studiograph 1.3.48-next.21 → 1.3.48-next.211

package/dist/core/secrets/auth-db-migration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-db-migration.js","sourceRoot":"","sources":["../../../src/core/secrets/auth-db-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAqB,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AACpC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AACxD,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAC1D,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAoBvC;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA4B;IAE5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,qEAAqE;QACrE,kEAAkE;QAClE,iEAAiE;QACjE,8DAA8D;QAC9D,iEAAiE;QACjE,uCAAuC;QACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAE1D,yEAAyE;IACzE,oDAAoD;IACpD,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,eAAe,CAAC,EAAE,CAAC,CAAC;QAEpB,IAAI,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;QACvE,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,kDAAkD;QAClD,eAAe,CAAC,EAAE,CAAC,CAAC;QAEpB,qEAAqE;QACrE,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAE7C,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAE1B,IAAI,CAAC;YACH,2DAA2D;YAC3D,6DAA6D;YAC7D,2CAA2C;YAC3C,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBAClB,iBAAiB,GAAG,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;gBACvE,iBAAiB,GAAG,sBAAsB,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;gBAC3E,8DAA8D;gBAC9D,wCAAwC;gBACxC,EAAE,CAAC,OAAO,CACR;mEACyD,CAC1D,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAChD,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iEAAiE;YACjE,4DAA4D;YAC5D,GAAG,CAAC,KAAK,CACP,+CAA+C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI;gBACjG,0BAA0B,UAAU,mCAAmC,CAC1E,CAAC;YACF,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK;YACd,iBAAiB;YACjB,iBAAiB;YACjB,UAAU;SACX,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,EAAqB;IAC5D,eAAe,CAAC,EAAE,CAAC,CAAC;IACpB,IAAI,eAAe,CAAC,EAAE,CAAC;QAAE,OAAO;IAChC,EAAE,CAAC,OAAO,CACR;6DACyD,CAC1D,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,EAAqB;IAC1D,eAAe,CAAC,EAAE,CAAC,CAAC;IACpB,OAAO,eAAe,CAAC,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAqB;IAC1D,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,cAAc,EAAE,iBAAiB,CAAC;QAAE,OAAO;IACnE,eAAe,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED,wEAAwE;AACxE,YAAY;AACZ,wEAAwE;AAExE,SAAS,eAAe,CAAC,EAAqB;IAC5C,EAAE,CAAC,IAAI,CAAC;;;;;GAKP,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,EAAqB;IAC5C,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAC,sCAAsC,CAAC;SAC/C,GAAG,CAAC,kBAAkB,CAAkC,CAAC;IAC5D,OAAO,CAAC,CAAC,GAAG,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CACrB,EAAqB,EACrB,KAAa,EACb,MAAc;IAEd,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,qBAAqB,KAAK,GAAG,CAAC;SACtC,GAAG,EAA6B,CAAC;IACpC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,eAAe,CAAC,EAAqB;IAC5C,sDAAsD;IACtD,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,cAAc,EAAE,iBAAiB,CAAC;QAAE,OAAO;IACnE,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CACN;qEAC+D,CAChE;SACA,GAAG,EAAmB,CAAC;IAC1B,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,wCAAwC,GAAG,CAAC,CAAC,oCAAoC;YAC/E,+EAA+E,CAClF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,UAAkB;IAClC,MAAM,UAAU,GAAG,GAAG,UAAU,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACxD,mEAAmE;IACnE,qEAAqE;IACrE,sEAAsE;IACtE,oEAAoE;IACpE,qEAAqE;IACrE,+DAA+D;IAC/D,mDAAmD;IACnD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IACjE,CAAC;IACD,wEAAwE;IACxE,wEAAwE;IACxE,qEAAqE;IACrE,sEAAsE;IACtE,qEAAqE;IACrE,iEAAiE;IACjE,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACrC,sEAAsE;IACtE,qEAAqE;IACrE,kCAAkC;IAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CACzB,EAAqB,EACrB,SAAqB,EACrB,UAAkB;IAElB,qEAAqE;IACrE,sEAAsE;IACtE,sCAAsC;IACtC,oEAAoE;IACpE,mEAAmE;IACnE,MAAM,QAAQ,GAAG,EAAE;SAChB,OAAO,CAAC,iCAAiC,CAAC;SAC1C,GAAG,EAOJ,CAAC;IAEH,oEAAoE;IACpE,qEAAqE;IACrE,sDAAsD;IACtD,MAAM,MAAM,GAAG,QAAQ;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACvB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEtB,yEAAyE;IACzE,sEAAsE;IACtE,iEAAiE;IACjE,2EAA2E;IAC3E,uEAAuE;IACvE,uEAAuE;IACvE,sEAAsE;IACtE,mEAAmE;IACnE,iEAAiE;IACjE,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC;IAC5E,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IAExE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,uEAAuE;IACvE,6CAA6C;IAC7C,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC;QAC9B,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,GACR,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;YACjD,CAAC,CAAC,YAAY,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE;YAC3C,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,GAAG,IAAI,IAAI,IAAI,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,qEAAqE;IACrE,0DAA0D;IAC1D,IAAI,CAAC,gBAAgB;QAAE,UAAU,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC/D,IAAI,CAAC,gBAAgB;QAAE,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAE3D,4DAA4D;IAC5D,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,MAAM,GAAG,EAAE;SACd,OAAO,CAAC,uCAAuC,CAAC;SAChD,GAAG,EAQJ,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAClD,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9B,MAAM,QAAQ,GACZ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,WAAW;YACtD,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE;YACpC,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,QAAQ,GACZ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,WAAW;YACtD,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE;YACpC,CAAC,CAAC,EAAE,CAAC;QACT,SAAS,CAAC,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,MAAM,IAAI,OAAO,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,QAAQ,GACZ,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAEzE,gFAAgF;IAChF,EAAE,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAEhD,EAAE,CAAC,IAAI,CACL;QACI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,QAAQ,GAAG,QAAQ;MACpD,CACH,CAAC;IAEF,mEAAmE;IACnE,qEAAqE;IACrE,6EAA6E;IAC7E,wEAAwE;IACxE,uEAAuE;IACvE,sEAAsE;IACtE,qCAAqC;IACrC,MAAM,UAAU,GAAG,EAAE;SAClB,OAAO,CACN;;;kDAG4C,CAC7C;SACA,GAAG,EAAwD,CAAC;IAE/D,+DAA+D;IAC/D,MAAM,QAAQ,GACZ,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,EACzD,CAAC,CAAC,CAAC;IAEJ,2DAA2D;IAC3D,iEAAiE;IACjE,kEAAkE;IAClE,+CAA+C;IAC/C,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC3B,UAAU,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CACpD,CAAC;IAEF,qEAAqE;IACrE,2EAA2E;IAC3E,uEAAuE;IACvE,oEAAoE;IACpE,mEAAmE;IACnE,MAAM,UAAU,GAAG,gBAAgB,IAAI,gBAAgB;QACrD,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,CAAC,GAAG,UAAU;YACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAChD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,kBAAkB,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC3B,gCAAgC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;eAC1C,kBAAkB,GAAG,CACjC,CAAC;IAEF,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,8BAA8B;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAoC,CAAC;IAEhE,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;QAClC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAExE,iCAAiC;QACjC,IAAI,YAA2B,CAAC;QAChC,IAAI,cAA6B,CAAC;QAClC,IAAI,cAA6B,CAAC;QAElC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,mEAAmE;YACnE,6DAA6D;YAC7D,gEAAgE;YAChE,8DAA8D;YAC9D,iCAAiC;YACjC,IAAI,OAAO,kBAAkB,KAAK,QAAQ,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,KAAK,CACb,gCAAgC,MAAM,0BAA0B;oBAC9D,6DAA6D,CAChE,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE;gBACvC,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,MAAM;gBACf,GAAG,EAAE,gBAAgB;gBACrB,UAAU;aACX,CAAC,CAAC;YACH,YAAY,GAAG,IAAI,CAAC;YACpB,cAAc,GAAG,GAAG,CAAC,UAAU,CAAC;YAChC,cAAc,GAAG,GAAG,CAAC,UAAU,CAAC;QAClC,CAAC;aAAM,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,kBAAkB,KAAK,QAAQ,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxG,mEAAmE;YACnE,8DAA8D;YAC9D,qBAAqB;YACrB,YAAY,GAAG,IAAI,CAAC;YACpB,cAAc,GAAG,kBAAkB,CAAC;YACpC,cAAc,GAAG,CAAC,OAAO,kBAAkB,KAAK,QAAQ,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC;gBACxF,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,UAAU,CAAC;QACjB,CAAC;aAAM,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,IAAI,kBAAkB,KAAK,SAAS,CAAC,EAAE,CAAC;YAClG,kEAAkE;YAClE,qEAAqE;YACrE,oEAAoE;YACpE,YAAY,GAAG,IAAI,CAAC;YACpB,cAAc,GAAG,IAAI,CAAC;YACtB,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,gCAAgC,MAAM,iCAAiC;gBACrE,IAAI,OAAO,QAAQ,uBAAuB,CAC7C,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAClC,IAAI,CAAC,KAAK,WAAW;gBAAE,OAAO,YAAY,CAAC;YAC3C,IAAI,CAAC,KAAK,iBAAiB;gBAAE,OAAO,cAAc,CAAC;YACnD,IAAI,CAAC,KAAK,aAAa;gBAAE,OAAO,cAAc,CAAC;YAC/C,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QAC1B,YAAY,EAAE,CAAC;IACjB,CAAC;IAED,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,kDAAkD,QAAQ,UAAU,YAAY,EAAE,CACnF,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACnC,EAAE,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IAE9D,mDAAmD;IACnD,MAAM,SAAS,GACb,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,EACzD,CAAC,CAAC,CAAC;IACJ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,oDAAoD,QAAQ,UAAU,SAAS,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,qEAAqE;IACrE,qDAAqD;IACrD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,mEAAmE;QACnE,kEAAkE;QAClE,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,sBAAsB,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,4BAA4B;gBACpE,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,sBAAsB,CAC7B,EAAqB,EACrB,SAAqB,EACrB,UAAkB;IAElB,wEAAwE;IACxE,qEAAqE;IACrE,mDAAmD;IACnD,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,kBAAkB,EAAE,qBAAqB,CAAC,EAAE,CAAC;QACnE,EAAE,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,kBAAkB,EAAE,aAAa,CAAC,EAAE,CAAC;QAC3D,EAAE,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACtE,CAAC;IAED,uEAAuE;IACvE,oEAAoE;IACpE,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CACN;;iEAE2D,CAC5D;SACA,GAAG,EAIJ,CAAC;IAEH,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC3B;;wBAEoB,CACrB,CAAC;IAEF,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,qDAAqD;YACrD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,SAAS;QAE7E,MAAM,aAAa,GAA4B,EAAE,CAAC;QAClD,MAAM,YAAY,GAA4B,EAAE,CAAC;QACjD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,IAAI,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