ysk-server-core 1.0.0

package/dist/security/ssh-identity/install.js

@@ -0,0 +1,281 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Install / uninstall identity private keys to Linux user home or panel secrets path.
+ * Honest: dry-run default; apply needs root + YSK_EXECUTE via HostExecutor.
+ */
+import { chmodSync, existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { shellQuote } from '../../hosting/project-user-run.js';
+import { decryptPrivateKey, resolveMasterKey, secretsSshDir } from './crypto.js';
+import { exportSshIdentityPrivate, getSshIdentityInternal, updateSshIdentityRecord } from './store.js';
+import { toPublicIdentity } from './types.js';
+function defaultInstallPaths(dataDir, identity) {
+    if (identity.purpose === 'panel_outbound' || !identity.binding?.homeDir) {
+        const dir = join(secretsSshDir(dataDir), 'keys', identity.id);
+        return {
+            privatePath: join(dir, 'id_ed25519'),
+            publicPath: join(dir, 'id_ed25519.pub')
+        };
+    }
+    const home = identity.binding.homeDir;
+    const base = identity.algorithm === 'rsa-4096' ? 'id_rsa' : 'id_ed25519';
+    return {
+        privatePath: join(home, '.ssh', base),
+        publicPath: join(home, '.ssh', `${base}.pub`),
+        owner: identity.binding.linuxUser
+    };
+}
+export async function installSshIdentity(input) {
+    const notes = [];
+    const row = getSshIdentityInternal(input.dataDir, input.id);
+    if (!row) {
+        return {
+            ok: false,
+            dryRun: !input.apply,
+            applied: false,
+            blocked: false,
+            requiresRoot: true,
+            requiresExecute: true,
+            notes: [tl('notes.ssh.identityNotFound')]
+        };
+    }
+    const paths = defaultInstallPaths(input.dataDir, row);
+    notes.push(`planned private: ${paths.privatePath} mode 0600`);
+    notes.push(`planned public:  ${paths.publicPath} mode 0644`);
+    if (paths.owner)
+        notes.push(`owner: ${paths.owner}`);
+    const apply = Boolean(input.apply);
+    if (!apply) {
+        notes.push('dry-run — pass apply/execute to write disk');
+        return {
+            ok: true,
+            dryRun: true,
+            applied: false,
+            blocked: false,
+            requiresRoot: true,
+            requiresExecute: true,
+            plannedPath: paths.privatePath,
+            plannedPublicPath: paths.publicPath,
+            identity: toPublicIdentity(row),
+            notes
+        };
+    }
+    const requiresRoot = true;
+    const requiresExecute = true;
+    if (!input.executeEnabled) {
+        notes.push(tl('notes.auto.n0003'));
+        return {
+            ok: false,
+            dryRun: false,
+            applied: false,
+            blocked: true,
+            requiresRoot,
+            requiresExecute,
+            plannedPath: paths.privatePath,
+            plannedPublicPath: paths.publicPath,
+            notes
+        };
+    }
+    let privateKey;
+    try {
+        const master = resolveMasterKey(input.dataDir);
+        privateKey = decryptPrivateKey(master.key, row.id, row.privateKeyEnc);
+    }
+    catch (e) {
+        notes.push(e instanceof Error ? e.message : 'decrypt failed');
+        return {
+            ok: false,
+            dryRun: false,
+            applied: false,
+            blocked: false,
+            requiresRoot,
+            requiresExecute,
+            notes
+        };
+    }
+    // Write via process (panel dataDir) or host for user homes
+    try {
+        const sshDir = join(paths.privatePath, '..');
+        mkdirSync(sshDir, { recursive: true });
+        writeFileSync(paths.privatePath, privateKey.endsWith('\n') ? privateKey : privateKey + '\n', {
+            mode: 0o600
+        });
+        writeFileSync(paths.publicPath, row.publicKey.endsWith('\n') ? row.publicKey : row.publicKey + '\n', { mode: 0o644 });
+        try {
+            chmodSync(sshDir, 0o700);
+            chmodSync(paths.privatePath, 0o600);
+            chmodSync(paths.publicPath, 0o644);
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    catch (e) {
+        notes.push(`write failed: ${e instanceof Error ? e.message : String(e)}`);
+        return {
+            ok: false,
+            dryRun: false,
+            applied: false,
+            blocked: false,
+            requiresRoot,
+            requiresExecute,
+            plannedPath: paths.privatePath,
+            plannedPublicPath: paths.publicPath,
+            notes
+        };
+    }
+    if (paths.owner && input.host) {
+        const ch = await input.host.runCommand([
