@wemush/wols 0.1.0 → 1.3.0

package/dist/cjs/crypto/decrypt.js.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../../../src/crypto/decrypt.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AA+FH,0CAwDC;AArJD,4CAAkE;AAClE,4CAA6C;AAG7C,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,6DAA6D;AAC7D,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAEvE,0DAA0D;AAC1D,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAElC,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;GAEG;AACH,SAAS,aAAa,CAAC,SAAiB;IACtC,8BAA8B;IAC9B,MAAM,MAAM,GAAG,SAAS;SACrB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAEtE,iCAAiC;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAElC,yBAAyB;IACzB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,KAAK,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,SAAS,CAAC,QAAgB;IACvC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE/C,kCAAkC;IAClC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE;QACvF,WAAW;KACZ,CAAC,CAAC;IAEH,yBAAyB;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,iBAAiB;QAC7B,IAAI,EAAE,SAAS;KAChB,EACD,WAAW,EACX,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACI,KAAK,UAAU,eAAe,CACnC,SAA4B,EAC5B,OAA0B;IAE1B,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAExB,wCAAwC;IACxC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,IAAI,+BAAmB,CAAC,yBAAa,CAAC,gBAAgB,EAAE,2BAA2B,EAAE;gBAC1F,IAAI,EAAE,CAAC,SAAS,CAAC;aAClB,CAAC;SACH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,IAAI,+BAAmB,CAC5B,yBAAa,CAAC,gBAAgB,EAC9B,oCAAoC,EACpC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CACjB;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,mCAAmC;QACnC,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAEvE,uCAAuC;QACvC,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEpC,UAAU;QACV,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAE9F,6BAA6B;QAC7B,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEjD,gDAAgD;QAChD,OAAO,IAAA,yBAAa,EAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4DAA4D;QAC5D,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC;QAEzF,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,IAAI,+BAAmB,CAC5B,yBAAa,CAAC,gBAAgB,EAC9B,sBAAsB,YAAY,EAAE,CACrC;SACF,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../../../src/crypto/decrypt.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;AA6EH,8CAuEC;AAoTD,4CAiCC;AA+BD,0CAOC;AAiBD,oCAqBC;AAuED,sCA4GC;AAruBD,4CAA6C;AAY7C,2CAoBqB;AAGrB,MAAM,IAAI,GAAG,CAAC,KAA0B,EAAW,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAClF,MAAM,SAAS,GAAG,CAAC,KAAc,EAAoB,EAAE,CACrD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAK,KAA+B,CAAC,OAAO,KAAK,KAAK,CAAC;AAuBpG,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAU,CAAC;AAEtE;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,gCAAoB,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,IAAA,2BAAe,EAAC,aAAa,EAAE,wBAAwB,gCAAoB,GAAG,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,gCAAoB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CACT,IAAA,2BAAe,EAAC,aAAa,EAAE,wDAAwD,CAAC,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,qFAAqF;QACrF,OAAO,IAAI,CACT,IAAA,2BAAe,EACb,kBAAkB,EAClB,iEAAiE,CAClE,CACF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CACT,IAAA,2BAAe,EAAC,aAAa,EAAE,wDAAwD,CAAC,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CACT,IAAA,2BAAe,EAAC,mBAAmB,EAAE,cAAc,IAAI,0BAA0B,CAAC,CACnF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,IAAI,CACT,IAAA,2BAAe,EAAC,mBAAmB,EAAE,gDAAgD,EAAE;YACrF,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;SACvB,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAsB;QAChC,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,CAAC;QACV,EAAE;QACF,EAAE,EAAE,UAAU,MAAM,EAAE;QACtB,GAAG;KACJ,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,CAAC,GAAG,GAAG,GAAoB,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,0EAA0E;QAC1E,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAC/D,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC;IACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,cAAc,CAAC,KAAiC;IACvD,IAAI,GAAsB,CAAC;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;IACpB,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACvD,GAAG,GAAG,KAAK,CAAC;IACd,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CACT,IAAA,2BAAe,EAAC,aAAa,EAAE,wDAAwD,CAAC,CACzF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,IAAI,CACT,IAAA,2BAAe,EAAC,mBAAmB,EAAE,2BAA2B,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,IAAI,CACT,IAAA,2BAAe,EAAC,mBAAmB,EAAE,oCAAoC,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAC7F,CAAC;IACJ,CAAC;IAED,IAAI,QAA4B,CAAC;IACjC,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvF,OAAO,IAAI,CAAC,IAAA,2BAAe,EAAC,mBAAmB,EAAE,wBAAwB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/F,CAAC;QACD,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,IAAI,EAAE;YACJ,QAAQ;YACR,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,gDAAgD;AAChD,gFAAgF;AAEhF,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,IAAI,CAAC;QACH,OAAO,IAAA,2BAAe,EAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,IAAA,2BAAe,EAAC,mBAAmB,EAAE,cAAc,IAAI,0BAA0B,CAAC,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,OAA0B;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,IAAI,yCAA6B,CAAC;IACnE,+EAA+E;IAC/E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,iCAAqB,IAAI,GAAG,GAAG,0BAAc,EAAE,CAAC;QAClF,OAAO,IAAI,CACT,IAAA,2BAAe,EACb,mBAAmB,EACnB,yCAAyC,iCAAqB,OAAO,0BAAc,SAAS,GAAG,EAAE,CAClG,CACF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,KAAkC,EAAE,GAAW;IACtE,mFAAmF;IACnF,MAAM,CAAC,GACL,OAAO,KAAK,KAAK,QAAQ;QACvB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAChD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACf,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACnB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,IAAA,2BAAe,EAAC,mBAAmB,EAAE,2CAA2C,CAAC,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,GAAG,iCAAqB,EAAE,CAAC;QAC9B,OAAO,IAAI,CACT,IAAA,2BAAe,EACb,yBAAyB,EACzB,0BAA0B,CAAC,4BAA4B,iCAAqB,EAAE,CAC/E,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACZ,OAAO,IAAI,CACT,IAAA,2BAAe,EACb,sBAAsB,EACtB,0BAA0B,CAAC,2BAA2B,GAAG,GAAG,EAC5D,EAAE,UAAU,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CACtC,CACF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,CAAe,EAAE,OAA0B;IAC1D,IAAI,CAAC,IAAA,wBAAY,GAAE,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,IAAA,2BAAe,EAAC,yBAAyB,EAAE,gCAAoB,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,IAAA,2BAAe,EAAC,aAAa,EAAE,4CAA4C,CAAC,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACxB,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,SAAS,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAE/B,yDAAyD;IACzD,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzB,OAAO,IAAI,CACT,IAAA,2BAAe,EACb,eAAe,EACf,iEAAiE;gBAC/D,4DAA4D,EAC9D,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,IAAI,CACT,IAAA,2BAAe,EAAC,sBAAsB,EAAE,mDAAmD,CAAC,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,IAAI,CACT,IAAA,2BAAe,EAAC,mBAAmB,EAAE,+CAA+C,EAAE;gBACpF,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;aAC9B,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,IAAI,CACT,IAAA,2BAAe,EAAC,sBAAsB,EAAE,6CAA6C,CAAC,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,IAAA,2BAAe,EAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,uBAAuB;IACvB,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,SAAS,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC7C,IAAI,UAAU,CAAC,MAAM,GAAG,0BAAc,EAAE,CAAC;QACvC,OAAO,IAAI,CACT,IAAA,2BAAe,EACb,mBAAmB,EACnB,iBAAiB,UAAU,CAAC,MAAM,+BAA+B,0BAAc,eAAe,CAC/F,CACF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACnC,IAAI,SAAS,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,EAAE,CAAC,MAAM,KAAK,qBAAS,EAAE,CAAC;QAC5B,OAAO,IAAI,CACT,IAAA,2BAAe,EAAC,mBAAmB,EAAE,cAAc,qBAAS,eAAe,EAAE,CAAC,MAAM,EAAE,CAAC,CACxF,CAAC;IACJ,CAAC;IAED,wCAAwC;IACxC,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,IAAA,wBAAY,EAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,IAAA,oBAAQ,EAAC,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CACT,IAAA,2BAAe,EAAC,aAAa,EAAE,2DAA2D,CAAC,CAC5F,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAChC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,oCAAwB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAC/E,GAAG,CACJ,CAAC;IACF,IAAI,SAAS,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC7C,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,GAAG,IAAI,UAAU,CAAC,8BAAkB,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,SAAS,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC;QACvC,IAAI,GAAG,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,IAAA,wBAAY,EAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,IAAA,2BAAe,EAAC,aAAa,EAAE,6CAA6C,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC/E,CAAC;AAED,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF,6EAA6E;AAC7E,SAAS,YAAY,CAAC,QAAkB;IACtC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAC/B,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACjE,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAkB;IACzC,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAA,yBAAa,EAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACjE,OAAO,OAAO,QAAQ,KAAK,QAAQ;gBACjC,CAAC,CAAC,IAAI,CAAC,IAAA,2BAAe,EAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;gBAChD,CAAC,CAAC,QAAQ,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAA,+BAAmB,EACrC,QAAQ,CAAC,UAAU,EACnB,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,UAAU,CACpB,CAAC;QACF,OAAO,MAAM,IAAA,wBAAY,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CACT,IAAA,2BAAe,EACb,aAAa,EACb,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7E,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,UAAU,CACvB,CAAe,EACf,OAA0B;IAE1B,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACrC,IAAI,SAAS,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,SAAS,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,YAAY,CACzB,QAAkB,EAClB,SAAoB,EACpB,GAA6B;IAE7B,IAAI,SAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACrC,GAAG,KAAK,SAAS;YACf,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;YACtC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,EAC7D,SAAS,EACT,QAAQ,CAAC,UAAU,CACpB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CACT,IAAA,2BAAe,EACb,uBAAuB,EACvB,iFAAiF,CAClF,CACF,CAAC;IACJ,CAAC;IAED,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,qEAAqE;QACrE,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,IAAA,2BAAe,EAAC,mBAAmB,EAAE,sCAAsC,CAAC,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CACT,IAAA,2BAAe,EAAC,mBAAmB,EAAE,iDAAiD,CAAC,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,gBAAgB,CACpC,KAAiC,EACjC,OAA0B;IAE1B,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAEnC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAEnC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,UAAU,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpD,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,QAAQ,GAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAA6B,EAAE,EAAE,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,IAAA,2BAAe,EAAC,mBAAmB,EAAE,qCAAqC,CAAC,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,qEAAqE;YACrE,iCAAiC;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC7D,OAAO,IAAI,CACT,IAAA,2BAAe,EACb,aAAa,EACb,yBAAyB,KAAK,mBAAmB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