@harrylabsj/kiwi 0.7.22 → 0.9.0

package/dist/merchant-gateway/cli.js

@@ -0,0 +1,458 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * `kiwi merchant gateway serve` —— 商家连接器（「Kiwi 商家运营」）的远程 MCP 入口。
+ *
+ * merchant-buddy 第 1 版设计 §3.2 / 商家连接器发布计划 §2：买方连接器
+ * （`kiwi-sourcing`，本地 stdio）由本命令之外的路径承载；本进程只服务商家侧，
+ * 服务端连接共享 `kiwi-catalog`，第 0 版提供公开资料能力，第 1 版按服务端
+ * 注册表路由到商家自托管实例。
+ *
+ * 部署形态（两种，均要求公网为 HTTPS）：
+ *
+ *   1) 反向代理终止 TLS（推荐）：本进程 `--host 127.0.0.1`（默认），
+ *      `--public-url https://…` 指向代理对外地址；
+ *   2) 本进程直接终止 TLS：`--tls-cert/--tls-key`（可配合非 loopback 监听）。
+ *
+ * 监听非 loopback 且既无 TLS 材料又未显式 `--trusted-proxy` 时**拒绝启动**
+ * （fail-closed）；不做“默认相信前面有代理”的推断。
+ *
+ * 凭据分工（互不通用，详见启动摘要）：
+ *   - **用户 OAuth token**：WorkBuddy ↔ 入口。授权码 + PKCE 签发，入口只存摘要；
+ *   - **connector token**（`--connector-token-env`）：入口 → 目录的机器凭据，
+ *     仅用于创建/兑换一次性身份授权请求，**不授予任何商家数据访问**；
+ *   - **商家目录凭据 `cmt_…`**：入口 → 目录的商家作用域凭据（读写该商家公开
+ *     资料；发布仍须商家在门户确认）；由兑换签发，加密保管；
+ *   - **实例内部凭据**（第 1 版）：入口 → 商家自托管 MCP 实例；同样加密保管；
+ *   - **凭据加密密钥**（`--credential-key-env`）：仅本进程使用，不落库、不下发。
+ *
+ * 缺少加密密钥时**不启用**依赖加密存储的功能（目录工具与实例路由），
+ * 但入口本身仍可启动（连接流程与健康检查可用）——第 0 版注册/发布不会因
+ * 尚未配对实例或缺少实例凭据而被阻塞。
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { expectedCallbackUri, MerchantOAuthServer, MerchantOAuthStore, } from "../auth/merchant-oauth.js";
+import { MerchantAdminSessions } from "../auth/merchant-sessions.js";
+import { MerchantOAuthVerifier } from "../auth/merchant-authorization.js";
+import { CatalogConnectorIdentityClient } from "../discovery/catalog-source/connector-identity.js";
+import { isLoopbackHost } from "../a2a/client/url-policy.js";
+import { EXIT } from "../exit-codes.js";
+import { buildCatalogTools } from "./catalog-tools.js";
+import { MerchantPublicationClient } from "./catalog-publications.js";
+import { GatewayCredentialVault } from "./credential-vault.js";
+import { buildInstanceTools, InstanceToolListCache } from "./instance-tools.js";
+import { InstanceRegistrationStore } from "./instance-registration.js";
+import { combineScopedTools } from "./tool-bundle.js";
+import { loadTenantBackendConfigs, TenantBackendError, TenantBackendRegistry, } from "./tenant-registry.js";
+import { DEFAULT_GATEWAY_ENTRY_PATH, DEFAULT_GATEWAY_ENTRY_PORT, startGatewayEntryServer, } from "./entry-server.js";
+const DEFAULT_CATALOG_URL = "https://catalog.kiwi.harrylabsj.com";
+/** 默认商家连接器 source（平台唯一性待核验；核验后按此处替换即可）。 */
+export const DEFAULT_MERCHANT_CONNECTOR_SOURCE = "kiwi-merchant";
+const DEFAULT_CONNECTOR_TOKEN_ENV = "KIWI_CATALOG_CONNECTOR_TOKEN";
+export function defaultGatewayDataDir(cwd = process.cwd()) {
+    return path.join(cwd, ".kiwi", "gateway");
+}
+/** 解析 `kiwi merchant gateway serve` 的原始 flag（含 `--check`）。 */
+export function parseGatewayServeArgs(args, env = process.env) {
+    const opts = {
+        catalogUrl: env.KIWI_CATALOG_URL ?? DEFAULT_CATALOG_URL,
+        source: DEFAULT_MERCHANT_CONNECTOR_SOURCE,
+        host: "127.0.0.1",
+        port: DEFAULT_GATEWAY_ENTRY_PORT,
+        mcpPath: DEFAULT_GATEWAY_ENTRY_PATH,
+        dataDir: defaultGatewayDataDir(),
+        connectorTokenEnv: DEFAULT_CONNECTOR_TOKEN_ENV,
+        credentialKeyEnv: "KIWI_GATEWAY_CREDENTIAL_KEY",
+        trustedProxy: false,
+        allowLoopbackCallback: true,
+        checkOnly: false,
+    };
+    for (let i = 0; i < args.length; i += 1) {
+        const flag = args[i];
+        const value = args[i + 1];
+        if (flag === "--check") {
+            opts.checkOnly = true;
+            continue;
+        }
+        if (flag === "--trusted-proxy") {
+            opts.trustedProxy = true;
+            continue;
+        }
+        if (flag === "--no-loopback-callback") {
+            opts.allowLoopbackCallback = false;
+            continue;
+        }
+        if (value === undefined)
+            continue;
+        if (flag === "--public-url")
+            opts.publicUrl = value;
+        else if (flag === "--catalog-url")
+            opts.catalogUrl = value;
+        else if (flag === "--source")
+            opts.source = value;
+        else if (flag === "--host")
+            opts.host = value;
+        else if (flag === "--port")
