@vercel/cli-auth 0.3.13 → 0.3.14-snapshot-c4f338842961

package/hardware-key.ts

@@ -0,0 +1,227 @@
+// DPoP keys protected by this device's security chip: the Secure Enclave on a
+// Mac, the TPM on Windows and Linux. The DPoP key itself is a software key,
+// and the login saves it only sealed by a key that never leaves the chip, so
+// a copy of the login can't be unsealed, or sign, on any other device.
+//
+// Unsealing asks for nothing (no password, Touch ID, or PIN), so it doesn't
+// protect against code running as the user on this device: that code can
+// have the chip unseal the key, the same way the CLI does, and then use it
+// anywhere. Sealing protects a copied login, not a compromised device.
+//
+// Once unsealed, a key is kept in this process's memory for
+// `DPOP_KEY_CACHE_TTL_MS`, so a command uses the chip once, not for every
+// request (a deploy signs one for every file it uploads). Nothing unsealed
+// outlives the command.
+
+import {
+  createECDH,
+  createPrivateKey,
+  generateKeyPairSync,
+  type KeyObject,
+  randomUUID,
+  sign,
+} from 'node:crypto';
+import {
+  createSecureEnclaveKey,
+  unsealWithSecureEnclaveKey,
+} from './secure-enclave';
+import { createTpmKey, deleteTpmKey, unsealWithTpmKey } from './tpm';
+import { hasLinuxTpm, sealWithLinuxTpm, unsealWithLinuxTpm } from './linux-tpm';
+
+export { TpmAccessError } from './linux-tpm';
+export { SecureEnclaveLockedError } from './secure-enclave';
+
+/**
+ * How long an unsealed DPoP key is kept in memory, so the chip isn't used
+ * for every request. Fixed from when the key was unsealed, not extended by
+ * use, which only matters to long-running commands.
+ */
+export const DPOP_KEY_CACHE_TTL_MS = 30 * 60 * 1000;
+
+/**
+ * A DPoP key's private half (`d`), `sealed` by a key in this device's chip:
+ * a Secure Enclave key, in the wrapped form only this Mac's Secure Enclave
+ * can use, the name of a key in this PC's TPM, or, on Linux, the public area
+ * of a TPM sealed object whose private area is `sealed`.
+ */
+export type HardwareKeyHandle = (
+  | { secureEnclave: string }
+  | { tpm: string }
+  | { tpmPublic: string }
+) & {
+  sealed: string;
+};
+
+export type HardwareKey = HardwareKeyHandle & { x: string; y: string };
+
+/**
+ * Whether this device may have a security chip `createHardwareKey` can use:
+ * every Mac and Windows PC, and a Linux machine whose kernel exposes a TPM.
+ */
+export function hasSecurityChip(): boolean {
+  return (
+    process.platform === 'darwin' ||
+    process.platform === 'win32' ||
+    (process.platform === 'linux' && hasLinuxTpm())
+  );
+}
+
+/**
+ * Create a P-256 DPoP key sealed by this device's Secure Enclave (macOS) or
+ * TPM (Windows, Linux). Throws when there's no such chip, or it can't be
+ * used.
