@sparkleideas/security 3.0.0-alpha.22 → 3.0.0-alpha.49

package/dist/credential-generator.d.ts

@@ -0,0 +1,176 @@
+/**
+ * Credential Generator - CVE-3 Remediation
+ *
+ * Fixes hardcoded default credentials by providing secure random
+ * credential generation for installation and runtime.
+ *
+ * Security Properties:
+ * - Uses crypto.randomBytes for cryptographically secure randomness
+ * - Configurable entropy levels
+ * - No hardcoded defaults stored in code
+ * - Secure credential storage recommendations
+ *
+ * @module v3/security/credential-generator
+ */
+export interface CredentialConfig {
+    /**
+     * Length of generated passwords.
+     * Default: 32 characters
+     */
+    passwordLength?: number;
+    /**
+     * Length of generated API keys.
+     * Default: 48 characters
+     */
+    apiKeyLength?: number;
+    /**
+     * Length of generated secrets (JWT, session, etc.).
+     * Default: 64 characters
+     */
+    secretLength?: number;
+    /**
+     * Character set for password generation.
+     * Default: alphanumeric + special
+     */
+    passwordCharset?: string;
+    /**
+     * Character set for API key generation.
+     * Default: alphanumeric only (URL-safe)
+     */
+    apiKeyCharset?: string;
+}
+export interface GeneratedCredentials {
+    adminPassword: string;
+    servicePassword: string;
+    jwtSecret: string;
+    sessionSecret: string;
+    encryptionKey: string;
+    generatedAt: Date;
+    expiresAt?: Date;
+}
+export interface ApiKeyCredential {
+    key: string;
+    prefix: string;
+    keyId: string;
+    createdAt: Date;
+}
+export declare class CredentialGeneratorError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+/**
+ * Secure credential generator.
+ *
+ * This class provides cryptographically secure credential generation
+ * to replace hardcoded default credentials.
+ *
+ * @example
+ * ```typescript
+ * const generator = new CredentialGenerator();
+ * const credentials = generator.generateInstallationCredentials();
+ * // Store credentials securely (environment variables, secrets manager)
+ * ```
+ */
+export declare class CredentialGenerator {
+    private readonly config;
+    constructor(config?: CredentialConfig);
+    /**
+     * Validates configuration parameters.
+     */
+    private validateConfig;
+    /**
+     * Generates a cryptographically secure random string using rejection sampling
+     * to eliminate modulo bias.
+     *
+     * @param length - Length of the string to generate
+     * @param charset - Character set to use
+     * @returns Random string
+     */
+    private generateSecureString;
+    /**
+     * Generates a secure random password.
+     *
+     * @param length - Optional custom length (default from config)
+     * @returns Secure random password
+     */
+    generatePassword(length?: number): string;
+    /**
+     * Checks if password has required character types.
+     */
+    private hasRequiredCharacterTypes;
+    /**
+     * Generates a secure API key.
+     *
+     * @param prefix - Optional prefix for the key (e.g., 'cf_')
+     * @returns API key credential with metadata
+     */
+    generateApiKey(prefix?: string): ApiKeyCredential;
+    /**
+     * Generates a secure secret for JWT, sessions, etc.
+     *
+     * @param length - Optional custom length (default from config)
+     * @returns Hex-encoded secret
+     */
+    generateSecret(length?: number): string;
+    /**
+     * Generates an encryption key suitable for AES-256.
+     *
+     * @returns 32-byte key encoded as hex (64 characters)
+     */
+    generateEncryptionKey(): string;
+    /**
+     * Generates a complete set of installation credentials.
+     *
+     * These should be stored securely (environment variables,
+     * secrets manager, etc.) and NEVER committed to version control.
+     *
+     * @param expirationDays - Optional expiration period in days
+     * @returns Complete credential set
+     */
+    generateInstallationCredentials(expirationDays?: number): GeneratedCredentials;
+    /**
+     * Generates a secure session token.
+     *
+     * @returns URL-safe session token
+     */
+    generateSessionToken(): string;
+    /**
+     * Generates a secure CSRF token.
