@fungi.computer/ear-tag 0.0.0-stage → 0.0.1

package/dist/keys.js

@@ -0,0 +1,567 @@
+import { defineIdFamily } from "@fungi.computer/cairn/id";
+import { z } from "zod";
+import { generateKeyAndHash, hashKey } from "./index.js";
+const rateLimitSchema = z.strictObject({
+    limit: z.number().int().positive(),
+    windowSeconds: z.number().int().positive(),
+});
+class Refusal extends Error {
+    code;
+    retryAfterSeconds;
+    constructor(code, retryAfterSeconds) {
+        super(`Ear Tag key store refusal: ${code}`);
+        this.code = code;
+        this.retryAfterSeconds = retryAfterSeconds;
+        this.name = "Refusal";
+    }
+}
+const PREFIX_PATTERN = /^[a-z][a-z0-9]*(?:_[a-z][a-z0-9]*)*$/;
+const prefixSchema = z.string().min(1).max(24).regex(PREFIX_PATTERN);
+const requestIdSchema = z.string().min(1).max(112);
+/**
+ * Create one tenant-scoped key store: bearer-key issuance, verification and
+ * lifecycle over one host's capability vocabulary. One store instance is one
+ * tenant; namespacing between tenants is the host's own table or storage
+ * boundary, not a column inside this store.
+ */
+export function createKeyStore(options) {
+    const prefix = prefixSchema.parse(options.prefix);
+    const now = options.now ?? Date.now;
+    const vocabulary = options.vocabulary;
+    const sql = options.sql;
+    const ids = defineIdFamily({
+        family: "ear-tag",
+        version: 1,
+        kinds: { key: { prefix } },
+    });
+    const keysTable = `ear_tag_${prefix}_keys`;
+    const receiptsTable = `ear_tag_${prefix}_key_receipts`;
+    const suspensionsTable = `ear_tag_${prefix}_key_suspensions`;
+    const useReceiptsTable = `ear_tag_${prefix}_key_use_receipts`;
+    const ensure = () => {
+        sql.exec(`CREATE TABLE IF NOT EXISTS ${keysTable} (
+      key_id TEXT PRIMARY KEY,
+      owner TEXT NOT NULL,
+      digest TEXT NOT NULL UNIQUE,
+      name TEXT NOT NULL,
+      grants TEXT NOT NULL,
+      grant_version INTEGER NOT NULL CHECK(grant_version > 0),
+      expires_at INTEGER,
+      revoked_at INTEGER,
+      rate_limit TEXT,
+      last_used_at INTEGER,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    ) STRICT`);
+        sql.exec(`CREATE TABLE IF NOT EXISTS ${receiptsTable} (
+      request_id TEXT PRIMARY KEY,
+      kind TEXT NOT NULL CHECK(kind IN ('grants','revoke')),
+      actor_id TEXT NOT NULL,
+      input TEXT NOT NULL,
+      metadata TEXT NOT NULL
+    ) STRICT`);
+        sql.exec(`CREATE TABLE IF NOT EXISTS ${suspensionsTable} (
+      key_id TEXT PRIMARY KEY, suspended_at INTEGER NOT NULL
+    ) STRICT`);
+        sql.exec(`CREATE TABLE IF NOT EXISTS ${useReceiptsTable} (
+      request_id TEXT PRIMARY KEY, key_id TEXT NOT NULL, grant_version INTEGER NOT NULL,
+      capability TEXT NOT NULL, target TEXT, at INTEGER NOT NULL
+    ) STRICT`);
+    };
+    const keyRowSchema = z.strictObject({
+        key_id: z.string().min(1).max(256),
+        owner: z.string().min(1).max(256),
+        digest: z.string().length(64),
+        name: z.string().min(1).max(128),
+        grants: z.string(),
+        grant_version: z.number().int().positive(),
+        expires_at: z.number().int().positive().nullable(),
+        revoked_at: z.number().int().nonnegative().nullable(),
+        rate_limit: z.string().nullable(),
+        last_used_at: z.number().int().nonnegative().nullable(),
+        created_at: z.number().int().nonnegative(),
+        updated_at: z.number().int().nonnegative(),
+    });
+    const grantsArraySchema = z.array(vocabulary.grantSchema).min(1).max(64);
+    const issueInputSchema = z.strictObject({
+        name: z.string().trim().min(1).max(128),
