@cybedefend/vibedefend 1.4.7 → 1.6.0

package/dist/mcp/auth/secrets.js

@@ -0,0 +1,446 @@
+/**
+ * Where a third-party MCP token is kept, per platform.
+ *
+ * One interface, four implementations, in decreasing order of protection:
+ *
+ *  - macOS: the system keychain, through `security`, in a service of its own.
+ *  - Linux: the session secret service, through `secret-tool` (libsecret).
+ *  - Windows: DPAPI, through PowerShell's `ConvertFrom-SecureString`. The
+ *    plan says "Credential Manager"; DPAPI is the primitive Credential
+ *    Manager itself is built on, and it is the only one reachable without a
+ *    native dependency — `cmdkey` can write a credential but cannot read its
+ *    password back, which makes it useless to us. The ciphertext is bound to
+ *    the user and the machine, and lands in the same file as the fallback.
+ *  - Anywhere else, or when the above is unavailable: `tokens.enc`, AES-256-GCM
+ *    under a key derived from a machine secret and a per-install salt.
+ *
+ * The last one is obfuscation, not protection, and says so out loud: anything
+ * running as this user can derive the same key. It exists so that a laptop
+ * without a session keyring keeps working, and it is announced every time it
+ * is used, as the plan requires.
+ *
+ * No token is ever logged, interpolated into an error message, or passed as a
+ * command-line argument — except on macOS, where `security` takes the value
+ * in `argv`. That one is inherited from the legacy implementation and noted
+ * in the Phase 2 summary.
+ */
+import { execFileSync } from 'node:child_process';
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync, timingSafeEqual, } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { hostname, homedir, userInfo } from 'node:os';
+import { join } from 'node:path';
+import { mcpHomeDir, PROXY_ENV_PREFIX } from '../proxy/paths.js';
+/**
+ * Keychain service dedicated to third-party MCP credentials.
+ *
+ * Deliberately not `"Codex MCP Credentials"`, where `src/auth/auth-store.ts`
+ * keeps the CybeDefend entries: a loose lookup of that service falling back
+ * to "the first entry found" could surface a Linear token as the CybeDefend
+ * one, which would then leave as `Authorization: Bearer` towards our own API.
+ * A separate service closes that structurally.
+ */
+export const MCP_KEYCHAIN_SERVICE = 'CybeDefend MCP Server Credentials';
+const COMMAND_TIMEOUT_MS = 5000;
+function defaultExecFile(file, args, input) {
+    return execFileSync(file, args, {
+        encoding: 'utf8',
+        stdio: input === undefined ? ['ignore', 'pipe', 'ignore'] : ['pipe', 'pipe', 'ignore'],
+        input,
+        timeout: COMMAND_TIMEOUT_MS,
+        windowsHide: true,
+    }).trim();
+}
+function defaultAnnounce(detail) {
+    try {
+        process.stderr.write(`vibedefend: ${detail}\n`);
+    }
+    catch {
+        /* a message must never take the CLI down */
+    }
+}
+// ─── macOS ──────────────────────────────────────────────────────────────────
+class MacosKeychain {
+    exec;
+    kind = 'macos-keychain';
+    constructor(exec) {
+        this.exec = exec;
+    }
+    get(key) {
+        try {
+            const blob = this.exec('security', [
+                'find-generic-password',
+                '-s',
+                MCP_KEYCHAIN_SERVICE,
+                '-a',
+                key,
+                '-w',
+            ]);
+            return blob.trim() === '' ? null : blob.trim();
+        }
+        catch {
+            return null;
+        }
+    }
+    set(key, value) {
+        this.exec('security', [
+            'add-generic-password',
+            '-U',
+            '-s',
+            MCP_KEYCHAIN_SERVICE,
+            '-a',
+            key,
+            '-w',
+            value,
+        ]);
+    }
+    delete(key) {
+        try {
+            this.exec('security', ['delete-generic-password', '-s', MCP_KEYCHAIN_SERVICE, '-a', key]);
+        }
+        catch {
+            /* absent, or the keychain is locked */
+        }
+    }
+}
+// ─── Linux ──────────────────────────────────────────────────────────────────
+class LinuxSecretService {
+    exec;
+    kind = 'linux-secret-service';
+    constructor(exec) {
+        this.exec = exec;
+    }
+    get(key) {
+        try {
+            const blob = this.exec('secret-tool', [
+                'lookup',
+                'service',
+                MCP_KEYCHAIN_SERVICE,
+                'account',
+                key,
+            ]);
+            return blob.trim() === '' ? null : blob.trim();
+        }
+        catch {
+            return null;
+        }
+    }
+    set(key, value) {
+        // The value goes in on stdin: `secret-tool store` reads it there
+        // precisely so it never appears in `/proc/<pid>/cmdline`.
