@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/sqlcipher-db.js

@@ -1,357 +0,0 @@
-/**
- * The daemon's single encrypted store.
- *
- * The daemon DB is a SQLCipher database (whole-file AES-256 at rest). This module is the ONE
- * engine site: it loads @signalapp/sqlcipher (prebuilt — never compiled from source), opens the DB with a
- * PRAGMA key, verifies the key, enables WAL, and presents a thin `DaemonDatabase` adapter so the
- * rest of the daemon (SessionNodeManager, RetryQueue, NonceDedupStore) keeps its node:sqlite-style
- * varargs call sites unchanged.
- *
- * Why an adapter: node:sqlite's `DatabaseSync` uses varargs (`stmt.run(a, b, c)`); @signalapp's
- * better-sqlite3-style API takes an array (`stmt.run([a, b, c])`). The `DaemonDatabase` /
- * `DaemonStatement` interfaces expose the varargs surface — node:sqlite's `DatabaseSync` structurally
- * satisfies them too (used for in-memory test handles and for reading a legacy plaintext DB during
- * migration), and `SqlcipherDatabase` implements them by forwarding varargs as an array.
- *
- * Key custody: the SQLCipher key is a standalone random 32-byte 0600 key file beside the DB. It is
- * NOT derived from K_local — that is a chicken-and-egg, since K_local itself lives inside the DB. It
- * is the ONE plaintext key file on disk.
- *
- * FAILS CLOSED: there is no plaintext fallback anywhere. A wrong/missing key on an existing DB throws
- * `db_encryption_key_mismatch`; the daemon never opens, creates, or migrates to a plaintext store as
- * a fallback.
- *
- * Security invariants:
- *   - The db key is NEVER logged, serialized, or placed in an error message — only the raw
- *     `PRAGMA key` string uses the hex, and that string is never logged.
- *   - WAL mode is enabled only AFTER key verification, so WAL files are encrypted at rest.
- */
-import { createRequire } from "node:module";
-import { existsSync, readFileSync, readSync, openSync, writeSync, fsyncSync, closeSync, renameSync, mkdirSync, unlinkSync, } from "node:fs";
-import { randomBytes } from "node:crypto";
-import { dirname, join } from "node:path";
-import { extractErrorMessage } from "./error-message.js";
-const DB_KEY_BYTES = 32; // AES-256
-export class DbEncryptionError extends Error {
-    code;
-    /** Actionable next step surfaced to the operator (never contains key material). */
-    guidance;
-    constructor(code, message, guidance) {
-        super(message);
-        this.name = "DbEncryptionError";
-        this.code = code;
-        this.guidance = guidance;
-    }
-}
-// ─── The varargs→array adapter ──────────────────────────────────────────────────
-class SqlcipherStatement {
-    #inner;
-    constructor(inner) {
-        this.#inner = inner;
-    }
-    run(...params) {
-        return this.#inner.run(params);
-    }
-    get(...params) {
-        return this.#inner.get(params);
-    }
-    all(...params) {
-        return this.#inner.all(params);
-    }
-}
-class SqlcipherDatabase {
-    #inner;
-    constructor(inner) {
-        this.#inner = inner;
-    }
-    exec(sql) {
-        this.#inner.exec(sql);
-    }
-    prepare(sql) {
-        return new SqlcipherStatement(this.#inner.prepare(sql));
-    }
-    pragma(source, options) {
-        return this.#inner.pragma(source, options);
-    }
-    close() {
-        this.#inner.close();
-    }
-}
-// ─── The raw SQLite magic — used to distinguish a plaintext DB from an encrypted one ──
-// A plaintext SQLite file begins with "SQLite format 3\0". A SQLCipher database encrypts the
-// header too, so its first bytes are ciphertext and never match. The migration path uses this to
-// detect a legacy plaintext DB that must be migrated.
