@tgoliveira/vault-core 0.1.0 → 0.2.0

package/dist/session/auto-lock.js

@@ -5,6 +5,7 @@ let inactivityTimer = null;
 let manuallyLocked = false;
 let lastActivityAt = 0;
 const listeners = new Set();
+const DEFAULT_ACTIVITY_EVENTS = ["pointerdown", "keydown", "touchstart", "focus"];
 export function configureVaultSession(config) {
     sessionConfig = config;
 }
@@ -77,10 +78,23 @@ export function registerVaultUnloadGuard() {
     window.addEventListener("pagehide", handler);
     return () => window.removeEventListener("pagehide", handler);
 }
+export function registerVaultActivityGuard(events = DEFAULT_ACTIVITY_EVENTS) {
+    if (typeof window === "undefined")
+        return () => undefined;
+    const handler = () => touchVaultSession();
+    for (const event of events) {
+        window.addEventListener(event, handler, { passive: true });
+    }
+    return () => {
+        for (const event of events) {
+            window.removeEventListener(event, handler);
+        }
+    };
+}
 export function getVaultAutoLockRemainingMs() {
     if (!isVaultUnlocked() || manuallyLocked || lastActivityAt === 0)
         return null;
     return Math.max(0, getAutoLockTimeoutMs() - (Date.now() - lastActivityAt));
 }
-export { getSessionVaultKey, setSessionVaultKey, lockVault, isVaultUnlocked, clearVaultClientState, } from "./memory-session.js";
+export { getSessionVaultKey, isVaultUnlocked, } from "./memory-session.js";
 //# sourceMappingURL=auto-lock.js.map

package/dist/session/auto-lock.js.map

@@ -1 +1 @@
-{"version":3,"file":"auto-lock.js","sourceRoot":"","sources":["../../src/session/auto-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAOrF,IAAI,aAAa,GAAuB,EAAE,CAAC;AAC3C,IAAI,eAAe,GAAyC,IAAI,CAAC;AACjE,IAAI,cAAc,GAAG,KAAK,CAAC;AAC3B,IAAI,cAAc,GAAG,CAAC,CAAC;AACvB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;AAExC,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,aAAa,GAAG,MAAM,CAAC;AACzB,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,QAAQ,GAAG,aAAa,CAAC,sBAAsB,EAAE,EAAE,CAAC;IAC1D,MAAM,OAAO,GACX,QAAQ;QACR,aAAa,CAAC,eAAe;QAC7B,+BAA+B,CAAC;IAClC,MAAM,WAAW,GACf,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,CAAC;IACtF,OAAO,WAAW,GAAG,EAAE,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,wBAAwB;IAC/B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,QAAQ,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAoB;IACxD,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,IAAI,eAAe,EAAE,CAAC;QACpB,YAAY,CAAC,eAAe,CAAC,CAAC;QAC9B,eAAe,GAAG,IAAI,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC,eAAe,EAAE,IAAI,cAAc;QAAE,OAAO;IACjD,uBAAuB,EAAE,CAAC;IAC1B,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,eAAe,GAAG,UAAU,CAAC,GAAG,EAAE;QAChC,gBAAgB,EAAE,CAAC;IACrB,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,IAAI,eAAe,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;QACzC,qBAAqB,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAmB;IACpD,cAAc,GAAG,KAAK,CAAC;IACvB,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7B,qBAAqB,EAAE,CAAC;IACxB,wBAAwB,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,uBAAuB,EAAE,CAAC;IAC1B,cAAc,GAAG,CAAC,CAAC;IACnB,SAAS,EAAE,CAAC;IACZ,cAAc,GAAG,IAAI,CAAC;IACtB,wBAAwB,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,gBAAgB,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,cAAc,GAAG,KAAK,CAAC;IACvB,uBAAuB,EAAE,CAAC;IAC1B,cAAc,GAAG,CAAC,CAAC;IACnB,wBAAwB,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IAE1D,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC;IACzC,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,IAAI,CAAC,eAAe,EAAE,IAAI,cAAc,IAAI,cAAc,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,SAAS,EACT,eAAe,EACf,qBAAqB,GACtB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"auto-lock.js","sourceRoot":"","sources":["../../src/session/auto-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAOrF,IAAI,aAAa,GAAuB,EAAE,CAAC;AAC3C,IAAI,eAAe,GAAyC,IAAI,CAAC;AACjE,IAAI,cAAc,GAAG,KAAK,CAAC;AAC3B,IAAI,cAAc,GAAG,CAAC,CAAC;AACvB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;AACxC,MAAM,uBAAuB,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,CAAU,CAAC;AAE3F,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,aAAa,GAAG,MAAM,CAAC;AACzB,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,QAAQ,GAAG,aAAa,CAAC,sBAAsB,EAAE,EAAE,CAAC;IAC1D,MAAM,OAAO,GACX,QAAQ;QACR,aAAa,CAAC,eAAe;QAC7B,+BAA+B,CAAC;IAClC,MAAM,WAAW,GACf,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,CAAC;IACtF,OAAO,WAAW,GAAG,EAAE,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,wBAAwB;IAC/B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,QAAQ,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAoB;IACxD,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,IAAI,eAAe,EAAE,CAAC;QACpB,YAAY,CAAC,eAAe,CAAC,CAAC;QAC9B,eAAe,GAAG,IAAI,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC,eAAe,EAAE,IAAI,cAAc;QAAE,OAAO;IACjD,uBAAuB,EAAE,CAAC;IAC1B,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,eAAe,GAAG,UAAU,CAAC,GAAG,EAAE;QAChC,gBAAgB,EAAE,CAAC;IACrB,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,IAAI,eAAe,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;QACzC,qBAAqB,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAmB;IACpD,cAAc,GAAG,KAAK,CAAC;IACvB,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7B,qBAAqB,EAAE,CAAC;IACxB,wBAAwB,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,uBAAuB,EAAE,CAAC;IAC1B,cAAc,GAAG,CAAC,CAAC;IACnB,SAAS,EAAE,CAAC;IACZ,cAAc,GAAG,IAAI,CAAC;IACtB,wBAAwB,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,gBAAgB,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,cAAc,GAAG,KAAK,CAAC;IACvB,uBAAuB,EAAE,CAAC;IAC1B,cAAc,GAAG,CAAC,CAAC;IACnB,wBAAwB,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IAE1D,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC;IACzC,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,SAA4B,uBAAuB;IAEnD,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IAE1D,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,EAAE;QACV,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,IAAI,CAAC,eAAe,EAAE,IAAI,cAAc,IAAI,cAAc,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,OAAO,EACL,kBAAkB,EAClB,eAAe,GAChB,MAAM,qBAAqB,CAAC"}

