kynjal-cli 3.1.3 → 4.0.0

package/dist/src/appliance/rvfa-signing.js

@@ -0,0 +1,469 @@
+/**
+ * RVFA Ed25519 Code Signing -- Digital signatures for RVFA appliance files.
+ *
+ * Provides tamper detection and publisher identity verification using
+ * Ed25519 (RFC 8032) via Node.js native crypto. Zero external dependencies.
+ *
+ * @module @claude-flow/cli/appliance/rvfa-signing
+ */
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (_) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+import { generateKeyPairSync, createHash, sign, verify, createPublicKey, createPrivateKey, } from 'node:crypto';
+import { readFile, writeFile, stat, chmod, mkdir } from 'node:fs/promises';
+// ── Constants ────────────────────────────────────────────────
+var PREAMBLE_SIZE = 12; // 4B magic + 4B version + 4B header_len
+var SHA256_SIZE = 32;
+var KEY_FILE_MODE = 384;
+// ── Key Management ───────────────────────────────────────────
+/** Compute the fingerprint of a public key: first 16 hex chars of its SHA256. */
+function computeFingerprint(publicKeyPem) {
+    return createHash('sha256')
+        .update(publicKeyPem, 'utf-8')
+        .digest('hex')
+        .slice(0, 16);
+}
+/**
+ * Generate a new Ed25519 key pair for RVFA signing.
+ */
+export function generateKeyPair() {
+    return __awaiter(this, void 0, Promise, function () {
+        var _a, publicKey, privateKey, pubBuf, privBuf, fingerprint;
+        return __generator(this, function (_b) {
+            _a = generateKeyPairSync('ed25519', {
+                publicKeyEncoding: { type: 'spki', format: 'pem' },
+                privateKeyEncoding: { type: 'pkcs8', format: 'pem' }
+            }), publicKey = _a.publicKey, privateKey = _a.privateKey;
+            pubBuf = Buffer.from(publicKey, 'utf-8');
+            privBuf = Buffer.from(privateKey, 'utf-8');
+            fingerprint = computeFingerprint(publicKey);
+            return [2 /*return*/, { publicKey: pubBuf, privateKey: privBuf, fingerprint: fingerprint }];
+        });
+    });
+}
+/**
+ * Save a key pair to disk as PEM files.
+ *
+ * @param keyPair  The key pair to persist.
+ * @param dir      Directory to write files into.
+ * @param name     Base name for the key files (default: 'rvfa-signing').
+ * @returns Paths to the written public and private key files.
+ */
+export function saveKeyPair(keyPair, dir, name) {
+    if (name === void 0) { name = 'rvfa-signing'; }
+    return __awaiter(this, void 0, Promise, function () {
+        var pubPath, privPath;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, mkdir(dir, { recursive: true })];
+                case 1:
+                    _a.sent();
+                    pubPath = dir + "/" + name + ".pub";
+                    privPath = dir + "/" + name + ".key";
+                    return [4 /*yield*/, writeFile(pubPath, keyPair.publicKey)];
+                case 2:
+                    _a.sent();
+                    return [4 /*yield*/, writeFile(privPath, keyPair.privateKey, { mode: KEY_FILE_MODE })];
+                case 3:
+                    _a.sent();
+                    // Ensure private key has restrictive permissions even on existing files
+                    return [4 /*yield*/, chmod(privPath, KEY_FILE_MODE)];
+                case 4:
+                    // Ensure private key has restrictive permissions even on existing files
+                    _a.sent();
+                    return [2 /*return*/, { publicKeyPath: pubPath, privateKeyPath: privPath }];
+            }
+        });
+    });
+}
+/**
+ * Load a key pair from PEM files on disk.
+ *
+ * @param dir   Directory containing the key files.
+ * @param name  Base name for the key files (default: 'rvfa-signing').
