@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/sqlcipher-db.js

@@ -0,0 +1,357 @@
+/**
+ * The daemon's single encrypted store.
+ *
+ * The daemon DB is a SQLCipher database (whole-file AES-256 at rest). This module is the ONE
+ * engine site: it loads @signalapp/sqlcipher (prebuilt — never compiled from source), opens the DB with a
+ * PRAGMA key, verifies the key, enables WAL, and presents a thin `DaemonDatabase` adapter so the
+ * rest of the daemon (SessionNodeManager, RetryQueue, NonceDedupStore) keeps its node:sqlite-style
+ * varargs call sites unchanged.
+ *
+ * Why an adapter: node:sqlite's `DatabaseSync` uses varargs (`stmt.run(a, b, c)`); @signalapp's
+ * better-sqlite3-style API takes an array (`stmt.run([a, b, c])`). The `DaemonDatabase` /
+ * `DaemonStatement` interfaces expose the varargs surface — node:sqlite's `DatabaseSync` structurally
+ * satisfies them too (used for in-memory test handles and for reading a legacy plaintext DB during
+ * migration), and `SqlcipherDatabase` implements them by forwarding varargs as an array.
+ *
+ * Key custody: the SQLCipher key is a standalone random 32-byte 0600 key file beside the DB. It is
+ * NOT derived from K_local — that is a chicken-and-egg, since K_local itself lives inside the DB. It
+ * is the ONE plaintext key file on disk.
+ *
+ * FAILS CLOSED: there is no plaintext fallback anywhere. A wrong/missing key on an existing DB throws
+ * `db_encryption_key_mismatch`; the daemon never opens, creates, or migrates to a plaintext store as
+ * a fallback.
+ *
+ * Security invariants:
+ *   - The db key is NEVER logged, serialized, or placed in an error message — only the raw
+ *     `PRAGMA key` string uses the hex, and that string is never logged.
+ *   - WAL mode is enabled only AFTER key verification, so WAL files are encrypted at rest.
+ */
+import { createRequire } from "node:module";
+import { existsSync, readFileSync, readSync, openSync, writeSync, fsyncSync, closeSync, renameSync, mkdirSync, unlinkSync, } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { dirname, join } from "node:path";
+import { extractErrorMessage } from "./error-message.js";
+const DB_KEY_BYTES = 32; // AES-256
+export class DbEncryptionError extends Error {
+    code;
+    /** Actionable next step surfaced to the operator (never contains key material). */
+    guidance;
+    constructor(code, message, guidance) {
+        super(message);
+        this.name = "DbEncryptionError";
+        this.code = code;
+        this.guidance = guidance;
+    }
+}
+// ─── The varargs→array adapter ──────────────────────────────────────────────────
+class SqlcipherStatement {
+    #inner;
+    constructor(inner) {
+        this.#inner = inner;
+    }
+    run(...params) {
+        return this.#inner.run(params);
+    }
+    get(...params) {
+        return this.#inner.get(params);
+    }
+    all(...params) {
+        return this.#inner.all(params);
+    }
+}
+class SqlcipherDatabase {
+    #inner;
+    constructor(inner) {
+        this.#inner = inner;
+    }
+    exec(sql) {
+        this.#inner.exec(sql);
+    }
+    prepare(sql) {
+        return new SqlcipherStatement(this.#inner.prepare(sql));
+    }
+    pragma(source, options) {
+        return this.#inner.pragma(source, options);
+    }
+    close() {
+        this.#inner.close();
+    }
+}
+// ─── The raw SQLite magic — used to distinguish a plaintext DB from an encrypted one ──
+// A plaintext SQLite file begins with "SQLite format 3\0". A SQLCipher database encrypts the
+// header too, so its first bytes are ciphertext and never match. The migration path uses this to
+// detect a legacy plaintext DB that must be migrated.
