crewly 1.20.303 → 1.20.304

package/dist/backend/backend/src/services/team-move/team-move-crypto.js

@@ -0,0 +1,348 @@
+/**
+ * Team move crypto — end-to-end encryption of the package stream.
+ *
+ * Only the two machines can read a package; Crewly Cloud stores ciphertext.
+ *
+ *  - The TARGET makes an ephemeral X25519 key pair per move. The public key
+ *    goes to Cloud, the private key never leaves the target's
+ *    `~/.crewly/team-moves/<moveId>/`.
+ *  - The SOURCE makes an ephemeral X25519 key pair per package, derives a
+ *    shared secret with the target's public key and runs it through
+ *    HKDF-SHA256 (random 32-byte salt, `info` binds the move id) to get a
+ *    one-time AES-256 key.
+ *  - The stream is cut into frames of `frameBytes` plaintext. Each frame is
+ *    sealed with AES-256-GCM under its own nonce (frame counter). The
+ *    authenticated data of every frame is the header (which carries the move
+ *    id and the ephemeral public key), the frame counter and a "final" flag,
+ *    so a frame cannot be moved, dropped, repeated or cut off at the end, and
+ *    a package cannot be replayed into another move, without failing.
+ *
+ * Wire format:
+ *
+ *   header : "CTMV" | version u8 | frameBytes u32 | ephemeralPublicKey[32]
+ *            | salt[32] | moveIdLength u8 | moveId
+ *   frame* : length u32 (ciphertext incl. 16-byte tag) | ciphertext
+ *
+ * The one-time key makes counter nonces safe: a (key, nonce) pair is never
+ * used twice. Both transforms are streaming — memory stays at one frame.
+ *
+ * @module services/team-move/team-move-crypto
+ */
+import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, } from 'node:crypto';
+import { Transform } from 'node:stream';
+import { TEAM_MOVE_CONSTANTS } from '../../constants.js';
+/** Magic bytes at the start of an encrypted package. */
+const MAGIC = Buffer.from('CTMV', 'ascii');
+/** Format version in the header. */
+const FORMAT_VERSION = 1;
+/** Length of the GCM tag. */
+const TAG_BYTES = 16;
+/** Length of an X25519 raw key. */
+const KEY_BYTES = 32;
+/** DER prefix of an X25519 SubjectPublicKeyInfo (the 32 key bytes follow). */
+const X25519_SPKI_PREFIX = Buffer.from('302a300506032b656e032100', 'hex');
+/** HKDF info prefix; the move id is appended. */
+const HKDF_INFO_PREFIX = 'crewly-team-move/v1|';
+/** Largest frame size a header may announce (guards memory). */
+const MAX_FRAME_BYTES = 16 * 1024 * 1024;
+/** Fixed part of the header, before the move id. */
+const FIXED_HEADER_BYTES = MAGIC.length + 1 + 4 + KEY_BYTES + KEY_BYTES + 1;
+/** Thrown when a package cannot be decrypted or has been altered. */
+export class TeamMoveCryptoError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'TeamMoveCryptoError';
+    }
+}
+/**
+ * Make the target's ephemeral key pair for one move.
+ *
+ * @returns Base64 public (raw) and private (PKCS8) keys
+ */
+export function generateTargetKeyPair() {
+    const { publicKey, privateKey } = generateKeyPairSync('x25519');
+    return {
+        publicKey: rawPublicKey(publicKey).toString('base64'),
+        privateKey: privateKey.export({ format: 'der', type: 'pkcs8' }).toString('base64'),
+    };
+}
+/**
+ * Raw 32 public-key bytes of a key object.
+ *
+ * @param key - Public or private X25519 key
+ * @returns The 32 raw bytes
+ */
+function rawPublicKey(key) {
+    const spki = (key.type === 'private' ? createPublicKey(key) : key).export({ format: 'der', type: 'spki' });
+    return Buffer.from(spki.subarray(spki.length - KEY_BYTES));
+}
+/**
+ * Import a raw X25519 public key.
