@opendatalabs/personal-server-ts-core 0.0.1-canary.01ca694 → 0.0.1-canary.052d47e

package/dist/derivatives/e2ee/suite.d.ts

@@ -0,0 +1,56 @@
+/**
+ * E2EE v2 cipher suite `x25519-aes-256-gcm-hkdf-sha256` on WebCrypto only
+ * (X25519 deriveBits, HKDF-SHA256, AES-256-GCM, getRandomValues), so the
+ * same code runs in Node 22+ and in the browser (PS-Lite). No Node-only
+ * import lives in this directory.
+ *
+ * Wire format of one encrypted field value (spec section 4), lowercase hex:
+ *
+ *   ephemeral_public_key (32) || aes_gcm_nonce (12) || ciphertext || tag (16)
+ *
+ *   key = HKDF-SHA256(salt = none, ikm = X25519(ephemeral, recipient),
+ *                     info = "aci.e2ee.v2.x25519", len = 32)
+ *
+ * A fresh ephemeral key and AES-GCM nonce per field; the AAD is the JCS
+ * bytes built in aad.ts.
+ */
+export declare const E2EE_ALGO_X25519 = "x25519-aes-256-gcm-hkdf-sha256";
+export declare const E2EE_HKDF_INFO_X25519 = "aci.e2ee.v2.x25519";
+export interface E2eeKeyPair {
+    privateKey: CryptoKey;
+    /** Raw 32-byte X25519 public key. */
+    publicKey: Uint8Array;
+}
+export declare class E2eeCipherError extends Error {
+    constructor(message: string);
+}
+export declare function randomBytes(length: number): Uint8Array;
+export declare function bytesToHex(bytes: Uint8Array): string;
+export declare function hexToBytes(hex: string): Uint8Array;
+/** Spec section 4: hex with an optional `0x` prefix, 32 bytes for X25519. */
+export declare function parseX25519PublicKey(hex: string): Uint8Array;
+export declare function generateX25519KeyPair(): Promise<E2eeKeyPair>;
+/**
+ * Import a private key from its 32-byte seed. Only for tests and tooling
+ * that need a deterministic key; production keys come from generate.
+ */
+export declare function importX25519PrivateKey(seed: Uint8Array, publicKey: Uint8Array): Promise<E2eeKeyPair>;
+export interface EncryptFieldInput {
+    plaintext: string;
+    recipientPublicKey: Uint8Array;
+    aad: Uint8Array;
+    /** Test hooks: a fixed ephemeral key / nonce make the output reproducible. */
+    ephemeral?: E2eeKeyPair;
+    nonce?: Uint8Array;
+}
+/** One field value -> lowercase hex wire value. */
+export declare function encryptField(input: EncryptFieldInput): Promise<string>;
+export interface DecryptFieldInput {
+    /** Hex wire value (either case, optional 0x). */
+    wire: string;
+    privateKey: CryptoKey;
+    aad: Uint8Array;
+}
+/** Hex wire value -> plaintext; throws E2eeCipherError on any failure. */
+export declare function decryptField(input: DecryptFieldInput): Promise<string>;
+//# sourceMappingURL=suite.d.ts.map

package/dist/derivatives/e2ee/suite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suite.d.ts","sourceRoot":"","sources":["../../../src/derivatives/e2ee/suite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,gBAAgB,mCAAmC,CAAC;AACjE,eAAO,MAAM,qBAAqB,uBAAuB,CAAC;AAM1D,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,SAAS,CAAC;IACtB,qCAAqC;IACrC,SAAS,EAAE,UAAU,CAAC;CACvB;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAQD,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAItD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIpD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAWlD;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAM5D;AAoBD,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,WAAW,CAAC,CAMlE;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,WAAW,CAAC,CActB;AAmCD,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,UAAU,CAAC;IAC/B,GAAG,EAAE,UAAU,CAAC;IAChB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,mDAAmD;AACnD,wBAAsB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsB5E;AAED,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,SAAS,CAAC;IACtB,GAAG,EAAE,UAAU,CAAC;CACjB;AAED,0EAA0E;AAC1E,wBAAsB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAwC5E"}

