@centient/secrets 0.4.0 → 0.6.0

package/dist/vault/policy.js

@@ -0,0 +1,68 @@
+/**
+ * SecretsPolicy — Middleware layer for credential operations.
+ *
+ * Policies are cross-cutting concerns (audit, rate limiting, access
+ * control, attestation) applied to every credential operation via
+ * `setSecretsPolicies([...])`. In 0.5.0 only the audit policy is
+ * shipped; the API shape is designed to grow into the full policy
+ * stack described in ADR-002.
+ *
+ * Execution model:
+ *   1. `before` hooks run top-to-bottom. If any throws, the operation
+ *      is aborted and the error propagates to the caller.
+ *   2. The backend operation executes.
+ *   3. `after` hooks run bottom-to-top with a structured event
+ *      describing the outcome. Exceptions in `after` hooks are
+ *      swallowed with a one-time stderr warning — audit infrastructure
+ *      failures must never break credential operations.
+ */
+// =============================================================================
+// Policy registry
+// =============================================================================
+let activePolicies = [];
+let afterWarningEmitted = false;
+export function setSecretsPolicies(policies) {
+    activePolicies = [...policies];
+    afterWarningEmitted = false;
+}
+export function getActivePolicies() {
+    return activePolicies;
+}
+export async function runBeforeHooks(op) {
+    for (const policy of activePolicies) {
+        if (policy.before)
+            await policy.before(op);
+    }
+}
+export function runAfterHooks(event) {
+    for (let i = activePolicies.length - 1; i >= 0; i--) {
+        const policy = activePolicies[i];
+        if (policy.after) {
+            try {
+                policy.after(event);
+            }
+            catch (err) {
+                if (!afterWarningEmitted) {
+                    afterWarningEmitted = true;
+                    const msg = err instanceof Error ? err.message : String(err);
+                    process.stderr.write(`[secrets] policy "${policy.name}" after-hook threw (swallowed): ${msg}\n`);
+                }
+            }
+        }
+    }
+}
+export function auditTrail(opts) {
+    const includeReads = opts.includeReads ?? true;
+    return {
+        name: "auditTrail",
+        after(event) {
+            if (!includeReads &&
+                (event.type === "credential_read" ||
+                    event.type === "credential_read_missing")) {
+                return;
+            }
+            opts.sink(event);
+        },
+    };
+}
+//# sourceMappingURL=policy.js.map

package/dist/vault/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/vault/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAkDH,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF,IAAI,cAAc,GAAoB,EAAE,CAAC;AACzC,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAEhC,MAAM,UAAU,kBAAkB,CAAC,QAAyB;IAC1D,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/B,mBAAmB,GAAG,KAAK,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAoB;IACvD,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,KAAK,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAE,CAAC;QAClC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,mBAAmB,GAAG,IAAI,CAAC;oBAC3B,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qBAAqB,MAAM,CAAC,IAAI,mCAAmC,GAAG,IAAI,CAC3E,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAWD,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAC/C,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,KAAK,CAAC,KAAmB;YACvB,IACE,CAAC,YAAY;gBACb,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB;oBAC/B,KAAK,CAAC,IAAI,KAAK,yBAAyB,CAAC,EAC3C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/vault/session-vault-errors.d.ts

@@ -0,0 +1,38 @@
+/**
+ * SessionVault error classes — extracted so helper modules (file-lock,
+ * sidecar) can throw them without creating an import cycle back into
+ * session-vault.ts.
+ *
+ * Each subclass restores the prototype chain with `Object.setPrototypeOf`
+ * so `instanceof VaultError` etc. remains robust when the class is consumed
+ * across an ES transpile boundary (L2 — matches the EngramError pattern in
+ * `packages/sdk/src/errors.ts`).
+ */
+/** Base class for SessionVault errors. */
+export declare class VaultError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/** Thrown when the master key can't be retrieved from the configured provider. */
+export declare class VaultUnlockError extends VaultError {
+    constructor(message: string);
+}
+/** Thrown when decryption fails — wrong key, corrupted file, or AAD mismatch. */
+export declare class VaultDecryptError extends VaultError {
+    constructor(message: string);
+}
+/** Thrown when rollback is detected and not explicitly accepted. */
+export declare class VaultRollbackError extends VaultError {
+    readonly expected: number;
+    readonly actual: number;
+    constructor(expected: number, actual: number);
+}
+/** Thrown when operations are attempted on a closed vault. */
+export declare class VaultClosedError extends VaultError {
+    constructor();
+}
+/** Thrown when the write-path file lock can't be acquired within the timeout. */
+export declare class VaultLockError extends VaultError {
+    constructor(message: string);
+}
+//# sourceMappingURL=session-vault-errors.d.ts.map

