agentvault 1.0.2 → 1.0.5

package/dist/src/vault/secret-management-layer.js

@@ -0,0 +1,366 @@
+/**
+ * Secret Management Layer – Unified Orchestrator
+ *
+ * Brings together all Agent Safehouse-inspired components into a single
+ * coherent API:
+ *
+ * - **SecretSandbox**: Deny-first access control with scoped grants
+ * - **EncryptedMemoryStore**: AES-256-GCM encrypted in-memory cache
+ * - **SecretRotationManager**: Automatic secret rotation
+ * - **SecretLeakDetector**: Leak monitoring and auto-redaction
+ * - **SecretInjector**: Safe secret delivery to agent processes
+ * - **SecretAccessAudit**: Hash-chained tamper-evident audit trail
+ *
+ * Usage:
+ * ```ts
+ * const sml = SecretManagementLayer.create({
+ *   backend: 'memory',   // or 'hashicorp' / 'bitwarden'
+ *   leakDetection: true,
+ *   auditEnabled: true,
+ * });
+ *
+ * const scope = sml.createScope({
+ *   agentId: 'my-agent',
+ *   grants: [{ keyPattern: 'api_*', access: 'read' }],
+ * });
+ *
+ * sml.enterScope(scope.scopeId);
+ * const value = await sml.getSecret('api_key');
+ * sml.exitScope();
+ * sml.dispose();
+ * ```
+ */
+import { SecretSandbox } from './secret-sandbox.js';
+import { EncryptedMemoryStore } from './encrypted-memory-store.js';
+import { SecretRotationManager } from './secret-rotation.js';
+import { SecretLeakDetector } from './secret-leak-detector.js';
+import { SecretInjector } from './secret-injector.js';
+import { SecretAccessAudit } from './secret-audit.js';
+import { MemorySecretProvider } from './memory-provider.js';
+import { HashiCorpVaultProvider } from './hashicorp-provider.js';
+import { BitwardenProvider } from './bitwarden.js';
+export class SecretManagementLayer {
+    sandbox;
+    memoryStore;
+    rotation;
+    leakDetector;
+    injector;
+    audit;
+    config;
+    startedAt;
+    /** Counters for stats */
+    totalReads = 0;
+    totalWrites = 0;
+    totalDenied = 0;
+    /** Active secret values for leak detection (key -> plaintext) */
+    activeSecrets = new Map();
+    constructor(provider, config) {
+        this.startedAt = Date.now();
+        this.config = {
+            defaultTtlSeconds: config.defaultTtlSeconds ?? 300,
+            leakDetection: config.leakDetection ?? true,
+            auditEnabled: config.auditEnabled ?? true,
+            maxSecretsPerSession: config.maxSecretsPerSession ?? 100,
+            injectionMethod: config.injectionMethod ?? 'env-scoped',
+            backend: config.backend ?? 'memory',
+            autoWipeIntervalMs: config.autoWipeIntervalMs ?? 30_000,
+        };
+        // Initialize components
+        this.audit = new SecretAccessAudit();
+        this.sandbox = new SecretSandbox(provider, (action, secretKey, allowed, reason) => {
+            if (!allowed)
+                this.totalDenied++;
+            if (this.config.auditEnabled) {
+                const scope = this.sandbox.getActiveScope();
+                this.audit.record({
+                    action,
+                    agentId: scope?.agentId ?? 'unknown',
+                    scopeId: scope?.scopeId ?? 'none',
+                    secretKey,
+                    allowed,
+                    denialReason: reason,
+                });
+            }
+        });
+        this.memoryStore = new EncryptedMemoryStore({
+            defaultTtlMs: this.config.defaultTtlSeconds * 1000,
+            maxEntries: this.config.maxSecretsPerSession,
+            autoWipeIntervalMs: this.config.autoWipeIntervalMs,
+        });
+        this.rotation = new SecretRotationManager(provider);
+        this.leakDetector = new SecretLeakDetector({
+            onLeak: (event) => {
+                if (this.config.auditEnabled) {
+                    const scope = this.sandbox.getActiveScope();
+                    this.audit.record({
+                        action: 'secret.leak_detected',
+                        agentId: scope?.agentId ?? 'unknown',
+                        scopeId: scope?.scopeId ?? 'none',
+                        secretKey: event.secretKey,
+                        allowed: true,
+                        metadata: {
+                            severity: event.severity,
+                            source: event.source,
+                            description: event.description,
+                            remediated: String(event.remediated),
+                        },
+                    });
+                }
+            },
+            autoRemediate: true,
+        });
+        this.injector = new SecretInjector({
+            method: this.config.injectionMethod,
+        });
+    }
+    // -----------------------------------------------------------------------
+    // Factory
+    // -----------------------------------------------------------------------
+    /**
+     * Create a new SecretManagementLayer with the specified configuration.
