@fiduswriter/editor 0.1.0

package/dist/documents/access_rights/templates.js

@@ -0,0 +1,150 @@
+import { avatarTemplate, escapeText } from "fwtoolkit";
+export const peopleTabTemplate = ({ contacts, collaborators }) => `<div id="my-contacts" class="fw-ar-container">
+        <h3 class="fw-green-title">${gettext("My contacts")}</h3>
+        <table class="fw-data-table">
+            <thead class="fw-data-table-header"><tr><th width="337">${gettext("Contacts")}</th></tr></thead>
+            <tbody class="fw-data-table-body fw-small">
+                ${contactsTemplate({ contacts })}
+            </tbody>
+        </table>
+    </div>
+    <span id="add-share-contact" class="fw-button fw-large fw-square fw-light fw-ar-button">
+        <i class="fa-solid fa-caret-right"></i>
+    </span>
+    <div id="share-contact" class="fw-ar-container">
+        <h3 class="fw-green-title">${gettext("My collaborators")}</h3>
+        <table class="fw-data-table tablesorter">
+            <thead class="fw-data-table-header"><tr>
+                    <th width="217">${gettext("Collaborators")}</th>
+                    <th width="50" align="center">${gettext("Rights")}</th>
+                    <th width="50" align="center">${gettext("Delete")}</th>
+            </tr></thead>
+            <tbody class="fw-data-table-body fw-small">
+                ${collaboratorsTemplate({ collaborators })}
+            </tbody>
+        </table>
+    </div>`;
+export const shareLinkTabTemplate = () => `<div id="share-token-list">
+        <p class="fw-ar-loading">${gettext("Loading…")}</p>
+    </div>
+    <button class="fw-button fw-light" id="create-share-token-btn">
+        <i class="fa-solid fa-plus"></i>&nbsp;${gettext("Create new share link")}
+    </button>`;
+/** The list of active share-link tokens for a single document */
+export const shareTokenListTemplate = ({ tokens }) => {
+    if (!tokens.length) {
+        return `<p class="fw-ar-no-tokens">${gettext("No active share links yet.")}</p>`;
+    }
+    return tokens.map(token => shareTokenRowTemplate({ token })).join("");
+};
+/** A single share-link token row */
+export const shareTokenRowTemplate = ({ token }) => {
+    const expiry = token.expires_at
+        ? escapeText(token.expires_at.slice(0, 10))
+        : gettext("never");
+    const note = token.note ? escapeText(token.note) : "";
+    return `<div class="share-token-row" data-token-id="${token.id}">
+        <div class="share-token-meta">
+            <span class="share-token-rights fw-bold">${escapeText(token.rights)}</span>
+            <span class="share-token-expiry">&nbsp;·&nbsp;${gettext("expires")}: ${expiry}</span>
+            ${note ? `<span class="share-token-note">&nbsp;·&nbsp;${note}</span>` : ""}
+        </div>
+        <div class="share-token-url-row">
+            <input class="share-token-url-input" type="text" readonly value="${escapeText(token.share_url)}" />
+            <button class="fw-button fw-light copy-share-token-btn" data-url="${escapeText(token.share_url)}" title="${gettext("Copy link")}">
+                <i class="fa-solid fa-copy"></i>
+            </button>
+            <button class="fw-button fw-light revoke-share-token-btn" data-token-id="${token.id}" title="${gettext("Revoke")}">
+                <i class="fa-solid fa-trash-alt"></i>
+            </button>
+        </div>
+    </div>`;
+};
+/** Sub-dialog for creating a new share link */
+export const createShareTokenDialogTemplate = (e2ee = false, documentPassword = "") => `<table class="fw-dialog-table">
+        <tbody>
+            <tr>
+                <th><label for="share-token-rights">${gettext("Rights")}</label></th>
+                <td class="fw-entry-field">
+                    <select id="share-token-rights" class="fw-button fw-light fw-large">
+                        ${e2ee
+    ? `<option value="read">${gettext("Read")}</option>
+                               <option value="read-without-comments">${gettext("Read without comments")}</option>
+                               <option value="write">${gettext("Write")}</option>`
