@sempdev/semp 0.4.3

package/dist/keys/device_certificate.js

@@ -0,0 +1,328 @@
+/**
+ * Scoped device certificates per KEY.md §10.3.
+ *
+ * A `SEMP_DEVICE_CERTIFICATE` binds a delegated device's public key
+ * to a permission scope and is signed by an existing full-access
+ * device of the account (the issuer). The home server enforces the
+ * scope on every relevant operation by the delegated device.
+ *
+ * This module provides:
+ *
+ *   - {@link DeviceCertificate} typed shape + the supporting
+ *     {@link Scope}, {@link ScopeMatcher}, {@link ScopeResource},
+ *     {@link ScopeEntry}, {@link RateLimitTier} types.
+ *   - {@link signDeviceCertificate}: build + Ed25519-sign a certificate
+ *     under the issuing device's signing seed (path
+ *     `signature.value`, prefix `SEMP-DEVICE-AUTHORIZE:`).
+ *   - {@link verifyDeviceCertificate}: Ed25519-verify against the
+ *     issuer's published device public key.
+ *   - {@link validateDeviceCertificate}: structural checks per
+ *     §10.3.2 / §10.3.3 / §10.3.8 (lifetime cap, scope rules).
+ *   - {@link scopeAllowsRecipient} / {@link scopeAllowsSender}:
+ *     enforcement helpers that the home server invokes on each
+ *     operation per §10.3.4.
+ *
+ * @module
+ */
+import { signSignedDoc, verifySignedDoc } from "./signed.js";
+/** `type` discriminator for a device certificate. */
+export const DeviceCertificateType = "SEMP_DEVICE_CERTIFICATE";
+/** Domain-separation prefix for the issuer signature, per ENVELOPE.md §4.3. */
+export const DeviceAuthorizePrefix = "SEMP-DEVICE-AUTHORIZE:";
+/** Combined cap on `allow + deny` size in a single matcher per §10.3.3.1. */
+export const MaxScopeMatcherEntries = 10_000;
+/** Cap on rate-limit tiers per scope field per §10.3.3.3. */
+export const MaxScopeRateLimitTiers = 16;
+/** Cap on certificate lifetime per §10.3.8: 365 days, in milliseconds. */
+export const MaxDeviceCertificateLifetimeMs = 365 * 24 * 3600 * 1000;
+/**
+ * Compute the issuer's signature over the canonical certificate
+ * bytes, then return a copy with `signature.{algorithm,key_id,value}`
+ * populated. Pre-populates the algorithm + key_id BEFORE
+ * canonicalization so the canonical bytes cover both — an attacker
+ * cannot downgrade the signing algorithm or forge a different
+ * issuer fingerprint.
+ */
+export function signDeviceCertificate(input) {
+    if (input.issuerKeyId === "") {
+        throw new Error("device certificate: empty issuer key_id");
+    }
+    validateDeviceCertificate(input.certificate, { skipSignatureCheck: true });
+    const preSign = {
+        ...input.certificate,
+        signature: {
+            algorithm: "ed25519",
+            key_id: input.issuerKeyId,
+            value: "",
+        },
+    };
+    const { signedJSON, signatureB64 } = signSignedDoc({
+        preSignJSON: preSign,
+        seed: input.issuerSigningSeed,
+        signaturePath: "signature.value",
+        prefix: DeviceAuthorizePrefix,
+    });
+    return {
+        certificate: signedJSON,
+        signatureB64,
+    };
+}
+/**
+ * Ed25519-verify a certificate's signature under `issuerPub`. Returns
+ * true when the signature verifies. Does NOT cross-check that the
+ * issuer is currently a registered, non-revoked full-access device
+ * for the account — that requires a key directory store and is the
+ * caller's responsibility.