package/dist/vault/session-vault-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-vault-errors.d.ts","sourceRoot":"","sources":["../../src/vault/session-vault-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,0CAA0C;AAC1C,qBAAa,UAAW,SAAQ,KAAK;aACP,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1D;AAED,kFAAkF;AAClF,qBAAa,gBAAiB,SAAQ,UAAU;gBAClC,OAAO,EAAE,MAAM;CAK5B;AAED,iFAAiF;AACjF,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,EAAE,MAAM;CAK5B;AAED,oEAAoE;AACpE,qBAAa,kBAAmB,SAAQ,UAAU;aAE9B,QAAQ,EAAE,MAAM;aAChB,MAAM,EAAE,MAAM;gBADd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM;CAWjC;AAED,8DAA8D;AAC9D,qBAAa,gBAAiB,SAAQ,UAAU;;CAM/C;AAED,iFAAiF;AACjF,qBAAa,cAAe,SAAQ,UAAU;gBAChC,OAAO,EAAE,MAAM;CAK5B"}

package/dist/vault/session-vault-errors.js

@@ -0,0 +1,67 @@
+/**
+ * SessionVault error classes — extracted so helper modules (file-lock,
+ * sidecar) can throw them without creating an import cycle back into
+ * session-vault.ts.
+ *
+ * Each subclass restores the prototype chain with `Object.setPrototypeOf`
+ * so `instanceof VaultError` etc. remains robust when the class is consumed
+ * across an ES transpile boundary (L2 — matches the EngramError pattern in
+ * `packages/sdk/src/errors.ts`).
+ */
+/** Base class for SessionVault errors. */
+export class VaultError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "VaultError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Thrown when the master key can't be retrieved from the configured provider. */
+export class VaultUnlockError extends VaultError {
+    constructor(message) {
+        super("VAULT_UNLOCK_FAILED", message);
+        this.name = "VaultUnlockError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Thrown when decryption fails — wrong key, corrupted file, or AAD mismatch. */
+export class VaultDecryptError extends VaultError {
+    constructor(message) {
+        super("VAULT_DECRYPT_FAILED", message);
+        this.name = "VaultDecryptError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Thrown when rollback is detected and not explicitly accepted. */
+export class VaultRollbackError extends VaultError {
+    expected;
+    actual;
+    constructor(expected, actual) {
+        super("VAULT_VERSION_ROLLBACK_DETECTED", `Vault version rollback detected: sidecar expects version >= ${expected}, ` +
+            `but vault file reports version ${actual}. If this is an intentional ` +
+            `restore, pass { acceptRollback: true } to openVault().`);
+        this.expected = expected;
+        this.actual = actual;
+        this.name = "VaultRollbackError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Thrown when operations are attempted on a closed vault. */
+export class VaultClosedError extends VaultError {
+    constructor() {
+        super("VAULT_CLOSED", "Vault has been closed; reopen with openVault() to continue.");
+        this.name = "VaultClosedError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Thrown when the write-path file lock can't be acquired within the timeout. */
+export class VaultLockError extends VaultError {
+    constructor(message) {
+        super("VAULT_LOCK_FAILED", message);
+        this.name = "VaultLockError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+//# sourceMappingURL=session-vault-errors.js.map

package/dist/vault/session-vault-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-vault-errors.js","sourceRoot":"","sources":["../../src/vault/session-vault-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,0CAA0C;AAC1C,MAAM,OAAO,UAAW,SAAQ,KAAK;IACP;IAA5B,YAA4B,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,oEAAoE;AACpE,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAE9B;IACA;IAFlB,YACkB,QAAgB,EAChB,MAAc;QAE9B,KAAK,CACH,iCAAiC,EACjC,+DAA+D,QAAQ,IAAI;YACzE,kCAAkC,MAAM,8BAA8B;YACtE,wDAAwD,CAC3D,CAAC;QARc,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QAQ9B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,8DAA8D;AAC9D,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C;QACE,KAAK,CAAC,cAAc,EAAE,6DAA6D,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/vault/session-vault.d.ts

