studiograph 1.3.48-next.21 → 1.3.48-next.210

package/dist/core/secrets/SqliteEncryptedStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SqliteEncryptedStore.js","sourceRoot":"","sources":["../../../src/core/secrets/SqliteEncryptedStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAiB,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAY1C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAYzC,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAEpC;;;;GAIG;AACH,MAAM,eAAe,GAAG,WAAW,CAAC;AACpC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAqB9B,MAAM,OAAO,oBAAoB;IACd,EAAE,CAAoB;IACtB,SAAS,CAAa;IACtB,UAAU,CAAS;IACnB,iBAAiB,CAAc;IAC/B,kBAAkB,CAAU;IACpC,KAAK,CAAc;IAE5B,YAAY,IAAiC;QAC3C,sEAAsE;QACtE,gDAAgD;QAChD,0EAA0E;QAC1E,gEAAgE;QAChE,mEAAmE;QACnE,qEAAqE;QACrE,kEAAkE;QAClE,mEAAmE;QACnE,iEAAiE;QACjE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC9C,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wDAAwD;gBACxD,+DAA+D;gBAC/D,gCAAgC;gBAChC,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC;YAClE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC;gBAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAEpC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;QACzD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAChD,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAElD,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtC,mEAAmE;QACnE,mEAAmE;QACnE,0DAA0D;QAC1D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;KAwBZ,CAAC,CAAC;QAEH,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;QACnE,oEAAoE;QACpE,iDAAiD;QACjD,IAAI,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAEvG,8CAA8C;QAC9C,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,uDAAuD,CACxD,CAAC,GAAG,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,uDAAuD,CACxD,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACK,oBAAoB,CAAC,MAAc;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE;aACpB,OAAO,CAAC,+DAA+D,CAAC;aACxE,GAAG,EAAmC,CAAC;QAC1C,IAAI,OAAO,EAAE,KAAK;YAAE,OAAO;QAE3B,wDAAwD;QACxD,MAAM,YAAY,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,GAAG,EAA6B,CAAC;QACrG,MAAM,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,GAAG,EAA6B,CAAC;QACnG,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,GAAG,EAA6B,CAAC;QAEnG,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QAE9G,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW,EAAE,CAAC;YACtD,kEAAkE;YAClE,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,mFAAmF,CACpF,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,qEAAqE;QACrE,mEAAmE;QACnE,2CAA2C;QAC3C,EAAE;QACF,qEAAqE;QACrE,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,oEAAoE;QACpE,kCAAkC;QAClC,IAAI,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAC;QAC7F,MAAM,UAAU,GAAG,GAAG,MAAM,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,IAAI,CAAC;oBAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8DAA8D;YAC9D,+DAA+D;YAC/D,kCAAkC;YAClC,MAAM,IAAI,KAAK,CACb,gEAAgE,UAAU,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAClI,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,+DAA+D;QAC/D,8CAA8C;QAC9C,MAAM,aAAa,GAKd,aAAa;YAChB,CAAC,CAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,GAAG,EAAY;YAC3D,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,cAAc,GAGf,cAAc;YACjB,CAAC,CAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,GAAG,EAAY;YAC5D,CAAC,CAAC,EAAE,CAAC;QAEP,oEAAoE;QACpE,uEAAuE;QACvE,4DAA4D;QAC5D,kEAAkE;QAClE,gBAAgB;QAChB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;YAC/B,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACrD,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,wFAAwF,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,UAAU,0CAA0C,CACtO,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,mEAAmE;QACnE,6DAA6D;QAC7D,eAAe;QACf,MAAM,WAAW,GAAuG,EAAE,CAAC;QAC3H,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAa;gBACvB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,OAAO,EAAE,CAAC,CAAC,QAAQ;gBACnB,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,UAAU,EAAE,CAAC,CAAC,WAAW;aAC1B,CAAC;YACF,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACvE,IAAI,SAA6B,CAAC;YAClC,IAAI,CAAC;gBACH,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;oBACtC,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtD,CAAC;qBAAM,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBAC/E,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC9D,CAAC;qBAAM,CAAC;oBACN,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,4DAA4D;gBAC5D,8DAA8D;gBAC9D,+DAA+D;gBAC/D,oDAAoD;gBACpD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;oBACf,MAAM,EAAE,cAAc;oBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,0BAA0B,EAAE;oBAC/D,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBAC/F,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,yCAAyC;YACzC,MAAM,MAAM,GAAa;gBACvB,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,kBAAkB;gBAC3B,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC;YACF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YACzD,