@did-btcr2/cli 0.15.0 → 0.16.0

package/dist/esm/src/keystore/file-key-store.js

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { dirname } from 'node:path';
+import { utf8ToBytes } from '@noble/hashes/utils.js';
 import { base64urlnopad } from '@scure/base';
 import { assertSecurePerms, ensureDir, writeFileAtomic } from './atomic.js';
 import { DEFAULT_ARGON_PARAMS, decryptSecret, encryptSecret } from './envelope.js';
@@ -9,19 +10,44 @@ import { defaultKeystorePath } from './paths.js';
 /** Current on-disk keystore file format version. */
 export const KEYSTORE_VERSION = 1;
 /**
- * A Node-only, file-backed {@link KeyValueStore} that encrypts secret keys at
+ * Fixed sentinel sealed under the keystore passphrase and stored as the file's
+ * `verifier`. Decrypting it checks a candidate passphrase before any real secret
+ * is sealed or opened, so a typo fails loudly instead of corrupting the store.
+ */
+const VERIFIER_PLAINTEXT = utf8ToBytes('did-btcr2-keystore-verifier-v1');
+/** Constant-length-independent byte compare for the verifier sentinel. */
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+/** Whether two secret envelopes are byte-identical (structural JSON compare). */
+function sameEnvelope(a, b) {
+    return JSON.stringify(a) === JSON.stringify(b);
+}
+/**
+ * A Node-only, file-backed {@link KeyValueStore} that protects secret keys at
  * rest. It satisfies the synchronous store contract by caching the parsed file
  * in memory at construction and flushing the whole file atomically on every
  * mutation.
  *
+ * Encrypted keystores seal each secret in its own argon2id + XChaCha20-Poly1305
+ * envelope under one shared passphrase, and store a `verifier` sentinel so a
+ * candidate passphrase is checked before it is used (ADR 080): the first
+ * passphrase is established with a confirm prompt, and every later use is
+ * verified, so a typo is a loud failure rather than a key sealed under an
+ * unknown or divergent passphrase. Dev keystores (`protection: 'none'`) store
+ * secrets as plaintext and never prompt; they are refused for mainnet by the
+ * command layer.
+ *
  * Every mutation runs under an exclusive cross-process lock and, inside that
- * lock, reloads the file from disk before applying its change and flushing.
- * Caching at construction and flushing the whole file is otherwise a lost-update
- * race: two `btcr2` processes that each load, then each write, would have the
- * second overwrite the first. The lock serializes the writers and the reload
- * merges any change the other made, so concurrent invocations compose instead of
- * clobbering. Reads stay lock-free: an atomic rename means a concurrent reader
- * always sees a complete file, old or new.
+ * lock, reloads the file from disk before applying its change and flushing, so
+ * concurrent `btcr2` invocations compose instead of clobbering. Reads stay
+ * lock-free: an atomic rename means a concurrent reader always sees a complete
+ * file, old or new.
  *
  * Secrets are materialized only through {@link FileKeyStore.get}. The
  * {@link FileKeyStore.list} and {@link FileKeyStore.entries} projections omit
@@ -36,12 +62,17 @@ export class FileKeyStore {
     #argonParams;
     #cache = new Map();
     #active;
+    #protection;
+    #verifier;
     constructor(options) {
         this.#path = options.path ?? defaultKeystorePath();
         this.#lockPath = `${this.#path}.lock`;
         this.#lockOptions = options.lock ?? {};
         this.#getPassphrase = options.getPassphrase;
         this.#argonParams = options.argonParams ?? DEFAULT_ARGON_PARAMS;
+        // The requested mode applies only when establishing a fresh keystore; an
+        // existing file's on-disk protection overrides it in #loadFromDisk.
+        this.#protection = options.protection ?? 'passphrase';
         ensureDir(dirname(this.#path), 0o700);
         this.#loadFromDisk();
     }
@@ -59,7 +90,24 @@ export class FileKeyStore {
         if (parsed.v !== KEYSTORE_VERSION) {
             throw new KeyStoreError(`Unsupported keystore version: ${String(parsed.v)}.`, 'KEYSTORE_VERSION_ERROR', { version: parsed.v });
         }
+        // Every keystore this CLI writes carries a recognized protection header. A
+        // file without one was not written by this CLI (there is no pre-header
+        // format to accommodate); refuse it rather than guess how its secrets are
+        // protected.
+        if (parsed.protection !== 'none' && parsed.protection !== 'passphrase') {
+            throw new KeyStoreError(`Keystore at ${this.#path} has no recognized protection header; it was not written by this CLI.`, 'KEYSTORE_CORRUPT_ERROR', { path: this.#path });
+        }
+        this.#protection = parsed.protection;
+        this.#verifier = parsed.verifier;
         this.#active = parsed.active;
+        // An encrypted keystore that holds sealed keys must carry the verifier that
+        // established its passphrase. Without it, the verify-or-establish decision in
+        // #sealPassphrase could take the establish path over existing sealed keys and
+        // seal a new key under a divergent passphrase; refuse the file instead.
