@centient/secrets 0.9.0 → 0.11.0

package/dist/crypto/darwin-keychain.d.ts

@@ -0,0 +1,394 @@
+/**
+ * Hardened macOS Keychain core (#188).
+ *
+ * ## The defect this module exists to end
+ *
+ * Every `security` invocation in this package used to be wrong in the same two
+ * ways, and both ways only bite in a context that cannot complain:
+ *
+ *   1. **Writes preauthorized nothing.** `add-generic-password … -T ""` trusts
+ *      *no* application. An item written that way is readable only by granting
+ *      consent through a dialog — and a launchd daemon or an SSH login has no
+ *      UI in which such a dialog can render. The item is therefore unreadable
+ *      in exactly the contexts a credential store is for.
+ *   2. **Reads consulted the search list.** `find-generic-password` with no
+ *      keychain argument walks the session search list, which leads with the
+ *      login keychain. In a sessionless context that keychain is locked, and a
+ *      locked copy *shadows* a readable System-keychain copy — so the read
+ *      fails even though the credential is right there.
+ *
+ * Combined with the old accessors' habit of collapsing every failure into
+ * `null`, the result was a store that silently reported "nothing configured"
+ * to a headless reader. See issue #188 and `docs/threat-model.md`.
+ *
+ * ## The posture
+ *
+ *   1. **Session-aware reads.** An interactive session keeps its existing
+ *      search-list read (so vaults that open today keep opening unchanged). A
+ *      *sessionless* context reads the System keychain by **explicit
+ *      positional target** first — no search list, so nothing can shadow it —
+ *      and only consults the search list when the System keychain genuinely
+ *      has no copy. That ordering is what makes a misclassified context
+ *      harmless: the fallback can only ever add a result, never lose one.
+ *   2. **Preauthorized writes.** `-T /usr/bin/security` grants the reader path
+ *      at write time, on every write, everywhere in this package. Never
+ *      `-T ""`.
+ *   3. **`-U` replace-in-place.** A rotation is one command and never leaves
+ *      two generations of the same account. The old delete-then-add left a
+ *      window in which the credential existed nowhere.
+ *   4. **Discriminated results.** Reads, probes, writes, deletes and the
+ *      migration all answer with a discriminated union. `absent` and `locked`
+ *      are never merged (see {@link ../secret-state.js}).
+ *
+ * ## Never logs a value
+ *
+ * No function here logs or formats a credential into a diagnostic. Every
+ * `detail`/`reason`/`command` string is value-free by construction — the
+ * operator command reads the secret with `read -s` into a shell variable, so
+ * it appears in neither the printed text nor the shell history.
+ *
+ * ## Residual, stated rather than hidden
+ *
+ * A programmatic write passes the value in `argv` (`-w <value>`), briefly
+ * visible to a local `ps`. That is unchanged from this package's previous
+ * write path, so it is not a regression — but it is why the OPERATOR-facing
+ * command printed by {@link privilegedWriteCommand} keeps the value out of the
+ * command text entirely. `docs/threat-model.md` §4.3 tracks the argv exposure.
+ */
+import type { SecretState } from "../secret-state.js";
+/** The macOS system keychain — readable from the launchd system domain. */
+export declare const SYSTEM_KEYCHAIN_PATH = "/Library/Keychains/System.keychain";
+/**
+ * The reader path preauthorized on write (`-T`), and the binary this module
+ * spawns. Absolute deliberately: the `-T` argument names a path, so the two
+ * must be the same path or the grant does not describe the reader.
+ */
+export declare const SECURITY_BINARY = "/usr/bin/security";
+export interface KeychainRunResult {
+    status: number;
+    stderr: string;
+    stdout: string;
+}
+/**
+ * The one seam every `security` invocation in this package passes through.
+ * Tests inject `runSecurity` and `platform`, so no test touches a real
+ * keychain and the exact argv is assertable — the argv *is* the contract here.