package/dist/validation/aad-assert.d.ts

@@ -1,5 +1,7 @@
 import type { EncryptedVaultPayload } from "./schemas.js";
-import type { VaultCryptoProfile } from "../profile.js";
-export declare function assertVaultKeyAad(userId: string, payload: EncryptedVaultPayload, profile: VaultCryptoProfile): void;
-export declare function assertVaultPayloadAad(userId: string, payload: EncryptedVaultPayload, profile: VaultCryptoProfile): void;
+import type { VaultAadScope, VaultCryptoProfile } from "../profile.js";
+type ExpectedScope = Pick<VaultAadScope, "userId" | "resourceId">;
+export declare function assertVaultKeyAad(expectedScope: string | ExpectedScope, payload: EncryptedVaultPayload, profile: VaultCryptoProfile): void;
+export declare function assertVaultPayloadAad(expectedScope: string | ExpectedScope, payload: EncryptedVaultPayload, profile: VaultCryptoProfile): void;
+export {};
 //# sourceMappingURL=aad-assert.d.ts.map

package/dist/validation/aad-assert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aad-assert.d.ts","sourceRoot":"","sources":["../../src/validation/aad-assert.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,kBAAkB,GAC1B,IAAI,CAaN;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,kBAAkB,GAC1B,IAAI,CAaN"}
+{"version":3,"file":"aad-assert.d.ts","sourceRoot":"","sources":["../../src/validation/aad-assert.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEvE,KAAK,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,YAAY,CAAC,CAAC;AAQlE,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,GAAG,aAAa,EACrC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,kBAAkB,GAC1B,IAAI,CAcN;AAED,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,MAAM,GAAG,aAAa,EACrC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,kBAAkB,GAC1B,IAAI,CAcN"}

package/dist/validation/aad-assert.js

@@ -1,28 +1,35 @@
-export function assertVaultKeyAad(userId, payload, profile) {
-    if (payload.aad.userId !== userId) {
+function normalizeExpectedScope(scope) {
+    return typeof scope === "string"
+        ? { userId: scope, resourceId: scope }
+        : scope;
+}
+export function assertVaultKeyAad(expectedScope, payload, profile) {
+    const scope = normalizeExpectedScope(expectedScope);
+    if (payload.aad.userId !== scope.userId) {
         throw new Error("Vault key AAD userId mismatch");
     }
-    if (payload.aad.resourceId !== userId) {
+    if (payload.aad.resourceId !== scope.resourceId) {
         throw new Error("Vault key AAD resourceId mismatch");
     }
     if (payload.aad.field !== "vault_key") {
         throw new Error("Vault key AAD field mismatch");
     }
-    if (payload.aad.context && payload.aad.context !== profile.aadContextEnvelope) {
+    if (payload.aad.context !== profile.aadContextEnvelope) {
         throw new Error("Vault key AAD context mismatch");
     }
 }
-export function assertVaultPayloadAad(userId, payload, profile) {
-    if (payload.aad.userId !== userId) {
+export function assertVaultPayloadAad(expectedScope, payload, profile) {
+    const scope = normalizeExpectedScope(expectedScope);
+    if (payload.aad.userId !== scope.userId) {
         throw new Error("Vault payload AAD userId mismatch");
     }
-    if (payload.aad.resourceId !== userId) {
+    if (payload.aad.resourceId !== scope.resourceId) {
         throw new Error("Vault payload AAD resourceId mismatch");
     }
     if (payload.aad.field !== "vault_payload") {
         throw new Error("Vault payload AAD field mismatch");
     }
-    if (payload.aad.context && payload.aad.context !== profile.aadContextVault) {
+    if (payload.aad.context !== profile.aadContextVault) {
         throw new Error("Vault payload AAD context mismatch");
     }
 }

