@moxxy/plugin-vault 0.0.33

package/dist/placeholder.js

@@ -0,0 +1,92 @@
+import { MoxxyError } from '@moxxy/sdk';
+const PLACEHOLDER_RE = /\$\{vault:([A-Za-z0-9_.-]+)\}/g;
+// Bound recursion over caller-supplied objects: a pathologically deep config
+// (or an in-memory reference cycle, which is legal for JS objects even though
+// JSON can't express one) would otherwise overflow the stack and take down the
+// process. 64 levels is far deeper than any real config tree.
+const MAX_DEPTH = 64;
+function tooDeepError() {
+    return new MoxxyError({
+        code: 'CONFIG_INVALID',
+        message: `vault: value nested too deeply (> ${MAX_DEPTH} levels) — possible reference cycle`,
+        hint: 'Flatten the config or remove the cyclic reference before resolving vault placeholders.',
+    });
+}
+/**
+ * Resolve every `${vault:NAME}` placeholder in a string against the vault. If
+ * any referenced key is missing, throws — secret refs are not optional.
+ */
+export async function resolveString(input, vault) {
+    PLACEHOLDER_RE.lastIndex = 0;
+    if (!PLACEHOLDER_RE.test(input))
+        return input;
+    PLACEHOLDER_RE.lastIndex = 0;
+    const names = new Set();
+    let m;
+    while ((m = PLACEHOLDER_RE.exec(input)))
+        names.add(m[1]);
+    const values = new Map();
+    for (const name of names) {
+        const value = await vault.get(name);
+        if (value === null) {
+            throw new MoxxyError({
+                code: 'CONFIG_INVALID',
+                message: `vault: missing required entry '${name}' referenced in config`,
+                hint: `Add it with \`/vault set ${name} <value>\` (or the \`vault_set\` tool), then retry.`,
+                context: { name },
+            });
+        }
+        values.set(name, value);
+    }
+    return input.replace(PLACEHOLDER_RE, (_match, name) => values.get(name) ?? '');
+}
+/** Walk an arbitrary value, resolving all vault placeholders in nested strings. */
+export async function resolveValue(value, vault) {
+    return resolveValueInner(value, vault, new Set());
+}
+// `ancestors` is the chain of objects on the path from the root to (but not
+// including) the current node, so a node that appears as its own ancestor is a
+// true cycle — while a shared object reachable via two *sibling* paths (a legal
+// DAG) is resolved on each path rather than falsely flagged. The chain length
+// is the nesting depth, so its size doubles as the depth bound.
+async function resolveValueInner(value, vault, ancestors) {
+    if (typeof value === 'string')
+        return await resolveString(value, vault);
+    if (value && typeof value === 'object') {
+        if (ancestors.has(value))
+            throw tooDeepError(); // reference cycle
+        if (ancestors.size >= MAX_DEPTH)
+            throw tooDeepError();
+        const nextAncestors = new Set(ancestors).add(value);
+        if (Array.isArray(value)) {
+            return Promise.all(value.map((v) => resolveValueInner(v, vault, nextAncestors)));
+        }
+        // Resolve object properties concurrently (mirrors the array branch); each
+        // leaf may await vault.get(), so serializing them needlessly serializes I/O.
