@iflow-mcp/jkheadley-instar 0.26.2

package/dist/core/SecretRedactor.d.ts

@@ -0,0 +1,121 @@
+/**
+ * SecretRedactor — Redact secrets from content before LLM exposure.
+ *
+ * Two-layer detection:
+ *   1. Pattern matching — known secret formats (API keys, connection strings, etc.)
+ *   2. Entropy scanning — high-entropy strings that may be non-standard secrets
+ *
+ * Replacement is indexed for provenance-aware restoration after LLM resolution.
+ *
+ * From INTELLIGENT_SYNC_SPEC Section 5.3 (Secret Redaction).
+ */
+export type SecretType = 'api-key' | 'connection-string' | 'private-key' | 'jwt' | 'high-entropy' | 'env-ref';
+export interface RedactionEntry {
+    /** Index for replacement tracking. */
+    index: number;
+    /** The type of secret detected. */
+    type: SecretType;
+    /** Original value (stored in-memory only, never logged). */
+    originalValue: string;
+    /** Which file section this was found in (for provenance). */
+    fileSection: 'ours' | 'theirs' | 'base' | 'unknown';
+    /** Start offset in the original content. */
+    startOffset: number;
+    /** End offset in the original content. */
+    endOffset: number;
+}
+export interface RedactionResult {
+    /** The redacted content. */
+    content: string;
+    /** The redaction map (for restoration). */
+    redactions: RedactionEntry[];
+    /** Total number of redactions performed. */
+    count: number;
+    /** Summary by type (for logging). */
+    typeCounts: Record<SecretType, number>;
+}
+export interface RestorationResult {
+    /** The restored content. */
+    content: string;
+    /** Number of secrets restored. */
+    restored: number;
+    /** Number of secrets NOT restored (provenance mismatch). */
+    blocked: number;
+    /** Entries that were blocked. */
+    blockedEntries: Array<{
+        index: number;
+        reason: string;
+    }>;
+}
+export interface FileExclusionResult {
+    /** Whether the file should be excluded from LLM resolution. */
+    excluded: boolean;
+    /** Reason for exclusion. */
+    reason?: string;
+}
+export interface SecretRedactorConfig {
+    /** Custom secret patterns to add. */
+    customPatterns?: SecretPattern[];
+    /** Entropy threshold (default: 4.5 bits/char). */
+    entropyThreshold?: number;
+    /** Minimum length for entropy scanning (default: 20). */
+    entropyMinLength?: number;
+    /** Maximum high-entropy strings before excluding file (default: 5). */
+    maxEntropyStringsBeforeExclusion?: number;
+    /** Additional file patterns to exclude. */
+    excludePatterns?: string[];
+}
+export interface SecretPattern {
+    /** Pattern name/type. */
+    type: SecretType;
+    /** Regex pattern to match. */
+    pattern: RegExp;
+}
+export declare class SecretRedactor {
+    private patterns;
+    private entropyThreshold;
+    private entropyMinLength;
+    private maxEntropyStrings;
+    private excludePatterns;
+    constructor(config?: SecretRedactorConfig);
+    /**
+     * Check whether a file should be excluded from LLM resolution entirely.
+     */
+    shouldExcludeFile(filePath: string, content?: string): FileExclusionResult;
+    /**
+     * Redact secrets from content.
+     * Returns the redacted content and a map for later restoration.
+     */
+    redact(content: string, fileSection?: RedactionEntry['fileSection']): RedactionResult;
+    /**
+     * Restore redacted secrets in LLM output.
+     *
+     * Provenance-aware: only restores a secret to a region matching its
+     * original file section. If a placeholder appears in a mismatched
+     * region, it is NOT restored and flagged for human review.
+     */
+    restore(content: string, redactions: RedactionEntry[], currentSection?: RedactionEntry['fileSection']): RestorationResult;
+    /**
+     * Calculate Shannon entropy of a string (bits per character).
+     */
+    shannonEntropy(str: string): number;
+    /**
+     * Find high-entropy strings in content (Layer 2).
+     */
+    private findHighEntropyStrings;
+    /**
+     * Check if a high-entropy string is likely NOT a secret
+     * (URLs, file paths, common code constructs).
