ysk-server-core 1.0.0

package/dist/security/ssh-2fa/install.js

@@ -0,0 +1,457 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Write ~/.google_authenticator + plan/apply PAM/sshd notes.
+ * Honest: dry-run default; apply needs execute.
+ */
+import { chmodSync, existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs';
+import { randomInt } from 'node:crypto';
+import { join } from 'node:path';
+import { shellQuote } from '../../hosting/project-user-run.js';
+import { decryptPrivateKey, resolveMasterKey, secretsSshDir } from '../ssh-identity/crypto.js';
+import { getSsh2faInternal, updateSsh2faStatus } from './store.js';
+import { toPublicSsh2fa } from './types.js';
+/**
+ * google-authenticator file format (libpam-google-authenticator).
+ * First line: base32 secret; " lines are options; trailing digits = scratch codes (optional).
+ */
+/**
+ * @param scratchCodes optional emergency 8-digit codes (pam consumes once)
+ */
+export function buildGoogleAuthenticatorFile(secret, scratchCodes) {
+    const lines = [
+        secret.trim(),
+        '" RATE_LIMIT 3 30',
+        '" WINDOW_SIZE 17',
+        '" DISALLOW_REUSE',
+        '" TOTP_AUTH',
+    ];
+    for (const c of scratchCodes ?? []) {
+        const dig = c.replace(/\D/g, '').slice(0, 8);
+        if (dig.length >= 6)
+            lines.push(dig.padStart(8, '0').slice(0, 8));
+    }
+    lines.push('');
+    return lines.join('\n');
+}
+export function generateScratchCodes(count = 5) {
+    const out = [];
+    for (let i = 0; i < count; i++) {
+        out.push(String(randomInt(0, 100_000_000)).padStart(8, '0'));
+    }
+    return out;
+}
+export function buildPamSshSnippet() {
+    return [
+        '# YSK Server — SSH TOTP (pam_google_authenticator)',
+        '# Include from /etc/pam.d/sshd (after common-auth or at end of auth stack).',
+        '# nullok: users without ~/.google_authenticator still login (key-only).',
+        '# Remove nullok only when every interactive user has a file + recovery path.',
+        'auth required pam_google_authenticator.so nullok',
+        '',
+    ].join('\n');
+}
+export function buildSshdTotpHints() {
+    return [
+        '# YSK Server — hints for SSH + TOTP (do not blindly paste on production)',
+        '# OpenSSH 8.2+ often uses KbdInteractiveAuthentication instead of ChallengeResponseAuthentication',
+        'UsePAM yes',
+        'KbdInteractiveAuthentication yes',
+        '# Prefer per-user Match (see buildSshdStrictMatchSnippet) — NOT global AuthenticationMethods',
+        '# Keep at least one console / key-only recovery admin without 2FA file',
+        '',
+    ].join('\n');
+}
+/**
+ * Per-user strict Match: publickey then TOTP; password off.
+ * Only list users that already have .google_authenticator written.
+ */
+export function buildSshdStrictMatchSnippet(linuxUsers) {
+    const users = [...new Set(linuxUsers.map((u) => u.trim()).filter(Boolean))];
+    if (!users.length) {
+        return [
+            '# YSK Server — no strict 2FA users yet',
+            '# After install .google_authenticator, regenerate this Match block',
+            '',
+        ].join('\n');
+    }
+    // OpenSSH Match User: comma-separated patterns
+    const pattern = users.join(',');
+    return [
+        '# Generated by YSK Server — Include from sshd_config.d/',
+        '# Strict: publickey THEN keyboard-interactive (PAM TOTP)',
+        '# WARNING: ensure recovery user is NOT in this list',
+        `Match User ${pattern}`,
+        '    PasswordAuthentication no',
+        '    KbdInteractiveAuthentication yes',
+        '    AuthenticationMethods publickey,keyboard-interactive',
+        '    PubkeyAuthentication yes',
+        '',
+    ].join('\n');
+}
+export const SSHD_STRICT_SNIPPET_NAME = '98-ysk-ssh-2fa-strict.conf';
+/** Project SFTP-style users (ysks_ or ysk_ prefix) — exclude from strict Match by default. */
+export function isSftpOnlyStyleUser(linuxUser) {
+    return /^(ysks_|ysk_)/.test(linuxUser.trim());
+}
+export function planSsh2faStrictSnippet(input) {
+    const recovery = new Set((input.recoveryUsers ?? []).map((u) => u.trim()).filter(Boolean));
+    let users = [...new Set(input.linuxUsers.map((u) => u.trim()).filter(Boolean))].filter((u) => !recovery.has(u));
+    const droppedSftp = [];
+    if (!input.includeSftpUsers) {
+        for (const u of users) {
+            if (isSftpOnlyStyleUser(u))
+                droppedSftp.push(u);
+        }
+        users = users.filter((u) => !isSftpOnlyStyleUser(u));