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YAClC,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACnC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;SAYZ,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;SAG9B,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;oBAC5B,MAAM,CAAC,GAAG,CAAC;wBACT,GAAG,EAAE,CAAC,CAAC,GAAG;wBACV,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK;wBAClB,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ;wBACxB,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc;wBACpC,gBAAgB,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB;wBACxC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU;wBAC5B,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU;qBAC7B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACnB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;gBACpC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;SAOZ,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;SAG/B,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;oBAC/B,OAAO,CAAC,GAAG,CAAC;wBACV,GAAG,EAAE,CAAC,CAAC,GAAG;wBACV,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,UAAU,EAAE,CAAC,CAAC,UAAU;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBAChB,2DAA2D;gBAC3D,6DAA6D;gBAC7D,gEAAgE;gBAChE,IAAI,CAAC;oBAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC;gBAC9F,IAAI,CAAC;oBAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC;YACnG,CAAC;YAED,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,mFAAmF,CACpF,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,uEAAuE,CACxE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,EAAE,EAAE,CAAC;IACP,CAAC;IAEO,WAAW,CAAC,KAAmB;QACrC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,QAAQ,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QACtE,OAAO,UAAU,KAAK,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;IACjD,CAAC;IAED,0EAA0E;IAE1E,KAAK,CAAC,GAAG,CAAC,KAAuC,EAAE,KAAmB;QACpE,uEAAuE;QACvE,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GACZ,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,KAAK,kBAAkB,CAAC;QACrD,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAuB,EAAE,KAAK,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,UAAU,CAAC,KAAwB,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAAsB,EAAE,KAAmB;QAClE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9C,oEAAoE;QACpE,oEAAoE;QACpE,kEAAkE;QAClE,4DAA4D;QAC5D,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YAClC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;;OAOf,CAAC,CAAC,GAAG,CAAC;gBACL,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBACf,MAAM,EAAE,KAAK;gBACb,KAAK;gBACL,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,EAAE,EAAE,CAAC;QACL,OAAO;YACL,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,SAAS;YACT,SAAS;YACT,SAAS;SACV,CAAC;IACJ,CAAC;IAED,GAAG,CAAc,GAAW;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,6CAA6C,CAC9C,CAAC,GAAG,CAAC,GAAG,CAAuC,CAAC;QACjD,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAM,CAAC;QAAC,CAAC;QAC/C,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;IAC7B,CAAC;IAED,IAAI;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,GAAG,EAAmB,CAAC;QAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,SAAS,EAAE,CAAC,CAAC,UAAU;SACxB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,KAAmB;QAC3C,iEAAiE;QACjE,kEAAkE;QAClE,+BAA+B;QAC/B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YAClC,yEAAyE;YACzE,MAAM,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACjC,kCAAkC,CACnC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACX,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAChC,iCAAiC,CAClC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACX,OAAO,GAAG,WAAW,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBACf,MAAM,EAAE,QAAQ;gBAChB,KAAK;gBACL,GAAG;gBACH,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,EAAE,EAAE,CAAC;QACL,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,0EAA0E;IAElE,KAAK,CAAC,SAAS,CAAC,KAAqB,EAAE,KAAmB;QAChE,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,KAAK,kBAAkB,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,oDAAoD,KAAK,CAAC,GAAG,uCAAuC,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAa;YACpB,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,kBAAkB;YAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtD,qEAAqE;QACrE,qEAAqE;QACrE,gEAAgE;QAChE,6CAA6C;QAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YAClC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;;;;;;;OAYf,CAAC,CAAC,GAAG,CAAC;gBACL,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,WAAW,EAAE,GAAG,CAAC,UAAU;gBAC3B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;gBAChC,cAAc,EAAE,IAAI;gBACpB,gBAAgB,EAAE,IAAI;gBACtB,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBACf,MAAM,EAAE,KAAK;gBACb,KAAK;gBACL,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,EAAE,EAAE,CAAC;QACL,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAE,CAAC;IACnC,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,mCAAmC,CACpC,CAAC,GAAG,CAAC,GAAG,CAA2B,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