+        const sealedPresent = Object.values(parsed.keys ?? {}).some(k => k && typeof k === 'object' && k.secret !== undefined);
+        if (this.#protection === 'passphrase' && sealedPresent && this.#verifier === undefined) {
+            throw new KeyStoreError(`Keystore at ${this.#path} holds sealed keys but no passphrase verifier; it is corrupt or was tampered with.`, 'KEYSTORE_CORRUPT_ERROR', { path: this.#path });
+        }
         for (const [id, stored] of Object.entries(parsed.keys ?? {})) {
             let publicKey;
             try {
@@ -73,24 +121,61 @@ export class FileKeyStore {
             if (publicKey.length !== 33) {
                 throw new KeyStoreError(`Keystore entry ${id} has a ${publicKey.length}-byte public key; expected 33.`, 'KEYSTORE_CORRUPT_ERROR', { path: this.#path, keyId: id });
             }
-            this.#cache.set(id, {
-                publicKey,
-                ...(stored.tags && { tags: stored.tags }),
-                ...(stored.secret && { secret: stored.secret }),
-            });
+            const entry = { publicKey, ...(stored.tags && { tags: stored.tags }) };
+            // A secret's storage form must match the keystore's protection mode: a dev
+            // keystore holds plaintext, an encrypted keystore holds sealed envelopes. A
+            // mismatch is a tampered or foreign file, not something to open blindly.
+            if (stored.plainSecret !== undefined) {
+                if (this.#protection !== 'none') {
+                    throw new KeyStoreError(`Keystore entry ${id} holds a plaintext secret in an encrypted keystore at ${this.#path}.`, 'KEYSTORE_CORRUPT_ERROR', { path: this.#path, keyId: id });
+                }
+                entry.plaintext = true;
+                entry.decrypted = this.#decodePlainSecret(stored.plainSecret, id);
+            }
+            else if (stored.secret) {
+                if (this.#protection !== 'passphrase') {
+                    throw new KeyStoreError(`Keystore entry ${id} holds a sealed secret in a dev keystore at ${this.#path}.`, 'KEYSTORE_CORRUPT_ERROR', { path: this.#path, keyId: id });
+                }
+                entry.secret = stored.secret;
+            }
+            this.#cache.set(id, entry);
         }
     }
+    /** Decodes and length-checks a dev-keystore plaintext secret. */
+    #decodePlainSecret(encoded, id) {
+        let secret;
+        try {
+            secret = base64urlnopad.decode(encoded);
+        }
+        catch {
+            throw new KeyStoreError(`Keystore entry ${id} has a malformed plaintext secret.`, 'KEYSTORE_CORRUPT_ERROR', { path: this.#path, keyId: id });
+        }
+        if (secret.length !== 32) {
+            throw new KeyStoreError(`Keystore entry ${id} has a ${secret.length}-byte secret; expected 32.`, 'KEYSTORE_CORRUPT_ERROR', { path: this.#path, keyId: id });
+        }
+        return secret;
+    }
     #flush() {
         const keys = {};
         for (const [id, entry] of this.#cache) {
-            keys[id] = {
-                publicKey: base64urlnopad.encode(entry.publicKey),
-                ...(entry.tags && { tags: entry.tags }),
-                ...(entry.secret && { secret: entry.secret }),
-            };
+            const stored = { publicKey: base64urlnopad.encode(entry.publicKey) };
+            if (entry.tags)
+                stored.tags = entry.tags;
+            if (entry.plaintext && entry.decrypted) {
+                stored.plainSecret = base64urlnopad.encode(entry.decrypted);
+            }
+            else if (entry.secret) {
+                stored.secret = entry.secret;
+            }
+            keys[id] = stored;
         }
+        // Every keystore this CLI writes self-describes: the protection header is
+        // always present (`passphrase` for encrypted, `none` for dev), so a file is
+        // never ambiguous about how its secrets are protected.
         const file = {
             v: KEYSTORE_VERSION,
+            protection: this.#protection,
+            ...(this.#verifier && { verifier: this.#verifier }),
             ...(this.#active && { active: this.#active }),
             keys,
         };
@@ -101,7 +186,8 @@ export class FileKeyStore {
      * mutation applies on top of whatever other processes have written. Secrets
      * already decrypted this session are carried over for entries whose sealed
      * envelope is byte-identical on disk, so a mid-session write does not force a
-     * re-prompt for keys it did not touch.
+     * re-prompt for keys it did not touch. (Dev-keystore plaintext secrets are
+     * reloaded from disk, so they need no carry.)
      */
     #reload() {
         const carried = new Map();
@@ -133,6 +219,47 @@ export class FileKeyStore {
             this.#flush();
         }, this.#lockOptions);
     }
+    /**
+     * Verifies a candidate passphrase against the keystore verifier, throwing when
+     * it does not open the sentinel. A no-op only on a fresh keystore whose
+     * passphrase has not been established yet (no verifier to check against).
+     */
+    #assertPassphrase(passphrase) {
+        if (!this.#verifier)
+            return;
+        let plain;
+        try {
+            plain = decryptSecret(this.#verifier, passphrase);
+        }
+        catch {
+            throw new KeyStoreError(`Incorrect passphrase for the keystore at ${this.#path}.`, 'DECRYPT_ERROR', { path: this.#path });
+        }
+        if (!bytesEqual(plain, VERIFIER_PLAINTEXT)) {
+            throw new KeyStoreError(`Keystore verifier at ${this.#path} did not match; the file may be corrupt.`, 'KEYSTORE_CORRUPT_ERROR', { path: this.#path });
+        }
+    }
+    /** Passphrase for opening an existing secret: verified when a verifier exists. */
+    #openPassphrase() {
+        const passphrase = this.#getPassphrase();
+        this.#assertPassphrase(passphrase);
+        return passphrase;
+    }
+    /**
+     * Passphrase for sealing a secret. When the keystore's passphrase is already
+     * established (a verifier exists), prompt once and verify it. Otherwise this is
+     * establishment on a fresh keystore: prompt with confirm and mint a verifier for
+     * the caller to persist alongside the first sealed key.