+    }
+    const notes = [];
+    if (recovery.size) {
+        notes.push(tl('notes.auto.t0502', { v0: ([...recovery].join(', ')) }));
+    }
+    if (droppedSftp.length) {
+        notes.push(tl('notes.auto.t0503', { v0: (droppedSftp.join(', ')) }));
+    }
+    const overlap = input.linuxUsers.filter((u) => recovery.has(u.trim()));
+    if (overlap.length) {
+        notes.push(tl('notes.auto.t0504', { v0: (overlap.join(', ')) }));
+    }
+    if (!users.length) {
+        return {
+            ok: false,
+            snippet: buildSshdStrictMatchSnippet([]),
+            users: [],
+            notes: [...notes, tl('notes.auto.n1099')],
+            blocked: true
+        };
+    }
+    notes.push(tl('notes.auto.t0505', { v0: (users.length) }));
+    notes.push(tl('notes.auto.n0222'));
+    return {
+        ok: true,
+        snippet: buildSshdStrictMatchSnippet(users),
+        users,
+        notes
+    };
+}
+export async function applySshdStrictSnippet(input) {
+    const plan = planSsh2faStrictSnippet({
+        linuxUsers: input.linuxUsers,
+        recoveryUsers: input.recoveryUsers
+    });
+    const notes = [...plan.notes];
+    const managed = join(secretsSshDir(input.dataDir), SSHD_STRICT_SNIPPET_NAME);
+    mkdirSync(secretsSshDir(input.dataDir), { recursive: true });
+    writeFileSync(managed, plan.snippet, 'utf8');
+    notes.push(tl('notes.auto.t0506', { v0: (managed) }));
+    if (!input.apply) {
+        return {
+            ok: plan.ok,
+            dryRun: true,
+            applied: false,
+            blocked: Boolean(plan.blocked),
+            snippet: plan.snippet,
+            notes: [...notes, tl('notes.auto.n0268')],
+            written: [managed]
+        };
+    }
+    if (plan.blocked || !plan.ok) {
+        return {
+            ok: false,
+            dryRun: false,
+            applied: false,
+            blocked: true,
+            snippet: plan.snippet,
+            notes,
+            written: [managed]
+        };
+    }
+    if (!input.executeEnabled) {
+        return {
+            ok: false,
+            dryRun: false,
+            applied: false,
+            blocked: true,
+            snippet: plan.snippet,
+            notes: [...notes, tl('notes.auto.n0003')],
+            written: [managed]
+        };
+    }
+    const systemPath = `/etc/ssh/sshd_config.d/${SSHD_STRICT_SNIPPET_NAME}`;
+    const r = await input.host.runCommand([
+        'bash',
+        '-c',
+        `cp ${JSON.stringify(managed)} ${JSON.stringify(systemPath)} && chmod 644 ${JSON.stringify(systemPath)} && (sshd -t 2>&1) && (systemctl reload sshd 2>/dev/null || systemctl reload ssh 2>/dev/null)`,
+    ], { timeoutMs: 15_000 });
+    const ok = r.exitCode === 0;
+    notes.push(ok
+        ? tl('notes.auto.t0507', { v0: (systemPath) })
+        : tl('notes.auto.t0508', { v0: ((r.stderr || r.stdout).slice(0, 200)) }));
+    return {
+        ok,
+        dryRun: false,
+        applied: ok,
+        blocked: false,
+        snippet: plan.snippet,
+        notes,
+        written: [managed, systemPath]
+    };
+}
+export async function installSsh2faFile(input) {
+    const notes = [];
+    const row = getSsh2faInternal(input.dataDir, input.id);
+    if (!row) {
+        return {
+            ok: false,
+            dryRun: !input.apply,
+            applied: false,
+            blocked: false,
+            requiresRoot: true,
+            requiresExecute: true,
+            notes: [tl('notes.ssh.registrationNotFound')]
+        };
+    }
+    const filePath = join(row.homeDir, '.google_authenticator');
+    notes.push(`planned: ${filePath} mode 0400 owner ${row.linuxUser}`);
+    notes.push('file written ≠ PAM active ≠ sshd requires TOTP');
+    notes.push(tl('notes.auto.n0685'));
+    const pamSnippet = buildPamSshSnippet();
+    const sshdHints = buildSshdTotpHints();
+    const managedPam = join(secretsSshDir(input.dataDir), 'pam-sshd-ysk-totp');
+    const managedSshd = join(secretsSshDir(input.dataDir), 'sshd-totp-hints.conf');
+    if (!input.apply) {
+        notes.push(tl('notes.auto.n0266'));
+        notes.push(tl('notes.auto.t0509', { v0: (managedPam) }));
+        return {
+            ok: true,
+            dryRun: true,
+            applied: false,
+            blocked: false,
+            requiresRoot: true,
+            requiresExecute: true,
+            plannedPath: filePath,
+            record: toPublicSsh2fa(row),
+            notes,