+ *
+ * @param raw - 32 raw bytes
+ * @returns Key object
+ */
+function importPublicKey(raw) {
+    if (raw.length !== KEY_BYTES)
+        throw new TeamMoveCryptoError('public key must be 32 bytes');
+    return createPublicKey({ key: Buffer.concat([X25519_SPKI_PREFIX, raw]), format: 'der', type: 'spki' });
+}
+/**
+ * Whether a string is a base64 raw X25519 public key (as Cloud validates it).
+ *
+ * @param value - Candidate
+ * @returns True for 32 bytes of base64
+ */
+export function isPublicKeyString(value) {
+    return typeof value === 'string' && /^[A-Za-z0-9+/]{43}=$/.test(value) && Buffer.from(value, 'base64').length === KEY_BYTES;
+}
+/**
+ * One-time AES key for a package.
+ *
+ * @param privateKey - One side's X25519 private key
+ * @param peerPublic - The other side's X25519 public key
+ * @param salt - 32 random bytes from the header
+ * @param moveId - Move id (bound into the derivation)
+ * @returns 32-byte key
+ */
+function deriveKey(privateKey, peerPublic, salt, moveId) {
+    const shared = diffieHellman({ privateKey, publicKey: peerPublic });
+    return Buffer.from(hkdfSync('sha256', shared, salt, Buffer.from(HKDF_INFO_PREFIX + moveId, 'utf8'), 32));
+}
+/**
+ * Nonce of frame `counter`: 4 zero bytes + 8-byte big-endian counter.
+ *
+ * @param counter - Frame index
+ * @returns 12-byte nonce
+ */
+function nonceFor(counter) {
+    const nonce = Buffer.alloc(12);
+    nonce.writeBigUInt64BE(BigInt(counter), 4);
+    return nonce;
+}
+/**
+ * Authenticated data of a frame: header, frame index, final flag.
+ *
+ * @param header - Package header bytes
+ * @param counter - Frame index
+ * @param final - Whether this is the last frame
+ * @returns AAD bytes
+ */
+function aadFor(header, counter, final) {
+    const tail = Buffer.alloc(9);
+    tail.writeBigUInt64BE(BigInt(counter), 0);
+    tail.writeUInt8(final ? 1 : 0, 8);
+    return Buffer.concat([header, tail]);
+}
+/**
+ * Transform that encrypts a byte stream for the target of a move.
+ *
+ * @param options - Recipient key, move id, frame size
+ * @returns A Transform (plaintext in, package out)
+ * @throws TeamMoveCryptoError for an invalid recipient key or move id
+ */
+export function createEncryptStream(options) {
+    const frameBytes = options.frameBytes ?? TEAM_MOVE_CONSTANTS.CRYPTO_FRAME_BYTES;
+    if (!Number.isInteger(frameBytes) || frameBytes <= 0 || frameBytes > MAX_FRAME_BYTES) {
+        throw new TeamMoveCryptoError('invalid frame size');
+    }
+    const moveId = Buffer.from(options.moveId, 'utf8');
+    if (moveId.length === 0 || moveId.length > 255)
+        throw new TeamMoveCryptoError('invalid move id');
+    if (!isPublicKeyString(options.recipientPublicKey))
+        throw new TeamMoveCryptoError('invalid recipient public key');
+    const eph = generateKeyPairSync('x25519');
+    const salt = randomBytes(KEY_BYTES);
+    const key = deriveKey(eph.privateKey, importPublicKey(Buffer.from(options.recipientPublicKey, 'base64')), salt, options.moveId);
+    const fixed = Buffer.alloc(MAGIC.length + 1 + 4);
+    MAGIC.copy(fixed, 0);
+    fixed.writeUInt8(FORMAT_VERSION, MAGIC.length);
+    fixed.writeUInt32BE(frameBytes, MAGIC.length + 1);
+    const header = Buffer.concat([fixed, rawPublicKey(eph.publicKey), salt, Buffer.from([moveId.length]), moveId]);
+    let pending = [];
+    let pendingBytes = 0;
+    let counter = 0;
+    let headerSent = false;
+    const seal = (plain, final) => {
+        const cipher = createCipheriv('aes-256-gcm', key, nonceFor(counter), { authTagLength: TAG_BYTES });
+        cipher.setAAD(aadFor(header, counter, final));
+        const body = Buffer.concat([cipher.update(plain), cipher.final(), cipher.getAuthTag()]);
+        counter += 1;
+        const len = Buffer.alloc(4);
+        len.writeUInt32BE(body.length, 0);
+        return Buffer.concat([len, body]);
+    };
+    return new Transform({
+        transform(chunk, _encoding, callback) {
+            try {
+                if (!headerSent) {
+                    this.push(header);
+                    headerSent = true;
+                }
+                pending.push(chunk);
+                pendingBytes += chunk.length;
+                // Keep at least one byte back so the last frame can be sealed as final.