-const SQLITE_MAGIC = Buffer.concat([Buffer.from("SQLite format 3", "latin1"), Buffer.from([0x00])]);
-/** True when the file at `dbPath` exists and is an UNENCRYPTED node:sqlite database. */
-export function isPlaintextSqliteFile(dbPath) {
-    if (!existsSync(dbPath))
-        return false;
-    const head = Buffer.alloc(SQLITE_MAGIC.length);
-    try {
-        const fd = openSync(dbPath, "r");
-        try {
-            // Read exactly the header bytes — never slurp the whole (possibly very large) DB into RAM.
-            const bytesRead = readSync(fd, head, 0, SQLITE_MAGIC.length, 0);
-            if (bytesRead < SQLITE_MAGIC.length)
-                return false;
-        }
-        finally {
-            closeSync(fd);
-        }
-    }
-    catch {
-        return false;
-    }
-    return head.equals(SQLITE_MAGIC);
-}
-// ─── Key custody ─────────────────────────────────────────────────────────────────
-/**
- * Resolve the SQLCipher key, generating it on a genuinely fresh install only.
- *
- * Fail-closed matrix:
- *   key present                      → load it (must be 32 bytes).
- *   key absent + DB absent           → generate + persist (0600), proceed (fresh install).
- *   key absent + DB present          → THROW db_encryption_key_mismatch (never overwrite an
- *                                      existing DB with a new key — that would be data loss; and
- *                                      a legacy PLAINTEXT DB must be migrated first, not opened).
- */
-export function resolveDbKey(dbPath, keyPath) {
-    if (existsSync(keyPath)) {
-        const key = readFileSync(keyPath);
-        if (key.length !== DB_KEY_BYTES) {
-            throw new DbEncryptionError("db_encryption_key_mismatch", `SQLCipher key file is ${key.length} bytes, expected ${DB_KEY_BYTES}`, `The key file at ${keyPath} is malformed. Restore it from backup or remove it only if the database is also gone.`);
-        }
-        return new Uint8Array(key);
-    }
-    if (existsSync(dbPath)) {
-        throw new DbEncryptionError("db_encryption_key_mismatch", `database exists at ${dbPath} but its SQLCipher key file is missing`, `The encrypted database cannot be opened without its key file (${keyPath}). Restore the key file from backup. The daemon will not create a new plaintext store.`);
-    }
-    // Fresh install: generate and persist the key atomically with 0600.
-    const key = randomBytes(DB_KEY_BYTES);
-    const keyDir = dirname(keyPath);
-    mkdirSync(keyDir, { recursive: true, mode: 0o700 });
-    const tmp = join(keyDir, `.cello-dbkey-tmp-${process.pid}-${randomBytes(6).toString("hex")}`);
-    const fd = openSync(tmp, "wx", 0o600);
-    try {
-        writeSync(fd, key);
-        fsyncSync(fd);
-    }
-    catch (err) {
-        // Never leave a stray plaintext key fragment on disk if the write/fsync failed partway — the
-        // only plaintext key on disk is the one sanctioned key file.
-        closeSync(fd);
-        try {
-            unlinkSync(tmp);
-        }
-        catch {
-            /* ignore */
-        }
-        throw err;
-    }
-    closeSync(fd);
-    try {
-        renameSync(tmp, keyPath);
-    }
-    catch (err) {
-        try {
-            unlinkSync(tmp);
-        }
-        catch {
-            /* ignore */
-        }
-        throw err;
-    }
-    // Durability of the rename itself (parent-dir fsync) so a crash right after a fresh install can't
-    // lose the key while the encrypted DB exists. Best-effort — some platforms reject dir fsync.
-    try {
-        const dfd = openSync(keyDir, "r");
-        try {
-            fsyncSync(dfd);
-        }
-        finally {
-            closeSync(dfd);
-        }
-    }
-    catch {
-        /* directory fsync is best-effort */
-    }
-    return new Uint8Array(key);
-}
-// ─── Open ────────────────────────────────────────────────────────────────────────
-/**
- * Load the SQLCipher native module. Exported because the daemon's singleton lock needs the same
- * engine for its kernel-level file lock — one place that knows how to load the prebuilt, and one
- * error when it will not load.
