agentvault 1.0.2 → 1.0.5

package/dist/src/security/webauthn.js

@@ -0,0 +1,246 @@
+/**
+ * WebAuthn / Biometric Fallback — AgentVault MFA Layer 2
+ *
+ * Provides a biometric-backed device key for approvals when TOTP is unavailable.
+ *
+ * Architecture
+ * ─────────────
+ *  • A P-256 (prime256v1) ECDSA keypair is generated once per device and stored in
+ *    ~/.agentvault/mfa/device-key-<fingerprint>.json.
+ *  • The private key is AES-256-GCM encrypted using a key derived from the device
+ *    fingerprint + a locally generated salt (HKDF-SHA256).  This simulates the
+ *    Secure Enclave model: the key never leaves the local machine and is bound to
+ *    the device's hardware identity (hostname + platform + arch).
+ *  • signChallenge() signs a challenge hash with the private key and returns a DER
+ *    signature — equivalent to what a Secure Enclave produces.
+ *  • verifySignature() validates the signature using the public key, suitable for
+ *    both the local CLI and a remote verifier (ICP canister, webapp).
+ *  • generateWebAuthnAssertion() wraps sign+metadata into a WebAuthn-compatible
+ *    AuthenticatorAssertionResponse structure for browser/webapp interop.
+ *
+ * Browser / Node.js portability
+ * ──────────────────────────────
+ *  In a browser the same flow runs via crypto.subtle (WebCrypto API):
+ *    navigator.credentials.get({ publicKey: { challenge, ... } })
+ *  The server (ICP canister) holds the public key and verifies the assertion.
+ *  This module mirrors that contract using Node's built-in crypto so the CLI
+ *  can participate in the same protocol without browser dependencies.
+ *
+ * Replay protection
+ * ──────────────────
+ *  Every assertion includes a counter that increments on each signing operation.
+ *  The verifier checks that counter > lastSeenCounter, matching the WebAuthn spec.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import crypto from 'node:crypto';
+import { parse, stringify } from 'yaml';
+// ─── Directory helpers ────────────────────────────────────────────────────────
+const MFA_DIR = path.join(os.homedir(), '.agentvault', 'mfa');
+function ensureMfaDir() {
+    fs.mkdirSync(MFA_DIR, { recursive: true });
+}
+function deviceKeyFile(fingerprint) {
+    return path.join(MFA_DIR, `device-key-${fingerprint}.yaml`);
+}
+// ─── Internal crypto helpers ──────────────────────────────────────────────────
+/**
+ * Derive a 32-byte AES key from the device fingerprint using HKDF-SHA256.
+ * This binds the stored private key to the device's hardware identity.
+ */
+function deriveEncryptionKey(fingerprint, saltHex) {
+    const salt = Buffer.from(saltHex, 'hex');
+    const ikm = crypto.createHash('sha256').update(`agentvault:device-key:${fingerprint}`).digest();
+    return Buffer.from(crypto.hkdfSync('sha256', ikm, salt, 'agentvault:biometric-key:v1', 32));
+}
+/** AES-256-GCM encrypt. Returns { ciphertext, iv, authTag } — all Buffer. */
+function aesGcmEncrypt(plaintext, key) {
+    const iv = crypto.randomBytes(12); // 96-bit IV recommended for GCM
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    return { ciphertext, iv, authTag };
+}
+/** AES-256-GCM decrypt. Throws on authentication failure. */
+function aesGcmDecrypt(ciphertext, key, iv, authTag) {
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(authTag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+}
+// ─── Device credential management ────────────────────────────────────────────
+function loadCredential(fingerprint) {
+    const fp = deviceKeyFile(fingerprint);
+    if (!fs.existsSync(fp))
+        return null;
+    return parse(fs.readFileSync(fp, 'utf8'));
+}
+function saveCredential(cred) {
+    ensureMfaDir();
+    fs.writeFileSync(deviceKeyFile(cred.deviceFingerprint), stringify(cred), { mode: 0o600 });
+}
+// ─── Public API ───────────────────────────────────────────────────────────────
+/**
+ * Generate a new P-256 device keypair and store it (private key AES-GCM encrypted).
+ *
+ * This is the one-time "biometric enrollment" step.  In a browser this would
+ * involve navigator.credentials.create() with the Secure Enclave; here we use
+ * Node's crypto to produce an equivalent credential.
