@zwave-js/cc 14.0.0-beta.4 → 14.0.0-beta.5

package/build/cjs/cc/SecurityCC.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/cc/SecurityCC.ts"],
-  "sourcesContent": ["import {\n\tCommandClasses,\n\tEncapsulationFlags,\n\ttype MessageOrCCLogEntry,\n\tMessagePriority,\n\ttype MessageRecord,\n\tSecurityClass,\n\ttype SecurityManager,\n\tTransmitOptions,\n\ttype WithAddress,\n\tZWaveError,\n\tZWaveErrorCodes,\n\tcomputeMAC,\n\tdecryptAES128OFB,\n\tencodeCCList,\n\tencryptAES128OFB,\n\tgenerateAuthKey,\n\tgenerateEncryptionKey,\n\tgetCCName,\n\tisTransmissionError,\n\tparseCCList,\n\tvalidatePayload,\n} from \"@zwave-js/core\";\nimport { type MaybeNotKnown } from \"@zwave-js/core/safe\";\nimport type {\n\tCCEncodingContext,\n\tCCParsingContext,\n\tGetValueDB,\n} from \"@zwave-js/host/safe\";\nimport { Bytes } from \"@zwave-js/shared/safe\";\nimport { buffer2hex, num2hex, pick } from \"@zwave-js/shared/safe\";\nimport { wait } from \"alcalzone-shared/async/index.js\";\nimport { randomBytes } from \"node:crypto\";\nimport { CCAPI, PhysicalCCAPI } from \"../lib/API.js\";\nimport {\n\ttype CCRaw,\n\tCommandClass,\n\ttype InterviewContext,\n} from \"../lib/CommandClass.js\";\nimport {\n\tAPI,\n\tCCCommand,\n\tcommandClass,\n\texpectedCCResponse,\n\timplementedVersion,\n} from \"../lib/CommandClassDecorators.js\";\nimport { SecurityCommand } from \"../lib/_Types.js\";\nimport { CRC16CC } from \"./CRC16CC.js\";\nimport { Security2CC } from \"./Security2CC.js\";\nimport { TransportServiceCC } from \"./TransportServiceCC.js\";\n\n// @noSetValueAPI This is an encapsulation CC\n\nfunction getAuthenticationData(\n\tsenderNonce: Uint8Array,\n\treceiverNonce: Uint8Array,\n\tccCommand: SecurityCommand,\n\tsendingNodeId: number,\n\treceivingNodeId: number,\n\tencryptedPayload: Uint8Array,\n): Uint8Array {\n\treturn Bytes.concat([\n\t\tsenderNonce,\n\t\treceiverNonce,\n\t\tBytes.from([\n\t\t\tccCommand,\n\t\t\tsendingNodeId,\n\t\t\treceivingNodeId,\n\t\t\tencryptedPayload.length,\n\t\t]),\n\t\tencryptedPayload,\n\t]);\n}\n\nfunction throwNoNonce(reason?: string): never {\n\tlet message = `Security CC requires a nonce to be sent!`;\n\tif (reason) message += ` Reason: ${reason}`;\n\tthrow new ZWaveError(message, ZWaveErrorCodes.SecurityCC_NoNonce);\n}\n\nconst HALF_NONCE_SIZE = 8;\n\nfunction assertSecurityRX(\n\tctx: CCParsingContext,\n): asserts ctx is CCParsingContext & { securityManager: SecurityManager } {\n\tif (!ctx.ownNodeId) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S0) can only be decoded when the controller's node id is known!`,\n\t\t\tZWaveErrorCodes.Driver_NotReady,\n\t\t);\n\t}\n\n\tif (!ctx.securityManager) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S0) can only be decoded when the security manager is set up!`,\n\t\t\tZWaveErrorCodes.Driver_NoSecurity,\n\t\t);\n\t}\n}\n\nfunction assertSecurityTX(\n\tctx: CCEncodingContext,\n): asserts ctx is CCEncodingContext & { securityManager: SecurityManager } {\n\tif (!ctx.ownNodeId) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S0) can only be sent when the controller's node id is known!`,\n\t\t\tZWaveErrorCodes.Driver_NotReady,\n\t\t);\n\t}\n\n\tif (!ctx.securityManager) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S0) can only be sent when the security manager is set up!`,\n\t\t\tZWaveErrorCodes.Driver_NoSecurity,\n\t\t);\n\t}\n}\n\n// TODO: Ignore commands if received via multicast\n\n// Encapsulation CCs are used internally and too frequently that we\n// want to pay the cost of validating each call\n/* eslint-disable @zwave-js/ccapi-validate-args */\n\n@API(CommandClasses.Security)\nexport class SecurityCCAPI extends PhysicalCCAPI {\n\tpublic supportsCommand(_cmd: SecurityCommand): MaybeNotKnown<boolean> {\n\t\t// All commands are mandatory\n\t\treturn true;\n\t}\n\n\tpublic async sendEncapsulated(\n\t\tencapsulated: CommandClass,\n\t\trequestNextNonce: boolean = false,\n\t): Promise<void> {\n\t\tif (requestNextNonce) {\n\t\t\tthis.assertSupportsCommand(\n\t\t\t\tSecurityCommand,\n\t\t\t\tSecurityCommand.CommandEncapsulation,\n\t\t\t);\n\t\t} else {\n\t\t\tthis.assertSupportsCommand(\n\t\t\t\tSecurityCommand,\n\t\t\t\tSecurityCommand.CommandEncapsulationNonceGet,\n\t\t\t);\n\t\t}\n\n\t\tconst cc = new (\n\t\t\trequestNextNonce\n\t\t\t\t? SecurityCCCommandEncapsulationNonceGet\n\t\t\t\t: SecurityCCCommandEncapsulation\n\t\t)({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tencapsulated,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\t/**\n\t * Requests a new nonce for Security CC encapsulation which is not directly linked to a specific command.\n\t */\n\tpublic async getNonce(): Promise<Uint8Array | undefined> {\n\t\tthis.assertSupportsCommand(SecurityCommand, SecurityCommand.NonceGet);\n\n\t\tconst cc = new SecurityCCNonceGet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tconst response = await this.host.sendCommand<SecurityCCNonceReport>(\n\t\t\tcc,\n\t\t\t{\n\t\t\t\t...this.commandOptions,\n\t\t\t\t// Only try getting a nonce once\n\t\t\t\tmaxSendAttempts: 1,\n\t\t\t},\n\t\t);\n\t\tif (!response) return;\n\n\t\tconst nonce = response.nonce;\n\t\tconst secMan = this.host.securityManager!;\n\t\tsecMan.setNonce(\n\t\t\t{\n\t\t\t\tissuer: this.endpoint.nodeId,\n\t\t\t\tnonceId: secMan.getNonceId(nonce),\n\t\t\t},\n\t\t\t{ nonce, receiver: this.host.ownNodeId },\n\t\t\t{ free: true },\n\t\t);\n\t\treturn nonce;\n\t}\n\n\t/**\n\t * Responds to a NonceGet request. The message is sent without any retransmission etc.\n\t * The return value indicates whether a nonce was successfully sent\n\t */\n\tpublic async sendNonce(): Promise<boolean> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.NonceReport,\n\t\t);\n\n\t\tif (!this.host.securityManager) {\n\t\t\tthrow new ZWaveError(\n\t\t\t\t`Nonces can only be sent if secure communication is set up!`,\n\t\t\t\tZWaveErrorCodes.Driver_NoSecurity,\n\t\t\t);\n\t\t}\n\n\t\tconst nonce = this.host.securityManager.generateNonce(\n\t\t\tthis.endpoint.nodeId,\n\t\t\tHALF_NONCE_SIZE,\n\t\t);\n\t\tconst nonceId = this.host.securityManager.getNonceId(nonce);\n\n\t\tconst cc = new SecurityCCNonceReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tnonce,\n\t\t});\n\n\t\ttry {\n\t\t\tawait this.host.sendCommand(cc, {\n\t\t\t\t...this.commandOptions,\n\t\t\t\t// Seems we need these options or some nodes won't accept the nonce\n\t\t\t\ttransmitOptions: TransmitOptions.ACK\n\t\t\t\t\t| TransmitOptions.AutoRoute,\n\t\t\t\t// Only try sending a nonce once\n\t\t\t\tmaxSendAttempts: 1,\n\t\t\t\t// Nonce requests must be handled immediately\n\t\t\t\tpriority: MessagePriority.Immediate,\n\t\t\t\t// We don't want failures causing us to treat the node as asleep or dead\n\t\t\t\tchangeNodeStatusOnMissingACK: false,\n\t\t\t});\n\t\t} catch (e) {\n\t\t\tif (isTransmissionError(e)) {\n\t\t\t\t// The nonce could not be sent, invalidate it\n\t\t\t\tthis.host.securityManager.deleteNonce(nonceId);\n\t\t\t\treturn false;\n\t\t\t} else {\n\t\t\t\t// Pass other errors through\n\t\t\t\tthrow e;\n\t\t\t}\n\t\t}\n\t\treturn true;\n\t}\n\n\tpublic async getSecurityScheme(): Promise<[0]> {\n\t\tthis.assertSupportsCommand(SecurityCommand, SecurityCommand.SchemeGet);\n\n\t\tconst cc = new SecurityCCSchemeGet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t\t// There is only one scheme, so we hardcode it\n\t\treturn [0];\n\t}\n\n\tpublic async reportSecurityScheme(encapsulated: boolean): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.SchemeReport,\n\t\t);\n\n\t\tlet cc: CommandClass = new SecurityCCSchemeReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tif (encapsulated) {\n\t\t\tcc = new SecurityCCCommandEncapsulation({\n\t\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\t\tendpointIndex: this.endpoint.index,\n\t\t\t\tencapsulated: cc,\n\t\t\t});\n\t\t}\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\tpublic async inheritSecurityScheme(): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.SchemeInherit,\n\t\t);\n\n\t\tconst cc = new SecurityCCSchemeInherit({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t\t// There is only one scheme, so we don't return anything here\n\t}\n\n\tpublic async setNetworkKey(networkKey: Uint8Array): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.NetworkKeySet,\n\t\t);\n\n\t\tconst keySet = new SecurityCCNetworkKeySet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tnetworkKey,\n\t\t});\n\t\tconst cc = new SecurityCCCommandEncapsulation({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tencapsulated: keySet,\n\t\t\talternativeNetworkKey: new Uint8Array(16).fill(0),\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\tpublic async verifyNetworkKey(): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.NetworkKeyVerify,\n\t\t);\n\n\t\tconst cc = new SecurityCCNetworkKeyVerify({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\t// eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types\n\tpublic async getSupportedCommands() {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.CommandsSupportedGet,\n\t\t);\n\n\t\tconst cc = new SecurityCCCommandsSupportedGet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tconst response = await this.host.sendCommand<\n\t\t\tSecurityCCCommandsSupportedReport\n\t\t>(\n\t\t\tcc,\n\t\t\tthis.commandOptions,\n\t\t);\n\t\tif (response) {\n\t\t\treturn pick(response, [\"supportedCCs\", \"controlledCCs\"]);\n\t\t}\n\t}\n\n\tpublic async reportSupportedCommands(\n\t\tsupportedCCs: CommandClasses[],\n\t\tcontrolledCCs: CommandClasses[],\n\t): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.CommandsSupportedReport,\n\t\t);\n\n\t\tconst cc = new SecurityCCCommandsSupportedReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tsupportedCCs,\n\t\t\tcontrolledCCs,\n\t\t\treportsToFollow: 0,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n}\n\n@commandClass(CommandClasses.Security)\n@implementedVersion(1)\nexport class SecurityCC extends CommandClass {\n\tdeclare ccCommand: SecurityCommand;\n\t// Force singlecast for the Security CC\n\tdeclare nodeId: number;\n\n\tpublic async interview(\n\t\tctx: InterviewContext,\n\t): Promise<void> {\n\t\tconst node = this.getNode(ctx)!;\n\t\tconst endpoint = this.getEndpoint(ctx)!;\n\t\tconst api = CCAPI.create(\n\t\t\tCommandClasses.Security,\n\t\t\tctx,\n\t\t\tendpoint,\n\t\t).withOptions({\n\t\t\tpriority: MessagePriority.NodeQuery,\n\t\t});\n\n\t\tctx.logNode(node.id, {\n\t\t\tmessage: \"Querying securely supported commands (S0)...\",\n\t\t\tdirection: \"outbound\",\n\t\t});\n\n\t\tlet supportedCCs: CommandClasses[] | undefined;\n\t\tlet controlledCCs: CommandClasses[] | undefined;\n\n\t\t// Try up to 3 times on the root device. We REALLY don't want a spurious timeout or collision to cause us to discard a known good security class\n\t\tconst MAX_ATTEMPTS = this.endpointIndex === 0 ? 3 : 1;\n\t\tfor (let attempts = 1; attempts <= MAX_ATTEMPTS; attempts++) {\n\t\t\tconst resp = await api.getSupportedCommands();\n\t\t\tif (resp) {\n\t\t\t\tsupportedCCs = resp.supportedCCs;\n\t\t\t\tcontrolledCCs = resp.controlledCCs;\n\t\t\t\tbreak;\n\t\t\t} else if (attempts < MAX_ATTEMPTS) {\n\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\tendpoint: this.endpointIndex,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`Querying securely supported commands (S0), attempt ${attempts}/${MAX_ATTEMPTS} failed. Retrying in 500ms...`,\n\t\t\t\t\tlevel: \"warn\",\n\t\t\t\t});\n\t\t\t\tawait wait(500);\n\t\t\t}\n\t\t}\n\n\t\tif (!supportedCCs || !controlledCCs) {\n\t\t\tif (node.hasSecurityClass(SecurityClass.S0_Legacy) === true) {\n\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\tendpoint: this.endpointIndex,\n\t\t\t\t\tmessage: \"Querying securely supported commands (S0) failed\",\n\t\t\t\t\tlevel: \"warn\",\n\t\t\t\t});\n\t\t\t\t// TODO: Abort interview?\n\t\t\t} else {\n\t\t\t\t// We didn't know if the node was secure and it didn't respond,\n\t\t\t\t// assume that it doesn't have the S0 security class\n\t\t\t\tctx.logNode(\n\t\t\t\t\tnode.id,\n\t\t\t\t\t`The node was not granted the S0 security class. Continuing interview non-securely.`,\n\t\t\t\t);\n\t\t\t\tnode.setSecurityClass(SecurityClass.S0_Legacy, false);\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\n\t\tconst logLines: string[] = [\n\t\t\t\"received secure commands (S0)\",\n\t\t\t\"supported CCs:\",\n\t\t];\n\t\tfor (const cc of supportedCCs) {\n\t\t\tlogLines.push(`\u00B7 ${getCCName(cc)}`);\n\t\t}\n\t\tlogLines.push(\"controlled CCs:\");\n\t\tfor (const cc of controlledCCs) {\n\t\t\tlogLines.push(`\u00B7 ${getCCName(cc)}`);\n\t\t}\n\t\tctx.logNode(node.id, {\n\t\t\tmessage: logLines.join(\"\\n\"),\n\t\t\tdirection: \"inbound\",\n\t\t});\n\n\t\t// Remember which commands are supported securely\n\t\tfor (const cc of supportedCCs) {\n\t\t\t// Basic CC has special rules for when it is considered supported\n\t\t\t// Therefore we mark all other CCs as supported, but not Basic CC,\n\t\t\t// for which support is determined later.\n\t\t\tif (cc === CommandClasses.Basic) {\n\t\t\t\tendpoint.addCC(cc, { secure: true });\n\t\t\t} else {\n\t\t\t\tendpoint.addCC(cc, {\n\t\t\t\t\tisSupported: true,\n\t\t\t\t\tsecure: true,\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t\tfor (const cc of controlledCCs) {\n\t\t\t// Basic CC has special rules for when it is considered supported\n\t\t\t// Therefore we mark all other CCs as supported, but not Basic CC,\n\t\t\t// for which support is determined later.\n\t\t\tif (cc === CommandClasses.Basic) {\n\t\t\t\tendpoint.addCC(cc, { secure: true });\n\t\t\t} else {\n\t\t\t\tendpoint.addCC(cc, {\n\t\t\t\t\tisControlled: true,\n\t\t\t\t\tsecure: true,\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\t// We know for sure that the node is included securely\n\t\tif (node.hasSecurityClass(SecurityClass.S0_Legacy) !== true) {\n\t\t\tnode.setSecurityClass(SecurityClass.S0_Legacy, true);\n\t\t\tctx.logNode(\n\t\t\t\tnode.id,\n\t\t\t\t`The node was granted the S0 security class`,\n\t\t\t);\n\t\t}\n\n\t\t// Remember that the interview is complete\n\t\tthis.setInterviewComplete(ctx, true);\n\t}\n\n\t/** Tests if a command should be sent secure and thus requires encapsulation */\n\tpublic static requiresEncapsulation(cc: CommandClass): boolean {\n\t\t// No security flag -> no encapsulation\n\t\tif (!(cc.encapsulationFlags & EncapsulationFlags.Security)) {\n\t\t\treturn false;\n\t\t}\n\n\t\t// S2, CRC16, Transport Service -> no S2 encapsulation\n\t\tif (\n\t\t\tcc instanceof Security2CC\n\t\t\t|| cc instanceof CRC16CC\n\t\t\t|| cc instanceof TransportServiceCC\n\t\t) {\n\t\t\treturn false;\n\t\t}\n\n\t\t// S0: check command\n\t\tif (cc instanceof SecurityCC) {\n\t\t\tswitch (cc.ccCommand) {\n\t\t\t\t// Already encapsulated\n\t\t\t\tcase SecurityCommand.CommandEncapsulation:\n\t\t\t\tcase SecurityCommand.CommandEncapsulationNonceGet:\n\t\t\t\t// Cannot be sent encapsulated:\n\t\t\t\tcase SecurityCommand.NonceGet:\n\t\t\t\tcase SecurityCommand.NonceReport:\n\t\t\t\tcase SecurityCommand.SchemeGet:\n\t\t\t\tcase SecurityCommand.SchemeReport:\n\t\t\t\t\treturn false;\n\n\t\t\t\tdefault:\n\t\t\t\t\t// All other commands must be encapsulated\n\t\t\t\t\treturn true;\n\t\t\t}\n\t\t}\n\n\t\t// Everything else needs to be encapsulated if the CC is secure\n\t\treturn true;\n\t}\n\n\t/** Encapsulates a command that should be sent encrypted */\n\tpublic static encapsulate(\n\t\townNodeId: number,\n\t\tsecurityManager: SecurityManager,\n\t\tcc: CommandClass,\n\t): SecurityCCCommandEncapsulation {\n\t\t// TODO: When to return a SecurityCCCommandEncapsulationNonceGet?\n\t\tconst ret = new SecurityCCCommandEncapsulation({\n\t\t\tnodeId: cc.nodeId,\n\t\t\tencapsulated: cc,\n\t\t});\n\n\t\t// Copy the encapsulation flags from the encapsulated command\n\t\t// but omit Security, since we're doing that right now\n\t\tret.encapsulationFlags = cc.encapsulationFlags\n\t\t\t& ~EncapsulationFlags.Security;\n\n\t\treturn ret;\n\t}\n}\n\ninterface SecurityCCNonceReportOptions {\n\tnonce: Uint8Array;\n}\n\n@CCCommand(SecurityCommand.NonceReport)\nexport class SecurityCCNonceReport extends SecurityCC {\n\tconstructor(\n\t\toptions: WithAddress<SecurityCCNonceReportOptions>,\n\t) {\n\t\tsuper(options);\n\t\tif (options.nonce.length !== HALF_NONCE_SIZE) {\n\t\t\tthrow new ZWaveError(\n\t\t\t\t`Nonce must have length ${HALF_NONCE_SIZE}!`,\n\t\t\t\tZWaveErrorCodes.Argument_Invalid,\n\t\t\t);\n\t\t}\n\t\tthis.nonce = options.nonce;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCNonceReport {\n\t\tvalidatePayload.withReason(\"Invalid nonce length\")(\n\t\t\traw.payload.length === HALF_NONCE_SIZE,\n\t\t);\n\n\t\treturn new SecurityCCNonceReport({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tnonce: raw.payload,\n\t\t});\n\t}\n\n\tpublic nonce: Uint8Array;\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = Bytes.view(this.nonce);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: { nonce: buffer2hex(this.nonce) },\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.NonceGet)\n@expectedCCResponse(SecurityCCNonceReport)\nexport class SecurityCCNonceGet extends SecurityCC {}\n\n// @publicAPI\nexport type SecurityCCCommandEncapsulationOptions =\n\t& {\n\t\talternativeNetworkKey?: Uint8Array;\n\t}\n\t& ({\n\t\tencapsulated: CommandClass;\n\t} | {\n\t\tdecryptedCCBytes: Uint8Array;\n\t\tsequenced: boolean;\n\t\tsecondFrame: boolean;\n\t\tsequenceCounter: number;\n\t});\n\nfunction getCCResponseForCommandEncapsulation(\n\tsent: SecurityCCCommandEncapsulation,\n) {\n\tif (sent.encapsulated.expectsCCResponse()) {\n\t\treturn SecurityCCCommandEncapsulation;\n\t}\n}\n\n@CCCommand(SecurityCommand.CommandEncapsulation)\n@expectedCCResponse(\n\tgetCCResponseForCommandEncapsulation,\n\t() => \"checkEncapsulated\",\n)\nexport class SecurityCCCommandEncapsulation extends SecurityCC {\n\tpublic constructor(\n\t\toptions: WithAddress<SecurityCCCommandEncapsulationOptions>,\n\t) {\n\t\tsuper(options);\n\n\t\tif (\"encapsulated\" in options) {\n\t\t\tthis.encapsulated = options.encapsulated;\n\t\t\tthis.encapsulated.encapsulatingCC = this as any;\n\t\t} else {\n\t\t\tthis.decryptedCCBytes = options.decryptedCCBytes;\n\t\t\tthis.sequenced = options.sequenced;\n\t\t\tthis.secondFrame = options.secondFrame;\n\t\t\tthis.sequenceCounter = options.sequenceCounter;\n\t\t}\n\t\tthis.alternativeNetworkKey = options.alternativeNetworkKey;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCCommandEncapsulation {\n\t\tassertSecurityRX(ctx);\n\n\t\t// HALF_NONCE_SIZE bytes iv, 1 byte frame control, at least 1 CC byte, 1 byte nonce id, 8 bytes auth code\n\t\tvalidatePayload(\n\t\t\traw.payload.length >= HALF_NONCE_SIZE + 1 + 1 + 1 + 8,\n\t\t);\n\t\tconst iv = raw.payload.subarray(0, HALF_NONCE_SIZE);\n\t\tconst encryptedPayload = raw.payload.subarray(HALF_NONCE_SIZE, -9);\n\t\tconst nonceId = raw.payload.at(-9)!;\n\t\tconst authCode = raw.payload.subarray(-8);\n\n\t\t// Retrieve the used nonce from the nonce store\n\t\tconst nonce = ctx.securityManager.getNonce(nonceId);\n\t\t// Only accept the message if the nonce hasn't expired\n\t\tif (!nonce) {\n\t\t\tvalidatePayload.fail(\n\t\t\t\t`Nonce ${\n\t\t\t\t\tnum2hex(\n\t\t\t\t\t\tnonceId,\n\t\t\t\t\t)\n\t\t\t\t} expired, cannot decode security encapsulated command.`,\n\t\t\t);\n\t\t}\n\t\t// and mark the nonce as used\n\t\tctx.securityManager.deleteNonce(nonceId);\n\n\t\t// Validate the encrypted data\n\t\tconst authData = getAuthenticationData(\n\t\t\tiv,\n\t\t\tnonce,\n\t\t\tSecurityCommand.CommandEncapsulation,\n\t\t\tctx.sourceNodeId,\n\t\t\tctx.ownNodeId,\n\t\t\tencryptedPayload,\n\t\t);\n\t\tconst expectedAuthCode = computeMAC(\n\t\t\tauthData,\n\t\t\tctx.securityManager.authKey,\n\t\t);\n\t\t// Only accept messages with a correct auth code\n\t\tvalidatePayload.withReason(\n\t\t\t\"Invalid auth code, won't accept security encapsulated command.\",\n\t\t)(authCode.equals(expectedAuthCode));\n\n\t\t// Decrypt the encapsulated CC\n\t\tconst frameControlAndDecryptedCC = decryptAES128OFB(\n\t\t\tencryptedPayload,\n\t\t\tctx.securityManager.encryptionKey,\n\t\t\tBytes.concat([iv, nonce]),\n\t\t);\n\t\tconst frameControl = frameControlAndDecryptedCC[0];\n\t\tconst sequenceCounter = frameControl & 0b1111;\n\t\tconst sequenced = !!(frameControl & 0b1_0000);\n\t\tconst secondFrame = !!(frameControl & 0b10_0000);\n\t\tconst decryptedCCBytes: Uint8Array | undefined =\n\t\t\tframeControlAndDecryptedCC\n\t\t\t\t.subarray(1);\n\n\t\tconst ret = new SecurityCCCommandEncapsulation({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tsequenceCounter,\n\t\t\tsequenced,\n\t\t\tsecondFrame,\n\t\t\tdecryptedCCBytes,\n\t\t});\n\n\t\tret.authData = authData;\n\t\tret.authCode = authCode;\n\t\tret.iv = iv;\n\n\t\treturn ret;\n\t}\n\n\tprivate sequenced: boolean | undefined;\n\tprivate secondFrame: boolean | undefined;\n\tprivate sequenceCounter: number | undefined;\n\n\tprivate decryptedCCBytes: Uint8Array | undefined;\n\tpublic encapsulated!: CommandClass;\n\n\tprivate alternativeNetworkKey?: Uint8Array;\n\n\tpublic get nonceId(): number | undefined {\n\t\treturn this.nonce?.[0];\n\t}\n\tpublic nonce: Uint8Array | undefined;\n\n\t// Only used testing/for debugging purposes\n\tprivate iv?: Uint8Array;\n\tprivate authData?: Uint8Array;\n\tprivate authCode?: Uint8Array;\n\tprivate ciphertext?: Uint8Array;\n\n\tpublic getPartialCCSessionId(): Record<string, any> | undefined {\n\t\tif (this.sequenced) {\n\t\t\treturn {\n\t\t\t\t// Treat Encapsulation and EncapsulationNonceGet as one\n\t\t\t\tccCommand: undefined,\n\t\t\t\tsequence: this.sequenceCounter,\n\t\t\t};\n\t\t} else {\n\t\t\treturn {\n\t\t\t\t// Treat Encapsulation and EncapsulationNonceGet as one\n\t\t\t\tccCommand: undefined,\n\t\t\t};\n\t\t}\n\t}\n\n\tpublic expectMoreMessages(): boolean {\n\t\treturn !!this.sequenced && !this.secondFrame;\n\t}\n\n\tpublic mergePartialCCs(\n\t\tpartials: SecurityCCCommandEncapsulation[],\n\t\tctx: CCParsingContext,\n\t): void {\n\t\t// Concat the CC buffers\n\t\tthis.decryptedCCBytes = Bytes.concat(\n\t\t\t[...partials, this].map((cc) => cc.decryptedCCBytes!),\n\t\t);\n\t\t// make sure this contains a complete CC command that's worth splitting\n\t\tvalidatePayload(this.decryptedCCBytes.length >= 2);\n\t\t// and deserialize the CC\n\t\tthis.encapsulated = CommandClass.parse(this.decryptedCCBytes, ctx);\n\t\tthis.encapsulated.encapsulatingCC = this as any;\n\t}\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tif (!this.nonce) throwNoNonce();\n\t\tif (this.nonce.length !