@embassys/ambassador 0.0.0 → 0.2.6

package/dist/credential-store.js

@@ -0,0 +1,517 @@
+import { execFile } from "node:child_process";
+import { createCipheriv, createDecipheriv, randomBytes, scrypt } from "node:crypto";
+import { constants } from "node:fs";
+import { link, lstat, mkdir, open, rename, unlink } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { TextDecoder } from "node:util";
+import { parseCentralCredential } from "./central-credential.js";
+const FILE_FORMAT = 1;
+const SCRYPT_N = 131_072;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+const SCRYPT_MAXMEM = 256 * 1024 * 1024;
+const KEY_BYTES = 32;
+const SALT_BYTES = 16;
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+const MAX_PLAINTEXT_BYTES = 8_192;
+const MAX_FILE_BYTES = 16_384;
+const SYSTEM_SID = "S-1-5-18";
+const LOCAL_TOKEN = /^[0-9a-f]{48}$/u;
+const BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u;
+const ENVELOPE_KEYS = [
+    "cipher",
+    "ciphertext",
+    "iv",
+    "kdf",
+    "n",
+    "p",
+    "r",
+    "salt",
+    "tag",
+    "version",
+];
+const AAD_METADATA = {
+    kdf: "scrypt",
+    n: SCRYPT_N,
+    r: SCRYPT_R,
+    p: SCRYPT_P,
+    cipher: "aes-256-gcm",
+};
+const savingPaths = new Set();
+function invalidCredential() {
+    return new Error("The credential store is invalid or cannot be decrypted");
+}
+function credentialExists() {
+    return new Error("A central identity is already stored");
+}
+function errorCode(error) {
+    return error !== null && typeof error === "object" && "code" in error
+        ? String(error.code)
+        : undefined;
+}
+function sameArtifact(left, right) {
+    return left.dev === right.dev && left.ino === right.ino;
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function decodeBase64(value, expectedBytes) {
+    if (typeof value !== "string" || !BASE64.test(value))
+        throw invalidCredential();
+    const decoded = Buffer.from(value, "base64");
+    if (decoded.toString("base64") !== value)
+        throw invalidCredential();
+    if (expectedBytes !== undefined && decoded.length !== expectedBytes)
+        throw invalidCredential();
+    return decoded;
+}
+function parseEnvelope(bytes) {
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw invalidCredential();
+    }
+    if (!isRecord(value))
+        throw invalidCredential();
+    const keys = Object.keys(value).sort();
+    if (keys.length !== ENVELOPE_KEYS.length ||
+        !ENVELOPE_KEYS.every((key, index) => keys[index] === key) ||
+        value.version !== FILE_FORMAT ||
+        value.kdf !== "scrypt" ||
+        value.n !== SCRYPT_N ||
+        value.r !== SCRYPT_R ||
+        value.p !== SCRYPT_P ||
+        value.cipher !== "aes-256-gcm") {
+        throw invalidCredential();
+    }
+    const ciphertext = decodeBase64(value.ciphertext);
+    if (ciphertext.length < 1 || ciphertext.length > MAX_PLAINTEXT_BYTES) {
+        throw invalidCredential();
+    }
+    return {
+        salt: decodeBase64(value.salt, SALT_BYTES),
+        iv: decodeBase64(value.iv, IV_BYTES),
+        tag: decodeBase64(value.tag, TAG_BYTES),
+        ciphertext,
+    };
+}
+function deriveKey(localToken, salt) {
+    return new Promise((resolveKey, reject) => {
+        scrypt(localToken, salt, KEY_BYTES, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P, maxmem: SCRYPT_MAXMEM }, (error, key) => (error === null ? resolveKey(key) : reject(error)));
+    });
+}
+function assertSid(value) {
+    if (!/^S-1-(?:0|[1-9][0-9]*)(?:-(?:0|[1-9][0-9]*)){1,15}$/u.test(value)) {
+        throw new Error("Current Windows identity is unavailable");
+    }
+    const components = value.split("-").slice(2);
+    const authority = components.shift();
+    if (authority === undefined || BigInt(authority) > 281474976710655n) {
+        throw new Error("Current Windows identity is unavailable");
+    }
+    if (components.some((component) => BigInt(component) > 4294967295n)) {
+        throw new Error("Current Windows identity is unavailable");
+    }
+    return value;
+}
+function runExecutable(file, arguments_) {
+    return new Promise((resolveOutput, reject) => {
+        execFile(file, arguments_, { encoding: "utf8", maxBuffer: 32 * 1024, windowsHide: true }, (error, stdout, stderr) => {
+            if (error !== null || stderr.length !== 0) {
