@kya-os/cli 1.8.3 → 2.0.2

package/dist/utils/dco/verify.js

@@ -1,550 +0,0 @@
-import { lookup as dnsLookup } from "node:dns/promises";
-import { isValidDid } from "./claude-config.js";
-/**
- * Exported (review-loop P9 commit 3) so `review verify`'s did:web
- * resolution (`../review/did-web-key.ts`) can pass the real resolver
- * through to {@link checkDocumentHostIsSafe} without redefining it — same
- * reasoning as that export.
- */
-export const defaultLookup = async (hostname) => {
-    const records = await dnsLookup(hostname, { all: true });
-    return records.map((record) => record.address);
-};
-/**
- * The document host is chosen by the DID, which comes from a PR body we do
- * not control. Without a deadline a hostile or merely unreachable host hangs
- * the command for as long as it cares to hold the socket open — tolerable
- * when a human can interrupt it, not when this runs unattended in CI.
- */
-export const RESOLVE_TIMEOUT_MS = 10000;
-/**
- * Captures the whole remainder of the line, not the first whitespace-free
- * run. Truncating at whitespace would silently reduce a malformed value to
- * whichever prefix happens to parse: `Agent DID: did:web:knowthat.ai junk`
- * would become `did:web:knowthat.ai`, resolve the registry's own root
- * document, match its own `id`, and report a forged line as verified.
- */
-const AGENT_DID_LINE = /Agent DID:[^\S\n\r]*([^\n\r]*)/g;
-/**
- * Pull the claimed DID out of a PR body.
- *
- * Returns null when the body claims two *different* DIDs. Taking the first
- * match would mean an appended line could never change the verdict, but it
- * would also mean a forged line prepended above the real one silently wins.
- * Ambiguous attribution is a failure, not a tie to be broken.
- */
-export function extractAgentDid(prBody) {
-    const claimed = new Set();
-    for (const match of prBody.matchAll(AGENT_DID_LINE)) {
-        // The managed block wraps the line in a code span, so a trailing
-        // backtick is expected punctuation rather than part of the identifier.
-        const candidate = match[1].replace(/`+\s*$/, "").trim();
-        if (isValidDid(candidate)) {
-            claimed.add(candidate);
-        }
-    }
-    if (claimed.size !== 1)
-        return null;
-    return [...claimed][0];
-}
-/**
- * Whether a piece of text already carries an `Agent DID:` attribution line
- * that `extractAgentDid` would pick up. Uses the exact same line pattern and
- * backtick/whitespace handling, so a caller (notably `dco dispatch`, which
- * appends its own authoritative line) can reject a description that would
- * otherwise put a second, conflicting DID into the PR body. Matches the
- * managed CLAUDE.md block's backticked, mid-line form, not just a line-start
- * one.
- */
-export function hasAgentDidClaim(text) {
-    for (const match of text.matchAll(AGENT_DID_LINE)) {
-        const candidate = match[1].replace(/`+\s*$/, "").trim();
-        if (isValidDid(candidate)) {
-            return true;
-        }
-    }
-    return false;
-}
-/**
- * Map a `did:web` to the HTTPS URL its document must be served from, per the
- * did:web method spec: the identifier's colon-separated segments *are* the
- * path, and a bare domain resolves under `/.well-known/`.
- *
- * Segments are validated AFTER percent-decoding. `DID_PATTERN` permits `%`,
- * so a crafted `%2F` would otherwise smuggle a path separator through and
- * point resolution at an attacker-chosen URL on the same host.
- */
-export function didWebToHttpsUrl(did) {
-    const prefix = "did:web:";
-    if (!did.startsWith(prefix))
-        return null;
-    const segments = did.slice(prefix.length).split(":");
-    if (segments.length === 0 || segments.some((segment) => segment === "")) {
-        return null;
-    }
-    const decoded = [];
-    for (const segment of segments) {
-        try {
-            decoded.push(decodeURIComponent(segment));
-        }
-        catch {
-            return null;
-        }
-    }
-    const [host, ...path] = decoded;
-    // Host may carry a port (encoded as %3A in the DID) but nothing else.
