linkshell-cli 0.5.42 → 0.6.1

package/dist/wire/src/relay.d.ts

@@ -0,0 +1,481 @@
+import { z } from "zod";
+import { SecureChannel, type Identity, type PublicIdentity } from "./crypto.js";
+export declare const RELAY_PATH = "/v2/connect";
+export declare const publicIdentitySchema: z.ZodObject<{
+    id: z.ZodString;
+    signKey: z.ZodString;
+    boxKey: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    signKey: string;
+    boxKey: string;
+}, {
+    id: string;
+    signKey: string;
+    boxKey: string;
+}>;
+export declare const peerRoleSchema: z.ZodEnum<["machine", "device"]>;
+export type PeerRole = z.infer<typeof peerRoleSchema>;
+/** A machine as a device sees it in the gateway's list. */
+export declare const machineEntrySchema: z.ZodObject<{
+    id: z.ZodString;
+    signKey: z.ZodString;
+    boxKey: z.ZodString;
+} & {
+    name: z.ZodString;
+    platform: z.ZodOptional<z.ZodString>;
+    online: z.ZodBoolean;
+    /** How this device may reach it: it paired, or both belong to the same account. */
+    via: z.ZodEnum<["paired", "account"]>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    name: string;
+    online: boolean;
+    signKey: string;
+    boxKey: string;
+    via: "account" | "paired";
+    platform?: string | undefined;
+}, {
+    id: string;
+    name: string;
+    online: boolean;
+    signKey: string;
+    boxKey: string;
+    via: "account" | "paired";
+    platform?: string | undefined;
+}>;
+export type MachineEntry = z.infer<typeof machineEntrySchema>;
+export declare const deviceEntrySchema: z.ZodObject<{
+    id: z.ZodString;
+    signKey: z.ZodString;
+    boxKey: z.ZodString;
+} & {
+    name: z.ZodString;
+    online: z.ZodBoolean;
+    pairedAt: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    name: string;
+    online: boolean;
+    signKey: string;
+    boxKey: string;
+    pairedAt?: number | undefined;
+}, {
+    id: string;
+    name: string;
+    online: boolean;
+    signKey: string;
+    boxKey: string;
+    pairedAt?: number | undefined;
+}>;
+export type DeviceEntry = z.infer<typeof deviceEntrySchema>;
+export declare const clientFrameSchema: z.ZodDiscriminatedUnion<"t", [z.ZodObject<{
+    t: z.ZodLiteral<"auth">;
+    role: z.ZodEnum<["machine", "device"]>;
+    identity: z.ZodObject<{
+        id: z.ZodString;
+        signKey: z.ZodString;
+        boxKey: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        signKey: string;
+        boxKey: string;
+    }, {
+        id: string;
+        signKey: string;
+        boxKey: string;
+    }>;
+    signature: z.ZodString;
+    name: z.ZodString;
+    platform: z.ZodOptional<z.ZodString>;
+    /** Account access token, when signed in. */
+    token: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    role: "machine" | "device";
+    name: string;
+    t: "auth";
+    identity: {
+        id: string;
+        signKey: string;
+        boxKey: string;
+    };
+    signature: string;
+    platform?: string | undefined;
+    token?: string | undefined;
+}, {
+    role: "machine" | "device";
+    name: string;
+    t: "auth";
+    identity: {
+        id: string;
+        signKey: string;
+        boxKey: string;
+    };
+    signature: string;
+    platform?: string | undefined;
+    token?: string | undefined;
+}>, z.ZodObject<{
+    t: z.ZodLiteral<"req">;
+    id: z.ZodNumber;
+    method: z.ZodString;
+    params: z.ZodOptional<z.ZodUnknown>;
+}, "strip", z.ZodTypeAny, {
+    method: string;
+    id: number;
+    t: "req";
+    params?: unknown;
+}, {
+    method: string;
+    id: number;
+    t: "req";
+    params?: unknown;
+}>, z.ZodObject<{
+    t: z.ZodLiteral<"to">;
+    to: z.ZodString;
+    d: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    t: "to";
+    to: string;
+    d: string;
+}, {
+    t: "to";
+    to: string;
+    d: string;
+}>, z.ZodObject<{
+    t: z.ZodLiteral<"ping">;
+}, "strip", z.ZodTypeAny, {
+    t: "ping";
+}, {
+    t: "ping";
+}>]>;
+export type ClientFrame = z.infer<typeof clientFrameSchema>;
+export declare const serverFrameSchema: z.ZodDiscriminatedUnion<"t", [z.ZodObject<{
+    t: z.ZodLiteral<"challenge">;
+    nonce: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    t: "challenge";
+    nonce: string;
+}, {
+    t: "challenge";
+    nonce: string;
+}>, z.ZodObject<{
+    t: z.ZodLiteral<"ready">;
+    userId: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    t: "ready";
+    email?: string | undefined;
+    userId?: string | undefined;
+}, {
+    t: "ready";
+    email?: string | undefined;
+    userId?: string | undefined;
+}>, z.ZodObject<{
+    t: z.ZodLiteral<"res">;
+    id: z.ZodNumber;
+    result: z.ZodOptional<z.ZodUnknown>;
+    error: z.ZodOptional<z.ZodObject<{
