@meshline/sdk 0.0.0-stage → 0.1.0-alpha.1

package/dist/groups/secrets.d.ts

@@ -0,0 +1,67 @@
+import type { MessageDecryptor } from '../crypto/messages.js';
+import { ProtocolError } from '../errors.js';
+import type { SecretProtector } from '../interactions.js';
+import { type GroupHistorySecret, type GroupMemberPrivateState, type GroupRef } from '../models/groups.js';
+import type { NetworkContext } from '../protocol/context.js';
+import type { MeshlineStore, RecordKey, RecordQuery, StoreMutation, StoreSnapshot } from '../storage/store.js';
+import type { GroupApplicationSecrets } from './messages.js';
+export declare const groupMemberSecretKey: (groupId: string, publicKey: Uint8Array) => RecordKey;
+export declare const groupApplicationSecretKey: (groupId: string, epoch: number) => RecordKey;
+export declare const groupRotationKey: (group: GroupRef) => RecordKey;
+export interface PreparedGroupMemberKey {
+    readonly group: GroupRef;
+    readonly publicKey: Uint8Array;
+    readonly protectedKey: string;
+    readonly deviceId: string;
+}
+export interface GroupSecretEffect {
+    readonly queries: readonly RecordQuery[];
+    plan(snapshot: StoreSnapshot): readonly StoreMutation[];
+}
+export interface GroupSecretsOptions {
+    readonly store: MeshlineStore;
+    readonly context: NetworkContext;
+    readonly accountId: string;
+    readonly deviceId: () => string;
+    readonly protector: SecretProtector;
+}
+export interface GroupKeyRecoveryResult {
+    readonly derived: readonly number[];
+    readonly missing: readonly number[];
+    readonly rejected: readonly {
+        readonly epoch: number;
+        readonly error: ProtocolError;
+    }[];
+}
+export interface GroupRotation {
+    readonly group: GroupRef;
+    readonly baseCommitment: string;
+    readonly commitment: string;
+    readonly ownerSequence: number;
+    readonly deviceId: string;
+    readonly ownerPublicKey?: Uint8Array;
+    readonly expiresAt?: number;
+}
+/** Account-message authentication is the caller's responsibility; arriving keys never select current membership or advance verified history. */
+export declare class GroupSecrets implements GroupApplicationSecrets {
+    #private;
+    readonly options: GroupSecretsOptions;
+    constructor(options: GroupSecretsOptions);
+    prepareMemberState(source: GroupMemberPrivateState, signal?: AbortSignal): Promise<PreparedGroupMemberKey>;
+    /** Current and historical private keys coexist by derived public key; arrival order has no authority. */
+    saveMemberState(source: GroupMemberPrivateState, signal?: AbortSignal): Promise<void>;
+    /** Prepared mutations can join an account-message consumer cursor in one atomic commit. */
+    prepareMemberStates(sources: readonly GroupMemberPrivateState[], signal?: AbortSignal): Promise<GroupSecretEffect>;
+    readMemberKey(groupId: string, publicKey: Uint8Array, signal?: AbortSignal): Promise<Uint8Array | undefined>;
+    stageHistorySecret(source: GroupHistorySecret, signal?: AbortSignal): Promise<void>;
+    prepareHistorySecrets(sources: readonly GroupHistorySecret[], signal?: AbortSignal): Promise<GroupSecretEffect>;
+    readApplicationSecret(group: GroupRef, epoch: number, signal?: AbortSignal): Promise<Uint8Array | undefined>;
+    readClientSecret(group: GroupRef, commitment: string, signal?: AbortSignal): Promise<Uint8Array | undefined>;
+    rotation(group: GroupRef, signal?: AbortSignal): Promise<GroupRotation | undefined>;
+    beginRotation(group: GroupRef, baseCommitment: string, source: Uint8Array, member: PreparedGroupMemberKey | undefined, signal?: AbortSignal): Promise<GroupRotation>;
+    readRotationSecret(rotation: GroupRotation, signal?: AbortSignal): Promise<Uint8Array>;
+    acknowledgeRotation(rotation: GroupRotation, expiresAt: number): Promise<GroupRotation>;
+    discardRotation(rotation: GroupRotation, signal?: AbortSignal): Promise<void>;
+    derivePending(group: GroupRef, device: MessageDecryptor, signal?: AbortSignal): Promise<GroupKeyRecoveryResult>;
+}
+//# sourceMappingURL=secrets.d.ts.map

package/dist/groups/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/groups/secrets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAsB,MAAM,cAAc,CAAC;AAGjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAG1D,OAAO,EAAyL,KAAK,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAElS,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAI7D,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAG/G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAI7D,eAAO,MAAM,oBAAoB,YAAa,MAAM,aAAa,UAAU,KAAG,SAAmG,CAAC;AAClL,eAAO,MAAM,yBAAyB,YAAa,MAAM,SAAS,MAAM,KAAG,SAAgH,CAAC;AAC5L,eAAO,MAAM,gBAAgB,UAAW,QAAQ,KAAG,SAAoE,CAAC;AAExH,MAAM,WAAW,sBAAsB;IAAG,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAC9J,MAAM,WAAW,iBAAiB;IAAG,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,GAAG,SAAS,aAAa,EAAE,CAAA;CAAE;AACxI,MAAM,WAAW,mBAAmB;IAAG,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;CAAE;AAC1M,MAAM,WAAW,sBAAsB;IAAG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;KAAE,EAAE,CAAA;CAAE;AAC7M,MAAM,WAAW,aAAa;IAAG,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AAWvP,gJAAgJ;AAChJ,qBAAa,YAAa,YAAW,uBAAuB;;IAC5C,QAAQ,CAAC,OAAO,EAAE,mBAAmB;IAAjD,YAAqB,OAAO,EAAE,mBAAmB,EAA2C;IAkBtF,kBAAkB,CAAC,MAAM,EAAE,uBAAuB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAU/G;IACD,yGAAyG;IACnG,eAAe,CAAC,MAAM,EAAE,uBAAuB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1F;IACD,2FAA2F;IACrF,mBAAmB,CAAC,OAAO,EAAE,SAAS,uBAAuB,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAmBvH;IACK,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAMjH;IACK,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAGxF;IACK,qBAAqB,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwBpH;IACK,qBAAqB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAQjH;IACK,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAMjH;IACK,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAIxF;IACK,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,sBAAsB,GAAG,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAmBzK;IACK,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAM3F;IACK,mBAAmB,CAAC,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAO5F;IACK,eAAe,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAKlF;IACK,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAapH;CA8CJ"}

package/dist/groups/secrets.js

@@ -0,0 +1,452 @@
+import { deriveGroupApplicationSecret, groupClientSecretBoxAad, groupClientSecretCommitment, groupRelaySecretBoxAad, GroupKeyAccessError, openGroupSecret } from '../crypto/groups.js';
+import { agreeKey, encryptionPublicKey, requireLength } from '../crypto/primitives.js';
+import { ProtocolError, StateConflictError } from '../errors.js';
+import { validateIdentifier } from '../identity/identifiers.js';
+import { validateAccountId } from '../identity/neo.js';
+import { contentHashBytes } from '../models/content.js';
+import { groupKeyEntryCodec, validateGroupKeyEntry } from '../models/group-keys.js';
+import { groupHistorySecretCodec, groupMemberPrivateStateCodec, validateAccountGroupHistorySecretSync, validateAccountGroupPrivateStateSync, validateGroupMemberPrivateState, validateGroupRef } from '../models/groups.js';
