@vercel/cli-auth 0.3.13 → 0.3.14-snapshot-dd15927e8ded

package/secure-enclave.ts

@@ -0,0 +1,304 @@
+// Seals a secret with a P-256 key that lives in this Mac's Secure Enclave,
+// through the Security framework's C API (called with koffi, so there's no
+// native code to build). Sealing is ECIES (ECDH with the Secure Enclave key,
+// then AES-GCM), so only that key can unseal it. The key is created outside
+// the keychain, so it needs no keychain entitlement and works from any
+// binary, `node` included. What we save is the key as wrapped by this Mac's
+// Secure Enclave (`kSecAttrTokenOID`), which only it can unwrap: a copy of
+// the file can't unseal anything anywhere else.
+
+import { type Koffi, loadKoffi } from './koffi';
+
+export type Pointer = bigint;
+
+const CORE_FOUNDATION =
+  '/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation';
+const SECURITY = '/System/Library/Frameworks/Security.framework/Security';
+
+const kCFStringEncodingUTF8 = 0x08000100;
+const kCFNumberSInt32Type = 3;
+const kSecAccessControlPrivateKeyUsage = 1 << 30;
+// `SecBase.h` errSecInteractionNotAllowed: the key can't be used while this
+// Mac is locked (`kSecAttrAccessibleWhenUnlockedThisDeviceOnly`).
+const errSecInteractionNotAllowed = -25308;
+
+/** The Secure Enclave can't use the key while this Mac is locked. */
+export class SecureEnclaveLockedError extends Error {}
+
+let api: ReturnType<typeof loadApi> | undefined;
+
+function loadApi(koffi: Koffi) {
+  const cf = koffi.load(CORE_FOUNDATION);
+  const sec = koffi.load(SECURITY);
+  // The value of an exported constant, such as a `CFStringRef`.
+  const constant = (lib: typeof cf, name: string): Pointer =>
+    koffi.decode(lib.symbol(name), 'void *');
+
+  return {
+    koffi,
+    CFRelease: cf.func('void CFRelease(void *cf)'),
+    CFDictionaryCreateMutable: cf.func(
+      'void *CFDictionaryCreateMutable(void *allocator, long capacity, void *keyCallBacks, void *valueCallBacks)'
+    ),
+    CFDictionarySetValue: cf.func(
+      'void CFDictionarySetValue(void *dict, void *key, void *value)'
+    ),
+    CFDictionaryGetValue: cf.func(
+      'void *CFDictionaryGetValue(void *dict, void *key)'
+    ),
+    CFDataCreate: cf.func(
+      'void *CFDataCreate(void *allocator, const uint8_t *bytes, long length)'
+    ),
+    CFDataGetLength: cf.func('long CFDataGetLength(void *data)'),
+    CFDataGetBytePtr: cf.func('void *CFDataGetBytePtr(void *data)'),
+    CFNumberCreate: cf.func(
+      'void *CFNumberCreate(void *allocator, long type, const int32_t *value)'
+    ),
+    CFStringCreateWithCString: cf.func(
+      'void *CFStringCreateWithCString(void *allocator, const char *str, uint32_t encoding)'
+    ),
+    CFErrorGetCode: cf.func('long CFErrorGetCode(void *error)'),
+    SecAccessControlCreateWithFlags: sec.func(
+      'void *SecAccessControlCreateWithFlags(void *allocator, void *protection, unsigned long flags, _Out_ void **error)'
+    ),
+    SecKeyCreateRandomKey: sec.func(
+      'void *SecKeyCreateRandomKey(void *parameters, _Out_ void **error)'
+    ),
+    SecKeyCreateWithData: sec.func(
+      'void *SecKeyCreateWithData(void *keyData, void *attributes, _Out_ void **error)'
+    ),
+    SecKeyCopyAttributes: sec.func('void *SecKeyCopyAttributes(void *key)'),
+    SecKeyCopyPublicKey: sec.func('void *SecKeyCopyPublicKey(void *key)'),
+    SecKeyCreateEncryptedData: sec.func(
+      'void *SecKeyCreateEncryptedData(void *key, void *algorithm, void *plaintext, _Out_ void **error)'
