@kya-os/cli 2.0.0 → 2.0.3

package/dist/utils/dco/verify.d.ts

@@ -1,114 +0,0 @@
-/**
- * Verifies that a pull request's attribution byline names an agent identity
- * that actually resolves.
- *
- * `dco setup` only ever *instructs* the harness to write the byline —
- * the PR body is composed by a model at PR time and can be edited by anyone
- * with write access to the branch. So an `Agent DID:` line is a claim, not
- * evidence, until the DID document behind it is fetched and checked. Every
- * failure mode below exists because some way of "resolving" a DID would
- * otherwise let an unverified claim read as verified.
- */
-export type VerifyFailure = "no-did" | "unsupported-method" | "unresolvable" | "did-mismatch" | "blocked-host";
-export interface AttributionVerification {
-    ok: boolean;
-    /** The DID claimed by the PR body, when exactly one valid claim is present. */
-    did?: string;
-    /** Where the DID document was fetched from. */
-    documentUrl?: string;
-    /** The agent's registry page, taken from the document's service entry. */
-    agentUrl?: string;
-    reason?: VerifyFailure;
-    detail?: string;
-}
-export type FetchLike = (url: string, init?: {
-    signal?: AbortSignal;
-    redirect?: RequestInit["redirect"];
-}) => Promise<Response>;
-/**
- * Resolve a hostname to every address it answers to. Injectable for the same
- * reason `FetchLike` is: production wants the real resolver, tests want a
- * fixed answer instead of a live DNS lookup.
- */
-export type LookupLike = (hostname: string) => Promise<string[]>;
-/**
- * The document host is chosen by the DID, which comes from a PR body we do
- * not control. Without a deadline a hostile or merely unreachable host hangs
- * the command for as long as it cares to hold the socket open — tolerable
- * when a human can interrupt it, not when this runs unattended in CI.
- */
-export declare const RESOLVE_TIMEOUT_MS = 10000;
-/**
- * Pull the claimed DID out of a PR body.
- *
- * Returns null when the body claims two *different* DIDs. Taking the first
- * match would mean an appended line could never change the verdict, but it
- * would also mean a forged line prepended above the real one silently wins.
- * Ambiguous attribution is a failure, not a tie to be broken.
- */
-export declare function extractAgentDid(prBody: string): string | null;
-/**
- * Whether a piece of text already carries an `Agent DID:` attribution line
- * that `extractAgentDid` would pick up. Uses the exact same line pattern and
- * backtick/whitespace handling, so a caller (notably `dco dispatch`, which
- * appends its own authoritative line) can reject a description that would
- * otherwise put a second, conflicting DID into the PR body. Matches the
- * managed CLAUDE.md block's backticked, mid-line form, not just a line-start
- * one.
- */
-export declare function hasAgentDidClaim(text: string): boolean;
-/**
- * Map a `did:web` to the HTTPS URL its document must be served from, per the
- * did:web method spec: the identifier's colon-separated segments *are* the
- * path, and a bare domain resolves under `/.well-known/`.
- *
- * Segments are validated AFTER percent-decoding. `DID_PATTERN` permits `%`,
- * so a crafted `%2F` would otherwise smuggle a path separator through and
- * point resolution at an attacker-chosen URL on the same host.
- */
-export declare function didWebToHttpsUrl(did: string): string | null;
-/**
- * Cheap, synchronous first line of defense against the exact literals an
- * attacker would put directly in a did:web host: `localhost`, or an IPv4
- * literal in a private, loopback, link-local, or otherwise reserved range.
- *
- * Takes the hostname `new URL()` produces, not the raw did:web segment.
- * `URL` canonicalizes decimal/hex/octal IPv4 shorthand (`2130706433` and
- * `0x7f000001` both become `127.0.0.1`) before `fetch` ever sees it, so
- * checking the pre-parse segment would miss exactly the encodings an
- * attacker would reach for to slip past a naive dotted-quad check. The
- * trailing dot is stripped first for the same reason: `new URL()` preserves
- * a root-zone dot (`"localhost."` stays `"localhost."`), and DNS treats it
- * as identical to `"localhost"` — an unstripped compare would let that
- * single character walk straight past an exact-match or `endsWith` check.
- *
- * This is a fast-path, not the actual guarantee: it only catches literals,
- * so it cannot see a normal-looking hostname whose A/AAAA record happens to
- * point at an internal address. `hostResolvesToBlockedAddress` below is
- * what actually closes that gap, by checking where the name resolves to
- * rather than how it's spelled.
