@bitspark/archon-cli 0.6.1

package/dist/src/cmd/key_store.js

@@ -0,0 +1,482 @@
+// archon key add|list|rm|default|export — the password-protected seed store of
+// ADR 0007 §A. The format lives in ../keystore.js; this file is the command: flags,
+// prompts, paths, and the lines we print about what we did.
+//
+// Every operation that destroys, reveals or creates key material says so IN SCOPE
+// (docs/keystore.md §6): archon speaks for its own store and never for anyone else's, so
+// an empty result means "nothing visible here", never "nothing exists". The wording is
+// pinned in cli/smoke.mjs.
+import { randomBytes } from "node:crypto";
+import { chmodSync, existsSync, fstatSync, mkdirSync, readdirSync, readFileSync, readSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+import { encodeKey, getPublicKey, pkcs8PemToSeed, pubkeyFromHex, seedFromHex, seedToPkcs8Pem } from "@bitspark/archon";
+import * as keystore from "../keystore.js";
+export const USAGE = "usage: archon key <add <name> [--seed <hex>|--seed-file <file>|--pkcs8 <file>]|" +
+    "list [--json]|rm <name> [--force]|default [<name>]|export <name> --reveal --out <file>>\n  " +
+    "the password-protected seed store; keys live in $ARCHON_HOME/keys (default ~/.archon). " +
+    "Password: interactive prompt, or ARCHON_KEY_PASSWORD / --password-fd <n>, never argv.";
+// ---------------------------------------------------------------------------
+// Where the store lives — docs/keystore.md §1.
+// ---------------------------------------------------------------------------
+const archonHome = () => {
+    const env = process.env["ARCHON_HOME"];
+    return env !== undefined && env !== "" ? env : join(homedir(), ".archon");
+};
+const storeDir = () => join(archonHome(), "keys");
+function keyPath(name) {
+    keystore.validateName(name);
+    return join(storeDir(), name);
+}
+/**
+ * Writes atomically: a temp file in the SAME directory, then a rename, so a crash
+ * mid-write can never leave a half key where a whole one was.
+ */
+function writeKeyFile(path, blob) {
+    const dir = dirname(path);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const tmp = join(dir, `.tmp-${process.pid}`);
+    writeFileSync(tmp, blob, { mode: 0o600 });
+    try {
+        chmodSync(tmp, 0o600);
+    }
+    catch {
+        // Windows has no mode bits; the file inherits the ACL of the user's own profile
+        // directory. Failing here would be pretending 0600 was ever possible.
+    }
+    renameSync(tmp, path);
+}
+function listKeyNames() {
+    try {
+        return readdirSync(storeDir())
+            .filter((n) => !n.startsWith(".tmp-"))
+            .filter((n) => {
+            try {
+                return statSync(join(storeDir(), n)).isFile();
+            }
+            catch {
+                return false;
+            }
+        })
+            .sort();
+    }
+    catch {
+        // A missing store directory is an empty store, not an error: nothing added yet.
+        return [];
+    }
+}
+// ---------------------------------------------------------------------------
+// Passwords — docs/keystore.md §4. Never argv.
+// ---------------------------------------------------------------------------
+/**
+ * Scans for `--password-fd <n>` and removes it. The password never travels in argv, so
+ * this carries a descriptor number rather than the secret.
