@spool-lab/core 0.4.12 → 0.5.0

package/dist/security/maintenance.js

@@ -0,0 +1,68 @@
+import { existsSync, readdirSync, rmSync, statSync, } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+// Listed in the UI: any snapshot Spool itself produced under
+// ~/.spool/backups/. The narrower regex below distinguishes automated
+// schema-migration snapshots (kind: 'auto') from human-named rollback
+// points (kind: 'manual') so the UI can surface that difference.
+const SPOOL_BACKUP_RE = /^spool-pre-.+\.db$/;
+const AUTO_BACKUP_RE = /^spool-pre-v\d+-/;
+export function backupDirFor(db) {
+    if (db.memory)
+        return null;
+    const dbPath = db.name;
+    if (!dbPath)
+        return null;
+    return join(dirname(dbPath), 'backups');
+}
+export function listBackups(db) {
+    const backupDir = backupDirFor(db);
+    if (!backupDir || !existsSync(backupDir))
+        return [];
+    return readdirSync(backupDir)
+        .filter((name) => SPOOL_BACKUP_RE.test(name))
+        .map((name) => {
+        try {
+            const st = statSync(join(backupDir, name));
+            return {
+                name,
+                sizeBytes: st.size,
+                mtimeMs: st.mtimeMs,
+                kind: AUTO_BACKUP_RE.test(name) ? 'auto' : 'manual',
+            };
+        }
+        catch {
+            // stat may race with a concurrent delete; skip on error.
+            return null;
+        }
+    })
+        .filter((e) => e !== null)
+        .sort((a, b) => b.mtimeMs - a.mtimeMs);
+}
+export function deleteBackups(db, names) {
+    const backupDir = backupDirFor(db);
+    if (!backupDir || !existsSync(backupDir) || names.length === 0) {
+        return { deleted: 0, bytesFreed: 0 };
+    }
+    let deleted = 0;
+    let bytesFreed = 0;
+    for (const name of names) {
+        // Reject path traversal: a malicious or buggy caller must not be
+        // able to delete files outside the backups dir.
+        if (basename(name) !== name)
+            continue;
+        if (!SPOOL_BACKUP_RE.test(name))
+            continue;
+        const full = join(backupDir, name);
+        try {
+            const st = statSync(full);
+            rmSync(full, { force: true });
+            deleted += 1;
+            bytesFreed += st.size;
+        }
+        catch {
+            // best-effort; missing file = already gone, treat as no-op.
+        }
+    }
+    return { deleted, bytesFreed };
+}
+//# sourceMappingURL=maintenance.js.map

package/dist/security/maintenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintenance.js","sourceRoot":"","sources":["../../src/security/maintenance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,MAAM,EACN,QAAQ,GACT,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAGnD,6DAA6D;AAC7D,sEAAsE;AACtE,sEAAsE;AACtE,iEAAiE;AACjE,MAAM,eAAe,GAAG,oBAAoB,CAAA;AAC5C,MAAM,cAAc,GAAG,kBAAkB,CAAA;AAczC,MAAM,UAAU,YAAY,CAAC,EAAqB;IAChD,IAAI,EAAE,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,CAAA;IACtB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAqB;IAC/C,MAAM,SAAS,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;IAClC,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAA;IAEnD,OAAO,WAAW,CAAC,SAAS,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC5C,GAAG,CAAC,CAAC,IAAI,EAAyB,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;YAC1C,OAAO;gBACL,IAAI;gBACJ,SAAS,EAAE,EAAE,CAAC,IAAI;gBAClB,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;aACpD,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;YACzD,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAuB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,EAAqB,EACrB,KAAwB;IAExB,MAAM,SAAS,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;IAClC,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAA;IACtC,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,iEAAiE;QACjE,gDAAgD;QAChD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,SAAQ;QACrC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAQ;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QAClC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;YACzB,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7B,OAAO,IAAI,CAAC,CAAA;YACZ,UAAU,IAAI,EAAE,CAAC,IAAI,CAAA;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;AAChC,CAAC"}

package/dist/security/profile.d.ts

@@ -0,0 +1,47 @@
+export declare const REDACT_DETECTOR_VERSION = 2;
+export interface ProfileOpts {
+    /** Regex detector revision. Bump in lockstep with rule changes. */
+    regexVersion?: number;
+    /** Whether the Privacy Filter ML provider is enabled. */
+    pfEnabled?: boolean;
+    /** Privacy Filter model + quant level, e.g. '1.5b-q4'. Required
+     *  when `pfEnabled` is true. */
+    pfVersion?: string;
+    /** Per-kind allowlist (Settings → Security → "Don't report"). Hashed
+     *  into the profile string so flipping a kind triggers a real
+     *  re-scan via `listSessionsNeedingScan` — otherwise sessions
+     *  scanned before the toggle would never re-evaluate their findings
+     *  and stale `state='active'` rows would linger for the now-
+     *  allowlisted kind.
