onadit 0.0.1 → 1.0.0

package/dist/src/auth/middleware.js

@@ -0,0 +1,93 @@
+const EXEMPT_ROUTES = new Set([
+    "/health",
+    "/ready",
+    "/version",
+    // SwiftBar polls this on every tick. Response carries only call counts
+    // and tool names — no user content — so unauthenticated is safe and
+    // matches the /health, /version posture.
+    "/stats/mcp-usage",
+]);
+/**
+ * Read-only setup routes Onadit.app polls. They share the `/setup/<segment>`
+ * shape of the page path but carry user data, so they never take the page
+ * exemption and always need the scoped token. They are also exempt from the
+ * token's rate limit, like the other progress polls.
+ */
+const SETUP_API_READS = new Set([
+    "/setup/state",
+    "/setup/activity",
+    "/setup/memory",
+]);
+/**
+ * Register the bearer-token auth hook and per-token rate limiter.
+ *
+ * Auth is skipped for /health, /ready, /version, and /stats/mcp-usage
+ * (unauthenticated probes used by health/operator surfaces).
+ *
+ * Test-only bypass: when `NODE_ENV=test` AND `config.auth.test_token`
+ * is set AND the bearer matches it, the request is allowed without
+ * consulting the TokenManager. This is the ONLY way to bypass Keychain
+ * in tests — it is never active in production config.
+ *
+ * Rate limiting is skipped for `DELETE /auth/token` so a leaked token
+ * that has hit the rate-limit cap can still revoke itself.
+ */
+export function registerAuth(server, config, tokenManager, rateLimiter, setupSessions) {
+    server.addHook("onRequest", async (request, reply) => {
+        const path = request.url.split("?")[0];
+        if (EXEMPT_ROUTES.has(path))
+            return;
+        // The setup document contains no user data. Its unguessable path is
+        // minted by an authenticated CLI call and expires quickly. Every action
+        // the page performs still goes through the scoped token branch below.
+        if (request.method === "GET" &&
+            !SETUP_API_READS.has(path ?? "") &&
+            (path === "/setup" || /^\/setup\/[A-Za-z0-9_-]+$/.test(path ?? ""))) {
+            return;
+        }
+        const authHeader = request.headers.authorization;
+        if (!authHeader) {
+            return reply.code(401).send({ error: "missing_token" });
+        }
+        if (authHeader.startsWith("Rift-Setup ")) {
+            const setupToken = authHeader.slice("Rift-Setup ".length);
+            if (setupSessions?.authorize(setupToken, request.method, request.url) === true) {
+                // Progress polls are exempt. The setup page polls a job every 1.5s
+                // while an archive imports, so a large import spends its whole run
+                // against the shared per-token budget and a modest `max_requests`
+                // locks the owner out of their own setup half way through — the one
+                // moment the flow cannot recover from. The polls are trivial local
+                // reads on a 127.0.0.1 daemon behind a two-hour scoped token; the
+                // routes that actually cost something (ingest, search, connect,
+                // remove) stay metered.
+                const isProgressPoll = request.method === "GET" &&
+                    (/^\/jobs\/[^/]+$/.test(path ?? "") ||
+                        path === "/setup/remove/status" ||
+                        SETUP_API_READS.has(path ?? ""));
+                if (!isProgressPoll && !rateLimiter.check(setupToken)) {
+                    return reply.code(429).send({ error: "rate_limit_exceeded" });
+                }
+                return;
+            }
+            return reply.code(401).send({ error: "invalid_setup_token" });
+        }
+        if (!authHeader.startsWith("Bearer ")) {
+            return reply.code(401).send({ error: "missing_token" });
+        }
+        const token = authHeader.slice(7);
+        // Test-only bypass — double-gated.
+        const isTestBypass = process.env.NODE_ENV === "test" &&
+            config.auth.test_token !== undefined &&
+            token === config.auth.test_token;
+        if (!isTestBypass && (tokenManager === null || !tokenManager.validate(token))) {
+            return reply.code(401).send({ error: "invalid_token" });
+        }
+        // Rate limit — but exempt DELETE /auth/token so a leaked token
+        // that has already hit the cap can still revoke itself.
+        const isRateLimitExempt = path === "/auth/token" && request.method === "DELETE";
+        if (!isRateLimitExempt && !rateLimiter.check(token)) {
+            return reply.code(429).send({ error: "rate_limit_exceeded" });
+        }
+    });
+}
+//# sourceMappingURL=middleware.js.map