+ */
+export function createHardwareKey(): HardwareKey {
+  if (
+    process.platform !== 'darwin' &&
+    process.platform !== 'win32' &&
+    process.platform !== 'linux'
+  ) {
+    throw new Error(
+      `There's no supported security chip on ${process.platform}.`
+    );
+  }
+  const { privateKey } = generateKeyPairSync('ec', { namedCurve: 'P-256' });
+  const { x, y, d } = privateKey.export({ format: 'jwk' });
+  if (!x || !y || !d) {
+    throw new Error('Failed to export the DPoP key.');
+  }
+  const secret = Buffer.from(d, 'base64url');
+  try {
+    if (process.platform === 'darwin') {
+      const { wrapped, sealed } = createSecureEnclaveKey(secret);
+      return {
+        secureEnclave: wrapped.toString('base64url'),
+        sealed: sealed.toString('base64url'),
+        x,
+        y,
+      };
+    }
+    if (process.platform === 'linux') {
+      const sealed = sealWithLinuxTpm(secret);
+      return {
+        tpmPublic: sealed.public.toString('base64url'),
+        sealed: sealed.private.toString('base64url'),
+        x,
+        y,
+      };
+    }
+    const name = `vercel-cli-dpop-${randomUUID()}`;
+    const sealed = createTpmKey(name, secret);
+    return { tpm: name, sealed: sealed.toString('base64url'), x, y };
+  } finally {
+    secret.fill(0);
+  }
+}
+
+/**
+ * Sign `data` with ECDSA P-256 and SHA-256 using a hardware-sealed key,
+ * unsealing it with the chip unless it was unsealed in the last
+ * `DPOP_KEY_CACHE_TTL_MS`. Returns the signature as `r || s` (IEEE P1363), as
+ * JWS uses for ES256.
+ */
+export function signWithHardwareKey(
+  key: HardwareKey,
+  data: Uint8Array
+): Buffer {
+  return sign('sha256', data, {
+    key: unsealed(key),
+    dsaEncoding: 'ieee-p1363',
+  });
+}
+
+/**
+ * Delete a hardware key once nothing uses it, forgetting it if it's
+ * unsealed. A Secure Enclave key and a Linux sealed object are only what's
+ * in the login, so only a Windows TPM key is deleted from the chip.
+ */
+export function deleteHardwareKey(key: HardwareKeyHandle): void {
+  forget(cacheId(key));
+  if ('tpm' in key) {
+    deleteTpmKey(key.tpm);
+  }
+}
+
+// Keys this process unsealed, by `cacheId`.
+const unsealedKeys = new Map<
+  string,
+  { key: KeyObject; timer: ReturnType<typeof setTimeout> }
+>();
+
+function cacheId(key: HardwareKeyHandle): string {
+  if ('secureEnclave' in key) {
+    return `secureEnclave:${key.secureEnclave}:${key.sealed}`;
+  }
+  if ('tpmPublic' in key) {
+    return `tpmPublic:${key.tpmPublic}:${key.sealed}`;
+  }
+  return `tpm:${key.tpm}:${key.sealed}`;
+}
+
+function unsealed(key: HardwareKey): KeyObject {
+  const id = cacheId(key);
+  const cached = unsealedKeys.get(id);
+  if (cached) {
+    return cached.key;
+  }
+  const keyObject = unseal(key);
+  // Dropped when its time is up, even if the process is idle, so nothing
+  // holds it longer. The timer doesn't keep the process running.
+  const timer = setTimeout(() => forget(id), DPOP_KEY_CACHE_TTL_MS);
+  timer.unref?.();
+  unsealedKeys.set(id, { key: keyObject, timer });
+  return keyObject;
+}
+
+function forget(id: string): void {
+  const cached = unsealedKeys.get(id);
+  if (cached) {
+    clearTimeout(cached.timer);
+    unsealedKeys.delete(id);
+  }
+}
+
+function unseal(key: HardwareKey): KeyObject {
+  const sealed = Buffer.from(key.sealed, 'base64url');
+  let secret: Buffer;
+  if ('secureEnclave' in key) {
+    secret = unsealWithSecureEnclaveKey(
+      Buffer.from(key.secureEnclave, 'base64url'),
+      sealed
+    );
+  } else if ('tpmPublic' in key) {
+    secret = unsealWithLinuxTpm({
+      public: Buffer.from(key.tpmPublic, 'base64url'),
+      private: sealed,
+    });
+  } else {
+    secret = unsealWithTpmKey(key.tpm, sealed);
+  }
+  try {
+    // Not every Node version checks that `d` is the private half of `x` and
+    // `y` on import, so derive its public key and compare.
