@daski/pay 0.3.0 → 0.4.0

package/dist/store/keystore.js

@@ -1,26 +1,57 @@
 /**
  * §5 — key storage.
  *
- * Order of preference: the OS keychain, then an scrypt+AES-GCM file guarded by
- * a passphrase, then — for sandbox development only — an environment variable.
- * Sandbox and mainnet never share a keychain entry or a file slot, so a
- * profile mix-up cannot reach a mainnet key.
+ * A local key is written only to a store whose persistence is known by
+ * construction: the macOS keychain or Windows Credential Manager (backend
+ * `keychain`), or the scrypt+AES-GCM file guarded by a passphrase (backend
+ * `file`). On Linux the keyring wrapper is never loaded: without a Secret
+ * Service it silently fell back to the kernel session keyring and a key was
+ * lost with the session, so `keychain` is refused there and the file backend
+ * is named instead. For sandbox development only, `DASKI_PAYER_PRIVATE_KEY`
+ * supplies a key from the environment.
+ *
+ * The file store distinguishes a missing file (an empty store) from one it
+ * cannot read, parse, or trust (`DASKI_KEYSTORE_UNREADABLE`), and it refuses
+ * to create or use a key on the latter. Every update holds an exclusive lock
+ * file, writes a temporary file beside the target with owner-only mode,
+ * flushes it, atomically renames it over the target, flushes the directory,
+ * then reads the file back and decrypts the new entry to the expected address
+ * before reporting success.
  *
- * Nothing in this file logs, prints, or returns key material except to the
- * single caller that is about to construct a signer.
+ * Sandbox and mainnet never share a keychain entry or a file slot, so a
+ * profile mix-up cannot reach a mainnet key. Nothing in this file logs,
+ * prints, or returns key material except to the single caller that is about
+ * to construct a signer.
  */
-import { createCipheriv, createDecipheriv, randomBytes, scrypt as scryptCallback } from "node:crypto";
-import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
+import { createCipheriv, createDecipheriv, randomBytes, scrypt as scryptCallback, } from "node:crypto";
+import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeSync, } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
 import { promisify } from "node:util";
+import { privateKeyToAccount } from "viem/accounts";
+import { getAddress } from "viem";
 import { CliError } from "../cli/errors.js";
-import { readPassphrase } from "../cli/prompt.js";
+import { isInteractive, readPassphrase } from "../cli/prompt.js";
+import { HOSTED_BACKENDS, } from "../host.js";
 import { keystorePath } from "../paths.js";
+import { withFileLock } from "./lock.js";
 const scrypt = promisify(scryptCallback);
 const SERVICE = "io.daski.pay";
 const DOC = "https://github.com/daski-io/buyer/blob/main/docs/keys.md";
 /** Interactive-grade scrypt parameters. */
 const SCRYPT = { N: 1 << 17, r: 8, p: 1 };
+/**
+ * The largest parameters an entry may ask for on decryption: twice the
+ * interactive cost. scrypt needs 128·N·r bytes, and Node's default 32 MiB
+ * ceiling is below even the interactive cost, so the ceiling is derived from
+ * the parameters instead of trusted to a default; a file that asks for more
+ * is malformed, not a reason to allocate gigabytes.
+ */
+const SCRYPT_MAX = { N: 1 << 18, r: 8, p: 2 };
+const scryptMemory = (N, r) => 2 * 128 * N * r;
+const MIN_PASSPHRASE_LENGTH = 8;
+/** How long a store update waits for another live process's lock before giving up. */
+const LOCK_WAIT_MS = 30_000;
 /** Keychain and file entries are namespaced by profile, never shared. */
 function accountFor(profile) {
     return `payer:${profile}`;
@@ -35,8 +66,8 @@ function environmentKey(profile) {
             code: "DASKI_ENV_KEY_REFUSED_OFF_SANDBOX",
             message: `DASKI_PAYER_PRIVATE_KEY is set, but the active profile is "${profile}". ` +
                 "The environment-variable signer is sandbox-only.",
-            remediation: `Unset DASKI_PAYER_PRIVATE_KEY, and store the ${profile} key in the OS ` +
-                `keychain instead: run \`daski wallet create --profile ${profile}\`. See ${DOC}`,
+            remediation: `Unset DASKI_PAYER_PRIVATE_KEY, and store the ${profile} key in a durable ` +
+                `backend instead: run \`daski wallet create --profile ${profile}\`. See ${DOC}`,
         });
     }
     if (!/^0x[0-9a-fA-F]{64}$/.test(raw)) {
@@ -48,43 +79,170 @@ function environmentKey(profile) {
     }
     return raw;
 }
+const ENVIRONMENT_LOCATION = {
+    source: "environment",
+    description: "DASKI_PAYER_PRIVATE_KEY (developer/sandbox only)",
+    durability: "environment",
+};
+function keychainLocation(profile) {
+    return {
+        source: "keychain",
+        description: `OS keychain (${SERVICE}/${accountFor(profile)})`,
+        durability: "persistent",
+    };
+}
+function fileLocation() {
+    return {
+        source: "encrypted-file",
+        description: `${keystorePath()} (scrypt + AES-256-GCM)`,
+        durability: "encrypted-file",
+    };
+}
+export function keychainUnsupportedOnLinux(profile) {
+    return new CliError({
+        code: "DASKI_KEYCHAIN_UNSUPPORTED_ON_LINUX",
+        message: "The OS keychain backend is not used on Linux: without a Secret Service the keyring " +
+            "wrapper falls back to the kernel session keyring, which does not survive the session.",
+        remediation: `Use the encrypted file backend: DASKI_KEY_BACKEND=file daski wallet create --profile ${profile}. ` +
+            `Without a terminal, also set DASKI_KEYSTORE_PASSPHRASE_FILE. See ${DOC}`,
+    });
+}
 /**
- * Loads `@napi-rs/keyring` if the platform has it. It is an optional
- * dependency with prebuilt binaries and no install scripts, so its absence is
- * normal rather than exceptional — we fall through to the file keystore.