@@ -0,0 +1,147 @@
+/**
+ * SessionVault — public session-backed envelope vault API.
+ *
+ * Opens the CLI's encrypted vault file once per session (one KeyProvider
+ * prompt), caches the decrypted contents in RAM, and serves reads without
+ * further prompts. External writes (e.g. the CLI in another shell) become
+ * visible via mtime-check coherence on every read.
+ *
+ * Addresses the per-item Keychain-prompt problem flagged in issue #40:
+ * long-running daemons (centient-labs/maintainer) holding N credentials
+ * across a long lifetime should not reach into the OS keychain on every
+ * access. Envelope encryption with a single master-key unlock matches
+ * industry standard (KMS, HashiCorp Vault, 1Password, Bitwarden).
+ *
+ * ## Threat model (what this protects and doesn't)
+ *
+ * - Protects against filesystem-read-only adversaries (ciphertext is AEAD
+ *   encrypted; forging plaintext requires the master key).
+ * - Protects against live-session and cold-start vault-file rollback by a
+ *   filesystem-write-only adversary via the combined in-payload
+ *   `vaultVersion` + sidecar-file `highestSeenVersion` scheme.
+ * - Does NOT protect against an adversary with **both** master-key access
+ *   and filesystem write — game over for any local envelope vault.
+ * - Does NOT protect against an adversary with write access to the vault
+ *   directory who chooses to downgrade both vault and sidecar in lockstep
+ *   — the sidecar lives next to the vault. If your threat model includes
+ *   adversarial writes to `~/.centient/secrets/`, use a secrets service
+ *   with remote attestation (HashiCorp Vault, AWS Secrets Manager,
+ *   1Password Connect) instead.
+ * - Session key is in process RAM for the full session lifetime. Any code
+ *   with execution in the process has access to all secrets in the vault.
+ *   Operators running daemons with this API SHOULD disable core dumps
+ *   (`ulimit -c 0` / `prlimit --core=0`) and disable the Node.js inspector
+ *   (`NODE_OPTIONS=--inspect` grants heap read to anyone on the inspector
+ *   socket — a full master-key compromise vector).
+ * - On macOS, a newly-started process will still prompt the user for
+ *   Keychain access even if another process holds the vault open.
+ *   Keychain ACLs are per-process, not per-vault-file.
+ */
+import type { KeyProviderType } from "../key-providers/types.js";
+import { VaultError, VaultUnlockError, VaultDecryptError, VaultRollbackError, VaultClosedError, VaultLockError } from "./session-vault-errors.js";
+export { VaultError, VaultUnlockError, VaultDecryptError, VaultRollbackError, VaultClosedError, VaultLockError, };
+/** Current payload schema version — bump requires a compat migration. */
+export declare const VAULT_SCHEMA_VERSION = 1;
+/** Default vault file location — same path the CLI uses, so they share state. */
+export declare const DEFAULT_VAULT_PATH: string;
+/** Default sidecar location — stores highest-ever-seen vault version. */
+export declare const DEFAULT_SIDECAR_PATH: string;
+/**
+ * AAD prefix — static byte header mixed into the vault ciphertext's
+ * Additional Authenticated Data. Binding this prefix into AAD means a
+ * ciphertext from some other AES-GCM user with the same key cannot be
+ * substituted into the vault. Exported so test fixtures can produce AAD
+ * consistent with the real implementation without duplicating the constant.
+ */
+export declare const VAULT_AAD_PREFIX = "centient-secrets-vault";
+/**
+ * Coherence strategy governs how the open vault reconciles in-memory state
+ * with concurrent external writes to the vault file.
+ */
+export type CoherenceStrategy = "mtime-check" | "strict" | "best-effort";
+/** Options for {@link openVault}. All fields are optional. */
+export interface OpenVaultOptions {
+    /** Alternate vault file path. Defaults to the same path the CLI uses. */
+    path?: string;
+    /** Alternate sidecar path. Defaults to vault directory + `vault.seen-version`. */
+    sidecarPath?: string;
+    /**
+     * Coherence strategy for concurrent external writes. Default `mtime-check`:
+     * stat on every read; re-decrypt if mtime advanced. `strict` throws on stale
+     * snapshot. `best-effort` keeps the in-memory snapshot until `reload()`.
+     */
+    coherence?: CoherenceStrategy;
+    /**
+     * Opt-in acceptance of a detected rollback (sidecar version > vault version).
+     * Emits a scary warning on stderr. Use only when the operator explicitly
+     * intends to restore an older vault (backup restore, etc.).