,cAAc,EAAE,GAAG,EAAE,cAAc,IAAI,kBAAkB;YACzD,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,SAAS;YAC7B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,SAAS;YACnC,YAAY,EAAE,GAAG,CAAC,cAAc,IAAI,SAAS;YAC7C,cAAc,EAAE,GAAG,CAAC,gBAAgB,IAAI,SAAS;YACjD,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,UAAU,EAAE,GAAG,CAAC,WAAW;SAC5B,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,KAAoB;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,GAAG,EAAkB,CAAC;QAC5E,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBACf,MAAM,EAAE,UAAU;gBAClB,KAAK;gBACL,GAAG,EAAE,GAAG;gBACR,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACpB,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO;gBACL,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,cAAc,EAAE,GAAG,EAAE,cAAc,IAAI,kBAAkB;gBACzD,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,SAAS;gBAC3B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,SAAS;gBACjC,YAAY,EAAE,CAAC,CAAC,cAAc,IAAI,SAAS;gBAC3C,cAAc,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;gBAC/C,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,UAAU,EAAE,CAAC,CAAC,WAAW;aAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,oBAAoB,CAAC,GAAW;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,yDAAyD,CAC1D,CAAC,GAAG,CAAC,GAAG,CAA4D,CAAC;QACtE,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,GAAG,GAAa;YACpB,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,kBAAkB;YAC3B,GAAG;YACH,UAAU,EAAE,GAAG,CAAC,WAAW;SAC5B,CAAC;QACF,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;QAC3E,IAAI,CAAC;YACH,+CAA+C;YAC/C,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxC,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC;YACD,gEAAgE;YAChE,IACE,IAAI,CAAC,iBAAiB;gBACtB,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,kBAAkB,EAC3C,CAAC;gBACD,OAAO,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC;YACD,+DAA+D;YAC/D,qDAAqD;YACrD,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kEAAkE;YAClE,qEAAqE;YACrE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBACf,MAAM,EAAE,cAAc;gBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE;gBAC/C,GAAG;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aACjG,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,GAAW;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,oCAAoC,CACrC,CAAC,GAAG,CAAC,GAAG,CAAkC,CAAC;QAC5C,OAAO,GAAG,EAAE,KAAK,CAAC;IACpB,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,GAAW,EAAE,KAAa;QAChC,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,wDAAwD,CACzD,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;CACF"}

package/dist/core/secrets/audit.d.ts

@@ -0,0 +1,36 @@
+/**
+ * AuditLogger — append-only operational audit trail for the secrets store.
+ *
+ * Hot-path resolves (get) are NOT audited — that would create N×requests
+ * log volume. We audit writes, deletes, rotations, tests, metadata reads
+ * from UI/API, master-key rotations, and AEAD decrypt failures (security
+ * signal).
+ *
+ * The schema captures both user and system actors via a discriminated
+ * (`actor_type`, `actor_user_id`, `actor_system_id`) triple.
+ *
+ * After the scope-collapse refactor, audit rows no longer carry a scope
+ * dimension. Legacy migration code may still pass `scope` / `scope_id`
+ * fields on the AuditEvent for backward compatibility while it
+ * decrypts pre-migration rows — those fields are simply ignored.
+ */
+import type Database from 'better-sqlite3';
+import type { ActorContext } from './SecretStore.js';
+export type AuditAction = 'set' | 'delete' | 'test' | 'describe' | 'rotate_master' | 'decrypt_fail' | 'bundle_export' | 'bundle_import' | 'migrate';
+export interface AuditEvent {
+    action: AuditAction;
+    actor: ActorContext;
+    key?: string;
+    success: boolean;
+    /** Non-secret context, e.g. `{ rowCount: 42 }` for rotate_master. */
+    detail?: Record<string, unknown>;
+    /** @deprecated kept for migration call sites; ignored at insert time. */
+    scope?: string;
+    /** @deprecated kept for migration call sites; ignored at insert time. */
+    scope_id?: string;
+}
+export declare class AuditLogger {
+    private readonly insert;
+    constructor(db: Database.Database);
+    write(event: AuditEvent): void;
+}

package/dist/core/secrets/audit.js

@@ -0,0 +1,60 @@
+/**
+ * AuditLogger — append-only operational audit trail for the secrets store.
+ *
+ * Hot-path resolves (get) are NOT audited — that would create N×requests
+ * log volume. We audit writes, deletes, rotations, tests, metadata reads
+ * from UI/API, master-key rotations, and AEAD decrypt failures (security
+ * signal).
+ *
+ * The schema captures both user and system actors via a discriminated
+ * (`actor_type`, `actor_user_id`, `actor_system_id`) triple.
+ *
+ * After the scope-collapse refactor, audit rows no longer carry a scope
+ * dimension. Legacy migration code may still pass `scope` / `scope_id`
+ * fields on the AuditEvent for backward compatibility while it
+ * decrypts pre-migration rows — those fields are simply ignored.
