{"version":3,"file":"CrossSigning.js","names":["_olmlib","require","_logger","_indexeddbCryptoStore","_aes","KEY_REQUEST_TIMEOUT_MS","publicKeyFromKeyInfo","keyInfo","Object","values","keys","CrossSigningInfo","constructor","userId","callbacks","cacheCallbacks","_defineProperty2","default","fromStorage","obj","res","prop","hasOwnProperty","toStorage","firstUse","crossSigningVerifiedBefore","getCrossSigningKey","type","expectedPubkey","shouldCache","indexOf","Error","undefined","getId","validateKey","key","signing","global","Olm","PkSigning","gotPubkey","init_with_seed","free","privkey","getCrossSigningKeyCache","cacheresult","result","storeCrossSigningKeyCache","isStoredInSecretStorage","secretStorage","stored","isStored","intersect","s","k","length","storeInSecretStorage","privateKey","encodedKey","encodeBase64","store","getFromSecretStorage","get","decodeBase64","isStoredInKeyCache","types","t","_cacheCallbacks$getCr","call","getCrossSigningKeysFromCache","Map","_cacheCallbacks$getCr2","privKey","set","resetKeys","level","saveCrossSigningKeys","CrossSigningLevel","MASTER","master","USER_SIGNING","SELF_SIGNING","privateKeys","masterSigning","masterPub","generate_seed","user_id","usage","sskSigning","self_signing","sskPub","pkSign","uskSigning","user_signing","uskPub","assign","clearKeys","setKeys","signingKeys","error","logger","masterKey","pkVerify","e","updateCrossSigningVerifiedBefore","isCrossSigningVerified","signObject","data","pubkey","signUser","info","signDevice","device","algorithms","device_id","deviceId","checkUserTrust","userCrossSigning","UserTrustLevel","userTrusted","userMaster","uskId","checkDeviceTrust","localTrust","trustCrossSignedDevices","userTrust","userSSK","DeviceTrustLevel","deviceObj","deviceToObject","fromUserTrustLevel","getCacheCallbacks","exports","signatures","crossSigningVerified","tofu","isVerified","wasCrossSigningVerified","isTofu","localVerified","userTrustLevel","Boolean","isLocallyVerified","createCryptoStoreCacheCallbacks","olmDevice","_expectedPublicKey","Promise","resolve","doTxn","IndexedDBCryptoStore","STORE_ACCOUNT","txn","getSecretStorePrivateKey","ciphertext","pickleKey","Buffer","from","decrypted","decryptAES","Uint8Array","encryptedKey","encryptAES","storeSecretStorePrivateKey","requestKeysDuringVerification","baseApis","getUserId","log","reject","client","original","crypto","crossSigningInfo","crossSigning","debug","promise","requestSecret","decoded","timeout","setTimeout","backupKeyPromise","cachedKey","getSessionBackupPrivateKey","secretReq","base64Key","decodedKey","storeSessionBackupPrivateKey","backupInfo","getKeyBackupVersion","restoreKeyBackupWithCache","then","race","all","catch","warn"],"sources":["../../src/crypto/CrossSigning.ts"],"sourcesContent":["/*\nCopyright 2019 - 2021 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\n/**\n * Cross signing methods\n */\n\nimport { PkSigning } from \"@matrix-org/olm\";\n\nimport { decodeBase64, encodeBase64, IObject, pkSign, pkVerify } from \"./olmlib\";\nimport { logger } from \"../logger\";\nimport { IndexedDBCryptoStore } from \"../crypto/store/indexeddb-crypto-store\";\nimport { decryptAES, encryptAES } from \"./aes\";\nimport { DeviceInfo } from \"./deviceinfo\";\nimport { SecretStorage } from \"./SecretStorage\";\nimport { ICrossSigningKey, ISignedKey, MatrixClient } from \"../client\";\nimport { OlmDevice } from \"./OlmDevice\";\nimport { ICryptoCallbacks } from \".\";\nimport { ISignatures } from \"../@types/signed\";\nimport { CryptoStore, SecretStorePrivateKeys } from \"./store/base\";\nimport { SecretStorageKeyDescription } from \"../secret-storage\";\n\nconst KEY_REQUEST_TIMEOUT_MS = 1000 * 60;\n\nfunction publicKeyFromKeyInfo(keyInfo: ICrossSigningKey): string {\n    // `keys` is an object with { [`ed25519:${pubKey}`]: pubKey }\n    // We assume only a single key, and we want the bare form without type\n    // prefix, so we select the values.\n    return Object.values(keyInfo.keys)[0];\n}\n\nexport interface ICacheCallbacks {\n    getCrossSigningKeyCache?(type: string, expectedPublicKey?: string): Promise<Uint8Array | null>;\n    storeCrossSigningKeyCache?(type: string, key?: Uint8Array): Promise<void>;\n}\n\nexport interface ICrossSigningInfo {\n    keys: Record<string, ICrossSigningKey>;\n    firstUse: boolean;\n    crossSigningVerifiedBefore: boolean;\n}\n\nexport class CrossSigningInfo {\n    public keys: Record<string, ICrossSigningKey> = {};\n    public firstUse = true;\n    // This tracks whether we've ever verified this user with any identity.\n    // When you verify a user, any devices online at the time that receive\n    // the verifying signature via the homeserver will latch this to true\n    // and can use it in the future to detect cases where the user has\n    // become unverified later for any reason.\n    private crossSigningVerifiedBefore = false;\n\n    /**\n     * Information about a user's cross-signing keys\n     *\n     * @param userId - the user that the information is about\n     * @param callbacks - Callbacks used to interact with the app\n     *     Requires getCrossSigningKey and saveCrossSigningKeys\n     * @param cacheCallbacks - Callbacks used to interact with the cache\n     */\n    public constructor(\n        public readonly userId: string,\n        private callbacks: ICryptoCallbacks = {},\n        private cacheCallbacks: ICacheCallbacks = {},\n    ) {}\n\n    public static fromStorage(obj: ICrossSigningInfo, userId: string): CrossSigningInfo {\n        const res = new CrossSigningInfo(userId);\n        for (const prop in obj) {\n            if (obj.hasOwnProperty(prop)) {\n                // @ts-ignore - ts doesn't like this and nor should we\n                res[prop] = obj[prop];\n            }\n        }\n        return res;\n    }\n\n    public toStorage(): ICrossSigningInfo {\n        return {\n            keys: this.keys,\n            firstUse: this.firstUse,\n            crossSigningVerifiedBefore: this.crossSigningVerifiedBefore,\n        };\n    }\n\n    /**\n     * Calls the app callback to ask for a private key\n     *\n     * @param type - The key type (\"master\", \"self_signing\", or \"user_signing\")\n     * @param expectedPubkey - The matching public key or undefined to use\n     *     the stored public key for the given key type.