+const SQLITE_MAGIC = Buffer.concat([Buffer.from("SQLite format 3", "latin1"), Buffer.from([0x00])]);
+/** True when the file at `dbPath` exists and is an UNENCRYPTED node:sqlite database. */
+export function isPlaintextSqliteFile(dbPath) {
+    if (!existsSync(dbPath))
+        return false;
+    const head = Buffer.alloc(SQLITE_MAGIC.length);
+    try {
+        const fd = openSync(dbPath, "r");
+        try {
+            // Read exactly the header bytes — never slurp the whole (possibly very large) DB into RAM.
+            const bytesRead = readSync(fd, head, 0, SQLITE_MAGIC.length, 0);
+            if (bytesRead < SQLITE_MAGIC.length)
+                return false;
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    catch {
+        return false;
+    }
+    return head.equals(SQLITE_MAGIC);
+}
+// ─── Key custody ─────────────────────────────────────────────────────────────────
+/**
+ * Resolve the SQLCipher key, generating it on a genuinely fresh install only.
+ *
+ * Fail-closed matrix:
+ *   key present                      → load it (must be 32 bytes).
+ *   key absent + DB absent           → generate + persist (0600), proceed (fresh install).
+ *   key absent + DB present          → THROW db_encryption_key_mismatch (never overwrite an
+ *                                      existing DB with a new key — that would be data loss; and
+ *                                      a legacy PLAINTEXT DB must be migrated first, not opened).
+ */
+export function resolveDbKey(dbPath, keyPath) {
+    if (existsSync(keyPath)) {
+        const key = readFileSync(keyPath);
+        if (key.length !== DB_KEY_BYTES) {
+            throw new DbEncryptionError("db_encryption_key_mismatch", `SQLCipher key file is ${key.length} bytes, expected ${DB_KEY_BYTES}`, `The key file at ${keyPath} is malformed. Restore it from backup or remove it only if the database is also gone.`);
+        }
+        return new Uint8Array(key);
+    }
+    if (existsSync(dbPath)) {
+        throw new DbEncryptionError("db_encryption_key_mismatch", `database exists at ${dbPath} but its SQLCipher key file is missing`, `The encrypted database cannot be opened without its key file (${keyPath}). Restore the key file from backup. The daemon will not create a new plaintext store.`);
+    }
+    // Fresh install: generate and persist the key atomically with 0600.
+    const key = randomBytes(DB_KEY_BYTES);
+    const keyDir = dirname(keyPath);
+    mkdirSync(keyDir, { recursive: true, mode: 0o700 });
+    const tmp = join(keyDir, `.cello-dbkey-tmp-${process.pid}-${randomBytes(6).toString("hex")}`);
+    const fd = openSync(tmp, "wx", 0o600);
+    try {
+        writeSync(fd, key);
+        fsyncSync(fd);
+    }
+    catch (err) {
+        // Never leave a stray plaintext key fragment on disk if the write/fsync failed partway — the
+        // only plaintext key on disk is the one sanctioned key file.
+        closeSync(fd);
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            /* ignore */
+        }
+        throw err;
+    }
+    closeSync(fd);
+    try {
+        renameSync(tmp, keyPath);
+    }
+    catch (err) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            /* ignore */
+        }
+        throw err;
+    }
+    // Durability of the rename itself (parent-dir fsync) so a crash right after a fresh install can't
+    // lose the key while the encrypted DB exists. Best-effort — some platforms reject dir fsync.
+    try {
+        const dfd = openSync(keyDir, "r");
+        try {
+            fsyncSync(dfd);
+        }
+        finally {
+            closeSync(dfd);
+        }
+    }
+    catch {
+        /* directory fsync is best-effort */
+    }
+    return new Uint8Array(key);
+}
+// ─── Open ────────────────────────────────────────────────────────────────────────
+/**
+ * Load the SQLCipher native module. Exported because the daemon's singleton lock needs the same
+ * engine for its kernel-level file lock — one place that knows how to load the prebuilt, and one
+ * error when it will not load.
