@de-otio/trellis 0.4.0 → 0.6.0

package/dist/lib/crypto/encryption-service.d.ts

@@ -1,100 +0,0 @@
-/**
- * EncryptionService
- *
- * Provides shared cryptographic operations for Trellis:
- * - AES-256-GCM encryption/decryption with AAD support
- * - Key derivation (PBKDF2, with Argon2id support when available)
- * - Hash functions (SHA-256)
- * - Email hashing with pepper (HMAC-SHA-256)
- *
- * This service is used by:
- * - Border Safety Mode
- * - Encrypted DM
- * - Secure Voting (hash functions only)
- */
-import type { AAD, KDFParams } from "./types.js";
-/**
- * EncryptionService class for cryptographic operations
- */
-export declare class EncryptionService {
-    /**
-     * Encrypt data using AES-256-GCM
-     *
-     * @param data - Data to encrypt (will be JSON stringified if not a string)
-     * @param key - CryptoKey for AES-256-GCM (256-bit)
-     * @param aad - Optional Additional Authenticated Data to bind to encryption
-     * @returns Base64-encoded encrypted data with IV and tag
-     * @throws Error if encryption fails
-     */
-    static encrypt(data: string | object, key: CryptoKey, aad?: AAD): Promise<string>;
-    /**
-     * Decrypt data using AES-256-GCM
-     *
-     * @param encryptedData - Base64-encoded encrypted data with IV and tag
-     * @param key - CryptoKey for AES-256-GCM (256-bit)
-     * @param aad - Optional Additional Authenticated Data (must match encryption)
-     * @returns Decrypted data as string
-     * @throws Error if decryption fails (invalid key, tampered data, etc.)
-     */
-    static decrypt(encryptedData: string, key: CryptoKey, aad?: AAD): Promise<string>;
-    /**
-     * Derive encryption key from password using PBKDF2 or Argon2id
-     *
-     * Note: Argon2id requires a library (not available in WebCrypto API).
-     * This implementation supports PBKDF2. For Argon2id, use a library like
-     * 'argon2-browser' or 'argon2-wasm' and call this method with algorithm='pbkdf2'
-     * as fallback, or implement Argon2id separately.
-     *
-     * @param password - Password to derive key from
-     * @param salt - Salt (base64-encoded, minimum 128 bits / 16 bytes)
-     * @param kdfParams - Key derivation parameters
-     * @returns CryptoKey for AES-256-GCM
-     * @throws Error if key derivation fails or parameters are invalid
-     */
-    static deriveKey(password: string, salt: string, kdfParams: KDFParams): Promise<CryptoKey>;
-    /**
-     * Hash data using SHA-256
-     *
-     * @param data - Data to hash (string or object)
-     * @returns SHA-256 hash as hex string
-     */
-    static hash(data: string | object): Promise<string>;
-    /**
-     * Hash email address using HMAC-SHA-256 with pepper
-     *
-     * This provides privacy-preserving email hashing for zero-knowledge lookups.
-     * The email is normalized (lowercased and trimmed) before hashing.
-     *
-     * @param email - Email address to hash
-     * @param pepper - Secret pepper value (should be stored server-side, not in code)
-     * @returns HMAC-SHA-256 hash as hex string
-     * @throws Error if email is empty or invalid after normalization
-     */
-    static hashEmail(email: string, pepper: string): Promise<string>;
-    /**
-     * Generate a random salt (128 bits / 16 bytes)
-     *
-     * @returns Base64-encoded salt
-     */
-    static generateSalt(): string;
-    /**
-     * Extract IV from encrypted data for reuse detection
-     *
-     * This is a utility function for server-side IV reuse detection.
-     * The server should track IVs per key to prevent reuse.
-     *
-     * @param encryptedData - Base64-encoded encrypted data
-     * @returns IV as base64 string
-     * @throws Error if encrypted data format is invalid
-     */
-    static extractIV(encryptedData: string): string;
-    /**
-     * Convert ArrayBuffer to base64 string
-     */
-    private static arrayBufferToBase64;
-    /**
-     * Convert base64 string to ArrayBuffer
-     */
-    private static base64ToArrayBuffer;
-}
-//# sourceMappingURL=encryption-service.d.ts.map

