approval-md 0.0.1 → 0.2.0

package/dist/src/core/seal.js

@@ -0,0 +1,290 @@
+/**
+ * Sealed token delivery (amended SPEC.md §6.3, §10.4, §11.1 — APRV-105).
+ *
+ * The problem this closes is a handover, not an authorization. A token is minted
+ * at exactly one site — the grant path of `core/gate.ts` — and spent at another,
+ * `approval run`. The two are different processes, and until now the only
+ * transport between them was a human with a clipboard: `approval grant` (or the
+ * Telegram listener) printed the raw token on ITS stdout, and `approval wait`,
+ * which reads only the verified log, had nothing to return because the log
+ * carries hashes. On one machine that is a paste. Across two — the listener on a
+ * laptop, the agent elsewhere, the log synced through git — it is a paste that
+ * cannot happen.
+ *
+ * So the requester publishes an ADDRESS. `approval request` mints an ephemeral
+ * X25519 keypair, keeps the private half in a 0600 file beside the log, and puts
+ * the public half on `approval.requested` as `token_recipient_key`. On grant the
+ * mint site seals the raw token to that key and records the ciphertext beside
+ * the digest as `token_sealed`. `approval wait` opens it with the local private
+ * key and hands the token back to the process that asked for it.
+ *
+ * ## The keypair ADDRESSES; it does not AUTHORIZE
+ *
+ * The obvious objection is that the agent creates both halves of the key, so how
+ * does this control the agent? It does not, and it does not need to. The four
+ * properties that make an action human-gated are untouched:
+ *
+ * - a token exists only after a human grant (one mint site);
+ * - it binds to the exact payload bytes;
+ * - it is single-use, and consumption is an `execution.started` in the log;
+ * - credentials answer only to tokens.
+ *
+ * A keypair cannot mint a token, forge a grant, alter the bound payload, or
+ * reuse a spent one. What changes is who can READ a minted token: the requesting
+ * process instead of the human's clipboard, which is where the human was
+ * carrying it anyway. A malicious agent that substitutes a key substitutes it
+ * only in its OWN request, which the approver sees and approves as that agent's
+ * request; identity spoofing is exactly as it was in SPEC.md §11, where the
+ * trust boundary is the machine.
+ *
+ * What is lost, stated plainly: the marginal ability to approve on the phone and
+ * then withhold delivery.
+ *
+ * ## Residual risk, stated plainly
+ *
+ * Someone who steals the private-key file AND reads the log can recover an
+ * unspent token inside its TTL. That window equals the terminal-paste window
+ * today, and it closes at consume or at TTL, whichever comes first — this module
+ * unlinks the key file at both. The ciphertext lives in a public, permanent log,
+ * so the seal must be sound and the token short-lived; it already is.
+ *
+ * ## The construction
+ *
+ * X25519 ECDH to a fresh ephemeral sender key, HKDF-SHA-256 to a 32-byte AEAD
+ * key, AES-256-GCM with a fresh 12-byte nonce. All from `node:crypto`; no
+ * dependency is added. The sender's ephemeral public key travels with the
+ * ciphertext, so the recipient needs nothing but its own private key and the
+ * record. The HKDF `info` binds the ciphertext to this scheme and to the action
+ * it was minted for, so a seal lifted from one grant cannot be replayed as
+ * another's even by someone holding both key files.
+ */
+import { createCipheriv, createDecipheriv, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, } from "node:crypto";
+import { closeSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeSync, } from "node:fs";
+import { basename, dirname, join } from "node:path";
+/** The payload key carrying the requester's public key on `approval.requested`. */
+export const RECIPIENT_KEY_FIELD = "token_recipient_key";
+/** The payload key carrying the sealed token on `approval.granted`. */
+export const SEALED_TOKEN_FIELD = "token_sealed";
+/**
+ * The payload key on `approval.requested` saying the requester will consume its
+ * own grant in its own process (APRV-211), so the raw token is delivered ONLY
+ * through the seal and is never returned to the granting surface.
+ *
+ * A fact about delivery, recorded where every other delivery fact is recorded.
+ * It authorizes nothing and relaxes nothing: the token is still minted only by
+ * a human's grant, still bound to the payload bytes, still single-use. What it
+ * removes is a reader — a terminal that was being handed a live credential it
+ * had no use for.
+ */
+export const SELF_DELIVERY_FIELD = "token_delivery_self";
+/** `.approval/keys/`, the sibling of the log directory the private keys live in. */
+export const KEY_STORE_DIRNAME = "keys";
+/** The scheme identifier recorded inside every seal. One value in v0.1. */
+export const SEAL_ALG = "x25519-hkdf-sha256/aes-256-gcm";
+const NONCE_BYTES = 12;
+const KEY_BYTES = 32;
+/** The key store for a log path, by the same rule the payload store uses. */
+export function keyStoreDirFor(logPath) {
+    const logDir = dirname(logPath);
+    const home = basename(logDir) === "log" ? dirname(logDir) : logDir;
+    return join(home, KEY_STORE_DIRNAME);
+}
+/**
+ * The file one action key's private key lives in.
