matrix-js-sdk 42.3.0 → 42.4.0

package/lib/oauth/fetch.js

@@ -0,0 +1,47 @@
+/*
+Copyright 2026 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { sanitizeUrlForLogs } from "../http-api/logging.js";
+import { Method } from "../http-api/method.js";
+/**
+ * Perform a `fetch` request, logging the request and response in the same manner as
+ * `FetchHttpApi` does for Client-Server API requests.
+ *
+ * Neither the request nor the response body is logged, as they routinely contain credentials.
+ * Query parameter values are redacted for the same reason.
+ *
+ * @internal
+ * @param logger - the logger to write the request and response lines to.
+ * @param resource - the URL to request.
+ * @param options - the options to pass to `fetch`.
+ * @returns the `Response`, whatever its status code.
+ * @throws rethrows whatever `fetch` threw, having logged it.
+ */
+export async function fetchWithLogging(logger, resource, options = {}) {
+  const method = options.method ?? Method.Get;
+  const urlForLogs = sanitizeUrlForLogs(resource);
+  logger.debug(`OAuth2: --> ${method} ${urlForLogs}`);
+  const start = Date.now();
+  try {
+    const res = await globalThis.fetch(resource, options);
+    logger.debug(`OAuth2: <-- ${method} ${urlForLogs} [${Date.now() - start}ms ${res.status}]`);
+    return res;
+  } catch (e) {
+    logger.debug(`OAuth2: <-- ${method} ${urlForLogs} [${Date.now() - start}ms ${e}]`);
+    throw e;
+  }
+}
+//# sourceMappingURL=fetch.js.map

package/lib/oauth/fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.js","names":[],"sources":["../../src/oauth/fetch.ts"],"sourcesContent":["/*\nCopyright 2026 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport { sanitizeUrlForLogs } from \"../http-api/logging.ts\";\nimport { Method } from \"../http-api/method.ts\";\nimport { type Logger } from \"../logger.ts\";\n\n/**\n * Perform a `fetch` request, logging the request and response in the same manner as\n * `FetchHttpApi` does for Client-Server API requests.\n *\n * Neither the request nor the response body is logged, as they routinely contain credentials.\n * Query parameter values are redacted for the same reason.\n *\n * @internal\n * @param logger - the logger to write the request and response lines to.\n * @param resource - the URL to request.\n * @param options - the options to pass to `fetch`.\n * @returns the `Response`, whatever its status code.\n * @throws rethrows whatever `fetch` threw, having logged it.\n */\nexport async function fetchWithLogging(\n    logger: Logger,\n    resource: URL | string,\n    options: RequestInit = {},\n): Promise<Response> {\n    const method = options.method ?? Method.Get;\n    const urlForLogs = sanitizeUrlForLogs(resource);\n\n    logger.debug(`OAuth2: --> ${method} ${urlForLogs}`);\n\n    const start = Date.now();\n    try {\n        const res = await globalThis.fetch(resource, options);\n        logger.debug(`OAuth2: <-- ${method} ${urlForLogs} [${Date.now() - start}ms ${res.status}]`);\n        return res;\n    } catch (e) {\n        logger.debug(`OAuth2: <-- ${method} ${urlForLogs} [${Date.now() - start}ms ${e}]`);\n        throw e;\n    }\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAAS,kBAAkB,QAAQ,wBAAwB;AAC3D,SAAS,MAAM,QAAQ,uBAAuB;AAG9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAe,gBAAgB,CAClC,MAAc,EACd,QAAsB,EACtB,OAAoB,GAAG,CAAC,CAAC,EACR;EACjB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG;EAC3C,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC;EAE/C,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,IAAI,UAAU,EAAE,CAAC;EAEnD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;EACxB,IAAI;IACA,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,IAAI,UAAU,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC;IAC3F,OAAO,GAAG;EACd,CAAC,CAAC,OAAO,CAAC,EAAE;IACR,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,IAAI,UAAU,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC;IAClF,MAAM,CAAC;EACX;AACJ","ignoreList":[]}

package/lib/oauth/index.d.ts

@@ -1,6 +1,7 @@
 import { type BearerTokenResponse, type DeviceAccessTokenError, type DeviceAccessTokenResponse, type DeviceAuthorizationResponse } from "./authorize.ts";
 import type { ValidatedAuthMetadata } from "./discover.ts";
 import { type OAuthRegistrationRequest } from "./register.ts";
+import { type Logger } from "../logger.ts";
 export * from "./authorize.ts";
 export * from "./error.ts";
 export * from "./register.ts";
@@ -21,18 +22,26 @@ type Context = {
 };
 export declare class OAuth2 {
     readonly metadata: ValidatedAuthMetadata;
+    private readonly logger;
     /**
      * Attempts dynamic registration against the configured registration endpoint.
      * Will ignore any URIs that do not use client_uri as a common base as per the spec.
      * @param authMetadata - Auth config from {@link MatrixClient.getAuthMetadata}
      * @param clientMetadata - The metadata for the client which to register,
      *     grant_types & response_types & token_endpoint_auth_method will be sanely calculated if omitted.
+     * @param logger - Optional logger to use for the request, defaults to the root logger of the js-sdk.
      * @returns Promise<string> resolved with registered clientId
      * @throws when registration is not supported, on failed request or invalid response
      */
-    static registerClient(authMetadata: ValidatedAuthMetadata, clientMetadata: OAuthRegistrationRequest): Promise<string>;
+    static registerClient(authMetadata: ValidatedAuthMetadata, clientMetadata: OAuthRegistrationRequest, logger?: Logger): Promise<string>;
     readonly context: Required<Context>;
-    constructor(metadata: ValidatedAuthMetadata, context: Context);
+    /**
+     * @param metadata - The validated OAuth 2.0 metadata for the Identity Provider.
+     * @param context - The persistent context needed for the OAuth flows.
+     * @param logger - Optional logger to use for the requests made by this instance,
+     *     defaults to the root logger of the js-sdk.
+     */
+    constructor(metadata: ValidatedAuthMetadata, context: Context, logger?: Logger);
     /**
      * Generate a URL to attempt authorization with the OP
      * See https://spec.matrix.org/v1.18/client-server-api/#authorization-code-flow
@@ -82,6 +91,10 @@ export declare class OAuth2 {
      *   or an error response if the user denies authorization or the device code expires.
      */
     waitForDeviceAuthorizationGrant(session: DeviceAuthorizationResponse): Promise<DeviceAccessTokenResponse | DeviceAccessTokenError>;
+    /**
+     * Make a request to one of the OAuth 2.0 endpoints, throwing if it responds with an error.
+     * @returns the {@link Response}, for the caller to parse if the endpoint returns a body.
+     */
     private fetch;
 }
 //# sourceMappingURL=index.d.ts.map

package/lib/oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAgBA,OAAO,EACH,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAMnC,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAEH,KAAK,wBAAwB,EAGhC,MAAM,eAAe,CAAC;AASvB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,eAAe,CAAC;AAE9B;;GAEG;AACH,KAAK,OAAO,GAAG;IACX,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,qBAAa,MAAM;aA0EK,QAAQ,EAAE,qBAAqB;IAzEnD;;;;;;;;OAQG;IACH,OAAoB,cAAc,CAC9B,YAAY,EAAE,qBAAqB,EACnC,cAAc,EAAE,wBAAwB,GACzC,OAAO,CAAC,MAAM,CAAC,CAwDjB;IAED,SAAgB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE3C,YACoB,QAAQ,EAAE,qBAAqB,EAC/C,OAAO,EAAE,OAAO,EAQnB;IAED;;;;;;;;;;OAUG;IACU,iCAAiC,CAC1C,KAAK,EAAE,MAAM,EACb,YAAY,GAAE,UAAU,GAAG,OAAoB,EAC/C,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAkBjB;IAED;;;;;;;;;;OAUG;IACU,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAatF;IAED;;;OAGG;IACU,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAWxF;IAED;;;;OAIG;IACU,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAY9F;IAED;;;;;OAKG;IACU,6BAA6B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAM/F;IAED;;;;;OAKG;IACU,+BAA+B,CACxC,OAAO,EAAE,2BAA2B,GACrC,OAAO,CAAC,yBAAyB,GAAG,sBAAsB,CAAC,CAM7D;YAEa,KAAK;CAsCtB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAgBA,OAAO,EACH,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAMnC,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAEH,KAAK,wBAAwB,EAGhC,MAAM,eAAe,CAAC;AAIvB,OAAO,EAAE,KAAK,MAAM,EAAwB,MAAM,cAAc,CAAC;AAMjE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,eAAe,CAAC;AAE9B;;GAEG;AACH,KAAK,OAAO,GAAG;IACX,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,qBAAa,MAAM;aAkFK,QAAQ,EAAE,qBAAqB;IAE/C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAnF3B;;;;;;;;;OASG;IACH,OAAoB,cAAc,CAC9B,YAAY,EAAE,qBAAqB,EACnC,cAAc,EAAE,wBAAwB,EACxC,MAAM,GAAE,MAAmB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAwDjB;IAED,SAAgB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE3C;;;;;OAKG;IACH,YACoB,QAAQ,EAAE,qBAAqB,EAC/C,OAAO,EAAE,OAAO,EACC,MAAM,GAAE,MAAmB,EAQ/C;IAED;;;;;;;;;;OAUG;IACU,iCAAiC,CAC1C,KAAK,EAAE,MAAM,EACb,YAAY,GAAE,UAAU,GAAG,OAAoB,EAC/C,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAkBjB;IAED;;;;;;;;;;OAUG;IACU,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CActF;IAED;;;OAGG;IACU,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAYxF;IAED;;;;OAIG;IACU,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAa9F;IAED;;;;;OAKG;IACU,6BAA6B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAO/F;IAED;;;;;OAKG;IACU,+BAA+B,CACxC,OAAO,EAAE,2BAA2B,GACrC,OAAO,CAAC,yBAAyB,GAAG,sBAAsB,CAAC,CAO7D;IAED;;;OAGG;YACW,KAAK;CAsCtB"}

package/lib/oauth/index.js

@@ -21,7 +21,8 @@ import { OAuthGrantType, urlHasCommonBase, validateRegistrationResponse } from "
 import { encodeUnpaddedBase64Url } from "../base64.js";
 import { sha256 } from "../digest.js";
 import { HTTPError, isMatrixErrorResponse, MatrixError, Method } from "../http-api/index.js";
-import { logger } from "../logger.js";
+import { logger as rootLogger } from "../logger.js";
+import { fetchWithLogging } from "./fetch.js";
 import { isOAuth2ErrorResponse, OAuth2Error, OAuth2HTTPError } from "./error.js";
 import { secureRandomString } from "../randomstring.js";
 export * from "./authorize.js";
@@ -41,10 +42,11 @@ export class OAuth2 {
    * @param authMetadata - Auth config from {@link MatrixClient.getAuthMetadata}
    * @param clientMetadata - The metadata for the client which to register,
    *     grant_types & response_types & token_endpoint_auth_method will be sanely calculated if omitted.
+   * @param logger - Optional logger to use for the request, defaults to the root logger of the js-sdk.
    * @returns Promise<string> resolved with registered clientId
    * @throws when registration is not supported, on failed request or invalid response
    */
-  static async registerClient(authMetadata, clientMetadata) {
+  static async registerClient(authMetadata, clientMetadata, logger = rootLogger) {
     const defaultGrantTypes = [OAuthGrantType.AuthorizationCode, OAuthGrantType.RefreshToken];
     // ask for device authorization grant if supported
     if (authMetadata.grant_types_supported.includes(OAuthGrantType.DeviceAuthorization)) {
@@ -66,7 +68,7 @@ export class OAuth2 {
       tos_uri: urlHasCommonBase(commonBase, clientMetadata.tos_uri) ? clientMetadata.tos_uri : undefined
     });
     try {
-      const response = await fetch(authMetadata.registration_endpoint, {
+      const response = await fetchWithLogging(logger, authMetadata.registration_endpoint, {
         method: Method.Post,
         headers: {
           "Accept": "application/json",
@@ -93,9 +95,16 @@ export class OAuth2 {
       }
     }
   }
-  constructor(metadata, context) {
+  /**
+   * @param metadata - The validated OAuth 2.0 metadata for the Identity Provider.
+   * @param context - The persistent context needed for the OAuth flows.
+   * @param logger - Optional logger to use for the requests made by this instance,
+   *     defaults to the root logger of the js-sdk.
+   */
+  constructor(metadata, context, logger = rootLogger) {
     _defineProperty(this, "context", void 0);
     this.metadata = metadata;
+    this.logger = logger;
     this.context = {
       clientId: context.clientId,
       redirectUri: context.redirectUri,
@@ -150,7 +159,8 @@ export class OAuth2 {
     params.append("code_verifier", this.context.codeVerifier);
     params.append("redirect_uri", this.context.redirectUri);
     params.append("code", code);
-    const tokenResponse = await this.fetch("token", params, OAuth2Error.CodeExchangeFailed);
+    const res = await this.fetch("token", params, OAuth2Error.CodeExchangeFailed);
+    const tokenResponse = await res.json();
 
     // throws when response is invalid
     validateBearerTokenResponse(tokenResponse);
@@ -166,7 +176,8 @@ export class OAuth2 {
     params.append("grant_type", "refresh_token");
     params.append("client_id", this.context.clientId);
     params.append("refresh_token", refreshToken);
-    const tokenResponse = await this.fetch("token", params, OAuth2Error.RefreshTokenFailed);
+    const res = await this.fetch("token", params, OAuth2Error.RefreshTokenFailed);
+    const tokenResponse = await res.json();
 
     // throws when response is invalid
     validateBearerTokenResponse(tokenResponse);
@@ -185,9 +196,12 @@ export class OAuth2 {
     if (type) {
       params.append("token_type_hint", type);
     }
+
+    // [RFC 7009 section 2.2](https://www.rfc-editor.org/rfc/rfc7009.html#section-2.2) says:
+    // > The content of the response body is ignored by the client as all
+    // > necessary information is conveyed in the response code.
+    // so, we don't do anything with the response body.
     await this.fetch("revocation", params, OAuth2Error.RevokeTokenFailed);
-    const headers = new Headers();
-    headers.set("Content-Type", "application/x-www-form-urlencoded");
   }
 
   /**
@@ -200,7 +214,8 @@ export class OAuth2 {
     return startDeviceAuthorization({
       scope: scope ?? generateScope(this.context.deviceId),
       metadata: this.metadata,
-      clientId: this.context.clientId
+      clientId: this.context.clientId,
+      logger: this.logger
     });
   }
 
