@icure/api 6.4.0 → 7.0.0-beta.1

package/icc-x-api/crypto/KeyManager.js

@@ -0,0 +1,288 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyManager = void 0;
+const utils_1 = require("../utils");
+const utils_2 = require("./utils");
+/**
+ * Allows to manage public and private keys for the current user and his parent hierarchy.
+ */
+class KeyManager {
+    constructor(primitives, dataOwnerApi, icureStorage, keyRecovery, baseExchangeKeyManager, strategies) {
+        this.keysCache = undefined;
+        this.primitives = primitives;
+        this.icureStorage = icureStorage;
+        this.dataOwnerApi = dataOwnerApi;
+        this.keyRecovery = keyRecovery;
+        this.baseExchangeKeyManager = baseExchangeKeyManager;
+        this.strategies = strategies;
+    }
+    /**
+     * Get the public keys of available key pairs for the current user in hex-encoded spki representation (uses cached keys: no request is done to the
+     * server).
+     * By setting {@link verifiedOnly} to true only the public keys for verified key pairs will be returned: these will include only key pairs created
+     * on this device or which have been verified using {@link CryptoStrategies} on this device.
+     * @param verifiedOnly if true only the verified public keys will be returned.
+     * @return the spki representation of public keys of available keypairs for the current user.
+     */
+    getCurrentUserAvailablePublicKeysHex(verifiedOnly) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.ensureInitialised();
+            let selectedData = Object.values(this.keysCache[this.selfId]);
+            if (verifiedOnly) {
+                selectedData = selectedData.filter((data) => data.isVerified || data.isDevice);
+            }
+            return yield Promise.all(selectedData.map((keyData) => __awaiter(this, void 0, void 0, function* () { return (0, utils_1.ua2hex)(yield this.primitives.RSA.exportKey(keyData.pair.publicKey, 'spki')); })));
+        });
+    }
+    /**
+     * Get the public keys of available key pairs for the current user and his parents in hex-encoded spki representation (uses cached keys: no request
+     * is done to the server).
+     * Note that this will also include unverified keys.
+     * @return the spki representation of public keys of available keypairs for the current user.
+     */
+    getCurrentUserHierarchyAvailablePublicKeysHex() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield Promise.all(Object.values(this.keysCache)
+                .flatMap((pairsForParent) => Object.values(pairsForParent))
+                .map((keyPairData) => __awaiter(this, void 0, void 0, function* () { return (0, utils_1.ua2hex)(yield this.primitives.RSA.exportKey(keyPairData.pair.publicKey, 'spki')); })));
+        });
+    }
+    /**
+     * Get a key pair with the provided fingerprint if present.
+     * @param fingerprint a key-pair/public-key fingerprint
+     * @return the pair associated to the fingerprint and a boolean indicating if the pair is verified, if present, else undefined
+     */
+    getKeyPairForFingerprint(fingerprint) {
+        const foundVerified = this.getSelfVerifiedKeys().find((x) => x.fingerprint === fingerprint);
+        if (foundVerified)
+            return { pair: foundVerified.pair, verified: true };
+        const foundOther = this.getDecryptionKeys()[fingerprint];
+        if (foundOther)
+            return { pair: foundOther, verified: false };
+        return undefined;
+    }
+    /**
+     * @internal This method is intended for internal use only and may be changed without notice.
+     * Initializes all keys for the current data owner. This method needs to be called before any other method of this class can be used.
+     * @throws if the current user is not a data owner, or if there is no key and no new key could be created according to this manager crypt
+     * strategies.
+     * @return if a new key was created during initialisation the newly created key, else undefined.
+     */
+    initialiseKeys() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const newKey = yield this.doLoadKeys((x) => this.strategies.recoverAndVerifySelfHierarchyKeys(x, this.primitives), (x) => this.strategies.generateNewKeyForDataOwner(x, this.primitives));
+            return newKey ? { newKeyPair: newKey.pair, newKeyFingerprint: newKey.fingerprint } : undefined;
+        });
+    }
+    /**
+     * @internal This method is intended for internal use only and may be changed without notice.
+     * Forces to reload keys for the current data owner. This could be useful if the data owner has logged in from another device in order to update the
+     * transfer keys.
+     * This method will complete only after keys have been reloaded successfully.
+     */
+    reloadKeys() {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.doLoadKeys((x) => Promise.resolve(x.reduce((acc, { dataOwner }) => (Object.assign(Object.assign({}, acc), { [dataOwner.id]: { recoveredKeys: {}, keyAuthenticity: {} } })), {})), (x) => {
+                throw new Error("Can't create new keys at reload time: it should have already been created on initialisation");
+            });
+        });
+    }
+    /**
+     * @internal This method is intended for internal use only and may be changed without notice.
+     * Get all verified key pairs for the current data owner which can safely be used for encryption. This includes all key pairs created on the current
+     * device and all recovered key pairs which have been verified.
+     * The keys returned by this method will be in the following order:
+     * 1. Legacy key pair if it is verified
+     * 2. All device key pais, in alphabetical order according to the fingerprint
+     * 3. Other verified key pairs, in alphabetical order according to the fingerprint
+     * @return all verified keys, in order.
+     */
+    getSelfVerifiedKeys() {
+        var _a;
+        this.ensureInitialised();
+        const selfKeys = this.keysCache[this.selfId];
+        const allKeysEntries = Object.entries(selfKeys);
+        const legacyKeyFp = (_a = this.selfLegacyPublicKey) === null || _a === void 0 ? void 0 : _a.slice(-32);
+        const legacyKeyData = legacyKeyFp ? selfKeys[legacyKeyFp] : undefined;
+        const legacyEntry = (legacyKeyData === null || legacyKeyData === void 0 ? void 0 : legacyKeyData.isVerified) && legacyKeyFp ? [{ fingerprint: legacyKeyFp, pair: legacyKeyData.pair }] : [];
+        function filteredEntries(filterFunction) {
+            return allKeysEntries
+                .filter(([fp, data]) => filterFunction(fp, data) && fp !== legacyKeyFp)
+                .sort(([a], [b]) => {
+                // need to make sure that the comparison is independent of the locale, but the actual ordering is not that important
+                return a == b ? 0 : a > b ? 1 : -1;
+            })
+                .map(([fingerprint, { pair }]) => ({ fingerprint, pair }));
+        }
+        return [...legacyEntry, ...filteredEntries((_, data) => data.isDevice), ...filteredEntries((_, data) => !data.isDevice && data.isVerified)];
+    }
+    /**
+     * Get all verified keys for a member of the current data owner hierarchy in no particular order.
