agentvault 1.0.1 → 1.0.5

package/dist/src/vault/bitwarden.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bitwarden.js","sourceRoot":"","sources":["../../../src/vault/bitwarden.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AA+B1C,MAAM,OAAO,iBAAiB;IACnB,IAAI,GAAG,eAAe,CAAC;IAEf,OAAO,CAAS;IAChB,KAAK,CAAS;IACd,OAAO,CAAS;IAEjC,YAAY,MAAuB;QACjC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC;QAElC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,qCAAqC;gBACrC,4CAA4C;gBAC5C,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,mDAAmD;IAC3C,QAAQ,CAAC,GAAW;QAC1B,OAAO,cAAc,IAAI,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;IAC7C,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,EAAE,CAAC,IAAc;QAC7B,MAAM,GAAG,GAAG;YACV,GAAG,OAAO,CAAC,GAAG;YACd,UAAU,EAAE,IAAI,CAAC,OAAO;SACzB,CAAC;QAEF,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/D,GAAG;YACH,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ;SACtC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAiE,EAAE,EAAE;YAC7E,oEAAoE;YACpE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,IAAI,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YACnB,iDAAiD;QACnD,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAED,+EAA+E;IACvE,YAAY,CAAI,GAAW;QACjC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;YACpE,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAS,GAAG,CAAC,CAAC;YAC5C,OAAO,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,yDAAyD;YACzD,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,KAAa;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAEhC,8DAA8D;QAC9D,IAAI,UAAU,GAAkB,IAAI,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;YACpE,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAS,GAAG,CAAC,CAAC;YAC5C,UAAU,GAAG,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QAED,mDAAmD;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,IAAI,EAAE,CAAC;YACP,IAAI;YACJ,KAAK,EAAE,KAAK;YACZ,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;SACxB,CAAC,CAAC;QAEH,8CAA8C;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAExD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,MAAM,GAAG,cAAc,IAAI,CAAC,OAAO,GAAG,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,IAAI,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;YAC1G,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAW,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,CAAC;YACtB,OAAO,KAAK;iBACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;iBACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAS,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,0BAA0B,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAW,GAAG,CAAC,CAAC;YAEhD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;YACzE,CAAC;YAED,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;gBACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;YAClF,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;YACrF,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,wBAAwB,MAAM,CAAC,SAAS,GAAG;aACrD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,mEAAmE;iBAC7E,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAkC,GAAG,EAAE,EAAE,CAAC;QAC9E,CAAC;IACH,CAAC;CACF"}

package/dist/src/vault/client.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Secret manager client for agent secret management
+ *
+ * Supports HashiCorp Vault and Bitwarden CLI backends while preserving
+ * a per-agent secret namespace.
+ */
+import type { VaultConfig, AgentVaultPolicy, VaultSecret, VaultSecretMetadata, VaultOperationResult, VaultHealthStatus, VaultSecretListEntry, AgentVaultInitOptions } from './types.js';
+export declare class VaultClient {
+    private config;
+    private policy;
+    private clientToken;
+    /**
+     * SEC-2: undici Agent that pins the configured CA certificate (and
+     * optionally disables verification when `tlsSkipVerify` is set). Used
+     * as the `dispatcher` on every fetch so TLS is actually validated
+     * against the user-supplied CA — the prior implementation loaded
+     * `caCertPath` but never wired it to fetch, leaving MITM possible.