+     *
+     *  Order-insensitive: we sort + dedupe before hashing. Empty list
+     *  collapses the segment so the profile stays `regex@4` (not
+     *  `regex@4,allow@0`) — backward-compat with sessions stamped
+     *  before the allowlist feature existed. */
+    kindAllowlist?: readonly string[];
+}
+export interface ParsedProfile {
+    regex: number;
+    pf?: string;
+    /** Short hex digest of the sorted kind allowlist; only present when
+     *  the user has configured a non-empty list. */
+    allow?: string;
+}
+/** Build the canonical profile string for the current detector set.
+ *  Order is fixed (regex → pf → allow) so equality is structural. */
+export declare function currentProfileString(opts?: ProfileOpts): string;
+/** Parse a profile string back into structured fields. Returns null
+ *  for inputs that don't look like a profile (e.g. legacy values,
+ *  manual edits). Strict — unknown tokens cause a null return so the
+ *  worker treats them as "stale, rescan". */
+export declare function parseProfile(s: string | null | undefined): ParsedProfile | null;
+/** Structural equality on profile strings — order-insensitive but
+ *  same-content. */
+export declare function profilesMatch(a: string | null | undefined, b: string | null | undefined): boolean;
+/** Names of the providers active in a profile. Used by
+ *  `deleteActiveFindings(... providers)` so rescanning with a smaller
+ *  provider set doesn't clobber prior findings the user may still
+ *  want (e.g. disabling pf shouldn't delete pf's historical hits;
+ *  they just stop being refreshed). */
+export declare function providersInProfile(s: string): string[];
+//# sourceMappingURL=profile.d.ts.map

package/dist/security/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/security/profile.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,uBAAuB,IAAI,CAAA;AAExC,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,yDAAyD;IACzD,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB;oCACgC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;;;;gDAU4C;IAC5C,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,CAAC,EAAE,MAAM,CAAA;IACX;oDACgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;qEACqE;AACrE,wBAAgB,oBAAoB,CAAC,IAAI,GAAE,WAAgB,GAAG,MAAM,CAYnE;AAqBD;;;6CAG6C;AAC7C,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,aAAa,GAAG,IAAI,CA6B/E;AAED;oBACoB;AACpB,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAKjG;AAED;;;;uCAIuC;AACvC,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAMtD"}

package/dist/security/profile.js

@@ -0,0 +1,131 @@
+// Scan profile — a composite identifier for the set of providers
+// that produced the findings in a session.
+//
+// Persisted on `sessions.scan_profile`. Compare to the worker's
+// current profile string at startup to detect rescan candidates:
+//
+//   stored = NULL                     → never scanned, enqueue
+//   stored = 'regex@1'                → matches current 'regex@1', skip
+//   stored = 'regex@1,pf@1.5b-q4.r2'  → user disabled pf, enqueue rescan
+//
+// Provider versions are bumped manually when detection logic changes.
+// REDACT_DETECTOR_VERSION lives next to the regex detector in
+// `@spool-lab/redact` (added in PR 1a); we re-export it here for
+// callers that only depend on @spool-lab/core.
+// Cache-nonce for the regex detector rule set. Bumping it makes
+// `currentProfileString()` differ from what's stored on
+// `sessions.scan_profile`, which the backfill loop reads as "this
+// session needs a rescan". No semantic meaning outside that diff —
+// it's NOT a user-visible "version of the security feature".
