@fides-anima/fpp-protocol-core 1.0.2

package/dist/steward-authorization.js

@@ -0,0 +1,483 @@
+/**
+ * Steward / operator authorization wire contracts.
+ *
+ * Key-independent human steward identity and OpenPGP-signed authorization
+ * payloads. Verification backends live in `@fides-anima/fpp-steward-auth-core`;
+ * this module defines schemas, mint/parse helpers, and domain digests only.
+ */
+import { randomBytes } from "node:crypto";
+import { Type } from "@sinclair/typebox";
+import { Value } from "@sinclair/typebox/value";
+import { digest } from "./digest.js";
+/** RFC 4648 base32 alphabet (lowercase, no padding). */
+const BASE32_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+const STEWARD_ID_RE = /^fpp:steward:v1:([a-z2-7]{26})$/;
+/** OpenPGP V4 fingerprint is 40 hex chars; V5 is 64. Accept both lowercase. */
+const OPENPGP_KEY_REF_RE = /^openpgp:([0-9a-f]{40}|[0-9a-f]{64})$/;
+/** High-entropy nonce: ≥32 chars of base64url / hex / base32. */
+const NONCE_RE = /^[A-Za-z0-9_-]{32,128}$/;
+const ISO_8601_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/;
+/** Classifications that operator authority must never satisfy. */
+const NON_DELEGABLE_CLASSIFICATIONS = new Set([
+    "affected-party-consent",
+    "data-subject-consent",
+    "constitutional-ratification",
+]);
+/**
+ * Domain separators for steward digests (not credentials).
+ * Object key is `authz` (not the secret-scanner trigger name) so static
+ * analyzers do not treat the domain string as an exposed API token.
+ */
+export const STEWARD_DIGEST_DOMAINS = {
+    evidence: "fpp:v2:steward-evidence",
+    replay: "fpp:v2:steward-replay",
+    attestation: "fpp:v2:steward-attestation",
+    authz: "fpp:v2:steward-authorization",
+    revocation: "fpp:v2:steward-authorization-revocation",
+};
+function encodeBase32(bytes) {
+    let bits = 0;
+    let value = 0;
+    let output = "";
+    for (const byte of bytes) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            output += BASE32_ALPHABET[(value >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0) {
+        output += BASE32_ALPHABET[(value << (5 - bits)) & 31];
+    }
+    return output;
+}
+/** Mint a key-independent steward ID from 128 random bits. */
+export function mintStewardIdV1() {
+    const body = encodeBase32(randomBytes(16));
+    return `fpp:steward:v1:${body}`;
+}
+export function isStewardIdV1(value) {
+    return typeof value === "string" && STEWARD_ID_RE.test(value);
+}
+export function parseStewardIdV1(value) {
+    if (typeof value !== "string") {
+        return { ok: false, error: "steward id must be a string" };
+    }
+    const match = STEWARD_ID_RE.exec(value);
+    if (!match) {
+        return {
+            ok: false,
+            error: "steward id must be fpp:steward:v1:<26 lowercase base32 chars>",
+        };
+    }
+    return {
+        ok: true,
+        stewardId: {
+            kind: "v1",
+            raw: value,
+            idBody: match[1],
+        },
+    };
+}
+export const KeyRefSchema = Type.String({
+    minLength: 1,
+    pattern: "^[a-z0-9]+:[a-z0-9]+$",
+});
+export function parseKeyRef(value) {
+    if (typeof value !== "string") {
+        return { ok: false, error: "key ref must be a string" };
+    }
+    const openpgp = OPENPGP_KEY_REF_RE.exec(value);
+    if (openpgp) {
+        return {
+            ok: true,
+            keyRef: {
+                algorithm: "openpgp",
+                identifier: openpgp[1],
+                raw: value,
+            },
+        };
+    }
+    // Future algorithms: algorithm:identifier with lowercase identifier body.
