effect 4.0.7 → 4.1.0

package/dist/crypto/KeyWrap.js

@@ -0,0 +1,381 @@
+/**
+ * Key wrapping: AES-KW (RFC 3394) and RSA-OAEP (RFC 8017).
+ *
+ * The {@link KeyWrap} service generates AES-KW keys and RSA-OAEP key pairs,
+ * wraps keys, and unwraps them. The top-level {@link key},
+ * {@link fromCryptoKey}, {@link privateKeyFromCryptoKey},
+ * {@link publicKeyFromCryptoKey}, and {@link toBytes} functions build and
+ * export keys without a service.
+ *
+ * `wrap` takes an `Aead`, `Cipher`, `Mac`, or `KeyWrap` key, never raw bytes,
+ * which keeps RSA-OAEP limited to key transport. `unwrap` returns a typed key
+ * of the algorithm it is given.
+ *
+ * A key-encryption key is the key most worth keeping non-extractable, so in
+ * browsers {@link fromCryptoKey} is the main way to build one.
+ *
+ * Keys are opaque. They hold either bytes or a `CryptoKey`, display only their
+ * algorithm, and compare by reference. The bytes are the AES-KW key, and
+ * PKCS#8 or SPKI DER for RSA-OAEP.
+ *
+ * **Gotchas**
+ *
+ * - AES-KW wraps keys whose length is a multiple of 8 bytes and at least 16
+ *   bytes. Other lengths fail with an `InvalidArgument` reason.
+ * - RSA-OAEP key generation and encryption use WebCrypto's own randomness and
+ *   cannot be seeded through `SecureRandom`.
+ * - Safari rejects RSA-OAEP keys over 4096 bits.
+ *
+ * @stability unstable
+ * @since 4.0.0
+ */
+import * as Context from "../Context.js";
+import * as Effect from "../Effect.js";
+import * as Layer from "../Layer.js";
+import * as Predicate from "../Predicate.js";
+import * as Aead from "./Aead.js";
+import * as Cipher from "./Cipher.js";
+import * as CryptoError from "./CryptoError.js";
+import * as Digest from "./Digest.js";
+import * as Asymmetric from "./internal/asymmetric.js";
+import * as KeyModel from "./internal/key.js";
+import * as internal from "./internal/webCrypto.js";
+import * as Mac from "./Mac.js";
+import * as SecureRandom from "./SecureRandom.js";
+import { WebCrypto } from "./WebCrypto.js";
+const KeyTypeId = "~effect/crypto/KeyWrap/Key";
+const PrivateKeyTypeId = "~effect/crypto/KeyWrap/PrivateKey";
+const PublicKeyTypeId = "~effect/crypto/KeyWrap/PublicKey";
+/**
+ * AES-128-KW (JOSE A128KW), with a 16-byte key.
+ *
+ * @stability unstable
+ * @category algorithms
+ * @since 4.0.0
+ */
+export const aes128Kw = {
+  _tag: "AesKw",
+  name: "aes128Kw",
+  keyLength: 16
+};
+/**
+ * AES-256-KW (JOSE A256KW), with a 32-byte key.
+ *
+ * @stability unstable
+ * @category algorithms
+ * @since 4.0.0
+ */
+export const aes256Kw = {
+  _tag: "AesKw",
+  name: "aes256Kw",
+  keyLength: 32
+};
+/**
+ * Builds an RSA-OAEP algorithm for a hash and a modulus length in bits.
+ *
+ * **Details**
+ *
+ * MGF1 uses the same hash. There is no OAEP label.
+ *
+ * @stability unstable
+ * @category algorithms
+ * @since 4.0.0
+ */
+export const rsaOaep = options => ({
+  _tag: "RsaOaep",
+  name: `rsaOaep${Digest.nameSuffix(options.hash)}`,
+  hash: options.hash,
+  modulusLength: options.modulusLength
+});
+/**
+ * RSA-OAEP with SHA-256 (JOSE RSA-OAEP-256), generating 3072-bit keys. This is
+ * the default RSA-OAEP algorithm.
+ *
+ * @stability unstable
+ * @category algorithms
+ * @since 4.0.0
+ */
+export const rsaOaepSha256 = /*#__PURE__*/rsaOaep({
+  hash: Digest.sha256,
+  modulusLength: 3072
+});
+/**
+ * RSA-OAEP with SHA-1 (JOSE RSA-OAEP), generating 3072-bit keys.
+ *
+ * **When to use**
+ *
+ * Use to interoperate with JOSE `RSA-OAEP`. Otherwise prefer
+ * {@link rsaOaepSha256}.
+ *
+ * @stability unstable
+ * @category algorithms
+ * @since 4.0.0
+ */
+export const rsaOaepSha1 = /*#__PURE__*/rsaOaep({
+  hash: Digest.sha1,
+  modulusLength: 3072
+});
+const KeyProto = /*#__PURE__*/KeyModel.redactedProto(KeyTypeId, "KeyWrap.Key");
+const PrivateKeyProto = /*#__PURE__*/KeyModel.redactedProto(PrivateKeyTypeId, "KeyWrap.PrivateKey");
+const PublicKeyProto = /*#__PURE__*/KeyModel.redactedProto(PublicKeyTypeId, "KeyWrap.PublicKey");
+/**
+ * Checks whether a value is an AES-KW {@link Key}.
