@fgv/ts-extras 5.1.0-41 → 5.1.0-43

package/dist/packlets/crypto-utils/keystore/keyStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"keyStore.js","sourceRoot":"","sources":["../../../../src/packlets/crypto-utils/keystore/keyStore.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,gFAAgF;AAChF,YAAY;AAGZ,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,IAAI,EAAU,OAAO,EAAE,MAAM,eAAe,CAAC;AACzF,OAAO,KAAK,SAAS,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAA2B,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAC5F,OAAO,EASL,kBAAkB,EAGnB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EAoBzB,eAAe,EAGf,eAAe,EAChB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAEnE;;GAEG;AACH,SAAS,mBAAmB;IAC1B,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,6EAA6E;AAC7E,gFAAgF;AAChF,8EAA8E;AAC9E,qDAAqD;AACrD,MAAM,kBAAkB,GAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAErF,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,OAAO,QAAQ;IAWnB,YACE,cAA+B,EAC/B,UAAkB,EAClB,YAAuC,EACvC,KAAc,EACd,iBAAiD;QAEjD,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACtC,IAAI,CAAC,kBAAkB,GAAG,iBAAiB,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;QAC9B,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,+EAA+E;IAC/E,kBAAkB;IAClB,+EAA+E;IAE/E;;;;;;OAMG;IACI,MAAM,CAAC,MAAM,CAAC,MAA6B;;QAChD,MAAM,UAAU,GAAG,MAAA,MAAM,CAAC,UAAU,mCAAI,2BAA2B,CAAC;QACpE,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,OAAO,CACZ,IAAI,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAC3F,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,IAAI,CAAC,MAA2B;QAC5C,2BAA2B;QAC3B,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,2BAA2B,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC;QAC7D,OAAO,OAAO,CACZ,IAAI,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,CAAC,CACnG,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,oBAAoB;IACpB,+EAA+E;IAE/E;;;;;;;OAOG;IACI,KAAK,CAAC,UAAU,CAAC,QAAgB;QACtC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,8DAA8D,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QAED,yDAAyD;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC7E,yFAAyF;QACzF,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,4BAA4B,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,8BAA8B;QAElD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,MAAM,CAAC,QAAgB;QAClC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,0DAA0D,CAAC,CAAC;QAC1E,CAAC;QACD,8EAA8E;QAC9E,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC;QACvD,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACvE,6EAA6E;QAC7E,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,mCAAmC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC;QAE9B,+BAA+B;QAC/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;QACjG,6EAA6E;QAC7E,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,0BAA0B,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,aAAa,CAAC,UAAsB;QAC/C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,0DAA0D,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,gBAAgB,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,eAAe,SAAS,CAAC,gBAAgB,eAAe,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,yGAAyG;QACzG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACI,IAAI,CAAC,KAAe;QACzB,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,6DAA6D,CAAC,CAAC;QAC7E,CAAC;QAED,qDAAqD;QACrD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;oBACxC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QAEpB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,IAAW,UAAU;QACnB,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,IAAW,OAAO;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACH,IAAW,KAAK;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,IAAW,KAAK;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACH,IAAW,cAAc;QACvB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,+EAA+E;IAC/E,oBAAoB;IACpB,+EAA+E;IAE/E;;;;OAIG;IACI,WAAW;QAChB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,SAAS,CAAC,IAAY;QAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAED;;;;;;;OAOG;IACI,eAAe,CAAC,IAAY;QACjC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,WAAW,IAAI,yCAAyC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACI,SAAS,CAAC,IAAY;QAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAA2B;QAC9D,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QAED,4BAA4B;QAC5B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC3D,yFAAyF;QACzF,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,2BAA2B,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,KAAK,GAA4B;YACrC,IAAI;YACJ,IAAI,EAAE,gBAAgB;YACtB,GAAG,EAAE,SAAS,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW;YACjC,SAAS,EAAE,mBAAmB,EAAE;SACjC,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,YAAY,CACvB,IAAY,EACZ,GAAe,EACf,OAA2B;;QAE3B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,gBAAgB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,eAAe,SAAS,CAAC,gBAAgB,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAA,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,WAAW,IAAI,kDAAkD,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,KAAK,GAA4B;YACrC,IAAI;YACJ,IAAI,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,mCAAI,gBAAgB;YACvC,GAAG,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,wCAAwC;YAClE,WAAW,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW;YACjC,SAAS,EAAE,mBAAmB,EAAE;SACjC,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,qBAAqB,CAChC,IAAY,EACZ,QAAgB,EAChB,OAAuC;;QAEvC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAA,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,WAAW,IAAI,kDAAkD,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,UAAU,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,mCAAI,yBAAyB,CAAC;QAEpE,0DAA0D;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC7E,yFAAyF;QACzF,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,4BAA4B,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,+BAA+B;QAC/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC/F,yFAAyF;QACzF,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,0BAA0B,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,KAAK,GAA4B;YACrC,IAAI;YACJ,IAAI,EAAE,gBAAgB;YACtB,GAAG,EAAE,SAAS,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW;YACjC,SAAS,EAAE,mBAAmB,EAAE;SACjC,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,OAAO,OAAO,CAAC;YACb,KAAK;YACL,QAAQ,EAAE,QAAQ,KAAK,SAAS;YAChC,OAAO;YACP,aAAa,EAAE;gBACb,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;gBACrD,UAAU;aACX;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACI,KAAK,CAAC,wBAAwB,CACnC,IAAY,EACZ,QAAgB,EAChB,aAAmC;QAEnC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,oBAAoB,aAAa,CAAC,GAAG,uBAAuB,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,WAAW,IAAI,wDAAwD,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,iBAAiB,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CACxD,QAAQ,EACR,UAAU,CAAC,KAAK,EAChB,aAAa,CAAC,UAAU,CACzB,CAAC;QACF,mFAAmF;QACnF,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,0BAA0B,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,KAAK,CAAC,6BAA6B,CACxC,IAAY,EACZ,QAAgB,EAChB,gBAAmC,EACnC,OAA+C;;QAE/C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAA,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,WAAW,IAAI,kDAAkD,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,MAAM,GAAoB,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,kBAAkB,CAAC;QAEtE,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC7E,yFAAyF;QACzF,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,4BAA4B,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtF,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,mCAAmC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,gBAAgB,EAAE,CAAC;YAC1D,OAAO,IAAI,CACT,gCAAgC,SAAS,CAAC,gBAAgB,8BAA8B,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CACjH,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAA4B;YACrC,IAAI;YACJ,IAAI,EAAE,gBAAgB;YACtB,GAAG,EAAE,SAAS,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW;YACjC,SAAS,EAAE,mBAAmB,EAAE;SACjC,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,MAAM,aAAa,GAAiC;YAClD,GAAG,EAAE,UAAU;YACf,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;YACrD,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC;QAEF,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,gCAAgC,CAC3C,IAAY,EACZ,QAAgB,EAChB,gBAAmC,EACnC,aAA2C;QAE3C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,WAAW,IAAI,wDAAwD,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,iBAAiB,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,MAAM,GAAoB;YAC9B,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,UAAU,EAAE,aAAa,CAAC,UAAU;YACpC,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;SAC9B,CAAC;QAEF,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1F,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,mCAAmC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,YAAY,CAAC,IAAY;QACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC;QAC5C,CAAC;QAED,qEAAqE;QACrE,wCAAwC;QACxC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,YAAY,CACvB,IAAY,EACZ,MAAc,EACd,OAA8B;QAE9B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAA,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,WAAW,IAAI,kDAAkD,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,KAAK,GAA4B;YACrC,IAAI;YACJ,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YAC3B,WAAW,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW;YACjC,SAAS,EAAE,mBAAmB,EAAE;SACjC,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;OAMG;IACI,SAAS,CAAC,IAAY;QAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,WAAW,IAAI,8BAA8B,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,+EAA+E;IAC/E,gCAAgC;IAChC,+EAA+E;IAE/E;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACI,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,OAA2B;;QAC/D,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,WAAW,IAAI,kDAAkD,CAAC,CAAC;QACjF,CAAC;QAED,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,sEAAsE;QACtE,kEAAkE;QAClE,4BAA4B;QAC5B,MAAM,kBAAkB,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC;QAC3E,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,IAAI,kBAAkB,EAAE,CAAC;YACxD,OAAO,IAAI,CACT,8CAA8C,IAAI,0DAA0D,CAC7G,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,mBAAmB;QACnB,MAAM,eAAe,GAAG,MAAA,OAAO,CAAC,WAAW,mCAAI,kBAAkB,CAAC;QAElE,0EAA0E;QAC1E,qEAAqE;QACrE,oEAAoE;QACpE,0CAA0C;QAC1C,MAAM,mBAAmB,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC;QAC7E,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACzG,6HAA6H;QAC7H,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,mCAAmC,IAAI,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC;QAEtD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC3E,8FAA8F;QAC9F,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,oCAAoC,IAAI,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,mEAAmE;QACnE,oEAAoE;QACpE,4EAA4E;QAC5E,wEAAwE;QACxE,0EAA0E;QAC1E,oEAAoE;QACpE,yEAAyE;QACzE,IAAI,qBAA6C,CAAC;QAClD,IAAI,UAAU,GAAc,UAAU,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC5B,oEAAoE;YACpE,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,MAAM,gBAAgB,GAAG,MAAM,CAC7B,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,CAClD,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,EAA+D,EAAE;gBACzF,IAAI,eAAe,EAAE,CAAC;oBACpB,OAAO,OAAO,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;gBAClD,CAAC;gBACD,OAAO,CAAC,MAAM,IAAI,CAAC,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;qBACzE,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,8CAA8C,IAAI,MAAM,GAAG,EAAE,CAAC;qBACvF,SAAS,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;YACH,gUAAgU;YAChU,IAAI,gBAAgB,CAAC,SAAS,EAAE,EAAE,CAAC;gBACjC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACxC,CAAC;YACD,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,wFAAwF;QACxF,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,kCAAkC,IAAI,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;QAE1B,0EAA0E;QAC1E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACxE,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,sCAAsC,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,KAAK,GAA6B;YACtC,IAAI;YACJ,IAAI,EAAE,oBAAoB;YAC1B,EAAE;YACF,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,YAAY,EAAE,SAAS,CAAC,KAAK;YAC7B,qBAAqB;YACrB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,mBAAmB,EAAE;SACjC,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACI,KAAK,CAAC,UAAU,CACrB,IAAY,EACZ,OAA4B;QAE5B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,WAAW,IAAI,yCAAyC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,CAAC,MAAM,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CACtG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;aACjF,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,uCAAuC,IAAI,MAAM,GAAG,EAAE,CAAC;aAChF,SAAS,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAChE,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,iBAAiB,CAAC,IAAwB;QAC/C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAED;;;;;;OAMG;IACI,YAAY,CAAC,OAAe,EAAE,OAAe;QAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,OAAO,aAAa,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC,WAAW,OAAO,kBAAkB,CAAC,CAAC;QACpD,CAAC;QAED,oEAAoE;QACpE,4DAA4D;QAC5D,MAAM,QAAQ,mCACT,KAAK,KACR,IAAI,EAAE,OAAO,GACd,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAED,+EAA+E;IAC/E,cAAc;IACd,+EAA+E;IAE/E;;;;;;OAMG;IACI,KAAK,CAAC,IAAI,CAAC,QAAgB;QAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QAED,4BAA4B;QAC5B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/F,yFAAyF;QACzF,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,0BAA0B,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,WAAW,CAAC,UAAsB;QAC7C,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,gBAAgB,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,eAAe,SAAS,CAAC,gBAAgB,eAAe,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,cAAc,CAAC,eAAuB,EAAE,WAAmB;QACtE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC9C,CAAC;QAED,6DAA6D;QAC7D,mEAAmE;QACnE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAC1F,6EAA6E;YAC7E,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,mCAAmC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CACpD,eAAe,EACf,UAAU,CAAC,KAAK,EAChB,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,UAAU,CAC5C,CAAC;YACF,6EAA6E;YAC7E,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,0BAA0B,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,oCAAoC;YACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAClF,MAAM,mBAAmB,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;YAE9F,6EAA6E;YAC7E,IAAI,QAAQ,CAAC,SAAS,EAAE,IAAI,aAAa,CAAC,SAAS,EAAE,IAAI,mBAAmB,CAAC,SAAS,EAAE,EAAE,CAAC;gBACzF,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC/C,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CACtD,mBAAmB,CAAC,KAAK,EACzB,SAAS,CAAC,KAAK,EACf,QAAQ,CAAC,KAAK,EACd,aAAa,CAAC,KAAK,CACpB,CAAC;YACF,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC7E,yFAAyF;QACzF,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,4BAA4B,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,yBAAyB;QACzB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChD,6EAA6E;QAC7E,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,+EAA+E;IAC/E,sBAAsB;IACtB,+EAA+E;IAE/E,sDAAsD;IAC/C,KAAK,CAAC,aAAa,CACxB,UAAkB,EAClB,OAAkB,EAClB,QAAoB;QAEpB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,kBAAkB,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACrD,OAAO,IAAI,CACT,0BAA0B,UAAU,wDAAwD,CAC7F,CAAC;QACJ,CAAC;QAED,OAAO,mBAAmB,CAAC;YACzB,OAAO;YACP,UAAU;YACV,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG;YAC3B,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,qCAAqC;IACrC,+EAA+E;IAE/E;;;;;OAKG;IACI,iBAAiB;QACtB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,MAAM,QAAQ,GAAmB,KAAK,EAAE,UAAkB,EAA+B,EAAE;YACzF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,WAAW,UAAU,0BAA0B,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC,WAAW,UAAU,wDAAwD,CAAC,CAAC;YAC7F,CAAC;YACD,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC,CAAC;QAEF,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACI,mBAAmB;QACxB,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAChD,IAAI,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,OAAO,CAAC;YACb,cAAc,EAAE,cAAc,CAAC,KAAK;YACpC,cAAc,EAAE,IAAI,CAAC,eAAe;SACrC,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,yCAAyC;IACzC,+EAA+E;IAE/E;;;OAGG;IACK,KAAK,CAAC,aAAa,CAAC,UAAsB;QAChD,6DAA6D;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAS,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAM,CAAC;QAEzB,uBAAuB;QACvB,MAAM,aAAa,GAAuC,EAAE,CAAC;QAC7D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBACxC,aAAa,CAAC,IAAI,CAAC,GAAG;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;oBAClD,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,aAAa,CAAC,IAAI,CAAC,GAAG;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;oBAC7C,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAA2B;YAC5C,OAAO,EAAE,eAAe;YACxB,OAAO,EAAE,aAAa;SACvB,CAAC;QAEF,wBAAwB;QACxB,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;QACtE,6EAA6E;QAC7E,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,8BAA8B,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACvF,yFAAyF;QACzF,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,sBAAsB,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC;QAE3D,MAAM,gBAAgB,GAAkB;YACtC,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,SAAS,CAAC,iBAAiB;YACtC,EAAE,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC/C,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC3D,aAAa,EAAE;gBACb,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACzC,UAAU,EAAE,IAAI,CAAC,WAAW;aAC7B;SACF,CAAC;QAEF,IAAI,CAAC,aAAa,GAAG,gBAAgB,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QAEpB,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACnC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa,CAAC,UAAsB;QAChD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,sGAAsG;QACtG,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5E,MAAM,mBAAmB,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAExF,uFAAuF;QACvF,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,iCAAiC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,uCAAuC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,mBAAmB,CAAC,SAAS,EAAE,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,6CAA6C,mBAAmB,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CACtD,mBAAmB,CAAC,KAAK,EACzB,UAAU,EACV,QAAQ,CAAC,KAAK,EACd,aAAa,CAAC,KAAK,CACpB,CAAC;QACF,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC3D,CAAC;QAED,2BAA2B;QAC3B,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAY,CAAC,CAAC;QACpF,6EAA6E;QAC7E,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,mCAAmC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrE,6EAA6E;QAC7E,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,yBAAyB,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACpF,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,mCAAmC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1E,IAAI,SAAS,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBAC5C,MAAM,KAAK,GAA6B;oBACtC,IAAI;oBACJ,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,EAAE,EAAE,SAAS,CAAC,EAAE;oBAChB,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,YAAY,EAAE,SAAS,CAAC,YAAY;oBACpC,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;oBACtD,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,SAAS,EAAE,SAAS,CAAC,SAAS;iBAC/B,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACtE,6EAA6E;gBAC7E,IAAI,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC;oBAC/B,OAAO,IAAI,CAAC,2BAA2B,IAAI,MAAM,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7E,CAAC;gBACD,MAAM,KAAK,GAA4B;oBACrC,IAAI;oBACJ,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,GAAG,EAAE,cAAc,CAAC,KAAK;oBACzB,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,SAAS,EAAE,SAAS,CAAC,SAAS;iBAC/B,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QAEpB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,+EAA+E;IAC/E,wCAAwC;IACxC,+EAA+E;IAE/E;;;;;;;;;OASG;IACK,KAAK,CAAC,sBAAsB,CAAC,KAAqB;QACxD,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC7B,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpE,IAAI,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC7B,OAAO,4CAA4C,KAAK,CAAC,IAAI,SAAS,KAAK,CAAC,EAAE,MAAM,YAAY,CAAC,OAAO,EAAE,CAAC;YAC7G,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,oBAAoB,CAAC,UAAqB,EAAE,IAAY;QACpE,OAAO,kBAAkB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,eAAe,CACpG,CAAC,GAAG,EAAE,EAAE,CAAC,+CAA+C,IAAI,MAAM,GAAG,EAAE,CACxE,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,yBAAyB,CACrC,GAAe,EACf,SAA2B,EAC3B,WAAoB;QAEpB,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC1D,OAAO,kBAAkB,CAAC,GAAG,EAAE,CAC7B,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,eAAe,EAAE,WAAW,EAAE,MAAM,CAAC,CAC5F,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,0BAA0B,CACtC,IAAY,EACZ,KAA+B,EAC/B,OAAuC;QAEvC,oDAAoD;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAmB,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,MAAK,IAAI,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAC,mCAAmC,IAAI,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,kBAAkB,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC;QAC3D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,yBAAyB,CACvD,KAAK,CAAC,qBAAqB,EAC3B,KAAK,CAAC,SAAS,EACf,kBAAkB,CACnB,CAAC;QACF,IAAI,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,wCAAwC,IAAI,kBAAkB,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,iDAAiD,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,oBAAoB,CAAC,GAAe,EAAE,MAA+B;QAClF,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAClG,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;QAC3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,gBAAgB,CAAC,CAAa,EAAE,CAAa;QAC1D,oFAAoF;QACpF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,sCAAsC;YACtC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,KAAK,CAAC,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACK,WAAW;QACjB,OAAO,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;YACtE,8DAA8D;YAC9D,sCAAsC;YACtC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YACpC,sCAAsC;YACtC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YACpC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;iBAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;iBAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,OAAO,OAAO,CACZ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAC3F,EAAE,EACF,EAAE,CACH,EAAE,CACJ,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF","sourcesContent":["// Copyright (c) 2026 Erik Fortune\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal\n// in the Software without restriction, including without limitation the rights\n// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n// copies of the Software, and to permit persons to whom the Software is\n// furnished to do so, subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all\n// copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n// SOFTWARE.