@weaveprotocol/core 0.1.0

package/dist/node/types.d.ts

@@ -0,0 +1,508 @@
+/**
+ * @module node/types
+ * The shape of a node: everything an app, a CLI, a daemon or an agent needs to
+ * work with spaces, as plain data in and plain data out.
+ *
+ * Everything a method returns is JSON-serialisable on purpose. The same calls
+ * are exposed as actions to a command line, an MCP server and WebMCP, and a
+ * value that cannot cross a wire would have to be reshaped at each of them.
+ */
+import type { BodyOf, Query, ResultOf } from '../query/types.js';
+import type { CollectionRules } from '../records/rules.js';
+import type { CollectionDef, CryptoProvider, Link, SpaceRole, SpaceVisibility, StandardJSONSchemaV1 } from '../types.js';
+import type { LinkDeclaration } from '../records/links.js';
+import type { RootSigner } from '../identity/root-signer.js';
+import type { Capability, UCANToken } from '../identity/ucan.js';
+import type { PeerTransport } from '../network/transport.js';
+import type { ServerAuth } from '../network/peer-auth.js';
+import type { StoreFactory } from './stores.js';
+import type { JsonSchema, SchemaIssue } from '../schema/collection-def.js';
+export interface NodeNetworkConfig {
+    /** Relays for WebRTC, browsers only. Each space meets in the room named after its id. */
+    readonly relays?: ReadonlyArray<string>;
+    /** Always-on nodes to hold a socket to, `ws(s)://host/peer`. The space id is appended. */
+    readonly nodes?: ReadonlyArray<string>;
+    readonly iceServers?: ReadonlyArray<RTCIceServer>;
+    /**
+     * Extra transports per space — how a node serving sockets, or a test, plugs
+     * in. Given the space and this node's session DID, which is its identity on
+     * the wire.
+     */
+    readonly transports?: (spaceId: string, sessionDid: string) => ReadonlyArray<PeerTransport>;
+}
+export interface NodeConfig {
+    /** Who this node acts for. The root key only ever signs session delegations. */
+    readonly signer: RootSigner;
+    /**
+     * The account's vault key bytes (`deriveVaultKeyBytes(seed)`). With it, the node keeps the account's space list in the
+     * account registry space: spaces joined on any device or node of the account
+     * are joined here too, and leaving one leaves it everywhere. Without it,
+     * spaces are this node's alone.
+     */
+    readonly accountKey?: Uint8Array;
+    /** Where the registry and each space's store live */
+    readonly stores: StoreFactory;
+    readonly provider?: CryptoProvider;
+    /**
+     * Collections this node knows the shape of, for when a space does not
+     * describe them itself. Records are checked against them when written here
+     * and flagged (`conforms`) when read. Nothing is refused on arrival for its
+     * shape: sync accepts whatever is signed and authorized, so nodes with
+     * different schemas still converge.
+     */
+    readonly collections?: ReadonlyArray<CollectionDef>;
+    /** Omit to stay offline */
+    readonly network?: NodeNetworkConfig;
+    /** How long each session delegation lasts. Renewed before it runs out. Default 3600. */
+    readonly sessionTtlSeconds?: number;
+    /**
+     * The key this node signs with, when it must be one the signer already
+     * knows — an app given a delegation by an account home, which named the
+     * app's key. By default the node makes a fresh one each time it starts.
+     */
+    readonly sessionKey?: CryptoKeyPair;
+    /** How often to look for writes another process made to a folder store. 0 disables. Default 2000. */
+    readonly watchIntervalMs?: number;
+}
+/** A space, as the node describes it. Never carries the key. */
+export interface SpaceSummary {
+    readonly id: string;
+    readonly name: string;
+    readonly visibility: SpaceVisibility;
+    /** The account that made it */
+    readonly creator: string;
+    readonly createdAt: string;
+    /** Whether this node can read the space: always for public ones, only with the key for private */
+    readonly readable: boolean;
+    /**
+     * Whether this node's account holds a role here, and so may write — as far
+     * as this node last heard. A view-only invite, or being removed, means it
+     * follows the space and reads.