+     */
+    private dispatcher;
+    constructor(config: VaultConfig, policy: AgentVaultPolicy);
+    static create(agentId: string, options?: AgentVaultInitOptions): VaultClient;
+    static createWithConfig(config: VaultConfig, policy: AgentVaultPolicy): VaultClient;
+    private get backend();
+    private runBitwarden;
+    private getToken;
+    private authenticateAppRole;
+    private authenticateUserPass;
+    private authenticateKubernetes;
+    private rawRequest;
+    private request;
+    private buildSecretPath;
+    private buildListPath;
+    private validateKey;
+    get agentId(): string;
+    get secretPath(): string;
+    health(): Promise<VaultOperationResult<VaultHealthStatus>>;
+    getSecret(key: string): Promise<VaultOperationResult<VaultSecret>>;
+    putSecret(key: string, value: string | Record<string, string>, metadata?: Record<string, string>): Promise<VaultOperationResult<VaultSecretMetadata>>;
+    deleteSecret(key: string): Promise<VaultOperationResult>;
+    listSecrets(): Promise<VaultOperationResult<VaultSecretListEntry[]>>;
+    secretExists(key: string): Promise<boolean>;
+    getPolicy(): AgentVaultPolicy;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/src/vault/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/vault/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EACV,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAiFpB,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,WAAW,CAAuB;IAC1C;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAsB;gBAE5B,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB;IAMzD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,WAAW;IA6B5E,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,GAAG,WAAW;IAInF,OAAO,KAAK,OAAO,GAElB;YAEa,YAAY;YAmBZ,QAAQ;YAuBR,mBAAmB;YAcnB,oBAAoB;YAepB,sBAAsB;YAwBtB,UAAU;YA2DV,OAAO;IASrB,OAAO,CAAC,eAAe;IAevB,OAAO,CAAC,aAAa;IAcrB,OAAO,CAAC,WAAW;IA0BnB,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAEK,MAAM,IAAI,OAAO,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IA2D1D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;IA2DlE,SAAS,CACb,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACtC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;IAiF/C,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAmCxD,WAAW,IAAI,OAAO,CAAC,oBAAoB,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAuCpE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKjD,SAAS,IAAI,gBAAgB;CAG9B"}

package/dist/src/vault/client.js

@@ -0,0 +1,523 @@
+/**
+ * Secret manager client for agent secret management
+ *
+ * Supports HashiCorp Vault and Bitwarden CLI backends while preserving
+ * a per-agent secret namespace.
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import * as fs from 'node:fs';
+import { Agent as UndiciAgent } from 'undici';
+import { loadVaultConfig, getOrCreateAgentPolicy, validateVaultConfig, } from './config.js';
+const execFileAsync = promisify(execFile);
+/**
+ * SEC-6: Convert a glob pattern (supporting `*` and `?` wildcards only)
+ * to an anchored RegExp safely. All other characters are escaped so they
+ * cannot inject regex metacharacters that would cause ReDoS or unintended
+ * matches.
+ *
+ * `*`  → `.*`  (greedy)
+ * `?`  → `.`   (single char)
+ * everything else is regex-escaped
+ */
+function globToSafeRegex(pattern) {
+    let out = '';
+    for (const ch of pattern) {
+        if (ch === '*')
+            out += '.*';
+        else if (ch === '?')
+            out += '.';
+        else
+            out += ch.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+    }
+    return new RegExp(`^${out}$`);
+}
+/**
+ * SEC-2: build an undici dispatcher that honours TLS configuration.
+ * Returns undefined when neither caCertPath nor tlsSkipVerify are set,
+ * so plaintext-HTTP test setups keep working with no dispatcher attached.
+ */
+function buildVaultDispatcher(config) {
+    const tlsOpts = {};
+    if (config.caCertPath) {
+        try {
+            tlsOpts.ca = fs.readFileSync(config.caCertPath);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : 'unknown';
+            throw new Error(`Vault TLS CA certificate not readable at ${config.caCertPath}: ${msg}`);
+        }
+    }
+    if (config.tlsSkipVerify) {
+        tlsOpts.rejectUnauthorized = false;
+    }
+    if (tlsOpts.ca === undefined && tlsOpts.rejectUnauthorized === undefined) {
+        return undefined;
+    }
+    return new UndiciAgent({ connect: tlsOpts });
+}
+export class VaultClient {
+    config;
+    policy;
+    clientToken = null;
+    /**
+     * SEC-2: undici Agent that pins the configured CA certificate (and
+     * optionally disables verification when `tlsSkipVerify` is set). Used
+     * as the `dispatcher` on every fetch so TLS is actually validated
+     * against the user-supplied CA — the prior implementation loaded
+     * `caCertPath` but never wired it to fetch, leaving MITM possible.
