@terminals-tech/agent-zero 1.0.0

package/dist/security/vault.js

@@ -0,0 +1,522 @@
+import { randomBytes, pbkdf2, createCipheriv, createDecipheriv, createHash } from 'crypto';
+import { readFile, writeFile, unlink, readdir, mkdir, rmdir, stat, rm } from 'fs/promises';
+import { hostname, userInfo, homedir } from 'os';
+import { join } from 'path';
+import { z } from 'zod';
+// ============================================================================
+// TYPES & SCHEMAS
+// ============================================================================
+const VaultEntrySchema = z.object({
+    salt: z.string(),
+    iv: z.string(),
+    authTag: z.string(),
+    ciphertext: z.string(),
+});
+const DeviceSlotSchema = z.object({
+    salt: z.string(),
+    iv: z.string(),
+    authTag: z.string(),
+    ciphertext: z.string(),
+    addedAt: z.string(),
+    label: z.string().optional(),
+});
+const VaultFileV2Schema = z.object({
+    version: z.literal(2),
+    deviceSlots: z.array(DeviceSlotSchema).min(1),
+    entries: z.record(z.string(), VaultEntrySchema),
+});
+const VaultFileV1Schema = z.object({
+    masterSalt: z.string().optional(),
+    entries: z.record(z.string(), VaultEntrySchema),
+});
+// ============================================================================
+// CONSTANTS
+// ============================================================================
+function getVaultDir() {
+    return process.env['VAULT_DIR'] ?? join(homedir(), '.agent-zero');
+}
+function getVaultPath() {
+    return join(getVaultDir(), 'vault.enc');
+}
+function getLockPath() {
+    return join(getVaultDir(), 'vault.lock');
+}
+const PBKDF2_ITERATIONS = 100_000;
+const KEY_LENGTH = 32; // 256 bits
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12; // GCM recommended IV size
+const SALT_LENGTH = 32;
+// ============================================================================
+// VAULT
+// ============================================================================
+export class Vault {
+    masterKey;
+    passphrase;
+    deviceSlots;
+    data = {};
+    locked = false;
+    version = 2;
+    // v1 compat: masterSalt used when persisting in v1 mode (before migration)
+    masterSalt;
+    constructor(masterKey, passphrase, deviceSlots, masterSalt) {
+        this.masterKey = masterKey;
+        this.passphrase = passphrase;
+        this.deviceSlots = deviceSlots;
+        this.masterSalt = masterSalt;
+    }
+    // ==========================================================================
+    // FINGERPRINT
+    // ==========================================================================
+    /**
+     * Native machine fingerprint (ignores VAULT_MACHINE_FINGERPRINT override).
+     * Used by addDevice() to register the actual current machine.
+     */
+    static getNativeFingerprint() {
+        const host = hostname();
+        const user = userInfo().username;
+        const home = homedir();
+        return createHash('sha256').update(`${host}:${user}:${home}`).digest('hex');
+    }
+    /**
+     * Auth fingerprint — respects VAULT_MACHINE_FINGERPRINT override.
+     * Used for vault open/key derivation.