+                while (pendingBytes > frameBytes) {
+                    const all = Buffer.concat(pending);
+                    this.push(seal(all.subarray(0, frameBytes), false));
+                    const rest = all.subarray(frameBytes);
+                    pending = rest.length > 0 ? [rest] : [];
+                    pendingBytes = rest.length;
+                }
+                callback();
+            }
+            catch (error) {
+                callback(error);
+            }
+        },
+        flush(callback) {
+            try {
+                if (!headerSent) {
+                    this.push(header);
+                    headerSent = true;
+                }
+                this.push(seal(Buffer.concat(pending), true));
+                callback();
+            }
+            catch (error) {
+                callback(error);
+            }
+        },
+    });
+}
+/**
+ * Transform that decrypts a package on the target. Fails with
+ * {@link TeamMoveCryptoError} on any altered, truncated, reordered or
+ * foreign-move package.
+ *
+ * @param options - Target private key and expected move id
+ * @returns A Transform (package in, plaintext out)
+ */
+export function createDecryptStream(options) {
+    let privateKey;
+    try {
+        privateKey = createPrivateKey({ key: Buffer.from(options.privateKey, 'base64'), format: 'der', type: 'pkcs8' });
+    }
+    catch {
+        throw new TeamMoveCryptoError('invalid private key');
+    }
+    let buffer = Buffer.alloc(0);
+    let header = null;
+    let key = null;
+    let frameBytes = 0;
+    let counter = 0;
+    const open = (body, final) => {
+        if (!header || !key)
+            throw new TeamMoveCryptoError('package header missing');
+        if (body.length < TAG_BYTES)
+            throw new TeamMoveCryptoError('truncated frame');
+        const decipher = createDecipheriv('aes-256-gcm', key, nonceFor(counter), { authTagLength: TAG_BYTES });
+        decipher.setAAD(aadFor(header, counter, final));
+        decipher.setAuthTag(body.subarray(body.length - TAG_BYTES));
+        try {
+            const plain = Buffer.concat([decipher.update(body.subarray(0, body.length - TAG_BYTES)), decipher.final()]);
+            counter += 1;
+            return plain;
+        }
+        catch {
+            throw new TeamMoveCryptoError('package failed authentication (altered, truncated or not for this move)');
+        }
+    };
+    /** Parse the header once enough bytes are here; returns false when more are needed. */
+    const readHeader = () => {
+        if (buffer.length < FIXED_HEADER_BYTES)
+            return false;
+        if (!buffer.subarray(0, MAGIC.length).equals(MAGIC))
+            throw new TeamMoveCryptoError('not a team move package');
+        if (buffer.readUInt8(MAGIC.length) !== FORMAT_VERSION)
+            throw new TeamMoveCryptoError('unsupported package version');
+        const announced = buffer.readUInt32BE(MAGIC.length + 1);
+        if (announced <= 0 || announced > MAX_FRAME_BYTES)
+            throw new TeamMoveCryptoError('invalid frame size in package');
+        const idLength = buffer.readUInt8(FIXED_HEADER_BYTES - 1);
+        const total = FIXED_HEADER_BYTES + idLength;
+        if (buffer.length < total)
+            return false;
+        const moveId = buffer.subarray(FIXED_HEADER_BYTES, total).toString('utf8');
+        if (moveId !== options.moveId)
+            throw new TeamMoveCryptoError('package belongs to another move');
+        const ephPublic = buffer.subarray(MAGIC.length + 5, MAGIC.length + 5 + KEY_BYTES);
+        const salt = buffer.subarray(MAGIC.length + 5 + KEY_BYTES, MAGIC.length + 5 + 2 * KEY_BYTES);
+        header = Buffer.from(buffer.subarray(0, total));
+        key = deriveKey(privateKey, importPublicKey(Buffer.from(ephPublic)), Buffer.from(salt), moveId);
+        frameBytes = announced;
+        buffer = buffer.subarray(total);
+        return true;
+    };
+    /**
+     * Open every frame that is certainly not the last one: a frame is open-able
+     * once at least one more byte follows it.
