@did-btcr2/cli 0.12.1 → 0.12.3

package/dist/cjs/index.js

@@ -63,7 +63,7 @@ var import_utils2 = require("@noble/hashes/utils.js");
 
 // src/config.ts
 var import_api = require("@did-btcr2/api");
-var import_node_fs4 = require("fs");
+var import_node_fs5 = require("fs");
 var import_node_os2 = require("os");
 var import_node_path4 = require("path");
 
@@ -142,7 +142,7 @@ function assertSecurePerms(path) {
 var import_key_manager = require("@did-btcr2/key-manager");
 
 // src/keystore/file-key-store.ts
-var import_node_fs2 = require("fs");
+var import_node_fs3 = require("fs");
 var import_node_path3 = require("path");
 var import_base2 = require("@scure/base");
 
@@ -230,6 +230,90 @@ function decryptSecret(env, passphrase) {
   }
 }
 
+// src/keystore/lock.ts
+var import_node_fs2 = require("fs");
+var DEFAULT_TIMEOUT_MS = 1e4;
+var DEFAULT_STALE_MS = 3e4;
+var DEFAULT_RETRY_MS = 50;
+var tokenCounter = 0;
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function isProcessAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function breakIfStale(lockPath, staleMs) {
+  let ageMs;
+  let pid;
+  try {
+    const stat = (0, import_node_fs2.statSync)(lockPath);
+    ageMs = Date.now() - stat.mtimeMs;
+    pid = Number.parseInt((0, import_node_fs2.readFileSync)(lockPath, "utf-8").split(".")[0] ?? "", 10);
+  } catch {
+    return true;
+  }
+  if (ageMs > staleMs || !isProcessAlive(pid)) {
+    try {
+      (0, import_node_fs2.rmSync)(lockPath, { force: true });
+    } catch {
+    }
+    return true;
+  }
+  return false;
+}
+function releaseIfOwner(lockPath, token) {
+  try {
+    if ((0, import_node_fs2.readFileSync)(lockPath, "utf-8") === token) (0, import_node_fs2.rmSync)(lockPath, { force: true });
+  } catch {
+  }
+}
+function withFileLock(lockPath, fn, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const staleMs = options.staleMs ?? DEFAULT_STALE_MS;
+  const retryMs = options.retryMs ?? DEFAULT_RETRY_MS;
+  const token = `${process.pid}.${tokenCounter++}`;
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    try {
+      const fd = (0, import_node_fs2.openSync)(lockPath, "wx", 384);
+      try {
+        (0, import_node_fs2.writeSync)(fd, token);
+      } finally {
+        (0, import_node_fs2.closeSync)(fd);
+      }
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") {
+        throw new KeyStoreError(
+          `Failed to acquire keystore lock at ${lockPath}.`,
+          "KEYSTORE_LOCK_ERROR",
+          { lockPath, cause: error instanceof Error ? error.message : String(error) }
+        );
+      }
+      if (breakIfStale(lockPath, staleMs)) continue;
+      if (Date.now() >= deadline) {
+        throw new KeyStoreError(
+          `Timed out after ${timeoutMs}ms waiting for the keystore lock at ${lockPath}. Another btcr2 process may be writing; retry, or remove the lock file if no other process is running.`,
+          "KEYSTORE_LOCKED_ERROR",
+          { lockPath, timeoutMs }
+        );
+      }
+      sleepSync(retryMs);
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    releaseIfOwner(lockPath, token);
+  }
+}
+
 // src/keystore/paths.ts
 var import_node_os = require("os");
 var import_node_path2 = require("path");
@@ -242,23 +326,27 @@ function defaultKeystorePath() {
 var KEYSTORE_VERSION = 1;
 var FileKeyStore = class {
   #path;
+  #lockPath;
+  #lockOptions;
   #getPassphrase;
   #argonParams;
   #cache = /* @__PURE__ */ new Map();
   #active;
   constructor(options) {
     this.#path = options.path ?? defaultKeystorePath();
+    this.#lockPath = `${this.#path}.lock`;
+    this.#lockOptions = options.lock ?? {};
     this.#getPassphrase = options.getPassphrase;
     this.#argonParams = options.argonParams ?? DEFAULT_ARGON_PARAMS;
     ensureDir((0, import_node_path3.dirname)(this.#path), 448);
-    this.#load();
+    this.#loadFromDisk();
   }
-  #load() {
-    if (!(0, import_node_fs2.existsSync)(this.#path)) return;
+  #loadFromDisk() {
