@did-btcr2/cli 0.15.0 → 0.17.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (76) hide show
  1. package/README.md +47 -6
  2. package/dist/.tsbuildinfo +1 -1
  3. package/dist/cjs/index.js +836 -122
  4. package/dist/esm/src/cli.js +7 -4
  5. package/dist/esm/src/cli.js.map +1 -1
  6. package/dist/esm/src/commands/config.js +11 -15
  7. package/dist/esm/src/commands/config.js.map +1 -1
  8. package/dist/esm/src/commands/create.js +4 -1
  9. package/dist/esm/src/commands/create.js.map +1 -1
  10. package/dist/esm/src/commands/deactivate.js +3 -1
  11. package/dist/esm/src/commands/deactivate.js.map +1 -1
  12. package/dist/esm/src/commands/index.js +2 -0
  13. package/dist/esm/src/commands/index.js.map +1 -1
  14. package/dist/esm/src/commands/init.js +69 -0
  15. package/dist/esm/src/commands/init.js.map +1 -0
  16. package/dist/esm/src/commands/keystore.js +180 -0
  17. package/dist/esm/src/commands/keystore.js.map +1 -0
  18. package/dist/esm/src/commands/profile.js +1 -1
  19. package/dist/esm/src/commands/profile.js.map +1 -1
  20. package/dist/esm/src/commands/update.js +3 -1
  21. package/dist/esm/src/commands/update.js.map +1 -1
  22. package/dist/esm/src/config.js +109 -31
  23. package/dist/esm/src/config.js.map +1 -1
  24. package/dist/esm/src/keystore/file-key-store.js +388 -32
  25. package/dist/esm/src/keystore/file-key-store.js.map +1 -1
  26. package/dist/esm/src/keystore/passphrase.js +53 -10
  27. package/dist/esm/src/keystore/passphrase.js.map +1 -1
  28. package/dist/esm/src/keystore/paths.js +6 -18
  29. package/dist/esm/src/keystore/paths.js.map +1 -1
  30. package/dist/esm/src/keystore/session.js +250 -0
  31. package/dist/esm/src/keystore/session.js.map +1 -0
  32. package/dist/esm/src/paths.js +71 -0
  33. package/dist/esm/src/paths.js.map +1 -0
  34. package/dist/esm/src/types.js.map +1 -1
  35. package/dist/types/src/cli.d.ts.map +1 -1
  36. package/dist/types/src/commands/config.d.ts.map +1 -1
  37. package/dist/types/src/commands/create.d.ts.map +1 -1
  38. package/dist/types/src/commands/deactivate.d.ts.map +1 -1
  39. package/dist/types/src/commands/index.d.ts +2 -0
  40. package/dist/types/src/commands/index.d.ts.map +1 -1
  41. package/dist/types/src/commands/init.d.ts +13 -0
  42. package/dist/types/src/commands/init.d.ts.map +1 -0
  43. package/dist/types/src/commands/keystore.d.ts +11 -0
  44. package/dist/types/src/commands/keystore.d.ts.map +1 -0
  45. package/dist/types/src/commands/update.d.ts.map +1 -1
  46. package/dist/types/src/config.d.ts +38 -14
  47. package/dist/types/src/config.d.ts.map +1 -1
  48. package/dist/types/src/keystore/file-key-store.d.ts +102 -10
  49. package/dist/types/src/keystore/file-key-store.d.ts.map +1 -1
  50. package/dist/types/src/keystore/passphrase.d.ts +26 -1
  51. package/dist/types/src/keystore/passphrase.d.ts.map +1 -1
  52. package/dist/types/src/keystore/paths.d.ts +6 -10
  53. package/dist/types/src/keystore/paths.d.ts.map +1 -1
  54. package/dist/types/src/keystore/session.d.ts +105 -0
  55. package/dist/types/src/keystore/session.d.ts.map +1 -0
  56. package/dist/types/src/paths.d.ts +64 -0
  57. package/dist/types/src/paths.d.ts.map +1 -0
  58. package/dist/types/src/types.d.ts +53 -0
  59. package/dist/types/src/types.d.ts.map +1 -1
  60. package/package.json +3 -3
  61. package/src/cli.ts +8 -3
  62. package/src/commands/config.ts +12 -14
  63. package/src/commands/create.ts +4 -1
  64. package/src/commands/deactivate.ts +3 -1
  65. package/src/commands/index.ts +2 -0
  66. package/src/commands/init.ts +80 -0
  67. package/src/commands/keystore.ts +232 -0
  68. package/src/commands/profile.ts +1 -1
  69. package/src/commands/update.ts +3 -1
  70. package/src/config.ts +118 -35
  71. package/src/keystore/file-key-store.ts +498 -43
  72. package/src/keystore/passphrase.ts +71 -8
  73. package/src/keystore/paths.ts +6 -19
  74. package/src/keystore/session.ts +303 -0
  75. package/src/paths.ts +92 -0
  76. package/src/types.ts +16 -1
@@ -1,5 +1,7 @@
1
1
  import { existsSync, readFileSync } from 'node:fs';
2
2
  import { dirname } from 'node:path';
3
+ import { sha256 } from '@noble/hashes/sha2.js';
4
+ import { utf8ToBytes } from '@noble/hashes/utils.js';
3
5
  import { base64urlnopad } from '@scure/base';
4
6
  import { assertSecurePerms, ensureDir, writeFileAtomic } from './atomic.js';
5
7
  import { DEFAULT_ARGON_PARAMS, decryptSecret, encryptSecret } from './envelope.js';
@@ -9,19 +11,44 @@ import { defaultKeystorePath } from './paths.js';
9
11
  /** Current on-disk keystore file format version. */
10
12
  export const KEYSTORE_VERSION = 1;
11
13
  /**
12
- * A Node-only, file-backed {@link KeyValueStore} that encrypts secret keys at
14
+ * Fixed sentinel sealed under the keystore passphrase and stored as the file's
15
+ * `verifier`. Decrypting it checks a candidate passphrase before any real secret
16
+ * is sealed or opened, so a typo fails loudly instead of corrupting the store.