package/dist/lib/crypto/encryption-service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"encryption-service.d.ts","sourceRoot":"","sources":["../../../src/lib/crypto/encryption-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAiB,SAAS,EAAE,MAAM,YAAY,CAAC;AAGhE;;GAEG;AACH,qBAAa,iBAAiB;IAC5B;;;;;;;;OAQG;WACU,OAAO,CAClB,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,GAAG,EAAE,SAAS,EACd,GAAG,CAAC,EAAE,GAAG,GACR,OAAO,CAAC,MAAM,CAAC;IAiDlB;;;;;;;;OAQG;WACU,OAAO,CAClB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,SAAS,EACd,GAAG,CAAC,EAAE,GAAG,GACR,OAAO,CAAC,MAAM,CAAC;IAwElB;;;;;;;;;;;;;OAaG;WACU,SAAS,CACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,SAAS,CAAC;IA0ErB;;;;;OAKG;WACU,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUzD;;;;;;;;;;OAUG;WACU,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkCtE;;;;OAIG;IACH,MAAM,CAAC,YAAY,IAAI,MAAM;IAK7B;;;;;;;;;OASG;IACH,MAAM,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM;IAY/C;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAOlC;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;CAQnC"}

package/dist/lib/crypto/encryption-service.js

@@ -1,293 +0,0 @@
-"use strict";
-/**
- * EncryptionService
- *
- * Provides shared cryptographic operations for Trellis:
- * - AES-256-GCM encryption/decryption with AAD support
- * - Key derivation (PBKDF2, with Argon2id support when available)
- * - Hash functions (SHA-256)
- * - Email hashing with pepper (HMAC-SHA-256)
- *
- * This service is used by:
- * - Border Safety Mode
- * - Encrypted DM
- * - Secure Voting (hash functions only)
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.EncryptionService = void 0;
-const versioning_js_1 = require("./versioning.js");
-/**
- * EncryptionService class for cryptographic operations
- */
-class EncryptionService {
-    /**
-     * Encrypt data using AES-256-GCM
-     *
-     * @param data - Data to encrypt (will be JSON stringified if not a string)
-     * @param key - CryptoKey for AES-256-GCM (256-bit)
-     * @param aad - Optional Additional Authenticated Data to bind to encryption
-     * @returns Base64-encoded encrypted data with IV and tag
-     * @throws Error if encryption fails
-     */
-    static async encrypt(data, key, aad) {
-        // Validate key
-        if (key.algorithm.name !== "AES-GCM" || key.extractable) {
-            throw new Error("Invalid key: must be AES-GCM key and non-extractable");
-        }
-        // Convert data to string if needed
-        const dataString = typeof data === "string" ? data : JSON.stringify(data);
-        const dataBytes = new TextEncoder().encode(dataString);
-        // Generate random IV (12 bytes for GCM)
-        const iv = crypto.getRandomValues(new Uint8Array(12));
-        // Prepare AAD if provided
-        let aadBytes;
-        if (aad) {
-            const aadString = JSON.stringify(aad);
-            aadBytes = new TextEncoder().encode(aadString).buffer;
-        }
-        // Encrypt with AAD
-        const encrypted = await crypto.subtle.encrypt({
-            name: "AES-GCM",
-            iv: iv,
-            additionalData: aadBytes,
-            tagLength: 128, // 128-bit authentication tag
-        }, key, dataBytes);
-        // Extract tag (last 16 bytes) and encrypted data
-        const encryptedArray = new Uint8Array(encrypted);
-        const tag = encryptedArray.slice(-16); // Last 16 bytes are the tag
-        const ciphertext = encryptedArray.slice(0, -16); // Rest is ciphertext
-        // Create result object with version
-        const result = {
-            iv: this.arrayBufferToBase64(iv),
-            data: this.arrayBufferToBase64(ciphertext),
-            tag: this.arrayBufferToBase64(tag),
-            version: versioning_js_1.ParameterVersionManager.getCurrentVersion(),
-        };
-        // Return base64-encoded JSON
-        return btoa(JSON.stringify(result));
-    }
-    /**
-     * Decrypt data using AES-256-GCM
-     *
-     * @param encryptedData - Base64-encoded encrypted data with IV and tag
-     * @param key - CryptoKey for AES-256-GCM (256-bit)
-     * @param aad - Optional Additional Authenticated Data (must match encryption)
-     * @returns Decrypted data as string
-     * @throws Error if decryption fails (invalid key, tampered data, etc.)
-     */
-    static async decrypt(encryptedData, key, aad) {
-        // Validate key
-        if (key.algorithm.name !== "AES-GCM" || key.extractable) {
