npm - @fgv/ts-web-extras - Versions diffs - 5.1.0-4 → 5.1.0-41 - Mend

@fgv/ts-web-extras 5.1.0-4 → 5.1.0-41

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (424) hide show

package/dist/packlets/crypto-utils/browserCryptoProvider.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"browserCryptoProvider.js","sourceRoot":"","sources":["../../../src/packlets/crypto-utils/browserCryptoProvider.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,gFAAgF;AAChF,YAAY;AAEZ,2FAA2F;AAC3F,OAAO,EAAE,aAAa,EAAE,OAAO,EAAU,OAAO,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAI7C,MAAM,eAAe,GAAG,WAAW,CAAC,SAAS,CAAC;AAE9C;;;;GAIG;AACH,SAAS,aAAa,CAAC,GAAe;IACpC,mGAAmG;IACnG,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAGhC;;;OAGG;IACH,YAAmB,SAAkB;QACnC,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC3B,CAAC;aAAM,IAAI,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YAClE,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC;QACnC,CAAC;aAAM,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1D,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,GAAe;QACrD,IAAI,GAAG,CAAC,MAAM,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;YACpD,OAAO,OAAO,CAAC,IAAI,CAAC,eAAe,eAAe,CAAC,gBAAgB,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,IAAI,CAAC;YACH,qBAAqB;YACrB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;YAErF,iBAAiB;YACjB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CACnD,KAAK,EACL,aAAa,CAAC,GAAG,CAAC,EAClB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;YAEF,4BAA4B;YAC5B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAEjD,sDAAsD;YACtD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CACxD;gBACE,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,EAAE;gBACN,SAAS,EAAE,eAAe,CAAC,iBAAiB,GAAG,CAAC,CAAC,OAAO;aACzD,EACD,SAAS,EACT,cAAc,CACf,CAAC;YAEF,4DAA4D;YAC5D,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC;YACxD,MAAM,aAAa,GAAG,cAAc,CAAC,KAAK,CACxC,CAAC,EACD,cAAc,CAAC,MAAM,GAAG,eAAe,CAAC,iBAAiB,CAC1D,CAAC;YACF,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC;YAChG,OAAO,OAAO,CAAC,IAAI,CAAC;gBAClB,EAAE;gBACF,OAAO;gBACP,aAAa;aACd,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,OAAO,CAClB,aAAyB,EACzB,GAAe,EACf,EAAc,EACd,OAAmB;QAEnB,IAAI,GAAG,CAAC,MAAM,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;YACpD,OAAO,OAAO,CAAC,IAAI,CAAC,eAAe,eAAe,CAAC,gBAAgB,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,EAAE,CAAC,MAAM,KAAK,eAAe,CAAC,WAAW,EAAE,CAAC;YAC9C,OAAO,OAAO,CAAC,IAAI,CAAC,cAAc,eAAe,CAAC,WAAW,eAAe,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,CAAC,iBAAiB,EAAE,CAAC;YACzD,OAAO,OAAO,CAAC,IAAI,CACjB,oBAAoB,eAAe,CAAC,iBAAiB,eAAe,OAAO,CAAC,MAAM,EAAE,CACrF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,iBAAiB;YACjB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CACnD,KAAK,EACL,aAAa,CAAC,GAAG,CAAC,EAClB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;YAEF,wDAAwD;YACxD,MAAM,gBAAgB,GAAG,IAAI,UAAU,CAAC,aAAa,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/E,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACpC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;YAEpD,UAAU;YACV,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CACjD;gBACE,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;gBACrB,SAAS,EAAE,eAAe,CAAC,iBAAiB,GAAG,CAAC,CAAC,OAAO;aACzD,EACD,SAAS,EACT,gBAAgB,CACjB,CAAC;YAEF,mBAAmB;YACnB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,WAAW;QACtB,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACtG,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,SAAS,CACpB,QAAgB,EAChB,IAAgB,EAChB,UAAkB;QAElB,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC;YACH,kBAAkB;YAClB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAE/C,kCAAkC;YAClC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE;gBAC7F,YAAY;aACb,CAAC,CAAC;YAEH,kBAAkB;YAClB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CACtD;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC;gBACzB,UAAU,EAAE,UAAU;gBACtB,IAAI,EAAE,SAAS;aAChB,EACD,WAAW,EACX,eAAe,CAAC,gBAAgB,GAAG,CAAC,CAAC,OAAO;aAC7C,CAAC;YAEF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,2BAA2B;IAC3B,+EAA+E;IAE/E;;;;OAIG;IACI,mBAAmB,CAAC,MAAc;QACvC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,QAAQ,CAAC,IAAgB;QAC9B,sDAAsD;QACtD,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACI,UAAU,CAAC,MAAc;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,aAAa,CAAC,GAAG,EAAE,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC;AAC1D,CAAC;AACD,oBAAoB","sourcesContent":["// Copyright (c) 2024 Erik Fortune\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal\n// in the Software without restriction, including without limitation the rights\n// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n// copies of the Software, and to permit persons to whom the Software is\n// furnished to do so, subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all\n// copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n// SOFTWARE.\n\n/* c8 ignore start - Browser-only implementation cannot be tested in Node.js environment /\nimport { captureResult, Failure, Result, Success } from '@fgv/ts-utils';\nimport { CryptoUtils } from '@fgv/ts-extras';\n\ntype ICryptoProvider = CryptoUtils.ICryptoProvider;\ntype IEncryptionResult = CryptoUtils.IEncryptionResult;\nconst CryptoConstants = CryptoUtils.Constants;\n\n/\n Extracts an `ArrayBuffer` from a Uint8Array, handling the potential SharedArrayBuffer case.\n * @param arr - The Uint8Array to extract from\n * @returns An `ArrayBuffer` containing a copy of the data.\n /\nfunction toArrayBuffer(arr: Uint8Array): ArrayBuffer {\n // Create a new ArrayBuffer and copy the data - this handles both ArrayBuffer and SharedArrayBuffer\n const buffer = new ArrayBuffer(arr.byteLength);\n new Uint8Array(buffer).set(arr);\n return buffer;\n}\n\n/\n Browser implementation of `ICryptoProvider` using the Web Crypto API.\n * Uses AES-256-GCM for authenticated encryption.\n \n Note: This provider requires a browser environment with Web Crypto API support.\n * In Node.js 15+, Web Crypto is available via globalThis.crypto or require('crypto').webcrypto.\n \n @public\n /\nexport class BrowserCryptoProvider implements ICryptoProvider {\n private readonly _crypto: Crypto;\n\n /\n Creates a new {@link CryptoUtils.BrowserCryptoProvider \| BrowserCryptoProvider}.\n * @param cryptoApi - Optional Crypto instance (defaults to globalThis.crypto)\n /\n public constructor(cryptoApi?: Crypto) {\n if (cryptoApi) {\n this._crypto = cryptoApi;\n } else if (typeof globalThis !== 'undefined' && globalThis.crypto) {\n this._crypto = globalThis.crypto;\n } else if (typeof window !== 'undefined' && window.crypto) {\n this._crypto = window.crypto;\n } else {\n throw new Error('Web Crypto API not available');\n }\n }\n\n /\n Encrypts plaintext using AES-256-GCM.\n * @param plaintext - UTF-8 string to encrypt\n * @param key - 32-byte encryption key\n * @returns `Success` with encryption result, or `Failure` with an error.\n /\n public async encrypt(plaintext: string, key: Uint8Array): Promise<Result<IEncryptionResult>> {\n if (key.length !== CryptoConstants.AES_256_KEY_SIZE) {\n return Failure.with(`Key must be ${CryptoConstants.AES_256_KEY_SIZE} bytes, got ${key.length}`);\n }\n\n try {\n // Generate random IV\n const iv = this._crypto.getRandomValues(new Uint8Array(CryptoConstants.GCM_IV_SIZE));\n\n // Import the key\n const cryptoKey = await this._crypto.subtle.importKey(\n 'raw',\n toArrayBuffer(key),\n { name: 'AES-GCM' },\n false,\n ['encrypt']\n );\n\n // Encode plaintext to bytes\n const encoder = new TextEncoder();\n const plaintextBytes = encoder.encode(plaintext);\n\n // Encrypt (Web Crypto appends auth tag to ciphertext)\n const encryptedWithTag = await this._crypto.subtle.encrypt(\n {\n name: 'AES-GCM',\n iv: iv,\n tagLength: CryptoConstants.GCM_AUTH_TAG_SIZE 8 // bits\n },\n cryptoKey,\n plaintextBytes\n );\n\n // Split ciphertext and auth tag (auth tag is last 16 bytes)\n const encryptedArray = new Uint8Array(encryptedWithTag);\n const encryptedData = encryptedArray.slice(\n 0,\n encryptedArray.length - CryptoConstants.GCM_AUTH_TAG_SIZE\n );\n const authTag = encryptedArray.slice(encryptedArray.length - CryptoConstants.GCM_AUTH_TAG_SIZE);\n return Success.with({\n iv,\n authTag,\n encryptedData\n });\n } catch (e) {\n const message = e instanceof Error ? e.message : String(e);\n return Failure.with(`Encryption failed: ${message}`);\n }\n }\n\n /*\n Decrypts ciphertext using AES-256-GCM.\n * @param encryptedData - Encrypted bytes\n * @param key - 32-byte decryption key\n * @param iv - Initialization vector (12 bytes)\n * @param authTag - GCM authentication tag (16 bytes)\n * @returns `Success` with decrypted UTF-8 string, or `Failure` with an error.\n /\n public async decrypt(\n encryptedData: Uint8Array,\n key: Uint8Array,\n iv: Uint8Array,\n authTag: Uint8Array\n ): Promise<Result<string>> {\n if (key.length !== CryptoConstants.AES_256_KEY_SIZE) {\n return Failure.with(`Key must be ${CryptoConstants.AES_256_KEY_SIZE} bytes, got ${key.length}`);\n }\n if (iv.length !== CryptoConstants.GCM_IV_SIZE) {\n return Failure.with(`IV must be ${CryptoConstants.GCM_IV_SIZE} bytes, got ${iv.length}`);\n }\n if (authTag.length !== CryptoConstants.GCM_AUTH_TAG_SIZE) {\n return Failure.with(\n `Auth tag must be ${CryptoConstants.GCM_AUTH_TAG_SIZE} bytes, got ${authTag.length}`\n );\n }\n\n try {\n // Import the key\n const cryptoKey = await this._crypto.subtle.importKey(\n 'raw',\n toArrayBuffer(key),\n { name: 'AES-GCM' },\n false,\n ['decrypt']\n );\n\n // Web Crypto expects ciphertext + auth tag concatenated\n const encryptedWithTag = new Uint8Array(encryptedData.length + authTag.length);\n encryptedWithTag.set(encryptedData);\n encryptedWithTag.set(authTag, encryptedData.length);\n\n // Decrypt\n const decrypted = await this._crypto.subtle.decrypt(\n {\n name: 'AES-GCM',\n iv: toArrayBuffer(iv),\n tagLength: CryptoConstants.GCM_AUTH_TAG_SIZE 8 // bits\n },\n cryptoKey,\n encryptedWithTag\n );\n\n // Decode to string\n const decoder = new TextDecoder();\n return Success.with(decoder.decode(decrypted));\n } catch (e) {\n const message = e instanceof Error ? e.message : String(e);\n return Failure.with(`Decryption failed: ${message}`);\n }\n }\n\n /*\n Generates a random 32-byte key suitable for AES-256.\n * @returns Success with generated key, or Failure with error\n /\n public async generateKey(): Promise<Result<Uint8Array>> {\n try {\n return Success.with(this._crypto.getRandomValues(new Uint8Array(CryptoConstants.AES_256_KEY_SIZE)));\n } catch (e) {\n const message = e instanceof Error ? e.message : String(e);\n return Failure.with(`Key generation failed: ${message}`);\n }\n }\n\n /\n Derives a key from a password using PBKDF2.\n * @param password - Password string\n * @param salt - Salt bytes (should be at least 16 bytes)\n * @param iterations - Number of iterations (recommend 100000+)\n * @returns Success with derived 32-byte key, or Failure with error\n /\n public async deriveKey(\n password: string,\n salt: Uint8Array,\n iterations: number\n ): Promise<Result<Uint8Array>> {\n if (iterations < 1) {\n return Failure.with('Iterations must be at least 1');\n }\n if (salt.length < 8) {\n return Failure.with('Salt should be at least 8 bytes');\n }\n\n try {\n // Encode password\n const encoder = new TextEncoder();\n const passwordBytes = encoder.encode(password);\n\n // Import password as key material\n const keyMaterial = await this._crypto.subtle.importKey('raw', passwordBytes, 'PBKDF2', false, [\n 'deriveBits'\n ]);\n\n // Derive key bits\n const derivedBits = await this._crypto.subtle.deriveBits(\n {\n name: 'PBKDF2',\n salt: toArrayBuffer(salt),\n iterations: iterations,\n hash: 'SHA-256'\n },\n keyMaterial,\n CryptoConstants.AES_256_KEY_SIZE 8 // bits\n );\n\n return Success.with(new Uint8Array(derivedBits));\n } catch (e) {\n const message = e instanceof Error ? e.message : String(e);\n return Failure.with(`Key derivation failed: ${message}`);\n }\n }\n\n // ============================================================================\n // Platform Utility Methods\n // ============================================================================\n\n /*\n Generates cryptographically secure random bytes.\n * @param length - Number of bytes to generate\n * @returns Success with random bytes, or Failure with error\n /\n public generateRandomBytes(length: number): Result<Uint8Array> {\n if (length < 1) {\n return Failure.with('Length must be at least 1');\n }\n try {\n return Success.with(this._crypto.getRandomValues(new Uint8Array(length)));\n } catch (e) {\n const message = e instanceof Error ? e.message : String(e);\n return Failure.with(`Random bytes generation failed: ${message}`);\n }\n }\n\n /\n Encodes binary data to base64 string.\n * @param data - Binary data to encode\n * @returns Base64-encoded string\n /\n public toBase64(data: Uint8Array): string {\n // Convert Uint8Array to binary string, then to base64\n let binary = '';\n for (let i = 0; i < data.length; i++) {\n binary += String.fromCharCode(data[i]);\n }\n return btoa(binary);\n }\n\n /\n Decodes base64 string to binary data.\n * @param base64 - Base64-encoded string\n * @returns Success with decoded bytes, or Failure if invalid base64\n /\n public fromBase64(base64: string): Result<Uint8Array> {\n try {\n const binary = atob(base64);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) {\n bytes[i] = binary.charCodeAt(i);\n }\n return Success.with(bytes);\n } catch (e) {\n return Failure.with('Invalid base64 string');\n }\n }\n}\n\n/\n Creates a {@link CryptoUtils.BrowserCryptoProvider \| BrowserCryptoProvider} if Web\n * Crypto API is available.\n * @returns `Success` with provider, or `Failure` if not available\n * @public\n /\nexport function createBrowserCryptoProvider(): Result<BrowserCryptoProvider> {\n return captureResult(() => new BrowserCryptoProvider());\n}\n/ c8 ignore stop */\n"]}
