studiograph 1.3.48-next.13 → 1.3.48-next.130

package/dist/core/secrets/SqliteEncryptedStore.js

@@ -0,0 +1,581 @@
+/**
+ * SqliteEncryptedStore — concrete SecretStore + SettingsStore on
+ * better-sqlite3.
+ *
+ * Lives at /workspace/secrets.db on Railway, ~/.studiograph/secrets.db
+ * locally. File mode 0600 enforced after open. The audit table lives in
+ * the same DB so cross-table operations stay atomic.
+ *
+ * After the scope-collapse refactor, the schema has no `scope` /
+ * `scope_id` columns — Studiograph is single-workspace-per-process, so
+ * each key has at most one row. Existing populated databases (with the
+ * old `(scope, scope_id, key)` shape) are migrated transparently on
+ * first construction via `migrateScopeCollapse()`.
+ *
+ * AAD binding for encrypted rows keeps the four-tuple `AADInput` shape so
+ * the shared encryption module continues to serve auth.db (which uses
+ * different `scope: 'user'` AAD per user). Inside this store every row
+ * binds AAD with the constant `scope: 'workspace'`, `scopeId: ''` —
+ * cosmetic-only after the migration since each row is also uniquely
+ * keyed by `(key)`.
+ */
+import Database from 'better-sqlite3';
+import { chmodSync, closeSync, copyFileSync, openSync } from 'fs';
+import { encrypt, decrypt } from './encryption.js';
+import { getKeyDef } from './registry.js';
+import { AuditLogger } from './audit.js';
+const SCHEMA_VERSION = '2';
+const DEFAULT_KEY_VERSION = 'mk_v1';
+/**
+ * Constant AAD components written for every row in this store. Kept as a
+ * literal so the AADInput type doesn't need a different shape from
+ * auth-db-migration's `'user'`-scoped calls.
+ */
+const STORE_AAD_SCOPE = 'workspace';
+const STORE_AAD_SCOPE_ID = '';
+export class SqliteEncryptedStore {
+    db;
+    masterKey;
+    keyVersion;
+    previousMasterKey;
+    previousKeyVersion;
+    audit;
+    constructor(opts) {
+        // L1: pre-create the DB file with restrictive mode BEFORE handing the
+        // path to better-sqlite3. The previous flow was
+        //   new Database(opts.dbPath)        // creates with default umask (0644)
+        //   chmodSync(opts.dbPath, 0o600)    // tightens after the fact
+        // which left a window in which a co-located process could open the
+        // file with relaxed permissions. `openSync(..., 'wx', 0o600)` is the
+        // primary protection — fails if the file already exists, in which
+        // case we leave it alone (it already exists from a previous start;
+        // the chmod below is defense-in-depth in case its mode drifted).
+        if (process.platform !== 'win32') {
+            try {
+                const fd = openSync(opts.dbPath, 'wx', 0o600);
+                closeSync(fd);
+            }
+            catch (err) {
+                // ENOENT (parent dir missing) is a real error; rethrow.
+                // EEXIST means the file is already there — fall through to the
+                // defense-in-depth chmod below.
+                if (err.code !== 'EEXIST')
+                    throw err;
+            }
+        }
+        this.db = new Database(opts.dbPath);
+        if (process.platform !== 'win32') {
+            try {
+                chmodSync(opts.dbPath, 0o600);
+            }
+            catch { /* non-fatal */ }
+        }
+        this.db.pragma('journal_mode = WAL');
+        this.db.pragma('foreign_keys = ON');
+        this.masterKey = opts.masterKey;
+        this.keyVersion = opts.keyVersion ?? DEFAULT_KEY_VERSION;
+        this.previousMasterKey = opts.previousMasterKey;
+        this.previousKeyVersion = opts.previousKeyVersion;
+        this.initSchema();
+        this.audit = new AuditLogger(this.db);
+        // One-shot migration: collapse legacy (scope, scope_id, key)-keyed
+        // tables into the single-tier shape. Idempotent — re-running after
+        // success is a no-op via meta.scope_collapse_migrated_at.
+        this.migrateScopeCollapse(opts.dbPath);
+    }
+    initSchema() {
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS settings (
+        key TEXT NOT NULL PRIMARY KEY,
+        value_json TEXT NOT NULL,
+        updated_at INTEGER NOT NULL,
+        updated_by TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS secrets (
+        key TEXT NOT NULL PRIMARY KEY,
+        ciphertext TEXT NOT NULL,
+        key_version TEXT NOT NULL,
+        label TEXT,
+        provider TEXT,
+        last_tested_at INTEGER,
+        last_test_result TEXT,
+        updated_at INTEGER NOT NULL,
+        updated_by TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS meta (
+        key TEXT PRIMARY KEY,
+        value TEXT NOT NULL
+      );
+    `);
+        // Defensive cleanup of the legacy `last_rotated_at` column. The rotate
+        // feature was removed; existing DBs created before the removal still
+        // carry the column even though no code references it. SQLite 3.35+
+        // supports ALTER TABLE DROP COLUMN; the try/catch handles fresh DBs
+        // (column never existed) and any future re-runs.
