@swal/edge-mesh 0.0.0-stage → 0.1.0

package/dist/web/pq.js

@@ -0,0 +1,59 @@
+// Post-quantum primitives of the browser mesh (AGENTS.md §2): identity signatures are ML-DSA-65 (FIPS 204) and key
+// exchanges combine ML-KEM-768 (FIPS 203) with ECDH P-256 (hybrid: both secrets REQUIRED, so the exchange stays
+// secure if either primitive holds). Implementation: `@noble/post-quantum` (pure JS) + WebCrypto for ECDH/HKDF.
+import { ml_dsa65 } from "@noble/post-quantum/ml-dsa.js";
+import { ml_kem768 } from "@noble/post-quantum/ml-kem.js";
+import { hkdf } from "./crypto.js";
+import { canonicalBytes, sha256B64u } from "./trust/canonical.js";
+import { b64uEncode, concat } from "./util.js";
+export const IDENTITY_ALG = "ML-DSA-65";
+export const KEM_ALG = "ML-KEM-768";
+export const ML_DSA_PUBLIC_KEY_BYTES = 1952;
+export const ML_DSA_SECRET_KEY_BYTES = 4032;
+export const ML_DSA_SIGNATURE_BYTES = 3309;
+export const ML_KEM_PUBLIC_KEY_BYTES = 1184;
+export const ML_KEM_SECRET_KEY_BYTES = 2400;
+export const ML_KEM_CIPHERTEXT_BYTES = 1088;
+/**
+ * Device id = fingerprint of the ML-DSA-65 identity key, with ONE canonical encoding shared with `web/trust`
+ * (`keyFingerprint`): base64url(SHA-256(canonicalJson({ alg: "ML-DSA-65", pub: base64url(raw 1952-byte key) }))),
+ * 43 characters (full 256-bit hash: 128-bit second-preimage resistance even against Grover). The algorithm is part of
+ * the hashed value, so a key of another algorithm can never produce the same id.
+ */
+export function deviceIdOf(publicKey) {
+    return sha256B64u(canonicalBytes({ alg: IDENTITY_ALG, pub: b64uEncode(publicKey) }));
+}
+/** New ML-DSA-65 identity key pair (raw bytes). */
+export const identityKeygen = () => ml_dsa65.keygen();
+export const identitySign = (secretKey, data) => ml_dsa65.sign(data, secretKey);
+/** ML-DSA-65 verification with exact sizes; never throws (anything else, e.g. an ECDSA key or signature: false). */
+export function identityVerify(publicKey, data, signature) {
+    if (publicKey.length !== ML_DSA_PUBLIC_KEY_BYTES ||
+        signature.length !== ML_DSA_SIGNATURE_BYTES)
+        return false;
+    try {
+        return ml_dsa65.verify(signature, data, publicKey);
+    }
+    catch {
+        return false;
+    }
+}
+/** New ML-KEM-768 key pair (raw bytes): `publicKey` is the encapsulation key, `secretKey` the decapsulation key. */
+export const kemKeygen = () => ml_kem768.keygen();
+export function kemEncapsulate(publicKey) {
+    if (publicKey.length !== ML_KEM_PUBLIC_KEY_BYTES)
+        throw new Error("not an ML-KEM-768 encapsulation key");
+    return ml_kem768.encapsulate(publicKey);
+}
+export function kemDecapsulate(cipherText, secretKey) {
+    if (cipherText.length !== ML_KEM_CIPHERTEXT_BYTES)
+        throw new Error("not an ML-KEM-768 ciphertext");
+    return ml_kem768.decapsulate(cipherText, secretKey);
+}
+/** Hybrid combiner: HKDF-SHA-256(ikm = ML-KEM secret || ECDH secret, salt, info). Both inputs are required. */
+export function hybridSecret(kemSecret, ecdhSecret, info, salt) {
+    if (kemSecret.length !== 32 || ecdhSecret.length !== 32)
+        throw new Error("hybrid key exchange needs both secrets");
+    return hkdf(concat(kemSecret, ecdhSecret), info, salt);
+}
+//# sourceMappingURL=pq.js.map

package/dist/web/pq.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq.js","sourceRoot":"","sources":["../../src/web/pq.ts"],"names":[],"mappings":"AAAA,mHAAmH;AACnH,gHAAgH;AAChH,gHAAgH;AAChH,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE/C,MAAM,CAAC,MAAM,YAAY,GAAG,WAAoB,CAAC;AACjD,MAAM,CAAC,MAAM,OAAO,GAAG,YAAqB,CAAC;AAC7C,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAC5C,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAC5C,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAC3C,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAC5C,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAC5C,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,SAAqB;IAC/C,OAAO,UAAU,CAChB,cAAc,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CACjE,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,MAAM,cAAc,GAAG,GAG5B,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,YAAY,GAAG,CAC3B,SAAqB,EACrB,IAAgB,EACH,