+ * Loads `@napi-rs/keyring` on the platforms whose native stores are persistent
+ * by construction. On Linux this function never reaches the import.
  */
-async function keyring(profile) {
-    if (process.env.DASKI_DISABLE_KEYCHAIN === "1")
-        return undefined;
+async function keyring(profile, host) {
+    if (host.platform === "linux")
+        throw keychainUnsupportedOnLinux(profile);
+    let Entry;
     try {
         const module = await import("@napi-rs/keyring");
-        const Entry = module.Entry;
-        return new Entry(SERVICE, accountFor(profile));
+        Entry = module.Entry;
     }
     catch {
-        return undefined;
+        throw new CliError({
+            code: "DASKI_KEYCHAIN_UNAVAILABLE",
+            message: "The OS keychain backend could not be loaded on this machine.",
+            remediation: `Reinstall @daski/pay so its optional @napi-rs/keyring binary is present, or use ` +
+                `the encrypted file backend with DASKI_KEY_BACKEND=file. See ${DOC}`,
+        });
     }
+    return new Entry(SERVICE, accountFor(profile));
+}
+// -- file backend ----------------------------------------------------------------
+function keystoreUnreadable(path, reason) {
+    return new CliError({
+        code: "DASKI_KEYSTORE_UNREADABLE",
+        message: `The keystore ${path} exists but cannot be used: ${reason}.`,
+        remediation: "An unreadable or malformed keystore is never treated as empty, because creating a " +
+            "key over it could hide the one already there. Restore the file from a backup or fix " +
+            `its permissions, then re-run. See ${DOC}`,
+    });
 }
-function readKeystoreFile() {
+function isEncryptedEntry(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const entry = value;
+    const { N, r, p } = entry;
+    return entry.kdf === "scrypt" &&
+        typeof N === "number" && Number.isSafeInteger(N) && N >= 1 << 14 && N <= SCRYPT_MAX.N && (N & (N - 1)) === 0 &&
+        typeof r === "number" && Number.isSafeInteger(r) && r >= 1 && r <= SCRYPT_MAX.r &&
+        typeof p === "number" && Number.isSafeInteger(p) && p >= 1 && p <= SCRYPT_MAX.p &&
+        [entry.salt, entry.iv, entry.tag, entry.ciphertext].every((s) => typeof s === "string" && s.length > 0);
+}
+/**
+ * Reads the store. A missing file is an empty store; anything else that stops
+ * the file being read, parsed, or trusted is `DASKI_KEYSTORE_UNREADABLE`.
+ */
+function readKeystoreFile(path = keystorePath()) {
+    let raw;
     try {
-        const parsed = JSON.parse(readFileSync(keystorePath(), "utf8"));
-        if (parsed.version !== 1 || typeof parsed.entries !== "object")
-            throw new Error("shape");
-        return parsed;
+        raw = readFileSync(path, "utf8");
     }
-    catch {
-        return { version: 1, entries: {} };
+    catch (error) {
+        if (error.code === "ENOENT")
+            return { version: 1, entries: {} };
+        throw keystoreUnreadable(path, error.message);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        throw keystoreUnreadable(path, `not valid JSON (${error.message})`);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw keystoreUnreadable(path, "the document is not an object");
+    }
+    const file = parsed;
+    if (file.version !== 1 || !file.entries || typeof file.entries !== "object" || Array.isArray(file.entries)) {
+        throw keystoreUnreadable(path, "unexpected document shape");
+    }
+    for (const [account, entry] of Object.entries(file.entries)) {
+        if (!isEncryptedEntry(entry))
+            throw keystoreUnreadable(path, `entry "${account}" is malformed`);
     }
+    return file;
 }
-function writeKeystoreFile(file) {
-    const path = keystorePath();
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    writeFileSync(path, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
-    chmodSync(path, 0o600);
+function fsyncDirectory(directory) {
+    // Windows cannot open a directory handle for fsync; the rename is still atomic there.
+    if (process.platform === "win32")
+        return;
+    const fd = openSync(directory, "r");
+    try {
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/**
+ * Replaces the store atomically: an owner-only temporary file beside the
+ * target, flushed, renamed over the target, then the directory flushed. A
+ * crash at any point leaves either the previous file or the new one, never a
+ * truncated mixture.
