@judaharagao/opencode-ssh 1.0.0

package/dist/security/validator.js

@@ -0,0 +1,152 @@
+import { getBuiltinBlocklist, createCustomEntries } from "./blocklist.js";
+import { getAllowedCommands } from "./allowlist.js";
+/**
+ * Validate a command against the security policy.
+ *
+ * Validation order:
+ * 1. Check against destructive blocklist → ALWAYS BLOCKED (no exceptions)
+ * 2. Check against risky blocklist → requires permission prompt
+ * 3. In restricted/read_only mode, check against allowlist
+ */
+export function validateCommand(command, mode, extraBlocklist = []) {
+    const trimmed = command.trim();
+    if (!trimmed) {
+        return { safe: true, level: "safe" };
+    }
+    // ── Step 1: Check against ALL blocklist entries ──
+    const allBlocklistEntries = [
+        ...getBuiltinBlocklist(),
+        ...createCustomEntries(extraBlocklist),
+    ];
+    for (const entry of allBlocklistEntries) {
+        if (entry.pattern.test(trimmed)) {
+            // Destructive: always blocked, no override
+            if (entry.level === "destructive") {
+                return {
+                    safe: false,
+                    level: "destructive",
+                    reason: `🚫 BLOCKED [${entry.id}]: ${entry.reason}`,
+                    matched_rule: entry.id,
+                    suggestions: getSuggestions(entry),
+                };
+            }
+            // Risky: requires permission prompt
+            if (entry.level === "risky") {
+                return {
+                    safe: false,
+                    level: "risky",
+                    reason: `⚠️ REQUIRES APPROVAL [${entry.id}]: ${entry.reason}`,
+                    matched_rule: entry.id,
+                    suggestions: getSuggestions(entry),
+                };
+            }
+        }
+    }
+    // ── Step 2: In restricted/read_only mode, check allowlist ──
+    if (mode === "restricted" || mode === "read_only") {
+        const allowedCommands = getAllowedCommands(mode);
+        const isAllowed = allowedCommands.some((entry) => entry.pattern.test(trimmed));
+        if (!isAllowed) {
+            return {
+                safe: false,
+                level: "not_in_allowlist",
+                reason: `🔒 NOT ALLOWED in "${mode}" mode. Command not in the allowlist.`,
+                suggestions: [
+                    `Switch to "full" mode to allow all non-blocked commands`,
+                    `Add this command pattern to the allowlist via ssh.security_policy`,
+                ],
+            };
+        }
+    }
+    // ── Command is safe ──
+    return { safe: true, level: "safe" };
+}
+/**
+ * Check if a command is purely read-only (no side effects).
+ */
+export function isReadOnlyCommand(command) {
+    const readOnlyPatterns = [
+        /^ls\b/,
+        /^ll\b/,
+        /^la\b/,
+        /^cat\b/,
+        /^head\b/,
+        /^tail\b/,
+        /^less\b/,
+        /^more\b/,
+        /^grep\b/,
+        /^rg\b/,
+        /^find\b/,
+        /^which\b/,
+        /^whereis\b/,
+        /^whoami\b/,
+        /^id\b/,
+        /^pwd\b/,
+        /^echo\b/,
+        /^date\b/,
+        /^uptime\b/,
+        /^uname\b/,
+        /^hostname\b/,
+        /^df\b/,
+        /^du\b/,
+        /^free\b/,
+        /^ps\b/,
+        /^wc\b/,
+        /^file\b/,
+        /^stat\b/,
+        /^tree\b/,
+        /^diff\b/,
+        /^md5sum\b/,
+        /^sha256sum\b/,
+        /^env\b/,
+        /^printenv\b/,
+        /^man\b/,
+        /^ping\b/,
+        /^dig\b/,
+        /^nslookup\b/,
+        /^docker\s+ps\b/,
+        /^docker\s+images\b/,
+        /^docker\s+logs\b/,
+        /^docker\s+inspect\b/,
+        /^kubectl\s+get\b/,
+        /^kubectl\s+describe\b/,
+        /^kubectl\s+logs\b/,
+        /^kubectl\s+top\b/,
+        /^systemctl\s+status\b/,
+        /^systemctl\s+list\b/,
+        /^journalctl\b/,
+        /^git\s+(status|log|diff|show|branch|remote)\b/,
+    ];
+    return readOnlyPatterns.some((p) => p.test(command.trim()));
+}
+/**
+ * Get safer alternatives for a blocked/risky command.
+ */
+function getSuggestions(entry) {
+    const suggestions = {
+        DESTR: ["This command is permanently blocked and cannot be overridden."],
+        RISK: ["Consider running this command manually via a direct SSH session."],
+    };
+    const prefix = entry.id.split("-")[0];
+    return suggestions[prefix] || ["Consider a safer alternative or run manually."];
+}
+/**
+ * Format validation result for display.
+ */
+export function formatValidationResult(result) {
+    if (result.safe) {
+        return "✅ Command is safe to execute.";
+    }
+    const lines = [result.reason || "Command validation failed."];
+    if (result.matched_rule) {
+        lines.push(`Rule: ${result.matched_rule}`);
+    }
+    if (result.suggestions && result.suggestions.length > 0) {
+        lines.push("\nSuggestions:");
+        for (const s of result.suggestions) {
+            lines.push(`  • ${s}`);
+        }
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=validator.js.map

