@agenticprimitives/key-custody 0.1.0-alpha.2

package/dist/providers/gcp.js

@@ -0,0 +1,490 @@
+// GcpKmsSigner — production GCP Cloud KMS asymmetric-sign backend.
+//
+// Cloudflare-Workers-compatible: drives the Cloud KMS REST API directly via
+// fetch + Web Crypto for JWT auth. The @google-cloud/kms SDK uses gRPC and
+// won't run on Workers; this implementation avoids gRPC entirely.
+//
+// Auth: service-account JSON → RS256 JWT (signed via crypto.subtle) →
+//   exchanged for an OAuth access token at oauth2.googleapis.com/token.
+//   Token cached with expiry buffer.
+//
+// Signing: POST cryptoKeyVersions/N:asymmetricSign with `digest.sha256`
+//   carrying our 32-byte keccak256 digest. Cloud KMS signs it as-is
+//   (does NOT re-hash) for `EC_SIGN_SECP256K1_SHA256` keys. Response is
+//   DER-encoded ECDSA (r,s). We:
+//     1. parse DER → (r, s)
+//     2. normalize s to low-s form (EIP-2)
+//     3. search recovery byte by trying v∈{27,28} against the known pubkey
+//       (Cloud KMS doesn't return the recovery bit)
+//
+// Public key: GET cryptoKeyVersions/N/publicKey returns PEM SPKI. We parse
+//   the trailing 65-byte uncompressed point (0x04||X||Y), compute
+//   keccak256(X||Y), take last 20 bytes → Ethereum address. Cached forever.
+//
+// GcpKmsProvider (envelope encryption via GCP KMS Encrypt/Decrypt) remains a
+// stub — that's a separate v0.2 follow-up. The signer covers the production
+// path for the agent's master-key requirement.
+import { secp256k1 } from '@noble/curves/secp256k1';
+import { keccak_256 } from '@noble/hashes/sha3';
+import { bytesToHex } from 'viem';
+import { buildEvent } from '@agenticprimitives/audit';
+import { canonicalContextBytes } from '../aad';
+// ─────────────────────────────────────────────────────────────────────
+// Constants
+// ─────────────────────────────────────────────────────────────────────
+const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
+const CLOUDKMS_SCOPE = 'https://www.googleapis.com/auth/cloudkms';
+const CLOUDKMS_BASE = 'https://cloudkms.googleapis.com/v1/';
+const TOKEN_EXPIRY_BUFFER_SECONDS = 60;
+const SECP256K1_N = secp256k1.CURVE.n;
+const SECP256K1_HALF_N = SECP256K1_N >> 1n;
+// ─────────────────────────────────────────────────────────────────────
+// Base64 / PEM helpers
+// ─────────────────────────────────────────────────────────────────────
+export function base64UrlEncode(bytes) {
+    let str = '';
+    for (let i = 0; i < bytes.length; i++)
+        str += String.fromCharCode(bytes[i]);
+    return btoa(str).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function base64Decode(s) {
+    const binary = atob(s);
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        out[i] = binary.charCodeAt(i);
+    return out;
+}
+function base64Encode(bytes) {
+    let str = '';
+    for (let i = 0; i < bytes.length; i++)
+        str += String.fromCharCode(bytes[i]);
+    return btoa(str);
+}
+export function pemToDer(pem) {
+    const lines = pem
+        .split('\n')
+        .filter((l) => !l.startsWith('-----') && l.trim().length > 0)
+        .join('');
+    return base64Decode(lines);
+}
+// ─────────────────────────────────────────────────────────────────────
+// JWT signing + token exchange
+// ─────────────────────────────────────────────────────────────────────
+export async function signJwt(serviceAccount, scope) {
+    const now = Math.floor(Date.now() / 1000);
+    const header = { alg: 'RS256', typ: 'JWT' };
+    const payload = {
+        iss: serviceAccount.client_email,
+        scope,
+        aud: GOOGLE_TOKEN_URL,
+        iat: now,
+        exp: now + 3600,
+    };
+    const encoder = new TextEncoder();
+    const headerB64 = base64UrlEncode(encoder.encode(JSON.stringify(header)));
+    const payloadB64 = base64UrlEncode(encoder.encode(JSON.stringify(payload)));
+    const signingInput = `${headerB64}.${payloadB64}`;
+    const keyDer = pemToDer(serviceAccount.private_key);
+    // Copy into a fresh ArrayBuffer so the typing satisfies BufferSource
+    // (TS lib.dom narrowed Uint8Array.buffer to ArrayBufferLike in 5.7).
