@zincapp/znvault-cli 4.3.0 → 4.5.0

package/dist/commands/kmip/admin.d.ts

@@ -0,0 +1,8 @@
+export declare function enableKmip(options: {
+    json?: boolean;
+}): Promise<void>;
+export declare function reissueServerCert(options: {
+    yes?: boolean;
+    json?: boolean;
+}): Promise<void>;
+//# sourceMappingURL=admin.d.ts.map

package/dist/commands/kmip/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../src/commands/kmip/admin.ts"],"names":[],"mappings":"AAQA,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB3E;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAiCjG"}

package/dist/commands/kmip/admin.js

@@ -0,0 +1,58 @@
+// Path: src/commands/kmip/admin.ts
+// Superadmin KMIP commands (enable PKI, re-issue server cert).
+import inquirer from 'inquirer';
+import { client } from '../../lib/client.js';
+import * as output from '../../lib/output.js';
+export async function enableKmip(options) {
+    const spinner = output.spinner('Initializing KMIP PKI and starting the listener...').start();
+    try {
+        const response = await client.post('/v1/superadmin/kmip/enable', {});
+        spinner.stop();
+        if (options.json) {
+            output.json(response);
+            return;
+        }
+        output.success('KMIP enabled');
+        output.keyValue({
+            'Listening': String(response.listener.listening),
+            'Port': String(response.listener.port),
+            'Server Cert Expires': response.serverCertNotAfter ?? '-',
+        });
+    }
+    catch (err) {
+        spinner.fail('Failed to enable KMIP');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+export async function reissueServerCert(options) {
+    if (!options.yes) {
+        output.warn('Re-issuing the KMIP server certificate may require a manual recovery-key unlock on EVERY enrolled NAS.');
+        const { confirm } = await inquirer.prompt([
+            { type: 'confirm', name: 'confirm', message: 'Proceed with server certificate re-issue?', default: false },
+        ]);
+        if (!confirm) {
+            output.info('Aborted.');
+            return;
+        }
+    }
+    const spinner = output.spinner('Re-issuing KMIP server certificate...').start();
+    try {
+        const response = await client.post('/v1/superadmin/kmip/server-cert/reissue', { confirm: true });
+        spinner.stop();
+        if (options.json) {
+            output.json(response);
+            return;
+        }
+        output.success('Server certificate re-issued');
+        output.keyValue({ 'New Expiry': response.serverCertNotAfter ?? '-' });
+        if (response.warning)
+            output.warn(response.warning);
+    }
+    catch (err) {
+        spinner.fail('Failed to re-issue server certificate');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=admin.js.map

package/dist/commands/kmip/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../../src/commands/kmip/admin.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,+DAA+D;AAE/D,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAG9C,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAA2B;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7F,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,4BAA4B,EAC5B,EAAE,CACH,CAAC;QACF,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC;YACd,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;YAChD,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;YACtC,qBAAqB,EAAE,QAAQ,CAAC,kBAAkB,IAAI,GAAG;SAC1D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA0C;IAChF,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CACT,wGAAwG,CACzG,CAAC;QACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAuB;YAC9D,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,KAAK,EAAE;SAC3G,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,KAAK,EAAE,CAAC;IAChF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,yCAAyC,EACzC,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;QACF,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;QAC/C,MAAM,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,kBAAkB,IAAI,GAAG,EAAE,CAAC,CAAC;QACtE,IAAI,QAAQ,CAAC,OAAO;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/commands/kmip/clients.d.ts

@@ -0,0 +1,18 @@
+interface CreateOptions {
+    description?: string;
+    outputDir?: string;
+    allowedCidrs?: string;
+    json?: boolean;
+}
+export declare function createClient(name: string, options: CreateOptions): Promise<void>;
+export declare function listClients(options: {
+    json?: boolean;
+}): Promise<void>;
+export declare function setSourceCidrs(id: string, cidrs: string, options: {
+    json?: boolean;
+}): Promise<void>;
+export declare function revokeClient(id: string, options: {
+    json?: boolean;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=clients.d.ts.map

package/dist/commands/kmip/clients.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../../../src/commands/kmip/clients.ts"],"names":[],"mappings":"AASA,UAAU,aAAa;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAWD,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCtF;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B5E;AAED,wBAAsB,cAAc,CAClC,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1B,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAezF"}