+     * @param dataOwner the current data owner or a member of his hierarchy.
+     * @throws if the provided data owner is not part of the current data owner hierarchy
+     */
+    getVerifiedPublicKeysFor(dataOwner) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.ensureInitialised();
+            const availableKeys = this.keysCache[dataOwner.id];
+            if (!availableKeys)
+                throw new Error(`Data owner ${dataOwner.id} is not part of the hierarchy of the current data owner ${this.selfId}`);
+            const availableVerifiedKeysFp = new Set(Object.entries(availableKeys).flatMap(([fp, info]) => (info.isVerified || info.isDevice ? [fp] : [])));
+            const otherVerifiedFp = new Set(Object.entries(yield this.icureStorage.loadSelfVerifiedKeys(dataOwner.id)).flatMap(([fp, verified]) => (verified ? [fp] : [])));
+            return Array.from(this.dataOwnerApi.getHexPublicKeysOf(dataOwner)).filter((key) => {
+                const fp = key.slice(-32);
+                return availableVerifiedKeysFp.has(fp) || otherVerifiedFp.has(fp);
+            });
+        });
+    }
+    /**
+     * @internal This method is intended for internal use only and may be changed without notice.
+     * Get all key pairs for the current data owner and his parents. These keys should be used only for decryption as they may have not been verified.
+     * @return all key pairs available for decryption.
+     */
+    getDecryptionKeys() {
+        this.ensureInitialised();
+        return Object.values(this.keysCache).reduce((acc, curr) => {
+            return Object.assign(Object.assign({}, acc), this.plainKeysByFingerprint(curr));
+        }, {});
+    }
+    doLoadKeys(keyRecovererAndVerifier, currentOwnerKeyGenerator) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // Load all keys for self from key store
+            const hierarchy = yield this.dataOwnerApi.getCurrentDataOwnerHierarchy();
+            const self = hierarchy[hierarchy.length - 1];
+            this.selfId = self.dataOwner.id;
+            const keysData = [];
+            for (const dowt of hierarchy) {
+                const availableKeys = yield this.loadAndRecoverKeysFor(dowt);
+                const verifiedKeysMap = yield this.icureStorage.loadSelfVerifiedKeys(dowt.dataOwner.id);
+                const allPublicKeys = this.dataOwnerApi.getHexPublicKeysOf(dowt.dataOwner);
+                const fpToFullMap = (0, utils_2.fingerprintToPublicKeysMapOf)(dowt.dataOwner);
+                const unavailableKeys = Object.keys(availableKeys).flatMap((fp) => {
+                    const fullPublicKey = fpToFullMap[fp];
+                    return allPublicKeys.has(fullPublicKey) ? [] : [fullPublicKey];
+                });
+                const unknownKeys = Array.from(allPublicKeys).filter((x) => { var _a; return !(x.slice(-32) in verifiedKeysMap) && !(((_a = availableKeys === null || availableKeys === void 0 ? void 0 : availableKeys[x.slice(-32)]) === null || _a === void 0 ? void 0 : _a.isDevice) === true); });
+                keysData.push({ dowt, availableKeys, unavailableKeys, unknownKeys });
+            }
+            const recoveryAndVerificationResult = yield keyRecovererAndVerifier(keysData.map(({ dowt, unavailableKeys, unknownKeys }) => ({ dataOwner: dowt.dataOwner, unavailableKeys, unknownKeys })));
+            const keysCache = {};
+            for (const keyData of keysData) {
+                const currAuthenticity = this.ensureFingerprintKeys(recoveryAndVerificationResult[keyData.dowt.dataOwner.id].keyAuthenticity);
+                const currExternallyRecovered = this.ensureFingerprintKeys(recoveryAndVerificationResult[keyData.dowt.dataOwner.id].recoveredKeys);
+                for (const [fp, keyPair] of Object.entries(currExternallyRecovered)) {
+                    const jwkPair = yield this.primitives.RSA.exportKeys(keyPair, 'jwk', 'jwk');
+                    yield this.icureStorage.saveKey(keyData.dowt.dataOwner.id, fp, jwkPair, true);
+                }
+                const updatedVerifiedMap = yield this.icureStorage.saveSelfVerifiedKeys(keyData.dowt.dataOwner.id, [...Object.keys(currAuthenticity), ...Object.keys(currExternallyRecovered)].reduce((acc, currFp) => (Object.assign(Object.assign({}, acc), { [currFp]: currFp in currExternallyRecovered || currAuthenticity[currFp] })), {}));
+                const keysWithExternallyRecovered = Object.assign(Object.assign({}, keyData.availableKeys), Object.fromEntries(Object.entries(currExternallyRecovered).map(([k, v]) => [k, { pair: v, isDevice: false }])));
+                const additionallyRecovered = yield this.recoverAndCacheKeys(keyData.dowt, this.plainKeysByFingerprint(keysWithExternallyRecovered));
+                const keys = Object.assign(Object.assign({}, keysWithExternallyRecovered), Object.fromEntries(Object.entries(additionallyRecovered).map(([k, v]) => [k, { pair: v, isDevice: false }])));
+                keysCache[keyData.dowt.dataOwner.id] = this.verifyKeys(keys, updatedVerifiedMap);
+            }
+            if (Object.entries(keysCache).some(([ownerId, data]) => ownerId !== self.dataOwner.id && !this.hasVerifiedKey(data))) {
+                throw new Error('Some parent hcps have no verified keys: impossible to generate locally a new key for a parent.');
+            }
+            else if (this.hasVerifiedKey(keysCache[self.dataOwner.id])) {
+                this.keysCache = keysCache;
+                this.selfLegacyPublicKey = self.dataOwner.publicKey;
+                return undefined;
+            }
+            else {
+                const whatToDo = yield currentOwnerKeyGenerator(self.dataOwner);
+                if (whatToDo === false) {
+                    throw new Error(`No verified key found for ${self.dataOwner.id} and settings do not allow creation of a new key.`);
+                }
+                else {
+                    const updateInfo = yield this.createAndSaveNewKeyPair(whatToDo === true ? undefined : whatToDo, self);
+                    // self may be outdated now
+                    this.selfLegacyPublicKey = updateInfo.updatedSelf.dataOwner.publicKey;
