ftown 0.19.52 → 0.19.54

package/dist/security/crypto.js

@@ -0,0 +1,280 @@
+import { Aes256Gcm, CipherSuite, DhkemP256HkdfSha256, HkdfSha256 } from '@hpke/core';
+/** Wire limits apply to serialized UTF-8, including headers and base64 expansion. */
+export const MAX_ENVELOPE_BYTES = 450_000;
+const MAX_RECIPIENTS = 100;
+const encoder = new TextEncoder();
+const domain = encoder.encode('ftown/e2ee/v1');
+const kinds = ['bridge', 'browser', 'mcp', 'local-cli'];
+const purposes = ['application', 'hello', 'welcome', 'enroll', 'enrolled', 'mcp-approval'];
+const fields = [
+    'type', 'version', 'senderId', 'recipientId', 'ownerId', 'bridgeId', 'channel',
+    'purpose', 'messageId', 'createdAt', 'expiresAt', 'receiverEpoch', 'enc', 'ciphertext',
+];
+const suite = new CipherSuite({
+    kem: new DhkemP256HkdfSha256(), kdf: new HkdfSha256(), aead: new Aes256Gcm(),
+});
+/** A safe, stable error: underlying crypto/input details never cross this boundary. */
+export class SecurityError extends Error {
+    code;
+    retryable;
+    constructor(code, message, retryable = false) {
+        super(message);
+        this.code = code;
+        this.retryable = retryable;
+        this.name = 'SecurityError';
+    }
+}
+const invalid = () => { throw new SecurityError('invalid_envelope', 'Invalid encrypted packet'); };
+const wrongContext = () => { throw new SecurityError('wrong_context', 'Encrypted packet targets a different context'); };
+function subtle() {
+    if (!globalThis.crypto?.subtle)
+        throw new SecurityError('secure_context_required', 'Encryption requires HTTPS or trustworthy localhost');
+    return globalThis.crypto.subtle;
+}
+function object(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function exact(value, keys) {
+    if (Object.keys(value).length !== keys.length || Object.keys(value).some(key => !keys.includes(key)))
+        invalid();
+}
+function token(value, max = 200) {
+    return typeof value === 'string' && value.length > 0 && value.length <= max && /^[A-Za-z0-9_-]+$/.test(value);
+}
+function owner(value) {
+    return typeof value === 'string' && (/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value)
+        || /^solo:[A-Za-z0-9_-]{1,200}$/.test(value));
+}
+function base64(bytes) {
+    let binary = '';
+    for (let offset = 0; offset < bytes.length; offset += 16_384) {
+        binary += String.fromCharCode(...bytes.subarray(offset, offset + 16_384));
+    }
+    return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
+}
+function bytes(value, min, max = min) {
+    if (typeof value !== 'string' || value.length > Math.ceil(max * 4 / 3) || !/^[A-Za-z0-9_-]+$/.test(value))
+        return invalid();
+    let binary;
+    try {
+        binary = atob(value.replaceAll('-', '+').replaceAll('_', '/'));
+    }
+    catch {
+        return invalid();
+    }
+    if (binary.length < min || binary.length > max)
+        return invalid();
+    const result = Uint8Array.from(binary, character => character.charCodeAt(0));
+    if (base64(result) !== value)
+        return invalid();
+    return result;
+}
+function fingerprintSyntax(value) {
+    if (typeof value !== 'string' || value.length !== 43)
+        return false;
+    try {
+        bytes(value, 32);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function header(value) {
+    if (!object(value))
+        return invalid();
+    if (value.type !== 'ftown_encrypted' || value.version !== 1
+        || !fingerprintSyntax(value.senderId) || !fingerprintSyntax(value.recipientId)
+        || !owner(value.ownerId) || !token(value.bridgeId)
+        || typeof value.channel !== 'string' || !/^[\x21-\x7e]{1,512}$/.test(value.channel)
+        || typeof value.purpose !== 'string' || !purposes.some(purpose => purpose === value.purpose)
+        || !token(value.messageId, 128) || !Number.isSafeInteger(value.createdAt) || !Number.isSafeInteger(value.expiresAt)
+        || typeof value.createdAt !== 'number' || typeof value.expiresAt !== 'number'
+        || value.createdAt < 0 || value.expiresAt <= value.createdAt
+        || (value.receiverEpoch !== null && !token(value.receiverEpoch, 128)))
+        return invalid();
+    // Avoid coercing untrusted values or retaining attacker-owned objects.
