@schema-weaver/pg-connector 0.0.0-stage → 2.0.1

package/dist/esm/cli/daemon/state.js

@@ -0,0 +1,352 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { getAgentHome, getAuditDirPath, getCredentialKeyPath, getDbConfigPath, getPidFilePath, getStatusFilePath, getErrorsPath, } from '../../config/paths';
+import { isProcessAlive } from './pid-file';
+import { isStatusStale } from './status-file';
+/* ------------------------------------------------------------------ */
+/* Daemon environment allow-list                                       */
+/* ------------------------------------------------------------------ */
+/**
+ * Variables the detached daemon child is allowed to inherit, copied verbatim.
+ *
+ * The child used to be spawned with `{ ...process.env }`, which handed it every
+ * variable the operator's shell happened to contain — including nine that
+ * materially change security posture (see `UNRECOGNISED_SECURITY_ENV`). The
+ * list below is the complete set of variables the daemon actually needs.
+ *
+ * Anything not listed here is dropped rather than inherited.
+ */
+export const DAEMON_ENV_ALLOW_LIST = [
+    // Process/runtime basics. The child is spawned with `process.execPath`, an
+    // absolute path, so PATH is only needed for the Windows `taskkill` fallback
+    // in `sw-agent clean`.
+    'PATH',
+    'HOME',
+    'SystemRoot',
+    'WINDIR',
+    'COMSPEC',
+    'PATHEXT',
+    'TEMP',
+    'TMP',
+    // POSIX locale/timezone: affects parsing and log rendering only.
+    'LANG',
+    'LC_ALL',
+    'TZ',
+    // TLS trust material for corporate proxies / private CAs.
+    'NODE_EXTRA_CA_CERTS',
+    'SSL_CERT_FILE',
+    'SSL_CERT_DIR',
+    // Corporate forward proxy support (documented feature).
+    'HTTP_PROXY',
+    'HTTPS_PROXY',
+    'NO_PROXY',
+    'http_proxy',
+    'https_proxy',
+    'no_proxy',
+    // Terminal capability detection for the CLI surfaces.
+    'TERM',
+    'TERM_PROGRAM',
+    'WT_SESSION',
+    'NO_COLOR',
+    'FORCE_COLOR',
+    'ConEmuANSI',
+    'MSYSTEM',
+    // Recognised SW_AGENT_* presentation and diagnostic toggles.
+    'SW_AGENT_NO_COLOR',
+    'SW_AGENT_ASCII',
+    'SW_AGENT_UNICODE',
+    'SW_AGENT_COLUMNS',
+    'SW_AGENT_DEBUG',
+    // Machine-local audit chain key. Provisioned by the operator on the host; it
+    // never leaves the machine, and the daemon cannot verify or extend the audit
+    // chain without it.
+    'SW_AGENT_AUDIT_KEY',
+    'SW_AGENT_AUDIT_KEY_PATH',
+    // Database scope. This one NARROWS access rather than widening it: an agent
+    // scoped to a subset must reach every database outside that subset never be
+    // reachable. Dropping it would turn a deliberately scoped deployment into an
+    // unscoped one, so it is allow-listed for the same reason the pool ceiling and
+    // statement_timeout ceilings are refused: honouring the operator's scope is
+    // the secure direction, and silently discarding it is the insecure one.
+    'SW_AGENT_ALLOWED_DATABASES',
+];
+/**
+ * Variables that look like configuration but are NOT allow-listed, and each
+ * value that would change the security posture if honoured.
+ *
+ * These are recognised — so they are not silently ignored — but they are
+ * refused rather than applied. `buildDaemonChildEnv` reports them so the parent
+ * can warn, and `stripUnrecognisedSecurityEnv` removes them so an
+ * already-running foreground process cannot be steered by an inherited value.