+                    this.keysCache = Object.assign(Object.assign({}, keysCache), { [self.dataOwner.id]: Object.assign(Object.assign({}, keysCache[self.dataOwner.id]), { [updateInfo.publicKeyFingerprint]: { pair: updateInfo.keyPair, isDevice: true, isVerified: true } }) });
+                    return { pair: updateInfo.keyPair, fingerprint: updateInfo.publicKeyFingerprint };
+                }
+            }
+        });
+    }
+    createAndSaveNewKeyPair(importedKeyPair, selfDataOwner) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const keyPair = importedKeyPair !== null && importedKeyPair !== void 0 ? importedKeyPair : (yield this.primitives.RSA.generateKeyPair());
+            const publicKeyHex = (0, utils_1.ua2hex)(yield this.primitives.RSA.exportKey(keyPair.publicKey, 'spki'));
+            const publicKeyFingerprint = publicKeyHex.slice(-32);
+            yield this.icureStorage.saveKey(selfDataOwner.dataOwner.id, publicKeyFingerprint, yield this.primitives.RSA.exportKeys(keyPair, 'jwk', 'jwk'), true);
+            const verifiedPublicKeysMap = yield this.icureStorage.saveSelfVerifiedKeys(selfDataOwner.dataOwner.id, { [publicKeyFingerprint]: true });
+            const { updatedDelegator } = yield this.baseExchangeKeyManager.createOrUpdateEncryptedExchangeKeyTo(selfDataOwner.dataOwner.id, keyPair, yield (0, utils_2.loadPublicKeys)(this.primitives.RSA, Array.from(this.dataOwnerApi.getHexPublicKeysOf(selfDataOwner.dataOwner)).filter((x) => verifiedPublicKeysMap[x.slice(-32)])));
+            return { publicKeyFingerprint, keyPair: keyPair, updatedSelf: updatedDelegator };
+        });
+    }
+    loadStoredKeys(dataOwner, pubKeysFingerprints) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield pubKeysFingerprints.reduce((acc, currentFingerprint) => __awaiter(this, void 0, void 0, function* () {
+                const awaitedAcc = yield acc;
+                let loadedPair = undefined;
+                try {
+                    const storedKeypair = yield this.icureStorage.loadKey(dataOwner.dataOwner.id, currentFingerprint, dataOwner.dataOwner.publicKey);
+                    if (storedKeypair) {
+                        const importedKey = yield this.primitives.RSA.importKeyPair('jwk', storedKeypair.pair.privateKey, 'jwk', storedKeypair.pair.publicKey);
+                        loadedPair = { pair: importedKey, isDevice: storedKeypair.isDevice };
+                    }
+                }
+                catch (e) {
+                    console.warn('Error while loading keypair', currentFingerprint, e);
+                }
+                return loadedPair
+                    ? Object.assign(Object.assign({}, awaitedAcc), { [currentFingerprint]: loadedPair }) : awaitedAcc;
+            }), Promise.resolve({}));
+        });
+    }
+    verifyKeys(keys, verifiedKeysMap) {
+        return Object.fromEntries(Object.entries(keys).map(([fp, keyData]) => [fp, Object.assign(Object.assign({}, keyData), { isVerified: keyData.isDevice || (verifiedKeysMap === null || verifiedKeysMap === void 0 ? void 0 : verifiedKeysMap[fp]) === true })]));
+    }
+    plainKeysByFingerprint(richKeys) {
+        return Object.fromEntries(Object.entries(richKeys).map(([fp, keyData]) => [fp, keyData.pair]));
+    }
+    ensureInitialised() {
+        if (!this.keysCache)
+            throw new Error('Key manager was not properly initialised');
+    }
+    recoverAndCacheKeys(dataOwner, availableKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const recoveredKeys = yield this.keyRecovery.recoverKeys(dataOwner, availableKeys);
+            for (const [fp, pair] of Object.entries(recoveredKeys)) {
+                yield this.icureStorage.saveKey(dataOwner.dataOwner.id, fp, yield this.primitives.RSA.exportKeys(pair, 'jwk', 'jwk'), false);
+            }
+            return recoveredKeys;
+        });
+    }
+    loadAndRecoverKeysFor(dataOwner) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const selfPublicKeys = this.dataOwnerApi.getHexPublicKeysOf(dataOwner.dataOwner);
+            const pubKeysFingerprints = Array.from(selfPublicKeys).map((x) => x.slice(-32));
+            const loadedKeys = pubKeysFingerprints.length > 0 ? yield this.loadStoredKeys(dataOwner, pubKeysFingerprints) : {};
+            const loadedKeysFingerprints = Object.keys(loadedKeys);
+            if (loadedKeysFingerprints.length !== pubKeysFingerprints.length && loadedKeysFingerprints.length > 0) {
+                const recoveredKeys = yield this.recoverAndCacheKeys(dataOwner, this.plainKeysByFingerprint(loadedKeys));
+                for (const [fp, pair] of Object.entries(recoveredKeys)) {
+                    loadedKeys[fp] = { pair, isDevice: false };
+                }
+            }
+            return loadedKeys;
+        });
+    }
+    ensureFingerprintKeys(obj) {
+        return Object.fromEntries(Object.entries(obj).map(([k, v]) => [k.slice(-32), v]));
+    }
+    hasVerifiedKey(keysData) {
+        return Object.values(keysData).some((x) => x.isVerified || x.isDevice);
+    }
+}
+exports.KeyManager = KeyManager;
+//# sourceMappingURL=KeyManager.js.map

package/icc-x-api/crypto/KeyManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/KeyManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,oCAAiC;AAGjC,mCAAsE;AAoBtE;;GAEG;AACH,MAAa,UAAU;IAYrB,YACE,UAA4B,EAC5B,YAA8B,EAC9B,YAAgC,EAChC,WAAwB,EACxB,sBAA+C,EAC/C,UAA4B;QARtB,cAAS,GAA2F,SAAS,CAAA;QAUnH,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;QAChC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;QAChC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;QAC9B,IAAI,CAAC,sBAAsB,GAAG,sBAAsB,CAAA;QACpD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;IAED;;;;;;;OAOG;IACG,oCAAoC,CAAC,YAAqB;;YAC9D,IAAI,CAAC,iBAAiB,EAAE,CAAA;YACxB,IAAI,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,IAAI,CAAC,MAAO,CAAC,CAAC,CAAA;YAC/D,IAAI,YAAY,EAAE;gBAChB,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAA;aAC/E;YACD,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAO,OAAO,EAAE,EAAE,gDAAC,OAAA,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA,GAAA,CAAC,CAAC,CAAA;QAC5I,CAAC;KAAA;IAED;;;;;OAKG;IACG,6CAA6C;;YACjD,OAAO,MAAM,OAAO,CAAC,GAAG,CACtB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC;iBAC3B,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;iBAC1D,GAAG,CAAC,CAAO,WAAW,EAAE,EAAE,gDAAC,OAAA,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA,GAAA,CAAC,CAC/G,CAAA;QACH,CAAC;KAAA;IAED;;;;OAIG;IACH,wBAAwB,CAAC,WAAmB;QAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAA;QAC3F,IAAI,aAAa;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QACtE,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC,WAAW,CAAC,CAAA;QACxD,IAAI,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;QAC5D,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;;;;OAMG;IACG,cAAc;;YAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,iCAAiC,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,EAC5E,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CACtE,CAAA;YACD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QAChG,CAAC;KAAA;IAED;;;;;OAKG;IACG,UAAU;;YACd,MAAM,IAAI,CAAC,UAAU,CACnB,CAAC,CAAC,EAAE,EAAE,CACJ,OAAO,CAAC,OAAO,CACb,CAAC,CAAC,MAAM,CACN,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,iCAAM,GAAG,KAAE,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,IAAG,EAChG,EAKC,CACF,CACF,EACH,CAAC,CAAC,EAAE,EAAE;gBACJ,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAA;YAChH,CAAC,CACF,CAAA;QACH,CAAC;KAAA;IAED;;;;;;;;;OASG;IACH,mBAAmB;;QACjB,IAAI,CAAC,iBAAiB,EAAE,CAAA;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAU,CAAC,IAAI,CAAC,MAAO,CAAC,CAAA;QAC9C,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAE/C,MAAM,WAAW,GAAG,MAAA,IAAI,CAAC,mBAAmB,0CAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;QACxD,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACrE,MAAM,WAAW,GAAG,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,UAAU,KAAI,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAE5H,SAAS,eAAe,CAAC,cAA0D;YACjF,OAAO,cAAc;iBAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,WAAW,CAAC;iBACtE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBACjB,oHAAoH;gBACpH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACpC,CAAC,CAAC;iBACD,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;IAC7I,CAAC;IAED;;;;OAIG;IACG,wBAAwB,CAAC,SAAoB;;YACjD,IAAI,CAAC,iBAAiB,EAAE,CAAA;YACxB,MAAM,aAAa,GAAG,IAAI,CAAC,SAAU,CAAC,SAAS,CAAC,EAAG,CAAC,CAAA;YACpD,IAAI,CAAC,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,SAAS,CAAC,EAAE,2DAA2D,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;YACvI,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAC9I,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAC/H,CAAA;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;gBAChF,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;gBACzB,OAAO,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACnE,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAED;;;;OAIG;IACH,iBAAiB;QACf,IAAI,CAAC,iBAAiB,EAAE,CAAA;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YACzD,uCACK,GAAG,GACH,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EACrC;QACH,CAAC,EAAE,EAA0C,CAAC,CAAA;IAChD,CAAC;IAEa,UAAU,CACtB,uBAAgD,EAChD,wBAAkD;;YAElD,wCAAwC;YACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,4BAA4B,EAAE,CAAA;YACxE,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YAC5C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,EAAG,CAAA;YAChC,MAAM,QAAQ,GAAG,EAAE,CAAA;YACnB,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE;gBAC5B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAA;gBAC5D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,CAAC,CAAA;gBACxF,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAC1E,MAAM,WAAW,GAAG,IAAA,oCAA4B,EAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAChE,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;oBAChE,MAAM,aAAa,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;oBACrC,OAAO,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;gBAChE,CAAC,CAAC,CAAA;gBACF,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA,MAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,0CAAE,QAAQ,MAAK,IAAI,CAAC,CAAA,EAAA,CACjG,CAAA;gBACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAA;aACrE;YACD,MAAM,6BAA6B,GAAG,MAAM,uBAAuB,CACjE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC,CACxH,CAAA;YACD,MAAM,SAAS,GAA6D,EAAE,CAAA;YAC9E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE;gBAC9B,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,6BAA6B,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,eAAe,CAAC,CAAA;gBAC7H,MAAM,uBAAuB,GAAG,IAAI,CAAC,qBAAqB,CAAC,6BAA6B,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,CAAA;gBAClI,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE;oBACnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;oBAC3E,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;iBAC/E;gBACD,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CACrE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,EAC1B,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAChF,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,iCACZ,GAAG,KACN,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,uBAAuB,IAAI,gBAAgB,CAAC,MAAM,CAAC,IACvE,EACF,EAAE,CACH,CACF,CAAA;gBACD,MAAM,2BAA2B,mCAC5B,OAAO,CAAC,aAAa,GACrB,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAClH,CAAA;gBACD,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,CAAC,CAAA;gBACpI,MAAM,IAAI,mCACL,2BAA2B,GAC3B,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAChH,CAAA;gBACD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;aAClF;YACD,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE;gBACpH,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAA;aAClH;iBAAM,IAAI,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE;gBAC5D,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;gBAC1B,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAA;gBACnD,OAAO,SAAS,CAAA;aACjB;iBAAM;gBACL,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAC/D,IAAI,QAAQ,KAAK,KAAK,EAAE;oBACtB,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,EAAE,mDAAmD,CAAC,CAAA;iBACnH;qBAAM;oBACL,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;oBACrG,2BAA2B;oBAC3B,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAA;oBACrE,IAAI,CAAC,SAAS,mCACT,SAAS,KACZ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,CAAC,kCACf,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAC/B,