internxt-crypto 1.1.0 → 1.2.0

package/dist/email-crypto.d.mts

@@ -56,6 +56,20 @@ declare function decryptPwdProtectedEmail(encryptedEmail: PwdProtectedEmail, pas
  * @returns The user's private and public keys
  */
 declare function generateEmailKeys(): Promise<HybridKeyPair>;
+/**
+ * Derives database encryption key for the given user
+ *
+ * @param mnemonic - The user's mnemonic (machine-generated with secure PRNG)
+ * @returns The symmetric key for protecting database
+ */
+declare const deriveDatabaseKey: (mnemonic: string) => Promise<Uint8Array>;
+/**
+ * Derives email draft encryption key for the given user
+ *
+ * @param mnemonic - The user's mnemonic (machine-generated with secure PRNG)
+ * @returns The symmetric key for protecting email drafts
+ */
+declare const deriveEmailDraftKey: (mnemonic: string) => Promise<Uint8Array>;
 //#endregion
 //#region src/email-crypto/core.d.ts
 /**
@@ -120,5 +134,5 @@ declare function passwordProtectKey(emailEncryptionKey: Uint8Array, password: st
  */
 declare function removePasswordProtection(emailEncryptionKey: PwdProtectedKey, password: string): Promise<Uint8Array>;
 //#endregion
-export { createPwdProtectedEmail, decryptEmailBody, decryptEmailHybrid, decryptKeysHybrid, decryptPwdProtectedEmail, encryptEmailBody, encryptEmailBodyWithKey, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, encryptKeysHybrid, generateEmailKeys, passwordProtectKey, removePasswordProtection };
+export { createPwdProtectedEmail, decryptEmailBody, decryptEmailHybrid, decryptKeysHybrid, decryptPwdProtectedEmail, deriveDatabaseKey, deriveEmailDraftKey, encryptEmailBody, encryptEmailBodyWithKey, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, encryptKeysHybrid, generateEmailKeys, passwordProtectKey, removePasswordProtection };
 //# sourceMappingURL=email-crypto.d.mts.map

package/dist/email-crypto.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"email-crypto.d.mts","names":[],"sources":["../src/email-crypto/hybridEncyptedEmail.ts","../src/email-crypto/pwdProtectedEmail.ts","../src/email-crypto/emailKeys.ts","../src/email-crypto/core.ts"],"mappings":";;;;;AAWA;;;;;;iBAAsB,kBAAA,CACpB,IAAA,EAAM,SAAA,EACN,SAAA,EAAW,sBAAA,EACX,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,oBAAA;;;;;;;;;iBAkBW,uCAAA,CACpB,IAAA,EAAM,SAAA,EACN,UAAA,EAAY,sBAAA,IACZ,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,oBAAA;;;;;AAJX;;;;iBA8BsB,kBAAA,CACpB,YAAA,EAAc,oBAAA,EACd,0BAAA,EAA4B,UAAA,EAC5B,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;AAxDX;;;;;;iBCAsB,uBAAA,CACpB,SAAA,EAAW,SAAA,EACX,QAAA,UACA,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,iBAAA;;;;;;;;;iBAmBW,wBAAA,CACpB,cAAA,EAAgB,iBAAA,EAChB,QAAA,UACA,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;AD3BX;;;iBEHsB,iBAAA,CAAA,GAAqB,OAAA,CAAQ,aAAA;;;;;AFGnD;;;;;iBGGsB,gBAAA,CACpB,IAAA,EAAM,SAAA,EACN,GAAA,GAAM,UAAA,GACL,OAAA;EACD,YAAA,EAAc,kBAAA;EACd,aAAA,EAAe,UAAA;AAAA;;;;;;;;;iBAuBK,uBAAA,CACpB,IAAA,EAAM,SAAA,EACN,aAAA,EAAe,UAAA,EACf,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,kBAAA;;;AHbX;;;;;;iBG8CsB,gBAAA,CACpB,YAAA,EAAc,kBAAA,EACd,aAAA,EAAe,UAAA,EACf,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;;;;iBA8BW,iBAAA,CACpB,kBAAA,EAAoB,UAAA,EACpB,SAAA,EAAW,sBAAA,GACV,OAAA,CAAQ,YAAA;;;;;;AHrDX;;iBG6EsB,iBAAA,CACpB,YAAA,EAAc,YAAA,EACd,mBAAA,EAAqB,UAAA,GACpB,OAAA,CAAQ,UAAA;;;;;;;;iBAmBW,kBAAA,CAAmB,kBAAA,EAAoB,UAAA,EAAY,QAAA,WAAmB,OAAA,CAAQ,eAAA;;;;;;;;iBAmB9E,wBAAA,CACpB,kBAAA,EAAoB,eAAA,EACpB,QAAA,WACC,OAAA,CAAQ,UAAA"}
+{"version":3,"file":"email-crypto.d.mts","names":[],"sources":["../src/email-crypto/hybridEncyptedEmail.ts","../src/email-crypto/pwdProtectedEmail.ts","../src/email-crypto/emailKeys.ts","../src/email-crypto/core.ts"],"mappings":";;;;;AAWA;;;;;;iBAAsB,kBAAA,CACpB,IAAA,EAAM,SAAA,EACN,SAAA,EAAW,sBAAA,EACX,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,oBAAA;;;;;;;;;iBAkBW,uCAAA,CACpB,IAAA,EAAM,SAAA,EACN,UAAA,EAAY,sBAAA,IACZ,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,oBAAA;;;;;AAJX;;;;iBA8BsB,kBAAA,CACpB,YAAA,EAAc,oBAAA,EACd,0BAAA,EAA4B,UAAA,EAC5B,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;AAxDX;;;;;;iBCAsB,uBAAA,CACpB,SAAA,EAAW,SAAA,EACX,QAAA,UACA,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,iBAAA;;;;;;;;;iBAmBW,wBAAA,CACpB,cAAA,EAAgB,iBAAA,EAChB,QAAA,UACA,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;AD3BX;;;iBEDsB,iBAAA,CAAA,GAAqB,OAAA,CAAQ,aAAA;;;;;;;cAUtC,iBAAA,GAA2B,QAAA,aAAmB,OAAA,CAAQ,UAAA;;;;;;;cAUtD,mBAAA,GAA6B,QAAA,aAAmB,OAAA,CAAQ,UAAA;;;;;AFnBrE;;;;;iBGGsB,gBAAA,CACpB,IAAA,EAAM,SAAA,EACN,GAAA,GAAM,UAAA,GACL,OAAA;EACD,YAAA,EAAc,kBAAA;EACd,aAAA,EAAe,UAAA;AAAA;;;;;;;;;iBAuBK,uBAAA,CACpB,IAAA,EAAM,SAAA,EACN,aAAA,EAAe,UAAA,EACf,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,kBAAA;;;AHbX;;;;;;iBG8CsB,gBAAA,CACpB,YAAA,EAAc,kBAAA,EACd,aAAA,EAAe,UAAA,EACf,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;;;;iBA8BW,iBAAA,CACpB,kBAAA,EAAoB,UAAA,EACpB,SAAA,EAAW,sBAAA,GACV,OAAA,CAAQ,YAAA;;;;;;AHrDX;;iBG6EsB,iBAAA,CACpB,YAAA,EAAc,YAAA,EACd,mBAAA,EAAqB,UAAA,GACpB,OAAA,CAAQ,UAAA;;;;;;;;iBAmBW,kBAAA,CAAmB,kBAAA,EAAoB,UAAA,EAAY,QAAA,WAAmB,OAAA,CAAQ,eAAA;;;;;;;;iBAmB9E,wBAAA,CACpB,kBAAA,EAAoB,eAAA,EACpB,QAAA,WACC,OAAA,CAAQ,UAAA"}

package/dist/email-crypto.d.ts

@@ -56,6 +56,20 @@ declare function decryptPwdProtectedEmail(encryptedEmail: PwdProtectedEmail, pas
  * @returns The user's private and public keys
  */
 declare function generateEmailKeys(): Promise<HybridKeyPair>;
+/**
+ * Derives database encryption key for the given user
+ *
+ * @param mnemonic - The user's mnemonic (machine-generated with secure PRNG)
+ * @returns The symmetric key for protecting database
+ */
+declare const deriveDatabaseKey: (mnemonic: string) => Promise<Uint8Array>;
+/**
+ * Derives email draft encryption key for the given user
+ *
+ * @param mnemonic - The user's mnemonic (machine-generated with secure PRNG)
+ * @returns The symmetric key for protecting email drafts
+ */
+declare const deriveEmailDraftKey: (mnemonic: string) => Promise<Uint8Array>;
 //#endregion
 //#region src/email-crypto/core.d.ts
 /**
@@ -120,5 +134,5 @@ declare function passwordProtectKey(emailEncryptionKey: Uint8Array, password: st
  */
 declare function removePasswordProtection(emailEncryptionKey: PwdProtectedKey, password: string): Promise<Uint8Array>;
 //#endregion
-export { createPwdProtectedEmail, decryptEmailBody, decryptEmailHybrid, decryptKeysHybrid, decryptPwdProtectedEmail, encryptEmailBody, encryptEmailBodyWithKey, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, encryptKeysHybrid, generateEmailKeys, passwordProtectKey, removePasswordProtection };
+export { createPwdProtectedEmail, decryptEmailBody, decryptEmailHybrid, decryptKeysHybrid, decryptPwdProtectedEmail, deriveDatabaseKey, deriveEmailDraftKey, encryptEmailBody, encryptEmailBodyWithKey, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, encryptKeysHybrid, generateEmailKeys, passwordProtectKey, removePasswordProtection };
 //# sourceMappingURL=email-crypto.d.ts.map

