@spool-lab/core 0.4.12 → 0.4.20

package/dist/security/repo.js

@@ -0,0 +1,469 @@
+// Findings + allowlist repository.
+//
+// Plain better-sqlite3 prepared statements. No Effect here — this
+// module is called from both the scan worker (Effect, wraps these in
+// Effect.sync) and the IPC handlers (Promise-shaped). Keeping it
+// effect-free preserves the worker / boundary split documented in
+// the spec's "Implementation: Effect TS scope" section.
+//
+// Invariant: `findings.value_hash` is FNV-1a, computed via the
+// share-kit-aligned `hashValueForRedactExclude` so identity matches
+// across surfaces (share editor's exclude list, security allowlists).
+import { HIGH_SEVERITY_KINDS, INFO_SEVERITY_KINDS, severityOf } from '@spool-lab/redact';
+function rowToFinding(r) {
+    return {
+        id: r.id,
+        sessionId: r.session_id,
+        messageId: r.message_id,
+        kind: r.kind,
+        valueHash: r.value_hash,
+        confidence: r.confidence,
+        provider: r.provider,
+        startOffset: r.start_offset,
+        endOffset: r.end_offset,
+        state: r.state,
+        detectedAt: r.detected_at,
+        stateChangedAt: r.state_changed_at,
+    };
+}
+/** Insert a batch of findings. Caller wraps in a transaction. */
+export function insertFindings(db, rows) {
+    if (rows.length === 0)
+        return;
+    const stmt = db.prepare(`INSERT INTO findings
+       (session_id, message_id, kind, value_hash, confidence, provider,
+        start_offset, end_offset, state, state_changed_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+    for (const r of rows) {
+        stmt.run(r.sessionId, r.messageId, r.kind, r.valueHash, r.confidence, r.provider, r.startOffset, r.endOffset, r.state, r.state !== 'active' ? new Date().toISOString() : null);
+    }
+}
+/** Delete all non-purged rows for the providers being rescanned —
+ *  i.e. wipe the producer's previous output so the upcoming
+ *  `insertFindings` is the canonical truth.
+ *
+ *  Includes `state='dismissed'` deliberately: those rows are derived
+ *  state. The user's "ignore" decisions live in `allowlist_session`
+ *  and `allowlist_global` (preserved here), and the scan path
+ *  re-emits findings as `state='dismissed'` whenever it encounters a
+ *  hit that matches an allowlist row. Re-inserting also keeps
+ *  `findings.value_hash` aligned with the per-kind allowlist
+ *  preference (security.json `kindAllowlist`) — without this delete,
+ *  a mute → unmute cycle would accumulate phantom dismissed rows
+ *  (one set per cycle), inflating audit counts and breaking
+ *  `riskByCategory` totals over time.
+ *
+ *  Purged rows are the only state that's NOT producer-derived —
+ *  they correspond to destructive `messages.content_text` rewrites
+ *  the user explicitly approved. Preserving them is the audit
+ *  contract documented in the design doc. */
+export function deleteRefreshableFindings(db, sessionId, providers) {
+    if (providers.length === 0)
+        return;
+    const placeholders = providers.map(() => '?').join(',');
+    db.prepare(`DELETE FROM findings
+     WHERE session_id = ?
+       AND state IN ('active','dismissed')
+       AND provider IN (${placeholders})`).run(sessionId, ...providers);
+}
+/** @deprecated Renamed to {@link deleteRefreshableFindings} after the
+ *  active-only filter was found to leak phantom dismissed rows
+ *  across mute→unmute cycles. Kept as a thin alias so callers
+ *  outside the repo don't break mid-stack. */
+export const deleteActiveFindings = deleteRefreshableFindings;
+// ─── Counts (denormalised on sessions) ────────────────────────────
+/** Recompute sessions.scan_finding_count + scan_high_count from the
+ *  findings table.
+ *
+ *  Counts EXCLUDE info-tier kinds (absolute-path, ip, internal-host).
+ *  Those are stored — useful for an opt-in "Show informational
+ *  signals" toggle — but they don't drive the Library row badge
+ *  because their pattern-only signal has too high a false-positive
+ *  rate to be meaningful at first glance. */
+export function updateSessionCounts(db, sessionId) {
+    const active = db.prepare(`SELECT
+        SUM(CASE WHEN kind NOT IN (${infoKindsPlaceholders()}) THEN 1 ELSE 0 END) AS total,
+        SUM(CASE WHEN kind IN (${highKindsPlaceholders()}) THEN 1 ELSE 0 END) AS high
+     FROM findings
+     WHERE session_id = ? AND state = 'active'`).get(...INFO_SEVERITY_KINDS_ARRAY, ...HIGH_SEVERITY_KINDS_ARRAY, sessionId);
+    const purged = db.prepare(`SELECT COUNT(*) AS c
+       FROM findings
+      WHERE session_id = ? AND state = 'purged'`).get(sessionId);
+    db.prepare(`UPDATE sessions
+        SET scan_finding_count = ?,
+            scan_high_count    = ?,
+            scan_purged_count  = ?
+      WHERE id = ?`).run(active.total ?? 0, active.high ?? 0, purged.c, sessionId);
+}
+const HIGH_SEVERITY_KINDS_ARRAY = Array.from(HIGH_SEVERITY_KINDS);
+const INFO_SEVERITY_KINDS_ARRAY = Array.from(INFO_SEVERITY_KINDS);
+function highKindsPlaceholders() {
+    return HIGH_SEVERITY_KINDS_ARRAY.map(() => '?').join(',');
+}
+function infoKindsPlaceholders() {
+    return INFO_SEVERITY_KINDS_ARRAY.map(() => '?').join(',');
+}
+export function setSessionScanProfile(db, sessionId, profile, completedAt) {
+    db.prepare(`UPDATE sessions
+        SET scan_profile = ?, scan_completed_at = ?
