@cleocode/core 2026.9.16 → 2026.9.18

package/dist/crypto/credentials.js

@@ -1,15 +1,19 @@
 /**
- * Credential encryption — AES-256-GCM with machine-bound key derivation.
+ * Credential encryption — AES-256-GCM with device-bound key derivation.
  *
- * API keys (`sk_live_*`) are encrypted at rest in SQLite using AES-256-GCM.
- * The encryption key is derived per-project from a machine-specific secret:
+ * Every key derives from the 32-byte `machine-key` in the CLEO home. That key
+ * NEVER leaves the device; credentials cross devices only through the
+ * passphrase-sealed path in `store/credential-transfer.ts`.
  *
- *   machine-key (32 random bytes at ~/.local/share/cleo/machine-key)
- *   + project path
- *   = HMAC-SHA256(machine-key, project-path) → per-project AES key
+ * Two KDFs:
  *
- * This means credentials are bound to BOTH the machine AND the project.
- * Moving `.cleo/tasks.db` to another machine renders stored keys unreadable.
+ * - **Project** (T12326): `HMAC-SHA256(machine-key, "cleo:project-credential:v2\0"
+ *   ‖ projectId)`, ciphertext version `0x02`. Keyed by project IDENTITY, so a
+ *   moved or renamed project still decrypts. The pre-T12326 path-bound KDF
+ *   (`HMAC-SHA256(machine-key, projectPath)`, version `0x01`) is read-only and
+ *   migrated on first successful decrypt ({@link decryptProjectSecret}).
+ * - **Global** (ADR-037 §5): `HMAC-SHA256(machine-key ‖ global-salt, id)`,
+ *   version `0x01`, for project-independent credentials.
  *
  * @see docs/specs/SIGNALDOCK-UNIFIED-AGENT-REGISTRY.md Section 3.6
  * @module crypto/credentials
@@ -18,39 +22,39 @@ import { execFileSync } from 'node:child_process';
 import { createCipheriv, createDecipheriv, createHmac, randomBytes } from 'node:crypto';
 import { chmod, mkdir, readFile, stat, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
-import { getGlobalSalt } from '../store/global-salt.js';
+import { getCleoHome } from '../paths.js';
+import { getGlobalSalt, loadGlobalSaltAt } from '../store/global-salt.js';
 /** AES-256-GCM constants. */
 const ALGORITHM = 'aes-256-gcm';
 const IV_LENGTH = 12;
 const AUTH_TAG_LENGTH = 16;
 const KEY_LENGTH = 32;
-/** Version byte prefix for ciphertext format (F-006: enables future algorithm migration). */
+/**
+ * Version byte of global-KDF ciphertexts (F-006: enables future algorithm
+ * migration). Project ciphertexts carry their own versions — see
+ * {@link PROJECT_CIPHERTEXT_VERSION_PROJECT_ID}.
+ */
 const CIPHERTEXT_VERSION = 0x01;
 /**
- * Get the path to the machine key file.
- * Uses XDG data dir: `~/.local/share/cleo/machine-key`
+ * Absolute path to the machine key file: `<cleoHome>/machine-key`.
+ *
+ * Resolved through {@link getCleoHome} — the same root as `global-salt` and
+ * the agent registry's key reader — so `CLEO_HOME` relocates all of them
+ * together. (Before T12326 this function re-derived the XDG path itself and
+ * ignored `CLEO_HOME`, so a relocated home read the salt from one directory
+ * and the key from another.) On every platform the default resolves to the
+ * same file as before.
  *
- * @throws If HOME/USERPROFILE are unset (F-002: never fall back to /tmp).
+ * The machine key is DEVICE-LOCAL by design: it is never exported in any
+ * backup bundle. Credentials move between devices through
+ * `store/credential-transfer.ts` instead.
+ *
+ * @param cleoHome - CLEO home to resolve against (defaults to the ambient home).
+ * @returns Absolute path to the machine key.
