@ethora/chat-component-rn 26.10.6 → 26.10.7

package/CHANGELOG.md

@@ -7,7 +7,9 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this pr
 
 ### Added
 
-- **Attachment previews in iOS pushes.** New Expo config plugin (`"plugins": ["@ethora/chat-component-rn"]` in the host app.json) that adds a Notification Service Extension target, `EthoraNotificationService`, on `expo prebuild`. It downloads the thumbnail the push service sends as `previewUrl` for photo and video messages and shows it in the notification, the way Android already does. Text pushes and failed downloads show the notification unchanged; sealed pushes are not handled yet. Setup in the README, Install, step 4.
+- **Encrypted pushes.** A device key per install (`ensurePushKeyPair`, X25519 in expo-secure-store) sent with the token as `pushKey` (`registerPushToken(token, { pushKey })`, `getPushTokens` entries, `PushSubscriptionPayload`); the push service then seals every chat push for it (libsodium sealed box) and Google and Apple relay ciphertext only. iOS: the notification service extension from the config plugin opens the box (plain Swift, CryptoKit X25519 and tweetnacl ports, no pod) and shows the real title and text; the plugin now shares a keychain access group between the app and the extension. Android: `registerSealedPushTask({ channelId })` defines the expo-task-manager task that opens the box and posts one notification per chat, also with the app killed. A box that does not open leaves the "New message" placeholder. A backend without `pushKey` refuses the registration instead of delivering in the clear. New optional peers `expo-notifications` and `expo-task-manager` (Android only). Setup and checks in docs/push-encryption.md.
+
+- **Attachment previews in iOS pushes.** New Expo config plugin (`"plugins": ["@ethora/chat-component-rn"]` in the host app.json) that adds a Notification Service Extension target, `EthoraNotificationService`, on `expo prebuild`. It downloads the thumbnail the push service sends as `previewUrl` for photo and video messages and shows it in the notification, the way Android already does. Text pushes and failed downloads show the notification unchanged. Setup in the README, Install, step 4.
 
 - **Sending several files in one message.** The composer picks several files at once (documents and the library; the camera adds one shot), and every pick adds to the tray instead of replacing it. A message carries up to `config.attachments.maxFiles` files (default and hard ceiling 10), and `config.attachments.maxSizeMB` can lower the per-file size below the 50 MB upload limit; both refuse with a localized message. The files upload in parallel (fewer at a time in an e2ee room, where each is sealed first) and go out as ONE message in selection order. Text typed with the files is their caption: a plain room carries it on `<data>`, an e2ee room inside the sealed body. Each file shows its own upload progress on the bubble, and a file that did not upload gets its own Retry; a failed send keeps every file, so Retry re-uploads only what failed, also after a restart. A single file sends exactly the stanza it always did.
 

package/README.md

@@ -96,9 +96,9 @@ cd ios && pod install
 
 After `npx expo prebuild` (or first `npm run ios` in an Expo project), the pods install runs automatically.
 
-### 4. Attachment previews in iOS pushes (optional)
+### 4. Pushes: the iOS extension, encrypted pushes (optional)
 
-The push service sends a photo or video message with its thumbnail (`previewUrl`, `mutable-content: 1`). Android shows it by itself; iOS needs a Notification Service Extension in the app. The SDK ships one as an Expo config plugin:
+The SDK ships an Expo config plugin that adds a Notification Service Extension, `EthoraNotificationService`, to the app:
 
 ```json
 {
@@ -109,7 +109,10 @@ The push service sends a photo or video message with its thumbnail (`previewUrl`
 }
 ```
 
-`npx expo prebuild` then adds the `EthoraNotificationService` target (bundle id `<app bundle id>.EthoraNotificationService`), embeds it in the app and registers it for EAS Build credentials (`extra.eas.build.experimental.ios.appExtensions`). The signing team comes from the plugin option `appleTeamId`, else `ios.appleTeamId`, else the team already set on the app target. The extension downloads the thumbnail and attaches it to the notification; text pushes and failed downloads (an expired link, no network, the iOS time limit) show the notification unchanged. The sender avatar is not attached. Encrypted (sealed) pushes are not handled yet.
+`npx expo prebuild` then adds the target (bundle id `<app bundle id>.EthoraNotificationService`), embeds it in the app, shares a keychain access group between the two and registers the extension for EAS Build credentials (`extra.eas.build.experimental.ios.appExtensions`). The signing team comes from the plugin option `appleTeamId`, else `ios.appleTeamId`, else the team already set on the app target. The extension does two things:
+
+- **Attachment previews.** A photo or video push carries its thumbnail (`previewUrl`, `mutable-content: 1`); Android shows it by itself, the extension attaches it on iOS. Text pushes and failed downloads show the notification unchanged.
+- **Encrypted pushes.** A device that registers an X25519 public key with its token gets its chat pushes sealed (libsodium sealed box), so Google and Apple relay ciphertext only; the extension decrypts and shows the real text. Android does the same in a background task. Setup, the API (`ensurePushKeyPair`, `registerPushToken(token, { pushKey })`, `registerSealedPushTask`) and what to check are in [docs/push-encryption.md](docs/push-encryption.md).
 
 ## Quick start
 

package/lib/commonjs/helpers/secureStoreRuntime.js

@@ -18,6 +18,12 @@ exports.loadSecureStore = exports.isSecureStoreAvailable = exports.__resetSecure
  * AsyncStorage rather than crash (see `secureKeyValue.ts`).
  */
 
+/**
+ * The subset of expo-secure-store's options the SDK uses. `keychainService`
+ * must be repeated on every read of an item written with it; the
+ * accessibility constants come from `SecureStoreRuntime.accessible`.
+ */
+
 let cached;
 
 /**
@@ -39,7 +45,10 @@ const loadSecureStore = () => {
       cached = {
         getItemAsync: mod.getItemAsync,
         setItemAsync: mod.setItemAsync,
-        deleteItemAsync: mod.deleteItemAsync
+        deleteItemAsync: mod.deleteItemAsync,
+        accessible: {
+          afterFirstUnlockThisDeviceOnly: mod.AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY
+        }
       };
     }
   } catch {

package/lib/commonjs/helpers/secureStoreRuntime.js.map

@@ -1 +1 @@
-{"version":3,"names":["cached","loadSecureStore","undefined","mod","require","getItemAsync","setItemAsync","deleteItemAsync","exports","isSecureStoreAvailable","__resetSecureStoreRuntimeForTests"],"sourceRoot":"../../../src","sources":["helpers/secureStoreRuntime.ts"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAQA,IAAIA,MAA6C;;AAEjD;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,eAAe,GAAGA,CAAA,KAAiC;EAC9D,IAAID,MAAM,KAAKE,SAAS,EAAE;IACxB,OAAOF,MAAM;EACf;EAEA,IAAI;IACF;IACA,MAAMG,GAAG,GAAGC,OAAO,CAAC,mBAAmB,CAAC;IACxC,IACE,OAAOD,GAAG,EAAEE,YAAY,KAAK,UAAU,IACvC,OAAOF,GAAG,EAAEG,YAAY,KAAK,UAAU,IACvC,OAAOH,GAAG,EAAEI,eAAe,KAAK,UAAU,EAC1C;MACAP,MAAM,GAAG,IAAI;IACf,CAAC,MAAM;MACLA,MAAM,GAAG;QACPK,YAAY,EAAEF,GAAG,CAACE,YAAY;QAC9BC,YAAY,EAAEH,GAAG,CAACG,YAAY;QAC9BC,eAAe,EAAEJ,GAAG,CAACI;MACvB,CAAC;IACH;EACF,CAAC,CAAC,MAAM;IACNP,MAAM,GAAG,IAAI;EACf;EAEA,OAAOA,MAAM;AACf,CAAC;AAACQ,OAAA,CAAAP,eAAA,GAAAA,eAAA;AAEK,MAAMQ,sBAAsB,GAAGA,CAAA,KAAeR,eAAe,CAAC,CAAC,KAAK,IAAI;;AAE/E;AAAAO,OAAA,CAAAC,sBAAA,GAAAA,sBAAA;AACO,MAAMC,iCAAiC,GAAGA,CAAA,KAAY;EAC3DV,MAAM,GAAGE,SAAS;AACpB,CAAC;AAACM,OAAA,CAAAE,iCAAA,GAAAA,iCAAA","ignoreList":[]}
+{"version":3,"names":["cached","loadSecureStore","undefined","mod","require","getItemAsync","setItemAsync","deleteItemAsync","accessible","afterFirstUnlockThisDeviceOnly","AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY","exports","isSecureStoreAvailable","__resetSecureStoreRuntimeForTests"],"sourceRoot":"../../../src","sources":["helpers/secureStoreRuntime.ts"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;;AAiBA,IAAIA,MAA6C;;AAEjD;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,eAAe,GAAGA,CAAA,KAAiC;EAC9D,IAAID,MAAM,KAAKE,SAAS,EAAE;IACxB,OAAOF,MAAM;EACf;EAEA,IAAI;IACF;IACA,MAAMG,GAAG,GAAGC,OAAO,CAAC,mBAAmB,CAAC;IACxC,IACE,OAAOD,GAAG,EAAEE,YAAY,KAAK,UAAU,IACvC,OAAOF,GAAG,EAAEG,YAAY,KAAK,UAAU,IACvC,OAAOH,GAAG,EAAEI,eAAe,KAAK,UAAU,EAC1C;MACAP,MAAM,GAAG,IAAI;IACf,CAAC,MAAM;MACLA,MAAM,GAAG;QACPK,YAAY,EAAEF,GAAG,CAACE,YAAY;QAC9BC,YAAY,EAAEH,GAAG,CAACG,YAAY;QAC9BC,eAAe,EAAEJ,GAAG,CAACI,eAAe;QACpCC,UAAU,EAAE;UACVC,8BAA8B,EAAEN,GAAG,CAACO;QACtC;MACF,CAAC;IACH;EACF,CAAC,CAAC,MAAM;IACNV,MAAM,GAAG,IAAI;EACf;EAEA,OAAOA,MAAM;AACf,CAAC;AAACW,OAAA,CAAAV,eAAA,GAAAA,eAAA;AAEK,MAAMW,sBAAsB,GAAGA,CAAA,KAAeX,eAAe,CAAC,CAAC,KAAK,IAAI;;AAE/E;AAAAU,OAAA,CAAAC,sBAAA,GAAAA,sBAAA;AACO,MAAMC,iCAAiC,GAAGA,CAAA,KAAY;EAC3Db,MAAM,GAAGE,SAAS;AACpB,CAAC;AAACS,OAAA,CAAAE,iCAAA,GAAAA,iCAAA","ignoreList":[]}