+      WHERE id = ?`).run(profile, completedAt, sessionId);
+}
+/** Set every session's scan_profile to NULL — used by "Rescan all" so
+ *  every session re-enqueues. */
+export function invalidateAllScanProfiles(db) {
+    const r = db.prepare('UPDATE sessions SET scan_profile = NULL').run();
+    return r.changes;
+}
+/** Drop the scan profile for one session — used by the sync cascade
+ *  when a session's messages change after first scan. */
+export function invalidateSessionScanProfile(db, sessionId) {
+    db.prepare(`UPDATE sessions
+        SET scan_profile = NULL,
+            scan_completed_at = NULL
+      WHERE id = ?`).run(sessionId);
+}
+/** Sessions whose stored profile doesn't structurally match
+ *  `currentProfile`. Used at boot for backfill enqueue. */
+export function listSessionsNeedingScan(db, currentProfile) {
+    const rows = db.prepare(`SELECT id, scan_profile
+       FROM sessions
+      ORDER BY started_at DESC`).all();
+    const out = [];
+    for (const r of rows) {
+        if (r.scan_profile === null || r.scan_profile !== currentProfile) {
+            out.push(r.id);
+        }
+    }
+    return out;
+}
+// ─── Reads (UI path) ──────────────────────────────────────────────
+export function listFindings(db, filter) {
+    const where = [];
+    const params = [];
+    if (filter.sessionId !== undefined) {
+        where.push('session_id = ?');
+        params.push(filter.sessionId);
+    }
+    if (filter.kinds && filter.kinds.length > 0) {
+        const placeholders = filter.kinds.map(() => '?').join(',');
+        where.push(`kind IN (${placeholders})`);
+        params.push(...filter.kinds);
+    }
+    else if (filter.kind !== undefined) {
+        where.push('kind = ?');
+        params.push(filter.kind);
+    }
+    if (filter.state && filter.state !== 'any') {
+        where.push('state = ?');
+        params.push(filter.state);
+    }
+    else if (!filter.state) {
+        // Default: active only.
+        where.push("state = 'active'");
+    }
+    if (filter.severity === 'high') {
+        where.push(`kind IN (${highKindsPlaceholders()})`);
+        params.push(...HIGH_SEVERITY_KINDS_ARRAY);
+    }
+    else if (filter.severity === 'low') {
+        where.push(`kind NOT IN (${highKindsPlaceholders()})`);
+        params.push(...HIGH_SEVERITY_KINDS_ARRAY);
+    }
+    let pagination = '';
+    if (filter.limit !== undefined) {
+        pagination = ' LIMIT ? OFFSET ?';
+        params.push(filter.limit, filter.offset ?? 0);
+    }
+    const sql = `SELECT * FROM findings
+               ${where.length ? 'WHERE ' + where.join(' AND ') : ''}
+               ORDER BY detected_at DESC, id DESC${pagination}`;
+    const rows = db.prepare(sql).all(...params);
+    return rows.map(rowToFinding);
+}
+/** limit+1 peek to set `hasMore` without an extra COUNT round-trip. */
+function paginate(filter, fetch) {
+    if (filter.limit === undefined)
+        return { rows: fetch(filter), hasMore: false };
+    const peeked = fetch({ ...filter, limit: filter.limit + 1 });
+    const hasMore = peeked.length > filter.limit;
+    return { rows: hasMore ? peeked.slice(0, filter.limit) : peeked, hasMore };
+}
+export function listFindingsPage(db, filter) {
+    return paginate(filter, f => listFindings(db, f));
+}
+/** Shared WHERE-clause builder for the session-findings join. Used by
+ *  both `listSessionsWithFindings` (paginated rows) and
+ *  `countSessionsWithFindings` (total) so the two stay consistent. */
+function buildSessionFindingWhereSql(filter) {
+    const params = [];
+    const stateCondition = filter.state && filter.state !== 'any'
+        ? 'f.state = ?'
+        : "f.state = 'active'";
+    if (filter.state && filter.state !== 'any')
+        params.push(filter.state);
+    let kindCondition = '';
+    const explicitKinds = filter.kinds && filter.kinds.length > 0
+        ? filter.kinds
+        : filter.kind !== undefined ? [filter.kind] : undefined;
+    if (explicitKinds) {
+        const placeholders = explicitKinds.map(() => '?').join(',');
+        kindCondition = `AND f.kind IN (${placeholders})`;
+        params.push(...explicitKinds);
+    }
+    let severityCondition = '';
+    if (filter.severity === 'high') {
+        severityCondition = `AND f.kind IN (${highKindsPlaceholders()})`;
+        params.push(...HIGH_SEVERITY_KINDS_ARRAY);
+    }
+    else if (filter.severity === 'low') {
+        // Exclude both HIGH (not low) and INFO (noisy infra signals) so
+        // `severity:low` returns only the identity-tier kinds (email,
+        // phone, person-name, etc.).