+ */
+export function loadSignalModule() {
+    const require = createRequire(import.meta.url);
+    try {
+        return require("@signalapp/sqlcipher");
+    }
+    catch (err) {
+        const reason = extractErrorMessage(err);
+        throw new DbEncryptionError("db_sqlcipher_unavailable", `SQLCipher native module unavailable: ${reason}`, "The @signalapp/sqlcipher prebuilt binary failed to load for this platform. Reinstall the CELLO client.");
+    }
+}
+/**
+ * Open `dbPath` as a SQLCipher database keyed by `dbKey`. Verifies the key (reads sqlite_master)
+ * and enables WAL after verification. Throws DbEncryptionError on any failure — never returns a
+ * plaintext handle.
+ */
+export function openEncryptedDatabase(dbPath, dbKey, logger) {
+    const mod = loadSignalModule();
+    const Ctor = mod.Database ?? mod.default;
+    let inner;
+    try {
+        inner = new Ctor(dbPath);
+    }
+    catch (err) {
+        const reason = extractErrorMessage(err);
+        throw new DbEncryptionError("db_open_failed", reason, `Could not open the database file at ${dbPath}.`);
+    }
+    // The key is set OUTSIDE the message-bearing try below — keep it there. The key hex must never be
+    // able to reach a thrown/logged error string, even if a future SQLCipher build echoed the pragma
+    // source on error. A well-formed `key` pragma does not throw; a wrong key surfaces at the verify
+    // read instead.
+    const keyHex = Buffer.from(dbKey).toString("hex");
+    inner.pragma(`key = "x'${keyHex}'"`);
+    try {
+        // Verify: reading sqlite_master decrypts the header. Wrong key / plaintext file → throws.
+        inner.prepare("SELECT count(*) AS c FROM sqlite_master").get([]);
+    }
+    catch (err) {
+        try {
+            inner.close();
+        }
+        catch {
+            /* ignore */
+        }
+        // Do NOT echo the underlying SQLITE message into guidance verbatim, and log nothing here (the
+        // caller logs). No key material may appear in the message.
+        const reason = extractErrorMessage(err);
+        throw new DbEncryptionError("db_encryption_key_mismatch", `database did not decrypt with the supplied key (${reason})`, "The SQLCipher key does not match this database. Restore the correct key file; the daemon will not fall back to a plaintext store.");
+    }
+    // WAL only AFTER key verification, so WAL/SHM files are encrypted.
+    try {
+        const mode = inner.pragma("journal_mode=WAL", { simple: true });
+        if (mode !== "wal") {
+            // Not fatal — SQLCipher encrypts the rollback journal too, so at-rest integrity holds — but
+            // surface it so a permanent non-WAL degradation (e.g. a network filesystem) is not silent.
+            logger?.warn("persist.db.wal.unavailable", { mode: String(mode) });
+        }
+    }
+    catch (err) {
+        logger?.warn("persist.db.wal.unavailable", { error: extractErrorMessage(err) });
+    }
+    // WAIT FOR A BUSY LOCK INSTEAD OF FAILING THE WRITE INSTANTLY.
+    //
+    // SQLite's default busy timeout is ZERO: a second writer does not queue, it returns SQLITE_BUSY on
+    // the spot. This database has more than one connection by design — the daemon holds one, the CLI
+    // and the identity migration open their own — so "another writer held the lock for 3ms" is an
+    // ORDINARY event here, not an exceptional one, and answering it with an immediate failure turns a
+    // routine overlap into a lost write.
+    //
+    // The write that made this concrete is the shutdown UPDATE that marks live sessions `interrupted`:
+    // it is caught and logged, and the daemon then exits 0. A machine under load could therefore report
+    // a clean shutdown while leaving sessions marked `active` forever — rows that look live to every
+    // later read but have no node behind them. A timeout does not paper over that; it removes the
+    // contention that caused it, and a lock genuinely held for 5 s is a real fault that still surfaces.