+ */
+function replaceKeystoreFile(path, file) {
+    const directory = dirname(path);
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const temporary = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+    const fd = openSync(temporary, "wx", 0o600);
+    try {
+        writeSync(fd, `${JSON.stringify(file, null, 2)}\n`);
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    try {
+        renameSync(temporary, path);
+    }
+    catch (error) {
+        rmSync(temporary, { force: true });
+        throw error;
+    }
+    fsyncDirectory(directory);
+}
+/** Serializes store updates across processes with an exclusive lock file. */
+function withKeystoreLock(path, run) {
+    const lock = `${path}.lock`;
+    return withFileLock(lock, {
+        waitMs: LOCK_WAIT_MS,
+        locked: (reason) => new CliError({
+            code: "DASKI_KEYSTORE_LOCKED",
+            message: reason === "orphaned"
+                ? `A daski process died while recovering the keystore lock ${lock}.`
+                : `Another process holds the keystore lock ${lock}.`,
+            remediation: reason === "orphaned"
+                ? `If no daski process is running, remove ${lock} and ${lock}.reclaim, then re-run. See ${DOC}`
+                : "Wait for the other daski command to finish, then re-run. If no daski process " +
+                    `is running, remove the stale lock file. See ${DOC}`,
+        }),
+    }, run);
 }
 async function encrypt(privateKey, passphrase) {
     const salt = randomBytes(32);
-    const key = await scrypt(passphrase, salt, 32, SCRYPT);
+    const key = await scrypt(passphrase, salt, 32, { ...SCRYPT, maxmem: scryptMemory(SCRYPT.N, SCRYPT.r) });
     const iv = randomBytes(12);
     const cipher = createCipheriv("aes-256-gcm", key, iv);
     const ciphertext = Buffer.concat([
@@ -102,7 +260,7 @@ async function encrypt(privateKey, passphrase) {
 }
 async function decrypt(entry, passphrase) {
     const key = await scrypt(passphrase, Buffer.from(entry.salt, "base64"), 32, {
-        N: entry.N, r: entry.r, p: entry.p,
+        N: entry.N, r: entry.r, p: entry.p, maxmem: scryptMemory(entry.N, entry.r),
     });
     const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(entry.iv, "base64"));
     decipher.setAuthTag(Buffer.from(entry.tag, "base64"));
@@ -123,104 +281,250 @@ async function decrypt(entry, passphrase) {
         });
     }
 }
+// -- passphrase ------------------------------------------------------------------
+function passphraseFileInvalid(path, reason, remediation) {
+    return new CliError({
+        code: "DASKI_PASSPHRASE_FILE_INVALID",
+        message: `DASKI_KEYSTORE_PASSPHRASE_FILE (${path}) cannot be used: ${reason}.`,
+        remediation: `${remediation} See ${DOC}`,
+    });
+}
+/**
+ * Reads the passphrase from the file `DASKI_KEYSTORE_PASSPHRASE_FILE` names.
+ * The file must be a regular file with owner-only permissions; a passphrase
+ * never travels on a command line.
+ */
+export function readPassphraseFile(path, platform) {
+    let stat;
+    try {
+        stat = statSync(path);
+    }
+    catch (error) {
+        throw passphraseFileInvalid(path, error.message, "Point it at a regular file containing only the passphrase.");
+    }
+    if (!stat.isFile()) {
+        throw passphraseFileInvalid(path, "it is not a regular file", "Point it at a regular file containing only the passphrase.");
+    }
+    // Windows permissions are ACLs that Node cannot express as a mode.
+    if (platform !== "win32" && (stat.mode & 0o077) !== 0) {
+        throw passphraseFileInvalid(path, "it is readable or writable by other users", `Run: chmod 600 ${path}`);
+    }
+    let content;
+    try {
+        content = readFileSync(path, "utf8");
+    }
+    catch (error) {
+        throw passphraseFileInvalid(path, error.message, "Fix the file's permissions.");
+    }
+    const passphrase = content.replace(/\r?\n$/, "");
+    if (passphrase.length === 0) {
+        throw passphraseFileInvalid(path, "it is empty", "Write the passphrase into the file.");
+    }
+    return passphrase;
+}
+function passphraseTooShort() {
+    return new CliError({
+        code: "DASKI_PASSPHRASE_TOO_SHORT",
+        message: `The keystore passphrase must be at least ${MIN_PASSPHRASE_LENGTH} characters.`,
+        remediation: "Re-run and choose a longer passphrase.",
+    });
+}
+/**
+ * The passphrase for the file store: from `DASKI_KEYSTORE_PASSPHRASE_FILE`
+ * when set, otherwise from the terminal. With neither, the command refuses.
