daemora 1.0.0-alpha.0

package/dist/config/SecretVault.d.ts

@@ -0,0 +1,53 @@
+/**
+ * SecretVault — encrypted SQLite KV for API keys, OAuth tokens, anything
+ * that must never sit in process.env or plaintext on disk.
+ *
+ * Crypto choices (defended):
+ *   - scrypt(N=2^15, r=8, p=1) to derive a 256-bit key from passphrase.
+ *     Values picked so unlock is ~100 ms on M-series; 1+ second on commodity.
+ *   - aes-256-gcm per entry, with a fresh 96-bit IV per write.
+ *     Authenticated encryption stops swap-the-blob attacks.
+ *   - Salt is per-vault, stored in the same DB under a reserved __vault_salt__ row.
+ *     Re-using a salt across users is fine here; we're a single-user app.
+ *
+ * Lifecycle:
+ *   - new() does NOT unlock. Call unlock(passphrase) before reading secrets.
+ *   - lock() drops the in-memory key. Subsequent reads return undefined.
+ *   - State changes emit events so subscribers (ModelRouter, integrations)
+ *     can react.
+ */
+import { EventEmitter } from "node:events";
+import type Database from "better-sqlite3";
+import { Secret } from "./Secret.js";
+export type VaultEvent = "unlocked" | "locked" | "set" | "delete";
+export declare class SecretVault extends EventEmitter {
+    #private;
+    private readonly db;
+    constructor(db: Database.Database);
+    /** Has this vault been initialized with anything (i.e. has it been unlocked at least once)? */
+    exists(): boolean;
+    isUnlocked(): boolean;
+    /**
+     * Unlock the vault. On first ever call (no entries yet), the
+     * passphrase is accepted as-is and becomes the new vault password.
+     * On subsequent calls, the passphrase is verified by attempting to
+     * decrypt the first non-salt entry — wrong passphrase → throws
+     * `ValidationError`.
+     */
+    unlock(passphrase: string): void;
+    lock(): void;
+    set(key: string, value: string): void;
+    /**
+     * Read a secret. Returns `undefined` if the key isn't set OR the
+     * vault is locked. Caller MUST check both — by design, locked vault
+     * doesn't throw, so an integration can degrade gracefully.
+     */
+    get(key: string): Secret | undefined;
+    has(key: string): boolean;
+    delete(key: string): boolean;
+    /** Return all known keys (no values). Useful for the UI key list. */
+    keys(): readonly string[];
+    private readRaw;
+    private writeRaw;
+}
+//# sourceMappingURL=SecretVault.d.ts.map

package/dist/config/SecretVault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretVault.d.ts","sourceRoot":"","sources":["../../src/config/SecretVault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAQH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAI3C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAarC,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,CAAC;AAElE,qBAAa,WAAY,SAAQ,YAAY;;IAI/B,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ,CAAC,QAAQ;IAuBlD,+FAA+F;IAC/F,MAAM,IAAI,OAAO;IAOjB,UAAU,IAAI,OAAO;IAIrB;;;;;;OAMG;IACH,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IA6BhC,IAAI,IAAI,IAAI;IAOZ,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAgBrC;;;;OAIG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAepC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQzB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAU5B,qEAAqE;IACrE,IAAI,IAAI,SAAS,MAAM,EAAE;IASzB,OAAO,CAAC,OAAO;IAOf,OAAO,CAAC,QAAQ;CAKjB"}