- */
-export declare function isBlockedResolutionHost(hostname: string): boolean;
-/**
- * The actual guarantee `isBlockedResolutionHost` can't provide on its own:
- * resolve the hostname and check every address it answers to, not just
- * whether the hostname string itself looks like one of the blocked
- * literals. A domain an attacker controls can point an A/AAAA record at
- * 169.254.169.254 (or loopback, or an RFC1918 address) just as easily as a
- * did:web host can spell the address out directly — DNS is the attacker's
- * to shape here just as much as the PR body text is, since the DID names
- * whatever host they choose.
- *
- * Deliberately does not catch a lookup failure: that is "no evidence
- * either way", the same as a failed fetch, and the caller already has a
- * reason for that (`unresolvable`) that this must not collide with —
- * mislabeling a plain NXDOMAIN as "blocked-host" would tell the CLI's user
- * they hit a private address when they actually just mistyped a domain.
- */
-export declare function hostResolvesToBlockedAddress(hostname: string, lookupImpl?: LookupLike): Promise<boolean>;
-/**
- * Resolve the DID claimed by a PR body and confirm the document describes
- * that same DID.
- */
-export declare function verifyPrAttribution(prBody: string, fetchImpl?: FetchLike, lookupImpl?: LookupLike): Promise<AttributionVerification>;
-//# sourceMappingURL=verify.d.ts.map

package/dist/utils/dco/verify.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/verify.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,aAAa,GACrB,QAAQ,GACR,oBAAoB,GACpB,cAAc,GACd,cAAc,GACd,cAAc,CAAC;AAEnB,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,CAAA;CAAE,KAChE,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAOjE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAWzC;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqC3D;AA0ED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIjE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,4BAA4B,CAChD,QAAQ,EAAE,MAAM,EAChB,UAAU,GAAE,UAA0B,GACrC,OAAO,CAAC,OAAO,CAAC,CAGlB;AAyED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,SAA2C,EACtD,UAAU,GAAE,UAA0B,GACrC,OAAO,CAAC,uBAAuB,CAAC,CAwGlC"}

package/dist/utils/dco/verify.js

@@ -1,383 +0,0 @@
-import { lookup as dnsLookup } from "node:dns/promises";
-import { isValidDid } from "./claude-config.js";
-const defaultLookup = async (hostname) => {
-    const records = await dnsLookup(hostname, { all: true });
-    return records.map((record) => record.address);
-};
-/**
- * The document host is chosen by the DID, which comes from a PR body we do
- * not control. Without a deadline a hostile or merely unreachable host hangs
- * the command for as long as it cares to hold the socket open — tolerable
- * when a human can interrupt it, not when this runs unattended in CI.
- */
-export const RESOLVE_TIMEOUT_MS = 10000;
-/**
- * Captures the whole remainder of the line, not the first whitespace-free
- * run. Truncating at whitespace would silently reduce a malformed value to
- * whichever prefix happens to parse: `Agent DID: did:web:knowthat.ai junk`
- * would become `did:web:knowthat.ai`, resolve the registry's own root
- * document, match its own `id`, and report a forged line as verified.
- */
-const AGENT_DID_LINE = /Agent DID:[^\S\n\r]*([^\n\r]*)/g;
-/**
- * Pull the claimed DID out of a PR body.
- *
- * Returns null when the body claims two *different* DIDs. Taking the first
- * match would mean an appended line could never change the verdict, but it
- * would also mean a forged line prepended above the real one silently wins.
- * Ambiguous attribution is a failure, not a tie to be broken.
- */
-export function extractAgentDid(prBody) {
-    const claimed = new Set();
-    for (const match of prBody.matchAll(AGENT_DID_LINE)) {
-        // The managed block wraps the line in a code span, so a trailing
-        // backtick is expected punctuation rather than part of the identifier.
-        const candidate = match[1].replace(/`+\s*$/, "").trim();
-        if (isValidDid(candidate)) {
-            claimed.add(candidate);
-        }
-    }
-    if (claimed.size !== 1)
-        return null;
-    return [...claimed][0];
-}
-/**
- * Whether a piece of text already carries an `Agent DID:` attribution line
- * that `extractAgentDid` would pick up. Uses the exact same line pattern and
- * backtick/whitespace handling, so a caller (notably `dco dispatch`, which
- * appends its own authoritative line) can reject a description that would
- * otherwise put a second, conflicting DID into the PR body. Matches the
- * managed CLAUDE.md block's backticked, mid-line form, not just a line-start
- * one.
