@primuslabs/fhetransform-sdk 0.4.0

package/dist/jazz/user-decrypt-p.js

@@ -0,0 +1,280 @@
+import { ethers } from "ethers";
+import { bytesToHex, fromHexString } from "../core/bytes.js";
+import { kms_combine_secret, kms_unsigncrypt } from "../core/kms.js";
+import { getHandleAbiType, getHandleFheType } from "../core/handle.js";
+import { logger } from "../core/logger.js";
+import { formatValue } from "../core/pretty-print.js";
+import { readKmsSignersInfo } from "./read-contract.js";
+import { aclAbi } from "../abis/acl.abi.js";
+import { FheErrorCode } from "../core/errors/error-codes.js";
+import { FheError } from "../core/errors/fhe-error.js";
+// ============================================================================
+// EIP-712 Constants
+// ============================================================================
+/**
+ * EIP-712 type definitions for KMS user decryption.
+ *
+ * CRITICAL: Field order is authoritative — it determines the EIP-712 type hash.
+ * Changing the order will produce a different signature and break on-chain verification.
+ * Must match the Solidity struct definition exactly.
+ */
+export const kmsUserDecryptEip712Types = {
+    EIP712Domain: [
+        { name: 'name', type: 'string' },
+        { name: 'version', type: 'string' },
+        { name: 'chainId', type: 'uint256' },
+        { name: 'verifyingContract', type: 'address' },
+    ],
+    // CRITICAL: Field order is authoritative — it determines the EIP-712 type hash.
+    // Changing the order will produce a different signature and break on-chain verification.
+    // Must match the Solidity struct definition exactly.
+    ResponseUserDecryptSignData: [
+        { name: 'publicKey', type: 'bytes' },
+        { name: 'ctHandles', type: 'bytes32[]' },
+        { name: 'userDecryptedData', type: 'bytes' },
+        { name: 'extraData', type: 'bytes' },
+    ],
+};
+// ============================================================================
+// Signature Verification
+// ============================================================================
+/**
+ * Verifies KMS user decryption EIP-712 signatures.
+ *
+ * This function:
+ * 1. Reconstructs the EIP-712 message from each share
+ * 2. Recovers the signer addresses from each signature
+ * 3. Verifies all recovered addresses are in the KMS signer set
+ * 4. Verifies the threshold is met
+ *
+ * @param client - The Jazz client instance
+ * @param params - Verification parameters (chainId, verifyingContract, handles, publicKey)
+ * @param shares - Array of KMS signcrypted shares
+ * @throws Error if verification fails (unknown signer, threshold not met, invalid signature)
+ */
+export async function verifyUserDecryptionSignatures(client, params, shares) {
+    // Enter method
+    logger.debug(() => ['[verifyUserDecryptionSignatures] Enter', formatValue({ params, shares })]);
+    // ============================================================================
+    // Step 1: Build EIP-712 Domain and Types
+    // ============================================================================
+    const domain = {
+        name: 'Decryption',
+        version: '1',
+        chainId: params.chainId,
+        verifyingContract: params.verifyingContract,
+    };
+    const types = kmsUserDecryptEip712Types;
+    const primaryType = 'ResponseUserDecryptSignData';
+    const primaryTypeFields = types[primaryType];
+    if (primaryTypeFields === undefined) {
+        logger.error('[verifyUserDecryptionSignatures] Primary type not found', {
+            primaryType,
+        });
+        throw new FheError({ code: FheErrorCode.Internal, message: `Primary type "${primaryType}" not found in types` });
+    }
+    const typesToSign = {
+        [primaryType]: [...primaryTypeFields],
+    };
+    // ============================================================================
+    // Step 2: Recover Signer Addresses
+    // ============================================================================
+    logger.debug('[verifyUserDecryptionSignatures] Recovering signer addresses', {
+        shareCount: shares.length,
+    });
+    const recoveredAddresses = await Promise.all(shares.map(async (share, index) => {
+        // Build message from share data
+        const message = {
+            publicKey: params.publicKey,
+            ctHandles: params.handles,
+            userDecryptedData: `0x${share.payload}`,
+            extraData: `0x${share.extraData}`,
+        };