+     */
+    static getAuthFingerprint() {
+        return process.env['VAULT_MACHINE_FINGERPRINT'] ?? Vault.getNativeFingerprint();
+    }
+    // ==========================================================================
+    // KEY DERIVATION
+    // ==========================================================================
+    static async deriveDeviceKey(passphrase, fingerprint, salt) {
+        const combinedSecret = `${fingerprint}:${passphrase}`;
+        return new Promise((resolve, reject) => {
+            pbkdf2(combinedSecret, salt, PBKDF2_ITERATIONS, KEY_LENGTH, 'sha512', (err, key) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(key);
+            });
+        });
+    }
+    /** v1 compat: derive key using auth fingerprint (old behavior). */
+    static async deriveKeyV1(passphrase, salt) {
+        return Vault.deriveDeviceKey(passphrase, Vault.getAuthFingerprint(), salt);
+    }
+    // ==========================================================================
+    // MASTER KEY ENCRYPTION (for device slots)
+    // ==========================================================================
+    static encryptMasterKey(deviceKey, masterKey) {
+        const iv = randomBytes(IV_LENGTH);
+        const cipher = createCipheriv(ALGORITHM, deviceKey, iv);
+        const ciphertext = Buffer.concat([cipher.update(masterKey), cipher.final()]);
+        const authTag = cipher.getAuthTag();
+        return {
+            iv: iv.toString('hex'),
+            authTag: authTag.toString('hex'),
+            ciphertext: ciphertext.toString('hex'),
+        };
+    }
+    static decryptMasterKey(deviceKey, slot) {
+        const iv = Buffer.from(slot.iv, 'hex');
+        const authTag = Buffer.from(slot.authTag, 'hex');
+        const ciphertext = Buffer.from(slot.ciphertext, 'hex');
+        const decipher = createDecipheriv(ALGORITHM, deviceKey, iv);
+        decipher.setAuthTag(authTag);
+        return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    }
+    // ==========================================================================
+    // FACTORY: create / open
+    // ==========================================================================
+    static async create(passphrase) {
+        await Vault.ensureVaultDirStatic();
+        let raw;
+        try {
+            const content = await readFile(getVaultPath(), 'utf-8');
+            raw = JSON.parse(content);
+        }
+        catch {
+            raw = null;
+        }
+        // No existing vault → create fresh v2
+        if (!raw) {
+            return Vault.createFreshV2(passphrase);
+        }
+        // Try v2 format first
+        const v2 = VaultFileV2Schema.safeParse(raw);
+        if (v2.success) {
+            return Vault.openV2(passphrase, v2.data);
+        }
+        // v1 format (with or without masterSalt wrapper)
+        return Vault.openV1(passphrase, raw);
+    }
+    static async createFreshV2(passphrase) {
+        const masterKey = randomBytes(KEY_LENGTH);
+        const fingerprint = Vault.getAuthFingerprint();
+        const slotSalt = randomBytes(SALT_LENGTH);
+        const deviceKey = await Vault.deriveDeviceKey(passphrase, fingerprint, slotSalt);
+        const encrypted = Vault.encryptMasterKey(deviceKey, masterKey);
+        const slot = {
+            salt: slotSalt.toString('hex'),
+            ...encrypted,
+            addedAt: new Date().toISOString(),
+            label: 'initial',
+        };
+        const vault = new Vault(masterKey, passphrase, [slot]);
+        vault.version = 2;
+        vault.data = {};
+        await vault.persist();
+        return vault;
+    }
+    static async openV2(passphrase, file) {
+        const fingerprint = Vault.getAuthFingerprint();
+        for (const slot of file.deviceSlots) {
+            try {
+                const slotSalt = Buffer.from(slot.salt, 'hex');
+                const deviceKey = await Vault.deriveDeviceKey(passphrase, fingerprint, slotSalt);
+                const masterKey = Vault.decryptMasterKey(deviceKey, slot);
+                const vault = new Vault(masterKey, passphrase, [...file.deviceSlots]);
+                vault.version = 2;
+                vault.data = file.entries;
+                return vault;
+            }
+            catch {
+                continue;
+            }
+        }
+        throw new Error('Vault: no device slot matches current fingerprint. '
+            + 'Set VAULT_MACHINE_FINGERPRINT=<old-fingerprint> to recover, then run: addDevice()');
+    }
+    static async openV1(passphrase, raw) {
+        // Parse v1 — two sub-formats: { masterSalt, entries } or flat { key: entry }
+        let masterSaltHex;
+        let entries;
+        const v1 = VaultFileV1Schema.safeParse(raw);
+        if (v1.success) {
+            masterSaltHex = v1.data.masterSalt;
+            entries = v1.data.entries;
+        }
+        else {
+            // Legacy flat format
+            const flat = z.record(z.string(), VaultEntrySchema).safeParse(raw);
+            entries = flat.success ? flat.data : {};
+        }
+        const salt = masterSaltHex
+            ? Buffer.from(masterSaltHex, 'hex')
+            : randomBytes(SALT_LENGTH);
+        const saltHex = salt.toString('hex');
+        const oldKey = await Vault.deriveKeyV1(passphrase, salt);
+        // Test if we can decrypt any entry
+        let canDecrypt = Object.keys(entries).length === 0; // empty = trivially migratable
+        for (const entry of Object.values(entries)) {
+            try {
+                const iv = Buffer.from(entry.iv, 'hex');
+                const authTag = Buffer.from(entry.authTag, 'hex');
+                const ct = Buffer.from(entry.ciphertext, 'hex');
+                const decipher = createDecipheriv(ALGORITHM, oldKey, iv);
+                decipher.setAuthTag(authTag);
+                decipher.update(ct);
+                decipher.final();
+                canDecrypt = true;
+                break;
+            }
+            catch {
+                continue;
+            }
+        }
+        if (canDecrypt) {
+            // Auto-migrate to v2
+            return Vault.migrateV1ToV2(passphrase, oldKey, entries);
+        }
+        // Can't decrypt — stay v1, warn. Existing "entries return null" behavior preserved.