package/lib/commonjs/main.js

@@ -33,6 +33,18 @@ Object.defineProperty(exports, "LIGHT_THEME", {
     return _theme.LIGHT_THEME;
   }
 });
+Object.defineProperty(exports, "PUSH_KEY_KEYCHAIN_SERVICE", {
+  enumerable: true,
+  get: function () {
+    return _pushKeyStore.PUSH_KEY_KEYCHAIN_SERVICE;
+  }
+});
+Object.defineProperty(exports, "PUSH_SECRET_KEY_ITEM", {
+  enumerable: true,
+  get: function () {
+    return _pushKeyStore.PUSH_SECRET_KEY_ITEM;
+  }
+});
 Object.defineProperty(exports, "PushRegistrationError", {
   enumerable: true,
   get: function () {
@@ -45,18 +57,48 @@ Object.defineProperty(exports, "RefreshFatalError", {
     return _authRefresh.RefreshFatalError;
   }
 });
+Object.defineProperty(exports, "SEALED_PUSH_ALG", {
+  enumerable: true,
+  get: function () {
+    return _sealedPush.SEALED_PUSH_ALG;
+  }
+});
+Object.defineProperty(exports, "SEALED_PUSH_TASK", {
+  enumerable: true,
+  get: function () {
+    return _sealedPushTask.SEALED_PUSH_TASK;
+  }
+});
 Object.defineProperty(exports, "XmppProvider", {
   enumerable: true,
   get: function () {
     return _xmppProvider.XmppProvider;
   }
 });
+Object.defineProperty(exports, "clearPushKeyPair", {
+  enumerable: true,
+  get: function () {
+    return _pushKeyStore.clearPushKeyPair;
+  }
+});
 Object.defineProperty(exports, "detectPushTokenType", {
   enumerable: true,
   get: function () {
     return _push.detectPushTokenType;
   }
 });
+Object.defineProperty(exports, "ensurePushKeyPair", {
+  enumerable: true,
+  get: function () {
+    return _pushKeyStore.ensurePushKeyPair;
+  }
+});
+Object.defineProperty(exports, "getPushKeyPair", {
+  enumerable: true,
+  get: function () {
+    return _pushKeyStore.getPushKeyPair;
+  }
+});
 Object.defineProperty(exports, "getRegisteredPushToken", {
   enumerable: true,
   get: function () {
@@ -105,6 +147,12 @@ Object.defineProperty(exports, "isRefreshFatalError", {
     return _authRefresh.isRefreshFatalError;
   }
 });
+Object.defineProperty(exports, "isSealedPush", {
+  enumerable: true,
+  get: function () {
+    return _sealedPush.isSealedPush;
+  }
+});
 Object.defineProperty(exports, "logoutService", {
   enumerable: true,
   get: function () {
@@ -123,6 +171,18 @@ Object.defineProperty(exports, "openRoomFromPush", {
     return _pushPayload.openRoomFromPush;
   }
 });
+Object.defineProperty(exports, "openSealedPush", {
+  enumerable: true,
+  get: function () {
+    return _sealedPush.openSealedPush;
+  }
+});
+Object.defineProperty(exports, "presentSealedPush", {
+  enumerable: true,
+  get: function () {
+    return _sealedPushTask.presentSealedPush;
+  }
+});
 Object.defineProperty(exports, "refreshAuthTokens", {
   enumerable: true,
   get: function () {
@@ -141,12 +201,24 @@ Object.defineProperty(exports, "registerPushToken", {
     return _pushRegistration.registerPushToken;
   }
 });
+Object.defineProperty(exports, "registerSealedPushTask", {
+  enumerable: true,
+  get: function () {
+    return _sealedPushTask.registerSealedPushTask;
+  }
+});
 Object.defineProperty(exports, "resendMessage", {
   enumerable: true,
   get: function () {
     return _resendMessage.resendMessage;
   }
 });
+Object.defineProperty(exports, "resetPushKeyPair", {
+  enumerable: true,
+  get: function () {
+    return _pushKeyStore.resetPushKeyPair;
+  }
+});
 Object.defineProperty(exports, "resolveStringTable", {
   enumerable: true,
   get: function () {
@@ -159,6 +231,12 @@ Object.defineProperty(exports, "resolveTheme", {
     return _theme.resolveTheme;
   }
 });
+Object.defineProperty(exports, "sealedPushEnvelopeOf", {
+  enumerable: true,
+  get: function () {
+    return _sealedPush.sealedPushEnvelopeOf;
+  }
+});
 Object.defineProperty(exports, "setPushEnabled", {
   enumerable: true,
   get: function () {
@@ -244,6 +322,9 @@ var _useUnreadMessagesCounter = require("./hooks/useUnreadMessagesCounter");
 var _pushPayload = require("./helpers/pushPayload");
 var _pushRegistration = require("./services/pushRegistration");
 var _push = require("./networking/api-requests/push.api");
+var _pushKeyStore = require("./push/pushKeyStore");
+var _sealedPushTask = require("./push/sealedPushTask");
+var _sealedPush = require("./push/sealedPush");
 var _useChatRoomFocus = require("./hooks/useChatRoomFocus");
 var _useLogout = require("./hooks/useLogout");
 var _useQRCodeChatHandler = require("./hooks/useQRCodeChatHandler");

package/lib/commonjs/main.js.map

@@ -1 +1 @@
-{"version":3,"names":["require","_ReduxWrapper","_xmppProvider","_useUnreadMessagesCounter","_pushPayload","_pushRegistration","_push","_useChatRoomFocus","_useLogout","_useQRCodeChatHandler","_resendMessage","_useChatFonts","_useT","_strings","_authRefresh","_theme","_chatSettingsSlice","_e2ee"],"sourceRoot":"../../src","sources":["main.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBAA,OAAA;AAGA,IAAAC,aAAA,GAAAD,OAAA;AACA,IAAAE,aAAA,GAAAF,OAAA;AAGA,IAAAG,yBAAA,GAAAH,OAAA;AAEA,IAAAI,YAAA,GAAAJ,OAAA;AAEA,IAAAK,iBAAA,GAAAL,OAAA;AAYA,IAAAM,KAAA,GAAAN,OAAA;AAUA,IAAAO,iBAAA,GAAAP,OAAA;AACA,IAAAQ,UAAA,GAAAR,OAAA;AACA,IAAAS,qBAAA,GAAAT,OAAA;AACA,IAAAU,cAAA,GAAAV,OAAA;AAEA,IAAAW,aAAA,GAAAX,OAAA;AAKA,IAAAY,KAAA,GAAAZ,OAAA;AACA,IAAAa,QAAA,GAAAb,OAAA;AAqCA,IAAAc,YAAA,GAAAd,OAAA;AAYA,IAAAe,MAAA,GAAAf,OAAA;AASA,IAAAgB,kBAAA,GAAAhB,OAAA;AACA,IAAAiB,KAAA,GAAAjB,OAAA","ignoreList":[]}
+{"version":3,"names":["require","_ReduxWrapper","_xmppProvider","_useUnreadMessagesCounter","_pushPayload","_pushRegistration","_push","_pushKeyStore","_sealedPushTask","_sealedPush","_useChatRoomFocus","_useLogout","_useQRCodeChatHandler","_resendMessage","_useChatFonts","_useT","_strings","_authRefresh","_theme","_chatSettingsSlice","_e2ee"],"sourceRoot":"../../src","sources":["main.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBAA,OAAA;AAGA,IAAAC,aAAA,GAAAD,OAAA;AACA,IAAAE,aAAA,GAAAF,OAAA;AAGA,IAAAG,yBAAA,GAAAH,OAAA;AAEA,IAAAI,YAAA,GAAAJ,OAAA;AAEA,IAAAK,iBAAA,GAAAL,OAAA;AAYA,IAAAM,KAAA,GAAAN,OAAA;AAaA,IAAAO,aAAA,GAAAP,OAAA;AASA,IAAAQ,eAAA,GAAAR,OAAA;AAMA,IAAAS,WAAA,GAAAT,OAAA;AAYA,IAAAU,iBAAA,GAAAV,OAAA;AACA,IAAAW,UAAA,GAAAX,OAAA;AACA,IAAAY,qBAAA,GAAAZ,OAAA;AACA,IAAAa,cAAA,GAAAb,OAAA;AAEA,IAAAc,aAAA,GAAAd,OAAA;AAKA,IAAAe,KAAA,GAAAf,OAAA;AACA,IAAAgB,QAAA,GAAAhB,OAAA;AAqCA,IAAAiB,YAAA,GAAAjB,OAAA;AAYA,IAAAkB,MAAA,GAAAlB,OAAA;AASA,IAAAmB,kBAAA,GAAAnB,OAAA;AACA,IAAAoB,KAAA,GAAApB,OAAA","ignoreList":[]}