+     */
+    dispatcher;
+    constructor(config, policy) {
+        this.config = { ...config, backend: config.backend ?? 'hashicorp' };
+        this.policy = policy;
+        this.dispatcher = buildVaultDispatcher(config);
+    }
+    static create(agentId, options) {
+        const config = loadVaultConfig();
+        if (!config) {
+            throw new Error('Vault is not configured. Set VAULT_ADDR and VAULT_TOKEN environment variables, ' +
+                'or run `agentvault vault init` to configure.');
+        }
+        const errors = validateVaultConfig(config);
+        if (errors.length > 0) {
+            throw new Error(`Invalid Vault configuration: ${errors.join(', ')}`);
+        }
+        const policy = getOrCreateAgentPolicy(agentId, options?.engine ?? 'kv-v2');
+        if (options?.maxSecrets) {
+            policy.maxSecrets = options.maxSecrets;
+        }
+        if (options?.allowedKeyPatterns) {
+            policy.allowedKeyPatterns = options.allowedKeyPatterns;
+        }
+        return new VaultClient(config, policy);
+    }
+    static createWithConfig(config, policy) {
+        return new VaultClient(config, policy);
+    }
+    get backend() {
+        return this.config.backend ?? 'hashicorp';
+    }
+    async runBitwarden(args) {
+        try {
+            const { stdout, stderr } = await execFileAsync('bw', args, {
+                env: process.env,
+            });
+            if (stderr && stderr.trim().length > 0 && !stdout) {
+                throw new Error(stderr.trim());
+            }
+            return stdout.trim();
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                throw new Error(`Bitwarden CLI failed: ${error.message}`);
+            }
+            throw new Error('Bitwarden CLI failed with unknown error');
+        }
+    }
+    async getToken() {
+        if (this.clientToken) {
+            return this.clientToken;
+        }
+        switch (this.config.authMethod) {
+            case 'token':
+                if (!this.config.token) {
+                    throw new Error('Vault token not configured');
+                }
+                this.clientToken = this.config.token;
+                return this.clientToken;
+            case 'approle':
+                return this.authenticateAppRole();
+            case 'userpass':
+                return this.authenticateUserPass();
+            case 'kubernetes':
+                return this.authenticateKubernetes();
+            default:
+                throw new Error(`Unsupported auth method: ${this.config.authMethod}`);
+        }
+    }
+    async authenticateAppRole() {
+        const response = await this.rawRequest('POST', '/v1/auth/approle/login', {
+            role_id: this.config.roleId,
+            secret_id: this.config.secretId,
+        });
+        if (!response.auth?.client_token) {
+            throw new Error('AppRole authentication failed: no token returned');
+        }
+        this.clientToken = response.auth.client_token;
+        return this.clientToken;
+    }
+    async authenticateUserPass() {
+        const response = await this.rawRequest('POST', `/v1/auth/userpass/login/${this.config.username}`, { password: this.config.password });
+        if (!response.auth?.client_token) {
+            throw new Error('Userpass authentication failed: no token returned');
+        }
+        this.clientToken = response.auth.client_token;
+        return this.clientToken;
+    }
+    async authenticateKubernetes() {
+        const fs = await import('node:fs');
+        const jwtPath = '/var/run/secrets/kubernetes.io/serviceaccount/token';
+        let jwt;
+        try {
+            jwt = fs.readFileSync(jwtPath, 'utf-8').trim();
+        }
+        catch {
+            throw new Error(`Cannot read Kubernetes service account token from ${jwtPath}`);
+        }
+        const response = await this.rawRequest('POST', '/v1/auth/kubernetes/login', {
+            role: this.config.k8sRole,
+            jwt,
+        });
+        if (!response.auth?.client_token) {
+            throw new Error('Kubernetes authentication failed: no token returned');
+        }
+        this.clientToken = response.auth.client_token;
+        return this.clientToken;
+    }
+    async rawRequest(method, apiPath, body) {
+        const url = `${this.config.address}${apiPath}`;
+        const headers = {
+            'Content-Type': 'application/json',
+        };
+        if (this.clientToken || this.config.token) {
+            headers['X-Vault-Token'] = this.clientToken || this.config.token;
+        }
+        if (this.config.namespace) {
+            headers['X-Vault-Namespace'] = this.config.namespace;
+        }
+        const controller = new AbortController();
+        const timeout = this.config.timeoutMs ?? 30000;
+        const timeoutId = setTimeout(() => controller.abort(), timeout);
+        try {
+            const fetchOptions = {
+                method,
+                headers,
+                signal: controller.signal,
+            };
+            if (body && method !== 'GET') {
+                fetchOptions.body = JSON.stringify(body);
+            }
+            // SEC-2: attach the TLS-configured dispatcher so the CA cert is
+            // actually used when validating the Vault server certificate.