\n     * @returns An array with [ public key, Olm.PkSigning ]\n     */\n    public async getCrossSigningKey(type: string, expectedPubkey?: string): Promise<[string, PkSigning]> {\n        const shouldCache = [\"master\", \"self_signing\", \"user_signing\"].indexOf(type) >= 0;\n\n        if (!this.callbacks.getCrossSigningKey) {\n            throw new Error(\"No getCrossSigningKey callback supplied\");\n        }\n\n        if (expectedPubkey === undefined) {\n            expectedPubkey = this.getId(type)!;\n        }\n\n        function validateKey(key: Uint8Array | null): [string, PkSigning] | undefined {\n            if (!key) return;\n            const signing = new global.Olm.PkSigning();\n            const gotPubkey = signing.init_with_seed(key);\n            if (gotPubkey === expectedPubkey) {\n                return [gotPubkey, signing];\n            }\n            signing.free();\n        }\n\n        let privkey: Uint8Array | null = null;\n        if (this.cacheCallbacks.getCrossSigningKeyCache && shouldCache) {\n            privkey = await this.cacheCallbacks.getCrossSigningKeyCache(type, expectedPubkey);\n        }\n\n        const cacheresult = validateKey(privkey);\n        if (cacheresult) {\n            return cacheresult;\n        }\n\n        privkey = await this.callbacks.getCrossSigningKey(type, expectedPubkey);\n        const result = validateKey(privkey);\n        if (result) {\n            if (this.cacheCallbacks.storeCrossSigningKeyCache && shouldCache) {\n                await this.cacheCallbacks.storeCrossSigningKeyCache(type, privkey!);\n            }\n            return result;\n        }\n\n        /* No keysource even returned a key */\n        if (!privkey) {\n            throw new Error(\"getCrossSigningKey callback for \" + type + \" returned falsey\");\n        }\n\n        /* We got some keys from the keysource, but none of them were valid */\n        throw new Error(\"Key type \" + type + \" from getCrossSigningKey callback did not match\");\n    }\n\n    /**\n     * Check whether the private keys exist in secret storage.\n     * XXX: This could be static, be we often seem to have an instance when we\n     * want to know this anyway...\n     *\n     * @param secretStorage - The secret store using account data\n     * @returns map of key name to key info the secret is encrypted\n     *     with, or null if it is not present or not encrypted with a trusted\n     *     key\n     */\n    public async isStoredInSecretStorage(\n        secretStorage: SecretStorage<MatrixClient | undefined>,\n    ): Promise<Record<string, object> | null> {\n        // check what SSSS keys have encrypted the master key (if any)\n        const stored = (await secretStorage.isStored(\"m.cross_signing.master\")) || {};\n        // then check which of those SSSS keys have also encrypted the SSK and USK\n        function intersect(s: Record<string, SecretStorageKeyDescription>): void {\n            for (const k of Object.keys(stored)) {\n                if (!s[k]) {\n                    delete stored[k];\n                }\n            }\n        }\n        for (const type of [\"self_signing\", \"user_signing\"]) {\n            intersect((await secretStorage.isStored(`m.cross_signing.${type}`)) || {});\n        }\n        return Object.keys(stored).length ? stored : null;\n    }\n\n    /**\n     * Store private keys in secret storage for use by other devices. This is\n     * typically called in conjunction with the creation of new cross-signing\n     * keys.\n     *\n     * @param keys - The keys to store\n     * @param secretStorage - The secret store using account data\n     */\n    public static async storeInSecretStorage(\n        keys: Map<string, Uint8Array>,\n        secretStorage: SecretStorage<undefined>,\n    ): Promise<void> {\n        for (const [type, privateKey] of keys) {\n            const encodedKey = encodeBase64(privateKey);\n            await secretStorage.store(`m.cross_signing.${type}`, encodedKey);\n        }\n    }\n\n    /**\n     * Get private keys from secret storage created by some other device. This\n     * also passes the private keys to the app-specific callback.\n     *\n     * @param type - The type of key to get.  One of \"master\",\n     * \"self_signing\", or \"user_signing\".\n     * @param secretStorage - The secret store using account data\n     * @returns The private key\n     */\n    public static async getFromSecretStorage(type: string, secretStorage: SecretStorage): Promise<Uint8Array | null> {\n        const encodedKey = await secretStorage.get(`m.cross_signing.${type}`);\n        if (!encodedKey) {\n            return null;\n        }\n        return decodeBase64(encodedKey);\n    }\n\n    /**\n     * Check whether the private keys exist in the local key cache.\n     *\n     * @param type - The type of key to get. One of \"master\",\n     * \"self_signing\", or \"user_signing\". Optional, will check all by default.\n     * @returns True if all keys are stored in the local cache.\n     */\n    public async isStoredInKeyCache(type?: string): Promise<boolean> {\n        const cacheCallbacks = this.cacheCallbacks;\n        if (!cacheCallbacks) return false;\n        const types = type ? [type] : [\"master\", \"self_signing\", \"user_signing\"];\n        for (const t of types) {\n            if (!(await cacheCallbacks.getCrossSigningKeyCache?.(t))) {\n                return false;\n            }\n        }\n        return true;\n    }\n\n    /**\n     * Get cross-signing private keys from the local cache.\n     *\n     * @returns A map from key type (string) to private key (Uint8Array)\n     */\n    public async getCrossSigningKeysFromCache(): Promise<Map<string, Uint8Array>> {\n        const keys = new Map();\n        const cacheCallbacks = this.cacheCallbacks;\n        if (!cacheCallbacks) return keys;\n        for (const type of [\"master\", \"self_signing\", \"user_signing\"]) {\n            const privKey = await cacheCallbacks.getCrossSigningKeyCache?.(type);\n            if (!privKey) {\n                continue;\n            }\n            keys.set(type, privKey);\n        }\n        return keys;\n    }\n\n    /**\n     * Get the ID used to identify the user. This can also be used to test for\n     * the existence of a given key type.\n     *\n     * @param type - The type of key to get the ID of.  One of \"master\",\n     * \"self_signing\", or \"user_signing\".  Defaults to \"master\".