+    const generic = /^([a-z][a-z0-9]*):([a-z0-9]{8,128})$/.exec(value);
+    if (generic && generic[1] !== "openpgp") {
+        return {
+            ok: true,
+            keyRef: {
+                algorithm: generic[1],
+                identifier: generic[2],
+                raw: value,
+            },
+        };
+    }
+    return {
+        ok: false,
+        error: "key ref must be algorithm-qualified (e.g. openpgp:<lowercase fingerprint>)",
+    };
+}
+const StewardSubjectKeySchema = Type.Object({
+    algorithm: Type.String({ minLength: 1 }),
+    keyRef: Type.String({ minLength: 1 }),
+    publicKeyArmored: Type.Optional(Type.String({ minLength: 1 })),
+}, { additionalProperties: false });
+export const StewardKeyAttestationV1Schema = Type.Object({
+    schemaVersion: Type.Literal(1),
+    kind: Type.Literal("steward-key-attestation"),
+    attestationId: Type.String({ minLength: 1 }),
+    operation: Type.Union([
+        Type.Literal("initial-bind"),
+        Type.Literal("add"),
+        Type.Literal("rotate"),
+        Type.Literal("revoke"),
+    ]),
+    stewardId: Type.String({ minLength: 1 }),
+    audience: Type.String({ minLength: 1 }),
+    subjectKey: StewardSubjectKeySchema,
+    replacesKeyRef: Type.Optional(Type.String({ minLength: 1 })),
+    issuedAt: Type.String({ minLength: 1 }),
+    nonce: Type.String({ minLength: 1 }),
+    reason: Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+/** Immutable local ledger policy caps bound into a signed genesis bootstrap. */
+export const StewardBootstrapPolicyCapsV1Schema = Type.Object({
+    instanceAudience: Type.String({ minLength: 1 }),
+    maxStandingLifetimeMs: Type.Integer({ minimum: 1 }),
+    maxStandingUses: Type.Integer({ minimum: 1 }),
+    maxOneShotLifetimeMs: Type.Integer({ minimum: 1 }),
+    allowedClockSkewMs: Type.Integer({ minimum: 0 }),
+}, { additionalProperties: false });
+/**
+ * Signed steward genesis bundle: policy caps + initial key binding.
+ * Signed bytes are canonicalizeV2 of the full object (no private keys).
+ */
+export const StewardBootstrapV1Schema = Type.Object({
+    schemaVersion: Type.Literal(1),
+    kind: Type.Literal("steward-bootstrap"),
+    bootstrapId: Type.String({ minLength: 1 }),
+    stewardId: Type.String({ minLength: 1 }),
+    audience: Type.String({ minLength: 1 }),
+    policy: StewardBootstrapPolicyCapsV1Schema,
+    initialBinding: StewardKeyAttestationV1Schema,
+    issuedAt: Type.String({ minLength: 1 }),
+    nonce: Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+const AuthorizationScopeSchema = Type.Object({
+    classifications: Type.Array(Type.String({ minLength: 1 }), {
+        minItems: 1,
+    }),
+    toolNames: Type.Optional(Type.Array(Type.String({ minLength: 1 }), { minItems: 1 })),
+    resourcePaths: Type.Optional(Type.Array(Type.String({ minLength: 1 }), { minItems: 1 })),
+}, { additionalProperties: false });
+export const OperatorAuthorizationV1Schema = Type.Object({
+    schemaVersion: Type.Literal(1),
+    kind: Type.Literal("operator-authorization"),
+    authorizationId: Type.String({ minLength: 1 }),
+    stewardId: Type.String({ minLength: 1 }),
+    signingKeyRef: Type.String({ minLength: 1 }),
+    audience: Type.String({ minLength: 1 }),
+    mode: Type.Union([Type.Literal("one-shot"), Type.Literal("standing")]),
+    scope: AuthorizationScopeSchema,
+    issuedAt: Type.String({ minLength: 1 }),
+    expiresAt: Type.String({ minLength: 1 }),
+    nonce: Type.String({ minLength: 1 }),
+    maxUses: Type.Integer({ minimum: 1 }),
+    reason: Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+export const OperatorAuthorizationRevocationV1Schema = Type.Object({
+    schemaVersion: Type.Literal(1),
+    kind: Type.Literal("operator-authorization-revocation"),
+    authorizationId: Type.String({ minLength: 1 }),
+    stewardId: Type.String({ minLength: 1 }),
+    signingKeyRef: Type.String({ minLength: 1 }),
+    audience: Type.String({ minLength: 1 }),
+    issuedAt: Type.String({ minLength: 1 }),
+    nonce: Type.String({ minLength: 1 }),
+    reason: Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+function firstTypeboxError(schema, input, fallback) {
+    const errors = [...Value.Errors(schema, input)];
+    return errors[0] !== undefined