+    ),
+    SecKeyCreateDecryptedData: sec.func(
+      'void *SecKeyCreateDecryptedData(void *key, void *algorithm, void *ciphertext, _Out_ void **error)'
+    ),
+    keyCallBacks: cf.symbol('kCFTypeDictionaryKeyCallBacks') as Pointer,
+    valueCallBacks: cf.symbol('kCFTypeDictionaryValueCallBacks') as Pointer,
+    kCFBooleanFalse: constant(cf, 'kCFBooleanFalse'),
+    kSecAttrKeyType: constant(sec, 'kSecAttrKeyType'),
+    kSecAttrKeyTypeECSECPrimeRandom: constant(
+      sec,
+      'kSecAttrKeyTypeECSECPrimeRandom'
+    ),
+    kSecAttrKeySizeInBits: constant(sec, 'kSecAttrKeySizeInBits'),
+    kSecAttrKeyClass: constant(sec, 'kSecAttrKeyClass'),
+    kSecAttrKeyClassPrivate: constant(sec, 'kSecAttrKeyClassPrivate'),
+    kSecAttrTokenID: constant(sec, 'kSecAttrTokenID'),
+    kSecAttrTokenIDSecureEnclave: constant(sec, 'kSecAttrTokenIDSecureEnclave'),
+    kSecPrivateKeyAttrs: constant(sec, 'kSecPrivateKeyAttrs'),
+    kSecAttrIsPermanent: constant(sec, 'kSecAttrIsPermanent'),
+    kSecAttrAccessControl: constant(sec, 'kSecAttrAccessControl'),
+    kSecAttrAccessibleWhenUnlockedThisDeviceOnly: constant(
+      sec,
+      'kSecAttrAccessibleWhenUnlockedThisDeviceOnly'
+    ),
+    kSecKeyAlgorithmECIESEncryptionCofactorVariableIVX963SHA256AESGCM: constant(
+      sec,
+      'kSecKeyAlgorithmECIESEncryptionCofactorVariableIVX963SHA256AESGCM'
+    ),
+  };
+}
+
+type Api = ReturnType<typeof loadApi>;
+
+/**
+ * Runs `fn` with an `own` function that records each Core Foundation object
+ * `fn` creates, and releases them all when it returns or throws.
+ */
+function withObjects<T>(
+  fn: (a: Api, own: (object: Pointer | null, what: string) => Pointer) => T
+): T {
+  const a = (api ??= loadApi(loadKoffi()));
+  const objects: Pointer[] = [];
+  try {
+    return fn(a, (object, what) => {
+      if (!object) {
+        throw new Error(`${what} failed.`);
+      }
+      objects.push(object);
+      return object;
+    });
+  } finally {
+    for (const object of objects.reverse()) {
+      a.CFRelease(object);
+    }
+  }
+}
+
+/** Calls a function that reports failure with a `CFErrorRef` out argument. */
+function check(
+  a: Api,
+  what: string,
+  call: (error: [Pointer | null]) => Pointer | null
+): Pointer | null {
+  const error: [Pointer | null] = [null];
+  const result = call(error);
+  if (!result && error[0]) {
+    const code = a.CFErrorGetCode(error[0]);
+    a.CFRelease(error[0]);
+    const message = `${what} failed with error ${code}.`;
+    if (Number(code) === errSecInteractionNotAllowed) {
+      throw new SecureEnclaveLockedError(message);
+    }
+    throw new Error(message);
+  }
+  return result;
+}
+
+function dictionary(
+  a: Api,
+  own: (object: Pointer | null, what: string) => Pointer,
+  entries: [Pointer, Pointer][]
+): Pointer {
+  const dict = own(
+    a.CFDictionaryCreateMutable(null, 0, a.keyCallBacks, a.valueCallBacks),
+    'CFDictionaryCreateMutable'
+  );
+  for (const [key, value] of entries) {
+    a.CFDictionarySetValue(dict, key, value);
+  }
+  return dict;
+}
+
+function toData(
+  a: Api,
+  own: (object: Pointer | null, what: string) => Pointer,
+  bytes: Buffer | Uint8Array
+): Pointer {
+  return own(a.CFDataCreate(null, bytes, bytes.length), 'CFDataCreate');
+}
+
+function fromData(a: Api, data: Pointer): Buffer {
+  const length = Number(a.CFDataGetLength(data));
+  if (length === 0) {
+    return Buffer.alloc(0);
+  }
+  // Copy out of the CFData before it's released.
