@mebular/fleet 0.0.0-stage → 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/agentdir.d.ts +43 -0
- package/dist/agentdir.d.ts.map +1 -0
- package/dist/agentdir.js +107 -0
- package/dist/agentdir.js.map +1 -0
- package/dist/cli.d.ts +3 -0
- package/dist/cli.d.ts.map +1 -0
- package/dist/cli.js +1135 -0
- package/dist/cli.js.map +1 -0
- package/dist/collab/chatter.d.ts +54 -0
- package/dist/collab/chatter.d.ts.map +1 -0
- package/dist/collab/chatter.js +94 -0
- package/dist/collab/chatter.js.map +1 -0
- package/dist/collab/dag.d.ts +27 -0
- package/dist/collab/dag.d.ts.map +1 -0
- package/dist/collab/dag.js +107 -0
- package/dist/collab/dag.js.map +1 -0
- package/dist/collab/negotiation.d.ts +60 -0
- package/dist/collab/negotiation.d.ts.map +1 -0
- package/dist/collab/negotiation.js +90 -0
- package/dist/collab/negotiation.js.map +1 -0
- package/dist/collab/tree.d.ts +39 -0
- package/dist/collab/tree.d.ts.map +1 -0
- package/dist/collab/tree.js +177 -0
- package/dist/collab/tree.js.map +1 -0
- package/dist/config.d.ts +123 -0
- package/dist/config.d.ts.map +1 -0
- package/dist/config.js +206 -0
- package/dist/config.js.map +1 -0
- package/dist/index.d.ts +33 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +40 -0
- package/dist/index.js.map +1 -0
- package/dist/join.d.ts +50 -0
- package/dist/join.d.ts.map +1 -0
- package/dist/join.js +167 -0
- package/dist/join.js.map +1 -0
- package/dist/jointoken.d.ts +144 -0
- package/dist/jointoken.d.ts.map +1 -0
- package/dist/jointoken.js +472 -0
- package/dist/jointoken.js.map +1 -0
- package/dist/model.d.ts +64 -0
- package/dist/model.d.ts.map +1 -0
- package/dist/model.js +158 -0
- package/dist/model.js.map +1 -0
- package/dist/onboard.d.ts +90 -0
- package/dist/onboard.d.ts.map +1 -0
- package/dist/onboard.js +510 -0
- package/dist/onboard.js.map +1 -0
- package/dist/protocol/envelope.d.ts +94 -0
- package/dist/protocol/envelope.d.ts.map +1 -0
- package/dist/protocol/envelope.js +169 -0
- package/dist/protocol/envelope.js.map +1 -0
- package/dist/protocol/events.d.ts +51 -0
- package/dist/protocol/events.d.ts.map +1 -0
- package/dist/protocol/events.js +87 -0
- package/dist/protocol/events.js.map +1 -0
- package/dist/qr.d.ts +15 -0
- package/dist/qr.d.ts.map +1 -0
- package/dist/qr.js +52 -0
- package/dist/qr.js.map +1 -0
- package/dist/quickstart.d.ts +167 -0
- package/dist/quickstart.d.ts.map +1 -0
- package/dist/quickstart.js +482 -0
- package/dist/quickstart.js.map +1 -0
- package/dist/quota.d.ts +41 -0
- package/dist/quota.d.ts.map +1 -0
- package/dist/quota.js +84 -0
- package/dist/quota.js.map +1 -0
- package/dist/runtime/agent.d.ts +100 -0
- package/dist/runtime/agent.d.ts.map +1 -0
- package/dist/runtime/agent.js +260 -0
- package/dist/runtime/agent.js.map +1 -0
- package/dist/runtime/executor.d.ts +42 -0
- package/dist/runtime/executor.d.ts.map +1 -0
- package/dist/runtime/executor.js +87 -0
- package/dist/runtime/executor.js.map +1 -0
- package/dist/runtime/fairness.d.ts +25 -0
- package/dist/runtime/fairness.d.ts.map +1 -0
- package/dist/runtime/fairness.js +79 -0
- package/dist/runtime/fairness.js.map +1 -0
- package/dist/runtime/node.d.ts +91 -0
- package/dist/runtime/node.d.ts.map +1 -0
- package/dist/runtime/node.js +203 -0
- package/dist/runtime/node.js.map +1 -0
- package/dist/runtime/openchamber-http.d.ts +27 -0
- package/dist/runtime/openchamber-http.d.ts.map +1 -0
- package/dist/runtime/openchamber-http.js +118 -0
- package/dist/runtime/openchamber-http.js.map +1 -0
- package/dist/runtime/openchamber.d.ts +38 -0
- package/dist/runtime/openchamber.d.ts.map +1 -0
- package/dist/runtime/openchamber.js +43 -0
- package/dist/runtime/openchamber.js.map +1 -0
- package/dist/runtime/planner.d.ts +23 -0
- package/dist/runtime/planner.d.ts.map +1 -0
- package/dist/runtime/planner.js +17 -0
- package/dist/runtime/planner.js.map +1 -0
- package/dist/runtime/worker.d.ts +96 -0
- package/dist/runtime/worker.d.ts.map +1 -0
- package/dist/runtime/worker.js +296 -0
- package/dist/runtime/worker.js.map +1 -0
- package/dist/security.d.ts +462 -0
- package/dist/security.d.ts.map +1 -0
- package/dist/security.js +1197 -0
- package/dist/security.js.map +1 -0
- package/dist/store/daemon-store.d.ts +33 -0