+     */
+    const drain = (push) => {
+        for (;;) {
+            if (!header && !readHeader())
+                return;
+            if (buffer.length < 4)
+                return;
+            const length = buffer.readUInt32BE(0);
+            if (length < TAG_BYTES || length > frameBytes + TAG_BYTES)
+                throw new TeamMoveCryptoError('invalid frame length');
+            if (buffer.length < 4 + length + 1)
+                return; // need a byte beyond it to know it is not final
+            const body = buffer.subarray(4, 4 + length);
+            push(open(body, false));
+            buffer = buffer.subarray(4 + length);
+        }
+    };
+    return new Transform({
+        transform(chunk, _encoding, callback) {
+            try {
+                buffer = buffer.length === 0 ? chunk : Buffer.concat([buffer, chunk]);
+                drain((b) => this.push(b));
+                callback();
+            }
+            catch (error) {
+                callback(error);
+            }
+        },
+        flush(callback) {
+            try {
+                if (!header && !readHeader())
+                    throw new TeamMoveCryptoError('package is empty or truncated');
+                if (buffer.length < 4)
+                    throw new TeamMoveCryptoError('package is truncated');
+                const length = buffer.readUInt32BE(0);
+                if (length < TAG_BYTES || length > frameBytes + TAG_BYTES)
+                    throw new TeamMoveCryptoError('invalid frame length');
+                if (buffer.length !== 4 + length)
+                    throw new TeamMoveCryptoError('package is truncated or has trailing data');
+                this.push(open(buffer.subarray(4), true));
+                buffer = Buffer.alloc(0);
+                callback();
+            }
+            catch (error) {
+                callback(error);
+            }
+        },
+    });
+}
+/**
+ * Pass-through stream computing SHA-256 and size of its data.
+ *
+ * @returns The tap
+ */
+export function createHashTap() {
+    const hash = createHash('sha256');
+    let bytes = 0;
+    const tap = new Transform({
+        transform(chunk, _encoding, callback) {
+            hash.update(chunk);
+            bytes += chunk.length;
+            callback(null, chunk);
+        },
+    });
+    Object.defineProperty(tap, 'bytes', { get: () => bytes });
+    tap.digest = () => hash.digest('hex');
+    return tap;
+}
+//# sourceMappingURL=team-move-crypto.js.map

package/dist/backend/backend/src/services/team-move/team-move-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-move-crypto.js","sourceRoot":"","sources":["../../../../../../backend/src/services/team-move/team-move-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,QAAQ,EACR,WAAW,GAEZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAA0B,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,wDAAwD;AACxD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC3C,oCAAoC;AACpC,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,6BAA6B;AAC7B,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,mCAAmC;AACnC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAC1E,iDAAiD;AACjD,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAChD,gEAAgE;AAChE,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACzC,oDAAoD;AACpD,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC;AAU5E,qEAAqE;AACrE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChE,OAAO;QACL,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACrD,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACnF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,GAAc;IAClC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3G,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,CAAC,CAAC;IAC3F,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACzG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;AAC9H,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,UAAqB,EAAE,UAAqB,EAAE,IAAY,EAAE,MAAc;IAC3F,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,GAAG,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,OAAe;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,MAAM,CAAC,MAAc,EAAE,OAAe,EAAE,KAAc;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AACvC,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC,kBAAkB,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;QACrF,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IACjG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAAE,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,CAAC,CAAC;IAElH,MAAM,GAAG,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhI,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrB,KAAK,CAAC,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/C,KAAK,CAAC,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAE/G,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,KAAc,EAAU,EAAE;QACrD,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;QACnG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC,CAAC;QACb,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,QAA2B;YAC7D,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAClB,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpB,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC7B,wEAAwE;gBACxE,OAAO,YAAY,GAAG,UAAU,EAAE,CAAC;oBACjC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBACnC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;oBACpD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;oBACtC,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxC,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC7B,CAAC;gBACD,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,KAAc,