+    try {
+        inner.pragma("busy_timeout=5000");
+    }
+    catch (err) {
+        logger?.warn("persist.db.busy_timeout.unavailable", { error: extractErrorMessage(err) });
+    }
+    // M10-D19: FOREIGN KEY enforcement. SQLite defaults this OFF — and with it off, a declared
+    // `FOREIGN KEY` is DECORATIVE: SQLite happily accepts an orphan row, so a schema that looks like it
+    // enforces a relationship enforces nothing. INV-AGENT-SCOPED depends on this being real (a received
+    // trust signal cannot exist except hung off one agent's contact row — `contact_trust_signals` FKs to
+    // `contacts(agent_id, pubkey)`), and ON DELETE CASCADE only fires when it is on.
+    //
+    // It is per-CONNECTION, not per-database, so it belongs here at open — not in a migration, which
+    // would set it for exactly one connection and leave every later one unguarded.
+    //
+    // Safe to enable on existing databases: the daemon declared ZERO foreign keys before this, so there
+    // is no pre-existing constraint that enforcement could retroactively violate.
+    inner.pragma("foreign_keys = ON");
+    const fkOn = inner.pragma("foreign_keys", { simple: true });
+    if (fkOn !== 1 && fkOn !== true) {
+        // Refuse to run with a silently-unenforced schema. If FKs cannot be turned on, every FK in the
+        // DB is a lie and INV-AGENT-SCOPED is unenforced — that is not a degraded mode we announce and
+        // continue through, it is a broken security property. ABSENT IS NOT FINE.
+        try {
+            inner.close();
+        }
+        catch { /* ignore */ }
+        throw new DbEncryptionError("db_open_failed", `PRAGMA foreign_keys did not take effect (reported ${String(fkOn)})`, "This SQLite build will not enforce foreign keys, so per-agent scoping of received trust signals cannot be guaranteed. The daemon will not run with an unenforced schema.");
+    }
+    return new SqlcipherDatabase(inner);
+}
+/**
+ * Run a table REBUILD (the create-copy-drop-rename recipe) with foreign keys safely disabled.
+ *
+ * THE TRAP THIS EXISTS TO CLOSE. With `PRAGMA foreign_keys = ON` (M10-D19), SQLite treats
+ * `DROP TABLE parent` as an implicit `DELETE FROM parent` — which **fires `ON DELETE CASCADE` and
+ * silently empties every child table**. No error. No log. The rebuild's own row-count guards count
+ * the table being rebuilt, not its children, so they pass. Measured:
+ *
+ *     children before rebuild: 1
+ *     PRAGMA foreign_keys = OFF  (inside BEGIN)  -> still reports 1   <-- A SILENT NO-OP
+ *     DROP TABLE contacts                        -> children: 0       <-- cascade fired
+ *
+ * And the obvious mitigation does not work: **`PRAGMA foreign_keys` is a no-op inside a
+ * transaction.** SQLite ignores it and says nothing. Since every rebuild in this codebase runs
+ * inside one `BEGIN…COMMIT` (agent-id-migration.ts rebuilds seven tables, `contacts` among them),
+ * a rebuild that "disabled" FKs in the usual place would still cascade.
+ *
+ * So the pragma must be toggled OUTSIDE the transaction, which is what this helper enforces — and it
+ * VERIFIES the toggle took effect rather than assuming it, because the failure is silent by nature.
+ * On the way out it re-enables FKs and runs `PRAGMA foreign_key_check`: a rebuild that left a
+ * dangling reference (e.g. `ALTER TABLE parent RENAME` rewrites children's FK clauses to point at
+ * the renamed table) is a loud failure here rather than a mystery on some later insert.