+    const keyBuffer = new ArrayBuffer(keyDer.byteLength);
+    new Uint8Array(keyBuffer).set(keyDer);
+    const key = await globalThis.crypto.subtle.importKey('pkcs8', keyBuffer, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['sign']);
+    const signature = await globalThis.crypto.subtle.sign({ name: 'RSASSA-PKCS1-v1_5' }, key, encoder.encode(signingInput));
+    return `${signingInput}.${base64UrlEncode(new Uint8Array(signature))}`;
+}
+export async function fetchAccessToken(serviceAccount) {
+    const assertion = await signJwt(serviceAccount, CLOUDKMS_SCOPE);
+    const body = `grant_type=${encodeURIComponent('urn:ietf:params:oauth:grant-type:jwt-bearer')}&assertion=${encodeURIComponent(assertion)}`;
+    const res = await fetch(GOOGLE_TOKEN_URL, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body,
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`GCP token exchange failed: HTTP ${res.status}: ${text.slice(0, 300)}`);
+    }
+    const json = (await res.json());
+    if (!json.access_token || typeof json.expires_in !== 'number') {
+        throw new Error('GCP token exchange: response missing access_token or expires_in');
+    }
+    return {
+        accessToken: json.access_token,
+        expiresAt: Math.floor(Date.now() / 1000) + json.expires_in - TOKEN_EXPIRY_BUFFER_SECONDS,
+    };
+}
+// ─────────────────────────────────────────────────────────────────────
+// Cloud KMS REST calls
+// ─────────────────────────────────────────────────────────────────────
+async function callKms(token, pathRelativeToBase, options = { method: 'GET' }) {
+    const url = `${CLOUDKMS_BASE}${pathRelativeToBase}`;
+    const init = {
+        method: options.method,
+        headers: {
+            authorization: `Bearer ${token}`,
+            ...(options.body ? { 'content-type': 'application/json' } : {}),
+        },
+    };
+    if (options.body)
+        init.body = JSON.stringify(options.body);
+    const res = await fetch(url, init);
+    if (!res.ok) {
+        const text = await res.text();
+        // Don't leak the Authorization header. URL path is safe to include.
+        throw new Error(`Cloud KMS API error: HTTP ${res.status} on ${pathRelativeToBase}: ${text.slice(0, 300)}`);
+    }
+    return (await res.json());
+}
+// ─────────────────────────────────────────────────────────────────────
+// SPKI public-key parsing (uncompressed secp256k1 point extraction)
+// ─────────────────────────────────────────────────────────────────────
+export function parseSpkiUncompressedSecp256k1PubKey(spkiDer) {
+    // The SPKI structure ends with a BIT STRING containing the public key.
+    // For secp256k1, the public key is 65 bytes: 0x04 || X(32) || Y(32).
+    // The BIT STRING wrapping adds a single zero "unused bits" byte before
+    // the 0x04 marker. So the last 66 bytes of the DER should be:
+    //   [0x00 (unused bits)] [0x04 (uncompressed marker)] [X 32 bytes] [Y 32 bytes]
+    if (spkiDer.length < 66) {
+        throw new Error(`SPKI too short to contain uncompressed secp256k1 pubkey: ${spkiDer.length} bytes`);
+    }
+    const tail = spkiDer.slice(spkiDer.length - 65);
+    const marker = tail[0];
+    if (marker !== 0x04) {
+        throw new Error(`SPKI does not end with uncompressed point marker (0x04). Wrong key algorithm? ` +
+            `Found 0x${(marker ?? 0).toString(16).padStart(2, '0')} at position ${spkiDer.length - 65}.`);
+    }
+    return tail;
+}
+export function publicKeyToAddress(pubKey65) {
+    // pubKey65: 0x04 || X(32) || Y(32). Strip prefix; keccak256 over X||Y; last 20 bytes.
+    const raw = pubKey65.slice(1);
+    const hash = keccak_256(raw);
+    return bytesToHex(hash.slice(12));
+}
+// ─────────────────────────────────────────────────────────────────────
+// DER signature parsing + low-s + recovery byte search
+// ─────────────────────────────────────────────────────────────────────
+export function parseDerEcdsa(der) {
+    const at = (idx) => {
+        const b = der[idx];
+        if (b === undefined)
+            throw new Error(`DER: unexpected end of buffer at offset ${idx}`);
+        return b;
+    };
+    let i = 0;
+    if (at(i++) !== 0x30)
+        throw new Error('DER: expected SEQUENCE tag (0x30)');
+    // Skip length. Handle short and long form.