\n     *\n     * @returns the ID\n     */\n    public getId(type = \"master\"): string | null {\n        if (!this.keys[type]) return null;\n        const keyInfo = this.keys[type];\n        return publicKeyFromKeyInfo(keyInfo);\n    }\n\n    /**\n     * Create new cross-signing keys for the given key types. The public keys\n     * will be held in this class, while the private keys are passed off to the\n     * `saveCrossSigningKeys` application callback.\n     *\n     * @param level - The key types to reset\n     */\n    public async resetKeys(level?: CrossSigningLevel): Promise<void> {\n        if (!this.callbacks.saveCrossSigningKeys) {\n            throw new Error(\"No saveCrossSigningKeys callback supplied\");\n        }\n\n        // If we're resetting the master key, we reset all keys\n        if (level === undefined || level & CrossSigningLevel.MASTER || !this.keys.master) {\n            level = CrossSigningLevel.MASTER | CrossSigningLevel.USER_SIGNING | CrossSigningLevel.SELF_SIGNING;\n        } else if (level === (0 as CrossSigningLevel)) {\n            return;\n        }\n\n        const privateKeys: Record<string, Uint8Array> = {};\n        const keys: Record<string, ICrossSigningKey> = {};\n        let masterSigning;\n        let masterPub;\n\n        try {\n            if (level & CrossSigningLevel.MASTER) {\n                masterSigning = new global.Olm.PkSigning();\n                privateKeys.master = masterSigning.generate_seed();\n                masterPub = masterSigning.init_with_seed(privateKeys.master);\n                keys.master = {\n                    user_id: this.userId,\n                    usage: [\"master\"],\n                    keys: {\n                        [\"ed25519:\" + masterPub]: masterPub,\n                    },\n                };\n            } else {\n                [masterPub, masterSigning] = await this.getCrossSigningKey(\"master\");\n            }\n\n            if (level & CrossSigningLevel.SELF_SIGNING) {\n                const sskSigning = new global.Olm.PkSigning();\n                try {\n                    privateKeys.self_signing = sskSigning.generate_seed();\n                    const sskPub = sskSigning.init_with_seed(privateKeys.self_signing);\n                    keys.self_signing = {\n                        user_id: this.userId,\n                        usage: [\"self_signing\"],\n                        keys: {\n                            [\"ed25519:\" + sskPub]: sskPub,\n                        },\n                    };\n                    pkSign(keys.self_signing, masterSigning, this.userId, masterPub);\n                } finally {\n                    sskSigning.free();\n                }\n            }\n\n            if (level & CrossSigningLevel.USER_SIGNING) {\n                const uskSigning = new global.Olm.PkSigning();\n                try {\n                    privateKeys.user_signing = uskSigning.generate_seed();\n                    const uskPub = uskSigning.init_with_seed(privateKeys.user_signing);\n                    keys.user_signing = {\n                        user_id: this.userId,\n                        usage: [\"user_signing\"],\n                        keys: {\n                            [\"ed25519:\" + uskPub]: uskPub,\n                        },\n                    };\n                    pkSign(keys.user_signing, masterSigning, this.userId, masterPub);\n                } finally {\n                    uskSigning.free();\n                }\n            }\n\n            Object.assign(this.keys, keys);\n            this.callbacks.saveCrossSigningKeys(privateKeys);\n        } finally {\n            if (masterSigning) {\n                masterSigning.free();\n            }\n        }\n    }\n\n    /**\n     * unsets the keys, used when another session has reset the keys, to disable cross-signing\n     */\n    public clearKeys(): void {\n        this.keys = {};\n    }\n\n    public setKeys(keys: Record<string, ICrossSigningKey>): void {\n        const signingKeys: Record<string, ICrossSigningKey> = {};\n        if (keys.master) {\n            if (keys.master.user_id !== this.userId) {\n                const error = \"Mismatched user ID \" + keys.master.user_id + \" in master key from \" + this.userId;\n                logger.error(error);\n                throw new Error(error);\n            }\n            if (!this.keys.master) {\n                // this is the first key we've seen, so first-use is true\n                this.firstUse = true;\n            } else if (publicKeyFromKeyInfo(keys.master) !== this.getId()) {\n                // this is a different key, so first-use is false\n                this.firstUse = false;\n            } // otherwise, same key, so no change\n            signingKeys.master = keys.master;\n        } else if (this.keys.master) {\n            signingKeys.master = this.keys.master;\n        } else {\n            throw new Error(\"Tried to set cross-signing keys without a master key\");\n        }\n        const masterKey = publicKeyFromKeyInfo(signingKeys.master);\n\n        // verify signatures\n        if (keys.user_signing) {\n            if (keys.user_signing.user_id !== this.userId) {\n                const error = \"Mismatched user ID \" + keys.master.user_id + \" in user_signing key from \" + this.userId;\n                logger.error(error);\n                throw new Error(error);\n            }\n            try {\n                pkVerify(keys.user_signing, masterKey, this.userId);\n            } catch (e) {\n                logger.error(\"invalid signature on user-signing key\");\n                // FIXME: what do we want to do here?\n                throw e;\n            }\n        }\n        if (keys.self_signing) {\n            if (keys.self_signing.user_id !== this.userId) {\n                const error = \"Mismatched user ID \" + keys.master.user_id + \" in self_signing key from \" + this.userId;\n                logger.error(error);\n                throw new Error(error);\n            }\n            try {\n                pkVerify(keys.self_signing, masterKey, this.userId);\n            } catch (e) {\n                logger.error(\"invalid signature on self-signing key\");\n                // FIXME: what do we want to do here?