package/dist/src/auth/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/auth/middleware.ts"],"names":[],"mappings":"AAMA,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,SAAS;IACT,QAAQ;IACR,UAAU;IACV,uEAAuE;IACvE,oEAAoE;IACpE,yCAAyC;IACzC,kBAAkB;CACnB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,cAAc;IACd,iBAAiB;IACjB,eAAe;CAChB,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAuB,EACvB,MAAc,EACd,YAAiC,EACjC,WAAwB,EACxB,aAAmC;IAEnC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAK,CAAC;YAAE,OAAO;QAErC,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,IACE,OAAO,CAAC,MAAM,KAAK,KAAK;YACxB,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAChC,CAAC,IAAI,KAAK,QAAQ,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EACnE,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC1D,IACE,aAAa,EAAE,SAAS,CACtB,UAAU,EACV,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,GAAG,CACZ,KAAK,IAAI,EACV,CAAC;gBACD,mEAAmE;gBACnE,mEAAmE;gBACnE,kEAAkE;gBAClE,oEAAoE;gBACpE,mEAAmE;gBACnE,kEAAkE;gBAClE,gEAAgE;gBAChE,wBAAwB;gBACxB,MAAM,cAAc,GAClB,OAAO,CAAC,MAAM,KAAK,KAAK;oBACxB,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;wBACjC,IAAI,KAAK,sBAAsB;wBAC/B,eAAe,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;gBACrC,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;oBACtD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBAChE,CAAC;gBACD,OAAO;YACT,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAElC,mCAAmC;QACnC,MAAM,YAAY,GAChB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;YAC/B,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS;YACpC,KAAK,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QAEnC,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,+DAA+D;QAC/D,wDAAwD;QACxD,MAAM,iBAAiB,GACrB,IAAI,KAAK,aAAa,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC;QACxD,IAAI,CAAC,iBAAiB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/auth/rate-limit.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Per-token sliding-window rate limiter.
+ *
+ * Tracks request timestamps per token. On each call to `check()`,
+ * expired entries are pruned and the count is compared to the limit.
+ */
+export declare class RateLimiter {
+    private windowMs;
+    private maxRequests;
+    private windows;
+    constructor(windowMs: number, maxRequests: number);
+    /** Returns `true` if the request is allowed, `false` if rate-limited. */
+    check(token: string): boolean;
+    reset(): void;
+}
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/src/auth/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/auth/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,qBAAa,WAAW;IAIpB,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,WAAW;IAJrB,OAAO,CAAC,OAAO,CAA+B;gBAGpC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM;IAG7B,yEAAyE;IACzE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAuB7B,KAAK,IAAI,IAAI;CAGd"}

package/dist/src/auth/rate-limit.js

@@ -0,0 +1,38 @@
+/**
+ * Per-token sliding-window rate limiter.
+ *
+ * Tracks request timestamps per token. On each call to `check()`,
+ * expired entries are pruned and the count is compared to the limit.
+ */
+export class RateLimiter {
+    windowMs;
+    maxRequests;
+    windows = new Map();
+    constructor(windowMs, maxRequests) {
+        this.windowMs = windowMs;
+        this.maxRequests = maxRequests;
+    }
+    /** Returns `true` if the request is allowed, `false` if rate-limited. */
+    check(token) {
+        const now = Date.now();
+        const cutoff = now - this.windowMs;
+        let timestamps = this.windows.get(token);
+        if (!timestamps) {
+            timestamps = [];
+            this.windows.set(token, timestamps);
+        }
+        // Prune expired entries from the front.
+        while (timestamps.length > 0 && timestamps[0] < cutoff) {
+            timestamps.shift();
+        }
+        if (timestamps.length >= this.maxRequests) {
+            return false;
+        }
+        timestamps.push(now);
+        return true;
+    }
+    reset() {
+        this.windows.clear();
+    }
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/src/auth/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/auth/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IAIZ;IACA;IAJF,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE9C,YACU,QAAgB,EAChB,WAAmB;QADnB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,gBAAW,GAAX,WAAW,CAAQ;IAC1B,CAAC;IAEJ,yEAAyE;IACzE,KAAK,CAAC,KAAa;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;QAEnC,IAAI,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,UAAU,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACtC,CAAC;QAED,wCAAwC;QACxC,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,CAAC,CAAE,GAAG,MAAM,EAAE,CAAC;YACxD,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/dist/src/auth/rotation.d.ts