@@ -214,12 +229,18 @@ export class OAuth2 {
     return waitForDeviceAuthorization({
       session,
       metadata: this.metadata,
-      clientId: this.context.clientId
+      clientId: this.context.clientId,
+      logger: this.logger
     });
   }
+
+  /**
+   * Make a request to one of the OAuth 2.0 endpoints, throwing if it responds with an error.
+   * @returns the {@link Response}, for the caller to parse if the endpoint returns a body.
+   */
   async fetch(target, params, error) {
     const url = this.metadata[`${target}_endpoint`];
-    const res = await fetch(url, {
+    const res = await fetchWithLogging(this.logger, url, {
       method: Method.Post,
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
@@ -247,7 +268,7 @@ export class OAuth2 {
       }
       throw new HTTPError(error, res.status, res.headers);
     }
-    return await res.json();
+    return res;
   }
 }
 //# sourceMappingURL=index.js.map

package/lib/oauth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../src/oauth/index.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport {\n    type BearerTokenResponse,\n    type DeviceAccessTokenError,\n    type DeviceAccessTokenResponse,\n    type DeviceAuthorizationResponse,\n    generateScope,\n    normalizeBearerTokenResponseTokenType,\n    startDeviceAuthorization,\n    validateBearerTokenResponse,\n    waitForDeviceAuthorization,\n} from \"./authorize.ts\";\nimport type { ValidatedAuthMetadata } from \"./discover.ts\";\nimport {\n    OAuthGrantType,\n    type OAuthRegistrationRequest,\n    urlHasCommonBase,\n    validateRegistrationResponse,\n} from \"./register.ts\";\nimport { encodeUnpaddedBase64Url } from \"../base64.ts\";\nimport { sha256 } from \"../digest.ts\";\nimport { HTTPError, isMatrixErrorResponse, MatrixError, Method } from \"../http-api/index.ts\";\nimport { logger } from \"../logger.ts\";\nimport { isOAuth2ErrorResponse, OAuth2Error, OAuth2HTTPError } from \"./error.ts\";\nimport { secureRandomString } from \"../randomstring.ts\";\nimport { type NonEmptyArray } from \"../@types/common.ts\";\n\nexport * from \"./authorize.ts\";\nexport * from \"./error.ts\";\nexport * from \"./register.ts\";\nexport * from \"./tokenRefresher.ts\";\nexport * from \"./discover.ts\";\n\n/**\n * Type representing the persistent context needed for typical OAuth flows\n */\ntype Context = {\n    /** The OAuth client ID */\n    clientId: string;\n    /** The desired device ID */\n    deviceId?: string;\n    /** The seed used to generate the challenge code */\n    codeVerifier?: string;\n    /** The URI to redirect the user to with credentials after auth */\n    redirectUri: string;\n};\n\nexport class OAuth2 {\n    /**\n     * Attempts dynamic registration against the configured registration endpoint.\n     * Will ignore any URIs that do not use client_uri as a common base as per the spec.\n     * @param authMetadata - Auth config from {@link MatrixClient.getAuthMetadata}\n     * @param clientMetadata - The metadata for the client which to register,\n     *     grant_types & response_types & token_endpoint_auth_method will be sanely calculated if omitted.\n     * @returns Promise<string> resolved with registered clientId\n     * @throws when registration is not supported, on failed request or invalid response\n     */\n    public static async registerClient(\n        authMetadata: ValidatedAuthMetadata,\n        clientMetadata: OAuthRegistrationRequest,\n    ): Promise<string> {\n        const defaultGrantTypes: NonEmptyArray<string> = [\n            OAuthGrantType.AuthorizationCode,\n            OAuthGrantType.RefreshToken,\n        ];\n        // ask for device authorization grant if supported\n        if (authMetadata.grant_types_supported.includes(OAuthGrantType.DeviceAuthorization)) {\n            defaultGrantTypes.push(OAuthGrantType.DeviceAuthorization);\n        }\n\n        const grantTypes = clientMetadata.grant_types ?? defaultGrantTypes;\n        if (grantTypes.some((scope) => !authMetadata.grant_types_supported.includes(scope))) {\n            throw new Error(OAuth2Error.DynamicRegistrationNotSupported);\n        }\n\n        const commonBase = new URL(clientMetadata.client_uri);\n\n        const request: OAuthRegistrationRequest = {\n            // Apply some defaults\n            response_types: [\"code\"],\n            token_endpoint_auth_method: \"none\",\n            ...clientMetadata,\n            grant_types: grantTypes,\n            logo_uri: urlHasCommonBase(commonBase, clientMetadata.logo_uri) ? clientMetadata.logo_uri : undefined,\n            policy_uri: urlHasCommonBase(commonBase, clientMetadata.policy_uri) ? clientMetadata.policy_uri : undefined,\n            tos_uri: urlHasCommonBase(commonBase, clientMetadata.tos_uri) ? clientMetadata.tos_uri : undefined,\n        };\n\n        try {\n            const response = await fetch(authMetadata.registration_endpoint, {\n                method: Method.Post,\n                headers: {\n                    \"Accept\": \"application/json\",\n                    \"Content-Type\": \"application/json\",\n                },\n                body: JSON.stringify(request),\n            });\n\n            if (response.status >= 400) {\n                throw new Error(OAuth2Error.DynamicRegistrationFailed);\n            }\n\n            const registrationResponse = await response.json();\n            if (validateRegistrationResponse(registrationResponse)) {\n                return registrationResponse.client_id;\n            }\n\n            throw new Error(OAuth2Error.DynamicRegistrationInvalid);\n        } catch (error) {\n            if (Object.values(OAuth2Error).includes((error as Error).message as OAuth2Error)) {\n                throw error;\n            } else {\n                logger.error(\"Dynamic registration request failed\", error);\n                throw new Error(OAuth2Error.DynamicRegistrationFailed, { cause: error });\n            }\n        }\n    }\n\n    public readonly context: Required<Context>;\n\n    public constructor(\n        public readonly metadata: ValidatedAuthMetadata,\n        context: Context,\n    ) {\n        this.context = {\n            clientId: context.clientId,\n            redirectUri: context.redirectUri,\n            deviceId: context.deviceId ?? secureRandomString(10),\n            codeVerifier: context.codeVerifier ?? secureRandomString(96),\n        };\n    }\n\n    /**\n     * Generate a URL to attempt authorization with the OP\n     * See https://spec.matrix.org/v1.18/client-server-api/#authorization-code-flow\n     * @param state - A unique opaque identifier, like a transaction ID,\n     *     that will allow the client to maintain state between the authorization request and the callback.\n     *     The app should use this to key the storage for where the rest of the auth context is saved.\n     * @param responseMode - The manner in which the IdP should send the secrets back to the app. Defaults to `fragment` for privacy.\n     * @param prompt - Optional prompt parameter to pass to the IdP to signal intent, e.g. `create` for User registration.\n     * @param scope - The OAuth2 scope to request, will be generated based on the device ID if omitted.\n     * @returns a Promise with the url as a string\n     */\n    public async generateAuthorizationCodeGrantUrl(\n        state: string,\n        responseMode: \"fragment\" | \"query\" = \"fragment\",\n        prompt?: string,\n        scope?: string,\n    ): Promise<string> {\n        const challenge = encodeUnpaddedBase64Url(await sha256(this.context.codeVerifier));\n\n        const url = new URL(this.metadata.authorization_endpoint);\n        url.searchParams.set(\"response_type\", \"code\");\n        url.searchParams.set(\"response_mode\", responseMode);\n        url.searchParams.set(\"client_id\", this.context.clientId);\n        url.searchParams.set(\"redirect_uri\", this.context.redirectUri);\n        url.searchParams.set(\"scope\", scope ?? generateScope(this.context.deviceId));\n        url.searchParams.set(\"state\", state);\n        url.searchParams.set(\"code_challenge_method\", \"S256\");\n        url.searchParams.set(\"code_challenge\", challenge);\n\n        if (prompt) {\n            url.searchParams.set(\"prompt\", prompt);\n        }\n\n        return url.toString();\n    }\n\n    /**\n     * Attempt to exchange authorization code for bearer token.\n     *\n     * Takes the authorization code returned by the OAuth2 Provider via the authorization URL, and makes a\n     * request to the Token Endpoint, to obtain the access token, refresh token, etc.\n     *\n     * @param code - authorization code as returned by IdP during authorization\n     * @returns a validated bearer token response\n     * @throws An `Error` with `message` set to an entry in {@link OAuth2Error},\n     *      when the request fails, or the returned token response is invalid.\n     */\n    public async completeAuthorizationCodeGrant(code: string): Promise<BearerTokenResponse> {\n        const params = new URLSearchParams();\n        params.append(\"grant_type\", \"authorization_code\");\n        params.append(\"client_id\", this.context.clientId);\n        params.append(\"code_verifier\", this.context.codeVerifier);\n        params.append(\"redirect_uri\", this.context.redirectUri);\n        params.append(\"code\", code);\n\n        const tokenResponse = await this.fetch(\"token\", params, OAuth2Error.CodeExchangeFailed);\n\n        // throws when response is invalid\n        validateBearerTokenResponse(tokenResponse);\n        return normalizeBearerTokenResponseTokenType(tokenResponse);\n    }\n\n    /**\n     * Refresh the access token using the given refresh token and the refresh token grant\n     * @param refreshToken - the token to use to refresh the access token\n     */\n    public async performRefreshTokenGrant(refreshToken: string): Promise<BearerTokenResponse> {\n        const params = new URLSearchParams();\n        params.append(\"grant_type\", \"refresh_token\");\n        params.append(\"client_id\", this.context.clientId);\n        params.append(\"refresh_token\", refreshToken);\n\n        const tokenResponse = await this.fetch(\"token\", params, OAuth2Error.RefreshTokenFailed);\n\n        // throws when response is invalid\n        validateBearerTokenResponse(tokenResponse);\n        return normalizeBearerTokenResponseTokenType(tokenResponse);\n    }\n\n    /**\n     * Revokes the given token\n     * @param token - the token to remove\n     * @param type - the type of token, acts as a hint to the IdP\n     */\n    public async revokeToken(token: string, type?: \"access_token\" | \"refresh_token\"): Promise<void> {\n        const params = new URLSearchParams();\n        params.append(\"token\", token);\n        params.append(\"client_id\", this.context.clientId);\n        if (type) {\n            params.append(\"token_type_hint\", type);\n        }\n\n        await this.fetch(\"revocation\", params, OAuth2Error.RevokeTokenFailed);\n\n        const headers = new Headers();\n        headers.set(\"Content-Type\", \"application/x-www-form-urlencoded\");\n    }\n\n    /**\n     * Begin OAuth2 device authorization flow.\n     * @param scope - the scope to request for authorization.\n     * @returns a promise that resolves to a device access token response,\n     *   or an error response if the user denies authorization or the device code expires.\n     */\n    public async startDeviceAuthorizationGrant(scope?: string): Promise<DeviceAuthorizationResponse> {\n        return startDeviceAuthorization({\n            scope: scope ?? generateScope(this.context.deviceId),\n            metadata: this.metadata,\n            clientId: this.context.clientId,\n        });\n    }\n\n    /**\n     * Polls the OAuth2 token endpoint until we get a device access token response, or encounter an unrecoverable error.\n     * @param session - The session returned from a previous call to {@link OAuth2.startDeviceAuthorizationGrant}.\n     * @returns a promise that resolves to a device access token response,\n     *   or an error response if the user denies authorization or the device code expires.\n     */\n    public async waitForDeviceAuthorizationGrant(\n        session: DeviceAuthorizationResponse,\n    ): Promise<DeviceAccessTokenResponse | DeviceAccessTokenError> {\n        return waitForDeviceAuthorization({\n            session,\n            metadata: this.metadata,\n            clientId: this.context.clientId,\n        });\n    }\n\n    private async fetch(\n        target: \"token\" | \"registration\" | \"revocation\",\n        params: URLSearchParams,\n        error: OAuth2Error,\n    ): Promise<unknown> {\n        const url = this.metadata[`${target}_endpoint`];\n        const res = await fetch(url, {\n            method: Method.Post,\n            headers: {\n                \"Content-Type\": \"application/x-www-form-urlencoded\",\n                \"Accept\": \"application/json\",\n            },\n            body: params,\n        });\n\n        if (res.status >= 400) {\n            let body: unknown;\n            try {\n                body = await res.json();\n            } catch {\n                // The endpoint didn't give us a JSON body, so we can't determine the error type. We'll throw a generic\n                // HTTPError below.\n            }\n            // Because the Matrix C-S API error response format is so similar to the OAuth 2.0 error response format\n            // the ordering of these checks is important. We want to check for a Matrix error response first, and only\n            // if it isn't one do we check for an OAuth 2.0 error response.\n            // This essentially relies on `errcode` not being present in an OAuth 2.0 error response.\n            if (isMatrixErrorResponse(body)) {\n                throw new MatrixError(body, res.status, undefined, undefined, res.headers);\n            }\n            if (isOAuth2ErrorResponse(body)) {\n                throw new OAuth2HTTPError(error, res.status, res.headers, body);\n            }\n            throw new HTTPError(error, res.status, res.headers);\n        }\n\n        return await res.json();\n    }\n}\n"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAKI,aAAa,EACb,qCAAqC,EACrC,wBAAwB,EACxB,2BAA2B,EAC3B,0BAA0B,QACvB,gBAAgB;AAEvB,SACI,cAAc,EAEd,gBAAgB,EAChB,4BAA4B,QACzB,eAAe;AACtB,SAAS,uBAAuB,QAAQ,cAAc;AACtD,SAAS,MAAM,QAAQ,cAAc;AACrC,SAAS,SAAS,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,QAAQ,sBAAsB;AAC5F,SAAS,MAAM,QAAQ,cAAc;AACrC,SAAS,qBAAqB,EAAE,WAAW,EAAE,eAAe,QAAQ,YAAY;AAChF,SAAS,kBAAkB,QAAQ,oBAAoB;AAGvD,cAAc,gBAAgB;AAC9B,cAAc,YAAY;AAC1B,cAAc,eAAe;AAC7B,cAAc,qBAAqB;AACnC,cAAc,eAAe;;AAE7B;AACA;AACA;;AAYA,OAAO,MAAM,MAAM,CAAC;EAChB;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACI,aAAoB,cAAc,CAC9B,YAAmC,EACnC,cAAwC,EACzB;IACf,MAAM,iBAAwC,GAAG,CAC7C,cAAc,CAAC,iBAAiB,EAChC,cAAc,CAAC,YAAY,CAC9B;IACD;IACA,IAAI,YAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAAE;MACjF,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC;IAC9D;IAEA,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,IAAI,iBAAiB;IAClE,IAAI,UAAU,CAAC,IAAI,CAAE,KAAK,IAAK,CAAC,YAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE;MACjF,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,+BAA+B,CAAC;IAChE;IAEA,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC;IAErD,MAAM,OAAiC;MACnC;MACA,cAAc,EAAE,CAAC,MAAM,CAAC;MACxB,0BAA0B,EAAE;IAAM,GAC/B,cAAc;MACjB,WAAW,EAAE,UAAU;MACvB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,EAAE,cAAc,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,QAAQ,GAAG,SAAS;MACrG,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,cAAc,CAAC,UAAU,GAAG,SAAS;MAC3G,OAAO,EAAE,gBAAgB,CAAC,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC,OAAO,GAAG;IAAS,EACrG;IAED,IAAI;MACA,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,qBAAqB,EAAE;QAC7D,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,OAAO,EAAE;UACL,QAAQ,EAAE,kBAAkB;UAC5B,cAAc,EAAE;QACpB,CAAC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;MAChC,CAAC,CAAC;MAEF,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE;QACxB,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,yBAAyB,CAAC;MAC1D;MAEA,MAAM,oBAAoB,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;MAClD,IAAI,4BAA4B,CAAC,oBAAoB,CAAC,EAAE;QACpD,OAAO,oBAAoB,CAAC,SAAS;MACzC;MAEA,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,0BAA0B,CAAC;IAC3D,CAAC,CAAC,OAAO,KAAK,EAAE;MACZ,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAE,KAAK,CAAW,OAAsB,CAAC,EAAE;QAC9E,MAAM,KAAK;MACf,CAAC,MAAM;QACH,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,yBAAyB,EAAE;UAAE,KAAK,EAAE;QAAM,CAAC,CAAC;MAC5E;IACJ;EACJ;EAIO,WAAW,CACE,QAA+B,EAC/C,OAAgB,EAClB;IAAA;IAAA,KAFkB,QAA+B,GAA/B,QAA+B;IAG/C,IAAI,CAAC,OAAO,GAAG;MACX,QAAQ,EAAE,OAAO,CAAC,QAAQ;MAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;MAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAC,EAAE,CAAC;MACpD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,kBAAkB,CAAC,EAAE;IAC/D,CAAC;EACL;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACI,MAAa,iCAAiC,CAC1C,KAAa,EACb,YAAkC,GAAG,UAAU,EAC/C,MAAe,EACf,KAAc,EACC;IACf,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAElF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC;IAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;IAC9D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;IACpC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAEjD,IAAI,MAAM,EAAE;MACR,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1C;IAEA,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;EACzB;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACI,MAAa,8BAA8B,CAAC,IAAY,EAAgC;IACpF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC;IACjD,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IACjD,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;IACzD,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;IACvD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAE3B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,kBAAkB,CAAC;;IAEvF;IACA,2BAA2B,CAAC,aAAa,CAAC;IAC1C,OAAO,qCAAqC,CAAC,aAAa,CAAC;EAC/D;;EAEA;AACJ;AACA;AACA;EACI,MAAa,wBAAwB,CAAC,YAAoB,EAAgC;IACtF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;IAC5C,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IACjD,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC;IAE5C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,kBAAkB,CAAC;;IAEvF;IACA,2BAA2B,CAAC,aAAa,CAAC;IAC1C,OAAO,qCAAqC,CAAC,aAAa,CAAC;EAC/D;;EAEA;AACJ;AACA;AACA;AACA;EACI,MAAa,WAAW,CAAC,KAAa,EAAE,IAAuC,EAAiB;IAC5F,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;IAC7B,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IACjD,IAAI,IAAI,EAAE;MACN,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC;IAC1C;IAEA,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,iBAAiB,CAAC;IAErE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,mCAAmC,CAAC;EACpE;;EAEA;AACJ;AACA;AACA;AACA;AACA;EACI,MAAa,6BAA6B,CAAC,KAAc,EAAwC;IAC7F,OAAO,wBAAwB,CAAC;MAC5B,KAAK,EAAE,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;MACpD,QAAQ,EAAE,IAAI,CAAC,QAAQ;MACvB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;IAC3B,CAAC,CAAC;EACN;;EAEA;AACJ;AACA;AACA;AACA;AACA;EACI,MAAa,+BAA+B,CACxC,OAAoC,EACuB;IAC3D,OAAO,0BAA0B,CAAC;MAC9B,OAAO;MACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;MACvB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;IAC3B,CAAC,CAAC;EACN;EAEA,MAAc,KAAK,CACf,MAA+C,EAC/C,MAAuB,EACvB,KAAkB,EACF;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,MAAM,WAAW,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;MACzB,MAAM,EAAE,MAAM,CAAC,IAAI;MACnB,OAAO,EAAE;QACL,cAAc,EAAE,mCAAmC;QACnD,QAAQ,EAAE;MACd,CAAC;MACD,IAAI,EAAE;IACV,CAAC,CAAC;IAEF,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE;MACnB,IAAI,IAAa;MACjB,IAAI;QACA,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;MAC3B,CAAC,CAAC,MAAM;QACJ;QACA;MAAA;MAEJ;MACA;MACA;MACA;MACA,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE;QAC7B,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC;MAC9E;MACA,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE;QAC7B,MAAM,IAAI,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;MACnE;MACA,MAAM,IAAI,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC;IACvD;IAEA,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;EAC3B;AACJ","ignoreList":[]}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/oauth/index.