+            if (this.dispatcher) {
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                fetchOptions.dispatcher = this.dispatcher;
+            }
+            const response = await fetch(url, fetchOptions);
+            if (response.status === 204) {
+                return {};
+            }
+            const data = await response.json();
+            if (!response.ok) {
+                const errors = data.errors?.join(', ') ?? `HTTP ${response.status}`;
+                throw new Error(`Vault API error: ${errors}`);
+            }
+            return data;
+        }
+        finally {
+            clearTimeout(timeoutId);
+        }
+    }
+    async request(method, apiPath, body) {
+        await this.getToken();
+        return this.rawRequest(method, apiPath, body);
+    }
+    buildSecretPath(key, action = 'data') {
+        const engine = this.policy.engine === 'kv-v1' ? '' : action;
+        const basePath = this.policy.secretPath;
+        if (this.policy.engine === 'kv-v1') {
+            return `/v1/${basePath}/${key}`;
+        }
+        const parts = basePath.split('/');
+        const mount = parts[0];
+        const secretSubPath = parts.slice(1).join('/');
+        return `/v1/${mount}/${engine}/${secretSubPath}/${key}`;
+    }
+    buildListPath() {
+        const basePath = this.policy.secretPath;
+        if (this.policy.engine === 'kv-v1') {
+            return `/v1/${basePath}`;
+        }
+        const parts = basePath.split('/');
+        const mount = parts[0];
+        const secretSubPath = parts.slice(1).join('/');
+        return `/v1/${mount}/metadata/${secretSubPath}`;
+    }
+    validateKey(key) {
+        if (!key || key.trim().length === 0) {
+            return 'Secret key cannot be empty';
+        }
+        if (key.includes('..') || key.startsWith('/')) {
+            return 'Secret key cannot contain path traversal sequences';
+        }
+        if (this.policy.allowedKeyPatterns && this.policy.allowedKeyPatterns.length > 0) {
+            // SEC-6: escape regex metachars in the user-supplied pattern before
+            // expanding `*`/`?`. The previous implementation only substituted
+            // those two and left `.` / `(` / etc. raw, enabling ReDoS and
+            // unintended matches.
+            const matches = this.policy.allowedKeyPatterns.some(pattern => {
+                return globToSafeRegex(pattern).test(key);
+            });
+            if (!matches) {
+                return `Secret key "${key}" does not match allowed patterns: ${this.policy.allowedKeyPatterns.join(', ')}`;
+            }
+        }
+        return null;
+    }
+    get agentId() {
+        return this.policy.agentId;
+    }
+    get secretPath() {
+        return this.policy.secretPath;
+    }
+    async health() {
+        if (this.backend === 'bitwarden') {
+            try {
+                await this.runBitwarden(['--version']);
+                return {
+                    success: true,
+                    data: {
+                        initialized: true,
+                        sealed: false,
+                        version: 'bitwarden-cli',
+                        clusterName: 'bitwarden',
+                    },
+                };
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'Unknown error';
+                return {
+                    success: false,
+                    error: `Failed to check Bitwarden CLI health: ${message}`,
+                };
+            }
+        }
+        try {
+            const fetchOptions = {
+                method: 'GET',
+                signal: AbortSignal.timeout(this.config.timeoutMs ?? 5000),
+            };
+            // SEC-2: honour the pinned CA on the health probe too
+            if (this.dispatcher) {
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                fetchOptions.dispatcher = this.dispatcher;
+            }
+            const response = await fetch(`${this.config.address}/v1/sys/health`, fetchOptions);
+            const data = await response.json();
+            return {
+                success: true,
+                data: {
+                    initialized: data.initialized,
+                    sealed: data.sealed,
+                    version: data.version,
+                    clusterName: data.cluster_name,
+                },
+            };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            return {
+                success: false,
+                error: `Failed to check Vault health: ${message}`,
+            };
+        }
+    }
+    async getSecret(key) {
+        const keyError = this.validateKey(key);
+        if (keyError) {
+            return { success: false, error: keyError };
+        }
+        if (this.backend === 'bitwarden') {
+            try {
+                const itemName = `agentvault/${this.policy.agentId}/${key}`;
+                const output = await this.runBitwarden(['get', 'item', itemName, '--raw']);
+                const secret = {
+                    key,
+                    value: output,
+                    metadata: {
+                        version: 1,
+                        createdAt: new Date().toISOString(),
+                        updatedAt: new Date().toISOString(),
+                        destroyed: false,
+                    },
+                };
+                return { success: true, data: secret };
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'Unknown error';
+                return { success: false, error: `Failed to get secret "${key}": ${message}` };
+            }
+        }
+        try {
+            const apiPath = this.buildSecretPath(key);
+            const response = await this.request('GET', apiPath);
