@unwanted/matrix-sdk-mini 34.12.0 → 36.0.0

package/lib/crypto/algorithms/olm.js

@@ -1,299 +0,0 @@
-import _asyncToGenerator from "@babel/runtime/helpers/asyncToGenerator";
-import _defineProperty from "@babel/runtime/helpers/defineProperty";
-/*
-Copyright 2016 - 2021 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-/**
- * Defines m.olm encryption/decryption
- */
-
-import { logger } from "../../logger.js";
-import * as olmlib from "../olmlib.js";
-import { DeviceInfo } from "../deviceinfo.js";
-import { DecryptionAlgorithm, EncryptionAlgorithm, registerAlgorithm } from "./base.js";
-import { DecryptionFailureCode } from "../../crypto-api/index.js";
-import { DecryptionError } from "../../common-crypto/CryptoBackend.js";
-var DeviceVerification = DeviceInfo.DeviceVerification;
-/**
- * Olm encryption implementation
- *
- * @param params - parameters, as per {@link EncryptionAlgorithm}
- */
-class OlmEncryption extends EncryptionAlgorithm {
-  constructor() {
-    super(...arguments);
-    _defineProperty(this, "sessionPrepared", false);
-    _defineProperty(this, "prepPromise", null);
-  }
-  /**
-   * @internal
-    * @param roomMembers - list of currently-joined users in the room
-   * @returns Promise which resolves when setup is complete
-   */
-  ensureSession(roomMembers) {
-    if (this.prepPromise) {
-      // prep already in progress
-      return this.prepPromise;
-    }
-    if (this.sessionPrepared) {
-      // prep already done
-      return Promise.resolve();
-    }
-    this.prepPromise = this.crypto.downloadKeys(roomMembers).then(() => {
-      return this.crypto.ensureOlmSessionsForUsers(roomMembers);
-    }).then(() => {
-      this.sessionPrepared = true;
-    }).finally(() => {
-      this.prepPromise = null;
-    });
-    return this.prepPromise;
-  }
-
-  /**
-   * @param content - plaintext event content
-   *
-   * @returns Promise which resolves to the new event body
-   */
-  encryptMessage(room, eventType, content) {
-    var _this = this;
-    return _asyncToGenerator(function* () {
-      // pick the list of recipients based on the membership list.
-      //
-      // TODO: there is a race condition here! What if a new user turns up
-      // just as you are sending a secret message?
-
-      var members = yield room.getEncryptionTargetMembers();
-      var users = members.map(function (u) {
-        return u.userId;
-      });
-      yield _this.ensureSession(users);
-      var payloadFields = {
-        room_id: room.roomId,
-        type: eventType,
-        content: content
-      };
-      var encryptedContent = {
-        algorithm: olmlib.OLM_ALGORITHM,
-        sender_key: _this.olmDevice.deviceCurve25519Key,
-        ciphertext: {}
-      };
-      var promises = [];
-      for (var userId of users) {
-        var devices = _this.crypto.getStoredDevicesForUser(userId) || [];
-        for (var deviceInfo of devices) {
-          var key = deviceInfo.getIdentityKey();
-          if (key == _this.olmDevice.deviceCurve25519Key) {
-            // don't bother sending to ourself
-            continue;
-          }
-          if (deviceInfo.verified == DeviceVerification.BLOCKED) {
-            // don't bother setting up sessions with blocked users
-            continue;
-          }
-          promises.push(olmlib.encryptMessageForDevice(encryptedContent.ciphertext, _this.userId, _this.deviceId, _this.olmDevice, userId, deviceInfo, payloadFields));
-        }
-      }
-      return Promise.all(promises).then(() => encryptedContent);
-    })();
-  }
-}
-
-/**
- * Olm decryption implementation
- *
- * @param params - parameters, as per {@link DecryptionAlgorithm}
- */
-class OlmDecryption extends DecryptionAlgorithm {
-  /**
-   * returns a promise which resolves to a
-   * {@link EventDecryptionResult} once we have finished
-   * decrypting. Rejects with an `algorithms.DecryptionError` if there is a
-   * problem decrypting the event.
-   */
-  decryptEvent(event) {
-    var _this2 = this;
-    return _asyncToGenerator(function* () {
-      var content = event.getWireContent();
-      var deviceKey = content.sender_key;
-      var ciphertext = content.ciphertext;
-      if (!ciphertext) {
-        throw new DecryptionError(DecryptionFailureCode.OLM_MISSING_CIPHERTEXT, "Missing ciphertext");
-      }
-      if (!(_this2.olmDevice.deviceCurve25519Key in ciphertext)) {
-        throw new DecryptionError(DecryptionFailureCode.OLM_NOT_INCLUDED_IN_RECIPIENTS, "Not included in recipients");
-      }
-      var message = ciphertext[_this2.olmDevice.deviceCurve25519Key];
-      var payloadString;
-      try {
-        payloadString = yield _this2.decryptMessage(deviceKey, message);
-      } catch (e) {
-        throw new DecryptionError(DecryptionFailureCode.OLM_BAD_ENCRYPTED_MESSAGE, "Bad Encrypted Message", {
-          sender: deviceKey,
-          err: e
-        });
-      }
-      var payload = JSON.parse(payloadString);
-
-      // check that we were the intended recipient, to avoid unknown-key attack
-      // https://github.com/vector-im/vector-web/issues/2483
-      if (payload.recipient != _this2.userId) {
-        throw new DecryptionError(DecryptionFailureCode.OLM_BAD_RECIPIENT, "Message was intended for " + payload.recipient);
-      }
-      if (payload.recipient_keys.ed25519 != _this2.olmDevice.deviceEd25519Key) {
-        throw new DecryptionError(DecryptionFailureCode.OLM_BAD_RECIPIENT_KEY, "Message not intended for this device", {
-          intended: payload.recipient_keys.ed25519,
-          our_key: _this2.olmDevice.deviceEd25519Key
-        });
-      }
-
-      // check that the device that encrypted the event belongs to the user that the event claims it's from.
-      //
-      // If the device is unknown then we check that we don't have any pending key-query requests for the sender. If
-      // after that the device is still unknown, then we can only assume that the device logged out and accept it
-      // anyway. Some event handlers, such as secret sharing, may be more strict and reject events that come from
-      // unknown devices.
-      //
-      // This is a defence against the following scenario:
-      //
-      //   * Alice has verified Bob and Mallory.
-      //   * Mallory gets control of Alice's server, and sends a megolm session to Alice using her (Mallory's)
-      //     senderkey, but claiming to be from Bob.
-      //   * Mallory sends more events using that session, claiming to be from Bob.
-      //   * Alice sees that the senderkey is verified (since she verified Mallory) so marks events those events as
-      //     verified even though the sender is forged.
-      //
-      // In practice, it's not clear that the js-sdk would behave that way, so this may be only a defence in depth.
-
-      var senderKeyUser = _this2.crypto.deviceList.getUserByIdentityKey(olmlib.OLM_ALGORITHM, deviceKey);
-      if (senderKeyUser === undefined || senderKeyUser === null) {
-        // Wait for any pending key query fetches for the user to complete before trying the lookup again.
-        try {
-          yield _this2.crypto.deviceList.downloadKeys([event.getSender()], false);
-        } catch (e) {
-          throw new DecryptionError(DecryptionFailureCode.OLM_BAD_SENDER_CHECK_FAILED, "Could not verify sender identity", {
-            sender: deviceKey,
-            err: e
-          });
-        }
-        senderKeyUser = _this2.crypto.deviceList.getUserByIdentityKey(olmlib.OLM_ALGORITHM, deviceKey);
-      }
-      if (senderKeyUser !== event.getSender() && senderKeyUser !== undefined && senderKeyUser !== null) {
-        throw new DecryptionError(DecryptionFailureCode.OLM_BAD_SENDER, "Message claimed to be from " + event.getSender(), {
-          real_sender: senderKeyUser
-        });
-      }
-
-      // check that the original sender matches what the homeserver told us, to
-      // avoid people masquerading as others.
-      // (this check is also provided via the sender's embedded ed25519 key,
-      // which is checked elsewhere).