+                reject(new Error("Windows credential access control failed"));
+                return;
+            }
+            resolveOutput(stdout);
+        });
+    });
+}
+const WINDOWS_ACL_SCRIPT = `
+$ErrorActionPreference = 'Stop'
+if ($args.Count -ne 3) { exit 41 }
+$target = $args[0]
+$userSid = $args[1]
+$kind = $args[2]
+$item = Get-Item -LiteralPath $target -Force
+if (($kind -eq 'directory') -ne $item.PSIsContainer) { exit 42 }
+if ($kind -ne 'directory' -and $kind -ne 'file') { exit 43 }
+$security = if ($kind -eq 'directory') {
+  New-Object System.Security.AccessControl.DirectorySecurity
+} else {
+  New-Object System.Security.AccessControl.FileSecurity
+}
+$security.SetAccessRuleProtection($true, $false)
+$inheritance = if ($kind -eq 'directory') {
+  [System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit'
+} else {
+  [System.Security.AccessControl.InheritanceFlags]::None
+}
+$expected = @($userSid, '${SYSTEM_SID}') | Select-Object -Unique
+foreach ($sid in $expected) {
+  $identity = New-Object System.Security.Principal.SecurityIdentifier($sid)
+  $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
+    $identity,
+    [System.Security.AccessControl.FileSystemRights]::FullControl,
+    $inheritance,
+    [System.Security.AccessControl.PropagationFlags]::None,
+    [System.Security.AccessControl.AccessControlType]::Allow
+  )
+  [void]$security.AddAccessRule($rule)
+}
+Set-Acl -LiteralPath $target -AclObject $security
+$actual = Get-Acl -LiteralPath $target
+if (-not $actual.AreAccessRulesProtected) { exit 44 }
+$rules = @($actual.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]))
+if ($rules.Count -ne $expected.Count) { exit 45 }
+foreach ($rule in $rules) {
+  if ($expected -notcontains $rule.IdentityReference.Value) { exit 46 }
+  if ($rule.IsInherited) { exit 47 }
+  if ($rule.AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow) { exit 48 }
+  if ([int]$rule.FileSystemRights -ne [int][System.Security.AccessControl.FileSystemRights]::FullControl) { exit 49 }
+  if ($rule.InheritanceFlags -ne $inheritance) { exit 50 }
+  if ($rule.PropagationFlags -ne [System.Security.AccessControl.PropagationFlags]::None) { exit 51 }
+}
+[Console]::Out.Write('A2A_ACL_OK')
+`;
+class BuiltInWindowsCredentialAccessControl {
+    #userSid;
+    async secure(path, kind) {
+        this.#userSid ??= this.#readUserSid();
+        const sid = await this.#userSid;
+        const output = await runExecutable("powershell.exe", [
+            "-NoLogo",
+            "-NoProfile",
+            "-NonInteractive",
+            "-Command",
+            WINDOWS_ACL_SCRIPT,
+            path,
+            sid,
+            kind,
+        ]);
+        if (output !== "A2A_ACL_OK")
+            throw new Error("Windows credential access control failed");
+    }
+    async #readUserSid() {
+        const output = await runExecutable("whoami.exe", ["/user", "/fo", "csv", "/nh"]);
+        const match = /^(?:"(?:[^"]|"")*"),"([^"]+)"\r?\n?$/u.exec(output);
+        if (match?.[1] === undefined)
+            throw new Error("Current Windows identity is unavailable");
+        return assertSid(match[1]);
+    }
+}
+export class EncryptedFileCredentialStore {
+    #path;
+    #directoryPath;
+    #localToken;
+    #credentialScope;
+    #platform;
+    #windowsAccessControl;
+    constructor(path, localToken, credentialScope, options = {}) {
+        if (!LOCAL_TOKEN.test(localToken))
+            throw new Error("The local token format is invalid");
+        if (typeof credentialScope !== "string" || credentialScope.length < 1) {
+            throw new Error("The credential scope is invalid");
+        }
+        this.#path = resolve(path);
+        this.#directoryPath = dirname(this.#path);
+        this.#localToken = Buffer.from(localToken, "hex");
+        this.#credentialScope = credentialScope;
+        this.#platform = options.platform ?? process.platform;
+        if (this.#platform === "win32") {
+            this.#windowsAccessControl =
+                options.windowsAccessControl ?? new BuiltInWindowsCredentialAccessControl();
+        }
+    }
+    async load() {
+        const directory = await this.#openDirectory(false);
+        if (directory === undefined)
+            return undefined;
+        try {
+            try {