+ * @task T12326
  */
-function getMachineKeyPath() {
-    // Use platform-aware data directory: XDG on Linux, Library on macOS, %LOCALAPPDATA% on Windows
-    if (process.platform === 'win32') {
-        const appData = process.env['LOCALAPPDATA'] ?? process.env['APPDATA'];
-        if (appData)
-            return join(appData, 'cleo', 'Data', 'machine-key');
-    }
-    else if (process.platform === 'darwin') {
-        const home = process.env['HOME'];
-        if (home)
-            return join(home, 'Library', 'Application Support', 'cleo', 'machine-key');
-    }
-    // Linux / fallback: XDG_DATA_HOME or ~/.local/share
-    const dataHome = process.env['XDG_DATA_HOME'] ?? join(process.env['HOME'] ?? '', '.local', 'share');
-    if (!dataHome) {
-        throw new Error('Cannot determine data directory. Set HOME or XDG_DATA_HOME environment variable. ' +
-            'Machine key cannot be stored securely without a persistent data directory.');
-    }
-    return join(dataHome, 'cleo', 'machine-key');
+export function getMachineKeyPath(cleoHome = getCleoHome()) {
+    return join(cleoHome, 'machine-key');
 }
 /**
  * Read or auto-generate the machine key (32 random bytes).
@@ -58,8 +62,8 @@ function getMachineKeyPath() {
  *
  * @throws If the machine key exists but has wrong permissions (not 0600).
  */
-async function getMachineKey() {
-    const keyPath = getMachineKeyPath();
+async function getMachineKey(cleoHome) {
+    const keyPath = getMachineKeyPath(cleoHome);
     try {
         // Verify key file permissions
         const stats = await stat(keyPath);
@@ -122,102 +126,156 @@ async function getMachineKey() {
         throw err;
     }
 }
+// ============================================================================
+// Ciphertext framing (shared by every KDF)
+// ============================================================================
 /**
- * Derive a per-project encryption key from the machine key.
- * Uses HMAC-SHA256(machine-key, project-path) to produce a 32-byte AES key.
- *
- * @remarks
- * **KDF COORDINATION NOTE (T380/ADR-041 §D5, ADR-037 §5)**
- *
- * This KDF is intentionally NOT changed in T380. The current scheme
- * (`HMAC-SHA256(machine-key, projectPath)`) is project-path-bound, which is
- * correct for the current project-tier signaldock.db layout.
- *
- * ADR-037 §5 specifies the replacement KDF:
- * ```
- * apiKey = HMAC-SHA256(machine-key || globalSalt, agentId)
- * ```
- * where `globalSalt` is a 32-byte per-machine random value stored at
- * `$XDG_DATA_HOME/cleo/global-salt`.
- *
- * The replacement KDF MUST be implemented as part of the global-signaldock
- * migration (T310 + T362). Swapping it here, before that migration, would
- * silently invalidate all stored encrypted API keys without providing the
- * global-salt infrastructure needed to re-encrypt them.
- *
- * Once T310/T362 land, this function should be REPLACED (not extended) with
- * the new `deriveAgentKey(agentId: string)` helper defined in that epic.
- * Remove this comment block when the replacement lands.
- *
- * @see ADR-037 §5 — full KDF design and migration plan
- * @see T310 — GlobalAgentRegistryAccessor + KDF refactor
- * @see T362 — parallel KDF coordination
- * @task T380
- */
-async function deriveProjectKey(projectPath) {
-    const machineKey = await getMachineKey();
-    return createHmac('sha256', machineKey).update(projectPath).digest();
-}
-/**
- * Encrypt a plaintext string using AES-256-GCM with a per-project key.
- *
- * Output format: base64(version + iv + ciphertext + authTag)
- *   - version: 1 byte (0x01 = AES-256-GCM)
- *   - iv: 12 bytes
- *   - ciphertext: variable length
- *   - authTag: 16 bytes
- *
- * @param plaintext - The string to encrypt (e.g. an API key).
- * @param projectPath - Absolute path to the project directory (used for key derivation).
- * @returns Base64-encoded ciphertext.
+ * Encrypt `plaintext` under `key` and frame it as
+ * base64(version ‖ iv ‖ ciphertext ‖ authTag).