package/dist/validation/aad-assert.js.map

@@ -1 +1 @@
-{"version":3,"file":"aad-assert.js","sourceRoot":"","sources":["../../src/validation/aad-assert.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,OAA8B,EAC9B,OAA2B;IAE3B,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,OAA8B,EAC9B,OAA2B;IAE3B,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;AACH,CAAC"}
+{"version":3,"file":"aad-assert.js","sourceRoot":"","sources":["../../src/validation/aad-assert.ts"],"names":[],"mappings":"AAKA,SAAS,sBAAsB,CAAC,KAA6B;IAC3D,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;QACtC,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,aAAqC,EACrC,OAA8B,EAC9B,OAA2B;IAE3B,MAAM,KAAK,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,aAAqC,EACrC,OAA8B,EAC9B,OAA2B;IAE3B,MAAM,KAAK,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;AACH,CAAC"}

package/dist/validation/plaintext-reject.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plaintext-reject.d.ts","sourceRoot":"","sources":["../../src/validation/plaintext-reject.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,gCAAgC,8PAiBnC,CAAC;AAEX,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,gCAAgC,CAAC,CAAC,MAAM,CAAC,CAAC;AAExF,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAOvF;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAKhF;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAGvF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,GAAE,SAAS,MAAM,EAAkB,GAAG,MAAM,EAAE,CAWtG;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,GAAE,SAAS,MAAM,EAAkB,GAAG,OAAO,CAErG;AAED,eAAO,MAAM,uBAAuB,yCAAyC,CAAC;AAC9E,eAAO,MAAM,wBAAwB,0CAA0C,CAAC;AAChF,eAAO,MAAM,gCAAgC,kDACI,CAAC;AAClD,eAAO,MAAM,gCAAgC,kDACI,CAAC;AAClD,eAAO,MAAM,sBAAsB,wCAAwC,CAAC;AAC5E,eAAO,MAAM,sBAAsB,wCAAwC,CAAC;AAC5E,eAAO,MAAM,2BAA2B,6CAA6C,CAAC;AACtF,eAAO,MAAM,yBAAyB,2CAA2C,CAAC;AAClF,eAAO,MAAM,qBAAqB,uCAAuC,CAAC;AAC1E,eAAO,MAAM,uBAAuB,yCAAyC,CAAC;AAC9E,eAAO,MAAM,mBAAmB,qCAAqC,CAAC;AAEtE,eAAO,MAAM,aAAa,odAYhB,CAAC"}
+{"version":3,"file":"plaintext-reject.d.ts","sourceRoot":"","sources":["../../src/validation/plaintext-reject.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,gCAAgC,8PAiBnC,CAAC;AAEX,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,gCAAgC,CAAC,CAAC,MAAM,CAAC,CAAC;AAIxF,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAsBvF;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAKhF;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAGvF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,GAAE,SAAS,MAAM,EAAkB,GAAG,MAAM,EAAE,CAWtG;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,GAAE,SAAS,MAAM,EAAkB,GAAG,OAAO,CAErG;AAED,eAAO,MAAM,uBAAuB,yCAAyC,CAAC;AAC9E,eAAO,MAAM,wBAAwB,0CAA0C,CAAC;AAChF,eAAO,MAAM,gCAAgC,kDACI,CAAC;AAClD,eAAO,MAAM,gCAAgC,kDACI,CAAC;AAClD,eAAO,MAAM,sBAAsB,wCAAwC,CAAC;AAC5E,eAAO,MAAM,sBAAsB,wCAAwC,CAAC;AAC5E,eAAO,MAAM,2BAA2B,6CAA6C,CAAC;AACtF,eAAO,MAAM,yBAAyB,2CAA2C,CAAC;AAClF,eAAO,MAAM,qBAAqB,uCAAuC,CAAC;AAC1E,eAAO,MAAM,uBAAuB,yCAAyC,CAAC;AAC9E,eAAO,MAAM,mBAAmB,qCAAqC,CAAC;AAEtE,eAAO,MAAM,aAAa,odAYhB,CAAC"}