+        grants: grantsArraySchema,
+        keyId: z.string().min(1).max(256).optional(),
+        expiresAt: z.number().int().positive().optional(),
+        rateLimit: rateLimitSchema.optional(),
+    });
+    const updateGrantsInputSchema = z.strictObject({
+        requestId: requestIdSchema,
+        keyId: z.string().min(1).max(256),
+        expectedGrantVersion: z.number().int().positive(),
+        grants: grantsArraySchema,
+    });
+    const keyRecordSchema = z.strictObject({
+        keyId: z.string().min(1).max(256),
+        owner: z.string().min(1).max(256),
+        name: z.string().min(1).max(128),
+        scope: vocabulary.scopeSchema.nullable(),
+        grantVersion: z.number().int().positive(),
+        expiresAt: z.number().int().positive().nullable(),
+        revokedAt: z.number().int().nonnegative().nullable(),
+        rateLimit: rateLimitSchema.nullable(),
+        lastUsedAt: z.number().int().nonnegative().nullable(),
+        createdAt: z.number().int().nonnegative(),
+        updatedAt: z.number().int().nonnegative(),
+    });
+    const revokeInputSchema = z.strictObject({
+        requestId: requestIdSchema,
+        keyId: z.string().min(1).max(256),
+    });
+    const admitUseInputSchema = z.strictObject({
+        capability: vocabulary.capabilityNameSchema,
+        target: z.string().min(1).max(256).optional(),
+        requestId: z.string().min(1).max(256),
+    });
+    const keyPrincipalSchema = z.strictObject({
+        keyId: z.string().min(1).max(256),
+        owner: z.string().min(1).max(256),
+        name: z.string().min(1).max(128),
+        scope: vocabulary.scopeSchema,
+        grantVersion: z.number().int().positive(),
+        expiresAt: z.number().int().positive().nullable(),
+    });
+    const mutationReceiptRowSchema = z.strictObject({
+        request_id: requestIdSchema,
+        kind: z.enum(["grants", "revoke"]),
+        actor_id: z.string().min(1).max(256),
+        input: z.string().min(1),
+        metadata: z.string().min(1),
+    });
+    const columns = "key_id,owner,digest,name,grants,grant_version,expires_at,revoked_at,rate_limit,last_used_at,created_at,updated_at";
+    const decodeScope = (json) => {
+        let parsed;
+        try {
+            parsed = JSON.parse(json);
+        }
+        catch {
+            return null;
+        }
+        const result = vocabulary.scopeSchema.safeParse(parsed);
+        if (!result.success)
+            return null;
+        return { grants: vocabulary.canonicalGrants(result.data.grants) };
+    };
+    // Unlike a corrupt scope (which fails closed to no authority), a corrupt
+    // rate limit must never fail open to unlimited: a stored, non-null policy
+    // that cannot be read back refuses the whole record as unavailable.
+    const decodeRateLimit = (json) => {
+        if (json === null)
+            return null;
+        let parsed;
+        try {
+            parsed = JSON.parse(json);
+        }
+        catch {
+            throw new Refusal("unavailable");
+        }
+        const result = rateLimitSchema.safeParse(parsed);
+        if (!result.success)
+            throw new Refusal("unavailable");
+        return result.data;
+    };
+    const decode = (row) => {
+        const parsed = keyRowSchema.safeParse(row);
+        if (!parsed.success)
+            throw new Refusal("unavailable");
+        // A key id is either store-generated (`ids.key.generate()`) or
+        // host-chosen at issuance (`IssueKeyInput.keyId`); only the former has
+        // this id family's own shape, so decode trusts it as the plain, bounded
+        // string `keyRowSchema` already validated above, not a family member.