\n\nimport { JsonValue } from '@fgv/ts-json-base';\nimport { captureAsyncResult, captureResult, fail, Result, succeed } from '@fgv/ts-utils';\nimport * as Constants from '../constants';\nimport { createEncryptedFile } from '../encryptedFile';\nimport { IKeyPairAlgorithmParams, keyPairAlgorithmParams } from '../keyPairAlgorithmParams';\nimport {\n  ICryptoProvider,\n  IEncryptedFile,\n  IEncryptionConfig,\n  IEncryptionProvider,\n  IArgon2idKeyDerivationParams,\n  IArgon2idProvider,\n  IArgon2idParams,\n  IKeyDerivationParams,\n  ARGON2ID_OWASP_MIN,\n  KeyPairAlgorithm,\n  SecretProvider\n} from '../model';\nimport {\n  DEFAULT_KEYSTORE_ITERATIONS,\n  DEFAULT_SECRET_ITERATIONS,\n  IAddKeyPairOptions,\n  IAddKeyPairResult,\n  IAddSecretFromPasswordArgon2idOptions,\n  IAddSecretFromPasswordOptions,\n  IAddSecretFromPasswordResult,\n  IAddSecretOptions,\n  IAddSecretResult,\n  IGetKeyPairOptions,\n  IImportKeyOptions,\n  IImportSecretOptions,\n  IKeyStoreAsymmetricEntry,\n  IKeyStoreCreateParams,\n  IKeyStoreEntry,\n  IKeyStoreEntryJson,\n  IKeyStoreFile,\n  IKeyStoreOpenParams,\n  IKeyStoreSymmetricEntry,\n  IKeyStoreVaultContents,\n  IRemoveSecretResult,\n  KEYSTORE_FORMAT,\n  KeyStoreLockState,\n  KeyStoreSecretType,\n  MIN_SALT_LENGTH\n} from './model';\nimport { IPrivateKeyStorage } from './privateKeyStorage';\nimport { keystoreFile, keystoreVaultContents } from './converters';\n\n/**\n * Gets the current ISO timestamp.\n */\nfunction getCurrentTimestamp(): string {\n  return new Date().toISOString();\n}\n\n// WebCrypto key usages that only ever apply to a public key. Filtering these\n// out of the keypair usages yields the usages valid for the private half, which\n// `crypto.subtle.importKey` requires when re-importing a private JWK. Mirrors\n// the same list in `EncryptedFilePrivateKeyStorage`.\nconst PUBLIC_ONLY_USAGES: ReadonlyArray<KeyUsage> = ['verify', 'encrypt', 'wrapKey'];\n\n// ============================================================================\n// KeyStore Class\n// ============================================================================\n\n/**\n * Password-protected key store for managing encryption secrets.\n *\n * The KeyStore provides a secure vault for storing named encryption keys.\n * The vault is encrypted at rest using a master password via PBKDF2 key derivation.\n *\n * @example\n * ```typescript\n * // Create new key store\n * const keystore = KeyStore.create({ cryptoProvider: nodeCryptoProvider }).orThrow();\n * await keystore.initialize('master-password');\n *\n * // Add secrets\n * await keystore.addSecret('my-key', { description: 'Production key' });\n *\n * // Save to file\n * const fileContent = await keystore.save();\n *\n * // Later: Open existing key store\n * const keystore2 = KeyStore.open({\n *   cryptoProvider: nodeCryptoProvider,\n *   keystoreFile: fileContent.value\n * }).orThrow();\n * await keystore2.unlock('master-password');\n *\n * // Use as secret provider for encrypted file loading\n * const encryptionConfig = keystore2.getEncryptionConfig().orThrow();\n * ```\n *\n * @remarks\n * SECURITY — private-key escrow. By default an asymmetric keypair's private\n * key lives only in the per-device {@link CryptoUtils.KeyStore.IPrivateKeyStorage}\n * backend; the vault carries only the public JWK, so a vault recovered on a new\n * device reconstitutes with no private keys (a lost device is a lost identity).\n * `addKeyPair(name, { escrow: true })` opts into carrying an encrypted private-key\n * copy inside the vault ciphertext, so the vault file plus the master password can\n * recover the identity on a fresh device via `getKeyPair(name, { rehydrate: true })`.\n *\n * When escrow is used, **the master password becomes the sole gate** protecting a\n * private signing/decryption key that was previously unrecoverable from the vault.\n * Configure escrow-bearing stores with a strong KDF — an Argon2id-derived master\n * key or a high-iteration PBKDF2 count — and treat the vault file accordingly.\n *\n * @public\n */\nexport class KeyStore implements IEncryptionProvider {\n  private readonly _cryptoProvider: ICryptoProvider;\n  private readonly _privateKeyStorage: IPrivateKeyStorage | undefined;\n  private readonly _iterations: number;\n  private _keystoreFile: IKeyStoreFile | undefined;\n  private _salt: Uint8Array | undefined;\n  private _secrets: Map<string, IKeyStoreEntry> | undefined;\n  private _state: KeyStoreLockState;\n  private _dirty: boolean;\n  private _isNew: boolean;\n\n  private constructor(\n    cryptoProvider: ICryptoProvider,\n    iterations: number,\n    keystoreFile: IKeyStoreFile | undefined,\n    isNew: boolean,\n    privateKeyStorage: IPrivateKeyStorage | undefined\n  ) {\n    this._cryptoProvider = cryptoProvider;\n    this._privateKeyStorage = privateKeyStorage;\n    this._iterations = iterations;\n    this._keystoreFile = keystoreFile;\n    this._state = 'locked';\n    this._dirty = false;\n    this._isNew = isNew;\n  }\n\n  // ============================================================================\n  // Factory Methods\n  // ============================================================================\n\n  /**\n   * Creates a new, empty key store.\n   * Call `initialize(password)` to set the master password.\n   * @param params - Creation parameters\n   * @returns Success with new KeyStore instance, or Failure if parameters invalid\n   * @public\n   */\n  public static create(params: IKeyStoreCreateParams): Result<KeyStore> {\n    const iterations = params.iterations ?? DEFAULT_KEYSTORE_ITERATIONS;\n    if (iterations < 1) {\n      return fail('Iterations must be at least 1');\n    }\n    return succeed(\n      new KeyStore(params.cryptoProvider, iterations, undefined, true, params.privateKeyStorage)\n    );\n  }\n\n  /**\n   * Opens an existing encrypted key store.\n   * Call `unlock(password)` to decrypt and access secrets.\n   * @param params - Open parameters including the encrypted file\n   * @returns Success with KeyStore instance, or Failure if file format invalid\n   * @public\n   */\n  public static open(params: IKeyStoreOpenParams): Result<KeyStore> {\n    // Validate the file format\n    const fileResult = keystoreFile.convert(params.keystoreFile);\n    if (fileResult.isFailure()) {\n      return fail(`Invalid key store file: ${fileResult.message}`);\n    }\n\n    const iterations = fileResult.value.keyDerivation.iterations;\n    return succeed(\n      new KeyStore(params.cryptoProvider, iterations, fileResult.value, false, params.privateKeyStorage)\n    );\n  }\n\n  // ============================================================================\n  // Lifecycle Methods\n  // ============================================================================\n\n  /**\n   * Initializes a new key store with the master password.\n   * Generates a random salt for key derivation.\n   * Only valid for newly created (not opened) key stores.\n   * @param password - The master password\n   * @returns Success with this instance when initialized, Failure if already initialized or opened\n   * @public\n   */\n  public async initialize(password: string): Promise<Result<KeyStore>> {\n    if (!this._isNew) {\n      return fail('Cannot initialize an opened key store - use unlock() instead');\n    }\n    if (this._state === 'unlocked') {\n      return fail('Key store is already initialized');\n    }\n    if (!password || password.length === 0) {\n      return fail('Password cannot be empty');\n    }\n\n    // Generate salt for this key store using crypto provider\n    const saltResult = this._cryptoProvider.generateRandomBytes(MIN_SALT_LENGTH);\n    /* c8 ignore next 3 - crypto provider errors tested but coverage intermittently missed */\n    if (saltResult.isFailure()) {\n      return fail(`Failed to generate salt: ${saltResult.message}`);\n    }\n\n    this._salt = saltResult.value;\n    this._secrets = new Map();\n    this._state = 'unlocked';\n    this._dirty = true; // New store needs to be saved\n\n    return succeed(this);\n  }\n\n  /**\n   * Unlocks an existing key store with the master password.\n   * Decrypts the vault and loads secrets into memory.\n   * @param password - The master password\n   * @returns Success with this instance when unlocked, Failure if password incorrect\n   * @public\n   */\n  public async unlock(password: string): Promise<Result<KeyStore>> {\n    if (this._isNew) {\n      return fail('Cannot unlock a new key store - use initialize() instead');\n    }\n    /* c8 ignore next 6 - error paths tested but coverage intermittently missed */\n    if (this._state === 'unlocked') {\n      return fail('Key store is already unlocked');\n    }\n    if (!this._keystoreFile) {\n      return fail('No key store file to unlock');\n    }\n\n    const keyDerivation = this._keystoreFile.keyDerivation;\n    const saltResult = this._cryptoProvider.fromBase64(keyDerivation.salt);\n    /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n    if (saltResult.isFailure()) {\n      return fail(`Invalid salt in key store file: ${saltResult.message}`);\n    }\n    const salt = saltResult.value;\n\n    // Derive the key from password\n    const keyResult = await this._cryptoProvider.deriveKey(password, salt, keyDerivation.iterations);\n    /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n    if (keyResult.isFailure()) {\n      return fail(`Key derivation failed: ${keyResult.message}`);\n    }\n\n    return this._decryptVault(keyResult.value);\n  }\n\n  /**\n   * Unlocks an existing key store with a pre-derived key, bypassing\n   * PBKDF2 key derivation. Use this when the derived key has been\n   * stored externally (e.g., in another key store) and the original\n   * password is no longer available.\n   *\n   * The supplied key must have been derived from the correct password\n   * using the key store file's own PBKDF2 parameters (salt and\n   * iteration count).\n   *\n   * @param derivedKey - The pre-derived master key (32 bytes for AES-256)\n   * @returns Success with this instance when unlocked, Failure if key is incorrect\n   * @public\n   */\n  public async unlockWithKey(derivedKey: Uint8Array): Promise<Result<KeyStore>> {\n    if (this._isNew) {\n      return fail('Cannot unlock a new key store - use initialize() instead');\n    }\n    if (this._state === 'unlocked') {\n      return fail('Key store is already unlocked');\n    }\n    if (derivedKey.length !== Constants.AES_256_KEY_SIZE) {\n      return fail(`Key must be ${Constants.AES_256_KEY_SIZE} bytes, got ${derivedKey.length}`);\n    }\n    /* c8 ignore next 3 - defensive coding: unreachable via public API (open sets file, create sets isNew) */\n    if (!this._keystoreFile) {\n      return fail('No key store file to unlock');\n    }\n\n    return this._decryptVault(derivedKey);\n  }\n\n  /**\n   * Locks the key store, clearing all secrets from memory.\n   * @param force - If true, discards unsaved changes\n   * @returns Success when locked, Failure if unsaved changes and !force\n   * @public\n   */\n  public lock(force?: boolean): Result<KeyStore> {\n    if (this._state === 'locked') {\n      return succeed(this);\n    }\n\n    if (this._dirty && !force) {\n      return fail('Unsaved changes - use force=true to discard or save() first');\n    }\n\n    // Clear secrets from memory (overwrite for security)\n    if (this._secrets) {\n      for (const entry of this._secrets.values()) {\n        if (entry.type !== 'asymmetric-keypair') {\n          entry.key.fill(0);\n        }\n      }\n      this._secrets.clear();\n      this._secrets = undefined;\n    }\n\n    this._state = 'locked';\n    this._dirty = false;\n\n    return succeed(this);\n  }\n\n  /**\n   * Checks if the key store is unlocked.\n   * @public\n   */\n  public get isUnlocked(): boolean {\n    return this._state === 'unlocked';\n  }\n\n  /**\n   * Checks if there are unsaved changes.\n   * @public\n   */\n  public get isDirty(): boolean {\n    return this._dirty;\n  }\n\n  /**\n   * Whether this is a newly created key store (not opened from a file).\n   * A new key store must be initialized with a password before use.\n   * An opened key store must be unlocked with the existing password.\n   * @public\n   */\n  public get isNew(): boolean {\n    return this._isNew;\n  }\n\n  /**\n   * Gets the current lock state.\n   * @public\n   */\n  public get state(): KeyStoreLockState {\n    return this._state;\n  }\n\n  /**\n   * Gets the crypto provider used by this key store.\n   * Available regardless of lock state.\n   * @public\n   */\n  public get cryptoProvider(): ICryptoProvider {\n    return this._cryptoProvider;\n  }\n\n  // ============================================================================\n  // Secret Management\n  // ============================================================================\n\n  /**\n   * Lists all secret names in the key store.\n   * @returns Success with array of secret names, Failure if locked\n   * @public\n   */\n  public listSecrets(): Result<readonly string[]> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    return succeed(Array.from(this._secrets.keys()));\n  }\n\n  /**\n   * Gets a secret by name. Returns the {@link CryptoUtils.KeyStore.IKeyStoreEntry | discriminated union}\n   * — callers must check `entry.type` before accessing `key`/`id` since asymmetric\n   * entries carry no raw key material.\n   *\n   * SECURITY: for an escrow-enabled asymmetric-keypair entry the returned object\n   * carries `escrowedPrivateKeyJwk` in cleartext (same custody class as\n   * `publicKeyJwk`, gated by the same unlock) — do not log or serialize a\n   * `getSecret()` result casually.\n   *\n   * @param name - Name of the secret\n   * @returns Success with secret entry, Failure if not found or locked\n   * @public\n   */\n  public getSecret(name: string): Result<IKeyStoreEntry> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    const entry = this._secrets.get(name);\n    if (!entry) {\n      return fail(`Secret '${name}' not found`);\n    }\n    return succeed(entry);\n  }\n\n  /**\n   * Returns the public-key JWK for an asymmetric-keypair entry.\n   * Available without {@link CryptoUtils.KeyStore.IPrivateKeyStorage} since the\n   * public key lives in the vault metadata directly.\n   * @param name - Name of the entry\n   * @returns Success with the JWK, Failure if not found, locked, or wrong type\n   * @public\n   */\n  public getPublicKeyJwk(name: string): Result<JsonWebKey> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    const entry = this._secrets.get(name);\n    if (!entry) {\n      return fail(`Secret '${name}' not found`);\n    }\n    if (entry.type !== 'asymmetric-keypair') {\n      return fail(`Secret '${name}' is not an asymmetric keypair (type: ${entry.type})`);\n    }\n    return succeed(entry.publicKeyJwk);\n  }\n\n  /**\n   * Checks if a secret exists.\n   * @param name - Name of the secret\n   * @returns Success with boolean, Failure if locked\n   * @public\n   */\n  public hasSecret(name: string): Result<boolean> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    return succeed(this._secrets.has(name));\n  }\n\n  /**\n   * Adds a new secret with a randomly generated key.\n   * @param name - Unique name for the secret\n   * @param options - Optional description\n   * @returns Success with the generated entry, Failure if locked or name invalid\n   * @public\n   */\n  public async addSecret(name: string, options?: IAddSecretOptions): Promise<Result<IAddSecretResult>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!name || name.length === 0) {\n      return fail('Secret name cannot be empty');\n    }\n\n    // Generate a new random key\n    const keyResult = await this._cryptoProvider.generateKey();\n    /* c8 ignore next 3 - crypto provider errors tested but coverage intermittently missed */\n    if (keyResult.isFailure()) {\n      return fail(`Failed to generate key: ${keyResult.message}`);\n    }\n\n    const entry: IKeyStoreSymmetricEntry = {\n      name,\n      type: 'encryption-key',\n      key: keyResult.value,\n      description: options?.description,\n      createdAt: getCurrentTimestamp()\n    };\n\n    const existing = this._secrets.get(name);\n    const warning = existing ? await this._releaseEntryResources(existing) : undefined;\n\n    this._secrets.set(name, entry);\n    this._dirty = true;\n\n    return succeed({ entry, replaced: existing !== undefined, warning });\n  }\n\n  /**\n   * Imports raw 32-byte key material into the vault.\n   *\n   * Always validates that the key is exactly 32 bytes (AES-256). The optional\n   * `type` field is a classification label stored with the entry; it does not\n   * change the validation rules.  For importing UTF-8 API key strings (variable\n   * length), use {@link KeyStore.importApiKey} instead.\n   *\n   * @param name - Unique name for the secret\n   * @param key - The 32-byte AES-256 key material\n   * @param options - Optional type classification, description, whether to replace existing\n   * @returns Success with entry, Failure if locked, key invalid, or exists and !replace\n   * @public\n   */\n  public async importSecret(\n    name: string,\n    key: Uint8Array,\n    options?: IImportKeyOptions\n  ): Promise<Result<IAddSecretResult>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!name || name.length === 0) {\n      return fail('Secret name cannot be empty');\n    }\n    if (key.length !== Constants.AES_256_KEY_SIZE) {\n      return fail(`Key must be ${Constants.AES_256_KEY_SIZE} bytes, got ${key.length}`);\n    }\n\n    const existing = this._secrets.get(name);\n    if (existing && !options?.replace) {\n      return fail(`Secret '${name}' already exists - use replace=true to overwrite`);\n    }\n\n    const entry: IKeyStoreSymmetricEntry = {\n      name,\n      type: options?.type ?? 'encryption-key',\n      key: new Uint8Array(key), // Copy to prevent external modification\n      description: options?.description,\n      createdAt: getCurrentTimestamp()\n    };\n\n    const warning = existing ? await this._releaseEntryResources(existing) : undefined;\n    this._secrets.set(name, entry);\n    this._dirty = true;\n\n    return succeed({ entry, replaced: existing !== undefined, warning });\n  }\n\n  /**\n   * Adds a secret derived from a password using PBKDF2.\n   *\n   * Generates a random salt, derives a 32-byte AES-256 key from the password,\n   * and stores it in the vault. Returns the key derivation parameters so they\n   * can be stored alongside encrypted files, enabling decryption with just the\n   * password (without unlocking the keystore).\n   *\n   * @param name - Unique name for the secret\n   * @param password - Password to derive the key from\n   * @param options - Optional description, iterations, replace flag\n   * @returns Success with entry and keyDerivation params, Failure if locked or invalid\n   * @public\n   */\n  public async addSecretFromPassword(\n    name: string,\n    password: string,\n    options?: IAddSecretFromPasswordOptions\n  ): Promise<Result<IAddSecretFromPasswordResult>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!name || name.length === 0) {\n      return fail('Secret name cannot be empty');\n    }\n    if (!password || password.length === 0) {\n      return fail('Password cannot be empty');\n    }\n\n    const existing = this._secrets.get(name);\n    if (existing && !options?.replace) {\n      return fail(`Secret '${name}' already exists - use replace=true to overwrite`);\n    }\n\n    const iterations = options?.iterations ?? DEFAULT_SECRET_ITERATIONS;\n\n    // Generate a random salt for this secret's key derivation\n    const saltResult = this._cryptoProvider.generateRandomBytes(MIN_SALT_LENGTH);\n    /* c8 ignore next 3 - crypto provider errors tested but coverage intermittently missed */\n    if (saltResult.isFailure()) {\n      return fail(`Failed to generate salt: ${saltResult.message}`);\n    }\n\n    // Derive the key from password\n    const keyResult = await this._cryptoProvider.deriveKey(password, saltResult.value, iterations);\n    /* c8 ignore next 3 - crypto provider errors tested but coverage intermittently missed */\n    if (keyResult.isFailure()) {\n      return fail(`Key derivation failed: ${keyResult.message}`);\n    }\n\n    const entry: IKeyStoreSymmetricEntry = {\n      name,\n      type: 'encryption-key',\n      key: keyResult.value,\n      description: options?.description,\n      createdAt: getCurrentTimestamp()\n    };\n\n    const warning = existing ? await this._releaseEntryResources(existing) : undefined;\n    this._secrets.set(name, entry);\n    this._dirty = true;\n\n    return succeed({\n      entry,\n      replaced: existing !== undefined,\n      warning,\n      keyDerivation: {\n        kdf: 'pbkdf2',\n        salt: this._cryptoProvider.toBase64(saltResult.value),\n        iterations\n      }\n    });\n  }\n\n  /**\n   * Verifies that a candidate password derives the same key material currently\n   * stored under `name`, using the supplied\n   * {@link CryptoUtils.IKeyDerivationParams | key derivation parameters}.\n   *\n   * The keystore does not persist per-slot key derivation parameters with the\n   * entry — callers receive them from `addSecretFromPassword` and store them\n   * alongside the encrypted artifact (or wherever else makes sense). Pass\n   * those same parameters here for verification.\n   *\n   * Re-derives a key from `password` + `keyDerivation`, then compares it to\n   * the stored key material in constant time. Restricted to entries of type\n   * `'encryption-key'` — the type produced by `addSecretFromPassword`. Other\n   * symmetric types (`'api-key'`) and asymmetric entries are rejected so\n   * the boolean result reflects \"this slot accepts this password\" rather\n   * than an incidental byte-equality match against unrelated material.\n   *\n   * Note: the keystore does not currently flag whether an `'encryption-key'`\n   * entry was actually password-derived (vs. random via `addSecret` or raw\n   * via `importSecret`). A `true` result therefore means \"the candidate\n   * password produces the same 32 bytes currently stored\", which is what\n   * the equivalent consumer-side helper (`verifyGatePassword`) already\n   * implies for entries it manages.\n   *\n   * @param name - Name of the secret to verify against\n   * @param password - Candidate password to test\n   * @param keyDerivation - The key derivation parameters returned by\n   * `addSecretFromPassword` when the secret was created. Only\n   * `kdf: 'pbkdf2'` is supported.