+ */
+export function verifyDeviceCertificate(certificate, issuerPub) {
+    validateDeviceCertificate(certificate);
+    if (certificate.signature.value === "") {
+        return false;
+    }
+    const { ok } = verifySignedDoc({
+        signedJSON: certificate,
+        publicKey: issuerPub,
+        signaturePath: "signature.value",
+        prefix: DeviceAuthorizePrefix,
+    });
+    return ok;
+}
+/**
+ * Structural validation per §10.3.2 / §10.3.3 / §10.3.8. Throws on
+ * the first violation. Does NOT verify the signature; pair with
+ * {@link verifyDeviceCertificate}.
+ */
+export function validateDeviceCertificate(c, opts = {}) {
+    if (c.type !== DeviceCertificateType) {
+        throw new Error(`device certificate: type ${JSON.stringify(c.type)}, want ${DeviceCertificateType}`);
+    }
+    if (typeof c.version !== "string" || c.version === "") {
+        throw new Error("device certificate: missing version");
+    }
+    for (const f of ["device_id", "device_public_key", "account", "issued_by"]) {
+        if (typeof c[f] !== "string" || c[f] === "") {
+            throw new Error(`device certificate: missing ${f}`);
+        }
+    }
+    for (const f of ["issued_at", "expires_at"]) {
+        if (typeof c[f] !== "string" || c[f] === "") {
+            throw new Error(`device certificate: missing ${f}`);
+        }
+    }
+    const issued = Date.parse(c.issued_at);
+    const expires = Date.parse(c.expires_at);
+    if (Number.isNaN(issued)) {
+        throw new Error(`device certificate: issued_at is not ISO 8601: ${c.issued_at}`);
+    }
+    if (Number.isNaN(expires)) {
+        throw new Error(`device certificate: expires_at is not ISO 8601: ${c.expires_at}`);
+    }
+    if (expires <= issued) {
+        throw new Error("device certificate: expires_at MUST be after issued_at");
+    }
+    if (expires - issued > MaxDeviceCertificateLifetimeMs) {
+        throw new Error(`device certificate: lifetime ${expires - issued} ms exceeds 365-day cap (KEY.md §10.3.8)`);
+    }
+    validateScope(c.scope);
+    if (typeof c.signature?.algorithm !== "string" || c.signature.algorithm === "") {
+        throw new Error("device certificate: missing signature.algorithm");
+    }
+    if (typeof c.signature?.key_id !== "string" || c.signature.key_id === "") {
+        throw new Error("device certificate: missing signature.key_id");
+    }
+    if (typeof c.signature?.value !== "string") {
+        throw new Error("device certificate: signature.value must be a string");
+    }
+    if (!opts.skipSignatureCheck && c.signature.value === "") {
+        throw new Error("device certificate: signature.value is empty (unsigned)");
+    }
+}
+/** Structural validation of a {@link Scope} per §10.3.3. */
+export function validateScope(scope) {
+    if (scope === undefined || scope === null) {
+        throw new Error("scope: missing");
+    }
+    validateMatcher(scope.send, "scope.send", false);
+    validateMatcher(scope.receive, "scope.receive", true);
+    validateResource(scope.blocklist, "scope.blocklist");
+    validateResource(scope.keys, "scope.keys");
+    validateResource(scope.devices, "scope.devices");
+}
+function validateMatcher(m, path, allowDeliveryStage) {
+    if (m === undefined || m === null) {
+        throw new Error(`${path}: missing`);
+    }
+    if (!Array.isArray(m.rate_limits)) {
+        throw new Error(`${path}.rate_limits: missing or not an array`);
+    }
+    validateRateLimits(m.rate_limits, `${path}.rate_limits`);
+    const allow = m.allow ?? [];
+    const deny = m.deny ?? [];
+    switch (m.mode) {
+        case "unrestricted":
+        case "none":
+            if (allow.length > 0 || deny.length > 0) {
+                throw new Error(`${path}: mode=${m.mode} requires allow + deny absent or empty`);
+            }
+            break;
+        case "restricted":
+            if (allow.length === 0) {