17
+ */
18
+ const VERIFIER_PLAINTEXT = utf8ToBytes('did-btcr2-keystore-verifier-v1');
19
+ /** Constant-length-independent byte compare for the verifier sentinel. */
20
+ function bytesEqual(a, b) {
21
+ if (a.length !== b.length)
22
+ return false;
23
+ let diff = 0;
24
+ for (let i = 0; i < a.length; i++)
25
+ diff |= a[i] ^ b[i];
26
+ return diff === 0;
27
+ }
28
+ /** Whether two secret envelopes are byte-identical (structural JSON compare). */
29
+ function sameEnvelope(a, b) {
30
+ return JSON.stringify(a) === JSON.stringify(b);
31
+ }
32
+ /**
33
+ * A Node-only, file-backed {@link KeyValueStore} that protects secret keys at
13
34
  * rest. It satisfies the synchronous store contract by caching the parsed file
14
35
  * in memory at construction and flushing the whole file atomically on every
15
36
  * mutation.
16
37
  *
38
+ * Encrypted keystores seal each secret in its own argon2id + XChaCha20-Poly1305
39
+ * envelope under one shared passphrase, and store a `verifier` sentinel so a
40
+ * candidate passphrase is checked before it is used (ADR 080): the first
41
+ * passphrase is established with a confirm prompt, and every later use is
42
+ * verified, so a typo is a loud failure rather than a key sealed under an
43
+ * unknown or divergent passphrase. Dev keystores (`protection: 'none'`) store
44
+ * secrets as plaintext and never prompt; they are refused for mainnet by the
45
+ * command layer.
46
+ *
17
47
  * Every mutation runs under an exclusive cross-process lock and, inside that
18
- * lock, reloads the file from disk before applying its change and flushing.
19
- * Caching at construction and flushing the whole file is otherwise a lost-update
20
- * race: two `btcr2` processes that each load, then each write, would have the
21
- * second overwrite the first. The lock serializes the writers and the reload
22
- * merges any change the other made, so concurrent invocations compose instead of
23
- * clobbering. Reads stay lock-free: an atomic rename means a concurrent reader
24
- * always sees a complete file, old or new.
48
+ * lock, reloads the file from disk before applying its change and flushing, so
49
+ * concurrent `btcr2` invocations compose instead of clobbering. Reads stay
50
+ * lock-free: an atomic rename means a concurrent reader always sees a complete
51
+ * file, old or new.
25
52
  *
26
53
  * Secrets are materialized only through {@link FileKeyStore.get}. The
27
54
  * {@link FileKeyStore.list} and {@link FileKeyStore.entries} projections omit
@@ -36,12 +63,17 @@ export class FileKeyStore {
36
63
  #argonParams;
37
64
  #cache = new Map();
38
65
  #active;
66
+ #protection;
67
+ #verifier;
39
68
  constructor(options) {
40
69
  this.#path = options.path ?? defaultKeystorePath();
41
70
  this.#lockPath = `${this.#path}.lock`;
42
71
  this.#lockOptions = options.lock ?? {};
43
72
  this.#getPassphrase = options.getPassphrase;
44
73
  this.#argonParams = options.argonParams ?? DEFAULT_ARGON_PARAMS;
74
+ // The requested mode applies only when establishing a fresh keystore; an
75
+ // existing file's on-disk protection overrides it in #loadFromDisk.
76
+ this.#protection = options.protection ?? 'passphrase';
45
77
  ensureDir(dirname(this.#path), 0o700);
46
78
  this.#loadFromDisk();
47
79
  }
@@ -59,7 +91,24 @@ export class FileKeyStore {
59
91
  if (parsed.v !== KEYSTORE_VERSION) {
60
92
  throw new KeyStoreError(`Unsupported keystore version: ${String(parsed.v)}.`, 'KEYSTORE_VERSION_ERROR', { version: parsed.v });
61
93
  }
94
+ // Every keystore this CLI writes carries a recognized protection header. A
95
+ // file without one was not written by this CLI (there is no pre-header
96
+ // format to accommodate); refuse it rather than guess how its secrets are
97
+ // protected.
98
+ if (parsed.protection !== 'none' && parsed.protection !== 'passphrase') {
99
+ throw new KeyStoreError(`Keystore at ${this.#path} has no recognized protection header; it was not written by this CLI.`, 'KEYSTORE_CORRUPT_ERROR', { path: this.#path });
100
+ }
101
+ this.#protection = parsed.protection;
102
+ this.#verifier = parsed.verifier;
62
103
  this.#active = parsed.active;
104
+ // An encrypted keystore that holds sealed keys must carry the verifier that
105
+ // established its passphrase. Without it, the verify-or-establish decision in
106
+ // #sealPassphrase could take the establish path over existing sealed keys and
107
+ // seal a new key under a divergent passphrase; refuse the file instead.
