@kya-os/cli 1.8.1 → 1.8.3

package/dist/utils/dco/verify.js

@@ -0,0 +1,550 @@
+import { lookup as dnsLookup } from "node:dns/promises";
+import { isValidDid } from "./claude-config.js";
+/**
+ * Exported (review-loop P9 commit 3) so `review verify`'s did:web
+ * resolution (`../review/did-web-key.ts`) can pass the real resolver
+ * through to {@link checkDocumentHostIsSafe} without redefining it — same
+ * reasoning as that export.
+ */
+export const defaultLookup = async (hostname) => {
+    const records = await dnsLookup(hostname, { all: true });
+    return records.map((record) => record.address);
+};
+/**
+ * The document host is chosen by the DID, which comes from a PR body we do
+ * not control. Without a deadline a hostile or merely unreachable host hangs
+ * the command for as long as it cares to hold the socket open — tolerable
+ * when a human can interrupt it, not when this runs unattended in CI.
+ */
+export const RESOLVE_TIMEOUT_MS = 10000;
+/**
+ * Captures the whole remainder of the line, not the first whitespace-free
+ * run. Truncating at whitespace would silently reduce a malformed value to
+ * whichever prefix happens to parse: `Agent DID: did:web:knowthat.ai junk`
+ * would become `did:web:knowthat.ai`, resolve the registry's own root
+ * document, match its own `id`, and report a forged line as verified.
+ */
+const AGENT_DID_LINE = /Agent DID:[^\S\n\r]*([^\n\r]*)/g;
+/**
+ * Pull the claimed DID out of a PR body.
+ *
+ * Returns null when the body claims two *different* DIDs. Taking the first
+ * match would mean an appended line could never change the verdict, but it
+ * would also mean a forged line prepended above the real one silently wins.
+ * Ambiguous attribution is a failure, not a tie to be broken.
+ */
+export function extractAgentDid(prBody) {
+    const claimed = new Set();
+    for (const match of prBody.matchAll(AGENT_DID_LINE)) {
+        // The managed block wraps the line in a code span, so a trailing
+        // backtick is expected punctuation rather than part of the identifier.
+        const candidate = match[1].replace(/`+\s*$/, "").trim();
+        if (isValidDid(candidate)) {
+            claimed.add(candidate);
+        }
+    }
+    if (claimed.size !== 1)
+        return null;
+    return [...claimed][0];
+}
+/**
+ * Whether a piece of text already carries an `Agent DID:` attribution line
+ * that `extractAgentDid` would pick up. Uses the exact same line pattern and
+ * backtick/whitespace handling, so a caller (notably `dco dispatch`, which
+ * appends its own authoritative line) can reject a description that would
+ * otherwise put a second, conflicting DID into the PR body. Matches the
+ * managed CLAUDE.md block's backticked, mid-line form, not just a line-start
+ * one.
+ */
+export function hasAgentDidClaim(text) {
+    for (const match of text.matchAll(AGENT_DID_LINE)) {
+        const candidate = match[1].replace(/`+\s*$/, "").trim();
+        if (isValidDid(candidate)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Map a `did:web` to the HTTPS URL its document must be served from, per the
+ * did:web method spec: the identifier's colon-separated segments *are* the
+ * path, and a bare domain resolves under `/.well-known/`.
+ *
+ * Segments are validated AFTER percent-decoding. `DID_PATTERN` permits `%`,
+ * so a crafted `%2F` would otherwise smuggle a path separator through and
+ * point resolution at an attacker-chosen URL on the same host.
+ */
+export function didWebToHttpsUrl(did) {
+    const prefix = "did:web:";
+    if (!did.startsWith(prefix))
+        return null;
+    const segments = did.slice(prefix.length).split(":");
+    if (segments.length === 0 || segments.some((segment) => segment === "")) {
+        return null;
+    }
+    const decoded = [];
+    for (const segment of segments) {
+        try {
+            decoded.push(decodeURIComponent(segment));
+        }
+        catch {
+            return null;
+        }
+    }
+    const [host, ...path] = decoded;
+    // Host may carry a port (encoded as %3A in the DID) but nothing else.