+        ? `${errors[0].path}: ${errors[0].message}`
+        : fallback;
+}
+function hasDuplicateStrings(values) {
+    return new Set(values).size !== values.length;
+}
+function isValidIso8601(value) {
+    if (!ISO_8601_RE.test(value))
+        return false;
+    return !Number.isNaN(Date.parse(value));
+}
+function validateSharedIdentityFields(fields) {
+    if (!isStewardIdV1(fields.stewardId)) {
+        return "invalid stewardId";
+    }
+    if (fields.audience.trim().length === 0) {
+        return "audience must be non-empty";
+    }
+    if (!NONCE_RE.test(fields.nonce)) {
+        return "nonce must be 32–128 URL-safe alphanumeric characters";
+    }
+    if (!isValidIso8601(fields.issuedAt)) {
+        return "issuedAt must be ISO-8601 UTC";
+    }
+    if (!parseKeyRef(fields.keyRef).ok) {
+        return "invalid key ref";
+    }
+    return undefined;
+}
+function validateScope(scope) {
+    if (scope.classifications.length === 0) {
+        return "classifications must be non-empty";
+    }
+    if (hasDuplicateStrings(scope.classifications)) {
+        return "duplicate classifications";
+    }
+    for (const c of scope.classifications) {
+        if (c.includes("*") || c === "") {
+            return "wildcard/empty classifications are forbidden";
+        }
+        if (NON_DELEGABLE_CLASSIFICATIONS.has(c)) {
+            return `operator authority cannot satisfy classification: ${c}`;
+        }
+    }
+    if (scope.toolNames !== undefined) {
+        if (scope.toolNames.length === 0) {
+            return "toolNames must be non-empty when present";
+        }
+        if (hasDuplicateStrings(scope.toolNames)) {
+            return "duplicate toolNames";
+        }
+        for (const t of scope.toolNames) {
+            if (t.includes("*") || t === "") {
+                return "wildcard/empty toolNames are forbidden";
+            }
+        }
+    }
+    if (scope.resourcePaths !== undefined) {
+        if (scope.resourcePaths.length === 0) {
+            return "resourcePaths must be non-empty when present";
+        }
+        if (hasDuplicateStrings(scope.resourcePaths)) {
+            return "duplicate resourcePaths";
+        }
+        for (const p of scope.resourcePaths) {
+            if (p.includes("*") || p === "" || p.startsWith("/") || p.includes("..")) {
+                return "invalid resourcePaths entry";
+            }
+        }
+    }
+    return undefined;
+}
+export function containsOpenPgpSecretKeyArmor(value) {
+    return /BEGIN PGP (?:PRIVATE|SECRET) KEY BLOCK/i.test(value);
+}
+export function parseStewardKeyAttestation(input) {
+    if (!Value.Check(StewardKeyAttestationV1Schema, input)) {
+        return {
+            ok: false,
+            error: firstTypeboxError(StewardKeyAttestationV1Schema, input, "invalid StewardKeyAttestationV1"),
+        };
+    }
+    const attestation = input;
+    const shared = validateSharedIdentityFields({
+        stewardId: attestation.stewardId,
+        audience: attestation.audience,
+        nonce: attestation.nonce,
+        issuedAt: attestation.issuedAt,
+        keyRef: attestation.subjectKey.keyRef,
+    });
+    if (shared) {
+        return { ok: false, error: shared };
+    }
+    if (attestation.subjectKey.algorithm.trim().length === 0) {
+        return { ok: false, error: "subjectKey.algorithm required" };
+    }
+    const subjectKeyRef = parseKeyRef(attestation.subjectKey.keyRef);
+    if (!subjectKeyRef.ok ||
+        attestation.subjectKey.algorithm !== subjectKeyRef.keyRef.algorithm) {
+        return {
+            ok: false,
+            error: "subjectKey.algorithm must match the algorithm in subjectKey.keyRef",
+        };
+    }
+    if (attestation.subjectKey.publicKeyArmored !== undefined &&
+        containsOpenPgpSecretKeyArmor(attestation.subjectKey.publicKeyArmored)) {
+        return { ok: false, error: "OpenPGP secret key material is not accepted" };
+    }
+    if (attestation.operation === "rotate" &&
+        (attestation.replacesKeyRef === undefined ||
+            !parseKeyRef(attestation.replacesKeyRef).ok)) {
+        return { ok: false, error: "rotate requires valid replacesKeyRef" };
+    }
+    if (attestation.replacesKeyRef !== undefined &&
+        !parseKeyRef(attestation.replacesKeyRef).ok) {