package/dist/commands/kmip/clients.js

@@ -0,0 +1,121 @@
+// Path: src/commands/kmip/clients.ts
+// KMIP client management commands.
+import fs from 'fs';
+import path from 'path';
+import { client } from '../../lib/client.js';
+import * as output from '../../lib/output.js';
+/** Parse a comma-separated CIDR list into a trimmed string[] (empty if unset). */
+function parseCidrList(raw) {
+    if (raw === undefined)
+        return [];
+    return raw
+        .split(',')
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+export async function createClient(name, options) {
+    const spinner = output.spinner(`Creating KMIP client '${name}'...`).start();
+    try {
+        const allowedSourceCidrs = parseCidrList(options.allowedCidrs);
+        const response = await client.post('/v1/kmip/clients', {
+            name,
+            description: options.description,
+            ...(allowedSourceCidrs.length > 0 ? { allowedSourceCidrs } : {}),
+        });
+        spinner.stop();
+        if (options.json) {
+            output.json(response);
+            return;
+        }
+        output.success(`KMIP client '${name}' created`);
+        output.keyValue({
+            ID: response.id,
+            Fingerprint: response.certFingerprint,
+            'Expires': response.certNotAfter ?? '-',
+        });
+        // Write the three files DSM imports (the only chance — the key is never stored).
+        const dir = options.outputDir ?? `kmip-${name}`;
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(path.join(dir, 'client.key'), response.bundle.clientKeyPem, { mode: 0o600 });
+        fs.writeFileSync(path.join(dir, 'client.crt'), response.bundle.clientCertPem);
+        fs.writeFileSync(path.join(dir, 'ca.crt'), response.bundle.caCertPem);
+        output.info(`Bundle written to ${dir}/ (client.key, client.crt, ca.crt)`);
+        output.warn('The private key is shown only once and is NOT stored on the server. Keep it safe.');
+    }
+    catch (err) {
+        spinner.fail('Failed to create KMIP client');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+export async function listClients(options) {
+    const spinner = output.spinner('Fetching KMIP clients...').start();
+    try {
+        const response = await client.get('/v1/kmip/clients');
+        spinner.stop();
+        if (options.json) {
+            output.json(response);
+            return;
+        }
+        if (response.items.length === 0) {
+            output.info('No KMIP clients.');
+            return;
+        }
+        output.table(['Name', 'Status', 'Fingerprint', 'Last Seen', 'Expires'], response.items.map((c) => [
+            c.name,
+            c.status,
+            `${c.certFingerprint.slice(0, 16)}…`,
+            c.lastSeenAt ?? '-',
+            c.certNotAfter ?? '-',
+        ]));
+    }
+    catch (err) {
+        spinner.fail('Failed to list KMIP clients');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+export async function setSourceCidrs(id, cidrs, options) {
+    const allowedSourceCidrs = parseCidrList(cidrs);
+    const verb = allowedSourceCidrs.length > 0 ? 'Setting' : 'Clearing';
+    const spinner = output.spinner(`${verb} source-IP allowlist for KMIP client ${id}...`).start();
+    try {
+        const response = await client.put(`/v1/kmip/clients/${id}/source-cidrs`, {
+            allowedSourceCidrs,
+        });
+        spinner.stop();
+        if (options.json) {
+            output.json(response);
+            return;
+        }
+        if (allowedSourceCidrs.length > 0) {
+            output.success(`Source-IP allowlist set for '${response.name ?? id}': ${allowedSourceCidrs.join(', ')}`);
+        }
+        else {
+            output.success(`Source-IP allowlist cleared for '${response.name ?? id}' (no restriction)`);
+        }
+    }
+    catch (err) {
+        spinner.fail('Failed to set KMIP client source-IP allowlist');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+export async function revokeClient(id, options) {
+    const spinner = output.spinner(`Revoking KMIP client ${id}...`).start();
+    try {
+        const response = await client.post(`/v1/kmip/clients/${id}/revoke`, {});
+        spinner.stop();
+        if (options.json) {
+            output.json(response);
+            return;
+        }
+        output.success(`KMIP client '${response.name ?? id}' revoked`);
+    }
+    catch (err) {
+        spinner.fail('Failed to revoke KMIP client');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=clients.js.map

package/dist/commands/kmip/clients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clients.js","sourceRoot":"","sources":["../../../src/commands/kmip/clients.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,mCAAmC;AAEnC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAU9C,kFAAkF;AAClF,SAAS,aAAa,CAAC,GAAuB;IAC5C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,OAAsB;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,yBAAyB,IAAI,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,kBAAkB,GAAG,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAA2B,kBAAkB,EAAE;YAC/E,IAAI;YACJ,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,GAAG,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,EAAE,CAAC;QAEf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,gBAAgB,IAAI,WAAW,CAAC,CAAC;QAChD,MAAM,CAAC,QAAQ,CAAC;YACd,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,WAAW,EAAE,QAAQ,CAAC,eAAe;YACrC,SAAS,EAAE,QAAQ,CAAC,YAAY,IAAI,GAAG;SACxC,CAAC,CAAC;QAEH,iFAAiF;QACjF,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,IAAI,EAAE,CAAC;QAChD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9E,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,qBAAqB,GAAG,oCAAoC,CAAC,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;IACnG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA2B;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,KAAK,EAAE,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAgC,kBAAkB,CAAC,CAAC;QACrF,OAAO,CAAC,IAAI,EAAE,CAAC;QAEf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,CAAC,EACzD,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACxB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM;YACR,GAAG,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG;YACpC,CAAC,CAAC,UAAU,IAAI,GAAG;YACnB,CAAC,CAAC,YAAY,IAAI,GAAG;SACtB,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAU,EACV,KAAa,EACb,OAA2B;IAE3B,MAAM,kBAAkB,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,wCAAwC,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/F,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAa,oBAAoB,EAAE,eAAe,EAAE;YACnF,kBAAkB;SACnB,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,OAAO,CAAC,gCAAgC,QAAQ,CAAC,IAAI,IAAI,EAAE,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3G,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,OAAO,CAAC,oCAAoC,QAAQ,CAAC,IAAI,IAAI,EAAE,oBAAoB,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU,EAAE,OAA2B;IACxE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAa,oBAAoB,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACpF,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,gBAAgB,QAAQ,CAAC,IAAI,IAAI,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/commands/kmip/index.d.ts