package/dist/email-crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-crypto.d.ts","names":[],"sources":["../src/email-crypto/hybridEncyptedEmail.ts","../src/email-crypto/pwdProtectedEmail.ts","../src/email-crypto/emailKeys.ts","../src/email-crypto/core.ts"],"mappings":";;;;;AAWA;;;;;;iBAAsB,kBAAA,CACpB,IAAA,EAAM,SAAA,EACN,SAAA,EAAW,sBAAA,EACX,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,oBAAA;;;;;;;;;iBAkBW,uCAAA,CACpB,IAAA,EAAM,SAAA,EACN,UAAA,EAAY,sBAAA,IACZ,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,oBAAA;;;;;AAJX;;;;iBA8BsB,kBAAA,CACpB,YAAA,EAAc,oBAAA,EACd,0BAAA,EAA4B,UAAA,EAC5B,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;AAxDX;;;;;;iBCAsB,uBAAA,CACpB,SAAA,EAAW,SAAA,EACX,QAAA,UACA,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,iBAAA;;;;;;;;;iBAmBW,wBAAA,CACpB,cAAA,EAAgB,iBAAA,EAChB,QAAA,UACA,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;AD3BX;;;iBEHsB,iBAAA,CAAA,GAAqB,OAAA,CAAQ,aAAA;;;;;AFGnD;;;;;iBGGsB,gBAAA,CACpB,IAAA,EAAM,SAAA,EACN,GAAA,GAAM,UAAA,GACL,OAAA;EACD,YAAA,EAAc,kBAAA;EACd,aAAA,EAAe,UAAA;AAAA;;;;;;;;;iBAuBK,uBAAA,CACpB,IAAA,EAAM,SAAA,EACN,aAAA,EAAe,UAAA,EACf,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,kBAAA;;;AHbX;;;;;;iBG8CsB,gBAAA,CACpB,YAAA,EAAc,kBAAA,EACd,aAAA,EAAe,UAAA,EACf,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;;;;iBA8BW,iBAAA,CACpB,kBAAA,EAAoB,UAAA,EACpB,SAAA,EAAW,sBAAA,GACV,OAAA,CAAQ,YAAA;;;;;;AHrDX;;iBG6EsB,iBAAA,CACpB,YAAA,EAAc,YAAA,EACd,mBAAA,EAAqB,UAAA,GACpB,OAAA,CAAQ,UAAA;;;;;;;;iBAmBW,kBAAA,CAAmB,kBAAA,EAAoB,UAAA,EAAY,QAAA,WAAmB,OAAA,CAAQ,eAAA;;;;;;;;iBAmB9E,wBAAA,CACpB,kBAAA,EAAoB,eAAA,EACpB,QAAA,WACC,OAAA,CAAQ,UAAA"}
+{"version":3,"file":"email-crypto.d.ts","names":[],"sources":["../src/email-crypto/hybridEncyptedEmail.ts","../src/email-crypto/pwdProtectedEmail.ts","../src/email-crypto/emailKeys.ts","../src/email-crypto/core.ts"],"mappings":";;;;;AAWA;;;;;;iBAAsB,kBAAA,CACpB,IAAA,EAAM,SAAA,EACN,SAAA,EAAW,sBAAA,EACX,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,oBAAA;;;;;;;;;iBAkBW,uCAAA,CACpB,IAAA,EAAM,SAAA,EACN,UAAA,EAAY,sBAAA,IACZ,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,oBAAA;;;;;AAJX;;;;iBA8BsB,kBAAA,CACpB,YAAA,EAAc,oBAAA,EACd,0BAAA,EAA4B,UAAA,EAC5B,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;AAxDX;;;;;;iBCAsB,uBAAA,CACpB,SAAA,EAAW,SAAA,EACX,QAAA,UACA,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,iBAAA;;;;;;;;;iBAmBW,wBAAA,CACpB,cAAA,EAAgB,iBAAA,EAChB,QAAA,UACA,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;AD3BX;;;iBEDsB,iBAAA,CAAA,GAAqB,OAAA,CAAQ,aAAA;;;;;;;cAUtC,iBAAA,GAA2B,QAAA,aAAmB,OAAA,CAAQ,UAAA;;;;;;;cAUtD,mBAAA,GAA6B,QAAA,aAAmB,OAAA,CAAQ,UAAA;;;;;AFnBrE;;;;;iBGGsB,gBAAA,CACpB,IAAA,EAAM,SAAA,EACN,GAAA,GAAM,UAAA,GACL,OAAA;EACD,YAAA,EAAc,kBAAA;EACd,aAAA,EAAe,UAAA;AAAA;;;;;;;;;iBAuBK,uBAAA,CACpB,IAAA,EAAM,SAAA,EACN,aAAA,EAAe,UAAA,EACf,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,kBAAA;;;AHbX;;;;;;iBG8CsB,gBAAA,CACpB,YAAA,EAAc,kBAAA,EACd,aAAA,EAAe,UAAA,EACf,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;;;;iBA8BW,iBAAA,CACpB,kBAAA,EAAoB,UAAA,EACpB,SAAA,EAAW,sBAAA,GACV,OAAA,CAAQ,YAAA;;;;;;AHrDX;;iBG6EsB,iBAAA,CACpB,YAAA,EAAc,YAAA,EACd,mBAAA,EAAqB,UAAA,GACpB,OAAA,CAAQ,UAAA;;;;;;;;iBAmBW,kBAAA,CAAmB,kBAAA,EAAoB,UAAA,EAAY,QAAA,WAAmB,OAAA,CAAQ,eAAA;;;;;;;;iBAmB9E,wBAAA,CACpB,kBAAA,EAAoB,eAAA,EACpB,QAAA,WACC,OAAA,CAAQ,UAAA"}

package/dist/email-crypto.js

@@ -1,11 +1,13 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_emailKeys = require('./emailKeys-DWvKANTZ.js');
+const require_emailKeys = require('./emailKeys-BFI-paQq.js');
 
 exports.createPwdProtectedEmail = require_emailKeys.createPwdProtectedEmail;
 exports.decryptEmailBody = require_emailKeys.decryptEmailBody;
 exports.decryptEmailHybrid = require_emailKeys.decryptEmailHybrid;
 exports.decryptKeysHybrid = require_emailKeys.decryptKeysHybrid;
 exports.decryptPwdProtectedEmail = require_emailKeys.decryptPwdProtectedEmail;
+exports.deriveDatabaseKey = require_emailKeys.deriveDatabaseKey;
+exports.deriveEmailDraftKey = require_emailKeys.deriveEmailDraftKey;
 exports.encryptEmailBody = require_emailKeys.encryptEmailBody;
 exports.encryptEmailBodyWithKey = require_emailKeys.encryptEmailBodyWithKey;
 exports.encryptEmailHybrid = require_emailKeys.encryptEmailHybrid;

package/dist/email-crypto.mjs

@@ -1,3 +1,3 @@
-import { a as encryptEmailHybrid, c as decryptKeysHybrid, d as encryptKeysHybrid, f as passwordProtectKey, i as decryptEmailHybrid, l as encryptEmailBody, n as createPwdProtectedEmail, o as encryptEmailHybridForMultipleRecipients, p as removePasswordProtection, r as decryptPwdProtectedEmail, s as decryptEmailBody, t as generateEmailKeys, u as encryptEmailBodyWithKey } from "./emailKeys-nzn7U7HQ.mjs";
+import { a as decryptPwdProtectedEmail, c as encryptEmailHybridForMultipleRecipients, d as encryptEmailBody, f as encryptEmailBodyWithKey, h as removePasswordProtection, i as createPwdProtectedEmail, l as decryptEmailBody, m as passwordProtectKey, n as deriveEmailDraftKey, o as decryptEmailHybrid, p as encryptKeysHybrid, r as generateEmailKeys, s as encryptEmailHybrid, t as deriveDatabaseKey, u as decryptKeysHybrid } from "./emailKeys-BjIeINfC.mjs";
 