package/dist/derivatives/e2ee/suite.js

@@ -0,0 +1,164 @@
+/**
+ * E2EE v2 cipher suite `x25519-aes-256-gcm-hkdf-sha256` on WebCrypto only
+ * (X25519 deriveBits, HKDF-SHA256, AES-256-GCM, getRandomValues), so the
+ * same code runs in Node 22+ and in the browser (PS-Lite). No Node-only
+ * import lives in this directory.
+ *
+ * Wire format of one encrypted field value (spec section 4), lowercase hex:
+ *
+ *   ephemeral_public_key (32) || aes_gcm_nonce (12) || ciphertext || tag (16)
+ *
+ *   key = HKDF-SHA256(salt = none, ikm = X25519(ephemeral, recipient),
+ *                     info = "aci.e2ee.v2.x25519", len = 32)
+ *
+ * A fresh ephemeral key and AES-GCM nonce per field; the AAD is the JCS
+ * bytes built in aad.ts.
+ */
+export const E2EE_ALGO_X25519 = "x25519-aes-256-gcm-hkdf-sha256";
+export const E2EE_HKDF_INFO_X25519 = "aci.e2ee.v2.x25519";
+const X25519_PUBLIC_KEY_BYTES = 32;
+const AES_GCM_NONCE_BYTES = 12;
+const AES_GCM_TAG_BYTES = 16;
+export class E2eeCipherError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "E2eeCipherError";
+    }
+}
+function subtle() {
+    const api = globalThis.crypto?.subtle;
+    if (!api)
+        throw new E2eeCipherError("WebCrypto is not available");
+    return api;
+}
+export function randomBytes(length) {
+    const bytes = new Uint8Array(length);
+    globalThis.crypto.getRandomValues(bytes);
+    return bytes;
+}
+export function bytesToHex(bytes) {
+    let out = "";
+    for (const byte of bytes)
+        out += byte.toString(16).padStart(2, "0");
+    return out;
+}
+export function hexToBytes(hex) {
+    const clean = hex.startsWith("0x") || hex.startsWith("0X") ? hex.slice(2) : hex;
+    if (clean.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(clean)) {
+        throw new E2eeCipherError("malformed hex");
+    }
+    const out = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < out.length; i += 1) {
+        out[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+/** Spec section 4: hex with an optional `0x` prefix, 32 bytes for X25519. */
+export function parseX25519PublicKey(hex) {
+    const bytes = hexToBytes(hex);
+    if (bytes.length !== X25519_PUBLIC_KEY_BYTES) {
+        throw new E2eeCipherError("X25519 public key must be 32 bytes");
+    }
+    return bytes;
+}
+function concat(...parts) {
+    const total = parts.reduce((sum, part) => sum + part.length, 0);
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const part of parts) {
+        out.set(part, offset);
+        offset += part.length;
+    }
+    return out;
+}
+/** Copy into a plain ArrayBuffer (WebCrypto rejects some typed-array views). */
+function toBuffer(bytes) {
+    const out = new ArrayBuffer(bytes.byteLength);
+    new Uint8Array(out).set(bytes);
+    return out;
+}
+export async function generateX25519KeyPair() {
+    const pair = (await subtle().generateKey({ name: "X25519" }, false, [
+        "deriveBits",
+    ]));
+    const raw = await subtle().exportKey("raw", pair.publicKey);
+    return { privateKey: pair.privateKey, publicKey: new Uint8Array(raw) };
+}
+/**
+ * Import a private key from its 32-byte seed. Only for tests and tooling
+ * that need a deterministic key; production keys come from generate.
+ */
+export async function importX25519PrivateKey(seed, publicKey) {
+    const b64u = (bytes) => btoa(String.fromCharCode(...bytes))
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+    const privateKey = await subtle().importKey("jwk", { kty: "OKP", crv: "X25519", d: b64u(seed), x: b64u(publicKey) }, { name: "X25519" }, false, ["deriveBits"]);
+    return { privateKey, publicKey };
+}
+async function deriveFieldKey(privateKey, peerPublicKey, usage) {
+    const api = subtle();
+    const peer = await api.importKey("raw", toBuffer(peerPublicKey), { name: "X25519" }, false, []);
+    const shared = await api.deriveBits({ name: "X25519", public: peer }, privateKey, X25519_PUBLIC_KEY_BYTES * 8);
+    const ikm = await api.importKey("raw", shared, "HKDF", false, ["deriveKey"]);
+    return api.deriveKey({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: new Uint8Array(0),
+        info: new TextEncoder().encode(E2EE_HKDF_INFO_X25519),
+    }, ikm, { name: "AES-GCM", length: 256 }, false, [usage]);
+}
+/** One field value -> lowercase hex wire value. */
+export async function encryptField(input) {
+    const ephemeral = input.ephemeral ?? (await generateX25519KeyPair());
+    const nonce = input.nonce ?? randomBytes(AES_GCM_NONCE_BYTES);
+    if (nonce.length !== AES_GCM_NONCE_BYTES) {
+        throw new E2eeCipherError("AES-GCM nonce must be 12 bytes");
+    }
+    const key = await deriveFieldKey(ephemeral.privateKey, input.recipientPublicKey, "encrypt");
+    const sealed = await subtle().encrypt({
+        name: "AES-GCM",
+        iv: toBuffer(nonce),
+        additionalData: toBuffer(input.aad),
+        tagLength: AES_GCM_TAG_BYTES * 8,
+    }, key, new TextEncoder().encode(input.plaintext));
+    return bytesToHex(concat(ephemeral.publicKey, nonce, new Uint8Array(sealed)));
+}
+/** Hex wire value -> plaintext; throws E2eeCipherError on any failure. */
+export async function decryptField(input) {
+    let bytes;
+    try {
+        bytes = hexToBytes(input.wire);
+    }
+    catch {
+        throw new E2eeCipherError("ciphertext is not hex");
+    }
+    const minimum = X25519_PUBLIC_KEY_BYTES + AES_GCM_NONCE_BYTES + AES_GCM_TAG_BYTES;
+    if (bytes.length < minimum) {
+        throw new E2eeCipherError("ciphertext is too short");
+    }
+    const ephemeralPublicKey = bytes.subarray(0, X25519_PUBLIC_KEY_BYTES);
+    const nonce = bytes.subarray(X25519_PUBLIC_KEY_BYTES, X25519_PUBLIC_KEY_BYTES + AES_GCM_NONCE_BYTES);
+    const sealed = bytes.subarray(X25519_PUBLIC_KEY_BYTES + AES_GCM_NONCE_BYTES);
+    let key;
+    try {
+        key = await deriveFieldKey(input.privateKey, ephemeralPublicKey, "decrypt");
+    }
+    catch {
+        throw new E2eeCipherError("key agreement failed");
+    }
+    let opened;
+    try {
+        opened = await subtle().decrypt({
+            name: "AES-GCM",
+            iv: toBuffer(nonce),
+            additionalData: toBuffer(input.aad),
+            tagLength: AES_GCM_TAG_BYTES * 8,
+        }, key, toBuffer(sealed));
+    }
+    catch {
+        throw new E2eeCipherError("authentication failed");
+    }
+    return new TextDecoder().decode(opened);
+}
+//# sourceMappingURL=suite.js.map