+        try {
+            this.db.exec('ALTER TABLE secrets DROP COLUMN last_rotated_at');
+        }
+        catch { /* already absent */ }
+        // Schema version metadata. Idempotent insert.
+        this.db.prepare('INSERT OR IGNORE INTO meta (key, value) VALUES (?, ?)').run('schema_version', SCHEMA_VERSION);
+        this.db.prepare('INSERT OR IGNORE INTO meta (key, value) VALUES (?, ?)').run('master_key_version', this.keyVersion);
+    }
+    /**
+     * One-shot migration: collapse the legacy `(scope, scope_id, key)` tables
+     * into the single-tier shape. Steps:
+     *
+     *   1. Detect legacy shape by querying `PRAGMA table_info` for the
+     *      `scope` column on settings or secrets.
+     *   2. Back up secrets.db → secrets.db.backup.<ts> with mode 0o600.
+     *   3. For each legacy row in `secrets`, decrypt with its original AAD
+     *      (4-tuple including the row's scope+scope_id), re-encrypt under
+     *      the new constant AAD, INSERT into the new table. Drop the old.
+     *   4. For `settings`, INSERT...SELECT keeping just `key`/`value_json`/
+     *      timestamps. Duplicate keys across scopes would collide; assert
+     *      none before commit.
+     *   5. For `audit_log`, ALTER TABLE DROP COLUMN scope/scope_id. SQLite
+     *      3.35+ supports this directly; PK is auto-increment so no rebuild.
+     *   6. Mark `meta.scope_collapse_migrated_at`. Re-running is a no-op.
+     *
+     * Failure modes: per-row decrypt failures during step 3 are logged as
+     * decrypt_fail audit rows and the row is skipped. The transaction
+     * still commits — the alternative is refusing to start when one
+     * historical row got out of sync, which is worse than dropping a key
+     * that already couldn't decrypt.
+     */
+    migrateScopeCollapse(dbPath) {
+        const already = this.db
+            .prepare("SELECT value FROM meta WHERE key='scope_collapse_migrated_at'")
+            .get();
+        if (already?.value)
+            return;
+        // Detect legacy shape — old table has a `scope` column.
+        const settingsCols = this.db.prepare('PRAGMA table_info(settings)').all();
+        const secretsCols = this.db.prepare('PRAGMA table_info(secrets)').all();
+        const auditCols = this.db.prepare('PRAGMA table_info(audit_log)').all();
+        const settingsLegacy = settingsCols.some((c) => c.name === 'scope');
+        const secretsLegacy = secretsCols.some((c) => c.name === 'scope');
+        const auditLegacy = auditCols.some((c) => c.name === 'scope') || auditCols.some((c) => c.name === 'scope_id');
+        if (!settingsLegacy && !secretsLegacy && !auditLegacy) {
+            // Fresh DB created with the post-collapse schema — nothing to do.
+            this.db.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES ('scope_collapse_migrated_at', ?)").run(String(Date.now()));
+            return;
+        }
+        // Backup before destructive rebuild. We deliberately do this OUTSIDE
+        // any transaction — copy-on-write semantics on Node's copyFileSync
+        // give us a snapshot of the on-disk pages.
+        //
+        // Checkpoint the WAL into the .db BEFORE the copy so the backup is a
+        // complete restorable snapshot. Without this, rows still in the .wal
+        // sidecar would be missing from the backup (the .wal is intentionally
+        // NOT copied alongside — its existence with a stale .db would confuse
+        // a restore). Operators restore by copying the backup over the live
+        // file with the server shut down.
+        try {
+            this.db.pragma('wal_checkpoint(FULL)');
+        }
+        catch { /* non-fatal — best-effort flush */ }
+        const backupPath = `${dbPath}.backup.${Date.now()}`;
+        try {
+            copyFileSync(dbPath, backupPath);
+            if (process.platform !== 'win32') {
+                try {
+                    chmodSync(backupPath, 0o600);
+                }
+                catch { /* non-fatal */ }
+            }
+        }
+        catch (err) {
+            // If we can't take a backup, refuse to migrate — the operator
+            // gets a clear error instead of a clobbered DB. The flag stays
+            // unset so the next boot retries.