+//
+// Scope: consumed only by code gated behind VITE_FEATURE_SECURITY.
+// Bump on every rule change once the feature ships so users with old
+// stamps automatically pick up the new rules.
+//   1 — initial release
+//   2 — 2026-05-28: env-var detector now rejects values containing
+//       non-ASCII letters (CJK / Cyrillic / Hangul / Arabic / emoji
+//       are placeholder description text, never real env-var secrets).
+export const REDACT_DETECTOR_VERSION = 2;
+/** Build the canonical profile string for the current detector set.
+ *  Order is fixed (regex → pf → allow) so equality is structural. */
+export function currentProfileString(opts = {}) {
+    const regexVersion = opts.regexVersion ?? REDACT_DETECTOR_VERSION;
+    const parts = [`regex@${regexVersion}`];
+    if (opts.pfEnabled) {
+        if (!opts.pfVersion) {
+            throw new Error('currentProfileString: pfVersion is required when pfEnabled is true');
+        }
+        parts.push(`pf@${opts.pfVersion}`);
+    }
+    const allowHash = hashKindAllowlist(opts.kindAllowlist);
+    if (allowHash)
+        parts.push(`allow@${allowHash}`);
+    return parts.join(',');
+}
+/** FNV-1a 32-bit over the sorted+deduped kind list. Returns null for
+ *  empty / undefined so the profile string stays minimal when no kinds
+ *  are allowlisted (the common case). 8-char hex; collision risk is
+ *  irrelevant — drift, not authenticity, is what we're detecting. */
+function hashKindAllowlist(kinds) {
+    if (!kinds || kinds.length === 0)
+        return null;
+    const sorted = [...new Set(kinds)].sort();
+    let h = 0x811c9dc5;
+    for (const k of sorted) {
+        for (let i = 0; i < k.length; i++) {
+            h ^= k.charCodeAt(i);
+            h = Math.imul(h, 0x01000193);
+        }
+        h ^= 0x2c; // ',' delimiter so ['a','bc'] !== ['ab','c']
+        h = Math.imul(h, 0x01000193);
+    }
+    return (h >>> 0).toString(16).padStart(8, '0');
+}
+/** Parse a profile string back into structured fields. Returns null
+ *  for inputs that don't look like a profile (e.g. legacy values,
+ *  manual edits). Strict — unknown tokens cause a null return so the
+ *  worker treats them as "stale, rescan". */
+export function parseProfile(s) {
+    if (!s)
+        return null;
+    const parts = s.split(',').map(p => p.trim()).filter(Boolean);
+    let regex;
+    let pf;
+    let allow;
+    for (const part of parts) {
+        const at = part.indexOf('@');
+        if (at <= 0)
+            return null;
+        const name = part.slice(0, at);
+        const ver = part.slice(at + 1);
+        if (!ver)
+            return null;
+        if (name === 'regex') {
+            const n = Number(ver);
+            if (!Number.isInteger(n) || n < 1)
+                return null;
+            regex = n;
+        }
+        else if (name === 'pf') {
+            pf = ver;
+        }
+        else if (name === 'allow') {
+            allow = ver;
+        }
+        else {
+            return null;
+        }
+    }
+    if (regex === undefined)
+        return null;
+    const result = { regex };
+    if (pf !== undefined)
+        result.pf = pf;
+    if (allow !== undefined)
+        result.allow = allow;
+    return result;
+}
+/** Structural equality on profile strings — order-insensitive but
+ *  same-content. */
+export function profilesMatch(a, b) {
+    const pa = parseProfile(a);
+    const pb = parseProfile(b);
+    if (!pa || !pb)
+        return false;
+    return pa.regex === pb.regex && pa.pf === pb.pf && pa.allow === pb.allow;
+}
+/** Names of the providers active in a profile. Used by
+ *  `deleteActiveFindings(... providers)` so rescanning with a smaller
+ *  provider set doesn't clobber prior findings the user may still
+ *  want (e.g. disabling pf shouldn't delete pf's historical hits;
+ *  they just stop being refreshed). */
+export function providersInProfile(s) {
+    const parsed = parseProfile(s);
+    if (!parsed)
+        return [];
+    const out = ['regex'];
+    if (parsed.pf)
+        out.push('pf');
+    return out;
+}
+//# sourceMappingURL=profile.js.map