/B,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,sCAAsC;QACtC,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEtD,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE;YAC5D,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;YAC5B,GAAG,EAAE,qBAAqB;YAC1B,UAAU;SACX,CAAC,CAAC;QAEH,UAAU,CAAC,GAAG,CACZ,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAC5B,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,OAAO,CACZ,CAAC;QACF,YAAY,EAAE,CAAC;IACjB,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,MAAc;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,MAAM,EAAE,cAAc,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC1D,wEAAwE;IACxE,sEAAsE;IACtE,yCAAyC;IACzC,MAAM,SAAS,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,GAAG,EAAE,cAAc,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAA2B;IAClE,YAAY,EAAE,uBAAuB;CACtC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAAqB,EACrB,MAAc,EACd,YAAuC,EACvC,kBAA6C,EAC7C,UAAqC;IAErC,MAAM,KAAK,GACT,YAAY,IAAI,YAAY,CAAC,IAAI,EAAE;QACjC,CAAC,CAAC,mBAAmB,CAAC,YAAY,CAAC;QACnC,CAAC,CAAC,EAAE,CAAC;IAET,IAAI,CAAC,kBAAkB;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,SAAS,GAAG,OAAO,CACvB,SAAS,EACT;QACE,UAAU,EAAE,kBAAkB;QAC9B,UAAU,EAAE,UAAU,IAAI,mBAAmB;KAC9C,EACD;QACE,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACvB,GAAG,EAAE,qBAAqB;QAC1B,UAAU,EAAE,UAAU,IAAI,mBAAmB;KAC9C,CACF,CAAC;IACF,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC9C,sEAAsE;IACtE,mEAAmE;IACnE,gEAAgE;IAChE,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAAqB,EACrB,MAAc,EACd,MAA+B,EAC/B,aAAqB,mBAAmB;IAExC,MAAM,aAAa,GAA4B,EAAE,CAAC;IAClD,MAAM,YAAY,GAA4B,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;YAC1C,kBAAkB,EAAE,IAAI;YACxB,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE;QAC5D,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACvB,GAAG,EAAE,qBAAqB;QAC1B,UAAU;KACX,CAAC,CAAC;IACH,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;QAC1C,kBAAkB,EAAE,GAAG,CAAC,UAAU;QAClC,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAqB,EACrB,MAAc,EACd,QAAgB,EAChB,aAAqB,mBAAmB;IAExC,OAAO,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE;QAClC,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACvB,GAAG,EAAE,gBAAgB;QACrB,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAqB,EACrB,MAAc,EACd,UAAkB,EAClB,UAAqC;IAErC,OAAO,OAAO,CACZ,SAAS,EACT,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,IAAI,mBAAmB,EAAE,EAC7D;QACE,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACvB,GAAG,EAAE,gBAAgB;QACrB,UAAU,EAAE,UAAU,IAAI,mBAAmB;KAC9C,CACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,uCAAuC;IACvC,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACrD,4BAA4B;IAC5B,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACzD,yDAAyD;IACzD,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACtD,yBAAyB;IACzB,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7C,8DAA8D;IAC9D,OAAO,IAAI,OAAO,GAAG,CAAC;AACxB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,CAA4B,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/core/secrets/bundle.d.ts

@@ -0,0 +1,141 @@
+/**
+ * Config-bundle export sanitization.
+ *
+ * Phase 3 of the secrets refactor: every export path (the
+ * `/api/config/bundle` GET endpoint and the `studiograph push --remote`
+ * CLI) routes through this module so the produced bundles are
+ * byte-identical and the registry's `exportable` flag is the single
+ * source of truth for "what may leave the trust boundary."
+ *
+ * Rules driven by the registry:
+ *   - bootstrap classification          → never exportable
+ *   - any *-secret classification       → never exportable (defense-in-depth;
+ *                                         registry already says exportable=false)
+ *   - exportable=true entries           → included
+ *   - non-registered top-level fields   → included by default (they're the
+ *                                         workspace shape: name, slug, repos,
+ *                                         etc.) UNLESS they look like a known
+ *                                         secret-shape (URL credentials,
+ *                                         prefix-matched tokens). Phase 9b
+ *                                         tightens this to a strict-allowlist
+ *                                         schema; Phase 3 keeps the seam wide
+ *                                         enough to ship.
+ *
+ * H1 (Codex): the sanitizer + the import gate share a SINGLE detector
+ * (`isSecretLeak()` below). They walk every object/array to arbitrary
+ * depth — the previous top-level-only loop missed nested
+ * `r2_config.secret_access_key` and friends. A small static legacy-path
+ * map (`LEGACY_SECRET_PATHS`) covers known nested slots that pre-date
+ * the registry's flat naming so e.g. `r2_config.secret_access_key` is
+ * recognized as the registry's `r2.secret_access_key`.
+ *
+ * H2 (Codex): connectors get the same treatment with stricter rules —
+ * any string value at a secret-named key (`looksLikeSecretFieldName`)
+ * MUST be a `$ENV_VAR` placeholder. Raw values are dropped on export
+ * and rejected on import.