-      if (payload.sender != event.getSender()) {
-        throw new DecryptionError(DecryptionFailureCode.OLM_FORWARDED_MESSAGE, "Message forwarded from " + payload.sender, {
-          reported_sender: event.getSender()
-        });
-      }
-
-      // Olm events intended for a room have a room_id.
-      if (payload.room_id !== event.getRoomId()) {
-        throw new DecryptionError(DecryptionFailureCode.OLM_BAD_ROOM, "Message intended for room " + payload.room_id, {
-          reported_room: event.getRoomId() || "ROOM_ID_UNDEFINED"
-        });
-      }
-      var claimedKeys = payload.keys || {};
-      return {
-        clearEvent: payload,
-        senderCurve25519Key: deviceKey,
-        claimedEd25519Key: claimedKeys.ed25519 || null
-      };
-    })();
-  }
-
-  /**
-   * Attempt to decrypt an Olm message
-   *
-   * @param theirDeviceIdentityKey -  Curve25519 identity key of the sender
-   * @param message -  message object, with 'type' and 'body' fields
-   *
-   * @returns payload, if decrypted successfully.
-   */
-  decryptMessage(theirDeviceIdentityKey, message) {
-    // This is a wrapper that serialises decryptions of prekey messages, because
-    // otherwise we race between deciding we have no active sessions for the message
-    // and creating a new one, which we can only do once because it removes the OTK.
-    if (message.type !== 0) {
-      // not a prekey message: we can safely just try & decrypt it
-      return this.reallyDecryptMessage(theirDeviceIdentityKey, message);
-    } else {
-      var myPromise = this.olmDevice.olmPrekeyPromise.then(() => {
-        return this.reallyDecryptMessage(theirDeviceIdentityKey, message);
-      });
-      // we want the error, but don't propagate it to the next decryption
-      this.olmDevice.olmPrekeyPromise = myPromise.catch(() => {});
-      return myPromise;
-    }
-  }
-  reallyDecryptMessage(theirDeviceIdentityKey, message) {
-    var _this3 = this;
-    return _asyncToGenerator(function* () {
-      var sessionIds = yield _this3.olmDevice.getSessionIdsForDevice(theirDeviceIdentityKey);
-
-      // try each session in turn.
-      var decryptionErrors = {};
-      for (var sessionId of sessionIds) {
-        try {
-          var payload = yield _this3.olmDevice.decryptMessage(theirDeviceIdentityKey, sessionId, message.type, message.body);
-          logger.log("Decrypted Olm message from " + theirDeviceIdentityKey + " with session " + sessionId);
-          return payload;
-        } catch (e) {
-          var foundSession = yield _this3.olmDevice.matchesSession(theirDeviceIdentityKey, sessionId, message.type, message.body);
-          if (foundSession) {
-            // decryption failed, but it was a prekey message matching this
-            // session, so it should have worked.
-            throw new Error("Error decrypting prekey message with existing session id " + sessionId + ": " + e.message);
-          }
-
-          // otherwise it's probably a message for another session; carry on, but
-          // keep a record of the error
-          decryptionErrors[sessionId] = e.message;
-        }
-      }
-      if (message.type !== 0) {
-        // not a prekey message, so it should have matched an existing session, but it
-        // didn't work.
-
-        if (sessionIds.length === 0) {
-          throw new Error("No existing sessions");
-        }
-        throw new Error("Error decrypting non-prekey message with existing sessions: " + JSON.stringify(decryptionErrors));
-      }
-
-      // prekey message which doesn't match any existing sessions: make a new
-      // session.
-
-      var res;
-      try {
-        res = yield _this3.olmDevice.createInboundSession(theirDeviceIdentityKey, message.type, message.body);
-      } catch (e) {
-        decryptionErrors["(new)"] = e.message;
-        throw new Error("Error decrypting prekey message: " + JSON.stringify(decryptionErrors));
-      }
-      logger.log("created new inbound Olm session ID " + res.session_id + " with " + theirDeviceIdentityKey);
-      return res.payload;
-    })();
-  }
-}
-registerAlgorithm(olmlib.OLM_ALGORITHM, OlmEncryption, OlmDecryption);
-//# sourceMappingURL=olm.js.map

package/lib/crypto/algorithms/olm.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"olm.js","names":["logger","olmlib","DeviceInfo","DecryptionAlgorithm","EncryptionAlgorithm","registerAlgorithm","DecryptionFailureCode","DecryptionError","DeviceVerification","OlmEncryption","constructor","arguments","_defineProperty","ensureSession","roomMembers","prepPromise","sessionPrepared","Promise","resolve","crypto","downloadKeys","then","ensureOlmSessionsForUsers","finally","encryptMessage","room","eventType","content","_this","_asyncToGenerator","members","getEncryptionTargetMembers","users","map","u","userId","payloadFields","room_id","roomId","type","encryptedContent","algorithm","OLM_ALGORITHM","sender_key","olmDevice","deviceCurve25519Key","ciphertext","promises","devices","getStoredDevicesForUser","deviceInfo","key","getIdentityKey","verified","BLOCKED","push","encryptMessageForDevice","deviceId","all","OlmDecryption","decryptEvent","event","_this2","getWireContent","deviceKey","OLM_MISSING_CIPHERTEXT","OLM_NOT_INCLUDED_IN_RECIPIENTS","message","payloadString","decryptMessage","e","OLM_BAD_ENCRYPTED_MESSAGE","sender","err","payload","JSON","parse","recipient","OLM_BAD_RECIPIENT","recipient_keys","ed25519","deviceEd25519Key","OLM_BAD_RECIPIENT_KEY","intended","our_key","senderKeyUser","deviceList","getUserByIdentityKey","undefined","getSender","OLM_BAD_SENDER_CHECK_FAILED","OLM_BAD_SENDER","real_sender","OLM_FORWARDED_MESSAGE","reported_sender","getRoomId","OLM_BAD_ROOM","reported_room","claimedKeys","keys","clearEvent","senderCurve25519Key","claimedEd25519Key","theirDeviceIdentityKey","reallyDecryptMessage","myPromise","olmPrekeyPromise","catch","_this3","sessionIds","getSessionIdsForDevice","decryptionErrors","sessionId","body","log","foundSession","matchesSession","Error","length","stringify","res","createInboundSession","session_id"],"sources":["../../../src/crypto/algorithms/olm.ts"],"sourcesContent":["/*\nCopyright 2016 - 2021 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\n/**\n * Defines m.olm encryption/decryption\n */\n\nimport type { IEventDecryptionResult } from \"../../@types/crypto.ts\";\nimport { logger } from \"../../logger.ts\";\nimport * as olmlib from \"../olmlib.ts\";\nimport { DeviceInfo } from \"../deviceinfo.ts\";\nimport { DecryptionAlgorithm, EncryptionAlgorithm, registerAlgorithm } from \"./base.ts\";\nimport { Room } from \"../../models/room.ts\";\nimport { IContent, MatrixEvent } from \"../../models/event.ts\";\nimport { IEncryptedContent, IOlmEncryptedContent } from \"../index.ts\";\nimport { IInboundSession } from \"../OlmDevice.ts\";\nimport { DecryptionFailureCode } from \"../../crypto-api/index.ts\";\nimport { DecryptionError } from \"../../common-crypto/CryptoBackend.ts\";\n\nconst DeviceVerification = DeviceInfo.DeviceVerification;\n\nexport interface IMessage {\n    type: number;\n    body: string;\n}\n\n/**\n * Olm encryption implementation\n *\n * @param params - parameters, as per {@link EncryptionAlgorithm}\n */\nclass OlmEncryption extends EncryptionAlgorithm {\n    private sessionPrepared = false;\n    private prepPromise: Promise<void> | null = null;\n\n    /**\n     * @internal\n\n     * @param roomMembers - list of currently-joined users in the room\n     * @returns Promise which resolves when setup is complete\n     */\n    private ensureSession(roomMembers: string[]): Promise<void> {\n        if (this.prepPromise) {\n            // prep already in progress\n            return this.prepPromise;\n        }\n\n        if (this.sessionPrepared) {\n            // prep already done\n            return Promise.resolve();\n        }\n\n        this.prepPromise = this.crypto\n            .downloadKeys(roomMembers)\n            .then(() => {\n                return this.crypto.ensureOlmSessionsForUsers(roomMembers);\n            })\n            .then(() => {\n                this.sessionPrepared = true;\n            })\n            .finally(() => {\n                this.prepPromise = null;\n            });\n\n        return this.prepPromise;\n    }\n\n    /**\n     * @param content - plaintext event content\n     *\n     * @returns Promise which resolves to the new event body\n     */\n    public async encryptMessage(room: Room, eventType: string, content: IContent): Promise<IOlmEncryptedContent> {\n        // pick the list of recipients based on the membership list.\n        //\n        // TODO: there is a race condition here! What if a new user turns up\n        // just as you are sending a secret message?\n\n        const members = await room.getEncryptionTargetMembers();\n\n        const users = members.map(function (u) {\n            return u.userId;\n        });\n\n        await this.ensureSession(users);\n\n        const payloadFields = {\n            room_id: room.roomId,\n            type: eventType,\n            content: content,\n        };\n\n        const encryptedContent: IEncryptedContent = {\n            algorithm: olmlib.OLM_ALGORITHM,\n            sender_key: this.olmDevice.deviceCurve25519Key!,\n            ciphertext: {},\n        };\n\n        const promises: Promise<void>[] = [];\n\n        for (const userId of users) {\n            const devices = this.crypto.getStoredDevicesForUser(userId) || [];\n\n            for (const deviceInfo of devices) {\n                const key = deviceInfo.getIdentityKey();\n                if (key == this.olmDevice.deviceCurve25519Key) {\n                    // don't bother sending to ourself\n                    continue;\n                }\n                if (deviceInfo.verified == DeviceVerification.BLOCKED) {\n                    // don't bother setting up sessions with blocked users\n                    continue;\n                }\n\n                promises.push(\n                    olmlib.encryptMessageForDevice(\n                        encryptedContent.ciphertext,\n                        this.userId,\n                        this.deviceId,\n                        this.olmDevice,\n                        userId,\n                        deviceInfo,\n                        payloadFields,\n                    ),\n                );\n            }\n        }\n\n        return Promise.all(promises).then(() => encryptedContent);\n    }\n}\n\n/**\n * Olm decryption implementation\n *\n * @param params - parameters, as per {@link DecryptionAlgorithm}\n */\nclass OlmDecryption extends DecryptionAlgorithm {\n    /**\n     * returns a promise which resolves to a\n     * {@link EventDecryptionResult} once we have finished\n     * decrypting. Rejects with an `algorithms.DecryptionError` if there is a\n     * problem decrypting the event.\n     */\n    public async decryptEvent(event: MatrixEvent): Promise<IEventDecryptionResult> {\n        const content = event.getWireContent();\n        const deviceKey = content.sender_key;\n        const ciphertext = content.ciphertext;\n\n        if (!ciphertext) {\n            throw new DecryptionError(DecryptionFailureCode.OLM_MISSING_CIPHERTEXT, \"Missing ciphertext\");\n        }\n\n        if (!(this.olmDevice.deviceCurve25519Key! in ciphertext)) {\n            throw new DecryptionError(\n                DecryptionFailureCode.OLM_NOT_INCLUDED_IN_RECIPIENTS,\n                \"Not included in recipients\",\n            );\n        }\n        const message = ciphertext[this.olmDevice.deviceCurve25519Key!];\n        let payloadString: string;\n\n        try {\n            payloadString = await this.decryptMessage(deviceKey, message);\n        } catch (e) {\n            throw new DecryptionError(DecryptionFailureCode.OLM_BAD_ENCRYPTED_MESSAGE, \"Bad Encrypted Message\", {\n                sender: deviceKey,\n                err: e as Error,\n            });\n        }\n\n        const payload = JSON.parse(payloadString);\n\n        // check that we were the intended recipient, to avoid unknown-key attack\n        // https://github.com/vector-im/vector-web/issues/2483\n        if (payload.recipient != this.userId) {\n            throw new DecryptionError(\n                DecryptionFailureCode.OLM_BAD_RECIPIENT,\n                \"Message was intended for \" + payload.recipient,\n            );\n        }\n\n        if (payload.recipient_keys.ed25519 != this.olmDevice.deviceEd25519Key) {\n            throw new DecryptionError(\n                DecryptionFailureCode.OLM_BAD_RECIPIENT_KEY,\n                \"Message not intended for this device\",\n                {\n                    intended: payload.recipient_keys.ed25519,\n                    our_key: this.olmDevice.deviceEd25519Key!,\n                },\n            );\n        }\n\n        // check that the device that encrypted the event belongs to the user that the event claims it's from.