  */
-export async function encrypt(plaintext, projectPath) {
-    const key = await deriveProjectKey(projectPath);
+function sealWithKey(plaintext, key, version) {
     const iv = randomBytes(IV_LENGTH);
     const cipher = createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
     const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
     const authTag = cipher.getAuthTag();
-    // Pack: version + iv + ciphertext + authTag (F-006: version byte for future migration)
-    const version = Buffer.from([CIPHERTEXT_VERSION]);
-    const packed = Buffer.concat([version, iv, encrypted, authTag]);
-    return packed.toString('base64');
+    return Buffer.concat([Buffer.from([version]), iv, encrypted, authTag]).toString('base64');
 }
 /**
- * Decrypt a base64-encoded ciphertext using AES-256-GCM with a per-project key.
+ * Split a framed ciphertext into its parts.
  *
- * @param ciphertext - Base64-encoded string from `encrypt()`.
- * @param projectPath - Absolute path to the project directory (must match the one used for encryption).
- * @returns The original plaintext string.
- * @throws If decryption fails (wrong key, corrupted data, or machine key mismatch).
+ * @throws {Error} If the payload is shorter than the fixed framing.
  */
-export async function decrypt(ciphertext, projectPath) {
-    const key = await deriveProjectKey(projectPath);
+function unframe(ciphertext) {
     const packed = Buffer.from(ciphertext, 'base64');
     if (packed.length < 1 + IV_LENGTH + AUTH_TAG_LENGTH) {
         throw new Error('Cannot decrypt credentials: ciphertext too short');
     }
-    // F-006: check version byte
-    const version = packed[0];
-    if (version !== CIPHERTEXT_VERSION) {
-        throw new Error(`Unknown ciphertext version (${version}). Expected ${CIPHERTEXT_VERSION}. ` +
-            'Re-register agents to re-encrypt with the current format.');
-    }
-    const iv = packed.subarray(1, 1 + IV_LENGTH);
-    const authTag = packed.subarray(packed.length - AUTH_TAG_LENGTH);
-    const encrypted = packed.subarray(1 + IV_LENGTH, packed.length - AUTH_TAG_LENGTH);
-    const decipher = createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
-    decipher.setAuthTag(authTag);
+    return {
+        version: packed[0] ?? -1,
+        iv: packed.subarray(1, 1 + IV_LENGTH),
+        encrypted: packed.subarray(1 + IV_LENGTH, packed.length - AUTH_TAG_LENGTH),
+        authTag: packed.subarray(packed.length - AUTH_TAG_LENGTH),
+    };
+}
+/**
+ * Decrypt a framed ciphertext under `key`. Returns `null` when the GCM auth
+ * tag rejects the key — the caller decides whether another key is worth trying.
+ */
+function openWithKey(parts, key) {
+    const decipher = createDecipheriv(ALGORITHM, key, parts.iv, { authTagLength: AUTH_TAG_LENGTH });
+    decipher.setAuthTag(parts.authTag);
     try {
-        const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
-        return decrypted.toString('utf8');
+        return Buffer.concat([decipher.update(parts.encrypted), decipher.final()]).toString('utf8');
     }
     catch {
-        throw new Error('Cannot decrypt credentials. Machine key mismatch or corrupted data. ' +
-            'If this database was moved from another machine, re-register agents: ' +
-            'cleo agent register --id <id> --api-key <key>');
+        return null;
     }
 }
 // ============================================================================
+// Project KDF — keyed by project IDENTITY, not project path (T12326)
+// ============================================================================
+/**
+ * Ciphertext version written by the pre-T12326 project KDF,
+ * `HMAC-SHA256(machine-key, projectPath)`. Read-only: decrypted during
+ * migration, never written.
+ */
+export const PROJECT_CIPHERTEXT_VERSION_LEGACY_PATH = 0x01;
+/**
+ * Ciphertext version written by the project-identity KDF,
+ * `HMAC-SHA256(machine-key, "cleo:project-credential:v2\0" ‖ projectId)`.
+ */
+export const PROJECT_CIPHERTEXT_VERSION_PROJECT_ID = 0x02;
+/** Domain-separation prefix for the project-identity KDF message. */
+const PROJECT_ID_KDF_CONTEXT = 'cleo:project-credential:v2\0';
+/**
+ * Derive the project-identity key.