+ */
+export const UNRECOGNISED_SECURITY_ENV = {
+    SW_AGENT_E2E: 'enables a test-only inbound admin HTTP listener in the daemon',
+    PG_CONNECTOR_HOME: 'relocates the whole agent home, including the permission configuration',
+    SW_AGENT_MAX_STREAM_ROWS: 'raises the streaming row ceiling',
+    SW_AGENT_AUDIT_BUFFER: 'raises the audit queue depth above the durable write path',
+    SW_PG_POOL_MAX: 'raises the PostgreSQL pool ceiling',
+    SW_MAX_STATEMENT_TIMEOUT_MS: 'raises the statement_timeout ceiling',
+    SW_AGENT_MANUAL_APPROVAL_TIMEOUT_MS: 'changes how long an unapproved write stays pending',
+};
+/** Variables the child env builder sets itself, regardless of the parent. */
+const DAEMON_ENV_INJECTED = {
+    SW_AGENT_DAEMON: '1',
+};
+/**
+ * Build the environment for the detached daemon child.
+ *
+ * Only allow-listed variables are copied. `SW_AGENT_HOME` is pinned to the
+ * home the parent already resolved, and `SW_AGENT_DAEMON=1` is set. Anything in
+ * `UNRECOGNISED_SECURITY_ENV` that happened to be set is dropped and reported
+ * instead of being inherited.
+ */
+export function buildDaemonChildEnv(source = process.env, opts) {
+    const env = {};
+    for (const name of DAEMON_ENV_ALLOW_LIST) {
+        const value = source[name];
+        if (typeof value === 'string' && value.length > 0) {
+            env[name] = value;
+        }
+    }
+    const refused = [];
+    for (const [name, effect] of Object.entries(UNRECOGNISED_SECURITY_ENV)) {
+        if (typeof source[name] === 'string' && source[name].length > 0) {
+            refused.push({ name, effect });
+        }
+    }
+    for (const [name, value] of Object.entries(DAEMON_ENV_INJECTED)) {
+        env[name] = value;
+    }
+    env.SW_AGENT_HOME = opts.agentHome;
+    return { env, refused };
+}
+/**
+ * Delete every recognised-but-refused security variable from the live
+ * process environment. Called once at daemon startup so that a foreground
+ * `sw-agent start` cannot be steered by a value inherited from a `.service`
+ * file, wrapper script, PM2 ecosystem file, CI job, or Dockerfile `ENV`.
+ *
+ * Returns the names that were removed so the caller can log them.
+ */
+export function stripUnrecognisedSecurityEnv(target = process.env) {
+    const removed = [];
+    for (const name of Object.keys(UNRECOGNISED_SECURITY_ENV)) {
+        if (target[name] !== undefined) {
+            delete target[name];
+            removed.push(name);
+        }
+    }
+    return removed;
+}
+/* ------------------------------------------------------------------ */
+/* Resolved-home assertion                                     */
+/* ------------------------------------------------------------------ */
+/** The one code this module raises. */
+export const AGENT_HOME_MISMATCH_CODE = 'agent_home_mismatch';
+/**
+ * Raised when the home this process is about to use is not the home its
+ * environment asked for.
+ *
+ * A daemon that silently runs somewhere other than where it was told is the
+ * whole of a different `sw-agent.config.json`, a different
+ * `default_permission`, a different `allowed_databases`, a different audit
+ * directory and therefore a DIFFERENT AUDIT KEY, while the operator's
+ * `sw-agent audit verify` reviews the chain the daemon is not writing.
+ */
+export class AgentHomeMismatchError extends Error {
+    code = AGENT_HOME_MISMATCH_CODE;
+    constructor(message) {
+        super(`${AGENT_HOME_MISMATCH_CODE}: ${message}`);
+        this.name = 'AgentHomeMismatchError';
+    }
+}
+/**
+ * Resolves the agent home and everything derived from it, without throwing.
+ *
+ * `getAgentHome()` has a side effect — it creates the directory and repairs its
+ * mode — so it is called through the same accessor the rest of the daemon uses.
+ * A failure there (a read-only filesystem under `ProtectSystem=strict`, a
+ * permission problem) is reported as `null` rather than thrown, because the
+ * startup log must not be the thing that kills a daemon that is about to fail
+ * closed on its own.