+    const ecdh = createECDH('prime256v1');
+    ecdh.setPrivateKey(
+      new Uint8Array(secret.buffer, secret.byteOffset, secret.length)
+    );
+    const point = ecdh.getPublicKey();
+    if (
+      point.subarray(1, 33).toString('base64url') !== key.x ||
+      point.subarray(33).toString('base64url') !== key.y
+    ) {
+      throw new Error("The unsealed DPoP key doesn't match its public key.");
+    }
+    return createPrivateKey({
+      key: {
+        kty: 'EC',
+        crv: 'P-256',
+        x: key.x,
+        y: key.y,
+        d: secret.toString('base64url'),
+      },
+      format: 'jwk',
+    });
+  } finally {
+    secret.fill(0);
+  }
+}

package/koffi.d.ts

@@ -0,0 +1,2 @@
+export type Koffi = typeof import('koffi');
+export declare function loadKoffi(): Koffi;

package/koffi.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadKoffi = loadKoffi;
+// koffi is an optional dependency, so load it only when the chip is used.
+function loadKoffi() {
+    return require('koffi');
+}
+//# sourceMappingURL=koffi.js.map

package/koffi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"koffi.js","sourceRoot":"","sources":["koffi.ts"],"names":[],"mappings":";;AAGA,8BAEC;AAHD,0EAA0E;AAC1E,SAAgB,SAAS;IACvB,OAAO,OAAO,CAAC,OAAO,CAAU,CAAC;AACnC,CAAC"}

package/koffi.ts

@@ -0,0 +1,6 @@
+export type Koffi = typeof import('koffi');
+
+// koffi is an optional dependency, so load it only when the chip is used.
+export function loadKoffi(): Koffi {
+  return require('koffi') as Koffi;
+}

package/linux-tpm.d.ts

@@ -0,0 +1,30 @@
+export declare const TPM_DEVICE = "/dev/tpmrm0";
+/** A connection to a TPM: sends a command and returns its response. */
+export interface TpmConnection {
+    transmit(command: Buffer): Buffer;
+    close(): void;
+}
+export type ConnectTpm = () => TpmConnection;
+export declare class LinuxTpmError extends Error {
+    readonly rc: number;
+    constructor(what: string, rc: number, reason?: string);
+}
+/** This user isn't allowed to open the TPM device. */
+export declare class TpmAccessError extends Error {
+    constructor();
+}
+/** Whether this machine has a TPM the kernel exposes to user space. */
+export declare function hasLinuxTpm(): boolean;
+/**
+ * Seal `secret` with this machine's TPM. Returns the sealed object's public
+ * area and its private area, encrypted by the TPM, both as TPM2B structures.
+ */
+export declare function sealWithLinuxTpm(secret: Buffer, connect?: ConnectTpm): {
+    public: Buffer;
+    private: Buffer;
+};
+/** Unseal what `sealWithLinuxTpm` sealed, with this machine's TPM. */
+export declare function unsealWithLinuxTpm(sealed: {
+    public: Buffer;
+    private: Buffer;
+}, connect?: ConnectTpm): Buffer;

package/linux-tpm.js

@@ -0,0 +1,313 @@
+"use strict";
+// Seals a secret with this Linux machine's TPM 2.0, by sending TPM commands
+// to the kernel's resource manager (`/dev/tpmrm0`) directly, so there's no
+// native code or library (tpm2-tss) to install.
+//
+// The secret goes into a sealed data object under the owner hierarchy's
+// storage key. The TPM derives that storage key from a seed that never
+// leaves it, the same way every time, so nothing is kept in the TPM: what we
+// save is the object's public area and its private area, which the TPM
+// encrypted with that storage key and which only this TPM can load.
+//
+// The commands use password sessions with empty passwords, without
+// parameter encryption, so the secret crosses the bus between the CPU and a
+// discrete TPM in the clear when it's sealed and unsealed. That's within
+// what sealing protects against (a copied login), not a physical attacker.
