@credo-ts/askar-to-drizzle-storage-migration 0.6.0-alpha-20251010154241 → 0.6.0-alpha-20251010164336

package/build/packages/didcomm/src/DidCommDispatcher.mjs

@@ -0,0 +1,100 @@
+import { __decorateMetadata } from "../../../_virtual/_@oxc-project_runtime@0.94.0/helpers/decorateMetadata.mjs";
+import { __decorate } from "../../../_virtual/_@oxc-project_runtime@0.94.0/helpers/decorate.mjs";
+import { canHandleMessageType, parseMessageType } from "./util/messageType.mjs";
+import { DidCommProblemReportMessage } from "./messages/problem-reports/DidCommProblemReportMessage.mjs";
+import { DidCommProblemReportError } from "./errors/problem-reports/DidCommProblemReportError.mjs";
+import "./errors/problem-reports/index.mjs";
+import { DidCommMessageHandlerMiddlewareRunner } from "./handlers/DidCommMessageHandlerMiddleware.mjs";
+import "./messages/index.mjs";
+import { DidCommProblemReportReason } from "./models/problem-reports/DidCommProblemReportReason.mjs";
+import { DidCommOutboundMessageContext } from "./models/DidCommOutboundMessageContext.mjs";
+import "./models/index.mjs";
+import { DidCommEventTypes } from "./DidCommEvents.mjs";
+import { __decorateParam } from "../../../_virtual/_@oxc-project_runtime@0.94.0/helpers/decorateParam.mjs";
+import { DidCommMessageSender } from "./DidCommMessageSender.mjs";
+import { DidCommMessageHandlerRegistry } from "./DidCommMessageHandlerRegistry.mjs";
+import { CredoError, EventEmitter, InjectionSymbols, inject, injectable } from "@credo-ts/core";
+
+//#region ../didcomm/src/DidCommDispatcher.ts
+var _ref, _ref2, _ref3;
+let DidCommDispatcher = class DidCommDispatcher$1 {
+	constructor(messageSender, eventEmitter, messageHandlerRegistry, logger) {
+		this.defaultHandlerMiddleware = async (inboundMessageContext, next) => {
+			let messageHandler = inboundMessageContext.messageHandler;
+			const fallbackMessageHandler = inboundMessageContext.agentContext.dependencyManager.resolve(DidCommMessageHandlerRegistry).fallbackMessageHandler;
+			if (!messageHandler && fallbackMessageHandler) messageHandler = {
+				supportedMessages: [],
+				handle: fallbackMessageHandler
+			};
+			if (!messageHandler) throw new DidCommProblemReportError(`Error handling message ${inboundMessageContext.message.id} with type ${inboundMessageContext.message.type}. The message type is not supported`, { problemCode: DidCommProblemReportReason.MessageParseFailure });
+			const outboundMessage = await messageHandler.handle(inboundMessageContext);
+			if (outboundMessage) inboundMessageContext.setResponseMessage(outboundMessage);
+			await next();
+		};
+		this.messageSender = messageSender;
+		this.eventEmitter = eventEmitter;
+		this.messageHandlerRegistry = messageHandlerRegistry;
+		this.logger = logger;
+	}
+	async dispatch(messageContext) {
+		const { agentContext, connection, senderKey, recipientKey, message, encryptedMessage } = messageContext;
+		const messageHandler = this.messageHandlerRegistry.getHandlerForMessageType(message.type);
+		if (messageHandler) messageContext.setMessageHandler(messageHandler);
+		let outboundMessage;
+		try {
+			const middlewares = [...agentContext.dependencyManager.resolve(DidCommMessageHandlerRegistry).messageHandlerMiddlewares, this.defaultHandlerMiddleware];
+			await DidCommMessageHandlerMiddlewareRunner.run(middlewares, messageContext);
+			outboundMessage = messageContext.responseMessage;
+		} catch (error) {
+			const problemReportMessage = error.problemReport;
+			if (problemReportMessage instanceof DidCommProblemReportMessage && messageContext.connection) {
+				if (canHandleMessageType(DidCommProblemReportMessage, parseMessageType(messageContext.message.type))) throw new CredoError(`Not sending problem report in response to problem report: ${message}`);
+				const { protocolUri: problemReportProtocolUri } = parseMessageType(problemReportMessage.type);
+				const { protocolUri: inboundProtocolUri } = parseMessageType(messageContext.message.type);
+				if (inboundProtocolUri === problemReportProtocolUri) problemReportMessage.setThread({ threadId: message.threadId });
+				else problemReportMessage.setThread({ parentThreadId: message.id });
+				outboundMessage = new DidCommOutboundMessageContext(problemReportMessage, {
+					agentContext,
+					connection: messageContext.connection,
+					inboundMessageContext: messageContext
+				});
+			} else {
+				this.logger.error(`Error handling message with type ${message.type}`, {
+					message: message.toJSON(),
+					error,
+					senderKey: senderKey?.fingerprint,
+					recipientKey: recipientKey?.fingerprint,
+					connectionId: connection?.id
+				});
+				throw error;
+			}
+		}
+		if (outboundMessage) {
+			if (!outboundMessage.inboundMessageContext) outboundMessage.inboundMessageContext = messageContext;
+			await this.messageSender.sendMessage(outboundMessage);
+		}
+		this.eventEmitter.emit(agentContext, {
+			type: DidCommEventTypes.DidCommMessageProcessed,
+			payload: {
+				message,
+				connection,
+				receivedAt: messageContext.receivedAt,
+				encryptedMessage
+			}
+		});
+	}
+};
+DidCommDispatcher = __decorate([
+	injectable(),
+	__decorateParam(3, inject(InjectionSymbols.Logger)),
+	__decorateMetadata("design:paramtypes", [
+		typeof (_ref = typeof DidCommMessageSender !== "undefined" && DidCommMessageSender) === "function" ? _ref : Object,
+		typeof (_ref2 = typeof EventEmitter !== "undefined" && EventEmitter) === "function" ? _ref2 : Object,
+		typeof (_ref3 = typeof DidCommMessageHandlerRegistry !== "undefined" && DidCommMessageHandlerRegistry) === "function" ? _ref3 : Object,
+		Object
+	])
+], DidCommDispatcher);
+
+//#endregion
+export { DidCommDispatcher };
+//# sourceMappingURL=DidCommDispatcher.mjs.map

package/build/packages/didcomm/src/DidCommDispatcher.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DidCommDispatcher.mjs","names":["DidCommDispatcher","logger: Logger","outboundMessage: DidCommOutboundMessageContext<DidCommMessage> | undefined"],"sources":["../../../../../didcomm/src/DidCommDispatcher.ts"],"sourcesContent":["import type { DidCommMessageProcessedEvent } from './DidCommEvents'\nimport type { DidCommMessage } from './DidCommMessage'\nimport type { DidCommMessageHandlerMiddleware } from './handlers/DidCommMessageHandlerMiddleware'\nimport type { DidCommInboundMessageContext } from './models/DidCommInboundMessageContext'\n\nimport { CredoError, EventEmitter, InjectionSymbols, type Logger, inject, injectable } from '@credo-ts/core'\n\nimport { DidCommEventTypes } from './DidCommEvents'\nimport { DidCommMessageHandlerRegistry } from './DidCommMessageHandlerRegistry'\nimport { DidCommMessageSender } from './DidCommMessageSender'\nimport { DidCommProblemReportError } from './errors/problem-reports'\nimport { DidCommMessageHandlerMiddlewareRunner } from './handlers'\nimport { DidCommProblemReportMessage } from './messages'\nimport { DidCommOutboundMessageContext } from './models'\nimport { DidCommProblemReportReason } from './models/problem-reports'\nimport { canHandleMessageType, parseMessageType } from './util/messageType'\n\n@injectable()\nexport class DidCommDispatcher {\n  private messageHandlerRegistry: DidCommMessageHandlerRegistry\n  private messageSender: DidCommMessageSender\n  private eventEmitter: EventEmitter\n  private logger: Logger\n\n  public constructor(\n    messageSender: DidCommMessageSender,\n    eventEmitter: EventEmitter,\n    messageHandlerRegistry: DidCommMessageHandlerRegistry,\n    @inject(InjectionSymbols.Logger) logger: Logger\n  ) {\n    this.messageSender = messageSender\n    this.eventEmitter = eventEmitter\n    this.messageHandlerRegistry = messageHandlerRegistry\n    this.logger = logger\n  }\n\n  private defaultHandlerMiddleware: DidCommMessageHandlerMiddleware = async (inboundMessageContext, next) => {\n    let messageHandler = inboundMessageContext.messageHandler\n\n    const fallbackMessageHandler =\n      inboundMessageContext.agentContext.dependencyManager.resolve(DidCommMessageHandlerRegistry).fallbackMessageHandler\n    if (!messageHandler && fallbackMessageHandler) {\n      messageHandler = {\n        supportedMessages: [],\n        handle: fallbackMessageHandler,\n      }\n    }\n\n    if (!messageHandler) {\n      throw new DidCommProblemReportError(\n        `Error handling message ${inboundMessageContext.message.id} with type ${inboundMessageContext.message.type}. The message type is not supported`,\n        {\n          problemCode: DidCommProblemReportReason.MessageParseFailure,\n        }\n      )\n    }\n\n    const outboundMessage = await messageHandler.handle(inboundMessageContext)\n    if (outboundMessage) {\n      inboundMessageContext.setResponseMessage(outboundMessage)\n    }\n\n    await next()\n  }\n\n  public async dispatch(messageContext: DidCommInboundMessageContext): Promise<void> {\n    const { agentContext, connection, senderKey, recipientKey, message, encryptedMessage } = messageContext\n\n    // Set default handler if available, middleware can still override the message handler\n    const messageHandler = this.messageHandlerRegistry.getHandlerForMessageType(message.type)\n    if (messageHandler) {\n      messageContext.setMessageHandler(messageHandler)\n    }\n\n    let outboundMessage: DidCommOutboundMessageContext<DidCommMessage> | undefined\n\n    try {\n      const messageHandlerMiddlewares =\n        agentContext.dependencyManager.resolve(DidCommMessageHandlerRegistry).messageHandlerMiddlewares\n      const middlewares = [...messageHandlerMiddlewares, this.defaultHandlerMiddleware]\n      await DidCommMessageHandlerMiddlewareRunner.run(middlewares, messageContext)\n\n      outboundMessage = messageContext.responseMessage\n    } catch (error) {\n      const problemReportMessage = error.problemReport\n\n      if (problemReportMessage instanceof DidCommProblemReportMessage && messageContext.connection) {\n        const messageType = parseMessageType(messageContext.message.type)\n        if (canHandleMessageType(DidCommProblemReportMessage, messageType)) {\n          throw new CredoError(`Not sending problem report in response to problem report: ${message}`)\n        }\n\n        const { protocolUri: problemReportProtocolUri } = parseMessageType(problemReportMessage.type)\n        const { protocolUri: inboundProtocolUri } = parseMessageType(messageContext.message.type)\n\n        // If the inbound protocol uri is the same as the problem report protocol uri, we can see the interaction as the same thread\n        // However if it is no the same we should see it as a new thread, where the inbound message `@id` is the parentThreadId\n        if (inboundProtocolUri === problemReportProtocolUri) {\n          problemReportMessage.setThread({\n            threadId: message.threadId,\n          })\n        } else {\n          problemReportMessage.setThread({\n            parentThreadId: message.id,\n          })\n        }\n\n        outboundMessage = new DidCommOutboundMessageContext(problemReportMessage, {\n          agentContext,\n          connection: messageContext.connection,\n          inboundMessageContext: messageContext,\n        })\n      } else {\n        this.logger.error(`Error handling message with type ${message.type}`, {\n          message: message.toJSON(),\n          error,\n          senderKey: senderKey?.fingerprint,\n          recipientKey: recipientKey?.fingerprint,\n          connectionId: connection?.id,\n        })\n\n        throw error\n      }\n    }\n\n    if (outboundMessage) {\n      // set the inbound message context, if not already defined\n      if (!outboundMessage.inboundMessageContext) {\n        outboundMessage.inboundMessageContext = messageContext\n      }\n\n      await this.messageSender.sendMessage(outboundMessage)\n    }\n\n    // Emit event that allows to hook into received messages\n    this.eventEmitter.emit<DidCommMessageProcessedEvent>(agentContext, {\n      type: DidCommEventTypes.DidCommMessageProcessed,\n      payload: {\n        message,\n        connection,\n        receivedAt: messageContext.receivedAt,\n        encryptedMessage,\n      },\n    })\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAkBO,8BAAMA,oBAAkB;CAM7B,AAAO,YACL,eACA,cACA,wBACA,AAAiCC,QACjC;OAOM,2BAA4D,OAAO,uBAAuB,SAAS;GACzG,IAAI,iBAAiB,sBAAsB;GAE3C,MAAM,yBACJ,sBAAsB,aAAa,kBAAkB,QAAQ,8BAA8B,CAAC;AAC9F,OAAI,CAAC,kBAAkB,uBACrB,kBAAiB;IACf,mBAAmB,EAAE;IACrB,QAAQ;IACT;AAGH,OAAI,CAAC,eACH,OAAM,IAAI,0BACR,0BAA0B,sBAAsB,QAAQ,GAAG,aAAa,sBAAsB,QAAQ,KAAK,sCAC3G,EACE,aAAa,2BAA2B,qBACzC,CACF;GAGH,MAAM,kBAAkB,MAAM,eAAe,OAAO,sBAAsB;AAC1E,OAAI,gBACF,uBAAsB,mBAAmB,gBAAgB;AAG3D,SAAM,MAAM;;AAhCZ,OAAK,gBAAgB;AACrB,OAAK,eAAe;AACpB,OAAK,yBAAyB;AAC9B,OAAK,SAAS;;CAgChB,MAAa,SAAS,gBAA6D;EACjF,MAAM,EAAE,cAAc,YAAY,WAAW,cAAc,SAAS,qBAAqB;EAGzF,MAAM,iBAAiB,KAAK,uBAAuB,yBAAyB,QAAQ,KAAK;AACzF,MAAI,eACF,gBAAe,kBAAkB,eAAe;EAGlD,IAAIC;AAEJ,MAAI;GAGF,MAAM,cAAc,CAAC,GADnB,aAAa,kBAAkB,QAAQ,8BAA8B,CAAC,2BACrB,KAAK,yBAAyB;AACjF,SAAM,sCAAsC,IAAI,aAAa,eAAe;AAE5E,qBAAkB,eAAe;WAC1B,OAAO;GACd,MAAM,uBAAuB,MAAM;AAEnC,OAAI,gCAAgC,+BAA+B,eAAe,YAAY;AAE5F,QAAI,qBAAqB,6BADL,iBAAiB,eAAe,QAAQ,KAAK,CACC,CAChE,OAAM,IAAI,WAAW,6DAA6D,UAAU;IAG9F,MAAM,EAAE,aAAa,6BAA6B,iBAAiB,qBAAqB,KAAK;IAC7F,MAAM,EAAE,aAAa,uBAAuB,iBAAiB,eAAe,QAAQ,KAAK;AAIzF,QAAI,uBAAuB,yBACzB,sBAAqB,UAAU,EAC7B,UAAU,QAAQ,UACnB,CAAC;QAEF,sBAAqB,UAAU,EAC7B,gBAAgB,QAAQ,IACzB,CAAC;AAGJ,sBAAkB,IAAI,8BAA8B,sBAAsB;KACxE;KACA,YAAY,eAAe;KAC3B,uBAAuB;KACxB,CAAC;UACG;AACL,SAAK,OAAO,MAAM,oCAAoC,QAAQ,QAAQ;KACpE,SAAS,QAAQ,QAAQ;KACzB;KACA,WAAW,WAAW;KACtB,cAAc,cAAc;KAC5B,cAAc,YAAY;KAC3B,CAAC;AAEF,UAAM;;;AAIV,MAAI,iBAAiB;AAEnB,OAAI,CAAC,gBAAgB,sBACnB,iBAAgB,wBAAwB;AAG1C,SAAM,KAAK,cAAc,YAAY,gBAAgB;;AAIvD,OAAK,aAAa,KAAmC,cAAc;GACjE,MAAM,kBAAkB;GACxB,SAAS;IACP;IACA;IACA,YAAY,eAAe;IAC3B;IACD;GACF,CAAC;;;;CA9HL,YAAY;oBAWR,OAAO,iBAAiB,OAAO"}

package/build/packages/didcomm/src/DidCommEnvelopeService.js

@@ -0,0 +1,237 @@
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.js');
+const require_decorateMetadata = require('../../../_virtual/_@oxc-project_runtime@0.94.0/helpers/decorateMetadata.js');
+const require_decorate = require('../../../_virtual/_@oxc-project_runtime@0.94.0/helpers/decorate.js');
+const require_DidCommModuleConfig = require('./DidCommModuleConfig.js');
+const require_decorateParam = require('../../../_virtual/_@oxc-project_runtime@0.94.0/helpers/decorateParam.js');
+const require_DidCommDocumentService = require('./services/DidCommDocumentService.js');
+const require_helpers = require('./modules/connections/services/helpers.js');
+const require_DidCommOutOfBandRole = require('./modules/oob/domain/DidCommOutOfBandRole.js');
+const require_DidCommOutOfBandRepository = require('./modules/oob/repository/DidCommOutOfBandRepository.js');
+const require_outOfBandRecordMetadataTypes = require('./modules/oob/repository/outOfBandRecordMetadataTypes.js');
+const require_DidCommForwardMessage = require('./modules/routing/messages/DidCommForwardMessage.js');
+const require_DidCommMediatorRoutingRepository = require('./modules/routing/repository/DidCommMediatorRoutingRepository.js');
+let __credo_ts_core = require("@credo-ts/core");
+__credo_ts_core = require_rolldown_runtime.__toESM(__credo_ts_core);
+
+//#region ../didcomm/src/DidCommEnvelopeService.ts
+var _ref;
+let DidCommEnvelopeService = class DidCommEnvelopeService$1 {
+	constructor(logger, didcommDocumentService) {
+		this.logger = logger;
+		this.didcommDocumentService = didcommDocumentService;
+	}
+	async encryptDidcommV1Message(agentContext, message, recipientKeys, senderKey) {
