@mdbase-dev/sdk 0.0.0-stage → 0.1.0-beta.149

package/dist/private-account.js

@@ -0,0 +1,510 @@
+/**
+ * Private (E2E) multi-device enrolment with the account key (AK1,
+ * account-key bundle design): setup, unlock, change
+ * password, recover and strict mode, over two narrow host ports.
+ *
+ * - {@link AccountKeyControlPort}: the Connect client's authenticated account-key routes
+ *   (§5). The host owns the connector bearer, the device identity, challenges and the
+ *   device proof signature; the SDK never sees a bearer or signs as the device.
+ * - {@link AccountKeyReplicaPort}: the replica's account-key operations (§6) for each
+ *   private collection this device has open. The replica derives the recovery device
+ *   from `R`, checks the enrolment and appends grants; the SDK never
+ *   builds log items.
+ *
+ * `R` is held only in the {@link AccountSecretStore} (RAM by default; hosts supply the
+ * platform keychain, never a file) and wiped from working buffers after each step.
+ * Every step re-checks the caller's signal; a committed control-plane write is never
+ * reported cancelled.
+ */
+import { AccountKeyError, checkPassword, checkRecoveryKey, decodeBundle, deriveAccountKeyProof, deriveRecoveryDevice, domainHash, encodeBundle, formatRecoveryKey, generateRecoveryKey, inlineArgon2id, keyId, openBundle, parseRecoveryKey, platformEntropy, recoverySign, sealBundle, signAccountKeyRewrap, uuidBytes, wipe, wipeRecoveryDevice, } from "./account-key.js";
+import { encode, fromHex, toHex } from "./cbor.js";
+import { passwordStrength } from "./strength.js";
+/** RAM only, for tests and short-lived tools. Production hosts inject the platform keychain. */
+export function memorySecretStore() {
+    let held = null;
+    return {
+        get: async () => (held ? held.slice() : null),
+        set: async (s) => {
+            if (held)
+                wipe(held);
+            held = s.slice();
+        },
+        clear: async () => {
+            if (held)
+                wipe(held);
+            held = null;
+        },
+    };
+}
+const HEX32 = /^[0-9a-f]{64}$/;
+const HEX_BUNDLE = /^([0-9a-f]{2}){1,512}$/;
+const bad = (reason) => new AccountKeyError("internal", "Invalid control-plane account-key response.", { reason });
+const unavailable = (reason, retryAfterMs) => new AccountKeyError("unavailable", "The account key service refused or was unreachable.", retryAfterMs === undefined ? { reason } : { reason, retryAfterMs });
+function object(v) {
+    if (!v || typeof v !== "object" || Array.isArray(v))
+        throw bad("not_object");
+    return v;
+}
+const version = (v) => {
+    if (!Number.isSafeInteger(v) || v < 0)
+        throw bad("version");
+    return v;
+};
+/** Validate the entire CP completion answer before permitting any key deletion. */
+function strictCompletion(r) {
+    if (typeof r.complete !== "boolean" || !Array.isArray(r.pending) || r.pending.length > 1024)
+        throw bad("strict_completion");
+    const seen = new Set();
+    const pending = r.pending.map((x) => {
+        const o = object(x);
+        if (typeof o.collection_id !== "string" || typeof o.device_id !== "string"
+            || (o.revoked_at !== null && (!Number.isSafeInteger(o.revoked_at) || o.revoked_at < 0)))
+            throw bad("strict_pending");
+        uuidBytes(o.collection_id);
+        uuidBytes(o.device_id);
+        const id = `${o.collection_id.toLowerCase()}/${o.device_id.toLowerCase()}`;
+        if (seen.has(id))
+            throw bad("strict_pending");
+        seen.add(id);
+        return { collectionId: o.collection_id, deviceId: o.device_id, revokedAt: o.revoked_at };
+    });
+    if (r.complete && pending.length !== 0)
+        throw bad("strict_completion");
+    return { complete: r.complete, pending };
+}
+/** Map a port failure to a typed error; never leak a foreign error class. */
+function mapPortError(error) {
+    if (error instanceof AccountKeyError)
+        return error;
+    const e = (error && typeof error === "object" ? error : {});
+    const problem = (e.problem && typeof e.problem === "object" ? e.problem : {});
+    const code = typeof problem.code === "string" ? problem.code : typeof e.code === "string" ? e.code : "";
+    const status = typeof e.status === "number" ? e.status : undefined;