+        return { ok: false, error: "invalid replacesKeyRef" };
+    }
+    return { ok: true, attestation };
+}
+export function parseStewardBootstrap(input) {
+    if (!Value.Check(StewardBootstrapV1Schema, input)) {
+        return {
+            ok: false,
+            error: firstTypeboxError(StewardBootstrapV1Schema, input, "invalid StewardBootstrapV1"),
+        };
+    }
+    const bootstrap = input;
+    const shared = validateSharedIdentityFields({
+        stewardId: bootstrap.stewardId,
+        audience: bootstrap.audience,
+        nonce: bootstrap.nonce,
+        issuedAt: bootstrap.issuedAt,
+        keyRef: bootstrap.initialBinding.subjectKey.keyRef,
+    });
+    if (shared) {
+        return { ok: false, error: shared };
+    }
+    if (bootstrap.bootstrapId.trim().length === 0) {
+        return { ok: false, error: "bootstrapId must be non-empty" };
+    }
+    if (bootstrap.policy.instanceAudience !== bootstrap.audience) {
+        return {
+            ok: false,
+            error: "policy.instanceAudience must match bootstrap audience",
+        };
+    }
+    const binding = parseStewardKeyAttestation(bootstrap.initialBinding);
+    if (!binding.ok) {
+        return { ok: false, error: binding.error };
+    }
+    if (binding.attestation.operation !== "initial-bind") {
+        return {
+            ok: false,
+            error: "bootstrap initialBinding.operation must be initial-bind",
+        };
+    }
+    if (binding.attestation.stewardId !== bootstrap.stewardId) {
+        return {
+            ok: false,
+            error: "initialBinding.stewardId must match bootstrap stewardId",
+        };
+    }
+    if (binding.attestation.audience !== bootstrap.audience) {
+        return {
+            ok: false,
+            error: "initialBinding.audience must match bootstrap audience",
+        };
+    }
+    const armored = binding.attestation.subjectKey.publicKeyArmored;
+    if (armored === undefined || armored.trim().length === 0) {
+        return {
+            ok: false,
+            error: "initialBinding.subjectKey.publicKeyArmored is required",
+        };
+    }
+    if (containsOpenPgpSecretKeyArmor(armored)) {
+        return { ok: false, error: "OpenPGP secret key material is not accepted" };
+    }
+    return { ok: true, bootstrap };
+}
+export function parseOperatorAuthorization(input) {
+    if (!Value.Check(OperatorAuthorizationV1Schema, input)) {
+        return {
+            ok: false,
+            error: firstTypeboxError(OperatorAuthorizationV1Schema, input, "invalid OperatorAuthorizationV1"),
+        };
+    }
+    const authorization = input;
+    const shared = validateSharedIdentityFields({
+        stewardId: authorization.stewardId,
+        audience: authorization.audience,
+        nonce: authorization.nonce,
+        issuedAt: authorization.issuedAt,
+        keyRef: authorization.signingKeyRef,
+    });
+    if (shared) {
+        return { ok: false, error: shared };
+    }
+    if (!isValidIso8601(authorization.expiresAt)) {
+        return { ok: false, error: "expiresAt must be ISO-8601 UTC" };
+    }
+    const scopeError = validateScope(authorization.scope);
+    if (scopeError) {
+        return { ok: false, error: scopeError };
+    }
+    const bounds = validateOperatorAuthorizationBounds(authorization);
+    if (!bounds.ok) {
+        return { ok: false, error: bounds.error };
+    }
+    return { ok: true, authorization };
+}
+export function parseOperatorAuthorizationRevocation(input) {
+    if (!Value.Check(OperatorAuthorizationRevocationV1Schema, input)) {
+        return {
+            ok: false,
+            error: firstTypeboxError(OperatorAuthorizationRevocationV1Schema, input, "invalid OperatorAuthorizationRevocationV1"),
+        };
+    }
+    const revocation = input;
+    const shared = validateSharedIdentityFields({
+        stewardId: revocation.stewardId,
+        audience: revocation.audience,
+        nonce: revocation.nonce,
+        issuedAt: revocation.issuedAt,
+        keyRef: revocation.signingKeyRef,
+    });
+    if (shared) {
+        return { ok: false, error: shared };
+    }
+    return { ok: true, revocation };
+}
+/**
+ * Temporal / mode bounds for a schema-shaped authorization.
+ * Local policy caps (max lifetime / maxUses) are applied by steward-auth-core.