+            throw new Error(`[secrets] scope-collapse migration: failed to take backup at ${backupPath}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        // Read legacy rows BEFORE rebuilding so we can re-encrypt secrets.
+        // The legacy `last_rotated_at` column (if present) is read but
+        // discarded — the rotate feature was removed.
+        const legacySecrets = secretsLegacy
+            ? this.db.prepare('SELECT * FROM secrets').all()
+            : [];
+        const legacySettings = settingsLegacy
+            ? this.db.prepare('SELECT * FROM settings').all()
+            : [];
+        // Pre-flight: assert no duplicate keys across scopes (would collide
+        // on the new PK). All known data lived at scope='instance'|'workspace'
+        // with scopeId='', so the same key in both scopes should be
+        // vanishingly rare — but assert to fail loud rather than silently
+        // drop one row.
+        const dupeSecrets = new Set();
+        const seenSecrets = new Set();
+        for (const r of legacySecrets) {
+            if (seenSecrets.has(r.key))
+                dupeSecrets.add(r.key);
+            seenSecrets.add(r.key);
+        }
+        const dupeSettings = new Set();
+        const seenSettings = new Set();
+        for (const r of legacySettings) {
+            if (seenSettings.has(r.key))
+                dupeSettings.add(r.key);
+            seenSettings.add(r.key);
+        }
+        if (dupeSecrets.size > 0 || dupeSettings.size > 0) {
+            throw new Error(`[secrets] scope-collapse migration: duplicate keys across scopes detected (secrets: [${[...dupeSecrets].join(', ')}], settings: [${[...dupeSettings].join(', ')}]). Backup at ${backupPath}. Resolve by manual SQL before retrying.`);
+        }
+        // Decrypt every legacy secret under its original AAD up front. If
+        // any fails, log decrypt_fail and drop — but keep going. After all
+        // rows are decrypted (or dropped), rebuild the tables in one
+        // transaction.
+        const reencrypted = [];
+        for (const r of legacySecrets) {
+            const oldCtx = {
+                scope: r.scope,
+                scopeId: r.scope_id,
+                key: r.key,
+                keyVersion: r.key_version,
+            };
+            const encRow = { ciphertext: r.ciphertext, keyVersion: r.key_version };
+            let plaintext;
+            try {
+                if (r.key_version === this.keyVersion) {
+                    plaintext = decrypt(this.masterKey, encRow, oldCtx);
+                }
+                else if (this.previousMasterKey && r.key_version === this.previousKeyVersion) {
+                    plaintext = decrypt(this.previousMasterKey, encRow, oldCtx);
+                }
+                else {
+                    plaintext = decrypt(this.masterKey, encRow, oldCtx);
+                }
+            }
+            catch (err) {
+                // Log + skip — the row was already undecryptable before the
+                // migration, and we shouldn't fail the whole boot for one bad
+                // row. The audit logger uses the legacy 4-arg signature (scope
+                // + scope_id columns exist on audit_log right now).
+                this.audit.write({
+                    action: 'decrypt_fail',
+                    actor: { type: 'system', systemId: 'scope-collapse-migration' },
+                    scope: r.scope,
+                    scope_id: r.scope_id,
+                    key: r.key,
+                    success: false,
+                    detail: { keyVersion: r.key_version, error: err instanceof Error ? err.message : String(err) },
+                });
+                continue;
+            }
+            // Re-encrypt under the new constant AAD.