- */
-export function loadSignalModule() {
-    const require = createRequire(import.meta.url);
-    try {
-        return require("@signalapp/sqlcipher");
-    }
-    catch (err) {
-        const reason = extractErrorMessage(err);
-        throw new DbEncryptionError("db_sqlcipher_unavailable", `SQLCipher native module unavailable: ${reason}`, "The @signalapp/sqlcipher prebuilt binary failed to load for this platform. Reinstall the CELLO client.");
-    }
-}
-/**
- * Open `dbPath` as a SQLCipher database keyed by `dbKey`. Verifies the key (reads sqlite_master)
- * and enables WAL after verification. Throws DbEncryptionError on any failure — never returns a
- * plaintext handle.
- */
-export function openEncryptedDatabase(dbPath, dbKey, logger) {
-    const mod = loadSignalModule();
-    const Ctor = mod.Database ?? mod.default;
-    let inner;
-    try {
-        inner = new Ctor(dbPath);
-    }
-    catch (err) {
-        const reason = extractErrorMessage(err);
-        throw new DbEncryptionError("db_open_failed", reason, `Could not open the database file at ${dbPath}.`);
-    }
-    // The key is set OUTSIDE the message-bearing try below — keep it there. The key hex must never be
-    // able to reach a thrown/logged error string, even if a future SQLCipher build echoed the pragma
-    // source on error. A well-formed `key` pragma does not throw; a wrong key surfaces at the verify
-    // read instead.
-    const keyHex = Buffer.from(dbKey).toString("hex");
-    inner.pragma(`key = "x'${keyHex}'"`);
-    try {
-        // Verify: reading sqlite_master decrypts the header. Wrong key / plaintext file → throws.
-        inner.prepare("SELECT count(*) AS c FROM sqlite_master").get([]);
-    }
-    catch (err) {
-        try {
-            inner.close();
-        }
-        catch {
-            /* ignore */
-        }
-        // Do NOT echo the underlying SQLITE message into guidance verbatim, and log nothing here (the
-        // caller logs). No key material may appear in the message.
-        const reason = extractErrorMessage(err);
-        throw new DbEncryptionError("db_encryption_key_mismatch", `database did not decrypt with the supplied key (${reason})`, "The SQLCipher key does not match this database. Restore the correct key file; the daemon will not fall back to a plaintext store.");
-    }
-    // WAL only AFTER key verification, so WAL/SHM files are encrypted.
-    try {
-        const mode = inner.pragma("journal_mode=WAL", { simple: true });
-        if (mode !== "wal") {
-            // Not fatal — SQLCipher encrypts the rollback journal too, so at-rest integrity holds — but
-            // surface it so a permanent non-WAL degradation (e.g. a network filesystem) is not silent.
-            logger?.warn("persist.db.wal.unavailable", { mode: String(mode) });
-        }
-    }
-    catch (err) {
-        logger?.warn("persist.db.wal.unavailable", { error: extractErrorMessage(err) });
-    }
-    // WAIT FOR A BUSY LOCK INSTEAD OF FAILING THE WRITE INSTANTLY.
-    //
-    // SQLite's default busy timeout is ZERO: a second writer does not queue, it returns SQLITE_BUSY on
-    // the spot. This database has more than one connection by design — the daemon holds one, the CLI
-    // and the identity migration open their own — so "another writer held the lock for 3ms" is an
-    // ORDINARY event here, not an exceptional one, and answering it with an immediate failure turns a
-    // routine overlap into a lost write.