,EAC7E,EAAE,UAAU,EAAE,QAAQ,EAAE,CACzB,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8FAA8F;AAC9F,SAAS,cAAc,CAAC,IAAY,EAAE,IAAY;IAChD,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,IAAI,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAClC,OAAO,IAAI,CACT,IAAA,2BAAe,EACb,mBAAmB,EACnB,GAAG,IAAI,kCAAkC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAC/D,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,CAC7B,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,eAAe,CACnC,KAAiC,EACjC,OAA0B;IAE1B,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,SAAS,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACI,KAAK,UAAU,YAAY,CAChC,KAAqB,EACrB,OAA0B,EAC1B,OAAqB;IAErB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC,IAAA,2BAAe,EAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,IAAI,SAAS,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,SAAS,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,SAAS,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAY,EAAE,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,IAAA,2BAAe,EAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAUD,SAAS,WAAW,CAAC,KAAqB;IACxC,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,UAAU,CACjB,KAAqB,EACrB,OAAiC;IAEjC,IAAK,KAA2B,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrE,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ;QAC9B,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QACjC,OAAO,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QACtC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QACjC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,IAAI,CACT,IAAA,2BAAe,EACb,mBAAmB,EACnB,iGAAiG,CAClG,CACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,oBAAQ,EAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACI,KAAK,UAAU,aAAa,CACjC,KAAuD,EACvD,OAA0B;IAE1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,IAAA,2BAAe,EAAC,mBAAmB,EAAE,4CAA4C,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,KAA0B,EAAW,EAAE,CACvE,IAAI,CACF,IAAA,2BAAe,EAAC,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE;QACjE,GAAG,KAAK,CAAC,OAAO;QAChB,IAAI,EAAE,CAAC,IAAI,CAAC;KACb,CAAC,CACH,CAAC;IAEJ,MAAM,gBAAgB,GAAG,CAAC,CAAU,EAAW,EAAE,CAC/C,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAA6B,CAAC,SAAS,KAAK,IAAI,CAAC;IAE3F,kEAAkE;IAClE,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,oBAAoB,GAAG,8BAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CACT,IAAA,2BAAe,EACb,mBAAmB,EACnB,wBAAwB,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAC/E,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAC/B,CACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAE7B,+DAA+D;IAC/D,MAAM,OAAO,GACX,EAAE,CAAC;IACL,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,IACE,OAAO,UAAU,KAAK,QAAQ;YAC9B,UAAU,KAAK,IAAI;YAClB,UAAsC,CAAC,SAAS,KAAK,IAAI,EAC1D,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,UAA4B,CAAC;QAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QACtD,IAAI,SAAS,CAAC,QAAQ,CAAC;YAAE,OAAO,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,SAAS,CAAC,GAAG,CAAC;YAAE,OAAO,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,0DAA0D;IAC1D,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,SAAS,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC/B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,OAAO,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,EAAE,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ;YAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAChB,OAAO,IAAI,CACT,IAAA,2BAAe,EACb,sBAAsB,EACtB,kBAAkB,KAAK,6BAA6B,WAAW,CAAC,IAAI,mBAAmB;YACrF,4BAA4B,GAAG,GAAG,EACpC,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,CAC1C,CACF,CAAC;IACJ,CAAC;IAED,kDAAkD;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,MAAM,MAAM,GAA4B,EAAE,GAAG,KAAK,EAAE,CAAC;IACrD,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,SAAS,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,SAAS,CAAC,OAAO,CAAC;gBAAE,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/D,SAAS,GAAG,OAAO,CAAC;YACpB,IAAI,EAAE,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAY,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,UAAU,CACf,IAAI,EACJ,IAAA,2BAAe,EAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CACT,IAAA,2BAAe,EACb,mBAAmB,EACnB,2CAA2C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9F,CACF,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;AACnD,CAAC"}

package/dist/cjs/crypto/encrypt.d.ts

@@ -0,0 +1,132 @@
+/**
+ * WOLS Encryption Module (WOLS v1.3.0 encrypted format)
+ *
+ * AES-256-GCM via WebCrypto, so it runs in Node.js 20+, browsers, Deno and Bun.
+ *
+ * ## Wire format
+ *
+ * ```
+ * wemush://v1/encrypted/{id}?e={ciphertext}&iv={iv}&kdf={pbkdf2|raw}[&salt={salt}&i={iterations}]
+ * ```
+ *
+ * - `e`: ciphertext with the 16-byte GCM tag appended
+ * - `iv`: fresh random 12-byte IV per encryption
+ * - All binary values are base64url without padding
+ *
+ * ## Keys
+ *
+ * | `key` value | `kdf` | Notes |
+ * |-------------|-------|-------|
+ * | `string` passphrase | `pbkdf2` | PBKDF2-HMAC-SHA256, fresh random 16-byte salt per label, ≥100,000 iterations |
+ * | 32-byte `Uint8Array` / `ArrayBuffer` | `raw` | Key shared out of band |
+ * | AES-GCM 256 `CryptoKey` | `raw` | Key shared out of band |
+ *
+ * Pre-1.3.0 releases derived passphrase keys with a fixed library-wide salt.
+ * That scheme is never generated any more; see `allowLegacy` on decryption.
+ *
+ * @module crypto/encrypt
+ */
+import type { EncryptedField, EncryptedSpecimen, EncryptionOptions, FieldEncryptedSpecimen, FieldEncryptedSpecimenOf, FieldEncryptionOptions, Specimen } from '../types.js';
+/**
+ * Build the encrypted-format URL for an encrypted specimen.