+ */
+export function loadKeyPair(dir, name) {
+    if (name === void 0) { name = 'rvfa-signing'; }
+    return __awaiter(this, void 0, Promise, function () {
+        var pubPath, privPath, publicKey, privateKey, privStat, mode, fingerprint;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    pubPath = dir + "/" + name + ".pub";
+                    privPath = dir + "/" + name + ".key";
+                    return [4 /*yield*/, readFile(pubPath)];
+                case 1:
+                    publicKey = _a.sent();
+                    return [4 /*yield*/, readFile(privPath)];
+                case 2:
+                    privateKey = _a.sent();
+                    return [4 /*yield*/, stat(privPath)];
+                case 3:
+                    privStat = _a.sent();
+                    mode = privStat.mode & 511;
+                    if (mode & 63) {
+                        console.warn("[rvfa-signing] WARNING: Private key " + privPath + " has open permissions " +
+                            ("(" + mode.toString(8) + "). Consider running: chmod 600 " + privPath));
+                    }
+                    fingerprint = computeFingerprint(publicKey.toString('utf-8'));
+                    return [2 /*return*/, { publicKey: publicKey, privateKey: privateKey, fingerprint: fingerprint }];
+            }
+        });
+    });
+}
+/**
+ * Load a public key from a single PEM file.
+ */
+export function loadPublicKey(path) {
+    return __awaiter(this, void 0, Promise, function () {
+        return __generator(this, function (_a) {
+            return [2 /*return*/, readFile(path)];
+        });
+    });
+}
+// ── Internal Helpers ─────────────────────────────────────────
+/**
+ * Recursively sort object keys for canonical JSON serialization.
+ * Produces deterministic output regardless of insertion order.
+ */
+function canonicalJson(value) {
+    return JSON.stringify(value, function (_key, val) {
+        if (val !== null && typeof val === 'object' && !Array.isArray(val) && !Buffer.isBuffer(val)) {
+            var sorted = {};
+            for (var _i = 0, _a = Object.keys(val).sort(); _i < _a.length; _i++) {
+                var k = _a[_i];
+                sorted[k] = val[k];
+            }
+            return sorted;
+        }
+        return val;
+    });
+}
+/**
+ * Parse an RVFA binary into its components without full validation.
+ * Returns the header object, header JSON bytes, section data region, and footer.
+ */
+function parseRvfaBinary(buf) {
+    if (buf.length < PREAMBLE_SIZE + SHA256_SIZE) {
+        throw new Error('Buffer too small to be a valid RVFA file');
+    }
+    var magic = buf.subarray(0, 4).toString('ascii');
+    if (magic !== 'RVFA') {
+        throw new Error("Invalid RVFA magic: expected \"RVFA\", got \"" + magic + "\"");
+    }
+    var headerLen = buf.readUInt32LE(8);
+    var headerStart = PREAMBLE_SIZE;
+    var headerEnd = headerStart + headerLen;
+    if (headerEnd > buf.length - SHA256_SIZE) {
+        throw new Error('Header length extends beyond buffer');
+    }
+    var headerJson = buf.subarray(headerStart, headerEnd).toString('utf-8');
+    var header;
+    try {
+        header = JSON.parse(headerJson);
+    }
+    catch (_a) {
+        throw new Error('Failed to parse RVFA header JSON');
+    }
+    var footer = buf.subarray(buf.length - SHA256_SIZE);
+    var sectionData = buf.subarray(headerEnd, buf.length - SHA256_SIZE);
+    return { header: header, headerStart: headerStart, headerEnd: headerEnd, sectionData: sectionData, footer: footer };
+}
+/**
+ * Compute the signing digest for an RVFA file.
+ *
+ * The digest is SHA256 of: canonical_header_json (without signature field)
+ *                         + section_data_bytes
+ *                         + footer_32_bytes
+ */
+function computeSigningDigest(header, sectionData, footer) {
+    // Strip signature field from header for digest computation
+    var stripped = __assign({}, header);
+    delete stripped.signature;
+    var canonical = Buffer.from(canonicalJson(stripped), 'utf-8');
+    return createHash('sha256')
+        .update(canonical)
+        .update(sectionData)
+        .update(footer)
+        .digest();
+}
+/** Convert a Buffer or PEM string into a KeyObject. */
+function toPrivateKeyObject(key) {
+    var pem = Buffer.isBuffer(key) ? key.toString('utf-8') : key;
+    return createPrivateKey(pem);
+}
+/** Convert a Buffer or PEM string into a KeyObject. */
+function toPublicKeyObject(key) {
+    var pem = Buffer.isBuffer(key) ? key.toString('utf-8') : key;
+    return createPublicKey(pem);
+}
+/**
+ * Rebuild the RVFA binary with an updated header.
+ *
+ * Preserves the original preamble version, recalculates header length,
+ * and keeps section data and footer intact.