+ *
+ * @stability unstable
+ * @category guards
+ * @since 4.0.0
+ */
+export const isKey = u => Predicate.hasProperty(u, KeyTypeId);
+/**
+ * Checks whether a value is an RSA-OAEP {@link PrivateKey}.
+ *
+ * @stability unstable
+ * @category guards
+ * @since 4.0.0
+ */
+export const isPrivateKey = u => Predicate.hasProperty(u, PrivateKeyTypeId);
+/**
+ * Checks whether a value is an RSA-OAEP {@link PublicKey}.
+ *
+ * @stability unstable
+ * @category guards
+ * @since 4.0.0
+ */
+export const isPublicKey = u => Predicate.hasProperty(u, PublicKeyTypeId);
+const specOf = algorithm => ({
+  name: "RSA-OAEP",
+  importParams: {
+    name: "RSA-OAEP",
+    hash: algorithm.hash.name
+  },
+  privateUsages: ["decrypt"],
+  publicUsages: ["encrypt"],
+  seedPrefix: undefined,
+  publicFormat: "spki",
+  check: Asymmetric.checkHash(algorithm.hash.name)
+});
+/** @internal */
+export const family = {
+  module: "KeyWrap",
+  specOf,
+  privateKeyProto: PrivateKeyProto,
+  publicKeyProto: PublicKeyProto,
+  isPrivateKey
+};
+/** @internal */
+export const secretFamily = algorithm => "nonceLength" in algorithm ? Aead : "mode" in algorithm ? Cipher : "_tag" in algorithm ? {
+  key,
+  toBytes
+} : Mac;
+// AES-KW in WebCrypto only wraps `CryptoKey`s, so the key bytes go through a
+// temporary extractable HMAC key, which imports any non-empty length.
+const hmacParams = {
+  name: "HMAC",
+  hash: "SHA-256"
+};
+const rsaOaepParams = {
+  name: "RSA-OAEP"
+};
+const invalidArgument = description => new internal.Failure(new CryptoError.InvalidArgument({
+  description
+}));
+// RFC 8017, section 7.1.1: the message fits the modulus minus two hashes and
+// two bytes.
+const checkOaepLength = (algorithm, cryptoKey, length) => {
+  const modulusLength = cryptoKey.algorithm.modulusLength;
+  const max = Math.ceil(modulusLength / 8) - 2 * algorithm.hash.outputLength - 2;
+  if (length > max) {
+    throw invalidArgument(`A ${modulusLength}-bit RSA-OAEP key with ${algorithm.hash.name} wraps at most ${max} bytes, not ${length}`);
+  }
+};
+// RFC 3394, section 2: keys are at least two 64-bit blocks, and the wrapped
+// form adds one block.
+const checkKwLength = (length, overhead) => {
+  if (length % 8 !== 0 || length < 16 + overhead) {
+    throw invalidArgument(`AES-KW needs a multiple of 8 bytes and at least ${16 + overhead} bytes, not ${length}`);
+  }
+};
+/**
+ * Service that generates keys, wraps keys, and unwraps them.
+ *
+ * **Example** (Wrapping an AES-GCM key with AES-KW)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect, Layer } from "effect"
+ * import { Aead, KeyWrap, SecureRandom } from "effect/crypto"
+ *
+ * const program = Effect.gen(function*() {
+ *   const keyWrap = yield* KeyWrap.KeyWrap
+ *   const kek = yield* keyWrap.generateKey(KeyWrap.aes256Kw)
+ *   const key = yield* Aead.key(Aead.aes256Gcm, new Uint8Array(32))
+ *   const wrapped = yield* keyWrap.wrap(kek, key)
+ *   const unwrapped = yield* keyWrap.unwrap(kek, Aead.aes256Gcm, wrapped)
+ *   return [wrapped.length, unwrapped.algorithm.name]
+ * })
+ *
+ * const layer = KeyWrap.layerWebCrypto.pipe(Layer.provide(SecureRandom.layerWebCrypto))
+ * await Effect.runPromise(program.pipe(Effect.provide(layer))) // => [40, "aes256Gcm"]
+ * ```
+ *
+ * @stability unstable
+ * @category services
+ * @since 4.0.0
+ */
+export class KeyWrap extends /*#__PURE__*/Context.Service()("effect/crypto/KeyWrap") {}
+/**
+ * Layer that provides `KeyWrap` on the `WebCrypto` reference.
+ *
+ * **Details**
+ *
+ * The layer imports a byte-backed key on first use and caches the
+ * `CryptoKey`. AES-KW keys come from `SecureRandom`, so a seeded
+ * `SecureRandom` reproduces them.
+ *
+ * WebCrypto's AES-KW only wraps `CryptoKey`s, so the layer imports the target
+ * bytes as a temporary extractable HMAC key and wraps that. RSA-OAEP uses
+ * `encrypt` and `decrypt` when the key allows them, and otherwise the same
+ * route through `wrapKey` and `unwrapKey`. Both give the same ciphertext.