+     */
+    readonly writable: boolean;
+    /** The role this account holds here, by name — null when it holds none */
+    readonly role: string | null;
+    /** Whether an invite is waiting to be used — its record has not reached this device yet */
+    readonly joining: boolean;
+}
+export interface NewSpace {
+    readonly name: string;
+    /** `private` encrypts every body with the space key */
+    readonly visibility: SpaceVisibility;
+    /**
+     * The roles it starts with. Default: the creator alone, holding everything.
+     * `rolePresets` has some to start from — or write your own.
+     */
+    readonly roles?: ReadonlyArray<SpaceRole>;
+    /** Which of them the creator holds. Default: the highest-ranked. */
+    readonly creatorRole?: string;
+}
+export interface InvitePreview {
+    readonly space: Pick<SpaceSummary, 'id' | 'name' | 'visibility' | 'creator' | 'createdAt'>;
+    readonly invitedBy: string;
+    /** Whether the invite carries the key to a private space */
+    readonly carriesKey: boolean;
+    /** Whether the invite lets you join with a role — false for a view-only one */
+    readonly carriesWrite: boolean;
+    /** The role it is for, as the link says. The space's own invite record is what counts. */
+    readonly role: string | null;
+}
+export interface InviteOptions {
+    /**
+     * The role whoever uses it will hold. Default: the lowest role below your
+     * own — or, when there is none, a view-only invite.
+     */
+    readonly role?: string;
+    /** False for a view-only invite: the key to read a private space, and no role */
+    readonly write?: boolean;
+}
+/** Who holds what in a space, now */
+export interface SpaceAccess {
+    /** Highest rank first */
+    readonly roles: ReadonlyArray<SpaceRole>;
+    readonly members: ReadonlyArray<{
+        readonly did: string;
+        readonly role: string;
+    }>;
+    /** Open and closed invites, by their public key */
+    readonly invites: ReadonlyArray<{
+        readonly key: string;
+        readonly role: string;
+        readonly open: boolean;
+    }>;
+    /** This account's own role — null when it holds none */
+    readonly role: SpaceRole | null;
+    /** The latest access changes held — what a record written now names as `seen` */
+    readonly heads: ReadonlyArray<string>;
+}
+/** A record, opened and checked — its current version, unless listed as history */
+export interface NodeRecord<T = unknown> {
+    /** The record's identity. Stays the same across edits; links point here. */
+    readonly key: string;
+    /** This version's id — a content hash, different for every edit */
+    readonly version: string;
+    /** 0 for the first version, one more for each edit */
+    readonly seq: number;
+    readonly space: string;
+    readonly collection: string;
+    /** The key that signed this version — usually a session key */
+    readonly author: string;
+    /** The identity that key was acting for, when its delegation checks out */
+    readonly root: string | null;
+    /** The identity that created the record, when its first version is held */
+    readonly createdBy: string | null;
+    /** When the record was created, as its creator's clock said — for display; it decides nothing */
+    readonly createdAt: string;
+    /** When this version was written, likewise for display only */
+    readonly updatedAt: string;
+    /** The content, or null when it is encrypted and this node has no key */
+    readonly body: T | null;
+    /** What this record points at — empty when it points at nothing, or cannot be opened */
+    readonly links: ReadonlyArray<Link>;
+    readonly encrypted: boolean;
+    /** Signature, delegation and shape all check out */
+    readonly verified: boolean;
+    /**
+     * Present, and true, when an agent wrote this version for `root`: the note
+     * it was signed under says so (`AGENT_FACT`). The account's word, signed —
+     * not something the agent can leave out.
+     */
+    readonly viaAgent?: true;
+    readonly reason?: string;
+    /** Present, and true, when this version deletes the record (listed only with `includeDeleted`) */
+    readonly deleted?: true;
+    /**
+     * Whether the body fits its collection's schema — the one the space
+     * describes, else one this node was given. Null when there is none, or the
+     * body could not be opened. A record that does not fit is still kept and
+     * synced: whether it fits can depend on which definition a peer has seen yet,
+     * and rejecting it would leave peers that disagree forever.