-            throw new Error("Invalid key: must be AES-GCM key and non-extractable");
-        }
-        // Parse encrypted data
-        let parsed;
-        try {
-            parsed = JSON.parse(atob(encryptedData));
-        }
-        catch (error) {
-            throw new Error("Invalid encrypted data format");
-        }
-        // Validate structure (data can be empty string, but fields must exist)
-        if (parsed.iv === undefined ||
-            parsed.data === undefined ||
-            parsed.tag === undefined) {
-            throw new Error("Invalid encrypted data: missing IV, data, or tag");
-        }
-        // Validate version if present
-        if (parsed.version) {
-            try {
-                versioning_js_1.ParameterVersionManager.validateAndNormalize(parsed.version);
-            }
-            catch (error) {
-                throw new Error(`Invalid or unsupported encryption version: ${parsed.version}. ${error instanceof Error ? error.message : String(error)}`);
-            }
-        }
-        // Decode IV, ciphertext, and tag
-        const iv = this.base64ToArrayBuffer(parsed.iv);
-        const ciphertext = this.base64ToArrayBuffer(parsed.data);
-        const tag = this.base64ToArrayBuffer(parsed.tag);
-        // Combine ciphertext and tag (GCM expects them together)
-        const encrypted = new Uint8Array(ciphertext.byteLength + tag.byteLength);
-        encrypted.set(new Uint8Array(ciphertext), 0);
-        encrypted.set(new Uint8Array(tag), ciphertext.byteLength);
-        // Prepare AAD if provided
-        let aadBytes;
-        if (aad) {
-            const aadString = JSON.stringify(aad);
-            aadBytes = new TextEncoder().encode(aadString).buffer;
-        }
-        // Decrypt with AAD verification
-        try {
-            const decrypted = await crypto.subtle.decrypt({
-                name: "AES-GCM",
-                iv: iv,
-                additionalData: aadBytes,
-                tagLength: 128,
-            }, key, encrypted.buffer);
-            return new TextDecoder().decode(decrypted);
-        }
-        catch (error) {
-            throw new Error("Decryption failed: invalid key, tampered data, or AAD mismatch");
-        }
-    }
-    /**
-     * Derive encryption key from password using PBKDF2 or Argon2id
-     *
-     * Note: Argon2id requires a library (not available in WebCrypto API).
-     * This implementation supports PBKDF2. For Argon2id, use a library like
-     * 'argon2-browser' or 'argon2-wasm' and call this method with algorithm='pbkdf2'
-     * as fallback, or implement Argon2id separately.
-     *
-     * @param password - Password to derive key from
-     * @param salt - Salt (base64-encoded, minimum 128 bits / 16 bytes)
-     * @param kdfParams - Key derivation parameters
-     * @returns CryptoKey for AES-256-GCM
-     * @throws Error if key derivation fails or parameters are invalid
-     */
-    static async deriveKey(password, salt, kdfParams) {
-        // Validate inputs
-        if (!password || typeof password !== "string") {
-            throw new Error("Password must be a non-empty string");
-        }
-        if (!salt || typeof salt !== "string") {
-            throw new Error("Salt must be a non-empty string");
-        }
-        // Decode salt
-        let saltBuffer;
-        try {
-            saltBuffer = this.base64ToArrayBuffer(salt);
-        }
-        catch (error) {
-            throw new Error("Invalid salt format: must be base64-encoded");
-        }
-        const saltBytes = new Uint8Array(saltBuffer);
-        // Validate salt size (minimum 128 bits / 16 bytes)
-        if (saltBytes.length < 16) {
-            throw new Error("Salt must be at least 128 bits (16 bytes)");
-        }
-        // Handle Argon2id (not supported by WebCrypto API)
-        if (kdfParams.algorithm === "argon2id") {
-            throw new Error("Argon2id not supported in WebCrypto API. Use a library like argon2-browser or fallback to PBKDF2.");
-        }
-        // PBKDF2 implementation
-        if (kdfParams.algorithm !== "pbkdf2") {
-            throw new Error(`Unsupported KDF algorithm: ${kdfParams.algorithm}`);
-        }
-        // Validate and normalize version
-        const version = versioning_js_1.ParameterVersionManager.validateAndNormalize(kdfParams.version);
-        // Validate PBKDF2 parameters
-        const iterations = kdfParams.iterations ?? 600000;
-        if (iterations < 600000) {
