sandstream-kit 1.0.0

package/dist/elevation.js

@@ -0,0 +1,449 @@
+/**
+ * Elevation gate for destructive secret operations.
+ *
+ * User requirement: agents (or unauthorized humans) must not be able to
+ * rotate / migrate / propagate / register-fake a key without an explicit
+ * human-loop confirmation. This module provides:
+ *
+ *   1. A short-lived elevation marker (`.kit/elevation.json`) with TTL,
+ *      created by `kit auth elevate`.
+ *   2. Optional TOTP (RFC 6238) verification when `KIT_TOTP_SECRET` is set.
+ *      Without TOTP, falls back to a plain interactive "YES" prompt.
+ *   3. A `requireElevation()` check that destructive ops call before running.
+ *      In non-interactive / agent contexts: fails closed unless
+ *      `KIT_ELEVATED=1` is set (CI escape hatch — gets audit-logged loudly
+ *      so a leaked CI env doesn't silently bypass).
+ */
+import { readFile, writeFile, mkdir, access } from "node:fs/promises";
+import { resolve, dirname } from "node:path";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { appendAuditEventDirect } from "./audit.js";
+const ELEVATION_FILE = ".kit/elevation.json";
+const DEFAULT_TTL_MINUTES = 15;
+/**
+ * Scopes that, when granted, MUST be consumed (atomically deleted) on use.
+ * One elevation = one destructive operation. Rotation modes that need a
+ * follow-up rollback path (scoped-key-mint) are intentionally absent — they
+ * retain the standard 15-min TTL because the rollback re-uses the marker.
+ */
+const ONE_SHOT_SCOPES = new Set([
+    "jwt-secret-roll",
+    "purge-history",
+    "onecli-register",
+]);
+export function isOneShotScope(scope) {
+    return ONE_SHOT_SCOPES.has(scope);
+}
+/**
+ * Loud one-time stderr warning for the CI escape hatch. Emitted once per
+ * process so a single `kit secrets rotate ... ` invocation doesn't spam,
+ * but the operator sees it on stderr even when stdout is captured.
+ */
+let warnedAboutCiBypass = false;
+function warnCiBypassOnce(operation) {
+    if (warnedAboutCiBypass)
+        return;
+    warnedAboutCiBypass = true;
+    console.error(`[kit] WARNING: KIT_ELEVATED=1 is bypassing the TTY elevation gate for "${operation}". This is logged to .kit-audit.jsonl.`);
+}
+/**
+ * Records every elevation decision — granted or refused — to the local
+ * audit log. Returns true on success; false means the audit-log itself
+ * couldn't be written, which the caller treats as a refusal-to-elevate.
+ *
+ * Audit-log write must succeed before destructive ops proceed. The
+ * "always-allow if audit-log down" pattern is exactly the silent-bypass
+ * we're closing.
+ */
+async function auditElevationDecision(operation, granted, reason, method, cwd) {
+    return appendAuditEventDirect({
+        operation: "elevation-check",
+        environment: process.env.KIT_ENV ?? process.env.NODE_ENV ?? "unknown",
+        success: granted,
+        metadata: {
+            requested_scope: operation,
+            method,
+            reason,
+            granter: process.env.USER ?? "unknown",
+        },
+    }, { cwd });
+}
+// ── Marker signing ───────────────────────────────────────────────────────────
+//
+// The elevation marker lives in the PROJECT dir (.kit/elevation.json). Without
+// a signature, any process that can write that file could forge elevation and
+// bypass the TOTP/human gate entirely. We HMAC-sign the marker with a key kept
+// OUTSIDE the project, in ~/.kit/elevation.key (0600). A process sandboxed to
+// the project (the agent threat model) can write the marker but cannot read the
+// key, so it cannot produce a valid signature.