+                throw new Error(`${path}: mode=restricted requires non-empty allow`);
+            }
+            if (deny.length > 0) {
+                throw new Error(`${path}: mode=restricted forbids deny`);
+            }
+            break;
+        case "denylist":
+            if (deny.length === 0) {
+                throw new Error(`${path}: mode=denylist requires non-empty deny`);
+            }
+            if (allow.length > 0) {
+                throw new Error(`${path}: mode=denylist forbids allow`);
+            }
+            break;
+        default:
+            throw new Error(`${path}: invalid mode ${JSON.stringify(m.mode)}`);
+    }
+    if (allow.length + deny.length > MaxScopeMatcherEntries) {
+        throw new Error(`${path}: allow + deny size ${allow.length + deny.length} exceeds cap ${MaxScopeMatcherEntries}`);
+    }
+    for (let i = 0; i < allow.length; i++) {
+        validateScopeEntry(allow[i], `${path}.allow[${i}]`);
+    }
+    for (let i = 0; i < deny.length; i++) {
+        validateScopeEntry(deny[i], `${path}.deny[${i}]`);
+    }
+    if (m.delivery_stage !== undefined) {
+        if (!allowDeliveryStage) {
+            throw new Error(`${path}: delivery_stage MUST be omitted on send matcher`);
+        }
+        if (!Number.isInteger(m.delivery_stage) || m.delivery_stage < 1) {
+            throw new Error(`${path}.delivery_stage: ${m.delivery_stage} MUST be a positive integer`);
+        }
+    }
+}
+function validateScopeEntry(e, path) {
+    switch (e.type) {
+        case "user":
+            if (typeof e.address !== "string" || e.address === "") {
+                throw new Error(`${path}: type=user requires address`);
+            }
+            break;
+        case "domain":
+            if (typeof e.domain !== "string" || e.domain === "") {
+                throw new Error(`${path}: type=domain requires domain`);
+            }
+            break;
+        case "server":
+            // Spec allows either `server` or `domain` as the matching key on
+            // server entries; the example schemas in DELIVERY.md §5.3 use
+            // `server`, but the device-cert example uses `domain`. Accept
+            // either.
+            if ((typeof e.server !== "string" || e.server === "") &&
+                (typeof e.domain !== "string" || e.domain === "")) {
+                throw new Error(`${path}: type=server requires server or domain`);
+            }
+            break;
+        default:
+            throw new Error(`${path}: invalid entity type ${JSON.stringify(e.type)}`);
+    }
+}
+function validateResource(r, path) {
+    if (r === undefined || r === null) {
+        throw new Error(`${path}: missing`);
+    }
+    if (typeof r.read !== "boolean") {
+        throw new Error(`${path}.read: must be boolean`);
+    }
+    if (typeof r.write !== "boolean") {
+        throw new Error(`${path}.write: must be boolean`);
+    }
+    if (!Array.isArray(r.rate_limits)) {
+        throw new Error(`${path}.rate_limits: missing or not an array`);
+    }
+    validateRateLimits(r.rate_limits, `${path}.rate_limits`);
+}
+function validateRateLimits(tiers, path) {
+    if (tiers.length > MaxScopeRateLimitTiers) {
+        throw new Error(`${path}: ${tiers.length} tiers exceeds cap ${MaxScopeRateLimitTiers}`);
+    }
+    for (let i = 0; i < tiers.length; i++) {
+        const t = tiers[i];
+        if (!Number.isInteger(t.period_seconds) || t.period_seconds < 1) {
+            throw new Error(`${path}[${i}].period_seconds: ${t.period_seconds} MUST be >= 1`);
+        }
+        if (!Number.isInteger(t.amount_allowed) || t.amount_allowed < 0) {
+            throw new Error(`${path}[${i}].amount_allowed: ${t.amount_allowed} MUST be >= 0`);
+        }
+    }
+}
+/**
+ * Report whether `matcher` permits sending to `recipient` per
+ * §10.3.3.1. Does NOT evaluate rate limits — the caller applies
+ * rate-limit tiers separately per §10.3.4.