+    if (!/^[A-Za-z0-9.-]+(:\d+)?$/.test(host))
+        return null;
+    if (path.some((segment) => segment === "" ||
+        segment === "." ||
+        segment === ".." ||
+        /[/\\?#]/.test(segment))) {
+        return null;
+    }
+    const suffix = path.length
+        ? `${path.join("/")}/did.json`
+        : ".well-known/did.json";
+    return `https://${host}/${suffix}`;
+}
+/**
+ * IPv4 ranges that must never be treated as a resolvable did:web host:
+ * loopback, all three RFC1918 private blocks, link-local (which is also
+ * where every major cloud's instance-metadata service lives, at
+ * 169.254.169.254), and the remaining reserved/special-use blocks that have
+ * no business serving a public DID document.
+ */
+const BLOCKED_IPV4_RANGES = [
+    ["0.0.0.0", 8], // "this network"
+    ["10.0.0.0", 8], // RFC1918 private
+    ["100.64.0.0", 10], // shared address space (CGNAT)
+    ["127.0.0.0", 8], // loopback
+    ["169.254.0.0", 16], // link-local, incl. cloud metadata (169.254.169.254)
+    ["172.16.0.0", 12], // RFC1918 private
+    ["192.0.0.0", 24], // IETF protocol assignments
+    ["192.0.2.0", 24], // documentation (TEST-NET-1)
+    ["192.168.0.0", 16], // RFC1918 private
+    ["198.18.0.0", 15], // benchmarking
+    ["198.51.100.0", 24], // documentation (TEST-NET-2)
+    ["203.0.113.0", 24], // documentation (TEST-NET-3)
+    ["224.0.0.0", 4], // multicast
+    ["240.0.0.0", 4], // reserved, incl. the 255.255.255.255 broadcast address
+];
+function ipv4ToInt(ip) {
+    const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(ip);
+    if (!match)
+        return null;
+    const octets = match.slice(1, 5).map(Number);
+    if (octets.some((octet) => octet > 255))
+        return null;
+    return (((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>>
+        0);
+}
+function isBlockedIpv4(ip) {
+    const value = ipv4ToInt(ip);
+    if (value === null)
+        return false;
+    return BLOCKED_IPV4_RANGES.some(([base, prefix]) => {
+        const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0;
+        return (value & mask) === (ipv4ToInt(base) & mask);
+    });
+}
+/**
+ * The IPv6 counterparts of the ranges above: loopback, unspecified,
+ * link-local (`fe80::/10`), and unique-local (`fc00::/7`, the IPv6 analogue
+ * of RFC1918). A resolver can hand back either family, so an address that
+ * only checked IPv4 would wave an AAAA-only loopback/private record through.
+ */
+function isBlockedIpv6(ip) {
+    const lower = ip.toLowerCase();
+    // A v4-mapped/v4-compatible address ends in a dotted IPv4 literal (e.g.
+    // "::ffff:127.0.0.1") — defer to the IPv4 check on that embedded address.
+    const tail = lower.slice(lower.lastIndexOf(":") + 1);
+    if (tail.includes(".") && isBlockedIpv4(tail))
+        return true;
+    if (lower === "::1" || lower === "::")
+        return true;
+    const firstGroup = lower.split(":")[0];
+    const firstHextet = firstGroup === "" ? NaN : parseInt(firstGroup, 16);
+    if (Number.isNaN(firstHextet))
+        return false;
+    if (firstHextet >= 0xfe80 && firstHextet <= 0xfebf)
+        return true; // link-local
+    if (firstHextet >= 0xfc00 && firstHextet <= 0xfdff)
+        return true; // unique-local
+    return false;
+}
+function isBlockedAddress(ip) {
+    return ip.includes(":") ? isBlockedIpv6(ip) : isBlockedIpv4(ip);
+}
+/**
+ * Cheap, synchronous first line of defense against the exact literals an
+ * attacker would put directly in a did:web host: `localhost`, or an IPv4
+ * literal in a private, loopback, link-local, or otherwise reserved range.