+		const kms = agentContext.dependencyManager.resolve(__credo_ts_core.Kms.KeyManagementApi);
+		const contentEncryptionKey = kms.randomBytes({ length: 32 });
+		const recipients = [];
+		for (const recipientKey of recipientKeys) {
+			let encryptedSender = void 0;
+			if (senderKey) {
+				const { encrypted: encrypted$2 } = await kms.encrypt({
+					key: { keyAgreement: {
+						algorithm: "ECDH-HSALSA20",
+						externalPublicJwk: recipientKey.convertTo(__credo_ts_core.Kms.X25519PublicJwk).toJson()
+					} },
+					encryption: { algorithm: "XSALSA20-POLY1305" },
+					data: __credo_ts_core.TypedArrayEncoder.fromString(__credo_ts_core.TypedArrayEncoder.toBase58(senderKey.publicKey.publicKey))
+				});
+				encryptedSender = __credo_ts_core.TypedArrayEncoder.toBase64URL(encrypted$2);
+			}
+			const { encrypted: encrypted$1, iv: iv$1 } = await kms.encrypt({
+				key: { keyAgreement: {
+					algorithm: "ECDH-HSALSA20",
+					externalPublicJwk: recipientKey.convertTo(__credo_ts_core.Kms.X25519PublicJwk).toJson(),
+					keyId: senderKey?.keyId
+				} },
+				data: contentEncryptionKey,
+				encryption: { algorithm: "XSALSA20-POLY1305" }
+			});
+			recipients.push({
+				encrypted_key: __credo_ts_core.TypedArrayEncoder.toBase64URL(encrypted$1),
+				header: {
+					kid: __credo_ts_core.TypedArrayEncoder.toBase58(recipientKey.publicKey.publicKey),
+					iv: iv$1 ? __credo_ts_core.TypedArrayEncoder.toBase64URL(iv$1) : void 0,
+					sender: encryptedSender
+				}
+			});
+		}
+		const protectedString = __credo_ts_core.JsonEncoder.toBase64URL({
+			enc: "xchacha20poly1305_ietf",
+			typ: "JWM/1.0",
+			alg: senderKey ? "Authcrypt" : "Anoncrypt",
+			recipients
+		});
+		const { encrypted, iv, tag } = await kms.encrypt({
+			encryption: {
+				algorithm: "C20P",
+				aad: __credo_ts_core.TypedArrayEncoder.fromString(protectedString)
+			},
+			data: __credo_ts_core.JsonEncoder.toBuffer(message),
+			key: { privateJwk: {
+				kty: "oct",
+				k: __credo_ts_core.TypedArrayEncoder.toBase64URL(contentEncryptionKey)
+			} }
+		});
+		if (!iv || !tag) throw new __credo_ts_core.CredoError("Expected 'iv' and 'tag' to be defined");
+		return {
+			ciphertext: __credo_ts_core.TypedArrayEncoder.toBase64URL(encrypted),
+			iv: __credo_ts_core.TypedArrayEncoder.toBase64URL(iv),
+			tag: __credo_ts_core.TypedArrayEncoder.toBase64URL(tag),
+			protected: protectedString
+		};
+	}
+	async decryptDidcommV1Message(agentContext, encryptedMessage) {
+		const kms = agentContext.dependencyManager.resolve(__credo_ts_core.Kms.KeyManagementApi);
+		const protectedJson = __credo_ts_core.JsonEncoder.fromBase64(encryptedMessage.protected);
+		const alg = protectedJson.alg;
+		if (alg !== "Anoncrypt" && alg !== "Authcrypt") throw new __credo_ts_core.CredoError(`Unsupported pack algorithm: ${alg}`);
+		if (protectedJson.enc !== "xchacha20poly1305_ietf") throw new __credo_ts_core.CredoError(`Unsupported enc algorithm: ${protectedJson.enc}`);
+		let recipientKey = null;
+		let recipient = null;
+		for (const _recipient of protectedJson.recipients) {
+			recipientKey = await this.extractOurRecipientKeyWithKeyId(agentContext, _recipient);
+			if (recipientKey) recipient = _recipient;
+		}
+		if (!recipientKey || !recipient) throw new __credo_ts_core.CredoError("No corresponding recipient key found");
+		if (alg === "Authcrypt" && (!recipient.header.sender || !recipient.header.iv)) throw new __credo_ts_core.CredoError("Sender and iv header values are required for Authcrypt");
+		let senderPublicJwk = void 0;
+		if (recipient.header.sender) {
+			const { data } = await kms.decrypt({
+				key: { keyAgreement: {
+					algorithm: "ECDH-HSALSA20",
+					keyId: recipientKey.keyId
+				} },
+				decryption: { algorithm: "XSALSA20-POLY1305" },
+				encrypted: __credo_ts_core.TypedArrayEncoder.fromBase64(recipient.header.sender)
+			});
+			senderPublicJwk = __credo_ts_core.Kms.PublicJwk.fromPublicKey({
+				crv: "Ed25519",
+				kty: "OKP",
+				publicKey: __credo_ts_core.TypedArrayEncoder.fromBase58(__credo_ts_core.TypedArrayEncoder.toUtf8String(data))
+			});
+		}
+		const { data: contentEncryptionKey } = await kms.decrypt({
+			decryption: {
+				algorithm: "XSALSA20-POLY1305",
+				iv: recipient.header.iv ? __credo_ts_core.TypedArrayEncoder.fromBase64(recipient.header.iv) : void 0
+			},
+			encrypted: __credo_ts_core.TypedArrayEncoder.fromBase64(recipient.encrypted_key),
+			key: { keyAgreement: {
+				algorithm: "ECDH-HSALSA20",
+				keyId: recipientKey.keyId,
+				externalPublicJwk: senderPublicJwk?.convertTo(__credo_ts_core.Kms.X25519PublicJwk).toJson()
+			} }
+		});
+		const { data: message } = await kms.decrypt({
+			decryption: {
+				algorithm: "C20P",
+				iv: __credo_ts_core.TypedArrayEncoder.fromBase64(encryptedMessage.iv),
+				tag: __credo_ts_core.TypedArrayEncoder.fromBase64(encryptedMessage.tag),
+				aad: __credo_ts_core.TypedArrayEncoder.fromString(encryptedMessage.protected)
+			},
+			key: { privateJwk: {
+				kty: "oct",
+				k: __credo_ts_core.TypedArrayEncoder.toBase64URL(contentEncryptionKey)
+			} },
+			encrypted: __credo_ts_core.TypedArrayEncoder.fromBase64(encryptedMessage.ciphertext)
+		});
+		return {
+			plaintextMessage: __credo_ts_core.JsonEncoder.fromBuffer(message),
+			senderKey: senderPublicJwk,
+			recipientKey
+		};
+	}
+	async packMessage(agentContext, payload, keys) {
+		const didcommConfig = agentContext.dependencyManager.resolve(require_DidCommModuleConfig.DidCommModuleConfig);
+		const { routingKeys, senderKey } = keys;
+		let recipientKeys = keys.recipientKeys;
+		const message = payload.toJSON({ useDidSovPrefixWhereAllowed: didcommConfig.useDidSovPrefixWhereAllowed });
+		this.logger.debug(`Pack outbound message ${message["@type"]}`);
+		let encryptedMessage = await this.encryptDidcommV1Message(agentContext, message, recipientKeys, senderKey);
+		for (const routingKey of routingKeys) {
+			const forwardMessage = new require_DidCommForwardMessage.DidCommForwardMessage({
+				to: __credo_ts_core.TypedArrayEncoder.toBase58(recipientKeys[0].publicKey.publicKey),
+				message: encryptedMessage
+			});
+			recipientKeys = [routingKey];
+			this.logger.debug("Forward message created", forwardMessage);
+			const forwardJson = forwardMessage.toJSON({ useDidSovPrefixWhereAllowed: didcommConfig.useDidSovPrefixWhereAllowed });
+			encryptedMessage = await this.encryptDidcommV1Message(agentContext, forwardJson, [routingKey]);
+		}
+		this.logger.debug(`Packed outbound message ${message["@type"]}`, { routingKeys: routingKeys.map((routingKey) => routingKey.fingerprint) });
+		return encryptedMessage;
+	}
+	async unpackMessage(agentContext, encryptedMessage) {
+		return await this.decryptDidcommV1Message(agentContext, encryptedMessage);
+	}
+	async extractOurRecipientKeyWithKeyId(agentContext, recipient) {
+		const kms = agentContext.resolve(__credo_ts_core.Kms.KeyManagementApi);
+		const publicKey = __credo_ts_core.Kms.PublicJwk.fromPublicKey({
+			kty: "OKP",
+			crv: "Ed25519",
+			publicKey: __credo_ts_core.TypedArrayEncoder.fromBase58(recipient.header.kid)
+		});
+		try {
+			const { didDocument, keys } = await this.didcommDocumentService.resolveCreatedDidDocumentWithKeysByRecipientKey(agentContext, publicKey);
+			const verificationMethod = didDocument.findVerificationMethodByPublicKey(publicKey);
+			const kmsKeyId = keys?.find(({ didDocumentRelativeKeyId }) => verificationMethod.id.endsWith(didDocumentRelativeKeyId))?.kmsKeyId;
+			agentContext.config.logger.debug(`Found did '${didDocument.id}' for recipient key '${publicKey.fingerprint}' for incoming didcomm message`);
+			publicKey.keyId = kmsKeyId ?? publicKey.legacyKeyId;
+			return publicKey;
+		} catch (error) {
+			const mediatorRoutingRepository = agentContext.dependencyManager.resolve(require_DidCommMediatorRoutingRepository.DidCommMediatorRoutingRepository);