\n        //\n        // If the device is unknown then we check that we don't have any pending key-query requests for the sender. If\n        // after that the device is still unknown, then we can only assume that the device logged out and accept it\n        // anyway. Some event handlers, such as secret sharing, may be more strict and reject events that come from\n        // unknown devices.\n        //\n        // This is a defence against the following scenario:\n        //\n        //   * Alice has verified Bob and Mallory.\n        //   * Mallory gets control of Alice's server, and sends a megolm session to Alice using her (Mallory's)\n        //     senderkey, but claiming to be from Bob.\n        //   * Mallory sends more events using that session, claiming to be from Bob.\n        //   * Alice sees that the senderkey is verified (since she verified Mallory) so marks events those events as\n        //     verified even though the sender is forged.\n        //\n        // In practice, it's not clear that the js-sdk would behave that way, so this may be only a defence in depth.\n\n        let senderKeyUser = this.crypto.deviceList.getUserByIdentityKey(olmlib.OLM_ALGORITHM, deviceKey);\n        if (senderKeyUser === undefined || senderKeyUser === null) {\n            // Wait for any pending key query fetches for the user to complete before trying the lookup again.\n            try {\n                await this.crypto.deviceList.downloadKeys([event.getSender()!], false);\n            } catch (e) {\n                throw new DecryptionError(\n                    DecryptionFailureCode.OLM_BAD_SENDER_CHECK_FAILED,\n                    \"Could not verify sender identity\",\n                    {\n                        sender: deviceKey,\n                        err: e as Error,\n                    },\n                );\n            }\n\n            senderKeyUser = this.crypto.deviceList.getUserByIdentityKey(olmlib.OLM_ALGORITHM, deviceKey);\n        }\n        if (senderKeyUser !== event.getSender() && senderKeyUser !== undefined && senderKeyUser !== null) {\n            throw new DecryptionError(\n                DecryptionFailureCode.OLM_BAD_SENDER,\n                \"Message claimed to be from \" + event.getSender(),\n                {\n                    real_sender: senderKeyUser,\n                },\n            );\n        }\n\n        // check that the original sender matches what the homeserver told us, to\n        // avoid people masquerading as others.\n        // (this check is also provided via the sender's embedded ed25519 key,\n        // which is checked elsewhere).\n        if (payload.sender != event.getSender()) {\n            throw new DecryptionError(\n                DecryptionFailureCode.OLM_FORWARDED_MESSAGE,\n                \"Message forwarded from \" + payload.sender,\n                {\n                    reported_sender: event.getSender()!,\n                },\n            );\n        }\n\n        // Olm events intended for a room have a room_id.\n        if (payload.room_id !== event.getRoomId()) {\n            throw new DecryptionError(\n                DecryptionFailureCode.OLM_BAD_ROOM,\n                \"Message intended for room \" + payload.room_id,\n                {\n                    reported_room: event.getRoomId() || \"ROOM_ID_UNDEFINED\",\n                },\n            );\n        }\n\n        const claimedKeys = payload.keys || {};\n\n        return {\n            clearEvent: payload,\n            senderCurve25519Key: deviceKey,\n            claimedEd25519Key: claimedKeys.ed25519 || null,\n        };\n    }\n\n    /**\n     * Attempt to decrypt an Olm message\n     *\n     * @param theirDeviceIdentityKey -  Curve25519 identity key of the sender\n     * @param message -  message object, with 'type' and 'body' fields\n     *\n     * @returns payload, if decrypted successfully.\n     */\n    private decryptMessage(theirDeviceIdentityKey: string, message: IMessage): Promise<string> {\n        // This is a wrapper that serialises decryptions of prekey messages, because\n        // otherwise we race between deciding we have no active sessions for the message\n        // and creating a new one, which we can only do once because it removes the OTK.\n        if (message.type !== 0) {\n            // not a prekey message: we can safely just try & decrypt it\n            return this.reallyDecryptMessage(theirDeviceIdentityKey, message);\n        } else {\n            const myPromise = this.olmDevice.olmPrekeyPromise.then(() => {\n                return this.reallyDecryptMessage(theirDeviceIdentityKey, message);\n            });\n            // we want the error, but don't propagate it to the next decryption\n            this.olmDevice.olmPrekeyPromise = myPromise.catch(() => {});\n            return myPromise;\n        }\n    }\n\n    private async reallyDecryptMessage(theirDeviceIdentityKey: string, message: IMessage): Promise<string> {\n        const sessionIds = await this.olmDevice.getSessionIdsForDevice(theirDeviceIdentityKey);\n\n        // try each session in turn.\n        const decryptionErrors: Record<string, string> = {};\n        for (const sessionId of sessionIds) {\n            try {\n                const payload = await this.olmDevice.decryptMessage(\n                    theirDeviceIdentityKey,\n                    sessionId,\n                    message.type,\n                    message.body,\n                );\n                logger.log(\"Decrypted Olm message from \" + theirDeviceIdentityKey + \" with session \" + sessionId);\n                return payload;\n            } catch (e) {\n                const foundSession = await this.olmDevice.matchesSession(\n                    theirDeviceIdentityKey,\n                    sessionId,\n                    message.type,\n                    message.body,\n                );\n\n                if (foundSession) {\n                    // decryption failed, but it was a prekey message matching this\n                    // session, so it should have worked.\n                    throw new Error(\n                        \"Error decrypting prekey message with existing session id \" +\n                            sessionId +\n                            \": \" +\n                            (<Error>e).message,\n                    );\n                }\n\n                // otherwise it's probably a message for another session; carry on, but\n                // keep a record of the error\n                decryptionErrors[sessionId] = (<Error>e).message;\n            }\n        }\n\n        if (message.type !