+  return Buffer.from(
+    new Uint8Array(a.koffi.view(a.CFDataGetBytePtr(data), length))
+  );
+}
+
+// Not exported by the SDK headers: the attribute that holds a Secure Enclave
+// key's wrapped form, which CryptoKit calls `dataRepresentation`.
+function tokenOid(
+  a: Api,
+  own: (object: Pointer | null, what: string) => Pointer
+): Pointer {
+  return own(
+    a.CFStringCreateWithCString(null, 'toid', kCFStringEncodingUTF8),
+    'CFStringCreateWithCString'
+  );
+}
+
+/**
+ * Create a key in this Mac's Secure Enclave and seal `secret` with it.
+ * Returns the key as wrapped by the Secure Enclave, and the sealed secret.
+ */
+export function createSecureEnclaveKey(secret: Buffer): {
+  wrapped: Buffer;
+  sealed: Buffer;
+} {
+  return withObjects((a, own) => {
+    const accessControl = own(
+      check(a, 'SecAccessControlCreateWithFlags', error =>
+        a.SecAccessControlCreateWithFlags(
+          null,
+          a.kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+          kSecAccessControlPrivateKeyUsage,
+          error
+        )
+      ),
+      'SecAccessControlCreateWithFlags'
+    );
+    const keySize = own(
+      a.CFNumberCreate(null, kCFNumberSInt32Type, Int32Array.of(256)),
+      'CFNumberCreate'
+    );
+    const parameters = dictionary(a, own, [
+      [a.kSecAttrKeyType, a.kSecAttrKeyTypeECSECPrimeRandom],
+      [a.kSecAttrKeySizeInBits, keySize],
+      [a.kSecAttrTokenID, a.kSecAttrTokenIDSecureEnclave],
+      [
+        a.kSecPrivateKeyAttrs,
+        dictionary(a, own, [
+          // Not in the keychain, which would need a keychain entitlement.
+          [a.kSecAttrIsPermanent, a.kCFBooleanFalse],
+          [a.kSecAttrAccessControl, accessControl],
+        ]),
+      ],
+    ]);
+    const key = own(
+      check(a, 'SecKeyCreateRandomKey', error =>
+        a.SecKeyCreateRandomKey(parameters, error)
+      ),
+      'SecKeyCreateRandomKey'
+    );
+
+    const attributes = own(a.SecKeyCopyAttributes(key), 'SecKeyCopyAttributes');
+    const wrapped = a.CFDictionaryGetValue(attributes, tokenOid(a, own));
+    if (!wrapped) {
+      throw new Error("The Secure Enclave didn't return the wrapped key.");
+    }
+
+    const publicKey = own(a.SecKeyCopyPublicKey(key), 'SecKeyCopyPublicKey');
+    const sealed = own(
+      check(a, 'SecKeyCreateEncryptedData', error =>
+        a.SecKeyCreateEncryptedData(
+          publicKey,
+          a.kSecKeyAlgorithmECIESEncryptionCofactorVariableIVX963SHA256AESGCM,
+          toData(a, own, secret),
+          error
+        )
+      ),
+      'SecKeyCreateEncryptedData'
+    );
+
+    return { wrapped: fromData(a, wrapped), sealed: fromData(a, sealed) };
+  });
+}
+
+/**
+ * Unseal what `createSecureEnclaveKey` sealed, with the key `wrapped` by
+ * this Mac's Secure Enclave. The Secure Enclave's private key never leaves
+ * it. Fails while the Mac is locked.