+ */
+import { type KeyDef } from './registry.js';
+export interface AuthSeedShape {
+    jwtSecret?: string;
+    apiKey?: string;
+    users: Array<Record<string, unknown>>;
+    folder_access?: Array<Record<string, unknown>>;
+    [k: string]: unknown;
+}
+export interface ConfigBundleShape {
+    workspace: Record<string, unknown> | null;
+    about: string | null;
+    authSeed: AuthSeedShape;
+    sources: Record<string, unknown>;
+    connectors: Array<Record<string, unknown>>;
+}
+/**
+ * Heuristic: does this string look like a raw secret value that should
+ * never appear in a bundle? Cheap prefix + URL-credential check.
+ * Placeholder shape (`$ENV_VAR`) is explicitly NOT a leak.
+ */
+export declare function looksLikeRawSecret(s: string): boolean;
+/**
+ * Heuristic: does this field name suggest its value is a secret?
+ * Used by the connector detector to require `$ENV_VAR` placeholders
+ * for any secret-named key.
+ */
+export declare function looksLikeSecretFieldName(name: string): boolean;
+/**
+ * Validate a connector URL doesn't carry embedded credentials.
+ */
+export declare function urlContainsCredentials(s: string): boolean;
+/**
+ * The single secret-detector used by both the export sanitizer and the
+ * import gate. Returns `true` if this (path, value) pair represents a
+ * leak — i.e. the value MUST NOT cross the trust boundary.
+ *
+ * Asymmetry between export and import would itself be a finding;
+ * symmetry here is load-bearing.
+ */
+export declare function isSecretLeak(path: string, value: unknown): boolean;
+/**
+ * Walk an object/array tree and return an array of `(path, value)`
+ * pairs flagged by `isSecretLeak`. Used by `bundleContainsBootstrapFields`
+ * to produce a complete list for error messages.
+ *
+ * `prefix` is the dotted path so far; the root caller passes `''`.
+ */
+export declare function findSecretLeaks(prefix: string, value: unknown): Array<{
+    path: string;
+    reason: 'registry' | 'value-shape' | 'connector';
+}>;
+/**
+ * Drop any field from the seed that the registry classifies as
+ * bootstrap. `users[].password_hash` is intentionally retained — see
+ * docs/SECURITY.md for the product decision.
+ *
+ * Walks recursively so nested secret-shaped values inside `users[]` or
+ * `folder_access[]` are also stripped.
+ */
+export declare function sanitizeAuthSeed(seed: AuthSeedShape): AuthSeedShape;
+/**
+ * Filter a workspace.json-ish object by walking the entire tree and
+ * dropping any (path, value) pair flagged by `isSecretLeak`.
+ *
+ * Phase 3 keeps unknown leaf fields by default; Phase 9b tightens via
+ * WorkspaceConfigSchema.
+ */
+export declare function sanitizeWorkspaceConfig(workspace: Record<string, unknown> | null): Record<string, unknown> | null;
+/**
+ * Connector configs use placeholder substitution (`$ENV_VAR`) for any
+ * secret-bearing field. Walk to arbitrary depth and reject any value
+ * at a secret-named key that isn't a placeholder. URLs with embedded
+ * credentials are dropped wholesale.
+ *
+ * Same detector as the import gate — see `connectorImportLeaks`.
+ */
+export declare function sanitizeConnectorConfigs<T extends Record<string, unknown>>(connectors: T[]): T[];
+/**
+ * Walk every connector and return the list of (path, key, reason)
+ * triples flagged by `isConnectorLeak`. Used by the import gate to
+ * reject bundles carrying literal connector secrets.
+ */
+export declare function connectorImportLeaks(connectors: ReadonlyArray<Record<string, unknown>>): string[];
+/**
+ * Compose an export-ready bundle from raw workspace materials. Used by
+ * both the GET /api/config/bundle endpoint and the `studiograph push
+ * --remote` CLI so they produce byte-identical output for the same
+ * workspace state.
+ */
+export declare function buildConfigBundle(input: ConfigBundleShape): ConfigBundleShape;
+/**
+ * Re-sanitize an inbound bundle (POST /api/config/bundle). Returns the
+ * list of paths within the bundle that carried bootstrap-class or
+ * secret-class material. Caller rejects the request when the result
+ * is non-empty.
+ *
+ * Walks the auth seed, workspace, and every connector to arbitrary
+ * depth using the same detectors as the export sanitizer. Any
+ * asymmetry between export and import would itself be a finding.
+ */
+export declare function bundleContainsBootstrapFields(bundle: ConfigBundleShape): string[];
+/**
+ * Re-export the registry's `exportable` filter for tests.
+ */
+export declare function exportableRegistryEntries(): KeyDef[];

package/dist/core/secrets/bundle.js

@@ -0,0 +1,435 @@
+/**
+ * Config-bundle export sanitization.
+ *
+ * Phase 3 of the secrets refactor: every export path (the
+ * `/api/config/bundle` GET endpoint and the `studiograph push --remote`
+ * CLI) routes through this module so the produced bundles are
+ * byte-identical and the registry's `exportable` flag is the single
+ * source of truth for "what may leave the trust boundary."