+    : `<option value="read">${gettext("Read")}</option>
+                               <option value="read-without-comments">${gettext("Read without comments")}</option>
+                               <option value="review">${gettext("Review")}</option>
+                               <option value="review-tracked">${gettext("Review tracked")}</option>
+                               <option value="comment">${gettext("Comment")}</option>
+                               <option value="write">${gettext("Write")}</option>
+                               <option value="write-tracked">${gettext("Write tracked")}</option>`}
+                    </select>
+                    <div class="fw-select-arrow fa-solid fa-caret-down"></div>
+                </td>
+            </tr>
+            <tr>
+                <th><label for="share-token-expires">${gettext("Expires")}</label></th>
+                <td class="fw-entry-field">
+                    <input id="share-token-expires" type="text" class="fw-light" placeholder="${gettext("YYYY-MM-DD or empty")}" pattern="\d{4}-\d{2}-\d{2}" />
+                </td>
+            </tr>
+            <tr>
+                <th><label for="share-token-note">${gettext("Note")}</label></th>
+                <td class="fw-entry-field">
+                    <input id="share-token-note" type="text" class="fw-light" placeholder="${gettext('optional label, e.g. "for reviewers"')}"/>
+                </td>
+            </tr>
+            ${e2ee
+    ? `<tr>
+                    <th><label for="share-token-password">${gettext("Document password")}</label></th>
+                    <td class="fw-entry-field">
+                        <input id="share-token-password" type="text" class="fw-light" value="${escapeText(documentPassword)}" placeholder="${gettext("Enter the document password to include it in the link")}" autocomplete="off" />
+                        <p class="e2ee-share-warning">
+                            <i class="fa-solid fa-exclamation-triangle"></i>
+                            ${gettext("If you enter the password above, it will be embedded in the link (after #). Anyone with the link can open the document. Only share such links through secure channels.")}
+                        </p>
+                    </td>
+                </tr>`
+    : ""}
+        </tbody>
+    </table>`;
+/** The template for an individual row in the left hand side list of users (all contacts) of the access rights dialogue. */
+export const contactsTemplate = ({ contacts }) => contacts
+    .map(contact => `<tr>
+            <td width="337" data-id="${contact.id}" data-type="${contact.type}" class="fw-checkable fw-checkable-td">
+                <span>${avatarTemplate({ user: contact })}</span>
+                <span class="fw-inline">
+                ${contact.type === "userinvite"
+    ? `${gettext("Invite")}:&nbsp;`
+    : ""}
+                    ${escapeText(contact.name)}
+
+                </span>
+            </td>
+        </tr>`)
+    .join("");
+/** The template for the right hand side list of users (the collaborators of the current document) of the access rights dialogue. */
+export const collaboratorsTemplate = ({ collaborators }) => collaborators
+    .map(collaborator => `<tr id="collaborator-${collaborator.holder.type}-${collaborator.holder.id}"
+    data-type="${collaborator.holder.type}" data-id="${collaborator.holder.id}"
+    class="fw-collaborator-tr" data-rights="${collaborator.rights}">
+        <td width="215">
+            <span>${avatarTemplate({ user: collaborator.holder })}</span>
+            <span class="fw-inline">${collaborator.holder.type === "userinvite"
+    ? `${gettext("Invite")}: `
+    : ""}${escapeText(collaborator.holder.name)}</span>
+        </td>
+        <td width="50" align="center">
+            <div class="fw-inline edit-right-wrapper">
+                <i class="fw-icon-access-right icon-access-${collaborator.rights}"></i>
+                <i class="fa-solid fa-caret-down edit-right"></i>
+            </div>
+        </td>
+        <td width="50" align="center">
