instar 0.28.52 → 0.28.53

package/dist/core/WorktreeKeyVault.js

@@ -0,0 +1,242 @@
+/**
+ * WorktreeKeyVault — Ed25519 + HMAC key storage for parallel-dev isolation.
+ *
+ * Per PARALLEL-DEV-ISOLATION-SPEC.md "Key management (iter 4)" + K1 (iter-4
+ * adversarial finding: Ed25519 private-key extraction via flat-file fallback).
+ *
+ * Storage strategy:
+ *   1. macOS — Keychain Services via `security` CLI.
+ *   2. Linux — libsecret via `secret-tool` CLI when available.
+ *   3. Windows — Credential Manager via `cmdkey`/`Get-Credential` (best-effort).
+ *   4. Headless fallback — flat file at `<stateDir>/local-state/keys.enc`,
+ *      AES-GCM encrypted with key derived from user passphrase via Argon2id-style
+ *      scrypt KDF (Node has scrypt built-in; Argon2id would require a dep).
+ *      File is chmod 0600.
+ *
+ * K1: passphrase REQUIRED in headless mode. Caller can pass `headless.allowed=true`
+ * with a passphrase resolver (env var, prompt, etc.); otherwise headless = error.
+ */
+import crypto from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+const SECURE_FILE_MODE = 0o600;
+const SCRYPT_PARAMS = { N: 1 << 16, r: 8, p: 1 }; // ~64MB, ~250ms
+const SCRYPT_KEY_LEN = 32;
+const KEYCHAIN_SERVICE = 'instar.parallel-dev';
+const KEYCHAIN_ITEM_HMAC = 'hmac-key';
+const KEYCHAIN_ITEM_SIGNING_PRIV = 'signing-private';
+const KEYCHAIN_ITEM_SIGNING_PUB = 'signing-public';
+const KEYCHAIN_ITEM_MACHINE_ID = 'machine-id';
+const KEYCHAIN_ITEM_KEY_VERSION = 'key-version';
+// ── Backend probes ───────────────────────────────────────────────────
+function macOsKeychainAvailable() {
+    if (process.platform !== 'darwin')
+        return false;
+    try {
+        execFileSync('security', ['list-keychains', '-d', 'user'], { stdio: 'pipe', timeout: 2000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function linuxLibsecretAvailable() {
+    if (process.platform !== 'linux')
+        return false;
+    try {
+        execFileSync('secret-tool', ['--version'], { stdio: 'pipe', timeout: 2000 });
+        return !!process.env.DBUS_SESSION_BUS_ADDRESS;
+    }
+    catch {
+        return false;
+    }
+}
+// ── Backend impls ────────────────────────────────────────────────────
+function macReadItem(account) {
+    try {
+        return execFileSync('security', [
+            'find-generic-password', '-s', KEYCHAIN_SERVICE, '-a', account, '-w',
+        ], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 5000 }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+function macWriteItem(account, value) {
+    // Delete first if exists, then add (security tool doesn't have upsert)
+    try {
+        execFileSync('security', ['delete-generic-password', '-s', KEYCHAIN_SERVICE, '-a', account], {
+            stdio: 'pipe', timeout: 5000,
+        });
+    }
+    catch { /* @silent-fallback-ok */ }
+    execFileSync('security', [
+        'add-generic-password', '-s', KEYCHAIN_SERVICE, '-a', account, '-w', value,
+    ], { stdio: 'pipe', timeout: 5000 });
+}
+function linuxReadItem(account) {
+    try {
+        return execFileSync('secret-tool', ['lookup', 'service', KEYCHAIN_SERVICE, 'account', account], {
+            encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 5000,
+        }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+function linuxWriteItem(account, value) {
+    // secret-tool reads from stdin
+    execFileSync('secret-tool', ['store', '--label', `instar:${account}`,
+        'service', KEYCHAIN_SERVICE, 'account', account], {
+        input: value, timeout: 5000,
+    });
+}
+async function deriveKeyFromPassphrase(passphrase, salt) {
+    return new Promise((resolve, reject) => {
+        // maxmem must be ≥ 128 * N * r (per Node docs); set generous headroom.