+ *
+ * @param deviceFingerprint - SHA-256(hostname ‖ platform ‖ arch)[:16] identifying this device
+ * @returns BiometricSetup containing the public key to register with the verifier
+ */
+export function setupBiometricCredential(deviceFingerprint) {
+    // Generate P-256 (prime256v1) keypair — matches WebAuthn ES256 (-7)
+    const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', {
+        namedCurve: 'prime256v1',
+    });
+    // Export keys
+    const pkcs8 = privateKey.export({ type: 'pkcs8', format: 'der' });
+    const spki = publicKey.export({ type: 'spki', format: 'der' });
+    const publicKeyB64 = spki.toString('base64url');
+    // Credential ID = SHA-256(public key DER)[:16], hex
+    const credentialId = crypto.createHash('sha256').update(spki).digest('hex').slice(0, 32);
+    // Derive encryption key and encrypt private key
+    const kdfSaltHex = crypto.randomBytes(32).toString('hex');
+    const encKey = deriveEncryptionKey(deviceFingerprint, kdfSaltHex);
+    const { ciphertext, iv, authTag } = aesGcmEncrypt(pkcs8, encKey);
+    const cred = {
+        credentialId,
+        deviceFingerprint,
+        publicKeyB64,
+        signCounter: 0,
+        encryptedPrivateKeyB64: ciphertext.toString('base64url'),
+        kdfSaltHex,
+        ivHex: iv.toString('hex'),
+        authTagHex: authTag.toString('hex'),
+        createdAt: new Date().toISOString(),
+    };
+    saveCredential(cred);
+    return {
+        credentialId,
+        deviceFingerprint,
+        publicKeyB64,
+        createdAt: cred.createdAt,
+    };
+}
+/**
+ * Sign a challenge hash with the device's private key (biometric assertion).
+ *
+ * Mirrors the WebAuthn AuthenticatorAssertionResponse:
+ *   - clientDataHash = SHA-256(JSON.stringify({ type, challenge, timestamp }))
+ *   - signature = ECDSA-SHA256(clientDataHash, privateKey) in DER format
+ *   - signCounter increments (replay protection)
+ *
+ * @param challengeHash  - SHA-256 hex from MFA challenge (binds this to the request)
+ * @param deviceFingerprint - Must match the enrolled device
+ * @returns WebAuthnAssertion — forward to the ICP canister for verification
+ */
+export function signChallenge(challengeHash, deviceFingerprint) {
+    const cred = loadCredential(deviceFingerprint);
+    if (!cred) {
+        throw new Error(`No biometric credential for device ${deviceFingerprint}. ` +
+            `Run: agentvault approve mfa biometric-setup`);
+    }
+    // Re-derive encryption key and decrypt private key
+    const encKey = deriveEncryptionKey(deviceFingerprint, cred.kdfSaltHex);
+    const pkcs8 = aesGcmDecrypt(Buffer.from(cred.encryptedPrivateKeyB64, 'base64url'), encKey, Buffer.from(cred.ivHex, 'hex'), Buffer.from(cred.authTagHex, 'hex'));
+    const privateKey = crypto.createPrivateKey({ key: pkcs8, format: 'der', type: 'pkcs8' });
+    // Build clientData (WebAuthn-compatible structure)
+    const timestamp = new Date().toISOString();
+    const clientDataJSON = JSON.stringify({
+        type: 'webauthn.get',
+        challenge: challengeHash,
+        origin: 'https://agentvault.approve',
+        timestamp,
+    });
+    const clientDataHash = crypto
+        .createHash('sha256')
+        .update(clientDataJSON)
+        .digest('hex');
+    // Sign with ECDSA-SHA256
+    const sigDer = crypto.sign('sha256', Buffer.from(clientDataHash, 'hex'), privateKey);
+    // Increment sign counter (replay protection)
+    cred.signCounter += 1;
+    saveCredential(cred);
+    return {
+        credentialId: cred.credentialId,
+        clientDataHash,
+        signatureB64: sigDer.toString('base64url'),
+        signCounter: cred.signCounter,
+        timestamp,
+    };
+}
+/**
+ * Verify a WebAuthn assertion from any device.