+ */
+export async function keystorePassphrase(host, purpose, profile) {
+    if (host.passphraseFile) {
+        const passphrase = readPassphraseFile(host.passphraseFile, host.platform);
+        if (purpose === "create" && passphrase.length < MIN_PASSPHRASE_LENGTH)
+            throw passphraseTooShort();
+        return passphrase;
+    }
+    if (!isInteractive()) {
+        throw new CliError({
+            code: "DASKI_PASSPHRASE_REQUIRES_TTY",
+            message: "The encrypted keystore needs a passphrase, and this session has no terminal.",
+            remediation: "Run the command from an interactive terminal, or set DASKI_KEYSTORE_PASSPHRASE_FILE " +
+                "to a regular file (mode 600) containing the passphrase. The passphrase is never " +
+                `taken from a flag. See ${DOC}`,
+        });
+    }
+    if (purpose === "unlock")
+        return readPassphrase(`Passphrase for the ${profile} keystore: `);
+    const passphrase = await readPassphrase(`Choose a passphrase for ${keystorePath()}: `);
+    if (passphrase.length < MIN_PASSPHRASE_LENGTH)
+        throw passphraseTooShort();
+    const again = await readPassphrase("Confirm passphrase: ");
+    if (again !== passphrase) {
+        throw new CliError({
+            code: "DASKI_PASSPHRASE_MISMATCH",
+            message: "The passphrases did not match.",
+            remediation: "Re-run and enter the same passphrase twice.",
+        });
+    }
+    return passphrase;
+}
+// -- the store API -----------------------------------------------------------------
+/** The refusal for a host whose backend holds no local key. */
+export function localKeyRefusedOnHost(profile, backend) {
+    const named = backend === "none" ? "no local key store (DASKI_KEY_BACKEND=none)" : `the hosted ${backend} wallet`;
+    return new CliError({
+        code: "DASKI_LOCAL_KEY_REFUSED_ON_HOST",
+        message: `This host selects ${named}, so no local key is created or read for "${profile}".`,
+        remediation: backend === "none"
+            ? "Set DASKI_KEY_BACKEND=file (or keychain on macOS and Windows) to keep a local key, " +
+                `or configure a hosted signer. See ${DOC}`
+            : `Set the profile signer to ${backend} and run daski doctor --json --signer ${backend}. ` +
+                `To keep a local key instead, set DASKI_KEY_BACKEND=file. See ${DOC}`,
+    });
+}
 /** Where a key for this profile lives, without loading it. */
-export async function locateKey(profile) {
-    if (process.env.DASKI_PAYER_PRIVATE_KEY) {
-        return {
-            source: "environment",
-            description: "DASKI_PAYER_PRIVATE_KEY (developer/sandbox only)",
-        };
-    }
-    const entry = await keyring(profile);
-    if (entry) {
+export async function locateKey(profile, store) {
+    if (process.env.DASKI_PAYER_PRIVATE_KEY)
+        return ENVIRONMENT_LOCATION;
+    if (HOSTED_BACKENDS.has(store.backend))
+        return undefined;
+    if (store.backend === "keychain") {
+        const entry = await keyring(profile, store.host);
         try {
-            if (entry.getPassword()) {
-                return { source: "keychain", description: `OS keychain (${SERVICE}/${accountFor(profile)})` };
-            }
+            return entry.getPassword() ? keychainLocation(profile) : undefined;
         }
         catch {
-            // An unavailable keychain is not an error here; fall through to the file.
+            return undefined;
         }
     }
-    if (readKeystoreFile().entries[accountFor(profile)]) {
-        return { source: "encrypted-file", description: `${keystorePath()} (scrypt + AES-256-GCM)` };
-    }
-    return undefined;
+    return readKeystoreFile().entries[accountFor(profile)] ? fileLocation() : undefined;
 }
 /** Loads the private key for a profile, prompting for a passphrase if needed. */
-export async function loadKey(profile) {
+export async function loadKey(profile, store) {
     const fromEnvironment = environmentKey(profile);
     if (fromEnvironment)
         return fromEnvironment;
-    const entry = await keyring(profile);
-    if (entry) {
-        try {
-            const stored = entry.getPassword();
-            if (stored) {
-                if (!/^0x[0-9a-fA-F]{64}$/.test(stored)) {
-                    throw new CliError({
-                        code: "DASKI_KEYCHAIN_ENTRY_MALFORMED",
-                        message: `The keychain entry for "${profile}" is not a valid private key.`,
-                        remediation: `Delete it and re-run \`daski wallet create --profile ${profile}\`. See ${DOC}`,
-                    });
-                }
-                return stored;
-            }
-        }
-        catch (error) {
-            if (error instanceof CliError)
-                throw error;
+    if (HOSTED_BACKENDS.has(store.backend))
+        throw localKeyRefusedOnHost(profile, store.backend);
+    if (store.backend === "keychain") {
+        const entry = await keyring(profile, store.host);
+        const stored = entry.getPassword();
+        if (!stored)
+            throw noKey(profile);
+        if (!/^0x[0-9a-fA-F]{64}$/.test(stored)) {
+            throw new CliError({
+                code: "DASKI_KEYCHAIN_ENTRY_MALFORMED",
+                message: `The keychain entry for "${profile}" is not a valid private key.`,
+                remediation: `Delete it and re-run \`daski wallet create --profile ${profile}\`. See ${DOC}`,
+            });
         }
+        return stored;
     }
     const stored = readKeystoreFile().entries[accountFor(profile)];
-    if (!stored) {
-        throw new CliError({
-            code: "DASKI_NO_KEY_FOR_PROFILE",
-            message: `No signing key is configured for the "${profile}" profile.`,
-            remediation: `Run: daski wallet create --profile ${profile}`,
-        });
-    }
-    const passphrase = await readPassphrase(`Passphrase for the ${profile} keystore: `);
+    if (!stored)
+        throw noKey(profile);
+    const passphrase = await keystorePassphrase(store.host, "unlock", profile);
     return decrypt(stored, passphrase);
 }
+function noKey(profile) {
+    return new CliError({
+        code: "DASKI_NO_KEY_FOR_PROFILE",
+        message: `No signing key is configured for the "${profile}" profile.`,
+        remediation: `Run: daski wallet create --profile ${profile}`,
+    });
+}
+/**
+ * Serializes a profile's native keychain setup. The entry is per OS user, not
+ * per DASKI_HOME, so the lock lives outside DASKI_HOME and names the entry:
+ * two setups for the same profile, from any directories, take turns, and the
+ * second finds the first's key instead of overwriting it after a check that
+ * saw nothing.