+ *
+ * Rules driven by the registry:
+ *   - bootstrap classification          → never exportable
+ *   - any *-secret classification       → never exportable (defense-in-depth;
+ *                                         registry already says exportable=false)
+ *   - exportable=true entries           → included
+ *   - non-registered top-level fields   → included by default (they're the
+ *                                         workspace shape: name, slug, repos,
+ *                                         etc.) UNLESS they look like a known
+ *                                         secret-shape (URL credentials,
+ *                                         prefix-matched tokens). Phase 9b
+ *                                         tightens this to a strict-allowlist
+ *                                         schema; Phase 3 keeps the seam wide
+ *                                         enough to ship.
+ *
+ * H1 (Codex): the sanitizer + the import gate share a SINGLE detector
+ * (`isSecretLeak()` below). They walk every object/array to arbitrary
+ * depth — the previous top-level-only loop missed nested
+ * `r2_config.secret_access_key` and friends. A small static legacy-path
+ * map (`LEGACY_SECRET_PATHS`) covers known nested slots that pre-date
+ * the registry's flat naming so e.g. `r2_config.secret_access_key` is
+ * recognized as the registry's `r2.secret_access_key`.
+ *
+ * H2 (Codex): connectors get the same treatment with stricter rules —
+ * any string value at a secret-named key (`looksLikeSecretFieldName`)
+ * MUST be a `$ENV_VAR` placeholder. Raw values are dropped on export
+ * and rejected on import.
+ */
+import { REGISTRY, getKeyDef } from './registry.js';
+/**
+ * Names of `auth-seed.json` fields that MUST NOT cross the trust
+ * boundary. Sanitization is registry-driven for the most part, but the
+ * AuthSeed top-level fields are a fixed shape — easier to hard-code
+ * which of them are bootstrap-class and to drop them before the bundle
+ * leaves the workspace.
+ */
+const SEED_BOOTSTRAP_FIELDS = new Set([
+    'jwtSecret',
+    // 'apiKey' is the deprecated workspace-wide bearer token; gone in
+    // current code, but pre-existing seeds may still carry it. Strip it
+    // either way — it's strictly worse than the per-user api_tokens flow.
+    'apiKey',
+]);
+/**
+ * Static map of legacy nested paths to canonical registry names.
+ *
+ * The registry uses flat dotted keys (`r2.secret_access_key`), but
+ * `workspace.json` historically stored R2 credentials nested under
+ * `r2_config.*`. We map the obvious legacy paths so the recursive
+ * walker can recognize a nested secret slot even if the user supplied
+ * a literal value there.
+ *
+ * Path components are joined with `.` — arrays are not part of the
+ * known legacy shape, so we don't need an array-index syntax here.
+ */
+const LEGACY_SECRET_PATHS = new Map([
+    ['r2_config.secret_access_key', 'r2.secret_access_key'],
+    ['r2_config.access_key_id', 'r2.access_key_id'],
+    // `auth_secret` and `jwt_secret` show up under different spellings in
+    // older configs; both belong to bootstrap-class entries that are
+    // never exportable.
+    ['jwt_secret', 'jwt.secret'],
+    ['jwtSecret', 'jwt.secret'],
+    ['auth_secret', 'jwt.secret'],
+    ['master_key', 'master.key'],
+    ['masterKey', 'master.key'],
+]);
+/**
+ * Heuristic: does this string look like a raw secret value that should
+ * never appear in a bundle? Cheap prefix + URL-credential check.
+ * Placeholder shape (`$ENV_VAR`) is explicitly NOT a leak.
+ */
+export function looksLikeRawSecret(s) {
+    if (typeof s !== 'string')
+        return false;
+    if (/^\$[A-Z_][A-Z0-9_]*$/.test(s))
+        return false; // placeholder
+    return (/^(sk-|ghp_|ghu_|ghs_|xox[bp]-|AKIA|glpat-|Bearer |Basic )/.test(s) ||
+        /https?:\/\/[^:]+:[^@]+@/.test(s));
+}
+/**
+ * Heuristic: does this field name suggest its value is a secret?
+ * Used by the connector detector to require `$ENV_VAR` placeholders
+ * for any secret-named key.
+ */
+export function looksLikeSecretFieldName(name) {
+    return /(?:authorization|cookie|token|key|secret|auth|password|credential)/i.test(name);
+}
+/**
+ * Validate a connector URL doesn't carry embedded credentials.
+ */
+export function urlContainsCredentials(s) {
+    return typeof s === 'string' && /^https?:\/\/[^:/?#@]+:[^@/?#]+@/.test(s);
+}
+/**
+ * Look up a registry entry by either:
+ *   - a flat key as exposed in workspace.json (`team_name`, etc.) —
+ *     tried verbatim, prefixed `workspace.`, and prefixed `instance.`
+ *   - a dotted nested path resolved through the legacy map
+ *     (`r2_config.secret_access_key` → `r2.secret_access_key`)
+ */
+function lookupByPath(path) {
+    // Direct match first — handles flat dotted keys.
+    const direct = getKeyDef(path) ?? getKeyDef(`workspace.${path}`) ?? getKeyDef(`instance.${path}`);
+    if (direct)
+        return direct;
+    // Try the legacy mapping — exact path match and tail-match.
+    // Tail-match handles cases where the path includes intermediate
+    // structure not represented in the legacy table.
+    const legacy = LEGACY_SECRET_PATHS.get(path);
+    if (legacy)
+        return getKeyDef(legacy);
+    // Fall back to walking suffixes: `a.b.c` → try `b.c`, then `c`.