+        const pairs = await Promise.all(Object.entries(value).map(async ([k, v]) => [k, await resolveValueInner(v, vault, nextAncestors)]));
+        return Object.fromEntries(pairs);
+    }
+    return value;
+}
+export function containsPlaceholder(value) {
+    return containsPlaceholderInner(value, new Set());
+}
+function containsPlaceholderInner(value, ancestors) {
+    if (typeof value === 'string') {
+        PLACEHOLDER_RE.lastIndex = 0;
+        return PLACEHOLDER_RE.test(value);
+    }
+    if (value && typeof value === 'object') {
+        if (ancestors.has(value))
+            return false; // cycle — this subtree already inspected on the path
+        if (ancestors.size >= MAX_DEPTH)
+            throw tooDeepError();
+        const nextAncestors = new Set(ancestors).add(value);
+        if (Array.isArray(value)) {
+            return value.some((v) => containsPlaceholderInner(v, nextAncestors));
+        }
+        return Object.values(value).some((v) => containsPlaceholderInner(v, nextAncestors));
+    }
+    return false;
+}
+//# sourceMappingURL=placeholder.js.map

package/dist/placeholder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"placeholder.js","sourceRoot":"","sources":["../src/placeholder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAGxC,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,8DAA8D;AAC9D,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,SAAS,YAAY;IACnB,OAAO,IAAI,UAAU,CAAC;QACpB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,qCAAqC,SAAS,qCAAqC;QAC5F,IAAI,EAAE,wFAAwF;KAC/F,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa,EAAE,KAAiB;IAClE,cAAc,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,cAAc,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,UAAU,CAAC;gBACnB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,kCAAkC,IAAI,wBAAwB;gBACvE,IAAI,EAAE,4BAA4B,IAAI,qDAAqD;gBAC3F,OAAO,EAAE,EAAE,IAAI,EAAE;aAClB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAc,EAAE,KAAiB;IAClE,OAAO,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,4EAA4E;AAC5E,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,gEAAgE;AAChE,KAAK,UAAU,iBAAiB,CAC9B,KAAc,EACd,KAAiB,EACjB,SAAsB;IAEtB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,YAAY,EAAE,CAAC,CAAC,kBAAkB;QAClE,IAAI,SAAS,CAAC,IAAI,IAAI,SAAS;YAAE,MAAM,YAAY,EAAE,CAAC;QACtD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,GAAG,CAClD,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,iBAAiB,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,CAAU,CACjF,CACF,CAAC;QACF,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,wBAAwB,CAAC,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc,EAAE,SAAsB;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,cAAc,CAAC,SAAS,GAAG,CAAC,CAAC;QAC7B,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,qDAAqD;QAC7F,IAAI,SAAS,CAAC,IAAI,IAAI,SAAS;YAAE,MAAM,YAAY,EAAE,CAAC;QACtD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAChE,wBAAwB,CAAC,CAAC,EAAE,aAAa,CAAC,CAC3C,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/store.d.ts

@@ -0,0 +1,106 @@
+import { type EncryptedBlob } from './crypto.js';
+import type { MasterKeySource } from './keysource.js';
+/**
+ * Thrown when the supplied passphrase doesn't match the stored vault.
+ * Surfaced to the user with a recovery hint instead of the raw AES-GCM
+ * "Unsupported state or unable to authenticate data" error.
+ */
+export declare class VaultPassphraseError extends Error {
+    readonly filePath: string;
+    constructor(filePath: string);
+}
+export interface VaultEntry extends EncryptedBlob {
+    readonly createdAt: string;
+    readonly updatedAt: string;
+    readonly tags?: ReadonlyArray<string>;
+}
+export interface VaultEntryInfo {
+    readonly name: string;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+    readonly tags?: ReadonlyArray<string>;
+}
+export interface VaultStoreOptions {
+    readonly filePath: string;
+    readonly keySource: MasterKeySource;
+}
+export declare class VaultStore {
+    private readonly filePath;
+    private readonly keySource;
+    private file;
+    private masterKey;
+    private readonly mutex;
+    private lastSynced;
+    constructor(opts: VaultStoreOptions);
+    open(): Promise<void>;
+    get sourceName(): string;
+    private load;
+    /**
+     * Obtain the master key and return a copy the store solely owns. Key sources
+     * may hand back a buffer they (or the caller) keep a reference to — copying
+     * lets `close()` zero our buffer without corrupting that shared one.
+     */
+    private obtainOwnedKey;
+    private corruptError;
+    /**
+     * Confirm the master key decrypts the file's canary (or, for legacy
+     * vaults without a canary, the first stored entry). On mismatch throw
+     * a friendly `VaultPassphraseError` rather than letting the cryptic
+     * "Unsupported state or unable to authenticate data" error from
+     * Node's AES-GCM bubble up later.
+     */
+    private verifyPassphrase;
+    /**
+     * Fold other writers' entries in from the on-disk file. Historically the
+     * vault persisted a whole-file snapshot of THIS instance's memory, so a
+     * write from any other `VaultStore` (another moxxy process, or a second
+     * instance in this one) was silently clobbered by our next persist —
+     * last-writer-wins, fatal for single-use rotated OAuth refresh tokens.
