crewly 1.2.3 → 1.2.6

package/dist/backend/backend/src/services/cloud/relay-client.service.js

@@ -0,0 +1,392 @@
+/**
+ * Relay Client Service
+ *
+ * WebSocket client that connects to a Relay Server for inter-node
+ * communication when direct connections are unavailable (NAT/firewall).
+ *
+ * Flow: Node A (Agent) <-> Cloud (Relay) <-> Node B (Orchestrator)
+ *
+ * Features:
+ * - Automatic fallback from direct connection to relay mode
+ * - End-to-end encryption (E2EE) — relay never sees plaintext
+ * - Heartbeat keep-alive with auto-reconnection
+ * - Exponential backoff on reconnection failures
+ *
+ * @module services/cloud/relay-client.service
+ */
+import WebSocket from 'ws';
+import { EventEmitter } from 'events';
+import { LoggerService } from '../core/logger.service.js';
+import { CLOUD_CONSTANTS } from '../../constants.js';
+import { isRelayMessage, } from './relay.types.js';
+import { deriveKey, generateSalt, encrypt, decrypt, serializeEnvelope, deserializeEnvelope, } from './relay-crypto.service.js';
+const RELAY = CLOUD_CONSTANTS.RELAY;
+// ---------------------------------------------------------------------------
+// Service
+// ---------------------------------------------------------------------------
+/**
+ * RelayClientService singleton.
+ *
+ * Manages a WebSocket connection to a relay server, handles registration,
+ * heartbeats, reconnection, and encrypts/decrypts messages for E2EE.
+ */
+export class RelayClientService extends EventEmitter {
+    static instance = null;
+    logger;
+    /** Current WebSocket connection */
+    ws = null;
+    /** Client configuration (set via connect()) */
+    config = null;
+    /** Current connection state */
+    state = 'disconnected';
+    /** Assigned session ID after registration */
+    sessionId = null;
+    /** Heartbeat interval timer */
+    heartbeatInterval = null;
+    /** Reconnection attempt counter */
+    reconnectAttempts = 0;
+    /** Reconnection timer */
+    reconnectTimer = null;
+    /** Derived encryption key */
+    encryptionKey = null;
+    /** Salt for key derivation (exchanged as part of pairing code) */
+    salt = null;
+    /** Whether disconnect was intentional (skip reconnect) */
+    intentionalDisconnect = false;
+    constructor() {
+        super();
+        this.logger = LoggerService.getInstance().createComponentLogger('RelayClientService');
+    }
+    /**
+     * Get the singleton instance.
+     *
+     * @returns RelayClientService instance
+     */
+    static getInstance() {
+        if (!RelayClientService.instance) {
+            RelayClientService.instance = new RelayClientService();
+        }
+        return RelayClientService.instance;
+    }
+    /**
+     * Reset the singleton (for testing).
+     */
+    static resetInstance() {
+        if (RelayClientService.instance) {
+            RelayClientService.instance.disconnect();
+            RelayClientService.instance.removeAllListeners();
+        }
+        RelayClientService.instance = null;
+    }
+    // -------------------------------------------------------------------------
+    // Public API
+    // -------------------------------------------------------------------------
+    /**
+     * Connect to a relay server.
+     *
+     * Establishes the WebSocket connection, sends a register message,
+     * and derives the E2EE encryption key from the shared secret.
+     *
+     * @param config - Relay client configuration
+     *
+     * @example
+     * ```ts
+     * const client = RelayClientService.getInstance();
+     * client.connect({
+     *   wsUrl: 'ws://cloud.crewly.dev:8787/relay',
+     *   pairingCode: 'abc-123',
+     *   role: 'agent',
+     *   token: 'sk-xxx',
+     *   sharedSecret: 'team-secret',
+     * });
+     * client.on('message', (plaintext) => console.log(plaintext));
+     * ```
+     */
+    connect(config) {
+        if (this.state !== 'disconnected' && this.state !== 'error') {
+            this.logger.warn('Already connected or connecting — disconnect first');
+            return;
+        }
+        this.config = config;
+        this.intentionalDisconnect = false;
+        this.reconnectAttempts = 0;
+        // Derive encryption key from shared secret
+        this.salt = generateSalt();
+        this.encryptionKey = deriveKey(config.sharedSecret, this.salt);
+        this.doConnect();
+    }
+    /**
+     * Disconnect from the relay server.