+ *
+ * @stability unstable
+ * @category layers
+ * @since 4.0.0
+ */
+export const layerWebCrypto = /*#__PURE__*/Layer.effect(KeyWrap, /*#__PURE__*/Effect.gen(function* () {
+  const random = yield* SecureRandom.SecureRandom;
+  const crypto = yield* WebCrypto;
+  const kwCryptoKey = KeyModel.makeCache((subtle, bytes) => subtle.importKey("raw", bytes, "AES-KW", false, ["wrapKey", "unwrapKey"]));
+  const caches = Asymmetric.makeCaches(family);
+  const wrapBytes = (wrapKey, bytes) => internal.run("KeyWrap", "wrap", wrapKey.algorithm.name, crypto, async subtle => {
+    if (isKey(wrapKey)) {
+      checkKwLength(bytes.length, 0);
+      const kek = await kwCryptoKey(subtle, wrapKey);
+      const target = await subtle.importKey("raw", bytes, hmacParams, true, ["sign"]);
+      return new Uint8Array(await subtle.wrapKey("raw", target, kek, "AES-KW"));
+    }
+    const publicKey = await caches.publicKey(subtle, wrapKey);
+    checkOaepLength(wrapKey.algorithm, publicKey, bytes.length);
+    if (publicKey.usages.includes("encrypt")) {
+      return new Uint8Array(await subtle.encrypt(rsaOaepParams, publicKey, bytes));
+    }
+    const target = await subtle.importKey("raw", bytes, hmacParams, true, ["sign"]);
+    return new Uint8Array(await subtle.wrapKey("raw", target, publicKey, rsaOaepParams));
+  });
+  const unwrapBytes = (unwrapKey, wrapped) => internal.run("KeyWrap", "unwrap", unwrapKey.algorithm.name, crypto, async subtle => {
+    if (isKey(unwrapKey)) {
+      checkKwLength(wrapped.length, 8);
+      const kek = await kwCryptoKey(subtle, unwrapKey);
+      const target = await subtle.unwrapKey("raw", wrapped, kek, "AES-KW", hmacParams, true, ["sign"]);
+      return KeyModel.exportRaw(subtle, target);
+    }
+    const privateKey = await caches.privateKey(subtle, unwrapKey);
+    if (privateKey.usages.includes("decrypt")) {
+      return new Uint8Array(await subtle.decrypt(rsaOaepParams, privateKey, wrapped));
+    }
+    const target = await subtle.unwrapKey("raw", wrapped, privateKey, rsaOaepParams, hmacParams, true, ["sign"]);
+    return KeyModel.exportRaw(subtle, target);
+  }, cause => internal.webCryptoError("KeyWrap", "unwrap", unwrapKey.algorithm.name, cause, () => new CryptoError.DecryptionFailed()));
+  return KeyWrap.of({
+    generateKey: algorithm => Effect.map(random.randomBytes(algorithm.keyLength), bytes => KeyModel.makeBytes(KeyProto, algorithm, bytes)),
+    generateKeyPair: algorithm => Asymmetric.generateKeyPair(family, crypto, random, algorithm, Asymmetric.rsaGenerateParams(specOf(algorithm), algorithm.modulusLength)),
+    wrap: (wrapKey, key) => Effect.suspend(() => {
+      const stored = KeyModel.material(key);
+      if (stored._tag === "CryptoKey" && !stored.cryptoKey.extractable) {
+        return internal.notExtractable("KeyWrap", "wrap");
+      }
+      return secretFamily(key.algorithm).toBytes(key).pipe(Effect.catch(internal.rehome("KeyWrap", "wrap")), Effect.flatMap(bytes => wrapBytes(wrapKey, bytes)));
+    }),
+    unwrap: (unwrapKey, algorithm, wrapped) => Effect.flatMap(unwrapBytes(unwrapKey, wrapped), bytes => secretFamily(algorithm).key(algorithm, bytes).pipe(Effect.catch(internal.rehome("KeyWrap", "unwrap"))))
+  });
+}));
+/**
+ * Builds an AES-KW key from its bytes.
+ *
+ * **Details**
+ *
+ * The bytes are copied. A length other than the algorithm's key length fails
+ * with an `InvalidKey` reason. RSA-OAEP keys have no raw form, so passing
+ * them is a type error.
+ *
+ * @stability unstable
+ * @category constructors
+ * @since 4.0.0
+ */
+export const key = (algorithm, bytes) => KeyModel.fromBytes("KeyWrap", "key", KeyProto, algorithm, bytes, KeyModel.checkKeyLength(algorithm));
+/**
+ * Builds an AES-KW key from an existing `CryptoKey`, such as a
+ * non-extractable one.
+ *
+ * **Details**
+ *
+ * The `CryptoKey` must be a secret AES-KW key of the algorithm's length with
+ * both the `wrapKey` and `unwrapKey` usages, since a key reaches both
+ * operations. Otherwise the constructor fails with an `InvalidKey` reason. It
+ * must come from the `Crypto` object of the `WebCrypto` reference.
+ *
+ * @stability unstable
+ * @category constructors
+ * @since 4.0.0
+ */
+export const fromCryptoKey = (algorithm, cryptoKey) => KeyModel.fromCryptoKey("KeyWrap", "fromCryptoKey", KeyProto, algorithm, cryptoKey, {
+  type: "secret",
+  name: "AES-KW",
+  usages: ["wrapKey", "unwrapKey"],
+  usagePolicy: "all",
+  check: KeyModel.checkAesLength("AES-KW", algorithm.keyLength)
+});
+// RSA-OAEP keys need one usage the layer can use for the key's role, since
+// `wrapKey` and `encrypt` produce the same ciphertext.
