sealbridge 0.2.1 → 0.3.0

package/dist/packages/runtime/dist/invite-store.js

@@ -0,0 +1,337 @@
+// SPDX-License-Identifier: Apache-2.0
+import * as fs from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { digest, digestBytes, inviteTokenFromUri, parseAndVerifyInviteToken, signPayload, verifySigned } from '../../core/dist/index.js';
+import { checkPath, inspectDirectory, privateDirectory, readPrivateFile, resolveDataRoot, writePrivateFile } from './local-identity.js';
+import { keyStoreSelection } from './key-store.js';
+import { openKeychainSecretStore } from './secret-store.js';
+import { selectApplicationRelay } from './relay-selection.js';
+const MAX_STORE_BYTES = 4 * 1024 * 1024;
+const aliasPattern = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+const code = (error) => error.code;
+function exactKeys(value, keys) {
+    return Object.keys(value).sort().join(',') === keys.split(',').sort().join(',');
+}
+/** Owner-scoped bearer invitations. Public results deliberately omit the token. */
+export class InviteStore {
+    owner;
+    options;
+    path;
+    root;
+    directory;
+    io;
+    now;
+    secretStore;
+    /** Loads the optional backend; the constructor and synchronous methods remain available. */
+    static async open(owner, options = {}) {
+        const store = new InviteStore(owner, options);
+        if (!options.secretStore && (store.selection() === 'keychain' ||
+            store.readMetadata().some(e => e.inviteSecret !== undefined))) {
+            store.secretStore = await openKeychainSecretStore(options);
+        }
+        return store;
+    }
+    selection() {
+        // An explicit identity file chooses the signer, independently of invitation storage.
+        return keyStoreSelection({ ...this.options, explicitKeyPath: undefined }).keyStore;
+    }
+    constructor(owner, options = {}) {
+        this.owner = owner;
+        this.options = options;
+        this.root = resolveDataRoot(options);
+        this.directory = join(this.root, 'invites');
+        this.path = join(this.directory, digestBytes(owner.did).slice(7) + '.json');
+        this.io = options.fs ?? fs;
+        this.now = options.now ?? Date.now;
+        this.secretStore = options.secretStore;
+    }
+    verify(token, now, allowExpired = false, historical = false) {
+        const invite = parseAndVerifyInviteToken(token, now, {
+            allowExpired, allowPrivateRelay: historical || this.options.relayPolicy?.allowPrivateRelay,
+        });
+        if (invite.ownerDid === this.owner.did)
+            throw new Error('SELF_DELEGATION_NOT_ALLOWED');
+        return invite;
+    }
+    entry(token, alias, importedAt, invite) {
+        const inviteDigest = digest(invite);
+        return {
+            id: digest({ localOwnerDid: this.owner.did, inviteDigest }).slice(7), alias,
+            displayName: invite.agentCard.payload.name, ownerDid: invite.ownerDid,
+            agentDid: invite.agentDid, relayUrl: invite.relayUrl, inviteToken: token, inviteDigest, importedAt,
+            effectiveExpiresAt: new Date(Math.min(Date.parse(invite.expiresAt), Date.parse(invite.agentCard.payload.expiresAt))).toISOString(),
+        };
+    }
+    readMetadata() {
+        try {
+            for (const path of [this.root, this.directory]) {
+                try {
+                    inspectDirectory(path, this.io, this.options.platform);
+                }
+                catch (error) {
+                    if (code(error) !== 'ENOENT')
+                        throw error;
+                }
+            }
+            const contents = readPrivateFile(this.path, this.io, MAX_STORE_BYTES, this.options.platform);
+            if (contents === undefined)
+                return [];
+            const signed = JSON.parse(contents);
+            const p = signed.payload;
+            if (!exactKeys(signed, 'payload,signature') || !verifySigned(signed, this.owner.did) ||
+                !exactKeys(p, 'type,version,localOwnerDid,entries') || p.type !== 'StoredInvites' ||
+                p.version !== 1 || p.localOwnerDid !== this.owner.did || !Array.isArray(p.entries))
+                throw new Error();
+            const ids = new Set(), aliases = new Set();
+            for (const e of p.entries) {
+                const external = e?.inviteSecret !== undefined;
+                const fields = 'id,alias,displayName,ownerDid,agentDid,relayUrl,inviteDigest,importedAt,effectiveExpiresAt,';
+                if (!e || !exactKeys(e, fields + (external ? 'inviteSecret,tokenDigest' : 'inviteToken') +
+                    (e.importState !== undefined ? ',importState' : '')) ||
+                    (e.importState !== undefined && e.importState !== 'unconfirmed') ||
+                    Object.values(e).some(v => typeof v !== 'string') || !aliasPattern.test(e.alias) ||
+                    !Number.isFinite(Date.parse(e.importedAt)) || Date.parse(e.importedAt) > this.now() ||
+                    ids.has(e.id) || aliases.has(e.alias))