package/lib/commonjs/networking/api-requests/push.api.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.isPushRegistrationError = exports.detectPushTokenType = exports.buildPushSubscriptionPayload = exports.buildPushGatewayPayload = exports.PushRegistrationError = void 0;
+exports.isPushRegistrationError = exports.detectPushTokenType = exports.buildPushSubscriptionPayload = exports.buildPushGatewayPayload = exports.PushRegistrationError = exports.PUSH_KEY_ALG = void 0;
 exports.registerPushSubscription = registerPushSubscription;
 exports.resolvePushDeviceType = void 0;
 exports.subscribeToPushGateway = subscribeToPushGateway;
@@ -51,32 +51,47 @@ const toRegistrationError = (error, what) => {
   return new PushRegistrationError(status ? `${what} refused (HTTP ${status}): ${detail}` : `${what} failed: ${detail}`, status, body);
 };
 const isUnknownFieldError = error => error?.response?.status === 422 && /not allowed/i.test(String(error?.response?.data?.error ?? ''));
-const buildPushSubscriptionPayload = (token, tokenType) => ({
+
+/** The only sealing scheme the push service knows (README, "Encrypted pushes"). */
+const PUSH_KEY_ALG = exports.PUSH_KEY_ALG = 'sealed-box-x25519';
+const buildPushSubscriptionPayload = (token, tokenType, pushKey, pushKeyId) => ({
   registrationToken: token,
   deviceType: resolvePushDeviceType(),
-  tokenType
+  tokenType,
+  ...(pushKey ? {
+    pushKey,
+    pushKeyAlg: PUSH_KEY_ALG,
+    ...(pushKeyId ? {
+      pushKeyId
+    } : {})
+  } : {})
 });
 exports.buildPushSubscriptionPayload = buildPushSubscriptionPayload;
 async function registerPushSubscription({
   appId,
   token,
   tokenType,
-  authToken
+  authToken,
+  pushKey,
+  pushKeyId
 }) {
   const path = `/v1/push/subscription/${encodeURIComponent(appId)}`;
   const headers = {
     Authorization: authToken
   };
-  const payload = buildPushSubscriptionPayload(token, tokenType);
+  const payload = buildPushSubscriptionPayload(token, tokenType, pushKey, pushKeyId);
   try {
     await _apiClient.default.post(path, payload, {
       headers
     });
     return;
   } catch (error) {
-    const canDowngrade = tokenType === 'apns' || tokenType === 'fcm';
+    // A backend that predates `tokenType` still delivers to apns / fcm
+    // tokens. One that predates `pushKey` would deliver in the clear: the
+    // host asked for encryption, so that is an error, never a quiet fallback.
+    const canDowngrade = (tokenType === 'apns' || tokenType === 'fcm') && !pushKey;
     if (!(canDowngrade && isUnknownFieldError(error))) {
-      throw toRegistrationError(error, tokenType === 'expo' ? 'Push registration (the backend does not accept Expo push tokens yet)' : 'Push registration');
+      throw toRegistrationError(error, tokenType === 'expo' ? 'Push registration (the backend does not accept Expo push tokens yet)' : pushKey && isUnknownFieldError(error) ? 'Push registration (the backend does not support encrypted pushes)' : 'Push registration');
     }
   }
   try {