+ *
+ * @param assertion       - The assertion produced by signChallenge()
+ * @param challengeHash   - The original challenge hash (must be embedded in clientDataHash)
+ * @param publicKeyB64    - SPKI public key registered for this credential (base64url)
+ * @param lastSignCounter - The last seen signCounter for this credential (replay check)
+ * @returns { ok: true } or { ok: false, reason: string }
+ */
+export function verifyWebAuthnAssertion(assertion, challengeHash, publicKeyB64, lastSignCounter) {
+    // ── Counter check (replay protection) ────────────────────────────────────
+    if (assertion.signCounter <= lastSignCounter) {
+        return { ok: false, reason: 'counter-replay' };
+    }
+    // ── Reconstruct clientDataHash to verify it embeds the right challenge ───
+    // The clientDataHash is SHA-256(clientDataJSON) where clientDataJSON contains
+    // the challengeHash.  We verify the signature covers clientDataHash and that
+    // clientDataHash encodes the expected challenge.
+    // For the CLI flow the verifier re-derives clientDataHash from assertion.clientDataHash
+    // and checks the challenge is present (full JSON is not transmitted here, only hash).
+    // A production ICP canister would receive the full clientDataJSON.
+    // ── Signature verification ────────────────────────────────────────────────
+    const spki = Buffer.from(publicKeyB64, 'base64url');
+    let publicKey;
+    try {
+        publicKey = crypto.createPublicKey({ key: spki, format: 'der', type: 'spki' });
+    }
+    catch {
+        return { ok: false, reason: 'invalid-public-key' };
+    }
+    let sigBuf;
+    try {
+        sigBuf = Buffer.from(assertion.signatureB64, 'base64url');
+    }
+    catch {
+        return { ok: false, reason: 'invalid-signature-encoding' };
+    }
+    const verified = crypto.verify('sha256', Buffer.from(assertion.clientDataHash, 'hex'), publicKey, sigBuf);
+    if (!verified) {
+        return { ok: false, reason: 'signature-invalid' };
+    }
+    // ── Challenge binding ─────────────────────────────────────────────────────
+    // The clientDataHash must encode the expected challenge.  We verify by checking
+    // that the assertion's stored clientDataHash was derived from a JSON blob containing
+    // our challengeHash.  Since we only receive the hash (not the full JSON), we perform
+    // a best-effort check: the assertion must have been produced after the challenge was
+    // issued, which is ensured by the nonce/timestamp in the calling mfa-approval layer.
+    // If the full clientDataJSON is available (webapp flow), verify:
+    //   JSON.parse(clientDataJSON).challenge === challengeHash
+    void challengeHash;
+    return { ok: true };
+}
+/**
+ * Return the registered public key for a device, or null if not enrolled.
+ */
+export function getDevicePublicKey(deviceFingerprint) {
+    const cred = loadCredential(deviceFingerprint);
+    return cred?.publicKeyB64 ?? null;
+}
+/**
+ * Return the current sign counter for a device credential.
+ * Used by the verifier to detect counter replay.
+ */
+export function getSignCounter(deviceFingerprint) {
+    return loadCredential(deviceFingerprint)?.signCounter ?? 0;
+}
+/**
+ * Check whether a biometric credential exists for the given device.
+ */
+export function hasBiometricCredential(deviceFingerprint) {
+    return fs.existsSync(deviceKeyFile(deviceFingerprint));
+}
+//# sourceMappingURL=webauthn.js.map

package/dist/src/security/webauthn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../../src/security/webauthn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAExC,iFAAiF;AAEjF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;AAE9D,SAAS,YAAY;IACnB,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAAC,WAAmB;IACxC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,WAAW,OAAO,CAAC,CAAC;AAC9D,CAAC;AAgDD,iFAAiF;AAEjF;;;GAGG;AACH,SAAS,mBAAmB,CAAC,WAAmB,EAAE,OAAe;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,yBAAyB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAChG,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,6BAA6B,EAAE,EAAE,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,6EAA6E;AAC7E,SAAS,aAAa,CACpB,SAAiB,EACjB,GAAW;IAEX,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,gCAAgC;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,6DAA6D;AAC7D,SAAS,aAAa,CACpB,UAAkB,EAClB,GAAW,EACX,EAAU,EACV,OAAe;IAEf,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,gFAAgF;AAEhF,SAAS,cAAc,CAAC,WAAmB;IACzC,MAAM,EAAE,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAqB,CAAC;AAChE,CAAC;AAED,SAAS,cAAc,CAAC,IAAsB;IAC5C,YAAY,EAAE,CAAC;IACf,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,iBAAyB;IAChE,oEAAoE;IACpE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;QACjE,UAAU,EAAE,YAAY;KACzB,CAAC,CAAC;IAEH,cAAc;IACd,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IAC5E,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IACzE,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEhD,oDAAoD;IACpD,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEzF,gDAAgD;IAChD,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,mBAAmB,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;IAClE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEjE,MAAM,IAAI,GAAqB;QAC7B,YAAY;QACZ,iBAAiB;QACjB,YAAY;QACZ,WAAW,EAAE,CAAC;QACd,sBAAsB,EAAE,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