+     *
+     * @returns CSRF token
+     */
+    generateCsrfToken(): string;
+    /**
+     * Generates a secure nonce for one-time use.
+     *
+     * @returns Unique nonce value
+     */
+    generateNonce(): string;
+    /**
+     * Creates a setup script output for secure credential deployment.
+     *
+     * @param credentials - Generated credentials
+     * @returns Environment variable export script
+     */
+    createEnvScript(credentials: GeneratedCredentials): string;
+    /**
+     * Creates a JSON configuration output for secure credential deployment.
+     *
+     * @param credentials - Generated credentials
+     * @returns JSON configuration (for secrets manager import)
+     */
+    createJsonConfig(credentials: GeneratedCredentials): string;
+}
+/**
+ * Factory function to create a production credential generator.
+ *
+ * @returns Configured CredentialGenerator instance
+ */
+export declare function createCredentialGenerator(): CredentialGenerator;
+/**
+ * Quick credential generation for CLI usage.
+ *
+ * @returns Generated installation credentials
+ */
+export declare function generateCredentials(): GeneratedCredentials;
+//# sourceMappingURL=credential-generator.d.ts.map

package/dist/credential-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-generator.d.ts","sourceRoot":"","sources":["../src/credential-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,IAAI,CAAC;IAClB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,qBAAa,wBAAyB,SAAQ,KAAK;aAG/B,IAAI,EAAE,MAAM;gBAD5B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM;CAK/B;AAgBD;;;;;;;;;;;;GAYG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;gBAExC,MAAM,GAAE,gBAAqB;IAazC;;OAEG;IACH,OAAO,CAAC,cAAc;IAuBtB;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IA6B5B;;;;;OAKG;IACH,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM;IAezC;;OAEG;IACH,OAAO,CAAC,yBAAyB;IASjC;;;;;OAKG;IACH,cAAc,CAAC,MAAM,SAAQ,GAAG,gBAAgB;IAiBhD;;;;;OAKG;IACH,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM;IAMvC;;;;OAIG;IACH,qBAAqB,IAAI,MAAM;IAI/B;;;;;;;;OAQG;IACH,+BAA+B,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,oBAAoB;IAiB9E;;;;OAIG;IACH,oBAAoB,IAAI,MAAM;IAI9B;;;;OAIG;IACH,iBAAiB,IAAI,MAAM;IAI3B;;;;OAIG;IACH,aAAa,IAAI,MAAM;IAIvB;;;;;OAKG;IACH,eAAe,CAAC,WAAW,EAAE,oBAAoB,GAAG,MAAM;IAa1D;;;;;OAKG;IACH,gBAAgB,CAAC,WAAW,EAAE,oBAAoB,GAAG,MAAM;CAW5D;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,mBAAmB,CAE/D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,oBAAoB,CAG1D"}

package/dist/credential-generator.js

@@ -0,0 +1,272 @@
+/**
+ * Credential Generator - CVE-3 Remediation
+ *
+ * Fixes hardcoded default credentials by providing secure random
+ * credential generation for installation and runtime.
+ *
+ * Security Properties:
+ * - Uses crypto.randomBytes for cryptographically secure randomness
+ * - Configurable entropy levels
+ * - No hardcoded defaults stored in code
+ * - Secure credential storage recommendations
+ *
+ * @module v3/security/credential-generator
+ */
+import { randomBytes, randomUUID } from 'crypto';
+export class CredentialGeneratorError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'CredentialGeneratorError';
+    }
+}
+/**
+ * Character sets for credential generation
+ */
+const CHARSETS = {
+    UPPERCASE: 'ABCDEFGHIJKLMNOPQRSTUVWXYZ',
+    LOWERCASE: 'abcdefghijklmnopqrstuvwxyz',
+    DIGITS: '0123456789',
+    SPECIAL: '!@#$%^&*()_+-=[]{}|;:,.<>?',
+    // URL-safe characters for API keys
+    URL_SAFE: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_',
+    // Hex characters for secrets
+    HEX: '0123456789abcdef',
+};
+/**
+ * Secure credential generator.
+ *
+ * This class provides cryptographically secure credential generation
+ * to replace hardcoded default credentials.