-            throw new Error("PBKDF2 iterations must be at least 600,000 for security");
-        }
-        // Import password as key material
-        const keyMaterial = await crypto.subtle.importKey("raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveBits", "deriveKey"]);
-        // Derive 256-bit key for AES-256
-        return crypto.subtle.deriveKey({
-            name: "PBKDF2",
-            salt: saltBuffer,
-            iterations: iterations,
-            hash: "SHA-256",
-        }, keyMaterial, { name: "AES-GCM", length: 256 }, false, // Not extractable
-        ["encrypt", "decrypt"]);
-    }
-    /**
-     * Hash data using SHA-256
-     *
-     * @param data - Data to hash (string or object)
-     * @returns SHA-256 hash as hex string
-     */
-    static async hash(data) {
-        const dataString = typeof data === "string" ? data : JSON.stringify(data);
-        const dataBytes = new TextEncoder().encode(dataString);
-        const hashBuffer = await crypto.subtle.digest("SHA-256", dataBytes);
-        // Convert to hex string
-        const hashArray = Array.from(new Uint8Array(hashBuffer));
-        return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
-    }
-    /**
-     * Hash email address using HMAC-SHA-256 with pepper
-     *
-     * This provides privacy-preserving email hashing for zero-knowledge lookups.
-     * The email is normalized (lowercased and trimmed) before hashing.
-     *
-     * @param email - Email address to hash
-     * @param pepper - Secret pepper value (should be stored server-side, not in code)
-     * @returns HMAC-SHA-256 hash as hex string
-     * @throws Error if email is empty or invalid after normalization
-     */
-    static async hashEmail(email, pepper) {
-        if (!email || typeof email !== "string") {
-            throw new Error("Email must be a non-empty string");
-        }
-        if (!pepper || typeof pepper !== "string") {
-            throw new Error("Pepper must be a non-empty string");
-        }
-        // Normalize email: lowercase and trim
-        const normalizedEmail = email.toLowerCase().trim();
-        if (normalizedEmail.length === 0) {
-            throw new Error("Email cannot be empty after normalization");
-        }
-        // Import pepper as HMAC key
-        const pepperKey = await crypto.subtle.importKey("raw", new TextEncoder().encode(pepper), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-        // Compute HMAC
-        const emailBytes = new TextEncoder().encode(normalizedEmail);
-        const signature = await crypto.subtle.sign("HMAC", pepperKey, emailBytes);
-        // Convert to hex string
-        const hashArray = Array.from(new Uint8Array(signature));
-        return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
-    }
-    /**
-     * Generate a random salt (128 bits / 16 bytes)
-     *
-     * @returns Base64-encoded salt
-     */
-    static generateSalt() {
-        const salt = crypto.getRandomValues(new Uint8Array(16));
-        return this.arrayBufferToBase64(salt);
-    }
-    /**
-     * Extract IV from encrypted data for reuse detection
-     *
-     * This is a utility function for server-side IV reuse detection.
-     * The server should track IVs per key to prevent reuse.
-     *
-     * @param encryptedData - Base64-encoded encrypted data
-     * @returns IV as base64 string
-     * @throws Error if encrypted data format is invalid
-     */
-    static extractIV(encryptedData) {
-        try {
-            const parsed = JSON.parse(atob(encryptedData));
-            if (!parsed.iv) {
-                throw new Error("Invalid encrypted data: missing IV");
-            }
-            return parsed.iv;
-        }
-        catch (error) {
-            throw new Error("Invalid encrypted data format");
-        }
-    }
-    /**
-     * Convert ArrayBuffer to base64 string
-     */
-    static arrayBufferToBase64(buffer) {
-        const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
-        const binary = String.fromCharCode(...bytes);
-        return btoa(binary);
-    }
-    /**
-     * Convert base64 string to ArrayBuffer
-     */
-    static base64ToArrayBuffer(base64) {
-        const binary = atob(base64);
-        const bytes = new Uint8Array(binary.length);
-        for (let i = 0; i < binary.length; i++) {
-            bytes[i] = binary.charCodeAt(i);
-        }
-        return bytes.buffer;
-    }
-}
-exports.EncryptionService = EncryptionService;
-//# sourceMappingURL=encryption-service.js.map