+    const retryRaw = e.retryAfterMs ?? problem.retryAfterMs ?? (typeof e.retry_after === "number" ? e.retry_after * 1000 : undefined);
+    const retryAfterMs = typeof retryRaw === "number" && Number.isFinite(retryRaw) && retryRaw >= 0 ? retryRaw : undefined;
+    if (code === "rate_limited" || status === 429) {
+        return new AccountKeyError("rate_limited", "Too many account key requests; try again later.", retryAfterMs === undefined ? {} : { retryAfterMs });
+    }
+    if (code === "version_conflict" || code === "rotate_requires_strict")
+        return new AccountKeyError("conflict", "The account key changed; fetch the current state and retry.", { reason: code });
+    if (code === "strict_mode")
+        return new AccountKeyError("strict_mode", "The account is in strict mode.");
+    if (code === "account_key_proof_required")
+        return new AccountKeyError("wrong_secret", "The account key held here is not the one registered for this bundle.", { reason: code });
+    if (code === "no_account_key")
+        return new AccountKeyError("no_account_key", "The account has no account key.");
+    if (code === "cancelled" || (e.name === "AbortError"))
+        return new AccountKeyError("cancelled", "Account key request cancelled.");
+    return unavailable(code || (status === undefined ? "port_failure" : `http_${status}`), retryAfterMs);
+}
+/** Setup, unlock and recovery for private collections (AK1 §7). */
+export class PrivateAccount {
+    lifetime = new AbortController();
+    control;
+    replica;
+    secrets;
+    argon2id;
+    entropy;
+    /** One account-key operation at a time: they all compare-and-set the same version. */
+    busy = Promise.resolve();
+    last = null;
+    constructor(ports) {
+        this.control = ports.control;
+        this.replica = ports.replica;
+        if (!ports.secrets)
+            throw new AccountKeyError("internal", "PrivateAccount needs a secret store (the platform keychain).");
+        this.secrets = ports.secrets;
+        this.argon2id = ports.argon2id ?? inlineArgon2id;
+        this.entropy = ports.entropy ?? platformEntropy;
+        uuidBytes(this.control.accountId);
+    }
+    /** Stops this facade. `R` stays in the secret store (the host owns its lifetime). */
+    close() {
+        if (this.lifetime.signal.aborted)
+            return;
+        this.lifetime.abort();
+        this.control.close?.();
+    }
+    /** Local and synchronous; the server never sees the password. */
+    passwordStrength(password) {
+        return passwordStrength(password);
+    }
+    /** The account's mode from the status route (no bundle, not on the fetch budget). */
+    async status(options = {}) {
+        return this.serial(options, (signal) => this.readStatus(signal));
+    }
+    /** The last `status()` answer, without a request; `null` before the first fetch. */
+    get lastStatus() {
+        return this.last;
+    }
+    /** First private collection, device A (§3.1). The recovery key is returned once. */
+    async setup(password, signal) {
+        return this.serial({ signal }, async (s) => {
+            const strength = passwordStrength(password);
+            checkPassword(password);
+            if (!strength.acceptable)
+                throw new AccountKeyError("weak_password", "The password is too weak.", { reason: "strength" });
+            const state = await this.fetchState(s);
+            if (state.mode === "password")
+                throw new AccountKeyError("already_set_up", "This account already has an account key; unlock it instead.");
+            const secret = generateRecoveryKey(this.entropy);
+            try {
+                const bundle = await sealBundle(secret, password, this.control.accountId, { entropy: this.entropy, argon2id: this.argon2id, signal: s });
+                this.check(s);
+                await this.putBundle(secret, state.version, bundle, s);
+                await this.secrets.set(secret);
+                const recoveryKey = formatRecoveryKey(secret);
+                const incomplete = await this.keyAll(secret, s);
+                return incomplete.length ? { recoveryKey, incomplete } : { recoveryKey };
+            }
+            finally {
+                wipe(secret);
