eACJ,UACA,MACA,OACA,UAA8B,CAAC,GACd;EACjB,OAAO,WAAW,EAAE,SAAS,SAAS,KAAK,MAAM,MAAM,OAAO,OAAO,CAAC;CACxE;;;;CAKA,MAAM,SAAS,MAAwC;EACrD,MAAM,WAAW,gBAAgB;EACjC,MAAM,SAAS,KAAK,iBAAiB;EAGrC,IAAI,UAAU;EAEd,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,UAAU,IAAI;GAI3D,IAAI,CAAC,UAAU,OAAO,aAAa,UAAU;IAC3C,MAAM,KAAK,MAAM,MAAM,MAAM,QAAQ,QAAQ,WAAW,EACtD,OAAO,mBACT,CAAC;IACD,UAAU;IACV,MAAM,IAAI,MAAM,WAAW,KAAK,YAAY;GAC9C;GAEA,IAAI,CAAC,OAAO,SAAS,GAAG;IACtB,MAAM,SAAS,OAAO,UAAU,IAC5B,mBACA;IACJ,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,MAAM,QAAQ,QAAQ,WAAW,EACnE,OAAO,OACT,CAAC;IACD,UAAU;IACV,MAAM,IAAI,MAAM,MAAM;GACxB;GAGA,MAAM,WAA8B,KAAK,MAAM,OAAO,cAAc;GACpE,MAAM,YAAY,MAAM,KAAK,YAAY,QAAQ,UAAU,QAAQ;GAInE,MAAM,yBAAyB,OAAO;GACtC,MAAM,sBAAsB,OAAO;GACnC,IAAI;IACF,OAAO,aAAa;IACpB,MAAM,OAAO,KAAK;GACpB,SAAS,eAAe;IACtB,OAAO,iBAAiB;IACxB,OAAO,cAAc;IACrB,OAAO,MAAM,2CAA2C,EACtD,OAAO,cACT,CAAC;GACH;GAEA,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,MAAM,QAAQ,QAAQ,SAAS;GAEnE,OAAO;IACL,OAAO,UAAU;IACjB,MAAM,OAAO;IACb,aAAa,OAAO;IACpB,UAAU,OAAO;IACjB,WAAW,OAAO;IAClB,WAAW,OAAO,8BAAc,IAAI,KAAK;IACzC,gBAAgB,OAAO;IACvB,aAAa,OAAO;IACpB,UAAU,OAAO;GACnB;EACF,SAAS,OAAO;GACd,MAAM,kBAAkB,MAAM,KAAK,yBACjC,UACA,MACA,KACF;GAEA,IAAI,CAAC,SACH,MAAM,KAAK,MAAM,MAAM,MAAM,QAAQ,QAAQ,WAAW,EACtD,OAAO,gBAAgB,QACzB,CAAC;GAEH,MAAM;EACR;CACF;;;;CAKA,MAAM,kBACJ,UACA,MAC0B;EAC1B,OAAO,WAAW,EAAE,SAAS,SAAS,KAAK,SAAS,IAAI,CAAC;CAC3D;;;;CAKA,MAAM,6BACJ,UACA,UAA+C,CAAC,GACjB;EAC/B,MAAM,gBAAgB,MAAM,KAAK,iCAC/B,UACA,QAAQ,WACV;EACA,MAAM,uBACJ,MAAM,KAAK,4BAA4B,QAAQ;EACjD,MAAM,oBACJ,MAAM,KAAK,+BAA+B,QAAQ;EACpD,MAAM,iBAAiB,kBAAkB;EACzC,MAAM,SAAgC,CAAC;EAEvC,MAAM,6BAA6B,qBAAqB,QACrD,QAAQ,IAAI,WAAW,QAC1B;EACA,MAAM,uBAAuB,eAAe,QACzC,QAAQ,IAAI,WAAW,QAC1B;EACA,MAAM,MAAM,KAAK,6BAA6B;EAE9C,IAAI,CAAC,IAAI,QACP,OAAO,KAAK;GACV,MAAM;GACN,UAAU;GACV,SAAS,IAAI,SAAS,OAAO,KAAK,UAAU;GAC5C,cAAc;GACd,SAAS;IACP,WAAW,KAAK;IAChB,UAAU,KAAK;GACjB;EACF,CAAC;EAGH,IAAI,cAAc,SAAS,KAAK,2BAA2B,WAAW