package/dist/lib/crypto/encryption-service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"encryption-service.js","sourceRoot":"","sources":["../../../src/lib/crypto/encryption-service.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAGH,mDAA0D;AAE1D;;GAEG;AACH,MAAa,iBAAiB;IAC5B;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAClB,IAAqB,EACrB,GAAc,EACd,GAAS;QAET,eAAe;QACf,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QAED,mCAAmC;QACnC,MAAM,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAEvD,wCAAwC;QACxC,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAEtD,0BAA0B;QAC1B,IAAI,QAAiC,CAAC;QACtC,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACtC,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QACxD,CAAC;QAED,mBAAmB;QACnB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C;YACE,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,EAAE;YACN,cAAc,EAAE,QAAQ;YACxB,SAAS,EAAE,GAAG,EAAE,6BAA6B;SAC9C,EACD,GAAG,EACH,SAAS,CACV,CAAC;QAEF,iDAAiD;QACjD,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B;QACnE,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB;QAEtE,oCAAoC;QACpC,MAAM,MAAM,GAAkB;YAC5B,EAAE,EAAE,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAChC,IAAI,EAAE,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC;YAC1C,GAAG,EAAE,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;YAClC,OAAO,EAAE,uCAAuB,CAAC,iBAAiB,EAAE;SACrD,CAAC;QAEF,6BAA6B;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAClB,aAAqB,EACrB,GAAc,EACd,GAAS;QAET,eAAe;QACf,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QAED,uBAAuB;QACvB,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,uEAAuE;QACvE,IACE,MAAM,CAAC,EAAE,KAAK,SAAS;YACvB,MAAM,CAAC,IAAI,KAAK,SAAS;YACzB,MAAM,CAAC,GAAG,KAAK,SAAS,EACxB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,8BAA8B;QAC9B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,uCAAuB,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,8CAA8C,MAAM,CAAC,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1H,CAAC;YACJ,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,MAAM,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAEjD,yDAAyD;QACzD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACzE,SAAS,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7C,SAAS,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAE1D,0BAA0B;QAC1B,IAAI,QAAiC,CAAC;QACtC,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACtC,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QACxD,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C;gBACE,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,EAAE;gBACN,cAAc,EAAE,QAAQ;gBACxB,SAAS,EAAE,GAAG;aACf,EACD,GAAG,EACH,SAAS,CAAC,MAAM,CACjB,CAAC;YAEF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS,CACpB,QAAgB,EAChB,IAAY,EACZ,SAAoB;QAEpB,kBAAkB;QAClB,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,cAAc;QACd,IAAI,UAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;QAE7C,mDAAmD;QACnD,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,mDAAmD;QACnD,IAAI,SAAS,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;QACJ,CAAC;QAED,wBAAwB;QACxB,IAAI,SAAS,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,8BAA8B,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,iCAAiC;QACjC,MAAM,OAAO,GAAG,uCAAuB,CAAC,oBAAoB,CAC1D,SAAS,CAAC,OAAO,CAClB,CAAC;QAEF,6BAA6B;QAC7B,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,IAAI,MAAM,CAAC;QAClD,IAAI,UAAU,GAAG,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QAED,kCAAkC;QAClC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC/C,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAClC,QAAQ,EACR,KAAK,EACL,CAAC,YAAY,EAAE,WAAW,CAAC,CAC5B,CAAC;QAEF,iCAAiC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;YACE,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,UAAU;YACtB,IAAI,EAAE,SAAS;SAChB,EACD,WAAW,EACX,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EAAE,kBAAkB;QACzB,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAqB;QACrC,MAAM,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAEpE,wBAAwB;QACxB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,MAAc;QAClD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QAED,sCAAsC;QACtC,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAEnD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,4BAA4B;QAC5B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,eAAe;QACf,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAE1E,wBAAwB;QACxB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QACxD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,YAAY;QACjB,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,SAAS,CAAC,aAAqB;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAkB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,MAAM,CAAC,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,mBAAmB,CAAC,MAAgC;QACjE,MAAM,KAAK,GACT,MAAM,YAAY,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,mBAAmB,CAAC,MAAc;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;CACF;AAlWD,8CAkWC"}