+        const maxmem = 128 * SCRYPT_PARAMS.N * SCRYPT_PARAMS.r * 2;
+        crypto.scrypt(passphrase, salt, SCRYPT_KEY_LEN, { ...SCRYPT_PARAMS, maxmem }, (err, derived) => {
+            if (err)
+                reject(err);
+            else
+                resolve(derived);
+        });
+    });
+}
+async function flatFileWrite(filePath, plaintext, passphrase) {
+    const salt = crypto.randomBytes(16);
+    const key = await deriveKeyFromPassphrase(passphrase, salt);
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    const ct = Buffer.concat([cipher.update(plaintext, 'utf-8'), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    const payload = {
+        version: 1,
+        kdf: 'scrypt',
+        scryptParams: SCRYPT_PARAMS,
+        salt: salt.toString('base64'),
+        iv: iv.toString('base64'),
+        ciphertext: ct.toString('base64'),
+        authTag: authTag.toString('base64'),
+    };
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, JSON.stringify(payload), { mode: SECURE_FILE_MODE });
+}
+async function flatFileRead(filePath, passphrase) {
+    const payload = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+    if (payload.version !== 1 || payload.kdf !== 'scrypt') {
+        throw new Error(`unsupported keyvault version: ${payload.version}/${payload.kdf}`);
+    }
+    const salt = Buffer.from(payload.salt, 'base64');
+    const iv = Buffer.from(payload.iv, 'base64');
+    const ct = Buffer.from(payload.ciphertext, 'base64');
+    const authTag = Buffer.from(payload.authTag, 'base64');
+    const key = await deriveKeyFromPassphrase(passphrase, salt);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(authTag);
+    const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
+    return pt.toString('utf-8');
+}
+// ── Public API ───────────────────────────────────────────────────────
+export class WorktreeKeyVault {
+    stateDir;
+    opts;
+    flatFilePath;
+    constructor(opts) {
+        this.stateDir = opts.stateDir;
+        this.opts = {
+            stateDir: opts.stateDir,
+            headlessAllowed: opts.headlessAllowed ?? false,
+            forceBackend: opts.forceBackend ?? null,
+            passphraseResolver: opts.passphraseResolver ?? null,
+        };
+        this.flatFilePath = path.join(opts.stateDir, 'local-state', 'keys.enc');
+    }
+    async loadOrInit() {
+        const backend = this.detectBackend();
+        if (backend === 'keychain')
+            return this.loadOrInitKeychain();
+        if (backend === 'flatfile')
+            return this.loadOrInitFlatFile();
+        throw new Error('no keyvault backend available; set headlessAllowed=true with passphraseResolver to use flat-file fallback');
+    }
+    detectBackend() {
+        if (this.opts.forceBackend)
+            return this.opts.forceBackend;
+        if (macOsKeychainAvailable())
+            return 'keychain';
+        if (linuxLibsecretAvailable())
+            return 'keychain';
+        if (this.opts.headlessAllowed)
+            return 'flatfile';
+        return null;
+    }
+    async loadOrInitKeychain() {
+        const macOs = process.platform === 'darwin';
+        const read = macOs ? macReadItem : linuxReadItem;
+        const write = macOs ? macWriteItem : linuxWriteItem;
+        let hmacB64 = read(KEYCHAIN_ITEM_HMAC);
+        let signingPriv = read(KEYCHAIN_ITEM_SIGNING_PRIV);
+        let signingPub = read(KEYCHAIN_ITEM_SIGNING_PUB);
+        let machineId = read(KEYCHAIN_ITEM_MACHINE_ID);
+        let keyVersionStr = read(KEYCHAIN_ITEM_KEY_VERSION);
+        if (!hmacB64 || !signingPriv || !signingPub || !machineId) {
+            const fresh = generateFreshMaterial();
+            write(KEYCHAIN_ITEM_HMAC, fresh.hmacB64);
+            write(KEYCHAIN_ITEM_SIGNING_PRIV, fresh.signingPriv);
+            write(KEYCHAIN_ITEM_SIGNING_PUB, fresh.signingPub);
+            write(KEYCHAIN_ITEM_MACHINE_ID, fresh.machineId);
+            write(KEYCHAIN_ITEM_KEY_VERSION, '1');
+            return materialFromParts(fresh, 1);
+        }
+        return {
+            hmacKey: Buffer.from(hmacB64, 'base64'),
+            signing: { privateKeyPem: signingPriv, publicKeyPem: signingPub, keyVersion: Number(keyVersionStr ?? 1) },
+            machineId,
+        };
+    }
+    async loadOrInitFlatFile() {
+        if (!this.opts.passphraseResolver) {
+            throw new Error('K1: headless flat-file mode requires passphraseResolver');
+        }
+        const passphrase = await this.opts.passphraseResolver();
+        if (!passphrase || passphrase.length < 12) {
+            throw new Error('K1: passphrase must be ≥12 characters');
+        }
+        if (fs.existsSync(this.flatFilePath)) {