+                    throw new Error();
+                if (external && (e.inviteSecret !== 'invite:' + e.id || !/^[a-f0-9]{64}$/.test(e.id) ||
+                    !/^sha256:[a-f0-9]{64}$/.test(e.tokenDigest)))
+                    throw new Error();
+                if (!external)
+                    this.validateToken(e, e.inviteToken);
+                ids.add(e.id);
+                aliases.add(e.alias);
+            }
+            return p.entries;
+        }
+        catch {
+            throw new Error('INVITE_STORE_INVALID');
+        }
+    }
+    validateToken(e, token) {
+        try {
+            const invite = this.verify(token, Date.parse(e.importedAt), false, true);
+            this.verify(token, this.now(), true, true);
+            const expected = this.entry(token, e.alias, e.importedAt, invite);
+            if (e.inviteSecret !== undefined) {
+                delete expected.inviteToken;
+                expected.inviteSecret = 'invite:' + expected.id;
+                expected.tokenDigest = digestBytes(token);
+            }
+            if (e.importState !== undefined)
+                expected.importState = e.importState;
+            if (token !== inviteTokenFromUri(token) || digest(e) !== digest(expected))
+                throw new Error();
+        }
+        catch {
+            throw new Error('INVITE_STORE_INVALID');
+        }
+    }
+    token(e) {
+        if (e.inviteToken !== undefined)
+            return e.inviteToken;
+        if (!this.secretStore)
+            throw new Error('KEY_STORE_UNAVAILABLE');
+        let token;
+        try {
+            token = this.secretStore.get(e.inviteSecret);
+        }
+        catch {
+            throw new Error('KEY_STORE_UNAVAILABLE');
+        }
+        if (token === undefined)
+            throw new Error('INVITE_SECRET_MISSING');
+        if (digestBytes(token) !== e.tokenDigest)
+            throw new Error('INVITE_SECRET_MISMATCH');
+        this.validateToken(e, token);
+        return token;
+    }
+    read() {
+        const entries = this.readMetadata();
+        for (const entry of entries)
+            this.token(entry);
+        return entries;
+    }
+    externalize(e) {
+        if (!this.secretStore)
+            throw new Error('KEY_STORE_UNAVAILABLE');
+        const token = this.token(e), id = 'invite:' + e.id;
+        try {
+            const existing = this.secretStore.get(id);
+            if (existing !== undefined && existing !== token)
+                throw new Error('INVITE_SECRET_CONFLICT');
+            if (existing === undefined)
+                this.secretStore.set(id, token);
+            if (this.secretStore.get(id) !== token)
+                throw new Error('INVITE_SECRET_MISMATCH');
+        }
+        catch (error) {
+            if (error instanceof Error && /^INVITE_SECRET_/.test(error.message))
+                throw error;
+            throw new Error('KEY_STORE_UNAVAILABLE');
+        }
+        const { inviteToken: _token, ...metadata } = e;
+        return { ...metadata, inviteSecret: id, tokenDigest: digestBytes(token) };
+    }
+    publicEntry(e) {
+        const { alias, displayName, ownerDid, agentDid, relayUrl, importedAt, effectiveExpiresAt } = e;
+        return { workerRef: 'saved:' + e.id, alias, displayName, ownerDid, agentDid, relayUrl,
+            importedAt, effectiveExpiresAt, ...(e.importState ? { importState: e.importState } : {}),
+            status: Date.parse(effectiveExpiresAt) <= this.now() ? 'expired' : 'current' };
+    }
+    list() { return this.read().map(e => this.publicEntry(e)); }
+    /** Strict validation occurs on every resolution; an expired invite never becomes a DID target. */
+    resolve(workerRef) {
+        const e = this.find(this.read(), workerRef);
+        if (!e)
+            throw new Error('INVITE_NOT_FOUND');
+        if (e.importState === 'unconfirmed')
+            throw new Error('INVITE_CONFIRMATION_REQUIRED');
+        const token = this.token(e);
+        const invite = this.verify(token, this.now());
+        selectApplicationRelay({ ...this.options.relayPolicy, inviteRelay: invite.relayUrl });
+        return { inviteToken: token, invite };
+    }
+    find(entries, ref) {
+        return entries.find(e => ref === 'saved:' + e.id || ref === e.alias);
+    }
+    mutate(change, metadataOnly = false) {
+        const lock = this.path + '.lock';
+        const temporary = join(this.directory, '.' + randomUUID() + '.tmp');
+        let locked = false, written = false;
+        try {
+            privateDirectory(this.root, this.io, this.options.platform);
+            privateDirectory(this.directory, this.io, this.options.platform);
+            try {
+                writePrivateFile(lock, Buffer.from(String(process.pid) + '\n'), this.io, this.options.platform);
+                locked = true;
+            }
+            catch (error) {
+                if (code(error) === 'EEXIST')
