@schema-weaver/pg-connector 0.0.0-stage → 2.0.0

package/dist/esm/audit/sanitize.js

@@ -0,0 +1,307 @@
+/**
+ * Outbound error sanitisation.
+ *
+ * `Dispatcher.mapErrorToPayload` used to copy PostgreSQL's `message`, `detail`
+ * and `hint` straight onto the wire. DETAIL lines routinely carry row data:
+ *
+ *     ERROR:  duplicate key value violates unique constraint "users_email_key"
+ *     DETAIL:  Key (email)=(alice@corp.com) already exists.
+ *
+ * and `PoolError` messages embed host, port, user and database name. This path
+ * had no redaction at all, which made it the most reliable PII leak in the
+ * connector.
+ *
+ * The rules here are deny-by-default:
+ *   - only SQLSTATE codes on {@link PG_DETAIL_ALLOWLIST} may contribute
+ *     anything other than `code` + `severity`;
+ *   - the raw `detail`/`hint` are NEVER forwarded — the hint is always one of
+ *     our own strings from {@link PG_CURATED_HINTS};
+ *   - anything that does survive is passed through the SQL lexer (which turns
+ *     `Key (email)=(…)` into `Key (email)=(?)` and strips literals) and then
+ *     through {@link scrubTopology}, which removes hosts, users, database
+ *     names, absolute paths, URLs and email addresses.
+ */
+import { redactSqlLiterals, UNREDACTABLE } from './redact';
+/** Upper bound on any message we put on the wire. */
+const MAX_MESSAGE_CHARS = 400;
+/**
+ * SQLSTATE codes for which operator-useful detail text is surfaced.
+ *
+ * These are all class-22/23 (integrity), class-28 (auth), class-40 (transaction
+ * rollback), class-42 (syntax/access), class-53/55 (resource) and 57 (cancel)
+ * codes whose text is structural. Anything NOT listed here yields `code` +
+ * `severity` + a generic message only.
+ */
+export const PG_DETAIL_ALLOWLIST = new Set([
+    '23505', // unique_violation
+    '23503', // foreign_key_violation
+    '23502', // not_null_violation
+    '23514', // check_violation
+    '42501', // insufficient_privilege
+    '42P01', // undefined_table
+    '42703', // undefined_column
+    '42883', // undefined_function
+    '57014', // query_canceled
+    '53300', // too_many_connections
+    '55P03', // lock_not_available
+    '40001', // serialization_failure
+    '40P01', // deadlock_detected
+    '3D000', // invalid_catalog_name
+    '28P01', // invalid_password
+    '28000', // invalid_authorization_specification
+    '25P02', // in_failed_sql_transaction
+]);
+/**
+ * Our own one-line description for each SQLSTATE we recognise.
+ *
+ * These are strings written here, not derived from PostgreSQL output, so they
+ * cannot carry row data. Codes that are absent get a generic message that names
+ * only the SQLSTATE.
+ */
+export const PG_CURATED_MESSAGES = {
+    '22001': 'A value was longer than its column allows.',
+    '22003': 'A numeric value was outside the range its column allows.',
+    '22007': 'A date or time value is not valid.',
+    '22008': 'A date or time value was out of range.',
+    '22012': 'Division by zero.',
+    '22023': 'A parameter is outside the valid range.',
+    '22P02': 'A value could not be converted to the required type.',
+    '23502': 'A column that requires a value was given none.',
+    '23503': 'A foreign key constraint was violated: the referenced row is missing.',
+    '23505': 'A unique constraint was violated: the row already exists.',
+    '23514': 'A value failed a check constraint on the table.',
+    '23P01': 'No exclusion constraint permits this row.',
+    '25000': 'The transaction is in an invalid state for this operation.',
+    '25P01': 'The transaction is already aborted.',
+    '25P02': 'The current transaction cannot be committed or rolled back in this state.',
+    '28000': 'The database refused the operation for this role.',
+    '28P01': 'The database rejected the configured credentials.',
+    '3D000': 'The requested database does not exist.',
+    '40001': 'The transaction lost a serialization conflict. Retry it.',
+    '40P01': 'Deadlock detected. The transaction was rolled back.',
+    '42501': 'The database refused the operation: insufficient privilege.',
+    '42601': 'The statement is not valid PostgreSQL syntax.',
+    '42701': 'A column was specified more than once.',
+    '42703': 'A referenced column does not exist.',
+    '42704': 'The referenced object does not exist.',
+    '42710': 'A constraint with that name already exists.',
+    '42711': 'A column is defined more than once.',
+    '42804': 'A column, function or operator has the wrong type.',
+    '42883': 'The referenced function or operator does not exist.',
+    '42P01': 'The referenced table or view does not exist.',
+    '42P04': 'The requested database does not exist.',
+    '42P06': 'The requested schema already exists.',
+    '42P07': 'The requested table already exists.',
+    '53300': 'The database is out of connection slots.',
+    '55P03': 'The target object is currently locked by another transaction.',
+    '57014': 'The statement was cancelled or exceeded its timeout.',
+    '58030': 'The connection to the server was lost.',
+    XX000: 'The database reported an internal error.',
+};
+/**
+ * Our own hints. Never the server's `hint` field — that is attacker-influenced
+ * free text in the general case and is not on any allow-list.