+            const decrypted = await flatFileRead(this.flatFilePath, passphrase);
+            const parsed = JSON.parse(decrypted);
+            return {
+                hmacKey: Buffer.from(parsed.hmacB64, 'base64'),
+                signing: { privateKeyPem: parsed.signingPriv, publicKeyPem: parsed.signingPub, keyVersion: parsed.keyVersion },
+                machineId: parsed.machineId,
+            };
+        }
+        const fresh = generateFreshMaterial();
+        const payload = JSON.stringify({ ...fresh, keyVersion: 1 });
+        await flatFileWrite(this.flatFilePath, payload, passphrase);
+        return materialFromParts(fresh, 1);
+    }
+}
+function generateFreshMaterial() {
+    const hmac = crypto.randomBytes(32);
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', {
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+        privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+    });
+    return {
+        hmacB64: hmac.toString('base64'),
+        signingPriv: privateKey,
+        signingPub: publicKey,
+        machineId: crypto.randomUUID(),
+    };
+}
+function materialFromParts(f, keyVersion) {
+    return {
+        hmacKey: Buffer.from(f.hmacB64, 'base64'),
+        signing: { privateKeyPem: f.signingPriv, publicKeyPem: f.signingPub, keyVersion },
+        machineId: f.machineId,
+    };
+}
+//# sourceMappingURL=WorktreeKeyVault.js.map

package/dist/core/WorktreeKeyVault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorktreeKeyVault.js","sourceRoot":"","sources":["../../src/core/WorktreeKeyVault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,gBAAgB;AAClE,MAAM,cAAc,GAAG,EAAE,CAAC;AAqB1B,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAC/C,MAAM,kBAAkB,GAAG,UAAU,CAAC;AACtC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC;AACrD,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AACnD,MAAM,wBAAwB,GAAG,YAAY,CAAC;AAC9C,MAAM,yBAAyB,GAAG,aAAa,CAAC;AAEhD,wEAAwE;AAExE,SAAS,sBAAsB;IAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC;QACH,YAAY,CAAC,UAAU,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AAED,SAAS,uBAAuB;IAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC;QACH,YAAY,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AAED,wEAAwE;AAExE,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,UAAU,EAAE;YAC9B,uBAAuB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI;SACrE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,KAAa;IAClD,uEAAuE;IACvE,IAAI,CAAC;QACH,YAAY,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;YAC3F,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI;SAC7B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;IACrC,YAAY,CAAC,UAAU,EAAE;QACvB,sBAAsB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK;KAC3E,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;YAC9F,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI;SAClE,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,KAAa;IACpD,+BAA+B;IAC/B,YAAY,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,OAAO,EAAE;QAClE,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;QAClD,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;KAC5B,CAAC,CAAC;AACL,CAAC;AAcD,KAAK,UAAU,uBAAuB,CAAC,UAAkB,EAAE,IAAY;IACrE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,uEAAuE;QACvE,MAAM,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;YAC7F,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,SAAiB,EAAE,UAAkB;IAClF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC5D,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,MAAM,OAAO,GAAoB;QAC/B,OAAO,EAAE,CAAC;QACV,GAAG,EAAE,QAAQ;QACb,YAAY,EAAE,aAAa;QAC3B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACjC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACpC,CAAC;IACF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,UAAkB;IAC9D,MAAM,OAAO,GAAoB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClE,OAAO,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,wEAAwE;AAExE,MAAM,OAAO,gBAAgB;IACnB,QAAQ,CAAS;IACjB,IAAI,CAGV;IACM,YAAY,CAAS;IAE7B,YAAY,IAAqB;QAC/B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,KAAK;YAC9C,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;YACvC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,IAAI;SACpD,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACrC,IAAI,OAAO,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC7D,IAAI,OAAO,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,2GAA2G,CAAC,CAAC;IAC/H,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;QAC1D,IAAI,sBAAsB,EAAE;YAAE,OAAO,UAAU,CAAC;QAChD,IAAI,uBAAuB,EAAE;YAAE,OAAO,UAAU,CAAC;QACjD,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO,UAAU,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;QACjD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC;QAEpD,IAAI,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACvC,IAAI,WAAW,GAAG,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACnD,IAAI,UAAU,GAAG,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACjD,IAAI,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAC/C,IAAI,aAAa,GAAG,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAEpD,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,KAAK,CAAC,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACzC,KAAK,CAAC,0BAA0B,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YACrD,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YACnD,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACjD,KAAK,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;YACtC,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrC,CAAC;QAED,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;YACvC,OAAO,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC,EAAE;YACzG,SAAS;SACV,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACrC,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC;gBAC9C,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;gBAC9G,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5D,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAC5D,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrC,CAAC;CACF;AAWD,SAAS,qBAAqB;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE;QACtE,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;KACrD,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAChC,WAAW,EAAE,UAAU;QACvB,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAgB,EAAE,UAAkB;IAC7D,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC;QACzC,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE;QACjF,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC"}

package/dist/core/WorktreeManager.d.ts

@@ -0,0 +1,250 @@
+/**
+ * WorktreeManager — Topic-bound parallel-dev isolation (PARALLEL-DEV-ISOLATION-SPEC.md iter 4).
+ *
+ * Source of truth for: topic→worktree bindings, exclusive locks, fencing tokens,
+ * commit-trailer signing, force-take protocol, state reconciliation matrix.
+ *
+ * Two storage layers:
+ *   - Machine-local (gitignored): bindings, locks, fencing, binding-history.db, snapshots/
+ *   - Git-synced (signed): topic-branch-map (path-free), binding-history-log.jsonl
+ *
+ * Authority model:
+ *   - Local advisory: pre-commit gate (cwd-vs-binding, lock-owner)
+ *   - Local authoritative-on-trailer: commit-msg hook (Ed25519 sign tree+nonce+parent)
+ *   - Origin authoritative: GitHub Repository Ruleset + workflow check (Ed25519 verify offline)
+ *
+ * Same-topic concurrency: EXCLUSIVE — one session per topic worktree.
+ */
+import { EventEmitter } from 'node:events';
+export type WorktreeMode = 'dev' | 'read-only' | 'doc-fix' | 'platform';
+export interface WorktreeBinding {
+    topicId: number | 'platform';
+    slug: string;
+    branch: string;
+    worktreePath: string;
+    mode: WorktreeMode;
+    status: 'active' | 'merged' | 'abandoned' | 'lost' | 'quarantined';
+    createdAt: string;
+    createdBy: string;
+    machineId: string;
+    fencingToken: string;
+    serverSignature: string;
+}
+export interface SessionLock {
+    schema: 'v2';
+    machineId: string;
+    bootId: string;
+    pid: number;
+    processStartTime: number;
+    sessionId: string;
+    fencingToken: string;
+    topicId: number | 'platform';
+    acquiredAt: string;
+    heartbeatAt: string;
+    serverSignature: string;
+}
+export interface ResolveResult {
+    cwd: string;
+    branch: string;
+    fencingToken: string;
+    sessionContextPath: string;
+    mode: WorktreeMode;
+    binding: WorktreeBinding;
+}
+export interface SignedTrailerResult {
+    trailers: string[];
+    nonce: string;
+    issued: number;
+    maxPushDelay: number;
+    keyVersion: number;
+}
+export interface WorktreeManagerOptions {
+    projectDir: string;
+    stateDir: string;
+    signingKey: {
+        privateKeyPem: string;
+        publicKeyPem: string;
+        keyVersion: number;
+    };
+    hmacKey: Buffer;
+    machineId: string;
+    bootId: string;
+    repoOriginUrl: string;
+    fsTypeProbe?: () => Promise<FsType>;
+    maxPushDelaySeconds?: number;
+}
+type FsType = 'apfs' | 'btrfs' | 'xfs' | 'ext4' | 'hfs+' | 'ntfs' | 'tmpfs' | 'unknown';
+export declare class WorktreeManager extends EventEmitter {
+    private opts;
+    private bindings;
+    private locks;
+    private fencingCounter;
+    private bindingsFile;
+    private fencingFile;
+    private bindingHistoryLog;
+    private worktreesRoot;
+    private snapshotsDir;
+    private quarantineDir;
+    constructor(options: WorktreeManagerOptions);
+    /**
+     * Load persistent state from disk. Idempotent.
