agentvault 1.0.2 → 1.0.5

package/dist/src/security/vetkeys.js

@@ -18,6 +18,7 @@
  * This implementation class avoids the naming conflict.
  */
 import * as crypto from 'node:crypto';
+import { debugLog } from '../debugging/debug-logger.js';
 function toCanisterAlgorithm(algorithm) {
     return algorithm === 'aes-256-gcm' ? 'aes_256_gcm' : 'chacha20_poly1305';
 }
@@ -112,11 +113,13 @@ export class VetKeysImplementation {
             };
             // Derive master key from seed phrase (for local use)
             const derivedKey = await this.deriveMasterKey(seedPhrase, algorithm);
+            // SECURITY: Do not include seedPhrase in returned object to prevent memory exposure
+            // The seed phrase should only be used transiently for key derivation
             return {
                 type: 'threshold',
                 key: derivedKey.key,
                 method: derivedKey.method,
-                seedPhrase,
+                // seedPhrase intentionally omitted for security - see SEC-3 in SECURITY_AUDIT
                 threshold: threshold,
                 totalParties: totalParties,
                 algorithm: algorithm,
@@ -190,13 +193,18 @@ export class VetKeysImplementation {
         const crypto = await import('node:crypto');
         const secretBuffer = Buffer.from(secret, 'utf-8');
         const iv = algorithm === 'aes-256-gcm' ? crypto.randomBytes(12) : crypto.randomBytes(16);
-        const algorithmName = algorithm.replace('-', '');
-        const encryptionKey = crypto.pbkdf2Sync(secretBuffer, iv, 100000, 32, 'sha256');
-        const cipher = crypto.createCipheriv(algorithmName, encryptionKey, iv);
-        const encryptedShare = Buffer.concat([
+        // SEC-10: use an independent random salt for PBKDF2 rather than
+        // reusing the IV. The salt is prepended to the encrypted output so
+        // that any future decrypt path can recover it.
+        const salt = crypto.randomBytes(16);
+        const encryptionKey = crypto.pbkdf2Sync(secretBuffer, salt, 100000, 32, 'sha256');
+        const cipher = crypto.createCipheriv(algorithm, encryptionKey, iv);
+        const ciphertext = Buffer.concat([
             cipher.update(secretBuffer),
             cipher.final(),
         ]);
+        // On-disk layout v2: salt(16) || iv(12 or 16) || ciphertext
+        const encryptedShare = Buffer.concat([salt, iv, ciphertext]);
         const commitmentHash = crypto.createHash('sha256')
             .update(encryptedShare)
             .digest();
@@ -306,11 +314,11 @@ export class VetKeysImplementation {
      */
     async storeEncryptedSecretOnCanister(secretId, encryptedSecret) {
         if (!this.useCanister) {
-            console.warn('Canister integration disabled, skipping canister storage');
+            debugLog('Canister integration disabled, skipping canister storage');
             return false;
         }
         if (!this.canisterId) {
-            console.warn('Canister ID not configured, skipping canister storage');
+            debugLog('Canister ID not configured, skipping canister storage');
             return false;
         }
         try {
@@ -325,14 +333,14 @@ export class VetKeysImplementation {
                 createdAt: Date.now(),
             });
             if ('ok' in result) {
-                console.log('Encrypted secret stored on canister:', secretId);
+                debugLog('Encrypted secret stored on canister:', secretId);
                 return true;
             }
             return false;
         }
         catch (error) {
             const message = error instanceof Error ? error.message : 'Unknown error';
-            console.warn(`Failed to store encrypted secret on canister: ${message}`);
+            debugLog(`Failed to store encrypted secret on canister: ${message}`);
             return false;
         }
     }
@@ -363,7 +371,7 @@ export class VetKeysImplementation {
         }
         catch (error) {
             const message = error instanceof Error ? error.message : 'Unknown error';
-            console.warn(`Failed to retrieve encrypted secret from canister: ${message}`);
+            debugLog(`Failed to retrieve encrypted secret from canister: ${message}`);
             return null;
         }
     }
@@ -384,7 +392,7 @@ export class VetKeysImplementation {
         }
         catch (error) {
             const message = error instanceof Error ? error.message : 'Unknown error';
-            console.warn(`Failed to list encrypted secrets from canister: ${message}`);
+            debugLog(`Failed to list encrypted secrets from canister: ${message}`);