+ */
+export const PG_CURATED_HINTS = {
+    '23505': 'A row with the same value already exists in a unique column or index.',
+    '23503': 'The referenced row is missing, or the child row is still referenced.',
+    '23502': 'A NOT NULL column was given NULL.',
+    '23514': 'A CHECK constraint rejected the row.',
+    '42501': 'The PostgreSQL role used by this agent lacks the required privilege.',
+    '42P01': 'Check the schema and table name, or run Introspect to list tables.',
+    '42703': 'Check the column name against the table definition.',
+    '42883': 'Check the function name and its argument types.',
+    '57014': 'The statement hit the configured statement_timeout or was cancelled.',
+    '53300': 'Wait for other sessions to finish, or raise the server max_connections.',
+    '55P03': 'Another transaction holds a conflicting lock. Retry after it commits.',
+    '40001': 'Retry the whole transaction; concurrent updates were detected.',
+    '40P01': 'Retry the transaction. Deadlocks are reported, not prevented.',
+    '3D000': 'Check the `database` value on this database entry.',
+    '28P01': 'Verify the password env var and that the PostgreSQL role can log in.',
+    '28000': 'Check the PostgreSQL role and its LOGIN attribute.',
+    '25P02': 'The current transaction is aborted; roll back before continuing.',
+};
+/** Codes where retrying the identical request can succeed. */
+export const PG_RETRYABLE_CODES = new Set([
+    '40001',
+    '40P01',
+    '53300',
+    '55P03',
+    '57014',
+    '57P03', // cannot_connect_now
+    '08000',
+    '08003',
+    '08006', // connection exceptions
+    '58030',
+]);
+/**
+ * Replacement text for `PoolError` codes. The originals interpolate host, port,
+ * user and database name, so they are never forwarded verbatim.
+ */
+export const POOL_ERROR_MESSAGES = {
+    env_var_missing: 'The database password is not available to the agent.',
+    connection_failed: 'Cannot reach the PostgreSQL server for this database.',
+    auth_failed: 'PostgreSQL rejected the credentials for this database.',
+    db_not_found: 'The configured PostgreSQL database does not exist.',
+    ssl_error: 'The TLS handshake with PostgreSQL failed.',
+    pool_exhausted: 'The connection pool for this database is exhausted.',
+    unsafe_session_setting: 'A session setting this agent requires was rejected.',
+};
+const GENERIC_MESSAGE = 'The database rejected the request. See the agent log for details.';
+/* ------------------------------------------------------------------ */
+/* Topology scrubbing                                                   */
+/* ------------------------------------------------------------------ */
+const SCRUB_RULES = [
+    // Connection URIs: postgres://user:pass@host:5432/db
+    [/\b[a-z][a-z0-9+.-]*:\/\/[^\s'")]+/gi, '<url>'],
+    // key=value forms used by libpq and the driver
+    [/\b(password|passfile|sslpassword)\s*=\s*("[^"]*"|'[^']*'|\S+)/gi, '$1=<redacted>'],
+    [
+        /\b(user|username|role|database|dbname|host|hostaddr|address|application_name)\s*[:=]\s*("[^"]*"|'[^']*'|\S+)/gi,
+        '$1=<redacted>',
+    ],
+    // prose forms: `for user "app_user"`, `on database "acme"`, `by role bob`
+    [
+        /\b(user|username|role|database|dbname|host|hostname|address)\s+("[^"]*"|'[^']*')/gi,
+        '$1 <redacted>',
+    ],
+    [
+        /\b(for|by|on)\s+(user|role|database|dbname)\s+("[^"]*"|'[^']*'|[^\s,;]+)/gi,
+        '$1 $2 <redacted>',
+    ],
+    // IPv4 / IPv6 literals, with or without a port
+    [/\[\s*[0-9A-Fa-f:.]+\s*\](?::\d{1,5})?/g, '<host>'],
+    [/\b\d{1,3}(?:\.\d{1,3}){3}(?::\d{1,5})?\b/g, '<host>'],
+    // a port, which is topology even without the host next to it
+    [/:\d{2,5}\b/g, ':<port>'],
+    // absolute filesystem paths
+    [/(^|[\s"'(=:])(?:\/[A-Za-z0-9._+-]+){2,}/g, '$1<path>'],
+    // email addresses (unquoted row values, log lines, NOTICE output)
+    [/[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+/g, '<email>'],
+    // a DNS name immediately followed by a port, as libpq and the driver print them
+    [/\b[A-Za-z0-9][A-Za-z0-9.-]*\.[A-Za-z][A-Za-z0-9-]*:\d{1,5}\b/g, '<host>'],
+];
+/**
+ * Remove hostnames, usernames, database names, URLs, absolute paths and email
+ * addresses from text that is about to leave the process.