+     * Now every read and every mutation first re-reads the file (mtime/size
+     * gated, so the common no-other-writer case costs one `stat`) and merges:
+     *   - key on both sides → newer `updatedAt` wins (ISO timestamps);
+     *   - key only on disk  → adopt it (another writer added it);
+     *   - key only in memory → drop it (every mutation persists before
+     *     returning, so a key missing on disk was deleted by another writer).
+     * Skipped when the on-disk salt differs (vault wiped/recreated — those
+     * entries are undecryptable under our master key) or the file is
+     * unreadable/corrupt (keep memory; the next persist restores a good file).
+     *
+     * Must be called while holding `this.mutex`.
+     */
+    private syncFromDisk;
+    /**
+     * Crash-atomic write: serialize to a sibling tmp file, then rename. POSIX
+     * rename is atomic, so a crash mid-write leaves the previous vault intact
+     * rather than truncated. mode 0o600 keeps the secret store owner-only.
+     */
+    private persist;
+    set(name: string, value: string, tags?: ReadonlyArray<string>): Promise<void>;
+    get(name: string): Promise<string | null>;
+    /**
+     * Decrypt a single stored blob, converting any low-level crypto failure into
+     * a friendly `VAULT_CORRUPT` error. `validateVaultFile` only guarantees the
+     * blob's iv/tag/data are *strings*, not that they base64-decode to the right
+     * lengths — a partially-corrupted entry (e.g. a truncated `iv` or `tag`, or a
+     * value re-keyed out-of-band) passes structural validation yet makes Node's
+     * AES-GCM throw a raw `ERR_CRYPTO_INVALID_IV` / `ERR_CRYPTO_INVALID_AUTH_TAG`
+     * / auth-tag-mismatch error. The vault's passphrase is already verified
+     * against the canary on open(), so a per-entry decrypt failure means THAT
+     * entry is corrupt, not that the whole vault is locked — surface a targeted
+     * recovery hint instead of crashing the caller with a cryptic crypto error.
+     */
+    private decryptEntry;
+    has(name: string): Promise<boolean>;
+    delete(name: string): Promise<boolean>;
+    list(): Promise<ReadonlyArray<VaultEntryInfo>>;
+    /**
+     * Wipe the in-memory master key and cached file so the AES key is no longer
+     * recoverable from a heap/core dump or swap after the store is done. The
+     * store can be reopened — `open()` re-derives the key. Returned plaintext
+     * strings from `get()` cannot be wiped (JS strings are immutable); only the
+     * long-lived key Buffer is zeroed here.
+     */
+    close(): void;
+    [Symbol.dispose](): void;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkC,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AA2BtD;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;aACjB,QAAQ,EAAE,MAAM;gBAAhB,QAAQ,EAAE,MAAM;CAU7C;AAED,MAAM,WAAW,UAAW,SAAQ,aAAa;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACrC;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,IAAI,CAA0B;IACtC,OAAO,CAAC,SAAS,CAAuB;IAKxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAG9C,OAAO,CAAC,UAAU,CAAkD;gBAExD,IAAI,EAAE,iBAAiB;IAK7B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ3B,IAAI,UAAU,IAAI,MAAM,CAEvB;YAEa,IAAI;IAwDlB;;;;OAIG;YACW,cAAc;IAI5B,OAAO,CAAC,YAAY;IASpB;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAexB;;;;;;;;;;;;;;;;;OAiBG;YACW,YAAY;IA6C1B;;;;OAIG;YACW,OAAO;IAYf,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB7E,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAc/C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,YAAY;IAcd,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQnC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IActC,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;IAcpD;;;;;;OAMG;IACH,KAAK,IAAI,IAAI;IAOb,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI;CAGzB"}

package/dist/store.js

@@ -0,0 +1,415 @@
+import { promises as fs } from 'node:fs';
+import { createMutex, MoxxyError } from '@moxxy/sdk';
+import { writeFileAtomic } from '@moxxy/sdk/server';
+import { decrypt, encrypt, generateSalt } from './crypto.js';
+const CANARY_PLAINTEXT = 'moxxy:vault:v1';
+// Upper bound on filesystem mtime granularity (HFS+/old ext are ~1-2s). Within
+// this window of "now" an unchanged (mtime,size) fingerprint can't be trusted
+// to mean "no other writer", so syncFromDisk re-reads instead of fast-pathing.