+const ELEVATION_KEY_REL = ".kit/elevation.key";
+function elevationKeyPath() {
+    return `${_homedir()}/${ELEVATION_KEY_REL}`;
+}
+/** Machine-local HMAC key, created once (0600). Create is atomic (flag "wx"):
+ *  on a lost create race the winner's key is re-read, so all callers agree. */
+async function getElevationSigningKey() {
+    const keyPath = elevationKeyPath();
+    try {
+        const hex = (await readFile(keyPath, "utf-8")).trim();
+        if (hex.length >= 64)
+            return Buffer.from(hex, "hex");
+    }
+    catch {
+        /* fall through to create */
+    }
+    const key = randomBytes(32);
+    await mkdir(dirname(keyPath), { recursive: true });
+    try {
+        await writeFile(keyPath, key.toString("hex") + "\n", { encoding: "utf-8", mode: 0o600, flag: "wx" });
+        return key;
+    }
+    catch {
+        const hex = (await readFile(keyPath, "utf-8")).trim();
+        return Buffer.from(hex, "hex");
+    }
+}
+/** Canonical signed form — stable field order, excludes the signature itself. */
+function elevationPayload(state) {
+    return JSON.stringify({
+        expiresAt: state.expiresAt,
+        scope: state.scope,
+        granter: state.granter,
+        method: state.method,
+    });
+}
+async function signElevation(state) {
+    const key = await getElevationSigningKey();
+    return createHmac("sha256", key).update(elevationPayload(state)).digest("hex");
+}
+async function verifyElevationSig(state, sig) {
+    if (!sig)
+        return false;
+    const expected = Buffer.from(await signElevation(state), "hex");
+    let actual;
+    try {
+        actual = Buffer.from(sig, "hex");
+    }
+    catch {
+        return false;
+    }
+    return expected.length === actual.length && timingSafeEqual(expected, actual);
+}
+export async function readElevation(cwd = process.cwd()) {
+    const path = resolve(cwd, ELEVATION_FILE);
+    try {
+        await access(path);
+        const text = await readFile(path, "utf-8");
+        const parsed = JSON.parse(text);
+        if (!parsed.expiresAt || !parsed.scope)
+            return null;
+        const state = {
+            expiresAt: parsed.expiresAt,
+            scope: parsed.scope,
+            granter: parsed.granter ?? "unknown",
+            method: parsed.method ?? "yes-prompt",
+        };
+        // Reject unsigned / tampered / forged markers — only an HMAC signed with the
+        // machine-local key is honored. This is what makes the gate unforgeable.
+        if (!(await verifyElevationSig(state, parsed.sig ?? "")))
+            return null;
+        return state;
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeElevation(state, cwd = process.cwd()) {
+    const path = resolve(cwd, ELEVATION_FILE);
+    await mkdir(dirname(path), { recursive: true });
+    const sig = await signElevation(state);
+    await writeFile(path, JSON.stringify({ ...state, sig }, null, 2) + "\n", "utf-8");
+}
+export async function clearElevation(cwd = process.cwd()) {
+    const path = resolve(cwd, ELEVATION_FILE);
+    try {
+        const { rm } = await import("node:fs/promises");
+        await rm(path);
+    }
+    catch {
+        /* nothing to clear */
+    }
+}
+/**
+ * Returns true if an unexpired elevation marker exists that covers the
+ * requested operation scope.
+ */
+export async function isElevated(operation, cwd = process.cwd()) {
+    const state = await readElevation(cwd);
+    if (!state)
+        return false;
+    const expires = Date.parse(state.expiresAt);
+    if (!Number.isFinite(expires) || expires < Date.now()) {
+        return false;
+    }
+    return state.scope === "all" || state.scope === operation;
+}
+export function elevationTtlMinutes() {
+    const env = process.env.KIT_ELEVATION_TTL_MINUTES;
+    if (env) {
+        const n = parseInt(env, 10);
+        if (Number.isFinite(n) && n > 0 && n <= 240)
+            return n;
+    }
+    return DEFAULT_TTL_MINUTES;
+}
+/**
+ * Mints a fresh elevation marker covering `scope` for the configured TTL.