+    if (!(0, import_node_fs3.existsSync)(this.#path)) return;
     assertSecurePerms(this.#path);
     let parsed;
     try {
-      parsed = JSON.parse((0, import_node_fs2.readFileSync)(this.#path, "utf-8"));
+      parsed = JSON.parse((0, import_node_fs3.readFileSync)(this.#path, "utf-8"));
     } catch {
       throw new KeyStoreError(
         `Keystore at ${this.#path} is corrupt or unreadable.`,
@@ -317,6 +405,42 @@ var FileKeyStore = class {
     writeFileAtomic(this.#path, `${JSON.stringify(file, null, 2)}
 `, 384);
   }
+  /**
+   * Re-reads the file into the cache, discarding the prior in-memory view so a
+   * mutation applies on top of whatever other processes have written. Secrets
+   * already decrypted this session are carried over for entries whose sealed
+   * envelope is byte-identical on disk, so a mid-session write does not force a
+   * re-prompt for keys it did not touch.
+   */
+  #reload() {
+    const carried = /* @__PURE__ */ new Map();
+    for (const [id, entry] of this.#cache) {
+      if (entry.secret && entry.decrypted) carried.set(id, { secret: entry.secret, decrypted: entry.decrypted });
+    }
+    this.#cache.clear();
+    this.#active = void 0;
+    this.#loadFromDisk();
+    for (const [id, prior] of carried) {
+      const entry = this.#cache.get(id);
+      if (entry?.secret && JSON.stringify(entry.secret) === JSON.stringify(prior.secret)) {
+        entry.decrypted = prior.decrypted;
+      }
+    }
+  }
+  /**
+   * Runs a cache mutation under the exclusive write lock, reloading the file
+   * first so the change merges with any concurrent writer's change rather than
+   * overwriting it, then flushing the result atomically. Callers must do any
+   * expensive work (such as sealing a secret with argon2id) before calling this,
+   * so the locked critical section stays short.
+   */
+  #mutate(apply) {
+    withFileLock(this.#lockPath, () => {
+      this.#reload();
+      apply();
+      this.#flush();
+    }, this.#lockOptions);
+  }
   get(id) {
     const entry = this.#cache.get(id);
     if (!entry) return void 0;
@@ -342,26 +466,28 @@ var FileKeyStore = class {
   }
   set(id, value) {
     const secret = value.secretKey ? encryptSecret(value.secretKey, this.#getPassphrase(), this.#argonParams) : void 0;
-    this.#cache.set(id, {
-      publicKey: value.publicKey,
-      ...value.tags && { tags: value.tags },
-      ...secret && { secret },
-      ...value.secretKey && { decrypted: value.secretKey }
+    this.#mutate(() => {
+      this.#cache.set(id, {
+        publicKey: value.publicKey,
+        ...value.tags && { tags: value.tags },
+        ...secret && { secret },
+        ...value.secretKey && { decrypted: value.secretKey }
+      });
     });
-    this.#flush();
   }
   delete(id) {
-    const existed = this.#cache.delete(id);
-    if (existed) {
-      if (this.#active === id) this.#active = void 0;
-      this.#flush();
-    }
+    let existed = false;
+    this.#mutate(() => {
+      existed = this.#cache.delete(id);
+      if (existed && this.#active === id) this.#active = void 0;
+    });
     return existed;
   }
   clear() {
-    this.#cache.clear();
-    this.#active = void 0;
-    this.#flush();
+    this.#mutate(() => {
+      this.#cache.clear();
+      this.#active = void 0;
+    });
   }
   /** All stored values with secret keys omitted. Never decrypts, never prompts. */
   list() {
@@ -400,11 +526,12 @@ var FileKeyStore = class {
    * clears it. Throws if the identifier is not a known key.
    */
   setActive(id) {
-    if (id !== void 0 && !this.#cache.has(id)) {
-      throw new KeyStoreError(`Cannot set unknown key as active: ${id}.`, "KEY_NOT_FOUND_ERROR", { keyId: id });
-    }
-    this.#active = id;
-    this.#flush();
+    this.#mutate(() => {
+      if (id !== void 0 && !this.#cache.has(id)) {
+        throw new KeyStoreError(`Cannot set unknown key as active: ${id}.`, "KEY_NOT_FOUND_ERROR", { keyId: id });
+      }
+      this.#active = id;
+    });
   }
 };
 