+     */
+    readonly conforms: boolean | null;
+    readonly issues?: ReadonlyArray<SchemaIssue>;
+}
+/** A collection as a space describes it, and how many records it holds */
+export interface NodeCollection {
+    readonly name: string;
+    readonly title?: string;
+    readonly description?: string;
+    /** Null when records exist but the space has no definition for them */
+    readonly schema: JsonSchema | null;
+    readonly version: number | null;
+    /** Whether edits keep old versions: `all` for an audit trail, `latest` (the default) for current state only */
+    readonly history: 'latest' | 'all';
+    /** The link roles its records carry, and what each may point at — how the space's things connect */
+    readonly links: Readonly<Record<string, LinkDeclaration>>;
+    /** The identity that first defined it — it, and anyone who can manage the space, may change it */
+    readonly definedBy: string | null;
+    /** The permissions its rules name — a role holds each as `<collection>/<permission>` */
+    readonly permissions: ReadonlyArray<string>;
+    /** Who may create, edit and delete, what must be unique — for records created from now on */
+    readonly rules: CollectionRules;
+    /** A screen for its records, when its definer gave one: one HTML document, run sealed */
+    readonly screen?: string;
+    readonly records: number;
+}
+export interface DefineCollection {
+    readonly name: string;
+    readonly title?: string;
+    readonly description?: string;
+    /**
+     * A record body's shape: JSON Schema in the supported subset, or a
+     * validator that can describe itself as JSON Schema — a Zod object, say
+     * (Standard JSON Schema). Either way, JSON Schema is what gets stored.
+     */
+    readonly schema: JsonSchema | StandardJSONSchemaV1;
+    /** Default: one past the current version, or 1 */
+    readonly version?: number;
+    /** Keep every version of every record in it (`all`), or only the current one (`latest`, the default) */
+    readonly history?: 'latest' | 'all';
+    /** The link roles its records may carry, and what each may point at */
+    readonly links?: Readonly<Record<string, LinkDeclaration>>;
+    /** The permissions its rules may name, like `moderate` */
+    readonly permissions?: ReadonlyArray<string>;
+    /** Who may create, edit and delete, what must be unique, which fields are fixed */
+    readonly rules?: CollectionRules;
+    /** A screen for its records — one HTML document an app may run in a sealed frame (`StoredCollection.screen`) */
+    readonly screen?: string;
+}
+export interface NodeCollections {
+    /** What a space holds: every defined collection, and every collection with records */
+    list(spaceId: string): Promise<ReadonlyArray<NodeCollection>>;
+    /** Publishes a definition into the space, as a signed record that syncs like any other */
+    define(spaceId: string, definition: DefineCollection): Promise<NodeCollection>;
+    /**
+     * Takes a definition out of the space. Refused while the collection still
+     * has records; the same people who may change a definition may remove it.
+     */
+    delete(spaceId: string, name: string): Promise<void>;
+}
+export interface ListOptions {
+    /** Only this collection. Default: every collection except the protocol's own `sys.*` */
+    readonly collection?: string;
+    /** Newest first when set; oldest first by default */
+    readonly newestFirst?: boolean;
+    readonly limit?: number;
+    /** Also return deleted records, marked `deleted` */
+    readonly includeDeleted?: boolean;
+}
+export type ConnectionState = 'offline' | 'connecting' | 'connected' | 'error';
+export interface SpaceStatus {
+    readonly space: string;
+    readonly connection: ConnectionState;
+    /** Peers currently connected in this space */
+    readonly peers: ReadonlyArray<string>;
+    /** Of `peers`, this account's own other devices and apps — the ones following the account registry too */
+    readonly own: ReadonlyArray<string>;
+    /** Of `peers`, carriers the account uses: nodes that keep its spaces online without reading them */
+    readonly carriers: ReadonlyArray<string>;
+    /** Root of this space's Merkle tree — equal on two nodes means identical data */
+    readonly root: string | null;
+    /** Records peers sent that failed validation */
+    readonly rejected: number;
+}
+export type NodeEvent = 
+/** Records were added, changed or deleted, locally or by sync */
+{
+    readonly type: 'records';
+    readonly space: string;
+}
+/** Connection or peers changed */
+ | {
+    readonly type: 'status';
+    readonly space: string;
+}
+/** The registry changed: a space was created, joined or left */
+ | {
+    readonly type: 'spaces';
+}
+/** The account's profile may have changed, here or on another device */
+ | {
+    readonly type: 'account';
+} | {
+    readonly type: 'rejected';
+    readonly space: string;
+    readonly peer: string;
+    readonly reason: string;
+}
+/** The note this node writes under was revoked in a space — an app disconnected from its account home, say */
+ | {
+    readonly type: 'revoked';
+    readonly space: string;
+};
+/** Who someone is in a space: the name they gave there, by their identity */
+export interface SpaceProfile {
+    /** Their identity — what `root` and `createdBy` on a record name */
+    readonly did: string;
+    readonly name: string;
+    readonly updatedAt: string;
+}
+export interface NodeSpaces {
+    list(): Promise<ReadonlyArray<SpaceSummary>>;
+    get(spaceId: string): Promise<SpaceSummary | null>;
+    create(params: NewSpace): Promise<SpaceSummary>;
+    /**
+     * An invite string. For a private space it carries the key, and unless it is
+     * view-only, the secret of an invite opened for a role — so treat it as a
+     * secret. It is shown once: nothing keeps it. Closing the invite (`closeInvite`)
+     * stops it working.
