agentvault 1.0.1 → 1.0.5

package/dist/src/wallet/hsm/ledger-provider.js

@@ -0,0 +1,272 @@
+/**
+ * Ledger Hardware Wallet HSM Provider
+ *
+ * Offloads key generation and signing to a Ledger hardware wallet over USB HID.
+ * The device generates keys internally from its BIP39 seed phrase, which is
+ * entered on the physical keypad and NEVER transmitted to the host machine.
+ *
+ * Security properties:
+ *   - Private key is generated inside the Secure Element and never leaves it.
+ *   - BIP39 mnemonic is air-gapped on the device (entered via physical buttons).
+ *   - The host receives ONLY the derived public key and chain address.
+ *   - Transaction signing: the host sends an unsigned digest; the device returns
+ *     only the signature bytes.
+ *   - RAM dumps of the host process contain zero key material.
+ *
+ * Supported chains / apps (Ledger app must be open on device):
+ *   secp256k1: Ethereum app  → ckETH, Polkadot (ECDSA mode)
+ *   ed25519:   Solana app    → Solana, ICP, Arweave
+ *
+ * Dependencies (optional peer deps, dynamically imported):
+ *   @ledgerhq/hw-transport-node-hid  – USB HID transport
+ *   @ledgerhq/hw-app-eth             – Ethereum APDU client
+ *   @ledgerhq/hw-app-solana          – Solana APDU client
+ *
+ * Install with:
+ *   npm install @ledgerhq/hw-transport-node-hid @ledgerhq/hw-app-eth @ledgerhq/hw-app-solana
+ */
+import { createHash } from 'node:crypto';
+import { HsmNotAvailableError, HsmCurveUnsupportedError, HsmOperationError, } from './types.js';
+// ---------------------------------------------------------------------------
+// Address derivation helpers (pure, no private key needed)
+// ---------------------------------------------------------------------------
+// LedgerHsmProvider
+// ---------------------------------------------------------------------------
+/**
+ * HSM provider that delegates all key operations to a connected Ledger device.
+ *
+ * Usage:
+ * ```ts
+ * const ledger = new LedgerHsmProvider();
+ * await ledger.open();                          // connects over USB HID
+ * const { address } = await ledger.getPublicKey("m/44'/60'/0'/0/0", 'secp256k1');
+ * await ledger.close();
+ * ```
+ */
+export class LedgerHsmProvider {
+    name = 'Ledger Hardware Wallet';
+    backend = 'ledger';
+    supportedCurves = ['secp256k1', 'ed25519'];
+    _transport = null;
+    _deviceProduct = null;
+    _deviceSerial = null;
+    // -------------------------------------------------------------------------
+    // Lifecycle
+    // -------------------------------------------------------------------------
+    async open() {
+        if (this._transport)
+            return; // already open
+        // Dynamically import – avoids hard dependency if Ledger is not installed.
+        let TransportNodeHid;
+        try {
+            const mod = await import('@ledgerhq/hw-transport-node-hid');
+            TransportNodeHid = mod.default ?? mod;
+        }
+        catch {
+            throw new HsmNotAvailableError('ledger', 'Package @ledgerhq/hw-transport-node-hid is not installed. ' +
+                'Run: npm install @ledgerhq/hw-transport-node-hid @ledgerhq/hw-app-eth @ledgerhq/hw-app-solana');
+        }
+        // Check that at least one device is reachable before trying to open.
+        let devices;
+        try {
+            devices = await TransportNodeHid.list();
+        }
+        catch (err) {
+            throw new HsmNotAvailableError('ledger', 'Failed to list HID devices: ' + String(err));
+        }
+        if (devices.length === 0) {
+            throw new HsmNotAvailableError('ledger', 'No Ledger device found. Connect the device, unlock it, and open the correct app.');
+        }
+        try {
+            this._transport = await TransportNodeHid.create();
+        }
+        catch (err) {
+            throw new HsmNotAvailableError('ledger', 'Could not open HID transport: ' + String(err));
+        }
+        // Capture device identity for later.
+        this._deviceProduct = this._transport.deviceModel?.productName ?? 'Ledger';
+        // Use a hash of the product name + current open time as a stable-enough ID.
+        this._deviceSerial =
+            this._transport.deviceModel?.id ??