+ */
+export interface KeychainDeps {
+    runSecurity: (args: readonly string[], options?: {
+        maxBuffer?: number;
+    }) => KeychainRunResult;
+    platform: NodeJS.Platform;
+    env: NodeJS.ProcessEnv;
+}
+/**
+ * A read outcome. The only variant carrying secret material — probes use the
+ * value-free {@link SecretState} instead.
+ */
+export type KeychainReadResult = {
+    kind: "found";
+    value: string;
+} | {
+    kind: "absent";
+} | {
+    kind: "locked";
+} | {
+    kind: "not-applicable";
+    reason: string;
+} | {
+    kind: "failed";
+    detail: string;
+};
+export type KeychainWriteResult = {
+    kind: "stored";
+    /**
+     * Where the item actually landed — the System keychain path, or
+     * `"default"` for the session's default (login) keychain. Present only
+     * on the session-aware write, which is the one that can choose. A caller
+     * comparing this against the reader's context learns whether the write
+     * is reachable from there; leaving it out would be exactly the silent
+     * degradation this ticket is about.
+     */
+    keychain?: string;
+    /**
+     * Set when the item landed somewhere other than the System keychain
+     * *because* the System write needed privileges. Value-free; running it
+     * promotes the credential to the daemon-readable copy.
+     */
+    privilegedCommand?: string;
+}
+/** The write needs root. Carries the exact VALUE-FREE operator command. */
+ | {
+    kind: "needs-privilege";
+    command: string;
+} | {
+    kind: "not-applicable";
+    reason: string;
+} | {
+    kind: "failed";
+    detail: string;
+};
+export type KeychainDeleteResult = {
+    kind: "deleted";
+}
+/** Nothing to delete. Distinct from `deleted`, and never an error. */
+ | {
+    kind: "absent";
+} | {
+    kind: "not-applicable";
+    reason: string;
+} | {
+    kind: "failed";
+    detail: string;
+};
+export type KeychainMigrationResult = 
+/** The System copy was written from the login copy. */
+{
+    kind: "migrated";
+    loginCopyDeleted: boolean;
+}
+/** A System copy already existed — nothing moved. */
+ | {
+    kind: "already-resident";
+    loginCopyDeleted: boolean;
+}
+/** No login copy to move (and no System copy) — nothing to do. */
+ | {
+    kind: "nothing-to-migrate";
+}
+/** Could not complete. The PREVIOUS read path is untouched. */
+ | {
+    kind: "blocked";
+    reason: string;
+    command?: string;
+};
+/**
+ * Classify a `security` outcome.
+ *
+ * Stderr patterns are checked BEFORE exit codes on purpose: Apple has shifted
+ * `security` exit codes between releases while the user-facing strings have
+ * stayed stable, so pinning on the code alone silently reclassifies an
+ * unreadable item as a missing one on the next OS bump — the very collapse
+ * this module exists to prevent.
+ */
+export declare function classifyKeychainRead(status: number, stderr: string, stdout: string): KeychainReadResult;
+/** Drop the value from a read outcome, yielding the value-free state. */
+export declare function toSecretState(read: KeychainReadResult): SecretState;
+/**
+ * Shell-quote one argument for the copy/paste operator command.
+ *
+ * The service and account reach this from caller-supplied strings, so an
+ * unquoted interpolation turns a remediation command into a DIFFERENT command
+ * the moment one of them carries a shell metacharacter. Single-quote wrapping
+ * is the only form that neutralizes every metacharacter; an embedded single
+ * quote is closed, escaped and reopened (the POSIX `'\''` idiom).
+ */
+export declare function shellQuote(value: string): string;
+/**
+ * The operator command for a privileged System-keychain write.
+ *
+ * The command TEXT is value-free: the secret is read by `read -s` (silent, and
+ * present in both zsh and bash) into a shell variable, so it never appears in
+ * the printed command, in a log line, or in shell history — history records
+ * the literal `"$PW"`, not its expansion.
+ *
+ * Why not a `security` prompt form: `-w` consumes any following token as the
+ * password, so a trailing keychain path would silently BECOME the stored
+ * value, and the bare dangling `-w` form is not a reliable terminal prompt.
