@compass-ai/nova 1.0.74 → 1.0.76

package/dist/utils/crypto.js

@@ -1,615 +0,0 @@
-/**
- * Cryptographic utilities for encryption/decryption of sensitive data.
- *
- * This module provides secure cryptographic operations for the Compass CLI,
- * including AES-256-GCM encryption/decryption, secure random generation,
- * hashing, and HMAC signatures.
- *
- * Security features:
- * - AES-256-GCM authenticated encryption
- * - PBKDF2 key derivation with 100,000 iterations
- * - Cryptographically secure random number generation
- * - Constant-time string comparison to prevent timing attacks
- * - SHA-256 hashing for data integrity
- * - HMAC-SHA256 for message authentication
- */
-import crypto from 'crypto';
-import os from 'os';
-// =============================================================================
-// Constants
-// =============================================================================
-/**
- * Encryption algorithm: AES-256 in GCM mode for authenticated encryption
- */
-const ALGORITHM = 'aes-256-gcm';
-/**
- * Initialization vector length in bytes (128 bits for AES-GCM)
- */
-const IV_LENGTH = 16;
-/**
- * Salt length in bytes for key derivation
- */
-const SALT_LENGTH = 32;
-/**
- * Authentication tag length in bytes for GCM mode
- */
-const TAG_LENGTH = 16;
-/**
- * Derived key length in bytes (256 bits for AES-256)
- */
-const KEY_LENGTH = 32;
-/**
- * Number of PBKDF2 iterations for key derivation
- * Higher values increase security but also computation time
- */
-const ITERATIONS = 100000;
-/**
- * Hash algorithm used for PBKDF2 key derivation
- */
-const HASH_ALGORITHM = 'sha256';
-// =============================================================================
-// Key Derivation
-// =============================================================================
-/**
- * Derives a cryptographic key from a password using PBKDF2.
- *
- * PBKDF2 (Password-Based Key Derivation Function 2) is used to derive
- * a secure encryption key from a potentially weak password. The high
- * iteration count makes brute-force attacks computationally expensive.
- *
- * @param password - The password to derive the key from
- * @param salt - Random salt to prevent rainbow table attacks
- * @returns Derived key buffer of KEY_LENGTH bytes
- */
-function deriveKey(password, salt) {
-    return crypto.pbkdf2Sync(password, salt, ITERATIONS, KEY_LENGTH, HASH_ALGORITHM);
-}
-// =============================================================================
-// Encryption / Decryption
-// =============================================================================
-/**
- * Encrypts plaintext data using AES-256-GCM authenticated encryption.
- *
- * The encryption process:
- * 1. Generates a random salt for key derivation
- * 2. Derives an encryption key from the password using PBKDF2
- * 3. Generates a random initialization vector (IV)
- * 4. Encrypts the data using AES-256-GCM
- * 5. Combines salt + IV + auth tag + ciphertext into a single output
- *
- * The output format is: salt (32 bytes) + IV (16 bytes) + tag (16 bytes) + ciphertext
- * All encoded as base64 for safe storage and transmission.
- *
- * @param plaintext - The string data to encrypt
- * @param password - The password used for key derivation
- * @returns Base64-encoded encrypted data containing salt, IV, tag, and ciphertext
- *
- * @example
- * ```typescript
- * const encrypted = encrypt('my secret data', 'strong-password');
- * // Returns: base64-encoded string
- * ```
- */
-export function encrypt(plaintext, password) {
-    // Generate random salt for key derivation
-    const salt = crypto.randomBytes(SALT_LENGTH);
-    // Generate random initialization vector
-    const iv = crypto.randomBytes(IV_LENGTH);
-    // Derive encryption key from password
-    const key = deriveKey(password, salt);
-    // Create cipher with AES-256-GCM
-    const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
-    // Encrypt the plaintext
-    let encrypted = cipher.update(plaintext, 'utf8', 'hex');
-    encrypted += cipher.final('hex');
-    // Get the authentication tag
-    const tag = cipher.getAuthTag();
-    // Combine all components: salt + iv + tag + encrypted data
-    const combined = Buffer.concat([
-        salt,
-        iv,
-        tag,
-        Buffer.from(encrypted, 'hex'),
-    ]);
-    // Return as base64 for safe storage
-    return combined.toString('base64');
-}
-/**
- * Decrypts data that was encrypted with the encrypt() function.