\n   * @returns Success(true) when the candidate matches the stored key,\n   * Success(false) when it does not, Failure if locked, secret missing,\n   * wrong type, unsupported `kdf`, or key derivation fails\n   * @public\n   */\n  public async verifySecretFromPassword(\n    name: string,\n    password: string,\n    keyDerivation: IKeyDerivationParams\n  ): Promise<Result<boolean>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!password || password.length === 0) {\n      return fail('Password cannot be empty');\n    }\n    if (keyDerivation.kdf !== 'pbkdf2') {\n      return fail(`Unsupported kdf '${keyDerivation.kdf}' (expected 'pbkdf2')`);\n    }\n\n    const entry = this._secrets.get(name);\n    if (!entry) {\n      return fail(`Secret '${name}' not found`);\n    }\n    if (entry.type !== 'encryption-key') {\n      return fail(`Secret '${name}' is not a password-verifiable encryption key (type: ${entry.type})`);\n    }\n\n    const saltResult = this._cryptoProvider.fromBase64(keyDerivation.salt);\n    if (saltResult.isFailure()) {\n      return fail(`Invalid salt: ${saltResult.message}`);\n    }\n\n    const derivedResult = await this._cryptoProvider.deriveKey(\n      password,\n      saltResult.value,\n      keyDerivation.iterations\n    );\n    /* c8 ignore next 3 - crypto provider errors covered in nodeCryptoProvider tests */\n    if (derivedResult.isFailure()) {\n      return fail(`Key derivation failed: ${derivedResult.message}`);\n    }\n\n    return succeed(KeyStore._timingSafeEqual(derivedResult.value, entry.key));\n  }\n\n  /**\n   * Adds a secret derived from a password using Argon2id (RFC 9106).\n   *\n   * The Argon2id provider must be supplied explicitly; the KeyStore does not\n   * hold one by default (consumers opt in by depending on the argon2 package).\n   *\n   * Returns the key derivation parameters so callers can store them alongside\n   * encrypted artifacts, enabling future re-derivation and verification.\n   *\n   * @param name - Unique name for the secret\n   * @param password - Password or passphrase\n   * @param argon2idProvider - Argon2id provider (Node or Browser implementation)\n   * @param options - Optional: Argon2id params (defaults to ARGON2ID_OWASP_MIN), description, replace flag\n   * @returns Success with entry and keyDerivation params, Failure if locked or invalid\n   * @public\n   */\n  public async addSecretFromPasswordArgon2id(\n    name: string,\n    password: string,\n    argon2idProvider: IArgon2idProvider,\n    options?: IAddSecretFromPasswordArgon2idOptions\n  ): Promise<Result<IAddSecretFromPasswordResult>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!name || name.length === 0) {\n      return fail('Secret name cannot be empty');\n    }\n    if (!password || password.length === 0) {\n      return fail('Password cannot be empty');\n    }\n\n    const existing = this._secrets.get(name);\n    if (existing && !options?.replace) {\n      return fail(`Secret '${name}' already exists - use replace=true to overwrite`);\n    }\n\n    const params: IArgon2idParams = options?.params ?? ARGON2ID_OWASP_MIN;\n\n    const saltResult = this._cryptoProvider.generateRandomBytes(MIN_SALT_LENGTH);\n    /* c8 ignore next 3 - crypto provider errors tested but coverage intermittently missed */\n    if (saltResult.isFailure()) {\n      return fail(`Failed to generate salt: ${saltResult.message}`);\n    }\n\n    const keyResult = await argon2idProvider.argon2id(password, saltResult.value, params);\n    if (keyResult.isFailure()) {\n      return fail(`Argon2id key derivation failed: ${keyResult.message}`);\n    }\n    if (keyResult.value.length !== Constants.AES_256_KEY_SIZE) {\n      return fail(\n        `Argon2id outputBytes must be ${Constants.AES_256_KEY_SIZE} for KeyStore secrets, got ${keyResult.value.length}`\n      );\n    }\n\n    const entry: IKeyStoreSymmetricEntry = {\n      name,\n      type: 'encryption-key',\n      key: keyResult.value,\n      description: options?.description,\n      createdAt: getCurrentTimestamp()\n    };\n\n    const warning = existing ? await this._releaseEntryResources(existing) : undefined;\n    this._secrets.set(name, entry);\n    this._dirty = true;\n\n    const keyDerivation: IArgon2idKeyDerivationParams = {\n      kdf: 'argon2id',\n      salt: this._cryptoProvider.toBase64(saltResult.value),\n      memoryKiB: params.memoryKiB,\n      iterations: params.iterations,\n      parallelism: params.parallelism\n    };\n\n    return succeed({ entry, replaced: existing !== undefined, warning, keyDerivation });\n  }\n\n  /**\n   * Verifies a candidate password against an Argon2id-derived entry using the\n   * supplied key derivation parameters. Constant-time comparison.\n   *\n   * @param name - Name of the secret to verify against\n   * @param password - Candidate password to test\n   * @param argon2idProvider - Argon2id provider (must produce bit-identical output for identical inputs)\n   * @param keyDerivation - The Argon2id key derivation parameters returned by `addSecretFromPasswordArgon2id`\n   * @returns Success(true) if candidate matches stored key, Success(false) if not,\n   * Failure if locked, secret missing, wrong type, or derivation fails\n   * @public\n   */\n  public async verifySecretFromPasswordArgon2id(\n    name: string,\n    password: string,\n    argon2idProvider: IArgon2idProvider,\n    keyDerivation: IArgon2idKeyDerivationParams\n  ): Promise<Result<boolean>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!password || password.length === 0) {\n      return fail('Password cannot be empty');\n    }\n\n    const entry = this._secrets.get(name);\n    if (!entry) {\n      return fail(`Secret '${name}' not found`);\n    }\n    if (entry.type !== 'encryption-key') {\n      return fail(`Secret '${name}' is not a password-verifiable encryption key (type: ${entry.type})`);\n    }\n\n    const saltResult = this._cryptoProvider.fromBase64(keyDerivation.salt);\n    if (saltResult.isFailure()) {\n      return fail(`Invalid salt: ${saltResult.message}`);\n    }\n\n    const params: IArgon2idParams = {\n      memoryKiB: keyDerivation.memoryKiB,\n      iterations: keyDerivation.iterations,\n      parallelism: keyDerivation.parallelism,\n      outputBytes: entry.key.length\n    };\n\n    const derivedResult = await argon2idProvider.argon2id(password, saltResult.value, params);\n    if (derivedResult.isFailure()) {\n      return fail(`Argon2id key derivation failed: ${derivedResult.message}`);\n    }\n\n    return succeed(KeyStore._timingSafeEqual(derivedResult.value, entry.key));\n  }\n\n  /**\n   * Removes a secret by name. Vault-first: the in-memory vault entry is dropped\n   * before any storage cleanup runs. For asymmetric-keypair entries, best-effort\n   * calls {@link CryptoUtils.KeyStore.IPrivateKeyStorage}.delete on the entry's\n   * `id`; a failure is reported via `warning` on the result but does not roll\n   * back the vault removal.\n   * @param name - Name of the secret to remove\n   * @returns Success with removed entry (and optional warning), Failure if not found or locked\n   * @public\n   */\n  public async removeSecret(name: string): Promise<Result<IRemoveSecretResult>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n\n    const entry = this._secrets.get(name);\n    if (!entry) {\n      return fail(`Secret '${name}' not found`);\n    }\n\n    // Vault-first: drop the in-memory entry before touching storage so a\n    // storage failure cannot block removal.\n    this._secrets.delete(name);\n    this._dirty = true;\n\n    const warning = await this._releaseEntryResources(entry);\n    return succeed({ entry, warning });\n  }\n\n  /**\n   * Imports an API key string into the vault.\n   * The string is UTF-8 encoded and stored with type `'api-key'`.\n   * @param name - Unique name for the secret\n   * @param apiKey - The API key string\n   * @param options - Optional description, whether to replace existing\n   * @returns Success with entry, Failure if locked, empty, or exists and !replace\n   * @public\n   */\n  public async importApiKey(\n    name: string,\n    apiKey: string,\n    options?: IImportSecretOptions\n  ): Promise<Result<IAddSecretResult>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!name || name.length === 0) {\n      return fail('Secret name cannot be empty');\n    }\n    if (!apiKey || apiKey.length === 0) {\n      return fail('API key cannot be empty');\n    }\n\n    const existing = this._secrets.get(name);\n    if (existing && !options?.replace) {\n      return fail(`Secret '${name}' already exists - use replace=true to overwrite`);\n    }\n\n    const encoder = new TextEncoder();\n    const entry: IKeyStoreSymmetricEntry = {\n      name,\n      type: 'api-key',\n      key: encoder.encode(apiKey),\n      description: options?.description,\n      createdAt: getCurrentTimestamp()\n    };\n\n    const warning = existing ? await this._releaseEntryResources(existing) : undefined;\n    this._secrets.set(name, entry);\n    this._dirty = true;\n\n    return succeed({ entry, replaced: existing !== undefined, warning });\n  }\n\n  /**\n   * Retrieves an API key string by name.\n   * Only works for secrets with type `'api-key'`.\n   * @param name - Name of the secret\n   * @returns Success with the API key string, Failure if not found, locked, or wrong type\n   * @public\n   */\n  public getApiKey(name: string): Result<string> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    const entry = this._secrets.get(name);\n    if (!entry) {\n      return fail(`Secret '${name}' not found`);\n    }\n    if (entry.type !== 'api-key') {\n      return fail(`Secret '${name}' is not an API key (type: ${entry.type})`);\n    }\n    const decoder = new TextDecoder();\n    return succeed(decoder.decode(entry.key));\n  }\n\n  // ============================================================================\n  // Asymmetric Keypair Management\n  // ============================================================================\n\n  /**\n   * Adds a new asymmetric keypair to the vault. Storage-first: the private key\n   * is stored under a freshly-minted `id` before the public-key vault entry is\n   * committed. If the storage call fails, no vault entry is written and the\n   * operation returns Failure.\n   *\n   * When `replace: true` displaces an existing entry (asymmetric or symmetric),\n   * a fresh `id` is minted; the displaced entry's resources are released\n   * best-effort. Failure of the storage delete is reported via `warning` on the\n   * result but does not roll back the replacement.\n   *\n   * Requires a {@link CryptoUtils.KeyStore.IPrivateKeyStorage} backend\n   * supplied at construction.\n   *\n   * Extractability of the generated private key defaults to the storage\n   * backend's {@link CryptoUtils.KeyStore.IPrivateKeyStorage.supportsNonExtractable}.\n   * `options.extractable` overrides that default for this key only; requesting\n   * `extractable: false` against a backend that cannot store non-extractable\n   * keys fails loudly rather than silently generating an extractable key.\n   *\n   * @param name - Unique name for the entry\n   * @param options - Algorithm, optional description, replace flag, extractable override\n   * @returns Success with the new entry, Failure if locked, no provider, storage write failed,\n   * or the requested extractability cannot be honored by the backend\n   * @public\n   */\n  public async addKeyPair(name: string, options: IAddKeyPairOptions): Promise<Result<IAddKeyPairResult>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!name || name.length === 0) {\n      return fail('Entry name cannot be empty');\n    }\n    if (!this._privateKeyStorage) {\n      return fail('No private key storage configured');\n    }\n\n    const existing = this._secrets.get(name);\n    if (existing && !options.replace) {\n      return fail(`Secret '${name}' already exists - use replace=true to overwrite`);\n    }\n\n    // Generate the keypair before touching storage. extractable=true on backends\n    // that round-trip via JWK; extractable=false on backends that hold CryptoKey\n    // refs directly. `options.extractable` overrides the backend-derived default\n    // for this key only; a caller-requested non-extractable key against a\n    // backend that cannot store one fails loudly rather than silently\n    // upgrading to extractable.\n    const backendExtractable = !this._privateKeyStorage.supportsNonExtractable;\n    if (options.extractable === false && backendExtractable) {\n      return fail(\n        `Cannot create non-extractable keypair for '${name}': storage backend does not support non-extractable keys`\n      );\n    }\n    // Extractability of the LIVE stored key. Escrow is orthogonal — it never\n    // changes this; the escrow copy is captured separately from a transient\n    // extractable key.\n    const liveExtractable = options.extractable ?? backendExtractable;\n\n    // For escrow we must be able to export the private key to JWK, which only\n    // works on an extractable key, so the transient keypair is generated\n    // extractable regardless of `liveExtractable`. Without escrow it is\n    // generated directly at the live setting.\n    const generateExtractable = options.escrow === true ? true : liveExtractable;\n    const keyPairResult = await this._cryptoProvider.generateKeyPair(options.algorithm, generateExtractable);\n    /* c8 ignore next 3 - crypto provider errors covered in nodeCryptoProvider tests; cannot be triggered here without mocking */\n    if (keyPairResult.isFailure()) {\n      return fail(`Failed to generate keypair for '${name}': ${keyPairResult.message}`);\n    }\n    const { publicKey, privateKey } = keyPairResult.value;\n\n    const jwkResult = await this._cryptoProvider.exportPublicKeyJwk(publicKey);\n    /* c8 ignore next 3 - export of an extractable freshly-generated public key is hard to fail */\n    if (jwkResult.isFailure()) {\n      return fail(`Failed to export public key for '${name}': ${jwkResult.message}`);\n    }\n\n    // Escrow (opt-in). The bare private key exists only as three local\n    // artifacts, none of which is returned or logged: (1) the transient\n    // extractable `privateKey` above; (2) the exported `escrowedPrivateKeyJwk`,\n    // which is carried in the vault entry (same custody class as the public\n    // JWK); (3) a freshly re-imported non-extractable key handed to `store()`\n    // when the live copy must be non-extractable. When the live copy is\n    // extractable the transient key IS the live copy and is stored directly.\n    let escrowedPrivateKeyJwk: JsonWebKey | undefined;\n    let keyToStore: CryptoKey = privateKey;\n    if (options.escrow === true) {\n      // Chain the export → (conditional) non-extractable re-import so the\n      // failure dispatch lives in ts-utils rather than in local branch nodes.\n      // When the live copy is extractable the transient key IS the live copy;\n      // otherwise a freshly re-imported non-extractable key is stored instead.\n      const escrowPrepResult = await (\n        await this._exportPrivateKeyJwk(privateKey, name)\n      ).thenOnSuccess(async (jwk): Promise<Result<{ jwk: JsonWebKey; keyToStore: CryptoKey }>> => {\n        if (liveExtractable) {\n          return succeed({ jwk, keyToStore: privateKey });\n        }\n        return (await this._importEscrowedPrivateKey(jwk, options.algorithm, false))\n          .withErrorFormat((msg) => `Failed to prepare non-extractable key for '${name}': ${msg}`)\n          .onSuccess((reimported) => succeed({ jwk, keyToStore: reimported }));\n      });\n      /* c8 ignore next 3 - escrowPrepResult only fails if exporting or re-importing a freshly-generated valid key fails, which a healthy provider cannot do (same untestable class as the keyPairResult/jwkResult/idResult guards); the import-failure path itself is covered via getKeyPair rehydration of a malformed escrow JWK */\n      if (escrowPrepResult.isFailure()) {\n        return fail(escrowPrepResult.message);\n      }\n      ({ jwk: escrowedPrivateKeyJwk, keyToStore } = escrowPrepResult.value);\n    }\n\n    const idResult = this._generateId();\n    /* c8 ignore next 3 - random-bytes failure is hard to trigger with a healthy provider */\n    if (idResult.isFailure()) {\n      return fail(`Failed to mint storage id for '${name}': ${idResult.message}`);\n    }\n    const id = idResult.value;\n\n    // Storage-first: write the private key before committing the vault entry.\n    const storeResult = await this._privateKeyStorage.store(id, keyToStore);\n    if (storeResult.isFailure()) {\n      return fail(`Failed to persist private key for '${name}': ${storeResult.message}`);\n    }\n\n    const entry: IKeyStoreAsymmetricEntry = {\n      name,\n      type: 'asymmetric-keypair',\n      id,\n      algorithm: options.algorithm,\n      publicKeyJwk: jwkResult.value,\n      escrowedPrivateKeyJwk,\n      description: options.description,\n      createdAt: getCurrentTimestamp()\n    };\n\n    const warning = existing ? await this._releaseEntryResources(existing) : undefined;\n    this._secrets.set(name, entry);\n    this._dirty = true;\n\n    return succeed({ entry, replaced: existing !== undefined, warning });\n  }\n\n  /**\n   * Retrieves the keypair for an asymmetric-keypair entry. The private key is\n   * loaded from {@link CryptoUtils.KeyStore.IPrivateKeyStorage} on every call —\n   * the keystore never caches private `CryptoKey` references between calls.\n   * The public key is re-imported from the vault's JWK so callers always\n   * receive a `CryptoKey` rather than the JWK form.\n   *\n   * With `options.rehydrate: true`, if the storage backend holds no blob for\n   * the entry's `id` and the entry carries an `escrowedPrivateKeyJwk` (see\n   * `addKeyPair(name, { escrow: true })`), the escrowed JWK is imported and\n   * stored under the entry's `id` before being returned — recovering the\n   * private key on a fresh device from the vault plus master password. This is\n   * fill-a-gap only: an existing storage blob is never overwritten.\n   *\n   * @param name - Name of the entry\n   * @param options - Optional {@link CryptoUtils.KeyStore.IGetKeyPairOptions}\n   * (currently the `rehydrate` escrow-recovery flag).\n   * @returns Success with `{ publicKey, privateKey }`, Failure if not found,\n   * locked, wrong type, no provider, or storage load (and any escrow\n   * rehydration) failed.\n   * @public\n   */\n  public async getKeyPair(\n    name: string,\n    options?: IGetKeyPairOptions\n  ): Promise<Result<{ publicKey: CryptoKey; privateKey: CryptoKey }>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    const entry = this._secrets.get(name);\n    if (!entry) {\n      return fail(`Secret '${name}' not found`);\n    }\n    if (entry.type !== 'asymmetric-keypair') {\n      return fail(`Secret '${name}' is not an asymmetric keypair (type: ${entry.type})`);\n    }\n    if (!this._privateKeyStorage) {\n      return fail('No private key storage configured');\n    }\n\n    return (await this._loadOrRehydratePrivateKey(name, entry, options)).thenOnSuccess(async (privateKey) =>\n      (await this._cryptoProvider.importPublicKeyJwk(entry.publicKeyJwk, entry.algorithm))\n        .withErrorFormat((msg) => `Failed to re-import public key for '${name}': ${msg}`)\n        .onSuccess((publicKey) => succeed({ publicKey, privateKey }))\n    );\n  }\n\n  /**\n   * Lists secret names filtered by type.\n   * @param type - The secret type to filter by\n   * @returns Success with array of matching secret names, Failure if locked\n   * @public\n   */\n  public listSecretsByType(type: KeyStoreSecretType): Result<readonly string[]> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    const names: string[] = [];\n    for (const [name, entry] of this._secrets) {\n      if (entry.type === type) {\n        names.push(name);\n      }\n    }\n    return succeed(names);\n  }\n\n  /**\n   * Renames a secret.\n   * @param oldName - Current name\n   * @param newName - New name\n   * @returns Success with updated entry, Failure if source not found, target exists, or locked\n   * @public\n   */\n  public renameSecret(oldName: string, newName: string): Result<IKeyStoreEntry> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!newName || newName.length === 0) {\n      return fail('New name cannot be empty');\n    }\n\n    const entry = this._secrets.get(oldName);\n    if (!entry) {\n      return fail(`Secret '${oldName}' not found`);\n    }\n\n    if (oldName !== newName && this._secrets.has(newName)) {\n      return fail(`Secret '${newName}' already exists`);\n    }\n\n    // Create new entry with new name. For asymmetric entries the spread\n    // preserves `id` so the storage handle survives the rename.\n    const newEntry: IKeyStoreEntry = {\n      ...entry,\n      name: newName\n    };\n\n    this._secrets.delete(oldName);\n    this._secrets.set(newName, newEntry);\n    this._dirty = true;\n\n    return succeed(newEntry);\n  }\n\n  // ============================================================================\n  // Persistence\n  // ============================================================================\n\n  /**\n   * Saves the key store, returning the encrypted file content.\n   * Requires the master password to encrypt.\n   * @param password - The master password\n   * @returns Success with IKeyStoreFile, Failure if locked\n   * @public\n   */\n  public async save(password: string): Promise<Result<IKeyStoreFile>> {\n    if (!this._secrets || !this._salt) {\n      return fail('Key store is locked');\n    }\n    if (!password || password.length === 0) {\n      return fail('Password cannot be empty');\n    }\n\n    // Derive the encryption key\n    const keyResult = await this._cryptoProvider.deriveKey(password, this._salt, this._iterations);\n    /* c8 ignore next 3 - crypto provider errors tested but coverage intermittently missed */\n    if (keyResult.isFailure()) {\n      return fail(`Key derivation failed: ${keyResult.message}`);\n    }\n\n    return this._encryptVault(keyResult.value);\n  }\n\n  /**\n   * Saves the key store using a pre-derived key, bypassing PBKDF2 key\n   * derivation. Use this when the derived key has been stored externally\n   * (e.g., in another key store) and the original password is no longer\n   * available.\n   *\n   * The supplied key must be the same key that was (or would be) derived\n   * from the master password using the key store's PBKDF2 parameters.\n   *\n   * @param derivedKey - The pre-derived master key (32 bytes for AES-256)\n   * @returns Success with IKeyStoreFile, Failure if locked or key invalid\n   * @public\n   */\n  public async saveWithKey(derivedKey: Uint8Array): Promise<Result<IKeyStoreFile>> {\n    if (!this._secrets || !this._salt) {\n      return fail('Key store is locked');\n    }\n    if (derivedKey.length !