+ *
+ * Takes the hostname `new URL()` produces, not the raw did:web segment.
+ * `URL` canonicalizes decimal/hex/octal IPv4 shorthand (`2130706433` and
+ * `0x7f000001` both become `127.0.0.1`) before `fetch` ever sees it, so
+ * checking the pre-parse segment would miss exactly the encodings an
+ * attacker would reach for to slip past a naive dotted-quad check. The
+ * trailing dot is stripped first for the same reason: `new URL()` preserves
+ * a root-zone dot (`"localhost."` stays `"localhost."`), and DNS treats it
+ * as identical to `"localhost"` — an unstripped compare would let that
+ * single character walk straight past an exact-match or `endsWith` check.
+ *
+ * This is a fast-path, not the actual guarantee: it only catches literals,
+ * so it cannot see a normal-looking hostname whose A/AAAA record happens to
+ * point at an internal address. `hostResolvesToBlockedAddress` below is
+ * what actually closes that gap, by checking where the name resolves to
+ * rather than how it's spelled.
+ */
+export function isBlockedResolutionHost(hostname) {
+    const lower = hostname.toLowerCase().replace(/\.$/, "");
+    if (lower === "localhost" || lower.endsWith(".localhost"))
+        return true;
+    return isBlockedAddress(lower);
+}
+/**
+ * The actual guarantee `isBlockedResolutionHost` can't provide on its own:
+ * resolve the hostname and check every address it answers to, not just
+ * whether the hostname string itself looks like one of the blocked
+ * literals. A domain an attacker controls can point an A/AAAA record at
+ * 169.254.169.254 (or loopback, or an RFC1918 address) just as easily as a
+ * did:web host can spell the address out directly — DNS is the attacker's
+ * to shape here just as much as the PR body text is, since the DID names
+ * whatever host they choose.
+ *
+ * Deliberately does not catch a lookup failure: that is "no evidence
+ * either way", the same as a failed fetch, and the caller already has a
+ * reason for that (`unresolvable`) that this must not collide with —
+ * mislabeling a plain NXDOMAIN as "blocked-host" would tell the CLI's user
+ * they hit a private address when they actually just mistyped a domain.
+ */
+export async function hostResolvesToBlockedAddress(hostname, lookupImpl = defaultLookup) {
+    const addresses = await lookupImpl(hostname);
+    return addresses.some(isBlockedAddress);
+}
+/**
+ * Everything that has to be true about `documentUrl`'s host before it is
+ * worth spending a request on: it must parse, it must not be one of the
+ * literals `isBlockedResolutionHost` recognizes, and it must not resolve to
+ * one either. Pulled out on its own so `verifyPrAttribution` reads as one
+ * linear pipeline instead of three nested guard clauses doing the same kind
+ * of check.
+ *
+ * Exported (review-loop P9 commit 3): `review verify`'s did:web resolution
+ * fetches a DIFFERENT document (an agent's DID document, not a PR-body
+ * claim) from an equally untrusted, wire-supplied host, and needs the exact
+ * same SSRF defense before spending a request on it. Reusing this function
+ * keeps that defense in ONE place rather than re-deriving the blocked-range
+ * checks a second time.
+ */
+export async function checkDocumentHostIsSafe(documentUrl, lookupImpl) {
+    let hostname;
+    try {
+        hostname = new URL(documentUrl).hostname;
+    }
+    catch {
+        return {
+            safe: false,
+            reason: "unresolvable",
+            detail: "The resolved document URL was invalid.",
+        };
+    }
+    if (isBlockedResolutionHost(hostname)) {
+        return {
+            safe: false,
+            reason: "blocked-host",
+            detail: "Refusing to resolve a private, loopback, link-local, or metadata address.",
+        };
+    }
+    let blocked;
+    try {
+        blocked = await hostResolvesToBlockedAddress(hostname, lookupImpl);
+    }
+    catch (error) {
+        // Same reasoning as a failed fetch: no evidence either way, so no pass.
