@nopeek/chat 0.1.0

package/README.md

@@ -0,0 +1,17 @@
+# @nopeek/chat
+
+Official client SDK for **NoPeek** — end-to-end-encrypted messaging. The server
+only ever sees ciphertext; message bodies, attachments, and key backups are all
+encrypted on-device (MLS-style per-channel AES-256-GCM).
+
+```ts
+import { NoPeek } from "@nopeek/chat";
+
+const np = await NoPeek.connect({ apiUrl, appId, userId, sessionToken });
+const ch = await np.channels.create({ channelTypeKey: "direct", memberIds: [userId, peerId] });
+ch.on?.("message", (m) => console.log(m.body?.text));
+await ch.send({ text: "encrypted before it leaves this device" });
+```
+
+See the NoPeek API reference for the full surface (channels, messages, recovery,
+backups, bots). Used by the NoPeek messenger and by `@nopeek/agent-bridge`.

package/dist/crypto.d.ts

@@ -0,0 +1,80 @@
+/**
+ * NoPeek dev cipher suite ("npdev-1").
+ *
+ * Real client-side E2EE: per-channel AES-256-GCM content keys, distributed to
+ * member devices by wrapping under ECDH(P-256) shared secrets, riding the
+ * MLS delivery-service rails (key packages / welcome / commit) as opaque
+ * payloads. The server never sees key material or plaintext.
+ *
+ * Honest limitations vs. full MLS (RFC 9420), which this slot is shaped for
+ * (swap in mls-rs WASM without changing the wire contract): no ratcheting,
+ * so no forward secrecy / post-compromise security yet; membership changes
+ * SHOULD rotate the channel key (rotateKey() is provided; the SDK calls it on
+ * member removal).
+ */
+export declare const b64: {
+    enc: (buf: ArrayBuffer | Uint8Array) => string;
+    dec: (s: string) => Uint8Array<ArrayBuffer>;
+};
+export interface DeviceKeyPair {
+    publicKeyJwk: JsonWebKey;
+    privateKeyJwk: JsonWebKey;
+}
+export declare function generateDeviceKeys(): Promise<DeviceKeyPair>;
+/** Key-package payload published to the registry (opaque to the server). */
+export declare function keyPackageData(deviceId: string, publicKeyJwk: JsonWebKey): string;
+export declare function sha256hex(data: string): Promise<string>;
+export declare function generateChannelKey(): Promise<CryptoKey>;
+/**
+ * Derive an AES-256-GCM backup key from a human recovery code (PBKDF2-SHA-256,
+ * WebCrypto-native, no argon2 wasm dependency). The recovery code is shown to
+ * the user ONCE; NoPeek never sees it or the derived key — this is what makes
+ * WhatsApp-style restore work without Matrix-grade key management.
+ */
+export declare function deriveBackupKey(recoveryCode: string, saltB64: string, iterations?: number): Promise<CryptoKey>;
+/** A friendly recovery code: 4 groups of 4 crockford-base32 chars (e.g. K7QP-3M9X-...). */
+export declare function generateRecoveryCode(): string;
+/**
+ * OPTIONAL key escrow: wrap raw key bytes under a server-published RSA public
+ * key (base64 SPKI, RSA-OAEP with SHA-256 — matches Erlang
+ * :rsa_pkcs1_oaep_padding + rsa_oaep_md/rsa_mgf1_md :sha256 on the unwrap
+ * side; parity-tested). A 32-byte data key fits RSA-2048-OAEP (~190B limit).
+ * The escrow PRIVATE key never reaches clients — only the workspace-opt-in
+ * server endpoint can unwrap (email+password-only recovery; see backup()).
+ */
+export declare function rsaOaepWrapB64(spkiB64: string, raw: Uint8Array<ArrayBuffer>): Promise<string>;
+export declare function generateContentKey(): Promise<CryptoKey>;
+export declare function exportRawKeyB64(key: CryptoKey): Promise<string>;
+export declare function importRawKeyB64(raw: string): Promise<CryptoKey>;
+/** Encrypt raw bytes with a content key. Returns the IV (b64) and ciphertext bytes. */
+export declare function encryptBytes(key: CryptoKey, bytes: ArrayBuffer): Promise<{
+    iv: string;
+    data: Uint8Array<ArrayBuffer>;
+}>;
+export declare function decryptBytes(keyB64: string, ivB64: string, ct: ArrayBuffer): Promise<ArrayBuffer>;
+/**
+ * Deterministically derive an AES-256-GCM channel key from a shared secret and
+ * the channel id (HKDF-SHA-256). Every member holding `secret` derives the same
+ * key with no key distribution — used by preshared-key mode. The secret never
+ * leaves the client, so the server still only sees ciphertext.
+ */
+export declare function deriveSharedChannelKey(secret: string, channelId: string): Promise<CryptoKey>;
+export declare function exportChannelKey(key: CryptoKey): Promise<string>;
+export declare function importChannelKey(raw: string): Promise<CryptoKey>;
+export interface WrappedKey {
+    deviceId: string;
+    /** Ephemeral sender public key for this wrap. */
+    epk: JsonWebKey;
+    iv: string;
+    ct: string;
+}
+/** Wrap a channel key to a set of recipient devices (one ECDH each, fresh ephemeral key per wrap). */
+export declare function wrapChannelKey(channelKey: CryptoKey, recipients: {
+    deviceId: string;
+    publicKeyJwk: JsonWebKey;
+}[]): Promise<WrappedKey[]>;
+export declare function unwrapChannelKey(wrapped: WrappedKey, devicePrivateJwk: JsonWebKey): Promise<CryptoKey>;
+/** Encrypt an application payload (the EncryptedPayload JSON) for a channel. */
+export declare function encryptPayload(channelKey: CryptoKey, payload: unknown): Promise<string>;
+export declare function decryptPayload<T = unknown>(channelKey: CryptoKey, ciphertext: string): Promise<T>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,eAAO,MAAM,GAAG;eACH,WAAW,GAAG,UAAU,KAAG,MAAM;aAMnC,MAAM,KAAG,UAAU,CAAC,WAAW,CAAC;CAM1C,CAAC;AAKF,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,UAAU,CAAC;IACzB,aAAa,EAAE,UAAU,CAAC;CAC3B;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,aAAa,CAAC,CAMjE;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,GAAG,MAAM,CAEjF;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG7D;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,SAAS,CAAC,CAE7D;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,SAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CASrH;AAED,2FAA2F;AAC3F,wBAAgB,oBAAoB,IAAI,MAAM,CAK7C;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAGnG;AAKD,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,SAAS,CAAC,CAE7D;AACD,wBAAsB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE;AACD,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAErE;AACD,uFAAuF;AACvF,wBAAsB,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;CAAE,CAAC,CAI7H;AACD,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAGvG;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CASlG;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAEtE;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAEtE;AAWD,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,GAAG,EAAE,UAAU,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,sGAAsG;AACtG,wBAAsB,cAAc,CAClC,UAAU,EAAE,SAAS,EACrB,UAAU,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,UAAU,CAAA;CAAE,EAAE,GAC3D,OAAO,CAAC,UAAU,EAAE,CAAC,CAYvB;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAI5G;AAED,gFAAgF;AAChF,wBAAsB,cAAc,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAO7F;AAED,wBAAsB,cAAc,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAMvG"}

package/dist/crypto.js

@@ -0,0 +1,161 @@
+/**
+ * NoPeek dev cipher suite ("npdev-1").
+ *
+ * Real client-side E2EE: per-channel AES-256-GCM content keys, distributed to
+ * member devices by wrapping under ECDH(P-256) shared secrets, riding the
+ * MLS delivery-service rails (key packages / welcome / commit) as opaque
+ * payloads. The server never sees key material or plaintext.
+ *
+ * Honest limitations vs. full MLS (RFC 9420), which this slot is shaped for
+ * (swap in mls-rs WASM without changing the wire contract): no ratcheting,
+ * so no forward secrecy / post-compromise security yet; membership changes
+ * SHOULD rotate the channel key (rotateKey() is provided; the SDK calls it on
+ * member removal).
+ */
+const subtle = globalThis.crypto.subtle;
+export const b64 = {
+    enc: (buf) => {
+        const bytes = buf instanceof Uint8Array ? buf : new Uint8Array(buf);
+        let s = "";
+        for (const b of bytes)
+            s += String.fromCharCode(b);
+        return btoa(s);
+    },
+    dec: (s) => {
+        const bin = atob(s);
+        const out = new Uint8Array(new ArrayBuffer(bin.length));
+        for (let i = 0; i < bin.length; i++)
+            out[i] = bin.charCodeAt(i);
+        return out;
+    },
+};
+const te = new TextEncoder();
+const td = new TextDecoder();
+export async function generateDeviceKeys() {
+    const pair = await subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveKey", "deriveBits"]);
+    return {
+        publicKeyJwk: await subtle.exportKey("jwk", pair.publicKey),
+        privateKeyJwk: await subtle.exportKey("jwk", pair.privateKey),
+    };
+}
+/** Key-package payload published to the registry (opaque to the server). */
+export function keyPackageData(deviceId, publicKeyJwk) {
+    return b64.enc(te.encode(JSON.stringify({ suite: "npdev-1", deviceId, pub: publicKeyJwk })));
+}
+export async function sha256hex(data) {
+    const digest = await subtle.digest("SHA-256", te.encode(data));
+    return [...new Uint8Array(digest)].map((x) => x.toString(16).padStart(2, "0")).join("");
+}
+export async function generateChannelKey() {
+    return subtle.generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt", "decrypt"]);
+}
+/**
+ * Derive an AES-256-GCM backup key from a human recovery code (PBKDF2-SHA-256,
+ * WebCrypto-native, no argon2 wasm dependency). The recovery code is shown to
+ * the user ONCE; NoPeek never sees it or the derived key — this is what makes
+ * WhatsApp-style restore work without Matrix-grade key management.