+            <span class="delete-collaborator fw-inline" data-rights="delete">
+                <i class="fa-solid fa-trash-alt fw-link-text"></i>
+            </span>
+        </td>
+    </tr>`)
+    .join("");
+//# sourceMappingURL=templates.js.map

package/dist/documents/access_rights/templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../../src/documents/access_rights/templates.js"],"names":[],"mappings":"AAAA,OAAO,EAAC,cAAc,EAAE,UAAU,EAAC,MAAM,WAAW,CAAA;AAEpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,EAAC,QAAQ,EAAE,aAAa,EAAC,EAAE,EAAE,CAC3D;qCACiC,OAAO,CAAC,aAAa,CAAC;;sEAEW,OAAO,CAAC,UAAU,CAAC;;kBAEvE,gBAAgB,CAAC,EAAC,QAAQ,EAAC,CAAC;;;;;;;;qCAQT,OAAO,CAAC,kBAAkB,CAAC;;;sCAG1B,OAAO,CAAC,eAAe,CAAC;oDACV,OAAO,CAAC,QAAQ,CAAC;oDACjB,OAAO,CAAC,QAAQ,CAAC;;;kBAGnD,qBAAqB,CAAC,EAAC,aAAa,EAAC,CAAC;;;WAG7C,CAAA;AAEX,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,EAAE,CACrC;mCAC+B,OAAO,CAAC,UAAU,CAAC;;;gDAGN,OAAO,CAAC,uBAAuB,CAAC;cAClE,CAAA;AAEd,iEAAiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,EAAC,MAAM,EAAC,EAAE,EAAE;IAC/C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,8BAA8B,OAAO,CAAC,4BAA4B,CAAC,MAAM,CAAA;IACpF,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAC,KAAK,EAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACvE,CAAC,CAAA;AAED,oCAAoC;AACpC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,EAAC,KAAK,EAAC,EAAE,EAAE;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU;QAC3B,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACtB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrD,OAAO,+CAA+C,KAAK,CAAC,EAAE;;uDAEX,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;4DACnB,OAAO,CAAC,SAAS,CAAC,KAAK,MAAM;cAC3E,IAAI,CAAC,CAAC,CAAC,+CAA+C,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE;;;+EAGP,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;gFAC1B,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,YAAY,OAAO,CAAC,WAAW,CAAC;;;uFAGpD,KAAK,CAAC,EAAE,YAAY,OAAO,CAAC,QAAQ,CAAC;;;;WAIjH,CAAA;AACX,CAAC,CAAA;AAED,+CAA+C;AAC/C,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC1C,IAAI,GAAG,KAAK,EACZ,gBAAgB,GAAG,EAAE,EACvB,EAAE,CACA;;;sDAGkD,OAAO,CAAC,QAAQ,CAAC;;;0BAI3C,IAAI;IACA,CAAC,CAAC,wBAAwB,OAAO,CAAC,MAAM,CAAC;uEACF,OAAO,CAAC,uBAAuB,CAAC;uDAChD,OAAO,CAAC,OAAO,CAAC,WAAW;IAClD,CAAC,CAAC,wBAAwB,OAAO,CAAC,MAAM,CAAC;uEACF,OAAO,CAAC,uBAAuB,CAAC;wDAC/C,OAAO,CAAC,QAAQ,CAAC;gEACT,OAAO,CAAC,gBAAgB,CAAC;yDAChC,OAAO,CAAC,SAAS,CAAC;uDACpB,OAAO,CAAC,OAAO,CAAC;+DACR,OAAO,CAAC,eAAe,CAAC,WAC/D;;;;;;uDAM+B,OAAO,CAAC,SAAS,CAAC;;gGAEuB,OAAO,CAAC,qBAAqB,CAAC;;;;oDAI1E,OAAO,CAAC,MAAM,CAAC;;6FAE0B,OAAO,CAAC,sCAAsC,CAAC;;;cAI5H,IAAI;IACA,CAAC,CAAC;4DACsC,OAAO,CAAC,mBAAmB,CAAC;;+FAEO,UAAU,CAAC,gBAAgB,CAAC,kBAAkB,OAAO,CAAC,uDAAuD,CAAC;;;8BAG/K,OAAO,CAAC,wKAAwK,CAAC;;;sBAGzL;IACF,CAAC,CAAC,EACV;;aAEC,CAAA;AAEb,2HAA2H;AAC3H,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,EAAC,QAAQ,EAAC,EAAE,EAAE,CAC3C,QAAQ;KACH,GAAG,CACA,OAAO,CAAC,EAAE,CACN;uCACuB,OAAO,CAAC,EAAE,gBAAgB,OAAO,CAAC,IAAI;wBACrD,cAAc,CAAC,EAAC,IAAI,EAAE,OAAO,EAAC,CAAC;;kBAGnC,OAAO,CAAC,IAAI,KAAK,YAAY;IACzB,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC/B,CAAC,CAAC,EACV;sBACM,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;;;;cAIhC,CACL;KACA,IAAI,CAAC,EAAE,CAAC,CAAA;AAEjB,oIAAoI;AACpI,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,EAAC,aAAa,EAAC,EAAE,EAAE,CACrD,aAAa;KACR,GAAG,CACA,YAAY,CAAC,EAAE,CACX,wBAAwB,YAAY,CAAC,MAAM,CAAC,IAAI,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE;iBACzE,YAAY,CAAC,MAAM,CAAC,IAAI,cAAc,YAAY,CAAC,MAAM,CAAC,EAAE;8CAC/B,YAAY,CAAC,MAAM;;oBAE7C,cAAc,CAAC,EAAC,IAAI,EAAE,YAAY,CAAC,MAAM,EAAC,CAAC;sCAE/C,YAAY,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;IACrC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI;IAC1B,CAAC,CAAC,EACV,GAAG,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;;;;6DAIU,YAAY,CAAC,MAAM;;;;;;;;;UAStE,CACD;KACA,IAAI,CAAC,EAAE,CAAC,CAAA"}

package/dist/e2ee/encryptor.js

@@ -0,0 +1,201 @@
+/**
+ * E2EE Encryptor - Handles encryption and decryption of document content
+ * for end-to-end encrypted documents.