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAEhD,oHAAoH;AACpH,MAAM,UAAU,cAAc,CAC7B,SAAqB,EACrB,IAAgB,EAChB,SAAqB;IAErB,IACC,SAAS,CAAC,MAAM,KAAK,uBAAuB;QAC5C,SAAS,CAAC,MAAM,KAAK,sBAAsB;QAE3C,OAAO,KAAK,CAAC;IACd,IAAI,CAAC;QACJ,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,oHAAoH;AACpH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAqD,EAAE,CAC/E,SAAS,CAAC,MAAM,EAAE,CAAC;AAEpB,MAAM,UAAU,cAAc,CAAC,SAAqB;IAInD,IAAI,SAAS,CAAC,MAAM,KAAK,uBAAuB;QAC/C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxD,OAAO,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,cAAc,CAC7B,UAAsB,EACtB,SAAqB;IAErB,IAAI,UAAU,CAAC,MAAM,KAAK,uBAAuB;QAChD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACjD,OAAO,SAAS,CAAC,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,YAAY,CAC3B,SAAqB,EACrB,UAAsB,EACtB,IAAY,EACZ,IAAiB;IAEjB,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE;QACtD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC"}

package/dist/web/provider.d.ts

@@ -0,0 +1,188 @@
+import { Awareness } from "y-protocols/awareness";
+import * as Y from "yjs";
+import { type Role, type TrustRoot } from "./admission.js";
+import { type RotDoc } from "./rotation.js";
+import { type SecDoc } from "./secstate.js";
+import { type MeshStore } from "./store.js";
+import type { TrustStore } from "./trust/store.js";
+import type { TrustSchema } from "./trust/types.js";
+import type { Device, RtcOptions, SigTransport, VaultClient } from "./types.js";
+export type MeshStatus = "off" | "connecting" | "online";
+export type MeshEvent = "status" | "peers" | "devices" | "sas" | "paired" | "revoked" | "rejected" | "error";
+export interface MeshOptions {
+    appId: string;
+    topic: string;
+    doc: Y.Doc;
+    vault: VaultClient;
+    /** Tried/used in order; ALL optional. Default [] = no network at all. No public defaults. */
+    signaling?: SigTransport[];
+    persist?: "idb";
+    deviceName?: string;
+    rtc?: RtcOptions;
+    now?: () => number;
+    /**
+     * Device-local store for the security state (pinned root, signed grants, revocations, key records, rotations).
+     * Default: `vault.store`, else IndexedDB when persist:'idb', else memory (a reloaded device then has to be paired
+     * again). Nothing of it lives in the shared Y.Doc.
+     */
+    store?: MeshStore;
+    /**
+     * Schema of the mesh's web/trust store (round 5: the single source of membership and authority). Default
+     * `MESH_SCHEMA` (module "mesh", roles "admin"/"member"). An app may pass its own schema (it must keep the module
+     * "mesh" and the roles "admin" and "member") to issue its own permissions into the same store (`mesh.security`).
+     */
+    trustSchema?: TrustSchema;
+    /**
+     * Extra membership filter on top of the signed grants: called for every device the trust store makes a member,
+     * with its identity key. Only devices it accepts receive rotation wraps and appear in `devices()`.
+     */
+    authorizeDevice?: (deviceId: string, devicePub: Uint8Array) => boolean | Promise<boolean>;
+    /**
+     * Extra policy for revocations: may `issuer` revoke `target`? Checked before a local revoke() (on top of web/trust:
+     * the owner revokes anybody, an admin the devices it admitted) and for every device an incoming owner rotation cuts.
+     */
+    canRotate?: (issuer: string, target: string) => boolean | Promise<boolean>;
+    /**
+     * Data authorization hook: called before applying every incoming Yjs update with the AUTHENTICATED peer that
+     * delivered it (with signFrames on). Default: allow. Note that a sync reply may carry other members' changes:
+     * `sender` is the delivering device, not necessarily the author (per-author authorization needs a signed log).
+     * A refused update is dropped and reported as a 'rejected' event.
+     */
+    authorizeUpdate?: (sender: string, update: Uint8Array) => boolean | Promise<boolean>;
+    /**
+     * Sign every data frame with the device identity key and require valid signatures from ADMITTED devices
+     * (default true). Per-sender subkeys alone do not authenticate the sender: every member can derive them.
+     * `false` restores the legacy unsigned wire; it must then be off on every device of the mesh.