- *
- * The decryption process:
- * 1. Decodes the base64 input
- * 2. Extracts salt, IV, authentication tag, and ciphertext
- * 3. Derives the decryption key using the same password and salt
- * 4. Verifies the authentication tag and decrypts the data
- *
- * @param encryptedData - Base64-encoded encrypted data from encrypt()
- * @param password - The same password used for encryption
- * @returns The original plaintext string
- * @throws Error if decryption fails (wrong password, corrupted data, or tampering)
- *
- * @example
- * ```typescript
- * const encrypted = encrypt('my secret data', 'strong-password');
- * const decrypted = decrypt(encrypted, 'strong-password');
- * // Returns: 'my secret data'
- * ```
- */
-export function decrypt(encryptedData, password) {
-    // Decode from base64
-    const combined = Buffer.from(encryptedData, 'base64');
-    // Validate minimum length
-    const minLength = SALT_LENGTH + IV_LENGTH + TAG_LENGTH + 1;
-    if (combined.length < minLength) {
-        throw new Error('Invalid encrypted data: too short');
-    }
-    // Extract components
-    const salt = combined.subarray(0, SALT_LENGTH);
-    const iv = combined.subarray(SALT_LENGTH, SALT_LENGTH + IV_LENGTH);
-    const tag = combined.subarray(SALT_LENGTH + IV_LENGTH, SALT_LENGTH + IV_LENGTH + TAG_LENGTH);
-    const encrypted = combined.subarray(SALT_LENGTH + IV_LENGTH + TAG_LENGTH);
-    // Derive the same key using the extracted salt
-    const key = deriveKey(password, salt);
-    // Create decipher
-    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
-    // Set the authentication tag for verification
-    decipher.setAuthTag(tag);
-    // Decrypt the data
-    let decrypted = decipher.update(encrypted.toString('hex'), 'hex', 'utf8');
-    decrypted += decipher.final('utf8');
-    return decrypted;
-}
-// =============================================================================
-// Random Generation
-// =============================================================================
-/**
- * Generates a cryptographically secure random string.
- *
- * Uses crypto.randomBytes() which provides cryptographically strong
- * pseudo-random data suitable for security-sensitive operations.
- *
- * @param length - Number of random bytes to generate (default: 32)
- * @returns Hexadecimal string of the random bytes (2 * length characters)
- *
- * @example
- * ```typescript
- * const token = generateSecureRandom(16);
- * // Returns: 32-character hex string like 'a1b2c3d4e5f6...'
- *
- * const sessionId = generateSecureRandom();
- * // Returns: 64-character hex string (default 32 bytes)
- * ```
- */
-export function generateSecureRandom(length = 32) {
-    return crypto.randomBytes(length).toString('hex');
-}
-/**
- * Generates a cryptographically secure random bytes buffer.
- *
- * @param length - Number of random bytes to generate
- * @returns Buffer containing random bytes
- *
- * @example
- * ```typescript
- * const randomBytes = generateRandomBytes(16);
- * // Returns: Buffer of 16 random bytes
- * ```
- */
-export function generateRandomBytes(length) {
-    return crypto.randomBytes(length);
-}
-/**
- * Generates a random UUID v4.
- *
- * @returns A random UUID string in the format xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx
- *
- * @example
- * ```typescript
- * const id = generateUUID();
- * // Returns: 'f47ac10b-58cc-4372-a567-0e02b2c3d479'
- * ```
- */
-export function generateUUID() {
-    return crypto.randomUUID();
-}
-// =============================================================================
-// Hashing
-// =============================================================================
-/**
- * Creates a SHA-256 hash of the input string.
- *
- * SHA-256 is a cryptographic hash function that produces a 256-bit (32-byte)
- * hash value. It's suitable for data integrity verification and generating
- * unique identifiers from input data.
- *
- * @param input - The string to hash
- * @returns Hexadecimal string of the SHA-256 hash (64 characters)
- *
- * @example
- * ```typescript
- * const hashedPassword = hash('user-password');
- * // Returns: 64-character hex string
- *
- * const fileHash = hash(fileContents);
- * // Can be used to verify file integrity
- * ```
- */
-export function hash(input) {
-    return crypto.createHash(HASH_ALGORITHM).update(input).digest('hex');
-}
-/**
- * Creates a hash of the input using the specified algorithm.