+    const purpose = purposes.find(candidate => candidate === value.purpose);
+    if (!purpose)
+        return invalid();
+    return {
+        type: 'ftown_encrypted', version: 1, senderId: value.senderId, recipientId: value.recipientId,
+        ownerId: value.ownerId, bridgeId: value.bridgeId, channel: value.channel, purpose,
+        messageId: value.messageId, createdAt: value.createdAt, expiresAt: value.expiresAt,
+        receiverEpoch: value.receiverEpoch,
+    };
+}
+/** One ordered tuple; property insertion order on received objects is irrelevant. */
+function aad(value) {
+    return encoder.encode(JSON.stringify([
+        'ftown/e2ee/v1', value.type, value.version, value.senderId, value.recipientId,
+        value.ownerId, value.bridgeId, value.channel, value.purpose, value.messageId,
+        value.createdAt, value.expiresAt, value.receiverEpoch,
+    ]));
+}
+function serializedSize(value) {
+    try {
+        return encoder.encode(JSON.stringify(value)).byteLength;
+    }
+    catch {
+        return invalid();
+    }
+}
+export function parseSecureEnvelope(value) {
+    if (!object(value))
+        return invalid();
+    exact(value, fields);
+    const parsed = header(value);
+    // Reject oversized strings before decoding/allocating their binary contents.
+    const enc = bytes(value.enc, 65);
+    if (enc[0] !== 4)
+        return invalid();
+    bytes(value.ciphertext, 16, MAX_ENVELOPE_BYTES);
+    if (serializedSize(value) > MAX_ENVELOPE_BYTES || typeof value.enc !== 'string' || typeof value.ciphertext !== 'string')
+        return invalid();
+    return { ...parsed, enc: value.enc, ciphertext: value.ciphertext };
+}
+export function parseSecurePublication(value) {
+    if (!object(value))
+        return invalid();
+    exact(value, ['type', 'version', 'envelopes']);
+    if (value.type !== 'ftown_encrypted_batch' || value.version !== 1 || !Array.isArray(value.envelopes)
+        || value.envelopes.length < 1 || value.envelopes.length > MAX_RECIPIENTS
+        || serializedSize(value) > MAX_ENVELOPE_BYTES)
+        return invalid();
+    return { type: 'ftown_encrypted_batch', version: 1, envelopes: value.envelopes.map(parseSecureEnvelope) };
+}
+export async function exportPublicKey(key) {
+    try {
+        if (key.type !== 'public' || key.algorithm.name !== 'ECDH' || !('namedCurve' in key.algorithm) || key.algorithm.namedCurve !== 'P-256')
+            return invalid();
+        const raw = new Uint8Array(await subtle().exportKey('raw', key));
+        if (raw.length !== 65 || raw[0] !== 4)
+            return invalid();
+        return base64(raw);
+    }
+    catch (error) {
+        if (error instanceof SecurityError)
+            throw error;
+        throw new SecurityError('key_unavailable', 'Encryption public key is unavailable');
+    }
+}
+export async function importPublicKey(raw) {
+    const decoded = bytes(raw, 65);
+    if (decoded[0] !== 4)
+        return invalid();
+    try {
+        return await subtle().importKey('raw', decoded, { name: 'ECDH', namedCurve: 'P-256' }, true, []);
+    }
+    catch (error) {
+        if (error instanceof SecurityError)
+            throw error;
+        return invalid();
+    }
+}
+async function endpointKey(endpoint) {
+    if (!object(endpoint))
+        return invalid();
+    exact(endpoint, ['version', 'id', 'ownerId', 'kind', 'publicKey']);
+    if (endpoint.version !== 1 || !owner(endpoint.ownerId) || !kinds.includes(endpoint.kind) || !fingerprintSyntax(endpoint.id))
+        return invalid();
+    const raw = bytes(endpoint.publicKey, 65);
+    const digest = base64(new Uint8Array(await subtle().digest('SHA-256', raw)));
+    if (digest !== endpoint.id)
+        return invalid();
+    return importPublicKey(endpoint.publicKey);
