@compass-ai/nova 1.0.72 → 1.0.74

package/dist/utils/crypto.js

@@ -0,0 +1,615 @@
+/**
+ * Cryptographic utilities for encryption/decryption of sensitive data.
+ *
+ * This module provides secure cryptographic operations for the Compass CLI,
+ * including AES-256-GCM encryption/decryption, secure random generation,
+ * hashing, and HMAC signatures.
+ *
+ * Security features:
+ * - AES-256-GCM authenticated encryption
+ * - PBKDF2 key derivation with 100,000 iterations
+ * - Cryptographically secure random number generation
+ * - Constant-time string comparison to prevent timing attacks
+ * - SHA-256 hashing for data integrity
+ * - HMAC-SHA256 for message authentication
+ */
+import crypto from 'crypto';
+import os from 'os';
+// =============================================================================
+// Constants
+// =============================================================================
+/**
+ * Encryption algorithm: AES-256 in GCM mode for authenticated encryption
+ */
+const ALGORITHM = 'aes-256-gcm';
+/**
+ * Initialization vector length in bytes (128 bits for AES-GCM)
+ */
+const IV_LENGTH = 16;
+/**
+ * Salt length in bytes for key derivation
+ */
+const SALT_LENGTH = 32;
+/**
+ * Authentication tag length in bytes for GCM mode
+ */
+const TAG_LENGTH = 16;
+/**
+ * Derived key length in bytes (256 bits for AES-256)
+ */
+const KEY_LENGTH = 32;
+/**
+ * Number of PBKDF2 iterations for key derivation
+ * Higher values increase security but also computation time
+ */
+const ITERATIONS = 100000;
+/**
+ * Hash algorithm used for PBKDF2 key derivation
+ */
+const HASH_ALGORITHM = 'sha256';
+// =============================================================================
+// Key Derivation
+// =============================================================================
+/**
+ * Derives a cryptographic key from a password using PBKDF2.
+ *
+ * PBKDF2 (Password-Based Key Derivation Function 2) is used to derive
+ * a secure encryption key from a potentially weak password. The high
+ * iteration count makes brute-force attacks computationally expensive.
+ *
+ * @param password - The password to derive the key from
+ * @param salt - Random salt to prevent rainbow table attacks
+ * @returns Derived key buffer of KEY_LENGTH bytes
+ */
+function deriveKey(password, salt) {
+    return crypto.pbkdf2Sync(password, salt, ITERATIONS, KEY_LENGTH, HASH_ALGORITHM);
+}
+// =============================================================================
+// Encryption / Decryption
+// =============================================================================
+/**
+ * Encrypts plaintext data using AES-256-GCM authenticated encryption.
+ *
+ * The encryption process:
+ * 1. Generates a random salt for key derivation
+ * 2. Derives an encryption key from the password using PBKDF2
+ * 3. Generates a random initialization vector (IV)
+ * 4. Encrypts the data using AES-256-GCM
+ * 5. Combines salt + IV + auth tag + ciphertext into a single output
+ *
+ * The output format is: salt (32 bytes) + IV (16 bytes) + tag (16 bytes) + ciphertext
+ * All encoded as base64 for safe storage and transmission.
+ *
+ * @param plaintext - The string data to encrypt
+ * @param password - The password used for key derivation
+ * @returns Base64-encoded encrypted data containing salt, IV, tag, and ciphertext
+ *
+ * @example
+ * ```typescript
+ * const encrypted = encrypt('my secret data', 'strong-password');
+ * // Returns: base64-encoded string
+ * ```
+ */
+export function encrypt(plaintext, password) {
+    // Generate random salt for key derivation
+    const salt = crypto.randomBytes(SALT_LENGTH);
+    // Generate random initialization vector
+    const iv = crypto.randomBytes(IV_LENGTH);
+    // Derive encryption key from password
+    const key = deriveKey(password, salt);
+    // Create cipher with AES-256-GCM
+    const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+    // Encrypt the plaintext
+    let encrypted = cipher.update(plaintext, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    // Get the authentication tag
+    const tag = cipher.getAuthTag();
+    // Combine all components: salt + iv + tag + encrypted data
+    const combined = Buffer.concat([
+        salt,
+        iv,
+        tag,
+        Buffer.from(encrypted, 'hex'),
+    ]);
+    // Return as base64 for safe storage
+    return combined.toString('base64');
+}
+/**
+ * Decrypts data that was encrypted with the encrypt() function.