+        const signature = `0x${share.signature}`;
+        logger.trace('[verifyUserDecryptionSignatures] Verifying share', {
+            index,
+            payloadLength: share.payload.length,
+            signatureLength: share.signature.length,
+            extraDataLength: share.extraData.length,
+        });
+        try {
+            const signerAddress = ethers.verifyTypedData(domain, typesToSign, message, signature);
+            logger.debug('[verifyUserDecryptionSignatures] Signature recovered', {
+                index,
+                signature: signature.substring(0, 20) + '...',
+                signerAddress,
+            });
+            return signerAddress;
+        }
+        catch (error) {
+            logger.error('[verifyUserDecryptionSignatures] Failed to recover signature', {
+                index,
+                error: error.message,
+            });
+            throw error;
+        }
+    }));
+    logger.debug('[verifyUserDecryptionSignatures] Recovered addresses', {
+        addresses: recoveredAddresses,
+    });
+    // ============================================================================
+    // Step 3: Verify Against KMS Signer Set
+    // ============================================================================
+    const { kmsSigners, userDecryptionThreshold } = await readKmsSignersInfo(client);
+    // Verify all recovered signers are in the KMS signer set
+    const isInclude = recoveredAddresses.every(item => kmsSigners.includes(item));
+    if (!isInclude) {
+        logger.error('[verifyUserDecryptionSignatures] Unknown KMS signer detected', {
+            recoveredAddresses,
+            allowedSigners: kmsSigners,
+        });
+        throw new FheError({ code: FheErrorCode.UnknownSigner, message: 'Unknown KMS Signer' });
+    }
+    // Verify threshold is met
+    if (recoveredAddresses.length < userDecryptionThreshold) {
+        logger.error('[verifyUserDecryptionSignatures] Threshold not met', {
+            recoveredCount: recoveredAddresses.length,
+            threshold: userDecryptionThreshold,
+        });
+        throw new FheError({ code: FheErrorCode.ThresholdNotMet, message: 'recovered signer addresses should >= threshold' });
+    }
+    logger.info('[verifyUserDecryptionSignatures] All signatures verified successfully', {
+        recoveredCount: recoveredAddresses.length,
+        threshold: userDecryptionThreshold,
+    });
+}
+// ============================================================================
+// KMS Decryption
+// ============================================================================
+/**
+ * Decrypts KMS signcrypted shares to recover plaintext values.
+ *
+ * This function:
+ * 1. Unsigncrypts each share using the KMS
+ * 2. Combines the shares to recover the secret
+ * 3. Decodes the recovered bytes to plaintext values
+ *
+ * @param handles - List of handles corresponding to the shares
+ * @param shares - Array of KMS signcrypted shares
+ * @param keypair - Transport key pair for decryption
+ * @returns Array of plaintext values
+ * @throws Error if decryption fails or shares are insufficient
+ */
+export async function decryptKmsSignedcryptedShares(handles, shares, keypair, kmsDecryptionSignerAddress) {
+    // Enter method
+    logger.debug(() => ['[decryptKmsSignedcryptedShares] Enter', formatValue({ handles, shares })]);
+    // ============================================================================
+    // Step 1: Validate Inputs
+    // ============================================================================
+    if (handles.length === 0) {
+        logger.error('[decryptKmsSignedcryptedShares] No handles provided');
+        throw new FheError({ code: FheErrorCode.EmptyInput, message: 'No handles provided for decryption' });
+    }
+    if (shares.length === 0) {
+        logger.error('[decryptKmsSignedcryptedShares] No shares provided');
+        throw new FheError({ code: FheErrorCode.EmptyInput, message: 'No shares provided for decryption' });
+    }
+    // TODO: Check shares.length >= threshold
+    // ============================================================================
+    // Step 2: Prepare Keys
+    // ============================================================================
+    const sk = fromHexString(keypair.privateKey);
+    const pk = fromHexString(keypair.publicKey);
+    // ============================================================================
+    // Step 3: Unsigncrypt Each Share