1	+ {"version":3,"file":"browserCryptoProvider.js","sourceRoot":"","sources":["../../../src/packlets/crypto-utils/browserCryptoProvider.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,gFAAgF;AAChF,YAAY;AAEZ,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,IAAI,EACJ,OAAO,EAEP,OAAO,EACP,OAAO,EAER,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,sGAAsG;AACtG;;;;GAIG;AACH,SAAS,aAAa,CAAC,GAAe;IACpC,mGAAmG;IACnG,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,oBAAoB;AAEpB;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,GAAe;IACnC,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAGhC,6FAA6F;IAC7F;;;OAGG;IACH,YAAmB,SAAkB;QACnC,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC3B,CAAC;aAAM,IAAI,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YAClE,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC;QACnC,CAAC;aAAM,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1D,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,GAAe;QACrD,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;YAC1D,OAAO,OAAO,CAAC,IAAI,CAAC,eAAe,WAAW,CAAC,SAAS,CAAC,gBAAgB,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,CAAC;YACH,qBAAqB;YACrB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;YAE3F,iBAAiB;YACjB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CACnD,KAAK,EACL,aAAa,CAAC,GAAG,CAAC,EAClB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;YAEF,4BAA4B;YAC5B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAEjD,sDAAsD;YACtD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CACxD;gBACE,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,EAAE;gBACN,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC,iBAAiB,GAAG,CAAC,CAAC,OAAO;aAC/D,EACD,SAAS,EACT,cAAc,CACf,CAAC;YAEF,4DAA4D;YAC5D,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC;YACxD,MAAM,aAAa,GAAG,cAAc,CAAC,KAAK,CACxC,CAAC,EACD,cAAc,CAAC,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,iBAAiB,CAChE,CAAC;YACF,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;YACtG,OAAO,OAAO,CAAC,IAAI,CAAC;gBAClB,EAAE;gBACF,OAAO;gBACP,aAAa;aACd,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,OAAO,CAClB,aAAyB,EACzB,GAAe,EACf,EAAc,EACd,OAAmB;QAEnB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;YAC1D,OAAO,OAAO,CAAC,IAAI,CAAC,eAAe,WAAW,CAAC,SAAS,CAAC,gBAAgB,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,EAAE,CAAC,MAAM,KAAK,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YACpD,OAAO,OAAO,CAAC,IAAI,CAAC,cAAc,WAAW,CAAC,SAAS,CAAC,WAAW,eAAe,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC;YAC/D,OAAO,OAAO,CAAC,IAAI,CACjB,oBAAoB,WAAW,CAAC,SAAS,CAAC,iBAAiB,eAAe,OAAO,CAAC,MAAM,EAAE,CAC3F,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,iBAAiB;YACjB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CACnD,KAAK,EACL,aAAa,CAAC,GAAG,CAAC,EAClB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;YAEF,wDAAwD;YACxD,MAAM,gBAAgB,GAAG,IAAI,UAAU,CAAC,aAAa,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/E,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACpC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;YAEpD,UAAU;YACV,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CACjD;gBACE,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;gBACrB,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC,iBAAiB,GAAG,CAAC,CAAC,OAAO;aAC/D,EACD,SAAS,EACT,gBAAgB,CACjB,CAAC;YAEF,mBAAmB;YACnB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,WAAW;QACtB,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,IAAI,CACjB,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CACrF,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,SAAS,CACpB,QAAgB,EAChB,IAAgB,EAChB,UAAkB;QAElB,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC;YACH,kBAAkB;YAClB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAE/C,kCAAkC;YAClC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE;gBAC7F,YAAY;aACb,CAAC,CAAC;YAEH,kBAAkB;YAClB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CACtD;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC;gBACzB,UAAU,EAAE,UAAU;gBACtB,IAAI,EAAE,SAAS;aAChB,EACD,WAAW,EACX,WAAW,CAAC,SAAS,CAAC,gBAAgB,GAAG,CAAC,CAAC,OAAO;aACnD,CAAC;YAEF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,MAAM,CAAC,IAAY;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAC3E,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;iBAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;iBAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,2BAA2B;IAC3B,+EAA+E;IAE/E;;;;OAIG;IACI,mBAAmB,CAAC,MAAc;QACvC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,oBAAoB;IAEpB;;;;;OAKG;IACI,YAAY;QACjB,yGAAyG;QACzG,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YAClD,OAAO,OAAO,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,aAAa,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAU,CAAC,CAAC;IAChE,CAAC;IAED,qDAAqD;IAErD;;;;OAIG;IACI,QAAQ,CAAC,IAAgB;QAC9B,sDAAsD;QACtD,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACI,UAAU,CAAC,MAAc;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,4BAA4B;IAC5B,+EAA+E;IAE/E;;;;;OAKG;IACI,KAAK,CAAC,eAAe,CAC1B,SAAuC,EACvC,WAAoB;QAEpB,MAAM,MAAM,GAAG,WAAW,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC7D,6EAA6E;QAC7E,4EAA4E;QAC5E,6EAA6E;QAC7E,kEAAkE;QAClE,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,IAAI,EAAE;YACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CACrD,MAAM,CAAC,WAAkC,EACzC,WAAW,EACX,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,CAC1B,CAAC;YACF,IAAI,YAAY,IAAI,SAAS,IAAI,WAAW,IAAI,SAAS,EAAE,CAAC;gBAC1D,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,4FAA4F;YAC5F,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,2CAA2C,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,SAAS,aAAa,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,kBAAkB,CAAC,SAAoB;QAClD,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC,IAAI,CAAC,wDAAwD,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/F,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uCAAuC,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,kBAAkB,CAC7B,GAAe,EACf,SAAuC;QAEvC,MAAM,MAAM,GAAG,WAAW,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAC3C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,CAChG,CAAC;QACF,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,SAAS,yBAAyB,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,mBAAmB,CAAC,SAAoB;QACnD,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC,IAAI,CAAC,yDAAyD,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QAChG,OAAO,MAAM;aACV,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8CAA8C,CAAC,EAAE,CAAC;aACzE,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,mBAAmB,CAC9B,SAAqB,EACrB,SAAuC;QAEvC,MAAM,MAAM,GAAG,WAAW,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAC3C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAC3B,MAAM,EACN,YAAY,CAAC,SAAS,CAAC,EACvB,MAAM,CAAC,eAAsC,EAC7C,IAAI,EACJ,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,CAC5B,CACF,CAAC;QACF,OAAO,MAAM,CAAC,eAAe,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,yCAAyC,SAAS,0BAA0B,CAAC,EAAE,CACvF,CAAC;IACJ,CAAC;IACD,oBAAoB;IAEpB;;;;;OAKG;IACI,KAAK,CAAC,IAAI,CAAC,UAAqB,EAAE,IAAgB;QACvD,MAAM,SAAS,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAC3C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CACpE,CAAC;QACF,OAAO,MAAM;aACV,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;aAC3C,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,MAAM,CACjB,SAAoB,EACpB,SAAqB,EACrB,IAAgB;QAEhB,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAC3C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAC9F,CAAC;QACF,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;;OAUG;IACI,eAAe,CAAC,CAAa,EAAE,CAAa;QACjD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACxC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,sCAAsC;YACtC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,KAAK,CAAC,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,UAAU,CAAC,GAAc,EAAE,IAAgB;QACtD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAC3C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CACpE,CAAC;QACF,OAAO,MAAM;aACV,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC;aACjD,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,gBAAgB,CAC3B,GAAc,EACd,SAAqB,EACrB,IAAgB;QAEhB,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;aACtC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,EAAE,CAAC;aACvD,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,KAAK,CAAC,YAAY,CACvB,GAAe,EACf,KAAiB,EACjB,SAAqB,EACrB,GAAgB;QAEhB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;YAC1D,OAAO,OAAO,CAAC,IAAI,CACjB,6BAA6B,WAAW,CAAC,SAAS,CAAC,gBAAgB,eAAe,GAAG,CAAC,MAAM,EAAE,CAC/F,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YACvD,OAAO,OAAO,CAAC,IAAI,CACjB,+BAA+B,WAAW,CAAC,SAAS,CAAC,WAAW,eAAe,KAAK,CAAC,MAAM,EAAE,CAC9F,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,IAAI,EAAE;YACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CACnD,KAAK,EACL,YAAY,CAAC,GAAG,CAAC,EACjB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;YACF,MAAM,SAAS,GAAiB;gBAC9B,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC;gBACvB,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC,iBAAiB,GAAG,CAAC,CAAC,OAAO;aAC/D,CAAC;YACF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,SAAS,CAAC,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM,gBAAgB,GAAG,IAAI,UAAU,CACrC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,CACjF,CAAC;YACF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,iBAAiB,CAAC;YACnF,OAAO;gBACL,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC;gBAC/C,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC;aAC1C,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,YAAY,CACvB,GAAe,EACf,KAAiB,EACjB,UAAsB,EACtB,OAAmB,EACnB,GAAgB;QAEhB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;YAC1D,OAAO,OAAO,CAAC,IAAI,CACjB,6BAA6B,WAAW,CAAC,SAAS,CAAC,gBAAgB,eAAe,GAAG,CAAC,MAAM,EAAE,CAC/F,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YACvD,OAAO,OAAO,CAAC,IAAI,CACjB,+BAA+B,WAAW,CAAC,SAAS,CAAC,WAAW,eAAe,KAAK,CAAC,MAAM,EAAE,CAC9F,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC;YAC/D,OAAO,OAAO,CAAC,IAAI,CACjB,kCAAkC,WAAW,CAAC,SAAS,CAAC,iBAAiB,eAAe,OAAO,CAAC,MAAM,EAAE,CACzG,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,IAAI,EAAE;YACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CACnD,KAAK,EACL,YAAY,CAAC,GAAG,CAAC,EACjB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;YACF,yDAAyD;YACzD,MAAM,gBAAgB,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5E,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACjC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,SAAS,GAAiB;gBAC9B,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC;gBACvB,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC,iBAAiB,GAAG,CAAC,CAAC,OAAO;aAC/D,CAAC;YACF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,SAAS,CAAC,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;YAC5F,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,SAAS,CACpB,SAAqB,EACrB,kBAA6B,EAC7B,OAAsC;QAEtC,MAAM,cAAc,GAAG,aAAa,CAAC,kBAAkB,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;QAC3F,IAAI,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,IAAI,CAAC,qBAAqB,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,IAAI,EAAE;YACjD,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE;gBACvF,WAAW;aACZ,CAAC,CAAkB,CAAC;YACrB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,SAAS,CACrC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAC5C,SAAS,CAAC,UAAU,EACpB,EAAE,IAAI,EAAE,MAAM,EAAE,EAChB,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CACpC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EACrG,QAAQ,EACR,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;YACF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;YAC9F,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;YACrG,MAAM,kBAAkB,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;YAC9E,OAAO;gBACL,kBAAkB;gBAClB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC3B,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;aACjD,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,WAAW,CACtB,OAAkC,EAClC,mBAA8B,EAC9B,OAAsC;QAEtC,MAAM,cAAc,GAAG,aAAa,CAAC,mBAAmB,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAC9F,IAAI,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,IAAI,CAAC,uBAAuB,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC;YAC5B,OAAO,OAAO,CAAC,IAAI,CAAC,8BAA8B,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YACnE,OAAO,OAAO,CAAC,IAAI,CACjB,qCAAqC,WAAW,CAAC,SAAS,CAAC,WAAW,eAAe,WAAW,CAAC,KAAK,CAAC,MAAM,GAAG,CACjH,CAAC;QACJ,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,gBAAgB,CAAC,SAAS,EAAE,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC,IAAI,CAAC,mCAAmC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,gBAAgB,CAAC,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC;YAC5E,OAAO,OAAO,CAAC,IAAI,CACjB,mDAAmD,WAAW,CAAC,SAAS,CAAC,iBAAiB,eAAe,gBAAgB,CAAC,KAAK,CAAC,MAAM,GAAG,CAC1I,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,IAAI,EAAE;YACjD,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,SAAS,CACzC,KAAK,EACL,OAAO,CAAC,kBAAkB,EAC1B,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EACrC,KAAK,EACL,EAAE,CACH,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,SAAS,CACrC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,EACtC,mBAAmB,EACnB,EAAE,IAAI,EAAE,MAAM,EAAE,EAChB,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CACpC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EACrG,QAAQ,EACR,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAChC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EACxD,OAAO,EACP,YAAY,CAAC,gBAAgB,CAAC,KAAK,CAAC,CACrC,CAAC;YACF,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,GAAc;IAC1C,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC,SAAgC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,aAAa,CAAC,GAAc,EAAE,OAA6B,EAAE,KAAa;IACjF,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,uCAAuC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,UAAU,GAAI,GAAG,CAAC,SAA4B,CAAC,UAAU,CAAC;IAChE,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,mCAAmC,UAAU,IAAI,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,cAAc,OAAO,oBAAoB,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,4FAA4F;AAC5F;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,aAAa,CAAC,GAAG,EAAE,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC;AAC1D,CAAC;AACD,oBAAoB","sourcesContent":["// Copyright (c) 2024 Erik Fortune\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal\n// in the Software without restriction, including without limitation the rights\n// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n// copies of the Software, and to permit persons to whom the Software is\n// furnished to do so, subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all\n// copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n// SOFTWARE.\n\nimport {\n captureAsyncResult,\n captureResult,\n fail,\n Failure,\n Result,\n succeed,\n Success,\n Uuid\n} from '@fgv/ts-utils';\nimport { CryptoUtils } from '@fgv/ts-extras';\n\n/* c8 ignore start - Used only by browser-only methods that cannot be tested in Node.js environment /\n/\n Extracts an `ArrayBuffer` from a Uint8Array, handling the potential SharedArrayBuffer case.\n * @param arr - The Uint8Array to extract from\n * @returns An `ArrayBuffer` containing a copy of the data.\n /\nfunction toArrayBuffer(arr: Uint8Array): ArrayBuffer {\n // Create a new ArrayBuffer and copy the data - this handles both ArrayBuffer and SharedArrayBuffer\n const buffer = new ArrayBuffer(arr.byteLength);\n new Uint8Array(buffer).set(arr);\n return buffer;\n}\n/ c8 ignore stop /\n\n/\n Returns a fresh Uint8Array view over a non-shared ArrayBuffer copy of `arr`.\n * Used by {@link BrowserCryptoProvider.wrapBytes \| wrapBytes} and\n * {@link BrowserCryptoProvider.unwrapBytes \| unwrapBytes}: Node 20's\n * webcrypto.subtle rejects raw `ArrayBuffer` for several `BufferSource`\n * parameters with \"is not instance of ArrayBuffer, Buffer, TypedArray, or\n * DataView\" even though `ArrayBuffer` should be valid per the spec; a\n * TypedArray view is accepted on Node 20+ and on browsers, and the explicit\n * `Uint8Array<ArrayBuffer>` return type also satisfies TypeScript's `BufferSource`\n * (which excludes the `SharedArrayBuffer` branch of `Uint8Array`'s buffer type).\n /\nfunction toBufferView(arr: Uint8Array): Uint8Array<ArrayBuffer> {\n const buffer = new ArrayBuffer(arr.byteLength);\n const view = new Uint8Array(buffer);\n view.set(arr);\n return view;\n}\n\n/\n Browser implementation of `ICryptoProvider` using the Web Crypto API.\n * Uses AES-256-GCM for authenticated encryption.\n \n Note: This provider requires a browser environment with Web Crypto API support.\n * In Node.js 15+, Web Crypto is available via globalThis.crypto or require('crypto').webcrypto.\n \n @public\n /\nexport class BrowserCryptoProvider implements CryptoUtils.ICryptoProvider {\n private readonly _crypto: Crypto;\n\n / c8 ignore start - Existing browser-only methods cannot be tested in Node.js environment /\n /\n Creates a new {@link CryptoUtils.BrowserCryptoProvider \| BrowserCryptoProvider}.\n * @param cryptoApi - Optional Crypto instance (defaults to globalThis.crypto)\n /\n public constructor(cryptoApi?: Crypto) {\n if (cryptoApi) {\n this._crypto = cryptoApi;\n } else if (typeof globalThis !== 'undefined' && globalThis.crypto) {\n this._crypto = globalThis.crypto;\n } else if (typeof window !== 'undefined' && window.crypto) {\n this._crypto = window.crypto;\n } else {\n throw new Error('Web Crypto API not available');\n }\n }\n\n /\n Encrypts plaintext using AES-256-GCM.\n * @param plaintext - UTF-8 string to encrypt\n * @param key - 32-byte encryption key\n * @returns `Success` with encryption result, or `Failure` with an error.\n /\n public async encrypt(plaintext: string, key: Uint8Array): Promise<Result<CryptoUtils.IEncryptionResult>> {\n if (key.length !== CryptoUtils.Constants.AES_256_KEY_SIZE) {\n return Failure.with(`Key must be ${CryptoUtils.Constants.AES_256_KEY_SIZE} bytes, got ${key.length}`);\n }\n\n try {\n // Generate random IV\n const iv = this._crypto.getRandomValues(new Uint8Array(CryptoUtils.Constants.GCM_IV_SIZE));\n\n // Import the key\n const cryptoKey = await this._crypto.subtle.importKey(\n 'raw',\n toArrayBuffer(key),\n { name: 'AES-GCM' },\n false,\n ['encrypt']\n );\n\n // Encode plaintext to bytes\n const encoder = new TextEncoder();\n const plaintextBytes = encoder.encode(plaintext);\n\n // Encrypt (Web Crypto appends auth tag to ciphertext)\n const encryptedWithTag = await this._crypto.subtle.encrypt(\n {\n name: 'AES-GCM',\n iv: iv,\n tagLength: CryptoUtils.Constants.GCM_AUTH_TAG_SIZE 8 // bits\n },\n cryptoKey,\n plaintextBytes\n );\n\n // Split ciphertext and auth tag (auth tag is last 16 bytes)\n const encryptedArray = new Uint8Array(encryptedWithTag);\n const encryptedData = encryptedArray.slice(\n 0,\n encryptedArray.length - CryptoUtils.Constants.GCM_AUTH_TAG_SIZE\n );\n const authTag = encryptedArray.slice(encryptedArray.length - CryptoUtils.Constants.GCM_AUTH_TAG_SIZE);\n return Success.with({\n iv,\n authTag,\n encryptedData\n });\n } catch (e) {\n const message = e instanceof Error ? e.message : String(e);\n return Failure.with(`Encryption failed: ${message}`);\n }\n }\n\n /*\n Decrypts ciphertext using AES-256-GCM.\n * @param encryptedData - Encrypted bytes\n * @param key - 32-byte decryption key\n * @param iv - Initialization vector (12 bytes)\n * @param authTag - GCM authentication tag (16 bytes)\n * @returns `Success` with decrypted UTF-8 string, or `Failure` with an error.\n /\n public async decrypt(\n encryptedData: Uint8Array,\n key: Uint8Array,\n iv: Uint8Array,\n authTag: Uint8Array\n ): Promise<Result<string>> {\n if (key.length !== CryptoUtils.Constants.AES_256_KEY_SIZE) {\n return Failure.with(`Key must be ${CryptoUtils.Constants.AES_256_KEY_SIZE} bytes, got ${key.length}`);\n }\n if (iv.length !== CryptoUtils.Constants.GCM_IV_SIZE) {\n return Failure.with(`IV must be ${CryptoUtils.Constants.GCM_IV_SIZE} bytes, got ${iv.length}`);\n }\n if (authTag.length !== CryptoUtils.Constants.GCM_AUTH_TAG_SIZE) {\n return Failure.with(\n `Auth tag must be ${CryptoUtils.Constants.GCM_AUTH_TAG_SIZE} bytes, got ${authTag.length}`\n );\n }\n\n try {\n // Import the key\n const cryptoKey = await this._crypto.subtle.importKey(\n 'raw',\n toArrayBuffer(key),\n { name: 'AES-GCM' },\n false,\n ['decrypt']\n );\n\n // Web Crypto expects ciphertext + auth tag concatenated\n const encryptedWithTag = new Uint8Array(encryptedData.length + authTag.length);\n encryptedWithTag.set(encryptedData);\n encryptedWithTag.set(authTag, encryptedData.length);\n\n // Decrypt\n const decrypted = await this._crypto.subtle.decrypt(\n {\n name: 'AES-GCM',\n iv: toArrayBuffer(iv),\n tagLength: CryptoUtils.Constants.GCM_AUTH_TAG_SIZE 8 // bits\n },\n cryptoKey,\n encryptedWithTag\n );\n\n // Decode to string\n const decoder = new TextDecoder();\n return Success.with(decoder.decode(decrypted));\n } catch (e) {\n const message = e instanceof Error ? e.message : String(e);\n return Failure.with(`Decryption failed: ${message}`);\n }\n }\n\n /*\n Generates a random 32-byte key suitable for AES-256.\n * @returns Success with generated key, or Failure with error\n /\n public async generateKey(): Promise<Result<Uint8Array>> {\n try {\n return Success.with(\n this._crypto.getRandomValues(new Uint8Array(CryptoUtils.Constants.AES_256_KEY_SIZE))\n );\n } catch (e) {\n const message = e instanceof Error ? e.message : String(e);\n return Failure.with(`Key generation failed: ${message}`);\n }\n }\n\n /\n Derives a key from a password using PBKDF2.\n * @param password - Password string\n * @param salt - Salt bytes (should be at least 16 bytes)\n * @param iterations - Number of iterations (recommend 100000+)\n * @returns Success with derived 32-byte key, or Failure with error\n /\n public async deriveKey(\n password: string,\n salt: Uint8Array,\n iterations: number\n ): Promise<Result<Uint8Array>> {\n if (iterations < 1) {\n return Failure.with('Iterations must be at least 1');\n }\n if (salt.length < 8) {\n return Failure.with('Salt should be at least 8 bytes');\n }\n\n try {\n // Encode password\n const encoder = new TextEncoder();\n const passwordBytes = encoder.encode(password);\n\n // Import password as key material\n const keyMaterial = await this._crypto.subtle.importKey('raw', passwordBytes, 'PBKDF2', false, [\n 'deriveBits'\n ]);\n\n // Derive key bits\n const derivedBits = await this._crypto.subtle.deriveBits(\n {\n name: 'PBKDF2',\n salt: toArrayBuffer(salt),\n iterations: iterations,\n hash: 'SHA-256'\n },\n keyMaterial,\n CryptoUtils.Constants.AES_256_KEY_SIZE 8 // bits\n );\n\n return Success.with(new Uint8Array(derivedBits));\n } catch (e) {\n const message = e instanceof Error ? e.message : String(e);\n return Failure.with(`Key derivation failed: ${message}`);\n }\n }\n\n /*\n Computes a SHA-256 hash of the given data.\n * @param data - UTF-8 string to hash\n * @returns `Success` with hex-encoded hash string, or `Failure` with an error.