+ */
+export function scrubTopology(text, topology) {
+    if (typeof text !== 'string' || text.length === 0)
+        return '';
+    let out = text;
+    const exact = [];
+    if (topology) {
+        for (const value of [topology.host, topology.user, topology.database, topology.project]) {
+            // 3 characters is the floor: a shorter value would match inside ordinary
+            // words and mangle the message. Leaking beats cosmetic damage, so this
+            // is deliberately low.
+            if (typeof value === 'string' && value.length >= 3)
+                exact.push(value);
+        }
+    }
+    // Longest first so `db.internal` is removed before `db`.
+    exact.sort((a, b) => b.length - a.length);
+    for (const value of exact) {
+        out = out.split(value).join('<redacted>');
+    }
+    for (const [re, replacement] of SCRUB_RULES) {
+        out = out.replace(re, replacement);
+    }
+    return collapse(out);
+}
+function collapse(text) {
+    return text.replace(/[ \t]{2,}/g, ' ').trim();
+}
+/* ------------------------------------------------------------------ */
+/* Public API                                                           */
+/* ------------------------------------------------------------------ */
+/** True when `code` may contribute detail text and a curated hint. */
+export function isDetailAllowed(code) {
+    return PG_DETAIL_ALLOWLIST.has(code);
+}
+function readString(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function asRecord(err) {
+    return err !== null && typeof err === 'object' ? err : {};
+}
+/**
+ * Redact + scrub one piece of free text so it can be shown to the operator and
+ * shipped to the browser. Quoted identifiers are redacted too, because
+ * PostgreSQL quotes row values in messages such as
+ * `invalid input syntax for type integer: "alice@corp.com"`.
+ */
+function cleanText(text, opts, redactIdentifiers = true) {
+    if (!text)
+        return undefined;
+    // The strict pass always runs first, so a caller-supplied redactor can never
+    // widen the output.
+    const first = redactSqlLiterals(text, { redactIdentifiers });
+    if (first === UNREDACTABLE)
+        return undefined;
+    const second = opts.redactSql ? opts.redactSql(first) : first;
+    if (!second || second === UNREDACTABLE)
+        return undefined;
+    const scrubbed = scrubTopology(second, opts.topology);
+    return scrubbed.length > 0 ? scrubbed : undefined;
+}
+/**
+ * Convert an arbitrary thrown value into a wire-safe error description.
+ *
+ * Never throws. Never returns row data, credentials, hostnames, usernames,
+ * database names or filesystem paths.
+ */
+export function sanitizePgError(err, opts = {}) {
+    const raw = asRecord(err);
+    const code = readString(raw.code) ?? 'UNKNOWN';
+    const severity = readString(raw.severity);
+    const name = readString(raw.name);
+    const message = readString(raw.message) ?? (typeof err === 'string' ? err : undefined);
+    const detail = readString(raw.detail);
+    const out = { code, message: '' };
+    if (severity)
+        out.severity = severity;
+    if (name === 'PoolError') {
+        out.message = POOL_ERROR_MESSAGES[code] ?? 'The agent could not use this database connection.';
+    }
+    else if (isDetailAllowed(code)) {
+        const parts = [PG_CURATED_MESSAGES[code] ?? 'The database reported an error.'];
+        const cleanedMessage = cleanText(message, opts);
+        if (cleanedMessage)
+            parts.push(cleanedMessage);
+        const cleanedDetail = cleanText(detail, opts);
+        if (cleanedDetail)
+            parts.push(cleanedDetail);
+        out.message = clamp(parts.join(' '));
+        const hint = PG_CURATED_HINTS[code];
+        if (hint)
+            out.hint = hint;
+    }
+    else {
+        out.message = clamp(`Database error (${code}). ${GENERIC_MESSAGE}`);
+    }
+    if (PG_RETRYABLE_CODES.has(code))
+        out.retryable = true;
+    return out;
+}
+/**
+ * Sanitise a free-text reason that came from our own permission layer. Those
+ * strings can embed a parser error, and a parser error embeds the SQL that
+ * failed to parse — so identifiers and literals are both redacted here.