             return [];
         }
     }
@@ -409,7 +417,7 @@ export class VetKeysImplementation {
         }
         catch (error) {
             const message = error instanceof Error ? error.message : 'Unknown error';
-            console.warn(`Failed to delete encrypted secret from canister: ${message}`);
+            debugLog(`Failed to delete encrypted secret from canister: ${message}`);
             return false;
         }
     }
@@ -425,7 +433,7 @@ export class VetKeysImplementation {
      */
     async verifyThresholdSignatureCanister(signature, message) {
         if (!this.canisterId) {
-            console.warn('VetKeys canister not configured: cannot verify threshold signature');
+            debugLog('VetKeys canister not configured: cannot verify threshold signature');
             return false;
         }
         try {
@@ -439,7 +447,7 @@ export class VetKeysImplementation {
         }
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : 'Unknown error';
-            console.warn(`Failed to verify threshold signature on canister: ${errorMessage}`);
+            debugLog(`Failed to verify threshold signature on canister: ${errorMessage}`);
             return false;
         }
     }
@@ -477,7 +485,7 @@ export class VetKeysImplementation {
         }
         catch (error) {
             const message = error instanceof Error ? error.message : 'Unknown error';
-            console.warn(`Failed to get VetKeys status from canister: ${message}`);
+            debugLog(`Failed to get VetKeys status from canister: ${message}`);
             return {
                 enabled: false,
                 thresholdSupported: true,
@@ -496,4 +504,125 @@ export class VetKeysImplementation {
 export async function decryptJSON(encrypted, seedPhrase) {
     return VetKeysImplementation.decryptJSON(encrypted, seedPhrase);
 }
+// ---------------------------------------------------------------------------
+// Bundle encryption / decryption using principal-based VetKeys
+// ---------------------------------------------------------------------------
+/** AES-256-GCM constants */
+const BUNDLE_AES_KEY_BYTES = 32;
+const BUNDLE_GCM_IV_BYTES = 12;
+const BUNDLE_SALT_BYTES = 32;
+const BUNDLE_PBKDF2_ITERATIONS = 210_000;
+/** 4-byte magic header so we can identify VetKeys-encrypted bundles */
+const VETKEYS_MAGIC = Buffer.from('VKEB'); // VetKeys Encrypted Bundle
+/**
+ * Derive a 32-byte AES-256-GCM key from the caller's ICP principal.
+ *
+ * The principal acts as the identity-binding input; a random per-bundle salt
+ * prevents key reuse across bundles encrypted for the same principal.
+ */
+function deriveBundleKey(principalId, salt) {
+    return crypto.pbkdf2Sync(principalId, Buffer.concat([salt, Buffer.from('agentvault-vetkeys-bundle-v1')]), BUNDLE_PBKDF2_ITERATIONS, BUNDLE_AES_KEY_BYTES, 'sha256');
+}
+/**
+ * Encrypt an agent bundle buffer using VetKeys principal-based key derivation.
+ *
+ * The returned buffer is self-describing: it contains a magic header, the salt,
+ * IV, auth tag, the encrypting principal, and the AES-256-GCM ciphertext. This
+ * allows `decryptBundle` to reconstruct the key and decrypt without any
+ * out-of-band metadata.
+ *
+ * @param buffer      - Plaintext bundle (e.g. serialized agent state)
+ * @param principalId - ICP principal that "owns" the encryption key
+ * @returns Encrypted bundle buffer (magic ‖ salt ‖ iv ‖ tag ‖ principalLen ‖ principal ‖ ciphertext)
+ */
+export async function encryptBundleWithVetKeys(buffer, principalId) {
+    if (!principalId || principalId.length === 0) {
+        throw new Error('principalId is required for VetKeys bundle encryption');
+    }
+    const salt = crypto.randomBytes(BUNDLE_SALT_BYTES);
+    const iv = crypto.randomBytes(BUNDLE_GCM_IV_BYTES);
+    const key = deriveBundleKey(principalId, salt);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    const ciphertext = Buffer.concat([cipher.update(buffer), cipher.final()]);
+    const authTag = cipher.getAuthTag(); // 16 bytes
+    // Encode principal length as a 4-byte big-endian uint
+    const principalBuf = Buffer.from(principalId, 'utf-8');
+    const principalLenBuf = Buffer.alloc(4);
+    principalLenBuf.writeUInt32BE(principalBuf.length, 0);
+    return Buffer.concat([
+        VETKEYS_MAGIC, // 4
+        salt, // 32
+        iv, // 12
+        authTag, // 16
+        principalLenBuf, // 4
+        principalBuf, // variable
+        ciphertext, // variable
+    ]);
+}
+/**
+ * Detect whether a buffer starts with the VetKeys encrypted-bundle magic.