+ *
+ * Uses AES-GCM (256-bit) for all encryption operations. Each encryption
+ * operation generates a random 12-byte IV (initialization vector) to
+ * ensure that encrypting the same plaintext twice produces different
+ * ciphertext.
+ *
+ * Encrypted data format (Appendix A of the E2EE plan):
+ *   [IV (12 bytes)][Ciphertext (variable length)][Auth Tag (16 bytes, implicit in AES-GCM)]
+ *
+ * When stored as a string (e.g., in JSON fields), the entire structure
+ * is Base64-encoded.
+ */
+export class E2EEEncryptor {
+    /**
+     * Encrypt a string with AES-GCM.
+     *
+     * @param {string} plaintext - The plaintext string to encrypt
+     * @param {CryptoKey} key - An AES-GCM key (from E2EEKeyManager.deriveKey)
+     * @returns {Promise<string>} Base64-encoded string (iv + ciphertext + auth tag)
+     */
+    static async encrypt(plaintext, key) {
+        const iv = crypto.getRandomValues(new Uint8Array(12));
+        const encoded = new TextEncoder().encode(plaintext);
+        const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv: iv }, key, encoded);
+        // Prepend IV to ciphertext for storage
+        const combined = new Uint8Array(iv.length + ciphertext.byteLength);
+        combined.set(iv, 0);
+        combined.set(new Uint8Array(ciphertext), iv.length);
+        return E2EEEncryptor._uint8ArrayToBase64(combined);
+    }
+    /**
+     * Decrypt a Base64-encoded AES-GCM ciphertext.
+     *
+     * @param {string} ciphertextBase64 - Base64-encoded (iv + ciphertext + auth tag)
+     * @param {CryptoKey} key - An AES-GCM key (from E2EEKeyManager.deriveKey)
+     * @returns {Promise<string>} The decrypted plaintext string
+     */
+    static async decrypt(ciphertextBase64, key) {
+        const combined = E2EEEncryptor._base64ToUint8Array(ciphertextBase64);
+        const iv = combined.slice(0, 12);
+        const ciphertext = combined.slice(12);
+        const decrypted = await crypto.subtle.decrypt({ name: "AES-GCM", iv: iv }, key, ciphertext);
+        return new TextDecoder().decode(decrypted);
+    }
+    /**
+     * Encrypt a JSON-serializable object.
+     *
+     * Serializes the object to JSON, then encrypts the JSON string.
+     *
+     * @param {Object} obj - A JSON-serializable object
+     * @param {CryptoKey} key - An AES-GCM key
+     * @returns {Promise<string>} Base64-encoded encrypted data
+     */
+    static encryptObject(obj, key) {
+        return E2EEEncryptor.encrypt(JSON.stringify(obj), key);
+    }
+    /**
+     * Decrypt to a JSON-serializable object.
+     *
+     * Decrypts the Base64-encoded ciphertext, then parses the result as JSON.
+     *
+     * @param {string} ciphertextBase64 - Base64-encoded encrypted data
+     * @param {CryptoKey} key - An AES-GCM key
+     * @returns {Promise<Object>} The decrypted and parsed object
+     */
+    static async decryptObject(ciphertextBase64, key) {
+        const plaintext = await E2EEEncryptor.decrypt(ciphertextBase64, key);
+        return JSON.parse(plaintext);
+    }
+    /**
+     * Encrypt an ArrayBuffer (for images and other binary data).