+     *
+     * Closes the WebSocket cleanly and stops heartbeats and reconnection.
+     */
+    disconnect() {
+        this.intentionalDisconnect = true;
+        this.cleanup();
+        this.setState('disconnected');
+    }
+    /**
+     * Send an encrypted message to the paired peer via the relay.
+     *
+     * The message is encrypted locally before being sent — the relay
+     * server only forwards the opaque ciphertext.
+     *
+     * @param plaintext - Message content to send
+     * @throws Error if not in paired state or encryption key is not available
+     *
+     * @example
+     * ```ts
+     * client.send('Hello from agent node!');
+     * ```
+     */
+    send(plaintext) {
+        if (this.state !== 'paired') {
+            throw new Error(`Cannot send — client is in "${this.state}" state, must be "paired"`);
+        }
+        if (!this.encryptionKey) {
+            throw new Error('Encryption key not derived — cannot send');
+        }
+        const envelope = encrypt(plaintext, this.encryptionKey);
+        const payload = serializeEnvelope(envelope);
+        const msg = { type: 'relay', payload };
+        this.sendRaw(msg);
+    }
+    /**
+     * Get the current client state.
+     *
+     * @returns Current RelayClientState
+     */
+    getState() {
+        return this.state;
+    }
+    /**
+     * Get the assigned session ID (available after registration).
+     *
+     * @returns Session ID or null if not registered
+     */
+    getSessionId() {
+        return this.sessionId;
+    }
+    // -------------------------------------------------------------------------
+    // Connection lifecycle
+    // -------------------------------------------------------------------------
+    /**
+     * Establish the WebSocket connection and set up handlers.
+     */
+    doConnect() {
+        if (!this.config)
+            return;
+        this.setState('connecting');
+        this.logger.info('Connecting to relay server', { wsUrl: this.config.wsUrl });
+        try {
+            this.ws = new WebSocket(this.config.wsUrl, {
+                handshakeTimeout: RELAY.HANDSHAKE_TIMEOUT_MS,
+            });
+        }
+        catch (err) {
+            this.logger.error('Failed to create WebSocket', {
+                error: err instanceof Error ? err.message : String(err),
+            });
+            this.setState('error');
+            this.scheduleReconnect();
+            return;
+        }
+        this.ws.on('open', () => {
+            this.logger.info('WebSocket connected, sending registration');
+            this.reconnectAttempts = 0;
+            this.sendRegister();
+        });
+        this.ws.on('message', (data) => {
+            this.handleMessage(data);
+        });
+        this.ws.on('close', (code, reason) => {
+            this.logger.info('WebSocket closed', { code, reason: reason.toString('utf8') });
+            this.cleanup();
+            if (!this.intentionalDisconnect) {
+                this.setState('disconnected');
+                this.scheduleReconnect();
+            }
+        });
+        this.ws.on('error', (err) => {
+            this.logger.error('WebSocket error', { error: err.message });
+            this.emit('error', err);
+        });
+    }
+    /**
+     * Send the registration message to the relay server.
+     */
+    sendRegister() {
+        if (!this.config)
+            return;
+        const msg = {
+            type: 'register',
+            role: this.config.role,
+            pairingCode: this.config.pairingCode,
+            token: this.config.token,
+        };
+        this.sendRaw(msg);
+    }
+    /**
+     * Handle an incoming WebSocket message.