+ */
+export function withForeignKeysOff(db, logger, fn) {
+    db.exec("PRAGMA foreign_keys = OFF");
+    // Verify. If we are inside a transaction the pragma was silently ignored, and proceeding would
+    // cascade-delete children on the first DROP. Refuse — do not rebuild with FKs live.
+    const off = db.prepare("PRAGMA foreign_keys").get();
+    if (off?.foreign_keys !== 0) {
+        throw new Error("table rebuild refused: PRAGMA foreign_keys = OFF did not take effect (still " +
+            `${String(off?.foreign_keys)}). PRAGMA foreign_keys is a NO-OP inside a transaction — this ` +
+            "helper must be called OUTSIDE any BEGIN. Rebuilding with FKs live makes DROP TABLE <parent> " +
+            "cascade-delete every child row, silently.");
+    }
+    try {
+        return fn();
+    }
+    finally {
+        db.exec("PRAGMA foreign_keys = ON");
+        const violations = db.prepare("PRAGMA foreign_key_check").all();
+        if (violations.length > 0) {
+            // The rebuild left dangling references. Loud — an FK that points at a table that no longer
+            // exists (or a renamed one) fails on some unrelated insert much later, naming the wrong
+            // subsystem entirely.
+            logger?.error("persist.db.rebuild.fk_violation", { violations: violations.length });
+            throw new Error(`table rebuild left ${violations.length} foreign-key violation(s) — PRAGMA foreign_key_check ` +
+                "is non-empty. The rebuilt table's children now reference a parent that is missing or renamed.");
+        }
+    }
+}
+/**
+ * Convenience used by tests and tooling: resolve the key file beside `dbPath` and open. Throws if
+ * the key file is absent (it does NOT generate one) — callers inspecting an existing DB always have
+ * the key.
+ */
+export function openEncryptedDatabaseAtPath(dbPath, keyPath) {
+    const kp = keyPath ?? `${dbPath}.key`;
+    if (!existsSync(kp)) {
+        throw new DbEncryptionError("db_encryption_key_mismatch", `SQLCipher key file not found at ${kp}`, "Provide the key file path that was generated beside the database.");
+    }
+    const key = readFileSync(kp);
+    return openEncryptedDatabase(dbPath, new Uint8Array(key));
+}
+/** The key file path the daemon uses for a given DB path — the one plaintext key file. */
+export function dbKeyPathFor(dbPath) {
+    return `${dbPath}.key`;
+}
+//# sourceMappingURL=sqlcipher-db.js.map

package/dist/sqlcipher-db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlcipher-db.js","sourceRoot":"","sources":["../src/sqlcipher-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EACL,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,YAAY,GAAG,EAAE,CAAC,CAAC,UAAU;AA0BnC,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAc;IAC3B,mFAAmF;IAC1E,QAAQ,CAAS;IAC1B,YAAY,IAAiB,EAAE,OAAe,EAAE,QAAgB;QAC9D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAwBD,mFAAmF;AAEnF,MAAM,kBAAkB;IACb,MAAM,CAAkB;IACjC,YAAY,KAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF;AAED,MAAM,iBAAiB;IACZ,MAAM,CAAiB;IAChC,YAAY,KAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,GAAW;QACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,CAAC,MAAc,EAAE,OAA8B;QACnD,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAED,yFAAyF;AACzF,6FAA6F;AAC7F,iGAAiG;AACjG,sDAAsD;AACtD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpG,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,2FAA2F;YAC3F,MAAM,SAAS,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAChE,IAAI,SAAS,GAAG,YAAY,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACnC,CAAC;AAED,oFAAoF;AAEpF;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