+ * The `read -s` flow sidesteps `security`'s prompt semantics entirely and
+ * RESTORES the explicit System-keychain positional target, so the write cannot
+ * land in the wrong keychain.
+ */
+export declare function privilegedWriteCommand(service: string, account: string): string;
+/**
+ * Read one credential from the System keychain, addressing it EXPLICITLY.
+ *
+ * The trailing keychain path is the whole point: without it `security` walks
+ * the session search list, which in a sessionless context leads with the
+ * locked login keychain — so a stale login copy shadows the readable System
+ * one and the read fails in exactly the context that has no way to prompt.
+ */
+export declare function readSystemKeychainCredential(service: string, account: string, deps?: Partial<KeychainDeps>): KeychainReadResult;
+/**
+ * Read one credential through the session search list — the historical path,
+ * and still the right one in an interactive session where the login keychain
+ * is unlocked and is where the item lives.
+ */
+export declare function readSearchListCredential(service: string, account: string, deps?: Partial<KeychainDeps>): KeychainReadResult;
+/**
+ * Read a credential using the path appropriate to THIS execution context.
+ *
+ * - Interactive session: the search-list read, byte-for-byte what this package
+ *   did before #188. Vaults that open today keep opening.
+ * - Sessionless (launchd system domain, SSH): the explicit System-keychain
+ *   read first, so no login copy can shadow it — then, only if the System
+ *   keychain genuinely has no such item, the search-list read.
+ *
+ * The fallback ordering is deliberate and load-bearing. Session detection is a
+ * heuristic (see `../platform/session-context.ts`); with System consulted
+ * first, a *false* sessionless verdict cannot lose a credential that used to
+ * be readable, and a false interactive verdict is no worse than today. The
+ * shadowing bug cannot come back either way, because the search list is only
+ * ever reached after the System keychain has answered `absent`.
+ */
+export declare function readKeychainCredential(service: string, account: string, deps?: Partial<KeychainDeps>): KeychainReadResult;
+/**
+ * **Presence, not readability.** Metadata-only existence probe against the
+ * System keychain.
+ *
+ * No `-w`, so `security` prints no value on any stream. That is also its
+ * limit: a `found` here means only that an item with these coordinates exists.
+ * An item can exist and still be unreadable — locked keychain, an ACL that
+ * does not preauthorize the reader, a partially written item — so this must
+ * NOT be used to answer "what is the state of this credential?". Reporting
+ * `found` for an item the reader cannot open is the exact failure mode #188
+ * exists to end.
+ *
+ * Its correct use is the non-destructive residency question inside
+ * {@link migrateLoginCredentialToSystem} ("is a copy already here, so that I
+ * need not move one?"), which is deliberately answered without reading the
+ * secret. Credential STATE is {@link probeKeychainCredentialState}.
+ */
+export declare function probeSystemKeychainEntry(service: string, account: string, deps?: Partial<KeychainDeps>): SecretState;
+/**
+ * **Presence, not readability.** Metadata-only existence probe through the
+ * session search list. Same caveat as {@link probeSystemKeychainEntry}: use
+ * {@link probeKeychainCredentialState} for credential state.
+ */
+export declare function probeSearchListEntry(service: string, account: string, deps?: Partial<KeychainDeps>): SecretState;
+/**
+ * **Presence, not readability.** Metadata-only probe along the same keychain
+ * the reader would consult in this context.
+ *
+ * Same caveat as the two functions above, and for the same reason: a status-0
+ * metadata hit says an item exists, not that opening it yields bytes. Use
+ * {@link probeKeychainCredentialState} for credential state.
+ */
+export declare function probeKeychainEntry(service: string, account: string, deps?: Partial<KeychainDeps>): SecretState;
+/**
+ * The credential STATE probe: what will the reader in THIS context actually
+ * get?