+     */
+    initialize(): void;
+    private loadBindings;
+    private saveBindings;
+    private loadFencing;
+    private saveFencing;
+    private loadLocks;
+    private hmacHex;
+    private signBinding;
+    private verifySignature;
+    private signLock;
+    private verifyLockSignature;
+    private nextFencingToken;
+    /**
+     * Atomically: ensure binding for (topicId, mode) exists, ensure worktree exists,
+     * acquire exclusive lock, return the cwd to spawn into.
+     *
+     * Throws on lock contention with `code: 'LOCK_HELD'`.
+     */
+    resolve(args: {
+        topicId: number | 'platform';
+        mode: WorktreeMode;
+        sessionId: string;
+        pid: number;
+        processStartTime: number;
+        slug?: string;
+    }): Promise<ResolveResult>;
+    /**
+     * Release the lock held by (sessionId, fencingToken). No-op if not the holder.
+     */
+    release(args: {
+        sessionId: string;
+        fencingToken: string;
+    }): {
+        released: boolean;
+    };
+    /**
+     * Server-stamped heartbeat. Validates fencing token before accepting.
+     */
+    heartbeat(args: {
+        sessionId: string;
+        fencingToken: string;
+    }): {
+        ok: boolean;
+        reason?: string;
+    };
+    /**
+     * Force-take an existing lock (per spec section "Force-take protocol iter 4").
+     * Performs FS snapshot + scoped stash (no --include-ignored), then bumps fencing token.
+     */
+    forceTake(args: {
+        topicId: number | 'platform';
+        mode: WorktreeMode;
+        bySessionId: string;
+        pid: number;
+        processStartTime: number;
+    }): Promise<{
+        snapshotPath: string;
+        stashRef: string | null;
+        previousLock: SessionLock | null;
+    }>;
+    /**
+     * Issue a signed trailer set for a new commit.
+     * The hook calls this after computing treeHash + parents.
+     */
+    signTrailer(args: {
+        sessionId: string;
+        fencingToken: string;
+        treeHash: string;
+        parents: string[];
+    }): SignedTrailerResult;
+    /**
+     * Verify a trailer set (used by GH check via /gh-check/verify-nonce).
+     * Returns ok plus a reason on failure (uniform error for oracle protection).
+     */
+    verifyTrailer(args: {
+        trailers: Record<string, string>;
+        pushReceivedAt?: number;
+    }): {
+        ok: boolean;
+        reason?: string;
+    };
+    /**
+     * Append-only signed log with Merkle chain (K3 hardening).
+     *
+     * Each entry includes `prevEntrySha = sha256(previousLine)`, so a malicious
+     * `git rebase -i` that drops or reorders entries breaks the chain — detectable
+     * by `verifyHistoryChain()`. The chain head is periodically anchored to a
+     * GitHub Repo Variable for cross-machine tamper detection.
+     */
+    private appendHistoryEvent;
+    /**
+     * Compute SHA-256 of the most recent log line (Merkle chain head).
+     * Returns null on empty log.
+     */
+    computeChainHead(): string | null;
+    /**
+     * Walk the entire log and verify (a) HMAC of each line, and (b) prevEntrySha
+     * chain integrity. Returns null on success, or the first detected breach.
+     */
+    verifyHistoryChain(): {
+        lineNumber: number;
+        reason: string;
+    } | null;
+    /**
+     * Check whether nonce was previously used for a different commit.
+     * Idempotent: returns 'unseen' or 'seen-for-same-commit' (allowed retry) or 'seen-for-different-commit'.