+            'bash',
+            '-c',
+            `chown -R ${shellQuote(paths.owner)}:${shellQuote(paths.owner)} ${shellQuote(join(paths.privatePath, '..'))} 2>&1 || true`,
+        ], { timeoutMs: 10_000 });
+        if (ch.exitCode !== 0) {
+            notes.push(tl('notes.auto.t0518', { v0: ((ch.stderr || ch.stdout).slice(0, 120)) }));
+        }
+        else {
+            notes.push(`chown ${paths.owner} ok`);
+        }
+    }
+    else if (paths.owner && !input.host) {
+        notes.push(tl('notes.auto.n1059'));
+    }
+    const identity = updateSshIdentityRecord(input.dataDir, row.id, {
+        install: {
+            path: paths.privatePath,
+            publicPath: paths.publicPath,
+            installedAt: new Date().toISOString(),
+            mode: '600'
+        },
+        status: 'installed'
+    });
+    notes.push('written to disk (installed ≠ remote ssh verified)');
+    return {
+        ok: true,
+        dryRun: false,
+        applied: true,
+        blocked: false,
+        requiresRoot,
+        requiresExecute,
+        plannedPath: paths.privatePath,
+        plannedPublicPath: paths.publicPath,
+        identity: identity ?? undefined,
+        notes
+    };
+}
+export async function uninstallSshIdentity(input) {
+    const notes = [];
+    const row = getSshIdentityInternal(input.dataDir, input.id);
+    if (!row) {
+        return {
+            ok: false,
+            dryRun: !input.apply,
+            applied: false,
+            blocked: false,
+            requiresRoot: false,
+            requiresExecute: false,
+            notes: [tl('notes.ssh.identityNotFound')]
+        };
+    }
+    const path = row.install?.path;
+    const pub = row.install?.publicPath;
+    if (!path) {
+        notes.push(tl('notes.auto.n1079'));
+        if (input.apply) {
+            updateSshIdentityRecord(input.dataDir, row.id, {
+                install: undefined,
+                status: 'stored'
+            });
+        }
+        return {
+            ok: true,
+            dryRun: !input.apply,
+            applied: Boolean(input.apply),
+            blocked: false,
+            requiresRoot: false,
+            requiresExecute: false,
+            notes
+        };
+    }
+    notes.push(`will remove: ${path}`);
+    if (pub)
+        notes.push(`will remove: ${pub}`);
+    if (!input.apply) {
+        notes.push('dry-run');
+        return {
+            ok: true,
+            dryRun: true,
+            applied: false,
+            blocked: false,
+            requiresRoot: false,
+            requiresExecute: false,
+            plannedPath: path,
+            plannedPublicPath: pub,
+            notes
+        };
+    }
+    if (input.purgeFiles !== false) {
+        for (const p of [path, pub]) {
+            if (p && existsSync(p)) {
+                try {
+                    unlinkSync(p);
+                    notes.push(`removed ${p}`);
+                }
+                catch (e) {
+                    notes.push(`remove failed ${p}: ${e instanceof Error ? e.message : String(e)}`);
+                }
+            }
+        }
+    }
+    const identity = updateSshIdentityRecord(input.dataDir, row.id, {
+        install: undefined,
+        status: 'stored'
+    });
+    return {
+        ok: true,
+        dryRun: false,
+        applied: true,
+        blocked: false,
+        requiresRoot: false,
+        requiresExecute: false,
+        identity: identity ?? undefined,
+        notes
+    };
+}
+/** Materialize private key to panel path for -i use (idempotent install for panel purpose). */
+export function materializeIdentityKeyFile(dataDir, id) {
+    const exp = exportSshIdentityPrivate(dataDir, id);
+    if (!exp.ok || !exp.privateKey) {
+        return { ok: false, notes: exp.notes };
+    }
+    const row = getSshIdentityInternal(dataDir, id);
+    if (!row)
+        return { ok: false, notes: [tl('notes.ssh.identityNotFound')] };
+    const paths = defaultInstallPaths(dataDir, row);
+    mkdirSync(join(paths.privatePath, '..'), { recursive: true });
+    writeFileSync(paths.privatePath, exp.privateKey.endsWith('\n') ? exp.privateKey : exp.privateKey + '\n', {
+        mode: 0o600
+    });
+    writeFileSync(paths.publicPath, row.publicKey.endsWith('\n') ? row.publicKey : row.publicKey + '\n', { mode: 0o644 });
+    try {
+        chmodSync(paths.privatePath, 0o600);
+    }
+    catch {
+        /* ignore */
+    }
+    return { ok: true, path: paths.privatePath, notes: [`materialized ${paths.privatePath}`] };
+}
+/** ssh/scp argv fragment: -i path -o IdentitiesOnly=yes -o BatchMode=yes */