+ *
+ * The decryption process:
+ * 1. Decodes the base64 input
+ * 2. Extracts salt, IV, authentication tag, and ciphertext
+ * 3. Derives the decryption key using the same password and salt
+ * 4. Verifies the authentication tag and decrypts the data
+ *
+ * @param encryptedData - Base64-encoded encrypted data from encrypt()
+ * @param password - The same password used for encryption
+ * @returns The original plaintext string
+ * @throws Error if decryption fails (wrong password, corrupted data, or tampering)
+ *
+ * @example
+ * ```typescript
+ * const encrypted = encrypt('my secret data', 'strong-password');
+ * const decrypted = decrypt(encrypted, 'strong-password');
+ * // Returns: 'my secret data'
+ * ```
+ */
+export function decrypt(encryptedData, password) {
+    // Decode from base64
+    const combined = Buffer.from(encryptedData, 'base64');
+    // Validate minimum length
+    const minLength = SALT_LENGTH + IV_LENGTH + TAG_LENGTH + 1;
+    if (combined.length < minLength) {
+        throw new Error('Invalid encrypted data: too short');
+    }
+    // Extract components
+    const salt = combined.subarray(0, SALT_LENGTH);
+    const iv = combined.subarray(SALT_LENGTH, SALT_LENGTH + IV_LENGTH);
+    const tag = combined.subarray(SALT_LENGTH + IV_LENGTH, SALT_LENGTH + IV_LENGTH + TAG_LENGTH);
+    const encrypted = combined.subarray(SALT_LENGTH + IV_LENGTH + TAG_LENGTH);
+    // Derive the same key using the extracted salt
+    const key = deriveKey(password, salt);
+    // Create decipher
+    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+    // Set the authentication tag for verification
+    decipher.setAuthTag(tag);
+    // Decrypt the data
+    let decrypted = decipher.update(encrypted.toString('hex'), 'hex', 'utf8');
+    decrypted += decipher.final('utf8');
+    return decrypted;
+}
+// =============================================================================
+// Random Generation
+// =============================================================================
+/**
+ * Generates a cryptographically secure random string.
+ *
+ * Uses crypto.randomBytes() which provides cryptographically strong
+ * pseudo-random data suitable for security-sensitive operations.
+ *
+ * @param length - Number of random bytes to generate (default: 32)
+ * @returns Hexadecimal string of the random bytes (2 * length characters)
+ *
+ * @example
+ * ```typescript
+ * const token = generateSecureRandom(16);
+ * // Returns: 32-character hex string like 'a1b2c3d4e5f6...'
+ *
+ * const sessionId = generateSecureRandom();
+ * // Returns: 64-character hex string (default 32 bytes)
+ * ```
+ */
+export function generateSecureRandom(length = 32) {
+    return crypto.randomBytes(length).toString('hex');
+}
+/**
+ * Generates a cryptographically secure random bytes buffer.
+ *
+ * @param length - Number of random bytes to generate
+ * @returns Buffer containing random bytes
+ *
+ * @example
+ * ```typescript
+ * const randomBytes = generateRandomBytes(16);
+ * // Returns: Buffer of 16 random bytes
+ * ```
+ */
+export function generateRandomBytes(length) {
+    return crypto.randomBytes(length);
+}
+/**
+ * Generates a random UUID v4.