+                const plaintext = await this.#readCredentialPath(this.#path);
+                await this.#verifyDirectory(directory);
+                return plaintext;
+            }
+            catch (error) {
+                if (errorCode(error) === "ENOENT") {
+                    await this.#verifyDirectory(directory);
+                    return undefined;
+                }
+                throw error;
+            }
+        }
+        finally {
+            await directory.handle?.close();
+        }
+    }
+    async save(plaintext) {
+        if (typeof plaintext !== "string" ||
+            plaintext.length < 1 ||
+            Buffer.byteLength(plaintext, "utf8") > MAX_PLAINTEXT_BYTES) {
+            throw new Error("The central credential is invalid");
+        }
+        parseCentralCredential(plaintext);
+        if (savingPaths.has(this.#path))
+            throw credentialExists();
+        savingPaths.add(this.#path);
+        let directory;
+        let temporaryPath;
+        let temporaryFile;
+        let temporaryCreated = false;
+        let finalCreated = false;
+        let committed = false;
+        try {
+            directory = await this.#openDirectory(true);
+            if (directory === undefined)
+                throw invalidCredential();
+            await this.#assertCredentialAbsent();
+            const salt = randomBytes(SALT_BYTES);
+            const iv = randomBytes(IV_BYTES);
+            let key;
+            let ciphertext;
+            let tag;
+            try {
+                key = await deriveKey(this.#localToken, salt);
+                const cipher = createCipheriv("aes-256-gcm", key, iv, { authTagLength: TAG_BYTES });
+                cipher.setAAD(this.#additionalData());
+                ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+                tag = cipher.getAuthTag();
+            }
+            finally {
+                key?.fill(0);
+            }
+            const envelope = {
+                version: FILE_FORMAT,
+                kdf: "scrypt",
+                n: SCRYPT_N,
+                r: SCRYPT_R,
+                p: SCRYPT_P,
+                salt: salt.toString("base64"),
+                cipher: "aes-256-gcm",
+                iv: iv.toString("base64"),
+                tag: tag.toString("base64"),
+                ciphertext: ciphertext.toString("base64"),
+            };
+            const serialized = Buffer.from(JSON.stringify(envelope), "ascii");
+            await this.#verifyDirectory(directory);
+            temporaryPath = `${this.#path}.tmp-${process.pid}-${randomBytes(16).toString("hex")}`;
+            const noFollow = this.#platform === "win32" ? 0 : constants.O_NOFOLLOW;
+            temporaryFile = await open(temporaryPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | noFollow, 0o600);
+            temporaryCreated = true;
+            await this.#verifyOpenFile(temporaryPath, temporaryFile, undefined, false);
+            if (this.#platform === "win32") {
+                await this.#windowsAccessControl?.secure(temporaryPath, "file");
+            }
+            else {
+                await temporaryFile.chmod(0o600);
+            }
+            await this.#verifyOpenFile(temporaryPath, temporaryFile);
+            await temporaryFile.writeFile(serialized);
+            await temporaryFile.sync();
+            await temporaryFile.close();
+            temporaryFile = undefined;
+            if ((await this.#readCredentialPath(temporaryPath)) !== plaintext)
+                throw invalidCredential();
+            await this.#verifyDirectory(directory);
+            await this.#assertCredentialAbsent();
+            if (this.#platform === "win32") {
+                await rename(temporaryPath, this.#path);
+                temporaryCreated = false;
+                finalCreated = true;
+            }
+            else {
+                await link(temporaryPath, this.#path);
+                finalCreated = true;
+                await unlink(temporaryPath);
+                temporaryCreated = false;
+            }
+            const finalFile = await this.#openExistingFile(this.#path, true);
+            try {
+                await finalFile.sync();
+            }
+            finally {
+                await finalFile.close();