+    const parts = path.split('.');
+    for (let i = 1; i < parts.length; i++) {
+        const tail = parts.slice(i).join('.');
+        const legacyTail = LEGACY_SECRET_PATHS.get(tail);
+        if (legacyTail)
+            return getKeyDef(legacyTail);
+    }
+    return undefined;
+}
+/**
+ * The single secret-detector used by both the export sanitizer and the
+ * import gate. Returns `true` if this (path, value) pair represents a
+ * leak — i.e. the value MUST NOT cross the trust boundary.
+ *
+ * Asymmetry between export and import would itself be a finding;
+ * symmetry here is load-bearing.
+ */
+export function isSecretLeak(path, value) {
+    // Registry/legacy-path-driven: any path that resolves to a secret or
+    // bootstrap entry is a leak regardless of value shape.
+    const def = lookupByPath(path);
+    if (def && (def.classification === 'bootstrap' || def.classification.endsWith('-secret'))) {
+        return true;
+    }
+    // Top-level seed bootstrap fields by name — covers `authSeed.jwtSecret`
+    // even when the registry path lookup misses (legacy spellings like
+    // `apiKey`). The path comes in as `authSeed.jwtSecret` so we look
+    // at the last segment.
+    const tail = path.split('.').pop() ?? '';
+    if (SEED_BOOTSTRAP_FIELDS.has(tail))
+        return true;
+    // Value-shape: only kicks in for plain strings. Treats raw token
+    // prefixes and URL credentials as leaks even when the path is
+    // unknown.
+    if (typeof value === 'string' && looksLikeRawSecret(value))
+        return true;
+    return false;
+}
+/**
+ * Walk an object/array tree and return an array of `(path, value)`
+ * pairs flagged by `isSecretLeak`. Used by `bundleContainsBootstrapFields`
+ * to produce a complete list for error messages.
+ *
+ * `prefix` is the dotted path so far; the root caller passes `''`.
+ */
+export function findSecretLeaks(prefix, value) {
+    const out = [];
+    walkLeaks(prefix, value, out);
+    return out;
+}
+function walkLeaks(prefix, value, out) {
+    if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+            walkLeaks(prefix ? `${prefix}.${i}` : String(i), value[i], out);
+        }
+        return;
+    }
+    if (value && typeof value === 'object') {
+        for (const [k, v] of Object.entries(value)) {
+            const path = prefix ? `${prefix}.${k}` : k;
+            // Probe at the field level — covers registry-named slots and
+            // bootstrap field names regardless of value shape.
+            if (isSecretLeak(path, v)) {
+                out.push({ path, reason: 'registry' });
+                // Don't recurse into a flagged subtree — the leak is the whole
+                // value. (Recursing would just double-report.)
+                continue;
+            }
+            walkLeaks(path, v, out);
+        }
+        return;
+    }
+    // Primitive: probe value-shape only.
+    if (typeof value === 'string' && looksLikeRawSecret(value)) {
+        out.push({ path: prefix, reason: 'value-shape' });
+    }
+}
+/**
+ * Recursively sanitize an object/array tree by dropping every
+ * `(path, value)` pair flagged by `isSecretLeak`.
+ *
+ * Returns a fresh structure — input is not mutated.
+ */
+function sanitizeRecursive(prefix, value) {
+    if (Array.isArray(value)) {
+        return value.map((v, i) => sanitizeRecursive(prefix ? `${prefix}.${i}` : String(i), v));
+    }
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            const path = prefix ? `${prefix}.${k}` : k;
+            if (isSecretLeak(path, v))
+                continue;
+            out[k] = sanitizeRecursive(path, v);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * Drop any field from the seed that the registry classifies as
+ * bootstrap. `users[].password_hash` is intentionally retained — see
+ * docs/SECURITY.md for the product decision.
+ *
+ * Walks recursively so nested secret-shaped values inside `users[]` or
+ * `folder_access[]` are also stripped.
+ */
+export function sanitizeAuthSeed(seed) {
+    const out = { users: [] };
+    for (const [k, v] of Object.entries(seed)) {
+        if (SEED_BOOTSTRAP_FIELDS.has(k))
+            continue;
+        // Don't recurse into users[] — their fields (email, password_hash)
+        // are intentional product output. Other top-level entries get the
+        // recursive treatment.
+        if (k === 'users' || k === 'folder_access') {
+            out[k] = v;
+            continue;
+        }
+        out[k] = sanitizeRecursive(k, v);
+    }
+    if (!out.users)
+        out.users = seed.users ?? [];
+    return out;
+}
+/**
+ * Filter a workspace.json-ish object by walking the entire tree and
+ * dropping any (path, value) pair flagged by `isSecretLeak`.
+ *
+ * Phase 3 keeps unknown leaf fields by default; Phase 9b tightens via
+ * WorkspaceConfigSchema.
+ */
+export function sanitizeWorkspaceConfig(workspace) {
+    if (!workspace)
+        return workspace;
+    return sanitizeRecursive('', workspace);
+}
+/**
+ * Connector configs use placeholder substitution (`$ENV_VAR`) for any
+ * secret-bearing field. Walk to arbitrary depth and reject any value
+ * at a secret-named key that isn't a placeholder. URLs with embedded
+ * credentials are dropped wholesale.
+ *
+ * Same detector as the import gate — see `connectorImportLeaks`.