+ */
+export function isVetKeysEncryptedBundle(buffer) {
+    if (buffer.length < VETKEYS_MAGIC.length) {
+        return false;
+    }
+    return buffer.subarray(0, VETKEYS_MAGIC.length).equals(VETKEYS_MAGIC);
+}
+/**
+ * Parse the header from an encrypted bundle buffer.
+ *
+ * @returns The parsed header and the offset where ciphertext begins.
+ */
+function parseEncryptedBundleHeader(encrypted) {
+    const minHeaderSize = 4 + 32 + 12 + 16 + 4; // magic + salt + iv + tag + principalLen
+    if (encrypted.length < minHeaderSize) {
+        throw new Error('Encrypted bundle is too short to contain a valid header');
+    }
+    let offset = VETKEYS_MAGIC.length; // skip magic (already verified by caller)
+    const salt = encrypted.subarray(offset, offset + BUNDLE_SALT_BYTES);
+    offset += BUNDLE_SALT_BYTES;
+    const iv = encrypted.subarray(offset, offset + BUNDLE_GCM_IV_BYTES);
+    offset += BUNDLE_GCM_IV_BYTES;
+    const authTag = encrypted.subarray(offset, offset + 16);
+    offset += 16;
+    const principalLen = encrypted.readUInt32BE(offset);
+    offset += 4;
+    if (encrypted.length < offset + principalLen) {
+        throw new Error('Encrypted bundle is truncated: principal field extends past end');
+    }
+    const principalId = encrypted.subarray(offset, offset + principalLen).toString('utf-8');
+    offset += principalLen;
+    return {
+        header: { salt: Buffer.from(salt), iv: Buffer.from(iv), authTag: Buffer.from(authTag), principalId },
+        ciphertextOffset: offset,
+    };
+}
+/**
+ * Decrypt a VetKeys-encrypted bundle buffer.
+ *
+ * The principal used for decryption is embedded in the bundle header.  The
+ * caller may optionally supply their own `principalId` to verify that the
+ * bundle was encrypted for them; if omitted the embedded principal is used.
+ *
+ * @param encrypted   - Buffer produced by `encryptBundleWithVetKeys`
+ * @param principalId - (optional) expected principal; if provided and it does
+ *                       not match the embedded principal an error is thrown
+ * @returns Decrypted plaintext buffer
+ */
+export async function decryptBundle(encrypted, principalId) {
+    if (!isVetKeysEncryptedBundle(encrypted)) {
+        throw new Error('Buffer is not a VetKeys encrypted bundle (missing magic header)');
+    }
+    const { header, ciphertextOffset } = parseEncryptedBundleHeader(encrypted);
+    // Optionally enforce principal match
+    if (principalId && principalId !== header.principalId) {
+        throw new Error(`Principal mismatch: bundle was encrypted for "${header.principalId}" but decryption was requested with "${principalId}"`);
+    }
+    const ciphertext = encrypted.subarray(ciphertextOffset);
+    const key = deriveBundleKey(header.principalId, header.salt);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, header.iv);
+    decipher.setAuthTag(header.authTag);
+    const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    return plaintext;
+}
 //# sourceMappingURL=vetkeys.js.map

package/dist/src/security/vetkeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vetkeys.js","sourceRoot":"","sources":["../../../src/security/vetkeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAUxD,SAAS,mBAAmB,CAAC,SAA8B;IACzD,OAAO,SAAS,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC;AAC3E,CAAC;AAED,SAAS,qBAAqB,CAAC,WAA8B;IAC3D,OAAO,WAAW,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC;AAC7E,CAAC;AAED,MAAM,OAAO,qBAAqB;IACxB,MAAM,CAAiB;IACvB,UAAU,CAAU;IACpB,WAAW,CAAU;IAE7B,YAAY,UAA2E,EAAE;QACvF,IAAI,CAAC,MAAM,GAAG;YACZ,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;YACjC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;YACvC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,aAAa;YACjE,iBAAiB,EAAE,OAAO,CAAC,UAAU;SACtC,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IACjE,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,KAAK,CAAC,WAAW,CAC7B,SAAwB,EACxB,UAAkB;QAElB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QAEpC,8BAA8B;QAC9B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAC3B,IAAI,EACJ,SAAS,CAAC,IAAI,EACd,MAAM,EACN,EAAE,EACF,QAAQ,CACT,CAAC;QAEF,2BAA2B;QAC3B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAE5D,6BAA6B;QAC7B,IAAI,SAAiB,CAAC;QACtB,IAAI,SAAS,