-    //
-    // The write that made this concrete is the shutdown UPDATE that marks live sessions `interrupted`:
-    // it is caught and logged, and the daemon then exits 0. A machine under load could therefore report
-    // a clean shutdown while leaving sessions marked `active` forever — rows that look live to every
-    // later read but have no node behind them. A timeout does not paper over that; it removes the
-    // contention that caused it, and a lock genuinely held for 5 s is a real fault that still surfaces.
-    try {
-        inner.pragma("busy_timeout=5000");
-    }
-    catch (err) {
-        logger?.warn("persist.db.busy_timeout.unavailable", { error: extractErrorMessage(err) });
-    }
-    // M10-D19: FOREIGN KEY enforcement. SQLite defaults this OFF — and with it off, a declared
-    // `FOREIGN KEY` is DECORATIVE: SQLite happily accepts an orphan row, so a schema that looks like it
-    // enforces a relationship enforces nothing. INV-AGENT-SCOPED depends on this being real (a received
-    // trust signal cannot exist except hung off one agent's contact row — `contact_trust_signals` FKs to
-    // `contacts(agent_id, pubkey)`), and ON DELETE CASCADE only fires when it is on.
-    //
-    // It is per-CONNECTION, not per-database, so it belongs here at open — not in a migration, which
-    // would set it for exactly one connection and leave every later one unguarded.
-    //
-    // Safe to enable on existing databases: the daemon declared ZERO foreign keys before this, so there
-    // is no pre-existing constraint that enforcement could retroactively violate.
-    inner.pragma("foreign_keys = ON");
-    const fkOn = inner.pragma("foreign_keys", { simple: true });
-    if (fkOn !== 1 && fkOn !== true) {
-        // Refuse to run with a silently-unenforced schema. If FKs cannot be turned on, every FK in the
-        // DB is a lie and INV-AGENT-SCOPED is unenforced — that is not a degraded mode we announce and
-        // continue through, it is a broken security property. ABSENT IS NOT FINE.
-        try {
-            inner.close();
-        }
-        catch { /* ignore */ }
-        throw new DbEncryptionError("db_open_failed", `PRAGMA foreign_keys did not take effect (reported ${String(fkOn)})`, "This SQLite build will not enforce foreign keys, so per-agent scoping of received trust signals cannot be guaranteed. The daemon will not run with an unenforced schema.");
-    }
-    return new SqlcipherDatabase(inner);
-}
-/**
- * Run a table REBUILD (the create-copy-drop-rename recipe) with foreign keys safely disabled.
- *
- * THE TRAP THIS EXISTS TO CLOSE. With `PRAGMA foreign_keys = ON` (M10-D19), SQLite treats
- * `DROP TABLE parent` as an implicit `DELETE FROM parent` — which **fires `ON DELETE CASCADE` and
- * silently empties every child table**. No error. No log. The rebuild's own row-count guards count
- * the table being rebuilt, not its children, so they pass. Measured:
- *
- *     children before rebuild: 1
- *     PRAGMA foreign_keys = OFF  (inside BEGIN)  -> still reports 1   <-- A SILENT NO-OP
- *     DROP TABLE contacts                        -> children: 0       <-- cascade fired
- *
- * And the obvious mitigation does not work: **`PRAGMA foreign_keys` is a no-op inside a
- * transaction.** SQLite ignores it and says nothing. Since every rebuild in this codebase runs
- * inside one `BEGIN…COMMIT` (agent-id-migration.ts rebuilds seven tables, `contacts` among them),
- * a rebuild that "disabled" FKs in the usual place would still cascade.
- *
- * So the pragma must be toggled OUTSIDE the transaction, which is what this helper enforces — and it
- * VERIFIES the toggle took effect rather than assuming it, because the failure is silent by nature.
- * On the way out it re-enables FKs and runs `PRAGMA foreign_key_check`: a rebuild that left a
- * dangling reference (e.g. `ALTER TABLE parent RENAME` rewrites children's FK clauses to point at
- * the renamed table) is a loud failure here rather than a mystery on some later insert.