+                createHash('sha256')
+                    .update(this._deviceProduct + '-' + Date.now())
+                    .digest('hex')
+                    .slice(0, 16);
+    }
+    async close() {
+        if (this._transport) {
+            await this._transport.close().catch(() => { });
+            this._transport = null;
+        }
+    }
+    // -------------------------------------------------------------------------
+    // Public key retrieval
+    // -------------------------------------------------------------------------
+    async getPublicKey(derivationPath, curve) {
+        this._assertOpen();
+        if (!this.supportedCurves.includes(curve)) {
+            throw new HsmCurveUnsupportedError('ledger', curve);
+        }
+        try {
+            if (curve === 'secp256k1') {
+                return await this._getEthPublicKey(derivationPath);
+            }
+            else {
+                return await this._getSolanaPublicKey(derivationPath);
+            }
+        }
+        catch (err) {
+            if (err instanceof HsmNotAvailableError || err instanceof HsmCurveUnsupportedError) {
+                throw err;
+            }
+            throw new HsmOperationError('ledger', 'getPublicKey', err);
+        }
+    }
+    /**
+     * Retrieve secp256k1 public key from the Ledger Ethereum app.
+     * The device derives the key at `path` from its internal seed and returns
+     * only the public key + EIP-55 address.  No private key is transmitted.
+     */
+    async _getEthPublicKey(path) {
+        let EthApp;
+        try {
+            const mod = await import('@ledgerhq/hw-app-eth');
+            EthApp = mod.default ?? mod;
+        }
+        catch {
+            throw new HsmNotAvailableError('ledger', 'Package @ledgerhq/hw-app-eth is not installed.');
+        }
+        const eth = new EthApp(this._transport);
+        // display=false → no on-device confirmation required (just address derivation)
+        const result = await eth.getAddress(path, false);
+        return {
+            publicKeyHex: result.publicKey.startsWith('04')
+                ? result.publicKey
+                : '04' + result.publicKey,
+            address: result.address,
+            derivationPath: path,
+            curve: 'secp256k1',
+        };
+    }
+    /**
+     * Retrieve Ed25519 public key from the Ledger Solana app.
+     * Works for Solana, ICP, and Arweave (all use Ed25519).
+     * The host receives only the 32-byte public key; the private key stays sealed.
+     */
+    async _getSolanaPublicKey(path) {
+        let SolanaApp;
+        try {
+            const mod = await import('@ledgerhq/hw-app-solana');
+            SolanaApp = mod.default ?? mod;
+        }
+        catch {
+            throw new HsmNotAvailableError('ledger', 'Package @ledgerhq/hw-app-solana is not installed.');
+        }
+        const sol = new SolanaApp(this._transport);
+        const result = await sol.getAddress(path);
+        const pubkeyHex = Buffer.from(result.address).toString('hex');
+        // For Solana the address is the base58-encoded public key.
+        // We derive it here so callers get a usable address without needing bs58.
+        const { PublicKey } = await import('@solana/web3.js');
+        const address = new PublicKey(result.address).toBase58();
+        return {
+            publicKeyHex: pubkeyHex,
+            address,
+            derivationPath: path,
+            curve: 'ed25519',
+        };
+    }
+    // -------------------------------------------------------------------------
+    // Signing
+    // -------------------------------------------------------------------------
+    async signDigest(derivationPath, digestHex, curve) {
+        this._assertOpen();
+        if (!this.supportedCurves.includes(curve)) {
+            throw new HsmCurveUnsupportedError('ledger', curve);
+        }
+        try {
+            if (curve === 'secp256k1') {
+                return await this._signEth(derivationPath, digestHex);
+            }
+            else {
+                return await this._signSolana(derivationPath, digestHex);
+            }
+        }
+        catch (err) {
+            if (err instanceof HsmNotAvailableError || err instanceof HsmCurveUnsupportedError) {
+                throw err;
+            }
+            throw new HsmOperationError('ledger', 'signDigest', err);
+        }
+    }
+    async _signEth(path, digestHex) {
+        let EthApp;
+        try {
+            const mod = await import('@ledgerhq/hw-app-eth');
+            EthApp = mod.default ?? mod;
+        }
+        catch {
+            throw new HsmNotAvailableError('ledger', 'Package @ledgerhq/hw-app-eth is not installed.');
+        }
+        const eth = new EthApp(this._transport);
+        // The Ledger Ethereum app signs raw transactions; we pass the digest as a
+        // minimal "raw tx" hex.  For EIP-191 personal signs callers should use
+        // signPersonalMessage instead; this method handles arbitrary 32-byte digests.