+     */
+    invite(spaceId: string, options?: InviteOptions): Promise<string>;
+    preview(invite: string): InvitePreview;
+    join(invite: string): Promise<SpaceSummary>;
+    /**
+     * Forgets a space on this node, with its key. Other members keep theirs.
+     * Your role stays too — to give it up, `setMember` yourself to null first.
+     */
+    leave(spaceId: string): Promise<void>;
+    /** Roles, members and invites, as the space's access history says now */
+    access(spaceId: string): Promise<SpaceAccess>;
+    /** Gives someone a role, changes it, or with null takes it away. You may change people ranked below you, and yourself to null. */
+    setMember(spaceId: string, did: string, role: string | null): Promise<void>;
+    /** Adds or changes a role ranked below yours */
+    putRole(spaceId: string, role: SpaceRole): Promise<void>;
+    /** Removes a role ranked below yours; whoever held it holds nothing */
+    removeRole(spaceId: string, name: string): Promise<void>;
+    /** Closes an invite — by the link itself, or by its key from `access().invites`. Who joined with it before stays. */
+    closeInvite(spaceId: string, keyOrLink: string): Promise<void>;
+    /**
+     * Revokes a note this account signed — an app's, say. Nothing written under
+     * it counts from then on, except what this node had already seen.
+     */
+    revoke(spaceId: string, token: string): Promise<void>;
+    /** Starts syncing a space. Reading or writing opens it anyway; this is for nodes that serve. */
+    open(spaceId: string): Promise<void>;
+    /** Stops syncing a space until it is next used */
+    close(spaceId: string): Promise<void>;
+    status(spaceId: string): Promise<SpaceStatus>;
+    /**
+     * What a node serving this space uses to check a connecting peer is who it
+     * says — and, in a private space, may read it — and to sign its welcome.
+     * Needs no key of the space's. Null for a space this node does not hold.
+     */
+    authenticator(spaceId: string): Promise<ServerAuth | null>;
+    /**
+     * The name each person gave in this space, by identity. Your own is
+     * published for you, from the account's name, into every space you can
+     * write in — and kept up to date when you rename. Only you can change yours.
+     */
+    profiles(spaceId: string): Promise<ReadonlyArray<SpaceProfile>>;
+}
+export interface NodeRecords {
+    /** Current versions, oldest record first; deleted records only with `includeDeleted` */
+    list<T = unknown>(spaceId: string, options?: ListOptions): Promise<ReadonlyArray<NodeRecord<T>>>;
+    /** A record's current version, or null when there is none or it was deleted */
+    get<T = unknown>(spaceId: string, key: string): Promise<NodeRecord<T> | null>;
+    /**
+     * Creates a record. Its key is random unless given — a chosen key suits a
+     * record there is one of by nature. Writing a key that was deleted brings it back.