+            }
+            await this.#verifyDirectory(directory);
+            await directory.handle?.sync();
+            if ((await this.#readCredentialPath(this.#path)) !== plaintext)
+                throw invalidCredential();
+            committed = true;
+        }
+        finally {
+            savingPaths.delete(this.#path);
+            await temporaryFile?.close().catch(() => undefined);
+            if (!committed && finalCreated)
+                await unlink(this.#path).catch(() => undefined);
+            if (!committed && temporaryCreated && temporaryPath !== undefined) {
+                await unlink(temporaryPath).catch(() => undefined);
+            }
+            await directory?.handle?.close().catch(() => undefined);
+        }
+    }
+    #additionalData() {
+        return Buffer.from(JSON.stringify({
+            version: FILE_FORMAT,
+            ...AAD_METADATA,
+            credentialScope: this.#credentialScope,
+        }), "utf8");
+    }
+    async #readCredentialPath(path) {
+        const file = await this.#openExistingFile(path, false);
+        try {
+            const stats = await file.stat({ bigint: true });
+            if (stats.size < 1n || stats.size > BigInt(MAX_FILE_BYTES))
+                throw invalidCredential();
+            const bytes = await file.readFile();
+            const currentStats = await file.stat({ bigint: true });
+            if (bytes.length !== Number(stats.size) || !sameArtifact(stats, currentStats)) {
+                throw invalidCredential();
+            }
+            const envelope = parseEnvelope(bytes);
+            let key;
+            let decoded;
+            try {
+                key = await deriveKey(this.#localToken, envelope.salt);
+                const decipher = createDecipheriv("aes-256-gcm", key, envelope.iv, {
+                    authTagLength: TAG_BYTES,
+                });
+                decipher.setAAD(this.#additionalData());
+                decipher.setAuthTag(envelope.tag);
+                decoded = Buffer.concat([decipher.update(envelope.ciphertext), decipher.final()]);
+                const plaintext = new TextDecoder("utf-8", { fatal: true }).decode(decoded);
+                parseCentralCredential(plaintext);
+                return plaintext;
+            }
+            catch {
+                throw invalidCredential();
+            }
+            finally {
+                key?.fill(0);
+                decoded?.fill(0);
+            }
+        }
+        finally {
+            await file.close();
+        }
+    }
+    async #openDirectory(create) {
+        if (create)
+            await mkdir(this.#directoryPath, { recursive: true, mode: 0o700 });
+        let initialStats;
+        try {
+            initialStats = await lstat(this.#directoryPath, { bigint: true });
+        }
+        catch (error) {
+            if (!create && errorCode(error) === "ENOENT")
+                return undefined;
+            throw error;
+        }
+        if (!initialStats.isDirectory())
+            throw invalidCredential();
+        if (this.#platform === "win32") {
+            await this.#windowsAccessControl?.secure(this.#directoryPath, "directory");
+            const currentStats = await lstat(this.#directoryPath, { bigint: true });
+            if (!currentStats.isDirectory() || !sameArtifact(initialStats, currentStats)) {
+                throw invalidCredential();
+            }
+            return { stats: currentStats };
+        }
+        const handle = await open(this.#directoryPath, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+        try {
+            const descriptorStats = await handle.stat({ bigint: true });
+            const pathStats = await lstat(this.#directoryPath, { bigint: true });
+            if (!descriptorStats.isDirectory() ||
+                !pathStats.isDirectory() ||
+                !sameArtifact(initialStats, descriptorStats) ||
+                !sameArtifact(descriptorStats, pathStats) ||
+                (typeof process.getuid === "function" && descriptorStats.uid !== BigInt(process.getuid()))) {
+                throw invalidCredential();
+            }
+            await handle.chmod(0o700);
+            const securedStats = await handle.stat({ bigint: true });