+            }
+        });
+    }
+    /** New device B, same account (§3.2): opens the bundle and self-grants in every private collection. */
+    async unlock(secret, signal) {
+        return this.serial({ signal }, async (s) => {
+            const state = await this.requirePassword(s);
+            let r;
+            if ("recoveryKey" in secret) {
+                r = parseRecoveryKey(secret.recoveryKey);
+                try {
+                    checkRecoveryKey(r, state.bundle);
+                }
+                catch (e) {
+                    wipe(r);
+                    throw e;
+                }
+            }
+            else {
+                r = await openBundle(state.bundle, secret.password, this.control.accountId, { argon2id: this.argon2id, signal: s });
+            }
+            try {
+                this.check(s);
+                await this.secrets.set(r);
+                const incomplete = await this.grantAll(r, s);
+                return incomplete.length ? { incomplete } : {};
+            }
+            finally {
+                wipe(r);
+            }
+        });
+    }
+    /** Re-wrap the same `R` (same key id); nothing on any log changes. Requires unlocked. */
+    async changePassword(newPassword, signal) {
+        return this.serial({ signal }, async (s) => {
+            const strength = passwordStrength(newPassword);
+            checkPassword(newPassword);
+            if (!strength.acceptable)
+                throw new AccountKeyError("weak_password", "The password is too weak.", { reason: "strength" });
+            const r = await this.secrets.get();
+            if (!r)
+                throw new AccountKeyError("locked", "Unlock the account key on this device first.");
+            try {
+                const state = await this.requirePassword(s);
+                try {
+                    checkRecoveryKey(r, state.bundle);
+                }
+                catch {
+                    throw new AccountKeyError("conflict", "The account key on the server is not the one unlocked here; unlock again.", { reason: "key_id_changed" });
+                }
+                const bundle = await sealBundle(r, newPassword, this.control.accountId, { entropy: this.entropy, argon2id: this.argon2id, signal: s });
+                this.check(s);
+                await this.putBundle(r, state.version, bundle, s);
+            }
+            finally {
+                wipe(r);
+            }
+        });
+    }
+    /** Forgotten password: the recovery key opens the account, and a new bundle wraps the same `R`. */
+    async recover(recoveryKey, newPassword, signal) {
+        return this.serial({ signal }, async (s) => {
+            const strength = passwordStrength(newPassword);
+            checkPassword(newPassword);
+            if (!strength.acceptable)
+                throw new AccountKeyError("weak_password", "The password is too weak.", { reason: "strength" });
+            const r = parseRecoveryKey(recoveryKey);
+            try {
+                const state = await this.requirePassword(s);
+                checkRecoveryKey(r, state.bundle);
+                const bundle = await sealBundle(r, newPassword, this.control.accountId, { entropy: this.entropy, argon2id: this.argon2id, signal: s });
+                this.check(s);
+                await this.putBundle(r, state.version, bundle, s);
+                await this.secrets.set(r);
+                const incomplete = await this.grantAll(r, s);
+                return incomplete.length ? { incomplete } : {};
+            }
+            finally {
+                wipe(r);
+            }
+        });
+    }
+    /**
+     * Account-level strict mode (§3.3). The control plane deletes the bundle, records
+     * strict, and queues a `device-revoke` for each listed recovery device; the result is
+     * NOT complete protection: each collection is rekeyed only when one of its keyed
+     * devices applies that revocation, and content keyed before then stays readable to
+     * whoever held the old bundle and password. The UI shows the pending revocations and
+     * says so. R stays here until explicit CP completion; repeat this operation to
+     * forget it after witnesses arrive. Leaving strict is `setup` with a new key.