- package/dist/store/daemon-store.d.ts.map +1 -0
- package/dist/store/daemon-store.js +115 -0
- package/dist/store/daemon-store.js.map +1 -0
- package/dist/store/file-store.d.ts +22 -0
- package/dist/store/file-store.d.ts.map +1 -0
- package/dist/store/file-store.js +63 -0
- package/dist/store/file-store.js.map +1 -0
- package/dist/store/mebular-store.d.ts +22 -0
- package/dist/store/mebular-store.d.ts.map +1 -0
- package/dist/store/mebular-store.js +53 -0
- package/dist/store/mebular-store.js.map +1 -0
- package/dist/store/message-store.d.ts +26 -0
- package/dist/store/message-store.d.ts.map +1 -0
- package/dist/store/message-store.js +51 -0
- package/dist/store/message-store.js.map +1 -0
- package/dist/surface.d.ts +43 -0
- package/dist/surface.d.ts.map +1 -0
- package/dist/surface.js +515 -0
- package/dist/surface.js.map +1 -0
- package/dist/transport/null.d.ts +7 -0
- package/dist/transport/null.d.ts.map +1 -0
- package/dist/transport/null.js +16 -0
- package/dist/transport/null.js.map +1 -0
- package/dist/transport/spool.d.ts +12 -0
- package/dist/transport/spool.d.ts.map +1 -0
- package/dist/transport/spool.js +54 -0
- package/dist/transport/spool.js.map +1 -0
- package/dist/transport/types.d.ts +21 -0
- package/dist/transport/types.d.ts.map +1 -0
- package/dist/transport/types.js +6 -0
- package/dist/transport/types.js.map +1 -0
- package/dist/version.json +6 -0
- package/package.json +37 -4
- package/protocol/collab.example.json +23 -0
- package/protocol/daemon-home.example.json +66 -0
- package/protocol/envelope.example.json +12 -0
- package/protocol/state-machine.json +14 -0
- package/protocol/task-tree.example.json +72 -0
- package/src/agentdir.ts +138 -0
- package/src/cli.ts +1192 -0
- package/src/collab/chatter.ts +116 -0
- package/src/collab/dag.ts +124 -0
- package/src/collab/negotiation.ts +130 -0
- package/src/collab/tree.ts +184 -0
- package/src/config.ts +286 -0
- package/src/index.ts +39 -0
- package/src/join.ts +227 -0
- package/src/jointoken.ts +609 -0
- package/src/model.ts +203 -0
- package/src/onboard.ts +601 -0
- package/src/protocol/envelope.ts +228 -0
- package/src/protocol/events.ts +135 -0
- package/src/qr.ts +68 -0
- package/src/quickstart.ts +632 -0
- package/src/quota.ts +112 -0
- package/src/runtime/agent.ts +313 -0
- package/src/runtime/executor.ts +114 -0
- package/src/runtime/fairness.ts +90 -0
- package/src/runtime/node.ts +250 -0
- package/src/runtime/openchamber-http.ts +137 -0
- package/src/runtime/openchamber.ts +66 -0
- package/src/runtime/planner.ts +36 -0
- package/src/runtime/worker.ts +354 -0
- package/src/security.ts +1660 -0
- package/src/store/daemon-store.ts +144 -0
- package/src/store/file-store.ts +75 -0
- package/src/store/mebular-store.ts +66 -0
- package/src/store/message-store.ts +62 -0
- package/src/surface.ts +535 -0
- package/src/transport/null.ts +20 -0
- package/src/transport/spool.ts +62 -0
- package/src/transport/types.ts +27 -0
- package/README.md +0 -3
|
@@ -0,0 +1,462 @@
|
|
|
1
|
+
import { createPrivateKey, createPublicKey } from 'node:crypto';
|
|
2
|
+
import { type DeviceCertificate } from '@mebular/core';
|
|
3
|
+
import { readMasterKeyFile, type FleetAgentConfig } from './config.js';
|
|
4
|
+
export declare const SECURITY_TIER_EVENT = "security_tier";
|
|
5
|
+
export declare const SECURITY_APPROVAL_EVENT = "security_approval";
|
|
6
|
+
export declare const SECURITY_RECOVERY_EVENT = "security_recovery";
|
|
7
|
+
export declare const SECURITY_TOTP_EVENT = "security_totp";
|
|
8
|
+
export declare const SECURITY_TOTP_FILE = "security-totp.json";
|
|
9
|
+
export declare const SECURITY_TOTP_STATE_FILE = "security-totp.json.state";
|
|
10
|
+
export declare const TOTP_STEP_MS = 30000;
|
|
11
|
+
export declare const TOTP_WINDOW_STEPS = 1;
|
|
12
|
+
export declare const TOTP_MAX_FAILURES = 5;
|
|
13
|
+
export declare const TOTP_FAILURE_WINDOW_MS: number;
|
|
14
|
+
export declare const TOTP_LOCK_MS: number;
|
|
15
|
+
export declare const TOTP_BACKOFF_MAX_MS = 30000;
|
|
16
|
+
export type SecurityLevel = 'low' | 'medium' | 'high';
|
|
17
|
+
export interface SecurityTierState {
|
|
18
|
+
level: SecurityLevel;
|
|
19
|
+
changedAt?: number;
|
|
20
|
+
changedBy?: string;
|
|
21
|
+
admitted: string[];
