@appforge-ci/core 0.2.3 → 0.3.1

package/dist/schemas.js

@@ -1,4 +1,7 @@
 import { z } from "zod";
+import { ENFORCEMENT_LEVELS, MAX_VPN_FEATURES, VPN_FEATURE_ID_PATTERN, VPN_HOST_POLICIES } from "./agent-readiness.js";
+import { looksLikeSshGitRemote, MAX_KNOWN_HOSTS_LINE_LENGTH, parseGitRemote } from "./vpn-ssh.js";
+import { VPN_COMPLIANCE_MODES, VPN_EGRESS_MAX_CUSTOM_RULES, VPN_EGRESS_MAX_PRESETS, validateEgressSettings } from "./vpn-egress-presets.js";
 export const platformSchema = z.enum(["ios", "android", "flutter", "react-native"]);
 export const appforgeWorkflowSchema = z.object({
     name: z.string().optional(),
@@ -188,22 +191,58 @@ export const resetPasswordSchema = z.object({
 // transport ever reaches a real `git clone` on shared, multi-tenant
 // infrastructure (`agents.ts`'s own docblock: "the fleet is a shared
 // pool... not one Mac mini per customer"). This product only ever
-// integrates public GitHub repos over HTTPS (no SSH-deploy-key feature
-// exists anywhere in this codebase), so restricting to exactly `https:`
-// isn't just "safe enough," it's the only scheme any legitimate caller
-// ever needs. See `packages/agent/src/lib/builder.ts`'s own `runScript`
-// git-clone call for the matching defense-in-depth restriction applied
-// at the point of the actual clone, in case a repoUrl ever reaches the
+// integrates public GitHub repos over HTTPS, and a private git server only
+// through a customer's site-to-site VPN tunnel (see below), so the set of
+// transports is exactly those two. See `packages/agent/src/lib/builder.ts`'s own
+// `runScript` git-clone call for the matching defense-in-depth restriction
+// applied at the point of the actual clone, in case a repoUrl ever reaches the
 // agent by some path other than this schema.
-const repoUrlSchema = z
-    .string()
-    .url()
-    .refine((v) => new URL(v).protocol === "https:", "must be an https:// URL — no other transport (file:, ext:, ssh:, git:, ...) is supported");
+//
+// Regulated-VPN program, PR-G: an `ssh://user@host[:port]/path` or scp-like
+// `user@host:path` remote is now SYNTACTICALLY accepted (strict grammar, see
+// `parseGitRemote` in vpn-ssh.ts: a user is required, the host is a DNS name or
+// IPv4 address, nothing an ssh client could read as an option or a command).
+// That is only the shape check. Whether THIS app may use one is a cross-resource
+// rule this schema cannot know and the routes enforce (`POST /orgs/:orgId/apps`,
+// `PATCH /apps/:appId`): the app must use the org's VPN tunnel, the tunnel must
+// not be disabled and must have pinned SSH host keys, and the change needs an org
+// owner/admin. The lease re-checks all of it, and the agent clones an ssh remote
+// only through the build's pinned-host-key ssh config (never directly, never over
+// https instead). `file:`, `git:`, `ext::`, plain `http:` and every other scheme
+// stay refused.
+const repoUrlSchema = z.string().superRefine((v, ctx) => {
+    if (looksLikeSshGitRemote(v)) {
+        if (parseGitRemote(v)?.kind !== "ssh") {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "not a valid ssh remote: use ssh://user@host[:port]/path or user@host:path (a user name is required; the host is a DNS name or IPv4 address)",
+            });
+        }
+        return;
+    }
+    let protocol = null;
+    try {
+        protocol = new URL(v).protocol;
+    }
+    catch {
+        ctx.addIssue({ code: z.ZodIssueCode.invalid_string, validation: "url", message: "Invalid url" });
+        return;
+    }
+    if (protocol !== "https:") {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "must be an https:// URL, or an ssh remote for an app that builds through a VPN tunnel with SSH host keys — no other transport (file:, ext:, git:, http:, ...) is supported",
+        });
+    }
+});
 export const createAppSchema = z.object({
     name: z.string().min(1).max(255, "must be at most 255 characters"),
     platform: platformSchema,
     repoUrl: repoUrlSchema,
     defaultBranch: z.string().min(1).default("main"),
+    /** Build through the org's site-to-site VPN tunnel from the start. Needed to create an app with an ssh
+     *  `repoUrl` (the route requires it, and an owner/admin); the same rules as `PATCH /apps/:appId`'s `useVpn`. */
+    useVpn: z.boolean().optional(),
 });
 // `platform` is deliberately excluded — see updateApp's own docblock in
 // packages/db/src/apps.ts. Every field optional; the route only applies
@@ -456,6 +495,20 @@ export const agentHeartbeatSchema = z.object({
      *  predates the VPN feature omits it and stays `vpnCapable = 0`, so it
      *  is never offered a VPN build. */
     vpnCapable: z.boolean().optional(),
+    /** VPN features this agent can enforce (migrations/0043) — ids matching
+     *  `VPN_FEATURE_ID_PATTERN`, at most `MAX_VPN_FEATURES`. Like `vpnCapable`
+     *  the stored value is derived from THIS heartbeat alone: omitting it (an
+     *  older agent) means "no features", never "keep the last value". A
+     *  malformed list is rejected (400) rather than half-trusted. */
+    vpnFeatures: z.array(z.string().regex(VPN_FEATURE_ID_PATTERN)).max(MAX_VPN_FEATURES).optional(),
+    /** Build-isolation level this agent enforces (migrations/0043). Same
+     *  omit-means-default (`none`) rule as `vpnFeatures`. */
+    enforcementLevel: z.enum(ENFORCEMENT_LEVELS).optional(),
+    /** Whether a GitHub Actions self-hosted runner shares this machine
+     *  (migrations/0047). Like `vpnFeatures`, stored from THIS heartbeat alone:
+     *  omitted (an older agent, or a check that failed) means "unknown", never
+     *  "keep the last value", and unknown refuses a dedicated host. */
+    coHostedRunner: z.boolean().optional(),
 });
 // `POST /builds/:buildId/logs` (apps/admin-api/src/routes/agents.ts) —
 // one call per flushed line/burst from `packages/agent/src/lib/
@@ -543,6 +596,21 @@ export const setAgentRemoteControlSchema = z.object({
 export const setAgentVpnApprovedSchema = z.object({
     approved: z.boolean(),
 });
+/** `PATCH /orgs/:orgId/agents/:agentId/dedicated` (apps/admin-api) — the
+ *  only way `Agent.dedicatedOrgId` ever changes (migrations/0043). An
+ *  operator taint, deliberately not in agentHeartbeatSchema/agentEnrollSchema:
+ *  an agent must never be able to widen or lift its own restriction. `null`
+ *  clears it (the Mac goes back to being shared). */
+export const setAgentDedicatedOrgSchema = z.object({
+    dedicatedOrgId: z.string().min(1).max(128).nullable(),
+});
+/** `PATCH /orgs/:orgId/vpn-hosts/:tunnelOrgId/policy` (apps/admin-api, platform
+ *  admins only) — the only way `VpnTunnel.hostPolicy` ever changes
+ *  (migrations/0047). Deliberately not in `updateVpnTunnelSchema`: an org
+ *  admin must not be able to loosen the placement the operator set. */
+export const setVpnHostPolicySchema = z.object({
+    hostPolicy: z.enum(VPN_HOST_POLICIES),
+});
 /** `PATCH /orgs/:orgId/agents/:agentId/device-stream-hostname` (apps/
  *  admin-api)'s request body — `hostname: null` clears it, going back
  *  to the global DEVICE_STREAM_WS_URL fallback (see migrations/0034's
@@ -569,7 +637,45 @@ export const startVncSessionSchema = z.object({
 // and the route all apply the identical checks, with every problem
 // reported at once.