-export { createPwdProtectedEmail, decryptEmailBody, decryptEmailHybrid, decryptKeysHybrid, decryptPwdProtectedEmail, encryptEmailBody, encryptEmailBodyWithKey, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, encryptKeysHybrid, generateEmailKeys, passwordProtectKey, removePasswordProtection };
+export { createPwdProtectedEmail, decryptEmailBody, decryptEmailHybrid, decryptKeysHybrid, decryptPwdProtectedEmail, deriveDatabaseKey, deriveEmailDraftKey, encryptEmailBody, encryptEmailBodyWithKey, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, encryptKeysHybrid, generateEmailKeys, passwordProtectKey, removePasswordProtection };

package/dist/emailEncryptionKey-Cw-vW_Oq.js

@@ -0,0 +1,248 @@
+const require_constants = require('./constants.js');
+const require_genID = require('./genID-cWOPmspk.js');
+const require_deriveKeysFromMnemonic = require('./deriveKeysFromMnemonic-Dbx7VSBQ.js');
+const require_deriveKeysFromPassword = require('./deriveKeysFromPassword-iMHv-tIA.js');
+const require_aes = require('./aes-CuW_SPl-.js');
+const require_xwing = require('./xwing-iRWVRtNE.js');
+const require_types = require('./types.js');
+
+//#region src/keystore-crypto/core.ts
+/**
+* Encrypts the user's hybrid key using symmetric encryption to get a keystore
+*
+* @param secretKey - The symmetric key to encrypt the keystore content
+* @param key - The hybrid key pair
+* @param userEmail - The email of the user
+* @param type - The keystore type
+* @returns The encrypted keystore
+*/
+async function encryptKeystoreContent(secretKey, keys, userEmail, type) {
+	try {
+		const aux = require_genID.UTF8ToUint8(userEmail + type);
+		return {
+			userEmail,
+			type,
+			publicKey: require_genID.uint8ArrayToBase64(keys.publicKey),
+			privateKeyEncrypted: require_genID.uint8ArrayToBase64(await require_aes.encryptSymmetrically(secretKey, keys.secretKey, aux))
+		};
+	} catch (error) {
+		throw new Error("Failed to encrypt keystore content", { cause: error });
+	}
+}
+/**
+* Decrypts the keystore content using symmetric encryption
+*
+* @param kesytoreOpeningKey - The symmetric key to decrypt the keystore content
+* @param encryptedKeys - The encrypted keystore content
+* @returns The decrypted hybrid key pair contained in the keystore
+*/
+async function decryptKeystoreContent(kesytoreOpeningKey, encryptedKeystore) {
+	try {
+		const aux = require_genID.UTF8ToUint8(encryptedKeystore.userEmail + encryptedKeystore.type);
+		return {
+			publicKey: require_genID.base64ToUint8Array(encryptedKeystore.publicKey),
+			secretKey: await require_aes.decryptSymmetrically(kesytoreOpeningKey, require_genID.base64ToUint8Array(encryptedKeystore.privateKeyEncrypted), aux)
+		};
+	} catch (error) {
+		throw new Error("Failed to decrypt keystore content", { cause: error });
+	}
+}
+/**
+* Derives a secret key for protecting the recovery keystore
+*
+* @param recoveryCodes - The recovery codes (machine-generated with secure PRNG)
+* @returns The derived secret key for protecting the recovery keystore
+*/
+async function deriveRecoveryKey(recoveryCodes) {
+	return require_deriveKeysFromMnemonic.deriveKeyFromMnemonic(recoveryCodes, require_constants.CONTEXT_RECOVERY);
+}
+/**
+* Derives a secret key for protecting the encryption keystore
+*
+* @param password - The user's password
+* @param salt - The keystore salt
+* @returns The derived secret key for protecting the encryption keystore
+*/
+async function deriveEncryptionKeystoreKey(password, salt) {
+	return require_deriveKeysFromMnemonic.deriveSymmetricKeyFromContext(require_constants.CONTEXT_ENC_KEYSTORE, await require_deriveKeysFromPassword.getKeyFromPasswordAndSalt(password, salt));
+}
+/**
+* Derives a secret key for protecting the encryption keystore
+*
+* @param password - The user's password
+* @param salt - The keystore salt
+* @returns The derived secret key for protecting the encryption keystore
+*/
+async function deriveNewEncryptionKeystoreKey(password) {
+	const { key, salt } = await require_deriveKeysFromPassword.getKeyFromPassword(password);
+	return {
+		secretKey: require_deriveKeysFromMnemonic.deriveSymmetricKeyFromContext(require_constants.CONTEXT_ENC_KEYSTORE, key),
+		salt
+	};
+}
+
+//#endregion
+//#region src/keystore-crypto/errors.ts
+var FailedToCreateKeyStores = class FailedToCreateKeyStores extends Error {
+	constructor(errorMsg) {
+		super("Failed to create encryption and recovery keystores: " + errorMsg);
+		Object.setPrototypeOf(this, FailedToCreateKeyStores.prototype);
+	}
+};
+var FailedToOpenEncryptionKeyStore = class FailedToOpenEncryptionKeyStore extends Error {
+	constructor(errorMsg) {
+		super("Failed to open encryption keystore: " + errorMsg);
+		Object.setPrototypeOf(this, FailedToOpenEncryptionKeyStore.prototype);
+	}
+};
+var FailedToOpenRecoveryKeyStore = class FailedToOpenRecoveryKeyStore extends Error {
+	constructor(errorMsg) {
+		super("Failed to open recovery keystore: " + errorMsg);
+		Object.setPrototypeOf(this, FailedToOpenRecoveryKeyStore.prototype);
+	}
+};
+var FailedToChangePasswordForKeyStore = class FailedToChangePasswordForKeyStore extends Error {
+	constructor(errorMsg) {
+		super("Error while fetching message: " + errorMsg);
+		Object.setPrototypeOf(this, FailedToChangePasswordForKeyStore.prototype);
+	}
+};
+
+//#endregion
+//#region src/keystore-crypto/emailEncryptionKey.ts
+/**
+* Generates hybrid keys and creates encrypted main and recovery keystores
+* The main keystore encryption key is derived from the user's password
+* The recovery keystore encryption key is derived from the recovery codes
+*
+* @param userEmail - The user's email
+* @param password - The user's password
+* @returns The encryption keys
+*
+* @returns The encryption and recovery keystores, recovery codes and hybrid keys
+*/
+async function createEncryptionAndRecoveryKeystores(userEmail, password) {
+	try {
+		const keys = require_xwing.genHybridKeys();
+		const { secretKey, salt } = await deriveNewEncryptionKeystoreKey(password);
+		const encryptionKeystore = await encryptKeystoreContent(secretKey, keys, userEmail, require_types.KeystoreType.ENCRYPTION);
+		const recoveryCodes = require_genID.genMnemonic();
+		return {
+			encryptionKeystore,
+			recoveryKeystore: await encryptKeystoreContent(await deriveRecoveryKey(recoveryCodes), keys, userEmail, require_types.KeystoreType.RECOVERY),
+			recoveryCodes,
+			keys,
+			salt
+		};
+	} catch (error) {
+		throw new FailedToCreateKeyStores(error instanceof Error ? error.message : String(error));
+	}
+}
+/**
+* Opens the encryption keystore and returns the email encryption keys
+* The decryption key is derived from the user password
+*
+* @param encryptedKeystore - The encrypted keystore containing encryption keys
+* @param password - The user's password
+* @param salt - The keystore's salt
+* @returns The encryption keys
+*/
+async function openEncryptionKeystore(encryptedKeystore, password, salt) {
+	try {
+		if (encryptedKeystore.type !== require_types.KeystoreType.ENCRYPTION) throw new Error("Input is invalid");
+		return await decryptKeystoreContent(await deriveEncryptionKeystoreKey(password, salt), encryptedKeystore);
+	} catch (error) {
+		throw new FailedToOpenEncryptionKeyStore(error instanceof Error ? error.message : String(error));
+	}
+}
+/**
+* Opens the recovery keystore and returns the email encryption keys
+* The decryption key is derived from the recovery codes (machine-generated mnemonic)
+*
+* @param recoveryCodes - The user's recovery codes
+* @param encryptedKeystore - The encrypted keystore containing encryption keys
+* @returns The encryption keys
+*/
+async function openRecoveryKeystore(recoveryCodes, encryptedKeystore) {
+	try {
+		if (encryptedKeystore.type !== require_types.KeystoreType.RECOVERY) throw new Error("Input is invalid");
+		return await decryptKeystoreContent(await deriveRecoveryKey(recoveryCodes), encryptedKeystore);
+	} catch (error) {
+		throw new FailedToOpenRecoveryKeyStore(error instanceof Error ? error.message : String(error));
+	}
+}
+/**
+* Re-encrypts the encryption keystore with a new password
+* The decryption key is derived from the user password
+*
+* @param encryptedKeystore - The encrypted keystore containing encryption keys
+* @param oldPassword - The user's old password
+* @param newPassword - The user's new password
+* @param oldSalt - The keystore's old salt
+* @returns The keys, re-encrypted keystore, and new salt
+*/
+async function changePasswordForEncryptionKeystore(encryptedKeystore, oldPassword, newPassword, oldSalt) {
+	try {
+		if (encryptedKeystore.type !== require_types.KeystoreType.ENCRYPTION) throw new Error("Input is invalid");
+		const keys = await openEncryptionKeystore(encryptedKeystore, oldPassword, oldSalt);
+		const { secretKey, salt } = await deriveNewEncryptionKeystoreKey(newPassword);
+		return {
+			newKeystore: await encryptKeystoreContent(secretKey, keys, encryptedKeystore.userEmail, require_types.KeystoreType.ENCRYPTION),
+			newSalt: salt,
+			keys
+		};
+	} catch (error) {
+		throw new FailedToChangePasswordForKeyStore(error instanceof Error ? error.message : String(error));
+	}
+}
+
+//#endregion
+Object.defineProperty(exports, 'FailedToChangePasswordForKeyStore', {
+  enumerable: true,
+  get: function () {
+    return FailedToChangePasswordForKeyStore;
+  }
+});
+Object.defineProperty(exports, 'FailedToCreateKeyStores', {
+  enumerable: true,
+  get: function () {
+    return FailedToCreateKeyStores;
+  }
+});
+Object.defineProperty(exports, 'FailedToOpenEncryptionKeyStore', {
+  enumerable: true,
+  get: function () {
+    return FailedToOpenEncryptionKeyStore;
+  }
+});
+Object.defineProperty(exports, 'FailedToOpenRecoveryKeyStore', {
+  enumerable: true,
+  get: function () {
+    return FailedToOpenRecoveryKeyStore;
+  }
+});
+Object.defineProperty(exports, 'changePasswordForEncryptionKeystore', {
+  enumerable: true,
+  get: function () {
+    return changePasswordForEncryptionKeystore;
+  }
+});
+Object.defineProperty(exports, 'createEncryptionAndRecoveryKeystores', {
+  enumerable: true,
+  get: function () {
+    return createEncryptionAndRecoveryKeystores;
+  }
+});
+Object.defineProperty(exports, 'openEncryptionKeystore', {
+  enumerable: true,
+  get: function () {
+    return openEncryptionKeystore;
+  }
+});
+Object.defineProperty(exports, 'openRecoveryKeystore', {
+  enumerable: true,
+  get: function () {
+    return openRecoveryKeystore;
+  }
+});
+//# sourceMappingURL=emailEncryptionKey-Cw-vW_Oq.js.map