-    if (!/^[A-Za-z0-9.-]+(:\d+)?$/.test(host))
-        return null;
-    if (path.some((segment) => segment === "" ||
-        segment === "." ||
-        segment === ".." ||
-        /[/\\?#]/.test(segment))) {
-        return null;
-    }
-    const suffix = path.length
-        ? `${path.join("/")}/did.json`
-        : ".well-known/did.json";
-    return `https://${host}/${suffix}`;
-}
-/**
- * IPv4 ranges that must never be treated as a resolvable did:web host:
- * loopback, all three RFC1918 private blocks, link-local (which is also
- * where every major cloud's instance-metadata service lives, at
- * 169.254.169.254), and the remaining reserved/special-use blocks that have
- * no business serving a public DID document.
- */
-const BLOCKED_IPV4_RANGES = [
-    ["0.0.0.0", 8], // "this network"
-    ["10.0.0.0", 8], // RFC1918 private
-    ["100.64.0.0", 10], // shared address space (CGNAT)
-    ["127.0.0.0", 8], // loopback
-    ["169.254.0.0", 16], // link-local, incl. cloud metadata (169.254.169.254)
-    ["172.16.0.0", 12], // RFC1918 private
-    ["192.0.0.0", 24], // IETF protocol assignments
-    ["192.0.2.0", 24], // documentation (TEST-NET-1)
-    ["192.168.0.0", 16], // RFC1918 private
-    ["198.18.0.0", 15], // benchmarking
-    ["198.51.100.0", 24], // documentation (TEST-NET-2)
-    ["203.0.113.0", 24], // documentation (TEST-NET-3)
-    ["224.0.0.0", 4], // multicast
-    ["240.0.0.0", 4], // reserved, incl. the 255.255.255.255 broadcast address
-];
-function ipv4ToInt(ip) {
-    const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(ip);
-    if (!match)
-        return null;
-    const octets = match.slice(1, 5).map(Number);
-    if (octets.some((octet) => octet > 255))
-        return null;
-    return (((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>>
-        0);
-}
-function isBlockedIpv4(ip) {
-    const value = ipv4ToInt(ip);
-    if (value === null)
-        return false;
-    return BLOCKED_IPV4_RANGES.some(([base, prefix]) => {
-        const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0;
-        return (value & mask) === (ipv4ToInt(base) & mask);
-    });
-}
-/**
- * The IPv6 counterparts of the ranges above: loopback, unspecified,
- * link-local (`fe80::/10`), and unique-local (`fc00::/7`, the IPv6 analogue
- * of RFC1918). A resolver can hand back either family, so an address that
- * only checked IPv4 would wave an AAAA-only loopback/private record through.
- */
-function isBlockedIpv6(ip) {
-    const lower = ip.toLowerCase();
-    // A v4-mapped/v4-compatible address ends in a dotted IPv4 literal (e.g.
-    // "::ffff:127.0.0.1") — defer to the IPv4 check on that embedded address.
-    const tail = lower.slice(lower.lastIndexOf(":") + 1);
-    if (tail.includes(".") && isBlockedIpv4(tail))
-        return true;
-    if (lower === "::1" || lower === "::")
-        return true;
-    const firstGroup = lower.split(":")[0];
-    const firstHextet = firstGroup === "" ? NaN : parseInt(firstGroup, 16);
-    if (Number.isNaN(firstHextet))
-        return false;
-    if (firstHextet >= 0xfe80 && firstHextet <= 0xfebf)
-        return true; // link-local
-    if (firstHextet >= 0xfc00 && firstHextet <= 0xfdff)
-        return true; // unique-local
-    return false;
-}
-function isBlockedAddress(ip) {
-    return ip.includes(":") ? isBlockedIpv6(ip) : isBlockedIpv4(ip);
-}
-/**
- * Cheap, synchronous first line of defense against the exact literals an
- * attacker would put directly in a did:web host: `localhost`, or an IPv4
- * literal in a private, loopback, link-local, or otherwise reserved range.