+        return {
+            keyId: parsed.data.key_id,
+            owner: parsed.data.owner,
+            name: parsed.data.name,
+            scope: decodeScope(parsed.data.grants),
+            grantVersion: parsed.data.grant_version,
+            expiresAt: parsed.data.expires_at,
+            revokedAt: parsed.data.revoked_at,
+            rateLimit: decodeRateLimit(parsed.data.rate_limit),
+            lastUsedAt: parsed.data.last_used_at,
+            createdAt: parsed.data.created_at,
+            updatedAt: parsed.data.updated_at,
+        };
+    };
+    const readById = (keyId) => {
+        ensure();
+        const row = sql
+            .exec(`SELECT ${columns} FROM ${keysTable} WHERE key_id=?`, keyId)
+            .toArray()[0];
+        return row === undefined ? null : decode(row);
+    };
+    const isSuspended = (keyId) => sql
+        .exec(`SELECT key_id FROM ${suspensionsTable} WHERE key_id=?`, keyId)
+        .toArray().length > 0;
+    const requireActive = (record) => {
+        if (record.scope === null)
+            throw new Refusal("denied");
+        if (record.revokedAt !== null)
+            throw new Refusal("denied");
+        if (isSuspended(record.keyId))
+            throw new Refusal("denied");
+        if (record.expiresAt !== null && record.expiresAt <= now())
+            throw new Refusal("expired");
+        return { ...record, scope: record.scope };
+    };
+    const principalFor = (record) => ({
+        keyId: record.keyId,
+        owner: record.owner,
+        name: record.name,
+        scope: record.scope,
+        grantVersion: record.grantVersion,
+        expiresAt: record.expiresAt,
+    });
+    const assertIssuer = async (actorId, grants) => {
+        const authority = await options.authorizeIssuer(actorId);
+        if (authority === null)
+            throw new Refusal("denied");
+        if (authority.kind === "bounded" &&
+            !vocabulary.isSubset(grants, authority.grants))
+            throw new Refusal("denied");
+    };
+    const rateWindows = new Map();
+    const admitRate = (keyId, policy) => {
+        const at = now();
+        for (const [id, window] of rateWindows)
+            if (at - window.windowStart >= window.windowMs)
+                rateWindows.delete(id);
+        const windowMs = policy.windowSeconds * 1_000;
+        const window = rateWindows.get(keyId);
+        if (window === undefined || at - window.windowStart >= window.windowMs) {
+            rateWindows.set(keyId, { windowStart: at, count: 1, windowMs });
+            return null;
+        }
+        if (window.count >= policy.limit)
+            return Math.max(1, Math.ceil((window.windowStart + window.windowMs - at) / 1_000));
+        rateWindows.set(keyId, { ...window, count: window.count + 1 });
+        return null;
+    };
+    const currentImpl = (rawPrincipal) => {
+        const principal = keyPrincipalSchema.parse(rawPrincipal);
+        const record = readById(principal.keyId);
+        if (record === null)
+            throw new Refusal("denied");
+        const active = requireActive(record);
+        if (active.grantVersion !== principal.grantVersion)
+            throw new Refusal("denied");
+        return principalFor(active);
+    };
+    const currentLiveImpl = async (principal) => {
+        const record = currentImpl(principal);
+        await assertIssuer(record.owner, record.scope.grants);
+        return currentImpl(record);
+    };
+    const verifyImpl = async (secret) => {
+        const digest = await hashKey(secret);
+        ensure();
+        const row = sql
+            .exec(`SELECT ${columns} FROM ${keysTable} WHERE digest=?`, digest)
+            .toArray()[0];
+        if (row === undefined)
+            throw new Refusal("denied");
+        const record = requireActive(decode(row));
+        await assertIssuer(record.owner, record.scope.grants);
+        const freshRecord = readById(record.keyId);
+        if (freshRecord === null)
+            throw new Refusal("denied");
+        const fresh = requireActive(freshRecord);
+        if (fresh.rateLimit !== null) {
+            const retryAfterSeconds = admitRate(fresh.keyId, fresh.rateLimit);
+            if (retryAfterSeconds !== null)
+                throw new Refusal("rate_limited", retryAfterSeconds);
+        }
+        return principalFor(fresh);
+    };
+    // Merging grants that share a capability can push one grant's `ids` past
+    // the bound `grantTargetsSchema` allows even when every grant the caller
+    // sent was itself within bounds (two disjoint 129-id grants merge into
+    // one 258-id grant). The merged, canonical form is what gets stored and
+    // later read back through this same `scopeSchema`, so it must pass that
+    // schema here too, before anything is written: an over-bound merge is
+    // the caller's own invalid input, never a bound this store relaxes, and
+    // refusing it before any write leaves the key exactly as it was.