+const MTIME_GRANULARITY_MS = 2000;
+/**
+ * Thrown when the supplied passphrase doesn't match the stored vault.
+ * Surfaced to the user with a recovery hint instead of the raw AES-GCM
+ * "Unsupported state or unable to authenticate data" error.
+ */
+export class VaultPassphraseError extends Error {
+    filePath;
+    constructor(filePath) {
+        super(`Wrong vault passphrase for ${filePath}.\n` +
+            `  If you've forgotten it, wipe the vault and key cache, then re-run \`moxxy init\`:\n` +
+            `    rm ${filePath} ~/.moxxy/vault.key\n` +
+            `  (If the OS keychain holds a cached key, also clear it: \`security delete-generic-password -s moxxy\` on macOS.)\n` +
+            `  Or set MOXXY_VAULT_PASSPHRASE to a known value to skip the prompt entirely.`);
+        this.filePath = filePath;
+        this.name = 'VaultPassphraseError';
+    }
+}
+export class VaultStore {
+    filePath;
+    keySource;
+    file = null;
+    masterKey = null;
+    // Serializes every mutator (set/delete) and persist() so concurrent
+    // writers don't clobber each other through the read-modify-write +
+    // whole-file rewrite. open() is also chained through this so two
+    // parallel `open()` calls never both derive a fresh salt.
+    mutex = createMutex();
+    // stat() fingerprint of the file as of our last load/sync/persist; lets
+    // syncFromDisk() skip the read+parse when nothing else has written.
+    lastSynced = null;
+    constructor(opts) {
+        this.filePath = opts.filePath;
+        this.keySource = opts.keySource;
+    }
+    async open() {
+        if (this.file && this.masterKey)
+            return;
+        return this.mutex.run(async () => {
+            if (this.file && this.masterKey)
+                return;
+            await this.load();
+        });
+    }
+    get sourceName() {
+        return this.keySource.name;
+    }
+    async load() {
+        let raw = null;
+        try {
+            raw = await fs.readFile(this.filePath, 'utf8');
+        }
+        catch (err) {
+            if (!isEnoent(err))
+                throw err;
+        }
+        if (raw === null) {
+            const salt = generateSalt();
+            this.masterKey = await this.obtainOwnedKey(salt);
+            this.file = {
+                version: 1,
+                kdf: 'scrypt',
+                salt: salt.toString('base64'),
+                entries: {},
+                canary: encrypt(CANARY_PLAINTEXT, this.masterKey),
+            };
+            await this.persist();
+            return;
+        }
+        let parsedRaw;
+        try {
+            parsedRaw = JSON.parse(raw);
+        }
+        catch {
+            throw this.corruptError('Vault file is not valid JSON');
+        }
+        if (!isPlainObject(parsedRaw)) {
+            throw this.corruptError('Vault file is not a JSON object');
+        }
+        const parsed = parsedRaw;
+        if (parsed.version !== 1 || parsed.kdf !== 'scrypt') {
+            throw new MoxxyError({
+                code: 'VAULT_CORRUPT',
+                message: `Unsupported vault file: version=${String(parsed.version)} kdf=${String(parsed.kdf)}`,
+                hint: `This vault was written by an incompatible version. Back up and remove ${this.filePath} to re-initialize.`,
+                context: { filePath: this.filePath },
+            });
+        }
+        if (!validateVaultFile(parsed)) {
+            throw this.corruptError('Vault file is malformed (bad salt/entries/canary shape)');
+        }
+        this.file = parsed;
+        const salt = Buffer.from(parsed.salt, 'base64');
+        this.masterKey = await this.obtainOwnedKey(salt);
+        this.verifyPassphrase();
+        // Backfill the canary on the first successful open of a legacy vault.
+        if (!this.file.canary) {
+            this.file = { ...this.file, canary: encrypt(CANARY_PLAINTEXT, this.masterKey) };
+            try {
+                await this.persist();
+            }
+            catch {
+                // Best-effort — failing to backfill doesn't break the open.
+            }
+        }
+    }
+    /**
+     * Obtain the master key and return a copy the store solely owns. Key sources
+     * may hand back a buffer they (or the caller) keep a reference to — copying
+     * lets `close()` zero our buffer without corrupting that shared one.