package/lib/commonjs/networking/api-requests/push.api.js.map

@@ -1 +1 @@
-{"version":3,"names":["_axios","_interopRequireDefault","require","_reactNative","_roomStore","_apiClient","e","__esModule","default","PushRegistrationError","Error","constructor","message","status","body","name","exports","isPushRegistrationError","error","EXPO_PUSH_TOKEN","APNS_TOKEN","detectPushTokenType","token","t","trim","test","resolvePushDeviceType","Platform","OS","toRegistrationError","what","response","data","detail","isUnknownFieldError","String","buildPushSubscriptionPayload","tokenType","registrationToken","deviceType","registerPushSubscription","appId","authToken","path","encodeURIComponent","headers","Authorization","payload","http","post","canDowngrade","unregisterPushSubscription","delete","endpoint","DEFAULT_XMPP_HOST","resolveXmppHost","config","store","getState","chatSettingStore","xmppSettings","host","gatewayAxios","axios","create","buildPushGatewayPayload","userJid","projectName","jid","includes","subscribeToPushGateway","args","baseURL","apiUrl"],"sourceRoot":"../../../../src","sources":["networking/api-requests/push.api.ts"],"mappings":";;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AACA,IAAAE,UAAA,GAAAF,OAAA;AACA,IAAAG,UAAA,GAAAJ,sBAAA,CAAAC,OAAA;AAAgC,SAAAD,uBAAAK,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAOhC;AACA;AACA;AACA;AACA;AACO,MAAMG,qBAAqB,SAASC,KAAK,CAAC;EAI/CC,WAAWA,CAACC,OAAe,EAAEC,MAAe,EAAEC,IAAc,EAAE;IAC5D,KAAK,CAACF,OAAO,CAAC;IACd,IAAI,CAACG,IAAI,GAAG,uBAAuB;IACnC,IAAI,CAACF,MAAM,GAAGA,MAAM;IACpB,IAAI,CAACC,IAAI,GAAGA,IAAI;EAClB;AACF;AAACE,OAAA,CAAAP,qBAAA,GAAAA,qBAAA;AAEM,MAAMQ,uBAAuB,GAClCC,KAAc,IAEbA,KAAK,EAA4BH,IAAI,KAAK,uBAAuB;AAACC,OAAA,CAAAC,uBAAA,GAAAA,uBAAA;AAErE,MAAME,eAAe,GAAG,oCAAoC;AAC5D,MAAMC,UAAU,GAAG,kBAAkB;AAE9B,MAAMC,mBAAmB,GAAIC,KAAa,IAAoB;EACnE,MAAMC,CAAC,GAAGD,KAAK,CAACE,IAAI,CAAC,CAAC;EACtB,IAAIL,eAAe,CAACM,IAAI,CAACF,CAAC,CAAC,EAAE;IAC3B,OAAO,MAAM;EACf;EACA,IAAIH,UAAU,CAACK,IAAI,CAACF,CAAC,CAAC,EAAE;IACtB,OAAO,MAAM;EACf;EACA,OAAO,KAAK;AACd,CAAC;AAACP,OAAA,CAAAK,mBAAA,GAAAA,mBAAA;AAEK,MAAMK,qBAAqB,GAAGA,CAAA,KACnCC,qBAAQ,CAACC,EAAE,KAAK,KAAK,GAAG,KAAK,GAAG,SAAS;AAACZ,OAAA,CAAAU,qBAAA,GAAAA,qBAAA;AAE5C,MAAMG,mBAAmB,GAAGA,CAACX,KAAU,EAAEY,IAAY,KAA4B;EAC/E,MAAMjB,MAA0B,GAAGK,KAAK,EAAEa,QAAQ,EAAElB,MAAM;EAC1D,MAAMC,IAAI,GAAGI,KAAK,EAAEa,QAAQ,EAAEC,IAAI;EAClC,MAAMC,MAAM,GACT,OAAOnB,IAAI,EAAEI,KAAK,KAAK,QAAQ,IAAIJ,IAAI,CAACI,KAAK,IAC9CA,KAAK,EAAEN,OAAO,IACd,eAAe;EACjB,OAAO,IAAIH,qBAAqB,CAC9BI,MAAM,GACF,GAAGiB,IAAI,kBAAkBjB,MAAM,MAAMoB,MAAM,EAAE,GAC7C,GAAGH,IAAI,YAAYG,MAAM,EAAE,EAC/BpB,MAAM,EACNC,IACF,CAAC;AACH,CAAC;AAED,MAAMoB,mBAAmB,GAAIhB,KAAU,IACrCA,KAAK,EAAEa,QAAQ,EAAElB,MAAM,KAAK,GAAG,IAC/B,cAAc,CAACY,IAAI,CAACU,MAAM,CAACjB,KAAK,EAAEa,QAAQ,EAAEC,IAAI,EAAEd,KAAK,IAAI,EAAE,CAAC,CAAC;AAe1D,MAAMkB,4BAA4B,GAAGA,CAC1Cd,KAAa,EACbe,SAAwB,MACK;EAC7BC,iBAAiB,EAAEhB,KAAK;EACxBiB,UAAU,EAAEb,qBAAqB,CAAC,CAAC;EACnCW;AACF,CAAC,CAAC;AAACrB,OAAA,CAAAoB,4BAAA,GAAAA,4BAAA;AAEI,eAAeI,wBAAwBA,CAAC;EAC7CC,KAAK;EACLnB,KAAK;EACLe,SAAS;EACTK;AAC4B,CAAC,EAAiB;EAC9C,MAAMC,IAAI,GAAG,yBAAyBC,kBAAkB,CAACH,KAAK,CAAC,EAAE;EACjE,MAAMI,OAAO,GAAG;IAAEC,aAAa,EAAEJ;EAAU,CAAC;EAC5C,MAAMK,OAAO,GAAGX,4BAA4B,CAACd,KAAK,EAAEe,SAAS,CAAC;EAE9D,IAAI;IACF,MAAMW,kBAAI,CAACC,IAAI,CAACN,IAAI,EAAEI,OAAO,EAAE;MAAEF;IAAQ,CAAC,CAAC;IAC3C;EACF,CAAC,CAAC,OAAO3B,KAAU,EAAE;IACnB,MAAMgC,YAAY,GAAGb,SAAS,KAAK,MAAM,IAAIA,SAAS,KAAK,KAAK;IAChE,IAAI,EAAEa,YAAY,IAAIhB,mBAAmB,CAAChB,KAAK,CAAC,CAAC,EAAE;MACjD,MAAMW,mBAAmB,CACvBX,KAAK,EACLmB,SAAS,KAAK,MAAM,GAChB,sEAAsE,GACtE,mBACN,CAAC;IACH;EACF;EAEA,IAAI;IACF,MAAMW,kBAAI,CAACC,IAAI,CACbN,IAAI,EACJ;MAAEL,iBAAiB,EAAES,OAAO,CAACT,iBAAiB;MAAEC,UAAU,EAAEQ,OAAO,CAACR;IAAW,CAAC,EAChF;MAAEM;IAAQ,CACZ,CAAC;EACH,CAAC,CAAC,OAAO3B,KAAU,EAAE;IACnB,MAAMW,mBAAmB,CAACX,KAAK,EAAE,mBAAmB,CAAC;EACvD;AACF;AAQO,eAAeiC,0BAA0BA,CAAC;EAC/CV,KAAK;EACLnB,KAAK;EACLoB;AAC8B,CAAC,EAAiB;EAChD,MAAMG,OAAO,GAAG;IAAEC,aAAa,EAAEJ;EAAU,CAAC;EAC5C,IAAI;IACF,MAAMM,kBAAI,CAACI,MAAM,CAAC,yBAAyBR,kBAAkB,CAACH,KAAK,CAAC,EAAE,EAAE;MACtEI,OAAO;MACPb,IAAI,EAAE;QAAEM,iBAAiB,EAAEhB;MAAM;IACnC,CAAC,CAAC;IACF;EACF,CAAC,CAAC,OAAOJ,KAAU,EAAE;IACnB,IAAIA,KAAK,EAAEa,QAAQ,EAAElB,MAAM,KAAK,GAAG,EAAE;MACnC,MAAMgB,mBAAmB,CAACX,KAAK,EAAE,qBAAqB,CAAC;IACzD;EACF;EACA,IAAI;IACF,MAAM8B,kBAAI,CAACI,MAAM,CAAC,qBAAqB,EAAE;MACvCP,OAAO;MACPb,IAAI,EAAE;QAAEqB,QAAQ,EAAE/B;MAAM;IAC1B,CAAC,CAAC;EACJ,CAAC,CAAC,OAAOJ,KAAU,EAAE;IACnB,MAAMW,mBAAmB,CAACX,KAAK,EAAE,qBAAqB,CAAC;EACzD;AACF;AAEA,MAAMoC,iBAAiB,GAAG,sBAAsB;AAiBhD,MAAMC,eAAe,GAAGA,CAAA,KAAc;EACpC,MAAMC,MAAM,GAAGC,gBAAK,CAACC,QAAQ,CAAC,CAAC,CAACC,gBAAgB,EAAEH,MAAM;EACxD,OAAO,CAACA,MAAM,EAAEI,YAAY,EAAEC,IAAI,IAAI,EAAE,EAAErC,IAAI,CAAC,CAAC,IAAI8B,iBAAiB;AACvE,CAAC;AAED,MAAMQ,YAAY,GAAGC,cAAK,CAACC,MAAM,CAAC;EAChCnB,OAAO,EAAE;IAAE,cAAc,EAAE;EAAmB;AAChD,CAAC,CAAC;AAEK,MAAMoB,uBAAuB,GAAGA,CAAC;EACtC3C,KAAK;EACL4C,OAAO;EACPC;AAC+D,CAAC,MAAsC;EACtGA,WAAW;EACX7B,iBAAiB,EAAEhB,KAAK;EACxBiB,UAAU,EAAEb,qBAAqB,CAAC,CAAC;EACnC0C,GAAG,EAAEF,OAAO,CAACG,QAAQ,CAAC,GAAG,CAAC,GAAGH,OAAO,GAAG,GAAGA,OAAO,IAAIX,eAAe,CAAC,CAAC;AACxE,CAAC,CAAC;AAACvC,OAAA,CAAAiD,uBAAA,GAAAA,uBAAA;AAEI,eAAeK,sBAAsBA,CAC1CC,IAA0B,EACX;EACf,IAAI;IACF,MAAMT,YAAY,CAACb,IAAI,CAAC,gBAAgB,EAAEgB,uBAAuB,CAACM,IAAI,CAAC,EAAE;MACvEC,OAAO,EAAED,IAAI,CAACE,MAAM;MACpB5B,OAAO,EAAE;QAAEC,aAAa,EAAE,UAAUyB,IAAI,CAAC7B,SAAS;MAAG;IACvD,CAAC,CAAC;EACJ,CAAC,CAAC,OAAOxB,KAAU,EAAE;IACnB,MAAMW,mBAAmB,CAACX,KAAK,EAAE,2BAA2B,CAAC;EAC/D;AACF","ignoreList":[]}
+{"version":3,"names":["_axios","_interopRequireDefault","require","_reactNative","_roomStore","_apiClient","e","__esModule","default","PushRegistrationError","Error","constructor","message","status","body","name","exports","isPushRegistrationError","error","EXPO_PUSH_TOKEN","APNS_TOKEN","detectPushTokenType","token","t","trim","test","resolvePushDeviceType","Platform","OS","toRegistrationError","what","response","data","detail","isUnknownFieldError","String","PUSH_KEY_ALG","buildPushSubscriptionPayload","tokenType","pushKey","pushKeyId","registrationToken","deviceType","pushKeyAlg","registerPushSubscription","appId","authToken","path","encodeURIComponent","headers","Authorization","payload","http","post","canDowngrade","unregisterPushSubscription","delete","endpoint","DEFAULT_XMPP_HOST","resolveXmppHost","config","store","getState","chatSettingStore","xmppSettings","host","gatewayAxios","axios","create","buildPushGatewayPayload","userJid","projectName","jid","includes","subscribeToPushGateway","args","baseURL","apiUrl"],"sourceRoot":"../../../../src","sources":["networking/api-requests/push.api.ts"],"mappings":";;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AACA,IAAAE,UAAA,GAAAF,OAAA;AACA,IAAAG,UAAA,GAAAJ,sBAAA,CAAAC,OAAA;AAAgC,SAAAD,uBAAAK,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAOhC;AACA;AACA;AACA;AACA;AACO,MAAMG,qBAAqB,SAASC,KAAK,CAAC;EAI/CC,WAAWA,CAACC,OAAe,EAAEC,MAAe,EAAEC,IAAc,EAAE;IAC5D,KAAK,CAACF,OAAO,CAAC;IACd,IAAI,CAACG,IAAI,GAAG,uBAAuB;IACnC,IAAI,CAACF,MAAM,GAAGA,MAAM;IACpB,IAAI,CAACC,IAAI,GAAGA,IAAI;EAClB;AACF;AAACE,OAAA,CAAAP,qBAAA,GAAAA,qBAAA;AAEM,MAAMQ,uBAAuB,GAClCC,KAAc,IAEbA,KAAK,EAA4BH,IAAI,KAAK,uBAAuB;AAACC,OAAA,CAAAC,uBAAA,GAAAA,uBAAA;AAErE,MAAME,eAAe,GAAG,oCAAoC;AAC5D,MAAMC,UAAU,GAAG,kBAAkB;AAE9B,MAAMC,mBAAmB,GAAIC,KAAa,IAAoB;EACnE,MAAMC,CAAC,GAAGD,KAAK,CAACE,IAAI,CAAC,CAAC;EACtB,IAAIL,eAAe,CAACM,IAAI,CAACF,CAAC,CAAC,EAAE;IAC3B,OAAO,MAAM;EACf;EACA,IAAIH,UAAU,CAACK,IAAI,CAACF,CAAC,CAAC,EAAE;IACtB,OAAO,MAAM;EACf;EACA,OAAO,KAAK;AACd,CAAC;AAACP,OAAA,CAAAK,mBAAA,GAAAA,mBAAA;AAEK,MAAMK,qBAAqB,GAAGA,CAAA,KACnCC,qBAAQ,CAACC,EAAE,KAAK,KAAK,GAAG,KAAK,GAAG,SAAS;AAACZ,OAAA,CAAAU,qBAAA,GAAAA,qBAAA;AAE5C,MAAMG,mBAAmB,GAAGA,CAACX,KAAU,EAAEY,IAAY,KAA4B;EAC/E,MAAMjB,MAA0B,GAAGK,KAAK,EAAEa,QAAQ,EAAElB,MAAM;EAC1D,MAAMC,IAAI,GAAGI,KAAK,EAAEa,QAAQ,EAAEC,IAAI;EAClC,MAAMC,MAAM,GACT,OAAOnB,IAAI,EAAEI,KAAK,KAAK,QAAQ,IAAIJ,IAAI,CAACI,KAAK,IAC9CA,KAAK,EAAEN,OAAO,IACd,eAAe;EACjB,OAAO,IAAIH,qBAAqB,CAC9BI,MAAM,GACF,GAAGiB,IAAI,kBAAkBjB,MAAM,MAAMoB,MAAM,EAAE,GAC7C,GAAGH,IAAI,YAAYG,MAAM,EAAE,EAC/BpB,MAAM,EACNC,IACF,CAAC;AACH,CAAC;AAED,MAAMoB,mBAAmB,GAAIhB,KAAU,IACrCA,KAAK,EAAEa,QAAQ,EAAElB,MAAM,KAAK,GAAG,IAC/B,cAAc,CAACY,IAAI,CAACU,MAAM,CAACjB,KAAK,EAAEa,QAAQ,EAAEC,IAAI,EAAEd,KAAK,IAAI,EAAE,CAAC,CAAC;;AAEjE;AACO,MAAMkB,YAAY,GAAApB,OAAA,CAAAoB,YAAA,GAAG,mBAAmB;AAyBxC,MAAMC,4BAA4B,GAAGA,CAC1Cf,KAAa,EACbgB,SAAwB,EACxBC,OAAgB,EAChBC,SAAkB,MACW;EAC7BC,iBAAiB,EAAEnB,KAAK;EACxBoB,UAAU,EAAEhB,qBAAqB,CAAC,CAAC;EACnCY,SAAS;EACT,IAAIC,OAAO,GACP;IAAEA,OAAO;IAAEI,UAAU,EAAEP,YAAY;IAAE,IAAII,SAAS,GAAG;MAAEA;IAAU,CAAC,GAAG,CAAC,CAAC;EAAE,CAAC,GAC1E,CAAC,CAAC;AACR,CAAC,CAAC;AAACxB,OAAA,CAAAqB,4BAAA,GAAAA,4BAAA;AAEI,eAAeO,wBAAwBA,CAAC;EAC7CC,KAAK;EACLvB,KAAK;EACLgB,SAAS;EACTQ,SAAS;EACTP,OAAO;EACPC;AAC4B,CAAC,EAAiB;EAC9C,MAAMO,IAAI,GAAG,yBAAyBC,kBAAkB,CAACH,KAAK,CAAC,EAAE;EACjE,MAAMI,OAAO,GAAG;IAAEC,aAAa,EAAEJ;EAAU,CAAC;EAC5C,MAAMK,OAAO,GAAGd,4BAA4B,CAACf,KAAK,EAAEgB,SAAS,EAAEC,OAAO,EAAEC,SAAS,CAAC;EAElF,IAAI;IACF,MAAMY,kBAAI,CAACC,IAAI,CAACN,IAAI,EAAEI,OAAO,EAAE;MAAEF;IAAQ,CAAC,CAAC;IAC3C;EACF,CAAC,CAAC,OAAO/B,KAAU,EAAE;IACnB;IACA;IACA;IACA,MAAMoC,YAAY,GAAG,CAAChB,SAAS,KAAK,MAAM,IAAIA,SAAS,KAAK,KAAK,KAAK,CAACC,OAAO;IAC9E,IAAI,EAAEe,YAAY,IAAIpB,mBAAmB,CAAChB,KAAK,CAAC,CAAC,EAAE;MACjD,MAAMW,mBAAmB,CACvBX,KAAK,EACLoB,SAAS,KAAK,MAAM,GAChB,sEAAsE,GACtEC,OAAO,IAAIL,mBAAmB,CAAChB,KAAK,CAAC,GACnC,mEAAmE,GACnE,mBACR,CAAC;IACH;EACF;EAEA,IAAI;IACF,MAAMkC,kBAAI,CAACC,IAAI,CACbN,IAAI,EACJ;MAAEN,iBAAiB,EAAEU,OAAO,CAACV,iBAAiB;MAAEC,UAAU,EAAES,OAAO,CAACT;IAAW,CAAC,EAChF;MAAEO;IAAQ,CACZ,CAAC;EACH,CAAC,CAAC,OAAO/B,KAAU,EAAE;IACnB,MAAMW,mBAAmB,CAACX,KAAK,EAAE,mBAAmB,CAAC;EACvD;AACF;AAQO,eAAeqC,0BAA0BA,CAAC;EAC/CV,KAAK;EACLvB,KAAK;EACLwB;AAC8B,CAAC,EAAiB;EAChD,MAAMG,OAAO,GAAG;IAAEC,aAAa,EAAEJ;EAAU,CAAC;EAC5C,IAAI;IACF,MAAMM,kBAAI,CAACI,MAAM,CAAC,yBAAyBR,kBAAkB,CAACH,KAAK,CAAC,EAAE,EAAE;MACtEI,OAAO;MACPjB,IAAI,EAAE;QAAES,iBAAiB,EAAEnB;MAAM;IACnC,CAAC,CAAC;IACF;EACF,CAAC,CAAC,OAAOJ,KAAU,EAAE;IACnB,IAAIA,KAAK,EAAEa,QAAQ,EAAElB,MAAM,KAAK,GAAG,EAAE;MACnC,MAAMgB,mBAAmB,CAACX,KAAK,EAAE,qBAAqB,CAAC;IACzD;EACF;EACA,IAAI;IACF,MAAMkC,kBAAI,CAACI,MAAM,CAAC,qBAAqB,EAAE;MACvCP,OAAO;MACPjB,IAAI,EAAE;QAAEyB,QAAQ,EAAEnC;MAAM;IAC1B,CAAC,CAAC;EACJ,CAAC,CAAC,OAAOJ,KAAU,EAAE;IACnB,MAAMW,mBAAmB,CAACX,KAAK,EAAE,qBAAqB,CAAC;EACzD;AACF;AAEA,MAAMwC,iBAAiB,GAAG,sBAAsB;AAiBhD,MAAMC,eAAe,GAAGA,CAAA,KAAc;EACpC,MAAMC,MAAM,GAAGC,gBAAK,CAACC,QAAQ,CAAC,CAAC,CAACC,gBAAgB,EAAEH,MAAM;EACxD,OAAO,CAACA,MAAM,EAAEI,YAAY,EAAEC,IAAI,IAAI,EAAE,EAAEzC,IAAI,CAAC,CAAC,IAAIkC,iBAAiB;AACvE,CAAC;AAED,MAAMQ,YAAY,GAAGC,cAAK,CAACC,MAAM,CAAC;EAChCnB,OAAO,EAAE;IAAE,cAAc,EAAE;EAAmB;AAChD,CAAC,CAAC;AAEK,MAAMoB,uBAAuB,GAAGA,CAAC;EACtC/C,KAAK;EACLgD,OAAO;EACPC;AAC+D,CAAC,MAAsC;EACtGA,WAAW;EACX9B,iBAAiB,EAAEnB,KAAK;EACxBoB,UAAU,EAAEhB,qBAAqB,CAAC,CAAC;EACnC8C,GAAG,EAAEF,OAAO,CAACG,QAAQ,CAAC,GAAG,CAAC,GAAGH,OAAO,GAAG,GAAGA,OAAO,IAAIX,eAAe,CAAC,CAAC;AACxE,CAAC,CAAC;AAAC3C,OAAA,CAAAqD,uBAAA,GAAAA,uBAAA;AAEI,eAAeK,sBAAsBA,CAC1CC,IAA0B,EACX;EACf,IAAI;IACF,MAAMT,YAAY,CAACb,IAAI,CAAC,gBAAgB,EAAEgB,uBAAuB,CAACM,IAAI,CAAC,EAAE;MACvEC,OAAO,EAAED,IAAI,CAACE,MAAM;MACpB5B,OAAO,EAAE;QAAEC,aAAa,EAAE,UAAUyB,IAAI,CAAC7B,SAAS;MAAG;IACvD,CAAC,CAAC;EACJ,CAAC,CAAC,OAAO5B,KAAU,EAAE;IACnB,MAAMW,mBAAmB,CAACX,KAAK,EAAE,2BAA2B,CAAC;EAC/D;AACF","ignoreList":[]}