+     *
+     * @param data - Raw message data
+     */
+    handleMessage(data) {
+        const raw = typeof data === 'string' ? data : data.toString('utf8');
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            this.logger.error('Received invalid JSON from relay');
+            return;
+        }
+        if (!isRelayMessage(parsed)) {
+            this.logger.warn('Received unknown message type from relay');
+            return;
+        }
+        const msg = parsed;
+        switch (msg.type) {
+            case 'registered':
+                this.sessionId = msg.sessionId;
+                this.setState('registered');
+                this.startHeartbeat();
+                this.logger.info('Registered with relay', { sessionId: msg.sessionId });
+                break;
+            case 'paired':
+                this.setState('paired');
+                this.logger.info('Paired with peer', { peerSessionId: msg.peerSessionId, peerRole: msg.peerRole });
+                this.emit('paired', msg.peerSessionId, msg.peerRole);
+                break;
+            case 'relay':
+                this.handleRelayData(msg);
+                break;
+            case 'heartbeat_ack':
+                // Heartbeat acknowledged — no action needed
+                break;
+            case 'peer_disconnected':
+                this.setState('registered');
+                this.logger.info('Peer disconnected', { peerSessionId: msg.peerSessionId });
+                this.emit('peerDisconnected', msg.peerSessionId);
+                break;
+            case 'error':
+                this.logger.error('Relay server error', { code: msg.code, message: msg.message });
+                this.emit('error', new Error(`Relay error [${msg.code}]: ${msg.message}`));
+                break;
+            default:
+                this.logger.warn('Unhandled relay message type', { type: msg.type });
+        }
+    }
+    /**
+     * Handle an incoming relay data message by decrypting the payload.
+     *
+     * @param msg - Relay data message with encrypted payload
+     */
+    handleRelayData(msg) {
+        if (!this.encryptionKey) {
+            this.logger.error('Cannot decrypt — no encryption key');
+            return;
+        }
+        try {
+            const envelope = deserializeEnvelope(msg.payload);
+            const plaintext = decrypt(envelope, this.encryptionKey);
+            this.emit('message', plaintext);
+        }
+        catch (err) {
+            this.logger.error('Failed to decrypt relay message', {
+                error: err instanceof Error ? err.message : String(err),
+            });
+            this.emit('error', new Error('Failed to decrypt relay message'));
+        }
+    }
+    // -------------------------------------------------------------------------
+    // Heartbeat
+    // -------------------------------------------------------------------------
+    /**
+     * Start the heartbeat interval to keep the connection alive.
+     */
+    startHeartbeat() {
+        this.stopHeartbeat();
+        this.heartbeatInterval = setInterval(() => {
+            const msg = { type: 'heartbeat' };
+            this.sendRaw(msg);
+        }, RELAY.HEARTBEAT_INTERVAL_MS);
+    }
+    /**
+     * Stop the heartbeat interval.
+     */
+    stopHeartbeat() {
+        if (this.heartbeatInterval) {
+            clearInterval(this.heartbeatInterval);
+            this.heartbeatInterval = null;
+        }
+    }
+    // -------------------------------------------------------------------------
+    // Reconnection
+    // -------------------------------------------------------------------------
+    /**
+     * Schedule a reconnection attempt with exponential backoff.
+     */
+    scheduleReconnect() {
+        if (this.intentionalDisconnect)
+            return;
+        if (this.reconnectAttempts >= RELAY.MAX_RECONNECT_ATTEMPTS) {
+            this.logger.error('Max reconnection attempts reached — giving up');
+            this.setState('error');
+            return;
+        }
+        const delay = Math.min(RELAY.RECONNECT_BASE_DELAY_MS * Math.pow(2, this.reconnectAttempts), RELAY.RECONNECT_MAX_DELAY_MS);
+        this.reconnectAttempts++;
+        this.logger.info('Scheduling reconnection', {
+            attempt: this.reconnectAttempts,
+            delayMs: delay,
+        });
+        this.reconnectTimer = setTimeout(() => {
+            this.reconnectTimer = null;
+            this.doConnect();
+        }, delay);
+    }
+    // -------------------------------------------------------------------------
+    // Helpers
+    // -------------------------------------------------------------------------
+    /**
+     * Send a raw relay message over the WebSocket.
+     *
+     * @param message - Relay message to send
+     */
+    sendRaw(message) {
+        if (this.ws && this.ws.readyState === WebSocket.OPEN) {
+            this.ws.send(JSON.stringify(message));
+        }
+    }
+    /**
+     * Update the client state and emit a stateChange event.
+     *
+     * @param newState - New state
+     */
+    setState(newState) {
+        if (this.state !== newState) {
+            this.state = newState;
+            this.emit('stateChange', newState);
+        }
+    }
+    /**
+     * Clean up timers and close the WebSocket connection.
