mindoodb 0.0.50 → 0.0.53

package/dist/core/userid/canonicalUsername.js

@@ -0,0 +1,235 @@
+"use strict";
+/**
+ * Notes/Domino-style username canonicalization. Keep in lockstep with Haven
+ * `src/shared/lib/names/canonicalNames.ts` so `_encryptFor` keys, recipient
+ * matching, and UI name fields use one algorithm.
+ *
+ * Comparison (`normalizeCanonicalNameForComparison` / {@link usernamesEqual})
+ * abbreviates typed segments then lowercases, so `cn=Alice/o=Acme`,
+ * `CN=alice/O=acme`, and `Alice/Acme` are the same person.
+ *
+ * Persist keys ({@link canonicalizeUsername}) expand abbreviated names the same
+ * way Haven does (`cn=` first, `ou=` middle, `o=` last), then uppercase types
+ * and lowercase NFKC-normalized values. The result must include `O=`; the
+ * tenant id is a random string and must not be substituted for the organization.
+ *
+ * Display / `_encryptFor.label` ({@link formatCanonicalUsernameLabel}) uses the
+ * same expand, but lowercase types and the original value case so UI chips can
+ * abbreviate to `Maya Chen/Acme` instead of the persist key `maya chen/acme`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.abbreviateCanonicalName = abbreviateCanonicalName;
+exports.expandAbbreviatedName = expandAbbreviatedName;
+exports.sanitizeCanonicalNamePart = sanitizeCanonicalNamePart;
+exports.buildCanonicalName = buildCanonicalName;
+exports.parseCanonicalName = parseCanonicalName;
+exports.isCanonicalName = isCanonicalName;
+exports.formatCanonicalDisplayName = formatCanonicalDisplayName;
+exports.normalizeCanonicalNameForComparison = normalizeCanonicalNameForComparison;
+exports.getCanonicalNameVariants = getCanonicalNameVariants;
+exports.canonicalizeUsername = canonicalizeUsername;
+exports.formatCanonicalUsernameLabel = formatCanonicalUsernameLabel;
+exports.usernamesEqual = usernamesEqual;
+const CANONICAL_PART_PATTERN = /^\s*([^=]+)\s*=\s*(.*?)\s*$/;
+function splitNameParts(value) {
+    return value
+        .split("/")
+        .map((part) => part.trim())
+        .filter(Boolean);
+}
+function abbreviateCanonicalName(value) {
+    const parts = splitNameParts(value);
+    if (!parts.length) {
+        return value.trim();
+    }
+    const abbreviatedParts = [];
+    for (const part of parts) {
+        const match = CANONICAL_PART_PATTERN.exec(part);
+        if (!match) {
+            return value.trim();
+        }
+        const partValue = match[2].trim();
+        if (!partValue) {
+            return value.trim();
+        }
+        abbreviatedParts.push(partValue);
+    }
+    return abbreviatedParts.join("/");
+}
+function expandAbbreviatedName(value) {
+    const normalized = value.trim();
+    if (isCanonicalName(normalized)) {
+        return normalized;
+    }
+    const parts = splitNameParts(normalized);
+    if (parts.length < 2) {
+        return normalized;
+    }
+    const lastIndex = parts.length - 1;
+    return parts
+        .map((part, index) => {
+        // Leave segments that already carry an explicit key (e.g. "o=myorg") untouched,
+        // so mixed input like "test/o=myorg" does not become "cn=test/o=o=myorg".
+        if (CANONICAL_PART_PATTERN.test(part)) {
+            return part;
+        }
+        if (index === 0) {
+            return `cn=${part}`;
+        }
+        if (index === lastIndex) {
+            return `o=${part}`;
+        }
+        return `ou=${part}`;
+    })
+        .join("/");
+}
+/**
+ * Strip characters that would break the canonical name structure: `/` separates
+ * the segments and `=` separates a segment's key from its value, so neither may
+ * appear inside a single field's value.
+ */
+function sanitizeCanonicalNamePart(value) {
+    return (value ?? "").replace(/[/=]/g, "");
+}
+/**
+ * Build a canonical Notes-style name from separate fields, e.g.