+ *
+ * Runs the real read — {@link readKeychainCredential}, the same path, the same
+ * explicit target, the same `-w` — and then **discards the value**, returning
+ * only the value-free {@link SecretState}. So `found` here means "the reader
+ * will get bytes", which is the claim a caller needs and the claim a metadata
+ * probe cannot make.
+ *
+ * Presence is not readability, and the gap between them is not hypothetical:
+ * an item whose ACL does not preauthorize the reader, or that sits in a locked
+ * keychain, or that was written empty, is *present* and *unreadable*. A probe
+ * that answered `found` for those would hand a caller trusted state that is
+ * wrong in precisely the direction #188 exists to fix — a reader told the
+ * credential is there, failing anyway, with no signal that says why.
+ *
+ * The trade is deliberate: this reads secret material into the process to
+ * answer, where {@link probeKeychainEntry} does not. Nothing leaves — the
+ * value never reaches a return value, a log, or a stream. Callers that must
+ * not read the secret at all (the migration's residency check) use the
+ * metadata probe under its own name, and accept that it answers a narrower
+ * question.
+ */
+export declare function probeKeychainCredentialState(service: string, account: string, deps?: Partial<KeychainDeps>): SecretState;
+/**
+ * Store a credential in the System keychain, preauthorized for the reader path.
+ *
+ * `-U` replaces an existing item in place (the rotation path, and the reason
+ * there is no delete-then-add window here); `-T` grants
+ * `/usr/bin/security` up front because no consent prompt can render in the
+ * launchd or SSH contexts that have to read it.
+ */
+export declare function writeSystemKeychainCredential(service: string, account: string, value: string, deps?: Partial<KeychainDeps>): KeychainWriteResult;
+/**
+ * Store a credential in the session's default (login) keychain — the
+ * historical destination — but with the two flags that were missing: `-U` so a
+ * rotation replaces in place, and `-T /usr/bin/security` so the item is
+ * readable without a consent dialog.
+ *
+ * A permission failure here is reported as `failed`, not `needs-privilege`:
+ * `sudo` is the wrong remedy for a login keychain (it would write root's), and
+ * offering it would send an operator down a path that cannot work.
+ */
+export declare function writeDefaultKeychainCredential(service: string, account: string, value: string, deps?: Partial<KeychainDeps>): KeychainWriteResult;
+/**
+ * Store a credential using the destination appropriate to THIS context.
+ *
+ * - Interactive: the default (login) keychain, unchanged destination, now with
+ *   `-U` and `-T`.
+ * - Sessionless: the System keychain, so the reader that has no session can
+ *   actually open it. If that write needs privileges the credential is still
+ *   written to the default keychain rather than failing outright — but the
+ *   result says so (`keychain`) and carries the value-free command that
+ *   promotes it (`privilegedCommand`). Reporting the lesser destination is
+ *   what keeps this from being a silent downgrade.
+ */
+export declare function writeKeychainCredential(service: string, account: string, value: string, deps?: Partial<KeychainDeps>): KeychainWriteResult;
+/**
+ * Did a write land where THIS context's reader will look for it?
+ *
+ * `kind: "stored"` alone does not answer that. In a sessionless context a
+ * System-keychain write that needs privileges falls back to the default
+ * keychain — the value is stored, and the result says so and carries the
+ * command that promotes it, but a launchd or SSH reader will not find it
+ * there. A boolean caller that treated that as success would record a write
+ * the reader cannot see: a silent downgrade, which is the same class of lie as
+ * the read-side collapse this module exists to fix.
+ *
+ * So: interactive → the default keychain IS where the reader looks, so any
+ * `stored` is reachable. Sessionless → only the System keychain is.
+ *
+ * Callers that want the nuance rather than the boolean use the discriminated
+ * {@link KeychainWriteResult} directly; it carries both the destination and
+ * the value-free promotion command.
+ */
+export declare function storedWithinReaderReach(result: KeychainWriteResult, deps?: Partial<KeychainDeps>): boolean;
+/**
+ * Delete a credential from wherever this context can read it.
+ *
+ * Interactive: the historical default-destination delete, unchanged.