+     */
+    cleanup() {
+        this.stopHeartbeat();
+        if (this.reconnectTimer) {
+            clearTimeout(this.reconnectTimer);
+            this.reconnectTimer = null;
+        }
+        if (this.ws) {
+            this.ws.removeAllListeners();
+            if (this.ws.readyState === WebSocket.OPEN || this.ws.readyState === WebSocket.CONNECTING) {
+                this.ws.close(1000, 'Client disconnecting');
+            }
+            this.ws = null;
+        }
+        this.sessionId = null;
+    }
+}
+//# sourceMappingURL=relay-client.service.js.map

package/dist/backend/backend/src/services/cloud/relay-client.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-client.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/cloud/relay-client.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,aAAa,EAAwB,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,cAAc,GAQf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,OAAO,EACP,OAAO,EACP,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC;AAmBpC,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,OAAO,kBAAmB,SAAQ,YAAY;IAC1C,MAAM,CAAC,QAAQ,GAA8B,IAAI,CAAC;IACzC,MAAM,CAAkB;IAEzC,mCAAmC;IAC3B,EAAE,GAAqB,IAAI,CAAC;IACpC,+CAA+C;IACvC,MAAM,GAA6B,IAAI,CAAC;IAChD,+BAA+B;IACvB,KAAK,GAAqB,cAAc,CAAC;IACjD,6CAA6C;IACrC,SAAS,GAA0B,IAAI,CAAC;IAChD,+BAA+B;IACvB,iBAAiB,GAA0C,IAAI,CAAC;IACxE,mCAAmC;IAC3B,iBAAiB,GAAG,CAAC,CAAC;IAC9B,yBAAyB;IACjB,cAAc,GAAyC,IAAI,CAAC;IACpE,6BAA6B;IACrB,aAAa,GAAkB,IAAI,CAAC;IAC5C,kEAAkE;IAC1D,IAAI,GAAkB,IAAI,CAAC;IACnC,0DAA0D;IAClD,qBAAqB,GAAG,KAAK,CAAC;IAEtC;QACE,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IACxF,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,WAAW;QAChB,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,CAAC;YACjC,kBAAkB,CAAC,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,kBAAkB,CAAC,QAAQ,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,aAAa;QAClB,IAAI,kBAAkB,CAAC,QAAQ,EAAE,CAAC;YAChC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YACzC,kBAAkB,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC;QACnD,CAAC;QACD,kBAAkB,CAAC,QAAQ,GAAG,IAAI,CAAC;IACrC,CAAC;IAED,4EAA4E;IAC5E,aAAa;IACb,4EAA4E;IAE5E;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,MAAyB;QAC/B,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,qBAAqB,GAAG,KAAK,CAAC;QACnC,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC;QAE3B,2CAA2C;QAC3C,IAAI,CAAC,IAAI,GAAG,YAAY,EAAE,CAAC;QAC3B,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/D,IAAI,CAAC,SAAS,EAAE,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,UAAU;QACR,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,SAAiB;QACpB,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,KAAK,2BAA2B,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAE5C,MAAM,GAAG,GAAqB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACzD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,4EAA4E;IAC5E,uBAAuB;IACvB,4EAA4E;IAE5E;;OAEG;IACK,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QAEzB,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAE7E,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;gBACzC,gBAAgB,EAAE,KAAK,CAAC,oBAAoB;aAC7C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBAC9C,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACvB,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC9D,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAqB,EAAE,EAAE;YAC9C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAY,EAAE,MAAc,EAAE,EAAE;YACnD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChF,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAChC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;gBAC9B,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QAEzB,MAAM,GAAG,GAAyB;YAChC,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACpC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;SACzB,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,IAAqB;QACzC,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEpE,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAiB,MAAM,CAAC;QAEjC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,YAAY;gBACf,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;gBAC/B,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAC5B,IAAI,CAAC,cAAc,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;gBACxE,MAAM;YAER,KAAK,QAAQ;gBACX,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACnG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACrD,MAAM;YAER,KAAK,OAAO;gBACV,