+ * `{ cn: "Jane Doe", o: "Acme" }` becomes `cn=Jane Doe/o=Acme`.
+ *
+ * Empty parts are omitted and structure-breaking characters (`/`, `=`) are
+ * stripped, so the result is always a valid canonical name. When the common
+ * name is missing an empty string is returned, which lets callers treat
+ * "no name yet" as an empty preview.
+ */
+function buildCanonicalName(parts) {
+    const cn = sanitizeCanonicalNamePart(parts.cn).trim();
+    const ou = sanitizeCanonicalNamePart(parts.ou).trim();
+    const o = sanitizeCanonicalNamePart(parts.o).trim();
+    if (!cn) {
+        return "";
+    }
+    const segments = [`cn=${cn}`];
+    if (ou) {
+        segments.push(`ou=${ou}`);
+    }
+    if (o) {
+        segments.push(`o=${o}`);
+    }
+    return segments.join("/");
+}
+/**
+ * Split a canonical (or abbreviated) name back into `cn`/`ou`/`o` fields so the
+ * structured identity inputs can be pre-filled from an existing username.
+ *
+ * Only the first `cn` and `o` are used; multiple `ou` segments are joined with
+ * `/` to avoid data loss even though the wizard currently edits a single level.
+ */
+function parseCanonicalName(value) {
+    const result = { cn: "", ou: "", o: "" };
+    const canonical = isCanonicalName(value) ? value : expandAbbreviatedName(value?.trim() ?? "");
+    const organizationUnits = [];
+    for (const part of splitNameParts(canonical)) {
+        const match = CANONICAL_PART_PATTERN.exec(part);
+        if (!match) {
+            continue;
+        }
+        const key = match[1].trim().toLowerCase();
+        const partValue = match[2].trim();
+        if (!partValue) {
+            continue;
+        }
+        if (key === "cn" && !result.cn) {
+            result.cn = partValue;
+        }
+        else if (key === "o" && !result.o) {
+            result.o = partValue;
+        }
+        else if (key === "ou") {
+            organizationUnits.push(partValue);
+        }
+    }
+    result.ou = organizationUnits.join("/");
+    return result;
+}
+function isCanonicalName(value) {
+    const parts = splitNameParts(value?.trim() ?? "");
+    if (!parts.length) {
+        return false;
+    }
+    return parts.every((part) => {
+        const match = CANONICAL_PART_PATTERN.exec(part);
+        return Boolean(match?.[1]?.trim() && match[2]?.trim());
+    });
+}
+function formatCanonicalDisplayName(value, fallback = "") {
+    if (!value) {
+        return fallback;
+    }
+    const abbreviated = abbreviateCanonicalName(value);
+    return abbreviated || fallback;
+}
+function normalizeCanonicalNameForComparison(value) {
+    const normalized = value?.trim();
+    if (!normalized) {
+        return "";
+    }
+    return abbreviateCanonicalName(normalized).trim().toLowerCase();
+}
+function getCanonicalNameVariants(value) {
+    const normalized = value?.trim();
+    if (!normalized) {
+        return [];
+    }
+    const abbreviated = abbreviateCanonicalName(normalized);
+    const commonName = abbreviated.split("/")[0]?.trim() || abbreviated;
+    return Array.from(new Set([normalized, abbreviated, commonName].filter(Boolean)));
+}
+function parseExpandedRdns(username, typeCase, valueCase) {
+    const trimmed = username.trim().normalize("NFKC");
+    if (!trimmed) {
+        throw new Error("Username must not be empty");
+    }
+    const expanded = expandAbbreviatedName(trimmed);
+    const rdns = [];
+    for (const part of splitNameParts(expanded)) {
+        const match = CANONICAL_PART_PATTERN.exec(part);
+        if (!match?.[1]?.trim() || !match[2]?.trim()) {
+            throw new Error(`Username must include an organization (O=...): got "${username.trim()}"`);
+        }
+        const type = match[1].trim();
+        const value = match[2].trim();
+        rdns.push({
+            type: typeCase === "upper" ? type.toUpperCase() : type.toLowerCase(),
+            value: valueCase === "lower" ? value.toLowerCase() : value,
+        });
+    }
+    const orgType = typeCase === "upper" ? "O" : "o";
+    if (!rdns.some((rdn) => rdn.type === orgType && rdn.value)) {
+        throw new Error(`Username must include an organization (O=...): got "${username.trim()}"`);
+    }
+    return rdns;
+}
+/**
+ * Stable `_encryptFor` map key: Haven expand, then uppercase types and
+ * lowercase NFKC values. Throws if the name has no organization after expand.