+export function buildSshIdentityArgs(privateKeyPath) {
+    return [
+        '-i',
+        privateKeyPath,
+        '-o',
+        'IdentitiesOnly=yes',
+        '-o',
+        'BatchMode=yes',
+        '-o',
+        'StrictHostKeyChecking=accept-new',
+    ];
+}
+//# sourceMappingURL=install.js.map

package/dist/security/ssh-identity/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../../src/security/ssh-identity/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAA0B,MAAM,YAAY,CAAC;AAetE,SAAS,mBAAmB,CAC1B,OAAe,EACf,QAAgE;IAEhE,IAAI,QAAQ,CAAC,OAAO,KAAK,gBAAgB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QACxE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC9D,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC;YACpC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC;SAAE,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;IACtC,MAAM,IAAI,GACR,QAAQ,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC;IAC9D,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC;QACrC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC;QAC7C,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;KAAE,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAOxC;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK;YACpB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,IAAI;YACrB,KAAK,EAAE,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC;SAAE,CAAC;IAChD,CAAC;IAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACtD,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,CAAC,WAAW,YAAY,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,CAAC,UAAU,YAAY,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAErD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QACzD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,iBAAiB,EAAE,KAAK,CAAC,UAAU;YACnC,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC;YAC/B,KAAK;SAAE,CAAC;IACZ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC;IAC1B,MAAM,eAAe,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,YAAY;YACZ,eAAe;YACf,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,iBAAiB,EAAE,KAAK,CAAC,UAAU;YACnC,KAAK;SAAE,CAAC;IACZ,CAAC;IAED,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAC9D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,YAAY;YACZ,eAAe;YACf,KAAK;SAAE,CAAC;IACZ,CAAC;IAED,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC7C,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,EAAE;YAC3F,IAAI,EAAE,KAAK;SAAE,CAAC,CAAC;QACjB,aAAa,CACX,KAAK,CAAC,UAAU,EAChB,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,GAAG,IAAI,EACnE,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;QACF,IAAI,CAAC;YACH,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACzB,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YACpC,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,YAAY;YACZ,eAAe;YACf,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,iBAAiB,EAAE,KAAK,CAAC,UAAU;YACnC,KAAK;SAAE,CAAC;IACZ,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CACpC;YACE,MAAM;YACN,IAAI;YACJ,YAAY,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,eAAe;SAC3H,EACD,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;QACF,IAAI,EAAE,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE;QAC9D,OAAO,EAAE;YACP,IAAI,EAAE,KAAK,CAAC,WAAW;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,IAAI,EAAE,KAAK;SAAE;QACf,MAAM,EAAE,WAAW;KAAE,CAAC,CAAC;IAEzB,KAAK,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAChE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,KAAK;QACd,YAAY;QACZ,eAAe;QACf,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,UAAU;QACnC,QAAQ,EAAE,QAAQ,IAAI,SAAS;QAC/B,KAAK;KAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAK1C;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK;YACpB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,KAAK,EAAE,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC;SAAE,CAAC;IAChD,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE;gBAC7C,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,QAAQ;aAAE,CAAC,CAAC;QACxB,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;YAC7B,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,KAAK;SAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IACnC,IAAI,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;IAE3C,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,WAAW,EAAE,IAAI;YACjB,iBAAiB,EAAE,GAAG;YACtB,KAAK;SAAE,CAAC;IACZ,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,UAAU,CAAC,CAAC,CAAC,CAAC;oBACd,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBAC7B,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE;QAC9D,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,QAAQ;KAAE,CAAC,CAAC;IAEtB,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,KAAK;QACd,YAAY,EAAE,KAAK;QACnB,eAAe,EAAE,KAAK;QACtB,QAAQ,EAAE,QAAQ,IAAI,SAAS;QAC/B,KAAK;KAAE,CAAC;AACZ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,0BAA0B,CACxC,OAAe,EACf,EAAU;IAEV,MAAM,GAAG,GAAG,wBAAwB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAChD,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,GAAG,IAAI,EAAE;QACvG,IAAI,EAAE,KAAK;KAAE,CAAC,CAAC;IACjB,aAAa,CACX,KAAK,CAAC,UAAU,EAChB,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,GAAG,IAAI,EACnE,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACF,IAAI,CAAC;QACH,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,gBAAgB,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAAC,cAAsB;IACzD,OAAO;QACL,IAAI;QACJ,cAAc;QACd,IAAI;QACJ,oBAAoB;QACpB,IAAI;QACJ,eAAe;QACf,IAAI;QACJ,kCAAkC;KACnC,CAAC;AACJ,CAAC"}

package/dist/security/ssh-identity/ops.d.ts

@@ -0,0 +1,77 @@
+import type { HostExecutor } from '../../host/executor.js';
+import type { JsonStore } from '../../db/store.js';
+import { type SshIdentityPublic } from './types.js';
+export type TestSshIdentityResult = {
+    ok: boolean;
+    dryRun: boolean;
+    applied: boolean;
+    blocked: boolean;
+    requiresExecute: boolean;
+    target?: string;
+    identity?: SshIdentityPublic;
+    notes: string[];
+    exitCode?: number;
+};
+/** Parse user@host[:port] or bare host (root@host). */
+export declare function parseSshTarget(target: string): {
+    user: string;
+    host: string;
+    port: number;
+} | null;
+export declare function buildIdentityFileOpts(privateKeyPath: string): string[];
+export declare function buildSshIdentityArgv(privateKeyPath: string, extra: {
+    port?: number;
+    userAtHost: string;
+    remoteCommand?: string[];
+    connectTimeout?: number;
+}): string[];
+export declare function buildScpIdentityArgv(privateKeyPath: string, opts: {
+    port?: number;
+    localPath: string;
+    remoteSpec: string;
+}): string[];
+/**
+ * Resolve private key path for outbound ssh/scp (-i).
+ * Prefers install path; else materializes under dataDir/secrets/ssh/keys/{id}/.
+ */
+export declare function resolveIdentityKeyPath(dataDir: string, identityId: string): {
+    ok: boolean;
+    path?: string;
+    notes: string[];
+};
+export declare function testSshIdentity(input: {
+    dataDir: string;
+    id: string;
+    target: string;
+    apply?: boolean;
+    host?: HostExecutor;
+    executeEnabled?: boolean;
+}): Promise<TestSshIdentityResult>;
+export type RotateSshIdentityResult = {
+    ok: boolean;
+    oldIdentity?: SshIdentityPublic;
+    newIdentity?: SshIdentityPublic;
+    privateKey?: string;
+    notes: string[];
+};
+/** Generate new key; mark old retired. Optionally reveal private once. */
+export declare function rotateSshIdentity(input: {
+    dataDir: string;
+    id: string;
+    revealPrivate?: boolean;
+    db?: JsonStore;
+}): RotateSshIdentityResult;
+export type AuthorizeSelfResult = {
+    ok: boolean;
+    notes: string[];
+    written?: string[];
+    keyId?: string;
+};
+/** Append this identity's public key to binding user's authorized_keys. */
+export declare function authorizeSelfSshIdentity(input: {
+    dataDir: string;
+    db: JsonStore;
+    id: string;
+    host?: HostExecutor;
+}): Promise<AuthorizeSelfResult>;
+//# sourceMappingURL=ops.d.ts.map

package/dist/security/ssh-identity/ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops.d.ts","sourceRoot":"","sources":["../../../src/security/ssh-identity/ops.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAQnD,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,IAAI,CAcP;AAED,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAWtE;AAED,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE;IACL,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GACA,MAAM,EAAE,CAWV;AAED,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB,GACA,MAAM,EAAE,CASV;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAUjD;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA8FjC;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,EAAE,CAAC,EAAE,SAAS,CAAC;CAChB,GAAG,uBAAuB,CAuC1B;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,2EAA2E;AAC3E,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,SAAS,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+B/B"}

package/dist/security/ssh-identity/ops.js

@@ -0,0 +1,244 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Identity ops: test connectivity, rotate, authorize-self (public → authorized_keys).