+}
+async function validateIdentity(identity) {
+    await endpointKey(identity.endpoint);
+    if (await exportPublicKey(identity.keyPair.publicKey) !== identity.endpoint.publicKey
+        || identity.keyPair.privateKey.type !== 'private' || identity.keyPair.privateKey.algorithm.name !== 'ECDH'
+        || !('namedCurve' in identity.keyPair.privateKey.algorithm) || identity.keyPair.privateKey.algorithm.namedCurve !== 'P-256'
+        || !identity.keyPair.privateKey.usages.includes('deriveBits'))
+        return invalid();
+}
+export async function generateEndpoint(ownerId, kind, extractable = false) {
+    if (!owner(ownerId) || !kinds.includes(kind))
+        return invalid();
+    try {
+        const keyPair = await subtle().generateKey({ name: 'ECDH', namedCurve: 'P-256' }, extractable, ['deriveBits']);
+        const publicKey = await exportPublicKey(keyPair.publicKey);
+        const id = base64(new Uint8Array(await subtle().digest('SHA-256', bytes(publicKey, 65))));
+        return { endpoint: { version: 1, id, ownerId, kind, publicKey }, keyPair };
+    }
+    catch (error) {
+        if (error instanceof SecurityError)
+            throw error;
+        throw new SecurityError('key_unavailable', 'Encryption identity could not be created');
+    }
+}
+export async function importEndpoint(endpoint, privateKey, extractable = false) {
+    const publicKey = await endpointKey(endpoint);
+    try {
+        // Check the JWK's public coordinates against the independently pinned point.
+        const publicJwk = await subtle().exportKey('jwk', publicKey);
+        if (privateKey.kty !== 'EC' || privateKey.crv !== 'P-256' || !privateKey.d
+            || privateKey.x !== publicJwk.x || privateKey.y !== publicJwk.y)
+            return invalid();
+        const imported = await subtle().importKey('jwk', privateKey, { name: 'ECDH', namedCurve: 'P-256' }, extractable, ['deriveBits']);
+        const identity = { endpoint: { ...endpoint }, keyPair: { publicKey, privateKey: imported } };
+        // WebCrypto imports may trust supplied public coordinates. Prove private/public correspondence.
+        const challenge = await subtle().generateKey({ name: 'ECDH', namedCurve: 'P-256' }, false, ['deriveBits']);
+        const left = new Uint8Array(await subtle().deriveBits({ name: 'ECDH', public: challenge.publicKey }, imported, 256));
+        const right = new Uint8Array(await subtle().deriveBits({ name: 'ECDH', public: publicKey }, challenge.privateKey, 256));
+        let difference = 0;
+        for (let index = 0; index < left.length; index++)
+            difference |= left[index] ^ right[index];
+        if (difference !== 0)
+            return invalid();
+        return identity;
+    }
+    catch (error) {
+        if (error instanceof SecurityError)
+            throw error;
+        throw new SecurityError('key_unavailable', 'Encryption identity could not be loaded');
+    }
+}
+function contextMatches(value, expected) {
+    if (value.ownerId !== expected.ownerId || value.bridgeId !== expected.bridgeId || value.channel !== expected.channel
+        || value.recipientId !== expected.recipientId || value.purpose !== expected.purpose)
+        return wrongContext();
+}
+export async function seal(identity, recipient, input, plaintext) {
+    const parsed = header(input);
+    await validateIdentity(identity);
+    const recipientPublicKey = await endpointKey(recipient);
+    if (parsed.senderId !== identity.endpoint.id || parsed.recipientId !== recipient.id
+        || parsed.ownerId !== identity.endpoint.ownerId || parsed.ownerId !== recipient.ownerId)
+        return wrongContext();
+    // Base64 expands the AEAD tag and plaintext; account for exact header overhead before encrypting.