package/dist/security/validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../src/security/validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAA0C,MAAM,gBAAgB,CAAA;AACjH,OAAO,EAAE,kBAAkB,EAAuB,MAAM,gBAAgB,CAAA;AAgBxE;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,IAAkB,EAClB,iBAA2B,EAAE;IAE7B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IACtC,CAAC;IAED,oDAAoD;IACpD,MAAM,mBAAmB,GAAG;QAC1B,GAAG,mBAAmB,EAAE;QACxB,GAAG,mBAAmB,CAAC,cAAc,CAAC;KACvC,CAAA;IAED,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,2CAA2C;YAC3C,IAAI,KAAK,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;gBAClC,OAAO;oBACL,IAAI,EAAE,KAAK;oBACX,KAAK,EAAE,aAAa;oBACpB,MAAM,EAAE,eAAe,KAAK,CAAC,EAAE,MAAM,KAAK,CAAC,MAAM,EAAE;oBACnD,YAAY,EAAE,KAAK,CAAC,EAAE;oBACtB,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC;iBACnC,CAAA;YACH,CAAC;YAED,oCAAoC;YACpC,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;gBAC5B,OAAO;oBACL,IAAI,EAAE,KAAK;oBACX,KAAK,EAAE,OAAO;oBACd,MAAM,EAAE,yBAAyB,KAAK,CAAC,EAAE,MAAM,KAAK,CAAC,MAAM,EAAE;oBAC7D,YAAY,EAAE,KAAK,CAAC,EAAE;oBACtB,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC;iBACnC,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAClD,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;QAChD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;QAE9E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE,kBAAkB;gBACzB,MAAM,EAAE,sBAAsB,IAAI,uCAAuC;gBACzE,WAAW,EAAE;oBACX,yDAAyD;oBACzD,mEAAmE;iBACpE;aACF,CAAA;QACH,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,gBAAgB,GAAG;QACvB,OAAO;QACP,OAAO;QACP,OAAO;QACP,QAAQ;QACR,SAAS;QACT,SAAS;QACT,SAAS;QACT,SAAS;QACT,SAAS;QACT,OAAO;QACP,SAAS;QACT,UAAU;QACV,YAAY;QACZ,WAAW;QACX,OAAO;QACP,QAAQ;QACR,SAAS;QACT,SAAS;QACT,WAAW;QACX,UAAU;QACV,aAAa;QACb,OAAO;QACP,OAAO;QACP,SAAS;QACT,OAAO;QACP,OAAO;QACP,SAAS;QACT,SAAS;QACT,SAAS;QACT,SAAS;QACT,WAAW;QACX,cAAc;QACd,QAAQ;QACR,aAAa;QACb,QAAQ;QACR,SAAS;QACT,QAAQ;QACR,aAAa;QACb,gBAAgB;QAChB,oBAAoB;QACpB,kBAAkB;QAClB,qBAAqB;QACrB,kBAAkB;QAClB,uBAAuB;QACvB,mBAAmB;QACnB,kBAAkB;QAClB,uBAAuB;QACvB,qBAAqB;QACrB,eAAe;QACf,+CAA+C;KAChD,CAAA;IAED,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,KAAqB;IAC3C,MAAM,WAAW,GAA6B;QAC5C,KAAK,EAAE,CAAC,+DAA+D,CAAC;QACxE,IAAI,EAAE,CAAC,kEAAkE,CAAC;KAC3E,CAAA;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACrC,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAA;AACjF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAwB;IAC7D,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,+BAA+B,CAAA;IACxC,CAAC;IAED,MAAM,KAAK,GAAa,CAAC,MAAM,CAAC,MAAM,IAAI,4BAA4B,CAAC,CAAA;IAEvE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,YAAY,EAAE,CAAC,CAAA;IAC5C,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC"}