+ */
+function rebuildRvfa(originalBuf, newHeader, sectionData, footer) {
+    var headerJson = Buffer.from(JSON.stringify(newHeader), 'utf-8');
+    // Preamble: magic + version + new header length
+    var preamble = Buffer.alloc(PREAMBLE_SIZE);
+    originalBuf.copy(preamble, 0, 0, 8); // magic + version unchanged
+    preamble.writeUInt32LE(headerJson.length, 8);
+    return Buffer.concat([preamble, headerJson, sectionData, footer]);
+}
+// ── RvfaSigner ───────────────────────────────────────────────
+/**
+ * Signs RVFA appliance files and data with Ed25519.
+ */
+var RvfaSigner = /** @class */ (function () {
+    function RvfaSigner(privateKey) {
+        this.keyObj = toPrivateKeyObject(privateKey);
+        // Derive public key to compute fingerprint
+        var pubPem = createPublicKey(this.keyObj)["export"]({ type: 'spki', format: 'pem' });
+        this.fingerprint = computeFingerprint(pubPem);
+    }
+    /**
+     * Sign an RVFA appliance file in-place.
+     *
+     * Algorithm:
+     *  1. Read and parse the RVFA binary
+     *  2. Strip any existing signature from the header
+     *  3. Compute SHA256 of [canonical_header + section_data + footer]
+     *  4. Sign the digest with Ed25519
+     *  5. Embed signature metadata into the header
+     *  6. Write the updated binary back to the file
+     *
+     * @param rvfaPath   Path to the .rvf appliance file.
+     * @param signedBy   Optional publisher name.
+     * @returns The signature metadata that was embedded.
+     */
+    RvfaSigner.prototype.signAppliance = function (rvfaPath, signedBy) {
+        return __awaiter(this, void 0, Promise, function () {
+            var buf, _a, header, sectionData, footer, digest, sig, metadata, rebuilt;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, readFile(rvfaPath)];
+                    case 1:
+                        buf = _b.sent();
+                        _a = parseRvfaBinary(buf), header = _a.header, sectionData = _a.sectionData, footer = _a.footer;
+                        digest = computeSigningDigest(header, sectionData, footer);
+                        sig = sign(null, digest, this.keyObj);
+                        metadata = {
+                            algorithm: 'ed25519',
+                            publicKeyFingerprint: this.fingerprint,
+                            signature: sig.toString('hex'),
+                            signedAt: new Date().toISOString(),
+                            signedBy: signedBy,
+                            scope: 'full'
+                        };
+                        // Embed signature in header and rebuild
+                        header.signature = metadata;
+                        rebuilt = rebuildRvfa(buf, header, sectionData, footer);
+                        return [4 /*yield*/, writeFile(rvfaPath, rebuilt)];
+                    case 2:
+                        _b.sent();
+                        return [2 /*return*/, metadata];
+                }
+            });
+        });
+    };
+    /**
+     * Sign a section footer hash (detached signature).
+     *
+     * @param footerHash  The 32-byte SHA256 footer hash from an RVFA file.
+     * @returns Hex-encoded Ed25519 signature.
+     */
+    RvfaSigner.prototype.signSections = function (footerHash) {
+        return __awaiter(this, void 0, Promise, function () {
+            var sig;
+            return __generator(this, function (_a) {
+                if (footerHash.length !== SHA256_SIZE) {
+                    throw new Error("Footer hash must be " + SHA256_SIZE + " bytes, got " + footerHash.length);
+                }
+                sig = sign(null, footerHash, this.keyObj);
+                return [2 /*return*/, sig.toString('hex')];
+            });
+        });
+    };
+    /**
+     * Sign an RVFP patch file (detached signature).
+     *
+     * @param patchData  The raw patch binary data.
+     * @returns Hex-encoded Ed25519 signature.
+     */
+    RvfaSigner.prototype.signPatch = function (patchData) {
+        return __awaiter(this, void 0, Promise, function () {
+            var digest, sig;
+            return __generator(this, function (_a) {
+                digest = createHash('sha256').update(patchData).digest();
+                sig = sign(null, digest, this.keyObj);
+                return [2 /*return*/, sig.toString('hex')];
+            });
+        });
+    };
+    return RvfaSigner;
+}());
+export { RvfaSigner };
+// ── RvfaVerifier ─────────────────────────────────────────────
+/**
+ * Verifies Ed25519 signatures on RVFA appliance files and data.