+ */
+function withKeychainLock(profile, directory, run) {
+    const name = `keychain-${SERVICE}-${accountFor(profile)}`.replace(/[^A-Za-z0-9._-]/g, "_");
+    const lock = join(directory ?? join(tmpdir(), "daski-locks"), `${name}.lock`);
+    return withFileLock(lock, {
+        waitMs: LOCK_WAIT_MS,
+        locked: (reason) => new CliError({
+            code: "DASKI_KEYSTORE_LOCKED",
+            message: reason === "orphaned"
+                ? `A daski process died while recovering the keychain lock ${lock}.`
+                : `Another process is setting up the keychain entry for "${profile}".`,
+            remediation: reason === "orphaned"
+                ? `If no daski process is running, remove ${lock} and ${lock}.reclaim, then re-run. See ${DOC}`
+                : "Wait for the other daski command to finish, then re-run. If no daski process " +
+                    `is running, remove the stale lock file. See ${DOC}`,
+        }),
+    }, run);
+}
 /**
  * Stores a key for a profile. Returns where it landed so the caller can tell
- * the operator — the caller prints the location, never the key.
+ * the operator — the caller prints the location, never the key. The store is
+ * re-read under the lock, so two creations for the same profile serialize to
+ * one key: the second finds the first and refuses.
  */
-export async function storeKey(profile, privateKey) {
-    const entry = await keyring(profile);
-    if (entry) {
-        try {
+export async function storeKey(profile, privateKey, store, hooks = {}) {
+    if (HOSTED_BACKENDS.has(store.backend))
+        throw localKeyRefusedOnHost(profile, store.backend);
+    const expected = privateKeyToAccount(privateKey).address;
+    if (store.backend === "keychain") {
+        const entry = hooks.keyring ? hooks.keyring(profile) : await keyring(profile, store.host);
+        // Check, write and read-back are one critical section: a read-back alone
+        // cannot tell that another setup will overwrite the entry afterwards.
+        return withKeychainLock(profile, hooks.lockDirectory, async () => {
+            if (entry.getPassword())
+                throw keyAlreadyExists(profile);
+            await hooks.beforeKeychainWrite?.();
             entry.setPassword(privateKey);
-            return { source: "keychain", description: `OS keychain (${SERVICE}/${accountFor(profile)})` };
-        }
-        catch {
-            // No usable keychain (headless Linux without libsecret, for example).
-        }
-    }
-    const passphrase = await readPassphrase(`No OS keychain is available. Choose a passphrase for ${keystorePath()}: `);
-    if (passphrase.length < 8) {
-        throw new CliError({
-            code: "DASKI_PASSPHRASE_TOO_SHORT",
-            message: "The keystore passphrase must be at least 8 characters.",
-            remediation: "Re-run and choose a longer passphrase.",
-        });
-    }
-    const again = await readPassphrase("Confirm passphrase: ");
-    if (again !== passphrase) {
-        throw new CliError({
-            code: "DASKI_PASSPHRASE_MISMATCH",
-            message: "The passphrases did not match.",
-            remediation: "Re-run and enter the same passphrase twice.",
+            const readBack = entry.getPassword();
+            if (readBack !== privateKey)
+                throw readBackMismatch(profile);
+            return keychainLocation(profile);
         });
     }
-    const file = readKeystoreFile();
-    file.entries[accountFor(profile)] = await encrypt(privateKey, passphrase);
-    writeKeystoreFile(file);
-    return { source: "encrypted-file", description: `${keystorePath()} (scrypt + AES-256-GCM)` };
+    const path = keystorePath();
+    // The passphrase is obtained before the lock so a prompt never holds it.