\n /\n public async sha256(data: string): Promise<Result<string>> {\n try {\n const encoder = new TextEncoder();\n const dataBuffer = encoder.encode(data);\n const hashBuffer = await this._crypto.subtle.digest('SHA-256', dataBuffer);\n const hashArray = new Uint8Array(hashBuffer);\n const hashHex = Array.from(hashArray)\n .map((b) => b.toString(16).padStart(2, '0'))\n .join('');\n return succeed(hashHex);\n } catch (e) {\n const message = e instanceof Error ? e.message : String(e);\n return fail(`SHA-256 hash failed: ${message}`);\n }\n }\n\n // ============================================================================\n // Platform Utility Methods\n // ============================================================================\n\n /\n Generates cryptographically secure random bytes.\n * @param length - Number of bytes to generate\n * @returns Success with random bytes, or Failure with error\n /\n public generateRandomBytes(length: number): Result<Uint8Array> {\n if (length < 1) {\n return Failure.with('Length must be at least 1');\n }\n try {\n return Success.with(this._crypto.getRandomValues(new Uint8Array(length)));\n } catch (e) {\n const message = e instanceof Error ? e.message : String(e);\n return Failure.with(`Random bytes generation failed: ${message}`);\n }\n }\n / c8 ignore stop /\n\n /\n Generates a cryptographically random UUIDv4 using the injected\n * `Crypto` instance.\n * @returns `Success` with the generated UUID, or `Failure` if the underlying\n * `Crypto` instance does not expose `randomUUID`.\n /\n public generateUuid(): Result<Uuid> {\n / c8 ignore next 3 - randomUUID is always available in supported runtimes (Node 22+, modern browsers) /\n if (typeof this._crypto.randomUUID !== 'function') {\n return Failure.with('Crypto instance does not expose randomUUID');\n }\n return captureResult(() => this._crypto.randomUUID() as Uuid);\n }\n\n / c8 ignore start - browser-only methods continue /\n\n /\n Encodes binary data to base64 string.\n * @param data - Binary data to encode\n * @returns Base64-encoded string\n /\n public toBase64(data: Uint8Array): string {\n // Convert Uint8Array to binary string, then to base64\n let binary = '';\n for (let i = 0; i < data.length; i++) {\n binary += String.fromCharCode(data[i]);\n }\n return btoa(binary);\n }\n\n /\n Decodes base64 string to binary data.\n * @param base64 - Base64-encoded string\n * @returns Success with decoded bytes, or Failure if invalid base64\n /\n public fromBase64(base64: string): Result<Uint8Array> {\n try {\n const binary = atob(base64);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) {\n bytes[i] = binary.charCodeAt(i);\n }\n return Success.with(bytes);\n } catch (e) {\n return Failure.with('Invalid base64 string');\n }\n }\n\n // ============================================================================\n // Asymmetric Key Operations\n // ============================================================================\n\n /\n Generates a new asymmetric keypair via Web Crypto.\n * @param algorithm - The algorithm to use.\n * @param extractable - Whether the resulting keys may be exported.\n * @returns `Success` with the generated `CryptoKeyPair`, or `Failure` with an error.\n /\n public async generateKeyPair(\n algorithm: CryptoUtils.KeyPairAlgorithm,\n extractable: boolean\n ): Promise<Result<CryptoKeyPair>> {\n const params = CryptoUtils.keyPairAlgorithmParams[algorithm];\n // Widening upcast to `AlgorithmIdentifier` steers TS to subtle.generateKey's\n // broad overload, which accepts the Ed25519 `{ name: 'Ed25519' }` shape and\n // returns `CryptoKey \| CryptoKeyPair`. The narrowing back to `CryptoKeyPair`\n // is a runtime check via the `in` operator, not a type assertion.\n const result = await captureAsyncResult(async () => {\n const generated = await this._crypto.subtle.generateKey(\n params.generateKey as AlgorithmIdentifier,\n extractable,\n [...params.keyPairUsages]\n );\n if ('privateKey' in generated && 'publicKey' in generated) {\n return generated;\n }\n / c8 ignore next - unreachable: every entry in keyPairAlgorithmParams produces a keypair /\n throw new Error(`${algorithm} unexpectedly produced a single CryptoKey`);\n });\n return result.withErrorFormat((e) => `Failed to generate ${algorithm} keypair: ${e}`);\n }\n\n /\n Exports a public `CryptoKey` as a JSON Web Key.\n * @remarks\n * Rejects non-public keys at runtime. WebCrypto's `exportKey('jwk', ...)`\n * does not enforce public-vs-private; without this guard a caller that\n * passed an extractable private key would receive its private fields\n * (`d`, `p`, `q`, ...) as JWK, defeating the method's name.\n * @param publicKey - Extractable public key to export.\n * @returns `Success` with the JWK, or `Failure` if not a public key or if export fails.\n /\n public async exportPublicKeyJwk(publicKey: CryptoKey): Promise<Result<JsonWebKey>> {\n if (publicKey.type !== 'public') {\n return Failure.with(`exportPublicKeyJwk requires a public CryptoKey, got '${publicKey.type}'`);\n }\n const result = await captureAsyncResult(() => this._crypto.subtle.exportKey('jwk', publicKey));\n return result.withErrorFormat((e) => `Failed to export public key as JWK: ${e}`);\n }\n\n /\n Imports a public-key JWK as a `CryptoKey` for the requested algorithm.\n * @param jwk - The JSON Web Key produced by a prior export.\n * @param algorithm - The algorithm the key was generated for.\n * @returns `Success` with the imported public `CryptoKey`, or `Failure` with an error.\n /\n public async importPublicKeyJwk(\n jwk: JsonWebKey,\n algorithm: CryptoUtils.KeyPairAlgorithm\n ): Promise<Result<CryptoKey>> {\n const params = CryptoUtils.keyPairAlgorithmParams[algorithm];\n const result = await captureAsyncResult(() =>\n this._crypto.subtle.importKey('jwk', jwk, params.importPublicKey, true, params.publicKeyUsages)\n );\n return result.withErrorFormat((e) => `Failed to import ${algorithm} public key from JWK: ${e}`);\n }\n\n /\n Exports a public `CryptoKey` as a DER-encoded SPKI blob.\n * @param publicKey - The public `CryptoKey` to export.\n * @returns `Success` with the raw SPKI bytes, or `Failure` with error context.\n /\n public async exportPublicKeySpki(publicKey: CryptoKey): Promise<Result<Uint8Array>> {\n if (publicKey.type !== 'public') {\n return Failure.with(`exportPublicKeySpki requires a public CryptoKey, got '${publicKey.type}'`);\n }\n const result = await captureAsyncResult(() => this._crypto.subtle.exportKey('spki', publicKey));\n return result\n .withErrorFormat((e) => `exportPublicKeySpki: failed to export key: ${e}`)\n .onSuccess((buf) => succeed(new Uint8Array(buf)));\n }\n\n /\n Imports a public key from a DER-encoded SPKI blob.\n * @param spkiBytes - The raw SPKI bytes.\n * @param algorithm - The algorithm the key was generated for.\n * @returns `Success` with the imported public `CryptoKey`, or `Failure` with error context.\n /\n public async importPublicKeySpki(\n spkiBytes: Uint8Array,\n algorithm: CryptoUtils.KeyPairAlgorithm\n ): Promise<Result<CryptoKey>> {\n const params = CryptoUtils.keyPairAlgorithmParams[algorithm];\n const result = await captureAsyncResult(() =>\n this._crypto.subtle.importKey(\n 'spki',\n toBufferView(spkiBytes),\n params.importPublicKey as AlgorithmIdentifier,\n true,\n [...params.publicKeyUsages]\n )\n );\n return result.withErrorFormat(\n (e) => `importPublicKeySpki: failed to import ${algorithm} public key from SPKI: ${e}`\n );\n }\n / c8 ignore stop /\n\n /\n Signs `data` with `privateKey` using the algorithm inferred from the key.\n * @param privateKey - A signing `CryptoKey` (`'ecdsa-p256'` or `'ed25519'`).\n * @param data - The bytes to sign.\n * @returns `Success` with the raw signature bytes, or `Failure` with error context.\n /\n public async sign(privateKey: CryptoKey, data: Uint8Array): Promise<Result<Uint8Array>> {\n const algorithm = signAlgorithmFromKey(privateKey);\n const result = await captureAsyncResult(() =>\n this._crypto.subtle.sign(algorithm, privateKey, toBufferView(data))\n );\n return result\n .withErrorFormat((e) => `sign failed: ${e}`)\n .onSuccess((buf) => succeed(new Uint8Array(buf)));\n }\n\n /\n Verifies a signature produced by {@link BrowserCryptoProvider.sign}.\n * @param publicKey - A verify `CryptoKey` (`'ecdsa-p256'` or `'ed25519'`).\n * @param signature - The raw signature bytes.\n * @param data - The original data that was signed.\n * @returns `Success` with `true` if valid, `false` if not, or `Failure` with error context.\n /\n public async verify(\n publicKey: CryptoKey,\n signature: Uint8Array,\n data: Uint8Array\n ): Promise<Result<boolean>> {\n const algorithm = signAlgorithmFromKey(publicKey);\n const result = await captureAsyncResult(() =>\n this._crypto.subtle.verify(algorithm, publicKey, toBufferView(signature), toBufferView(data))\n );\n return result.withErrorFormat((e) => `verify failed: ${e}`);\n }\n\n /\n Compares two byte arrays in constant time.\n \n Accumulates XOR differences with bitwise-OR; no early-return is possible\n * once the length check passes, making timing independent of the byte\n * values. Returns `false` immediately on length mismatch (length is not\n * secret in normal use).\n * @param a - First byte array.\n * @param b - Second byte array.\n * @returns `true` if lengths match and all bytes are equal, `false` otherwise.\n /\n public timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) {\n // eslint-disable-next-line no-bitwise\n diff \|= a[i] ^ b[i];\n }\n return diff === 0;\n }\n\n /\n Computes an HMAC-SHA256 MAC for `data` using `key`.\n * @param key - An HMAC `CryptoKey` with `'sign'` usage.\n * @param data - The bytes to authenticate.\n * @returns `Success` with the 32-byte MAC, or `Failure` with error context.\n /\n public async hmacSha256(key: CryptoKey, data: Uint8Array): Promise<Result<Uint8Array>> {\n const result = await captureAsyncResult(() =>\n this._crypto.subtle.sign({ name: 'HMAC' }, key, toBufferView(data))\n );\n return result\n .withErrorFormat((e) => `hmacSha256 failed: ${e}`)\n .onSuccess((buf) => succeed(new Uint8Array(buf)));\n }\n\n /\n Verifies an HMAC-SHA256 MAC in constant time.\n * @param key - An HMAC `CryptoKey` with `'sign'` usage.\n * @param signature - The MAC bytes to verify.\n * @param data - The original data that was authenticated.\n * @returns `Success` with `true` if valid, `false` if not, or `Failure` with error context.\n /\n public async verifyHmacSha256(\n key: CryptoKey,\n signature: Uint8Array,\n data: Uint8Array\n ): Promise<Result<boolean>> {\n return (await this.hmacSha256(key, data))\n .withErrorFormat((e) => `verifyHmacSha256 failed: ${e}`)\n .onSuccess((mac) => succeed(this.timingSafeEqual(mac, signature)));\n }\n\n /\n Encrypts raw bytes using AES-256-GCM with a caller-supplied nonce and\n * optional AAD. See {@link CryptoUtils.ICryptoProvider.encryptBytes \| ICryptoProvider.encryptBytes}\n * — in particular the caller's responsibility to use a unique `nonce` per\n * message under a given `key`.\n \n Byte-identical to {@link CryptoUtils.NodeCryptoProvider.encryptBytes} for\n * identical `(key, nonce, plaintext, aad)`: Web Crypto appends the 16-byte tag\n * to the ciphertext, and this method splits it off so the returned\n * `ciphertext`/`authTag` match Node's separated-tag layout exactly.\n * @param key - 32-byte AES-256 key.\n * @param nonce - 12-byte GCM nonce (must be unique per message under `key`).\n * @param plaintext - The bytes to encrypt (empty permitted).\n * @param aad - Optional additional authenticated data bound into the tag.\n * @returns `Success` with the ciphertext and 16-byte auth tag, or `Failure` with an error.\n /\n public async encryptBytes(\n key: Uint8Array,\n nonce: Uint8Array,\n plaintext: Uint8Array,\n aad?: Uint8Array\n ): Promise<Result<CryptoUtils.IEncryptBytesResult>> {\n if (key.length !== CryptoUtils.Constants.AES_256_KEY_SIZE) {\n return Failure.with(\n `encryptBytes: key must be ${CryptoUtils.Constants.AES_256_KEY_SIZE} bytes, got ${key.length}`\n );\n }\n if (nonce.length !== CryptoUtils.Constants.GCM_IV_SIZE) {\n return Failure.with(\n `encryptBytes: nonce must be ${CryptoUtils.Constants.GCM_IV_SIZE} bytes, got ${nonce.length}`\n );\n }\n const result = await captureAsyncResult(async () => {\n const cryptoKey = await this._crypto.subtle.importKey(\n 'raw',\n toBufferView(key),\n { name: 'AES-GCM' },\n false,\n ['encrypt']\n );\n const algorithm: AesGcmParams = {\n name: 'AES-GCM',\n iv: toBufferView(nonce),\n tagLength: CryptoUtils.Constants.GCM_AUTH_TAG_SIZE 8 // bits\n };\n if (aad !