+ */
+export function validateOperatorAuthorizationBounds(authorization) {
+    const issued = Date.parse(authorization.issuedAt);
+    const expires = Date.parse(authorization.expiresAt);
+    if (Number.isNaN(issued) || Number.isNaN(expires)) {
+        return { ok: false, error: "issuedAt/expiresAt must be ISO-8601" };
+    }
+    if (expires <= issued) {
+        return { ok: false, error: "expiresAt must be after issuedAt" };
+    }
+    if (authorization.mode === "one-shot" && authorization.maxUses !== 1) {
+        return { ok: false, error: "one-shot authorizations require maxUses: 1" };
+    }
+    if (authorization.mode === "standing" && authorization.maxUses < 1) {
+        return {
+            ok: false,
+            error: "standing authorizations require finite positive maxUses",
+        };
+    }
+    return { ok: true };
+}
+/** Signed bytes are exactly canonicalizeV2 of these fields (no trailing newline). */
+export function attestationSigningFields(attestation) {
+    return { ...attestation };
+}
+export function bootstrapSigningFields(bootstrap) {
+    return { ...bootstrap };
+}
+export function authorizationSigningFields(authorization) {
+    return { ...authorization };
+}
+export function authorizationRevocationSigningFields(revocation) {
+    return { ...revocation };
+}
+export function buildStewardEvidenceDigest(payload) {
+    return digest({
+        version: 2,
+        domain: STEWARD_DIGEST_DOMAINS.evidence,
+        value: payload,
+    });
+}
+export function buildStewardReplayDigest(payload) {
+    return digest({
+        version: 2,
+        domain: STEWARD_DIGEST_DOMAINS.replay,
+        value: payload,
+    });
+}
+//# sourceMappingURL=steward-authorization.js.map

package/dist/steward-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"steward-authorization.js","sourceRoot":"","sources":["../src/steward-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAe,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,wDAAwD;AACxD,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAE3D,MAAM,aAAa,GAAG,iCAAiC,CAAC;AACxD,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,uCAAuC,CAAC;AACnE,iEAAiE;AACjE,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAC3C,MAAM,WAAW,GACf,sDAAsD,CAAC;AAEzD,kEAAkE;AAClE,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,wBAAwB;IACxB,sBAAsB;IACtB,6BAA6B;CAC9B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,QAAQ,EAAE,yBAAyB;IACnC,MAAM,EAAE,uBAAuB;IAC/B,WAAW,EAAE,4BAA4B;IACzC,KAAK,EAAE,8BAA8B;IACrC,UAAU,EAAE,yCAAyC;CAC7C,CAAC;AAwBX,SAAS,YAAY,CAAC,KAAiB;IACrC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAE,CAAC;YACxD,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAE,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,OAAO,kBAAkB,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,+DAA+D;SACvE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS,EAAE;YACT,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,KAAoB;YACzB,MAAM,EAAE,KAAK,CAAC,CAAC,CAAE;SAClB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC;IACZ,OAAO,EAAE,uBAAuB;CACjC,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,SAAS,EAAE,SAAS;gBACpB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAE;gBACvB,GAAG,EAAE,KAAK;aACX;SACF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,MAAM,OAAO,GAAG,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,SAAS,EAAE,OAAO,CAAC,CAAC,CAAE;gBACtB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAE;gBACvB,GAAG,EAAE,KAAK;aACX;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EACH,4EAA4E;KAC/E,CAAC;AACJ,CAAC;AAED,MAAM,uBAAuB,GAAG,IAAI,CAAC,MAAM,CACzC;IACE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACrC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;CAC/D,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC,MAAM,CACtD;IACE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC;IAC7C,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC5C,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;KACvB,CAAC;IACF,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACvC,UAAU,EAAE,uBAAuB;IACnC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5D,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACvC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACpC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;CACtC,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAUF,gFAAgF;AAChF,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC,MAAM,CAC3D;IACE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC/C,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACnD,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC7C,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAClD,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;CACjD,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAMF;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC,MAAM,CACjD;IACE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACvC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC1C,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACvC,MAAM,EAAE,kCAAkC;IAC1C,cAAc,EAAE,6BAA6B;IAC7C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACvC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;CACrC,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAQF,MAAM,wBAAwB,GAAG,IAAI,CAAC,MAAM,CAC1C;IACE,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE;QACzD,QAAQ,EAAE,CAAC;KACZ,CAAC;IACF,SAAS,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAC3D;IACD,aAAa,EAAE,IAAI,CAAC,QAAQ,CAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAC3D;CACF,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC,MAAM,CACtD;IACE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC;IAC5C,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC9C,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC5C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACvC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACtE,KAAK,EAAE,wBAAwB;IAC/B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACvC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACpC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACrC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;CACtC,