+//
+// Buffers that held the secret are zeroed once they're used. That's best
+// effort: JavaScript can keep other copies, and the caller turns the secret
+// into a key.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TpmAccessError = exports.LinuxTpmError = exports.TPM_DEVICE = void 0;
+exports.hasLinuxTpm = hasLinuxTpm;
+exports.sealWithLinuxTpm = sealWithLinuxTpm;
+exports.unsealWithLinuxTpm = unsealWithLinuxTpm;
+const node_fs_1 = require("node:fs");
+exports.TPM_DEVICE = '/dev/tpmrm0';
+// Constants from the TPM 2.0 Library spec, Part 2.
+const TPM_ST_NO_SESSIONS = 0x8001;
+const TPM_ST_SESSIONS = 0x8002;
+const TPM_CC_CREATE_PRIMARY = 0x131;
+const TPM_CC_CREATE = 0x153;
+const TPM_CC_LOAD = 0x157;
+const TPM_CC_UNSEAL = 0x15e;
+const TPM_CC_FLUSH_CONTEXT = 0x165;
+const TPM_RH_OWNER = 0x40000001;
+const TPM_RS_PW = 0x40000009;
+const TPM_ALG_AES = 0x0006;
+const TPM_ALG_KEYEDHASH = 0x0008;
+const TPM_ALG_SHA256 = 0x000b;
+const TPM_ALG_NULL = 0x0010;
+const TPM_ALG_ECC = 0x0023;
+const TPM_ALG_CFB = 0x0043;
+const TPM_ECC_NIST_P256 = 0x0003;
+const FIXED_TPM = 1 << 1;
+const FIXED_PARENT = 1 << 4;
+const SENSITIVE_DATA_ORIGIN = 1 << 5;
+const USER_WITH_AUTH = 1 << 6;
+const NO_DA = 1 << 10;
+const RESTRICTED = 1 << 16;
+const DECRYPT = 1 << 17;
+// The TPM is busy: send the command again.
+const TPM_RC_RETRY = 0x922;
+const TPM_RC_YIELDED = 0x908;
+const TPM_RC_TESTING = 0x90a;
+const MAX_RETRIES = 10;
+// How long to wait before sending a command again, times the attempt.
+const RETRY_DELAY_MS = 50;
+// Format-one response codes (bit 7 set) carry an error number in their low
+// six bits: TPM_RC_BAD_AUTH and TPM_RC_AUTH_FAIL mean a wrong password.
+const RC_FMT1 = 0x080;
+const RC_BAD_AUTH = 0x022;
+const RC_AUTH_FAIL = 0x00e;
+const MAX_RESPONSE_SIZE = 4096;
+// The storage key's template: the TCG's standard ECC P-256 SRK template, so
+// the TPM derives the same key from the owner seed every time.
+const STORAGE_KEY_TEMPLATE = tpm2b(concat([
+    u16(TPM_ALG_ECC),
+    u16(TPM_ALG_SHA256),
+    u32(FIXED_TPM |
+        FIXED_PARENT |
+        SENSITIVE_DATA_ORIGIN |
+        USER_WITH_AUTH |
+        NO_DA |
+        RESTRICTED |
+        DECRYPT),
+    tpm2b(Buffer.alloc(0)), // authPolicy
+    u16(TPM_ALG_AES),
+    u16(128),
+    u16(TPM_ALG_CFB),
+    u16(TPM_ALG_NULL), // scheme
+    u16(TPM_ECC_NIST_P256),
+    u16(TPM_ALG_NULL), // kdf
+    tpm2b(Buffer.alloc(0)), // unique.x
+    tpm2b(Buffer.alloc(0)), // unique.y
+]));
+// The sealed object's template: data only this TPM can load, and only under
+// this storage key, unsealed with an empty password.