+const rsaFromCryptoKey = (method, proto, algorithm, role, cryptoKey) => KeyModel.fromCryptoKey("KeyWrap", method, proto, algorithm, cryptoKey, {
+  type: role,
+  name: "RSA-OAEP",
+  usages: role === "private" ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"],
+  usagePolicy: "any",
+  check: Asymmetric.checkHash(algorithm.hash.name)
+});
+/**
+ * Builds an RSA-OAEP private key from an existing `CryptoKey`, such as a
+ * non-extractable one.
+ *
+ * **Details**
+ *
+ * The `CryptoKey` must be an RSA-OAEP private key with the algorithm's hash
+ * and the `decrypt` or `unwrapKey` usage. Otherwise the constructor fails
+ * with an `InvalidKey` reason. The modulus length is not checked. The key must
+ * come from the `Crypto` object of the `WebCrypto` reference.
+ *
+ * @stability unstable
+ * @category constructors
+ * @since 4.0.0
+ */
+export const privateKeyFromCryptoKey = (algorithm, cryptoKey) => rsaFromCryptoKey("privateKeyFromCryptoKey", PrivateKeyProto, algorithm, "private", cryptoKey);
+/**
+ * Builds an RSA-OAEP public key from an existing `CryptoKey`.
+ *
+ * **Details**
+ *
+ * The `CryptoKey` must be an RSA-OAEP public key with the algorithm's hash and
+ * the `encrypt` or `wrapKey` usage. Otherwise the constructor fails with an
+ * `InvalidKey` reason. The key must come from the `Crypto` object of the
+ * `WebCrypto` reference.
+ *
+ * @stability unstable
+ * @category constructors
+ * @since 4.0.0
+ */
+export const publicKeyFromCryptoKey = (algorithm, cryptoKey) => rsaFromCryptoKey("publicKeyFromCryptoKey", PublicKeyProto, algorithm, "public", cryptoKey);
+/**
+ * Exports a key's stored bytes.
+ *
+ * **Details**
+ *
+ * Returns a fresh `Uint8Array`: the AES-KW key, or PKCS#8 or SPKI DER for
+ * RSA-OAEP. A `CryptoKey`-backed key is exported on the `WebCrypto`
+ * reference, and fails with a `NotExtractable` reason when the `CryptoKey` is
+ * not extractable.
+ *
+ * @stability unstable
+ * @category converting
+ * @since 4.0.0
+ */
+export const toBytes = key => isKey(key) ? KeyModel.toBytes("KeyWrap", key, KeyModel.exportRaw) : Asymmetric.toBytes(family, key);
+//# sourceMappingURL=KeyWrap.js.map

package/dist/crypto/KeyWrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyWrap.js","names":[],"sources":["../../src/crypto/KeyWrap.ts"],"sourcesContent":[null],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,OAAO,KAAK,OAAO,MAAM,eAAe;AACxC,OAAO,KAAK,MAAM,MAAM,cAAc;AAEtC,OAAO,KAAK,KAAK,MAAM,aAAa;AACpC,OAAO,KAAK,SAAS,MAAM,iBAAiB;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW;AACjC,OAAO,KAAK,MAAM,MAAM,aAAa;AACrC,OAAO,KAAK,WAAW,MAAM,kBAAkB;AAC/C,OAAO,KAAK,MAAM,MAAM,aAAa;AACrC,OAAO,KAAK,UAAU,MAAM,0BAA0B;AACtD,OAAO,KAAK,QAAQ,MAAM,mBAAmB;AAC7C,OAAO,KAAK,QAAQ,MAAM,yBAAyB;AAEnD,OAAO,KAAK,GAAG,MAAM,UAAU;AAC/B,OAAO,KAAK,YAAY,MAAM,mBAAmB;AACjD,SAAS,SAAS,QAAQ,gBAAgB;AAE1C,MAAM,SAAS,GAAG,4BAAqC;AACvD,MAAM,gBAAgB,GAAG,mCAA4C;AACrE,MAAM,eAAe,GAAG,kCAA2C;AAgDnE;;;;;;;AAOA,OAAO,MAAM,QAAQ,GAAU;EAAE,IAAI,EAAE,OAAO;EAAE,IAAI,EAAE,UAAU;EAAE,SAAS,EAAE;AAAE,CAAE;AAEjF;;;;;;;AAOA,OAAO,MAAM,QAAQ,GAAU;EAAE,IAAI,EAAE,OAAO;EAAE,IAAI,EAAE,UAAU;EAAE,SAAS,EAAE;AAAE,CAAE;AAEjF;;;;;;;;;;;AAWA,OAAO,MAAM,OAAO,GAAI,OAGvB,KAAe;EACd,IAAI,EAAE,SAAS;EACf,IAAI,EAAE,UAAU,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;EACjD,IAAI,EAAE,OAAO,CAAC,IAAI;EAClB,aAAa,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;;;;;AAQA,OAAO,MAAM,aAAa,gBAAY,OAAO,CAAC;EAAE,IAAI,EAAE,MAAM,CAAC,MAAM;EAAE,aAAa,EAAE;AAAI,CAAE,CAAC;AAE3F;;;;;;;;;;;;AAYA,OAAO,MAAM,WAAW,gBAAY,OAAO,CAAC;EAAE,IAAI,EAAE,MAAM,CAAC,IAAI;EAAE,aAAa,EAAE;AAAI,CAAE,CAAC;AA2FvF,MAAM,QAAQ,gBAAG,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC;AACjE,MAAM,eAAe,gBAAG,QAAQ,CAAC,aAAa,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;AACtF,MAAM,cAAc,gBAAG,QAAQ,CAAC,aAAa,CAAC,eAAe,EAAE,mBAAmB,CAAC;AAEnF;;;;;;;AAOA,OAAO,MAAM,KAAK,GAAI,CAAU,IAAe,SAAS,CAAC,WAAW,CAAC,CAAC,EAAE,SAAS,CAAC;AAElF;;;;;;;AAOA,OAAO,MAAM,YAAY,GAAI,CAAU,IAAsB,SAAS,CAAC,WAAW,CAAC,CAAC,EAAE,gBAAgB,CAAC;AAEvG;;;;;;;AAOA,OAAO,MAAM,WAAW,GAAI,CAAU,IAAqB,SAAS,CAAC,WAAW,CAAC,CAAC,EAAE,eAAe,CAAC;AAEpG,MAAM,MAAM,GAAI,SAAkB,KAAuB;EACvD,IAAI,EAAE,UAAU;EAChB,YAAY,EAAE;IAAE,IAAI,EAAE,UAAU;IAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC;EAAI,CAAE;EAC7D,aAAa,EAAE,CAAC,SAAS,CAAC;EAC1B,YAAY,EAAE,CAAC,SAAS,CAAC;EACzB,UAAU,EAAE,SAAS;EACrB,YAAY,EAAE,MAAM;EACpB,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI;CAChD,CAAC;AAEF;AACA,OAAO,MAAM,MAAM,GAAsB;EACvC,MAAM,EAAE,SAAS;EACjB,MAAM;EACN,eAAe,EAAE,eAAe;EAChC,cAAc,EAAE,cAAc;EAC9B;CACD;AAaD;AACA,OAAO,MAAM,YAAY,GAAI,SAAoC,IAC/D,aAAa,IAAI,SAAS,GAAG,IAAI,GAAG,MAAM,IAAI,SAAS,GAAG,MAAM,GAAG,MAAM,IAAI,SAAS,GAAG;EAAE,GAAG;EAAE;AAAO,CAAE,GAAG,GAAG;AAEjH;AACA;AACA,MAAM,UAAU,GAAqB;EAAE,IAAI,EAAE,MAAM;EAAE,IAAI,EAAE;AAAS,CAAE;AAEtE,MAAM,aAAa,GAAkB;EAAE,IAAI,EAAE;AAAU,CAAE;AAEzD,MAAM,eAAe,GAAI,WAAmB,IAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,eAAe,CAAC;EAAE;AAAW,CAAE,CAAC,CAAC;AAEvH;AACA;AACA,MAAM,eAAe,GAAG,CAAC,SAAkB,EAAE,SAAoB,EAAE,MAAc,KAAI;EACnF,MAAM,aAAa,GAAI,SAAS,CAAC,SAAmC,CAAC,aAAa;EAClF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC;EAC9E,IAAI,MAAM,GAAG,GAAG,EAAE;IAChB,MAAM,eAAe,CACnB,KAAK,aAAa,0BAA0B,SAAS,CAAC,IAAI,CAAC,IAAI,kBAAkB,GAAG,eAAe,MAAM,EAAE,CAC5G;EACH;AACF,CAAC;AAED;AACA;AACA,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,QAAgB,KAAI;EACzD,IAAI,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE;IAC9C,MAAM,eAAe,CAAC,mDAAmD,EAAE,GAAG,QAAQ,eAAe,MAAM,EAAE,CAAC;EAChH;AACF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,OAAM,MAAO,OAAQ,sBAAQ,OAAO,CAAC,OAAO,EA0BxC,CAAC,uBAAuB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;AAkBA,OAAO,MAAM,cAAc,gBAA2D,KAAK,CAAC,MAAM,CAChG,OAAO,eACP,MAAM,CAAC,GAAG,CAAC,aAAS;EAClB,MAAM,MAAM,GAAG,OAAO,YAAY,CAAC,YAAY;EAC/C,MAAM,MAAM,GAAG,OAAO,SAAS;EAC/B,MAAM,WAAW,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,KAAK,KACnD,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAqB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAC1F;EACD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;EAE5C,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAE,KAAiB,KACpD,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAO,MAAM,IAAI;IAC/E,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE;MAClB,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;MAC9B,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC;MAC9C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAqB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;MAC/F,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3E;IACA,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC;IACzD,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC;IAC3D,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;MACxC,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,EAAE,KAAqB,CAAC,CAAC;IAC9F;IACA,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAqB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;IAC/F,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;EACtF,CAAC,CAAC;EAEJ,MAAM,WAAW,GAAG,CAAC,SAAoB,EAAE,OAAmB,KAC5D,QAAQ,CAAC,GAAG,CACV,SAAS,EACT,QAAQ,EACR,SAAS,CAAC,SAAS,CAAC,IAAI,EACxB,MAAM,EACN,MAAO,MAAM,IAAI;IACf,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE;MACpB,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;MAChC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC;MAChD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAuB,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,CACrG,MAAM,CACP,CAAC;MACF,OAAO,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;IAC3C;IACA,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC;IAC7D,IAAI,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;MACzC,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,OAAuB,CAAC,CAAC;IACjG;IACA,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CACnC,KAAK,EACL,OAAuB,EACvB,UAAU,EACV,aAAa,EACb,UAAU,EACV,IAAI,EACJ,CAAC,MAAM,CAAC,CACT;IACD,OAAO,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;EAC3C,CAAC,EACA,KAAK,IACJ,QAAQ,CAAC,cAAc,CACrB,SAAS,EACT,QAAQ,EACR,SAAS,CAAC,SAAS,CAAC,IAAI,EACxB,KAAK,EACL,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,CACzC,CACJ;EAEH,OAAO,OAAO,CAAC,EAAE,CAAC;IAChB,WAAW,EAAoB,SAAY,IACzC,MAAM,CAAC,GAAG,CACR,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,EACtC,KAAK,IAAK,QAAQ,CAAC,SAAS,CAAS,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAClE;IACH,eAAe,EAAsB,SAAY,IAC/C,UAAU,CAAC,eAAe,CACxB,MAAM,EACN,MAAM,EACN,MAAM,EACN,SAAS,EACT,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,aAAa,CAAC,CACzE;IACH,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,KACjB,MAAM,CAAC,OAAO,CAAC,MAAK;MAClB,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;MACrC,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;QAChE,OAAO,QAAQ,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC;MACnD;MACA,OAAO,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAClD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,EAChD,MAAM,CAAC,OAAO,CAAE,KAAK,IAAK,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CACrD;IACH,CAAC,CAAC;IACJ,MAAM,EAAE,CAAsC,SAAoB,EAAE,SAAY,EAAE,OAAmB,KACnG,MAAM,CAAC,OAAO,CACZ,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,EAC9B,KAAK,IACJ,YAAY,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,IAAI,CAChD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CACe;GAE1E,CAAC;AACJ,CAAC,CAAC,CACH;AAED;;;;;;;;;;;;;AAaA,OAAO,MAAM,GAAG,GAAG,CACjB,SAAY,EACZ,KAAiB,KAEjB,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;AAEtG;;;;;;;;;;;;;;;AAeA,OAAO,MAAM,aAAa,GAAG,CAC3B,SAAY,EACZ,SAAoB,KAEpB,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE;EACjF,IAAI,EAAE,QAAQ;EACd,IAAI,EAAE,QAAQ;EACd,MAAM,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC;EAChC,WAAW,EAAE,KAAK;EAClB,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS;CAC7D,CAAC;AAEJ;AACA;AACA,MAAM,gBAAgB,GAAG,CACvB,MAAc,EACd,KAAa,EACb,SAAkB,EAClB,IAAqB,EACrB,SAAoB,KAEpB,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE;EACrE,IAAI,EAAE,IAAI;EACV,IAAI,EAAE,UAAU;EAChB,MAAM,EAAE,IAAI,KAAK,SAAS,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC;EAC9E,WAAW,EAAE,KAAK;EAClB,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI;CAChD,CAAC;AAEJ;;;;;;;;;;;;;;;AAeA,OAAO,MAAM,uBAAuB,GAAG,CACrC,SAAY,EACZ,SAAoB,KAEpB,gBAAgB,CAAC,yBAAyB,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;AAE/F;;;;;;;;;;;;;;AAcA,OAAO,MAAM,sBAAsB,GAAG,CACpC,SAAY,EACZ,SAAoB,KAEpB,gBAAgB,CAAC,wBAAwB,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;AAE5F;;;;;;;;;;;;;;AAcA,OAAO,MAAM,OAAO,GAAI,GAAiC,IACvD,KAAK,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC","ignoreList":[]}

package/dist/crypto/Mac.d.ts

@@ -0,0 +1,277 @@
+/**
+ * Message authentication codes: HMAC with SHA-1, SHA-256, SHA-384, or
+ * SHA-512.
+ *
+ * The {@link Mac} service generates keys, signs data, and verifies tags. The
+ * top-level {@link key}, {@link fromCryptoKey}, and {@link toBytes} functions
+ * build and export keys without a service, and {@link timingSafeEqual}
+ * compares byte arrays in constant time.
+ *
+ * Keys are opaque. They hold either key bytes or a `CryptoKey`, display only
+ * their algorithm, and compare by reference.
+ *
+ * @stability unstable
+ * @since 4.0.0
+ */
+import * as Context from "../Context.ts";
+import * as Effect from "../Effect.ts";
+import type { Inspectable } from "../Inspectable.ts";
+import * as Layer from "../Layer.ts";
+import type * as CryptoError from "./CryptoError.ts";
+import * as Digest from "./Digest.ts";
+import * as SecureRandom from "./SecureRandom.ts";
+declare const TypeId: "~effect/crypto/Mac/Key";
+/**
+ * An HMAC algorithm, such as {@link hmacSha256}.
+ *
+ * **Details**
+ *
+ * `hash` is the digest the HMAC is built on.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.0.0
+ */
+export interface Algorithm {
+    readonly name: "hmacSha1" | "hmacSha256" | "hmacSha384" | "hmacSha512";
+    readonly hash: Digest.Algorithm;
+}
+/**
+ * HMAC with SHA-1, with a 20-byte tag.
+ *
+ * **Gotchas**
+ *
+ * HMAC-SHA-1 is still secure as a MAC, but use it only for interoperability
+ * with existing protocols.
+ *
+ * @stability unstable
+ * @category algorithms
+ * @since 4.0.0
+ */
+export declare const hmacSha1: Algorithm;
+/**
+ * HMAC with SHA-256, with a 32-byte tag.