- *
- * Takes the hostname `new URL()` produces, not the raw did:web segment.
- * `URL` canonicalizes decimal/hex/octal IPv4 shorthand (`2130706433` and
- * `0x7f000001` both become `127.0.0.1`) before `fetch` ever sees it, so
- * checking the pre-parse segment would miss exactly the encodings an
- * attacker would reach for to slip past a naive dotted-quad check. The
- * trailing dot is stripped first for the same reason: `new URL()` preserves
- * a root-zone dot (`"localhost."` stays `"localhost."`), and DNS treats it
- * as identical to `"localhost"` — an unstripped compare would let that
- * single character walk straight past an exact-match or `endsWith` check.
- *
- * This is a fast-path, not the actual guarantee: it only catches literals,
- * so it cannot see a normal-looking hostname whose A/AAAA record happens to
- * point at an internal address. `hostResolvesToBlockedAddress` below is
- * what actually closes that gap, by checking where the name resolves to
- * rather than how it's spelled.
- */
-export function isBlockedResolutionHost(hostname) {
-    const lower = hostname.toLowerCase().replace(/\.$/, "");
-    if (lower === "localhost" || lower.endsWith(".localhost"))
-        return true;
-    return isBlockedAddress(lower);
-}
-/**
- * The actual guarantee `isBlockedResolutionHost` can't provide on its own:
- * resolve the hostname and check every address it answers to, not just
- * whether the hostname string itself looks like one of the blocked
- * literals. A domain an attacker controls can point an A/AAAA record at
- * 169.254.169.254 (or loopback, or an RFC1918 address) just as easily as a
- * did:web host can spell the address out directly — DNS is the attacker's
- * to shape here just as much as the PR body text is, since the DID names
- * whatever host they choose.
- *
- * Deliberately does not catch a lookup failure: that is "no evidence
- * either way", the same as a failed fetch, and the caller already has a
- * reason for that (`unresolvable`) that this must not collide with —
- * mislabeling a plain NXDOMAIN as "blocked-host" would tell the CLI's user
- * they hit a private address when they actually just mistyped a domain.
- */
-export async function hostResolvesToBlockedAddress(hostname, lookupImpl = defaultLookup) {
-    const addresses = await lookupImpl(hostname);
-    return addresses.some(isBlockedAddress);
-}
-/**
- * Everything that has to be true about `documentUrl`'s host before it is
- * worth spending a request on: it must parse, it must not be one of the
- * literals `isBlockedResolutionHost` recognizes, and it must not resolve to
- * one either. Pulled out on its own so `verifyPrAttribution` reads as one
- * linear pipeline instead of three nested guard clauses doing the same kind
- * of check.
- *
- * Exported (review-loop P9 commit 3): `review verify`'s did:web resolution
- * fetches a DIFFERENT document (an agent's DID document, not a PR-body
- * claim) from an equally untrusted, wire-supplied host, and needs the exact
- * same SSRF defense before spending a request on it. Reusing this function
- * keeps that defense in ONE place rather than re-deriving the blocked-range
- * checks a second time.
- */
-export async function checkDocumentHostIsSafe(documentUrl, lookupImpl) {
-    let hostname;
-    try {
-        hostname = new URL(documentUrl).hostname;
-    }
-    catch {
-        return {
-            safe: false,
-            reason: "unresolvable",
-            detail: "The resolved document URL was invalid.",
-        };
-    }
-    if (isBlockedResolutionHost(hostname)) {
-        return {
-            safe: false,
-            reason: "blocked-host",
-            detail: "Refusing to resolve a private, loopback, link-local, or metadata address.",
-        };
-    }
-    let blocked;
-    try {
-        blocked = await hostResolvesToBlockedAddress(hostname, lookupImpl);
-    }
-    catch (error) {
-        // Same reasoning as a failed fetch: no evidence either way, so no pass.