package/lib/commonjs/push/pushKeyStore.js

@@ -0,0 +1,169 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.__resetPushKeyStoreForTests = exports.PUSH_SECRET_KEY_ITEM = exports.PUSH_PUBLIC_KEY_ITEM = exports.PUSH_KEY_KEYCHAIN_SERVICE = void 0;
+exports.clearPushKeyPair = clearPushKeyPair;
+exports.ensurePushKeyPair = ensurePushKeyPair;
+exports.getPushKeyPair = getPushKeyPair;
+exports.loadPushSecretKey = loadPushSecretKey;
+exports.resetPushKeyPair = resetPushKeyPair;
+var _crypto = require("../e2ee/crypto");
+var _secureStoreRuntime = require("../helpers/secureStoreRuntime");
+var _devLogger = require("../utils/devLogger");
+var _sealedBox = require("./sealedBox");
+// The device key for encrypted pushes: one X25519 pair per install, in the
+// platform keychain / keystore through expo-secure-store. The public half
+// goes to the push service with the token (`pushKey`); the secret half
+// never leaves the device and is read by whoever renders a sealed push —
+// the Android background task (`sealedPushTask.ts`, same process, same
+// store) and the iOS notification service extension, which reads the
+// keychain item directly (plugins/notification-service), so the item's
+// attributes below are a contract with the Swift side:
+//   service   `ethora.push` (expo-secure-store stores it as `ethora.push:no-auth`)
+//   account   `ethora_push_secret_key`, UTF-8
+//   value     base64 of the 32-byte secret key, UTF-8
+//   group     the app's first keychain access group, which the config
+//             plugin shares with the extension
+// Readable after the first unlock so a push that arrives while the phone
+// is locked still decrypts; this device only, so an iCloud keychain copy
+// on another device is never a key for pushes that go to this one.
+
+const PUSH_KEY_KEYCHAIN_SERVICE = exports.PUSH_KEY_KEYCHAIN_SERVICE = 'ethora.push';
+const PUSH_SECRET_KEY_ITEM = exports.PUSH_SECRET_KEY_ITEM = 'ethora_push_secret_key';
+const PUSH_PUBLIC_KEY_ITEM = exports.PUSH_PUBLIC_KEY_ITEM = 'ethora_push_public_key';
+let warnedMissingStore = false;
+const warnMissingStoreOnce = () => {
+  if (warnedMissingStore) {
+    return;
+  }
+  warnedMissingStore = true;
+  (0, _devLogger.pushLog)('warn', 'push: expo-secure-store is not installed, so no device key for encrypted ' + 'pushes can be kept; pushes stay in the clear.');
+};
+const storeOptions = () => {
+  const store = (0, _secureStoreRuntime.loadSecureStore)();
+  if (!store) {
+    return null;
+  }
+  const accessible = store.accessible.afterFirstUnlockThisDeviceOnly;
+  return {
+    keychainService: PUSH_KEY_KEYCHAIN_SERVICE,
+    ...(accessible !== undefined ? {
+      keychainAccessible: accessible
+    } : {})
+  };
+};
+const readItem = async item => {
+  const store = (0, _secureStoreRuntime.loadSecureStore)();
+  const options = storeOptions();
+  if (!store || !options) {
+    return null;
+  }
+  try {
+    return await store.getItemAsync(item, options);
+  } catch (e) {
+    (0, _devLogger.pushLog)('warn', `push: reading ${item} failed`, e);
+    return null;
+  }
+};
+const decodeKey = (raw, length) => {
+  if (!raw) {
+    return null;
+  }
+  try {
+    const bytes = (0, _crypto.fromBase64)(raw);
+    return bytes.length === length ? bytes : null;
+  } catch {
+    return null;
+  }
+};
+
+/**
+ * The stored pair, or null when there is none (or it is unreadable).
+ * The public key is re-derived from the secret, so the pair is consistent
+ * even if only the secret item survived.
+ */
+async function loadPushSecretKey() {
+  const secretKey = decodeKey(await readItem(PUSH_SECRET_KEY_ITEM), _sealedBox.SEALED_BOX_SECRET_KEY_BYTES);
+  if (!secretKey) {
+    return null;
+  }
+  const stored = decodeKey(await readItem(PUSH_PUBLIC_KEY_ITEM), _sealedBox.SEALED_BOX_PUBLIC_KEY_BYTES);
+  return {
+    publicKey: stored ?? (0, _sealedBox.sealedBoxPublicKeyOf)(secretKey),
+    secretKey
+  };
+}
+const describe = publicKey => ({
+  publicKey: (0, _crypto.toBase64)(publicKey),
+  keyId: (0, _sealedBox.sealedBoxKeyId)(publicKey)
+});
+
+/** The public half of the stored pair, null when the device has no key. */
+async function getPushKeyPair() {
+  const key = await loadPushSecretKey();
+  return key ? describe(key.publicKey) : null;
+}
+
+/**
+ * Generate and store a new pair, replacing any existing one. Pushes sealed
+ * for the old key stop opening at once, so re-register the token with the
+ * new `publicKey` right after. Null when expo-secure-store is missing or
+ * the keychain refused the write.
+ */
+async function resetPushKeyPair() {
+  const store = (0, _secureStoreRuntime.loadSecureStore)();
+  const options = storeOptions();
+  if (!store || !options) {
+    warnMissingStoreOnce();
+    return null;
+  }
+  const pair = (0, _sealedBox.generateSealedBoxKeyPair)();
+  try {
+    await store.setItemAsync(PUSH_SECRET_KEY_ITEM, (0, _crypto.toBase64)(pair.secretKey), options);
+    await store.setItemAsync(PUSH_PUBLIC_KEY_ITEM, (0, _crypto.toBase64)(pair.publicKey), options);
+  } catch (e) {
+    (0, _devLogger.pushLog)('warn', 'push: storing the device key failed', e);
+    return null;
+  }
+  const check = await loadPushSecretKey();
+  if (!check || (0, _crypto.toBase64)(check.publicKey) !== (0, _crypto.toBase64)(pair.publicKey)) {
+    (0, _devLogger.pushLog)('warn', 'push: the device key was not kept');
+    return null;
+  }
+  (0, _devLogger.pushLog)('rn', `push: new device key ${(0, _sealedBox.sealedBoxKeyId)(pair.publicKey)}`);
+  return describe(pair.publicKey);
+}
+
+/**
+ * The device key for encrypted pushes, created on first call. Hand
+ * `publicKey` to `registerPushToken` (or send it as `pushKey` yourself).
+ */
+async function ensurePushKeyPair() {
+  const existing = await getPushKeyPair();
+  return existing ?? resetPushKeyPair();
+}
+
+/** Remove the pair; the next `ensurePushKeyPair` creates a new one. */
+async function clearPushKeyPair() {
+  const store = (0, _secureStoreRuntime.loadSecureStore)();
+  const options = storeOptions();
+  if (!store || !options) {
+    return;
+  }
+  for (const item of [PUSH_SECRET_KEY_ITEM, PUSH_PUBLIC_KEY_ITEM]) {
+    try {
+      await store.deleteItemAsync(item, options);
+    } catch {
+      // Not there — nothing to remove.
+    }
+  }
+}
+
+/** Test seam only. */
+const __resetPushKeyStoreForTests = () => {
+  warnedMissingStore = false;
+};
+exports.__resetPushKeyStoreForTests = __resetPushKeyStoreForTests;
+//# sourceMappingURL=pushKeyStore.js.map