+ *
+ * @stability unstable
+ * @category algorithms
+ * @since 4.0.0
+ */
+export declare const hmacSha256: Algorithm;
+/**
+ * HMAC with SHA-384, with a 48-byte tag.
+ *
+ * @stability unstable
+ * @category algorithms
+ * @since 4.0.0
+ */
+export declare const hmacSha384: Algorithm;
+/**
+ * HMAC with SHA-512, with a 64-byte tag.
+ *
+ * @stability unstable
+ * @category algorithms
+ * @since 4.0.0
+ */
+export declare const hmacSha512: Algorithm;
+/**
+ * An opaque HMAC key for the algorithm `A`.
+ *
+ * **Details**
+ *
+ * The key holds either key bytes or a `CryptoKey` from {@link fromCryptoKey}.
+ * `toString`, `toJSON`, and `inspect` show only the algorithm. Keys compare
+ * by reference and do not implement `Equal`, because comparing key bytes is
+ * not constant time.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.0.0
+ */
+export interface Key<out A extends Algorithm = Algorithm> extends Inspectable {
+    readonly [TypeId]: typeof TypeId;
+    readonly algorithm: A;
+}
+/**
+ * Checks whether a value is a {@link Key}.
+ *
+ * @stability unstable
+ * @category guards
+ * @since 4.0.0
+ */
+export declare const isKey: (u: unknown) => u is Key;
+declare const Mac_base: Context.ServiceClass<Mac, "effect/crypto/Mac", {
+    /**
+     * Generates a random key of the hash's block size from `SecureRandom`
+     * bytes.
+     */
+    readonly generateKey: <A extends Algorithm>(algorithm: A) => Effect.Effect<Key<A>, CryptoError.CryptoError>;
+    /**
+     * Computes the tag of `data`.
+     */
+    readonly sign: (key: Key, data: Uint8Array) => Effect.Effect<Uint8Array, CryptoError.CryptoError>;
+    /**
+     * Checks `tag` against the tag of `data` in constant time. A wrong tag, or
+     * a tag of the wrong length, returns `false`.
+     */
+    readonly verify: (key: Key, tag: Uint8Array, data: Uint8Array) => Effect.Effect<boolean, CryptoError.CryptoError>;
+}>;
+/**
+ * Service that generates HMAC keys, signs data, and verifies tags.
+ *
+ * **Example** (Signing and verifying a message)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect, Layer } from "effect"
+ * import { Mac, SecureRandom } from "effect/crypto"
+ *
+ * const program = Effect.gen(function*() {
+ *   const mac = yield* Mac.Mac
+ *   const key = yield* mac.generateKey(Mac.hmacSha256)
+ *   const data = new TextEncoder().encode("message")
+ *   const tag = yield* mac.sign(key, data)
+ *   return yield* mac.verify(key, tag, data)
+ * })
+ *
+ * const layer = Mac.layerWebCrypto.pipe(Layer.provide(SecureRandom.layerWebCrypto))
+ * const valid = await Effect.runPromise(program.pipe(Effect.provide(layer)))
+ * valid // => true
+ * ```
+ *
+ * @stability unstable
+ * @category services
+ * @since 4.0.0
+ */
+export declare class Mac extends Mac_base {
+}
+/**
+ * Builds a `Mac` layer on the `WebCrypto` reference that can sign and verify
+ * byte-backed keys with a synchronous HMAC primitive.
+ *
+ * **When to use**
+ *
+ * Use to run HMAC on a runtime's native code, as `NodeCrypto.layerMac` does
+ * with `createHmac` from `node:crypto`.
+ *
+ * **Details**
+ *
+ * `hmac` receives the hash name, the key bytes, and the data, and returns the
+ * tag. It runs only for byte-backed keys. `CryptoKey`-backed keys run on
+ * `crypto.subtle`, and generated keys come from `SecureRandom`, as in
+ * {@link layerWebCrypto}. `verify` computes the tag with `hmac` and compares
+ * it with {@link timingSafeEqual}. Without `hmac`, the layer is
+ * {@link layerWebCrypto}.
+ *
+ * **Gotchas**
+ *
+ * `hmac` receives the key's own bytes, not a copy, so it must not modify or
+ * keep them.
+ *
+ * **Example** (Signing with a native HMAC)
+ *
+ * ```ts
+ * import { Layer } from "effect"
+ * import { Mac, SecureRandom } from "effect/crypto"
+ *
+ * declare const nativeHmac: (hash: string, key: Uint8Array, data: Uint8Array) => Uint8Array
+ *
+ * const layer = Mac.layerWebCryptoWith({ hmac: nativeHmac }).pipe(
+ *   Layer.provide(SecureRandom.layerWebCrypto)
+ * )
+ * ```
+ *
+ * @stability unstable
+ * @category layers
+ * @since 4.0.0
+ */
+export declare const layerWebCryptoWith: (options: {
+    readonly hmac?: ((hash: Digest.Algorithm["name"], key: Uint8Array, data: Uint8Array) => Uint8Array) | undefined;
+}) => Layer.Layer<Mac, never, SecureRandom.SecureRandom>;
+/**
+ * Layer that provides `Mac` on the `WebCrypto` reference.
+ *
+ * **Details**
+ *
+ * Signing and verification run on `crypto.subtle`. The layer imports a
+ * byte-backed key on first use and caches the `CryptoKey`. Generated keys come
+ * from `SecureRandom`, so a seeded `SecureRandom` gives reproducible keys.