@@ -0,0 +1,6 @@
+import { type Command } from 'commander';
+export * from './types.js';
+export declare function registerKmipCommands(program: Command): void;
+/** Superadmin-context KMIP commands (enable / reissue). Registered under `superadmin kmip`. */
+export declare function registerKmipSuperadminCommands(parent: Command): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/kmip/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/kmip/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,cAAc,YAAY,CAAC;AAE3B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsD3D;AAED,+FAA+F;AAC/F,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CASpE"}

package/dist/commands/kmip/index.js

@@ -0,0 +1,66 @@
+// Path: src/commands/kmip/index.ts
+// `znvault kmip` command registration.
+import { createClient, listClients, revokeClient, setSourceCidrs } from './clients.js';
+import { listObjects, getStatus } from './objects.js';
+import { enableKmip, reissueServerCert } from './admin.js';
+export * from './types.js';
+export function registerKmipCommands(program) {
+    const kmip = program
+        .command('kmip')
+        .description('KMIP server (Synology encryption key vault) management')
+        .addHelpText('after', `
+Examples:
+  # Check KMIP service status
+  znvault kmip status
+
+  # Create a client and write the DSM bundle (client.key/client.crt/ca.crt)
+  znvault kmip client create nas-rack-1 --output-dir ./nas-rack-1
+
+  # List and revoke clients
+  znvault kmip client list
+  znvault kmip client revoke CLIENT_ID
+
+  # List managed objects (volume keys), metadata only
+  znvault kmip object list
+
+  # Superadmin: enable KMIP (one-time PKI init) / re-issue the server cert
+  znvault superadmin kmip enable
+  znvault superadmin kmip reissue-server-cert --yes
+`);
+    kmip.command('status').description('Show KMIP service status').option('--json', 'Output as JSON').action(getStatus);
+    const clientCmd = kmip.command('client').description('Manage KMIP clients');
+    clientCmd
+        .command('create <name>')
+        .description('Create a KMIP client and download its certificate bundle')
+        .option('--description <text>', 'Optional description')
+        .option('--output-dir <dir>', 'Directory to write client.key/client.crt/ca.crt (default: kmip-<name>)')
+        .option('--allowed-cidrs <cidrs>', 'Comma-separated source-IP allowlist (e.g. "192.168.50.4/32"). Defense-in-depth on top of mTLS; empty = no restriction')
+        .option('--json', 'Output as JSON (includes the private key)')
+        .action(createClient);
+    clientCmd.command('list').description('List KMIP clients').option('--json', 'Output as JSON').action(listClients);
+    clientCmd
+        .command('set-cidrs <id> <cidrs>')
+        .description('Set a client source-IP allowlist (comma-separated CIDRs; empty string clears it)')
+        .option('--json', 'Output as JSON')
+        .action(setSourceCidrs);
+    clientCmd
+        .command('revoke <id>')
+        .description('Revoke a KMIP client')
+        .option('--json', 'Output as JSON')
+        .action(revokeClient);
+    const objectCmd = kmip.command('object').description('Inspect KMIP managed objects (metadata only)');
+    objectCmd.command('list').description('List KMIP objects').option('--json', 'Output as JSON').action(listObjects);
+    return;
+}
+/** Superadmin-context KMIP commands (enable / reissue). Registered under `superadmin kmip`. */
+export function registerKmipSuperadminCommands(parent) {
+    const kmip = parent.command('kmip').description('KMIP server administration');
+    kmip.command('enable').description('Initialize KMIP PKI and start the listener').option('--json', 'Output as JSON').action(enableKmip);
+    kmip
+        .command('reissue-server-cert')
+        .description('Re-issue the KMIP server certificate (fleet-wide recovery event)')
+        .option('-y, --yes', 'Skip the confirmation prompt')
+        .option('--json', 'Output as JSON')
+        .action(reissueServerCert);
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/kmip/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/kmip/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,uCAAuC;AAGvC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE3D,cAAc,YAAY,CAAC;AAE3B,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,wDAAwD,CAAC;SACrE,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;CAkBzB,CAAC,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEpH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAC5E,SAAS;SACN,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;SACtD,MAAM,CAAC,oBAAoB,EAAE,wEAAwE,CAAC;SACtG,MAAM,CACL,yBAAyB,EACzB,uHAAuH,CACxH;SACA,MAAM,CAAC,QAAQ,EAAE,2CAA2C,CAAC;SAC7D,MAAM,CAAC,YAAY,CAAC,CAAC;IACxB,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAClH,SAAS;SACN,OAAO,CAAC,wBAAwB,CAAC;SACjC,WAAW,CAAC,kFAAkF,CAAC;SAC/F,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1B,SAAS;SACN,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,sBAAsB,CAAC;SACnC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,YAAY,CAAC,CAAC;IAExB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,8CAA8C,CAAC,CAAC;IACrG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAElH,OAAO;AACT,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,8BAA8B,CAAC,MAAe;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC;IAC9E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,4CAA4C,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvI,IAAI;SACD,OAAO,CAAC,qBAAqB,CAAC;SAC9B,WAAW,CAAC,kEAAkE,CAAC;SAC/E,MAAM,CAAC,WAAW,EAAE,8BAA8B,CAAC;SACnD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC"}

package/dist/commands/kmip/objects.d.ts

@@ -0,0 +1,7 @@
+export declare function listObjects(options: {
+    json?: boolean;
+}): Promise<void>;
+export declare function getStatus(options: {
+    json?: boolean;
+}): Promise<void>;
+//# sourceMappingURL=objects.d.ts.map