+        const sig = await eth.signTransaction(path, digestHex);
+        const r = sig.r.replace(/^0x/, '');
+        const s = sig.s.replace(/^0x/, '');
+        const vHex = sig.v.replace(/^0x/, '').padStart(2, '0');
+        const recovery = parseInt(vHex, 16) % 2; // 0 or 1
+        return { signatureHex: r + s + vHex, recovery };
+    }
+    async _signSolana(path, digestHex) {
+        let SolanaApp;
+        try {
+            const mod = await import('@ledgerhq/hw-app-solana');
+            SolanaApp = mod.default ?? mod;
+        }
+        catch {
+            throw new HsmNotAvailableError('ledger', 'Package @ledgerhq/hw-app-solana is not installed.');
+        }
+        const sol = new SolanaApp(this._transport);
+        const txBuffer = Buffer.from(digestHex, 'hex');
+        const result = await sol.signTransaction(path, txBuffer);
+        return { signatureHex: Buffer.from(result.signature).toString('hex') };
+    }
+    // -------------------------------------------------------------------------
+    // Device identity
+    // -------------------------------------------------------------------------
+    async deviceId() {
+        this._assertOpen();
+        return this._deviceSerial ?? 'ledger-unknown';
+    }
+    // -------------------------------------------------------------------------
+    // Internal helpers
+    // -------------------------------------------------------------------------
+    _assertOpen() {
+        if (!this._transport) {
+            throw new HsmNotAvailableError('ledger', 'Provider is not open. Call open() before any key operations.');
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Probe helper – call without opening a full provider
+// ---------------------------------------------------------------------------
+/**
+ * Quick check: is a Ledger device currently connected and unlocked?
+ *
+ * @returns `true` if at least one HID device is enumerable, `false` otherwise.
+ *          Does NOT verify that any particular Ledger app is open.
+ */
+export async function isLedgerAvailable() {
+    try {
+        const mod = await import('@ledgerhq/hw-transport-node-hid');
+        const Transport = mod.default ?? mod;
+        const devices = await Transport.list();
+        return Array.isArray(devices) && devices.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=ledger-provider.js.map

package/dist/src/wallet/hsm/ledger-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-provider.js","sourceRoot":"","sources":["../../../../src/wallet/hsm/ledger-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQzC,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AA2BpB,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IACnB,IAAI,GAAG,wBAAwB,CAAC;IAChC,OAAO,GAAe,QAAQ,CAAC;IAC/B,eAAe,GAA4B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAErE,UAAU,GAA2B,IAAI,CAAC;IAC1C,cAAc,GAAkB,IAAI,CAAC;IACrC,aAAa,GAAkB,IAAI,CAAC;IAE5C,4EAA4E;IAC5E,YAAY;IACZ,4EAA4E;IAE5E,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,eAAe;QAE5C,0EAA0E;QAC1E,IAAI,gBAA4C,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,iCAAwC,CAAC,CAAC;YACnE,gBAAgB,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,oBAAoB,CAC5B,QAAQ,EACR,4DAA4D;gBAC1D,+FAA+F,CAClG,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,IAAI,OAAkB,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,oBAAoB,CAAC,QAAQ,EAAE,8BAA8B,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,oBAAoB,CAC5B,QAAQ,EACR,kFAAkF,CACnF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,oBAAoB,CAAC,QAAQ,EAAE,gCAAgC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3F,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,IAAI,QAAQ,CAAC;QAC3E,4EAA4E;QAC5E,IAAI,CAAC,aAAa;YAChB,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE;gBAC/B,UAAU,CAAC,QAAQ,CAAC;qBACjB,MAAM,CAAC,IAAI,CAAC,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;qBAC9C,MAAM,CAAC,KAAK,CAAC;qBACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC9C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,uBAAuB;IACvB,4EAA4E;IAE5E,KAAK,CAAC,YAAY,CAAC,cAAsB,EAAE,KAAe;QACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,wBAAwB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC;YACH,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC1B,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oBAAoB,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;gBACnF,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,sBAA6B,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,oBAAoB,CAC5B,QAAQ,EACR,gDAAgD,CACjD,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAW,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChD,+EAA+E;QAC/E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEjD,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;gBAC7C,CAAC,CAAC,MAAM,CAAC,SAAS;gBAClB,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,cAAc,EAAE,IAAI;YACpB,KAAK,EAAE,WAAW;SACnB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,mBAAmB,CAAC,IAAY;QAC5C,IAAI,SAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,yBAAgC,CAAC,CAAC;YAC3D,SAAS,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,oBAAoB,CAC5B,QAAQ,EACR,mDAAmD,CACpD,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAc,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE9D,2DAA2D;QAC3D,0EAA0E;QAC1E,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEzD,OAAO;YACL,YAAY,EAAE,SAAS;YACvB,OAAO;YACP,cAAc,EAAE,IAAI;YACpB,KAAK,EAAE,SAAS;SACjB,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,UAAU;IACV,4EAA4E;IAE5E,KAAK,CAAC,UAAU,CACd,cAAsB,EACtB,SAAiB,EACjB,KAAe;QAEf,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,wBAAwB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC;YACH,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC1B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACN,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oBAAoB,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;gBACnF,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,SAAiB;QACpD,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,sBAA6B,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,oBAAoB,CAAC,QAAQ,EAAE,gDAAgD,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,GAAG,GAAW,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChD,0EAA0E;QAC1E,uEAAuE;QACvE,8EAA8E;QAC9E,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAEvD,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAElD,OAAO,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,SAAiB;QACvD,IAAI,SAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,yBAAgC,CAAC,CAAC;YAC3D,SAAS,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,oBAAoB,CAC5B,QAAQ,EACR,mDAAmD,CACpD,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAc,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACzE,CAAC;IAED,4EAA4E;IAC5E,kBAAkB;IAClB,4EAA4E;IAE5E,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,aAAa,IAAI,gBAAgB,CAAC;IAChD,CAAC;IAED,4EAA4E;IAC5E,mBAAmB;IACnB,4EAA4E;IAEpE,WAAW;QACjB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,oBAAoB,CAC5B,QAAQ,EACR,8DAA8D,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,iCAAwC,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/src/wallet/hsm/sgx-provider.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Intel SGX TEE HSM Provider
+ *
+ * Offloads key generation and signing to an Intel SGX trusted enclave.
+ * The enclave generates keys inside its protected memory, seals them with
+ * the processor's platform key, and only ever exposes public keys and
+ * signatures to the untrusted host.
+ *
+ * Security properties:
+ *   - Private key material generated inside the SGX enclave (ring-0 isolation).
+ *   - Keys are *sealed* to the enclave identity (MRENCLAVE / MRSIGNER):
+ *       sealed blobs are opaque byte strings that cannot be read outside
+ *       the matching enclave even with physical DRAM access.
+ *   - Host process receives ONLY public keys and signatures.
+ *   - RAM dumps of the host process contain zero key material.
+ *
+ * Architecture:
+ *   Host (this file) ──UNIX-socket──▶ AESM daemon (aesmd)
+ *                                         │
+ *                                    SGX driver / enclave
+ *
+ * The AESM socket path is configurable; default: /var/run/aesmd/aesm.socket
+ * For development / CI without real SGX hardware, set env SGX_SIMULATION=1
+ * to use the libsgx_urts simulation mode.
+ *
+ * Real deployment:
+ *   1. Install Intel SGX driver + platform software stack.
+ *   2. Build / sign the enclave shared library (agentvault_keygen.signed.so).
+ *   3. Set AGENTVAULT_SGX_ENCLAVE_PATH to point at the .signed.so file.
+ *   4. Start aesmd.
+ *   5. Run `agentvault wallet create --hsm sgx`.
+ *
+ * This file implements the host-side stub that communicates with the enclave
+ * via a JSON-over-UNIX-socket protocol.  The protocol is intentionally simple
+ * so that the enclave-side implementation can be small and auditable.
+ */
+import type { HsmProvider, HsmBackend, HsmCurve, HsmPublicKeyResult, HsmSignatureResult } from './types.js';
+/**
+ * HSM provider that delegates all key operations to an Intel SGX enclave.
+ *
+ * The enclave binary must implement the agentvault_keygen.edl interface and
+ * respond to the JSON-over-UNIX-socket protocol defined above.