+ */
+function canonicalizeUsername(username) {
+    return parseExpandedRdns(username, "upper", "lower")
+        .map((rdn) => `${rdn.type}=${rdn.value}`)
+        .join("/");
+}
+/**
+ * Display spelling for `_encryptFor.label` and similar UI fields: Haven expand,
+ * lowercase attribute types, keep value case. Persist map keys stay on
+ * {@link canonicalizeUsername}.
+ */
+function formatCanonicalUsernameLabel(username) {
+    return parseExpandedRdns(username, "lower", "preserve")
+        .map((rdn) => `${rdn.type}=${rdn.value}`)
+        .join("/");
+}
+function usernamesEqual(a, b) {
+    const left = normalizeCanonicalNameForComparison(a.normalize("NFKC"));
+    const right = normalizeCanonicalNameForComparison(b.normalize("NFKC"));
+    return left.length > 0 && left === right;
+}
+//# sourceMappingURL=canonicalUsername.js.map

package/dist/core/userid/canonicalUsername.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalUsername.js","sourceRoot":"","sources":["../../../src/core/userid/canonicalUsername.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;AAWH,0DAqBC;AAED,sDA4BC;AAaD,8DAEC;AAWD,gDAeC;AASD,gDA0BC;AAED,0CAUC;AAED,gEAMC;AAED,kFAMC;AAED,4DASC;AAwCD,oDAIC;AAOD,oEAIC;AAED,wCAIC;AA5OD,MAAM,sBAAsB,GAAG,6BAA6B,CAAC;AAE7D,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAgB,uBAAuB,CAAC,KAAa;IACnD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,gBAAgB,GAAa,EAAE,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,SAAgB,qBAAqB,CAAC,KAAa;IACjD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACnC,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACnB,gFAAgF;QAChF,0EAA0E;QAC1E,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,CAAC;QACD,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAQD;;;;GAIG;AACH,SAAgB,yBAAyB,CAAC,KAAgC;IACxE,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,kBAAkB,CAAC,KAAyB;IAC1D,MAAM,EAAE,GAAG,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,EAAE,GAAG,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,CAAC,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9B,IAAI,EAAE,EAAE,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,EAAE,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,KAAgC;IACjE,MAAM,MAAM,GAA0C,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;IAChF,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1G,MAAM,iBAAiB,GAAa,EAAE,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAC/B,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC;QACxB,CAAC;aAAM,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;QACvB,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACxB,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,eAAe,CAAC,KAAgC;IAC9D,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,0BAA0B,CAAC,KAAgC,EAAE,QAAQ,GAAG,EAAE;IACxF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,WAAW,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACnD,OAAO,WAAW,IAAI,QAAQ,CAAC;AACjC,CAAC;AAED,SAAgB,mCAAmC,CAAC,KAAgC;IAClF,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,uBAAuB,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClE,CAAC;AAED,SAAgB,wBAAwB,CAAC,KAAgC;IACvE,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,WAAW,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,WAAW,CAAC;IACpE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAgB,EAChB,QAA2B,EAC3B,SAA+B;IAE/B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,IAAI,GAA2C,EAAE,CAAC;IACxD,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,uDAAuD,QAAQ,CAAC,IAAI,EAAE,GAAG,CAC1E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;YACpE,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK;SAC3D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,uDAAuD,QAAQ,CAAC,IAAI,EAAE,GAAG,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,QAAgB;IACnD,OAAO,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC;SACjD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;SACxC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAgB,4BAA4B,CAAC,QAAgB;IAC3D,OAAO,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC;SACpD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;SACxC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,cAAc,CAAC,CAAS,EAAE,CAAS;IACjD,MAAM,IAAI,GAAG,mCAAmC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,mCAAmC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,KAAK,CAAC;AAC3C,CAAC"}

package/dist/core/userid/index.d.ts

@@ -1,4 +1,6 @@
 import { SigningKeyPair, EncryptionKeyPair } from "../types";
+export { abbreviateCanonicalName, buildCanonicalName, canonicalizeUsername, expandAbbreviatedName, formatCanonicalDisplayName, formatCanonicalUsernameLabel, getCanonicalNameVariants, isCanonicalName, normalizeCanonicalNameForComparison, parseCanonicalName, sanitizeCanonicalNamePart, usernamesEqual, } from "./canonicalUsername";
+export type { CanonicalNameParts } from "./canonicalUsername";
 /**
  * Public info for a user of the platform
  */
@@ -39,5 +41,12 @@ export interface PrivateUserId {
      * Used ONLY for encrypting/decrypting the named symmetric keys map stored on disk, not for signing.