+        console.warn('Vault: fingerprint mismatch. Entries from previous device will return null.');
+        console.warn('To migrate: set VAULT_MACHINE_FINGERPRINT=<old-fingerprint>, reopen, then call addDevice().');
+        const vault = new Vault(oldKey, passphrase, [], saltHex);
+        vault.version = 1;
+        vault.data = entries;
+        return vault;
+    }
+    static async migrateV1ToV2(passphrase, oldKey, entries) {
+        const newMasterKey = randomBytes(KEY_LENGTH);
+        const fingerprint = Vault.getAuthFingerprint();
+        // Re-encrypt all entries with new random master key
+        const newEntries = {};
+        let migrated = 0;
+        let dropped = 0;
+        for (const [key, entry] of Object.entries(entries)) {
+            try {
+                // Decrypt with old key
+                const iv = Buffer.from(entry.iv, 'hex');
+                const authTag = Buffer.from(entry.authTag, 'hex');
+                const ct = Buffer.from(entry.ciphertext, 'hex');
+                const decipher = createDecipheriv(ALGORITHM, oldKey, iv);
+                decipher.setAuthTag(authTag);
+                const plaintext = Buffer.concat([decipher.update(ct), decipher.final()]);
+                // Re-encrypt with new master key
+                const newIv = randomBytes(IV_LENGTH);
+                const newSalt = randomBytes(SALT_LENGTH);
+                const cipher = createCipheriv(ALGORITHM, newMasterKey, newIv);
+                const newCt = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+                const newAuthTag = cipher.getAuthTag();
+                newEntries[key] = {
+                    salt: newSalt.toString('hex'),
+                    iv: newIv.toString('hex'),
+                    authTag: newAuthTag.toString('hex'),
+                    ciphertext: newCt.toString('hex'),
+                };
+                migrated++;
+            }
+            catch {
+                // Entry can't be decrypted (stale from old passphrase) — drop
+                dropped++;
+            }
+        }
+        // Create device slot for current auth fingerprint
+        const slotSalt = randomBytes(SALT_LENGTH);
+        const deviceKey = await Vault.deriveDeviceKey(passphrase, fingerprint, slotSalt);
+        const encrypted = Vault.encryptMasterKey(deviceKey, newMasterKey);
+        const slot = {
+            salt: slotSalt.toString('hex'),
+            ...encrypted,
+            addedAt: new Date().toISOString(),
+            label: 'migrated-from-v1',
+        };
+        if (migrated > 0 || dropped > 0) {
+            console.log(`Vault migrated v1→v2: ${migrated} entries migrated, ${dropped} stale entries dropped`);
+        }
+        const vault = new Vault(newMasterKey, passphrase, [slot]);
+        vault.version = 2;
+        vault.data = newEntries;
+        await vault.persist();
+        return vault;
+    }
+    // ==========================================================================
+    // DEVICE MANAGEMENT
+    // ==========================================================================
+    /**
+     * Register the current machine's native fingerprint as a new device slot.
+     * Always uses the NATIVE fingerprint (ignores VAULT_MACHINE_FINGERPRINT override),
+     * so you can open with an override and add-device to register the real machine.