+                    throw new Error('INVITE_STORE_BUSY');
+                throw error;
+            }
+            const { entries, result, changed } = change(metadataOnly ? this.readMetadata() : this.read());
+            if (!changed)
+                return result;
+            const bytes = Buffer.from(JSON.stringify(signPayload({
+                type: 'StoredInvites', version: 1, localOwnerDid: this.owner.did, entries,
+            }, this.owner, new Date(this.now()).toISOString())) + '\n');
+            if (bytes.length > MAX_STORE_BYTES)
+                throw new Error('INVITE_STORE_INVALID');
+            writePrivateFile(temporary, bytes, this.io, this.options.platform);
+            written = true;
+            checkPath(this.path, this.io, this.options.platform);
+            this.io.renameSync(temporary, this.path);
+            written = false;
+            return result;
+        }
+        catch (error) {
+            if (error instanceof Error && /^(INVITE_|ALIAS_|INVALID_ALIAS|KEY_STORE_)/.test(error.message))
+                throw error;
+            throw new Error('INVITE_STORE_INVALID');
+        }
+        finally {
+            if (written)
+                this.io.unlinkSync(temporary);
+            if (locked)
+                this.io.unlinkSync(lock);
+        }
+    }
+    import(link, alias, options = {}) {
+        const now = this.now();
+        const invite = this.verify(link, now);
+        selectApplicationRelay({ ...this.options.relayPolicy, inviteRelay: invite.relayUrl });
+        if (alias !== undefined && !aliasPattern.test(alias))
+            throw new Error('INVALID_ALIAS');
+        const suffix = digest(invite).slice(7, 19);
+        const slug = invite.agentCard.payload.name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '').slice(0, 48) || 'worker';
+        const entry = this.entry(inviteTokenFromUri(link), alias ?? slug + '-' + suffix, new Date(now).toISOString(), invite);
+        if (options.pendingConfirmation)
+            entry.importState = 'unconfirmed';
+        return this.mutate(entries => {
+            const duplicate = entries.find(e => e.inviteDigest === entry.inviteDigest);
+            if (duplicate) {
+                if (alias !== undefined && alias !== duplicate.alias)
+                    throw new Error('ALIAS_EXISTS');
+                const changed = !options.pendingConfirmation && duplicate.importState === 'unconfirmed';
+                if (changed)
+                    delete duplicate.importState;
+                return { entries, result: this.publicEntry(duplicate), changed };
+            }
+            if (entries.some(e => e.alias === entry.alias))
+                throw new Error('ALIAS_EXISTS');
+            const stored = this.options.secretStore || this.selection() === 'keychain' ? this.externalize(entry) : entry;
+            return { entries: [...entries, stored], result: this.publicEntry(entry), changed: true };
+        });
+    }
+    /** Explicit migration publishes only after all external strings have been read back. */
+    migrateToKeychain(dryRun = false) {
+        if (!this.secretStore)
+            throw new Error('KEY_STORE_UNAVAILABLE');
+        if (dryRun)
+            return { count: this.read().filter(e => e.inviteToken !== undefined).length, dryRun };
+        return this.mutate(entries => {
+            const count = entries.filter(e => e.inviteToken !== undefined).length;
+            return { entries: entries.map(e => e.inviteToken === undefined ? e : this.externalize(e)),
+                result: { count, dryRun }, changed: count > 0 };
+        });
+    }
+    /** Keeps an import permanently outside unconfirmed cleanup; grants no connection or task consent. */
+    retain(workerRef) {
+        const current = this.find(this.read(), workerRef);
+        if (!current)
+            throw new Error('INVITE_NOT_FOUND');
+        if (current.importState !== 'unconfirmed')
+            return this.publicEntry(current);
+        return this.mutate(entries => {
+            const entry = this.find(entries, workerRef);
+            if (!entry)
+                throw new Error('INVITE_NOT_FOUND');
+            const changed = entry.importState === 'unconfirmed';
+            delete entry.importState;
+            return { entries, result: this.publicEntry(entry), changed };
+        });
+    }
+    /** Token-free metadata remains available even after interrupted secret deletion. */
+    listUnconfirmed() {
+        return this.readMetadata().filter(e => e.importState === 'unconfirmed').map(e => this.publicEntry(e));
+    }
+    /** Deletes only explicitly pending imports strictly older than the supplied timestamp. */
+    removeUnconfirmed(options) {
+        const cutoff = Date.parse(options.olderThan);
+        if (!Number.isFinite(cutoff) || cutoff > this.now())
+            throw new Error('INVITE_CLEANUP_INVALID_CUTOFF');
+        return this.mutate(entries => {