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAEpG,CAAA;oBACD,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,oBAAoB,EAAE,CAAA;iBAClF;aACF;QACH,CAAC;KAAA;IAEa,uBAAuB,CACnC,eAA+C,EAC/C,aAAgC;;YAEhC,MAAM,OAAO,GAAG,eAAe,aAAf,eAAe,cAAf,eAAe,GAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAA;YAChF,MAAM,YAAY,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;YAC3F,MAAM,oBAAoB,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAC7B,aAAa,CAAC,SAAS,CAAC,EAAG,EAC3B,oBAAoB,EACpB,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EAC3D,IAAI,CACL,CAAA;YACD,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,aAAa,CAAC,SAAS,CAAC,EAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;YACzI,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,oCAAoC,CACjG,aAAa,CAAC,SAAS,CAAC,EAAG,EAC3B,OAAO,EACP,MAAM,IAAA,sBAAc,EAClB,IAAI,CAAC,UAAU,CAAC,GAAG,EACnB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAC7H,CACF,CAAA;YACD,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAA;QAClF,CAAC;KAAA;IAEa,cAAc,CAC1B,SAA4B,EAC5B,mBAA6B;;YAE7B,OAAO,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAO,GAAG,EAAE,kBAAkB,EAAE,EAAE;gBACxE,MAAM,UAAU,GAAG,MAAM,GAAG,CAAA;gBAC5B,IAAI,UAAU,GAAgE,SAAS,CAAA;gBACvF,IAAI;oBACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAG,EAAE,kBAAkB,EAAE,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;oBACjI,IAAI,aAAa,EAAE;wBACjB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;wBACtI,UAAU,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAA;qBACrE;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,OAAO,CAAC,IAAI,CAAC,6BAA6B,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAA;iBACnE;gBACD,OAAO,UAAU;oBACf,CAAC,iCACM,UAAU,KACb,CAAC,kBAAkB,CAAC,EAAE,UAAU,IAEpC,CAAC,CAAC,UAAU,CAAA;YAChB,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,CAAC,EAAsF,CAAC,CAAC,CAAA;QAC7G,CAAC;KAAA;IAEO,UAAU,CAChB,IAAsF,EACtF,eAAyD;QAEzD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CACtB,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,kCAAO,OAAO,KAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAG,EAAE,CAAC,MAAK,IAAI,IAA4B,CACjI,CACF,CAAA;IACH,CAAC;IAEO,sBAAsB,CAAC,QAAuE;QAGpG,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChG,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAClF,CAAC;IAEa,mBAAmB,CAC/B,SAA4B,EAC5B,aAAkE;;YAElE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;YAClF,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE;gBACtD,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAG,EAAE,EAAE,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;aAC9H;YACD,OAAO,aAAa,CAAA;QACtB,CAAC;KAAA;IAEa,qBAAqB,CAAC,SAA4B;;YAC9D,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAChF,MAAM,mBAAmB,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YAC/E,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAClH,MAAM,sBAAsB,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACtD,IAAI,sBAAsB,CAAC,MAAM,KAAK,mBAAmB,CAAC,MAAM,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE;gBACrG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAA;gBACxG,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE;oBACtD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;iBAC3C;aACF;YACD,OAAO,UAAU,CAAA;QACnB,CAAC;KAAA;IAEO,qBAAqB,CAAI,GAAyC;QACxE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACnF,CAAC;IAEO,cAAc,CAAC,QAAuC;QAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAA;IACxE,CAAC;CACF;AA1WD,gCA0WC","sourcesContent":["import { DataOwner, DataOwnerWithType, IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { KeyPair } from './RSA'\nimport { ua2hex } from '../utils'\nimport { IcureStorageFacade } from '../storage/IcureStorageFacade'\nimport { BaseExchangeKeysManager } from './BaseExchangeKeysManager'\nimport { fingerprintToPublicKeysMapOf, loadPublicKeys } from './utils'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { KeyRecovery } from './KeyRecovery'\nimport { CryptoStrategies } from './CryptoStrategies'\n\ntype KeyPairData = { pair: KeyPair<CryptoKey>; isVerified: boolean; isDevice: boolean }\ntype KeyRecovererAndVerifier = (\n  keysData: {\n    dataOwner: DataOwner\n    unknownKeys: string[]\n    unavailableKeys: string[]\n  }[]\n) => Promise<{\n  [dataOwnerId: string]: {\n    recoveredKeys: { [keyPairFingerprint: string]: KeyPair<CryptoKey> }\n    keyAuthenticity: { [keyPairFingerprint: string]: boolean }\n  }\n}>\ntype CurrentOwnerKeyGenerator = (self: DataOwner) => Promise<KeyPair<CryptoKey> | boolean>\n\n/**\n * Allows to manage public and private keys for the current user and his parent hierarchy.\n */\nexport class KeyManager {\n  private readonly primitives: CryptoPrimitives\n  private readonly dataOwnerApi: IccDataOwnerXApi\n  private readonly keyRecovery: KeyRecovery\n  private readonly icureStorage: IcureStorageFacade\n  private readonly baseExchangeKeyManager: BaseExchangeKeysManager\n  private readonly strategies: CryptoStrategies\n\n  private selfId: string | undefined\n  private selfLegacyPublicKey: string | undefined\n  private keysCache: { [selfOrParentId: string]: { [pubKeyFingerprint: string]: KeyPairData } } | undefined = undefined\n\n  constructor(\n    primitives: CryptoPrimitives,\n    dataOwnerApi: IccDataOwnerXApi,\n    icureStorage: IcureStorageFacade,\n    keyRecovery: KeyRecovery,\n    baseExchangeKeyManager: BaseExchangeKeysManager,\n    strategies: CryptoStrategies\n  ) {\n    this.primitives = primitives\n    this.icureStorage = icureStorage\n    this.dataOwnerApi = dataOwnerApi\n    this.keyRecovery = keyRecovery\n    this.baseExchangeKeyManager = baseExchangeKeyManager\n    this.strategies = strategies\n  }\n\n  /**\n   * Get the public keys of available key pairs for the current user in hex-encoded spki representation (uses cached keys: no request is done to the\n   * server).\n   * By setting {@link verifiedOnly} to true only the public keys for verified key pairs will be returned: these will include only key pairs created\n   * on this device or which have been verified using {@link CryptoStrategies} on this device.\n   * @param verifiedOnly if true only the verified public keys will be returned.\n   * @return the spki representation of public keys of available keypairs for the current user.