+     */
+    async obtainOwnedKey(salt) {
+        return Buffer.from(await this.keySource.obtain(salt));
+    }
+    corruptError(message) {
+        return new MoxxyError({
+            code: 'VAULT_CORRUPT',
+            message,
+            hint: `Back up and remove ${this.filePath} to re-initialize the vault.`,
+            context: { filePath: this.filePath },
+        });
+    }
+    /**
+     * Confirm the master key decrypts the file's canary (or, for legacy
+     * vaults without a canary, the first stored entry). On mismatch throw
+     * a friendly `VaultPassphraseError` rather than letting the cryptic
+     * "Unsupported state or unable to authenticate data" error from
+     * Node's AES-GCM bubble up later.
+     */
+    verifyPassphrase() {
+        if (!this.file || !this.masterKey)
+            return;
+        const probe = this.file.canary ?? firstEntry(this.file.entries);
+        if (!probe)
+            return; // empty legacy vault — nothing to verify yet.
+        try {
+            const plaintext = decrypt(probe, this.masterKey);
+            if (this.file.canary && plaintext !== CANARY_PLAINTEXT) {
+                throw new VaultPassphraseError(this.filePath);
+            }
+        }
+        catch (err) {
+            if (err instanceof VaultPassphraseError)
+                throw err;
+            throw new VaultPassphraseError(this.filePath);
+        }
+    }
+    /**
+     * Fold other writers' entries in from the on-disk file. Historically the
+     * vault persisted a whole-file snapshot of THIS instance's memory, so a
+     * write from any other `VaultStore` (another moxxy process, or a second
+     * instance in this one) was silently clobbered by our next persist —
+     * last-writer-wins, fatal for single-use rotated OAuth refresh tokens.
+     * Now every read and every mutation first re-reads the file (mtime/size
+     * gated, so the common no-other-writer case costs one `stat`) and merges:
+     *   - key on both sides → newer `updatedAt` wins (ISO timestamps);
+     *   - key only on disk  → adopt it (another writer added it);
+     *   - key only in memory → drop it (every mutation persists before
+     *     returning, so a key missing on disk was deleted by another writer).
+     * Skipped when the on-disk salt differs (vault wiped/recreated — those
+     * entries are undecryptable under our master key) or the file is
+     * unreadable/corrupt (keep memory; the next persist restores a good file).
+     *
+     * Must be called while holding `this.mutex`.
+     */
+    async syncFromDisk() {
+        if (!this.file)
+            return;
+        let st;
+        try {
+            st = await fs.stat(this.filePath);
+        }
+        catch (err) {
+            if (isEnoent(err))
+                return; // deleted out from under us — keep memory
+            throw err;
+        }
+        // Fast path: skip the read+merge only when the stat fingerprint is
+        // unchanged AND it has aged past the filesystem's mtime granularity. On
+        // coarse-mtime filesystems (HFS+, older ext) two writes inside the same
+        // ~1-2s tick that also produce an identical byte length share a
+        // (mtime,size) fingerprint, so a recent match might hide a sibling write.
+        // The merge is idempotent and cheap, so when in doubt we re-read.
+        if (this.lastSynced &&
+            st.mtimeMs === this.lastSynced.mtimeMs &&
+            st.size === this.lastSynced.size &&
+            Date.now() - st.mtimeMs > MTIME_GRANULARITY_MS) {
+            return;
+        }
+        let parsedRaw;
+        try {
+            parsedRaw = JSON.parse(await fs.readFile(this.filePath, 'utf8'));
+        }
+        catch {
+            return;
+        }
+        if (!isPlainObject(parsedRaw))
+            return;
+        const parsed = parsedRaw;
+        if (parsed.version !== 1 ||
+            parsed.kdf !== 'scrypt' ||
+            parsed.salt !== this.file.salt ||
+            !validateVaultFile(parsed)) {
+            return;
+        }
+        this.file = { ...this.file, entries: mergeEntries(this.file.entries, parsed.entries) };
+        // Fingerprint from BEFORE the read: if a write landed in between, the
+        // next sync simply re-reads — never the other way around.