+ */
+export function unsealWithSecureEnclaveKey(
+  wrapped: Buffer,
+  sealed: Buffer
+): Buffer {
+  return withObjects((a, own) => {
+    const attributes = dictionary(a, own, [
+      [a.kSecAttrKeyType, a.kSecAttrKeyTypeECSECPrimeRandom],
+      [a.kSecAttrKeyClass, a.kSecAttrKeyClassPrivate],
+      [a.kSecAttrTokenID, a.kSecAttrTokenIDSecureEnclave],
+      [tokenOid(a, own), toData(a, own, wrapped)],
+    ]);
+    // With a token ID the key comes from the attributes, not `keyData`.
+    const key = own(
+      check(a, 'SecKeyCreateWithData', error =>
+        a.SecKeyCreateWithData(
+          toData(a, own, new Uint8Array(0)),
+          attributes,
+          error
+        )
+      ),
+      'SecKeyCreateWithData'
+    );
+    const secret = own(
+      check(a, 'SecKeyCreateDecryptedData', error =>
+        a.SecKeyCreateDecryptedData(
+          key,
+          a.kSecKeyAlgorithmECIESEncryptionCofactorVariableIVX963SHA256AESGCM,
+          toData(a, own, sealed),
+          error
+        )
+      ),
+      'SecKeyCreateDecryptedData'
+    );
+    return fromData(a, secret);
+  });
+}

package/tpm.d.ts

@@ -0,0 +1,13 @@
+export type Handle = number | bigint;
+/**
+ * Create an RSA key named `name` in this PC's TPM, which may only decrypt,
+ * and seal `secret` with it. Returns the sealed secret.
+ */
+export declare function createTpmKey(name: string, secret: Buffer): Buffer;
+/**
+ * Unseal what `createTpmKey` sealed, with the key named `name` in this PC's
+ * TPM. The TPM's private key never leaves it.
+ */
+export declare function unsealWithTpmKey(name: string, sealed: Buffer): Buffer;
+/** Delete the key named `name` from this PC's TPM, if it's there. */
+export declare function deleteTpmKey(name: string): void;

package/tpm.js

@@ -0,0 +1,160 @@
+"use strict";
+// Seals a secret with an RSA key that lives in this PC's TPM, through CNG's
+// Platform Crypto Provider (called with koffi, so there's no native code to
+// build). The TPM keeps the private key and only hands out what it unseals:
+// what we save is the key's name, which is useless on any other PC.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTpmKey = createTpmKey;
+exports.unsealWithTpmKey = unsealWithTpmKey;
+exports.deleteTpmKey = deleteTpmKey;
+const koffi_1 = require("./koffi");
+// String constants from `ncrypt.h` and `bcrypt.h`.
+const PLATFORM_CRYPTO_PROVIDER = 'Microsoft Platform Crypto Provider';
+const NCRYPT_RSA_ALGORITHM = 'RSA';
+const NCRYPT_LENGTH_PROPERTY = 'Length';
+const NCRYPT_KEY_USAGE_PROPERTY = 'Key Usage';
+const BCRYPT_SHA256_ALGORITHM = 'SHA256';
+const RSA_KEY_BITS = 2048;
+// `ncrypt.h`: the key may only decrypt.
+const NCRYPT_ALLOW_DECRYPT_FLAG = 0x1;
+// `ncrypt.h`: RSA-OAEP, with a `BCRYPT_OAEP_PADDING_INFO`.
+const NCRYPT_PAD_OAEP_FLAG = 0x4;
+// `ncrypt.h`: fail instead of showing UI, since the CLI may not be
+// interactive.
+const NCRYPT_SILENT_FLAG = 0x40;
+// `winerror.h` NTE_BAD_KEYSET: there's no key with that name.