+ */
+export function scopeAllowsRecipient(matcher, recipient) {
+    switch (matcher.mode) {
+        case "unrestricted":
+            return true;
+        case "none":
+            return false;
+        case "restricted":
+            return matchAny(matcher.allow ?? [], recipient);
+        case "denylist":
+            return !matchAny(matcher.deny ?? [], recipient);
+        default:
+            // Unknown mode — fail closed.
+            return false;
+    }
+}
+/**
+ * Report whether `matcher` permits receiving from `sender` per
+ * §10.3.3.1. Identical evaluation to {@link scopeAllowsRecipient};
+ * separate name reads clearly at call sites.
+ */
+export function scopeAllowsSender(matcher, sender) {
+    return scopeAllowsRecipient(matcher, sender);
+}
+function matchAny(entries, addr) {
+    const peer = addr.address.toLowerCase();
+    const peerDomain = peer.includes("@") ? peer.split("@").pop() ?? "" : "";
+    const peerServer = (addr.server ?? "").toLowerCase();
+    for (const entry of entries) {
+        switch (entry.type) {
+            case "user":
+                if (typeof entry.address === "string" &&
+                    entry.address !== "" &&
+                    entry.address.toLowerCase() === peer) {
+                    return true;
+                }
+                break;
+            case "domain":
+                if (typeof entry.domain === "string" &&
+                    entry.domain !== "" &&
+                    entry.domain.toLowerCase() === peerDomain) {
+                    return true;
+                }
+                break;
+            case "server": {
+                const ent = (entry.server ?? entry.domain ?? "").toLowerCase();
+                if (ent === "") {
+                    continue;
+                }
+                // Server entries match either the routing server hostname (when
+                // known) or the recipient's domain (which is approximately the
+                // server identity for direct-domain deployments).
+                if (peerServer !== "" && ent === peerServer) {
+                    return true;
+                }
+                if (peerServer === "" && ent === peerDomain) {
+                    return true;
+                }
+                break;
+            }
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=device_certificate.js.map

package/dist/keys/device_certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device_certificate.js","sourceRoot":"","sources":["../../src/keys/device_certificate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE7D,qDAAqD;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAE/D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAE9D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE7C,6DAA6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AA0FrE;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAiC;IAEjC,IAAI,KAAK,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,yBAAyB,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3E,MAAM,OAAO,GAAsB;QACjC,GAAG,KAAK,CAAC,WAAW;QACpB,SAAS,EAAE;YACT,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,KAAK,CAAC,WAAW;YACzB,KAAK,EAAE,EAAE;SACV;KACF,CAAC;IAEF,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC;QACjD,WAAW,EAAE,OAA6C;QAC1D,IAAI,EAAE,KAAK,CAAC,iBAAiB;QAC7B,aAAa,EAAE,iBAAiB;QAChC,MAAM,EAAE,qBAAqB;KAC9B,CAAC,CAAC;IAEH,OAAO;QACL,WAAW,EAAE,UAA0C;QACvD,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAA8B,EAC9B,SAAqB;IAErB,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,GAAG,eAAe,CAAC;QAC7B,UAAU,EAAE,WAAiD;QAC7D,SAAS,EAAE,SAAS;QACpB,aAAa,EAAE,iBAAiB;QAChC,MAAM,EAAE,qBAAqB;KAC9B,CAAC,CAAC;IACH,OAAO,EAAE,CAAC;AACZ,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,CAAoB,EACpB,OAAwB,EAAE;IAE1B,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,qBAAqB,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,WAAW,CAAU,EAAE,CAAC;QACpF,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAU,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,GAAG,MAAM,GAAG,8BAA8B,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,gCAAgC,OAAO,GAAG,MAAM,0CAA0C,CAC3F,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAEvB,IAAI,OAAO,CAAC,CAAC,SAAS,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,aAAa,CAAC,KAAY;IACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IACD,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IACjD,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;IACtD,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IACrD,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC3C,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,eAAe,CACtB,CAAe,EACf,IAAY,EACZ,kBAA2B;IAE3B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAClE,CAAC;IACD,kBAAkB,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,cAAc,CAAC,CAAC;IAEzD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC1B,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,cAAc,CAAC;QACpB,KAAK,MAAM;YACT,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,wCAAwC,CAChE,CAAC;YACJ,CAAC;YACD,MAAM;QACR,KAAK,YAAY;YACf,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4CAA4C,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gCAAgC,CAAC,CAAC;YAC3D,CAAC;YACD,MAAM;QACR,KAAK,UAAU;YACb,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yCAAyC,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM;QACR;YACE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kBAAkB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,uBAAuB,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,gBAAgB,sBAAsB,EAAE,CACjG,CAAC;IACJ,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAe,EAAE,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAe,EAAE,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kDAAkD,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,oBAAoB,CAAC,CAAC,cAAc,6BAA6B,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAa,EAAE,IAAY;IACrD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,MAAM;YACT,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;YACzD,CAAC;YACD,MAAM;QACR,KAAK,QAAQ;YACX,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM;QACR,KAAK,QAAQ;YACX,iEAAiE;YACjE,8DAA8D;YAC9D,8DAA8D;YAC9D,UAAU;YACV,IACE,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC;gBACjD,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,EACjD,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yCAAyC,CAAC,CAAC;YACpE,CAAC;YACD,MAAM;QACR;YACE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yBAAyB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAgB,EAAE,IAAY;IACtD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yBAAyB,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAClE,CAAC;IACD,kBAAkB,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,cAAc,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAsB,EAAE,IAAY;IAC9D,IAAI,KAAK,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,KAAK,KAAK,CAAC,MAAM,sBAAsB,sBAAsB,EAAE,CACvE,CAAC;IACJ,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAkB,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,IAAI,CAAC,qBAAqB,CAAC,CAAC,cAAc,eAAe,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,IAAI,CAAC,qBAAqB,CAAC,CAAC,cAAc,eAAe,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAaD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAqB,EACrB,SAA0B;IAE1B,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,cAAc;YACjB,OAAO,IAAI,CAAC;QACd,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf,KAAK,YAAY;YACf,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;QAClD,KAAK,UAAU;YACb,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;QAClD;YACE,8BAA8B;YAC9B,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAqB,EACrB,MAAuB;IAEvB,OAAO,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,OAAqB,EAAE,IAAqB;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,MAAM;gBACT,IACE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;oBACjC,KAAK,CAAC,OAAO,KAAK,EAAE;oBACpB,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI,EACpC,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM;YACR,KAAK,QAAQ;gBACX,IACE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;oBAChC,KAAK,CAAC,MAAM,KAAK,EAAE;oBACnB,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,UAAU,EACzC,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM;YACR,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC/D,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;oBACf,SAAS;gBACX,CAAC;gBACD,gEAAgE;gBAChE,+DAA+D;gBAC/D,kDAAkD;gBAClD,IAAI,UAAU,KAAK,EAAE,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;oBAC5C,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,IAAI,UAAU,KAAK,EAAE,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;oBAC5C,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/keys/device_records.d.ts

@@ -0,0 +1,175 @@
+/**
+ * Multi-device record primitives per KEY.md §10.1, §10.5, §10.6.
+ *
+ * Three record kinds share an account-identity-key signature on the
+ * outer envelope so a home server or correspondent can verify
+ * "this record was authored by the account's current identity key"
+ * without knowing the device graph in advance:
+ *
+ *   - {@link DeviceRegistration} (`SEMP_DEVICE`, step="register"):
+ *     announces a new device. Carries device pubkey, role, and an
+ *     INNER authorization signature from an existing full-access
+ *     device that authorized the enrollment (§10.2).
+ *   - {@link DeviceRevocation} (`SEMP_DEVICE_REVOCATION`): removes
+ *     a device from the active set per §10.5.