+ *
+ * @stability unstable
+ * @category layers
+ * @since 4.0.0
+ */
+export declare const layerWebCrypto: Layer.Layer<Mac, never, SecureRandom.SecureRandom>;
+/**
+ * Builds a key from raw key bytes.
+ *
+ * **Details**
+ *
+ * The bytes are copied into a new `Uint8Array`, so later changes to the input,
+ * including a Node.js `Buffer`, do not reach the key. Any non-empty length is
+ * accepted; RFC 2104 recommends at least the hash's output length. An empty key
+ * fails with an `InvalidKey` reason.
+ *
+ * @stability unstable
+ * @category constructors
+ * @since 4.0.0
+ */
+export declare const key: <A extends Algorithm>(algorithm: A, bytes: Uint8Array) => Effect.Effect<Key<A>, CryptoError.CryptoError>;
+/**
+ * Builds a key from an existing `CryptoKey`, such as a non-extractable one.
+ *
+ * **Details**
+ *
+ * The `CryptoKey` must be a secret HMAC key with the algorithm's hash and both
+ * the `sign` and `verify` usages, since a key reaches both operations.
+ * Otherwise the constructor fails with an `InvalidKey` reason. It must come
+ * from the `Crypto` object of the `WebCrypto` reference.
+ *
+ * @stability unstable
+ * @category constructors
+ * @since 4.0.0
+ */
+export declare const fromCryptoKey: <A extends Algorithm>(algorithm: A, cryptoKey: CryptoKey) => Effect.Effect<Key<A>, CryptoError.CryptoError>;
+/**
+ * Exports a key's bytes.
+ *
+ * **Details**
+ *
+ * Returns a fresh `Uint8Array` that shares no memory with the key. A
+ * `CryptoKey`-backed key is exported on the `WebCrypto` reference, and fails
+ * with a `NotExtractable` reason when the `CryptoKey` is not extractable.
+ *
+ * @stability unstable
+ * @category converting
+ * @since 4.0.0
+ */
+export declare const toBytes: (key: Key) => Effect.Effect<Uint8Array, CryptoError.CryptoError>;
+/**
+ * Compares two byte arrays in constant time.
+ *
+ * **When to use**
+ *
+ * Use to compare secrets of a fixed, known length, such as tags computed
+ * outside {@link Mac}. To check an HMAC tag, use `Mac.verify`.
+ *
+ * **Gotchas**
+ *
+ * Arrays of different lengths return `false` immediately, revealing their
+ * lengths. Equal-length arrays are compared with an XOR-accumulate loop;
+ * JavaScript runtimes do not guarantee constant-time execution.
+ *
+ * **Example** (Comparing fixed-length secrets)
+ *
+ * ```ts import.meta.vitest
+ * import { Mac } from "effect/crypto"
+ *
+ * const expected = new Uint8Array([1, 2, 3])
+ * const received = new Uint8Array([1, 2, 3])
+ * Mac.timingSafeEqual(expected, received) // => true
+ * ```
+ *
+ * @stability unstable
+ * @category utils
+ * @since 4.0.0
+ */
+export declare const timingSafeEqual: (a: Uint8Array, b: Uint8Array) => boolean;
+export {};
+//# sourceMappingURL=Mac.d.ts.map

package/dist/crypto/Mac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Mac.d.ts","sourceRoot":"","sources":["../../src/crypto/Mac.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,OAAO,MAAM,eAAe,CAAA;AACxC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,KAAK,KAAK,MAAM,aAAa,CAAA;AAEpC,OAAO,KAAK,KAAK,WAAW,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAGrC,OAAO,KAAK,YAAY,MAAM,mBAAmB,CAAA;AAGjD,QAAA,MAAM,MAAM,EAAG,wBAAiC,CAAA;AAEhD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,YAAY,CAAA;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAA;CAChC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,QAAQ,EAAE,SAAmD,CAAA;AAE1E;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,EAAE,SAAuD,CAAA;AAEhF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,EAAE,SAAuD,CAAA;AAEhF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,EAAE,SAAuD,CAAA;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,CAAE,SAAQ,WAAW;IAC3E,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,MAAM,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;CACtB;AAID;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,MAAO,OAAO,KAAG,CAAC,IAAI,GAAuC,CAAA;;IAsC7E;;;OAGG;0BACmB,CAAC,CAAC,SAAS,SAAS,EAAE,SAAS,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC;IAC3G;;OAEG;mBACY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,WAAW,CAAC;IACjG;;;OAGG;qBACc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,WAAW,CAAC;;AAxCnH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,GAAI,SAAQ,QAeA;CAAG;AAI5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,eAAO,MAAM,kBAAkB,YAAa;IAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,KAAK,UAAU,CAAC,GAAG,SAAS,CAAA;CAChH,KAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,YAAY,CAmDlD,CAAA;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,YAAY,CAA0B,CAAA;AAExG;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,SAAS,SAAS,aAC1B,CAAC,SACL,UAAU,KAChB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,WAAW,CAQ7C,CAAA;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,SAAS,SAAS,aACpC,CAAC,aACD,SAAS,KACnB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,WAAW,CAU5C,CAAA;AAEJ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,OAAO,QAAS,GAAG,KAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,WAAW,CAClC,CAAA;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,eAAe,MAAO,UAAU,KAAK,UAAU,KAAG,OAK9D,CAAA"}