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,QAA2B;YAC/B,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAClB,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC9C,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,KAAc,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAUD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,IAAI,UAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,UAAU,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAClH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,KAAc,EAAU,EAAE;QACpD,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS;YAAE,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;QACvG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAChD,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC5G,OAAO,IAAI,CAAC,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,mBAAmB,CAAC,yEAAyE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC,CAAC;IAEF,uFAAuF;IACvF,MAAM,UAAU,GAAG,GAAY,EAAE;QAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,kBAAkB;YAAE,OAAO,KAAK,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;QAC9G,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,cAAc;YAAE,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,CAAC,CAAC;QACpH,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACxD,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,GAAG,eAAe;YAAE,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAC;QAClH,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,kBAAkB,GAAG,QAAQ,CAAC;QAC5C,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK;YAAE,OAAO,KAAK,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3E,IAAI,MAAM,KAAK,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,CAAC,CAAC;QAChG,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,SAAS,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;QAC7F,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QAChD,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAChG,UAAU,GAAG,SAAS,CAAC;QACvB,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF;;;OAGG;IACH,MAAM,KAAK,GAAG,CAAC,IAAyB,EAAQ,EAAE;QAChD,SAAS,CAAC;YACR,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE;gBAAE,OAAO;YACrC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO;YAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,MAAM,GAAG,SAAS,IAAI,MAAM,GAAG,UAAU,GAAG,SAAS;gBAAE,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;YACjH,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,gDAAgD;YAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YACxB,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,QAA2B;YAC7D,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;gBACtE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3B,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,KAAc,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,QAA2B;YAC/B,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE;oBAAE,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAC;gBAC7F,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;gBAC7E,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBACtC,IAAI,MAAM,GAAG,SAAS,IAAI,MAAM,GAAG,UAAU,GAAG,SAAS;oBAAE,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;gBACjH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,MAAM;oBAAE,MAAM,IAAI,mBAAmB,CAAC,2CAA2C,CAAC,CAAC;gBAC7G,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC1C,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,KAAc,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;QACxB,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,QAA2B;YAC7D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnB,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;KACF,CAAY,CAAC;IACd,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1D,GAAG,CAAC,MAAM,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/backend/backend/src/services/team-move/team-move-driver.service.d.ts

@@ -0,0 +1,209 @@
+/**
+ * Team move driver — the machine side of the Cloud protocol.
+ *
+ * Cloud tells a machine what to do with a `team_move` relay push
+ * (`{moveId, role, action}`); the push is only a hint, the driver fetches the
+ * move from Cloud and acts on what Cloud says. The same list is read at boot
+ * and every few minutes, so a machine that was offline when the push went out
+ * picks the move up when it returns. Every action is idempotent (journaled
+ * steps, resumable upload/download), so a repeated push or a restart in the
+ * middle is harmless.
+ *
+ *   target  prepare       -> make the per-move key, preflight, publish the key
+ *   source  package       -> collect, scan, encrypt, upload
+ *   target  import        -> download, decrypt, import, start, report `imported`
+ *   source  stop_archive  -> stop the team, archive it, report `source_stopped`
+ *   either  rollback      -> source: restore + start (`source_restored`);
+ *                            target: stop + archive its copy (`target_stopped`).
+ *                            Also "abort and clean up" after a failure.
+ *
+ * Starting the driver advertises the `teamMove:1` capability to Cloud.
+ *
+ * @module services/team-move/team-move-driver.service
+ */
+import { type ComponentLogger } from '../core/logger.service.js';
+import type { IncomingMessage } from './../cloud/cloud-sync.types.js';
+import { TeamMoveArchiver } from './team-move-archive.js';
+import { TeamMoveCloudClient } from './team-move-cloud.client.js';
+import { TeamMoveExporter } from './team-move-exporter.js';
+import { TeamMoveImporter } from './team-move-importer.js';
+import type { PackageRepo, TeamMovePreflight, TeamMoveRelayData, TeamMoveView } from './team-move.types.js';
+/**
+ * Install the process-wide driver (composition root).