+ *
+ * @returns A random UUID string in the format xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx
+ *
+ * @example
+ * ```typescript
+ * const id = generateUUID();
+ * // Returns: 'f47ac10b-58cc-4372-a567-0e02b2c3d479'
+ * ```
+ */
+export function generateUUID() {
+    return crypto.randomUUID();
+}
+// =============================================================================
+// Hashing
+// =============================================================================
+/**
+ * Creates a SHA-256 hash of the input string.
+ *
+ * SHA-256 is a cryptographic hash function that produces a 256-bit (32-byte)
+ * hash value. It's suitable for data integrity verification and generating
+ * unique identifiers from input data.
+ *
+ * @param input - The string to hash
+ * @returns Hexadecimal string of the SHA-256 hash (64 characters)
+ *
+ * @example
+ * ```typescript
+ * const hashedPassword = hash('user-password');
+ * // Returns: 64-character hex string
+ *
+ * const fileHash = hash(fileContents);
+ * // Can be used to verify file integrity
+ * ```
+ */
+export function hash(input) {
+    return crypto.createHash(HASH_ALGORITHM).update(input).digest('hex');
+}
+/**
+ * Creates a hash of the input using the specified algorithm.
+ *
+ * @param input - The string to hash
+ * @param algorithm - Hash algorithm to use (e.g., 'sha256', 'sha512', 'md5')
+ * @returns Hexadecimal string of the hash
+ *
+ * @example
+ * ```typescript
+ * const sha512Hash = hashWithAlgorithm('data', 'sha512');
+ * const md5Hash = hashWithAlgorithm('data', 'md5');
+ * ```
+ */
+export function hashWithAlgorithm(input, algorithm) {
+    return crypto.createHash(algorithm).update(input).digest('hex');
+}
+/**
+ * Creates a hash of a buffer using SHA-256.
+ *
+ * @param input - The buffer to hash
+ * @returns Hexadecimal string of the SHA-256 hash
+ */
+export function hashBuffer(input) {
+    return crypto.createHash(HASH_ALGORITHM).update(input).digest('hex');
+}
+// =============================================================================
+// HMAC
+// =============================================================================
+/**
+ * Creates an HMAC-SHA256 signature of the data.
+ *
+ * HMAC (Hash-based Message Authentication Code) provides both data integrity
+ * and authentication. It's used to verify that a message hasn't been altered
+ * and was created by someone with the secret key.
+ *
+ * @param data - The data to sign
+ * @param secret - The secret key for HMAC
+ * @returns Hexadecimal string of the HMAC signature (64 characters)
+ *
+ * @example
+ * ```typescript
+ * const signature = hmac('message-to-sign', 'secret-key');
+ * // Returns: 64-character hex string
+ *
+ * // Verify by computing HMAC again and comparing
+ * const isValid = hmac('message-to-sign', 'secret-key') === signature;
+ * ```
+ */
+export function hmac(data, secret) {
+    return crypto
+        .createHmac(HASH_ALGORITHM, secret)
+        .update(data)
+        .digest('hex');
+}
+/**
+ * Creates an HMAC signature using the specified algorithm.
+ *
+ * @param data - The data to sign
+ * @param secret - The secret key for HMAC
+ * @param algorithm - Hash algorithm to use (e.g., 'sha256', 'sha512')
+ * @returns Hexadecimal string of the HMAC signature
+ */
+export function hmacWithAlgorithm(data, secret, algorithm) {
+    return crypto.createHmac(algorithm, secret).update(data).digest('hex');
+}
+// =============================================================================
+// Machine Key Generation
+// =============================================================================
+/**
+ * Generates a machine-specific key for local encryption.
+ *
+ * This function creates a unique key based on machine identifiers,
+ * which can be used for encrypting data that should only be decryptable
+ * on the same machine. This is useful for storing credentials locally.
+ *
+ * Note: This key will change if the machine's hostname, username, or
+ * other identifying characteristics change.