@@ -464,13 +591,13 @@ var FileBackedKeyManager = class {
 };
 
 // src/keystore/passphrase.ts
-var import_node_fs3 = require("fs");
+var import_node_fs4 = require("fs");
 var ENV_KEYSTORE_PASSPHRASE = "BTCR2_KEYSTORE_PASSPHRASE";
 function acquirePassphrase(options = {}) {
   const fromEnv = process.env[ENV_KEYSTORE_PASSPHRASE];
   if (fromEnv) return assertNonEmpty(fromEnv.replace(/\r?\n$/, ""));
   if (options.passphraseFile) {
-    return assertNonEmpty((0, import_node_fs3.readFileSync)(options.passphraseFile, "utf-8").replace(/\r?\n$/, ""));
+    return assertNonEmpty((0, import_node_fs4.readFileSync)(options.passphraseFile, "utf-8").replace(/\r?\n$/, ""));
   }
   if (!process.stdin.isTTY) {
     throw new KeyStoreError(
@@ -504,7 +631,7 @@ function promptHidden(label) {
     for (; ; ) {
       let read = 0;
       try {
-        read = (0, import_node_fs3.readSync)(stdin.fd, byte, 0, 1, null);
+        read = (0, import_node_fs4.readSync)(stdin.fd, byte, 0, 1, null);
       } catch (error) {
         const code = error.code;
         if (code === "EAGAIN") continue;
@@ -601,7 +728,7 @@ function defaultConfigPath() {
 }
 function readConfigFile(path) {
   try {
-    const content = (0, import_node_fs4.readFileSync)(path, "utf-8");
+    const content = (0, import_node_fs5.readFileSync)(path, "utf-8");
     return JSON.parse(content);
   } catch {
     return void 0;
@@ -1034,7 +1161,7 @@ function parseJsonArg2(flagName) {
 // src/commands/key.ts
 var import_keypair = require("@did-btcr2/keypair");
 var import_utils3 = require("@noble/hashes/utils.js");
-var import_node_fs5 = require("fs");
+var import_node_fs6 = require("fs");
 function registerKeyCommand(program, factory, globals) {
   const key = program.command("key").description("Manage keypairs in the encrypted keystore.");
   const print = (result) => console.log(formatResult(result, globals()));
@@ -1132,7 +1259,7 @@ function parseHex(hex, expectedBytes, label) {
 function readHexFile(path, expectedBytes, label) {
   let content;
   try {
-    content = (0, import_node_fs5.readFileSync)(path, "utf-8");
+    content = (0, import_node_fs6.readFileSync)(path, "utf-8");
   } catch {
     throw new CLIError(`Cannot read ${label} at ${path}.`, "INVALID_ARGUMENT_ERROR", { label, path });
   }
@@ -1141,7 +1268,7 @@ function readHexFile(path, expectedBytes, label) {
 function writeSecretFile(path, contents) {
   let fd;
   try {
-    fd = (0, import_node_fs5.openSync)(path, "wx", 384);
+    fd = (0, import_node_fs6.openSync)(path, "wx", 384);
   } catch (error) {
     if (error.code === "EEXIST") {
       throw new CLIError(`Refusing to overwrite existing file ${path}. Choose a new --out path.`, "INVALID_ARGUMENT_ERROR", { path });
@@ -1149,14 +1276,14 @@ function writeSecretFile(path, contents) {
     throw error;
   }
   try {
-    (0, import_node_fs5.writeFileSync)(fd, contents);
+    (0, import_node_fs6.writeFileSync)(fd, contents);
   } finally {
-    (0, import_node_fs5.closeSync)(fd);
+    (0, import_node_fs6.closeSync)(fd);
   }
 }
 