+ */
+var RvfaVerifier = /** @class */ (function () {
+    function RvfaVerifier(publicKey) {
+        this.keyObj = toPublicKeyObject(publicKey);
+        var pem = Buffer.isBuffer(publicKey) ? publicKey.toString('utf-8') : publicKey;
+        this.fingerprint = computeFingerprint(pem);
+    }
+    /**
+     * Verify the Ed25519 signature embedded in an RVFA appliance file.
+     *
+     * @param rvfaPath  Path to the .rvf appliance file.
+     * @returns Verification result with details and any errors.
+     */
+    RvfaVerifier.prototype.verifyAppliance = function (rvfaPath) {
+        return __awaiter(this, void 0, Promise, function () {
+            var errors, buf, err_1, parsed, header, sectionData, footer, sigRaw, sigMeta, digest, sigBuf, valid;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        errors = [];
+                        _a.label = 1;
+                    case 1:
+                        _a.trys.push([1, 3, , 4]);
+                        return [4 /*yield*/, readFile(rvfaPath)];
+                    case 2:
+                        buf = _a.sent();
+                        return [3 /*break*/, 4];
+                    case 3:
+                        err_1 = _a.sent();
+                        return [2 /*return*/, { valid: false, errors: ["Failed to read file: " + err_1.message] }];
+                    case 4:
+                        try {
+                            parsed = parseRvfaBinary(buf);
+                        }
+                        catch (err) {
+                            return [2 /*return*/, { valid: false, errors: ["Invalid RVFA file: " + err.message] }];
+                        }
+                        header = parsed.header, sectionData = parsed.sectionData, footer = parsed.footer;
+                        sigRaw = header.signature;
+                        if (!sigRaw || typeof sigRaw !== 'object') {
+                            return [2 /*return*/, { valid: false, errors: ['No signature found in RVFA header'] }];
+                        }
+                        sigMeta = sigRaw;
+                        if (sigMeta.algorithm !== 'ed25519') {
+                            errors.push("Unsupported algorithm: " + String(sigMeta.algorithm));
+                            return [2 /*return*/, { valid: false, errors: errors }];
+                        }
+                        if (typeof sigMeta.signature !== 'string' || !sigMeta.signature) {
+                            errors.push('Signature field is missing or empty');
+                            return [2 /*return*/, { valid: false, errors: errors }];
+                        }
+                        digest = computeSigningDigest(header, sectionData, footer);
+                        try {
+                            sigBuf = Buffer.from(sigMeta.signature, 'hex');
+                        }
+                        catch (_b) {
+                            errors.push('Signature is not valid hex');
+                            return [2 /*return*/, { valid: false, errors: errors }];
+                        }
+                        try {
+                            valid = verify(null, digest, this.keyObj, sigBuf);
+                        }
+                        catch (err) {
+                            errors.push("Verification error: " + err.message);
+                            return [2 /*return*/, { valid: false, errors: errors }];
+                        }
+                        if (!valid) {
+                            errors.push('Ed25519 signature verification failed: data may be tampered');
+                        }
+                        return [2 /*return*/, {
+                                valid: valid,
+                                signerFingerprint: sigMeta.publicKeyFingerprint,
+                                signedAt: sigMeta.signedAt,
+                                signedBy: sigMeta.signedBy,
+                                errors: errors
+                            }];
+                }
+            });
+        });
+    };
+    /**
+     * Verify a detached Ed25519 signature over arbitrary data.
+     *
+     * @param data       The data that was signed.
+     * @param signature  Hex-encoded Ed25519 signature.
+     */
+    RvfaVerifier.prototype.verifyDetached = function (data, signature) {
+        return __awaiter(this, void 0, Promise, function () {
+            var digest, sigBuf;
+            return __generator(this, function (_a) {
+                digest = createHash('sha256').update(data).digest();
+                sigBuf = Buffer.from(signature, 'hex');
+                return [2 /*return*/, verify(null, digest, this.keyObj, sigBuf)];
+            });
+        });
+    };
+    /**
+     * Verify an RVFP patch file signature.
+     *
+     * @param patchData  The raw patch binary data.
+     * @param signature  Hex-encoded Ed25519 signature.