+     */
+    signFrames?: boolean;
+    /**
+     * Namespace of this mesh instance within the app (e.g. a restaurant id); it is bound into the room ids and
+     * every channel frame. Must be identical on all devices. Default: fingerprint of the owner's identity key.
+     */
+    instance?: string;
+    /** Largest message handed to a link; bigger ones are fragmented (H5). Default 64 KiB. */
+    maxFrameBytes?: number;
+    /** Largest reassembled message accepted from a peer. Default 64 MiB. */
+    maxMessageBytes?: number;
+    /**
+     * Rejoin the pinned mesh on start (default true). Pass `false` with a fresh `Y.Doc` to move this device to another
+     * mesh with `pairJoin` while the old one may still be reachable: otherwise the new instance resumes the old mesh
+     * and its doc fills with the old mesh's data, which `pairJoin` then refuses to carry over.
+     */
+    resume?: boolean;
+    /** A data link whose handshake (S1) has not completed after this long is closed (note 9). Default 120 s. */
+    handshakeTimeoutMs?: number;
+}
+export interface PairHostOptions {
+    /** Role of the admitted guest. Default "member". Only the owner admits admins. */
+    role?: Exclude<Role, "owner">;
+    /** Application data for this guest (e.g. a signed capability grant), sent inside the encrypted grant. */
+    extra?: (guest: Device) => unknown | Promise<unknown>;
+}
+/** A private, encrypted, signed message channel of one kind inside the mesh (e.g. "oplog"). */
+export interface MeshChannel {
+    /** `{appId}/{instance}/{kind}`: frames from any other app or instance are rejected. */
+    readonly namespace: string;
+    /** Send to every connected, authenticated member (or only `to`). Large payloads are fragmented. */
+    send(data: Uint8Array, opts?: {
+        to?: string;
+    }): Promise<void>;
+    /** `from` is the authenticated sender (signFrames on). */
+    onMessage(cb: (data: Uint8Array, from: string) => void): () => void;
+    close(): void;
+}
+export interface PairJoinResult {
+    host?: Device;
+    extra?: unknown;
+}
+export interface PairOffer {
+    /** Show as QR / copy-paste. */
+    payload: string;
+    expiresAt: number;
+    cancel(): void;
+}
+/** Read access to the mesh's security state, plus adding documents (e.g. app-issued grants, a backup). */
+export interface MeshSecurity {
+    /** Membership and authority (web/trust). */
+    readonly trust: TrustStore;
+    /** Every security document held (grants, revocations, key records, recent owner rotations). */
+    docs(): Promise<SecDoc[]>;
+    /** Verified owner rotations kept (the most recent ones), oldest first. */
+    rotations(): Array<RotDoc & {
+        id: string;
+    }>;
+    /** Key-agreement keys of a device (base64url), or null if unknown. */
+    keyAgreement(deviceId: string): {
+        ecdh: string;
+        kem: string;
+    } | null;
+    /** Grant ids executed (cut) by owner rotations. */
+    executedCuts(): string[];
+    /** Add a signed document (verified like any received one) and hand it to the mesh. */
+    add(doc: unknown): Promise<{
+        status: string;
+        id?: string;
+        reason?: string;
+    }>;
+    /** Several documents at once (any order; e.g. a backup). */
+    addMany(docs: readonly unknown[]): Promise<Array<{
+        status: string;
+        id?: string;
+        reason?: string;
+    }>>;
+    /** Sign a grant with this device's identity (owner, or an admin for members). Not added: pass it to `add`. */
+    issueGrant(subjectPub: string, opts: {
+        role: "admin" | "member";
+        name?: string;
+    }): Promise<unknown>;
+}
+export interface Mesh {
+    readonly status: MeshStatus;
+    readonly peers: string[];
+    readonly epoch: number;
+    readonly awareness: Awareness;
+    /** Resolves when local persistence is loaded and this device is registered. */
+    readonly ready: Promise<void>;
+    /** Pinned trust root (mesh owner), or null before the first pairing. */
+    readonly root: TrustRoot | null;
+    /** `{appId}/{instance}` of this mesh ("" instance before the first pairing unless MeshOptions.instance). */
+    readonly namespace: string;
+    /** Own message channel of a kind (letters, digits, '-', '_', '.'), separate from the shared Y.Doc. */
+    channel(kind: string): MeshChannel;
+    pairHost(opts?: PairHostOptions): Promise<PairOffer>;
+    pairJoin(payload: string, opts?: {
+        confirmSas?: (code: string) => Promise<boolean> | boolean;
+    }): Promise<PairJoinResult>;
+    /** This device plus every device a valid signed grant makes a member (and the owner). */
+    devices(): Device[];
+    /** Verified role of a device (default: this one), or null if it is not a member. */
+    role(deviceId?: string): Role | null;
+    /**
+     * Revoke a device: signs web/trust revocations of its grants (the owner: all of them; an admin: the ones it issued,
+     * directly or below), and its writes and links are cut at once everywhere. Only owner devices re-key the mesh; after
+     * an admin's revocation `rekeyPending` stays true until an owner device is online and has re-keyed (UI: "pendiente
+     * de que el dueño se conecte"): until then the revoked device still holds the current mesh key. `heads` (web/oplog
+     * `headIds()`) keep the device's op history up to there; without them none of its ops stays authorized.