== Constants.AES_256_KEY_SIZE) {\n      return fail(`Key must be ${Constants.AES_256_KEY_SIZE} bytes, got ${derivedKey.length}`);\n    }\n\n    return this._encryptVault(derivedKey);\n  }\n\n  /**\n   * Changes the master password.\n   * Re-encrypts the vault with the new password-derived key.\n   * @param currentPassword - Current master password (for verification)\n   * @param newPassword - New master password\n   * @returns Success when password changed, Failure if locked or current password incorrect\n   * @public\n   */\n  public async changePassword(currentPassword: string, newPassword: string): Promise<Result<KeyStore>> {\n    if (!this._secrets || !this._salt) {\n      return fail('Key store is locked');\n    }\n    if (!newPassword || newPassword.length === 0) {\n      return fail('New password cannot be empty');\n    }\n\n    // Verify current password by trying to derive and re-encrypt\n    // (For opened stores, we'd need to verify against the stored file)\n    if (this._keystoreFile) {\n      const saltResult = this._cryptoProvider.fromBase64(this._keystoreFile.keyDerivation.salt);\n      /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n      if (saltResult.isFailure()) {\n        return fail(`Invalid salt in key store file: ${saltResult.message}`);\n      }\n\n      const keyResult = await this._cryptoProvider.deriveKey(\n        currentPassword,\n        saltResult.value,\n        this._keystoreFile.keyDerivation.iterations\n      );\n      /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n      if (keyResult.isFailure()) {\n        return fail(`Key derivation failed: ${keyResult.message}`);\n      }\n\n      // Try to decrypt to verify password\n      const ivResult = this._cryptoProvider.fromBase64(this._keystoreFile.iv);\n      const authTagResult = this._cryptoProvider.fromBase64(this._keystoreFile.authTag);\n      const encryptedDataResult = this._cryptoProvider.fromBase64(this._keystoreFile.encryptedData);\n\n      /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n      if (ivResult.isFailure() || authTagResult.isFailure() || encryptedDataResult.isFailure()) {\n        return fail('Invalid key store file format');\n      }\n\n      const decryptResult = await this._cryptoProvider.decrypt(\n        encryptedDataResult.value,\n        keyResult.value,\n        ivResult.value,\n        authTagResult.value\n      );\n      if (decryptResult.isFailure()) {\n        return fail('Current password is incorrect');\n      }\n    }\n\n    // Generate new salt for the new password using crypto provider\n    const saltResult = this._cryptoProvider.generateRandomBytes(MIN_SALT_LENGTH);\n    /* c8 ignore next 3 - crypto provider errors tested but coverage intermittently missed */\n    if (saltResult.isFailure()) {\n      return fail(`Failed to generate salt: ${saltResult.message}`);\n    }\n\n    this._salt = saltResult.value;\n    this._dirty = true;\n\n    // Save with new password\n    const saveResult = await this.save(newPassword);\n    /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n    if (saveResult.isFailure()) {\n      return fail(saveResult.message);\n    }\n    return succeed(this);\n  }\n\n  // ============================================================================\n  // IEncryptionProvider\n  // ============================================================================\n\n  /** {@inheritDoc IEncryptionProvider.encryptByName} */\n  public async encryptByName<TMetadata = JsonValue>(\n    secretName: string,\n    content: JsonValue,\n    metadata?: TMetadata\n  ): Promise<Result<IEncryptedFile<TMetadata>>> {\n    const secretResult = this.getSecret(secretName);\n    if (secretResult.isFailure()) {\n      return fail(`encryptByName: ${secretResult.message}`);\n    }\n    if (secretResult.value.type === 'asymmetric-keypair') {\n      return fail(\n        `encryptByName: secret '${secretName}' is an asymmetric keypair, not symmetric key material`\n      );\n    }\n\n    return createEncryptedFile({\n      content,\n      secretName,\n      key: secretResult.value.key,\n      cryptoProvider: this._cryptoProvider,\n      metadata\n    });\n  }\n\n  // ============================================================================\n  // Integration with IEncryptionConfig\n  // ============================================================================\n\n  /**\n   * Creates a SecretProvider function for use with IEncryptionConfig.\n   * The returned function looks up secrets from this key store.\n   * @returns Success with SecretProvider, Failure if locked\n   * @public\n   */\n  public getSecretProvider(): Result<SecretProvider> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n\n    const secrets = this._secrets;\n    const provider: SecretProvider = async (secretName: string): Promise<Result<Uint8Array>> => {\n      const entry = secrets.get(secretName);\n      if (!entry) {\n        return fail(`Secret '${secretName}' not found in key store`);\n      }\n      if (entry.type === 'asymmetric-keypair') {\n        return fail(`Secret '${secretName}' is an asymmetric keypair, not symmetric key material`);\n      }\n      return succeed(entry.key);\n    };\n\n    return succeed(provider);\n  }\n\n  /**\n   * Creates a partial IEncryptionConfig using this key store as the secret source.\n   * @returns Partial config that can be spread into a full IEncryptionConfig\n   * @public\n   */\n  public getEncryptionConfig(): Result<Pick<IEncryptionConfig, 'secretProvider' | 'cryptoProvider'>> {\n    const providerResult = this.getSecretProvider();\n    if (providerResult.isFailure()) {\n      return fail(providerResult.message);\n    }\n\n    return succeed({\n      secretProvider: providerResult.value,\n      cryptoProvider: this._cryptoProvider\n    });\n  }\n\n  // ============================================================================\n  // Private: Vault Encryption / Decryption\n  // ============================================================================\n\n  /**\n   * Encrypts the vault with a derived key and returns the key store file.\n   * Shared by `save()` and `saveWithKey()`.\n   */\n  private async _encryptVault(derivedKey: Uint8Array): Promise<Result<IKeyStoreFile>> {\n    // _secrets and _salt are guaranteed non-undefined by callers\n    const secrets = this._secrets!;\n    const salt = this._salt!;\n\n    // Build vault contents\n    const secretEntries: Record<string, IKeyStoreEntryJson> = {};\n    for (const [name, entry] of secrets) {\n      if (entry.type === 'asymmetric-keypair') {\n        secretEntries[name] = {\n          name: entry.name,\n          type: entry.type,\n          id: entry.id,\n          algorithm: entry.algorithm,\n          publicKeyJwk: entry.publicKeyJwk,\n          escrowedPrivateKeyJwk: entry.escrowedPrivateKeyJwk,\n          description: entry.description,\n          createdAt: entry.createdAt\n        };\n      } else {\n        secretEntries[name] = {\n          name: entry.name,\n          type: entry.type,\n          key: this._cryptoProvider.toBase64(entry.key),\n          description: entry.description,\n          createdAt: entry.createdAt\n        };\n      }\n    }\n\n    const vaultContents: IKeyStoreVaultContents = {\n      version: KEYSTORE_FORMAT,\n      secrets: secretEntries\n    };\n\n    // Serialize and encrypt\n    const jsonResult = captureResult(() => JSON.stringify(vaultContents));\n    /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n    if (jsonResult.isFailure()) {\n      return fail(`Failed to serialize vault: ${jsonResult.message}`);\n    }\n\n    const encryptResult = await this._cryptoProvider.encrypt(jsonResult.value, derivedKey);\n    /* c8 ignore next 3 - crypto provider errors tested but coverage intermittently missed */\n    if (encryptResult.isFailure()) {\n      return fail(`Encryption failed: ${encryptResult.message}`);\n    }\n\n    const { iv, authTag, encryptedData } = encryptResult.value;\n\n    const keystoreFileData: IKeyStoreFile = {\n      format: KEYSTORE_FORMAT,\n      algorithm: Constants.DEFAULT_ALGORITHM,\n      iv: this._cryptoProvider.toBase64(iv),\n      authTag: this._cryptoProvider.toBase64(authTag),\n      encryptedData: this._cryptoProvider.toBase64(encryptedData),\n      keyDerivation: {\n        kdf: 'pbkdf2',\n        salt: this._cryptoProvider.toBase64(salt),\n        iterations: this._iterations\n      }\n    };\n\n    this._keystoreFile = keystoreFileData;\n    this._dirty = false;\n    this._isNew = false;\n\n    return succeed(keystoreFileData);\n  }\n\n  /**\n   * Decrypts the vault with a derived key and loads secrets into memory.\n   * Shared by `unlock()` and `unlockWithKey()`.\n   */\n  private async _decryptVault(derivedKey: Uint8Array): Promise<Result<KeyStore>> {\n    const keystoreFile = this._keystoreFile;\n    /* c8 ignore next 3 - defensive: _decryptVault is only called after a successful open() or create() */\n    if (keystoreFile === undefined) {\n      return fail('No key store file loaded');\n    }\n\n    const ivResult = this._cryptoProvider.fromBase64(keystoreFile.iv);\n    const authTagResult = this._cryptoProvider.fromBase64(keystoreFile.authTag);\n    const encryptedDataResult = this._cryptoProvider.fromBase64(keystoreFile.encryptedData);\n\n    /* c8 ignore next 9 - base64 decode errors tested but coverage intermittently missed */\n    if (ivResult.isFailure()) {\n      return fail(`Invalid IV in key store file: ${ivResult.message}`);\n    }\n    if (authTagResult.isFailure()) {\n      return fail(`Invalid auth tag in key store file: ${authTagResult.message}`);\n    }\n    if (encryptedDataResult.isFailure()) {\n      return fail(`Invalid encrypted data in key store file: ${encryptedDataResult.message}`);\n    }\n\n    const decryptResult = await this._cryptoProvider.decrypt(\n      encryptedDataResult.value,\n      derivedKey,\n      ivResult.value,\n      authTagResult.value\n    );\n    if (decryptResult.isFailure()) {\n      return fail('Incorrect password or corrupted key store');\n    }\n\n    // Parse the vault contents\n    const parseResult = captureResult(() => JSON.parse(decryptResult.value) as unknown);\n    /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n    if (parseResult.isFailure()) {\n      return fail(`Failed to parse vault contents: ${parseResult.message}`);\n    }\n\n    const vaultResult = keystoreVaultContents.convert(parseResult.value);\n    /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n    if (vaultResult.isFailure()) {\n      return fail(`Invalid vault format: ${vaultResult.message}`);\n    }\n\n    // Build secrets into local variables to avoid partial state on failure\n    const saltResult = this._cryptoProvider.fromBase64(keystoreFile.keyDerivation.salt);\n    if (saltResult.isFailure()) {\n      return fail(`Invalid salt in key store file: ${saltResult.message}`);\n    }\n    const secrets = new Map<string, IKeyStoreEntry>();\n    for (const [name, jsonEntry] of Object.entries(vaultResult.value.secrets)) {\n      if (jsonEntry.type === 'asymmetric-keypair') {\n        const entry: IKeyStoreAsymmetricEntry = {\n          name,\n          type: jsonEntry.type,\n          id: jsonEntry.id,\n          algorithm: jsonEntry.algorithm,\n          publicKeyJwk: jsonEntry.publicKeyJwk,\n          escrowedPrivateKeyJwk: jsonEntry.escrowedPrivateKeyJwk,\n          description: jsonEntry.description,\n          createdAt: jsonEntry.createdAt\n        };\n        secrets.set(name, entry);\n      } else {\n        const keyBytesResult = this._cryptoProvider.fromBase64(jsonEntry.key);\n        /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n        if (keyBytesResult.isFailure()) {\n          return fail(`Invalid key for secret '${name}': ${keyBytesResult.message}`);\n        }\n        const entry: IKeyStoreSymmetricEntry = {\n          name,\n          type: jsonEntry.type,\n          key: keyBytesResult.value,\n          description: jsonEntry.description,\n          createdAt: jsonEntry.createdAt\n        };\n        secrets.set(name, entry);\n      }\n    }\n\n    // All validation passed — commit state atomically\n    this._salt = saltResult.value;\n    this._secrets = secrets;\n    this._state = 'unlocked';\n    this._dirty = false;\n\n    return succeed(this);\n  }\n\n  // ============================================================================\n  // Private: Helpers for asymmetric flows\n  // ============================================================================\n\n  /**\n   * Releases the resources held by an entry being displaced from the vault.\n   * Symmetric entries get their key buffer zeroed in place. Asymmetric entries\n   * have their private-key blob best-effort deleted from\n   * {@link CryptoUtils.KeyStore.IPrivateKeyStorage}; if the storage call fails,\n   * a warning string is returned but the displacement still proceeds — the\n   * orphaned blob is left for consumer-side GC. Without a configured provider,\n   * asymmetric cleanup is silently skipped.\n   * @returns A warning string if storage cleanup failed, otherwise undefined.\n   */\n  private async _releaseEntryResources(entry: IKeyStoreEntry): Promise<string | undefined> {\n    if (entry.type === 'asymmetric-keypair') {\n      if (!this._privateKeyStorage) {\n        return undefined;\n      }\n      const deleteResult = await this._privateKeyStorage.delete(entry.id);\n      if (deleteResult.isFailure()) {\n        return `Failed to delete prior storage blob for '${entry.name}' (id ${entry.id}): ${deleteResult.message}`;\n      }\n      return undefined;\n    }\n    entry.key.fill(0);\n    return undefined;\n  }\n\n  /**\n   * Exports the transient extractable private `CryptoKey` to a JWK for escrow,\n   * via WebCrypto's `exportKey('jwk', ...)` (cross-runtime through\n   * `globalThis.crypto.subtle`). The result is carried in the vault entry — the\n   * same custody class as the public JWK — and is never returned from a public\n   * method nor logged.\n   */\n  private async _exportPrivateKeyJwk(privateKey: CryptoKey, name: string): Promise<Result<JsonWebKey>> {\n    return captureAsyncResult(() => globalThis.crypto.subtle.exportKey('jwk', privateKey)).withErrorFormat(\n      (msg) => `Failed to export private key for escrow of '${name}': ${msg}`\n    );\n  }\n\n  /**\n   * Re-imports an escrowed private-key JWK as a `CryptoKey` for `algorithm`\n   * with the requested extractability. The WebCrypto JWK-import descriptor is\n   * shared between the public and private halves for every supported algorithm,\n   * so `IKeyPairAlgorithmParams.importPublicKey` is reused; the private/public\n   * distinction is carried by the requested usages (see\n   * {@link KeyStore._privateKeyUsagesFor}). Cross-runtime through\n   * `globalThis.crypto.subtle`.\n   */\n  private async _importEscrowedPrivateKey(\n    jwk: JsonWebKey,\n    algorithm: KeyPairAlgorithm,\n    extractable: boolean\n  ): Promise<Result<CryptoKey>> {\n    const params = keyPairAlgorithmParams[algorithm];\n    const usages = KeyStore._privateKeyUsagesFor(jwk, params);\n    return captureAsyncResult(() =>\n      globalThis.crypto.subtle.importKey('jwk', jwk, params.importPublicKey, extractable, usages)\n    ).withErrorFormat((msg) => `Failed to import escrowed private key: ${msg}`);\n  }\n\n  /**\n   * Loads the private key for `entry` from storage, or — when\n   * `options.rehydrate` is set, storage holds no blob, and the entry carries an\n   * escrowed JWK — imports the escrowed key, persists it under the entry's `id`\n   * (fill-a-gap; never overwrites an existing blob), and returns it.\n   */\n  private async _loadOrRehydratePrivateKey(\n    name: string,\n    entry: IKeyStoreAsymmetricEntry,\n    options: IGetKeyPairOptions | undefined\n  ): Promise<Result<CryptoKey>> {\n    // Non-undefined by getKeyPair's precondition check.\n    const storage = this._privateKeyStorage!;\n    const loadResult = await storage.load(entry.id);\n    if (loadResult.isSuccess()) {\n      return succeed(loadResult.value);\n    }\n    if (options?.rehydrate !== true || entry.escrowedPrivateKeyJwk === undefined) {\n      return fail(`Failed to load private key for '${name}': ${loadResult.message}`);\n    }\n\n    // Fill-a-gap recovery: import the escrowed key non-extractable where the\n    // backend supports it (extractable otherwise, since a JWK-round-tripping\n    // backend cannot store a non-extractable key), then persist it.\n    const backendExtractable = !storage.supportsNonExtractable;\n    const importResult = await this._importEscrowedPrivateKey(\n      entry.escrowedPrivateKeyJwk,\n      entry.algorithm,\n      backendExtractable\n    );\n    if (importResult.isFailure()) {\n      return fail(`Failed to rehydrate private key for '${name}' from escrow: ${importResult.message}`);\n    }\n\n    const storeResult = await storage.store(entry.id, importResult.value);\n    if (storeResult.isFailure()) {\n      return fail(`Failed to persist rehydrated private key for '${name}': ${storeResult.message}`);\n    }\n    return succeed(importResult.value);\n  }\n\n  /**\n   * Computes the key usages to request when importing an escrowed private JWK.\n   * Mirrors `EncryptedFilePrivateKeyStorage`: intersect the algorithm's private\n   * usages (its keypair usages minus the public-only ones) with the JWK's\n   * recorded `key_ops` so we request exactly the operations the stored key\n   * supports; fall back to the algorithm's private usages when `key_ops` is\n   * absent.\n   */\n  private static _privateKeyUsagesFor(jwk: JsonWebKey, params: IKeyPairAlgorithmParams): KeyUsage[] {\n    const privateUsages = params.keyPairUsages.filter((usage) => !PUBLIC_ONLY_USAGES.includes(usage));\n    const keyOps = jwk.key_ops;\n    if (keyOps === undefined) {\n      return [...privateUsages];\n    }\n    return privateUsages.filter((usage) => keyOps.includes(usage));\n  }\n\n  /**\n   * Constant-time byte comparison. Returns false immediately for length\n   * mismatch (length is not secret); for equal-length inputs, walks the full\n   * buffer accumulating differences via XOR so the running time does not leak\n   * the position of the first differing byte.\n   */\n  private static _timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n    /* c8 ignore next 3 - defensive: callers compare equal-length 32-byte PBKDF2 keys */\n    if (a.length !== b.length) {\n      return false;\n    }\n    let diff = 0;\n    for (let i = 0; i < a.length; i++) {\n      // eslint-disable-next-line no-bitwise\n      diff |= a[i] ^ b[i];\n    }\n    return diff === 0;\n  }\n\n  /**\n   * Mints a fresh UUID v4 storage handle using the crypto provider's\n   * {@link CryptoUtils.ICryptoProvider.generateRandomBytes | generateRandomBytes}.\n   * Random-bytes failures propagate as Failure.\n   */\n  private _generateId(): Result<string> {\n    return this._cryptoProvider.generateRandomBytes(16).onSuccess((bytes) => {\n      // Per RFC 4122 §4.4: set version (4) and variant (10xx) bits.\n      // eslint-disable-next-line no-bitwise\n      bytes[6] = (bytes[6] & 0x0f) | 0x40;\n      // eslint-disable-next-line no-bitwise\n      bytes[8] = (bytes[8] & 0x3f) | 0x80;\n      const hex = Array.from(bytes)\n        .map((b) => b.toString(16).padStart(2, '0'))\n        .join('');\n      return succeed(\n        `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(\n          20,\n          32\n        )}`\n      );\n    });\n  }\n}\n"]}