+            if ((securedStats.mode & 4095n) !== 448n)
+                throw invalidCredential();
+            return { stats: securedStats, handle };
+        }
+        catch (error) {
+            await handle.close().catch(() => undefined);
+            throw error;
+        }
+    }
+    async #verifyDirectory(directory) {
+        const pathStats = await lstat(this.#directoryPath, { bigint: true });
+        const descriptorStats = directory.handle === undefined
+            ? directory.stats
+            : await directory.handle.stat({ bigint: true });
+        if (!pathStats.isDirectory() ||
+            !descriptorStats.isDirectory() ||
+            !sameArtifact(directory.stats, descriptorStats) ||
+            !sameArtifact(descriptorStats, pathStats)) {
+            throw invalidCredential();
+        }
+        if (this.#platform === "win32") {
+            await this.#windowsAccessControl?.secure(this.#directoryPath, "directory");
+        }
+        else if ((descriptorStats.mode & 4095n) !== 448n ||
+            (typeof process.getuid === "function" && descriptorStats.uid !== BigInt(process.getuid()))) {
+            throw invalidCredential();
+        }
+    }
+    async #assertCredentialAbsent() {
+        try {
+            await lstat(this.#path, { bigint: true });
+        }
+        catch (error) {
+            if (errorCode(error) === "ENOENT")
+                return;
+            throw error;
+        }
+        throw credentialExists();
+    }
+    async #openExistingFile(path, writable) {
+        const initialStats = await lstat(path, { bigint: true });
+        if (!initialStats.isFile() || initialStats.nlink !== 1n)
+            throw invalidCredential();
+        const noFollow = this.#platform === "win32" ? 0 : constants.O_NOFOLLOW;
+        const file = await open(path, (writable ? constants.O_RDWR : constants.O_RDONLY) | noFollow);
+        try {
+            await this.#verifyOpenFile(path, file, initialStats, false);
+            if (this.#platform === "win32") {
+                await this.#windowsAccessControl?.secure(path, "file");
+            }
+            else {
+                if (typeof process.getuid === "function" && initialStats.uid !== BigInt(process.getuid())) {
+                    throw invalidCredential();
+                }
+                await file.chmod(0o600);
+            }
+            await this.#verifyOpenFile(path, file, initialStats);
+            return file;
+        }
+        catch (error) {
+            await file.close().catch(() => undefined);
+            throw error;
+        }
+    }
+    async #verifyOpenFile(path, file, initialStats, requireMode = true) {
+        const descriptorStats = await file.stat({ bigint: true });
+        const pathStats = await lstat(path, { bigint: true });
+        if (!descriptorStats.isFile() ||
+            !pathStats.isFile() ||
+            descriptorStats.nlink !== 1n ||
+            pathStats.nlink !== 1n ||
+            (initialStats !== undefined && !sameArtifact(initialStats, descriptorStats)) ||
+            !sameArtifact(descriptorStats, pathStats)) {
+            throw invalidCredential();
+        }
+        if (requireMode &&
+            this.#platform !== "win32" &&
+            ((descriptorStats.mode & 4095n) !== 384n ||
+                (typeof process.getuid === "function" && descriptorStats.uid !== BigInt(process.getuid())))) {
+            throw invalidCredential();
+        }
+    }
+}
+//# sourceMappingURL=credential-store.js.map

package/dist/credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,EAAoB,SAAS,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAmB,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC7F,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,QAAQ,GAAG,OAAO,CAAC;AACzB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,aAAa,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACxC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,UAAU,GAAG,UAAU,CAAC;AAC9B,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,MAAM,GAAG,mEAAmE,CAAC;AACnF,MAAM,aAAa,GAAG;IACpB,QAAQ;IACR,YAAY;IACZ,IAAI;IACJ,KAAK;IACL,GAAG;IACH,GAAG;IACH,GAAG;IACH,MAAM;IACN,KAAK;IACL,SAAS;CACD,CAAC;AACX,MAAM,YAAY,GAAG;IACnB,GAAG,EAAE,QAAQ;IACb,CAAC,EAAE,QAAQ;IACX,CAAC,EAAE,QAAQ;IACX,CAAC,EAAE,QAAQ;IACX,MAAM,EAAE,aAAa;CACb,CAAC;AACX,