+    const requireValidScope = (grants) => {
+        if (!vocabulary.scopeSchema.safeParse({ grants }).success)
+            throw new Refusal("invalid");
+    };
+    const issueImpl = async (actorId, rawInput) => {
+        const input = issueInputSchema.parse(rawInput);
+        const grants = vocabulary.canonicalGrants(input.grants);
+        requireValidScope(grants);
+        if (input.expiresAt !== undefined && input.expiresAt <= now())
+            throw new Refusal("denied");
+        await assertIssuer(actorId, grants);
+        const generated = await generateKeyAndHash({ prefix });
+        const createdAt = now();
+        const record = await options.commit(() => {
+            ensure();
+            const keyId = input.keyId ?? ids.key.generate();
+            // An id is never reused, including one a now-revoked key already
+            // held: revoke tombstones the row rather than deleting it, so it
+            // still answers here. The check and the insert share this one
+            // commit, so no other write can land between them; the PRIMARY KEY
+            // on key_id is the storage-level backstop behind this refusal.
+            if (readById(keyId) !== null)
+                throw new Refusal("conflict");
+            sql.exec(`INSERT INTO ${keysTable} (${columns}) VALUES (?,?,?,?,?,1,?,NULL,?,NULL,?,?)`, keyId, actorId, generated.digest, input.name, JSON.stringify({ grants }), input.expiresAt ?? null, input.rateLimit ? JSON.stringify(input.rateLimit) : null, createdAt, createdAt);
+            const stored = readById(keyId);
+            if (stored === null)
+                throw new Refusal("unavailable");
+            return requireActive(stored);
+        });
+        return { key: generated.key, record };
+    };
+    const readMutationReceipt = (requestId) => {
+        const raw = sql
+            .exec(`SELECT request_id,kind,actor_id,input,metadata FROM ${receiptsTable} WHERE request_id=?`, requestId)
+            .toArray()[0];
+        if (raw === undefined)
+            return null;
+        const row = mutationReceiptRowSchema.safeParse(raw);
+        if (!row.success)
+            throw new Refusal("unavailable");
+        let metadata;
+        try {
+            metadata = JSON.parse(row.data.metadata);
+        }
+        catch {
+            throw new Refusal("unavailable");
+        }
+        const parsedMetadata = keyRecordSchema.safeParse(metadata);
+        if (!parsedMetadata.success)
+            throw new Refusal("unavailable");
+        return {
+            kind: row.data.kind,
+            actorId: row.data.actor_id,
+            input: row.data.input,
+            metadata: parsedMetadata.data,
+        };
+    };
+    const recordMutationReceipt = (requestId, receipt) => {
+        sql.exec(`INSERT INTO ${receiptsTable} (request_id,kind,actor_id,input,metadata) VALUES (?,?,?,?,?)`, requestId, receipt.kind, receipt.actorId, receipt.input, JSON.stringify(receipt.metadata));
+    };
+    const replayMutation = (requestId, actorId, kind, input) => {
+        const prior = readMutationReceipt(requestId);
+        if (prior === null)
+            return null;
+        if (prior.kind !== kind ||
+            prior.actorId !== actorId ||
+            prior.input !== input)
+            throw new Refusal("conflict");
+        return prior.metadata;
+    };
+    const fence = (requestId, record) => {
+        options.onAuthorityChange?.({
+            requestId,
+            keyId: record.keyId,
+            grantVersion: record.grantVersion,
+            expiresAt: record.expiresAt,
+        });
+    };
+    const updateGrantsImpl = async (actorId, rawInput) => {
+        const input = updateGrantsInputSchema.parse(rawInput);
+        const grants = vocabulary.canonicalGrants(input.grants);
+        requireValidScope(grants);
+        await assertIssuer(actorId, grants);
+        const inputKey = JSON.stringify({
+            keyId: input.keyId,
+            expectedGrantVersion: input.expectedGrantVersion,
+            grants,
+        });
+        const replay = replayMutation(input.requestId, actorId, "grants", inputKey);
+        if (replay !== null)
+            return replay;
+        return options.commit(() => {
+            const repeated = replayMutation(input.requestId, actorId, "grants", inputKey);
+            if (repeated !== null)
+                return repeated;
+            const current = readById(input.keyId);
+            if (current === null)
+                throw new Refusal("denied");
+            if (current.revokedAt !== null)
+                throw new Refusal("denied");
+            if (current.grantVersion !== input.expectedGrantVersion)
+                throw new Refusal("conflict");
+            const updatedAt = now();
+            sql.exec(`UPDATE ${keysTable} SET grants=?,grant_version=grant_version+1,updated_at=? WHERE key_id=? AND grant_version=? AND revoked_at IS NULL`, JSON.stringify({ grants }), updatedAt, input.keyId, input.expectedGrantVersion);
+            const after = readById(input.keyId);
+            if (after === null)
+                throw new Refusal("conflict");
+            if (after.grantVersion !== input.expectedGrantVersion + 1)
+                throw new Refusal("conflict");