+            opts.port = Number(value);
+        else if (flag === "--mcp-path")
+            opts.mcpPath = value;
+        else if (flag === "--data-dir")
+            opts.dataDir = value;
+        else if (flag === "--connector-token-env")
+            opts.connectorTokenEnv = value;
+        else if (flag === "--credential-key-env")
+            opts.credentialKeyEnv = value;
+        else if (flag === "--tls-cert")
+            opts.tlsCertPath = value;
+        else if (flag === "--tls-key")
+            opts.tlsKeyPath = value;
+        else if (flag === "--callback-uri")
+            opts.callbackUri = value;
+        else if (flag === "--portal-url")
+            opts.portalBaseUrl = value;
+        else if (flag === "--tenant-config")
+            opts.tenantConfigPath = value;
+    }
+    return opts;
+}
+/**
+ * 启动前校验（fail-closed）。纯函数，便于测试与 `--check` 复用。
+ *
+ * 规则：
+ *   - `--public-url` 必填，且 https（loopback http 仅限本地开发）；
+ *   - 监听非 loopback 必须给出 TLS 材料，或显式 `--trusted-proxy`；
+ *   - TLS 证书与私钥必须成对；
+ *   - connector token 必须已配置（缺少则入口无法建立商家身份，直接拒绝启动）；
+ *   - 凭据加密密钥缺失**不**拒绝启动，但关闭依赖加密存储的功能并给出警告。
+ */
+export function validateGatewayServeOptions(opts, env = process.env) {
+    const publicUrlRaw = (opts.publicUrl ?? "").trim();
+    if (publicUrlRaw === "") {
+        return {
+            ok: false,
+            error: "缺少 --public-url（公网 HTTPS 入口，用于 OAuth issuer 与连接回跳）",
+        };
+    }
+    let publicUrl;
+    try {
+        publicUrl = new URL(publicUrlRaw);
+    }
+    catch {
+        return { ok: false, error: `--public-url 不是合法 URL：${publicUrlRaw}` };
+    }
+    if (publicUrl.username !== "" || publicUrl.password !== "") {
+        return { ok: false, error: "--public-url 不得内嵌凭据（userinfo）" };
+    }
+    if (publicUrl.search !== "" || publicUrl.hash !== "") {
+        return { ok: false, error: "--public-url 不得包含查询串或片段" };
+    }
+    if (publicUrl.protocol !== "https:" && !isLoopbackHost(publicUrl.hostname)) {
+        return {
+            ok: false,
+            error: `--public-url 必须是 https（除非 loopback 开发地址）：${publicUrlRaw}`,
+        };
+    }
+    if (!Number.isInteger(opts.port) || opts.port <= 0 || opts.port > 65535) {
+        return { ok: false, error: `--port 非法：${opts.port}` };
+    }
+    if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(opts.source)) {
+        return { ok: false, error: `--source 非法（小写字母/数字/连字符）：${opts.source}` };
+    }
+    // 目录地址校验：http(s)、无 userinfo、无查询串。
+    try {
+        const catalogUrl = new URL(opts.catalogUrl);
+        if ((catalogUrl.protocol !== "http:" && catalogUrl.protocol !== "https:") ||
+            catalogUrl.username !== "" ||
+            catalogUrl.password !== "") {
+            return { ok: false, error: `--catalog-url 非法：${opts.catalogUrl}` };
+        }
+    }
+    catch {
+        return { ok: false, error: `--catalog-url 非法：${opts.catalogUrl}` };
+    }
+    const hasCert = (opts.tlsCertPath ?? "").trim() !== "";
+    const hasKey = (opts.tlsKeyPath ?? "").trim() !== "";
+    if (hasCert !== hasKey) {
+        return { ok: false, error: "--tls-cert 与 --tls-key 必须成对提供" };
+    }
+    if (hasCert) {
+        for (const file of [opts.tlsCertPath, opts.tlsKeyPath]) {
+            if (!existsSync(String(file))) {
+                return { ok: false, error: `TLS 材料不存在：${file}` };
+            }
+        }
+    }
+    const nonLoopback = !isLoopbackHost(opts.host);
+    if (nonLoopback && !hasCert && !opts.trustedProxy) {
+        return {
+            ok: false,
+            error: `监听非 loopback 地址（${opts.host}）时必须二选一：` +
+                "提供 --tls-cert/--tls-key 由本进程终止 TLS，或显式声明 --trusted-proxy（TLS 由受信反向代理终止）",
+        };
+    }
+    const connectorToken = (env[opts.connectorTokenEnv] ?? "").trim();
+    if (connectorToken === "") {
+        return {
+            ok: false,
+            error: `环境变量 ${opts.connectorTokenEnv} 未配置：入口需要目录发给的 connector token ` +
+                "才能创建/兑换一次性身份授权请求（它不授予商家数据访问）",
+        };
+    }
+    const credentialKey = (env[opts.credentialKeyEnv] ?? "").trim();
+    const warnings = [];
+    if (credentialKey === "") {
+        warnings.push(`环境变量 ${opts.credentialKeyEnv} 未配置：依赖加密存储的功能（第 0 版目录工具、第 1 版实例路由）未启用。` +