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport {\n    type BearerTokenResponse,\n    type DeviceAccessTokenError,\n    type DeviceAccessTokenResponse,\n    type DeviceAuthorizationResponse,\n    generateScope,\n    normalizeBearerTokenResponseTokenType,\n    startDeviceAuthorization,\n    validateBearerTokenResponse,\n    waitForDeviceAuthorization,\n} from \"./authorize.ts\";\nimport type { ValidatedAuthMetadata } from \"./discover.ts\";\nimport {\n    OAuthGrantType,\n    type OAuthRegistrationRequest,\n    urlHasCommonBase,\n    validateRegistrationResponse,\n} from \"./register.ts\";\nimport { encodeUnpaddedBase64Url } from \"../base64.ts\";\nimport { sha256 } from \"../digest.ts\";\nimport { HTTPError, isMatrixErrorResponse, MatrixError, Method } from \"../http-api/index.ts\";\nimport { type Logger, logger as rootLogger } from \"../logger.ts\";\nimport { fetchWithLogging } from \"./fetch.ts\";\nimport { isOAuth2ErrorResponse, OAuth2Error, OAuth2HTTPError } from \"./error.ts\";\nimport { secureRandomString } from \"../randomstring.ts\";\nimport { type NonEmptyArray } from \"../@types/common.ts\";\n\nexport * from \"./authorize.ts\";\nexport * from \"./error.ts\";\nexport * from \"./register.ts\";\nexport * from \"./tokenRefresher.ts\";\nexport * from \"./discover.ts\";\n\n/**\n * Type representing the persistent context needed for typical OAuth flows\n */\ntype Context = {\n    /** The OAuth client ID */\n    clientId: string;\n    /** The desired device ID */\n    deviceId?: string;\n    /** The seed used to generate the challenge code */\n    codeVerifier?: string;\n    /** The URI to redirect the user to with credentials after auth */\n    redirectUri: string;\n};\n\nexport class OAuth2 {\n    /**\n     * Attempts dynamic registration against the configured registration endpoint.\n     * Will ignore any URIs that do not use client_uri as a common base as per the spec.\n     * @param authMetadata - Auth config from {@link MatrixClient.getAuthMetadata}\n     * @param clientMetadata - The metadata for the client which to register,\n     *     grant_types & response_types & token_endpoint_auth_method will be sanely calculated if omitted.\n     * @param logger - Optional logger to use for the request, defaults to the root logger of the js-sdk.\n     * @returns Promise<string> resolved with registered clientId\n     * @throws when registration is not supported, on failed request or invalid response\n     */\n    public static async registerClient(\n        authMetadata: ValidatedAuthMetadata,\n        clientMetadata: OAuthRegistrationRequest,\n        logger: Logger = rootLogger,\n    ): Promise<string> {\n        const defaultGrantTypes: NonEmptyArray<string> = [\n            OAuthGrantType.AuthorizationCode,\n            OAuthGrantType.RefreshToken,\n        ];\n        // ask for device authorization grant if supported\n        if (authMetadata.grant_types_supported.includes(OAuthGrantType.DeviceAuthorization)) {\n            defaultGrantTypes.push(OAuthGrantType.DeviceAuthorization);\n        }\n\n        const grantTypes = clientMetadata.grant_types ?? defaultGrantTypes;\n        if (grantTypes.some((scope) => !authMetadata.grant_types_supported.includes(scope))) {\n            throw new Error(OAuth2Error.DynamicRegistrationNotSupported);\n        }\n\n        const commonBase = new URL(clientMetadata.client_uri);\n\n        const request: OAuthRegistrationRequest = {\n            // Apply some defaults\n            response_types: [\"code\"],\n            token_endpoint_auth_method: \"none\",\n            ...clientMetadata,\n            grant_types: grantTypes,\n            logo_uri: urlHasCommonBase(commonBase, clientMetadata.logo_uri) ? clientMetadata.logo_uri : undefined,\n            policy_uri: urlHasCommonBase(commonBase, clientMetadata.policy_uri) ? clientMetadata.policy_uri : undefined,\n            tos_uri: urlHasCommonBase(commonBase, clientMetadata.tos_uri) ? clientMetadata.tos_uri : undefined,\n        };\n\n        try {\n            const response = await fetchWithLogging(logger, authMetadata.registration_endpoint, {\n                method: Method.Post,\n                headers: {\n                    \"Accept\": \"application/json\",\n                    \"Content-Type\": \"application/json\",\n                },\n                body: JSON.stringify(request),\n            });\n\n            if (response.status >= 400) {\n                throw new Error(OAuth2Error.DynamicRegistrationFailed);\n            }\n\n            const registrationResponse = await response.json();\n            if (validateRegistrationResponse(registrationResponse)) {\n                return registrationResponse.client_id;\n            }\n\n            throw new Error(OAuth2Error.DynamicRegistrationInvalid);\n        } catch (error) {\n            if (Object.values(OAuth2Error).includes((error as Error).message as OAuth2Error)) {\n                throw error;\n            } else {\n                logger.error(\"Dynamic registration request failed\", error);\n                throw new Error(OAuth2Error.DynamicRegistrationFailed, { cause: error });\n            }\n        }\n    }\n\n    public readonly context: Required<Context>;\n\n    /**\n     * @param metadata - The validated OAuth 2.0 metadata for the Identity Provider.\n     * @param context - The persistent context needed for the OAuth flows.\n     * @param logger - Optional logger to use for the requests made by this instance,\n     *     defaults to the root logger of the js-sdk.\n     */\n    public constructor(\n        public readonly metadata: ValidatedAuthMetadata,\n        context: Context,\n        private readonly logger: Logger = rootLogger,\n    ) {\n        this.context = {\n            clientId: context.clientId,\n            redirectUri: context.redirectUri,\n            deviceId: context.deviceId ?? secureRandomString(10),\n            codeVerifier: context.codeVerifier ?? secureRandomString(96),\n        };\n    }\n\n    /**\n     * Generate a URL to attempt authorization with the OP\n     * See https://spec.matrix.org/v1.18/client-server-api/#authorization-code-flow\n     * @param state - A unique opaque identifier, like a transaction ID,\n     *     that will allow the client to maintain state between the authorization request and the callback.\n     *     The app should use this to key the storage for where the rest of the auth context is saved.\n     * @param responseMode - The manner in which the IdP should send the secrets back to the app. Defaults to `fragment` for privacy.\n     * @param prompt - Optional prompt parameter to pass to the IdP to signal intent, e.g. `create` for User registration.\n     * @param scope - The OAuth2 scope to request, will be generated based on the device ID if omitted.\n     * @returns a Promise with the url as a string\n     */\n    public async generateAuthorizationCodeGrantUrl(\n        state: string,\n        responseMode: \"fragment\" | \"query\" = \"fragment\",\n        prompt?: string,\n        scope?: string,\n    ): Promise<string> {\n        const challenge = encodeUnpaddedBase64Url(await sha256(this.context.codeVerifier));\n\n        const url = new URL(this.metadata.authorization_endpoint);\n        url.searchParams.set(\"response_type\", \"code\");\n        url.searchParams.set(\"response_mode\", responseMode);\n        url.searchParams.set(\"client_id\", this.context.clientId);\n        url.searchParams.set(\"redirect_uri\", this.context.redirectUri);\n        url.searchParams.set(\"scope\", scope ?? generateScope(this.context.deviceId));\n        url.searchParams.set(\"state\", state);\n        url.searchParams.set(\"code_challenge_method\", \"S256\");\n        url.searchParams.set(\"code_challenge\", challenge);\n\n        if (prompt) {\n            url.searchParams.set(\"prompt\", prompt);\n        }\n\n        return url.toString();\n    }\n\n    /**\n     * Attempt to exchange authorization code for bearer token.\n     *\n     * Takes the authorization code returned by the OAuth2 Provider via the authorization URL, and makes a\n     * request to the Token Endpoint, to obtain the access token, refresh token, etc.\n     *\n     * @param code - authorization code as returned by IdP during authorization\n     * @returns a validated bearer token response\n     * @throws An `Error` with `message` set to an entry in {@link OAuth2Error},\n     *      when the request fails, or the returned token response is invalid.\n     */\n    public async completeAuthorizationCodeGrant(code: string): Promise<BearerTokenResponse> {\n        const params = new URLSearchParams();\n        params.append(\"grant_type\", \"authorization_code\");\n        params.append(\"client_id\", this.context.clientId);\n        params.append(\"code_verifier\", this.context.codeVerifier);\n        params.append(\"redirect_uri\", this.context.redirectUri);\n        params.append(\"code\", code);\n\n        const res = await this.fetch(\"token\", params, OAuth2Error.CodeExchangeFailed);\n        const tokenResponse = await res.json();\n\n        // throws when response is invalid\n        validateBearerTokenResponse(tokenResponse);\n        return normalizeBearerTokenResponseTokenType(tokenResponse);\n    }\n\n    /**\n     * Refresh the access token using the given refresh token and the refresh token grant\n     * @param refreshToken - the token to use to refresh the access token\n     */\n    public async performRefreshTokenGrant(refreshToken: string): Promise<BearerTokenResponse> {\n        const params = new URLSearchParams();\n        params.append(\"grant_type\", \"refresh_token\");\n        params.append(\"client_id\", this.context.clientId);\n        params.append(\"refresh_token\", refreshToken);\n\n        const res = await this.fetch(\"token\", params, OAuth2Error.RefreshTokenFailed);\n        const tokenResponse = await res.json();\n\n        // throws when response is invalid\n        validateBearerTokenResponse(tokenResponse);\n        return normalizeBearerTokenResponseTokenType(tokenResponse);\n    }\n\n    /**\n     * Revokes the given token\n     * @param token - the token to remove\n     * @param type - the type of token, acts as a hint to the IdP\n     */\n    public async revokeToken(token: string, type?: \"access_token\" | \"refresh_token\"): Promise<void> {\n        const params = new URLSearchParams();\n        params.append(\"token\", token);\n        params.append(\"client_id\", this.context.clientId);\n        if (type) {\n            params.append(\"token_type_hint\", type);\n        }\n\n        // [RFC 7009 section 2.2](https://www.rfc-editor.org/rfc/rfc7009.html#section-2.2) says:\n        // > The content of the response body is ignored by the client as all\n        // > necessary information is conveyed in the response code.\n        // so, we don't do anything with the response body.\n        await this.fetch(\"revocation\", params, OAuth2Error.RevokeTokenFailed);\n    }\n\n    /**\n     * Begin OAuth2 device authorization flow.\n     * @param scope - the scope to request for authorization.\n     * @returns a promise that resolves to a device access token response,\n     *   or an error response if the user denies authorization or the device code expires.\n     */\n    public async startDeviceAuthorizationGrant(scope?: string): Promise<DeviceAuthorizationResponse> {\n        return startDeviceAuthorization({\n            scope: scope ?? generateScope(this.context.deviceId),\n            metadata: this.metadata,\n            clientId: this.context.clientId,\n            logger: this.logger,\n        });\n    }\n\n    /**\n     * Polls the OAuth2 token endpoint until we get a device access token response, or encounter an unrecoverable error.\n     * @param session - The session returned from a previous call to {@link OAuth2.startDeviceAuthorizationGrant}.\n     * @returns a promise that resolves to a device access token response,\n     *   or an error response if the user denies authorization or the device code expires.\n     */\n    public async waitForDeviceAuthorizationGrant(\n        session: DeviceAuthorizationResponse,\n    ): Promise<DeviceAccessTokenResponse | DeviceAccessTokenError> {\n        return waitForDeviceAuthorization({\n            session,\n            metadata: this.metadata,\n            clientId: this.context.clientId,\n            logger: this.logger,\n        });\n    }\n\n    /**\n     * Make a request to one of the OAuth 2.0 endpoints, throwing if it responds with an error.\n     * @returns the {@link Response}, for the caller to parse if the endpoint returns a body.\n     */\n    private async fetch(\n        target: \"token\" | \"registration\" | \"revocation\",\n        params: URLSearchParams,\n        error: OAuth2Error,\n    ): Promise<Response> {\n        const url = this.metadata[`${target}_endpoint`];\n        const res = await fetchWithLogging(this.logger, url, {\n            method: Method.Post,\n            headers: {\n                \"Content-Type\": \"application/x-www-form-urlencoded\",\n                \"Accept\": \"application/json\",\n            },\n            body: params,\n        });\n\n        if (res.status >= 400) {\n            let body: unknown;\n            try {\n                body = await res.json();\n            } catch {\n                // The endpoint didn't give us a JSON body, so we can't determine the error type. We'll throw a generic\n                // HTTPError below.\n            }\n            // Because the Matrix C-S API error response format is so similar to the OAuth 2.0 error response format\n            // the ordering of these checks is important. We want to check for a Matrix error response first, and only\n            // if it isn't one do we check for an OAuth 2.0 error response.\n            // This essentially relies on `errcode` not being present in an OAuth 2.0 error response.\n            if (isMatrixErrorResponse(body)) {\n                throw new MatrixError(body, res.status, undefined, undefined, res.headers);\n            }\n            if (isOAuth2ErrorResponse(body)) {\n                throw new OAuth2HTTPError(error, res.status, res.headers, body);\n            }\n            throw new HTTPError(error, res.status, res.headers);\n        }\n\n        return res;\n    }\n}\n"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAKI,aAAa,EACb,qCAAqC,EACrC,wBAAwB,EACxB,2BAA2B,EAC3B,0BAA0B,QACvB,gBAAgB;AAEvB,SACI,cAAc,EAEd,gBAAgB,EAChB,4BAA4B,QACzB,eAAe;AACtB,SAAS,uBAAuB,QAAQ,cAAc;AACtD,SAAS,MAAM,QAAQ,cAAc;AACrC,SAAS,SAAS,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,QAAQ,sBAAsB;AAC5F,SAAsB,MAAM,IAAI,UAAU,QAAQ,cAAc;AAChE,SAAS,gBAAgB,QAAQ,YAAY;AAC7C,SAAS,qBAAqB,EAAE,WAAW,EAAE,eAAe,QAAQ,YAAY;AAChF,SAAS,kBAAkB,QAAQ,oBAAoB;AAGvD,cAAc,gBAAgB;AAC9B,cAAc,YAAY;AAC1B,cAAc,eAAe;AAC7B,cAAc,qBAAqB;AACnC,cAAc,eAAe;;AAE7B;AACA;AACA;;AAYA,OAAO,MAAM,MAAM,CAAC;EAChB;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACI,aAAoB,cAAc,CAC9B,YAAmC,EACnC,cAAwC,EACxC,MAAc,GAAG,UAAU,EACZ;IACf,MAAM,iBAAwC,GAAG,CAC7C,cAAc,CAAC,iBAAiB,EAChC,cAAc,CAAC,YAAY,CAC9B;IACD;IACA,IAAI,YAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAAE;MACjF,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC;IAC9D;IAEA,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,IAAI,iBAAiB;IAClE,IAAI,UAAU,CAAC,IAAI,CAAE,KAAK,IAAK,CAAC,YAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE;MACjF,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,+BAA+B,CAAC;IAChE;IAEA,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC;IAErD,MAAM,OAAiC;MACnC;MACA,cAAc,EAAE,CAAC,MAAM,CAAC;MACxB,0BAA0B,EAAE;IAAM,GAC/B,cAAc;MACjB,WAAW,EAAE,UAAU;MACvB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,EAAE,cAAc,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,QAAQ,GAAG,SAAS;MACrG,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,cAAc,CAAC,UAAU,GAAG,SAAS;MAC3G,OAAO,EAAE,gBAAgB,CAAC,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC,OAAO,GAAG;IAAS,EACrG;IAED,IAAI;MACA,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,YAAY,CAAC,qBAAqB,EAAE;QAChF,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,OAAO,EAAE;UACL,QAAQ,EAAE,kBAAkB;UAC5B,cAAc,EAAE;QACpB,CAAC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;MAChC,CAAC,CAAC;MAEF,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE;QACxB,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,yBAAyB,CAAC;MAC1D;MAEA,MAAM,oBAAoB,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;MAClD,IAAI,4BAA4B,CAAC,oBAAoB,CAAC,EAAE;QACpD,OAAO,oBAAoB,CAAC,SAAS;MACzC;MAEA,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,0BAA0B,CAAC;IAC3D,CAAC,CAAC,OAAO,KAAK,EAAE;MACZ,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAE,KAAK,CAAW,OAAsB,CAAC,EAAE;QAC9E,MAAM,KAAK;MACf,CAAC,MAAM;QACH,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,yBAAyB,EAAE;UAAE,KAAK,EAAE;QAAM,CAAC,CAAC;MAC5E;IACJ;EACJ;EAIA;AACJ;AACA;AACA;AACA;AACA;EACW,WAAW,CACE,QAA+B,EAC/C,OAAgB,EACC,MAAc,GAAG,UAAU,EAC9C;IAAA;IAAA,KAHkB,QAA+B,GAA/B,QAA+B;IAAA,KAE9B,MAAc,GAAd,MAAc;IAE/B,IAAI,CAAC,OAAO,GAAG;MACX,QAAQ,EAAE,OAAO,CAAC,QAAQ;MAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;MAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAC,EAAE,CAAC;MACpD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,kBAAkB,CAAC,EAAE;IAC/D,CAAC;EACL;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACI,MAAa,iCAAiC,CAC1C,KAAa,EACb,YAAkC,GAAG,UAAU,EAC/C,MAAe,EACf,KAAc,EACC;IACf,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAElF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC;IAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;IAC9D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;IACpC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAEjD,IAAI,MAAM,EAAE;MACR,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1C;IAEA,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;EACzB;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACI,MAAa,8BAA8B,CAAC,IAAY,EAAgC;IACpF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC;IACjD,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IACjD,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;IACzD,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;IACvD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAE3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,kBAAkB,CAAC;IAC7E,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;;IAEtC;IACA,2BAA2B,CAAC,aAAa,CAAC;IAC1C,OAAO,qCAAqC,CAAC,aAAa,CAAC;EAC/D;;EAEA;AACJ;AACA;AACA;EACI,MAAa,wBAAwB,CAAC,YAAoB,EAAgC;IACtF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;IAC5C,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IACjD,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC;IAE5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,kBAAkB,CAAC;IAC7E,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;;IAEtC;IACA,2BAA2B,CAAC,aAAa,CAAC;IAC1C,OAAO,qCAAqC,CAAC,aAAa,CAAC;EAC/D;;EAEA;AACJ;AACA;AACA;AACA;EACI,MAAa,WAAW,CAAC,KAAa,EAAE,IAAuC,EAAiB;IAC5F,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;IAC7B,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IACjD,IAAI,IAAI,EAAE;MACN,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC;IAC1C;;IAEA;IACA;IACA;IACA;IACA,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,iBAAiB,CAAC;EACzE;;EAEA;AACJ;AACA;AACA;AACA;AACA;EACI,MAAa,6BAA6B,CAAC,KAAc,EAAwC;IAC7F,OAAO,wBAAwB,CAAC;MAC5B,KAAK,EAAE,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;MACpD,QAAQ,EAAE,IAAI,CAAC,QAAQ;MACvB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;MAC/B,MAAM,EAAE,IAAI,CAAC;IACjB,CAAC,CAAC;EACN;;EAEA;AACJ;AACA;AACA;AACA;AACA;EACI,MAAa,+BAA+B,CACxC,OAAoC,EACuB;IAC3D,OAAO,0BAA0B,CAAC;MAC9B,OAAO;MACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;MACvB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;MAC/B,MAAM,EAAE,IAAI,CAAC;IACjB,CAAC,CAAC;EACN;;EAEA;AACJ;AACA;AACA;EACI,MAAc,KAAK,CACf,MAA+C,EAC/C,MAAuB,EACvB,KAAkB,EACD;IACjB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,MAAM,WAAW,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;MACjD,MAAM,EAAE,MAAM,CAAC,IAAI;MACnB,OAAO,EAAE;QACL,cAAc,EAAE,mCAAmC;QACnD,QAAQ,EAAE;MACd,CAAC;MACD,IAAI,EAAE;IACV,CAAC,CAAC;IAEF,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE;MACnB,IAAI,IAAa;MACjB,IAAI;QACA,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;MAC3B,CAAC,CAAC,MAAM;QACJ;QACA;MAAA;MAEJ;MACA;MACA;MACA;MACA,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE;QAC7B,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC;MAC9E;MACA,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE;QAC7B,MAAM,IAAI,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;MACnE;MACA,MAAM,IAAI,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC;IACvD;IAEA,OAAO,GAAG;EACd;AACJ","ignoreList":[]}