+ *
+ * The action key is used verbatim wherever it is already a safe file name, and
+ * percent-encoded elsewhere. Percent-encoding is injective, so two distinct
+ * action keys can never name one file — which matters more than readability,
+ * since a collision would hand one action's token to another. The common case
+ * (`task-042:chaser:2026-08-04`) survives unchanged, so the directory listing
+ * still reads as the action keys it holds.
+ */
+export function keyPath(keyDir, actionKey) {
+    const safe = actionKey.replace(/[^A-Za-z0-9._:-]/gu, (character) => [...character]
+        .flatMap((unit) => [...Buffer.from(unit, "utf8")])
+        .map((byte) => `%${byte.toString(16).toUpperCase().padStart(2, "0")}`)
+        .join(""));
+    return join(keyDir, `${safe}.key`);
+}
+/** Mint an ephemeral X25519 keypair for one request. */
+export function mintRecipientKeypair() {
+    const pair = generateKeyPairSync("x25519");
+    return {
+        publicKey: pair.publicKey.export({ type: "spki", format: "der" }).toString("base64"),
+        privateKey: pair.privateKey.export({ type: "pkcs8", format: "der" }).toString("base64"),
+    };
+}
+/** Is this a value that could be a recipient public key? Shape only. */
+export function isRecipientKey(value) {
+    return typeof value === "string" && /^[A-Za-z0-9+/]{20,600}={0,2}$/u.test(value);
+}
+function publicKeyOf(encoded) {
+    return createPublicKey({
+        key: Buffer.from(encoded, "base64"),
+        format: "der",
+        type: "spki",
+    });
+}
+function privateKeyOf(encoded) {
+    return createPrivateKey({
+        key: Buffer.from(encoded, "base64"),
+        format: "der",
+        type: "pkcs8",
+    });
+}
+function detail(cause) {
+    return cause instanceof Error ? cause.message : String(cause);
+}
+/** Distinguishes concurrent writers' temp files within one process. */
+let tempCounter = 0;
+/**
+ * Write one private key, atomically and 0600.
+ *
+ * The mode is set by `openSync`'s mode argument on a file created `wx`, so the
+ * key never exists at a wider mode even for an instant — a `chmod` after the
+ * fact would leave a window in which any process on the machine could read it.
+ * The rename is atomic, so a reader either sees the whole key or no file.
+ */
+export function writePrivateKey(keyDir, actionKey, privateKey) {
+    const path = keyPath(keyDir, actionKey);
+    tempCounter += 1;
+    const temp = join(keyDir, `.${basename(path)}.tmp-${String(process.pid)}-${String(tempCounter)}`);
+    try {
+        mkdirSync(keyDir, { recursive: true, mode: 0o700 });
+        const handle = openSync(temp, "wx", 0o600);
+        try {
+            writeSync(handle, privateKey, 0, "utf8");
+        }
+        finally {
+            closeSync(handle);
+        }
+        renameSync(temp, path);
+    }
+    catch (cause) {
+        try {
+            unlinkSync(temp);
+        }
+        catch {
+            // The temp file may never have been created; nothing to clean up.
+        }
+        return { ok: false, message: detail(cause) };
+    }
+    return { ok: true, path };
+}
+/** The private key for an action, or `null` when this machine holds none. */
+export function readPrivateKey(keyDir, actionKey) {
+    try {
+        const text = readFileSync(keyPath(keyDir, actionKey), "utf8").trim();
+        return text.length === 0 ? null : text;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Remove one action's private key. Idempotent and never throws.
+ *
+ * Called at every death of the authorization it addresses: consumption, expiry,
+ * revocation. A key that outlived its grant would be a decryption capability for
+ * a ciphertext that is in the log forever, kept for no reason at all.
+ */
+export function forgetPrivateKey(keyDir, actionKey) {
+    try {
+        unlinkSync(keyPath(keyDir, actionKey));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Binds a seal to this scheme and to the action it was minted for. */
+function infoFor(actionKey) {
+    return Buffer.from(`approval.md/${SEAL_ALG}/${actionKey}`, "utf8");
+}
+function aeadKey(shared, actionKey) {
+    return Buffer.from(hkdfSync("sha256", shared, Buffer.alloc(0), infoFor(actionKey), KEY_BYTES));
+}
+/**
+ * Seal a raw token to a recipient public key.
+ *
+ * Returns `null` for a recipient key that cannot be parsed. A grant is not
+ * refused over an unusable recipient key: the authorization is the human's
+ * decision and stands, the digest still binds it, and the raw token is still
+ * printed once on the granting surface. What fails is the convenience, and a
+ * convenience must never be able to void a human's yes.