+ */
+export class AuditLogger {
+    insert;
+    constructor(db) {
+        db.exec(`
+      CREATE TABLE IF NOT EXISTS audit_log (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        ts INTEGER NOT NULL,
+        actor_type TEXT NOT NULL CHECK (actor_type IN ('user','system')),
+        actor_user_id TEXT,
+        actor_system_id TEXT,
+        action TEXT NOT NULL,
+        key TEXT,
+        success INTEGER NOT NULL,
+        ip TEXT,
+        user_agent TEXT,
+        detail_json TEXT
+      );
+      CREATE INDEX IF NOT EXISTS idx_audit_ts ON audit_log(ts DESC);
+      CREATE INDEX IF NOT EXISTS idx_audit_actor ON audit_log(actor_user_id, ts DESC);
+    `);
+        this.insert = db.prepare(`
+      INSERT INTO audit_log
+        (ts, actor_type, actor_user_id, actor_system_id, action, key, success, ip, user_agent, detail_json)
+      VALUES
+        (@ts, @actor_type, @actor_user_id, @actor_system_id, @action, @key, @success, @ip, @user_agent, @detail_json)
+    `);
+    }
+    write(event) {
+        const a = event.actor;
+        this.insert.run({
+            ts: Date.now(),
+            actor_type: a.type,
+            actor_user_id: a.type === 'user' ? (a.userId ?? null) : null,
+            actor_system_id: a.type === 'system' ? (a.systemId ?? null) : null,
+            action: event.action,
+            key: event.key ?? null,
+            success: event.success ? 1 : 0,
+            ip: a.ip ?? null,
+            user_agent: a.userAgent ?? null,
+            detail_json: event.detail ? JSON.stringify(event.detail) : null,
+        });
+    }
+}
+//# sourceMappingURL=audit.js.map

package/dist/core/secrets/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/core/secrets/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA6BH,MAAM,OAAO,WAAW;IACL,MAAM,CAAqB;IAE5C,YAAY,EAAqB;QAC/B,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;KAgBP,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;KAKxB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAiB;QACrB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,UAAU,EAAE,CAAC,CAAC,IAAI;YAClB,aAAa,EAAE,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YAC5D,eAAe,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YAClE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI;YAChB,UAAU,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;YAC/B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;SAChE,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/core/secrets/auth-db-migration.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Phase 8 — auth.db column upgrades for per-user secret encryption.
+ *
+ * Two tables in `auth.db` carry per-user secrets:
+ *
+ *   1. `oauth_tokens.data_json` (TEXT NOT NULL) holds the full MCP OAuth
+ *      payload (tokens + client info + code verifier) for a user+connector.
+ *      Its value is a JSON blob containing the access/refresh tokens.
+ *   2. `user_preferences.settings_json` (TEXT NOT NULL DEFAULT '{}') holds
+ *      a free-form per-user key/value map. Today the only secret it
+ *      carries is the Deepgram key (meeting capture); the rest is
+ *      non-secret prefs (default folder, calendar config). Discrimination
+ *      is registry-driven — any key whose registry entry is
+ *      `user-secret` moves to the new ciphertext column.
+ *
+ * Strategy:
+ *
+ *   - `oauth_tokens`: SQLite cannot ALTER a TEXT NOT NULL column to be
+ *     nullable. The standard pattern is a transactional table rebuild
+ *     (CREATE NEW + INSERT...SELECT + DROP + RENAME). We do that, with
+ *     the per-row encryption running in the Node loop between SELECT and
+ *     INSERT.
+ *   - `user_preferences`: column additions are easy (no constraints
+ *     block us), so we just ALTER to add `settings_ciphertext` and
+ *     `key_version`, then walk each row and partition keys by
+ *     classification.
+ *
+ * Safety:
+ *
+ *   - Before any DDL, `auth.db` is copied to
+ *     `auth.db.backup.<unix-ts-ms>`. If the backup write fails, the
+ *     migration aborts before touching the source DB.
+ *   - The rebuild runs inside a single transaction. SQLite atomic
+ *     semantics give us rollback on any per-row encryption failure.
+ *   - A row-count integrity check fires before COMMIT; mismatch
+ *     triggers ROLLBACK and a thrown error.
+ *   - Idempotent: completion is recorded in a new `meta` table.
+ *     Re-running is a fast no-op.
+ *   - Half-state guard: at boot we refuse to start if we find
+ *     `data_json IS NOT NULL AND data_ciphertext IS NOT NULL` on any
+ *     row — that means a previous run committed partial state.