+            "配置该密钥后重启即可启用（商家需重新连接一次）。");
+    }
+    let registeredInstances = 0;
+    if ((opts.tenantConfigPath ?? "").trim() !== "") {
+        const configPath = String(opts.tenantConfigPath);
+        if (!existsSync(configPath)) {
+            return { ok: false, error: `租户配置文件不存在：${configPath}` };
+        }
+        try {
+            const configs = loadTenantBackendConfigs(readFileSync(configPath, "utf8"));
+            registeredInstances = new TenantBackendRegistry(configs).size;
+        }
+        catch (err) {
+            return {
+                ok: false,
+                error: err instanceof TenantBackendError ? err.message : String(err),
+            };
+        }
+    }
+    if (nonLoopback && opts.trustedProxy && !hasCert) {
+        warnings.push(`监听 ${opts.host} 且未由本进程终止 TLS：仅当受信反向代理已终止 TLS 并限制直连时可用；` +
+            `公网入口必须为 ${publicUrl.origin}。`);
+    }
+    if (publicUrl.protocol === "http:") {
+        warnings.push("--public-url 为 http（loopback 开发地址）：不可用于生产。");
+    }
+    return {
+        ok: true,
+        readiness: {
+            publicUrl: publicUrl.origin,
+            callbackUri: expectedCallbackUri(opts.source, {
+                ...(opts.callbackUri !== undefined ? { expectedCallbackUri: opts.callbackUri } : {}),
+                allowLoopbackFallback: opts.allowLoopbackCallback,
+            }),
+            directTls: hasCert,
+            nonLoopback,
+            encryptedFeaturesEnabled: credentialKey !== "",
+            registeredInstances,
+            connectorTokenConfigured: true,
+            warnings,
+        },
+    };
+}
+function resolveGatewayDataDir(dir) {
+    const resolved = path.resolve(dir);
+    mkdirSync(resolved, { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(resolved, 0o700);
+    }
+    catch {
+        // 只读/受限文件系统：目录已按 0700 创建，权限收紧失败不阻塞启动。
+    }
+    return resolved;
+}
+/** 打开（或预建）oauth.sqlite：先以 0600 建空文件再打开，消除权限窗口。 */
+function openGatewayStore(dataDir) {
+    const dbPath = path.join(dataDir, "oauth.sqlite");
+    if (!existsSync(dbPath)) {
+        writeFileSync(dbPath, "", { mode: 0o600 });
+    }
+    const db = new DatabaseSync(dbPath);
+    chmodSync(dbPath, 0o600);
+    return db;
+}
+const USAGE = `usage: kiwi merchant gateway serve [options]
+
+商家连接器（Kiwi 商家运营）远程 MCP 入口。买方连接器（kiwi-sourcing）由
+本地 stdio 承载，不由本命令提供服务。
+
+  --public-url <url>           必填。公网入口（https；loopback http 仅限开发）
+  --catalog-url <url>          kiwi-catalog 地址（缺省 KIWI_CATALOG_URL）
+  --source <name>              连接器 source（缺省 ${DEFAULT_MERCHANT_CONNECTOR_SOURCE}）
+  --host <host>                监听地址（缺省 127.0.0.1）
+  --port <n>                   监听端口（缺省 ${DEFAULT_GATEWAY_ENTRY_PORT}）
+  --mcp-path <path>            MCP endpoint 路径（缺省 /mcp）
+  --data-dir <dir>             状态目录（缺省 <cwd>/.kiwi/gateway）
+  --connector-token-env <ENV>  connector token 的环境变量名（缺省 ${DEFAULT_CONNECTOR_TOKEN_ENV}）
+  --credential-key-env <ENV>   凭据加密密钥的环境变量名（缺省 KIWI_GATEWAY_CREDENTIAL_KEY）
+  --tls-cert <file>            TLS 证书（与 --tls-key 成对；由本进程终止 TLS）
+  --tls-key <file>             TLS 私钥
+  --trusted-proxy              TLS 由受信反向代理终止（允许监听非 loopback）
+  --callback-uri <uri>         显式指定期望 OAuth 回调（缺省按 source 派生）
+  --no-loopback-callback       不允许 http loopback 回退回调
+  --portal-url <url>           目录门户地址（公开资料确认入口）
+  --tenant-config <file>       商家实例注册表 JSON（{tenants:[{merchant_id,mcp_url,
+                               token_env|credential_kind:"vault"}]}；可选，商家也可在
+                               /instance 页面自助绑定实例）
+  --check                      只校验配置与就绪状态，不启动监听
+`;
+/** 启动摘要：把三类凭据的分工与功能开关显式打印，避免部署误判。 */
+function printReadiness(opts, readiness, handle) {
+    const listen = handle === undefined ? `${opts.host}:${opts.port}（未启动）` : handle.url;
+    const lines = [
+        "kiwi merchant gateway serve",
+        `  公网入口        ${readiness.publicUrl}`,
+        `  本地监听        ${listen}${readiness.directTls ? "（本进程终止 TLS）" : "（TLS 应由受信反向代理终止）"}`,
+        `  连接器 source   ${opts.source}`,
+        `  OAuth 回调      ${readiness.callbackUri}`,
+        `  目录服务        ${opts.catalogUrl}`,
+        `  状态目录        ${opts.dataDir}`,
+        `  实例绑定页      ${readiness.publicUrl}/instance（需商家登录态）`,
+        "凭据分工（互不通用）：",