+     */
+    #sealPassphrase() {
+        if (this.#verifier) {
+            const passphrase = this.#getPassphrase();
+            this.#assertPassphrase(passphrase);
+            return { passphrase };
+        }
+        const passphrase = this.#getPassphrase({ confirm: true });
+        const newVerifier = encryptSecret(VERIFIER_PLAINTEXT, passphrase, this.#argonParams);
+        return { passphrase, newVerifier };
+    }
     get(id) {
         const entry = this.#cache.get(id);
         if (!entry)
@@ -141,18 +268,26 @@ export class FileKeyStore {
             publicKey: entry.publicKey,
             ...(entry.tags && { tags: entry.tags }),
         };
-        if (entry.secret) {
-            // Materialize the secret lazily, only when it is actually accessed, so
-            // reads that need just public material (an active-key existence check,
-            // getPublicKey, getEntry) never trigger a passphrase prompt. The property
-            // is non-enumerable so spreading or serializing the entry cannot silently
-            // decrypt the secret.
+        if (entry.plaintext && entry.decrypted) {
+            // Dev keystore: plaintext already materialized; expose without a prompt.
+            const secret = entry.decrypted;
+            Object.defineProperty(result, 'secretKey', {
+                configurable: true,
+                enumerable: false,
+                get: () => secret,
+            });
+        }
+        else if (entry.secret) {
+            // Materialize the sealed secret lazily, only when it is actually accessed,
+            // so reads that need just public material never trigger a passphrase
+            // prompt. The property is non-enumerable so spreading or serializing the
+            // entry cannot silently decrypt the secret.
             const sealed = entry.secret;
             Object.defineProperty(result, 'secretKey', {
                 configurable: true,
                 enumerable: false,
                 get: () => {
-                    entry.decrypted ??= decryptSecret(sealed, this.#getPassphrase());
+                    entry.decrypted ??= decryptSecret(sealed, this.#openPassphrase());
                     return entry.decrypted;
                 },
             });
@@ -163,16 +298,55 @@ export class FileKeyStore {
         return this.#cache.has(id);
     }
     set(id, value) {
-        // Seal the secret before taking the lock: argon2id is deliberately slow and
-        // must not extend the critical section that blocks other processes.
-        const secret = value.secretKey
-            ? encryptSecret(value.secretKey, this.#getPassphrase(), this.#argonParams)
-            : undefined;
+        if (this.#protection === 'none') {
+            // Dev keystore: store the secret in the clear, never prompt.
+            this.#mutate(() => {
+                this.#cache.set(id, {
+                    publicKey: value.publicKey,
+                    ...(value.tags && { tags: value.tags }),
+                    ...(value.secretKey && { plaintext: true, decrypted: value.secretKey }),
+                });
+            });
+            return;
+        }
+        // Encrypted keystore. Resolve (and, if establishing, confirm) the passphrase
+        // and seal the secret before taking the lock: argon2id is deliberately slow
+        // and must not extend the critical section that blocks other processes.
+        const verifierAtSeal = this.#verifier;
+        let sealed;
+        let newVerifier;
+        let passphrase;
+        if (value.secretKey) {
+            const resolved = this.#sealPassphrase();
+            passphrase = resolved.passphrase;
+            newVerifier = resolved.newVerifier;
+            sealed = encryptSecret(value.secretKey, passphrase, this.#argonParams);
+        }
         this.#mutate(() => {
+            // A secret sealed outside the lock must never be persisted under a
+            // passphrase that diverges from the keystore verifier (the key-loss class
+            // ADR 080 exists to prevent). Reconcile our seal-time view with whatever the
+            // reload sees before committing.
+            if (value.secretKey) {
+                if (this.#verifier === undefined && newVerifier !== undefined) {
+                    // Establishing, and no concurrent writer beat us to it: record our verifier.
+                    this.#verifier = newVerifier;
+                }
+                else if (this.#verifier !== undefined && passphrase !== undefined) {
+                    // A verifier exists: it pre-existed, was established concurrently while we
+                    // sealed, or was rotated by a concurrent change-passphrase. If it was
+                    // rotated out from under our seal, abort with a clear message; otherwise
+                    // assert our passphrase still opens it before persisting the key.
+                    if (verifierAtSeal !== undefined && !sameEnvelope(this.#verifier, verifierAtSeal)) {
+                        throw new KeyStoreError(`The keystore passphrase at ${this.#path} changed concurrently; re-run the command.`, 'KEYSTORE_CONCURRENT_CHANGE_ERROR', { path: this.#path });
+                    }
+                    this.#assertPassphrase(passphrase);
+                }
+            }
             this.#cache.set(id, {
                 publicKey: value.publicKey,
                 ...(value.tags && { tags: value.tags }),
-                ...(secret && { secret }),
+                ...(sealed && { secret: sealed }),
                 ...(value.secretKey && { decrypted: value.secretKey }),
             });
         });
@@ -240,5 +414,139 @@ export class FileKeyStore {
             this.#active = id;
         });
     }
+    /** The keystore's protection mode. */
+    get protection() {
+        return this.#protection;
+    }
+    /**
+     * Re-seals every sealed secret and the verifier under a new passphrase (ADR
+     * 080), returning the number of secrets re-sealed. Verifies the current
+     * passphrase against the verifier first. Refused on a dev keystore, which has
+     * no passphrase.