,GACpE,OAAO,KAAK;GACV,MAAM;GACN,UAAU;GACV,SACE;GACF,cAAc;GACd,aAAa;GACb,SAAS,EACP,mBAAmB,cAAc,OACnC;EACF,CAAC;EAGH,IAAI,kBAAkB,OACpB,OAAO,KAAK;GACV,MAAM;GACN,UAAU;GACV,SACE;GACF,cAAc;GACd,aAAa;GACb,SAAS,EACP,OAAO,kBAAkB,MAAM,QACjC;EACF,CAAC;EAGH,IAAI,2BAA2B,SAAS,GACtC,OAAO,KAAK;GACV,MAAM;GACN,UAAU;GACV,SACE;GACF,cAAc;GACd,aAAa;GACb,SAAS,EACP,gCAAgC,2BAA2B,OAC7D;EACF,CAAC;EAGH,MAAM,kBAAqC,CAAC;EAE5C,KAAK,MAAM,OAAO,sBAAsB;GACtC,MAAM,QAAQ,IAAI,QACd,KAAK,gBAAgB,IAAI,aAAa,IAAI,KAAK,IAC/C;IAAE,QAAQ;IAAO,OAAO,IAAI;GAAM;GAEtC,IAAI,IAAI,WAAW,UACjB,gBAAgB,KAAK,KAAK;GAG5B,IAAI,IAAI,WAAW,YAAY,IAAI,eAAe,KAAK,UACrD,OAAO,KAAK;IACV,MAAM;IACN,UAAU;IACV,SACE;IACF,cAAc;IACd,OAAO,IAAI;IACX,aAAa;IACb,SAAS;KACP,aAAa,IAAI;KACjB,oBAAoB,KAAK;IAC3B;GACF,CAAC;GAGH,IAAI,IAAI,WAAW,YAAY,CAAC,MAAM,UAAU,IAAI,OAClD,OAAO,KAAK;IACV,MAAM;IACN,UAAU;IACV,SACE;IACF,cAAc;IACd,OAAO,IAAI;IACX,aAAa;IACb,SAAS;KACP,SAAS,IAAI;KACb,OAAO,MAAM,SAAS;IACxB;GACF,CAAC;EAEL;EAEA,MAAM,uCAAuC,gBAAgB,QAC1D,UAAU,MAAM,MACnB,CAAC,CAAC;EAEF,IACE,cAAc,SAAS,KACvB,yCAAyC,GAEzC,OAAO,KAAK;GACV,MAAM;GACN,UAAU;GACV,SACE;GACF,cAAc;GACd,aAAa;GACb,SAAS;IACP,mBAAmB,cAAc;IACjC,gCAAgC,2BAA2B;GAC7D;EACF,CAAC;EAGH,MAAM,sCAAsB,IAAI,IAAoC;EACpE,KAAK,MAAM,OAAO,sBAAsB;GACtC,MAAM,cAAc,KAAK,yBAAyB,IAAI,WAAW;GACjE,IAAI,aACF,oBAAoB,IAAI,aAAa,GAAG;EAE5C;EAEA,KAAK,MAAM,UAAU,eAAe;GAClC,MAAM,WAAW,KAAK,gCAAgC,QAAQ,MAAM;GACpE,IAAI,CAAC,UAAU;GAEf,MAAM,sBAAsB,KAAK,yBAC/B,SAAS,UACX;GACA,MAAM,gBAAgB,IAAI,QACtB,KAAK,gBAAgB,SAAS,YAAY,IAAI,KAAK,IACnD;IACE,QAAQ;IACR,OAAO,IAAI;IACX,aAAa;GACf;GAEJ,IAAI,CAAC,cAAc,aAAa;IAC9B,OAAO,KAAK;KACV,MAAM;KACN,UAAU;KACV,SACE;KACF,cAAc;KACd,UAAU,OAAO;KACjB,YAAY,OAAO;KACnB,aAAa;KACb,SAAS,EACP,OAAO,cAAc,SAAS,KAChC;IACF,CAAC;IACD;GACF;GAEA,MAAM,cAAc,oBAAoB,IAAI,cAAc,WAAW;GACrE,IAAI,CAAC,aACH,OAAO,KAAK;IACV,MAAM;IACN,UAAU;IACV,SACE;IACF,cAAc,CAAC,IAAI,QACf,SACA,cAAc,SACZ,SACA;IACN,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,aAAa;GACf,CAAC;GAGH,IAAI,CAAC,cAAc,UAAU,IAAI,OAC/B,OAAO