+     */
+    async addDevice(label) {
+        if (this.version !== 2) {
+            throw new Error('Cannot add device to v1 vault. Open with correct fingerprint first to trigger migration.');
+        }
+        const fingerprint = Vault.getNativeFingerprint();
+        const slotSalt = randomBytes(SALT_LENGTH);
+        const deviceKey = await Vault.deriveDeviceKey(this.passphrase, fingerprint, slotSalt);
+        const encrypted = Vault.encryptMasterKey(deviceKey, this.masterKey);
+        const slot = {
+            salt: slotSalt.toString('hex'),
+            ...encrypted,
+            addedAt: new Date().toISOString(),
+            ...(label ? { label } : {}),
+        };
+        this.deviceSlots.push(slot);
+        await this.persist();
+        return fingerprint.slice(0, 16); // truncated for display
+    }
+    /**
+     * List registered device slots (no secrets exposed).
+     */
+    listDevices() {
+        return this.deviceSlots.map((slot, i) => ({
+            index: i,
+            addedAt: slot.addedAt,
+            label: slot.label,
+        }));
+    }
+    getVersion() {
+        return this.version;
+    }
+    // ==========================================================================
+    // LOCKING
+    // ==========================================================================
+    static async ensureVaultDirStatic() {
+        try {
+            await mkdir(getVaultDir(), { recursive: true });
+        }
+        catch (err) {
+            if (err.code !== 'EEXIST')
+                throw err;
+        }
+    }
+    async acquireLock() {
+        const maxRetries = 50;
+        const retryDelay = 100;
+        for (let i = 0; i < maxRetries; i++) {
+            try {
+                await mkdir(getLockPath());
+                this.locked = true;
+                return;
+            }
+            catch (err) {
+                if (err.code === 'EEXIST') {
+                    // Check for stale lock (older than 30 seconds)
+                    const lockStat = await stat(getLockPath()).catch(() => null);
+                    if (lockStat && Date.now() - lockStat.mtimeMs > 30_000) {
+                        await rm(getLockPath(), { recursive: true }).catch(() => { });
+                        try {
+                            await mkdir(getLockPath());
+                            this.locked = true;
+                            return;
+                        }
+                        catch {
+                            // continue retry loop
+                        }
+                    }
+                    await new Promise(resolve => setTimeout(resolve, retryDelay));
+                }
+                else {
+                    throw err;
+                }
+            }
+        }
+        throw new Error('Failed to acquire vault lock after retries');
+    }
+    async releaseLock() {
+        if (!this.locked)
+            return;
+        try {
+            await rmdir(getLockPath());
+            this.locked = false;
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                throw err;
+        }
+    }
+    // ==========================================================================
+    // ENCRYPT / DECRYPT (entry-level, using master key)
+    // ==========================================================================
+    encrypt(plaintext) {
+        const salt = randomBytes(SALT_LENGTH);
+        const iv = randomBytes(IV_LENGTH);
+        const cipher = createCipheriv(ALGORITHM, this.masterKey, iv);
+        const ciphertext = Buffer.concat([
+            cipher.update(plaintext, 'utf-8'),
+            cipher.final(),
+        ]);
+        const authTag = cipher.getAuthTag();
+        return {
+            salt: salt.toString('hex'),
+            iv: iv.toString('hex'),
+            authTag: authTag.toString('hex'),
+            ciphertext: ciphertext.toString('hex'),
+        };
+    }
+    decrypt(entry) {
+        const iv = Buffer.from(entry.iv, 'hex');
+        const authTag = Buffer.from(entry.authTag, 'hex');
+        const ciphertext = Buffer.from(entry.ciphertext, 'hex');
+        const decipher = createDecipheriv(ALGORITHM, this.masterKey, iv);
+        decipher.setAuthTag(authTag);
+        const plaintext = Buffer.concat([
+            decipher.update(ciphertext),
+            decipher.final(),
+        ]);
+        return plaintext.toString('utf-8');
+    }
+    // ==========================================================================
+    // PUBLIC API
+    // ==========================================================================
+    async store(key, value) {
+        const entry = this.encrypt(value);
+        this.data[key] = entry;
+        await this.persist();
+    }
+    async retrieve(key) {
+        const entry = this.data[key];
+        if (!entry)
+            return null;
+        try {
+            return this.decrypt(entry);
+        }
+        catch {
+            // Silently return null for decrypt failures (expected for mixed-passphrase entries)
+            return null;
+        }
+    }
+    async rotate(key, newValue) {
+        if (!this.data[key]) {
+            throw new Error(`Key "${key}" does not exist`);
+        }
+        await this.store(key, newValue);
+    }
+    async delete(key) {
+        delete this.data[key];
+        await this.persist();
+    }
+    async list() {
+        return Object.keys(this.data);
+    }
+    async migrateFromPlaintext(dir) {
+        let count = 0;
+        try {
+            const files = await readdir(dir);
+            for (const file of files) {
+                if (file.startsWith('.'))