@@ -0,0 +1,67 @@
+import type { KeychainOps } from "./keychain.js";
+/**
+ * In-memory token state machine backed by a KeychainOps provider.
+ *
+ * Invariants:
+ * - At most 2 tokens are valid at once: current + grace (previous).
+ * - Grace expires after `gracePeriodMs` (default 60 s).
+ * - `load()` restores only the current version — no grace for old
+ *   tokens on daemon restart (PRD: timer does not survive restart).
+ * - `revokeAll()` immediately invalidates everything and deletes
+ *   ALL Keychain entries (versions 1..current) so revoked tokens
+ *   don't resurface on restart and old secrets don't accumulate.
+ * - `issue()` eagerly deletes any superseded grace version from
+ *   Keychain before setting up new grace, so rapid rotation
+ *   (v1→v2→v3 within one grace window) never leaves old secrets.
+ *   The latest grace version is cleaned up when its timer fires.
+ */
+export declare class TokenManager {
+    private keychain;
+    private gracePeriodMs;
+    private currentVersion;
+    private currentToken;
+    private graceToken;
+    private graceVersion;
+    private graceTimer;
+    constructor(keychain: KeychainOps, gracePeriodMs?: number);
+    /**
+     * Cold-load: restore the current token from keychain with no grace.
+     * Used at daemon startup — PRD: grace timer does not survive restart.
+     */
+    load(): Promise<void>;
+    /**
+     * Hot-reload: pick up a new token from keychain (e.g. after CLI
+     * issues a token and sends SIGHUP).
+     *
+     * When `noGrace` is false (default), the old token enters a 60 s
+     * grace window. When `noGrace` is true, the old token is immediately
+     * invalidated and its Keychain entry deleted — used by `token issue`
+     * to enforce single-active-credential semantics (PRD: "makes it the
+     * sole active token").
+     *
+     * If the version hasn't changed, just refreshes the current value.
+     */
+    reload(opts?: {
+        noGrace?: boolean;
+    }): Promise<void>;
+    /** Check if a token is currently valid (current or within grace). */
+    validate(token: string): boolean;
+    /** Issue a new token. Returns the new version number. */
+    issue(newToken: string): Promise<number>;
+    /**
+     * Immediately revoke all tokens. No grace period.
+     *
+     * Clears in-memory state first (immediate effect for the running
+     * daemon), then deletes ALL Keychain entries (versions 1..current)
+     * so revoked tokens cannot resurface on restart.
+     *
+     * Keychain delete errors propagate — the caller (route handler)
+     * should surface them so the operator knows cleanup may be incomplete.
+     */
+    revokeAll(): Promise<void>;
+    /** Clean up timers. Call on daemon shutdown. */
+    shutdown(): void;
+    private clearGraceTimer;
+    private clearGrace;
+}
+//# sourceMappingURL=rotation.d.ts.map

package/dist/src/auth/rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation.d.ts","sourceRoot":"","sources":["../../../src/auth/rotation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,YAAY;IAQrB,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,aAAa;IARvB,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,UAAU,CAA8C;gBAGtD,QAAQ,EAAE,WAAW,EACrB,aAAa,SAAS;IAGhC;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAS3B;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAoEzD,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAMhC,yDAAyD;IACnD,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA6C9C;;;;;;;;;OASG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAWhC,gDAAgD;IAChD,QAAQ,IAAI,IAAI;IAIhB,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,UAAU;CAKnB"}