+ * Caller is responsible for prompting / verifying the user before calling.
+ */
+export async function grantElevation(scope, method, cwd = process.cwd(), granter = process.env.USER || "unknown") {
+    // Read-only mode: refuse before writing the elevation marker. Granting
+    // elevation IS a write — without this gate a read-only session could
+    // still mint a marker for a subsequent destructive op.
+    const { isReadOnlyMode, refuseWrite } = await import("./read-only-mode.js");
+    if (isReadOnlyMode()) {
+        const refusal = await refuseWrite("grant-elevation", { scope, method });
+        throw new Error(refusal.reason);
+    }
+    const expiresAt = new Date(Date.now() + elevationTtlMinutes() * 60_000).toISOString();
+    const state = { expiresAt, scope, granter, method };
+    await writeElevation(state, cwd);
+    return state;
+}
+// ── TOTP enrollment ─────────────────────────────────────────────────────────
+//
+// `kit auth setup-totp` generates a fresh base32 secret, writes it to
+// ~/.kit/totp-secret (chmod 0o600 so other users can't read it), and
+// prints the otpauth provisioning URI for the user's authenticator app.
+// The secret only ever exists on disk in that one file; the elevation
+// flow reads it via `KIT_TOTP_SECRET` env var (or the new helper that
+// reads the file when the env var is unset).
+import { homedir as _homedir } from "node:os";
+const TOTP_FILE_REL = ".kit/totp-secret";
+function totpFilePath() {
+    return `${_homedir()}/${TOTP_FILE_REL}`;
+}
+export function generateBase32Secret(byteLength = 20) {
+    // ESM-friendly — reuse the top-level import.
+    const bytes = randomBytes(byteLength);
+    // RFC 4648 base32 (no padding) — same alphabet TOTP libs expect.
+    let bits = "";
+    for (const b of bytes)
+        bits += b.toString(2).padStart(8, "0");
+    let out = "";
+    for (let i = 0; i + 5 <= bits.length; i += 5) {
+        out += BASE32_ALPHABET[parseInt(bits.slice(i, i + 5), 2)];
+    }
+    return out;
+}
+export function buildOtpAuthUri(input) {
+    const issuer = input.issuer ?? "kit";
+    const label = `${encodeURIComponent(issuer)}:${encodeURIComponent(input.accountName)}`;
+    const params = new URLSearchParams({
+        secret: input.secret,
+        issuer,
+        algorithm: "SHA1",
+        digits: "6",
+        period: "30",
+    });
+    return `otpauth://totp/${label}?${params.toString()}`;
+}
+export async function enrollTotp(opts) {
+    const { writeFile, mkdir, access } = await import("node:fs/promises");
+    const { dirname } = await import("node:path");
+    const filePath = totpFilePath();
+    // Guard against silently overwriting an existing enrollment — that
+    // would invalidate the user's already-registered authenticator entry.
+    let exists = false;
+    try {
+        await access(filePath);
+        exists = true;
+    }
+    catch {
+        exists = false;
+    }
+    if (exists && !opts.overwrite) {
+        throw new Error(`TOTP secret already enrolled at ${filePath}. Pass overwrite=true to replace it (your old authenticator entry will stop working).`);
+    }
+    const secret = generateBase32Secret(20);
+    const uri = buildOtpAuthUri({
+        accountName: opts.accountName,
+        issuer: opts.issuer,
+        secret,
+    });
+    await mkdir(dirname(filePath), { recursive: true });
+    await writeFile(filePath, secret + "\n", { encoding: "utf-8", mode: 0o600 });
+    return {
+        secret,
+        filePath,
+        uri,
+        currentCode: generateTotp(secret),
+    };
+}
+/**
+ * Resolves the TOTP secret in priority order:
+ *   1. `KIT_TOTP_SECRET` env var (overrides everything; useful for CI)
+ *   2. `~/.kit/totp-secret` file (created by `kit auth setup-totp`)
+ *   3. undefined — caller falls back to yes-prompt
+ */
+export async function resolveTotpSecret() {
+    if (process.env.KIT_TOTP_SECRET)
+        return process.env.KIT_TOTP_SECRET;
+    try {
+        const { readFile } = await import("node:fs/promises");
+        const content = await readFile(totpFilePath(), "utf-8");
+        return content.trim() || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+// ── TOTP (RFC 6238) ─────────────────────────────────────────────────────────
+//
+// Minimal implementation so we don't add an npm dep for a 30-line algorithm.