+    // ============================================================================
+    logger.debug('[decryptKmsSignedcryptedShares] Unsigncrypting shares', {
+        shareCount: shares.length,
+    });
+    const sharedValues = [];
+    const kmsSignerAddress = fromHexString(kmsDecryptionSignerAddress);
+    for (let i = 0; i < shares.length; i++) {
+        const share = shares[i];
+        const encryptedShare = fromHexString(share.payload);
+        logger.trace('[decryptKmsSignedcryptedShares] Unsigncrypting share', {
+            index: i,
+            encryptedShareLength: encryptedShare.length,
+        });
+        const sharedValue = kms_unsigncrypt(encryptedShare, kmsSignerAddress, sk, pk);
+        logger.debug(() => ['[decryptKmsSignedcryptedShares] Share unsigncrypted', {
+                index: i,
+                sharedValue: formatValue(sharedValue),
+            }]);
+        sharedValues.push(sharedValue);
+    }
+    // ============================================================================
+    // Step 4: Combine Shares
+    // ============================================================================
+    logger.debug('[decryptKmsSignedcryptedShares] Combining shares', {
+        shareCount: sharedValues.length,
+    });
+    const recovered = kms_combine_secret(sharedValues);
+    logger.debug('[decryptKmsSignedcryptedShares] Shares combined', {
+        recovered: bytesToHex(recovered)
+    });
+    // ============================================================================
+    // Step 5: Decode Recovered Data
+    // ============================================================================
+    const abiTypes = handles.map(h => getHandleAbiType(h));
+    logger.trace('[decryptKmsSignedcryptedShares] Decoding recovered data', {
+        abiTypes,
+        recoveredLength: recovered.length,
+    });
+    const abiCoder = ethers.AbiCoder.defaultAbiCoder();
+    const decoded = abiCoder.decode(abiTypes, recovered);
+    if (decoded.length !== handles.length) {
+        throw new FheError({
+            code: FheErrorCode.DecryptionFailed,
+            message: `Decoded value count (${decoded.length}) does not match handles (${handles.length})`,
+        });
+    }
+    logger.debug('[decryptKmsSignedcryptedShares] Values decoded', {
+        decodedCount: decoded.length,
+        decodedValues: decoded.map((v) => v.toString()),
+    });
+    // ============================================================================
+    // Step 6: Build Plaintext Results
+    // ============================================================================
+    const results = [];
+    for (let i = 0; i < handles.length; i++) {
+        const plaintext = {
+            type: getHandleFheType(handles[i]),
+            value: decoded[i],
+        };
+        results.push(plaintext);
+        logger.trace('[decryptKmsSignedcryptedShares] Plaintext constructed', {
+            index: i,
+            type: plaintext.type,
+            value: plaintext.value.toString(),
+        });
+    }
+    logger.info('[decryptKmsSignedcryptedShares] Decryption completed successfully', { results });
+    return results;
+}
+export async function checkUserDecryptPermission(client, params) {
+    const { aclContractAddress, userAddress, ctHandles, sanitizedPairs } = params;
+    const provider = await client.sdk.requireProvider();
+    const contract = new ethers.Contract(aclContractAddress, aclAbi, provider);
+    // Check user permission
+    const userCheckPromises = ctHandles.map(async (ctHandle) => {
+        const isUserAllowed = await contract.isAllowed(ctHandle, userAddress);
+        if (!isUserAllowed) {
+            throw new FheError({ code: FheErrorCode.PermissionDenied, message: `UserDecryption: not allowed ${ctHandle} for user ${userAddress}`, context: { handle: ctHandle, userAddress } });
+        }
+        return ctHandle;
+    });
+    await Promise.all(userCheckPromises);
+    // Check contract (dapp) permission
+    const contractCheckPromises = sanitizedPairs.map(async ({ handle, contractAddress }) => {
+        const isContractAllowed = await contract.isAllowed(handle, contractAddress);
+        if (!isContractAllowed) {
+            throw new FheError({ code: FheErrorCode.PermissionDenied, message: `UserDecryption: not allowed ${handle} for dapp ${contractAddress}`, context: { handle, contractAddress } });
+        }
+    });
+    await Promise.all(contractCheckPromises);