+ *
+ * Enforces the generator rules, so a hand-built object cannot produce a
+ * non-conformant label:
+ * - `payload` and `iv` are canonical unpadded base64url, the IV is 12 bytes,
+ *   and the payload is at least the 16-byte GCM tag
+ * - `kdf` is present: `pbkdf2` needs 100,000 to 2^32-1 iterations and a salt
+ *   of at least 16 bytes that is not the legacy library salt (compared as
+ *   bytes); `raw` must not carry `salt` or `iterations`
+ *
+ * Labels with more than 10,000,000 iterations are valid but exceed the
+ * decoders' default `maxIterations`, so readers must raise it.
+ *
+ * @throws WolsEncryptionError when the object would produce a non-conformant
+ *   label (including legacy payloads, which are never generated)
+ * @since 1.3.0
+ */
+export declare function toEncryptedUrl(encrypted: EncryptedSpecimen): string;
+/**
+ * Encrypt a whole specimen with AES-256-GCM (WOLS v1.3.0 encrypted format).
+ *
+ * The specimen's embedded JSON-LD serialization is encrypted and the result
+ * carries `url`, the `wemush://v1/encrypted/...` string to encode in a QR code.
+ * For field-level encryption use {@link encryptFields}.
+ *
+ * @param specimen - The specimen to encrypt
+ * @param options - `key` (passphrase or raw key) and optional `iterations`
+ * @throws WolsEncryptionError for an unusable key, too few iterations, an id
+ *   without a suffix, or a runtime without WebCrypto
+ *
+ * @example
+ * ```typescript
+ * // Passphrase: kdf=pbkdf2 with a random per-label salt
+ * const enc = await encryptSpecimen(specimen, { key: 'correct horse battery staple' });
+ * enc.url; // 'wemush://v1/encrypted/clx1a2b3c4?e=...&iv=...&kdf=pbkdf2&salt=...&i=100000'
+ *
+ * // Raw 32-byte key: kdf=raw
+ * const raw = await encryptSpecimen(specimen, { key: crypto.getRandomValues(new Uint8Array(32)) });
+ * ```
+ *
+ * @since 1.3.0 Per-label random salt, `kdf`, `id` and `url`; raw key bytes accepted.
+ *   The `fields` option is deprecated in favor of `encryptFields()`.
+ */
+export declare function encryptSpecimen(specimen: Specimen, options: EncryptionOptions & {
+    fields: readonly string[];
+}): Promise<FieldEncryptedSpecimen>;
+export declare function encryptSpecimen(specimen: Specimen, options: EncryptionOptions): Promise<EncryptedSpecimen>;
+/**
+ * Field-level encryption (WOLS v1.3.0): replace the value of each named field
+ * with an {@link EncryptedField} and leave the rest of the specimen in cleartext.
+ *
+ * One key (and, for passphrases, one random salt) per call; a fresh IV per field.
+ * Each value is bound to its label and field with AES-GCM additional data:
+ * the UTF-8 of `"{id}\n{field}"` (WOLS 1.3.0). A value moved to another field
+ * or copied into another label fails authentication. Restore with `decryptFields()`.
+ *
+ * The identifying fields (`@context`, `@type`, `id`, `version`, `type`,
+ * `species`) can't be encrypted.
+ *
+ * @param specimen - The specimen to partially encrypt
+ * @param options - `key`, `fields` (each must be present on the specimen), optional `iterations`
+ * @throws WolsEncryptionError when `fields` is empty, names a field the specimen
+ *   does not have, or names a field twice; or for an unusable key
+ *
+ * @example
+ * ```typescript
+ * const partial = await encryptFields(specimen, { key: passphrase, fields: ['strain'] });
+ * partial.species;  // still cleartext
+ * partial.strain;   // { encrypted: true, algorithm: 'AES-256-GCM', payload, iv, kdf: 'pbkdf2', salt, iterations }
+ * ```
+ *
+ * @since 1.3.0
+ */
+export declare function encryptFields<K extends keyof Specimen>(specimen: Specimen, options: FieldEncryptionOptions<K>): Promise<FieldEncryptedSpecimenOf<K>>;
+/**
+ * Whether a value is a field-level {@link EncryptedField}: an encrypted value
+ * with a `kdf` and no specimen `id` or `url`.
+ *
+ * The 1.3.0 shapes are told apart structurally: whole-label objects produced
+ * by `encryptSpecimen` and `parseEncryptedUrl` always carry `id`, and field
+ * values never do. Legacy (pre-1.3.0) values have no `kdf` and are reported
+ * as {@link isEncryptedSpecimen}, whether they were whole labels or fields.
+ * `decryptFields` handles legacy field values regardless (with `allowLegacy`).
+ *
+ * @since 1.3.0
+ */
+export declare function isEncryptedField(value: unknown): value is EncryptedField;
+/**
+ * Whether a value is a whole-label {@link EncryptedSpecimen} (v1.3.0 or legacy).
+ *
+ * @since 1.3.0
+ */
+export declare function isEncryptedSpecimen(value: unknown): value is EncryptedSpecimen;
+/**
+ * Whether a value carries the `encrypted: true` marker: either a whole-label
+ * {@link EncryptedSpecimen} or a field-level {@link EncryptedField}. Use
+ * {@link isEncryptedSpecimen} or {@link isEncryptedField} to tell them apart.