+ *
+ * @example
+ * ```typescript
+ * const generator = new CredentialGenerator();
+ * const credentials = generator.generateInstallationCredentials();
+ * // Store credentials securely (environment variables, secrets manager)
+ * ```
+ */
+export class CredentialGenerator {
+    config;
+    constructor(config = {}) {
+        this.config = {
+            passwordLength: config.passwordLength ?? 32,
+            apiKeyLength: config.apiKeyLength ?? 48,
+            secretLength: config.secretLength ?? 64,
+            passwordCharset: config.passwordCharset ??
+                CHARSETS.UPPERCASE + CHARSETS.LOWERCASE + CHARSETS.DIGITS + CHARSETS.SPECIAL,
+            apiKeyCharset: config.apiKeyCharset ?? CHARSETS.URL_SAFE,
+        };
+        this.validateConfig();
+    }
+    /**
+     * Validates configuration parameters.
+     */
+    validateConfig() {
+        if (this.config.passwordLength < 16) {
+            throw new CredentialGeneratorError('Password length must be at least 16 characters', 'INVALID_PASSWORD_LENGTH');
+        }
+        if (this.config.apiKeyLength < 32) {
+            throw new CredentialGeneratorError('API key length must be at least 32 characters', 'INVALID_API_KEY_LENGTH');
+        }
+        if (this.config.secretLength < 32) {
+            throw new CredentialGeneratorError('Secret length must be at least 32 characters', 'INVALID_SECRET_LENGTH');
+        }
+    }
+    /**
+     * Generates a cryptographically secure random string using rejection sampling
+     * to eliminate modulo bias.
+     *
+     * @param length - Length of the string to generate
+     * @param charset - Character set to use
+     * @returns Random string
+     */
+    generateSecureString(length, charset) {
+        const charsetLength = charset.length;
+        const result = new Array(length);
+        // Calculate rejection threshold to eliminate modulo bias
+        // For a byte (0-255), we reject values >= (256 - (256 % charsetLength))
+        // This ensures uniform distribution over charset indices
+        const maxValidValue = 256 - (256 % charsetLength);
+        let i = 0;
+        while (i < length) {
+            // Generate more random bytes than needed to reduce iterations
+            const randomBuffer = randomBytes(Math.max(length - i, 16));
+            for (let j = 0; j < randomBuffer.length && i < length; j++) {
+                const randomValue = randomBuffer[j];
+                // Rejection sampling: only accept values below threshold
+                if (randomValue < maxValidValue) {
+                    result[i] = charset[randomValue % charsetLength];
+                    i++;
+                }
+                // Values >= maxValidValue are rejected to avoid bias
+            }
+        }
+        return result.join('');
+    }
+    /**
+     * Generates a secure random password.
+     *
+     * @param length - Optional custom length (default from config)
+     * @returns Secure random password
+     */
+    generatePassword(length) {
+        const len = length ?? this.config.passwordLength;
+        // Ensure password contains at least one of each required character type
+        const password = this.generateSecureString(len, this.config.passwordCharset);
+        // Validate the generated password meets requirements
+        if (!this.hasRequiredCharacterTypes(password)) {
+            // Regenerate if requirements not met (rare case)
+            return this.generatePassword(length);
+        }
+        return password;
+    }
+    /**
+     * Checks if password has required character types.
+     */
+    hasRequiredCharacterTypes(password) {
+        const hasUppercase = /[A-Z]/.test(password);
+        const hasLowercase = /[a-z]/.test(password);
+        const hasDigit = /\d/.test(password);
+        const hasSpecial = /[!@#$%^&*()_+\-=\[\]{}|;:,.<>?]/.test(password);
+        return hasUppercase && hasLowercase && hasDigit && hasSpecial;
+    }
+    /**
+     * Generates a secure API key.
+     *
+     * @param prefix - Optional prefix for the key (e.g., 'cf_')
+     * @returns API key credential with metadata
+     */
+    generateApiKey(prefix = 'cf_') {
+        const keyBody = this.generateSecureString(this.config.apiKeyLength - prefix.length, this.config.apiKeyCharset);
+        const key = `${prefix}${keyBody}`;
+        const keyId = randomUUID();
+        return {
+            key,
+            prefix,
+            keyId,
+            createdAt: new Date(),
+        };
+    }
+    /**
+     * Generates a secure secret for JWT, sessions, etc.