+        "  用户 OAuth token    WorkBuddy ↔ 入口（授权码 + PKCE；入口只存摘要）",
+        `  connector token     入口 → 目录：创建/兑换一次性身份授权请求（env ${opts.connectorTokenEnv}），不授予商家数据访问`,
+        "  商家目录凭据 cmt_…  入口 → 目录：读写该商家公开资料（发布仍须商家在门户确认）",
+        "  实例内部凭据        入口 → 商家自托管实例（第 1 版路由）",
+        `  凭据加密密钥        仅本进程使用（env ${opts.credentialKeyEnv}），不落库、不下发`,
+        "功能：",
+        "  ✓ 商家连接与授权（OAuth 2.1 + PKCE）",
+        readiness.encryptedFeaturesEnabled
+            ? "  ✓ 第 0 版目录工具（公开资料草稿/状态/撤回 + 门户确认入口）"
+            : "  ✗ 第 0 版目录工具（未配置凭据加密密钥）",
+        readiness.registeredInstances > 0
+            ? `  ✓ 第 1 版实例路由（静态配置 ${readiness.registeredInstances} 个；商家自助绑定在 /instance 页面完成）`
+            : "  ✓ 第 1 版实例路由（静态配置 0 个；商家可在 /instance 页面自助绑定实例）",
+    ];
+    for (const warning of readiness.warnings) {
+        lines.push(`  ⚠️ ${warning}`);
+    }
+    process.stdout.write(`${lines.join("\n")}\n`);
+}
+export async function runGatewayServe(args, env = process.env) {
+    if (args.includes("--help") || args.includes("-h")) {
+        process.stdout.write(USAGE);
+        return EXIT.OK;
+    }
+    const opts = parseGatewayServeArgs(args, env);
+    const validation = validateGatewayServeOptions(opts, env);
+    if (!validation.ok) {
+        process.stderr.write(`${validation.error}\n\n${USAGE}`);
+        return EXIT.CONFIG;
+    }
+    const readiness = validation.readiness;
+    if (opts.checkOnly) {
+        printReadiness(opts, readiness);
+        return EXIT.OK;
+    }
+    const dataDir = resolveGatewayDataDir(opts.dataDir);
+    const db = openGatewayStore(dataDir);
+    const oauthStore = new MerchantOAuthStore({ db });
+    const credentialSecret = env[opts.credentialKeyEnv];
+    const vault = credentialSecret !== undefined && credentialSecret.trim() !== ""
+        ? new GatewayCredentialVault({ db, secret: credentialSecret })
+        : undefined;
+    const oauth = new MerchantOAuthServer({
+        store: oauthStore,
+        issuer: readiness.publicUrl,
+        resource: `${readiness.publicUrl}${opts.mcpPath}`,
+        connectorSource: opts.source,
+        multiMerchant: true,
+        // 目录 scope（第 0 版工具）+ 实例 scope（第 1 版工具，经 mcp-proxy 逐次校验）。
+        scopes: ["catalog:read", "catalog:write", "merchant:read", "merchant:write"],
+        loginPath: "/connect",
+        callbackPolicy: {
+            ...(opts.callbackUri !== undefined ? { expectedCallbackUri: opts.callbackUri } : {}),
+            allowLoopbackFallback: opts.allowLoopbackCallback,
+        },
+    });
+    const publicationClient = new MerchantPublicationClient({ baseUrl: opts.catalogUrl });
+    const portalBaseUrl = opts.portalBaseUrl ?? opts.catalogUrl;
+    // 商家自助绑定的实例登记（§8.4 第一期）：需要加密保管库，缺密钥时不启用。
+    const registrations = vault !== undefined ? new InstanceRegistrationStore({ db }) : undefined;
+    // 实例注册表 = 运维静态配置 + 商家自助绑定（§8.4）。
+    // 凭据来源为 vault 的实例需要加密密钥：缺密钥时**这些实例不启用**
+    // （其余静态实例与第 0 版能力不受影响）。
+    let staticConfigs = [];
+    if ((opts.tenantConfigPath ?? "").trim() !== "") {
+        staticConfigs = loadTenantBackendConfigs(readFileSync(String(opts.tenantConfigPath), "utf8"));
+        if (vault === undefined) {
+            const kept = staticConfigs.filter((c) => c.credentialKind !== "vault");
+            if (kept.length < staticConfigs.length) {
+                process.stderr.write(`⚠️ 未配置凭据加密密钥：${staticConfigs.length - kept.length} 个 vault 凭据实例未启用\n`);
+            }
+            staticConfigs = kept;
+        }
+    }
+    const tenantRegistry = new TenantBackendRegistry(staticConfigs, env, {
+        ...(vault !== undefined ? { credentials: vault } : {}),
+        ...(registrations !== undefined ? { dynamic: { lookup: (id) => registrations.get(id) } } : {}),
+    });
+    const instanceToolCache = new InstanceToolListCache();
+    const handle = await startGatewayEntryServer({
+        publicBaseUrl: readiness.publicUrl,
+        oauth,
+        sessions: new MerchantAdminSessions({ db }),
+        identity: new CatalogConnectorIdentityClient({
+            baseUrl: opts.catalogUrl,
+            connectorToken: String(env[opts.connectorTokenEnv] ?? "").trim(),
+        }),
+        auth: new MerchantOAuthVerifier({ store: oauthStore, multiMerchant: true }),