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;AAoCtC,SAAS,iBAAiB;IACxB,OAAO,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK;QACnE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,IAAiB,EAAE,KAAkB;IACzD,OAAO,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,aAAsB;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,iBAAiB,EAAE,CAAC;IAChF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK;QAAE,MAAM,iBAAiB,EAAE,CAAC;IACpE,IAAI,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa;QAAE,MAAM,iBAAiB,EAAE,CAAC;IAC/F,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAMlC,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,iBAAiB,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,iBAAiB,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IACE,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM;QACpC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;QACzD,KAAK,CAAC,OAAO,KAAK,WAAW;QAC7B,KAAK,CAAC,GAAG,KAAK,QAAQ;QACtB,KAAK,CAAC,CAAC,KAAK,QAAQ;QACpB,KAAK,CAAC,CAAC,KAAK,QAAQ;QACpB,KAAK,CAAC,CAAC,KAAK,QAAQ;QACpB,KAAK,CAAC,MAAM,KAAK,aAAa,EAC9B,CAAC;QACD,MAAM,iBAAiB,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACrE,MAAM,iBAAiB,EAAE,CAAC;IAC5B,CAAC;IACD,OAAO;QACL,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC;QAC1C,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC;QACpC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC;QACvC,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB,EAAE,IAAY;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,CACJ,UAAU,EACV,IAAI,EACJ,SAAS,EACT,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,EAChE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACnE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,CAAC,sDAAsD,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC;IACrC,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,gBAAoB,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,WAAc,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,UAAoB;IACvD,OAAO,IAAI,OAAO,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;QAC3C,QAAQ,CACN,IAAI,EACJ,UAAU,EACV,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAC7D,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACxB,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,aAAa,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;2BAoBA,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BpC,CAAC;AAEF,MAAM,qCAAqC;IACzC,QAAQ,CAAmB;IAE3B,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,IAA4B;QACrD,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,gBAAgB,EAAE;YACnD,SAAS;YACT,YAAY;YACZ,iBAAiB;YACjB,UAAU;YACV,kBAAkB;YAClB,IAAI;YACJ,GAAG;YACH,IAAI;SACL,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC3F,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACjF,MAAM,KAAK,GAAG,uCAAuC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACzF,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,OAAO,4BAA4B;IAC9B,KAAK,CAAS;IACd,cAAc,CAAS;IACvB,WAAW,CAAS;IACpB,gBAAgB,CAAS;IACzB,SAAS,CAAkB;IAC3B,qBAAqB,CAAkC;IAEhE,YACE,IAAY,EACZ,UAAkB,EAClB,eAAuB,EACvB,OAAO,GAAwC,EAAE;QAEjD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACxF,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QACtD,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC,qBAAqB;gBACxB,OAAO,CAAC,oBAAoB,IAAI,IAAI,qCAAqC,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC9C,IAAI,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC7D,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBACvC,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;oBACvC,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,IACE,OAAO,SAAS,KAAK,QAAQ;YAC7B,SAAS,CAAC,MAAM,GAAG,CAAC;YACpB,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,mBAAmB,EAC1D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,gBAAgB,EAAE,CAAC;QAC1D,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,SAAuC,CAAC;QAC5C,IAAI,aAAiC,CAAC;QACtC,IAAI,aAAqC,CAAC;QAC1C,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAC7B,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,SAAS,KAAK,SAAS;gBAAE,MAAM,iBAAiB,EAAE,CAAC;YACvD,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;YACrC,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,GAAuB,CAAC;YAC5B,IAAI,UAAkB,CAAC;YACvB,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;gBACpF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