package/lib/commonjs/push/pushKeyStore.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_crypto","require","_secureStoreRuntime","_devLogger","_sealedBox","PUSH_KEY_KEYCHAIN_SERVICE","exports","PUSH_SECRET_KEY_ITEM","PUSH_PUBLIC_KEY_ITEM","warnedMissingStore","warnMissingStoreOnce","pushLog","storeOptions","store","loadSecureStore","accessible","afterFirstUnlockThisDeviceOnly","keychainService","undefined","keychainAccessible","readItem","item","options","getItemAsync","e","decodeKey","raw","length","bytes","fromBase64","loadPushSecretKey","secretKey","SEALED_BOX_SECRET_KEY_BYTES","stored","SEALED_BOX_PUBLIC_KEY_BYTES","publicKey","sealedBoxPublicKeyOf","describe","toBase64","keyId","sealedBoxKeyId","getPushKeyPair","key","resetPushKeyPair","pair","generateSealedBoxKeyPair","setItemAsync","check","ensurePushKeyPair","existing","clearPushKeyPair","deleteItemAsync","__resetPushKeyStoreForTests"],"sourceRoot":"../../../src","sources":["push/pushKeyStore.ts"],"mappings":";;;;;;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,mBAAA,GAAAD,OAAA;AACA,IAAAE,UAAA,GAAAF,OAAA;AACA,IAAAG,UAAA,GAAAH,OAAA;AASA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEO,MAAMI,yBAAyB,GAAAC,OAAA,CAAAD,yBAAA,GAAG,aAAa;AAC/C,MAAME,oBAAoB,GAAAD,OAAA,CAAAC,oBAAA,GAAG,wBAAwB;AACrD,MAAMC,oBAAoB,GAAAF,OAAA,CAAAE,oBAAA,GAAG,wBAAwB;AAS5D,IAAIC,kBAAkB,GAAG,KAAK;AAC9B,MAAMC,oBAAoB,GAAGA,CAAA,KAAM;EACjC,IAAID,kBAAkB,EAAE;IAAC;EAAO;EAChCA,kBAAkB,GAAG,IAAI;EACzB,IAAAE,kBAAO,EACL,MAAM,EACN,2EAA2E,GACzE,+CACJ,CAAC;AACH,CAAC;AAED,MAAMC,YAAY,GAAGA,CAAA,KAAiC;EACpD,MAAMC,KAAK,GAAG,IAAAC,mCAAe,EAAC,CAAC;EAC/B,IAAI,CAACD,KAAK,EAAE;IAAC,OAAO,IAAI;EAAC;EACzB,MAAME,UAAU,GAAGF,KAAK,CAACE,UAAU,CAACC,8BAA8B;EAClE,OAAO;IACLC,eAAe,EAAEZ,yBAAyB;IAC1C,IAAIU,UAAU,KAAKG,SAAS,GAAG;MAAEC,kBAAkB,EAAEJ;IAAW,CAAC,GAAG,CAAC,CAAC;EACxE,CAAC;AACH,CAAC;AAED,MAAMK,QAAQ,GAAG,MAAOC,IAAY,IAA6B;EAC/D,MAAMR,KAAK,GAAG,IAAAC,mCAAe,EAAC,CAAC;EAC/B,MAAMQ,OAAO,GAAGV,YAAY,CAAC,CAAC;EAC9B,IAAI,CAACC,KAAK,IAAI,CAACS,OAAO,EAAE;IAAC,OAAO,IAAI;EAAC;EACrC,IAAI;IACF,OAAO,MAAMT,KAAK,CAACU,YAAY,CAACF,IAAI,EAAEC,OAAO,CAAC;EAChD,CAAC,CAAC,OAAOE,CAAC,EAAE;IACV,IAAAb,kBAAO,EAAC,MAAM,EAAE,iBAAiBU,IAAI,SAAS,EAAEG,CAAC,CAAC;IAClD,OAAO,IAAI;EACb;AACF,CAAC;AAED,MAAMC,SAAS,GAAGA,CAACC,GAAkB,EAAEC,MAAc,KAAwB;EAC3E,IAAI,CAACD,GAAG,EAAE;IAAC,OAAO,IAAI;EAAC;EACvB,IAAI;IACF,MAAME,KAAK,GAAG,IAAAC,kBAAU,EAACH,GAAG,CAAC;IAC7B,OAAOE,KAAK,CAACD,MAAM,KAAKA,MAAM,GAAGC,KAAK,GAAG,IAAI;EAC/C,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACO,eAAeE,iBAAiBA,CAAA,EAAkC;EACvE,MAAMC,SAAS,GAAGN,SAAS,CAAC,MAAML,QAAQ,CAACb,oBAAoB,CAAC,EAAEyB,sCAA2B,CAAC;EAC9F,IAAI,CAACD,SAAS,EAAE;IAAC,OAAO,IAAI;EAAC;EAC7B,MAAME,MAAM,GAAGR,SAAS,CAAC,MAAML,QAAQ,CAACZ,oBAAoB,CAAC,EAAE0B,sCAA2B,CAAC;EAC3F,OAAO;IAAEC,SAAS,EAAEF,MAAM,IAAI,IAAAG,+BAAoB,EAACL,SAAS,CAAC;IAAEA;EAAU,CAAC;AAC5E;AAEA,MAAMM,QAAQ,GAAIF,SAAqB,KAAmB;EACxDA,SAAS,EAAE,IAAAG,gBAAQ,EAACH,SAAS,CAAC;EAC9BI,KAAK,EAAE,IAAAC,yBAAc,EAACL,SAAS;AACjC,CAAC,CAAC;;AAEF;AACO,eAAeM,cAAcA,CAAA,EAAgC;EAClE,MAAMC,GAAG,GAAG,MAAMZ,iBAAiB,CAAC,CAAC;EACrC,OAAOY,GAAG,GAAGL,QAAQ,CAACK,GAAG,CAACP,SAAS,CAAC,GAAG,IAAI;AAC7C;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeQ,gBAAgBA,CAAA,EAAgC;EACpE,MAAM9B,KAAK,GAAG,IAAAC,mCAAe,EAAC,CAAC;EAC/B,MAAMQ,OAAO,GAAGV,YAAY,CAAC,CAAC;EAC9B,IAAI,CAACC,KAAK,IAAI,CAACS,OAAO,EAAE;IACtBZ,oBAAoB,CAAC,CAAC;IACtB,OAAO,IAAI;EACb;EACA,MAAMkC,IAAI,GAAG,IAAAC,mCAAwB,EAAC,CAAC;EACvC,IAAI;IACF,MAAMhC,KAAK,CAACiC,YAAY,CAACvC,oBAAoB,EAAE,IAAA+B,gBAAQ,EAACM,IAAI,CAACb,SAAS,CAAC,EAAET,OAAO,CAAC;IACjF,MAAMT,KAAK,CAACiC,YAAY,CAACtC,oBAAoB,EAAE,IAAA8B,gBAAQ,EAACM,IAAI,CAACT,SAAS,CAAC,EAAEb,OAAO,CAAC;EACnF,CAAC,CAAC,OAAOE,CAAC,EAAE;IACV,IAAAb,kBAAO,EAAC,MAAM,EAAE,qCAAqC,EAAEa,CAAC,CAAC;IACzD,OAAO,IAAI;EACb;EACA,MAAMuB,KAAK,GAAG,MAAMjB,iBAAiB,CAAC,CAAC;EACvC,IAAI,CAACiB,KAAK,IAAI,IAAAT,gBAAQ,EAACS,KAAK,CAACZ,SAAS,CAAC,KAAK,IAAAG,gBAAQ,EAACM,IAAI,CAACT,SAAS,CAAC,EAAE;IACpE,IAAAxB,kBAAO,EAAC,MAAM,EAAE,mCAAmC,CAAC;IACpD,OAAO,IAAI;EACb;EACA,IAAAA,kBAAO,EAAC,IAAI,EAAE,wBAAwB,IAAA6B,yBAAc,EAACI,IAAI,CAACT,SAAS,CAAC,EAAE,CAAC;EACvE,OAAOE,QAAQ,CAACO,IAAI,CAACT,SAAS,CAAC;AACjC;;AAEA;AACA;AACA;AACA;AACO,eAAea,iBAAiBA,CAAA,EAAgC;EACrE,MAAMC,QAAQ,GAAG,MAAMR,cAAc,CAAC,CAAC;EACvC,OAAOQ,QAAQ,IAAIN,gBAAgB,CAAC,CAAC;AACvC;;AAEA;AACO,eAAeO,gBAAgBA,CAAA,EAAkB;EACtD,MAAMrC,KAAK,GAAG,IAAAC,mCAAe,EAAC,CAAC;EAC/B,MAAMQ,OAAO,GAAGV,YAAY,CAAC,CAAC;EAC9B,IAAI,CAACC,KAAK,IAAI,CAACS,OAAO,EAAE;IAAC;EAAO;EAChC,KAAK,MAAMD,IAAI,IAAI,CAACd,oBAAoB,EAAEC,oBAAoB,CAAC,EAAE;IAC/D,IAAI;MACF,MAAMK,KAAK,CAACsC,eAAe,CAAC9B,IAAI,EAAEC,OAAO,CAAC;IAC5C,CAAC,CAAC,MAAM;MACN;IAAA;EAEJ;AACF;;AAEA;AACO,MAAM8B,2BAA2B,GAAGA,CAAA,KAAY;EACrD3C,kBAAkB,GAAG,KAAK;AAC5B,CAAC;AAACH,OAAA,CAAA8C,2BAAA,GAAAA,2BAAA","ignoreList":[]}

package/lib/commonjs/push/sealedBox.js

@@ -0,0 +1,106 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.sealedBoxKeyId = exports.generateSealedBoxKeyPair = exports.SEALED_BOX_SECRET_KEY_BYTES = exports.SEALED_BOX_PUBLIC_KEY_BYTES = exports.SEALED_BOX_OVERHEAD_BYTES = void 0;
+exports.sealedBoxOpen = sealedBoxOpen;
+exports.sealedBoxPublicKeyOf = void 0;
+exports.sealedBoxSeal = sealedBoxSeal;
+var _salsa = require("@noble/ciphers/salsa.js");
+var _utils = require("@noble/ciphers/utils.js");
+var _ed = require("@noble/curves/ed25519.js");
+var _blake = require("@noble/hashes/blake2.js");
+var _sha = require("@noble/hashes/sha2.js");
+var _utils2 = require("@noble/hashes/utils.js");
+// libsodium's sealed box (`crypto_box_seal` / `crypto_box_seal_open`) on
+// the noble primitives the e2ee code already ships, so the JS side needs
+// no native libsodium. The push service seals every chat push for a
+// device that registered an X25519 public key (ethora-backend,
+// services/push/README.md, "Encrypted pushes"); this is the matching
+// receiver. The iOS notification service extension decrypts the same
+// boxes in Swift with libsodium (plugins/notification-service).
+//
+// Layout: ephemeral public key (32) || crypto_box(message, nonce,
+// recipient pk, ephemeral sk), with crypto_box = XSalsa20-Poly1305 under
+// HSalsa20(X25519 shared secret) and nonce = BLAKE2b-192(epk || rpk).
+// `__tests__/sealedBox.test.ts` pins this against libsodium itself.
+
+const SEALED_BOX_PUBLIC_KEY_BYTES = exports.SEALED_BOX_PUBLIC_KEY_BYTES = 32;
+const SEALED_BOX_SECRET_KEY_BYTES = exports.SEALED_BOX_SECRET_KEY_BYTES = 32;
+/** Ephemeral public key (32) + Poly1305 tag (16). */
+const SEALED_BOX_OVERHEAD_BYTES = exports.SEALED_BOX_OVERHEAD_BYTES = 48;
+const NONCE_BYTES = 24;
+const SIGMA = (0, _utils.u32)((0, _utils.utf8ToBytes)('expand 32-byte k'));
+const ZERO_NONCE_PREFIX = new Uint32Array(4);
+const generateSealedBoxKeyPair = () => {
+  const {
+    secretKey,
+    publicKey
+  } = _ed.x25519.keygen();
+  return {
+    publicKey,
+    secretKey
+  };
+};
+exports.generateSealedBoxKeyPair = generateSealedBoxKeyPair;
+const sealedBoxPublicKeyOf = secretKey => _ed.x25519.getPublicKey(secretKey);
+
+/**
+ * The key id the push service derives when the registration carries none:
+ * the first 16 hex characters of SHA-256 over the raw public key. Sent back
+ * as `kid` in every sealed push.
+ */
+exports.sealedBoxPublicKeyOf = sealedBoxPublicKeyOf;
+const sealedBoxKeyId = publicKey => (0, _utils2.bytesToHex)((0, _sha.sha256)(publicKey)).slice(0, 16);
+
+// crypto_box_beforenm: HSalsa20 over the X25519 shared secret.
+exports.sealedBoxKeyId = sealedBoxKeyId;
+const boxSharedKey = (theirPublicKey, mySecretKey) => {
+  const shared = _ed.x25519.getSharedSecret(mySecretKey, theirPublicKey);
+  const words = new Uint32Array(8);
+  (0, _salsa.hsalsa)(SIGMA, (0, _utils.u32)(shared), ZERO_NONCE_PREFIX, words);
+  (0, _utils.clean)(shared);
+  return (0, _utils.u8)(words);
+};
+const sealNonce = (ephemeralPublicKey, recipientPublicKey) => (0, _blake.blake2b)((0, _utils.concatBytes)(ephemeralPublicKey, recipientPublicKey), {
+  dkLen: NONCE_BYTES
+});
+
+/** `crypto_box_seal`: used by the tests and the key tool, not by the app. */
+function sealedBoxSeal(message, recipientPublicKey) {
+  if (recipientPublicKey.length !== SEALED_BOX_PUBLIC_KEY_BYTES) {
+    throw new Error('sealedBoxSeal: the public key must be 32 bytes');
+  }
+  const ephemeral = generateSealedBoxKeyPair();
+  const key = boxSharedKey(recipientPublicKey, ephemeral.secretKey);
+  const nonce = sealNonce(ephemeral.publicKey, recipientPublicKey);
+  const box = (0, _salsa.xsalsa20poly1305)(key, nonce).encrypt(message);
+  (0, _utils.clean)(key, ephemeral.secretKey);
+  return (0, _utils.concatBytes)(ephemeral.publicKey, box);
+}
+
+/**
+ * `crypto_box_seal_open`. Returns null for anything that does not open:
+ * a wrong key, a box for another key, a damaged or truncated box.
+ */
+function sealedBoxOpen(sealed, publicKey, secretKey) {
+  if (sealed.length < SEALED_BOX_OVERHEAD_BYTES || publicKey.length !== SEALED_BOX_PUBLIC_KEY_BYTES || secretKey.length !== SEALED_BOX_SECRET_KEY_BYTES) {
+    return null;
+  }
+  const ephemeralPublicKey = sealed.subarray(0, SEALED_BOX_PUBLIC_KEY_BYTES);
+  const box = sealed.subarray(SEALED_BOX_PUBLIC_KEY_BYTES);
+  let key = null;
+  try {
+    key = boxSharedKey(ephemeralPublicKey, secretKey);
+    const nonce = sealNonce(ephemeralPublicKey, publicKey);
+    return (0, _salsa.xsalsa20poly1305)(key, nonce).decrypt(box);
+  } catch {
+    return null;
+  } finally {
+    if (key) {
+      (0, _utils.clean)(key);
+    }
+  }
+}
+//# sourceMappingURL=sealedBox.js.map