+        return {
+            safe: false,
+            reason: "unresolvable",
+            detail: error instanceof Error ? error.message : String(error),
+        };
+    }
+    if (blocked) {
+        return {
+            safe: false,
+            reason: "blocked-host",
+            detail: "The claimed DID resolves to a private, loopback, link-local, or metadata address.",
+        };
+    }
+    return { safe: true };
+}
+function readServiceEndpoint(document) {
+    if (typeof document !== "object" || document === null)
+        return undefined;
+    const service = document.service;
+    if (!Array.isArray(service))
+        return undefined;
+    for (const entry of service) {
+        if (typeof entry !== "object" || entry === null)
+            continue;
+        const endpoint = entry.serviceEndpoint;
+        if (typeof endpoint === "string" && endpoint.length > 0)
+            return endpoint;
+    }
+    return undefined;
+}
+/**
+ * Fetch and identity-check a did:web document: map the DID to its HTTPS
+ * document URL, refuse an unsafe host (SSRF guard — see
+ * `checkDocumentHostIsSafe`'s own doc comment), fetch it without following
+ * redirects, and confirm the resolved document's `id` actually matches the
+ * DID being resolved. Shared by `verifyPrAttribution` (which only needs the
+ * identity check) and `resolveAgentEd25519PublicKey` (which additionally
+ * needs a key out of the same document) so the two never drift on what
+ * "resolves" means — a document that passes this step for one must pass it
+ * for the other too.
+ */
+async function resolveDidWebDocument(did, fetchImpl, lookupImpl) {
+    const documentUrl = didWebToHttpsUrl(did);
+    if (!documentUrl) {
+        return {
+            ok: false,
+            reason: "unsupported-method",
+            detail: "Only did:web identities can be resolved over HTTPS.",
+        };
+    }
+    // The document host came from untrusted input (a PR body, or a reviewer
+    // DID read off a PR review — either way, not ours to control), so it is
+    // checked — both how it's spelled and where it actually resolves — before
+    // we ever make a request to it. Skipping this would let an IP literal, or
+    // a normal-looking domain with an A/AAAA record pointing at one, reach a
+    // loopback, private, link-local, or cloud-metadata address — an SSRF that
+    // hostile input can trigger unattended in CI.
+    const hostCheck = await checkDocumentHostIsSafe(documentUrl, lookupImpl);
+    if (!hostCheck.safe) {
+        return { ok: false, documentUrl, reason: hostCheck.reason, detail: hostCheck.detail };
+    }
+    let response;
+    try {
+        response = await fetchImpl(documentUrl, {
+            signal: AbortSignal.timeout(RESOLVE_TIMEOUT_MS),
+            // A redirect target is unverified: it could bounce to an internal
+            // address the check above never saw. Refusing to follow it, rather
+            // than trusting `fetch`'s default of following automatically, keeps
+            // this host check from being bypassable by a 3xx response.
+            redirect: "manual",
+        });
+    }
+    catch (error) {
+        // A transport failure is indistinguishable from a missing document as far
+        // as trust goes: neither produced evidence, so neither may pass.
+        return {
+            ok: false,
+            documentUrl,
+            reason: "unresolvable",
+            detail: error instanceof Error ? error.message : String(error),
+        };
+    }
+    if (!response.ok) {
+        return {
+            ok: false,
+            documentUrl,
+            reason: "unresolvable",
+            detail: response.type === "opaqueredirect"
+                ? "Server returned a redirect, which is not followed."
+                : `HTTP ${response.status}`,
+        };
+    }
+    let document;
+    try {
+        document = await response.json();
+    }
+    catch {
+        return {
+            ok: false,
+            documentUrl,
+            reason: "unresolvable",
+            detail: "Response was not valid JSON.",
+        };
+    }
+    const resolvedId = typeof document === "object" && document !== null
+        ? document.id
+        : undefined;
+    // A document that resolves but names a different subject proves nothing
+    // about the claimed identity.
+    if (resolvedId !== did) {
+        return {
+            ok: false,
+            documentUrl,
+            reason: "did-mismatch",
+            detail: `Document describes ${typeof resolvedId === "string" ? resolvedId : "no DID"}.`,
+        };
+    }
+    return { ok: true, document, documentUrl };
+}
+/**
+ * Resolve the DID claimed by a PR body and confirm the document describes
+ * that same DID.