package/dist/validation/plaintext-reject.js

@@ -17,13 +17,27 @@ export const PLAINTEXT_FORBIDDEN_VAULT_FIELDS = [
     "content",
     "message",
 ];
+const FORBIDDEN_FIELD_SET = new Set(PLAINTEXT_FORBIDDEN_VAULT_FIELDS);
 export function rejectVaultPlaintextFields(body) {
-    for (const field of PLAINTEXT_FORBIDDEN_VAULT_FIELDS) {
-        if (field in body && body[field] !== undefined) {
-            return `Plaintext field '${field}' is not allowed`;
+    const visited = new WeakSet();
+    function visit(value, path) {
+        if (value === null || typeof value !== "object")
+            return null;
+        if (visited.has(value))
+            return null;
+        visited.add(value);
+        for (const [field, nestedValue] of Object.entries(value)) {
+            const fieldPath = path ? `${path}.${field}` : field;
+            if (FORBIDDEN_FIELD_SET.has(field) && nestedValue !== undefined) {
+                return `Plaintext field '${field}' is not allowed at '${fieldPath}'`;
+            }
+            const nestedError = visit(nestedValue, fieldPath);
+            if (nestedError)
+                return nestedError;
         }
+        return null;
     }
-    return null;
+    return visit(body, "");
 }
 export function assertNoVaultPlaintextFields(body) {
     const error = rejectVaultPlaintextFields(body);

package/dist/validation/plaintext-reject.js.map

@@ -1 +1 @@
-{"version":3,"file":"plaintext-reject.js","sourceRoot":"","sources":["../../src/validation/plaintext-reject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAEzE,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,eAAe;IACf,sBAAsB;IACtB,UAAU;IACV,gBAAgB;IAChB,eAAe;IACf,cAAc;IACd,WAAW;IACX,kBAAkB;IAClB,aAAa;IACb,aAAa;IACb,cAAc;IACd,mBAAmB;IACnB,OAAO;IACP,MAAM;IACN,SAAS;IACT,SAAS;CACD,CAAC;AAIX,MAAM,UAAU,0BAA0B,CAAC,IAA6B;IACtE,KAAK,MAAM,KAAK,IAAI,gCAAgC,EAAE,CAAC;QACrD,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YAC/C,OAAO,oBAAoB,KAAK,kBAAkB,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAA6B;IACxE,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAa;IACnD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAa,EAAE,YAA+B,aAAa;IAC1F,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,YAA+B,aAAa;IAC1F,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,sCAAsC,CAAC;AAC9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,uCAAuC,CAAC;AAChF,MAAM,CAAC,MAAM,gCAAgC,GAC3C,+CAA+C,CAAC;AAClD,MAAM,CAAC,MAAM,gCAAgC,GAC3C,+CAA+C,CAAC;AAClD,MAAM,CAAC,MAAM,sBAAsB,GAAG,qCAAqC,CAAC;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,qCAAqC,CAAC;AAC5E,MAAM,CAAC,MAAM,2BAA2B,GAAG,0CAA0C,CAAC;AACtF,MAAM,CAAC,MAAM,yBAAyB,GAAG,wCAAwC,CAAC;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAAG,oCAAoC,CAAC;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,sCAAsC,CAAC;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,kCAAkC,CAAC;AAEtE,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,uBAAuB;IACvB,wBAAwB;IACxB,gCAAgC;IAChC,gCAAgC;IAChC,sBAAsB;IACtB,sBAAsB;IACtB,2BAA2B;IAC3B,yBAAyB;IACzB,qBAAqB;IACrB,uBAAuB;IACvB,mBAAmB;CACX,CAAC"}
+{"version":3,"file":"plaintext-reject.js","sourceRoot":"","sources":["../../src/validation/plaintext-reject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAEzE,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,eAAe;IACf,sBAAsB;IACtB,UAAU;IACV,gBAAgB;IAChB,eAAe;IACf,cAAc;IACd,WAAW;IACX,kBAAkB;IAClB,aAAa;IACb,aAAa;IACb,cAAc;IACd,mBAAmB;IACnB,OAAO;IACP,MAAM;IACN,SAAS;IACT,SAAS;CACD,CAAC;AAIX,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS,gCAAgC,CAAC,CAAC;AAE9E,MAAM,UAAU,0BAA0B,CAAC,IAA6B;IACtE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAU,CAAC;IAEtC,SAAS,KAAK,CAAC,KAAc,EAAE,IAAY;QACzC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEnB,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACpD,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAChE,OAAO,oBAAoB,KAAK,wBAAwB,SAAS,GAAG,CAAC;YACvE,CAAC;YAED,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAClD,IAAI,WAAW;gBAAE,OAAO,WAAW,CAAC;QACtC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAA6B;IACxE,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAa;IACnD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAa,EAAE,YAA+B,aAAa;IAC1F,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,YAA+B,aAAa;IAC1F,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,sCAAsC,CAAC;AAC9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,uCAAuC,CAAC;AAChF,MAAM,CAAC,MAAM,gCAAgC,GAC3C,+CAA+C,CAAC;AAClD,MAAM,CAAC,MAAM,gCAAgC,GAC3C,+CAA+C,CAAC;AAClD,MAAM,CAAC,MAAM,sBAAsB,GAAG,qCAAqC,CAAC;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,qCAAqC,CAAC;AAC5E,MAAM,CAAC,MAAM,2BAA2B,GAAG,0CAA0C,CAAC;AACtF,MAAM,CAAC,MAAM,yBAAyB,GAAG,wCAAwC,CAAC;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAAG,oCAAoC,CAAC;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,sCAAsC,CAAC;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,kCAAkC,CAAC;AAEtE,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,uBAAuB;IACvB,wBAAwB;IACxB,gCAAgC;IAChC,gCAAgC;IAChC,sBAAsB;IACtB,sBAAsB;IACtB,2BAA2B;IAC3B,yBAAyB;IACzB,qBAAqB;IACrB,uBAAuB;IACvB,mBAAmB;CACX,CAAC"}