+     */
+    private isLikelyNonSecret;
+    /**
+     * Check if a position falls inside an already-detected redaction range.
+     */
+    private isInsideRedaction;
+    /**
+     * Hash content for audit trail (does NOT contain secrets).
+     * Uses SHA-256 truncated to 16 hex chars.
+     */
+    static hashContent(content: string): string;
+}
+//# sourceMappingURL=SecretRedactor.d.ts.map

package/dist/core/SecretRedactor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretRedactor.d.ts","sourceRoot":"","sources":["../../src/core/SecretRedactor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,mBAAmB,GACnB,aAAa,GACb,KAAK,GACL,cAAc,GACd,SAAS,CAAC;AAEd,MAAM,WAAW,cAAc;IAC7B,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,IAAI,EAAE,UAAU,CAAC;IACjB,4DAA4D;IAC5D,aAAa,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;IACpD,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,iBAAiB;IAChC,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,cAAc,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,QAAQ,EAAE,OAAO,CAAC;IAClB,4BAA4B;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,qCAAqC;IACrC,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uEAAuE;IACvE,gCAAgC,CAAC,EAAE,MAAM,CAAC;IAC1C,2CAA2C;IAC3C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,yBAAyB;IACzB,IAAI,EAAE,UAAU,CAAC;IACjB,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;CACjB;AA2DD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,eAAe,CAAW;gBAEtB,MAAM,CAAC,EAAE,oBAAoB;IAgBzC;;OAEG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,mBAAmB;IAwB1E;;;OAGG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,GAAE,cAAc,CAAC,aAAa,CAAa,GAAG,eAAe;IA0EhG;;;;;;OAMG;IACH,OAAO,CACL,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,cAAc,EAAE,EAC5B,cAAc,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,GAC7C,iBAAiB;IA2DpB;;OAEG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAoBnC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA6B9B;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAezB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAMzB;;;OAGG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;CAG5C"}

package/dist/core/SecretRedactor.js

@@ -0,0 +1,309 @@
+/**
+ * SecretRedactor — Redact secrets from content before LLM exposure.
+ *
+ * Two-layer detection:
+ *   1. Pattern matching — known secret formats (API keys, connection strings, etc.)
+ *   2. Entropy scanning — high-entropy strings that may be non-standard secrets
+ *
+ * Replacement is indexed for provenance-aware restoration after LLM resolution.
+ *
+ * From INTELLIGENT_SYNC_SPEC Section 5.3 (Secret Redaction).
+ */
+import crypto from 'node:crypto';
+// ── Constants ────────────────────────────────────────────────────────
+const DEFAULT_ENTROPY_THRESHOLD = 4.5;
+const DEFAULT_ENTROPY_MIN_LENGTH = 20;
+const DEFAULT_MAX_ENTROPY_BEFORE_EXCLUSION = 5;
+/**
+ * Built-in secret patterns — Layer 1 detection.
+ */
+const BUILTIN_PATTERNS = [
+    // API keys
+    { type: 'api-key', pattern: /\bsk-[a-zA-Z0-9_-]{20,}\b/g },
+    { type: 'api-key', pattern: /\bsk-ant-api[a-zA-Z0-9_-]{20,}\b/g },
+    { type: 'api-key', pattern: /\bxoxb-[a-zA-Z0-9-]+\b/g },
+    { type: 'api-key', pattern: /\bxoxp-[a-zA-Z0-9-]+\b/g },
+    { type: 'api-key', pattern: /\bghp_[a-zA-Z0-9]{36,}\b/g },
+    { type: 'api-key', pattern: /\bghs_[a-zA-Z0-9]{36,}\b/g },
+    { type: 'api-key', pattern: /\bgho_[a-zA-Z0-9]{36,}\b/g },