+			if (error instanceof __credo_ts_core.RecordNotFoundError) {
+				const mediatorRoutingRecord = await mediatorRoutingRepository.findSingleByQuery(agentContext, { routingKeyFingerprints: [publicKey.fingerprint] });
+				if (mediatorRoutingRecord) {
+					agentContext.config.logger.debug(`Found mediator routing record with id '${mediatorRoutingRecord.id}' for recipient key '${publicKey.fingerprint}' for incoming didcomm message`);
+					const routingKey = mediatorRoutingRecord.routingKeysWithKeyId.find((routingKey$1) => publicKey.equals(routingKey$1));
+					if (!routingKey) throw new __credo_ts_core.CredoError(`Expected to find key with fingerprint '${publicKey.fingerprint}' in routing keys of mediator routing record '${mediatorRoutingRecord.id}'`);
+					if (routingKey) return routingKey;
+				}
+				const outOfBandRecord = await agentContext.dependencyManager.resolve(require_DidCommOutOfBandRepository.DidCommOutOfBandRepository).findSingleByQuery(agentContext, { $or: [{
+					role: require_DidCommOutOfBandRole.DidCommOutOfBandRole.Sender,
+					recipientKeyFingerprints: [publicKey.fingerprint]
+				}, {
+					role: require_DidCommOutOfBandRole.DidCommOutOfBandRole.Receiver,
+					recipientRoutingKeyFingerprint: publicKey.fingerprint
+				}] });
+				if (outOfBandRecord?.role === require_DidCommOutOfBandRole.DidCommOutOfBandRole.Sender) {
+					agentContext.config.logger.debug(`Found out of band record with id '${outOfBandRecord.id}' and role '${outOfBandRecord.role}' for recipient key '${publicKey.fingerprint}' for incoming didcomm message`);
+					for (const service of outOfBandRecord.outOfBandInvitation.getInlineServices()) {
+						const _recipientKey = require_helpers.getResolvedDidcommServiceWithSigningKeyId(service, outOfBandRecord.invitationInlineServiceKeys).recipientKeys.find((recipientKey) => recipientKey.equals(publicKey));
+						if (_recipientKey) return _recipientKey;
+					}
+				} else if (outOfBandRecord?.role === require_DidCommOutOfBandRole.DidCommOutOfBandRole.Receiver) {
+					agentContext.config.logger.debug(`Found out of band record with id '${outOfBandRecord.id}' and role '${outOfBandRecord.role}' for recipient key '${publicKey.fingerprint}' for incoming didcomm message`);
+					const recipieintRouting = outOfBandRecord.metadata.get(require_outOfBandRecordMetadataTypes.DidCommOutOfBandRecordMetadataKeys.RecipientRouting);
+					if (recipieintRouting?.recipientKeyFingerprint === publicKey.fingerprint) {
+						publicKey.keyId = recipieintRouting.recipientKeyId ?? publicKey.legacyKeyId;
+						return publicKey;
+					}
+				}
+				if (await kms.getPublicKey({ keyId: publicKey.legacyKeyId }).catch((error$1) => {
+					if (error$1 instanceof __credo_ts_core.Kms.KeyManagementKeyNotFoundError) return null;
+					throw error$1;
+				})) {
+					agentContext.config.logger.debug(`Found public key with legacy key id '${publicKey.legacyKeyId}' for recipient key '${publicKey.fingerprint}' for incoming didcomm message`);
+					publicKey.keyId = publicKey.legacyKeyId;
+					return publicKey;
+				}
+			}
+		}
+		return null;
+	}
+};
+DidCommEnvelopeService = require_decorate.__decorate([
+	(0, __credo_ts_core.injectable)(),
+	require_decorateParam.__decorateParam(0, (0, __credo_ts_core.inject)(__credo_ts_core.InjectionSymbols.Logger)),
+	require_decorateMetadata.__decorateMetadata("design:paramtypes", [Object, typeof (_ref = typeof require_DidCommDocumentService.DidCommDocumentService !== "undefined" && require_DidCommDocumentService.DidCommDocumentService) === "function" ? _ref : Object])
+], DidCommEnvelopeService);
+
+//#endregion
+Object.defineProperty(exports, 'DidCommEnvelopeService', {
+  enumerable: true,
+  get: function () {
+    return DidCommEnvelopeService;
+  }
+});

package/build/packages/didcomm/src/DidCommEnvelopeService.mjs

@@ -0,0 +1,231 @@
+import { __decorateMetadata } from "../../../_virtual/_@oxc-project_runtime@0.94.0/helpers/decorateMetadata.mjs";
+import { __decorate } from "../../../_virtual/_@oxc-project_runtime@0.94.0/helpers/decorate.mjs";
+import { DidCommModuleConfig } from "./DidCommModuleConfig.mjs";
+import { __decorateParam } from "../../../_virtual/_@oxc-project_runtime@0.94.0/helpers/decorateParam.mjs";
+import { DidCommDocumentService } from "./services/DidCommDocumentService.mjs";
+import { getResolvedDidcommServiceWithSigningKeyId } from "./modules/connections/services/helpers.mjs";
+import { DidCommOutOfBandRole } from "./modules/oob/domain/DidCommOutOfBandRole.mjs";
+import { DidCommOutOfBandRepository } from "./modules/oob/repository/DidCommOutOfBandRepository.mjs";
+import { DidCommOutOfBandRecordMetadataKeys } from "./modules/oob/repository/outOfBandRecordMetadataTypes.mjs";
+import { DidCommForwardMessage } from "./modules/routing/messages/DidCommForwardMessage.mjs";
+import { DidCommMediatorRoutingRepository } from "./modules/routing/repository/DidCommMediatorRoutingRepository.mjs";
+import { AgentContext, CredoError, InjectionSymbols, JsonEncoder, Kms, RecordNotFoundError, TypedArrayEncoder, inject, injectable } from "@credo-ts/core";
+
+//#region ../didcomm/src/DidCommEnvelopeService.ts
+var _ref;
+let DidCommEnvelopeService = class DidCommEnvelopeService$1 {
+	constructor(logger, didcommDocumentService) {
+		this.logger = logger;
+		this.didcommDocumentService = didcommDocumentService;
+	}
+	async encryptDidcommV1Message(agentContext, message, recipientKeys, senderKey) {
+		const kms = agentContext.dependencyManager.resolve(Kms.KeyManagementApi);
+		const contentEncryptionKey = kms.randomBytes({ length: 32 });
+		const recipients = [];
+		for (const recipientKey of recipientKeys) {
+			let encryptedSender = void 0;
+			if (senderKey) {
+				const { encrypted: encrypted$2 } = await kms.encrypt({
+					key: { keyAgreement: {
+						algorithm: "ECDH-HSALSA20",
+						externalPublicJwk: recipientKey.convertTo(Kms.X25519PublicJwk).toJson()
+					} },
+					encryption: { algorithm: "XSALSA20-POLY1305" },
+					data: TypedArrayEncoder.fromString(TypedArrayEncoder.toBase58(senderKey.publicKey.publicKey))
+				});
+				encryptedSender = TypedArrayEncoder.toBase64URL(encrypted$2);
+			}
+			const { encrypted: encrypted$1, iv: iv$1 } = await kms.encrypt({
+				key: { keyAgreement: {
+					algorithm: "ECDH-HSALSA20",
+					externalPublicJwk: recipientKey.convertTo(Kms.X25519PublicJwk).toJson(),
+					keyId: senderKey?.keyId
+				} },
+				data: contentEncryptionKey,
+				encryption: { algorithm: "XSALSA20-POLY1305" }
+			});
+			recipients.push({
+				encrypted_key: TypedArrayEncoder.toBase64URL(encrypted$1),
+				header: {
+					kid: TypedArrayEncoder.toBase58(recipientKey.publicKey.publicKey),
+					iv: iv$1 ? TypedArrayEncoder.toBase64URL(iv$1) : void 0,
+					sender: encryptedSender
+				}
+			});
+		}
+		const protectedString = JsonEncoder.toBase64URL({
+			enc: "xchacha20poly1305_ietf",
+			typ: "JWM/1.0",
+			alg: senderKey ? "Authcrypt" : "Anoncrypt",
+			recipients
+		});
+		const { encrypted, iv, tag } = await kms.encrypt({
+			encryption: {
+				algorithm: "C20P",
+				aad: TypedArrayEncoder.fromString(protectedString)
+			},
+			data: JsonEncoder.toBuffer(message),
+			key: { privateJwk: {
+				kty: "oct",
+				k: TypedArrayEncoder.toBase64URL(contentEncryptionKey)
+			} }
+		});
+		if (!iv || !tag) throw new CredoError("Expected 'iv' and 'tag' to be defined");
+		return {
+			ciphertext: TypedArrayEncoder.toBase64URL(encrypted),
+			iv: TypedArrayEncoder.toBase64URL(iv),
+			tag: TypedArrayEncoder.toBase64URL(tag),
+			protected: protectedString
+		};
+	}
+	async decryptDidcommV1Message(agentContext, encryptedMessage) {
+		const kms = agentContext.dependencyManager.resolve(Kms.KeyManagementApi);