package/dist/lib/crypto/index.d.ts

@@ -1,22 +0,0 @@
-/**
- * @de-otio/trellis (inlined crypto)
- *
- * Shared cryptographic library for Trellis
- *
- * Provides:
- * - AES-256-GCM encryption/decryption with AAD support
- * - Key derivation (PBKDF2, with Argon2id support when available)
- * - Hash functions (SHA-256)
- * - Email hashing with pepper (HMAC-SHA-256)
- *
- * Used by:
- * - Border Safety Mode
- * - Encrypted DM
- * - Secure Voting (hash functions only)
- */
-export { EncryptionService } from "./encryption-service.js";
-export type { AAD, EncryptedData, KDFParams } from "./types.js";
-export { ParameterVersionManager } from "./versioning.js";
-export type { ParameterVersion } from "./versioning.js";
-export { CURRENT_VERSION, MINIMUM_VERSION, SUPPORTED_VERSIONS, } from "./versioning.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/lib/crypto/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/crypto/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,YAAY,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,eAAe,EACf,eAAe,EACf,kBAAkB,GACnB,MAAM,iBAAiB,CAAC"}

package/dist/lib/crypto/index.js

@@ -1,28 +0,0 @@
-"use strict";
-/**
- * @de-otio/trellis (inlined crypto)
- *
- * Shared cryptographic library for Trellis
- *
- * Provides:
- * - AES-256-GCM encryption/decryption with AAD support
- * - Key derivation (PBKDF2, with Argon2id support when available)
- * - Hash functions (SHA-256)
- * - Email hashing with pepper (HMAC-SHA-256)
- *
- * Used by:
- * - Border Safety Mode
- * - Encrypted DM
- * - Secure Voting (hash functions only)
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SUPPORTED_VERSIONS = exports.MINIMUM_VERSION = exports.CURRENT_VERSION = exports.ParameterVersionManager = exports.EncryptionService = void 0;
-var encryption_service_js_1 = require("./encryption-service.js");
-Object.defineProperty(exports, "EncryptionService", { enumerable: true, get: function () { return encryption_service_js_1.EncryptionService; } });
-var versioning_js_1 = require("./versioning.js");
-Object.defineProperty(exports, "ParameterVersionManager", { enumerable: true, get: function () { return versioning_js_1.ParameterVersionManager; } });
-var versioning_js_2 = require("./versioning.js");
-Object.defineProperty(exports, "CURRENT_VERSION", { enumerable: true, get: function () { return versioning_js_2.CURRENT_VERSION; } });
-Object.defineProperty(exports, "MINIMUM_VERSION", { enumerable: true, get: function () { return versioning_js_2.MINIMUM_VERSION; } });
-Object.defineProperty(exports, "SUPPORTED_VERSIONS", { enumerable: true, get: function () { return versioning_js_2.SUPPORTED_VERSIONS; } });
-//# sourceMappingURL=index.js.map

package/dist/lib/crypto/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/crypto/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAEH,iEAA4D;AAAnD,0HAAA,iBAAiB,OAAA;AAE1B,iDAA0D;AAAjD,wHAAA,uBAAuB,OAAA;AAEhC,iDAIyB;AAHvB,gHAAA,eAAe,OAAA;AACf,gHAAA,eAAe,OAAA;AACf,mHAAA,kBAAkB,OAAA"}

package/dist/lib/crypto/types.d.ts

@@ -1,71 +0,0 @@
-/**
- * Key Derivation Function Parameters
- */
-export interface KDFParams {
-    /**
-     * Algorithm to use: 'argon2id' (preferred) or 'pbkdf2' (fallback)
-     */
-    algorithm: "argon2id" | "pbkdf2";
-    /**
-     * Salt (128-bit minimum, 16 bytes)
-     * Stored as base64 string
-     */
-    salt: string;
-    /**
-     * For PBKDF2: number of iterations (≥600,000 recommended)
-     * For Argon2id: time cost parameter (≥3 recommended)
-     */
-    iterations?: number;
-    time?: number;
-    /**
-     * For Argon2id: memory cost in MB (≥64-128 MB recommended)
-     */
-    memory?: number;
-    /**
-     * For Argon2id: parallelism parameter
-     */
-    parallelism?: number;
-    /**
-     * Parameter version for future compatibility
-     */
-    version?: string;
-}
-/**
- * Encryption result containing IV, encrypted data, and authentication tag
- */
-export interface EncryptedData {
-    /**
-     * Initialization Vector (12 bytes, 96 bits)
-     * Base64 encoded
-     */
-    iv: string;
-    /**
-     * Encrypted data
-     * Base64 encoded
-     */
-    data: string;
-    /**
-     * Authentication tag (16 bytes, 128 bits)
-     * Base64 encoded
-     */
-    tag: string;
-    /**
-     * Parameter version (semantic versioning: MAJOR.MINOR.PATCH)
-     * Used for backward compatibility and parameter upgrades
-     * Example: "1.0.0"
-     */
-    version?: string;
-}
-/**
- * Additional Authenticated Data (AAD) schema
- * Used to bind metadata to encryption
- */
-export interface AAD {
-    userId?: string;
-    contextId?: string;
-    dataType?: string;
-    timestamp?: number;
-    sequence?: number;
-    [key: string]: string | number | undefined;
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/lib/crypto/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/crypto/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,SAAS,EAAE,UAAU,GAAG,QAAQ,CAAC;IAEjC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,EAAE,EAAE,MAAM,CAAC;IAEX;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,GAAG;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAC5C"}

package/dist/lib/crypto/types.js

@@ -1,3 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=types.js.map

package/dist/lib/crypto/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/lib/crypto/types.ts"],"names":[],"mappings":""}