package/dist/ssh/audit.d.ts

@@ -0,0 +1,47 @@
+export interface AuditEntry {
+    /** ISO timestamp */
+    timestamp: string;
+    /** Session identifier (host@user) */
+    sessionId: string;
+    /** Command executed */
+    command: string;
+    /** Result of the command */
+    result: "success" | "blocked" | "approved" | "error";
+    /** Exit code */
+    exitCode: number;
+    /** Duration in milliseconds */
+    duration: number;
+    /** Reason for blocking/error */
+    reason?: string;
+    /** Matched blocklist rule ID */
+    matchedRule?: string;
+}
+/**
+ * Log a command execution to the audit trail.
+ * Uses JSONL format (append-only).
+ */
+export declare function logCommand(projectDir: string, entry: Omit<AuditEntry, "timestamp">): void;
+/**
+ * Read the audit log entries.
+ */
+export declare function readAuditLog(projectDir: string, options?: {
+    limit?: number;
+    sessionId?: string;
+    commandFilter?: string;
+}): AuditEntry[];
+/**
+ * Format audit log entries for display.
+ */
+export declare function formatAuditLog(entries: AuditEntry[]): string;
+/**
+ * Get audit statistics.
+ */
+export declare function getAuditStats(projectDir: string): {
+    total: number;
+    success: number;
+    blocked: number;
+    approved: number;
+    error: number;
+    blockedCommands: string[];
+};
+//# sourceMappingURL=audit.d.ts.map

package/dist/ssh/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/ssh/audit.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,UAAU;IACzB,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,4BAA4B;IAC5B,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,CAAA;IACpD,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,gCAAgC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gCAAgC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAmBD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,IAAI,CAYzF;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE;IACP,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;CAClB,GACL,UAAU,EAAE,CAmCd;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAuC5D;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG;IACjD,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,EAAE,MAAM,EAAE,CAAA;CAC1B,CAiBA"}