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;YAC1C,SAAS,GAAG,aAAa,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAE7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YAC3B,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAM,CAAC;IACtD,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,kBAAkB,CAC7B,UAAkB,EAClB,UAII,EAAE;QAEN,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAC7D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QACtE,MAAM,SAAS,GAAG,OAAO,CAAC,mBAAmB,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAEjF,qBAAqB;QACrB,IAAI,SAAU,GAAG,CAAC,IAAI,SAAU,GAAG,YAAa,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,sDAAsD,YAAa,WAAW,SAAS,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,0CAA0C;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,SAAU,EAAE,YAAa,EAAE,SAAU,CAAC,CAAC;YAElG,0BAA0B;YAC1B,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;gBAClD,KAAK,EAAE,KAAK,GAAG,CAAC;gBAChB,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE;gBAC/B,aAAa,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE;gBACrC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC,CAAC;YAEJ,sBAAsB;YACtB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAEzD,mCAAmC;YACnC,MAAM,YAAY,GAAG;gBACnB,SAAS;gBACT,MAAM;gBACN,UAAU;gBACV,SAAS;gBACT,mBAAmB,EAAE,SAAS;gBAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YAEF,qDAAqD;YACrD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,SAAU,CAAC,CAAC;YAEtE,oFAAoF;YACpF,qEAAqE;YACrE,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,GAAG,EAAE,UAAU,CAAC,GAAG;gBACnB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,8EAA8E;gBAC9E,SAAS,EAAE,SAAU;gBACrB,YAAY,EAAE,YAAa;gBAC3B,SAAS,EAAE,SAAU;gBACrB,MAAM;gBACN,aAAa;gBACb,UAAU;gBACV,YAAY;aACC,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,oBAAoB,CAChC,UAAkB,EAClB,SAAiB,EACjB,YAAoB,EACpB,SAA8B;QAE9B,MAAM,MAAM,GAAkG,EAAE,CAAC;QACjH,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAE/D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACvC,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,CAAC;YAE5B,8CAA8C;YAC9C,MAAM,iBAAiB,GAAG,IAAI,CAAC,yBAAyB,CAAC,UAAU,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;YAEtF,0CAA0C;YAC1C,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAC7E,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,CACV,CAAC;YAEF,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO;gBACP,aAAa,EAAE,aAAa,CAAC,QAAQ,EAAE;gBACvC,cAAc;gBACd,UAAU,EAAE,eAAe;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,eAAe;QACrB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9D,OAAO,SAAS,SAAS,IAAI,SAAS,EAAE,CAAC;IAC3C,CAAC;IAEA;;;;;MAKE;IACK,yBAAyB,CAAC,UAAkB,EAAE,gBAAwB,EAAE,aAAqB;QACnG,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAEpD,wEAAwE;QACxE,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;QAExF,OAAO,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,YAAY,CACxB,MAAc,EACd,WAAmB,EACnB,SAA8B;QAE9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAE3C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,EAAE,GAAG,SAAS,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACzF,gEAAgE;QAChE,mEAAmE;QACnE,+CAA+C;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAEpC,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CACrC,YAAY,EACZ,IAAI,EACJ,MAAM,EACN,EAAE,EACF,QAAQ,CACT,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAEnE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;YAC3B,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QAEH,4DAA4D;QAC5D,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QAE7D,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;aAC/C,MAAM,CAAC,cAAc,CAAC;aACtB,MAAM,EAAE,CAAC;QAEZ,OAAO;YACL,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC9C,UAAU,EAAE,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;SAC3C,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAAyC;QACxE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEzC,+BAA+B;QAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,UAA+B;QAC/E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QAEpC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAEpD,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;aACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;aACzB,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