== HALF_NONCE_SIZE) {\n\t\t\tthrowNoNonce(\"Invalid nonce size\");\n\t\t}\n\t\tassertSecurityTX(ctx);\n\n\t\tlet authKey: Uint8Array;\n\t\tlet encryptionKey: Uint8Array;\n\t\tif (this.alternativeNetworkKey) {\n\t\t\tauthKey = generateAuthKey(this.alternativeNetworkKey);\n\t\t\tencryptionKey = generateEncryptionKey(\n\t\t\t\tthis.alternativeNetworkKey,\n\t\t\t);\n\t\t} else {\n\t\t\tauthKey = ctx.securityManager.authKey;\n\t\t\tencryptionKey = ctx.securityManager.encryptionKey;\n\t\t}\n\n\t\tconst serializedCC = this.encapsulated.serialize(ctx);\n\t\tconst plaintext = Bytes.concat([\n\t\t\tBytes.from([0]), // TODO: frame control\n\t\t\tserializedCC,\n\t\t]);\n\t\t// Encrypt the payload\n\t\tconst senderNonce = randomBytes(HALF_NONCE_SIZE);\n\t\tconst iv = Bytes.concat([senderNonce, this.nonce]);\n\t\tconst ciphertext = encryptAES128OFB(plaintext, encryptionKey, iv);\n\t\t// And generate the auth code\n\t\tconst authData = getAuthenticationData(\n\t\t\tsenderNonce,\n\t\t\tthis.nonce,\n\t\t\tthis.ccCommand,\n\t\t\tctx.ownNodeId,\n\t\t\tthis.nodeId,\n\t\t\tciphertext,\n\t\t);\n\t\tconst authCode = computeMAC(authData, authKey);\n\n\t\t// Remember for debugging purposes\n\t\tthis.iv = iv;\n\t\tthis.authData = authData;\n\t\tthis.authCode = authCode;\n\t\tthis.ciphertext = ciphertext;\n\n\t\tthis.payload = Bytes.concat([\n\t\t\tsenderNonce,\n\t\t\tciphertext,\n\t\t\tBytes.from([this.nonceId!]),\n\t\t\tauthCode,\n\t\t]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tprotected computeEncapsulationOverhead(): number {\n\t\t// Security CC adds 8 bytes IV, 1 byte frame control, 1 byte nonce ID, 8 bytes MAC\n\t\treturn super.computeEncapsulationOverhead() + 18;\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\tconst message: MessageRecord = {};\n\t\tif (this.nonceId != undefined) {\n\t\t\tmessage[\"nonce id\"] = this.nonceId;\n\t\t}\n\t\tif (this.sequenced != undefined) {\n\t\t\tmessage.sequenced = this.sequenced;\n\t\t\tif (this.sequenced) {\n\t\t\t\tif (this.secondFrame != undefined) {\n\t\t\t\t\tmessage[\"second frame\"] = this.secondFrame;\n\t\t\t\t}\n\t\t\t\tif (this.sequenceCounter != undefined) {\n\t\t\t\t\tmessage[\"sequence counter\"] = this.sequenceCounter;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\t// Log the plaintext in integration tests and development mode\n\t\tif (\n\t\t\tprocess.env.NODE_ENV === \"test\"\n\t\t\t|| process.env.NODE_ENV === \"development\"\n\t\t) {\n\t\t\tif (this.iv) {\n\t\t\t\tmessage.IV = buffer2hex(this.iv);\n\t\t\t}\n\t\t\tif (this.ciphertext) {\n\t\t\t\tmessage.ciphertext = buffer2hex(this.ciphertext);\n\t\t\t} else if (this.decryptedCCBytes) {\n\t\t\t\tmessage.plaintext = buffer2hex(this.decryptedCCBytes);\n\t\t\t}\n\t\t\tif (this.authData) {\n\t\t\t\tmessage[\"auth data\"] = buffer2hex(this.authData);\n\t\t\t}\n\t\t\tif (this.authCode) {\n\t\t\t\tmessage[\"auth code\"] = buffer2hex(this.authCode);\n\t\t\t}\n\t\t}\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage,\n\t\t};\n\t}\n}\n\n// This is the same message, but with another CC command\n@CCCommand(SecurityCommand.CommandEncapsulationNonceGet)\nexport class SecurityCCCommandEncapsulationNonceGet\n\textends SecurityCCCommandEncapsulation\n{}\n\n@CCCommand(SecurityCommand.SchemeReport)\nexport class SecurityCCSchemeReport extends SecurityCC {\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCSchemeReport {\n\t\tvalidatePayload(raw.payload.length >= 1);\n\t\t// The including controller MUST NOT perform any validation of the Supported Security Schemes byte\n\t\treturn new SecurityCCSchemeReport({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t});\n\t}\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\t// Since it is unlikely that any more schemes will be added to S0, we hardcode the default scheme here (bit 0 = 0)\n\t\tthis.payload = Bytes.from([0]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\t// Hide the default payload line\n\t\t\tmessage: undefined,\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.SchemeGet)\n@expectedCCResponse(SecurityCCSchemeReport)\nexport class SecurityCCSchemeGet extends SecurityCC {\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\t// Since it is unlikely that any more schemes will be added to S0, we hardcode the default scheme here (bit 0 = 0)\n\t\tthis.payload = Bytes.from([0]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\t// Hide the default payload line\n\t\t\tmessage: undefined,\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.SchemeInherit)\n@expectedCCResponse(SecurityCCSchemeReport)\nexport class SecurityCCSchemeInherit extends SecurityCC {\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\t// Since it is unlikely that any more schemes will be added to S0, we hardcode the default scheme here (bit 0 = 0)\n\t\tthis.payload = Bytes.from([0]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\t// Hide the default payload line\n\t\t\tmessage: undefined,\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.NetworkKeyVerify)\nexport class SecurityCCNetworkKeyVerify extends SecurityCC {}\n\n// @publicAPI\nexport interface SecurityCCNetworkKeySetOptions {\n\tnetworkKey: Uint8Array;\n}\n\n@CCCommand(SecurityCommand.NetworkKeySet)\n@expectedCCResponse(SecurityCCNetworkKeyVerify)\nexport class SecurityCCNetworkKeySet extends SecurityCC {\n\tpublic constructor(\n\t\toptions: WithAddress<SecurityCCNetworkKeySetOptions>,\n\t) {\n\t\tsuper(options);\n\t\tif (options.networkKey.length !== 16) {\n\t\t\tthrow new ZWaveError(\n\t\t\t\t`The network key must have length 16!`,\n\t\t\t\tZWaveErrorCodes.Argument_Invalid,\n\t\t\t);\n\t\t}\n\t\tthis.networkKey = options.networkKey;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCNetworkKeySet {\n\t\tvalidatePayload(raw.payload.length >= 16);\n\t\tconst networkKey: Uint8Array = raw.payload.subarray(0, 16);\n\n\t\treturn new SecurityCCNetworkKeySet({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tnetworkKey,\n\t\t});\n\t}\n\n\tpublic networkKey: Uint8Array;\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = Bytes.view(this.networkKey);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\t// The network key shouldn't be logged, so users can safely post their logs online\n\t\tconst { message, ...log } = super.toLogEntry(ctx);\n\t\treturn log;\n\t}\n}\n\n// @publicAPI\nexport interface SecurityCCCommandsSupportedReportOptions {\n\treportsToFollow?: number;\n\tsupportedCCs: CommandClasses[];\n\tcontrolledCCs: CommandClasses[];\n}\n\n@CCCommand(SecurityCommand.CommandsSupportedReport)\nexport class SecurityCCCommandsSupportedReport extends SecurityCC {\n\tpublic constructor(\n\t\toptions: WithAddress<SecurityCCCommandsSupportedReportOptions>,\n\t) {\n\t\tsuper(options);\n\n\t\tthis.supportedCCs = options.supportedCCs;\n\t\tthis.controlledCCs = options.controlledCCs;\n\t\t// TODO: properly split the CCs into multiple reports\n\t\tthis.reportsToFollow = options.reportsToFollow ?? 0;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCCommandsSupportedReport {\n\t\tvalidatePayload(raw.payload.length >= 1);\n\t\tconst reportsToFollow = raw.payload[0];\n\t\tconst list = parseCCList(raw.payload.subarray(1));\n\t\tconst supportedCCs: CommandClasses[] = list.supportedCCs;\n\t\tconst controlledCCs: CommandClasses[] = list.controlledCCs;\n\n\t\treturn new SecurityCCCommandsSupportedReport({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\treportsToFollow,\n\t\t\tsupportedCCs,\n\t\t\tcontrolledCCs,\n\t\t});\n\t}\n\n\tpublic reportsToFollow: number;\n\tpublic supportedCCs: CommandClasses[];\n\tpublic controlledCCs: CommandClasses[];\n\n\tpublic getPartialCCSessionId(): Record<string, any> | undefined {\n\t\t// Nothing special we can distinguish sessions with\n\t\treturn {};\n\t}\n\n\tpublic expectMoreMessages(): boolean {\n\t\treturn this.reportsToFollow > 0;\n\t}\n\n\tpublic mergePartialCCs(\n\t\tpartials: SecurityCCCommandsSupportedReport[],\n\t): void {\n\t\t// Concat the lists of CCs\n\t\tthis.supportedCCs = [...partials, this]\n\t\t\t.map((report) => report.supportedCCs)\n\t\t\t.reduce((prev, cur) => prev.concat(...cur), []);\n\t\tthis.controlledCCs = [...partials, this]\n\t\t\t.map((report) => report.controlledCCs)\n\t\t\t.reduce((prev, cur) => prev.concat(...cur), []);\n\t}\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = Bytes.concat([\n\t\t\tBytes.from([this.reportsToFollow]),\n\t\t\tencodeCCList(this.supportedCCs, this.controlledCCs),\n\t\t]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\treportsToFollow: this.reportsToFollow,\n\t\t\t\tsupportedCCs: this.supportedCCs\n\t\t\t\t\t.map((cc) => getCCName(cc))\n\t\t\t\t\t.map((cc) => `\\n\u00B7 ${cc}`)\n\t\t\t\t\t.join(\"\"),\n\t\t\t\tcontrolledCCs: this.controlledCCs\n\t\t\t\t\t.map((cc) => getCCName(cc))\n\t\t\t\t\t.map((cc) => `\\n\u00B7 ${cc}`)\n\t\t\t\t\t.join(\"\"),\n\t\t\t},\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.CommandsSupportedGet)\n@expectedCCResponse(SecurityCCCommandsSupportedReport)\nexport class SecurityCCCommandsSupportedGet extends SecurityCC {}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kBAsBO;AAOP,kBAAsB;AACtB,IAAAA,eAA0C;AAC1C,mBAAqB;AACrB,yBAA4B;AAC5B,iBAAqC;AACrC,0BAIO;AACP,oCAMO;AACP,mBAAgC;AAChC,qBAAwB;AACxB,yBAA4B;AAC5B,gCAAmC;;;;;;;;AAInC,SAAS,sBACR,aACA,eACA,WACA,eACA,iBACA,kBAA4B;AAE5B,SAAO,kBAAM,OAAO;IACnB;IACA;IACA,kBAAM,KAAK;MACV;MACA;MACA;MACA,iBAAiB;KACjB;IACD;GACA;AACF;AAEA,SAAS,aAAa,QAAe;AACpC,MAAI,UAAU;AACd,MAAI;AAAQ,eAAW,YAAY,MAAM;AACzC,QAAM,IAAI,uBAAW,SAAS,4BAAgB,kBAAkB;AACjE;AAEA,MAAM,kBAAkB;AAExB,SAAS,iBACR,KAAqB;AAErB,MAAI,CAAC,IAAI,WAAW;AACnB,UAAM,IAAI,uBACT,oFACA,4BAAgB,eAAe;EAEjC;AAEA,MAAI,CAAC,IAAI,iBAAiB;AACzB,UAAM,IAAI,uBACT,iFACA,4BAAgB,iBAAiB;EAEnC;AACD;AAEA,SAAS,iBACR,KAAsB;AAEtB,MAAI,CAAC,IAAI,WAAW;AACnB,UAAM,IAAI,uBACT,iFACA,4BAAgB,eAAe;EAEjC;AAEA,MAAI,CAAC,IAAI,iBAAiB;AACzB,UAAM,IAAI,uBACT,8EACA,4BAAgB,iBAAiB;EAEnC;AACD;AASO,IAAM,gBAAN,MAAMC,uBAAsB,yBAAa;EACxC,gBAAgB,MAAqB;AAE3C,WAAO;EACR;EAEO,MAAM,iBACZ,cACA,mBAA4B,OAAK;AAEjC,QAAI,kBAAkB;AACrB,WAAK,sBACJ,8BACA,6BAAgB,oBAAoB;IAEtC,OAAO;AACN,WAAK,sBACJ,8BACA,6BAAgB,4BAA4B;IAE9C;AAEA,UAAM,KAAK,KACV,mBACG,yCACA,gCACF;MACD,QAAQ,KAAK,SAAS;MACtB;KACA;AACD,UAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;EACpD;;;;EAKO,MAAM,WAAQ;AACpB,SAAK,sBAAsB,8BAAiB,6BAAgB,QAAQ;AAEpE,UAAM,KAAK,IAAI,mBAAmB;MACjC,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;KAC7B;AACD,UAAM,WAAW,MAAM,KAAK,KAAK,YAChC,IACA;MACC,GAAG,KAAK;;MAER,iBAAiB;KACjB;AAEF,QAAI,CAAC;AAAU;AAEf,UAAM,QAAQ,SAAS;AACvB,UAAM,SAAS,KAAK,KAAK;AACzB,WAAO,SACN;MACC,QAAQ,KAAK,SAAS;MACtB,SAAS,OAAO,WAAW,KAAK;OAEjC,EAAE,OAAO,UAAU,KAAK,KAAK,UAAS,GACtC,EAAE,MAAM,KAAI,CAAE;AAEf,WAAO;EACR;;;;;EAMO,MAAM,YAAS;AACrB,SAAK,sBACJ,8BACA,6BAAgB,WAAW;AAG5B,QAAI,CAAC,KAAK,KAAK,iBAAiB;AAC/B,YAAM,IAAI,uBACT,8DACA,4BAAgB,iBAAiB;IAEnC;AAEA,UAAM,QAAQ,KAAK,KAAK,gBAAgB,cACvC,KAAK,SAAS,QACd,eAAe;AAEhB,UAAM,UAAU,KAAK,KAAK,gBAAgB,WAAW,KAAK;AAE1D,UAAM,KAAK,IAAI,sBAAsB;MACpC,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;MAC7B;KACA;AAED,QAAI;AACH,YAAM,KAAK,KAAK,YAAY,IAAI;QAC/B,GAAG,KAAK;;QAER,iBAAiB,4BAAgB,MAC9B,4BAAgB;;QAEnB,iBAAiB;;QAEjB,UAAU,4BAAgB;;QAE1B,8BAA8B;OAC9B;IACF,SAAS,GAAG;AACX,cAAI,iCAAoB,CAAC,GAAG;AAE3B,aAAK,KAAK,gBAAgB,YAAY,OAAO;AAC7C,eAAO;MACR,OAAO;AAEN,cAAM;MACP;IACD;AACA,WAAO;EACR;EAEO,MAAM,oBAAiB;AAC7B,SAAK,sBAAsB,8BAAiB,6BAAgB,SAAS;AAErE,UAAM,KAAK,IAAI,oBAAoB;MAClC,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;KAC7B;AACD,UAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;AAEnD,WAAO,CAAC,CAAC;EACV;EAEO,MAAM,qBAAqB,cAAqB;AACtD,SAAK,sBACJ,8BACA,6BAAgB,YAAY;AAG7B,QAAI,KAAmB,IAAI,uBAAuB;MACjD,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;KAC7B;AACD,QAAI,cAAc;AACjB,WAAK,IAAI,+BAA+B;QACvC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,cAAc;OACd;IACF;AACA,UAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;EACpD;EAEO,MAAM,wBAAqB;AACjC,SAAK,sBACJ,8BACA,6BAAgB,aAAa;AAG9B,UAAM,KAAK,IAAI,wBAAwB;MACtC,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;KAC7B;AACD,UAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;EAEpD;EAEO,MAAM,cAAc,YAAsB;AAChD,SAAK,sBACJ,8BACA,6BAAgB,aAAa;AAG9B,UAAM,SAAS,IAAI,wBAAwB;MAC1C,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;MAC7B;KACA;AACD,UAAM,KAAK,IAAI,+BAA+B;MAC7C,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;MAC7B,cAAc;MACd,uBAAuB,IAAI,WAAW,EAAE,EAAE,KAAK,CAAC;KAChD;AACD,UAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;EACpD;EAEO,MAAM,mBAAgB;AAC5B,SAAK,sBACJ,8BACA,6BAAgB,gBAAgB;AAGjC,UAAM,KAAK,IAAI,2BAA2B;MACzC,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;KAC7B;AACD,UAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;EACpD;;EAGO,MAAM,uBAAoB;AAChC,SAAK,sBACJ,8BACA,6BAAgB,oBAAoB;AAGrC,UAAM,KAAK,IAAI,+BAA+B;MAC7C,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;KAC7B;AACD,UAAM,WAAW,MAAM,KAAK,KAAK,YAGhC,IACA,KAAK,cAAc;AAEpB,QAAI,UAAU;AACb,iBAAO,mBAAK,UAAU,CAAC,gBAAgB,eAAe,CAAC;IACxD;EACD;EAEO,MAAM,wBACZ,cACA,eAA+B;AAE/B,SAAK,sBACJ,8BACA,6BAAgB,uBAAuB;AAGxC,UAAM,KAAK,IAAI,kCAAkC;MAChD,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;MAC7B;MACA;MACA,iBAAiB;KACjB;AACD,UAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;EACpD;;AA/OY,gBAAa,WAAA;MADzB,mCAAI,2BAAe,QAAQ;GACf,aAAa;AAoPnB,IAAM,aAAU,eAAhB,MAAMC,oBAAmB,iCAAY;EAKpC,MAAM,UACZ,KAAqB;AAErB,UAAM,OAAO,KAAK,QAAQ,GAAG;AAC7B,UAAM,WAAW,KAAK,YAAY,GAAG;AACrC,UAAM,MAAM,iBAAM,OACjB,2BAAe,UACf,KACA,QAAQ,EACP,YAAY;MACb,UAAU,4BAAgB;KAC1B;AAED,QAAI,QAAQ,KAAK,IAAI;MACpB,SAAS;MACT,WAAW;KACX;AAED,QAAI;AACJ,QAAI;AAGJ,UAAM,eAAe,KAAK,kBAAkB,IAAI,IAAI;AACpD,aAAS,WAAW,GAAG,YAAY,cAAc,YAAY;AAC5D,YAAM,OAAO,MAAM,IAAI,qBAAoB;AAC3C,UAAI,MAAM;AACT,uBAAe,KAAK;AACpB,wBAAgB,KAAK;AACrB;MACD,WAAW,WAAW,cAAc;AACnC,YAAI,QAAQ,KAAK,IAAI;UACpB,UAAU,KAAK;UACf,SACC,sDAAsD,QAAQ,IAAI,YAAY;UAC/E,OAAO;SACP;AACD,kBAAM,mBAAK,GAAG;MACf;IACD;AAEA,QAAI,CAAC,gBAAgB,CAAC,eAAe;AACpC,UAAI,KAAK,iBAAiB,0BAAc,SAAS,MAAM,MAAM;AAC5D,YAAI,QAAQ,KAAK,IAAI;UACpB,UAAU,KAAK;UACf,SAAS;UACT,OAAO;SACP;MAEF,OAAO;AAGN,YAAI,QACH,KAAK,IACL,oFAAoF;AAErF,aAAK,iBAAiB,0BAAc,WAAW,KAAK;MACrD;AACA;IACD;AAEA,UAAM,WAAqB;MAC1B;MACA;;AAED,eAAW,MAAM,cAAc;AAC9B,eAAS,KAAK,YAAK,uBAAU,EAAE,CAAC,EAAE;IACnC;AACA,aAAS,KAAK,iBAAiB;AAC/B,eAAW,MAAM,eAAe;AAC/B,eAAS,KAAK,YAAK,uBAAU,EAAE,CAAC,EAAE;IACnC;AACA,QAAI,QAAQ,KAAK,IAAI;MACpB,SAAS,SAAS,KAAK,IAAI;MAC3B,WAAW;KACX;AAGD,eAAW,MAAM,cAAc;AAI9B,UAAI,OAAO,2BAAe,OAAO;AAChC,iBAAS,MAAM,IAAI,EAAE,QAAQ,KAAI,CAAE;MACpC,OAAO;AACN,iBAAS,MAAM,IAAI;UAClB,aAAa;UACb,QAAQ;SACR;MACF;IACD;AACA,eAAW,MAAM,eAAe;AAI/B,UAAI,OAAO,2BAAe,OAAO;AAChC,iBAAS,MAAM,IAAI,EAAE,QAAQ,KAAI,CAAE;MACpC,OAAO;AACN,iBAAS,MAAM,IAAI;UAClB,cAAc;UACd,QAAQ;SACR;MACF;IACD;AAGA,QAAI,KAAK,iBAAiB,0BAAc,SAAS,MAAM,MAAM;AAC5D,WAAK,iBAAiB,0BAAc,WAAW,IAAI;AACnD,UAAI,QACH,KAAK,IACL,4CAA4C;IAE9C;AAGA,SAAK,qBAAqB,KAAK,IAAI;EACpC;;EAGO,OAAO,sBAAsB,IAAgB;AAEnD,QAAI,EAAE,GAAG,qBAAqB,+BAAmB,WAAW;AAC3D,aAAO;IACR;AAGA,QACC,cAAc,kCACX,cAAc,0BACd,cAAc,8CAChB;AACD,aAAO;IACR;AAGA,QAAI,cAAc,cAAY;AAC7B,cAAQ,GAAG,WAAW;;QAErB,KAAK,6BAAgB;QACrB,KAAK,6BAAgB;;QAErB,KAAK,6BAAgB;QACrB,KAAK,6BAAgB;QACrB,KAAK,6BAAgB;QACrB,KAAK,6BAAgB;AACpB,iBAAO;QAER;AAEC,iBAAO;MACT;IACD;AAGA,WAAO;EACR;;EAGO,OAAO,YACb,WACA,iBACA,IAAgB;AAGhB,UAAM,MAAM,IAAI,+BAA+B;MAC9C,QAAQ,GAAG;MACX,cAAc;KACd;AAID,QAAI,qBAAqB,GAAG,qBACzB,CAAC,+BAAmB;AAEvB,WAAO;EACR;;AAnLY,aAAU,eAAA,WAAA;MAFtB,4CAAa,2BAAe,QAAQ;MACpC,kDAAmB,CAAC;GACR,UAAU;AA2LhB,IAAM,wBAAqB,0BAA3B,MAAMC,+BAA8B,WAAU;EACpD,YACC,SAAkD;AAElD,UAAM,OAAO;AACb,QAAI,QAAQ,MAAM,WAAW,iBAAiB;AAC7C,YAAM,IAAI,uBACT,0BAA0B,eAAe,KACzC,4BAAgB,gBAAgB;IAElC;AACA,SAAK,QAAQ,QAAQ;EACtB;EAEO,OAAO,KACb,KACA,KAAqB;AAErB,gCAAgB,WAAW,sBAAsB,EAChD,IAAI,QAAQ,WAAW,eAAe;AAGvC,WAAO,IAAI,wBAAsB;MAChC,QAAQ,IAAI;MACZ,OAAO,IAAI;KACX;EACF;EAEO;EAEA,UAAU,KAAsB;AACtC,SAAK,UAAU,kBAAM,KAAK,KAAK,KAAK;AACpC,WAAO,MAAM,UAAU,GAAG;EAC3B;EAEO,WAAW,KAAgB;AACjC,WAAO;MACN,GAAG,MAAM,WAAW,GAAG;MACvB,SAAS,EAAE,WAAO,yBAAW,KAAK,KAAK,EAAC;;EAE1C;;AAxCY,wBAAqB,0BAAA,WAAA;MADjC,yCAAU,6BAAgB,WAAW;GACzB,qBAAqB;AA6C3B,IAAM,qBAAN,MAAMC,4BAA2B,WAAU;;AAArC,qBAAkB,WAAA;MAF9B,yCAAU,6BAAgB,QAAQ;MAClC,kDAAmB,qBAAqB;GAC5B,kBAAkB;AAgB/B,SAAS,qCACR,MAAoC;AAEpC,MAAI,KAAK,aAAa,kBAAiB,GAAI;AAC1C,WAAO;EACR;AACD;AAOO,IAAM,iCAA8B,mCAApC,MAAMC,wCAAuC,WAAU;EAC7D,YACC,SAA2D;AAE3D,UAAM,OAAO;AAEb,QAAI,kBAAkB,SAAS;AAC9B,WAAK,eAAe,QAAQ;AAC5B,WAAK,aAAa,kBAAkB;IACrC,OAAO;AACN,WAAK,mBAAmB,QAAQ;AAChC,WAAK,YAAY,QAAQ;AACzB,WAAK,cAAc,QAAQ;AAC3B,WAAK,kBAAkB,QAAQ;IAChC;AACA,SAAK,wBAAwB,QAAQ;EACtC;EAEO,OAAO,KACb,KACA,KAAqB;AAErB,qBAAiB,GAAG;AAGpB,qCACC,IAAI,QAAQ,UAAU,kBAAkB,IAAI,IAAI,IAAI,CAAC;AAEtD,UAAM,KAAK,IAAI,QAAQ,SAAS,GAAG,eAAe;AAClD,UAAM,mBAAmB,IAAI,QAAQ,SAAS,iBAAiB,EAAE;AACjE,UAAM,UAAU,IAAI,QAAQ,GAAG,EAAE;AACjC,UAAM,WAAW,IAAI,QAAQ,SAAS,EAAE;AAGxC,UAAM,QAAQ,IAAI,gBAAgB,SAAS,OAAO;AAElD,QAAI,CAAC,OAAO;AACX,kCAAgB,KACf,aACC,sBACC,OAAO,CAET,wDAAwD;IAE1D;AAEA,QAAI,gBAAgB,YAAY,OAAO;AAGvC,UAAM,WAAW,sBAChB,IACA,OACA,6BAAgB,sBAChB,IAAI,cACJ,IAAI,WACJ,gBAAgB;AAEjB,UAAM,uBAAmB,wBACxB,UACA,IAAI,gBAAgB,OAAO;AAG5B,gCAAgB,WACf,gEAAgE,EAC/D,SAAS,OAAO,gBAAgB,CAAC;AAGnC,UAAM,iCAA6B,8BAClC,kBACA,IAAI,gBAAgB,eACpB,kBAAM,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;AAE1B,UAAM,eAAe,2BAA2B,CAAC;AACjD,UAAM,kBAAkB,eAAe;AACvC,UAAM,YAAY,CAAC,EAAE,eAAe;AACpC,UAAM,cAAc,CAAC,EAAE,eAAe;AACtC,UAAM,mBACL,2BACE,SAAS,CAAC;AAEb,UAAM,MAAM,IAAI,iCAA+B;MAC9C,QAAQ,IAAI;MACZ;MACA;MACA;MACA;KACA;AAED,QAAI,WAAW;AACf,QAAI,WAAW;AACf,QAAI,KAAK;AAET,WAAO;EACR;EAEQ;EACA;EACA;EAEA;EACD;EAEC;EAER,IAAW,UAAO;AACjB,WAAO,KAAK,QAAQ,CAAC;EACtB;EACO;;EAGC;EACA;EACA;EACA;EAED,wBAAqB;AAC3B,QAAI,KAAK,WAAW;AACnB,aAAO;;QAEN,WAAW;QACX,UAAU,KAAK;;IAEjB,OAAO;AACN,aAAO;;QAEN,WAAW;;IAEb;EACD;EAEO,qBAAkB;AACxB,WAAO,CAAC,CAAC,KAAK,aAAa,CAAC,KAAK;EAClC;EAEO,gBACN,UACA,KAAqB;AAGrB,SAAK,mBAAmB,kBAAM,OAC7B,CAAC,GAAG,UAAU,IAAI,EAAE,IAAI,CAAC,OAAO,GAAG,gBAAiB,CAAC;AAGtD,qCAAgB,KAAK,iBAAiB,UAAU,CAAC;AAEjD,SAAK,eAAe,iCAAa,MAAM,KAAK,kBAAkB,GAAG;AACjE,SAAK,aAAa,kBAAkB;EACrC;EAEO,UAAU,KAAsB;AACtC,QAAI,CAAC,KAAK;AAAO,mBAAY;AAC7B,QAAI,KAAK,MAAM,WAAW,iBAAiB;AAC1C,mBAAa,oBAAoB;IAClC;AACA,qBAAiB,GAAG;AAEpB,QAAI;AACJ,QAAI;AACJ,QAAI,KAAK,uBAAuB;AAC/B,oBAAU,6BAAgB,KAAK,qBAAqB;AACpD,0BAAgB,mCACf,KAAK,qBAAqB;IAE5B,OAAO;AACN,gBAAU,IAAI,gBAAgB;AAC9B,sBAAgB,IAAI,gBAAgB;IACrC;AAEA,UAAM,eAAe,KAAK,aAAa,UAAU,GAAG;AACpD,UAAM,YAAY,kBAAM,OAAO;MAC9B,kBAAM,KAAK,CAAC,CAAC,CAAC;;MACd;KACA;AAED,UAAM,kBAAc,gCAAY,eAAe;AAC/C,UAAM,KAAK,kBAAM,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC;AACjD,UAAM,iBAAa,8BAAiB,WAAW,eAAe,EAAE;AAEhE,UAAM,WAAW,sBAChB,aACA,KAAK,OACL,KAAK,WACL,IAAI,WACJ,KAAK,QACL,UAAU;AAEX,UAAM,eAAW,wBAAW,UAAU,OAAO;AAG7C,SAAK,KAAK;AACV,SAAK,WAAW;AAChB,SAAK,WAAW;AAChB,SAAK,aAAa;AAElB,SAAK,UAAU,kBAAM,OAAO;MAC3B;MACA;MACA,kBAAM,KAAK,CAAC,KAAK,OAAQ,CAAC;MAC1B;KACA;AACD,WAAO,MAAM,UAAU,GAAG;EAC3B;EAEU,+BAA4B;AAErC,WAAO,MAAM,6BAA4B,IAAK;EAC/C;EAEO,WAAW,KAAgB;AACjC,UAAM,UAAyB,CAAA;AAC/B,QAAI,KAAK,WAAW,QAAW;AAC9B,cAAQ,UAAU,IAAI,KAAK;IAC5B;AACA,QAAI,KAAK,aAAa,QAAW;AAChC,cAAQ,YAAY,KAAK;AACzB,UAAI,KAAK,WAAW;AACnB,YAAI,KAAK,eAAe,QAAW;AAClC,kBAAQ,cAAc,IAAI,KAAK;QAChC;AACA,YAAI,KAAK,mBAAmB,QAAW;AACtC,kBAAQ,kBAAkB,IAAI,KAAK;QACpC;MACD;IACD;AAEA,QACC,QAAQ,IAAI,aAAa,UACtB,QAAQ,IAAI,aAAa,eAC3B;AACD,UAAI,KAAK,IAAI;AACZ,gBAAQ,SAAK,yBAAW,KAAK,EAAE;MAChC;AACA,UAAI,KAAK,YAAY;AACpB,gBAAQ,iBAAa,yBAAW,KAAK,UAAU;MAChD,WAAW,KAAK,kBAAkB;AACjC,gBAAQ,gBAAY,yBAAW,KAAK,gBAAgB;MACrD;AACA,UAAI,KAAK,UAAU;AAClB,gBAAQ,WAAW,QAAI,yBAAW,KAAK,QAAQ;MAChD;AACA,UAAI,KAAK,UAAU;AAClB,gBAAQ,WAAW,QAAI,yBAAW,KAAK,QAAQ;MAChD;IACD;AACA,WAAO;MACN,GAAG,MAAM,WAAW,GAAG;MACvB;;EAEF;;AAxPY,iCAA8B,mCAAA,WAAA;MAL1C,yCAAU,6BAAgB,oBAAoB;MAC9C,kDACA,sCACA,MAAM,mBAAmB;GAEb,8BAA8B;AA6PpC,IAAM,yCAAN,MAAMC,gDACJ,+BAA8B;;AAD1B,yCAAsC,WAAA;MADlD,yCAAU,6BAAgB,4BAA4B;GAC1C,sCAAsC;AAK5C,IAAM,yBAAsB,2BAA5B,MAAMC,gCAA+B,WAAU;EAC9C,OAAO,KACb,KACA,KAAqB;AAErB,qCAAgB,IAAI,QAAQ,UAAU,CAAC;AAEvC,WAAO,IAAI,yBAAuB;MACjC,QAAQ,IAAI;KACZ;EACF;EAEO,UAAU,KAAsB;AAEtC,SAAK,UAAU,kBAAM,KAAK,CAAC,CAAC,CAAC;AAC7B,WAAO,MAAM,UAAU,GAAG;EAC3B;EAEO,WAAW,KAAgB;AACjC,WAAO;MACN,GAAG,MAAM,WAAW,GAAG;;MAEvB,SAAS;;EAEX;;AAxBY,yBAAsB,2BAAA,WAAA;MADlC,yCAAU,6BAAgB,YAAY;GAC1B,sBAAsB;AA6B5B,IAAM,sBAAN,MAAMC,6BAA4B,WAAU;EAC3C,UAAU,KAAsB;AAEtC,SAAK,UAAU,kBAAM,KAAK,CAAC,CAAC,CAAC;AAC7B,WAAO,MAAM,UAAU,GAAG;EAC3B;EAEO,WAAW,KAAgB;AACjC,WAAO;MACN,GAAG,MAAM,WAAW,GAAG;;MAEvB,SAAS;;EAEX;;AAbY,sBAAmB,WAAA;MAF/B,yCAAU,6BAAgB,SAAS;MACnC,kDAAmB,sBAAsB;GAC7B,mBAAmB;AAkBzB,IAAM,0BAAN,MAAMC,iCAAgC,WAAU;EAC/C,UAAU,KAAsB;AAEtC,SAAK,UAAU,kBAAM,KAAK,CAAC,CAAC,CAAC;AAC7B,WAAO,MAAM,UAAU,GAAG;EAC3B;EAEO,WAAW,KAAgB;AACjC,WAAO;MACN,GAAG,MAAM,WAAW,GAAG;;MAEvB,SAAS;;EAEX;;AAbY,0BAAuB,WAAA;MAFnC,yCAAU,6BAAgB,aAAa;MACvC,kDAAmB,sBAAsB;GAC7B,uBAAuB;AAiB7B,IAAM,6BAAN,MAAMC,oCAAmC,WAAU;;AAA7C,6BAA0B,WAAA;MADtC,yCAAU,6BAAgB,gBAAgB;GAC9B,0BAA0B;AAShC,IAAM,0BAAuB,4BAA7B,MAAMC,iCAAgC,WAAU;EACtD,YACC,SAAoD;AAEpD,UAAM,OAAO;AACb,QAAI,QAAQ,WAAW,WAAW,IAAI;AACrC,YAAM,IAAI,uBACT,wCACA,4BAAgB,gBAAgB;IAElC;AACA,SAAK,aAAa,QAAQ;EAC3B;EAEO,OAAO,KACb,KACA,KAAqB;AAErB,qCAAgB,IAAI,QAAQ,UAAU,EAAE;AACxC,UAAM,aAAyB,IAAI,QAAQ,SAAS,GAAG,EAAE;AAEzD,WAAO,IAAI,0BAAwB;MAClC,QAAQ,IAAI;MACZ;KACA;EACF;EAEO;EAEA,UAAU,KAAsB;AACtC,SAAK,UAAU,kBAAM,KAAK,KAAK,UAAU;AACzC,WAAO,MAAM,UAAU,GAAG;EAC3B;EAEO,WAAW,KAAgB;AAEjC,UAAM,EAAE,SAAS,GAAG,IAAG,IAAK,MAAM,WAAW,GAAG;AAChD,WAAO;EACR;;AAtCY,0BAAuB,4BAAA,WAAA;MAFnC,yCAAU,6BAAgB,aAAa;MACvC,kDAAmB,0BAA0B;GACjC,uBAAuB;AAiD7B,IAAM,oCAAiC,sCAAvC,MAAMC,2CAA0C,WAAU;EAChE,YACC,SAA8D;AAE9D,UAAM,OAAO;AAEb,SAAK,eAAe,QAAQ;AAC5B,SAAK,gBAAgB,QAAQ;AAE7B,SAAK,kBAAkB,QAAQ,mBAAmB;EACnD;EAEO,OAAO,KACb,KACA,KAAqB;AAErB,qCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,UAAM,kBAAkB,IAAI,QAAQ,CAAC;AACrC,UAAM,WAAO,yBAAY,IAAI,QAAQ,SAAS,CAAC,CAAC;AAChD,UAAM,eAAiC,KAAK;AAC5C,UAAM,gBAAkC,KAAK;AAE7C,WAAO,IAAI,oCAAkC;MAC5C,QAAQ,IAAI;MACZ;MACA;MACA;KACA;EACF;EAEO;EACA;EACA;EAEA,wBAAqB;AAE3B,WAAO,CAAA;EACR;EAEO,qBAAkB;AACxB,WAAO,KAAK,kBAAkB;EAC/B;EAEO,gBACN,UAA6C;AAG7C,SAAK,eAAe,CAAC,GAAG,UAAU,IAAI,EACpC,IAAI,CAAC,WAAW,OAAO,YAAY,EACnC,OAAO,CAAC,MAAM,QAAQ,KAAK,OAAO,GAAG,GAAG,GAAG,CAAA,CAAE;AAC/C,SAAK,gBAAgB,CAAC,GAAG,UAAU,IAAI,EACrC,IAAI,CAAC,WAAW,OAAO,aAAa,EACpC,OAAO,CAAC,MAAM,QAAQ,KAAK,OAAO,GAAG,GAAG,GAAG,CAAA,CAAE;EAChD;EAEO,UAAU,KAAsB;AACtC,SAAK,UAAU,kBAAM,OAAO;MAC3B,kBAAM,KAAK,CAAC,KAAK,eAAe,CAAC;UACjC,0BAAa,KAAK,cAAc,KAAK,aAAa;KAClD;AACD,WAAO,MAAM,UAAU,GAAG;EAC3B;EAEO,WAAW,KAAgB;AACjC,WAAO;MACN,GAAG,MAAM,WAAW,GAAG;MACvB,SAAS;QACR,iBAAiB,KAAK;QACtB,cAAc,KAAK,aACjB,IAAI,CAAC,WAAO,uBAAU,EAAE,CAAC,EACzB,IAAI,CAAC,OAAO;OAAO,EAAE,EAAE,EACvB,KAAK,EAAE;QACT,eAAe,KAAK,cAClB,IAAI,CAAC,WAAO,uBAAU,EAAE,CAAC,EACzB,IAAI,CAAC,OAAO;OAAO,EAAE,EAAE,EACvB,KAAK,EAAE;;;EAGZ;;AA9EY,oCAAiC,sCAAA,WAAA;MAD7C,yCAAU,6BAAgB,uBAAuB;GACrC,iCAAiC;AAmFvC,IAAM,iCAAN,MAAMC,wCAAuC,WAAU;;AAAjD,iCAA8B,WAAA;MAF1C,yCAAU,6BAAgB,oBAAoB;MAC9C,kDAAmB,iCAAiC;GACxC,8BAA8B;",