package/dist/emailEncryptionKey-Cw-vW_Oq.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailEncryptionKey-Cw-vW_Oq.js","names":["UTF8ToUint8","uint8ArrayToBase64","encryptSymmetrically","base64ToUint8Array","decryptSymmetrically","deriveKeyFromMnemonic","CONTEXT_RECOVERY","deriveSymmetricKeyFromContext","CONTEXT_ENC_KEYSTORE","getKeyFromPasswordAndSalt","getKeyFromPassword","genHybridKeys","KeystoreType","genMnemonic"],"sources":["../src/keystore-crypto/core.ts","../src/keystore-crypto/errors.ts","../src/keystore-crypto/emailEncryptionKey.ts"],"sourcesContent":["import { encryptSymmetrically, decryptSymmetrically } from '../symmetric-crypto';\nimport { base64ToUint8Array, uint8ArrayToBase64, UTF8ToUint8 } from '../utils';\nimport { deriveKeyFromMnemonic, deriveSymmetricKeyFromContext } from '../derive-key';\nimport { CONTEXT_ENC_KEYSTORE, CONTEXT_RECOVERY } from '../constants';\nimport { EncryptedKeystore, HybridKeyPair, KeystoreType } from '../types';\nimport { getKeyFromPasswordAndSalt, getKeyFromPassword } from '../derive-password';\n\n/**\n * Encrypts the user's hybrid key using symmetric encryption to get a keystore\n *\n * @param secretKey - The symmetric key to encrypt the keystore content\n * @param key - The hybrid key pair\n * @param userEmail - The email of the user\n * @param type - The keystore type\n * @returns The encrypted keystore\n */\nexport async function encryptKeystoreContent(\n  secretKey: Uint8Array,\n  keys: HybridKeyPair,\n  userEmail: string,\n  type: KeystoreType,\n): Promise<EncryptedKeystore> {\n  try {\n    const aux = UTF8ToUint8(userEmail + type);\n    const publicKey = uint8ArrayToBase64(keys.publicKey);\n    const secretKeyEncrypted = await encryptSymmetrically(secretKey, keys.secretKey, aux);\n\n    const keystore: EncryptedKeystore = {\n      userEmail,\n      type,\n      publicKey,\n      privateKeyEncrypted: uint8ArrayToBase64(secretKeyEncrypted),\n    };\n    return keystore;\n  } catch (error) {\n    throw new Error('Failed to encrypt keystore content', { cause: error });\n  }\n}\n\n/**\n * Decrypts the keystore content using symmetric encryption\n *\n * @param kesytoreOpeningKey - The symmetric key to decrypt the keystore content\n * @param encryptedKeys - The encrypted keystore content\n * @returns The decrypted hybrid key pair contained in the keystore\n */\nexport async function decryptKeystoreContent(\n  kesytoreOpeningKey: Uint8Array,\n  encryptedKeystore: EncryptedKeystore,\n): Promise<HybridKeyPair> {\n  try {\n    const aux = UTF8ToUint8(encryptedKeystore.userEmail + encryptedKeystore.type);\n    const publicKey = base64ToUint8Array(encryptedKeystore.publicKey);\n    const ciphertext = base64ToUint8Array(encryptedKeystore.privateKeyEncrypted);\n    const secretKey = await decryptSymmetrically(kesytoreOpeningKey, ciphertext, aux);\n    return {\n      publicKey,\n      secretKey,\n    };\n  } catch (error) {\n    throw new Error('Failed to decrypt keystore content', { cause: error });\n  }\n}\n\n/**\n * Derives a secret key for protecting the recovery keystore\n *\n * @param recoveryCodes - The recovery codes (machine-generated with secure PRNG)\n * @returns The derived secret key for protecting the recovery keystore\n */\nexport async function deriveRecoveryKey(recoveryCodes: string): Promise<Uint8Array> {\n  return deriveKeyFromMnemonic(recoveryCodes, CONTEXT_RECOVERY);\n}\n\n/**\n * Derives a secret key for protecting the encryption keystore from user's mnemonic\n *\n * @param mnemonic - The user's mnemonic (machine-generated with secure PRNG)\n * @returns The derived secret key for protecting the encryption keystore\n */\nexport async function deriveEncryptionKeystoreKeyFromMnemonic(mnemonic: string): Promise<Uint8Array> {\n  return deriveKeyFromMnemonic(mnemonic, CONTEXT_ENC_KEYSTORE);\n}\n\n/**\n * Derives a secret key for protecting the encryption keystore\n *\n * @param password - The user's password\n * @param salt - The keystore salt\n * @returns The derived secret key for protecting the encryption keystore\n */\nexport async function deriveEncryptionKeystoreKey(password: string, salt: Uint8Array): Promise<Uint8Array> {\n  const baseKey = await getKeyFromPasswordAndSalt(password, salt);\n  return deriveSymmetricKeyFromContext(CONTEXT_ENC_KEYSTORE, baseKey);\n}\n\n/**\n * Derives a secret key for protecting the encryption keystore\n *\n * @param password - The user's password\n * @param salt - The keystore salt\n * @returns The derived secret key for protecting the encryption keystore\n */\nexport async function deriveNewEncryptionKeystoreKey(\n  password: string,\n): Promise<{ secretKey: Uint8Array; salt: Uint8Array }> {\n  const { key, salt } = await getKeyFromPassword(password);\n  const secretKey = deriveSymmetricKeyFromContext(CONTEXT_ENC_KEYSTORE, key);\n  return { secretKey, salt };\n}\n","export class FailedToCreateKeyStores extends Error {\n  constructor(errorMsg?: string) {\n    super('Failed to create encryption and recovery keystores: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToCreateKeyStores.prototype);\n  }\n}\n\nexport class FailedToOpenEncryptionKeyStore extends Error {\n  constructor(errorMsg?: string) {\n    super('Failed to open encryption keystore: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToOpenEncryptionKeyStore.prototype);\n  }\n}\n\nexport class FailedToOpenRecoveryKeyStore extends Error {\n  constructor(errorMsg?: string) {\n    super('Failed to open recovery keystore: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToOpenRecoveryKeyStore.prototype);\n  }\n}\n\nexport class FailedToChangePasswordForKeyStore extends Error {\n  constructor(errorMsg?: string) {\n    super('Error while fetching message: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToChangePasswordForKeyStore.prototype);\n  }\n}\n","import { EncryptedKeystore, KeystoreType, HybridKeyPair } from '../types';\nimport { genMnemonic } from '../utils';\nimport {\n  encryptKeystoreContent,\n  decryptKeystoreContent,\n  deriveEncryptionKeystoreKey,\n  deriveNewEncryptionKeystoreKey,\n  deriveRecoveryKey,\n} from './core';\nimport { genHybridKeys } from '../hybrid-crypto';\nimport {\n  FailedToOpenEncryptionKeyStore,\n  FailedToCreateKeyStores,\n  FailedToOpenRecoveryKeyStore,\n  FailedToChangePasswordForKeyStore,\n} from './errors';\n\n/**\n * Generates hybrid keys and creates encrypted main and recovery keystores\n * The main keystore encryption key is derived from the user's password\n * The recovery keystore encryption key is derived from the recovery codes\n *\n * @param userEmail - The user's email\n * @param password - The user's password\n * @returns The encryption keys\n *\n * @returns