+// Accepts base32-encoded secret in `KIT_TOTP_SECRET`. 6-digit codes,
+// 30-second period, SHA-1 — matches Google Authenticator / 1Password / Authy.
+const BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+function base32Decode(input) {
+    const cleaned = input.toUpperCase().replace(/=+$/, "").replace(/\s+/g, "");
+    let bits = "";
+    for (const ch of cleaned) {
+        const idx = BASE32_ALPHABET.indexOf(ch);
+        if (idx < 0)
+            throw new Error(`invalid base32 char: ${ch}`);
+        bits += idx.toString(2).padStart(5, "0");
+    }
+    const bytes = [];
+    for (let i = 0; i + 8 <= bits.length; i += 8) {
+        bytes.push(parseInt(bits.slice(i, i + 8), 2));
+    }
+    return Buffer.from(bytes);
+}
+export function generateTotp(secretBase32, step = Math.floor(Date.now() / 1000 / 30)) {
+    const secret = base32Decode(secretBase32);
+    const counter = Buffer.alloc(8);
+    // Big-endian uint64. step fits in uint32 for the next ~136 years, so write
+    // the high word as zero.
+    counter.writeUInt32BE(0, 0);
+    counter.writeUInt32BE(step >>> 0, 4);
+    const hmac = createHmac("sha1", secret).update(counter).digest();
+    const offset = hmac[hmac.length - 1] & 0x0f;
+    const bin = ((hmac[offset] & 0x7f) << 24) |
+        ((hmac[offset + 1] & 0xff) << 16) |
+        ((hmac[offset + 2] & 0xff) << 8) |
+        (hmac[offset + 3] & 0xff);
+    return (bin % 1_000_000).toString().padStart(6, "0");
+}
+/**
+ * Verifies a user-supplied TOTP. Accepts the current step ± 1 (handles minor
+ * clock skew, ±30s window). Uses timingSafeEqual for the digit comparison —
+ * both sides are fixed 6-ASCII-digit strings, so lengths always match.
+ */
+export function verifyTotp(code, secretBase32, windowSteps = 1) {
+    if (!/^\d{6}$/.test(code))
+        return false;
+    const codeBuf = Buffer.from(code, "ascii");
+    const now = Math.floor(Date.now() / 1000 / 30);
+    for (let delta = -windowSteps; delta <= windowSteps; delta++) {
+        const expected = Buffer.from(generateTotp(secretBase32, now + delta), "ascii");
+        if (expected.length === codeBuf.length && timingSafeEqual(expected, codeBuf))
+            return true;
+    }
+    return false;
+}
+/**
+ * Throws (or returns false in nice mode) when the active context isn't
+ * elevated for `operation`. Used by every destructive secrets-* command.
+ *
+ * Order of resolution:
+ *   1. `KIT_ELEVATED=1` env var (CI escape hatch).
+ *   2. A live elevation marker covering the operation.
+ *   3. Otherwise: not elevated.
+ *
+ * Every decision — granted or refused — emits an audit-log entry before
+ * returning. If the audit-log write itself fails, the call returns
+ * `{ ok: false }` even if the credential would otherwise be granted. The
+ * intent is: a code path that runs destructive ops must always leave a
+ * forensic trail; "audit-log down" is treated identically to "elevation
+ * refused" so the silent-bypass property is eliminated.