 const vpnNameSchema = z.string().min(1).max(64, "must be at most 64 characters");
-export const createVpnTunnelSchema = z.object({
+/**
+ * The egress-policy fields of a tunnel (migrations/0045), shared by create and
+ * update. The field shapes here are shape and size bounds only; which preset ids
+ * exist and which hosts are acceptable (no bare `*`, no IP literals ...) is
+ * `validateEgressSettings` (vpn-egress-presets.ts), which `refineVpnEgressSettings`
+ * applies on top so a caller that relies on these schemas alone cannot accept
+ * what the route would refuse. Whether `regulated` may be set at all is the
+ * route's call (an operator flag), not the schema's.
+ */
+const vpnEgressSettingsFields = {
+    /** `regulated` needs `strictEgress`, and the operator's REGULATED_VPN_ENABLED flag. */
+    complianceMode: z.enum(VPN_COMPLIANCE_MODES).optional(),
+    strictEgress: z.boolean().optional(),
+    /** Preset ids; replaces the list. */
+    egressPresets: z.array(z.string().min(1).max(64)).max(VPN_EGRESS_MAX_PRESETS).optional(),
+    /** Custom hosts (exact or `*.suffix`, port 443 unless `ports` says otherwise); replaces the list. */
+    egressAllow: z
+        .array(z.object({
+        host: z.string().min(1).max(253),
+        ports: z.array(z.number().int().min(1).max(65535)).max(16).optional(),
+    }))
+        .max(VPN_EGRESS_MAX_CUSTOM_RULES)
+        .optional(),
+};
+/** Adds `validateEgressSettings`' host/preset/merge rules to a tunnel schema. Problem strings never echo a rejected value. */
+function refineVpnEgressSettings(input, ctx) {
+    for (const message of validateEgressSettings({ egressPresets: input.egressPresets, egressAllow: input.egressAllow })) {
+        const field = message.startsWith("egressPresets") ? "egressPresets" : message.startsWith("egressAllow") ? "egressAllow" : null;
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message, path: field ? [field] : [] });
+    }
+}
+/**
+ * The shape-only form of the create/update bodies, WITHOUT the egress rules. The
+ * API route parses with these and then runs `resolveEgressChange`, which applies
+ * the same `validateEgressSettings` but answers with a structured 400 listing
+ * every problem (`errors`) rather than a generic schema error. Anything else
+ * should use `createVpnTunnelSchema` / `updateVpnTunnelSchema` below.
+ */
+export const createVpnTunnelBodySchema = z.object({
     name: vpnNameSchema,
     gatewayEndpoint: z.string().min(1).max(300),
     gatewayPublicKey: z.string().min(1).max(64),
@@ -582,8 +688,9 @@ export const createVpnTunnelSchema = z.object({
     /** Lab mode — allow a private (RFC1918/CGNAT) gateway endpoint. Setting it
      *  `true` is platform-admin only (enforced by the route, not here). */
     allowPrivateEndpoint: z.boolean().optional(),
+    ...vpnEgressSettingsFields,
 });
-export const updateVpnTunnelSchema = z.object({
+export const updateVpnTunnelBodySchema = z.object({
     name: vpnNameSchema.optional(),
     gatewayEndpoint: z.string().min(1).max(300).optional(),
     gatewayPublicKey: z.string().min(1).max(64).optional(),
@@ -598,6 +705,26 @@ export const updateVpnTunnelSchema = z.object({
      *  instead of queueing); `true` re-enables it, back to `pending` until
      *  the next handshake proves it works. */
     enabled: z.boolean().optional(),
+    ...vpnEgressSettingsFields,
+});
+/** The create body, with the egress rules (bare `*`, IP literals, unknown presets, merged port limit) enforced too. */
+export const createVpnTunnelSchema = createVpnTunnelBodySchema.superRefine(refineVpnEgressSettings);
+/** The update body, with the egress rules enforced too. */
+export const updateVpnTunnelSchema = updateVpnTunnelBodySchema.superRefine(refineVpnEgressSettings);
+/**
+ * The strict-egress allow-list (`VpnJobConfig.egress`; docs in vpn-egress.ts).
+ * Field-level shape and size bounds only; the host rules (no IP literals, no
+ * bare `*`, no trailing dot ...) live in `validateVpnEgressPolicy` so the
+ * server, the CLI and the agent apply the identical checks and report every
+ * problem at once. Tunnel settings (PR-D) will embed this.
+ */
+export const vpnEgressPolicySchema = z.object({
+    allow: z
+        .array(z.object({
+        host: z.string().min(1).max(253),
+        ports: z.array(z.number().int().min(1).max(65535)).max(16).optional(),
+    }))
+        .max(512),
 });
 /** `POST /agents/vpn/report` (apps/admin-api) — what the agent that holds
  *  an org's tunnel for a build tells the control plane about it. The
@@ -609,4 +736,13 @@ export const reportVpnEventSchema = z.object({
     event: z.enum(["tunnel_up", "tunnel_down", "handshake_ok", "handshake_failed"]),
     detail: z.string().max(300).optional(),
 });
+/**
+ * `PUT /orgs/:orgId/vpn/ssh-hosts` (regulated-VPN program, PR-G): replaces the
+ * tunnel's pinned SSH host keys. Only the SHAPE is checked here (bounded array of
+ * bounded strings); the content rules, with their per-line error messages, are
+ * `validateKnownHostsInput` in vpn-ssh.ts, run by the route. `[]` clears them.