package/dist/ssh/audit.js

@@ -0,0 +1,126 @@
+import { appendFileSync, readFileSync, existsSync, mkdirSync } from "fs";
+import { join } from "path";
+import { getSshDataDir } from "../config/defaults.js";
+const AUDIT_FILE = "audit.jsonl";
+/**
+ * Get the audit log file path.
+ */
+function getAuditPath(projectDir) {
+    const dataDir = getSshDataDir(projectDir);
+    try {
+        if (!existsSync(dataDir)) {
+            mkdirSync(dataDir, { recursive: true });
+        }
+    }
+    catch {
+        // If we can't create the directory, use a fallback
+    }
+    return join(dataDir, AUDIT_FILE);
+}
+/**
+ * Log a command execution to the audit trail.
+ * Uses JSONL format (append-only).
+ */
+export function logCommand(projectDir, entry) {
+    const auditEntry = {
+        timestamp: new Date().toISOString(),
+        ...entry,
+    };
+    try {
+        const auditPath = getAuditPath(projectDir);
+        appendFileSync(auditPath, JSON.stringify(auditEntry) + "\n", "utf-8");
+    }
+    catch {
+        // Audit logging should never crash the main flow
+    }
+}
+/**
+ * Read the audit log entries.
+ */
+export function readAuditLog(projectDir, options = {}) {
+    const auditPath = getAuditPath(projectDir);
+    if (!existsSync(auditPath))
+        return [];
+    try {
+        const content = readFileSync(auditPath, "utf-8");
+        const lines = content.trim().split("\n").filter(Boolean);
+        let entries = lines.map((line) => {
+            try {
+                return JSON.parse(line);
+            }
+            catch {
+                return null;
+            }
+        }).filter((e) => e !== null);
+        // Apply filters
+        if (options.sessionId) {
+            entries = entries.filter((e) => e.sessionId === options.sessionId);
+        }
+        if (options.commandFilter) {
+            const filter = options.commandFilter.toLowerCase();
+            entries = entries.filter((e) => e.command.toLowerCase().includes(filter));
+        }
+        // Apply limit (return most recent entries)
+        if (options.limit && options.limit > 0) {
+            entries = entries.slice(-options.limit);
+        }
+        return entries;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Format audit log entries for display.
+ */
+export function formatAuditLog(entries) {
+    if (entries.length === 0) {
+        return "📋 No audit entries found.";
+    }
+    const lines = [`## SSH Audit Log (${entries.length} entries)\n`];
+    for (const entry of entries) {
+        const icon = entry.result === "success"
+            ? "✅"
+            : entry.result === "approved"
+                ? "⚠️"
+                : entry.result === "blocked"
+                    ? "🚫"
+                    : "❌";
+        const duration = entry.duration < 1000
+            ? `${entry.duration}ms`
+            : `${(entry.duration / 1000).toFixed(1)}s`;
+        lines.push(`${icon} **${entry.timestamp}** | ${entry.sessionId} | \`${entry.command}\``);
+        const details = [];
+        if (entry.exitCode !== 0)
+            details.push(`exit: ${entry.exitCode}`);
+        details.push(`duration: ${duration}`);
+        if (entry.matchedRule)
+            details.push(`rule: ${entry.matchedRule}`);
+        if (entry.reason)
+            details.push(`reason: ${entry.reason}`);
+        if (details.length > 0) {
+            lines.push(`   ${details.join(" | ")}`);
+        }
+        lines.push("");
+    }
+    return lines.join("\n");
+}
+/**
+ * Get audit statistics.
+ */
+export function getAuditStats(projectDir) {