- *
- * @param input - The string to hash
- * @param algorithm - Hash algorithm to use (e.g., 'sha256', 'sha512', 'md5')
- * @returns Hexadecimal string of the hash
- *
- * @example
- * ```typescript
- * const sha512Hash = hashWithAlgorithm('data', 'sha512');
- * const md5Hash = hashWithAlgorithm('data', 'md5');
- * ```
- */
-export function hashWithAlgorithm(input, algorithm) {
-    return crypto.createHash(algorithm).update(input).digest('hex');
-}
-/**
- * Creates a hash of a buffer using SHA-256.
- *
- * @param input - The buffer to hash
- * @returns Hexadecimal string of the SHA-256 hash
- */
-export function hashBuffer(input) {
-    return crypto.createHash(HASH_ALGORITHM).update(input).digest('hex');
-}
-// =============================================================================
-// HMAC
-// =============================================================================
-/**
- * Creates an HMAC-SHA256 signature of the data.
- *
- * HMAC (Hash-based Message Authentication Code) provides both data integrity
- * and authentication. It's used to verify that a message hasn't been altered
- * and was created by someone with the secret key.
- *
- * @param data - The data to sign
- * @param secret - The secret key for HMAC
- * @returns Hexadecimal string of the HMAC signature (64 characters)
- *
- * @example
- * ```typescript
- * const signature = hmac('message-to-sign', 'secret-key');
- * // Returns: 64-character hex string
- *
- * // Verify by computing HMAC again and comparing
- * const isValid = hmac('message-to-sign', 'secret-key') === signature;
- * ```
- */
-export function hmac(data, secret) {
-    return crypto
-        .createHmac(HASH_ALGORITHM, secret)
-        .update(data)
-        .digest('hex');
-}
-/**
- * Creates an HMAC signature using the specified algorithm.
- *
- * @param data - The data to sign
- * @param secret - The secret key for HMAC
- * @param algorithm - Hash algorithm to use (e.g., 'sha256', 'sha512')
- * @returns Hexadecimal string of the HMAC signature
- */
-export function hmacWithAlgorithm(data, secret, algorithm) {
-    return crypto.createHmac(algorithm, secret).update(data).digest('hex');
-}
-// =============================================================================
-// Machine Key Generation
-// =============================================================================
-/**
- * Generates a machine-specific key for local encryption.
- *
- * This function creates a unique key based on machine identifiers,
- * which can be used for encrypting data that should only be decryptable
- * on the same machine. This is useful for storing credentials locally.
- *
- * Note: This key will change if the machine's hostname, username, or
- * other identifying characteristics change.
- *
- * @returns SHA-256 hash of combined machine identifiers
- *
- * @example
- * ```typescript
- * const machineKey = getMachineKey();
- * const encrypted = encrypt('sensitive-data', machineKey);
- * // Data can only be decrypted on the same machine
- * ```
- */
-export function getMachineKey() {
-    // Combine multiple machine-specific values for key derivation
-    const components = [
-        os.hostname(),
-        os.platform(),
-        os.arch(),
-        os.userInfo().username,
-        os.homedir(),
-    ];
-    // Create a hash of the combined components
-    return hash(components.join(':'));
-}
-/**
- * Generates a machine-specific key asynchronously.
- * This is provided for consistency with async patterns in the codebase.
- *
- * @returns Promise resolving to SHA-256 hash of combined machine identifiers
- */
-export async function getMachineKeyAsync() {
-    return getMachineKey();
-}
-// =============================================================================
-// Secure Comparison
-// =============================================================================
-/**
- * Securely compares two strings in constant time.
- *
- * This function prevents timing attacks by ensuring the comparison
- * takes the same amount of time regardless of where the strings differ.
- * Regular string comparison (===) can leak information about the position
- * of the first differing character through timing analysis.
- *
- * @param a - First string to compare
- * @param b - Second string to compare
- * @returns True if strings are equal, false otherwise
- *
- * @example
- * ```typescript
- * // Use for comparing sensitive values like tokens or signatures
- * const isValid = secureCompare(providedToken, storedToken);
- *
- * // Don't use regular comparison for security-sensitive data
- * // BAD: if (providedToken === storedToken) { ... }
- * // GOOD: if (secureCompare(providedToken, storedToken)) { ... }
- * ```
- */
-export function secureCompare(a, b) {
-    // If lengths differ, we still need to do a constant-time comparison
-    // to avoid leaking length information
-    if (a.length !== b.length) {
-        // Compare against itself to maintain constant time
-        crypto.timingSafeEqual(Buffer.from(a), Buffer.from(a));
-        return false;
-    }
-    return crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));
-}
-/**
- * Securely compares two buffers in constant time.