+    const lenByte = at(i++);
+    if (lenByte & 0x80) {
+        const lenBytes = lenByte & 0x7f;
+        i += lenBytes;
+    }
+    if (at(i++) !== 0x02)
+        throw new Error('DER: expected INTEGER tag for r');
+    const rLen = at(i++);
+    const rBytes = der.slice(i, i + rLen);
+    i += rLen;
+    if (at(i++) !== 0x02)
+        throw new Error('DER: expected INTEGER tag for s');
+    const sLen = at(i++);
+    const sBytes = der.slice(i, i + sLen);
+    const r = bytesToBigInt(rBytes);
+    const s = bytesToBigInt(sBytes);
+    // Range-validate (audit F-7): a malformed/compromised KMS response with
+    // r/s = 0 or ≥ n is never a valid ECDSA signature — fail closed here
+    // rather than letting a degenerate value flow into recovery.
+    if (r <= 0n || r >= SECP256K1_N || s <= 0n || s >= SECP256K1_N) {
+        throw new Error('DER: r/s out of range (require 0 < r,s < n)');
+    }
+    return { r, s };
+}
+function bytesToBigInt(bytes) {
+    let n = 0n;
+    for (const b of bytes)
+        n = (n << 8n) | BigInt(b);
+    return n;
+}
+export function bigIntTo32Bytes(n) {
+    const out = new Uint8Array(32);
+    let v = n;
+    for (let i = 31; i >= 0; i--) {
+        out[i] = Number(v & 0xffn);
+        v >>= 8n;
+    }
+    return out;
+}
+export function normalizeLowS(s) {
+    return s > SECP256K1_HALF_N ? SECP256K1_N - s : s;
+}
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++)
+        if (a[i] !== b[i])
+            return false;
+    return true;
+}
+export function findRecoveryByte(r, s, digest, knownPubKey65) {
+    const rBytes = bigIntTo32Bytes(r);
+    const sBytes = bigIntTo32Bytes(s);
+    const compact = new Uint8Array(64);
+    compact.set(rBytes, 0);
+    compact.set(sBytes, 32);
+    const attempts = [];
+    for (let recovery = 0; recovery < 2; recovery++) {
+        try {
+            const sig = secp256k1.Signature.fromCompact(compact).addRecoveryBit(recovery);
+            const recovered = sig.recoverPublicKey(digest).toRawBytes(false);
+            attempts.push(`v=${recovery + 27} recovered=${bytesToHex(recovered)}`);
+            if (bytesEqual(recovered, knownPubKey65))
+                return recovery + 27;
+        }
+        catch (e) {
+            attempts.push(`v=${recovery + 27} threw ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    // eslint-disable-next-line no-console
+    console.error('[gcp-kms findRecoveryByte] mismatch:', {
+        digest: bytesToHex(digest),
+        r: bytesToHex(rBytes),
+        s: bytesToHex(sBytes),
+        knownPubKey: bytesToHex(knownPubKey65),
+        attempts,
+    });
+    throw new Error('Recovery byte search failed: neither v=27 nor v=28 recovers the known public key. ' +
+        attempts.join(' | '));
+}
+// ─────────────────────────────────────────────────────────────────────
+// GcpKmsSigner — the public class
+// ─────────────────────────────────────────────────────────────────────
+export class GcpKmsSigner {
+    provider = 'gcp-kms';
+    keyName;
+    serviceAccount;
+    auditSink;
+    cachedToken;
+    cachedPubKey65;
+    cachedAddress;
+    constructor(opts) {
+        const keyName = opts?.cryptoKeyVersionName ?? process.env.GCP_KMS_KEY_NAME;
+        const jsonStr = opts?.serviceAccountJson ?? process.env.GCP_SERVICE_ACCOUNT_JSON;
+        this.auditSink = opts?.auditSink;
+        if (!keyName) {
+            throw new Error('GcpKmsSigner: GCP_KMS_KEY_NAME (projects/<P>/locations/<L>/keyRings/<R>/cryptoKeys/<K>/cryptoKeyVersions/<V>) is required.');
+        }
+        if (!jsonStr) {