package/dist/derivatives/e2ee/suite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suite.js","sourceRoot":"","sources":["../../../src/derivatives/e2ee/suite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,gCAAgC,CAAC;AACjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AAE1D,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAQ7B,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,SAAS,MAAM;IACb,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,eAAe,CAAC,4BAA4B,CAAC,CAAC;IAClE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,KAAK,GACT,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACpE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,GAAG,KAAmB;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtB,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,SAAS,QAAQ,CAAC,KAAiB;IACjC,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE;QAClE,YAAY;KACb,CAAC,CAAkB,CAAC;IACrB,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5D,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAgB,EAChB,SAAqB;IAErB,MAAM,IAAI,GAAG,CAAC,KAAiB,EAAE,EAAE,CACjC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SAChC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxB,MAAM,UAAU,GAAG,MAAM,MAAM,EAAE,CAAC,SAAS,CACzC,KAAK,EACL,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAChE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;IACF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,UAAqB,EACrB,aAAyB,EACzB,KAA4B;IAE5B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAC9B,KAAK,EACL,QAAQ,CAAC,aAAa,CAAC,EACvB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,KAAK,EACL,EAAE,CACH,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CACjC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAChC,UAAU,EACV,uBAAuB,GAAG,CAAC,CAC5B,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC,SAAS,CAClB;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC;KACtD,EACD,GAAG,EACH,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,KAAK,CAAC,CACR,CAAC;AACJ,CAAC;AAWD,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAwB;IACzD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,MAAM,qBAAqB,EAAE,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QACzC,MAAM,IAAI,eAAe,CAAC,gCAAgC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,cAAc,CAC9B,SAAS,CAAC,UAAU,EACpB,KAAK,CAAC,kBAAkB,EACxB,SAAS,CACV,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC,OAAO,CACnC;QACE,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC;QACnB,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;QACnC,SAAS,EAAE,iBAAiB,GAAG,CAAC;KACjC,EACD,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAC1C,CAAC;IACF,OAAO,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AASD,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAwB;IACzD,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,uBAAuB,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,OAAO,GACX,uBAAuB,GAAG,mBAAmB,GAAG,iBAAiB,CAAC;IACpE,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,kBAAkB,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAC1B,uBAAuB,EACvB,uBAAuB,GAAG,mBAAmB,CAC9C,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,uBAAuB,GAAG,mBAAmB,CAAC,CAAC;IAC7E,IAAI,GAAc,CAAC;IACnB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,kBAAkB,EAAE,SAAS,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,MAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC,OAAO,CAC7B;YACE,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC;YACnB,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;YACnC,SAAS,EAAE,iBAAiB,GAAG,CAAC;SACjC,EACD,GAAG,EACH,QAAQ,CAAC,MAAM,CAAC,CACjB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,uBAAuB,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC"}