+const NTE_BAD_KEYSET = 0x80090016;
+let api;
+function loadApi(koffi) {
+    const ncrypt = koffi.load('ncrypt.dll');
+    koffi.struct('BCRYPT_OAEP_PADDING_INFO', {
+        pszAlgId: 'str16',
+        pbLabel: 'void *',
+        cbLabel: 'uint32_t',
+    });
+    return {
+        NCryptOpenStorageProvider: ncrypt.func('int32_t __stdcall NCryptOpenStorageProvider(_Out_ uintptr_t *phProvider, const char16_t *pszProviderName, uint32_t dwFlags)'),
+        NCryptCreatePersistedKey: ncrypt.func('int32_t __stdcall NCryptCreatePersistedKey(uintptr_t hProvider, _Out_ uintptr_t *phKey, const char16_t *pszAlgId, const char16_t *pszKeyName, uint32_t dwLegacyKeySpec, uint32_t dwFlags)'),
+        NCryptSetProperty: ncrypt.func('int32_t __stdcall NCryptSetProperty(uintptr_t hObject, const char16_t *pszProperty, const uint8_t *pbInput, uint32_t cbInput, uint32_t dwFlags)'),
+        NCryptFinalizeKey: ncrypt.func('int32_t __stdcall NCryptFinalizeKey(uintptr_t hKey, uint32_t dwFlags)'),
+        NCryptOpenKey: ncrypt.func('int32_t __stdcall NCryptOpenKey(uintptr_t hProvider, _Out_ uintptr_t *phKey, const char16_t *pszKeyName, uint32_t dwLegacyKeySpec, uint32_t dwFlags)'),
+        NCryptEncrypt: ncrypt.func('int32_t __stdcall NCryptEncrypt(uintptr_t hKey, const uint8_t *pbInput, uint32_t cbInput, const BCRYPT_OAEP_PADDING_INFO *pPaddingInfo, _Out_ uint8_t *pbOutput, uint32_t cbOutput, _Out_ uint32_t *pcbResult, uint32_t dwFlags)'),
+        NCryptDecrypt: ncrypt.func('int32_t __stdcall NCryptDecrypt(uintptr_t hKey, const uint8_t *pbInput, uint32_t cbInput, const BCRYPT_OAEP_PADDING_INFO *pPaddingInfo, _Out_ uint8_t *pbOutput, uint32_t cbOutput, _Out_ uint32_t *pcbResult, uint32_t dwFlags)'),
+        NCryptDeleteKey: ncrypt.func('int32_t __stdcall NCryptDeleteKey(uintptr_t hKey, uint32_t dwFlags)'),
+        NCryptFreeObject: ncrypt.func('int32_t __stdcall NCryptFreeObject(uintptr_t hObject)'),
+    };
+}
+class TpmError extends Error {
+    constructor(what, status) {
+        super(`${what} failed with 0x${(status >>> 0).toString(16)}.`);
+        this.status = status;
+    }
+}
+function check(what, status) {
+    if (status !== 0) {
+        throw new TpmError(what, status);
+    }
+}
+function withProvider(fn) {
+    const a = (api ??= loadApi((0, koffi_1.loadKoffi)()));
+    const provider = [0];
+    check('NCryptOpenStorageProvider', a.NCryptOpenStorageProvider(provider, PLATFORM_CRYPTO_PROVIDER, 0));
+    try {
+        return fn(a, provider[0]);
+    }
+    finally {
+        a.NCryptFreeObject(provider[0]);
+    }
+}
+function openKey(a, provider, name) {
+    const key = [0];
+    check('NCryptOpenKey', a.NCryptOpenKey(provider, key, name, 0, NCRYPT_SILENT_FLAG));
+    return key[0];
+}
+/**
+ * Create an RSA key named `name` in this PC's TPM, which may only decrypt,
+ * and seal `secret` with it. Returns the sealed secret.
+ */
+function createTpmKey(name, secret) {
+    return withProvider((a, provider) => {
+        const handle = [0];
+        check('NCryptCreatePersistedKey', a.NCryptCreatePersistedKey(provider, handle, NCRYPT_RSA_ALGORITHM, name, 0, 0));
+        const key = handle[0];
+        let finalized = false;
+        try {
+            setDword(a, key, NCRYPT_LENGTH_PROPERTY, RSA_KEY_BITS);
+            setDword(a, key, NCRYPT_KEY_USAGE_PROPERTY, NCRYPT_ALLOW_DECRYPT_FLAG);
+            check('NCryptFinalizeKey', a.NCryptFinalizeKey(key, NCRYPT_SILENT_FLAG));
+            finalized = true;
+            const sealed = oaep(a, 'NCryptEncrypt', key, secret);
+            a.NCryptFreeObject(key);
+            return sealed;
+        }
+        catch (error) {
+            if (finalized) {
+                // Also frees the handle.