+    const entries = readAuditLog(projectDir);
+    return {
+        total: entries.length,
+        success: entries.filter((e) => e.result === "success").length,
+        blocked: entries.filter((e) => e.result === "blocked").length,
+        approved: entries.filter((e) => e.result === "approved").length,
+        error: entries.filter((e) => e.result === "error").length,
+        blockedCommands: [
+            ...new Set(entries
+                .filter((e) => e.result === "blocked")
+                .map((e) => e.command)),
+        ],
+    };
+}
+//# sourceMappingURL=audit.js.map

package/dist/ssh/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/ssh/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAA;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAqBrD,MAAM,UAAU,GAAG,aAAa,CAAA;AAEhC;;GAEG;AACH,SAAS,YAAY,CAAC,UAAkB;IACtC,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;IACzC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,UAAkB,EAAE,KAAoC;IACjF,MAAM,UAAU,GAAe;QAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,GAAG,KAAK;KACT,CAAA;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;QAC1C,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAkB,EAClB,UAII,EAAE;IAEN,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;IAC1C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAA;IAErC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAExD,IAAI,OAAO,GAAiB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC7C,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAA;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;QAE7C,gBAAgB;QAChB,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAA;QACpE,CAAC;QAED,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE,CAAA;YAClD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3E,CAAC;QAED,2CAA2C;QAC3C,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACzC,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,OAAqB;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,4BAA4B,CAAA;IACrC,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,qBAAqB,OAAO,CAAC,MAAM,aAAa,CAAC,CAAA;IAEhE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GACR,KAAK,CAAC,MAAM,KAAK,SAAS;YACxB,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU;gBAC3B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;oBAC1B,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,GAAG,CAAA;QAEb,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,GAAG,IAAI;YACpC,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI;YACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAA;QAE5C,KAAK,CAAC,IAAI,CACR,GAAG,IAAI,MAAM,KAAK,CAAC,SAAS,QAAQ,KAAK,CAAC,SAAS,QAAQ,KAAK,CAAC,OAAO,IAAI,CAC7E,CAAA;QAED,MAAM,OAAO,GAAa,EAAE,CAAA;QAC5B,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;QACjE,OAAO,CAAC,IAAI,CAAC,aAAa,QAAQ,EAAE,CAAC,CAAA;QACrC,IAAI,KAAK,CAAC,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;QACjE,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;QAEzD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACzC,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB;IAQ9C,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;IAExC,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,MAAM;QACrB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;QAC7D,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;QAC7D,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM;QAC/D,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM;QACzD,eAAe,EAAE;YACf,GAAG,IAAI,GAAG,CACR,OAAO;iBACJ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;iBACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CACzB;SACF;KACF,CAAA;AACH,CAAC"}