+ */
+export const setVpnSshHostsSchema = z.object({
+    knownHosts: z.array(z.string().max(MAX_KNOWN_HOSTS_LINE_LENGTH * 2)).max(512),
+});
 //# sourceMappingURL=schemas.js.map

package/dist/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAEpF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC;SACX,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACtC,CAAC;SACD,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3D,CAAC;SACD,QAAQ,EAAE;IACb,OAAO,EAAE,CAAC;SACP,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1B,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;IACT,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC;;;sEAGkE;IAClE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,6EAA6E;IAC7E,GAAG,EAAE,CAAC;SACH,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;QACzC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACtC,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,iDAAiD;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,cAAc;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;QACnF,OAAO,EAAE,mCAAmC;KAC7C,CAAC;CACH,CAAC,CAAC;AAEH,0EAA0E;AAC1E,sEAAsE;AACtE,qDAAqD;AACrD,yEAAyE;AACzE,uEAAuE;AACvE,wEAAwE;AACxE,sEAAsE;AACtE,mEAAmE;AACnE,yDAAyD;AACzD,qEAAqE;AACrE,mEAAmE;AACnE,8DAA8D;AAC9D,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,wDAAwD;AACxD,iEAAiE;AACjE,0BAA0B;AAC1B,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,CAAC;AAE5D,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,wEAAwE;AACxE,kEAAkE;AAClE,gEAAgE;AAChE,+DAA+D;AAC/D,yEAAyE;AACzE,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,yCAAyC,CAAC;IACvE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC,QAAQ,EAAE;IAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC;CACtE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B;;;uEAGmE;IACnE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B;;yCAEqC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH;;;;;;;;;;;;uEAYuE;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH;;;4CAG4C;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;4CAe4C;AAC5C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH;;;;;wDAKwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,yCAAyC,CAAC;CAC3E,CAAC,CAAC;AAEH;;;;;gEAKgE;AAChE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,WAAW;CACnB,CAAC,CAAC;AAEH;;;4BAG4B;AAC5B,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,yCAAyC,CAAC;CAC3E,CAAC,CAAC;AAEH,yEAAyE;AACzE,kEAAkE;AAClE,gEAAgE;AAChE,iEAAiE;AACjE,mEAAmE;AACnE,8CAA8C;AAC9C,0EAA0E;AAC1E,kEAAkE;AAClE,kEAAkE;AAClE,iEAAiE;AACjE,uEAAuE;AACvE,2DAA2D;AAC3D,+DAA+D;AAC/D,sEAAsE;AACtE,kEAAkE;AAClE,kEAAkE;AAClE,uEAAuE;AACvE,uEAAuE;AACvE,qEAAqE;AACrE,mEAAmE;AACnE,sEAAsE;AACtE,+DAA+D;AAC/D,oEAAoE;AACpE,qEAAqE;AACrE,kEAAkE;AAClE,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,6CAA6C;AAC7C,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,EAAE;KACR,GAAG,EAAE;KACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,0FAA0F,CAAC,CAAC;AAE/I,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC;IAClE,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,aAAa;IACtB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACjD,CAAC,CAAC;AAEH,wEAAwE;AACxE,wEAAwE;AACxE,2CAA2C;AAC3C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC,QAAQ,EAAE;IAC7E,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C;;iEAE6D;IAC7D,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,wEAAwE;AACxE,mEAAmE;AACnE,qEAAqE;AACrE,6DAA6D;AAC7D,qEAAqE;AACrE,sDAAsD;AACtD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC,QAAQ,EAAE;IAC7E,qEAAqE;IACrE,sEAAsE;IACtE,iEAAiE;IACjE,gEAAgE;IAChE,sEAAsE;IACtE,8DAA8D;IAC9D,0DAA0D;IAC1D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,yEAAyE;AACzE,uEAAuE;AACvE,yDAAyD;AACzD,uEAAuE;AACvE,iEAAiE;AACjE,qEAAqE;AACrE,uEAAuE;AACvE,mEAAmE;AACnE,mEAAmE;AACnE,oEAAoE;AACpE,kDAAkD;AAClD,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,gEAAgE;AAChE,sEAAsE;AACtE,sEAAsE;AACtE,sEAAsE;AACtE,oEAAoE;AACpE,oEAAoE;AACpE,oEAAoE;AACpE,iEAAiE;AACjE,kEAAkE;AAClE,iEAAiE;AACjE,kEAAkE;AAClE,qEAAqE;AACrE,sEAAsE;AACtE,gEAAgE;AAChE,WAAW;AACX,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,qEAAqE;AACrE,8DAA8D;AAC9D,sEAAsE;AACtE,kEAAkE;AAClE,8DAA8D;AAC9D,qEAAqE;AACrE,uEAAuE;AACvE,uEAAuE;AACvE,kEAAkE;AAClE,qEAAqE;AACrE,kEAAkE;AAClE,iEAAiE;AACjE,sEAAsE;AACtE,mDAAmD;AACnD,oEAAoE;AACpE,qEAAqE;AACrE,qEAAqE;AACrE,iEAAiE;AACjE,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,uEAAuE;AACvE,6DAA6D;AAC7D,sEAAsE;AACtE,+DAA+D;AAC/D,gEAAgE;AAChE,sEAAsE;AACtE,kEAAkE;AAClE,mEAAmE;AACnE,kEAAkE;AAClE,2DAA2D;AAC3D,uEAAuE;AACvE,uEAAuE;AACvE,iEAAiE;AACjE,gEAAgE;AAChE,kEAAkE;AAClE,oEAAoE;AACpE,uEAAuE;AACvE,qEAAqE;AACrE,2CAA2C;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,oEAAoE;IACpE,qEAAqE;IACrE,6DAA6D;IAC7D,kEAAkE;IAClE,oEAAoE;IACpE,sEAAsE;IACtE,mDAAmD;IACnD,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC;SAC1C,KAAK,CAAC,0BAA0B,EAAE,uFAAuF,CAAC;IAC7H,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,gJAAgJ,CAAC;SACxJ,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,+IAA+I,CAAC;CACrL,CAAC,CAAC;AAEH,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,mEAAmE;AACnE,gEAAgE;AAChE,yEAAyE;AACzE,8CAA8C;AAC9C,uEAAuE;AACvE,uEAAuE;AACvE,qEAAqE;AACrE,yDAAyD;AACzD,uEAAuE;AACvE,mEAAmE;AACnE,wEAAwE;AACxE,mBAAmB;AACnB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,qBAAqB,EAAE,wBAAwB,CAAU,CAAC;AAI3G,uDAAuD;AACvD,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,sEAAsE;AACtE,iCAAiC;AACjC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAChC,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,gJAAgJ,CAAC;QACzJ,gEAAgE;QAChE,kEAAkE;QAClE,kEAAkE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;SAChE,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,6FAA6F,CAAC;CACnI,CAAC,CAAC;AAEH,kEAAkE;AAClE,4DAA4D;AAC5D,kEAAkE;AAClE,mEAAmE;AACnE,oEAAoE;AACpE,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,0CAA0C;AAC1C,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAClD,MAAM,cAAc,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClE,MAAM,wBAAwB,GAAG,uDAAuD,CAAC;AAEzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,wBAAwB,CAAC;IACvH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC;SAC1C,MAAM,CAAC,cAAc,EAAE,wBAAwB,CAAC;SAChD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,qEAAqE;IACrE,wEAAwE;IACxE,oEAAoE;IACpE,qEAAqE;IACrE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,wEAAwE;IACxE,oEAAoE;IACpE,mEAAmE;IACnE,+DAA+D;IAC/D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,qEAAqE;IACrE,+DAA+D;IAC/D,2CAA2C;IAC3C,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAClD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,sEAAsE;IACtE,2DAA2D;IAC3D,oEAAoE;IACpE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,kEAAkE;IAClE,4EAA4E;IAC5E,mEAAmE;IACnE,mEAAmE;IACnE,uEAAuE;IACvE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,kEAAkE;IAClE,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,iDAAiD;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C;;2EAEuE;IACvE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C;;;;wCAIoC;IACpC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,uEAAuE;AACvE,gEAAgE;AAChE,+DAA+D;AAC/D,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,6DAA6D;AAC7D,oDAAoD;AACpD,qEAAqE;AACrE,sEAAsE;AACtE,yEAAyE;AACzE,kEAAkE;AAClE,2BAA2B;AAC3B,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,qBAAqB,CAAC;IAC7D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACvC,SAAS,EAAE,CAAC;SACT,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;KACvB,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;IACd,0EAA0E;IAC1E,0EAA0E;IAC1E,gDAAgD;IAChD,GAAG,EAAE,CAAC;SACH,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACzC,CAAC;SACD,QAAQ,EAAE;IACb,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,4BAA4B;IAC5B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAEH,uEAAuE;AACvE,wEAAwE;AACxE,kEAAkE;AAClE,yEAAyE;AACzE,iEAAiE;AACjE,iEAAiE;AACjE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC3F,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;CAClE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAC1C,CAAC,CAAC;AAEH;;;;;oBAKoB;AACpB,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAEH;;;;2EAI2E;AAC3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;CACtB,CAAC,CAAC;AAEH;;;;;oEAKoE;AACpE,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH;;;;;;oDAMoD;AACpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,yEAAyE;AACzE,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,mEAAmE;AACnE,oBAAoB;AACpB,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;AAEjF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,aAAa;IACnB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1D,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtE;+DAC2D;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD;2EACuE;IACvE,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE;IAC9B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtE,8DAA8D;IAC9D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1D,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,4EAA4E;IAC5E,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5C;;8CAE0C;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH;;;;gEAIgE;AAChE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAC/E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC"}
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACvH,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAE5I,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAEpF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC;SACX,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACtC,CAAC;SACD,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3D,CAAC;SACD,QAAQ,EAAE;IACb,OAAO,EAAE,CAAC;SACP,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1B,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;IACT,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC;;;sEAGkE;IAClE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,6EAA6E;IAC7E,GAAG,EAAE,CAAC;SACH,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;QACzC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACtC,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,iDAAiD;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,cAAc;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;QACnF,OAAO,EAAE,mCAAmC;KAC7C,CAAC;CACH,CAAC,CAAC;AAEH,0EAA0E;AAC1E,sEAAsE;AACtE,qDAAqD;AACrD,yEAAyE;AACzE,uEAAuE;AACvE,wEAAwE;AACxE,sEAAsE;AACtE,mEAAmE;AACnE,yDAAyD;AACzD,qEAAqE;AACrE,mEAAmE;AACnE,8DAA8D;AAC9D,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,wDAAwD;AACxD,iEAAiE;AACjE,0BAA0B;AAC1B,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,CAAC;AAE5D,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,wEAAwE;AACxE,kEAAkE;AAClE,gEAAgE;AAChE,+DAA+D;AAC/D,yEAAyE;AACzE,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,yCAAyC,CAAC;IACvE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC,QAAQ,EAAE;IAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC;CACtE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B;;;uEAGmE;IACnE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B;;yCAEqC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH;;;;;;;;;;;;uEAYuE;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH;;;4CAG4C;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;4CAe4C;AAC5C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH;;;;;wDAKwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,yCAAyC,CAAC;CAC3E,CAAC,CAAC;AAEH;;;;;gEAKgE;AAChE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,WAAW;CACnB,CAAC,CAAC;AAEH;;;4BAG4B;AAC5B,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,yCAAyC,CAAC;CAC3E,CAAC,CAAC;AAEH,yEAAyE;AACzE,kEAAkE;AAClE,gEAAgE;AAChE,iEAAiE;AACjE,mEAAmE;AACnE,8CAA8C;AAC9C,0EAA0E;AAC1E,kEAAkE;AAClE,kEAAkE;AAClE,iEAAiE;AACjE,uEAAuE;AACvE,2DAA2D;AAC3D,+DAA+D;AAC/D,sEAAsE;AACtE,kEAAkE;AAClE,kEAAkE;AAClE,uEAAuE;AACvE,uEAAuE;AACvE,qEAAqE;AACrE,mEAAmE;AACnE,sEAAsE;AACtE,+DAA+D;AAC/D,oEAAoE;AACpE,qEAAqE;AACrE,kEAAkE;AAClE,2EAA2E;AAC3E,0EAA0E;AAC1E,iFAAiF;AACjF,2EAA2E;AAC3E,+EAA+E;AAC/E,6CAA6C;AAC7C,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,gFAAgF;AAChF,6EAA6E;AAC7E,iFAAiF;AACjF,iFAAiF;AACjF,gFAAgF;AAChF,kFAAkF;AAClF,iFAAiF;AACjF,kFAAkF;AAClF,iFAAiF;AACjF,gBAAgB;AAChB,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACtD,IAAI,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;YACtC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,6IAA6I;aACvJ,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,cAAc,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;QACjG,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,4KAA4K;SACtL,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC;IAClE,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,aAAa;IACtB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAChD;oHACgH;IAChH,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,wEAAwE;AACxE,wEAAwE;AACxE,2CAA2C;AAC3C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC,QAAQ,EAAE;IAC7E,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C;;iEAE6D;IAC7D,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,wEAAwE;AACxE,mEAAmE;AACnE,qEAAqE;AACrE,6DAA6D;AAC7D,qEAAqE;AACrE,sDAAsD;AACtD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC,QAAQ,EAAE;IAC7E,qEAAqE;IACrE,sEAAsE;IACtE,iEAAiE;IACjE,gEAAgE;IAChE,sEAAsE;IACtE,8DAA8D;IAC9D,0DAA0D;IAC1D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,yEAAyE;AACzE,uEAAuE;AACvE,yDAAyD;AACzD,uEAAuE;AACvE,iEAAiE;AACjE,qEAAqE;AACrE,uEAAuE;AACvE,mEAAmE;AACnE,mEAAmE;AACnE,oEAAoE;AACpE,kDAAkD;AAClD,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,gEAAgE;AAChE,sEAAsE;AACtE,sEAAsE;AACtE,sEAAsE;AACtE,oEAAoE;AACpE,oEAAoE;AACpE,oEAAoE;AACpE,iEAAiE;AACjE,kEAAkE;AAClE,iEAAiE;AACjE,kEAAkE;AAClE,qEAAqE;AACrE,sEAAsE;AACtE,gEAAgE;AAChE,WAAW;AACX,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,qEAAqE;AACrE,8DAA8D;AAC9D,sEAAsE;AACtE,kEAAkE;AAClE,8DAA8D;AAC9D,qEAAqE;AACrE,uEAAuE;AACvE,uEAAuE;AACvE,kEAAkE;AAClE,qEAAqE;AACrE,kEAAkE;AAClE,iEAAiE;AACjE,sEAAsE;AACtE,mDAAmD;AACnD,oEAAoE;AACpE,qEAAqE;AACrE,qEAAqE;AACrE,iEAAiE;AACjE,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,uEAAuE;AACvE,6DAA6D;AAC7D,sEAAsE;AACtE,+DAA+D;AAC/D,gEAAgE;AAChE,sEAAsE;AACtE,kEAAkE;AAClE,mEAAmE;AACnE,kEAAkE;AAClE,2DAA2D;AAC3D,uEAAuE;AACvE,uEAAuE;AACvE,iEAAiE;AACjE,gEAAgE;AAChE,kEAAkE;AAClE,oEAAoE;AACpE,uEAAuE;AACvE,qEAAqE;AACrE,2CAA2C;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,oEAAoE;IACpE,qEAAqE;IACrE,6DAA6D;IAC7D,kEAAkE;IAClE,oEAAoE;IACpE,sEAAsE;IACtE,mDAAmD;IACnD,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC;SAC1C,KAAK,CAAC,0BAA0B,EAAE,uFAAuF,CAAC;IAC7H,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,gJAAgJ,CAAC;SACxJ,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,+IAA+I,CAAC;CACrL,CAAC,CAAC;AAEH,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,mEAAmE;AACnE,gEAAgE;AAChE,yEAAyE;AACzE,8CAA8C;AAC9C,uEAAuE;AACvE,uEAAuE;AACvE,qEAAqE;AACrE,yDAAyD;AACzD,uEAAuE;AACvE,mEAAmE;AACnE,wEAAwE;AACxE,mBAAmB;AACnB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,qBAAqB,EAAE,wBAAwB,CAAU,CAAC;AAI3G,uDAAuD;AACvD,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,sEAAsE;AACtE,iCAAiC;AACjC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAChC,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,gJAAgJ,CAAC;QACzJ,gEAAgE;QAChE,kEAAkE;QAClE,kEAAkE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;SAChE,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,6FAA6F,CAAC;CACnI,CAAC,CAAC;AAEH,kEAAkE;AAClE,4DAA4D;AAC5D,kEAAkE;AAClE,mEAAmE;AACnE,oEAAoE;AACpE,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,0CAA0C;AAC1C,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAClD,MAAM,cAAc,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClE,MAAM,wBAAwB,GAAG,uDAAuD,CAAC;AAEzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,wBAAwB,CAAC;IACvH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC;SAC1C,MAAM,CAAC,cAAc,EAAE,wBAAwB,CAAC;SAChD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,qEAAqE;IACrE,wEAAwE;IACxE,oEAAoE;IACpE,qEAAqE;IACrE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,wEAAwE;IACxE,oEAAoE;IACpE,mEAAmE;IACnE,+DAA+D;IAC/D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,qEAAqE;IACrE,+DAA+D;IAC/D,2CAA2C;IAC3C,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAClD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,sEAAsE;IACtE,2DAA2D;IAC3D,oEAAoE;IACpE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,kEAAkE;IAClE,4EAA4E;IAC5E,mEAAmE;IACnE,mEAAmE;IACnE,uEAAuE;IACvE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,kEAAkE;IAClE,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,iDAAiD;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C;;2EAEuE;IACvE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C;;;;wCAIoC;IACpC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;qEAIiE;IACjE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAC/F;6DACyD;IACzD,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACvD;;;uEAGmE;IACnE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,uEAAuE;AACvE,gEAAgE;AAChE,+DAA+D;AAC/D,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,6DAA6D;AAC7D,oDAAoD;AACpD,qEAAqE;AACrE,sEAAsE;AACtE,yEAAyE;AACzE,kEAAkE;AAClE,2BAA2B;AAC3B,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,qBAAqB,CAAC;IAC7D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACvC,SAAS,EAAE,CAAC;SACT,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;KACvB,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;IACd,0EAA0E;IAC1E,0EAA0E;IAC1E,gDAAgD;IAChD,GAAG,EAAE,CAAC;SACH,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACzC,CAAC;SACD,QAAQ,EAAE;IACb,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,4BAA4B;IAC5B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAEH,uEAAuE;AACvE,wEAAwE;AACxE,kEAAkE;AAClE,yEAAyE;AACzE,iEAAiE;AACjE,iEAAiE;AACjE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC3F,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;CAClE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAC1C,CAAC,CAAC;AAEH;;;;;oBAKoB;AACpB,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAEH;;;;2EAI2E;AAC3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;CACtB,CAAC,CAAC;AAEH;;;;qDAIqD;AACrD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH;;;uEAGuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;CACtC,CAAC,CAAC;AAEH;;;;;oEAKoE;AACpE,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH;;;;;;oDAMoD;AACpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,yEAAyE;AACzE,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,mEAAmE;AACnE,oBAAoB;AACpB,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;AAEjF;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAAG;IAC9B,uFAAuF;IACvF,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IACvD,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACpC,qCAAqC;IACrC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IACxF,qGAAqG;IACrG,WAAW,EAAE,CAAC;SACX,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAChC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;KACtE,CAAC,CACH;SACA,GAAG,CAAC,2BAA2B,CAAC;SAChC,QAAQ,EAAE;CACd,CAAC;AAEF,8HAA8H;AAC9H,SAAS,uBAAuB,CAC9B,KAAyD,EACzD,GAAoB;IAEpB,KAAK,MAAM,OAAO,IAAI,sBAAsB,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACrH,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/H,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,aAAa;IACnB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1D,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtE;+DAC2D;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD;2EACuE;IACvE,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5C,GAAG,uBAAuB;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE;IAC9B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtE,8DAA8D;IAC9D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1D,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,4EAA4E;IAC5E,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5C;;8CAE0C;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,GAAG,uBAAuB;CAC3B,CAAC,CAAC;AAEH,uHAAuH;AACvH,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;AAEpG,2DAA2D;AAC3D,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;AAEpG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,EAAE,CAAC;SACL,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAChC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;KACtE,CAAC,CACH;SACA,GAAG,CAAC,GAAG,CAAC;CACZ,CAAC,CAAC;AAEH;;;;gEAIgE;AAChE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAC/E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,2BAA2B,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAC9E,CAAC,CAAC"}

package/dist/ssh-deploy-key.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Per-app git deploy keys (regulated-VPN program, PR-G).