package/dist/config/SecretVault.js

@@ -0,0 +1,205 @@
+/**
+ * SecretVault — encrypted SQLite KV for API keys, OAuth tokens, anything
+ * that must never sit in process.env or plaintext on disk.
+ *
+ * Crypto choices (defended):
+ *   - scrypt(N=2^15, r=8, p=1) to derive a 256-bit key from passphrase.
+ *     Values picked so unlock is ~100 ms on M-series; 1+ second on commodity.
+ *   - aes-256-gcm per entry, with a fresh 96-bit IV per write.
+ *     Authenticated encryption stops swap-the-blob attacks.
+ *   - Salt is per-vault, stored in the same DB under a reserved __vault_salt__ row.
+ *     Re-using a salt across users is fine here; we're a single-user app.
+ *
+ * Lifecycle:
+ *   - new() does NOT unlock. Call unlock(passphrase) before reading secrets.
+ *   - lock() drops the in-memory key. Subsequent reads return undefined.
+ *   - State changes emit events so subscribers (ModelRouter, integrations)
+ *     can react.
+ */
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync, } from "node:crypto";
+import { EventEmitter } from "node:events";
+import { ConfigError, NotFoundError, ValidationError } from "../util/errors.js";
+import { createLogger } from "../util/logger.js";
+import { Secret } from "./Secret.js";
+const log = createLogger("vault");
+const ALGO = "aes-256-gcm";
+const KEY_LEN = 32;
+const IV_LEN = 12;
+const TAG_LEN = 16;
+const SCRYPT_N = 1 << 15;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+const SALT_KEY = "__vault_salt__";
+export class SecretVault extends EventEmitter {
+    db;
+    #key = null;
+    #salt;
+    constructor(db) {
+        super();
+        this.db = db;
+        this.db
+            .prepare(`CREATE TABLE IF NOT EXISTS vault_entries (
+          key   TEXT PRIMARY KEY,
+          value TEXT NOT NULL,
+          created_at TEXT DEFAULT (datetime('now')),
+          updated_at TEXT DEFAULT (datetime('now'))
+        )`)
+            .run();
+        // Per-vault salt — created once on first use and never rotated.
+        const existing = this.readRaw(SALT_KEY);
+        if (existing) {
+            this.#salt = Buffer.from(existing, "hex");
+        }
+        else {
+            this.#salt = randomBytes(16);
+            this.writeRaw(SALT_KEY, this.#salt.toString("hex"));
+        }
+    }
+    /** Has this vault been initialized with anything (i.e. has it been unlocked at least once)? */
+    exists() {
+        const row = this.db
+            .prepare("SELECT count(*) as n FROM vault_entries WHERE key != ?")
+            .get(SALT_KEY);
+        return (row?.n ?? 0) > 0;
+    }
+    isUnlocked() {
+        return this.#key !== null;
+    }
+    /**
+     * Unlock the vault. On first ever call (no entries yet), the
+     * passphrase is accepted as-is and becomes the new vault password.
+     * On subsequent calls, the passphrase is verified by attempting to
+     * decrypt the first non-salt entry — wrong passphrase → throws
+     * `ValidationError`.
+     */
+    unlock(passphrase) {
+        if (passphrase.length < 8) {
+            throw new ValidationError("Passphrase must be at least 8 characters.");
+        }
+        const candidate = scryptSync(passphrase, this.#salt, KEY_LEN, {
+            N: SCRYPT_N,
+            r: SCRYPT_R,
+            p: SCRYPT_P,
+            maxmem: 64 * 1024 * 1024,
+        });
+        // Verify by trying to decrypt any existing entry.
+        const sample = this.db
+            .prepare("SELECT key, value FROM vault_entries WHERE key != ? LIMIT 1")
+            .get(SALT_KEY);
+        if (sample) {
+            try {
+                decryptWith(sample.value, candidate);
+            }
+            catch {
+                throw new ValidationError("Incorrect vault passphrase.");
+            }
+        }
+        this.#key = candidate;
+        log.info("vault unlocked");
+        this.emit("unlocked");
+    }
+    lock() {
+        if (this.#key)
+            this.#key.fill(0);
+        this.#key = null;
+        log.info("vault locked");
+        this.emit("locked");
+    }
+    set(key, value) {
+        if (key === SALT_KEY)
+            throw new ValidationError("Reserved key");
+        if (!this.#key)
+            throw new ConfigError("Vault is locked. Unlock before writing secrets.");
+        if (typeof value !== "string" || value.length === 0) {
+            throw new ValidationError("Secret value must be a non-empty string.");
+        }
+        const blob = encryptWith(value, this.#key);
+        this.db
+            .prepare(`INSERT INTO vault_entries (key, value) VALUES (?, ?)
+         ON CONFLICT(key) DO UPDATE SET value=excluded.value, updated_at=datetime('now')`)
+            .run(key, blob);
+        this.emit("set", key);
+    }
+    /**
+     * Read a secret. Returns `undefined` if the key isn't set OR the
+     * vault is locked. Caller MUST check both — by design, locked vault
+     * doesn't throw, so an integration can degrade gracefully.
+     */
+    get(key) {
+        if (!this.#key)
+            return undefined;
+        const row = this.db
+            .prepare("SELECT value FROM vault_entries WHERE key = ?")
+            .get(key);
+        if (!row)
+            return undefined;
+        try {
+            return Secret.of(decryptWith(row.value, this.#key));
+        }
+        catch (e) {
+            // Corrupt entry — surface, don't silently swallow.
+            log.error({ key, err: e.message }, "vault entry decrypt failed");
+            return undefined;
+        }
+    }
+    has(key) {
+        if (key === SALT_KEY)
+            return false;
+        const row = this.db
+            .prepare("SELECT 1 FROM vault_entries WHERE key = ?")
+            .get(key);
+        return row !== undefined;
+    }
+    delete(key) {
+        if (key === SALT_KEY)
+            throw new ValidationError("Reserved key");
+        const info = this.db.prepare("DELETE FROM vault_entries WHERE key = ?").run(key);
+        if (info.changes > 0) {
+            this.emit("delete", key);
+            return true;
+        }
+        return false;
+    }
+    /** Return all known keys (no values). Useful for the UI key list. */
+    keys() {
+        const rows = this.db
+            .prepare("SELECT key FROM vault_entries WHERE key != ? ORDER BY key")
+            .all(SALT_KEY);
+        return rows.map((r) => r.key);
+    }
+    // ── Raw read/write for the salt only ─────────────────────────────────────
+    readRaw(key) {
+        const row = this.db
+            .prepare("SELECT value FROM vault_entries WHERE key = ?")
+            .get(key);
+        return row?.value;
+    }
+    writeRaw(key, value) {
+        this.db
+            .prepare("INSERT OR REPLACE INTO vault_entries (key, value) VALUES (?, ?)")
+            .run(key, value);
+    }
+}
+function encryptWith(plaintext, key) {
+    const iv = randomBytes(IV_LEN);
+    const cipher = createCipheriv(ALGO, key, iv);
+    const enc = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return `${iv.toString("base64")}.${tag.toString("base64")}.${enc.toString("base64")}`;
+}
+function decryptWith(blob, key) {
+    const parts = blob.split(".");
+    if (parts.length !== 3)
+        throw new NotFoundError("Malformed vault entry");
+    const [ivB64, tagB64, encB64] = parts;
+    const iv = Buffer.from(ivB64, "base64");
+    const tag = Buffer.from(tagB64, "base64");
+    const enc = Buffer.from(encB64, "base64");
+    if (iv.length !== IV_LEN || tag.length !== TAG_LEN) {
+        throw new NotFoundError("Malformed vault entry");
+    }
+    const decipher = createDecipheriv(ALGO, key, iv);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(enc), decipher.final()]).toString("utf-8");
+}
+//# sourceMappingURL=SecretVault.js.map