== undefined) {\n algorithm.additionalData = toBufferView(aad);\n }\n const encryptedWithTag = new Uint8Array(\n await this._crypto.subtle.encrypt(algorithm, cryptoKey, toBufferView(plaintext))\n );\n const tagStart = encryptedWithTag.length - CryptoUtils.Constants.GCM_AUTH_TAG_SIZE;\n return {\n ciphertext: encryptedWithTag.slice(0, tagStart),\n authTag: encryptedWithTag.slice(tagStart)\n };\n });\n return result.withErrorFormat((e) => `encryptBytes failed: ${e}`);\n }\n\n /*\n Decrypts raw bytes produced by {@link BrowserCryptoProvider.encryptBytes}\n * using AES-256-GCM. See\n * {@link CryptoUtils.ICryptoProvider.decryptBytes \| ICryptoProvider.decryptBytes}.\n * Fails (never throws) on any authentication failure, including a mismatched `aad`.\n * @param key - 32-byte AES-256 key.\n * @param nonce - 12-byte GCM nonce (the same one used to encrypt).\n * @param ciphertext - The ciphertext from the `encryptBytes` result.\n * @param authTag - The 16-byte GCM auth tag from the `encryptBytes` result.\n * @param aad - The identical AAD supplied at encrypt time (or absent).\n * @returns `Success` with the decrypted plaintext bytes, or `Failure` with an error.\n /\n public async decryptBytes(\n key: Uint8Array,\n nonce: Uint8Array,\n ciphertext: Uint8Array,\n authTag: Uint8Array,\n aad?: Uint8Array\n ): Promise<Result<Uint8Array>> {\n if (key.length !== CryptoUtils.Constants.AES_256_KEY_SIZE) {\n return Failure.with(\n `decryptBytes: key must be ${CryptoUtils.Constants.AES_256_KEY_SIZE} bytes, got ${key.length}`\n );\n }\n if (nonce.length !== CryptoUtils.Constants.GCM_IV_SIZE) {\n return Failure.with(\n `decryptBytes: nonce must be ${CryptoUtils.Constants.GCM_IV_SIZE} bytes, got ${nonce.length}`\n );\n }\n if (authTag.length !== CryptoUtils.Constants.GCM_AUTH_TAG_SIZE) {\n return Failure.with(\n `decryptBytes: auth tag must be ${CryptoUtils.Constants.GCM_AUTH_TAG_SIZE} bytes, got ${authTag.length}`\n );\n }\n const result = await captureAsyncResult(async () => {\n const cryptoKey = await this._crypto.subtle.importKey(\n 'raw',\n toBufferView(key),\n { name: 'AES-GCM' },\n false,\n ['decrypt']\n );\n // Web Crypto expects ciphertext + auth tag concatenated.\n const encryptedWithTag = new Uint8Array(ciphertext.length + authTag.length);\n encryptedWithTag.set(ciphertext);\n encryptedWithTag.set(authTag, ciphertext.length);\n const algorithm: AesGcmParams = {\n name: 'AES-GCM',\n iv: toBufferView(nonce),\n tagLength: CryptoUtils.Constants.GCM_AUTH_TAG_SIZE 8 // bits\n };\n if (aad !== undefined) {\n algorithm.additionalData = toBufferView(aad);\n }\n const decrypted = await this._crypto.subtle.decrypt(algorithm, cryptoKey, encryptedWithTag);\n return new Uint8Array(decrypted);\n });\n return result.withErrorFormat((e) => `decryptBytes failed: ${e}`);\n }\n\n /*\n Wraps `plaintext` for the holder of `recipientPublicKey` using\n * ECIES (ECDH P-256 + HKDF-SHA256 + AES-GCM-256). See\n * {@link CryptoUtils.ICryptoProvider.wrapBytes \| ICryptoProvider.wrapBytes}.\n * @param plaintext - The bytes to wrap.\n * @param recipientPublicKey - The recipient's ECDH P-256 public `CryptoKey`.\n * @param options - HKDF salt and info; see {@link CryptoUtils.IWrapBytesOptions \| IWrapBytesOptions}.\n * @returns `Success` with the wrapped payload, or `Failure` with an error.\n /\n public async wrapBytes(\n plaintext: Uint8Array,\n recipientPublicKey: CryptoKey,\n options: CryptoUtils.IWrapBytesOptions\n ): Promise<Result<CryptoUtils.IWrappedBytes>> {\n const recipientCheck = checkEcdhP256(recipientPublicKey, 'public', 'recipient public key');\n if (recipientCheck.isFailure()) {\n return Failure.with(`wrapBytes failed: ${recipientCheck.message}`);\n }\n const subtle = this._crypto.subtle;\n const result = await captureAsyncResult(async () => {\n const ephemeral = (await subtle.generateKey({ name: 'ECDH', namedCurve: 'P-256' }, true, [\n 'deriveKey'\n ])) as CryptoKeyPair;\n const hkdfBase = await subtle.deriveKey(\n { name: 'ECDH', public: recipientPublicKey },\n ephemeral.privateKey,\n { name: 'HKDF' },\n false,\n ['deriveKey']\n );\n const wrapKey = await subtle.deriveKey(\n { name: 'HKDF', salt: toBufferView(options.salt), info: toBufferView(options.info), hash: 'SHA-256' },\n hkdfBase,\n { name: 'AES-GCM', length: 256 },\n false,\n ['encrypt']\n );\n const nonce = this._crypto.getRandomValues(new Uint8Array(CryptoUtils.Constants.GCM_IV_SIZE));\n const ctBuf = await subtle.encrypt({ name: 'AES-GCM', iv: nonce }, wrapKey, toBufferView(plaintext));\n const ephemeralPublicKey = await subtle.exportKey('jwk', ephemeral.publicKey);\n return {\n ephemeralPublicKey,\n nonce: this.toBase64(nonce),\n ciphertext: this.toBase64(new Uint8Array(ctBuf))\n };\n });\n return result.withErrorFormat((e) => `wrapBytes failed: ${e}`);\n }\n\n /\n Unwraps a payload produced by `wrapBytes` using the recipient's private\n * key. See {@link CryptoUtils.ICryptoProvider.unwrapBytes \| ICryptoProvider.unwrapBytes}.\n * @param wrapped - The wrapped payload.\n * @param recipientPrivateKey - The recipient's ECDH P-256 private `CryptoKey`.\n * @param options - HKDF salt and info matching the wrap call.\n * @returns `Success` with the original `plaintext`, or `Failure` with an error.\n /\n public async unwrapBytes(\n wrapped: CryptoUtils.IWrappedBytes,\n recipientPrivateKey: CryptoKey,\n options: CryptoUtils.IWrapBytesOptions\n ): Promise<Result<Uint8Array>> {\n const recipientCheck = checkEcdhP256(recipientPrivateKey, 'private', 'recipient private key');\n if (recipientCheck.isFailure()) {\n return Failure.with(`unwrapBytes failed: ${recipientCheck.message}`);\n }\n const nonceResult = this.fromBase64(wrapped.nonce);\n if (nonceResult.isFailure()) {\n return Failure.with(`unwrapBytes failed: nonce: ${nonceResult.message}`);\n }\n if (nonceResult.value.length !== CryptoUtils.Constants.GCM_IV_SIZE) {\n return Failure.with(\n `unwrapBytes failed: nonce must be ${CryptoUtils.Constants.GCM_IV_SIZE} bytes (got ${nonceResult.value.length})`\n );\n }\n const ciphertextResult = this.fromBase64(wrapped.ciphertext);\n if (ciphertextResult.isFailure()) {\n return Failure.with(`unwrapBytes failed: ciphertext: ${ciphertextResult.message}`);\n }\n if (ciphertextResult.value.length < CryptoUtils.Constants.GCM_AUTH_TAG_SIZE) {\n return Failure.with(\n `unwrapBytes failed: ciphertext must be at least ${CryptoUtils.Constants.GCM_AUTH_TAG_SIZE} bytes (got ${ciphertextResult.value.length})`\n );\n }\n const subtle = this._crypto.subtle;\n const result = await captureAsyncResult(async () => {\n const ephemeralPub = await subtle.importKey(\n 'jwk',\n wrapped.ephemeralPublicKey,\n { name: 'ECDH', namedCurve: 'P-256' },\n false,\n []\n );\n const hkdfBase = await subtle.deriveKey(\n { name: 'ECDH', public: ephemeralPub },\n recipientPrivateKey,\n { name: 'HKDF' },\n false,\n ['deriveKey']\n );\n const wrapKey = await subtle.deriveKey(\n { name: 'HKDF', salt: toBufferView(options.salt), info: toBufferView(options.info), hash: 'SHA-256' },\n hkdfBase,\n { name: 'AES-GCM', length: 256 },\n false,\n ['decrypt']\n );\n const ptBuf = await subtle.decrypt(\n { name: 'AES-GCM', iv: toBufferView(nonceResult.value) },\n wrapKey,\n toBufferView(ciphertextResult.value)\n );\n return new Uint8Array(ptBuf);\n });\n return result.withErrorFormat((e) => `unwrapBytes failed: ${e}`);\n }\n}\n\n/\n Derives the algorithm identifier needed by `crypto.subtle.sign/verify`\n * from the key's embedded `algorithm` property. ECDSA requires an explicit\n * `hash` parameter that is not stored on the key object itself; all other\n * supported signing algorithms (`Ed25519`) use the key algorithm as-is.\n /\nfunction signAlgorithmFromKey(key: CryptoKey): AlgorithmIdentifier \| EcdsaParams {\n if (key.algorithm.name === 'ECDSA') {\n return { name: 'ECDSA', hash: 'SHA-256' };\n }\n return key.algorithm as AlgorithmIdentifier;\n}\n\n/\n Verifies that `key` is an ECDH P-256 `CryptoKey` of the expected `keyType`\n * (public or private). Used by the wrap/unwrap methods to surface a clean\n * `Failure` instead of letting the WebCrypto deriveKey call throw a less\n * informative error later in the pipeline. Key usages are intentionally not\n * checked here: WebCrypto already produces a specific error if `deriveKey` is\n * not in `usages`, and `deriveBits` is an equally valid alternative usage that\n * an explicit check would have to track.\n * @param key - The CryptoKey to validate.\n * @param keyType - The required `key.type` ('public' for wrap, 'private' for unwrap).\n * @param label - Human-readable role label included in the failure message.\n * @returns `Success` with the key (unchanged) when the algorithm, curve, and\n * type all match; otherwise `Failure` with `<label> must be ECDH P-256 (...)`.\n /\nfunction checkEcdhP256(key: CryptoKey, keyType: 'public' \| 'private', label: string): Result<CryptoKey> {\n if (key.algorithm.name !== 'ECDH') {\n return Failure.with(`${label} must be ECDH P-256 (got algorithm '${key.algorithm.name}')`);\n }\n const namedCurve = (key.algorithm as EcKeyAlgorithm).namedCurve;\n if (namedCurve !== 'P-256') {\n return Failure.with(`${label} must be ECDH P-256 (got curve '${namedCurve}')`);\n }\n if (key.type !== keyType) {\n return Failure.with(`${label} must be a ${keyType} CryptoKey (got '${key.type}')`);\n }\n return succeed(key);\n}\n\n/ c8 ignore start - Constructs a provider; only meaningful in a real browser environment /\n/\n Creates a {@link CryptoUtils.BrowserCryptoProvider \| BrowserCryptoProvider} if Web\n * Crypto API is available.\n * @returns `Success` with provider, or `Failure` if not available\n * @public\n /\nexport function createBrowserCryptoProvider(): Result<BrowserCryptoProvider> {\n return captureResult(() => new BrowserCryptoProvider());\n}\n/ c8 ignore stop */\n"]}

package/dist/packlets/crypto-utils/idbPrivateKeyStorage.js ADDED Viewed

@@ -0,0 +1,238 @@
+/*
+ * Copyright (c) 2026 Erik Fortune
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+import { captureAsyncResult, captureResult, fail, succeed } from '@fgv/ts-utils';
+const DEFAULT_DATABASE_NAME = 'fgv-keystore-private-keys';
+const DEFAULT_STORE_NAME = 'privateKeys';
+/**
+ * {@link CryptoUtils.KeyStore.IPrivateKeyStorage | IPrivateKeyStorage}
+ * implementation backed by IndexedDB. Stores `CryptoKey` objects directly via
+ * IndexedDB's structured-clone serialization — no JWK round-trip — so it works
+ * with non-extractable keys.
+ *
+ * `supportsNonExtractable` is `true`: because the `CryptoKey` is stored by
+ * reference (structured clone) rather than exported, the keystore may generate
+ * `extractable: false` keys for maximum security on browsers that support it.
+ *
+ * The database is opened lazily on first use and cached. Each operation runs in
+ * its own transaction, relying on IndexedDB's default serialization. Multi-tab
+ * concurrency is a known limitation: two tabs writing the same id can race; this
+ * implementation targets single-tab use.
+ *
+ * @public
+ */
+export class IdbPrivateKeyStorage {
+    constructor(factory, databaseName, storeName) {
+        /**
+         * `true` — IndexedDB stores `CryptoKey` objects directly, so non-extractable
+         * keys are supported.
+         */
+        this.supportsNonExtractable = true;
+        this._factory = factory;
+        this._databaseName = databaseName;
+        this._storeName = storeName;
+    }
+    /**
+     * Creates a new {@link CryptoUtils.IdbPrivateKeyStorage}.
+     * @param params - Optional {@link CryptoUtils.IIdbPrivateKeyStorageCreateParams}.
+     * @returns `Success` with the new instance, or `Failure` if no IndexedDB
+     * factory is available.
+     */
+    static create(params = {}) {
+        var _a, _b, _c;
+        const factory = (_a = params.indexedDB) !== null && _a !== void 0 ? _a : globalThis.indexedDB;
+        if (factory === undefined) {
+            return fail('IdbPrivateKeyStorage: no IndexedDB factory available (pass params.indexedDB)');
+        }
+        return succeed(new IdbPrivateKeyStorage(factory, (_b = params.databaseName) !== null && _b !== void 0 ? _b : DEFAULT_DATABASE_NAME, (_c = params.storeName) !== null && _c !== void 0 ? _c : DEFAULT_STORE_NAME));
+    }
+    /**
+     * Stores `key` under `id`.
+     * @param id - Storage handle to write under.