+            const newCtx = {
+                scope: STORE_AAD_SCOPE,
+                scopeId: STORE_AAD_SCOPE_ID,
+                key: r.key,
+                keyVersion: this.keyVersion,
+            };
+            const fresh = encrypt(this.masterKey, plaintext, newCtx);
+            reencrypted.push({ key: r.key, ciphertext: fresh.ciphertext, key_version: fresh.keyVersion, row: r });
+        }
+        const tx = this.db.transaction(() => {
+            if (secretsLegacy) {
+                this.db.exec('DROP TABLE secrets');
+                this.db.exec(`
+          CREATE TABLE secrets (
+            key TEXT NOT NULL PRIMARY KEY,
+            ciphertext TEXT NOT NULL,
+            key_version TEXT NOT NULL,
+            label TEXT,
+            provider TEXT,
+            last_tested_at INTEGER,
+            last_test_result TEXT,
+            updated_at INTEGER NOT NULL,
+            updated_by TEXT NOT NULL
+          );
+        `);
+                const insert = this.db.prepare(`
+          INSERT INTO secrets (key, ciphertext, key_version, label, provider, last_tested_at, last_test_result, updated_at, updated_by)
+          VALUES (@key, @ciphertext, @key_version, @label, @provider, @last_tested_at, @last_test_result, @updated_at, @updated_by)
+        `);
+                for (const r of reencrypted) {
+                    insert.run({
+                        key: r.key,
+                        ciphertext: r.ciphertext,
+                        key_version: r.key_version,
+                        label: r.row.label,
+                        provider: r.row.provider,
+                        last_tested_at: r.row.last_tested_at,
+                        last_test_result: r.row.last_test_result,
+                        updated_at: r.row.updated_at,
+                        updated_by: r.row.updated_by,
+                    });
+                }
+            }
+            if (settingsLegacy) {
+                this.db.exec('DROP TABLE settings');
+                this.db.exec(`
+          CREATE TABLE settings (
+            key TEXT NOT NULL PRIMARY KEY,
+            value_json TEXT NOT NULL,
+            updated_at INTEGER NOT NULL,
+            updated_by TEXT NOT NULL
+          );
+        `);
+                const insertS = this.db.prepare(`
+          INSERT INTO settings (key, value_json, updated_at, updated_by)
+          VALUES (@key, @value_json, @updated_at, @updated_by)
+        `);
+                for (const r of legacySettings) {
+                    insertS.run({
+                        key: r.key,
+                        value_json: r.value_json,
+                        updated_at: r.updated_at,
+                        updated_by: r.updated_by,
+                    });
+                }
+            }
+            if (auditLegacy) {
+                // SQLite 3.35+ supports ALTER TABLE DROP COLUMN. The PK is
+                // auto-increment id, so no rebuild needed for audit_log — we
+                // can drop the now-redundant scope / scope_id columns in place.
+                try {
+                    this.db.exec('ALTER TABLE audit_log DROP COLUMN scope');
+                }
+                catch { /* may not exist */ }
+                try {
+                    this.db.exec('ALTER TABLE audit_log DROP COLUMN scope_id');
+                }
+                catch { /* may not exist */ }
+            }
+            this.db.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES ('scope_collapse_migrated_at', ?)").run(String(Date.now()));
+            this.db.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES ('schema_version', ?)").run(SCHEMA_VERSION);
+        });
+        tx();
+    }
+    actorString(actor) {
+        if (actor.type === 'user')
+            return `user:${actor.userId ?? 'unknown'}`;
+        return `system:${actor.systemId ?? 'unknown'}`;
+    }
+    // ── SettingsStore impl ─────────────────────────────────────────────────
+    async set(input, actor) {
+        // Discriminate by whether the registry classifies the key as a secret.
+        const def = getKeyDef(input.key);
+        const isSecret = !!def && def.classification === 'workspace-secret';
+        if (isSecret)
+            return this.setSecret(input, actor);
+        return this.setSetting(input, actor);
+    }
+    async setSetting(input, actor) {
+        const updatedAt = Date.now();
+        const updatedBy = this.actorString(actor);
+        const valueJson = JSON.stringify(input.value);
+        // M1: settings write + audit insert run inside one transaction so a
+        // disk-full / table-locked / write-failure on either step rolls the
+        // whole pair back. Otherwise we'd persist mutations without their
+        // audit row, breaking the "every write is logged" property.
+        const tx = this.db.transaction(() => {
+            this.db.prepare(`
+        INSERT INTO settings (key, value_json, updated_at, updated_by)
+        VALUES (@key, @value_json, @updated_at, @updated_by)
+        ON CONFLICT(key) DO UPDATE SET
+          value_json = excluded.value_json,
+          updated_at = excluded.updated_at,
+          updated_by = excluded.updated_by
+      `).run({
+                key: input.key,
+                value_json: valueJson,
+                updated_at: updatedAt,
+                updated_by: updatedBy,
+            });
+            this.audit.write({
+                action: 'set',
+                actor,
+                key: input.key,
+                success: true,
+            });
+        });
+        tx();
+        return {
+            key: input.key,
+            valueJson,
+            updatedAt,
+            updatedBy,
+        };
+    }
+    get(key) {
+        const row = this.db.prepare('SELECT value_json FROM settings WHERE key=?').get(key);
+        if (!row)
+            return undefined;
+        try {
+            return JSON.parse(row.value_json);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    list() {
+        const rows = this.db.prepare('SELECT * FROM settings').all();
+        return rows.map((r) => ({
+            key: r.key,
+            valueJson: r.value_json,
+            updatedAt: r.updated_at,
+            updatedBy: r.updated_by,
+        }));
+    }
+    async delete(key, actor) {
+        // M1: delete + audit insert run inside one transaction. If audit
+        // insert fails, the deletes roll back so we never silently drop a
+        // row without its audit trail.