-        return {
-            safe: false,
-            reason: "unresolvable",
-            detail: error instanceof Error ? error.message : String(error),
-        };
-    }
-    if (blocked) {
-        return {
-            safe: false,
-            reason: "blocked-host",
-            detail: "The claimed DID resolves to a private, loopback, link-local, or metadata address.",
-        };
-    }
-    return { safe: true };
-}
-function readServiceEndpoint(document) {
-    if (typeof document !== "object" || document === null)
-        return undefined;
-    const service = document.service;
-    if (!Array.isArray(service))
-        return undefined;
-    for (const entry of service) {
-        if (typeof entry !== "object" || entry === null)
-            continue;
-        const endpoint = entry.serviceEndpoint;
-        if (typeof endpoint === "string" && endpoint.length > 0)
-            return endpoint;
-    }
-    return undefined;
-}
-/**
- * Fetch and identity-check a did:web document: map the DID to its HTTPS
- * document URL, refuse an unsafe host (SSRF guard — see
- * `checkDocumentHostIsSafe`'s own doc comment), fetch it without following
- * redirects, and confirm the resolved document's `id` actually matches the
- * DID being resolved. Shared by `verifyPrAttribution` (which only needs the
- * identity check) and `resolveAgentEd25519PublicKey` (which additionally
- * needs a key out of the same document) so the two never drift on what
- * "resolves" means — a document that passes this step for one must pass it
- * for the other too.
- */
-async function resolveDidWebDocument(did, fetchImpl, lookupImpl) {
-    const documentUrl = didWebToHttpsUrl(did);
-    if (!documentUrl) {
-        return {
-            ok: false,
-            reason: "unsupported-method",
-            detail: "Only did:web identities can be resolved over HTTPS.",
-        };
-    }
-    // The document host came from untrusted input (a PR body, or a reviewer
-    // DID read off a PR review — either way, not ours to control), so it is
-    // checked — both how it's spelled and where it actually resolves — before
-    // we ever make a request to it. Skipping this would let an IP literal, or
-    // a normal-looking domain with an A/AAAA record pointing at one, reach a
-    // loopback, private, link-local, or cloud-metadata address — an SSRF that
-    // hostile input can trigger unattended in CI.
-    const hostCheck = await checkDocumentHostIsSafe(documentUrl, lookupImpl);
-    if (!hostCheck.safe) {
-        return { ok: false, documentUrl, reason: hostCheck.reason, detail: hostCheck.detail };
-    }
-    let response;
-    try {
-        response = await fetchImpl(documentUrl, {
-            signal: AbortSignal.timeout(RESOLVE_TIMEOUT_MS),
-            // A redirect target is unverified: it could bounce to an internal
-            // address the check above never saw. Refusing to follow it, rather
-            // than trusting `fetch`'s default of following automatically, keeps
-            // this host check from being bypassable by a 3xx response.
-            redirect: "manual",
-        });
-    }
-    catch (error) {
-        // A transport failure is indistinguishable from a missing document as far
-        // as trust goes: neither produced evidence, so neither may pass.
-        return {
-            ok: false,
-            documentUrl,
-            reason: "unresolvable",
-            detail: error instanceof Error ? error.message : String(error),
-        };
-    }
-    if (!response.ok) {
-        return {
-            ok: false,
-            documentUrl,
-            reason: "unresolvable",
-            detail: response.type === "opaqueredirect"
-                ? "Server returned a redirect, which is not followed."
-                : `HTTP ${response.status}`,
-        };
-    }
-    let document;
-    try {
-        document = await response.json();
-    }
-    catch {
-        return {
-            ok: false,
-            documentUrl,
-            reason: "unresolvable",
-            detail: "Response was not valid JSON.",
-        };
-    }
-    const resolvedId = typeof document === "object" && document !== null
-        ? document.id
-        : undefined;
-    // A document that resolves but names a different subject proves nothing
-    // about the claimed identity.
-    if (resolvedId !== did) {
-        return {
-            ok: false,
-            documentUrl,
-            reason: "did-mismatch",
-            detail: `Document describes ${typeof resolvedId === "string" ? resolvedId : "no DID"}.`,
-        };
-    }
-    return { ok: true, document, documentUrl };
-}
-/**
- * Resolve the DID claimed by a PR body and confirm the document describes
- * that same DID.