+ */
+export async function requireElevation(operation, cwd = process.cwd()) {
+    const decide = async (ok, reason, method) => {
+        const audited = await auditElevationDecision(operation, ok, reason, method, cwd);
+        if (ok && !audited) {
+            return {
+                ok: false,
+                reason: "audit-log unavailable; refusing elevation (fail-closed)",
+            };
+        }
+        return { ok, reason };
+    };
+    if (process.env.KIT_ELEVATED === "1") {
+        warnCiBypassOnce(operation);
+        return decide(true, "KIT_ELEVATED=1 (CI escape hatch)", "ci-env");
+    }
+    const state = await readElevation(cwd);
+    if (!state) {
+        return decide(false, `No elevation marker. Run 'kit auth elevate --scope ${operation}' first.`, "none");
+    }
+    const expires = Date.parse(state.expiresAt);
+    if (!Number.isFinite(expires) || expires < Date.now()) {
+        return decide(false, "Elevation marker expired. Run 'kit auth elevate' again.", state.method);
+    }
+    if (state.scope !== "all" && state.scope !== operation) {
+        return decide(false, `Elevation covers scope="${state.scope}" but operation requires "${operation}".`, state.method);
+    }
+    return decide(true, `Elevated by ${state.granter} via ${state.method} until ${state.expiresAt}`, state.method);
+}
+/**
+ * One-shot elevation: same gate as `requireElevation`, but the underlying
+ * marker is **deleted** immediately on successful use. Used for scopes that
+ * must not be reusable within their TTL window (jwt-secret-roll, etc).
+ *
+ * The KIT_ELEVATED=1 escape hatch is allowed once per process — after
+ * the first consume call the module-scoped `consumedInProcess` flag prevents
+ * the same env var from re-grant the same scope on a subsequent call in the
+ * same invocation. This matches the "one auth, one destructive op" intent.
+ */
+const consumedInProcess = new Set();
+export async function consumeElevation(operation, cwd = process.cwd()) {
+    if (consumedInProcess.has(operation)) {
+        const reason = `Elevation for "${operation}" already consumed in this process. Re-run 'kit auth elevate' for another one-shot op.`;
+        await auditElevationDecision(operation, false, reason, "none", cwd);
+        return { ok: false, reason };
+    }
+    const result = await requireElevation(operation, cwd);
+    if (!result.ok)
+        return result;
+    // Atomic cross-process claim: rename the marker so exactly one caller wins.
+    // Two concurrent invocations can both pass requireElevation (read), but only
+    // one rename succeeds — the loser finds the marker gone and is refused, so one
+    // human elevation authorizes exactly one one-shot op. Env-var (KIT_ELEVATED)
+    // grants have no marker file; the rename fails and is allowed (explicit CI
+    // escape hatch).
+    const markerPath = resolve(cwd, ELEVATION_FILE);
+    try {
+        const { rename, rm } = await import("node:fs/promises");
+        await rename(markerPath, `${markerPath}.consumed`);
+        await rm(`${markerPath}.consumed`).catch(() => { });
+    }
+    catch {
+        if (process.env.KIT_ELEVATED !== "1") {
+            const reason = `Elevation for "${operation}" was already consumed by a concurrent process.`;
+            await auditElevationDecision(operation, false, reason, "none", cwd);
+            return { ok: false, reason };
+        }
+    }
+    consumedInProcess.add(operation);
+    return result;
+}
+/**
+ * Test-only: reset the in-process consumed-scope set. Public so tests can
+ * exercise the one-shot semantics deterministically without spawning new
+ * processes.