+     */
+    async enableStrict(signal) {
+        return this.serial({ signal }, async (s) => {
+            const state = await this.readStatus(s);
+            if (state.mode === "strict") {
+                if (state.strictComplete === true)
+                    await this.secrets.clear();
+                const accountKeyKept = state.strictComplete === true ? false : state.accountKeyKept;
+                this.last = { ...state, accountKeyKept };
+                return { version: state.version, complete: state.strictComplete, pending: state.pending, accountKeyKept, revocations: [], alreadyStrict: true };
+            }
+            let raw;
+            try {
+                raw = await this.control.strict({ expected_version: state.version }, { signal: s });
+            }
+            catch (e) {
+                throw mapPortError(e);
+            }
+            const r = object(raw);
+            if (r.mode !== "strict" || version(r.version) !== state.version + 1 || !Array.isArray(r.revocations))
+                throw bad("strict");
+            const completion = strictCompletion(r);
+            const revocations = r.revocations.map((x) => {
+                const o = object(x);
+                if (typeof o.collection_id !== "string" || typeof o.device_id !== "string")
+                    throw bad("strict");
+                uuidBytes(o.collection_id);
+                uuidBytes(o.device_id);
+                return { collectionId: o.collection_id, deviceId: o.device_id };
+            });
+            if (completion.complete === true)
+                await this.secrets.clear();
+            const held = await this.secrets.get();
+            const accountKeyKept = held !== null;
+            if (held)
+                wipe(held);
+            this.last = { mode: "strict", version: r.version, unlocked: false, strictComplete: completion.complete, pending: completion.pending, accountKeyKept };
+            return { version: r.version, ...completion, accountKeyKept, revocations, alreadyStrict: false };
+        });
+    }
+    /**
+     * Setup step 2 for every private collection this device has open (also for private
+     * collections created after setup, §3.1.3). Requires unlocked. Returns the
+     * collections that are still incomplete.
+     */
+    async keyCollections(signal) {
+        return this.serial({ signal }, async (s) => {
+            const r = await this.secrets.get();
+            if (!r)
+                throw new AccountKeyError("locked", "Unlock the account key on this device first.");
+            try {
+                const state = await this.requirePassword(s);
+                checkRecoveryKey(r, state.bundle);
+                return await this.keyAll(r, s);
+            }
+            finally {
+                wipe(r);
+            }
+        });
+    }
+    /** Forget `R` on this device. Keys already granted to this device stay; a later `unlock` is needed to key new collections. */
+    async lock() {
+        await this.secrets.clear();
+    }
+    // ---------------------------------------------------------------- internals
+    serial(options, f) {
+        const signal = options.signal ? AbortSignal.any([this.lifetime.signal, options.signal]) : this.lifetime.signal;
+        const run = this.busy.then(() => {
+            this.check(signal);
+            return f(signal);
+        }, () => {
+            this.check(signal);
+            return f(signal);
+        });
+        this.busy = run.catch(() => undefined);
+        return run;
+    }
+    check(signal) {
+        if (signal.aborted)
+            throw new AccountKeyError("cancelled", "Account key request cancelled.");
+    }
+    async readStatus(signal) {
+        let raw;
+        try {
+            raw = await this.control.status({ signal });
+        }
+        catch (e) {
+            throw mapPortError(e);
+        }
+        this.check(signal);
+        const r = object(raw);
+        const v = version(r.version);
+        let mode;
+        let keyIdHex = null;
+        if (r.mode === "none" && v === 0)
+            mode = "none";
+        else if (r.mode === "strict")
+            mode = "strict";
+        else if (r.mode === "password" && typeof r.key_id === "string" && HEX32.test(r.key_id)) {
+            mode = "password";
+            keyIdHex = r.key_id;
+        }
+        else
+            throw bad("status");
+        const completion = mode === "strict" ? strictCompletion(r) : undefined;
+        const held = await this.secrets.get();
+        try {
+            const unlocked = keyIdHex !== null && held !== null && held.length === 32 && toHex(keyId(held)) === keyIdHex;
+            return (this.last = {
+                mode, unlocked, version: v,
+                ...(completion ? { strictComplete: completion.complete, pending: completion.pending, accountKeyKept: held !== null } : {}),
+            });
+        }
+        finally {
+            if (held)
+                wipe(held);
+        }
+    }
+    async fetchState(signal) {
+        let raw;
+        try {
+            raw = await this.control.fetch({ signal });
+        }
+        catch (e) {
+            throw mapPortError(e);
+        }
+        this.check(signal);
+        const r = object(raw);
+        const v = version(r.version);
+        if (r.mode === "none") {
+            if (v !== 0)
+                throw bad("mode");
+            return { mode: "none", version: 0 };