|
|
22
|
+
recoveryKeyId?: string;
|
|
23
|
+
rejections: Array<{
|
|
24
|
+
eventId: string;
|
|
25
|
+
reason: string;
|
|
26
|
+
}>;
|
|
27
|
+
}
|
|
28
|
+
/** `getSecurityTier()` 缺失时的保守读档(低档),并带特性探测标记。 */
|
|
29
|
+
export interface SecurityStateView extends SecurityTierState {
|
|
30
|
+
coreTierAvailable: boolean;
|
|
31
|
+
}
|
|
32
|
+
export interface SecurityRejection {
|
|
33
|
+
eventId: string;
|
|
34
|
+
reason: string;
|
|
35
|
+
}
|
|
36
|
+
export interface CosignProof {
|
|
37
|
+
v: 1;
|
|
38
|
+
op: SecurityAction;
|
|
39
|
+
approver: string;
|
|
40
|
+
approverCertificateChain: DeviceCertificate[];
|
|
41
|
+
approvalId: string;
|
|
42
|
+
digest: string;
|
|
43
|
+
pairingCode: string;
|
|
44
|
+
issuedAt: number;
|
|
45
|
+
expiresAt: number;
|
|
46
|
+
signature: string;
|
|
47
|
+
}
|
|
48
|
+
export interface BreakGlassProof {
|
|
49
|
+
v: 1;
|
|
50
|
+
op: SecurityAction;
|
|
51
|
+
keyId: string;
|
|
52
|
+
digest: string;
|
|
53
|
+
nonce: string;
|
|
54
|
+
issuedAt: number;
|
|
55
|
+
expiresAt: number;
|
|
56
|
+
signature: string;
|
|
57
|
+
}
|
|
58
|
+
export interface SecurityTierRecord {
|
|
59
|
+
level: SecurityLevel;
|
|
60
|
+
nonce: string;
|
|
61
|
+
issuedAt: number;
|
|
62
|
+
note?: string;
|
|
63
|
+
cosign?: CosignProof;
|
|
64
|
+
breakGlass?: BreakGlassProof;
|
|
65
|
+
}
|
|
66
|
+
export interface SecurityApprovalRecord {
|
|
67
|
+
approvalId: string;
|
|
68
|
+
op: SecurityAction;
|
|
69
|
+
decision: 'request' | 'approve' | 'deny';
|
|
70
|
+
initiator: string;
|
|
71
|
+
target?: string;
|
|
72
|
+
namespace?: string;
|
|
73
|
+
level?: SecurityLevel;
|
|
74
|
+
nonce: string;
|
|
75
|
+
digest: string;
|
|
76
|
+
pairingCode: string;
|
|
77
|
+
cosign?: CosignProof;
|
|
78
|
+
expiresAt: number;
|
|
79
|
+
issuedAt: number;
|
|
80
|
+
note?: string;
|
|
81
|
+
}
|
|
82
|
+
export interface SecurityRecoveryRecord {
|
|
83
|
+
keyId: string;
|
|
84
|
+
publicKey: string;
|
|
85
|
+
createdAt: number;
|
|
86
|
+
mode: 'set' | 'rotate';
|
|
87
|
+
/** rotate 的动作 nonce(进入 digest;`set` 可缺省)。 */
|
|
88
|
+
nonce?: string;
|
|
89
|
+
note?: string;
|
|
90
|
+
cosign?: CosignProof;
|
|
91
|
+
breakGlass?: BreakGlassProof;
|
|
92
|
+
}
|
|
93
|
+
export interface SecurityTotpRecord {
|
|
94
|
+
device: string;
|
|
95
|
+
fingerprint: string;
|
|
96
|
+
epoch?: string;
|
|
97
|
+
issuedAt: number;
|
|
98
|
+
note?: string;
|
|
99
|
+
}
|
|
100
|
+
export type SecurityAction = 'kick' | 'join' | 'tier' | 'rotate' | 'restore';
|
|
101
|
+
export interface SecurityActionParams {
|
|
102
|
+
op: SecurityAction;
|
|
103
|
+
initiator: string;
|
|
104
|
+
subject?: string;
|
|
105
|
+
namespace?: string;
|
|
106
|
+
level?: SecurityLevel;
|
|
107
|
+
oldKeyId?: string;
|
|
108
|
+
newPublicKey?: string;
|
|
109
|
+
nonce: string;
|
|
110
|
+
}
|
|
111
|
+
export interface SecurityApp {
|
|
112
|
+
deviceId?: string;
|
|
113
|
+
eventLog?: {
|
|
114
|
+
append(event: Record<string, unknown>): Promise<{
|
|
115
|
+
id: string;
|
|
116
|
+
}>;
|
|
117
|
+
listEvents(filter?: Record<string, unknown>): Promise<Array<PolicyEvent>>;
|
|
118
|
+
};
|
|
119
|
+
getSecurityTier?: (...args: any[]) => Promise<unknown>;
|
|
120
|
+
setSecurityTier?: (...args: any[]) => Promise<unknown>;
|
|
121
|
+
getBlockedDevices?: (...args: any[]) => Promise<unknown>;
|
|
122
|
+
revokeDevice?: (...args: any[]) => Promise<unknown>;
|
|
123
|
+
restoreDevice?: (...args: any[]) => Promise<unknown>;
|
|
124
|
+
identity?: any;
|
|
125
|
+
}
|
|
126
|
+
export interface PolicyEvent {
|
|
127
|
+
id: string;
|
|
128
|
+
type: string;
|
|
129
|
+
author?: string;
|
|
130
|
+
timestamp?: number;
|
|
131
|
+
data?: Record<string, any>;
|
|
132
|
+
}
|
|
133
|
+
/** 原子写 0600(先写临时文件再 rename;失败不留半成品)。 */
|
|
134
|
+
export declare function writePrivateFile(path: string, data: string | Uint8Array): Promise<void>;
|
|
135
|
+
export declare function readPrivateJson<T>(path: string): Promise<T | null>;
|
|
136
|
+
export declare function base32Encode(bytes: Uint8Array): string;
|
|
137
|
+
export declare function base32Decode(input: string): Uint8Array;
|
|
138
|
+
export declare function crockfordEncode(bytes: Uint8Array): string;
|
|
139
|
+