package/dist/validation/schemas.d.ts

@@ -37,12 +37,15 @@ export declare const kdfMetadataSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type KdfMetadata = Argon2idKdfMetadata;
 export type VaultEnvelopeMethod = "password" | "recovery_phrase" | "passkey_prf";
-export declare const storedEnvelopeSchema: z.ZodObject<{
-    method: z.ZodEnum<{
-        password: "password";
-        recovery_phrase: "recovery_phrase";
-        passkey_prf: "passkey_prf";
-    }>;
+export declare const passwordEnvelopeSchema: z.ZodObject<{
+    kdfMetadata: z.ZodObject<{
+        kdf: z.ZodLiteral<"argon2id">;
+        version: z.ZodLiteral<"kdf-v1">;
+        salt: z.ZodString;
+        memory: z.ZodNumber;
+        iterations: z.ZodNumber;
+        parallelism: z.ZodNumber;
+    }, z.core.$strip>;
     encryptedVaultKey: z.ZodObject<{
         version: z.ZodLiteral<"enc-v1">;
         alg: z.ZodLiteral<"AES-GCM">;
@@ -59,31 +62,139 @@ export declare const storedEnvelopeSchema: z.ZodObject<{
             context: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>;
     }, z.core.$strip>;
-    kdfMetadata: z.ZodNullable<z.ZodObject<{
+    publicMetadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    method: z.ZodLiteral<"password">;
+}, z.core.$strip>;
+export declare const recoveryPhraseEnvelopeSchema: z.ZodObject<{
+    kdfMetadata: z.ZodObject<{
         kdf: z.ZodLiteral<"argon2id">;
         version: z.ZodLiteral<"kdf-v1">;
         salt: z.ZodString;
         memory: z.ZodNumber;
         iterations: z.ZodNumber;
         parallelism: z.ZodNumber;
-    }, z.core.$strip>>;
+    }, z.core.$strip>;
+    encryptedVaultKey: z.ZodObject<{
+        version: z.ZodLiteral<"enc-v1">;
+        alg: z.ZodLiteral<"AES-GCM">;
+        iv: z.ZodString;
+        ciphertext: z.ZodString;
+        aad: z.ZodObject<{
+            userId: z.ZodString;
+            resourceId: z.ZodString;
+            field: z.ZodEnum<{
+                vault_key: "vault_key";
+                vault_payload: "vault_payload";
+                vault_index: "vault_index";
+            }>;
+            context: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
     publicMetadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    method: z.ZodLiteral<"recovery_phrase">;
 }, z.core.$strip>;
+export declare const passkeyPrfEnvelopeSchema: z.ZodObject<{
+    kdfMetadata: z.ZodNull;
+    encryptedVaultKey: z.ZodObject<{
+        version: z.ZodLiteral<"enc-v1">;
+        alg: z.ZodLiteral<"AES-GCM">;
+        iv: z.ZodString;
+        ciphertext: z.ZodString;
+        aad: z.ZodObject<{
+            userId: z.ZodString;
+            resourceId: z.ZodString;
+            field: z.ZodEnum<{
+                vault_key: "vault_key";
+                vault_payload: "vault_payload";
+                vault_index: "vault_index";
+            }>;
+            context: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    publicMetadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    method: z.ZodLiteral<"passkey_prf">;
+}, z.core.$strip>;
+export declare const storedEnvelopeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kdfMetadata: z.ZodObject<{
+        kdf: z.ZodLiteral<"argon2id">;
+        version: z.ZodLiteral<"kdf-v1">;
+        salt: z.ZodString;
+        memory: z.ZodNumber;
+        iterations: z.ZodNumber;
+        parallelism: z.ZodNumber;
+    }, z.core.$strip>;
+    encryptedVaultKey: z.ZodObject<{
+        version: z.ZodLiteral<"enc-v1">;
+        alg: z.ZodLiteral<"AES-GCM">;
+        iv: z.ZodString;
+        ciphertext: z.ZodString;
+        aad: z.ZodObject<{
+            userId: z.ZodString;
+            resourceId: z.ZodString;
+            field: z.ZodEnum<{
+                vault_key: "vault_key";
+                vault_payload: "vault_payload";
+                vault_index: "vault_index";
+            }>;
+            context: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    publicMetadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    method: z.ZodLiteral<"password">;
+}, z.core.$strip>, z.ZodObject<{
+    kdfMetadata: z.ZodObject<{
+        kdf: z.ZodLiteral<"argon2id">;
+        version: z.ZodLiteral<"kdf-v1">;
+        salt: z.ZodString;
+        memory: z.ZodNumber;
+        iterations: z.ZodNumber;
+        parallelism: z.ZodNumber;
+    }, z.core.$strip>;
+    encryptedVaultKey: z.ZodObject<{
+        version: z.ZodLiteral<"enc-v1">;
+        alg: z.ZodLiteral<"AES-GCM">;
+        iv: z.ZodString;
+        ciphertext: z.ZodString;
+        aad: z.ZodObject<{
+            userId: z.ZodString;
+            resourceId: z.ZodString;
+            field: z.ZodEnum<{
+                vault_key: "vault_key";
+                vault_payload: "vault_payload";
+                vault_index: "vault_index";
+            }>;
+            context: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    publicMetadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    method: z.ZodLiteral<"recovery_phrase">;
+}, z.core.$strip>, z.ZodObject<{
+    kdfMetadata: z.ZodNull;
+    encryptedVaultKey: z.ZodObject<{
+        version: z.ZodLiteral<"enc-v1">;
+        alg: z.ZodLiteral<"AES-GCM">;