+ *
+ * Usage:
+ * ```ts
+ * const sgx = new SgxHsmProvider();
+ * await sgx.open();                              // connects to AESM daemon
+ * const { address } = await sgx.getPublicKey("m/44'/60'/0'/0/0", 'secp256k1');
+ * await sgx.close();
+ * ```
+ */
+export declare class SgxHsmProvider implements HsmProvider {
+    readonly name = "Intel SGX TEE Enclave";
+    readonly backend: HsmBackend;
+    readonly supportedCurves: ReadonlyArray<HsmCurve>;
+    private readonly _socketPath;
+    private readonly _enclavePath;
+    private _socket;
+    constructor(options?: {
+        socketPath?: string;
+        enclavePath?: string;
+    });
+    open(): Promise<void>;
+    close(): Promise<void>;
+    getPublicKey(derivationPath: string, curve: HsmCurve): Promise<HsmPublicKeyResult>;
+    signDigest(derivationPath: string, digestHex: string, curve: HsmCurve): Promise<HsmSignatureResult>;
+    deviceId(): Promise<string>;
+    private _connectSocket;
+    /**
+     * Send a JSON request to the enclave daemon and await a JSON response.
+     * Each message is framed as a 4-byte big-endian length prefix followed by
+     * the UTF-8 JSON payload (same framing as Intel's AESM RPC protocol).
+     */
+    private _send;
+    private _assertOpen;
+}
+/**
+ * Quick check: is the SGX AESM daemon socket accessible?
+ *
+ * @returns `true` if the socket file exists and can be stat'd, `false` otherwise.
+ */
+export declare function isSgxAvailable(socketPath?: string): Promise<boolean>;
+//# sourceMappingURL=sgx-provider.d.ts.map

package/dist/src/wallet/hsm/sgx-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sgx-provider.d.ts","sourceRoot":"","sources":["../../../../src/wallet/hsm/sgx-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAyCpB;;;;;;;;;;;;;GAaG;AACH,qBAAa,cAAe,YAAW,WAAW;IAChD,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAS;IACrC,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,QAAQ,CAAC,CAA4B;IAE7E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,OAAO,CAA2B;gBAE9B,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO;IAYjE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAgClF,UAAU,CACd,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC,kBAAkB,CAAC;IA8BxB,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;YAgBnB,cAAc;IAmC5B;;;;OAIG;YACW,KAAK;IA8DnB,OAAO,CAAC,WAAW;CAQpB;AAcD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,UAAU,GAAE,MAA4B,GACvC,OAAO,CAAC,OAAO,CAAC,CAQlB"}

package/dist/src/wallet/hsm/sgx-provider.js

@@ -0,0 +1,281 @@
+/**
+ * Intel SGX TEE HSM Provider
+ *
+ * Offloads key generation and signing to an Intel SGX trusted enclave.
+ * The enclave generates keys inside its protected memory, seals them with
+ * the processor's platform key, and only ever exposes public keys and
+ * signatures to the untrusted host.
+ *
+ * Security properties:
+ *   - Private key material generated inside the SGX enclave (ring-0 isolation).
+ *   - Keys are *sealed* to the enclave identity (MRENCLAVE / MRSIGNER):
+ *       sealed blobs are opaque byte strings that cannot be read outside
+ *       the matching enclave even with physical DRAM access.
+ *   - Host process receives ONLY public keys and signatures.
+ *   - RAM dumps of the host process contain zero key material.
+ *
+ * Architecture:
+ *   Host (this file) ──UNIX-socket──▶ AESM daemon (aesmd)
+ *                                         │
+ *                                    SGX driver / enclave
+ *
+ * The AESM socket path is configurable; default: /var/run/aesmd/aesm.socket
+ * For development / CI without real SGX hardware, set env SGX_SIMULATION=1
+ * to use the libsgx_urts simulation mode.
+ *
+ * Real deployment:
+ *   1. Install Intel SGX driver + platform software stack.
+ *   2. Build / sign the enclave shared library (agentvault_keygen.signed.so).
+ *   3. Set AGENTVAULT_SGX_ENCLAVE_PATH to point at the .signed.so file.
+ *   4. Start aesmd.
+ *   5. Run `agentvault wallet create --hsm sgx`.
+ *
+ * This file implements the host-side stub that communicates with the enclave
+ * via a JSON-over-UNIX-socket protocol.  The protocol is intentionally simple
+ * so that the enclave-side implementation can be small and auditable.