+ *
+ * @since 1.3.0 Narrows to `EncryptedSpecimen | EncryptedField`
+ */
+export declare function isEncrypted(value: unknown): value is EncryptedSpecimen | EncryptedField;
+//# sourceMappingURL=encrypt.d.ts.map

package/dist/cjs/crypto/encrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt.d.ts","sourceRoot":"","sources":["../../../src/crypto/encrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EAEjB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,QAAQ,EACT,MAAM,aAAa,CAAC;AA+IrB;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,iBAAiB,GAAG,MAAM,CAmCnE;AAMD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,iBAAiB,GAAG;IAAE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACzD,OAAO,CAAC,sBAAsB,CAAC,CAAC;AACnC,wBAAsB,eAAe,CACnC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAuC9B;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,aAAa,CAAC,CAAC,SAAS,MAAM,QAAQ,EAC1D,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAuDtC;AAgBD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAOxE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAE9E;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,GAAG,cAAc,CAKvF"}

package/dist/cjs/crypto/encrypt.js

@@ -1,151 +1,334 @@
 "use strict";
 /**
- * WOLS Encryption Module
+ * WOLS Encryption Module (WOLS v1.3.0 encrypted format)
  *
- * Provides AES-256-GCM encryption for specimens using Web Crypto API.
- * Supports both password-based (PBKDF2) and raw CryptoKey encryption.
+ * AES-256-GCM via WebCrypto, so it runs in Node.js 20+, browsers, Deno and Bun.
+ *
+ * ## Wire format
+ *
+ * ```
+ * wemush://v1/encrypted/{id}?e={ciphertext}&iv={iv}&kdf={pbkdf2|raw}[&salt={salt}&i={iterations}]
+ * ```
+ *
+ * - `e`: ciphertext with the 16-byte GCM tag appended
+ * - `iv`: fresh random 12-byte IV per encryption
+ * - All binary values are base64url without padding
+ *
+ * ## Keys
+ *
+ * | `key` value | `kdf` | Notes |
+ * |-------------|-------|-------|
+ * | `string` passphrase | `pbkdf2` | PBKDF2-HMAC-SHA256, fresh random 16-byte salt per label, ≥100,000 iterations |
+ * | 32-byte `Uint8Array` / `ArrayBuffer` | `raw` | Key shared out of band |
+ * | AES-GCM 256 `CryptoKey` | `raw` | Key shared out of band |
+ *
+ * Pre-1.3.0 releases derived passphrase keys with a fixed library-wide salt.
+ * That scheme is never generated any more; see `allowLegacy` on decryption.
  *
  * @module crypto/encrypt
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.toEncryptedUrl = toEncryptedUrl;
 exports.encryptSpecimen = encryptSpecimen;
+exports.encryptFields = encryptFields;
+exports.isEncryptedField = isEncryptedField;
+exports.isEncryptedSpecimen = isEncryptedSpecimen;
 exports.isEncrypted = isEncrypted;
+const errors_js_1 = require("../errors.js");
 const specimen_js_1 = require("../specimen.js");
-// =============================================================================
-// CONSTANTS
-// =============================================================================
-/** Salt for PBKDF2 key derivation (fixed for deterministic key from same password) */
-const PBKDF2_SALT = new TextEncoder().encode('@wemush/wols/crypto/v1');
-/** Number of PBKDF2 iterations */
-const PBKDF2_ITERATIONS = 100_000;
-/** IV length in bytes (96 bits = 12 bytes recommended for GCM) */
-const IV_LENGTH = 12;
-// =============================================================================
-// UTILITY FUNCTIONS
-// =============================================================================
-/**
- * Convert ArrayBuffer to base64url string
- */
-function toBase64Url(buffer) {
-    const bytes = new Uint8Array(buffer);
-    let binary = '';
-    for (const byte of bytes) {
-        binary += String.fromCharCode(byte);
+const shared_js_1 = require("./shared.js");
+function encryptionError(message, code = errors_js_1.WolsErrorCode.ENCRYPTION_ERROR) {
+    throw new errors_js_1.WolsEncryptionError(code, message);
+}
+/** Generators MUST use 100,000 to 10,000,000 iterations (WOLS 1.3.0). */
+function checkGenerateIterations(iterations) {
+    if (typeof iterations !== 'number' ||
+        !Number.isInteger(iterations) ||
+        iterations < shared_js_1.MIN_GENERATE_ITERATIONS ||
+        iterations > shared_js_1.MAX_ITERATIONS) {
+        return encryptionError(`PBKDF2 iterations must be an integer from ${shared_js_1.MIN_GENERATE_ITERATIONS} to ` +
+            `${shared_js_1.MAX_ITERATIONS}, got ${String(iterations)}`);
+    }
+    return iterations;
+}
+/** Decode canonical, unpadded base64url, or throw an encryption error naming the parameter. */
+function canonicalBytes(name, value) {
+    let bytes;
+    if (typeof value === 'string' && !value.includes('=')) {
+        try {
+            bytes = (0, shared_js_1.base64UrlDecode)(value);
+        }
+        catch {
+            bytes = undefined;
+        }
+    }
+    // Re-encoding catches non-canonical spellings (non-zero trailing bits) that
+    // decode to the same bytes as a different string.