+ *   - {@link DeviceDirectory} (`SEMP_DEVICE_DIRECTORY`): the
+ *     home server's signed list of currently active devices, with
+ *     a monotonically increasing revision so correspondents can
+ *     detect rollback per §10.6.
+ *
+ * The SEMP_DEVICE_CERTIFICATE (scoped delegation) lives in
+ * {@link "./device_certificate"}.
+ *
+ * @module
+ */
+/** Wire-level type discriminators. */
+export declare const DeviceRegistrationType = "SEMP_DEVICE";
+export declare const DeviceRegistrationStep = "register";
+export declare const DeviceRevocationType = "SEMP_DEVICE_REVOCATION";
+export declare const DeviceDirectoryType = "SEMP_DEVICE_DIRECTORY";
+export declare const DeviceRecordVersion = "1.0.0";
+/** Domain-separation prefixes per ENVELOPE.md §4.3. */
+export declare const DeviceRegisterPrefix = "SEMP-DEVICE-REGISTER:";
+export declare const DeviceAuthorizeRecordPrefix = "SEMP-DEVICE-AUTHORIZE:";
+export declare const DeviceRevocationPrefix = "SEMP-DEVICE-REVOCATION:";
+export declare const DeviceDirectoryPrefix = "SEMP-DEVICE-DIRECTORY:";
+/** Device authority levels per §10.1. */
+export type DeviceRole = "full_access" | "delegated";
+/** Authorization methods per §10.2.1. */
+export type DeviceAuthorizationMethod = "qr_scan" | "numeric_code";
+/** Reasons a device may be revoked per §10.5.2. */
+export type DeviceRevocationReason = "key_compromise" | "lost" | "retired" | "superseded";
+/**
+ * Report whether `r` is the kind of revocation that triggers
+ * mandatory identity-key rotation per §10.5.5.
+ */
+export declare function requiresIdentityRotation(r: DeviceRevocationReason): boolean;
+/** Reusable signature block. */
+export interface KeysSignature {
+    algorithm: string;
+    key_id: string;
+    value: string;
+}
+/** Inner authorization block embedded in a {@link DeviceRegistration}. */
+export interface DeviceAuthorization {
+    method: DeviceAuthorizationMethod;
+    authorizing_device_id: string;
+    authorizing_signature: KeysSignature;
+}
+/** SEMP_DEVICE register record per §10.1. */
+export interface DeviceRegistration {
+    type: typeof DeviceRegistrationType;
+    step: typeof DeviceRegistrationStep;
+    version: string;
+    user_id: string;
+    device_id: string;
+    device_name: string;
+    device_type: string;
+    device_public_key: string;
+    device_identity_pubkey_algorithm: string;
+    /** ISO 8601 UTC. */
+    enrolled_at: string;
+    role: DeviceRole;
+    /** For `delegated`: matches a SEMP_DEVICE_CERTIFICATE device_id. For `full_access`: null. */
+    certificate_id: string | null;
+    authorization: DeviceAuthorization;
+    signature: KeysSignature;
+}
+/** SEMP_DEVICE_REVOCATION record per §10.5.1. */
+export interface DeviceRevocation {
+    type: typeof DeviceRevocationType;
+    version: string;
+    user_id: string;
+    device_id: string;
+    reason: DeviceRevocationReason;
+    /** ISO 8601 UTC. */
+    revoked_at: string;
+    revoked_by_device_id: string;
+    /** Non-null only for reason="superseded". */
+    replacement_device_id: string | null;
+    signature: KeysSignature;
+}
+/** One entry inside a {@link DeviceDirectory} per §10.6.1. */
+export interface DeviceDirectoryEntry {
+    device_id: string;
+    device_public_key: string;
+    device_identity_pubkey_algorithm: string;
+    role: DeviceRole;
+    certificate_id: string | null;
+    /** ISO 8601 UTC. */
+    enrolled_at: string;
+    device_name: string;
+    device_type: string;
+}
+/** SEMP_DEVICE_DIRECTORY record per §10.6.1. */
+export interface DeviceDirectory {
+    type: typeof DeviceDirectoryType;
+    version: string;
+    user_id: string;
+    /** Monotonically non-decreasing per emission. */
+    revision: number;
+    /** ISO 8601 UTC. */
+    issued_at: string;
+    devices: DeviceDirectoryEntry[];
+    signature: KeysSignature;
+}
+/**
+ * Inputs to {@link signDeviceAuthorization}. The signature covers the
+ * length-prefixed (NUL-separated) concatenation of
+ * `device_id || device_public_key || enrolled_at || enroll_nonce`,
+ * prefixed with `SEMP-DEVICE-AUTHORIZE:`.