+ */
+export function resolveAgentHomeReport(env = process.env) {
+    let resolved;
+    try {
+        resolved = getAgentHome();
+    }
+    catch {
+        return null;
+    }
+    const requested = env.SW_AGENT_HOME ?? null;
+    const defaulted = requested === null && !env.PG_CONNECTOR_HOME;
+    return {
+        requested,
+        resolved: path.resolve(resolved),
+        matches: requested === null
+            ? true
+            : path.resolve(resolved) === path.resolve(requested) && requested.trim().length > 0,
+        defaulted,
+        stale_home_var_present: typeof env.PG_CONNECTOR_HOME === 'string',
+        config: safeDerived(getDbConfigPath),
+        audit_dir: safeDerived(getAuditDirPath),
+        credential_key: safeDerived(getCredentialKeyPath),
+        pid_file: safeDerived(getPidFilePath),
+        status_file: safeDerived(getStatusFilePath),
+        errors_log: safeDerived(getErrorsPath),
+    };
+}
+function safeDerived(fn) {
+    try {
+        return fn();
+    }
+    catch {
+        return '<unresolved>';
+    }
+}
+/**
+ * The startup lines. Printed on EVERY daemon start, not only when
+ * `SW_AGENT_HOME` is set, because the failure this defends against is invisible
+ * from the journal: a daemon writing a fresh, empty audit chain in
+ * `~/.sw-agent` looks exactly like a healthy one.
+ *
+ * The absolute resolved path is the whole point. `journalctl -u schemaweaver`
+ * is where an operator checks that the 24/7 service is running against the home
+ * they configured, and before this existed the only evidence available was a
+ * unit file asserting a pin the daemon then ignored.
+ */
+export function formatAgentHomeReport(report) {
+    const lines = [
+        `[security] Resolved agent home: ${report.resolved}` +
+            (report.requested ? ` (from SW_AGENT_HOME=${report.requested})` : ' (default)'),
+        `[security]   config=${report.config}`,
+        `[security]   audit=${report.audit_dir}`,
+        `[security]   credential key=${report.credential_key}` +
+            ` (derived from HOME, not from the agent home)`,
+    ];
+    if (!report.matches) {
+        lines.push(`[security] MISMATCH: SW_AGENT_HOME=${report.requested} did not resolve to the agent ` +
+            `home in effect (${report.resolved}). Refusing to serve: the config, the database scope ` +
+            `and the audit chain the operator reviews would not be the ones in use.`);
+    }
+    if (report.stale_home_var_present) {
+        lines.push(`[security] WARNING: PG_CONNECTOR_HOME is still set in this process's environment. It is a ` +
+            'refused variable that is DELETED at startup, so any path already resolved from it now ' +
+            'points somewhere this process will not use.');
+    }
+    return lines;
+}
+/**
+ * Asserts the resolved agent home matches what the environment asked for, logs
+ * it, and returns the report.
+ *
+ * Called once per daemon start, after
+ * {@link stripUnrecognisedSecurityEnv}. Throws
+ * {@link AgentHomeMismatchError} rather than warning: a daemon running against a
+ * home nobody configured would apply a different `default_permission`, a
+ * different `allowed_databases` and a different audit key, which is worse than
+ * not running.
+ *
+ * A `SW_AGENT_HOME` that is not absolute is refused too. A relative value
+ * resolves against whatever working directory the supervisor happened to use,
+ * which is exactly how a systemd unit ends up pointing somewhere nobody chose.