+ *
+ * @returns SHA-256 hash of combined machine identifiers
+ *
+ * @example
+ * ```typescript
+ * const machineKey = getMachineKey();
+ * const encrypted = encrypt('sensitive-data', machineKey);
+ * // Data can only be decrypted on the same machine
+ * ```
+ */
+export function getMachineKey() {
+    // Combine multiple machine-specific values for key derivation
+    const components = [
+        os.hostname(),
+        os.platform(),
+        os.arch(),
+        os.userInfo().username,
+        os.homedir(),
+    ];
+    // Create a hash of the combined components
+    return hash(components.join(':'));
+}
+/**
+ * Generates a machine-specific key asynchronously.
+ * This is provided for consistency with async patterns in the codebase.
+ *
+ * @returns Promise resolving to SHA-256 hash of combined machine identifiers
+ */
+export async function getMachineKeyAsync() {
+    return getMachineKey();
+}
+// =============================================================================
+// Secure Comparison
+// =============================================================================
+/**
+ * Securely compares two strings in constant time.
+ *
+ * This function prevents timing attacks by ensuring the comparison
+ * takes the same amount of time regardless of where the strings differ.
+ * Regular string comparison (===) can leak information about the position
+ * of the first differing character through timing analysis.
+ *
+ * @param a - First string to compare
+ * @param b - Second string to compare
+ * @returns True if strings are equal, false otherwise
+ *
+ * @example
+ * ```typescript
+ * // Use for comparing sensitive values like tokens or signatures
+ * const isValid = secureCompare(providedToken, storedToken);
+ *
+ * // Don't use regular comparison for security-sensitive data
+ * // BAD: if (providedToken === storedToken) { ... }
+ * // GOOD: if (secureCompare(providedToken, storedToken)) { ... }
+ * ```
+ */
+export function secureCompare(a, b) {
+    // If lengths differ, we still need to do a constant-time comparison
+    // to avoid leaking length information
+    if (a.length !== b.length) {
+        // Compare against itself to maintain constant time
+        crypto.timingSafeEqual(Buffer.from(a), Buffer.from(a));
+        return false;
+    }
+    return crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));
+}
+/**
+ * Securely compares two buffers in constant time.
+ *
+ * @param a - First buffer to compare
+ * @param b - Second buffer to compare
+ * @returns True if buffers are equal, false otherwise
+ */
+export function secureCompareBuffers(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    return crypto.timingSafeEqual(a, b);
+}
+// =============================================================================
+// Utility Functions
+// =============================================================================
+/**
+ * Generates a secure token suitable for session IDs or API tokens.
+ *
+ * @param length - Length of the token in bytes (default: 32)
+ * @returns URL-safe base64-encoded token
+ *
+ * @example
+ * ```typescript
+ * const sessionToken = generateToken();
+ * // Returns: URL-safe base64 string
+ * ```
+ */
+export function generateToken(length = 32) {
+    return crypto.randomBytes(length).toString('base64url');
+}
+/**
+ * Creates a salted hash of a password for storage.
+ *
+ * This is a simple implementation for non-critical use cases.
+ * For production password storage, consider using bcrypt or argon2.
+ *
+ * @param password - The password to hash
+ * @returns Object containing the salt and hash
+ *
+ * @example
+ * ```typescript
+ * const { salt, hash } = hashPassword('user-password');
+ * // Store both salt and hash in database
+ * ```
+ */
+export function hashPassword(password) {
+    const salt = generateSecureRandom(16);
+    const derivedKey = deriveKey(password, Buffer.from(salt, 'hex'));
+    return {
+        salt,
+        hash: derivedKey.toString('hex'),
+    };
+}
+/**
+ * Verifies a password against a stored salt and hash.