+        }
+        if (r.mode === "strict")
+            return { mode: "strict", version: v };
+        if (r.mode !== "password")
+            throw bad("mode");
+        if (typeof r.key_id !== "string" || !HEX32.test(r.key_id) || typeof r.bundle !== "string" || !HEX_BUNDLE.test(r.bundle))
+            throw bad("bundle");
+        const bundle = decodeBundle(fromHex(r.bundle));
+        if (toHex(bundle.keyId) !== r.key_id)
+            throw bad("key_id");
+        return { mode: "password", version: v, bundle };
+    }
+    async requirePassword(signal) {
+        const state = await this.fetchState(signal);
+        if (state.mode === "none")
+            throw new AccountKeyError("no_account_key", "The account has no account key yet; set one up on a device that holds the keys.");
+        if (state.mode === "strict")
+            throw new AccountKeyError("strict_mode", "The account is in strict mode; approve this device from an existing device.");
+        return state;
+    }
+    /** Store a bundle with the account key's proof: the proof key registered with it, and a signature over this rewrap. */
+    async putBundle(secret, expected, bundle, signal) {
+        const keyIdHex = toHex(bundle.keyId);
+        const bytes = encodeBundle(bundle);
+        const proof = deriveAccountKeyProof(secret, this.control.accountId);
+        let raw;
+        try {
+            const proof_sig = toHex(signAccountKeyRewrap(proof, this.control.accountId, bytes, expected));
+            raw = await this.control.put({ expected_version: expected, key_id: keyIdHex, bundle: toHex(bytes), proof_pk: toHex(proof.pk), proof_sig }, { signal });
+        }
+        catch (e) {
+            throw mapPortError(e);
+        }
+        finally {
+            wipe(proof.seed);
+        }
+        const r = object(raw);
+        if (r.mode !== "password" || version(r.version) !== expected + 1 || r.key_id !== keyIdHex)
+            throw bad("put");
+    }
+    async collections(signal) {
+        let list;
+        try {
+            list = await this.replica.privateCollections({ signal });
+        }
+        catch (e) {
+            throw mapPortError(e);
+        }
+        this.check(signal);
+        if (!Array.isArray(list) || list.some((c) => typeof c !== "string") || new Set(list).size !== list.length)
+            throw bad("collections");
+        for (const c of list)
+            uuidBytes(c);
+        return list;
+    }
+    /** Enrol and key the recovery device in each private collection; collect the ones that failed. */
+    async keyAll(secret, signal) {
+        const incomplete = [];
+        for (const collection of await this.collections(signal)) {
+            this.check(signal);
+            try {
+                await this.enrol(secret, collection, signal);
+                await this.replica.keyAccountKeyDevice(collection, secret, { signal });
+            }
+            catch (e) {
+                if (e instanceof AccountKeyError && e.code === "cancelled")
+                    throw e;
+                incomplete.push(collection);
+            }
+        }
+        return incomplete;
+    }
+    async grantAll(secret, signal) {
+        const incomplete = [];
+        for (const collection of await this.collections(signal)) {
+            this.check(signal);
+            try {
+                await this.replica.selfGrantWithAccountKey(collection, secret, { signal });
+            }
+            catch (e) {
+                if (e instanceof AccountKeyError && e.code === "cancelled")
+                    throw e;
+                incomplete.push(collection);
+            }
+        }
+        return incomplete;
+    }
+    /** §5.3: the control plane enrols the derived recovery device, with a proof of possession by its signing key. */
+    async enrol(secret, collection, signal) {
+        let challengeRaw;
+        try {
+            challengeRaw = await this.control.challenge({ signal });
+        }
+        catch (e) {
+            throw mapPortError(e);
+        }
+        const challenge = typeof challengeRaw === "string" ? challengeRaw.toLowerCase()
+            : typeof challengeRaw?.challenge === "string" ? (challengeRaw.challenge).toLowerCase() : "";
+        if (!HEX32.test(challenge))
+            throw bad("challenge");
+        this.check(signal);
+        const device = deriveRecoveryDevice(secret, collection);
+        try {
+            const digest = domainHash("mdbase/v1/account-key-enrol", encode([
+                fromHex(challenge), uuidBytes(collection), uuidBytes(device.device), uuidBytes(this.control.accountId), device.signPk, device.kemPk, device.noisePk,
+            ]));
+            const pop = toHex(recoverySign(device, digest));
+            let raw;
+            try {
+                raw = await this.control.enrolRecoveryDevice(collection, {
+                    challenge, recovery_device: device.device, sign_pk: toHex(device.signPk), kem_pk: toHex(device.kemPk), pop,
+                }, { signal });
+            }
+            catch (e) {
+                throw mapPortError(e);
+            }
+            const r = object(raw);
+            if (r.collection_id !== collection || r.device_id !== device.device || !Number.isSafeInteger(r.enrolled_at))
+                throw bad("enrol");
+        }
+        finally {
+            wipeRecoveryDevice(device);
+        }
+    }
+}
+//# sourceMappingURL=private-account.js.map