      */
     userEncryptionKeyPair: EncryptionKeyPair;
+    /**
+     * Person-bound RSA-OAEP User-Key (docs/userkeys.md). Password-encrypted with
+     * salt `"userkey"`, same wrapping as the device encryption key. Optional on
+     * identities created before User-Keys existed; generated before a join
+     * request and included in paper backups of this object.
+     */
+    userKeyPair?: EncryptionKeyPair;
 }
 //# sourceMappingURL=index.d.ts.map

package/dist/core/userid/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/userid/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7D;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,kBAAkB,EAAE,cAAc,CAAC;IAEnC;;;;OAIG;IACH,qBAAqB,EAAE,iBAAiB,CAAC;CAC1C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/userid/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7D,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,EAC5B,wBAAwB,EACxB,eAAe,EACf,mCAAmC,EACnC,kBAAkB,EAClB,yBAAyB,EACzB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,kBAAkB,EAAE,cAAc,CAAC;IAEnC;;;;OAIG;IACH,qBAAqB,EAAE,iBAAiB,CAAC;IAEzC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC"}

package/dist/core/userid/index.js

@@ -1,3 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.usernamesEqual = exports.sanitizeCanonicalNamePart = exports.parseCanonicalName = exports.normalizeCanonicalNameForComparison = exports.isCanonicalName = exports.getCanonicalNameVariants = exports.formatCanonicalUsernameLabel = exports.formatCanonicalDisplayName = exports.expandAbbreviatedName = exports.canonicalizeUsername = exports.buildCanonicalName = exports.abbreviateCanonicalName = void 0;
+var canonicalUsername_1 = require("./canonicalUsername");
+Object.defineProperty(exports, "abbreviateCanonicalName", { enumerable: true, get: function () { return canonicalUsername_1.abbreviateCanonicalName; } });
+Object.defineProperty(exports, "buildCanonicalName", { enumerable: true, get: function () { return canonicalUsername_1.buildCanonicalName; } });
+Object.defineProperty(exports, "canonicalizeUsername", { enumerable: true, get: function () { return canonicalUsername_1.canonicalizeUsername; } });
+Object.defineProperty(exports, "expandAbbreviatedName", { enumerable: true, get: function () { return canonicalUsername_1.expandAbbreviatedName; } });
+Object.defineProperty(exports, "formatCanonicalDisplayName", { enumerable: true, get: function () { return canonicalUsername_1.formatCanonicalDisplayName; } });
+Object.defineProperty(exports, "formatCanonicalUsernameLabel", { enumerable: true, get: function () { return canonicalUsername_1.formatCanonicalUsernameLabel; } });
+Object.defineProperty(exports, "getCanonicalNameVariants", { enumerable: true, get: function () { return canonicalUsername_1.getCanonicalNameVariants; } });
+Object.defineProperty(exports, "isCanonicalName", { enumerable: true, get: function () { return canonicalUsername_1.isCanonicalName; } });
+Object.defineProperty(exports, "normalizeCanonicalNameForComparison", { enumerable: true, get: function () { return canonicalUsername_1.normalizeCanonicalNameForComparison; } });
+Object.defineProperty(exports, "parseCanonicalName", { enumerable: true, get: function () { return canonicalUsername_1.parseCanonicalName; } });
+Object.defineProperty(exports, "sanitizeCanonicalNamePart", { enumerable: true, get: function () { return canonicalUsername_1.sanitizeCanonicalNamePart; } });
+Object.defineProperty(exports, "usernamesEqual", { enumerable: true, get: function () { return canonicalUsername_1.usernamesEqual; } });
 //# sourceMappingURL=index.js.map