+        let removed = false;
+        const tx = this.db.transaction(() => {
+            // Delete from both tables — same primary-key shape, only one will match.
+            const settingsRes = this.db.prepare('DELETE FROM settings WHERE key=?').run(key);
+            const secretsRes = this.db.prepare('DELETE FROM secrets WHERE key=?').run(key);
+            removed = settingsRes.changes + secretsRes.changes > 0;
+            this.audit.write({
+                action: 'delete',
+                actor,
+                key,
+                success: removed,
+            });
+        });
+        tx();
+        return removed;
+    }
+    // ── SecretStore impl ───────────────────────────────────────────────────
+    async setSecret(input, actor) {
+        const def = getKeyDef(input.key);
+        if (!def || def.classification !== 'workspace-secret') {
+            throw new Error(`SqliteEncryptedStore: cannot set secret for key "${input.key}" — not a registered workspace-secret`);
+        }
+        const updatedAt = Date.now();
+        const updatedBy = this.actorString(actor);
+        const ctx = {
+            scope: STORE_AAD_SCOPE,
+            scopeId: STORE_AAD_SCOPE_ID,
+            key: input.key,
+            keyVersion: this.keyVersion,
+        };
+        const enc = encrypt(this.masterKey, input.value, ctx);
+        // M1: encrypted-row insert + audit insert run inside one transaction
+        // so any failure (disk full, table locked, audit insert error) rolls
+        // both writes back. Encryption itself runs outside the txn — if
+        // encrypt() throws, we never opened the txn.
+        const tx = this.db.transaction(() => {
+            this.db.prepare(`
+        INSERT INTO secrets (key, ciphertext, key_version, label, provider, last_tested_at, last_test_result, updated_at, updated_by)
+        VALUES (@key, @ciphertext, @key_version, @label, @provider, @last_tested_at, @last_test_result, @updated_at, @updated_by)
+        ON CONFLICT(key) DO UPDATE SET
+          ciphertext = excluded.ciphertext,
+          key_version = excluded.key_version,
+          label = COALESCE(excluded.label, secrets.label),
+          provider = COALESCE(excluded.provider, secrets.provider),
+          last_tested_at = excluded.last_tested_at,
+          last_test_result = excluded.last_test_result,
+          updated_at = excluded.updated_at,
+          updated_by = excluded.updated_by
+      `).run({
+                key: input.key,
+                ciphertext: enc.ciphertext,
+                key_version: enc.keyVersion,
+                label: input.label ?? null,
+                provider: input.provider ?? null,
+                last_tested_at: null,
+                last_test_result: null,
+                updated_at: updatedAt,
+                updated_by: updatedBy,
+            });
+            this.audit.write({
+                action: 'set',
+                actor,
+                key: input.key,
+                success: true,
+            });
+        });
+        tx();
+        return this.describe(input.key);
+    }
+    describe(key) {
+        const row = this.db.prepare('SELECT * FROM secrets WHERE key=?').get(key);
+        if (!row)
+            return undefined;
+        const def = getKeyDef(row.key);
+        return {
+            key: row.key,
+            classification: def?.classification ?? 'workspace-secret',
+            label: row.label ?? undefined,
+            provider: row.provider ?? undefined,
+            lastTestedAt: row.last_tested_at ?? undefined,
+            lastTestResult: row.last_test_result ?? undefined,
+            updatedAt: row.updated_at,
+            updatedBy: row.updated_by,
+            keyVersion: row.key_version,
+        };
+    }
+    listSecrets(actor) {
+        const rows = this.db.prepare('SELECT * FROM secrets').all();
+        if (actor) {
+            this.audit.write({
+                action: 'describe',
+                actor,
+                key: '*',
+                success: true,
+            });
+        }
+        return rows.map((r) => {
+            const def = getKeyDef(r.key);
+            return {
+                key: r.key,
+                classification: def?.classification ?? 'workspace-secret',
+                label: r.label ?? undefined,
+                provider: r.provider ?? undefined,
+                lastTestedAt: r.last_tested_at ?? undefined,
+                lastTestResult: r.last_test_result ?? undefined,
+                updatedAt: r.updated_at,
+                updatedBy: r.updated_by,
+                keyVersion: r.key_version,
+            };
+        });
+    }
+    unsafeGetForResolver(key) {
+        const row = this.db.prepare('SELECT ciphertext, key_version FROM secrets WHERE key=?').get(key);
+        if (!row)
+            return undefined;
+        const ctx = {
+            scope: STORE_AAD_SCOPE,
+            scopeId: STORE_AAD_SCOPE_ID,
+            key,
+            keyVersion: row.key_version,
+        };
+        const encRow = { ciphertext: row.ciphertext, keyVersion: row.key_version };
+        try {
+            // Try current master key first (steady state).