package/dist/src/auth/rotation.js

@@ -0,0 +1,190 @@
+/**
+ * In-memory token state machine backed by a KeychainOps provider.
+ *
+ * Invariants:
+ * - At most 2 tokens are valid at once: current + grace (previous).
+ * - Grace expires after `gracePeriodMs` (default 60 s).
+ * - `load()` restores only the current version — no grace for old
+ *   tokens on daemon restart (PRD: timer does not survive restart).
+ * - `revokeAll()` immediately invalidates everything and deletes
+ *   ALL Keychain entries (versions 1..current) so revoked tokens
+ *   don't resurface on restart and old secrets don't accumulate.
+ * - `issue()` eagerly deletes any superseded grace version from
+ *   Keychain before setting up new grace, so rapid rotation
+ *   (v1→v2→v3 within one grace window) never leaves old secrets.
+ *   The latest grace version is cleaned up when its timer fires.
+ */
+export class TokenManager {
+    keychain;
+    gracePeriodMs;
+    currentVersion = 0;
+    currentToken = null;
+    graceToken = null;
+    graceVersion = 0;
+    graceTimer = null;
+    constructor(keychain, gracePeriodMs = 60_000) {
+        this.keychain = keychain;
+        this.gracePeriodMs = gracePeriodMs;
+    }
+    /**
+     * Cold-load: restore the current token from keychain with no grace.
+     * Used at daemon startup — PRD: grace timer does not survive restart.
+     */
+    async load() {
+        this.clearGrace();
+        this.currentVersion = await this.keychain.findLatestVersion();
+        this.currentToken =
+            this.currentVersion > 0
+                ? await this.keychain.read(this.currentVersion)
+                : null;
+    }
+    /**
+     * Hot-reload: pick up a new token from keychain (e.g. after CLI
+     * issues a token and sends SIGHUP).
+     *
+     * When `noGrace` is false (default), the old token enters a 60 s
+     * grace window. When `noGrace` is true, the old token is immediately
+     * invalidated and its Keychain entry deleted — used by `token issue`
+     * to enforce single-active-credential semantics (PRD: "makes it the
+     * sole active token").
+     *
+     * If the version hasn't changed, just refreshes the current value.
+     */
+    async reload(opts) {
+        const noGrace = opts?.noGrace ?? false;
+        const prevToken = this.currentToken;
+        const prevVersion = this.currentVersion;
+        const latestVersion = await this.keychain.findLatestVersion();
+        const latestToken = latestVersion > 0 ? await this.keychain.read(latestVersion) : null;
+        if (latestVersion === prevVersion) {
+            // Same version — just refresh the value (covers manual Keychain edit).
+            this.currentToken = latestToken;
+            return;
+        }
+        // Version changed — handle the outgoing token.
+        if (prevToken !== null) {
+            // Clean up any existing grace entry before replacing it.
+            if (this.graceVersion > 0) {
+                try {
+                    await this.keychain.delete(this.graceVersion);
+                }
+                catch (err) {
+                    process.stderr.write(`Warning: failed to clean up token v${this.graceVersion} from Keychain: ${err instanceof Error ? err.message : String(err)}\n`);
+                }
+            }
+            this.clearGraceTimer();
+            if (noGrace) {
+                // Immediate invalidation: no grace window, delete old entry now.
+                this.graceToken = null;
+                this.graceVersion = 0;
+                if (prevVersion > 0) {
+                    try {
+                        await this.keychain.delete(prevVersion);
+                    }
+                    catch (err) {
+                        process.stderr.write(`Warning: failed to clean up token v${prevVersion} from Keychain: ${err instanceof Error ? err.message : String(err)}\n`);
+                    }
+                }
+            }
+            else {
+                // Grace period: old token valid for gracePeriodMs.
+                this.graceToken = prevToken;
+                this.graceVersion = prevVersion;
+                const vToDelete = prevVersion;
+                this.graceTimer = setTimeout(() => {
+                    this.graceToken = null;
+                    this.graceTimer = null;
+                    this.graceVersion = 0;
+                    if (vToDelete > 0) {
+                        this.keychain.delete(vToDelete).catch((err) => {
+                            process.stderr.write(`Warning: failed to clean up token v${vToDelete} from Keychain: ${err instanceof Error ? err.message : String(err)}\n`);
+                        });
+                    }
+                }, this.gracePeriodMs);
+            }
+        }
+        this.currentVersion = latestVersion;
+        this.currentToken = latestToken;
+    }
+    /** Check if a token is currently valid (current or within grace). */
+    validate(token) {
+        if (this.currentToken !== null && token === this.currentToken)
+            return true;
+        if (this.graceToken !== null && token === this.graceToken)
+            return true;
+        return false;
+    }
+    /** Issue a new token. Returns the new version number. */
+    async issue(newToken) {
+        const previousVersion = this.currentVersion;
+        const newVersion = this.currentVersion + 1;
+        await this.keychain.write(newVersion, newToken);
+        // Start grace period for the outgoing token.
+        if (this.currentToken !== null) {
+            // If there's an existing grace token being superseded by this
+            // rotation, eagerly delete its Keychain entry now — it is no
+            // longer valid in memory and must not linger in the vault.
+            if (this.graceVersion > 0) {
+                try {
+                    await this.keychain.delete(this.graceVersion);
+                }
+                catch (err) {
+                    process.stderr.write(`Warning: failed to clean up token v${this.graceVersion} from Keychain: ${err instanceof Error ? err.message : String(err)}\n`);
+                }
+            }
+            this.clearGraceTimer();
+            this.graceToken = this.currentToken;
+            this.graceVersion = previousVersion;
+            // Timer cleans up THIS grace token's Keychain entry when it expires.
+            const vToDelete = previousVersion;
+            this.graceTimer = setTimeout(() => {
+                this.graceToken = null;
+                this.graceTimer = null;
+                this.graceVersion = 0;
+                if (vToDelete > 0) {
+                    this.keychain.delete(vToDelete).catch((err) => {
+                        process.stderr.write(`Warning: failed to clean up token v${vToDelete} from Keychain: ${err instanceof Error ? err.message : String(err)}\n`);
+                    });
+                }
+            }, this.gracePeriodMs);
+        }
+        this.currentVersion = newVersion;
+        this.currentToken = newToken;
+        return newVersion;
+    }
+    /**
+     * Immediately revoke all tokens. No grace period.
+     *
+     * Clears in-memory state first (immediate effect for the running
+     * daemon), then deletes ALL Keychain entries (versions 1..current)
+     * so revoked tokens cannot resurface on restart.
+     *
+     * Keychain delete errors propagate — the caller (route handler)
+     * should surface them so the operator knows cleanup may be incomplete.
+     */
+    async revokeAll() {
+        this.clearGrace();
+        this.currentToken = null;
+        const deletions = [];
+        for (let v = 1; v <= this.currentVersion; v++) {
+            deletions.push(this.keychain.delete(v));
+        }
+        await Promise.all(deletions);
+    }
+    /** Clean up timers. Call on daemon shutdown. */
+    shutdown() {
+        this.clearGrace();
+    }
+    clearGraceTimer() {
+        if (this.graceTimer !== null) {
+            clearTimeout(this.graceTimer);
+            this.graceTimer = null;
+        }
+    }
+    clearGrace() {
+        this.clearGraceTimer();
+        this.graceToken = null;
+        this.graceVersion = 0;
+    }
+}
+//# sourceMappingURL=rotation.js.map