- */
-export function withForeignKeysOff(db, logger, fn) {
-    db.exec("PRAGMA foreign_keys = OFF");
-    // Verify. If we are inside a transaction the pragma was silently ignored, and proceeding would
-    // cascade-delete children on the first DROP. Refuse — do not rebuild with FKs live.
-    const off = db.prepare("PRAGMA foreign_keys").get();
-    if (off?.foreign_keys !== 0) {
-        throw new Error("table rebuild refused: PRAGMA foreign_keys = OFF did not take effect (still " +
-            `${String(off?.foreign_keys)}). PRAGMA foreign_keys is a NO-OP inside a transaction — this ` +
-            "helper must be called OUTSIDE any BEGIN. Rebuilding with FKs live makes DROP TABLE <parent> " +
-            "cascade-delete every child row, silently.");
-    }
-    try {
-        return fn();
-    }
-    finally {
-        db.exec("PRAGMA foreign_keys = ON");
-        const violations = db.prepare("PRAGMA foreign_key_check").all();
-        if (violations.length > 0) {
-            // The rebuild left dangling references. Loud — an FK that points at a table that no longer
-            // exists (or a renamed one) fails on some unrelated insert much later, naming the wrong
-            // subsystem entirely.
-            logger?.error("persist.db.rebuild.fk_violation", { violations: violations.length });
-            throw new Error(`table rebuild left ${violations.length} foreign-key violation(s) — PRAGMA foreign_key_check ` +
-                "is non-empty. The rebuilt table's children now reference a parent that is missing or renamed.");
-        }
-    }
-}
-/**
- * Convenience used by tests and tooling: resolve the key file beside `dbPath` and open. Throws if
- * the key file is absent (it does NOT generate one) — callers inspecting an existing DB always have
- * the key.
- */
-export function openEncryptedDatabaseAtPath(dbPath, keyPath) {
-    const kp = keyPath ?? `${dbPath}.key`;
-    if (!existsSync(kp)) {
-        throw new DbEncryptionError("db_encryption_key_mismatch", `SQLCipher key file not found at ${kp}`, "Provide the key file path that was generated beside the database.");
-    }
-    const key = readFileSync(kp);
-    return openEncryptedDatabase(dbPath, new Uint8Array(key));
-}
-/** The key file path the daemon uses for a given DB path — the one plaintext key file. */
-export function dbKeyPathFor(dbPath) {
-    return `${dbPath}.key`;
-}
-//# sourceMappingURL=sqlcipher-db.js.map

package/dist/sqlcipher-db.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sqlcipher-db.js","sourceRoot":"","sources":["../src/sqlcipher-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EACL,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,YAAY,GAAG,EAAE,CAAC,CAAC,UAAU;AA0BnC,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAc;IAC3B,mFAAmF;IAC1E,QAAQ,CAAS;IAC1B,YAAY,IAAiB,EAAE,OAAe,EAAE,QAAgB;QAC9D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAwBD,mFAAmF;AAEnF,MAAM,kBAAkB;IACb,MAAM,CAAkB;IACjC,YAAY,KAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF;AAED,MAAM,iBAAiB;IACZ,MAAM,CAAiB;IAChC,YAAY,KAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,GAAW;QACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,CAAC,MAAc,EAAE,OAA8B;QACnD,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAED,yFAAyF;AACzF,6FAA6F;AAC7F,iGAAiG;AACjG,sDAAsD;AACtD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpG,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,2FAA2F;YAC3F,MAAM,SAAS,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAChE,IAAI,SAAS,GAAG,YAAY,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACnC,CAAC;AAED,oFAAoF;AAEpF;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