+ *
+ * Sessionless: both copies the read path can see — the System copy (explicit
+ * target) and the login copy (targeted through `login-keychain`, skipped when
+ * unresolvable). Deleting only one would leave the other to be resurrected by
+ * the very fallback that makes sessionless reads work.
+ */
+export declare function deleteKeychainCredential(service: string, account: string, deps?: Partial<KeychainDeps>): KeychainDeleteResult;
+/**
+ * Move one credential from the login keychain to the System keychain, ONCE,
+ * then remove the login copy so nothing can shadow it.
+ *
+ * Idempotent: a System copy that already exists short-circuits to
+ * `already-resident` (and still sweeps a login shadow if one is left).
+ *
+ * Fail-loud-but-SAFE ordering — the login copy is deleted LAST, and only after
+ * the System copy is verified readable through the explicit-target read. Every
+ * earlier failure returns `blocked` with the login copy intact, so the previous
+ * read path keeps working: a failed migration can never produce "reader up with
+ * no credential".
+ */
+export declare function migrateLoginCredentialToSystem(service: string, account: string, deps?: Partial<KeychainDeps>): KeychainMigrationResult;
+/**
+ * The keychain search list, for diagnostics. Names only — a search list
+ * carries no secret material, and knowing that the login keychain leads it is
+ * exactly what explains a shadowed read.
+ */
+export declare function keychainSearchList(deps?: Partial<KeychainDeps>): readonly string[];
+/**
+ * Raw `security dump-keychain` output, for the enumeration path in
+ * `vault-common.ts`.
+ *
+ * Deliberately NOT platform-guarded: enumeration is only reachable when the
+ * Keychain backend is the active one, and guarding here would change a
+ * spawn-and-fail into a silent empty answer on a host whose platform string
+ * has been adjusted (several suites in this package do exactly that).
+ *
+ * `-d` is deliberately omitted, so no password data is in the output.
+ */
+export declare function dumpKeychain(deps?: Partial<KeychainDeps>): {
+    kind: "ok";
+    output: string;
+} | {
+    kind: "failed";
+    detail: string;
+};
+//# sourceMappingURL=darwin-keychain.d.ts.map

package/dist/crypto/darwin-keychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"darwin-keychain.d.ts","sourceRoot":"","sources":["../../src/crypto/darwin-keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAQtD,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB,uCAAuC,CAAC;AAEzE;;;;GAIG;AACH,eAAO,MAAM,eAAe,sBAAsB,CAAC;AASnD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,CACX,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KAC7B,iBAAiB,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB;AAqDD;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,MAAM,mBAAmB,GAC3B;IACE,IAAI,EAAE,QAAQ,CAAC;IACf;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AACH,2EAA2E;GACzE;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE;AACrB,sEAAsE;GACpE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,MAAM,uBAAuB;AACjC,uDAAuD;AACrD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE;AACjD,qDAAqD;GACnD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE;AACzD,kEAAkE;GAChE;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE;AAChC,+DAA+D;GAC7D;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAa1D;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,kBAAkB,CA2BpB;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,IAAI,EAAE,kBAAkB,GAAG,WAAW,CAEnE;AAoBD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAuB/E;AAsBD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM,GAC/B,kBAAkB,CAKpB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM,GAC/B,kBAAkB,CAKpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM,GAC/B,kBAAkB,CASpB;AAUD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM,GAC/B,WAAW,CAab;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM,GAC/B,WAAW,CAYb;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM,GAC/B,WAAW,CASb;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM,GAC/B,WAAW,CAEb;AAMD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM,GAC/B,mBAAmB,CA2BrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM,GAC/B,mBAAmB,CAuBrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM,GAC/B,mBAAmB,CAsBrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,mBAAmB,EAC3B,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM,GAC/B,OAAO,CAKT;AAsED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM,GAC/B,oBAAoB,CA6BtB;AAyBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM,GAC/B,uBAAuB,CAgFzB;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM,GAC/B,SAAS,MAAM,EAAE,CASnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM,GAC/B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAUrE"}