package/dist/config/SecretVault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretVault.js","sourceRoot":"","sources":["../../src/config/SecretVault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAI3C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;AAElC,MAAM,IAAI,GAAG,aAAa,CAAC;AAC3B,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;AACzB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAIlC,MAAM,OAAO,WAAY,SAAQ,YAAY;IAId;IAH7B,IAAI,GAAkB,IAAI,CAAC;IAClB,KAAK,CAAS;IAEvB,YAA6B,EAAqB;QAChD,KAAK,EAAE,CAAC;QADmB,OAAE,GAAF,EAAE,CAAmB;QAEhD,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;;;;UAKE,CACH;aACA,GAAG,EAAE,CAAC;QAET,gEAAgE;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC7B,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,MAAM;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,wDAAwD,CAAC;aACjE,GAAG,CAAC,QAAQ,CAA8B,CAAC;QAC9C,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,UAAkB;QACvB,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CAAC,2CAA2C,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE;YAC5D,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SACzB,CAAC,CAAC;QAEH,kDAAkD;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CAAC,6DAA6D,CAAC;aACtE,GAAG,CAAC,QAAQ,CAA+C,CAAC;QAE/D,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,eAAe,CAAC,6BAA6B,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAA+B,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAA6B,CAAC,CAAC;IAC3C,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAa;QAC5B,IAAI,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,WAAW,CAAC,iDAAiD,CAAC,CAAC;QACzF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,eAAe,CAAC,0CAA0C,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;yFACiF,CAClF;aACA,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,KAA0B,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,GAAG,CAAC,GAAW;QACb,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,+CAA+C,CAAC;aACxD,GAAG,CAAC,GAAG,CAAkC,CAAC;QAC7C,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,mDAAmD;YACnD,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,4BAA4B,CAAC,CAAC;YAC5E,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,GAAG,CAAC,GAAW;QACb,IAAI,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,2CAA2C,CAAC;aACpD,GAAG,CAAC,GAAG,CAAC,CAAC;QACZ,OAAO,GAAG,KAAK,SAAS,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,IAAI,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjF,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,QAA6B,EAAE,GAAG,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qEAAqE;IACrE,IAAI;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,2DAA2D,CAAC;aACpE,GAAG,CAAC,QAAQ,CAAsB,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,4EAA4E;IAEpE,OAAO,CAAC,GAAW;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,+CAA+C,CAAC;aACxD,GAAG,CAAC,GAAG,CAAkC,CAAC;QAC7C,OAAO,GAAG,EAAE,KAAK,CAAC;IACpB,CAAC;IAEO,QAAQ,CAAC,GAAW,EAAE,KAAa;QACzC,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,iEAAiE,CAAC;aAC1E,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrB,CAAC;CACF;AAED,SAAS,WAAW,CAAC,SAAiB,EAAE,GAAW;IACjD,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,GAAW;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,uBAAuB,CAAC,CAAC;IACzE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAiC,CAAC;IAClE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QACnD,MAAM,IAAI,aAAa,CAAC,uBAAuB,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACnF,CAAC"}