+import { certificateId, deviceCertificateCodec, validateCertificate } from '../models/identity.js';
+import { decodeBase64Url, encodeBase64Url, equalBytes } from '../protocol/encoding.js';
+import { canonicalJson, requireObject, requireSafeInteger } from '../protocol/json.js';
+import { throwIfAborted } from '../runtime/clock.js';
+import { updateStore } from '../storage/transaction.js';
+import { decodeGroupProjection, groupEpochKey, groupKey, GroupRepository } from './repository.js';
+const fingerprint = (value) => canonicalJson(value ?? null);
+const put = (key, value) => ({ ...key, kind: 'put', value });
+export const groupMemberSecretKey = (groupId, publicKey) => ({ collection: 'group_member_keys', key: `${groupId}|${encodeBase64Url(publicKey)}` });
+export const groupApplicationSecretKey = (groupId, epoch) => ({ collection: 'group_application_secrets', key: `${groupId}|${String(epoch).padStart(16, '0')}` });
+export const groupRotationKey = (group) => ({ collection: 'group_rotations', key: group.groupId });
+const clientSecretKey = (groupId, commitment) => ({ collection: 'group_client_secrets', key: `${groupId}|${commitment}` });
+function rotationRecord(value, group) {
+    validateGroupRef(group);
+    if (value.relayId !== group.relayId || typeof value.baseCommitment !== 'string' || typeof value.commitment !== 'string' || typeof value.deviceId !== 'string' || typeof value.protectedSecret !== 'string')
+        throw new ProtocolError('invalid_storage', 'Stored rotation has inconsistent group, commitment or secret metadata.');
+    contentHashBytes(value.baseCommitment);
+    contentHashBytes(value.commitment);
+    validateIdentifier('device', value.deviceId);
+    requireSafeInteger(value.ownerSequence, 0);
+    if (value.baseCommitment === value.commitment)
+        throw new ProtocolError('invalid_storage', 'Stored rotation did not select a new secret.');
+    if (value.expiresAt !== undefined)
+        requireSafeInteger(value.expiresAt, 1);
+    const ownerPublicKey = value.ownerPublicKey === undefined ? undefined : decodeBase64Url(String(value.ownerPublicKey));
+    if (ownerPublicKey)
+        requireLength(ownerPublicKey, 32, 'Candidate owner public key');
+    return { group, baseCommitment: value.baseCommitment, commitment: value.commitment, ownerSequence: value.ownerSequence, deviceId: value.deviceId, ...(ownerPublicKey ? { ownerPublicKey } : {}), ...(value.expiresAt === undefined ? {} : { expiresAt: value.expiresAt }) };
+}
+/** Account-message authentication is the caller's responsibility; arriving keys never select current membership or advance verified history. */
+export class GroupSecrets {
+    options;
+    constructor(options) {
+        this.options = options;
+        validateAccountId(options.accountId);
+    }
+    #purpose(groupId, kind, key) {
+        validateIdentifier('group', groupId);
+        const deviceId = this.options.deviceId();
+        validateIdentifier('device', deviceId);
+        return `Meshline/${this.options.context}/${this.options.accountId}/${deviceId}/group/${groupId}/${kind}/${key}`;
+    }
+    async #protect(secret, purpose, signal) {
+        try {
+            const protectedData = await this.options.protector.protect(secret, purpose, signal);
+            throwIfAborted(signal);
+            if (!(protectedData instanceof Uint8Array) || !protectedData.length)
+                throw new Error('Secret protector returned empty data.');
+            return encodeBase64Url(protectedData);
+        }
+        catch (cause) {
+            throwIfAborted(signal);
+            throw new GroupKeyAccessError('Local group secret protection failed.', { cause });
+        }
+    }
+    async #unprotect(value, field, purpose, signal) {
+        let result;
+        try {
+            if (typeof value[field] !== 'string')
+                throw new Error('Protected group secret is missing.');
+            result = await this.options.protector.unprotect(decodeBase64Url(value[field]), purpose, signal);
+            throwIfAborted(signal);
+            requireLength(result, 32, 'Protected group secret');
+            return result;
+        }
+        catch (cause) {
+            if (result instanceof Uint8Array)
+                result.fill(0);
+            throwIfAborted(signal);
+            throw new GroupKeyAccessError('Local group secret could not be restored.', { cause });
+        }
+    }
+    async prepareMemberState(source, signal) {
+        const value = groupMemberPrivateStateCodec.decode(groupMemberPrivateStateCodec.encode(source));
+        try {
+            validateGroupMemberPrivateState(value);
+            const deviceId = this.options.deviceId();
+            const group = { groupId: value.groupId, relayId: value.relayId };
+            const publicKey = encryptionPublicKey(value.memberEncryptionPrivateKey);
+            const purpose = this.#purpose(group.groupId, 'member', encodeBase64Url(publicKey));
+            const protectedKey = await this.#protect(value.memberEncryptionPrivateKey, purpose, signal);
+            if (purpose !== this.#purpose(group.groupId, 'member', encodeBase64Url(publicKey)))
+                throw new GroupKeyAccessError('Local device changed during group key protection.');
+            return { group, publicKey, protectedKey, deviceId };
+        }
+        finally {
+            value.memberEncryptionPrivateKey.fill(0);
+        }
+    }
+    /** Current and historical private keys coexist by derived public key; arrival order has no authority. */
+    async saveMemberState(source, signal) {
+        const effect = await this.prepareMemberStates([source], signal);
+        await updateStore(this.options.store, effect.queries, snapshot => ({ mutations: effect.plan(snapshot), result: undefined }), signal);
+    }
+    /** Prepared mutations can join an account-message consumer cursor in one atomic commit. */
+    async prepareMemberStates(sources, signal) {
+        const states = sources.map(source => groupMemberPrivateStateCodec.decode(groupMemberPrivateStateCodec.encode(source)));
+        try {
+            validateAccountGroupPrivateStateSync({ states });
+            const prepared = [];
+            for (const state of states)
+                prepared.push(await this.prepareMemberState(state, signal));
+            const queries = prepared.flatMap(value => [groupKey(value.group), groupMemberSecretKey(value.group.groupId, value.publicKey)]);
+            return { queries, plan: snapshot => {
+                    const mutations = [];
+                    for (const [index, value] of prepared.entries()) {
+                        if (this.options.deviceId() !== value.deviceId)
+                            throw new GroupKeyAccessError('Local device changed before member key persistence.');
+                        const record = snapshot.sets[index * 2][0]?.value;
+                        const existing = snapshot.sets[index * 2 + 1][0]?.value;
+                        const publicKey = encodeBase64Url(value.publicKey);
+                        if (record && record.relayId !== value.group.relayId)