+     */
+    changePassphrase(oldPassphrase, newPassphrase) {
+        if (this.#protection === 'none') {
+            throw new KeyStoreError(`The keystore at ${this.#path} is an unencrypted dev keystore; it has no passphrase to change.`, 'KEYSTORE_PROTECTION_ERROR', { path: this.#path });
+        }
+        // Fail a wrong current passphrase up front (when a verifier exists) so a typo
+        // does not pay for a full re-seal before failing.
+        if (this.#verifier)
+            this.#assertPassphrase(oldPassphrase);
+        // Precompute every re-seal and the new verifier BEFORE taking the lock:
+        // argon2id is deliberately slow, and holding the exclusive lock across many
+        // derivations could exceed the lock's stale threshold and let a concurrent
+        // process break a still-live lock. Each re-seal records the source envelope
+        // it derived from, so the locked section can abort on any concurrent change
+        // instead of corrupting. This follows the same do-expensive-work-before-the-
+        // lock contract as set().
+        const resealed = new Map();
+        for (const [id, entry] of this.#cache) {
+            if (!entry.secret)
+                continue;
+            let plain;
+            try {
+                plain = decryptSecret(entry.secret, oldPassphrase);
+            }
+            catch {
+                throw new KeyStoreError(`Incorrect current passphrase for the keystore at ${this.#path}.`, 'DECRYPT_ERROR', { path: this.#path });
+            }
+            resealed.set(id, { from: entry.secret, to: encryptSecret(plain, newPassphrase, this.#argonParams), plain });
+        }
+        const newVerifier = encryptSecret(VERIFIER_PLAINTEXT, newPassphrase, this.#argonParams);
+        let rekeyed = 0;
+        this.#mutate(() => {
+            // The reload reflects any concurrent writer. Apply a precomputed re-seal
+            // only where the on-disk envelope still matches what it was derived from;
+            // abort if any sealed key changed or a new sealed key appeared that was not
+            // re-sealed, rather than leave a key under the old passphrase.
+            for (const [id, entry] of this.#cache) {
+                if (!entry.secret)
+                    continue;
+                const pre = resealed.get(id);
+                if (!pre || !sameEnvelope(pre.from, entry.secret)) {
+                    throw new KeyStoreError(`The keystore at ${this.#path} changed while its passphrase was being changed; re-run the command.`, 'KEYSTORE_CONCURRENT_CHANGE_ERROR', { path: this.#path });
+                }
+                entry.secret = pre.to;
+                entry.decrypted = pre.plain;
+                rekeyed++;
+            }
+            this.#verifier = newVerifier;
+        });
+        return rekeyed;
+    }
+}
+/**
+ * Summarizes a keystore file by structure alone: protection mode, whether a
+ * passphrase is established, key count, and active key. Never decrypts, never
+ * prompts, and never throws (a missing or unreadable file reports `absent`), so
+ * it is safe for `keystore status`, `config path`, and the mainnet dev-keystore
+ * guard.
+ */
+export function keystoreSummary(path) {
+    const absent = { protection: 'absent', established: false, keyCount: 0, active: undefined };
+    if (!existsSync(path))
+        return absent;
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    catch {
+        return absent;
+    }
+    const keys = (parsed.keys && typeof parsed.keys === 'object') ? parsed.keys : {};
+    const keyCount = Object.keys(keys).length;
+    const active = typeof parsed.active === 'string' ? parsed.active : undefined;
+    if (parsed.protection === 'none') {
+        return { protection: 'dev', established: true, keyCount, active };
+    }
+    if (parsed.protection === 'passphrase') {
+        // An encrypted keystore is "established" once its passphrase verifier exists
+        // (written by `init` or the first key-seal). Without it the passphrase has not
+        // been set yet: a freshly-created, still-empty encrypted keystore.
+        return { protection: 'encrypted', established: parsed.verifier !== undefined, keyCount, active };
+    }
+    // No recognized protection header: not a keystore this CLI wrote. Report absent
+    // (never throw) so `keystore status` stays a safe, no-decrypt introspection; an
+    // actual open of such a file is refused by FileKeyStore.
+    return absent;
+}
+/** The protection label of a keystore file, without decrypting or prompting. */
+export function keystoreProtection(path) {
+    return keystoreSummary(path).protection;
+}
+/**
+ * Establishes a fresh keystore file (ADR 080). An encrypted keystore prompts
+ * (with confirm) for the passphrase and writes the verifier; a dev keystore
+ * writes a plaintext-mode header with no passphrase. The caller is responsible
+ * for refusing to overwrite an existing keystore; this always writes the file.
+ */
+export function initKeystore(path, options) {
+    ensureDir(dirname(path), 0o700);
+    let file;
+    if (options.protection === 'none') {
+        file = { v: KEYSTORE_VERSION, protection: 'none', keys: {} };
+    }
+    else {
+        const passphrase = options.getPassphrase({ confirm: true });
+        const verifier = encryptSecret(VERIFIER_PLAINTEXT, passphrase, options.argonParams ?? DEFAULT_ARGON_PARAMS);
+        file = { v: KEYSTORE_VERSION, protection: 'passphrase', verifier, keys: {} };
+    }
+    writeFileAtomic(path, `${JSON.stringify(file, null, 2)}\n`, 0o600);
+}
+/**
+ * Re-seals every secret in an encrypted keystore under a new passphrase (ADR
+ * 080), returning the count re-sealed. The old and new passphrases are supplied
+ * explicitly, so the store's own passphrase provider is never invoked (a wrong
+ * current passphrase is caught by the verifier). Refused on a dev keystore.