+        severityCondition = `AND f.kind NOT IN (${highKindsPlaceholders()}) AND f.kind NOT IN (${infoKindsPlaceholders()})`;
+        params.push(...HIGH_SEVERITY_KINDS_ARRAY, ...INFO_SEVERITY_KINDS_ARRAY);
+    }
+    // Default exclusion: info-tier findings don't surface a session on
+    // their own — they're stored as an audit record (see Info drawer at
+    // the bottom of the page). Only when the user has explicitly pinned
+    // an info kind via filter.kind/filter.kinds do we let them through.
+    let infoExclusion = '';
+    if (!explicitKinds && filter.severity !== 'high' && filter.severity !== 'low') {
+        infoExclusion = `AND f.kind NOT IN (${infoKindsPlaceholders()})`;
+        params.push(...INFO_SEVERITY_KINDS_ARRAY);
+    }
+    let textCondition = '';
+    if (filter.text && filter.text.trim().length > 0) {
+        textCondition = `AND s.title LIKE ?`;
+        params.push(`%${filter.text.trim()}%`);
+    }
+    const whereClause = `${stateCondition} ${kindCondition} ${severityCondition} ${infoExclusion} ${textCondition}
+      AND COALESCE(s.message_count, 0) > 0`;
+    return { whereClause, params };
+}
+export function listSessionsWithFindings(db, filter) {
+    // For category/severity-aware filtering we need to compute counts
+    // from the findings table directly (denormalised counters can't
+    // express "only api-key findings"). We always recompute here.
+    const { whereClause, params } = buildSessionFindingWhereSql(filter);
+    const sql = `
+    SELECT
+      s.id              AS id,
+      s.session_uuid    AS session_uuid,
+      s.title           AS title,
+      s.started_at      AS started_at,
+      s.scan_completed_at AS scan_completed_at,
+      s.scan_purged_count AS purged_count,
+      s.message_count   AS message_count,
+      s.model           AS model,
+      s.cwd             AS cwd,
+      src.name          AS source,
+      p.display_name    AS project_display_name,
+      SUM(1) AS finding_count,
+      SUM(CASE WHEN f.kind IN (${highKindsPlaceholders()}) THEN 1 ELSE 0 END) AS high_count
+    FROM sessions s
+    JOIN findings f ON f.session_id = s.id
+    JOIN sources src ON src.id = s.source_id
+    JOIN projects p ON p.id = s.project_id
+    WHERE ${whereClause}
+    GROUP BY s.id
+    ORDER BY high_count DESC, finding_count DESC, s.started_at DESC, s.id DESC
+    ${filter.limit !== undefined ? 'LIMIT ? OFFSET ?' : ''}
+  `;
+    // Placeholder order matches SQL: SELECT's CASE WHEN IN (?) binds first,
+    // then the WHERE clause's params.
+    const allParams = [...HIGH_SEVERITY_KINDS_ARRAY, ...params];
+    if (filter.limit !== undefined) {
+        allParams.push(filter.limit, filter.offset ?? 0);
+    }
+    const rows = db.prepare(sql).all(...allParams);
+    return rows.map(r => ({
+        id: r.id,
+        sessionUuid: r.session_uuid,
+        title: r.title,
+        startedAt: r.started_at,
+        scanCompletedAt: r.scan_completed_at,
+        findingCount: r.finding_count,
+        highCount: r.high_count ?? 0,
+        purgedCount: r.purged_count ?? 0,
+        source: r.source,
+        messageCount: r.message_count ?? 0,
+        model: r.model,
+        cwd: r.cwd,
+        projectDisplayName: r.project_display_name,
+    }));
+}
+export function listSessionsWithFindingsPage(db, filter) {
+    return paginate(filter, f => listSessionsWithFindings(db, f));
+}
+/** Total distinct sessions matching the same filter as
+ *  `listSessionsWithFindings` — used by the renderer to show
+ *  "涉及 N 个会话" without loading every page. Cheaper than the list
+ *  query: no SELECT projection, no GROUP BY, no ORDER BY. */
+export function countSessionsWithFindings(db, filter) {
+    const { whereClause, params } = buildSessionFindingWhereSql(filter);
+    const sql = `
+    SELECT COUNT(DISTINCT s.id) AS total
+    FROM sessions s
+    JOIN findings f ON f.session_id = s.id
+    JOIN sources src ON src.id = s.source_id
+    JOIN projects p ON p.id = s.project_id
+    WHERE ${whereClause}
+  `;
+    const row = db.prepare(sql).get(...params);
+    return row.total;
+}
+/** Risk by category — one row per kind that has ≥ 1 active finding.
+ *  Drives the Watchtower-style panel on the Security page. */
+export function riskByCategory(db) {
+    const rows = db.prepare(`SELECT kind,
+            COUNT(*) AS count,
+            COUNT(DISTINCT session_id) AS sessions
+       FROM findings
+      WHERE state = 'active'
+      GROUP BY kind
+      ORDER BY count DESC`).all();
+    return rows.map(r => ({
+        kind: r.kind,
+        severity: severityOf(r.kind),
+        count: r.count,
+        sessions: r.sessions,
+    }));
+}
+/** Read the live raw value for one finding. Used by the UI's review
+ *  panel and the Purge confirm dialog. Returns null when the finding
+ *  no longer points at a valid message (race against session
+ *  deletion) or has been purged (offsets now point at the mask). */
+export function getFindingValue(db, findingId) {
+    const row = db.prepare(`SELECT f.start_offset, f.end_offset, f.state, m.content_text
+       FROM findings f
+       LEFT JOIN messages m ON m.id = f.message_id
+      WHERE f.id = ?`).get(findingId);
+    if (!row || row.content_text === null)
+        return null;
+    if (row.state === 'purged')
+        return null;
+    return row.content_text.slice(row.start_offset, row.end_offset);
+}
+/** Bulk version of `getFindingValue` — one SQL query for N finding
+ *  ids instead of N round-trips. Caller fans the result map back out
+ *  by id; missing keys are treated as `null` (purged / vanished). */
+export function getFindingValues(db, findingIds) {
+    const out = {};
+    if (findingIds.length === 0)
+        return out;
+    const placeholders = findingIds.map(() => '?').join(',');
+    const rows = db.prepare(`SELECT f.id, f.start_offset, f.end_offset, f.state, m.content_text
+       FROM findings f
+       LEFT JOIN messages m ON m.id = f.message_id
+      WHERE f.id IN (${placeholders})`).all(...findingIds);
+    for (const r of rows) {
+        if (r.content_text === null || r.state === 'purged') {
+            out[r.id] = null;
+        }
+        else {
+            out[r.id] = r.content_text.slice(r.start_offset, r.end_offset);
+        }
+    }
+    // Fill in nulls for ids that didn't come back (deleted / cascade).