+ */
+import * as net from 'node:net';
+import * as crypto from 'node:crypto';
+import { HsmNotAvailableError, HsmCurveUnsupportedError, HsmOperationError, } from './types.js';
+// ---------------------------------------------------------------------------
+// Configuration constants
+// ---------------------------------------------------------------------------
+/** Default UNIX socket path used by Intel's AESM daemon. */
+const DEFAULT_AESM_SOCKET = '/var/run/aesmd/aesm.socket';
+/**
+ * Environment variable pointing to the signed enclave shared object.
+ * When unset the provider falls back to simulation mode (SGX_SIMULATION=1).
+ */
+const ENCLAVE_PATH_ENV = 'AGENTVAULT_SGX_ENCLAVE_PATH';
+/** Socket I/O timeout in milliseconds. */
+const SOCKET_TIMEOUT_MS = 10_000;
+// ---------------------------------------------------------------------------
+// SgxHsmProvider
+// ---------------------------------------------------------------------------
+/**
+ * HSM provider that delegates all key operations to an Intel SGX enclave.
+ *
+ * The enclave binary must implement the agentvault_keygen.edl interface and
+ * respond to the JSON-over-UNIX-socket protocol defined above.
+ *
+ * Usage:
+ * ```ts
+ * const sgx = new SgxHsmProvider();
+ * await sgx.open();                              // connects to AESM daemon
+ * const { address } = await sgx.getPublicKey("m/44'/60'/0'/0/0", 'secp256k1');
+ * await sgx.close();
+ * ```
+ */
+export class SgxHsmProvider {
+    name = 'Intel SGX TEE Enclave';
+    backend = 'sgx';
+    supportedCurves = ['secp256k1', 'ed25519'];
+    _socketPath;
+    _enclavePath;
+    _socket = null;
+    constructor(options = {}) {
+        this._socketPath = options.socketPath ?? DEFAULT_AESM_SOCKET;
+        this._enclavePath =
+            options.enclavePath ??
+                process.env[ENCLAVE_PATH_ENV] ??
+                '/usr/lib/agentvault/agentvault_keygen.signed.so';
+    }
+    // -------------------------------------------------------------------------
+    // Lifecycle
+    // -------------------------------------------------------------------------
+    async open() {
+        if (this._socket)
+            return; // already open
+        await this._connectSocket();
+        try {
+            await this._send({ op: 'ping' });
+        }
+        catch (err) {
+            await this.close();
+            throw new HsmNotAvailableError('sgx', `SGX daemon at ${this._socketPath} did not respond to ping: ${String(err)}`);
+        }
+    }
+    async close() {
+        if (this._socket) {
+            this._socket.destroy();
+            this._socket = null;
+        }
+    }
+    // -------------------------------------------------------------------------
+    // Public key retrieval
+    // -------------------------------------------------------------------------
+    async getPublicKey(derivationPath, curve) {
+        this._assertOpen();
+        if (!this.supportedCurves.includes(curve)) {
+            throw new HsmCurveUnsupportedError('sgx', curve);
+        }
+        let result;
+        try {
+            result = await this._send({ op: 'getPublicKey', path: derivationPath, curve });
+        }
+        catch (err) {
+            throw new HsmOperationError('sgx', 'getPublicKey', err);
+        }
+        // Validate response shape
+        const r = result;
+        if (typeof r.publicKeyHex !== 'string' || typeof r.address !== 'string') {
+            throw new HsmOperationError('sgx', 'getPublicKey', 'Malformed response from enclave');
+        }
+        return {
+            publicKeyHex: r.publicKeyHex,
+            address: r.address,
+            derivationPath,
+            curve,
+        };
+    }
+    // -------------------------------------------------------------------------
+    // Signing
+    // -------------------------------------------------------------------------
+    async signDigest(derivationPath, digestHex, curve) {
+        this._assertOpen();
+        if (!this.supportedCurves.includes(curve)) {
+            throw new HsmCurveUnsupportedError('sgx', curve);
+        }
+        if (!/^[0-9a-fA-F]{64}$/.test(digestHex)) {
+            throw new HsmOperationError('sgx', 'signDigest', 'digestHex must be exactly 32 bytes (64 hex chars)');
+        }
+        let result;
+        try {
+            result = await this._send({ op: 'signDigest', path: derivationPath, digestHex, curve });
+        }
+        catch (err) {
+            throw new HsmOperationError('sgx', 'signDigest', err);
+        }
+        const r = result;
+        if (typeof r.signatureHex !== 'string') {
+            throw new HsmOperationError('sgx', 'signDigest', 'Malformed signature from enclave');
+        }
+        return { signatureHex: r.signatureHex, recovery: r.recovery };
+    }
+    // -------------------------------------------------------------------------