package/dist/core/userid/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/userid/index.ts"],"names":[],"mappings":""}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/userid/index.ts"],"names":[],"mappings":";;;AAEA,yDAa6B;AAZ3B,4HAAA,uBAAuB,OAAA;AACvB,uHAAA,kBAAkB,OAAA;AAClB,yHAAA,oBAAoB,OAAA;AACpB,0HAAA,qBAAqB,OAAA;AACrB,+HAAA,0BAA0B,OAAA;AAC1B,iIAAA,4BAA4B,OAAA;AAC5B,6HAAA,wBAAwB,OAAA;AACxB,oHAAA,eAAe,OAAA;AACf,wIAAA,mCAAmC,OAAA;AACnC,uHAAA,kBAAkB,OAAA;AAClB,8HAAA,yBAAyB,OAAA;AACzB,mHAAA,cAAc,OAAA"}

package/dist/core/userkeys/UserKeyDocument.d.ts

@@ -0,0 +1,50 @@
+import type { EncryptedPrivateKey, MindooDB, MindooDoc, SigningKeyPair } from "../types";
+import type { CryptoAdapter } from "../crypto/CryptoAdapter";
+import { currentUserKeyEpoch, isPendingUserKeyDocument, userKeyDocumentId, type UserKeyDeviceWrap, type UserKeyDocumentPayload, type UserKeyGeneration } from "./types";
+export { isPendingUserKeyDocument, currentUserKeyEpoch, userKeyDocumentId };
+/** Copy `username_hash` / `username_hash_v` from a grantaccess document (docs/userkeys.md §6.1). */
+export declare function usernameHashBindingFromGrant(data: Record<string, unknown>): {
+    usernameHash: string;
+    usernameHashVersion: number;
+} | null;
+export declare function buildPendingUserKeyPayload(input: {
+    usernameHash: string;
+    usernameHashVersion: number;
+    publicKey: string;
+    fingerprint: string;
+    createdAt: number;
+}): UserKeyDocumentPayload;
+export declare function createPendingUserKeyDocument(input: {
+    db: MindooDB;
+    grantDocId: string;
+    usernameHash: string;
+    usernameHashVersion: number;
+    publicKey: string;
+    fingerprint: string;
+    signingKeyPair?: SigningKeyPair;
+    signingKeyPassword?: string;
+    assumeUniqueId?: boolean;
+}): Promise<MindooDoc>;
+export declare function wrapPrivateKeyForDevice(input: {
+    cryptoAdapter: CryptoAdapter;
+    privateKeyBytes: Uint8Array;
+    deviceEncryptionPublicKey: string;
+}): Promise<string>;
+export declare function writeDeviceWrap(input: {
+    db: MindooDB;
+    doc: MindooDoc;
+    epoch: string;
+    deviceFingerprint: string;
+    wrap: UserKeyDeviceWrap;
+}): Promise<void>;
+export declare function replaceUserKeys(db: MindooDB, doc: MindooDoc, userKeys: UserKeyDocumentPayload["userKeys"]): Promise<void>;
+export declare function replaceRejectedDevices(db: MindooDB, doc: MindooDoc, rejectedDevices: UserKeyDocumentPayload["rejectedDevices"]): Promise<void>;
+export declare function fingerprintUserPublicKey(publicKeyPem: string, cryptoAdapter: CryptoAdapter): Promise<string>;
+export declare function unwrapPrivateKeyFromDevice(input: {
+    cryptoAdapter: CryptoAdapter;
+    wrappedKeyB64: string;
+    deviceEncryptionPrivateKey: CryptoKey;
+}): Promise<Uint8Array>;
+export declare function generationAt(payload: UserKeyDocumentPayload, epoch: string): UserKeyGeneration | undefined;
+export type { EncryptedPrivateKey };
+//# sourceMappingURL=UserKeyDocument.d.ts.map

package/dist/core/userkeys/UserKeyDocument.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserKeyDocument.d.ts","sourceRoot":"","sources":["../../../src/core/userkeys/UserKeyDocument.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAGzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAIL,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACvB,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC;AAE5E,oGAAoG;AACpG,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAC3E,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,IAAI,CAQP;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,sBAAsB,CAgBzB;AAwBD,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,EAAE,EAAE,QAAQ,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,OAAO,CAAC,SAAS,CAAC,CA6BrB;AAED,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,aAAa,EAAE,aAAa,CAAC;IAC7B,eAAe,EAAE,UAAU,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