+        this.exec('secret-tool', ['store', '--label', MCP_KEYCHAIN_SERVICE, 'service', MCP_KEYCHAIN_SERVICE, 'account', key], value);
+    }
+    delete(key) {
+        try {
+            this.exec('secret-tool', ['clear', 'service', MCP_KEYCHAIN_SERVICE, 'account', key]);
+        }
+        catch {
+            /* absent, or no session keyring */
+        }
+    }
+}
+// ─── Windows ────────────────────────────────────────────────────────────────
+/**
+ * DPAPI, driven by PowerShell, with the ciphertext kept in `tokens.enc`.
+ *
+ * `ConvertFrom-SecureString` (no `-Key`) encrypts under the current user's
+ * DPAPI master key: the result is useless to another user and on another
+ * machine. Both directions read their input from stdin, never from `argv`,
+ * because a command line is visible to anything that can list processes.
+ */
+class WindowsDpapi {
+    exec;
+    file;
+    kind = 'windows-dpapi';
+    constructor(exec, file) {
+        this.exec = exec;
+        this.file = file;
+    }
+    powershell(script, input) {
+        return this.exec('powershell.exe', ['-NoProfile', '-NonInteractive', '-NoLogo', '-Command', script], input);
+    }
+    get(key) {
+        const stored = this.file.readRaw(key);
+        if (!stored)
+            return null;
+        try {
+            const plain = this.powershell('$e = [Console]::In.ReadToEnd().Trim(); ' +
+                '$s = ConvertTo-SecureString -String $e; ' +
+                '[Runtime.InteropServices.Marshal]::PtrToStringBSTR(' +
+                '[Runtime.InteropServices.Marshal]::SecureStringToBSTR($s))', stored);
+            return plain.trim() === '' ? null : plain;
+        }
+        catch {
+            return null;
+        }
+    }
+    set(key, value) {
+        const encrypted = this.powershell('$p = [Console]::In.ReadToEnd(); ' +
+            '$s = ConvertTo-SecureString -String $p -AsPlainText -Force; ' +
+            'ConvertFrom-SecureString -SecureString $s', value);
+        if (encrypted.trim() === '')
+            throw new Error('DPAPI returned an empty ciphertext');
+        this.file.writeRaw(key, encrypted.trim());
+    }
+    delete(key) {
+        this.file.writeRaw(key, null);
+    }
+}
+/**
+ * `tokens.enc`: AES-256-GCM, key derived with scrypt from a machine secret
+ * and a per-install salt.
+ *
+ * What this is: enough that a token is not readable in a backup, in a synced
+ * folder, or by a tool grepping dotfiles for `Bearer`. What it is not: a
+ * defence against code running as this user, which can derive the same key.
+ * Callers announce it; see `selectSecretBackend`.
+ */
+export class EncryptedFileStore {
+    path;
+    machineSecretFn;
+    readFileFn;
+    writeFileFn;
+    kind = 'encrypted-file';
+    /**
+     * Keyed by salt, not by nothing.
+     *
+     * The salt is created with the envelope and never changes afterwards, but
+     * caching a key without remembering which salt produced it is how the first
+     * version of this class wrote a file it could not read back: `encrypt` read
+     * the envelope to get a salt, then `writeRaw` read it AGAIN — and a missing
+     * file yields a FRESH random salt every time — so the ciphertext went to
+     * disk under one key while the envelope recorded another. Everything worked
+     * inside the writing process, where the key was cached, and nothing worked
+     * in the next one.