The encryption and recovery keystores, recovery codes and hybrid keys\n */\nexport async function createEncryptionAndRecoveryKeystores(\n  userEmail: string,\n  password: string,\n): Promise<{\n  encryptionKeystore: EncryptedKeystore;\n  recoveryKeystore: EncryptedKeystore;\n  recoveryCodes: string;\n  keys: HybridKeyPair;\n  salt: Uint8Array;\n}> {\n  try {\n    const keys = genHybridKeys();\n\n    const { secretKey, salt } = await deriveNewEncryptionKeystoreKey(password);\n    const encryptionKeystore = await encryptKeystoreContent(secretKey, keys, userEmail, KeystoreType.ENCRYPTION);\n\n    const recoveryCodes = genMnemonic();\n    const recoveryKey = await deriveRecoveryKey(recoveryCodes);\n    const recoveryKeystore = await encryptKeystoreContent(recoveryKey, keys, userEmail, KeystoreType.RECOVERY);\n\n    return { encryptionKeystore, recoveryKeystore, recoveryCodes, keys, salt };\n  } catch (error) {\n    throw new FailedToCreateKeyStores(error instanceof Error ? error.message : String(error));\n  }\n}\n\n/**\n * Opens the encryption keystore and returns the email encryption keys\n * The decryption key is derived from the user password\n *\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @param password - The user's password\n * @param salt - The keystore's salt\n * @returns The encryption keys\n */\nexport async function openEncryptionKeystore(\n  encryptedKeystore: EncryptedKeystore,\n  password: string,\n  salt: Uint8Array,\n): Promise<HybridKeyPair> {\n  try {\n    if (encryptedKeystore.type !== KeystoreType.ENCRYPTION) {\n      throw new Error('Input is invalid');\n    }\n    const secretKey = await deriveEncryptionKeystoreKey(password, salt);\n    const keys = await decryptKeystoreContent(secretKey, encryptedKeystore);\n    return keys;\n  } catch (error) {\n    throw new FailedToOpenEncryptionKeyStore(error instanceof Error ? error.message : String(error));\n  }\n}\n\n/**\n * Opens the recovery keystore and returns the email encryption keys\n * The decryption key is derived from the recovery codes (machine-generated mnemonic)\n *\n * @param recoveryCodes - The user's recovery codes\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @returns The encryption keys\n */\nexport async function openRecoveryKeystore(\n  recoveryCodes: string,\n  encryptedKeystore: EncryptedKeystore,\n): Promise<HybridKeyPair> {\n  try {\n    if (encryptedKeystore.type !== KeystoreType.RECOVERY) {\n      throw new Error('Input is invalid');\n    }\n    const recoveryKey = await deriveRecoveryKey(recoveryCodes);\n    const keys = await decryptKeystoreContent(recoveryKey, encryptedKeystore);\n    return keys;\n  } catch (error) {\n    throw new FailedToOpenRecoveryKeyStore(error instanceof Error ? error.message : String(error));\n  }\n}\n\n/**\n * Re-encrypts the encryption keystore with a new password\n * The decryption key is derived from the user password\n *\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @param oldPassword - The user's old password\n * @param newPassword - The user's new password\n * @param oldSalt - The keystore's old salt\n * @returns The keys, re-encrypted keystore, and new salt\n */\nexport async function changePasswordForEncryptionKeystore(\n  encryptedKeystore: EncryptedKeystore,\n  oldPassword: string,\n  newPassword: string,\n  oldSalt: Uint8Array,\n): Promise<{ keys: HybridKeyPair; newSalt: Uint8Array; newKeystore: EncryptedKeystore }> {\n  try {\n    if (encryptedKeystore.type !== KeystoreType.ENCRYPTION) {\n      throw new Error('Input is invalid');\n    }\n    const keys = await openEncryptionKeystore(encryptedKeystore, oldPassword, oldSalt);\n\n    const { secretKey, salt } = await deriveNewEncryptionKeystoreKey(newPassword);\n    const newKeystore = await encryptKeystoreContent(\n      secretKey,\n      keys,\n      encryptedKeystore.userEmail,\n      KeystoreType.ENCRYPTION,\n    );\n\n    return { newKeystore, newSalt: salt, keys };\n  } catch (error) {\n    throw new FailedToChangePasswordForKeyStore(error instanceof Error ? error.message : String(error));\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBA,eAAsB,uBACpB,WACA,MACA,WACA,MAC4B;AAC5B,KAAI;EACF,MAAM,MAAMA,0BAAY,YAAY,KAAK;AAUzC,SANoC;GAClC;GACA;GACA,WANgBC,iCAAmB,KAAK,UAAU;GAOlD,qBAAqBA,iCANI,MAAMC,iCAAqB,WAAW,KAAK,WAAW,IAAI,CAMxB;GAC5D;UAEM,OAAO;AACd,QAAM,IAAI,MAAM,sCAAsC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;AAW3E,eAAsB,uBACpB,oBACA,mBACwB;AACxB,KAAI;EACF,MAAM,MAAMF,0BAAY,kBAAkB,YAAY,kBAAkB,KAAK;AAI7E,SAAO;GACL,WAJgBG,iCAAmB,kBAAkB,UAAU;GAK/D,WAHgB,MAAMC,iCAAqB,oBAD1BD,iCAAmB,kBAAkB,oBAAoB,EACC,IAAI;GAIhF;UACM,OAAO;AACd,QAAM,IAAI,MAAM,sCAAsC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;AAU3E,eAAsB,kBAAkB,eAA4C;AAClF,QAAOE,qDAAsB,eAAeC,mCAAiB;;;;;;;;;AAoB/D,eAAsB,4BAA4B,UAAkB,MAAuC;AAEzG,QAAOC,6DAA8BC,wCADrB,MAAMC,yDAA0B,UAAU,KAAK,CACI;;;;;;;;;AAUrE,eAAsB,+BACpB,UACsD;CACtD,MAAM,EAAE,KAAK,SAAS,MAAMC,kDAAmB,SAAS;AAExD,QAAO;EAAE,WADSH,6DAA8BC,wCAAsB,IAAI;EACtD;EAAM;;;;;AC5G5B,IAAa,0BAAb,MAAa,gCAAgC,MAAM;CACjD,YAAY,UAAmB;AAC7B,QAAM,yDAAyD,SAAS;AAExE,SAAO,eAAe,MAAM,wBAAwB,UAAU;;;AAIlE,IAAa,iCAAb,MAAa,uCAAuC,MAAM;CACxD,YAAY,UAAmB;AAC7B,QAAM,yCAAyC,SAAS;AAExD,SAAO,eAAe,MAAM,+BAA+B,UAAU;;;AAIzE,IAAa,+BAAb,MAAa,qCAAqC,MAAM;CACtD,YAAY,UAAmB;AAC7B,QAAM,uCAAuC,SAAS;AAEtD,SAAO,eAAe,MAAM,6BAA6B,UAAU;;;AAIvE,IAAa,oCAAb,MAAa,0CAA0C,MAAM;CAC3D,YAAY,UAAmB;AAC7B,QAAM,mCAAmC,SAAS;AAElD,SAAO,eAAe,MAAM,kCAAkC,UAAU;;;;;;;;;;;;;;;;;ACA5E,eAAsB,qCACpB,WACA,UAOC;AACD,KAAI;EACF,MAAM,OAAOG,6BAAe;EAE5B,MAAM,EAAE,WAAW,SAAS,MAAM,+BAA+B,SAAS;EAC1E,MAAM,qBAAqB,MAAM,uBAAuB,WAAW,MAAM,WAAWC,2BAAa,WAAW;EAE5G,MAAM,gBAAgBC,2BAAa;AAInC,SAAO;GAAE;GAAoB,kBAFJ,MAAM,uBADX,MAAM,kBAAkB,cAAc,EACS,MAAM,WAAWD,2BAAa,SAAS;GAE3D;GAAe;GAAM;GAAM;UACnE,OAAO;AACd,QAAM,IAAI,wBAAwB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;;;;;;;;;;;AAa7F,eAAsB,uBACpB,mBACA,UACA,MACwB;AACxB,KAAI;AACF,MAAI,kBAAkB,SAASA,2BAAa,WAC1C,OAAM,IAAI,MAAM,mBAAmB;AAIrC,SADa,MAAM,uBADD,MAAM,4BAA4B,UAAU,KAAK,EACd,kBAAkB;UAEhE,OAAO;AACd,QAAM,IAAI,+BAA+B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;;;;;;;;;;AAYpG,eAAsB,qBACpB,eACA,mBACwB;AACxB,KAAI;AACF,MAAI,kBAAkB,SAASA,2BAAa,SAC1C,OAAM,IAAI,MAAM,mBAAmB;AAIrC,SADa,MAAM,uBADC,MAAM,kBAAkB,cAAc,EACH,kBAAkB;UAElE,OAAO;AACd,QAAM,IAAI,6BAA6B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;;;;;;;;;;;;AAclG,eAAsB,oCACpB,mBACA,aACA,aACA,SACuF;AACvF,KAAI;AACF,MAAI,kBAAkB,SAASA,2BAAa,WAC1C,OAAM,IAAI,MAAM,mBAAmB;EAErC,MAAM,OAAO,MAAM,uBAAuB,mBAAmB,aAAa,QAAQ;EAElF,MAAM,EAAE,WAAW,SAAS,MAAM,+BAA+B,YAAY;AAQ7E,SAAO;GAAE,aAPW,MAAM,uBACxB,WACA,MACA,kBAAkB,WAClBA,2BAAa,WACd;GAEqB,SAAS;GAAM;GAAM;UACpC,OAAO;AACd,QAAM,IAAI,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC"}