- */
-export function hasAgentDidClaim(text) {
-    for (const match of text.matchAll(AGENT_DID_LINE)) {
-        const candidate = match[1].replace(/`+\s*$/, "").trim();
-        if (isValidDid(candidate)) {
-            return true;
-        }
-    }
-    return false;
-}
-/**
- * Map a `did:web` to the HTTPS URL its document must be served from, per the
- * did:web method spec: the identifier's colon-separated segments *are* the
- * path, and a bare domain resolves under `/.well-known/`.
- *
- * Segments are validated AFTER percent-decoding. `DID_PATTERN` permits `%`,
- * so a crafted `%2F` would otherwise smuggle a path separator through and
- * point resolution at an attacker-chosen URL on the same host.
- */
-export function didWebToHttpsUrl(did) {
-    const prefix = "did:web:";
-    if (!did.startsWith(prefix))
-        return null;
-    const segments = did.slice(prefix.length).split(":");
-    if (segments.length === 0 || segments.some((segment) => segment === "")) {
-        return null;
-    }
-    const decoded = [];
-    for (const segment of segments) {
-        try {
-            decoded.push(decodeURIComponent(segment));
-        }
-        catch {
-            return null;
-        }
-    }
-    const [host, ...path] = decoded;
-    // Host may carry a port (encoded as %3A in the DID) but nothing else.
-    if (!/^[A-Za-z0-9.-]+(:\d+)?$/.test(host))
-        return null;
-    if (path.some((segment) => segment === "" ||
-        segment === "." ||
-        segment === ".." ||
-        /[/\\?#]/.test(segment))) {
-        return null;
-    }
-    const suffix = path.length
-        ? `${path.join("/")}/did.json`
-        : ".well-known/did.json";
-    return `https://${host}/${suffix}`;
-}
-/**
- * IPv4 ranges that must never be treated as a resolvable did:web host:
- * loopback, all three RFC1918 private blocks, link-local (which is also
- * where every major cloud's instance-metadata service lives, at
- * 169.254.169.254), and the remaining reserved/special-use blocks that have
- * no business serving a public DID document.
- */
-const BLOCKED_IPV4_RANGES = [
-    ["0.0.0.0", 8], // "this network"
-    ["10.0.0.0", 8], // RFC1918 private
-    ["100.64.0.0", 10], // shared address space (CGNAT)
-    ["127.0.0.0", 8], // loopback
-    ["169.254.0.0", 16], // link-local, incl. cloud metadata (169.254.169.254)
-    ["172.16.0.0", 12], // RFC1918 private
-    ["192.0.0.0", 24], // IETF protocol assignments
-    ["192.0.2.0", 24], // documentation (TEST-NET-1)
-    ["192.168.0.0", 16], // RFC1918 private
-    ["198.18.0.0", 15], // benchmarking
-    ["198.51.100.0", 24], // documentation (TEST-NET-2)
-    ["203.0.113.0", 24], // documentation (TEST-NET-3)
-    ["224.0.0.0", 4], // multicast
-    ["240.0.0.0", 4], // reserved, incl. the 255.255.255.255 broadcast address
-];
-function ipv4ToInt(ip) {
-    const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(ip);
-    if (!match)
-        return null;
-    const octets = match.slice(1, 5).map(Number);
-    if (octets.some((octet) => octet > 255))
-        return null;
-    return (((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>>
-        0);
-}
-function isBlockedIpv4(ip) {
-    const value = ipv4ToInt(ip);
-    if (value === null)
-        return false;
-    return BLOCKED_IPV4_RANGES.some(([base, prefix]) => {
-        const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0;
-        return (value & mask) === (ipv4ToInt(base) & mask);
-    });
-}
-/**
- * The IPv6 counterparts of the ranges above: loopback, unspecified,
- * link-local (`fe80::/10`), and unique-local (`fc00::/7`, the IPv6 analogue
- * of RFC1918). A resolver can hand back either family, so an address that
- * only checked IPv4 would wave an AAAA-only loopback/private record through.
- */
-function isBlockedIpv6(ip) {
-    const lower = ip.toLowerCase();
-    // A v4-mapped/v4-compatible address ends in a dotted IPv4 literal (e.g.