package/dist/src/auth/rotation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation.js","sourceRoot":"","sources":["../../../src/auth/rotation.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,YAAY;IAQb;IACA;IARF,cAAc,GAAG,CAAC,CAAC;IACnB,YAAY,GAAkB,IAAI,CAAC;IACnC,UAAU,GAAkB,IAAI,CAAC;IACjC,YAAY,GAAG,CAAC,CAAC;IACjB,UAAU,GAAyC,IAAI,CAAC;IAEhE,YACU,QAAqB,EACrB,gBAAgB,MAAM;QADtB,aAAQ,GAAR,QAAQ,CAAa;QACrB,kBAAa,GAAb,aAAa,CAAS;IAC7B,CAAC;IAEJ;;;OAGG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,cAAc,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC9D,IAAI,CAAC,YAAY;YACf,IAAI,CAAC,cAAc,GAAG,CAAC;gBACrB,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;gBAC/C,CAAC,CAAC,IAAI,CAAC;IACb,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,MAAM,CAAC,IAA4B;QACvC,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,KAAK,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC;QAExC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC9D,MAAM,WAAW,GACf,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAErE,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;YAClC,uEAAuE;YACvE,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;YAChC,OAAO;QACT,CAAC;QAED,+CAA+C;QAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,yDAAyD;YACzD,IAAI,IAAI,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAChD,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,IAAI,CAAC,YAAY,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC/H,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,CAAC,eAAe,EAAE,CAAC;YAEvB,IAAI,OAAO,EAAE,CAAC;gBACZ,iEAAiE;gBACjE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBACvB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;gBACtB,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;oBACpB,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;oBAC1C,CAAC;oBAAC,OAAO,GAAY,EAAE,CAAC;wBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,WAAW,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACzH,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,mDAAmD;gBACnD,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;gBAC5B,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;gBAEhC,MAAM,SAAS,GAAG,WAAW,CAAC;gBAC9B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;oBAChC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;oBACvB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;oBACvB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;oBACtB,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;wBAClB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;4BACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,SAAS,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACvH,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IAClC,CAAC;IAED,qEAAqE;IACrE,QAAQ,CAAC,KAAa;QACpB,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAC3E,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,KAAK,CAAC,QAAgB;QAC1B,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEhD,6CAA6C;QAC7C,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC/B,8DAA8D;YAC9D,6DAA6D;YAC7D,2DAA2D;YAC3D,IAAI,IAAI,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAChD,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,IAAI,CAAC,YAAY,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC/H,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC;YACpC,IAAI,CAAC,YAAY,GAAG,eAAe,CAAC;YAEpC,qEAAqE;YACrE,MAAM,SAAS,GAAG,eAAe,CAAC;YAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;gBAChC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBACvB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBACvB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;gBACtB,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;oBAClB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;wBACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,SAAS,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACvH,CAAC;oBACJ,CAAC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC;QAC7B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAEzB,MAAM,SAAS,GAAoB,EAAE,CAAC;QACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IAED,gDAAgD;IAChD,QAAQ;QACN,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAEO,eAAe;QACrB,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC7B,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;IACxB,CAAC;CACF"}