+            if (row.key_version === this.keyVersion) {
+                return decrypt(this.masterKey, encRow, ctx);
+            }
+            // Transitional: row was encrypted under a previous key version.
+            if (this.previousMasterKey &&
+                row.key_version === this.previousKeyVersion) {
+                return decrypt(this.previousMasterKey, encRow, ctx);
+            }
+            // Fall through — try current key against whatever AAD we have.
+            // (Misconfigured rotation; better to error noisily.)
+            return decrypt(this.masterKey, encRow, ctx);
+        }
+        catch (err) {
+            // Audit decrypt failures as a security signal but don't throw out
+            // through the resolver hot path. Caller treats undefined as "unset".
+            this.audit.write({
+                action: 'decrypt_fail',
+                actor: { type: 'system', systemId: 'resolver' },
+                key,
+                success: false,
+                detail: { keyVersion: row.key_version, error: err instanceof Error ? err.message : String(err) },
+            });
+            return undefined;
+        }
+    }
+    close() {
+        this.db.close();
+    }
+}
+//# sourceMappingURL=SqliteEncryptedStore.js.map

package/dist/core/secrets/SqliteEncryptedStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SqliteEncryptedStore.js","sourceRoot":"","sources":["../../../src/core/secrets/SqliteEncryptedStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAiB,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAY1C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAYzC,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAEpC;;;;GAIG;AACH,MAAM,eAAe,GAAG,WAAW,CAAC;AACpC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAqB9B,MAAM,OAAO,oBAAoB;IACd,EAAE,CAAoB;IACtB,SAAS,CAAa;IACtB,UAAU,CAAS;IACnB,iBAAiB,CAAc;IAC/B,kBAAkB,CAAU;IACpC,KAAK,CAAc;IAE5B,YAAY,IAAiC;QAC3C,sEAAsE;QACtE,gDAAgD;QAChD,0EAA0E;QAC1E,gEAAgE;QAChE,mEAAmE;QACnE,qEAAqE;QACrE,kEAAkE;QAClE,mEAAmE;QACnE,iEAAiE;QACjE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC9C,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wDAAwD;gBACxD,+DAA+D;gBAC/D,gCAAgC;gBAChC,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC;YAClE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC;gBAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAEpC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;QACzD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAChD,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAElD,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtC,mEAAmE;QACnE,mEAAmE;QACnE,0DAA0D;QAC1D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;KAwBZ,CAAC,CAAC;QAEH,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;QACnE,oEAAoE;QACpE,iDAAiD;QACjD,IAAI,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAEvG,8CAA8C;QAC9C,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,uDAAuD,CACxD,CAAC,GAAG,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,uDAAuD,CACxD,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACK,oBAAoB,CAAC,MAAc;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE;aACpB,OAAO,CAAC,+DAA+D,CAAC;aACxE,GAAG,EAAmC,CAAC;QAC1C,IAAI,OAAO,EAAE,KAAK;YAAE,OAAO;QAE3B,wDAAwD;QACxD,MAAM,YAAY,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,GAAG,EAA6B,CAAC;QACrG,MAAM,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,GAAG,EAA6B,CAAC;QACnG,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,GAAG,EAA6B,CAAC;QAEnG,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QAE9G,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW,EAAE,CAAC;YACtD,kEAAkE;YAClE,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,mFAAmF,CACpF,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,qEAAqE;QACrE,mEAAmE;QACnE,2CAA2C;QAC3C,EAAE;QACF,qEAAqE;QACrE,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,oEAAoE;QACpE,kCAAkC;QAClC,IAAI,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAC;QAC7F,MAAM,UAAU,GAAG,GAAG,MAAM,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,IAAI,CAAC;oBAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8DAA8D;YAC9D,+DAA+D;YAC/D,kCAAkC;YAClC,MAAM,IAAI,KAAK,CACb,gEAAgE,UAAU,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAClI,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,+DAA+D;QAC/D,8CAA8C;QAC9C,MAAM,aAAa,GAKd,aAAa;YAChB,CAAC,CAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,GAAG,EAAY;YAC3D,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,cAAc,GAGf,cAAc;YACjB,CAAC,CAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,GAAG,EAAY;YAC5D,CAAC,CAAC,EAAE,CAAC;QAEP,oEAAoE;QACpE,uEAAuE;QACvE,4DAA4D;QAC5D,kEAAkE;QAClE,gBAAgB;QAChB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;YAC/B,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACrD,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,wFAAwF,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,UAAU,0CAA0C,CACtO,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,mEAAmE;QACnE,6DAA6D;QAC7D,eAAe;QACf,MAAM,WAAW,GAAuG,EAAE,CAAC;QAC3H,