package/dist/ssh/connection.d.ts

@@ -0,0 +1,73 @@
+export interface SshConnectionConfig {
+    host: string;
+    port: number;
+    username: string;
+    authMethod: "password" | "key";
+    password?: string;
+    keyPath?: string;
+    passphrase?: string;
+    /** Timeout in milliseconds */
+    timeout?: number;
+    /** Connection alias for display */
+    alias?: string;
+}
+export interface SshConnectionInfo {
+    id: string;
+    config: SshConnectionConfig;
+    connected: boolean;
+    connectedAt?: string;
+    lastActivity?: string;
+}
+export declare class SshConnection {
+    private client;
+    private _config;
+    private _id;
+    private _connected;
+    private _connectedAt?;
+    private _lastActivity?;
+    private _reconnectAttempts;
+    private _maxReconnectAttempts;
+    constructor(id: string, config: SshConnectionConfig);
+    get id(): string;
+    get config(): SshConnectionConfig;
+    get connected(): boolean;
+    get connectedAt(): Date | undefined;
+    get lastActivity(): Date | undefined;
+    /**
+     * Connect to the SSH server.
+     */
+    connect(): Promise<void>;
+    /**
+     * Execute a command on the remote server.
+     * Returns a stream for real-time output.
+     */
+    exec(command: string, options?: {
+        cwd?: string;
+        timeout?: number;
+    }): Promise<{
+        stdout: string;
+        stderr: string;
+        code: number | null;
+        signal: string | undefined;
+    }>;
+    /**
+     * Execute a command and return it as a readable stream (for real-time output).
+     */
+    execStream(command: string, options?: {
+        cwd?: string;
+        timeout?: number;
+    }): NodeJS.ReadableStream | null;
+    /**
+     * Get an SFTP session for file transfers.
+     */
+    sftp(): Promise<any>;
+    /**
+     * Disconnect from the SSH server.
+     */
+    disconnect(): void;
+    /**
+     * Get connection info for display.
+     */
+    getInfo(): SshConnectionInfo;
+}
+//# sourceMappingURL=connection.d.ts.map

package/dist/ssh/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/ssh/connection.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,UAAU,GAAG,KAAK,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,mBAAmB,CAAA;IAC3B,SAAS,EAAE,OAAO,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,GAAG,CAAQ;IACnB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,YAAY,CAAC,CAAM;IAC3B,OAAO,CAAC,aAAa,CAAC,CAAM;IAC5B,OAAO,CAAC,kBAAkB,CAAI;IAC9B,OAAO,CAAC,qBAAqB,CAAI;gBAErB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB;IAMnD,IAAI,EAAE,IAAI,MAAM,CAEf;IAED,IAAI,MAAM,IAAI,mBAAmB,CAEhC;IAED,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,IAAI,WAAW,IAAI,IAAI,GAAG,SAAS,CAElC;IAED,IAAI,YAAY,IAAI,IAAI,GAAG,SAAS,CAEnC;IAED;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA+D9B;;;OAGG;IACG,IAAI,CACR,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IA8D/F;;OAEG;IACH,UAAU,CACR,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,MAAM,CAAC,cAAc,GAAG,IAAI;IAgB/B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC;IAgB1B;;OAEG;IACH,UAAU,IAAI,IAAI;IAOlB;;OAEG;IACH,OAAO,IAAI,iBAAiB;CAgB7B"}