,KAAK;IACV,MAAM;IACN,UAAU;IACV,SACE;IACF,cAAc;IACd,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,OAAO,aAAa;IACpB,aAAa;IACb,SAAS,EACP,OAAO,cAAc,SAAS,KAChC;GACF,CAAC;EAEL;EAEA,IACE,cAAc,SAAS,KACvB,qBAAqB,SAAS,KAC9B,eAAe,WAAW,KAC1B,CAAC,kBAAkB,OAEnB,OAAO,KAAK;GACV,MAAM;GACN,UAAU;GACV,SACE;GACF,cAAc;GACd,aAAa;EACf,CAAC;EAGH,OAAO;GACL;GACA,2BAAW,IAAI,KAAK;GACpB,IAAI,CAAC,OAAO,MAAM,UAAU,MAAM,aAAa,OAAO;GACtD,SAAS;IACP,mBAAmB,cAAc;IACjC,0BAA0B,qBAAqB;IAC/C,gCAAgC,2BAA2B;IAC3D;IACA,oBAAoB,eAAe;IACnC,0BAA0B,qBAAqB;GACjD;GACA;EACF;CACF;;;;CAKA,MAAM,oCACJ,UAA+C,CAAC,GACjB;EAC/B,OAAO,KAAK,6BAA6B,gBAAgB,GAAG,OAAO;CACrE;;;;;;;CAQA,MAAM,2BACJ,UACA,UAA6C,CAAC,GACT;EACrC,MAAM,SAAS,QAAQ,UAAU;EACjC,MAAM,SAAS,MAAM,KAAK,6BAA6B,UAAU,OAAO;EACxE,MAAM,4BAAY,IAAI,IAAY;EAClC,MAAM,8BAAc,IAAI,IAAoB;EAC5C,MAAM,yCAAyB,IAAI,IAAY;EAE/C,KAAK,MAAM,SAAS,OAAO,QAAQ;GACjC,IACE,MAAM,iBAAiB,iCACvB,MAAM,UACN;IACA,UAAU,IAAI,MAAM,QAAQ;IAC5B,IAAI,MAAM,YACR,YAAY,IAAI,MAAM,UAAU,MAAM,UAAU;GAEpD;GAEA,IACE,MAAM,iBAAiB,2CACvB,MAAM,OAEN,uBAAuB,IAAI,MAAM,KAAK;EAE1C;EAEA,MAAM,qBAAqB,UAAU;EACrC,MAAM,kCAAkC,uBAAuB;EAC/D,MAAM,+BACJ,qBAAqB,kCAAkC;EAEzD,IACE,CAAC,UACD,gCACA,CAAC,QAAQ,gCAET,MAAM,IAAI,MACR,gIACF;EAGF,IAAI,iBAAiB;EACrB,IAAI,8BAA8B;EAElC,IAAI,CAAC,QAAQ;GACX,MAAM,aAAa,OAAO,OAA0B;IAalD,OAAO;KACL,gBAAgB,MAbc,KAAK,gBACnC,WACA,UACA,WACA,EACF;KASE,6BAA6B,MARc,KAAK,gBAChD,0BACA,UACA,wBACA,EACF;IAIA;GACF;GACA,MAAM,OAAO,KAAK;GAClB,MAAM,eACJ,OAAO,KAAK,gBAAgB,aACxB,MAAM,KAAK,aAAa,OAAO,WAAW,EAAE,CAAC,IAC7C,MAAM,WAAW,KAAK,EAAE;GAE9B,iBAAiB,aAAa;GAC9B,8BAA8B,aAAa;GAC3C,MAAM,KAAK,8BACT,UACA,WACA,WACF;EACF;EAEA,MAAM,QAAQ,SACV,SACA,MAAM,KAAK,6BAA6B,UAAU,OAAO;EAE7D,OAAO;GACL;GACA;GACA,cAAc,OAAO;GACrB,iBAAiB,MAAM;GACvB;GACA;GACA;GACA;GACA,aAAa,MAAM,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK;GACnD,wBAAwB,MAAM,KAAK,sBAAsB,CAAC,CAAC,KAAK;EAClE;CACF;;;;CAKA,MAAM,KAAK,UAAiC,CAAC,GAAsB;EACjE,OAAO,KAAK,QAAQ,YAAY,gBAAgB,GAAG;GACjD,UAAU,QAAQ;GAClB,QAAQ;EACV,CAAC;CACH;;;;CAKA,