+        code: z.ZodString;
+        message: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        code: string;
+        message: string;
+    }, {
+        code: string;
+        message: string;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    id: number;
+    t: "res";
+    error?: {
+        code: string;
+        message: string;
+    } | undefined;
+    result?: unknown;
+}, {
+    id: number;
+    t: "res";
+    error?: {
+        code: string;
+        message: string;
+    } | undefined;
+    result?: unknown;
+}>, z.ZodObject<{
+    t: z.ZodLiteral<"event">;
+    name: z.ZodString;
+    data: z.ZodUnknown;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    t: "event";
+    data?: unknown;
+}, {
+    name: string;
+    t: "event";
+    data?: unknown;
+}>, z.ZodObject<{
+    t: z.ZodLiteral<"from">;
+    from: z.ZodObject<{
+        id: z.ZodString;
+        signKey: z.ZodString;
+        boxKey: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        signKey: string;
+        boxKey: string;
+    }, {
+        id: string;
+        signKey: string;
+        boxKey: string;
+    }>;
+    via: z.ZodEnum<["paired", "account"]>;
+    d: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    t: "from";
+    via: "account" | "paired";
+    d: string;
+    from: {
+        id: string;
+        signKey: string;
+        boxKey: string;
+    };
+}, {
+    t: "from";
+    via: "account" | "paired";
+    d: string;
+    from: {
+        id: string;
+        signKey: string;
+        boxKey: string;
+    };
+}>, z.ZodObject<{
+    t: z.ZodLiteral<"undeliverable">;
+    to: z.ZodString;
+    reason: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    reason: string;
+    t: "undeliverable";
+    to: string;
+}, {
+    reason: string;
+    t: "undeliverable";
+    to: string;
+}>, z.ZodObject<{
+    t: z.ZodLiteral<"pong">;
+}, "strip", z.ZodTypeAny, {
+    t: "pong";
+}, {
+    t: "pong";
+}>, z.ZodObject<{
+    t: z.ZodLiteral<"error">;
+    code: z.ZodString;
+    message: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    message: string;
+    t: "error";
+}, {
+    code: string;
+    message: string;
+    t: "error";
+}>]>;
+export type ServerFrame = z.infer<typeof serverFrameSchema>;
+/** Control methods and their results. */
+export interface RelayMethods {
+    /** Machine: open a pairing window. The QR carries `secret`; the code is for typing. */
+    "pair.offer": {
+        params: {
+            secretHash?: string;
+        };
+        result: {
+            code: string;
+            expiresAt: number;
+        };
+    };
+    /** Machine: accept or refuse a claim it received as a `pair.request` event. */
+    "pair.decide": {
+        params: {
+            requestId: string;
+            accept: boolean;
+        };
+        result: Record<string, never>;
+    };
+    /** Device: claim a pairing by code (typed) or by machine id (scanned). */
+    "pair.claim": {
+        params: {
+            code?: string;
+            machineId?: string;
+            proof: string;
+        };
+        result: {
+            machine: MachineEntry;
+        };
+    };
+    "machines.list": {
+        params: Record<string, never>;
+        result: {
+            machines: MachineEntry[];
+        };
+    };
+    "machines.forget": {
+        params: {
+            machineId: string;
+        };
+        result: Record<string, never>;
+    };
+    "devices.list": {
+        params: Record<string, never>;
+        result: {
+            devices: DeviceEntry[];
+        };
+    };
+    "devices.revoke": {
+        params: {
+            deviceId: string;
+        };
+        result: Record<string, never>;
+    };
+}
+export type RelayMethod = keyof RelayMethods;
+/** Events the gateway pushes. */
+export interface RelayEvents {
+    /** To a machine: a device wants to pair. */
+    "pair.request": {
+        requestId: string;
+        device: PublicIdentity & {
+            name: string;
+        };
+        proof: string;
+        code: string;
+    };
+    /** To a machine: pairing finished (accepted or not). */
+    "pair.done": {
+        requestId: string;
+        accepted: boolean;
+        device?: DeviceEntry;
+    };
+    /** A reachable peer came online or went offline. */
+    presence: {
+        id: string;
+        online: boolean;
+    };
+    /** To a device: the list of reachable machines changed (paired, revoked, account). */
+    "machines.changed": Record<string, never>;
+}
+/**
+ * What `linkshell pair` puts in the QR code, kept short so the code stays
+ * scannable: the gateway, the machine's signing key (its id derives from it,
+ * and every channel is checked against it), a one-time secret and the code.