package/dist/commands/kmip/objects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"objects.d.ts","sourceRoot":"","sources":["../../../src/commands/kmip/objects.ts"],"names":[],"mappings":"AAOA,wBAAsB,WAAW,CAAC,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA2B5E;AAED,wBAAsB,SAAS,CAAC,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB1E"}

package/dist/commands/kmip/objects.js

@@ -0,0 +1,58 @@
+// Path: src/commands/kmip/objects.ts
+// KMIP managed-object commands (metadata only).
+import { client } from '../../lib/client.js';
+import * as output from '../../lib/output.js';
+export async function listObjects(options) {
+    const spinner = output.spinner('Fetching KMIP objects...').start();
+    try {
+        const response = await client.get('/v1/kmip/objects');
+        spinner.stop();
+        if (options.json) {
+            output.json(response);
+            return;
+        }
+        if (response.items.length === 0) {
+            output.info('No KMIP objects.');
+            return;
+        }
+        output.table(['ID', 'Type', 'State', 'Names'], response.items.map((o) => [
+            `${o.id.slice(0, 8)}…`,
+            o.objectType,
+            o.state,
+            o.names.join(', ') || '-',
+        ]));
+    }
+    catch (err) {
+        spinner.fail('Failed to list KMIP objects');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+export async function getStatus(options) {
+    const spinner = output.spinner('Fetching KMIP status...').start();
+    try {
+        const response = await client.get('/v1/kmip/config');
+        spinner.stop();
+        if (options.json) {
+            output.json(response);
+            return;
+        }
+        output.keyValue({
+            'Listener Enabled': String(response.listener.enabled),
+            'Listening': String(response.listener.listening),
+            'Port': String(response.listener.port),
+            'PKI Initialized': String(response.pkiInitialized),
+            'Server Cert Expires': response.serverCertNotAfter ?? '-',
+            'Days To Expiry': response.serverCertDaysToExpiry === null ? '-' : String(response.serverCertDaysToExpiry),
+        });
+        if (!response.pkiInitialized) {
+            output.info('PKI not initialized. A superadmin must run: znvault superadmin kmip enable');
+        }
+    }
+    catch (err) {
+        spinner.fail('Failed to get KMIP status');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=objects.js.map

package/dist/commands/kmip/objects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"objects.js","sourceRoot":"","sources":["../../../src/commands/kmip/objects.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,gDAAgD;AAEhD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAG9C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA2B;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,KAAK,EAAE,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAgC,kBAAkB,CAAC,CAAC;QACrF,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,MAAM,CAAC,KAAK,CACV,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,EAChC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACxB,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG;YACtB,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG;SAC1B,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA2B;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,KAAK,EAAE,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAmB,iBAAiB,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,CAAC,QAAQ,CAAC;YACd,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YACrD,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;YAChD,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;YACtC,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;YAClD,qBAAqB,EAAE,QAAQ,CAAC,kBAAkB,IAAI,GAAG;YACzD,gBAAgB,EAAE,QAAQ,CAAC,sBAAsB,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC;SAC3G,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/commands/kmip/types.d.ts

@@ -0,0 +1,59 @@
+export interface KmipClient {
+    id: string;
+    name: string;
+    description: string | null;
+    certFingerprint: string;
+    certSerial: string | null;
+    certNotAfter: string | null;
+    status: string;
+    createdBy: string | null;
+    createdAt: string;
+    revokedAt: string | null;
+    lastSeenAt: string | null;
+    lastSeenIp: string | null;
+    allowedSourceCidrs?: string[];
+}
+export interface KmipClientBundle {
+    clientKeyPem: string;
+    clientCertPem: string;
+    caCertPem: string;
+}
+export interface KmipClientCreateResponse extends KmipClient {
+    bundle: KmipClientBundle;
+}
+export interface KmipObject {
+    id: string;
+    objectType: string;
+    secretDataType: string | null;
+    keyFormatType: string;
+    state: string;
+    names: string[];
+    clientId: string | null;
+    cryptographicUsageMask: number;
+    initialDate: string | null;
+    activationDate: string | null;
+    deactivationDate: string | null;
+    compromiseDate: string | null;
+    destroyDate: string | null;
+}
+export interface KmipConfigStatus {
+    listener: {
+        enabled: boolean;
+        listening: boolean;
+        port: number;
+    };
+    pkiInitialized: boolean;
+    caCertPem: string | null;
+    serverCertNotAfter: string | null;
+    serverCertDaysToExpiry: number | null;
+}
+export interface PaginatedResponse<T> {
+    items: T[];
+    pagination: {
+        total: number;
+        limit: number;
+        offset: number;
+        hasMore: boolean;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/commands/kmip/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/commands/kmip/types.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAyB,SAAQ,UAAU;IAC1D,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,UAAU,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CAChF"}

package/dist/commands/kmip/types.js

@@ -0,0 +1,4 @@
+// Path: src/commands/kmip/types.ts
+// Types for the `znvault kmip` command group (Synology encryption key vault).
+export {};
+//# sourceMappingURL=types.js.map

package/dist/commands/kmip/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/commands/kmip/types.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,8EAA8E"}

package/dist/commands/lmk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lmk.d.ts","sourceRoot":"","sources":["../../src/commands/lmk.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AA+FzC,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAgO1D"}
+{"version":3,"file":"lmk.d.ts","sourceRoot":"","sources":["../../src/commands/lmk.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAwHzC,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoV1D"}