+            pamSnippet,
+            sshdHints
+        };
+    }
+    if (!input.executeEnabled) {
+        notes.push(tl('notes.auto.n0003'));
+        return {
+            ok: false,
+            dryRun: false,
+            applied: false,
+            blocked: true,
+            requiresRoot: true,
+            requiresExecute: true,
+            plannedPath: filePath,
+            record: toPublicSsh2fa(row),
+            notes,
+            pamSnippet,
+            sshdHints
+        };
+    }
+    let secret;
+    try {
+        const master = resolveMasterKey(input.dataDir);
+        secret = decryptPrivateKey(master.key, row.id, row.secretEnc);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            dryRun: false,
+            applied: false,
+            blocked: false,
+            requiresRoot: true,
+            requiresExecute: true,
+            notes: [e instanceof Error ? e.message : 'decrypt failed']
+        };
+    }
+    const scratch = generateScratchCodes(5);
+    const body = buildGoogleAuthenticatorFile(secret, scratch);
+    try {
+        mkdirSync(row.homeDir, { recursive: true });
+        writeFileSync(filePath, body, { mode: 0o400 });
+        try {
+            chmodSync(filePath, 0o400);
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    catch (e) {
+        return {
+            ok: false,
+            dryRun: false,
+            applied: false,
+            blocked: false,
+            requiresRoot: true,
+            requiresExecute: true,
+            plannedPath: filePath,
+            notes: [`write failed: ${e instanceof Error ? e.message : String(e)}`]
+        };
+    }
+    if (input.host) {
+        const ch = await input.host.runCommand([
+            'bash',
+            '-c',
+            `chown ${shellQuote(row.linuxUser)}:${shellQuote(row.linuxUser)} ${shellQuote(filePath)} 2>&1; chmod 400 ${shellQuote(filePath)} 2>&1; stat -c '%a %U %G' ${shellQuote(filePath)} 2>&1 || true`,
+        ], { timeoutMs: 10_000 });
+        const st = (ch.stdout || '').trim().split(/\n/).pop() || '';
+        notes.push(ch.exitCode === 0
+            ? `chown/chmod ok · ${st}`
+            : tl('notes.auto.t0510', { v0: ((ch.stderr || st).slice(0, 120)) }));
+        if (st && !/^400\b/.test(st)) {
+            notes.push(tl('notes.auto.t0511', { v0: (st) }));
+        }
+    }
+    else {
+        notes.push(tl('notes.auto.n1058'));
+    }
+    // Always write managed PAM/sshd docs under dataDir (safe)
+    try {
+        mkdirSync(secretsSshDir(input.dataDir), { recursive: true });
+        writeFileSync(managedPam, pamSnippet, { mode: 0o644 });
+        writeFileSync(managedSshd, sshdHints, { mode: 0o644 });
+        notes.push(tl('notes.auto.t0512', { v0: (managedPam) }));
+        notes.push(tl('notes.auto.t0513', { v0: (managedSshd) }));
+    }
+    catch {
+        /* ignore */
+    }
+    const record = updateSsh2faStatus(input.dataDir, row.id, {
+        status: 'file_written',
+        filePath,
+        writtenAt: new Date().toISOString(),
+        notes: [...row.notes, `written ${filePath}`, tl('notes.auto.n0492')]
+    });
+    notes.push(tl('notes.auto.n0760'));
+    notes.push(tl('notes.auto.n0493'));
+    notes.push(tl('notes.auto.t0514', { v0: (scratch.join(' ')) }));
+    return {
+        ok: true,
+        dryRun: false,
+        applied: true,
+        blocked: false,
+        requiresRoot: true,
+        requiresExecute: false,
+        plannedPath: filePath,
+        record: record ?? undefined,
+        notes,
+        pamSnippet,
+        sshdHints,
+        scratchCodes: scratch
+    };
+}
+export async function uninstallSsh2faFile(input) {
+    const notes = [];
+    const row = getSsh2faInternal(input.dataDir, input.id);
+    if (!row) {
+        return {
+            ok: false,
+            dryRun: !input.apply,
+            applied: false,
+            blocked: false,
+            requiresRoot: false,
+            requiresExecute: false,
+            notes: [tl('notes.ssh.registrationNotFound')]
+        };
+    }
+    const path = row.filePath || join(row.homeDir, '.google_authenticator');
+    notes.push(`will remove ${path}`);
+    if (!input.apply) {
+        return {
+            ok: true,
+            dryRun: true,
+            applied: false,
+            blocked: false,
+            requiresRoot: false,
+            requiresExecute: false,
+            plannedPath: path,
+            record: toPublicSsh2fa(row),
+            notes: [...notes, 'dry-run']