+        iv: z.ZodString;
+        ciphertext: z.ZodString;
+        aad: z.ZodObject<{
+            userId: z.ZodString;
+            resourceId: z.ZodString;
+            field: z.ZodEnum<{
+                vault_key: "vault_key";
+                vault_payload: "vault_payload";
+                vault_index: "vault_index";
+            }>;
+            context: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    publicMetadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    method: z.ZodLiteral<"passkey_prf">;
+}, z.core.$strip>], "method">;
 export type VaultEnvelope = z.infer<typeof storedEnvelopeSchema>;
 /** @deprecated Use VaultEnvelope */
 export type StoredEnvelope = VaultEnvelope;
-export type PasswordEnvelope = VaultEnvelope & {
-    method: "password";
-    kdfMetadata: Argon2idKdfMetadata;
-};
-export type RecoveryPhraseEnvelope = VaultEnvelope & {
-    method: "recovery_phrase";
-    kdfMetadata: Argon2idKdfMetadata;
-};
-export type PasskeyPrfEnvelope = VaultEnvelope & {
-    method: "passkey_prf";
-    kdfMetadata: null;
-};
+export type PasswordEnvelope = z.infer<typeof passwordEnvelopeSchema>;
+export type RecoveryPhraseEnvelope = z.infer<typeof recoveryPhraseEnvelopeSchema>;
+export type PasskeyPrfEnvelope = z.infer<typeof passkeyPrfEnvelopeSchema>;
 export { VAULT_CRYPTO_VERSION } from "../constants.js";
 export declare const vaultSetupEnvelopeFieldsSchema: z.ZodObject<{
     cryptoVersion: z.ZodLiteral<"vault-v1">;
@@ -104,11 +215,14 @@ export declare const vaultSetupEnvelopeFieldsSchema: z.ZodObject<{
         }, z.core.$strip>;
     }, z.core.$strip>;
     passwordEnvelope: z.ZodObject<{
-        method: z.ZodEnum<{
-            password: "password";
-            recovery_phrase: "recovery_phrase";
-            passkey_prf: "passkey_prf";
-        }>;
+        kdfMetadata: z.ZodObject<{
+            kdf: z.ZodLiteral<"argon2id">;
+            version: z.ZodLiteral<"kdf-v1">;
+            salt: z.ZodString;
+            memory: z.ZodNumber;
+            iterations: z.ZodNumber;
+            parallelism: z.ZodNumber;
+        }, z.core.$strip>;
         encryptedVaultKey: z.ZodObject<{
             version: z.ZodLiteral<"enc-v1">;
             alg: z.ZodLiteral<"AES-GCM">;
@@ -125,22 +239,18 @@ export declare const vaultSetupEnvelopeFieldsSchema: z.ZodObject<{
                 context: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>;
         }, z.core.$strip>;
-        kdfMetadata: z.ZodNullable<z.ZodObject<{
+        publicMetadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        method: z.ZodLiteral<"password">;
+    }, z.core.$strip>;
+    recoveryEnvelope: z.ZodObject<{
+        kdfMetadata: z.ZodObject<{
             kdf: z.ZodLiteral<"argon2id">;
             version: z.ZodLiteral<"kdf-v1">;
             salt: z.ZodString;
             memory: z.ZodNumber;
             iterations: z.ZodNumber;
             parallelism: z.ZodNumber;
-        }, z.core.$strip>>;
-        publicMetadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    }, z.core.$strip>;
-    recoveryEnvelope: z.ZodObject<{
-        method: z.ZodEnum<{
-            password: "password";
-            recovery_phrase: "recovery_phrase";
-            passkey_prf: "passkey_prf";
-        }>;
+        }, z.core.$strip>;
         encryptedVaultKey: z.ZodObject<{
             version: z.ZodLiteral<"enc-v1">;
             alg: z.ZodLiteral<"AES-GCM">;
@@ -157,22 +267,11 @@ export declare const vaultSetupEnvelopeFieldsSchema: z.ZodObject<{
                 context: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>;
         }, z.core.$strip>;
-        kdfMetadata: z.ZodNullable<z.ZodObject<{
-            kdf: z.ZodLiteral<"argon2id">;
-            version: z.ZodLiteral<"kdf-v1">;
-            salt: z.ZodString;
-            memory: z.ZodNumber;
-            iterations: z.ZodNumber;
-            parallelism: z.ZodNumber;
-        }, z.core.$strip>>;
         publicMetadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        method: z.ZodLiteral<"recovery_phrase">;
     }, z.core.$strip>;
     passkeyPrfEnvelope: z.ZodOptional<z.ZodNullable<z.ZodObject<{
-        method: z.ZodEnum<{
-            password: "password";
-            recovery_phrase: "recovery_phrase";
-            passkey_prf: "passkey_prf";
-        }>;
+        kdfMetadata: z.ZodNull;
         encryptedVaultKey: z.ZodObject<{
             version: z.ZodLiteral<"enc-v1">;
             alg: z.ZodLiteral<"AES-GCM">;
@@ -189,15 +288,8 @@ export declare const vaultSetupEnvelopeFieldsSchema: z.ZodObject<{
                 context: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>;
         }, z.core.$strip>;
-        kdfMetadata: z.ZodNullable<z.ZodObject<{
-            kdf: z.ZodLiteral<"argon2id">;
-            version: z.ZodLiteral<"kdf-v1">;
-            salt: z.ZodString;
-            memory: z.ZodNumber;
-            iterations: z.ZodNumber;
-            parallelism: z.ZodNumber;
-        }, z.core.$strip>>;
         publicMetadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        method: z.ZodLiteral<"passkey_prf">;
     }, z.core.$strip>>>;
 }, z.core.$strip>;
 //# sourceMappingURL=schemas.d.ts.map