+ *
+ * AppForge generates the key pair SERVER-SIDE (Ed25519, WebCrypto) so the
+ * customer never has to hand over a private key: they get only the PUBLIC half,
+ * to install as a read-only deploy key on their git server. The private half is
+ * stored encrypted (the same AES-GCM envelope as tunnel keys and app secrets),
+ * decrypted only by the lease-job Worker for the one build that needs it, and
+ * handed to the agent, which loads it into a per-build ssh-agent over stdin
+ * (packages/agent/src/lib/vpn-ssh.ts). It is never shown, logged or audited.
+ *
+ * Why this file serialises OpenSSH's own private-key format rather than PKCS#8:
+ * `ssh-add` and `ssh` read PKCS#8 only for some key types and builds; the
+ * `openssh-key-v1` container is what `ssh-keygen` writes and every OpenSSH
+ * release since 6.5 reads. It is small (PROTOCOL.key in the OpenSSH sources):
+ *
+ *   "openssh-key-v1\0"
+ *   string ciphername ("none"), string kdfname ("none"), string kdfoptions ("")
+ *   uint32 number-of-keys (1)
+ *   string public key blob   = string "ssh-ed25519", string <32-byte public key>
+ *   string private section   = uint32 check, uint32 check (equal, a decryption sanity
+ *                              check), string "ssh-ed25519", string <public key>,
+ *                              string <seed || public key> (64 bytes), string comment,
+ *                              padding 1,2,3,... to a multiple of the cipher block size (8)
+ *
+ * base64 of that, wrapped at 70 columns, between the OPENSSH PRIVATE KEY armor.
+ * The tests prove it against the real `ssh-keygen -y` and `ssh-add`.
+ */
+/** The SSH wire-format public key blob of an Ed25519 key. */
+export declare function ed25519PublicBlob(publicKey: Uint8Array): Uint8Array;
+/** `ssh-ed25519 <base64> <comment>`: the line a git server's deploy-key form takes. */
+export declare function formatOpenSshPublicKey(publicKey: Uint8Array, comment: string): string;
+/**
+ * Serialises an unencrypted Ed25519 key as an `openssh-key-v1` PEM.
+ * `random` supplies the 4 check bytes (a parameter so tests can be deterministic).
+ */
+export declare function serializeOpenSshEd25519PrivateKey(seed: Uint8Array, publicKey: Uint8Array, comment: string, random?: (n: number) => Uint8Array): string;
+export interface GeneratedDeployKey {
+    /** The OpenSSH PEM. A secret: encrypt it before it is stored, never log it. */
+    privateKey: string;
+    /** `ssh-ed25519 <base64> <comment>`: public, safe to show. */
+    publicKey: string;
+    /** `SHA256:<base64>` of the public key, as the git server's UI prints it. */
+    fingerprint: string;
+}
+/**
+ * Generates an Ed25519 deploy key. `comment` ends up in both halves, so it should
+ * say what the key is for and carry nothing secret (e.g. `appforge-deploy-<appId>`).
+ * Works in the Workers runtime and in Node 20+ (WebCrypto Ed25519).
+ */
+export declare function generateDeployKey(comment: string): Promise<GeneratedDeployKey>;
+/**
+ * Validates and fingerprints a public key line (`ssh-ed25519 <base64> [comment]`)
+ * read back from storage, or null when it is not an Ed25519 public key. Used to
+ * fingerprint what is displayed, so the shown fingerprint is computed from the
+ * shown key and cannot disagree with it.
+ */
+export declare function deployKeyFingerprint(publicKeyLine: string): Promise<string | null>;
+//# sourceMappingURL=ssh-deploy-key.d.ts.map

package/dist/ssh-deploy-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-deploy-key.d.ts","sourceRoot":"","sources":["../src/ssh-deploy-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AA8BH,6DAA6D;AAC7D,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,UAAU,GAAG,UAAU,CAGnE;AAED,uFAAuF;AACvF,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAGrF;AAED;;;GAGG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,UAA6D,GACnF,MAAM,CAkBR;AAED,MAAM,WAAW,kBAAkB;IACjC,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAcpF;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYxF"}

package/dist/ssh-deploy-key.js

@@ -0,0 +1,124 @@
+/**
+ * Per-app git deploy keys (regulated-VPN program, PR-G).
+ *
+ * AppForge generates the key pair SERVER-SIDE (Ed25519, WebCrypto) so the
+ * customer never has to hand over a private key: they get only the PUBLIC half,
+ * to install as a read-only deploy key on their git server. The private half is
+ * stored encrypted (the same AES-GCM envelope as tunnel keys and app secrets),
+ * decrypted only by the lease-job Worker for the one build that needs it, and
+ * handed to the agent, which loads it into a per-build ssh-agent over stdin
+ * (packages/agent/src/lib/vpn-ssh.ts). It is never shown, logged or audited.
+ *
+ * Why this file serialises OpenSSH's own private-key format rather than PKCS#8:
+ * `ssh-add` and `ssh` read PKCS#8 only for some key types and builds; the
+ * `openssh-key-v1` container is what `ssh-keygen` writes and every OpenSSH
+ * release since 6.5 reads. It is small (PROTOCOL.key in the OpenSSH sources):
+ *
+ *   "openssh-key-v1\0"
+ *   string ciphername ("none"), string kdfname ("none"), string kdfoptions ("")
+ *   uint32 number-of-keys (1)
+ *   string public key blob   = string "ssh-ed25519", string <32-byte public key>
+ *   string private section   = uint32 check, uint32 check (equal, a decryption sanity
+ *                              check), string "ssh-ed25519", string <public key>,
+ *                              string <seed || public key> (64 bytes), string comment,
+ *                              padding 1,2,3,... to a multiple of the cipher block size (8)
+ *
+ * base64 of that, wrapped at 70 columns, between the OPENSSH PRIVATE KEY armor.
+ * The tests prove it against the real `ssh-keygen -y` and `ssh-add`.
+ */
+const MAGIC = new TextEncoder().encode("openssh-key-v1\0");
+const KEY_TYPE = "ssh-ed25519";
+function u32(n) {
+    return new Uint8Array([(n >>> 24) & 0xff, (n >>> 16) & 0xff, (n >>> 8) & 0xff, n & 0xff]);
+}
+function sshString(data) {
+    const bytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
+    return concat(u32(bytes.length), bytes);
+}
+function concat(...parts) {
+    const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    let o = 0;
+    for (const p of parts) {
+        out.set(p, o);
+        o += p.length;
+    }
+    return out;
+}
+function b64(bytes) {
+    let bin = "";
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin);
+}
+/** The SSH wire-format public key blob of an Ed25519 key. */
+export function ed25519PublicBlob(publicKey) {
+    if (publicKey.length !== 32)
+        throw new Error("an Ed25519 public key is 32 bytes");
+    return concat(sshString(KEY_TYPE), sshString(publicKey));
+}
+/** `ssh-ed25519 <base64> <comment>`: the line a git server's deploy-key form takes. */
+export function formatOpenSshPublicKey(publicKey, comment) {
+    const c = comment.replace(/[^\x21-\x7e]+/g, "-").slice(0, 100);
+    return `${KEY_TYPE} ${b64(ed25519PublicBlob(publicKey))}${c ? ` ${c}` : ""}`;
+}
+/**
+ * Serialises an unencrypted Ed25519 key as an `openssh-key-v1` PEM.