+    logger.debug('[checkUserDecryptPermission] ACL permissions verified', {
+        userAddress,
+        handleCount: ctHandles.length
+    });
+}
+//# sourceMappingURL=user-decrypt-p.js.map

package/dist/jazz/user-decrypt-p.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-decrypt-p.js","sourceRoot":"","sources":["../../src/jazz/user-decrypt-p.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGrE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGvE,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAsCvD,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA8B;IAClE,YAAY,EAAE;QACZ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;QAChC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;QACnC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;QACpC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE;KACtC;IACV,gFAAgF;IAChF,yFAAyF;IACzF,qDAAqD;IACrD,2BAA2B,EAAE;QAC3B,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;QACpC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE;QACxC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE;QAC5C,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;KAC5B;CACF,CAAC;AAEX,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,MAAmB,EACnB,MAKC,EACD,MAAsC;IAEtC,eAAe;IACf,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,wCAAwC,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAGhG,+EAA+E;IAC/E,yCAAyC;IACzC,+EAA+E;IAE/E,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KACnC,CAAC;IAEX,MAAM,KAAK,GAAG,yBAAyB,CAAC;IACxC,MAAM,WAAW,GAAG,6BAA6B,CAAC;IAElD,MAAM,iBAAiB,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,yDAAyD,EAAE;YACtE,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,iBAAiB,WAAW,sBAAsB,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,WAAW,GAAqC;QACpD,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC;KACtC,CAAC;IAEF,+EAA+E;IAC/E,mCAAmC;IACnC,+EAA+E;IAE/E,MAAM,CAAC,KAAK,CAAC,8DAA8D,EAAE;QAC3E,UAAU,EAAE,MAAM,CAAC,MAAM;KAC1B,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAG,MAAM,OAAO,CAAC,GAAG,CAC1C,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAA0B,EAAE,KAAa,EAAE,EAAE;QAC7D,gCAAgC;QAChC,MAAM,OAAO,GAAgC;YAC3C,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,OAAO;YACzB,iBAAiB,EAAE,KAAK,KAAK,CAAC,OAAO,EAAc;YACnD,SAAS,EAAE,KAAK,KAAK,CAAC,SAAS,EAAc;SAC9C,CAAC;QAEF,MAAM,SAAS,GAAG,KAAK,KAAK,CAAC,SAAS,EAAc,CAAC;QAErD,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE;YAC/D,KAAK;YACL,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YACnC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM;YACvC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YACtF,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE;gBACnE,KAAK;gBACL,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBAC7C,aAAa;aACd,CAAC,CAAC;YACH,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,8DAA8D,EAAE;gBAC3E,KAAK;gBACL,KAAK,EAAE,KAAK,CAAC,OAAO;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE;QACnE,SAAS,EAAE,kBAAkB;KAC9B,CAAC,CAAC;IAEH,+EAA+E;IAC/E,wCAAwC;IACxC,+EAA+E;IAC/E,MAAM,EAAE,UAAU,EAAE,uBAAuB,EAAE,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAEjF,yDAAyD;IACzD,MAAM,SAAS,GAAY,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,8DAA8D,EAAE;YAC3E,kBAAkB;YAClB,cAAc,EAAE,UAAU;SAC3B,CAAC,CAAC;QACH,MAAM,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,aAAa,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,0BAA0B;IAC1B,IAAI,kBAAkB,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QACxD,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE;YACjE,cAAc,EAAE,kBAAkB,CAAC,MAAM;YACzC,SAAS,EAAE,uBAAuB;SACnC,CAAC,CAAC;QACH,MAAM,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,eAAe,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC,CAAC;IACxH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,uEAAuE,EAAE;QACnF,cAAc,EAAE,kBAAkB,CAAC,MAAM;QACzC,SAAS,EAAE,uBAAuB;KACnC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAqB,EACrB,MAA6B,EAC7B,OAAyB,EACzB,0BAAmC;IAEnC,eAAe;IACf,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,uCAAuC,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAEhG,+EAA+E;IAC/E,0BAA0B;IAC1B,+EAA+E;IAE/E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACpE,MAAM,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;IACvG,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACnE,MAAM,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,yCAAyC;IAEzC,+EAA+E;IAC/E,uBAAuB;IACvB,+EAA+E;IAE/E,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAE5C,+EAA+E;IAC/E,iCAAiC;IACjC,+EAA+E;IAE/E,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;QACpE,UAAU,EAAE,MAAM,CAAC,MAAM;KAC1B,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,EAAE,CAAC;IACxB,MAAM,gBAAgB,GAAG,aAAa,CAAC,0BAA0B,CAAC,CAAC;IAEnE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEpD,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE;YACnE,KAAK,EAAE,CAAC;YACR,oBAAoB,EAAE,cAAc,CAAC,MAAM;SAC5C,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,eAAe,CAAC,cAAc,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAE9E,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,qDAAqD,EAAE;gBACzE,KAAK,EAAE,CAAC;gBACR,WAAW,EAAE,WAAW,CAAC,WAAW,CAAC;aACtC,CAAC,CAAC,CAAC;QAEJ,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IAED,+EAA+E;IAC/E,yBAAyB;IACzB,+EAA+E;IAE/E,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE;QAC/D,UAAU,EAAE,YAAY,CAAC,MAAM;KAChC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,iDAAiD,EAAE;QAC9D,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC;KACjC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,gCAAgC;IAChC,+EAA+E;IAE/E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,yDAAyD,EAAE;QACtE,QAAQ;QACR,eAAe,EAAE,SAAS,CAAC,MAAM;KAClC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAErD,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,YAAY,CAAC,gBAAgB;YACnC,OAAO,EAAE,wBAAwB,OAAO,CAAC,MAAM,6BAA6B,OAAO,CAAC,MAAM,GAAG;SAC9F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;QAC7D,YAAY,EAAE,OAAO,CAAC,MAAM;QAC5B,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;KACrD,CAAC,CAAC;IAEH,+EAA+E;IAC/E,kCAAkC;IAClC,+EAA+E;IAE/E,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,SAAS,GAAc;YAC3B,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;SAClB,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAExB,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;YACpE,KAAK,EAAE,CAAC;YACR,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,mEAAmE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAE9F,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAmB,EACnB,MAQC;IAED,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC;IAE9E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,QAAQ,CAClC,kBAAkB,EAClB,MAAM,EACN,QAAQ,CACT,CAAC;IAEF,wBAAwB;IACxB,MAAM,iBAAiB,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QACzD,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,gBAAgB,EAAE,OAAO,EAAE,+BAA+B,QAAQ,aAAa,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;QACtL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAErC,mCAAmC;IACnC,MAAM,qBAAqB,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAAE;QACrF,MAAM,iBAAiB,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAC5E,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,gBAAgB,EAAE,OAAO,EAAE,+BAA+B,MAAM,aAAa,eAAe,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAClL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAEzC,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;QACpE,WAAW;QACX,WAAW,EAAE,SAAS,CAAC,MAAM;KAC9B,CAAC,CAAC;AACL,CAAC"}

package/dist/jazz/user-decrypt.d.ts

@@ -0,0 +1,74 @@
+import { HandleLike, Plaintext } from "../core/fhe-type.js";
+import { Address } from "../core/primitives.js";
+import type { IJazzClient } from "./jazz-client-i.js";
+import { TransportKeyPair } from "./key-pair.js";
+import { SignedDecryptionPermit } from "./permit.js";
+import { JazzProcessOptions } from "./types/common.js";
+/**
+ * Configuration options for user decryption operations.
+ */
+export type UserDecryptOptions = JazzProcessOptions & {
+    checkPermissions?: boolean;
+};
+/**
+ * Input for user decryption: handle + contract address pair.
+ */
+export type UserDecryptInput = {
+    /** Ciphertext handle to decrypt */
+    readonly handle: HandleLike;
+    /** Contract address associated with the handle */
+    readonly contractAddress: Address;
+};
+/**
+ * Payload can be a single input or an array of inputs.
+ */
+export type UserDecryptPayload = UserDecryptInput | UserDecryptInput[];
+/**
+ * Parameters for user decryption operations.
+ *
+ * This is the public API that internally fetches or creates the keypair and permit.
+ */
+export type UserDecryptParameters<T extends UserDecryptPayload> = {
+    /** Handle-contract pairs to decrypt */
+    readonly payloads: T;
+    /** Additional options */
+    readonly options?: UserDecryptOptions;
+};
+/**
+ * Parameters for user decryption with pre-fetched keypair and permit.
+ *
+ * This is an internal variant used for testing/mock scenarios.