package/dist/private-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-account.js","sourceRoot":"","sources":["../src/private-account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EACL,eAAe,EAAkD,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAC9G,qBAAqB,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,cAAc,EAC7H,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,YAAY,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB,GAC1I,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAiB,MAAM,eAAe,CAAC;AAiFhE,gGAAgG;AAChG,MAAM,UAAU,iBAAiB;IAC/B,IAAI,IAAI,GAAsB,IAAI,CAAC;IACnC,OAAO;QACL,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7C,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACf,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAyCD,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAC/B,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAC5C,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,UAAU,EAAE,6CAA6C,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAC3H,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,YAAqB,EAAE,EAAE,CAC5D,IAAI,eAAe,CAAC,aAAa,EAAE,qDAAqD,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;AAEhK,SAAS,MAAM,CAAC,CAAU;IACxB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7E,OAAO,CAA4B,CAAC;AACtC,CAAC;AACD,MAAM,OAAO,GAAG,CAAC,CAAU,EAAU,EAAE;IACrC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAK,CAAY,GAAG,CAAC;QAAE,MAAM,GAAG,CAAC,SAAS,CAAC,CAAC;IACxE,OAAO,CAAW,CAAC;AACrB,CAAC,CAAC;AAEF,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,CAA0B;IAClD,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC5H,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;eACrE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,IAAK,CAAC,CAAC,UAAqB,GAAG,CAAC,CAAC,CAAC;YAAE,MAAM,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACnI,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC3B,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3E,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,MAAM,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,UAA2B,EAAE,CAAC;IAC5G,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACvE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC3C,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,YAAY,eAAe;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IACvF,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IACzG,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxG,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClI,MAAM,YAAY,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACvH,IAAI,IAAI,KAAK,cAAc,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAC9C,OAAO,IAAI,eAAe,CAAC,cAAc,EAAE,iDAAiD,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;IACpJ,CAAC;IACD,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,wBAAwB;QAAE,OAAO,IAAI,eAAe,CAAC,UAAU,EAAE,6DAA6D,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9L,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,IAAI,eAAe,CAAC,aAAa,EAAE,gCAAgC,CAAC,CAAC;IACxG,IAAI,IAAI,KAAK,4BAA4B;QAAE,OAAO,IAAI,eAAe,CAAC,cAAc,EAAE,sEAAsE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAChL,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,IAAI,eAAe,CAAC,gBAAgB,EAAE,iCAAiC,CAAC,CAAC;IAC/G,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC;QAAE,OAAO,IAAI,eAAe,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAC;IACjI,OAAO,WAAW,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;AACvG,CAAC;AAED,mEAAmE;AACnE,MAAM,OAAO,cAAc;IACR,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,OAAO,CAAwB;IAC/B,OAAO,CAAwB;IAC/B,OAAO,CAAqB;IAC5B,QAAQ,CAAiB;IACzB,OAAO,CAAU;IAClC,sFAAsF;IAC9E,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3C,IAAI,GAAgC,IAAI,CAAC;IAEjD,YAAY,KAA0B;QACpC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,8DAA8D,CAAC,CAAC;QAC1H,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,cAAc,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,eAAe,CAAC;QAChD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,qFAAqF;IACrF,KAAK;QACH,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACzC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IACzB,CAAC;IAED,iEAAiE;IACjE,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,MAAM,CAAC,UAAwC,EAAE;QACrD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,oFAAoF;IACpF,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,MAAoB;QAChD,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACzC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC5C,aAAa,CAAC,QAAQ,CAAC,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,UAAU;gBAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,2BAA2B,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1H,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;gBAAE,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,6DAA6D,CAAC,CAAC;YAC1I,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBACzI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACd,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACvD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC/B,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBAC9C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAChD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YAC3E,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,MAAM,CAAC,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uGAAuG;IACvG,KAAK,CAAC,MAAM,CAAC,MAAsD,EAAE,MAAoB;QACvF,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAC5C