;CACnC,GAAG,OAAO,CAAC,MAAM,CAAC,CAIlB;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,EAAE,EAAE,QAAQ,CAAC;IACb,GAAG,EAAE,SAAS,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,iBAAiB,CAAC;CACzB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BhB;AAED,wBAAsB,eAAe,CACnC,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,SAAS,EACd,QAAQ,EAAE,sBAAsB,CAAC,UAAU,CAAC,GAC3C,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,SAAS,EACd,eAAe,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,GACzD,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,wBAAwB,CAC5C,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,aAAa,EAAE,aAAa,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,0BAA0B,EAAE,SAAS,CAAC;CACvC,GAAG,OAAO,CAAC,UAAU,CAAC,CAGtB;AAED,wBAAgB,YAAY,CAC1B,OAAO,EAAE,sBAAsB,EAC/B,KAAK,EAAE,MAAM,GACZ,iBAAiB,GAAG,SAAS,CAE/B;AAED,YAAY,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/core/userkeys/UserKeyDocument.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userKeyDocumentId = exports.currentUserKeyEpoch = exports.isPendingUserKeyDocument = void 0;
+exports.usernameHashBindingFromGrant = usernameHashBindingFromGrant;
+exports.buildPendingUserKeyPayload = buildPendingUserKeyPayload;
+exports.createPendingUserKeyDocument = createPendingUserKeyDocument;
+exports.wrapPrivateKeyForDevice = wrapPrivateKeyForDevice;
+exports.writeDeviceWrap = writeDeviceWrap;
+exports.replaceUserKeys = replaceUserKeys;
+exports.replaceRejectedDevices = replaceRejectedDevices;
+exports.fingerprintUserPublicKey = fingerprintUserPublicKey;
+exports.unwrapPrivateKeyFromDevice = unwrapPrivateKeyFromDevice;
+exports.generationAt = generationAt;
+const types_1 = require("../types");
+const RSAEncryption_1 = require("../crypto/RSAEncryption");
+const types_2 = require("./types");
+Object.defineProperty(exports, "currentUserKeyEpoch", { enumerable: true, get: function () { return types_2.currentUserKeyEpoch; } });
+Object.defineProperty(exports, "isPendingUserKeyDocument", { enumerable: true, get: function () { return types_2.isPendingUserKeyDocument; } });
+Object.defineProperty(exports, "userKeyDocumentId", { enumerable: true, get: function () { return types_2.userKeyDocumentId; } });
+const fingerprint_1 = require("./fingerprint");
+/** Copy `username_hash` / `username_hash_v` from a grantaccess document (docs/userkeys.md §6.1). */
+function usernameHashBindingFromGrant(data) {
+    const usernameHash = typeof data.username_hash === "string" ? data.username_hash : "";
+    if (!usernameHash)
+        return null;
+    const version = data.username_hash_v;
+    return {
+        usernameHash,
+        usernameHashVersion: typeof version === "number" && Number.isInteger(version) ? version : 1,
+    };
+}
+function buildPendingUserKeyPayload(input) {
+    return {
+        form: types_2.USERKEY_FORM,
+        type: types_2.USERKEY_TYPE,
+        schemaVersion: types_2.USERKEY_SCHEMA_VERSION,
+        username_hash: input.usernameHash,
+        username_hash_v: input.usernameHashVersion,
+        userKeys: {
+            "1": {
+                publicKey: input.publicKey,
+                fingerprint: input.fingerprint,
+                createdAt: input.createdAt,
+                deviceWraps: {},
+            },
+        },
+    };
+}
+/** Drop `undefined` so Automerge does not throw `RangeError: invalid value`. */
+function plainJson(value) {
+    return JSON.parse(JSON.stringify(value));
+}
+/**
+ * Nested `applyJsonPatch` hydrates objects through Automerge's
+ * `putObjectFromHydrate`, which throws `RangeError: invalid value` on this
+ * document shape. `changeDoc` assigns a top-level field inside `Automerge.change`,
+ * which is the same path `createDocument` already uses successfully.