+    if (bytes === undefined || (0, shared_js_1.base64UrlEncode)(bytes) !== value) {
+        return encryptionError(`${name} must be canonical base64url without padding`);
     }
-    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+    return bytes;
+}
+function bytesEqual(a, b) {
+    return a.length === b.length && a.every((byte, i) => byte === b[i]);
 }
+/** Identifying fields (WOLS 1.3.0) stay in cleartext so labels remain routable. */
+const STRUCTURAL_FIELDS = new Set(shared_js_1.IDENTIFYING_FIELDS);
 /**
- * Derive a CryptoKey from a password using PBKDF2
+ * Turn the caller's key into an AES key plus the parameters to record.
+ * A passphrase gets a fresh random salt for every call (one call = one label).
  */
-async function deriveKey(password) {
-    const encoder = new TextEncoder();
-    const passwordBytes = encoder.encode(password);
-    // Import password as key material
-    const keyMaterial = await crypto.subtle.importKey('raw', passwordBytes, 'PBKDF2', false, [
-        'deriveKey',
-    ]);
-    // Derive AES-256-GCM key
-    return crypto.subtle.deriveKey({
-        name: 'PBKDF2',
-        salt: PBKDF2_SALT,
-        iterations: PBKDF2_ITERATIONS,
-        hash: 'SHA-256',
-    }, keyMaterial, { name: 'AES-GCM', length: 256 }, false, ['encrypt']);
+async function resolveEncryptionKey(options) {
+    const { key } = options;
+    if ((0, shared_js_1.isPassphrase)(key)) {
+        const iterations = checkGenerateIterations(options.iterations ?? shared_js_1.DEFAULT_PBKDF2_ITERATIONS);
+        const salt = (0, shared_js_1.randomBytes)(shared_js_1.SALT_LENGTH);
+        const keyBytes = await (0, shared_js_1.derivePassphraseKey)(key, salt, iterations);
+        return {
+            cryptoKey: await (0, shared_js_1.importAesKey)(keyBytes, 'encrypt'),
+            kdf: 'pbkdf2',
+            salt: (0, shared_js_1.base64UrlEncode)(salt),
+            iterations,
+        };
+    }
+    if ((0, shared_js_1.isRawKey)(key)) {
+        const resolved = await (0, shared_js_1.resolveRawKey)(key, 'encrypt');
+        if (typeof resolved === 'string') {
+            encryptionError(resolved, errors_js_1.WolsErrorCode.INVALID_KEY);
+        }
+        return { cryptoKey: resolved, kdf: 'raw' };
+    }
+    return encryptionError('key must be a passphrase string, 32 raw key bytes, or an AES-GCM CryptoKey', errors_js_1.WolsErrorCode.INVALID_KEY);
 }
 /**
- * Generate a random initialization vector
+ * AES-256-GCM encrypt UTF-8 text with a fresh IV. The tag is appended by
+ * WebCrypto. `aad` is used for field-level values only; whole labels have none.
  */
-function generateIV() {
-    const buffer = new ArrayBuffer(IV_LENGTH);
-    const iv = new Uint8Array(buffer);
-    crypto.getRandomValues(iv);
-    return { iv, ivBuffer: buffer };
+async function seal(cryptoKey, text, aad) {
+    const iv = (0, shared_js_1.randomBytes)(shared_js_1.IV_LENGTH);
+    const params = aad === undefined ? { name: 'AES-GCM', iv } : { name: 'AES-GCM', iv, additionalData: aad };
+    const ciphertext = await crypto.subtle.encrypt(params, cryptoKey, new TextEncoder().encode(text));
+    return { payload: (0, shared_js_1.base64UrlEncode)(ciphertext), iv: (0, shared_js_1.base64UrlEncode)(iv) };
+}
+/** Split `wemush:{suffix}` into its suffix, enforcing a non-empty suffix. */
+function idSuffix(id) {
+    if (typeof id !== 'string' || !id.startsWith('wemush:') || id.length === 'wemush:'.length) {
+        encryptionError(`Specimen id must be 'wemush:' followed by a non-empty suffix, got '${String(id)}'`);
+    }
+    return id.slice('wemush:'.length);
 }
 // =============================================================================
-// ENCRYPTION FUNCTIONS
+// URL SERIALIZATION
 // =============================================================================
 /**
- * Encrypt a specimen using AES-256-GCM
+ * Build the encrypted-format URL for an encrypted specimen.
  *
- * @param specimen - The specimen to encrypt
- * @param options - Encryption options (key required)
- * @returns Promise resolving to encrypted specimen wrapper
+ * Enforces the generator rules, so a hand-built object cannot produce a
+ * non-conformant label:
+ * - `payload` and `iv` are canonical unpadded base64url, the IV is 12 bytes,
+ *   and the payload is at least the 16-byte GCM tag
+ * - `kdf` is present: `pbkdf2` needs 100,000 to 2^32-1 iterations and a salt
+ *   of at least 16 bytes that is not the legacy library salt (compared as
+ *   bytes); `raw` must not carry `salt` or `iterations`
  *
- * @example
- * ```typescript
- * import { encryptSpecimen } from '@wemush/wols/crypto';
+ * Labels with more than 10,000,000 iterations are valid but exceed the
+ * decoders' default `maxIterations`, so readers must raise it.