+{"version":3,"file":"keyStore.js","sourceRoot":"","sources":["../../../../src/packlets/crypto-utils/keystore/keyStore.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,gFAAgF;AAChF,YAAY;AAGZ,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,IAAI,EAAU,OAAO,EAAE,MAAM,eAAe,CAAC;AACzF,OAAO,KAAK,SAAS,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAA2B,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAC5F,OAAO,EASL,kBAAkB,EAGnB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EAqBzB,eAAe,EAGf,eAAe,EAChB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAEnE;;GAEG;AACH,SAAS,mBAAmB;IAC1B,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,6EAA6E;AAC7E,gFAAgF;AAChF,8EAA8E;AAC9E,qDAAqD;AACrD,MAAM,kBAAkB,GAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAErF,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,OAAO,QAAQ;IAWnB,YACE,cAA+B,EAC/B,UAAkB,EAClB,YAAuC,EACvC,KAAc,EACd,iBAAiD;QAEjD,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACtC,IAAI,CAAC,kBAAkB,GAAG,iBAAiB,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;QAC9B,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,+EAA+E;IAC/E,kBAAkB;IAClB,+EAA+E;IAE/E;;;;;;OAMG;IACI,MAAM,CAAC,MAAM,CAAC,MAA6B;;QAChD,MAAM,UAAU,GAAG,MAAA,MAAM,CAAC,UAAU,mCAAI,2BAA2B,CAAC;QACpE,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,OAAO,CACZ,IAAI,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAC3F,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,IAAI,CAAC,MAA2B;QAC5C,2BAA2B;QAC3B,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,2BAA2B,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC;QAC7D,OAAO,OAAO,CACZ,IAAI,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,CAAC,CACnG,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,oBAAoB;IACpB,+EAA+E;IAE/E;;;;;;;OAOG;IACI,KAAK,CAAC,UAAU,CAAC,QAAgB;QACtC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,8DAA8D,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QAED,yDAAyD;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC7E,yFAAyF;QACzF,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,4BAA4B,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,8BAA8B;QAElD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,MAAM,CAAC,QAAgB;QAClC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,0DAA0D,CAAC,CAAC;QAC1E,CAAC;QACD,8EAA8E;QAC9E,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC;QACvD,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACvE,6EAA6E;QAC7E,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,mCAAmC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC;QAE9B,+BAA+B;QAC/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;QACjG,6EAA6E;QAC7E,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,0BAA0B,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,aAAa,CAAC,UAAsB;QAC/C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,0DAA0D,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,gBAAgB,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,eAAe,SAAS,CAAC,gBAAgB,eAAe,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,yGAAyG;QACzG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACI,IAAI,CAAC,KAAe;QACzB,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,6DAA6D,CAAC,CAAC;QAC7E,CAAC;QAED,qDAAqD;QACrD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;oBACxC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QAEpB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,IAAW,UAAU;QACnB,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,IAAW,OAAO;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACH,IAAW,KAAK;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,IAAW,KAAK;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACH,IAAW,cAAc;QACvB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,+EAA+E;IAC/E,oBAAoB;IACpB,+EAA+E;IAE/E;;;;OAIG;IACI,WAAW;QAChB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,SAAS,CAAC,IAAY;QAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAED;;;;;;;OAOG;IACI,eAAe,CAAC,IAAY;QACjC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,WAAW,IAAI,yCAAyC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACI,SAAS,CAAC,IAAY;QAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAA2B;QAC9D,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QAED,4BAA4B;QAC5B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC3D,yFAAyF;QACzF,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,2BAA2B,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,KAAK,GAA4B;YACrC,IAAI;YACJ,IAAI,EAAE,gBAAgB;YACtB,GAAG,EAAE,SAAS,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW;YACjC,SAAS,EAAE,mBAAmB,EAAE;SACjC,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,YAAY,CACvB,IAAY,EACZ,GAAe,EACf,OAA2B;;QAE3B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,gBAAgB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,eAAe,SAAS,CAAC,gBAAgB,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAA,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,WAAW,IAAI,kDAAkD,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,KAAK,GAA4B;YACrC,IAAI;YACJ,IAAI,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,mCAAI,gBAAgB;YACvC,GAAG,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,wCAAwC;YAClE,WAAW,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW;YACjC,SAAS,EAAE,mBAAmB,EAAE;SACjC,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,qBAAqB,CAChC,IAAY,EACZ,QAAgB,EAChB,OAAuC;;QAEvC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAA,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,WAAW,IAAI,kDAAkD,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,UAAU,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,mCAAI,yBAAyB,CAAC;QAEpE,0DAA0D;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC7E,yFAAyF;QACzF,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,4BAA4B,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,+BAA+B;QAC/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC/F,yFAAyF;QACzF,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,0BAA0B,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,KAAK,GAA4B;YACrC,IAAI;YACJ,IAAI,EAAE,gBAAgB;YACtB,GAAG,EAAE,SAAS,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW;YACjC,SAAS,EAAE,mBAAmB,EAAE;SACjC,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,OAAO,OAAO,CAAC;YACb,KAAK;YACL,QAAQ,EAAE,QAAQ,KAAK,SAAS;YAChC,OAAO;YACP,aAAa,EAAE;gBACb,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;gBACrD,UAAU;aACX;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACI,KAAK,CAAC,wBAAwB,CACnC,IAAY,EACZ,QAAgB,EAChB,aAAmC;QAEnC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,oBAAoB,aAAa,CAAC,GAAG,uBAAuB,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,WAAW,IAAI,wDAAwD,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,iBAAiB,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CACxD,QAAQ,EACR,UAAU,CAAC,KAAK,EAChB,aAAa,CAAC,UAAU,CACzB,CAAC;QACF,mFAAmF;QACnF,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,0BAA0B,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,KAAK,CAAC,6BAA6B,CACxC,IAAY,EACZ,QAAgB,EAChB,gBAAmC,EACnC,OAA+C;;QAE/C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAA,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,WAAW,IAAI,kDAAkD,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,MAAM,GAAoB,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,kBAAkB,CAAC;QAEtE,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC7E,yFAAyF;QACzF,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,4BAA4B,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtF,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,mCAAmC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,gBAAgB,EAAE,CAAC;YAC1D,OAAO,IAAI,CACT,gCAAgC,SAAS,CAAC,gBAAgB,8BAA8B,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CACjH,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAA4B;YACrC,IAAI;YACJ,IAAI,EAAE,gBAAgB;YACtB,GAAG,EAAE,SAAS,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW;YACjC,SAAS,EAAE,mBAAmB,EAAE;SACjC,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,MAAM,aAAa,GAAiC;YAClD,GAAG,EAAE,UAAU;YACf,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;YACrD,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC;QAEF,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,gCAAgC,CAC3C,IAAY,EACZ,QAAgB,EAChB,gBAAmC,EACnC,aAA2C;QAE3C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,WAAW,IAAI,wDAAwD,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,iBAAiB,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,MAAM,GAAoB;YAC9B,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,UAAU,EAAE,aAAa,CAAC,UAAU;YACpC,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;SAC9B,CAAC;QAEF,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1F,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,mCAAmC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,YAAY,CAAC,IAAY;QACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC;QAC5C,CAAC;QAED,qEAAqE;QACrE,wCAAwC;QACxC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,YAAY,CACvB,IAAY,EACZ,MAAc,EACd,OAA8B;QAE9B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAA,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,WAAW,IAAI,kDAAkD,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,KAAK,GAA4B;YACrC,IAAI;YACJ,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YAC3B,WAAW,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW;YACjC,SAAS,EAAE,mBAAmB,EAAE;SACjC,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;OAMG;IACI,SAAS,CAAC,IAAY;QAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,WAAW,IAAI,8BAA8B,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,KAAK,CAAC,iBAAiB,CAC5B,IAAY,EACZ,KAAiB,EACjB,OAAmC;QAEnC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAA,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,WAAW,IAAI,kDAAkD,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,KAAK,GAA4B;YACrC,IAAI;YACJ,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,wCAAwC;YACpE,WAAW,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW;YACjC,QAAQ,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ;YAC3B,SAAS,EAAE,mBAAmB,EAAE;SACjC,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;OAUG;IACI,cAAc,CAAC,IAAY;QAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,WAAW,IAAI,4DAA4D,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QACxG,CAAC;QACD,4DAA4D;QAC5D,OAAO,OAAO,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,iBAAiB,CAAC,IAAY,EAAE,KAAgB;QACrD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACxC,OAAO,IAAI,CACT,WAAW,IAAI,sFAAsF,KAAK,CAAC,IAAI,GAAG,CACnH,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,mCACR,KAAK,KACR,QAAQ,EAAE,KAAK,EACf,SAAS,EAAE,mBAAmB,EAAE,GACjC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAED,+EAA+E;IAC/E,gCAAgC;IAChC,+EAA+E;IAE/E;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACI,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,OAA2B;;QAC/D,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,WAAW,IAAI,kDAAkD,CAAC,CAAC;QACjF,CAAC;QAED,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,sEAAsE;QACtE,kEAAkE;QAClE,4BAA4B;QAC5B,MAAM,kBAAkB,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC;QAC3E,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,IAAI,kBAAkB,EAAE,CAAC;YACxD,OAAO,IAAI,CACT,8CAA8C,IAAI,0DAA0D,CAC7G,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,mBAAmB;QACnB,MAAM,eAAe,GAAG,MAAA,OAAO,CAAC,WAAW,mCAAI,kBAAkB,CAAC;QAElE,0EAA0E;QAC1E,qEAAqE;QACrE,oEAAoE;QACpE,0CAA0C;QAC1C,MAAM,mBAAmB,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC;QAC7E,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACzG,6HAA6H;QAC7H,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,mCAAmC,IAAI,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC;QAEtD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC3E,8FAA8F;QAC9F,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,oCAAoC,IAAI,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,mEAAmE;QACnE,oEAAoE;QACpE,4EAA4E;QAC5E,wEAAwE;QACxE,0EAA0E;QAC1E,oEAAoE;QACpE,yEAAyE;QACzE,IAAI,qBAA6C,CAAC;QAClD,IAAI,UAAU,GAAc,UAAU,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC5B,oEAAoE;YACpE,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,MAAM,gBAAgB,GAAG,MAAM,CAC7B,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,CAClD,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,EAA+D,EAAE;gBACzF,IAAI,eAAe,EAAE,CAAC;oBACpB,OAAO,OAAO,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;gBAClD,CAAC;gBACD,OAAO,CAAC,MAAM,IAAI,CAAC,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;qBACzE,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,8CAA8C,IAAI,MAAM,GAAG,EAAE,CAAC;qBACvF,SAAS,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;YACH,gUAAgU;YAChU,IAAI,gBAAgB,CAAC,SAAS,EAAE,EAAE,CAAC;gBACjC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACxC,CAAC;YACD,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,wFAAwF;QACxF,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,kCAAkC,IAAI,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;QAE1B,0EAA0E;QAC1E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACxE,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,sCAAsC,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,KAAK,GAA6B;YACtC,IAAI;YACJ,IAAI,EAAE,oBAAoB;YAC1B,EAAE;YACF,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,YAAY,EAAE,SAAS,CAAC,KAAK;YAC7B,qBAAqB;YACrB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,mBAAmB,EAAE;SACjC,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACI,KAAK,CAAC,UAAU,CACrB,IAAY,EACZ,OAA4B;QAE5B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,WAAW,IAAI,yCAAyC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,CAAC,MAAM,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CACtG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;aACjF,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,uCAAuC,IAAI,MAAM,GAAG,EAAE,CAAC;aAChF,SAAS,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAChE,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,iBAAiB,CAAC,IAAwB;QAC/C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAED;;;;;;OAMG;IACI,YAAY,CAAC,OAAe,EAAE,OAAe;QAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,OAAO,aAAa,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC,WAAW,OAAO,kBAAkB,CAAC,CAAC;QACpD,CAAC;QAED,oEAAoE;QACpE,4DAA4D;QAC5D,MAAM,QAAQ,mCACT,KAAK,KACR,IAAI,EAAE,OAAO,GACd,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAED,+EAA+E;IAC/E,cAAc;IACd,+EAA+E;IAE/E;;;;;;OAMG;IACI,KAAK,CAAC,IAAI,CAAC,QAAgB;QAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QAED,4BAA4B;QAC5B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/F,yFAAyF;QACzF,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,0BAA0B,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,WAAW,CAAC,UAAsB;QAC7C,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,gBAAgB,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,eAAe,SAAS,CAAC,gBAAgB,eAAe,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,cAAc,CAAC,eAAuB,EAAE,WAAmB;QACtE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC9C,CAAC;QAED,6DAA6D;QAC7D,mEAAmE;QACnE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAC1F,6EAA6E;YAC7E,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,mCAAmC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CACpD,eAAe,EACf,UAAU,CAAC,KAAK,EAChB,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,UAAU,CAC5C,CAAC;YACF,6EAA6E;YAC7E,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,0BAA0B,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,oCAAoC;YACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAClF,MAAM,mBAAmB,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;YAE9F,6EAA6E;YAC7E,IAAI,QAAQ,CAAC,SAAS,EAAE,IAAI,aAAa,CAAC,SAAS,EAAE,IAAI,mBAAmB,CAAC,SAAS,EAAE,EAAE,CAAC;gBACzF,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC/C,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CACtD,mBAAmB,CAAC,KAAK,EACzB,SAAS,CAAC,KAAK,EACf,QAAQ,CAAC,KAAK,EACd,aAAa,CAAC,KAAK,CACpB,CAAC;YACF,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC7E,yFAAyF;QACzF,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,4BAA4B,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,yBAAyB;QACzB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChD,6EAA6E;QAC7E,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,+EAA+E;IAC/E,sBAAsB;IACtB,+EAA+E;IAE/E,sDAAsD;IAC/C,KAAK,CAAC,aAAa,CACxB,UAAkB,EAClB,OAAkB,EAClB,QAAoB;QAEpB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,kBAAkB,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACrD,OAAO,IAAI,CACT,0BAA0B,UAAU,wDAAwD,CAC7F,CAAC;QACJ,CAAC;QAED,OAAO,mBAAmB,CAAC;YACzB,OAAO;YACP,UAAU;YACV,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG;YAC3B,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,qCAAqC;IACrC,+EAA+E;IAE/E;;;;;OAKG;IACI,iBAAiB;QACtB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,MAAM,QAAQ,GAAmB,KAAK,EAAE,UAAkB,EAA+B,EAAE;YACzF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,WAAW,UAAU,0BAA0B,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC,WAAW,UAAU,wDAAwD,CAAC,CAAC;YAC7F,CAAC;YACD,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC,CAAC;QAEF,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACI,mBAAmB;QACxB,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAChD,IAAI,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,OAAO,CAAC;YACb,cAAc,EAAE,cAAc,CAAC,KAAK;YACpC,cAAc,EAAE,IAAI,CAAC,eAAe;SACrC,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,yCAAyC;IACzC,+EAA+E;IAE/E;;;OAGG;IACK,KAAK,CAAC,aAAa,CAAC,UAAsB;QAChD,6DAA6D;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAS,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAM,CAAC;QAEzB,uBAAuB;QACvB,MAAM,aAAa,GAAuC,EAAE,CAAC;QAC7D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBACxC,aAAa,CAAC,IAAI,CAAC,GAAG;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;oBAClD,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,aAAa,CAAC,IAAI,CAAC,GAAG;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;oBAC7C,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAA2B;YAC5C,OAAO,EAAE,eAAe;YACxB,OAAO,EAAE,aAAa;SACvB,CAAC;QAEF,wBAAwB;QACxB,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;QACtE,6EAA6E;QAC7E,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,8BAA8B,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACvF,yFAAyF;QACzF,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,sBAAsB,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC;QAE3D,MAAM,gBAAgB,GAAkB;YACtC,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,SAAS,CAAC,iBAAiB;YACtC,EAAE,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC/C,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC3D,aAAa,EAAE;gBACb,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACzC,UAAU,EAAE,IAAI,CAAC,WAAW;aAC7B;SACF,CAAC;QAEF,IAAI,CAAC,aAAa,GAAG,gBAAgB,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QAEpB,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACnC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa,CAAC,UAAsB;QAChD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,sGAAsG;QACtG,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5E,MAAM,mBAAmB,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAExF,uFAAuF;QACvF,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,iCAAiC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,uCAAuC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,mBAAmB,CAAC,SAAS,EAAE,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,6CAA6C,mBAAmB,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CACtD,mBAAmB,CAAC,KAAK,EACzB,UAAU,EACV,QAAQ,CAAC,KAAK,EACd,aAAa,CAAC,KAAK,CACpB,CAAC;QACF,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC3D,CAAC;QAED,2BAA2B;QAC3B,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAY,CAAC,CAAC;QACpF,6EAA6E;QAC7E,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,mCAAmC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrE,6EAA6E;QAC7E,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,yBAAyB,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACpF,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,mCAAmC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1E,IAAI,SAAS,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBAC5C,MAAM,KAAK,GAA6B;oBACtC,IAAI;oBACJ,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,EAAE,EAAE,SAAS,CAAC,EAAE;oBAChB,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,YAAY,EAAE,SAAS,CAAC,YAAY;oBACpC,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;oBACtD,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,SAAS,EAAE,SAAS,CAAC,SAAS;iBAC/B,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACtE,6EAA6E;gBAC7E,IAAI,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC;oBAC/B,OAAO,IAAI,CAAC,2BAA2B,IAAI,MAAM,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7E,CAAC;gBACD,MAAM,KAAK,GAA4B;oBACrC,IAAI;oBACJ,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,GAAG,EAAE,cAAc,CAAC,KAAK;oBACzB,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,SAAS,EAAE,SAAS,CAAC,SAAS;iBAC/B,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QAEpB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,+EAA+E;IAC/E,wCAAwC;IACxC,+EAA+E;IAE/E;;;;;;;;;OASG;IACK,KAAK,CAAC,sBAAsB,CAAC,KAAqB;QACxD,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC7B,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpE,IAAI,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC7B,OAAO,4CAA4C,KAAK,CAAC,IAAI,SAAS,KAAK,CAAC,EAAE,MAAM,YAAY,CAAC,OAAO,EAAE,CAAC;YAC7G,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,oBAAoB,CAAC,UAAqB,EAAE,IAAY;QACpE,OAAO,kBAAkB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,eAAe,CACpG,CAAC,GAAG,EAAE,EAAE,CAAC,+CAA+C,IAAI,MAAM,GAAG,EAAE,CACxE,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,yBAAyB,CACrC,GAAe,EACf,SAA2B,EAC3B,WAAoB;QAEpB,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC1D,OAAO,kBAAkB,CAAC,GAAG,EAAE,CAC7B,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,eAAe,EAAE,WAAW,EAAE,MAAM,CAAC,CAC5F,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,0BAA0B,CACtC,IAAY,EACZ,KAA+B,EAC/B,OAAuC;QAEvC,oDAAoD;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAmB,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,MAAK,IAAI,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAC,mCAAmC,IAAI,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,kBAAkB,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC;QAC3D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,yBAAyB,CACvD,KAAK,CAAC,qBAAqB,EAC3B,KAAK,CAAC,SAAS,EACf,kBAAkB,CACnB,CAAC;QACF,IAAI,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,wCAAwC,IAAI,kBAAkB,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,iDAAiD,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,oBAAoB,CAAC,GAAe,EAAE,MAA+B;QAClF,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAClG,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;QAC3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,gBAAgB,CAAC,CAAa,EAAE,CAAa;QAC1D,oFAAoF;QACpF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,sCAAsC;YACtC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,KAAK,CAAC,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACK,WAAW;QACjB,OAAO,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;YACtE,8DAA8D;YAC9D,sCAAsC;YACtC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YACpC,sCAAsC;YACtC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YACpC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;iBAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;iBAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,OAAO,OAAO,CACZ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAC3F,EAAE,EACF,EAAE,CACH,EAAE,CACJ,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF","sourcesContent":["// Copyright (c) 2026 Erik Fortune\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal\n// in the Software without restriction, including without limitation the rights\n// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n// copies of the Software, and to permit persons to whom the Software is\n// furnished to do so, subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all\n// copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n// SOFTWARE.\n\nimport { JsonValue } from '@fgv/ts-json-base';\nimport { captureAsyncResult, captureResult, fail, Result, succeed } from '@fgv/ts-utils';\nimport * as Constants from '../constants';\nimport { createEncryptedFile } from '../encryptedFile';\nimport { IKeyPairAlgorithmParams, keyPairAlgorithmParams } from '../keyPairAlgorithmParams';\nimport {\n  ICryptoProvider,\n  IEncryptedFile,\n  IEncryptionConfig,\n  IEncryptionProvider,\n  IArgon2idKeyDerivationParams,\n  IArgon2idProvider,\n  IArgon2idParams,\n  IKeyDerivationParams,\n  ARGON2ID_OWASP_MIN,\n  KeyPairAlgorithm,\n  SecretProvider\n} from '../model';\nimport {\n  DEFAULT_KEYSTORE_ITERATIONS,\n  DEFAULT_SECRET_ITERATIONS,\n  IAddKeyPairOptions,\n  IAddKeyPairResult,\n  IAddSecretFromPasswordArgon2idOptions,\n  IAddSecretFromPasswordOptions,\n  IAddSecretFromPasswordResult,\n  IAddSecretOptions,\n  IAddSecretResult,\n  IGetKeyPairOptions,\n  IImportKeyOptions,\n  IImportSecretBytesOptions,\n  IImportSecretOptions,\n  IKeyStoreAsymmetricEntry,\n  IKeyStoreCreateParams,\n  IKeyStoreEntry,\n  IKeyStoreEntryJson,\n  IKeyStoreFile,\n  IKeyStoreOpenParams,\n  IKeyStoreSymmetricEntry,\n  IKeyStoreVaultContents,\n  IRemoveSecretResult,\n  KEYSTORE_FORMAT,\n  KeyStoreLockState,\n  KeyStoreSecretType,\n  MIN_SALT_LENGTH\n} from './model';\nimport { IPrivateKeyStorage } from './privateKeyStorage';\nimport { keystoreFile, keystoreVaultContents } from './converters';\n\n/**\n * Gets the current ISO timestamp.\n */\nfunction getCurrentTimestamp(): string {\n  return new Date().toISOString();\n}\n\n// WebCrypto key usages that only ever apply to a public key. Filtering these\n// out of the keypair usages yields the usages valid for the private half, which\n// `crypto.subtle.importKey` requires when re-importing a private JWK. Mirrors\n// the same list in `EncryptedFilePrivateKeyStorage`.