+        ...(vault !== undefined ? { credentials: vault } : {}),
+        ...(vault !== undefined && registrations !== undefined
+            ? { instanceBinding: { registrations, credentials: vault } }
+            : {}),
+        // 每请求按已验证主体组合工具束：第 0 版目录工具 + 该商家的第 1 版实例工具。
+        toolsFor: (authorization) => {
+            const merchantId = authorization?.merchant_id ?? "";
+            if (merchantId === "")
+                return undefined;
+            const bundles = [];
+            if (vault !== undefined) {
+                bundles.push(buildCatalogTools(merchantId, {
+                    client: publicationClient,
+                    credentials: vault,
+                    portalBaseUrl,
+                }));
+            }
+            if (tenantRegistry !== undefined && authorization !== undefined) {
+                bundles.push(buildInstanceTools({
+                    registry: tenantRegistry,
+                    authorization,
+                    cache: instanceToolCache,
+                }));
+            }
+            return combineScopedTools(bundles);
+        },
+        ...(opts.tlsCertPath !== undefined && opts.tlsKeyPath !== undefined
+            ? { tls: { certPath: opts.tlsCertPath, keyPath: opts.tlsKeyPath } }
+            : {}),
+        host: opts.host,
+        port: opts.port,
+        mcpPath: opts.mcpPath,
+        secureCookies: readiness.publicUrl.startsWith("https://"),
+        clientLabel: "Kiwi 商家运营",
+        serverInfo: { name: "kiwi-merchant-entry", version: "0.1.0" },
+    });
+    printReadiness(opts, readiness, handle);
+    return await new Promise((resolve) => {
+        const shutdown = () => {
+            void handle.close().then(() => {
+                db.close();
+                resolve(EXIT.OK);
+            });
+        };
+        process.once("SIGINT", shutdown);
+        process.once("SIGTERM", shutdown);
+    });
+}
+//# sourceMappingURL=cli.js.map

package/dist/merchant-gateway/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/merchant-gateway/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,mDAAmD,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,GAEtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AAClE,2CAA2C;AAC3C,MAAM,CAAC,MAAM,iCAAiC,GAAG,eAAe,CAAC;AACjE,MAAM,2BAA2B,GAAG,8BAA8B,CAAC;AAuBnE,MAAM,UAAU,qBAAqB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,qBAAqB,CACnC,IAAc,EACd,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,IAAI,GAAwB;QAChC,UAAU,EAAE,GAAG,CAAC,gBAAgB,IAAI,mBAAmB;QACvD,MAAM,EAAE,iCAAiC;QACzC,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,0BAA0B;QACnC,OAAO,EAAE,qBAAqB,EAAE;QAChC,iBAAiB,EAAE,2BAA2B;QAC9C,gBAAgB,EAAE,6BAA6B;QAC/C,YAAY,EAAE,KAAK;QACnB,qBAAqB,EAAE,IAAI;QAC3B,SAAS,EAAE,KAAK;KACjB,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;YACtC,IAAI,CAAC,qBAAqB,GAAG,KAAK,CAAC;YACnC,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,IAAI,KAAK,cAAc;YAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;aAC/C,IAAI,IAAI,KAAK,eAAe;YAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;aACtD,IAAI,IAAI,KAAK,UAAU;YAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;aAC7C,IAAI,IAAI,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;aACzC,IAAI,IAAI,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;aACjD,IAAI,IAAI,KAAK,YAAY;YAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;aAChD,IAAI,IAAI,KAAK,YAAY;YAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;aAChD,IAAI,IAAI,KAAK,uBAAuB;YAAE,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;aACrE,IAAI,IAAI,KAAK,sBAAsB;YAAE,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC;aACnE,IAAI,IAAI,KAAK,YAAY;YAAE,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;aACpD,IAAI,IAAI,KAAK,WAAW;YAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;aAClD,IAAI,IAAI,KAAK,gBAAgB;YAAE,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;aACxD,IAAI,IAAI,KAAK,cAAc;YAAE,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;aACxD,IAAI,IAAI,KAAK,iBAAiB;YAAE,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAsBD;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAyB,EACzB,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oDAAoD;SAC5D,CAAC;IACJ,CAAC;IACD,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,YAAY,EAAE,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,SAAS,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,4CAA4C,YAAY,EAAE;SAClE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,kCAAkC;IAClC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5C,IACE,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC;YACrE,UAAU,CAAC,QAAQ,KAAK,EAAE;YAC1B,UAAU,CAAC,QAAQ,KAAK,EAAE,EAC1B,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACrD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,WAAW,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,mBAAmB,IAAI,CAAC,IAAI,UAAU;gBACtC,yEAAyE;SAC5E,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,cAAc,KAAK,EAAE,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,QAAQ,IAAI,CAAC,iBAAiB,iCAAiC;gBAC/D,8BAA8B;SACjC,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CACX,QAAQ,IAAI,CAAC,gBAAgB,yCAAyC;YACpE,0BAA0B,CAC7B,CAAC;IACJ,CAAC;IACD,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,UAAU,EAAE,EAAE,CAAC;QACzD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,wBAAwB,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3E,mBAAmB,GAAG,IAAI,qBAAqB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,YAAY,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACrE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,WAAW,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CACX,MAAM,IAAI,CAAC,IAAI,yCAAyC;YACtD,WAAW,SAAS,CAAC,MAAM,GAAG,CACjC,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS,EAAE;YACT,SAAS,EAAE,SAAS,CAAC,MAAM;YAC3B,WAAW,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE;gBAC5C,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpF,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;aAClD,CAAC;YACF,SAAS,EAAE,OAAO;YAClB,WAAW;YACX,wBAAwB,EAAE,aAAa,KAAK,EAAE;YAC9C,mBAAmB;YACnB,wBAAwB,EAAE,IAAI;YAC9B,QAAQ;SACT;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kDAAkD;AAClD,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzB,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,KAAK,GAAG;;;;;;;+CAOiC,iCAAiC;;yCAEvC,0BAA0B;;;2DAGR,2BAA2B;;;;;;;;;;;;CAYrF,CAAC;AAEF,qCAAqC;AACrC,SAAS,cAAc,CACrB,IAAyB,EACzB,SAAgC,EAChC,MAAiC;IAEjC,MAAM,MAAM,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACpF,MAAM,KAAK,GAAG;QACZ,6BAA6B;QAC7B,iBAAiB,SAAS,CAAC,SAAS,EAAE;QACtC,iBAAiB,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,kBAAkB,EAAE;QACpF,kBAAkB,IAAI,CAAC,MAAM,EAAE;QAC/B,mBAAmB,SAAS,CAAC,WAAW,EAAE;QAC1C,iBAAiB,IAAI,CAAC,UAAU,EAAE;QAClC,iBAAiB,IAAI,CAAC,OAAO,EAAE;QAC/B,gBAAgB,SAAS,CAAC,SAAS,mBAAmB;QACtD,aAAa;QACb,uDAAuD;QACvD,oDAAoD,IAAI,CAAC,iBAAiB,aAAa;QACvF,gDAAgD;QAChD,uCAAuC;QACvC,8BAA8B,IAAI,CAAC,gBAAgB,WAAW;QAC9D,KAAK;QACL,+BAA+B;QAC/B,SAAS,CAAC,wBAAwB;YAChC,CAAC,CAAC,sCAAsC;YACxC,CAAC,CAAC,0BAA0B;QAC9B,SAAS,CAAC,mBAAmB,GAAG,CAAC;YAC/B,CAAC,CAAC,sBAAsB,SAAS,CAAC,mBAAmB,4BAA4B;YACjF,CAAC,CAAC,iDAAiD;KACtD,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAc,EACd,MAA0C,OAAO,CAAC,GAAG;IAErD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,2BAA2B,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,OAAO,KAAK,EAAE,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACvC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,IAAI,kBAAkB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,gBAAgB,GAAG,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpD,MAAM,KAAK,GACT,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE;QAC9D,CAAC,CAAC,IAAI,sBAAsB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,KAAK,GAAG,IAAI,mBAAmB,CAAC;QACpC,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,SAAS,CAAC,SAAS;QAC3B,QAAQ,EAAE,GAAG,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE;QACjD,eAAe,EAAE,IAAI,CAAC,MAAM;QAC5B,aAAa,EAAE,IAAI;QACnB,yDAAyD;QACzD,MAAM,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,CAAC;QAC5E,SAAS,EAAE,UAAU;QACrB,cAAc,EAAE;YACd,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SAClD;KACF,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,IAAI,yBAAyB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACtF,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,UAAU,CAAC;IAE5D,yCAAyC;IACzC,MAAM,aAAa,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