+     *
+     * @param length - Optional custom length (default from config)
+     * @returns Hex-encoded secret
+     */
+    generateSecret(length) {
+        const len = length ?? this.config.secretLength;
+        // Generate raw bytes and encode as hex for consistent storage
+        return randomBytes(Math.ceil(len / 2)).toString('hex').slice(0, len);
+    }
+    /**
+     * Generates an encryption key suitable for AES-256.
+     *
+     * @returns 32-byte key encoded as hex (64 characters)
+     */
+    generateEncryptionKey() {
+        return randomBytes(32).toString('hex');
+    }
+    /**
+     * Generates a complete set of installation credentials.
+     *
+     * These should be stored securely (environment variables,
+     * secrets manager, etc.) and NEVER committed to version control.
+     *
+     * @param expirationDays - Optional expiration period in days
+     * @returns Complete credential set
+     */
+    generateInstallationCredentials(expirationDays) {
+        const now = new Date();
+        const expiresAt = expirationDays
+            ? new Date(now.getTime() + expirationDays * 24 * 60 * 60 * 1000)
+            : undefined;
+        return {
+            adminPassword: this.generatePassword(),
+            servicePassword: this.generatePassword(),
+            jwtSecret: this.generateSecret(64),
+            sessionSecret: this.generateSecret(64),
+            encryptionKey: this.generateEncryptionKey(),
+            generatedAt: now,
+            expiresAt,
+        };
+    }
+    /**
+     * Generates a secure session token.
+     *
+     * @returns URL-safe session token
+     */
+    generateSessionToken() {
+        return this.generateSecureString(64, CHARSETS.URL_SAFE);
+    }
+    /**
+     * Generates a secure CSRF token.
+     *
+     * @returns CSRF token
+     */
+    generateCsrfToken() {
+        return randomBytes(32).toString('base64url');
+    }
+    /**
+     * Generates a secure nonce for one-time use.
+     *
+     * @returns Unique nonce value
+     */
+    generateNonce() {
+        return randomBytes(16).toString('hex');
+    }
+    /**
+     * Creates a setup script output for secure credential deployment.
+     *
+     * @param credentials - Generated credentials
+     * @returns Environment variable export script
+     */
+    createEnvScript(credentials) {
+        return `# Claude Flow V3 - Generated Credentials
+# Generated: ${credentials.generatedAt.toISOString()}
+# IMPORTANT: Store these securely and delete this file after use
+
+export CLAUDE_FLOW_ADMIN_PASSWORD="${credentials.adminPassword}"
+export CLAUDE_FLOW_SERVICE_PASSWORD="${credentials.servicePassword}"
+export CLAUDE_FLOW_JWT_SECRET="${credentials.jwtSecret}"
+export CLAUDE_FLOW_SESSION_SECRET="${credentials.sessionSecret}"
+export CLAUDE_FLOW_ENCRYPTION_KEY="${credentials.encryptionKey}"
+`;
+    }
+    /**
+     * Creates a JSON configuration output for secure credential deployment.
+     *
+     * @param credentials - Generated credentials
+     * @returns JSON configuration (for secrets manager import)
+     */
+    createJsonConfig(credentials) {
+        return JSON.stringify({
+            'claude-flow/admin-password': credentials.adminPassword,
+            'claude-flow/service-password': credentials.servicePassword,
+            'claude-flow/jwt-secret': credentials.jwtSecret,
+            'claude-flow/session-secret': credentials.sessionSecret,
+            'claude-flow/encryption-key': credentials.encryptionKey,
+            'claude-flow/generated-at': credentials.generatedAt.toISOString(),
+            'claude-flow/expires-at': credentials.expiresAt?.toISOString() ?? null,
+        }, null, 2);
+    }
+}
+/**
+ * Factory function to create a production credential generator.
+ *
+ * @returns Configured CredentialGenerator instance
+ */
+export function createCredentialGenerator() {
+    return new CredentialGenerator();
+}
+/**
+ * Quick credential generation for CLI usage.