+ */
+export type UserDecryptParameters2<T extends UserDecryptPayload> = {
+    /** Handle-contract pairs to decrypt */
+    readonly payloads: T;
+    /** Pre-fetched transport key pair */
+    readonly transportKeyPair: TransportKeyPair;
+    /** Pre-fetched signed decryption permit */
+    readonly signedPermit: SignedDecryptionPermit;
+    /** Additional options */
+    readonly options?: UserDecryptOptions;
+};
+/**
+ * Result of a user decryption operation.
+ */
+export type UserDecryptResult<T extends UserDecryptPayload> = {
+    /** Decrypted plaintexts (single item or array matching input) */
+    readonly plaintexts: T extends HandleLike[] ? Plaintext[] : Plaintext;
+};
+/**
+ * Decrypts a value or batch of values using user decryption.
+ *
+ * This function handles the complete user decryption flow:
+ * 1. Gets or creates a transport key pair and decryption permit
+ * 2. Validates ACL permissions for each handle
+ * 3. Calls Jazz service for decryption shares
+ * 4. Verifies KMS signatures
+ * 5. Locally decrypts the shares to recover plaintexts
+ *
+ * @param client - The Jazz client instance
+ * @param parameters - User decryption parameters
+ * @returns UserDecryptResult containing plaintexts
+ * @throws Error if ACL check fails, decryption fails, or signature verification fails
+ */
+export declare function decryptUserValue<T extends UserDecryptPayload>(client: IJazzClient, parameters: UserDecryptParameters<T>): Promise<UserDecryptResult<T>>;

package/dist/jazz/user-decrypt.js

@@ -0,0 +1,143 @@
+import { formatValue } from "../core/pretty-print.js";
+import { fetchUserDecrypt } from "./module/fetch-user-decrypt.js";
+import { fetchUserDecrypt as fetchUserDecryptMock } from "./mock/fetch-user-decrypt.js";
+import { getOrCreateTKeyPairWithPermit } from "./permit.js";
+import { checkUserDecryptPermission, decryptKmsSignedcryptedShares, verifyUserDecryptionSignatures } from "./user-decrypt-p.js";
+import { logger } from "../core/logger.js";
+import { assertChecksumAddress } from "../core/address.js";
+import { FheTransformSDKEvents } from "../core/event.js";
+// ============================================================================
+// Main User Decryption Function
+// ============================================================================
+/**
+ * Decrypts a value or batch of values using user decryption.
+ *
+ * This function handles the complete user decryption flow:
+ * 1. Gets or creates a transport key pair and decryption permit
+ * 2. Validates ACL permissions for each handle
+ * 3. Calls Jazz service for decryption shares
+ * 4. Verifies KMS signatures
+ * 5. Locally decrypts the shares to recover plaintexts
+ *
+ * @param client - The Jazz client instance
+ * @param parameters - User decryption parameters
+ * @returns UserDecryptResult containing plaintexts
+ * @throws Error if ACL check fails, decryption fails, or signature verification fails
+ */
+export async function decryptUserValue(client, parameters) {
+    let t0;
+    // Enter method
+    logger.debug(() => ['[decryptUserValue] Enter', formatValue({ parameters })]);
+    const isArray = Array.isArray(parameters.payloads);
+    const items = (isArray ? parameters.payloads : [parameters.payloads]);
+    items.forEach(item => { assertChecksumAddress(item.contractAddress, "contractAddress"); });
+    const dappContractAddresses = items.map(item => item.contractAddress);
+    const ctHandles = items.map(item => item.handle);
+    const sanitizedPairs = items.map(item => ({
+        handle: item.handle,
+        contractAddress: item.contractAddress,
+    }));
+    logger.trace('[decryptUserValue] Sanitized pairs', { pairs: sanitizedPairs });
+    const isMock = client.sdk.isMock();
+    const chainId = await client.sdk.getChainID();
+    const sysContractInfo = await client.sdk.getSystemContractInfo();
+    // ============================================================================
+    // Step 0: Input Validation
+    // ============================================================================
+    // TODO: Add input validation here
+    // - Validate items are not empty
+    // - Validate each handle and contract address is valid
+    // ============================================================================
+    // Step 1: Get or Create Permit with Keypair
+    // ============================================================================
+    t0 = Date.now();
+    logger.debug('[decryptUserValue] Step 1: Getting or creating permit');
+    const { keypair, permit } = await getOrCreateTKeyPairWithPermit(client.sdk, dappContractAddresses);
+    logger.debug(() => ['[decryptUserValue] Permit and keypair ready', {
+            publicKey: formatValue(keypair.publicKey),