+    if (readKeystoreFile(path).entries[accountFor(profile)])
+        throw keyAlreadyExists(profile);
+    const passphrase = await keystorePassphrase(store.host, "create", profile);
+    const encrypted = await encrypt(privateKey, passphrase);
+    return withKeystoreLock(path, async () => {
+        const file = readKeystoreFile(path);
+        if (file.entries[accountFor(profile)])
+            throw keyAlreadyExists(profile);
+        file.entries[accountFor(profile)] = encrypted;
+        replaceKeystoreFile(path, file);
+        hooks.afterWrite?.();
+        // Success is claimed only after the bytes on disk decrypt to this key.
+        const written = readKeystoreFile(path).entries[accountFor(profile)];
+        let recovered;
+        if (written) {
+            try {
+                recovered = getAddress(privateKeyToAccount(await decrypt(written, passphrase)).address);
+            }
+            catch {
+                recovered = undefined;
+            }
+        }
+        if (recovered !== expected)
+            throw readBackMismatch(profile);
+        return fileLocation();
+    });
+}
+function keyAlreadyExists(profile) {
+    return new CliError({
+        code: "DASKI_KEY_ALREADY_EXISTS",
+        message: `A signing key already exists for the "${profile}" profile.`,
+        remediation: `Use the existing signer with daski wallet address --profile ${profile}.`,
+    });
+}
+function readBackMismatch(profile) {
+    return new CliError({
+        code: "DASKI_KEYSTORE_READBACK_MISMATCH",
+        message: `The key written for "${profile}" did not read back as the key that was generated, ` +
+            "so the store cannot be trusted to hold it.",
+        remediation: "Do not fund this address. Check the disk and the state directory, then re-run " +
+            `daski wallet create --profile ${profile}. See ${DOC}`,
+    });
 }
 /** True when a key already exists for this profile. */
-export async function hasKey(profile) {
-    return (await locateKey(profile)) !== undefined;
+export async function hasKey(profile, store) {
+    return (await locateKey(profile, store)) !== undefined;
 }
 //# sourceMappingURL=keystore.js.map

package/dist/store/keystore.js.map

@@ -1 +1 @@
-{"version":3,"file":"keystore.js","sourceRoot":"","sources":["../../src/store/keystore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,aAAa,CAAC;AACtG,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAEnB,CAAC;AAErB,MAAM,OAAO,GAAG,cAAc,CAAC;AAC/B,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE,2CAA2C;AAC3C,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAW,CAAC;AA0BnD,yEAAyE;AACzE,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,SAAS,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,kEAAkE;AAClE,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,mCAAmC;YACzC,OAAO,EACL,8DAA8D,OAAO,KAAK;gBAC1E,kDAAkD;YACpD,WAAW,EACT,gDAAgD,OAAO,iBAAiB;gBACxE,yDAAyD,OAAO,WAAW,GAAG,EAAE;SACnF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,+DAA+D;YACxE,WAAW,EAAE,qCAAqC,GAAG,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAU,CAAC;AACpB,CAAC;AAQD;;;;GAIG;AACH,KAAK,UAAU,OAAO,CAAC,OAAe;IACpC,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAChD,MAAM,KAAK,GAAI,MAA4E,CAAC,KAAK,CAAC;QAClG,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,MAAM,CAAC,CAAiB,CAAC;QAChF,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QACzF,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAkB;IAC3C,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,UAAe,EAAE,UAAkB;IACxD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,OAAO;QACL,GAAG,EAAE,QAAQ;QACb,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3C,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,KAAqB,EAAE,UAAkB;IAC9D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE;QAC1E,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACxD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,KAAK,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAS,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,2DAA2D;YACpE,WAAW,EACT,uEAAuE;gBACvE,4DAA4D,GAAG,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAe;IAC7C,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;QACxC,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,kDAAkD;SAChE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAChG,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,YAAY,EAAE,yBAAyB,EAAE,CAAC;IAC/F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAe;IAC3C,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YACnC,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxC,MAAM,IAAI,QAAQ,CAAC;wBACjB,IAAI,EAAE,gCAAgC;wBACtC,OAAO,EAAE,2BAA2B,OAAO,+BAA+B;wBAC1E,WAAW,EAAE,wDAAwD,OAAO,WAAW,GAAG,EAAE;qBAC7F,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,MAAa,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,yCAAyC,OAAO,YAAY;YACrE,WAAW,EAAE,sCAAsC,OAAO,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,sBAAsB,OAAO,aAAa,CAAC,CAAC;IACpF,OAAO,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe,EAAE,UAAe;IAC7D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAC9B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAChG,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,cAAc,CACrC,wDAAwD,YAAY,EAAE,IAAI,CAC3E,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,wDAAwD;YACjE,WAAW,EAAE,wCAAwC;SACtD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,sBAAsB,CAAC,CAAC;IAC3D,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,gCAAgC;YACzC,WAAW,EAAE,6CAA6C;SAC3D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC1E,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,YAAY,EAAE,yBAAyB,EAAE,CAAC;AAC/F,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAe;IAC1C,OAAO,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC;AAClD,CAAC"}