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;gBAC1B,MAAM;YAER,KAAK,eAAe;gBAClB,4CAA4C;gBAC5C,MAAM;YAER,KAAK,mBAAmB;gBACtB,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;gBAC5E,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBACjD,MAAM;YAER,KAAK,OAAO;gBACV,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC3E,MAAM;YAER;gBACE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,IAAI,EAAG,GAAoB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,eAAe,CAAC,GAAqB;QAC3C,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBACnD,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,YAAY;IACZ,4EAA4E;IAE5E;;OAEG;IACK,cAAc;QACpB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE;YACxC,MAAM,GAAG,GAA0B,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACzD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACK,aAAa;QACnB,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACtC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAChC,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,eAAe;IACf,4EAA4E;IAE5E;;OAEG;IACK,iBAAiB;QACvB,IAAI,IAAI,CAAC,qBAAqB;YAAE,OAAO;QACvC,IAAI,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,EACnE,KAAK,CAAC,sBAAsB,CAC7B,CAAC;QAEF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAC1C,OAAO,EAAE,IAAI,CAAC,iBAAiB;YAC/B,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;YACpC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAED,4EAA4E;IAC5E,UAAU;IACV,4EAA4E;IAE5E;;;;OAIG;IACK,OAAO,CAAC,OAAqB;QACnC,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YACrD,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,QAAQ,CAAC,QAA0B;QACzC,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,OAAO;QACb,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;QAED,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,EAAE,CAAC;gBACzF,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;QACjB,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC"}

package/dist/backend/backend/src/services/cloud/relay-crypto.service.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Relay Crypto Service
+ *
+ * Provides end-to-end encryption (E2EE) for relay message payloads.
+ * Uses AES-256-GCM with keys derived via PBKDF2 from a shared secret.
+ *
+ * The relay server only forwards opaque encrypted blobs — it never
+ * has access to the derived key or plaintext content.
+ *
+ * @module services/cloud/relay-crypto.service
+ */
+import type { EncryptedEnvelope } from './relay.types.js';
+/**
+ * Derive a 256-bit AES key from a shared secret and salt using PBKDF2.
+ *
+ * Both peers must use the same shared secret and salt to produce
+ * the same key. The salt prevents rainbow table attacks.
+ *
+ * @param sharedSecret - Pre-shared secret string known to both peers
+ * @param salt - Salt buffer (should be exchanged or agreed upon)
+ * @returns 32-byte derived key buffer
+ *
+ * @example
+ * ```ts
+ * const key = deriveKey('my-secret', salt);
+ * ```
+ */
+export declare function deriveKey(sharedSecret: string, salt: Buffer): Buffer;
+/**
+ * Generate a random salt for key derivation.
+ *
+ * @returns 16-byte random salt buffer
+ */
+export declare function generateSalt(): Buffer;
+/**
+ * Encrypt a plaintext string into an EncryptedEnvelope using AES-256-GCM.
+ *
+ * Produces a random IV per encryption to ensure semantic security.
+ * The returned envelope contains base64-encoded IV, ciphertext, and auth tag.
+ *
+ * @param plaintext - Data to encrypt (will be treated as UTF-8)
+ * @param key - 32-byte AES key (from deriveKey)
+ * @returns EncryptedEnvelope with base64 fields
+ * @throws Error if key length is invalid
+ *
+ * @example
+ * ```ts
+ * const envelope = encrypt('hello world', key);
+ * // { iv: '...', ciphertext: '...', authTag: '...' }
+ * ```
+ */
+export declare function encrypt(plaintext: string, key: Buffer): EncryptedEnvelope;
+/**
+ * Decrypt an EncryptedEnvelope back to plaintext using AES-256-GCM.
+ *
+ * Verifies the authentication tag to ensure message integrity.
+ *
+ * @param envelope - Encrypted envelope with base64 fields
+ * @param key - 32-byte AES key (same key used for encryption)
+ * @returns Decrypted plaintext string
+ * @throws Error if decryption fails (wrong key, tampered data, or invalid envelope)
+ *
+ * @example
+ * ```ts
+ * const plaintext = decrypt(envelope, key);
+ * ```
+ */
+export declare function decrypt(envelope: EncryptedEnvelope, key: Buffer): string;
+/**
+ * Serialize an EncryptedEnvelope to a base64 string for wire transport.