package/dist/emailEncryptionKey-D9sk_WKj.mjs

@@ -0,0 +1,201 @@
+import { CONTEXT_ENC_KEYSTORE, CONTEXT_RECOVERY } from "./constants.mjs";
+import { a as genMnemonic, c as base64ToUint8Array, s as UTF8ToUint8, u as uint8ArrayToBase64 } from "./genID-D08K7JPr.mjs";
+import { n as deriveSymmetricKeyFromContext, t as deriveKeyFromMnemonic } from "./deriveKeysFromMnemonic-DB0UHE-y.mjs";
+import { n as getKeyFromPassword, r as getKeyFromPasswordAndSalt } from "./deriveKeysFromPassword-DFzo2OII.mjs";
+import { n as encryptSymmetrically, t as decryptSymmetrically } from "./aes-B8TA-JKq.mjs";
+import { r as genHybridKeys } from "./xwing-CQmQX6hn.mjs";
+import { KeystoreType } from "./types.mjs";
+
+//#region src/keystore-crypto/core.ts
+/**
+* Encrypts the user's hybrid key using symmetric encryption to get a keystore
+*
+* @param secretKey - The symmetric key to encrypt the keystore content
+* @param key - The hybrid key pair
+* @param userEmail - The email of the user
+* @param type - The keystore type
+* @returns The encrypted keystore
+*/
+async function encryptKeystoreContent(secretKey, keys, userEmail, type) {
+	try {
+		const aux = UTF8ToUint8(userEmail + type);
+		return {
+			userEmail,
+			type,
+			publicKey: uint8ArrayToBase64(keys.publicKey),
+			privateKeyEncrypted: uint8ArrayToBase64(await encryptSymmetrically(secretKey, keys.secretKey, aux))
+		};
+	} catch (error) {
+		throw new Error("Failed to encrypt keystore content", { cause: error });
+	}
+}
+/**
+* Decrypts the keystore content using symmetric encryption
+*
+* @param kesytoreOpeningKey - The symmetric key to decrypt the keystore content
+* @param encryptedKeys - The encrypted keystore content
+* @returns The decrypted hybrid key pair contained in the keystore
+*/
+async function decryptKeystoreContent(kesytoreOpeningKey, encryptedKeystore) {
+	try {
+		const aux = UTF8ToUint8(encryptedKeystore.userEmail + encryptedKeystore.type);
+		return {
+			publicKey: base64ToUint8Array(encryptedKeystore.publicKey),
+			secretKey: await decryptSymmetrically(kesytoreOpeningKey, base64ToUint8Array(encryptedKeystore.privateKeyEncrypted), aux)
+		};
+	} catch (error) {
+		throw new Error("Failed to decrypt keystore content", { cause: error });
+	}
+}
+/**
+* Derives a secret key for protecting the recovery keystore
+*
+* @param recoveryCodes - The recovery codes (machine-generated with secure PRNG)
+* @returns The derived secret key for protecting the recovery keystore
+*/
+async function deriveRecoveryKey(recoveryCodes) {
+	return deriveKeyFromMnemonic(recoveryCodes, CONTEXT_RECOVERY);
+}
+/**
+* Derives a secret key for protecting the encryption keystore
+*
+* @param password - The user's password
+* @param salt - The keystore salt
+* @returns The derived secret key for protecting the encryption keystore
+*/
+async function deriveEncryptionKeystoreKey(password, salt) {
+	return deriveSymmetricKeyFromContext(CONTEXT_ENC_KEYSTORE, await getKeyFromPasswordAndSalt(password, salt));
+}
+/**
+* Derives a secret key for protecting the encryption keystore
+*
+* @param password - The user's password
+* @param salt - The keystore salt
+* @returns The derived secret key for protecting the encryption keystore
+*/
+async function deriveNewEncryptionKeystoreKey(password) {
+	const { key, salt } = await getKeyFromPassword(password);
+	return {
+		secretKey: deriveSymmetricKeyFromContext(CONTEXT_ENC_KEYSTORE, key),
+		salt
+	};
+}
+
+//#endregion
+//#region src/keystore-crypto/errors.ts
+var FailedToCreateKeyStores = class FailedToCreateKeyStores extends Error {
+	constructor(errorMsg) {
+		super("Failed to create encryption and recovery keystores: " + errorMsg);
+		Object.setPrototypeOf(this, FailedToCreateKeyStores.prototype);
+	}
+};
+var FailedToOpenEncryptionKeyStore = class FailedToOpenEncryptionKeyStore extends Error {
+	constructor(errorMsg) {
+		super("Failed to open encryption keystore: " + errorMsg);
+		Object.setPrototypeOf(this, FailedToOpenEncryptionKeyStore.prototype);
+	}
+};
+var FailedToOpenRecoveryKeyStore = class FailedToOpenRecoveryKeyStore extends Error {
+	constructor(errorMsg) {
+		super("Failed to open recovery keystore: " + errorMsg);
+		Object.setPrototypeOf(this, FailedToOpenRecoveryKeyStore.prototype);
+	}
+};
+var FailedToChangePasswordForKeyStore = class FailedToChangePasswordForKeyStore extends Error {
+	constructor(errorMsg) {
+		super("Error while fetching message: " + errorMsg);
+		Object.setPrototypeOf(this, FailedToChangePasswordForKeyStore.prototype);
+	}
+};
+
+//#endregion
+//#region src/keystore-crypto/emailEncryptionKey.ts
+/**
+* Generates hybrid keys and creates encrypted main and recovery keystores
+* The main keystore encryption key is derived from the user's password
+* The recovery keystore encryption key is derived from the recovery codes
+*
+* @param userEmail - The user's email
+* @param password - The user's password
+* @returns The encryption keys
+*
+* @returns The encryption and recovery keystores, recovery codes and hybrid keys
+*/
+async function createEncryptionAndRecoveryKeystores(userEmail, password) {
+	try {
+		const keys = genHybridKeys();
+		const { secretKey, salt } = await deriveNewEncryptionKeystoreKey(password);
+		const encryptionKeystore = await encryptKeystoreContent(secretKey, keys, userEmail, KeystoreType.ENCRYPTION);
+		const recoveryCodes = genMnemonic();
+		return {
+			encryptionKeystore,
+			recoveryKeystore: await encryptKeystoreContent(await deriveRecoveryKey(recoveryCodes), keys, userEmail, KeystoreType.RECOVERY),
+			recoveryCodes,
+			keys,
+			salt
+		};
+	} catch (error) {
+		throw new FailedToCreateKeyStores(error instanceof Error ? error.message : String(error));
+	}
+}
+/**
+* Opens the encryption keystore and returns the email encryption keys
+* The decryption key is derived from the user password
+*
+* @param encryptedKeystore - The encrypted keystore containing encryption keys
+* @param password - The user's password
+* @param salt - The keystore's salt
+* @returns The encryption keys
+*/
+async function openEncryptionKeystore(encryptedKeystore, password, salt) {
+	try {
+		if (encryptedKeystore.type !== KeystoreType.ENCRYPTION) throw new Error("Input is invalid");
+		return await decryptKeystoreContent(await deriveEncryptionKeystoreKey(password, salt), encryptedKeystore);
+	} catch (error) {
+		throw new FailedToOpenEncryptionKeyStore(error instanceof Error ? error.message : String(error));
+	}
+}
+/**
+* Opens the recovery keystore and returns the email encryption keys
+* The decryption key is derived from the recovery codes (machine-generated mnemonic)
+*
+* @param recoveryCodes - The user's recovery codes
+* @param encryptedKeystore - The encrypted keystore containing encryption keys
+* @returns The encryption keys
+*/
+async function openRecoveryKeystore(recoveryCodes, encryptedKeystore) {
+	try {
+		if (encryptedKeystore.type !== KeystoreType.RECOVERY) throw new Error("Input is invalid");
+		return await decryptKeystoreContent(await deriveRecoveryKey(recoveryCodes), encryptedKeystore);
+	} catch (error) {
+		throw new FailedToOpenRecoveryKeyStore(error instanceof Error ? error.message : String(error));
+	}
+}
+/**
+* Re-encrypts the encryption keystore with a new password
+* The decryption key is derived from the user password
+*
+* @param encryptedKeystore - The encrypted keystore containing encryption keys
+* @param oldPassword - The user's old password
+* @param newPassword - The user's new password
+* @param oldSalt - The keystore's old salt
+* @returns The keys, re-encrypted keystore, and new salt
+*/
+async function changePasswordForEncryptionKeystore(encryptedKeystore, oldPassword, newPassword, oldSalt) {
+	try {
+		if (encryptedKeystore.type !== KeystoreType.ENCRYPTION) throw new Error("Input is invalid");
+		const keys = await openEncryptionKeystore(encryptedKeystore, oldPassword, oldSalt);
+		const { secretKey, salt } = await deriveNewEncryptionKeystoreKey(newPassword);
+		return {
+			newKeystore: await encryptKeystoreContent(secretKey, keys, encryptedKeystore.userEmail, KeystoreType.ENCRYPTION),
+			newSalt: salt,
+			keys
+		};
+	} catch (error) {
+		throw new FailedToChangePasswordForKeyStore(error instanceof Error ? error.message : String(error));
+	}
+}
+
+//#endregion
+export { FailedToChangePasswordForKeyStore as a, FailedToOpenRecoveryKeyStore as c, openRecoveryKeystore as i, createEncryptionAndRecoveryKeystores as n, FailedToCreateKeyStores as o, openEncryptionKeystore as r, FailedToOpenEncryptionKeyStore as s, changePasswordForEncryptionKeystore as t };
+//# sourceMappingURL=emailEncryptionKey-D9sk_WKj.mjs.map