+{"version":3,"file":"keystore.js","sourceRoot":"","sources":["../../src/store/keystore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,IAAI,cAAc,GACxE,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EACrF,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,UAAU,EAA0B,MAAM,MAAM,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EACL,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAGnB,CAAC;AAErB,MAAM,OAAO,GAAG,cAAc,CAAC;AAC/B,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE,2CAA2C;AAC3C,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAW,CAAC;AACnD;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAW,CAAC;AACvD,MAAM,YAAY,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;AACvE,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,sFAAsF;AACtF,MAAM,YAAY,GAAG,MAAM,CAAC;AAkC5B,yEAAyE;AACzE,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,SAAS,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,kEAAkE;AAClE,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,mCAAmC;YACzC,OAAO,EACL,8DAA8D,OAAO,KAAK;gBAC1E,kDAAkD;YACpD,WAAW,EACT,gDAAgD,OAAO,oBAAoB;gBAC3E,wDAAwD,OAAO,WAAW,GAAG,EAAE;SAClF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,+DAA+D;YACxE,WAAW,EAAE,qCAAqC,GAAG,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAU,CAAC;AACpB,CAAC;AAED,MAAM,oBAAoB,GAAgB;IACxC,MAAM,EAAE,aAAa;IACrB,WAAW,EAAE,kDAAkD;IAC/D,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,WAAW,EAAE,gBAAgB,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG;QAC9D,UAAU,EAAE,YAAY;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO;QACL,MAAM,EAAE,gBAAgB;QACxB,WAAW,EAAE,GAAG,YAAY,EAAE,yBAAyB;QACvD,UAAU,EAAE,gBAAgB;KAC7B,CAAC;AACJ,CAAC;AAUD,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EACL,qFAAqF;YACrF,uFAAuF;QACzF,WAAW,EACT,wFAAwF,OAAO,IAAI;YACnG,oEAAoE,GAAG,EAAE;KAC5E,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,OAAO,CAAC,OAAe,EAAE,IAAqB;IAC3D,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,KAA6D,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAChD,KAAK,GAAI,MAA4E,CAAC,KAAK,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,8DAA8D;YACvE,WAAW,EACT,kFAAkF;gBAClF,+DAA+D,GAAG,EAAE;SACvE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,mFAAmF;AAEnF,SAAS,kBAAkB,CAAC,IAAY,EAAE,MAAc;IACtD,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,gBAAgB,IAAI,+BAA+B,MAAM,GAAG;QACrE,WAAW,EACT,oFAAoF;YACpF,sFAAsF;YACtF,qCAAqC,GAAG,EAAE;KAC7C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC;IAC1B,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAC3B,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5G,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC;QAC/E,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC;QAC/E,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAI,GAAG,YAAY,EAAE;IAC7C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC3F,MAAM,kBAAkB,CAAC,IAAI,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,kBAAkB,CAAC,IAAI,EAAE,mBAAoB,KAAe,CAAC,OAAO,GAAG,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,kBAAkB,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,MAAkD,CAAC;IAChE,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3G,MAAM,kBAAkB,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAkC,CAAC,EAAE,CAAC;QACvF,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAAE,MAAM,kBAAkB,CAAC,IAAI,EAAE,UAAU,OAAO,gBAAgB,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,IAAoB,CAAC;AAC9B,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB;IACvC,sFAAsF;IACtF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACzC,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,IAAY,EAAE,IAAkB;IAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IACjF,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpD,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC;IACD,cAAc,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED,6EAA6E;AAC7E,SAAS,gBAAgB,CAAI,IAAY,EAAE,GAAqB;IAC9D,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,CAAC;IAC5B,OAAO,YAAY,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC;YAC/B,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,MAAM,KAAK,UAAU;gBAC5B,CAAC,CAAC,2DAA2D,IAAI,GAAG;gBACpE,CAAC,CAAC,2CAA2C,IAAI,GAAG;YACtD,WAAW,EAAE,MAAM,KAAK,UAAU;gBAChC,CAAC,CAAC,0CAA0C,IAAI,QAAQ,IAAI,8BAA8B,GAAG,EAAE;gBAC/F,CAAC,CAAC,+EAA+E;oBAC/E,+CAA+C,GAAG,EAAE;SACzD,CAAC;KACH,EAAE,GAAG,CAAC,CAAC;AACV,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,UAAe,EAAE,UAAkB;IACxD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxG,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,OAAO;QACL,GAAG,EAAE,QAAQ;QACb,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3C,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,KAAqB,EAAE,UAAkB;IAC9D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE;QAC1E,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;KAC3E,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACxD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,KAAK,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAS,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,2DAA2D;YACpE,WAAW,EACT,uEAAuE;gBACvE,4DAA4D,GAAG,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,mFAAmF;AAEnF