 // src/commands/config.ts
-var import_node_fs6 = require("fs");
+var import_node_fs7 = require("fs");
 var import_node_path5 = require("path");
 function registerConfigCommand(program, globals) {
   const config = program.command("config").description("Read and write CLI configuration.");
@@ -1164,7 +1291,7 @@ function registerConfigCommand(program, globals) {
   const print = (result) => console.log(formatResult(result, globals()));
   config.command("init").description("Create a default config file with one profile per network.").option("--force", "Overwrite an existing config file.", false).action((options) => {
     const p = path();
-    if ((0, import_node_fs6.existsSync)(p) && !options.force) {
+    if ((0, import_node_fs7.existsSync)(p) && !options.force) {
       throw new CLIError(`Config already exists at ${p}. Use --force to overwrite.`, "INVALID_ARGUMENT_ERROR", { path: p });
     }
     const scaffold = {
@@ -1276,14 +1403,14 @@ function completionScript(shell) {
 }
 
 // src/version.ts
-var import_node_fs7 = require("fs");
+var import_node_fs8 = require("fs");
 var import_node_path6 = require("path");
 var import_node_url = require("url");
 function readVersion() {
   let dir = (0, import_node_path6.dirname)((0, import_node_url.fileURLToPath)(importMetaUrl));
   for (let i = 0; i < 5; i++) {
     try {
-      const pkg = JSON.parse((0, import_node_fs7.readFileSync)((0, import_node_path6.join)(dir, "package.json"), "utf-8"));
+      const pkg = JSON.parse((0, import_node_fs8.readFileSync)((0, import_node_path6.join)(dir, "package.json"), "utf-8"));
       if (pkg.name === "@did-btcr2/cli") return pkg.version;
     } catch {
     }