package/lib/rust-crypto/index.d.ts

@@ -67,6 +67,23 @@ export interface InitRustCryptoArgs {
      * considered verified, without any manual verification taking place.
      */
     caCertsPem?: string;
+    /**
+     * Optional async function for signing some data with an X.509 certificate.
+     * Used to sign the user's identity so compatible clients will recognise
+     * this user as verified without manual verification taking place. If you
+     * supply this you must also supply {@link InitRustCryptoArgs#x509Validity}.
+     */
+    x509Signer?: (item: Uint8Array) => Promise<{
+        signature_bytes: Uint8Array;
+        certificate_chain: string;
+        signature_scheme: "RsaPssSha512";
+    }>;
+    /**
+     * Optional function returning the validity period of the X.509 certificate
+     * used for signing, as the number of milliseconds since the Unix epoch. If
+     * you supply this you must also supply {@link InitRustCryptoArgs#x509Signer}.
+     */
+    x509Validity?: () => number;
 }
 /**
  * Create a new `RustCrypto` implementation

package/lib/rust-crypto/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rust-crypto/index.ts"],"names":[],"mappings":"AAmBA,OAAO,EAA2C,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,KAAK,WAAW,EAAkB,MAAM,yBAAyB,CAAC;AAM3E,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IAC/B,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,IAAI,EAAE,aAAa,CAAC,SAAS,GAAG;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAEpD,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IAEf,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;IAEjB,+CAA+C;IAC/C,aAAa,EAAE,uBAAuB,CAAC;IAEvC,oDAAoD;IACpD,eAAe,EAAE,eAAe,CAAC;IAEjC;;;OAGG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3B;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC;IAEtB,+FAA+F;IAC/F,iBAAiB,CAAC,EAAE,WAAW,CAAC;IAEhC,6CAA6C;IAC7C,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;;OAIG;IACH,+BAA+B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAE5E;;OAEG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAErC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAkClF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rust-crypto/index.ts"],"names":[],"mappings":"AAmBA,OAAO,EAA2C,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,KAAK,WAAW,EAAkB,MAAM,yBAAyB,CAAC;AAM3E,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IAC/B,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,IAAI,EAAE,aAAa,CAAC,SAAS,GAAG;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAEpD,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IAEf,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;IAEjB,+CAA+C;IAC/C,aAAa,EAAE,uBAAuB,CAAC;IAEvC,oDAAoD;IACpD,eAAe,EAAE,eAAe,CAAC;IAEjC;;;OAGG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3B;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC;IAEtB,+FAA+F;IAC/F,iBAAiB,CAAC,EAAE,WAAW,CAAC;IAEhC,6CAA6C;IAC7C,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;;OAIG;IACH,+BAA+B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAE5E;;OAEG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAErC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC;QACvC,eAAe,EAAE,UAAU,CAAC;QAC5B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,gBAAgB,EAAE,cAAc,CAAC;KACpC,CAAC,CAAC;IAEH;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAkClF"}

package/lib/rust-crypto/index.js

@@ -73,10 +73,12 @@ async function initOlmMachine({
   cryptoCallbacks,
   legacyCryptoStore,
   enableEncryptedStateEvents,
-  caCertsPem
+  caCertsPem,
+  x509Signer,
+  x509Validity
 }, storeHandle) {
   logger.debug("Init OlmMachine");
-  const olmMachine = await RustSdkCryptoJs.OlmMachine.initFromStore(new RustSdkCryptoJs.UserId(userId), new RustSdkCryptoJs.DeviceId(deviceId), storeHandle, logger, caCertsPem);
+  const olmMachine = await RustSdkCryptoJs.OlmMachine.initFromStore(new RustSdkCryptoJs.UserId(userId), new RustSdkCryptoJs.DeviceId(deviceId), storeHandle, logger, caCertsPem, x509Signer, x509Validity);
 