package/dist/validation/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/validation/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;iBAWjC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC3E,4CAA4C;AAC5C,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAErD,eAAO,MAAM,yBAAyB;;;;;;;iBAOpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,iBAAiB;;;;;;;iBAA4B,CAAC;AAC3D,MAAM,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAE9C,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,iBAAiB,GAAG,aAAa,CAAC;AAEjF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAK/B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACjE,oCAAoC;AACpC,MAAM,MAAM,cAAc,GAAG,aAAa,CAAC;AAE3C,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAC7C,MAAM,EAAE,UAAU,CAAC;IACnB,WAAW,EAAE,mBAAmB,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG;IACnD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,WAAW,EAAE,mBAAmB,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG;IAC/C,MAAM,EAAE,aAAa,CAAC;IACtB,WAAW,EAAE,IAAI,CAAC;CACnB,CAAC;AAEF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMzC,CAAC"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/validation/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;iBAWjC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC3E,4CAA4C;AAC5C,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAErD,eAAO,MAAM,yBAAyB;;;;;;;iBAOpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,iBAAiB;;;;;;;iBAA4B,CAAC;AAC3D,MAAM,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAE9C,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,iBAAiB,GAAG,aAAa,CAAC;AAOjF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIjC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIvC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;iBAInC,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAI/B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACjE,oCAAoC;AACpC,MAAM,MAAM,cAAc,GAAG,aAAa,CAAC;AAE3C,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMzC,CAAC"}