+ */
+export function changeKeystorePassphrase(path, oldPassphrase, newPassphrase, argonParams) {
+    const store = new FileKeyStore({
+        path,
+        ...(argonParams && { argonParams }),
+        getPassphrase: () => {
+            throw new KeyStoreError(`Unexpected passphrase prompt while changing the passphrase for ${path}.`, 'KEYSTORE_INTERNAL_ERROR', { path });
+        },
+    });
+    return store.changePassphrase(oldPassphrase, newPassphrase);
 }
 //# sourceMappingURL=file-key-store.js.map

package/dist/esm/src/keystore/file-key-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-key-store.js","sourceRoot":"","sources":["../../../../src/keystore/file-key-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAoB,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,oDAAoD;AACpD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAU,CAAC;AAoC3C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,YAAY;IACd,KAAK,CAAS;IACd,SAAS,CAAS;IAClB,YAAY,CAAc;IAC1B,cAAc,CAAe;IAC7B,YAAY,CAAc;IAC1B,MAAM,GAAmC,IAAI,GAAG,EAAE,CAAC;IAC5D,OAAO,CAAqB;IAE5B,YAAY,OAA4B;QACtC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,GAAG,IAAI,CAAC,KAAK,OAAO,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAChE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAED,aAAa;QACX,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO;QACpC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAiB,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,aAAa,CACrB,eAAe,IAAI,CAAC,KAAK,4BAA4B,EACrD,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC;YAClC,MAAM,IAAI,aAAa,CACrB,iCAAiC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EACpD,wBAAwB,EACxB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,KAAK,MAAM,CAAE,EAAE,EAAE,MAAM,CAAE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,SAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBAC/E,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,8BAA8B,EAClD,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;YACJ,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC5B,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,UAAU,SAAS,CAAC,MAAM,gCAAgC,EAC9E,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;gBAClB,SAAS;gBACT,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM;QACJ,MAAM,IAAI,GAA8B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,EAAE,CAAC,GAAG;gBACT,SAAS,EAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;gBAClD,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACvC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;aAC9C,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAiB;YACzB,CAAC,EAAG,gBAAgB;YACpB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7C,IAAI;SACL,CAAC;QACF,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoE,CAAC;QAC5F,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,OAAO,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnF,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,KAAiB;QACvB,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YAChC,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,KAAK,EAAE,CAAC;YACR,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACxB,CAAC;IAED,GAAG,CAAC,EAAiB;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,MAAM,GAAa;YACvB,SAAS,EAAG,KAAK,CAAC,SAAS;YAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SACxC,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,uEAAuE;YACvE,uEAAuE;YACvE,0EAA0E;YAC1E,0EAA0E;YAC1E,sBAAsB;YACtB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC5B,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE;gBACzC,YAAY,EAAG,IAAI;gBACnB,UAAU,EAAK,KAAK;gBACpB,GAAG,EAAY,GAAe,EAAE;oBAC9B,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;oBACjE,OAAO,KAAK,CAAC,SAAS,CAAC;gBACzB,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,GAAG,CAAC,EAAiB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,GAAG,CAAC,EAAiB,EAAE,KAAe;QACpC,4EAA4E;QAC5E,oEAAoE;QACpE,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS;YAC5B,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC;YAC1E,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;gBAClB,SAAS,EAAG,KAAK,CAAC,SAAS;gBAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACvC,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC;gBACzB,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,EAAiB;QACtB,4EAA4E;QAC5E,8EAA8E;QAC9E,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE;gBAAE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC/D,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACjF,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAE,AAAD,EAAG,KAAK,CAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,MAAM,GAAG,GAAqC,EAAE,CAAC;QACjD,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,CAAE,EAAE,EAAE;oBACb,SAAS,EAAG,KAAK,CAAC,SAAS;oBAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;iBACxC,CAAE,CAAC,CAAC;QACP,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK;QACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,wEAAwE;IACxE,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,EAA6B;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,wEAAwE;YACxE,0DAA0D;YAC1D,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,aAAa,CAAC,qCAAqC,EAAE,GAAG,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC5G,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"file-key-store.js","sourceRoot":"","sources":["../../../../src/keystore/file-key-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAoB,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,oDAAoD;AACpD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAU,CAAC;AAW3C;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,WAAW,CAAC,gCAAgC,CAAC,CAAC;AAEzE,0EAA0E;AAC1E,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,iFAAiF;AACjF,SAAS,YAAY,CAAC,CAA6B,EAAE,CAA6B;IAChF,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AA0DD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,YAAY;IACd,KAAK,CAAS;IACd,SAAS,CAAS;IAClB,YAAY,CAAc;IAC1B,cAAc,CAA2C;IACzD,YAAY,CAAc;IAC1B,MAAM,GAAmC,IAAI,GAAG,EAAE,CAAC;IAC5D,OAAO,CAAqB;IAC5B,WAAW,CAAqB;IAChC,SAAS,CAA6B;IAEtC,YAAY,OAA4B;QACtC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,GAAG,IAAI,CAAC,KAAK,OAAO,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAChE,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;QACtD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAED,aAAa;QACX,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO;QACpC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAiB,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,aAAa,CACrB,eAAe,IAAI,CAAC,KAAK,4BAA4B,EACrD,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC;YAClC,MAAM,IAAI,aAAa,CACrB,iCAAiC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EACpD,wBAAwB,EACxB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CACtB,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,uEAAuE;QACvE,0EAA0E;QAC1E,aAAa;QACb,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;YACvE,MAAM,IAAI,aAAa,CACrB,eAAe,IAAI,CAAC,KAAK,uEAAuE,EAChG,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,4EAA4E;QAC5E,8EAA8E;QAC9E,8EAA8E;QAC9E,wEAAwE;QACxE,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CACzD,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAe,CAAC,MAAM,KAAK,SAAS,CACzE,CAAC;QACF,IAAI,IAAI,CAAC,WAAW,KAAK,YAAY,IAAI,aAAa,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvF,MAAM,IAAI,aAAa,CACrB,eAAe,IAAI,CAAC,KAAK,oFAAoF,EAC7G,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAE,EAAE,EAAE,MAAM,CAAE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,SAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBAC/E,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,8BAA8B,EAClD,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;YACJ,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC5B,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,UAAU,SAAS,CAAC,MAAM,gCAAgC,EAC9E,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAe,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACnF,2EAA2E;YAC3E,4EAA4E;YAC5E,yEAAyE;YACzE,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACrC,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;oBAChC,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,yDAAyD,IAAI,CAAC,KAAK,GAAG,EAC1F,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;gBACJ,CAAC;gBACD,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;gBACvB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACpE,CAAC;iBAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;oBACtC,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,+CAA+C,IAAI,CAAC,KAAK,GAAG,EAChF,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;gBACJ,CAAC;gBACD,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,kBAAkB,CAAC,OAAe,EAAE,EAAiB;QACnD,IAAI,MAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,oCAAoC,EACxD,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAAE,UAAU,MAAM,CAAC,MAAM,4BAA4B,EACvE,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAChC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM;QACJ,MAAM,IAAI,GAA8B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,MAAM,GAAc,EAAE,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAChF,IAAI,KAAK,CAAC,IAAI;gBAAE,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACzC,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACvC,MAAM,CAAC,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC9D,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxB,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC/B,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC;QACpB,CAAC;QACD,0EAA0E;QAC1E,4EAA4E;QAC5E,uDAAuD;QACvD,MAAM,IAAI,GAAiB;YACzB,CAAC,EAAY,gBAAgB;YAC7B,UAAU,EAAG,IAAI,CAAC,WAAW;YAC7B,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YACnD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7C,IAAI;SACL,CAAC;QACF,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;OAOG;IACH,OAAO;QACL,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoE,CAAC;QAC5F,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,OAAO,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnF,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,KAAiB;QACvB,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YAChC,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,KAAK,EAAE,CAAC;YACR,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,UAAkB;QAClC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5B,IAAI,KAAiB,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,aAAa,CACrB,4CAA4C,IAAI,CAAC,KAAK,GAAG,EACzD,eAAe,EACf,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,aAAa,CACrB,wBAAwB,IAAI,CAAC,KAAK,0CAA0C,EAC5E,wBAAwB,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,eAAe;QACb,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACzC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACnC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,eAAe;QACb,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACzC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACnC,OAAO,EAAE,UAAU,EAAE,CAAC;QACxB,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,aAAa,CAAC,kBAAkB,EAAE,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACrF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IACrC,CAAC;IAED,GAAG,CAAC,EAAiB;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,MAAM,GAAa;YACvB,SAAS,EAAG,KAAK,CAAC,SAAS;YAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SACxC,CAAC;QACF,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACvC,yEAAyE;YACzE,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC;YAC/B,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE;gBACzC,YAAY,EAAG,IAAI;gBACnB,UAAU,EAAK,KAAK;gBACpB,GAAG,EAAY,GAAe,EAAE,CAAC,MAAM;aACxC,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACxB,2EAA2E;YAC3E,qEAAqE;YACrE,yEAAyE;YACzE,4CAA4C;YAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC5B,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE;gBACzC,YAAY,EAAG,IAAI;gBACnB,UAAU,EAAK,KAAK;gBACpB,GAAG,EAAY,GAAe,EAAE;oBAC9B,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;oBAClE,OAAO,KAAK,CAAC,SAAS,CAAC;gBACzB,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,GAAG,CAAC,EAAiB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,GAAG,CAAC,EAAiB,EAAE,KAAe;QACpC,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;YAChC,6DAA6D;YAC7D,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;gBAChB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;oBAClB,SAAS,EAAG,KAAK,CAAC,SAAS;oBAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;oBACvC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;iBACxE,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,6EAA6E;QAC7E,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;QACtC,IAAI,MAAkC,CAAC;QACvC,IAAI,WAAuC,CAAC;QAC5C,IAAI,UAA8B,CAAC;QACnC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACxC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;YACjC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;YACnC,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,mEAAmE;YACnE,0EAA0E;YAC1E,6EAA6E;YAC7E,iCAAiC;YACjC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC9D,6EAA6E;oBAC7E,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC;gBAC/B,CAAC;qBAAM,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBACpE,2EAA2E;oBAC3E,sEAAsE;oBACtE,yEAAyE;oBACzE,kEAAkE;oBAClE,IAAI,cAAc,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC;wBAClF,MAAM,IAAI,aAAa,CACrB,8BAA8B,IAAI,CAAC,KAAK,4CAA4C,EACpF,kCAAkC,EAClC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;oBACJ,CAAC;oBACD,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;gBAClB,SAAS,EAAG,KAAK,CAAC,SAAS;gBAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACvC,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACjC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,EAAiB;QACtB,4EAA4E;QAC5E,8EAA8E;QAC9E,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE;gBAAE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC/D,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACjF,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAE,AAAD,EAAG,KAAK,CAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,MAAM,GAAG,GAAqC,EAAE,CAAC;QACjD,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,CAAE,EAAE,EAAE;oBACb,SAAS,EAAG,KAAK,CAAC,SAAS;oBAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;iBACxC,CAAE,CAAC,CAAC;QACP,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK;QACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,wEAAwE;IACxE,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,EAA6B;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,wEAAwE;YACxE,0DAA0D;YAC1D,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,aAAa,CAAC,qCAAqC,EAAE,GAAG,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC5G,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,sCAAsC;IACtC,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,aAAqB,EAAE,aAAqB;QAC3D,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,aAAa,CACrB,mBAAmB,IAAI,CAAC,KAAK,kEAAkE,EAC/F,2BAA2B,EAC3B,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;QACJ,CAAC;QACD,8EAA8E;QAC9E,kDAAkD;QAClD,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAC1D,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,6EAA6E;QAC7E,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkF,CAAC;QAC3G,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,SAAS;YAC5B,IAAI,KAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,aAAa,CACrB,oDAAoD,IAAI,CAAC,KAAK,GAAG,EACjE,eAAe,EACf,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,aAAa,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,WAAW,GAAG,aAAa,CAAC,kBAAkB,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACxF,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,yEAAyE;YACzE,0EAA0E;YAC1E,4EAA4E;YAC5E,+DAA+D;YAC/D,KAAK,MAAM,CAAE,EAAE,EAAE,KAAK,CAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACxC,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,SAAS;gBAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7B,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClD,MAAM,IAAI,aAAa,CACrB,mBAAmB,IAAI,CAAC,KAAK,sEAAsE,EACnG,kCAAkC,EAClC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CACrB,CAAC;gBACJ,CAAC;gBACD,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAUD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,MAAM,GAAoB,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC7G,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAiB,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7E,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QACvC,6EAA6E;QAC7E,+EAA+E;QAC/E,mEAAmE;QACnE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnG,CAAC;IACD,gFAAgF;IAChF,gFAAgF;IAChF,yDAAyD;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;AAC1C,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAA4B;IACrE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAChC,IAAI,IAAkB,CAAC;IACvB,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QAClC,IAAI,GAAG,EAAE,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,aAAa,CAAC,kBAAkB,EAAE,UAAU,EAAE,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;QAC5G,IAAI,GAAG,EAAE,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC/E,CAAC;IACD,eAAe,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAsB,EACtB,aAAsB,EACtB,aAAsB,EACtB,WAA2B;IAE3B,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC;QAC7B,IAAI;QACJ,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;QACnC,aAAa,EAAG,GAAG,EAAE;YACnB,MAAM,IAAI,aAAa,CACrB,kEAAkE,IAAI,GAAG,EACzE,yBAAyB,EACzB,EAAE,IAAI,EAAE,CACT,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,gBAAgB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AAC9D,CAAC"}

package/dist/esm/src/keystore/passphrase.js

@@ -7,16 +7,19 @@ export const ENV_KEYSTORE_PASSPHRASE = 'BTCR2_KEYSTORE_PASSPHRASE';
  * (which would leak into process listings and shell history). Resolution order:
  * the {@link ENV_KEYSTORE_PASSPHRASE} environment variable, a passphrase file,
  * then a non-echoing terminal prompt. Throws if none is available and standard
- * input is not a terminal.
+ * input is not a terminal. When `forcePrompt` is set, the env var and file are
+ * skipped and a terminal entry is required.
  */
 export function acquirePassphrase(options = {}) {
     // All sources are normalized identically (at most one trailing newline
     // removed) so the KDF input is source-independent.
-    const fromEnv = process.env[ENV_KEYSTORE_PASSPHRASE];
-    if (fromEnv)
-        return assertNonEmpty(fromEnv.replace(/\r?\n$/, ''));
-    if (options.passphraseFile) {
-        return assertNonEmpty(readFileSync(options.passphraseFile, 'utf-8').replace(/\r?\n$/, ''));
+    if (!options.forcePrompt) {
+        const fromEnv = process.env[ENV_KEYSTORE_PASSPHRASE];
+        if (fromEnv)
+            return assertNonEmpty(fromEnv.replace(/\r?\n$/, ''));
+        if (options.passphraseFile) {
+            return assertNonEmpty(readFileSync(options.passphraseFile, 'utf-8').replace(/\r?\n$/, ''));
+        }
     }
     if (!process.stdin.isTTY) {
         throw new KeyStoreError(`No passphrase available. Set ${ENV_KEYSTORE_PASSPHRASE}, pass --passphrase-file, or run in a terminal.`, 'PASSPHRASE_REQUIRED_ERROR');
@@ -37,9 +40,32 @@ function assertNonEmpty(passphrase) {
     }
     return passphrase;
 }
+/**
+ * A 4-byte shared buffer used only as an {@link Atomics.wait} target. It lets
+ * {@link promptHidden} block briefly on an empty non-blocking TTY instead of
+ * busy-spinning. It is never written to, so the wait always times out.