+        this.lastSynced = { mtimeMs: st.mtimeMs, size: st.size };
+    }
+    /**
+     * Crash-atomic write: serialize to a sibling tmp file, then rename. POSIX
+     * rename is atomic, so a crash mid-write leaves the previous vault intact
+     * rather than truncated. mode 0o600 keeps the secret store owner-only.
+     */
+    async persist() {
+        if (!this.file)
+            return;
+        await writeFileAtomic(this.filePath, JSON.stringify(this.file, null, 2), { mode: 0o600 });
+        // Force the next syncFromDisk() to re-read rather than recording a stat
+        // here: between our rename and a post-write fs.stat another process may
+        // have renamed ITS version in, so the fingerprint we'd capture could be
+        // a foreign file's — which would then make us skip reading the very
+        // update we're out of sync with. Dropping the fingerprint costs one
+        // extra (idempotent, merge-only) read on the next access.
+        this.lastSynced = null;
+    }
+    async set(name, value, tags) {
+        await this.open();
+        return this.mutex.run(async () => {
+            if (!this.file || !this.masterKey)
+                throw new Error('vault not open');
+            await this.syncFromDisk();
+            const now = new Date().toISOString();
+            const existing = this.file.entries[name];
+            const blob = encrypt(value, this.masterKey);
+            this.file = {
+                ...this.file,
+                entries: {
+                    ...this.file.entries,
+                    [name]: {
+                        ...blob,
+                        createdAt: existing?.createdAt ?? now,
+                        updatedAt: now,
+                        tags: tags ?? existing?.tags,
+                    },
+                },
+            };
+            await this.persist();
+        });
+    }
+    async get(name) {
+        await this.open();
+        // Read the entry inside the same mutex turn as syncFromDisk so a
+        // concurrent set()/delete() (which replaces this.file wholesale) can't
+        // swap the snapshot out between the sync and the decrypt.
+        return this.mutex.run(async () => {
+            await this.syncFromDisk();
+            if (!this.file || !this.masterKey)
+                throw new Error('vault not open');
+            const entry = this.file.entries[name];
+            if (!entry)
+                return null;
+            return this.decryptEntry(name, entry);
+        });
+    }
+    /**
+     * Decrypt a single stored blob, converting any low-level crypto failure into
+     * a friendly `VAULT_CORRUPT` error. `validateVaultFile` only guarantees the
+     * blob's iv/tag/data are *strings*, not that they base64-decode to the right
+     * lengths — a partially-corrupted entry (e.g. a truncated `iv` or `tag`, or a
+     * value re-keyed out-of-band) passes structural validation yet makes Node's
+     * AES-GCM throw a raw `ERR_CRYPTO_INVALID_IV` / `ERR_CRYPTO_INVALID_AUTH_TAG`
+     * / auth-tag-mismatch error. The vault's passphrase is already verified
+     * against the canary on open(), so a per-entry decrypt failure means THAT
+     * entry is corrupt, not that the whole vault is locked — surface a targeted
+     * recovery hint instead of crashing the caller with a cryptic crypto error.
+     */
+    decryptEntry(name, entry) {
+        try {
+            return decrypt(entry, this.masterKey);
+        }
+        catch (err) {
+            throw new MoxxyError({
+                code: 'VAULT_CORRUPT',
+                message: `vault: entry '${name}' could not be decrypted (corrupt or re-keyed)`,
+                hint: `Re-store it with \`/vault set ${name} <value>\`, or back up and remove ${this.filePath} to re-initialize.`,
+                context: { filePath: this.filePath, name },
+                cause: err,
+            });
+        }
+    }
+    async has(name) {
+        await this.open();
+        return this.mutex.run(async () => {
+            await this.syncFromDisk();
+            return Boolean(this.file?.entries[name]);
+        });
+    }
+    async delete(name) {
+        await this.open();
+        return this.mutex.run(async () => {
+            if (!this.file)
+                return false;
+            await this.syncFromDisk();
+            if (!(name in this.file.entries))
+                return false;
+            const { [name]: _removed, ...rest } = this.file.entries;
+            void _removed;
+            this.file = { ...this.file, entries: rest };
+            await this.persist();
+            return true;
+        });
+    }
+    async list() {
+        await this.open();
+        return this.mutex.run(async () => {
+            await this.syncFromDisk();
+            if (!this.file)
+                return [];
+            return Object.entries(this.file.entries).map(([name, e]) => ({
+                name,
+                createdAt: e.createdAt,
+                updatedAt: e.updatedAt,
+                tags: e.tags,
+            }));
+        });
+    }
+    /**
+     * Wipe the in-memory master key and cached file so the AES key is no longer
+     * recoverable from a heap/core dump or swap after the store is done. The
+     * store can be reopened — `open()` re-derives the key. Returned plaintext
+     * strings from `get()` cannot be wiped (JS strings are immutable); only the
+     * long-lived key Buffer is zeroed here.