+    { type: 'api-key', pattern: /\bAKIA[A-Z0-9]{16}\b/g },
+    { type: 'api-key', pattern: /\bAIza[a-zA-Z0-9_-]{35}\b/g },
+    { type: 'api-key', pattern: /\bnpm_[a-zA-Z0-9]{36,}\b/g },
+    { type: 'api-key', pattern: /\bglpat-[a-zA-Z0-9_-]{20,}\b/g },
+    // Connection strings
+    { type: 'connection-string', pattern: /\bpostgres(?:ql)?:\/\/[^\s"'`]+/g },
+    { type: 'connection-string', pattern: /\bmongodb(?:\+srv)?:\/\/[^\s"'`]+/g },
+    { type: 'connection-string', pattern: /\bredis:\/\/[^\s"'`]+/g },
+    { type: 'connection-string', pattern: /\bmysql:\/\/[^\s"'`]+/g },
+    // Private keys (multiline — match the BEGIN marker)
+    { type: 'private-key', pattern: /-----BEGIN\s+(?:RSA\s+|EC\s+|DSA\s+|OPENSSH\s+)?PRIVATE\s+KEY-----[\s\S]*?-----END\s+(?:RSA\s+|EC\s+|DSA\s+|OPENSSH\s+)?PRIVATE\s+KEY-----/g },
+    // JWT tokens (three base64url segments)
+    { type: 'jwt', pattern: /\beyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\b/g },
+    // Environment variable references with values
+    { type: 'env-ref', pattern: /(?:export\s+)?[A-Z_]{2,}(?:_KEY|_SECRET|_TOKEN|_PASSWORD|_CREDENTIAL)=["']?[^\s"']+["']?/g },
+];
+/**
+ * File patterns excluded from LLM resolution entirely.
+ */
+const DEFAULT_EXCLUDED_PATTERNS = [
+    /^\.env/,
+    /\.env$/,
+    /\.env\..+/,
+    /credentials/i,
+    /secrets/i,
+    /\.pem$/,
+    /\.key$/,
+    /\.p12$/,
+    /\.pfx$/,
+    /\.instar\/config\.json$/,
+];
+// ── SecretRedactor ───────────────────────────────────────────────────
+export class SecretRedactor {
+    patterns;
+    entropyThreshold;
+    entropyMinLength;
+    maxEntropyStrings;
+    excludePatterns;
+    constructor(config) {
+        this.patterns = [
+            ...BUILTIN_PATTERNS,
+            ...(config?.customPatterns ?? []),
+        ];
+        this.entropyThreshold = config?.entropyThreshold ?? DEFAULT_ENTROPY_THRESHOLD;
+        this.entropyMinLength = config?.entropyMinLength ?? DEFAULT_ENTROPY_MIN_LENGTH;
+        this.maxEntropyStrings = config?.maxEntropyStringsBeforeExclusion ?? DEFAULT_MAX_ENTROPY_BEFORE_EXCLUSION;
+        this.excludePatterns = [
+            ...DEFAULT_EXCLUDED_PATTERNS,
+            ...(config?.excludePatterns?.map(p => new RegExp(p)) ?? []),
+        ];
+    }
+    // ── File Exclusion Check ──────────────────────────────────────────
+    /**
+     * Check whether a file should be excluded from LLM resolution entirely.
+     */
+    shouldExcludeFile(filePath, content) {
+        // Check file path patterns
+        for (const pattern of this.excludePatterns) {
+            if (pattern.test(filePath)) {
+                return { excluded: true, reason: `File path matches exclusion pattern: ${pattern}` };
+            }
+        }
+        // Check entropy density if content provided
+        if (content) {
+            const entropyStrings = this.findHighEntropyStrings(content);
+            if (entropyStrings.length > this.maxEntropyStrings) {
+                return {
+                    excluded: true,
+                    reason: `File contains ${entropyStrings.length} high-entropy strings (threshold: ${this.maxEntropyStrings}). Likely a credentials file.`,
+                };
+            }
+        }
+        return { excluded: false };
+    }
+    // ── Redaction ─────────────────────────────────────────────────────
+    /**
+     * Redact secrets from content.
+     * Returns the redacted content and a map for later restoration.