-    // "::ffff:127.0.0.1") — defer to the IPv4 check on that embedded address.
-    const tail = lower.slice(lower.lastIndexOf(":") + 1);
-    if (tail.includes(".") && isBlockedIpv4(tail))
-        return true;
-    if (lower === "::1" || lower === "::")
-        return true;
-    const firstGroup = lower.split(":")[0];
-    const firstHextet = firstGroup === "" ? NaN : parseInt(firstGroup, 16);
-    if (Number.isNaN(firstHextet))
-        return false;
-    if (firstHextet >= 0xfe80 && firstHextet <= 0xfebf)
-        return true; // link-local
-    if (firstHextet >= 0xfc00 && firstHextet <= 0xfdff)
-        return true; // unique-local
-    return false;
-}
-function isBlockedAddress(ip) {
-    return ip.includes(":") ? isBlockedIpv6(ip) : isBlockedIpv4(ip);
-}
-/**
- * Cheap, synchronous first line of defense against the exact literals an
- * attacker would put directly in a did:web host: `localhost`, or an IPv4
- * literal in a private, loopback, link-local, or otherwise reserved range.
- *
- * Takes the hostname `new URL()` produces, not the raw did:web segment.
- * `URL` canonicalizes decimal/hex/octal IPv4 shorthand (`2130706433` and
- * `0x7f000001` both become `127.0.0.1`) before `fetch` ever sees it, so
- * checking the pre-parse segment would miss exactly the encodings an
- * attacker would reach for to slip past a naive dotted-quad check. The
- * trailing dot is stripped first for the same reason: `new URL()` preserves
- * a root-zone dot (`"localhost."` stays `"localhost."`), and DNS treats it
- * as identical to `"localhost"` — an unstripped compare would let that
- * single character walk straight past an exact-match or `endsWith` check.
- *
- * This is a fast-path, not the actual guarantee: it only catches literals,
- * so it cannot see a normal-looking hostname whose A/AAAA record happens to
- * point at an internal address. `hostResolvesToBlockedAddress` below is
- * what actually closes that gap, by checking where the name resolves to
- * rather than how it's spelled.
- */
-export function isBlockedResolutionHost(hostname) {
-    const lower = hostname.toLowerCase().replace(/\.$/, "");
-    if (lower === "localhost" || lower.endsWith(".localhost"))
-        return true;
-    return isBlockedAddress(lower);
-}
-/**
- * The actual guarantee `isBlockedResolutionHost` can't provide on its own:
- * resolve the hostname and check every address it answers to, not just
- * whether the hostname string itself looks like one of the blocked
- * literals. A domain an attacker controls can point an A/AAAA record at
- * 169.254.169.254 (or loopback, or an RFC1918 address) just as easily as a
- * did:web host can spell the address out directly — DNS is the attacker's
- * to shape here just as much as the PR body text is, since the DID names
- * whatever host they choose.
- *
- * Deliberately does not catch a lookup failure: that is "no evidence
- * either way", the same as a failed fetch, and the caller already has a
- * reason for that (`unresolvable`) that this must not collide with —
- * mislabeling a plain NXDOMAIN as "blocked-host" would tell the CLI's user
- * they hit a private address when they actually just mistyped a domain.
- */
-export async function hostResolvesToBlockedAddress(hostname, lookupImpl = defaultLookup) {
-    const addresses = await lookupImpl(hostname);
-    return addresses.some(isBlockedAddress);
-}
-/**
- * Everything that has to be true about `documentUrl`'s host before it is
- * worth spending a request on: it must parse, it must not be one of the
- * literals `isBlockedResolutionHost` recognizes, and it must not resolve to
- * one either. Pulled out on its own so `verifyPrAttribution` reads as one
- * linear pipeline instead of three nested guard clauses doing the same kind
- * of check.
- */
-async function checkDocumentHostIsSafe(documentUrl, lookupImpl) {
-    let hostname;
-    try {
-        hostname = new URL(documentUrl).hostname;
-    }
-    catch {
-        return {
-            safe: false,
-            reason: "unresolvable",
-            detail: "The resolved document URL was invalid.",
-        };
-    }
-    if (isBlockedResolutionHost(hostname)) {
-        return {
-            safe: false,
-            reason: "blocked-host",
-            detail: "Refusing to resolve a private, loopback, link-local, or metadata address.",
-        };
-    }
-    let blocked;
-    try {
-        blocked = await hostResolvesToBlockedAddress(hostname, lookupImpl);
-    }
-    catch (error) {
-        // Same reasoning as a failed fetch: no evidence either way, so no pass.