MAAM,OAAO,MAAgC;EAC3C,MAAM,WAAW,gBAAgB;EACjC,MAAM,SAAS,KAAK,iBAAiB;EAErC,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,UAAU,IAAI;EAE3D,IAAI,CAAC,UAAU,OAAO,aAAa,UACjC,OAAO;EAGT,IAAI;GACF,MAAM,OAAO,OAAO;GACpB,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,MAAM,QAAQ,UAAU,SAAS;GACrE,OAAO;EACT,SAAS,OAAO;GACd,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,MAAM,QAAQ,UAAU,WAAW,EACrE,OAAQ,MAAgB,QAC1B,CAAC;GACD,MAAM;EACR;CACF;;;;CAKA,MAAM,QAAQ,MAAgC;EAC5C,MAAM,WAAW,gBAAgB;EACjC,MAAM,SAAS,KAAK,iBAAiB;EAErC,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,UAAU,IAAI;EAE3D,IAAI,CAAC,UAAU,OAAO,aAAa,UACjC,OAAO;EAGT,OAAO,QAAQ;EACf,MAAM,OAAO,KAAK;EAClB,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,MAAM,QAAQ,WAAW,SAAS;EACtE,OAAO;CACT;;;;CAKA,MAAM,OAAO,MAAgC;EAC3C,MAAM,WAAW,gBAAgB;EACjC,MAAM,SAAS,KAAK,iBAAiB;EAErC,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,UAAU,IAAI;EAE3D,IAAI,CAAC,UAAU,OAAO,aAAa,UACjC,OAAO;EAGT,OAAO,OAAO;EACd,MAAM,OAAO,KAAK;EAClB,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,MAAM,QAAQ,UAAU,SAAS;EACrE,OAAO;CACT;;;;;;;;;;CAWA,MAAM,YAA2B;EAC/B,MAAM,WAAW,gBAAgB;EACjC,MAAM,SAAS,KAAK,iBAAiB;EAErC,IAAI;GACF,MAAM,KAAK,YAAY,gBAAgB,QAAQ;GAC/C,MAAM,KAAK,MAAM,MAAM,IAAI,QAAQ,cAAc,WAAW,EAC1D,SACF,CAAC;EACH,SAAS,OAAO;GACd,MAAM,KAAK,MAAM,MAAM,IAAI,QAAQ,cAAc,WAAW;IAC1D;IACA,OAAQ,MAAgB;GAC1B,CAAC;GACD,MAAM;EACR;CACF;;;;;;;CAQA,MAAM,eAA6D;EACjE,MAAM,WAAW,gBAAgB;EACjC,MAAM,SAAS,KAAK,iBAAiB;EAIrC,MAAM,UAAU,MAAM,KAAK,QAAQ,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;EAC/D,IAAI,UAAU;EACd,IAAI,SAAS;EAEb,KAAK,MAAM,UAAU,SACnB,IAAI;GAEF,MAAM,WAA8B,KAAK,MAAM,OAAO,cAAc;GACpE,MAAM,YAAY,MAAM,KAAK,YAAY,QAAQ,UAAU,QAAQ;GAGnE,MAAM,cAAc,MAAM,KAAK,YAAY,QACzC,UACA,OAAO,MACP,UAAU,KACZ;GAEA,OAAO,iBAAiB,KAAK,UAAU,WAAW;GAClD,MAAM,OAAO,KAAK;GAElB;EACF,SAAS,OAAO;GACd;GACA,MAAM,KAAK,MACT,OAAO,MAAM,MACb,OAAO,MACP,QACA,UACA,WACA;IACE,QAAQ;IACR,OAAQ,MAAgB;GAC1B,CACF;EACF;EAGF,OAAO;GAAE;GAAS;EAAO;CAC3B;;;;CAKA