+     */
+    close() {
+        this.masterKey?.fill(0);
+        this.masterKey = null;
+        this.file = null;
+        this.lastSynced = null;
+    }
+    [Symbol.dispose]() {
+        this.close();
+    }
+}
+/**
+ * Merge our in-memory entries with another writer's on-disk entries. Disk is
+ * the base (all current writers merge-before-persist, so disk is the union of
+ * everyone's persisted state); when both sides hold a key, the newer
+ * `updatedAt` wins so a stale whole-file write from an older moxxy can't roll
+ * back a fresher value (e.g. a just-rotated OAuth refresh token).
+ */
+function mergeEntries(memory, disk) {
+    const merged = { ...disk };
+    for (const [name, mine] of Object.entries(memory)) {
+        const theirs = merged[name];
+        if (theirs && theirs.updatedAt >= mine.updatedAt)
+            continue;
+        if (!theirs)
+            continue; // absent on disk → deleted by another writer
+        merged[name] = mine;
+    }
+    return merged;
+}
+function isEnoent(err) {
+    return err instanceof Error && 'code' in err && err.code === 'ENOENT';
+}
+function isPlainObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function isEncryptedBlob(v) {
+    return (isPlainObject(v) &&
+        typeof v.iv === 'string' &&
+        typeof v.tag === 'string' &&
+        typeof v.data === 'string');
+}
+/**
+ * Structural validation of a parsed vault file beyond the version/kdf gate:
+ * `salt` is a string, `entries` is a plain object whose every value is a
+ * well-formed encrypted blob (with createdAt/updatedAt strings), and `canary`
+ * (when present) is a blob. Guards against partial writes / manual edits that
+ * are valid JSON but would otherwise throw a raw TypeError in
+ * verifyPassphrase()/list() instead of a friendly VAULT_CORRUPT error.
+ */
+function validateVaultFile(parsed) {
+    if (typeof parsed.salt !== 'string')
+        return false;
+    if (!isPlainObject(parsed.entries))
+        return false;
+    for (const entry of Object.values(parsed.entries)) {
+        if (!isEncryptedBlob(entry))
+            return false;
+        const e = entry;
+        if (typeof e.createdAt !== 'string' || typeof e.updatedAt !== 'string')
+            return false;
+    }
+    if (parsed.canary !== undefined && !isEncryptedBlob(parsed.canary))
+        return false;
+    return true;
+}
+function firstEntry(entries) {
+    for (const key of Object.keys(entries)) {
+        return entries[key];
+    }
+    return undefined;
+}
+//# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAc,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAsB,MAAM,aAAa,CAAC;AAqBjF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAE1C,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC;;;;GAIG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACjB;IAA5B,YAA4B,QAAgB;QAC1C,KAAK,CACH,8BAA8B,QAAQ,KAAK;YACzC,uFAAuF;YACvF,UAAU,QAAQ,uBAAuB;YACzC,qHAAqH;YACrH,+EAA+E,CAClF,CAAC;QAPwB,aAAQ,GAAR,QAAQ,CAAQ;QAQ1C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAoBD,MAAM,OAAO,UAAU;IACJ,QAAQ,CAAS;IACjB,SAAS,CAAkB;IACpC,IAAI,GAAqB,IAAI,CAAC;IAC9B,SAAS,GAAkB,IAAI,CAAC;IACxC,oEAAoE;IACpE,mEAAmE;IACnE,iEAAiE;IACjE,0DAA0D;IACzC,KAAK,GAAU,WAAW,EAAE,CAAC;IAC9C,wEAAwE;IACxE,oEAAoE;IAC5D,UAAU,GAA6C,IAAI,CAAC;IAEpE,YAAY,IAAuB;QACjC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YAC/B,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO;YACxC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,GAAG,GAAkB,IAAI,CAAC;QAC9B,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;QAChC,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;YAC5B,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,GAAG;gBACV,OAAO,EAAE,CAAC;gBACV,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC7B,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC;aAClD,CAAC;YACF,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,SAAkB,CAAC;QACvB,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,iCAAiC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,MAAM,GAAG,SAA+B,CAAC;QAC/C,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,UAAU,CAAC;gBACnB,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,mCAAmC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBAC9F,IAAI,EAAE,yEAAyE,IAAI,CAAC,QAAQ,oBAAoB;gBAChH,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