-  "names": ["import_safe", "SecurityCCAPI", "SecurityCC", "SecurityCCNonceReport", "SecurityCCNonceGet", "SecurityCCCommandEncapsulation", "SecurityCCCommandEncapsulationNonceGet", "SecurityCCSchemeReport", "SecurityCCSchemeGet", "SecurityCCSchemeInherit", "SecurityCCNetworkKeyVerify", "SecurityCCNetworkKeySet", "SecurityCCCommandsSupportedReport", "SecurityCCCommandsSupportedGet"]
+  "sourcesContent": ["import {\n\tCommandClasses,\n\tEncapsulationFlags,\n\ttype MessageOrCCLogEntry,\n\tMessagePriority,\n\ttype MessageRecord,\n\tSecurityClass,\n\ttype SecurityManager,\n\tTransmitOptions,\n\ttype WithAddress,\n\tZWaveError,\n\tZWaveErrorCodes,\n\tcomputeMAC,\n\tdecryptAES128OFB,\n\tencodeCCList,\n\tencryptAES128OFB,\n\tgenerateAuthKey,\n\tgenerateEncryptionKey,\n\tgetCCName,\n\tisTransmissionError,\n\tparseCCList,\n\tvalidatePayload,\n} from \"@zwave-js/core\";\nimport { type MaybeNotKnown } from \"@zwave-js/core/safe\";\nimport type {\n\tCCEncodingContext,\n\tCCParsingContext,\n\tGetValueDB,\n} from \"@zwave-js/host/safe\";\nimport { Bytes } from \"@zwave-js/shared/safe\";\nimport { buffer2hex, num2hex, pick } from \"@zwave-js/shared/safe\";\nimport { wait } from \"alcalzone-shared/async/index.js\";\nimport { randomBytes } from \"node:crypto\";\nimport { CCAPI, PhysicalCCAPI } from \"../lib/API.js\";\nimport {\n\ttype CCRaw,\n\tCommandClass,\n\ttype InterviewContext,\n} from \"../lib/CommandClass.js\";\nimport {\n\tAPI,\n\tCCCommand,\n\tcommandClass,\n\texpectedCCResponse,\n\timplementedVersion,\n} from \"../lib/CommandClassDecorators.js\";\nimport { SecurityCommand } from \"../lib/_Types.js\";\nimport { CRC16CC } from \"./CRC16CC.js\";\nimport { Security2CC } from \"./Security2CC.js\";\nimport { TransportServiceCC } from \"./TransportServiceCC.js\";\n\n// @noSetValueAPI This is an encapsulation CC\n\nfunction getAuthenticationData(\n\tsenderNonce: Uint8Array,\n\treceiverNonce: Uint8Array,\n\tccCommand: SecurityCommand,\n\tsendingNodeId: number,\n\treceivingNodeId: number,\n\tencryptedPayload: Uint8Array,\n): Uint8Array {\n\treturn Bytes.concat([\n\t\tsenderNonce,\n\t\treceiverNonce,\n\t\tBytes.from([\n\t\t\tccCommand,\n\t\t\tsendingNodeId,\n\t\t\treceivingNodeId,\n\t\t\tencryptedPayload.length,\n\t\t]),\n\t\tencryptedPayload,\n\t]);\n}\n\nfunction throwNoNonce(reason?: string): never {\n\tlet message = `Security CC requires a nonce to be sent!`;\n\tif (reason) message += ` Reason: ${reason}`;\n\tthrow new ZWaveError(message, ZWaveErrorCodes.SecurityCC_NoNonce);\n}\n\nconst HALF_NONCE_SIZE = 8;\n\nfunction assertSecurityRX(\n\tctx: CCParsingContext,\n): asserts ctx is CCParsingContext & { securityManager: SecurityManager } {\n\tif (!ctx.ownNodeId) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S0) can only be decoded when the controller's node id is known!`,\n\t\t\tZWaveErrorCodes.Driver_NotReady,\n\t\t);\n\t}\n\n\tif (!ctx.securityManager) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S0) can only be decoded when the security manager is set up!`,\n\t\t\tZWaveErrorCodes.Driver_NoSecurity,\n\t\t);\n\t}\n}\n\nfunction assertSecurityTX(\n\tctx: CCEncodingContext,\n): asserts ctx is CCEncodingContext & { securityManager: SecurityManager } {\n\tif (!ctx.ownNodeId) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S0) can only be sent when the controller's node id is known!`,\n\t\t\tZWaveErrorCodes.Driver_NotReady,\n\t\t);\n\t}\n\n\tif (!ctx.securityManager) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S0) can only be sent when the security manager is set up!`,\n\t\t\tZWaveErrorCodes.Driver_NoSecurity,\n\t\t);\n\t}\n}\n\n// TODO: Ignore commands if received via multicast\n\n// Encapsulation CCs are used internally and too frequently that we\n// want to pay the cost of validating each call\n/* eslint-disable @zwave-js/ccapi-validate-args */\n\n@API(CommandClasses.Security)\nexport class SecurityCCAPI extends PhysicalCCAPI {\n\tpublic supportsCommand(_cmd: SecurityCommand): MaybeNotKnown<boolean> {\n\t\t// All commands are mandatory\n\t\treturn true;\n\t}\n\n\tpublic async sendEncapsulated(\n\t\tencapsulated: CommandClass,\n\t\trequestNextNonce: boolean = false,\n\t): Promise<void> {\n\t\tif (requestNextNonce) {\n\t\t\tthis.assertSupportsCommand(\n\t\t\t\tSecurityCommand,\n\t\t\t\tSecurityCommand.CommandEncapsulation,\n\t\t\t);\n\t\t} else {\n\t\t\tthis.assertSupportsCommand(\n\t\t\t\tSecurityCommand,\n\t\t\t\tSecurityCommand.CommandEncapsulationNonceGet,\n\t\t\t);\n\t\t}\n\n\t\tconst cc = new (\n\t\t\trequestNextNonce\n\t\t\t\t? SecurityCCCommandEncapsulationNonceGet\n\t\t\t\t: SecurityCCCommandEncapsulation\n\t\t)({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tencapsulated,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\t/**\n\t * Requests a new nonce for Security CC encapsulation which is not directly linked to a specific command.\n\t */\n\tpublic async getNonce(): Promise<Uint8Array | undefined> {\n\t\tthis.assertSupportsCommand(SecurityCommand, SecurityCommand.NonceGet);\n\n\t\tconst cc = new SecurityCCNonceGet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tconst response = await this.host.sendCommand<SecurityCCNonceReport>(\n\t\t\tcc,\n\t\t\t{\n\t\t\t\t...this.commandOptions,\n\t\t\t\t// Only try getting a nonce once\n\t\t\t\tmaxSendAttempts: 1,\n\t\t\t},\n\t\t);\n\t\tif (!response) return;\n\n\t\tconst nonce = response.nonce;\n\t\tconst secMan = this.host.securityManager!;\n\t\tsecMan.setNonce(\n\t\t\t{\n\t\t\t\tissuer: this.endpoint.nodeId,\n\t\t\t\tnonceId: secMan.getNonceId(nonce),\n\t\t\t},\n\t\t\t{ nonce, receiver: this.host.ownNodeId },\n\t\t\t{ free: true },\n\t\t);\n\t\treturn nonce;\n\t}\n\n\t/**\n\t * Responds to a NonceGet request. The message is sent without any retransmission etc.\n\t * The return value indicates whether a nonce was successfully sent\n\t */\n\tpublic async sendNonce(): Promise<boolean> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.NonceReport,\n\t\t);\n\n\t\tif (!this.host.securityManager) {\n\t\t\tthrow new ZWaveError(\n\t\t\t\t`Nonces can only be sent if secure communication is set up!`,\n\t\t\t\tZWaveErrorCodes.Driver_NoSecurity,\n\t\t\t);\n\t\t}\n\n\t\tconst nonce = this.host.securityManager.generateNonce(\n\t\t\tthis.endpoint.nodeId,\n\t\t\tHALF_NONCE_SIZE,\n\t\t);\n\t\tconst nonceId = this.host.securityManager.getNonceId(nonce);\n\n\t\tconst cc = new SecurityCCNonceReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tnonce,\n\t\t});\n\n\t\ttry {\n\t\t\tawait this.host.sendCommand(cc, {\n\t\t\t\t...this.commandOptions,\n\t\t\t\t// Seems we need these options or some nodes won't accept the nonce\n\t\t\t\ttransmitOptions: TransmitOptions.ACK\n\t\t\t\t\t| TransmitOptions.AutoRoute,\n\t\t\t\t// Only try sending a nonce once\n\t\t\t\tmaxSendAttempts: 1,\n\t\t\t\t// Nonce requests must be handled immediately\n\t\t\t\tpriority: MessagePriority.Immediate,\n\t\t\t\t// We don't want failures causing us to treat the node as asleep or dead\n\t\t\t\tchangeNodeStatusOnMissingACK: false,\n\t\t\t});\n\t\t} catch (e) {\n\t\t\tif (isTransmissionError(e)) {\n\t\t\t\t// The nonce could not be sent, invalidate it\n\t\t\t\tthis.host.securityManager.deleteNonce(nonceId);\n\t\t\t\treturn false;\n\t\t\t} else {\n\t\t\t\t// Pass other errors through\n\t\t\t\tthrow e;\n\t\t\t}\n\t\t}\n\t\treturn true;\n\t}\n\n\tpublic async getSecurityScheme(): Promise<[0]> {\n\t\tthis.assertSupportsCommand(SecurityCommand, SecurityCommand.SchemeGet);\n\n\t\tconst cc = new SecurityCCSchemeGet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t\t// There is only one scheme, so we hardcode it\n\t\treturn [0];\n\t}\n\n\tpublic async reportSecurityScheme(encapsulated: boolean): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.SchemeReport,\n\t\t);\n\n\t\tlet cc: CommandClass = new SecurityCCSchemeReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tif (encapsulated) {\n\t\t\tcc = new SecurityCCCommandEncapsulation({\n\t\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\t\tendpointIndex: this.endpoint.index,\n\t\t\t\tencapsulated: cc,\n\t\t\t});\n\t\t}\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\tpublic async inheritSecurityScheme(): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.SchemeInherit,\n\t\t);\n\n\t\tconst cc = new SecurityCCSchemeInherit({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t\t// There is only one scheme, so we don't return anything here\n\t}\n\n\tpublic async setNetworkKey(networkKey: Uint8Array): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.NetworkKeySet,\n\t\t);\n\n\t\tconst keySet = new SecurityCCNetworkKeySet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tnetworkKey,\n\t\t});\n\t\tconst cc = new SecurityCCCommandEncapsulation({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tencapsulated: keySet,\n\t\t\talternativeNetworkKey: new Uint8Array(16).fill(0),\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\tpublic async verifyNetworkKey(): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.NetworkKeyVerify,\n\t\t);\n\n\t\tconst cc = new SecurityCCNetworkKeyVerify({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\t// eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types\n\tpublic async getSupportedCommands() {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.CommandsSupportedGet,\n\t\t);\n\n\t\tconst cc = new SecurityCCCommandsSupportedGet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tconst response = await this.host.sendCommand<\n\t\t\tSecurityCCCommandsSupportedReport\n\t\t>(\n\t\t\tcc,\n\t\t\tthis.commandOptions,\n\t\t);\n\t\tif (response) {\n\t\t\treturn pick(response, [\"supportedCCs\", \"controlledCCs\"]);\n\t\t}\n\t}\n\n\tpublic async reportSupportedCommands(\n\t\tsupportedCCs: CommandClasses[],\n\t\tcontrolledCCs: CommandClasses[],\n\t): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.CommandsSupportedReport,\n\t\t);\n\n\t\tconst cc = new SecurityCCCommandsSupportedReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tsupportedCCs,\n\t\t\tcontrolledCCs,\n\t\t\treportsToFollow: 0,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n}\n\n@commandClass(CommandClasses.Security)\n@implementedVersion(1)\nexport class SecurityCC extends CommandClass {\n\tdeclare ccCommand: SecurityCommand;\n\t// Force singlecast for the Security CC\n\tdeclare nodeId: number;\n\n\tpublic async interview(\n\t\tctx: InterviewContext,\n\t): Promise<void> {\n\t\tconst node = this.getNode(ctx)!;\n\t\tconst endpoint = this.getEndpoint(ctx)!;\n\t\tconst api = CCAPI.create(\n\t\t\tCommandClasses.Security,\n\t\t\tctx,\n\t\t\tendpoint,\n\t\t).withOptions({\n\t\t\tpriority: MessagePriority.NodeQuery,\n\t\t});\n\n\t\tctx.logNode(node.id, {\n\t\t\tmessage: \"Querying securely supported commands (S0)...\",\n\t\t\tdirection: \"outbound\",\n\t\t});\n\n\t\tlet supportedCCs: CommandClasses[] | undefined;\n\t\tlet controlledCCs: CommandClasses[] | undefined;\n\n\t\t// Try up to 3 times on the root device. We REALLY don't want a spurious timeout or collision to cause us to discard a known good security class\n\t\tconst MAX_ATTEMPTS = this.endpointIndex === 0 ? 3 : 1;\n\t\tfor (let attempts = 1; attempts <= MAX_ATTEMPTS; attempts++) {\n\t\t\tconst resp = await api.getSupportedCommands();\n\t\t\tif (resp) {\n\t\t\t\tsupportedCCs = resp.supportedCCs;\n\t\t\t\tcontrolledCCs = resp.controlledCCs;\n\t\t\t\tbreak;\n\t\t\t} else if (attempts < MAX_ATTEMPTS) {\n\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\tendpoint: this.endpointIndex,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`Querying securely supported commands (S0), attempt ${attempts}/${MAX_ATTEMPTS} failed. Retrying in 500ms...