\nconst PUBLIC_ONLY_USAGES: ReadonlyArray<KeyUsage> = ['verify', 'encrypt', 'wrapKey'];\n\n// ============================================================================\n// KeyStore Class\n// ============================================================================\n\n/**\n * Password-protected key store for managing encryption secrets.\n *\n * The KeyStore provides a secure vault for storing named encryption keys.\n * The vault is encrypted at rest using a master password via PBKDF2 key derivation.\n *\n * @example\n * ```typescript\n * // Create new key store\n * const keystore = KeyStore.create({ cryptoProvider: nodeCryptoProvider }).orThrow();\n * await keystore.initialize('master-password');\n *\n * // Add secrets\n * await keystore.addSecret('my-key', { description: 'Production key' });\n *\n * // Save to file\n * const fileContent = await keystore.save();\n *\n * // Later: Open existing key store\n * const keystore2 = KeyStore.open({\n *   cryptoProvider: nodeCryptoProvider,\n *   keystoreFile: fileContent.value\n * }).orThrow();\n * await keystore2.unlock('master-password');\n *\n * // Use as secret provider for encrypted file loading\n * const encryptionConfig = keystore2.getEncryptionConfig().orThrow();\n * ```\n *\n * @remarks\n * SECURITY — private-key escrow. By default an asymmetric keypair's private\n * key lives only in the per-device {@link CryptoUtils.KeyStore.IPrivateKeyStorage}\n * backend; the vault carries only the public JWK, so a vault recovered on a new\n * device reconstitutes with no private keys (a lost device is a lost identity).\n * `addKeyPair(name, { escrow: true })` opts into carrying an encrypted private-key\n * copy inside the vault ciphertext, so the vault file plus the master password can\n * recover the identity on a fresh device via `getKeyPair(name, { rehydrate: true })`.\n *\n * When escrow is used, **the master password becomes the sole gate** protecting a\n * private signing/decryption key that was previously unrecoverable from the vault.\n * Configure escrow-bearing stores with a strong KDF — an Argon2id-derived master\n * key or a high-iteration PBKDF2 count — and treat the vault file accordingly.\n *\n * @public\n */\nexport class KeyStore implements IEncryptionProvider {\n  private readonly _cryptoProvider: ICryptoProvider;\n  private readonly _privateKeyStorage: IPrivateKeyStorage | undefined;\n  private readonly _iterations: number;\n  private _keystoreFile: IKeyStoreFile | undefined;\n  private _salt: Uint8Array | undefined;\n  private _secrets: Map<string, IKeyStoreEntry> | undefined;\n  private _state: KeyStoreLockState;\n  private _dirty: boolean;\n  private _isNew: boolean;\n\n  private constructor(\n    cryptoProvider: ICryptoProvider,\n    iterations: number,\n    keystoreFile: IKeyStoreFile | undefined,\n    isNew: boolean,\n    privateKeyStorage: IPrivateKeyStorage | undefined\n  ) {\n    this._cryptoProvider = cryptoProvider;\n    this._privateKeyStorage = privateKeyStorage;\n    this._iterations = iterations;\n    this._keystoreFile = keystoreFile;\n    this._state = 'locked';\n    this._dirty = false;\n    this._isNew = isNew;\n  }\n\n  // ============================================================================\n  // Factory Methods\n  // ============================================================================\n\n  /**\n   * Creates a new, empty key store.\n   * Call `initialize(password)` to set the master password.\n   * @param params - Creation parameters\n   * @returns Success with new KeyStore instance, or Failure if parameters invalid\n   * @public\n   */\n  public static create(params: IKeyStoreCreateParams): Result<KeyStore> {\n    const iterations = params.iterations ?? DEFAULT_KEYSTORE_ITERATIONS;\n    if (iterations < 1) {\n      return fail('Iterations must be at least 1');\n    }\n    return succeed(\n      new KeyStore(params.cryptoProvider, iterations, undefined, true, params.privateKeyStorage)\n    );\n  }\n\n  /**\n   * Opens an existing encrypted key store.\n   * Call `unlock(password)` to decrypt and access secrets.\n   * @param params - Open parameters including the encrypted file\n   * @returns Success with KeyStore instance, or Failure if file format invalid\n   * @public\n   */\n  public static open(params: IKeyStoreOpenParams): Result<KeyStore> {\n    // Validate the file format\n    const fileResult = keystoreFile.convert(params.keystoreFile);\n    if (fileResult.isFailure()) {\n      return fail(`Invalid key store file: ${fileResult.message}`);\n    }\n\n    const iterations = fileResult.value.keyDerivation.iterations;\n    return succeed(\n      new KeyStore(params.cryptoProvider, iterations, fileResult.value, false, params.privateKeyStorage)\n    );\n  }\n\n  // ============================================================================\n  // Lifecycle Methods\n  // ============================================================================\n\n  /**\n   * Initializes a new key store with the master password.\n   * Generates a random salt for key derivation.\n   * Only valid for newly created (not opened) key stores.\n   * @param password - The master password\n   * @returns Success with this instance when initialized, Failure if already initialized or opened\n   * @public\n   */\n  public async initialize(password: string): Promise<Result<KeyStore>> {\n    if (!this._isNew) {\n      return fail('Cannot initialize an opened key store - use unlock() instead');\n    }\n    if (this._state === 'unlocked') {\n      return fail('Key store is already initialized');\n    }\n    if (!password || password.length === 0) {\n      return fail('Password cannot be empty');\n    }\n\n    // Generate salt for this key store using crypto provider\n    const saltResult = this._cryptoProvider.generateRandomBytes(MIN_SALT_LENGTH);\n    /* c8 ignore next 3 - crypto provider errors tested but coverage intermittently missed */\n    if (saltResult.isFailure()) {\n      return fail(`Failed to generate salt: ${saltResult.message}`);\n    }\n\n    this._salt = saltResult.value;\n    this._secrets = new Map();\n    this._state = 'unlocked';\n    this._dirty = true; // New store needs to be saved\n\n    return succeed(this);\n  }\n\n  /**\n   * Unlocks an existing key store with the master password.\n   * Decrypts the vault and loads secrets into memory.\n   * @param password - The master password\n   * @returns Success with this instance when unlocked, Failure if password incorrect\n   * @public\n   */\n  public async unlock(password: string): Promise<Result<KeyStore>> {\n    if (this._isNew) {\n      return fail('Cannot unlock a new key store - use initialize() instead');\n    }\n    /* c8 ignore next 6 - error paths tested but coverage intermittently missed */\n    if (this._state === 'unlocked') {\n      return fail('Key store is already unlocked');\n    }\n    if (!this._keystoreFile) {\n      return fail('No key store file to unlock');\n    }\n\n    const keyDerivation = this._keystoreFile.keyDerivation;\n    const saltResult = this._cryptoProvider.fromBase64(keyDerivation.salt);\n    /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n    if (saltResult.isFailure()) {\n      return fail(`Invalid salt in key store file: ${saltResult.message}`);\n    }\n    const salt = saltResult.value;\n\n    // Derive the key from password\n    const keyResult = await this._cryptoProvider.deriveKey(password, salt, keyDerivation.iterations);\n    /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n    if (keyResult.isFailure()) {\n      return fail(`Key derivation failed: ${keyResult.message}`);\n    }\n\n    return this._decryptVault(keyResult.value);\n  }\n\n  /**\n   * Unlocks an existing key store with a pre-derived key, bypassing\n   * PBKDF2 key derivation. Use this when the derived key has been\n   * stored externally (e.g., in another key store) and the original\n   * password is no longer available.\n   *\n   * The supplied key must have been derived from the correct password\n   * using the key store file's own PBKDF2 parameters (salt and\n   * iteration count).\n   *\n   * @param derivedKey - The pre-derived master key (32 bytes for AES-256)\n   * @returns Success with this instance when unlocked, Failure if key is incorrect\n   * @public\n   */\n  public async unlockWithKey(derivedKey: Uint8Array): Promise<Result<KeyStore>> {\n    if (this._isNew) {\n      return fail('Cannot unlock a new key store - use initialize() instead');\n    }\n    if (this._state === 'unlocked') {\n      return fail('Key store is already unlocked');\n    }\n    if (derivedKey.length !== Constants.AES_256_KEY_SIZE) {\n      return fail(`Key must be ${Constants.AES_256_KEY_SIZE} bytes, got ${derivedKey.length}`);\n    }\n    /* c8 ignore next 3 - defensive coding: unreachable via public API (open sets file, create sets isNew) */\n    if (!this._keystoreFile) {\n      return fail('No key store file to unlock');\n    }\n\n    return this._decryptVault(derivedKey);\n  }\n\n  /**\n   * Locks the key store, clearing all secrets from memory.\n   * @param force - If true, discards unsaved changes\n   * @returns Success when locked, Failure if unsaved changes and !force\n   * @public\n   */\n  public lock(force?: boolean): Result<KeyStore> {\n    if (this._state === 'locked') {\n      return succeed(this);\n    }\n\n    if (this._dirty && !force) {\n      return fail('Unsaved changes - use force=true to discard or save() first');\n    }\n\n    // Clear secrets from memory (overwrite for security)\n    if (this._secrets) {\n      for (const entry of this._secrets.values()) {\n        if (entry.type !== 'asymmetric-keypair') {\n          entry.key.fill(0);\n        }\n      }\n      this._secrets.clear();\n      this._secrets = undefined;\n    }\n\n    this._state = 'locked';\n    this._dirty = false;\n\n    return succeed(this);\n  }\n\n  /**\n   * Checks if the key store is unlocked.\n   * @public\n   */\n  public get isUnlocked(): boolean {\n    return this._state === 'unlocked';\n  }\n\n  /**\n   * Checks if there are unsaved changes.\n   * @public\n   */\n  public get isDirty(): boolean {\n    return this._dirty;\n  }\n\n  /**\n   * Whether this is a newly created key store (not opened from a file).\n   * A new key store must be initialized with a password before use.\n   * An opened key store must be unlocked with the existing password.\n   * @public\n   */\n  public get isNew(): boolean {\n    return this._isNew;\n  }\n\n  /**\n   * Gets the current lock state.\n   * @public\n   */\n  public get state(): KeyStoreLockState {\n    return this._state;\n  }\n\n  /**\n   * Gets the crypto provider used by this key store.\n   * Available regardless of lock state.\n   * @public\n   */\n  public get cryptoProvider(): ICryptoProvider {\n    return this._cryptoProvider;\n  }\n\n  // ============================================================================\n  // Secret Management\n  // ============================================================================\n\n  /**\n   * Lists all secret names in the key store.\n   * @returns Success with array of secret names, Failure if locked\n   * @public\n   */\n  public listSecrets(): Result<readonly string[]> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    return succeed(Array.from(this._secrets.keys()));\n  }\n\n  /**\n   * Gets a secret by name. Returns the {@link CryptoUtils.KeyStore.IKeyStoreEntry | discriminated union}\n   * — callers must check `entry.type` before accessing `key`/`id` since asymmetric\n   * entries carry no raw key material.\n   *\n   * SECURITY: for an escrow-enabled asymmetric-keypair entry the returned object\n   * carries `escrowedPrivateKeyJwk` in cleartext (same custody class as\n   * `publicKeyJwk`, gated by the same unlock) — do not log or serialize a\n   * `getSecret()` result casually.\n   *\n   * @param name - Name of the secret\n   * @returns Success with secret entry, Failure if not found or locked\n   * @public\n   */\n  public getSecret(name: string): Result<IKeyStoreEntry> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    const entry = this._secrets.get(name);\n    if (!entry) {\n      return fail(`Secret '${name}' not found`);\n    }\n    return succeed(entry);\n  }\n\n  /**\n   * Returns the public-key JWK for an asymmetric-keypair entry.\n   * Available without {@link CryptoUtils.KeyStore.IPrivateKeyStorage} since the\n   * public key lives in the vault metadata directly.\n   * @param name - Name of the entry\n   * @returns Success with the JWK, Failure if not found, locked, or wrong type\n   * @public\n   */\n  public getPublicKeyJwk(name: string): Result<JsonWebKey> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    const entry = this._secrets.get(name);\n    if (!entry) {\n      return fail(`Secret '${name}' not found`);\n    }\n    if (entry.type !== 'asymmetric-keypair') {\n      return fail(`Secret '${name}' is not an asymmetric keypair (type: ${entry.type})`);\n    }\n    return succeed(entry.publicKeyJwk);\n  }\n\n  /**\n   * Checks if a secret exists.\n   * @param name - Name of the secret\n   * @returns Success with boolean, Failure if locked\n   * @public\n   */\n  public hasSecret(name: string): Result<boolean> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    return succeed(this._secrets.has(name));\n  }\n\n  /**\n   * Adds a new secret with a randomly generated key.\n   * @param name - Unique name for the secret\n   * @param options - Optional description\n   * @returns Success with the generated entry, Failure if locked or name invalid\n   * @public\n   */\n  public async addSecret(name: string, options?: IAddSecretOptions): Promise<Result<IAddSecretResult>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!name || name.length === 0) {\n      return fail('Secret name cannot be empty');\n    }\n\n    // Generate a new random key\n    const keyResult = await this._cryptoProvider.generateKey();\n    /* c8 ignore next 3 - crypto provider errors tested but coverage intermittently missed */\n    if (keyResult.isFailure()) {\n      return fail(`Failed to generate key: ${keyResult.message}`);\n    }\n\n    const entry: IKeyStoreSymmetricEntry = {\n      name,\n      type: 'encryption-key',\n      key: keyResult.value,\n      description: options?.description,\n      createdAt: getCurrentTimestamp()\n    };\n\n    const existing = this._secrets.get(name);\n    const warning = existing ? await this._releaseEntryResources(existing) : undefined;\n\n    this._secrets.set(name, entry);\n    this._dirty = true;\n\n    return succeed({ entry, replaced: existing !== undefined, warning });\n  }\n\n  /**\n   * Imports raw 32-byte key material into the vault.\n   *\n   * Always validates that the key is exactly 32 bytes (AES-256). The optional\n   * `type` field is a classification label stored with the entry; it does not\n   * change the validation rules.  For importing UTF-8 API key strings (variable\n   * length), use {@link KeyStore.importApiKey} instead.\n   *\n   * @param name - Unique name for the secret\n   * @param key - The 32-byte AES-256 key material\n   * @param options - Optional type classification, description, whether to replace existing\n   * @returns Success with entry, Failure if locked, key invalid, or exists and !replace\n   * @public\n   */\n  public async importSecret(\n    name: string,\n    key: Uint8Array,\n    options?: IImportKeyOptions\n  ): Promise<Result<IAddSecretResult>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!name || name.length === 0) {\n      return fail('Secret name cannot be empty');\n    }\n    if (key.length !== Constants.AES_256_KEY_SIZE) {\n      return fail(`Key must be ${Constants.AES_256_KEY_SIZE} bytes, got ${key.length}`);\n    }\n\n    const existing = this._secrets.get(name);\n    if (existing && !options?.replace) {\n      return fail(`Secret '${name}' already exists - use replace=true to overwrite`);\n    }\n\n    const entry: IKeyStoreSymmetricEntry = {\n      name,\n      type: options?.type ?? 'encryption-key',\n      key: new Uint8Array(key), // Copy to prevent external modification\n      description: options?.description,\n      createdAt: getCurrentTimestamp()\n    };\n\n    const warning = existing ? await this._releaseEntryResources(existing) : undefined;\n    this._secrets.set(name, entry);\n    this._dirty = true;\n\n    return succeed({ entry, replaced: existing !== undefined, warning });\n  }\n\n  /**\n   * Adds a secret derived from a password using PBKDF2.\n   *\n   * Generates a random salt, derives a 32-byte AES-256 key from the password,\n   * and stores it in the vault. Returns the key derivation parameters so they\n   * can be stored alongside encrypted files, enabling decryption with just the\n   * password (without unlocking the keystore).\n   *\n   * @param name - Unique name for the secret\n   * @param password - Password to derive the key from\n   * @param options - Optional description, iterations, replace flag\n   * @returns Success with entry and keyDerivation params, Failure if locked or invalid\n   * @public\n   */\n  public async addSecretFromPassword(\n    name: string,\n    password: string,\n    options?: IAddSecretFromPasswordOptions\n  ): Promise<Result<IAddSecretFromPasswordResult>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!name || name.length === 0) {\n      return fail('Secret name cannot be empty');\n    }\n    if (!password || password.length === 0) {\n      return fail('Password cannot be empty');\n    }\n\n    const existing = this._secrets.get(name);\n    if (existing && !options?.replace) {\n      return fail(`Secret '${name}' already exists - use replace=true to overwrite`);\n    }\n\n    const iterations = options?.iterations ?? DEFAULT_SECRET_ITERATIONS;\n\n    // Generate a random salt for this secret's key derivation\n    const saltResult = this._cryptoProvider.generateRandomBytes(MIN_SALT_LENGTH);\n    /* c8 ignore next 3 - crypto provider errors tested but coverage intermittently missed */\n    if (saltResult.isFailure()) {\n      return fail(`Failed to generate salt: ${saltResult.message}`);\n    }\n\n    // Derive the key from password\n    const keyResult = await this._cryptoProvider.deriveKey(password, saltResult.value, iterations);\n    /* c8 ignore next 3 - crypto provider errors tested but coverage intermittently missed */\n    if (keyResult.isFailure()) {\n      return fail(`Key derivation failed: ${keyResult.message}`);\n    }\n\n    const entry: IKeyStoreSymmetricEntry = {\n      name,\n      type: 'encryption-key',\n      key: keyResult.value,\n      description: options?.description,\n      createdAt: getCurrentTimestamp()\n    };\n\n    const warning = existing ? await this._releaseEntryResources(existing) : undefined;\n    this._secrets.set(name, entry);\n    this._dirty = true;\n\n    return succeed({\n      entry,\n      replaced: existing !== undefined,\n      warning,\n      keyDerivation: {\n        kdf: 'pbkdf2',\n        salt: this._cryptoProvider.toBase64(saltResult.value),\n        iterations\n      }\n    });\n  }\n\n  /**\n   * Verifies that a candidate password derives the same key material currently\n   * stored under `name`, using the supplied\n   * {@link CryptoUtils.IKeyDerivationParams | key derivation parameters}.\n   *\n   * The keystore does not persist per-slot key derivation parameters with the\n   * entry — callers receive them from `addSecretFromPassword` and store them\n   * alongside the encrypted artifact (or wherever else makes sense). Pass\n   * those same parameters here for verification.\n   *\n   * Re-derives a key from `password` + `keyDerivation`, then compares it to\n   * the stored key material in constant time. Restricted to entries of type\n   * `'encryption-key'` — the type produced by `addSecretFromPassword`. Other\n   * symmetric types (`'api-key'`) and asymmetric entries are rejected so\n   * the boolean result reflects \"this slot accepts this password\" rather\n   * than an incidental byte-equality match against unrelated material.\n   *\n   * Note: the keystore does not currently flag whether an `'encryption-key'`\n   * entry was actually password-derived (vs. random via `addSecret` or raw\n   * via `importSecret`). A `true` result therefore means \"the candidate\n   * password produces the same 32 bytes currently stored\", which is what\n   * the equivalent consumer-side helper (`verifyGatePassword`) already\n   * implies for entries it manages.\n   *\n   * @param name - Name of the secret to verify against\n   * @param password - Candidate password to test\n   * @param keyDerivation - The key derivation parameters returned by\n   * `addSecretFromPassword` when the secret was created. Only\n   * `kdf: 'pbkdf2'` is supported.\n   * @returns Success(true) when the candidate matches the stored key,\n   * Success(false) when it does not, Failure if locked, secret missing,\n   * wrong type, unsupported `kdf`, or key derivation fails\n   * @public\n   */\n  public async verifySecretFromPassword(\n    name: string,\n    password: string,\n    keyDerivation: IKeyDerivationParams\n  ): Promise<Result<boolean>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!password || password.length === 0) {\n      return fail('Password cannot be empty');\n    }\n    if (keyDerivation.kdf !== 'pbkdf2') {\n      return fail(`Unsupported kdf '${keyDerivation.kdf}' (expected 'pbkdf2')`);\n    }\n\n    const entry = this._secrets.get(name);\n    if (!entry) {\n      return fail(`Secret '${name}' not found`);\n    }\n    if (entry.type !== 'encryption-key') {\n      return fail(`Secret '${name}' is not a password-verifiable encryption key (type: ${entry.type})`);\n    }\n\n    const saltResult = this._cryptoProvider.fromBase64(keyDerivation.salt);\n    if (saltResult.isFailure()) {\n      return fail(`Invalid salt: ${saltResult.message}`);\n    }\n\n    const derivedResult = await this._cryptoProvider.deriveKey(\n      password,\n      saltResult.value,\n      keyDerivation.iterations\n    );\n    /* c8 ignore next 3 - crypto provider errors covered in nodeCryptoProvider tests */\n    if (derivedResult.isFailure()) {\n      return fail(`Key derivation failed: ${derivedResult.message}`);\n    }\n\n    return succeed(KeyStore._timingSafeEqual(derivedResult.value, entry.key));\n  }\n\n  /**\n   * Adds a secret derived from a password using Argon2id (RFC 9106).\n   *\n   * The Argon2id provider must be supplied explicitly; the KeyStore does not\n   * hold one by default (consumers opt in by depending on the argon2 package).\n   *\n   * Returns the key derivation parameters so callers can store them alongside\n   * encrypted artifacts, enabling future re-derivation and verification.