+     */
+    keys = new Map();
+    constructor(path, machineSecretFn, readFileFn, writeFileFn) {
+        this.path = path;
+        this.machineSecretFn = machineSecretFn;
+        this.readFileFn = readFileFn;
+        this.writeFileFn = writeFileFn;
+    }
+    get(key) {
+        const envelope = this.load();
+        const raw = envelope.entries[key];
+        if (!raw)
+            return null;
+        try {
+            return this.decrypt(envelope.salt, raw);
+        }
+        catch {
+            // A ciphertext that no longer opens — the machine secret changed, or
+            // the file was tampered with — behaves like an absent credential.
+            return null;
+        }
+    }
+    set(key, value) {
+        const envelope = this.load();
+        envelope.entries[key] = this.encrypt(envelope.salt, value);
+        this.persist(envelope);
+    }
+    delete(key) {
+        const envelope = this.load();
+        delete envelope.entries[key];
+        this.persist(envelope);
+    }
+    /** Reads one entry without decrypting it. Used by the DPAPI backend. */
+    readRaw(key) {
+        return this.load().entries[key] ?? null;
+    }
+    /** Writes one entry as it is, or removes it when `value` is `null`. */
+    writeRaw(key, value) {
+        const envelope = this.load();
+        if (value === null)
+            delete envelope.entries[key];
+        else
+            envelope.entries[key] = value;
+        this.persist(envelope);
+    }
+    load() {
+        try {
+            const parsed = JSON.parse(this.readFileFn(this.path));
+            if (parsed && parsed.v === 1 && typeof parsed.salt === 'string' && parsed.entries) {
+                return { v: 1, salt: parsed.salt, entries: { ...parsed.entries } };
+            }
+        }
+        catch {
+            /* absent or unreadable: start a new envelope */
+        }
+        return { v: 1, salt: randomBytes(16).toString('base64'), entries: {} };
+    }
+    persist(envelope) {
+        this.writeFileFn(this.path, JSON.stringify(envelope, null, 2));
+    }
+    /** scrypt costs about 50 ms, and a session asks for the key more than once. */
+    keyFor(salt) {
+        const known = this.keys.get(salt);
+        if (known)
+            return known;
+        const derived = scryptSync(this.machineSecretFn(), Buffer.from(salt, 'base64'), 32);
+        this.keys.set(salt, derived);
+        return derived;
+    }
+    encrypt(salt, plain) {
+        const iv = randomBytes(12);
+        const cipher = createCipheriv('aes-256-gcm', this.keyFor(salt), iv, { authTagLength: 16 });
+        const body = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
+        return [
+            iv.toString('base64'),
+            cipher.getAuthTag().toString('base64'),
+            body.toString('base64'),
+        ].join('.');
+    }
+    decrypt(salt, blob) {
+        const [ivPart, tagPart, bodyPart] = blob.split('.');
+        if (!ivPart || !tagPart || !bodyPart)
+            throw new Error('malformed ciphertext');
+        const decipher = createDecipheriv('aes-256-gcm', this.keyFor(salt), Buffer.from(ivPart, 'base64'), { authTagLength: 16 });
+        decipher.setAuthTag(Buffer.from(tagPart, 'base64'));
+        return Buffer.concat([
+            decipher.update(Buffer.from(bodyPart, 'base64')),
+            decipher.final(),
+        ]).toString('utf8');
+    }
+}
+export function tokensFile(dir) {
+    return join(dir ?? mcpHomeDir(), 'tokens.enc');
+}
+function defaultReadFile(path) {
+    if (!existsSync(path))
+        throw new Error('ENOENT: no such file');
+    return readFileSync(path, 'utf8');
+}
+function defaultWriteFile(path, content) {
+    // The mode is set AT CREATION, as in `auth-store.ts`: a `chmod` afterwards
+    // leaves the file readable for the length of a syscall, and on a shared
+    // machine that window is enough.