+    for (const id of findingIds) {
+        if (!(id in out))
+            out[id] = null;
+    }
+    return out;
+}
+const allowKey = (kind, hash) => `${kind}|${hash}`;
+export function getAllowlists(db, sessionId) {
+    const sessionRows = db.prepare('SELECT kind, value_hash FROM allowlist_session WHERE session_id = ?').all(sessionId);
+    const globalRows = db.prepare('SELECT kind, value_hash FROM allowlist_global').all();
+    return {
+        session: new Set(sessionRows.map(r => allowKey(r.kind, r.value_hash))),
+        global: new Set(globalRows.map(r => allowKey(r.kind, r.value_hash))),
+    };
+}
+export function isAllowlisted(allow, kind, valueHash) {
+    const key = allowKey(kind, valueHash);
+    return allow.session.has(key) || allow.global.has(key);
+}
+export function addAllowlistSession(db, sessionId, kind, valueHash) {
+    db.prepare(`INSERT OR IGNORE INTO allowlist_session (session_id, kind, value_hash)
+     VALUES (?, ?, ?)`).run(sessionId, kind, valueHash);
+}
+export function addAllowlistGlobal(db, kind, valueHash) {
+    db.prepare(`INSERT OR IGNORE INTO allowlist_global (kind, value_hash) VALUES (?, ?)`).run(kind, valueHash);
+}
+export function removeAllowlistSession(db, sessionId, kind, valueHash) {
+    db.prepare(`DELETE FROM allowlist_session
+      WHERE session_id = ? AND kind = ? AND value_hash = ?`).run(sessionId, kind, valueHash);
+}
+export function removeAllowlistGlobal(db, kind, valueHash) {
+    db.prepare(`DELETE FROM allowlist_global WHERE kind = ? AND value_hash = ?`).run(kind, valueHash);
+}
+/** All allowlist rows from both tables, joined with the originating
+ *  session metadata. Drives the Settings → Security pane's "Manage…"
+ *  modal so the user can review and revoke past decisions. */
+export function listAllowlistEntries(db) {
+    const sessionRows = db.prepare(`SELECT a.kind          AS kind,
+            a.value_hash    AS value_hash,
+            a.created_at    AS created_at,
+            s.session_uuid  AS session_uuid,
+            s.title         AS session_title
+       FROM allowlist_session a
+       JOIN sessions s ON s.id = a.session_id
+      ORDER BY a.created_at DESC`).all();
+    const globalRows = db.prepare(`SELECT kind, value_hash, created_at
+       FROM allowlist_global
+      ORDER BY created_at DESC`).all();
+    return [
+        ...globalRows.map((r) => ({
+            scope: 'global',
+            kind: r.kind,
+            valueHash: r.value_hash,
+            createdAt: r.created_at,
+            sessionUuid: null,
+            sessionTitle: null,
+        })),
+        ...sessionRows.map((r) => ({
+            scope: 'session',
+            kind: r.kind,
+            valueHash: r.value_hash,
+            createdAt: r.created_at,
+            sessionUuid: r.session_uuid,
+            sessionTitle: r.session_title,
+        })),
+    ];
+}
+// ─── Mutations called from IPC dismiss handlers ───────────────────
+/** Flip a finding to 'dismissed' and, depending on scope, write the
+ *  allowlist entry so future rescans honor the decision. Caller
+ *  wraps in a transaction. */
+export function dismissFinding(db, findingId, scope) {
+    const f = db.prepare('SELECT session_id, kind, value_hash FROM findings WHERE id = ?').get(findingId);
+    if (!f)
+        return;
+    db.prepare(`UPDATE findings
+        SET state = 'dismissed',
+            state_changed_at = datetime('now')
+      WHERE id = ?`).run(findingId);
+    if (scope === 'session') {
+        addAllowlistSession(db, f.session_id, f.kind, f.value_hash);
+    }
+    else {
+        addAllowlistGlobal(db, f.kind, f.value_hash);
+    }
+    updateSessionCounts(db, f.session_id);
+}
+/** Re-activate a dismissed finding and remove the allowlist entry
+ *  that pinned it (both scopes, since UI doesn't always know which). */
+export function undismissFinding(db, findingId) {
+    const f = db.prepare('SELECT session_id, kind, value_hash FROM findings WHERE id = ?').get(findingId);
+    if (!f)
+        return;
+    db.prepare(`UPDATE findings
+        SET state = 'active',
+            state_changed_at = datetime('now')
+      WHERE id = ?`).run(findingId);
+    removeAllowlistSession(db, f.session_id, f.kind, f.value_hash);
+    removeAllowlistGlobal(db, f.kind, f.value_hash);
+    updateSessionCounts(db, f.session_id);
+}
+//# sourceMappingURL=repo.js.map