+    // Device identity
+    // -------------------------------------------------------------------------
+    async deviceId() {
+        this._assertOpen();
+        try {
+            const result = await this._send({ op: 'deviceId' });
+            return typeof result?.id === 'string' ? result.id : 'sgx-unknown';
+        }
+        catch {
+            // Fall back to a stable hash derived from the enclave path
+            return createHash('sha256').update(this._enclavePath).digest('hex').slice(0, 16);
+        }
+    }
+    // -------------------------------------------------------------------------
+    // UNIX socket transport
+    // -------------------------------------------------------------------------
+    async _connectSocket() {
+        return new Promise((resolve, reject) => {
+            const socket = net.createConnection({ path: this._socketPath });
+            const onConnect = () => {
+                socket.removeListener('error', onError);
+                this._socket = socket;
+                resolve();
+            };
+            const onError = (err) => {
+                socket.destroy();
+                reject(new HsmNotAvailableError('sgx', `Cannot connect to SGX AESM socket at ${this._socketPath}: ${err.message}. ` +
+                    'Is Intel SGX installed and aesmd running? (systemctl status aesmd)'));
+            };
+            socket.once('connect', onConnect);
+            socket.once('error', onError);
+            socket.setTimeout(SOCKET_TIMEOUT_MS, () => {
+                socket.destroy();
+                reject(new HsmNotAvailableError('sgx', `Timeout connecting to SGX AESM socket at ${this._socketPath}`));
+            });
+        });
+    }
+    /**
+     * Send a JSON request to the enclave daemon and await a JSON response.
+     * Each message is framed as a 4-byte big-endian length prefix followed by
+     * the UTF-8 JSON payload (same framing as Intel's AESM RPC protocol).
+     */
+    async _send(request) {
+        const socket = this._socket;
+        if (!socket)
+            throw new Error('Socket not connected');
+        return new Promise((resolve, reject) => {
+            const payload = Buffer.from(JSON.stringify(request), 'utf8');
+            const frame = Buffer.allocUnsafe(4 + payload.length);
+            frame.writeUInt32BE(payload.length, 0);
+            payload.copy(frame, 4);
+            const chunks = [];
+            const onData = (chunk) => {
+                chunks.push(chunk);
+                const accumulated = Buffer.concat(chunks);
+                // Wait for at least 4 bytes (length prefix)
+                if (accumulated.length < 4)
+                    return;
+                const bodyLen = accumulated.readUInt32BE(0);
+                if (accumulated.length < 4 + bodyLen)
+                    return;
+                // Full response received
+                socket.removeListener('data', onData);
+                socket.removeListener('error', onError);
+                const bodyStr = accumulated.slice(4, 4 + bodyLen).toString('utf8');
+                let parsed;
+                try {
+                    parsed = JSON.parse(bodyStr);
+                }
+                catch {
+                    return reject(new Error(`Invalid JSON from enclave: ${bodyStr}`));
+                }
+                if (!parsed.ok) {
+                    return reject(new Error(parsed.error ?? 'Unknown enclave error'));
+                }
+                resolve(parsed.data);
+            };
+            const onError = (err) => {
+                socket.removeListener('data', onData);
+                reject(err);
+            };
+            socket.on('data', onData);
+            socket.once('error', onError);
+            socket.write(frame, (err) => {
+                if (err) {
+                    socket.removeListener('data', onData);
+                    socket.removeListener('error', onError);
+                    reject(err);
+                }
+            });
+        });
+    }
+    // -------------------------------------------------------------------------
+    // Internal helpers
+    // -------------------------------------------------------------------------
+    _assertOpen() {
+        if (!this._socket) {
+            throw new HsmNotAvailableError('sgx', 'Provider is not open. Call open() before any key operations.');
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Helper
+// ---------------------------------------------------------------------------
+function createHash(alg) {
+    return crypto.createHash(alg);
+}
+// ---------------------------------------------------------------------------
+// Probe helper
+// ---------------------------------------------------------------------------
+/**
+ * Quick check: is the SGX AESM daemon socket accessible?