,OAAe;IAC1D,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAChC,MAAM,IAAI,iBAAiB,CACzB,4BAA4B,EAC5B,yBAAyB,GAAG,CAAC,MAAM,oBAAoB,YAAY,EAAE,EACrE,mBAAmB,OAAO,uFAAuF,CAClH,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,iBAAiB,CACzB,4BAA4B,EAC5B,sBAAsB,MAAM,wCAAwC,EACpE,iEAAiE,OAAO,wFAAwF,CACjK,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,MAAM,GAAG,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,oBAAoB,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnB,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6FAA6F;QAC7F,6DAA6D;QAC7D,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,SAAS,CAAC,EAAE,CAAC,CAAC;IACd,IAAI,CAAC;QACH,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,kGAAkG;IAClG,6FAA6F;IAC7F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,SAAS,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,oFAAoF;AAEpF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,sBAAsB,CAAiB,CAAC;IACzD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,iBAAiB,CACzB,0BAA0B,EAC1B,wCAAwC,MAAM,EAAE,EAChD,wGAAwG,CACzG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,KAAiB,EACjB,MAAyE;IAEzE,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;IAEzC,IAAI,KAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,MAAM,EAAE,uCAAuC,MAAM,GAAG,CAAC,CAAC;IAC1G,CAAC;IAED,kGAAkG;IAClG,iGAAiG;IACjG,iGAAiG;IACjG,gBAAgB;IAChB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,KAAK,CAAC,MAAM,CAAC,YAAY,MAAM,IAAI,CAAC,CAAC;IAErC,IAAI,CAAC;QACH,0FAA0F;QAC1F,KAAK,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,8FAA8F;QAC9F,2DAA2D;QAC3D,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,iBAAiB,CACzB,4BAA4B,EAC5B,mDAAmD,MAAM,GAAG,EAC5D,mIAAmI,CACpI,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,4FAA4F;YAC5F,2FAA2F;YAC3F,MAAM,EAAE,IAAI,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,EAAE,IAAI,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,+DAA+D;IAC/D,EAAE;IACF,mGAAmG;IACnG,iGAAiG;IACjG,8FAA8F;IAC9F,kGAAkG;IAClG,qCAAqC;IACrC,EAAE;IACF,mGAAmG;IACnG,oGAAoG;IACpG,iGAAiG;IACjG,8FAA8F;IAC9F,oGAAoG;IACpG,IAAI,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,EAAE,IAAI,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,2FAA2F;IAC3F,oGAAoG;IACpG,oGAAoG;IACpG,qGAAqG;IACrG,iFAAiF;IACjF,EAAE;IACF,iGAAiG;IACjG,+EAA+E;IAC/E,EAAE;IACF,oGAAoG;IACpG,8EAA8E;IAC9E,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAChC,+FAA+F;QAC/F,+FAA+F;QAC/F,0EAA0E;QAC1E,IAAI,CAAC;YAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,IAAI,iBAAiB,CACzB,gBAAgB,EAChB,qDAAqD,MAAM,CAAC,IAAI,CAAC,GAAG,EACpE,0KAA0K,CAC3K,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,kBAAkB,CAAI,EAAkB,EAAE,MAA0B,EAAE,EAAW;IAC/F,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAErC,+FAA+F;IAC/F,oFAAoF;IACpF,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAA2C,CAAC;IAC7F,IAAI,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC9E,GAAG,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,gEAAgE;YAC5F,8FAA8F;YAC9F,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,GAAG,EAAe,CAAC;QAC7E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,2FAA2F;YAC3F,wFAAwF;YACxF,sBAAsB;YACtB,MAAM,EAAE,KAAK,CAAC,iCAAiC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YACpF,MAAM,IAAI,KAAK,CACb,sBAAsB,UAAU,CAAC,MAAM,uDAAuD;gBAC9F,+FAA+F,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAc,EAAE,OAAgB;IAC1E,MAAM,EAAE,GAAG,OAAO,IAAI,GAAG,MAAM,MAAM,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CACzB,4BAA4B,EAC5B,mCAAmC,EAAE,EAAE,EACvC,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC7B,OAAO,qBAAqB,CAAC,MAAM,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO,GAAG,MAAM,MAAM,CAAC;AACzB,CAAC"}