+		const protectedJson = JsonEncoder.fromBase64(encryptedMessage.protected);
+		const alg = protectedJson.alg;
+		if (alg !== "Anoncrypt" && alg !== "Authcrypt") throw new CredoError(`Unsupported pack algorithm: ${alg}`);
+		if (protectedJson.enc !== "xchacha20poly1305_ietf") throw new CredoError(`Unsupported enc algorithm: ${protectedJson.enc}`);
+		let recipientKey = null;
+		let recipient = null;
+		for (const _recipient of protectedJson.recipients) {
+			recipientKey = await this.extractOurRecipientKeyWithKeyId(agentContext, _recipient);
+			if (recipientKey) recipient = _recipient;
+		}
+		if (!recipientKey || !recipient) throw new CredoError("No corresponding recipient key found");
+		if (alg === "Authcrypt" && (!recipient.header.sender || !recipient.header.iv)) throw new CredoError("Sender and iv header values are required for Authcrypt");
+		let senderPublicJwk = void 0;
+		if (recipient.header.sender) {
+			const { data } = await kms.decrypt({
+				key: { keyAgreement: {
+					algorithm: "ECDH-HSALSA20",
+					keyId: recipientKey.keyId
+				} },
+				decryption: { algorithm: "XSALSA20-POLY1305" },
+				encrypted: TypedArrayEncoder.fromBase64(recipient.header.sender)
+			});
+			senderPublicJwk = Kms.PublicJwk.fromPublicKey({
+				crv: "Ed25519",
+				kty: "OKP",
+				publicKey: TypedArrayEncoder.fromBase58(TypedArrayEncoder.toUtf8String(data))
+			});
+		}
+		const { data: contentEncryptionKey } = await kms.decrypt({
+			decryption: {
+				algorithm: "XSALSA20-POLY1305",
+				iv: recipient.header.iv ? TypedArrayEncoder.fromBase64(recipient.header.iv) : void 0
+			},
+			encrypted: TypedArrayEncoder.fromBase64(recipient.encrypted_key),
+			key: { keyAgreement: {
+				algorithm: "ECDH-HSALSA20",
+				keyId: recipientKey.keyId,
+				externalPublicJwk: senderPublicJwk?.convertTo(Kms.X25519PublicJwk).toJson()
+			} }
+		});
+		const { data: message } = await kms.decrypt({
+			decryption: {
+				algorithm: "C20P",
+				iv: TypedArrayEncoder.fromBase64(encryptedMessage.iv),
+				tag: TypedArrayEncoder.fromBase64(encryptedMessage.tag),
+				aad: TypedArrayEncoder.fromString(encryptedMessage.protected)
+			},
+			key: { privateJwk: {
+				kty: "oct",
+				k: TypedArrayEncoder.toBase64URL(contentEncryptionKey)
+			} },
+			encrypted: TypedArrayEncoder.fromBase64(encryptedMessage.ciphertext)
+		});
+		return {
+			plaintextMessage: JsonEncoder.fromBuffer(message),
+			senderKey: senderPublicJwk,
+			recipientKey
+		};
+	}
+	async packMessage(agentContext, payload, keys) {
+		const didcommConfig = agentContext.dependencyManager.resolve(DidCommModuleConfig);
+		const { routingKeys, senderKey } = keys;
+		let recipientKeys = keys.recipientKeys;
+		const message = payload.toJSON({ useDidSovPrefixWhereAllowed: didcommConfig.useDidSovPrefixWhereAllowed });
+		this.logger.debug(`Pack outbound message ${message["@type"]}`);
+		let encryptedMessage = await this.encryptDidcommV1Message(agentContext, message, recipientKeys, senderKey);
+		for (const routingKey of routingKeys) {
+			const forwardMessage = new DidCommForwardMessage({
+				to: TypedArrayEncoder.toBase58(recipientKeys[0].publicKey.publicKey),
+				message: encryptedMessage
+			});
+			recipientKeys = [routingKey];
+			this.logger.debug("Forward message created", forwardMessage);
+			const forwardJson = forwardMessage.toJSON({ useDidSovPrefixWhereAllowed: didcommConfig.useDidSovPrefixWhereAllowed });
+			encryptedMessage = await this.encryptDidcommV1Message(agentContext, forwardJson, [routingKey]);
+		}
+		this.logger.debug(`Packed outbound message ${message["@type"]}`, { routingKeys: routingKeys.map((routingKey) => routingKey.fingerprint) });
+		return encryptedMessage;
+	}
+	async unpackMessage(agentContext, encryptedMessage) {
+		return await this.decryptDidcommV1Message(agentContext, encryptedMessage);
+	}
+	async extractOurRecipientKeyWithKeyId(agentContext, recipient) {
+		const kms = agentContext.resolve(Kms.KeyManagementApi);
+		const publicKey = Kms.PublicJwk.fromPublicKey({
+			kty: "OKP",
+			crv: "Ed25519",
+			publicKey: TypedArrayEncoder.fromBase58(recipient.header.kid)
+		});
+		try {
+			const { didDocument, keys } = await this.didcommDocumentService.resolveCreatedDidDocumentWithKeysByRecipientKey(agentContext, publicKey);
+			const verificationMethod = didDocument.findVerificationMethodByPublicKey(publicKey);
+			const kmsKeyId = keys?.find(({ didDocumentRelativeKeyId }) => verificationMethod.id.endsWith(didDocumentRelativeKeyId))?.kmsKeyId;
+			agentContext.config.logger.debug(`Found did '${didDocument.id}' for recipient key '${publicKey.fingerprint}' for incoming didcomm message`);
+			publicKey.keyId = kmsKeyId ?? publicKey.legacyKeyId;
+			return publicKey;
+		} catch (error) {
+			const mediatorRoutingRepository = agentContext.dependencyManager.resolve(DidCommMediatorRoutingRepository);
+			if (error instanceof RecordNotFoundError) {
+				const mediatorRoutingRecord = await mediatorRoutingRepository.findSingleByQuery(agentContext, { routingKeyFingerprints: [publicKey.fingerprint] });
+				if (mediatorRoutingRecord) {
+					agentContext.config.logger.debug(`Found mediator routing record with id '${mediatorRoutingRecord.id}' for recipient key '${publicKey.fingerprint}' for incoming didcomm message`);
+					const routingKey = mediatorRoutingRecord.routingKeysWithKeyId.find((routingKey$1) => publicKey.equals(routingKey$1));
+					if (!routingKey) throw new CredoError(`Expected to find key with fingerprint '${publicKey.fingerprint}' in routing keys of mediator routing record '${mediatorRoutingRecord.id}'`);
+					if (routingKey) return routingKey;
+				}
+				const outOfBandRecord = await agentContext.dependencyManager.resolve(DidCommOutOfBandRepository).findSingleByQuery(agentContext, { $or: [{
+					role: DidCommOutOfBandRole.Sender,
+					recipientKeyFingerprints: [publicKey.fingerprint]
+				}, {
+					role: DidCommOutOfBandRole.Receiver,
+					recipientRoutingKeyFingerprint: publicKey.fingerprint
+				}] });
+				if (outOfBandRecord?.role === DidCommOutOfBandRole.Sender) {
+					agentContext.config.logger.debug(`Found out of band record with id '${outOfBandRecord.id}' and role '${outOfBandRecord.role}' for recipient key '${publicKey.fingerprint}' for incoming didcomm message`);
+					for (const service of outOfBandRecord.outOfBandInvitation.getInlineServices()) {
+						const _recipientKey = getResolvedDidcommServiceWithSigningKeyId(service, outOfBandRecord.invitationInlineServiceKeys).recipientKeys.find((recipientKey) => recipientKey.equals(publicKey));
+						if (_recipientKey) return _recipientKey;
+					}
+				} else if (outOfBandRecord?.role === DidCommOutOfBandRole.Receiver) {
+					agentContext.config.logger.debug(`Found out of band record with id '${outOfBandRecord.id}' and role '${outOfBandRecord.role}' for recipient key '${publicKey.fingerprint}' for incoming didcomm message`);
+					const recipieintRouting = outOfBandRecord.metadata.get(DidCommOutOfBandRecordMetadataKeys.RecipientRouting);
+					if (recipieintRouting?.recipientKeyFingerprint === publicKey.fingerprint) {
+						publicKey.keyId = recipieintRouting.recipientKeyId ?? publicKey.legacyKeyId;
+						return publicKey;
+					}
+				}
+				if (await kms.getPublicKey({ keyId: publicKey.legacyKeyId }).catch((error$1) => {
+					if (error$1 instanceof Kms.KeyManagementKeyNotFoundError) return null;
+					throw error$1;
+				})) {
+					agentContext.config.logger.debug(`Found public key with legacy key id '${publicKey.legacyKeyId}' for recipient key '${publicKey.fingerprint}' for incoming didcomm message`);
+					publicKey.keyId = publicKey.legacyKeyId;
+					return publicKey;
+				}
+			}
+		}
+		return null;
+	}
+};
+DidCommEnvelopeService = __decorate([
+	injectable(),
+	__decorateParam(0, inject(InjectionSymbols.Logger)),