+ */
+export function sanitizeConnectorConfigs(connectors) {
+    return connectors.map((c) => sanitizeConnectorRecursive('', c));
+}
+/**
+ * Connector-specific predicate: in committed/imported config, secret
+ * slots must be `$ENV_VAR` placeholders. Returns `true` if the value
+ * at this slot is a leak (literal value where placeholder is required,
+ * or a URL with embedded creds).
+ */
+function isConnectorLeak(key, value, fullPath) {
+    // URLs with embedded creds, anywhere.
+    if (typeof value === 'string' && urlContainsCredentials(value))
+        return true;
+    if (key === 'url' && typeof value === 'string' && urlContainsCredentials(value))
+        return true;
+    // Inside any header / query / env / oauth.client_secret / token /
+    // args slot, a secret-named field must hold a placeholder.
+    if (typeof value === 'string' && looksLikeSecretFieldName(key)) {
+        if (!/^\$[A-Z_][A-Z0-9_]*$/.test(value))
+            return true;
+    }
+    // stdio `args` — array of strings, each scanned for literal token
+    // prefixes. The match is wide, but bundles have no legitimate need
+    // for raw tokens in argv.
+    if (typeof value === 'string' && /\.args\.[0-9]+$/.test(fullPath)) {
+        if (looksLikeRawSecret(value) && !/^\$[A-Z_][A-Z0-9_]*$/.test(value)) {
+            return true;
+        }
+    }
+    // env-block (stdio) values: parent path ends in `.env` and the leaf
+    // value is a plain string. Demand placeholder for secret-named keys.
+    if (typeof value === 'string' &&
+        /(\.env)\.[^.]+$/.test(fullPath) &&
+        looksLikeSecretFieldName(key) &&
+        !/^\$[A-Z_][A-Z0-9_]*$/.test(value)) {
+        return true;
+    }
+    // Last-resort value-shape check anywhere in the connector subtree.
+    if (typeof value === 'string' && looksLikeRawSecret(value))
+        return true;
+    return false;
+}
+function sanitizeConnectorRecursive(prefix, value) {
+    if (Array.isArray(value)) {
+        return value
+            .map((v, i) => {
+            const childPath = prefix ? `${prefix}.${i}` : String(i);
+            if (isConnectorLeak(String(i), v, childPath))
+                return undefined;
+            return sanitizeConnectorRecursive(childPath, v);
+        })
+            .filter((v) => v !== undefined);
+    }
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            const childPath = prefix ? `${prefix}.${k}` : k;
+            if (typeof v === 'string' && isConnectorLeak(k, v, childPath))
+                continue;
+            out[k] = sanitizeConnectorRecursive(childPath, v);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * Walk every connector and return the list of (path, key, reason)
+ * triples flagged by `isConnectorLeak`. Used by the import gate to
+ * reject bundles carrying literal connector secrets.
+ */
+export function connectorImportLeaks(connectors) {
+    const out = [];
+    for (let i = 0; i < connectors.length; i++) {
+        walkConnectorLeaks(`connectors.${i}`, connectors[i], out);
+    }
+    return out;
+}
+function walkConnectorLeaks(prefix, value, out) {
+    if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+            const childPath = `${prefix}.${i}`;
+            if (isConnectorLeak(String(i), value[i], childPath)) {
+                out.push(childPath);
+                continue;
+            }
+            walkConnectorLeaks(childPath, value[i], out);
+        }
+        return;
+    }
+    if (value && typeof value === 'object') {
+        for (const [k, v] of Object.entries(value)) {
+            const childPath = `${prefix}.${k}`;
+            if (typeof v === 'string' && isConnectorLeak(k, v, childPath)) {
+                out.push(childPath);
+                continue;
+            }
+            walkConnectorLeaks(childPath, v, out);
+        }
+        return;
+    }
+}
+/**
+ * Compose an export-ready bundle from raw workspace materials. Used by
+ * both the GET /api/config/bundle endpoint and the `studiograph push
+ * --remote` CLI so they produce byte-identical output for the same
+ * workspace state.
+ */
+export function buildConfigBundle(input) {
+    return {
+        workspace: sanitizeWorkspaceConfig(input.workspace),
+        about: input.about,
+        authSeed: sanitizeAuthSeed(input.authSeed),
+        sources: input.sources,
+        connectors: sanitizeConnectorConfigs(input.connectors),
+    };
+}
+/**
+ * Re-sanitize an inbound bundle (POST /api/config/bundle). Returns the
+ * list of paths within the bundle that carried bootstrap-class or
+ * secret-class material. Caller rejects the request when the result
+ * is non-empty.
+ *
+ * Walks the auth seed, workspace, and every connector to arbitrary
+ * depth using the same detectors as the export sanitizer. Any
+ * asymmetry between export and import would itself be a finding.
+ */
+export function bundleContainsBootstrapFields(bundle) {
+    const found = [];
+    if (bundle.authSeed) {
+        for (const k of Object.keys(bundle.authSeed)) {
+            if (SEED_BOOTSTRAP_FIELDS.has(k)) {
+                found.push(`authSeed.${k}`);
+            }
+        }
+        // Also walk inside the seed for nested secret-shaped material.
+        // Skip `users` and `folder_access` (their fields are intentional).