+     */
+    redact(content, fileSection = 'unknown') {
+        const redactions = [];
+        let redactedContent = content;
+        let index = 0;
+        // Layer 1: Pattern matching
+        for (const { type, pattern } of this.patterns) {
+            // Reset the regex (global flag means lastIndex persists)
+            const regex = new RegExp(pattern.source, pattern.flags);
+            let match;
+            while ((match = regex.exec(content)) !== null) {
+                const value = match[0];
+                const placeholder = `[REDACTED:${type}:${index}]`;
+                // Check not already inside a redaction placeholder
+                if (!this.isInsideRedaction(match.index, redactions)) {
+                    redactions.push({
+                        index,
+                        type,
+                        originalValue: value,
+                        fileSection,
+                        startOffset: match.index,
+                        endOffset: match.index + value.length,
+                    });
+                    index++;
+                }
+            }
+        }
+        // Layer 2: Entropy scanning
+        const entropyMatches = this.findHighEntropyStrings(content);
+        for (const { value, start, end } of entropyMatches) {
+            // Skip if already caught by pattern matching
+            if (!this.isInsideRedaction(start, redactions)) {
+                redactions.push({
+                    index,
+                    type: 'high-entropy',
+                    originalValue: value,
+                    fileSection,
+                    startOffset: start,
+                    endOffset: end,
+                });
+                index++;
+            }
+        }
+        // Sort redactions by offset (descending) so we can replace from end to start
+        const sorted = [...redactions].sort((a, b) => b.startOffset - a.startOffset);
+        for (const entry of sorted) {
+            const placeholder = `[REDACTED:${entry.type}:${entry.index}]`;
+            redactedContent =
+                redactedContent.slice(0, entry.startOffset) +
+                    placeholder +
+                    redactedContent.slice(entry.endOffset);
+        }
+        // Build type counts
+        const typeCounts = {};
+        for (const entry of redactions) {
+            typeCounts[entry.type] = (typeCounts[entry.type] ?? 0) + 1;
+        }
+        return {
+            content: redactedContent,
+            redactions,
+            count: redactions.length,
+            typeCounts,
+        };
+    }
+    // ── Restoration ───────────────────────────────────────────────────
+    /**
+     * Restore redacted secrets in LLM output.
+     *
+     * Provenance-aware: only restores a secret to a region matching its
+     * original file section. If a placeholder appears in a mismatched
+     * region, it is NOT restored and flagged for human review.
+     */
+    restore(content, redactions, currentSection) {
+        let restoredContent = content;
+        let restored = 0;
+        let blocked = 0;
+        const blockedEntries = [];
+        // Build lookup map
+        const redactionMap = new Map();
+        for (const entry of redactions) {
+            redactionMap.set(entry.index, entry);
+        }
+        // Find all placeholders in the content
+        const placeholderRegex = /\[REDACTED:([a-z-]+):(\d+)\]/g;
+        let match;
+        const replacements = [];
+        while ((match = placeholderRegex.exec(content)) !== null) {
+            const idx = parseInt(match[2], 10);
+            const entry = redactionMap.get(idx);
+            if (!entry) {
+                // Unknown redaction — leave placeholder
+                continue;
+            }
+            // Provenance check: if currentSection is specified, verify match
+            if (currentSection && entry.fileSection !== 'unknown' && entry.fileSection !== currentSection) {
+                blocked++;
+                blockedEntries.push({
+                    index: idx,
+                    reason: `Secret from "${entry.fileSection}" section found in "${currentSection}" section — provenance mismatch`,
+                });
+                continue;
+            }
+            replacements.push({
+                start: match.index,
+                end: match.index + match[0].length,
+                value: entry.originalValue,
+                index: idx,
+            });
+            restored++;
+        }
+        // Apply replacements from end to start
+        const sortedReplacements = replacements.sort((a, b) => b.start - a.start);
+        for (const rep of sortedReplacements) {
+            restoredContent =
+                restoredContent.slice(0, rep.start) +
+                    rep.value +
+                    restoredContent.slice(rep.end);
+        }
+        return { content: restoredContent, restored, blocked, blockedEntries };
+    }
+    // ── Entropy Analysis ──────────────────────────────────────────────
+    /**
+     * Calculate Shannon entropy of a string (bits per character).
+     */
+    shannonEntropy(str) {
+        if (str.length === 0)
+            return 0;
+        const freq = new Map();
+        for (const ch of str) {
+            freq.set(ch, (freq.get(ch) ?? 0) + 1);
+        }
+        let entropy = 0;
+        const len = str.length;
+        for (const count of freq.values()) {
+            const p = count / len;
+            entropy -= p * Math.log2(p);
+        }
+        return entropy;
+    }
+    // ── Private Helpers ───────────────────────────────────────────────
+    /**
+     * Find high-entropy strings in content (Layer 2).