+ */
+export function sanitizeReason(reason, opts = {}) {
+    const cleaned = cleanText(reason, opts);
+    return cleaned ?? 'Request denied.';
+}
+/**
+ * Sanitise a message that arrived as a bare string (e.g. a migration
+ * statement's recorded error) rather than as an error object.
+ */
+export function sanitizeErrorText(text, opts = {}) {
+    return cleanText(text ?? undefined, opts) ?? GENERIC_MESSAGE;
+}
+function clamp(text) {
+    const trimmed = collapse(text);
+    return trimmed.length > MAX_MESSAGE_CHARS ? trimmed.slice(0, MAX_MESSAGE_CHARS) + '…' : trimmed;
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/esm/audit/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../../src/audit/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AA4B3D,qDAAqD;AACrD,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IAC9D,OAAO,EAAE,mBAAmB;IAC5B,OAAO,EAAE,wBAAwB;IACjC,OAAO,EAAE,qBAAqB;IAC9B,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,yBAAyB;IAClC,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,mBAAmB;IAC5B,OAAO,EAAE,qBAAqB;IAC9B,OAAO,EAAE,iBAAiB;IAC1B,OAAO,EAAE,uBAAuB;IAChC,OAAO,EAAE,qBAAqB;IAC9B,OAAO,EAAE,wBAAwB;IACjC,OAAO,EAAE,oBAAoB;IAC7B,OAAO,EAAE,uBAAuB;IAChC,OAAO,EAAE,mBAAmB;IAC5B,OAAO,EAAE,sCAAsC;IAC/C,OAAO,EAAE,4BAA4B;CACtC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAqC;IACnE,OAAO,EAAE,4CAA4C;IACrD,OAAO,EAAE,0DAA0D;IACnE,OAAO,EAAE,oCAAoC;IAC7C,OAAO,EAAE,wCAAwC;IACjD,OAAO,EAAE,mBAAmB;IAC5B,OAAO,EAAE,yCAAyC;IAClD,OAAO,EAAE,sDAAsD;IAC/D,OAAO,EAAE,gDAAgD;IACzD,OAAO,EAAE,uEAAuE;IAChF,OAAO,EAAE,2DAA2D;IACpE,OAAO,EAAE,iDAAiD;IAC1D,OAAO,EAAE,2CAA2C;IACpD,OAAO,EAAE,4DAA4D;IACrE,OAAO,EAAE,qCAAqC;IAC9C,OAAO,EAAE,2EAA2E;IACpF,OAAO,EAAE,mDAAmD;IAC5D,OAAO,EAAE,mDAAmD;IAC5D,OAAO,EAAE,wCAAwC;IACjD,OAAO,EAAE,0DAA0D;IACnE,OAAO,EAAE,qDAAqD;IAC9D,OAAO,EAAE,6DAA6D;IACtE,OAAO,EAAE,+CAA+C;IACxD,OAAO,EAAE,wCAAwC;IACjD,OAAO,EAAE,qCAAqC;IAC9C,OAAO,EAAE,uCAAuC;IAChD,OAAO,EAAE,6CAA6C;IACtD,OAAO,EAAE,qCAAqC;IAC9C,OAAO,EAAE,oDAAoD;IAC7D,OAAO,EAAE,qDAAqD;IAC9D,OAAO,EAAE,8CAA8C;IACvD,OAAO,EAAE,wCAAwC;IACjD,OAAO,EAAE,sCAAsC;IAC/C,OAAO,EAAE,qCAAqC;IAC9C,OAAO,EAAE,0CAA0C;IACnD,OAAO,EAAE,+DAA+D;IACxE,OAAO,EAAE,sDAAsD;IAC/D,OAAO,EAAE,wCAAwC;IACjD,KAAK,EAAE,0CAA0C;CAClD,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAqC;IAChE,OAAO,EAAE,uEAAuE;IAChF,OAAO,EAAE,sEAAsE;IAC/E,OAAO,EAAE,mCAAmC;IAC5C,OAAO,EAAE,sCAAsC;IAC/C,OAAO,EAAE,sEAAsE;IAC/E,OAAO,EAAE,oEAAoE;IAC7E,OAAO,EAAE,qDAAqD;IAC9D,OAAO,EAAE,iDAAiD;IAC1D,OAAO,EAAE,sEAAsE;IAC/E,OAAO,EAAE,yEAAyE;IAClF,OAAO,EAAE,uEAAuE;IAChF,OAAO,EAAE,gEAAgE;IACzE,OAAO,EAAE,+DAA+D;IACxE,OAAO,EAAE,oDAAoD;IAC7D,OAAO,EAAE,sEAAsE;IAC/E,OAAO,EAAE,oDAAoD;IAC7D,OAAO,EAAE,kEAAkE;CAC5E,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IAC7D,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO,EAAE,qBAAqB;IAC9B,OAAO;IACP,OAAO;IACP,OAAO,EAAE,wBAAwB;IACjC,OAAO;CACR,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAqC;IACnE,eAAe,EAAE,sDAAsD;IACvE,iBAAiB,EAAE,uDAAuD;IAC1E,WAAW,EAAE,wDAAwD;IACrE,YAAY,EAAE,oDAAoD;IAClE,SAAS,EAAE,2CAA2C;IACtD,cAAc,EAAE,qDAAqD;IACrE,sBAAsB,EAAE,qDAAqD;CAC9E,CAAC;AAEF,MAAM,eAAe,GAAG,mEAAmE,CAAC;AAE5F,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AAExE,MAAM,WAAW,GAA6C;IAC5D,qDAAqD;IACrD,CAAC,qCAAqC,EAAE,OAAO,CAAC;IAChD,+CAA+C;IAC/C,CAAC,iEAAiE,EAAE,eAAe,CAAC;IACpF;QACE,gHAAgH;QAChH,eAAe;KAChB;IACD,0EAA0E;IAC1E;QACE,oFAAoF;QACpF,eAAe;KAChB;IACD;QACE,4EAA4E;QAC5E,kBAAkB;KACnB;IACD,+CAA+C;IAC/C,CAAC,wCAAwC,EAAE,QAAQ,CAAC;IACpD,CAAC,2CAA2C,EAAE,QAAQ,CAAC;IACvD,6DAA6D;IAC7D,CAAC,aAAa,EAAE,SAAS,CAAC;IAC1B,4BAA4B;IAC5B,CAAC,0CAA0C,EAAE,UAAU,CAAC;IACxD,kEAAkE;IAClE,CAAC,sDAAsD,EAAE,SAAS,CAAC;IACnE,gFAAgF;IAChF,CAAC,+DAA+D,EAAE,QAAQ,CAAC;CAC5E,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,QAA2B;IACrE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE7D,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACxF,yEAAyE;YACzE,uEAAuE;YACvE,uBAAuB;YACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,yDAAyD;IACzD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5C,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAChD,CAAC;AAED,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AAExE,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAO,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAChB,IAAwB,EACxB,IAAqB,EACrB,iBAAiB,GAAG,IAAI;IAExB,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,6EAA6E;IAC7E,oBAAoB;IACpB,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC7D,IAAI,KAAK,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9D,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAY,EAAE,OAAwB,EAAE;IACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAC/C,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEtC,MAAM,GAAG,GAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC/C,IAAI,QAAQ;QAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAEtC,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,GAAG,CAAC,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,mDAAmD,CAAC;IACjG,CAAC;SAAM,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAa,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,iCAAiC,CAAC,CAAC;QACzF,MAAM,cAAc,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,cAAc;YAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,aAAa;YAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7C,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAC5B,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC,mBAAmB,IAAI,MAAM,eAAe,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;IACvD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,OAAwB,EAAE;IACvE,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,OAAO,OAAO,IAAI,iBAAiB,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAA+B,EAC/B,OAAwB,EAAE;IAE1B,OAAO,SAAS,CAAC,IAAI,IAAI,SAAS,EAAE,IAAI,CAAC,IAAI,eAAe,CAAC;AAC/D,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AAClG,CAAC"}

package/dist/esm/audit/sink.d.ts

@@ -0,0 +1,278 @@
+import { LocalAuditWriter } from './local-writer';
+import { CloudAuditWriter } from './cloud-writer';
+import { AuditActor, AuditEvent, AuditFilter, AuditQueryResult, AuditSinkHealth } from './types';
+import { type ResolvedDbIdentity } from './context';
+/**
+ * Fields the sink fills in itself; a caller supplies only the facts it knows.
+ *
+ * `resolved_db_alias`/`resolved_database` are deliberately NOT part of what a
+ * caller may supply: they are stamped by the sink from the per-request resolved
+ * context (`withResolvedDatabase`), so a call site cannot record the frame's
+ * claimed database and call it resolved.
+ */
+export type PendingEvent = Omit<AuditEvent, 'id' | 'ts' | 'agent_id' | 'seq' | 'chain_id' | 'prev_hash' | 'mac' | 'hash' | 'actor' | 'resolved_db_alias' | 'resolved_database'> & {
+    id?: string;
+    /**
+     * `user` (default) for cloud-asserted principals, `local` for a host-local
+     * operator, `system` for agent records. An absent value stays `user`, so
+     * every pre-existing call site keeps its meaning.
+     */
+    actor?: AuditActor;
+};
+export interface AuditSinkOptions {
+    agentId: string;
+    localWriter: LocalAuditWriter;
+    cloudWriter: CloudAuditWriter;
+    bufferSize?: number;
+    /**
+     * Hard cap on **queued** records. Past it the **oldest** are dropped, because
+     * an unbounded queue under sustained write pressure is unbounded memory in the
+     * daemon — the same defect class `CloudClient.maxQueueItems` closes (finding
+     * M-07). Default 4096.
+     *
+     * Only records that carry no authorization decision are ever queued (see
+     * {@link AuditSink}), so this bounds the sink's own memory no matter how much
+     * decision traffic arrives. It is clamped to at least `bufferSize`.
+     */
+    maxQueueItems?: number;
+    /**
+     * Called whenever queued records are dropped instead of written. Mirrors
+     * `CloudClient.onDrop`: the counter in {@link AuditSink.getHealth} is the
+     * marker, and an owner with a durable log elsewhere can record the loss.
+     * Never allowed to throw into the write path.
+     */
+    onDrop?: (drop: AuditDrop) => void;
+    /** Directory holding `audit.key`. Defaults to the agent home. */
+    keyDir?: string;
+    /** Explicit HMAC key (32-byte Buffer, or 64 hex chars). Overrides `keyDir`. */
+    key?: Buffer | string;
+    /** Upper bound on records scanned by `query()`. Default 200000. */
+    maxScanRecords?: number;
+}
+/** Why a queued record was dropped instead of written. */
+export type AuditDropReason = 'queue_overflow';
+export interface AuditDrop {
+    /** How many records were dropped in this event. */
+    count: number;
+    reason: AuditDropReason;
+    /** Queue depth after the drop. */
+    queueDepth: number;
+    /** The hard cap that was hit. */
+    maxQueueItems: number;
+}
+/**
+ * The audit sink: builds keyed, sequenced records, appends them locally and
+ * mirrors them to the cloud.
+ *
+ * Chain integrity rules:
+ *   - every record is MAC'd with the installation key and stamped with a
+ *     monotonically increasing `seq`
+ *   - `{seq, last_hash}` is anchored in `head.json` at every durable commit
+ *   - the head is recovered on first append (from `head.json` plus the tail of
+ *     the newest log file), so a restart continues the chain instead of
+ *     restarting it (finding H-13)
+ *   - a tail that does not verify is a loud, exposed failure — never a silent
+ *     new chain in the same file
+ *
+ * Buffer pressure (findings M-04, M-07): every write is serialised through one
+ * FIFO write lane, which is what keeps `seq`/`prev_hash` coherent. Records split
+ * by how they reach that lane:
+ *   - **never queued** — `logSync()` (an awaited record) and any record carrying
+ *     an authorization decision (`allow`/`deny`). They take the write lane
+ *     directly, so no amount of pressure can drop one, reject one, or make its
+ *     caller wait for queue space. This is the guaranteed path.
+ *   - **queued** — fire-and-forget `log()` records with no authorization
+ *     decision (manual-approval lifecycle telemetry). The queue is hard-capped
+ *     at `maxQueueItems`; past it the **oldest** are dropped and counted, so
+ *     sustained pressure cannot grow the heap without bound.
+ *
+ * A full queue is therefore not an error and never rejects a caller; the loss is
+ * counted (`getHealth().dropped`), logged, persisted as an `audit_overflow`
+ * record and handed to `onDrop`.
+ *
+ * Every record also carries the **resolved** database identity
+ * (`resolved_db_alias`, `resolved_database`), taken from the per-request context
+ * established by `withResolvedDatabase` and never from the caller. With
+ * no context established the value is the fail-closed `'unresolved'`.
+ */
+export declare class AuditSink {
+    private readonly opts;
+    private queue;
+    private draining;
+    private pendingFlush;
+    /**
+     * FIFO serialisation for every record write. Admission order is chain order;
+     * a lane slot is held only for the duration of one append.
+     */
+    private writeLane;
+    /** Records admitted but not yet written, queued or straight through. */
+    private pending;
+    private overflowPending;
+    private overflowTotal;
+    /** Drops since the last `audit_overflow` record was written. */
+    private overflowDropped;
+    private dropped;
+    private chainInit;
+    private auditKey;
+    private seq;
+    private lastHash;
+    private head;
+    /**
+     * Oldest sequence number still on disk. Rotation evicts the oldest archives,
+     * so verification starts here instead of at the genesis hash. Monotonic: it is
+     * a promise about what the log retains.