package/lib/commonjs/push/sealedBox.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_salsa","require","_utils","_ed","_blake","_sha","_utils2","SEALED_BOX_PUBLIC_KEY_BYTES","exports","SEALED_BOX_SECRET_KEY_BYTES","SEALED_BOX_OVERHEAD_BYTES","NONCE_BYTES","SIGMA","u32","utf8ToBytes","ZERO_NONCE_PREFIX","Uint32Array","generateSealedBoxKeyPair","secretKey","publicKey","x25519","keygen","sealedBoxPublicKeyOf","getPublicKey","sealedBoxKeyId","bytesToHex","sha256","slice","boxSharedKey","theirPublicKey","mySecretKey","shared","getSharedSecret","words","hsalsa","clean","u8","sealNonce","ephemeralPublicKey","recipientPublicKey","blake2b","concatBytes","dkLen","sealedBoxSeal","message","length","Error","ephemeral","key","nonce","box","xsalsa20poly1305","encrypt","sealedBoxOpen","sealed","subarray","decrypt"],"sourceRoot":"../../../src","sources":["push/sealedBox.ts"],"mappings":";;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,MAAA,GAAAD,OAAA;AACA,IAAAE,GAAA,GAAAF,OAAA;AACA,IAAAG,MAAA,GAAAH,OAAA;AACA,IAAAI,IAAA,GAAAJ,OAAA;AACA,IAAAK,OAAA,GAAAL,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEO,MAAMM,2BAA2B,GAAAC,OAAA,CAAAD,2BAAA,GAAG,EAAE;AACtC,MAAME,2BAA2B,GAAAD,OAAA,CAAAC,2BAAA,GAAG,EAAE;AAC7C;AACO,MAAMC,yBAAyB,GAAAF,OAAA,CAAAE,yBAAA,GAAG,EAAE;AAE3C,MAAMC,WAAW,GAAG,EAAE;AACtB,MAAMC,KAAK,GAAG,IAAAC,UAAG,EAAC,IAAAC,kBAAW,EAAC,kBAAkB,CAAC,CAAC;AAClD,MAAMC,iBAAiB,GAAG,IAAIC,WAAW,CAAC,CAAC,CAAC;AAOrC,MAAMC,wBAAwB,GAAGA,CAAA,KAAwB;EAC9D,MAAM;IAAEC,SAAS;IAAEC;EAAU,CAAC,GAAGC,UAAM,CAACC,MAAM,CAAC,CAAC;EAChD,OAAO;IAAEF,SAAS;IAAED;EAAU,CAAC;AACjC,CAAC;AAACV,OAAA,CAAAS,wBAAA,GAAAA,wBAAA;AAEK,MAAMK,oBAAoB,GAAIJ,SAAqB,IACxDE,UAAM,CAACG,YAAY,CAACL,SAAS,CAAC;;AAEhC;AACA;AACA;AACA;AACA;AAJAV,OAAA,CAAAc,oBAAA,GAAAA,oBAAA;AAKO,MAAME,cAAc,GAAIL,SAAqB,IAClD,IAAAM,kBAAU,EAAC,IAAAC,WAAM,EAACP,SAAS,CAAC,CAAC,CAACQ,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;;AAE5C;AAAAnB,OAAA,CAAAgB,cAAA,GAAAA,cAAA;AACA,MAAMI,YAAY,GAAGA,CAACC,cAA0B,EAAEC,WAAuB,KAAiB;EACxF,MAAMC,MAAM,GAAGX,UAAM,CAACY,eAAe,CAACF,WAAW,EAAED,cAAc,CAAC;EAClE,MAAMI,KAAK,GAAG,IAAIjB,WAAW,CAAC,CAAC,CAAC;EAChC,IAAAkB,aAAM,EAACtB,KAAK,EAAE,IAAAC,UAAG,EAACkB,MAAM,CAAC,EAAEhB,iBAAiB,EAAEkB,KAAK,CAAC;EACpD,IAAAE,YAAK,EAACJ,MAAM,CAAC;EACb,OAAO,IAAAK,SAAE,EAACH,KAAK,CAAC;AAClB,CAAC;AAED,MAAMI,SAAS,GAAGA,CAACC,kBAA8B,EAAEC,kBAA8B,KAC/E,IAAAC,cAAO,EAAC,IAAAC,kBAAW,EAACH,kBAAkB,EAAEC,kBAAkB,CAAC,EAAE;EAAEG,KAAK,EAAE/B;AAAY,CAAC,CAAC;;AAEtF;AACO,SAASgC,aAAaA,CAACC,OAAmB,EAAEL,kBAA8B,EAAc;EAC7F,IAAIA,kBAAkB,CAACM,MAAM,KAAKtC,2BAA2B,EAAE;IAC7D,MAAM,IAAIuC,KAAK,CAAC,gDAAgD,CAAC;EACnE;EACA,MAAMC,SAAS,GAAG9B,wBAAwB,CAAC,CAAC;EAC5C,MAAM+B,GAAG,GAAGpB,YAAY,CAACW,kBAAkB,EAAEQ,SAAS,CAAC7B,SAAS,CAAC;EACjE,MAAM+B,KAAK,GAAGZ,SAAS,CAACU,SAAS,CAAC5B,SAAS,EAAEoB,kBAAkB,CAAC;EAChE,MAAMW,GAAG,GAAG,IAAAC,uBAAgB,EAACH,GAAG,EAAEC,KAAK,CAAC,CAACG,OAAO,CAACR,OAAO,CAAC;EACzD,IAAAT,YAAK,EAACa,GAAG,EAAED,SAAS,CAAC7B,SAAS,CAAC;EAC/B,OAAO,IAAAuB,kBAAW,EAACM,SAAS,CAAC5B,SAAS,EAAE+B,GAAG,CAAC;AAC9C;;AAEA;AACA;AACA;AACA;AACO,SAASG,aAAaA,CAC3BC,MAAkB,EAClBnC,SAAqB,EACrBD,SAAqB,EACF;EACnB,IACEoC,MAAM,CAACT,MAAM,GAAGnC,yBAAyB,IACzCS,SAAS,CAAC0B,MAAM,KAAKtC,2BAA2B,IAChDW,SAAS,CAAC2B,MAAM,KAAKpC,2BAA2B,EAChD;IACA,OAAO,IAAI;EACb;EACA,MAAM6B,kBAAkB,GAAGgB,MAAM,CAACC,QAAQ,CAAC,CAAC,EAAEhD,2BAA2B,CAAC;EAC1E,MAAM2C,GAAG,GAAGI,MAAM,CAACC,QAAQ,CAAChD,2BAA2B,CAAC;EACxD,IAAIyC,GAAsB,GAAG,IAAI;EACjC,IAAI;IACFA,GAAG,GAAGpB,YAAY,CAACU,kBAAkB,EAAEpB,SAAS,CAAC;IACjD,MAAM+B,KAAK,GAAGZ,SAAS,CAACC,kBAAkB,EAAEnB,SAAS,CAAC;IACtD,OAAO,IAAAgC,uBAAgB,EAACH,GAAG,EAAEC,KAAK,CAAC,CAACO,OAAO,CAACN,GAAG,CAAC;EAClD,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb,CAAC,SAAS;IACR,IAAIF,GAAG,EAAE;MAAC,IAAAb,YAAK,EAACa,GAAG,CAAC;IAAC;EACvB;AACF","ignoreList":[]}