package/dist/lib/crypto/versioning.d.ts

@@ -1,112 +0,0 @@
-/**
- * Parameter Versioning
- *
- * Manages versioning of cryptographic parameters to enable safe upgrades
- * and maintain backward compatibility.
- *
- * Version Format: Semantic versioning (MAJOR.MINOR.PATCH)
- * - Major: Breaking changes (algorithm change)
- * - Minor: Parameter changes (iteration count increase)
- * - Patch: Bug fixes
- *
- * @see doc/02-technical/architecture/cryptography/08-implementation-recommendations.md
- */
-/**
- * Parameter version information
- */
-export interface ParameterVersion {
-    /**
-     * Version string in semantic versioning format (MAJOR.MINOR.PATCH)
-     * Example: "1.0.0", "1.1.0", "2.0.0"
-     */
-    version: string;
-    /**
-     * Whether this version is deprecated
-     */
-    deprecated?: boolean;
-    /**
-     * Deprecation date (ISO 8601)
-     */
-    deprecatedAt?: string;
-    /**
-     * Removal date (ISO 8601) - when support will be removed
-     */
-    removedAt?: string;
-}
-/**
- * Supported parameter versions
- */
-export declare const SUPPORTED_VERSIONS: Record<string, ParameterVersion>;
-/**
- * Current default version
- */
-export declare const CURRENT_VERSION = "1.0.0";
-/**
- * Minimum supported version (for backward compatibility)
- */
-export declare const MINIMUM_VERSION = "1.0.0";
-/**
- * Parameter version manager
- */
-export declare class ParameterVersionManager {
-    /**
-     * Validate version format
-     *
-     * @param version - Version string to validate
-     * @returns true if valid semantic version format
-     */
-    static isValidVersion(version: string): boolean;
-    /**
-     * Compare two versions
-     *
-     * @param version1 - First version
-     * @param version2 - Second version
-     * @returns -1 if version1 < version2, 0 if equal, 1 if version1 > version2
-     */
-    static compareVersions(version1: string, version2: string): number;
-    /**
-     * Check if version is supported
-     *
-     * @param version - Version to check
-     * @returns true if version is supported
-     */
-    static isSupported(version: string): boolean;
-    /**
-     * Check if version is deprecated
-     *
-     * @param version - Version to check
-     * @returns true if version is deprecated
-     */
-    static isDeprecated(version: string): boolean;
-    /**
-     * Get version information
-     *
-     * @param version - Version string
-     * @returns Version information or null if not found
-     */
-    static getVersionInfo(version: string): ParameterVersion | null;
-    /**
-     * Get current default version
-     *
-     * @returns Current version string
-     */
-    static getCurrentVersion(): string;
-    /**
-     * Get minimum supported version
-     *
-     * @returns Minimum version string
-     */
-    static getMinimumVersion(): string;
-    /**
-     * Validate and normalize version
-     *
-     * If version is not provided, returns current version.
-     * If version is invalid, throws error.
-     *
-     * @param version - Optional version string
-     * @returns Validated version string
-     * @throws Error if version is invalid
-     */
-    static validateAndNormalize(version?: string): string;
-}
-//# sourceMappingURL=versioning.d.ts.map

package/dist/lib/crypto/versioning.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"versioning.d.ts","sourceRoot":"","sources":["../../../src/lib/crypto/versioning.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAK/D,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;GAEG;AACH,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;GAEG;AACH,qBAAa,uBAAuB;IAClC;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAM/C;;;;;;OAMG;IACH,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAgBlE;;;;;OAKG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAiB5C;;;;;OAKG;IACH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAK7C;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI;IAI/D;;;;OAIG;IACH,MAAM,CAAC,iBAAiB,IAAI,MAAM;IAIlC;;;;OAIG;IACH,MAAM,CAAC,iBAAiB,IAAI,MAAM;IAIlC;;;;;;;;;OASG;IACH,MAAM,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM;CAmBtD"}