+ */
+export function takePasswordFd(args) {
+    const rest = [];
+    let fd;
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === "--password-fd") {
+            const v = args[i + 1];
+            if (v === undefined)
+                throw new Error('flag "--password-fd" needs a value');
+            const n = Number.parseInt(v, 10);
+            if (!Number.isInteger(n) || n < 0) {
+                throw new Error(`--password-fd: ${JSON.stringify(v)} is not a file descriptor`);
+            }
+            fd = n;
+            i++;
+            continue;
+        }
+        rest.push(args[i]);
+    }
+    return { rest, fd };
+}
+const trimNewline = (s) => s.replace(/[\r\n]+$/u, "");
+/** The real terminal. The fd read is injectable too, so the byte-reading closure — the one
+ *  place this file touches fd 0 — can be exercised by a test without a TTY. */
+export const terminalIo = (readOne = (into) => readSync(0, into, 0, 1, null)) => {
+    const chunk = Buffer.alloc(1);
+    return {
+        setRawMode: (raw) => {
+            process.stdin.setRawMode(raw);
+        },
+        readByte: () => {
+            let n = 0;
+            try {
+                n = readOne(chunk);
+            }
+            catch {
+                return -1;
+            }
+            return n === 0 ? -1 : chunk[0];
+        },
+        write: (text) => {
+            process.stderr.write(text);
+        },
+    };
+};
+/** A prompt that does not echo. Node has no rpassword, so raw mode is done by hand. */
+export function promptHidden(label, io = terminalIo()) {
+    io.write(label);
+    const wasRaw = process.stdin.isRaw === true;
+    io.setRawMode(true);
+    const buf = [];
+    for (;;) {
+        const c = io.readByte();
+        if (c < 0 || c === 0x0d || c === 0x0a)
+            break;
+        if (c === 0x03) {
+            io.setRawMode(wasRaw);
+            io.write("\n");
+            throw new Error("interrupted");
+        }
+        if (c === 0x7f || c === 0x08) {
+            buf.pop();
+            continue;
+        }
+        buf.push(String.fromCharCode(c));
+    }
+    io.setRawMode(wasRaw);
+    io.write("\n");
+    return buf.join("");
+}
+/**
+ * Sources the password: --password-fd, then ARCHON_KEY_PASSWORD, then an interactive
+ * prompt. `confirm` asks twice when a key is being created, where a typo would otherwise
+ * be discovered only at the next unlock.
+ */
+export function readPassword(fd, confirm) {
+    if (fd !== undefined) {
+        refuseLoosePasswordFile(fd);
+        return trimNewline(readFileSync(fd, "utf8"));
+    }
+    const env = process.env["ARCHON_KEY_PASSWORD"];
+    if (env !== undefined)
+        return env;
+    if (process.stdin.isTTY !== true) {
+        throw new Error("no password: stdin is not a terminal — set ARCHON_KEY_PASSWORD or pass --password-fd <n>");
+    }
+    const first = promptHidden("password: ");
+    if (confirm) {
+        const second = promptHidden("password (again): ");
+        if (first !== second)
+            throw new Error("the two passwords differ");
+    }
+    return first;
+}
+// ---------------------------------------------------------------------------
+// What the store lets another command ask of it — `login --key`'s seams.
+// ---------------------------------------------------------------------------
+/**
+ * The store's own "is there a key called that": a validated name, then a stat — opening
+ * nothing, asking for no password. Shared by `key default <name>` and by `login`'s
+ * pre-network check, so both refuse a missing key with one wording.
+ */
+export function requireNamedKey(name) {
+    if (!existsSync(keyPath(name))) {
+        throw new Error(`no key named ${JSON.stringify(name)} in archon's store`);
+    }
+}
+/**
+ * The ONE reader of the default pointer ($ARCHON_HOME/default), shared by `key default`
+ * and by `login`'s fallback so the two can never disagree about what "the default" is.
+ * Absent, unreadable, or present-but-empty all read as undefined — there is no default —
+ * and the caller says what that means for it.
+ */
+export function readDefaultKeyName() {
+    let raw;
+    try {
+        raw = readFileSync(join(archonHome(), "default"), "utf8");
+    }
+    catch {
+        return undefined;
+    }
+    const name = raw.trim();
+    return name === "" ? undefined : name;
+}
+/**
+ * Opens the key called `name`: the path, the file, the password — sourced the store's one
+ * way (--password-fd, then ARCHON_KEY_PASSWORD, then a prompt) — and the seal. It is the
+ * ONE unlock path, shared by `key export` and `login --key`, so no two commands can ask
+ * for a password differently.
+ */
+export function unlockNamedKey(name, fd) {
+    const path = keyPath(name);
+    let raw;
+    try {
+        raw = new Uint8Array(readFileSync(path));
+    }
+    catch {
+        throw new Error(`no key named ${JSON.stringify(name)} in archon's store`);
+    }
+    return keystore.open(raw, readPassword(fd, false));
+}
+// ---------------------------------------------------------------------------
+// The commands.
+// ---------------------------------------------------------------------------
+/**
+ * The one place a key is written, shared by `key add` and `keygen --store` so the two
+ * cannot drift apart. Salt and nonce are drawn HERE, in the command: the format takes them
+ * as arguments and never sources randomness, which is what makes it pinnable.