package/dist/derivatives/index.d.ts

@@ -0,0 +1,10 @@
+export { questionRegistrationView, type QuestionErrorCode, type QuestionRecompute, type QuestionRegisteredBy, type QuestionRegistration, type QuestionRegistrationPatch, type QuestionRegistrationView, type QuestionStatus, type QuestionStore, type QuestionStoreListFilter, } from "./types.js";
+export { createInMemoryQuestionStore, matchesQuestionFilter, sortQuestions, } from "./store.js";
+export { MAX_ECHOED_SCOPE_CHARS, MAX_MODEL_CHARS, MAX_QUESTION_CHARS, MAX_QUESTION_SOURCE_SCOPES, createQuestionRegistration, findDerivationCycle, parseQuestionInput, uncoveredSourceScopes, type CreateQuestionRegistrationInput, type ParsedQuestionInput, } from "./registration.js";
+export { DEFAULT_MAX_SOURCE_CHARS, DEFAULT_MAX_SOURCE_ITEMS, SYSTEM_PROMPT, buildQuestionMessages, parseAnswer, sortNewestFirst, trimSourceData, type ParsedAnswer, type PromptSource, type TrimResult, } from "./prompt.js";
+export { DEFAULT_INFERENCE_BASE_URL, DEFAULT_INFERENCE_MAX_TOKENS, DEFAULT_INFERENCE_MODEL, DEFAULT_INFERENCE_REQUEST_FIELDS, DEFAULT_INFERENCE_TIMEOUT_MS, InferenceRequestError, createFakeInferenceProvider, createOpenAiCompatibleInferenceProvider, type EncryptedInferenceRequest, type FakeInferenceProvider, type FakeInferenceProviderOptions, type InferenceChatInput, type InferenceChatResult, type InferenceMessage, type InferenceProvider, type InferenceRequestEncryption, type InferenceRole, type InferenceUsage, type OpenAiCompatibleInferenceOptions, } from "./inference.js";
+export { computeQuestion, type ComputeLogger, type ComputeOutcome, type ComputeSyncNotifier, type DerivativeAnswerRecord, type QuestionComputeDeps, } from "./compute.js";
+export { createRecomputeScheduler, type RecomputeScheduler, type RecomputeSchedulerOptions, type SchedulerTimers, } from "./scheduler.js";
+export { MAX_QUESTION_BODY_BYTES, handlePersonalServerDerivativesRequest, type PersonalServerDerivativesApiDeps, } from "./api.js";
+export { DEFAULT_E2EE_KEY_TTL_MS, E2EE_ALGO_X25519, E2eeAttestationError, E2eeCipherError, PHALA_GATEWAY_BASE_URL, createPhalaE2eeEncryption, fetchGatewayE2eeKey, verifyAciReportBinding, type AciAttestationReport, type E2eeAttestationErrorCode, type FetchGatewayE2eeKeyOptions, type GatewayE2eeKey, type PhalaE2eeEncryption, type PhalaE2eeEncryptionOptions, } from "./e2ee/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/derivatives/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/derivatives/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,uBAAuB,GAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,+BAA+B,EACpC,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,aAAa,EACb,qBAAqB,EACrB,WAAW,EACX,eAAe,EACf,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,UAAU,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,gCAAgC,EAChC,4BAA4B,EAC5B,qBAAqB,EACrB,2BAA2B,EAC3B,uCAAuC,EACvC,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,gCAAgC,GACtC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,sCAAsC,EACtC,KAAK,gCAAgC,GACtC,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAC/B,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,GAChC,MAAM,iBAAiB,CAAC"}