+ *
+ * @returns Generated installation credentials
+ */
+export function generateCredentials() {
+    const generator = new CredentialGenerator();
+    return generator.generateInstallationCredentials();
+}
+//# sourceMappingURL=credential-generator.js.map

package/dist/credential-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-generator.js","sourceRoot":"","sources":["../src/credential-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAmDjD,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAG/B;IAFlB,YACE,OAAe,EACC,IAAY;QAE5B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,SAAI,GAAJ,IAAI,CAAQ;QAG5B,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,QAAQ,GAAG;IACf,SAAS,EAAE,4BAA4B;IACvC,SAAS,EAAE,4BAA4B;IACvC,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,4BAA4B;IACrC,mCAAmC;IACnC,QAAQ,EAAE,kEAAkE;IAC5E,6BAA6B;IAC7B,GAAG,EAAE,kBAAkB;CACf,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,mBAAmB;IACb,MAAM,CAA6B;IAEpD,YAAY,SAA2B,EAAE;QACvC,IAAI,CAAC,MAAM,GAAG;YACZ,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;YAC3C,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACrC,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,OAAO;YAC9E,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,QAAQ,CAAC,QAAQ;SACzD,CAAC;QAEF,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAED;;OAEG;IACK,cAAc;QACpB,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,GAAG,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,wBAAwB,CAChC,gDAAgD,EAChD,yBAAyB,CAC1B,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,GAAG,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,wBAAwB,CAChC,+CAA+C,EAC/C,wBAAwB,CACzB,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,GAAG,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,wBAAwB,CAChC,8CAA8C,EAC9C,uBAAuB,CACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,oBAAoB,CAAC,MAAc,EAAE,OAAe;QAC1D,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,yDAAyD;QACzD,wEAAwE;QACxE,yDAAyD;QACzD,MAAM,aAAa,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,aAAa,CAAC,CAAC;QAElD,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC;YAClB,8DAA8D;YAC9D,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAE3D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3D,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;gBAEpC,yDAAyD;gBACzD,IAAI,WAAW,GAAG,aAAa,EAAE,CAAC;oBAChC,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,GAAG,aAAa,CAAC,CAAC;oBACjD,CAAC,EAAE,CAAC;gBACN,CAAC;gBACD,qDAAqD;YACvD,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,MAAe;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QAEjD,wEAAwE;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAE7E,qDAAqD;QACrD,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,iDAAiD;YACjD,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,yBAAyB,CAAC,QAAgB;QAChD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEpE,OAAO,YAAY,IAAI,YAAY,IAAI,QAAQ,IAAI,UAAU,CAAC;IAChE,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,MAAM,GAAG,KAAK;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CACvC,IAAI,CAAC,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,EACxC,IAAI,CAAC,MAAM,CAAC,aAAa,CAC1B,CAAC;QAEF,MAAM,GAAG,GAAG,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAE3B,OAAO;YACL,GAAG;YACH,MAAM;YACN,KAAK;YACL,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,MAAe;QAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAC/C,8DAA8D;QAC9D,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACH,qBAAqB;QACnB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;;;OAQG;IACH,+BAA+B,CAAC,cAAuB;QACrD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,cAAc;YAC9B,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YAChE,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,gBAAgB,EAAE;YACtC,eAAe,EAAE,IAAI,CAAC,gBAAgB,EAAE;YACxC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAClC,aAAa,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACtC,aAAa,EAAE,IAAI,CAAC,qBAAqB,EAAE;YAC3C,WAAW,EAAE,GAAG;YAChB,SAAS;SACV,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,oBAAoB;QAClB,OAAO,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAED;;;;OAIG;IACH,iBAAiB;QACf,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,aAAa;QACX,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,WAAiC;QAC/C,OAAO;eACI,WAAW,CAAC,WAAW,CAAC,WAAW,EAAE;;;qCAGf,WAAW,CAAC,aAAa;uCACvB,WAAW,CAAC,eAAe;iCACjC,WAAW,CAAC,SAAS;qCACjB,WAAW,CAAC,aAAa;qCACzB,WAAW,CAAC,aAAa;CAC7D,CAAC;IACA,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,WAAiC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,4BAA4B,EAAE,WAAW,CAAC,aAAa;YACvD,8BAA8B,EAAE,WAAW,CAAC,eAAe;YAC3D,wBAAwB,EAAE,WAAW,CAAC,SAAS;YAC/C,4BAA4B,EAAE,WAAW,CAAC,aAAa;YACvD,4BAA4B,EAAE,WAAW,CAAC,aAAa;YACvD,0BAA0B,EAAE,WAAW,CAAC,WAAW,CAAC,WAAW,EAAE;YACjE,wBAAwB,EAAE,WAAW,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;SACvE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACd,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,IAAI,mBAAmB,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,SAAS,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAC5C,OAAO,SAAS,CAAC,+BAA+B,EAAE,CAAC;AACrD,CAAC"}

package/dist/domain/entities/security-context.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Security Context Entity - Domain Layer
+ *
+ * Represents security context for operations with validation and policy enforcement.