+                a.NCryptDeleteKey(key, NCRYPT_SILENT_FLAG);
+            }
+            else {
+                a.NCryptFreeObject(key);
+            }
+            throw error;
+        }
+    });
+}
+/**
+ * Unseal what `createTpmKey` sealed, with the key named `name` in this PC's
+ * TPM. The TPM's private key never leaves it.
+ */
+function unsealWithTpmKey(name, sealed) {
+    return withProvider((a, provider) => {
+        const key = openKey(a, provider, name);
+        try {
+            return oaep(a, 'NCryptDecrypt', key, sealed);
+        }
+        finally {
+            a.NCryptFreeObject(key);
+        }
+    });
+}
+function setDword(a, key, property, value) {
+    const bytes = Buffer.alloc(4);
+    bytes.writeUInt32LE(value);
+    check(`NCryptSetProperty(${property})`, a.NCryptSetProperty(key, property, bytes, bytes.length, 0));
+}
+// Encrypt or decrypt with RSA-OAEP and SHA-256.
+function oaep(a, what, key, input) {
+    const output = Buffer.alloc(RSA_KEY_BITS / 8);
+    const size = [0];
+    check(what, a[what](key, input, input.length, { pszAlgId: BCRYPT_SHA256_ALGORITHM, pbLabel: null, cbLabel: 0 }, output, output.length, size, 
+    // Only decrypting uses the private key, which may want UI.
+    what === 'NCryptDecrypt'
+        ? NCRYPT_PAD_OAEP_FLAG | NCRYPT_SILENT_FLAG
+        : NCRYPT_PAD_OAEP_FLAG));
+    const result = Buffer.from(new Uint8Array(output.subarray(0, size[0])));
+    // Don't leave an unsealed secret behind.
+    output.fill(0);
+    return result;
+}
+/** Delete the key named `name` from this PC's TPM, if it's there. */
+function deleteTpmKey(name) {
+    withProvider((a, provider) => {
+        let key;
+        try {
+            key = openKey(a, provider, name);
+        }
+        catch (error) {
+            if (error instanceof TpmError && error.status >>> 0 === NTE_BAD_KEYSET) {
+                return;
+            }
+            throw error;
+        }
+        // Frees the handle when it succeeds.
+        const status = a.NCryptDeleteKey(key, NCRYPT_SILENT_FLAG);
+        if (status !== 0) {
+            a.NCryptFreeObject(key);
+        }
+        check('NCryptDeleteKey', status);
+    });
+}
+//# sourceMappingURL=tpm.js.map

package/tpm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tpm.js","sourceRoot":"","sources":["tpm.ts"],"names":[],"mappings":";AAAA,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAC5E,oEAAoE;;AA2GpE,oCAkCC;AAMD,4CASC;AA2CD,oCAkBC;AAvND,mCAAgD;AAIhD,mDAAmD;AACnD,MAAM,wBAAwB,GAAG,oCAAoC,CAAC;AACtE,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,sBAAsB,GAAG,QAAQ,CAAC;AACxC,MAAM,yBAAyB,GAAG,WAAW,CAAC;AAC9C,MAAM,uBAAuB,GAAG,QAAQ,CAAC;AACzC,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,wCAAwC;AACxC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,2DAA2D;AAC3D,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,mEAAmE;AACnE,eAAe;AACf,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,8DAA8D;AAC9D,MAAM,cAAc,GAAG,UAAU,CAAC;AAElC,IAAI,GAA2C,CAAC;AAEhD,SAAS,OAAO,CAAC,KAAY;IAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxC,KAAK,CAAC,MAAM,CAAC,0BAA0B,EAAE;QACvC,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,UAAU;KACpB,CAAC,CAAC;IACH,OAAO;QACL,yBAAyB,EAAE,MAAM,CAAC,IAAI,CACpC,6HAA6H,CAC9H;QACD,wBAAwB,EAAE,MAAM,CAAC,IAAI,CACnC,2LAA2L,CAC5L;QACD,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAC5B,iJAAiJ,CAClJ;QACD,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAC5B,uEAAuE,CACxE;QACD,aAAa,EAAE,MAAM,CAAC,IAAI,CACxB,sJAAsJ,CACvJ;QACD,aAAa,EAAE,MAAM,CAAC,IAAI,CACxB,kOAAkO,CACnO;QACD,aAAa,EAAE,MAAM,CAAC,IAAI,CACxB,kOAAkO,CACnO;QACD,eAAe,EAAE,MAAM,CAAC,IAAI,CAC1B,qEAAqE,CACtE;QACD,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAC3B,uDAAuD,CACxD;KACF,CAAC;AACJ,CAAC;AAID,MAAM,QAAS,SAAQ,KAAK;IAC1B,YACE,IAAY,EACH,MAAc;QAEvB,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAFtD,WAAM,GAAN,MAAM,CAAQ;IAGzB,CAAC;CACF;AAED,SAAS,KAAK,CAAC,IAAY,EAAE,MAAc;IACzC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAI,EAAmC;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,IAAA,iBAAS,GAAE,CAAC,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAa,CAAC,CAAC,CAAC,CAAC;IAC/B,KAAK,CACH,2BAA2B,EAC3B,CAAC,CAAC,yBAAyB,CAAC,QAAQ,EAAE,wBAAwB,EAAE,CAAC,CAAC,CACnE,CAAC;IACF,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,CAAM,EAAE,QAAgB,EAAE,IAAY;IACrD,MAAM,GAAG,GAAa,CAAC,CAAC,CAAC,CAAC;IAC1B,KAAK,CACH,eAAe,EACf,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,kBAAkB,CAAC,CAC5D,CAAC;IACF,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAgB,YAAY,CAAC,IAAY,EAAE,MAAc;IACvD,OAAO,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE;QAClC,MAAM,MAAM,GAAa,CAAC,CAAC,CAAC,CAAC;QAC7B,KAAK,CACH,0BAA0B,EAC1B,CAAC,CAAC,wBAAwB,CACxB,QAAQ,EACR,MAAM,EACN,oBAAoB,EACpB,IAAI,EACJ,CAAC,EACD,CAAC,CACF,CACF,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC;YACH,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,YAAY,CAAC,CAAC;YACvD,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,yBAAyB,EAAE,yBAAyB,CAAC,CAAC;YACvE,KAAK,CAAC,mBAAmB,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC;YACzE,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,EAAE,CAAC;gBACd,yBAAyB;gBACzB,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,IAAY,EAAE,MAAc;IAC3D,OAAO,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,CAAM,EAAE,GAAW,EAAE,QAAgB,EAAE,KAAa;IACpE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC3B,KAAK,CACH,qBAAqB,QAAQ,GAAG,EAChC,CAAC,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED,gDAAgD;AAChD,SAAS,IAAI,CACX,CAAM,EACN,IAAuC,EACvC,GAAW,EACX,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAa,CAAC,CAAC,CAAC,CAAC;IAC3B,KAAK,CACH,IAAI,EACJ,CAAC,CAAC,IAAI,CAAC,CACL,GAAG,EACH,KAAK,EACL,KAAK,CAAC,MAAM,EACZ,EAAE,QAAQ,EAAE,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,EAChE,MAAM,EACN,MAAM,CAAC,MAAM,EACb,IAAI;IACJ,2DAA2D;IAC3D,IAAI,KAAK,eAAe;QACtB,CAAC,CAAC,oBAAoB,GAAG,kBAAkB;QAC3C,CAAC,CAAC,oBAAoB,CACzB,CACF,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,yCAAyC;IACzC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qEAAqE;AACrE,SAAgB,YAAY,CAAC,IAAY;IACvC,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE;QAC3B,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,KAAK,cAAc,EAAE,CAAC;gBACvE,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,qCAAqC;QACrC,MAAM,MAAM,GAAG,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC1D,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC"}