;QACxD,UAAU;QACV,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzB,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,cAAc,CAAC,IAAI,CAAC,CAAC;IAErB,OAAO;QACL,YAAY;QACZ,iBAAiB;QACjB,YAAY;QACZ,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,aAAqB,EACrB,iBAAyB;IAEzB,MAAM,IAAI,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,sCAAsC,iBAAiB,IAAI;YACzD,6CAA6C,CAChD,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,MAAM,MAAM,GAAG,mBAAmB,CAAC,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,aAAa,CACzB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC,EACrD,MAAM,EACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CACpC,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAEzF,mDAAmD;IACnD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;QACpC,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,aAAa;QACxB,MAAM,EAAE,4BAA4B;QACpC,SAAS;KACV,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAM;SAC1B,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjB,yBAAyB;IACzB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;IAErF,6CAA6C;IAC7C,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;IACtB,cAAc,CAAC,IAAI,CAAC,CAAC;IAErB,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc;QACd,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC1C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAA4B,EAC5B,aAAqB,EACrB,YAAoB,EACpB,eAAuB;IAEvB,4EAA4E;IAC5E,IAAI,SAAS,CAAC,WAAW,IAAI,eAAe,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,iDAAiD;IACjD,wFAAwF;IACxF,sFAAsF;IACtF,mEAAmE;IAEnE,6EAA6E;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,SAA2B,CAAC;IAChC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAC5B,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,EAC5C,SAAS,EACT,MAAM,CACP,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,6EAA6E;IAC7E,gFAAgF;IAChF,qFAAqF;IACrF,qFAAqF;IACrF,qFAAqF;IACrF,qFAAqF;IACrF,iEAAiE;IACjE,2DAA2D;IAC3D,KAAK,aAAa,CAAC;IAEnB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,iBAAyB;IAC1D,MAAM,IAAI,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;IAC/C,OAAO,IAAI,EAAE,YAAY,IAAI,IAAI,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,iBAAyB;IACtD,OAAO,cAAc,CAAC,iBAAiB,CAAC,EAAE,WAAW,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,iBAAyB;IAC9D,OAAO,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/src/testing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC"}

package/dist/src/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC"}

package/dist/src/testing/local-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-runner.d.ts","sourceRoot":"","sources":["../../../src/testing/local-runner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EACV,iBAAiB,EACjB,SAAS,EACT,cAAc,EACd,cAAc,EACf,MAAM,YAAY,CAAC;AAwEpB;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAC,CA8BjF;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAC,CA8BxF;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAiFlF;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,CAAC,CAiB9F"}

package/dist/src/testing/local-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-runner.js","sourceRoot":"","sources":["../../../src/testing/local-runner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AAQzB,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AAC9D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;AAEnE;;GAEG;AACH,SAAS,oBAAoB;IAC3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrC,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,SAAiB,EAAE,QAAgB;IAC7D,oBAAoB,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,SAAS,IAAI,QAAQ,IAAI,SAAS,OAAO,CAAC,CAAC;AACnF,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAClE,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;YAC3C,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;YAC1C,MAAM,IAAI,GAAG,OAAO,IAAI,GAAG,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI;gBACJ,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAC/E,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;aAC7B,CAAC,CAAC;YACH,KAAK,EAAE,CAAC;YACR,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,EAAE,CAAC;iBAC3B,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,EAAE,CAAC;;gBAChC,OAAO,EAAE,CAAC;QACjB,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC5E,IAAI,aAAa,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK;QACL,MAAM;QACN,MAAM;QACN,OAAO;QACP,QAAQ;QACR,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA0B;IAC3D,MAAM,UAAU,GAAG;QACjB,KAAK;QACL,oBAAoB;KACrB,CAAC;IAEF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,UAAU,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;QACpC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAE9B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,GAAG,UAAU,CAAC,EAAE;QAC3D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnD,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;QACpC,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAClE,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,yBAAyB,WAAW,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAA0B;IAClE,MAAM,UAAU,GAAG;QACjB,KAAK;QACL,oBAAoB;KACrB,CAAC;IAEF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,UAAU,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;QACpC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAErC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,GAAG,UAAU,CAAC,EAAE;QAC3D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnD,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;QACpC,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACzE,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,yBAAyB,WAAW,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAsB;IACvD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,SAAS,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;IAEpE,MAAM,eAAe,GAA+E,EAAE,CAAC;IAEvG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO;YAAE,MAAM;QAEjC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE/B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;YACjI,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;YAC9C,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC;gBAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YACjD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAErC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAEnD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,aAAa,EAAE,CAAC;QAChB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,kBAAkB,EAAE,CAAC;YACrB,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,cAAc,EAAE,CAAC;YACjB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;IACvD,MAAM,iBAAiB,GAAG,aAAa,GAAG,cAAc,CAAC;IAEzD,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,MAAM,eAAe,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC;QAC9C,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM;QACjE,CAAC,CAAC,CAAC,CAAC;IAEN,MAAM,WAAW,GAAG;QAClB,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC;QAC3D,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC;QAC3D,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC;QAC5D,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC;KAC7D,CAAC;IAEF,OAAO;QACL,aAAa;QACb,kBAAkB;QAClB,cAAc;QACd,iBAAiB;QACjB,eAAe;QACf,eAAe;QACf,eAAe;QACf,WAAW;QACX,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAA0B;IACvD,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,MAAM;YACT,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;QAC/B,KAAK,aAAa;YAChB,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACtC,KAAK,WAAW;YACd,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE;YACE,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}

package/dist/src/testing/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/testing/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,gBAAgB;AAChB,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,aAAa,GAAG,WAAW,CAAC;AAE5D,yBAAyB;AACzB,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEzD,kCAAkC;AAClC,MAAM,WAAW,QAAQ;IACvB,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB;IAClB,MAAM,EAAE,UAAU,CAAC;IACnB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAwB;AACxB,MAAM,WAAW,SAAS;IACxB,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,KAAK,EAAE,QAAQ,EAAE,CAAC;CACnB;AAED,0BAA0B;AAC1B,MAAM,WAAW,iBAAiB;IAChC,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,wBAAwB;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IACzC,qBAAqB;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,yBAAyB;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8BAA8B;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,uBAAuB;AACvB,MAAM,WAAW,cAAc;IAC7B,0BAA0B;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,0BAA0B;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,0BAA0B;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,eAAe,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,eAAe,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB;IAClB,WAAW,EAAE;QACX,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC"}

package/dist/src/testing/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/testing/types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/src/trading/api-key-manager.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Binance API Key Manager
+ *
+ * Manages Binance API key lifecycle with mandatory weekly rotation.
+ * Keys are stored encrypted on disk using AES-256-GCM; only the
+ * metadata (creation timestamp, rotation interval) is held in plaintext.
+ *
+ * Threat model: assume the host is compromised at rest.
+ *   - Never log raw API key or secret.
+ *   - Rotation is enforced: operations on an overdue key are blocked by default.
+ *   - IP whitelist is embedded in the key record so it travels with the secret.
+ */
+export declare const KEY_ROTATION_INTERVAL_DAYS = 7;
+export interface BinanceApiKey {
+    /** Opaque label / nickname for this key pair (e.g. "trading-bot-1"). */
+    label: string;
+    /** Binance API key (public portion). */
+    apiKey: string;
+    /** Binance API secret (sensitive). */
+    apiSecret: string;
+    /** ISO-8601 timestamp when this key was first provisioned. */
+    createdAt: string;
+    /**
+     * IP addresses / CIDR blocks that Binance should restrict this key to.
+     * These mirror the IP restrictions you configure on the Binance sub-account.
+     */
+    ipWhitelist: string[];
+    /** Rotation interval in days (default: 7). */
+    rotationIntervalDays: number;
+}
+export interface KeyRotationStatus {
+    label: string;
+    createdAt: string;
+    rotationDue: boolean;
+    /** Days until rotation is due (negative means overdue). */
+    daysRemaining: number;
+    overdueDays: number;
+}
+export declare function getRotationStatus(record: Pick<BinanceApiKey, 'label' | 'createdAt' | 'rotationIntervalDays'>): KeyRotationStatus;
+/**
+ * Returns true if the key is within the allowed rotation window.