export declare function crockfordDecode(input: string): Uint8Array;
|
|
140
|
+
export interface TotpSeedRecord {
|
|
141
|
+
v: 1;
|
|
142
|
+
secret: string;
|
|
143
|
+
createdAt: number;
|
|
144
|
+
fingerprint: string;
|
|
145
|
+
}
|
|
146
|
+
export interface TotpVerifyState {
|
|
147
|
+
v: 1;
|
|
148
|
+
failures: number;
|
|
149
|
+
windowStartedAt: number;
|
|
150
|
+
lockedUntil: number;
|
|
151
|
+
backoffUntil: number;
|
|
152
|
+
lastAcceptedStep: number;
|
|
153
|
+
lastAcceptedAt: number;
|
|
154
|
+
updatedAt: number;
|
|
155
|
+
}
|
|
156
|
+
export interface TotpStatus {
|
|
157
|
+
imported: boolean;
|
|
158
|
+
fingerprint?: string;
|
|
159
|
+
createdAt?: number;
|
|
160
|
+
failures: number;
|
|
161
|
+
lockedUntil: number;
|
|
162
|
+
backoffUntil: number;
|
|
163
|
+
lastAcceptedAt: number;
|
|
164
|
+
}
|
|
165
|
+
export declare function totpFingerprint(secret: string): string;
|
|
166
|
+
export declare function generateTotpSecret(bytes?: number): string;
|
|
167
|
+
export declare function totpOtpauthUri(secret: string, deviceId: string, issuer?: string): string;
|
|
168
|
+
/** 解析纯 base32 / otpauth URI;返回 secret(base32)与可选元数据。 */
|
|
169
|
+
export declare function parseTotpInput(input: string): {
|
|
170
|
+
secret: string;
|
|
171
|
+
issuer?: string;
|
|
172
|
+
label?: string;
|
|
173
|
+
};
|
|
174
|
+
export declare function totpCodeAt(secret: string, step: number): string;
|
|
175
|
+
export declare function readTotpSeed(dir: string): Promise<TotpSeedRecord | null>;
|
|
176
|
+
export declare function writeTotpSeed(dir: string, secret: string, createdAt?: number): Promise<TotpSeedRecord>;
|
|
177
|
+
/** 导入种子;`expectedFingerprint` 不一致即拒绝(防导入错误/被替换)。 */
|
|
178
|
+
export declare function importTotpSeed(dir: string, input: string, options?: {
|
|
179
|
+
expectedFingerprint?: string;
|
|
180
|
+
}): Promise<TotpSeedRecord>;
|
|
181
|
+
export declare function totpStatePath(dir: string): string;
|
|
182
|
+
export interface VerifyTotpOptions {
|
|
183
|
+
/** home 目录:状态落 `<home>/security-totp.json.state`。缺省不持久化(仅纯函数校验)。 */
|
|
184
|
+
dir?: string;
|
|
185
|
+
statePath?: string;
|
|
186
|
+
/** 测试注入:失败退避延时;默认真实 setTimeout。 */
|
|
187
|
+
sleep?: (ms: number) => Promise<void>;
|
|
188
|
+
maxFailures?: number;
|
|
189
|
+
windowMs?: number;
|
|
190
|
+
lockMs?: number;
|
|
191
|
+
}
|
|
192
|
+
export type TotpFailureReason = 'invalid' | 'replay' | 'locked' | 'malformed' | 'missing';
|
|
193
|
+
export interface VerifyTotpResult {
|
|
194
|
+
ok: boolean;
|
|
195
|
+
driftStep?: number;
|
|
196
|
+
reason?: TotpFailureReason;
|
|
197
|
+
retryAfterMs?: number;
|
|
198
|
+
lockedUntil?: number;
|
|
199
|
+
failures?: number;
|
|
200
|
+
}
|
|
201
|
+
/**
|
|
202
|
+
* 校验 TOTP(±1 步)。状态持久化时同时执行重放/限次/退避。
|
|
203
|
+
* 注意:`now` 是逻辑时间;测试可注入固定值 + 空 sleep。
|
|
204
|
+
*/
|
|
205
|
+
export declare function verifyTotp(secret: string, code: string, now?: number, options?: VerifyTotpOptions): Promise<VerifyTotpResult>;
|
|
206
|
+
export declare function readTotpStatus(dir: string): Promise<TotpStatus>;
|
|
207
|
+
export interface RecoveryCodeMaterial {
|
|
208
|
+
code: string;
|
|
209
|
+
keyId: string;
|
|
210
|
+
publicKeyHex: string;
|
|
211
|
+
createdAt: number;
|
|
212
|
+
}
|
|
213
|
+
export interface DerivedRecoveryKey {
|
|
214
|
+
privateKey: ReturnType<typeof createPrivateKey>;
|
|
215
|
+
publicKey: ReturnType<typeof createPublicKey>;
|
|
216
|
+
publicKeyHex: string;
|
|
217
|
+
keyId: string;
|
|
218
|
+
}
|
|
219
|
+
/** 20B secret → 32 字符 Crockford + 2 校验字符。 */
|
|
220
|
+
export declare function encodeRecoveryCode(secret: Uint8Array): string;
|
|
221
|
+
export declare function decodeRecoveryCode(code: string): Uint8Array;
|
|
222
|
+
/** 显示形态:8 组 ×4 + 2 位校验单独成组。 */
|
|
223
|
+
export declare function formatRecoveryCode(code: string): string;
|
|
224
|
+
export declare function deriveRecoveryKey(code: string): DerivedRecoveryKey;
|
|
225
|
+
/** 生成恢复码(secret 不落盘;调用方只显示一次)。 */
|
|
226
|
+
export declare function generateRecoveryCode(now?: number): RecoveryCodeMaterial;
|
|
227
|
+
/** 规范 JSON:键序固定、无空白、忽略 undefined。 */
|
|
228
|
+
export declare function canonicalJson(value: unknown): string;
|
|
229
|
+