`,\n\t\t\t\t\tlevel: \"warn\",\n\t\t\t\t});\n\t\t\t\tawait wait(500);\n\t\t\t}\n\t\t}\n\n\t\tif (!supportedCCs || !controlledCCs) {\n\t\t\tif (node.hasSecurityClass(SecurityClass.S0_Legacy) === true) {\n\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\tendpoint: this.endpointIndex,\n\t\t\t\t\tmessage: \"Querying securely supported commands (S0) failed\",\n\t\t\t\t\tlevel: \"warn\",\n\t\t\t\t});\n\t\t\t\t// TODO: Abort interview?\n\t\t\t} else {\n\t\t\t\t// We didn't know if the node was secure and it didn't respond,\n\t\t\t\t// assume that it doesn't have the S0 security class\n\t\t\t\tctx.logNode(\n\t\t\t\t\tnode.id,\n\t\t\t\t\t`The node was not granted the S0 security class. Continuing interview non-securely.`,\n\t\t\t\t);\n\t\t\t\tnode.setSecurityClass(SecurityClass.S0_Legacy, false);\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\n\t\tconst logLines: string[] = [\n\t\t\t\"received secure commands (S0)\",\n\t\t\t\"supported CCs:\",\n\t\t];\n\t\tfor (const cc of supportedCCs) {\n\t\t\tlogLines.push(`\u00B7 ${getCCName(cc)}`);\n\t\t}\n\t\tlogLines.push(\"controlled CCs:\");\n\t\tfor (const cc of controlledCCs) {\n\t\t\tlogLines.push(`\u00B7 ${getCCName(cc)}`);\n\t\t}\n\t\tctx.logNode(node.id, {\n\t\t\tmessage: logLines.join(\"\\n\"),\n\t\t\tdirection: \"inbound\",\n\t\t});\n\n\t\t// Remember which commands are supported securely\n\t\tfor (const cc of supportedCCs) {\n\t\t\t// Basic CC has special rules for when it is considered supported\n\t\t\t// Therefore we mark all other CCs as supported, but not Basic CC,\n\t\t\t// for which support is determined later.\n\t\t\tif (cc === CommandClasses.Basic) {\n\t\t\t\tendpoint.addCC(cc, { secure: true });\n\t\t\t} else {\n\t\t\t\tendpoint.addCC(cc, {\n\t\t\t\t\tisSupported: true,\n\t\t\t\t\tsecure: true,\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t\tfor (const cc of controlledCCs) {\n\t\t\t// Basic CC has special rules for when it is considered supported\n\t\t\t// Therefore we mark all other CCs as supported, but not Basic CC,\n\t\t\t// for which support is determined later.\n\t\t\tif (cc === CommandClasses.Basic) {\n\t\t\t\tendpoint.addCC(cc, { secure: true });\n\t\t\t} else {\n\t\t\t\tendpoint.addCC(cc, {\n\t\t\t\t\tisControlled: true,\n\t\t\t\t\tsecure: true,\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\t// We know for sure that the node is included securely\n\t\tif (node.hasSecurityClass(SecurityClass.S0_Legacy) !== true) {\n\t\t\tnode.setSecurityClass(SecurityClass.S0_Legacy, true);\n\t\t\tctx.logNode(\n\t\t\t\tnode.id,\n\t\t\t\t`The node was granted the S0 security class`,\n\t\t\t);\n\t\t}\n\n\t\t// Remember that the interview is complete\n\t\tthis.setInterviewComplete(ctx, true);\n\t}\n\n\t/** Tests if a command should be sent secure and thus requires encapsulation */\n\tpublic static requiresEncapsulation(cc: CommandClass): boolean {\n\t\t// No security flag -> no encapsulation\n\t\tif (!(cc.encapsulationFlags & EncapsulationFlags.Security)) {\n\t\t\treturn false;\n\t\t}\n\n\t\t// S2, CRC16, Transport Service -> no S2 encapsulation\n\t\tif (\n\t\t\tcc instanceof Security2CC\n\t\t\t|| cc instanceof CRC16CC\n\t\t\t|| cc instanceof TransportServiceCC\n\t\t) {\n\t\t\treturn false;\n\t\t}\n\n\t\t// S0: check command\n\t\tif (cc instanceof SecurityCC) {\n\t\t\tswitch (cc.ccCommand) {\n\t\t\t\t// Already encapsulated\n\t\t\t\tcase SecurityCommand.CommandEncapsulation:\n\t\t\t\tcase SecurityCommand.CommandEncapsulationNonceGet:\n\t\t\t\t// Cannot be sent encapsulated:\n\t\t\t\tcase SecurityCommand.NonceGet:\n\t\t\t\tcase SecurityCommand.NonceReport:\n\t\t\t\tcase SecurityCommand.SchemeGet:\n\t\t\t\tcase SecurityCommand.SchemeReport:\n\t\t\t\t\treturn false;\n\n\t\t\t\tdefault:\n\t\t\t\t\t// All other commands must be encapsulated\n\t\t\t\t\treturn true;\n\t\t\t}\n\t\t}\n\n\t\t// Everything else needs to be encapsulated if the CC is secure\n\t\treturn true;\n\t}\n\n\t/** Encapsulates a command that should be sent encrypted */\n\tpublic static encapsulate(\n\t\townNodeId: number,\n\t\tsecurityManager: SecurityManager,\n\t\tcc: CommandClass,\n\t): SecurityCCCommandEncapsulation {\n\t\t// TODO: When to return a SecurityCCCommandEncapsulationNonceGet?\n\t\tconst ret = new SecurityCCCommandEncapsulation({\n\t\t\tnodeId: cc.nodeId,\n\t\t\tencapsulated: cc,\n\t\t});\n\n\t\t// Copy the encapsulation flags from the encapsulated command\n\t\t// but omit Security, since we're doing that right now\n\t\tret.encapsulationFlags = cc.encapsulationFlags\n\t\t\t& ~EncapsulationFlags.Security;\n\n\t\treturn ret;\n\t}\n}\n\ninterface SecurityCCNonceReportOptions {\n\tnonce: Uint8Array;\n}\n\n@CCCommand(SecurityCommand.NonceReport)\nexport class SecurityCCNonceReport extends SecurityCC {\n\tconstructor(\n\t\toptions: WithAddress<SecurityCCNonceReportOptions>,\n\t) {\n\t\tsuper(options);\n\t\tif (options.nonce.length !== HALF_NONCE_SIZE) {\n\t\t\tthrow new ZWaveError(\n\t\t\t\t`Nonce must have length ${HALF_NONCE_SIZE}!`,\n\t\t\t\tZWaveErrorCodes.Argument_Invalid,\n\t\t\t);\n\t\t}\n\t\tthis.nonce = options.nonce;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCNonceReport {\n\t\tvalidatePayload.withReason(\"Invalid nonce length\")(\n\t\t\traw.payload.length === HALF_NONCE_SIZE,\n\t\t);\n\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tnonce: raw.payload,\n\t\t});\n\t}\n\n\tpublic nonce: Uint8Array;\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = Bytes.view(this.nonce);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: { nonce: buffer2hex(this.nonce) },\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.NonceGet)\n@expectedCCResponse(SecurityCCNonceReport)\nexport class SecurityCCNonceGet extends SecurityCC {}\n\n// @publicAPI\nexport type SecurityCCCommandEncapsulationOptions =\n\t& {\n\t\talternativeNetworkKey?: Uint8Array;\n\t}\n\t& ({\n\t\tencapsulated: CommandClass;\n\t} | {\n\t\tdecryptedCCBytes: Uint8Array;\n\t\tsequenced: boolean;\n\t\tsecondFrame: boolean;\n\t\tsequenceCounter: number;\n\t});\n\nfunction getCCResponseForCommandEncapsulation(\n\tsent: SecurityCCCommandEncapsulation,\n) {\n\tif (sent.encapsulated.expectsCCResponse()) {\n\t\treturn SecurityCCCommandEncapsulation;\n\t}\n}\n\n@CCCommand(SecurityCommand.CommandEncapsulation)\n@expectedCCResponse(\n\tgetCCResponseForCommandEncapsulation,\n\t() => \"checkEncapsulated\",\n)\nexport class SecurityCCCommandEncapsulation extends SecurityCC {\n\tpublic constructor(\n\t\toptions: WithAddress<SecurityCCCommandEncapsulationOptions>,\n\t) {\n\t\tsuper(options);\n\n\t\tif (\"encapsulated\" in options) {\n\t\t\tthis.encapsulated = options.encapsulated;\n\t\t\tthis.encapsulated.encapsulatingCC = this as any;\n\t\t} else {\n\t\t\tthis.decryptedCCBytes = options.decryptedCCBytes;\n\t\t\tthis.sequenced = options.sequenced;\n\t\t\tthis.secondFrame = options.secondFrame;\n\t\t\tthis.sequenceCounter = options.sequenceCounter;\n\t\t}\n\t\tthis.alternativeNetworkKey = options.alternativeNetworkKey;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCCommandEncapsulation {\n\t\tassertSecurityRX(ctx);\n\n\t\t// HALF_NONCE_SIZE bytes iv, 1 byte frame control, at least 1 CC byte, 1 byte nonce id, 8 bytes auth code\n\t\tvalidatePayload(\n\t\t\traw.payload.length >= HALF_NONCE_SIZE + 1 + 1 + 1 + 8,\n\t\t);\n\t\tconst iv = raw.payload.subarray(0, HALF_NONCE_SIZE);\n\t\tconst encryptedPayload = raw.payload.subarray(HALF_NONCE_SIZE, -9);\n\t\tconst nonceId = raw.payload.at(-9)!;\n\t\tconst authCode = raw.payload.subarray(-8);\n\n\t\t// Retrieve the used nonce from the nonce store\n\t\tconst nonce = ctx.securityManager.getNonce(nonceId);\n\t\t// Only accept the message if the nonce hasn't expired\n\t\tif (!nonce) {\n\t\t\tvalidatePayload.fail(\n\t\t\t\t`Nonce ${\n\t\t\t\t\tnum2hex(\n\t\t\t\t\t\tnonceId,\n\t\t\t\t\t)\n\t\t\t\t} expired, cannot decode security encapsulated command.`,\n\t\t\t);\n\t\t}\n\t\t// and mark the nonce as used\n\t\tctx.securityManager.deleteNonce(nonceId);\n\n\t\t// Validate the encrypted data\n\t\tconst authData = getAuthenticationData(\n\t\t\tiv,\n\t\t\tnonce,\n\t\t\tSecurityCommand.CommandEncapsulation,\n\t\t\tctx.sourceNodeId,\n\t\t\tctx.ownNodeId,\n\t\t\tencryptedPayload,\n\t\t);\n\t\tconst expectedAuthCode = computeMAC(\n\t\t\tauthData,\n\t\t\tctx.securityManager.authKey,\n\t\t);\n\t\t// Only accept messages with a correct auth code\n\t\tvalidatePayload.withReason(\n\t\t\t\"Invalid auth code, won't accept security encapsulated command.\",\n\t\t)(authCode.equals(expectedAuthCode));\n\n\t\t// Decrypt the encapsulated CC\n\t\tconst frameControlAndDecryptedCC = decryptAES128OFB(\n\t\t\tencryptedPayload,\n\t\t\tctx.securityManager.encryptionKey,\n\t\t\tBytes.concat([iv, nonce]),\n\t\t);\n\t\tconst frameControl = frameControlAndDecryptedCC[0];\n\t\tconst sequenceCounter = frameControl & 0b1111;\n\t\tconst sequenced = !!(frameControl & 0b1_0000);\n\t\tconst secondFrame = !!(frameControl & 0b10_0000);\n\t\tconst decryptedCCBytes: Uint8Array | undefined =\n\t\t\tframeControlAndDecryptedCC\n\t\t\t\t.subarray(1);\n\n\t\tconst ret = new SecurityCCCommandEncapsulation({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tsequenceCounter,\n\t\t\tsequenced,\n\t\t\tsecondFrame,\n\t\t\tdecryptedCCBytes,\n\t\t});\n\n\t\tret.authData = authData;\n\t\tret.authCode = authCode;\n\t\tret.iv = iv;\n\n\t\treturn ret;\n\t}\n\n\tprivate sequenced: boolean | undefined;\n\tprivate secondFrame: boolean | undefined;\n\tprivate sequenceCounter: number | undefined;\n\n\tprivate decryptedCCBytes: Uint8Array | undefined;\n\tpublic encapsulated!: CommandClass;\n\n\tprivate alternativeNetworkKey?: Uint8Array;\n\n\tpublic get nonceId(): number | undefined {\n\t\treturn this.nonce?.[0];\n\t}\n\tpublic nonce: Uint8Array | undefined;\n\n\t// Only used testing/for debugging purposes\n\tprivate iv?: Uint8Array;\n\tprivate authData?: Uint8Array;\n\tprivate authCode?: Uint8Array;\n\tprivate ciphertext?: Uint8Array;\n\n\tpublic getPartialCCSessionId(): Record<string, any> | undefined {\n\t\tif (this.sequenced) {\n\t\t\treturn {\n\t\t\t\t// Treat Encapsulation and EncapsulationNonceGet as one\n\t\t\t\tccCommand: undefined,\n\t\t\t\tsequence: this.sequenceCounter,\n\t\t\t};\n\t\t} else {\n\t\t\treturn {\n\t\t\t\t// Treat Encapsulation and EncapsulationNonceGet as one\n\t\t\t\tccCommand: undefined,\n\t\t\t};\n\t\t}\n\t}\n\n\tpublic expectMoreMessages(): boolean {\n\t\treturn !!this.sequenced && !this.secondFrame;\n\t}\n\n\tpublic mergePartialCCs(\n\t\tpartials: SecurityCCCommandEncapsulation[],\n\t\tctx: CCParsingContext,\n\t): void {\n\t\t// Concat the CC buffers\n\t\tthis.decryptedCCBytes = Bytes.concat(\n\t\t\t[...partials, this].map((cc) => cc.decryptedCCBytes!),\n\t\t);\n\t\t// make sure this contains a complete CC command that's worth splitting\n\t\tvalidatePayload(this.decryptedCCBytes.length >= 2);\n\t\t// and deserialize the CC\n\t\tthis.encapsulated = CommandClass.parse(this.decryptedCCBytes, ctx);\n\t\tthis.encapsulated.encapsulatingCC = this as any;\n\t}\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tif (!this.nonce) throwNoNonce();\n\t\tif (this.nonce.length !