9F,iCAAiC;IACjC,wCAAwC;IACxC,wBAAwB;IACxB,IAAI,aAAa,GAA0B,EAAE,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAChD,aAAa,GAAG,wBAAwB,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,CAAC;YACvE,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;gBACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gBAAgB,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,oBAAoB,CACvE,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,qBAAqB,CAAC,aAAa,EAAE,GAAG,EAAE;QACnE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,IAAI,qBAAqB,EAAE,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;QAC3C,aAAa,EAAE,SAAS,CAAC,SAAS;QAClC,KAAK;QACL,QAAQ,EAAE,IAAI,qBAAqB,CAAC,EAAE,EAAE,EAAE,CAAC;QAC3C,QAAQ,EAAE,IAAI,8BAA8B,CAAC;YAC3C,OAAO,EAAE,IAAI,CAAC,UAAU;YACxB,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;SACjE,CAAC;QACF,IAAI,EAAE,IAAI,qBAAqB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS;YACpD,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;YAC5D,CAAC,CAAC,EAAE,CAAC;QACP,4CAA4C;QAC5C,QAAQ,EAAE,CAAC,aAAa,EAAE,EAAE;YAC1B,MAAM,UAAU,GAAG,aAAa,EAAE,WAAW,IAAI,EAAE,CAAC;YACpD,IAAI,UAAU,KAAK,EAAE;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,OAAO,GAAsC,EAAE,CAAC;YACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CACV,iBAAiB,CAAC,UAAU,EAAE;oBAC5B,MAAM,EAAE,iBAAiB;oBACzB,WAAW,EAAE,KAAK;oBAClB,aAAa;iBACd,CAAC,CACH,CAAC;YACJ,CAAC;YACD,IAAI,cAAc,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChE,OAAO,CAAC,IAAI,CACV,kBAAkB,CAAC;oBACjB,QAAQ,EAAE,cAAc;oBACxB,aAAa;oBACb,KAAK,EAAE,iBAAiB;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC;YACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YACjE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE;YACnE,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC;QACzD,WAAW,EAAE,WAAW;QACxB,UAAU,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE;KAC9D,CAAC,CAAC;IAEH,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAExC,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAAG,GAAS,EAAE;YAC1B,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC5B,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/merchant-gateway/credential-vault.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { DatabaseSync } from "node:sqlite";
+export declare const CREDENTIAL_KEY_ENV = "KIWI_GATEWAY_CREDENTIAL_KEY";
+export interface StoredMerchantCredential {
+    token: string;
+    expiresAt: string;
+}
+/** 入口需要的凭据保管能力（测试可注入内存实现）。 */
+export interface MerchantCredentialStore {
+    put(merchantId: string, token: string, expiresAt: string): void;
+    get(merchantId: string): StoredMerchantCredential | undefined;
+    delete(merchantId: string): void;
+}
+/** 从环境读取保管密钥；未配置返回 undefined（调用方据此 fail-closed）。 */
+export declare function credentialKeyFromEnv(env?: Record<string, string | undefined>): string | undefined;
+export declare class GatewayCredentialVault implements MerchantCredentialStore {
+    private readonly db;
+    private readonly key;
+    private readonly now;
+    constructor(options: {
+        db: DatabaseSync;
+        secret: string;
+        now?: () => string;
+    });
+    private encrypt;
+    private decrypt;
+    put(merchantId: string, token: string, expiresAt: string): void;
+    get(merchantId: string): StoredMerchantCredential | undefined;
+    delete(merchantId: string): void;
+}

package/dist/merchant-gateway/credential-vault.js

@@ -0,0 +1,111 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * 商家连接器入口的凭据保管（AES-256-GCM，密钥来自部署环境）。
+ *
+ * 入口在商家确认连接时兑换到**目录商家作用域凭据**（`cmt_…`），它需要长期
+ * 持有（入口重启后仍要代表该商家读写公开资料）。与既有做法一致，明文不落库：
+ * 这里用 `KIWI_GATEWAY_CREDENTIAL_KEY` 派生的 32 字节密钥做 AES-256-GCM
+ * 加密后存储，密钥缺失时 fail-closed（入口无法保管凭据 → 商家工具不可用，
+ * 而不是退回明文）。
+ *
+ * 存储位置：入口自己的 oauth.sqlite（0600），表 `gateway_merchant_credentials`。
+ * 每个商家一行（merchant_id 主键）；重新连接覆盖旧凭据。
+ */
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+export const CREDENTIAL_KEY_ENV = "KIWI_GATEWAY_CREDENTIAL_KEY";
+const VAULT_SCHEMA = `
+CREATE TABLE IF NOT EXISTS gateway_merchant_credentials (
+  merchant_id TEXT PRIMARY KEY,
+  ciphertext TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+`;
+/** 从环境读取保管密钥；未配置返回 undefined（调用方据此 fail-closed）。 */
+export function credentialKeyFromEnv(env = process.env) {