,EAAE,CAAC;QAEZ,2CAA2C;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAC3B,IAAI,EACJ,IAAI,EACJ,MAAM,EACN,EAAE,EACF,QAAQ,CACT,CAAC;QAEF,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YACxB,MAAM,EAAE,QAAQ;SACjB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,gBAAgB,CAAC,SAAwB;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,CAAC,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YAChG,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,gBAAgB,GAAG,SAAS,CAAC,SAAS,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACtE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACjE,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAC/B,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACI,mBAAmB;QAOxB,OAAO;YACL,kBAAkB,EAAE,IAAI;YACxB,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,YAAa;YAC5C,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,SAAU;YACxC,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAoB;YACrD,aAAa,EAAE,WAAW;SAC3B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,8BAA8B,CACzC,QAAgB,EAChB,eAKC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,QAAQ,CAAC,0DAA0D,CAAC,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,QAAQ,CAAC,uDAAuD,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAE3C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC;gBAC9C,EAAE,EAAE,QAAQ;gBACZ,UAAU,EAAE,IAAI,UAAU,CAAC,eAAe,CAAC,UAAU,CAAC;gBACtD,EAAE,EAAE,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACtC,GAAG,EAAE,IAAI,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC;gBACxC,SAAS,EAAE,mBAAmB,CAAC,eAAe,CAAC,SAAS,CAAC;gBACzD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC,CAAC;YAEH,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;gBACnB,QAAQ,CAAC,sCAAsC,EAAE,QAAQ,CAAC,CAAC;gBAC3D,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,QAAQ,CAAC,iDAAiD,OAAO,EAAE,CAAC,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,8BAA8B,CACzC,QAAgB;QAEhB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAE3C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAExD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;YAExB,OAAO;gBACL,UAAU,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC7C,EAAE,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,GAAG,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC/B,SAAS,EAAE,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC;aACnD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,QAAQ,CAAC,sDAAsD,OAAO,EAAE,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,8BAA8B;QACzC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAE3C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,oBAAoB,EAAE,CAAC;YAEnD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,QAAQ,CAAC,mDAAmD,OAAO,EAAE,CAAC,CAAC;YACvE,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,iCAAiC,CAAC,QAAgB;QAC7D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAE3C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAE3D,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,QAAQ,CAAC,oDAAoD,OAAO,EAAE,CAAC,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,gCAAgC,CAC3C,SAAiB,EACjB,OAAe;QAEf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,QAAQ,CAAC,oEAAoE,CAAC,CAAC;YAC/E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAE3C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAExE,IAAI,IAAI,IAAI,MAAM,IAAI,MAAM,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;gBAC/C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YAC9E,QAAQ,CAAC,qDAAqD,YAAY,EAAE,CAAC,CAAC;YAC9E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,4BAA4B;QAKvC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,kBAAkB,EAAE,IAAI;gBACxB,IAAI,EAAE,MAAM;aACb,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAE3C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAE9C,IAAI,IAAI,GAA0B,MAAM,CAAC;YACzC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC;YAC5F,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC;YAExG,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,GAAG,MAAM,CAAC;YAChB,CAAC;iBAAM,IAAI,iBAAiB,EAAE,CAAC;gBAC7B,IAAI,GAAG,YAAY,CAAC;YACtB,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,IAAI,EAAE,IAAI;aACX,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,QAAQ,CAAC,+CAA+C,OAAO,EAAE,CAAC,CAAC;YACnE