package/dist/derivatives/index.js

@@ -0,0 +1,10 @@
+export { questionRegistrationView, } from "./types.js";
+export { createInMemoryQuestionStore, matchesQuestionFilter, sortQuestions, } from "./store.js";
+export { MAX_ECHOED_SCOPE_CHARS, MAX_MODEL_CHARS, MAX_QUESTION_CHARS, MAX_QUESTION_SOURCE_SCOPES, createQuestionRegistration, findDerivationCycle, parseQuestionInput, uncoveredSourceScopes, } from "./registration.js";
+export { DEFAULT_MAX_SOURCE_CHARS, DEFAULT_MAX_SOURCE_ITEMS, SYSTEM_PROMPT, buildQuestionMessages, parseAnswer, sortNewestFirst, trimSourceData, } from "./prompt.js";
+export { DEFAULT_INFERENCE_BASE_URL, DEFAULT_INFERENCE_MAX_TOKENS, DEFAULT_INFERENCE_MODEL, DEFAULT_INFERENCE_REQUEST_FIELDS, DEFAULT_INFERENCE_TIMEOUT_MS, InferenceRequestError, createFakeInferenceProvider, createOpenAiCompatibleInferenceProvider, } from "./inference.js";
+export { computeQuestion, } from "./compute.js";
+export { createRecomputeScheduler, } from "./scheduler.js";
+export { MAX_QUESTION_BODY_BYTES, handlePersonalServerDerivativesRequest, } from "./api.js";
+export { DEFAULT_E2EE_KEY_TTL_MS, E2EE_ALGO_X25519, E2eeAttestationError, E2eeCipherError, PHALA_GATEWAY_BASE_URL, createPhalaE2eeEncryption, fetchGatewayE2eeKey, verifyAciReportBinding, } from "./e2ee/index.js";
+//# sourceMappingURL=index.js.map

package/dist/derivatives/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/derivatives/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,GAUzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,GAGtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,aAAa,EACb,qBAAqB,EACrB,WAAW,EACX,eAAe,EACf,cAAc,GAIf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,gCAAgC,EAChC,4BAA4B,EAC5B,qBAAqB,EACrB,2BAA2B,EAC3B,uCAAuC,GAYxC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,eAAe,GAMhB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,GAIzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,sCAAsC,GAEvC,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,GAOvB,MAAM,iBAAiB,CAAC"}