package/dist/config/SettingsStore.d.ts

@@ -0,0 +1,46 @@
+/**
+ * SettingsStore — plain SQLite KV for non-secret user preferences.
+ * Editable via UI, hot-reloadable, schema-validated on write.
+ *
+ * Storage: TEXT column holding JSON-encoded values (so booleans, numbers,
+ * arrays, null are all preserved without an extra type column).
+ */
+import { EventEmitter } from "node:events";
+import type Database from "better-sqlite3";
+import type { z } from "zod";
+import { settings as settingsSchema, type SettingKey } from "./schema.js";
+export type SettingsEvent = "change";
+export declare class SettingsStore extends EventEmitter {
+    private readonly db;
+    constructor(db: Database.Database);
+    /**
+     * Get a setting. Returns the schema default if unset.
+     */
+    get<K extends SettingKey>(key: K): z.infer<(typeof settingsSchema)[K]["schema"]>;
+    /**
+     * Whether a key has an explicitly-set value (vs falling back to default).
+     * Useful for the UI to distinguish "user picked X" from "X is the default".
+     */
+    has<K extends SettingKey>(key: K): boolean;
+    /**
+     * Set a setting. Value is validated against the schema; throws
+     * ValidationError on bad input. Emits a "change" event so reactive
+     * subscribers (ModelRouter, etc.) can update.
+     */
+    set<K extends SettingKey>(key: K, value: z.infer<(typeof settingsSchema)[K]["schema"]>): void;
+    /** Reset a setting back to its schema default. */
+    reset<K extends SettingKey>(key: K): boolean;
+    /** All known settings with their resolved value + source ("settings" or "default"). */
+    inspectAll(): readonly {
+        key: string;
+        value: unknown;
+        source: "settings" | "default";
+    }[];
+    /** Store an arbitrary key/value pair not in the schema. */
+    setGeneric(key: string, value: unknown): void;
+    /** Check if a generic key exists. */
+    hasGeneric(key: string): boolean;
+    /** Read a generic key. */
+    getGeneric(key: string): unknown;
+}
+//# sourceMappingURL=SettingsStore.d.ts.map

package/dist/config/SettingsStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SettingsStore.d.ts","sourceRoot":"","sources":["../../src/config/SettingsStore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAI7B,OAAO,EAAE,QAAQ,IAAI,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAI1E,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC;AAOrC,qBAAa,aAAc,SAAQ,YAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ,CAAC,QAAQ;IAalD;;OAEG;IACH,GAAG,CAAC,CAAC,SAAS,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IA0BhF;;;OAGG;IACH,GAAG,CAAC,CAAC,SAAS,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO;IAO1C;;;;OAIG;IACH,GAAG,CAAC,CAAC,SAAS,UAAU,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI;IAmB7F,kDAAkD;IAClD,KAAK,CAAC,CAAC,SAAS,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO;IAW5C,uFAAuF;IACvF,UAAU,IAAI,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE,EAAE;IAUxF,2DAA2D;IAC3D,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAS7C,qCAAqC;IACrC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAOhC,0BAA0B;IAC1B,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;CAOjC"}