package/dist/security/repo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo.js","sourceRoot":"","sources":["../../src/security/repo.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,EAAE;AACF,kEAAkE;AAClE,qEAAqE;AACrE,iEAAiE;AACjE,kEAAkE;AAClE,wDAAwD;AACxD,EAAE;AACF,+DAA+D;AAC/D,oEAAoE;AACpE,sEAAsE;AAItE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAyBxF,SAAS,YAAY,CAAC,CAAe;IACnC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,IAAI,EAAE,CAAC,CAAC,IAAqB;QAC7B,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,cAAc,EAAE,CAAC,CAAC,gBAAgB;KACnC,CAAA;AACH,CAAC;AAgDD,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAAC,EAAqB,EAAE,IAA6B;IACjF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAC7B,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB;;;2CAGuC,CACxC,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,CACN,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,UAAU,EACZ,CAAC,CAAC,QAAQ,EACV,CAAC,CAAC,WAAW,EACb,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,KAAK,EACP,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CACvD,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;6CAkB6C;AAC7C,MAAM,UAAU,yBAAyB,CACvC,EAAqB,EACrB,SAAiB,EACjB,SAA4B;IAE5B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAClC,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACvD,EAAE,CAAC,OAAO,CACR;;;0BAGsB,YAAY,GAAG,CACtC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,SAAS,CAAC,CAAA;AAChC,CAAC;AAED;;;8CAG8C;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAA;AAE7D,qEAAqE;AAErE;;;;;;;6CAO6C;AAC7C,MAAM,UAAU,mBAAmB,CAAC,EAAqB,EAAE,SAAiB;IAC1E,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB;qCACiC,qBAAqB,EAAE;iCAC3B,qBAAqB,EAAE;;+CAET,CAC5C,CAAC,GAAG,CACH,GAAG,yBAAyB,EAC5B,GAAG,yBAAyB,EAC5B,SAAS,CACuC,CAAA;IAClD,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB;;gDAE4C,CAC7C,CAAC,GAAG,CAAC,SAAS,CAAkB,CAAA;IACjC,EAAE,CAAC,OAAO,CACR;;;;mBAIe,CAChB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;AACjE,CAAC;AAED,MAAM,yBAAyB,GAAG,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;AACjE,MAAM,yBAAyB,GAAG,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;AACjE,SAAS,qBAAqB;IAC5B,OAAO,yBAAyB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC3D,CAAC;AACD,SAAS,qBAAqB;IAC5B,OAAO,yBAAyB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC3D,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,EAAqB,EACrB,SAAiB,EACjB,OAAe,EACf,WAAmB;IAEnB,EAAE,CAAC,OAAO,CACR;;mBAEe,CAChB,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;AACxC,CAAC;AAED;iCACiC;AACjC,MAAM,UAAU,yBAAyB,CAAC,EAAqB;IAC7D,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,EAAE,CAAA;IACrE,OAAO,CAAC,CAAC,OAAO,CAAA;AAClB,CAAC;AAED;yDACyD;AACzD,MAAM,UAAU,4BAA4B,CAAC,EAAqB,EAAE,SAAiB;IACnF,EAAE,CAAC,OAAO,CACR;;;mBAGe,CAChB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AAClB,CAAC;AAED;2DAC2D;AAC3D,MAAM,UAAU,uBAAuB,CACrC,EAAqB,EACrB,cAAsB;IAEtB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB;;+BAE2B,CAC5B,CAAC,GAAG,EAAwD,CAAA;IAC7D,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAChB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,qEAAqE;AAErE,MAAM,UAAU,YAAY,CAAC,EAAqB,EAAE,MAAqB;IACvE,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,MAAM,MAAM,GAAc,EAAE,CAAA;IAC5B,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1D,KAAK,CAAC,IAAI,CAAC,YAAY,YAAY,GAAG,CAAC,CAAA;QACvC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACtB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACvB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3B,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACzB,wBAAwB;QACxB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,YAAY,qBAAqB,EAAE,GAAG,CAAC,CAAA;QAClD,MAAM,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,CAAA;IAC3C,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,gBAAgB,qBAAqB,EAAE,GAAG,CAAC,CAAA;QACtD,MAAM,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,CAAA;IAC3C,CAAC;IACD,IAAI,UAAU,GAAG,EAAE,CAAA;IACnB,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,UAAU,GAAG,mBAAmB,CAAA;QAChC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,GAAG,GAAG;iBACG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;mDAChB,UAAU,EAAE,CAAA;IAC7D,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAmB,CAAA;IAC7D,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;AAC/B,CAAC;AAED,uEAAuE;AACvE,SAAS,QAAQ,CACf,MAAS,EACT,KAAoB;IAEpB,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC9E,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAA;IAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAA;AAC5E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,EAAqB,EACrB,MAAqB;IAErB,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;AACnD,CAAC;AAED;;sEAEsE;AACtE,SAAS,2BAA2B,CAAC,MAA4B;IAI/D,MAAM,MAAM,GAAc,EAAE,CAAA;IAC5B,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAC3D,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,oBAAoB,CAAA;IACxB,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAErE,IAAI,aAAa,GAAG,EAAE,CAAA;IACtB,MAAM,aAAa,GACjB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACrC,CAAC,CAAC,MAAM,CAAC,KAAK;QACd,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC3D,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC3D,aAAa,GAAG,kBAAkB,YAAY,GAAG,CAAA;QACjD,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAA;IAC/B,CAAC;IACD,IAAI,iBAAiB,GAAG,EAAE,CAAA;IAC1B,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC/B,iBAAiB,GAAG,kBAAkB,qBAAqB,EAAE,GAAG,CAAA;QAChE,MAAM,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,CAAA;IAC3C,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QACrC,gEAAgE;QAChE,8DAA8D;QAC