+     */
+    acceptRollback?: boolean;
+    /**
+     * Opt-in acceptance of a missing sidecar. Default behaviour (`false`) is to
+     * **refuse** to open the vault when the sidecar is absent — this enforces
+     * the security invariant that rollback protection is always in effect.
+     * Pass `true` for legitimate first-use contexts (fresh install, test
+     * fixtures, post-migration) to auto-initialize `seenVersion = vaultVersion`
+     * with a stderr warning. See docs/session-vault.md §Missing sidecar.
+     */
+    acceptMissingSidecar?: boolean;
+    /**
+     * Optional auto-close TTL in milliseconds. Not set by default — daemons run
+     * forever; forced re-auth undoes the point of a session vault. Useful for
+     * short-lived script consumers that want defense-in-depth.
+     */
+    ttlMs?: number;
+}
+/**
+ * A long-lived handle to an unlocked vault. Construct with {@link openVault};
+ * close with {@link SessionVault.close}. Operations are async so policy
+ * `before` hooks can await (e.g. remote attestation).
+ */
+export interface SessionVault {
+    /** Read a secret by name. Returns null if the name isn't in the vault. */
+    get(name: string): Promise<string | null>;
+    /** List all secret names, optionally prefix-filtered. Sorted ascending. */
+    list(prefix?: string): Promise<string[]>;
+    /** Write a secret. Re-encrypts and saves the vault file atomically. */
+    set(name: string, value: string): Promise<void>;
+    /** Delete a secret. Returns true if the name existed and was removed. */
+    delete(name: string): Promise<boolean>;
+    /** Force an immediate reload from disk regardless of coherence strategy. */
+    reload(): Promise<void>;
+    /** Release the session key and in-memory state. No-op if already closed. */
+    close(): void;
+    /** Diagnostic — the KeyProvider that unlocked this session. */
+    readonly provider: KeyProviderType;
+    /** Diagnostic — absolute path of the vault file. */
+    readonly path: string;
+    /** Diagnostic — the current in-memory vault version. */
+    readonly vaultVersion: number;
+}
+/**
+ * Open an encrypted session vault.
+ *
+ * Resolves the configured {@link KeyProvider} to obtain the master key,
+ * decrypts the vault file bound to its resolved real path (symlink-aware),
+ * checks rollback detection via the sidecar, and returns a long-lived
+ * {@link SessionVault} handle that serves reads from memory.
+ *
+ * @param opts - {@link OpenVaultOptions}. All fields are optional; defaults
+ *   use the same paths the `centient secrets` CLI uses.
+ * @returns An open {@link SessionVault}. Call `close()` when done.
+ * @throws {@link VaultError} `VAULT_NOT_FOUND` when the vault file is absent.
+ * @throws {@link VaultUnlockError} when the KeyProvider cannot return a key.
+ * @throws {@link VaultDecryptError} when decryption fails (wrong key, AAD
+ *   mismatch, corrupted payload).
+ * @throws {@link VaultRollbackError} when the sidecar indicates a rollback
+ *   and `acceptRollback` is not set.
+ *
+ * @example
+ * ```ts
+ * const vault = await openVault({ ttlMs: 60_000 });
+ * const apiKey = await vault.get("openai-api-key");
+ * vault.close();
+ * ```
+ */
+export declare function openVault(opts?: OpenVaultOptions): Promise<SessionVault>;
+//# sourceMappingURL=session-vault.d.ts.map

package/dist/vault/session-vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-vault.d.ts","sourceRoot":"","sources":["../../src/vault/session-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAiBH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAejE,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,CAAC;AAMF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,QAAuD,CAAC;AAEvF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,QAKhC,CAAC;AAKF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,2BAA2B,CAAC;AA2BzD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,QAAQ,GAAG,aAAa,CAAC;AAEzE,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1C,2EAA2E;IAC3E,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,uEAAuE;IACvE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,yEAAyE;IACzE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,4EAA4E;IAC5E,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,4EAA4E;IAC5E,KAAK,IAAI,IAAI,CAAC;IACd,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AA2ED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,SAAS,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,YAAY,CAAC,CAoJlF"}