\n   *\n   * @param name - Unique name for the secret\n   * @param password - Password or passphrase\n   * @param argon2idProvider - Argon2id provider (Node or Browser implementation)\n   * @param options - Optional: Argon2id params (defaults to ARGON2ID_OWASP_MIN), description, replace flag\n   * @returns Success with entry and keyDerivation params, Failure if locked or invalid\n   * @public\n   */\n  public async addSecretFromPasswordArgon2id(\n    name: string,\n    password: string,\n    argon2idProvider: IArgon2idProvider,\n    options?: IAddSecretFromPasswordArgon2idOptions\n  ): Promise<Result<IAddSecretFromPasswordResult>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!name || name.length === 0) {\n      return fail('Secret name cannot be empty');\n    }\n    if (!password || password.length === 0) {\n      return fail('Password cannot be empty');\n    }\n\n    const existing = this._secrets.get(name);\n    if (existing && !options?.replace) {\n      return fail(`Secret '${name}' already exists - use replace=true to overwrite`);\n    }\n\n    const params: IArgon2idParams = options?.params ?? ARGON2ID_OWASP_MIN;\n\n    const saltResult = this._cryptoProvider.generateRandomBytes(MIN_SALT_LENGTH);\n    /* c8 ignore next 3 - crypto provider errors tested but coverage intermittently missed */\n    if (saltResult.isFailure()) {\n      return fail(`Failed to generate salt: ${saltResult.message}`);\n    }\n\n    const keyResult = await argon2idProvider.argon2id(password, saltResult.value, params);\n    if (keyResult.isFailure()) {\n      return fail(`Argon2id key derivation failed: ${keyResult.message}`);\n    }\n    if (keyResult.value.length !== Constants.AES_256_KEY_SIZE) {\n      return fail(\n        `Argon2id outputBytes must be ${Constants.AES_256_KEY_SIZE} for KeyStore secrets, got ${keyResult.value.length}`\n      );\n    }\n\n    const entry: IKeyStoreSymmetricEntry = {\n      name,\n      type: 'encryption-key',\n      key: keyResult.value,\n      description: options?.description,\n      createdAt: getCurrentTimestamp()\n    };\n\n    const warning = existing ? await this._releaseEntryResources(existing) : undefined;\n    this._secrets.set(name, entry);\n    this._dirty = true;\n\n    const keyDerivation: IArgon2idKeyDerivationParams = {\n      kdf: 'argon2id',\n      salt: this._cryptoProvider.toBase64(saltResult.value),\n      memoryKiB: params.memoryKiB,\n      iterations: params.iterations,\n      parallelism: params.parallelism\n    };\n\n    return succeed({ entry, replaced: existing !== undefined, warning, keyDerivation });\n  }\n\n  /**\n   * Verifies a candidate password against an Argon2id-derived entry using the\n   * supplied key derivation parameters. Constant-time comparison.\n   *\n   * @param name - Name of the secret to verify against\n   * @param password - Candidate password to test\n   * @param argon2idProvider - Argon2id provider (must produce bit-identical output for identical inputs)\n   * @param keyDerivation - The Argon2id key derivation parameters returned by `addSecretFromPasswordArgon2id`\n   * @returns Success(true) if candidate matches stored key, Success(false) if not,\n   * Failure if locked, secret missing, wrong type, or derivation fails\n   * @public\n   */\n  public async verifySecretFromPasswordArgon2id(\n    name: string,\n    password: string,\n    argon2idProvider: IArgon2idProvider,\n    keyDerivation: IArgon2idKeyDerivationParams\n  ): Promise<Result<boolean>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!password || password.length === 0) {\n      return fail('Password cannot be empty');\n    }\n\n    const entry = this._secrets.get(name);\n    if (!entry) {\n      return fail(`Secret '${name}' not found`);\n    }\n    if (entry.type !== 'encryption-key') {\n      return fail(`Secret '${name}' is not a password-verifiable encryption key (type: ${entry.type})`);\n    }\n\n    const saltResult = this._cryptoProvider.fromBase64(keyDerivation.salt);\n    if (saltResult.isFailure()) {\n      return fail(`Invalid salt: ${saltResult.message}`);\n    }\n\n    const params: IArgon2idParams = {\n      memoryKiB: keyDerivation.memoryKiB,\n      iterations: keyDerivation.iterations,\n      parallelism: keyDerivation.parallelism,\n      outputBytes: entry.key.length\n    };\n\n    const derivedResult = await argon2idProvider.argon2id(password, saltResult.value, params);\n    if (derivedResult.isFailure()) {\n      return fail(`Argon2id key derivation failed: ${derivedResult.message}`);\n    }\n\n    return succeed(KeyStore._timingSafeEqual(derivedResult.value, entry.key));\n  }\n\n  /**\n   * Removes a secret by name. Vault-first: the in-memory vault entry is dropped\n   * before any storage cleanup runs. For asymmetric-keypair entries, best-effort\n   * calls {@link CryptoUtils.KeyStore.IPrivateKeyStorage}.delete on the entry's\n   * `id`; a failure is reported via `warning` on the result but does not roll\n   * back the vault removal.\n   * @param name - Name of the secret to remove\n   * @returns Success with removed entry (and optional warning), Failure if not found or locked\n   * @public\n   */\n  public async removeSecret(name: string): Promise<Result<IRemoveSecretResult>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n\n    const entry = this._secrets.get(name);\n    if (!entry) {\n      return fail(`Secret '${name}' not found`);\n    }\n\n    // Vault-first: drop the in-memory entry before touching storage so a\n    // storage failure cannot block removal.\n    this._secrets.delete(name);\n    this._dirty = true;\n\n    const warning = await this._releaseEntryResources(entry);\n    return succeed({ entry, warning });\n  }\n\n  /**\n   * Imports an API key string into the vault.\n   * The string is UTF-8 encoded and stored with type `'api-key'`.\n   * @param name - Unique name for the secret\n   * @param apiKey - The API key string\n   * @param options - Optional description, whether to replace existing\n   * @returns Success with entry, Failure if locked, empty, or exists and !replace\n   * @public\n   */\n  public async importApiKey(\n    name: string,\n    apiKey: string,\n    options?: IImportSecretOptions\n  ): Promise<Result<IAddSecretResult>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!name || name.length === 0) {\n      return fail('Secret name cannot be empty');\n    }\n    if (!apiKey || apiKey.length === 0) {\n      return fail('API key cannot be empty');\n    }\n\n    const existing = this._secrets.get(name);\n    if (existing && !options?.replace) {\n      return fail(`Secret '${name}' already exists - use replace=true to overwrite`);\n    }\n\n    const encoder = new TextEncoder();\n    const entry: IKeyStoreSymmetricEntry = {\n      name,\n      type: 'api-key',\n      key: encoder.encode(apiKey),\n      description: options?.description,\n      createdAt: getCurrentTimestamp()\n    };\n\n    const warning = existing ? await this._releaseEntryResources(existing) : undefined;\n    this._secrets.set(name, entry);\n    this._dirty = true;\n\n    return succeed({ entry, replaced: existing !== undefined, warning });\n  }\n\n  /**\n   * Retrieves an API key string by name.\n   * Only works for secrets with type `'api-key'`.\n   * @param name - Name of the secret\n   * @returns Success with the API key string, Failure if not found, locked, or wrong type\n   * @public\n   */\n  public getApiKey(name: string): Result<string> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    const entry = this._secrets.get(name);\n    if (!entry) {\n      return fail(`Secret '${name}' not found`);\n    }\n    if (entry.type !== 'api-key') {\n      return fail(`Secret '${name}' is not an API key (type: ${entry.type})`);\n    }\n    const decoder = new TextDecoder();\n    return succeed(decoder.decode(entry.key));\n  }\n\n  /**\n   * Imports arbitrary raw bytes into the vault with type `'opaque'`.\n   *\n   * Unlike {@link KeyStore.importSecret} (which enforces a 32-byte AES-256 key)\n   * and {@link KeyStore.importApiKey} (which UTF-8 encodes a string), this\n   * accepts a byte buffer of any length and stores it verbatim — including\n   * embedded NUL bytes. Use it for byte blobs that are neither a fixed-size key\n   * nor a UTF-8 string (e.g. a serialized credential bundle), so they are not\n   * mistyped as `'api-key'`.\n   *\n   * @param name - Unique name for the secret\n   * @param bytes - The raw bytes to store\n   * @param options - Optional description, initial metadata, whether to replace existing\n   * @returns Success with entry, Failure if locked, empty, or exists and !replace\n   * @public\n   */\n  public async importSecretBytes(\n    name: string,\n    bytes: Uint8Array,\n    options?: IImportSecretBytesOptions\n  ): Promise<Result<IAddSecretResult>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!name || name.length === 0) {\n      return fail('Secret name cannot be empty');\n    }\n\n    const existing = this._secrets.get(name);\n    if (existing && !options?.replace) {\n      return fail(`Secret '${name}' already exists - use replace=true to overwrite`);\n    }\n\n    const entry: IKeyStoreSymmetricEntry = {\n      name,\n      type: 'opaque',\n      key: new Uint8Array(bytes), // Copy to prevent external modification\n      description: options?.description,\n      metadata: options?.metadata,\n      createdAt: getCurrentTimestamp()\n    };\n\n    const warning = existing ? await this._releaseEntryResources(existing) : undefined;\n    this._secrets.set(name, entry);\n    this._dirty = true;\n\n    return succeed({ entry, replaced: existing !== undefined, warning });\n  }\n\n  /**\n   * Retrieves the raw stored bytes for a symmetric entry, returned verbatim\n   * (never UTF-8 decoded). Intended for `'opaque'` entries but works for any\n   * symmetric type; asymmetric-keypair entries carry no raw key material and\n   * are rejected.\n   *\n   * @param name - Name of the secret\n   * @returns Success with a copy of the stored bytes, Failure if not found,\n   * locked, or the entry is asymmetric\n   * @public\n   */\n  public getSecretBytes(name: string): Result<Uint8Array> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    const entry = this._secrets.get(name);\n    if (!entry) {\n      return fail(`Secret '${name}' not found`);\n    }\n    if (entry.type === 'asymmetric-keypair') {\n      return fail(`Secret '${name}' is an asymmetric keypair, not raw byte material (type: ${entry.type})`);\n    }\n    // Copy so callers cannot mutate the in-memory vault buffer.\n    return succeed(new Uint8Array(entry.key));\n  }\n\n  /**\n   * Replaces the mutable metadata on a symmetric entry and stamps `updatedAt`\n   * with the current timestamp. Does NOT touch the secret `key` bytes — the\n   * material reads back identically afterward.\n   *\n   * Metadata is non-secret by contract but physically lives inside the vault\n   * ciphertext (see {@link CryptoUtils.KeyStore.IKeyStoreSymmetricEntry.metadata}).\n   *\n   * @param name - Name of the secret to update\n   * @param value - New metadata value (replaces any prior metadata)\n   * @returns Success with the updated entry, Failure if not found, locked, or\n   * the entry is asymmetric\n   * @public\n   */\n  public setSecretMetadata(name: string, value: JsonValue): Result<IKeyStoreSymmetricEntry> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    const entry = this._secrets.get(name);\n    if (!entry) {\n      return fail(`Secret '${name}' not found`);\n    }\n    if (entry.type === 'asymmetric-keypair') {\n      return fail(\n        `Secret '${name}' is an asymmetric keypair; metadata is only supported on symmetric entries (type: ${entry.type})`\n      );\n    }\n\n    const updated: IKeyStoreSymmetricEntry = {\n      ...entry,\n      metadata: value,\n      updatedAt: getCurrentTimestamp()\n    };\n    this._secrets.set(name, updated);\n    this._dirty = true;\n\n    return succeed(updated);\n  }\n\n  // ============================================================================\n  // Asymmetric Keypair Management\n  // ============================================================================\n\n  /**\n   * Adds a new asymmetric keypair to the vault. Storage-first: the private key\n   * is stored under a freshly-minted `id` before the public-key vault entry is\n   * committed. If the storage call fails, no vault entry is written and the\n   * operation returns Failure.\n   *\n   * When `replace: true` displaces an existing entry (asymmetric or symmetric),\n   * a fresh `id` is minted; the displaced entry's resources are released\n   * best-effort. Failure of the storage delete is reported via `warning` on the\n   * result but does not roll back the replacement.\n   *\n   * Requires a {@link CryptoUtils.KeyStore.IPrivateKeyStorage} backend\n   * supplied at construction.\n   *\n   * Extractability of the generated private key defaults to the storage\n   * backend's {@link CryptoUtils.KeyStore.IPrivateKeyStorage.supportsNonExtractable}.\n   * `options.extractable` overrides that default for this key only; requesting\n   * `extractable: false` against a backend that cannot store non-extractable\n   * keys fails loudly rather than silently generating an extractable key.\n   *\n   * @param name - Unique name for the entry\n   * @param options - Algorithm, optional description, replace flag, extractable override\n   * @returns Success with the new entry, Failure if locked, no provider, storage write failed,\n   * or the requested extractability cannot be honored by the backend\n   * @public\n   */\n  public async addKeyPair(name: string, options: IAddKeyPairOptions): Promise<Result<IAddKeyPairResult>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!name || name.length === 0) {\n      return fail('Entry name cannot be empty');\n    }\n    if (!this._privateKeyStorage) {\n      return fail('No private key storage configured');\n    }\n\n    const existing = this._secrets.get(name);\n    if (existing && !options.replace) {\n      return fail(`Secret '${name}' already exists - use replace=true to overwrite`);\n    }\n\n    // Generate the keypair before touching storage. extractable=true on backends\n    // that round-trip via JWK; extractable=false on backends that hold CryptoKey\n    // refs directly. `options.extractable` overrides the backend-derived default\n    // for this key only; a caller-requested non-extractable key against a\n    // backend that cannot store one fails loudly rather than silently\n    // upgrading to extractable.\n    const backendExtractable = !this._privateKeyStorage.supportsNonExtractable;\n    if (options.extractable === false && backendExtractable) {\n      return fail(\n        `Cannot create non-extractable keypair for '${name}': storage backend does not support non-extractable keys`\n      );\n    }\n    // Extractability of the LIVE stored key. Escrow is orthogonal — it never\n    // changes this; the escrow copy is captured separately from a transient\n    // extractable key.\n    const liveExtractable = options.extractable ?? backendExtractable;\n\n    // For escrow we must be able to export the private key to JWK, which only\n    // works on an extractable key, so the transient keypair is generated\n    // extractable regardless of `liveExtractable`. Without escrow it is\n    // generated directly at the live setting.\n    const generateExtractable = options.escrow === true ? true : liveExtractable;\n    const keyPairResult = await this._cryptoProvider.generateKeyPair(options.algorithm, generateExtractable);\n    /* c8 ignore next 3 - crypto provider errors covered in nodeCryptoProvider tests; cannot be triggered here without mocking */\n    if (keyPairResult.isFailure()) {\n      return fail(`Failed to generate keypair for '${name}': ${keyPairResult.message}`);\n    }\n    const { publicKey, privateKey } = keyPairResult.value;\n\n    const jwkResult = await this._cryptoProvider.exportPublicKeyJwk(publicKey);\n    /* c8 ignore next 3 - export of an extractable freshly-generated public key is hard to fail */\n    if (jwkResult.isFailure()) {\n      return fail(`Failed to export public key for '${name}': ${jwkResult.message}`);\n    }\n\n    // Escrow (opt-in). The bare private key exists only as three local\n    // artifacts, none of which is returned or logged: (1) the transient\n    // extractable `privateKey` above; (2) the exported `escrowedPrivateKeyJwk`,\n    // which is carried in the vault entry (same custody class as the public\n    // JWK); (3) a freshly re-imported non-extractable key handed to `store()`\n    // when the live copy must be non-extractable. When the live copy is\n    // extractable the transient key IS the live copy and is stored directly.\n    let escrowedPrivateKeyJwk: JsonWebKey | undefined;\n    let keyToStore: CryptoKey = privateKey;\n    if (options.escrow === true) {\n      // Chain the export → (conditional) non-extractable re-import so the\n      // failure dispatch lives in ts-utils rather than in local branch nodes.\n      // When the live copy is extractable the transient key IS the live copy;\n      // otherwise a freshly re-imported non-extractable key is stored instead.\n      const escrowPrepResult = await (\n        await this._exportPrivateKeyJwk(privateKey, name)\n      ).thenOnSuccess(async (jwk): Promise<Result<{ jwk: JsonWebKey; keyToStore: CryptoKey }>> => {\n        if (liveExtractable) {\n          return succeed({ jwk, keyToStore: privateKey });\n        }\n        return (await this._importEscrowedPrivateKey(jwk, options.algorithm, false))\n          .withErrorFormat((msg) => `Failed to prepare non-extractable key for '${name}': ${msg}`)\n          .onSuccess((reimported) => succeed({ jwk, keyToStore: reimported }));\n      });\n      /* c8 ignore next 3 - escrowPrepResult only fails if exporting or re-importing a freshly-generated valid key fails, which a healthy provider cannot do (same untestable class as the keyPairResult/jwkResult/idResult guards); the import-failure path itself is covered via getKeyPair rehydration of a malformed escrow JWK */\n      if (escrowPrepResult.isFailure()) {\n        return fail(escrowPrepResult.message);\n      }\n      ({ jwk: escrowedPrivateKeyJwk, keyToStore } = escrowPrepResult.value);\n    }\n\n    const idResult = this._generateId();\n    /* c8 ignore next 3 - random-bytes failure is hard to trigger with a healthy provider */\n    if (idResult.isFailure()) {\n      return fail(`Failed to mint storage id for '${name}': ${idResult.message}`);\n    }\n    const id = idResult.value;\n\n    // Storage-first: write the private key before committing the vault entry.\n    const storeResult = await this._privateKeyStorage.store(id, keyToStore);\n    if (storeResult.isFailure()) {\n      return fail(`Failed to persist private key for '${name}': ${storeResult.message}`);\n    }\n\n    const entry: IKeyStoreAsymmetricEntry = {\n      name,\n      type: 'asymmetric-keypair',\n      id,\n      algorithm: options.algorithm,\n      publicKeyJwk: jwkResult.value,\n      escrowedPrivateKeyJwk,\n      description: options.description,\n      createdAt: getCurrentTimestamp()\n    };\n\n    const warning = existing ? await this._releaseEntryResources(existing) : undefined;\n    this._secrets.set(name, entry);\n    this._dirty = true;\n\n    return succeed({ entry, replaced: existing !== undefined, warning });\n  }\n\n  /**\n   * Retrieves the keypair for an asymmetric-keypair entry. The private key is\n   * loaded from {@link CryptoUtils.KeyStore.IPrivateKeyStorage} on every call —\n   * the keystore never caches private `CryptoKey` references between calls.\n   * The public key is re-imported from the vault's JWK so callers always\n   * receive a `CryptoKey` rather than the JWK form.\n   *\n   * With `options.rehydrate: true`, if the storage backend holds no blob for\n   * the entry's `id` and the entry carries an `escrowedPrivateKeyJwk` (see\n   * `addKeyPair(name, { escrow: true })`), the escrowed JWK is imported and\n   * stored under the entry's `id` before being returned — recovering the\n   * private key on a fresh device from the vault plus master password. This is\n   * fill-a-gap only: an existing storage blob is never overwritten.\n   *\n   * @param name - Name of the entry\n   * @param options - Optional {@link CryptoUtils.KeyStore.IGetKeyPairOptions}\n   * (currently the `rehydrate` escrow-recovery flag).\n   * @returns Success with `{ publicKey, privateKey }`, Failure if not found,\n   * locked, wrong type, no provider, or storage load (and any escrow\n   * rehydration) failed.\n   * @public\n   */\n  public async getKeyPair(\n    name: string,\n    options?: IGetKeyPairOptions\n  ): Promise<Result<{ publicKey: CryptoKey; privateKey: CryptoKey }>> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    const entry = this._secrets.get(name);\n    if (!entry) {\n      return fail(`Secret '${name}' not found`);\n    }\n    if (entry.type !== 'asymmetric-keypair') {\n      return fail(`Secret '${name}' is not an asymmetric keypair (type: ${entry.type})`);\n    }\n    if (!this._privateKeyStorage) {\n      return fail('No private key storage configured');\n    }\n\n    return (await this._loadOrRehydratePrivateKey(name, entry, options)).thenOnSuccess(async (privateKey) =>\n      (await this._cryptoProvider.importPublicKeyJwk(entry.publicKeyJwk, entry.algorithm))\n        .withErrorFormat((msg) => `Failed to re-import public key for '${name}': ${msg}`)\n        .onSuccess((publicKey) => succeed({ publicKey, privateKey }))\n    );\n  }\n\n  /**\n   * Lists secret names filtered by type.\n   * @param type - The secret type to filter by\n   * @returns Success with array of matching secret names, Failure if locked\n   * @public\n   */\n  public listSecretsByType(type: KeyStoreSecretType): Result<readonly string[]> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    const names: string[] = [];\n    for (const [name, entry] of this._secrets) {\n      if (entry.type === type) {\n        names.push(name);\n      }\n    }\n    return succeed(names);\n  }\n\n  /**\n   * Renames a secret.\n   * @param oldName - Current name\n   * @param newName - New name\n   * @returns Success with updated entry, Failure if source not found, target exists, or locked\n   * @public\n   */\n  public renameSecret(oldName: string, newName: string): Result<IKeyStoreEntry> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n    if (!newName || newName.length === 0) {\n      return fail('New name cannot be empty');\n    }\n\n    const entry = this._secrets.get(oldName);\n    if (!entry) {\n      return fail(`Secret '${oldName}' not found`);\n    }\n\n    if (oldName !== newName && this._secrets.has(newName)) {\n      return fail(`Secret '${newName}' already exists`);\n    }\n\n    // Create new entry with new name. For asymmetric entries the spread\n    // preserves `id` so the storage handle survives the rename.