  *
- * const encrypted = await encryptSpecimen(specimen, {
- *   key: 'my-secret-password',
- * });
- * // Returns: { encrypted: true, payload: "...", iv: "...", algorithm: "AES-256-GCM" }
- * ```
+ * @throws WolsEncryptionError when the object would produce a non-conformant
+ *   label (including legacy payloads, which are never generated)
+ * @since 1.3.0
  */
+function toEncryptedUrl(encrypted) {
+    const suffix = idSuffix(encrypted.id);
+    if (encrypted.kdf !== 'pbkdf2' && encrypted.kdf !== 'raw') {
+        encryptionError('Encrypted URLs require kdf=pbkdf2 or kdf=raw; legacy payloads are not generated');
+    }
+    if (canonicalBytes('payload', encrypted.payload).length < shared_js_1.GCM_TAG_LENGTH) {
+        encryptionError(`payload must include the ${shared_js_1.GCM_TAG_LENGTH}-byte GCM tag`);
+    }
+    if (canonicalBytes('iv', encrypted.iv).length !== shared_js_1.IV_LENGTH) {
+        encryptionError(`iv must be ${shared_js_1.IV_LENGTH} bytes`);
+    }
+    const params = [`e=${encrypted.payload}`, `iv=${encrypted.iv}`, `kdf=${encrypted.kdf}`];
+    if (encrypted.kdf === 'pbkdf2') {
+        const { salt } = encrypted;
+        if (!salt || encrypted.iterations === undefined) {
+            encryptionError('kdf=pbkdf2 requires salt and iterations');
+        }
+        const iterations = checkGenerateIterations(encrypted.iterations);
+        const saltBytes = canonicalBytes('salt', salt);
+        if (saltBytes.length < shared_js_1.SALT_LENGTH) {
+            encryptionError(`salt must be at least ${shared_js_1.SALT_LENGTH} bytes, got ${saltBytes.length}`);
+        }
+        if (bytesEqual(saltBytes, shared_js_1.LEGACY_PBKDF2_SALT)) {
+            encryptionError('The fixed pre-1.3.0 library salt must not be used to generate labels');
+        }
+        params.push(`salt=${salt}`, `i=${iterations}`);
+    }
+    else if (encrypted.salt !== undefined || encrypted.iterations !== undefined) {
+        encryptionError('kdf=raw labels must not carry salt or iterations');
+    }
+    if (encrypted.signature !== undefined) {
+        params.push(`sig=${encodeURIComponent(encrypted.signature)}`);
+    }
+    return `${shared_js_1.ENCRYPTED_URL_PREFIX}${encodeURIComponent(suffix)}?${params.join('&')}`;
+}
 async function encryptSpecimen(specimen, options) {
-    const { key, fields } = options;
-    // If partial encryption requested, handle separately
+    (0, shared_js_1.assertWebCrypto)();
+    const { fields } = options;
     if (fields !== undefined && fields.length > 0) {
-        return encryptPartial(specimen, options);
-    }
-    // Get or derive the encryption key
-    const cryptoKey = typeof key === 'string' ? await deriveKey(key) : key;
-    // Serialize the specimen to JSON
-    const plaintext = (0, specimen_js_1.serializeSpecimen)(specimen);
-    const plaintextBytes = new TextEncoder().encode(plaintext);
-    // Generate random IV
-    const { iv, ivBuffer } = generateIV();
-    // Encrypt
-    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, cryptoKey, plaintextBytes);
-    // Return encrypted specimen
-    return {
+        // Deprecated 1.2.x path: same behavior as encryptFields(). A call that
+        // passes `fields` literally is typed FieldEncryptedSpecimen by the first
+        // overload; options typed as plain EncryptionOptions keep the 1.2.x
+        // signature for source compatibility, which is why the option is deprecated.
+        const fieldOptions = {
+            key: options.key,
+            fields: fields,
+        };
+        if (options.iterations !== undefined)
+            fieldOptions.iterations = options.iterations;
+        return encryptFields(specimen, fieldOptions);
+    }
+    const id = specimen.id;
+    idSuffix(id);
+    const resolved = await resolveEncryptionKey(options);
+    const sealed = await seal(resolved.cryptoKey, (0, specimen_js_1.serializeSpecimen)(specimen));
+    const result = {
         encrypted: true,
-        payload: toBase64Url(ciphertext),
-        iv: toBase64Url(ivBuffer),
         algorithm: 'AES-256-GCM',
+        payload: sealed.payload,
+        iv: sealed.iv,
+        kdf: resolved.kdf,
+        id,
     };
+    if (resolved.salt !== undefined)
+        result.salt = resolved.salt;
+    if (resolved.iterations !== undefined)
+        result.iterations = resolved.iterations;
+    result.url = toEncryptedUrl(result);
+    return result;
 }
 /**
- * Encrypt only specific fields of a specimen
+ * Field-level encryption (WOLS v1.3.0): replace the value of each named field
+ * with an {@link EncryptedField} and leave the rest of the specimen in cleartext.
+ *
+ * One key (and, for passphrases, one random salt) per call; a fresh IV per field.
+ * Each value is bound to its label and field with AES-GCM additional data:
+ * the UTF-8 of `"{id}\n{field}"` (WOLS 1.3.0). A value moved to another field
+ * or copied into another label fails authentication. Restore with `decryptFields()`.
+ *
+ * The identifying fields (`@context`, `@type`, `id`, `version`, `type`,
+ * `species`) can't be encrypted.
+ *
+ * @param specimen - The specimen to partially encrypt
+ * @param options - `key`, `fields` (each must be present on the specimen), optional `iterations`
+ * @throws WolsEncryptionError when `fields` is empty, names a field the specimen
+ *   does not have, or names a field twice; or for an unusable key
+ *
+ * @example
+ * ```typescript
+ * const partial = await encryptFields(specimen, { key: passphrase, fields: ['strain'] });
+ * partial.species;  // still cleartext
+ * partial.strain;   // { encrypted: true, algorithm: 'AES-256-GCM', payload, iv, kdf: 'pbkdf2', salt, iterations }
+ * ```
  *
- * Returns a specimen-like object with specified fields encrypted.