package/dist/src/backfill/project-context-batch-constructor.d.ts

@@ -0,0 +1,127 @@
+export interface ProjectContextCandidate {
+    conversation_id: string;
+    title: string;
+    source_file: string;
+    confidence: number;
+    reason: string;
+    project_hint: string | null;
+    personal_hint: string | null;
+    family: string;
+    recommended_lane: string;
+    source_family: string;
+}
+export interface ManualBatchPick {
+    conversation_id: string;
+    stricter_memory_qualification: string;
+}
+export interface ExistingSeedReference {
+    batch_name: string;
+    seed_path: string;
+    conversation_id: string;
+}
+export interface IngestedConversationReference {
+    conversation_id: string;
+    raw_path: string;
+}
+export interface OversizeConversationReference {
+    conversation_id: string;
+}
+export interface ConstructorContext {
+    candidatesById: Map<string, ProjectContextCandidate>;
+    existingSeedsById: Map<string, ExistingSeedReference[]>;
+    ingestedById: Map<string, IngestedConversationReference>;
+    oversizeById: Map<string, OversizeConversationReference>;
+}
+export type ExclusionReasonCode = "missing_candidate" | "wrong_source_family" | "wrong_family" | "wrong_lane" | "oversize_holdout" | "already_staged" | "already_ingested";
+export interface ExclusionReason {
+    code: ExclusionReasonCode;
+    detail: string;
+}
+export interface ConstructorDecision {
+    conversation_id: string;
+    accepted: boolean;
+    candidate?: ProjectContextCandidate;
+    reasons: ExclusionReason[];
+}
+export interface AcceptedSeedConversation {
+    conversation_id: string;
+    title: string;
+    source_file: string;
+    confidence: number;
+    lane: string;
+    reason: string;
+    project_hint: string | null;
+    personal_hint: string | null;
+    family: string;
+    stricter_memory_qualification: string;
+    staged_file: string;
+}
+export interface SeedFilePayload {
+    generated_at: string;
+    recommended_batch_name: string;
+    family: "project_context";
+    source_family: "chatgpt";
+    selection_basis: string;
+    constructor_policy: {
+        ingest_aware: true;
+        already_ingested_source: string;
+        staged_dedupe_source: string;
+        oversize_holdout_source: string;
+    };
+    stricter_project_memory_rule_applied: true;
+    oversize_exclusions_applied: true;
+    oversize_threshold_bytes: number;
+    conversation_count: number;
+    source_of_truth_for_next_run: true;
+    explicitly_rejected_patterns: string[];
+    seed_conversations: AcceptedSeedConversation[];
+}
+export interface VerificationReport {
+    generated_at: string;
+    constructor_policy: SeedFilePayload["constructor_policy"];
+    verified_seed_path: string;
+    verified_seed_batch: string;
+    verified_seed_total: number;
+    verified_seed_excluded_count: number;
+    verified_seed_decisions: ConstructorDecision[];
+    fresh_candidate_pool_count: number;
+    staged_reservations_count: number;
+    ingested_conversation_count: number;
+    oversize_holdout_count: number;
+    requested_batch_name: string;
+    requested_pick_count: number;
+    accepted_pick_count: number;
+    rejected_pick_count: number;
+    requested_pick_decisions: ConstructorDecision[];
+}
+export declare function slugifyForFile(value: string): string;
+export declare function loadProjectContextCandidates(nextBatchCandidatesPath: string): Map<string, ProjectContextCandidate>;
+export declare function loadExistingSeedReferences(seedPaths: string[]): Map<string, ExistingSeedReference[]>;
+export declare function loadIngestedConversationReferences(rawConversationDir: string): Map<string, IngestedConversationReference>;
+export declare function loadOversizeConversationReferences(oversizeHoldoutPath: string): Map<string, OversizeConversationReference>;
+export declare function evaluateConversation(conversationId: string, context: ConstructorContext): ConstructorDecision;
+export declare function buildFreshPool(context: ConstructorContext): ProjectContextCandidate[];
+export declare function buildAcceptedSeedConversations(params: {
+    requestedBatchName: string;
+    picks: ManualBatchPick[];
+    decisions: ConstructorDecision[];
+    dataImportsDir?: string;
+}): AcceptedSeedConversation[];
+export declare function buildSeedPayload(params: {
+    generatedAt: string;
+    requestedBatchName: string;
+    selectionBasis: string;
+    explicitlyRejectedPatterns: string[];
+    acceptedSeedConversations: AcceptedSeedConversation[];
+}): SeedFilePayload;
+export declare function buildVerificationReport(params: {
+    generatedAt: string;
+    context: ConstructorContext;
+    verifiedSeedPath: string;
+    verifiedSeedBatch: string;
+    verifiedSeedDecisions: ConstructorDecision[];
+    requestedBatchName: string;
+    requestedPickDecisions: ConstructorDecision[];
+}): VerificationReport;
+export declare function extractConversationObject(sourceFile: string, conversationId: string): Record<string, unknown>;
+//# sourceMappingURL=project-context-batch-constructor.d.ts.map