,OAAe;IAC1D,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAChC,MAAM,IAAI,iBAAiB,CACzB,4BAA4B,EAC5B,yBAAyB,GAAG,CAAC,MAAM,oBAAoB,YAAY,EAAE,EACrE,mBAAmB,OAAO,uFAAuF,CAClH,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,iBAAiB,CACzB,4BAA4B,EAC5B,sBAAsB,MAAM,wCAAwC,EACpE,iEAAiE,OAAO,wFAAwF,CACjK,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,MAAM,GAAG,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,oBAAoB,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnB,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6FAA6F;QAC7F,6DAA6D;QAC7D,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,SAAS,CAAC,EAAE,CAAC,CAAC;IACd,IAAI,CAAC;QACH,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,kGAAkG;IAClG,6FAA6F;IAC7F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,SAAS,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,oFAAoF;AAEpF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,sBAAsB,CAAiB,CAAC;IACzD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,iBAAiB,CACzB,0BAA0B,EAC1B,wCAAwC,MAAM,EAAE,EAChD,wGAAwG,CACzG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,KAAiB,EACjB,MAAyE;IAEzE,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;IAEzC,IAAI,KAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,MAAM,EAAE,uCAAuC,MAAM,GAAG,CAAC,CAAC;IAC1G,CAAC;IAED,kGAAkG;IAClG,iGAAiG;IACjG,iGAAiG;IACjG,gBAAgB;IAChB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,KAAK,CAAC,MAAM,CAAC,YAAY,MAAM,IAAI,CAAC,CAAC;IAErC,IAAI,CAAC;QACH,0FAA0F;QAC1F,KAAK,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,8FAA8F;QAC9F,2DAA2D;QAC3D,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,iBAAiB,CACzB,4BAA4B,EAC5B,mDAAmD,MAAM,GAAG,EAC5D,mIAAmI,CACpI,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,4FAA4F;YAC5F,2FAA2F;YAC3F,MAAM,EAAE,IAAI,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,EAAE,IAAI,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,+DAA+D;IAC/D,EAAE;IACF,mGAAmG;IACnG,iGAAiG;IACjG,8FAA8F;IAC9F,kGAAkG;IAClG,qCAAqC;IACrC,EAAE;IACF,mGAAmG;IACnG,oGAAoG;IACpG,iGAAiG;IACjG,8FAA8F;IAC9F,oGAAoG;IACpG,IAAI,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,EAAE,IAAI,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,2FAA2F;IAC3F,oGAAoG;IACpG,oGAAoG;IACpG,qGAAqG;IACrG,iFAAiF;IACjF,EAAE;IACF,iGAAiG;IACjG,+EAA+E;IAC/E,EAAE;IACF,oGAAoG;IACpG,8EAA8E;IAC9E,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAChC,+FAA+F;QAC/F,+FAA+F;QAC/F,0EAA0E;QAC1E,IAAI,CAAC;YAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,IAAI,iBAAiB,CACzB,gBAAgB,EAChB,qDAAqD,MAAM,CAAC,IAAI,CAAC,GAAG,EACpE,0KAA0K,CAC3K,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,kBAAkB,CAAI,EAAkB,EAAE,MAA0B,EAAE,EAAW;IAC/F,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAErC,+FAA+F;IAC/F,oFAAoF;IACpF,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAA2C,CAAC;IAC7F,IAAI,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC9E,GAAG,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,gEAAgE;YAC5F,8FAA8F;YAC9F,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,GAAG,EAAe,CAAC;QAC7E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,2FAA2F;YAC3F,wFAAwF;YACxF,sBAAsB;YACtB,MAAM,EAAE,KAAK,CAAC,iCAAiC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YACpF,MAAM,IAAI,KAAK,CACb,sBAAsB,UAAU,CAAC,MAAM,uDAAuD;gBAC9F,+FAA+F,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAc,EAAE,OAAgB;IAC1E,MAAM,EAAE,GAAG,OAAO,IAAI,GAAG,MAAM,MAAM,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CACzB,4BAA4B,EAC5B,mCAAmC,EAAE,EAAE,EACvC,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC7B,OAAO,qBAAqB,CAAC,MAAM,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO,GAAG,MAAM,MAAM,CAAC;AACzB,CAAC"}