\n    const newEntry: IKeyStoreEntry = {\n      ...entry,\n      name: newName\n    };\n\n    this._secrets.delete(oldName);\n    this._secrets.set(newName, newEntry);\n    this._dirty = true;\n\n    return succeed(newEntry);\n  }\n\n  // ============================================================================\n  // Persistence\n  // ============================================================================\n\n  /**\n   * Saves the key store, returning the encrypted file content.\n   * Requires the master password to encrypt.\n   * @param password - The master password\n   * @returns Success with IKeyStoreFile, Failure if locked\n   * @public\n   */\n  public async save(password: string): Promise<Result<IKeyStoreFile>> {\n    if (!this._secrets || !this._salt) {\n      return fail('Key store is locked');\n    }\n    if (!password || password.length === 0) {\n      return fail('Password cannot be empty');\n    }\n\n    // Derive the encryption key\n    const keyResult = await this._cryptoProvider.deriveKey(password, this._salt, this._iterations);\n    /* c8 ignore next 3 - crypto provider errors tested but coverage intermittently missed */\n    if (keyResult.isFailure()) {\n      return fail(`Key derivation failed: ${keyResult.message}`);\n    }\n\n    return this._encryptVault(keyResult.value);\n  }\n\n  /**\n   * Saves the key store using a pre-derived key, bypassing PBKDF2 key\n   * derivation. Use this when the derived key has been stored externally\n   * (e.g., in another key store) and the original password is no longer\n   * available.\n   *\n   * The supplied key must be the same key that was (or would be) derived\n   * from the master password using the key store's PBKDF2 parameters.\n   *\n   * @param derivedKey - The pre-derived master key (32 bytes for AES-256)\n   * @returns Success with IKeyStoreFile, Failure if locked or key invalid\n   * @public\n   */\n  public async saveWithKey(derivedKey: Uint8Array): Promise<Result<IKeyStoreFile>> {\n    if (!this._secrets || !this._salt) {\n      return fail('Key store is locked');\n    }\n    if (derivedKey.length !== Constants.AES_256_KEY_SIZE) {\n      return fail(`Key must be ${Constants.AES_256_KEY_SIZE} bytes, got ${derivedKey.length}`);\n    }\n\n    return this._encryptVault(derivedKey);\n  }\n\n  /**\n   * Changes the master password.\n   * Re-encrypts the vault with the new password-derived key.\n   * @param currentPassword - Current master password (for verification)\n   * @param newPassword - New master password\n   * @returns Success when password changed, Failure if locked or current password incorrect\n   * @public\n   */\n  public async changePassword(currentPassword: string, newPassword: string): Promise<Result<KeyStore>> {\n    if (!this._secrets || !this._salt) {\n      return fail('Key store is locked');\n    }\n    if (!newPassword || newPassword.length === 0) {\n      return fail('New password cannot be empty');\n    }\n\n    // Verify current password by trying to derive and re-encrypt\n    // (For opened stores, we'd need to verify against the stored file)\n    if (this._keystoreFile) {\n      const saltResult = this._cryptoProvider.fromBase64(this._keystoreFile.keyDerivation.salt);\n      /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n      if (saltResult.isFailure()) {\n        return fail(`Invalid salt in key store file: ${saltResult.message}`);\n      }\n\n      const keyResult = await this._cryptoProvider.deriveKey(\n        currentPassword,\n        saltResult.value,\n        this._keystoreFile.keyDerivation.iterations\n      );\n      /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n      if (keyResult.isFailure()) {\n        return fail(`Key derivation failed: ${keyResult.message}`);\n      }\n\n      // Try to decrypt to verify password\n      const ivResult = this._cryptoProvider.fromBase64(this._keystoreFile.iv);\n      const authTagResult = this._cryptoProvider.fromBase64(this._keystoreFile.authTag);\n      const encryptedDataResult = this._cryptoProvider.fromBase64(this._keystoreFile.encryptedData);\n\n      /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n      if (ivResult.isFailure() || authTagResult.isFailure() || encryptedDataResult.isFailure()) {\n        return fail('Invalid key store file format');\n      }\n\n      const decryptResult = await this._cryptoProvider.decrypt(\n        encryptedDataResult.value,\n        keyResult.value,\n        ivResult.value,\n        authTagResult.value\n      );\n      if (decryptResult.isFailure()) {\n        return fail('Current password is incorrect');\n      }\n    }\n\n    // Generate new salt for the new password using crypto provider\n    const saltResult = this._cryptoProvider.generateRandomBytes(MIN_SALT_LENGTH);\n    /* c8 ignore next 3 - crypto provider errors tested but coverage intermittently missed */\n    if (saltResult.isFailure()) {\n      return fail(`Failed to generate salt: ${saltResult.message}`);\n    }\n\n    this._salt = saltResult.value;\n    this._dirty = true;\n\n    // Save with new password\n    const saveResult = await this.save(newPassword);\n    /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n    if (saveResult.isFailure()) {\n      return fail(saveResult.message);\n    }\n    return succeed(this);\n  }\n\n  // ============================================================================\n  // IEncryptionProvider\n  // ============================================================================\n\n  /** {@inheritDoc IEncryptionProvider.encryptByName} */\n  public async encryptByName<TMetadata = JsonValue>(\n    secretName: string,\n    content: JsonValue,\n    metadata?: TMetadata\n  ): Promise<Result<IEncryptedFile<TMetadata>>> {\n    const secretResult = this.getSecret(secretName);\n    if (secretResult.isFailure()) {\n      return fail(`encryptByName: ${secretResult.message}`);\n    }\n    if (secretResult.value.type === 'asymmetric-keypair') {\n      return fail(\n        `encryptByName: secret '${secretName}' is an asymmetric keypair, not symmetric key material`\n      );\n    }\n\n    return createEncryptedFile({\n      content,\n      secretName,\n      key: secretResult.value.key,\n      cryptoProvider: this._cryptoProvider,\n      metadata\n    });\n  }\n\n  // ============================================================================\n  // Integration with IEncryptionConfig\n  // ============================================================================\n\n  /**\n   * Creates a SecretProvider function for use with IEncryptionConfig.\n   * The returned function looks up secrets from this key store.\n   * @returns Success with SecretProvider, Failure if locked\n   * @public\n   */\n  public getSecretProvider(): Result<SecretProvider> {\n    if (!this._secrets) {\n      return fail('Key store is locked');\n    }\n\n    const secrets = this._secrets;\n    const provider: SecretProvider = async (secretName: string): Promise<Result<Uint8Array>> => {\n      const entry = secrets.get(secretName);\n      if (!entry) {\n        return fail(`Secret '${secretName}' not found in key store`);\n      }\n      if (entry.type === 'asymmetric-keypair') {\n        return fail(`Secret '${secretName}' is an asymmetric keypair, not symmetric key material`);\n      }\n      return succeed(entry.key);\n    };\n\n    return succeed(provider);\n  }\n\n  /**\n   * Creates a partial IEncryptionConfig using this key store as the secret source.\n   * @returns Partial config that can be spread into a full IEncryptionConfig\n   * @public\n   */\n  public getEncryptionConfig(): Result<Pick<IEncryptionConfig, 'secretProvider' | 'cryptoProvider'>> {\n    const providerResult = this.getSecretProvider();\n    if (providerResult.isFailure()) {\n      return fail(providerResult.message);\n    }\n\n    return succeed({\n      secretProvider: providerResult.value,\n      cryptoProvider: this._cryptoProvider\n    });\n  }\n\n  // ============================================================================\n  // Private: Vault Encryption / Decryption\n  // ============================================================================\n\n  /**\n   * Encrypts the vault with a derived key and returns the key store file.\n   * Shared by `save()` and `saveWithKey()`.\n   */\n  private async _encryptVault(derivedKey: Uint8Array): Promise<Result<IKeyStoreFile>> {\n    // _secrets and _salt are guaranteed non-undefined by callers\n    const secrets = this._secrets!;\n    const salt = this._salt!;\n\n    // Build vault contents\n    const secretEntries: Record<string, IKeyStoreEntryJson> = {};\n    for (const [name, entry] of secrets) {\n      if (entry.type === 'asymmetric-keypair') {\n        secretEntries[name] = {\n          name: entry.name,\n          type: entry.type,\n          id: entry.id,\n          algorithm: entry.algorithm,\n          publicKeyJwk: entry.publicKeyJwk,\n          escrowedPrivateKeyJwk: entry.escrowedPrivateKeyJwk,\n          description: entry.description,\n          createdAt: entry.createdAt\n        };\n      } else {\n        secretEntries[name] = {\n          name: entry.name,\n          type: entry.type,\n          key: this._cryptoProvider.toBase64(entry.key),\n          description: entry.description,\n          metadata: entry.metadata,\n          createdAt: entry.createdAt,\n          updatedAt: entry.updatedAt\n        };\n      }\n    }\n\n    const vaultContents: IKeyStoreVaultContents = {\n      version: KEYSTORE_FORMAT,\n      secrets: secretEntries\n    };\n\n    // Serialize and encrypt\n    const jsonResult = captureResult(() => JSON.stringify(vaultContents));\n    /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n    if (jsonResult.isFailure()) {\n      return fail(`Failed to serialize vault: ${jsonResult.message}`);\n    }\n\n    const encryptResult = await this._cryptoProvider.encrypt(jsonResult.value, derivedKey);\n    /* c8 ignore next 3 - crypto provider errors tested but coverage intermittently missed */\n    if (encryptResult.isFailure()) {\n      return fail(`Encryption failed: ${encryptResult.message}`);\n    }\n\n    const { iv, authTag, encryptedData } = encryptResult.value;\n\n    const keystoreFileData: IKeyStoreFile = {\n      format: KEYSTORE_FORMAT,\n      algorithm: Constants.DEFAULT_ALGORITHM,\n      iv: this._cryptoProvider.toBase64(iv),\n      authTag: this._cryptoProvider.toBase64(authTag),\n      encryptedData: this._cryptoProvider.toBase64(encryptedData),\n      keyDerivation: {\n        kdf: 'pbkdf2',\n        salt: this._cryptoProvider.toBase64(salt),\n        iterations: this._iterations\n      }\n    };\n\n    this._keystoreFile = keystoreFileData;\n    this._dirty = false;\n    this._isNew = false;\n\n    return succeed(keystoreFileData);\n  }\n\n  /**\n   * Decrypts the vault with a derived key and loads secrets into memory.\n   * Shared by `unlock()` and `unlockWithKey()`.\n   */\n  private async _decryptVault(derivedKey: Uint8Array): Promise<Result<KeyStore>> {\n    const keystoreFile = this._keystoreFile;\n    /* c8 ignore next 3 - defensive: _decryptVault is only called after a successful open() or create() */\n    if (keystoreFile === undefined) {\n      return fail('No key store file loaded');\n    }\n\n    const ivResult = this._cryptoProvider.fromBase64(keystoreFile.iv);\n    const authTagResult = this._cryptoProvider.fromBase64(keystoreFile.authTag);\n    const encryptedDataResult = this._cryptoProvider.fromBase64(keystoreFile.encryptedData);\n\n    /* c8 ignore next 9 - base64 decode errors tested but coverage intermittently missed */\n    if (ivResult.isFailure()) {\n      return fail(`Invalid IV in key store file: ${ivResult.message}`);\n    }\n    if (authTagResult.isFailure()) {\n      return fail(`Invalid auth tag in key store file: ${authTagResult.message}`);\n    }\n    if (encryptedDataResult.isFailure()) {\n      return fail(`Invalid encrypted data in key store file: ${encryptedDataResult.message}`);\n    }\n\n    const decryptResult = await this._cryptoProvider.decrypt(\n      encryptedDataResult.value,\n      derivedKey,\n      ivResult.value,\n      authTagResult.value\n    );\n    if (decryptResult.isFailure()) {\n      return fail('Incorrect password or corrupted key store');\n    }\n\n    // Parse the vault contents\n    const parseResult = captureResult(() => JSON.parse(decryptResult.value) as unknown);\n    /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n    if (parseResult.isFailure()) {\n      return fail(`Failed to parse vault contents: ${parseResult.message}`);\n    }\n\n    const vaultResult = keystoreVaultContents.convert(parseResult.value);\n    /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n    if (vaultResult.isFailure()) {\n      return fail(`Invalid vault format: ${vaultResult.message}`);\n    }\n\n    // Build secrets into local variables to avoid partial state on failure\n    const saltResult = this._cryptoProvider.fromBase64(keystoreFile.keyDerivation.salt);\n    if (saltResult.isFailure()) {\n      return fail(`Invalid salt in key store file: ${saltResult.message}`);\n    }\n    const secrets = new Map<string, IKeyStoreEntry>();\n    for (const [name, jsonEntry] of Object.entries(vaultResult.value.secrets)) {\n      if (jsonEntry.type === 'asymmetric-keypair') {\n        const entry: IKeyStoreAsymmetricEntry = {\n          name,\n          type: jsonEntry.type,\n          id: jsonEntry.id,\n          algorithm: jsonEntry.algorithm,\n          publicKeyJwk: jsonEntry.publicKeyJwk,\n          escrowedPrivateKeyJwk: jsonEntry.escrowedPrivateKeyJwk,\n          description: jsonEntry.description,\n          createdAt: jsonEntry.createdAt\n        };\n        secrets.set(name, entry);\n      } else {\n        const keyBytesResult = this._cryptoProvider.fromBase64(jsonEntry.key);\n        /* c8 ignore next 3 - error path tested but coverage intermittently missed */\n        if (keyBytesResult.isFailure()) {\n          return fail(`Invalid key for secret '${name}': ${keyBytesResult.message}`);\n        }\n        const entry: IKeyStoreSymmetricEntry = {\n          name,\n          type: jsonEntry.type,\n          key: keyBytesResult.value,\n          description: jsonEntry.description,\n          metadata: jsonEntry.metadata,\n          createdAt: jsonEntry.createdAt,\n          updatedAt: jsonEntry.updatedAt\n        };\n        secrets.set(name, entry);\n      }\n    }\n\n    // All validation passed — commit state atomically\n    this._salt = saltResult.value;\n    this._secrets = secrets;\n    this._state = 'unlocked';\n    this._dirty = false;\n\n    return succeed(this);\n  }\n\n  // ============================================================================\n  // Private: Helpers for asymmetric flows\n  // ============================================================================\n\n  /**\n   * Releases the resources held by an entry being displaced from the vault.\n   * Symmetric entries get their key buffer zeroed in place. Asymmetric entries\n   * have their private-key blob best-effort deleted from\n   * {@link CryptoUtils.KeyStore.IPrivateKeyStorage}; if the storage call fails,\n   * a warning string is returned but the displacement still proceeds — the\n   * orphaned blob is left for consumer-side GC. Without a configured provider,\n   * asymmetric cleanup is silently skipped.\n   * @returns A warning string if storage cleanup failed, otherwise undefined.\n   */\n  private async _releaseEntryResources(entry: IKeyStoreEntry): Promise<string | undefined> {\n    if (entry.type === 'asymmetric-keypair') {\n      if (!this._privateKeyStorage) {\n        return undefined;\n      }\n      const deleteResult = await this._privateKeyStorage.delete(entry.id);\n      if (deleteResult.isFailure()) {\n        return `Failed to delete prior storage blob for '${entry.name}' (id ${entry.id}): ${deleteResult.message}`;\n      }\n      return undefined;\n    }\n    entry.key.fill(0);\n    return undefined;\n  }\n\n  /**\n   * Exports the transient extractable private `CryptoKey` to a JWK for escrow,\n   * via WebCrypto's `exportKey('jwk', ...)` (cross-runtime through\n   * `globalThis.crypto.subtle`). The result is carried in the vault entry — the\n   * same custody class as the public JWK — and is never returned from a public\n   * method nor logged.\n   */\n  private async _exportPrivateKeyJwk(privateKey: CryptoKey, name: string): Promise<Result<JsonWebKey>> {\n    return captureAsyncResult(() => globalThis.crypto.subtle.exportKey('jwk', privateKey)).withErrorFormat(\n      (msg) => `Failed to export private key for escrow of '${name}': ${msg}`\n    );\n  }\n\n  /**\n   * Re-imports an escrowed private-key JWK as a `CryptoKey` for `algorithm`\n   * with the requested extractability. The WebCrypto JWK-import descriptor is\n   * shared between the public and private halves for every supported algorithm,\n   * so `IKeyPairAlgorithmParams.importPublicKey` is reused; the private/public\n   * distinction is carried by the requested usages (see\n   * {@link KeyStore._privateKeyUsagesFor}). Cross-runtime through\n   * `globalThis.crypto.subtle`.\n   */\n  private async _importEscrowedPrivateKey(\n    jwk: JsonWebKey,\n    algorithm: KeyPairAlgorithm,\n    extractable: boolean\n  ): Promise<Result<CryptoKey>> {\n    const params = keyPairAlgorithmParams[algorithm];\n    const usages = KeyStore._privateKeyUsagesFor(jwk, params);\n    return captureAsyncResult(() =>\n      globalThis.crypto.subtle.importKey('jwk', jwk, params.importPublicKey, extractable, usages)\n    ).withErrorFormat((msg) => `Failed to import escrowed private key: ${msg}`);\n  }\n\n  /**\n   * Loads the private key for `entry` from storage, or — when\n   * `options.rehydrate` is set, storage holds no blob, and the entry carries an\n   * escrowed JWK — imports the escrowed key, persists it under the entry's `id`\n   * (fill-a-gap; never overwrites an existing blob), and returns it.\n   */\n  private async _loadOrRehydratePrivateKey(\n    name: string,\n    entry: IKeyStoreAsymmetricEntry,\n    options: IGetKeyPairOptions | undefined\n  ): Promise<Result<CryptoKey>> {\n    // Non-undefined by getKeyPair's precondition check.\n    const storage = this._privateKeyStorage!;\n    const loadResult = await storage.load(entry.id);\n    if (loadResult.isSuccess()) {\n      return succeed(loadResult.value);\n    }\n    if (options?.rehydrate !== true || entry.escrowedPrivateKeyJwk === undefined) {\n      return fail(`Failed to load private key for '${name}': ${loadResult.message}`);\n    }\n\n    // Fill-a-gap recovery: import the escrowed key non-extractable where the\n    // backend supports it (extractable otherwise, since a JWK-round-tripping\n    // backend cannot store a non-extractable key), then persist it.\n    const backendExtractable = !storage.supportsNonExtractable;\n    const importResult = await this._importEscrowedPrivateKey(\n      entry.escrowedPrivateKeyJwk,\n      entry.algorithm,\n      backendExtractable\n    );\n    if (importResult.isFailure()) {\n      return fail(`Failed to rehydrate private key for '${name}' from escrow: ${importResult.message}`);\n    }\n\n    const storeResult = await storage.store(entry.id, importResult.value);\n    if (storeResult.isFailure()) {\n      return fail(`Failed to persist rehydrated private key for '${name}': ${storeResult.message}`);\n    }\n    return succeed(importResult.value);\n  }\n\n  /**\n   * Computes the key usages to request when importing an escrowed private JWK.\n   * Mirrors `EncryptedFilePrivateKeyStorage`: intersect the algorithm's private\n   * usages (its keypair usages minus the public-only ones) with the JWK's\n   * recorded `key_ops` so we request exactly the operations the stored key\n   * supports; fall back to the algorithm's private usages when `key_ops` is\n   * absent.\n   */\n  private static _privateKeyUsagesFor(jwk: JsonWebKey, params: IKeyPairAlgorithmParams): KeyUsage[] {\n    const privateUsages = params.keyPairUsages.filter((usage) => !PUBLIC_ONLY_USAGES.includes(usage));\n    const keyOps = jwk.key_ops;\n    if (keyOps === undefined) {\n      return [...privateUsages];\n    }\n    return privateUsages.filter((usage) => keyOps.includes(usage));\n  }\n\n  /**\n   * Constant-time byte comparison. Returns false immediately for length\n   * mismatch (length is not secret); for equal-length inputs, walks the full\n   * buffer accumulating differences via XOR so the running time does not leak\n   * the position of the first differing byte.\n   */\n  private static _timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n    /* c8 ignore next 3 - defensive: callers compare equal-length 32-byte PBKDF2 keys */\n    if (a.length !== b.length) {\n      return false;\n    }\n    let diff = 0;\n    for (let i = 0; i < a.length; i++) {\n      // eslint-disable-next-line no-bitwise\n      diff |= a[i] ^ b[i];\n    }\n    return diff === 0;\n  }\n\n  /**\n   * Mints a fresh UUID v4 storage handle using the crypto provider's\n   * {@link CryptoUtils.ICryptoProvider.generateRandomBytes | generateRandomBytes}.\n   * Random-bytes failures propagate as Failure.\n   */\n  private _generateId(): Result<string> {\n    return this._cryptoProvider.generateRandomBytes(16).onSuccess((bytes) => {\n      // Per RFC 4122 §4.4: set version (4) and variant (10xx) bits.\n      // eslint-disable-next-line no-bitwise\n      bytes[6] = (bytes[6] & 0x0f) | 0x40;\n      // eslint-disable-next-line no-bitwise\n      bytes[8] = (bytes[8] & 0x3f) | 0x80;\n      const hex = Array.from(bytes)\n        .map((b) => b.toString(16).padStart(2, '0'))\n        .join('');\n      return succeed(\n        `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(\n          20,\n          32\n        )}`\n      );\n    });\n  }\n}\n"]}

package/dist/packlets/crypto-utils/keystore/model.js

@@ -24,12 +24,16 @@ export { allKeyPairAlgorithms } from '../model';
  * All recognized key store format versions (readable by the current library).
  * @public
  */
-export const allKeyStoreFormats = ['keystore-v1', 'keystore-v2'];
+export const allKeyStoreFormats = [
+    'keystore-v1',
+    'keystore-v2',
+    'keystore-v3'
+];
 /**
- * Current format version constant. New vaults are written as `'keystore-v2'`.
+ * Current format version constant. New vaults are written as `'keystore-v3'`.
  * @public
  */
-export const KEYSTORE_FORMAT = 'keystore-v2';
+export const KEYSTORE_FORMAT = 'keystore-v3';
 /**
  * Default PBKDF2 iterations for key store encryption.
  * Higher than regular files since this protects the master key vault.
@@ -47,7 +51,8 @@ export const MIN_SALT_LENGTH = 16;
  */
 export const allKeyStoreSymmetricSecretTypes = [
     'encryption-key',
-    'api-key'
+    'api-key',
+    'opaque'
 ];
 /**
  * All valid asymmetric secret types.