== 0) {\n            // not a prekey message, so it should have matched an existing session, but it\n            // didn't work.\n\n            if (sessionIds.length === 0) {\n                throw new Error(\"No existing sessions\");\n            }\n\n            throw new Error(\n                \"Error decrypting non-prekey message with existing sessions: \" + JSON.stringify(decryptionErrors),\n            );\n        }\n\n        // prekey message which doesn't match any existing sessions: make a new\n        // session.\n\n        let res: IInboundSession;\n        try {\n            res = await this.olmDevice.createInboundSession(theirDeviceIdentityKey, message.type, message.body);\n        } catch (e) {\n            decryptionErrors[\"(new)\"] = (<Error>e).message;\n            throw new Error(\"Error decrypting prekey message: \" + JSON.stringify(decryptionErrors));\n        }\n\n        logger.log(\"created new inbound Olm session ID \" + res.session_id + \" with \" + theirDeviceIdentityKey);\n        return res.payload;\n    }\n}\n\nregisterAlgorithm(olmlib.OLM_ALGORITHM, OlmEncryption, OlmDecryption);\n"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;;AAGA,SAASA,MAAM,QAAQ,iBAAiB;AACxC,OAAO,KAAKC,MAAM,MAAM,cAAc;AACtC,SAASC,UAAU,QAAQ,kBAAkB;AAC7C,SAASC,mBAAmB,EAAEC,mBAAmB,EAAEC,iBAAiB,QAAQ,WAAW;AAKvF,SAASC,qBAAqB,QAAQ,2BAA2B;AACjE,SAASC,eAAe,QAAQ,sCAAsC;AAEtE,IAAMC,kBAAkB,GAAGN,UAAU,CAACM,kBAAkB;AAOxD;AACA;AACA;AACA;AACA;AACA,MAAMC,aAAa,SAASL,mBAAmB,CAAC;EAAAM,YAAA;IAAA,SAAAC,SAAA;IAAAC,eAAA,0BAClB,KAAK;IAAAA,eAAA,sBACa,IAAI;EAAA;EAEhD;AACJ;AACA;AACA;AACA;EAEYC,aAAaA,CAACC,WAAqB,EAAiB;IACxD,IAAI,IAAI,CAACC,WAAW,EAAE;MAClB;MACA,OAAO,IAAI,CAACA,WAAW;IAC3B;IAEA,IAAI,IAAI,CAACC,eAAe,EAAE;MACtB;MACA,OAAOC,OAAO,CAACC,OAAO,CAAC,CAAC;IAC5B;IAEA,IAAI,CAACH,WAAW,GAAG,IAAI,CAACI,MAAM,CACzBC,YAAY,CAACN,WAAW,CAAC,CACzBO,IAAI,CAAC,MAAM;MACR,OAAO,IAAI,CAACF,MAAM,CAACG,yBAAyB,CAACR,WAAW,CAAC;IAC7D,CAAC,CAAC,CACDO,IAAI,CAAC,MAAM;MACR,IAAI,CAACL,eAAe,GAAG,IAAI;IAC/B,CAAC,CAAC,CACDO,OAAO,CAAC,MAAM;MACX,IAAI,CAACR,WAAW,GAAG,IAAI;IAC3B,CAAC,CAAC;IAEN,OAAO,IAAI,CAACA,WAAW;EAC3B;;EAEA;AACJ;AACA;AACA;AACA;EACiBS,cAAcA,CAACC,IAAU,EAAEC,SAAiB,EAAEC,OAAiB,EAAiC;IAAA,IAAAC,KAAA;IAAA,OAAAC,iBAAA;MACzG;MACA;MACA;MACA;;MAEA,IAAMC,OAAO,SAASL,IAAI,CAACM,0BAA0B,CAAC,CAAC;MAEvD,IAAMC,KAAK,GAAGF,OAAO,CAACG,GAAG,CAAC,UAAUC,CAAC,EAAE;QACnC,OAAOA,CAAC,CAACC,MAAM;MACnB,CAAC,CAAC;MAEF,MAAMP,KAAI,CAACf,aAAa,CAACmB,KAAK,CAAC;MAE/B,IAAMI,aAAa,GAAG;QAClBC,OAAO,EAAEZ,IAAI,CAACa,MAAM;QACpBC,IAAI,EAAEb,SAAS;QACfC,OAAO,EAAEA;MACb,CAAC;MAED,IAAMa,gBAAmC,GAAG;QACxCC,SAAS,EAAExC,MAAM,CAACyC,aAAa;QAC/BC,UAAU,EAAEf,KAAI,CAACgB,SAAS,CAACC,mBAAoB;QAC/CC,UAAU,EAAE,CAAC;MACjB,CAAC;MAED,IAAMC,QAAyB,GAAG,EAAE;MAEpC,KAAK,IAAMZ,MAAM,IAAIH,KAAK,EAAE;QACxB,IAAMgB,OAAO,GAAGpB,KAAI,CAACT,MAAM,CAAC8B,uBAAuB,CAACd,MAAM,CAAC,IAAI,EAAE;QAEjE,KAAK,IAAMe,UAAU,IAAIF,OAAO,EAAE;UAC9B,IAAMG,GAAG,GAAGD,UAAU,CAACE,cAAc,CAAC,CAAC;UACvC,IAAID,GAAG,IAAIvB,KAAI,CAACgB,SAAS,CAACC,mBAAmB,EAAE;YAC3C;YACA;UACJ;UACA,IAAIK,UAAU,CAACG,QAAQ,IAAI7C,kBAAkB,CAAC8C,OAAO,EAAE;YACnD;YACA;UACJ;UAEAP,QAAQ,CAACQ,IAAI,CACTtD,MAAM,CAACuD,uBAAuB,CAC1BhB,gBAAgB,CAACM,UAAU,EAC3BlB,KAAI,CAACO,MAAM,EACXP,KAAI,CAAC6B,QAAQ,EACb7B,KAAI,CAACgB,SAAS,EACdT,MAAM,EACNe,UAAU,EACVd,aACJ,CACJ,CAAC;QACL;MACJ;MAEA,OAAOnB,OAAO,CAACyC,GAAG,CAACX,QAAQ,CAAC,CAAC1B,IAAI,CAAC,MAAMmB,gBAAgB,CAAC;IAAC;EAC9D;AACJ;;AAEA;AACA;AACA;AACA;AACA;AACA,MAAMmB,aAAa,SAASxD,mBAAmB,CAAC;EAC5C;AACJ;AACA;AACA;AACA;AACA;EACiByD,YAAYA,CAACC,KAAkB,EAAmC;IAAA,IAAAC,MAAA;IAAA,OAAAjC,iBAAA;MAC3E,IAAMF,OAAO,GAAGkC,KAAK,CAACE,cAAc,CAAC,CAAC;MACtC,IAAMC,SAAS,GAAGrC,OAAO,CAACgB,UAAU;MACpC,IAAMG,UAAU,GAAGnB,OAAO,CAACmB,UAAU;MAErC,IAAI,CAACA,UAAU,EAAE;QACb,MAAM,IAAIvC,eAAe,CAACD,qBAAqB,CAAC2D,sBAAsB,EAAE,oBAAoB,CAAC;MACjG;MAEA,IAAI,EAAEH,MAAI,CAAClB,SAAS,CAACC,mBAAmB,IAAKC,UAAU,CAAC,EAAE;QACtD,MAAM,IAAIvC,eAAe,CACrBD,qBAAqB,CAAC4D,8BAA8B,EACpD,4BACJ,CAAC;MACL;MACA,IAAMC,OAAO,GAAGrB,UAAU,CAACgB,MAAI,CAAClB,SAAS,CAACC,mBAAmB,CAAE;MAC/D,IAAIuB,aAAqB;MAEzB,IAAI;QACAA,aAAa,SAASN,MAAI,CAACO,cAAc,CAACL,SAAS,EAAEG,OAAO,CAAC;MACjE,CAAC,CAAC,OAAOG,CAAC,EAAE;QACR,MAAM,IAAI/D,eAAe,CAACD,qBAAqB,CAACiE,yBAAyB,EAAE,uBAAuB,EAAE;UAChGC,MAAM,EAAER,SAAS;UACjBS,GAAG,EAAEH;QACT,CAAC,CAAC;MACN;MAEA,IAAMI,OAAO,GAAGC,IAAI,CAACC,KAAK,CAACR,aAAa,CAAC;;MAEzC;MACA;MACA,IAAIM,OAAO,CAACG,SAAS,IAAIf,MAAI,CAAC3B,MAAM,EAAE;QAClC,MAAM,IAAI5B,eAAe,CACrBD,qBAAqB,CAACwE,iBAAiB,EACvC,2BAA2B,GAAGJ,OAAO,CAACG,SAC1C,CAAC;MACL;MAEA,IAAIH,OAAO,CAACK,cAAc,CAACC,OAAO,IAAIlB,MAAI,CAAClB,SAAS,CAACqC,gBAAgB,EAAE;QACnE,MAAM,IAAI1E,eAAe,CACrBD,qBAAqB,CAAC4E,qBAAqB,EAC3C,sCAAsC,EACtC;UACIC,QAAQ,EAAET,OAAO,CAACK,cAAc,CAACC,OAAO;UACxCI,OAAO,EAAEtB,MAAI,CAAClB,SAAS,CAACqC;QAC5B,CACJ,CAAC;MACL;;MAEA;MACA;MACA;MACA;MACA;MACA;MACA;MACA;MACA;MACA;MACA;MACA;MACA;MACA;MACA;MACA;MACA;;MAEA,IAAII,aAAa,GAAGvB,MAAI,CAAC3C,MAAM,CAACmE,UAAU,CAACC,oBAAoB,CAACtF,MAAM,CAACyC,aAAa,EAAEsB,SAAS,CAAC;MAChG,IAAIqB,aAAa,KAAKG,SAAS,IAAIH,aAAa,KAAK,IAAI,EAAE;QACvD;QACA,IAAI;UACA,MAAMvB,MAAI,CAAC3C,MAAM,CAACmE,UAAU,CAAClE,YAAY,CAAC,CAACyC,KAAK,CAAC4B,SAAS,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC;QAC1E,CAAC,CAAC,OAAOnB,CAAC,EAAE;UACR,MAAM,IAAI/D,eAAe,CACrBD,qBAAqB,CAACoF,2BAA2B,EACjD,kCAAkC,EAClC;YACIlB,MAAM,EAAER,SAAS;YACjBS,GAAG,EAAEH;UACT,CACJ,CAAC;QACL;QAEAe,aAAa,GAAGvB,MAAI,CAAC3C,MAAM,CAACmE,UAAU,CAACC,oBAAoB,CAACtF,MAAM,CAACyC,aAAa,EAAEsB,SAAS,CAAC;MAChG;MACA,IAAIqB,aAAa,KAAKxB,KAAK,CAAC4B,SAAS,CAAC,CAAC,IAAIJ,aAAa,KAAKG,SAAS,IAAIH,aAAa,KAAK,IAAI,EAAE;QAC9F,MAAM,IAAI9E,eAAe,CACrBD,qBAAqB,CAACqF,cAAc,EACpC,6BAA6B,GAAG9B,KAAK,CAAC4B,SAAS,CAAC,CAAC,EACjD;UACIG,WAAW,EAAEP;QACjB,CACJ,CAAC;MACL;;MAEA;MACA;MACA;MACA;MACA,IAAIX,OAAO,CAACF,MAAM,IAAIX,KAAK,CAAC4B,SAAS,CAAC,CAAC,EAAE;QACrC,MAAM,IAAIlF,eAAe,CACrBD,qBAAqB,CAACuF,qBAAqB,EAC3C,yBAAyB,GAAGnB,OAAO,CAACF,MAAM,EAC1C;UACIsB,eAAe,EAAEjC,KAAK,CAAC4B,SAAS,CAAC;QACrC,CACJ,CAAC;MACL;;MAEA;MACA,IAAIf,OAAO,CAACrC,OAAO,KAAKwB,KAAK,CAACkC,SAAS,CAAC,CAAC,EAAE;QACvC,MAAM,IAAIxF,eAAe,CACrBD,qBAAqB,CAAC0F,YAAY,EAClC,4BAA4B,GAAGtB,OAAO,CAACrC,OAAO,EAC9C;UACI4D,aAAa,EAAEpC,KAAK,CAACkC,SAAS,CAAC,CAAC,IAAI;QACxC,CACJ,CAAC;MACL;MAEA,IAAMG,WAAW,GAAGxB,OAAO,CAACyB,IAAI,IAAI,CAAC,CAAC;MAEtC,OAAO;QACHC,UAAU,EAAE1B,OAAO;QACnB2B,mBAAmB,EAAErC,SAAS;QAC9BsC,iBAAiB,EAAEJ,WAAW,CAAClB,OAAO,IAAI;MAC9C,CAAC;IAAC;EACN;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;EACYX,cAAcA,CAACkC,sBAA8B,EAAEpC,OAAiB,EAAmB;IACvF;IACA;IACA;IACA,IAAIA,OAAO,CAAC5B,IAAI,KAAK,CAAC,EAAE;MACpB;MACA,OAAO,IAAI,CAACiE,oBAAoB,CAACD,sBAAsB,EAAEpC,OAAO,CAAC;IACrE,CAAC,MAAM;MACH,IAAMsC,SAAS,GAAG,IAAI,CAAC7D,SAAS,CAAC8D,gBAAgB,CAACrF,IAAI,CAAC,MAAM;QACzD,OAAO,IAAI,CAACmF,oBAAoB,CAACD,sBAAsB,EAAEpC,OAAO,CAAC;MACrE,CAAC,CAAC;MACF;MACA,IAAI,CAACvB,SAAS,CAAC8D,gBAAgB,GAAGD,SAAS,CAACE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;MAC3D,OAAOF,SAAS;IACpB;EACJ;EAEcD,oBAAoBA,CAACD,sBAA8B,EAAEpC,OAAiB,EAAmB;IAAA,IAAAyC,MAAA;IAAA,OAAA/E,iBAAA;MACnG,IAAMgF,UAAU,SAASD,MAAI,CAAChE,SAAS,CAACkE,sBAAsB,CAACP,sBAAsB,CAAC;;MAEtF;MACA,IAAMQ,gBAAwC,GAAG,CAAC,CAAC;MACnD,KAAK,IAAMC,SAAS,IAAIH,UAAU,EAAE;QAChC,IAAI;UACA,IAAMnC,OAAO,SAASkC,MAAI,CAAChE,SAAS,CAACyB,cAAc,CAC/CkC,sBAAsB,EACtBS,SAAS,EACT7C,OAAO,CAAC5B,IAAI,EACZ4B,OAAO,CAAC8C,IACZ,CAAC;UACDjH,MAAM,CAACkH,GAAG,CAAC,6BAA6B,GAAGX,sBAAsB,GAAG,gBAAgB,GAAGS,SAAS,CAAC;UACjG,OAAOtC,OAAO;QAClB,CAAC,CAAC,OAAOJ,CAAC,EAAE;UACR,IAAM6C,YAAY,SAASP,MAAI,CAAChE,SAAS,CAACwE,cAAc,CACpDb,sBAAsB,EACtBS,SAAS,EACT7C,OAAO,CAAC5B,IAAI,EACZ4B,OAAO,CAAC8C,IACZ,CAAC;UAED,IAAIE,YAAY,EAAE;YACd;YACA;YACA,MAAM,IAAIE,KAAK,CACX,2DAA2D,GACvDL,SAAS,GACT,IAAI,GACI1C,CAAC,CAAEH,OACnB,CAAC;UACL;;UAEA;UACA;UACA4C,gBAAgB,CAACC,SAAS,CAAC,GAAW1C,CAAC,CAAEH,OAAO;QACpD;MACJ;MAEA,IAAIA,OAAO,CAAC5B,IAAI,KAAK,CAAC,EAAE;QACpB;QACA;;QAEA,IAAIsE,UAAU,CAACS,MAAM,KAAK,CAAC,EAAE;UACzB,MAAM,IAAID,KAAK,CAAC,sBAAsB,CAAC;QAC3C;QAEA,MAAM,IAAIA,KAAK,CACX,8DAA8D,GAAG1C,IAAI,CAAC4C,SAAS,CAACR,gBAAgB,CACpG,CAAC;MACL;;MAEA;MACA;;MAEA,IAAIS,GAAoB;MACxB,IAAI;QACAA,GAAG,SAASZ,MAAI,CAAChE,SAAS,CAAC6E,oBAAoB,CAAClB,sBAAsB,EAAEpC,OAAO,CAAC5B,IAAI,EAAE4B,OAAO,CAAC8C,IAAI,CAAC;MACvG,CAAC,CAAC,OAAO3C,CAAC,EAAE;QACRyC,gBAAgB,CAAC,OAAO,CAAC,GAAWzC,CAAC,CAAEH,OAAO;QAC9C,MAAM,IAAIkD,KAAK,CAAC,mCAAmC,GAAG1C,IAAI,CAAC4C,SAAS,CAACR,gBAAgB,CAAC,CAAC;MAC3F;MAEA/G,MAAM,CAACkH,GAAG,CAAC,qCAAqC,GAAGM,GAAG,CAACE,UAAU,GAAG,QAAQ,GAAGnB,sBAAsB,CAAC;MACtG,OAAOiB,GAAG,CAAC9C,OAAO;IAAC;EACvB;AACJ;AAEArE,iBAAiB,CAACJ,MAAM,CAACyC,aAAa,EAAEjC,aAAa,EAAEkD,aAAa,CAAC","ignoreList":[]}

package/lib/crypto/api.d.ts

@@ -1,32 +0,0 @@
-import { DeviceInfo } from "./deviceinfo.ts";
-export { CrossSigningKey } from "../crypto-api/index.ts";
-export type { GeneratedSecretStorageKey as IRecoveryKey, CreateSecretStorageOpts as ICreateSecretStorageOpts, } from "../crypto-api/index.ts";
-export type { ImportRoomKeyProgressData as IImportOpts, ImportRoomKeysOpts as IImportRoomKeysOpts, } from "../crypto-api/index.ts";
-export type { AddSecretStorageKeyOpts as IAddSecretStorageKeyOpts, PassphraseInfo as IPassphraseInfo, SecretStorageKeyDescription as ISecretStorageKeyInfo, } from "../secret-storage.ts";
-export interface IEncryptedEventInfo {
-    /**
-     * whether the event is encrypted (if not encrypted, some of the other properties may not be set)
-     */
-    encrypted: boolean;
-    /**
-     * the sender's key
-     */
-    senderKey: string;
-    /**
-     * the algorithm used to encrypt the event
-     */
-    algorithm: string;
-    /**
-     * whether we can be sure that the owner of the senderKey sent the event
-     */
-    authenticated: boolean;
-    /**
-     * the sender's device information, if available
-     */
-    sender?: DeviceInfo;
-    /**
-     * if the event's ed25519 and curve25519 keys don't match (only meaningful if `sender` is set)
-     */
-    mismatchedSender: boolean;
-}
-//# sourceMappingURL=api.d.ts.map

package/lib/crypto/api.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/crypto/api.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAI7C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EACR,yBAAyB,IAAI,YAAY,EACzC,uBAAuB,IAAI,wBAAwB,GACtD,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACR,yBAAyB,IAAI,WAAW,EACxC,kBAAkB,IAAI,mBAAmB,GAC5C,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACR,uBAAuB,IAAI,wBAAwB,EACnD,cAAc,IAAI,eAAe,EACjC,2BAA2B,IAAI,qBAAqB,GACvD,MAAM,sBAAsB,CAAC;AAI9B,MAAM,WAAW,mBAAmB;IAChC;;OAEG;IACH,SAAS,EAAE,OAAO,CAAC;IAEnB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;OAEG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IAEpB;;OAEG;IACH,gBAAgB,EAAE,OAAO,CAAC;CAC7B"}

package/lib/crypto/api.js

@@ -1,22 +0,0 @@
-/*
-Copyright 2021 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-/* re-exports for backwards compatibility. */
-// CrossSigningKey is used as a value in `client.ts`, we can't export it as a type
-export { CrossSigningKey } from "../crypto-api/index.js";
-
-// TODO: Merge this with crypto.js once converted
-//# sourceMappingURL=api.js.map

package/lib/crypto/api.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api.js","names":["CrossSigningKey"],"sources":["../../src/crypto/api.ts"],"sourcesContent":["/*\nCopyright 2021 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport { DeviceInfo } from \"./deviceinfo.ts\";\n\n/* re-exports for backwards compatibility. */\n// CrossSigningKey is used as a value in `client.ts`, we can't export it as a type\nexport { CrossSigningKey } from \"../crypto-api/index.ts\";\nexport type {\n    GeneratedSecretStorageKey as IRecoveryKey,\n    CreateSecretStorageOpts as ICreateSecretStorageOpts,\n} from \"../crypto-api/index.ts\";\n\nexport type {\n    ImportRoomKeyProgressData as IImportOpts,\n    ImportRoomKeysOpts as IImportRoomKeysOpts,\n} from \"../crypto-api/index.ts\";\n\nexport type {\n    AddSecretStorageKeyOpts as IAddSecretStorageKeyOpts,\n    PassphraseInfo as IPassphraseInfo,\n    SecretStorageKeyDescription as ISecretStorageKeyInfo,\n} from \"../secret-storage.ts\";\n\n// TODO: Merge this with crypto.js once converted\n\nexport interface IEncryptedEventInfo {\n    /**\n     * whether the event is encrypted (if not encrypted, some of the other properties may not be set)\n     */\n    encrypted: boolean;\n\n    /**\n     * the sender's key\n     */\n    senderKey: string;\n\n    /**\n     * the algorithm used to encrypt the event\n     */\n    algorithm: string;\n\n    /**\n     * whether we can be sure that the owner of the senderKey sent the event\n     */\n    authenticated: boolean;\n\n    /**\n     * the sender's device information, if available\n     */\n    sender?: DeviceInfo;\n\n    /**\n     * if the event's ed25519 and curve25519 keys don't match (only meaningful if `sender` is set)\n     */\n    mismatchedSender: boolean;\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA,SAASA,eAAe,QAAQ,wBAAwB;;AAiBxD","ignoreList":[]}

package/lib/crypto/backup.d.ts

@@ -1,227 +0,0 @@
-/**
- * Classes for dealing with key backup.