+ */
+export function assertAndLogResolvedAgentHome(env = process.env, log = (line) => console.log(line)) {
+    const requested = env.SW_AGENT_HOME;
+    if (typeof requested === 'string' && !path.isAbsolute(requested)) {
+        throw new AgentHomeMismatchError(`SW_AGENT_HOME=${requested} is not an absolute path. It would resolve against whatever ` +
+            'working directory the supervisor chose. Use an absolute path.');
+    }
+    const report = resolveAgentHomeReport(env);
+    if (!report) {
+        log('[security] Could not resolve the agent home (the directory could not be created or ' +
+            'inspected). The daemon will fail closed rather than guess a home.');
+        throw new AgentHomeMismatchError('the agent home could not be resolved');
+    }
+    for (const line of formatAgentHomeReport(report))
+        log(line);
+    if (!report.matches) {
+        throw new AgentHomeMismatchError(`SW_AGENT_HOME=${report.requested} does not resolve to the agent home in effect ` +
+            `(${report.resolved})`);
+    }
+    return report;
+}
+export function resolveAgentRuntimeState(now = new Date()) {
+    const pidInfo = readJsonFile(getPidFilePath());
+    const statusInfo = readJsonFile(getStatusFilePath());
+    let kind = 'stopped';
+    let running = false;
+    let healthy = false;
+    let pid = null;
+    let version = null;
+    let startedAt = null;
+    let uptimeSec = null;
+    let lastHeartbeat = null;
+    let statusMismatch = false;
+    if (pidInfo) {
+        pid = pidInfo.pid;
+        version = pidInfo.version;
+        startedAt = pidInfo.started_at;
+        running = isProcessAlive(pidInfo.pid);
+        if (startedAt) {
+            const startedMs = new Date(startedAt).getTime();
+            if (Number.isFinite(startedMs)) {
+                uptimeSec = Math.max(0, Math.floor((now.getTime() - startedMs) / 1000));
+            }
+        }
+    }
+    if (!running) {
+        kind = 'stopped';
+    }
+    else if (!statusInfo) {
+        kind = 'starting';
+    }
+    else if (statusInfo.pid !== pid) {
+        statusMismatch = true;
+        kind = 'unresponsive';
+    }
+    else {
+        lastHeartbeat = statusInfo.last_heartbeat;
+        const stale = isStatusStale(statusInfo, now);
+        kind = stale ? 'unresponsive' : 'running';
+        healthy = !stale;
+    }
+    return {
+        kind,
+        running,
+        healthy,
+        pid,
+        version,
+        started_at: startedAt,
+        uptime_sec: uptimeSec,
+        last_heartbeat: lastHeartbeat,
+        status: statusInfo,
+        pidFile: pidInfo,
+        status_mismatch: statusMismatch,
+        errors_log: statusInfo?.errors_log ?? { path: getErrorsPath(), size_bytes: 0 },
+    };
+}
+function readJsonFile(file) {
+    try {
+        if (!fs.existsSync(file))
+            return null;
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+export function formatDuration(sec) {
+    const hours = Math.floor(sec / 3600);
+    const mins = Math.floor((sec % 3600) / 60);
+    const secs = Math.floor(sec % 60);
+    if (hours > 0)
+        return `${hours}h ${mins}m ${secs}s`;
+    if (mins > 0)
+        return `${mins}m ${secs}s`;
+    return `${secs}s`;
+}
+export function formatTimestamp(ts) {
+    return ts.replace('T', ' ').slice(0, 19);
+}
+//# sourceMappingURL=state.js.map

package/dist/esm/cli/daemon/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../../../src/cli/daemon/state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAW,MAAM,YAAY,CAAC;AACrD,OAAO,EAAgB,aAAa,EAAE,MAAM,eAAe,CAAC;AAE5D,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,2EAA2E;IAC3E,4EAA4E;IAC5E,uBAAuB;IACvB,MAAM;IACN,MAAM;IACN,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,SAAS;IACT,MAAM;IACN,KAAK;IACL,iEAAiE;IACjE,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,0DAA0D;IAC1D,qBAAqB;IACrB,eAAe;IACf,cAAc;IACd,wDAAwD;IACxD,YAAY;IACZ,aAAa;IACb,UAAU;IACV,YAAY;IACZ,aAAa;IACb,UAAU;IACV,sDAAsD;IACtD,MAAM;IACN,cAAc;IACd,YAAY;IACZ,UAAU;IACV,aAAa;IACb,YAAY;IACZ,SAAS;IACT,6DAA6D;IAC7D,mBAAmB;IACnB,gBAAgB;IAChB,kBAAkB;IAClB,kBAAkB;IAClB,gBAAgB;IAChB,6EAA6E;IAC7E,6EAA6E;IAC7E,oBAAoB;IACpB,oBAAoB;IACpB,yBAAyB;IACzB,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,4EAA4E;IAC5E,wEAAwE;IACxE,4BAA4B;CAC7B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAqC;IACzE,YAAY,EAAE,+DAA+D;IAC7E,iBAAiB,EAAE,wEAAwE;IAC3F,wBAAwB,EAAE,kCAAkC;IAC5D,qBAAqB,EAAE,2DAA2D;IAClF,cAAc,EAAE,oCAAoC;IACpD,2BAA2B,EAAE,sCAAsC;IACnE,mCAAmC,EAAE,oDAAoD;CAC1F,CAAC;AAEF,6EAA6E;AAC7E,MAAM,mBAAmB,GAAqC;IAC5D,eAAe,EAAE,GAAG;CACrB,CAAC;AAiBF;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAA4B,OAAO,CAAC,GAAG,EACvC,IAA2B;IAE3B,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAA4C,EAAE,CAAC;IAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACvE,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC;IAEnC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAA4B,OAAO,CAAC,GAAG;IAClF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAC1D,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wEAAwE;AACxE,iEAAiE;AACjE,wEAAwE;AAExE,uCAAuC;AACvC,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,IAAI,GAAG,wBAAwB,CAAC;IAEzC,YAAY,OAAe;QACzB,KAAK,CAAC,GAAG,wBAAwB,KAAK,OAAO,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AA4BD;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC;IAC5C,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC/D,OAAO;QACL,SAAS;QACT,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChC,OAAO,EACL,SAAS,KAAK,IAAI;YAChB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACvF,SAAS;QACT,sBAAsB,EAAE,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;QACjE,MAAM,EAAE,WAAW,CAAC,eAAe,CAAC;QACpC,SAAS,EAAE,WAAW,CAAC,eAAe,CAAC;QACvC,cAAc,EAAE,WAAW,CAAC,oBAAoB,CAAC;QACjD,QAAQ,EAAE,WAAW,CAAC,cAAc,CAAC;QACrC,WAAW,EAAE,WAAW,CAAC,iBAAiB,CAAC;QAC3C,UAAU,EAAE,WAAW,CAAC,aAAa,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,EAAgB;IACnC,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA+B;IACnE,MAAM,KAAK,GAAG;QACZ,mCAAmC,MAAM,CAAC,QAAQ,EAAE;YAClD,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;QACjF,uBAAuB,MAAM,CAAC,MAAM,EAAE;QACtC,sBAAsB,MAAM,CAAC,SAAS,EAAE;QACxC,+BAA+B,MAAM,CAAC,cAAc,EAAE;YACpD,+CAA+C;KAClD,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CACR,sCAAsC,MAAM,CAAC,SAAS,gCAAgC;YACpF,mBAAmB,MAAM,CAAC,QAAQ,uDAAuD;YACzF,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CACR,4FAA4F;YAC1F,wFAAwF;YACxF,6CAA6C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAyB,OAAO,CAAC,GAAG,EACpC,MAA8B,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAEzD,MAAM,SAAS,GAAG,GAAG,CAAC,aAAa,CAAC;IACpC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,sBAAsB,CAC9B,iBAAiB,SAAS,8DAA8D;YACtF,+DAA+D,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CACD,qFAAqF;YACnF,mEAAmE,CACtE,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,qBAAqB,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,sBAAsB,CAC9B,iBAAiB,MAAM,CAAC,SAAS,gDAAgD;YAC/E,IAAI,MAAM,CAAC,QAAQ,GAAG,CACzB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAoBD,MAAM,UAAU,wBAAwB,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;IACvD,MAAM,OAAO,GAAG,YAAY,CAAU,cAAc,EAAE,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,YAAY,CAAe,iBAAiB,EAAE,CAAC,CAAC;IAEnE,IAAI,IAAI,GAAqB,SAAS,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QAClB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC1B,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;QAC/B,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEtC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YAChD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/B,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;SAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvB,IAAI,GAAG,UAAU,CAAC;IACpB,CAAC;SAAM,IAAI,UAAU,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QAClC,cAAc,GAAG,IAAI,CAAC;QACtB,IAAI,GAAG,cAAc,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,aAAa,GAAG,UAAU,CAAC,cAAc,CAAC;QAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1C,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;IAED,OAAO;QACL,IAAI;QACJ,OAAO;QACP,OAAO;QACP,GAAG;QACH,OAAO;QACP,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,SAAS;QACrB,cAAc,EAAE,aAAa;QAC7B,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,OAAO;QAChB,eAAe,EAAE,cAAc;QAC/B,UAAU,EAAE,UAAU,EAAE,UAAU,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;KAC/E,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAI,IAAY;IACnC,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,KAAK,KAAK,IAAI,KAAK,IAAI,GAAG,CAAC;IACpD,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,GAAG,IAAI,KAAK,IAAI,GAAG,CAAC;IACzC,OAAO,GAAG,IAAI,GAAG,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC"}

package/dist/esm/cli/daemon/status-file.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Health of the audit writer, mirrored from `AuditSinkHealth` so `sw-agent
+ * status` can show whether the trail is actually being written instead of only
+ * how many events were counted.