package/dist/esm/src/keystore/file-key-store.js

@@ -4,6 +4,7 @@ import { base64urlnopad } from '@scure/base';
 import { assertSecurePerms, ensureDir, writeFileAtomic } from './atomic.js';
 import { DEFAULT_ARGON_PARAMS, decryptSecret, encryptSecret } from './envelope.js';
 import { KeyStoreError } from './error.js';
+import { withFileLock } from './lock.js';
 import { defaultKeystorePath } from './paths.js';
 /** Current on-disk keystore file format version. */
 export const KEYSTORE_VERSION = 1;
@@ -13,6 +14,15 @@ export const KEYSTORE_VERSION = 1;
  * in memory at construction and flushing the whole file atomically on every
  * mutation.
  *
+ * Every mutation runs under an exclusive cross-process lock and, inside that
+ * lock, reloads the file from disk before applying its change and flushing.
+ * Caching at construction and flushing the whole file is otherwise a lost-update
+ * race: two `btcr2` processes that each load, then each write, would have the
+ * second overwrite the first. The lock serializes the writers and the reload
+ * merges any change the other made, so concurrent invocations compose instead of
+ * clobbering. Reads stay lock-free: an atomic rename means a concurrent reader
+ * always sees a complete file, old or new.
+ *
  * Secrets are materialized only through {@link FileKeyStore.get}. The
  * {@link FileKeyStore.list} and {@link FileKeyStore.entries} projections omit
  * secret keys and never decrypt, so enumerating the store never triggers a
@@ -20,18 +30,22 @@ export const KEYSTORE_VERSION = 1;
  */
 export class FileKeyStore {
     #path;
+    #lockPath;
+    #lockOptions;
     #getPassphrase;
     #argonParams;
     #cache = new Map();
     #active;
     constructor(options) {
         this.#path = options.path ?? defaultKeystorePath();
+        this.#lockPath = `${this.#path}.lock`;
+        this.#lockOptions = options.lock ?? {};
         this.#getPassphrase = options.getPassphrase;
         this.#argonParams = options.argonParams ?? DEFAULT_ARGON_PARAMS;
         ensureDir(dirname(this.#path), 0o700);
-        this.#load();
+        this.#loadFromDisk();
     }
-    #load() {
+    #loadFromDisk() {
         if (!existsSync(this.#path))
             return;
         assertSecurePerms(this.#path);
@@ -82,6 +96,43 @@ export class FileKeyStore {
         };
         writeFileAtomic(this.#path, `${JSON.stringify(file, null, 2)}\n`, 0o600);
     }
+    /**
+     * Re-reads the file into the cache, discarding the prior in-memory view so a
+     * mutation applies on top of whatever other processes have written. Secrets
+     * already decrypted this session are carried over for entries whose sealed
+     * envelope is byte-identical on disk, so a mid-session write does not force a
+     * re-prompt for keys it did not touch.
+     */
+    #reload() {
+        const carried = new Map();
+        for (const [id, entry] of this.#cache) {
+            if (entry.secret && entry.decrypted)
+                carried.set(id, { secret: entry.secret, decrypted: entry.decrypted });
+        }
+        this.#cache.clear();
+        this.#active = undefined;
+        this.#loadFromDisk();
+        for (const [id, prior] of carried) {
+            const entry = this.#cache.get(id);
+            if (entry?.secret && JSON.stringify(entry.secret) === JSON.stringify(prior.secret)) {
+                entry.decrypted = prior.decrypted;
+            }
+        }
+    }
+    /**