+ *
+ * The relay protocol sends a single base64 payload field. This function
+ * packs the envelope into a JSON string and then base64-encodes it.
+ *
+ * @param envelope - Encrypted envelope to serialize
+ * @returns Base64-encoded string
+ */
+export declare function serializeEnvelope(envelope: EncryptedEnvelope): string;
+/**
+ * Deserialize a base64 wire payload back to an EncryptedEnvelope.
+ *
+ * @param payload - Base64-encoded string from the relay wire message
+ * @returns Parsed EncryptedEnvelope
+ * @throws Error if the payload is not valid base64 or does not contain valid envelope fields
+ */
+export declare function deserializeEnvelope(payload: string): EncryptedEnvelope;
+//# sourceMappingURL=relay-crypto.service.d.ts.map

package/dist/backend/backend/src/services/cloud/relay-crypto.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-crypto.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/cloud/relay-crypto.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAI1D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAQpE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAsBzE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAqBxE;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAErE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,CAetE"}

package/dist/backend/backend/src/services/cloud/relay-crypto.service.js

@@ -0,0 +1,140 @@
+/**
+ * Relay Crypto Service
+ *
+ * Provides end-to-end encryption (E2EE) for relay message payloads.
+ * Uses AES-256-GCM with keys derived via PBKDF2 from a shared secret.
+ *
+ * The relay server only forwards opaque encrypted blobs — it never
+ * has access to the derived key or plaintext content.
+ *
+ * @module services/cloud/relay-crypto.service
+ */
+import { randomBytes, createCipheriv, createDecipheriv, pbkdf2Sync } from 'crypto';
+import { CLOUD_CONSTANTS } from '../../constants.js';
+const RELAY = CLOUD_CONSTANTS.RELAY;
+/**
+ * Derive a 256-bit AES key from a shared secret and salt using PBKDF2.
+ *
+ * Both peers must use the same shared secret and salt to produce
+ * the same key. The salt prevents rainbow table attacks.
+ *
+ * @param sharedSecret - Pre-shared secret string known to both peers
+ * @param salt - Salt buffer (should be exchanged or agreed upon)
+ * @returns 32-byte derived key buffer
+ *
+ * @example
+ * ```ts
+ * const key = deriveKey('my-secret', salt);
+ * ```
+ */
+export function deriveKey(sharedSecret, salt) {
+    return pbkdf2Sync(sharedSecret, salt, RELAY.KEY_DERIVATION_ITERATIONS, RELAY.KEY_LENGTH, 'sha256');
+}
+/**
+ * Generate a random salt for key derivation.
+ *
+ * @returns 16-byte random salt buffer
+ */
+export function generateSalt() {
+    return randomBytes(16);
+}
+/**
+ * Encrypt a plaintext string into an EncryptedEnvelope using AES-256-GCM.
+ *
+ * Produces a random IV per encryption to ensure semantic security.
+ * The returned envelope contains base64-encoded IV, ciphertext, and auth tag.
+ *
+ * @param plaintext - Data to encrypt (will be treated as UTF-8)
+ * @param key - 32-byte AES key (from deriveKey)
+ * @returns EncryptedEnvelope with base64 fields
+ * @throws Error if key length is invalid
+ *
+ * @example
+ * ```ts
+ * const envelope = encrypt('hello world', key);
+ * // { iv: '...', ciphertext: '...', authTag: '...' }
+ * ```
+ */
+export function encrypt(plaintext, key) {
+    if (key.length !== RELAY.KEY_LENGTH) {
+        throw new Error(`Invalid key length: expected ${RELAY.KEY_LENGTH} bytes, got ${key.length}`);
+    }
+    const iv = randomBytes(RELAY.IV_LENGTH);
+    const cipher = createCipheriv(RELAY.CIPHER_ALGORITHM, key, iv, {
+        authTagLength: RELAY.AUTH_TAG_LENGTH,
+    });
+    const encrypted = Buffer.concat([
+        cipher.update(plaintext, 'utf8'),
+        cipher.final(),
+    ]);
+    const authTag = cipher.getAuthTag();
+    return {
+        iv: iv.toString('base64'),
+        ciphertext: encrypted.toString('base64'),
+        authTag: authTag.toString('base64'),
+    };
+}
+/**
+ * Decrypt an EncryptedEnvelope back to plaintext using AES-256-GCM.