+ */
+export async function deriveBackupKey(recoveryCode, saltB64, iterations = 210_000) {
+    const ikm = await subtle.importKey("raw", te.encode(recoveryCode), "PBKDF2", false, ["deriveKey"]);
+    return subtle.deriveKey({ name: "PBKDF2", salt: b64.dec(saltB64), iterations, hash: "SHA-256" }, ikm, { name: "AES-GCM", length: 256 }, true, ["encrypt", "decrypt"]);
+}
+/** A friendly recovery code: 4 groups of 4 crockford-base32 chars (e.g. K7QP-3M9X-...). */
+export function generateRecoveryCode() {
+    const alphabet = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+    const bytes = globalThis.crypto.getRandomValues(new Uint8Array(10));
+    const chars = [...bytes].map((b) => alphabet[b % 32]).join("");
+    return chars.match(/.{1,4}/g).join("-");
+}
+/**
+ * OPTIONAL key escrow: wrap raw key bytes under a server-published RSA public
+ * key (base64 SPKI, RSA-OAEP with SHA-256 — matches Erlang
+ * :rsa_pkcs1_oaep_padding + rsa_oaep_md/rsa_mgf1_md :sha256 on the unwrap
+ * side; parity-tested). A 32-byte data key fits RSA-2048-OAEP (~190B limit).
+ * The escrow PRIVATE key never reaches clients — only the workspace-opt-in
+ * server endpoint can unwrap (email+password-only recovery; see backup()).
+ */
+export async function rsaOaepWrapB64(spkiB64, raw) {
+    const pub = await subtle.importKey("spki", b64.dec(spkiB64), { name: "RSA-OAEP", hash: "SHA-256" }, false, ["encrypt"]);
+    return b64.enc(await subtle.encrypt({ name: "RSA-OAEP" }, pub, raw));
+}
+// --- attachment (blob) encryption: fresh per-file AES key, key travels inside
+//     the E2EE message payload; only ciphertext is uploaded to S3 -----------
+export async function generateContentKey() {
+    return subtle.generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt", "decrypt"]);
+}
+export async function exportRawKeyB64(key) {
+    return b64.enc(await subtle.exportKey("raw", key));
+}
+export async function importRawKeyB64(raw) {
+    return subtle.importKey("raw", b64.dec(raw), { name: "AES-GCM" }, true, ["encrypt", "decrypt"]);
+}
+/** Encrypt raw bytes with a content key. Returns the IV (b64) and ciphertext bytes. */
+export async function encryptBytes(key, bytes) {
+    const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+    const ct = await subtle.encrypt({ name: "AES-GCM", iv }, key, bytes);
+    return { iv: b64.enc(iv), data: new Uint8Array(ct) };
+}
+export async function decryptBytes(keyB64, ivB64, ct) {
+    const key = await importRawKeyB64(keyB64);
+    return subtle.decrypt({ name: "AES-GCM", iv: b64.dec(ivB64) }, key, ct);
+}
+/**
+ * Deterministically derive an AES-256-GCM channel key from a shared secret and
+ * the channel id (HKDF-SHA-256). Every member holding `secret` derives the same
+ * key with no key distribution — used by preshared-key mode. The secret never
+ * leaves the client, so the server still only sees ciphertext.