+ * Outbound helpers for ssh/scp with -i.
+ */
+import { existsSync } from 'node:fs';
+import { addSftpKey, chownSftpProjectKeys } from '../../hosting/sftp-keys.js';
+import { materializeIdentityKeyFile } from './install.js';
+import { createSshIdentity, getSshIdentityInternal, listSshIdentities, updateSshIdentityRecord } from './store.js';
+import { toPublicIdentity } from './types.js';
+/** Parse user@host[:port] or bare host (root@host). */
+export function parseSshTarget(target) {
+    const t = target.trim();
+    if (!t)
+        return null;
+    const m = t.match(/^([^@\s]+)@([^:\s]+)(?::(\d+))?$/);
+    if (m) {
+        return {
+            user: m[1],
+            host: m[2],
+            port: m[3] ? Number(m[3]) : 22
+        };
+    }
+    if (/^[\w.-]+$/.test(t)) {
+        return { user: 'root', host: t, port: 22 };
+    }
+    return null;
+}
+export function buildIdentityFileOpts(privateKeyPath) {
+    return [
+        '-i',
+        privateKeyPath,
+        '-o',
+        'IdentitiesOnly=yes',
+        '-o',
+        'BatchMode=yes',
+        '-o',
+        'StrictHostKeyChecking=accept-new',
+    ];
+}
+export function buildSshIdentityArgv(privateKeyPath, extra) {
+    const argv = ['ssh', ...buildIdentityFileOpts(privateKeyPath)];
+    argv.push('-o', `ConnectTimeout=${extra.connectTimeout ?? 8}`);
+    if (extra.port) {
+        argv.push('-p', String(extra.port));
+    }
+    argv.push(extra.userAtHost);
+    if (extra.remoteCommand?.length) {
+        argv.push(...extra.remoteCommand);
+    }
+    return argv;
+}
+export function buildScpIdentityArgv(privateKeyPath, opts) {
+    return [
+        'scp',
+        ...buildIdentityFileOpts(privateKeyPath),
+        '-P',
+        String(opts.port ?? 22),
+        opts.localPath,
+        opts.remoteSpec,
+    ];
+}
+/**
+ * Resolve private key path for outbound ssh/scp (-i).
+ * Prefers install path; else materializes under dataDir/secrets/ssh/keys/{id}/.
+ */
+export function resolveIdentityKeyPath(dataDir, identityId) {
+    const row = getSshIdentityInternal(dataDir, identityId);
+    if (!row)
+        return { ok: false, notes: [tl('notes.ssh.identityNotFound')] };
+    if (row.install?.path && existsSync(row.install.path)) {
+        return {
+            ok: true,
+            path: row.install.path,
+            notes: [`using install path ${row.install.path}`]
+        };
+    }
+    return materializeIdentityKeyFile(dataDir, identityId);
+}
+export async function testSshIdentity(input) {
+    const notes = [];
+    const row = getSshIdentityInternal(input.dataDir, input.id);
+    if (!row) {
+        return {
+            ok: false,
+            dryRun: !input.apply,
+            applied: false,
+            blocked: false,
+            requiresExecute: true,
+            notes: [tl('notes.ssh.identityNotFound')]
+        };
+    }
+    const parsed = parseSshTarget(input.target);
+    if (!parsed) {
+        return {
+            ok: false,
+            dryRun: !input.apply,
+            applied: false,
+            blocked: false,
+            requiresExecute: false,
+            notes: [tl('notes.auto.n0445')]
+        };
+    }
+    const mat = resolveIdentityKeyPath(input.dataDir, input.id);
+    if (!mat.ok || !mat.path) {
+        return {
+            ok: false,
+            dryRun: !input.apply,
+            applied: false,
+            blocked: false,
+            requiresExecute: false,
+            identity: toPublicIdentity(row),
+            notes: mat.notes
+        };
+    }
+    const argv = buildSshIdentityArgv(mat.path, {
+        port: parsed.port,
+        userAtHost: `${parsed.user}@${parsed.host}`,
+        remoteCommand: ['true']
+    });
+    notes.push(`plan: ${argv.join(' ')}`);
+    notes.push(tl('notes.auto.n0839'));
+    if (!input.apply) {
+        notes.push(tl('notes.auto.n0267'));
+        return {
+            ok: true,
+            dryRun: true,
+            applied: false,
+            blocked: false,
+            requiresExecute: true,
+            target: `${parsed.user}@${parsed.host}:${parsed.port}`,
+            identity: toPublicIdentity(row),
+            notes
+        };
+    }
+    if (!input.executeEnabled || !input.host) {
+        notes.push(tl('notes.auto.n0230'));
+        return {
+            ok: false,
+            dryRun: false,
+            applied: false,
+            blocked: true,
+            requiresExecute: true,
+            target: `${parsed.user}@${parsed.host}:${parsed.port}`,
+            identity: toPublicIdentity(row),