9D,6BAA6B;QAC7B,iBAAiB,GAAG,sBAAsB,qBAAqB,EAAE,wBAAwB,qBAAqB,EAAE,GAAG,CAAA;QACnH,MAAM,CAAC,IAAI,CAAC,GAAG,yBAAyB,EAAE,GAAG,yBAAyB,CAAC,CAAA;IACzE,CAAC;IAED,mEAAmE;IACnE,oEAAoE;IACpE,oEAAoE;IACpE,oEAAoE;IACpE,IAAI,aAAa,GAAG,EAAE,CAAA;IACtB,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC9E,aAAa,GAAG,sBAAsB,qBAAqB,EAAE,GAAG,CAAA;QAChE,MAAM,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,CAAA;IAC3C,CAAC;IAED,IAAI,aAAa,GAAG,EAAE,CAAA;IACtB,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,aAAa,GAAG,oBAAoB,CAAA;QACpC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,cAAc,IAAI,aAAa,IAAI,iBAAiB,IAAI,aAAa,IAAI,aAAa;2CACpE,CAAA;IACzC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;AAChC,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,EAAqB,EACrB,MAA4B;IAE5B,kEAAkE;IAClE,gEAAgE;IAChE,8DAA8D;IAC9D,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAA;IAEnE,MAAM,GAAG,GAAG;;;;;;;;;;;;;;iCAcmB,qBAAqB,EAAE;;;;;YAK5C,WAAW;;;MAGjB,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE;GACvD,CAAA;IACD,wEAAwE;IACxE,kCAAkC;IAClC,MAAM,SAAS,GAAG,CAAC,GAAG,yBAAyB,EAAE,GAAG,MAAM,CAAC,CAAA;IAC3D,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAA;IAClD,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,SAAS,CAc3C,CAAA;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,eAAe,EAAE,CAAC,CAAC,iBAAiB;QACpC,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC;QAC5B,WAAW,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC;QAChC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,aAAa,IAAI,CAAC;QAClC,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,kBAAkB,EAAE,CAAC,CAAC,oBAAoB;KAC3C,CAAC,CAAC,CAAA;AACL,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,EAAqB,EACrB,MAA4B;IAE5B,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/D,CAAC;AAED;;;6DAG6D;AAC7D,MAAM,UAAU,yBAAyB,CACvC,EAAqB,EACrB,MAA4B;IAE5B,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAA;IACnE,MAAM,GAAG,GAAG;;;;;;YAMF,WAAW;GACpB,CAAA;IACD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAsB,CAAA;IAC/D,OAAO,GAAG,CAAC,KAAK,CAAA;AAClB,CAAC;AAED;8DAC8D;AAC9D,MAAM,UAAU,cAAc,CAAC,EAAqB;IAClD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB;;;;;;0BAMsB,CACvB,CAAC,GAAG,EAA8D,CAAA;IACnE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpB,IAAI,EAAE,CAAC,CAAC,IAAqB;QAC7B,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,IAAqB,CAAC;QAC7C,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;KACrB,CAAC,CAAC,CAAA;AACL,CAAC;AAED;;;oEAGoE;AACpE,MAAM,UAAU,eAAe,CAAC,EAAqB,EAAE,SAAiB;IACtE,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACpB;;;qBAGiB,CAClB,CAAC,GAAG,CAAC,SAAS,CAEF,CAAA;IACb,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAClD,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACvC,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;AACjE,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,gBAAgB,CAC9B,EAAqB,EACrB,UAA6B;IAE7B,MAAM,GAAG,GAAkC,EAAE,CAAA;IAC7C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAA;IACvC,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB;;;uBAGmB,YAAY,GAAG,CACnC,CAAC,GAAG,CAAC,GAAG,UAAU,CAMjB,CAAA;IACF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpD,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAA;QAClB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;IACD,mEAAmE;IACnE,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAA;IAClC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAWD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAA;AAElE,MAAM,UAAU,aAAa,CAAC,EAAqB,EAAE,SAAiB;IACpE,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAC5B,qEAAqE,CACtE,CAAC,GAAG,CAAC,SAAS,CAAgD,CAAA;IAC/D,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC3B,+CAA+C,CAChD,CAAC,GAAG,EAAiD,CAAA;IACtD,OAAO;QACL,OAAO,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACtE,MAAM,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;KACrE,CAAA;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAwB,EACxB,IAAmB,EACnB,SAAiB;IAEjB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,EAAqB,EACrB,SAAiB,EACjB,IAAmB,EACnB,SAAiB;IAEjB,EAAE,CAAC,OAAO,CACR;sBACkB,CACnB,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,EAAqB,EACrB,IAAmB,EACnB,SAAiB;IAEjB,EAAE,CAAC,OAAO,CACR,yEAAyE,CAC1E,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;AACxB,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,EAAqB,EACrB,SAAiB,EACjB,IAAmB,EACnB,SAAiB;IAEjB,EAAE,CAAC,OAAO,CACR;2DACuD,CACxD,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,EAAqB,EACrB,IAAmB,EACnB,SAAiB;IAEjB,EAAE,CAAC,OAAO,CACR,gEAAgE,CACjE,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;AACxB,CAAC;AAYD;;8DAE8D;AAC9D,MAAM,UAAU,oBAAoB,CAAC,EAAqB;IACxD,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAC5B;;;;;;;iCAO6B,CAC9B,CAAC,GAAG,EAMH,CAAA;IACF,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC3B;;+BAE2B,CAC5B,CAAC,GAAG,EAIH,CAAA;IACF,OAAO;QACL,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC;YAC3C,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,CAAC,CAAC,IAAqB;YAC7B,