+ */
+export interface SignDeviceAuthorizationInput {
+    /** The half-built registration; `authorization` will be replaced. */
+    registration: DeviceRegistration;
+    /** 32-byte Ed25519 secret seed for the authorizing full-access device. */
+    authorizingDeviceSeed: Uint8Array;
+    /** Stable id of the authorizing device. */
+    authorizingDeviceId: string;
+    /** Lowercase-hex SHA-256 fingerprint of the authorizing device pub. */
+    authorizingDeviceKeyId: string;
+    /** Fresh 32-byte enrollment nonce (single-use per attempt). */
+    enrollNonce: Uint8Array;
+    /** `qr_scan` or `numeric_code`. */
+    method: DeviceAuthorizationMethod;
+}
+/**
+ * Sign the inner authorization block and place it on
+ * `registration.authorization`. The caller MUST have populated
+ * `registration.device_id`, `device_public_key`, `enrolled_at`
+ * before calling.
+ */
+export declare function signDeviceAuthorization(input: SignDeviceAuthorizationInput): void;
+/**
+ * Verify the inner authorizing-device signature on `registration`
+ * using the supplied authorizing-device public key and the SAME
+ * `enrollNonce` that was used at sign time. Returns true on success.
+ */
+export declare function verifyDeviceAuthorization(registration: DeviceRegistration, authorizingDevicePub: Uint8Array, enrollNonce: Uint8Array): boolean;
+/** Sign the outer identity-key signature on a registration record. */
+export declare function signDeviceRegistration(reg: DeviceRegistration, identityPriv: Uint8Array, identityKeyId: string): string;
+/** Verify the outer identity-key signature on a registration record. */
+export declare function verifyDeviceRegistration(reg: DeviceRegistration, identityPub: Uint8Array): boolean;
+/** Structural validation per §10.1. Throws on first violation. */
+export declare function validateDeviceRegistration(reg: DeviceRegistration, opts?: {
+    skipSignatureCheck?: boolean;
+}): void;
+/** Sign the identity-key signature on a device revocation record. */
+export declare function signDeviceRevocation(rev: DeviceRevocation, identityPriv: Uint8Array, identityKeyId: string): string;
+/** Verify a device revocation record. */
+export declare function verifyDeviceRevocation(rev: DeviceRevocation, identityPub: Uint8Array): boolean;
+/** Structural validation per §10.5.1. Throws on first violation. */
+export declare function validateDeviceRevocation(rev: DeviceRevocation, opts?: {
+    skipSignatureCheck?: boolean;
+}): void;
+/** Sign the identity-key signature on a device directory record. */
+export declare function signDeviceDirectory(dir: DeviceDirectory, identityPriv: Uint8Array, identityKeyId: string): string;
+/** Verify a device directory record. */
+export declare function verifyDeviceDirectory(dir: DeviceDirectory, identityPub: Uint8Array): boolean;
+/** Structural validation per §10.6.1. Throws on first violation. */
+export declare function validateDeviceDirectory(dir: DeviceDirectory, opts?: {
+    skipSignatureCheck?: boolean;
+}): void;
+/** Look up a device entry by id. Returns null when not found. */
+export declare function findDevice(dir: DeviceDirectory, deviceId: string): DeviceDirectoryEntry | null;
+//# sourceMappingURL=device_records.d.ts.map