+            if (!response.data) {
+                return { success: false, error: `Secret "${key}" not found` };
+            }
+            const secretData = response.data.data ?? {};
+            const metadata = response.data.metadata;
+            const secret = {
+                key,
+                value: secretData,
+                metadata: {
+                    version: metadata?.version ?? 1,
+                    createdAt: metadata?.created_time ?? new Date().toISOString(),
+                    updatedAt: metadata?.created_time ?? new Date().toISOString(),
+                    destroyed: metadata?.destroyed ?? false,
+                    customMetadata: metadata?.custom_metadata ?? undefined,
+                },
+            };
+            return { success: true, data: secret };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            return { success: false, error: `Failed to get secret "${key}": ${message}` };
+        }
+    }
+    async putSecret(key, value, metadata) {
+        const keyError = this.validateKey(key);
+        if (keyError) {
+            return { success: false, error: keyError };
+        }
+        if (!this.policy.allowCreate && !this.policy.allowUpdate) {
+            return {
+                success: false,
+                error: `Agent "${this.policy.agentId}" is not allowed to write secrets`,
+            };
+        }
+        if (this.backend === 'bitwarden') {
+            try {
+                if (typeof value !== 'string') {
+                    return {
+                        success: false,
+                        error: 'Bitwarden backend currently supports string secret values only',
+                    };
+                }
+                const itemName = `agentvault/${this.policy.agentId}/${key}`;
+                await this.runBitwarden(['create', 'item', itemName, '--notes', value]);
+                return {
+                    success: true,
+                    data: {
+                        version: 1,
+                        createdAt: new Date().toISOString(),
+                        updatedAt: new Date().toISOString(),
+                        destroyed: false,
+                        customMetadata: metadata,
+                    },
+                };
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'Unknown error';
+                return { success: false, error: `Failed to put secret "${key}": ${message}` };
+            }
+        }
+        try {
+            const data = typeof value === 'string'
+                ? { value }
+                : value;
+            const body = { data };
+            if (metadata && this.policy.engine === 'kv-v2') {
+                body.options = { cas: 0 };
+            }
+            const apiPath = this.buildSecretPath(key);
+            const response = await this.request('POST', apiPath, body);
+            const resultMetadata = {
+                version: response.data?.metadata?.version ?? 1,
+                createdAt: response.data?.metadata?.created_time ?? new Date().toISOString(),
+                updatedAt: response.data?.metadata?.created_time ?? new Date().toISOString(),
+                destroyed: false,
+                customMetadata: metadata,
+            };
+            if (metadata && this.policy.engine === 'kv-v2') {
+                try {
+                    const metadataPath = this.buildSecretPath(key, 'metadata');
+                    await this.request('POST', metadataPath, {
+                        custom_metadata: metadata,
+                    });
+                }
+                catch {
+                    // ignore metadata failures
+                }
+            }
+            return { success: true, data: resultMetadata };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            return { success: false, error: `Failed to put secret "${key}": ${message}` };
+        }
+    }
+    async deleteSecret(key) {
+        const keyError = this.validateKey(key);
+        if (keyError) {
+            return { success: false, error: keyError };
+        }
+        if (!this.policy.allowDelete) {
+            return {
+                success: false,
+                error: `Agent "${this.policy.agentId}" is not allowed to delete secrets`,
+            };
+        }
+        if (this.backend === 'bitwarden') {
+            try {
+                const itemName = `agentvault/${this.policy.agentId}/${key}`;
+                await this.runBitwarden(['delete', 'item', itemName]);
+                return { success: true };
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'Unknown error';
+                return { success: false, error: `Failed to delete secret "${key}": ${message}` };
+            }
+        }
+        try {
+            const apiPath = this.buildSecretPath(key);
+            await this.request('DELETE', apiPath);
+            return { success: true };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            return { success: false, error: `Failed to delete secret "${key}": ${message}` };
+        }
+    }
+    async listSecrets() {
+        if (!this.policy.allowList) {
+            return {
+                success: false,
+                error: `Agent "${this.policy.agentId}" is not allowed to list secrets`,
+            };
+        }
+        if (this.backend === 'bitwarden') {
+            return {
+                success: false,
+                error: 'Bitwarden backend does not support listing by agent prefix yet',
+            };
+        }
+        try {
+            const apiPath = this.buildListPath();
+            const response = await this.request('LIST', apiPath);
+            const keys = response.data?.keys ?? [];
+            const entries = keys.map(key => ({