+     */
+    RvfaVerifier.prototype.verifyPatch = function (patchData, signature) {
+        return __awaiter(this, void 0, Promise, function () {
+            var digest, sigBuf;
+            return __generator(this, function (_a) {
+                digest = createHash('sha256').update(patchData).digest();
+                sigBuf = Buffer.from(signature, 'hex');
+                return [2 /*return*/, verify(null, digest, this.keyObj, sigBuf)];
+            });
+        });
+    };
+    return RvfaVerifier;
+}());
+export { RvfaVerifier };
+//# sourceMappingURL=rvfa-signing.js.map

package/dist/src/appliance/rvfa-signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rvfa-signing.js","sourceRoot":"","sources":["../../../src/appliance/rvfa-signing.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,OAAO,EACL,mBAAmB,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAC7C,eAAe,EAAE,gBAAgB,GAElC,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG3E,gEAAgE;AAEhE,IAAM,aAAa,GAAG,EAAE,CAAC,CAAC,wCAAwC;AAClE,IAAM,WAAW,GAAG,EAAE,CAAC;AACvB,IAAM,aAAa,GAAG,GAAK,CAAC;AA2B5B,gEAAgE;AAEhE,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC;SAC7B,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAgB,eAAe;mCAAI,OAAO;;;YACxC,KAA4B,mBAAmB,CAAC,SAAS,EAAE;gBAC/D,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;gBAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;aACrD,CAAC,EAHM,SAAS,eAAA,EAAE,UAAU,gBAAA,CAG1B;YAEG,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAmB,EAAE,OAAO,CAAC,CAAC;YACnD,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAoB,EAAE,OAAO,CAAC,CAAC;YACrD,WAAW,GAAG,kBAAkB,CAAC,SAAmB,CAAC,CAAC;YAE5D,sBAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,aAAA,EAAE,EAAC;;;CAChE;AAED;;;;;;;GAOG;AACH,MAAM,UAAgB,WAAW,CAC/B,OAAoB,EACpB,GAAW,EACX,IAAqB;IAArB,qBAAA,EAAA,qBAAqB;mCACpB,OAAO;;;;wBACR,qBAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAA;;oBAArC,SAAqC,CAAC;oBAEhC,OAAO,GAAM,GAAG,SAAI,IAAI,SAAM,CAAC;oBAC/B,QAAQ,GAAM,GAAG,SAAI,IAAI,SAAM,CAAC;oBAEtC,qBAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,EAAA;;oBAA3C,SAA2C,CAAC;oBAC5C,qBAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAA;;oBAAtE,SAAsE,CAAC;oBAEvE,wEAAwE;oBACxE,qBAAM,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAA;;oBADpC,wEAAwE;oBACxE,SAAoC,CAAC;oBAErC,sBAAO,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAC;;;;CAC7D;AAED;;;;;GAKG;AACH,MAAM,UAAgB,WAAW,CAC/B,GAAW,EACX,IAAqB;IAArB,qBAAA,EAAA,qBAAqB;mCACpB,OAAO;;;;;oBACF,OAAO,GAAM,GAAG,SAAI,IAAI,SAAM,CAAC;oBAC/B,QAAQ,GAAM,GAAG,SAAI,IAAI,SAAM,CAAC;oBAEpB,qBAAM,QAAQ,CAAC,OAAO,CAAC,EAAA;;oBAAnC,SAAS,GAAG,SAAuB;oBACtB,qBAAM,QAAQ,CAAC,QAAQ,CAAC,EAAA;;oBAArC,UAAU,GAAG,SAAwB;oBAG1B,qBAAM,IAAI,CAAC,QAAQ,CAAC,EAAA;;oBAA/B,QAAQ,GAAG,SAAoB;oBAC/B,IAAI,GAAG,QAAQ,CAAC,IAAI,GAAG,GAAK,CAAC;oBACnC,IAAI,IAAI,GAAG,EAAK,EAAE;wBAChB,OAAO,CAAC,IAAI,CACV,yCAAuC,QAAQ,2BAAwB;6BACvE,MAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,uCAAkC,QAAU,CAAA,CACjE,CAAC;qBACH;oBAEK,WAAW,GAAG,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;oBACpE,sBAAO,EAAE,SAAS,WAAA,EAAE,UAAU,YAAA,EAAE,WAAW,aAAA,EAAE,EAAC;;;;CAC/C;AAED;;GAEG;AACH,MAAM,UAAgB,aAAa,CAAC,IAAY;mCAAG,OAAO;;YACxD,sBAAO,QAAQ,CAAC,IAAI,CAAC,EAAC;;;CACvB;AAED,gEAAgE;AAEhE;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,UAAC,IAAI,EAAE,GAAG;QACrC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