+ *
+ * The required fields are exactly the ones an operator needs to tell a healthy
+ * writer from a silently failing one. Everything else the sink exposes is
+ * carried as optional, so an `AuditSinkHealth` can be assigned here directly and
+ * a producer that reports only the essentials still type-checks.
+ */
+export interface AuditStatusHealth {
+    /** False if the last append failed. Audit loss must never be silent. */
+    writable: boolean;
+    /** The audit directory the writer is using. */
+    dir: string;
+    dir_mode: number | null;
+    file_mode: number | null;
+    events_written: number;
+    events_failed: number;
+    /** Records actually lost. Any non-zero value is silent history loss. */
+    dropped: number;
+    last_write_at: string | null;
+    last_error: string | null;
+    chain_id: string | null;
+    /** Sequence number of the newest record this process wrote. */
+    seq: number;
+    chain_error: string | null;
+    /** Oldest sequence number still on disk, or null when nothing is retained. */
+    retained_from_seq: number | null;
+    ready?: boolean;
+    active_path?: string;
+    last_error_at?: string | null;
+    error_count?: number;
+    bytes_written?: number;
+    rotations?: number;
+    queue_depth?: number;
+    overflow_admitted?: number;
+}
+/**
+ * Effective security posture, as the daemon resolved it.
+ *
+ *  and  are both invisible by default: an agent with no database
+ * allow-list used to serve every configured database silently, and the local role
+ * ceiling had no reader at all. Both facts are printed to the console of a
+ * detached daemon that most operators never read, so the daemon also writes them
+ * here — this is the block `sw-agent status` renders.
+ *
+ * Optional because a status file written by an older daemon predates it, and
+ * because a reader that does not understand it must degrade rather than fail.
+ */
+export interface SecurityStatus {
+    /** One line stating the effective database scope in words. */
+    database_scope: string;
+    /** Whether any allow-list (`allowed_databases` / `SW_AGENT_ALLOWED_DATABASES`) is in force. */
+    allowlist_configured: boolean;
+    /**
+     * Whether the pre-remediation permissive default was deliberately restored with
+     * `security.allow_unscoped_databases: true`. When true, one token reaches every
+     * configured database.
+     */
+    allow_unscoped_databases: boolean;
+    /** True when the agent serves `ping` only because nothing is declared. */
+    fail_closed: boolean;
+    /** True when the environment channel narrowed the configured allow-list. */
+    env_narrowed_scope: boolean;
+    /**
+     * Effective local role ceiling. `'admin'` means a compromised relay has the
+     * full capability set on every database the agent can reach.
+     */
+    max_negotiable_role: string;
+}
+export interface DaemonStatus {
+    pid: number;
+    started_at: string;
+    last_heartbeat: string;
+    version: string;
+    channels: {
+        sse: 'connecting' | 'connected' | 'disconnected' | 'error';
+        wss: 'idle' | 'connecting' | 'connected' | 'disconnected' | 'error';
+        last_sse_reconnect?: string;
+        last_wss_session?: string;
+    };
+    stats: {
+        queries_served: number;
+        streams_served: number;
+        migrations_run: number;
+        cancellations: number;
+        permission_denies: number;
+        audit_events_written: number;
+        /**
+         * Records the sink could not persist. Optional because a status file written
+         * by a daemon without it predates the counter; readers treat an absent value
+         * as 0 rather than as "no failures".
+         */
+        audit_events_failed?: number;
+        audit_buffer_overflows: number;
+        /**
+         * Records the bounded audit queue discarded outright under pressure. Optional
+         * for the same reason as `audit_events_failed`: a status file written by a
+         * daemon without the counter predates it, and an absent value means "no drops
+         * reported", not "the trail is complete". Also available as `audit.dropped`.
+         */
+        audit_dropped?: number;
+    };
+    /**
+     * Audit writer health. Optional because a status file written by a build
+     * without it predates this field: readers must degrade to the counters rather
+     * than fail.