- */
-export async function verifyPrAttribution(prBody, fetchImpl = (url, init) => fetch(url, init), lookupImpl = defaultLookup) {
-    const did = extractAgentDid(prBody);
-    if (!did)
-        return { ok: false, reason: "no-did" };
-    const resolved = await resolveDidWebDocument(did, fetchImpl, lookupImpl);
-    if (!resolved.ok) {
-        return {
-            ok: false,
-            did,
-            documentUrl: resolved.documentUrl,
-            reason: resolved.reason,
-            detail: resolved.detail,
-        };
-    }
-    return {
-        ok: true,
-        did,
-        documentUrl: resolved.documentUrl,
-        agentUrl: readServiceEndpoint(resolved.document),
-    };
-}
-/**
- * Extract the first Ed25519 (OKP) public JWK's raw 32-byte key out of a DID
- * document's `verificationMethod` array. Mirrors
- * `packages/compute/src/didcomm/did-web.ts`'s `extractEd25519Jwk` (that
- * module lives in `@kya-os/compute`, which the CLI must never import — see
- * this feature's design doc — so the extraction logic is duplicated here
- * rather than shared, not delegated).
- */
-// Bitcoin/base58btc alphabet, matching `@kya-os/mcp-i-core`'s `base58.ts` and
-// `did-key-resolver.ts` byte for byte (reimplemented here, not imported: the
-// CLI has no dependency on that package, and this decode is small enough
-// that a second copy is cheaper than a new cross-package dependency for it —
-// the same tradeoff this ecosystem already makes broadly, see the crypto
-// utility inventory referenced in this repo's own audit notes).
-const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
-const BASE58_ALPHABET_MAP = new Map([...BASE58_ALPHABET].map((char, index) => [char, index]));
-/** Decode a base58 (Bitcoin alphabet) string to bytes. Throws on an invalid character. */
-function base58Decode(encoded) {
-    let num = 0n;
-    for (const char of encoded) {
-        const value = BASE58_ALPHABET_MAP.get(char);
-        if (value === undefined) {
-            throw new Error(`Invalid base58 character: ${char}`);
-        }
-        num = num * 58n + BigInt(value);
-    }
-    const bytes = [];
-    while (num > 0n) {
-        bytes.unshift(Number(num % 256n));
-        num /= 256n;
-    }
-    let leadingZeros = 0;
-    for (const char of encoded) {
-        if (char !== "1")
-            break;
-        leadingZeros++;
-    }
-    return Buffer.concat([Buffer.alloc(leadingZeros), Buffer.from(bytes)]);
-}
-/** The 2-byte varint multicodec prefix for an Ed25519 public key (0xed, 0x01). */
-const ED25519_MULTICODEC_PREFIX = Buffer.from([0xed, 0x01]);
-/**
- * Decode a `publicKeyMultibase` value (the did:key-style encoding:
- * multibase `z` prefix for base58btc, wrapping the Ed25519 multicodec
- * prefix followed by the raw 32-byte key) to the raw key. Returns null on
- * any malformed input — unsupported multibase prefix, invalid base58, or a
- * multicodec prefix that isn't Ed25519's — rather than throwing.
- */
-function decodeEd25519PublicKeyMultibase(value) {
-    if (!value.startsWith("z"))
-        return null; // only base58btc is supported
-    let decoded;
-    try {
-        decoded = base58Decode(value.slice(1));
-    }
-    catch {
-        return null;
-    }
-    if (decoded.length !== ED25519_MULTICODEC_PREFIX.length + 32 ||
-        !decoded.subarray(0, 2).equals(ED25519_MULTICODEC_PREFIX)) {
-        return null;
-    }
-    return decoded.subarray(2);
-}
-/**
- * Extract the first Ed25519 public key out of a DID document's
- * `verificationMethod` array, trying both encodings production DID
- * documents actually use: `publicKeyJwk` (OKP/Ed25519) and
- * `publicKeyMultibase` (`Ed25519VerificationKey2020`, did:key-style
- * multicodec+base58btc). Confirmed live against a real, currently
- * registered `did:web:knowthat.ai:agents:*` document — it uses
- * `publicKeyMultibase`, not `publicKeyJwk`; a version of this function
- * checking only `publicKeyJwk` silently never resolved any real agent's
- * key (mirroring `@kya-os/compute`'s `did-web.ts`'s own `publicKeyJwk`-only
- * `extractEd25519Jwk`, written for a different DID document source — org
- * root keys — that does use JWK).