+            throw new Error('GcpKmsSigner: GCP_SERVICE_ACCOUNT_JSON (service-account JSON string) is required.');
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(jsonStr);
+        }
+        catch {
+            throw new Error('GcpKmsSigner: GCP_SERVICE_ACCOUNT_JSON is not valid JSON.');
+        }
+        if (!parsed.client_email || !parsed.private_key) {
+            throw new Error('GcpKmsSigner: service-account JSON missing client_email or private_key.');
+        }
+        this.keyName = keyName;
+        this.serviceAccount = parsed;
+    }
+    async getAccessToken() {
+        const now = Math.floor(Date.now() / 1000);
+        if (this.cachedToken && this.cachedToken.expiresAt > now) {
+            return this.cachedToken.accessToken;
+        }
+        this.cachedToken = await fetchAccessToken(this.serviceAccount);
+        return this.cachedToken.accessToken;
+    }
+    async getPublicKeyBytes() {
+        if (this.cachedPubKey65)
+            return this.cachedPubKey65;
+        const token = await this.getAccessToken();
+        const res = await callKms(token, `${this.keyName}/publicKey`);
+        // Algorithm guard: signatures from any other curve (e.g. P-256) won't
+        // recover to an Ethereum-compatible pubkey. Catch the mistake at first
+        // pubkey fetch instead of producing nonsense signatures later.
+        if (res.algorithm !== 'EC_SIGN_SECP256K1_SHA256') {
+            throw new Error(`GcpKmsSigner: key ${this.keyName} has algorithm "${res.algorithm}", but ` +
+                `EC_SIGN_SECP256K1_SHA256 is required for Ethereum-compatible signing. ` +
+                `Recreate with: gcloud kms keys create <NAME> --purpose=asymmetric-signing ` +
+                `--default-algorithm=ec-sign-secp256k1-sha256 --protection-level=hsm. ` +
+                `Note: secp256k1 in GCP requires --protection-level=hsm; Software is not ` +
+                `supported. The Console dropdown greys out secp256k1 when Software is ` +
+                `selected. GCP doesn't allow changing the algorithm or protection level ` +
+                `of an existing key.`);
+        }
+        const spkiDer = pemToDer(res.pem);
+        this.cachedPubKey65 = parseSpkiUncompressedSecp256k1PubKey(spkiDer);
+        return this.cachedPubKey65;
+    }
+    async getSignerAddress() {
+        if (this.cachedAddress)
+            return this.cachedAddress;
+        const pub = await this.getPublicKeyBytes();
+        this.cachedAddress = publicKeyToAddress(pub);
+        return this.cachedAddress;
+    }
+    async signA2AAction(input) {
+        if (input.digest.length !== 32) {
+            throw new Error(`GcpKmsSigner.signA2AAction expects a 32-byte digest; got ${input.digest.length}.`);
+        }
+        const [token, pubKey] = await Promise.all([this.getAccessToken(), this.getPublicKeyBytes()]);
+        const res = await callKms(token, `${this.keyName}:asymmetricSign`, {
+            method: 'POST',
+            body: { digest: { sha256: base64Encode(input.digest) } },
+        });
+        const derBytes = base64Decode(res.signature);
+        const parsed = parseDerEcdsa(derBytes);
+        const s = normalizeLowS(parsed.s);
+        const v = findRecoveryByte(parsed.r, s, input.digest, pubKey);
+        const sig65 = new Uint8Array(65);
+        sig65.set(bigIntTo32Bytes(parsed.r), 0);
+        sig65.set(bigIntTo32Bytes(s), 32);
+        sig65[64] = v;
+        const signerAddress = await this.getSignerAddress();
+        // Audit emit. Per key-custody CLAUDE.md invariant:
+        //   raw sessionId MUST NEVER be logged — hash it.