108
+ const sealedPresent = Object.values(parsed.keys ?? {}).some(k => k && typeof k === 'object' && k.secret !== undefined);
109
+ if (this.#protection === 'passphrase' && sealedPresent && this.#verifier === undefined) {
110
+ throw new KeyStoreError(`Keystore at ${this.#path} holds sealed keys but no passphrase verifier; it is corrupt or was tampered with.`, 'KEYSTORE_CORRUPT_ERROR', { path: this.#path });
111
+ }
63
112
  for (const [id, stored] of Object.entries(parsed.keys ?? {})) {
64
113
  let publicKey;
65
114
  try {
@@ -73,24 +122,61 @@ export class FileKeyStore {
73
122
  if (publicKey.length !== 33) {
74
123
  throw new KeyStoreError(`Keystore entry ${id} has a ${publicKey.length}-byte public key; expected 33.`, 'KEYSTORE_CORRUPT_ERROR', { path: this.#path, keyId: id });
75
124
  }
76
- this.#cache.set(id, {
77
- publicKey,
78
- ...(stored.tags && { tags: stored.tags }),
79
- ...(stored.secret && { secret: stored.secret }),
80
- });
125
+ const entry = { publicKey, ...(stored.tags && { tags: stored.tags }) };
126
+ // A secret's storage form must match the keystore's protection mode: a dev
127
+ // keystore holds plaintext, an encrypted keystore holds sealed envelopes. A
128
+ // mismatch is a tampered or foreign file, not something to open blindly.
129
+ if (stored.plainSecret !== undefined) {
130
+ if (this.#protection !== 'none') {
131
+ throw new KeyStoreError(`Keystore entry ${id} holds a plaintext secret in an encrypted keystore at ${this.#path}.`, 'KEYSTORE_CORRUPT_ERROR', { path: this.#path, keyId: id });
132
+ }
133
+ entry.plaintext = true;
134
+ entry.decrypted = this.#decodePlainSecret(stored.plainSecret, id);
135
+ }
136
+ else if (stored.secret) {
137
+ if (this.#protection !== 'passphrase') {
138
+ throw new KeyStoreError(`Keystore entry ${id} holds a sealed secret in a dev keystore at ${this.#path}.`, 'KEYSTORE_CORRUPT_ERROR', { path: this.#path, keyId: id });
139
+ }
140
+ entry.secret = stored.secret;
141
+ }
142
+ this.#cache.set(id, entry);
81
143
  }
82
144
  }
145
+ /** Decodes and length-checks a dev-keystore plaintext secret. */
146
+ #decodePlainSecret(encoded, id) {
147
+ let secret;
148
+ try {
149
+ secret = base64urlnopad.decode(encoded);
150
+ }
151
+ catch {
152
+ throw new KeyStoreError(`Keystore entry ${id} has a malformed plaintext secret.`, 'KEYSTORE_CORRUPT_ERROR', { path: this.#path, keyId: id });
153
+ }
154
+ if (secret.length !== 32) {
155
+ throw new KeyStoreError(`Keystore entry ${id} has a ${secret.length}-byte secret; expected 32.`, 'KEYSTORE_CORRUPT_ERROR', { path: this.#path, keyId: id });
156
+ }
157
+ return secret;
158
+ }
83
159
  #flush() {
84
160
  const keys = {};
85
161
  for (const [id, entry] of this.#cache) {
86
- keys[id] = {
87
- publicKey: base64urlnopad.encode(entry.publicKey),
88
- ...(entry.tags && { tags: entry.tags }),
89
- ...(entry.secret && { secret: entry.secret }),
90
- };
162
+ const stored = { publicKey: base64urlnopad.encode(entry.publicKey) };
163
+ if (entry.tags)
164
+ stored.tags = entry.tags;
165
+ if (entry.plaintext && entry.decrypted) {
166
+ stored.plainSecret = base64urlnopad.encode(entry.decrypted);
167
+ }
168
+ else if (entry.secret) {
169
+ stored.secret = entry.secret;
170
+ }
171
+ keys[id] = stored;
91
172
  }
173
+ // Every keystore this CLI writes self-describes: the protection header is
174
+ // always present (`passphrase` for encrypted, `none` for dev), so a file is
175
+ // never ambiguous about how its secrets are protected.
92
176
  const file = {
93
177
  v: KEYSTORE_VERSION,
178
+ protection: this.#protection,
179
+ ...(this.#verifier && { verifier: this.#verifier }),
94
180
  ...(this.#active && { active: this.#active }),
95
181
  keys,
96
182
  };
@@ -101,7 +187,8 @@ export class FileKeyStore {
101
187
  * mutation applies on top of whatever other processes have written. Secrets
102
188
  * already decrypted this session are carried over for entries whose sealed
103
189
  * envelope is byte-identical on disk, so a mid-session write does not force a
104
- * re-prompt for keys it did not touch.
190
+ * re-prompt for keys it did not touch. (Dev-keystore plaintext secrets are
191
+ * reloaded from disk, so they need no carry.)
105
192
  */
106
193
  #reload() {
107
194
  const carried = new Map();
@@ -133,6 +220,47 @@ export class FileKeyStore {
133
220
  this.#flush();
134
221
  }, this.#lockOptions);
135
222
  }
223
+ /**
224
+ * Verifies a candidate passphrase against the keystore verifier, throwing when
225
+ * it does not open the sentinel. A no-op only on a fresh keystore whose
226
+ * passphrase has not been established yet (no verifier to check against).
227
+ */
228
+ #assertPassphrase(passphrase) {
229
+ if (!this.#verifier)
230
+ return;
231
+ let plain;
232
+ try {
233
+ plain = decryptSecret(this.#verifier, passphrase);
234
+ }
235
+ catch {
236
+ throw new KeyStoreError(`Incorrect passphrase for the keystore at ${this.#path}.`, 'DECRYPT_ERROR', { path: this.#path });
237
+ }
238
+ if (!bytesEqual(plain, VERIFIER_PLAINTEXT)) {
239
+ throw new KeyStoreError(`Keystore verifier at ${this.#path} did not match; the file may be corrupt.`, 'KEYSTORE_CORRUPT_ERROR', { path: this.#path });
240
+ }
241
+ }
242
+ /** Passphrase for opening an existing secret: verified when a verifier exists. */
243
+ #openPassphrase() {
244
+ const passphrase = this.#getPassphrase();
245
+ this.#assertPassphrase(passphrase);
246
+ return passphrase;
247
+ }
248
+ /**
249
+ * Passphrase for sealing a secret. When the keystore's passphrase is already
250
+ * established (a verifier exists), prompt once and verify it. Otherwise this is
251
+ * establishment on a fresh keystore: prompt with confirm and mint a verifier for
252
+ * the caller to persist alongside the first sealed key.