+            notes
+        };
+    }
+    const r = await input.host.runCommand(argv, { timeoutMs: 20_000 });
+    const ok = r.exitCode === 0;
+    notes.push(ok
+        ? tl('notes.auto.n0434')
+        : tl('notes.auto.t0519', { v0: ((r.stderr || r.stdout || '').slice(0, 160)) }));
+    const identity = updateSshIdentityRecord(input.dataDir, row.id, {
+        status: ok ? 'verified' : 'error',
+        lastVerifiedAt: new Date().toISOString(),
+        lastVerifyNote: ok
+            ? `ok ${parsed.user}@${parsed.host}`
+            : notes[notes.length - 1]
+    });
+    return {
+        ok,
+        dryRun: false,
+        applied: true,
+        blocked: false,
+        requiresExecute: false,
+        target: `${parsed.user}@${parsed.host}:${parsed.port}`,
+        identity: identity ?? undefined,
+        notes,
+        exitCode: r.exitCode
+    };
+}
+/** Generate new key; mark old retired. Optionally reveal private once. */
+export function rotateSshIdentity(input) {
+    const old = getSshIdentityInternal(input.dataDir, input.id);
+    if (!old)
+        return { ok: false, notes: [tl('notes.ssh.identityNotFound')] };
+    const notes = [`retire ${old.id} (${old.fingerprintSha256})`];
+    updateSshIdentityRecord(input.dataDir, old.id, {
+        status: 'retired',
+        name: old.name.endsWith(' (retired)') ? old.name : `${old.name} (retired)`
+    });
+    const baseName = old.name.replace(/\s*\(retired\)\s*$/, '').trim() || old.name;
+    const created = createSshIdentity(input.dataDir, {
+        name: baseName,
+        algorithm: old.algorithm,
+        purpose: old.purpose,
+        binding: old.binding,
+        comment: old.comment ?? `rotated from ${old.fingerprintSha256}`,
+        createdBy: old.createdBy,
+        revealPrivate: input.revealPrivate
+    }, input.db);
+    if (!created.ok || !created.identity) {
+        return {
+            ok: false,
+            oldIdentity: toPublicIdentity(old),
+            notes: [...notes, ...(created.notes ?? ['create failed'])]
+        };
+    }
+    notes.push(...created.notes);
+    notes.push(`new ${created.identity.id} ${created.identity.fingerprintSha256}`);
+    notes.push(tl('notes.auto.n1345'));
+    return {
+        ok: true,
+        oldIdentity: listSshIdentities(input.dataDir).find((i) => i.id === old.id),
+        newIdentity: created.identity,
+        privateKey: created.privateKey,
+        notes
+    };
+}
+/** Append this identity's public key to binding user's authorized_keys. */
+export async function authorizeSelfSshIdentity(input) {
+    const row = getSshIdentityInternal(input.dataDir, input.id);
+    if (!row)
+        return { ok: false, notes: [tl('notes.ssh.identityNotFound')] };
+    const linuxUser = row.binding?.linuxUser;
+    const homeDir = row.binding?.homeDir;
+    const projectId = row.binding?.projectId;
+    if (!linuxUser && !projectId && !homeDir) {
+        return {
+            ok: false,
+            notes: [tl('notes.auto.n0305')]
+        };
+    }
+    const r = addSftpKey(input.db, input.dataDir, {
+        username: linuxUser || 'unknown',
+        publicKey: row.publicKey,
+        comment: `ysk-identity:${row.id.slice(0, 8)} ${row.name}`,
+        projectId,
+        linuxUser,
+        homeDir
+    });
+    if (r.ok && homeDir && linuxUser && input.host) {
+        const ch = await chownSftpProjectKeys(input.host, homeDir, linuxUser);
+        r.notes.push(...ch);
+    }
+    return {
+        ok: r.ok,
+        notes: r.notes,
+        written: r.written,
+        keyId: r.key?.id
+    };
+}
+//# sourceMappingURL=ops.js.map

package/dist/security/ssh-identity/ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops.js","sourceRoot":"","sources":["../../../src/security/ssh-identity/ops.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAGrC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAA0B,MAAM,YAAY,CAAC;AActE,uDAAuD;AACvD,MAAM,UAAU,cAAc,CAAC,MAAc;IAK3C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,IAAI,CAAC,EAAE,CAAC;QACN,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE;YACX,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE;YACX,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;SAAE,CAAC;IACrC,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,cAAsB;IAC1D,OAAO;QACL,IAAI;QACJ,cAAc;QACd,IAAI;QACJ,oBAAoB;QACpB,IAAI;QACJ,eAAe;QACf,IAAI;QACJ,kCAAkC;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,cAAsB,EACtB,KAKC;IAED,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,KAAK,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