;gBACtC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC/E,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5B,CAAC;oBAAS,CAAC;gBACT,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACf,CAAC;YACD,MAAM,QAAQ,GAAuB;gBACnC,OAAO,EAAE,WAAW;gBACpB,GAAG,EAAE,QAAQ;gBACb,CAAC,EAAE,QAAQ;gBACX,CAAC,EAAE,QAAQ;gBACX,CAAC,EAAE,QAAQ;gBACX,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC7B,MAAM,EAAE,aAAa;gBACrB,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACzB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC3B,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC1C,CAAC;YACF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;YAClE,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YACvC,aAAa,GAAG,GAAG,IAAI,CAAC,KAAK,QAAQ,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC;YACvE,aAAa,GAAG,MAAM,IAAI,CACxB,aAAa,EACb,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,GAAG,QAAQ,EACpE,KAAK,CACN,CAAC;YACF,gBAAgB,GAAG,IAAI,CAAC;YACxB,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YAC3E,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACN,MAAM,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;YACzD,MAAM,aAAa,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;YAC3B,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC;YAC5B,aAAa,GAAG,SAAS,CAAC;YAC1B,IAAI,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,KAAK,SAAS;gBAAE,MAAM,iBAAiB,EAAE,CAAC;YAC7F,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC/B,MAAM,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBACxC,gBAAgB,GAAG,KAAK,CAAC;gBACzB,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBACtC,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;gBAC5B,gBAAgB,GAAG,KAAK,CAAC;YAC3B,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACjE,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;YACzB,CAAC;oBAAS,CAAC;gBACT,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YAC1B,CAAC;YACD,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,SAAS;gBAAE,MAAM,iBAAiB,EAAE,CAAC;YAC1F,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,MAAM,aAAa,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,SAAS,IAAI,YAAY;gBAAE,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAChF,IAAI,CAAC,SAAS,IAAI,gBAAgB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAClE,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,eAAe;QACb,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE,WAAW;YACpB,GAAG,YAAY;YACf,eAAe,EAAE,IAAI,CAAC,gBAAgB;SACvC,CAAC,EACF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,IAAY;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,IAAI,KAAK,CAAC,IAAI,GAAG,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC;gBAAE,MAAM,iBAAiB,EAAE,CAAC;YACtF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC9E,MAAM,iBAAiB,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,GAAuB,CAAC;YAC5B,IAAI,OAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACvD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE;oBACjE,aAAa,EAAE,SAAS;iBACzB,CAAC,CAAC;gBACH,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;gBACxC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAClC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAClF,MAAM,SAAS,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC5E,sBAAsB,CAAC,SAAS,CAAC,CAAC;gBAClC,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,iBAAiB,EAAE,CAAC;YAC5B,CAAC;oBAAS,CAAC;gBACT,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;gBACb,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAe;QAClC,IAAI,MAAM;YAAE,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,IAAI,YAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC/D,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE;YAAE,MAAM,iBAAiB,EAAE,CAAC;QAC3D,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAC3E,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC7E,MAAM,iBAAiB,EAAE,CAAC;YAC5B,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,IAAI,CAAC,cAAc,EACnB,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,UAAU,CAClE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,IACE,CAAC,eAAe,CAAC,WAAW,EAAE;gBAC9B,CAAC,SAAS,CAAC,WAAW,EAAE;gBACxB,CAAC,YAAY,CAAC,YAAY,EAAE,eAAe,CAAC;gBAC5C,CAAC,YAAY,CAAC,eAAe,EAAE,SAAS,CAAC;gBACzC,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,eAAe,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAC1F,CAAC;gBACD,MAAM,iBAAiB,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,KAAO,CAAC,KAAK,IAAM;gBAAE,MAAM,iBAAiB,EAAE,CAAC;YACxE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAA2B;QAChD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,eAAe,GACnB,SAAS,CAAC,MAAM,KAAK,SAAS;YAC5B,CAAC,CAAC,SAAS,CAAC,KAAK;YACjB,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,IACE,CAAC,SAAS,CAAC,WAAW,EAAE;YACxB,CAAC,eAAe,CAAC,WAAW,EAAE;YAC9B,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC;YAC/C,CAAC,YAAY,CAAC,eAAe,EAAE,SAAS,CAAC,EACzC,CAAC;YACD,MAAM,iBAAiB,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC7E,CAAC;aAAM,IACL,CAAC,eAAe,CAAC,IAAI,GAAG,KAAO,CAAC,KAAK,IAAM;YAC3C,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,eAAe,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAC1F,CAAC;YACD,MAAM,iBAAiB,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB;QAC3B,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,OAAO;YAC1C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,gBAAgB,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,IAAY,EAAE,QAAiB;QACrD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,YAAY,CAAC,KAAK,KAAK,EAAE;YAAE,MAAM,iBAAiB,EAAE,CAAC;QACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC7F,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YAC5D,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,YAAY,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;oBAC1F,MAAM,iBAAiB,EAAE,CAAC;gBAC5B,CAAC;gBACD,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1C,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,IAAY,EACZ,IAAgB,EAChB,YAA0B,EAC1B,WAAW,GAAG,IAAI;QAElB,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,IACE,CAAC,eAAe,CAAC,MAAM,EAAE;YACzB,CAAC,SAAS,CAAC,MAAM,EAAE;YACnB,eAAe,CAAC,KAAK,KAAK,EAAE;YAC5B,SAAS,CAAC,KAAK,KAAK,EAAE;YACtB,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;YAC5E,CAAC,YAAY,CAAC,eAAe,EAAE,SAAS,CAAC,EACzC,CAAC;YACD,MAAM,iBAAiB,EAAE,CAAC;QAC5B,CAAC;QACD,IACE,WAAW;YACX,IAAI,CAAC,SAAS,KAAK,OAAO;YAC1B,CAAC,CAAC,eAAe,CAAC,IAAI,GAAG,KAAO,CAAC,KAAK,IAAM;gBAC1C,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,eAAe,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAC7F,CAAC;YACD,MAAM,iBAAiB,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;CACF"}

package/dist/delivery-profile.d.ts

@@ -0,0 +1,43 @@
+import { type AgentCapability, type DeliveryMode } from "./agent-capabilities.js";
+export type DeliveryProfileErrorCode = "incompatible_profile" | "invalid_profile" | "missing_secret" | "profile_conflict" | "profile_store_failed";
+export declare class DeliveryProfileError extends Error {
+    readonly code: DeliveryProfileErrorCode;
+    constructor(code: DeliveryProfileErrorCode);
+}
+export interface DirectDeliveryInput {
+    readonly mode: "direct";
+}
+export interface WebhookDeliveryInput {
+    readonly mode: "webhook";
+    readonly url: string;
+    readonly secret_env: string;
+}
+export type DeliveryInput = DirectDeliveryInput | WebhookDeliveryInput;
+export interface DirectDeliveryProfile {
+    readonly version: 1;
+    readonly mode: "direct";
+    readonly agent_kind: string;
+    readonly working_directory: string;
+}
+export interface WebhookDeliveryProfile {
+    readonly version: 1;
+    readonly mode: "webhook";
+    readonly agent_kind: string;
+    readonly url: string;
+    readonly secret_env: string;
+}
+export type DeliveryProfile = DirectDeliveryProfile | WebhookDeliveryProfile;
+export declare function canonicalWebhookUrl(value: string): string;
+export declare function resolveWebhookSecret(environment: NodeJS.ProcessEnv, variableName: string): string;
+export declare function createDeliveryProfile(capability: AgentCapability, delivery: DeliveryInput, workingDirectory: string, environment: NodeJS.ProcessEnv): Promise<DeliveryProfile>;
+export declare function validateStoredDeliveryProfile(profile: DeliveryProfile, workingDirectory: string): Promise<{
+    readonly profile: DeliveryProfile;
+    readonly capability: AgentCapability;
+}>;
+export declare class DeliveryProfileStore {
+    readonly path: string;
+    constructor(path: string);
+    load(): Promise<DeliveryProfile | undefined>;
+    save(profile: DeliveryProfile): Promise<void>;
+}
+export declare function deliveryMode(profile: DeliveryProfile): DeliveryMode;