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAUF,MAAM,CAAC,MAAM,uCAAuC,GAAG,IAAI,CAAC,MAAM,CAChE;IACE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,mCAAmC,CAAC;IACvD,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC9C,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC5C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACvC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACvC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACpC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;CACtC,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAYF,SAAS,iBAAiB,CACxB,MAA0C,EAC1C,KAAc,EACd,QAAgB;IAEhB,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS;QAC5B,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;QAC3C,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAyB;IACpD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,4BAA4B,CAAC,MAMrC;IACC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO,4BAA4B,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,uDAAuD,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,OAAO,+BAA+B,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC;QACnC,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CACpB,KAAuC;IAEvC,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,mCAAmC,CAAC;IAC7C,CAAC;IACD,IAAI,mBAAmB,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QAC/C,OAAO,2BAA2B,CAAC;IACrC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAChC,OAAO,8CAA8C,CAAC;QACxD,CAAC;QACD,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO,qDAAqD,CAAC,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,0CAA0C,CAAC;QACpD,CAAC;QACD,IAAI,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,OAAO,qBAAqB,CAAC;QAC/B,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;gBAChC,OAAO,wCAAwC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,8CAA8C,CAAC;QACxD,CAAC;QACD,IAAI,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YAC7C,OAAO,yBAAyB,CAAC;QACnC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzE,OAAO,6BAA6B,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAa;IACzD,OAAO,yCAAyC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAAc;IAEd,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,iBAAiB,CACtB,6BAA6B,EAC7B,KAAK,EACL,iCAAiC,CAClC;SACF,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC;IAC1B,MAAM,MAAM,GAAG,4BAA4B,CAAC;QAC1C,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,KAAK,EAAE,WAAW,CAAC,KAAK;QACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,MAAM;KACtC,CAAC,CAAC;IACH,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,aAAa,GAAG,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjE,IACE,CAAC,aAAa,CAAC,EAAE;QACjB,WAAW,CAAC,UAAU,CAAC,SAAS,KAAK,aAAa,CAAC,MAAM,CAAC,SAAS,EACnE,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oEAAoE;SAC5E,CAAC;IACJ,CAAC;IACD,IACE,WAAW,CAAC,UAAU,CAAC,gBAAgB,KAAK,SAAS;QACrD,6BAA6B,CAC3B,WAAW,CAAC,UAAU,CAAC,gBAAgB,CACxC,EACD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;IAC7E,CAAC;IACD,IACE,WAAW,CAAC,SAAS,KAAK,QAAQ;QAClC,CAAC,WAAW,CAAC,cAAc,KAAK,SAAS;YACvC,CAAC,WAAW,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,EAC9C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;IACtE,CAAC;IACD,IACE,WAAW,CAAC,cAAc,KAAK,SAAS;QACxC,CAAC,WAAW,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,EAAE,EAC3C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc;IAEd,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,iBAAiB,CACtB,wBAAwB,EACxB,KAAK,EACL,4BAA4B,CAC7B;SACF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC;IACxB,MAAM,MAAM,GAAG,4BAA4B,CAAC;QAC1C,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,MAAM,EAAE,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM;KACnD,CAAC,CAAC;IACH,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC7D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uDAAuD;SAC/D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,0BAA0B,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;QACrD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,yDAAyD;SACjE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;QAC1D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,yDAAyD;SACjE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uDAAuD;SAC/D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,gBAAgB,CAAC;IAChE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wDAAwD;SAChE,CAAC;IACJ,CAAC;IACD,IAAI,6BAA6B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAAc;IAEd,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,iBAAiB,CACtB,6BAA6B,EAC7B,KAAK,EACL,iCAAiC,CAClC;SACF,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,CAAC;IAC5B,MAAM,MAAM,GAAG,4BAA4B,CAAC;QAC1C,SAAS,EAAE,aAAa,CAAC,SAAS;QAClC,QAAQ,EAAE,aAAa,CAAC,QAAQ;QAChC,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,QAAQ,EAAE,aAAa,CAAC,QAAQ;QAChC,MAAM,EAAE,aAAa,CAAC,aAAa;KACpC,CAAC,CAAC;IACH,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,mCAAmC,CAAC,aAAa,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,KAAc;IAEd,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,EAAE,CAAC;QACjE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,iBAAiB,CACtB,uCAAuC,EACvC,KAAK,EACL,2CAA2C,CAC5C;SACF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,4BAA4B,CAAC;QAC1C,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,MAAM,EAAE,UAAU,CAAC,aAAa;KACjC,CAAC,CAAC;IACH,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mCAAmC,CACjD,aAAsC;IAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,yDAAyD;SACjE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,wBAAwB,CACtC,WAAoC;IAEpC,OAAO,EAAE,GAAG,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,aAAsC;IAEtC,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,UAA6C;IAE7C,OAAO,EAAE,GAAG,UAAU,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAgB;IACzD,OAAO,MAAM,CAAC;QACZ,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,sBAAsB,CAAC,QAAQ;QACvC,KAAK,EAAE,OAAO;KACf,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,OAAO,MAAM,CAAC;QACZ,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,sBAAsB,CAAC,MAAM;QACrC,KAAK,EAAE,OAAO;KACf,CAAC,CAAC;AACL,CAAC"}

package/dist/workspace-profile.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Harness-neutral workspace path profiles.