+            fence(input.requestId, after);
+            recordMutationReceipt(input.requestId, {
+                kind: "grants",
+                actorId,
+                input: inputKey,
+                metadata: after,
+            });
+            return after;
+        });
+    };
+    const revokeImpl = async (actorId, rawInput) => {
+        const input = revokeInputSchema.parse(rawInput);
+        const authority = await options.authorizeIssuer(actorId);
+        if (authority === null)
+            throw new Refusal("denied");
+        const inputKey = JSON.stringify({ keyId: input.keyId });
+        const replay = replayMutation(input.requestId, actorId, "revoke", inputKey);
+        if (replay !== null)
+            return replay;
+        return options.commit(() => {
+            const repeated = replayMutation(input.requestId, actorId, "revoke", inputKey);
+            if (repeated !== null)
+                return repeated;
+            const current = readById(input.keyId);
+            if (current === null)
+                throw new Refusal("denied");
+            if (current.revokedAt === null) {
+                const revokedAt = now();
+                sql.exec(`UPDATE ${keysTable} SET revoked_at=?,updated_at=? WHERE key_id=? AND revoked_at IS NULL`, revokedAt, revokedAt, current.keyId);
+            }
+            const revoked = readById(current.keyId);
+            if (revoked === null)
+                throw new Refusal("conflict");
+            if (revoked.revokedAt === null)
+                throw new Refusal("conflict");
+            fence(input.requestId, revoked);
+            recordMutationReceipt(input.requestId, {
+                kind: "revoke",
+                actorId,
+                input: inputKey,
+                metadata: revoked,
+            });
+            return revoked;
+        });
+    };
+    const listImpl = async (actorId, owner) => {
+        const authority = await options.authorizeIssuer(actorId);
+        if (authority === null)
+            throw new Refusal("denied");
+        ensure();
+        const rows = owner === undefined
+            ? sql
+                .exec(`SELECT ${columns} FROM ${keysTable} ORDER BY created_at DESC,key_id DESC`)
+                .toArray()
+            : sql
+                .exec(`SELECT ${columns} FROM ${keysTable} WHERE owner=? ORDER BY created_at DESC,key_id DESC`, owner)
+                .toArray();
+        return rows.map(decode);
+    };
+    const readImpl = async (actorId, keyId) => {
+        const record = readById(keyId);
+        if (record === null)
+            throw new Refusal("denied");
+        const active = requireActive(record);
+        await assertIssuer(actorId, active.scope.grants);
+        return principalFor(active);
+    };
+    const admitUseImpl = async (principal, rawInput) => {
+        const input = admitUseInputSchema.parse(rawInput);
+        const live = await currentLiveImpl(principal);
+        if (!vocabulary.grantsAllow(live.scope.grants, input.capability, input.target))
+            throw new Refusal("denied");
+        const at = now();
+        await options.commit(() => {
+            currentImpl(live);
+            const prior = sql
+                .exec(`SELECT key_id,grant_version,capability,target FROM ${useReceiptsTable} WHERE request_id=?`, input.requestId)
+                .toArray()[0];
+            if (prior !== undefined) {
+                if (prior.key_id !== live.keyId ||
+                    prior.grant_version !== live.grantVersion ||
+                    prior.capability !== input.capability ||
+                    prior.target !== (input.target ?? null))
+                    throw new Refusal("conflict");
+                return;
+            }
+            sql.exec(`INSERT INTO ${useReceiptsTable} (request_id,key_id,grant_version,capability,target,at) VALUES (?,?,?,?,?,?)`, input.requestId, live.keyId, live.grantVersion, input.capability, input.target ?? null, at);
+        });
+        return live;
+    };
+    const suspendOwnerImpl = async (owner, requestId) => {
+        ensure();
+        await options.commit(() => {
+            const rows = sql
+                .exec(`SELECT ${columns} FROM ${keysTable} WHERE owner=?`, owner)
+                .toArray()
+                .map(decode);
+            for (const record of rows) {
+                sql.exec(`INSERT OR IGNORE INTO ${suspensionsTable} (key_id,suspended_at) VALUES (?,?)`, record.keyId, now());
+                fence(JSON.stringify(["owner-suspension", requestId, record.keyId]), record);
+            }
+        });
+    };
+    const revokeAllImpl = (closedAt) => {
+        ensure();
+        const rows = sql
+            .exec(`SELECT ${columns} FROM ${keysTable} WHERE revoked_at IS NULL`)
+            .toArray()
+            .map(decode);
+        for (const record of rows) {
+            sql.exec(`UPDATE ${keysTable} SET revoked_at=?,updated_at=? WHERE key_id=? AND revoked_at IS NULL`, closedAt, closedAt, record.keyId);
+            // Fence the post-revoke row, not the pre-revoke `record` read above;
+            // grantVersion and expiresAt do not change on revoke, but a fence
+            // naming a now-revoked key must never read as still live.