+            const selected = entries.filter(e => e.importState === 'unconfirmed' && Date.parse(e.importedAt) < cutoff);
+            for (const entry of selected)
+                this.deleteSecret(entry);
+            return { entries: entries.filter(e => !selected.includes(e)), result: { removed: selected.length },
+                changed: selected.length > 0 };
+        }, true);
+    }
+    deleteSecret(entry) {
+        if (!entry.inviteSecret)
+            return;
+        try {
+            if (!this.secretStore)
+                throw new Error();
+            this.secretStore.delete(entry.inviteSecret);
+            if (this.secretStore.get(entry.inviteSecret) !== undefined)
+                throw new Error();
+        }
+        catch {
+            throw new Error('INVITE_SECRET_DELETE_FAILED');
+        }
+    }
+    /** Secret deletion precedes metadata publication, so either step can be retried with the same reference. */
+    remove(workerRef) {
+        return this.mutate(entries => {
+            const entry = this.find(entries, workerRef);
+            if (entry)
+                this.deleteSecret(entry);
+            return { entries: entries.filter(e => e !== entry), result: !!entry, changed: !!entry };
+        }, true);
+    }
+}
+//# sourceMappingURL=invite-store.js.map

package/dist/packages/runtime/dist/invite-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite-store.js","sourceRoot":"","sources":["../src/invite-store.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE1H,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACxI,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AA8C9D,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACxC,MAAM,YAAY,GAAG,kCAAkC,CAAC;AACxD,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAE,KAA+B,CAAC,IAAI,CAAC;AACvE,SAAS,SAAS,CAAC,KAAa,EAAE,IAAY;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClF,CAAC;AACD,mFAAmF;AACnF,MAAM,OAAO,WAAW;IAoBO;IAAiC;IAnBrD,IAAI,CAAS;IACL,IAAI,CAAS;IACb,SAAS,CAAS;IAClB,EAAE,CAAY;IACd,GAAG,CAAe;IAC3B,WAAW,CAAe;IAClC,4FAA4F;IAC5F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAc,EAAE,UAA8B,EAAE;QAChE,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,UAAU;YACzD,KAAK,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,EAAE,CAAC;YAClE,KAAK,CAAC,WAAW,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACO,SAAS;QACf,qFAAqF;QACrF,OAAO,iBAAiB,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC;IACrF,CAAC;IACD,YAA6B,KAAc,EAAmB,UAA8B,EAAE;QAAjE,UAAK,GAAL,KAAK,CAAS;QAAmB,YAAO,GAAP,OAAO,CAAyB;QAC5F,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;QAC5E,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACzC,CAAC;IACO,MAAM,CAAC,KAAa,EAAE,GAAW,EAAE,YAAY,GAAG,KAAK,EAAE,UAAU,GAAG,KAAK;QACjF,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,EAAE,GAAG,EAAE;YACnD,YAAY,EAAE,iBAAiB,EAAE,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,iBAAiB;SAC3F,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACvF,OAAO,MAAM,CAAC;IAChB,CAAC;IACO,KAAK,CAAC,KAAa,EAAE,KAAa,EAAE,UAAkB,EAAE,MAAc;QAC5E,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK;YAC3E,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACrE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU;YAClG,kBAAkB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAChE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;SACjE,CAAC;IACJ,CAAC;IACO,YAAY;QAClB,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC;oBAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAAC,CAAC;gBAC/D,OAAO,KAAK,EAAE,CAAC;oBAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ;wBAAE,MAAM,KAAK,CAAC;gBAAC,CAAC;YAC9D,CAAC;YACD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC7F,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA0B,CAAC;YAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;YACzB,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;gBAChF,CAAC,SAAS,CAAC,CAAC,EAAE,oCAAoC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe;gBACjF,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC1G,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,EAAE,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;YAC3D,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,MAAM,QAAQ,GAAG,CAAC,EAAE,YAAY,KAAK,SAAS,CAAC;gBAC/C,MAAM,MAAM,GAAG,6FAA6F,CAAC;gBAC7G,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,aAAa,CAAC;oBACpF,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACpD,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,aAAa,CAAC;oBAChE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;oBAChF,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;oBACnF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC7D,IAAI,QAAQ,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChF,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,WAAY,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;gBACtE,IAAI,CAAC,QAAQ;oBAAE,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,WAAY,CAAC,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,CAAC,CAAC,OAAO,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAAC,CAAC;IACtD,CAAC;IACO,aAAa,CAAC,CAAe,EAAE,KAAa;QAClD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACzE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAClE,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,QAAQ,CAAC,WAAW,CAAC;gBAC5B,QAAQ,CAAC,YAAY,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC;gBAChD,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS;gBAAE,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;YACtE,IAAI,KAAK,KAAK,kBAAkB,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAAC,CAAC;IACtD,CAAC;IACO,KAAK,CAAC,CAAe;QAC3B,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,WAAW,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAChE,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,YAAa,CAAC,CAAC;QAAC,CAAC;QACtD,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAAC,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACpF,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IACO,IAAI;QACV,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;IACO,WAAW,CAAC,CAAe;QACjC,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5F,IAAI,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC5D,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;gBAAE,MAAM,KAAK,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC/C,OAAO,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,CAAC;IACO,WAAW,CAAC,CAAe;QACjC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC/F,OAAO,EAAE,SAAS,EAAE,QAAQ,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;YACnF,UAAU,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,KAAoB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,kGAAkG;IAClG,OAAO,CAAC,SAAiB;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,WAAW,KAAK,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACrF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9C,sBAAsB,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtF,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC;IACO,IAAI,CAAC,OAAuB,EAAE,GAAW;QAC/C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,QAAQ,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC;IACO,MAAM,CAAI,MAA6F,EAAE,YAAY,GAAG,KAAK;QACnI,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC;QACpE,IAAI,MAAM,GAAG,KAAK,EAAE,OAAO,GAAG,KAAK,CAAC;QACpC,IAAI,CAAC;YACH,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC5D,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjE,IAAI,CAAC;gBAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAAC,MAAM,GAAG,IAAI,CAAC;YAAC,CAAC;YACvH,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACnE,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9F,IAAI,CAAC,OAAO;gBAAE,OAAO,MAAM,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAgB;gBAClE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO;aAC1E,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC5D,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC5E,gBAAgB,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YACnF,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO,GAAG,KAAK,CAAC;YAC1D,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5G,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,IAAI,OAAO;gBAAE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC3C,IAAI,MAAM;gBAAE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAY,EAAE,KAAc,EAAE,UAA+B,EAAE;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,sBAAsB,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtF,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC;QACpI,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,GAAG,GAAG,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;QACtH,IAAI,OAAO,CAAC,mBAAmB;YAAE,KAAK,CAAC,WAAW,GAAG,aAAa,CAAC;QACnE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;YAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC,CAAC;YAC3E,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;gBACtF,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,SAAS,CAAC,WAAW,KAAK,aAAa,CAAC;gBACxF,IAAI,OAAO;oBAAE,OAAO,SAAS,CAAC,WAAW,CAAC;gBAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;YACnE,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;YAChF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAC7G,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3F,CAAC,CAAC,CAAC;IACL,CAAC;IACD,wFAAwF;IACxF,iBAAiB,CAAC,MAAM,GAAG,KAAK;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAChE,IAAI,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAClG,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;YAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;YACtE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;gBACvF,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,qGAAqG;IACrG,MAAM,CAAC,SAAiB;QACtB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,WAAW,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC5C,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,KAAK,aAAa,CAAC;YACpD,OAAO,KAAK,CAAC,WAAW,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC;IACD,oFAAoF;IACpF,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACxG,CAAC;IACD,0FAA0F;IAC1F,iBAAiB,CAAC,OAA8B;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACtG,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;YAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,CAAC;YAC3G,KAAK,MAAM,KAAK,IAAI,QAAQ;gBAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YACvD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE;gBAChG,OAAO,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,CAAC,EAAE,IAAI,CAAC,CAAC;IACX,CAAC;IACO,YAAY,CAAC,KAAmB;QACtC,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,OAAO;QAChC,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACzC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAChF,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAAC,CAAC;IAC7D,CAAC;IACD,4GAA4G;IAC5G,MAAM,CAAC,SAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC5C,IAAI,KAAK;gBAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAC1F,CAAC,EAAE,IAAI,CAAC,CAAC;IACX,CAAC;CACF"}

package/dist/packages/runtime/dist/key-store.d.ts

@@ -0,0 +1,77 @@
+import type { KeyPair } from '../../core/dist/index.js';
+import type { IdentityRole, LocalIdentityOptions, LocalIdentity } from './local-identity.js';
+type Result<T> = T | Promise<T>;
+export interface KeyStoreDescription {
+    backend: string;
+    location: string;
+    source?: LocalIdentity['source'];
+}
+/** Embedders implement createIfMissing without replacing an existing identity. */
+export interface KeyStore {
+    load(role: IdentityRole): Result<KeyPair | undefined>;
+    createIfMissing(role: IdentityRole): Result<KeyPair>;
+    exists(role: IdentityRole): Result<boolean>;
+    /** Descriptions contain only backend and location metadata. */
+    describe(role: IdentityRole): Result<KeyStoreDescription>;
+}
+export interface KeyringEntry {
+    getPassword(): string | null;
+    setPassword(value: string): void;
+    deletePassword?(): boolean | void;
+}
+export interface KeyringModule {
+    Entry: new (service: string, account: string, options?: {
+        linux: {
+            store: 'secret-service';
+        };
+    }) => KeyringEntry;
+}
+export interface IdentityStoreOptions extends LocalIdentityOptions {
+    /** Precedence: option, environment, application config, then file. */
+    keyStore?: 'file' | 'keychain' | KeyStore;
+    /** Optional native module loader, also usable by hosts and offline tests. */
+    keyringLoader?: () => Promise<KeyringModule>;
+}
+export interface StoredIdentity extends KeyStoreDescription {
+    present: boolean;
+    key?: KeyPair;
+}
+/** File paths, legacy selection, validation and publication retain their existing implementation. */
+export declare class FileKeyStore implements KeyStore {
+    readonly options: LocalIdentityOptions;
+    constructor(options?: LocalIdentityOptions);
+    load(role: IdentityRole): KeyPair | undefined;
+    createIfMissing(role: IdentityRole): KeyPair;
+    exists(role: IdentityRole): boolean;
+    describe(role: IdentityRole): KeyStoreDescription;
+}
+/** Stable service name scoped to the normalized absolute data root; accounts are role names. */
+export declare function keychainService(options?: LocalIdentityOptions): string;
+export declare class KeychainKeyStore implements KeyStore {
+    private readonly module;
+    readonly options: LocalIdentityOptions;
+    private readonly service;
+    constructor(module: KeyringModule, options?: LocalIdentityOptions);
+    describe(role: IdentityRole): KeyStoreDescription;
+    private entry;
+    private secret;
+    exists(role: IdentityRole): boolean;
+    load(role: IdentityRole): KeyPair | undefined;
+    createIfMissing(role: IdentityRole): KeyPair;
+}
+export declare function optionalKeyring(options: IdentityStoreOptions, required: boolean): Promise<KeyringModule | undefined>;
+export interface KeyStoreSelection {
+    keyStore: 'file' | 'keychain' | KeyStore;
+    source: 'option' | 'env' | 'config' | 'default';
+}
+/** Resolve selection metadata without loading a backend or creating an identity. */
+export declare function keyStoreSelection(options?: IdentityStoreOptions): KeyStoreSelection;
+/** Inspect the other backend without creating entries; optional keychain inspection may be unavailable. */
+export declare function otherKeyStorePresence(selected: 'file' | 'keychain', options?: IdentityStoreOptions): Promise<string[]>;
+/** Explicit file paths always bypass backend configuration and optional module loading. */
+export declare function selectKeyStore(role: IdentityRole, options?: IdentityStoreOptions): Promise<KeyStore>;
+/** Read-only inspection used by doctor and peer review; never creates an identity. */
+export declare function inspectStoredIdentity(role: IdentityRole, options?: IdentityStoreOptions): Promise<StoredIdentity>;
+/** Resolve the configured store, preserving its create-if-missing semantics. */
+export declare function resolveStoredIdentity(role: IdentityRole, options?: IdentityStoreOptions): Promise<KeyPair>;
+export {};