package/dist/derivatives/inference.d.ts

@@ -0,0 +1,151 @@
+/**
+ * Inference provider adapter for the derivative compute layer.
+ *
+ * One implementation: OpenAI-compatible chat completions over `fetch`, so it
+ * runs unchanged in Node and in the browser (PS-Lite). In production the
+ * base URL is the Vana inference relay, which holds the provider key; the
+ * optional API key header exists for local development against a provider
+ * directly.
+ *
+ * RELAY AUTH: the Vana inference relay
+ * (`POST /v1/inference/chat/completions` on the data gateway) only forwards
+ * a request that is signed by the owner or by one of the owner's ACTIVE
+ * registered servers, with the same Web3Signed scheme the lineage read uses
+ * (`RequestSigner`, see ../signing/request-signer.ts). Pass `requestSigner`
+ * and every relay call carries `Authorization: Web3Signed ...` over the
+ * exact bytes that go on the wire. `apiKey` is the local-development
+ * alternative (direct provider, `Authorization: Bearer`) and wins when both
+ * are set: a bearer key means "not the relay".
+ *
+ * E2EE SEAM: the Phala confidential-inference E2EE v2 protocol encrypts each
+ * `messages[i].content` to the gateway's attested public key and adds the
+ * headers X-E2EE-Version, X-Client-Pub-Key, X-Model-Pub-Key, X-E2EE-Nonce
+ * and X-E2EE-Timestamp; the response content comes back encrypted to the
+ * client key. `InferenceRequestEncryption` below is the hook, implemented
+ * by `createPhalaE2eeEncryption` in ./e2ee. This module only knows the
+ * shape: encrypt the outgoing messages, decrypt the one response field.
+ */
+import type { RequestSigner } from "../signing/request-signer.js";
+export type InferenceRole = "system" | "user" | "assistant";
+export interface InferenceMessage {
+    role: InferenceRole;
+    content: string;
+}
+export interface InferenceChatInput {
+    model: string;
+    messages: InferenceMessage[];
+    maxTokens?: number;
+}
+export interface InferenceUsage {
+    promptTokens?: number;
+    completionTokens?: number;
+    totalTokens?: number;
+}
+export interface InferenceChatResult {
+    content: string;
+    usage?: InferenceUsage;
+    /** `x-receipt-id` response header when the relay / provider sets one. */
+    receiptId?: string;
+    /** `x-aci-identity` response header (attested compute identity). */
+    aciIdentity?: string;
+}
+export interface InferenceProvider {
+    /** Model used when a registration names none. */
+    readonly defaultModel: string;
+    chat(input: InferenceChatInput): Promise<InferenceChatResult>;
+}
+/**
+ * One encrypted request: the messages to send and the decryptor bound to
+ * that request's context (nonce, timestamp, client key), since the response
+ * AAD is built from them.
+ */
+export interface EncryptedInferenceRequest {
+    messages: InferenceMessage[];
+    /**
+     * Decrypt one response field. `field` is the spec field path
+     * (`choices.{i}.message.content`), `id` the clear response `id` or "".
+     */
+    decryptResponse(input: {
+        content: string;
+        field: string;
+        id: string;
+        headers: Headers;
+    }): Promise<string>;
+}
+/**
+ * E2EE seam. Implement to encrypt message contents end to end (Phala E2EE
+ * v2); absent = plaintext over TLS to the relay. Runs inside
+ * `createOpenAiCompatibleInferenceProvider`, around the single fetch.
+ */
+export interface InferenceRequestEncryption {
+    /** Encrypt `messages[i].content` and add the X-E2EE-* request headers. */
+    encryptRequest(input: {
+        model: string;
+        messages: InferenceMessage[];
+        headers: Headers;
+    }): Promise<EncryptedInferenceRequest>;
+    /**
+     * Called once when the provider rejects the request (non-2xx) with the
+     * OpenAI-style `error.type` when the body carries one. Return true to
+     * re-encrypt and resend once (e.g. after `e2ee_model_key_mismatch`).
+     */
+    onRejected?(input: {
+        status: number;
+        errorType: string | null;
+        headers: Headers;
+    }): Promise<boolean>;
+}
+export declare const DEFAULT_INFERENCE_BASE_URL = "https://inference.phala.com/v1";
+export declare const DEFAULT_INFERENCE_MODEL = "z-ai/glm-5.3-flash";
+export declare const DEFAULT_INFERENCE_TIMEOUT_MS = 120000;
+export declare const DEFAULT_INFERENCE_MAX_TOKENS = 2048;
+export interface OpenAiCompatibleInferenceOptions {
+    /** Chat completions base, e.g. `https://inference.phala.com/v1`. */
+    baseUrl?: string;
+    /** Local development only; production relays hold the key. */
+    apiKey?: string;
+    /**
+     * Signs every request to the Vana inference relay as this personal server
+     * (the same signer the lineage client uses). Ignored when `apiKey` is set,
+     * which means the base URL is a provider, not the relay.
+     */
+    requestSigner?: RequestSigner;
+    model?: string;
+    timeoutMs?: number;
+    fetch?: typeof fetch;
+    /** E2EE seam; see the module comment. */
+    encryption?: InferenceRequestEncryption;
+    /**
+     * Extra body fields sent with every request. Defaults to the Vana / Phala
+     * routing hint `{ provider: { aci_verified: true, zdr: true } }`.
+     */
+    requestFields?: Record<string, unknown>;
+}
+export declare const DEFAULT_INFERENCE_REQUEST_FIELDS: Record<string, unknown>;
+/** Thrown for a non-2xx or malformed provider reply. Carries no prompt text. */
+export declare class InferenceRequestError extends Error {
+    readonly status: number | null;
+    /** OpenAI-style `error.type` of the rejection, when the body had one. */
+    readonly errorType: string | null;
+    /**
+     * Explicit retry hint. When undefined the compute layer falls back to the
+     * status: no response, 429 or 5xx are retried.
+     */
+    readonly retryable: boolean | undefined;
+    constructor(message: string, status: number | null, options?: {
+        errorType?: string | null;
+        retryable?: boolean;
+    });
+}
+export declare function createOpenAiCompatibleInferenceProvider(options?: OpenAiCompatibleInferenceOptions): InferenceProvider;
+export interface FakeInferenceProviderOptions {
+    model?: string;
+    /** Answer per call; a function sees the input and may throw. */
+    respond?: (input: InferenceChatInput, callIndex: number) => InferenceChatResult | Promise<InferenceChatResult>;
+}
+export interface FakeInferenceProvider extends InferenceProvider {
+    readonly calls: InferenceChatInput[];
+}
+/** Test double: records calls, answers with a fixed JSON object by default. */
+export declare function createFakeInferenceProvider(options?: FakeInferenceProviderOptions): FakeInferenceProvider;
+//# sourceMappingURL=inference.d.ts.map