+     */
+    static create(config) {
+        const backend = config?.backend ?? 'memory';
+        let provider;
+        switch (backend) {
+            case 'hashicorp':
+                provider = HashiCorpVaultProvider.forAgent('default');
+                break;
+            case 'bitwarden':
+                provider = new BitwardenProvider({ agentId: 'default' });
+                break;
+            case 'memory':
+            default:
+                provider = new MemorySecretProvider();
+                break;
+        }
+        return new SecretManagementLayer(provider, config ?? {});
+    }
+    /**
+     * Create with a custom provider.
+     */
+    static createWithProvider(provider, config) {
+        return new SecretManagementLayer(provider, config ?? {});
+    }
+    // -----------------------------------------------------------------------
+    // Scope management (delegated to sandbox)
+    // -----------------------------------------------------------------------
+    createScope(options) {
+        return this.sandbox.createScope(options);
+    }
+    enterScope(scopeId) {
+        this.sandbox.enterScope(scopeId);
+        // Install leak detection interceptors
+        if (this.config.leakDetection && this.activeSecrets.size > 0) {
+            this.leakDetector.installOutputInterceptors(this.activeSecrets);
+        }
+    }
+    exitScope() {
+        this.sandbox.exitScope();
+        this.leakDetector.removeOutputInterceptors();
+    }
+    revokeScope(scopeId) {
+        this.sandbox.revokeScope(scopeId);
+    }
+    // -----------------------------------------------------------------------
+    // Secret operations (sandbox + cache + leak detection)
+    // -----------------------------------------------------------------------
+    /**
+     * Get a secret. The value is cached in the encrypted memory store.
+     */
+    async getSecret(key) {
+        // Try cache first
+        const cached = this.memoryStore.get(key);
+        if (cached !== null) {
+            this.totalReads++;
+            await this.rotation.recordRead(key);
+            return cached;
+        }
+        // Fetch through sandbox (enforces policy)
+        const value = await this.sandbox.getSecret(key);
+        this.totalReads++;
+        if (value !== null) {
+            // Cache it
+            this.memoryStore.set(key, value, {
+                ttlMs: this.config.defaultTtlSeconds * 1000,
+            });
+            // Track for leak detection
+            this.activeSecrets.set(key, value);
+            this.leakDetector.track(key, value);
+            // Record read for rotation
+            await this.rotation.recordRead(key);
+            // Update leak detection interceptors
+            if (this.config.leakDetection) {
+                this.leakDetector.installOutputInterceptors(this.activeSecrets);
+            }
+        }
+        return value;
+    }
+    /**
+     * Store a secret through the sandbox.
+     */
+    async storeSecret(key, value) {
+        await this.sandbox.storeSecret(key, value);
+        this.totalWrites++;
+        // Update cache
+        this.memoryStore.set(key, value, {
+            ttlMs: this.config.defaultTtlSeconds * 1000,
+        });
+        // Update leak tracking
+        this.activeSecrets.set(key, value);
+        this.leakDetector.track(key, value);
+    }
+    /**
+     * Delete a secret through the sandbox.
+     */
+    async deleteSecret(key) {
+        await this.sandbox.deleteSecret(key);
+        // Remove from cache and tracking
+        this.memoryStore.delete(key);
+        this.activeSecrets.delete(key);
+        this.leakDetector.untrack(key);
+    }
+    /**
+     * List accessible secrets through the sandbox.