+    const raw = (env[CREDENTIAL_KEY_ENV] ?? "").trim();
+    return raw === "" ? undefined : raw;
+}
+/** 任意长度的部署密钥 → 32 字节 AES 密钥（sha256 派生）。 */
+function deriveKey(secret) {
+    return createHash("sha256").update(secret).digest();
+}
+export class GatewayCredentialVault {
+    db;
+    key;
+    now;
+    constructor(options) {
+        if (typeof options.secret !== "string" || options.secret.trim() === "") {
+            throw new Error("GatewayCredentialVault requires a non-empty credential secret");
+        }
+        this.db = options.db;
+        this.key = deriveKey(options.secret);
+        this.now = options.now ?? (() => new Date().toISOString());
+        this.db.exec(VAULT_SCHEMA);
+    }
+    encrypt(plaintext) {
+        const iv = randomBytes(12);
+        const cipher = createCipheriv("aes-256-gcm", this.key, iv);
+        const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return Buffer.concat([iv, tag, ciphertext]).toString("base64");
+    }
+    decrypt(payload) {
+        const raw = Buffer.from(payload, "base64");
+        const iv = raw.subarray(0, 12);
+        const tag = raw.subarray(12, 28);
+        const ciphertext = raw.subarray(28);
+        const decipher = createDecipheriv("aes-256-gcm", this.key, iv);
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+    }
+    put(merchantId, token, expiresAt) {
+        if (merchantId === "" || token === "") {
+            throw new Error("credential vault requires merchant_id and token");
+        }
+        this.db
+            .prepare(`INSERT INTO gateway_merchant_credentials(merchant_id, ciphertext, expires_at, updated_at)
+         VALUES (?, ?, ?, ?)
+         ON CONFLICT(merchant_id) DO UPDATE SET
+           ciphertext = excluded.ciphertext,
+           expires_at = excluded.expires_at,
+           updated_at = excluded.updated_at`)
+            .run(merchantId, this.encrypt(token), expiresAt, this.now());
+    }
+    get(merchantId) {
+        const row = this.db
+            .prepare("SELECT ciphertext, expires_at FROM gateway_merchant_credentials WHERE merchant_id = ?")
+            .get(merchantId);
+        if (row === undefined)
+            return undefined;
+        if (row.expires_at <= this.now())
+            return undefined;
+        try {
+            return { token: this.decrypt(row.ciphertext), expiresAt: row.expires_at };
+        }
+        catch {
+            // 密钥轮换/数据损坏：当作没有凭据（工具报「需要重新连接」），绝不返回噪音。
+            return undefined;
+        }
+    }
+    delete(merchantId) {
+        this.db
+            .prepare("DELETE FROM gateway_merchant_credentials WHERE merchant_id = ?")
+            .run(merchantId);
+    }
+}
+//# sourceMappingURL=credential-vault.js.map

package/dist/merchant-gateway/credential-vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-vault.js","sourceRoot":"","sources":["../../src/merchant-gateway/credential-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGxF,MAAM,CAAC,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AAEhE,MAAM,YAAY,GAAG;;;;;;;CAOpB,CAAC;AAcF,oDAAoD;AACpD,MAAM,UAAU,oBAAoB,CAClC,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;AACtC,CAAC;AAED,2CAA2C;AAC3C,SAAS,SAAS,CAAC,MAAc;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,OAAO,sBAAsB;IAChB,EAAE,CAAe;IACjB,GAAG,CAAS;IACZ,GAAG,CAAe;IAEnC,YAAY,OAAiE;QAC3E,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;IAEO,OAAO,CAAC,SAAiB;QAC/B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjE,CAAC;IAEO,OAAO,CAAC,OAAe;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzF,CAAC;IAED,GAAG,CAAC,UAAkB,EAAE,KAAa,EAAE,SAAiB;QACtD,IAAI,UAAU,KAAK,EAAE,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;;;;4CAKoC,CACrC;aACA,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,GAAG,CAAC,UAAkB;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CACN,uFAAuF,CACxF;aACA,GAAG,CAAC,UAAU,CAA2D,CAAC;QAC7E,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,SAAS,CAAC;QACnD,IAAI,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;YACxC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,UAAkB;QACvB,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,gEAAgE,CAAC;aACzE,GAAG,CAAC,UAAU,CAAC,CAAC;IACrB,CAAC;CACF"}