+        };
+    }
+    if (existsSync(path)) {
+        try {
+            unlinkSync(path);
+            notes.push('removed file');
+        }
+        catch (e) {
+            notes.push(`remove failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    else {
+        notes.push('file already absent');
+    }
+    if (input.retire !== false) {
+        updateSsh2faStatus(input.dataDir, row.id, {
+            status: 'retired',
+            notes: [...row.notes, 'uninstalled']
+        });
+    }
+    else {
+        updateSsh2faStatus(input.dataDir, row.id, {
+            status: 'confirmed',
+            filePath: undefined,
+            writtenAt: undefined
+        });
+    }
+    return {
+        ok: true,
+        dryRun: false,
+        applied: true,
+        blocked: false,
+        requiresRoot: false,
+        requiresExecute: false,
+        plannedPath: path,
+        notes
+    };
+}
+export async function probeSsh2faHost(host) {
+    const notes = [];
+    const mod = await host.runCommand([
+        'bash',
+        '-c',
+        'ls /lib/x86_64-linux-gnu/security/pam_google_authenticator.so /usr/lib/x86_64-linux-gnu/security/pam_google_authenticator.so 2>/dev/null | head -1; dpkg -l libpam-google-authenticator 2>/dev/null | grep -E "^ii" || true',
+    ], { timeoutMs: 8_000 });
+    const pamModule = (mod.stdout || '').includes('pam_google_authenticator.so') ||
+        (mod.stdout || '').includes('libpam-google-authenticator');
+    notes.push(pamModule
+        ? tl('notes.auto.n0559')
+        : tl('notes.auto.n0950'));
+    const pam = await host.runCommand(['bash', '-c', 'grep -E "pam_google_authenticator" /etc/pam.d/sshd 2>/dev/null | head -3 || true'], { timeoutMs: 5_000 });
+    const pamConfigured = Boolean((pam.stdout || '').trim());
+    if (pamConfigured) {
+        notes.push(tl('notes.auto.t0515', { v0: (pam.stdout.trim().slice(0, 120)) }));
+    }
+    else {
+        notes.push(tl('notes.auto.n0363'));
+    }
+    const kbd = await host.runCommand([
+        'bash',
+        '-c',
+        'sshd -T 2>/dev/null | grep -iE "kbdinteractiveauthentication|challengeresponseauthentication|usepam" || grep -iE "KbdInteractive|ChallengeResponse|UsePAM" /etc/ssh/sshd_config 2>/dev/null | head -5 || true',
+    ], { timeoutMs: 8_000 });
+    const kbdOut = (kbd.stdout || '').toLowerCase();
+    const kbdInteractive = kbdOut.includes('kbdinteractiveauthentication yes') ||
+        kbdOut.includes('challengeresponseauthentication yes');
+    if (kbdInteractive) {
+        notes.push(tl('notes.auto.n0435'));
+    }
+    else {
+        notes.push(tl('notes.auto.n0436'));
+    }
+    return {
+        notes,
+        lights: {
+            package: pamModule ? 'green' : 'red',
+            pam: pamConfigured ? 'green' : pamModule ? 'yellow' : 'red',
+            kbdInteractive: kbdInteractive ? 'green' : 'yellow'
+        },
+        pamModule,
+        pamConfigured,
+        kbdInteractive
+    };
+}
+//# sourceMappingURL=install.js.map

package/dist/security/ssh-2fa/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../../src/security/ssh-2fa/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;;GAGG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,UAAU,EACV,aAAa,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/F,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C;;;GAGG;AACH;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAc,EACd,YAAuB;IAEvB,MAAM,KAAK,GAAG;QACZ,MAAM,CAAC,IAAI,EAAE;QACb,mBAAmB;QACnB,kBAAkB;QAClB,kBAAkB;QAClB,aAAa;KACd,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAK,GAAG,CAAC;IAC5C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,oDAAoD;QACpD,6EAA6E;QAC7E,yEAAyE;QACzE,8EAA8E;QAC9E,kDAAkD;QAClD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,0EAA0E;QAC1E,mGAAmG;QACnG,YAAY;QACZ,kCAAkC;QAClC,8FAA8F;QAC9F,wEAAwE;QACxE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAoB;IAC9D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO;YACL,wCAAwC;YACxC,oEAAoE;YACpE,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,+CAA+C;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO;QACL,yDAAyD;QACzD,0DAA0D;QAC1D,qDAAqD;QACrD,cAAc,OAAO,EAAE;QACvB,+BAA+B;QAC/B,sCAAsC;QACtC,0DAA0D;QAC1D,8BAA8B;QAC9B,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;AAErE,8FAA8F;AAC9F,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,OAAO,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAMvC;IAOC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