package/dist/keys/device_records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device_records.d.ts","sourceRoot":"","sources":["../../src/keys/device_records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,sCAAsC;AACtC,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AACpD,eAAO,MAAM,sBAAsB,aAAa,CAAC;AACjD,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAC3D,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C,uDAAuD;AACvD,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAC5D,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AACpE,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAChE,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAE9D,yCAAyC;AACzC,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,WAAW,CAAC;AAErD,yCAAyC;AACzC,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,cAAc,CAAC;AAEnE,mDAAmD;AACnD,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,GAChB,MAAM,GACN,SAAS,GACT,YAAY,CAAC;AAEjB;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAE3E;AAED,gCAAgC;AAChC,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,yBAAyB,CAAC;IAClC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB,EAAE,aAAa,CAAC;CACtC;AAED,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,sBAAsB,CAAC;IACpC,IAAI,EAAE,OAAO,sBAAsB,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gCAAgC,EAAE,MAAM,CAAC;IACzC,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,UAAU,CAAC;IACjB,6FAA6F;IAC7F,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,mBAAmB,CAAC;IACnC,SAAS,EAAE,aAAa,CAAC;CAC1B;AAED,iDAAiD;AACjD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,oBAAoB,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,oBAAoB;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,6CAA6C;IAC7C,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,SAAS,EAAE,aAAa,CAAC;CAC1B;AAED,8DAA8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gCAAgC,EAAE,MAAM,CAAC;IACzC,IAAI,EAAE,UAAU,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,OAAO,mBAAmB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,SAAS,EAAE,aAAa,CAAC;CAC1B;AAKD;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C,qEAAqE;IACrE,YAAY,EAAE,kBAAkB,CAAC;IACjC,0EAA0E;IAC1E,qBAAqB,EAAE,UAAU,CAAC;IAClC,2CAA2C;IAC3C,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,sBAAsB,EAAE,MAAM,CAAC;IAC/B,+DAA+D;IAC/D,WAAW,EAAE,UAAU,CAAC;IACxB,mCAAmC;IACnC,MAAM,EAAE,yBAAyB,CAAC;CACnC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,4BAA4B,GAClC,IAAI,CAoCN;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,kBAAkB,EAChC,oBAAoB,EAAE,UAAU,EAChC,WAAW,EAAE,UAAU,GACtB,OAAO,CAsBT;AAoCD,sEAAsE;AACtE,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,kBAAkB,EACvB,YAAY,EAAE,UAAU,EACxB,aAAa,EAAE,MAAM,GACpB,MAAM,CAgBR;AAED,wEAAwE;AACxE,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,kBAAkB,EACvB,WAAW,EAAE,UAAU,GACtB,OAAO,CAYT;AAED,kEAAkE;AAClE,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,kBAAkB,EACvB,IAAI,GAAE;IAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC1C,IAAI,CA2EN;AAKD,qEAAqE;AACrE,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,gBAAgB,EACrB,YAAY,EAAE,UAAU,EACxB,aAAa,EAAE,MAAM,GACpB,MAAM,CAgBR;AAED,yCAAyC;AACzC,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,gBAAgB,EACrB,WAAW,EAAE,UAAU,GACtB,OAAO,CAYT;AAED,oEAAoE;AACpE,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,gBAAgB,EACrB,IAAI,GAAE;IAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC1C,IAAI,CAyCN;AAKD,oEAAoE;AACpE,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,eAAe,EACpB,YAAY,EAAE,UAAU,EACxB,aAAa,EAAE,MAAM,GACpB,MAAM,CAgBR;AAED,wCAAwC;AACxC,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,eAAe,EACpB,WAAW,EAAE,UAAU,GACtB,OAAO,CAYT;AAED,oEAAoE;AACpE,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,eAAe,EACpB,IAAI,GAAE;IAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC1C,IAAI,CAiEN;AAED,iEAAiE;AACjE,wBAAgB,UAAU,CACxB,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,MAAM,GACf,oBAAoB,GAAG,IAAI,CAO7B"}