package/dist/commands/lmk.js

@@ -186,6 +186,107 @@ export function registerLmkCommands(program) {
         }
         output.success(result.message);
     });
+    // -------------------------------------------------------------------------
+    // lmk upgrade-root-ca (R-LMK-005)
+    // -------------------------------------------------------------------------
+    lmk
+        .command('upgrade-root-ca')
+        .description('Upgrade the Vault Root CA private key from the legacy raw-LMK envelope ' +
+        'to the rotation-safe system-DEK (v2) envelope (R-LMK-005). Run ONCE, ' +
+        'after the whole fleet is on >= v1.45.3. Idempotent. An LMK rotation is ' +
+        'refused until this has run.')
+        .option('--json', 'Output as JSON')
+        .action(async (options) => {
+        const spinner = output.spinner('Upgrading root CA key envelope...').start();
+        try {
+            const result = await client.post('/v1/admin/root-ca/upgrade-key-envelope', {});
+            spinner.stop();
+            if (options.json === true) {
+                output.json(result);
+                return;
+            }
+            switch (result.result) {
+                case 'upgraded':
+                    output.success('Root CA private key upgraded to the rotation-safe system-DEK (v2) ' +
+                        'envelope. LMK rotation is now permitted.');
+                    break;
+                case 'already-v2':
+                    output.info('Root CA is already on the v2 envelope — nothing to do.');
+                    break;
+                case 'no-root-ca':
+                    output.warn('No active root CA found — nothing to upgrade.');
+                    break;
+            }
+        }
+        catch (err) {
+            spinner.fail('Failed to upgrade root CA key envelope');
+            throw err;
+        }
+    });
+    // -------------------------------------------------------------------------
+    // lmk reissue-root-ca (INC-2026-06-13-01 recovery)
+    // -------------------------------------------------------------------------
+    lmk
+        .command('reissue-root-ca')
+        .description('Reissue the Vault Root CA: mint a NEW root, archive the old (ROTATED), ' +
+        'and re-sign active intermediates under the new root. Use when the current ' +
+        'root private key is unrecoverable. Defaults to a DRY-RUN plan; pass --apply ' +
+        'to execute. --force reissues a healthy root (new trust anchor — disruptive).')
+        .option('--apply', 'Execute the reissue (default is a dry-run plan)')
+        .option('--force', 'Reissue even if the current root key is still healthy')
+        .option('--fingerprint <fp>', 'Current active root fingerprint (auto-fetched if omitted)')
+        .option('--json', 'Output as JSON')
+        .action(async (options) => {
+        // Resolve the current active root fingerprint (auto-fetch unless provided).
+        let fingerprint = options.fingerprint;
+        if (fingerprint === undefined || fingerprint === '') {
+            const info = await client.get('/v1/pki/root-ca/info');
+            fingerprint = info.fingerprintSha256;
+            if (fingerprint === undefined || fingerprint === '') {
+                output.error('Could not determine the active root CA fingerprint; pass --fingerprint.');
+                return;
+            }
+        }
+        const apply = options.apply === true;
+        const spinner = output
+            .spinner(apply ? 'Reissuing root CA...' : 'Planning root CA reissue (dry-run)...')
+            .start();
+        try {
+            const result = await client.post('/v1/superadmin/root-ca/reissue', {
+                dryRun: !apply,
+                confirmFingerprint: fingerprint,
+                confirm: 'REISSUE-ROOT-CA',
+                force: options.force === true,
+            });
+            spinner.stop();
+            if (options.json === true) {
+                output.json(result);
+                return;
+            }
+            output.section(result.applied ? 'Root CA Reissued' : 'Root CA Reissue Plan (dry-run)');
+            output.keyValue({
+                'Old root fingerprint': result.plan.oldRoot.fingerprint,
+                'Old root unrecoverable': String(result.plan.oldRoot.unrecoverable),
+                'New root subject': result.plan.newRoot.subjectDn,
+                'New root key type': result.plan.newRoot.keyType,
+                'Intermediates re-signed': result.plan.intermediates.length,
+            });
+            for (const im of result.plan.intermediates) {
+                output.info(`  ${im.caId} (tenant ${im.tenantId}) chainVerified=${String(im.chainVerified)}`);
+            }
+            if (result.applied) {
+                output.success('Reissue applied. Re-distribute the new root cert (GET /v1/pki/root-ca/cert) ' +
+                    'to any external trust stores. LMK rotation is now permitted.');
+            }
+            else {
+                output.info('Dry-run only — nothing was written. Re-run with --apply to execute.');
+            }
+        }
+        catch (err) {
+            spinner.fail('Root CA reissue failed');
+            throw err;
+        }
+    });
 }
 // ---------------------------------------------------------------------------
 // Shared start handler — used by both `lmk rotation start` and the