+     *
+     * @param {ArrayBuffer} buffer - The binary data to encrypt
+     * @param {CryptoKey} key - An AES-GCM key
+     * @returns {Promise<string>} Base64-encoded encrypted data (iv + ciphertext)
+     */
+    static async encryptBuffer(buffer, key) {
+        const iv = crypto.getRandomValues(new Uint8Array(12));
+        const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv: iv }, key, buffer);
+        // Prepend IV to ciphertext
+        const combined = new Uint8Array(iv.length + ciphertext.byteLength);
+        combined.set(iv, 0);
+        combined.set(new Uint8Array(ciphertext), iv.length);
+        return E2EEEncryptor._uint8ArrayToBase64(combined);
+    }
+    /**
+     * Decrypt to an ArrayBuffer.
+     *
+     * @param {string} ciphertextBase64 - Base64-encoded encrypted data
+     * @param {CryptoKey} key - An AES-GCM key
+     * @returns {Promise<ArrayBuffer>} The decrypted binary data
+     */
+    static decryptBuffer(ciphertextBase64, key) {
+        const combined = E2EEEncryptor._base64ToUint8Array(ciphertextBase64);
+        const iv = combined.slice(0, 12);
+        const ciphertext = combined.slice(12);
+        return crypto.subtle.decrypt({ name: "AES-GCM", iv: iv }, key, ciphertext);
+    }
+    /**
+     * Encrypt an image File/Blob for upload.
+     *
+     * Reads the file as an ArrayBuffer, encrypts it, and returns
+     * a Blob with application/octet-stream type (since the encrypted
+     * data is opaque binary).
+     *
+     * @param {File|Blob} file - The image file to encrypt
+     * @param {CryptoKey} key - An AES-GCM key
+     * @returns {Promise<Blob>} An encrypted Blob with type application/octet-stream
+     */
+    static async encryptImage(file, key) {
+        const buffer = await file.arrayBuffer();
+        const iv = crypto.getRandomValues(new Uint8Array(12));
+        const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv: iv }, key, buffer);
+        // Prepend IV to ciphertext
+        const combined = new Uint8Array(iv.length + ciphertext.byteLength);
+        combined.set(iv, 0);
+        combined.set(new Uint8Array(ciphertext), iv.length);
+        return new Blob([combined], { type: "application/octet-stream" });
+    }
+    /**
+     * Decrypt an encrypted image back to an ArrayBuffer.
+     *
+     * @param {string} ciphertextBase64 - Base64-encoded encrypted image data
+     * @param {CryptoKey} key - An AES-GCM key
+     * @returns {Promise<ArrayBuffer>} The decrypted image data
+     */
+    static decryptImage(ciphertextBase64, key) {
+        return E2EEEncryptor.decryptBuffer(ciphertextBase64, key);
+    }
+    /**
+     * Decrypt a Base64-encoded ciphertext and return as a Base64 string.
+     *
+     * Useful for decrypting encrypted images that need to be stored
+     * as Base64 data URLs or re-exported.
+     *
+     * @param {string} ciphertextBase64 - Base64-encoded encrypted data
+     * @param {CryptoKey} key - An AES-GCM key
+     * @returns {Promise<string>} Base64-encoded decrypted data
+     */
+    static async decryptBufferToBase64(ciphertextBase64, key) {
+        const buffer = await E2EEEncryptor.decryptBuffer(ciphertextBase64, key);
+        const bytes = new Uint8Array(buffer);
+        let binary = "";
+        for (let i = 0; i < bytes.length; i++) {
+            binary += String.fromCharCode(bytes[i]);
+        }
+        return btoa(binary);
+    }
+    /**
+     * Decrypt an encrypted image and return a blob URL for display.
+     *
+     * Fetches the encrypted image file from the given URL, decrypts it,
+     * and creates a temporary object URL that can be used as an img src.
+     *
+     * @param {string} imageUrl - The URL of the encrypted image file
+     * @param {CryptoKey} key - An AES-GCM key
+     * @param {string} mimeType - The MIME type of the decrypted image
+     * @returns {Promise<string>} A blob URL for the decrypted image
+     */
+    static async decryptImageToUrl(imageUrl, key, mimeType = "image/png") {
+        const response = await fetch(imageUrl);
+        const arrayBuffer = await response.arrayBuffer();
+        const bytes = new Uint8Array(arrayBuffer);
+        let binary = "";
+        for (let i = 0; i < bytes.length; i++) {
+            binary += String.fromCharCode(bytes[i]);
+        }
+        const base64 = btoa(binary);
+        const decrypted = await E2EEEncryptor.decryptBuffer(base64, key);
+        const blob = new Blob([decrypted], { type: mimeType });
+        return URL.createObjectURL(blob);
+    }
+    // --- Private helper methods ---
+    /**
+     * Convert a Uint8Array to a Base64-encoded string.