+     * @param key - The private `CryptoKey` to persist.
+     */
+    async store(id, key) {
+        if (key.type !== 'private') {
+            return fail(`failed to store private key '${id}': expected a private key, got '${key.type}'`);
+        }
+        return (await this._withStore('readwrite', (store) => this._request(store.put(key, id))))
+            .withErrorFormat((msg) => `failed to store private key '${id}': ${msg}`)
+            .onSuccess(() => succeed(id));
+    }
+    /**
+     * Loads the private key stored under `id`.
+     * @param id - Storage handle to look up.
+     */
+    async load(id) {
+        return (await this._getRaw(id))
+            .withErrorFormat((msg) => `failed to load private key '${id}': ${msg}`)
+            .onSuccess((key) => (key === undefined ? fail(`key not found: '${id}'`) : succeed(key)));
+    }
+    /**
+     * Deletes the entry stored under `id`. Missing ids fail, mirroring the
+     * encrypted-file backend. The existence check and the delete run in separate
+     * transactions (single-tab assumption).
+     * @param id - Storage handle to remove.
+     */
+    async delete(id) {
+        const existingResult = await this._getRaw(id);
+        /* c8 ignore next 3 - defensive: the existence-check read only fails on an IndexedDB environment error */
+        if (existingResult.isFailure()) {
+            return fail(`failed to delete private key '${id}': ${existingResult.message}`);
+        }
+        if (existingResult.value === undefined) {
+            return fail(`key not found: '${id}'`);
+        }
+        return (await this._withStore('readwrite', (store) => this._request(store.delete(id))))
+            .withErrorFormat((msg) => `failed to delete private key '${id}': ${msg}`)
+            .onSuccess(() => succeed(id));
+    }
+    /**
+     * Lists every stored id.
+     */
+    async list() {
+        return (await this._withStore('readonly', (store) => this._request(store.getAllKeys())))
+            .withErrorFormat((msg) => `failed to list private keys: ${msg}`)
+            .onSuccess((keys) => succeed(keys.map((key) => String(key))));
+    }
+    async _getRaw(id) {
+        return this._withStore('readonly', (store) => this._request(store.get(id)));
+    }
+    async _openDb() {
+        if (this._db !== undefined) {
+            return succeed(this._db);
+        }
+        const firstOpen = await this._open(undefined);
+        /* c8 ignore next 3 - defensive: database open only fails on a corrupted/blocked IndexedDB environment */
+        if (firstOpen.isFailure()) {
+            return firstOpen;
+        }
+        // The object store is created in `onupgradeneeded`, which only fires when
+        // the version changes. If a database at this name already existed at the
+        // current version but without our store (e.g. a different `storeName` than
+        // a prior instance used), the store is absent. Re-open at the next version
+        // to add it via a version-bump upgrade rather than failing later writes
+        // with NotFoundError.
+        let db = firstOpen.value;
+        if (!db.objectStoreNames.contains(this._storeName)) {
+            const nextVersion = db.version + 1;
+            db.close();
+            const reopen = await this._open(nextVersion);
+            /* c8 ignore next 3 - defensive: the version-bump re-open only fails on an IndexedDB environment fault */
+            if (reopen.isFailure()) {
+                return reopen;
+            }
+            db = reopen.value;
+        }
+        this._db = db;
+        return succeed(db);
+    }
+    async _open(version) {
+        return captureAsyncResult(() => new Promise((resolve, reject) => {
+            const request = version === undefined
+                ? this._factory.open(this._databaseName)
+                : this._factory.open(this._databaseName, version);
+            request.onupgradeneeded = () => {
+                // Create our object store if absent. This fires on initial creation
+                // and on the version bump used to add a store to an existing
+                // database; future schema migrations extend this hook additively.
+                if (!request.result.objectStoreNames.contains(this._storeName)) {
+                    request.result.createObjectStore(this._storeName);
+                }
+            };
+            request.onsuccess = () => {
+                const db = request.result;
+                // If another connection (e.g. a sibling instance adding a store via
+                // version bump, or another tab) needs to upgrade, close this one so
+                // we don't block it. Clear the cached handle first so the next
+                // operation reopens rather than reusing the now-closed connection.
+                // Single-tab use is the documented assumption; this just prevents a
+                // deadlock when several instances share a db.
+                db.onversionchange = () => {
+                    if (this._db === db) {
+                        this._db = undefined;
+                    }
+                    db.close();
+                };
+                resolve(db);
+            };
+            /* c8 ignore next 2 - defensive: open errors require a corrupted/blocked IndexedDB environment */
+            request.onerror = () => { var _a; return reject((_a = request.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB open failed')); };
+        }));
+    }
+    async _withStore(mode, op) {
+        const dbResult = await this._openDb();
+        /* c8 ignore next 3 - defensive: database open only fails on a corrupted/blocked IndexedDB environment */
+        if (dbResult.isFailure()) {
+            return fail(dbResult.message);
+        }
+        const txnResult = captureResult(() => dbResult.value.transaction(this._storeName, mode));
+        /* c8 ignore next 3 - transaction creation only throws if the store was deleted out from under us */
+        if (txnResult.isFailure()) {
+            return fail(txnResult.message);
+        }
+        const transaction = txnResult.value;
+        // For writes, a successful request is not durable until the transaction
+        // commits (oncomplete); it can still abort afterwards. Attach the completion
+        // listener BEFORE issuing the request so no event is missed, and wait for it
+        // before reporting success. Reads need no such wait.
+        const completion = mode === 'readwrite' ? this._awaitCompletion(transaction) : undefined;
+        // `op` builds and issues the IDB request synchronously (e.g. `store.put`),
+        // which can throw before any Promise is created — DataCloneError on a
+        // non-cloneable value, or a transaction-state DOMException. Run it inside a
+        // capture boundary so those surface as Failure rather than a rejection,
+        // preserving the Result contract.
+        const opOuter = await captureAsyncResult(() => op(transaction.objectStore(this._storeName)));
+        /* c8 ignore next 3 - defensive: synchronous IDB throws (e.g. DataCloneError) are unreachable for the typed public surface (private CryptoKeys clone; reads pass a string id), but the capture preserves the Result contract */
+        if (opOuter.isFailure()) {
+            return fail(opOuter.message);
+        }
+        const opResult = opOuter.value;
+        /* c8 ignore next 3 - defensive: the request itself only fails on an IndexedDB environment fault */
+        if (opResult.isFailure()) {
+            return opResult;
+        }
+        if (completion !== undefined) {
+            const commitResult = await completion;
+            /* c8 ignore next 3 - defensive: a transaction abort after a successful request requires an IndexedDB environment fault */
+            if (commitResult.isFailure()) {
+                return fail(commitResult.message);
+            }
+        }
+        return opResult;
+    }
+    async _request(request) {
+        return captureAsyncResult(() => new Promise((resolve, reject) => {
+            request.onsuccess = () => resolve(request.result);
+            /* c8 ignore next 2 - defensive: per-request errors require a corrupted IndexedDB environment */
+            request.onerror = () => { var _a; return reject((_a = request.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB request failed')); };
+        }));
+    }
+    async _awaitCompletion(transaction) {
+        return captureAsyncResult(() => new Promise((resolve, reject) => {
+            transaction.oncomplete = () => resolve(true);
+            /* c8 ignore next 4 - defensive: abort/error after a successful write requires an IndexedDB environment fault */
+            transaction.onabort = () => { var _a; return reject((_a = transaction.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB transaction aborted')); };
+            transaction.onerror = () => { var _a; return reject((_a = transaction.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB transaction error')); };
+        }));
+    }
+}
+//# sourceMappingURL=idbPrivateKeyStorage.js.map

package/dist/packlets/crypto-utils/idbPrivateKeyStorage.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"idbPrivateKeyStorage.js","sourceRoot":"","sources":["../../../src/packlets/crypto-utils/idbPrivateKeyStorage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,IAAI,EAAU,OAAO,EAAE,MAAM,eAAe,CAAC;AA0BzF,MAAM,qBAAqB,GAAW,2BAA2B,CAAC;AAClE,MAAM,kBAAkB,GAAW,aAAa,CAAC;AAEjD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,oBAAoB;IAY/B,YAAoB,OAAmB,EAAE,YAAoB,EAAE,SAAiB;QAXhF;;;WAGG;QACa,2BAAsB,GAAS,IAAI,CAAC;QAQlD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,MAAM,CAAC,SAA4C,EAAE;;QACjE,MAAM,OAAO,GAA2B,MAAA,MAAM,CAAC,SAAS,mCAAI,UAAU,CAAC,SAAS,CAAC;QACjF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,8EAA8E,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,OAAO,CACZ,IAAI,oBAAoB,CACtB,OAAO,EACP,MAAA,MAAM,CAAC,YAAY,mCAAI,qBAAqB,EAC5C,MAAA,MAAM,CAAC,SAAS,mCAAI,kBAAkB,CACvC,CACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,GAAc;QAC3C,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,gCAAgC,EAAE,mCAAmC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;aACtF,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gCAAgC,EAAE,MAAM,GAAG,EAAE,CAAC;aACvE,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,IAAI,CAAC,EAAU;QAC1B,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;aAC5B,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,+BAA+B,EAAE,MAAM,GAAG,EAAE,CAAC;aACtE,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,MAAM,CAAC,EAAU;QAC5B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9C,yGAAyG;QACzG,IAAI,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,iCAAiC,EAAE,MAAM,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,cAAc,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;aACpF,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iCAAiC,EAAE,MAAM,GAAG,EAAE,CAAC;aACxE,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,IAAI;QACf,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAgB,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;aACpG,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gCAAgC,GAAG,EAAE,CAAC;aAC/D,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,EAAU;QAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAwB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,yGAAyG;QACzG,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,sBAAsB;QACtB,IAAI,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACnD,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC;YACnC,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC7C,yGAAyG;YACzG,IAAI,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;gBACvB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACd,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,OAA2B;QAC7C,OAAO,kBAAkB,CACvB,GAAG,EAAE,CACH,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,OAAO,GACX,OAAO,KAAK,SAAS;gBACnB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;gBACxC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,CAAC,eAAe,GAAG,GAAS,EAAE;gBACnC,oEAAoE;gBACpE,6DAA6D;gBAC7D,kEAAkE;gBAClE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC/D,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC,CAAC;YACF,OAAO,CAAC,SAAS,GAAG,GAAS,EAAE;gBAC7B,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC1B,oEAAoE;gBACpE,oEAAoE;gBACpE,+DAA+D;gBAC/D,mEAAmE;gBACnE,oEAAoE;gBACpE,8CAA8C;gBAC9C,EAAE,CAAC,eAAe,GAAG,GAAS,EAAE;oBAC9B,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;wBACpB,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC;oBACvB,CAAC;oBACD,EAAE,CAAC,KAAK,EAAE,CAAC;gBACb,CAAC,CAAC;gBACF,OAAO,CAAC,EAAE,CAAC,CAAC;YACd,CAAC,CAAC;YACF,iGAAiG;YACjG,OAAO,CAAC,OAAO,GAAG,GAAS,EAAE,WAAC,OAAA,MAAM,CAAC,MAAA,OAAO,CAAC,KAAK,mCAAI,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAA,EAAA,CAAC;QAC5F,CAAC,CAAC,CACL,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAAwB,EACxB,EAAiD;QAEjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,yGAAyG;QACzG,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QACzF,oGAAoG;QACpG,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC;QAEpC,wEAAwE;QACxE,6EAA6E;QAC7E,6EAA6E;QAC7E,qDAAqD;QACrD,MAAM,UAAU,GAAG,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEzF,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,wEAAwE;QACxE,kCAAkC;QAClC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7F,+NAA+N;QAC/N,IAAI,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;QAC/B,mGAAmG;QACnG,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;YACzB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC;YACtC,0HAA0H;YAC1H,IAAI,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAI,OAAsB;QAC9C,OAAO,kBAAkB,CACvB,GAAG,EAAE,CACH,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjC,OAAO,CAAC,SAAS,GAAG,GAAS,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACxD,gGAAgG;YAChG,OAAO,CAAC,OAAO,GAAG,GAAS,EAAE,WAAC,OAAA,MAAM,CAAC,MAAA,OAAO,CAAC,KAAK,mCAAI,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAA,EAAA,CAAC;QAC/F,CAAC,CAAC,CACL,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,WAA2B;QACxD,OAAO,kBAAkB,CACvB,GAAG,EAAE,CACH,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpC,WAAW,CAAC,UAAU,GAAG,GAAS,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnD,gHAAgH;YAChH,WAAW,CAAC,OAAO,GAAG,GAAS,EAAE,WAC/B,OAAA,MAAM,CAAC,MAAA,WAAW,CAAC,KAAK,mCAAI,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAA,EAAA,CAAC;YAC1E,WAAW,CAAC,OAAO,GAAG,GAAS,EAAE,WAC/B,OAAA,MAAM,CAAC,MAAA,WAAW,CAAC,KAAK,mCAAI,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAA,EAAA,CAAC;QAC1E,CAAC,CAAC,CACL,CAAC;IACJ,CAAC;CACF","sourcesContent":["/*\n * Copyright (c) 2026 Erik Fortune\n *\n * Permission is hereby granted, free of charge, to any person obtaining a copy\n * of this software and associated documentation files (the \"Software\"), to deal\n * in the Software without restriction, including without limitation the rights\n * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n * copies of the Software, and to permit persons to whom the Software is\n * furnished to do so, subject to the following conditions:\n *\n * The above copyright notice and this permission notice shall be included in all\n * copies or substantial portions of the Software.