+ *
+ * @returns `true` if the socket file exists and can be stat'd, `false` otherwise.
+ */
+export async function isSgxAvailable(socketPath = DEFAULT_AESM_SOCKET) {
+    try {
+        const { stat } = await import('node:fs/promises');
+        const info = await stat(socketPath);
+        return info.isSocket();
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=sgx-provider.js.map

package/dist/src/wallet/hsm/sgx-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sgx-provider.js","sourceRoot":"","sources":["../../../../src/wallet/hsm/sgx-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAQtC,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAEpB,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,4DAA4D;AAC5D,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEzD;;;GAGG;AACH,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAEvD,0CAA0C;AAC1C,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAgBjC,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,uBAAuB,CAAC;IAC/B,OAAO,GAAe,KAAK,CAAC;IAC5B,eAAe,GAA4B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAE5D,WAAW,CAAS;IACpB,YAAY,CAAS;IAC9B,OAAO,GAAsB,IAAI,CAAC;IAE1C,YAAY,UAAyD,EAAE;QACrE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC7D,IAAI,CAAC,YAAY;YACf,OAAO,CAAC,WAAW;gBACnB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBAC7B,iDAAiD,CAAC;IACtD,CAAC;IAED,4EAA4E;IAC5E,YAAY;IACZ,4EAA4E;IAE5E,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,eAAe;QAEzC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,oBAAoB,CAC5B,KAAK,EACL,iBAAiB,IAAI,CAAC,WAAW,6BAA6B,MAAM,CAAC,GAAG,CAAC,EAAE,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,uBAAuB;IACvB,4EAA4E;IAE5E,KAAK,CAAC,YAAY,CAAC,cAAsB,EAAE,KAAe;QACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;QAED,0BAA0B;QAC1B,MAAM,CAAC,GAAG,MAAmD,CAAC;QAC9D,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACxE,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,iCAAiC,CAAC,CAAC;QACxF,CAAC;QAED,OAAO;YACL,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,cAAc;YACd,KAAK;SACN,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,UAAU;IACV,4EAA4E;IAE5E,KAAK,CAAC,UAAU,CACd,cAAsB,EACtB,SAAiB,EACjB,KAAe;QAEf,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,mDAAmD,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,CAAC,GAAG,MAAqD,CAAC;QAChE,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,kCAAkC,CAAC,CAAC;QACvF,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChE,CAAC;IAED,4EAA4E;IAC5E,kBAAkB;IAClB,4EAA4E;IAE5E,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAmB,CAAC;YACtE,OAAO,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,wBAAwB;IACxB,4EAA4E;IAEpE,KAAK,CAAC,cAAc;QAC1B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAEhE,MAAM,SAAS,GAAG,GAAG,EAAE;gBACrB,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;gBACtB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE;gBAC7B,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CACJ,IAAI,oBAAoB,CACtB,KAAK,EACL,wCAAwC,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,OAAO,IAAI;oBAC1E,oEAAoE,CACvE,CACF,CAAC;YACJ,CAAC,CAAC;YAEF,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,MAAM,CAAC,UAAU,CAAC,iBAAiB,EAAE,GAAG,EAAE;gBACxC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CACJ,IAAI,oBAAoB,CACtB,KAAK,EACL,4CAA4C,IAAI,CAAC,WAAW,EAAE,CAC/D,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,KAAK,CAAC,OAAmB;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAErD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YACrD,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAEvB,MAAM,MAAM,GAAa,EAAE,CAAC;YAE5B,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;gBAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAE1C,4CAA4C;gBAC5C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO;gBAEnC,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC5C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO;oBAAE,OAAO;gBAE7C,yBAAyB;gBACzB,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAExC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnE,IAAI,MAAmB,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC;gBAC9C,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC,CAAC;gBACpE,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAC,CAAC;gBACpE,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE;gBAC7B,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtC,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC;YAEF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAE9B,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC1B,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;oBACtC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACxC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,mBAAmB;IACnB,4EAA4E;IAEpE,WAAW;QACjB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,oBAAoB,CAC5B,KAAK,EACL,8DAA8D,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,aAAqB,mBAAmB;IAExC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}