+ */
+export async function verifyPrAttribution(prBody, fetchImpl = (url, init) => fetch(url, init), lookupImpl = defaultLookup) {
+    const did = extractAgentDid(prBody);
+    if (!did)
+        return { ok: false, reason: "no-did" };
+    const resolved = await resolveDidWebDocument(did, fetchImpl, lookupImpl);
+    if (!resolved.ok) {
+        return {
+            ok: false,
+            did,
+            documentUrl: resolved.documentUrl,
+            reason: resolved.reason,
+            detail: resolved.detail,
+        };
+    }
+    return {
+        ok: true,
+        did,
+        documentUrl: resolved.documentUrl,
+        agentUrl: readServiceEndpoint(resolved.document),
+    };
+}
+/**
+ * Extract the first Ed25519 (OKP) public JWK's raw 32-byte key out of a DID
+ * document's `verificationMethod` array. Mirrors
+ * `packages/compute/src/didcomm/did-web.ts`'s `extractEd25519Jwk` (that
+ * module lives in `@kya-os/compute`, which the CLI must never import — see
+ * this feature's design doc — so the extraction logic is duplicated here
+ * rather than shared, not delegated).
+ */
+// Bitcoin/base58btc alphabet, matching `@kya-os/mcp-i-core`'s `base58.ts` and
+// `did-key-resolver.ts` byte for byte (reimplemented here, not imported: the
+// CLI has no dependency on that package, and this decode is small enough
+// that a second copy is cheaper than a new cross-package dependency for it —
+// the same tradeoff this ecosystem already makes broadly, see the crypto
+// utility inventory referenced in this repo's own audit notes).
+const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+const BASE58_ALPHABET_MAP = new Map([...BASE58_ALPHABET].map((char, index) => [char, index]));
+/** Decode a base58 (Bitcoin alphabet) string to bytes. Throws on an invalid character. */
+function base58Decode(encoded) {
+    let num = 0n;
+    for (const char of encoded) {
+        const value = BASE58_ALPHABET_MAP.get(char);
+        if (value === undefined) {
+            throw new Error(`Invalid base58 character: ${char}`);
+        }
+        num = num * 58n + BigInt(value);
+    }
+    const bytes = [];
+    while (num > 0n) {
+        bytes.unshift(Number(num % 256n));
+        num /= 256n;
+    }
+    let leadingZeros = 0;
+    for (const char of encoded) {
+        if (char !== "1")
+            break;
+        leadingZeros++;
+    }
+    return Buffer.concat([Buffer.alloc(leadingZeros), Buffer.from(bytes)]);
+}
+/** The 2-byte varint multicodec prefix for an Ed25519 public key (0xed, 0x01). */
+const ED25519_MULTICODEC_PREFIX = Buffer.from([0xed, 0x01]);
+/**
+ * Decode a `publicKeyMultibase` value (the did:key-style encoding:
+ * multibase `z` prefix for base58btc, wrapping the Ed25519 multicodec
+ * prefix followed by the raw 32-byte key) to the raw key. Returns null on
+ * any malformed input — unsupported multibase prefix, invalid base58, or a
+ * multicodec prefix that isn't Ed25519's — rather than throwing.
+ */
+function decodeEd25519PublicKeyMultibase(value) {
+    if (!value.startsWith("z"))
+        return null; // only base58btc is supported
+    let decoded;
+    try {
+        decoded = base58Decode(value.slice(1));
+    }
+    catch {
+        return null;
+    }
+    if (decoded.length !== ED25519_MULTICODEC_PREFIX.length + 32 ||
+        !decoded.subarray(0, 2).equals(ED25519_MULTICODEC_PREFIX)) {
+        return null;
+    }
+    return decoded.subarray(2);
+}
+/**
+ * Extract the first Ed25519 public key out of a DID document's
+ * `verificationMethod` array, trying both encodings production DID
+ * documents actually use: `publicKeyJwk` (OKP/Ed25519) and
+ * `publicKeyMultibase` (`Ed25519VerificationKey2020`, did:key-style
+ * multicodec+base58btc). Confirmed live against a real, currently
+ * registered `did:web:knowthat.ai:agents:*` document — it uses
+ * `publicKeyMultibase`, not `publicKeyJwk`; a version of this function
+ * checking only `publicKeyJwk` silently never resolved any real agent's
+ * key (mirroring `@kya-os/compute`'s `did-web.ts`'s own `publicKeyJwk`-only
+ * `extractEd25519Jwk`, written for a different DID document source — org
+ * root keys — that does use JWK).