,SAAS,qBAAqB,CAAC,IAAY,EAAE,MAAc,EAAE,WAAmB;IAC9E,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,mCAAmC,IAAI,qBAAqB,MAAM,GAAG;QAC9E,WAAW,EAAE,GAAG,WAAW,QAAQ,GAAG,EAAE;KACzC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,QAAyB;IACxE,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,qBAAqB,CAAC,IAAI,EAAG,KAAe,CAAC,OAAO,EACxD,4DAA4D,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,MAAM,qBAAqB,CAAC,IAAI,EAAE,0BAA0B,EAC1D,4DAA4D,CAAC,CAAC;IAClE,CAAC;IACD,mEAAmE;IACnE,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,qBAAqB,CAAC,IAAI,EAAE,2CAA2C,EAC3E,kBAAkB,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,qBAAqB,CAAC,IAAI,EAAG,KAAe,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,qBAAqB,CAAC,IAAI,EAAE,aAAa,EAAE,qCAAqC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,4CAA4C,qBAAqB,cAAc;QACxF,WAAW,EAAE,wCAAwC;KACtD,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAqB,EACrB,OAA4B,EAC5B,OAAe;IAEf,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,OAAO,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,qBAAqB;YAAE,MAAM,kBAAkB,EAAE,CAAC;QAClG,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,8EAA8E;YACvF,WAAW,EACT,sFAAsF;gBACtF,kFAAkF;gBAClF,0BAA0B,GAAG,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC,sBAAsB,OAAO,aAAa,CAAC,CAAC;IAC5F,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,2BAA2B,YAAY,EAAE,IAAI,CAAC,CAAC;IACvF,IAAI,UAAU,CAAC,MAAM,GAAG,qBAAqB;QAAE,MAAM,kBAAkB,EAAE,CAAC;IAC1E,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,sBAAsB,CAAC,CAAC;IAC3D,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,gCAAgC;YACzC,WAAW,EAAE,6CAA6C;SAC3D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,qFAAqF;AAErF,+DAA+D;AAC/D,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,OAAmB;IACxE,MAAM,KAAK,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC,CAAC,cAAc,OAAO,SAAS,CAAC;IAClH,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,qBAAqB,KAAK,6CAA6C,OAAO,IAAI;QAC3F,WAAW,EACT,OAAO,KAAK,MAAM;YAChB,CAAC,CAAC,qFAAqF;gBACrF,qCAAqC,GAAG,EAAE;YAC5C,CAAC,CAAC,6BAA6B,OAAO,yCAAyC,OAAO,IAAI;gBACxF,gEAAgE,GAAG,EAAE;KAC5E,CAAC,CAAC;AACL,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAe,EAAE,KAAwB;IACvE,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB;QAAE,OAAO,oBAAoB,CAAC;IACrE,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACzD,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,gBAAgB,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtF,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAe,EAAE,KAAwB;IACrE,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,MAAM,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAE5F,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,QAAQ,CAAC;gBACjB,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EAAE,2BAA2B,OAAO,+BAA+B;gBAC1E,WAAW,EAAE,wDAAwD,OAAO,WAAW,GAAG,EAAE;aAC7F,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAa,CAAC;IACvB,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM;QAAE,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,yCAAyC,OAAO,YAAY;QACrE,WAAW,EAAE,sCAAsC,OAAO,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAcD;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAI,OAAe,EAAE,SAA6B,EAAE,GAAqB;IAChG,MAAM,IAAI,GAAG,YAAY,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IAC9E,OAAO,YAAY,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC;YAC/B,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,MAAM,KAAK,UAAU;gBAC5B,CAAC,CAAC,2DAA2D,IAAI,GAAG;gBACpE,CAAC,CAAC,yDAAyD,OAAO,IAAI;YACxE,WAAW,EAAE,MAAM,KAAK,UAAU;gBAChC,CAAC,CAAC,0CAA0C,IAAI,QAAQ,IAAI,8BAA8B,GAAG,EAAE;gBAC/F,CAAC,CAAC,+EAA+E;oBAC/E,+CAA+C,GAAG,EAAE;SACzD,CAAC;KACH,EAAE,GAAG,CAAC,CAAC;AACV,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAe,EACf,UAAe,EACf,KAAwB,EACxB,QAAuB,EAAE;IAEzB,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,MAAM,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;IAEzD,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1F,yEAAyE;QACzE,sEAAsE;QACtE,OAAO,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,IAAI,EAAE;YAC/D,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACzD,MAAM,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC;YACpC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YACrC,IAAI,QAAQ,KAAK,UAAU;gBAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC7D,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,yEAAyE;IACzE,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzF,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxD,OAAO,gBAAgB,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;QAC9C,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;QACrB,uEAAuE;QACvE,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QACpE,IAAI,SAA8B,CAAC;QACnC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,SAAS,GAAG,UAAU,CAAC,mBAAmB,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC1F,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,GAAG,SAAS,CAAC;YACxB,CAAC;QACH,CAAC;QACD,IAAI,SAAS,KAAK,QAAQ;YAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC5D,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,yCAAyC,OAAO,YAAY;QACrE,WAAW,EAAE,+DAA+D,OAAO,GAAG;KACvF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,kCAAkC;QACxC,OAAO,EACL,wBAAwB,OAAO,qDAAqD;YACpF,4CAA4C;QAC9C,WAAW,EACT,gFAAgF;YAChF,iCAAiC,OAAO,SAAS,GAAG,EAAE;KACzD,CAAC,CAAC;AACL,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAe,EAAE,KAAwB;IACpE,OAAO,CAAC,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,KAAK,SAAS,CAAC;AACzD,CAAC"}