+    mkdirSync(join(path, '..'), { recursive: true, mode: 0o700 });
+    writeFileSync(path, content, { encoding: 'utf8', mode: 0o600 });
+    chmodSync(path, 0o600);
+}
+/**
+ * Something stable for this machine and this user, and cheap to read.
+ *
+ * Not a secret in the cryptographic sense — a machine id is readable by any
+ * local process — which is exactly why the file it keys is called a fallback.
+ */
+export function machineSecret(platform = process.platform) {
+    const parts = [userInfo().username, homedir()];
+    try {
+        if (platform === 'linux') {
+            for (const candidate of ['/etc/machine-id', '/var/lib/dbus/machine-id']) {
+                if (existsSync(candidate)) {
+                    parts.push(readFileSync(candidate, 'utf8').trim());
+                    break;
+                }
+            }
+        }
+        else if (platform === 'darwin') {
+            const out = execFileSync('ioreg', ['-rd1', '-c', 'IOPlatformExpertDevice'], {
+                encoding: 'utf8',
+                timeout: COMMAND_TIMEOUT_MS,
+                stdio: ['ignore', 'pipe', 'ignore'],
+            });
+            const match = /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(out);
+            if (match)
+                parts.push(match[1]);
+        }
+        else if (platform === 'win32') {
+            const out = execFileSync('reg', ['query', 'HKLM\\SOFTWARE\\Microsoft\\Cryptography', '/v', 'MachineGuid'], { encoding: 'utf8', timeout: COMMAND_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'ignore'] });
+            const match = /MachineGuid\s+REG_SZ\s+(\S+)/.exec(out);
+            if (match)
+                parts.push(match[1]);
+        }
+    }
+    catch {
+        /* no machine id available: the hostname below still varies per machine */
+    }
+    parts.push(hostname());
+    return parts.join('|');
+}
+/**
+ * Picks the backend for this platform, and falls back to the encrypted file
+ * when it is not usable — an SSH session with no keyring, a locked keychain,
+ * a machine without `secret-tool`.
+ *
+ * The probe is a real round trip on a throwaway key rather than a version
+ * check: `secret-tool --version` succeeds on a machine whose D-Bus session
+ * has no secret service at all, which is exactly the case that has to
+ * degrade.
+ */
+export function selectSecretBackend(deps = {}) {
+    const exec = deps.execFileFn ?? defaultExecFile;
+    const platform = deps.platform ?? process.platform;
+    // `VIBEDEFEND_MCP_SECRET_BACKEND=file` skips the platform store entirely.
+    // The test suite needs it — a suite that wrote into the developer's keychain
+    // would be exactly the damage the plan forbids for `~/.cybedefend/` — and it
+    // is the honest answer for a headless box whose keyring prompt nobody will
+    // ever see.
+    const forced = (deps.env ?? process.env)[`${PROXY_ENV_PREFIX}SECRET_BACKEND`];
+    const file = new EncryptedFileStore(
+    // `dir` wins, then whatever `VIBEDEFEND_MCP_DIR` says in the environment
+    // this call was handed. A command that scopes its own environment — every
+    // test does — must not have its credential file fall back to the real one.