package/dist/ssh/connection.js

@@ -0,0 +1,210 @@
+import { Client } from "ssh2";
+import { readFileSync, existsSync } from "fs";
+import { resolve as pathResolve } from "path";
+import { escapeShellArg } from "./sanitizer.js";
+export class SshConnection {
+    client;
+    _config;
+    _id;
+    _connected = false;
+    _connectedAt;
+    _lastActivity;
+    _reconnectAttempts = 0;
+    _maxReconnectAttempts = 3;
+    constructor(id, config) {
+        this._id = id;
+        this._config = config;
+        this.client = new Client();
+    }
+    get id() {
+        return this._id;
+    }
+    get config() {
+        return this._config;
+    }
+    get connected() {
+        return this._connected;
+    }
+    get connectedAt() {
+        return this._connectedAt;
+    }
+    get lastActivity() {
+        return this._lastActivity;
+    }
+    /**
+     * Connect to the SSH server.
+     */
+    async connect() {
+        return new Promise((resolve, reject) => {
+            const connectConfig = {
+                host: this._config.host,
+                port: this._config.port,
+                username: this._config.username,
+                readyTimeout: this._config.timeout || 10000,
+                keepaliveInterval: 10000,
+                keepaliveCountMax: 3,
+            };
+            // Configure authentication
+            if (this._config.authMethod === "password") {
+                connectConfig.password = this._config.password;
+            }
+            else {
+                // Key-based authentication
+                const keyPath = this._config.keyPath
+                    ? pathResolve(this._config.keyPath.replace("~", process.env.HOME || ""))
+                    : pathResolve(process.env.HOME || "", ".ssh", "id_rsa");
+                if (!existsSync(keyPath)) {
+                    reject(new Error(`SSH key not found: ${keyPath}`));
+                    return;
+                }
+                connectConfig.privateKey = readFileSync(keyPath, "utf-8");
+                if (this._config.passphrase) {
+                    connectConfig.passphrase = this._config.passphrase;
+                }
+            }
+            this.client.on("ready", () => {
+                this._connected = true;
+                this._connectedAt = new Date();
+                this._lastActivity = new Date();
+                this._reconnectAttempts = 0;
+                resolve();
+            });
+            this.client.on("error", (err) => {
+                this._connected = false;
+                if (this._reconnectAttempts < this._maxReconnectAttempts) {
+                    this._reconnectAttempts++;
+                    // Attempt reconnect after delay
+                    setTimeout(() => {
+                        this.connect().catch(() => { });
+                    }, 1000 * this._reconnectAttempts);
+                }
+                reject(err);
+            });
+            this.client.on("close", () => {
+                this._connected = false;
+            });
+            this.client.on("end", () => {
+                this._connected = false;
+            });
+            this.client.connect(connectConfig);
+        });
+    }
+    /**
+     * Execute a command on the remote server.
+     * Returns a stream for real-time output.
+     */
+    async exec(command, options) {
+        if (!this._connected) {
+            throw new Error("SSH connection is not active");
+        }
+        this._lastActivity = new Date();
+        const wrappedCommand = options?.cwd
+            ? `cd ${escapeShellArg(options.cwd)} && ${command}`
+            : command;
+        return new Promise((resolve, reject) => {
+            const timeoutMs = (options?.timeout || 30) * 1000;
+            let timeoutId;
+            this.client.exec(wrappedCommand, (err, stream) => {
+                if (err) {
+                    reject(err);
+                    return;
+                }
+                let stdout = "";
+                let stderr = "";
+                let killed = false;
+                // Set timeout
+                if (timeoutMs > 0) {
+                    timeoutId = setTimeout(() => {
+                        killed = true;
+                        stream.close();
+                        reject(new Error(`Command timed out after ${timeoutMs / 1000}s`));
+                    }, timeoutMs);
+                }
+                stream.on("data", (data) => {
+                    stdout += data.toString("utf-8");
+                });
+                stream.stderr.on("data", (data) => {
+                    stderr += data.toString("utf-8");
+                });
+                stream.on("close", (code, signal) => {
+                    if (timeoutId)
+                        clearTimeout(timeoutId);
+                    if (killed)
+                        return;
+                    resolve({
+                        stdout,
+                        stderr,
+                        code: code ?? 1,
+                        signal: signal ?? undefined,
+                    });
+                });
+                stream.on("error", (streamErr) => {
+                    if (timeoutId)
+                        clearTimeout(timeoutId);
+                    reject(streamErr);
+                });
+            });
+        });
+    }
+    /**
+     * Execute a command and return it as a readable stream (for real-time output).
+     */
+    execStream(command, options) {
+        if (!this._connected) {
+            return null;
+        }
+        this._lastActivity = new Date();
+        const wrappedCommand = options?.cwd
+            ? `cd ${escapeShellArg(options.cwd)} && ${command}`
+            : command;
+        // This returns a stream that can be consumed externally
+        // The actual streaming is handled by the executor
+        return null; // Placeholder - actual streaming handled in executor.ts
+    }
+    /**
+     * Get an SFTP session for file transfers.
+     */
+    async sftp() {
+        if (!this._connected) {
+            throw new Error("SSH connection is not active");
+        }
+        return new Promise((resolve, reject) => {
+            this.client.sftp((err, sftp) => {
+                if (err) {
+                    reject(err);
+                    return;
+                }
+                resolve(sftp);
+            });
+        });
+    }
+    /**
+     * Disconnect from the SSH server.
+     */
+    disconnect() {
+        if (this._connected) {
+            this.client.end();
+            this._connected = false;
+        }
+    }
+    /**
+     * Get connection info for display.
+     */
+    getInfo() {
+        return {
+            id: this._id,
+            config: {
+                host: this._config.host,
+                port: this._config.port,
+                username: this._config.username,
+                authMethod: this._config.authMethod,
+                alias: this._config.alias,
+                // NEVER expose password or key in info
+            },
+            connected: this._connected,
+            connectedAt: this._connectedAt?.toISOString(),
+            lastActivity: this._lastActivity?.toISOString(),
+        };
+    }
+}
+//# sourceMappingURL=connection.js.map