- */
-import type { IMegolmSessionData } from "../@types/crypto.ts";
-import { MatrixClient } from "../client.ts";
-import { DeviceInfo } from "./deviceinfo.ts";
-import { DeviceTrustLevel } from "./CrossSigning.ts";
-import { Curve25519SessionData, IAes256AuthData, ICurve25519AuthData, IKeyBackupInfo, IKeyBackupSession } from "./keybackup.ts";
-import { BackupTrustInfo } from "../crypto-api/keybackup.ts";
-import { BackupDecryptor } from "../common-crypto/CryptoBackend.ts";
-import { AESEncryptedSecretStoragePayload } from "../@types/AESEncryptedSecretStoragePayload.ts";
-type AuthData = IKeyBackupInfo["auth_data"];
-type SigInfo = {
-    deviceId: string;
-    valid?: boolean | null;
-    device?: DeviceInfo | null;
-    crossSigningId?: boolean;
-    deviceTrust?: DeviceTrustLevel;
-};
-/** @deprecated Prefer {@link BackupTrustInfo} */
-export type TrustInfo = {
-    usable: boolean;
-    sigs: SigInfo[];
-    trusted_locally?: boolean;
-};
-export interface IKeyBackupCheck {
-    backupInfo?: IKeyBackupInfo;
-    trustInfo: TrustInfo;
-}
-export interface IPreparedKeyBackupVersion {
-    algorithm: string;
-    auth_data: AuthData;
-    recovery_key: string;
-    privateKey: Uint8Array;
-}
-/** A function used to get the secret key for a backup.
- */
-type GetKey = () => Promise<ArrayLike<number>>;
-interface BackupAlgorithmClass {
-    algorithmName: string;
-    init(authData: AuthData, getKey: GetKey): Promise<BackupAlgorithm>;
-    prepare(key?: string | Uint8Array | null): Promise<[Uint8Array, AuthData]>;
-    checkBackupVersion(info: IKeyBackupInfo): void;
-}
-interface BackupAlgorithm {
-    untrusted: boolean;
-    encryptSession(data: Record<string, any>): Promise<Curve25519SessionData | AESEncryptedSecretStoragePayload>;
-    decryptSessions(ciphertexts: Record<string, IKeyBackupSession>): Promise<IMegolmSessionData[]>;
-    authData: AuthData;
-    keyMatches(key: ArrayLike<number>): Promise<boolean>;
-    free(): void;
-}
-export interface IKeyBackup {
-    rooms: {
-        [roomId: string]: {
-            sessions: {
-                [sessionId: string]: IKeyBackupSession;
-            };
-        };
-    };
-}
-/**
- * Manages the key backup.
- */
-export declare class BackupManager {
-    private readonly baseApis;
-    readonly getKey: GetKey;
-    private algorithm;
-    backupInfo: IKeyBackupInfo | undefined;
-    checkedForBackup: boolean;
-    private sendingBackups;
-    private sessionLastCheckAttemptedTime;
-    private clientRunning;
-    constructor(baseApis: MatrixClient, getKey: GetKey);
-    /**
-     * Stop the backup manager from backing up keys and allow a clean shutdown.
-     */
-    stop(): void;
-    get version(): string | undefined;
-    /**
-     * Performs a quick check to ensure that the backup info looks sane.
-     *
-     * Throws an error if a problem is detected.
-     *
-     * @param info - the key backup info
-     */
-    static checkBackupVersion(info: IKeyBackupInfo): void;
-    static makeAlgorithm(info: IKeyBackupInfo, getKey: GetKey): Promise<BackupAlgorithm>;
-    enableKeyBackup(info: IKeyBackupInfo): Promise<void>;
-    /**
-     * Disable backing up of keys.
-     */
-    disableKeyBackup(): void;
-    getKeyBackupEnabled(): boolean | null;
-    prepareKeyBackupVersion(key?: string | Uint8Array | null, algorithm?: string | undefined): Promise<IPreparedKeyBackupVersion>;
-    createKeyBackupVersion(info: IKeyBackupInfo): Promise<void>;
-    /**
-     * Deletes all key backups.
-     *
-     * Will call the API to delete active backup until there is no more present.
-     */
-    deleteAllKeyBackupVersions(): Promise<void>;
-    /**
-     * Deletes the given key backup.
-     *
-     * @param version - The backup version to delete.
-     */
-    deleteKeyBackupVersion(version: string): Promise<void>;
-    /**
-     * Check the server for an active key backup and
-     * if one is present and has a valid signature from
-     * one of the user's verified devices, start backing up
-     * to it.
-     */
-    checkAndStart(): Promise<IKeyBackupCheck | null>;
-    /**
-     * Forces a re-check of the key backup and enables/disables it
-     * as appropriate.
-     *
-     * @returns Object with backup info (as returned by
-     *     getKeyBackupVersion) in backupInfo and
-     *     trust information (as returned by isKeyBackupTrusted)
-     *     in trustInfo.
-     */
-    checkKeyBackup(): Promise<IKeyBackupCheck | null>;
-    /**
-     * Attempts to retrieve a session from a key backup, if enough time
-     * has elapsed since the last check for this session id.
-     */
-    queryKeyBackupRateLimited(targetRoomId: string | undefined, targetSessionId: string | undefined): Promise<void>;
-    /**
-     * Check if the given backup info is trusted.
-     *
-     * @param backupInfo - key backup info dict from /room_keys/version
-     */
-    isKeyBackupTrusted(backupInfo?: IKeyBackupInfo): Promise<TrustInfo>;
-    /**
-     * Schedules sending all keys waiting to be sent to the backup, if not already
-     * scheduled. Retries if necessary.
-     *
-     * @param maxDelay - Maximum delay to wait in ms. 0 means no delay.
-     */
-    scheduleKeyBackupSend(maxDelay?: number): Promise<void>;
-    /**
-     * Take some e2e keys waiting to be backed up and send them
-     * to the backup.
-     *
-     * @param limit - Maximum number of keys to back up
-     * @returns Number of sessions backed up
-     */
-    backupPendingKeys(limit: number): Promise<number>;
-    backupGroupSession(senderKey: string, sessionId: string): Promise<void>;
-    /**
-     * Marks all group sessions as needing to be backed up and schedules them to
-     * upload in the background as soon as possible.
-     */
-    scheduleAllGroupSessionsForBackup(): Promise<void>;
-    /**
-     * Marks all group sessions as needing to be backed up without scheduling
-     * them to upload in the background.
-     * @returns Promise which resolves to the number of sessions now requiring a backup
-     *     (which will be equal to the number of sessions in the store).