+ */
+export function sealAndWrite(path, seed, password) {
+    const salt = new Uint8Array(randomBytes(keystore.SALT_SIZE));
+    const nonce = new Uint8Array(randomBytes(keystore.NONCE_SIZE));
+    const blob = keystore.seal(seed, password, salt, nonce, keystore.defaultParams());
+    writeKeyFile(path, blob);
+    return encodeKey(getPublicKey(seed));
+}
+/** `keygen --store <name>`: the same seal path as `key add`. */
+export function storeGenerated(name, seed, fd) {
+    keystore.validateName(name);
+    const path = keyPath(name);
+    if (existsSync(path)) {
+        throw new Error(`a key named ${JSON.stringify(name)} already exists; remove it first (archon key rm ${name})`);
+    }
+    const password = readPassword(fd, true);
+    const principal = sealAndWrite(path, seed, password);
+    process.stdout.write(`generated and stored ${name} (${principal}).\n`);
+}
+/**
+ * Accepts the two shapes ADR 0007 §A names: a 32-byte seed as 64 hex, and the first consumer's
+ * ed25519.PrivateKey shape as 128 hex (seed ‖ public key). The public half is CHECKED
+ * against the seed rather than trusted — a mismatch means the file is not what its owner
+ * thinks it is, and storing it would carry the confusion forward.
+ */
+function seedFromHexish(s) {
+    const t = s.trim();
+    if (t.length === 64)
+        return seedFromHex(t);
+    if (t.length === 128) {
+        const seed = seedFromHex(t.slice(0, 64));
+        const claimed = pubkeyFromHex(t.slice(64));
+        const derived = getPublicKey(seed);
+        if (claimed.length !== derived.length || claimed.some((b, i) => b !== derived[i])) {
+            throw new Error("the public half does not match the seed: this is not a consistent private key");
+        }
+        return seed;
+    }
+    throw new Error(`expected 64 hex characters (a seed) or 128 (seed then public key), got ${t.length}`);
+}
+export function runAdd(args) {
+    const name = args[0];
+    if (name === undefined)
+        throw new Error(USAGE);
+    keystore.validateName(name);
+    const { rest, fd } = takePasswordFd(args.slice(1));
+    let seedHex;
+    let seedFile;
+    let pkcs8File;
+    for (let i = 0; i < rest.length; i += 2) {
+        const value = rest[i + 1];
+        if (value === undefined)
+            throw new Error(`flag ${JSON.stringify(rest[i])} needs a value\n${USAGE}`);
+        switch (rest[i]) {
+            case "--seed":
+                seedHex = value;
+                break;
+            case "--seed-file":
+                seedFile = value;
+                break;
+            case "--pkcs8":
+                pkcs8File = value;
+                break;
+            default: throw new Error(`unknown flag ${JSON.stringify(rest[i])}\n${USAGE}`);
+        }
+    }
+    if ([seedHex, seedFile, pkcs8File].filter((v) => v !== undefined).length > 1) {
+        throw new Error(`--seed, --seed-file and --pkcs8 are mutually exclusive\n${USAGE}`);
+    }
+    const path = keyPath(name);
+    // Refused BEFORE a password is asked for: a key is never silently replaced, and there is
+    // no reason to make someone type a password to find that out.
+    if (existsSync(path)) {
+        throw new Error(`a key named ${JSON.stringify(name)} already exists; remove it first (archon key rm ${name})`);
+    }
+    let seed;
+    let from;
+    if (seedHex !== undefined) {
+        seed = seedFromHexish(seedHex);
+        from = "--seed";
+    }
+    else if (seedFile !== undefined) {
+        seed = seedFromHexish(readFileSync(seedFile, "utf8"));
+        from = seedFile;
+    }
+    else if (pkcs8File !== undefined) {
+        seed = pkcs8PemToSeed(readFileSync(pkcs8File, "utf8"));
+        from = pkcs8File;
+    }
+    else {
+        seed = new Uint8Array(randomBytes(keystore.SEED_SIZE));
+    }
+    const password = readPassword(fd, true);
+    const principal = sealAndWrite(path, seed, password);
+    if (from === undefined) {
+        process.stdout.write(`generated and stored ${name} (${principal}).\n`);
+    }
+    else {
+        process.stdout.write(`stored ${name} (${principal}) from ${from}; the source file is untouched.\n`);
+    }
+}
+/**
+ * Prints what each header CLAIMS. The claim is only proven at unlock, which is why this
+ * never opens a key and never asks for a password.