253
+ */
254
+ #sealPassphrase() {
255
+ if (this.#verifier) {
256
+ const passphrase = this.#getPassphrase();
257
+ this.#assertPassphrase(passphrase);
258
+ return { passphrase };
259
+ }
260
+ const passphrase = this.#getPassphrase({ confirm: true });
261
+ const newVerifier = encryptSecret(VERIFIER_PLAINTEXT, passphrase, this.#argonParams);
262
+ return { passphrase, newVerifier };
263
+ }
136
264
  get(id) {
137
265
  const entry = this.#cache.get(id);
138
266
  if (!entry)
@@ -141,18 +269,26 @@ export class FileKeyStore {
141
269
  publicKey: entry.publicKey,
142
270
  ...(entry.tags && { tags: entry.tags }),
143
271
  };
144
- if (entry.secret) {
145
- // Materialize the secret lazily, only when it is actually accessed, so
146
- // reads that need just public material (an active-key existence check,
147
- // getPublicKey, getEntry) never trigger a passphrase prompt. The property
148
- // is non-enumerable so spreading or serializing the entry cannot silently
149
- // decrypt the secret.
272
+ if (entry.plaintext && entry.decrypted) {
273
+ // Dev keystore: plaintext already materialized; expose without a prompt.
274
+ const secret = entry.decrypted;
275
+ Object.defineProperty(result, 'secretKey', {
276
+ configurable: true,
277
+ enumerable: false,
278
+ get: () => secret,
279
+ });
280
+ }
281
+ else if (entry.secret) {
282
+ // Materialize the sealed secret lazily, only when it is actually accessed,
283
+ // so reads that need just public material never trigger a passphrase
284
+ // prompt. The property is non-enumerable so spreading or serializing the
285
+ // entry cannot silently decrypt the secret.
150
286
  const sealed = entry.secret;
151
287
  Object.defineProperty(result, 'secretKey', {
152
288
  configurable: true,
153
289
  enumerable: false,
154
290
  get: () => {
155
- entry.decrypted ??= decryptSecret(sealed, this.#getPassphrase());
291
+ entry.decrypted ??= decryptSecret(sealed, this.#openPassphrase());
156
292
  return entry.decrypted;
157
293
  },
158
294
  });
@@ -163,16 +299,55 @@ export class FileKeyStore {
163
299
  return this.#cache.has(id);
164
300
  }
165
301
  set(id, value) {
166
- // Seal the secret before taking the lock: argon2id is deliberately slow and
167
- // must not extend the critical section that blocks other processes.
168
- const secret = value.secretKey
169
- ? encryptSecret(value.secretKey, this.#getPassphrase(), this.#argonParams)
170
- : undefined;
302
+ if (this.#protection === 'none') {
303
+ // Dev keystore: store the secret in the clear, never prompt.
304
+ this.#mutate(() => {
305
+ this.#cache.set(id, {
306
+ publicKey: value.publicKey,
307
+ ...(value.tags && { tags: value.tags }),
308
+ ...(value.secretKey && { plaintext: true, decrypted: value.secretKey }),
309
+ });
310
+ });
311
+ return;
312
+ }
313
+ // Encrypted keystore. Resolve (and, if establishing, confirm) the passphrase
314
+ // and seal the secret before taking the lock: argon2id is deliberately slow
315
+ // and must not extend the critical section that blocks other processes.
316
+ const verifierAtSeal = this.#verifier;
317
+ let sealed;
318
+ let newVerifier;
319
+ let passphrase;
320
+ if (value.secretKey) {
321
+ const resolved = this.#sealPassphrase();
322
+ passphrase = resolved.passphrase;
323
+ newVerifier = resolved.newVerifier;
324
+ sealed = encryptSecret(value.secretKey, passphrase, this.#argonParams);
325
+ }
171
326
  this.#mutate(() => {
327
+ // A secret sealed outside the lock must never be persisted under a
328
+ // passphrase that diverges from the keystore verifier (the key-loss class
329
+ // ADR 080 exists to prevent). Reconcile our seal-time view with whatever the
330
+ // reload sees before committing.
331
+ if (value.secretKey) {
332
+ if (this.#verifier === undefined && newVerifier !== undefined) {
333
+ // Establishing, and no concurrent writer beat us to it: record our verifier.
334
+ this.#verifier = newVerifier;
335
+ }
336
+ else if (this.#verifier !== undefined && passphrase !== undefined) {
337
+ // A verifier exists: it pre-existed, was established concurrently while we
338
+ // sealed, or was rotated by a concurrent change-passphrase. If it was
339
+ // rotated out from under our seal, abort with a clear message; otherwise
340
+ // assert our passphrase still opens it before persisting the key.