+     */
+    findHighEntropyStrings(content) {
+        const results = [];
+        // Match contiguous non-whitespace strings of sufficient length
+        const tokenRegex = /\S{20,}/g;
+        let match;
+        while ((match = tokenRegex.exec(content)) !== null) {
+            const token = match[0];
+            // Skip if it looks like a URL, path, or common code pattern
+            if (this.isLikelyNonSecret(token))
+                continue;
+            const entropy = this.shannonEntropy(token);
+            if (entropy > this.entropyThreshold) {
+                results.push({
+                    value: token,
+                    start: match.index,
+                    end: match.index + token.length,
+                    entropy,
+                });
+            }
+        }
+        return results;
+    }
+    /**
+     * Check if a high-entropy string is likely NOT a secret
+     * (URLs, file paths, common code constructs).
+     */
+    isLikelyNonSecret(str) {
+        // URLs
+        if (/^https?:\/\//i.test(str))
+            return true;
+        // File paths
+        if (/^[.\/]/.test(str) && str.includes('/'))
+            return true;
+        // Import paths
+        if (/^@?[a-z][a-z0-9-]*\//.test(str))
+            return true;
+        // Hex color codes
+        if (/^#[0-9a-fA-F]{6,8}$/.test(str))
+            return true;
+        // Common code identifiers (camelCase, snake_case)
+        if (/^[a-z][a-zA-Z0-9]*(?:_[a-zA-Z0-9]+)*$/.test(str) && str.length < 40)
+            return true;
+        return false;
+    }
+    /**
+     * Check if a position falls inside an already-detected redaction range.
+     */
+    isInsideRedaction(position, existing) {
+        return existing.some(e => position >= e.startOffset && position < e.endOffset);
+    }
+    // ── Utility: Content Hash ─────────────────────────────────────────
+    /**
+     * Hash content for audit trail (does NOT contain secrets).
+     * Uses SHA-256 truncated to 16 hex chars.
+     */
+    static hashContent(content) {
+        return crypto.createHash('sha256').update(content).digest('hex').slice(0, 16);
+    }
+}
+//# sourceMappingURL=SecretRedactor.js.map

package/dist/core/SecretRedactor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretRedactor.js","sourceRoot":"","sources":["../../src/core/SecretRedactor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AA4EjC,wEAAwE;AAExE,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AACtC,MAAM,oCAAoC,GAAG,CAAC,CAAC;AAE/C;;GAEG;AACH,MAAM,gBAAgB,GAAoB;IACxC,WAAW;IACX,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,4BAA4B,EAAE;IAC1D,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACjE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,yBAAyB,EAAE;IACvD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,yBAAyB,EAAE;IACvD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,2BAA2B,EAAE;IACzD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,2BAA2B,EAAE;IACzD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,2BAA2B,EAAE;IACzD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,uBAAuB,EAAE;IACrD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,4BAA4B,EAAE;IAC1D,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,2BAA2B,EAAE;IACzD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,+BAA+B,EAAE;IAE7D,qBAAqB;IACrB,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,kCAAkC,EAAE;IAC1E,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,oCAAoC,EAAE;IAC5E,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE;IAChE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE;IAEhE,oDAAoD;IACpD,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,6IAA6I,EAAE;IAE/K,wCAAwC;IACxC