-        return {
-            safe: false,
-            reason: "unresolvable",
-            detail: error instanceof Error ? error.message : String(error),
-        };
-    }
-    if (blocked) {
-        return {
-            safe: false,
-            reason: "blocked-host",
-            detail: "The claimed DID resolves to a private, loopback, link-local, or metadata address.",
-        };
-    }
-    return { safe: true };
-}
-function readServiceEndpoint(document) {
-    if (typeof document !== "object" || document === null)
-        return undefined;
-    const service = document.service;
-    if (!Array.isArray(service))
-        return undefined;
-    for (const entry of service) {
-        if (typeof entry !== "object" || entry === null)
-            continue;
-        const endpoint = entry.serviceEndpoint;
-        if (typeof endpoint === "string" && endpoint.length > 0)
-            return endpoint;
-    }
-    return undefined;
-}
-/**
- * Resolve the DID claimed by a PR body and confirm the document describes
- * that same DID.
- */
-export async function verifyPrAttribution(prBody, fetchImpl = (url, init) => fetch(url, init), lookupImpl = defaultLookup) {
-    const did = extractAgentDid(prBody);
-    if (!did)
-        return { ok: false, reason: "no-did" };
-    const documentUrl = didWebToHttpsUrl(did);
-    if (!documentUrl) {
-        return {
-            ok: false,
-            did,
-            reason: "unsupported-method",
-            detail: "Only did:web identities can be resolved over HTTPS.",
-        };
-    }
-    // The document host came from a PR body we do not control, so it is
-    // checked — both how it's spelled and where it actually resolves — before
-    // we ever make a request to it. Skipping this would let an IP literal, or
-    // a normal-looking domain with an A/AAAA record pointing at one, reach a
-    // loopback, private, link-local, or cloud-metadata address — an SSRF that
-    // a hostile PR description can trigger unattended in CI.
-    const hostCheck = await checkDocumentHostIsSafe(documentUrl, lookupImpl);
-    if (!hostCheck.safe) {
-        return {
-            ok: false,
-            did,
-            documentUrl,
-            reason: hostCheck.reason,
-            detail: hostCheck.detail,
-        };
-    }
-    let response;
-    try {
-        response = await fetchImpl(documentUrl, {
-            signal: AbortSignal.timeout(RESOLVE_TIMEOUT_MS),
-            // A redirect target is unverified: it could bounce to an internal
-            // address the check above never saw. Refusing to follow it, rather
-            // than trusting `fetch`'s default of following automatically, keeps
-            // this host check from being bypassable by a 3xx response.
-            redirect: "manual",
-        });
-    }
-    catch (error) {
-        // A transport failure is indistinguishable from a missing document as far
-        // as trust goes: neither produced evidence, so neither may pass.
-        return {
-            ok: false,
-            did,
-            documentUrl,
-            reason: "unresolvable",
-            detail: error instanceof Error ? error.message : String(error),
-        };
-    }
-    if (!response.ok) {
-        return {
-            ok: false,
-            did,
-            documentUrl,
-            reason: "unresolvable",
-            detail: response.type === "opaqueredirect"
-                ? "Server returned a redirect, which is not followed."
-                : `HTTP ${response.status}`,
-        };
-    }
-    let document;
-    try {
-        document = await response.json();
-    }
-    catch {
-        return {
-            ok: false,
-            did,
-            documentUrl,
-            reason: "unresolvable",
-            detail: "Response was not valid JSON.",
-        };
-    }
-    const resolvedId = typeof document === "object" && document !== null
-        ? document.id
-        : undefined;
-    // A document that resolves but names a different subject proves nothing
-    // about the claimed identity.