+ */
+export function runList(args) {
+    let asJson = false;
+    for (const a of args) {
+        if (a !== "--json")
+            throw new Error(`unknown flag ${JSON.stringify(a)}\n${USAGE}`);
+        asJson = true;
+    }
+    const rows = [];
+    for (const name of listKeyNames()) {
+        try {
+            const raw = new Uint8Array(readFileSync(keyPath(name)));
+            // The magic is what keeps a stray file out of this list.
+            const h = keystore.parseHeader(raw);
+            rows.push({ name, principal: encodeKey(h.publicKey) });
+        }
+        catch {
+            continue;
+        }
+    }
+    if (asJson) {
+        process.stdout.write(`${JSON.stringify(rows)}\n`);
+        return;
+    }
+    for (const r of rows)
+        process.stdout.write(`${r.name}\t${r.principal}\n`);
+}
+/**
+ * Removes a key and says exactly what it removed, from where, and what it does NOT speak
+ * for. An unparsable file is refused unless --force: deleting an unrecognised file inside
+ * the store silently is what this rule exists to prevent.
+ */
+export function runRm(args) {
+    const name = args[0];
+    if (name === undefined)
+        throw new Error(USAGE);
+    let force = false;
+    for (const a of args.slice(1)) {
+        if (a !== "--force")
+            throw new Error(`unknown flag ${JSON.stringify(a)}\n${USAGE}`);
+        force = true;
+    }
+    const path = keyPath(name);
+    let raw;
+    try {
+        raw = new Uint8Array(readFileSync(path));
+    }
+    catch {
+        throw new Error(`no key named ${JSON.stringify(name)} in archon's store`);
+    }
+    let header;
+    let why = "";
+    try {
+        header = keystore.parseHeader(raw);
+    }
+    catch (e) {
+        why = e instanceof Error ? e.message : String(e);
+        if (!force)
+            throw new Error(`not an archon key file: ${path}: ${why}`);
+    }
+    unlinkSync(path);
+    const what = header === undefined ? `unreadable header: ${why}` : encodeKey(header.publicKey);
+    process.stdout.write(`removed ${name} (${what}) from archon's store at ${path}; ` +
+        "any copy of this key outside it is untouched.\n");
+}
+/**
+ * Sets or shows the default key. Selection is by NAME, never by principal text
+ * (ADR 0007 §A). The pointer lives beside keys/, not in it, so it can never collide with
+ * a key name.
+ */
+export function runDefault(args) {
+    const pointer = join(archonHome(), "default");
+    if (args.length === 0) {
+        const name = readDefaultKeyName();
+        if (name === undefined)
+            throw new Error("no default key is set");
+        process.stdout.write(`${name}\n`);
+        return;
+    }
+    if (args.length !== 1)
+        throw new Error(USAGE);
+    const name = args[0];
+    requireNamedKey(name);
+    mkdirSync(dirname(pointer), { recursive: true, mode: 0o700 });
+    writeFileSync(pointer, `${name}\n`, { mode: 0o600 });
+    process.stdout.write(`default key is now ${name}.\n`);
+}
+/**
+ * Writes the seed out. Refuses without --reveal, and refuses stdout unless `--out -` says
+ * so: a seed should never land in a pipe by accident.
+ */
+export function runExport(args) {
+    const name = args[0];
+    if (name === undefined)
+        throw new Error(USAGE);
+    const { rest, fd } = takePasswordFd(args.slice(1));
+    let reveal = false;
+    let out = "";
+    for (let i = 0; i < rest.length; i++) {
+        if (rest[i] === "--reveal") {
+            reveal = true;
+            continue;
+        }
+        if (rest[i] === "--out") {
+            const v = rest[i + 1];
+            if (v === undefined)
+                throw new Error(`flag "--out" needs a value\n${USAGE}`);
+            out = v;
+            i++;
+            continue;
+        }
+        throw new Error(`unknown flag ${JSON.stringify(rest[i])}\n${USAGE}`);
+    }
+    if (!reveal)
+        throw new Error("refusing to export a seed without --reveal");
+    if (out === "") {
+        throw new Error("refusing to write a seed to stdout: pass --out <file>, or --out - to mean it");
+    }
+    const seed = unlockNamedKey(name, fd);
+    const pem = seedToPkcs8Pem(seed);
+    if (out === "-") {
+        process.stdout.write(pem);
+        process.stderr.write(`wrote the seed of ${name} to stdout; the store's copy remains.\n`);
+        return;
+    }
+    writeFileSync(out, pem, { mode: 0o600 });
+    process.stdout.write(`wrote the seed of ${name} to ${out}; the store's copy remains.\n`);
+}
+/**
+ * Refuses a password file that anyone but its owner can read (ADR 0007 §A). Only a REGULAR
+ * file is checked: a pipe, a terminal or a process substitution has no meaningful mode, and
+ * `--password-fd 0` fed by a heredoc is a pipe, so checking those would refuse the ordinary
+ * non-interactive case for nothing.