+ * Use this as a guard before allowing trade execution.
+ */
+export declare function isKeyValid(key: BinanceApiKey): boolean;
+export declare class ApiKeyManager {
+    private readonly vaultDir;
+    /**
+     * @param vaultDir Directory where encrypted key records are stored.
+     *                 Must be kept under a firewall-restricted VPS path.
+     */
+    constructor(vaultDir: string);
+    private recordPath;
+    private ensureVaultDir;
+    /**
+     * Persist a Binance API key pair, encrypted with `passphrase`.
+     *
+     * The passphrase should be derived from an operator-held master secret
+     * (e.g. a hardware token or the AgentVault VetKeys seed phrase) — never
+     * a static string baked into source code.
+     */
+    save(key: BinanceApiKey, passphrase: string): void;
+    /**
+     * Load and decrypt a stored key record.
+     * Throws if the file is missing, tampered, or the passphrase is wrong.
+     */
+    load(label: string, passphrase: string): BinanceApiKey;
+    /**
+     * List labels of all stored key records (without decrypting).
+     */
+    list(): string[];
+    /**
+     * Delete a stored key record from disk.
+     * Call this *after* revoking the key on Binance.
+     */
+    delete(label: string): void;
+    /**
+     * Check rotation status for a single stored key without decrypting secrets.
+     */
+    checkRotation(label: string): KeyRotationStatus;
+    /**
+     * Return rotation status for every stored key.
+     */
+    checkAllRotations(): KeyRotationStatus[];
+    /**
+     * Rotate an existing key: save the new credentials, delete the old record.
+     *
+     * The caller is responsible for:
+     *   1. Creating the new key on the Binance sub-account portal.
+     *   2. Configuring the IP restriction on Binance before calling this.
+     *   3. Revoking the old key on Binance after this returns.
+     *
+     * The `newKey.createdAt` should be set to the current time.
+     */
+    rotate(oldLabel: string, newKey: BinanceApiKey, passphrase: string): void;
+}
+//# sourceMappingURL=api-key-manager.d.ts.map

package/dist/src/trading/api-key-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-manager.d.ts","sourceRoot":"","sources":["../../../src/trading/api-key-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAUH,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAY5C,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,8CAA8C;IAC9C,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAmBD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,2DAA2D;IAC3D,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAqDD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,GAAG,WAAW,GAAG,sBAAsB,CAAC,GAAG,iBAAiB,CAehI;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAEtD;AAMD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAElC;;;OAGG;gBACS,QAAQ,EAAE,MAAM;IAM5B,OAAO,CAAC,UAAU;IAMlB,OAAO,CAAC,cAAc;IAQtB;;;;;;OAMG;IACH,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAsBlD;;;OAGG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,aAAa;IA4BtD;;OAEG;IACH,IAAI,IAAI,MAAM,EAAE;IAQhB;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAO3B;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB;IAa/C;;OAEG;IACH,iBAAiB,IAAI,iBAAiB,EAAE;IAIxC;;;;;;;;;OASG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;CAI1E"}

package/dist/src/trading/api-key-manager.js

@@ -0,0 +1,201 @@
+/**
+ * Binance API Key Manager
+ *
+ * Manages Binance API key lifecycle with mandatory weekly rotation.
+ * Keys are stored encrypted on disk using AES-256-GCM; only the
+ * metadata (creation timestamp, rotation interval) is held in plaintext.
+ *
+ * Threat model: assume the host is compromised at rest.
+ *   - Never log raw API key or secret.
+ *   - Rotation is enforced: operations on an overdue key are blocked by default.
+ *   - IP whitelist is embedded in the key record so it travels with the secret.