+                            throw new ProtocolError('invalid_binding', 'Private group state names another hosting relay.');
+                        if (existing && existing.publicKey !== publicKey)
+                            throw new ProtocolError('invalid_storage', 'Stored group member key does not match its identity.');
+                        if (!record)
+                            mutations.push(put(groupKey(value.group), { relayId: value.group.relayId }));
+                        if (!existing)
+                            mutations.push(put(groupMemberSecretKey(value.group.groupId, value.publicKey), { publicKey, protectedKey: value.protectedKey, shared: false }));
+                    }
+                    return mutations;
+                } };
+        }
+        finally {
+            for (const state of states)
+                state.memberEncryptionPrivateKey.fill(0);
+        }
+    }
+    async readMemberKey(groupId, publicKey, signal) {
+        validateIdentifier('group', groupId);
+        requireLength(publicKey, 32, 'Member public key');
+        const key = publicKey.slice();
+        const row = (await this.options.store.read([groupMemberSecretKey(groupId, key)], signal)).sets[0][0]?.value;
+        if (!row)
+            return undefined;
+        const purpose = this.#purpose(groupId, 'member', encodeBase64Url(key));
+        const privateKey = await this.#unprotect(row, 'protectedKey', purpose, signal);
+        try {
+            if (row.publicKey !== encodeBase64Url(key) || !equalBytes(encryptionPublicKey(privateKey), key) || purpose !== this.#purpose(groupId, 'member', encodeBase64Url(key)))
+                throw new GroupKeyAccessError('Restored group member key differs from its public identity.');
+            return privateKey;
+        }
+        catch (error) {
+            privateKey.fill(0);
+            throw error;
+        }
+    }
+    async stageHistorySecret(source, signal) {
+        const effect = await this.prepareHistorySecrets([source], signal);
+        await updateStore(this.options.store, effect.queries, snapshot => ({ mutations: effect.plan(snapshot), result: undefined }), signal);
+    }
+    async prepareHistorySecrets(sources, signal) {
+        const secrets = sources.map(source => groupHistorySecretCodec.decode(groupHistorySecretCodec.encode(source)));
+        try {
+            validateAccountGroupHistorySecretSync({ secrets });
+            const deviceId = this.options.deviceId();
+            const queries = secrets.map(value => groupApplicationSecretKey(value.groupId, value.epoch));
+            const initial = await this.options.store.read(queries, signal);
+            const mutations = [];
+            for (const [index, value] of secrets.entries()) {
+                const row = initial.sets[index][0]?.value;
+                const purpose = this.#purpose(value.groupId, 'epoch', String(value.epoch));
+                if (row) {
+                    if (row.epoch !== value.epoch)
+                        throw new ProtocolError('invalid_storage', 'Stored group secret belongs to another epoch.');
+                    const existing = await this.#unprotect(row, 'protectedSecret', purpose, signal);
+                    try {
+                        if (!equalBytes(existing, value.applicationSecret))
+                            throw new ProtocolError('conflicting_epoch_secret', 'Account synchronization conflicts with a previously stored epoch secret.');
+                    }
+                    finally {
+                        existing.fill(0);
+                    }
+                }
+                else {
+                    const protectedSecret = await this.#protect(value.applicationSecret, purpose, signal);
+                    mutations.push(put(queries[index], { epoch: value.epoch, protectedSecret, source: 'account', shared: false }));
+                }
+                if (deviceId !== this.options.deviceId())
+                    throw new GroupKeyAccessError('Local device changed during epoch secret preparation.');
+            }
+            return { queries, plan: snapshot => {
+                    if (deviceId !== this.options.deviceId())
+                        throw new GroupKeyAccessError('Local device changed before epoch secret persistence.');
+                    if (snapshot.sets.some((rows, index) => fingerprint(rows[0]?.value) !== fingerprint(initial.sets[index][0]?.value)))
+                        throw new StateConflictError('Group epoch secret changed while synchronization was being prepared.');
+                    return mutations;
+                } };
+        }
+        finally {
+            for (const value of secrets)
+                value.applicationSecret.fill(0);
+        }
+    }
+    async readApplicationSecret(group, epoch, signal) {
+        validateGroupRef(group);
+        requireSafeInteger(epoch, 0);
+        const snapshot = await this.options.store.read([groupKey(group), groupEpochKey(group, epoch), groupApplicationSecretKey(group.groupId, epoch)], signal);
+        const association = snapshot.sets[0][0]?.value;
+        if (association && association.relayId !== group.relayId)
+            throw new ProtocolError('invalid_binding', 'Group secret belongs to another hosting relay.');
+        if (!association?.projection || !snapshot.sets[1][0]?.value.commitment)
+            return undefined;
+        const projection = decodeGroupProjection(requireObject(association.projection), group);
+        if (epoch > projection.epoch)
+            return undefined;
+        const row = snapshot.sets[2][0]?.value;
+        if (!row)
+            return undefined;
+        if (row.epoch !== epoch)
+            throw new ProtocolError('invalid_storage', 'Stored group secret belongs to another epoch.');
+        const purpose = this.#purpose(group.groupId, 'epoch', String(epoch));
+        const secret = await this.#unprotect(row, 'protectedSecret', purpose, signal);
+        if (purpose !== this.#purpose(group.groupId, 'epoch', String(epoch))) {
+            secret.fill(0);
+            throw new GroupKeyAccessError('Local device changed during group secret restoration.');
+        }
+        return secret;
+    }
+    async readClientSecret(group, commitment, signal) {
+        validateGroupRef(group);
+        contentHashBytes(commitment);
+        const epochs = await new GroupRepository(this.options.store, this.options.context, this.options.accountId).epochs(group, signal);
+        if (!epochs.some(epoch => epoch.commitment === commitment))
+            return undefined;
+        const row = (await this.options.store.read([clientSecretKey(group.groupId, commitment)], signal)).sets[0][0]?.value;
+        if (!row)
+            return undefined;
+        const purpose = this.#purpose(group.groupId, 'client', commitment);
+        const secret = await this.#unprotect(row, 'protectedSecret', purpose, signal);
+        if (groupClientSecretCommitment(group.groupId, secret, this.options.context) !== commitment || purpose !== this.#purpose(group.groupId, 'client', commitment)) {
+            secret.fill(0);
+            throw new GroupKeyAccessError('Stored client secret does not match its verified commitment or local device.');