package/dist/security/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/security/profile.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,2CAA2C;AAC3C,EAAE;AACF,gEAAgE;AAChE,iEAAiE;AACjE,EAAE;AACF,+DAA+D;AAC/D,wEAAwE;AACxE,yEAAyE;AACzE,EAAE;AACF,sEAAsE;AACtE,8DAA8D;AAC9D,iEAAiE;AACjE,+CAA+C;AAE/C,gEAAgE;AAChE,wDAAwD;AACxD,kEAAkE;AAClE,mEAAmE;AACnE,6DAA6D;AAC7D,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,8CAA8C;AAC9C,wBAAwB;AACxB,mEAAmE;AACnE,oEAAoE;AACpE,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAA;AAgCxC;qEACqE;AACrE,MAAM,UAAU,oBAAoB,CAAC,OAAoB,EAAE;IACzD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,uBAAuB,CAAA;IACjE,MAAM,KAAK,GAAG,CAAC,SAAS,YAAY,EAAE,CAAC,CAAA;IACvC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;QACvF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACpC,CAAC;IACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACvD,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,SAAS,EAAE,CAAC,CAAA;IAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACxB,CAAC;AAED;;;qEAGqE;AACrE,SAAS,iBAAiB,CAAC,KAAoC;IAC7D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACzC,IAAI,CAAC,GAAG,UAAU,CAAA;IAClB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;YACpB,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QAC9B,CAAC;QACD,CAAC,IAAI,IAAI,CAAA,CAAC,6CAA6C;QACvD,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IAC9B,CAAC;IACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AAChD,CAAC;AAED;;;6CAG6C;AAC7C,MAAM,UAAU,YAAY,CAAC,CAA4B;IACvD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC7D,IAAI,KAAyB,CAAA;IAC7B,IAAI,EAAsB,CAAA;IAC1B,IAAI,KAAyB,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;QAC9B,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;YACrB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC9C,KAAK,GAAG,CAAC,CAAA;QACX,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,EAAE,GAAG,GAAG,CAAA;QACV,CAAC;aAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,KAAK,GAAG,GAAG,CAAA;QACb,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACpC,MAAM,MAAM,GAAkB,EAAE,KAAK,EAAE,CAAA;IACvC,IAAI,EAAE,KAAK,SAAS;QAAE,MAAM,CAAC,EAAE,GAAG,EAAE,CAAA;IACpC,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAA;IAC7C,OAAO,MAAM,CAAA;AACf,CAAC;AAED;oBACoB;AACpB,MAAM,UAAU,aAAa,CAAC,CAA4B,EAAE,CAA4B;IACtF,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;IAC1B,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;IAC1B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAA;IAC5B,OAAO,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK,CAAA;AAC1E,CAAC;AAED;;;;uCAIuC;AACvC,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IACtB,MAAM,GAAG,GAAa,CAAC,OAAO,CAAC,CAAA;IAC/B,IAAI,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7B,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/security/purge.d.ts

@@ -0,0 +1,68 @@
+import { Effect } from 'effect';
+import type Database from 'better-sqlite3';
+import type { SensitiveKind } from '@spool-lab/redact';
+import type { FindingsChange } from './types.js';
+declare const PurgeError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PurgeError";
+} & Readonly<A>;
+export declare class PurgeError extends PurgeError_base<{
+    readonly findingId: number;
+    readonly reason: 'not-found' | 'already-purged' | 'message-missing' | 'db-failed';
+    readonly cause?: unknown;
+}> {
+}
+export interface PurgeResult {
+    findingId: number;
+    sessionId: number;
+    /** The mask string that replaced the raw value. */
+    maskUsed: string;
+    purgedAt: string;
+}
+export interface PurgeDeps {
+    db: Database.Database;
+    publish: (change: FindingsChange) => Effect.Effect<void>;
+}
+/** Purge one finding. Idempotent on "already purged" → returns a
+ *  PurgeError so the UI can surface a no-op. */
+export declare function purgeFinding(findingId: number, deps: PurgeDeps): Effect.Effect<PurgeResult, PurgeError>;
+/** Bulk purge across many findings. Caller passes an arbitrary
+ *  ordering; we re-sort to the only correct order:
+ *
+ *    1. Group by `message_id`
+ *    2. Within each group, apply in **descending** `start_offset` so
+ *       earlier offsets stay valid as the string shifts.