- *
- * @param a - First buffer to compare
- * @param b - Second buffer to compare
- * @returns True if buffers are equal, false otherwise
- */
-export function secureCompareBuffers(a, b) {
-    if (a.length !== b.length) {
-        return false;
-    }
-    return crypto.timingSafeEqual(a, b);
-}
-// =============================================================================
-// Utility Functions
-// =============================================================================
-/**
- * Generates a secure token suitable for session IDs or API tokens.
- *
- * @param length - Length of the token in bytes (default: 32)
- * @returns URL-safe base64-encoded token
- *
- * @example
- * ```typescript
- * const sessionToken = generateToken();
- * // Returns: URL-safe base64 string
- * ```
- */
-export function generateToken(length = 32) {
-    return crypto.randomBytes(length).toString('base64url');
-}
-/**
- * Creates a salted hash of a password for storage.
- *
- * This is a simple implementation for non-critical use cases.
- * For production password storage, consider using bcrypt or argon2.
- *
- * @param password - The password to hash
- * @returns Object containing the salt and hash
- *
- * @example
- * ```typescript
- * const { salt, hash } = hashPassword('user-password');
- * // Store both salt and hash in database
- * ```
- */
-export function hashPassword(password) {
-    const salt = generateSecureRandom(16);
-    const derivedKey = deriveKey(password, Buffer.from(salt, 'hex'));
-    return {
-        salt,
-        hash: derivedKey.toString('hex'),
-    };
-}
-/**
- * Verifies a password against a stored salt and hash.
- *
- * @param password - The password to verify
- * @param salt - The stored salt (hex string)
- * @param storedHash - The stored hash (hex string)
- * @returns True if the password matches
- *
- * @example
- * ```typescript
- * const isValid = verifyPassword('user-password', storedSalt, storedHash);
- * ```
- */
-export function verifyPassword(password, salt, storedHash) {
-    const derivedKey = deriveKey(password, Buffer.from(salt, 'hex'));
-    return secureCompare(derivedKey.toString('hex'), storedHash);
-}
-/**
- * Encrypts an object by serializing it to JSON first.
- *
- * @param data - The object to encrypt
- * @param password - The encryption password
- * @returns Base64-encoded encrypted data
- *
- * @example
- * ```typescript
- * const encrypted = encryptObject({ apiKey: 'secret' }, 'password');
- * ```
- */
-export function encryptObject(data, password) {
-    const json = JSON.stringify(data);
-    return encrypt(json, password);
-}
-/**
- * Decrypts data and parses it as JSON.
- *
- * @param encryptedData - The encrypted data from encryptObject()
- * @param password - The decryption password
- * @returns The decrypted and parsed object
- *
- * @example
- * ```typescript
- * const data = decryptObject<{ apiKey: string }>(encrypted, 'password');
- * console.log(data.apiKey);
- * ```
- */
-export function decryptObject(encryptedData, password) {
-    const json = decrypt(encryptedData, password);
-    return JSON.parse(json);
-}
-/**
- * Generates a checksum for data integrity verification.
- *
- * @param data - The data to checksum
- * @returns Short hash suitable for display (first 8 characters of SHA-256)
- *
- * @example
- * ```typescript
- * const checksum = generateChecksum(fileContents);
- * // Returns: '3a7bd3e2' (8 characters)
- * ```
- */
-export function generateChecksum(data) {
-    return hash(data).substring(0, 8);
-}
-/**
- * Verifies a checksum against data.
- *
- * @param data - The data to verify
- * @param checksum - The expected checksum
- * @returns True if the checksum matches
- */
-export function verifyChecksum(data, checksum) {
-    return generateChecksum(data) === checksum;
-}
-// =============================================================================
-// Fernet-Compatible Decryption (for compatibility with Python's cryptography.fernet)
-// =============================================================================
-/**
- * Fixed salt used for key derivation in Fernet encryption
- * Must match the salt used in the Python CliAuth implementation
- */
-const FERNET_SALT = Buffer.from('b-f2T&>)XPx2vI/I9N7CfYH@Dvdb<F', 'utf-8');
-/**
- * Derives a Fernet-compatible encryption key from a password.