+ * `random` supplies the 4 check bytes (a parameter so tests can be deterministic).
+ */
+export function serializeOpenSshEd25519PrivateKey(seed, publicKey, comment, random = (n) => crypto.getRandomValues(new Uint8Array(n))) {
+    if (seed.length !== 32)
+        throw new Error("an Ed25519 seed is 32 bytes");
+    const check = random(4);
+    const checkInt = ((check[0] << 24) | (check[1] << 16) | (check[2] << 8) | check[3]) >>> 0;
+    let priv = concat(u32(checkInt), u32(checkInt), sshString(KEY_TYPE), sshString(publicKey), sshString(concat(seed, publicKey)), sshString(comment));
+    // Pad to the (null) cipher's block size of 8 with 1, 2, 3, ...
+    const pad = (8 - (priv.length % 8)) % 8;
+    if (pad > 0)
+        priv = concat(priv, Uint8Array.from({ length: pad }, (_, i) => i + 1));
+    const body = concat(MAGIC, sshString("none"), sshString("none"), sshString(""), u32(1), sshString(ed25519PublicBlob(publicKey)), sshString(priv));
+    const wrapped = b64(body).match(/.{1,70}/g).join("\n");
+    return `-----BEGIN OPENSSH PRIVATE KEY-----\n${wrapped}\n-----END OPENSSH PRIVATE KEY-----\n`;
+}
+/**
+ * Generates an Ed25519 deploy key. `comment` ends up in both halves, so it should
+ * say what the key is for and carry nothing secret (e.g. `appforge-deploy-<appId>`).
+ * Works in the Workers runtime and in Node 20+ (WebCrypto Ed25519).
+ */
+export async function generateDeployKey(comment) {
+    // Typed loosely on purpose: this package compiles without the DOM lib (it also runs in Node and Workers).
+    const pair = (await crypto.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"]));
+    const pkcs8 = new Uint8Array((await crypto.subtle.exportKey("pkcs8", pair.privateKey)));
+    const publicKey = new Uint8Array((await crypto.subtle.exportKey("raw", pair.publicKey)));
+    // PKCS#8 of an Ed25519 key is a fixed 16-byte prefix (version, algorithm OID, the
+    // OCTET STRING wrappers) followed by the 32-byte seed. Refuse a runtime that
+    // returns anything else instead of serialising garbage.
+    if (pkcs8.length !== 48 || publicKey.length !== 32)
+        throw new Error("unexpected Ed25519 key encoding from the runtime");
+    const seed = pkcs8.slice(16);
+    const privateKey = serializeOpenSshEd25519PrivateKey(seed, publicKey, comment);
+    const publicLine = formatOpenSshPublicKey(publicKey, comment);
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", ed25519PublicBlob(publicKey)));
+    return { privateKey, publicKey: publicLine, fingerprint: `SHA256:${b64(digest).replace(/=+$/, "")}` };
+}
+/**
+ * Validates and fingerprints a public key line (`ssh-ed25519 <base64> [comment]`)
+ * read back from storage, or null when it is not an Ed25519 public key. Used to
+ * fingerprint what is displayed, so the shown fingerprint is computed from the
+ * shown key and cannot disagree with it.
+ */
+export async function deployKeyFingerprint(publicKeyLine) {
+    const m = /^ssh-ed25519 ([A-Za-z0-9+/]{20,}={0,3})(?: [\x20-\x7e]*)?$/.exec(publicKeyLine);
+    if (!m)
+        return null;
+    let bin;
+    try {
+        bin = atob(m[1]);
+    }
+    catch {
+        return null;
+    }
+    const bytes = Uint8Array.from(bin, (c) => c.charCodeAt(0));
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+    return `SHA256:${b64(digest).replace(/=+$/, "")}`;
+}
+//# sourceMappingURL=ssh-deploy-key.js.map

package/dist/ssh-deploy-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-deploy-key.js","sourceRoot":"","sources":["../src/ssh-deploy-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC;AAE/B,SAAS,GAAG,CAAC,CAAS;IACpB,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,SAAS,CAAC,IAAyB;IAC1C,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,GAAG,KAAmB;IACpC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACd,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,GAAG,CAAC,KAAiB;IAC5B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,iBAAiB,CAAC,SAAqB;IACrD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,sBAAsB,CAAC,SAAqB,EAAE,OAAe;IAC3E,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/D,OAAO,GAAG,QAAQ,IAAI,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iCAAiC,CAC/C,IAAgB,EAChB,SAAqB,EACrB,OAAe,EACf,SAAoC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAEpF,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC;IAC9F,IAAI,IAAI,GAAG,MAAM,CACf,GAAG,CAAC,QAAQ,CAAC,EACb,GAAG,CAAC,QAAQ,CAAC,EACb,SAAS,CAAC,QAAQ,CAAC,EACnB,SAAS,CAAC,SAAS,CAAC,EACpB,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EAClC,SAAS,CAAC,OAAO,CAAC,CACnB,CAAC;IACF,+DAA+D;IAC/D,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,GAAG,GAAG,CAAC;QAAE,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAClJ,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,OAAO,wCAAwC,OAAO,uCAAuC,CAAC;AAChG,CAAC;AAWD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe;IACrD,0GAA0G;IAC1G,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAuD,CAAC;IACpJ,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAgB,CAAC,CAAC;IACvG,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAgB,CAAC,CAAC;IACxG,kFAAkF;IAClF,6EAA6E;IAC7E,wDAAwD;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxH,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,UAAU,GAAG,iCAAiC,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACnG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;AACxG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,aAAqB;IAC9D,MAAM,CAAC,GAAG,4DAA4D,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5E,OAAO,UAAU,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;AACpD,CAAC"}

package/dist/ssh-deploy-key.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ssh-deploy-key.test.d.ts.map

package/dist/ssh-deploy-key.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-deploy-key.test.d.ts","sourceRoot":"","sources":["../src/ssh-deploy-key.test.ts"],"names":[],"mappings":""}

package/dist/ssh-deploy-key.test.js

@@ -0,0 +1,117 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { execFileSync, spawn } from "node:child_process";
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { deployKeyFingerprint, ed25519PublicBlob, formatOpenSshPublicKey, generateDeployKey, serializeOpenSshEd25519PrivateKey } from "./ssh-deploy-key.js";
+import { isPlausibleSshPrivateKey } from "./vpn-ssh.js";
+const have = (bin) => ["/usr/bin", "/usr/local/bin", "/opt/homebrew/bin", "/bin"].some((d) => existsSync(join(d, bin)));
+const haveSsh = have("ssh-keygen") && have("ssh-add") && have("ssh-agent");
+function scratch() {
+    // Short on purpose: a unix-socket path is limited to ~104 bytes on macOS.