package/dist/commands/lmk.js.map

@@ -1 +1 @@
-{"version":3,"file":"lmk.js","sourceRoot":"","sources":["../../src/commands/lmk.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,qCAAqC;AACrC,EAAE;AACF,4CAA4C;AAC5C,4EAA4E;AAC5E,gDAAgD;AAChD,0CAA0C;AAC1C,qDAAqD;AACrD,4DAA4D;AAC5D,EAAE;AACF,qEAAqE;AAIrE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AA2FlD,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,GAAG,GAAG,OAAO;SAChB,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,4CAA4C,CAAC,CAAC;IAE7D,MAAM,QAAQ,GAAG,GAAG;SACjB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,yBAAyB,CAAC,CAAC;IAE1C,4EAA4E;IAC5E,qBAAqB;IACrB,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CACV,oEAAoE;QACpE,4DAA4D,CAC7D;SACA,MAAM,CAAC,0BAA0B,EAAE,yDAAyD,CAAC;SAC7F,MAAM,CACL,UAAU,EACV,kEAAkE;QAClE,2EAA2E,CAC5E;SACA,MAAM,CAAC,aAAa,EAAE,0BAA0B,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAsB,EAAE,EAAE;QACvC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,yDAAyD;IACzD,4EAA4E;IAC5E,GAAG;SACA,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,gCAAgC,CAAC;SAC7C,MAAM,CAAC,0BAA0B,EAAE,yDAAyD,CAAC;SAC7F,MAAM,CAAC,UAAU,EAAE,qDAAqD,CAAC;SACzE,MAAM,CAAC,aAAa,EAAE,0BAA0B,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAsB,EAAE,EAAE;QACvC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,sBAAsB;IACtB,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,yEAAyE;QACzE,uEAAuE;QACvE,iBAAiB,CAClB;SACA,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAmB,EAAE,EAAE;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,KAAK,EAAE,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,+BAA+B,EAC/B,EAAE,CACH,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YACvC,MAAM,CAAC,QAAQ,CAAC;gBACd,aAAa,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG;gBACvC,kBAAkB,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG;gBAC7C,gBAAgB,EAAE,MAAM,CAAC,SAAS,IAAI,GAAG;gBACzC,YAAY,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC;gBAC/B,sBAAsB,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;gBAC5C,wBAAwB,EAAE,MAAM,CAAC,OAAO,IAAI,CAAC;gBAC7C,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;aAC7B,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CACT,oEAAoE;oBACpE,8DAA8D;oBAC9D,mCAAmC,CACpC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,OAAO,CACZ,kEAAkE;oBAClE,kBAAkB,CACnB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC9C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,oBAAoB;IACpB,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gCAAgC,CAAC;SAC7C,MAAM,CAAC,aAAa,EAAE,wBAAwB,CAAC;SAC/C,MAAM,CAAC,cAAc,EAAE,yBAAyB,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAoB,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,KAAK,GAAG,UAAU,KAAK,WAAW,MAAM,EAAE,CAAC;QAEjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAC7B,0BAA0B,KAAK,EAAE,CAClC,CAAC;QAEF,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,kBAAkB,MAAM,CAAC,SAAS,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;QAC7E,MAAM,CAAC,KAAK,CACV,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE,SAAS,EAAE,IAAI,CAAC,EAChF,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC1B,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,MAAM;YACR,GAAG,CAAC,CAAC,aAAa,MAAM,CAAC,CAAC,aAAa,EAAE;YACzC,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,EAAE;YAClD,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9B,CAAC,CAAC,WAAW,IAAI,GAAG;SACrB,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,iCAAiC;IACjC,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,wCAAwC,CAAC;SACrD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,OAAmB,EAAE,EAAE;QACxD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAC7B,0BAA0B,UAAU,EAAE,CACvC,CAAC;QAEF,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,gBAAgB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,QAAQ,CAAC;YACd,QAAQ,EAAE,MAAM,CAAC,MAAM;YACvB,iBAAiB,EAAE,MAAM,CAAC,aAAa;YACvC,iBAAiB,EAAE,MAAM,CAAC,aAAa;YACvC,YAAY,EAAE,MAAM,CAAC,SAAS;YAC9B,eAAe,EAAE,MAAM,CAAC,YAAY;YACpC,aAAa,EAAE,MAAM,CAAC,UAAU;YAChC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;YAC9C,WAAW,EAAE,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG;YAC3F,aAAa,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG;YACxC,cAAc,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG;SAC1C,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,iEAAiE,CAAC,CAAC;QACxG,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,mCAAmC;IACnC,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,qBAAqB,CAAC;SAC9B,WAAW,CACV,yEAAyE;QACzE,qEAAqE;QACrE,sBAAsB,CACvB;SACA,MAAM,CAAC,qBAAqB,EAAE,mDAAmD,CAAC;SAClF,MAAM,CAAC,aAAa,EAAE,0BAA0B,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,OAAsB,EAAE,EAAE;QAC3D,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CACT,iEAAiE;gBACjE,gEAAgE;gBAChE,+DAA+D,CAChE,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,mBAAmB,UAAU,GAAG,EAChC,KAAK,CACN,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,0BAA0B,UAAU,SAAS,EAC7C,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,+BAA+B,EAAE,CAC9D,CAAC;QAEF,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,8EAA8E;AAC9E,mEAAmE;AACnE,gCAAgC;AAChC,8EAA8E;AAC9E,KAAK,UAAU,QAAQ,CAAC,OAAsB;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC;IAE1C,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CACT,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,oBAAoB,CACrB,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,oEAAoE;gBACpE,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,SAAS;YACP,CAAC,CAAC,2CAA2C;YAC7C,CAAC,CAAC,4CAA4C,EAChD,KAAK,CACN,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM;SACnB,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,4BAA4B,CAAC;SACrG,KAAK,EAAE,CAAC;IAEX,IAAI,CAAC;QACH,MAAM,IAAI,GAAiD,EAAE,SAAS,EAAE,CAAC;QACzE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACzC,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,sBAAsB,EACtB,IAAI,CACL,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;YACxC,MAAM,CAAC,QAAQ,CAAC;gBACd,aAAa,EAAE,MAAM,CAAC,UAAU;gBAChC,iBAAiB,EAAE,MAAM,CAAC,aAAa;gBACvC,QAAQ,EAAE,MAAM,CAAC,MAAM;gBACvB,eAAe,EAAE,MAAM,CAAC,YAAY,IAAI,CAAC;gBACzC,aAAa,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;aACtC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CACT,oDAAoD;oBACpD,0DAA0D;oBAC1D,qEAAqE,CACtE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,OAAO,CACZ,sBAAsB,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,oBAAoB;oBACtE,+BAA+B,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,sBAAsB,EACtB,IAAI,CACL,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;YACvD,MAAM,CAAC,QAAQ,CAAC;gBACd,aAAa,EAAE,MAAM,CAAC,UAAU;gBAChC,iBAAiB,EAAE,MAAM,CAAC,aAAa;gBACvC,QAAQ,EAAE,MAAM,CAAC,MAAM;gBACvB,iBAAiB,EAAE,MAAM,CAAC,aAAa,IAAI,CAAC;aAC7C,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CACT,qEAAqE;gBACrE,uEAAuE;gBACvE,sBAAsB,CACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACpC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"lmk.js","sourceRoot":"","sources":["../../src/commands/lmk.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,qCAAqC;AACrC,EAAE;AACF,4CAA4C;AAC5C,4EAA4E;AAC5E,gDAAgD;AAChD,0CAA0C;AAC1C,qDAAqD;AACrD,4DAA4D;AAC5D,EAAE;AACF,qEAAqE;AAIrE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAoHlD,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,GAAG,GAAG,OAAO;SAChB,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,4CAA4C,CAAC,CAAC;IAE7D,MAAM,QAAQ,GAAG,GAAG;SACjB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,yBAAyB,CAAC,CAAC;IAE1C,4EAA4E;IAC5E,qBAAqB;IACrB,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CACV,oEAAoE;QACpE,4DAA4D,CAC7D;SACA,MAAM,CAAC,0BAA0B,EAAE,yDAAyD,CAAC;SAC7F,MAAM,CACL,UAAU,EACV,kEAAkE;QAClE,2EAA2E,CAC5E;SACA,MAAM,CAAC,aAAa,EAAE,0BAA0B,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAsB,EAAE,EAAE;QACvC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,yDAAyD;IACzD,4EAA4E;IAC5E,GAAG;SACA,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,gCAAgC,CAAC;SAC7C,MAAM,CAAC,0BAA0B,EAAE,yDAAyD,CAAC;SAC7F,MAAM,CAAC,UAAU,EAAE,qDAAqD,CAAC;SACzE,MAAM,CAAC,aAAa,EAAE,0BAA0B,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAsB,EAAE,EAAE;QACvC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,sBAAsB;IACtB,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,yEAAyE;QACzE,uEAAuE;QACvE,iBAAiB,CAClB;SACA,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAmB,EAAE,EAAE;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,KAAK,EAAE,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,+BAA+B,EAC/B,EAAE,CACH,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YACvC,MAAM,CAAC,QAAQ,CAAC;gBACd,aAAa,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG;gBACvC,kBAAkB,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG;gBAC7C,gBAAgB,EAAE,MAAM,CAAC,SAAS,IAAI,GAAG;gBACzC,YAAY,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC;gBAC/B,sBAAsB,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;gBAC5C,wBAAwB,EAAE,MAAM,CAAC,OAAO,IAAI,CAAC;gBAC7C,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;aAC7B,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CACT,oEAAoE;oBACpE,8DAA8D;oBAC9D,mCAAmC,CACpC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,OAAO,CACZ,kEAAkE;oBAClE,kBAAkB,CACnB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC9C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,oBAAoB;IACpB,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gCAAgC,CAAC;SAC7C,MAAM,CAAC,aAAa,EAAE,wBAAwB,CAAC;SAC/C,MAAM,CAAC,cAAc,EAAE,yBAAyB,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAoB,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,KAAK,GAAG,UAAU,KAAK,WAAW,MAAM,EAAE,CAAC;QAEjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAC7B,0BAA0B,KAAK,EAAE,CAClC,CAAC;QAEF,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,kBAAkB,MAAM,CAAC,SAAS,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;QAC7E,MAAM,CAAC,KAAK,CACV,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE,SAAS,EAAE,IAAI,CAAC,EAChF,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC1B,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,MAAM;YACR,GAAG,CAAC,CAAC,aAAa,MAAM,CAAC,CAAC,aAAa,EAAE;YACzC,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,EAAE;YAClD,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9B,CAAC,CAAC,WAAW,IAAI,GAAG;SACrB,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,iCAAiC;IACjC,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,wCAAwC,CAAC;SACrD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,OAAmB,EAAE,EAAE;QACxD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAC7B,0BAA0B,UAAU,EAAE,CACvC,CAAC;QAEF,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,gBAAgB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,QAAQ,CAAC;YACd,QAAQ,EAAE,MAAM,CAAC,MAAM;YACvB,iBAAiB,EAAE,MAAM,CAAC,aAAa;YACvC,iBAAiB,EAAE,MAAM,CAAC,aAAa;YACvC,YAAY,EAAE,MAAM,CAAC,SAAS;YAC9B,eAAe,EAAE,MAAM,CAAC,YAAY;YACpC,aAAa,EAAE,MAAM,CAAC,UAAU;YAChC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;YAC9C,WAAW,EAAE,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG;YAC3F,aAAa,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG;YACxC,cAAc,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG;SAC1C,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,iEAAiE,CAAC,CAAC;QACxG,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,mCAAmC;IACnC,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,qBAAqB,CAAC;SAC9B,WAAW,CACV,yEAAyE;QACzE,qEAAqE;QACrE,sBAAsB,CACvB;SACA,MAAM,CAAC,qBAAqB,EAAE,mDAAmD,CAAC;SAClF,MAAM,CAAC,aAAa,EAAE,0BAA0B,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,OAAsB,EAAE,EAAE;QAC3D,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CACT,iEAAiE;gBACjE,gEAAgE;gBAChE,+DAA+D,CAChE,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,mBAAmB,UAAU,GAAG,EAChC,KAAK,CACN,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,0BAA0B,UAAU,SAAS,EAC7C,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,+BAA+B,EAAE,CAC9D,CAAC;QAEF,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,kCAAkC;IAClC,4EAA4E;IAC5E,GAAG;SACA,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CACV,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,6BAA6B,CAC9B;SACA,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAmB,EAAE,EAAE;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC5E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,wCAAwC,EACxC,EAAE,CACH,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,KAAK,UAAU;oBACb,MAAM,CAAC,OAAO,CACZ,oEAAoE;wBACpE,0CAA0C,CAC3C,CAAC;oBACF,MAAM;gBACR,KAAK,YAAY;oBACf,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;oBACtE,MAAM;gBACR,KAAK,YAAY;oBACf,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;oBAC7D,MAAM;YACV,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YACvD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,mDAAmD;IACnD,4EAA4E;IAC5E,GAAG;SACA,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CACV,yEAAyE;QACzE,4EAA4E;QAC5E,8EAA8E;QAC9E,8EAA8E,CAC/E;SACA,MAAM,CAAC,SAAS,EAAE,iDAAiD,CAAC;SACpE,MAAM,CAAC,SAAS,EAAE,uDAAuD,CAAC;SAC1E,MAAM,CAAC,oBAAoB,EAAE,2DAA2D,CAAC;SACzF,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAuB,EAAE,EAAE;QACxC,4EAA4E;QAC5E,IAAI,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACtC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAiC,sBAAsB,CAAC,CAAC;YACtF,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACrC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;gBACpD,MAAM,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM;aACnB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,uCAAuC,CAAC;aACjF,KAAK,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAwB,gCAAgC,EAAE;gBACxF,MAAM,EAAE,CAAC,KAAK;gBACd,kBAAkB,EAAE,WAAW;gBAC/B,OAAO,EAAE,iBAAiB;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI;aAC9B,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC;YACvF,MAAM,CAAC,QAAQ,CAAC;gBACd,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;gBACvD,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;gBACnE,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;gBACjD,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;gBAChD,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM;aAC5D,CAAC,CAAC;YACH,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,YAAY,EAAE,CAAC,QAAQ,mBAAmB,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,OAAO,CACZ,8EAA8E;oBAC9E,8DAA8D,CAC/D,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACvC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,8EAA8E;AAC9E,mEAAmE;AACnE,gCAAgC;AAChC,8EAA8E;AAC9E,KAAK,UAAU,QAAQ,CAAC,OAAsB;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC;IAE1C,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CACT,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,oBAAoB,CACrB,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,oEAAoE;gBACpE,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,SAAS;YACP,CAAC,CAAC,2CAA2C;YAC7C,CAAC,CAAC,4CAA4C,EAChD,KAAK,CACN,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM;SACnB,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,4BAA4B,CAAC;SACrG,KAAK,EAAE,CAAC;IAEX,IAAI,CAAC;QACH,MAAM,IAAI,GAAiD,EAAE,SAAS,EAAE,CAAC;QACzE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACzC,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,sBAAsB,EACtB,IAAI,CACL,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;YACxC,MAAM,CAAC,QAAQ,CAAC;gBACd,aAAa,EAAE,MAAM,CAAC,UAAU;gBAChC,iBAAiB,EAAE,MAAM,CAAC,aAAa;gBACvC,QAAQ,EAAE,MAAM,CAAC,MAAM;gBACvB,eAAe,EAAE,MAAM,CAAC,YAAY,IAAI,CAAC;gBACzC,aAAa,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;aACtC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CACT,oDAAoD;oBACpD,0DAA0D;oBAC1D,qEAAqE,CACtE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,OAAO,CACZ,sBAAsB,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,oBAAoB;oBACtE,+BAA+B,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,sBAAsB,EACtB,IAAI,CACL,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;YACvD,MAAM,CAAC,QAAQ,CAAC;gBACd,aAAa,EAAE,MAAM,CAAC,UAAU;gBAChC,iBAAiB,EAAE,MAAM,CAAC,aAAa;gBACvC,QAAQ,EAAE,MAAM,CAAC,MAAM;gBACvB,iBAAiB,EAAE,MAAM,CAAC,aAAa,IAAI,CAAC;aAC7C,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CACT,qEAAqE;gBACrE,uEAAuE;gBACvE,sBAAsB,CACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACpC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}