+ * The machine's name and box key come from the gateway; a wrong box key can't
+ * break a channel's secrecy because the ephemeral keys are signed.
+ */
+export interface PairingLink {
+    gateway: string;
+    signKey: string;
+    secret: string;
+    code: string;
+}
+export declare const PAIRING_LINK_PREFIX = "linkshell://pair?";
+export declare function encodePairingLink(link: PairingLink): string;
+export declare function decodePairingLink(text: string): PairingLink | undefined;
+/**
+ * Frames inside `to` / `from`. A device opens channel `ch` with `hello`, the
+ * machine answers `welcome`; both sign their ephemeral key with their
+ * long-term key, so neither can be impersonated by the gateway. After that
+ * every frame is `data`, sealed with the channel keys.
+ */
+export declare const tunnelFrameSchema: z.ZodDiscriminatedUnion<"k", [z.ZodObject<{
+    k: z.ZodLiteral<"hello">;
+    ch: z.ZodString;
+    eph: z.ZodString;
+    sig: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    k: "hello";
+    ch: string;
+    eph: string;
+    sig: string;
+}, {
+    k: "hello";
+    ch: string;
+    eph: string;
+    sig: string;
+}>, z.ZodObject<{
+    k: z.ZodLiteral<"welcome">;
+    ch: z.ZodString;
+    eph: z.ZodString;
+    sig: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    k: "welcome";
+    ch: string;
+    eph: string;
+    sig: string;
+}, {
+    k: "welcome";
+    ch: string;
+    eph: string;
+    sig: string;
+}>, z.ZodObject<{
+    k: z.ZodLiteral<"data">;
+    ch: z.ZodString;
+    box: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    k: "data";
+    ch: string;
+    box: string;
+}, {
+    k: "data";
+    ch: string;
+    box: string;
+}>, z.ZodObject<{
+    k: z.ZodLiteral<"close">;
+    ch: z.ZodString;
+    reason: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    k: "close";
+    ch: string;
+    reason?: string | undefined;
+}, {
+    k: "close";
+    ch: string;
+    reason?: string | undefined;
+}>, z.ZodObject<{
+    k: z.ZodLiteral<"refuse">;
+    ch: z.ZodString;
+    code: z.ZodString;
+    message: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    message: string;
+    k: "refuse";
+    ch: string;
+}, {
+    code: string;
+    message: string;
+    k: "refuse";
+    ch: string;
+}>]>;
+export type TunnelFrame = z.infer<typeof tunnelFrameSchema>;
+/** Device side: start a channel to `machine`. */
+export declare function openTunnel(device: Identity, machine: PublicIdentity, channel: string): {
+    hello: {
+        k: "hello";
+        ch: string;
+        eph: string;
+        sig: string;
+    };
+    /** Checks the machine's answer and returns the channel, or throws. */
+    accept(welcome: Extract<TunnelFrame, {
+        k: "welcome";
+    }>): SecureChannel;
+};
+/** Machine side: answer a device's hello. Throws when the signature is wrong. */
+export declare function answerTunnel(machine: Identity, device: PublicIdentity, hello: Extract<TunnelFrame, {
+    k: "hello";
+}>): {
+    welcome: {
+        k: "welcome";
+        ch: string;
+        eph: string;
+        sig: string;
+    };
+    channel: SecureChannel;
+};

package/dist/wire/src/relay.js

@@ -0,0 +1,129 @@
+import { z } from "zod";
+import { channelKeys, ephemeralKey, SecureChannel, sign, verifySignature, } from "./crypto.js";
+// Gateway v2 frames. The gateway authenticates peers by their keys, routes
+// opaque frames between a device and a machine it is allowed to reach, and
+// brokers pairing. Everything inside a routed frame is end-to-end encrypted:
+// the gateway never sees RPC, session content or terminal output.