+            permit: formatValue(permit),
+        }]);
+    client.sdk.emitEvent({ type: FheTransformSDKEvents.GetOrCreateTKeyPairWithPermitEnd, durationMs: Date.now() - t0 });
+    // ============================================================================
+    // Step 2: Check ACL Permissions
+    // ============================================================================
+    if (parameters.options?.checkPermissions === true) {
+        logger.debug('[decryptUserValue] Step 2: Checking ACL permissions');
+        t0 = Date.now();
+        await checkUserDecryptPermission(client, {
+            aclContractAddress: sysContractInfo.aclContractAddress,
+            userAddress: permit.signerAddress,
+            ctHandles: [...ctHandles],
+            sanitizedPairs: sanitizedPairs,
+        });
+        client.sdk.emitEvent({ type: FheTransformSDKEvents.UserDecryptionPermissionCheckEnd, durationMs: Date.now() - t0 });
+    }
+    // ============================================================================
+    // Step 3: Call Jazz for Decryption
+    // ============================================================================
+    logger.debug('[decryptUserValue] Step 3: Fetching user decryption from Jazz');
+    const { signerAddress, signature } = permit;
+    const fetchUserDecryptParameters = {
+        payload: {
+            handleContractPairs: sanitizedPairs,
+            kmsDecryptEip712Signer: signerAddress,
+            kmsDecryptEip712Message: permit.eip712.message,
+            kmsDecryptEip712Signature: signature,
+        },
+        options: { ...parameters.options },
+    };
+    logger.debug(() => ['[decryptUserValue] User decryption fetch parameters', formatValue({ fetchUserDecryptParameters })]);
+    let result;
+    client.sdk.emitEvent({ type: FheTransformSDKEvents.FetchUserDecryptStart });
+    t0 = Date.now();
+    if (isMock) {
+        logger.trace('[decryptUserValue] Using mock mode for user decryption');
+        result = await fetchUserDecryptMock(client, fetchUserDecryptParameters, keypair);
+    }
+    else {
+        logger.trace('[decryptUserValue] Using production mode for user decryption');
+        result = await fetchUserDecrypt(client, fetchUserDecryptParameters);
+    }
+    client.sdk.emitEvent({ type: FheTransformSDKEvents.FetchUserDecryptEnd, durationMs: Date.now() - t0 });
+    logger.debug(() => ['[decryptUserValue] User decryption fetched', formatValue({ result })]);
+    // ============================================================================
+    // Step 4: Verify KMS Signatures
+    // ============================================================================
+    t0 = Date.now();
+    logger.debug('[decryptUserValue] Step 4: Verifying KMS signatures');
+    await verifyUserDecryptionSignatures(client, {
+        chainId: chainId,
+        verifyingContract: sysContractInfo.decryptionContractAddress,
+        handles: [...ctHandles],
+        publicKey: keypair.publicKey,
+    }, result);
+    logger.debug('[decryptUserValue] KMS signatures verified successfully');
+    client.sdk.emitEvent({ type: FheTransformSDKEvents.VerifyUserDecryptionSignaturesEnd, durationMs: Date.now() - t0 });
+    // ============================================================================
+    // Step 5: Local Decrypt
+    // ============================================================================
+    const signerAddressInfo = await client.sdk.getSignerAddressInfo();
+    t0 = Date.now();
+    logger.debug('[decryptUserValue] Step 5: Decrypting shares locally');
+    const results = await decryptKmsSignedcryptedShares(ctHandles, [...result], keypair, signerAddressInfo.kmsDecryptionSignerAddress);
+    logger.debug('[decryptUserValue] Shares decrypted locally', {
+        resultCount: results.length,
+        plaintexts: results.map((p, i) => ({
+            index: i,
+            type: p.type,
+            value: p.value.toString(),
+        })),
+    });
+    client.sdk.emitEvent({ type: FheTransformSDKEvents.DecryptKmsSignedcryptedSharessEnd, durationMs: Date.now() - t0 });
+    // ============================================================================
+    // Step 6: Return Result
+    // ============================================================================
+    logger.info('[decryptUserValue] User decryption completed successfully', {
+        resultCount: results.length,
+        isArray,
+    });
+    return {
+        plaintexts: isArray ? results : results[0],
+    };
+}
+//# sourceMappingURL=user-decrypt.js.map