+ */
+export function sealToken(token, recipientPublicKey, actionKey) {
+    let recipient;
+    try {
+        recipient = publicKeyOf(recipientPublicKey);
+    }
+    catch {
+        return null;
+    }
+    try {
+        const ephemeral = generateKeyPairSync("x25519");
+        const shared = diffieHellman({ privateKey: ephemeral.privateKey, publicKey: recipient });
+        const nonce = randomBytes(NONCE_BYTES);
+        const cipher = createCipheriv("aes-256-gcm", aeadKey(shared, actionKey), nonce);
+        const ct = Buffer.concat([cipher.update(token, "utf8"), cipher.final()]);
+        return {
+            alg: SEAL_ALG,
+            epk: ephemeral.publicKey.export({ type: "spki", format: "der" }).toString("base64"),
+            nonce: nonce.toString("base64"),
+            ct: ct.toString("base64"),
+            tag: cipher.getAuthTag().toString("base64"),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** Read a `token_sealed` payload value as a {@link SealedToken}, or `null`. */
+export function asSealedToken(value) {
+    if (typeof value !== "object" || value === null)
+        return null;
+    const record = value;
+    const fields = ["alg", "epk", "nonce", "ct", "tag"];
+    for (const field of fields) {
+        if (typeof record[field] !== "string" || record[field].length === 0)
+            return null;
+    }
+    if (record["alg"] !== SEAL_ALG)
+        return null;
+    return {
+        alg: record["alg"],
+        epk: record["epk"],
+        nonce: record["nonce"],
+        ct: record["ct"],
+        tag: record["tag"],
+    };
+}
+/**
+ * Open a sealed token with a recipient private key.
+ *
+ * Returns `null` for anything that does not authenticate: a wrong key, a
+ * tampered ciphertext, a seal minted for a different action key. There is one
+ * failure, deliberately: distinguishing "wrong key" from "wrong ciphertext"
+ * would be an oracle, and the caller's response to either is identical — fall
+ * back to the raw token the granting surface printed.
+ */
+export function openSealedToken(sealed, recipientPrivateKey, actionKey) {
+    try {
+        const shared = diffieHellman({
+            privateKey: privateKeyOf(recipientPrivateKey),
+            publicKey: publicKeyOf(sealed.epk),
+        });
+        const decipher = createDecipheriv("aes-256-gcm", aeadKey(shared, actionKey), Buffer.from(sealed.nonce, "base64"));
+        decipher.setAuthTag(Buffer.from(sealed.tag, "base64"));
+        const plain = Buffer.concat([
+            decipher.update(Buffer.from(sealed.ct, "base64")),
+            decipher.final(),
+        ]);
+        const token = plain.toString("utf8");
+        return token.length === 0 ? null : token;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=seal.js.map

package/dist/src/core/seal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal.js","sourceRoot":"","sources":["../../../src/core/seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,QAAQ,EACR,WAAW,GAEZ,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEpD,mFAAmF;AACnF,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD,uEAAuE;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,QAAQ,GAAG,gCAAgC,CAAC;AAEzD,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACnE,OAAO,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,OAAO,CAAC,MAAc,EAAE,SAAiB;IACvD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAC5B,oBAAoB,EACpB,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,GAAG,SAAS,CAAC;SACX,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;SACjD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;SACrE,IAAI,CAAC,EAAE,CAAC,CACd,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;AACrC,CAAC;AAcD,wDAAwD;AACxD,MAAM,UAAU,oBAAoB;IAClC,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC3C,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACpF,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACxF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,eAAe,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;QACnC,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,gBAAgB,CAAC;QACtB,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;QACnC,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;AACL,CAAC;AAQD,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,uEAAuE;AACvE,IAAI,WAAW,GAAG,CAAC,CAAC;AAEpB;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,SAAiB,EACjB,UAAkB;IAElB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxC,WAAW,IAAI,CAAC,CAAC;IACjB,MAAM,IAAI,GAAG,IAAI,CACf,MAAM,EACN,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CACvE,CAAC;IACF,IAAI,CAAC;QACH,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;QACD,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,SAAiB;IAC9D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,SAAiB;IAChE,IAAI,CAAC;QACH,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAoBD,uEAAuE;AACvE,SAAS,OAAO,CAAC,SAAiB;IAChC,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,QAAQ,IAAI,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,SAAiB;IAChD,OAAO,MAAM,CAAC,IAAI,CAChB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CACvB,KAAa,EACb,kBAA0B,EAC1B,SAAiB;IAEjB,IAAI,SAAoB,CAAC;IACzB,IAAI,CAAC;QACH,SAAS,GAAG,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;QAChF,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO;YACL,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnF,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC5C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAU,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,MAAM,CAAC,KAAK,CAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/F,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,KAAK,CAAW;QAC5B,GAAG,EAAE,MAAM,CAAC,KAAK,CAAW;QAC5B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAW;QAChC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAW;QAC1B,GAAG,EAAE,MAAM,CAAC,KAAK,CAAW;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAmB,EACnB,mBAA2B,EAC3B,SAAiB;IAEjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC;YAC3B,UAAU,EAAE,YAAY,CAAC,mBAAmB,CAAC;YAC7C,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC;SACnC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CACpC,CAAC;QACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;YAC1B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACjD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}