+     */
+    async listSecrets() {
+        return this.sandbox.listSecrets();
+    }
+    // -----------------------------------------------------------------------
+    // Secret injection
+    // -----------------------------------------------------------------------
+    /**
+     * Inject a secret for an agent execution context.
+     */
+    async injectSecret(key, method) {
+        const value = await this.getSecret(key);
+        if (value === null) {
+            throw new Error(`Secret "${key}" not found or not accessible`);
+        }
+        const injection = await this.injector.inject(key, value, method);
+        if (this.config.auditEnabled) {
+            const scope = this.sandbox.getActiveScope();
+            this.audit.record({
+                action: 'secret.inject',
+                agentId: scope?.agentId ?? 'unknown',
+                scopeId: scope?.scopeId ?? 'none',
+                secretKey: key,
+                allowed: true,
+                metadata: { method: injection.method, reference: injection.reference },
+            });
+        }
+        return injection;
+    }
+    /**
+     * Build a child process environment with all env-scoped injected secrets.
+     */
+    buildChildEnv(baseEnv) {
+        return this.injector.buildChildEnv(baseEnv);
+    }
+    // -----------------------------------------------------------------------
+    // Rotation
+    // -----------------------------------------------------------------------
+    /**
+     * Register a secret for automatic rotation.
+     */
+    registerRotation(config) {
+        this.rotation.register(config);
+    }
+    /**
+     * Manually rotate a secret.
+     */
+    async rotateSecret(key) {
+        const state = await this.rotation.rotate(key);
+        // Invalidate cache so next read fetches the new value
+        this.memoryStore.delete(key);
+        this.activeSecrets.delete(key);
+        if (this.config.auditEnabled) {
+            const scope = this.sandbox.getActiveScope();
+            this.audit.record({
+                action: 'secret.rotate',
+                agentId: scope?.agentId ?? 'unknown',
+                scopeId: scope?.scopeId ?? 'none',
+                secretKey: key,
+                allowed: true,
+                metadata: { version: String(state.currentVersion) },
+            });
+        }
+        return state;
+    }
+    // -----------------------------------------------------------------------
+    // Leak scanning
+    // -----------------------------------------------------------------------
+    /**
+     * Run a full leak scan across environment, process args, and any custom text.
+     */
+    scanForLeaks() {
+        const events = [];
+        events.push(...this.leakDetector.scanEnvironment(this.activeSecrets));
+        events.push(...this.leakDetector.scanProcessArguments(this.activeSecrets));
+        return events;
+    }
+    /**
+     * Scan a string for leaked secrets.
+     */
+    scanText(text, source = 'log') {
+        return this.leakDetector.scanString(text, source, this.activeSecrets);
+    }
+    /**
+     * Get all recorded leak events.
+     */
+    getLeakEvents() {
+        return this.leakDetector.getEvents();
+    }
+    // -----------------------------------------------------------------------
+    // Statistics & health
+    // -----------------------------------------------------------------------
+    /**
+     * Get operational statistics.
+     */
+    stats() {
+        return {
+            cachedSecrets: this.memoryStore.size,
+            totalReads: this.totalReads,
+            totalWrites: this.totalWrites,
+            totalDenied: this.totalDenied,
+            totalLeaks: this.leakDetector.getEvents().length,
+            totalRotations: this.rotation.listStates().reduce((sum, s) => sum + s.totalRotations, 0),
+            activeScopes: this.sandbox.listScopes().filter(s => !s.revoked).length,
+            uptimeMs: Date.now() - this.startedAt,
+        };
+    }
+    /**
+     * Check the health of the underlying provider.
+     */
+    async healthCheck() {
+        return this.sandbox.healthCheck();
+    }
+    /**
+     * Get the audit trail.
+     */
+    getAuditEntries() {
+        return this.audit.getEntries();
+    }
+    /**
+     * Verify audit chain integrity.