+ *
+ * @param password - The password to verify
+ * @param salt - The stored salt (hex string)
+ * @param storedHash - The stored hash (hex string)
+ * @returns True if the password matches
+ *
+ * @example
+ * ```typescript
+ * const isValid = verifyPassword('user-password', storedSalt, storedHash);
+ * ```
+ */
+export function verifyPassword(password, salt, storedHash) {
+    const derivedKey = deriveKey(password, Buffer.from(salt, 'hex'));
+    return secureCompare(derivedKey.toString('hex'), storedHash);
+}
+/**
+ * Encrypts an object by serializing it to JSON first.
+ *
+ * @param data - The object to encrypt
+ * @param password - The encryption password
+ * @returns Base64-encoded encrypted data
+ *
+ * @example
+ * ```typescript
+ * const encrypted = encryptObject({ apiKey: 'secret' }, 'password');
+ * ```
+ */
+export function encryptObject(data, password) {
+    const json = JSON.stringify(data);
+    return encrypt(json, password);
+}
+/**
+ * Decrypts data and parses it as JSON.
+ *
+ * @param encryptedData - The encrypted data from encryptObject()
+ * @param password - The decryption password
+ * @returns The decrypted and parsed object
+ *
+ * @example
+ * ```typescript
+ * const data = decryptObject<{ apiKey: string }>(encrypted, 'password');
+ * console.log(data.apiKey);
+ * ```
+ */
+export function decryptObject(encryptedData, password) {
+    const json = decrypt(encryptedData, password);
+    return JSON.parse(json);
+}
+/**
+ * Generates a checksum for data integrity verification.
+ *
+ * @param data - The data to checksum
+ * @returns Short hash suitable for display (first 8 characters of SHA-256)
+ *
+ * @example
+ * ```typescript
+ * const checksum = generateChecksum(fileContents);
+ * // Returns: '3a7bd3e2' (8 characters)
+ * ```
+ */
+export function generateChecksum(data) {
+    return hash(data).substring(0, 8);
+}
+/**
+ * Verifies a checksum against data.
+ *
+ * @param data - The data to verify
+ * @param checksum - The expected checksum
+ * @returns True if the checksum matches
+ */
+export function verifyChecksum(data, checksum) {
+    return generateChecksum(data) === checksum;
+}
+// =============================================================================
+// Fernet-Compatible Decryption (for compatibility with Python's cryptography.fernet)
+// =============================================================================
+/**
+ * Fixed salt used for key derivation in Fernet encryption
+ * Must match the salt used in the Python CliAuth implementation
+ */
+const FERNET_SALT = Buffer.from('b-f2T&>)XPx2vI/I9N7CfYH@Dvdb<F', 'utf-8');
+/**
+ * Derives a Fernet-compatible encryption key from a password.
+ *
+ * This implementation matches Python's cryptography.fernet key derivation:
+ * - Uses PBKDF2HMAC with SHA256
+ * - 100,000 iterations
+ * - Fixed salt for consistency with backend
+ * - Returns base64 URL-safe encoded key (Fernet format requirement)
+ *
+ * @param password - The password to derive the key from
+ * @returns Base64 URL-safe encoded key for Fernet decryption
+ */
+function deriveFernetKey(password) {
+    // Derive 32-byte key using PBKDF2
+    const derivedKey = crypto.pbkdf2Sync(password, FERNET_SALT, 100000, // iterations
+    32, // key length
+    'sha256');
+    // Fernet requires the key to be base64 URL-safe encoded
+    return Buffer.from(derivedKey.toString('base64url'), 'utf-8');
+}
+/**
+ * Decrypts data encrypted with Python's cryptography.fernet.Fernet.