+     * Runs a cache mutation under the exclusive write lock, reloading the file
+     * first so the change merges with any concurrent writer's change rather than
+     * overwriting it, then flushing the result atomically. Callers must do any
+     * expensive work (such as sealing a secret with argon2id) before calling this,
+     * so the locked critical section stays short.
+     */
+    #mutate(apply) {
+        withFileLock(this.#lockPath, () => {
+            this.#reload();
+            apply();
+            this.#flush();
+        }, this.#lockOptions);
+    }
     get(id) {
         const entry = this.#cache.get(id);
         if (!entry)
@@ -112,30 +163,36 @@ export class FileKeyStore {
         return this.#cache.has(id);
     }
     set(id, value) {
+        // Seal the secret before taking the lock: argon2id is deliberately slow and
+        // must not extend the critical section that blocks other processes.
         const secret = value.secretKey
             ? encryptSecret(value.secretKey, this.#getPassphrase(), this.#argonParams)
             : undefined;
-        this.#cache.set(id, {
-            publicKey: value.publicKey,
-            ...(value.tags && { tags: value.tags }),
-            ...(secret && { secret }),
-            ...(value.secretKey && { decrypted: value.secretKey }),
+        this.#mutate(() => {
+            this.#cache.set(id, {
+                publicKey: value.publicKey,
+                ...(value.tags && { tags: value.tags }),
+                ...(secret && { secret }),
+                ...(value.secretKey && { decrypted: value.secretKey }),
+            });
         });
-        this.#flush();
     }
     delete(id) {
-        const existed = this.#cache.delete(id);
-        if (existed) {
-            if (this.#active === id)
+        // `existed` reflects the freshly-reloaded state inside the lock, so a key a
+        // concurrent process already removed reads as absent rather than resurrected.
+        let existed = false;
+        this.#mutate(() => {
+            existed = this.#cache.delete(id);
+            if (existed && this.#active === id)
                 this.#active = undefined;
-            this.#flush();
-        }
+        });
         return existed;
     }
     clear() {
-        this.#cache.clear();
-        this.#active = undefined;
-        this.#flush();
+        this.#mutate(() => {
+            this.#cache.clear();
+            this.#active = undefined;
+        });
     }
     /** All stored values with secret keys omitted. Never decrypts, never prompts. */
     list() {
@@ -174,11 +231,14 @@ export class FileKeyStore {
      * clears it. Throws if the identifier is not a known key.
      */
     setActive(id) {
-        if (id !== undefined && !this.#cache.has(id)) {
-            throw new KeyStoreError(`Cannot set unknown key as active: ${id}.`, 'KEY_NOT_FOUND_ERROR', { keyId: id });
-        }
-        this.#active = id;
-        this.#flush();
+        this.#mutate(() => {
+            // The existence check runs against the reloaded state, so a key another
+            // process added in the meantime is a valid active target.
+            if (id !== undefined && !this.#cache.has(id)) {
+                throw new KeyStoreError(`Cannot set unknown key as active: ${id}.`, 'KEY_NOT_FOUND_ERROR', { keyId: id });
+            }
+            this.#active = id;
+        });
     }
 }
 //# sourceMappingURL=file-key-store.js.map