+ */
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+export const KEY_ROTATION_INTERVAL_DAYS = 7;
+/** Bytes used for AES-256-GCM IV and salt. */
+const IV_BYTES = 12;
+const SALT_BYTES = 16;
+const PBKDF2_ITERATIONS = 200_000;
+const PBKDF2_KEY_BYTES = 32;
+// ---------------------------------------------------------------------------
+// Encryption helpers (AES-256-GCM + PBKDF2)
+// ---------------------------------------------------------------------------
+function deriveKey(passphrase, salt) {
+    return crypto.pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, PBKDF2_KEY_BYTES, 'sha256');
+}
+function encrypt(plaintext, passphrase) {
+    const salt = crypto.randomBytes(SALT_BYTES);
+    const iv = crypto.randomBytes(IV_BYTES);
+    const key = deriveKey(passphrase, salt);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    const ciphertext = Buffer.concat([
+        cipher.update(plaintext, 'utf8'),
+        cipher.final(),
+    ]);
+    const authTag = cipher.getAuthTag();
+    return { iv, salt, authTag, ciphertext };
+}
+function decrypt(ciphertext, iv, salt, authTag, passphrase) {
+    const key = deriveKey(passphrase, salt);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(authTag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+}
+// ---------------------------------------------------------------------------
+// Rotation logic
+// ---------------------------------------------------------------------------
+export function getRotationStatus(record) {
+    const createdAt = new Date(record.createdAt);
+    const now = new Date();
+    const ageMs = now.getTime() - createdAt.getTime();
+    const ageDays = ageMs / (1000 * 60 * 60 * 24);
+    const daysRemaining = record.rotationIntervalDays - ageDays;
+    const overdueDays = Math.max(0, -daysRemaining);
+    return {
+        label: record.label,
+        createdAt: record.createdAt,
+        rotationDue: daysRemaining <= 0,
+        daysRemaining: Math.ceil(daysRemaining),
+        overdueDays: Math.floor(overdueDays),
+    };
+}
+/**
+ * Returns true if the key is within the allowed rotation window.
+ * Use this as a guard before allowing trade execution.
+ */
+export function isKeyValid(key) {
+    return !getRotationStatus(key).rotationDue;
+}
+// ---------------------------------------------------------------------------
+// ApiKeyManager
+// ---------------------------------------------------------------------------
+export class ApiKeyManager {
+    vaultDir;
+    /**
+     * @param vaultDir Directory where encrypted key records are stored.
+     *                 Must be kept under a firewall-restricted VPS path.
+     */
+    constructor(vaultDir) {
+        this.vaultDir = path.resolve(vaultDir);
+    }
+    // ── Storage helpers ────────────────────────────────────────────────────────
+    recordPath(label) {
+        // Sanitise label so it is safe to use as a filename.
+        const safe = label.replace(/[^a-zA-Z0-9_-]/g, '_');
+        return path.join(this.vaultDir, `${safe}.binance.enc`);
+    }
+    ensureVaultDir() {
+        fs.mkdirSync(this.vaultDir, { recursive: true });
+        // Restrict directory to owner only (rwx------).
+        fs.chmodSync(this.vaultDir, 0o700);
+    }
+    // ── Public API ─────────────────────────────────────────────────────────────
+    /**
+     * Persist a Binance API key pair, encrypted with `passphrase`.
+     *
+     * The passphrase should be derived from an operator-held master secret
+     * (e.g. a hardware token or the AgentVault VetKeys seed phrase) — never
+     * a static string baked into source code.
+     */
+    save(key, passphrase) {
+        this.ensureVaultDir();
+        const payload = JSON.stringify({ apiKey: key.apiKey, apiSecret: key.apiSecret });
+        const { iv, salt, authTag, ciphertext } = encrypt(payload, passphrase);
+        const record = {
+            version: 1,
+            label: key.label,
+            createdAt: key.createdAt,
+            rotationIntervalDays: key.rotationIntervalDays,
+            ipWhitelist: key.ipWhitelist,
+            salt: salt.toString('hex'),
+            iv: iv.toString('hex'),
+            authTag: authTag.toString('hex'),
+            ciphertext: ciphertext.toString('hex'),
+        };
+        const filePath = this.recordPath(key.label);
+        fs.writeFileSync(filePath, JSON.stringify(record, null, 2), { mode: 0o600 });
+    }
+    /**
+     * Load and decrypt a stored key record.
+     * Throws if the file is missing, tampered, or the passphrase is wrong.
+     */
+    load(label, passphrase) {
+        const filePath = this.recordPath(label);
+        if (!fs.existsSync(filePath)) {
+            throw new Error(`No key record found for label: ${label}`);
+        }
+        const record = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+        const plaintext = decrypt(Buffer.from(record.ciphertext, 'hex'), Buffer.from(record.iv, 'hex'), Buffer.from(record.salt, 'hex'), Buffer.from(record.authTag, 'hex'), passphrase);
+        const { apiKey, apiSecret } = JSON.parse(plaintext);
+        return {
+            label: record.label,
+            apiKey,
+            apiSecret,
+            createdAt: record.createdAt,
+            ipWhitelist: record.ipWhitelist,
+            rotationIntervalDays: record.rotationIntervalDays,
+        };
+    }
+    /**
+     * List labels of all stored key records (without decrypting).