+     */
+    private retainedFromSeq;
+    /** Highest sequence number already anchored in the floor file. */
+    private floorSeq;
+    private floorErrorReported;
+    private chainError;
+    private chainErrorReported;
+    private eventsWritten;
+    private eventsFailed;
+    private writeErrorReported;
+    constructor(opts: AuditSinkOptions);
+    /** Chain identity, once established. */
+    get chainId(): string | null;
+    /**
+     * Attribute every audit record written inside `fn` to a resolved database.
+     *
+     * A thin delegate to the module-level context store, exposed here because the
+     * sink is where the contract lives: `log()`/`logSync()` read the identity from
+     * that store, so this method is the only supported way to supply one. It does
+     * not depend on sink instance state, which is what lets a caller that holds a
+     * hand-rolled sink in a test still get the same record shape.
+     */
+    withResolvedDatabase<T>(identity: ResolvedDbIdentity, fn: () => T): T;
+    /** Sequence number of the newest record this instance has written. */
+    get currentSeq(): number;
+    /**
+     * Fire-and-forget append. The record is written and committed by the next
+     * group commit; it is not guaranteed durable when this returns.
+     *
+     * A record that carries an authorization decision (`allow`/`deny`) bypasses
+     * the bounded queue and takes the write lane directly: a decision is never
+     * droppable and never waits for queue space. Everything else is queued and is
+     * subject to the `maxQueueItems` drop-oldest policy.
+     */
+    log(partial: PendingEvent): void;
+    /**
+     * Awaited append. Resolves only once the record (and the chain head that
+     * anchors it) is fsync'd. A write failure rejects — audit loss is never
+     * swallowed on this path.
+     *
+     * Never queued: buffer pressure can neither reject this call nor drop the
+     * record (finding M-04). The caller waits for its own append, never for queue
+     * room, so the wait is bounded by one write rather than by the backlog.
+     */
+    logSync(partial: PendingEvent): Promise<void>;
+    flush(): Promise<void>;
+    /**
+     * Filters the log and verifies the chain in the same streaming pass, so a full
+     * history is never materialised (finding M-06).
+     */
+    query(filter: AuditFilter): Promise<AuditQueryResult>;
+    /**
+     * The strongest claim about where the chain ends: this process's head plus the
+     * monotonic floor, which a second process (or a restored backup) may have moved
+     * further than the in-memory head.
+     */
+    private currentAnchor;
+    getHealth(): AuditSinkHealth;
+    /**
+     * Establishes the key and recovers the chain head. Idempotent; the promise is
+     * memoised so concurrent appends share one recovery.
+     */
+    private ensureChain;
+    private initChain;
+    private establishKey;
+    /**
+     * Validates the tail record against the key. Returns a problem description,
+     * or null when the tail is a legitimate continuation point.
+     */
+    private inspectTail;
+    /**
+     * Refuses to continue on a chain that does not verify. Throwing here is the
+     * point: the alternative — starting a fresh chain in the same file — would
+     * silently erase the evidence of the damage.
+     */
+    private failChain;
+    private reportChainError;
+    private onDurableCommit;
+    private persistHead;
+    private reportFloorError;
+    private buildEvent;
+    private record;
+    private buildVerifier;
+    /**
+     * Serialises every record write. This is what keeps `seq`, `prev_hash` and the
+     * anchored head consistent, and it is FIFO, so records enter the chain in
+     * admission order.
+     *
+     * A lane slot is held for the duration of one append only, which is what lets
+     * a decision record overtake queued telemetry instead of waiting behind it.
+     */
+    private runInWriteLane;
+    /**
+     * Records an admission: takes a slot in the outstanding-work count and, if
+     * the high-water mark is already exceeded, books an overflow admission. Every
+     * entry point (queued or straight through) goes through here, so the reported
+     * count describes the real backlog rather than one particular lane.
+     */
+    private admit;
+    /**
+     * The guaranteed path: straight to the write lane, never queued.
+     *
+     * Nothing here can be dropped or rejected for buffer pressure, and the caller
+     * never waits for queue room — only for its own append.
+     */
+    private writeThrough;
+    /**
+     * Queues a fire-and-forget, non-decision record.
+     *
+     * A full queue is *not* an error and never rejects the caller for pressure:
+     * the **oldest** entries are dropped to make room (drop-oldest, matching
+     * `CloudClient.maxQueueItems`, finding M-07) and every drop is counted,
+     * logged, persisted and handed to `onDrop`. Rejecting in-flight callers
+     * instead turned buffer pressure into a global query-kill switch and dropped
+     * the denial records that matter most (finding M-04).