+ *
+ * @module v3/security/domain/entities
+ */
+/**
+ * Permission levels
+ */
+export type PermissionLevel = 'read' | 'write' | 'execute' | 'admin';
+/**
+ * Security context properties
+ */
+export interface SecurityContextProps {
+    id?: string;
+    principalId: string;
+    principalType: 'agent' | 'user' | 'system';
+    permissions: PermissionLevel[];
+    allowedPaths?: string[];
+    blockedPaths?: string[];
+    allowedCommands?: string[];
+    blockedCommands?: string[];
+    metadata?: Record<string, unknown>;
+    expiresAt?: Date;
+    createdAt?: Date;
+}
+/**
+ * Security Context - Entity
+ */
+export declare class SecurityContext {
+    private _id;
+    private _principalId;
+    private _principalType;
+    private _permissions;
+    private _allowedPaths;
+    private _blockedPaths;
+    private _allowedCommands;
+    private _blockedCommands;
+    private _metadata;
+    private _expiresAt?;
+    private _createdAt;
+    private constructor();
+    static create(props: SecurityContextProps): SecurityContext;
+    static fromPersistence(props: SecurityContextProps): SecurityContext;
+    get id(): string;
+    get principalId(): string;
+    get principalType(): string;
+    get permissions(): PermissionLevel[];
+    get allowedPaths(): string[];
+    get blockedPaths(): string[];
+    get allowedCommands(): string[];
+    get blockedCommands(): string[];
+    get metadata(): Record<string, unknown>;
+    get expiresAt(): Date | undefined;
+    get createdAt(): Date;
+    hasPermission(level: PermissionLevel): boolean;
+    isExpired(): boolean;
+    canAccessPath(path: string): boolean;
+    canExecuteCommand(command: string): boolean;
+    private matchGlob;
+    grantPermission(level: PermissionLevel): void;
+    revokePermission(level: PermissionLevel): void;
+    addAllowedPath(path: string): void;
+    addBlockedPath(path: string): void;
+    toPersistence(): Record<string, unknown>;
+}
+//# sourceMappingURL=security-context.d.ts.map

package/dist/domain/entities/security-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-context.d.ts","sourceRoot":"","sources":["../../../src/domain/entities/security-context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;AAErE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC3C,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,cAAc,CAA8B;IACpD,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,aAAa,CAAc;IACnC,OAAO,CAAC,aAAa,CAAc;IACnC,OAAO,CAAC,gBAAgB,CAAc;IACtC,OAAO,CAAC,gBAAgB,CAAc;IACtC,OAAO,CAAC,SAAS,CAA0B;IAC3C,OAAO,CAAC,UAAU,CAAC,CAAO;IAC1B,OAAO,CAAC,UAAU,CAAO;IAEzB,OAAO;IAcP,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,eAAe;IAI3D,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,eAAe;IAIpE,IAAI,EAAE,IAAI,MAAM,CAAqB;IACrC,IAAI,WAAW,IAAI,MAAM,CAA8B;IACvD,IAAI,aAAa,IAAI,MAAM,CAAgC;IAC3D,IAAI,WAAW,IAAI,eAAe,EAAE,CAA0C;IAC9E,IAAI,YAAY,IAAI,MAAM,EAAE,CAA2C;IACvE,IAAI,YAAY,IAAI,MAAM,EAAE,CAA2C;IACvE,IAAI,eAAe,IAAI,MAAM,EAAE,CAA8C;IAC7E,IAAI,eAAe,IAAI,MAAM,EAAE,CAA8C;IAC7E,IAAI,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAkC;IACzE,IAAI,SAAS,IAAI,IAAI,GAAG,SAAS,CAA4B;IAC7D,IAAI,SAAS,IAAI,IAAI,CAAsC;IAI3D,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO;IAI9C,SAAS,IAAI,OAAO;IAKpB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAuBpC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAiB3C,OAAO,CAAC,SAAS;IAQjB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAI7C,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAI9C,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIlC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIlC,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAezC"}

package/dist/domain/entities/security-context.js

@@ -0,0 +1,132 @@
+/**
+ * Security Context Entity - Domain Layer
+ *
+ * Represents security context for operations with validation and policy enforcement.