package/dist/esm/src/keystore/file-key-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-key-store.js","sourceRoot":"","sources":["../../../../src/keystore/file-key-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,oDAAoD;AACpD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAU,CAAC;AAkC3C;;;;;;;;;;GAUG;AACH,MAAM,OAAO,YAAY;IACd,KAAK,CAAS;IACd,cAAc,CAAe;IAC7B,YAAY,CAAc;IAC1B,MAAM,GAAmC,IAAI,GAAG,EAAE,CAAC;IAC5D,OAAO,CAAqB;IAE5B,YAAY,OAA4B;QACtC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACnD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAChE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO;QACpC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAiB,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,aAAa,CACrB,eAAe,IAAI,CAAC,KAAK,4BAA4B,EACrD,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC;YAClC,MAAM,IAAI,aAAa,CACrB,iCAAiC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EACpD,wBAAwB,EACxB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,KAAK,MAAM,CAAE,EAAE,EAAE,MAAM,CAAE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,SAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBAC/E,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,8BAA8B,EAClD,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;YACJ,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC5B,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,UAAU,SAAS,CAAC,MAAM,gCAAgC,EAC9E,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;gBAClB,SAAS;gBACT,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM;QACJ,MAAM,IAAI,GAA8B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,EAAE,CAAC,GAAG;gBACT,SAAS,EAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;gBAClD,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACvC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;aAC9C,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAiB;YACzB,CAAC,EAAG,gBAAgB;YACpB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7C,IAAI;SACL,CAAC;QACF,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;IAED,GAAG,CAAC,EAAiB;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,MAAM,GAAa;YACvB,SAAS,EAAG,KAAK,CAAC,SAAS;YAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SACxC,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,uEAAuE;YACvE,uEAAuE;YACvE,0EAA0E;YAC1E,0EAA0E;YAC1E,sBAAsB;YACtB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC5B,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE;gBACzC,YAAY,EAAG,IAAI;gBACnB,UAAU,EAAK,KAAK;gBACpB,GAAG,EAAY,GAAe,EAAE;oBAC9B,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;oBACjE,OAAO,KAAK,CAAC,SAAS,CAAC;gBACzB,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,GAAG,CAAC,EAAiB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,GAAG,CAAC,EAAiB,EAAE,KAAe;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS;YAC5B,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC;YAC1E,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;YAClB,SAAS,EAAG,KAAK,CAAC,SAAS;YAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC;YACzB,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,EAAiB;QACtB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE;gBAAE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;YAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,MAAM,EAAE,CAAC;IAChB,CAAC;IAED,iFAAiF;IACjF,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAE,AAAD,EAAG,KAAK,CAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,MAAM,GAAG,GAAqC,EAAE,CAAC;QACjD,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,CAAE,EAAE,EAAE;oBACb,SAAS,EAAG,KAAK,CAAC,SAAS;oBAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;iBACxC,CAAE,CAAC,CAAC;QACP,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK;QACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,wEAAwE;IACxE,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,EAA6B;QACrC,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,aAAa,CAAC,qCAAqC,EAAE,GAAG,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,MAAM,EAAE,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"file-key-store.js","sourceRoot":"","sources":["../../../../src/keystore/file-key-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAoB,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,oDAAoD;AACpD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAU,CAAC;AAoC3C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,YAAY;IACd,KAAK,CAAS;IACd,SAAS,CAAS;IAClB,YAAY,CAAc;IAC1B,cAAc,CAAe;IAC7B,YAAY,CAAc;IAC1B,MAAM,GAAmC,IAAI,GAAG,EAAE,CAAC;IAC5D,OAAO,CAAqB;IAE5B,YAAY,OAA4B;QACtC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,GAAG,IAAI,CAAC,KAAK,OAAO,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAChE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAED,aAAa;QACX,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO;QACpC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAiB,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,aAAa,CACrB,eAAe,IAAI,CAAC,KAAK,4BAA4B,EACrD,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC;YAClC,MAAM,IAAI,aAAa,CACrB,iCAAiC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EACpD,wBAAwB,EACxB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,KAAK,MAAM,CAAE,EAAE,EAAE,MAAM,CAAE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,SAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBAC/E,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,8BAA8B,EAClD,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;YACJ,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC5B,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,UAAU,SAAS,CAAC,MAAM,gCAAgC,EAC9E,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;gBAClB,SAAS;gBACT,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM;QACJ,MAAM,IAAI,GAA8B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,EAAE,CAAC,GAAG;gBACT,SAAS,EAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;gBAClD,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACvC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;aAC9C,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAiB;YACzB,CAAC,EAAG,gBAAgB;YACpB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7C,IAAI;SACL,CAAC;QACF,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoE,CAAC;QAC5F,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,OAAO,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnF,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,KAAiB;QACvB,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YAChC,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,KAAK,EAAE,CAAC;YACR,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACxB,CAAC;IAED,GAAG,CAAC,EAAiB;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,MAAM,GAAa;YACvB,SAAS,EAAG,KAAK,CAAC,SAAS;YAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SACxC,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,uEAAuE;YACvE,uEAAuE;YACvE,0EAA0E;YAC1E,0EAA0E;YAC1E,sBAAsB;YACtB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC5B,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE;gBACzC,YAAY,EAAG,IAAI;gBACnB,UAAU,EAAK,KAAK;gBACpB,GAAG,EAAY,GAAe,EAAE;oBAC9B,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;oBACjE,OAAO,KAAK,CAAC,SAAS,CAAC;gBACzB,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,GAAG,CAAC,EAAiB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,GAAG,CAAC,EAAiB,EAAE,KAAe;QACpC,4EAA4E;QAC5E,oEAAoE;QACpE,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS;YAC5B,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC;YAC1E,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;gBAClB,SAAS,EAAG,KAAK,CAAC,SAAS;gBAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACvC,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC;gBACzB,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,EAAiB;QACtB,4EAA4E;QAC5E,8EAA8E;QAC9E,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE;gBAAE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC/D,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACjF,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAE,AAAD,EAAG,KAAK,CAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,MAAM,GAAG,GAAqC,EAAE,CAAC;QACjD,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,CAAE,EAAE,EAAE;oBACb,SAAS,EAAG,KAAK,CAAC,SAAS;oBAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;iBACxC,CAAE,CAAC,CAAC;QACP,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK;QACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,wEAAwE;IACxE,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,EAA6B;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,wEAAwE;YACxE,0DAA0D;YAC1D,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,aAAa,CAAC,qCAAqC,EAAE,GAAG,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC5G,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/esm/src/keystore/lock.js