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,kBAAkB,EAAE,IAAI;gBACxB,IAAI,EAAE,MAAM;aACb,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAwB,EACxB,UAAkB;IAElB,OAAO,qBAAqB,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAClE,CAAC;AAED,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E,4BAA4B;AAC5B,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEzC,uEAAuE;AACvE,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,2BAA2B;AAgBtE;;;;;GAKG;AACH,SAAS,eAAe,CAAC,WAAmB,EAAE,IAAY;IACxD,OAAO,MAAM,CAAC,UAAU,CACtB,WAAW,EACX,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAClE,wBAAwB,EACxB,oBAAoB,EACpB,QAAQ,CACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,WAAmB;IAEnB,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAE/C,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,WAAW;IAEhD,sDAAsD;IACtD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxC,eAAe,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAEtD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAS,IAAI;QAC1B,IAAI,EAAkB,KAAK;QAC3B,EAAE,EAAoB,KAAK;QAC3B,OAAO,EAAe,KAAK;QAC3B,eAAe,EAAO,IAAI;QAC1B,YAAY,EAAU,WAAW;QACjC,UAAU,EAAY,WAAW;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,IAAI,MAAM,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,SAAS,0BAA0B,CACjC,SAAiB;IAEjB,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,yCAAyC;IACrF,IAAI,SAAS,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,0CAA0C;IAE7E,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAAC,CAAC;IACpE,MAAM,IAAI,iBAAiB,CAAC;IAE5B,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAAC,CAAC;IACpE,MAAM,IAAI,mBAAmB,CAAC;IAE9B,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,IAAI,EAAE,CAAC;IAEb,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,IAAI,CAAC,CAAC;IAEZ,IAAI,SAAS,CAAC,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxF,MAAM,IAAI,YAAY,CAAC;IAEvB,OAAO;QACL,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE;QACpG,gBAAgB,EAAE,MAAM;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAiB,EACjB,WAAoB;IAEpB,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAE3E,qCAAqC;IACrC,IAAI,WAAW,IAAI,WAAW,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,iDAAiD,MAAM,CAAC,WAAW,wCAAwC,WAAW,GAAG,CAC1H,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAE7D,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACxE,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEpC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/src/security/webauthn.d.ts

@@ -0,0 +1,127 @@
+/**
+ * WebAuthn / Biometric Fallback — AgentVault MFA Layer 2
+ *
+ * Provides a biometric-backed device key for approvals when TOTP is unavailable.
+ *
+ * Architecture
+ * ─────────────
+ *  • A P-256 (prime256v1) ECDSA keypair is generated once per device and stored in
+ *    ~/.agentvault/mfa/device-key-<fingerprint>.json.
+ *  • The private key is AES-256-GCM encrypted using a key derived from the device
+ *    fingerprint + a locally generated salt (HKDF-SHA256).  This simulates the
+ *    Secure Enclave model: the key never leaves the local machine and is bound to
+ *    the device's hardware identity (hostname + platform + arch).
+ *  • signChallenge() signs a challenge hash with the private key and returns a DER
+ *    signature — equivalent to what a Secure Enclave produces.
+ *  • verifySignature() validates the signature using the public key, suitable for
+ *    both the local CLI and a remote verifier (ICP canister, webapp).
+ *  • generateWebAuthnAssertion() wraps sign+metadata into a WebAuthn-compatible
+ *    AuthenticatorAssertionResponse structure for browser/webapp interop.
+ *
+ * Browser / Node.js portability
+ * ──────────────────────────────
+ *  In a browser the same flow runs via crypto.subtle (WebCrypto API):
+ *    navigator.credentials.get({ publicKey: { challenge, ... } })
+ *  The server (ICP canister) holds the public key and verifies the assertion.
+ *  This module mirrors that contract using Node's built-in crypto so the CLI
+ *  can participate in the same protocol without browser dependencies.
+ *
+ * Replay protection
+ * ──────────────────
+ *  Every assertion includes a counter that increments on each signing operation.
+ *  The verifier checks that counter > lastSeenCounter, matching the WebAuthn spec.