+	__decorateMetadata("design:paramtypes", [Object, typeof (_ref = typeof DidCommDocumentService !== "undefined" && DidCommDocumentService) === "function" ? _ref : Object])
+], DidCommEnvelopeService);
+
+//#endregion
+export { DidCommEnvelopeService };
+//# sourceMappingURL=DidCommEnvelopeService.mjs.map

package/build/packages/didcomm/src/DidCommEnvelopeService.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DidCommEnvelopeService.mjs","names":["DidCommEnvelopeService","logger: Logger","recipients: Array<{\n      encrypted_key: string\n      header: {\n        kid: string\n\n        // In case of Authcrypt\n        sender?: string\n        iv?: string\n      }\n    }>","encryptedSender: string | undefined","encrypted","iv","recipientKey: Kms.PublicJwk<Kms.Ed25519PublicJwk> | null","recipient: {\n      header: {\n        kid: string\n        iv?: string\n        sender?: string\n      }\n      encrypted_key: string\n    } | null","senderPublicJwk: Kms.PublicJwk<Kms.Ed25519PublicJwk> | undefined","routingKey","error"],"sources":["../../../../../didcomm/src/DidCommEnvelopeService.ts"],"sourcesContent":["import {\n  AgentContext,\n  CredoError,\n  InjectionSymbols,\n  JsonEncoder,\n  Kms,\n  RecordNotFoundError,\n  TypedArrayEncoder,\n  inject,\n} from '@credo-ts/core'\nimport type { DidCommMessage } from './DidCommMessage'\nimport type { DidCommEncryptedMessage, DidCommPlaintextMessage } from './types'\n\nimport { type Logger, injectable } from '@credo-ts/core'\n\nimport { DidCommModuleConfig } from './DidCommModuleConfig'\nimport { getResolvedDidcommServiceWithSigningKeyId } from './modules/connections/services/helpers'\nimport { DidCommOutOfBandRole } from './modules/oob/domain/DidCommOutOfBandRole'\nimport { DidCommOutOfBandRepository } from './modules/oob/repository/DidCommOutOfBandRepository'\nimport { DidCommOutOfBandRecordMetadataKeys } from './modules/oob/repository/outOfBandRecordMetadataTypes'\nimport { DidCommForwardMessage } from './modules/routing/messages/DidCommForwardMessage'\nimport { DidCommMediatorRoutingRepository } from './modules/routing/repository/DidCommMediatorRoutingRepository'\nimport { DidCommDocumentService } from './services/DidCommDocumentService'\n\nexport interface EnvelopeKeys {\n  recipientKeys: Kms.PublicJwk<Kms.Ed25519PublicJwk>[]\n  routingKeys: Kms.PublicJwk<Kms.Ed25519PublicJwk>[]\n  senderKey: Kms.PublicJwk<Kms.Ed25519PublicJwk> | null\n}\n\n@injectable()\nexport class DidCommEnvelopeService {\n  private logger: Logger\n  private didcommDocumentService: DidCommDocumentService\n\n  public constructor(@inject(InjectionSymbols.Logger) logger: Logger, didcommDocumentService: DidCommDocumentService) {\n    this.logger = logger\n    this.didcommDocumentService = didcommDocumentService\n  }\n\n  private async encryptDidcommV1Message(\n    agentContext: AgentContext,\n    message: DidCommPlaintextMessage,\n    recipientKeys: Kms.PublicJwk<Kms.Ed25519PublicJwk>[],\n    senderKey?: Kms.PublicJwk<Kms.Ed25519PublicJwk> | null\n  ): Promise<DidCommEncryptedMessage> {\n    const kms = agentContext.dependencyManager.resolve(Kms.KeyManagementApi)\n    // Generally we would never generate the content encryption key outside of the KMS\n    // However how DIDcommV1 is specified to calcualte the aad we need the encrypted content\n    // encryption key, and thus we can't use the normal combined key agrement + encryption flow\n    const contentEncryptionKey = kms.randomBytes({ length: 32 })\n\n    const recipients: Array<{\n      encrypted_key: string\n      header: {\n        kid: string\n\n        // In case of Authcrypt\n        sender?: string\n        iv?: string\n      }\n    }> = []\n\n    for (const recipientKey of recipientKeys) {\n      let encryptedSender: string | undefined = undefined\n\n      if (senderKey) {\n        // Encrypt the sender\n        const { encrypted } = await kms.encrypt({\n          key: {\n            keyAgreement: {\n              algorithm: 'ECDH-HSALSA20',\n              // DIDComm v1 uses Ed25519 keys but encryption happens with X25519 keys\n              externalPublicJwk: recipientKey.convertTo(Kms.X25519PublicJwk).toJson(),\n            },\n          },\n          encryption: {\n            algorithm: 'XSALSA20-POLY1305',\n          },\n          data: TypedArrayEncoder.fromString(TypedArrayEncoder.toBase58(senderKey.publicKey.publicKey)),\n        })\n\n        encryptedSender = TypedArrayEncoder.toBase64URL(encrypted)\n      }\n\n      // Encrypt the key\n      const { encrypted, iv } = await kms.encrypt({\n        key: {\n          keyAgreement: {\n            algorithm: 'ECDH-HSALSA20',\n            externalPublicJwk: recipientKey.convertTo(Kms.X25519PublicJwk).toJson(),\n\n            // Sender key only needed for Authcrypt\n            keyId: senderKey?.keyId,\n          },\n        },\n        data: contentEncryptionKey,\n        encryption: {\n          algorithm: 'XSALSA20-POLY1305',\n        },\n      })\n\n      recipients.push({\n        encrypted_key: TypedArrayEncoder.toBase64URL(encrypted),\n        header: {\n          kid: TypedArrayEncoder.toBase58(recipientKey.publicKey.publicKey),\n          iv: iv ? TypedArrayEncoder.toBase64URL(iv) : undefined,\n          sender: encryptedSender,\n        },\n      })\n    }\n\n    const protectedString = JsonEncoder.toBase64URL({\n      enc: 'xchacha20poly1305_ietf',\n      typ: 'JWM/1.0',\n      alg: senderKey ? 'Authcrypt' : 'Anoncrypt',\n      recipients,\n    })\n\n    // Perofrm the actual encryption\n    const { encrypted, iv, tag } = await kms.encrypt({\n      encryption: {\n        algorithm: 'C20P',\n        aad: TypedArrayEncoder.fromString(protectedString),\n      },\n      data: JsonEncoder.toBuffer(message),\n      key: {\n        privateJwk: {\n          kty: 'oct',\n          k: TypedArrayEncoder.toBase64URL(contentEncryptionKey),\n        },\n      },\n    })\n\n    if (!iv || !tag) {\n      throw new CredoError(\"Expected 'iv' and 'tag' to be defined\")\n    }\n\n    return {\n      ciphertext: TypedArrayEncoder.toBase64URL(encrypted),\n      iv: TypedArrayEncoder.toBase64URL(iv),\n      tag: TypedArrayEncoder.toBase64URL(tag),\n      protected: protectedString,\n    } satisfies DidCommEncryptedMessage\n  }\n\n  private async decryptDidcommV1Message(agentContext: AgentContext, encryptedMessage: DidCommEncryptedMessage) {\n    const kms = agentContext.dependencyManager.resolve(Kms.KeyManagementApi)\n    const protectedJson = JsonEncoder.fromBase64(encryptedMessage.protected)\n\n    const alg = protectedJson.alg as 'Anoncrypt' | 'Authcrypt'\n    if (alg !== 'Anoncrypt' && alg !== 'Authcrypt') {\n      throw new CredoError(`Unsupported pack algorithm: ${alg}`)\n    }\n\n    if (protectedJson.enc !