+     *
+     * Only records that carry no authorization decision reach here — see
+     * {@link AuditSink.log} — so the eviction can never touch an allow/deny.
+     */
+    private enqueueQueued;
+    /**
+     * Single serial worker for the queue.
+     *
+     * Work queued while the worker is shutting down must not be lost: the queue is
+     * re-checked immediately after `draining` is cleared, with no `await` in
+     * between, so an entry can never be stranded with nobody left to run it.
+     */
+    private drain;
+    /**
+     * Releases a waiting `flush()` once nothing is outstanding — no queued entry,
+     * no write in flight. Straight-through records call this as they settle, so a
+     * flush cannot return while a decision record is still being written.
+     */
+    private settleIfIdle;
+    /**
+     * Writes the queue-pressure record: how many records were admitted above the
+     * high-water mark, and how many were dropped outright. Both numbers are read
+     * before they are reset (the previous code reset first, so the record always
+     * reported the wrong number).
+     */
+    private reportOverflowIfDue;
+    /**
+     * Counts a drop, says so out loud, and hands it to the `onDrop` marker hook —
+     * the same contract as `CloudClient.onDrop`. Audit loss is counted and
+     * reported, never discarded quietly.
+     */
+    private reportDrop;
+    /**
+     * Complains once per distinct failure so audit loss is never silent. The
+     * writer already announced a persistence failure, so this stays quiet rather
+     * than printing the same problem twice.
+     */
+    private reportWriteError;
+}
+//# sourceMappingURL=sink.d.ts.map

package/dist/esm/audit/sink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sink.d.ts","sourceRoot":"","sources":["../../../src/audit/sink.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EACL,UAAU,EAEV,UAAU,EACV,WAAW,EAEX,gBAAgB,EAChB,eAAe,EAChB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAmD,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAErG;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,CAC7B,UAAU,EACR,IAAI,GACJ,IAAI,GACJ,UAAU,GACV,KAAK,GACL,UAAU,GACV,WAAW,GACX,KAAK,GACL,MAAM,GACN,OAAO,GACP,mBAAmB,GACnB,mBAAmB,CACtB,GAAG;IACF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,IAAI,CAAC;IACnC,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,0DAA0D;AAC1D,MAAM,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAE/C,MAAM,WAAW,SAAS;IACxB,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,eAAe,CAAC;IACxB,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,aAAa,EAAE,MAAM,CAAC;CACvB;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAGnB;IACF,OAAO,CAAC,KAAK,CAAoB;IACjC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAA6B;IAEjD;;;OAGG;IACH,OAAO,CAAC,SAAS,CAAuC;IACxD,wEAAwE;IACxE,OAAO,CAAC,OAAO,CAAK;IAEpB,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,aAAa,CAAK;IAC1B,gEAAgE;IAChE,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,OAAO,CAAK;IAEpB,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,QAAQ,CAAyB;IACzC,OAAO,CAAC,GAAG,CAAK;IAChB,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,IAAI,CAA0B;IACtC;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAuB;IAC9C,kEAAkE;IAClE,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,kBAAkB,CAAuB;IACjD,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,kBAAkB,CAAuB;IAEjD,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,kBAAkB,CAAuB;gBAErC,IAAI,EAAE,gBAAgB;IAmClC,wCAAwC;IACxC,IAAI,OAAO,IAAI,MAAM,GAAG,IAAI,CAE3B;IAED;;;;;;;;OAQG;IACH,oBAAoB,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC;IAIrE,sEAAsE;IACtE,IAAI,UAAU,IAAI,MAAM,CAEvB;IAMD;;;;;;;;OAQG;IACH,GAAG,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;IAWhC;;;;;;;;OAQG;IACG,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAU5B;;;OAGG;IACG,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA6C3D;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAarB,SAAS,IAAI,eAAe;IAoB5B;;;OAGG;IACH,OAAO,CAAC,WAAW;YAsBL,SAAS;IA+DvB,OAAO,CAAC,YAAY;IAkBpB;;;OAGG;IACH,OAAO,CAAC,WAAW;IAsBnB;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,WAAW;IAsBnB,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,UAAU;YA8DJ,MAAM;YAaN,aAAa;IAiB3B;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;IAStB;;;;;OAKG;IACH,OAAO,CAAC,KAAK;IAOb;;;;;OAKG;YACW,YAAY;IAc1B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,aAAa;IA2BrB;;;;;;OAMG;YACW,KAAK;IAmCnB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAQpB;;;;;OAKG;YACW,mBAAmB;IA0CjC;;;;OAIG;IACH,OAAO,CAAC,UAAU;IAiBlB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;CAUzB"}