+ *
+ * @module v3/security/domain/entities
+ */
+import { randomUUID } from 'crypto';
+/**
+ * Security Context - Entity
+ */
+export class SecurityContext {
+    _id;
+    _principalId;
+    _principalType;
+    _permissions;
+    _allowedPaths;
+    _blockedPaths;
+    _allowedCommands;
+    _blockedCommands;
+    _metadata;
+    _expiresAt;
+    _createdAt;
+    constructor(props) {
+        this._id = props.id ?? randomUUID();
+        this._principalId = props.principalId;
+        this._principalType = props.principalType;
+        this._permissions = new Set(props.permissions);
+        this._allowedPaths = new Set(props.allowedPaths ?? []);
+        this._blockedPaths = new Set(props.blockedPaths ?? []);
+        this._allowedCommands = new Set(props.allowedCommands ?? []);
+        this._blockedCommands = new Set(props.blockedCommands ?? []);
+        this._metadata = props.metadata ?? {};
+        this._expiresAt = props.expiresAt;
+        this._createdAt = props.createdAt ?? new Date();
+    }
+    static create(props) {
+        return new SecurityContext(props);
+    }
+    static fromPersistence(props) {
+        return new SecurityContext(props);
+    }
+    get id() { return this._id; }
+    get principalId() { return this._principalId; }
+    get principalType() { return this._principalType; }
+    get permissions() { return Array.from(this._permissions); }
+    get allowedPaths() { return Array.from(this._allowedPaths); }
+    get blockedPaths() { return Array.from(this._blockedPaths); }
+    get allowedCommands() { return Array.from(this._allowedCommands); }
+    get blockedCommands() { return Array.from(this._blockedCommands); }
+    get metadata() { return { ...this._metadata }; }
+    get expiresAt() { return this._expiresAt; }
+    get createdAt() { return new Date(this._createdAt); }
+    // Business Logic
+    hasPermission(level) {
+        return this._permissions.has(level) || this._permissions.has('admin');
+    }
+    isExpired() {
+        if (!this._expiresAt)
+            return false;
+        return Date.now() > this._expiresAt.getTime();
+    }
+    canAccessPath(path) {
+        if (this.isExpired())
+            return false;
+        // Check blocked paths first
+        for (const blocked of this._blockedPaths) {
+            if (path.startsWith(blocked) || this.matchGlob(path, blocked)) {
+                return false;
+            }
+        }
+        // If no allowed paths specified, allow all non-blocked
+        if (this._allowedPaths.size === 0)
+            return true;
+        // Check allowed paths
+        for (const allowed of this._allowedPaths) {
+            if (path.startsWith(allowed) || this.matchGlob(path, allowed)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    canExecuteCommand(command) {
+        if (this.isExpired())
+            return false;
+        const cmdBase = command.split(' ')[0];
+        // Check blocked commands first
+        if (this._blockedCommands.has(cmdBase) || this._blockedCommands.has(command)) {
+            return false;
+        }
+        // If no allowed commands specified, allow all non-blocked
+        if (this._allowedCommands.size === 0)
+            return true;
+        // Check allowed commands
+        return this._allowedCommands.has(cmdBase) || this._allowedCommands.has(command);
+    }
+    matchGlob(path, pattern) {
+        const regex = pattern
+            .replace(/\*\*/g, '.*')
+            .replace(/\*/g, '[^/]*')
+            .replace(/\?/g, '.');
+        return new RegExp(`^${regex}$`).test(path);
+    }
+    grantPermission(level) {
+        this._permissions.add(level);
+    }
+    revokePermission(level) {
+        this._permissions.delete(level);
+    }
+    addAllowedPath(path) {
+        this._allowedPaths.add(path);
+    }
+    addBlockedPath(path) {
+        this._blockedPaths.add(path);
+    }
+    toPersistence() {
+        return {
+            id: this._id,
+            principalId: this._principalId,
+            principalType: this._principalType,
+            permissions: Array.from(this._permissions),
+            allowedPaths: Array.from(this._allowedPaths),