+    const overhead = serializedSize({ ...parsed, enc: 'A'.repeat(87), ciphertext: '' });
+    if (overhead + Math.ceil((plaintext.byteLength + 16) * 4 / 3) > MAX_ENVELOPE_BYTES)
+        throw new SecurityError('capacity_exceeded', 'Encrypted packet exceeds the transport limit');
+    try {
+        const sender = await suite.createSenderContext({ recipientPublicKey, senderKey: identity.keyPair, info: domain });
+        const ciphertext = await sender.seal(plaintext, aad(parsed));
+        return parseSecureEnvelope({ ...parsed, enc: base64(new Uint8Array(sender.enc)), ciphertext: base64(new Uint8Array(ciphertext)) });
+    }
+    catch (error) {
+        if (error instanceof SecurityError)
+            throw error;
+        throw new SecurityError('authentication_failed', 'Encrypted packet could not be sealed');
+    }
+}
+export async function open(identity, sender, value, expected) {
+    const envelope = parseSecureEnvelope(value);
+    contextMatches(envelope, expected);
+    await validateIdentity(identity);
+    const senderPublicKey = await endpointKey(sender);
+    if (envelope.recipientId !== identity.endpoint.id || envelope.senderId !== sender.id
+        || envelope.ownerId !== identity.endpoint.ownerId || envelope.ownerId !== sender.ownerId)
+        return wrongContext();
+    try {
+        const recipient = await suite.createRecipientContext({ recipientKey: identity.keyPair, senderPublicKey, enc: bytes(envelope.enc, 65), info: domain });
+        return new Uint8Array(await recipient.open(bytes(envelope.ciphertext, 16, MAX_ENVELOPE_BYTES), aad(envelope)));
+    }
+    catch {
+        throw new SecurityError('authentication_failed', 'Encrypted packet authentication failed');
+    }
+}
+//# sourceMappingURL=crypto.js.map

package/dist/security/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/security/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAMrF,qFAAqF;AACrF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;AAC/C,MAAM,KAAK,GAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;AACjF,MAAM,QAAQ,GAA+B,CAAC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;AACvH,MAAM,MAAM,GAAG;IACb,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS;IAC9E,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY;CACvF,CAAC;AACF,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC;IAC5B,GAAG,EAAE,IAAI,mBAAmB,EAAE,EAAE,GAAG,EAAE,IAAI,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE;CAC7E,CAAC,CAAC;AAEH,uFAAuF;AACvF,MAAM,OAAO,aAAc,SAAQ,KAAK;IACjB;IAAmD;IAAxE,YAAqB,IAAuB,EAAE,OAAe,EAAW,YAAY,KAAK;QACvF,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAAmB;QAA4B,cAAS,GAAT,SAAS,CAAQ;QAEvF,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AACD,MAAM,OAAO,GAAG,GAAU,EAAE,GAAG,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1G,MAAM,YAAY,GAAG,GAAU,EAAE,GAAG,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,8CAA8C,CAAC,CAAC,CAAC,CAAC,CAAC;AAChI,SAAS,MAAM;IACb,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,oDAAoD,CAAC,CAAC;IACzI,OAAO,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;AAClC,CAAC;AACD,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AACD,SAAS,KAAK,CAAC,KAA8B,EAAE,IAAuB;IACpE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;AAClH,CAAC;AACD,SAAS,KAAK,CAAC,KAAc,EAAE,GAAG,GAAG,GAAG;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChH,CAAC;AACD,SAAS,KAAK,CAAC,KAAc;IAC3B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,iEAAiE,CAAC,IAAI,CAAC,KAAK,CAAC;WAC7G,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAClD,CAAC;AACD,SAAS,MAAM,CAAC,KAAiB;IAC/B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACnF,CAAC;AACD,SAAS,KAAK,CAAC,KAAc,EAAE,GAAW,EAAE,GAAG,GAAG,GAAG;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,EAAE,CAAC;IAC5H,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,OAAO,EAAE,CAAC;IAAC,CAAC;IACnG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IACjE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK;QAAE,OAAO,OAAO,EAAE,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,CAAC;QAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAChE,CAAC;AACD,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC;WACtD,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC;WAC3E,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;WAC/C,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;WAChF,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC;WACzF,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;WAChH,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;WAC1E,KAAK,CAAC,SAAS,GAAG,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS;WACzD,CAAC,KAAK,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO,OAAO,EAAE,CAAC;IAC1F,uEAAuE;IACvE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,EAAE,CAAC;IAC/B,OAAO;QACL,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC7F,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO;QACjF,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;QAClF,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAC;AACJ,CAAC;AACD,qFAAqF;AACrF,SAAS,GAAG,CAAC,KAAqB;IAChC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACnC,eAAe,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW;QAC7E,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS;QAC5E,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa;KACtD,CAAC,CAAC,CAAC;AACN,CAAC;AACD,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC;QAAC