+ *
+ *  Without this re-sort, two findings inside the same message at
+ *  offsets [10..20] and [40..60] would corrupt: purging [10..20]
+ *  first shifts everything after offset 20 by `mask.length - 10`,
+ *  and the second slice [40..60] now points at the wrong bytes
+ *  (often leaking part of the second secret into the mask, or
+ *  losing it entirely). */
+export declare function purgeFindings(findingIds: readonly number[], deps: PurgeDeps): Effect.Effect<PurgeResult[], PurgeError>;
+/** Purge EVERY active occurrence of one leaked value — the
+ *  `(kind, value_hash)` pair — across all sessions in the archive, in a
+ *  single logical operation. The natural follow-through to "I've rotated
+ *  this key at the source → now scrub every copy from Spool's surfaces".
+ *
+ *  Delegates to {@link purgeFindings}, which re-orders the collected ids
+ *  via {@link orderForBulkPurge} so per-message offsets stay valid. The
+ *  original `~/.claude` session files are NOT touched — this masks only
+ *  Spool's stored copies (DB + FTS), closing the search / AI / browse
+ *  exposure.
+ *
+ *  Returns the purge results plus the distinct session ids touched, in
+ *  first-seen order, so the IPC layer can emit one change event per
+ *  session. */
+export declare function purgeEverywhere(kind: SensitiveKind, valueHash: string, deps: PurgeDeps): Effect.Effect<{
+    results: PurgeResult[];
+    sessionIds: number[];
+}, PurgeError>;
+/** Produce a purge order that's safe against offset drift. Findings
+ *  with `message_id IS NULL` (orphan rows that the schema permits but
+ *  should never happen in practice) fall to the end so they don't
+ *  interfere with message-grouped batches.
+ *
+ *  Exported only for tests. */
+export declare function orderForBulkPurge(db: Database.Database, findingIds: readonly number[]): number[];
+export {};
+//# sourceMappingURL=purge.d.ts.map

package/dist/security/purge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge.d.ts","sourceRoot":"","sources":["../../src/security/purge.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAQ,MAAM,EAAE,MAAM,QAAQ,CAAA;AACrC,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGtD,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,YAAY,CAAA;;;;AAE9D,qBAAa,UAAW,SAAQ,gBAA+B;IAC7D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,WAAW,CAAA;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;AAEL,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAYD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAA;IACrB,OAAO,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;CACzD;AAED;gDACgD;AAChD,wBAAgB,YAAY,CAC1B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,SAAS,GACd,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,CAsCxC;AAED;;;;;;;;;;;;2BAY2B;AAC3B,wBAAgB,aAAa,CAC3B,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,IAAI,EAAE,SAAS,GACd,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,UAAU,CAAC,CAyB1C;AAED;;;;;;;;;;;;;eAae;AACf,wBAAgB,eAAe,CAC7B,IAAI,EAAE,aAAa,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,SAAS,GACd,MAAM,CAAC,MAAM,CAAC;IAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,UAAU,CAAC,CAoB7E;AAED;;;;;+BAK+B;AAC/B,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,MAAM,EAAE,CAkCV"}

package/dist/security/purge.js

@@ -0,0 +1,193 @@
+// Purge mechanism — the only destructive action in the Security
+// Scan feature.
+//
+// What it does: rewrites the raw secret in `messages.content_text`
+// with the per-kind mask from @spool-lab/redact (e.g. `[redacted:
+// AWS key]`), flips the finding to `state='purged'`, recomputes the
+// session's denormalised counts, and lets the existing FTS triggers
+// sync messages_fts automatically.