+            const revoked = readById(record.keyId);
+            if (revoked !== null)
+                fence(JSON.stringify(["revoke-all", closedAt, record.keyId]), revoked);
+        }
+    };
+    const touchImpl = async (keyId) => {
+        const record = readById(keyId);
+        if (record === null)
+            throw new Refusal("denied");
+        await options.commit(() => {
+            ensure();
+            sql.exec(`UPDATE ${keysTable} SET last_used_at=? WHERE key_id=?`, now(), keyId);
+        });
+    };
+    const boundary = async (operation) => {
+        try {
+            return { kind: "ok", value: await operation() };
+        }
+        catch (error) {
+            if (error instanceof Refusal)
+                return {
+                    kind: "error",
+                    error: error.retryAfterSeconds === undefined
+                        ? { code: error.code }
+                        : {
+                            code: error.code,
+                            retryAfterSeconds: error.retryAfterSeconds,
+                        },
+                };
+            // Every `.parse()` call in this store runs only on caller-supplied
+            // input (stored data is always read through `.safeParse()` and a
+            // `Refusal` above), so a ZodError here is always the caller's own
+            // malformed request, never the store's state.
+            if (error instanceof z.ZodError)
+                return { kind: "error", error: { code: "invalid" } };
+            // An unexpected, unclassified failure: never silently relabel it as
+            // one of the closed reasons above without a trace of what it was.
+            console.error("Ear Tag key store: unexpected failure", error);
+            return { kind: "error", error: { code: "unavailable" } };
+        }
+    };
+    return {
+        issue: (actorId, input) => boundary(() => issueImpl(actorId, input)),
+        verify: (secret) => boundary(() => verifyImpl(secret)),
+        current: (principal) => boundary(() => currentImpl(principal)),
+        list: (actorId, owner) => boundary(() => listImpl(actorId, owner)),
+        read: (actorId, keyId) => boundary(() => readImpl(actorId, keyId)),
+        updateGrants: (actorId, input) => boundary(() => updateGrantsImpl(actorId, input)),
+        revoke: (actorId, input) => boundary(() => revokeImpl(actorId, input)),
+        suspendOwner: (owner, requestId) => boundary(() => suspendOwnerImpl(owner, requestId)),
+        revokeAll: (closedAt) => boundary(() => {
+            revokeAllImpl(closedAt);
+        }),
+        admitUse: (principal, input) => boundary(() => admitUseImpl(principal, input)),
+        touch: (keyId) => boundary(() => touchImpl(keyId)),
+    };
+}

package/docs/api/README.md

@@ -0,0 +1,16 @@
+<!-- Generated by Botanical API docs (TypeDoc + typedoc-plugin-markdown). Do not edit. -->
+
+**@fungi.computer/ear-tag**
+
+---
+
+# @fungi.computer/ear-tag
+
+## Modules
+
+| Module                    | Description |
+| ------------------------- | ----------- |
+| [grants](grants.md)       | -           |
+| [index](index.md)         | -           |
+| [keys-node](keys-node.md) | -           |
+| [keys](keys.md)           | -           |