   // A final migration step, now that we have an OlmMachine.
   if (legacyCryptoStore) {

package/lib/rust-crypto/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../src/rust-crypto/index.ts"],"sourcesContent":["/*\nCopyright 2022 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport * as RustSdkCryptoJs from \"@matrix-org/matrix-sdk-crypto-wasm\";\nimport { StoreHandle } from \"@matrix-org/matrix-sdk-crypto-wasm\";\n\nimport { MAX_INVITE_ACCEPTANCE_MS_FOR_KEY_BUNDLE, RustCrypto } from \"./rust-crypto.ts\";\nimport { type IHttpOpts, type MatrixHttpApi } from \"../http-api/index.ts\";\nimport { type ServerSideSecretStorage } from \"../secret-storage.ts\";\nimport { type Logger } from \"../logger.ts\";\nimport { type CryptoStore, MigrationState } from \"../crypto/store/base.ts\";\nimport {\n    migrateFromLegacyCrypto,\n    migrateLegacyLocalTrustIfNeeded,\n    migrateRoomSettingsFromLegacyCrypto,\n} from \"./libolm_migration.ts\";\nimport { type CryptoCallbacks } from \"../crypto-api/index.ts\";\n\n/**\n * The arguments used to initialise RustCrypto, passed in to initRustCrypto.\n *\n * @internal\n */\nexport interface InitRustCryptoArgs {\n    /** A `Logger` instance that will be used for debug output. */\n    logger: Logger;\n\n    /**\n     * Low-level HTTP interface: used to make outgoing requests required by the rust SDK.\n     * We expect it to set the access token, etc.\n     */\n    http: MatrixHttpApi<IHttpOpts & { onlyData: true }>;\n\n    /** The local user's User ID. */\n    userId: string;\n\n    /** The local user's Device ID. */\n    deviceId: string;\n\n    /** Interface to server-side secret storage. */\n    secretStorage: ServerSideSecretStorage;\n\n    /** Crypto callbacks provided by the application. */\n    cryptoCallbacks: CryptoCallbacks;\n\n    /**\n     * The prefix to use on the indexeddbs created by rust-crypto.\n     * If `null`, a memory store will be used.\n     */\n    storePrefix: string | null;\n\n    /**\n     * A passphrase to use to encrypt the indexeddb created by rust-crypto.\n     *\n     * Ignored if `storePrefix` is null, or `storeKey` is set.  If neither this nor `storeKey` is set\n     * (and `storePrefix` is not null), the indexeddb will be unencrypted.\n     */\n    storePassphrase?: string;\n\n    /**\n     * A key to use to encrypt the indexeddb created by rust-crypto.\n     *\n     * Ignored if `storePrefix` is null. Otherwise, if it is set, it must be a 32-byte cryptographic key, which\n     * will be used to encrypt the indexeddb. See also `storePassphrase`.\n     */\n    storeKey?: Uint8Array;\n\n    /** If defined, we will check if any data needs migrating from this store to the rust store. */\n    legacyCryptoStore?: CryptoStore;\n\n    /** The pickle key for `legacyCryptoStore` */\n    legacyPickleKey?: string;\n\n    /**\n     * A callback which will receive progress updates on migration from `legacyCryptoStore`.\n     *\n     * Called with (-1, -1) to mark the end of migration.\n     */\n    legacyMigrationProgressListener?: (progress: number, total: number) => void;\n\n    /**\n     * Whether to enable support for encrypting state events.\n     */\n    enableEncryptedStateEvents?: boolean;\n\n    /**\n     * Optional PEM-formatted string that provides CA certificates. These will\n     * be used to check X.509 signatures on user identities. Any user identity\n     * that has a valid signature according to the supplied CAs will be\n     * considered verified, without any manual verification taking place.\n     */\n    caCertsPem?: string;\n}\n\n/**\n * Create a new `RustCrypto` implementation\n *\n * @param args - InitRustCryptoArgs\n * @internal\n */\nexport async function initRustCrypto(args: InitRustCryptoArgs): Promise<RustCrypto> {\n    const { logger } = args;\n\n    // initialise the rust matrix-sdk-crypto-wasm, if it hasn't already been done\n    logger.debug(\"Initialising Rust crypto-sdk WASM artifact\");\n    await RustSdkCryptoJs.initAsync();\n\n    logger.debug(\"Opening Rust CryptoStore\");\n    let storeHandle;\n    if (args.storePrefix) {\n        if (args.storeKey) {\n            storeHandle = await StoreHandle.openWithKey(args.storePrefix, args.storeKey, logger);\n        } else {\n            storeHandle = await StoreHandle.open(args.storePrefix, args.storePassphrase, logger);\n        }\n    } else {\n        storeHandle = await StoreHandle.open(null, null, logger);\n    }\n\n    if (args.legacyCryptoStore) {\n        // We have a legacy crypto store, which we may need to migrate from.\n        await migrateFromLegacyCrypto({\n            legacyStore: args.legacyCryptoStore,\n            storeHandle,\n            ...args,\n        });\n    }\n\n    const rustCrypto = await initOlmMachine(args, storeHandle);\n\n    storeHandle.free();\n\n    logger.debug(\"Completed rust crypto-sdk setup\");\n    return rustCrypto;\n}\n\nasync function initOlmMachine(\n    {\n        logger,\n        http,\n        userId,\n        deviceId,\n        secretStorage,\n        cryptoCallbacks,\n        legacyCryptoStore,\n        enableEncryptedStateEvents,\n        caCertsPem,\n    }: InitRustCryptoArgs,\n    storeHandle: StoreHandle,\n): Promise<RustCrypto> {\n    logger.debug(\"Init OlmMachine\");\n\n    const olmMachine = await RustSdkCryptoJs.OlmMachine.initFromStore(\n        new RustSdkCryptoJs.UserId(userId),\n        new RustSdkCryptoJs.DeviceId(deviceId),\n        storeHandle,\n        logger,\n        caCertsPem,\n    );\n\n    // A final migration step, now that we have an OlmMachine.\n    if (legacyCryptoStore) {\n        await migrateRoomSettingsFromLegacyCrypto({\n            logger,\n            legacyStore: legacyCryptoStore,\n            olmMachine,\n        });\n    }\n\n    // Disable room key requests, per https://github.com/vector-im/element-web/issues/26524.\n    olmMachine.roomKeyRequestsEnabled = false;\n\n    const rustCrypto = new RustCrypto(\n        logger,\n        olmMachine,\n        http,\n        userId,\n        deviceId,\n        secretStorage,\n        cryptoCallbacks,\n        enableEncryptedStateEvents,\n    );\n\n    olmMachine.registerRoomKeyUpdatedCallback((sessions: RustSdkCryptoJs.RoomKeyInfo[]) =>\n        rustCrypto.onRoomKeysUpdated(sessions),\n    );\n    olmMachine.registerRoomKeysWithheldCallback((withheld: RustSdkCryptoJs.RoomKeyWithheldInfo[]) =>\n        rustCrypto.onRoomKeysWithheld(withheld),\n    );\n    olmMachine.registerUserIdentityUpdatedCallback((userId: RustSdkCryptoJs.UserId) =>\n        rustCrypto.onUserIdentityUpdated(userId),\n    );\n    olmMachine.registerDevicesUpdatedCallback((userIds: string[]) => rustCrypto.onDevicesUpdated(userIds));\n\n    // Check if there are any key backup secrets pending processing. There may be multiple secrets to process if several devices have gossiped them.\n    // The `registerReceiveSecretCallback` function will only be triggered for new secrets. If the client is restarted before processing them, the secrets will need to be manually handled.\n    void rustCrypto.checkSecrets(\"m.megolm_backup.v1\");\n\n    // Register a callback to be notified when a new secret is received, as for now only the key backup secret is supported (the cross signing secrets are handled automatically by the OlmMachine)\n    olmMachine.registerReceiveSecretCallback((name: string, _value: string) =>\n        // Instead of directly checking the secret value, we poll the inbox to get all values for that secret type.\n        // Once we have all the values, we can safely clear the secret inbox.\n        rustCrypto.checkSecrets(name),\n    );\n\n    // Tell the OlmMachine to think about its outgoing requests before we hand control back to the application.\n    //\n    // This is primarily a fudge to get it to correctly populate the `users_for_key_query` list, so that future\n    // calls to getIdentity (etc) block until the key queries are performed.\n    //\n    // Note that we don't actually need to *make* any requests here; it is sufficient to tell the Rust side to think\n    // about them.\n    //\n    // XXX: find a less hacky way to do this.\n    await olmMachine.outgoingRequests();\n\n    if (legacyCryptoStore && (await legacyCryptoStore.containsData())) {\n        const migrationState = await legacyCryptoStore.getMigrationState();\n        if (migrationState < MigrationState.INITIAL_OWN_KEY_QUERY_DONE) {\n            logger.debug(`Performing initial key query after migration`);\n            // We need to do an initial keys query so that the rust stack can properly update trust of\n            // the user device and identity from the migrated private keys.\n            // If not done, there is a short period where the own device/identity trust will be undefined after migration.\n            let initialKeyQueryDone = false;\n            while (!initialKeyQueryDone) {\n                try {\n                    await rustCrypto.userHasCrossSigningKeys(userId);\n                    initialKeyQueryDone = true;\n                } catch (e) {\n                    // If the initial key query fails, we retry until it succeeds.\n                    logger.error(\"Failed to check for cross-signing keys after migration, retrying\", e);\n                }\n            }\n\n            // If the private master cross-signing key was not cached in the legacy store, the rust session\n            // will not be able to establish the trust of the user identity.\n            // That means that after migration the session could revert to unverified.\n            // In order to avoid asking the users to re-verify their sessions, we need to migrate the legacy local trust\n            // (if the legacy session was already verified) to the new session.\n            await migrateLegacyLocalTrustIfNeeded({ legacyCryptoStore, rustCrypto, logger });\n\n            await legacyCryptoStore.setMigrationState(MigrationState.INITIAL_OWN_KEY_QUERY_DONE);\n        }\n    }\n\n    // If we have any recently-joined rooms, see if we have a pending key bundle for them.\n    for (const pendingDetails of await olmMachine.getAllRoomsPendingKeyBundles()) {\n        const roomId = pendingDetails.roomId.toString();\n        if (Date.now() - pendingDetails.inviteAcceptedAtMillis <= MAX_INVITE_ACCEPTANCE_MS_FOR_KEY_BUNDLE) {\n            logger.info(\n                `Checking for pending key bundle for recently-joined room ${roomId} (joined ${new Date(pendingDetails.inviteAcceptedAtMillis).toISOString()})`,\n            );\n            await rustCrypto.maybeAcceptKeyBundle(roomId, pendingDetails.inviterId.toString());\n        } else {\n            logger.info(\n                `Clearing pending-key-bundle flag for room ${roomId} (too old: joined ${new Date(pendingDetails.inviteAcceptedAtMillis).toISOString()})`,\n            );\n            await olmMachine.clearRoomPendingKeyBundle(new RustSdkCryptoJs.RoomId(roomId));\n        }\n    }\n\n    return rustCrypto;\n}\n"],"mappings":";AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,OAAO,KAAK,eAAe,MAAM,oCAAoC;AACrE,SAAS,WAAW,QAAQ,oCAAoC;AAEhE,SAAS,uCAAuC,EAAE,UAAU,QAAQ,kBAAkB;AAItF,SAA2B,cAAc,QAAQ,yBAAyB;AAC1E,SACI,uBAAuB,EACvB,+BAA+B,EAC/B,mCAAmC,QAChC,uBAAuB;;AAG9B;AACA;AACA;AACA;AACA;;AAwEA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAe,cAAc,CAAC,IAAwB,EAAuB;EAChF,MAAM;IAAE;EAAO,CAAC,GAAG,IAAI;;EAEvB;EACA,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC;EAC1D,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;EAEjC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC;EACxC,IAAI,WAAW;EACf,IAAI,IAAI,CAAC,WAAW,EAAE;IAClB,IAAI,IAAI,CAAC,QAAQ,EAAE;MACf,WAAW,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC;IACxF,CAAC,MAAM;MACH,WAAW,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC;IACxF;EACJ,CAAC,MAAM;IACH,WAAW,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC;EAC5D;EAEA,IAAI,IAAI,CAAC,iBAAiB,EAAE;IACxB;IACA,MAAM,uBAAuB;MACzB,WAAW,EAAE,IAAI,CAAC,iBAAiB;MACnC;IAAW,GACR,IAAI,CACV,CAAC;EACN;EAEA,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC;EAE1D,WAAW,CAAC,IAAI,CAAC,CAAC;EAElB,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC;EAC/C,OAAO,UAAU;AACrB;AAEA,eAAe,cAAc,CACzB;EACI,MAAM;EACN,IAAI;EACJ,MAAM;EACN,QAAQ;EACR,aAAa;EACb,eAAe;EACf,iBAAiB;EACjB,0BAA0B;EAC1B;AACgB,CAAC,EACrB,WAAwB,EACL;EACnB,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC;EAE/B,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,aAAa,CAC7D,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAClC,IAAI,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACtC,WAAW,EACX,MAAM,EACN,UACJ,CAAC;;EAED;EACA,IAAI,iBAAiB,EAAE;IACnB,MAAM,mCAAmC,CAAC;MACtC,MAAM;MACN,WAAW,EAAE,iBAAiB;MAC9B;IACJ,CAAC,CAAC;EACN;;EAEA;EACA,UAAU,CAAC,sBAAsB,GAAG,KAAK;EAEzC,MAAM,UAAU,GAAG,IAAI,UAAU,CAC7B,MAAM,EACN,UAAU,EACV,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,aAAa,EACb,eAAe,EACf,0BACJ,CAAC;EAED,UAAU,CAAC,8BAA8B,CAAE,QAAuC,IAC9E,UAAU,CAAC,iBAAiB,CAAC,QAAQ,CACzC,CAAC;EACD,UAAU,CAAC,gCAAgC,CAAE,QAA+C,IACxF,UAAU,CAAC,kBAAkB,CAAC,QAAQ,CAC1C,CAAC;EACD,UAAU,CAAC,mCAAmC,CAAE,MAA8B,IAC1E,UAAU,CAAC,qBAAqB,CAAC,MAAM,CAC3C,CAAC;EACD,UAAU,CAAC,8BAA8B,CAAE,OAAiB,IAAK,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;;EAEtG;EACA;EACA,KAAK,UAAU,CAAC,YAAY,CAAC,oBAAoB,CAAC;;EAElD;EACA,UAAU,CAAC,6BAA6B,CAAC,CAAC,IAAY,EAAE,MAAc;EAClE;EACA;EACA,UAAU,CAAC,YAAY,CAAC,IAAI,CAChC,CAAC;;EAED;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,MAAM,UAAU,CAAC,gBAAgB,CAAC,CAAC;EAEnC,IAAI,iBAAiB,KAAK,MAAM,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;IAC/D,MAAM,cAAc,GAAG,MAAM,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IAClE,IAAI,cAAc,GAAG,cAAc,CAAC,0BAA0B,EAAE;MAC5D,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC;MAC5D;MACA;MACA;MACA,IAAI,mBAAmB,GAAG,KAAK;MAC/B,OAAO,CAAC,mBAAmB,EAAE;QACzB,IAAI;UACA,MAAM,UAAU,CAAC,uBAAuB,CAAC,MAAM,CAAC;UAChD,mBAAmB,GAAG,IAAI;QAC9B,CAAC,CAAC,OAAO,CAAC,EAAE;UACR;UACA,MAAM,CAAC,KAAK,CAAC,kEAAkE,EAAE,CAAC,CAAC;QACvF;MACJ;;MAEA;MACA;MACA;MACA;MACA;MACA,MAAM,+BAA+B,CAAC;QAAE,iBAAiB;QAAE,UAAU;QAAE;MAAO,CAAC,CAAC;MAEhF,MAAM,iBAAiB,CAAC,iBAAiB,CAAC,cAAc,CAAC,0BAA0B,CAAC;IACxF;EACJ;;EAEA;EACA,KAAK,MAAM,cAAc,IAAI,MAAM,UAAU,CAAC,4BAA4B,CAAC,CAAC,EAAE;IAC1E,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,sBAAsB,IAAI,uCAAuC,EAAE;MAC/F,MAAM,CAAC,IAAI,CACP,4DAA4D,MAAM,YAAY,IAAI,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC,WAAW,CAAC,CAAC,GAC/I,CAAC;MACD,MAAM,UAAU,CAAC,oBAAoB,CAAC,MAAM,EAAE,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtF,CAAC,MAAM;MACH,MAAM,CAAC,IAAI,CACP,6CAA6C,MAAM,qBAAqB,IAAI,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC,WAAW,CAAC,CAAC,GACzI,CAAC;MACD,MAAM,UAAU,CAAC,yBAAyB,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClF;EACJ;EAEA,OAAO,UAAU;AACrB","ignoreList":[]}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/rust-crypto/index.ts"],"sourcesContent":["/*\nCopyright 2022 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport * as RustSdkCryptoJs from \"@matrix-org/matrix-sdk-crypto-wasm\";\nimport { StoreHandle } from \"@matrix-org/matrix-sdk-crypto-wasm\";\n\nimport { MAX_INVITE_ACCEPTANCE_MS_FOR_KEY_BUNDLE, RustCrypto } from \"./rust-crypto.ts\";\nimport { type IHttpOpts, type MatrixHttpApi } from \"../http-api/index.ts\";\nimport { type ServerSideSecretStorage } from \"../secret-storage.ts\";\nimport { type Logger } from \"../logger.ts\";\nimport { type CryptoStore, MigrationState } from \"../crypto/store/base.ts\";\nimport {\n    migrateFromLegacyCrypto,\n    migrateLegacyLocalTrustIfNeeded,\n    migrateRoomSettingsFromLegacyCrypto,\n} from \"./libolm_migration.ts\";\nimport { type CryptoCallbacks } from \"../crypto-api/index.ts\";\n\n/**\n * The arguments used to initialise RustCrypto, passed in to initRustCrypto.