+export const RELAY_PATH = "/v2/connect";
+export const publicIdentitySchema = z.object({ id: z.string(), signKey: z.string(), boxKey: z.string() });
+export const peerRoleSchema = z.enum(["machine", "device"]);
+/** A machine as a device sees it in the gateway's list. */
+export const machineEntrySchema = publicIdentitySchema.extend({
+    name: z.string(),
+    platform: z.string().optional(),
+    online: z.boolean(),
+    /** How this device may reach it: it paired, or both belong to the same account. */
+    via: z.enum(["paired", "account"]),
+});
+export const deviceEntrySchema = publicIdentitySchema.extend({
+    name: z.string(),
+    online: z.boolean(),
+    pairedAt: z.number().optional(),
+});
+// ── peer → gateway ───────────────────────────────────────────────────
+export const clientFrameSchema = z.discriminatedUnion("t", [
+    /** Answer to the challenge: a signature over it proves the key. */
+    z.object({
+        t: z.literal("auth"),
+        role: peerRoleSchema,
+        identity: publicIdentitySchema,
+        signature: z.string(),
+        name: z.string().max(120),
+        platform: z.string().max(40).optional(),
+        /** Account access token, when signed in. */
+        token: z.string().optional(),
+    }),
+    z.object({ t: z.literal("req"), id: z.number().int(), method: z.string(), params: z.unknown().optional() }),
+    /** An encrypted frame for a peer. */
+    z.object({ t: z.literal("to"), to: z.string(), d: z.string().max(40 * 1024 * 1024) }),
+    z.object({ t: z.literal("ping") }),
+]);
+// ── gateway → peer ───────────────────────────────────────────────────
+export const serverFrameSchema = z.discriminatedUnion("t", [
+    z.object({ t: z.literal("challenge"), nonce: z.string() }),
+    z.object({ t: z.literal("ready"), userId: z.string().optional(), email: z.string().optional() }),
+    z.object({
+        t: z.literal("res"),
+        id: z.number().int(),
+        result: z.unknown().optional(),
+        error: z.object({ code: z.string(), message: z.string() }).optional(),
+    }),
+    z.object({ t: z.literal("event"), name: z.string(), data: z.unknown() }),
+    /** An encrypted frame from a peer, with the keys the gateway verified it holds. */
+    z.object({ t: z.literal("from"), from: publicIdentitySchema, via: z.enum(["paired", "account"]), d: z.string() }),
+    /** A frame couldn't be delivered: the peer is offline or not reachable. */
+    z.object({ t: z.literal("undeliverable"), to: z.string(), reason: z.string() }),
+    z.object({ t: z.literal("pong") }),
+    z.object({ t: z.literal("error"), code: z.string(), message: z.string() }),
+]);
+export const PAIRING_LINK_PREFIX = "linkshell://pair?";
+export function encodePairingLink(link) {
+    const params = new URLSearchParams({ g: link.gateway, k: link.signKey, s: link.secret, c: link.code });
+    return PAIRING_LINK_PREFIX + params.toString();
+}
+export function decodePairingLink(text) {
+    const trimmed = text.trim();
+    if (!trimmed.startsWith(PAIRING_LINK_PREFIX))
+        return undefined;
+    const params = new URLSearchParams(trimmed.slice(PAIRING_LINK_PREFIX.length));
+    const gateway = params.get("g");
+    const signKey = params.get("k");
+    const secret = params.get("s");
+    const code = params.get("c");
+    if (!gateway || !signKey || !secret || !code || !/^(wss?|https?):\/\//.test(gateway))
+        return undefined;
+    return { gateway, signKey, secret, code };
+}
+// ── end-to-end channel over the relay ────────────────────────────────
+/**
+ * Frames inside `to` / `from`. A device opens channel `ch` with `hello`, the
+ * machine answers `welcome`; both sign their ephemeral key with their
+ * long-term key, so neither can be impersonated by the gateway. After that
+ * every frame is `data`, sealed with the channel keys.