== 'xchacha20poly1305_ietf') {\n      throw new CredoError(`Unsupported enc algorithm: ${protectedJson.enc}`)\n    }\n\n    let recipientKey: Kms.PublicJwk<Kms.Ed25519PublicJwk> | null = null\n    let recipient: {\n      header: {\n        kid: string\n        iv?: string\n        sender?: string\n      }\n      encrypted_key: string\n    } | null = null\n\n    for (const _recipient of protectedJson.recipients) {\n      recipientKey = await this.extractOurRecipientKeyWithKeyId(agentContext, _recipient)\n\n      if (recipientKey) {\n        recipient = _recipient\n      }\n    }\n\n    if (!recipientKey || !recipient) {\n      throw new CredoError('No corresponding recipient key found')\n    }\n\n    if (alg === 'Authcrypt' && (!recipient.header.sender || !recipient.header.iv)) {\n      throw new CredoError('Sender and iv header values are required for Authcrypt')\n    }\n\n    let senderPublicJwk: Kms.PublicJwk<Kms.Ed25519PublicJwk> | undefined = undefined\n    if (recipient.header.sender) {\n      const { data } = await kms.decrypt({\n        key: {\n          keyAgreement: {\n            algorithm: 'ECDH-HSALSA20',\n            keyId: recipientKey.keyId,\n          },\n        },\n        decryption: {\n          algorithm: 'XSALSA20-POLY1305',\n        },\n        encrypted: TypedArrayEncoder.fromBase64(recipient.header.sender),\n      })\n\n      senderPublicJwk = Kms.PublicJwk.fromPublicKey({\n        crv: 'Ed25519',\n        kty: 'OKP',\n        publicKey: TypedArrayEncoder.fromBase58(TypedArrayEncoder.toUtf8String(data)),\n      })\n    }\n\n    // Perofrm the actual decryption\n    const { data: contentEncryptionKey } = await kms.decrypt({\n      decryption: {\n        algorithm: 'XSALSA20-POLY1305',\n        iv: recipient.header.iv ? TypedArrayEncoder.fromBase64(recipient.header.iv) : undefined,\n      },\n      encrypted: TypedArrayEncoder.fromBase64(recipient.encrypted_key),\n      key: {\n        keyAgreement: {\n          algorithm: 'ECDH-HSALSA20',\n          keyId: recipientKey.keyId,\n\n          // Optionally we have a sender\n          externalPublicJwk: senderPublicJwk?.convertTo(Kms.X25519PublicJwk).toJson(),\n        },\n      },\n    })\n\n    const { data: message } = await kms.decrypt({\n      decryption: {\n        algorithm: 'C20P',\n        iv: TypedArrayEncoder.fromBase64(encryptedMessage.iv),\n        tag: TypedArrayEncoder.fromBase64(encryptedMessage.tag),\n        aad: TypedArrayEncoder.fromString(encryptedMessage.protected),\n      },\n      key: {\n        privateJwk: {\n          kty: 'oct',\n          k: TypedArrayEncoder.toBase64URL(contentEncryptionKey),\n        },\n      },\n      encrypted: TypedArrayEncoder.fromBase64(encryptedMessage.ciphertext),\n    })\n\n    return {\n      plaintextMessage: JsonEncoder.fromBuffer(message),\n      senderKey: senderPublicJwk,\n      recipientKey,\n    }\n  }\n\n  public async packMessage(\n    agentContext: AgentContext,\n    payload: DidCommMessage,\n    keys: EnvelopeKeys\n  ): Promise<DidCommEncryptedMessage> {\n    const didcommConfig = agentContext.dependencyManager.resolve(DidCommModuleConfig)\n\n    const { routingKeys, senderKey } = keys\n    let recipientKeys = keys.recipientKeys\n\n    // pass whether we want to use legacy did sov prefix\n    const message = payload.toJSON({ useDidSovPrefixWhereAllowed: didcommConfig.useDidSovPrefixWhereAllowed })\n\n    this.logger.debug(`Pack outbound message ${message['@type']}`)\n\n    let encryptedMessage = await this.encryptDidcommV1Message(agentContext, message, recipientKeys, senderKey)\n\n    // If the message has routing keys (mediator) pack for each mediator\n    for (const routingKey of routingKeys) {\n      const forwardMessage = new DidCommForwardMessage({\n        // Forward to first recipient key\n        to: TypedArrayEncoder.toBase58(recipientKeys[0].publicKey.publicKey),\n        message: encryptedMessage,\n      })\n      recipientKeys = [routingKey]\n      this.logger.debug('Forward message created', forwardMessage)\n\n      const forwardJson = forwardMessage.toJSON({\n        useDidSovPrefixWhereAllowed: didcommConfig.useDidSovPrefixWhereAllowed,\n      })\n\n      // Forward messages are anon packed\n      encryptedMessage = await this.encryptDidcommV1Message(agentContext, forwardJson, [routingKey])\n    }\n\n    this.logger.debug(`Packed outbound message ${message['@type']}`, {\n      routingKeys: routingKeys.map((routingKey) => routingKey.fingerprint),\n    })\n\n    return encryptedMessage\n  }\n\n  public async unpackMessage(\n    agentContext: AgentContext,\n    encryptedMessage: DidCommEncryptedMessage\n  ): Promise<DecryptedDidCommMessageContext> {\n    const decryptedMessage = await this.decryptDidcommV1Message(agentContext, encryptedMessage)\n    return decryptedMessage\n  }\n\n  private async extractOurRecipientKeyWithKeyId(\n    agentContext: AgentContext,\n    recipient: {\n      header: {\n        kid: string\n      }\n    }\n  ): Promise<Kms.PublicJwk<Kms.Ed25519PublicJwk> | null> {\n    const kms = agentContext.resolve(Kms.KeyManagementApi)\n\n    const publicKey = Kms.PublicJwk.fromPublicKey({\n      kty: 'OKP',\n      crv: 'Ed25519',\n      publicKey: TypedArrayEncoder.fromBase58(recipient.header.kid),\n    })\n\n    // We need to find the associated did based on the recipient key\n    // so we can extract the kms key id from the did record.\n    try {\n      const { didDocument, keys } = await this.didcommDocumentService.resolveCreatedDidDocumentWithKeysByRecipientKey(\n        agentContext,\n        publicKey\n      )\n\n      const verificationMethod = didDocument.findVerificationMethodByPublicKey(publicKey)\n      const kmsKeyId = keys?.find(({ didDocumentRelativeKeyId }) =>\n        verificationMethod.id.endsWith(didDocumentRelativeKeyId)\n      )?.kmsKeyId\n\n      agentContext.config.logger.debug(\n        `Found did '${didDocument.id}' for recipient key '${publicKey.fingerprint}' for incoming didcomm message`\n      )\n\n      publicKey.keyId = kmsKeyId ?? publicKey.legacyKeyId\n      return publicKey\n    } catch (error) {\n      // If there is no did record yet, we first look at the mediator routing record\n      const mediatorRoutingRepository = agentContext.dependencyManager.resolve(DidCommMediatorRoutingRepository)\n      if (error instanceof RecordNotFoundError) {\n        const mediatorRoutingRecord = await mediatorRoutingRepository.findSingleByQuery(agentContext, {\n          routingKeyFingerprints: [publicKey.fingerprint],\n        })\n\n        if (mediatorRoutingRecord) {\n          agentContext.config.logger.debug(\n            `Found mediator routing record with id '${mediatorRoutingRecord.id}' for recipient key '${publicKey.fingerprint}' for incoming didcomm message`\n          )\n\n          const routingKey = mediatorRoutingRecord.routingKeysWithKeyId.find((routingKey) =>\n            publicKey.equals(routingKey)\n          )\n\n          // This should not happen as we only get here if the tag matches\n          if (!routingKey) {\n            throw new CredoError(\n              `Expected to find key with fingerprint '${publicKey.fingerprint}' in routing keys of mediator routing record '${mediatorRoutingRecord.id}'`\n            )\n          }\n\n          if (routingKey) {\n            return routingKey\n          }\n        }\n\n        //  If there is no mediator routing record, we look at the out of band record\n        const outOfBandRepository = agentContext.dependencyManager.resolve(DidCommOutOfBandRepository)\n        const outOfBandRecord = await outOfBandRepository.findSingleByQuery(agentContext, {\n          $or: [\n            // In case we are the creator of the out of band invitation we can query based on\n            // out of band invitation recipient key fingerprint\n            {\n              role: DidCommOutOfBandRole.Sender,\n              recipientKeyFingerprints: [publicKey.fingerprint],\n            },\n            // In case we are the receiver of the out of band invitation we need to query\n            // for the recipient routing fingerprint\n            {\n              role: DidCommOutOfBandRole.Receiver,\n              recipientRoutingKeyFingerprint: publicKey.fingerprint,\n            },\n          ],\n        })\n\n        if (outOfBandRecord?.role === DidCommOutOfBandRole.Sender) {\n          agentContext.config.logger.debug(\n            `Found out of band record with id '${outOfBandRecord.id}' and role '${outOfBandRecord.role}' for recipient key '${publicKey.fingerprint}' for incoming didcomm message`\n          )\n\n          for (const service of outOfBandRecord.outOfBandInvitation.getInlineServices()) {\n            const resolvedService = getResolvedDidcommServiceWithSigningKeyId(\n              service,\n              