\n *\n * @internal\n */\nexport interface InitRustCryptoArgs {\n    /** A `Logger` instance that will be used for debug output. */\n    logger: Logger;\n\n    /**\n     * Low-level HTTP interface: used to make outgoing requests required by the rust SDK.\n     * We expect it to set the access token, etc.\n     */\n    http: MatrixHttpApi<IHttpOpts & { onlyData: true }>;\n\n    /** The local user's User ID. */\n    userId: string;\n\n    /** The local user's Device ID. */\n    deviceId: string;\n\n    /** Interface to server-side secret storage. */\n    secretStorage: ServerSideSecretStorage;\n\n    /** Crypto callbacks provided by the application. */\n    cryptoCallbacks: CryptoCallbacks;\n\n    /**\n     * The prefix to use on the indexeddbs created by rust-crypto.\n     * If `null`, a memory store will be used.\n     */\n    storePrefix: string | null;\n\n    /**\n     * A passphrase to use to encrypt the indexeddb created by rust-crypto.\n     *\n     * Ignored if `storePrefix` is null, or `storeKey` is set.  If neither this nor `storeKey` is set\n     * (and `storePrefix` is not null), the indexeddb will be unencrypted.\n     */\n    storePassphrase?: string;\n\n    /**\n     * A key to use to encrypt the indexeddb created by rust-crypto.\n     *\n     * Ignored if `storePrefix` is null. Otherwise, if it is set, it must be a 32-byte cryptographic key, which\n     * will be used to encrypt the indexeddb. See also `storePassphrase`.\n     */\n    storeKey?: Uint8Array;\n\n    /** If defined, we will check if any data needs migrating from this store to the rust store. */\n    legacyCryptoStore?: CryptoStore;\n\n    /** The pickle key for `legacyCryptoStore` */\n    legacyPickleKey?: string;\n\n    /**\n     * A callback which will receive progress updates on migration from `legacyCryptoStore`.\n     *\n     * Called with (-1, -1) to mark the end of migration.\n     */\n    legacyMigrationProgressListener?: (progress: number, total: number) => void;\n\n    /**\n     * Whether to enable support for encrypting state events.\n     */\n    enableEncryptedStateEvents?: boolean;\n\n    /**\n     * Optional PEM-formatted string that provides CA certificates. These will\n     * be used to check X.509 signatures on user identities. Any user identity\n     * that has a valid signature according to the supplied CAs will be\n     * considered verified, without any manual verification taking place.\n     */\n    caCertsPem?: string;\n\n    /**\n     * Optional async function for signing some data with an X.509 certificate.\n     * Used to sign the user's identity so compatible clients will recognise\n     * this user as verified without manual verification taking place. If you\n     * supply this you must also supply {@link InitRustCryptoArgs#x509Validity}.\n     */\n    x509Signer?: (item: Uint8Array) => Promise<{\n        signature_bytes: Uint8Array;\n        certificate_chain: string;\n        signature_scheme: \"RsaPssSha512\";\n    }>;\n\n    /**\n     * Optional function returning the validity period of the X.509 certificate\n     * used for signing, as the number of milliseconds since the Unix epoch. If\n     * you supply this you must also supply {@link InitRustCryptoArgs#x509Signer}.\n     */\n    x509Validity?: () => number;\n}\n\n/**\n * Create a new `RustCrypto` implementation\n *\n * @param args - InitRustCryptoArgs\n * @internal\n */\nexport async function initRustCrypto(args: InitRustCryptoArgs): Promise<RustCrypto> {\n    const { logger } = args;\n\n    // initialise the rust matrix-sdk-crypto-wasm, if it hasn't already been done\n    logger.debug(\"Initialising Rust crypto-sdk WASM artifact\");\n    await RustSdkCryptoJs.initAsync();\n\n    logger.debug(\"Opening Rust CryptoStore\");\n    let storeHandle;\n    if (args.storePrefix) {\n        if (args.storeKey) {\n            storeHandle = await StoreHandle.openWithKey(args.storePrefix, args.storeKey, logger);\n        } else {\n            storeHandle = await StoreHandle.open(args.storePrefix, args.storePassphrase, logger);\n        }\n    } else {\n        storeHandle = await StoreHandle.open(null, null, logger);\n    }\n\n    if (args.legacyCryptoStore) {\n        // We have a legacy crypto store, which we may need to migrate from.\n        await migrateFromLegacyCrypto({\n            legacyStore: args.legacyCryptoStore,\n            storeHandle,\n            ...args,\n        });\n    }\n\n    const rustCrypto = await initOlmMachine(args, storeHandle);\n\n    storeHandle.free();\n\n    logger.debug(\"Completed rust crypto-sdk setup\");\n    return rustCrypto;\n}\n\nasync function initOlmMachine(\n    {\n        logger,\n        http,\n        userId,\n        deviceId,\n        secretStorage,\n        cryptoCallbacks,\n        legacyCryptoStore,\n        enableEncryptedStateEvents,\n        caCertsPem,\n        x509Signer,\n        x509Validity,\n    }: InitRustCryptoArgs,\n    storeHandle: StoreHandle,\n): Promise<RustCrypto> {\n    logger.debug(\"Init OlmMachine\");\n\n    const olmMachine = await RustSdkCryptoJs.OlmMachine.initFromStore(\n        new RustSdkCryptoJs.UserId(userId),\n        new RustSdkCryptoJs.DeviceId(deviceId),\n        storeHandle,\n        logger,\n        caCertsPem,\n        x509Signer,\n        x509Validity,\n    );\n\n    // A final migration step, now that we have an OlmMachine.\n    if (legacyCryptoStore) {\n        await migrateRoomSettingsFromLegacyCrypto({\n            logger,\n            legacyStore: legacyCryptoStore,\n            olmMachine,\n        });\n    }\n\n    // Disable room key requests, per https://github.com/vector-im/element-web/issues/26524.\n    olmMachine.roomKeyRequestsEnabled = false;\n\n    const rustCrypto = new RustCrypto(\n        logger,\n        olmMachine,\n        http,\n        userId,\n        deviceId,\n        secretStorage,\n        cryptoCallbacks,\n        enableEncryptedStateEvents,\n    );\n\n    olmMachine.registerRoomKeyUpdatedCallback((sessions: RustSdkCryptoJs.RoomKeyInfo[]) =>\n        rustCrypto.onRoomKeysUpdated(sessions),\n    );\n    olmMachine.registerRoomKeysWithheldCallback((withheld: RustSdkCryptoJs.RoomKeyWithheldInfo[]) =>\n        rustCrypto.onRoomKeysWithheld(withheld),\n    );\n    olmMachine.registerUserIdentityUpdatedCallback((userId: RustSdkCryptoJs.UserId) =>\n        rustCrypto.onUserIdentityUpdated(userId),\n    );\n    olmMachine.registerDevicesUpdatedCallback((userIds: string[]) => rustCrypto.onDevicesUpdated(userIds));\n\n    // Check if there are any key backup secrets pending processing. There may be multiple secrets to process if several devices have gossiped them.\n    // The `registerReceiveSecretCallback` function will only be triggered for new secrets. If the client is restarted before processing them, the secrets will need to be manually handled.\n    void rustCrypto.checkSecrets(\"m.megolm_backup.v1\");\n\n    // Register a callback to be notified when a new secret is received, as for now only the key backup secret is supported (the cross signing secrets are handled automatically by the OlmMachine)\n    olmMachine.registerReceiveSecretCallback((name: string, _value: string) =>\n        // Instead of directly checking the secret value, we poll the inbox to get all values for that secret type.\n        // Once we have all the values, we can safely clear the secret inbox.\n        rustCrypto.checkSecrets(name),\n    );\n\n    // Tell the OlmMachine to think about its outgoing requests before we hand control back to the application.\n    //\n    // This is primarily a fudge to get it to correctly populate the `users_for_key_query` list, so that future\n    // calls to getIdentity (etc) block until the key queries are performed.\n    //\n    // Note that we don't actually need to *make* any requests here; it is sufficient to tell the Rust side to think\n    // about them.\n    //\n    // XXX: find a less hacky way to do this.\n    await olmMachine.outgoingRequests();\n\n    if (legacyCryptoStore && (await legacyCryptoStore.containsData())) {\n        const migrationState = await legacyCryptoStore.getMigrationState();\n        if (migrationState < MigrationState.INITIAL_OWN_KEY_QUERY_DONE) {\n            logger.debug(`Performing initial key query after migration`);\n            // We need to do an initial keys query so that the rust stack can properly update trust of\n            // the user device and identity from the migrated private keys.\n            // If not done, there is a short period where the own device/identity trust will be undefined after migration.\n            let initialKeyQueryDone = false;\n            while (!initialKeyQueryDone) {\n                try {\n                    await rustCrypto.userHasCrossSigningKeys(userId);\n                    initialKeyQueryDone = true;\n                } catch (e) {\n                    // If the initial key query fails, we retry until it succeeds.\n                    logger.error(\"Failed to check for cross-signing keys after migration, retrying\", e);\n                }\n            }\n\n            // If the private master cross-signing key was not cached in the legacy store, the rust session\n            // will not be able to establish the trust of the user identity.\n            // That means that after migration the session could revert to unverified.\n            // In order to avoid asking the users to re-verify their sessions, we need to migrate the legacy local trust\n            // (if the legacy session was already verified) to the new session.\n            await migrateLegacyLocalTrustIfNeeded({ legacyCryptoStore, rustCrypto, logger });\n\n            await legacyCryptoStore.setMigrationState(MigrationState.INITIAL_OWN_KEY_QUERY_DONE);\n        }\n    }\n\n    // If we have any recently-joined rooms, see if we have a pending key bundle for them.\n    for (const pendingDetails of await olmMachine.getAllRoomsPendingKeyBundles()) {\n        const roomId = pendingDetails.roomId.toString();\n        if (Date.now() - pendingDetails.inviteAcceptedAtMillis <= MAX_INVITE_ACCEPTANCE_MS_FOR_KEY_BUNDLE) {\n            logger.info(\n                `Checking for pending key bundle for recently-joined room ${roomId} (joined ${new Date(pendingDetails.inviteAcceptedAtMillis).toISOString()})`,\n            );\n            await rustCrypto.maybeAcceptKeyBundle(roomId, pendingDetails.inviterId.toString());\n        } else {\n            logger.info(\n                `Clearing pending-key-bundle flag for room ${roomId} (too old: joined ${new Date(pendingDetails.inviteAcceptedAtMillis).toISOString()})`,\n            );\n            await olmMachine.clearRoomPendingKeyBundle(new RustSdkCryptoJs.RoomId(roomId));\n        }\n    }\n\n    return rustCrypto;\n}\n"],"mappings":";AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,OAAO,KAAK,eAAe,MAAM,oCAAoC;AACrE,SAAS,WAAW,QAAQ,oCAAoC;AAEhE,SAAS,uCAAuC,EAAE,UAAU,QAAQ,kBAAkB;AAItF,SAA2B,cAAc,QAAQ,yBAAyB;AAC1E,SACI,uBAAuB,EACvB,+BAA+B,EAC/B,mCAAmC,QAChC,uBAAuB;;AAG9B;AACA;AACA;AACA;AACA;;AA2FA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAe,cAAc,CAAC,IAAwB,EAAuB;EAChF,MAAM;IAAE;EAAO,CAAC,GAAG,IAAI;;EAEvB;EACA,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC;EAC1D,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;EAEjC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC;EACxC,IAAI,WAAW;EACf,IAAI,IAAI,CAAC,WAAW,EAAE;IAClB,IAAI,IAAI,CAAC,QAAQ,EAAE;MACf,WAAW,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC;IACxF,CAAC,MAAM;MACH,WAAW,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC;IACxF;EACJ,CAAC,MAAM;IACH,WAAW,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC;EAC5D;EAEA,IAAI,IAAI,CAAC,iBAAiB,EAAE;IACxB;IACA,MAAM,uBAAuB;MACzB,WAAW,EAAE,IAAI,CAAC,iBAAiB;MACnC;IAAW,GACR,IAAI,CACV,CAAC;EACN;EAEA,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC;EAE1D,WAAW,CAAC,IAAI,CAAC,CAAC;EAElB,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC;EAC/C,OAAO,UAAU;AACrB;AAEA,eAAe,cAAc,CACzB;EACI,MAAM;EACN,IAAI;EACJ,MAAM;EACN,QAAQ;EACR,aAAa;EACb,eAAe;EACf,iBAAiB;EACjB,0BAA0B;EAC1B,UAAU;EACV,UAAU;EACV;AACgB,CAAC,EACrB,WAAwB,EACL;EACnB,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC;EAE/B,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,aAAa,CAC7D,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAClC,IAAI,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACtC,WAAW,EACX,MAAM,EACN,UAAU,EACV,UAAU,EACV,YACJ,CAAC;;EAED;EACA,IAAI,iBAAiB,EAAE;IACnB,MAAM,mCAAmC,CAAC;MACtC,MAAM;MACN,WAAW,EAAE,iBAAiB;MAC9B;IACJ,CAAC,CAAC;EACN;;EAEA;EACA,UAAU,CAAC,sBAAsB,GAAG,KAAK;EAEzC,MAAM,UAAU,GAAG,IAAI,UAAU,CAC7B,MAAM,EACN,UAAU,EACV,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,aAAa,EACb,eAAe,EACf,0BACJ,CAAC;EAED,UAAU,CAAC,8BAA8B,CAAE,QAAuC,IAC9E,UAAU,CAAC,iBAAiB,CAAC,QAAQ,CACzC,CAAC;EACD,UAAU,CAAC,gCAAgC,CAAE,QAA+C,IACxF,UAAU,CAAC,kBAAkB,CAAC,QAAQ,CAC1C,CAAC;EACD,UAAU,CAAC,mCAAmC,CAAE,MAA8B,IAC1E,UAAU,CAAC,qBAAqB,CAAC,MAAM,CAC3C,CAAC;EACD,UAAU,CAAC,8BAA8B,CAAE,OAAiB,IAAK,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;;EAEtG;EACA;EACA,KAAK,UAAU,CAAC,YAAY,CAAC,oBAAoB,CAAC;;EAElD;EACA,UAAU,CAAC,6BAA6B,CAAC,CAAC,IAAY,EAAE,MAAc;EAClE;EACA;EACA,UAAU,CAAC,YAAY,CAAC,IAAI,CAChC,CAAC;;EAED;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,MAAM,UAAU,CAAC,gBAAgB,CAAC,CAAC;EAEnC,IAAI,iBAAiB,KAAK,MAAM,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;IAC/D,MAAM,cAAc,GAAG,MAAM,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IAClE,IAAI,cAAc,GAAG,cAAc,CAAC,0BAA0B,EAAE;MAC5D,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC;MAC5D;MACA;MACA;MACA,IAAI,mBAAmB,GAAG,KAAK;MAC/B,OAAO,CAAC,mBAAmB,EAAE;QACzB,IAAI;UACA,MAAM,UAAU,CAAC,uBAAuB,CAAC,MAAM,CAAC;UAChD,mBAAmB,GAAG,IAAI;QAC9B,CAAC,CAAC,OAAO,CAAC,EAAE;UACR;UACA,MAAM,CAAC,KAAK,CAAC,kEAAkE,EAAE,CAAC,CAAC;QACvF;MACJ;;MAEA;MACA;MACA;MACA;MACA;MACA,MAAM,+BAA+B,CAAC;QAAE,iBAAiB;QAAE,UAAU;QAAE;MAAO,CAAC,CAAC;MAEhF,MAAM,iBAAiB,CAAC,iBAAiB,CAAC,cAAc,CAAC,0BAA0B,CAAC;IACxF;EACJ;;EAEA;EACA,KAAK,MAAM,cAAc,IAAI,MAAM,UAAU,CAAC,4BAA4B,CAAC,CAAC,EAAE;IAC1E,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,sBAAsB,IAAI,uCAAuC,EAAE;MAC/F,MAAM,CAAC,IAAI,CACP,4DAA4D,MAAM,YAAY,IAAI,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC,WAAW,CAAC,CAAC,GAC/I,CAAC;MACD,MAAM,UAAU,CAAC,oBAAoB,CAAC,MAAM,EAAE,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtF,CAAC,MAAM;MACH,MAAM,CAAC,IAAI,CACP,6CAA6C,MAAM,qBAAqB,IAAI,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC,WAAW,CAAC,CAAC,GACzI,CAAC;MACD,MAAM,UAAU,CAAC,yBAAyB,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClF;EACJ;EAEA,OAAO,UAAU;AACrB","ignoreList":[]}