,cAAsB,EACtB,IAIC;IAED,OAAO;QACL,KAAK;QACL,GAAG,qBAAqB,CAAC,cAAc,CAAC;QACxC,IAAI;QACJ,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,UAAU;KAChB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,UAAkB;IAElB,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC;IAC1E,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;YACtB,KAAK,EAAE,CAAC,sBAAsB,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;SAAE,CAAC;IACxD,CAAC;IACD,OAAO,0BAA0B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAOrC;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK;YACpB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,eAAe,EAAE,IAAI;YACrB,KAAK,EAAE,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC;SAAE,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK;YACpB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,eAAe,EAAE,KAAK;YACtB,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAAE,CAAC;IACtC,CAAC;IAED,MAAM,GAAG,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK;YACpB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC;YAC/B,KAAK,EAAE,GAAG,CAAC,KAAK;SAAE,CAAC;IACvB,CAAC;IAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,EAAE;QAC1C,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;QAC3C,aAAa,EAAE,CAAC,MAAM,CAAC;KAAE,CAAC,CAAC;IAC7B,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAEnC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,eAAe,EAAE,IAAI;YACrB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;YACtD,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC;YAC/B,KAAK;SAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,IAAI;YACrB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;YACtD,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC;YAC/B,KAAK;SAAE,CAAC;IACZ,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC5B,KAAK,CAAC,IAAI,CACR,EAAE;QACA,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;QACxB,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CACjF,CAAC;IAEF,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE;QAC9D,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO;QACjC,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACxC,cAAc,EAAE,EAAE;YAChB,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;YACpC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;KAAE,CAAC,CAAC;IAEjC,OAAO;QACL,EAAE;QACF,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,KAAK;QACd,eAAe,EAAE,KAAK;QACtB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;QACtD,QAAQ,EAAE,QAAQ,IAAI,SAAS;QAC/B,KAAK;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;KAAE,CAAC;AAC3B,CAAC;AAUD,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAAC,KAKjC;IACC,MAAM,GAAG,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC;IAE1E,MAAM,KAAK,GAAa,CAAC,UAAU,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC;IACxE,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE;QAC7C,MAAM,EAAE,SAAS;QACjB,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,YAAY;KAAE,CAAC,CAAC;IAEhF,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC;IAC/E,MAAM,OAAO,GAAG,iBAAiB,CAC/B,KAAK,CAAC,OAAO,EACb;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB,GAAG,CAAC,iBAAiB,EAAE;QAC/D,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,aAAa,EAAE,KAAK,CAAC,aAAa;KAAE,EACtC,KAAK,CAAC,EAAE,CACT,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW,EAAE,gBAAgB,CAAC,GAAG,CAAC;YAClC,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;SAAE,CAAC;IACjE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC/E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAEnC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,WAAW,EAAE,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1E,WAAW,EAAE,OAAO,CAAC,QAAQ;QAC7B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK;KAAE,CAAC;AACZ,CAAC;AASD,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAK9C;IACC,MAAM,GAAG,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC;IAE1E,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC;IACrC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC;IACzC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAAE,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE;QAC5C,QAAQ,EAAE,SAAS,IAAI,SAAS;QAChC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,gBAAgB,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE;QACzD,SAAS;QACT,SAAS;QACT,OAAO;KAAE,CAAC,CAAC;IAEb,IAAI,CAAC,CAAC,EAAE,IAAI,OAAO,IAAI,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACtE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtB,CAAC;IAED,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE;KAAE,CAAC;AACvB,CAAC"}