package/dist/src/backfill/project-context-batch-constructor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-context-batch-constructor.d.ts","sourceRoot":"","sources":["../../../src/backfill/project-context-batch-constructor.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,6BAA6B,EAAE,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,6BAA6B;IAC5C,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,6BAA6B;IAC5C,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACrD,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACxD,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;IACzD,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;CAC1D;AAED,MAAM,MAAM,mBAAmB,GAC3B,mBAAmB,GACnB,qBAAqB,GACrB,cAAc,GACd,YAAY,GACZ,kBAAkB,GAClB,gBAAgB,GAChB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC,OAAO,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,6BAA6B,EAAE,MAAM,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,aAAa,EAAE,SAAS,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE;QAClB,YAAY,EAAE,IAAI,CAAC;QACnB,uBAAuB,EAAE,MAAM,CAAC;QAChC,oBAAoB,EAAE,MAAM,CAAC;QAC7B,uBAAuB,EAAE,MAAM,CAAC;KACjC,CAAC;IACF,oCAAoC,EAAE,IAAI,CAAC;IAC3C,2BAA2B,EAAE,IAAI,CAAC;IAClC,wBAAwB,EAAE,MAAM,CAAC;IACjC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,4BAA4B,EAAE,IAAI,CAAC;IACnC,4BAA4B,EAAE,MAAM,EAAE,CAAC;IACvC,kBAAkB,EAAE,wBAAwB,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC;IAC1D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,4BAA4B,EAAE,MAAM,CAAC;IACrC,uBAAuB,EAAE,mBAAmB,EAAE,CAAC;IAC/C,0BAA0B,EAAE,MAAM,CAAC;IACnC,yBAAyB,EAAE,MAAM,CAAC;IAClC,2BAA2B,EAAE,MAAM,CAAC;IACpC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wBAAwB,EAAE,mBAAmB,EAAE,CAAC;CACjD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CASpD;AAED,wBAAgB,4BAA4B,CAAC,uBAAuB,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAiBlH;AAED,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAqBpG;AAED,wBAAgB,kCAAkC,CAAC,kBAAkB,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAkBzH;AAED,wBAAgB,kCAAkC,CAAC,mBAAmB,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAU1H;AAED,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,kBAAkB,GAC1B,mBAAmB,CA+DrB;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,kBAAkB,GAC1B,uBAAuB,EAAE,CAO3B;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,wBAAwB,EAAE,CAiC7B;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,0BAA0B,EAAE,MAAM,EAAE,CAAC;IACrC,yBAAyB,EAAE,wBAAwB,EAAE,CAAC;CACvD,GAAG,eAAe,CAqBlB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,mBAAmB,EAAE,CAAC;IAC7C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,mBAAmB,EAAE,CAAC;CAC/C,GAAG,kBAAkB,CAyBrB;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB"}