+        if (this.auditSink) {
+            const ctx = input.auditContext ?? {};
+            try {
+                await this.auditSink.write(buildEvent({
+                    action: 'key-custody.sign',
+                    outcome: 'success',
+                    actor: { type: 'system', id: 'gcp-kms-signer' },
+                    subject: { type: 'sign-digest', id: bytesToHex(input.digest) },
+                    context: {
+                        keyId: this.keyName,
+                        signerAddress,
+                        toolId: ctx.toolId ?? null,
+                        actionId: ctx.actionId ?? null,
+                        sessionHash: ctx.sessionId
+                            ? bytesToHex(keccak_256(new TextEncoder().encode(ctx.sessionId))).slice(0, 18)
+                            : null,
+                    },
+                }));
+            }
+            catch {
+                /* fail-soft */
+            }
+        }
+        return {
+            signature: sig65,
+            keyId: this.keyName,
+            signerAddress,
+        };
+    }
+}
+/**
+ * H7-F.4 / PKG-KEY-CUSTODY-008 closure — derive `keyVersion` from the
+ * GCP encryption response instead of a hardcoded string. The GCP KMS
+ * `encrypt` endpoint returns `name` = the full versioned resource path
+ * (`projects/<P>/locations/<L>/keyRings/<R>/cryptoKeys/<K>/cryptoKeyVersions/<V>`).
+ * The version suffix is what GCP uses to identify the actual key version
+ * that encrypted the ciphertext.
+ *
+ * Previously this class returned `'gcp-kms:v1'` regardless of the actual
+ * rotation state — so on a GCP key rotation (under the same cryptoKey
+ * NAME, different VERSION), any encrypted payload was still tagged with
+ * the meaningless `'gcp-kms:v1'` marker. The `decryptSessionDataKey`
+ * equality check then incorrectly accepted ciphertext from BOTH the old
+ * and the new key version as if they were the same, with no audit trail
+ * of which version produced which.
+ */
+function parseCryptoKeyVersion(responseName) {
+    if (!responseName)
+        return null;
+    const m = /\/cryptoKeyVersions\/(\d+)$/.exec(responseName);
+    return m ? `gcp-kms:v${m[1]}` : null;
+}
+export class GcpKmsProvider {
+    /**
+     * H7-F.4: this default is now ONLY used when the GCP encrypt response
+     * doesn't carry a `name` field (test fixtures + offline mocks). Real
+     * runs derive `keyVersion` from the response per call.
+     */
+    keyVersion = 'gcp-kms:unknown';
+    keyName;
+    serviceAccount;
+    cachedToken;
+    constructor(opts) {
+        const keyName = opts?.cryptoKeyName ?? process.env.GCP_KMS_ENCRYPT_KEY_NAME;
+        const jsonStr = opts?.serviceAccountJson ?? process.env.GCP_SERVICE_ACCOUNT_JSON;
+        if (!keyName) {
+            throw new Error('GcpKmsProvider: GCP_KMS_ENCRYPT_KEY_NAME (projects/<P>/locations/<L>/keyRings/<R>/cryptoKeys/<K>) is required.');
+        }
+        if (!jsonStr) {
+            throw new Error('GcpKmsProvider: GCP_SERVICE_ACCOUNT_JSON (service-account JSON string) is required.');
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(jsonStr);
+        }
+        catch {
+            throw new Error('GcpKmsProvider: GCP_SERVICE_ACCOUNT_JSON is not valid JSON.');
+        }
+        if (!parsed.client_email || !parsed.private_key) {
+            throw new Error('GcpKmsProvider: service-account JSON missing client_email or private_key.');
+        }
+        this.keyName = keyName;
+        this.serviceAccount = parsed;
+    }
+    async getAccessToken() {
+        const now = Math.floor(Date.now() / 1000);
+        if (this.cachedToken && this.cachedToken.expiresAt > now) {
+            return this.cachedToken.accessToken;
+        }
+        this.cachedToken = await fetchAccessToken(this.serviceAccount);
+        return this.cachedToken.accessToken;
+    }
+    async generateSessionDataKey(input) {
+        const plaintextDataKey = new Uint8Array(32);
+        globalThis.crypto.getRandomValues(plaintextDataKey);
+        const aadBytes = canonicalContextBytes(input.aadContext);
+        const token = await this.getAccessToken();
+        const res = await callKms(token, `${this.keyName}:encrypt`, {
+            method: 'POST',
+            body: {
+                plaintext: base64Encode(plaintextDataKey),
+                additionalAuthenticatedData: base64Encode(aadBytes),
+            },
+        });
+        const encryptedDataKey = base64Decode(res.ciphertext);
+        // H7-F.4: derive keyVersion from the response. GCP returns the full
+        // versioned cryptoKeyVersions/<N> resource path in `name`. When
+        // absent (test fixtures), fall back to the legacy 'gcp-kms:unknown'
+        // marker so callers can spot misconfigured mocks.