+        }
+        return secret;
+    }
+    async rotation(group, signal) {
+        group = { ...group };
+        validateGroupRef(group);
+        const snapshot = await this.options.store.read([groupKey(group), groupRotationKey(group)], signal);
+        if (snapshot.sets[0][0]?.value.relayId !== group.relayId)
+            throw new ProtocolError('invalid_binding', 'Rotation group has no matching hosting association.');
+        const row = snapshot.sets[1][0]?.value;
+        return row && rotationRecord(row, group);
+    }
+    async beginRotation(group, baseCommitment, source, member, signal) {
+        group = { ...group };
+        validateGroupRef(group);
+        contentHashBytes(baseCommitment);
+        const secret = source.slice();
+        try {
+            const commitment = groupClientSecretCommitment(group.groupId, secret, this.options.context);
+            if (commitment === baseCommitment)
+                throw new ProtocolError('unchanged_secret', 'Rotation requires a fresh client group secret.');
+            const deviceId = this.options.deviceId();
+            const purpose = this.#purpose(group.groupId, 'rotation', commitment);
+            const protectedSecret = await this.#protect(secret, purpose, signal);
+            if (member && (member.group.groupId !== group.groupId || member.group.relayId !== group.relayId || member.deviceId !== deviceId))
+                throw new ProtocolError('invalid_binding', 'Rotation member key belongs to another group or local device.');
+            const queries = [groupKey(group), groupRotationKey(group), ...(member ? [groupMemberSecretKey(group.groupId, member.publicKey)] : [])];
+            return await updateStore(this.options.store, queries, snapshot => {
+                if (purpose !== this.#purpose(group.groupId, 'rotation', commitment))
+                    throw new GroupKeyAccessError('Local rotation protection identity changed.');
+                const row = snapshot.sets[0][0]?.value;
+                if (row?.relayId !== group.relayId || !row.projection)
+                    throw new ProtocolError('unverified_group', 'Rotation requires verified group history.');
+                const state = decodeGroupProjection(requireObject(row.projection), group);
+                if (state.clientSecretCommitment !== baseCommitment || state.state.owner !== this.options.accountId || state.state.status !== 'active')
+                    throw new StateConflictError('Verified group secret or owner changed before rotation staging.');
+                if (snapshot.sets[1].length)
+                    throw new StateConflictError('A group secret rotation is already staged.');
+                const value = { relayId: group.relayId, baseCommitment, commitment, protectedSecret, deviceId, ownerSequence: row.ownerSequence ?? 0, ...(member ? { ownerPublicKey: encodeBase64Url(member.publicKey) } : {}) };
+                const result = rotationRecord(value, group);
+                const mutations = [put(groupRotationKey(group), value)];
+                if (member) {
+                    if (snapshot.sets[2].length)
+                        throw new StateConflictError('Candidate owner key already exists.');
+                    mutations.push(put(queries[2], { publicKey: encodeBase64Url(member.publicKey), protectedKey: member.protectedKey, shared: false }));
+                }
+                return { mutations, result };
+            }, signal);
+        }
+        finally {
+            secret.fill(0);
+        }
+    }
+    async readRotationSecret(rotation, signal) {
+        const row = (await this.options.store.read([groupRotationKey(rotation.group)], signal)).sets[0][0]?.value;
+        if (!row || row.commitment !== rotation.commitment || row.baseCommitment !== rotation.baseCommitment)
+            throw new StateConflictError('Candidate group secret changed before restoration.');
+        const current = rotationRecord(row, rotation.group);
+        if (current.deviceId !== this.options.deviceId())
+            throw new GroupKeyAccessError('Rotation belongs to another local device.');
+        const purpose = this.#purpose(rotation.group.groupId, 'rotation', rotation.commitment);
+        const secret = await this.#unprotect(row, 'protectedSecret', purpose, signal);
+        if (purpose !== this.#purpose(rotation.group.groupId, 'rotation', rotation.commitment) || groupClientSecretCommitment(rotation.group.groupId, secret, this.options.context) !== rotation.commitment) {
+            secret.fill(0);
+            throw new GroupKeyAccessError('Restored candidate secret differs from its commitment or local identity.');
+        }
+        return secret;
+    }
+    async acknowledgeRotation(rotation, expiresAt) {
+        requireSafeInteger(expiresAt, 1);
+        return updateStore(this.options.store, [groupRotationKey(rotation.group)], snapshot => {
+            const value = snapshot.sets[0][0]?.value;
+            if (!value || value.commitment !== rotation.commitment)
+                throw new StateConflictError('Candidate rotation changed before preparation was acknowledged.');
+            const current = rotationRecord(value, rotation.group);
+            if (current.expiresAt !== undefined && current.expiresAt !== expiresAt)
+                throw new ProtocolError('conflicting_expiry', 'Relay changed the original rotation preparation expiry.');
+            const next = { ...value, expiresAt };
+            return { mutations: [put(groupRotationKey(rotation.group), next)], result: rotationRecord(next, rotation.group) };
+        });
+    }
+    async discardRotation(rotation, signal) {
+        await updateStore(this.options.store, [groupRotationKey(rotation.group)], snapshot => {
+            const row = snapshot.sets[0][0]?.value;
+            if (row && row.commitment !== rotation.commitment)
+                throw new StateConflictError('Another rotation replaced the obsolete candidate.');
+            return { mutations: row ? [{ kind: 'delete', ...groupRotationKey(rotation.group) }] : [], result: undefined };
+        }, signal);
+    }
+    async derivePending(group, device, signal) {
+        const epochs = await new GroupRepository(this.options.store, this.options.context, this.options.accountId).epochs(group, signal);
+        const derived = [];
+        const missing = [];
+        const rejected = [];
+        for (const epoch of epochs) {
+            if (!epoch.keyEntry || !epoch.memberPublicKey)
+                continue;
+            try {
+                const result = await this.#deriveEpoch(group, epoch.epoch, device, signal);
+                if (result === 'derived')
+                    derived.push(epoch.epoch);
+                if (result === 'missing')
+                    missing.push(epoch.epoch);
+            }
+            catch (error) {
+                throwIfAborted(signal);
+                if (!(error instanceof ProtocolError) || !['invalid_ciphertext', 'invalid_key', 'invalid_commitment', 'conflicting_epoch_secret'].includes(error.code))
+                    throw error;
+                rejected.push({ epoch: epoch.epoch, error });