;YAC3F,IAAM,MAAM,GAA4B,EAAE,CAAC;YAC3C,KAAgB,UAAkD,EAAlD,KAAA,MAAM,CAAC,IAAI,CAAC,GAA8B,CAAC,CAAC,IAAI,EAAE,EAAlD,cAAkD,EAAlD,IAAkD,EAAE;gBAA/D,IAAM,CAAC,SAAA;gBACV,MAAM,CAAC,CAAC,CAAC,GAAI,GAA+B,CAAC,CAAC,CAAC,CAAC;aACjD;YACD,OAAO,MAAM,CAAC;SACf;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,GAAW;IAOlC,IAAI,GAAG,CAAC,MAAM,GAAG,aAAa,GAAG,WAAW,EAAE;QAC5C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;KAC7D;IAED,IAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,MAAM,EAAE;QACpB,MAAM,IAAI,KAAK,CAAC,kDAA6C,KAAK,OAAG,CAAC,CAAC;KACxE;IAED,IAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtC,IAAM,WAAW,GAAG,aAAa,CAAC;IAClC,IAAM,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAE1C,IAAI,SAAS,GAAG,GAAG,CAAC,MAAM,GAAG,WAAW,EAAE;QACxC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;KACxD;IAED,IAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,MAA+B,CAAC;IACpC,IAAI;QACF,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAA4B,CAAC;KAC5D;IAAC,WAAM;QACN,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;KACrD;IAED,IAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC;IACtD,IAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC;IAEtE,OAAO,EAAE,MAAM,QAAA,EAAE,WAAW,aAAA,EAAE,SAAS,WAAA,EAAE,WAAW,aAAA,EAAE,MAAM,QAAA,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,MAA+B,EAC/B,WAAmB,EACnB,MAAc;IAEd,2DAA2D;IAC3D,IAAM,QAAQ,gBAAQ,MAAM,CAAE,CAAC;IAC/B,OAAO,QAAQ,CAAC,SAAS,CAAC;IAE1B,IAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IAEhE,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,SAAS,CAAC;SACjB,MAAM,CAAC,WAAW,CAAC;SACnB,MAAM,CAAC,MAAM,CAAC;SACd,MAAM,EAAE,CAAC;AACd,CAAC;AAED,uDAAuD;AACvD,SAAS,kBAAkB,CAAC,GAAoB;IAC9C,IAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/D,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,uDAAuD;AACvD,SAAS,iBAAiB,CAAC,GAAoB;IAC7C,IAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/D,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAClB,WAAmB,EACnB,SAAkC,EAClC,WAAmB,EACnB,MAAc;IAEd,IAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;IAEnE,gDAAgD;IAChD,IAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7C,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,4BAA4B;IACjE,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAE7C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,gEAAgE;AAEhE;;GAEG;AACH;IAIE,oBAAY,UAA2B;QACrC,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAE7C,2CAA2C;QAC3C,IAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CACxC,QAAM,CAAA,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACG,kCAAa,GAAnB,UAAoB,QAAgB,EAAE,QAAiB;uCAAG,OAAO;;;;4BACnD,qBAAM,QAAQ,CAAC,QAAQ,CAAC,EAAA;;wBAA9B,GAAG,GAAG,SAAwB;wBAC9B,KAAkC,eAAe,CAAC,GAAG,CAAC,EAApD,MAAM,YAAA,EAAE,WAAW,iBAAA,EAAE,MAAM,YAAA,CAA0B;wBAGvD,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;wBAG3D,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;wBAEtC,QAAQ,GAAsB;4BAClC,SAAS,EAAE,SAAS;4BACpB,oBAAoB,EAAE,IAAI,CAAC,WAAW;4BACtC,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;4BAC9B,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;4BAClC,QAAQ,UAAA;4BACR,KAAK,EAAE,MAAM;yBACd,CAAC;wBAEF,wCAAwC;wBACxC,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;wBACtB,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;wBAC9D,qBAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAA;;wBAAlC,SAAkC,CAAC;wBAEnC,sBAAO,QAAQ,EAAC;;;;KACjB;IAED;;;;;OAKG;IACG,iCAAY,GAAlB,UAAmB,UAAkB;uCAAG,OAAO;;;gBAC7C,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,EAAE;oBACrC,MAAM,IAAI,KAAK,CACb,yBAAuB,WAAW,oBAAe,UAAU,CAAC,MAAQ,CACrE,CAAC;iBACH;gBACK,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChD,sBAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAC;;;KAC5B;IAED;;;;;OAKG;IACG,8BAAS,GAAf,UAAgB,SAAiB;uCAAG,OAAO;;;gBACnC,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;gBACzD,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC5C,sBAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAC;;;KAC5B;IACH,iBAAC;AAAD,CAAC,AAlFD,IAkFC;;AAED,gEAAgE;AAEhE;;GAEG;AACH;IAIE,sBAAY,SAA0B;QACpC,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACG,sCAAe,GAArB,UAAsB,QAAgB;uCAAG,OAAO;;;;;wBACxC,MAAM,GAAa,EAAE,CAAC;;;;wBAIpB,qBAAM,QAAQ,CAAC,QAAQ,CAAC,EAAA;;wBAA9B,GAAG,GAAG,SAAwB,CAAC;;;;wBAE/B,sBAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,0BAAyB,KAAa,CAAC,OAAS,CAAC,EAAE,EAAC;;wBAItF,IAAI;4BACF,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;yBAC/B;wBAAC,OAAO,GAAG,EAAE;4BACZ,sBAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,wBAAuB,GAAa,CAAC,OAAS,CAAC,EAAE,EAAC;yBACnF;wBAEO,MAAM,GAA0B,MAAM,OAAhC,EAAE,WAAW,GAAa,MAAM,YAAnB,EAAE,MAAM,GAAK,MAAM,OAAX,CAAY;wBAGzC,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC;wBAChC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;4BACzC,sBAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,mCAAmC,CAAC,EAAE,EAAC;yBACxE;wBAEK,OAAO,GAAG,MAAiC,CAAC;wBAClD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE;4BACnC,MAAM,CAAC,IAAI,CAAC,4BAA0B,MAAM,CAAC,OAAO,CAAC,SAAS,CAAG,CAAC,CAAC;4BACnE,sBAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,QAAA,EAAE,EAAC;yBACjC;wBAED,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;4BAC/D,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;4BACnD,sBAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,QAAA,EAAE,EAAC;yBACjC;wBAGK,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;wBAIjE,IAAI;4BACF,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAmB,EAAE,KAAK,CAAC,CAAC;yBAC1D;wBAAC,WAAM;4BACN,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;4BAC1C,sBAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,QAAA,EAAE,EAAC;yBACjC;wBAGD,IAAI;4BACF,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;yBACnD;wBAAC,OAAO,GAAG,EAAE;4BACZ,MAAM,CAAC,IAAI,CAAC,yBAAwB,GAAa,CAAC,OAAS,CAAC,CAAC;4BAC7D,sBAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,QAAA,EAAE,EAAC;yBACjC;wBAED,IAAI,CAAC,KAAK,EAAE;4BACV,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;yBAC5E;wBAED,sBAAO;gCACL,KAAK,OAAA;gCACL,iBAAiB,EAAE,OAAO,CAAC,oBAA0C;gCACrE,QAAQ,EAAE,OAAO,CAAC,QAA8B;gCAChD,QAAQ,EAAE,OAAO,CAAC,QAA8B;gCAChD,MAAM,QAAA;6BACP,EAAC;;;;KACH;IAED;;;;;OAKG;IACG,qCAAc,GAApB,UAAqB,IAAY,EAAE,SAAiB;uCAAG,OAAO;;;gBACtD,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBACpD,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBAC7C,sBAAO,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAC;;;KAClD;IAED;;;;;OAKG;IACG,kCAAW,GAAjB,UAAkB,SAAiB,EAAE,SAAiB;uCAAG,OAAO;;;gBACxD,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;gBACzD,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBAC7C,sBAAO,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAC;;;KAClD;IACH,mBAAC;AAAD,CAAC,AA5GD,IA4GC"}