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,oEAAoE,EAAE;IAE9F,8CAA8C;IAC9C,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,2FAA2F,EAAE;CAC1H,CAAC;AAEF;;GAEG;AACH,MAAM,yBAAyB,GAAG;IAChC,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,cAAc;IACd,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,yBAAyB;CAC1B,CAAC;AAEF,wEAAwE;AAExE,MAAM,OAAO,cAAc;IACjB,QAAQ,CAAkB;IAC1B,gBAAgB,CAAS;IACzB,gBAAgB,CAAS;IACzB,iBAAiB,CAAS;IAC1B,eAAe,CAAW;IAElC,YAAY,MAA6B;QACvC,IAAI,CAAC,QAAQ,GAAG;YACd,GAAG,gBAAgB;YACnB,GAAG,CAAC,MAAM,EAAE,cAAc,IAAI,EAAE,CAAC;SAClC,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,MAAM,EAAE,gBAAgB,IAAI,yBAAyB,CAAC;QAC9E,IAAI,CAAC,gBAAgB,GAAG,MAAM,EAAE,gBAAgB,IAAI,0BAA0B,CAAC;QAC/E,IAAI,CAAC,iBAAiB,GAAG,MAAM,EAAE,gCAAgC,IAAI,oCAAoC,CAAC;QAC1G,IAAI,CAAC,eAAe,GAAG;YACrB,GAAG,yBAAyB;YAC5B,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED,qEAAqE;IAErE;;OAEG;IACH,iBAAiB,CAAC,QAAgB,EAAE,OAAgB;QAClD,2BAA2B;QAC3B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,wCAAwC,OAAO,EAAE,EAAE,CAAC;YACvF,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,cAAc,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC5D,IAAI,cAAc,CAAC,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACnD,OAAO;oBACL,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,iBAAiB,cAAc,CAAC,MAAM,qCAAqC,IAAI,CAAC,iBAAiB,+BAA+B;iBACzI,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,qEAAqE;IAErE;;;OAGG;IACH,MAAM,CAAC,OAAe,EAAE,cAA6C,SAAS;QAC5E,MAAM,UAAU,GAAqB,EAAE,CAAC;QACxC,IAAI,eAAe,GAAG,OAAO,CAAC;QAC9B,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,4BAA4B;QAC5B,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9C,yDAAyD;YACzD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,KAA6B,CAAC;YAElC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,MAAM,WAAW,GAAG,aAAa,IAAI,IAAI,KAAK,GAAG,CAAC;gBAElD,mDAAmD;gBACnD,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;oBACrD,UAAU,CAAC,IAAI,CAAC;wBACd,KAAK;wBACL,IAAI;wBACJ,aAAa,EAAE,KAAK;wBACpB,WAAW;wBACX,WAAW,EAAE,KAAK,CAAC,KAAK;wBACxB,SAAS,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM;qBACtC,CAAC,CAAC;oBACH,KAAK,EAAE,CAAC;gBACV,CAAC;YACH,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,MAAM,cAAc,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC5D,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,cAAc,EAAE,CAAC;YACnD,6CAA6C;YAC7C,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC/C,UAAU,CAAC,IAAI,CAAC;oBACd,KAAK;oBACL,IAAI,EAAE,cAAc;oBACpB,aAAa,EAAE,KAAK;oBACpB,WAAW;oBACX,WAAW,EAAE,KAAK;oBAClB,SAAS,EAAE,GAAG;iBACf,CAAC,CAAC;gBACH,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;QAE7E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,aAAa,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC;YAC9D,eAAe;gBACb,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC;oBAC3C,WAAW;oBACX,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,oBAAoB;QACpB,MAAM,UAAU,GAAG,EAAgC,CAAC;QACpD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;YACL,OAAO,EAAE,eAAe;YACxB,UAAU;YACV,KAAK,EAAE,UAAU,CAAC,MAAM;YACxB,UAAU;SACX,CAAC;IACJ,CAAC;IAED,qEAAqE;IAErE;;;;;;OAMG;IACH,OAAO,CACL,OAAe,EACf,UAA4B,EAC5B,cAA8C;QAE9C,IAAI,eAAe,GAAG,OAAO,CAAC;QAC9B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,cAAc,GAA6C,EAAE,CAAC;QAEpE,mBAAmB;QACnB,MAAM,YAAY,GAAG,IAAI,GAAG,EAA0B,CAAC;QACvD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,uCAAuC;QACvC,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;QACzD,IAAI,KAA6B,CAAC;QAClC,MAAM,YAAY,GAAwE,EAAE,CAAC;QAE7F,OAAO,CAAC,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACzD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAEpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,wCAAwC;gBACxC,SAAS;YACX,CAAC;YAED,iEAAiE;YACjE,IAAI,cAAc,