- */
-function extractEd25519PublicKeyRaw(document) {
-    if (typeof document !== "object" || document === null)
-        return null;
-    const methods = document.verificationMethod;
-    if (!Array.isArray(methods))
-        return null;
-    for (const method of methods) {
-        if (typeof method !== "object" || method === null)
-            continue;
-        const jwk = method.publicKeyJwk;
-        if (typeof jwk === "object" && jwk !== null) {
-            const { kty, crv, x } = jwk;
-            if (typeof kty === "string" && kty.toUpperCase() === "OKP" && crv === "Ed25519" && typeof x === "string") {
-                return Buffer.from(x, "base64url");
-            }
-        }
-        const multibase = method.publicKeyMultibase;
-        if (typeof multibase === "string") {
-            const raw = decodeEd25519PublicKeyMultibase(multibase);
-            if (raw)
-                return raw;
-        }
-    }
-    return null;
-}
-/**
- * Resolve an agent DID to its raw 32-byte Ed25519 public key, for verifying
- * a signature it produced (a review verdict's or fix attestation's
- * `proof`). This is `kya-os agent verify`'s "key resolution v1": scoped to
- * `did:web` only, since every reviewer/maker DID in this feature is
- * `did:web:knowthat.ai:agents:<slug>` — a `did:key` or other method fails
- * closed with `unsupported-method` rather than half-supporting it (state
- * that scope in the command's `--help`, per this feature's design doc).
- *
- * The DID here is read off a PR review or comment — the same
- * untrusted-input shape `verifyPrAttribution` already handles — so it goes
- * through the identical SSRF-hardened resolution path
- * (`resolveDidWebDocument`) before this function ever looks at the document
- * for a key.
- */
-export async function resolveAgentEd25519PublicKey(did, fetchImpl = (url, init) => fetch(url, init), lookupImpl = defaultLookup) {
-    const resolved = await resolveDidWebDocument(did, fetchImpl, lookupImpl);
-    if (!resolved.ok) {
-        return {
-            ok: false,
-            did,
-            documentUrl: resolved.documentUrl,
-            reason: resolved.reason,
-            detail: resolved.detail,
-        };
-    }
-    const publicKeyRaw = extractEd25519PublicKeyRaw(resolved.document);
-    if (!publicKeyRaw) {
-        return {
-            ok: false,
-            did,
-            documentUrl: resolved.documentUrl,
-            reason: "no-ed25519-key",
-            detail: "Document has no verificationMethod with an Ed25519 publicKeyJwk.",
-        };
-    }
-    return { ok: true, did, documentUrl: resolved.documentUrl, publicKeyRaw };
-}
-//# sourceMappingURL=verify.js.map

package/dist/utils/dco/verify.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/utils/dco/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AA6ChD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,QAAQ,EAAE,EAAE;IAC1D,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,iCAAiC,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpD,iEAAiE;QACjE,uEAAuE;QACvE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC;IAC1B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IAChC,sEAAsE;IACtE,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IACE,IAAI,CAAC,IAAI,CACP,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,KAAK,EAAE;QACd,OAAO,KAAK,GAAG;QACf,OAAO,KAAK,IAAI;QAChB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAC1B,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM;QACxB,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW;QAC9B,CAAC,CAAC,sBAAsB,CAAC;IAC3B,OAAO,WAAW,IAAI,IAAI,MAAM,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,mBAAmB,GAA6C;IACpE,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,iBAAiB;IACjC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,kBAAkB;IACnC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,+BAA+B;IACnD,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,WAAW;IAC7B,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,qDAAqD;IAC1E,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,kBAAkB;IACtC,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,4BAA4B;IAC/C,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,6BAA6B;IAChD,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,kBAAkB;IACvC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,eAAe;IACnC,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,6BAA6B;IACnD,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,6BAA6B;IAClD,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,YAAY;IAC9B,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,wDAAwD;CAC3E,CAAC;AAEF,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,KAAK,GAAG,8CAA8C,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,CACL,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QACpE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAE,GAAG,