,yDAAyD,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,sEAAsE;QACtE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAChF,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,cAAc,CAAC,IAAY;QACvC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAEO,YAAY,CAAC,OAAe;QAClC,OAAO,IAAI,UAAU,CAAC;YACpB,IAAI,EAAE,eAAe;YACrB,OAAO;YACP,IAAI,EAAE,sBAAsB,IAAI,CAAC,QAAQ,8BAA8B;YACvE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;SACrC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB;QACtB,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,8CAA8C;QAClE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,KAAK,gBAAgB,EAAE,CAAC;gBACvD,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oBAAoB;gBAAE,MAAM,GAAG,CAAC;YACnD,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QACvB,IAAI,EAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,0CAA0C;YACrE,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,mEAAmE;QACnE,wEAAwE;QACxE,wEAAwE;QACxE,gEAAgE;QAChE,0EAA0E;QAC1E,kEAAkE;QAClE,IACE,IAAI,CAAC,UAAU;YACf,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO;YACtC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,GAAG,oBAAoB,EAC9C,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,SAAkB,CAAC;QACvB,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAAE,OAAO;QACtC,MAAM,MAAM,GAAG,SAA+B,CAAC;QAC/C,IACE,MAAM,CAAC,OAAO,KAAK,CAAC;YACpB,MAAM,CAAC,GAAG,KAAK,QAAQ;YACvB,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI;YAC9B,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAC1B,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACvF,sEAAsE;QACtE,0DAA0D;QAC1D,IAAI,CAAC,UAAU,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,OAAO;QACnB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QACvB,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1F,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,oEAAoE;QACpE,0DAA0D;QAC1D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,IAA4B;QACjE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACrE,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,GAAG;gBACV,GAAG,IAAI,CAAC,IAAI;gBACZ,OAAO,EAAE;oBACP,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO;oBACpB,CAAC,IAAI,CAAC,EAAE;wBACN,GAAG,IAAI;wBACP,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;wBACrC,SAAS,EAAE,GAAG;wBACd,IAAI,EAAE,IAAI,IAAI,QAAQ,EAAE,IAAI;qBAC7B;iBACF;aACF,CAAC;YACF,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,iEAAiE;QACjE,uEAAuE;QACvE,0DAA0D;QAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACrE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACK,YAAY,CAAC,IAAY,EAAE,KAAiB;QAClD,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,SAAU,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAAC;gBACnB,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,iBAAiB,IAAI,gDAAgD;gBAC9E,IAAI,EAAE,iCAAiC,IAAI,qCAAqC,IAAI,CAAC,QAAQ,oBAAoB;gBACjH,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;gBAC1C,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YAC/B,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC7B,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC/C,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YACxD,KAAK,QAAQ,CAAC;YACd,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3D,IAAI;gBACJ,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,IAAI,EAAE,CAAC,CAAC,IAAI;aACb,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK;QACH,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,CAAC,MAAM,CAAC,OAAO,CAAC;QACd,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;CACF;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CACnB,MAAkC,EAClC,IAAgC;IAEhC,MAAM,MAAM,GAA+B,EAAE,GAAG,IAAI,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;YAAE,SAAS;QAC3D,IAAI,CAAC,MAAM;YAAE,SAAS,CAAC,6CAA6C;QACpE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAO,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,CAAC;AACnG,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,CACL,aAAa,CAAC,CAAC,CAAC;QAChB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAC3B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,MAA0B;IACnD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,CAAC,GAAG,KAA4B,CAAC;QACvC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IACvF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,OAAmC;IACrD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}