+                key,
+                version: 0,
+                createdAt: '',
+                updatedAt: '',
+            }));
+            return { success: true, data: entries };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            if (message.includes('404') || message.includes('not found')) {
+                return { success: true, data: [] };
+            }
+            return { success: false, error: `Failed to list secrets: ${message}` };
+        }
+    }
+    async secretExists(key) {
+        const result = await this.getSecret(key);
+        return result.success && !!result.data;
+    }
+    getPolicy() {
+        return { ...this.policy };
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/src/vault/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/vault/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAC;AAW9C,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,EAAE,KAAK,GAAG;YAAE,GAAG,IAAI,IAAI,CAAC;aACvB,IAAI,EAAE,KAAK,GAAG;YAAE,GAAG,IAAI,GAAG,CAAC;;YAC3B,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,MAAmB;IAC/C,MAAM,OAAO,GAA2D,EAAE,CAAC;IAE3E,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,4CAA4C,MAAM,CAAC,UAAU,KAAK,GAAG,EAAE,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,CAAC,kBAAkB,GAAG,KAAK,CAAC;IACrC,CAAC;IAED,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACzE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,WAAW,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAC/C,CAAC;AAwBD,MAAM,OAAO,WAAW;IACd,MAAM,CAAc;IACpB,MAAM,CAAmB;IACzB,WAAW,GAAkB,IAAI,CAAC;IAC1C;;;;;;OAMG;IACK,UAAU,CAAsB;IAExC,YAAY,MAAmB,EAAE,MAAwB;QACvD,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC;QACpE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,OAAe,EAAE,OAA+B;QAC5D,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,iFAAiF;gBACjF,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,sBAAsB,CACnC,OAAO,EACP,OAAO,EAAE,MAAM,IAAI,OAAO,CAC3B,CAAC;QAEF,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;YACxB,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACzC,CAAC;QACD,IAAI,OAAO,EAAE,kBAAkB,EAAE,CAAC;YAChC,MAAM,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACzD,CAAC;QAED,OAAO,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,gBAAgB,CAAC,MAAmB,EAAE,MAAwB;QACnE,OAAO,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,IAAY,OAAO;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,WAAW,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,IAAc;QACvC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE;gBACzD,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;YAEH,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACjC,CAAC;YAED,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QAED,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC/B,KAAK,OAAO;gBACV,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBACvB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBAChD,CAAC;gBACD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBACrC,OAAO,IAAI,CAAC,WAAW,CAAC;YAC1B,KAAK,SAAS;gBACZ,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACpC,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAC;YACrC,KAAK,YAAY;gBACf,OAAO,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACvC;gBACE,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,wBAAwB,EAAE;YACvE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC3B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;QAC9C,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,oBAAoB;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CACpC,MAAM,EACN,2BAA2B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EACjD,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CACnC,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;QAC9C,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,sBAAsB;QAClC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,qDAAqD,CAAC;QAEtE,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,qDAAqD,OAAO,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,2BAA2B,EAAE;YAC1E,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YACzB,GAAG;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;QAC9C,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAAc,EACd,OAAe,EACf,IAA8B;QAE9B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,OAAO,EAAE,CAAC;QAC/C,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;SACnC,CAAC;QAEF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC1C,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,KAAM,CAAC;QACpE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1B,OAAO,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACvD,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC;QAC/C,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;QAEhE,IAAI,CAAC;YACH,MAAM,YAAY,GAA0C;gBAC1D,MAAM;gBACN,OAAO;gBACP,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC;YAEF,IAAI,IAAI,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC7B,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3C,CAAC;YAED,gEAAgE;YAChE,8DAA8D;YAC9D,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,8DAA8D;gBAC7D,YAAoB,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YACrD,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAEhD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAsB,CAAC;YAEvD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,EAAE,CAAC,CAAC;YAChD,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,OAAe,EACf,IAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAEO,eAAe,CAAC,GAAW,EAAE,SAA8B,MAAM;QACvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAExC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACnC,OAAO,OAAO,QAAQ,IAAI,GAAG,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE/C,OAAO,OAAO,KAAK,IAAI,MAAM,IAAI,aAAa,IAAI,GAAG,EAAE,CAAC;IAC1D,CAAC;IAEO,aAAa;QACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAExC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACnC,OAAO,OAAO,QAAQ,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE/C,OAAO,OAAO,KAAK,aAAa,aAAa,EAAE,CAAC;IAClD,CAAC;IAEO,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,4BAA4B,CAAC;QACtC,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,oDAAoD,CAAC;QAC9D,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChF,oEAAoE;YACpE,kEAAkE;YAClE,8DAA8D;YAC9D,sBAAsB;YACtB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;gBAC5D,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,eAAe,GAAG,sCAAsC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7G,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;IAC7B,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,IAAI,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;gBACvC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE;wBACJ,WAAW,EAAE,IAAI;wBACjB,MAAM,EAAE,KAAK;wBACb,OAAO,EAAE,eAAe;wBACxB,WAAW,EAAE,WAAW;qBACzB;iBACF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACzE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,yCAAyC,OAAO,EAAE;iBAC1D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,YAAY,GAA0C;gBAC1D,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;aAC3D,CAAC;YACF,sDAAsD;YACtD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,8DAA8D;gBAC7D,YAAoB,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YACrD,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,gBAAgB,EAAE,YAAY,CAAC,CAAC;YAEnF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAK/B,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,WAAW,EAAE,IAAI,CAAC,YAAY;iBAC/B;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,iCAAiC,OAAO,EAAE;aAClD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;gBAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBAE3E,MAAM,MAAM,GAAgB;oBAC1B,GAAG;oBACH,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE;wBACR,OAAO,EAAE,CAAC;wBACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,SAAS,EAAE,KAAK;qBACjB;iBACF,CAAC;gBAEF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACzE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,GAAG,MAAM,OAAO,EAAE,EAAE,CAAC;YAChF,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAEpD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,GAAG,aAAa,EAAE,CAAC;YAChE,CAAC;YAED,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;YAExC,MAAM,MAAM,GAAgB;gBAC1B,GAAG;gBACH,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE;oBACR,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC;oBAC/B,SAAS,EAAE,QAAQ,EAAE,YAAY,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC7D,SAAS,EAAE,QAAQ,EAAE,YAAY,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC7D,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,KAAK;oBACvC,cAAc,EAAE,QAAQ,EAAE,eAAe,IAAI,SAAS;iBACvD;aACF,CAAC;YAEF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,GAAG,MAAM,OAAO,EAAE,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CACb,GAAW,EACX,KAAsC,EACtC,QAAiC;QAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACzD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,OAAO,mCAAmC;aACxE,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,gEAAgE;qBACxE,CAAC;gBACJ,CAAC;gBAED,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;gBAC5D,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;gBAExE,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE;wBACJ,OAAO,EAAE,CAAC;wBACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,SAAS,EAAE,KAAK;wBAChB,cAAc,EAAE,QAAQ;qBACzB;iBACF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACzE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,GAAG,MAAM,OAAO,EAAE,EAAE,CAAC;YAChF,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ;gBACpC,CAAC,CAAC,EAAE,KAAK,EAAE;gBACX,CAAC,CAAC,KAAK,CAAC;YAEV,MAAM,IAAI,GAA4B,EAAE,IAAI,EAAE,CAAC;YAE/C,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC/C,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;YAC5B,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAE3D,MAAM,cAAc,GAAwB;gBAC1C,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC;gBAC9C,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5E,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5E,SAAS,EAAE,KAAK;gBAChB,cAAc,EAAE,QAAQ;aACzB,CAAC;YAEF,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC/C,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;oBAC3D,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE;wBACvC,eAAe,EAAE,QAAQ;qBAC1B,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,2BAA2B;gBAC7B,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,GAAG,MAAM,OAAO,EAAE,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,OAAO,oCAAoC;aACzE,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;gBAC5D,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACzE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,GAAG,MAAM,OAAO,EAAE,EAAE,CAAC;YACnF,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAEtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,GAAG,MAAM,OAAO,EAAE,EAAE,CAAC;QACnF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,OAAO,kCAAkC;aACvE,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,gEAAgE;aACxE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAErD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YACvC,MAAM,OAAO,GAA2B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvD,GAAG;gBACH,OAAO,EAAE,CAAC;gBACV,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;aACd,CAAC,CAAC,CAAC;YAEJ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YAEzE,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YACrC,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,OAAO,EAAE,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;CACF"}