- *
- * This implementation matches Python's cryptography.fernet key derivation:
- * - Uses PBKDF2HMAC with SHA256
- * - 100,000 iterations
- * - Fixed salt for consistency with backend
- * - Returns base64 URL-safe encoded key (Fernet format requirement)
- *
- * @param password - The password to derive the key from
- * @returns Base64 URL-safe encoded key for Fernet decryption
- */
-function deriveFernetKey(password) {
-    // Derive 32-byte key using PBKDF2
-    const derivedKey = crypto.pbkdf2Sync(password, FERNET_SALT, 100000, // iterations
-    32, // key length
-    'sha256');
-    // Fernet requires the key to be base64 URL-safe encoded
-    return Buffer.from(derivedKey.toString('base64url'), 'utf-8');
-}
-/**
- * Decrypts data encrypted with Python's cryptography.fernet.Fernet.
- *
- * Fernet format:
- * - Version (1 byte): 0x80
- * - Timestamp (8 bytes): big-endian timestamp
- * - IV (16 bytes): initialization vector for AES-128-CBC
- * - Ciphertext (variable): encrypted data
- * - HMAC (32 bytes): HMAC-SHA256 for authentication
- *
- * @param encryptedData - Base64 URL-safe encoded Fernet token
- * @param password - Password used for key derivation
- * @returns Decrypted plaintext string
- * @throws Error if decryption fails (wrong password, corrupted data, or invalid format)
- *
- * @example
- * ```typescript
- * // Decrypt data encrypted by Python's CliAuth.encrypt()
- * const decrypted = decryptFernet(encryptedToken, 'anthropic');
- * ```
- */
-export function decryptFernet(encryptedData, password) {
-    try {
-        // Step 1: Derive the Fernet key from password
-        const fernetKeyBuffer = deriveFernetKey(password);
-        // Step 2: Decode the Fernet key (it was base64url encoded)
-        const actualKey = Buffer.from(fernetKeyBuffer.toString('utf-8'), 'base64url');
-        // Step 3: Decode the encrypted data from base64url (TWICE - Python does double encoding)
-        // First decode: Remove the outer base64url encoding added by Python's CliAuth.encrypt()
-        const outerDecoded = Buffer.from(encryptedData, 'base64url');
-        // Second decode: The outer decode gives us ASCII text that is the Fernet token
-        // Convert those bytes to a string, then decode that string from base64url
-        const fernetTokenString = outerDecoded.toString('utf-8');
-        const tokenBuffer = Buffer.from(fernetTokenString, 'base64url');
-        // Step 4: Parse Fernet token structure
-        // Minimum length: version(1) + timestamp(8) + iv(16) + hmac(32) = 57 bytes
-        if (tokenBuffer.length < 57) {
-            throw new Error(`Invalid Fernet token: too short (${tokenBuffer.length} bytes, need at least 57)`);
-        }
-        const version = tokenBuffer[0];
-        if (version !== 0x80) {
-            throw new Error(`Invalid Fernet version: 0x${version.toString(16)} (expected 0x80)`);
-        }
-        const iv = tokenBuffer.subarray(9, 25);
-        const ciphertext = tokenBuffer.subarray(25, tokenBuffer.length - 32);
-        const providedHmac = tokenBuffer.subarray(tokenBuffer.length - 32);
-        // Step 5: Verify HMAC (authentication)
-        // HMAC is computed over: version + timestamp + iv + ciphertext
-        // Fernet key structure: first 16 bytes = signing key (HMAC), last 16 bytes = encryption key (AES)
-        const signingKey = actualKey.subarray(0, 16);
-        const encryptionKey = actualKey.subarray(16, 32);
-        const dataToVerify = tokenBuffer.subarray(0, tokenBuffer.length - 32);
-        const computedHmac = crypto
-            .createHmac('sha256', signingKey)
-            .update(dataToVerify)
-            .digest();
-        if (!crypto.timingSafeEqual(providedHmac, computedHmac)) {
-            throw new Error('Invalid Fernet token: HMAC verification failed');
-        }
-        // Step 6: Decrypt using AES-128-CBC
-        // Use the encryption key (last 16 bytes) - already extracted in Step 5
-        const decipher = crypto.createDecipheriv('aes-128-cbc', encryptionKey, iv);
-        // Enable automatic padding handling (Fernet uses PKCS7)
-        decipher.setAutoPadding(true);
-        let decrypted = decipher.update(ciphertext);
-        decrypted = Buffer.concat([decrypted, decipher.final()]);
-        return decrypted.toString('utf-8');
-    }
-    catch (error) {
-        if (error instanceof Error) {
-            throw new Error(`Failed to decrypt Fernet token: ${error.message}`);
-        }
-        throw new Error('Failed to decrypt Fernet token: Unknown error');
-    }
-}
-//# sourceMappingURL=crypto.js.map