+ */
+export const tunnelFrameSchema = z.discriminatedUnion("k", [
+    z.object({ k: z.literal("hello"), ch: z.string(), eph: z.string(), sig: z.string() }),
+    z.object({ k: z.literal("welcome"), ch: z.string(), eph: z.string(), sig: z.string() }),
+    z.object({ k: z.literal("data"), ch: z.string(), box: z.string() }),
+    z.object({ k: z.literal("close"), ch: z.string(), reason: z.string().optional() }),
+    z.object({ k: z.literal("refuse"), ch: z.string(), code: z.string(), message: z.string() }),
+]);
+function helloMessage(kind, channel, from, to, eph) {
+    return `linkshell-tunnel-v2:${kind}:${channel}:${from}:${to}:${eph}`;
+}
+/** Device side: start a channel to `machine`. */
+export function openTunnel(device, machine, channel) {
+    const eph = ephemeralKey();
+    const hello = {
+        k: "hello",
+        ch: channel,
+        eph: eph.public,
+        sig: sign(device, helloMessage("hello", channel, device.id, machine.id, eph.public)),
+    };
+    return {
+        hello,
+        /** Checks the machine's answer and returns the channel, or throws. */
+        accept(welcome) {
+            if (!verifySignature(machine.signKey, helloMessage("welcome", channel, machine.id, device.id, welcome.eph), welcome.sig)) {
+                throw new Error("the computer's key doesn't match: refusing to connect");
+            }
+            return new SecureChannel(channelKeys({ initiator: true, local: device, localEphemeral: eph.secret, remoteBoxKey: machine.boxKey, remoteEphemeral: welcome.eph }));
+        },
+    };
+}
+/** Machine side: answer a device's hello. Throws when the signature is wrong. */
+export function answerTunnel(machine, device, hello) {
+    if (!verifySignature(device.signKey, helloMessage("hello", hello.ch, device.id, machine.id, hello.eph), hello.sig)) {
+        throw new Error("bad hello signature");
+    }
+    const eph = ephemeralKey();
+    const welcome = {
+        k: "welcome",
+        ch: hello.ch,
+        eph: eph.public,
+        sig: sign(machine, helloMessage("welcome", hello.ch, machine.id, device.id, eph.public)),
+    };
+    const channel = new SecureChannel(channelKeys({ initiator: false, local: machine, localEphemeral: eph.secret, remoteBoxKey: device.boxKey, remoteEphemeral: hello.eph }));
+    return { welcome, channel };
+}
+//# sourceMappingURL=relay.js.map

package/dist/wire/src/relay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay.js","sourceRoot":"","sources":["../../../../wire/src/relay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,aAAa,EACb,IAAI,EACJ,eAAe,GAGhB,MAAM,aAAa,CAAC;AAErB,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,kEAAkE;AAElE,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC;AAExC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE1G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAG5D,2DAA2D;AAC3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,MAAM,CAAC;IAC5D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,mFAAmF;IACnF,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;CACnC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,CAAC;IAC3D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH,wEAAwE;AAExE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE;IACzD,mEAAmE;IACnE,CAAC,CAAC,MAAM,CAAC;QACP,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,oBAAoB;QAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;QACvC,4CAA4C;QAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;IACF,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC3G,qCAAqC;IACrC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;IACrF,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;CACnC,CAAC,CAAC;AAGH,wEAAwE;AAExE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE;IACzD,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC1D,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IAChG,CAAC,CAAC,MAAM,CAAC;QACP,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACnB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACpB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;KACtE,CAAC;IACF,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;IACxE,mFAAmF;IACnF,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACjH,2EAA2E;IAC3E,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/E,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IAClC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CAC3E,CAAC,CAAC;AA+CH,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEvD,MAAM,UAAU,iBAAiB,CAAC,IAAiB;IACjD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACvG,OAAO,mBAAmB,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACvG,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE;IACzD,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACrF,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACvF,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACnE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IAClF,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CAC5F,CAAC,CAAC;AAGH,SAAS,YAAY,CAAC,IAAyB,EAAE,OAAe,EAAE,IAAY,EAAE,EAAU,EAAE,GAAW;IACrG,OAAO,uBAAuB,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;AACvE,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,UAAU,CAAC,MAAgB,EAAE,OAAuB,EAAE,OAAe;IACnF,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAgB;QACzB,CAAC,EAAE,OAAO;QACV,EAAE,EAAE,OAAO;QACX,GAAG,EAAE,GAAG,CAAC,MAAM;QACf,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KACrF,CAAC;IACF,OAAO;QACL,KAAK;QACL,sEAAsE;QACtE,MAAM,CAAC,OAA+C;YACpD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzH,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,IAAI,aAAa,CACtB,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CACxI,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,OAAiB,EAAE,MAAsB,EAAE,KAA2C;IACjH,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnH,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAgB;QAC3B,CAAC,EAAE,SAAS;QACZ,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,GAAG,EAAE,GAAG,CAAC,MAAM;QACf,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KACzF,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,aAAa,CAC/B,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CACvI,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC"}