+const SEALED_OBJECT_TEMPLATE = tpm2b(concat([
+    u16(TPM_ALG_KEYEDHASH),
+    u16(TPM_ALG_SHA256),
+    u32(FIXED_TPM | FIXED_PARENT | USER_WITH_AUTH | NO_DA),
+    tpm2b(Buffer.alloc(0)), // authPolicy
+    u16(TPM_ALG_NULL), // scheme
+    tpm2b(Buffer.alloc(0)), // unique
+]));
+class LinuxTpmError extends Error {
+    constructor(what, rc, reason = '') {
+        super(`${reason}${what} failed with 0x${rc.toString(16)}.`);
+        this.rc = rc;
+    }
+}
+exports.LinuxTpmError = LinuxTpmError;
+/** This user isn't allowed to open the TPM device. */
+class TpmAccessError extends Error {
+    constructor() {
+        super(`Your user can't open ${exports.TPM_DEVICE}. The group that owns it (usually tss) can, but joining it gives your user access to the rest of the TPM too, so only join it if that's fine on this machine.`);
+    }
+}
+exports.TpmAccessError = TpmAccessError;
+/** Whether this machine has a TPM the kernel exposes to user space. */
+function hasLinuxTpm() {
+    return (0, node_fs_1.existsSync)(exports.TPM_DEVICE);
+}
+/**
+ * Seal `secret` with this machine's TPM. Returns the sealed object's public
+ * area and its private area, encrypted by the TPM, both as TPM2B structures.
+ */
+function sealWithLinuxTpm(secret, connect = connectToDevice) {
+    return withStorageKey(connect, (tpm, parent) => {
+        const data = tpm2b(secret);
+        const body = concat([tpm2b(Buffer.alloc(0)), data]);
+        const sensitive = tpm2b(body);
+        const cmd = command(TPM_CC_CREATE, parent, [
+            sensitive,
+            SEALED_OBJECT_TEMPLATE,
+            tpm2b(Buffer.alloc(0)), // outsideInfo
+            u32(0), // creationPCR
+        ]);
+        for (const copy of [data, body, sensitive]) {
+            copy.fill(0);
+        }
+        let response;
+        try {
+            response = send(tpm, 'TPM2_Create', cmd);
+        }
+        finally {
+            cmd.fill(0);
+        }
+        // Header, then parameterSize, then outPrivate and outPublic.
+        const sealedPrivate = readTpm2b(response, 14);
+        const sealedPublic = readTpm2b(response, 14 + sealedPrivate.length);
+        return { public: sealedPublic, private: sealedPrivate };
+    });
+}
+/** Unseal what `sealWithLinuxTpm` sealed, with this machine's TPM. */
+function unsealWithLinuxTpm(sealed, connect = connectToDevice) {
+    return withStorageKey(connect, (tpm, parent) => {
+        const object = send(tpm, 'TPM2_Load', command(TPM_CC_LOAD, parent, [sealed.private, sealed.public])).readUInt32BE(10);
+        try {
+            const response = send(tpm, 'TPM2_Unseal', command(TPM_CC_UNSEAL, object, []));
+            const outData = readTpm2b(response, 14);
+            const secret = Buffer.from(new Uint8Array(outData.subarray(2)));
+            outData.fill(0);
+            response.fill(0);
+            return secret;
+        }
+        finally {
+            flush(tpm, object);
+        }
+    });
+}
+function withStorageKey(connect, fn) {
+    const tpm = connect();
+    try {
+        let parent;
+        try {
+            parent = send(tpm, 'TPM2_CreatePrimary', command(TPM_CC_CREATE_PRIMARY, TPM_RH_OWNER, [
+                // inSensitive: no password, no data.
+                tpm2b(concat([tpm2b(Buffer.alloc(0)), tpm2b(Buffer.alloc(0))])),
+                STORAGE_KEY_TEMPLATE,
+                tpm2b(Buffer.alloc(0)), // outsideInfo
+                u32(0), // creationPCR
+            ])).readUInt32BE(10);
+        }
+        catch (error) {
+            if (error instanceof LinuxTpmError && isWrongPassword(error.rc)) {
+                throw new LinuxTpmError('TPM2_CreatePrimary', error.rc, "This TPM's owner hierarchy has a password, which the CLI doesn't use: ");
+            }
+            throw error;
+        }
+        try {
+            return fn(tpm, parent);
+        }
+        finally {
+            flush(tpm, parent);
+        }
+    }
+    finally {
+        // The resource manager also flushes what this connection loaded.