+ * @since 1.3.0
  */
-async function encryptPartial(specimen, options) {
-    const { key, fields = [] } = options;
-    // Get or derive the encryption key
-    const cryptoKey = typeof key === 'string' ? await deriveKey(key) : key;
-    // Clone the specimen
-    const result = { ...specimen };
-    // Encrypt each specified field
+async function encryptFields(specimen, options) {
+    (0, shared_js_1.assertWebCrypto)();
+    const { fields } = options;
+    if (!Array.isArray(fields) || fields.length === 0) {
+        encryptionError('encryptFields requires a non-empty fields array');
+    }
+    // The AAD binds every value to the label's full id, so the id must be usable.
+    idSuffix(specimen.id);
+    const seen = new Set();
     for (const field of fields) {
-        const value = result[field];
-        if (value !== undefined) {
-            const plaintext = JSON.stringify(value);
-            const plaintextBytes = new TextEncoder().encode(plaintext);
-            const { iv, ivBuffer } = generateIV();
-            const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, cryptoKey, plaintextBytes);
-            result[field] = {
-                encrypted: true,
-                payload: toBase64Url(ciphertext),
-                iv: toBase64Url(ivBuffer),
-                algorithm: 'AES-256-GCM',
-            };
+        if (typeof field === 'string' && STRUCTURAL_FIELDS.has(field)) {
+            encryptionError(`Cannot encrypt field '${field}': it identifies the label and must stay in cleartext`);
         }
+        if (typeof field !== 'string' || !Object.hasOwn(specimen, field)) {
+            encryptionError(`Cannot encrypt field '${String(field)}': the specimen has no such field. ` +
+                'Refusing to leave it unprotected.');
+        }
+        if (specimen[field] === undefined) {
+            encryptionError(`Cannot encrypt field '${field}': its value is undefined`);
+        }
+        if (seen.has(field)) {
+            encryptionError(`Field '${field}' is listed more than once`);
+        }
+        seen.add(field);
+    }
+    const keyOptions = { key: options.key };
+    if (options.iterations !== undefined)
+        keyOptions.iterations = options.iterations;
+    const resolved = await resolveEncryptionKey(keyOptions);
+    const result = { ...specimen };
+    for (const field of fields) {
+        // Fresh IV per field; AAD = "{id}\n{field}" (WOLS 1.3.0).
+        const sealed = await seal(resolved.cryptoKey, JSON.stringify(result[field]), (0, shared_js_1.fieldAad)(specimen.id, field));
+        const encryptedField = {
+            encrypted: true,
+            algorithm: 'AES-256-GCM',
+            payload: sealed.payload,
+            iv: sealed.iv,
+            kdf: resolved.kdf,
+        };
+        if (resolved.salt !== undefined)
+            encryptedField.salt = resolved.salt;
+        if (resolved.iterations !== undefined)
+            encryptedField.iterations = resolved.iterations;
+        result[field] = encryptedField;
     }
-    // Cast to EncryptedSpecimen for return type consistency
-    // In partial mode, this is actually a hybrid object
     return result;
 }
+// =============================================================================
+// TYPE GUARDS
+// =============================================================================
+function hasCipherShape(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        value['encrypted'] === true &&
+        typeof value['payload'] === 'string' &&
+        typeof value['iv'] === 'string');
+}
 /**
- * Type guard to check if an object is an encrypted specimen
+ * Whether a value is a field-level {@link EncryptedField}: an encrypted value
+ * with a `kdf` and no specimen `id` or `url`.
+ *
+ * The 1.3.0 shapes are told apart structurally: whole-label objects produced
+ * by `encryptSpecimen` and `parseEncryptedUrl` always carry `id`, and field
+ * values never do. Legacy (pre-1.3.0) values have no `kdf` and are reported
+ * as {@link isEncryptedSpecimen}, whether they were whole labels or fields.
+ * `decryptFields` handles legacy field values regardless (with `allowLegacy`).
+ *
+ * @since 1.3.0
+ */
+function isEncryptedField(value) {
+    return (hasCipherShape(value) &&
+        (value['kdf'] === 'pbkdf2' || value['kdf'] === 'raw') &&
+        value['id'] === undefined &&
+        value['url'] === undefined);
+}
+/**
+ * Whether a value is a whole-label {@link EncryptedSpecimen} (v1.3.0 or legacy).
+ *
+ * @since 1.3.0
+ */
+function isEncryptedSpecimen(value) {
+    return hasCipherShape(value) && !isEncryptedField(value);
+}
+/**
+ * Whether a value carries the `encrypted: true` marker: either a whole-label
+ * {@link EncryptedSpecimen} or a field-level {@link EncryptedField}. Use
+ * {@link isEncryptedSpecimen} or {@link isEncryptedField} to tell them apart.
+ *
+ * @since 1.3.0 Narrows to `EncryptedSpecimen | EncryptedField`
  */
 function isEncrypted(value) {
-    if (value === null || value === undefined) {
-        return false;
-    }
-    if (typeof value !== 'object') {
+    if (value === null || value === undefined || typeof value !== 'object') {
         return false;
     }
-    const obj = value;
-    return obj['encrypted'] === true;
+    return value['encrypted'] === true;
 }
 //# sourceMappingURL=encrypt.js.map