\n                throw e;\n            }\n        }\n\n        // if everything checks out, then save the keys\n        if (keys.master) {\n            this.keys.master = keys.master;\n            // if the master key is set, then the old self-signing and user-signing keys are obsolete\n            delete this.keys[\"self_signing\"];\n            delete this.keys[\"user_signing\"];\n        }\n        if (keys.self_signing) {\n            this.keys.self_signing = keys.self_signing;\n        }\n        if (keys.user_signing) {\n            this.keys.user_signing = keys.user_signing;\n        }\n    }\n\n    public updateCrossSigningVerifiedBefore(isCrossSigningVerified: boolean): void {\n        // It is critical that this value latches forward from false to true but\n        // never back to false to avoid a downgrade attack.\n        if (!this.crossSigningVerifiedBefore && isCrossSigningVerified) {\n            this.crossSigningVerifiedBefore = true;\n        }\n    }\n\n    public async signObject<T extends object>(data: T, type: string): Promise<T & { signatures: ISignatures }> {\n        if (!this.keys[type]) {\n            throw new Error(\"Attempted to sign with \" + type + \" key but no such key present\");\n        }\n        const [pubkey, signing] = await this.getCrossSigningKey(type);\n        try {\n            pkSign(data, signing, this.userId, pubkey);\n            return data as T & { signatures: ISignatures };\n        } finally {\n            signing.free();\n        }\n    }\n\n    public async signUser(key: CrossSigningInfo): Promise<ICrossSigningKey | undefined> {\n        if (!this.keys.user_signing) {\n            logger.info(\"No user signing key: not signing user\");\n            return;\n        }\n        return this.signObject(key.keys.master, \"user_signing\");\n    }\n\n    public async signDevice(userId: string, device: DeviceInfo): Promise<ISignedKey | undefined> {\n        if (userId !== this.userId) {\n            throw new Error(`Trying to sign ${userId}'s device; can only sign our own device`);\n        }\n        if (!this.keys.self_signing) {\n            logger.info(\"No self signing key: not signing device\");\n            return;\n        }\n        return this.signObject<Omit<ISignedKey, \"signatures\">>(\n            {\n                algorithms: device.algorithms,\n                keys: device.keys,\n                device_id: device.deviceId,\n                user_id: userId,\n            },\n            \"self_signing\",\n        );\n    }\n\n    /**\n     * Check whether a given user is trusted.\n     *\n     * @param userCrossSigning - Cross signing info for user\n     *\n     * @returns\n     */\n    public checkUserTrust(userCrossSigning: CrossSigningInfo): UserTrustLevel {\n        // if we're checking our own key, then it's trusted if the master key\n        // and self-signing key match\n        if (\n            this.userId === userCrossSigning.userId &&\n            this.getId() &&\n            this.getId() === userCrossSigning.getId() &&\n            this.getId(\"self_signing\") &&\n            this.getId(\"self_signing\") === userCrossSigning.getId(\"self_signing\")\n        ) {\n            return new UserTrustLevel(true, true, this.firstUse);\n        }\n\n        if (!this.keys.user_signing) {\n            // If there's no user signing key, they can't possibly be verified.\n            // They may be TOFU trusted though.\n            return new UserTrustLevel(false, false, userCrossSigning.firstUse);\n        }\n\n        let userTrusted: boolean;\n        const userMaster = userCrossSigning.keys.master;\n        const uskId = this.getId(\"user_signing\")!;\n        try {\n            pkVerify(userMaster, uskId, this.userId);\n            userTrusted = true;\n        } catch (e) {\n            userTrusted = false;\n        }\n        return new UserTrustLevel(userTrusted, userCrossSigning.crossSigningVerifiedBefore, userCrossSigning.firstUse);\n    }\n\n    /**\n     * Check whether a given device is trusted.\n     *\n     * @param userCrossSigning - Cross signing info for user\n     * @param device - The device to check\n     * @param localTrust - Whether the device is trusted locally\n     * @param trustCrossSignedDevices - Whether we trust cross signed devices\n     *\n     * @returns\n     */\n    public checkDeviceTrust(\n        userCrossSigning: CrossSigningInfo,\n        device: DeviceInfo,\n        localTrust: boolean,\n        trustCrossSignedDevices: boolean,\n    ): DeviceTrustLevel {\n        const userTrust = this.checkUserTrust(userCrossSigning);\n\n        const userSSK = userCrossSigning.keys.self_signing;\n        if (!userSSK) {\n            // if the user has no self-signing key then we cannot make any\n            // trust assertions about this device from cross-signing\n            return new DeviceTrustLevel(false, false, localTrust, trustCrossSignedDevices);\n        }\n\n        const deviceObj = deviceToObject(device, userCrossSigning.userId);\n        try {\n            // if we can verify the user's SSK from their master key...\n            pkVerify(userSSK, userCrossSigning.getId()!, userCrossSigning.userId);\n            // ...and this device's key from their SSK...\n            pkVerify(deviceObj, publicKeyFromKeyInfo(userSSK), userCrossSigning.userId);\n            // ...then we trust this device as much as far as we trust the user\n            return DeviceTrustLevel.fromUserTrustLevel(userTrust, localTrust, trustCrossSignedDevices);\n        } catch (e) {\n            return new DeviceTrustLevel(false, false, localTrust, trustCrossSignedDevices);\n        }\n    }\n\n    /**\n     * @returns Cache callbacks\n     */\n    public getCacheCallbacks(): ICacheCallbacks {\n        return this.cacheCallbacks;\n    }\n}\n\ninterface DeviceObject extends IObject {\n    algorithms: string[];\n    keys: Record<string, string>;\n    device_id: string;\n    user_id: string;\n}\n\nfunction deviceToObject(device: DeviceInfo, userId: string): DeviceObject {\n    return {\n        algorithms: device.algorithms,\n        keys: device.keys,\n        device_id: device.deviceId,\n        user_id: userId,\n        signatures: device.signatures,\n    };\n}\n\nexport enum CrossSigningLevel {\n    MASTER = 4,\n    USER_SIGNING = 2,\n    SELF_SIGNING = 1,\n}\n\n/**\n * Represents the ways in which we trust a user\n */\nexport class UserTrustLevel {\n    public constructor(\n        private readonly crossSigningVerified: boolean,\n        private readonly crossSigningVerifiedBefore: boolean,\n        private readonly tofu: boolean,\n    ) {}\n\n    /**\n     * @returns true if this user is verified via any means\n     */\n    public isVerified(): boolean {\n        return this.isCrossSigningVerified();\n    }\n\n    /**\n     * @returns true if this user is verified via cross signing\n     */\n    public isCrossSigningVerified(): boolean {\n        return this.crossSigningVerified;\n    }\n\n    /**\n     * @returns true if we ever verified this user before (at least for\n     * the history of verifications observed by this device).