package/dist/jazz/user-decrypt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-decrypt.js","sourceRoot":"","sources":["../../src/jazz/user-decrypt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAItD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,gBAAgB,IAAI,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,6BAA6B,EAA0B,MAAM,aAAa,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAChI,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAgEzD,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAE/E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAmB,EACnB,UAAoC;IAEpC,IAAI,EAAU,CAAC;IAEf,eAAe;IACf,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,0BAA0B,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;IAE9E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAuB,CAAC;IAC5F,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,qBAAqB,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;KACtC,CAAC,CAAC,CAAC;IACJ,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAE9E,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;IAC9C,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;IAGjE,+EAA+E;IAC/E,2BAA2B;IAC3B,+EAA+E;IAE/E,kCAAkC;IAClC,iCAAiC;IACjC,uDAAuD;IAEvD,+EAA+E;IAC/E,4CAA4C;IAC5C,+EAA+E;IAE/E,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChB,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACtE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,6BAA6B,CAAC,MAAM,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IACnG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,6CAA6C,EAAE;YACjE,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;YACzC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;SAC5B,CAAC,CAAC,CAAC;IACJ,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,qBAAqB,CAAC,gCAAgC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAEpH,+EAA+E;IAC/E,gCAAgC;IAChC,+EAA+E;IAC/E,IAAI,UAAU,CAAC,OAAO,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAEpE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,0BAA0B,CAAC,MAAM,EAAE;YACvC,kBAAkB,EAAE,eAAe,CAAC,kBAAkB;YACtD,WAAW,EAAE,MAAM,CAAC,aAAa;YACjC,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;YACzB,cAAc,EAAE,cAAc;SAC/B,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,qBAAqB,CAAC,gCAAgC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtH,CAAC;IAED,+EAA+E;IAC/E,mCAAmC;IACnC,+EAA+E;IAE/E,MAAM,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAE9E,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAE5C,MAAM,0BAA0B,GAAG;QACjC,OAAO,EAAE;YACP,mBAAmB,EAAE,cAAc;YACnC,sBAAsB,EAAE,aAAa;YACrC,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;YAC9C,yBAAyB,EAAE,SAAS;SACrC;QACD,OAAO,EAAE,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE;KACnC,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,qDAAqD,EAAE,WAAW,CAAC,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC,CAAC;IAEzH,IAAI,MAA8B,CAAC;IAEnC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,qBAAqB,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC5E,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACvE,MAAM,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,0BAA0B,EAAE,OAAO,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAC7E,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,qBAAqB,CAAC,mBAAmB,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAEvG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,4CAA4C,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAE5F,+EAA+E;IAC/E,gCAAgC;IAChC,+EAA+E;IAE/E,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChB,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACpE,MAAM,8BAA8B,CAClC,MAAM,EACN;QACE,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,eAAe,CAAC,yBAAyB;QAC5D,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC;QACvB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,EACD,MAAM,CACP,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACxE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,qBAAqB,CAAC,iCAAiC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAErH,+EAA+E;IAC/E,wBAAwB;IACxB,+EAA+E;IAE/E,MAAM,iBAAiB,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;IAClE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChB,MAAM,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,6BAA6B,CACjD,SAAS,EACT,CAAC,GAAG,MAAM,CAAC,EACX,OAAO,EACP,iBAAiB,CAAC,0BAA0B,CAC7C,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;QAC1D,WAAW,EAAE,OAAO,CAAC,MAAM;QAC3B,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,KAAK,EAAE,CAAC;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;SAC1B,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,qBAAqB,CAAC,iCAAiC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAErH,+EAA+E;IAC/E,wBAAwB;IACxB,+EAA+E;IAE/E,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;QACvE,WAAW,EAAE,OAAO,CAAC,MAAM;QAC3B,OAAO;KACR,CAAC,CAAC;IAEH,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACnB,CAAC;AAC5B,CAAC"}