+        tpm.close();
+    }
+}
+function isWrongPassword(rc) {
+    const error = rc & 0x3f;
+    return ((rc & RC_FMT1) !== 0 && (error === RC_BAD_AUTH || error === RC_AUTH_FAIL));
+}
+function flush(tpm, handle) {
+    try {
+        const body = u32(handle);
+        send(tpm, 'TPM2_FlushContext', concat([
+            u16(TPM_ST_NO_SESSIONS),
+            u32(10 + body.length),
+            u32(TPM_CC_FLUSH_CONTEXT),
+            body,
+        ]));
+    }
+    catch {
+        // Closing the connection flushes it anyway.
+    }
+}
+// A command with one handle, authorized by an empty password.
+function command(code, handle, parameters) {
+    const auth = concat([
+        u32(TPM_RS_PW),
+        tpm2b(Buffer.alloc(0)), // nonce
+        Buffer.from([0]), // sessionAttributes
+        tpm2b(Buffer.alloc(0)), // password
+    ]);
+    const body = concat([u32(handle), u32(auth.length), auth, ...parameters]);
+    const cmd = concat([
+        u16(TPM_ST_SESSIONS),
+        u32(10 + body.length),
+        u32(code),
+        body,
+    ]);
+    // It may hold a secret.
+    body.fill(0);
+    return cmd;
+}
+function send(tpm, what, cmd) {
+    for (let attempt = 0;; attempt++) {
+        const response = tpm.transmit(cmd);
+        if (response.length < 10 || response.readUInt32BE(2) !== response.length) {
+            throw new Error(`${what} returned a malformed response.`);
+        }
+        const rc = response.readUInt32BE(6);
+        if (rc === 0) {
+            return response;
+        }
+        const busy = rc === TPM_RC_RETRY || rc === TPM_RC_YIELDED || rc === TPM_RC_TESTING;
+        if (!busy || attempt >= MAX_RETRIES) {
+            throw new LinuxTpmError(what, rc);
+        }
+        sleep(RETRY_DELAY_MS * (attempt + 1));
+    }
+}
+// Wait without returning to the event loop: every TPM call is synchronous.
+function sleep(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function connectToDevice() {
+    let fd;
+    try {
+        fd = (0, node_fs_1.openSync)(exports.TPM_DEVICE, 'r+');
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === 'EACCES' || code === 'EPERM') {
+            throw new TpmAccessError();
+        }
+        throw error;
+    }
+    return {
+        transmit(cmd) {
+            (0, node_fs_1.writeSync)(fd, view(cmd));
+            // The kernel returns the whole response in one read.
+            const response = Buffer.alloc(MAX_RESPONSE_SIZE);
+            const size = (0, node_fs_1.readSync)(fd, view(response), 0, response.length, null);
+            const result = Buffer.from(new Uint8Array(response.subarray(0, size)));
+            response.fill(0);
+            return result;
+        },
+        close() {
+            (0, node_fs_1.closeSync)(fd);
+        },
+    };
+}
+// A TPM2B structure (a 16-bit size, then that many bytes) at `offset`,
+// including its size.
+function readTpm2b(buffer, offset) {
+    const end = offset + 2 + buffer.readUInt16BE(offset);
+    if (end > buffer.length) {
+        throw new Error('The TPM returned a truncated response.');
+    }
+    return Buffer.from(new Uint8Array(buffer.subarray(offset, end)));
+}
+function tpm2b(bytes) {
+    return concat([u16(bytes.length), bytes]);
+}
+function concat(parts) {
+    const result = Buffer.alloc(parts.reduce((size, p) => size + p.length, 0));
+    let offset = 0;
+    for (const part of parts) {
+        result.set(part, offset);
+        offset += part.length;
+    }
+    return result;
+}
+// A view `fs` accepts, whichever `@types/node` is installed.