+ */
+const IDLE_WAIT = new Int32Array(new SharedArrayBuffer(4));
+/**
+ * Milliseconds to block on each empty read. Imperceptible to a typist yet long
+ * enough that an open prompt sits idle rather than pegging a CPU core.
+ */
+const IDLE_POLL_MS = 20;
+/**
+ * Removes the last whole UTF-8 character from an accumulating byte array in
+ * place: pops any trailing continuation bytes (0b10xxxxxx) then the leading
+ * byte. Exported for testing; a backspace mid-entry must not strand a fragment
+ * that later decodes to U+FFFD.
+ */
+export function dropLastUtf8Char(bytes) {
+    while (bytes.length > 0 && (bytes[bytes.length - 1] & 0xc0) === 0x80)
+        bytes.pop();
+    bytes.pop();
+}
 /**
  * Reads a line from the terminal synchronously without echoing keystrokes.
- * Bytes are accumulated and decoded as UTF-8 so multibyte passphrases survive.
+ * Bytes are accumulated and decoded as UTF-8 so multibyte passphrases survive,
+ * including a backspace that spans a whole multibyte character.
  * This path runs only when standard input is a terminal.
  */
 function promptHidden(label) {
@@ -57,8 +83,12 @@ function promptHidden(label) {
             }
             catch (error) {
                 const code = error.code;
-                if (code === 'EAGAIN')
-                    continue; // no byte ready yet on a non-blocking TTY
+                if (code === 'EAGAIN') {
+                    // No byte ready yet on a non-blocking TTY. Block briefly instead of
+                    // spinning so an open prompt does not peg a CPU core while it waits.
+                    Atomics.wait(IDLE_WAIT, 0, 0, IDLE_POLL_MS);
+                    continue;
+                }
                 if (code === 'EOF')
                     break;
                 throw error;
@@ -72,7 +102,7 @@ function promptHidden(label) {
                 throw new KeyStoreError('Passphrase entry aborted.', 'PASSPHRASE_REQUIRED_ERROR');
             }
             if (ch === 0x7f || ch === 0x08) { // DEL or backspace
-                bytes.pop();
+                dropLastUtf8Char(bytes);
                 continue;
             }
             bytes.push(ch);

package/dist/esm/src/keystore/passphrase.js.map

@@ -1 +1 @@
-{"version":3,"file":"passphrase.js","sourceRoot":"","sources":["../../../../src/keystore/passphrase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,qFAAqF;AACrF,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAYnE;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA6B,EAAE;IAC/D,uEAAuE;IACvE,mDAAmD;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrD,IAAI,OAAO;QAAE,OAAO,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;IAElE,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,OAAO,cAAc,CAAC,YAAY,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,aAAa,CACrB,gCAAgC,uBAAuB,iDAAiD,EACxG,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,IAAI,uBAAuB,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;QACnD,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,aAAa,CAAC,4BAA4B,EAAE,2BAA2B,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAED,wGAAwG;AACxG,SAAS,cAAc,CAAC,UAAkB;IACxC,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,aAAa,CAAC,8CAA8C,EAAE,2BAA2B,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,SAAS,CAAC;YACR,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,IAAI,CAAC;gBACH,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;gBAC/C,IAAI,IAAI,KAAK,QAAQ;oBAAE,SAAS,CAAC,0CAA0C;gBAC3E,IAAI,IAAI,KAAK,KAAK;oBAAE,MAAM;gBAC1B,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,IAAI,KAAK,CAAC;gBAAE,MAAM;YACtB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI;gBAAE,MAAM,CAAC,yBAAyB;YAChE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,gBAAgB;gBACjC,MAAM,IAAI,aAAa,CAAC,2BAA2B,EAAE,2BAA2B,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,mBAAmB;gBACnD,KAAK,CAAC,GAAG,EAAE,CAAC;gBACZ,SAAS;YACX,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"passphrase.js","sourceRoot":"","sources":["../../../../src/keystore/passphrase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,qFAAqF;AACrF,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAmBnE;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA6B,EAAE;IAC/D,uEAAuE;IACvE,mDAAmD;IACnD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACrD,IAAI,OAAO;YAAE,OAAO,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QAElE,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,OAAO,cAAc,CAAC,YAAY,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,aAAa,CACrB,gCAAgC,uBAAuB,iDAAiD,EACxG,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,IAAI,uBAAuB,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;QACnD,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,aAAa,CAAC,4BAA4B,EAAE,2BAA2B,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAED,wGAAwG;AACxG,SAAS,cAAc,CAAC,UAAkB;IACxC,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,aAAa,CAAC,8CAA8C,EAAE,2BAA2B,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAe;IAC9C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAClF,KAAK,CAAC,GAAG,EAAE,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,SAAS,CAAC;YACR,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,IAAI,CAAC;gBACH,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;gBAC/C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,oEAAoE;oBACpE,qEAAqE;oBACrE,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;oBAC5C,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,KAAK,KAAK;oBAAE,MAAM;gBAC1B,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,IAAI,KAAK,CAAC;gBAAE,MAAM;YACtB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI;gBAAE,MAAM,CAAC,yBAAyB;YAChE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,gBAAgB;gBACjC,MAAM,IAAI,aAAa,CAAC,2BAA2B,EAAE,2BAA2B,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,mBAAmB;gBACnD,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC"}