+ *
+ * - `openclaw` → `<homedir>/.openclaw/workspace` (absolute OpenClaw default)
+ * - `generic` → `$FPP_WORKSPACE` or `~/.fpp`
+ * - `cursor` / `claude-code` / `codex` → `~/.fpp/<profile>`
+ *
+ * When `FPP_WORKSPACE` is set, it overrides the profile root for any profile.
+ *
+ * Legacy relative configs (e.g. `.openclaw/workspace/x`) are absolutized via
+ * `absolutizeWorkspacePath` so runtime never accidentally resolves against CWD.
+ */
+export type WorkspaceProfileId = "openclaw" | "generic" | "cursor" | "claude-code" | "codex";
+export declare const DEFAULT_WORKSPACE_PROFILE: WorkspaceProfileId;
+export type ResolveWorkspaceOptions = {
+    profile?: WorkspaceProfileId | string | undefined;
+    env?: NodeJS.ProcessEnv | undefined;
+    homedir?: (() => string) | undefined;
+};
+export type AbsolutizeWorkspaceOptions = ResolveWorkspaceOptions & {
+    /** Optional detected OpenClaw workspace absolute path when FPP_WORKSPACE is unset. */
+    openclawWorkspace?: string | undefined;
+};
+/**
+ * Resolve the workspace root directory for the active profile.
+ */
+export declare function resolveWorkspaceRoot(options?: ResolveWorkspaceOptions): string;
+/**
+ * Join a filename under the resolved workspace root using forward slashes
+ * (stable across hosts for config defaults and docs).
+ */
+export declare function workspaceFile(filename: string, options?: ResolveWorkspaceOptions): string;
+/**
+ * Resolve a possibly-relative workspace path to an absolute path.
+ *
+ * Absolute inputs are returned normalized. Relative inputs resolve against:
+ *   `FPP_WORKSPACE` → `openclawWorkspace` (if provided) → `homedir()`
+ *
+ * Legacy `.openclaw/workspace/...` strings map onto the workspace root + remainder
+ * when the base is an explicit workspace override (FPP_WORKSPACE / openclawWorkspace).
+ */
+export declare function absolutizeWorkspacePath(inputPath: string, options?: AbsolutizeWorkspaceOptions): string;
+//# sourceMappingURL=workspace-profile.d.ts.map

package/dist/workspace-profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-profile.d.ts","sourceRoot":"","sources":["../src/workspace-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,SAAS,GACT,QAAQ,GACR,aAAa,GACb,OAAO,CAAC;AAEZ,eAAO,MAAM,yBAAyB,EAAE,kBAA+B,CAAC;AAMxE,MAAM,MAAM,uBAAuB,GAAG;IACpC,OAAO,CAAC,EAAE,kBAAkB,GAAG,MAAM,GAAG,SAAS,CAAC;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IACpC,OAAO,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,uBAAuB,GAAG;IACjE,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC,CAAC;AAWF;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,uBAA4B,GACpC,MAAM,CAoBR;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,uBAA4B,GACpC,MAAM,CAIR;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,0BAA+B,GACvC,MAAM,CAgCR"}

package/dist/workspace-profile.js

@@ -0,0 +1,91 @@
+/**
+ * Harness-neutral workspace path profiles.
+ *
+ * - `openclaw` → `<homedir>/.openclaw/workspace` (absolute OpenClaw default)
+ * - `generic` → `$FPP_WORKSPACE` or `~/.fpp`
+ * - `cursor` / `claude-code` / `codex` → `~/.fpp/<profile>`
+ *
+ * When `FPP_WORKSPACE` is set, it overrides the profile root for any profile.
+ *
+ * Legacy relative configs (e.g. `.openclaw/workspace/x`) are absolutized via
+ * `absolutizeWorkspacePath` so runtime never accidentally resolves against CWD.