+        for (const [k, v] of Object.entries(bundle.authSeed)) {
+            if (SEED_BOOTSTRAP_FIELDS.has(k))
+                continue;
+            if (k === 'users' || k === 'folder_access')
+                continue;
+            for (const leak of findSecretLeaks(`authSeed.${k}`, v)) {
+                found.push(leak.path);
+            }
+        }
+    }
+    if (bundle.workspace) {
+        for (const leak of findSecretLeaks('workspace', bundle.workspace)) {
+            found.push(leak.path);
+        }
+    }
+    // H2: connectors get walked too. The previous gate skipped them
+    // entirely, so a bundle with `connectors[0].headers["X-API-Key"]:
+    // "real-token"` was accepted.
+    if (Array.isArray(bundle.connectors)) {
+        for (const path of connectorImportLeaks(bundle.connectors)) {
+            found.push(path);
+        }
+    }
+    // De-dupe in case a path is reported by multiple detectors.
+    return [...new Set(found)];
+}
+/**
+ * Re-export the registry's `exportable` filter for tests.
+ */
+export function exportableRegistryEntries() {
+    return REGISTRY.filter((k) => k.exportable && !k.classification.endsWith('-secret') && k.classification !== 'bootstrap');
+}
+//# sourceMappingURL=bundle.js.map

package/dist/core/secrets/bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../../src/core/secrets/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAe,MAAM,eAAe,CAAC;AAkBjE;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,WAAW;IACX,kEAAkE;IAClE,oEAAoE;IACpE,sEAAsE;IACtE,QAAQ;CACT,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,mBAAmB,GAAgC,IAAI,GAAG,CAAC;IAC/D,CAAC,6BAA6B,EAAE,sBAAsB,CAAC;IACvD,CAAC,yBAAyB,EAAE,kBAAkB,CAAC;IAC/C,sEAAsE;IACtE,iEAAiE;IACjE,oBAAoB;IACpB,CAAC,YAAY,EAAE,YAAY,CAAC;IAC5B,CAAC,WAAW,EAAE,YAAY,CAAC;IAC3B,CAAC,aAAa,EAAE,YAAY,CAAC;IAC7B,CAAC,YAAY,EAAE,YAAY,CAAC;IAC5B,CAAC,WAAW,EAAE,YAAY,CAAC;CAC5B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,cAAc;IAChE,OAAO,CACL,2DAA2D,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAClC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,OAAO,qEAAqE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1F,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAAS;IAC9C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,iDAAiD;IACjD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,aAAa,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAClG,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,4DAA4D;IAC5D,gEAAgE;IAChE,iDAAiD;IACjD,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,MAAM;QAAE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;IAErC,gEAAgE;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,UAAU;YAAE,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAc;IACvD,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,KAAK,WAAW,IAAI,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wEAAwE;IACxE,mEAAmE;IACnE,kEAAkE;IAClE,uBAAuB;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjD,iEAAiE;IACjE,8DAA8D;IAC9D,WAAW;IACX,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAExE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,KAAc;IAEd,MAAM,GAAG,GAA8E,EAAE,CAAC;IAC1F,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAChB,MAAc,EACd,KAAc,EACd,GAA8E;IAE9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,6DAA6D;YAC7D,mDAAmD;YACnD,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;gBACvC,+DAA+D;gBAC/D,+CAA+C;gBAC/C,SAAS;YACX,CAAC;YACD,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO;IACT,CAAC;IACD,qCAAqC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,MAAc,EAAE,KAAc;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;gBAAE,SAAS;YACpC,GAAG,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAmB;IAClD,MAAM,GAAG,GAAkB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC3C,mEAAmE;QACnE,kEAAkE;QAClE,uBAAuB;QACvB,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,eAAe,EAAE,CAAC;YAC3C,GAAG,CAAC,CAAC,CAAC,GAAG,CAAQ,CAAC;YAClB,SAAS;QACX,CAAC;QACD,GAAG,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC7C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAyC;IAC/E,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,OAAO,iBAAiB,CAAC,EAAE,EAAE,SAAS,CAA4B,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAe;IAEf,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,EAAE,EAAE,CAAC,CAAM,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,KAAc,EAAE,QAAgB;IACpE,sCAAsC;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,sBAAsB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,GAAG,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,sBAAsB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7F,kEAAkE;IAClE,2DAA2D;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IAED,kEAAkE;IAClE,mEAAmE;IACnE,0BAA0B;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClE,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAChC,wBAAwB,CAAC,GAAG,CAAC;QAC7B,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EACnC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mEAAmE;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAExE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAc,EAAE,KAAc;IAChE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK;aACT,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACZ,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACxD,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC/D,OAAO,0BAA0B,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC;gBAAE,SAAS;YACxE,GAAG,CAAC,CAAC,CAAC,GAAG,0BAA0B,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkD;IAElD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,kBAAkB,CAAC,cAAc,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc,EAAE,KAAc,EAAE,GAAa;IACvE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;gBACpD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC9D,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,kBAAkB,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QACD,OAAO;IACT,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAwB;IACxD,OAAO;QACL,SAAS,EAAE,uBAAuB,CAAC,KAAK,CAAC,SAAS,CAAC;QACnD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAyB;IACrE,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,+DAA+D;QAC/D,mEAAmE;QACnE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC3C,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,eAAe;gBAAE,SAAS;YACrD,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;gBACvD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAClE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,kEAAkE;IAClE,8BAA8B;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,WAAW,CAAC,CAAC;AAC3H,CAAC"}