+     * @private
+     */
+    static _uint8ArrayToBase64(bytes) {
+        let binary = "";
+        for (let i = 0; i < bytes.length; i++) {
+            binary += String.fromCharCode(bytes[i]);
+        }
+        return btoa(binary);
+    }
+    /**
+     * Convert a Base64-encoded string to a Uint8Array.
+     * @private
+     */
+    static _base64ToUint8Array(base64) {
+        const binary = atob(base64);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+}
+//# sourceMappingURL=encryptor.js.map

package/dist/e2ee/encryptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryptor.js","sourceRoot":"","sources":["../../src/e2ee/encryptor.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,aAAa;IACtB;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG;QAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;QACrD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACnD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC1C,EAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAC,EACzB,GAAG,EACH,OAAO,CACV,CAAA;QACD,uCAAuC;QACvC,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;QAClE,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QACnB,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;QACnD,OAAO,aAAa,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IACtD,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG;QACtC,MAAM,QAAQ,GAAG,aAAa,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAA;QACpE,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAChC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACrC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzC,EAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAC,EACzB,GAAG,EACH,UAAU,CACb,CAAA;QACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC9C,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG;QACzB,OAAO,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;IAC1D,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,gBAAgB,EAAE,GAAG;QAC5C,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAA;QACpE,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAChC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG;QAClC,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;QACrD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC1C,EAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAC,EACzB,GAAG,EACH,MAAM,CACT,CAAA;QACD,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;QAClE,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QACnB,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;QACnD,OAAO,aAAa,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IACtD,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,aAAa,CAAC,gBAAgB,EAAE,GAAG;QACtC,MAAM,QAAQ,GAAG,aAAa,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAA;QACpE,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAChC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACrC,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAC,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;IAC5E,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;QACrD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC1C,EAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAC,EACzB,GAAG,EACH,MAAM,CACT,CAAA;QACD,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;QAClE,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QACnB,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;QACnD,OAAO,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAC,IAAI,EAAE,0BAA0B,EAAC,CAAC,CAAA;IACnE,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,YAAY,CAAC,gBAAgB,EAAE,GAAG;QACrC,OAAO,aAAa,CAAC,aAAa,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAA;IAC7D,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,GAAG;QACpD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAA;QACvE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;QACpC,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3C,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,GAAG,WAAW;QAChE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAA;QAChD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAA;QACzC,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3C,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;QAC3B,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAChE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAC,CAAC,CAAA;QACpD,OAAO,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;IACpC,CAAC;IAED,iCAAiC;IAEjC;;;OAGG;IACH,MAAM,CAAC,mBAAmB,CAAC,KAAK;QAC5B,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3C,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,mBAAmB,CAAC,MAAM;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;QAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,KAAK,CAAA;IAChB,CAAC;CACJ"}

package/dist/e2ee/key-manager.js

@@ -0,0 +1,171 @@
+/**
+ * E2EE Key Manager - Handles key derivation and salt generation for
+ * end-to-end encrypted documents.
+ *
+ * Uses PBKDF2 with SHA-256 to derive a 256-bit AES-GCM key from a
+ * user-supplied password and a server-stored salt. The salt and
+ * iteration count are stored on the server as part of the Document
+ * model (Document.e2ee_salt and Document.e2ee_iterations),
+ * so the user only needs the password to decrypt from any device.
+ *
+ * The key is marked as non-extractable for security — it cannot be
+ * read back from the CryptoKey object once created.
+ */
+export class E2EEKeyManager {
+    /**
+     * Derive an AES-GCM key from a password and salt using PBKDF2.