+     */
+    verifyAuditChain() {
+        return this.audit.verifyChain();
+    }
+    // -----------------------------------------------------------------------
+    // Lifecycle
+    // -----------------------------------------------------------------------
+    /**
+     * Securely dispose of all components.
+     * After calling this, the layer is no longer usable.
+     */
+    async dispose() {
+        this.sandbox.exitScope();
+        this.memoryStore.dispose();
+        this.rotation.dispose();
+        this.leakDetector.dispose();
+        await this.injector.dispose();
+        this.activeSecrets.clear();
+    }
+}
+//# sourceMappingURL=secret-management-layer.js.map

package/dist/src/vault/secret-management-layer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-management-layer.js","sourceRoot":"","sources":["../../../src/vault/secret-management-layer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAeH,OAAO,EAAE,aAAa,EAA2B,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,OAAO,qBAAqB;IACvB,OAAO,CAAgB;IACvB,WAAW,CAAuB;IAClC,QAAQ,CAAwB;IAChC,YAAY,CAAqB;IACjC,QAAQ,CAAiB;IACzB,KAAK,CAAoB;IAEjB,MAAM,CAAwC;IAC9C,SAAS,CAAS;IAEnC,yBAAyB;IACjB,UAAU,GAAG,CAAC,CAAC;IACf,WAAW,GAAG,CAAC,CAAC;IAChB,WAAW,GAAG,CAAC,CAAC;IAExB,iEAAiE;IAChD,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3D,YAAoB,QAAwB,EAAE,MAAmC;QAC/E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE5B,IAAI,CAAC,MAAM,GAAG;YACZ,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,GAAG;YAClD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;YAC3C,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;YACzC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,IAAI,GAAG;YACxD,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,YAAY;YACvD,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,QAAQ;YACnC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,MAAM;SACxD,CAAC;QAEF,wBAAwB;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,iBAAiB,EAAE,CAAC;QAErC,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YAChF,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC5C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBAChB,MAAM;oBACN,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,SAAS;oBACpC,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,MAAM;oBACjC,SAAS;oBACT,OAAO;oBACP,YAAY,EAAE,MAAM;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,GAAG,IAAI,oBAAoB,CAAC;YAC1C,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,GAAG,IAAI;YAClD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;YAC5C,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;SACnD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,GAAG,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAEpD,IAAI,CAAC,YAAY,GAAG,IAAI,kBAAkB,CAAC;YACzC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAChB,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;oBAC5C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;wBAChB,MAAM,EAAE,sBAAsB;wBAC9B,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,SAAS;wBACpC,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,MAAM;wBACjC,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,OAAO,EAAE,IAAI;wBACb,QAAQ,EAAE;4BACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;4BACxB,MAAM,EAAE,KAAK,CAAC,MAAM;4BACpB,WAAW,EAAE,KAAK,CAAC,WAAW;4BAC9B,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;yBACrC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;SACpC,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,UAAU;IACV,0EAA0E;IAE1E;;OAEG;IACH,MAAM,CAAC,MAAM,CAAC,MAAoC;QAChD,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,QAAQ,CAAC;QAC5C,IAAI,QAAwB,CAAC;QAE7B,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,WAAW;gBACd,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACtD,MAAM;YACR,KAAK,WAAW;gBACd,QAAQ,GAAG,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;gBACzD,MAAM;YACR,KAAK,QAAQ,CAAC;YACd;gBACE,QAAQ,GAAG,IAAI,oBAAoB,EAAE,CAAC;gBACtC,MAAM;QACV,CAAC;QAED,OAAO,IAAI,qBAAqB,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,QAAwB,EAAE,MAAoC;QACtF,OAAO,IAAI,qBAAqB,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,0EAA0E;IAC1E,0CAA0C;IAC1C,0EAA0E;IAE1E,WAAW,CAAC,OAA2B;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAEjC,sCAAsC;QACtC,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,SAAS;QACP,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,wBAAwB,EAAE,CAAC;IAC/C,CAAC;IAED,WAAW,CAAC,OAAe;QACzB,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,0EAA0E;IAC1E,uDAAuD;IACvD,0EAA0E;IAE1E;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,kBAAkB;