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,cAAc,EAAE,CAAC;gBAC9F,OAAO,EAAE,CAAC;gBACV,cAAc,CAAC,IAAI,CAAC;oBAClB,KAAK,EAAE,GAAG;oBACV,MAAM,EAAE,gBAAgB,KAAK,CAAC,WAAW,uBAAuB,cAAc,iCAAiC;iBAChH,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,YAAY,CAAC,IAAI,CAAC;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM;gBAClC,KAAK,EAAE,KAAK,CAAC,aAAa;gBAC1B,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;YACH,QAAQ,EAAE,CAAC;QACb,CAAC;QAED,uCAAuC;QACvC,MAAM,kBAAkB,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1E,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,eAAe;gBACb,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC;oBACnC,GAAG,CAAC,KAAK;oBACT,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IACzE,CAAC;IAED,qEAAqE;IAErE;;OAEG;IACH,cAAc,CAAC,GAAW;QACxB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAE/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;QACvB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC;YACtB,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,qEAAqE;IAErE;;OAEG;IACK,sBAAsB,CAC5B,OAAe;QAEf,MAAM,OAAO,GAA0E,EAAE,CAAC;QAE1F,+DAA+D;QAC/D,MAAM,UAAU,GAAG,UAAU,CAAC;QAC9B,IAAI,KAA6B,CAAC;QAElC,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAEvB,4DAA4D;YAC5D,IAAI,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;gBAAE,SAAS;YAE5C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,OAAO,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC;oBACX,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM;oBAC/B,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,iBAAiB,CAAC,GAAW;QACnC,OAAO;QACP,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,aAAa;QACb,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzD,eAAe;QACf,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,kBAAkB;QAClB,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,kDAAkD;QAClD,IAAI,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAEtF,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,QAAgB,EAAE,QAA0B;QACpE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAW,IAAI,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IACjF,CAAC;IAED,qEAAqE;IAErE;;;OAGG;IACH,MAAM,CAAC,WAAW,CAAC,OAAe;QAChC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;CACF"}

package/dist/core/SecretStore.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Encrypted secret storage and forward-secret sync protocol.
+ *
+ * At-rest encryption:
+ *   - Master key stored in OS keychain (macOS Keychain, Linux Secret Service)
+ *   - File fallback for headless servers (.instar/machine/secrets-master.key, 0600)
+ *   - AES-256-GCM encryption of secret store
+ *
+ * Wire encryption (for sync between machines):
+ *   - Ephemeral X25519 ECDH key exchange
+ *   - HKDF-SHA256 key derivation
+ *   - AES-256-GCM authenticated encryption
+ *   - Forward secrecy: ephemeral keys discarded after each transfer
+ *
+ * Part of Phase 4 (secret sync via tunnel).
+ */
+import crypto from 'node:crypto';
+export interface SecretStoreConfig {
+    /** State directory (.instar) */
+    stateDir: string;
+    /** Force file-based key storage (skip keychain) */
+    forceFileKey?: boolean;
+}
+/** The decrypted secrets object (flat key-value or nested) */
+export type Secrets = Record<string, unknown>;
+/** Encrypted payload for wire transfer */
+export interface EncryptedSecretPayload {
+    /** Ephemeral X25519 public key (base64) */
+    ephemeralPublicKey: string;
+    /** AES-256-GCM initialization vector (base64) */
+    iv: string;
+    /** Encrypted ciphertext (base64) */
+    ciphertext: string;
+    /** AES-GCM authentication tag (base64) */
+    tag: string;
+}
+/**
+ * Store/retrieve the master key from the OS keychain.
+ * Falls back to file-based storage if keychain is unavailable.