+ *
+ * Fernet format:
+ * - Version (1 byte): 0x80
+ * - Timestamp (8 bytes): big-endian timestamp
+ * - IV (16 bytes): initialization vector for AES-128-CBC
+ * - Ciphertext (variable): encrypted data
+ * - HMAC (32 bytes): HMAC-SHA256 for authentication
+ *
+ * @param encryptedData - Base64 URL-safe encoded Fernet token
+ * @param password - Password used for key derivation
+ * @returns Decrypted plaintext string
+ * @throws Error if decryption fails (wrong password, corrupted data, or invalid format)
+ *
+ * @example
+ * ```typescript
+ * // Decrypt data encrypted by Python's CliAuth.encrypt()
+ * const decrypted = decryptFernet(encryptedToken, 'anthropic');
+ * ```
+ */
+export function decryptFernet(encryptedData, password) {
+    try {
+        // Step 1: Derive the Fernet key from password
+        const fernetKeyBuffer = deriveFernetKey(password);
+        // Step 2: Decode the Fernet key (it was base64url encoded)
+        const actualKey = Buffer.from(fernetKeyBuffer.toString('utf-8'), 'base64url');
+        // Step 3: Decode the encrypted data from base64url (TWICE - Python does double encoding)
+        // First decode: Remove the outer base64url encoding added by Python's CliAuth.encrypt()
+        const outerDecoded = Buffer.from(encryptedData, 'base64url');
+        // Second decode: The outer decode gives us ASCII text that is the Fernet token
+        // Convert those bytes to a string, then decode that string from base64url
+        const fernetTokenString = outerDecoded.toString('utf-8');
+        const tokenBuffer = Buffer.from(fernetTokenString, 'base64url');
+        // Step 4: Parse Fernet token structure
+        // Minimum length: version(1) + timestamp(8) + iv(16) + hmac(32) = 57 bytes
+        if (tokenBuffer.length < 57) {
+            throw new Error(`Invalid Fernet token: too short (${tokenBuffer.length} bytes, need at least 57)`);
+        }
+        const version = tokenBuffer[0];
+        if (version !== 0x80) {
+            throw new Error(`Invalid Fernet version: 0x${version.toString(16)} (expected 0x80)`);
+        }
+        const iv = tokenBuffer.subarray(9, 25);
+        const ciphertext = tokenBuffer.subarray(25, tokenBuffer.length - 32);
+        const providedHmac = tokenBuffer.subarray(tokenBuffer.length - 32);
+        // Step 5: Verify HMAC (authentication)
+        // HMAC is computed over: version + timestamp + iv + ciphertext
+        // Fernet key structure: first 16 bytes = signing key (HMAC), last 16 bytes = encryption key (AES)
+        const signingKey = actualKey.subarray(0, 16);
+        const encryptionKey = actualKey.subarray(16, 32);
+        const dataToVerify = tokenBuffer.subarray(0, tokenBuffer.length - 32);
+        const computedHmac = crypto
+            .createHmac('sha256', signingKey)
+            .update(dataToVerify)
+            .digest();
+        if (!crypto.timingSafeEqual(providedHmac, computedHmac)) {
+            throw new Error('Invalid Fernet token: HMAC verification failed');
+        }
+        // Step 6: Decrypt using AES-128-CBC
+        // Use the encryption key (last 16 bytes) - already extracted in Step 5
+        const decipher = crypto.createDecipheriv('aes-128-cbc', encryptionKey, iv);
+        // Enable automatic padding handling (Fernet uses PKCS7)
+        decipher.setAutoPadding(true);
+        let decrypted = decipher.update(ciphertext);
+        decrypted = Buffer.concat([decrypted, decipher.final()]);
+        return decrypted.toString('utf-8');
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            throw new Error(`Failed to decrypt Fernet token: ${error.message}`);
+        }
+        throw new Error('Failed to decrypt Fernet token: Unknown error');
+    }
+}
+//# sourceMappingURL=crypto.js.map

package/dist/utils/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;GAEG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC;;GAEG;AACH,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB;;GAEG;AACH,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB;;GAEG;AACH,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;GAEG;AACH,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;;GAGG;AACH,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B;;GAEG;AACH,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEhC,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAAC,QAAgB,EAAE,IAAY;IAC/C,OAAO,MAAM,CAAC,UAAU,CACtB,QAAQ,EACR,IAAI,EACJ,UAAU,EACV,UAAU,EACV,cAAc,CACf,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,QAAgB;IACzD,0CAA0C;