,IAAI,CAAa,CAAC;YAClB,IAAI,aAAa,IAAI,MAAM,EAAE,CAAC;gBAC5B,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACzC,IAAI,CAAC;oBACH,gBAAgB,CAAC,CAAC,EAAE,KAAK,CAAC,MAAO,CAAC,CAAC;gBACrC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,CAAC,CAAC,CAAC;oBACR,MAAM,CAAC,CAAC;gBACV,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,CAAC,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,MAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YACvH,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACd,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC1B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC7C,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,CAAC,CAAC,CAAC;YACV,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,cAAc,CAAC,WAAmB,EAAE,MAAoB;QAC5D,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACzC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC/C,aAAa,CAAC,WAAW,CAAC,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,UAAU;gBAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,2BAA2B,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1H,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACnC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,8CAA8C,CAAC,CAAC;YAC5F,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;gBAC5C,IAAI,CAAC;oBACH,gBAAgB,CAAC,CAAC,EAAE,KAAK,CAAC,MAAO,CAAC,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,2EAA2E,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBACnJ,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBACvI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACd,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACpD,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,CAAC,CAAC,CAAC;YACV,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,mGAAmG;IACnG,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,WAAmB,EAAE,MAAoB;QAC1E,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACzC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC/C,aAAa,CAAC,WAAW,CAAC,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,UAAU;gBAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,2BAA2B,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1H,MAAM,CAAC,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;gBAC5C,gBAAgB,CAAC,CAAC,EAAE,KAAK,CAAC,MAAO,CAAC,CAAC;gBACnC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBACvI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACd,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC1B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC7C,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,CAAC,CAAC,CAAC;YACV,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAAC,MAAoB;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI;oBAAE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBAC9D,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,cAAe,CAAC;gBACrF,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,CAAC;gBACzC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,cAAe,EAAE,OAAO,EAAE,KAAK,CAAC,OAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;YACpJ,CAAC;YACD,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;YACD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;gBAAE,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1H,MAAM,UAAU,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAChG,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAC3B,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACvB,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;YAClE,CAAC,CAAC,CAAC;YACH,IAAI,UAAU,CAAC,QAAQ,KAAK,IAAI;gBAAE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACtC,MAAM,cAAc,GAAG,IAAI,KAAK,IAAI,CAAC;YACrC,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;YAChK,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAiB,EAAE,GAAG,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAC5G,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,MAAoB;QACvC,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACzC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACnC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,8CAA8C,CAAC,CAAC;YAC5F,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;gBAC5C,gBAAgB,CAAC,CAAC,EAAE,KAAK,CAAC,MAAO,CAAC,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACjC,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,CAAC,CAAC,CAAC;YACV,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,8HAA8H;IAC9H,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,6EAA6E;IAErE,MAAM,CAAI,OAAqC,EAAE,CAAsC;QAC7F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC/G,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CACxB,GAAG,EAAE;YACH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC,EACD,GAAG,EAAE;YACH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC,CACF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,MAAmB;QAC/B,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAC;IAC/F,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAAmB;QAC1C,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,IAAoB,CAAC;QACzB,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC;YAAE,IAAI,GAAG,MAAM,CAAC;aAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,IAAI,GAAG,QAAQ,CAAC;aACzC,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACvF,IAAI,GAAG,UAAU,CAAC;YAClB,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;QACtB,CAAC;;YAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,MAAM,UAAU,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,QAAQ,