+     */
+    put<T = unknown>(spaceId: string, collection: string, body: T, options?: {
+        key?: string;
+        links?: ReadonlyArray<Link>;
+    }): Promise<NodeRecord<T>>;
+    /** The same, given the collection's definition: the body is checked against its type as you write it */
+    put<C extends {
+        readonly name: string;
+    }>(spaceId: string, collection: C, body: BodyOf<C>, options?: {
+        key?: string;
+        links?: ReadonlyArray<Link>;
+    }): Promise<NodeRecord<BodyOf<C>>>;
+    /** Writes the record's next version. Same key; `seq` one higher. Links carry over unless given. */
+    update<T = unknown>(spaceId: string, key: string, body: T, options?: {
+        links?: ReadonlyArray<Link>;
+    }): Promise<NodeRecord<T>>;
+    /** The records whose current version points at this one — optionally in one role, or one collection */
+    linked<T = unknown>(spaceId: string, key: string, options?: {
+        rel?: string;
+        collection?: string;
+    }): Promise<ReadonlyArray<NodeRecord<T>>>;
+    /**
+     * Deletes a record everywhere, by writing a version marked deleted that syncs
+     * like any other. Anyone who may write in the space may delete in it.
+     */
+    delete(spaceId: string, key: string): Promise<void>;
+    /**
+     * The versions of a record this node keeps, newest first: the current one,
+     * the first one, and — in a collection with `history: 'all'` — every other.
+     */
+    history<T = unknown>(spaceId: string, key: string): Promise<ReadonlyArray<NodeRecord<T>>>;
+    /**
+     * Whether this account may `create` in a collection (`target` = its name),
+     * or `edit` / `delete` a record (`target` = its key) — by the collection's
+     * rules and the space's. For hiding a button rather than showing an error.
+     */
+    can(spaceId: string, action: 'create' | 'edit' | 'delete', target: string): Promise<boolean>;
+    /**
+     * Records matching a query — filtered, sorted, paged, with linked records
+     * pulled in. The query is plain data. Name a collection by its definition
+     * (or a `Typed` name) instead of a string, and the records — and what each
+     * `include` finds — come back typed. Only records this device can read are
+     * returned.
+     * @throws When the query is malformed, saying what to fix
+     */
+    query<const Q extends Query>(spaceId: string, query: Q): Promise<ResultOf<Q>>;
+    /**
+     * Runs a query now and again whenever the space's records change, calling
+     * back with each result. Returns a function that stops it.
+     */
+    watch<const Q extends Query>(spaceId: string, query: Q, onResult: (result: ResultOf<Q>) => void, onError?: (error: Error) => void): () => void;
+}
+export interface DelegateParams {
+    /** The key being given permission — an agent's, a guest's */
+    readonly audience: string;
+    /** Must be no broader than the node's own */
+    readonly capabilities: ReadonlyArray<Capability>;
+    /** Unix seconds; capped at the node's own delegation. Default: the same. */
+    readonly expiration?: number;
+}
+export interface Delegated {
+    readonly token: UCANToken;
+    /** The chain above it, root first, for anyone verifying it */
+    readonly proofs: ReadonlyArray<string>;
+}
+export interface AccountProfileView {
+    readonly name: string;
+    /** When it was set, on whichever device set it */
+    readonly updatedAt: string;
+}
+/** A carrier the account uses, as the account registry lists it */
+export interface CarrierSummary {
+    /** The carry space shared with it */
+    readonly space: string;
+    /** Its key, as peers see it */
+    readonly did: string;
+    readonly name: string;
+    readonly since: string;
+}
+/**
+ * Carriers: nodes that keep the account's spaces online without being able to
+ * read them — a browser extension, say (`space/pass.ts`). Needs the account key.
+ */
+export interface NodeCarriers {
+    list(): Promise<ReadonlyArray<CarrierSummary>>;
+    /**
+     * Starts using a carrier: makes a carry space for it, puts a pass for every
+     * space of the account in it, and lists it in the account registry so every
+     * device keeps those passes current.
+     * @returns The carry space, and the view-only invite the carrier joins it with
+     */
+    add(carrier: {
+        readonly did: string;
+        readonly name: string;
+    }): Promise<{
+        readonly space: string;
+        readonly invite: string;
+    }>;
+    /**
+     * Stops using a carrier: takes its passes away and tells it to forget what it
+     * held. What it already downloaded, it keeps — encrypted, as it always was.