+ *
+ * Windows has no mode bits and Node reports a synthetic 0666, so there is nothing to check
+ * and nothing is claimed — the same honesty the store keeps about 0600 elsewhere.
+ */
+function refuseLoosePasswordFile(fd) {
+    if (process.platform === "win32")
+        return;
+    let st;
+    try {
+        st = fstatSync(fd);
+    }
+    catch {
+        // Undecidable, so this refuses nothing rather than guessing; the read below will
+        // produce the real error if the descriptor is unusable.
+        return;
+    }
+    if (!st.isFile())
+        return;
+    const perm = st.mode & 0o777;
+    if ((perm & 0o077) !== 0) {
+        throw new Error(`--password-fd: the password file is readable by others (mode ${perm.toString(8).padStart(4, "0")}); chmod 600 it`);
+    }
+}
+//# sourceMappingURL=key_store.js.map

package/dist/src/cmd/key_store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key_store.js","sourceRoot":"","sources":["../../../src/cmd/key_store.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,oFAAoF;AACpF,4DAA4D;AAC5D,EAAE;AACF,kFAAkF;AAClF,yFAAyF;AACzF,uFAAuF;AACvF,2BAA2B;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,MACvF,kBAAkB,CAAC;AAE1B,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,MAAM,CAAC,MAAM,KAAK,GAChB,iFAAiF;IACjF,6FAA6F;IAC7F,yFAAyF;IACzF,uFAAuF,CAAC;AAE1F,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAE9E,MAAM,UAAU,GAAG,GAAW,EAAE;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACvC,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5E,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;AAE1D,SAAS,OAAO,CAAC,IAAY;IAC3B,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,IAAY,EAAE,IAAgB;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7C,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,sEAAsE;IACxE,CAAC;IACD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;aAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;aACrC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACZ,IAAI,CAAC;gBACH,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC;aACD,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAc;IAC3C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,EAAsB,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YAC3E,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC;YAClF,CAAC;YACD,EAAE,GAAG,CAAC,CAAC;YACP,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAW,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAgBtE;+EAC+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,UAAoC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAC3D,EAAE;IAClB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO;QACL,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YAClB,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QACD,QAAQ,EAAE,GAAG,EAAE;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,IAAI,CAAC;gBACH,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,CAAC,CAAC;YACZ,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,CAAC,CAAY,CAAC;QAC7C,CAAC;QACD,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,uFAAuF;AACvF,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,KAAqB,UAAU,EAAE;IAC3E,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC;IAC5C,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACpB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,SAAS,CAAC;QACR,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM;QAC7C,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACtB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7B,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACtB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACf,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,EAAsB,EAAE,OAAgB;IACnE,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,uBAAuB,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC/C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,EAAsB;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAgB,EAAE,QAAgB;IAC3E,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAClF,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,OAAO,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAgB,EAAE,EAAsB;IACnF,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mDAAmD,IAAI,GAAG,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,IAAI,KAAK,SAAS,MAAM,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,CAAS;IAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CACb,0EAA0E,CAAC,CAAC,MAAM,EAAE,CACrF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAc;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnD,IAAI,OAA2B,CAAC;IAChC,IAAI,QAA4B,CAAC;IACjC,IAAI,SAA6B,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;QACpG,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,KAAK,QAAQ;gBAAE,OAAO,GAAG,KAAK,CAAC;gBAAC,MAAM;YACtC,KAAK,aAAa;gBAAE,QAAQ,GAAG,KAAK,CAAC;gBAAC,MAAM;YAC5C,KAAK,SAAS;gBAAE,SAAS,GAAG,KAAK,CAAC;gBAAC,MAAM;YACzC,OAAO,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,2DAA2D,KAAK,