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAE7C,wCAAwC;IACxC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAEzC,sCAAsC;IACtC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEtC,iCAAiC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAEzD,wBAAwB;IACxB,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACxD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAEjC,6BAA6B;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEhC,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI;QACJ,EAAE;QACF,GAAG;QACH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC;KAC9B,CAAC,CAAC;IAEH,oCAAoC;IACpC,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,OAAO,CAAC,aAAqB,EAAE,QAAgB;IAC7D,qBAAqB;IACrB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAEtD,0BAA0B;IAC1B,MAAM,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,CAAC,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,qBAAqB;IACrB,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAC3B,WAAW,GAAG,SAAS,EACvB,WAAW,GAAG,SAAS,GAAG,UAAU,CACrC,CAAC;IACF,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;IAE1E,+CAA+C;IAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEtC,kBAAkB;IAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAE7D,8CAA8C;IAC9C,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAEzB,mBAAmB;IACnB,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1E,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEpC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE;IACtD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,IAAI,CAAC,KAAa;IAChC,OAAO,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,SAAiB;IAChE,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,gFAAgF;AAChF,OAAO;AACP,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,IAAI,CAAC,IAAY,EAAE,MAAc;IAC/C,OAAO,MAAM;SACV,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC;SAClC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,MAAc,EACd,SAAiB;IAEjB,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa;IAC3B,8DAA8D;IAC9D,MAAM,UAAU,GAAG;QACjB,EAAE,CAAC,QAAQ,EAAE;QACb,EAAE,CAAC,QAAQ,EAAE;QACb,EAAE,CAAC,IAAI,EAAE;QACT,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ;QACtB,EAAE,CAAC,OAAO,EAAE;KACb,CAAC;IAEF,2CAA2C;IAC3C,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,oEAAoE;IACpE,sCAAsC;IACtC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,mDAAmD;QACnD,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,CAAS,EAAE,CAAS;IACvD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE;IAC/C,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,IAAY,EACZ,UAAkB;IAElB,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,OAAO,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,IAAa,EAAE,QAAgB;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAI,aAAqB,EAAE,QAAgB;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,QAAgB;IAC3D,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC;AAC7C,CAAC;AAED,gFAAgF;AAChF,qFAAqF;AACrF,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,OAAO,CAAC,CAAC;AAE3E;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,kCAAkC;IAClC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAClC,QAAQ,EACR,WAAW,EACX,MAAM,EAAE,aAAa;IACrB,EAAE,EAAE,aAAa;IACjB,QAAQ,CACT,CAAC;IAEF,wDAAwD;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,aAAa,CAAC,aAAqB,EAAE,QAAgB;IACnE,IAAI,CAAC;QACH,8CAA8C;QAC9C,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAElD,2DAA2D;QAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC;QAE9E,yFAAyF;QACzF,wFAAwF;QACxF,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAE7D,+EAA+E;QAC/E,0EAA0E;QAC1E,MAAM,iBAAiB,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;QAEhE,uCAAuC;QACvC,2EAA2E;QAC3E,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,oCAAoC,WAAW,CAAC,MAAM,2BAA2B,CAAC,CAAC;QACrG,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QACrE,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAEnE,uCAAuC;QACvC,+DAA+D;QAC/D,kGAAkG;QAClG,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAEjD,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QACtE,MAAM,YAAY,GAAG,MAAM;aACxB,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;aAChC,MAAM,CAAC,YAAY,CAAC;aACpB,MAAM,EAAE,CAAC;QAEZ,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QAED,oCAAoC;QACpC,uEAAuE;QACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAE3E,wDAAwD;QACxD,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE9B,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5C,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAEzD,OAAO,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}