\n     */\n    public wasCrossSigningVerified(): boolean {\n        return this.crossSigningVerifiedBefore;\n    }\n\n    /**\n     * @returns true if this user's key is trusted on first use\n     */\n    public isTofu(): boolean {\n        return this.tofu;\n    }\n}\n\n/**\n * Represents the ways in which we trust a device\n */\nexport class DeviceTrustLevel {\n    public constructor(\n        public readonly crossSigningVerified: boolean,\n        public readonly tofu: boolean,\n        private readonly localVerified: boolean,\n        private readonly trustCrossSignedDevices: boolean,\n    ) {}\n\n    public static fromUserTrustLevel(\n        userTrustLevel: UserTrustLevel,\n        localVerified: boolean,\n        trustCrossSignedDevices: boolean,\n    ): DeviceTrustLevel {\n        return new DeviceTrustLevel(\n            userTrustLevel.isCrossSigningVerified(),\n            userTrustLevel.isTofu(),\n            localVerified,\n            trustCrossSignedDevices,\n        );\n    }\n\n    /**\n     * @returns true if this device is verified via any means\n     */\n    public isVerified(): boolean {\n        return Boolean(this.isLocallyVerified() || (this.trustCrossSignedDevices && this.isCrossSigningVerified()));\n    }\n\n    /**\n     * @returns true if this device is verified via cross signing\n     */\n    public isCrossSigningVerified(): boolean {\n        return this.crossSigningVerified;\n    }\n\n    /**\n     * @returns true if this device is verified locally\n     */\n    public isLocallyVerified(): boolean {\n        return this.localVerified;\n    }\n\n    /**\n     * @returns true if this device is trusted from a user's key\n     * that is trusted on first use\n     */\n    public isTofu(): boolean {\n        return this.tofu;\n    }\n}\n\nexport function createCryptoStoreCacheCallbacks(store: CryptoStore, olmDevice: OlmDevice): ICacheCallbacks {\n    return {\n        getCrossSigningKeyCache: async function (\n            type: keyof SecretStorePrivateKeys,\n            _expectedPublicKey: string,\n        ): Promise<Uint8Array> {\n            const key = await new Promise<any>((resolve) => {\n                return store.doTxn(\"readonly\", [IndexedDBCryptoStore.STORE_ACCOUNT], (txn) => {\n                    store.getSecretStorePrivateKey(txn, resolve, type);\n                });\n            });\n\n            if (key && key.ciphertext) {\n                const pickleKey = Buffer.from(olmDevice.pickleKey);\n                const decrypted = await decryptAES(key, pickleKey, type);\n                return decodeBase64(decrypted);\n            } else {\n                return key;\n            }\n        },\n        storeCrossSigningKeyCache: async function (\n            type: keyof SecretStorePrivateKeys,\n            key?: Uint8Array,\n        ): Promise<void> {\n            if (!(key instanceof Uint8Array)) {\n                throw new Error(`storeCrossSigningKeyCache expects Uint8Array, got ${key}`);\n            }\n            const pickleKey = Buffer.from(olmDevice.pickleKey);\n            const encryptedKey = await encryptAES(encodeBase64(key), pickleKey, type);\n            return store.doTxn(\"readwrite\", [IndexedDBCryptoStore.STORE_ACCOUNT], (txn) => {\n                store.storeSecretStorePrivateKey(txn, type, encryptedKey);\n            });\n        },\n    };\n}\n\nexport type KeysDuringVerification = [[string, PkSigning], [string, PkSigning], [string, PkSigning], void];\n\n/**\n * Request cross-signing keys from another device during verification.\n *\n * @param baseApis - base Matrix API interface\n * @param userId - The user ID being verified\n * @param deviceId - The device ID being verified\n */\nexport async function requestKeysDuringVerification(\n    baseApis: MatrixClient,\n    userId: string,\n    deviceId: string,\n): Promise<KeysDuringVerification | void> {\n    // If this is a self-verification, ask the other party for keys\n    if (baseApis.getUserId() !== userId) {\n        return;\n    }\n    logger.log(\"Cross-signing: Self-verification done; requesting keys\");\n    // This happens asynchronously, and we're not concerned about waiting for\n    // it. We return here in order to test.\n    return new Promise<KeysDuringVerification | void>((resolve, reject) => {\n        const client = baseApis;\n        const original = client.crypto!.crossSigningInfo;\n\n        // We already have all of the infrastructure we need to validate and\n        // cache cross-signing keys, so instead of replicating that, here we set\n        // up callbacks that request them from the other device and call\n        // CrossSigningInfo.getCrossSigningKey() to validate/cache\n        const crossSigning = new CrossSigningInfo(\n            original.userId,\n            {\n                getCrossSigningKey: async (type): Promise<Uint8Array> => {\n                    logger.debug(\"Cross-signing: requesting secret\", type, deviceId);\n                    const { promise } = client.requestSecret(`m.cross_signing.${type}`, [deviceId]);\n                    const result = await promise;\n                    const decoded = decodeBase64(result);\n                    return Uint8Array.from(decoded);\n                },\n            },\n            original.getCacheCallbacks(),\n        );\n        crossSigning.keys = original.keys;\n\n        // XXX: get all keys out if we get one key out\n        // https://github.com/vector-im/element-web/issues/12604\n        // then change here to reject on the timeout\n        // Requests can be ignored, so don't wait around forever\n        const timeout = new Promise<void>((resolve) => {\n            setTimeout(resolve, KEY_REQUEST_TIMEOUT_MS, new Error(\"Timeout\"));\n        });\n\n        // also request and cache the key backup key\n        const backupKeyPromise = (async (): Promise<void> => {\n            const cachedKey = await client.crypto!.getSessionBackupPrivateKey();\n            if (!cachedKey) {\n                logger.info(\"No cached backup key found. Requesting...\");\n                const secretReq = client.requestSecret(\"m.megolm_backup.v1\", [deviceId]);\n                const base64Key = await secretReq.promise;\n                logger.info(\"Got key backup key, decoding...