+ */
+function extractEd25519PublicKeyRaw(document) {
+    if (typeof document !== "object" || document === null)
+        return null;
+    const methods = document.verificationMethod;
+    if (!Array.isArray(methods))
+        return null;
+    for (const method of methods) {
+        if (typeof method !== "object" || method === null)
+            continue;
+        const jwk = method.publicKeyJwk;
+        if (typeof jwk === "object" && jwk !== null) {
+            const { kty, crv, x } = jwk;
+            if (typeof kty === "string" && kty.toUpperCase() === "OKP" && crv === "Ed25519" && typeof x === "string") {
+                return Buffer.from(x, "base64url");
+            }
+        }
+        const multibase = method.publicKeyMultibase;
+        if (typeof multibase === "string") {
+            const raw = decodeEd25519PublicKeyMultibase(multibase);
+            if (raw)
+                return raw;
+        }
+    }
+    return null;
+}
+/**
+ * Resolve an agent DID to its raw 32-byte Ed25519 public key, for verifying
+ * a signature it produced (a review verdict's or fix attestation's
+ * `proof`). This is `kya-os agent verify`'s "key resolution v1": scoped to
+ * `did:web` only, since every reviewer/maker DID in this feature is
+ * `did:web:knowthat.ai:agents:<slug>` — a `did:key` or other method fails
+ * closed with `unsupported-method` rather than half-supporting it (state
+ * that scope in the command's `--help`, per this feature's design doc).
+ *
+ * The DID here is read off a PR review or comment — the same
+ * untrusted-input shape `verifyPrAttribution` already handles — so it goes
+ * through the identical SSRF-hardened resolution path
+ * (`resolveDidWebDocument`) before this function ever looks at the document
+ * for a key.
+ */
+export async function resolveAgentEd25519PublicKey(did, fetchImpl = (url, init) => fetch(url, init), lookupImpl = defaultLookup) {
+    const resolved = await resolveDidWebDocument(did, fetchImpl, lookupImpl);
+    if (!resolved.ok) {
+        return {
+            ok: false,
+            did,
+            documentUrl: resolved.documentUrl,
+            reason: resolved.reason,
+            detail: resolved.detail,
+        };
+    }
+    const publicKeyRaw = extractEd25519PublicKeyRaw(resolved.document);
+    if (!publicKeyRaw) {
+        return {
+            ok: false,
+            did,
+            documentUrl: resolved.documentUrl,
+            reason: "no-ed25519-key",
+            detail: "Document has no verificationMethod with an Ed25519 publicKeyJwk.",
+        };
+    }
+    return { ok: true, did, documentUrl: resolved.documentUrl, publicKeyRaw };
+}
+//# sourceMappingURL=verify.js.map

package/dist/utils/dco/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/utils/dco/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AA6ChD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,QAAQ,EAAE,EAAE;IAC1D,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,iCAAiC,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpD,iEAAiE;QACjE,uEAAuE;QACvE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC;IAC1B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IAChC,sEAAsE;IACtE,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IACE,IAAI,CAAC,IAAI,CACP,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,KAAK,EAAE;QACd,OAAO,KAAK,GAAG;QACf,OAAO,KAAK,IAAI;QAChB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAC1B,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM;QACxB,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW;QAC9B,CAAC,CAAC,sBAAsB,CAAC;IAC3B,OAAO,WAAW,IAAI,IAAI,MAAM,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,mBAAmB,GAA6C;IACpE,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,iBAAiB;IACjC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,kBAAkB;IACnC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,+BAA+B;IACnD,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,WAAW;IAC7B,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,qDAAqD;IAC1E,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,kBAAkB;IACtC,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,4BAA4B;IAC/C,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,6BAA6B;IAChD,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,kBAAkB;IACvC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,eAAe;IACnC,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,6BAA6B;IACnD,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,6BAA6B;IAClD,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,YAAY;IAC9B,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,wDAAwD;CAC3E,CAAC;AAEF,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,KAAK,GAAG,8CAA8C,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,CACL,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QACpE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAE,GAAG,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAE/B,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3D,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,WAAW,IAAI,MAAM,IAAI,WAAW,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IAC9E,IAAI,WAAW,IAAI,MAAM,IAAI,WAAW,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,eAAe;IAChF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAU;IAClC,OAAO,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,QAAgB,EAChB,aAAyB,aAAa;IAEtC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAC1C,CAAC;AAMD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAmB,EACnB,UAAsB;IAEtB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,wCAAwC;SACjD,CAAC;IACJ,CAAC;IAED,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EACJ,2EAA2E;SAC9E,CAAC;IACJ,CAAC;IAED,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,4BAA4B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,wEAAwE;QACxE,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EACJ,mFAAmF;SACtF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAiB;IAC5C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxE,MAAM,OAAO,GAAI,QAAkC,CAAC,OAAO,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC1D,MAAM,QAAQ,GAAI,KAAuC,CAAC,eAAe,CAAC;QAC1E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;IAC3E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAWD;;;;;;;;;;GAUG;AACH,KAAK,UAAU,qBAAqB,CAClC,GAAW,EACX,SAAoB,EACpB,UAAsB;IAEtB,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,qDAAqD;SAC9D,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,8CAA8C;IAC9C,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IACxF,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE;YACtC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAC/C,kEAAkE;YAClE,mEAAmE;YACnE,oEAAoE;YACpE,2DAA2D;YAC3D,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,0EAA0E;QAC1E,iEAAiE;QACjE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EACJ,QAAQ,CAAC,IAAI,KAAK,gBAAgB;gBAChC,CAAC,CAAC,oDAAoD;gBACtD,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,8BAA8B;SACvC,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GACd,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAC/C,CAAC,CAAE,QAA6B,CAAC,EAAE;QACnC,CAAC,CAAC,SAAS,CAAC;IAEhB,wEAAwE;IACxE,8BAA8B;IAC9B,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,sBACN,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAChD,GAAG;SACJ,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,YAAuB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EACtD,aAAyB,aAAa;IAEtC,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAEjD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,GAAG;QACH,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,6EAA6E;AAC7E,yEAAyE;AACzE,gEAAgE;AAChE,MAAM,eAAe,GAAG,4DAA4D,CAAC;AACrF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,CAAC,GAAG,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CACzD,CAAC;AAEF,0FAA0F;AAC1F,SAAS,YAAY,CAAC,OAAe;IACnC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,OAAO,GAAG,GAAG,EAAE,EAAE,CAAC;QAChB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;QAClC,GAAG,IAAI,IAAI,CAAC;IACd,CAAC;IACD,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM;QACxB,YAAY,EAAE,CAAC;IACjB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,kFAAkF;AAClF,MAAM,yBAAyB,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,SAAS,+BAA+B,CAAC,KAAa;IACpD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,8BAA8B;IACvE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,OAAO,CAAC,MAAM,KAAK,yBAAyB,CAAC,MAAM,GAAG,EAAE;QACxD,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACzD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,0BAA0B,CAAC,QAAiB;IACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,OAAO,GAAI,QAA6C,CAAC,kBAAkB,CAAC;IAClF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAE5D,MAAM,GAAG,GAAI,MAAqC,CAAC,YAAY,CAAC;QAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,GAAoD,CAAC;YAC7E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACzG,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAI,MAA2C,CAAC,kBAAkB,CAAC;QAClF,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,+BAA+B,CAAC,SAAS,CAAC,CAAC;YACvD,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAcD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAW,EACX,YAAuB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EACtD,aAAyB,aAAa;IAEtC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,0BAA0B,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,kEAAkE;SAC3E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC;AAC5E,CAAC"}

package/dist/utils/dependency-installer.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Installs a project dependency (currently just `@kya-os/mcp-i`) with the
+ * project's own package manager, streaming output so the user sees exactly
+ * what ran. The exec seam is injectable so callers (and every test) can
+ * avoid a real install and network access.