+ *
+ * @param driver - The driver or null
+ */
+export declare function setTeamMoveDriver(driver: TeamMoveDriver | null): void;
+/**
+ * The process-wide driver, or null before boot wired it.
+ *
+ * @returns The driver or null
+ */
+export declare function getTeamMoveDriver(): TeamMoveDriver | null;
+/**
+ * Whether the driver runs on this machine.
+ *
+ * @returns True once started
+ */
+export declare function isTeamMoveDriverActive(): boolean;
+/**
+ * Capabilities to advertise to Cloud (heartbeat).
+ *
+ * @returns `['teamMove:1']` while the driver runs, else `[]`
+ */
+export declare function teamMoveCapabilities(): string[];
+/** Emitter of relay messages (CloudSyncService). */
+export interface TeamMoveRelaySource {
+    on(event: 'message', listener: (msg: IncomingMessage) => void): unknown;
+    off(event: 'message', listener: (msg: IncomingMessage) => void): unknown;
+}
+/** Collaborators of the driver. */
+export interface TeamMoveDriverDeps {
+    home?: string;
+    cloud: TeamMoveCloudClient;
+    source: TeamMoveRelaySource;
+    identity: () => Promise<{
+        instanceId: string;
+        deviceName: string;
+    }>;
+    exporter: TeamMoveExporter;
+    /** Built per import so each uses the current services. */
+    importer: () => TeamMoveImporter;
+    archiver: TeamMoveArchiver;
+    preflight: (requiredTools?: readonly string[]) => Promise<TeamMovePreflight>;
+    /** True when no member of the team is working. */
+    isTeamIdle: (teamId: string) => Promise<boolean>;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => string;
+    logger?: ComponentLogger;
+}
+/** The driver. */
+export declare class TeamMoveDriver {
+    private readonly deps;
+    private readonly logger;
+    private readonly home;
+    private readonly sleep;
+    private readonly now;
+    private readonly inFlight;
+    private readonly listener;
+    private pollTimer;
+    private bootTimer;
+    private started;
+    constructor(deps: TeamMoveDriverDeps);
+    /** Listen for pushes, resume pending moves, advertise the capability. Idempotent. */
+    start(): void;
+    /** Stop listening; the capability is no longer advertised. */
+    stop(): void;
+    /**
+     * Handle one relay message. Anything but a well-formed `team_move` is ignored.
+     *
+     * @param msg - Relay message
+     * @returns True when it was a team move push that started work
+     */
+    handleRelay(msg: IncomingMessage): Promise<boolean>;
+    /** Read this machine's pending moves from Cloud and act on each. */
+    poll(): Promise<number>;
+    /** Run one action (one at a time per move and action). */
+    private dispatch;
+    private execute;
+    private prepare;
+    private packageAndUpload;
+    private waitForIdle;
+    private importPackage;
+    private stopArchive;
+    private rollback;
+    /**
+     * Ask Cloud to move a team from this machine to another.
+     *
+     * @param input - Team, target machine, flags
+     * @returns The new move id
+     * @throws TeamMoveBlockedError when a repository holds unpushed work (unless allowed)
+     */
+    startMove(input: {
+        teamId: string;
+        targetInstanceId: string;
+        allowDirty?: boolean;
+        skipFlagged?: boolean;
+    }): Promise<{
+        moveId: string;
+    }>;
+    /**
+     * What would stop a move of a team: repositories with unpushed or uncommitted work.
+     *
+     * @param teamId - Team id
+     * @returns Repo states and the blocking lines
+     */
+    checkRepos(teamId: string): Promise<{
+        repos: PackageRepo[];
+        blocking: string[];
+    }>;
+    /**
+     * Dry run: build the package here exactly as a move would, encrypt it with a
+     * throwaway key to measure it, and report. Nothing is sent anywhere.
+     *
+     * @param input - Team and a scratch directory
+     * @returns Manifest highlights and sizes
+     */
+    preview(input: {
+        teamId: string;
+        stagingDir: string;
+        allowDirty?: boolean;
+        skipFlagged?: boolean;
+    }): Promise<Record<string, unknown>>;
+    /**
+     * Moves known to Cloud plus what this machine remembers of each.