+     *
+     * @param {string} password - The user-supplied password
+     * @param {Uint8Array} salt - The salt (16 bytes), fetched from the server
+     *   as part of the document data (get_doc_data or subscribe)
+     * @param {number} [iterations=600000] - PBKDF2 iteration count
+     *   (OWASP 2023 recommendation for PBKDF2-SHA256)
+     * @returns {Promise<CryptoKey>} A non-extractable AES-GCM 256-bit key
+     */
+    static async deriveKey(password, salt, iterations = 600000) {
+        const encoder = new TextEncoder();
+        const keyMaterial = await crypto.subtle.importKey("raw", encoder.encode(password), "PBKDF2", false, ["deriveKey"]);
+        const key = await crypto.subtle.deriveKey({
+            name: "PBKDF2",
+            salt: salt,
+            iterations: iterations,
+            hash: "SHA-256"
+        }, keyMaterial, { name: "AES-GCM", length: 256 }, true, // extractable — required for sessionStorage caching
+        ["encrypt", "decrypt"]);
+        return key;
+    }
+    /**
+     * Store an AES-GCM key in sessionStorage for the current browser session.
+     * The key is exported as raw bytes and Base64-encoded before storage.
+     *
+     * @param {number} documentId - The document ID
+     * @param {CryptoKey} key - The AES-GCM key to store
+     */
+    static async storeKeyInSession(documentId, key) {
+        const raw = await crypto.subtle.exportKey("raw", key);
+        const base64 = btoa(String.fromCharCode(...new Uint8Array(raw)));
+        sessionStorage.setItem(`e2ee_key_${documentId}`, base64);
+    }
+    /**
+     * Retrieve an AES-GCM key from sessionStorage.
+     *
+     * @param {number} documentId - The document ID
+     * @returns {Promise<CryptoKey|null>} The imported key, or null if not found
+     */
+    static getKeyFromSession(documentId) {
+        const base64 = sessionStorage.getItem(`e2ee_key_${documentId}`);
+        if (!base64) {
+            return null;
+        }
+        const binary = atob(base64);
+        const raw = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            raw[i] = binary.charCodeAt(i);
+        }
+        return crypto.subtle.importKey("raw", raw, { name: "AES-GCM", length: 256 }, true, ["encrypt", "decrypt"]);
+    }
+    /**
+     * Remove a cached key from sessionStorage.
+     *
+     * @param {number} documentId - The document ID
+     */
+    static clearKeyFromSession(documentId) {
+        sessionStorage.removeItem(`e2ee_key_${documentId}`);
+    }
+    /**
+     * Clear all cached E2EE keys from sessionStorage.
+     * Should be called on sign-out or session expiration.
+     */
+    static clearAllKeysFromSession() {
+        for (let i = sessionStorage.length - 1; i >= 0; i--) {
+            const key = sessionStorage.key(i);
+            if (key && key.startsWith("e2ee_key_")) {
+                sessionStorage.removeItem(key);
+            }
+        }
+    }
+    /**
+     * Generate a new random salt (16 bytes).
+     *
+     * Used when creating a new E2EE document or changing the password.
+     * The generated salt is sent to the server and stored in
+     * Document.e2ee_salt. The salt is not a secret — its purpose
+     * is to ensure that two documents with the same password produce
+     * different derived keys (preventing rainbow table attacks).
+     *
+     * @returns {Uint8Array} A 16-byte random salt
+     */
+    static generateSalt() {
+        return crypto.getRandomValues(new Uint8Array(16));
+    }
+    /**
+     * Resolve a document password to an AES-GCM key.
+     *
+     * If the password is a valid base64/base64url-encoded 32-byte string
+     * (43 or 44 characters), it is treated as a raw DEK and imported
+     * directly without PBKDF2. Otherwise, the key is derived via PBKDF2.
+     *
+     * @param {string} password - The document password
+     * @param {Uint8Array} salt - The salt (16 bytes)
+     * @param {number} [iterations=600000] - PBKDF2 iteration count
+     * @returns {Promise<CryptoKey>} The AES-GCM key
+     */
+    static resolvePasswordToKey(password, salt, iterations = 600000) {
+        // Try to interpret as raw base64/base64url DEK first
+        if (password.length === 44 || password.length === 43) {
+            let decoded = null;
+            try {
+                decoded = atob(password);
+            }
+            catch (_e) {
+                // Try base64url with padding conversion
+                try {
+                    let base64 = password.replace(/-/g, "+").replace(/_/g, "/");
+                    while (base64.length % 4) {
+                        base64 += "=";
+                    }
+                    decoded = atob(base64);
+                }
+                catch (_e2) {
+                    // Not valid base64url either
+                }
+            }
+            if (decoded && decoded.length === 32) {
+                const raw = new Uint8Array(decoded.length);
+                for (let i = 0; i < decoded.length; i++) {
+                    raw[i] = decoded.charCodeAt(i);
+                }
+                return crypto.subtle.importKey("raw", raw, { name: "AES-GCM", length: 256 }, true, ["encrypt", "decrypt"]);
+            }
+        }
+        // Fall back to PBKDF2 derivation
+        return E2EEKeyManager.deriveKey(password, salt, iterations);
+    }
+    /**
+     * Store the document password in sessionStorage.