+ */
+export declare class MasterKeyManager {
+    private stateDir;
+    private forceFile;
+    private keyFilePath;
+    constructor(stateDir: string, forceFile?: boolean);
+    /** Retrieve or generate the master key. */
+    getMasterKey(): Buffer;
+    /** Whether the master key is stored in the OS keychain (vs file fallback). */
+    get isKeychainBacked(): boolean;
+    private readKeychain;
+    private writeKeychain;
+    private readMacKeychain;
+    private writeMacKeychain;
+    private readLinuxKeychain;
+    private writeLinuxKeychain;
+    private getFileKey;
+}
+export declare class SecretStore {
+    private stateDir;
+    private keyManager;
+    private encryptedPath;
+    constructor(config: SecretStoreConfig);
+    /** Read and decrypt secrets from the encrypted store. Returns empty object if no secrets exist. */
+    read(): Secrets;
+    /** Encrypt and write secrets to the store. */
+    write(secrets: Secrets): void;
+    /** Get a specific secret by dot-notation path (e.g., 'telegram.token'). */
+    get(keyPath: string): unknown;
+    /** Set a specific secret by dot-notation path. */
+    set(keyPath: string, value: unknown): void;
+    /** Delete a specific secret by dot-notation path. */
+    delete(keyPath: string): void;
+    /** Whether the secret store file exists. */
+    get exists(): boolean;
+    /** Whether the master key is in the OS keychain. */
+    get isKeychainBacked(): boolean;
+    /** Delete the encrypted store file. */
+    destroy(): void;
+    private encryptAES;
+    private decryptAES;
+}
+/**
+ * Encrypt secrets for wire transfer using forward-secret ECDH.
+ *
+ * Protocol:
+ * 1. Generate ephemeral X25519 key pair
+ * 2. ECDH: ephemeral private + recipient's long-term public = shared secret
+ * 3. HKDF-SHA256 to derive AES-256 key
+ * 4. AES-256-GCM encrypt
+ * 5. Return: { ephemeralPublicKey, iv, ciphertext, tag }
+ *
+ * The ephemeral private key is not retained — forward secrecy.
+ */
+export declare function encryptForSync(secrets: Secrets, recipientPublicKeyBase64: string): EncryptedSecretPayload;
+/**
+ * Decrypt secrets received via wire transfer.
+ *
+ * Protocol:
+ * 1. ECDH: own private key + sender's ephemeral public = shared secret
+ * 2. HKDF-SHA256 to derive AES-256 key
+ * 3. AES-256-GCM decrypt
+ */
+export declare function decryptFromSync(payload: EncryptedSecretPayload, ownPrivateKey: crypto.KeyObject): Secrets;
+//# sourceMappingURL=SecretStore.d.ts.map

package/dist/core/SecretStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretStore.d.ts","sourceRoot":"","sources":["../../src/core/SecretStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAiBjC,MAAM,WAAW,iBAAiB;IAChC,gCAAgC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,8DAA8D;AAC9D,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE9C,0CAA0C;AAC1C,MAAM,WAAW,sBAAsB;IACrC,2CAA2C;IAC3C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;CACb;AAID;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,SAAS,CAAU;IAC3B,OAAO,CAAC,WAAW,CAAS;gBAEhB,QAAQ,EAAE,MAAM,EAAE,SAAS,UAAQ;IAM/C,2CAA2C;IAC3C,YAAY,IAAI,MAAM;IAWtB,8EAA8E;IAC9E,IAAI,gBAAgB,IAAI,OAAO,CAQ9B;IAID,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,eAAe;IAevB,OAAO,CAAC,gBAAgB;IAgCxB,OAAO,CAAC,iBAAiB;IAczB,OAAO,CAAC,kBAAkB;IA2B1B,OAAO,CAAC,UAAU;CAsBnB;AAID,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,aAAa,CAAS;gBAElB,MAAM,EAAE,iBAAiB;IAMrC,mGAAmG;IACnG,IAAI,IAAI,OAAO;IAUf,8CAA8C;IAC9C,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAe7B,2EAA2E;IAC3E,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAK7B,kDAAkD;IAClD,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAM1C,qDAAqD;IACrD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAM7B,4CAA4C;IAC5C,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,oDAAoD;IACpD,IAAI,gBAAgB,IAAI,OAAO,CAE9B;IAED,uCAAuC;IACvC,OAAO,IAAI,IAAI;IAQf,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,UAAU;CAcnB;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,EAChB,wBAAwB,EAAE,MAAM,GAC/B,sBAAsB,CA0CxB;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,sBAAsB,EAC/B,aAAa,EAAE,MAAM,CAAC,SAAS,GAC9B,OAAO,CA4BT"}