package/dist/derivatives/inference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inference.d.ts","sourceRoot":"","sources":["../../src/derivatives/inference.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAC;AAE5D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC/D;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B;;;OAGG;IACH,eAAe,CAAC,KAAK,EAAE;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,OAAO,EAAE,OAAO,CAAC;KAClB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,cAAc,CAAC,KAAK,EAAE;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,gBAAgB,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,CAAC;KAClB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACvC;;;;OAIG;IACH,UAAU,CAAC,CAAC,KAAK,EAAE;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,OAAO,EAAE,OAAO,CAAC;KAClB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB;AAED,eAAO,MAAM,0BAA0B,mCAAmC,CAAC;AAC3E,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,eAAO,MAAM,4BAA4B,SAAU,CAAC;AACpD,eAAO,MAAM,4BAA4B,OAAQ,CAAC;AAElD,MAAM,WAAW,gCAAgC;IAC/C,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,yCAAyC;IACzC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACxC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,eAAO,MAAM,gCAAgC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAEpE,CAAC;AAEF,gFAAgF;AAChF,qBAAa,qBAAsB,SAAQ,KAAK;aAW5B,MAAM,EAAE,MAAM,GAAG,IAAI;IAVvC,yEAAyE;IACzE,SAAgB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC;;;OAGG;IACH,SAAgB,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;gBAG7C,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,GAAG,IAAI,EACrC,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO;CAOnE;AAmFD,wBAAgB,uCAAuC,CACrD,OAAO,GAAE,gCAAqC,GAC7C,iBAAiB,CA2JnB;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,OAAO,CAAC,EAAE,CACR,KAAK,EAAE,kBAAkB,EACzB,SAAS,EAAE,MAAM,KACd,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB;IAC9D,QAAQ,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC;CACtC;AAED,+EAA+E;AAC/E,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,4BAAiC,GACzC,qBAAqB,CAiBvB"}