package/lib/rust-crypto/rust-crypto.d.ts

@@ -1,11 +1,11 @@
 import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";
 import type { IMegolmSessionData } from "../@types/crypto.ts";
-import { type IDeviceLists, type IToDeviceEvent, type ReceivedToDeviceMessage } from "../sync-accumulator.ts";
+import { type ReceivedToDeviceMessage } from "../sync-accumulator.ts";
 import type { ToDeviceBatch, ToDevicePayload } from "../models/ToDeviceMessage.ts";
 import { type MatrixEvent } from "../models/event.ts";
 import { type Room } from "../models/room.ts";
 import { type RoomMember } from "../models/room-member.ts";
-import { type BackupDecryptor, type CryptoBackend, type EventDecryptionResult, type OnSyncCompletedData } from "../common-crypto/CryptoBackend.ts";
+import { type BackupDecryptor, type CryptoBackend, type EventDecryptionResult, type OnSyncCompletedData, type SyncCryptoChanges } from "../common-crypto/CryptoBackend.ts";
 import { type Logger } from "../logger.ts";
 import { type IHttpOpts, type MatrixHttpApi } from "../http-api/index.ts";
 import { type BackupTrustInfo, type BootstrapCrossSigningOpts, type CreateSecretStorageOpts, type CrossSigningKeys, CrossSigningKey, type CrossSigningStatus, type CryptoApi, type CryptoCallbacks, CryptoEvent, type CryptoEventHandlerMap, type DeviceIsolationMode, DeviceVerificationStatus, type EventEncryptionInfo, type GeneratedSecretStorageKey, type ImportRoomKeysOpts, type KeyBackupCheck, type KeyBackupInfo, type KeyBackupRestoreOpts, type KeyBackupRestoreResult, type OwnDeviceKeys, type SecretStorageStatus, type StartDehydrationOpts, UserVerificationStatus, type VerificationRequest } from "../crypto-api/index.ts";
@@ -435,32 +435,12 @@ export declare class RustCrypto extends TypedEventEmitter<RustCryptoEvents, Cryp
      */
     shareRoomHistoryWithUser(roomId: string, userId: string): Promise<void>;
     /**
-     * Apply sync changes to the olm machine
-     * @param events - the received to-device messages
-     * @param oneTimeKeysCounts - the received one time key counts
-     * @param unusedFallbackKeys - the received unused fallback keys
-     * @param devices - the received device list updates
-     * @returns A list of processed to-device messages.
-     */
-    private receiveSyncChanges;
-    /** called by the sync loop to preprocess incoming to-device messages
-     *
-     * @param events - the received to-device messages
-     * @returns A list of preprocessed to-device messages.
-     */
-    preprocessToDeviceMessages(events: IToDeviceEvent[]): Promise<ReceivedToDeviceMessage[]>;
-    /** called by the sync loop to process one time key counts and unused fallback keys
-     *
-     * @param oneTimeKeysCounts - the received one time key counts
-     * @param unusedFallbackKeys - the received unused fallback keys
-     */
-    processKeyCounts(oneTimeKeysCounts?: Record<string, number>, unusedFallbackKeys?: string[]): Promise<void>;
-    /** called by the sync loop to process the notification that device lists have
-     * been changed.
+     * Implementation of {@link SyncCryptoCallbacks.processSyncChanges}.
      *
-     * @param deviceLists - device_lists field from /sync
+     * Passes all of the encryption-relevant data from a sync response to the OlmMachine in a single call, and
+     * post-processes the resulting to-device messages.
      */
-    processDeviceLists(deviceLists: IDeviceLists): Promise<void>;
+    processSyncChanges({ toDeviceEvents, deviceLists, oneTimeKeysCounts, unusedFallbackKeys, useMsc4186, }: SyncCryptoChanges): Promise<ReceivedToDeviceMessage[]>;
     /** called by the sync loop on m.room.encryption events
      *
      * @param room - in which the event was received