+     */
+    list() {
+        if (!fs.existsSync(this.vaultDir))
+            return [];
+        return fs
+            .readdirSync(this.vaultDir)
+            .filter(f => f.endsWith('.binance.enc'))
+            .map(f => f.replace(/\.binance\.enc$/, ''));
+    }
+    /**
+     * Delete a stored key record from disk.
+     * Call this *after* revoking the key on Binance.
+     */
+    delete(label) {
+        const filePath = this.recordPath(label);
+        if (fs.existsSync(filePath)) {
+            fs.rmSync(filePath);
+        }
+    }
+    /**
+     * Check rotation status for a single stored key without decrypting secrets.
+     */
+    checkRotation(label) {
+        const filePath = this.recordPath(label);
+        if (!fs.existsSync(filePath)) {
+            throw new Error(`No key record found for label: ${label}`);
+        }
+        const record = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+        return getRotationStatus({
+            label: record.label,
+            createdAt: record.createdAt,
+            rotationIntervalDays: record.rotationIntervalDays,
+        });
+    }
+    /**
+     * Return rotation status for every stored key.
+     */
+    checkAllRotations() {
+        return this.list().map(label => this.checkRotation(label));
+    }
+    /**
+     * Rotate an existing key: save the new credentials, delete the old record.
+     *
+     * The caller is responsible for:
+     *   1. Creating the new key on the Binance sub-account portal.
+     *   2. Configuring the IP restriction on Binance before calling this.
+     *   3. Revoking the old key on Binance after this returns.
+     *
+     * The `newKey.createdAt` should be set to the current time.
+     */
+    rotate(oldLabel, newKey, passphrase) {
+        this.save(newKey, passphrase);
+        this.delete(oldLabel);
+    }
+}
+//# sourceMappingURL=api-key-manager.js.map

package/dist/src/trading/api-key-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-manager.js","sourceRoot":"","sources":["../../../src/trading/api-key-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAE5C,8CAA8C;AAC9C,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAkD5B,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E,SAAS,SAAS,CAAC,UAAkB,EAAE,IAAY;IACjD,OAAO,MAAM,CAAC,UAAU,CACtB,UAAU,EACV,IAAI,EACJ,iBAAiB,EACjB,gBAAgB,EAChB,QAAQ,CACT,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,SAAiB,EAAE,UAAkB;IAMpD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,OAAO,CACd,UAAkB,EAClB,EAAU,EACV,IAAY,EACZ,OAAe,EACf,UAAkB;IAElB,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACzF,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,UAAU,iBAAiB,CAAC,MAA2E;IAC3G,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;IAClD,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,oBAAoB,GAAG,OAAO,CAAC;IAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;IAEhD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,aAAa,IAAI,CAAC;QAC/B,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACvC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;KACrC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAkB;IAC3C,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,OAAO,aAAa;IACP,QAAQ,CAAS;IAElC;;;OAGG;IACH,YAAY,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,8EAA8E;IAEtE,UAAU,CAAC,KAAa;QAC9B,qDAAqD;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,cAAc,CAAC,CAAC;IACzD,CAAC;IAEO,cAAc;QACpB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,gDAAgD;QAChD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,8EAA8E;IAE9E;;;;;;OAMG;IACH,IAAI,CAAC,GAAkB,EAAE,UAAkB;QACzC,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QACjF,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAEvE,MAAM,MAAM,GAAuB;YACjC,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;YAC9C,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC1B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAChC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;SACvC,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED;;;OAGG;IACH,IAAI,CAAC,KAAa,EAAE,UAAkB;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAuB,CAAC;QAEpF,MAAM,SAAS,GAAG,OAAO,CACvB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,EACrC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,EAC7B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,EAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,EAClC,UAAU,CACX,CAAC;QAEF,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA0C,CAAC;QAE7F,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM;YACN,SAAS;YACT,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;SAClD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAI;QACF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QAC7C,OAAO,EAAE;aACN,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;aACvC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAa;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,KAAa;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAuB,CAAC;QACpF,OAAO,iBAAiB,CAAC;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;SAClD,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,QAAgB,EAAE,MAAqB,EAAE,UAAkB;QAChE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;CACF"}