-    if (resolvedId !== did) {
-        return {
-            ok: false,
-            did,
-            documentUrl,
-            reason: "did-mismatch",
-            detail: `Document describes ${typeof resolvedId === "string" ? resolvedId : "no DID"}.`,
-        };
-    }
-    return {
-        ok: true,
-        did,
-        documentUrl,
-        agentUrl: readServiceEndpoint(document),
-    };
-}
-//# sourceMappingURL=verify.js.map

package/dist/utils/dco/verify.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/utils/dco/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AA6ChD,MAAM,aAAa,GAAe,KAAK,EAAE,QAAQ,EAAE,EAAE;IACnD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,iCAAiC,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpD,iEAAiE;QACjE,uEAAuE;QACvE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC;IAC1B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IAChC,sEAAsE;IACtE,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IACE,IAAI,CAAC,IAAI,CACP,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,KAAK,EAAE;QACd,OAAO,KAAK,GAAG;QACf,OAAO,KAAK,IAAI;QAChB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAC1B,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM;QACxB,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW;QAC9B,CAAC,CAAC,sBAAsB,CAAC;IAC3B,OAAO,WAAW,IAAI,IAAI,MAAM,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,mBAAmB,GAA6C;IACpE,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,iBAAiB;IACjC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,kBAAkB;IACnC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,+BAA+B;IACnD,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,WAAW;IAC7B,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,qDAAqD;IAC1E,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,kBAAkB;IACtC,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,4BAA4B;IAC/C,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,6BAA6B;IAChD,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,kBAAkB;IACvC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,eAAe;IACnC,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,6BAA6B;IACnD,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,6BAA6B;IAClD,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,YAAY;IAC9B,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,wDAAwD;CAC3E,CAAC;AAEF,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,KAAK,GAAG,8CAA8C,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,CACL,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QACpE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAE,GAAG,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAE/B,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3D,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,WAAW,IAAI,MAAM,IAAI,WAAW,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IAC9E,IAAI,WAAW,IAAI,MAAM,IAAI,WAAW,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,eAAe;IAChF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAU;IAClC,OAAO,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,QAAgB,EAChB,aAAyB,aAAa;IAEtC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAC1C,CAAC;AAMD;;;;;;;GAOG;AACH,KAAK,UAAU,uBAAuB,CACpC,WAAmB,EACnB,UAAsB;IAEtB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,wCAAwC;SACjD,CAAC;IACJ,CAAC;IAED,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EACJ,2EAA2E;SAC9E,CAAC;IACJ,CAAC;IAED,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,4BAA4B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,wEAAwE;QACxE,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EACJ,mFAAmF;SACtF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAiB;IAC5C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxE,MAAM,OAAO,GAAI,QAAkC,CAAC,OAAO,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC1D,MAAM,QAAQ,GAAI,KAAuC,CAAC,eAAe,CAAC;QAC1E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;IAC3E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,YAAuB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EACtD,aAAyB,aAAa;IAEtC,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAEjD,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,qDAAqD;SAC9D,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,yDAAyD;IACzD,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,WAAW;YACX,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE;YACtC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAC/C,kEAAkE;YAClE,mEAAmE;YACnE,oEAAoE;YACpE,2DAA2D;YAC3D,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,0EAA0E;QAC1E,iEAAiE;QACjE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,WAAW;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,WAAW;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EACJ,QAAQ,CAAC,IAAI,KAAK,gBAAgB;gBAChC,CAAC,CAAC,oDAAoD;gBACtD,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,WAAW;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,8BAA8B;SACvC,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GACd,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAC/C,CAAC,CAAE,QAA6B,CAAC,EAAE;QACnC,CAAC,CAAC,SAAS,CAAC;IAEhB,wEAAwE;IACxE,8BAA8B;IAC9B,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,WAAW;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,sBACN,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAChD,GAAG;SACJ,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,GAAG;QACH,WAAW;QACX,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,CAAC;KACxC,CAAC;AACJ,CAAC"}