341
+ if (verifierAtSeal !== undefined && !sameEnvelope(this.#verifier, verifierAtSeal)) {
342
+ throw new KeyStoreError(`The keystore passphrase at ${this.#path} changed concurrently; re-run the command.`, 'KEYSTORE_CONCURRENT_CHANGE_ERROR', { path: this.#path });
343
+ }
344
+ this.#assertPassphrase(passphrase);
345
+ }
346
+ }
172
347
  this.#cache.set(id, {
173
348
  publicKey: value.publicKey,
174
349
  ...(value.tags && { tags: value.tags }),
175
- ...(secret && { secret }),
350
+ ...(sealed && { secret: sealed }),
176
351
  ...(value.secretKey && { decrypted: value.secretKey }),
177
352
  });
178
353
  });
@@ -240,5 +415,186 @@ export class FileKeyStore {
240
415
  this.#active = id;
241
416
  });
242
417
  }
418
+ /** The keystore's protection mode. */
419
+ get protection() {
420
+ return this.#protection;
421
+ }
422
+ /**
423
+ * Re-seals every sealed secret and the verifier under a new passphrase (ADR
424
+ * 080), returning the number of secrets re-sealed. Verifies the current
425
+ * passphrase against the verifier first. Refused on a dev keystore, which has
426
+ * no passphrase.
427
+ */
428
+ changePassphrase(oldPassphrase, newPassphrase) {
429
+ if (this.#protection === 'none') {
430
+ throw new KeyStoreError(`The keystore at ${this.#path} is an unencrypted dev keystore; it has no passphrase to change.`, 'KEYSTORE_PROTECTION_ERROR', { path: this.#path });
431
+ }
432
+ // Fail a wrong current passphrase up front (when a verifier exists) so a typo
433
+ // does not pay for a full re-seal before failing.
434
+ if (this.#verifier)
435
+ this.#assertPassphrase(oldPassphrase);
436
+ // Precompute every re-seal and the new verifier BEFORE taking the lock:
437
+ // argon2id is deliberately slow, and holding the exclusive lock across many
438
+ // derivations could exceed the lock's stale threshold and let a concurrent
439
+ // process break a still-live lock. Each re-seal records the source envelope
440
+ // it derived from, so the locked section can abort on any concurrent change
441
+ // instead of corrupting. This follows the same do-expensive-work-before-the-
442
+ // lock contract as set().
443
+ const resealed = new Map();
444
+ for (const [id, entry] of this.#cache) {
445
+ if (!entry.secret)
446
+ continue;
447
+ let plain;
448
+ try {
449
+ plain = decryptSecret(entry.secret, oldPassphrase);
450
+ }
451
+ catch {
452
+ throw new KeyStoreError(`Incorrect current passphrase for the keystore at ${this.#path}.`, 'DECRYPT_ERROR', { path: this.#path });
453
+ }
454
+ resealed.set(id, { from: entry.secret, to: encryptSecret(plain, newPassphrase, this.#argonParams), plain });
455
+ }
456
+ const newVerifier = encryptSecret(VERIFIER_PLAINTEXT, newPassphrase, this.#argonParams);
457
+ let rekeyed = 0;
458
+ this.#mutate(() => {
459
+ // The reload reflects any concurrent writer. Apply a precomputed re-seal
460
+ // only where the on-disk envelope still matches what it was derived from;
461
+ // abort if any sealed key changed or a new sealed key appeared that was not
462
+ // re-sealed, rather than leave a key under the old passphrase.
463
+ for (const [id, entry] of this.#cache) {
464
+ if (!entry.secret)
465
+ continue;
466
+ const pre = resealed.get(id);
467
+ if (!pre || !sameEnvelope(pre.from, entry.secret)) {
468
+ throw new KeyStoreError(`The keystore at ${this.#path} changed while its passphrase was being changed; re-run the command.`, 'KEYSTORE_CONCURRENT_CHANGE_ERROR', { path: this.#path });
469
+ }
470
+ entry.secret = pre.to;
471
+ entry.decrypted = pre.plain;
472
+ rekeyed++;
473
+ }
474
+ this.#verifier = newVerifier;
475
+ });
476
+ return rekeyed;
477
+ }
478
+ }
479
+ /**
480
+ * Summarizes a keystore file by structure alone: protection mode, whether a
481
+ * passphrase is established, key count, and active key. Never decrypts, never
482
+ * prompts, and never throws (a missing or unreadable file reports `absent`), so
483
+ * it is safe for `keystore status`, `config path`, and the mainnet dev-keystore
484
+ * guard.
485
+ */
486
+ export function keystoreSummary(path) {
487
+ const absent = { protection: 'absent', established: false, keyCount: 0, active: undefined };
488
+ if (!existsSync(path))
489
+ return absent;
490
+ let parsed;
491
+ try {
492
+ parsed = JSON.parse(readFileSync(path, 'utf-8'));
493
+ }
494
+ catch {
495
+ return absent;
496
+ }
497
+ const keys = (parsed.keys && typeof parsed.keys === 'object') ? parsed.keys : {};
498
+ const keyCount = Object.keys(keys).length;
499
+ const active = typeof parsed.active === 'string' ? parsed.active : undefined;
500
+ if (parsed.protection === 'none') {
501
+ return { protection: 'dev', established: true, keyCount, active };
502
+ }
503
+ if (parsed.protection === 'passphrase') {
504
+ // An encrypted keystore is "established" once its passphrase verifier exists
505
+ // (written by `init` or the first key-seal). Without it the passphrase has not
506
+ // been set yet: a freshly-created, still-empty encrypted keystore.
507
+ return { protection: 'encrypted', established: parsed.verifier !== undefined, keyCount, active };
508
+ }
509
+ // No recognized protection header: not a keystore this CLI wrote. Report absent
510
+ // (never throw) so `keystore status` stays a safe, no-decrypt introspection; an
511
+ // actual open of such a file is refused by FileKeyStore.
512
+ return absent;
513
+ }
514
+ /** The protection label of a keystore file, without decrypting or prompting. */
515
+ export function keystoreProtection(path) {
516
+ return keystoreSummary(path).protection;
517
+ }
518
+ /**
519
+ * A stable fingerprint of a keystore's passphrase verifier, or `undefined` when
520
+ * the file is absent, unparsable, or carries no verifier. Compared by equality
521
+ * to detect a rotated passphrase (`change-passphrase`, `init --force`) or a
522
+ * re-established keystore, so a cached session (ADR 081) stops matching a
523
+ * keystore whose passphrase has changed. Never decrypts, never throws.