+ */
+export function _resetConsumedElevationForTests() {
+    consumedInProcess.clear();
+    warnedAboutCiBypass = false;
+}
+//# sourceMappingURL=elevation.js.map

package/dist/elevation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"elevation.js","sourceRoot":"","sources":["../src/elevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAC7C,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACnD,iBAAiB;IACjB,eAAe;IACf,iBAAiB;CAClB,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAChC,SAAS,gBAAgB,CAAC,SAAiB;IACzC,IAAI,mBAAmB;QAAE,OAAO;IAChC,mBAAmB,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,KAAK,CACX,0EAA0E,SAAS,wCAAwC,CAC5H,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,sBAAsB,CACnC,SAAiB,EACjB,OAAgB,EAChB,MAAc,EACd,MAAoD,EACpD,GAAW;IAEX,OAAO,sBAAsB,CAC3B;QACE,SAAS,EAAE,iBAAiB;QAC5B,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,SAAS;QACrE,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE;YACR,eAAe,EAAE,SAAS;YAC1B,MAAM;YACN,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,SAAS;SACvC;KACF,EACD,EAAE,GAAG,EAAE,CACR,CAAC;AACJ,CAAC;AASD,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,+CAA+C;AAE/C,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAE/C,SAAS,gBAAgB;IACvB,OAAO,GAAG,QAAQ,EAAE,IAAI,iBAAiB,EAAE,CAAC;AAC9C,CAAC;AAED;+EAC+E;AAC/E,KAAK,UAAU,sBAAsB;IACnC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;IAC9B,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrG,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,KAAqB;IAC7C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAqB;IAChD,MAAM,GAAG,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC3C,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAAqB,EAAE,GAAW;IAClE,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IAChE,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA+C,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,KAAK,GAAmB;YAC5B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS;YACpC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,YAAY;SACtC,CAAC;QACF,6EAA6E;QAC7E,yEAAyE;QACzE,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAqB,EACrB,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAChD,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAClD,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,MAAgC,EAChC,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,UAAkB,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,SAAS;IAE/C,uEAAuE;IACvE,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC5E,IAAI,cAAc,EAAE,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IACtF,MAAM,KAAK,GAAmB,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACpE,MAAM,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,sEAAsE;AACtE,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,sEAAsE;AACtE,6CAA6C;AAE7C,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE9C,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAEzC,SAAS,YAAY;IACnB,OAAO,GAAG,QAAQ,EAAE,IAAI,aAAa,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,aAAqB,EAAE;IAC1D,6CAA6C;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACtC,iEAAiE;IACjE,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAWD,MAAM,UAAU,eAAe,CAAC,KAAsB;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;IACvF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM;QACN,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,IAAI;KACb,CAAC,CAAC;IACH,OAAO,kBAAkB,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACxD,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAIhC;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACtE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAEhC,mEAAmE;IACnE,sEAAsE;IACtE,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,mCAAmC,QAAQ,uFAAuF,CACnI,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,eAAe,CAAC;QAC1B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE7E,OAAO;QACL,MAAM;QACN,QAAQ;QACR,GAAG;QACH,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC;QACxD,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,6EAA6E;AAC7E,qEAAqE;AACrE,8EAA8E;AAE9E,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAE3D,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3E,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,YAAoB,EACpB,OAAe,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,CAAC;IAEjD,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,2EAA2E;IAC3E,yBAAyB;IACzB,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,OAAO,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5C,MAAM,GAAG,GACP,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,YAAoB,EACpB,cAAsB,CAAC;IAEvB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;IAC/C,KAAK,IAAI,KAAK,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,GAAG,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/E,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAiB,EACjB,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,MAAM,GAAG,KAAK,EAClB,EAAW,EACX,MAAc,EACd,MAAoD,EACV,EAAE;QAC5C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACjF,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,yDAAyD;aAClE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IACxB,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,GAAG,EAAE,CAAC;QACrC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC5B,OAAO,MAAM,CACX,IAAI,EACJ,kCAAkC,EAClC,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CACX,KAAK,EACL,sDAAsD,SAAS,UAAU,EACzE,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACtD,OAAO,MAAM,CACX,KAAK,EACL,yDAAyD,EACzD,KAAK,CAAC,MAAM,CACb,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,MAAM,CACX,KAAK,EACL,2BAA2B,KAAK,CAAC,KAAK,6BAA6B,SAAS,IAAI,EAChF,KAAK,CAAC,MAAM,CACb,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CACX,IAAI,EACJ,eAAe,KAAK,CAAC,OAAO,QAAQ,KAAK,CAAC,MAAM,UAAU,KAAK,CAAC,SAAS,EAAE,EAC3E,KAAK,CAAC,MAAM,CACb,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAgB,IAAI,GAAG,EAAE,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAiB,EACjB,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,kBAAkB,SAAS,wFAAwF,CAAC;QACnI,MAAM,sBAAsB,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAE9B,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,2EAA2E;IAC3E,iBAAiB;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,UAAU,EAAE,GAAG,UAAU,WAAW,CAAC,CAAC;QACnD,MAAM,EAAE,CAAC,GAAG,UAAU,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,GAAG,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,kBAAkB,SAAS,iDAAiD,CAAC;YAC5F,MAAM,sBAAsB,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B;IAC7C,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAC1B,mBAAmB,GAAG,KAAK,CAAC;AAC9B,CAAC"}

package/dist/env-diff.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Compare two .env-style files (or local vs vault state) and surface drift.
+ *
+ * Used by `kit env diff --compare staging` to spot when a developer's
+ * local .env.local has drifted from .env.staging — common cause of bugs
+ * that only reproduce in one environment.
+ *
+ * Reads via the existing planMigration() path so we honor the same KEY=VALUE
+ * parsing (quote-stripping, comment skipping, validation). Output is a
+ * diff-summary: only-in-A, only-in-B, value-different-keys. Values
+ * themselves are NEVER printed — only key-presence + a hash-prefix to
+ * confirm they differ.
+ */
+export interface EnvDiffResult {
+    onlyInA: string[];
+    onlyInB: string[];
+    /** Keys present in both with different values. */
+    changed: Array<{
+        key: string;
+        aHash: string;
+        bHash: string;
+    }>;
+    /** Keys with identical values (rendered only as count). */
+    identicalCount: number;
+}
+export declare function diffEnvFiles(pathA: string, pathB: string, cwd?: string): Promise<EnvDiffResult>;
+export declare function formatEnvDiff(diff: EnvDiffResult, labelA: string, labelB: string): string;

package/dist/env-diff.js

@@ -0,0 +1,104 @@
+/**
+ * Compare two .env-style files (or local vs vault state) and surface drift.
+ *
+ * Used by `kit env diff --compare staging` to spot when a developer's
+ * local .env.local has drifted from .env.staging — common cause of bugs
+ * that only reproduce in one environment.
+ *
+ * Reads via the existing planMigration() path so we honor the same KEY=VALUE
+ * parsing (quote-stripping, comment skipping, validation). Output is a
+ * diff-summary: only-in-A, only-in-B, value-different-keys. Values
+ * themselves are NEVER printed — only key-presence + a hash-prefix to
+ * confirm they differ.