\n *\n * THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n * SOFTWARE.\n */\n\nimport { captureAsyncResult, captureResult, fail, Result, succeed } from '@fgv/ts-utils';\nimport { CryptoUtils } from '@fgv/ts-extras';\n\n/**\n * Parameters for {@link CryptoUtils.IdbPrivateKeyStorage.create}.\n * @public\n */\nexport interface IIdbPrivateKeyStorageCreateParams {\n /**\n * IndexedDB database name. Default: `'fgv-keystore-private-keys'`.\n */\n readonly databaseName?: string;\n\n /**\n * IndexedDB object-store name. Default: `'privateKeys'`.\n */\n readonly storeName?: string;\n\n /**\n * IndexedDB factory to use. Defaults to `globalThis.indexedDB`. Supplied\n * explicitly in tests (e.g. a `fake-indexeddb` factory) or to target a\n * non-default factory.\n */\n readonly indexedDB?: IDBFactory;\n}\n\nconst DEFAULT_DATABASE_NAME: string = 'fgv-keystore-private-keys';\nconst DEFAULT_STORE_NAME: string = 'privateKeys';\n\n/**\n * {@link CryptoUtils.KeyStore.IPrivateKeyStorage | IPrivateKeyStorage}\n * implementation backed by IndexedDB. Stores `CryptoKey` objects directly via\n * IndexedDB's structured-clone serialization — no JWK round-trip — so it works\n * with non-extractable keys.\n *\n * `supportsNonExtractable` is `true`: because the `CryptoKey` is stored by\n * reference (structured clone) rather than exported, the keystore may generate\n * `extractable: false` keys for maximum security on browsers that support it.\n *\n * The database is opened lazily on first use and cached. Each operation runs in\n * its own transaction, relying on IndexedDB's default serialization. Multi-tab\n * concurrency is a known limitation: two tabs writing the same id can race; this\n * implementation targets single-tab use.\n *\n * @public\n */\nexport class IdbPrivateKeyStorage implements CryptoUtils.KeyStore.IPrivateKeyStorage {\n /**\n * `true` — IndexedDB stores `CryptoKey` objects directly, so non-extractable\n * keys are supported.\n */\n public readonly supportsNonExtractable: true = true;\n\n private readonly _factory: IDBFactory;\n private readonly _databaseName: string;\n private readonly _storeName: string;\n private _db: IDBDatabase | undefined;\n\n private constructor(factory: IDBFactory, databaseName: string, storeName: string) {\n this._factory = factory;\n this._databaseName = databaseName;\n this._storeName = storeName;\n }\n\n /**\n * Creates a new {@link CryptoUtils.IdbPrivateKeyStorage}.\n * @param params - Optional {@link CryptoUtils.IIdbPrivateKeyStorageCreateParams}.\n * @returns `Success` with the new instance, or `Failure` if no IndexedDB\n * factory is available.\n */\n public static create(params: IIdbPrivateKeyStorageCreateParams = {}): Result<IdbPrivateKeyStorage> {\n const factory: IDBFactory | undefined = params.indexedDB ?? globalThis.indexedDB;\n if (factory === undefined) {\n return fail('IdbPrivateKeyStorage: no IndexedDB factory available (pass params.indexedDB)');\n }\n return succeed(\n new IdbPrivateKeyStorage(\n factory,\n params.databaseName ?? DEFAULT_DATABASE_NAME,\n params.storeName ?? DEFAULT_STORE_NAME\n )\n );\n }\n\n /**\n * Stores `key` under `id`.\n * @param id - Storage handle to write under.\n * @param key - The private `CryptoKey` to persist.\n */\n public async store(id: string, key: CryptoKey): Promise<Result<string>> {\n if (key.type !== 'private') {\n return fail(`failed to store private key '${id}': expected a private key, got '${key.type}'`);\n }\n return (await this._withStore('readwrite', (store) => this._request(store.put(key, id))))\n .withErrorFormat((msg) => `failed to store private key '${id}': ${msg}`)\n .onSuccess(() => succeed(id));\n }\n\n /**\n * Loads the private key stored under `id`.\n * @param id - Storage handle to look up.\n */\n public async load(id: string): Promise<Result<CryptoKey>> {\n return (await this._getRaw(id))\n .withErrorFormat((msg) => `failed to load private key '${id}': ${msg}`)\n .onSuccess((key) => (key === undefined ? fail(`key not found: '${id}'`) : succeed(key)));\n }\n\n /**\n * Deletes the entry stored under `id`. Missing ids fail, mirroring the\n * encrypted-file backend. The existence check and the delete run in separate\n * transactions (single-tab assumption).\n * @param id - Storage handle to remove.\n */\n public async delete(id: string): Promise<Result<string>> {\n const existingResult = await this._getRaw(id);\n /* c8 ignore next 3 - defensive: the existence-check read only fails on an IndexedDB environment error */\n if (existingResult.isFailure()) {\n return fail(`failed to delete private key '${id}': ${existingResult.message}`);\n }\n if (existingResult.value === undefined) {\n return fail(`key not found: '${id}'`);\n }\n return (await this._withStore('readwrite', (store) => this._request(store.delete(id))))\n .withErrorFormat((msg) => `failed to delete private key '${id}': ${msg}`)\n .onSuccess(() => succeed(id));\n }\n\n /**\n * Lists every stored id.\n */\n public async list(): Promise<Result<readonly string[]>> {\n return (await this._withStore('readonly', (store) => this._request<IDBValidKey[]>(store.getAllKeys())))\n .withErrorFormat((msg) => `failed to list private keys: ${msg}`)\n .onSuccess((keys) => succeed(keys.map((key) => String(key))));\n }\n\n private async _getRaw(id: string): Promise<Result<CryptoKey | undefined>> {\n return this._withStore('readonly', (store) => this._request<CryptoKey | undefined>(store.get(id)));\n }\n\n private async _openDb(): Promise<Result<IDBDatabase>> {\n if (this._db !== undefined) {\n return succeed(this._db);\n }\n const firstOpen = await this._open(undefined);\n /* c8 ignore next 3 - defensive: database open only fails on a corrupted/blocked IndexedDB environment */\n if (firstOpen.isFailure()) {\n return firstOpen;\n }\n // The object store is created in `onupgradeneeded`, which only fires when\n // the version changes. If a database at this name already existed at the\n // current version but without our store (e.g. a different `storeName` than\n // a prior instance used), the store is absent. Re-open at the next version\n // to add it via a version-bump upgrade rather than failing later writes\n // with NotFoundError.\n let db = firstOpen.value;\n if (!db.objectStoreNames.contains(this._storeName)) {\n const nextVersion = db.version + 1;\n db.close();\n const reopen = await this._open(nextVersion);\n /* c8 ignore next 3 - defensive: the version-bump re-open only fails on an IndexedDB environment fault */\n if (reopen.isFailure()) {\n return reopen;\n }\n db = reopen.value;\n }\n this._db = db;\n return succeed(db);\n }\n\n private async _open(version: number | undefined): Promise<Result<IDBDatabase>> {\n return captureAsyncResult<IDBDatabase>(\n () =>\n new Promise<IDBDatabase>((resolve, reject) => {\n const request =\n version === undefined\n ? this._factory.open(this._databaseName)\n : this._factory.open(this._databaseName, version);\n request.onupgradeneeded = (): void => {\n // Create our object store if absent. This fires on initial creation\n // and on the version bump used to add a store to an existing\n // database; future schema migrations extend this hook additively.\n if (!request.result.objectStoreNames.contains(this._storeName)) {\n request.result.createObjectStore(this._storeName);\n }\n };\n request.onsuccess = (): void => {\n const db = request.result;\n // If another connection (e.g. a sibling instance adding a store via\n // version bump, or another tab) needs to upgrade, close this one so\n // we don't block it. Clear the cached handle first so the next\n // operation reopens rather than reusing the now-closed connection.\n // Single-tab use is the documented assumption; this just prevents a\n // deadlock when several instances share a db.\n db.onversionchange = (): void => {\n if (this._db === db) {\n this._db = undefined;\n }\n db.close();\n };\n resolve(db);\n };\n /* c8 ignore next 2 - defensive: open errors require a corrupted/blocked IndexedDB environment */\n request.onerror = (): void => reject(request.error ?? new Error('IndexedDB open failed'));\n })\n );\n }\n\n private async _withStore<T>(\n mode: IDBTransactionMode,\n op: (store: IDBObjectStore) => Promise<Result<T>>\n ): Promise<Result<T>> {\n const dbResult = await this._openDb();\n /* c8 ignore next 3 - defensive: database open only fails on a corrupted/blocked IndexedDB environment */\n if (dbResult.isFailure()) {\n return fail(dbResult.message);\n }\n const txnResult = captureResult(() => dbResult.value.transaction(this._storeName, mode));\n /* c8 ignore next 3 - transaction creation only throws if the store was deleted out from under us */\n if (txnResult.isFailure()) {\n return fail(txnResult.message);\n }\n const transaction = txnResult.value;\n\n // For writes, a successful request is not durable until the transaction\n // commits (oncomplete); it can still abort afterwards. Attach the completion\n // listener BEFORE issuing the request so no event is missed, and wait for it\n // before reporting success. Reads need no such wait.\n const completion = mode === 'readwrite' ? this._awaitCompletion(transaction) : undefined;\n\n // `op` builds and issues the IDB request synchronously (e.g. `store.put`),\n // which can throw before any Promise is created — DataCloneError on a\n // non-cloneable value, or a transaction-state DOMException. Run it inside a\n // capture boundary so those surface as Failure rather than a rejection,\n // preserving the Result contract.\n const opOuter = await captureAsyncResult(() => op(transaction.objectStore(this._storeName)));\n /* c8 ignore next 3 - defensive: synchronous IDB throws (e.g. DataCloneError) are unreachable for the typed public surface (private CryptoKeys clone; reads pass a string id), but the capture preserves the Result contract */\n if (opOuter.isFailure()) {\n return fail(opOuter.message);\n }\n const opResult = opOuter.value;\n /* c8 ignore next 3 - defensive: the request itself only fails on an IndexedDB environment fault */\n if (opResult.isFailure()) {\n return opResult;\n }\n if (completion !== undefined) {\n const commitResult = await completion;\n /* c8 ignore next 3 - defensive: a transaction abort after a successful request requires an IndexedDB environment fault */\n if (commitResult.isFailure()) {\n return fail(commitResult.message);\n }\n }\n return opResult;\n }\n\n private async _request<T>(request: IDBRequest<T>): Promise<Result<T>> {\n return captureAsyncResult<T>(\n () =>\n new Promise<T>((resolve, reject) => {\n request.onsuccess = (): void => resolve(request.result);\n /* c8 ignore next 2 - defensive: per-request errors require a corrupted IndexedDB environment */\n request.onerror = (): void => reject(request.error ?? new Error('IndexedDB request failed'));\n })\n );\n }\n\n private async _awaitCompletion(transaction: IDBTransaction): Promise<Result<true>> {\n return captureAsyncResult<true>(\n () =>\n new Promise<true>((resolve, reject) => {\n transaction.oncomplete = (): void => resolve(true);\n /* c8 ignore next 4 - defensive: abort/error after a successful write requires an IndexedDB environment fault */\n transaction.onabort = (): void =>\n reject(transaction.error ?? new Error('IndexedDB transaction aborted'));\n transaction.onerror = (): void =>\n reject(transaction.error ?? new Error('IndexedDB transaction error'));\n })\n );\n }\n}\n"]}

package/dist/packlets/crypto-utils/index.js CHANGED Viewed

@@ -25,4 +25,17 @@
  */
 export * from './browserHashProvider';
 export * from './browserCryptoProvider';
+export * from './idbPrivateKeyStorage';
+// HpkeProvider re-export: implementation lives in @fgv/ts-extras CryptoUtils packlet;
+// re-exported here so browser callers can import from @fgv/ts-web-extras for this primitive.
+// We import from the top-level namespace to avoid relying on package.json exports path
+// resolution (which requires moduleResolution: node16 or bundler).
+import { CryptoUtils } from '@fgv/ts-extras';
+/**
+ * HPKE base mode (RFC 9180) — `DHKEM(X25519, HKDF-SHA256) + HKDF-SHA256 + AES-256-GCM`.
+ * Re-exported from `@fgv/ts-extras` for browser consumers.