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC;YAC5C,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC,CAAC,IAAqB;YAC7B,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,WAAW,EAAE,CAAC,CAAC,YAAY;YAC3B,YAAY,EAAE,CAAC,CAAC,aAAa;SAC9B,CAAC,CAAC;KACJ,CAAA;AACH,CAAC;AAED,qEAAqE;AAErE;;8BAE8B;AAC9B,MAAM,UAAU,cAAc,CAC5B,EAAqB,EACrB,SAAiB,EACjB,KAA2B;IAE3B,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAClB,gEAAgE,CACjE,CAAC,GAAG,CAAC,SAAS,CAAyE,CAAA;IACxF,IAAI,CAAC,CAAC;QAAE,OAAM;IACd,EAAE,CAAC,OAAO,CACR;;;mBAGe,CAChB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAChB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,IAAqB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;IAC9E,CAAC;SAAM,CAAC;QACN,kBAAkB,CAAC,EAAE,EAAE,CAAC,CAAC,IAAqB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;IAC/D,CAAC;IACD,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;AACvC,CAAC;AAED;wEACwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,EAAqB,EAAE,SAAiB;IACvE,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAClB,gEAAgE,CACjE,CAAC,GAAG,CAAC,SAAS,CAAyE,CAAA;IACxF,IAAI,CAAC,CAAC;QAAE,OAAM;IACd,EAAE,CAAC,OAAO,CACR;;;mBAGe,CAChB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAChB,sBAAsB,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,IAAqB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;IAC/E,qBAAqB,CAAC,EAAE,EAAE,CAAC,CAAC,IAAqB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;IAChE,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;AACvC,CAAC"}

package/dist/security/scan.d.ts

@@ -0,0 +1,50 @@
+import { Effect } from 'effect';
+import type Database from 'better-sqlite3';
+import type { RedactProvider } from '@spool-lab/redact';
+import type { FindingsChange } from './types.js';
+declare const ScanError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ScanError";
+} & Readonly<A>;
+export declare class ScanError extends ScanError_base<{
+    readonly sessionId: number;
+    readonly cause: unknown;
+    readonly reason: 'session-not-found' | 'provider-failed' | 'db-failed';
+}> {
+}
+/** Result of one session scan — useful for tests and progress UIs. */
+export interface ScanResult {
+    sessionId: number;
+    inserted: number;
+    /** Profile string written to sessions.scan_profile. */
+    profile: string;
+}
+export interface ScanSessionDeps {
+    /** SQLite database handle (same instance the Syncer uses). */
+    db: Database.Database;
+    /** Active providers, evaluated in priority order. First entry wins
+     *  on overlap (regex before pf — pattern matches are authoritative
+     *  for known credential prefixes). */
+    providers: readonly RedactProvider[];
+    /** Profile string for the active provider set; persisted on
+     *  successful scan. */
+    currentProfile: string;
+    /** Names of providers whose prior `active` findings should be
+     *  deleted before re-insert. Almost always equals the names in
+     *  `providers`; passed explicitly so the worker can choose to
+     *  preserve historical pf findings even when pf is disabled. */
+    providerNames: readonly string[];
+    /** Sink for change notifications. The worker layer wraps PubSub
+     *  here; tests pass a simple collector. */
+    publish: (change: FindingsChange) => Effect.Effect<void>;
+    /** Kind-level allowlist. Findings whose kind is in this set get
+     *  inserted with state='dismissed' (instead of 'active') without
+     *  needing a per-value allowlist row. Driven by the Settings →
+     *  Security pane's multi-select. */
+    kindAllowlist?: ReadonlySet<string>;
+}
+/** Scan one session end to end. Idempotent: running twice produces
+ *  the same findings (same value_hash + same offsets → same rows
+ *  after the delete-then-insert reset). */
+export declare function scanSession(sessionId: number, deps: ScanSessionDeps): Effect.Effect<ScanResult, ScanError>;
+export {};
+//# sourceMappingURL=scan.d.ts.map

package/dist/security/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/security/scan.ts"],"names":[],"mappings":"AAaA,OAAO,EAAQ,MAAM,EAAE,MAAM,QAAQ,CAAA;AACrC,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAkB,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAWvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;;;;AAEhD,qBAAa,SAAU,SAAQ,eAA8B;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,iBAAiB,GAAG,WAAW,CAAA;CACvE,CAAC;CAAG;AAOL,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAA;IACrB;;0CAEsC;IACtC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAA;IACpC;2BACuB;IACvB,cAAc,EAAE,MAAM,CAAA;IACtB;;;oEAGgE;IAChE,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC;+CAC2C;IAC3C,OAAO,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACxD;;;wCAGoC;IACpC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACpC;AAED;;2CAE2C;AAC3C,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,eAAe,GACpB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAiFtC"}

package/dist/security/scan.js

@@ -0,0 +1,120 @@
+// Per-session scan pipeline.