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAa;gBACvB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,OAAO,EAAE,CAAC,CAAC,QAAQ;gBACnB,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,UAAU,EAAE,CAAC,CAAC,WAAW;aAC1B,CAAC;YACF,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACvE,IAAI,SAA6B,CAAC;YAClC,IAAI,CAAC;gBACH,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;oBACtC,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtD,CAAC;qBAAM,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBAC/E,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC9D,CAAC;qBAAM,CAAC;oBACN,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,4DAA4D;gBAC5D,8DAA8D;gBAC9D,+DAA+D;gBAC/D,oDAAoD;gBACpD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;oBACf,MAAM,EAAE,cAAc;oBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,0BAA0B,EAAE;oBAC/D,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBAC/F,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,yCAAyC;YACzC,MAAM,MAAM,GAAa;gBACvB,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,kBAAkB;gBAC3B,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC;YACF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YACzD,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YAClC,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACnC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;SAYZ,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;SAG9B,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;oBAC5B,MAAM,CAAC,GAAG,CAAC;wBACT,GAAG,EAAE,CAAC,CAAC,GAAG;wBACV,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK;wBAClB,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ;wBACxB,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc;wBACpC,gBAAgB,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB;wBACxC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU;wBAC5B,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU;qBAC7B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACnB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;gBACpC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;SAOZ,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;SAG/B,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;oBAC/B,OAAO,CAAC,GAAG,CAAC;wBACV,GAAG,EAAE,CAAC,CAAC,GAAG;wBACV,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,UAAU,EAAE,CAAC,CAAC,UAAU;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBAChB,2DAA2D;gBAC3D,6DAA6D;gBAC7D,gEAAgE;gBAChE,IAAI,CAAC;oBAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC;gBAC9F,IAAI,CAAC;oBAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC;YACnG,CAAC;YAED,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,mFAAmF,CACpF,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,uEAAuE,CACxE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,EAAE,EAAE,CAAC;IACP,CAAC;IAEO,WAAW,CAAC,KAAmB;QACrC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,QAAQ,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QACtE,OAAO,UAAU,KAAK,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;IACjD,CAAC;IAED,0EAA0E;IAE1E,KAAK,CAAC,GAAG,CAAC,KAAuC,EAAE,KAAmB;QACpE,uEAAuE;QACvE,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GACZ,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,KAAK,kBAAkB,CAAC;QACrD,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAuB,EAAE,KAAK,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,UAAU,CAAC,KAAwB,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAAsB,EAAE,KAAmB;QAClE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9C,oEAAoE;QACpE,oEAAoE;QACpE,kEAAkE;QAClE,4DAA4D;QAC5D,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YAClC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;;OAOf,CAAC,CAAC,GAAG,CAAC;gBACL,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBACf,MAAM,EAAE,KAAK;gBACb,KAAK;gBACL,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,EAAE,EAAE,CAAC;QACL,OAAO;YACL,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,SAAS;YACT,SAAS;YACT,SAAS;SACV,CAAC;IACJ,CAAC;IAED,GAAG,CAAc,GAAW;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,6CAA6C,CAC9C,CAAC,GAAG,CAAC,GAAG,CAAuC,CAAC;QACjD,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAM,CAAC;QAAC,CAAC;QAC/C,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;IAC7B,CAAC;IAED,IAAI;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,GAAG,EAAmB,CAAC;QAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,SAAS,EAAE,CAAC,CAAC,UAAU;SACxB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,KAAmB;QAC3C,iEAAiE;QACjE,kEAAkE;QAClE,+BAA+B;QAC/B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YAClC,yEAAyE;YACzE,MAAM,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACjC,kCAAkC,CACnC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACX,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAChC,iCAAiC,CAClC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACX,OAAO,GAAG,WAAW,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBACf,MAAM,EAAE,QAAQ;gBAChB,KAAK;gBACL,GAAG;gBACH,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,EAAE,EAAE,CAAC;QACL,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