+ *
+ * @throws {Error} If `projectId` is empty — an empty id would collapse every
+ *   project onto one key.
+ */
+async function deriveProjectIdKey(projectId, cleoHome) {
+    if (projectId.length === 0) {
+        throw new Error('Cannot derive a project credential key: projectId is empty');
+    }
+    const machineKey = await getMachineKey(cleoHome);
+    return createHmac('sha256', machineKey)
+        .update(PROJECT_ID_KDF_CONTEXT + projectId, 'utf8')
+        .digest();
+}
+/**
+ * Derive the LEGACY path-bound project key, `HMAC-SHA256(machine-key, path)`.
+ * Used only to read pre-T12326 ciphertexts during migration.
+ */
+async function deriveLegacyPathKey(projectPath, cleoHome) {
+    const machineKey = await getMachineKey(cleoHome);
+    return createHmac('sha256', machineKey).update(projectPath).digest();
+}
+/**
+ * Encrypt a project-scoped secret under the project-identity KDF.
+ *
+ * The key is `HMAC-SHA256(machine-key, "cleo:project-credential:v2\0" ‖
+ * projectId)`: bound to this device (machine-key) and to the project's
+ * identity, but NOT to where the project directory lives. Moving or renaming
+ * the checkout keeps the key; a different device does not (see
+ * `store/credential-transfer.ts` for the portable path).
+ *
+ * @param plaintext - The secret (e.g. an agent API key).
+ * @param projectId - Stable project identity.
+ * @param options - Key options (which CLEO home's machine-key).
+ * @returns Base64 ciphertext, version byte {@link PROJECT_CIPHERTEXT_VERSION_PROJECT_ID}.
+ * @task T12326
+ */
+export async function encryptProjectSecret(plaintext, projectId, options = {}) {
+    const key = await deriveProjectIdKey(projectId, options.cleoHome);
+    return sealWithKey(plaintext, key, PROJECT_CIPHERTEXT_VERSION_PROJECT_ID);
+}
+/**
+ * Decrypt a project-scoped secret, migrating legacy ciphertexts on the way.
+ *
+ * - Version `0x02` ciphertexts open with the project-identity key.
+ * - Version `0x01` (legacy, path-bound) ciphertexts are tried against each of
+ *   `legacyProjectPaths`; the first that authenticates wins and the secret is
+ *   re-encrypted under the project-identity KDF and returned as `rewrapped`
+ *   for the caller to persist. The legacy ciphertext is never needed again.
+ *
+ * @param ciphertext - Base64 ciphertext from either KDF.
+ * @param context - Project identity plus legacy path candidates.
+ * @returns The plaintext, which KDF opened it, and any re-wrapped ciphertext.
+ * @throws {Error} If no key authenticates. The message names the paths tried
+ *   so the caller can report which credential to re-enter.