3F,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CACpF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CACxB,CAAC;IACF,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,2BAA2B,CAAC,EAAE,CAAC;YACxC,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;YACzC,OAAO,EAAE,IAAI;SAAE,CAAC;IACpB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC;QAC3C,KAAK;QACL,KAAK;KAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAO5C;IASC,MAAM,IAAI,GAAG,uBAAuB,CAAC;QACnC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;KAAE,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC7E,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAEtD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;YACzC,OAAO,EAAE,CAAC,OAAO,CAAC;SAAE,CAAC;IACzB,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK;YACL,OAAO,EAAE,CAAC,OAAO,CAAC;SAAE,CAAC;IACzB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;YACzC,OAAO,EAAE,CAAC,OAAO,CAAC;SAAE,CAAC;IACzB,CAAC;IACD,MAAM,UAAU,GAAG,0BAA0B,wBAAwB,EAAE,CAAC;IACxE,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CACnC;QACE,MAAM;QACN,IAAI;QACJ,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,+FAA+F;KACtM,EACD,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;IACF,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC5B,KAAK,CAAC,IAAI,CACR,EAAE;QACA,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9C,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAC3E,CAAC;IACF,OAAO;QACL,EAAE;QACF,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK;QACL,OAAO,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;KAAE,CAAC;AACrC,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAMvC;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK;YACpB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,IAAI;YACrB,KAAK,EAAE,CAAC,EAAE,CAAC,gCAAgC,CAAC,CAAC;SAAE,CAAC;IACpD,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IAC5D,KAAK,CAAC,IAAI,CAAC,YAAY,QAAQ,oBAAoB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IACpE,KAAK,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAEnC,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,kBAAkB,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAE/E,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC;YAC3B,KAAK;YACL,UAAU;YACV,SAAS;SAAE,CAAC;IAChB,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC;YAC3B,KAAK;YACL,UAAU;YACV,SAAS;SAAE,CAAC;IAChB,CAAC;IAED,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,IAAI;YACrB,KAAK,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;SAAE,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,4BAA4B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,QAAQ;YACrB,KAAK,EAAE,CAAC,iBAAiB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;SAAE,CAAC;IAC7E,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CACpC;YACE,MAAM;YACN,IAAI;YACJ,SAAS,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,oBAAoB,UAAU,CAAC,QAAQ,CAAC,6BAA6B,UAAU,CAAC,QAAQ,CAAC,eAAe;SAChM,EACD,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;QACF,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC5D,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,QAAQ,KAAK,CAAC;YACf,CAAC,CAAC,oBAAoB,EAAE,EAAE;YAC1B,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CACtE,CAAC;QACF,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC;QACH,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE;QACvD,MAAM,EAAE,cAAc;QACtB,QAAQ;QACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,WAAW,QAAQ,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;KAAE,CAAC,CAAC;IAE1E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CACpD,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,KAAK;QACd,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,KAAK;QACtB,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,MAAM,IAAI,SAAS;QAC3B,KAAK;QACL,UAAU;QACV,SAAS;QACT,YAAY,EAAE,OAAO;KAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAKzC;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK;YACpB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,KAAK,EAAE,CAAC,EAAE,CAAC,gCAAgC,CAAC,CAAC;SAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IACxE,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IAElC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC;YAC3B,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,SAAS,CAAC;SAAE,CAAC;IACnC,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC3B,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE;YACxC,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC;SAAE,