-     */
-    flagAllGroupSessionsForBackup(): Promise<number>;
-    /**
-     * Counts the number of end to end session keys that are waiting to be backed up
-     * @returns Promise which resolves to the number of sessions requiring backup
-     */
-    countSessionsNeedingBackup(): Promise<number>;
-}
-export declare class Curve25519 implements BackupAlgorithm {
-    authData: ICurve25519AuthData;
-    private publicKey;
-    private getKey;
-    static algorithmName: string;
-    constructor(authData: ICurve25519AuthData, publicKey: any, // FIXME: PkEncryption
-    getKey: () => Promise<Uint8Array>);
-    static init(authData: AuthData, getKey: () => Promise<Uint8Array>): Promise<Curve25519>;
-    static prepare(key?: string | Uint8Array | null): Promise<[Uint8Array, AuthData]>;
-    static checkBackupVersion(info: IKeyBackupInfo): void;
-    get untrusted(): boolean;
-    encryptSession(data: Record<string, any>): Promise<Curve25519SessionData>;
-    decryptSessions(sessions: Record<string, IKeyBackupSession<Curve25519SessionData>>): Promise<IMegolmSessionData[]>;
-    keyMatches(key: Uint8Array): Promise<boolean>;
-    free(): void;
-}
-export declare class Aes256 implements BackupAlgorithm {
-    readonly authData: IAes256AuthData;
-    private readonly key;
-    static algorithmName: "org.matrix.msc3270.v1.aes-hmac-sha2";
-    constructor(authData: IAes256AuthData, key: Uint8Array);
-    static init(authData: IAes256AuthData, getKey: () => Promise<Uint8Array>): Promise<Aes256>;
-    static prepare(key?: string | Uint8Array | null): Promise<[Uint8Array, AuthData]>;
-    static checkBackupVersion(info: IKeyBackupInfo): void;
-    get untrusted(): boolean;
-    encryptSession(data: Record<string, any>): Promise<AESEncryptedSecretStoragePayload>;
-    decryptSessions(sessions: Record<string, IKeyBackupSession<AESEncryptedSecretStoragePayload>>): Promise<IMegolmSessionData[]>;
-    keyMatches(key: Uint8Array): Promise<boolean>;
-    free(): void;
-}
-export declare const algorithmsByName: Record<string, BackupAlgorithmClass>;
-/** @alias */
-export declare const DefaultAlgorithm: BackupAlgorithmClass;
-/**
- * Map a legacy {@link TrustInfo} into a new-style {@link BackupTrustInfo}.
- *
- * @param trustInfo - trustInfo to convert
- */
-export declare function backupTrustInfoFromLegacyTrustInfo(trustInfo: TrustInfo): BackupTrustInfo;
-/**
- * Implementation of {@link BackupDecryptor} for the libolm crypto backend.
- */
-export declare class LibOlmBackupDecryptor implements BackupDecryptor {
-    private algorithm;
-    readonly sourceTrusted: boolean;
-    constructor(algorithm: BackupAlgorithm);
-    /**
-     * Implements {@link BackupDecryptor#free}
-     */
-    free(): void;
-    /**
-     * Implements {@link BackupDecryptor#decryptSessions}
-     */
-    decryptSessions(sessions: Record<string, IKeyBackupSession<Curve25519SessionData>>): Promise<IMegolmSessionData[]>;
-}
-export {};
-//# sourceMappingURL=backup.d.ts.map

package/lib/crypto/backup.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/crypto/backup.ts"],"names":[],"mappings":"AAgBA;;GAEG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAIrD,OAAO,EACH,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACpB,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAIpE,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AAMjG,KAAK,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;AAE5C,KAAK,OAAO,GAAG;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,MAAM,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAClC,CAAC;AAEF,iDAAiD;AACjD,MAAM,MAAM,SAAS,GAAG;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,EAAE,CAAC;IAEhB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,MAAM,WAAW,eAAe;IAC5B,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,SAAS,EAAE,SAAS,CAAC;CACxB;AAGD,MAAM,WAAW,yBAAyB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,QAAQ,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,UAAU,CAAC;CAC1B;AAGD;GACG;AACH,KAAK,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAE/C,UAAU,oBAAoB;IAC1B,aAAa,EAAE,MAAM,CAAC;IAEtB,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAGnE,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE3E,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;CAClD;AAED,UAAU,eAAe;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,qBAAqB,GAAG,gCAAgC,CAAC,CAAC;IAC7G,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC/F,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACvB,KAAK,EAAE;QACH,CAAC,MAAM,EAAE,MAAM,GAAG;YACd,QAAQ,EAAE;gBACN,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,CAAC;aAC1C,CAAC;SACL,CAAC;KACL,CAAC;CACL;AAED;;GAEG;AACH,qBAAa,aAAa;IAUlB,OAAO,CAAC,QAAQ,CAAC,QAAQ;aACT,MAAM,EAAE,MAAM;IAVlC,OAAO,CAAC,SAAS,CAA8B;IACxC,UAAU,EAAE,cAAc,GAAG,SAAS,CAAC;IACvC,gBAAgB,EAAE,OAAO,CAAC;IACjC,OAAO,CAAC,cAAc,CAAU;IAChC,OAAO,CAAC,6BAA6B,CAA8B;IAEnE,OAAO,CAAC,aAAa,CAAQ;gBAGR,QAAQ,EAAE,YAAY,EACvB,MAAM,EAAE,MAAM;IAMlC;;OAEG;IACI,IAAI,IAAI,IAAI;IAInB,IAAW,OAAO,IAAI,MAAM,GAAG,SAAS,CAEvC;IAED;;;;;;OAMG;WACW,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI;WAW9C,aAAa,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAQ9E,eAAe,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAejE;;OAEG;IACI,gBAAgB,IAAI,IAAI;IAWxB,mBAAmB,IAAI,OAAO,GAAG,IAAI;IAO/B,uBAAuB,CAChC,GAAG,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,EAChC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,GAC/B,OAAO,CAAC,yBAAyB,CAAC;IAgBxB,sBAAsB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxE;;;;OAIG;IACU,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC;IAUxD;;;;OAIG;IACU,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnE;;;;;OAKG;IACU,aAAa,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAsD7D;;;;;;;;OAQG;IACU,cAAc,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAK9D;;;OAGG;IACU,yBAAyB,CAClC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,eAAe,EAAE,MAAM,GAAG,SAAS,GACpC,OAAO,CAAC,IAAI,CAAC;IAehB;;;;OAIG;IACU,kBAAkB,CAAC,UAAU,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC;IA4GhF;;;;;OAKG;IACU,qBAAqB,CAAC,QAAQ,SAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAmEnE;;;;;;OAMG;IACU,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA8CjD,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBpF;;;OAGG;IACU,iCAAiC,IAAI,OAAO,CAAC,IAAI,CAAC;IAO/D;;;;;OAKG;IACU,6BAA6B,IAAI,OAAO,CAAC,MAAM,CAAC;IAkB7D;;;OAGG;IACI,0BAA0B,IAAI,OAAO,CAAC,MAAM,CAAC;CAGvD;AAED,qBAAa,UAAW,YAAW,eAAe;IAInC,QAAQ,EAAE,mBAAmB;IACpC,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,MAAM;IALlB,OAAc,aAAa,SAA4C;gBAG5D,QAAQ,EAAE,mBAAmB,EAC5B,SAAS,EAAE,GAAG,EAAE,sBAAsB;IACtC,MAAM,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC;WAGzB,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;WAShF,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;WAuBhF,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI;IAM5D,IAAW,SAAS,IAAI,OAAO,CAE9B;IAEY,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAQzE,eAAe,CACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,GACnE,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAiCnB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAYnD,IAAI,IAAI,IAAI;CAGtB;AAaD,qBAAa,MAAO,YAAW,eAAe;aAItB,QAAQ,EAAE,eAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG;IAJxB,OAAc,aAAa,wCAA8B;gBAGrC,QAAQ,EAAE,eAAe,EACxB,GAAG,EAAE,UAAU;WAGhB,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;WAcnF,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;WAqBhF,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI;IAM5D,IAAW,SAAS,IAAI,OAAO,CAE9B;IAEM,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAQ9E,eAAe,CACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,gCAAgC,CAAC,CAAC,GAC9E,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAiBnB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAUnD,IAAI,IAAI,IAAI;CAGtB;AAED,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAGjE,CAAC;AAIF,aAAa;AACb,eAAO,MAAM,gBAAgB,EAAE,oBAAiC,CAAC;AAEjE;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,SAAS,GAAG,eAAe,CAKxF;AAED;;GAEG;AACH,qBAAa,qBAAsB,YAAW,eAAe;IACzD,OAAO,CAAC,SAAS,CAAkB;IACnC,SAAgB,aAAa,EAAE,OAAO,CAAC;gBAEpB,SAAS,EAAE,eAAe;IAK7C;;OAEG;IACI,IAAI,IAAI,IAAI;IAInB;;OAEG;IACU,eAAe,CACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,GACnE,OAAO,CAAC,kBAAkB,EAAE,CAAC;CAGnC"}