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,0CAA0C;QAC1C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,EAAE,CAAC;QAElB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,WAAW;YACX,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE;gBAC/B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,GAAG,IAAI;aAC5C,CAAC,CAAC;YAEH,2BAA2B;YAC3B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAEpC,2BAA2B;YAC3B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAEpC,qCAAqC;YACrC,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC9B,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,KAAa;QAC1C,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,eAAe;QACf,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE;YAC/B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,GAAG,IAAI;SAC5C,CAAC,CAAC;QAEH,uBAAuB;QACvB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAErC,iCAAiC;QACjC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,CAAC;IAED,0EAA0E;IAC1E,mBAAmB;IACnB,0EAA0E;IAE1E;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,MAAwB;QACtD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,+BAA+B,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAEjE,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAChB,MAAM,EAAE,eAAe;gBACvB,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,SAAS;gBACpC,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,MAAM;gBACjC,SAAS,EAAE,GAAG;gBACd,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAA2B;QACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,0EAA0E;IAC1E,WAAW;IACX,0EAA0E;IAE1E;;OAEG;IACH,gBAAgB,CAAC,MAA4B;QAC3C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAE9C,sDAAsD;QACtD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAE/B,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAChB,MAAM,EAAE,eAAe;gBACvB,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,SAAS;gBACpC,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,MAAM;gBACjC,SAAS,EAAE,GAAG;gBACd,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0EAA0E;IAC1E,gBAAgB;IAChB,0EAA0E;IAE1E;;OAEG;IACH,YAAY;QACV,MAAM,MAAM,GAAyB,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3E,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,IAAY,EAAE,SAAuC,KAAK;QACjE,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IACxE,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;IACvC,CAAC;IAED,0EAA0E;IAC1E,sBAAsB;IACtB,0EAA0E;IAE1E;;OAEG;IACH,KAAK;QACH,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;YACpC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,MAAM;YAChD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;YACxF,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM;YACtE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;SACtC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;IAED,0EAA0E;IAC1E,YAAY;IACZ,0EAA0E;IAE1E;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;CACF"}

package/dist/src/vault/secret-rotation.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Secret Rotation Manager
+ *
+ * Handles automatic secret rotation with zero-downtime semantics:
+ * - Periodic rotation on a timer
+ * - On-access rotation after N reads
+ * - Manual rotation triggered by API
+ *
+ * During rotation the old value remains accessible until the new value is
+ * confirmed stored in the backend.
+ */
+import type { SecretProvider } from './provider.js';
+import type { SecretRotationConfig, SecretRotationState } from './safehouse-types.js';
+export declare class SecretRotationManager {
+    private readonly provider;
+    private readonly configs;
+    private readonly states;
+    private readonly timers;
+    /** Callback invoked on any rotation event */
+    private readonly onRotated;
+    constructor(provider: SecretProvider, onRotated?: (key: string, version: number) => void);
+    /**
+     * Register a secret for automatic rotation.
+     */
+    register(config: SecretRotationConfig): void;
+    /**
+     * Unregister a secret from automatic rotation.
+     */
+    unregister(key: string): void;
+    /**
+     * Record a read and trigger on-access rotation if configured.
+     * Returns true if a rotation was triggered.
+     */
+    recordRead(key: string): Promise<boolean>;
+    /**
+     * Manually rotate a secret.
+     */
+    rotate(key: string): Promise<SecretRotationState>;
+    /**
+     * Get the current rotation state for a key.
+     */
+    getState(key: string): SecretRotationState | null;
+    /**
+     * Get all rotation states.
+     */
+    listStates(): SecretRotationState[];
+    /**
+     * Stop all timers and clean up.