\");\n                const decodedKey = decodeBase64(base64Key);\n                logger.info(\"Decoded backup key, storing...\");\n                await client.crypto!.storeSessionBackupPrivateKey(Uint8Array.from(decodedKey));\n                logger.info(\"Backup key stored. Starting backup restore...\");\n                const backupInfo = await client.getKeyBackupVersion();\n                // no need to await for this - just let it go in the bg\n                client.restoreKeyBackupWithCache(undefined, undefined, backupInfo!).then(() => {\n                    logger.info(\"Backup restored.\");\n                });\n            }\n        })();\n\n        // We call getCrossSigningKey() for its side-effects\n        return Promise.race<KeysDuringVerification | void>([\n            Promise.all([\n                crossSigning.getCrossSigningKey(\"master\"),\n                crossSigning.getCrossSigningKey(\"self_signing\"),\n                crossSigning.getCrossSigningKey(\"user_signing\"),\n                backupKeyPromise,\n            ]) as Promise<KeysDuringVerification>,\n            timeout,\n        ]).then(resolve, reject);\n    }).catch((e) => {\n        logger.warn(\"Cross-signing: failure while requesting keys:\", e);\n    });\n}\n"],"mappings":";;;;;;;;;;AAsBA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AACA,IAAAE,qBAAA,GAAAF,OAAA;AACA,IAAAG,IAAA,GAAAH,OAAA;AAzBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;;AAiBA,MAAMI,sBAAsB,GAAG,IAAI,GAAG,EAAE;AAExC,SAASC,oBAAoBA,CAACC,OAAyB,EAAU;EAC7D;EACA;EACA;EACA,OAAOC,MAAM,CAACC,MAAM,CAACF,OAAO,CAACG,IAAI,CAAC,CAAC,CAAC,CAAC;AACzC;AAaO,MAAMC,gBAAgB,CAAC;EAG1B;EACA;EACA;EACA;EACA;;EAGA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;EACWC,WAAWA,CACEC,MAAc,EACtBC,SAA2B,GAAG,CAAC,CAAC,EAChCC,cAA+B,GAAG,CAAC,CAAC,EAC9C;IAAA,KAHkBF,MAAc,GAAdA,MAAc;IAAA,KACtBC,SAA2B,GAA3BA,SAA2B;IAAA,KAC3BC,cAA+B,GAA/BA,cAA+B;IAAA,IAAAC,gBAAA,CAAAC,OAAA,gBApBK,CAAC,CAAC;IAAA,IAAAD,gBAAA,CAAAC,OAAA,oBAChC,IAAI;IAAA,IAAAD,gBAAA,CAAAC,OAAA,sCAMe,KAAK;EAcvC;EAEH,OAAcC,WAAWA,CAACC,GAAsB,EAAEN,MAAc,EAAoB;IAChF,MAAMO,GAAG,GAAG,IAAIT,gBAAgB,CAACE,MAAM,CAAC;IACxC,KAAK,MAAMQ,IAAI,IAAIF,GAAG,EAAE;MACpB,IAAIA,GAAG,CAACG,cAAc,CAACD,IAAI,CAAC,EAAE;QAC1B;QACAD,GAAG,CAACC,IAAI,CAAC,GAAGF,GAAG,CAACE,IAAI,CAAC;MACzB;IACJ;IACA,OAAOD,GAAG;EACd;EAEOG,SAASA,CAAA,EAAsB;IAClC,OAAO;MACHb,IAAI,EAAE,IAAI,CAACA,IAAI;MACfc,QAAQ,EAAE,IAAI,CAACA,QAAQ;MACvBC,0BAA0B,EAAE,IAAI,CAACA;IACrC,CAAC;EACL;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;EACI,MAAaC,kBAAkBA,CAACC,IAAY,EAAEC,cAAuB,EAAgC;IACjG,MAAMC,WAAW,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC,CAACC,OAAO,CAACH,IAAI,CAAC,IAAI,CAAC;IAEjF,IAAI,CAAC,IAAI,CAACb,SAAS,CAACY,kBAAkB,EAAE;MACpC,MAAM,IAAIK,KAAK,CAAC,yCAAyC,CAAC;IAC9D;IAEA,IAAIH,cAAc,KAAKI,SAAS,EAAE;MAC9BJ,cAAc,GAAG,IAAI,CAACK,KAAK,CAACN,IAAI,CAAE;IACtC;IAEA,SAASO,WAAWA,CAACC,GAAsB,EAAmC;MAC1E,IAAI,CAACA,GAAG,EAAE;MACV,MAAMC,OAAO,GAAG,IAAIC,MAAM,CAACC,GAAG,CAACC,SAAS,EAAE;MAC1C,MAAMC,SAAS,GAAGJ,OAAO,CAACK,cAAc,CAACN,GAAG,CAAC;MAC7C,IAAIK,SAAS,KAAKZ,cAAc,EAAE;QAC9B,OAAO,CAACY,SAAS,EAAEJ,OAAO,CAAC;MAC/B;MACAA,OAAO,CAACM,IAAI,EAAE;IAClB;IAEA,IAAIC,OAA0B,GAAG,IAAI;IACrC,IAAI,IAAI,CAAC5B,cAAc,CAAC6B,uBAAuB,IAAIf,WAAW,EAAE;MAC5Dc,OAAO,GAAG,MAAM,IAAI,CAAC5B,cAAc,CAAC6B,uBAAuB,CAACjB,IAAI,EAAEC,cAAc,CAAC;IACrF;IAEA,MAAMiB,WAAW,GAAGX,WAAW,CAACS,OAAO,CAAC;IACxC,IAAIE,WAAW,EAAE;MACb,OAAOA,WAAW;IACtB;IAEAF,OAAO,GAAG,MAAM,IAAI,CAAC7B,SAAS,CAACY,kBAAkB,CAACC,IAAI,EAAEC,cAAc,CAAC;IACvE,MAAMkB,MAAM,GAAGZ,WAAW,CAACS,OAAO,CAAC;IACnC,IAAIG,MAAM,EAAE;MACR,IAAI,IAAI,CAAC/B,cAAc,CAACgC,yBAAyB,IAAIlB,WAAW,EAAE;QAC9D,MAAM,IAAI,CAACd,cAAc,CAACgC,yBAAyB,CAACpB,IAAI,EAAEgB,OAAO,CAAE;MACvE;MACA,OAAOG,MAAM;IACjB;;IAEA;IACA,IAAI,CAACH,OAAO,EAAE;MACV,MAAM,IAAIZ,KAAK,CAAC,kCAAkC,GAAGJ,IAAI,GAAG,kBAAkB,CAAC;IACnF;;IAEA;IACA,MAAM,IAAII,KAAK,CAAC,WAAW,GAAGJ,IAAI,GAAG,iDAAiD,CAAC;EAC3F;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACI,MAAaqB,uBAAuBA,CAChCC,aAAsD,EAChB;IACtC;IACA,MAAMC,MAAM,GAAG,CAAC,MAAMD,aAAa,CAACE,QAAQ,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC7E;IACA,SAASC,SAASA,CAACC,CAA8C,EAAQ;MACrE,KAAK,MAAMC,CAAC,IAAI9C,MAAM,CAACE,IAAI,CAACwC,MAAM,CAAC,EAAE;QACjC,IAAI,CAACG,CAAC,CAACC,CAAC,CAAC,EAAE;UACP,OAAOJ,MAAM,CAACI,CAAC,CAAC;QACpB;MACJ;IACJ;IACA,KAAK,MAAM3B,IAAI,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,EAAE;MACjDyB,SAAS,CAAC,CAAC,MAAMH,aAAa,CAACE,QAAQ,CAAE,mBAAkBxB,IAAK,EAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9E;IACA,OAAOnB,MAAM,CAACE,IAAI,CAACwC,MAAM,CAAC,CAACK,MAAM,GAAGL,MAAM,GAAG,IAAI;EACrD;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;EACI,aAAoBM,oBAAoBA,CACpC9C,IAA6B,EAC7BuC,aAAuC,EAC1B;IACb,KAAK,MAAM,CAACtB,IAAI,EAAE8B,UAAU,CAAC,IAAI/C,IAAI,EAAE;MACnC,MAAMgD,UAAU,GAAG,IAAAC,oBAAY,EAACF,UAAU,CAAC;MAC3C,MAAMR,aAAa,CAACW,KAAK,CAAE,mBAAkBjC,IAAK,EAAC,EAAE+B,UAAU,CAAC;IACpE;EACJ;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACI,aAAoBG,oBAAoBA,CAAClC,IAAY,EAAEsB,aAA4B,EAA8B;IAC7G,MAAMS,UAAU,GAAG,MAAMT,aAAa,CAACa,GAAG,CAAE,mBAAkBnC,IAAK,EAAC,CAAC;IACrE,IAAI,CAAC+B,UAAU,EAAE;MACb,OAAO,IAAI;IACf;IACA,OAAO,IAAAK,oBAAY,EAACL,UAAU,CAAC;EACnC;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;EACI,MAAaM,kBAAkBA,CAACrC,IAAa,EAAoB;IAC7D,MAAMZ,cAAc,GAAG,IAAI,CAACA,cAAc;IAC1C,IAAI,CAACA,cAAc,EAAE,OAAO,KAAK;IACjC,MAAMkD,KAAK,GAAGtC,IAAI,GAAG,CAACA,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC;IACxE,KAAK,MAAMuC,CAAC,IAAID,KAAK,EAAE;MAAA,IAAAE,qBAAA;MACnB,IAAI,EAAE,QAAAA,qBAAA,GAAMpD,cAAc,CAAC6B,uBAAuB,cAAAuB,qBAAA,uBAAtCA,qBAAA,CAAAC,IAAA,CAAArD,cAAc,EAA2BmD,CAAC,CAAC,EAAC,EAAE;QACtD,OAAO,KAAK;MAChB;IACJ;IACA,OAAO,IAAI;EACf;;EAEA;AACJ;AACA;AACA;AACA;EACI,MAAaG,4BAA4BA,CAAA,EAAqC;IAC1E,MAAM3D,IAAI,GAAG,IAAI4D,GAAG,EAAE;IACtB,MAAMvD,cAAc,GAAG,IAAI,CAACA,cAAc;IAC1C,IAAI,CAACA,cAAc,EAAE,OAAOL,IAAI;IAChC,KAAK,MAAMiB,IAAI,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC,EAAE;MAAA,IAAA4C,sBAAA;MAC3D,MAAMC,OAAO,GAAG,QAAAD,sBAAA,GAAMxD,cAAc,CAAC6B,uBAAuB,cAAA2B,sBAAA,uBAAtCA,sBAAA,CAAAH,IAAA,CAAArD,cAAc,EAA2BY,IAAI,CAAC;MACpE,IAAI,CAAC6C,OAAO,EAAE;QACV;MACJ;MACA9D,IAAI,CAAC+D,GAAG,CAAC9C,IAAI,EAAE6C,OAAO,CAAC;IAC3B;IACA,OAAO9D,IAAI;EACf;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACWuB,KAAKA,CAACN,IAAI,GAAG,QAAQ,EAAiB;IACzC,IAAI,CAAC,IAAI,CAACjB,IAAI,CAACiB,IAAI,CAAC,EAAE,OAAO,IAAI;IACjC,MAAMpB,OAAO,GAAG,IAAI,CAACG,IAAI,CAACiB,IAAI,CAAC;IAC/B,OAAOrB,oBAAoB,CAACC,OAAO,CAAC;EACxC;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;EACI,MAAamE,SAASA,CAACC,KAAyB,EAAiB;IAC7D,IAAI,CAAC,IAAI,CAAC7D,SAAS,CAAC8D,oBAAoB,EAAE;MACtC,MAAM,IAAI7C,KAAK,CAAC,2CAA2C,CAAC;IAChE;;IAEA;IACA,IAAI4C,KAAK,KAAK3C,SAAS,IAAI2C,KAAK,GAAGE,iBAAiB,CAACC,MAAM,IAAI,CAAC,IAAI,CAACpE,IAAI,CAACqE,MAAM,EAAE;MAC9EJ,KAAK,GAAGE,iBAAiB,CAACC,MAAM,GAAGD,iBAAiB,CAACG,YAAY,GAAGH,iBAAiB,CAACI,YAAY;IACtG,CAAC,MAAM,IAAIN,KAAK,KAAM,CAAuB,EAAE;MAC3C;IACJ;IAEA,MAAMO,WAAuC,GAAG,CAAC,CAAC;IAClD,MAAMxE,IAAsC,GAAG,CAAC,CAAC;IACjD,IAAIyE,aAAa;IACjB,IAAIC,SAAS;IAEb,IAAI;MACA,IAAIT,KAAK,GAAGE,iBAAiB,CAACC,MAAM,EAAE;QAClCK,aAAa,GAAG,IAAI9C,MAAM,CAACC,GAAG,CAACC,SAAS,EAAE;QAC1C2C,WAAW,CAACH,MAAM,GAAGI,aAAa,CAACE,aAAa,EAAE;QAClDD,SAAS,GAAGD,aAAa,CAAC1C,cAAc,CAACyC,WAAW,CAACH,MAAM,CAAC;QAC5DrE,IAAI,CAACqE,MAAM,GAAG;UACVO,OAAO,EAAE,IAAI,CAACzE,MAAM;UACpB0E,KAAK,EAAE,CAAC,QAAQ,CAAC;UACjB7E,IAAI,EAAE;YACF,CAAC,UAAU,GAAG0E,SAAS,GAAGA;UAC9B;QACJ,CAAC;MACL,CAAC,MAAM;QACH,CAACA,SAAS,EAAED,aAAa,CAAC,GAAG,MAAM,IAAI,CAACzD,kBAAkB,CAAC,QAAQ,CAAC;MACxE;MAEA,IAAIiD,KAAK,GAAGE,iBAAiB,CAACI,YAAY,EAAE;QACxC,MAAMO,UAAU,GAAG,IAAInD,MAAM,CAACC,GAAG,CAACC,SAAS,EAAE;QAC7C,IAAI;UACA2C,WAAW,CAACO,YAAY,GAAGD,UAAU,CAACH,aAAa,EAAE;UACrD,MAAMK,MAAM,GAAGF,UAAU,CAAC/C,cAAc,CAACyC,WAAW,CAACO,YAAY,CAAC;UAClE/E,IAAI,CAAC+E,YAAY,GAAG;YAChBH,OAAO,EAAE,IAAI,CAACzE,MAAM;YACpB0E,KAAK,EAAE,CAAC,cAAc,CAAC;YACvB7E,IAAI,EAAE;cACF,CAAC,UAAU,GAAGgF,MAAM,GAAGA;YAC3B;UACJ,CAAC;UACD,IAAAC,cAAM,EAACjF,IAAI,CAAC+E,YAAY,EAAEN,aAAa,EAAE,IAAI,CAACtE,MAAM,EAAEuE,SAAS,CAAC;QACpE,CAAC,SAAS;UACNI,UAAU,CAAC9C,IAAI,EAAE;QACrB;MACJ;MAEA,IAAIiC,KAAK,GAAGE,iBAAiB,CAACG,YAAY,EAAE;QACxC,MAAMY,UAAU,GAAG,IAAIvD,MAAM,CAACC,GAAG,CAACC,SAAS,EAAE;QAC7C,IAAI;UACA2C,WAAW,CAACW,YAAY,GAAGD,UAAU,CAACP,aAAa,EAAE;UACrD,MAAMS,MAAM,GAAGF,UAAU,CAACnD,cAAc,CAACyC,WAAW,CAACW,YAAY,CAAC;UAClEnF,IAAI,CAACmF,YAAY,GAAG;YAChBP,OAAO,EAAE,IAAI,CAACzE,MAAM;YACpB0E,KAAK,EAAE,CAAC,cAAc,CAAC;YACvB7E,IAAI,EAAE;cACF,CAAC,UAAU,GAAGoF,MAAM,GAAGA;YAC3B;UACJ,CAAC;UACD,IAAAH,cAAM,EAACjF,IAAI,CAACmF,YAAY,EAAEV,aAAa,EAAE,IAAI,CAACtE,MAAM,EAAEuE,SAAS,CAAC;QACpE,CAAC,SAAS;UACNQ,UAAU,CAAClD,IAAI,EAAE;QACrB;MACJ;MAEAlC,MAAM,CAACuF,MAAM,CAAC,IAAI,CAACrF,IAAI,EAAEA,IAAI,CAAC;MAC9B,IAAI,CAACI,SAAS,CAAC8D,oBAAoB,CAACM,WAAW,CAAC;IACpD,CAAC,SAAS;MACN,IAAIC,aAAa,EAAE;QACfA,aAAa,CAACzC,IAAI,EAAE;MACxB;IACJ;EACJ;;EAEA;AACJ;AACA;EACWsD,SAASA,CAAA,EAAS;IACrB,IAAI,CAACtF,IAAI,GAAG,CAAC,CAAC;EAClB;EAEOuF,OAAOA,CAACvF,IAAsC,EAAQ;IACzD,MAAMwF,WAA6C,GAAG,CAAC,CAAC;IACxD,IAAIxF,IAAI,CAACqE,MAAM,EAAE;MACb,IAAIrE,IAAI,CAACqE,MAAM,CAACO,OAAO,KAAK,IAAI,CAACzE,MAAM,EAAE;QACrC,MAAMsF,KAAK,GAAG,qBAAqB,GAAGzF,IAAI,CAACqE,MAAM,CAACO,OAAO,GAAG,sBAAsB,GAAG,IAAI,CAACzE,MAAM;QAChGuF,cAAM,CAACD,KAAK,CAACA,KAAK,CAAC;QACnB,MAAM,IAAIpE,KAAK,CAACoE,KAAK,CAAC;MAC1B;MACA,IAAI,CAAC,IAAI,CAACzF,IAAI,CAACqE,MAAM,EAAE;QACnB;QACA,IAAI,CAACvD,QAAQ,GAAG,IAAI;MACxB,CAAC,MAAM,IAAIlB,oBAAoB,CAACI,IAAI,CAACqE,MAAM,CAAC,KAAK,IAAI,CAAC9C,KAAK,EAAE,EAAE;QAC3D;QACA,IAAI,CAACT,QAAQ,GAAG,KAAK;MACzB,CAAC,CAAC;MACF0E,WAAW,CAACnB,MAAM,GAAGrE,IAAI,CAACqE,MAAM;IACpC,CAAC,MAAM,IAAI,IAAI,CAACrE,IAAI,CAACqE,MAAM,EAAE;MACzBmB,WAAW,CAACnB,MAAM,GAAG,IAAI,CAACrE,IAAI,CAACqE,MAAM;IACzC,CAAC,MAAM;MACH,MAAM,IAAIhD,KAAK,CAAC,sDAAsD,CAAC;IAC3E;IACA,MAAMsE,SAAS,GAAG/F,oBAAoB,CAAC4F,WAAW,CAACnB,MAAM,CAAC;;IAE1D;IACA,IAAIrE,IAAI,CAACmF,YAAY,EAAE;MACnB,IAAInF,IAAI,CAACmF,YAAY,CAACP,OAAO,KAAK,IAAI,CAACzE,MAAM,EAAE;QAC3C,MAAMsF,KAAK,GAAG,qBAAqB,GAAGzF,IAAI,CAACqE,MAAM,CAACO,OAAO,GAAG,4BAA4B,GAAG,IAAI,CAACzE,MAAM;QACtGuF,cAAM,CAACD,KAAK,CAACA,KAAK,CAAC;QACnB,MAAM,IAAIpE,KAAK,CAACoE,KAAK,CAAC;MAC1B;MACA,IAAI;QACA,IAAAG,gBAAQ,EAAC5F,IAAI,CAACmF,YAAY,EAAEQ,SAAS,EAAE,IAAI,CAACxF,MAAM,CAAC;MACvD,CAAC,CAAC,OAAO0F,CAAC,EAAE;QACRH,cAAM,CAACD,KAAK,CAAC,uCAAuC,CAAC;QACrD;QACA,MAAMI,CAAC;MACX;IACJ;IACA,IAAI7F,IAAI,CAAC+E,YAAY,EAAE;MACnB,IAAI/E,IAAI,CAAC+E,YAAY,CAACH,OAAO,KAAK,IAAI,CAACzE,MAAM,EAAE;QAC3C,MAAMsF,KAAK,GAAG,qBAAqB,GAAGzF,IAAI,CAACqE,MAAM,CAACO,OAAO,GAAG,4BAA4B,GAAG,IAAI,CAACzE,MAAM;QACtGuF,cAAM,CAACD,KAAK,CAACA,KAAK,CAAC;QACnB,MAAM,IAAIpE,KAAK,CAACoE,KAAK,CAAC;MAC1B;MACA,IAAI;QACA,IAAAG,gBAAQ,EAAC5F,IAAI,CAAC+E,YAAY,EAAEY,SAAS,EAAE,IAAI,CAACxF,MAAM,CAAC;MACvD,CAAC,CAAC,OAAO0F,CAAC,EAAE;QACRH,cAAM,CAACD,KAAK,CAAC,uCAAuC,CAAC;QACrD;QACA,MAAMI,CAAC;MACX;IACJ;;IAEA;IACA,IAAI7F,IAAI,CAACqE,MAAM,EAAE;MACb,IAAI,CAACrE,IAAI,CAACqE,MAAM,GAAGrE,IAAI,CAACqE,MAAM;MAC9B;MACA,OAAO,IAAI,CAACrE,IAAI,CAAC,cAAc,CAAC;MAChC,OAAO,IAAI,CAACA,IAAI,CAAC,cAAc,CAAC;IACpC;IACA,IAAIA,IAAI,CAAC+E,YAAY,EAAE;MACnB,IAAI,CAAC/E,IAAI,CAAC+E,YAAY,GAAG/E,IAAI,CAAC+E,YAAY;IAC9C;IACA,IAAI/E,IAAI,CAACmF,YAAY,EAAE;MACnB,IAAI,CAACnF,IAAI,CAACmF,YAAY,GAAGnF,IAAI,CAACmF,YAAY;IAC9C;EACJ;EAEOW,gCAAgCA,CAACC,sBAA+B,EAAQ;IAC3E;IACA;IACA,IAAI,CAAC,IAAI,CAAChF,0BAA0B,IAAIgF,sBAAsB,EAAE;MAC5D,IAAI,CAAChF,0BAA0B,GAAG,IAAI;IAC1C;EACJ;EAEA,MAAaiF,UAAUA,CAAmBC,IAAO,EAAEhF,IAAY,EAA4C;IACvG,IAAI,CAAC,IAAI,CAACjB,IAAI,CAACiB,IAAI,CAAC,EAAE;MAClB,MAAM,IAAII,KAAK,CAAC,yBAAyB,GAAGJ,IAAI,GAAG,8BAA8B,CAAC;IACtF;IACA,MAAM,CAACiF,MAAM,EAAExE,OAAO,CAAC,GAAG,MAAM,IAAI,CAACV,kBAAkB,CAACC,IAAI,CAAC;IAC7D,IAAI;MACA,IAAAgE,cAAM,EAACgB,IAAI,EAAEvE,OAAO,EAAE,IAAI,CAACvB,MAAM,EAAE+F,MAAM,CAAC;MAC1C,OAAOD,IAAI;IACf,CAAC,SAAS;MACNvE,OAAO,CAACM,IAAI,EAAE;IAClB;EACJ;EAEA,MAAamE,QAAQA,CAAC1E,GAAqB,EAAyC;IAChF,IAAI,CAAC,IAAI,CAACzB,IAAI,CAACmF,YAAY,EAAE;MACzBO,cAAM,CAACU,IAAI,CAAC,uCAAuC,CAAC;MACpD;IACJ;IACA,OAAO,IAAI,CAACJ,UAAU,CAACvE,GAAG,CAACzB,IAAI,CAACqE,MAAM,EAAE,cAAc,CAAC;EAC3D;EAEA,MAAagC,UAAUA,CAAClG,MAAc,EAAEmG,MAAkB,EAAmC;IACzF,IAAInG,MAAM,KAAK,IAAI,CAACA,MAAM,EAAE;MACxB,MAAM,IAAIkB,KAAK,CAAE,kBAAiBlB,MAAO,yCAAwC,CAAC;IACtF;IACA,IAAI,CAAC,IAAI,CAACH,IAAI,CAAC+E,YAAY,EAAE;MACzBW,cAAM,CAACU,IAAI,CAAC,yCAAyC,CAAC;MACtD;IACJ;IACA,OAAO,IAAI,CAACJ,UAAU,CAClB;MACIO,UAAU,EAAED,MAAM,CAACC,UAAU;MAC7BvG,IAAI,EAAEsG,MAAM,CAACtG,IAAI;MACjBwG,SAAS,EAAEF,MAAM,CAACG,QAAQ;MAC1B7B,OAAO,EAAEzE;IACb,CAAC,EACD,cAAc,CACjB;EACL;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;EACWuG,cAAcA,CAACC,gBAAkC,EAAkB;IACtE;IACA;IACA,IACI,IAAI,CAACxG,MAAM,KAAKwG,gBAAgB,CAACxG,MAAM,IACvC,IAAI,CAACoB,KAAK,EAAE,IACZ,IAAI,CAACA,KAAK,EAAE,KAAKoF,gBAAgB,CAACpF,KAAK,EAAE,IACzC,IAAI,CAACA,KAAK,CAAC,cAAc,CAAC,IAC1B,IAAI,CAACA,KAAK,CAAC,cAAc,CAAC,KAAKoF,gBAAgB,CAACpF,KAAK,CAAC,cAAc,CAAC,EACvE;MACE,OAAO,IAAIqF,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC9F,QAAQ,CAAC;IACxD;IAEA,IAAI,CAAC,IAAI,CAACd,IAAI,CAACmF,YAAY,EAAE;MACzB;MACA;MACA,OAAO,IAAIyB,cAAc,CAAC,KAAK,EAAE,KAAK,EAAED,gBAAgB,CAAC7F,QAAQ,CAAC;IACtE;IAEA,IAAI+F,WAAoB;IACxB,MAAMC,UAAU,GAAGH,gBAAgB,CAAC3G,IAAI,CAACqE,MAAM;IAC/C,MAAM0C,KAAK,GAAG,IAAI,CAACxF,KAAK,CAAC,cAAc,CAAE;IACzC,IAAI;MACA,IAAAqE,gBAAQ,EAACkB,UAAU,EAAEC,KAAK,EAAE,IAAI,CAAC5G,MAAM,CAAC;MACxC0G,WAAW,GAAG,IAAI;IACtB,CAAC,CAAC,OAAOhB,CAAC,EAAE;MACRgB,WAAW,GAAG,KAAK;IACvB;IACA,OAAO,IAAID,cAAc,CAACC,WAAW,EAAEF,gBAAgB,CAAC5F,0BAA0B,EAAE4F,gBAAgB,CAAC7F,QAAQ,CAAC;EAClH;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACWkG,gBAAgBA,CACnBL,gBAAkC,EAClCL,MAAkB,EAClBW,UAAmB,EACnBC,uBAAgC,EAChB;IAChB,MAAMC,SAAS,GAAG,IAAI,CAACT,cAAc,CAACC,gBAAgB,CAAC;IAEvD,MAAMS,OAAO,GAAGT,gBAAgB,CAAC3G,IAAI,CAAC+E,YAAY;IAClD,IAAI,CAACqC,OAAO,EAAE;MACV;MACA;MACA,OAAO,IAAIC,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAEJ,UAAU,EAAEC,uBAAuB,CAAC;IAClF;IAEA,MAAMI,SAAS,GAAGC,cAAc,CAACjB,MAAM,EAAEK,gBAAgB,CAACxG,MAAM,CAAC;IACjE,IAAI;MACA;MACA,IAAAyF,gBAAQ,EAACwB,OAAO,EAAET,gBAAgB,CAACpF,KAAK,EAAE,EAAGoF,gBAAgB,CAACxG,MAAM,CAAC;MACrE;MACA,IAAAyF,gBAAQ,EAAC0B,SAAS,EAAE1H,oBAAoB,CAACwH,OAAO,CAAC,EAAET,gBAAgB,CAACxG,MAAM,CAAC;MAC3E;MACA,OAAOkH,gBAAgB,CAACG,kBAAkB,CAACL,SAAS,EAAEF,UAAU,EAAEC,uBAAuB,CAAC;IAC9F,CAAC,CAAC,OAAOrB,CAAC,EAAE;MACR,OAAO,IAAIwB,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAEJ,UAAU,EAAEC,uBAAuB,CAAC;IAClF;EACJ;;EAEA;AACJ;AACA;EACWO,iBAAiBA,CAAA,EAAoB;IACxC,OAAO,IAAI,CAACpH,cAAc;EAC9B;AACJ;AAACqH,OAAA,CAAAzH,gBAAA,GAAAA,gBAAA;AASD,SAASsH,cAAcA,CAACjB,MAAkB,EAAEnG,MAAc,EAAgB;EACtE,OAAO;IACHoG,UAAU,EAAED,MAAM,CAACC,UAAU;IAC7BvG,IAAI,EAAEsG,MAAM,CAACtG,IAAI;IACjBwG,SAAS,EAAEF,MAAM,CAACG,QAAQ;IAC1B7B,OAAO,EAAEzE,MAAM;IACfwH,UAAU,EAAErB,MAAM,CAACqB;EACvB,CAAC;AACL;AAAC,IAEWxD,iBAAiB;AAM7B;AACA;AACA;AAFAuD,OAAA,CAAAvD,iBAAA,GAAAA,iBAAA;AAAA,WANYA,iBAAiB;EAAjBA,iBAAiB,CAAjBA,iBAAiB;EAAjBA,iBAAiB,CAAjBA,iBAAiB;EAAjBA,iBAAiB,CAAjBA,iBAAiB;AAAA,GAAjBA,iBAAiB,KAAAuD,OAAA,CAAAvD,iBAAA,GAAjBA,iBAAiB;AAStB,MAAMyC,cAAc,CAAC;EACjB1G,WAAWA,CACG0H,oBAA6B,EAC7B7G,0BAAmC,EACnC8G,IAAa,EAChC;IAAA,KAHmBD,oBAA6B,GAA7BA,oBAA6B;IAAA,KAC7B7G,0BAAmC,GAAnCA,0BAAmC;IAAA,KACnC8G,IAAa,GAAbA,IAAa;EAC/B;;EAEH;AACJ;AACA;EACWC,UAAUA,CAAA,EAAY;IACzB,OAAO,IAAI,CAAC/B,sBAAsB,EAAE;EACxC;;EAEA;AACJ;AACA;EACWA,sBAAsBA,CAAA,EAAY;IACrC,OAAO,IAAI,CAAC6B,oBAAoB;EACpC;;EAEA;AACJ;AACA;AACA;EACWG,uBAAuBA,CAAA,EAAY;IACtC,OAAO,IAAI,CAAChH,0BAA0B;EAC1C;;EAEA;AACJ;AACA;EACWiH,MAAMA,CAAA,EAAY;IACrB,OAAO,IAAI,CAACH,IAAI;EACpB;AACJ;;AAEA;AACA;AACA;AAFAH,OAAA,CAAAd,cAAA,GAAAA,cAAA;AAGO,MAAMS,gBAAgB,CAAC;EACnBnH,WAAWA,CACE0H,oBAA6B,EAC7BC,IAAa,EACZI,aAAsB,EACtBf,uBAAgC,EACnD;IAAA,KAJkBU,oBAA6B,GAA7BA,oBAA6B;IAAA,KAC7BC,IAAa,GAAbA,IAAa;IAAA,KACZI,aAAsB,GAAtBA,aAAsB;IAAA,KACtBf,uBAAgC,GAAhCA,uBAAgC;EAClD;EAEH,OAAcM,kBAAkBA,CAC5BU,cAA8B,EAC9BD,aAAsB,EACtBf,uBAAgC,EAChB;IAChB,OAAO,IAAIG,gBAAgB,CACvBa,cAAc,CAACnC,sBAAsB,EAAE,EACvCmC,cAAc,CAACF,MAAM,EAAE,EACvBC,aAAa,EACbf,uBAAuB,CAC1B;EACL;;EAEA;AACJ;AACA;EACWY,UAAUA,CAAA,EAAY;IACzB,OAAOK,OAAO,CAAC,IAAI,CAACC,iBAAiB,EAAE,IAAK,IAAI,CAAClB,uBAAuB,IAAI,IAAI,CAACnB,sBAAsB,EAAG,CAAC;EAC/G;;EAEA;AACJ;AACA;EACWA,sBAAsBA,CAAA,EAAY;IACrC,OAAO,IAAI,CAAC6B,oBAAoB;EACpC;;EAEA;AACJ;AACA;EACWQ,iBAAiBA,CAAA,EAAY;IAChC,OAAO,IAAI,CAACH,aAAa;EAC7B;;EAEA;AACJ;AACA;AACA;EACWD,MAAMA,CAAA,EAAY;IACrB,OAAO,IAAI,CAACH,IAAI;EACpB;AACJ;AAACH,OAAA,CAAAL,gBAAA,GAAAA,gBAAA;AAEM,SAASgB,+BAA+BA,CAACnF,KAAkB,EAAEoF,SAAoB,EAAmB;EACvG,OAAO;IACHpG,uBAAuB,EAAE,eAAAA,CACrBjB,IAAkC,EAClCsH,kBAA0B,EACP;MACnB,MAAM9G,GAAG,GAAG,MAAM,IAAI+G,OAAO,CAAOC,OAAO,IAAK;QAC5C,OAAOvF,KAAK,CAACwF,KAAK,CAAC,UAAU,EAAE,CAACC,0CAAoB,CAACC,aAAa,CAAC,EAAGC,GAAG,IAAK;UAC1E3F,KAAK,CAAC4F,wBAAwB,CAACD,GAAG,EAAEJ,OAAO,EAAExH,IAAI,CAAC;QACtD,CAAC,CAAC;MACN,CAAC,CAAC;MAEF,IAAIQ,GAAG,IAAIA,GAAG,CAACsH,UAAU,EAAE;QACvB,MAAMC,SAAS,GAAGC,MAAM,CAACC,IAAI,CAACZ,SAAS,CAACU,SAAS,CAAC;QAClD,MAAMG,SAAS,GAAG,MAAM,IAAAC,eAAU,EAAC3H,GAAG,EAAEuH,SAAS,EAAE/H,IAAI,CAAC;QACxD,OAAO,IAAAoC,oBAAY,EAAC8F,SAAS,CAAC;MAClC,CAAC,MAAM;QACH,OAAO1H,GAAG;MACd;IACJ,CAAC;IACDY,yBAAyB,EAAE,eAAAA,CACvBpB,IAAkC,EAClCQ,GAAgB,EACH;MACb,IAAI,EAAEA,GAAG,YAAY4H,UAAU,CAAC,EAAE;QAC9B,MAAM,IAAIhI,KAAK,CAAE,qDAAoDI,GAAI,EAAC,CAAC;MAC/E;MACA,MAAMuH,SAAS,GAAGC,MAAM,CAACC,IAAI,CAACZ,SAAS,CAACU,SAAS,CAAC;MAClD,MAAMM,YAAY,GAAG,MAAM,IAAAC,eAAU,EAAC,IAAAtG,oBAAY,EAACxB,GAAG,CAAC,EAAEuH,SAAS,EAAE/H,IAAI,CAAC;MACzE,OAAOiC,KAAK,CAACwF,KAAK,CAAC,WAAW,EAAE,CAACC,0CAAoB,CAACC,aAAa,CAAC,EAAGC,GAAG,IAAK;QAC3E3F,KAAK,CAACsG,0BAA0B,CAACX,GAAG,EAAE5H,IAAI,EAAEqI,YAAY,CAAC;MAC7D,CAAC,CAAC;IACN;EACJ,CAAC;AACL;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeG,6BAA6BA,CAC/CC,QAAsB,EACtBvJ,MAAc,EACdsG,QAAgB,EACsB;EACtC;EACA,IAAIiD,QAAQ,CAACC,SAAS,EAAE,KAAKxJ,MAAM,EAAE;IACjC;EACJ;EACAuF,cAAM,CAACkE,GAAG,CAAC,wDAAwD,CAAC;EACpE;EACA;EACA,OAAO,IAAIpB,OAAO,CAAgC,CAACC,OAAO,EAAEoB,MAAM,KAAK;IACnE,MAAMC,MAAM,GAAGJ,QAAQ;IACvB,MAAMK,QAAQ,GAAGD,MAAM,CAACE,MAAM,CAAEC,gBAAgB;;IAEhD;IACA;IACA;IACA;IACA,MAAMC,YAAY,GAAG,IAAIjK,gBAAgB,CACrC8J,QAAQ,CAAC5J,MAAM,EACf;MACIa,kBAAkB,EAAE,MAAOC,IAAI,IAA0B;QACrDyE,cAAM,CAACyE,KAAK,CAAC,kCAAkC,EAAElJ,IAAI,EAAEwF,QAAQ,CAAC;QAChE,MAAM;UAAE2D;QAAQ,CAAC,GAAGN,MAAM,CAACO,aAAa,CAAE,mBAAkBpJ,IAAK,EAAC,EAAE,CAACwF,QAAQ,CAAC,CAAC;QAC/E,MAAMrE,MAAM,GAAG,MAAMgI,OAAO;QAC5B,MAAME,OAAO,GAAG,IAAAjH,oBAAY,EAACjB,MAAM,CAAC;QACpC,OAAOiH,UAAU,CAACH,IAAI,CAACoB,OAAO,CAAC;MACnC;IACJ,CAAC,EACDP,QAAQ,CAACtC,iBAAiB,EAAE,CAC/B;IACDyC,YAAY,CAAClK,IAAI,GAAG+J,QAAQ,CAAC/J,IAAI;;IAEjC;IACA;IACA;IACA;IACA,MAAMuK,OAAO,GAAG,IAAI/B,OAAO,CAAQC,OAAO,IAAK;MAC3C+B,UAAU,CAAC/B,OAAO,EAAE9I,sBAAsB,EAAE,IAAI0B,KAAK,CAAC,SAAS,CAAC,CAAC;IACrE,CAAC,CAAC;;IAEF;IACA,MAAMoJ,gBAAgB,GAAG,CAAC,YAA2B;MACjD,MAAMC,SAAS,GAAG,MAAMZ,MAAM,CAACE,MAAM,CAAEW,0BAA0B,EAAE;MACnE,IAAI,CAACD,SAAS,EAAE;QACZhF,cAAM,CAACU,IAAI,CAAC,2CAA2C,CAAC;QACxD,MAAMwE,SAAS,GAAGd,MAAM,CAACO,aAAa,CAAC,oBAAoB,EAAE,CAAC5D,QAAQ,CAAC,CAAC;QACxE,MAAMoE,SAAS,GAAG,MAAMD,SAAS,CAACR,OAAO;QACzC1E,cAAM,CAACU,IAAI,CAAC,iCAAiC,CAAC;QAC9C,MAAM0E,UAAU,GAAG,IAAAzH,oBAAY,EAACwH,SAAS,CAAC;QAC1CnF,cAAM,CAACU,IAAI,CAAC,gCAAgC,CAAC;QAC7C,MAAM0D,MAAM,CAACE,MAAM,CAAEe,4BAA4B,CAAC1B,UAAU,CAACH,IAAI,CAAC4B,UAAU,CAAC,CAAC;QAC9EpF,cAAM,CAACU,IAAI,CAAC,+CAA+C,CAAC;QAC5D,MAAM4E,UAAU,GAAG,MAAMlB,MAAM,CAACmB,mBAAmB,EAAE;QACrD;QACAnB,MAAM,CAACoB,yBAAyB,CAAC5J,SAAS,EAAEA,SAAS,EAAE0J,UAAU,CAAE,CAACG,IAAI,CAAC,MAAM;UAC3EzF,cAAM,CAACU,IAAI,CAAC,kBAAkB,CAAC;QACnC,CAAC,CAAC;MACN;IACJ,CAAC,GAAG;;IAEJ;IACA,OAAOoC,OAAO,CAAC4C,IAAI,CAAgC,CAC/C5C,OAAO,CAAC6C,GAAG,CAAC,CACRnB,YAAY,CAAClJ,kBAAkB,CAAC,QAAQ,CAAC,EACzCkJ,YAAY,CAAClJ,kBAAkB,CAAC,cAAc,CAAC,EAC/CkJ,YAAY,CAAClJ,kBAAkB,CAAC,cAAc,CAAC,EAC/CyJ,gBAAgB,CACnB,CAAC,EACFF,OAAO,CACV,CAAC,CAACY,IAAI,CAAC1C,OAAO,EAAEoB,MAAM,CAAC;EAC5B,CAAC,CAAC,CAACyB,KAAK,CAAEzF,CAAC,IAAK;IACZH,cAAM,CAAC6F,IAAI,CAAC,+CAA+C,EAAE1F,CAAC,CAAC;EACnE,CAAC,CAAC;AACN"}