+     */
+    revoke(deviceId: string, opts?: {
+        heads?: Readonly<Record<string, number | {
+            seq: number;
+            id: string;
+        }>>;
+        reason?: string;
+    }): Promise<void>;
+    /**
+     * Owner only: give devices that lost membership through a revoked admin (revocations cascade) a grant of their own
+     * from the owner. They get the current key with the next re-key.
+     */
+    reanchor(deviceIds: string[]): Promise<void>;
+    /** Security state (round 5: signed documents outside the Y.Doc), or null before the first pairing. */
+    readonly security: MeshSecurity | null;
+    /** A known revocation has not been followed by an owner re-key yet (the revoked device may still read new data). */
+    readonly rekeyPending: boolean;
+    leave(): void;
+    destroy(): void;
+    on(event: MeshEvent, cb: (data: any) => void): () => void;
+}
+export declare function createMesh(opts: MeshOptions): Mesh;
+//# sourceMappingURL=provider.d.ts.map

package/dist/web/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/web/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,SAAS,EAIT,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAON,KAAK,IAAI,EACT,KAAK,SAAS,EACd,MAAM,gBAAgB,CAAC;AAyCxB,OAAO,EAMN,KAAK,MAAM,EAOX,MAAM,eAAe,CAAC;AACvB,OAAO,EAEN,KAAK,MAAM,EAGX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAY,KAAK,SAAS,EAAe,MAAM,YAAY,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EACX,MAAM,EAEN,UAAU,EACV,YAAY,EACZ,WAAW,EACX,MAAM,YAAY,CAAC;AAYpB,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,YAAY,GAAG,QAAQ,CAAC;AACzD,MAAM,MAAM,SAAS,GAClB,QAAQ,GACR,OAAO,GACP,SAAS,GACT,KAAK,GACL,QAAQ,GACR,SAAS,GACT,UAAU,GACV,OAAO,CAAC;AAEX,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC;IACX,KAAK,EAAE,WAAW,CAAC;IACnB,6FAA6F;IAC7F,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,eAAe,CAAC,EAAE,CACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,UAAU,KACjB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4GAA4G;IAC5G,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC/B,kFAAkF;IAClF,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9B,yGAAyG;IACzG,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtD;AAED,+FAA+F;AAC/F,MAAM,WAAW,WAAW;IAC3B,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mGAAmG;IACnG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,0DAA0D;IAC1D,SAAS,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACpE,KAAK,IAAI,IAAI,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACzB,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,IAAI,IAAI,CAAC;CACf;AAED,0GAA0G;AAC1G,MAAM,WAAW,YAAY;IAC5B,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,+FAA+F;IAC/F,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1B,0EAA0E;IAC1E,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5C,sEAAsE;IACtE,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACrE,mDAAmD;IACnD,YAAY,IAAI,MAAM,EAAE,CAAC;IACzB,sFAAsF;IACtF,GAAG,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,4DAA4D;IAC5D,OAAO,CACN,IAAI,EAAE,SAAS,OAAO,EAAE,GACtB,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IACpE,8GAA8G;IAC9G,UAAU,CACT,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,OAAO,CAAC,OAAO,CAAC,CAAC;CACpB;AAED,MAAM,WAAW,IAAI;IACpB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IAChC,4GAA4G;IAC5G,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sGAAsG;IACtG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACrD,QAAQ,CACP,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;KAAE,GAClE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,yFAAyF;IACzF,OAAO,IAAI,MAAM,EAAE,CAAC;IACpB,oFAAoF;IACpF,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IACrC;;;;;;OAMG;IACH,MAAM,CACL,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QACN,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,EAAE,MAAM,CAAC;KAChB,GACC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,sGAAsG;IACtG,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IACvC,oHAAoH;IACpH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,KAAK,IAAI,IAAI,CAAC;IACd,OAAO,IAAI,IAAI,CAAC;IAChB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CAC1D;AAqKD,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CA8mElD"}