+//
+// What it does NOT do: touch the source transcript file in
+// `~/.claude/sessions/`, the `.spool` exports the user may already
+// have published, or OS backups of `spool.db`. Those are Phase 2/3
+// vault concerns documented in the spec.
+//
+// Bulk-by-message ordering: when several findings sit in the same
+// message, apply them in DESCENDING start_offset order so earlier
+// offsets stay valid as the string shifts.
+import { Data, Effect } from 'effect';
+import { maskValueByKind } from '@spool-lab/redact';
+import { updateSessionCounts } from './repo.js';
+export class PurgeError extends Data.TaggedError('PurgeError') {
+}
+/** Purge one finding. Idempotent on "already purged" → returns a
+ *  PurgeError so the UI can surface a no-op. */
+export function purgeFinding(findingId, deps) {
+    return Effect.gen(function* () {
+        const row = yield* Effect.try({
+            try: () => deps.db.prepare(`SELECT id, session_id, message_id, kind, start_offset, end_offset, state
+             FROM findings WHERE id = ?`).get(findingId),
+            catch: (cause) => new PurgeError({ findingId, reason: 'db-failed', cause }),
+        });
+        if (!row) {
+            return yield* Effect.fail(new PurgeError({ findingId, reason: 'not-found' }));
+        }
+        if (row.state === 'purged') {
+            return yield* Effect.fail(new PurgeError({ findingId, reason: 'already-purged' }));
+        }
+        if (row.message_id === null) {
+            return yield* Effect.fail(new PurgeError({ findingId, reason: 'message-missing' }));
+        }
+        const messageId = row.message_id;
+        const kind = row.kind;
+        const result = yield* Effect.try({
+            try: () => applyPurgeTxn(deps.db, row, messageId, kind),
+            catch: (cause) => new PurgeError({ findingId, reason: 'db-failed', cause }),
+        });
+        yield* deps.publish({
+            type: 'state-changed',
+            sessionId: row.session_id,
+            findingId: row.id,
+            state: 'purged',
+        });
+        return result;
+    }).pipe(Effect.withSpan('security.purge.single', { attributes: { findingId } }));
+}
+/** Bulk purge across many findings. Caller passes an arbitrary
+ *  ordering; we re-sort to the only correct order:
+ *
+ *    1. Group by `message_id`
+ *    2. Within each group, apply in **descending** `start_offset` so
+ *       earlier offsets stay valid as the string shifts.
+ *
+ *  Without this re-sort, two findings inside the same message at
+ *  offsets [10..20] and [40..60] would corrupt: purging [10..20]
+ *  first shifts everything after offset 20 by `mask.length - 10`,
+ *  and the second slice [40..60] now points at the wrong bytes
+ *  (often leaking part of the second secret into the mask, or
+ *  losing it entirely). */
+export function purgeFindings(findingIds, deps) {
+    return Effect.gen(function* () {
+        // Resolve offsets/message ids up front so we can deterministically
+        // order. The Effect.try preserves db-failure → PurgeError mapping.
+        const ordered = yield* Effect.try({
+            try: () => orderForBulkPurge(deps.db, findingIds),
+            catch: (cause) => new PurgeError({ findingId: -1, reason: 'db-failed', cause }),
+        });
+        const out = [];
+        for (const id of ordered) {
+            const result = yield* purgeFinding(id, deps).pipe(Effect.catchTag('PurgeError', (err) => err.reason === 'already-purged'
+                ? Effect.succeed(null)
+                : Effect.fail(err)));
+            if (result)
+                out.push(result);
+        }
+        yield* Effect.annotateCurrentSpan('purged', out.length);
+        return out;
+    }).pipe(Effect.withSpan('security.purge.bulk', { attributes: { requested: findingIds.length } }));
+}
+/** Purge EVERY active occurrence of one leaked value — the
+ *  `(kind, value_hash)` pair — across all sessions in the archive, in a
+ *  single logical operation. The natural follow-through to "I've rotated
+ *  this key at the source → now scrub every copy from Spool's surfaces".