+ */
+async function replaceTopLevelField(db, doc, field, value) {
+    await db.changeDoc(doc, (editable) => {
+        editable.getData()[field] = plainJson(value);
+    });
+}
+async function createPendingUserKeyDocument(input) {
+    const payload = buildPendingUserKeyPayload({
+        usernameHash: input.usernameHash,
+        usernameHashVersion: input.usernameHashVersion,
+        publicKey: input.publicKey,
+        fingerprint: input.fingerprint,
+        createdAt: Date.now(),
+    });
+    const id = (0, types_2.userKeyDocumentId)(input.grantDocId);
+    const create = {
+        decryptionKeyId: types_1.PUBLIC_INFOS_KEY_ID,
+        signingKeyPair: input.signingKeyPair,
+        signingKeyPassword: input.signingKeyPassword,
+        initialValues: payload,
+    };
+    try {
+        return await input.db.createDocument({
+            ...create,
+            id,
+            assumeUniqueId: input.assumeUniqueId ?? true,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (!message.includes("invalid document id"))
+            throw error;
+        return input.db.createDocument({
+            ...create,
+            idPrefix: "userkey",
+        });
+    }
+}
+async function wrapPrivateKeyForDevice(input) {
+    const rsa = new RSAEncryption_1.RSAEncryption(input.cryptoAdapter);
+    const wrapped = await rsa.encrypt(input.privateKeyBytes, input.deviceEncryptionPublicKey);
+    return (0, fingerprint_1.bytesToBase64)(wrapped);
+}
+async function writeDeviceWrap(input) {
+    const payload = input.doc.getData();
+    const userKeys = plainJson(payload.userKeys ?? {});
+    const gen = userKeys[input.epoch] ?? {
+        publicKey: "",
+        fingerprint: "",
+        createdAt: Date.now(),
+        deviceWraps: {},
+    };
+    gen.deviceWraps = { ...(gen.deviceWraps ?? {}) };
+    const existing = gen.deviceWraps[input.deviceFingerprint];
+    if (existing?.wrappedKey) {
+        if (!existing.label && input.wrap.label) {
+            gen.deviceWraps[input.deviceFingerprint] = { ...existing, label: input.wrap.label };
+            userKeys[input.epoch] = gen;
+            await replaceTopLevelField(input.db, input.doc, "userKeys", userKeys);
+        }
+        return;
+    }
+    gen.deviceWraps[input.deviceFingerprint] = {
+        wrappedKey: input.wrap.wrappedKey,
+        approvedAt: input.wrap.approvedAt,
+        approvedBySigningPublicKey: input.wrap.approvedBySigningPublicKey,
+        ...(input.wrap.label ? { label: input.wrap.label } : {}),
+    };
+    userKeys[input.epoch] = gen;
+    await replaceTopLevelField(input.db, input.doc, "userKeys", userKeys);
+}
+async function replaceUserKeys(db, doc, userKeys) {
+    await replaceTopLevelField(db, doc, "userKeys", userKeys);
+}
+async function replaceRejectedDevices(db, doc, rejectedDevices) {
+    await replaceTopLevelField(db, doc, "rejectedDevices", rejectedDevices ?? {});
+}
+async function fingerprintUserPublicKey(publicKeyPem, cryptoAdapter) {
+    return (0, fingerprint_1.fingerprintEncryptionPublicKey)(publicKeyPem, cryptoAdapter.getSubtle());
+}
+async function unwrapPrivateKeyFromDevice(input) {
+    const rsa = new RSAEncryption_1.RSAEncryption(input.cryptoAdapter);
+    return rsa.decrypt((0, fingerprint_1.base64ToBytes)(input.wrappedKeyB64), input.deviceEncryptionPrivateKey);
+}
+function generationAt(payload, epoch) {
+    return payload.userKeys?.[epoch];
+}
+//# sourceMappingURL=UserKeyDocument.js.map