524
+ */
525
+ export function keystoreVerifierId(path) {
526
+ if (!existsSync(path))
527
+ return undefined;
528
+ let parsed;
529
+ try {
530
+ parsed = JSON.parse(readFileSync(path, 'utf-8'));
531
+ }
532
+ catch {
533
+ return undefined;
534
+ }
535
+ if (!parsed.verifier)
536
+ return undefined;
537
+ return base64urlnopad.encode(sha256(utf8ToBytes(JSON.stringify(parsed.verifier))));
538
+ }
539
+ /**
540
+ * Checks a candidate passphrase against the keystore's verifier without
541
+ * constructing a store or opening any key. Returns `false` for an absent,
542
+ * unparsable, dev, or verifier-less keystore and for a wrong passphrase; `true`
543
+ * only when the passphrase opens the verifier sentinel. Never throws. Used by
544
+ * `keystore unlock` (ADR 081) to refuse caching a wrong passphrase.
545
+ */
546
+ export function verifyKeystorePassphrase(path, passphrase) {
547
+ if (!existsSync(path))
548
+ return false;
549
+ let parsed;
550
+ try {
551
+ parsed = JSON.parse(readFileSync(path, 'utf-8'));
552
+ }
553
+ catch {
554
+ return false;
555
+ }
556
+ if (parsed.protection !== 'passphrase' || !parsed.verifier)
557
+ return false;
558
+ try {
559
+ return bytesEqual(decryptSecret(parsed.verifier, passphrase), VERIFIER_PLAINTEXT);
560
+ }
561
+ catch {
562
+ return false;
563
+ }
564
+ }
565
+ /**
566
+ * Establishes a fresh keystore file (ADR 080). An encrypted keystore prompts
567
+ * (with confirm) for the passphrase and writes the verifier; a dev keystore
568
+ * writes a plaintext-mode header with no passphrase. The caller is responsible
569
+ * for refusing to overwrite an existing keystore; this always writes the file.
570
+ */
571
+ export function initKeystore(path, options) {
572
+ ensureDir(dirname(path), 0o700);
573
+ let file;
574
+ if (options.protection === 'none') {
575
+ file = { v: KEYSTORE_VERSION, protection: 'none', keys: {} };
576
+ }
577
+ else {
578
+ const passphrase = options.getPassphrase({ confirm: true });
579
+ const verifier = encryptSecret(VERIFIER_PLAINTEXT, passphrase, options.argonParams ?? DEFAULT_ARGON_PARAMS);
580
+ file = { v: KEYSTORE_VERSION, protection: 'passphrase', verifier, keys: {} };
581
+ }
582
+ writeFileAtomic(path, `${JSON.stringify(file, null, 2)}\n`, 0o600);
583
+ }
584
+ /**
585
+ * Re-seals every secret in an encrypted keystore under a new passphrase (ADR
586
+ * 080), returning the count re-sealed. The old and new passphrases are supplied
587
+ * explicitly, so the store's own passphrase provider is never invoked (a wrong
588
+ * current passphrase is caught by the verifier). Refused on a dev keystore.
589
+ */
590
+ export function changeKeystorePassphrase(path, oldPassphrase, newPassphrase, argonParams) {
591
+ const store = new FileKeyStore({
592
+ path,
593
+ ...(argonParams && { argonParams }),
594
+ getPassphrase: () => {
595
+ throw new KeyStoreError(`Unexpected passphrase prompt while changing the passphrase for ${path}.`, 'KEYSTORE_INTERNAL_ERROR', { path });
596
+ },
597
+ });
598
+ return store.changePassphrase(oldPassphrase, newPassphrase);
243
599
  }
244
600
  //# sourceMappingURL=file-key-store.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"file-key-store.js","sourceRoot":"","sources":["../../../../src/keystore/file-key-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAoB,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,oDAAoD;AACpD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAU,CAAC;AAoC3C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,YAAY;IACd,KAAK,CAAS;IACd,SAAS,CAAS;IAClB,YAAY,CAAc;IAC1B,cAAc,CAAe;IAC7B,YAAY,CAAc;IAC1B,MAAM,GAAmC,IAAI,GAAG,EAAE,CAAC;IAC5D,OAAO,CAAqB;IAE5B,YAAY,OAA4B;QACtC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,GAAG,IAAI,CAAC,KAAK,OAAO,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAChE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAED,aAAa;QACX,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO;QACpC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAiB,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,aAAa,CACrB,eAAe,IAAI,CAAC,KAAK,4BAA4B,EACrD,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC;YAClC,MAAM,IAAI,aAAa,CACrB,iCAAiC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EACpD,wBAAwB,EACxB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,KAAK,MAAM,CAAE,EAAE,EAAE,MAAM,CAAE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,SAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBAC/E,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,8BAA8B,EAClD,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;YACJ,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC5B,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,UAAU,SAAS,CAAC,MAAM,gCAAgC,EAC9E,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;gBAClB,SAAS;gBACT,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM;QACJ,MAAM,IAAI,GAA8B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,EAAE,CAAC,GAAG;gBACT,SAAS,EAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;gBAClD,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACvC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;aAC9C,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAiB;YACzB,CAAC,EAAG,gBAAgB;YACpB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7C,IAAI;SACL,CAAC;QACF,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoE,CAAC;QAC5F,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,OAAO,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnF,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,KAAiB;QACvB,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YAChC,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,KAAK,EAAE,CAAC;YACR,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACxB,CAAC;IAED,GAAG,CAAC,EAAiB;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,MAAM,GAAa;YACvB,SAAS,EAAG,KAAK,CAAC,SAAS;YAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SACxC,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,uEAAuE;YACvE,uEAAuE;YACvE,0EAA0E;YAC1E,0EAA0E;YAC1E,sBAAsB;YACtB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC5B,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE;gBACzC,YAAY,EAAG,IAAI;gBACnB,UAAU,EAAK,KAAK;gBACpB,GAAG,EAAY,GAAe,EAAE;oBAC9B,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;oBACjE,OAAO,KAAK,CAAC,SAAS,CAAC;gBACzB,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,GAAG,CAAC,EAAiB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,GAAG,CAAC,EAAiB,EAAE,KAAe;QACpC,4EAA4E;QAC5E,oEAAoE;QACpE,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS;YAC5B,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC;YAC1E,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;gBAClB,SAAS,EAAG,KAAK,CAAC,SAAS;gBAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACvC,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC;gBACzB,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,EAAiB;QACtB,4EAA4E;QAC5E,8EAA8E;QAC9E,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE;gBAAE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC/D,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACjF,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAE,AAAD,EAAG,KAAK,CAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,MAAM,GAAG,GAAqC,EAAE,CAAC;QACjD,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,CAAE,EAAE,EAAE;oBACb,SAAS,EAAG,KAAK,CAAC,SAAS;oBAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;iBACxC,CAAE,CAAC,CAAC;QACP,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK;QACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,wEAAwE;IACxE,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,EAA6B;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,wEAAwE;YACxE,0DAA0D;YAC1D,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,aAAa,CAAC,qCAAqC,EAAE,GAAG,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC5G,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
1
+ {"version":3,"file":"file-key-store.js","sourceRoot":"","sources":["../../../../src/keystore/file-key-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAoB,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,oDAAoD;AACpD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAU,CAAC;AAW3C;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,WAAW,CAAC,gCAAgC,CAAC,CAAC;AAEzE,0EAA0E;AAC1E,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,iFAAiF;AACjF,SAAS,YAAY,CAAC,CAA6B,EAAE,CAA6B;IAChF,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AA0DD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,YAAY;IACd,KAAK,CAAS;IACd,SAAS,CAAS;IAClB,YAAY,CAAc;IAC1B,cAAc,CAA2C;IACzD,YAAY,CAAc;IAC1B,MAAM,GAAmC,IAAI,GAAG,EAAE,CAAC;IAC5D,OAAO,CAAqB;IAC5B,WAAW,CAAqB;IAChC,SAAS,CAA6B;IAEtC,YAAY,OAA4B;QACtC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,GAAG,IAAI,CAAC,KAAK,OAAO,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAChE,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;QACtD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAED,aAAa;QACX,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO;QACpC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAiB,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,aAAa,CACrB,eAAe,IAAI,CAAC,KAAK,4BAA4B,EACrD,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC;YAClC,MAAM,IAAI,aAAa,CACrB,iCAAiC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EACpD,wBAAwB,EACxB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CACtB,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,uEAAuE;QACvE,0EAA0E;QAC1E,aAAa;QACb,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;YACvE,MAAM,IAAI,aAAa,CACrB,eAAe,IAAI,CAAC,KAAK,uEAAuE,EAChG,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,4EAA4E;QAC5E,8EAA8E;QAC9E,8EAA8E;QAC9E,wEAAwE;QACxE,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CACzD,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAe,CAAC,MAAM,KAAK,SAAS,CACzE,CAAC;QACF,IAAI,IAAI,CAAC,WAAW,KAAK,YAAY,IAAI,aAAa,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvF,MAAM,IAAI,aAAa,CACrB,eAAe,IAAI,CAAC,KAAK,oFAAoF,EAC7G,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAE,EAAE,EAAE,MAAM,CAAE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,SAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBAC/E,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,8BAA8B,EAClD,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;YACJ,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC5B,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,UAAU,SAAS,CAAC,MAAM,gCAAgC,EAC9E,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAe,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACnF,2EAA2E;YAC3E,4EAA4E;YAC5E,yEAAyE;YACzE,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACrC,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;oBAChC,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,yDAAyD,IAAI,CAAC,KAAK,GAAG,EAC1F,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;gBACJ,CAAC;gBACD,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;gBACvB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACpE,CAAC;iBAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;oBACtC,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,+CAA+C,IAAI,CAAC,KAAK,GAAG,EAChF,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;gBACJ,CAAC;gBACD,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,kBAAkB,CAAC,OAAe,EAAE,EAAiB;QACnD,IAAI,MAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,oCAAoC,EACxD,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,UAAU,MAAM,CAAC,MAAM,4BAA4B,EACvE,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM;QACJ,MAAM,IAAI,GAA8B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,MAAM,GAAc,EAAE,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAChF,IAAI,KAAK,CAAC,IAAI;gBAAE,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACzC,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACvC,MAAM,CAAC,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC9D,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxB,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC/B,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC;QACpB,CAAC;QACD,0EAA0E;QAC1E,4EAA4E;QAC5E,uDAAuD;QACvD,MAAM,IAAI,GAAiB;YACzB,CAAC,EAAY,gBAAgB;YAC7B,UAAU,EAAG,IAAI,CAAC,WAAW;YAC7B,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YACnD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7C,IAAI;SACL,CAAC;QACF,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;OAOG;IACH,OAAO;QACL,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoE,CAAC;QAC5F,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,OAAO,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnF,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,KAAiB;QACvB,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YAChC,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,KAAK,EAAE,CAAC;YACR,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,UAAkB;QAClC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5B,IAAI,KAAiB,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,aAAa,CACrB,4CAA4C,IAAI,CAAC,KAAK,GAAG,EACzD,eAAe,EACf,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,aAAa,CACrB,wBAAwB,IAAI,CAAC,KAAK,0CAA0C,EAC5E,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,eAAe;QACb,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACzC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACnC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,eAAe;QACb,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACzC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACnC,OAAO,EAAE,UAAU,EAAE,CAAC;QACxB,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,aAAa,CAAC,kBAAkB,EAAE,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACrF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IACrC,CAAC;IAED,GAAG,CAAC,EAAiB;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,MAAM,GAAa;YACvB,SAAS,EAAG,KAAK,CAAC,SAAS;YAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SACxC,CAAC;QACF,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACvC,yEAAyE;YACzE,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC;YAC/B,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE;gBACzC,YAAY,EAAG,IAAI;gBACnB,UAAU,EAAK,KAAK;gBACpB,GAAG,EAAY,GAAe,EAAE,CAAC,MAAM;aACxC,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACxB,2EAA2E;YAC3E,qEAAqE;YACrE,yEAAyE;YACzE,4CAA4C;YAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC5B,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE;gBACzC,YAAY,EAAG,IAAI;gBACnB,UAAU,EAAK,KAAK;gBACpB,GAAG,EAAY,GAAe,EAAE;oBAC9B,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;oBAClE,OAAO,KAAK,CAAC,SAAS,CAAC;gBACzB,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,GAAG,CAAC,EAAiB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,GAAG,CAAC,EAAiB,EAAE,KAAe;QACpC,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;YAChC,6DAA6D;YAC7D,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;gBAChB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;oBAClB,SAAS,EAAG,KAAK,CAAC,SAAS;oBAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;oBACvC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;iBACxE,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,6EAA6E;QAC7E,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;QACtC,IAAI,MAAkC,CAAC;QACvC,IAAI,WAAuC,CAAC;QAC5C,IAAI,UAA8B,CAAC;QACnC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACxC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;YACjC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;YACnC,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,mEAAmE;YACnE,0EAA0E;YAC1E,6EAA6E;YAC7E,iCAAiC;YACjC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC9D,6EAA6E;oBAC7E,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC;gBAC/B,CAAC;qBAAM,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBACpE,2EAA2E;oBAC3E,sEAAsE;oBACtE,yEAAyE;oBACzE,kEAAkE;oBAClE,IAAI,cAAc,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC;wBAClF,MAAM,IAAI,aAAa,CACrB,8BAA8B,IAAI,CAAC,KAAK,4CAA4C,EACpF,kCAAkC,EAClC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;oBACJ,CAAC;oBACD,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;gBAClB,SAAS,EAAG,KAAK,CAAC,SAAS;gBAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACvC,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACjC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,EAAiB;QACtB,4EAA4E;QAC5E,8EAA8E;QAC9E,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE;gBAAE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC/D,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACjF,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAE,AAAD,EAAG,KAAK,CAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,MAAM,GAAG,GAAqC,EAAE,CAAC;QACjD,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,CAAE,EAAE,EAAE;oBACb,SAAS,EAAG,KAAK,CAAC,SAAS;oBAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;iBACxC,CAAE,CAAC,CAAC;QACP,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK;QACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,wEAAwE;IACxE,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,EAA6B;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,wEAAwE;YACxE,0DAA0D;YAC1D,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,aAAa,CAAC,qCAAqC,EAAE,GAAG,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC5G,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,sCAAsC;IACtC,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,aAAqB,EAAE,aAAqB;QAC3D,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,aAAa,CACrB,mBAAmB,IAAI,CAAC,KAAK,kEAAkE,EAC/F,2BAA2B,EAC3B,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;QACJ,CAAC;QACD,8EAA8E;QAC9E,kDAAkD;QAClD,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAC1D,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,6EAA6E;QAC7E,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkF,CAAC;QAC3G,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,SAAS;YAC5B,IAAI,KAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,aAAa,CACrB,oDAAoD,IAAI,CAAC,KAAK,GAAG,EACjE,eAAe,EACf,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,aAAa,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,WAAW,GAAG,aAAa,CAAC,kBAAkB,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACxF,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,yEAAyE;YACzE,0EAA0E;YAC1E,4EAA4E;YAC5E,+DAA+D;YAC/D,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACxC,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,SAAS;gBAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7B,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClD,MAAM,IAAI,aAAa,CACrB,mBAAmB,IAAI,CAAC,KAAK,sEAAsE,EACnG,kCAAkC,EAClC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;gBACJ,CAAC;gBACD,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAUD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,MAAM,GAAoB,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC7G,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAiB,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7E,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QACvC,6EAA6E;QAC7E,+EAA+E;QAC/E,mEAAmE;QACnE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnG,CAAC;IACD,gFAAgF;IAChF,gFAAgF;IAChF,yDAAyD;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAiB,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,UAAkB;IACvE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAiB,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzE,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAA4B;IACrE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAChC,IAAI,IAAkB,CAAC;IACvB,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QAClC,IAAI,GAAG,EAAE,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,aAAa,CAAC,kBAAkB,EAAE,UAAU,EAAE,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;QAC5G,IAAI,GAAG,EAAE,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC/E,CAAC;IACD,eAAe,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAsB,EACtB,aAAsB,EACtB,aAAsB,EACtB,WAA2B;IAE3B,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC;QAC7B,IAAI;QACJ,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;QACnC,aAAa,EAAG,GAAG,EAAE;YACnB,MAAM,IAAI,aAAa,CACrB,kEAAkE,IAAI,GAAG,EACzE,yBAAyB,EACzB,EAAE,IAAI,EAAE,CACT,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,gBAAgB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AAC9D,CAAC"}