+ *
+ *  Delegates to {@link purgeFindings}, which re-orders the collected ids
+ *  via {@link orderForBulkPurge} so per-message offsets stay valid. The
+ *  original `~/.claude` session files are NOT touched — this masks only
+ *  Spool's stored copies (DB + FTS), closing the search / AI / browse
+ *  exposure.
+ *
+ *  Returns the purge results plus the distinct session ids touched, in
+ *  first-seen order, so the IPC layer can emit one change event per
+ *  session. */
+export function purgeEverywhere(kind, valueHash, deps) {
+    return Effect.gen(function* () {
+        const ids = yield* Effect.try({
+            try: () => deps.db.prepare(`SELECT id FROM findings
+            WHERE kind = ? AND value_hash = ? AND state = 'active'`).all(kind, valueHash).map(r => r.id),
+            catch: (cause) => new PurgeError({ findingId: -1, reason: 'db-failed', cause }),
+        });
+        const results = yield* purgeFindings(ids, deps);
+        const seen = new Set();
+        const sessionIds = [];
+        for (const r of results) {
+            if (!seen.has(r.sessionId)) {
+                seen.add(r.sessionId);
+                sessionIds.push(r.sessionId);
+            }
+        }
+        return { results, sessionIds };
+    }).pipe(Effect.withSpan('security.purge.everywhere', { attributes: { kind } }));
+}
+/** Produce a purge order that's safe against offset drift. Findings
+ *  with `message_id IS NULL` (orphan rows that the schema permits but
+ *  should never happen in practice) fall to the end so they don't
+ *  interfere with message-grouped batches.
+ *
+ *  Exported only for tests. */
+export function orderForBulkPurge(db, findingIds) {
+    if (findingIds.length === 0)
+        return [];
+    const placeholders = findingIds.map(() => '?').join(',');
+    const rows = db.prepare(`SELECT id, message_id, start_offset
+       FROM findings
+      WHERE id IN (${placeholders})`).all(...findingIds);
+    const byMessage = new Map();
+    for (const r of rows) {
+        const key = r.message_id;
+        let bucket = byMessage.get(key);
+        if (!bucket) {
+            bucket = [];
+            byMessage.set(key, bucket);
+        }
+        bucket.push({ id: r.id, start_offset: r.start_offset });
+    }
+    for (const bucket of byMessage.values()) {
+        bucket.sort((a, b) => b.start_offset - a.start_offset);
+    }
+    // Stable iteration order over the messages doesn't matter for
+    // correctness — purges in different messages can't shift each
+    // other's offsets. We sort by message_id (nulls last) for
+    // determinism in tests.
+    const messageKeys = [...byMessage.keys()].sort((a, b) => {
+        if (a === null)
+            return 1;
+        if (b === null)
+            return -1;
+        return a - b;
+    });
+    const out = [];
+    for (const key of messageKeys) {
+        for (const r of byMessage.get(key))
+            out.push(r.id);
+    }
+    return out;
+}
+function applyPurgeTxn(db, finding, messageId, kind) {
+    const msg = db.prepare('SELECT content_text FROM messages WHERE id = ?').get(messageId);
+    if (!msg) {
+        throw new Error(`Message ${messageId} disappeared between read and purge`);
+    }
+    const original = msg.content_text.slice(finding.start_offset, finding.end_offset);
+    const mask = maskValueByKind(original, kind);
+    const purgedAt = new Date().toISOString();
+    db.transaction(() => {
+        const newText = msg.content_text.slice(0, finding.start_offset) +
+            mask +
+            msg.content_text.slice(finding.end_offset);
+        db.prepare('UPDATE messages SET content_text = ? WHERE id = ?')
+            .run(newText, messageId);
+        db.prepare(`UPDATE findings
+          SET state = 'purged',
+              state_changed_at = ?