package/dist/core/userkeys/UserKeyDocument.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserKeyDocument.js","sourceRoot":"","sources":["../../../src/core/userkeys/UserKeyDocument.ts"],"names":[],"mappings":";;;AAoBA,oEAWC;AAED,gEAsBC;AAwBD,oEAuCC;AAED,0DAQC;AAED,0CAiCC;AAED,0CAMC;AAED,wDAMC;AAED,4DAKC;AAED,gEAOC;AAED,oCAKC;AAzMD,oCAA+C;AAC/C,2DAAwD;AAExD,mCAUiB;AAGkB,oGATjC,2BAAmB,OASiC;AAA7C,yGARP,gCAAwB,OAQO;AAAuB,kGAPtD,yBAAiB,OAOsD;AAFzE,+CAA6F;AAI7F,oGAAoG;AACpG,SAAgB,4BAA4B,CAAC,IAA6B;IAIxE,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC;IACrC,OAAO;QACL,YAAY;QACZ,mBAAmB,EAAE,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;KAC5F,CAAC;AACJ,CAAC;AAED,SAAgB,0BAA0B,CAAC,KAM1C;IACC,OAAO;QACL,IAAI,EAAE,oBAAY;QAClB,IAAI,EAAE,oBAAY;QAClB,aAAa,EAAE,8BAAsB;QACrC,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,eAAe,EAAE,KAAK,CAAC,mBAAmB;QAC1C,QAAQ,EAAE;YACR,GAAG,EAAE;gBACH,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,WAAW,EAAE,EAAE;aAChB;SACF;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,SAAS,SAAS,CAAI,KAAQ;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAM,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,EAAY,EACZ,GAAc,EACd,KAAqC,EACrC,KAAc;IAEd,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;QAClC,QAAQ,CAAC,OAAO,EAA8B,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,4BAA4B,CAAC,KAUlD;IACC,MAAM,OAAO,GAAG,0BAA0B,CAAC;QACzC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,yBAAiB,EAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG;QACb,eAAe,EAAE,2BAAmB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,aAAa,EAAE,OAA6C;KAC7D,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC;YACnC,GAAG,MAAM;YACT,EAAE;YACF,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;SAC7C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAAE,MAAM,KAAK,CAAC;QAC1D,OAAO,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC;YAC7B,GAAG,MAAM;YACT,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,uBAAuB,CAAC,KAI7C;IACC,MAAM,GAAG,GAAG,IAAI,6BAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC1F,OAAO,IAAA,2BAAa,EAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,KAMrC;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,EAAuC,CAAC;IACzE,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;QACnC,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,EAAE;QACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,WAAW,EAAE,EAAE;KAChB,CAAC;IACF,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,UAAU,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACpF,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;YAC5B,MAAM,oBAAoB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACxE,CAAC;QACD,OAAO;IACT,CAAC;IACD,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG;QACzC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;QACjC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;QACjC,0BAA0B,EAAE,KAAK,CAAC,IAAI,CAAC,0BAA0B;QACjE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;IACF,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;IAC5B,MAAM,oBAAoB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,EAAY,EACZ,GAAc,EACd,QAA4C;IAE5C,MAAM,oBAAoB,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAC5D,CAAC;AAEM,KAAK,UAAU,sBAAsB,CAC1C,EAAY,EACZ,GAAc,EACd,eAA0D;IAE1D,MAAM,oBAAoB,CAAC,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;AAChF,CAAC;AAEM,KAAK,UAAU,wBAAwB,CAC5C,YAAoB,EACpB,aAA4B;IAE5B,OAAO,IAAA,4CAA8B,EAAC,YAAY,EAAE,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC;AACjF,CAAC;AAEM,KAAK,UAAU,0BAA0B,CAAC,KAIhD;IACC,MAAM,GAAG,GAAG,IAAI,6BAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACnD,OAAO,GAAG,CAAC,OAAO,CAAC,IAAA,2BAAa,EAAC,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAC3F,CAAC;AAED,SAAgB,YAAY,CAC1B,OAA+B,EAC/B,KAAa;IAEb,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC"}