\n   */\n  async getCurrentUserAvailablePublicKeysHex(verifiedOnly: boolean): Promise<string[]> {\n    this.ensureInitialised()\n    let selectedData = Object.values(this.keysCache![this.selfId!])\n    if (verifiedOnly) {\n      selectedData = selectedData.filter((data) => data.isVerified || data.isDevice)\n    }\n    return await Promise.all(selectedData.map(async (keyData) => ua2hex(await this.primitives.RSA.exportKey(keyData.pair.publicKey, 'spki'))))\n  }\n\n  /**\n   * Get the public keys of available key pairs for the current user and his parents in hex-encoded spki representation (uses cached keys: no request\n   * is done to the server).\n   * Note that this will also include unverified keys.\n   * @return the spki representation of public keys of available keypairs for the current user.\n   */\n  async getCurrentUserHierarchyAvailablePublicKeysHex(): Promise<string[]> {\n    return await Promise.all(\n      Object.values(this.keysCache!)\n        .flatMap((pairsForParent) => Object.values(pairsForParent))\n        .map(async (keyPairData) => ua2hex(await this.primitives.RSA.exportKey(keyPairData.pair.publicKey, 'spki')))\n    )\n  }\n\n  /**\n   * Get a key pair with the provided fingerprint if present.\n   * @param fingerprint a key-pair/public-key fingerprint\n   * @return the pair associated to the fingerprint and a boolean indicating if the pair is verified, if present, else undefined\n   */\n  getKeyPairForFingerprint(fingerprint: string): { pair: KeyPair<CryptoKey>; verified: boolean } | undefined {\n    const foundVerified = this.getSelfVerifiedKeys().find((x) => x.fingerprint === fingerprint)\n    if (foundVerified) return { pair: foundVerified.pair, verified: true }\n    const foundOther = this.getDecryptionKeys()[fingerprint]\n    if (foundOther) return { pair: foundOther, verified: false }\n    return undefined\n  }\n\n  /**\n   * @internal This method is intended for internal use only and may be changed without notice.\n   * Initializes all keys for the current data owner. This method needs to be called before any other method of this class can be used.\n   * @throws if the current user is not a data owner, or if there is no key and no new key could be created according to this manager crypt\n   * strategies.\n   * @return if a new key was created during initialisation the newly created key, else undefined.\n   */\n  async initialiseKeys(): Promise<{ newKeyPair: KeyPair<CryptoKey>; newKeyFingerprint: string } | undefined> {\n    const newKey = await this.doLoadKeys(\n      (x) => this.strategies.recoverAndVerifySelfHierarchyKeys(x, this.primitives),\n      (x) => this.strategies.generateNewKeyForDataOwner(x, this.primitives)\n    )\n    return newKey ? { newKeyPair: newKey.pair, newKeyFingerprint: newKey.fingerprint } : undefined\n  }\n\n  /**\n   * @internal This method is intended for internal use only and may be changed without notice.\n   * Forces to reload keys for the current data owner. This could be useful if the data owner has logged in from another device in order to update the\n   * transfer keys.\n   * This method will complete only after keys have been reloaded successfully.\n   */\n  async reloadKeys(): Promise<void> {\n    await this.doLoadKeys(\n      (x) =>\n        Promise.resolve(\n          x.reduce(\n            (acc, { dataOwner }) => ({ ...acc, [dataOwner.id]: { recoveredKeys: {}, keyAuthenticity: {} } }),\n            {} as {\n              [dataOwnerId: string]: {\n                recoveredKeys: { [keyPairFingerprint: string]: KeyPair<CryptoKey> }\n                keyAuthenticity: { [keyPairFingerprint: string]: boolean }\n              }\n            }\n          )\n        ),\n      (x) => {\n        throw new Error(\"Can't create new keys at reload time: it should have already been created on initialisation\")\n      }\n    )\n  }\n\n  /**\n   * @internal This method is intended for internal use only and may be changed without notice.\n   * Get all verified key pairs for the current data owner which can safely be used for encryption. This includes all key pairs created on the current\n   * device and all recovered key pairs which have been verified.\n   * The keys returned by this method will be in the following order:\n   * 1. Legacy key pair if it is verified\n   * 2. All device key pais, in alphabetical order according to the fingerprint\n   * 3. Other verified key pairs, in alphabetical order according to the fingerprint\n   * @return all verified keys, in order.\n   */\n  getSelfVerifiedKeys(): { fingerprint: string; pair: KeyPair<CryptoKey> }[] {\n    this.ensureInitialised()\n    const selfKeys = this.keysCache![this.selfId!]\n    const allKeysEntries = Object.entries(selfKeys)\n\n    const legacyKeyFp = this.selfLegacyPublicKey?.slice(-32)\n    const legacyKeyData = legacyKeyFp ? selfKeys[legacyKeyFp] : undefined\n    const legacyEntry = legacyKeyData?.isVerified && legacyKeyFp ? [{ fingerprint: legacyKeyFp, pair: legacyKeyData.pair }] : []\n\n    function filteredEntries(filterFunction: (fp: string, data: KeyPairData) => boolean) {\n      return allKeysEntries\n        .filter(([fp, data]) => filterFunction(fp, data) && fp !== legacyKeyFp)\n        .sort(([a], [b]) => {\n          // need to make sure that the comparison is independent of the locale, but the actual ordering is not that important\n          return a == b ? 0 : a > b ? 1 : -1\n        })\n        .map(([fingerprint, { pair }]) => ({ fingerprint, pair }))\n    }\n    return [...legacyEntry, ...filteredEntries((_, data) => data.isDevice), ...filteredEntries((_, data) => !data.isDevice && data.isVerified)]\n  }\n\n  /**\n   * Get all verified keys for a member of the current data owner hierarchy in no particular order.\n   * @param dataOwner the current data owner or a member of his hierarchy.\n   * @throws if the provided data owner is not part of the current data owner hierarchy\n   */\n  async getVerifiedPublicKeysFor(dataOwner: DataOwner): Promise<string[]> {\n    this.ensureInitialised()\n    const availableKeys = this.keysCache![dataOwner.id!]