+        WHERE id = ?`).run(purgedAt, finding.id);
+        updateSessionCounts(db, finding.session_id);
+    })();
+    return {
+        findingId: finding.id,
+        sessionId: finding.session_id,
+        maskUsed: mask,
+        purgedAt,
+    };
+}
+//# sourceMappingURL=purge.js.map

package/dist/security/purge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge.js","sourceRoot":"","sources":["../../src/security/purge.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,gBAAgB;AAChB,EAAE;AACF,mEAAmE;AACnE,kEAAkE;AAClE,oEAAoE;AACpE,oEAAoE;AACpE,mCAAmC;AACnC,EAAE;AACF,2DAA2D;AAC3D,mEAAmE;AACnE,mEAAmE;AACnE,yCAAyC;AACzC,EAAE;AACF,kEAAkE;AAClE,kEAAkE;AAClE,2CAA2C;AAE3C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAGrC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAG/C,MAAM,OAAO,UAAW,SAAQ,IAAI,CAAC,WAAW,CAAC,YAAY,CAI3D;CAAG;AAyBL;gDACgD;AAChD,MAAM,UAAU,YAAY,CAC1B,SAAiB,EACjB,IAAe;IAEf,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAC5B,GAAG,EAAE,GAAG,EAAE,CACR,IAAI,CAAC,EAAE,CAAC,OAAO,CACb;wCAC8B,CAC/B,CAAC,GAAG,CAAC,SAAS,CAAgC;YACjD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;SAC5E,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAA;QACpF,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAA;QACrF,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAA;QAChC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAqB,CAAA;QACtC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAC/B,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC;YACvD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;SAC5E,CAAC,CAAA;QAEF,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAA;QAEF,OAAO,MAAM,CAAA;IACf,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CACxE,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;2BAY2B;AAC3B,MAAM,UAAU,aAAa,CAC3B,UAA6B,EAC7B,IAAe;IAEf,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAChC,GAAG,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;YACjD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;SAChF,CAAC,CAAA;QAEF,MAAM,GAAG,GAAkB,EAAE,CAAA;QAC7B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,IAAI,CAC/C,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CACpC,GAAG,CAAC,MAAM,KAAK,gBAAgB;gBAC7B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CACrB,CACF,CAAA;YACD,IAAI,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC9B,CAAC;QACD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QACvD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CACzF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;eAae;AACf,MAAM,UAAU,eAAe,CAC7B,IAAmB,EACnB,SAAiB,EACjB,IAAe;IAEf,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAC5B,GAAG,EAAE,GAAG,EAAE,CACP,IAAI,CAAC,EAAE,CAAC,OAAO,CACd;mEACyD,CAC1D,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;SAChF,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,MAAM,UAAU,GAAa,EAAE,CAAA;QAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;YAAC,CAAC;QACrF,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;IAChC,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CACvE,CAAA;AACH,CAAC;AAED;;;;;+BAK+B;AAC/B,MAAM,UAAU,iBAAiB,CAC/B,EAAqB,EACrB,UAA6B;IAE7B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACtC,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB;;qBAEiB,YAAY,GAAG,CACjC,CAAC,GAAG,CAAC,GAAG,UAAU,CAA2E,CAAA;IAE9F,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8D,CAAA;IACvF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAA;QACxB,IAAI,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,MAAM,GAAG,EAAE,CAAC;YAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAA;IACzD,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,CAAA;IACxD,CAAC;IACD,8DAA8D;IAC9D,8DAA8D;IAC9D,0DAA0D;IAC1D,wBAAwB;IACxB,MAAM,WAAW,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACtD,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,CAAA;QACxB,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,CAAA;QACzB,OAAO,CAAC,GAAG,CAAC,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAE;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACrD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,aAAa,CACpB,EAAqB,EACrB,OAAwB,EACxB,SAAiB,EACjB,IAAmB;IAEnB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACpB,gDAAgD,CACjD,CAAC,GAAG,CAAC,SAAS,CAAyC,CAAA;IACxD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,qCAAqC,CAAC,CAAA;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IACjF,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC5C,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAEzC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QAClB,MAAM,OAAO,GACX,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC;YAC/C,IAAI;YACJ,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAC5C,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC;aAC5D,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAC1B,EAAE,CAAC,OAAO,CACR;;;qBAGe,CAChB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;QAC3B,mBAAmB,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IAC7C,CAAC,CAAC,EAAE,CAAA;IAEJ,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,QAAQ,EAAE,IAAI;QACd,QAAQ;KACT,CAAA;AACH,CAAC"}