export declare function sha256Hex(value: string | Uint8Array): string;
|
|
230
|
+
/** §3.2 动作摘要的规范 JSON。 */
|
|
231
|
+
export declare function securityActionCanonical(params: SecurityActionParams): Record<string, unknown>;
|
|
232
|
+
export declare function securityActionDigest(params: SecurityActionParams): string;
|
|
233
|
+
/** 配对号:sha256('mebular-pairing'||digest) 前 4 字节 uint32 BE % 1e6 → 'NNN-NNN'。 */
|
|
234
|
+
export declare function pairingCodeForDigest(digest: string): string;
|
|
235
|
+
export declare function cosignUnsigned(proof: CosignProof): Record<string, unknown>;
|
|
236
|
+
export interface SignBreakGlassInput {
|
|
237
|
+
code: string;
|
|
238
|
+
op: SecurityAction;
|
|
239
|
+
initiator: string;
|
|
240
|
+
subject?: string;
|
|
241
|
+
namespace?: string;
|
|
242
|
+
level?: SecurityLevel;
|
|
243
|
+
oldKeyId?: string;
|
|
244
|
+
newPublicKey?: string;
|
|
245
|
+
nonce?: string;
|
|
246
|
+
now?: number;
|
|
247
|
+
ttlMs?: number;
|
|
248
|
+
}
|
|
249
|
+
export interface SignedBreakGlass {
|
|
250
|
+
proof: BreakGlassProof;
|
|
251
|
+
digest: string;
|
|
252
|
+
nonce: string;
|
|
253
|
+
pairingCode: string;
|
|
254
|
+
}
|
|
255
|
+
export declare function signBreakGlass(input: SignBreakGlassInput): SignedBreakGlass;
|
|
256
|
+
export interface VerifyBreakGlassOptions {
|
|
257
|
+
publicKeyHex: string;
|
|
258
|
+
expectedDigest?: string;
|
|
259
|
+
usedNonces?: Set<string>;
|
|
260
|
+
currentKeyId?: string;
|
|
261
|
+
}
|
|
262
|
+
export declare function verifyBreakGlassProof(proof: BreakGlassProof, options: VerifyBreakGlassOptions): {
|
|
263
|
+
ok: boolean;
|
|
264
|
+
reason?: string;
|
|
265
|
+
};
|
|
266
|
+
export interface SignCosignInput {
|
|
267
|
+
privateKey: CryptoKey;
|
|
268
|
+
approver: string;
|
|
269
|
+
approverCertificateChain: DeviceCertificate[];
|
|
270
|
+
approvalId: string;
|
|
271
|
+
op: SecurityAction;
|
|
272
|
+
digest: string;
|
|
273
|
+
pairingCode?: string;
|
|
274
|
+
now?: number;
|
|
275
|
+
ttlMs?: number;
|
|
276
|
+
}
|
|
277
|
+
export declare function signCosignProof(input: SignCosignInput): Promise<CosignProof>;
|
|
278
|
+
export declare function verifyCosignProofSignature(proof: CosignProof, approverPublicKeyHex: string): Promise<boolean>;
|
|
279
|
+
export interface RecoveryRegistry {
|
|
280
|
+
currentKeyId?: string;
|
|
281
|
+
keys: Record<string, {
|
|
282
|
+
publicKeyHex: string;
|
|
283
|
+
createdAt: number;
|
|
284
|
+
}>;
|
|
285
|
+
usedNonces: Set<string>;
|
|
286
|
+
lastUsedAt?: number;
|
|
287
|
+
}
|
|
288
|
+
/** 从 `__policy__` 事件推导恢复码登记/消费视图(本地预检口径;权威采纳在 core/S1)。 */
|
|
289
|
+
export declare function collectRecoveryRegistry(events: readonly PolicyEvent[]): RecoveryRegistry;
|
|
290
|
+
export declare function appendSecurityRecord(app: SecurityApp, type: string, key: string, record: unknown): Promise<{
|
|
291
|
+
id: string;
|
|
292
|
+
}>;
|
|
293
|
+
export declare function listPolicyEvents(app: SecurityApp): Promise<PolicyEvent[]>;
|
|
294
|
+
export declare function normalizeSecurityLevel(value: unknown): SecurityLevel;
|
|
295
|
+
/** 读档位:缺 `getSecurityTier()` → low(S1 未合并的当前构建不炸)。 */
|
|
296
|
+
export declare function readSecurityState(app: SecurityApp): Promise<SecurityStateView>;
|
|
297
|
+
export interface WriteTierInput {
|
|
298
|
+
level: SecurityLevel;
|
|
299
|
+
note?: string;
|
|
300
|
+
cosign?: CosignProof;
|
|
301
|
+
breakGlass?: BreakGlassProof;
|
|
302
|
+
nonce?: string;
|
|
303
|
+
}
|
|
304
|
+
export declare function writeSecurityTier(app: SecurityApp, input: WriteTierInput): Promise<{
|
|
305
|
+
id?: string;
|
|
306
|
+
level: SecurityLevel;
|
|
307
|
+
}>;
|
|
308
|
+
export interface WriteDeviceRevokeInput {
|
|
309
|
+
subject: string;
|
|
310
|
+
note?: string;
|
|
311
|
+
/** kick 动作 nonce(high 档进入 digest;带证明时必填/可由 breakGlass 推导)。 */
|
|
312
|
+
nonce?: string;
|
|
313
|
+
cosign?: CosignProof;
|
|
314
|
+
breakGlass?: BreakGlassProof;
|
|
315
|
+
}
|
|
316
|
+
export declare function writeDeviceRevoke(app: SecurityApp, input: WriteDeviceRevokeInput): Promise<{
|
|
317
|
+
id?: string;
|
|
318
|
+
}>;
|
|
319
|
+
export interface WriteDeviceRestoreInput {
|
|
320
|
+
subject: string;
|
|
321
|
+
note?: string;
|
|
322
|
+
nonce?: string;