outOfBandRecord.invitationInlineServiceKeys\n            )\n            const _recipientKey = resolvedService.recipientKeys.find((recipientKey) => recipientKey.equals(publicKey))\n\n            if (_recipientKey) {\n              return _recipientKey\n            }\n          }\n        } else if (outOfBandRecord?.role === DidCommOutOfBandRole.Receiver) {\n          agentContext.config.logger.debug(\n            `Found out of band record with id '${outOfBandRecord.id}' and role '${outOfBandRecord.role}' for recipient key '${publicKey.fingerprint}' for incoming didcomm message`\n          )\n\n          // If there is still no key we need to look at the metadata\n          const recipieintRouting = outOfBandRecord.metadata.get(DidCommOutOfBandRecordMetadataKeys.RecipientRouting)\n          if (recipieintRouting?.recipientKeyFingerprint === publicKey.fingerprint) {\n            publicKey.keyId = recipieintRouting.recipientKeyId ?? publicKey.legacyKeyId\n            return publicKey\n          }\n        }\n\n        // If there is no did found, no out of band record found, and not mediator routing record\n        // this is either:\n        //  - a connectionless oob exchange initiated before we added key ids.\n        //  - a message for a mediator, where the mediator routing record is created before we added key ids\n        //\n        // We will check if the public key exists based on the base58 encoded public key. We can remove this flow once we create a migration\n        // that optimizes this flow.\n        const kmsJwkPublic = await kms\n          .getPublicKey({\n            keyId: publicKey.legacyKeyId,\n          })\n          .catch((error) => {\n            if (error instanceof Kms.KeyManagementKeyNotFoundError) return null\n            throw error\n          })\n        if (kmsJwkPublic) {\n          agentContext.config.logger.debug(\n            `Found public key with legacy key id '${publicKey.legacyKeyId}' for recipient key '${publicKey.fingerprint}' for incoming didcomm message`\n          )\n\n          publicKey.keyId = publicKey.legacyKeyId\n          return publicKey\n        }\n      }\n    }\n\n    // no match found\n    return null\n  }\n}\n\nexport interface DecryptedDidCommMessageContext {\n  plaintextMessage: DidCommPlaintextMessage\n  senderKey?: Kms.PublicJwk<Kms.Ed25519PublicJwk>\n  recipientKey: Kms.PublicJwk<Kms.Ed25519PublicJwk>\n}\n"],"mappings":";;;;;;;;;;;;;;;AA+BO,mCAAMA,yBAAuB;CAIlC,AAAO,YAAY,AAAiCC,QAAgB,wBAAgD;AAClH,OAAK,SAAS;AACd,OAAK,yBAAyB;;CAGhC,MAAc,wBACZ,cACA,SACA,eACA,WACkC;EAClC,MAAM,MAAM,aAAa,kBAAkB,QAAQ,IAAI,iBAAiB;EAIxE,MAAM,uBAAuB,IAAI,YAAY,EAAE,QAAQ,IAAI,CAAC;EAE5D,MAAMC,aASD,EAAE;AAEP,OAAK,MAAM,gBAAgB,eAAe;GACxC,IAAIC,kBAAsC;AAE1C,OAAI,WAAW;IAEb,MAAM,EAAE,2BAAc,MAAM,IAAI,QAAQ;KACtC,KAAK,EACH,cAAc;MACZ,WAAW;MAEX,mBAAmB,aAAa,UAAU,IAAI,gBAAgB,CAAC,QAAQ;MACxE,EACF;KACD,YAAY,EACV,WAAW,qBACZ;KACD,MAAM,kBAAkB,WAAW,kBAAkB,SAAS,UAAU,UAAU,UAAU,CAAC;KAC9F,CAAC;AAEF,sBAAkB,kBAAkB,YAAYC,YAAU;;GAI5D,MAAM,EAAE,wBAAW,aAAO,MAAM,IAAI,QAAQ;IAC1C,KAAK,EACH,cAAc;KACZ,WAAW;KACX,mBAAmB,aAAa,UAAU,IAAI,gBAAgB,CAAC,QAAQ;KAGvE,OAAO,WAAW;KACnB,EACF;IACD,MAAM;IACN,YAAY,EACV,WAAW,qBACZ;IACF,CAAC;AAEF,cAAW,KAAK;IACd,eAAe,kBAAkB,YAAYA,YAAU;IACvD,QAAQ;KACN,KAAK,kBAAkB,SAAS,aAAa,UAAU,UAAU;KACjE,IAAIC,OAAK,kBAAkB,YAAYA,KAAG,GAAG;KAC7C,QAAQ;KACT;IACF,CAAC;;EAGJ,MAAM,kBAAkB,YAAY,YAAY;GAC9C,KAAK;GACL,KAAK;GACL,KAAK,YAAY,cAAc;GAC/B;GACD,CAAC;EAGF,MAAM,EAAE,WAAW,IAAI,QAAQ,MAAM,IAAI,QAAQ;GAC/C,YAAY;IACV,WAAW;IACX,KAAK,kBAAkB,WAAW,gBAAgB;IACnD;GACD,MAAM,YAAY,SAAS,QAAQ;GACnC,KAAK,EACH,YAAY;IACV,KAAK;IACL,GAAG,kBAAkB,YAAY,qBAAqB;IACvD,EACF;GACF,CAAC;AAEF,MAAI,CAAC,MAAM,CAAC,IACV,OAAM,IAAI,WAAW,wCAAwC;AAG/D,SAAO;GACL,YAAY,kBAAkB,YAAY,UAAU;GACpD,IAAI,kBAAkB,YAAY,GAAG;GACrC,KAAK,kBAAkB,YAAY,IAAI;GACvC,WAAW;GACZ;;CAGH,MAAc,wBAAwB,cAA4B,kBAA2C;EAC3G,MAAM,MAAM,aAAa,kBAAkB,QAAQ,IAAI,iBAAiB;EACxE,MAAM,gBAAgB,YAAY,WAAW,iBAAiB,UAAU;EAExE,MAAM,MAAM,cAAc;AAC1B,MAAI,QAAQ,eAAe,QAAQ,YACjC,OAAM,IAAI,WAAW,+BAA+B,MAAM;AAG5D,MAAI,cAAc,QAAQ,yBACxB,OAAM,IAAI,WAAW,8BAA8B,cAAc,MAAM;EAGzE,IAAIC,eAA2D;EAC/D,IAAIC,YAOO;AAEX,OAAK,MAAM,cAAc,cAAc,YAAY;AACjD,kBAAe,MAAM,KAAK,gCAAgC,cAAc,WAAW;AAEnF,OAAI,aACF,aAAY;;AAIhB,MAAI,CAAC,gBAAgB,CAAC,UACpB,OAAM,IAAI,WAAW,uCAAuC;AAG9D,MAAI,QAAQ,gBAAgB,CAAC,UAAU,OAAO,UAAU,CAAC,UAAU,OAAO,IACxE,OAAM,IAAI,WAAW,yDAAyD;EAGhF,IAAIC,kBAAmE;AACvE,MAAI,UAAU,OAAO,QAAQ;GAC3B,MAAM,EAAE,SAAS,MAAM,IAAI,QAAQ;IACjC,KAAK,EACH,cAAc;KACZ,WAAW;KACX,OAAO,aAAa;KACrB,EACF;IACD,YAAY,EACV,WAAW,qBACZ;IACD,WAAW,kBAAkB,WAAW,UAAU,OAAO,OAAO;IACjE,CAAC;AAEF,qBAAkB,IAAI,UAAU,cAAc;IAC5C,KAAK;IACL,KAAK;IACL,WAAW,kBAAkB,WAAW,kBAAkB,aAAa,KAAK,CAAC;IAC9E,CAAC;;EAIJ,MAAM,EAAE,MAAM,yBAAyB,MAAM,IAAI,QAAQ;GACvD,YAAY;IACV,WAAW;IACX,IAAI,UAAU,OAAO,KAAK,kBAAkB,WAAW,UAAU,OAAO,GAAG,GAAG;IAC/E;GACD,WAAW,kBAAkB,WAAW,UAAU,cAAc;GAChE,KAAK,EACH,cAAc;IACZ,WAAW;IACX,OAAO,aAAa;IAGpB,mBAAmB,iBAAiB,UAAU,IAAI,gBAAgB,CAAC,QAAQ;IAC5E,EACF;GACF,CAAC;EAEF,MAAM,EAAE,MAAM,YAAY,MAAM,IAAI,QAAQ;GAC1C,YAAY;IACV,WAAW;IACX,IAAI,kBAAkB,WAAW,iBAAiB,GAAG;IACrD,KAAK,kBAAkB,WAAW,iBAAiB,IAAI;IACvD,KAAK,kBAAkB,WAAW,iBAAiB,UAAU;IAC9D;GACD,KAAK,EACH,YAAY;IACV,KAAK;IACL,GAAG,kBAAkB,YAAY,qBAAqB;IACvD,EACF;GACD,WAAW,kBAAkB,WAAW,iBAAiB,WAAW;GACrE,CAAC;AAEF,SAAO;GACL,kBAAkB,YAAY,WAAW,QAAQ;GACjD,WAAW;GACX;GACD;;CAGH,MAAa,YACX,cACA,SACA,MACkC;EAClC,MAAM,gBAAgB,aAAa,kBAAkB,QAAQ,oBAAoB;EAEjF,MAAM,EAAE,aAAa,cAAc;EACnC,IAAI,gBAAgB,KAAK;EAGzB,MAAM,UAAU,QAAQ,OAAO,EAAE,6BAA6B,cAAc,6BAA6B,CAAC;AAE1G,OAAK,OAAO,MAAM,yBAAyB,QAAQ,WAAW;EAE9D,IAAI,mBAAmB,MAAM,KAAK,wBAAwB,cAAc,SAAS,eAAe,UAAU;AAG1G,OAAK,MAAM,cAAc,aAAa;GACpC,MAAM,iBAAiB,IAAI,sBAAsB;IAE/C,IAAI,kBAAkB,SAAS,cAAc,GAAG,UAAU,UAAU;IACpE,SAAS;IACV,CAAC;AACF,mBAAgB,CAAC,WAAW;AAC5B,QAAK,OAAO,MAAM,2BAA2B,eAAe;GAE5D,MAAM,cAAc,eAAe,OAAO,EACxC,6BAA6B,cAAc,6BAC5C,CAAC;AAGF,sBAAmB,MAAM,KAAK,wBAAwB,cAAc,aAAa,CAAC,WAAW,CAAC;;AAGhG,OAAK,OAAO,MAAM,2BAA2B,QAAQ,YAAY,EAC/D,aAAa,YAAY,KAAK,eAAe,WAAW,YAAY,EACrE,CAAC;AAEF,SAAO;;CAGT,MAAa,cACX,cACA,kBACyC;AAEzC,SADyB,MAAM,KAAK,wBAAwB,cAAc,iBAAiB;;CAI7F,MAAc,gCACZ,cACA,WAKqD;EACrD,MAAM,MAAM,aAAa,QAAQ,IAAI,iBAAiB;EAEtD,MAAM,YAAY,IAAI,UAAU,cAAc;GAC5C,KAAK;GACL,KAAK;GACL,WAAW,kBAAkB,WAAW,UAAU,OAAO,IAAI;GAC9D,CAAC;AAIF,MAAI;GACF,MAAM,EAAE,aAAa,SAAS,MAAM,KAAK,uBAAuB,gDAC9D,cACA,UACD;GAED,MAAM,qBAAqB,YAAY,kCAAkC,UAAU;GACnF,MAAM,WAAW,MAAM,MAAM,EAAE,+BAC7B,mBAAmB,GAAG,SAAS,yBAAyB,CACzD,EAAE;AAEH,gBAAa,OAAO,OAAO,MACzB,cAAc,YAAY,GAAG,uBAAuB,UAAU,YAAY,gCAC3E;AAED,aAAU,QAAQ,YAAY,UAAU;AACxC,UAAO;WACA,OAAO;GAEd,MAAM,4BAA4B,aAAa,kBAAkB,QAAQ,iCAAiC;AAC1G,OAAI,iBAAiB,qBAAqB;IACxC,MAAM,wBAAwB,MAAM,0BAA0B,kBAAkB,cAAc,EAC5F,wBAAwB,CAAC,UAAU,YAAY,EAChD,CAAC;AAEF,QAAI,uBAAuB;AACzB,kBAAa,OAAO,OAAO,MACzB,0CAA0C,sBAAsB,GAAG,uBAAuB,UAAU,YAAY,gCACjH;KAED,MAAM,aAAa,sBAAsB,qBAAqB,MAAM,iBAClE,UAAU,OAAOC,aAAW,CAC7B;AAGD,SAAI,CAAC,WACH,OAAM,IAAI,WACR,0CAA0C,UAAU,YAAY,gDAAgD,sBAAsB,GAAG,GAC1I;AAGH,SAAI,WACF,QAAO;;IAMX,MAAM,kBAAkB,MADI,aAAa,kBAAkB,QAAQ,2BAA2B,CAC5C,kBAAkB,cAAc,EAChF,KAAK,CAGH;KACE,MAAM,qBAAqB;KAC3B,0BAA0B,CAAC,UAAU,YAAY;KAClD,EAGD;KACE,MAAM,qBAAqB;KAC3B,gCAAgC,UAAU;KAC3C,CACF,EACF,CAAC;AAEF,QAAI,iBAAiB,SAAS,qBAAqB,QAAQ;AACzD,kBAAa,OAAO,OAAO,MACzB,qCAAqC,gBAAgB,GAAG,cAAc,gBAAgB,KAAK,uBAAuB,UAAU,YAAY,gCACzI;AAED,UAAK,MAAM,WAAW,gBAAgB,oBAAoB,mBAAmB,EAAE;MAK7E,MAAM,gBAJkB,0CACtB,SACA,gBAAgB,4BACjB,CACqC,cAAc,MAAM,iBAAiB,aAAa,OAAO,UAAU,CAAC;AAE1G,UAAI,cACF,QAAO;;eAGF,iBAAiB,SAAS,qBAAqB,UAAU;AAClE,kBAAa,OAAO,OAAO,MACzB,qCAAqC,gBAAgB,GAAG,cAAc,gBAAgB,KAAK,uBAAuB,UAAU,YAAY,gCACzI;KAGD,MAAM,oBAAoB,gBAAgB,SAAS,IAAI,mCAAmC,iBAAiB;AAC3G,SAAI,mBAAmB,4BAA4B,UAAU,aAAa;AACxE,gBAAU,QAAQ,kBAAkB,kBAAkB,UAAU;AAChE,aAAO;;;AAmBX,QARqB,MAAM,IACxB,aAAa,EACZ,OAAO,UAAU,aAClB,CAAC,CACD,OAAO,YAAU;AAChB,SAAIC,mBAAiB,IAAI,8BAA+B,QAAO;AAC/D,WAAMA;MACN,EACc;AAChB,kBAAa,OAAO,OAAO,MACzB,wCAAwC,UAAU,YAAY,uBAAuB,UAAU,YAAY,gCAC5G;AAED,eAAU,QAAQ,UAAU;AAC5B,YAAO;;;;AAMb,SAAO;;;;CAvZV,YAAY;oBAKS,OAAO,iBAAiB,OAAO"}