\n    if (!availableKeys) throw new Error(`Data owner ${dataOwner.id} is not part of the hierarchy of the current data owner ${this.selfId}`)\n    const availableVerifiedKeysFp = new Set(Object.entries(availableKeys).flatMap(([fp, info]) => (info.isVerified || info.isDevice ? [fp] : [])))\n    const otherVerifiedFp = new Set(\n      Object.entries(await this.icureStorage.loadSelfVerifiedKeys(dataOwner.id)).flatMap(([fp, verified]) => (verified ? [fp] : []))\n    )\n    return Array.from(this.dataOwnerApi.getHexPublicKeysOf(dataOwner)).filter((key) => {\n      const fp = key.slice(-32)\n      return availableVerifiedKeysFp.has(fp) || otherVerifiedFp.has(fp)\n    })\n  }\n\n  /**\n   * @internal This method is intended for internal use only and may be changed without notice.\n   * Get all key pairs for the current data owner and his parents. These keys should be used only for decryption as they may have not been verified.\n   * @return all key pairs available for decryption.\n   */\n  getDecryptionKeys(): { [fingerprint: string]: KeyPair<CryptoKey> } {\n    this.ensureInitialised()\n    return Object.values(this.keysCache!).reduce((acc, curr) => {\n      return {\n        ...acc,\n        ...this.plainKeysByFingerprint(curr),\n      }\n    }, {} as { [fp: string]: KeyPair<CryptoKey> })\n  }\n\n  private async doLoadKeys(\n    keyRecovererAndVerifier: KeyRecovererAndVerifier,\n    currentOwnerKeyGenerator: CurrentOwnerKeyGenerator\n  ): Promise<{ pair: KeyPair<CryptoKey>; fingerprint: string } | undefined> {\n    // Load all keys for self from key store\n    const hierarchy = await this.dataOwnerApi.getCurrentDataOwnerHierarchy()\n    const self = hierarchy[hierarchy.length - 1]\n    this.selfId = self.dataOwner.id!\n    const keysData = []\n    for (const dowt of hierarchy) {\n      const availableKeys = await this.loadAndRecoverKeysFor(dowt)\n      const verifiedKeysMap = await this.icureStorage.loadSelfVerifiedKeys(dowt.dataOwner.id!)\n      const allPublicKeys = this.dataOwnerApi.getHexPublicKeysOf(dowt.dataOwner)\n      const fpToFullMap = fingerprintToPublicKeysMapOf(dowt.dataOwner)\n      const unavailableKeys = Object.keys(availableKeys).flatMap((fp) => {\n        const fullPublicKey = fpToFullMap[fp]\n        return allPublicKeys.has(fullPublicKey) ? [] : [fullPublicKey]\n      })\n      const unknownKeys = Array.from(allPublicKeys).filter(\n        (x) => !(x.slice(-32) in verifiedKeysMap) && !(availableKeys?.[x.slice(-32)]?.isDevice === true)\n      )\n      keysData.push({ dowt, availableKeys, unavailableKeys, unknownKeys })\n    }\n    const recoveryAndVerificationResult = await keyRecovererAndVerifier(\n      keysData.map(({ dowt, unavailableKeys, unknownKeys }) => ({ dataOwner: dowt.dataOwner, unavailableKeys, unknownKeys }))\n    )\n    const keysCache: { [dataOwnerId: string]: { [fp: string]: KeyPairData } } = {}\n    for (const keyData of keysData) {\n      const currAuthenticity = this.ensureFingerprintKeys(recoveryAndVerificationResult[keyData.dowt.dataOwner.id].keyAuthenticity)\n      const currExternallyRecovered = this.ensureFingerprintKeys(recoveryAndVerificationResult[keyData.dowt.dataOwner.id].recoveredKeys)\n      for (const [fp, keyPair] of Object.entries(currExternallyRecovered)) {\n        const jwkPair = await this.primitives.RSA.exportKeys(keyPair, 'jwk', 'jwk')\n        await this.icureStorage.saveKey(keyData.dowt.dataOwner.id!, fp, jwkPair, true)\n      }\n      const updatedVerifiedMap = await this.icureStorage.saveSelfVerifiedKeys(\n        keyData.dowt.dataOwner.id!,\n        [...Object.keys(currAuthenticity), ...Object.keys(currExternallyRecovered)].reduce(\n          (acc, currFp) => ({\n            ...acc,\n            [currFp]: currFp in currExternallyRecovered || currAuthenticity[currFp],\n          }),\n          {}\n        )\n      )\n      const keysWithExternallyRecovered = {\n        ...keyData.availableKeys,\n        ...Object.fromEntries(Object.entries(currExternallyRecovered).map(([k, v]) => [k, { pair: v, isDevice: false }])),\n      }\n      const additionallyRecovered = await this.recoverAndCacheKeys(keyData.dowt, this.plainKeysByFingerprint(keysWithExternallyRecovered))\n      const keys = {\n        ...keysWithExternallyRecovered,\n        ...Object.fromEntries(Object.entries(additionallyRecovered).map(([k, v]) => [k, { pair: v, isDevice: false }])),\n      }\n      keysCache[keyData.dowt.dataOwner.id!] = this.verifyKeys(keys, updatedVerifiedMap)\n    }\n    if (Object.entries(keysCache).some(([ownerId, data]) => ownerId !== self.dataOwner.id && !this.hasVerifiedKey(data))) {\n      throw new Error('Some parent hcps have no verified keys: impossible to generate locally a new key for a parent.')\n    } else if (this.hasVerifiedKey(keysCache[self.dataOwner.id])) {\n      this.keysCache = keysCache\n      this.selfLegacyPublicKey = self.dataOwner.publicKey\n      return undefined\n    } else {\n      const whatToDo = await currentOwnerKeyGenerator(self.dataOwner)\n      if (whatToDo === false) {\n        throw new Error(`No verified key found for ${self.dataOwner.id} and settings do not allow creation of a new key.`)\n      } else {\n        const updateInfo = await this.createAndSaveNewKeyPair(whatToDo === true ? undefined : whatToDo, self)\n        // self may be outdated now\n        this.selfLegacyPublicKey = updateInfo.updatedSelf.dataOwner.publicKey\n        this.keysCache = {\n          ...keysCache,\n          [self.dataOwner.id!]: {\n            ...keysCache[self.dataOwner.id],\n            [updateInfo.publicKeyFingerprint]: { pair: updateInfo.keyPair, isDevice: true, isVerified: true },\n          },\n        }\n        return { pair: updateInfo.keyPair, fingerprint: updateInfo.publicKeyFingerprint }\n      }\n    }\n  }\n\n  private async createAndSaveNewKeyPair(\n    importedKeyPair: undefined | KeyPair<CryptoKey>,\n    selfDataOwner: DataOwnerWithType\n  ): Promise<{ publicKeyFingerprint: string; keyPair: KeyPair<CryptoKey>; updatedSelf: DataOwnerWithType }> {\n    const keyPair = importedKeyPair ?? (await this.primitives.RSA.generateKeyPair())\n    const publicKeyHex = ua2hex(await this.primitives.RSA.exportKey(keyPair.publicKey, 'spki'))\n    const publicKeyFingerprint = publicKeyHex.slice(-32)\n    await this.icureStorage.saveKey(\n      