+ *
+ * Verifies the authentication tag to ensure message integrity.
+ *
+ * @param envelope - Encrypted envelope with base64 fields
+ * @param key - 32-byte AES key (same key used for encryption)
+ * @returns Decrypted plaintext string
+ * @throws Error if decryption fails (wrong key, tampered data, or invalid envelope)
+ *
+ * @example
+ * ```ts
+ * const plaintext = decrypt(envelope, key);
+ * ```
+ */
+export function decrypt(envelope, key) {
+    if (key.length !== RELAY.KEY_LENGTH) {
+        throw new Error(`Invalid key length: expected ${RELAY.KEY_LENGTH} bytes, got ${key.length}`);
+    }
+    const iv = Buffer.from(envelope.iv, 'base64');
+    const ciphertext = Buffer.from(envelope.ciphertext, 'base64');
+    const authTag = Buffer.from(envelope.authTag, 'base64');
+    const decipher = createDecipheriv(RELAY.CIPHER_ALGORITHM, key, iv, {
+        authTagLength: RELAY.AUTH_TAG_LENGTH,
+    });
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([
+        decipher.update(ciphertext),
+        decipher.final(),
+    ]);
+    return decrypted.toString('utf8');
+}
+/**
+ * Serialize an EncryptedEnvelope to a base64 string for wire transport.
+ *
+ * The relay protocol sends a single base64 payload field. This function
+ * packs the envelope into a JSON string and then base64-encodes it.
+ *
+ * @param envelope - Encrypted envelope to serialize
+ * @returns Base64-encoded string
+ */
+export function serializeEnvelope(envelope) {
+    return Buffer.from(JSON.stringify(envelope)).toString('base64');
+}
+/**
+ * Deserialize a base64 wire payload back to an EncryptedEnvelope.
+ *
+ * @param payload - Base64-encoded string from the relay wire message
+ * @returns Parsed EncryptedEnvelope
+ * @throws Error if the payload is not valid base64 or does not contain valid envelope fields
+ */
+export function deserializeEnvelope(payload) {
+    const json = Buffer.from(payload, 'base64').toString('utf8');
+    const parsed = JSON.parse(json);
+    if (typeof parsed !== 'object' ||
+        parsed === null ||
+        typeof parsed['iv'] !== 'string' ||
+        typeof parsed['ciphertext'] !== 'string' ||
+        typeof parsed['authTag'] !== 'string') {
+        throw new Error('Invalid encrypted envelope format');
+    }
+    return parsed;
+}
+//# sourceMappingURL=relay-crypto.service.js.map

package/dist/backend/backend/src/services/cloud/relay-crypto.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-crypto.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/cloud/relay-crypto.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC;AAEpC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,SAAS,CAAC,YAAoB,EAAE,IAAY;IAC1D,OAAO,UAAU,CACf,YAAY,EACZ,IAAI,EACJ,KAAK,CAAC,yBAAyB,EAC/B,KAAK,CAAC,UAAU,EAChB,QAAQ,CACT,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,GAAW;IACpD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,CAAC,UAAU,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,EAAE,EAAE,EAAE;QAC7D,aAAa,EAAE,KAAK,CAAC,eAAe;KACrC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,OAAO,CAAC,QAA2B,EAAE,GAAW;IAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,CAAC,UAAU,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,EAAE,EAAE,EAAE;QACjE,aAAa,EAAE,KAAK,CAAC,eAAe;KACrC,CAAC,CAAC;IAEH,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA2B;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEzC,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACf,OAAQ,MAAkC,CAAC,IAAI,CAAC,KAAK,QAAQ;QAC7D,OAAQ,MAAkC,CAAC,YAAY,CAAC,KAAK,QAAQ;QACrE,OAAQ,MAAkC,CAAC,SAAS,CAAC,KAAK,QAAQ,EAClE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,MAA2B,CAAC;AACrC,CAAC"}