package/dist/config/SettingsStore.js

@@ -0,0 +1,132 @@
+/**
+ * SettingsStore — plain SQLite KV for non-secret user preferences.
+ * Editable via UI, hot-reloadable, schema-validated on write.
+ *
+ * Storage: TEXT column holding JSON-encoded values (so booleans, numbers,
+ * arrays, null are all preserved without an extra type column).
+ */
+import { EventEmitter } from "node:events";
+import { ValidationError } from "../util/errors.js";
+import { createLogger } from "../util/logger.js";
+import { settings as settingsSchema } from "./schema.js";
+const log = createLogger("settings");
+export class SettingsStore extends EventEmitter {
+    db;
+    constructor(db) {
+        super();
+        this.db = db;
+        this.db
+            .prepare(`CREATE TABLE IF NOT EXISTS settings_entries (
+          key   TEXT PRIMARY KEY,
+          value TEXT NOT NULL,
+          updated_at TEXT DEFAULT (datetime('now'))
+        )`)
+            .run();
+    }
+    /**
+     * Get a setting. Returns the schema default if unset.
+     */
+    get(key) {
+        const def = settingsSchema[key];
+        if (!def)
+            throw new ValidationError(`Unknown setting key: ${String(key)}`);
+        const row = this.db
+            .prepare("SELECT value FROM settings_entries WHERE key = ?")
+            .get(String(key));
+        if (!row)
+            return def.defaultValue;
+        let parsed;
+        try {
+            parsed = JSON.parse(row.value);
+        }
+        catch {
+            log.warn({ key }, "settings row is not valid JSON; falling back to default");
+            return def.defaultValue;
+        }
+        const validated = def.schema.safeParse(parsed);
+        if (!validated.success) {
+            log.warn({ key, issues: validated.error.issues }, "stored value failed schema; using default");
+            return def.defaultValue;
+        }
+        return validated.data;
+    }
+    /**
+     * Whether a key has an explicitly-set value (vs falling back to default).
+     * Useful for the UI to distinguish "user picked X" from "X is the default".
+     */
+    has(key) {
+        const row = this.db
+            .prepare("SELECT 1 FROM settings_entries WHERE key = ?")
+            .get(String(key));
+        return row !== undefined;
+    }
+    /**
+     * Set a setting. Value is validated against the schema; throws
+     * ValidationError on bad input. Emits a "change" event so reactive
+     * subscribers (ModelRouter, etc.) can update.
+     */
+    set(key, value) {
+        const def = settingsSchema[key];
+        if (!def)
+            throw new ValidationError(`Unknown setting key: ${String(key)}`);
+        const validated = def.schema.safeParse(value);
+        if (!validated.success) {
+            throw new ValidationError(`Invalid value for ${String(key)}: ${validated.error.message}`);
+        }
+        this.db
+            .prepare(`INSERT INTO settings_entries (key, value) VALUES (?, ?)
+         ON CONFLICT(key) DO UPDATE SET value=excluded.value, updated_at=datetime('now')`)
+            .run(String(key), JSON.stringify(validated.data));
+        this.emit("change", { key: String(key), value: validated.data });
+    }
+    /** Reset a setting back to its schema default. */
+    reset(key) {
+        const def = settingsSchema[key];
+        if (!def)
+            throw new ValidationError(`Unknown setting key: ${String(key)}`);
+        const info = this.db.prepare("DELETE FROM settings_entries WHERE key = ?").run(String(key));
+        if (info.changes > 0) {
+            this.emit("change", { key: String(key), value: def.defaultValue });
+            return true;
+        }
+        return false;
+    }
+    /** All known settings with their resolved value + source ("settings" or "default"). */
+    inspectAll() {
+        return Object.keys(settingsSchema).map((k) => ({
+            key: String(k),
+            value: this.get(k),
+            source: this.has(k) ? "settings" : "default",
+        }));
+    }
+    // ── Generic KV (for forward-compat keys the UI writes) ────────
+    /** Store an arbitrary key/value pair not in the schema. */
+    setGeneric(key, value) {
+        this.db
+            .prepare(`INSERT INTO settings_entries (key, value) VALUES (?, ?)
+         ON CONFLICT(key) DO UPDATE SET value=excluded.value, updated_at=datetime('now')`)
+            .run(key, JSON.stringify(value));
+    }
+    /** Check if a generic key exists. */
+    hasGeneric(key) {
+        const row = this.db
+            .prepare("SELECT 1 FROM settings_entries WHERE key = ?")
+            .get(key);
+        return row !== undefined;
+    }
+    /** Read a generic key. */
+    getGeneric(key) {
+        const row = this.db
+            .prepare("SELECT value FROM settings_entries WHERE key = ?")
+            .get(key);
+        if (!row)
+            return undefined;
+        try {
+            return JSON.parse(row.value);
+        }
+        catch {
+            return row.value;
+        }
+    }
+}
+//# sourceMappingURL=SettingsStore.js.map