+            }
+        }
+        return { derived, missing, rejected };
+    }
+    async #deriveEpoch(group, epoch, device, signal) {
+        const { store, context, accountId } = this.options;
+        const first = (await store.read([groupEpochKey(group, epoch)], signal)).sets[0][0]?.value;
+        if (!first || typeof first.commitment !== 'string' || typeof first.memberPublicKey !== 'string')
+            throw new ProtocolError('invalid_storage', 'Group epoch has no verified secret authority.');
+        const commitment = first.commitment;
+        contentHashBytes(commitment);
+        const publicKey = decodeBase64Url(first.memberPublicKey);
+        requireLength(publicKey, 32, 'Verified member public key');
+        const queries = [groupKey(group), groupEpochKey(group, epoch), groupMemberSecretKey(group.groupId, publicKey), groupApplicationSecretKey(group.groupId, epoch), clientSecretKey(group.groupId, commitment)];
+        const snapshot = await store.read(queries, signal);
+        const [association, epochRow, member, application, client] = snapshot.sets.map(rows => rows[0]?.value);
+        if (association?.relayId !== group.relayId || !association.projection || !epochRow || fingerprint(epochRow) !== fingerprint(first))
+            throw new StateConflictError('Group key authority changed during recovery.');
+        if (decodeGroupProjection(requireObject(association.projection), group).epoch < epoch)
+            throw new ProtocolError('invalid_storage', 'Group epoch has not been reached by verified history.');
+        const certificate = deviceCertificateCodec.decode(deviceCertificateCodec.encode(device.certificate));
+        validateCertificate(certificate, context);
+        const deviceId = certificateId(certificate, context);
+        if (certificate.account !== accountId || deviceId !== this.options.deviceId())
+            throw new GroupKeyAccessError('Group key receiver belongs to another local account or device.');
+        if (epochRow.materialVerified === true && application && client)
+            return 'ready';
+        if (!member)
+            return 'missing';
+        const entry = groupKeyEntryCodec.decode(epochRow.keyEntry);
+        validateGroupKeyEntry(entry);
+        if (entry.epoch !== epoch || !entry.clientSecretBox || member.publicKey !== encodeBase64Url(publicKey))
+            throw new ProtocolError('invalid_storage', 'Stored group key entry or member key has inconsistent metadata.');
+        const memberPurpose = this.#purpose(group.groupId, 'member', encodeBase64Url(publicKey));
+        const clientPurpose = this.#purpose(group.groupId, 'client', commitment);
+        const epochPurpose = this.#purpose(group.groupId, 'epoch', String(epoch));
+        const privateKey = await this.#unprotect(member, 'protectedKey', memberPurpose, signal);
+        let shared;
+        let clientSecret;
+        let relaySecret;
+        let secret;
+        let oldApplication;
+        let oldClient;
+        try {
+            if (!equalBytes(encryptionPublicKey(privateKey), publicKey))
+                throw new GroupKeyAccessError('Restored member key differs from its verified public key.');
+            shared = agreeKey(privateKey, entry.clientSecretBox.enc);
+            clientSecret = openGroupSecret(entry.clientSecretBox, shared, groupClientSecretBoxAad({ groupId: group.groupId, account: accountId, memberEncryptionPublicKey: publicKey, clientSecretCommitment: commitment }, context));
+            if (groupClientSecretCommitment(group.groupId, clientSecret, context) !== commitment)
+                throw new ProtocolError('invalid_commitment', 'Unwrapped client secret differs from the verified commitment.');
+            shared.fill(0);
+            shared = undefined;
+            const probe = agreeKey(new Uint8Array(32).fill(1), entry.relaySecretBox.enc);
+            probe.fill(0);
+            try {
+                shared = await device.deriveSharedSecret(entry.relaySecretBox.enc.slice(), signal);
+                throwIfAborted(signal);
+                requireLength(shared, 32, 'Device shared secret');
+                if (shared.every(byte => byte === 0) || certificateId(device.certificate, context) !== deviceId)
+                    throw new Error('Device key agreement returned invalid identity or key material.');
+            }
+            catch (cause) {
+                throwIfAborted(signal);
+                throw new GroupKeyAccessError('Local device could not open the group relay-secret box.', { cause });
+            }
+            relaySecret = openGroupSecret(entry.relaySecretBox, shared, groupRelaySecretBoxAad({ groupId: group.groupId, account: accountId, deviceId, epoch }, context));
+            secret = deriveGroupApplicationSecret(group.groupId, epoch, commitment, clientSecret, relaySecret, context);
+            if (application) {
+                oldApplication = await this.#unprotect(application, 'protectedSecret', epochPurpose, signal);
+                if (!equalBytes(oldApplication, secret))
+                    throw new ProtocolError('conflicting_epoch_secret', 'Derived group secret conflicts with a previously synchronized epoch secret.');
+            }
+            if (client) {
+                oldClient = await this.#unprotect(client, 'protectedSecret', clientPurpose, signal);
+                if (!equalBytes(oldClient, clientSecret))
+                    throw new GroupKeyAccessError('Stored client secret conflicts with its verified commitment.');
+            }
+            const protectedSecret = application?.protectedSecret ?? await this.#protect(secret, epochPurpose, signal);
+            const protectedClient = client?.protectedSecret ?? await this.#protect(clientSecret, clientPurpose, signal);
+            await updateStore(store, queries, current => {
+                if (this.options.deviceId() !== deviceId)
+                    throw new GroupKeyAccessError('Local device changed before epoch secret persistence.');
+                if (current.sets.some((rows, i) => fingerprint(rows[0]?.value) !== fingerprint(snapshot.sets[i][0]?.value)))
+                    throw new StateConflictError('Group key material changed while recovery was being prepared.');
+                return { mutations: [put(queries[1], { ...epochRow, materialVerified: true }), put(queries[3], { ...application, epoch, protectedSecret, source: 'derived' }),
+                        put(queries[4], { commitment, protectedSecret: protectedClient })], result: undefined };
+            }, signal);
+            return 'derived';
+        }
+        finally {
+            privateKey.fill(0);
+            if (shared instanceof Uint8Array)
+                shared.fill(0);
+            clientSecret?.fill(0);
+            relaySecret?.fill(0);
+            secret?.fill(0);
+            oldApplication?.fill(0);
+            oldClient?.fill(0);
+        }
+    }
+}
+//# sourceMappingURL=secrets.js.map