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE;YACxC,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,SAAS;YACnB,SAAS,EAAE,SAAS;SAAE,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,KAAK;QACd,YAAY,EAAE,KAAK;QACnB,eAAe,EAAE,KAAK;QACtB,WAAW,EAAE,IAAI;QACjB,KAAK;KAAE,CAAC;AACZ,CAAC;AAgBD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAkB;IACtD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAC/B;QACE,MAAM;QACN,IAAI;QACJ,6NAA6N;KAC9N,EACD,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;IACF,MAAM,SAAS,GACb,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAC1D,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CACR,SAAS;QACP,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;QACxB,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAC3B,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAC/B,CAAC,MAAM,EAAE,IAAI,EAAE,kFAAkF,CAAC,EAClG,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;IACF,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAC/B;QACE,MAAM;QACN,IAAI;QACJ,+MAA+M;KAChN,EACD,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,kCAAkC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;IACzD,IAAI,cAAc,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO;QACL,KAAK;QACL,MAAM,EAAE;YACN,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK;YACpC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;YAC3D,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;SAAE;QACvD,SAAS;QACT,aAAa;QACb,cAAc;KAAE,CAAC;AACrB,CAAC"}

package/dist/security/ssh-2fa/store.d.ts

@@ -0,0 +1,44 @@
+import type { JsonStore } from '../../db/store.js';
+import type { Ssh2faPublic, Ssh2faRecord } from './types.js';
+export declare function listSsh2fa(dataDir: string, filter?: {
+    projectId?: string;
+    linuxUser?: string;
+}): Ssh2faPublic[];
+export declare function listSsh2faAll(dataDir: string): Ssh2faPublic[];
+export declare function getSsh2fa(dataDir: string, id: string): Ssh2faPublic | null;
+export declare function getSsh2faInternal(dataDir: string, id: string): Ssh2faRecord | null;
+export type EnrollSsh2faResult = {
+    ok: boolean;
+    record?: Ssh2faPublic;
+    /** one-time */
+    secret?: string;
+    otpauthUrl?: string;
+    notes: string[];
+};
+/** Create enrollment with new secret (independent of panel). */
+export declare function enrollSsh2fa(dataDir: string, input: {
+    projectId?: string;
+    linuxUser?: string;
+    homeDir?: string;
+    createdBy?: string;
+    /** Advanced: use this raw secret instead of generating */
+    secret?: string;
+    fromPanel?: boolean;
+}, db?: JsonStore): EnrollSsh2faResult;
+export declare function confirmSsh2fa(dataDir: string, id: string, code: string): {
+    ok: boolean;
+    record?: Ssh2faPublic;
+    notes: string[];
+};
+export declare function revealSsh2faSecret(dataDir: string, id: string): {
+    ok: boolean;
+    secret?: string;
+    otpauthUrl?: string;
+    notes: string[];
+};
+export declare function updateSsh2faStatus(dataDir: string, id: string, patch: Partial<Pick<Ssh2faRecord, 'status' | 'filePath' | 'writtenAt' | 'notes'>>): Ssh2faPublic | null;
+export declare function retireSsh2fa(dataDir: string, id: string): {
+    ok: boolean;
+    notes: string[];
+};
+//# sourceMappingURL=store.d.ts.map

package/dist/security/ssh-2fa/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/security/ssh-2fa/store.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAOnD,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAgB,MAAM,YAAY,CAAC;AAkD3E,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,YAAY,EAAE,CAKjB;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,EAAE,CAE7D;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAG1E;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAElF;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,eAAe;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAEF,gEAAgE;AAChE,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;IACL,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,EACD,EAAE,CAAC,EAAE,SAAS,GACb,kBAAkB,CA2DpB;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAsBzD;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,GACT;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAiBxE;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CACZ,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,OAAO,CAAC,CAClE,GACA,YAAY,GAAG,IAAI,CAYrB;AAED,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,GACT;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAUlC"}