package/dist/config/SettingsStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SettingsStore.js","sourceRoot":"","sources":["../../src/config/SettingsStore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAK3C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,QAAQ,IAAI,cAAc,EAAmB,MAAM,aAAa,CAAC;AAE1E,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;AASrC,MAAM,OAAO,aAAc,SAAQ,YAAY;IAChB;IAA7B,YAA6B,EAAqB;QAChD,KAAK,EAAE,CAAC;QADmB,OAAE,GAAF,EAAE,CAAmB;QAEhD,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;;;UAIE,CACH;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IAED;;OAEG;IACH,GAAG,CAAuB,GAAM;QAC9B,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE3E,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,kDAAkD,CAAC;aAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAA4B,CAAC;QAE/C,IAAI,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC,YAA6D,CAAC;QAEnF,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,yDAAyD,CAAC,CAAC;YAC7E,OAAO,GAAG,CAAC,YAA6D,CAAC;QAC3E,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,2CAA2C,CAAC,CAAC;YAC/F,OAAO,GAAG,CAAC,YAA6D,CAAC;QAC3E,CAAC;QACD,OAAO,SAAS,CAAC,IAAqD,CAAC;IACzE,CAAC;IAED;;;OAGG;IACH,GAAG,CAAuB,GAAM;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,8CAA8C,CAAC;aACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACpB,OAAO,GAAG,KAAK,SAAS,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,GAAG,CAAuB,GAAM,EAAE,KAAoD;QACpF,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE3E,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,eAAe,CAAC,qBAAqB,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;yFACiF,CAClF;aACA,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpD,IAAI,CAAC,IAAI,CAAC,QAAgC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,kDAAkD;IAClD,KAAK,CAAuB,GAAM;QAChC,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5F,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,QAAgC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;YAC3F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uFAAuF;IACvF,UAAU;QACR,OAAQ,MAAM,CAAC,IAAI,CAAC,cAAc,CAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/D,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;YACd,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAClB,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;SAC7C,CAAC,CAAC,CAAC;IACN,CAAC;IAED,iEAAiE;IAEjE,2DAA2D;IAC3D,UAAU,CAAC,GAAW,EAAE,KAAc;QACpC,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;yFACiF,CAClF;aACA,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,qCAAqC;IACrC,UAAU,CAAC,GAAW;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,8CAA8C,CAAC;aACvD,GAAG,CAAC,GAAG,CAAC,CAAC;QACZ,OAAO,GAAG,KAAK,SAAS,CAAC;IAC3B,CAAC;IAED,0BAA0B;IAC1B,UAAU,CAAC,GAAW;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,kDAAkD,CAAC;aAC3D,GAAG,CAAC,GAAG,CAA4B,CAAC;QACvC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,GAAG,CAAC,KAAK,CAAC;QAAC,CAAC;IACnE,CAAC;CACF"}