|
|
323
|
+
cosign?: CosignProof;
|
|
324
|
+
breakGlass?: BreakGlassProof;
|
|
325
|
+
}
|
|
326
|
+
/** 写 `device_restore`(恢复纪元由 core 推导;high 档证明随记录走)。 */
|
|
327
|
+
export declare function writeDeviceRestore(app: SecurityApp, input: WriteDeviceRestoreInput): Promise<{
|
|
328
|
+
id?: string;
|
|
329
|
+
}>;
|
|
330
|
+
export declare function writeSecurityApproval(app: SecurityApp, record: SecurityApprovalRecord): Promise<{
|
|
331
|
+
id: string;
|
|
332
|
+
}>;
|
|
333
|
+
export declare function writeSecurityRecovery(app: SecurityApp, record: SecurityRecoveryRecord): Promise<{
|
|
334
|
+
id: string;
|
|
335
|
+
}>;
|
|
336
|
+
export declare function writeSecurityTotpAudit(app: SecurityApp, record: SecurityTotpRecord): Promise<{
|
|
337
|
+
id: string;
|
|
338
|
+
}>;
|
|
339
|
+
/** 最新恢复码登记(本地预检;权威在 core)。 */
|
|
340
|
+
export declare function latestRecoveryRecord(events: readonly PolicyEvent[]): SecurityRecoveryRecord | null;
|
|
341
|
+
export declare function approvalsFromEvents(events: readonly PolicyEvent[]): SecurityApprovalRecord[];
|
|
342
|
+
export declare function pendingApprovals(events: readonly PolicyEvent[], now?: number): SecurityApprovalRecord[];
|
|
343
|
+
export declare function findApproval(events: readonly PolicyEvent[], approvalId: string): SecurityApprovalRecord | null;
|
|
344
|
+
export interface SecurityGateResult {
|
|
345
|
+
ok: boolean;
|
|
346
|
+
status?: number;
|
|
347
|
+
error?: string;
|
|
348
|
+
message?: string;
|
|
349
|
+
retryAfterMs?: number;
|
|
350
|
+
}
|
|
351
|
+
export interface SecurityGateInput {
|
|
352
|
+
action: 'invite' | 'revoke' | 'tier' | 'restore';
|
|
353
|
+
level?: SecurityLevel;
|
|
354
|
+
code?: string;
|
|
355
|
+
cosign?: CosignProof;
|
|
356
|
+
breakGlass?: BreakGlassProof;
|
|
357
|
+
subject?: string;
|
|
358
|
+
namespace?: string;
|
|
359
|
+
approvalId?: string;
|
|
360
|
+
now?: number;
|
|
361
|
+
/** 测试注入:TOTP 失败退避延时;生产不传(真实 setTimeout)。 */
|
|
362
|
+
sleep?: (ms: number) => Promise<void>;
|
|
363
|
+
}
|
|
364
|
+
/**
|
|
365
|
+
* 本机程序门槛(SPEC §2.5 / §1.4):
|
|
366
|
+
* - medium:invite/revoke/档位变更(除 medium→medium)需要动态码;
|
|
367
|
+
* - high:invite/revoke/档位变更(除 high→high)需要会签或恢复码;
|
|
368
|
+
* - low:无门槛。S1 未合并(getSecurityTier 缺失)→ low。
|
|
369
|
+
*/
|
|
370
|
+
export declare function evaluateSecurityGate(app: SecurityApp, dir: string, input: SecurityGateInput): Promise<SecurityGateResult>;
|
|
371
|
+
export declare const BACKUP_KIND = "mebular-master-key-backup";
|
|
372
|
+
export declare const BACKUP_SCRYPT_N = 32768;
|
|
373
|
+
export declare const BACKUP_SCRYPT_R = 8;
|
|
374
|
+
export declare const BACKUP_SCRYPT_P = 1;
|
|
375
|
+
export interface MasterKeyBackupFile {
|
|
376
|
+
v: 1;
|
|
377
|
+
kind: typeof BACKUP_KIND;
|
|
378
|
+
createdAt: number;
|
|
379
|
+
deviceId: string;
|
|
380
|
+
masterPublicKeyHex: string;
|
|
381
|
+
kdf: {
|
|
382
|
+
name: 'scrypt';
|
|
383
|
+
N: number;
|
|
384
|
+
r: number;
|
|
385
|
+
p: number;
|
|
386
|
+
salt: string;
|
|
387
|
+
};
|
|
388
|
+
cipher: {
|
|
389
|
+
name: 'AES-256-GCM';
|
|
390
|
+
iv: string;
|
|
391
|
+
ciphertext: string;
|
|
392
|
+
tag: string;
|
|
393
|
+
};
|
|
394
|
+
}
|
|
395
|
+
export interface MasterKeyBackupPayload {
|
|
396
|
+
masterPrivateKeyPkcs8: string;
|
|
397
|
+
masterPublicKeyHex: string;
|
|
398
|
+
createdAt: number;
|
|
399
|
+
deviceId: string;
|
|
400
|
+
note?: string;
|
|
401
|
+
}
|
|
402
|
+
export interface ExportBackupInput {
|
|
403
|
+
dir: string;
|
|
404
|
+
/** 备份码;缺省生成一个新码(调用方必须一次性显示)。 */
|
|
405
|
+
code?: string;
|
|
406
|
+
note?: string;
|
|
407
|
+
now?: number;
|
|
408
|
+
}
|
|
409
|
+
export interface ExportBackupResult {
|
|
410
|
+
file: MasterKeyBackupFile;
|
|
411
|
+
code: string;
|
|
412
|
+
codeGenerated: boolean;
|
|
413
|
+
fingerprint: string;
|
|
414
|
+
deviceId: string;
|
|
415
|
+
}
|
|
416
|
+
interface ResolvedHomeKey {
|
|
417
|
+
keyPath: string;
|
|
418
|
+
deviceId: string;
|
|
419
|
+
encryption: Awaited<ReturnType<typeof readMasterKeyFile>>;
|
|
420
|
+
}
|
|
421
|
+
/** 解析 home 的主密钥路径(fleet home / 守护 home / 空 home)。 */
|
|
422
|
+
export declare function resolveHomeMasterKey(dir: string): Promise<ResolvedHomeKey>;
|
|
423
|
+