package/dist/ssh/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/ssh/connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAsB,MAAM,MAAM,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAA;AAC7C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,MAAM,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAwB/C,MAAM,OAAO,aAAa;IAChB,MAAM,CAAQ;IACd,OAAO,CAAqB;IAC5B,GAAG,CAAQ;IACX,UAAU,GAAG,KAAK,CAAA;IAClB,YAAY,CAAO;IACnB,aAAa,CAAO;IACpB,kBAAkB,GAAG,CAAC,CAAA;IACtB,qBAAqB,GAAG,CAAC,CAAA;IAEjC,YAAY,EAAU,EAAE,MAA2B;QACjD,IAAI,CAAC,GAAG,GAAG,EAAE,CAAA;QACb,IAAI,CAAC,OAAO,GAAG,MAAM,CAAA;QACrB,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,EAAE,CAAA;IAC5B,CAAC;IAED,IAAI,EAAE;QACJ,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,CAAA;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,aAAa,GAAkB;gBACnC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBACvB,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBACvB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC/B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK;gBAC3C,iBAAiB,EAAE,KAAK;gBACxB,iBAAiB,EAAE,CAAC;aACrB,CAAA;YAED,2BAA2B;YAC3B,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBAC3C,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAA;YAChD,CAAC;iBAAM,CAAC;gBACN,2BAA2B;gBAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO;oBAClC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;oBACxE,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;gBAEzD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBACzB,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC,CAAA;oBAClD,OAAM;gBACR,CAAC;gBAED,aAAa,CAAC,UAAU,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACzD,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;oBAC5B,aAAa,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAA;gBACpD,CAAC;YACH,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC3B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;gBACtB,IAAI,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAA;gBAC9B,IAAI,CAAC,aAAa,GAAG,IAAI,IAAI,EAAE,CAAA;gBAC/B,IAAI,CAAC,kBAAkB,GAAG,CAAC,CAAA;gBAC3B,OAAO,EAAE,CAAA;YACX,CAAC,CAAC,CAAA;YAEF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;gBACrC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAA;gBACvB,IAAI,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;oBACzD,IAAI,CAAC,kBAAkB,EAAE,CAAA;oBACzB,gCAAgC;oBAChC,UAAU,CAAC,GAAG,EAAE;wBACd,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;oBAChC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAA;gBACpC,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,CAAA;YACb,CAAC,CAAC,CAAA;YAEF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC3B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAA;YACzB,CAAC,CAAC,CAAA;YAEF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACzB,IAAI,CAAC,UAAU,GAAG,KAAK,CAAA;YACzB,CAAC,CAAC,CAAA;YAEF,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QACpC,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CACR,OAAe,EACf,OAA4C;QAE5C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,IAAI,EAAE,CAAA;QAE/B,MAAM,cAAc,GAAG,OAAO,EAAE,GAAG;YACjC,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE;YACnD,CAAC,CAAC,OAAO,CAAA;QAEX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;YACjD,IAAI,SAAoD,CAAA;YAExD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;gBAC/C,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,CAAC,GAAG,CAAC,CAAA;oBACX,OAAM;gBACR,CAAC;gBAED,IAAI,MAAM,GAAG,EAAE,CAAA;gBACf,IAAI,MAAM,GAAG,EAAE,CAAA;gBACf,IAAI,MAAM,GAAG,KAAK,CAAA;gBAElB,cAAc;gBACd,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;oBAClB,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;wBAC1B,MAAM,GAAG,IAAI,CAAA;wBACb,MAAM,CAAC,KAAK,EAAE,CAAA;wBACd,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,CAAA;oBACnE,CAAC,EAAE,SAAS,CAAC,CAAA;gBACf,CAAC;gBAED,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;oBACjC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBAClC,CAAC,CAAC,CAAA;gBAEF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;oBACxC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBAClC,CAAC,CAAC,CAAA;gBAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,MAAqB,EAAE,EAAE;oBAChE,IAAI,SAAS;wBAAE,YAAY,CAAC,SAAS,CAAC,CAAA;oBACtC,IAAI,MAAM;wBAAE,OAAM;oBAElB,OAAO,CAAC;wBACN,MAAM;wBACN,MAAM;wBACN,IAAI,EAAE,IAAI,IAAI,CAAC;wBACf,MAAM,EAAE,MAAM,IAAI,SAAS;qBAC5B,CAAC,CAAA;gBACJ,CAAC,CAAC,CAAA;gBAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,SAAgB,EAAE,EAAE;oBACtC,IAAI,SAAS;wBAAE,YAAY,CAAC,SAAS,CAAC,CAAA;oBACtC,MAAM,CAAC,SAAS,CAAC,CAAA;gBACnB,CAAC,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;OAEG;IACH,UAAU,CACR,OAAe,EACf,OAA4C;QAE5C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,IAAI,EAAE,CAAA;QAE/B,MAAM,cAAc,GAAG,OAAO,EAAE,GAAG;YACjC,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE;YACnD,CAAC,CAAC,OAAO,CAAA;QAEX,wDAAwD;QACxD,kDAAkD;QAClD,OAAO,IAAW,CAAA,CAAC,wDAAwD;IAC7E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;gBAC7B,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,CAAC,GAAG,CAAC,CAAA;oBACX,OAAM;gBACR,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,CAAA;YACf,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAA;YACjB,IAAI,CAAC,UAAU,GAAG,KAAK,CAAA;QACzB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,GAAG;YACZ,MAAM,EAAE;gBACN,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBACvB,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBACvB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC/B,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;gBACnC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;gBACzB,uCAAuC;aACxC;YACD,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE;YAC7C,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE;SAChD,CAAA;IACH,CAAC;CACF"}