+ */
+export type PackageManager = "npm" | "yarn" | "pnpm";
+export interface ExecStreamResult {
+    code: number;
+}
+export type ExecStreamImpl = (command: string, args: string[]) => Promise<ExecStreamResult>;
+export interface InstallDependencyOptions {
+    packageManager: PackageManager;
+    packageName: string;
+    /** Working directory for the install; defaults to process.cwd(). */
+    cwd?: string;
+    /** Injectable exec seam; defaults to a real streaming child process. */
+    execImpl?: ExecStreamImpl;
+}
+export interface InstallDependencyResult {
+    success: boolean;
+    code: number;
+    command: string;
+    args: string[];
+}
+/** Build the install invocation for a package manager. */
+export declare function buildInstallCommand(packageManager: PackageManager, packageName: string): {
+    command: string;
+    args: string[];
+};
+/**
+ * Install a single dependency, streaming output to the terminal. Never
+ * called without explicit user (or `--install`/`--yes`) consent -- that
+ * decision is the caller's, this function only executes it.
+ */
+export declare function installDependency(options: InstallDependencyOptions): Promise<InstallDependencyResult>;
+//# sourceMappingURL=dependency-installer.d.ts.map

package/dist/utils/dependency-installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-installer.d.ts","sourceRoot":"","sources":["../../src/utils/dependency-installer.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAErD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,KACX,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,cAAc,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,0DAA0D;AAC1D,wBAAgB,mBAAmB,CACjC,cAAc,EAAE,cAAc,EAC9B,WAAW,EAAE,MAAM,GAClB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAUrC;AAWD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,uBAAuB,CAAC,CAQlC"}

package/dist/utils/dependency-installer.js

@@ -0,0 +1,32 @@
+import { spawn } from "child_process";
+/** Build the install invocation for a package manager. */
+export function buildInstallCommand(packageManager, packageName) {
+    switch (packageManager) {
+        case "yarn":
+            return { command: "yarn", args: ["add", packageName] };
+        case "pnpm":
+            return { command: "pnpm", args: ["add", packageName] };
+        case "npm":
+        default:
+            return { command: "npm", args: ["install", packageName] };
+    }
+}
+function defaultExecStream(cwd) {
+    return (command, args) => new Promise((resolve) => {
+        const child = spawn(command, args, { stdio: "inherit", cwd });
+        child.on("error", () => resolve({ code: 1 }));
+        child.on("close", (code) => resolve({ code: code ?? 1 }));
+    });
+}
+/**
+ * Install a single dependency, streaming output to the terminal. Never
+ * called without explicit user (or `--install`/`--yes`) consent -- that
+ * decision is the caller's, this function only executes it.
+ */
+export async function installDependency(options) {
+    const { command, args } = buildInstallCommand(options.packageManager, options.packageName);
+    const execImpl = options.execImpl ?? defaultExecStream(options.cwd);
+    const { code } = await execImpl(command, args);
+    return { success: code === 0, code, command, args };
+}
+//# sourceMappingURL=dependency-installer.js.map

package/dist/utils/dependency-installer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-installer.js","sourceRoot":"","sources":["../../src/utils/dependency-installer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAoCtC,0DAA0D;AAC1D,MAAM,UAAU,mBAAmB,CACjC,cAA8B,EAC9B,WAAmB;IAEnB,QAAQ,cAAc,EAAE,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QACzD,KAAK,MAAM;YACT,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QACzD,KAAK,KAAK,CAAC;QACX;YACE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAuB;IAChD,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CACvB,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAiC;IAEjC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAC3C,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,WAAW,CACpB,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACtD,CAAC"}