+     */
+    dispose(): void;
+    private startPeriodicTimer;
+    private stopTimer;
+}
+//# sourceMappingURL=secret-rotation.d.ts.map

package/dist/src/vault/secret-rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-rotation.d.ts","sourceRoot":"","sources":["../../../src/vault/secret-rotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEtF,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2C;IACnE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IACjE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqD;IAE5E,6CAA6C;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkD;gBAEhE,QAAQ,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI;IASxF;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI;IAoB5C;;OAEG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAU7B;;;OAGG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmB/C;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAiCvD;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI;IAKjD;;OAEG;IACH,UAAU,IAAI,mBAAmB,EAAE;IAInC;;OAEG;IACH,OAAO,IAAI,IAAI;IAYf,OAAO,CAAC,kBAAkB;IAuB1B,OAAO,CAAC,SAAS;CAOlB"}

package/dist/src/vault/secret-rotation.js

@@ -0,0 +1,156 @@
+/**
+ * Secret Rotation Manager
+ *
+ * Handles automatic secret rotation with zero-downtime semantics:
+ * - Periodic rotation on a timer
+ * - On-access rotation after N reads
+ * - Manual rotation triggered by API
+ *
+ * During rotation the old value remains accessible until the new value is
+ * confirmed stored in the backend.
+ */
+export class SecretRotationManager {
+    provider;
+    configs = new Map();
+    states = new Map();
+    timers = new Map();
+    /** Callback invoked on any rotation event */
+    onRotated;
+    constructor(provider, onRotated) {
+        this.provider = provider;
+        this.onRotated = onRotated ?? null;
+    }
+    // -----------------------------------------------------------------------
+    // Configuration
+    // -----------------------------------------------------------------------
+    /**
+     * Register a secret for automatic rotation.
+     */
+    register(config) {
+        this.configs.set(config.key, config);
+        // Initialize state
+        if (!this.states.has(config.key)) {
+            this.states.set(config.key, {
+                key: config.key,
+                currentVersion: 0,
+                lastRotatedAt: new Date().toISOString(),
+                totalRotations: 0,
+                readsSinceRotation: 0,
+            });
+        }
+        // Start periodic timer if applicable
+        if (config.strategy === 'periodic' && config.intervalSeconds) {
+            this.startPeriodicTimer(config.key, config.intervalSeconds);
+        }
+    }
+    /**
+     * Unregister a secret from automatic rotation.
+     */
+    unregister(key) {
+        this.stopTimer(key);
+        this.configs.delete(key);
+        this.states.delete(key);
+    }
+    // -----------------------------------------------------------------------
+    // Rotation triggers
+    // -----------------------------------------------------------------------
+    /**
+     * Record a read and trigger on-access rotation if configured.
+     * Returns true if a rotation was triggered.
+     */
+    async recordRead(key) {
+        const config = this.configs.get(key);
+        const state = this.states.get(key);
+        if (!config || !state)
+            return false;
+        state.readsSinceRotation++;
+        if (config.strategy === 'on-access' &&
+            config.rotateAfterReads &&
+            state.readsSinceRotation >= config.rotateAfterReads) {
+            await this.rotate(key);
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Manually rotate a secret.
+     */
+    async rotate(key) {
+        const config = this.configs.get(key);
+        if (!config) {
+            throw new Error(`No rotation config registered for key "${key}"`);
+        }
+        const state = this.states.get(key);
+        // Generate new value
+        const newValue = await config.generator();
+        // Store in backend (old value remains until this completes)
+        await this.provider.storeSecret(key, newValue);
+        // Update state
+        state.currentVersion++;
+        state.lastRotatedAt = new Date().toISOString();
+        state.totalRotations++;
+        state.readsSinceRotation = 0;
+        if (config.strategy === 'periodic' && config.intervalSeconds) {
+            state.nextRotationAt = new Date(Date.now() + config.intervalSeconds * 1000).toISOString();
+        }
+        // Notify
+        if (config.onRotated)
+            config.onRotated(key, state.currentVersion);
+        if (this.onRotated)
+            this.onRotated(key, state.currentVersion);
+        return { ...state };
+    }
+    /**
+     * Get the current rotation state for a key.
+     */
+    getState(key) {
+        const state = this.states.get(key);
+        return state ? { ...state } : null;
+    }
+    /**
+     * Get all rotation states.