+ *
+ * AAD binding for every encrypted blob:
+ *
+ *   `{ scope: 'user', scopeId: <user_id>, key: <column>, keyVersion: 'mk_v1' }`
+ *
+ * Swapping a ciphertext between users invalidates the AAD; tampering
+ * with the row triggers AEAD failure on decrypt.
+ */
+import Database from 'better-sqlite3';
+import { type EncryptedRow } from './encryption.js';
+export interface AuthDbMigrationResult {
+    /** True when the meta row already records prior completion. */
+    skipped: boolean;
+    /** Rows rewritten in oauth_tokens. */
+    oauthRowsMigrated: number;
+    /** Rows in user_preferences that had at least one secret key partitioned out. */
+    prefsRowsMigrated: number;
+    /** Path of the on-disk backup; absent when skipped. */
+    backupPath?: string;
+}
+export interface AuthDbMigrationOptions {
+    authDbPath: string;
+    masterKey: Uint8Array;
+    /** Defaults to 'mk_v1'. */
+    keyVersion?: string;
+}
+/**
+ * Run the Phase 8 auth.db migration. Idempotent; returns immediately
+ * with `skipped: true` once the meta row is present.
+ *
+ * Caller MUST hold the only open handle to auth.db while this runs —
+ * the migration opens its own Database connection internally so that
+ * AuthService's WAL/foreign-keys configuration doesn't bleed in.
+ * In `serve.ts` this runs before AuthService is constructed.
+ */
+export declare function migrateAuthDbPhase8(opts: AuthDbMigrationOptions): AuthDbMigrationResult;
+/**
+ * Public helper for AuthService to invoke at construction time once the
+ * migration is known to be complete (or didn't need to run on a fresh
+ * DB). On a freshly-created DB this writes the meta row so future
+ * `migrateAuthDbPhase8` calls short-circuit.
+ */
+export declare function markAuthDbPhase8Migrated(db: Database.Database): void;
+export declare function isAuthDbPhase8Migrated(db: Database.Database): boolean;
+/**
+ * Half-state detector for the live AuthService boot. Caller-friendly:
+ * returns true when migration appears complete-and-consistent. Throws
+ * on the corrupted shape (data_json non-null on a row that also has
+ * data_ciphertext) — that's evidence a previous run committed partial
+ * state and we'd rather refuse to start than serve corrupt OAuth data.
+ */
+export declare function assertAuthDbConsistent(db: Database.Database): void;
+/**
+ * Map legacy `user_preferences.settings_json` keys to canonical registry
+ * names. The migration uses this to classify pre-existing rows; new
+ * writes through the API will use canonical names directly (Phase 8
+ * API update lands alongside the migration).
+ */
+export declare const LEGACY_PREFS_KEY_TO_REGISTRY: Record<string, string>;
+/**
+ * Helper used by AuthService when reading user_preferences. Given a
+ * row's plaintext `settings_json` and optional `settings_ciphertext`,
+ * return the merged object. Decryption errors throw — the caller
+ * should let them propagate (corrupt or wrong-key data is a hard
+ * fail, not a silent empty object).
+ */
+export declare function decryptUserPreferencesSettings(masterKey: Uint8Array, userId: number, settingsJson: string | null | undefined, settingsCiphertext: string | null | undefined, keyVersion: string | null | undefined): Record<string, unknown>;
+/**
+ * Encrypt the secret subset of a user_preferences object for storage.
+ * Returns the pair (settings_json plaintext, settings_ciphertext) to
+ * write into the row. The caller (AuthService.setUserSettings) is
+ * responsible for the full merged write.
+ */
+export declare function encryptUserPreferencesSettings(masterKey: Uint8Array, userId: number, merged: Record<string, unknown>, keyVersion?: string): {
+    settingsJson: string;
+    settingsCiphertext: string | null;
+    keyVersion: string | null;
+};
+/**
+ * Encrypt an oauth_tokens row's data payload for storage. The AAD is
+ * bound to the owning user_id so a row swap is detected on decrypt.
+ */
+export declare function encryptOAuthTokenData(masterKey: Uint8Array, userId: number, dataJson: string, keyVersion?: string): EncryptedRow;
+/**
+ * Decrypt an oauth_tokens row's ciphertext. Throws on AAD mismatch,
+ * tampering, or wrong key — callers should let the error propagate.
+ */
+export declare function decryptOAuthTokenData(masterKey: Uint8Array, userId: number, ciphertext: string, keyVersion: string | null | undefined): string;