+ */
+/** Stored device credential (no unencrypted private key on disk). */
+export interface DeviceCredential {
+    /** Credential identifier (hex of public key hash). */
+    credentialId: string;
+    /** Device fingerprint this credential is bound to. */
+    deviceFingerprint: string;
+    /** SPKI-encoded public key, base64url. */
+    publicKeyB64: string;
+    /** Signing counter — monotonically increments on every signing operation. */
+    signCounter: number;
+    /** AES-256-GCM encrypted PKCS#8 private key, base64url. */
+    encryptedPrivateKeyB64: string;
+    /** Random salt used for key derivation, hex. */
+    kdfSaltHex: string;
+    /** AES-GCM IV, hex. */
+    ivHex: string;
+    /** AES-GCM auth tag, hex. */
+    authTagHex: string;
+    createdAt: string;
+}
+/** Result of a biometric signing operation. */
+export interface WebAuthnAssertion {
+    /** The credential that produced this assertion. */
+    credentialId: string;
+    /** The data that was signed: SHA-256(clientDataJSON). */
+    clientDataHash: string;
+    /** DER-encoded ECDSA signature, base64url. */
+    signatureB64: string;
+    /** Current signing counter (replay protection). */
+    signCounter: number;
+    /** ISO timestamp of the signing operation. */
+    timestamp: string;
+}
+/** Result of a biometric setup call. */
+export interface BiometricSetup {
+    credentialId: string;
+    deviceFingerprint: string;
+    /** SPKI public key — send this to the ICP canister for storage. */
+    publicKeyB64: string;
+    createdAt: string;
+}
+/**
+ * Generate a new P-256 device keypair and store it (private key AES-GCM encrypted).
+ *
+ * This is the one-time "biometric enrollment" step.  In a browser this would
+ * involve navigator.credentials.create() with the Secure Enclave; here we use
+ * Node's crypto to produce an equivalent credential.
+ *
+ * @param deviceFingerprint - SHA-256(hostname ‖ platform ‖ arch)[:16] identifying this device
+ * @returns BiometricSetup containing the public key to register with the verifier
+ */
+export declare function setupBiometricCredential(deviceFingerprint: string): BiometricSetup;
+/**
+ * Sign a challenge hash with the device's private key (biometric assertion).
+ *
+ * Mirrors the WebAuthn AuthenticatorAssertionResponse:
+ *   - clientDataHash = SHA-256(JSON.stringify({ type, challenge, timestamp }))
+ *   - signature = ECDSA-SHA256(clientDataHash, privateKey) in DER format
+ *   - signCounter increments (replay protection)
+ *
+ * @param challengeHash  - SHA-256 hex from MFA challenge (binds this to the request)
+ * @param deviceFingerprint - Must match the enrolled device
+ * @returns WebAuthnAssertion — forward to the ICP canister for verification
+ */
+export declare function signChallenge(challengeHash: string, deviceFingerprint: string): WebAuthnAssertion;
+/**
+ * Verify a WebAuthn assertion from any device.
+ *
+ * @param assertion       - The assertion produced by signChallenge()
+ * @param challengeHash   - The original challenge hash (must be embedded in clientDataHash)
+ * @param publicKeyB64    - SPKI public key registered for this credential (base64url)
+ * @param lastSignCounter - The last seen signCounter for this credential (replay check)
+ * @returns { ok: true } or { ok: false, reason: string }
+ */
+export declare function verifyWebAuthnAssertion(assertion: WebAuthnAssertion, challengeHash: string, publicKeyB64: string, lastSignCounter: number): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Return the registered public key for a device, or null if not enrolled.
+ */
+export declare function getDevicePublicKey(deviceFingerprint: string): string | null;
+/**
+ * Return the current sign counter for a device credential.
+ * Used by the verifier to detect counter replay.
+ */
+export declare function getSignCounter(deviceFingerprint: string): number;
+/**
+ * Check whether a biometric credential exists for the given device.
+ */
+export declare function hasBiometricCredential(deviceFingerprint: string): boolean;
+//# sourceMappingURL=webauthn.d.ts.map

package/dist/src/security/webauthn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../../src/security/webauthn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAsBH,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,sDAAsD;IACtD,YAAY,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,YAAY,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,cAAc,EAAE,MAAM,CAAC;IACvB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wCAAwC;AACxC,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAqDD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,iBAAiB,EAAE,MAAM,GAAG,cAAc,CAuClF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,EACrB,iBAAiB,EAAE,MAAM,GACxB,iBAAiB,CA+CnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,iBAAiB,EAC5B,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,GACtB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAoD9C;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG3E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAEzE"}