+     *
+     * @param {number} documentId - The document ID
+     * @param {string} password - The document password
+     */
+    static storePasswordInSession(documentId, password) {
+        sessionStorage.setItem(`e2ee_password_${documentId}`, password);
+    }
+    /**
+     * Retrieve the document password from sessionStorage.
+     *
+     * @param {number} documentId - The document ID
+     * @returns {string|null} The password, or null if not found
+     */
+    static getPasswordFromSession(documentId) {
+        return sessionStorage.getItem(`e2ee_password_${documentId}`);
+    }
+    /**
+     * Remove a cached password from sessionStorage.
+     *
+     * @param {number} documentId - The document ID
+     */
+    static clearPasswordFromSession(documentId) {
+        sessionStorage.removeItem(`e2ee_password_${documentId}`);
+    }
+}
+//# sourceMappingURL=key-manager.js.map

package/dist/e2ee/key-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-manager.js","sourceRoot":"","sources":["../../src/e2ee/key-manager.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,cAAc;IACvB;;;;;;;;;OASG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,GAAG,MAAM;QACtD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;QACjC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EACxB,QAAQ,EACR,KAAK,EACL,CAAC,WAAW,CAAC,CAChB,CAAA;QAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACrC;YACI,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,UAAU;YACtB,IAAI,EAAE,SAAS;SAClB,EACD,WAAW,EACX,EAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAC,EAC9B,IAAI,EAAE,oDAAoD;QAC1D,CAAC,SAAS,EAAE,SAAS,CAAC,CACzB,CAAA;QAED,OAAO,GAAG,CAAA;IACd,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,UAAU,EAAE,GAAG;QAC1C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAChE,cAAc,CAAC,OAAO,CAAC,YAAY,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;IAC5D,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,iBAAiB,CAAC,UAAU;QAC/B,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,YAAY,UAAU,EAAE,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,IAAI,CAAA;QACf,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACjC,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC1B,KAAK,EACL,GAAG,EACH,EAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAC,EAC9B,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACzB,CAAA;IACL,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,mBAAmB,CAAC,UAAU;QACjC,cAAc,CAAC,UAAU,CAAC,YAAY,UAAU,EAAE,CAAC,CAAA;IACvD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,uBAAuB;QAC1B,KAAK,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YACjC,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,YAAY;QACf,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IACrD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,GAAG,MAAM;QAC3D,qDAAqD;QACrD,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACnD,IAAI,OAAO,GAAG,IAAI,CAAA;YAClB,IAAI,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5B,CAAC;YAAC,OAAO,EAAE,EAAE,CAAC;gBACV,wCAAwC;gBACxC,IAAI,CAAC;oBACD,IAAI,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;oBAC3D,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,MAAM,IAAI,GAAG,CAAA;oBACjB,CAAC;oBACD,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;gBAC1B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACX,6BAA6B;gBACjC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;gBAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtC,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;gBAClC,CAAC;gBACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC1B,KAAK,EACL,GAAG,EACH,EAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAC,EAC9B,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACzB,CAAA;YACL,CAAC;QACL,CAAC;QACD,iCAAiC;QACjC,OAAO,cAAc,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IAC/D,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,sBAAsB,CAAC,UAAU,EAAE,QAAQ;QAC9C,cAAc,CAAC,OAAO,CAAC,iBAAiB,UAAU,EAAE,EAAE,QAAQ,CAAC,CAAA;IACnE,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,sBAAsB,CAAC,UAAU;QACpC,OAAO,cAAc,CAAC,OAAO,CAAC,iBAAiB,UAAU,EAAE,CAAC,CAAA;IAChE,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,wBAAwB,CAAC,UAAU;QACtC,cAAc,CAAC,UAAU,CAAC,iBAAiB,UAAU,EAAE,CAAC,CAAA;IAC5D,CAAC;CACJ"}