+     */
+    listStates() {
+        return [...this.states.values()].map(s => ({ ...s }));
+    }
+    /**
+     * Stop all timers and clean up.
+     */
+    dispose() {
+        for (const key of this.timers.keys()) {
+            this.stopTimer(key);
+        }
+        this.configs.clear();
+        this.states.clear();
+    }
+    // -----------------------------------------------------------------------
+    // Internal
+    // -----------------------------------------------------------------------
+    startPeriodicTimer(key, intervalSeconds) {
+        this.stopTimer(key);
+        const timer = setInterval(async () => {
+            try {
+                await this.rotate(key);
+            }
+            catch {
+                // Rotation failure is non-fatal; it will retry next interval
+            }
+        }, intervalSeconds * 1000);
+        if (timer.unref)
+            timer.unref();
+        this.timers.set(key, timer);
+        // Set next rotation time
+        const state = this.states.get(key);
+        if (state) {
+            state.nextRotationAt = new Date(Date.now() + intervalSeconds * 1000).toISOString();
+        }
+    }
+    stopTimer(key) {
+        const timer = this.timers.get(key);
+        if (timer) {
+            clearInterval(timer);
+            this.timers.delete(key);
+        }
+    }
+}
+//# sourceMappingURL=secret-rotation.js.map

package/dist/src/vault/secret-rotation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-rotation.js","sourceRoot":"","sources":["../../../src/vault/secret-rotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,MAAM,OAAO,qBAAqB;IACf,QAAQ,CAAiB;IACzB,OAAO,GAAG,IAAI,GAAG,EAAgC,CAAC;IAClD,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IAChD,MAAM,GAAG,IAAI,GAAG,EAA0C,CAAC;IAE5E,6CAA6C;IAC5B,SAAS,CAAkD;IAE5E,YAAY,QAAwB,EAAE,SAAkD;QACtF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,IAAI,CAAC;IACrC,CAAC;IAED,0EAA0E;IAC1E,gBAAgB;IAChB,0EAA0E;IAE1E;;OAEG;IACH,QAAQ,CAAC,MAA4B;QACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAErC,mBAAmB;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;gBAC1B,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,cAAc,EAAE,CAAC;gBACjB,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACvC,cAAc,EAAE,CAAC;gBACjB,kBAAkB,EAAE,CAAC;aACtB,CAAC,CAAC;QACL,CAAC;QAED,qCAAqC;QACrC,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC7D,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,GAAW;QACpB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,0EAA0E;IAC1E,oBAAoB;IACpB,0EAA0E;IAE1E;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,GAAW;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEpC,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAE3B,IACE,MAAM,CAAC,QAAQ,KAAK,WAAW;YAC/B,MAAM,CAAC,gBAAgB;YACvB,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,gBAAgB,EACnD,CAAC;YACD,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,GAAG,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAEpC,qBAAqB;QACrB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QAE1C,4DAA4D;QAC5D,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAE/C,eAAe;QACf,KAAK,CAAC,cAAc,EAAE,CAAC;QACvB,KAAK,CAAC,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/C,KAAK,CAAC,cAAc,EAAE,CAAC;QACvB,KAAK,CAAC,kBAAkB,GAAG,CAAC,CAAC;QAE7B,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC7D,KAAK,CAAC,cAAc,GAAG,IAAI,IAAI,CAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,eAAe,GAAG,IAAI,CAC3C,CAAC,WAAW,EAAE,CAAC;QAClB,CAAC;QAED,SAAS;QACT,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QAE9D,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,OAAO;QACL,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,0EAA0E;IAC1E,WAAW;IACX,0EAA0E;IAElE,kBAAkB,CAAC,GAAW,EAAE,eAAuB;QAC7D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAEpB,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;YACnC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;YAC/D,CAAC;QACH,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC,CAAC;QAE3B,IAAI,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAE5B,yBAAyB;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,cAAc,GAAG,IAAI,IAAI,CAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,IAAI,CACpC,CAAC,WAAW,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,GAAW;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,EAAE,CAAC;YACV,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;CACF"}