package/lib/rust-crypto/rust-crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust-crypto.d.ts","sourceRoot":"","sources":["../../src/rust-crypto/rust-crypto.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,eAAe,MAAM,oCAAoC,CAAC;AAEtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,KAAK,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAC9G,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,KAAK,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EACH,KAAK,eAAe,EACpB,KAAK,aAAa,EAElB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EAC3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,KAAK,MAAM,EAAW,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,aAAa,EAAU,MAAM,sBAAsB,CAAC;AAKlF,OAAO,EAEH,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,eAAe,EAEf,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,WAAW,EACX,KAAK,qBAAqB,EAI1B,KAAK,mBAAmB,EAExB,wBAAwB,EAExB,KAAK,mBAAmB,EAGxB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EAEvB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,sBAAsB,EACtB,KAAK,mBAAmB,EAC3B,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAGH,KAAK,uBAAuB,EAC/B,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAYrE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAc9C,0GAA0G;AAC1G,eAAO,MAAM,uCAAuC,QAAsB,CAAC;AAE3E;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,iBAAiB,CAAC,gBAAgB,EAAE,qBAAqB,CAAE,YAAW,aAAa;IA0B3G,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU;IAE3B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI;IAErB,gCAAgC;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAKvB,8CAA8C;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,mDAAmD;IACnD,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhC,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,0BAA0B;IAlD/C;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAC,kCAAkC,CAAU;IAE7D,OAAO,CAAC,wBAAwB,CAAQ;IACxC,OAAO,CAAC,mBAAmB,CAA2D;IAEtF,2CAA2C;IAC3C,OAAO,CAAC,OAAO,CAAS;IAExB,0CAA0C;IAC1C,OAAO,CAAC,cAAc,CAAqC;IAE3D,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,wBAAwB,CAA2B;IAC3D,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoB;IAClD,OAAO,CAAC,uBAAuB,CAA0B;IACzD,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAgC;IAC3E,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA0B;IAClE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqE;IAE/F,YACqB,MAAM,EAAE,MAAM;IAE/B,4DAA4D;IAC3C,UAAU,EAAE,eAAe,CAAC,UAAU;IAEvD;;;;OAIG;IACc,IAAI,EAAE,aAAa,CAAC,SAAS,GAAG;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC;IAEpE,gCAAgC;IACf,MAAM,EAAE,MAAM;IAE/B,kCAAkC;IAClC,SAAS,EAAE,MAAM;IAEjB,8CAA8C;IAC7B,aAAa,EAAE,uBAAuB;IAEvD,mDAAmD;IAClC,eAAe,EAAE,eAAe;IAEjD,+DAA+D;IAC9C,0BAA0B,GAAE,OAAe,EAuD/D;IAED;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAa5B,IAAW,2BAA2B,CAAC,EAAE,EAAE,OAAO,EAEjD;IAED,IAAW,2BAA2B,IAAI,OAAO,CAGhD;IAEM,IAAI,IAAI,IAAI,CAkBlB;IAEY,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CASxE;IAEY,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAW5E;IAED;;OAEG;IACU,kBAAkB,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,CAexG;IAED;;OAEG;IACU,sBAAsB,CAC/B,IAAI,EAAE,kBAAkB,EAAE,EAC1B,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAEf;IAED;;OAEG;IACU,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAsEnF;IAED;;OAEG;IACU,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtF;IAQM,gCAAgC,UAAS;IAEhD;;OAEG;IACI,UAAU,IAAI,MAAM,CAG1B;IAED;;OAEG;IACI,sBAAsB,CAAC,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAEtE;IAED;;OAEG;IACU,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAKvE;IAED;;OAEG;IACU,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAK5E;IAED;;OAEG;IACU,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC,CAGtD;IAEM,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAMxC;IAEM,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAExD;IAEY,cAAc,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAG3D;IAEY,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CAEnD;IAEY,cAAc,CAAC,IAAI,EAAE,kBAAkB,EAAE,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhG;IAEY,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAExF;IAED;;OAEG;IACU,uBAAuB,CAAC,MAAM,SAAc,EAAE,gBAAgB,UAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAwCrG;IAED;;;;;;;;OAQG;IACU,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,gBAAgB,UAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAgC9F;IAED;;;OAGG;YACW,cAAc;IAgC5B;;;OAGG;YACW,kBAAkB;IAShC;;OAEG;IACI,0BAA0B,IAAI,OAAO,CAE3C;IAED;;OAEG;IACI,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAIpD;IAED;;;;OAIG;IACU,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,UAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB/F;IAED;;;;OAIG;IACU,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc5D;IAED;;OAEG;IACU,2BAA2B,CACpC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAiB1C;IAED;;OAEG;IACU,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAetF;IAED;;OAEG;IACU,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAajE;IAED;;OAEG;IACU,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS1E;IAED;;OAEG;IACU,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,CAkB9F;IAED;;OAEG;IACU,mBAAmB,IAAI,OAAO,CAAC,OAAO,CAAC,CAYnD;IAED;;OAEG;IACU,oBAAoB,CAAC,IAAI,GAAE,eAAwC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA+CxG;IAED;;OAEG;IACU,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjF;IAED;;OAEG;IACU,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAEpD;IAED;;OAEG;IACU,sBAAsB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAkClE;IAED;;OAEG;IACU,sBAAsB,CAAC,EAChC,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,GACpB,GAAE,uBAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C9C;IAED;;;OAGG;YACW,sBAAsB;IAuBpC;;;;;;;OAOG;YACW,kCAAkC;IAgBhD;;;;OAIG;YACW,sBAAsB;IAYpC;;OAEG;IACU,qBAAqB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAsBhE;IAED;;OAEG;IACU,+BAA+B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA+BlG;IAED;;OAEG;IACU,yBAAyB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAE9F;IAED;;;;;;;;OAQG;IACI,yCAAyC,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAOtF;IAED;;;;;;;;;;OAUG;IACI,mCAAmC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAa3G;IAED;;OAEG;IACU,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAiC/F;IAED;;;;;;;;;;OAUG;YACW,8BAA8B;IAgB5C;;OAEG;IACH,OAAO,CAAC,6BAA6B,CAAsC;IAE3E;;;;OAIG;IACI,+BAA+B,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,CAG1E;IAED;;;;;;;;OAQG;IACU,0BAA0B,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAgBtE;IAED;;;;;;;;;;;OAWG;IACU,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAmBrG;IAED;;;;;;OAMG;IACU,0BAA0B,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAIpE;IAED;;;;;;;OAOG;IACU,4BAA4B,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW1F;IAED;;OAEG;IACU,4CAA4C,IAAI,OAAO,CAAC,IAAI,CAAC,CAmBzE;IAED;;;;OAIG;IACU,6BAA6B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEnE;IAED;;OAEG;IACU,gBAAgB,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAE7D;IAED;;;;OAIG;IACU,kBAAkB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAE7E;IAED;;;;OAIG;IACU,uBAAuB,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAErE;IAED;;OAEG;IACU,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;IAED;;OAEG;IACU,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAU3C;IAED;;OAEG;IACU,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa9C;IAED;;;;;;;OAOG;YACW,UAAU;IAoBxB;;OAEG;IACU,8BAA8B,CACvC,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,sBAAsB,CAAC,CAWjC;IAED;;OAEG;IACU,gBAAgB,CAAC,IAAI,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAuB1F;IAED;;OAEG;IACU,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAEtD;IAED;;OAEG;IACU,gBAAgB,CAAC,IAAI,GAAE,oBAAoB,GAAG,OAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtF;IAED;;OAEG;IACU,mBAAmB,CAC5B,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GACtE,OAAO,CAAC,IAAI,CAAC,CAGf;IAED;;OAEG;IACU,mBAAmB,IAAI,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAK5F;IAED;;OAEG;IACU,uBAAuB,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,EAC/C,OAAO,EAAE,eAAe,GACzB,OAAO,CAAC,aAAa,CAAC,CAqCxB;IAED;;OAEG;IACU,eAAe,CAAC,2BAA2B,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB7F;IAED;;;OAGG;YACW,mBAAmB;IAcjC;;OAEG;IACU,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDnF;IAQD;;;;;;;OAOG;YACW,kBAAkB;IAmBhC;;;;OAIG;IACU,0BAA0B,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAoFpG;IAED;;;;OAIG;IACU,gBAAgB,CACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1C,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAC9B,OAAO,CAAC,IAAI,CAAC,CAUf;IAED;;;;OAIG;IACU,kBAAkB,CAAC,WAAW,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAMxE;IAED;;;;OAIG;IACU,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAyCxE;IAED;;;;OAIG;IACI,eAAe,CAAC,SAAS,EAAE,mBAAmB,GAAG,IAAI,CAM3D;IAED;;OAEG;IACU,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,CAEvD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,gCAAgC;IAiBxC,sGAAsG;IACtG,OAAO,CAAC,uBAAuB;IAgB/B;;;;;OAKG;IACI,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAqB5F;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACI,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CAanG;IAED;;;;;;;OAOG;IACU,iBAAiB,CAAC,IAAI,EAAE,eAAe,CAAC,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAKjF;IAED,OAAO,CAAC,gBAAgB;IA0BxB;;;;;;;OAOG;IACU,kBAAkB,CAAC,QAAQ,EAAE,eAAe,CAAC,mBAAmB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB9F;IAED;;;;;;;OAOG;IACU,qBAAqB,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhF;IAED;;;;;;;;;OASG;IACU,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAG9D;IAED;;;;;;;;;;;OAWG;YACW,oBAAoB;IAYlC;;;;;;OAMG;IACU,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYrD;IAED;;;;;OAKG;IACU,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAgClE;IAED;;;;OAIG;YACW,sBAAsB;IAmDpC;;;;;OAKG;IACU,cAAc,IAAI,OAAO,CAAC,eAAe,CAAC,eAAe,GAAG,SAAS,CAAC,CAKlF;IAED;;OAEG;IACU,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOpE;CACJ;AA8VD,KAAK,YAAY,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AACnE,KAAK,gBAAgB,GAAG,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,kCAAkC,CAAC,CAAC"}
+{"version":3,"file":"rust-crypto.d.ts","sourceRoot":"","sources":["../../src/rust-crypto/rust-crypto.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,eAAe,MAAM,oCAAoC,CAAC;AAEtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,EAAuB,KAAK,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,KAAK,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EACH,KAAK,eAAe,EACpB,KAAK,aAAa,EAElB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,KAAK,MAAM,EAAW,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,aAAa,EAAU,MAAM,sBAAsB,CAAC;AAKlF,OAAO,EAEH,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,eAAe,EAEf,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,WAAW,EACX,KAAK,qBAAqB,EAI1B,KAAK,mBAAmB,EAExB,wBAAwB,EAExB,KAAK,mBAAmB,EAGxB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EAEvB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,sBAAsB,EACtB,KAAK,mBAAmB,EAC3B,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAGH,KAAK,uBAAuB,EAC/B,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAYrE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAc9C,0GAA0G;AAC1G,eAAO,MAAM,uCAAuC,QAAsB,CAAC;AAE3E;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,iBAAiB,CAAC,gBAAgB,EAAE,qBAAqB,CAAE,YAAW,aAAa;IA0B3G,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU;IAE3B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI;IAErB,gCAAgC;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAKvB,8CAA8C;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,mDAAmD;IACnD,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhC,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,0BAA0B;IAlD/C;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAC,kCAAkC,CAAU;IAE7D,OAAO,CAAC,wBAAwB,CAAQ;IACxC,OAAO,CAAC,mBAAmB,CAA2D;IAEtF,2CAA2C;IAC3C,OAAO,CAAC,OAAO,CAAS;IAExB,0CAA0C;IAC1C,OAAO,CAAC,cAAc,CAAqC;IAE3D,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,wBAAwB,CAA2B;IAC3D,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoB;IAClD,OAAO,CAAC,uBAAuB,CAA0B;IACzD,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAgC;IAC3E,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA0B;IAClE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqE;IAE/F,YACqB,MAAM,EAAE,MAAM;IAE/B,4DAA4D;IAC3C,UAAU,EAAE,eAAe,CAAC,UAAU;IAEvD;;;;OAIG;IACc,IAAI,EAAE,aAAa,CAAC,SAAS,GAAG;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC;IAEpE,gCAAgC;IACf,MAAM,EAAE,MAAM;IAE/B,kCAAkC;IAClC,SAAS,EAAE,MAAM;IAEjB,8CAA8C;IAC7B,aAAa,EAAE,uBAAuB;IAEvD,mDAAmD;IAClC,eAAe,EAAE,eAAe;IAEjD,+DAA+D;IAC9C,0BAA0B,GAAE,OAAe,EAuD/D;IAED;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAa5B,IAAW,2BAA2B,CAAC,EAAE,EAAE,OAAO,EAEjD;IAED,IAAW,2BAA2B,IAAI,OAAO,CAGhD;IAEM,IAAI,IAAI,IAAI,CAkBlB;IAEY,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CASxE;IAEY,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAW5E;IAED;;OAEG;IACU,kBAAkB,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,CAexG;IAED;;OAEG;IACU,sBAAsB,CAC/B,IAAI,EAAE,kBAAkB,EAAE,EAC1B,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAEf;IAED;;OAEG;IACU,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAsEnF;IAED;;OAEG;IACU,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtF;IAQM,gCAAgC,UAAS;IAEhD;;OAEG;IACI,UAAU,IAAI,MAAM,CAG1B;IAED;;OAEG;IACI,sBAAsB,CAAC,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAEtE;IAED;;OAEG;IACU,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAKvE;IAED;;OAEG;IACU,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAK5E;IAED;;OAEG;IACU,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC,CAGtD;IAEM,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAMxC;IAEM,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAExD;IAEY,cAAc,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAG3D;IAEY,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CAEnD;IAEY,cAAc,CAAC,IAAI,EAAE,kBAAkB,EAAE,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhG;IAEY,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAExF;IAED;;OAEG;IACU,uBAAuB,CAAC,MAAM,SAAc,EAAE,gBAAgB,UAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAwCrG;IAED;;;;;;;;OAQG;IACU,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,gBAAgB,UAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAgC9F;IAED;;;OAGG;YACW,cAAc;IAgC5B;;;OAGG;YACW,kBAAkB;IAShC;;OAEG;IACI,0BAA0B,IAAI,OAAO,CAE3C;IAED;;OAEG;IACI,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAIpD;IAED;;;;OAIG;IACU,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,UAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB/F;IAED;;;;OAIG;IACU,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc5D;IAED;;OAEG;IACU,2BAA2B,CACpC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAiB1C;IAED;;OAEG;IACU,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAetF;IAED;;OAEG;IACU,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAajE;IAED;;OAEG;IACU,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS1E;IAED;;OAEG;IACU,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,CAkB9F;IAED;;OAEG;IACU,mBAAmB,IAAI,OAAO,CAAC,OAAO,CAAC,CAYnD;IAED;;OAEG;IACU,oBAAoB,CAAC,IAAI,GAAE,eAAwC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA+CxG;IAED;;OAEG;IACU,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjF;IAED;;OAEG;IACU,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAEpD;IAED;;OAEG;IACU,sBAAsB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAkClE;IAED;;OAEG;IACU,sBAAsB,CAAC,EAChC,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,GACpB,GAAE,uBAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C9C;IAED;;;OAGG;YACW,sBAAsB;IAuBpC;;;;;;;OAOG;YACW,kCAAkC;IAgBhD;;;;OAIG;YACW,sBAAsB;IAYpC;;OAEG;IACU,qBAAqB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAsBhE;IAED;;OAEG;IACU,+BAA+B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA+BlG;IAED;;OAEG;IACU,yBAAyB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAE9F;IAED;;;;;;;;OAQG;IACI,yCAAyC,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAOtF;IAED;;;;;;;;;;OAUG;IACI,mCAAmC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAa3G;IAED;;OAEG;IACU,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAiC/F;IAED;;;;;;;;;;OAUG;YACW,8BAA8B;IAgB5C;;OAEG;IACH,OAAO,CAAC,6BAA6B,CAAsC;IAE3E;;;;OAIG;IACI,+BAA+B,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,CAG1E;IAED;;;;;;;;OAQG;IACU,0BAA0B,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAgBtE;IAED;;;;;;;;;;;OAWG;IACU,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAmBrG;IAED;;;;;;OAMG;IACU,0BAA0B,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAIpE;IAED;;;;;;;OAOG;IACU,4BAA4B,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW1F;IAED;;OAEG;IACU,4CAA4C,IAAI,OAAO,CAAC,IAAI,CAAC,CAmBzE;IAED;;;;OAIG;IACU,6BAA6B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEnE;IAED;;OAEG;IACU,gBAAgB,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAE7D;IAED;;;;OAIG;IACU,kBAAkB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAE7E;IAED;;;;OAIG;IACU,uBAAuB,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAErE;IAED;;OAEG;IACU,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;IAED;;OAEG;IACU,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAU3C;IAED;;OAEG;IACU,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa9C;IAED;;;;;;;OAOG;YACW,UAAU;IAoBxB;;OAEG;IACU,8BAA8B,CACvC,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,sBAAsB,CAAC,CAWjC;IAED;;OAEG;IACU,gBAAgB,CAAC,IAAI,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAuB1F;IAED;;OAEG;IACU,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAEtD;IAED;;OAEG;IACU,gBAAgB,CAAC,IAAI,GAAE,oBAAoB,GAAG,OAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtF;IAED;;OAEG;IACU,mBAAmB,CAC5B,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GACtE,OAAO,CAAC,IAAI,CAAC,CAGf;IAED;;OAEG;IACU,mBAAmB,IAAI,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAK5F;IAED;;OAEG;IACU,uBAAuB,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,EAC/C,OAAO,EAAE,eAAe,GACzB,OAAO,CAAC,aAAa,CAAC,CAqCxB;IAED;;OAEG;IACU,eAAe,CAAC,2BAA2B,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB7F;IAED;;;OAGG;YACW,mBAAmB;IAcjC;;OAEG;IACU,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDnF;IAQD;;;;;OAKG;IACU,kBAAkB,CAAC,EAC5B,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,UAAkB,GACrB,EAAE,iBAAiB,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CA8FxD;IAED;;;;OAIG;IACU,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAyCxE;IAED;;;;OAIG;IACI,eAAe,CAAC,SAAS,EAAE,mBAAmB,GAAG,IAAI,CAM3D;IAED;;OAEG;IACU,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,CAEvD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,gCAAgC;IAiBxC,sGAAsG;IACtG,OAAO,CAAC,uBAAuB;IAgB/B;;;;;OAKG;IACI,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAqB5F;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACI,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CAanG;IAED;;;;;;;OAOG;IACU,iBAAiB,CAAC,IAAI,EAAE,eAAe,CAAC,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAKjF;IAED,OAAO,CAAC,gBAAgB;IA0BxB;;;;;;;OAOG;IACU,kBAAkB,CAAC,QAAQ,EAAE,eAAe,CAAC,mBAAmB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB9F;IAED;;;;;;;OAOG;IACU,qBAAqB,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhF;IAED;;;;;;;;;OASG;IACU,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAG9D;IAED;;;;;;;;;;;OAWG;YACW,oBAAoB;IAYlC;;;;;;OAMG;IACU,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYrD;IAED;;;;;OAKG;IACU,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAgClE;IAED;;;;OAIG;YACW,sBAAsB;IAmDpC;;;;;OAKG;IACU,cAAc,IAAI,OAAO,CAAC,eAAe,CAAC,eAAe,GAAG,SAAS,CAAC,CAKlF;IAED;;OAEG;IACU,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOpE;CACJ;AA8VD,KAAK,YAAY,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AACnE,KAAK,gBAAgB,GAAG,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,kCAAkC,CAAC,CAAC"}