+    tokensFile(deps.dir ?? mcpHomeDir(deps.env ?? process.env)), deps.machineSecretFn ?? (() => machineSecret(platform)), deps.readFileFn ?? defaultReadFile, deps.writeFileFn ?? defaultWriteFile);
+    const announce = deps.onFallback ?? defaultAnnounce;
+    if (forced === 'file')
+        return { backend: file, degraded: false };
+    const platformBackend = platform === 'darwin'
+        ? new MacosKeychain(exec)
+        : platform === 'linux'
+            ? new LinuxSecretService(exec)
+            : platform === 'win32'
+                ? new WindowsDpapi(exec, file)
+                : null;
+    if (!platformBackend) {
+        announce(`no OS credential store on ${platform} — MCP tokens are kept in ${tokensFile(deps.dir)}, ` +
+            'encrypted under a key derived from this machine; anything running as you can read them');
+        return { backend: file, degraded: true };
+    }
+    const failure = probe(platformBackend);
+    if (!failure)
+        return { backend: platformBackend, degraded: false };
+    announce(`${platformBackend.kind} is unavailable (${failure}) — MCP tokens are kept in ${tokensFile(deps.dir)}, encrypted under a key derived from this machine; anything running as you can read them`);
+    return { backend: file, degraded: true };
+}
+/** The probe key. Written, read back, removed; never a real credential. */
+const PROBE_KEY = 'vibedefend-availability-probe';
+function probe(backend) {
+    const expected = randomBytes(16).toString('base64');
+    try {
+        backend.set(PROBE_KEY, expected);
+        const seen = backend.get(PROBE_KEY);
+        backend.delete(PROBE_KEY);
+        if (seen === null)
+            return 'the store accepted a write but returned nothing';
+        const a = Buffer.from(seen);
+        const b = Buffer.from(expected);
+        if (a.length !== b.length || !timingSafeEqual(a, b)) {
+            return 'the store returned a different value than the one written';
+        }
+        return null;
+    }
+    catch (error) {
+        try {
+            backend.delete(PROBE_KEY);
+        }
+        catch {
+            /* nothing to clean up */
+        }
+        // The diagnostic goes to stderr, so it must not carry the value the store
+        // was handed. Here that value is only the probe's, but the same code path
+        // is what a real credential travels through, and a store that echoes its
+        // input into an error message is common enough (`secret-tool` does).
+        const detail = error instanceof Error ? firstLine(error.message) : 'unknown failure';
+        return redact(detail, expected);
+    }
+}
+/** Removes a known secret from a message that is about to be printed. */
+function redact(message, secret) {
+    return secret === '' ? message : message.split(secret).join('<redacted>');
+}
+function firstLine(message) {
+    const line = message.split('\n')[0]?.trim() ?? '';
+    return line.length > 160 ? `${line.slice(0, 160)}…` : line;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/mcp/auth/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../src/mcp/auth/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,mCAAmC,CAAC;AAExE,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAgChC,SAAS,eAAe,CAAC,IAAY,EAAE,IAAc,EAAE,KAAc;IACnE,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE;QAC9B,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;QACtF,KAAK;QACL,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,IAAI,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,MAAM,aAAa;IAGY;IAFpB,IAAI,GAAG,gBAAyB,CAAC;IAE1C,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,GAAG,CAAC,GAAW;QACb,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;gBACjC,uBAAuB;gBACvB,IAAI;gBACJ,oBAAoB;gBACpB,IAAI;gBACJ,GAAG;gBACH,IAAI;aACL,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAa;QAC5B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;YACpB,sBAAsB;YACtB,IAAI;YACJ,IAAI;YACJ,oBAAoB;YACpB,IAAI;YACJ,GAAG;YACH,IAAI;YACJ,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAE/E,MAAM,kBAAkB;IAGO;IAFpB,IAAI,GAAG,sBAA+B,CAAC;IAEhD,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,GAAG,CAAC,GAAW;QACb,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE;gBACpC,QAAQ;gBACR,SAAS;gBACT,oBAAoB;gBACpB,SAAS;gBACT,GAAG;aACJ,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAa;QAC5B,iEAAiE;QACjE,0DAA0D;QAC1D,IAAI,CAAC,IAAI,CACP,aAAa,EACb,CAAC,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,SAAS,EAAE,oBAAoB,EAAE,SAAS,EAAE,GAAG,CAAC,EAC3F,KAAK,CACN,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,YAAY;IAIG;IACA;IAJV,IAAI,GAAG,eAAwB,CAAC;IAEzC,YACmB,IAAgB,EAChB,IAAwB;QADxB,SAAI,GAAJ,IAAI,CAAY;QAChB,SAAI,GAAJ,IAAI,CAAoB;IACxC,CAAC;IAEI,UAAU,CAAC,MAAc,EAAE,KAAa;QAC9C,OAAO,IAAI,CAAC,IAAI,CACd,gBAAgB,EAChB,CAAC,YAAY,EAAE,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,EAChE,KAAK,CACN,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,GAAW;QACb,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAC3B,yCAAyC;gBACvC,0CAA0C;gBAC1C,qDAAqD;gBACrD,4DAA4D,EAC9D,MAAM,CACP,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAa;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAC/B,kCAAkC;YAChC,8DAA8D;YAC9D,2CAA2C,EAC7C,KAAK,CACN,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;CACF;AAWD;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IAkBV;IACA;IACA;IACA;IApBV,IAAI,GAAG,gBAAyB,CAAC;IAE1C;;;;;;;;;;;OAWG;IACK,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEzC,YACmB,IAAY,EACZ,eAA6B,EAC7B,UAAoC,EACpC,WAAoD;QAHpD,SAAI,GAAJ,IAAI,CAAQ;QACZ,oBAAe,GAAf,eAAe,CAAc;QAC7B,eAAU,GAAV,UAAU,CAA0B;QACpC,gBAAW,GAAX,WAAW,CAAyC;IACpE,CAAC;IAEJ,GAAG,CAAC,GAAW;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,kEAAkE;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAa;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAED,wEAAwE;IACxE,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IAC1C,CAAC;IAED,uEAAuE;IACvE,QAAQ,CAAC,GAAW,EAAE,KAAoB;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;;YAC5C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAEO,IAAI;QACV,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAA+B,CAAC;YACpF,IAAI,MAAM,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClF,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACrE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzE,CAAC;IAEO,OAAO,CAAC,QAA2B;QACzC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,+EAA+E;IACvE,MAAM,CAAC,IAAY;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,OAAO,CAAC,IAAY,EAAE,KAAa;QACzC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3E,OAAO;YACL,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACrB,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACxB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAEO,OAAO,CAAC,IAAY,EAAE,IAAY;QACxC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EACjB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAC7B,EAAE,aAAa,EAAE,EAAE,EAAE,CACtB,CAAC;QACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAChD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,OAAO,IAAI,CAAC,GAAG,IAAI,UAAU,EAAE,EAAE,YAAY,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC/D,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe;IACrD,2EAA2E;IAC3E,wEAAwE;IACxE,iCAAiC;IACjC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,WAA4B,OAAO,CAAC,QAAQ;IACxE,MAAM,KAAK,GAAa,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,KAAK,MAAM,SAAS,IAAI,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,EAAE,CAAC;gBACxE,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC1B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;oBACnD,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,CAAC,EAAE;gBAC1E,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,kBAAkB;gBAC3B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;aACpC,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3D,IAAI,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;aAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,YAAY,CACtB,KAAK,EACL,CAAC,OAAO,EAAE,yCAAyC,EAAE,IAAI,EAAE,aAAa,CAAC,EACzE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CACvF,CAAC;YACF,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAUD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA0B,EAAE;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,eAAe,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,YAAY;IACZ,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,gBAAgB,gBAAgB,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,kBAAkB;IACjC,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,EAC3D,IAAI,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,EACvD,IAAI,CAAC,UAAU,IAAI,eAAe,EAClC,IAAI,CAAC,WAAW,IAAI,gBAAgB,CACrC,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,eAAe,CAAC;IAEpD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAEjE,MAAM,eAAe,GACnB,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC;QACzB,CAAC,CAAC,QAAQ,KAAK,OAAO;YACpB,CAAC,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC;YAC9B,CAAC,CAAC,QAAQ,KAAK,OAAO;gBACpB,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC;gBAC9B,CAAC,CAAC,IAAI,CAAC;IAEf,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,QAAQ,CACN,6BAA6B,QAAQ,6BAA6B,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;YACxF,wFAAwF,CAC3F,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAEnE,QAAQ,CACN,GAAG,eAAe,CAAC,IAAI,oBAAoB,OAAO,8BAA8B,UAAU,CACxF,IAAI,CAAC,GAAG,CACT,0FAA0F,CAC5F,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,2EAA2E;AAC3E,MAAM,SAAS,GAAG,+BAA+B,CAAC;AAElD,SAAS,KAAK,CAAC,OAAsB;IACnC,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,iDAAiD,CAAC;QAC5E,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,2DAA2D,CAAC;QACrE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACrF,OAAO,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,MAAM,CAAC,OAAe,EAAE,MAAc;IAC7C,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClD,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC"}