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAE/B,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3D,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,WAAW,IAAI,MAAM,IAAI,WAAW,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IAC9E,IAAI,WAAW,IAAI,MAAM,IAAI,WAAW,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,eAAe;IAChF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAU;IAClC,OAAO,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,QAAgB,EAChB,aAAyB,aAAa;IAEtC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAC1C,CAAC;AAMD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAmB,EACnB,UAAsB;IAEtB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,wCAAwC;SACjD,CAAC;IACJ,CAAC;IAED,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EACJ,2EAA2E;SAC9E,CAAC;IACJ,CAAC;IAED,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,4BAA4B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,wEAAwE;QACxE,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EACJ,mFAAmF;SACtF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAiB;IAC5C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxE,MAAM,OAAO,GAAI,QAAkC,CAAC,OAAO,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC1D,MAAM,QAAQ,GAAI,KAAuC,CAAC,eAAe,CAAC;QAC1E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;IAC3E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAWD;;;;;;;;;;GAUG;AACH,KAAK,UAAU,qBAAqB,CAClC,GAAW,EACX,SAAoB,EACpB,UAAsB;IAEtB,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,qDAAqD;SAC9D,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,8CAA8C;IAC9C,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IACxF,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE;YACtC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAC/C,kEAAkE;YAClE,mEAAmE;YACnE,oEAAoE;YACpE,2DAA2D;YAC3D,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,0EAA0E;QAC1E,iEAAiE;QACjE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EACJ,QAAQ,CAAC,IAAI,KAAK,gBAAgB;gBAChC,CAAC,CAAC,oDAAoD;gBACtD,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,8BAA8B;SACvC,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GACd,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAC/C,CAAC,CAAE,QAA6B,CAAC,EAAE;QACnC,CAAC,CAAC,SAAS,CAAC;IAEhB,wEAAwE;IACxE,8BAA8B;IAC9B,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,sBACN,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAChD,GAAG;SACJ,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,YAAuB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EACtD,aAAyB,aAAa;IAEtC,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAEjD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,GAAG;QACH,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,6EAA6E;AAC7E,yEAAyE;AACzE,gEAAgE;AAChE,MAAM,eAAe,GAAG,4DAA4D,CAAC;AACrF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,CAAC,GAAG,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CACzD,CAAC;AAEF,0FAA0F;AAC1F,SAAS,YAAY,CAAC,OAAe;IACnC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,OAAO,GAAG,GAAG,EAAE,EAAE,CAAC;QAChB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;QAClC,GAAG,IAAI,IAAI,CAAC;IACd,CAAC;IACD,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM;QACxB,YAAY,EAAE,CAAC;IACjB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,kFAAkF;AAClF,MAAM,yBAAyB,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,SAAS,+BAA+B,CAAC,KAAa;IACpD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,8BAA8B;IACvE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,OAAO,CAAC,MAAM,KAAK,yBAAyB,CAAC,MAAM,GAAG,EAAE;QACxD,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACzD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,0BAA0B,CAAC,QAAiB;IACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,OAAO,GAAI,QAA6C,CAAC,kBAAkB,CAAC;IAClF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAE5D,MAAM,GAAG,GAAI,MAAqC,CAAC,YAAY,CAAC;QAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,GAAoD,CAAC;YAC7E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACzG,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAI,MAA2C,CAAC,kBAAkB,CAAC;QAClF,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,+BAA+B,CAAC,SAAS,CAAC,CAAC;YACvD,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAcD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAW,EACX,YAAuB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EACtD,aAAyB,aAAa;IAEtC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,0BAA0B,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,kEAAkE;SAC3E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC;AAC5E,CAAC"}

package/dist/utils/dependency-installer.d.ts

@@ -1,37 +0,0 @@
-/**
- * Installs a project dependency (currently just `@kya-os/mcp-i`) with the
- * project's own package manager, streaming output so the user sees exactly
- * what ran. The exec seam is injectable so callers (and every test) can
- * avoid a real install and network access.