+            blockedPaths: Array.from(this._blockedPaths),
+            allowedCommands: Array.from(this._allowedCommands),
+            blockedCommands: Array.from(this._blockedCommands),
+            metadata: this._metadata,
+            expiresAt: this._expiresAt?.toISOString(),
+            createdAt: this._createdAt.toISOString(),
+        };
+    }
+}
+//# sourceMappingURL=security-context.js.map

package/dist/domain/entities/security-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-context.js","sourceRoot":"","sources":["../../../src/domain/entities/security-context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAwBpC;;GAEG;AACH,MAAM,OAAO,eAAe;IAClB,GAAG,CAAS;IACZ,YAAY,CAAS;IACrB,cAAc,CAA8B;IAC5C,YAAY,CAAuB;IACnC,aAAa,CAAc;IAC3B,aAAa,CAAc;IAC3B,gBAAgB,CAAc;IAC9B,gBAAgB,CAAc;IAC9B,SAAS,CAA0B;IACnC,UAAU,CAAQ;IAClB,UAAU,CAAO;IAEzB,YAAoB,KAA2B;QAC7C,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,aAAa,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,gBAAgB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,gBAAgB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,KAA2B;QACvC,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,eAAe,CAAC,KAA2B;QAChD,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,EAAE,KAAa,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,IAAI,WAAW,KAAa,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IACvD,IAAI,aAAa,KAAa,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAC3D,IAAI,WAAW,KAAwB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC9E,IAAI,YAAY,KAAe,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,YAAY,KAAe,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,eAAe,KAAe,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,eAAe,KAAe,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,QAAQ,KAA8B,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACzE,IAAI,SAAS,KAAuB,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7D,IAAI,SAAS,KAAW,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAE3D,iBAAiB;IAEjB,aAAa,CAAC,KAAsB;QAClC,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxE,CAAC;IAED,SAAS;QACP,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QACnC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IAChD,CAAC;IAED,aAAa,CAAC,IAAY;QACxB,IAAI,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO,KAAK,CAAC;QAEnC,4BAA4B;QAC5B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC9D,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,uDAAuD;QACvD,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAE/C,sBAAsB;QACtB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC9D,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iBAAiB,CAAC,OAAe;QAC/B,IAAI,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO,KAAK,CAAC;QAEnC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtC,+BAA+B;QAC/B,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,0DAA0D;QAC1D,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAElD,yBAAyB;QACzB,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClF,CAAC;IAEO,SAAS,CAAC,IAAY,EAAE,OAAe;QAC7C,MAAM,KAAK,GAAG,OAAO;aAClB,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC;aACtB,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;aACvB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACvB,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,eAAe,CAAC,KAAsB;QACpC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,gBAAgB,CAAC,KAAsB;QACrC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,cAAc,CAAC,IAAY;QACzB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,cAAc,CAAC,IAAY;QACzB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,aAAa;QACX,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,GAAG;YACZ,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,aAAa,EAAE,IAAI,CAAC,cAAc;YAClC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;YAC1C,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5C,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5C,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAClD,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAClD,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE;YACzC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;SACzC,CAAC;IACJ,CAAC;CACF"}