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,QAAQ,CAAC;YAC7G,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG;gBAClB,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;gBAC1B,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3H,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAAmB;QAC1C,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;YAAE,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7I,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM;YAAE,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,MAAmB;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,iFAAiF,CAAC,CAAC;QAC1J,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,6EAA6E,CAAC,CAAC;QACrJ,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uHAAuH;IAC/G,KAAK,CAAC,SAAS,CAAC,MAAkB,EAAE,QAAgB,EAAE,MAAc,EAAE,MAAmB;QAC/F,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,KAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC9F,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACzJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9G,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,MAAmB;QAC3C,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,CAAC,aAAa,CAAC,CAAC;QACpI,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kGAAkG;IAC1F,KAAK,CAAC,MAAM,CAAC,MAAkB,EAAE,MAAmB;QAC1D,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,KAAK,MAAM,UAAU,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;gBAC7C,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;oBAAE,MAAM,CAAC,CAAC;gBACpE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,MAAkB,EAAE,MAAmB;QAC5D,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,KAAK,MAAM,UAAU,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7E,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;oBAAE,MAAM,CAAC,CAAC;gBACpE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,iHAAiH;IACzG,KAAK,CAAC,KAAK,CAAC,MAAkB,EAAE,UAAkB,EAAE,MAAmB;QAC7E,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE;YAC7E,CAAC,CAAC,OAAQ,YAA+C,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAE,YAAsC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7J,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,GAAG,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,6BAA6B,EAAE,MAAM,CAAC;gBAC9D,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO;aACpJ,CAAC,CAAC,CAAC;YACJ,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAChD,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,UAAU,EAAE;oBACvD,SAAS,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG;iBAC3G,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACjB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;YACD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC,CAAC,aAAa,KAAK,UAAU,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;gBAAE,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC;QAClI,CAAC;gBAAS,CAAC;YACT,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;CACF"}

package/dist/private.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Private (end-to-end) collections: device approval (`replica-client-api.md` §8.3) and
+ * the recovery key, offered at setup, skippable, and recommended.
+ *
+ * The recovery-key methods are proposed in the private-collection transport
+ * contract; the replica and control components own their semantics.
+ */
+import { Codec } from "./codec.js";
+import type { Problem, Uuid } from "./wire.js";
+/** `device-kind` (policy.md). */
+export declare const DEVICE_KINDS: readonly ["desktop", "mobile", "app_runtime", "cli", "hosted", "escrow", "recovery"];
+export type DeviceKind = (typeof DEVICE_KINDS)[number];
+export interface PendingDevice {
+    device: Uuid;
+    account: Uuid;
+    kind: DeviceKind | string;
+    /** Current challenge/reveal readiness only: NOT approval or key delivery. */
+    exchangeReady: boolean;
+    /** Host-only comparison code after a verified reveal; visually compare before Allow. */
+    sas?: string;
+}
+export declare const pendingDevice: Codec<PendingDevice>;
+/** Host-only `approval` push, not a joiner code or an approval result. */
+export interface ApprovalReadiness {
+    device: Uuid;
+    exchangeReady: boolean;
+    /** @deprecated Decode-only legacy field; NEVER display or copy into approval input. */
+    sas?: string;
+}
+export declare const approvalReadiness: Codec<ApprovalReadiness>;
+export interface RecoveryKeyStatus {
+    configured: boolean;
+    device?: Uuid;
+}
+export declare const recoveryKeyStatus: Codec<RecoveryKeyStatus>;
+export declare const recoveryKeyCreated: Codec<{
+    phrase: string;
+    device: Uuid;
+}>;
+/** Format either computer's local comparison code, preserving leading zeroes. */
+export declare function formatSas(sas: string): string;
+/**
+ * Where an account-key unlock stands on this replica. `refused` carries the typed
+ * `AccountKeyRefusal` as a problem (`details.reason` is the refusal name).
+ */
+export declare const ACCOUNT_KEY_STATES: readonly ["idle", "reading_ahead", "pending_grant", "keyed", "refused"];
+export type AccountKeyState = (typeof ACCOUNT_KEY_STATES)[number];
+export declare const accountKeyState: Codec<"refused" | "idle" | "reading_ahead" | "pending_grant" | "keyed"> & {
+    values: readonly ("refused" | "idle" | "reading_ahead" | "pending_grant" | "keyed")[];
+};
+export interface AccountKeyStatus {
+    state: AccountKeyState;
+    problem?: Problem;
+}
+export declare const accountKeyStatus: Codec<AccountKeyStatus>;