package/dist/config/env.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Boot-time environment reader. The ONLY place process.env is read.
+ *
+ * This handles a small fixed set: PORT, DAEMORA_DATA_DIR, DAEMON_MODE,
+ * LOG_LEVEL. Everything else (API keys, feature toggles, model picks)
+ * lives in the vault or the settings store — never in env.
+ *
+ * Why this is strict: the bug pattern we keep hitting in current
+ * Daemora is "stale env value persisted across config changes" (e.g.
+ * DAEMORA_TTS_PROVIDER stuck on openai after the user picked Groq).
+ * The fix is to NOT have those values in env in the first place.
+ */
+export interface BootEnv {
+    readonly port: number;
+    readonly dataDir: string;
+    readonly daemonMode: boolean;
+    readonly logLevel: "trace" | "debug" | "info" | "warn" | "error" | "fatal";
+}
+/** Parse process.env once at startup. Throws on any malformed value. */
+export declare function readBootEnv(env?: NodeJS.ProcessEnv): BootEnv;
+//# sourceMappingURL=env.d.ts.map

package/dist/config/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;CAC5E;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAYzE"}

package/dist/config/env.js

@@ -0,0 +1,62 @@
+/**
+ * Boot-time environment reader. The ONLY place process.env is read.
+ *
+ * This handles a small fixed set: PORT, DAEMORA_DATA_DIR, DAEMON_MODE,
+ * LOG_LEVEL. Everything else (API keys, feature toggles, model picks)
+ * lives in the vault or the settings store — never in env.
+ *
+ * Why this is strict: the bug pattern we keep hitting in current
+ * Daemora is "stale env value persisted across config changes" (e.g.
+ * DAEMORA_TTS_PROVIDER stuck on openai after the user picked Groq).
+ * The fix is to NOT have those values in env in the first place.
+ */
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { ConfigError } from "../util/errors.js";
+import { envOnly } from "./schema.js";
+/** Parse process.env once at startup. Throws on any malformed value. */
+export function readBootEnv(env = process.env) {
+    const port = parseField("PORT", env);
+    const dataDirRaw = parseField("DAEMORA_DATA_DIR", env);
+    const daemonMode = parseField("DAEMON_MODE", env);
+    const logLevel = parseField("LOG_LEVEL", env);
+    return {
+        port: port,
+        dataDir: dataDirRaw ?? defaultDataDir(),
+        daemonMode: daemonMode,
+        logLevel: logLevel,
+    };
+}
+function parseField(key, env) {
+    const def = envOnly[key];
+    const raw = env[String(key)];
+    const result = def.schema.safeParse(raw);
+    if (!result.success) {
+        throw new ConfigError(`Bad env var ${String(key)}: ${result.error.message}`);
+    }
+    return result.data;
+}
+/**
+ * Data dir resolution:
+ *   1. DAEMORA_DATA_DIR env (explicit override)
+ *   2. data/ in the project root (dev mode — like JS version)
+ *   3. OS-standard app dir (bundled desktop app)
+ */
+function defaultDataDir() {
+    // Dev mode: use data/ inside the project if it exists
+    const projectData = join(process.cwd(), "data");
+    if (existsSync(projectData))
+        return projectData;
+    // Bundled: OS-standard app data dir
+    const home = homedir();
+    switch (process.platform) {
+        case "darwin":
+            return join(home, "Library", "Application Support", "Daemora");
+        case "win32":
+            return join(process.env["APPDATA"] ?? join(home, "AppData", "Roaming"), "Daemora");
+        default:
+            return join(process.env["XDG_DATA_HOME"] ?? join(home, ".local", "share"), "daemora");
+    }
+}
+//# sourceMappingURL=env.js.map

package/dist/config/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAe,MAAM,aAAa,CAAC;AASnD,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,UAAU,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAE9C,OAAO;QACL,IAAI,EAAE,IAAc;QACpB,OAAO,EAAG,UAAiC,IAAI,cAAc,EAAE;QAC/D,UAAU,EAAE,UAAqB;QACjC,QAAQ,EAAE,QAA+B;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAmB,GAAM,EAAE,GAAsB;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,WAAW,CAAC,eAAe,MAAM,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc;IACrB,sDAAsD;IACtD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IAEhD,oCAAoC;IACpC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,CAAC,CAAC;QACjE,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;QACrF;YACE,OAAO,IAAI,CACT,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAC7D,SAAS,CACV,CAAC;IACN,CAAC;AACH,CAAC"}