+ */
+import { homedir as osHomedir } from "node:os";
+import { isAbsolute, join } from "node:path";
+export const DEFAULT_WORKSPACE_PROFILE = "openclaw";
+const HARNESS_PROFILES = new Set(["cursor", "claude-code", "codex"]);
+const OPENCLAW_RELATIVE_PREFIX = ".openclaw/workspace";
+function normalizeRoot(root) {
+    return root.replace(/\\/g, "/").replace(/\/+$/, "");
+}
+function isAbsolutePath(p) {
+    const n = p.replace(/\\/g, "/");
+    return isAbsolute(n) || /^[A-Za-z]:\//.test(n);
+}
+/**
+ * Resolve the workspace root directory for the active profile.
+ */
+export function resolveWorkspaceRoot(options = {}) {
+    const env = options.env ?? process.env;
+    const override = env.FPP_WORKSPACE?.trim();
+    if (override) {
+        return normalizeRoot(override);
+    }
+    const profile = (options.profile ?? DEFAULT_WORKSPACE_PROFILE);
+    const home = () => (options.homedir ?? osHomedir)();
+    if (profile === "generic") {
+        return normalizeRoot(join(home(), ".fpp"));
+    }
+    if (HARNESS_PROFILES.has(profile)) {
+        return normalizeRoot(join(home(), ".fpp", profile));
+    }
+    // openclaw (default) and unknown profiles use absolute OpenClaw layout
+    return normalizeRoot(join(home(), ".openclaw", "workspace"));
+}
+/**
+ * Join a filename under the resolved workspace root using forward slashes
+ * (stable across hosts for config defaults and docs).
+ */
+export function workspaceFile(filename, options = {}) {
+    const root = resolveWorkspaceRoot(options);
+    const name = filename.replace(/^\/+/, "");
+    return `${root}/${name}`;
+}
+/**
+ * Resolve a possibly-relative workspace path to an absolute path.
+ *
+ * Absolute inputs are returned normalized. Relative inputs resolve against:
+ *   `FPP_WORKSPACE` → `openclawWorkspace` (if provided) → `homedir()`
+ *
+ * Legacy `.openclaw/workspace/...` strings map onto the workspace root + remainder
+ * when the base is an explicit workspace override (FPP_WORKSPACE / openclawWorkspace).
+ */
+export function absolutizeWorkspacePath(inputPath, options = {}) {
+    const normalized = inputPath.replace(/\\/g, "/");
+    if (isAbsolutePath(normalized)) {
+        return normalizeRoot(normalized);
+    }
+    const env = options.env ?? process.env;
+    const fppWs = env.FPP_WORKSPACE?.trim();
+    const detected = options.openclawWorkspace?.trim();
+    const home = (options.homedir ?? osHomedir)();
+    const stripOpenclawPrefix = (base) => {
+        const root = normalizeRoot(base);
+        if (normalized === OPENCLAW_RELATIVE_PREFIX ||
+            normalized.startsWith(`${OPENCLAW_RELATIVE_PREFIX}/`)) {
+            const rest = normalized
+                .slice(OPENCLAW_RELATIVE_PREFIX.length)
+                .replace(/^\//, "");
+            return rest ? `${root}/${rest}` : root;
+        }
+        return normalizeRoot(join(root, normalized));
+    };
+    if (fppWs) {
+        return stripOpenclawPrefix(fppWs);
+    }
+    if (detected) {
+        return stripOpenclawPrefix(detected);
+    }
+    return normalizeRoot(join(home, normalized));
+}
+//# sourceMappingURL=workspace-profile.js.map

package/dist/workspace-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-profile.js","sourceRoot":"","sources":["../src/workspace-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAS7C,MAAM,CAAC,MAAM,yBAAyB,GAAuB,UAAU,CAAC;AAExE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AAE7E,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAavD,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChC,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,yBAAyB,CAAW,CAAC;IACzE,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,EAAE,CAAC;IAEpD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,uEAAuE;IACvE,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,UAAmC,EAAE;IAErC,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAiB,EACjB,UAAsC,EAAE;IAExC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,aAAa,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,EAAE,CAAC;IAE9C,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAU,EAAE;QACnD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,IACE,UAAU,KAAK,wBAAwB;YACvC,UAAU,CAAC,UAAU,CAAC,GAAG,wBAAwB,GAAG,CAAC,EACrD,CAAC;YACD,MAAM,IAAI,GAAG,UAAU;iBACpB,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC;iBACtC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC;IAEF,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;AAC/C,CAAC"}