+     */
+    audit?: AuditStatusHealth;
+    config?: {
+        databases: number;
+        projects: number;
+        revision: number;
+    };
+    /** Location and size of the local, rotated error log. Surfaced by `sw-agent status`. */
+    errors_log?: {
+        path: string;
+        size_bytes: number;
+    };
+    /**
+     * Effective security posture (database scope, role ceiling). Optional so a
+     * status file written by a build without it still reads; `sw-agent status`
+     * degrades to the counters rather than failing.
+     */
+    security?: SecurityStatus;
+    last_error?: {
+        ts: string;
+        code: string;
+        message: string;
+    };
+}
+export interface StatusFileOptions {
+    path: string;
+}
+export declare function writeStatusFile(opts: StatusFileOptions, status: DaemonStatus): Promise<void>;
+export declare function readStatusFile(opts: StatusFileOptions): Promise<DaemonStatus | null>;
+export declare function isStatusStale(status: DaemonStatus, now?: Date): boolean;
+//# sourceMappingURL=status-file.d.ts.map

package/dist/esm/cli/daemon/status-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-file.d.ts","sourceRoot":"","sources":["../../../../src/cli/daemon/status-file.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,EAAE,OAAO,CAAC;IAClB,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,8EAA8E;IAC9E,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,oBAAoB,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAClC,0EAA0E;IAC1E,WAAW,EAAE,OAAO,CAAC;IACrB,4EAA4E;IAC5E,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE;QACR,GAAG,EAAE,YAAY,GAAG,WAAW,GAAG,cAAc,GAAG,OAAO,CAAC;QAC3D,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,WAAW,GAAG,cAAc,GAAG,OAAO,CAAC;QACpE,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,KAAK,EAAE;QACL,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;QACtB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,oBAAoB,EAAE,MAAM,CAAC;QAC7B;;;;WAIG;QACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,sBAAsB,EAAE,MAAM,CAAC;QAC/B;;;;;WAKG;QACH,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;OAIG;IACH,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,MAAM,CAAC,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,wFAAwF;IACxF,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,UAAU,CAAC,EAAE;QACX,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;CACd;AAID,wBAAsB,eAAe,CACnC,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAiB1F;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAKnF"}

package/dist/esm/cli/daemon/status-file.js

@@ -0,0 +1,50 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import * as crypto from 'crypto';
+export async function writeStatusFile(opts, status) {
+    const dir = path.dirname(opts.path);
+    await fs.promises.mkdir(dir, { recursive: true, mode: 0o700 });
+    const tmpPath = opts.path + '.tmp.' + crypto.randomBytes(8).toString('hex');
+    await fs.promises.writeFile(tmpPath, JSON.stringify(status, null, 2), {
+        mode: 0o600,
+        encoding: 'utf8',
+    });
+    for (let i = 0; i < 10; i++) {
+        try {
+            await fs.promises.rename(tmpPath, opts.path);
+            return;
+        }
+        catch (err) {
+            if (i === 9) {
+                throw err;
+            }
+            await new Promise((resolve) => setTimeout(resolve, 50));
+        }
+    }
+}
+export async function readStatusFile(opts) {
+    for (let i = 0; i < 10; i++) {
+        try {
+            const content = await fs.promises.readFile(opts.path, 'utf8');
+            return JSON.parse(content);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === 'ENOENT') {
+                return null;
+            }
+            if (i === 9) {
+                throw err;
+            }
+            await new Promise((resolve) => setTimeout(resolve, 50));
+        }
+    }
+    return null;
+}
+export function isStatusStale(status, now = new Date()) {
+    const heartbeatTime = new Date(status.last_heartbeat).getTime();
+    const nowTime = now.getTime();
+    const ageMs = nowTime - heartbeatTime;
+    return ageMs > 90_000;
+}
+//# sourceMappingURL=status-file.js.map

package/dist/esm/cli/daemon/status-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-file.js","sourceRoot":"","sources":["../../../../src/cli/daemon/status-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AA6I7B,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAuB,EACvB,MAAoB;IAEpB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE/D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,GAAG,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACpE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IAEH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAuB;IAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAiB,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAoB,EAAE,MAAY,IAAI,IAAI,EAAE;IACxE,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC;IAChE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,OAAO,GAAG,aAAa,CAAC;IACtC,OAAO,KAAK,GAAG,MAAM,CAAC;AACxB,CAAC"}