package/dist/utils/crypto.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;GAEG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC;;GAEG;AACH,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB;;GAEG;AACH,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB;;GAEG;AACH,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;GAEG;AACH,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;;GAGG;AACH,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B;;GAEG;AACH,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEhC,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAAC,QAAgB,EAAE,IAAY;IAC/C,OAAO,MAAM,CAAC,UAAU,CACtB,QAAQ,EACR,IAAI,EACJ,UAAU,EACV,UAAU,EACV,cAAc,CACf,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,QAAgB;IACzD,0CAA0C;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAE7C,wCAAwC;IACxC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAEzC,sCAAsC;IACtC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEtC,iCAAiC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAEzD,wBAAwB;IACxB,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACxD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAEjC,6BAA6B;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEhC,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI;QACJ,EAAE;QACF,GAAG;QACH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC;KAC9B,CAAC,CAAC;IAEH,oCAAoC;IACpC,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,OAAO,CAAC,aAAqB,EAAE,QAAgB;IAC7D,qBAAqB;IACrB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAEtD,0BAA0B;IAC1B,MAAM,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,CAAC,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,qBAAqB;IACrB,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAC3B,WAAW,GAAG,SAAS,EACvB,WAAW,GAAG,SAAS,GAAG,UAAU,CACrC,CAAC;IACF,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;IAE1E,+CAA+C;IAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEtC,kBAAkB;IAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAE7D,8CAA8C;IAC9C,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAEzB,mBAAmB;IACnB,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1E,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEpC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE;IACtD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,IAAI,CAAC,KAAa;IAChC,OAAO,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,SAAiB;IAChE,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,gFAAgF;AAChF,OAAO;AACP,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,IAAI,CAAC,IAAY,EAAE,MAAc;IAC/C,OAAO,MAAM;SACV,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC;SAClC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,MAAc,EACd,SAAiB;IAEjB,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa;IAC3B,8DAA8D;IAC9D,MAAM,UAAU,GAAG;QACjB,EAAE,CAAC,QAAQ,EAAE;QACb,EAAE,CAAC,QAAQ,EAAE;QACb,EAAE,CAAC,IAAI,EAAE;QACT,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ;QACtB,EAAE,CAAC,OAAO,EAAE;KACb,CAAC;IAEF,2CAA2C;IAC3C,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,oEAAoE;IACpE,sCAAsC;IACtC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,mDAAmD;QACnD,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,CAAS,EAAE,CAAS;IACvD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE;IAC/C,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,IAAY,EACZ,UAAkB;IAElB,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,OAAO,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,IAAa,EAAE,QAAgB;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAI,aAAqB,EAAE,QAAgB;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,QAAgB;IAC3D,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC;AAC7C,CAAC;AAED,gFAAgF;AAChF,qFAAqF;AACrF,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,OAAO,CAAC,CAAC;AAE3E;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,kCAAkC;IAClC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAClC,QAAQ,EACR,WAAW,EACX,MAAM,EAAE,aAAa;IACrB,EAAE,EAAE,aAAa;IACjB,QAAQ,CACT,CAAC;IAEF,wDAAwD;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,aAAa,CAAC,aAAqB,EAAE,QAAgB;IACnE,IAAI,CAAC;QACH,8CAA8C;QAC9C,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAElD,2DAA2D;QAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC;QAE9E,yFAAyF;QACzF,wFAAwF;QACxF,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAE7D,+EAA+E;QAC/E,0EAA0E;QAC1E,MAAM,iBAAiB,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;QAEhE,uCAAuC;QACvC,2EAA2E;QAC3E,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,oCAAoC,WAAW,CAAC,MAAM,2BAA2B,CAAC,CAAC;QACrG,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QACrE,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAEnE,uCAAuC;QACvC,+DAA+D;QAC/D,kGAAkG;QAClG,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAEjD,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QACtE,MAAM,YAAY,GAAG,MAAM;aACxB,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;aAChC,MAAM,CAAC,YAAY,CAAC;aACpB,MAAM,EAAE,CAAC;QAEZ,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QAED,oCAAoC;QACpC,uEAAuE;QACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAE3E,wDAAwD;QACxD,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE9B,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5C,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAEzD,OAAO,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}