+     */
+    remove(space: string): Promise<void>;
+}
+export interface NodeAccount {
+    /** The account's profile as its devices last set it. Null without an account key, or before any is set. */
+    profile(): Promise<AccountProfileView | null>;
+    /** Renames the account on every device and app that opens it. Needs an account key. */
+    setName(name: string): Promise<AccountProfileView>;
+    /**
+     * Revokes a note this account signed in the account registry, so a
+     * whole-account app can no longer add spaces or rename it. Needs an account key.
+     */
+    revoke(token: string): Promise<void>;
+}
+export interface P2PNode {
+    /** The identity this node acts for */
+    readonly did: string;
+    /** The session key that signs and connects; stable for the node's lifetime */
+    readonly sessionDid: string;
+    readonly spaces: NodeSpaces;
+    readonly records: NodeRecords;
+    readonly collections: NodeCollections;
+    /** The account itself — its name, synced through the account registry */
+    readonly account: NodeAccount;
+    /** Nodes that keep the account's spaces online without reading them */
+    readonly carriers: NodeCarriers;
+    /** The delegation the session key currently writes under (root → session) */
+    delegation(): UCANToken;
+    /** Passes a narrower delegation from the session key on to another key */
+    delegate(params: DelegateParams): Promise<Delegated>;
+    /**
+     * The same node, acting as an agent: what it writes is signed by the
+     * agent's key under the agent's note (one carrying `AGENT_FACT`), so it
+     * shows as "via agent" everywhere. It reads and writes only the spaces that
+     * note names, and refuses everything that needs a person — defining
+     * collections, roles, invites, joining or leaving, the account itself.
+     * Closing it leaves this node running.
+     *
+     * @param agent.note The agent's note from the account home (`Grant.token` of an agent grant)
+     * @throws When the note is not an agent's, has run out, or is not made out to `keys`
+     */
+    asAgent(agent: {
+        readonly keys: CryptoKeyPair;
+        readonly note: string;
+    }): Promise<P2PNode>;
+    subscribe(listener: (event: NodeEvent) => void): () => void;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/node/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/node/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACzH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE3E,MAAM,WAAW,iBAAiB;IAChC,yFAAyF;IACzF,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,0FAA0F;IAC1F,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IAClD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,aAAa,CAAC,aAAa,CAAC,CAAC;CAC7F;AAED,MAAM,WAAW,UAAU;IACzB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IACpD,2BAA2B;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IACrC,wFAAwF;IACxF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;IACpC,qGAAqG;IACrG,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,gEAAgE;AAChE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,+BAA+B;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1C,oEAAoE;IACpE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,GAAG,MAAM,GAAG,YAAY,GAAG,SAAS,GAAG,WAAW,CAAC,CAAC;IAC3F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,qCAAqC;AACrC,MAAM,WAAW,WAAW;IAC1B,yBAAyB;IACzB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjF,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACzG,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IAChC,iFAAiF;IACjF,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACvC;AAED,mFAAmF;AACnF,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,OAAO;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iGAAiG;IACjG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IACxB,wFAAwF;IACxF,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,kGAAkG;IAClG,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;CAC9C;AAED,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,+GAA+G;IAC/G,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,KAAK,CAAC;IACnC,oGAAoG;IACpG,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IAC1D,kGAAkG;IAClG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,6FAA6F;IAC7F,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,yFAAyF;IACzF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,oBAAoB,CAAC;IACnD,kDAAkD;IAClD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,wGAAwG;IACxG,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IACpC,uEAAuE;IACvE,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IAC3D,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,mFAAmF;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,gHAAgH;IAChH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,sFAAsF;IACtF,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9D,0FAA0F;IAC1F,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/E;;;OAGG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,WAAW;IAC1B,wFAAwF;IACxF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,OAAO,CAAC;AAE/E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,0GAA0G;IAC1G,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,iFAAiF;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gDAAgD;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,SAAS;AACnB,iEAAiE;AAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AACtD,kCAAkC;GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AACrD,gEAAgE;GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE;AAC7B,wEAAwE;GACtE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACvG,8GAA8G;GAC5G;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7C,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACnD,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAChD;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C;;;OAGG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,yEAAyE;IACzE,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,kIAAkI;IAClI,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,gDAAgD;IAChD,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,uEAAuE;IACvE,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,qHAAqH;IACrH,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D;;;OAGG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,gGAAgG;IAChG,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,kDAAkD;IAClD,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C;;;;OAIG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC3D;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,WAAW;IAC1B,wFAAwF;IACxF,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,+EAA+E;IAC/E,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9E;;;OAGG;IACH,GAAG,CAAC,CAAC,GAAG,OAAO,EACb,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,CAAC,EACP,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,CAAA;KAAE,GACtD,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,wGAAwG;IACxG,GAAG,CAAC,CAAC,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EACrC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,CAAC,EACb,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EACf,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,CAAA;KAAE,GACtD,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,mGAAmG;IACnG,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9H,uGAAuG;IACvG,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1I;;;OAGG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;OAGG;IACH,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F;;;;OAIG;IACH,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7F;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CAChJ;AAED,MAAM,WAAW,cAAc;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC/C;;;;;OAKG;IACH,GAAG,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5H;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,WAAW;IAC1B,2GAA2G;IAC3G,OAAO,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC9C,uFAAuF;IACvF,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACnD;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,OAAO;IACtB,sCAAsC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;IACtC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,6EAA6E;IAC7E,UAAU,IAAI,SAAS,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACrD;;;;;;;;;;OAUG;IACH,OAAO,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1F,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}

package/dist/node/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/node/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/node/types.ts"],"names":[],"mappings":""}

package/dist/privacy/index.d.ts

@@ -0,0 +1,4 @@
+export * from './space-encryption.js';
+export * from './key-distribution.js';
+export * from './privacy-guard.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/privacy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/privacy/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC"}

package/dist/privacy/index.js

@@ -0,0 +1,4 @@
+export * from './space-encryption.js';
+export * from './key-distribution.js';
+export * from './privacy-guard.js';
+//# sourceMappingURL=index.js.map

package/dist/privacy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/privacy/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC"}

package/dist/privacy/key-distribution.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Represents a space key that has been wrapped for a specific recipient.
+ */
+export interface WrappedKey {
+    readonly recipientDid: string;
+    readonly ephemeralPublicKey: string;
+    readonly wrappedKeyData: string;
+    readonly algorithm: string;
+}
+/**
+ * A member's public key for key wrapping.
+ */
+export interface MemberPublicKey {
+    readonly did: string;
+    readonly publicKey: CryptoKey;
+}
+/**
+ * Wraps a space key using ECDH + AES-KW.
+ *
+ * @param {CryptoKey} spaceKey - The space key to wrap.
+ * @param {CryptoKey} recipientPublicKey - The recipient's public ECDH key.
+ * @param {string} recipientDid - The DID of the recipient.
+ * @returns {Promise<WrappedKey>} A promise resolving to the wrapped key.
+ */
+export declare function wrapSpaceKey(spaceKey: CryptoKey, recipientPublicKey: CryptoKey, recipientDid: string): Promise<WrappedKey>;
+/**
+ * Unwraps a wrapped space key using ECDH + AES-KW.
+ *
+ * @param {WrappedKey} wrapped - The wrapped key to unwrap.
+ * @param {CryptoKey} recipientPrivateKey - The recipient's private ECDH key.
+ * @returns {Promise<CryptoKey>} A promise resolving to the unwrapped space key.
+ */
+export declare function unwrapSpaceKey(wrapped: WrappedKey, recipientPrivateKey: CryptoKey): Promise<CryptoKey>;
+/**
+ * Wraps a space key for multiple members.
+ *
+ * @param {CryptoKey} spaceKey - The space key to wrap.
+ * @param {ReadonlyArray<MemberPublicKey>} memberPublicKeys - An array of member public keys.
+ * @returns {Promise<ReadonlyArray<WrappedKey>>} A promise resolving to an array of wrapped keys.