+ */
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { createHash } from "node:crypto";
+import { isValidKeyName } from "./secrets-migrate.js";
+async function parseEnvFile(path) {
+    const out = new Map();
+    let text;
+    try {
+        text = await readFile(path, "utf-8");
+    }
+    catch {
+        return out;
+    }
+    for (const rawLine of text.split("\n")) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const eq = line.indexOf("=");
+        if (eq <= 0)
+            continue;
+        const key = line.slice(0, eq).trim();
+        let value = line.slice(eq + 1).trim();
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        if (!isValidKeyName(key))
+            continue;
+        out.set(key, value);
+    }
+    return out;
+}
+function hashPrefix(value) {
+    return createHash("sha256").update(value).digest("hex").slice(0, 8);
+}
+export async function diffEnvFiles(pathA, pathB, cwd = process.cwd()) {
+    const a = await parseEnvFile(resolve(cwd, pathA));
+    const b = await parseEnvFile(resolve(cwd, pathB));
+    const onlyInA = [];
+    const onlyInB = [];
+    const changed = [];
+    let identicalCount = 0;
+    for (const [k, vA] of a) {
+        if (!b.has(k)) {
+            onlyInA.push(k);
+        }
+        else {
+            const vB = b.get(k);
+            if (vA === vB)
+                identicalCount++;
+            else
+                changed.push({ key: k, aHash: hashPrefix(vA), bHash: hashPrefix(vB) });
+        }
+    }
+    for (const k of b.keys()) {
+        if (!a.has(k))
+            onlyInB.push(k);
+    }
+    onlyInA.sort();
+    onlyInB.sort();
+    changed.sort((x, y) => x.key.localeCompare(y.key));
+    return { onlyInA, onlyInB, changed, identicalCount };
+}
+export function formatEnvDiff(diff, labelA, labelB) {
+    const lines = [];
+    lines.push(`env-diff ${labelA} vs ${labelB}`);
+    lines.push("─".repeat(50));
+    lines.push("");
+    if (diff.changed.length > 0) {
+        lines.push(`Changed (${diff.changed.length}):`);
+        for (const c of diff.changed) {
+            lines.push(`  ⚠  ${c.key}  ${labelA}=${c.aHash}…  ${labelB}=${c.bHash}…`);
+        }
+        lines.push("");
+    }
+    if (diff.onlyInA.length > 0) {
+        lines.push(`Only in ${labelA} (${diff.onlyInA.length}):`);
+        for (const k of diff.onlyInA)
+            lines.push(`  +  ${k}`);
+        lines.push("");
+    }
+    if (diff.onlyInB.length > 0) {
+        lines.push(`Only in ${labelB} (${diff.onlyInB.length}):`);
+        for (const k of diff.onlyInB)
+            lines.push(`  -  ${k}`);
+        lines.push("");
+    }
+    lines.push(`Identical keys: ${diff.identicalCount}`);
+    return lines.join("\n");
+}
+//# sourceMappingURL=env-diff.js.map

package/dist/env-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-diff.js","sourceRoot":"","sources":["../src/env-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAWtD,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAa,EACb,KAAa,EACb,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAClD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAyD,EAAE,CAAC;IACzE,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,KAAK,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;YACrB,IAAI,EAAE,KAAK,EAAE;gBAAE,cAAc,EAAE,CAAC;;gBAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,CAAC,IAAI,EAAE,CAAC;IACf,OAAO,CAAC,IAAI,EAAE,CAAC;IACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,IAAmB,EACnB,MAAc,EACd,MAAc;IAEd,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,OAAO,MAAM,EAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/env-inspect.d.ts

@@ -0,0 +1,28 @@
+import type { kitConfig } from "./config.js";
+export interface EnvKeyStatus {
+    name: string;
+    set: boolean;
+    value?: string;
+    redacted?: string;
+    source: string;
+}
+export interface EnvInspectResult {
+    ok: boolean;
+    keys: EnvKeyStatus[];
+    envLocalExists: boolean;
+}
+export interface InspectOptions {
+    showValues?: boolean;
+    missingOnly?: boolean;
+    cwd?: string;
+}
+/**
+ * Parse a .env file into a key-value record.
+ * Handles blank lines, comments (#), and quoted values.
+ */
+export declare function parseEnvFile(content: string): Record<string, string>;
+/**
+ * Redact a secret value: show first 4 chars + ****
+ */
+export declare function redactValue(value: string): string;
+export declare function inspectEnv(config: kitConfig, options?: InspectOptions): Promise<EnvInspectResult>;