+ * @task T12326
+ */
+export async function decryptProjectSecret(ciphertext, context) {
+    const parts = unframe(ciphertext);
+    if (parts.version === PROJECT_CIPHERTEXT_VERSION_PROJECT_ID) {
+        const plaintext = openWithKey(parts, await deriveProjectIdKey(context.projectId, context.cleoHome));
+        if (plaintext === null) {
+            throw new Error(`Cannot decrypt project credential for project ${context.projectId}: ` +
+                'the machine key differs from the one that encrypted it (another device, or a ' +
+                'regenerated machine-key), or the data is corrupted.');
+        }
+        return { plaintext, kdf: 'project-id', rewrapped: null };
+    }
+    if (parts.version === PROJECT_CIPHERTEXT_VERSION_LEGACY_PATH) {
+        const candidates = [...new Set(context.legacyProjectPaths ?? [])];
+        for (const candidate of candidates) {
+            const plaintext = openWithKey(parts, await deriveLegacyPathKey(candidate, context.cleoHome));
+            if (plaintext !== null) {
+                return {
+                    plaintext,
+                    kdf: 'legacy-path',
+                    rewrapped: await encryptProjectSecret(plaintext, context.projectId, context),
+                };
+            }
+        }
+        throw new Error('Cannot decrypt legacy path-bound project credential: none of the candidate project ' +
+            `paths opened it (${candidates.length === 0 ? 'none supplied' : candidates.join(', ')}). ` +
+            'It was encrypted at a path this device no longer knows, or on another device.');
+    }
+    throw new Error(`Unknown project ciphertext version (${parts.version}). Expected ` +
+        `${PROJECT_CIPHERTEXT_VERSION_PROJECT_ID} or ${PROJECT_CIPHERTEXT_VERSION_LEGACY_PATH}.`);
+}
+// ============================================================================
 // Global (project-independent) KDF — ADR-037 §5
 // ============================================================================
 /**
@@ -247,9 +305,9 @@ export async function decrypt(ciphertext, projectPath) {
  * @see getGlobalSalt — global-salt source of truth (store/global-salt.ts)
  * @task T11710
  */
-async function deriveGlobalKey(id) {
-    const machineKey = await getMachineKey();
-    const globalSalt = getGlobalSalt();
+async function deriveGlobalKey(id, cleoHome) {
+    const machineKey = await getMachineKey(cleoHome);
+    const globalSalt = cleoHome === undefined ? getGlobalSalt() : loadGlobalSaltAt(cleoHome);
     // HMAC key = machine-key || globalSalt (concatenation); message = id.
     const hmacKey = Buffer.concat([machineKey, globalSalt]);
     return createHmac('sha256', hmacKey).update(id).digest();
@@ -270,21 +328,15 @@ async function deriveGlobalKey(id) {
  *
  * @param plaintext - The string to encrypt (e.g. an LLM API key).
  * @param id - The stable identity used for key derivation (e.g. an agentId).
+ * @param options - Key options (which CLEO home's machine-key + salt).
  * @returns Base64-encoded ciphertext.
  *
  * @see decryptGlobal — the inverse operation.
  * @task T11710
  */
-export async function encryptGlobal(plaintext, id) {
-    const key = await deriveGlobalKey(id);
-    const iv = randomBytes(IV_LENGTH);
-    const cipher = createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
-    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
-    const authTag = cipher.getAuthTag();
-    // Pack: version + iv + ciphertext + authTag (matches encrypt() format exactly).
-    const version = Buffer.from([CIPHERTEXT_VERSION]);
-    const packed = Buffer.concat([version, iv, encrypted, authTag]);
-    return packed.toString('base64');
+export async function encryptGlobal(plaintext, id, options = {}) {
+    const key = await deriveGlobalKey(id, options.cleoHome);
+    return sealWithKey(plaintext, key, CIPHERTEXT_VERSION);
 }
 /**
  * Decrypt a base64-encoded ciphertext produced by {@link encryptGlobal} using
@@ -293,6 +345,7 @@ export async function encryptGlobal(plaintext, id) {
  * @param ciphertext - Base64-encoded string from {@link encryptGlobal}.
  * @param id - The identity used at encryption time. A mismatched `id` derives a
  *   different key and fails the GCM auth tag (throws).
+ * @param options - Key options (which CLEO home's machine-key + salt).
  * @returns The original plaintext string.
  * @throws If decryption fails (wrong id, corrupted data, or machine-key/
  *   global-salt mismatch).
@@ -300,30 +353,18 @@ export async function encryptGlobal(plaintext, id) {
  * @see encryptGlobal — the inverse operation.