- */
-export type PackageManager = "npm" | "yarn" | "pnpm";
-export interface ExecStreamResult {
-    code: number;
-}
-export type ExecStreamImpl = (command: string, args: string[]) => Promise<ExecStreamResult>;
-export interface InstallDependencyOptions {
-    packageManager: PackageManager;
-    packageName: string;
-    /** Working directory for the install; defaults to process.cwd(). */
-    cwd?: string;
-    /** Injectable exec seam; defaults to a real streaming child process. */
-    execImpl?: ExecStreamImpl;
-}
-export interface InstallDependencyResult {
-    success: boolean;
-    code: number;
-    command: string;
-    args: string[];
-}
-/** Build the install invocation for a package manager. */
-export declare function buildInstallCommand(packageManager: PackageManager, packageName: string): {
-    command: string;
-    args: string[];
-};
-/**
- * Install a single dependency, streaming output to the terminal. Never
- * called without explicit user (or `--install`/`--yes`) consent -- that
- * decision is the caller's, this function only executes it.
- */
-export declare function installDependency(options: InstallDependencyOptions): Promise<InstallDependencyResult>;
-//# sourceMappingURL=dependency-installer.d.ts.map

package/dist/utils/dependency-installer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dependency-installer.d.ts","sourceRoot":"","sources":["../../src/utils/dependency-installer.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAErD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,KACX,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,cAAc,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,0DAA0D;AAC1D,wBAAgB,mBAAmB,CACjC,cAAc,EAAE,cAAc,EAC9B,WAAW,EAAE,MAAM,GAClB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAUrC;AAWD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,uBAAuB,CAAC,CAQlC"}

package/dist/utils/dependency-installer.js

@@ -1,32 +0,0 @@
-import { spawn } from "child_process";
-/** Build the install invocation for a package manager. */
-export function buildInstallCommand(packageManager, packageName) {
-    switch (packageManager) {
-        case "yarn":
-            return { command: "yarn", args: ["add", packageName] };
-        case "pnpm":
-            return { command: "pnpm", args: ["add", packageName] };
-        case "npm":
-        default:
-            return { command: "npm", args: ["install", packageName] };
-    }
-}
-function defaultExecStream(cwd) {
-    return (command, args) => new Promise((resolve) => {
-        const child = spawn(command, args, { stdio: "inherit", cwd });
-        child.on("error", () => resolve({ code: 1 }));
-        child.on("close", (code) => resolve({ code: code ?? 1 }));
-    });
-}
-/**
- * Install a single dependency, streaming output to the terminal. Never
- * called without explicit user (or `--install`/`--yes`) consent -- that
- * decision is the caller's, this function only executes it.
- */
-export async function installDependency(options) {
-    const { command, args } = buildInstallCommand(options.packageManager, options.packageName);
-    const execImpl = options.execImpl ?? defaultExecStream(options.cwd);
-    const { code } = await execImpl(command, args);
-    return { success: code === 0, code, command, args };
-}
-//# sourceMappingURL=dependency-installer.js.map

package/dist/utils/dependency-installer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dependency-installer.js","sourceRoot":"","sources":["../../src/utils/dependency-installer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAoCtC,0DAA0D;AAC1D,MAAM,UAAU,mBAAmB,CACjC,cAA8B,EAC9B,WAAmB;IAEnB,QAAQ,cAAc,EAAE,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QACzD,KAAK,MAAM;YACT,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QACzD,KAAK,KAAK,CAAC;QACX;YACE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAuB;IAChD,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CACvB,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAiC;IAEjC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAC3C,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,WAAW,CACpB,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACtD,CAAC"}