selfDataOwner.dataOwner.id!,\n      publicKeyFingerprint,\n      await this.primitives.RSA.exportKeys(keyPair, 'jwk', 'jwk'),\n      true\n    )\n    const verifiedPublicKeysMap = await this.icureStorage.saveSelfVerifiedKeys(selfDataOwner.dataOwner.id!, { [publicKeyFingerprint]: true })\n    const { updatedDelegator } = await this.baseExchangeKeyManager.createOrUpdateEncryptedExchangeKeyTo(\n      selfDataOwner.dataOwner.id!,\n      keyPair,\n      await loadPublicKeys(\n        this.primitives.RSA,\n        Array.from(this.dataOwnerApi.getHexPublicKeysOf(selfDataOwner.dataOwner)).filter((x) => verifiedPublicKeysMap[x.slice(-32)])\n      )\n    )\n    return { publicKeyFingerprint, keyPair: keyPair, updatedSelf: updatedDelegator }\n  }\n\n  private async loadStoredKeys(\n    dataOwner: DataOwnerWithType,\n    pubKeysFingerprints: string[]\n  ): Promise<{ [pubKeyFingerprint: string]: { pair: KeyPair<CryptoKey>; isDevice: boolean } }> {\n    return await pubKeysFingerprints.reduce(async (acc, currentFingerprint) => {\n      const awaitedAcc = await acc\n      let loadedPair: { pair: KeyPair<CryptoKey>; isDevice: boolean } | undefined = undefined\n      try {\n        const storedKeypair = await this.icureStorage.loadKey(dataOwner.dataOwner.id!, currentFingerprint, dataOwner.dataOwner.publicKey)\n        if (storedKeypair) {\n          const importedKey = await this.primitives.RSA.importKeyPair('jwk', storedKeypair.pair.privateKey, 'jwk', storedKeypair.pair.publicKey)\n          loadedPair = { pair: importedKey, isDevice: storedKeypair.isDevice }\n        }\n      } catch (e) {\n        console.warn('Error while loading keypair', currentFingerprint, e)\n      }\n      return loadedPair\n        ? {\n            ...awaitedAcc,\n            [currentFingerprint]: loadedPair,\n          }\n        : awaitedAcc\n    }, Promise.resolve({} as { [pubKeyFingerprint: string]: { pair: KeyPair<CryptoKey>; isDevice: boolean } }))\n  }\n\n  private verifyKeys(\n    keys: { [pubKeyFingerprint: string]: { pair: KeyPair<CryptoKey>; isDevice: boolean } },\n    verifiedKeysMap: { [pubKeyFingerprint: string]: boolean }\n  ): { [pubKeyFingerprint: string]: KeyPairData } {\n    return Object.fromEntries(\n      Object.entries(keys).map(\n        ([fp, keyData]) => [fp, { ...keyData, isVerified: keyData.isDevice || verifiedKeysMap?.[fp] === true }] as [string, KeyPairData]\n      )\n    )\n  }\n\n  private plainKeysByFingerprint(richKeys: { [pubKeyFingerprint: string]: { pair: KeyPair<CryptoKey> } }): {\n    [pubKeyFingerprint: string]: KeyPair<CryptoKey>\n  } {\n    return Object.fromEntries(Object.entries(richKeys).map(([fp, keyData]) => [fp, keyData.pair]))\n  }\n\n  private ensureInitialised() {\n    if (!this.keysCache) throw new Error('Key manager was not properly initialised')\n  }\n\n  private async recoverAndCacheKeys(\n    dataOwner: DataOwnerWithType,\n    availableKeys: { [pubKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{ [p: string]: KeyPair<CryptoKey> }> {\n    const recoveredKeys = await this.keyRecovery.recoverKeys(dataOwner, availableKeys)\n    for (const [fp, pair] of Object.entries(recoveredKeys)) {\n      await this.icureStorage.saveKey(dataOwner.dataOwner.id!, fp, await this.primitives.RSA.exportKeys(pair, 'jwk', 'jwk'), false)\n    }\n    return recoveredKeys\n  }\n\n  private async loadAndRecoverKeysFor(dataOwner: DataOwnerWithType): Promise<{ [keyFp: string]: { pair: KeyPair<CryptoKey>; isDevice: boolean } }> {\n    const selfPublicKeys = this.dataOwnerApi.getHexPublicKeysOf(dataOwner.dataOwner)\n    const pubKeysFingerprints = Array.from(selfPublicKeys).map((x) => x.slice(-32))\n    const loadedKeys = pubKeysFingerprints.length > 0 ? await this.loadStoredKeys(dataOwner, pubKeysFingerprints) : {}\n    const loadedKeysFingerprints = Object.keys(loadedKeys)\n    if (loadedKeysFingerprints.length !== pubKeysFingerprints.length && loadedKeysFingerprints.length > 0) {\n      const recoveredKeys = await this.recoverAndCacheKeys(dataOwner, this.plainKeysByFingerprint(loadedKeys))\n      for (const [fp, pair] of Object.entries(recoveredKeys)) {\n        loadedKeys[fp] = { pair, isDevice: false }\n      }\n    }\n    return loadedKeys\n  }\n\n  private ensureFingerprintKeys<T>(obj: { [shouldBeFingerprint: string]: T }): { [definitelyFingerprint: string]: T } {\n    return Object.fromEntries(Object.entries(obj).map(([k, v]) => [k.slice(-32), v]))\n  }\n\n  private hasVerifiedKey(keysData: { [fp: string]: KeyPairData }) {\n    return Object.values(keysData).some((x) => x.isVerified || x.isDevice)\n  }\n}\n"]}

package/icc-x-api/crypto/KeyRecovery.d.ts

@@ -0,0 +1,34 @@
+import { DataOwnerWithType, IccDataOwnerXApi } from '../icc-data-owner-x-api';
+import { KeyPair } from './RSA';
+import { CryptoPrimitives } from './CryptoPrimitives';
+import { BaseExchangeKeysManager } from './BaseExchangeKeysManager';
+/**
+ * @internal this class is intended only for internal use and may be changed without notice.
+ *
+ */
+export declare class KeyRecovery {
+    private readonly primitives;
+    private readonly baseExchangeKeysManager;
+    private readonly dataOwnerApi;
+    constructor(primitives: CryptoPrimitives, baseExchangeKeysManager: BaseExchangeKeysManager, dataOwnerApi: IccDataOwnerXApi);
+    /**
+     * Attempt to recover private keys of a data owner using all available key recovery methods and all available private keys. The method will
+     * automatically try to use newly recovered key pairs to recover additional key pairs.
+     * @param dataOwner a data owner.
+     * @param knownKeys keys available for the data owner.
+     * @return new key pairs (exclude already known pairs) which could be recovered using the known keys.
+     */
+    recoverKeys(dataOwner: DataOwnerWithType, knownKeys: {
+        [pubKeyFp: string]: KeyPair<CryptoKey>;
+    }): Promise<{
+        [pubKeyFp: string]: KeyPair<CryptoKey>;
+    }>;
+    private recoverFromShamirSplitKeys;
+    private recoverWithSplits;
+    private tryRecoverSplitPrivate;
+    private tryDecryptSplitPiece;
+    private validateDecryptedSplit;
+    private recoverFromTransferKeys;
+    private tryDecryptTransferData;
+    private tryDecryptTransferKey;
+}