package/dist/validation/schemas.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { ENCRYPTION_ALG, ENCRYPTION_VERSION } from "../constants.js";
+import { ARGON2ID_LIMITS } from "../kdf/params.js";
 const aadFieldSchema = z.enum(["vault_key", "vault_payload", "vault_index"]);
 export const encryptedPayloadSchema = z.object({
     version: z.literal(ENCRYPTION_VERSION),
@@ -16,24 +17,42 @@ export const encryptedPayloadSchema = z.object({
 export const argon2idKdfMetadataSchema = z.object({
     kdf: z.literal("argon2id"),
     version: z.literal("kdf-v1"),
-    salt: z.string().min(1),
-    memory: z.number().int().positive(),
-    iterations: z.number().int().positive(),
-    parallelism: z.number().int().positive(),
+    salt: z.string().min(1).max(128),
+    memory: z.number().int().min(ARGON2ID_LIMITS.memory.min).max(ARGON2ID_LIMITS.memory.max),
+    iterations: z.number().int().min(ARGON2ID_LIMITS.iterations.min).max(ARGON2ID_LIMITS.iterations.max),
+    parallelism: z.number().int().min(ARGON2ID_LIMITS.parallelism.min).max(ARGON2ID_LIMITS.parallelism.max),
 });
 export const kdfMetadataSchema = argon2idKdfMetadataSchema;
-export const storedEnvelopeSchema = z.object({
-    method: z.enum(["password", "recovery_phrase", "passkey_prf"]),
+const envelopeFields = {
     encryptedVaultKey: encryptedPayloadSchema,
-    kdfMetadata: kdfMetadataSchema.nullable(),
     publicMetadata: z.record(z.string(), z.unknown()).optional(),
+};
+export const passwordEnvelopeSchema = z.object({
+    method: z.literal("password"),
+    ...envelopeFields,
+    kdfMetadata: argon2idKdfMetadataSchema,
 });
+export const recoveryPhraseEnvelopeSchema = z.object({
+    method: z.literal("recovery_phrase"),
+    ...envelopeFields,
+    kdfMetadata: argon2idKdfMetadataSchema,
+});
+export const passkeyPrfEnvelopeSchema = z.object({
+    method: z.literal("passkey_prf"),
+    ...envelopeFields,
+    kdfMetadata: z.null(),
+});
+export const storedEnvelopeSchema = z.discriminatedUnion("method", [
+    passwordEnvelopeSchema,
+    recoveryPhraseEnvelopeSchema,
+    passkeyPrfEnvelopeSchema,
+]);
 export { VAULT_CRYPTO_VERSION } from "../constants.js";
 export const vaultSetupEnvelopeFieldsSchema = z.object({
     cryptoVersion: z.literal("vault-v1"),
     encryptedBlob: encryptedPayloadSchema,
-    passwordEnvelope: storedEnvelopeSchema,
-    recoveryEnvelope: storedEnvelopeSchema,
-    passkeyPrfEnvelope: storedEnvelopeSchema.nullable().optional(),
+    passwordEnvelope: passwordEnvelopeSchema,
+    recoveryEnvelope: recoveryPhraseEnvelopeSchema,
+    passkeyPrfEnvelope: passkeyPrfEnvelopeSchema.nullable().optional(),
 });
 //# sourceMappingURL=schemas.js.map

package/dist/validation/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/validation/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErE,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IACtC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC9B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QAC7B,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC/B,CAAC;CACH,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAK3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC9D,iBAAiB,EAAE,sBAAsB;IACzC,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAC;AAqBH,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IACpC,aAAa,EAAE,sBAAsB;IACrC,gBAAgB,EAAE,oBAAoB;IACtC,gBAAgB,EAAE,oBAAoB;IACtC,kBAAkB,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC/D,CAAC,CAAC"}
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/validation/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IACtC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC9B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QAC7B,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC/B,CAAC;CACH,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC;IACxF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC;IACpG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC;CACxG,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAK3D,MAAM,cAAc,GAAG;IACrB,iBAAiB,EAAE,sBAAsB;IACzC,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC7B,GAAG,cAAc;IACjB,WAAW,EAAE,yBAAyB;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACpC,GAAG,cAAc;IACjB,WAAW,EAAE,yBAAyB;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAChC,GAAG,cAAc;IACjB,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACjE,sBAAsB;IACtB,4BAA4B;IAC5B,wBAAwB;CACzB,CAAC,CAAC;AAUH,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IACpC,aAAa,EAAE,sBAAsB;IACrC,gBAAgB,EAAE,sBAAsB;IACxC,gBAAgB,EAAE,4BAA4B;IAC9C,kBAAkB,EAAE,wBAAwB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC"}