package/dist/groups/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/groups/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACvL,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAEvF,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,qCAAqC,EAAE,oCAAoC,EAAE,+BAA+B,EAAE,gBAAgB,EAAwE,MAAM,qBAAqB,CAAC;AAClS,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEnG,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAmB,MAAM,qBAAqB,CAAC;AACxG,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGlG,MAAM,WAAW,GAAG,CAAC,KAA6B,EAAU,EAAE,CAAC,aAAa,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC5F,MAAM,GAAG,GAAG,CAAC,GAAc,EAAE,KAAiB,EAAiB,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAe,EAAE,SAAqB,EAAa,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,EAAE,GAAG,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;AAClL,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,OAAe,EAAE,KAAa,EAAa,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,2BAA2B,EAAE,GAAG,EAAE,GAAG,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5L,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAe,EAAa,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AACxH,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,UAAkB,EAAa,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,sBAAsB,EAAE,GAAG,EAAE,GAAG,OAAO,IAAI,UAAU,EAAE,EAAE,CAAC,CAAC;AAMtJ,SAAS,cAAc,CAAC,KAAiB,EAAE,KAAe;IACtD,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,wEAAwE,CAAC,CAAC;IACjU,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAAC,kBAAkB,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IACrK,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,8CAA8C,CAAC,CAAC;IAC1I,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IAAC,IAAI,cAAc;QAAE,aAAa,CAAC,cAAc,EAAE,EAAE,EAAE,4BAA4B,CAAC,CAAC;IAC3M,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;AAChR,CAAC;AAED,gJAAgJ;AAChJ,MAAM,OAAO,YAAY;IACA,OAAO;IAA5B,YAAqB,OAA4B;uBAA5B,OAAO;QAAyB,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAC5F,QAAQ,CAAC,OAAe,EAAE,IAAY,EAAE,GAAW;QAC/C,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACvH,OAAO,YAAY,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,QAAQ,UAAU,OAAO,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;IACpH,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,MAAkB,EAAE,OAAe,EAAE,MAAoB;QACpE,IAAI,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC5G,IAAI,CAAC,CAAC,aAAa,YAAY,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAAC,OAAO,eAAe,CAAC,aAAa,CAAC,CAAC;QACzK,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,CAAC;IAClI,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,KAAiB,EAAE,KAAa,EAAE,OAAe,EAAE,MAAoB;QACpF,IAAI,MAA8B,CAAC;QACnC,IAAI,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YAC5F,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAAC,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,wBAAwB,CAAC,CAAC;YAAC,OAAO,MAAM,CAAC;QAChM,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,MAAM,YAAY,UAAU;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,2CAA2C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,CAAC;IACxL,CAAC;IACD,KAAK,CAAC,kBAAkB,CAAC,MAA+B,EAAE,MAAoB;QAC1E,MAAM,KAAK,GAAG,4BAA4B,CAAC,MAAM,CAAC,4BAA4B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC;YACD,+BAA+B,CAAC,KAAK,CAAC,CAAC;YAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACjF,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAAC,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC1I,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;YACnF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,0BAA0B,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5F,IAAI,OAAO,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mDAAmD,CAAC,CAAC;YACvK,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;QACxD,CAAC;gBAAS,CAAC;YAAC,KAAK,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAC3D,CAAC;IACD,yGAAyG;IACzG,KAAK,CAAC,eAAe,CAAC,MAA+B,EAAE,MAAoB;QACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACzI,CAAC;IACD,2FAA2F;IAC3F,KAAK,CAAC,mBAAmB,CAAC,OAA2C,EAAE,MAAoB;QACvF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,4BAA4B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvH,IAAI,CAAC;YACD,oCAAoC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YAAC,MAAM,QAAQ,GAA6B,EAAE,CAAC;YAChG,KAAK,MAAM,KAAK,IAAI,MAAM;gBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YACxF,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC/H,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE;oBAC/B,MAAM,SAAS,GAAoB,EAAE,CAAC;oBACtC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;wBAC9C,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,KAAK,CAAC,QAAQ;4BAAE,MAAM,IAAI,mBAAmB,CAAC,qDAAqD,CAAC,CAAC;wBACrI,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;wBAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;wBAAC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;wBACjK,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO;4BAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,kDAAkD,CAAC,CAAC;wBACrJ,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;4BAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,sDAAsD,CAAC,CAAC;wBACrJ,IAAI,CAAC,MAAM;4BAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;wBAC1F,IAAI,CAAC,QAAQ;4BAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;oBACnK,CAAC;oBACD,OAAO,SAAS,CAAC;gBACrB,CAAC,EAAE,CAAC;QACR,CAAC;gBAAS,CAAC;YAAC,KAAK,MAAM,KAAK,IAAI,MAAM;gBAAE,KAAK,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACvF,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,SAAqB,EAAE,MAAoB;QAC5E,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAAC,aAAa,CAAC,SAAS,EAAE,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAAC,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC;QACvH,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QAAC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QACzI,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QAAC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvJ,IAAI,CAAC;YAAC,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,IAAI,OAAO,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,6DAA6D,CAAC,CAAC;YAAC,OAAO,UAAU,CAAC;QAAC,CAAC;QAC/R,OAAO,KAAK,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IACtD,CAAC;IACD,KAAK,CAAC,kBAAkB,CAAC,MAA0B,EAAE,MAAoB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACzI,CAAC;IACD,KAAK,CAAC,qBAAqB,CAAC,OAAsC,EAAE,MAAoB;QACpF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9G,IAAI,CAAC;YACD,qCAAqC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;YAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC7F,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAAC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAAC,MAAM,SAAS,GAAoB,EAAE,CAAC;YACnM,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;gBAAC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBACvH,IAAI,GAAG,EAAE,CAAC;oBACN,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;wBAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;oBAC3H,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;oBAChF,IAAI,CAAC;wBAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,iBAAiB,CAAC;4BAAE,MAAM,IAAI,aAAa,CAAC,0BAA0B,EAAE,0EAA0E,CAAC,CAAC;oBAAC,CAAC;4BACpL,CAAC;wBAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAAC,CAAC;gBACjC,CAAC;qBAAM,CAAC;oBACJ,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;oBACtF,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;gBACpH,CAAC;gBACD,IAAI,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;oBAAE,MAAM,IAAI,mBAAmB,CAAC,uDAAuD,CAAC,CAAC;YACrI,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE;oBAC/B,IAAI,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;wBAAE,MAAM,IAAI,mBAAmB,CAAC,uDAAuD,CAAC,CAAC;oBACjI,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;wBAAE,MAAM,IAAI,kBAAkB,CAAC,sEAAsE,CAAC,CAAC;oBAC3N,OAAO,SAAS,CAAC;gBACrB,CAAC,EAAE,CAAC;QACR,CAAC;gBAAS,CAAC;YAAC,KAAK,MAAM,KAAK,IAAI,OAAO;gBAAE,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAC/E,CAAC;IACD,KAAK,CAAC,qBAAqB,CAAC,KAAe,EAAE,KAAa,EAAE,MAAoB;QAC5E,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAAC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/M,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QAAC,IAAI,WAAW,IAAI,WAAW,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;QACxM,IAAI,CAAC,WAAW,EAAE,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAC1F,MAAM,UAAU,GAAG,qBAAqB,CAAC,aAAa,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;QAAC,IAAI,KAAK,GAAG,UAAU,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QACvI,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QAAC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAAC,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;QAC1L,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACpJ,IAAI,OAAO,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,uDAAuD,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,MAAM,CAAC;IACpM,CAAC;IACD,KAAK,CAAC,gBAAgB,CAAC,KAAe,EAAE,UAAkB,EAAE,MAAoB;QAC5E,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxL,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7E,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QAAC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QACjJ,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClJ,IAAI,2BAA2B,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,UAAU,IAAI,OAAO,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,8EAA8E,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,MAAM,CAAC;IACpT,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,KAAe,EAAE,MAAoB;QAChD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAClJ,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,qDAAqD,CAAC,CAAC;QAC7J,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QAAC,OAAO,GAAG,IAAI,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtF,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,KAAe,EAAE,cAAsB,EAAE,MAAkB,EAAE,MAA0C,EAAE,MAAoB;QAC7I,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;QAC/G,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAAC,IAAI,UAAU,KAAK,cAAc;gBAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,gDAAgD,CAAC,CAAC;YAC9N,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAAC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;YAAC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACrL,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;gBAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,+DAA+D,CAAC,CAAC;YAC9O,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACvI,OAAO,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;gBAC7D,IAAI,OAAO,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC;oBAAE,MAAM,IAAI,mBAAmB,CAAC,6CAA6C,CAAC,CAAC;gBACnJ,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;gBAAC,IAAI,GAAG,EAAE,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU;oBAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,2CAA2C,CAAC,CAAC;gBACzL,MAAM,KAAK,GAAG,qBAAqB,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC1E,IAAI,KAAK,CAAC,sBAAsB,KAAK,cAAc,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ;oBAAE,MAAM,IAAI,kBAAkB,CAAC,iEAAiE,CAAC,CAAC;gBACxO,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,MAAM;oBAAE,MAAM,IAAI,kBAAkB,CAAC,4CAA4C,CAAC,CAAC;gBACzG,MAAM,KAAK,GAAe,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7N,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAAC,MAAM,SAAS,GAAoB,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;gBACtH,IAAI,MAAM,EAAE,CAAC;oBAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,MAAM;wBAAE,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;oBAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;gBAAC,CAAC;gBACxP,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YACjC,CAAC,EAAE,MAAM,CAAC,CAAC;QACf,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACjC,CAAC;IACD,KAAK,CAAC,kBAAkB,CAAC,QAAuB,EAAE,MAAoB;QAClE,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QAC3G,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;YAAE,MAAM,IAAI,kBAAkB,CAAC,oDAAoD,CAAC,CAAC;QACzL,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,2CAA2C,CAAC,CAAC;QAClL,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACtK,IAAI,OAAO,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,2BAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,0EAA0E,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,MAAM,CAAC;IACtV,CAAC;IACD,KAAK,CAAC,mBAAmB,CAAC,QAAuB,EAAE,SAAiB;QAChE,kBAAkB,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACjC,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE;YAClF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;YAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;gBAAE,MAAM,IAAI,kBAAkB,CAAC,iEAAiE,CAAC,CAAC;YACnM,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;gBAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,yDAAyD,CAAC,CAAC;YACxO,MAAM,IAAI,GAAG,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC;YAAC,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5J,CAAC,CAAC,CAAC;IACP,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,QAAuB,EAAE,MAAoB;QAC/D,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE;YACjF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;YAAC,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;gBAAE,MAAM,IAAI,kBAAkB,CAAC,mDAAmD,CAAC,CAAC;YAC9K,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClH,CAAC,EAAE,MAAM,CAAC,CAAC;IACf,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,KAAe,EAAE,MAAwB,EAAE,MAAoB;QAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACjI,MAAM,OAAO,GAAa,EAAE,CAAC;QAAC,MAAM,OAAO,GAAa,EAAE,CAAC;QAAC,MAAM,QAAQ,GAA8C,EAAE,CAAC;QAC3H,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,eAAe;gBAAE,SAAS;YACxD,IAAI,CAAC;gBAAC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBAAC,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAAC,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAC7L,OAAO,KAAK,EAAE,CAAC;gBACX,cAAc,CAAC,MAAM,CAAC,CAAC;gBACvB,IAAI,CAAC,CAAC,KAAK,YAAY,aAAa,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,aAAa,EAAE,oBAAoB,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACpK,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACjD,CAAC;QACL,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC1C,CAAC;IACD,KAAK,CAAC,YAAY,CAAC,KAAe,EAAE,KAAa,EAAE,MAAwB,EAAE,MAAoB;QAC7F,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAAC,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QAC/I,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;QAC7L,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAAC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAAC,aAAa,CAAC,SAAS,EAAE,EAAE,EAAE,4BAA4B,CAAC,CAAC;QACxL,