+        const keyVersion = parseCryptoKeyVersion(res.name) ?? this.keyVersion;
+        return {
+            plaintextDataKey,
+            encryptedDataKey,
+            keyId: this.keyName,
+            keyVersion,
+        };
+    }
+    async decryptSessionDataKey(input) {
+        // H7-F.4: validate the `keyVersion` MARKER shape (must be
+        // 'gcp-kms:v<N>' or 'gcp-kms:unknown'). GCP's decrypt endpoint
+        // itself resolves the actual version from the ciphertext metadata,
+        // so the marker is operational ("which version produced this
+        // payload?") rather than a security gate. A null / arbitrary string
+        // here is a signal of cross-backend confusion — fail fast.
+        if (!/^gcp-kms:(v\d+|unknown)$/.test(input.keyVersion)) {
+            throw new Error(`GcpKmsProvider: input.keyVersion "${input.keyVersion}" doesn't match the expected ` +
+                `'gcp-kms:v<N>' or 'gcp-kms:unknown' shape (H7-F.4).`);
+        }
+        const aadBytes = canonicalContextBytes(input.aadContext);
+        const token = await this.getAccessToken();
+        const res = await callKms(token, `${this.keyName}:decrypt`, {
+            method: 'POST',
+            body: {
+                ciphertext: base64Encode(input.encryptedDataKey),
+                additionalAuthenticatedData: base64Encode(aadBytes),
+            },
+        });
+        return base64Decode(res.plaintext);
+    }
+}
+//# sourceMappingURL=gcp.js.map

package/dist/providers/gcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp.js","sourceRoot":"","sources":["../../src/providers/gcp.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,kEAAkE;AAClE,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,qCAAqC;AACrC,EAAE;AACF,wEAAwE;AACxE,oEAAoE;AACpE,wEAAwE;AACxE,iCAAiC;AACjC,4BAA4B;AAC5B,2CAA2C;AAC3C,2EAA2E;AAC3E,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,kEAAkE;AAClE,4EAA4E;AAC5E,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,+CAA+C;AAE/C,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAgB,MAAM,MAAM,CAAC;AAChD,OAAO,EAAE,UAAU,EAAkB,MAAM,0BAA0B,CAAC;AAEtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAE/C,wEAAwE;AACxE,YAAY;AACZ,wEAAwE;AAExE,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAC/D,MAAM,cAAc,GAAG,0CAA0C,CAAC;AAClE,MAAM,aAAa,GAAG,qCAAqC,CAAC;AAC5D,MAAM,2BAA2B,GAAG,EAAE,CAAC;AACvC,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AACtC,MAAM,gBAAgB,GAAG,WAAW,IAAI,EAAE,CAAC;AAwC3C,wEAAwE;AACxE,uBAAuB;AACvB,wEAAwE;AAExE,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SAC5D,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,wEAAwE;AACxE,+BAA+B;AAC/B,wEAAwE;AAExE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,cAA8B,EAAE,KAAa;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,cAAc,CAAC,YAAY;QAChC,KAAK;QACL,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,IAAI;KAChB,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAElD,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IACpD,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,SAAS,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,OAAO,EACP,SAAS,EACT,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CACnD,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAC7B,GAAG,EACH,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAC7B,CAAC;IACF,OAAO,GAAG,YAAY,IAAI,eAAe,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,cAA8B;IACnE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,cAAc,kBAAkB,CAAC,6CAA6C,CAAC,cAAc,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;IAC1I,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;QACxC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI;KACL,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmD,CAAC;IAClF,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,GAAG,2BAA2B;KACzF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,uBAAuB;AACvB,wEAAwE;AAExE,KAAK,UAAU,OAAO,CACpB,KAAa,EACb,kBAA0B,EAC1B,UAAsD,EAAE,MAAM,EAAE,KAAK,EAAE;IAEvE,MAAM,GAAG,GAAG,GAAG,aAAa,GAAG,kBAAkB,EAAE,CAAC;IACpD,MAAM,IAAI,GAAgB;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE;KACF,CAAC;IACF,IAAI,OAAO,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,oEAAoE;QACpE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,OAAO,kBAAkB,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AAED,wEAAwE;AACxE,oEAAoE;AACpE,wEAAwE;AAExE,MAAM,UAAU,oCAAoC,CAAC,OAAmB;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