== HALF_NONCE_SIZE) {\n\t\t\tthrowNoNonce(\"Invalid nonce size\");\n\t\t}\n\t\tassertSecurityTX(ctx);\n\n\t\tlet authKey: Uint8Array;\n\t\tlet encryptionKey: Uint8Array;\n\t\tif (this.alternativeNetworkKey) {\n\t\t\tauthKey = generateAuthKey(this.alternativeNetworkKey);\n\t\t\tencryptionKey = generateEncryptionKey(\n\t\t\t\tthis.alternativeNetworkKey,\n\t\t\t);\n\t\t} else {\n\t\t\tauthKey = ctx.securityManager.authKey;\n\t\t\tencryptionKey = ctx.securityManager.encryptionKey;\n\t\t}\n\n\t\tconst serializedCC = this.encapsulated.serialize(ctx);\n\t\tconst plaintext = Bytes.concat([\n\t\t\tBytes.from([0]), // TODO: frame control\n\t\t\tserializedCC,\n\t\t]);\n\t\t// Encrypt the payload\n\t\tconst senderNonce = randomBytes(HALF_NONCE_SIZE);\n\t\tconst iv = Bytes.concat([senderNonce, this.nonce]);\n\t\tconst ciphertext = encryptAES128OFB(plaintext, encryptionKey, iv);\n\t\t// And generate the auth code\n\t\tconst authData = getAuthenticationData(\n\t\t\tsenderNonce,\n\t\t\tthis.nonce,\n\t\t\tthis.ccCommand,\n\t\t\tctx.ownNodeId,\n\t\t\tthis.nodeId,\n\t\t\tciphertext,\n\t\t);\n\t\tconst authCode = computeMAC(authData, authKey);\n\n\t\t// Remember for debugging purposes\n\t\tthis.iv = iv;\n\t\tthis.authData = authData;\n\t\tthis.authCode = authCode;\n\t\tthis.ciphertext = ciphertext;\n\n\t\tthis.payload = Bytes.concat([\n\t\t\tsenderNonce,\n\t\t\tciphertext,\n\t\t\tBytes.from([this.nonceId!]),\n\t\t\tauthCode,\n\t\t]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tprotected computeEncapsulationOverhead(): number {\n\t\t// Security CC adds 8 bytes IV, 1 byte frame control, 1 byte nonce ID, 8 bytes MAC\n\t\treturn super.computeEncapsulationOverhead() + 18;\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\tconst message: MessageRecord = {};\n\t\tif (this.nonceId != undefined) {\n\t\t\tmessage[\"nonce id\"] = this.nonceId;\n\t\t}\n\t\tif (this.sequenced != undefined) {\n\t\t\tmessage.sequenced = this.sequenced;\n\t\t\tif (this.sequenced) {\n\t\t\t\tif (this.secondFrame != undefined) {\n\t\t\t\t\tmessage[\"second frame\"] = this.secondFrame;\n\t\t\t\t}\n\t\t\t\tif (this.sequenceCounter != undefined) {\n\t\t\t\t\tmessage[\"sequence counter\"] = this.sequenceCounter;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\t// Log the plaintext in integration tests and development mode\n\t\tif (\n\t\t\tprocess.env.NODE_ENV === \"test\"\n\t\t\t|| process.env.NODE_ENV === \"development\"\n\t\t) {\n\t\t\tif (this.iv) {\n\t\t\t\tmessage.IV = buffer2hex(this.iv);\n\t\t\t}\n\t\t\tif (this.ciphertext) {\n\t\t\t\tmessage.ciphertext = buffer2hex(this.ciphertext);\n\t\t\t} else if (this.decryptedCCBytes) {\n\t\t\t\tmessage.plaintext = buffer2hex(this.decryptedCCBytes);\n\t\t\t}\n\t\t\tif (this.authData) {\n\t\t\t\tmessage[\"auth data\"] = buffer2hex(this.authData);\n\t\t\t}\n\t\t\tif (this.authCode) {\n\t\t\t\tmessage[\"auth code\"] = buffer2hex(this.authCode);\n\t\t\t}\n\t\t}\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage,\n\t\t};\n\t}\n}\n\n// This is the same message, but with another CC command\n@CCCommand(SecurityCommand.CommandEncapsulationNonceGet)\nexport class SecurityCCCommandEncapsulationNonceGet\n\textends SecurityCCCommandEncapsulation\n{}\n\n@CCCommand(SecurityCommand.SchemeReport)\nexport class SecurityCCSchemeReport extends SecurityCC {\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCSchemeReport {\n\t\tvalidatePayload(raw.payload.length >= 1);\n\t\t// The including controller MUST NOT perform any validation of the Supported Security Schemes byte\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t});\n\t}\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\t// Since it is unlikely that any more schemes will be added to S0, we hardcode the default scheme here (bit 0 = 0)\n\t\tthis.payload = Bytes.from([0]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\t// Hide the default payload line\n\t\t\tmessage: undefined,\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.SchemeGet)\n@expectedCCResponse(SecurityCCSchemeReport)\nexport class SecurityCCSchemeGet extends SecurityCC {\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\t// Since it is unlikely that any more schemes will be added to S0, we hardcode the default scheme here (bit 0 = 0)\n\t\tthis.payload = Bytes.from([0]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\t// Hide the default payload line\n\t\t\tmessage: undefined,\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.SchemeInherit)\n@expectedCCResponse(SecurityCCSchemeReport)\nexport class SecurityCCSchemeInherit extends SecurityCC {\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\t// Since it is unlikely that any more schemes will be added to S0, we hardcode the default scheme here (bit 0 = 0)\n\t\tthis.payload = Bytes.from([0]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\t// Hide the default payload line\n\t\t\tmessage: undefined,\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.NetworkKeyVerify)\nexport class SecurityCCNetworkKeyVerify extends SecurityCC {}\n\n// @publicAPI\nexport interface SecurityCCNetworkKeySetOptions {\n\tnetworkKey: Uint8Array;\n}\n\n@CCCommand(SecurityCommand.NetworkKeySet)\n@expectedCCResponse(SecurityCCNetworkKeyVerify)\nexport class SecurityCCNetworkKeySet extends SecurityCC {\n\tpublic constructor(\n\t\toptions: WithAddress<SecurityCCNetworkKeySetOptions>,\n\t) {\n\t\tsuper(options);\n\t\tif (options.networkKey.length !== 16) {\n\t\t\tthrow new ZWaveError(\n\t\t\t\t`The network key must have length 16!`,\n\t\t\t\tZWaveErrorCodes.Argument_Invalid,\n\t\t\t);\n\t\t}\n\t\tthis.networkKey = options.networkKey;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCNetworkKeySet {\n\t\tvalidatePayload(raw.payload.length >= 16);\n\t\tconst networkKey: Uint8Array = raw.payload.subarray(0, 16);\n\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tnetworkKey,\n\t\t});\n\t}\n\n\tpublic networkKey: Uint8Array;\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = Bytes.view(this.networkKey);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\t// The network key shouldn't be logged, so users can safely post their logs online\n\t\tconst { message, ...log } = super.toLogEntry(ctx);\n\t\treturn log;\n\t}\n}\n\n// @publicAPI\nexport interface SecurityCCCommandsSupportedReportOptions {\n\treportsToFollow?: number;\n\tsupportedCCs: CommandClasses[];\n\tcontrolledCCs: CommandClasses[];\n}\n\n@CCCommand(SecurityCommand.CommandsSupportedReport)\nexport class SecurityCCCommandsSupportedReport extends SecurityCC {\n\tpublic constructor(\n\t\toptions: WithAddress<SecurityCCCommandsSupportedReportOptions>,\n\t) {\n\t\tsuper(options);\n\n\t\tthis.supportedCCs = options.supportedCCs;\n\t\tthis.controlledCCs = options.controlledCCs;\n\t\t// TODO: properly split the CCs into multiple reports\n\t\tthis.reportsToFollow = options.reportsToFollow ?? 0;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCCommandsSupportedReport {\n\t\tvalidatePayload(raw.payload.length >= 1);\n\t\tconst reportsToFollow = raw.payload[0];\n\t\tconst list = parseCCList(raw.payload.subarray(1));\n\t\tconst supportedCCs: CommandClasses[] = list.supportedCCs;\n\t\tconst controlledCCs: CommandClasses[] = list.controlledCCs;\n\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\treportsToFollow,\n\t\t\tsupportedCCs,\n\t\t\tcontrolledCCs,\n\t\t});\n\t}\n\n\tpublic reportsToFollow: number;\n\tpublic supportedCCs: CommandClasses[];\n\tpublic controlledCCs: CommandClasses[];\n\n\tpublic getPartialCCSessionId(): Record<string, any> | undefined {\n\t\t// Nothing special we can distinguish sessions with\n\t\treturn {};\n\t}\n\n\tpublic expectMoreMessages(): boolean {\n\t\treturn this.reportsToFollow > 0;\n\t}\n\n\tpublic mergePartialCCs(\n\t\tpartials: SecurityCCCommandsSupportedReport[],\n\t): void {\n\t\t// Concat the lists of CCs\n\t\tthis.supportedCCs = [...partials, this]\n\t\t\t.map((report) => report.supportedCCs)\n\t\t\t.reduce((prev, cur) => prev.concat(...cur), []);\n\t\tthis.controlledCCs = [...partials, this]\n\t\t\t.map((report) => report.controlledCCs)\n\t\t\t.reduce((prev, cur) => prev.concat(...cur), []);\n\t}\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = Bytes.concat([\n\t\t\tBytes.from([this.reportsToFollow]),\n\t\t\tencodeCCList(this.supportedCCs, this.controlledCCs),\n\t\t]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\treportsToFollow: this.reportsToFollow,\n\t\t\t\tsupportedCCs: this.supportedCCs\n\t\t\t\t\t.map((cc) => getCCName(cc))\n\t\t\t\t\t.map((cc) => `\\n\u00B7 ${cc}`)\n\t\t\t\t\t.join(\"\"),\n\t\t\t\tcontrolledCCs: this.controlledCCs\n\t\t\t\t\t.map((cc) => getCCName(cc))\n\t\t\t\t\t.map((cc) => `\\n\u00B7 ${cc}`)\n\t\t\t\t\t.join(\"\"),\n\t\t\t},\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.CommandsSupportedGet)\n@expectedCCResponse(SecurityCCCommandsSupportedReport)\nexport class SecurityCCCommandsSupportedGet extends SecurityCC {}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kBAsBO;AAOP,kBAAsB;AACtB,IAAAA,eAA0C;AAC1C,mBAAqB;AACrB,yBAA4B;AAC5B,iBAAqC;AACrC,0BAIO;AACP,oCAMO;AACP,mBAAgC;AAChC,qBAAwB;AACxB,yBAA4B;AAC5B,gCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAInC,SAAS,sBACR,aACA,eACA,WACA,eACA,iBACA,kBAA4B;AAE5B,SAAO,kBAAM,OAAO;IACnB;IACA;IACA,kBAAM,KAAK;MACV;MACA;MACA;MACA,iBAAiB;KACjB;IACD;GACA;AACF;AAEA,SAAS,aAAa,QAAe;AACpC,MAAI,UAAU;AACd,MAAI;AAAQ,eAAW,YAAY,MAAM;AACzC,QAAM,IAAI,uBAAW,SAAS,4BAAgB,kBAAkB;AACjE;AAEA,MAAM,kBAAkB;AAExB,SAAS,iBACR,KAAqB;AAErB,MAAI,CAAC,IAAI,WAAW;AACnB,UAAM,IAAI,uBACT,oFACA,4BAAgB,eAAe;EAEjC;AAEA,MAAI,CAAC,IAAI,iBAAiB;AACzB,UAAM,IAAI,uBACT,iFACA,4BAAgB,iBAAiB;EAEnC;AACD;AAEA,SAAS,iBACR,KAAsB;AAEtB,MAAI,CAAC,IAAI,WAAW;AACnB,UAAM,IAAI,uBACT,iFACA,4BAAgB,eAAe;EAEjC;AAEA,MAAI,CAAC,IAAI,iBAAiB;AACzB,UAAM,IAAI,uBACT,8EACA,4BAAgB,iBAAiB;EAEnC;AACD;IASa,iBAAa,MAAA;8BADzB,mCAAI,2BAAe,QAAQ,CAAC;;;;oBACM;qCAAA,YAAa;;;;;;AAAhD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACL,gBAAgB,MAAqB;AAE3C,aAAO;IACR;IAEO,MAAM,iBACZ,cACA,mBAA4B,OAAK;AAEjC,UAAI,kBAAkB;AACrB,aAAK,sBACJ,8BACA,6BAAgB,oBAAoB;MAEtC,OAAO;AACN,aAAK,sBACJ,8BACA,6BAAgB,4BAA4B;MAE9C;AAEA,YAAM,KAAK,KACV,mBACG,yCACA,gCACF;QACD,QAAQ,KAAK,SAAS;QACtB;OACA;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;;;;IAKO,MAAM,WAAQ;AACpB,WAAK,sBAAsB,8BAAiB,6BAAgB,QAAQ;AAEpE,YAAM,KAAK,IAAI,mBAAmB;QACjC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,YAAM,WAAW,MAAM,KAAK,KAAK,YAChC,IACA;QACC,GAAG,KAAK;;QAER,iBAAiB;OACjB;AAEF,UAAI,CAAC;AAAU;AAEf,YAAM,QAAQ,SAAS;AACvB,YAAM,SAAS,KAAK,KAAK;AACzB,aAAO,SACN;QACC,QAAQ,KAAK,SAAS;QACtB,SAAS,OAAO,WAAW,KAAK;SAEjC,EAAE,OAAO,UAAU,KAAK,KAAK,UAAS,GACtC,EAAE,MAAM,KAAI,CAAE;AAEf,aAAO;IACR;;;;;IAMO,MAAM,YAAS;AACrB,WAAK,sBACJ,8BACA,6BAAgB,WAAW;AAG5B,UAAI,CAAC,KAAK,KAAK,iBAAiB;AAC/B,cAAM,IAAI,uBACT,8DACA,4BAAgB,iBAAiB;MAEnC;AAEA,YAAM,QAAQ,KAAK,KAAK,gBAAgB,cACvC,KAAK,SAAS,QACd,eAAe;AAEhB,YAAM,UAAU,KAAK,KAAK,gBAAgB,WAAW,KAAK;AAE1D,YAAM,KAAK,IAAI,sBAAsB;QACpC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B;OACA;AAED,UAAI;AACH,cAAM,KAAK,KAAK,YAAY,IAAI;UAC/B,GAAG,KAAK;;UAER,iBAAiB,4BAAgB,MAC9B,4BAAgB;;UAEnB,iBAAiB;;UAEjB,UAAU,4BAAgB;;UAE1B,8BAA8B;SAC9B;MACF,SAAS,GAAG;AACX,gBAAI,iCAAoB,CAAC,GAAG;AAE3B,eAAK,KAAK,gBAAgB,YAAY,OAAO;AAC7C,iBAAO;QACR,OAAO;AAEN,gBAAM;QACP;MACD;AACA,aAAO;IACR;IAEO,MAAM,oBAAiB;AAC7B,WAAK,sBAAsB,8BAAiB,6BAAgB,SAAS;AAErE,YAAM,KAAK,IAAI,oBAAoB;QAClC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;AAEnD,aAAO,CAAC,CAAC;IACV;IAEO,MAAM,qBAAqB,cAAqB;AACtD,WAAK,sBACJ,8BACA,6BAAgB,YAAY;AAG7B,UAAI,KAAmB,IAAI,uBAAuB;QACjD,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,UAAI,cAAc;AACjB,aAAK,IAAI,+BAA+B;UACvC,QAAQ,KAAK,SAAS;UACtB,eAAe,KAAK,SAAS;UAC7B,cAAc;SACd;MACF;AACA,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;IAEO,MAAM,wBAAqB;AACjC,WAAK,sBACJ,8BACA,6BAAgB,aAAa;AAG9B,YAAM,KAAK,IAAI,wBAAwB;QACtC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IAEpD;IAEO,MAAM,cAAc,YAAsB;AAChD,WAAK,sBACJ,8BACA,6BAAgB,aAAa;AAG9B,YAAM,SAAS,IAAI,wBAAwB;QAC1C,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B;OACA;AACD,YAAM,KAAK,IAAI,+BAA+B;QAC7C,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,cAAc;QACd,uBAAuB,IAAI,WAAW,EAAE,EAAE,KAAK,CAAC;OAChD;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;IAEO,MAAM,mBAAgB;AAC5B,WAAK,sBACJ,8BACA,6BAAgB,gBAAgB;AAGjC,YAAM,KAAK,IAAI,2BAA2B;QACzC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;;IAGO,MAAM,uBAAoB;AAChC,WAAK,sBACJ,8BACA,6BAAgB,oBAAoB;AAGrC,YAAM,KAAK,IAAI,+BAA+B;QAC7C,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,YAAM,WAAW,MAAM,KAAK,KAAK,YAGhC,IACA,KAAK,cAAc;AAEpB,UAAI,UAAU;AACb,mBAAO,mBAAK,UAAU,CAAC,gBAAgB,eAAe,CAAC;MACxD;IACD;IAEO,MAAM,wBACZ,cACA,eAA+B;AAE/B,WAAK,sBACJ,8BACA,6BAAgB,uBAAuB;AAGxC,YAAM,KAAK,IAAI,kCAAkC;QAChD,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B;QACA;QACA,iBAAiB;OACjB;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;;;;IAKY,cAAU,MAAA;8BAFtB,4CAAa,2BAAe,QAAQ,OACpC,kDAAmB,CAAC,CAAC;;;;oBACU;kCAAA,YAAY;;;;;;AAA5C,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IAKL,MAAM,UACZ,KAAqB;AAErB,YAAM,OAAO,KAAK,QAAQ,GAAG;AAC7B,YAAM,WAAW,KAAK,YAAY,GAAG;AACrC,YAAM,MAAM,iBAAM,OACjB,2BAAe,UACf,KACA,QAAQ,EACP,YAAY;QACb,UAAU,4BAAgB;OAC1B;AAED,UAAI,QAAQ,KAAK,IAAI;QACpB,SAAS;QACT,WAAW;OACX;AAED,UAAI;AACJ,UAAI;AAGJ,YAAM,eAAe,KAAK,kBAAkB,IAAI,IAAI;AACpD,eAAS,WAAW,GAAG,YAAY,cAAc,YAAY;AAC5D,cAAM,OAAO,MAAM,IAAI,qBAAoB;AAC3C,YAAI,MAAM;AACT,yBAAe,KAAK;AACpB,0BAAgB,KAAK;AACrB;QACD,WAAW,WAAW,cAAc;AACnC,cAAI,QAAQ,KAAK,IAAI;YACpB,UAAU,KAAK;YACf,SACC,sDAAsD,QAAQ,IAAI,YAAY;YAC/E,OAAO;WACP;AACD,oBAAM,mBAAK,GAAG;QACf;MACD;AAEA,UAAI,CAAC,gBAAgB,CAAC,eAAe;AACpC,YAAI,KAAK,iBAAiB,0BAAc,SAAS,MAAM,MAAM;AAC5D,cAAI,QAAQ,KAAK,IAAI;YACpB,UAAU,KAAK;YACf,SAAS;YACT,OAAO;WACP;QAEF,OAAO;AAGN,cAAI,QACH,KAAK,IACL,oFAAoF;AAErF,eAAK,iBAAiB,0BAAc,WAAW,KAAK;QACrD;AACA;MACD;AAEA,YAAM,WAAqB;QAC1B;QACA;;AAED,iBAAW,MAAM,cAAc;AAC9B,iBAAS,KAAK,YAAK,uBAAU,EAAE,CAAC,EAAE;MACnC;AACA,eAAS,KAAK,iBAAiB;AAC/B,iBAAW,MAAM,eAAe;AAC/B,iBAAS,KAAK,YAAK,uBAAU,EAAE,CAAC,EAAE;MACnC;AACA,UAAI,QAAQ,KAAK,IAAI;QACpB,SAAS,SAAS,KAAK,IAAI;QAC3B,WAAW;OACX;AAGD,iBAAW,MAAM,cAAc;AAI9B,YAAI,OAAO,2BAAe,OAAO;AAChC,mBAAS,MAAM,IAAI,EAAE,QAAQ,KAAI,CAAE;QACpC,OAAO;AACN,mBAAS,MAAM,IAAI;YAClB,aAAa;YACb,QAAQ;WACR;QACF;MACD;AACA,iBAAW,MAAM,eAAe;AAI/B,YAAI,OAAO,2BAAe,OAAO;AAChC,mBAAS,MAAM,IAAI,EAAE,QAAQ,KAAI,CAAE;QACpC,OAAO;AACN,mBAAS,MAAM,IAAI;YAClB,cAAc;YACd,QAAQ;WACR;QACF;MACD;AAGA,UAAI,KAAK,iBAAiB,0BAAc,SAAS,MAAM,MAAM;AAC5D,aAAK,iBAAiB,0BAAc,WAAW,IAAI;AACnD,YAAI,QACH,KAAK,IACL,4CAA4C;MAE9C;AAGA,WAAK,qBAAqB,KAAK,IAAI;IACpC;;IAGO,OAAO,sBAAsB,IAAgB;AAEnD,UAAI,EAAE,GAAG,qBAAqB,+BAAmB,WAAW;AAC3D,eAAO;MACR;AAGA,UACC,cAAc,kCACX,cAAc,0BACd,cAAc,8CAChB;AACD,eAAO;MACR;AAGA,UAAI,cAAcC,aAAY;AAC7B,gBAAQ,GAAG,WAAW;;UAErB,KAAK,6BAAgB;UACrB,KAAK,6BAAgB;;UAErB,KAAK,6BAAgB;UACrB,KAAK,6BAAgB;UACrB,KAAK,6BAAgB;UACrB,KAAK,6BAAgB;AACpB,mBAAO;UAER;AAEC,mBAAO;QACT;MACD;AAGA,aAAO;IACR;;IAGO,OAAO,YACb,WACA,iBACA,IAAgB;AAGhB,YAAM,MAAM,IAAI,+BAA+B;QAC9C,QAAQ,GAAG;QACX,cAAc;OACd;AAID,UAAI,qBAAqB,GAAG,qBACzB,CAAC,+BAAmB;AAEvB,aAAO;IACR;;;;IAQY,yBAAqB,MAAA;8BADjC,yCAAU,6BAAgB,WAAW,CAAC;;;;oBACI;6CAAA,YAAU;;;;;;AAArD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAAkD;AAElD,YAAM,OAAO;AACb,UAAI,QAAQ,MAAM,WAAW,iBAAiB;AAC7C,cAAM,IAAI,uBACT,0BAA0B,eAAe,KACzC,4BAAgB,gBAAgB;MAElC;AACA,WAAK,QAAQ,QAAQ;IACtB;IAEO,OAAO,KACb,KACA,KAAqB;AAErB,kCAAgB,WAAW,sBAAsB,EAChD,IAAI,QAAQ,WAAW,eAAe;AAGvC,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;QACZ,OAAO,IAAI;OACX;IACF;IAEO;IAEA,UAAU,KAAsB;AACtC,WAAK,UAAU,kBAAM,KAAK,KAAK,KAAK;AACpC,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS,EAAE,WAAO,yBAAW,KAAK,KAAK,EAAC;;IAE1C;;;;IAKY,sBAAkB,MAAA;8BAF9B,yCAAU,6BAAgB,QAAQ,OAClC,kDAAmB,qBAAqB,CAAC;;;;oBACF;0CAAA,YAAU;;;;;;AAAlD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;;AAgBb,SAAS,qCACR,MAAoC;AAEpC,MAAI,KAAK,aAAa,kBAAiB,GAAI;AAC1C,WAAO;EACR;AACD;IAOa,kCAA8B,MAAA;8BAL1C,yCAAU,6BAAgB,oBAAoB,OAC9C,kDACA,sCACA,MAAM,mBAAmB,CACzB;;;;oBACmD;sDAAA,YAAU;;;;;;AAA9D,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAA2D;AAE3D,YAAM,OAAO;AAEb,UAAI,kBAAkB,SAAS;AAC9B,aAAK,eAAe,QAAQ;AAC5B,aAAK,aAAa,kBAAkB;MACrC,OAAO;AACN,aAAK,mBAAmB,QAAQ;AAChC,aAAK,YAAY,QAAQ;AACzB,aAAK,cAAc,QAAQ;AAC3B,aAAK,kBAAkB,QAAQ;MAChC;AACA,WAAK,wBAAwB,QAAQ;IACtC;IAEO,OAAO,KACb,KACA,KAAqB;AAErB,uBAAiB,GAAG;AAGpB,uCACC,IAAI,QAAQ,UAAU,kBAAkB,IAAI,IAAI,IAAI,CAAC;AAEtD,YAAM,KAAK,IAAI,QAAQ,SAAS,GAAG,eAAe;AAClD,YAAM,mBAAmB,IAAI,QAAQ,SAAS,iBAAiB,EAAE;AACjE,YAAM,UAAU,IAAI,QAAQ,GAAG,EAAE;AACjC,YAAM,WAAW,IAAI,QAAQ,SAAS,EAAE;AAGxC,YAAM,QAAQ,IAAI,gBAAgB,SAAS,OAAO;AAElD,UAAI,CAAC,OAAO;AACX,oCAAgB,KACf,aACC,sBACC,OAAO,CAET,wDAAwD;MAE1D;AAEA,UAAI,gBAAgB,YAAY,OAAO;AAGvC,YAAM,WAAW,sBAChB,IACA,OACA,6BAAgB,sBAChB,IAAI,cACJ,IAAI,WACJ,gBAAgB;AAEjB,YAAM,uBAAmB,wBACxB,UACA,IAAI,gBAAgB,OAAO;AAG5B,kCAAgB,WACf,gEAAgE,EAC/D,SAAS,OAAO,gBAAgB,CAAC;AAGnC,YAAM,iCAA6B,8BAClC,kBACA,IAAI,gBAAgB,eACpB,kBAAM,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;AAE1B,YAAM,eAAe,2BAA2B,CAAC;AACjD,YAAM,kBAAkB,eAAe;AACvC,YAAM,YAAY,CAAC,EAAE,eAAe;AACpC,YAAM,cAAc,CAAC,EAAE,eAAe;AACtC,YAAM,mBACL,2BACE,SAAS,CAAC;AAEb,YAAM,MAAM,IAAIC,gCAA+B;QAC9C,QAAQ,IAAI;QACZ;QACA;QACA;QACA;OACA;AAED,UAAI,WAAW;AACf,UAAI,WAAW;AACf,UAAI,KAAK;AAET,aAAO;IACR;IAEQ;IACA;IACA;IAEA;IACD;IAEC;IAER,IAAW,UAAO;AACjB,aAAO,KAAK,QAAQ,CAAC;IACtB;IACO;;IAGC;IACA;IACA;IACA;IAED,wBAAqB;AAC3B,UAAI,KAAK,WAAW;AACnB,eAAO;;UAEN,WAAW;UACX,UAAU,KAAK;;MAEjB,OAAO;AACN,eAAO;;UAEN,WAAW;;MAEb;IACD;IAEO,qBAAkB;AACxB,aAAO,CAAC,CAAC,KAAK,aAAa,CAAC,KAAK;IAClC;IAEO,gBACN,UACA,KAAqB;AAGrB,WAAK,mBAAmB,kBAAM,OAC7B,CAAC,GAAG,UAAU,IAAI,EAAE,IAAI,CAAC,OAAO,GAAG,gBAAiB,CAAC;AAGtD,uCAAgB,KAAK,iBAAiB,UAAU,CAAC;AAEjD,WAAK,eAAe,iCAAa,MAAM,KAAK,kBAAkB,GAAG;AACjE,WAAK,aAAa,kBAAkB;IACrC;IAEO,UAAU,KAAsB;AACtC,UAAI,CAAC,KAAK;AAAO,qBAAY;AAC7B,UAAI,KAAK,MAAM,WAAW,iBAAiB;AAC1C,qBAAa,oBAAoB;MAClC;AACA,uBAAiB,GAAG;AAEpB,UAAI;AACJ,UAAI;AACJ,UAAI,KAAK,uBAAuB;AAC/B,sBAAU,6BAAgB,KAAK,qBAAqB;AACpD,4BAAgB,mCACf,KAAK,qBAAqB;MAE5B,OAAO;AACN,kBAAU,IAAI,gBAAgB;AAC9B,wBAAgB,IAAI,gBAAgB;MACrC;AAEA,YAAM,eAAe,KAAK,aAAa,UAAU,GAAG;AACpD,YAAM,YAAY,kBAAM,OAAO;QAC9B,kBAAM,KAAK,CAAC,CAAC,CAAC;;QACd;OACA;AAED,YAAM,kBAAc,gCAAY,eAAe;AAC/C,YAAM,KAAK,kBAAM,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC;AACjD,YAAM,iBAAa,8BAAiB,WAAW,eAAe,EAAE;AAEhE,YAAM,WAAW,sBAChB,aACA,KAAK,OACL,KAAK,WACL,IAAI,WACJ,KAAK,QACL,UAAU;AAEX,YAAM,eAAW,wBAAW,UAAU,OAAO;AAG7C,WAAK,KAAK;AACV,WAAK,WAAW;AAChB,WAAK,WAAW;AAChB,WAAK,aAAa;AAElB,WAAK,UAAU,kBAAM,OAAO;QAC3B;QACA;QACA,kBAAM,KAAK,CAAC,KAAK,OAAQ,CAAC;QAC1B;OACA;AACD,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEU,+BAA4B;AAErC,aAAO,MAAM,6BAA4B,IAAK;IAC/C;IAEO,WAAW,KAAgB;AACjC,YAAM,UAAyB,CAAA;AAC/B,UAAI,KAAK,WAAW,QAAW;AAC9B,gBAAQ,UAAU,IAAI,KAAK;MAC5B;AACA,UAAI,KAAK,aAAa,QAAW;AAChC,gBAAQ,YAAY,KAAK;AACzB,YAAI,KAAK,WAAW;AACnB,cAAI,KAAK,eAAe,QAAW;AAClC,oBAAQ,cAAc,IAAI,KAAK;UAChC;AACA,cAAI,KAAK,mBAAmB,QAAW;AACtC,oBAAQ,kBAAkB,IAAI,KAAK;UACpC;QACD;MACD;AAEA,UACC,QAAQ,IAAI,aAAa,UACtB,QAAQ,IAAI,aAAa,eAC3B;AACD,YAAI,KAAK,IAAI;AACZ,kBAAQ,SAAK,yBAAW,KAAK,EAAE;QAChC;AACA,YAAI,KAAK,YAAY;AACpB,kBAAQ,iBAAa,yBAAW,KAAK,UAAU;QAChD,WAAW,KAAK,kBAAkB;AACjC,kBAAQ,gBAAY,yBAAW,KAAK,gBAAgB;QACrD;AACA,YAAI,KAAK,UAAU;AAClB,kBAAQ,WAAW,QAAI,yBAAW,KAAK,QAAQ;QAChD;AACA,YAAI,KAAK,UAAU;AAClB,kBAAQ,WAAW,QAAI,yBAAW,KAAK,QAAQ;QAChD;MACD;AACA,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB;;IAEF;;;;IAKY,0CAAsC,MAAA;8BADlD,yCAAU,6BAAgB,4BAA4B,CAAC;;;;oBAE/C;8DAAA,YAA8B;;;;;;AADvC,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;;IAKA,0BAAsB,MAAA;8BADlC,yCAAU,6BAAgB,YAAY,CAAC;;;;oBACI;8CAAA,YAAU;;;;;;AAAtD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACL,OAAO,KACb,KACA,KAAqB;AAErB,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AAEvC,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;OACZ;IACF;IAEO,UAAU,KAAsB;AAEtC,WAAK,UAAU,kBAAM,KAAK,CAAC,CAAC,CAAC;AAC7B,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;;QAEvB,SAAS;;IAEX;;;;IAKY,uBAAmB,MAAA;8BAF/B,yCAAU,6BAAgB,SAAS,OACnC,kDAAmB,sBAAsB,CAAC;;;;oBACF;2CAAA,YAAU;;;;;;AAAnD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACL,UAAU,KAAsB;AAEtC,WAAK,UAAU,kBAAM,KAAK,CAAC,CAAC,CAAC;AAC7B,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;;QAEvB,SAAS;;IAEX;;;;IAKY,2BAAuB,MAAA;8BAFnC,yCAAU,6BAAgB,aAAa,OACvC,kDAAmB,sBAAsB,CAAC;;;;oBACE;+CAAA,YAAU;;;;;;AAAvD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACL,UAAU,KAAsB;AAEtC,WAAK,UAAU,kBAAM,KAAK,CAAC,CAAC,CAAC;AAC7B,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;;QAEvB,SAAS;;IAEX;;;;IAIY,8BAA0B,MAAA;8BADtC,yCAAU,6BAAgB,gBAAgB,CAAC;;;;oBACI;kDAAA,YAAU;;;;;;AAA1D,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;;IASA,2BAAuB,MAAA;8BAFnC,yCAAU,6BAAgB,aAAa,OACvC,kDAAmB,0BAA0B,CAAC;;;;oBACF;+CAAA,YAAU;;;;;;AAAvD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAAoD;AAEpD,YAAM,OAAO;AACb,UAAI,QAAQ,WAAW,WAAW,IAAI;AACrC,cAAM,IAAI,uBACT,wCACA,4BAAgB,gBAAgB;MAElC;AACA,WAAK,aAAa,QAAQ;IAC3B;IAEO,OAAO,KACb,KACA,KAAqB;AAErB,uCAAgB,IAAI,QAAQ,UAAU,EAAE;AACxC,YAAM,aAAyB,IAAI,QAAQ,SAAS,GAAG,EAAE;AAEzD,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;QACZ;OACA;IACF;IAEO;IAEA,UAAU,KAAsB;AACtC,WAAK,UAAU,kBAAM,KAAK,KAAK,UAAU;AACzC,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AAEjC,YAAM,EAAE,SAAS,GAAG,IAAG,IAAK,MAAM,WAAW,GAAG;AAChD,aAAO;IACR;;;;IAWY,qCAAiC,MAAA;8BAD7C,yCAAU,6BAAgB,uBAAuB,CAAC;;;;oBACI;yDAAA,YAAU;;;;;;AAAjE,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAA8D;AAE9D,YAAM,OAAO;AAEb,WAAK,eAAe,QAAQ;AAC5B,WAAK,gBAAgB,QAAQ;AAE7B,WAAK,kBAAkB,QAAQ,mBAAmB;IACnD;IAEO,OAAO,KACb,KACA,KAAqB;AAErB,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,YAAM,kBAAkB,IAAI,QAAQ,CAAC;AACrC,YAAM,WAAO,yBAAY,IAAI,QAAQ,SAAS,CAAC,CAAC;AAChD,YAAM,eAAiC,KAAK;AAC5C,YAAM,gBAAkC,KAAK;AAE7C,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;QACZ;QACA;QACA;OACA;IACF;IAEO;IACA;IACA;IAEA,wBAAqB;AAE3B,aAAO,CAAA;IACR;IAEO,qBAAkB;AACxB,aAAO,KAAK,kBAAkB;IAC/B;IAEO,gBACN,UAA6C;AAG7C,WAAK,eAAe,CAAC,GAAG,UAAU,IAAI,EACpC,IAAI,CAAC,WAAW,OAAO,YAAY,EACnC,OAAO,CAAC,MAAM,QAAQ,KAAK,OAAO,GAAG,GAAG,GAAG,CAAA,CAAE;AAC/C,WAAK,gBAAgB,CAAC,GAAG,UAAU,IAAI,EACrC,IAAI,CAAC,WAAW,OAAO,aAAa,EACpC,OAAO,CAAC,MAAM,QAAQ,KAAK,OAAO,GAAG,GAAG,GAAG,CAAA,CAAE;IAChD;IAEO,UAAU,KAAsB;AACtC,WAAK,UAAU,kBAAM,OAAO;QAC3B,kBAAM,KAAK,CAAC,KAAK,eAAe,CAAC;YACjC,0BAAa,KAAK,cAAc,KAAK,aAAa;OAClD;AACD,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACR,iBAAiB,KAAK;UACtB,cAAc,KAAK,aACjB,IAAI,CAAC,WAAO,uBAAU,EAAE,CAAC,EACzB,IAAI,CAAC,OAAO;OAAO,EAAE,EAAE,EACvB,KAAK,EAAE;UACT,eAAe,KAAK,cAClB,IAAI,CAAC,WAAO,uBAAU,EAAE,CAAC,EACzB,IAAI,CAAC,OAAO;OAAO,EAAE,EAAE,EACvB,KAAK,EAAE;;;IAGZ;;;;IAKY,kCAA8B,MAAA;8BAF1C,yCAAU,6BAAgB,oBAAoB,OAC9C,kDAAmB,iCAAiC,CAAC;;;;oBACF;sDAAA,YAAU;;;;;;AAA9D,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;;",
+  "names": ["import_safe", "SecurityCC", "SecurityCCCommandEncapsulation"]
 }