+     *
+     * @returns Moves, newest first
+     */
+    listMoves(): Promise<Array<TeamMoveView & {
+        local?: {
+            phase: string;
+            action: string | null;
+            error?: string;
+        };
+    }>>;
+    /**
+     * One move with its local progress.
+     *
+     * @param moveId - Move id
+     * @returns Cloud's view plus the local journal
+     */
+    getMove(moveId: string): Promise<{
+        move: TeamMoveView;
+        journal: Array<{
+            step: string;
+            state: string;
+            at: string;
+        }>;
+    }>;
+    /**
+     * Owner rollback.
+     *
+     * @param moveId - Move id
+     */
+    rollbackMove(moveId: string): Promise<void>;
+    /**
+     * Housekeeping at boot and daily: purge expired archives.
+     *
+     * @returns Purged move ids
+     */
+    housekeeping(): Promise<string[]>;
+    private readIntent;
+    /** Tell Cloud an action failed, with text the owner can act on. */
+    private reportFailure;
+}
+/**
+ * Turn an error into the sentence the owner sees.
+ *
+ * @param error - Thrown value
+ * @returns Message
+ */
+export declare function friendlyError(error: unknown): string;
+/**
+ * Parse the data of a `team_move` push.
+ *
+ * @param payload - Relay payload
+ * @returns Parsed data, or null when malformed
+ */
+export declare function parseRelayData(payload: unknown): TeamMoveRelayData | null;
+//# sourceMappingURL=team-move-driver.service.d.ts.map

package/dist/backend/backend/src/services/team-move/team-move-driver.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-move-driver.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/team-move/team-move-driver.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAsB,MAAM,6BAA6B,CAAC;AAEtF,OAAO,EAAwB,gBAAgB,EAAyB,MAAM,yBAAyB,CAAC;AACxG,OAAO,EAAuB,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAIhF,OAAO,KAAK,EAAE,WAAW,EAAkB,iBAAiB,EAAE,iBAAiB,EAAgB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAc1I;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,GAAG,IAAI,CAErE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,EAAE,CAE/C;AAED,oDAAoD;AACpD,MAAM,WAAW,mBAAmB;IAClC,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC;IACxE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC;CAC1E;AAED,mCAAmC;AACnC,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,mBAAmB,CAAC;IAC3B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,QAAQ,EAAE,MAAM,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpE,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,gBAAgB,CAAC;IACjC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,SAAS,EAAE,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC7E,kDAAkD;IAClD,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAQD,kBAAkB;AAClB,qBAAa,cAAc;IAab,OAAO,CAAC,QAAQ,CAAC,IAAI;IAZjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAEvB;IACF,OAAO,CAAC,SAAS,CAA+C;IAChE,OAAO,CAAC,SAAS,CAA8C;IAC/D,OAAO,CAAC,OAAO,CAAS;gBAEK,IAAI,EAAE,kBAAkB;IAOrD,qFAAqF;IACrF,KAAK,IAAI,IAAI;IAYb,8DAA8D;IAC9D,IAAI,IAAI,IAAI;IAWZ;;;;;OAKG;IACG,WAAW,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBzD,oEAAoE;IAC9D,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;IAkB7B,0DAA0D;IAC1D,OAAO,CAAC,QAAQ;YAaF,OAAO;YAsBP,OAAO;YAgBP,gBAAgB;YA6ChB,WAAW;YAaX,aAAa;YA+Bb,WAAW;YAKX,QAAQ;IAgBtB;;;;;;OAMG;IACG,SAAS,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAa9I;;;;;OAKG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAIvF;;;;;;OAMG;IACG,OAAO,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IA2B3I;;;;OAIG;IACG,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,GAAG;QAAE,KAAK,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IAUtH;;;;;OAKG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAM3H;;;;OAIG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKjD;;;;OAIG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAQzB,UAAU;IAUxB,mEAAmE;YACrD,aAAa;CAU5B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGpD;AAiBD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,iBAAiB,GAAG,IAAI,CAQzE"}