+ */
+export async function deriveSharedChannelKey(secret, channelId) {
+    const ikm = await subtle.importKey("raw", te.encode(secret), "HKDF", false, ["deriveKey"]);
+    return subtle.deriveKey({ name: "HKDF", hash: "SHA-256", salt: te.encode("nopeek/channel/v1"), info: te.encode(channelId) }, ikm, { name: "AES-GCM", length: 256 }, true, ["encrypt", "decrypt"]);
+}
+export async function exportChannelKey(key) {
+    return b64.enc(await subtle.exportKey("raw", key));
+}
+export async function importChannelKey(raw) {
+    return subtle.importKey("raw", b64.dec(raw), { name: "AES-GCM" }, true, ["encrypt", "decrypt"]);
+}
+async function deriveWrapKey(privateJwk, publicJwk) {
+    const priv = await subtle.importKey("jwk", privateJwk, { name: "ECDH", namedCurve: "P-256" }, false, ["deriveKey"]);
+    const pub = await subtle.importKey("jwk", publicJwk, { name: "ECDH", namedCurve: "P-256" }, false, []);
+    return subtle.deriveKey({ name: "ECDH", public: pub }, priv, { name: "AES-GCM", length: 256 }, false, [
+        "encrypt",
+        "decrypt",
+    ]);
+}
+/** Wrap a channel key to a set of recipient devices (one ECDH each, fresh ephemeral key per wrap). */
+export async function wrapChannelKey(channelKey, recipients) {
+    const raw = await exportChannelKey(channelKey);
+    const out = [];
+    for (const r of recipients) {
+        const eph = await subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveKey"]);
+        const ephPrivJwk = await subtle.exportKey("jwk", eph.privateKey);
+        const wrapKey = await deriveWrapKey(ephPrivJwk, r.publicKeyJwk);
+        const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+        const ct = await subtle.encrypt({ name: "AES-GCM", iv }, wrapKey, te.encode(raw));
+        out.push({ deviceId: r.deviceId, epk: await subtle.exportKey("jwk", eph.publicKey), iv: b64.enc(iv), ct: b64.enc(ct) });
+    }
+    return out;
+}
+export async function unwrapChannelKey(wrapped, devicePrivateJwk) {
+    const wrapKey = await deriveWrapKey(devicePrivateJwk, wrapped.epk);
+    const raw = await subtle.decrypt({ name: "AES-GCM", iv: b64.dec(wrapped.iv) }, wrapKey, b64.dec(wrapped.ct));
+    return importChannelKey(td.decode(raw));
+}
+/** Encrypt an application payload (the EncryptedPayload JSON) for a channel. */
+export async function encryptPayload(channelKey, payload) {
+    const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+    const ct = await subtle.encrypt({ name: "AES-GCM", iv }, channelKey, te.encode(JSON.stringify(payload)));
+    const framed = new Uint8Array(iv.length + ct.byteLength);
+    framed.set(iv, 0);
+    framed.set(new Uint8Array(ct), iv.length);
+    return b64.enc(framed);
+}
+export async function decryptPayload(channelKey, ciphertext) {
+    const framed = b64.dec(ciphertext);
+    const iv = framed.slice(0, 12);
+    const ct = framed.slice(12);
+    const pt = await subtle.decrypt({ name: "AES-GCM", iv }, channelKey, ct);
+    return JSON.parse(td.decode(pt));
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;AAExC,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,GAAG,EAAE,CAAC,GAA6B,EAAU,EAAE;QAC7C,MAAM,KAAK,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,GAAG,EAAE,CAAC,CAAS,EAA2B,EAAE;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAC;AAEF,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC;AAC7B,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC;AAO7B,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;IAChH,OAAO;QACL,YAAY,EAAE,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;QAC3D,aAAa,EAAE,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,YAAwB;IACvE,OAAO,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY;IAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,YAAoB,EAAE,OAAe,EAAE,UAAU,GAAG,OAAO;IAC/F,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IACnG,OAAO,MAAM,CAAC,SAAS,CACrB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EACvE,GAAG,EACH,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,oBAAoB;IAClC,MAAM,QAAQ,GAAG,kCAAkC,CAAC;IACpD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,KAAK,CAAC,SAAS,CAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,GAA4B;IAChF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACxH,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAC5F,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAc;IAClD,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW;IAC/C,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAClG,CAAC;AACD,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAc,EAAE,KAAkB;IACnE,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACrE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,KAAa,EAAE,EAAe;IAC/E,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAAc,EAAE,SAAiB;IAC5E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,SAAS,CACrB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EACnG,GAAG,EACH,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAc;IACnD,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,UAAsB,EAAE,SAAqB;IACxE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IACpH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACvG,OAAO,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE;QACpG,SAAS;QACT,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAUD,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAqB,EACrB,UAA4D;IAE5D,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QACjG,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAClF,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAmB,EAAE,gBAA4B;IACtF,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7G,OAAO,gBAAgB,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAqB,EAAE,OAAgB;IAC1E,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAClB,MAAM,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAc,UAAqB,EAAE,UAAkB;IACzF,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAM,CAAC;AACxC,CAAC"}