+    return mkdtempSync(join(tmpdir(), "afdk-"));
+}
+test("generateDeployKey returns an OpenSSH PEM, a matching ssh-ed25519 public line and its SHA256 fingerprint", async () => {
+    const k = await generateDeployKey("appforge-deploy-app1");
+    assert.match(k.privateKey, /^-----BEGIN OPENSSH PRIVATE KEY-----\n[A-Za-z0-9+/=\n]+\n-----END OPENSSH PRIVATE KEY-----\n$/);
+    assert.match(k.publicKey, /^ssh-ed25519 [A-Za-z0-9+/]{68} appforge-deploy-app1$/);
+    assert.match(k.fingerprint, /^SHA256:[A-Za-z0-9+/]{43}$/);
+    assert.equal(await deployKeyFingerprint(k.publicKey), k.fingerprint);
+    // The shape check the agent and the lease apply to a deploy key.
+    assert.equal(isPlausibleSshPrivateKey(k.privateKey), true);
+    // PEM lines are wrapped at 70 columns like ssh-keygen's.
+    for (const l of k.privateKey.trimEnd().split("\n").slice(1, -1))
+        assert.ok(l.length <= 70);
+});
+test("two generated keys differ, and the private key never appears in the public one", async () => {
+    const a = await generateDeployKey("c");
+    const b = await generateDeployKey("c");
+    assert.notEqual(a.publicKey, b.publicKey);
+    assert.notEqual(a.privateKey, b.privateKey);
+    assert.equal(a.publicKey.includes("PRIVATE"), false);
+});
+test("serialisation is deterministic for fixed inputs and pads the private section to 8 bytes", () => {
+    const seed = new Uint8Array(32).fill(7);
+    const pub = new Uint8Array(32).fill(9);
+    const fixed = () => new Uint8Array([1, 2, 3, 4]);
+    const a = serializeOpenSshEd25519PrivateKey(seed, pub, "x", fixed);
+    assert.equal(a, serializeOpenSshEd25519PrivateKey(seed, pub, "x", fixed));
+    for (const comment of ["", "a", "abcd", "a-much-longer-comment-for-padding"]) {
+        const pem = serializeOpenSshEd25519PrivateKey(seed, pub, comment, fixed);
+        const body = Buffer.from(pem.split("\n").slice(1, -2).join(""), "base64");
+        let pos = "openssh-key-v1\0".length;
+        const str = () => {
+            const len = body.readUInt32BE(pos);
+            const out = body.subarray(pos + 4, pos + 4 + len);
+            pos += 4 + len;
+            return out;
+        };
+        assert.equal(str().toString(), "none"); // cipher
+        assert.equal(str().toString(), "none"); // kdf
+        assert.equal(str().length, 0); // kdf options
+        assert.equal(body.readUInt32BE(pos), 1); // one key
+        pos += 4;
+        assert.equal(str().length, 4 + 11 + 4 + 32); // public blob
+        const priv = str();
+        assert.equal(pos, body.length, "nothing may follow the private section");
+        assert.equal(priv.length % 8, 0);
+        assert.equal(priv.readUInt32BE(0), priv.readUInt32BE(4), "the two check ints are equal");
+        // Padding is 1, 2, 3, ... after the comment.
+        const pad = priv.length - (8 + 4 + 11 + 4 + 32 + 4 + 64 + 4 + comment.length);
+        assert.ok(pad >= 0 && pad < 8);
+        for (let i = 0; i < pad; i++)
+            assert.equal(priv[priv.length - pad + i], i + 1);
+    }
+    assert.throws(() => serializeOpenSshEd25519PrivateKey(new Uint8Array(31), pub, "x"), /32 bytes/);
+    assert.throws(() => ed25519PublicBlob(new Uint8Array(31)), /32 bytes/);
+});
+test("formatOpenSshPublicKey strips anything that could break the line out of the comment", () => {
+    const line = formatOpenSshPublicKey(new Uint8Array(32).fill(1), "evil\nkey with spaces\u0000");
+    assert.equal(line.includes("\n"), false);
+    assert.match(line, /^ssh-ed25519 [A-Za-z0-9+/]+ evil-key-with-spaces-$/);
+});
+test("deployKeyFingerprint refuses what is not an ed25519 public key line", async () => {
+    assert.equal(await deployKeyFingerprint("ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAB"), null);
+    assert.equal(await deployKeyFingerprint("ssh-ed25519 !!!!"), null);
+    assert.equal(await deployKeyFingerprint("-----BEGIN OPENSSH PRIVATE KEY-----"), null);
+});
+test("ssh-keygen -y accepts the generated private key and prints the same public key; ssh-keygen -l prints our fingerprint", { skip: !haveSsh }, async () => {
+    const dir = scratch();
+    try {
+        const k = await generateDeployKey("appforge-deploy-test");
+        const file = join(dir, "id");
+        writeFileSync(file, k.privateKey, { mode: 0o600 });
+        const derived = execFileSync("ssh-keygen", ["-y", "-f", file], { encoding: "utf8" }).trim();
+        // `ssh-keygen -y` prints the comment stored in the key.
+        assert.equal(derived, k.publicKey);
+        const pubFile = join(dir, "id.pub");
+        writeFileSync(pubFile, k.publicKey + "\n");
+        const l = execFileSync("ssh-keygen", ["-l", "-f", pubFile], { encoding: "utf8" });
+        assert.ok(l.includes(k.fingerprint), `ssh-keygen -l said ${l}`);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+test("ssh-add loads the generated key from stdin into a real ssh-agent and lists the same public key", { skip: !haveSsh }, async () => {
+    const dir = scratch();
+    const sock = join(dir, "a.sock");
+    const agent = spawn("ssh-agent", ["-D", "-a", sock], { stdio: "ignore" });
+    try {
+        const deadline = Date.now() + 5000;
+        while (!existsSync(sock) && Date.now() < deadline)
+            await new Promise((r) => setTimeout(r, 25));
+        assert.ok(existsSync(sock), "ssh-agent did not start");
+        const k = await generateDeployKey("appforge-deploy-test");
+        const env = { PATH: process.env.PATH ?? "/usr/bin:/bin", SSH_AUTH_SOCK: sock, SSH_ASKPASS: "/usr/bin/false", SSH_ASKPASS_REQUIRE: "force" };
+        execFileSync("ssh-add", ["-q", "-"], { input: k.privateKey, env });
+        const listed = execFileSync("ssh-add", ["-L"], { env, encoding: "utf8" }).trim();
+        assert.equal(listed.split(" ").slice(0, 2).join(" "), k.publicKey.split(" ").slice(0, 2).join(" "));
+    }
+    finally {
+        agent.kill("SIGTERM");
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=ssh-deploy-key.test.js.map