+ */
+export declare function distributeSpaceKey(spaceKey: CryptoKey, memberPublicKeys: ReadonlyArray<MemberPublicKey>): Promise<ReadonlyArray<WrappedKey>>;
+//# sourceMappingURL=key-distribution.d.ts.map

package/dist/privacy/key-distribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-distribution.d.ts","sourceRoot":"","sources":["../../src/privacy/key-distribution.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,SAAS,EACnB,kBAAkB,EAAE,SAAS,EAC7B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,UAAU,CAAC,CAoCrB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,UAAU,EACnB,mBAAmB,EAAE,SAAS,GAC7B,OAAO,CAAC,SAAS,CAAC,CAmCpB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,SAAS,EACnB,gBAAgB,EAAE,aAAa,CAAC,eAAe,CAAC,GAC/C,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAMpC"}

package/dist/privacy/key-distribution.js

@@ -0,0 +1,50 @@
+import { base64UrlEncode, base64UrlDecode } from '../utils/encoding.js';
+/**
+ * Wraps a space key using ECDH + AES-KW.
+ *
+ * @param {CryptoKey} spaceKey - The space key to wrap.
+ * @param {CryptoKey} recipientPublicKey - The recipient's public ECDH key.
+ * @param {string} recipientDid - The DID of the recipient.
+ * @returns {Promise<WrappedKey>} A promise resolving to the wrapped key.
+ */
+export async function wrapSpaceKey(spaceKey, recipientPublicKey, recipientDid) {
+    const ephemeralPair = await globalThis.crypto.subtle.generateKey({ name: 'ECDH', namedCurve: 'P-256' }, true, ['deriveBits']);
+    const sharedSecret = await globalThis.crypto.subtle.deriveBits({ name: 'ECDH', public: recipientPublicKey }, ephemeralPair.privateKey, 256);
+    const kek = await globalThis.crypto.subtle.importKey('raw', sharedSecret, { name: 'AES-KW' }, false, ['wrapKey']);
+    const wrappedKeyBuffer = await globalThis.crypto.subtle.wrapKey('raw', spaceKey, kek, { name: 'AES-KW' });
+    const ephemeralRaw = await globalThis.crypto.subtle.exportKey('raw', ephemeralPair.publicKey);
+    return Object.freeze({
+        recipientDid,
+        ephemeralPublicKey: base64UrlEncode(new Uint8Array(ephemeralRaw)),
+        wrappedKeyData: base64UrlEncode(new Uint8Array(wrappedKeyBuffer)),
+        algorithm: 'ECDH-AES-KW'
+    });
+}
+/**
+ * Unwraps a wrapped space key using ECDH + AES-KW.
+ *
+ * @param {WrappedKey} wrapped - The wrapped key to unwrap.
+ * @param {CryptoKey} recipientPrivateKey - The recipient's private ECDH key.
+ * @returns {Promise<CryptoKey>} A promise resolving to the unwrapped space key.
+ */
+export async function unwrapSpaceKey(wrapped, recipientPrivateKey) {
+    const ephemeralRaw = base64UrlDecode(wrapped.ephemeralPublicKey);
+    const ephemeralPublicKey = await globalThis.crypto.subtle.importKey('raw', ephemeralRaw, { name: 'ECDH', namedCurve: 'P-256' }, true, []);
+    const sharedSecret = await globalThis.crypto.subtle.deriveBits({ name: 'ECDH', public: ephemeralPublicKey }, recipientPrivateKey, 256);
+    const kek = await globalThis.crypto.subtle.importKey('raw', sharedSecret, { name: 'AES-KW' }, false, ['unwrapKey']);
+    const wrappedKeyData = base64UrlDecode(wrapped.wrappedKeyData);
+    return globalThis.crypto.subtle.unwrapKey('raw', wrappedKeyData, kek, { name: 'AES-KW' }, { name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
+}
+/**
+ * Wraps a space key for multiple members.
+ *
+ * @param {CryptoKey} spaceKey - The space key to wrap.
+ * @param {ReadonlyArray<MemberPublicKey>} memberPublicKeys - An array of member public keys.
+ * @returns {Promise<ReadonlyArray<WrappedKey>>} A promise resolving to an array of wrapped keys.
+ */
+export async function distributeSpaceKey(spaceKey, memberPublicKeys) {
+    const promises = memberPublicKeys.map(member => wrapSpaceKey(spaceKey, member.publicKey, member.did));
+    const wrappedKeys = await Promise.all(promises);
+    return Object.freeze([...wrappedKeys]);
+}
+//# sourceMappingURL=key-distribution.js.map