package/dist/emailEncryptionKey-D9sk_WKj.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailEncryptionKey-D9sk_WKj.mjs","names":[],"sources":["../src/keystore-crypto/core.ts","../src/keystore-crypto/errors.ts","../src/keystore-crypto/emailEncryptionKey.ts"],"sourcesContent":["import { encryptSymmetrically, decryptSymmetrically } from '../symmetric-crypto';\nimport { base64ToUint8Array, uint8ArrayToBase64, UTF8ToUint8 } from '../utils';\nimport { deriveKeyFromMnemonic, deriveSymmetricKeyFromContext } from '../derive-key';\nimport { CONTEXT_ENC_KEYSTORE, CONTEXT_RECOVERY } from '../constants';\nimport { EncryptedKeystore, HybridKeyPair, KeystoreType } from '../types';\nimport { getKeyFromPasswordAndSalt, getKeyFromPassword } from '../derive-password';\n\n/**\n * Encrypts the user's hybrid key using symmetric encryption to get a keystore\n *\n * @param secretKey - The symmetric key to encrypt the keystore content\n * @param key - The hybrid key pair\n * @param userEmail - The email of the user\n * @param type - The keystore type\n * @returns The encrypted keystore\n */\nexport async function encryptKeystoreContent(\n  secretKey: Uint8Array,\n  keys: HybridKeyPair,\n  userEmail: string,\n  type: KeystoreType,\n): Promise<EncryptedKeystore> {\n  try {\n    const aux = UTF8ToUint8(userEmail + type);\n    const publicKey = uint8ArrayToBase64(keys.publicKey);\n    const secretKeyEncrypted = await encryptSymmetrically(secretKey, keys.secretKey, aux);\n\n    const keystore: EncryptedKeystore = {\n      userEmail,\n      type,\n      publicKey,\n      privateKeyEncrypted: uint8ArrayToBase64(secretKeyEncrypted),\n    };\n    return keystore;\n  } catch (error) {\n    throw new Error('Failed to encrypt keystore content', { cause: error });\n  }\n}\n\n/**\n * Decrypts the keystore content using symmetric encryption\n *\n * @param kesytoreOpeningKey - The symmetric key to decrypt the keystore content\n * @param encryptedKeys - The encrypted keystore content\n * @returns The decrypted hybrid key pair contained in the keystore\n */\nexport async function decryptKeystoreContent(\n  kesytoreOpeningKey: Uint8Array,\n  encryptedKeystore: EncryptedKeystore,\n): Promise<HybridKeyPair> {\n  try {\n    const aux = UTF8ToUint8(encryptedKeystore.userEmail + encryptedKeystore.type);\n    const publicKey = base64ToUint8Array(encryptedKeystore.publicKey);\n    const ciphertext = base64ToUint8Array(encryptedKeystore.privateKeyEncrypted);\n    const secretKey = await decryptSymmetrically(kesytoreOpeningKey, ciphertext, aux);\n    return {\n      publicKey,\n      secretKey,\n    };\n  } catch (error) {\n    throw new Error('Failed to decrypt keystore content', { cause: error });\n  }\n}\n\n/**\n * Derives a secret key for protecting the recovery keystore\n *\n * @param recoveryCodes - The recovery codes (machine-generated with secure PRNG)\n * @returns The derived secret key for protecting the recovery keystore\n */\nexport async function deriveRecoveryKey(recoveryCodes: string): Promise<Uint8Array> {\n  return deriveKeyFromMnemonic(recoveryCodes, CONTEXT_RECOVERY);\n}\n\n/**\n * Derives a secret key for protecting the encryption keystore from user's mnemonic\n *\n * @param mnemonic - The user's mnemonic (machine-generated with secure PRNG)\n * @returns The derived secret key for protecting the encryption keystore\n */\nexport async function deriveEncryptionKeystoreKeyFromMnemonic(mnemonic: string): Promise<Uint8Array> {\n  return deriveKeyFromMnemonic(mnemonic, CONTEXT_ENC_KEYSTORE);\n}\n\n/**\n * Derives a secret key for protecting the encryption keystore\n *\n * @param password - The user's password\n * @param salt - The keystore salt\n * @returns The derived secret key for protecting the encryption keystore\n */\nexport async function deriveEncryptionKeystoreKey(password: string, salt: Uint8Array): Promise<Uint8Array> {\n  const baseKey = await getKeyFromPasswordAndSalt(password, salt);\n  return deriveSymmetricKeyFromContext(CONTEXT_ENC_KEYSTORE, baseKey);\n}\n\n/**\n * Derives a secret key for protecting the encryption keystore\n *\n * @param password - The user's password\n * @param salt - The keystore salt\n * @returns The derived secret key for protecting the encryption keystore\n */\nexport async function deriveNewEncryptionKeystoreKey(\n  password: string,\n): Promise<{ secretKey: Uint8Array; salt: Uint8Array }> {\n  const { key, salt } = await getKeyFromPassword(password);\n  const secretKey = deriveSymmetricKeyFromContext(CONTEXT_ENC_KEYSTORE, key);\n  return { secretKey, salt };\n}\n","export class FailedToCreateKeyStores extends Error {\n  constructor(errorMsg?: string) {\n    super('Failed to create encryption and recovery keystores: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToCreateKeyStores.prototype);\n  }\n}\n\nexport class FailedToOpenEncryptionKeyStore extends Error {\n  constructor(errorMsg?: string) {\n    super('Failed to open encryption keystore: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToOpenEncryptionKeyStore.prototype);\n  }\n}\n\nexport class FailedToOpenRecoveryKeyStore extends Error {\n  constructor(errorMsg?: string) {\n    super('Failed to open recovery keystore: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToOpenRecoveryKeyStore.prototype);\n  }\n}\n\nexport class FailedToChangePasswordForKeyStore extends Error {\n  constructor(errorMsg?: string) {\n    super('Error while fetching message: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToChangePasswordForKeyStore.prototype);\n  }\n}\n","import { EncryptedKeystore, KeystoreType, HybridKeyPair } from '../types';\nimport { genMnemonic } from '../utils';\nimport {\n  encryptKeystoreContent,\n  decryptKeystoreContent,\n  deriveEncryptionKeystoreKey,\n  deriveNewEncryptionKeystoreKey,\n  deriveRecoveryKey,\n} from './core';\nimport { genHybridKeys } from '../hybrid-crypto';\nimport {\n  FailedToOpenEncryptionKeyStore,\n  FailedToCreateKeyStores,\n  FailedToOpenRecoveryKeyStore,\n  FailedToChangePasswordForKeyStore,\n} from './errors';\n\n/**\n * Generates hybrid keys and creates encrypted main and recovery keystores\n * The main keystore encryption key is derived from the user's password\n * The recovery keystore encryption key is derived from the recovery codes\n *\n * @param userEmail - The user's email\n * @param password - The user's password\n * @returns The encryption keys\n *\n * @returns The encryption and recovery keystores, recovery codes and hybrid keys\n */\nexport async function createEncryptionAndRecoveryKeystores(\n  