+ * @see {@link CryptoUtils.HpkeProvider}
+ * @public
+ */
+export const HpkeProvider = CryptoUtils.HpkeProvider;
 //# sourceMappingURL=index.js.map

package/dist/packlets/crypto-utils/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/packlets/crypto-utils/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;GAGG;AAEH,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC","sourcesContent":["/\n Copyright (c) 2025 Erik Fortune\n \n Permission is hereby granted, free of charge, to any person obtaining a copy\n * of this software and associated documentation files (the \"Software\"), to deal\n * in the Software without restriction, including without limitation the rights\n * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n * copies of the Software, and to permit persons to whom the Software is\n * furnished to do so, subject to the following conditions:\n \n The above copyright notice and this permission notice shall be included in all\n * copies or substantial portions of the Software.\n \n THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n * SOFTWARE.\n /\n\n/\n Browser-compatible cryptographic utilities using the Web Crypto API.\n * @packageDocumentation\n /\n\nexport from './browserHashProvider';\nexport * from './browserCryptoProvider';\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/packlets/crypto-utils/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;GAGG;AAEH,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AAEvC,sFAAsF;AACtF,6FAA6F;AAC7F,uFAAuF;AACvF,mEAAmE;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAoC,WAAW,CAAC,YAAY,CAAC","sourcesContent":["/\n Copyright (c) 2025 Erik Fortune\n \n Permission is hereby granted, free of charge, to any person obtaining a copy\n * of this software and associated documentation files (the \"Software\"), to deal\n * in the Software without restriction, including without limitation the rights\n * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n * copies of the Software, and to permit persons to whom the Software is\n * furnished to do so, subject to the following conditions:\n \n The above copyright notice and this permission notice shall be included in all\n * copies or substantial portions of the Software.\n \n THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n * SOFTWARE.\n /\n\n/\n Browser-compatible cryptographic utilities using the Web Crypto API.\n * @packageDocumentation\n /\n\nexport from './browserHashProvider';\nexport * from './browserCryptoProvider';\nexport * from './idbPrivateKeyStorage';\n\n// HpkeProvider re-export: implementation lives in @fgv/ts-extras CryptoUtils packlet;\n// re-exported here so browser callers can import from @fgv/ts-web-extras for this primitive.\n// We import from the top-level namespace to avoid relying on package.json exports path\n// resolution (which requires moduleResolution: node16 or bundler).\nimport { CryptoUtils } from '@fgv/ts-extras';\n\n/*\n HPKE base mode (RFC 9180) — `DHKEM(X25519, HKDF-SHA256) + HKDF-SHA256 + AES-256-GCM`.\n * Re-exported from `@fgv/ts-extras` for browser consumers.\n * @see {@link CryptoUtils.HpkeProvider}\n * @public\n /\nexport const HpkeProvider: typeof CryptoUtils.HpkeProvider = CryptoUtils.HpkeProvider;\n\n/\n Output of `HpkeProvider.sealBase`. Re-exported from `@fgv/ts-extras`.\n * @public\n */\nexport type IHpkeSealResult = CryptoUtils.IHpkeSealResult;\n"]}

package/dist/packlets/file-tree/directoryHandleStore.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"directoryHandleStore.js","sourceRoot":"","sources":["../../../src/packlets/file-tree/directoryHandleStore.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,gFAAgF;AAChF,YAAY;AAEZ;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAU,OAAO,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAG9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,~~GAAG~~,uBAAuB,CAAC;~~AAEnE~~;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,~~GAAG~~,mBAAmB,CAAC;~~AAElE~~;;;;GAIG;AACH,MAAM,OAAO,oBAAoB;IAG/B,YACE,SAAiB,2BAA2B,EAC5C,YAAoB,8BAA8B;QAElD,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,MAAiC;QAChE,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,8BAA8B,KAAK,MAAM,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,IAAI,CAAC,KAAa;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAA4B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACxE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,8BAA8B,KAAK,MAAM,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,MAAM,CAAC,KAAa;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9B,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,gCAAgC,KAAK,MAAM,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,YAAY;QACvB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAS,IAAI,CAAC,MAAM,CAAC,CAAC;YAChD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,sCAAsC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,MAAM;QACjB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/C,IAAI,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,OAAO,GAAgE,EAAE,CAAC;QAChF,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,YAAY,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF","sourcesContent":["// Copyright (c) 2026 Erik Fortune\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal\n// in the Software without restriction, including without limitation the rights\n// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n// copies of the Software, and to permit persons to whom the Software is\n// furnished to do so, subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all\n// copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n// SOFTWARE.\n\n/*\n Persistent storage for FileSystemDirectoryHandle objects using IndexedDB.\n * Allows directory handles to survive page reloads without re-prompting the user.\n * @packageDocumentation\n /\n\nimport { fail, Result, succeed } from '@fgv/ts-utils';\nimport { createStore, del, get, keys, set } from 'idb-keyval';\nimport { FileSystemDirectoryHandle } from '../file-api-types';\n\n/\n Default IndexedDB database name for directory handles.\n * @public\n /\nexport const DEFAULT_DIRECTORY_HANDLE_DB = 'chocolate-lab-storage';\n\n/\n Default IndexedDB store name for directory handles.\n * @public\n /\nexport const DEFAULT_DIRECTORY_HANDLE_STORE = 'directory-handles';\n\n/\n Manages persistence of {@link FileSystemDirectoryHandle} objects in IndexedDB.\n * Keyed by a label (typically the directory name).\n * @public\n /\nexport class DirectoryHandleStore {\n private readonly _store: ReturnType<typeof createStore>;\n\n public constructor(\n dbName: string = DEFAULT_DIRECTORY_HANDLE_DB,\n storeName: string = DEFAULT_DIRECTORY_HANDLE_STORE\n ) {\n this._store = createStore(dbName, storeName);\n }\n\n /\n Saves a directory handle to IndexedDB under the given label.\n * @param label - Key to store the handle under (typically dirHandle.name)\n * @param handle - The FileSystemDirectoryHandle to persist\n * @returns Success or Failure\n /\n public async save(label: string, handle: FileSystemDirectoryHandle): Promise<Result<void>> {\n try {\n await set(label, handle, this._store);\n return succeed(undefined);\n } catch (e) {\n return fail(`DirectoryHandleStore.save \"${label}\": ${String(e)}`);\n }\n }\n\n /\n Retrieves a directory handle by label.\n * @param label - Key to look up\n * @returns Success with handle (or undefined if not found), or Failure on error\n /\n public async load(label: string): Promise<Result<FileSystemDirectoryHandle \| undefined>> {\n try {\n const handle = await get<FileSystemDirectoryHandle>(label, this._store);\n return succeed(handle);\n } catch (e) {\n return fail(`DirectoryHandleStore.load \"${label}\": ${String(e)}`);\n }\n }\n\n /\n Removes a directory handle from IndexedDB.\n * @param label - Key to remove\n * @returns Success or Failure\n /\n public async remove(label: string): Promise<Result<void>> {\n try {\n await del(label, this._store);\n return succeed(undefined);\n } catch (e) {\n return fail(`DirectoryHandleStore.remove \"${label}\": ${String(e)}`);\n }\n }\n\n /\n Returns all stored labels (keys).\n * @returns Success with array of labels, or Failure\n /\n public async getAllLabels(): Promise<Result<string[]>> {\n try {\n const allKeys = await keys<string>(this._store);\n return succeed(allKeys);\n } catch (e) {\n return fail(`DirectoryHandleStore.getAllLabels: ${String(e)}`);\n }\n }\n\n /\n Returns all stored handles as label/handle pairs.\n * @returns Success with array of entries, or Failure\n */\n public async getAll(): Promise<Result<Array<{ label: string; handle: FileSystemDirectoryHandle }>>> {\n const labelsResult = await this.getAllLabels();\n if (labelsResult.isFailure()) {\n return fail(labelsResult.message);\n }\n\n const entries: Array<{ label: string; handle: FileSystemDirectoryHandle }> = [];\n for (const label of labelsResult.value) {\n const handleResult = await this.load(label);\n if (handleResult.isFailure()) {\n return fail(handleResult.message);\n }\n if (handleResult.value !== undefined) {\n entries.push({ label, handle: handleResult.value });\n }\n }\n return succeed(entries);\n }\n}\n"]}
1	+ {"version":3,"file":"directoryHandleStore.js","sourceRoot":"","sources":["../../../src/packlets/file-tree/directoryHandleStore.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,gFAAgF;AAChF,YAAY;AAEZ;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAU,OAAO,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAG9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAW,uBAAuB,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAW,mBAAmB,CAAC;AAE1E;;;;GAIG;AACH,MAAM,OAAO,oBAAoB;IAG/B,YACE,SAAiB,2BAA2B,EAC5C,YAAoB,8BAA8B;QAElD,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,MAAiC;QAChE,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,8BAA8B,KAAK,MAAM,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,IAAI,CAAC,KAAa;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAA4B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACxE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,8BAA8B,KAAK,MAAM,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,MAAM,CAAC,KAAa;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9B,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,gCAAgC,KAAK,MAAM,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,YAAY;QACvB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAS,IAAI,CAAC,MAAM,CAAC,CAAC;YAChD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,sCAAsC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,MAAM;QACjB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/C,IAAI,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,OAAO,GAAgE,EAAE,CAAC;QAChF,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,YAAY,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF","sourcesContent":["// Copyright (c) 2026 Erik Fortune\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal\n// in the Software without restriction, including without limitation the rights\n// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n// copies of the Software, and to permit persons to whom the Software is\n// furnished to do so, subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all\n// copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n// SOFTWARE.\n\n/*\n Persistent storage for FileSystemDirectoryHandle objects using IndexedDB.\n * Allows directory handles to survive page reloads without re-prompting the user.\n * @packageDocumentation\n /\n\nimport { fail, Result, succeed } from '@fgv/ts-utils';\nimport { createStore, del, get, keys, set } from 'idb-keyval';\nimport { FileSystemDirectoryHandle } from '../file-api-types';\n\n/\n Default IndexedDB database name for directory handles.\n * @public\n /\nexport const DEFAULT_DIRECTORY_HANDLE_DB: string = 'chocolate-lab-storage';\n\n/\n Default IndexedDB store name for directory handles.\n * @public\n /\nexport const DEFAULT_DIRECTORY_HANDLE_STORE: string = 'directory-handles';\n\n/\n Manages persistence of {@link FileSystemDirectoryHandle} objects in IndexedDB.\n * Keyed by a label (typically the directory name).\n * @public\n /\nexport class DirectoryHandleStore {\n private readonly _store: ReturnType<typeof createStore>;\n\n public constructor(\n dbName: string = DEFAULT_DIRECTORY_HANDLE_DB,\n storeName: string = DEFAULT_DIRECTORY_HANDLE_STORE\n ) {\n this._store = createStore(dbName, storeName);\n }\n\n /\n Saves a directory handle to IndexedDB under the given label.\n * @param label - Key to store the handle under (typically dirHandle.name)\n * @param handle - The FileSystemDirectoryHandle to persist\n * @returns Success or Failure\n /\n public async save(label: string, handle: FileSystemDirectoryHandle): Promise<Result<void>> {\n try {\n await set(label, handle, this._store);\n return succeed(undefined);\n } catch (e) {\n return fail(`DirectoryHandleStore.save \"${label}\": ${String(e)}`);\n }\n }\n\n /\n Retrieves a directory handle by label.\n * @param label - Key to look up\n * @returns Success with handle (or undefined if not found), or Failure on error\n /\n public async load(label: string): Promise<Result<FileSystemDirectoryHandle \| undefined>> {\n try {\n const handle = await get<FileSystemDirectoryHandle>(label, this._store);\n return succeed(handle);\n } catch (e) {\n return fail(`DirectoryHandleStore.load \"${label}\": ${String(e)}`);\n }\n }\n\n /\n Removes a directory handle from IndexedDB.\n * @param label - Key to remove\n * @returns Success or Failure\n /\n public async remove(label: string): Promise<Result<void>> {\n try {\n await del(label, this._store);\n return succeed(undefined);\n } catch (e) {\n return fail(`DirectoryHandleStore.remove \"${label}\": ${String(e)}`);\n }\n }\n\n /\n Returns all stored labels (keys).\n * @returns Success with array of labels, or Failure\n /\n public async getAllLabels(): Promise<Result<string[]>> {\n try {\n const allKeys = await keys<string>(this._store);\n return succeed(allKeys);\n } catch (e) {\n return fail(`DirectoryHandleStore.getAllLabels: ${String(e)}`);\n }\n }\n\n /\n Returns all stored handles as label/handle pairs.\n * @returns Success with array of entries, or Failure\n */\n public async getAll(): Promise<Result<Array<{ label: string; handle: FileSystemDirectoryHandle }>>> {\n const labelsResult = await this.getAllLabels();\n if (labelsResult.isFailure()) {\n return fail(labelsResult.message);\n }\n\n const entries: Array<{ label: string; handle: FileSystemDirectoryHandle }> = [];\n for (const label of labelsResult.value) {\n const handleResult = await this.load(label);\n if (handleResult.isFailure()) {\n return fail(handleResult.message);\n }\n if (handleResult.value !== undefined) {\n entries.push({ label, handle: handleResult.value });\n }\n }\n return succeed(entries);\n }\n}\n"]}

package/dist/packlets/file-tree/fileApiTreeAccessors.js CHANGED Viewed

@@ -236,7 +236,7 @@ export class FileApiTreeAccessors {
     }
     /**
      * Extract file metadata from a File.
-     * @param fileList - The File to extract metadata from
+     * @param file - The File to extract metadata from
      * @returns The {@link IFileMetadata | file metadata}
      */
     static extractFileMetadata(file) {