@@ -0,0 +1,127 @@
+import { closeSync, openSync, readFileSync, rmSync, statSync, writeSync } from 'node:fs';
+import { KeyStoreError } from './error.js';
+const DEFAULT_TIMEOUT_MS = 10_000;
+const DEFAULT_STALE_MS = 30_000;
+const DEFAULT_RETRY_MS = 50;
+// A per-process counter so a lock token is unambiguous even when one process
+// runs several stores over the same path (as the tests do): the pid alone would
+// collide, the pid plus counter never does.
+let tokenCounter = 0;
+/**
+ * Sleeps synchronously for `ms` without spinning the CPU. The keystore store is
+ * a synchronous interface, so the wait must block the thread rather than yield a
+ * promise. `Atomics.wait` on a private buffer no other thread can notify always
+ * runs the full duration. Node-only, which the keystore already is.
+ */
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/**
+ * Reports whether a process is still running. `process.kill(pid, 0)` sends no
+ * signal but performs the existence/permission check: ESRCH means the process
+ * is gone, EPERM means it exists under another user (still alive).
+ */
+function isProcessAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+/**
+ * Removes the lock if its writer process is gone or it has aged past `staleMs`,
+ * so a process that crashed mid-mutation cannot wedge the keystore permanently.
+ * Returns true when the lock was broken or had already vanished (caller should
+ * retry the create immediately), false when a live, fresh holder still owns it.
+ */
+function breakIfStale(lockPath, staleMs) {
+    let ageMs;
+    let pid;
+    try {
+        const stat = statSync(lockPath);
+        ageMs = Date.now() - stat.mtimeMs;
+        pid = Number.parseInt(readFileSync(lockPath, 'utf-8').split('.')[0] ?? '', 10);
+    }
+    catch {
+        // The lock disappeared between our failed create and this inspection; the
+        // caller can race for it again straight away.
+        return true;
+    }
+    if (ageMs > staleMs || !isProcessAlive(pid)) {
+        try {
+            rmSync(lockPath, { force: true });
+        }
+        catch {
+            // Another waiter broke it first; either way it is gone, so retry.
+        }
+        return true;
+    }
+    return false;
+}
+/** Releases the lock only while it still holds our token, never one broken from us as stale. */
+function releaseIfOwner(lockPath, token) {
+    try {
+        if (readFileSync(lockPath, 'utf-8') === token)
+            rmSync(lockPath, { force: true });
+    }
+    catch {
+        // Already removed (broken as stale, or never created); nothing to release.
+    }
+}
+/**
+ * Runs `fn` while holding an exclusive, cross-process advisory lock on
+ * `lockPath`, then releases it.
+ *
+ * The lock is an `O_EXCL` lockfile: creating it fails when another holder
+ * exists, which serializes mutators across separate `btcr2` processes. This is
+ * the missing half of a safe read-modify-write on the keystore file: an atomic
+ * rename keeps the file from tearing, but only mutual exclusion (paired with a
+ * reload inside the lock) keeps two concurrent writers from clobbering each
+ * other's changes. A lock whose writer has died, or that has aged past
+ * `staleMs`, is broken so a crash cannot deadlock future invocations.
+ *
+ * @throws {KeyStoreError} `KEYSTORE_LOCKED_ERROR` if the lock cannot be acquired
+ *   within `timeoutMs`, or `KEYSTORE_LOCK_ERROR` on an unexpected filesystem error.
+ */
+export function withFileLock(lockPath, fn, options = {}) {
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const staleMs = options.staleMs ?? DEFAULT_STALE_MS;
+    const retryMs = options.retryMs ?? DEFAULT_RETRY_MS;
+    const token = `${process.pid}.${tokenCounter++}`;
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        try {
+            const fd = openSync(lockPath, 'wx', 0o600);
+            try {
+                writeSync(fd, token);
+            }
+            finally {
+                closeSync(fd);
+            }
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST') {
+                throw new KeyStoreError(`Failed to acquire keystore lock at ${lockPath}.`, 'KEYSTORE_LOCK_ERROR', { lockPath, cause: error instanceof Error ? error.message : String(error) });
+            }
+            if (breakIfStale(lockPath, staleMs))
+                continue;
+            if (Date.now() >= deadline) {
+                throw new KeyStoreError(`Timed out after ${timeoutMs}ms waiting for the keystore lock at ${lockPath}. `
+                    + 'Another btcr2 process may be writing; retry, or remove the lock file if no other process is running.', 'KEYSTORE_LOCKED_ERROR', { lockPath, timeoutMs });
+            }
+            sleepSync(retryMs);
+        }
+    }
+    try {
+        return fn();
+    }
+    finally {
+        releaseIfOwner(lockPath, token);
+    }
+}
+//# sourceMappingURL=lock.js.map