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,OAAO,EAAE,CAAC;IAAC,CAAC;AAC9F,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,EAAE,CAAC;IACrC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,6EAA6E;IAC7E,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,EAAE,CAAC;IACnC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAChD,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,kBAAkB,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,OAAO,EAAE,CAAC;IAC1I,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;AACrE,CAAC;AACD,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,EAAE,CAAC;IACrC,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;WAC/F,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,cAAc;WACrE,cAAc,CAAC,KAAK,CAAC,GAAG,kBAAkB;QAAE,OAAO,OAAO,EAAE,CAAC;IAClE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAC5G,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAc;IAClD,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,YAAY,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,UAAU,KAAK,OAAO;YAAE,OAAO,OAAO,EAAE,CAAC;QACzJ,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,EAAE,CAAC;QACxD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,aAAa;YAAE,MAAM,KAAK,CAAC;QAChD,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,sCAAsC,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,EAAE,CAAC;IACvC,IAAI,CAAC;QAAC,OAAO,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAAC,CAAC;IACzG,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,aAAa;YAAE,MAAM,KAAK,CAAC;QAChD,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AACD,KAAK,UAAU,WAAW,CAAC,QAAwB;IACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,EAAE,CAAC;IACxC,KAAK,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,OAAO,EAAE,CAAC;IAC9I,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,MAAM,KAAK,QAAQ,CAAC,EAAE;QAAE,OAAO,OAAO,EAAE,CAAC;IAC7C,OAAO,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC;AACD,KAAK,UAAU,gBAAgB,CAAC,QAA0B;IACxD,MAAM,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,MAAM,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,SAAS;WAChF,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM;WACvG,CAAC,CAAC,YAAY,IAAI,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,KAAK,OAAO;WACxH,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,OAAO,EAAE,CAAC;AACpF,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe,EAAE,IAAkB,EAAE,WAAW,GAAG,KAAK;IAC7F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,EAAE,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAC/G,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1F,OAAO,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,aAAa;YAAE,MAAM,KAAK,CAAC;QAChD,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,0CAA0C,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAwB,EAAE,UAAsB,EAAE,WAAW,GAAG,KAAK;IACxG,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,6EAA6E;QAC7E,MAAM,SAAS,GAAG,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,UAAU,CAAC,GAAG,KAAK,IAAI,IAAI,UAAU,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;eACrE,UAAU,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;YAAE,OAAO,OAAO,EAAE,CAAC;QACpF,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QACjI,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC7F,gGAAgG;QAChG,MAAM,SAAS,GAAG,MAAM,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3G,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QACrH,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;QACxH,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE;YAAE,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3F,IAAI,UAAU,KAAK,CAAC;YAAE,OAAO,OAAO,EAAE,CAAC;QACvC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,aAAa;YAAE,MAAM,KAAK,CAAC;QAChD,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AACD,SAAS,cAAc,CAAC,KAAqB,EAAE,QAAqB;IAClE,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;WAC/G,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;QAAE,OAAO,YAAY,EAAE,CAAC;AAC/G,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,QAA0B,EAAE,SAAyB,EAAE,KAAqB,EAAE,SAAqB;IAC5H,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,kBAAkB,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,EAAE;WAC9E,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,QAAQ,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;QAAE,OAAO,YAAY,EAAE,CAAC;IACjH,kGAAkG;IAClG,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IACpF,IAAI,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,kBAAkB;QAAE,MAAM,IAAI,aAAa,CAAC,mBAAmB,EAAE,8CAA8C,CAAC,CAAC;IACjL,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAClH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7D,OAAO,mBAAmB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;IACrI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,aAAa;YAAE,MAAM,KAAK,CAAC;QAChD,MAAM,IAAI,aAAa,CAAC,uBAAuB,EAAE,sCAAsC,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,QAA0B,EAAE,MAAsB,EAAE,KAAqB,EAAE,QAAqB;IACzH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC5C,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnC,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE;WAC/E,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAAE,OAAO,YAAY,EAAE,CAAC;IAClH,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACtJ,OAAO,IAAI,UAAU,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,uBAAuB,EAAE,wCAAwC,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC"}