+//
+// Effect-shaped so the worker can compose it with Queue / Stream /
+// supervisor primitives. The detection itself runs against
+// `messages.content_text` only — Purge later mutates that field,
+// findings re-detect, and the audit trail stays consistent.
+//
+// Transaction shape: detection runs *outside* the transaction (it
+// can take seconds with ML); only the final apply step is atomic.
+// If the worker dies mid-detection, scan_profile was never updated
+// → restart re-enqueues from scratch. If it dies inside the
+// transaction, SQLite atomicity guarantees no half-applied state.
+import { Data, Effect } from 'effect';
+import { hashValueForRedactExclude } from '@spool-lab/redact';
+import { deleteRefreshableFindings, insertFindings, setSessionScanProfile, updateSessionCounts, getAllowlists, isAllowlisted, } from './repo.js';
+export class ScanError extends Data.TaggedError('ScanError') {
+}
+/** Scan one session end to end. Idempotent: running twice produces
+ *  the same findings (same value_hash + same offsets → same rows
+ *  after the delete-then-insert reset). */
+export function scanSession(sessionId, deps) {
+    return Effect.gen(function* () {
+        // 1. Load messages outside the transaction.
+        const messages = yield* Effect.try({
+            try: () => deps.db.prepare(`SELECT id, content_text
+             FROM messages
+            WHERE session_id = ?
+            ORDER BY seq ASC`).all(sessionId),
+            catch: (cause) => new ScanError({ sessionId, cause, reason: 'db-failed' }),
+        });
+        if (messages.length === 0) {
+            // Session has no messages yet. Still mark it scanned with the
+            // current profile so we don't loop on it; future sync will
+            // invalidate the profile and re-enqueue.
+            yield* applyEmpty(sessionId, deps);
+            yield* deps.publish({ type: 'session-rescanned', sessionId });
+            return { sessionId, inserted: 0, profile: deps.currentProfile };
+        }
+        // 2. Run providers per message. The flat list is enough — we
+        // dedupe later by (kind, value_hash, start_offset) so producers
+        // can be naive about overlap.
+        const allMatches = [];
+        for (const msg of messages) {
+            for (const provider of deps.providers) {
+                if (!provider.available())
+                    continue;
+                const matches = yield* Effect.tryPromise({
+                    try: () => provider.analyze(msg.content_text),
+                    catch: (cause) => new ScanError({ sessionId, cause, reason: 'provider-failed' }),
+                });
+                for (const m of matches) {
+                    allMatches.push({ ...m, messageId: msg.id });
+                }
+            }
+        }
+        // 3. Dedupe across providers — pick the highest-confidence match
+        // for each (kind, value_hash, start_offset).
+        const merged = mergeMatches(allMatches);
+        // 4. Allowlist join → assign initial state.
+        const allow = yield* Effect.try({
+            try: () => getAllowlists(deps.db, sessionId),
+            catch: (cause) => new ScanError({ sessionId, cause, reason: 'db-failed' }),
+        });
+        const inputs = merged.map((m) => ({
+            sessionId,
+            messageId: m.messageId,
+            kind: m.kind,
+            valueHash: m.valueHash,
+            confidence: m.confidence,
+            provider: m.provider,
+            startOffset: m.start,
+            endOffset: m.end,
+            state: (deps.kindAllowlist?.has(m.kind) || isAllowlisted(allow, m.kind, m.valueHash))
+                ? 'dismissed'
+                : 'active',
+        }));
+        // 5. Apply atomically.
+        yield* Effect.try({
+            try: () => {
+                deps.db.transaction(() => {
+                    deleteRefreshableFindings(deps.db, sessionId, deps.providerNames);
+                    insertFindings(deps.db, inputs);
+                    setSessionScanProfile(deps.db, sessionId, deps.currentProfile, new Date().toISOString());
+                    updateSessionCounts(deps.db, sessionId);
+                })();
+            },
+            catch: (cause) => new ScanError({ sessionId, cause, reason: 'db-failed' }),
+        });
+        yield* deps.publish({ type: 'session-rescanned', sessionId });
+        return { sessionId, inserted: inputs.length, profile: deps.currentProfile };
+    });
+}
+function applyEmpty(sessionId, deps) {
+    return Effect.try({
+        try: () => {
+            deps.db.transaction(() => {
+                deleteRefreshableFindings(deps.db, sessionId, deps.providerNames);
+                setSessionScanProfile(deps.db, sessionId, deps.currentProfile, new Date().toISOString());
+                updateSessionCounts(deps.db, sessionId);
+            })();
+        },
+        catch: (cause) => new ScanError({ sessionId, cause, reason: 'db-failed' }),
+    });
+}
+/** Pick the highest-confidence match per (messageId, kind, value_hash,
+ *  start). The same vendor token detected by two providers should
+ *  produce one finding, attributed to whoever was most confident. */
+function mergeMatches(matches) {
+    const byKey = new Map();
+    for (const m of matches) {
+        const hash = hashValueForRedactExclude(m.value);
+        const key = `${m.messageId}|${m.kind}|${hash}|${m.start}`;
+        const existing = byKey.get(key);
+        if (!existing || m.confidence > existing.confidence) {
+            byKey.set(key, { ...m, valueHash: hash });
+        }
+    }
+    return Array.from(byKey.values());
+}
+//# sourceMappingURL=scan.js.map