/** 导出主密钥备份(仅 root;委派设备无主私钥 → 明确失败)。 */
|
|
424
|
+
export declare function exportMasterKeyBackup(input: ExportBackupInput): Promise<ExportBackupResult>;
|
|
425
|
+
export declare function writeBackupFile(path: string, file: MasterKeyBackupFile): Promise<void>;
|
|
426
|
+
export interface RestoreBackupInput {
|
|
427
|
+
file: string | MasterKeyBackupFile;
|
|
428
|
+
code: string;
|
|
429
|
+
dir: string;
|
|
430
|
+
keyPath?: string;
|
|
431
|
+
device?: string;
|
|
432
|
+
namespace?: string;
|
|
433
|
+
listen?: string;
|
|
434
|
+
agents?: FleetAgentConfig[];
|
|
435
|
+
}
|
|
436
|
+
export interface RestoreBackupResult {
|
|
437
|
+
fingerprint: string;
|
|
438
|
+
masterPublicKeyHex: string;
|
|
439
|
+
deviceId: string;
|
|
440
|
+
keyPath: string;
|
|
441
|
+
configPath?: string;
|
|
442
|
+
onboarded: boolean;
|
|
443
|
+
}
|
|
444
|
+
/**
|
|
445
|
+
* 从备份恢复主密钥。**先解密/验公钥,再写盘**;失败不留半成品。
|
|
446
|
+
* `device` 给出时顺带 `onboardDevice`(写 fleet 配置 + 设备证书,成为新 root)。
|
|
447
|
+
*/
|
|
448
|
+
export declare function restoreMasterKeyBackup(input: RestoreBackupInput): Promise<RestoreBackupResult>;
|
|
449
|
+
export interface TotpShareResult {
|
|
450
|
+
secret: string;
|
|
451
|
+
fingerprint: string;
|
|
452
|
+
otpauth: string;
|
|
453
|
+
groups: string;
|
|
454
|
+
qrText?: string;
|
|
455
|
+
}
|
|
456
|
+
export interface TotpShareOptions {
|
|
457
|
+
qr?: boolean;
|
|
458
|
+
}
|
|
459
|
+
export declare function renderTotpShare(secret: string, deviceId: string, options?: TotpShareOptions): Promise<TotpShareResult>;
|
|
460
|
+
export declare function renderTotpShareSvg(secret: string, deviceId: string, options?: TotpShareOptions): Promise<string | null>;
|
|
461
|
+
export {};
|
|
462
|
+
//# sourceMappingURL=security.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAYA,OAAO,EAKL,gBAAgB,EAChB,eAAe,EAQhB,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAKL,iBAAiB,EACjB,KAAK,gBAAgB,EACtB,MAAM,aAAa,CAAC;AAIrB,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AACnD,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAC3D,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAC3D,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AAEnD,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE,eAAO,MAAM,YAAY,QAAS,CAAC;AACnC,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,eAAO,MAAM,sBAAsB,QAAc,CAAC;AAClD,eAAO,MAAM,YAAY,QAAc,CAAC;AACxC,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxD;AAED,iDAAiD;AACjD,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,CAAC,CAAC;IACL,EAAE,EAAE,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,wBAAwB,EAAE,iBAAiB,EAAE,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,CAAC,EAAE,CAAC,CAAC;IACL,EAAE,EAAE,cAAc,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,cAAc,CAAC;IACnB,QAAQ,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,KAAK,GAAG,QAAQ,CAAC;IACvB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE7E,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,cAAc,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAChE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;KAC3E,CAAC;IACF,eAAe,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,eAAe,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,iBAAiB,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,YAAY,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,aAAa,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,QAAQ,CAAC,EAAE,GAAG,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC5B;AAWD,wCAAwC;AACxC,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAW7F;AAED,wBAAsB,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAGxE;AASD,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CActD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAmBtD;AAWD,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAczD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAgBzD;AAMD,MAAM,WAAW,cAAc;IAC7B,CAAC,EAAE,CAAC,CAAC;IACL,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAaD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,SAAK,GAAG,MAAM,CAErD;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAY,GAAG,MAAM,CAU3F;AAED,wDAAwD;AACxD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAoBjG;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAW/D;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAO9E;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,SAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAIhH;AAED,oDAAoD;AACpD,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7C,OAAO,CAAC,cAAc,CAAC,CAazB;AAcD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mCAAmC;IACnC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AAE1F,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,MAAmB,EACxB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAqG3B;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAgBrE;AAQD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;IAChD,SAAS,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAQD,6CAA6C;AAC7C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAG7D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAO3D;AAED,+BAA+B;AAC/B,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAalE;AAED,kCAAkC;AAClC,wBAAgB,oBAAoB,CAAC,GAAG,SAAa,GAAG,oBAAoB,CAK3E;AAED,qCAAqC;AACrC,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMpD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAE5D;AAED,yBAAyB;AACzB,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqB7F;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAIzE;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAK3D;AAOD,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAG1E;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,cAAc,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,gBAAgB,CA0B3E;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,uBAAuB,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAgChI;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,wBAAwB,EAAE,iBAAiB,EAAE,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,cAAc,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAkBlF;AAED,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBnH;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAYD,2DAA2D;AAC3D,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,gBAAgB,CAyBxF;AAMD,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,GACd,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAGzB;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAG/E;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAEpE;AAED,sDAAsD;AACtD,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA6BpF;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,aAAa,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC,CAwB/H;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA2BjH;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED,sDAAsD;AACtD,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BnH;AAED,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAErH;AAED,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAErH;AAED,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAElH;AAED,8BAA8B;AAC9B,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAelG;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,sBAAsB,EAAE,CAK5F;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,EAAE,GAAG,SAAa,GAAG,sBAAsB,EAAE,CAI3G;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAE9G;AAMD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;IACjD,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,kBAAkB,CAAC,CA6L7B;AAMD,eAAO,MAAM,WAAW,8BAA8B,CAAC;AACvD,eAAO,MAAM,eAAe,QAAS,CAAC;AACtC,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,eAAO,MAAM,eAAe,IAAI,CAAC;AAEjC,MAAM,WAAW,mBAAmB;IAClC,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,OAAO,WAAW,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,GAAG,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,MAAM,EAAE;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9E;AAED,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC;CAC3D;AAED,qDAAqD;AACrD,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAgChF;AAWD,uCAAuC;AACvC,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA4CjG;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;CACpB;AAaD;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAuEpG;AAeD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,OAAO,CAAC;CACd;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,CAAC,CAQ1B;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB"}
|