+                    continue;
+                const filePath = join(dir, file);
+                try {
+                    const content = await readFile(filePath, 'utf-8');
+                    await this.store(file, content.trim());
+                    count++;
+                }
+                catch (err) {
+                    console.warn(`Failed to migrate ${file}:`, err);
+                }
+            }
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                throw err;
+        }
+        return count;
+    }
+    async destroy() {
+        await this.acquireLock();
+        try {
+            this.data = {};
+            this.deviceSlots = [];
+            this.masterKey.fill(0);
+            try {
+                await unlink(getVaultPath());
+            }
+            catch (err) {
+                if (err.code !== 'ENOENT')
+                    throw err;
+            }
+        }
+        finally {
+            await this.releaseLock();
+        }
+    }
+    // ==========================================================================
+    // PERSISTENCE
+    // ==========================================================================
+    async persist() {
+        await this.acquireLock();
+        try {
+            let file;
+            if (this.version === 2) {
+                file = { version: 2, deviceSlots: this.deviceSlots, entries: this.data };
+            }
+            else {
+                // v1 fallback (pre-migration)
+                file = { masterSalt: this.masterSalt, entries: this.data };
+            }
+            const serialized = JSON.stringify(file, null, 2);
+            await writeFile(getVaultPath(), serialized, { mode: 0o600 });
+        }
+        finally {
+            await this.releaseLock();
+        }
+    }
+}
+// ============================================================================
+// FACTORY
+// ============================================================================
+export async function createVault(passphrase) {
+    return Vault.create(passphrase);
+}
+//# sourceMappingURL=vault.js.map

package/dist/security/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/security/vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC;CAChD,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC;CAChD,CAAC,CAAC;AAMH,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,SAAS,WAAW;IAClB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACpE,CAAC;AACD,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC,CAAC;AAC1C,CAAC;AACD,SAAS,WAAW;IAClB,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,YAAY,CAAC,CAAC;AAC3C,CAAC;AACD,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,WAAW;AAClC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,0BAA0B;AAChD,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,+EAA+E;AAC/E,QAAQ;AACR,+EAA+E;AAE/E,MAAM,OAAO,KAAK;IACR,SAAS,CAAS;IAClB,UAAU,CAAS;IACnB,WAAW,CAAe;IAC1B,IAAI,GAAc,EAAE,CAAC;IACrB,MAAM,GAAG,KAAK,CAAC;IACf,OAAO,GAAU,CAAC,CAAC;IAC3B,2EAA2E;IACnE,UAAU,CAAU;IAE5B,YAAoB,SAAiB,EAAE,UAAkB,EAAE,WAAyB,EAAE,UAAmB;QACvG,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,6EAA6E;IAC7E,cAAc;IACd,6EAA6E;IAE7E;;;OAGG;IACH,MAAM,CAAC,oBAAoB;QACzB,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,kBAAkB;QAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;IAClF,CAAC;IAED,6EAA6E;IAC7E,iBAAiB;IACjB,6EAA6E;IAErE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,WAAmB,EAAE,IAAY;QACxF,MAAM,cAAc,GAAG,GAAG,WAAW,IAAI,UAAU,EAAE,CAAC;QACtD,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,CAAC,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACjF,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,mEAAmE;IAC3D,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,UAAkB,EAAE,IAAY;QAC/D,OAAO,KAAK,CAAC,eAAe,CAAC,UAAU,EAAE,KAAK,CAAC,kBAAkB,EAAE,EAAE,IAAI,CAAC,CAAC;IAC7E,CAAC;IAED,6EAA6E;IAC7E,2CAA2C;IAC3C,6EAA6E;IAErE,MAAM,CAAC,gBAAgB,CAAC,SAAiB,EAAE,SAAiB;QAClE,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAChC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;SACvC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,gBAAgB,CAAC,SAAiB,EAAE,IAAgB;QACjE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5D,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,6EAA6E;IAC7E,yBAAyB;IACzB,6EAA6E;IAE7E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAkB;QACpC,MAAM,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAEnC,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC;YACxD,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,GAAG,IAAI,CAAC;QACb,CAAC;QAED,sCAAsC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QAED,sBAAsB;QACtB,MAAM,EAAE,GAAG,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAED,iDAAiD;QACjD,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,UAAkB;QACnD,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAE/D,MAAM,IAAI,GAAe;YACvB,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC9B,GAAG,SAAS;YACZ,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACjC,KAAK,EAAE,SAAS;SACjB,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;QAClB,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC;QAChB,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,IAAuC;QACrF,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAE/C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC/C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;gBACjF,MAAM,SAAS,GAAG,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;gBAE1D,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBACtE,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;gBAClB,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;gBAC1B,OAAO,KAAK,CAAC;YACf,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CACb,qDAAqD;cACnD,mFAAmF,CACtF,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,GAAY;QAC1D,6EAA6E;QAC7E,IAAI,aAAiC,CAAC;QACtC,IAAI,OAAkB,CAAC;QAEvB,MAAM,EAAE,GAAG,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YACf,aAAa,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;YACnC,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,qBAAqB;YACrB,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,GAAG,aAAa;YACxB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC;YACnC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAErC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAEzD,mCAAmC;QACnC,IAAI,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,+BAA+B;QACnF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAClD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;gBACzD,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACpB,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACjB,UAAU,GAAG,IAAI,CAAC;gBAClB,MAAM;YACR,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,qBAAqB;YACrB,OAAO,KAAK,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QAED,oFAAoF;QACpF,OAAO,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;QAC5F,OAAO,CAAC,IAAI,CAAC,6FAA6F,CAAC,CAAC;QAC5G,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QACzD,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;QAClB,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,UAAkB,EAAE,MAAc,EAAE,OAAkB;QACvF,MAAM,YAAY,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAE/C,oDAAoD;QACpD,MAAM,UAAU,GAAc,EAAE,CAAC;QACjC,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC;gBACH,uBAAuB;gBACvB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAClD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;gBACzD,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAEzE,iCAAiC;gBACjC,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;gBACrC,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;gBACzC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;gBAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACxE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBAEvC,UAAU,CAAC,GAAG,CAAC,GAAG;oBAChB,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAC7B,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;oBACzB,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;oBACnC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;iBAClC,CAAC;gBACF,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;gBAC9D,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAElE,MAAM,IAAI,GAAe;YACvB,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC9B,GAAG,SAAS;YACZ,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACjC,KAAK,EAAE,kBAAkB;SAC1B,CAAC;QAEF,IAAI,QAAQ,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,yBAAyB,QAAQ,sBAAsB,OAAO,wBAAwB,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;QAClB,KAAK,CAAC,IAAI,GAAG,UAAU,CAAC;QACxB,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6EAA6E;IAC7E,oBAAoB;IACpB,6EAA6E;IAE7E;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,KAAc;QAC5B,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;QAC9G,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACtF,MAAM,SAAS,GAAG,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEpE,MAAM,IAAI,GAAe;YACvB,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC9B,GAAG,SAAS;YACZ,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACjC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5B,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB;IAC3D,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACxC,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,6EAA6E;IAC7E,UAAU;IACV,6EAA6E;IAErE,MAAM,CAAC,KAAK,CAAC,oBAAoB;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QACvC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,MAAM,UAAU,GAAG,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,GAAG,CAAC;QAEvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACnB,OAAO;YACT,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,+CAA+C;oBAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;oBAC7D,IAAI,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC;wBACvD,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;wBAC7D,IAAI,CAAC;4BACH,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;4BAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;4BACnB,OAAO;wBACT,CAAC;wBAAC,MAAM,CAAC;4BACP,sBAAsB;wBACxB,CAAC;oBACH,CAAC;oBACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;gBAChE,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QACzB,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACtB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QACvC,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,oDAAoD;IACpD,6EAA6E;IAErE,OAAO,CAAC,SAAiB;QAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAE7D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC;YACjC,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC1B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAChC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;SACvC,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,KAAiB;QAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACjE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YAC3B,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,6EAA6E;IAC7E,aAAa;IACb,6EAA6E;IAE7E,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,KAAa;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,oFAAoF;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,QAAgB;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,kBAAkB,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,GAAW;QACpC,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;YAEjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAEnC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACjC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;oBAClD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;oBACvC,KAAK,EAAE,CAAC;gBACV,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,IAAI,CAAC,qBAAqB,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QACvC,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;YACf,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAEvB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC;YACvC,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,cAAc;IACd,6EAA6E;IAErE,KAAK,CAAC,OAAO;QACnB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,IAAa,CAAC;YAClB,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YAC3E,CAAC;iBAAM,CAAC;gBACN,8BAA8B;gBAC9B,IAAI,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7D,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACjD,MAAM,SAAS,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAkB;IAClD,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAClC,CAAC"}

package/dist/utils/persistentRateLimiter.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Persistent Rate Limiter
+ *
+ * Rate limiting with persistent storage via Vault.
+ * Survives process restarts and shares state across instances.
+ */
+import { Vault } from '../security/vault.js';
+/**
+ * Sliding window rate limiter with persistent storage.
+ * Stores request timestamps in vault and debounces writes for performance.
+ */
+export declare class PersistentSlidingWindowLimiter {
+    private timestamps;
+    private maxRequests;
+    private windowMs;
+    private vault;
+    private vaultKey;
+    private persistTimer;
+    private dirty;
+    constructor(vault: Vault, key: string, maxRequests: number, windowMs: number);
+    /**
+     * Load persisted state from vault.
+     * Must be called before using the limiter.
+     */
+    load(): Promise<void>;
+    /**
+     * Check if a request is allowed and record it.
+     * @returns true if request is allowed, false if rate limit exceeded
+     */
+    allow(): boolean;
+    /**
+     * Get remaining request quota.
+     */
+    remaining(): number;
+    /**
+     * Force persist current state to vault.
+     */
+    flush(): Promise<void>;
+    /**
+     * Clean up resources and persist final state.
+     */
+    destroy(): Promise<void>;
+}
+/**
+ * Cooldown-based rate limiter with persistent storage.
+ * Enforces minimum time between actions.
+ */
+export declare class PersistentCooldownLimiter {
+    private lastAction;
+    private cooldownMs;
+    private vault;
+    private vaultKey;
+    constructor(vault: Vault, key: string, cooldownMs: number);
+    /**
+     * Load persisted state from vault.
+     * Must be called before using the limiter.
+     */
+    load(): Promise<void>;
+    /**
+     * Check if an action is allowed and record it.
+     * @returns true if action is allowed, false if still in cooldown
+     */
+    allow(): Promise<boolean>;
+    /**
+     * Get remaining cooldown time in milliseconds.
+     */
+    remainingMs(): number;
+}
+//# sourceMappingURL=persistentRateLimiter.d.ts.map

package/dist/utils/persistentRateLimiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistentRateLimiter.d.ts","sourceRoot":"","sources":["../../src/utils/persistentRateLimiter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAM7C;;;GAGG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,KAAK,CAAS;gBAEV,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAO5E;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAY3B;;;OAGG;IACH,KAAK,IAAI,OAAO;IAahB;;OAEG;IACH,SAAS,IAAI,MAAM;IAMnB;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAS5B;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAO/B;AAED;;;GAGG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,QAAQ,CAAS;gBAEb,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;IAMzD;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ3B;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;IAW/B;;OAEG;IACH,WAAW,IAAI,MAAM;CAGtB"}