+     */
+    checkNonceUnique(args: {
+        nonce: string;
+        commitSha: string;
+    }): 'unseen' | 'seen-for-same-commit' | 'seen-for-different-commit';
+    /**
+     * Bind a commit SHA to a previously-issued trailer (called post-push).
+     */
+    recordCommitForNonce(args: {
+        nonce: string;
+        commitSha: string;
+    }): void;
+    private createBinding;
+    private fastCopyDeps;
+    private snapshotWorktree;
+    private writeLockAtomic;
+    private isLockLive;
+    /**
+     * Walk worktree state from three sources (bindings ∪ filesystem ∪ git worktree list)
+     * and return the rows that need action per the matrix.
+     */
+    reconcile(): Array<{
+        row: string;
+        binding: WorktreeBinding | null;
+        gitWorktree: {
+            path: string;
+        } | null;
+        fsPath: string | null;
+        action: string;
+    }>;
+    private bindingKey;
+    getBinding(topicId: number | 'platform', mode: WorktreeMode): WorktreeBinding | undefined;
+    listBindings(): WorktreeBinding[];
+    getLock(worktreePath: string): SessionLock | undefined;
+}
+/**
+ * Build a WorktreeManager from an instar agent config + machine identity.
+ * Generates an HMAC key on first start; persists to keychain (or flat file fallback).
+ */
+export declare function createWorktreeManager(args: {
+    projectDir: string;
+    stateDir: string;
+    signingKey: {
+        privateKeyPem: string;
+        publicKeyPem: string;
+        keyVersion: number;
+    };
+    hmacKey: Buffer;
+    machineId: string;
+    repoOriginUrl: string;
+}): WorktreeManager;
+export {};
+//# sourceMappingURL=WorktreeManager.d.ts.map

package/dist/core/WorktreeManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorktreeManager.d.ts","sourceRoot":"","sources":["../../src/core/WorktreeManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAM3C,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,CAAC;AAExE,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,MAAM,GAAG,aAAa,CAAC;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAChF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;AA6ExF,qBAAa,eAAgB,SAAQ,YAAY;IAC/C,OAAO,CAAC,IAAI,CAA0G;IAGtH,OAAO,CAAC,QAAQ,CAA2C;IAC3D,OAAO,CAAC,KAAK,CAAuC;IACpD,OAAO,CAAC,cAAc,CAAkC;IAExD,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,aAAa,CAAS;gBAElB,OAAO,EAAE,sBAAsB;IAmB3C;;OAEG;IACH,UAAU,IAAI,IAAI;IAclB,OAAO,CAAC,YAAY;IAmBpB,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,SAAS;IAoBjB,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,eAAe;IAMvB,OAAO,CAAC,QAAQ;IAKhB,OAAO,CAAC,mBAAmB;IAQ3B,OAAO,CAAC,gBAAgB;IAWxB;;;;;OAKG;IACG,OAAO,CAAC,IAAI,EAAE;QAClB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;QAC7B,IAAI,EAAE,YAAY,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;QACzB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,aAAa,CAAC;IA4E1B;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE;IAajF;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAgB9F;;;OAGG;IACG,SAAS,CAAC,IAAI,EAAE;QACpB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;QAC7B,IAAI,EAAE,YAAY,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,CAAC;IAwDhG;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,GAAG,mBAAmB;IA6DvB;;;OAGG;IACH,aAAa,CAAC,IAAI,EAAE;QAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAyBpC;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IAa1B;;;OAGG;IACH,gBAAgB,IAAI,MAAM,GAAG,IAAI;IASjC;;;OAGG;IACH,kBAAkB,IAAI;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAqBnE;;;OAGG;IACH,gBAAgB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,QAAQ,GAAG,sBAAsB,GAAG,2BAA2B;IAoB7H;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;YAMxD,aAAa;YAiFb,YAAY;YAuBZ,gBAAgB;IA6B9B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,UAAU;IAWlB;;;OAGG;IACH,SAAS,IAAI,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;QAAC,WAAW,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAmDjJ,OAAO,CAAC,UAAU;IAMlB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,IAAI,EAAE,YAAY,GAAG,eAAe,GAAG,SAAS;IAGzF,YAAY,IAAI,eAAe,EAAE;IACjC,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;CACvD;AAID;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAChF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,eAAe,CAOlB"}