,8DAA8D;IAC9D,gFAAgF;IAChF,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4DAA4D,OAAO,CAAC,MAAM,QAAQ,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,gFAAgF;YAC9E,WAAW,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,gBAAgB,OAAO,CAAC,MAAM,GAAG,EAAE,GAAG,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAoB;IACrD,sFAAsF;IACtF,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAY,CAAC;AAC/C,CAAC;AAED,wEAAwE;AACxE,uDAAuD;AACvD,wEAAwE;AAExE,MAAM,UAAU,aAAa,CAAC,GAAe;IAC3C,MAAM,EAAE,GAAG,CAAC,GAAW,EAAU,EAAE;QACjC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC3E,2CAA2C;IAC3C,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACxB,IAAI,OAAO,GAAG,IAAI,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAC;QAChC,CAAC,IAAI,QAAQ,CAAC;IAChB,CAAC;IACD,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACtC,CAAC,IAAI,IAAI,CAAC;IACV,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAChC,wEAAwE;IACxE,qEAAqE;IACrE,6DAA6D;IAC7D,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,CAAS,EACT,CAAS,EACT,MAAkB,EAClB,aAAyB;IAEzB,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,GAAG,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC9E,MAAM,SAAS,GAAG,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACjE,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,GAAG,EAAE,cAAc,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACvE,IAAI,UAAU,CAAC,SAAS,EAAE,aAAa,CAAC;gBAAE,OAAO,QAAQ,GAAG,EAAE,CAAC;QACjE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,GAAG,EAAE,UAAU,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,sCAAsC;IACtC,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE;QACpD,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC;QAC1B,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC;QACrB,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC;QACrB,WAAW,EAAE,UAAU,CAAC,aAAa,CAAC;QACtC,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,IAAI,KAAK,CACb,oFAAoF;QAClF,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,kCAAkC;AAClC,wEAAwE;AAExE,MAAM,OAAO,YAAY;IACd,QAAQ,GAAG,SAAkB,CAAC;IACtB,OAAO,CAAS;IAChB,cAAc,CAAiB;IAC/B,SAAS,CAAa;IAC/B,WAAW,CAAe;IAC1B,cAAc,CAAc;IAC5B,aAAa,CAAW;IAEhC,YAAY,IAA4D;QACtE,MAAM,OAAO,GAAG,IAAI,EAAE,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAI,EAAE,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACjF,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,4HAA4H,CAC7H,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAoB,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,YAAY,CAAC,CAAC;QACjF,sEAAsE;QACtE,uEAAuE;QACvE,+DAA+D;QAC/D,IAAI,GAAG,CAAC,SAAS,KAAK,0BAA0B,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,CAAC,OAAO,mBAAmB,GAAG,CAAC,SAAS,SAAS;gBACxE,wEAAwE;gBACxE,4EAA4E;gBAC5E,uEAAuE;gBACvE,0EAA0E;gBAC1E,uEAAuE;gBACvE,yEAAyE;gBACzE,qBAAqB,CACxB,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,cAAc,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAGnB;QACC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,4DAA4D,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;QAE7F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAyB,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,iBAAiB,EAAE;YACzF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE;SACzD,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE9D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAEd,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpD,mDAAmD;QACnD,kDAAkD;QAClD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CACxB,UAAU,CAAC;oBACT,MAAM,EAAE,kBAAkB;oBAC1B,OAAO,EAAE,SAAS;oBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,gBAAgB,EAAE;oBAC/C,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;oBAC9D,OAAO,EAAE;wBACP,KAAK,EAAE,IAAI,CAAC,OAAO;wBACnB,aAAa;wBACb,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;wBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;wBAC9B,WAAW,EAAE,GAAG,CAAC,SAAS;4BACxB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;4BAC9E,CAAC,CAAC,IAAI;qBACT;iBACF,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;QAED,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,IAAI,CAAC,OAAO;YACnB,aAAa;SACd,CAAC;IACJ,CAAC;CACF;AAuCD;;;;;;;;;;;;;;;GAeG;AACH,SAAS,qBAAqB,CAAC,YAAgC;IAC7D,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,CAAC,GAAG,6BAA6B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,OAAO,cAAc;IACzB;;;;OAIG;IACM,UAAU,GAAG,iBAAiB,CAAC;IACvB,OAAO,CAAS;IAChB,cAAc,CAAiB;IACxC,WAAW,CAAe;IAElC,YAAY,IAAkC;QAC5C,MAAM,OAAO,GAAG,IAAI,EAAE,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,EAAE,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAE5B;QAMC,MAAM,gBAAgB,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC5C,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAkB,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,SAAS,EAAE,YAAY,CAAC,gBAAgB,CAAC;gBACzC,2BAA2B,EAAE,YAAY,CAAC,QAAQ,CAAC;aACpD;SACF,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAEtD,oEAAoE;QACpE,gEAAgE;QAChE,oEAAoE;QACpE,kDAAkD;QAClD,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC;QAEtE,OAAO;YACL,gBAAgB;YAChB,gBAAgB;YAChB,KAAK,EAAE,IAAI,CAAC,OAAO;YACnB,UAAU;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAK3B;QACC,0DAA0D;QAC1D,+DAA+D;QAC/D,mEAAmE;QACnE,6DAA6D;QAC7D,oEAAoE;QACpE,2DAA2D;QAC3D,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,CAAC,UAAU,+BAA+B;gBAClF,qDAAqD,CACxD,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAkB,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAChD,2BAA2B,EAAE,YAAY,CAAC,QAAQ,CAAC;aACpD;SACF,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;CACF"}

package/dist/providers/local.d.ts

@@ -0,0 +1,60 @@
+import { hexToBytes, bytesToHex, toHex, type Address, type Hex } from 'viem';
+import type { A2AKeyProvider, KmsAccountBackend } from '../types';
+import { type AuditSink } from '@agenticprimitives/audit';
+export declare class LocalAesProvider implements A2AKeyProvider {
+    readonly keyVersion = "local-v1";
+    private readonly master;
+    constructor(opts?: {
+        sessionSecretHex?: string;
+    });
+    generateSessionDataKey(input: {
+        aadContext: Record<string, string>;
+    }): Promise<{
+        plaintextDataKey: Uint8Array<ArrayBufferLike>;
+        encryptedDataKey: Uint8Array<ArrayBufferLike>;
+        keyId: string;
+        keyVersion: string;
+    }>;
+    decryptSessionDataKey(input: {
+        encryptedDataKey: Uint8Array;
+        aadContext: Record<string, string>;
+        keyId: string;
+        keyVersion: string;
+    }): Promise<Uint8Array<ArrayBufferLike>>;
+    generateMac(input: {
+        canonicalMessage: Uint8Array;
+        service: string;
+        audience: string;
+    }): Promise<{
+        mac: Uint8Array<ArrayBufferLike>;
+        keyId: string;
+    }>;
+}
+export declare class LocalSecp256k1Signer implements KmsAccountBackend {
+    readonly provider: "local-aes";
+    private readonly priv;
+    private readonly addr;
+    private readonly auditSink?;
+    constructor(opts?: {
+        privateKeyHex?: string;
+        auditSink?: AuditSink;
+    });
+    signA2AAction(input: {
+        digest: Uint8Array;
+        auditContext?: {
+            toolId?: string;
+            sessionId?: string;
+            actionId?: string;
+        };
+    }): Promise<{
+        signature: Uint8Array<ArrayBuffer>;
+        keyId: string;
+        signerAddress: `0x${string}`;
+    }>;
+    getSignerAddress(): Promise<Address>;
+    /** Internal: returns the address as a hex string for use by adapters. */
+    addressHex(): Address;
+}
+export type { Address, Hex };
+export { hexToBytes, bytesToHex, toHex };
+//# sourceMappingURL=local.d.ts.map

package/dist/providers/local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/providers/local.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAElE,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAiHtE,qBAAa,gBAAiB,YAAW,cAAc;IACrD,QAAQ,CAAC,UAAU,cAAc;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;gBAExB,IAAI,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE;IAe1C,sBAAsB,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;;;;;;IAiBpE,qBAAqB,CAAC,KAAK,EAAE;QACjC,gBAAgB,EAAE,UAAU,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB;IAmBK,WAAW,CAAC,KAAK,EAAE;QAAE,gBAAgB,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;;;;CAW7F;AAED,qBAAa,oBAAqB,YAAW,iBAAiB;IAC5D,QAAQ,CAAC,QAAQ,EAAG,WAAW,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAU;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAY;gBAE3B,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE;IAQ9D,aAAa,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,UAAU,CAAC;QACnB,YAAY,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3E;;;;;IA8CK,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAI1C,yEAAyE;IACzE,UAAU,IAAI,OAAO;CAGtB;AAaD,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC"}