+function view(buffer) {
+    return new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.length);
+}
+function u16(value) {
+    const bytes = Buffer.alloc(2);
+    bytes.writeUInt16BE(value);
+    return bytes;
+}
+function u32(value) {
+    const bytes = Buffer.alloc(4);
+    bytes.writeUInt32BE(value >>> 0);
+    return bytes;
+}
+//# sourceMappingURL=linux-tpm.js.map

package/linux-tpm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-tpm.js","sourceRoot":"","sources":["linux-tpm.ts"],"names":[],"mappings":";AAAA,4EAA4E;AAC5E,2EAA2E;AAC3E,gDAAgD;AAChD,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,6EAA6E;AAC7E,uEAAuE;AACvE,oEAAoE;AACpE,EAAE;AACF,mEAAmE;AACnE,4EAA4E;AAC5E,yEAAyE;AACzE,2EAA2E;AAC3E,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,cAAc;;;AAgHd,kCAEC;AAMD,4CA4BC;AAGD,gDAyBC;AA9KD,qCAA+E;AAElE,QAAA,UAAU,GAAG,aAAa,CAAC;AAUxC,mDAAmD;AACnD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,qBAAqB,GAAG,KAAK,CAAC;AACpC,MAAM,aAAa,GAAG,KAAK,CAAC;AAC5B,MAAM,WAAW,GAAG,KAAK,CAAC;AAC1B,MAAM,aAAa,GAAG,KAAK,CAAC;AAC5B,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,SAAS,GAAG,UAAU,CAAC;AAC7B,MAAM,WAAW,GAAG,MAAM,CAAC;AAC3B,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,WAAW,GAAG,MAAM,CAAC;AAC3B,MAAM,WAAW,GAAG,MAAM,CAAC;AAC3B,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,CAAC;AACzB,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5B,MAAM,qBAAqB,GAAG,CAAC,IAAI,CAAC,CAAC;AACrC,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,CAAC;AAC9B,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;AACtB,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,CAAC;AAC3B,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACxB,2CAA2C;AAC3C,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,sEAAsE;AACtE,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,2EAA2E;AAC3E,wEAAwE;AACxE,MAAM,OAAO,GAAG,KAAK,CAAC;AACtB,MAAM,WAAW,GAAG,KAAK,CAAC;AAC1B,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,4EAA4E;AAC5E,+DAA+D;AAC/D,MAAM,oBAAoB,GAAG,KAAK,CAChC,MAAM,CAAC;IACL,GAAG,CAAC,WAAW,CAAC;IAChB,GAAG,CAAC,cAAc,CAAC;IACnB,GAAG,CACD,SAAS;QACP,YAAY;QACZ,qBAAqB;QACrB,cAAc;QACd,KAAK;QACL,UAAU;QACV,OAAO,CACV;IACD,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa;IACrC,GAAG,CAAC,WAAW,CAAC;IAChB,GAAG,CAAC,GAAG,CAAC;IACR,GAAG,CAAC,WAAW,CAAC;IAChB,GAAG,CAAC,YAAY,CAAC,EAAE,SAAS;IAC5B,GAAG,CAAC,iBAAiB,CAAC;IACtB,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM;IACzB,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW;IACnC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW;CACpC,CAAC,CACH,CAAC;AAEF,4EAA4E;AAC5E,qDAAqD;AACrD,MAAM,sBAAsB,GAAG,KAAK,CAClC,MAAM,CAAC;IACL,GAAG,CAAC,iBAAiB,CAAC;IACtB,GAAG,CAAC,cAAc,CAAC;IACnB,GAAG,CAAC,SAAS,GAAG,YAAY,GAAG,cAAc,GAAG,KAAK,CAAC;IACtD,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa;IACrC,GAAG,CAAC,YAAY,CAAC,EAAE,SAAS;IAC5B,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS;CAClC,CAAC,CACH,CAAC;AAEF,MAAa,aAAc,SAAQ,KAAK;IACtC,YACE,IAAY,EACH,EAAU,EACnB,MAAM,GAAG,EAAE;QAEX,KAAK,CAAC,GAAG,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAHnD,OAAE,GAAF,EAAE,CAAQ;IAIrB,CAAC;CACF;AARD,sCAQC;AAED,sDAAsD;AACtD,MAAa,cAAe,SAAQ,KAAK;IACvC;QACE,KAAK,CACH,wBAAwB,kBAAU,+JAA+J,CAClM,CAAC;IACJ,CAAC;CACF;AAND,wCAMC;AAED,uEAAuE;AACvE,SAAgB,WAAW;IACzB,OAAO,IAAA,oBAAU,EAAC,kBAAU,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAC9B,MAAc,EACd,UAAsB,eAAe;IAErC,OAAO,cAAc,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE;YACzC,SAAS;YACT,sBAAsB;YACtB,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc;YACtC,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc;SACvB,CAAC,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;QACD,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;QACD,6DAA6D;QAC7D,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACpE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sEAAsE;AACtE,SAAgB,kBAAkB,CAChC,MAA2C,EAC3C,UAAsB,eAAe;IAErC,OAAO,cAAc,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,IAAI,CACjB,GAAG,EACH,WAAW,EACX,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAC9D,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CACnB,GAAG,EACH,aAAa,EACb,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CACnC,CAAC;YACF,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CACrB,OAAmB,EACnB,EAA6C;IAE7C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CACX,GAAG,EACH,oBAAoB,EACpB,OAAO,CAAC,qBAAqB,EAAE,YAAY,EAAE;gBAC3C,qCAAqC;gBACrC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/D,oBAAoB;gBACpB,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc;gBACtC,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc;aACvB,CAAC,CACH,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,aAAa,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,aAAa,CACrB,oBAAoB,EACpB,KAAK,CAAC,EAAE,EACR,wEAAwE,CACzE,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,iEAAiE;QACjE,GAAG,CAAC,KAAK,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,EAAU;IACjC,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC;IACxB,OAAO,CACL,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,YAAY,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,GAAkB,EAAE,MAAc;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CACF,GAAG,EACH,mBAAmB,EACnB,MAAM,CAAC;YACL,GAAG,CAAC,kBAAkB,CAAC;YACvB,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;YACrB,GAAG,CAAC,oBAAoB,CAAC;YACzB,IAAI;SACL,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc,EAAE,UAAoB;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC;QAClB,GAAG,CAAC,SAAS,CAAC;QACd,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ;QAChC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,oBAAoB;QACtC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW;KACpC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,MAAM,CAAC;QACjB,GAAG,CAAC,eAAe,CAAC;QACpB,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QACrB,GAAG,CAAC,IAAI,CAAC;QACT,IAAI;KACL,CAAC,CAAC;IACH,wBAAwB;IACxB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACb,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,IAAI,CAAC,GAAkB,EAAE,IAAY,EAAE,GAAW;IACzD,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,iCAAiC,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,IAAI,GACR,EAAE,KAAK,YAAY,IAAI,EAAE,KAAK,cAAc,IAAI,EAAE,KAAK,cAAc,CAAC;QACxE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,WAAW,EAAE,CAAC;YACpC,MAAM,IAAI,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,cAAc,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,IAAA,kBAAQ,EAAC,kBAAU,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1C,MAAM,IAAI,cAAc,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO;QACL,QAAQ,CAAC,GAAG;YACV,IAAA,mBAAS,EAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,qDAAqD;YACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACpE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACvE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK;YACH,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,sBAAsB;AACtB,SAAS,SAAS,CAAC,MAAc,EAAE,MAAc;IAC/C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,MAAM,CAAC,KAAe;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3E,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6DAA6D;AAC7D,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,GAAG,CAAC,KAAa;IACxB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,GAAG,CAAC,KAAa;IACxB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,KAAK,CAAC,aAAa,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC;AACf,CAAC"}