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,yFAAyF;IACzF,8DAA8D;IAC9D,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mDAAmD,IAAI,GAAG,CAC9F,CAAC;IACJ,CAAC;IAED,IAAI,IAAgB,CAAC;IACrB,IAAI,IAAwB,CAAC;IAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,GAAG,QAAQ,CAAC;IAClB,CAAC;SAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,GAAG,cAAc,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,GAAG,QAAQ,CAAC;IAClB,CAAC;SAAM,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,GAAG,cAAc,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QACvD,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,IAAI,KAAK,SAAS,MAAM,CAAC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,UAAU,IAAI,KAAK,SAAS,UAAU,IAAI,mCAAmC,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,IAAc;IACpC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;QACnF,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAA0C,EAAE,CAAC;IACvD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxD,yDAAyD;YACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,KAAK,CAAC,IAAc;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;QACpF,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,MAAsC,CAAC;IAC3C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9F,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,WAAW,IAAI,KAAK,IAAI,4BAA4B,IAAI,IAAI;QAC1D,iDAAiD,CACpD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;QAClC,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;IAC/B,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,aAAa,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,IAAI,KAAK,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YAC3B,MAAM,GAAG,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;YAC7E,GAAG,GAAG,CAAC,CAAC;YACR,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC3E,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,yCAAyC,CAAC,CAAC;QACzF,OAAO;IACT,CAAC;IACD,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,OAAO,GAAG,+BAA+B,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,uBAAuB,CAAC,EAAU;IACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACzC,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,iFAAiF;QACjF,wDAAwD;QACxD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,OAAO;IACzB,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC;IAC7B,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,gEAAgE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,iBAAiB,CACnH,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/src/cmd/keygen.d.ts

@@ -0,0 +1 @@
+export declare function run(args: string[]): void;

package/dist/src/cmd/keygen.js

@@ -0,0 +1,114 @@
+// archon keygen — generate (or deterministically derive) an Ed25519 key pair: the
+// canonical public key to stdout — the shareable part — and the private key as a PKCS#8
+// v1 PEM, never the raw seed hex, either to --out <file> (the recommended path) or to
+// stderr behind a clear warning.
+//
+// The RNG is the one deliberately-unpinned edge, and it lives here, in the CLI: the
+// library takes a seed it is given and never invents one (ADR 0002). This is not custody
+// in stele's sense — nothing is named, stored or managed; a file you name is written and
+// forgotten.
+import { randomBytes } from "node:crypto";
+import { writeFileSync } from "node:fs";
+import { encodeKey, getPublicKey, seedFromHex, seedToPkcs8Pem, SEED_SIZE } from "@bitspark/archon";
+import { wantsHelp } from "../io.js";
+import * as keystore from "../keystore.js";
+import * as store from "./key_store.js";
+import { parsePubFormat, renderPub } from "../pubrender.js";
+const USAGE = "usage: archon keygen [--seed <hex>] [--store <name>] [--out <file>] [--pub-out <file>] [--pub-format spki|text|hex]\n  " +
+    "prints the public key (canonical text) on stdout; writes the PKCS#8 PEM private key to " +
+    "<file> (--out) or, by default, to stderr behind a SECRET warning; --pub-out writes the " +
+    "public key (--pub-format spki|text|hex, default spki) to a file. --seed derives the " +
+    "key deterministically.";
+export function run(args) {
+    if (wantsHelp(args)) {
+        process.stdout.write(`${USAGE}\n`);
+        return;
+    }
+    const { rest: afterStore, store: storeName } = takeStoreFlag(args);
+    const { rest: parsedArgs, fd: pwFd } = store.takePasswordFd(afterStore);
+    // Validated before anything is generated or printed: a bad name should cost nothing.
+    if (storeName !== undefined)
+        keystore.validateName(storeName);
+    const opts = parseOpts(parsedArgs);
+    if (storeName !== undefined && opts.out !== undefined) {
+        throw new Error("--store and --out are mutually exclusive: one keeps the seed, the other writes it out");
+    }
+    const pub = getPublicKey(opts.seed);
+    process.stdout.write(`${encodeKey(pub)}\n`);
+    // --store: the seed stays in the store and no PEM is produced at all. Same seal path
+    // `key add` uses (sealAndWrite), reached from the command that owns the CSPRNG.