,MAAM,aACJ,UAAmD,CAAC,GACzB;EAC3B,OAAO,KAAK,UAAU,SAAS;GAG7B,UAAU,gBAAgB;GAC1B,YAAY,QAAQ;GACpB,OAAO,QAAQ,SAAS;EAC1B,CAAC;CACH;;;;CAKA,MAAM,gBAAmC;EACvC,OAAO,KAAK,QAAQ,cAAc,gBAAgB,CAAC;CACrD;;;;CAKA,MAAM,OAAO,MAAgC;EAC3C,MAAM,WAAW,gBAAgB;EACjC,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,UAAU,IAAI;EAC3D,OAAO,WAAW,QAAQ,OAAO,aAAa;CAChD;CAIA,MAAc,iCACZ,UACA,aAC+B;EAC/B,MAAM,SAAoB,CAAC,QAAQ;EACnC,IAAI,aAAa;EAEjB,IAAI,eAAe,YAAY,SAAS,GAAG;GAEzC,aAAa,iBADQ,YAAY,UAAU,GAAG,CAAC,CAAC,KAAK,IACvB,EAAa;GAC3C,OAAO,KAAK,GAAG,WAAW;EAC5B;EAEA,MAAM,SAAS,MAAM,KAAK,GAAG,MAC3B;;;mDAG6C,WAAW;;SAGxD,GAAG,MACL;EAEA,OAAO,KAAK,eAAmC,MAAM;CACvD;CAEA,MAAc,4BACZ,UACmC;EACnC,MAAM,SAAS,MAAM,KAAK,GAAG,MAC3B;;;;;;SAOA,QACF;EAEA,OAAO,KAAK,eAAuC,MAAM;CAC3D;CAEA,MAAc,+BACZ,UACqC;EACrC,IAAI;GACF,OAAO,EAAE,MAAM,MAAM,KAAK,WAAW,gBAAgB,QAAQ,EAAE;EACjE,SAAS,OAAO;GACd,OAAO;IAAE,MAAM,CAAC;IAAG,OAAO,KAAK,QAAQ,KAAK;GAAE;EAChD;CACF;CAEA,+BAEwD;EACtD,MAAM,SAAS,QAAQ,IAAI,KAAK;EAChC,IAAI,CAAC,QACH,OAAO;GACL,QAAQ;GACR,OAAO,6DAA6D,KAAK;EAC3E;EAGF,IAAI;GACF,OAAO;IACL,QAAQ;IACR,OAAO,mBAAmB,YAAY,MAAM;GAC9C;EACF,SAAS,OAAO;GACd,OAAO;IACL,QAAQ;IACR,OAAO,kBAAkB,KAAK,UAAU,IACtC,KAAK,QAAQ,KAAK,CAAC,CAAC;GAExB;EACF;CACF;CAEA,gBAAwB,YAAoB,KAA8B;EACxE,MAAM,cAAc,KAAK,yBAAyB,UAAU;EAE5D,IAAI;GACF,MAAM,SAAS,mBAAmB,gBAAgB,UAAU;GAO5D,mBANmC,UACjC,OAAO,YACP,OAAO,IACP,OAAO,SACP,GAEF,CAAA,CAAQ,KAAK,CAAC;GACd,OAAO;IAAE,QAAQ;IAAM;GAAY;EACrC,SAAS,OAAO;GACd,OAAO;IACL,QAAQ;IACR;IACA,OAAO,KAAK,QAAQ,KAAK,CAAC,CAAC;GAC7B;EACF;CACF;CAEA,yBAAiC,YAAwC;EACvE,IAAI;GACF,OAAO,mBAAmB,gBAAgB,UAAU,CAAC,CAAC;EACxD,QAAQ;GACN;EACF;CACF;CAEA,gCACE,QACA,QAC0B;EAC1B,IAAI;GACF,OAAO,KAAK,MAAM,OAAO,eAAe;EAC1C,SAAS,OAAO;GACd,OAAO,KAAK;IACV,MAAM;IACN,UAAU;IACV,SAAS;IACT,cAAc;IACd,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,aAAa;IACb,SAAS,EACP,OAAO,KAAK,QAAQ,KAAK,CAAC,CAAC,QAC7B;GACF,CAAC;GACD,OAAO;EACT;CACF;CAEA,MAAc,gBACZ,WACA,UACA,KACA,KAAwB,KAAK,IACZ;EACjB,IAAI,IAAI,SAAS,GAAG,OAAO;EAE3B,MAAM,SAAS,MAAM,KAAK,GAAG;EAC7B,MAAM,eAAe,OAAO,UAAU,GAAG,CAAC,CAAC,KAAK,IAAI;EACpD,MAAM,SAAS,MAAM,GAAG,MACtB,gBAAgB,UAAU,mCAAmC,aAAa,IAC1E,UACA,GAAG,MACL;EAEA,OAAO,OAAO,OAAO,aAAa,WAC9B,OAAO,WACP,OAAO;CACb;CAEA,MAAc,8BACZ,UACA,WACA,aACe;EACf,IAAI,UAAU,SAAS,GAAG;EAE1B,MAAM,SAAS,KAAK,iBAAiB;EACrC,MAAM,WAAW,EAAE,SAAS,GAAG,YAAY;GACzC,KAAK,MAAM,YAAY,WACrB,MAAM,KAAK,MACT,UACA,YAAY,IAAI,QAAQ,KAAK,IAC7B,QACA,UACA,WACA;IACE,QAAQ;IACR,QAAQ;GACV,CACF;EAEJ,CAAC;CACH;CAEA,eAA0B,QAAsB;EAC9C,IAAI,MAAM,QAAQ,MAAM,GAAG,OAAO;EAClC,IACE,UACA,OAAO,WAAW,YAClB,MAAM,QAAS,OAA8B,IAAI,GAEjD,OAAQ,OAAyB;EAEnC,OAAO,CAAC;CACV;CAEA,MAAc,yBACZ,UACA,YACA,OACgB;EAChB,MAAM,aAAa,KAAK,QAAQ,KAAK;EACrC,IAAI,CAAC,KAAK,+BAA+B,UAAU,GACjD,OAAO;EAGT,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,6BAA6B,UAAU,EAC/D,aAAa,CAAC,UAAU,EAC1B,CAAC;GACD,MAAM,aAAa,OAAO,OACvB,QAAQ,UAAU,MAAM,aAAa,OAAO,CAAC,CAC7C,KAAK,UAAU,MAAM,IAAI;GAE5B,IAAI,WAAW,WAAW,GACxB,OAAO;GAGT,OAAO,IAAI,oBACT,WAAW,WAAW,gBAAgB,SAAS,kDAAkD,CAC/F,GAAG,IAAI,IAAI,UAAU,CACvB,CAAC,CAAC,KACA,IACF,EAAE,gIACF,UACA,QACA,UACF;EACF,QAAQ;GACN,OAAO;EACT;CACF;CAEA,+BAAuC,OAAuB;EAC5D,MAAM,OAAO,KAAK,mBAAmB,KAAK;EAC1C,IAAI,iBAAiB,uBAAuB,SAAS,mBACnD,OAAO;EAGT,OACE,iBAAiB,yBACjB,iBAAiB,mBACjB,iBAAiB,mBACjB,SAAS,wBACT,SAAS,uBACT,SAAS;CAEb;CAEA,mBAA2B,OAAkC;EAC3D,MAAM,OAAQ,MAA6B;EAC3C,OAAO,OAAO,SAAS,WAAW,OAAO,KAAA;CAC3C;CAEA,QAAgB,OAAuB;EACrC,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;CACjE;CAEA,mBAAmC;EAEjC,OADY,iBACL,CAAA,EAAK,UAAU;CACxB;CAEA,MAAc,MACZ,UACA,YACA,QACA,QACA,QACA,SACe;EACf,IAAI,CAAC,KAAK,cAAc;EAExB,IAAI;GACF,MAAM,WAAW,iBAAiB,CAAC,EAAE,YAAY;GAYjD,OAAM,MAXY,KAAK,UAAU,OAC/B,iBAAiB;IACf;IACA;IACA;IACA;IACA;IACA;IACA;GACF,CAAC,CACH,EAAA,CACU,KAAK;EACjB,SAAS,OAAO;GAEd,OAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC;EACrD;CACF;CAEA,kBACE,UACwB;EACxB,MAAM,SAAiC,CAAC;EACxC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,GAChD,OAAO,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;EAExE,OAAO;CACT;AACF"}