  * @task T11710
  */
-export async function decryptGlobal(ciphertext, id) {
-    const key = await deriveGlobalKey(id);
-    const packed = Buffer.from(ciphertext, 'base64');
-    if (packed.length < 1 + IV_LENGTH + AUTH_TAG_LENGTH) {
-        throw new Error('Cannot decrypt credentials: ciphertext too short');
-    }
-    const version = packed[0];
-    if (version !== CIPHERTEXT_VERSION) {
-        throw new Error(`Unknown ciphertext version (${version}). Expected ${CIPHERTEXT_VERSION}. ` +
+export async function decryptGlobal(ciphertext, id, options = {}) {
+    const parts = unframe(ciphertext);
+    if (parts.version !== CIPHERTEXT_VERSION) {
+        throw new Error(`Unknown ciphertext version (${parts.version}). Expected ${CIPHERTEXT_VERSION}. ` +
             'Re-register agents to re-encrypt with the current format.');
     }
-    const iv = packed.subarray(1, 1 + IV_LENGTH);
-    const authTag = packed.subarray(packed.length - AUTH_TAG_LENGTH);
-    const encrypted = packed.subarray(1 + IV_LENGTH, packed.length - AUTH_TAG_LENGTH);
-    const decipher = createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
-    decipher.setAuthTag(authTag);
-    try {
-        const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
-        return decrypted.toString('utf8');
-    }
-    catch {
+    const plaintext = openWithKey(parts, await deriveGlobalKey(id, options.cleoHome));
+    if (plaintext === null) {
         throw new Error('Cannot decrypt global credentials. Machine key / global-salt mismatch, ' +
             'wrong id, or corrupted data. If this database was moved from another ' +
             'machine, re-register the credential under its original id.');
     }
+    return plaintext;
 }
 //# sourceMappingURL=credentials.js.map

package/dist/crypto/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/crypto/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,6BAA6B;AAC7B,MAAM,SAAS,GAAG,aAAsB,CAAC;AACzC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,6FAA6F;AAC7F,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;;;GAKG;AACH,SAAS,iBAAiB;IACxB,+FAA+F;IAC/F,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IACnE,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IACvF,CAAC;IACD,oDAAoD;IACpD,MAAM,QAAQ,GACZ,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,mFAAmF;YACjF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa;IAC1B,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IAEpC,IAAI,CAAC;QACH,8BAA8B;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,+DAA+D;YAC/D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvF,MAAM,cAAc,GAAG,0CAA0C,CAAC;gBAClE,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChC,MAAM,IAAI,KAAK,CACb,mEAAmE;wBACjE,qBAAqB,OAAO,0CAA0C,CACzE,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,IAAI,MAAM,YAAY,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAAE,MAAM,MAAM,CAAC;YACjF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,gCAAgC;YAChC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;YAChC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB;oBACzE,uBAAuB,OAAO,EAAE,CACnC,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpC,6BAA6B;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,mCAAmC,GAAG,CAAC,MAAM,oBAAoB,UAAU,KAAK;gBAC9E,UAAU,OAAO,gDAAgD,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9F,6BAA6B;YAC7B,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;YACpC,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,gFAAgF;gBAChF,IAAI,CAAC;oBACH,YAAY,CACV,QAAQ,EACR;wBACE,OAAO;wBACP,gBAAgB;wBAChB,UAAU;wBACV,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,cAAc,IAAI;qBACjD,EACD,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,gEAAgE;gBAClE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC9B,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,KAAK,UAAU,gBAAgB,CAAC,WAAmB;IACjD,MAAM,UAAU,GAAG,MAAM,aAAa,EAAE,CAAC;IACzC,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,SAAiB,EAAE,WAAmB;IAClE,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAEtF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,uFAAuF;IACvF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,UAAkB,EAAE,WAAmB;IACnE,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEjD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,SAAS,GAAG,eAAe,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,4BAA4B;IAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,+BAA+B,OAAO,eAAe,kBAAkB,IAAI;YACzE,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,SAAS,EAAE,MAAM,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;IAElF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAC1F,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,uEAAuE;YACvE,+CAA+C,CAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,gDAAgD;AAChD,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,KAAK,UAAU,eAAe,CAAC,EAAU;IACvC,MAAM,UAAU,GAAG,MAAM,aAAa,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,sEAAsE;IACtE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IACxD,OAAO,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,EAAU;IAC/D,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAEtF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,gFAAgF;IAChF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB,EAAE,EAAU;IAChE,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEjD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,SAAS,GAAG,eAAe,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,+BAA+B,OAAO,eAAe,kBAAkB,IAAI;YACzE,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,SAAS,EAAE,MAAM,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;IAElF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAC1F,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,uEAAuE;YACvE,4DAA4D,CAC/D,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/crypto/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE1E,6BAA6B;AAC7B,MAAM,SAAS,GAAG,aAAsB,CAAC;AACzC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB,WAAW,EAAE;IAChE,OAAO,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACvC,CAAC;AAiBD;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAAC,QAAiB;IAC5C,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,8BAA8B;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,+DAA+D;YAC/D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvF,MAAM,cAAc,GAAG,0CAA0C,CAAC;gBAClE,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChC,MAAM,IAAI,KAAK,CACb,mEAAmE;wBACjE,qBAAqB,OAAO,0CAA0C,CACzE,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,IAAI,MAAM,YAAY,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAAE,MAAM,MAAM,CAAC;YACjF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,gCAAgC;YAChC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;YAChC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB;oBACzE,uBAAuB,OAAO,EAAE,CACnC,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpC,6BAA6B;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,mCAAmC,GAAG,CAAC,MAAM,oBAAoB,UAAU,KAAK;gBAC9E,UAAU,OAAO,gDAAgD,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9F,6BAA6B;YAC7B,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;YACpC,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,gFAAgF;gBAChF,IAAI,CAAC;oBACH,YAAY,CACV,QAAQ,EACR;wBACE,OAAO;wBACP,gBAAgB;wBAChB,UAAU;wBACV,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,cAAc,IAAI;qBACjD,EACD,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,gEAAgE;gBAClE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC9B,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,2CAA2C;AAC3C,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,WAAW,CAAC,SAAiB,EAAE,GAAW,EAAE,OAAe;IAClE,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,SAAS,OAAO,CAAC,UAAkB;IAMjC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,SAAS,GAAG,eAAe,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxB,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC;QACrC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,SAAS,EAAE,MAAM,CAAC,MAAM,GAAG,eAAe,CAAC;QAC1E,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,KAAiC,EAAE,GAAW;IACjE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAChG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,CAAC;AAE1D,qEAAqE;AACrE,MAAM,sBAAsB,GAAG,8BAA8B,CAAC;AA+C9D;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAAC,SAAiB,EAAE,QAAiB;IACpE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;SACpC,MAAM,CAAC,sBAAsB,GAAG,SAAS,EAAE,MAAM,CAAC;SAClD,MAAM,EAAE,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,mBAAmB,CAAC,WAAmB,EAAE,QAAiB;IACvE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,SAAiB,EACjB,UAAgC,EAAE;IAElC,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE,OAAO,WAAW,CAAC,SAAS,EAAE,GAAG,EAAE,qCAAqC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB,EAClB,OAA6B;IAE7B,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAElC,IAAI,KAAK,CAAC,OAAO,KAAK,qCAAqC,EAAE,CAAC;QAC5D,MAAM,SAAS,GAAG,WAAW,CAC3B,KAAK,EACL,MAAM,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAC9D,CAAC;QACF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,iDAAiD,OAAO,CAAC,SAAS,IAAI;gBACpE,+EAA+E;gBAC/E,qDAAqD,CACxD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,sCAAsC,EAAE,CAAC;QAC7D,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,CAAC;QAClE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,EAAE,MAAM,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7F,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,OAAO;oBACL,SAAS;oBACT,GAAG,EAAE,aAAa;oBAClB,SAAS,EAAE,MAAM,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;iBAC7E,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qFAAqF;YACnF,oBAAoB,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YAC1F,+EAA+E,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,CAAC,OAAO,cAAc;QAChE,GAAG,qCAAqC,OAAO,sCAAsC,GAAG,CAC3F,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,gDAAgD;AAChD,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,KAAK,UAAU,eAAe,CAAC,EAAU,EAAE,QAAiB;IAC1D,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzF,sEAAsE;IACtE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IACxD,OAAO,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAiB,EACjB,EAAU,EACV,UAAgC,EAAE;IAElC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxD,OAAO,WAAW,CAAC,SAAS,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB,EAClB,EAAU,EACV,UAAgC,EAAE;IAElC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,CAAC,OAAO,eAAe,kBAAkB,IAAI;YAC/E,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,EAAE,MAAM,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,uEAAuE;YACvE,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}