+    if (storeName !== undefined) {
+        store.storeGenerated(storeName, opts.seed, pwFd);
+        if (opts.pubOut !== undefined) {
+            writeFileSync(opts.pubOut, renderPub(pub, opts.pubFormat));
+            process.stderr.write(`wrote public key (${opts.pubFormat}) to ${opts.pubOut}\n`);
+        }
+        return;
+    }
+    const pem = seedToPkcs8Pem(opts.seed);
+    if (opts.out !== undefined) {
+        writeFileSync(opts.out, pem, { mode: 0o600 });
+        process.stderr.write(`wrote PKCS#8 private key PEM to ${opts.out}\n`);
+    }
+    else {
+        process.stderr.write("SECRET — do not share. Anyone with this private key controls the identity:\n");
+        process.stderr.write(pem);
+    }
+    if (opts.pubOut !== undefined) {
+        writeFileSync(opts.pubOut, renderPub(pub, opts.pubFormat));
+        process.stderr.write(`wrote public key (${opts.pubFormat}) to ${opts.pubOut}\n`);
+    }
+}
+function parseOpts(args) {
+    let seed;
+    let out;
+    let pubOut;
+    let pubFormat = "spki";
+    for (let i = 0; i < args.length; i += 2) {
+        const flag = args[i];
+        if (i + 1 >= args.length)
+            throw new Error(`flag ${JSON.stringify(flag)} needs a value\n${USAGE}`);
+        const value = args[i + 1];
+        switch (flag) {
+            case "--seed":
+                try {
+                    seed = seedFromHex(value);
+                }
+                catch (e) {
+                    throw new Error(`--seed: ${e.message}`);
+                }
+                break;
+            case "--out":
+                out = value;
+                break;
+            case "--pub-out":
+                pubOut = value;
+                break;
+            case "--pub-format":
+                // Validated at parse time so a bad format never leaves a private key behind.
+                pubFormat = parsePubFormat(value);
+                break;
+            default:
+                throw new Error(`unknown flag ${JSON.stringify(flag)}\n${USAGE}`);
+        }
+    }
+    return { seed: seed ?? new Uint8Array(randomBytes(SEED_SIZE)), out, pubOut, pubFormat };
+}
+/** Scans for `--store <name>` and removes it, the same shape as takeInFlag. */
+function takeStoreFlag(args) {
+    const rest = [];
+    let store;
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === "--store") {
+            const v = args[i + 1];
+            if (v === undefined || v === "")
+                throw new Error('flag "--store" needs a value');
+            store = v;
+            i++;
+            continue;
+        }
+        rest.push(args[i]);
+    }
+    return { rest, store };
+}
+//# sourceMappingURL=keygen.js.map

package/dist/src/cmd/keygen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygen.js","sourceRoot":"","sources":["../../../src/cmd/keygen.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,wFAAwF;AACxF,sFAAsF;AACtF,iCAAiC;AACjC,EAAE;AACF,oFAAoF;AACpF,yFAAyF;AACzF,yFAAyF;AACzF,aAAa;AACb,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEnG,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,cAAc,EAAkB,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5E,MAAM,KAAK,GACT,yHAAyH;IACzH,yFAAyF;IACzF,yFAAyF;IACzF,sFAAsF;IACtF,wBAAwB,CAAC;AAS3B,MAAM,UAAU,GAAG,CAAC,IAAc;IAChC,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACxE,qFAAqF;IACrF,IAAI,SAAS,KAAK,SAAS;QAAE,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,qFAAqF;IACrF,gFAAgF;IAChF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,KAAK,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,SAAS,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACnF,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8EAA8E,CAAC,CAAC;QACrG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,SAAS,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAc;IAC/B,IAAI,IAA4B,CAAC;IACjC,IAAI,GAAuB,CAAC;IAC5B,IAAI,MAA0B,CAAC;IAC/B,IAAI,SAAS,GAAc,MAAM,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;QAClG,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QAC3B,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,QAAQ;gBACX,IAAI,CAAC;oBACH,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;gBAC5B,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,WAAY,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;gBACrD,CAAC;gBACD,MAAM;YACR,KAAK,OAAO;gBACV,GAAG,GAAG,KAAK,CAAC;gBACZ,MAAM;YACR,KAAK,WAAW;gBACd,MAAM,GAAG,KAAK,CAAC;gBACf,MAAM;YACR,KAAK,cAAc;gBACjB,6EAA6E;gBAC7E,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM;YACR;gBACE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC1F,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,IAAc;IACnC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAyB,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACjF,KAAK,GAAG,CAAC,CAAC;YACV,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAW,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC"}