package/dist/utils/env-manager.d.ts

@@ -1,122 +0,0 @@
-export interface EnvVariables {
-    AGENT_PRIVATE_KEY: string;
-    AGENT_KEY_ID: string;
-    AGENT_DID: string;
-    AGENT_PUBLIC_KEY?: string;
-    AGENT_NAME?: string;
-    AGENT_DESCRIPTION?: string;
-    AGENT_GITHUB_REPO?: string;
-    BASE_URL?: string;
-    KYA_VOUCHED_API_KEY: string;
-    VOUCHED_API_KEY?: string;
-}
-export interface EnvFile {
-    path: string;
-    filename: string;
-    exists: boolean;
-    writable: boolean;
-    hasmcpidentity: boolean;
-    xmcpVariables: Partial<EnvVariables>;
-}
-export interface EnvInsertionResult {
-    success: boolean;
-    targetFile: string;
-    operation: "created" | "updated" | "replaced";
-    warnings: string[];
-    conflicts?: {
-        file: string;
-        variable: string;
-        value: string;
-    }[];
-}
-export declare class EnvManager {
-    private projectRoot;
-    constructor(projectRoot?: string);
-    /**
-     * Scan for all .env files with detailed analysis
-     */
-    scanEnvFiles(): EnvFile[];
-    /**
-     * Determine the best target file using precedence rules
-     */
-    selectTargetEnvFile(envFiles: EnvFile[]): {
-        target: EnvFile | null;
-        warnings: string[];
-    };
-    /**
-     * Check for conflicts across multiple .env files
-     */
-    detectConflicts(envFiles: EnvFile[], newVariables: EnvVariables): {
-        file: string;
-        variable: string;
-        value: string;
-    }[];
-    /**
-     * Smart insertion/update of MCP-I variables
-     */
-    smartInsertMcpVariables(variables: EnvVariables, options?: {
-        force?: boolean;
-    }): Promise<EnvInsertionResult>;
-    /**
-     * Parse .env file and extract MCP-I variables
-     */
-    private parseEnvFile;
-    /**
-     * Create a new .env file
-     */
-    private createEnvFile;
-    /**
-     * Update existing .env file by replacing MCP-I variables
-     */
-    private updateExistingEnvFile;
-    /**
-     * Append MCP-I variables to existing .env file
-     */
-    private appendToEnvFile;
-    /**
-     * Find existing .env files in the project
-     */
-    findExistingEnvFiles(): string[];
-    /**
-     * Update or create environment file, merging with existing content
-     */
-    updateEnvFile(filename: string, variables: EnvVariables, options?: {
-        force?: boolean;
-        example?: boolean;
-    }): Promise<void>;
-    /**
-     * Read environment variables from file
-     */
-    readEnvFile(filename: string): Partial<EnvVariables>;
-    /**
-     * Check if .gitignore includes env files
-     */
-    checkGitignore(envFiles: string[]): {
-        missing: string[];
-        ignored: string[];
-    };
-    /**
-     * Add files to .gitignore
-     */
-    addToGitignore(files: string[]): void;
-    /**
-     * Get environment variables from process.env
-     */
-    getFromProcess(): Partial<EnvVariables>;
-    /**
-     * Format environment variables for display
-     */
-    formatForDisplay(vars: Partial<EnvVariables>, hideSecrets?: boolean): string;
-    /**
-     * Format for clipboard (no masking)
-     */
-    formatForClipboard(vars: Partial<EnvVariables>): string;
-    /**
-     * Check if all required variables are present
-     */
-    validateVariables(vars: Partial<EnvVariables>): {
-        valid: boolean;
-        missing: string[];
-    };
-}
-//# sourceMappingURL=env-manager.d.ts.map

package/dist/utils/env-manager.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"env-manager.d.ts","sourceRoot":"","sources":["../../src/utils/env-manager.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,YAAY;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;IAC9C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjE;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,WAAW,CAAS;gBAEhB,WAAW,GAAE,MAAsB;IAI/C;;OAEG;IACH,YAAY,IAAI,OAAO,EAAE;IAwDzB;;OAEG;IACH,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG;QACxC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;QACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB;IAuCD;;OAEG;IACH,eAAe,CACb,QAAQ,EAAE,OAAO,EAAE,EACnB,YAAY,EAAE,YAAY,GACzB;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE;IAqBtD;;OAEG;IACG,uBAAuB,CAC3B,SAAS,EAAE,YAAY,EACvB,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAChC,OAAO,CAAC,kBAAkB,CAAC;IAsF9B;;OAEG;IACH,OAAO,CAAC,YAAY;IAoCpB;;OAEG;YACW,aAAa;IAuB3B;;OAEG;YACW,qBAAqB;IAmDnC;;OAEG;YACW,eAAe;IAuB7B;;OAEG;IACH,oBAAoB,IAAI,MAAM,EAAE;IAYhC;;OAEG;IACG,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,YAAY,EACvB,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAO,GACnD,OAAO,CAAC,IAAI,CAAC;IA2DhB;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAiCpD;;OAEG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE;IAkC5E;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAsBrC;;OAEG;IACH,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;IAqBvC;;OAEG;IACH,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,WAAW,UAAO,GAAG,MAAM;IAsBzE;;OAEG;IACH,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,MAAM;IAYvD;;OAEG;IACH,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG;QAC9C,KAAK,EAAE,OAAO,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB;CAeF"}