,0EAA0E;IAElE,KAAK,CAAC,SAAS,CAAC,KAAqB,EAAE,KAAmB;QAChE,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,KAAK,kBAAkB,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,oDAAoD,KAAK,CAAC,GAAG,uCAAuC,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAa;YACpB,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,kBAAkB;YAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtD,qEAAqE;QACrE,qEAAqE;QACrE,gEAAgE;QAChE,6CAA6C;QAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YAClC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;;;;;;;OAYf,CAAC,CAAC,GAAG,CAAC;gBACL,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,WAAW,EAAE,GAAG,CAAC,UAAU;gBAC3B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;gBAChC,cAAc,EAAE,IAAI;gBACpB,gBAAgB,EAAE,IAAI;gBACtB,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBACf,MAAM,EAAE,KAAK;gBACb,KAAK;gBACL,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,EAAE,EAAE,CAAC;QACL,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAE,CAAC;IACnC,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,mCAAmC,CACpC,CAAC,GAAG,CAAC,GAAG,CAA2B,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,cAAc,EAAE,GAAG,EAAE,cAAc,IAAI,kBAAkB;YACzD,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,SAAS;YAC7B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,SAAS;YACnC,YAAY,EAAE,GAAG,CAAC,cAAc,IAAI,SAAS;YAC7C,cAAc,EAAE,GAAG,CAAC,gBAAgB,IAAI,SAAS;YACjD,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,UAAU,EAAE,GAAG,CAAC,WAAW;SAC5B,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,KAAoB;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,GAAG,EAAkB,CAAC;QAC5E,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBACf,MAAM,EAAE,UAAU;gBAClB,KAAK;gBACL,GAAG,EAAE,GAAG;gBACR,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACpB,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO;gBACL,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,cAAc,EAAE,GAAG,EAAE,cAAc,IAAI,kBAAkB;gBACzD,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,SAAS;gBAC3B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,SAAS;gBACjC,YAAY,EAAE,CAAC,CAAC,cAAc,IAAI,SAAS;gBAC3C,cAAc,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;gBAC/C,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,UAAU,EAAE,CAAC,CAAC,WAAW;aAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,oBAAoB,CAAC,GAAW;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,yDAAyD,CAC1D,CAAC,GAAG,CAAC,GAAG,CAA4D,CAAC;QACtE,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,GAAG,GAAa;YACpB,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,kBAAkB;YAC3B,GAAG;YACH,UAAU,EAAE,GAAG,CAAC,WAAW;SAC5B,CAAC;QACF,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;QAC3E,IAAI,CAAC;YACH,+CAA+C;YAC/C,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxC,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC;YACD,gEAAgE;YAChE,IACE,IAAI,CAAC,iBAAiB;gBACtB,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,kBAAkB,EAC3C,CAAC;gBACD,OAAO,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC;YACD,+DAA+D;YAC/D,qDAAqD;YACrD,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kEAAkE;YAClE,qEAAqE;YACrE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBACf,MAAM,EAAE,cAAc;gBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE;gBAC/C,GAAG;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aACjG,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;CACF"}

package/dist/core/secrets/audit.d.ts

@@ -0,0 +1,36 @@
+/**
+ * AuditLogger — append-only operational audit trail for the secrets store.
+ *
+ * Hot-path resolves (get) are NOT audited — that would create N×requests
+ * log volume. We audit writes, deletes, rotations, tests, metadata reads
+ * from UI/API, master-key rotations, and AEAD decrypt failures (security
+ * signal).
+ *
+ * The schema captures both user and system actors via a discriminated
+ * (`actor_type`, `actor_user_id`, `actor_system_id`) triple.
+ *
+ * After the scope-collapse refactor, audit rows no longer carry a scope
+ * dimension. Legacy migration code may still pass `scope` / `scope_id`
+ * fields on the AuditEvent for backward compatibility while it
+ * decrypts pre-migration rows — those fields are simply ignored.
+ */
+import type Database from 'better-sqlite3';
+import type { ActorContext } from './SecretStore.js';
+export type AuditAction = 'set' | 'delete' | 'test' | 'describe' | 'rotate_master' | 'decrypt_fail' | 'bundle_export' | 'bundle_import' | 'migrate';
+export interface AuditEvent {
+    action: AuditAction;
+    actor: ActorContext;
+    key?: string;
+    success: boolean;
+    /** Non-secret context, e.g. `{ rowCount: 42 }` for rotate_master. */
+    detail?: Record<string, unknown>;
+    /** @deprecated kept for migration call sites; ignored at insert time. */
+    scope?: string;
+    /** @deprecated kept for migration call sites; ignored at insert time. */
+    scope_id?: string;
+}
+export declare class AuditLogger {
+    private readonly insert;
+    constructor(db: Database.Database);
+    write(event: AuditEvent): void;
+}