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5M,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3J,IAAI,WAAW,EAAE,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,WAAW,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,kBAAkB,CAAC,8CAA8C,CAAC,CAAC;QACjN,IAAI,qBAAqB,CAAC,aAAa,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,GAAG,KAAK;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,uDAAuD,CAAC,CAAC;QAC3L,MAAM,WAAW,GAAG,sBAAsB,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QAAC,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAAC,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACtM,IAAI,WAAW,CAAC,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,gEAAgE,CAAC,CAAC;QAC/K,IAAI,QAAQ,CAAC,gBAAgB,KAAK,IAAI,IAAI,WAAW,IAAI,MAAM;YAAE,OAAO,OAAO,CAAC;QAChF,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAS,CAAC,CAAC;QAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC1F,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,MAAM,CAAC,SAAS,KAAK,eAAe,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,iEAAiE,CAAC,CAAC;QACtN,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAAC,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAAC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9O,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QACxF,IAAI,MAA8B,CAAC;QAAC,IAAI,YAAoC,CAAC;QAAC,IAAI,WAAmC,CAAC;QAAC,IAAI,MAA8B,CAAC;QAAC,IAAI,cAAsC,CAAC;QAAC,IAAI,SAAiC,CAAC;QAC7O,IAAI,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,2DAA2D,CAAC,CAAC;YACxJ,MAAM,GAAG,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YACzD,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,EAAE,uBAAuB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,yBAAyB,EAAE,SAAS,EAAE,sBAAsB,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1N,IAAI,2BAA2B,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,UAAU;gBAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,+DAA+D,CAAC,CAAC;YACrM,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM,GAAG,SAAS,CAAC;YACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5F,IAAI,CAAC;gBACD,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;gBAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAAC,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAC;gBAC9J,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;YACxL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAAC,MAAM,IAAI,mBAAmB,CAAC,yDAAyD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,CAAC;YAChJ,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9J,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YAC5G,IAAI,WAAW,EAAE,CAAC;gBAAC,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;gBAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC;oBAAE,MAAM,IAAI,aAAa,CAAC,0BAA0B,EAAE,6EAA6E,CAAC,CAAC;YAAC,CAAC;YAC/R,IAAI,MAAM,EAAE,CAAC;gBAAC,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;gBAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC;oBAAE,MAAM,IAAI,mBAAmB,CAAC,8DAA8D,CAAC,CAAC;YAAC,CAAC;YAC7O,MAAM,eAAe,GAAG,WAAW,EAAE,eAAe,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;YAC1G,MAAM,eAAe,GAAG,MAAM,EAAE,eAAe,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;YAC5G,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;gBACxC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,QAAQ;oBAAE,MAAM,IAAI,mBAAmB,CAAC,uDAAuD,CAAC,CAAC;gBACjI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;oBAAE,MAAM,IAAI,kBAAkB,CAAC,+DAA+D,CAAC,CAAC;gBAC5M,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,EAAE,GAAG,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;wBAC3J,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACjG,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,OAAO,SAAS,CAAC;QACrB,CAAC;gBAAS,CAAC;YACP,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,MAAM,YAAY,UAAU;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACpL,CAAC;IACL,CAAC;CACJ"}

package/dist/groups/state.d.ts

@@ -0,0 +1,39 @@
+import { ProtocolError } from '../errors.js';
+import { type GroupEvent, type GroupMember, type GroupState } from '../models/group-management.js';
+import { type GroupMessageEnvelope, type GroupRef } from '../models/groups.js';
+import { type DeviceCertificate } from '../models/identity.js';
+import type { NetworkContext } from '../protocol/context.js';
+export interface GroupProjectedMember extends GroupMember {
+    readonly joinedAtSequence: number;
+    readonly nickname?: string;
+    readonly nicknameSequence?: number;
+}
+export type GroupDeparture = 'left' | 'removed' | 'banned' | 'not_member';
+/** Local verified state. Relay previews must never be deserialized into this type. */
+export interface GroupProjection extends GroupRef {
+    readonly sequence: number;
+    readonly epoch: number;
+    readonly managementHash: string;
+    readonly clientSecretCommitment: string;
+    readonly state: GroupState;
+    readonly members: readonly GroupProjectedMember[];
+    readonly bans: readonly string[];
+    readonly departures: Readonly<Record<string, GroupDeparture>>;
+}
+export interface VerifiedGroupMessage {
+    readonly envelope: GroupMessageEnvelope;
+    readonly sender: DeviceCertificate;
+    readonly signerDeviceId: string;
+    readonly joinedAtSequence: number;
+}
+export type GroupChangeKind = 'properties' | 'members' | 'roles' | 'bans' | 'nickname' | 'status';
+export declare const groupChangeKinds: readonly GroupChangeKind[];
+export interface GroupEventResult {
+    readonly projection: GroupProjection;
+    readonly message?: VerifiedGroupMessage;
+    readonly rejection?: ProtocolError;
+    readonly changeKinds?: readonly GroupChangeKind[];
+}
+/** Applies one timeline event without mutating the preceding projection. Invalid administration stops the chain; invalid ordinary messages retain an explicit rejection. */
+export declare function applyGroupEvent(previous: GroupProjection | undefined, source: GroupEvent, certificate: DeviceCertificate | undefined, group: GroupRef, context: NetworkContext): GroupEventResult;
+//# sourceMappingURL=state.d.ts.map

package/dist/groups/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/groups/state.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EACH,KAAK,UAAU,EAA+B,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3H,OAAO,EAAgG,KAAK,oBAAoB,EAAE,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC7K,OAAO,EAAsC,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACnG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAI7D,MAAM,WAAW,oBAAqB,SAAQ,WAAW;IAAG,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE;AAC/J,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,YAAY,CAAC;AAC1E,sFAAsF;AACtF,MAAM,WAAW,eAAgB,SAAQ,QAAQ;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAC5H,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;CAClL;AACD,MAAM,WAAW,oBAAoB;IAAG,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE;AACzL,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAC;AAClG,eAAO,MAAM,gBAAgB,EAAE,SAAS,eAAe,EAAqE,CAAC;AAK7H,MAAM,WAAW,gBAAgB;IAAG,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE;AAE1M,4KAA4K;AAC5K,wBAAgB,eAAe,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,GAAG,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,GAAG,gBAAgB,CA6GjM"}