userEmail: string,\n  password: string,\n): Promise<{\n  encryptionKeystore: EncryptedKeystore;\n  recoveryKeystore: EncryptedKeystore;\n  recoveryCodes: string;\n  keys: HybridKeyPair;\n  salt: Uint8Array;\n}> {\n  try {\n    const keys = genHybridKeys();\n\n    const { secretKey, salt } = await deriveNewEncryptionKeystoreKey(password);\n    const encryptionKeystore = await encryptKeystoreContent(secretKey, keys, userEmail, KeystoreType.ENCRYPTION);\n\n    const recoveryCodes = genMnemonic();\n    const recoveryKey = await deriveRecoveryKey(recoveryCodes);\n    const recoveryKeystore = await encryptKeystoreContent(recoveryKey, keys, userEmail, KeystoreType.RECOVERY);\n\n    return { encryptionKeystore, recoveryKeystore, recoveryCodes, keys, salt };\n  } catch (error) {\n    throw new FailedToCreateKeyStores(error instanceof Error ? error.message : String(error));\n  }\n}\n\n/**\n * Opens the encryption keystore and returns the email encryption keys\n * The decryption key is derived from the user password\n *\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @param password - The user's password\n * @param salt - The keystore's salt\n * @returns The encryption keys\n */\nexport async function openEncryptionKeystore(\n  encryptedKeystore: EncryptedKeystore,\n  password: string,\n  salt: Uint8Array,\n): Promise<HybridKeyPair> {\n  try {\n    if (encryptedKeystore.type !== KeystoreType.ENCRYPTION) {\n      throw new Error('Input is invalid');\n    }\n    const secretKey = await deriveEncryptionKeystoreKey(password, salt);\n    const keys = await decryptKeystoreContent(secretKey, encryptedKeystore);\n    return keys;\n  } catch (error) {\n    throw new FailedToOpenEncryptionKeyStore(error instanceof Error ? error.message : String(error));\n  }\n}\n\n/**\n * Opens the recovery keystore and returns the email encryption keys\n * The decryption key is derived from the recovery codes (machine-generated mnemonic)\n *\n * @param recoveryCodes - The user's recovery codes\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @returns The encryption keys\n */\nexport async function openRecoveryKeystore(\n  recoveryCodes: string,\n  encryptedKeystore: EncryptedKeystore,\n): Promise<HybridKeyPair> {\n  try {\n    if (encryptedKeystore.type !== KeystoreType.RECOVERY) {\n      throw new Error('Input is invalid');\n    }\n    const recoveryKey = await deriveRecoveryKey(recoveryCodes);\n    const keys = await decryptKeystoreContent(recoveryKey, encryptedKeystore);\n    return keys;\n  } catch (error) {\n    throw new FailedToOpenRecoveryKeyStore(error instanceof Error ? error.message : String(error));\n  }\n}\n\n/**\n * Re-encrypts the encryption keystore with a new password\n * The decryption key is derived from the user password\n *\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @param oldPassword - The user's old password\n * @param newPassword - The user's new password\n * @param oldSalt - The keystore's old salt\n * @returns The keys, re-encrypted keystore, and new salt\n */\nexport async function changePasswordForEncryptionKeystore(\n  encryptedKeystore: EncryptedKeystore,\n  oldPassword: string,\n  newPassword: string,\n  oldSalt: Uint8Array,\n): Promise<{ keys: HybridKeyPair; newSalt: Uint8Array; newKeystore: EncryptedKeystore }> {\n  try {\n    if (encryptedKeystore.type !== KeystoreType.ENCRYPTION) {\n      throw new Error('Input is invalid');\n    }\n    const keys = await openEncryptionKeystore(encryptedKeystore, oldPassword, oldSalt);\n\n    const { secretKey, salt } = await deriveNewEncryptionKeystoreKey(newPassword);\n    const newKeystore = await encryptKeystoreContent(\n      secretKey,\n      keys,\n      encryptedKeystore.userEmail,\n      KeystoreType.ENCRYPTION,\n    );\n\n    return { newKeystore, newSalt: salt, keys };\n  } catch (error) {\n    throw new FailedToChangePasswordForKeyStore(error instanceof Error ? error.message : String(error));\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBA,eAAsB,uBACpB,WACA,MACA,WACA,MAC4B;AAC5B,KAAI;EACF,MAAM,MAAM,YAAY,YAAY,KAAK;AAUzC,SANoC;GAClC;GACA;GACA,WANgB,mBAAmB,KAAK,UAAU;GAOlD,qBAAqB,mBANI,MAAM,qBAAqB,WAAW,KAAK,WAAW,IAAI,CAMxB;GAC5D;UAEM,OAAO;AACd,QAAM,IAAI,MAAM,sCAAsC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;AAW3E,eAAsB,uBACpB,oBACA,mBACwB;AACxB,KAAI;EACF,MAAM,MAAM,YAAY,kBAAkB,YAAY,kBAAkB,KAAK;AAI7E,SAAO;GACL,WAJgB,mBAAmB,kBAAkB,UAAU;GAK/D,WAHgB,MAAM,qBAAqB,oBAD1B,mBAAmB,kBAAkB,oBAAoB,EACC,IAAI;GAIhF;UACM,OAAO;AACd,QAAM,IAAI,MAAM,sCAAsC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;AAU3E,eAAsB,kBAAkB,eAA4C;AAClF,QAAO,sBAAsB,eAAe,iBAAiB;;;;;;;;;AAoB/D,eAAsB,4BAA4B,UAAkB,MAAuC;AAEzG,QAAO,8BAA8B,sBADrB,MAAM,0BAA0B,UAAU,KAAK,CACI;;;;;;;;;AAUrE,eAAsB,+BACpB,UACsD;CACtD,MAAM,EAAE,KAAK,SAAS,MAAM,mBAAmB,SAAS;AAExD,QAAO;EAAE,WADS,8BAA8B,sBAAsB,IAAI;EACtD;EAAM;;;;;AC5G5B,IAAa,0BAAb,MAAa,gCAAgC,MAAM;CACjD,YAAY,UAAmB;AAC7B,QAAM,yDAAyD,SAAS;AAExE,SAAO,eAAe,MAAM,wBAAwB,UAAU;;;AAIlE,IAAa,iCAAb,MAAa,uCAAuC,MAAM;CACxD,YAAY,UAAmB;AAC7B,QAAM,yCAAyC,SAAS;AAExD,SAAO,eAAe,MAAM,+BAA+B,UAAU;;;AAIzE,IAAa,+BAAb,MAAa,qCAAqC,MAAM;CACtD,YAAY,UAAmB;AAC7B,QAAM,uCAAuC,SAAS;AAEtD,SAAO,eAAe,MAAM,6BAA6B,UAAU;;;AAIvE,IAAa,oCAAb,MAAa,0CAA0C,MAAM;CAC3D,YAAY,UAAmB;AAC7B,QAAM,mCAAmC,SAAS;AAElD,SAAO,eAAe,MAAM,kCAAkC,UAAU;;;;;;;;;;;;;;;;;ACA5E,eAAsB,qCACpB,WACA,UAOC;AACD,KAAI;EACF,MAAM,OAAO,eAAe;EAE5B,MAAM,EAAE,WAAW,SAAS,MAAM,+BAA+B,SAAS;EAC1E,MAAM,qBAAqB,MAAM,uBAAuB,WAAW,MAAM,WAAW,aAAa,WAAW;EAE5G,MAAM,gBAAgB,aAAa;AAInC,SAAO;GAAE;GAAoB,kBAFJ,MAAM,uBADX,MAAM,kBAAkB,cAAc,EACS,MAAM,WAAW,aAAa,SAAS;GAE3D;GAAe;GAAM;GAAM;UACnE,OAAO;AACd,QAAM,IAAI,wBAAwB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;;;;;;;;;;;AAa7F,eAAsB,uBACpB,mBACA,UACA,MACwB;AACxB,KAAI;AACF,MAAI,kBAAkB,SAAS,aAAa,WAC1C,OAAM,IAAI,MAAM,mBAAmB;AAIrC,SADa,MAAM,uBADD,MAAM,4BAA4B,UAAU,KAAK,EACd,kBAAkB;UAEhE,OAAO;AACd,QAAM,IAAI,+BAA+B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;;;;;;;;;;AAYpG,eAAsB,qBACpB,eACA,mBACwB;AACxB,KAAI;AACF,MAAI,kBAAkB,SAAS,aAAa,SAC1C,OAAM,IAAI,MAAM,mBAAmB;AAIrC,SADa,MAAM,uBADC,MAAM,kBAAkB,cAAc,EACH,kBAAkB;UAElE,OAAO;AACd,QAAM,IAAI,6BAA6B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;;;;;;;;;;;;AAclG,eAAsB,oCACpB,mBACA,aACA,aACA,SACuF;AACvF,KAAI;AACF,MAAI,kBAAkB,SAAS,aAAa,WAC1C,OAAM,IAAI,MAAM,mBAAmB;EAErC,MAAM,OAAO,MAAM,uBAAuB,mBAAmB,aAAa,QAAQ;EAElF,MAAM,EAAE,WAAW,SAAS,MAAM,+BAA+B,YAAY;AAQ7E,SAAO;GAAE,aAPW,MAAM,uBACxB,WACA,MACA,kBAAkB,WAClB,aAAa,WACd;GAEqB,SAAS;GAAM;GAAM;UACpC,OAAO;AACd,QAAM,IAAI,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC"}