@modainteract/moda-interact-shared 5.1.0 → 5.3.0

package/dist/security/credentials/node.js

@@ -1,316 +1,15 @@
 import {
-  CommerceEnvironmentSchema
-} from "../../chunk-FTUTJH7W.js";
-import {
-  canonicalJson
-} from "../../chunk-AUS3WQIW.js";
-
-// src/security/credentials/errors.ts
-var MESSAGES = {
-  INVALID_KEYRING: "Invalid credential keyring configuration",
-  KEY_UNAVAILABLE: "Credential encryption key is unavailable",
-  INVALID_CREDENTIAL: "Invalid encrypted credential",
-  INVALID_COMMAND_HMAC_KEY: "Invalid command authentication key"
-};
-var CredentialSecurityError = class extends Error {
-  code;
-  constructor(code) {
-    super(MESSAGES[code]);
-    this.name = "CredentialSecurityError";
-    this.code = code;
-  }
-};
-
-// src/security/credentials/aad.ts
-var KEY_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
-var PURPOSES = /* @__PURE__ */ new Set(["MERCHANT_KNOWLEDGE", "REFERENCE_TAXONOMY"]);
-var FORBIDDEN_ID_CHARACTERS = /[\r\n\0]/;
-var INVALID_UNICODE = /\p{Surrogate}/u;
-var RESERVED_KEY_IDS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
-function invalidAad() {
-  throw new CredentialSecurityError("INVALID_CREDENTIAL");
-}
-function isBoundedIdentifier(value, limit) {
-  return typeof value === "string" && value.length >= 1 && value.length <= limit && value.trim().length > 0 && !FORBIDDEN_ID_CHARACTERS.test(value) && !INVALID_UNICODE.test(value);
-}
-function createCommerceEmbeddingCredentialAad(input) {
-  if (input === null || typeof input !== "object" || !CommerceEnvironmentSchema.safeParse(input.environment).success || !PURPOSES.has(input.purpose) || !isBoundedIdentifier(input.provider, 128) || typeof input.keyId !== "string" || !KEY_ID_PATTERN.test(input.keyId) || RESERVED_KEY_IDS.has(input.keyId)) {
-    return invalidAad();
-  }
-  return canonicalJson({
-    credentialType: "EMBEDDING",
-    environment: input.environment,
-    purpose: input.purpose,
-    provider: input.provider,
-    keyId: input.keyId
-  });
-}
-function createWooRestReadGrantAad(input) {
-  if (input === null || typeof input !== "object" || !isBoundedIdentifier(input.shopId, 128) || !isBoundedIdentifier(input.installationId, 128) || !isBoundedIdentifier(input.authorizationAttemptId, 128) || !Number.isSafeInteger(input.credentialVersionSnapshot) || input.credentialVersionSnapshot < 1) {
-    return invalidAad();
-  }
-  return JSON.stringify([
-    "moda-woo-rest-read-v1",
-    input.shopId,
-    input.installationId,
-    input.authorizationAttemptId,
-    input.credentialVersionSnapshot
-  ]);
-}
-
-// src/security/credentials/keyring.ts
-import { Buffer } from "buffer";
-var KEY_ID_PATTERN2 = /^[A-Za-z0-9_-]{1,64}$/;
-var STANDARD_BASE64_KEY_PATTERN = /^[A-Za-z0-9+/]{43}=$/;
-var RESERVED_KEY_IDS2 = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
-var MAX_CONFIG_BYTES = 4096;
-var MAX_KEYS = 16;
-var KEY_BYTES = 32;
-var privateKeys = /* @__PURE__ */ new WeakMap();
-function invalidKeyring() {
-  throw new CredentialSecurityError("INVALID_KEYRING");
-}
-function readJsonString(raw, start) {
-  if (raw[start] !== '"') invalidKeyring();
-  let cursor = start + 1;
-  while (cursor < raw.length) {
-    const character = raw[cursor];
-    if (character === "\\") {
-      cursor += 2;
-      continue;
-    }
-    if (character === '"') {
-      const decoded = JSON.parse(raw.slice(start, cursor + 1));
-      if (typeof decoded !== "string") invalidKeyring();
-      return [decoded, cursor + 1];
-    }
-    cursor += 1;
-  }
-  return invalidKeyring();
-}
-function parseUniqueStringObject(raw) {
-  let decoded;
-  try {
-    decoded = JSON.parse(raw);
-  } catch {
-    return invalidKeyring();
-  }
-  if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded)) {
-    return invalidKeyring();
-  }
-  let index = 0;
-  const skipWhitespace = () => {
-    while (index < raw.length && /[ \t\r\n]/.test(raw[index])) index += 1;
-  };
-  const entries = /* @__PURE__ */ new Map();
-  skipWhitespace();
-  if (raw[index++] !== "{") return invalidKeyring();
-  skipWhitespace();
-  if (raw[index] === "}") return invalidKeyring();
-  while (index < raw.length) {
-    const [key, afterKey] = readJsonString(raw, index);
-    if (entries.has(key)) return invalidKeyring();
-    if (!KEY_ID_PATTERN2.test(key) || RESERVED_KEY_IDS2.has(key)) return invalidKeyring();
-    index = afterKey;
-    skipWhitespace();
-    if (raw[index++] !== ":") return invalidKeyring();
-    skipWhitespace();
-    const [value, afterValue] = readJsonString(raw, index);
-    entries.set(key, value);
-    if (entries.size > MAX_KEYS) return invalidKeyring();
-    index = afterValue;
-    skipWhitespace();
-    const separator = raw[index++];
-    if (separator === "}") break;
-    if (separator !== ",") return invalidKeyring();
-    skipWhitespace();
-  }
-  skipWhitespace();
-  if (index !== raw.length || entries.size === 0) return invalidKeyring();
-  return entries;
-}
-function parseCredentialKeyring(raw) {
-  if (typeof raw !== "string" || raw.trim().length === 0 || Buffer.byteLength(raw, "utf8") > MAX_CONFIG_BYTES) {
-    return invalidKeyring();
-  }
-  let entries;
-  try {
-    entries = parseUniqueStringObject(raw);
-  } catch {
-    return invalidKeyring();
-  }
-  const keys = /* @__PURE__ */ new Map();
-  for (const [keyId, encoded] of entries) {
-    if (!STANDARD_BASE64_KEY_PATTERN.test(encoded)) return invalidKeyring();
-    const bytes = Buffer.from(encoded, "base64");
-    if (bytes.length !== KEY_BYTES || bytes.toString("base64") !== encoded) {
-      return invalidKeyring();
-    }
-    keys.set(keyId, Uint8Array.from(bytes));
-  }
-  const keyIds = Object.freeze([...keys.keys()].sort());
-  const descriptor = Object.freeze({
-    keyIds,
-    hasKey: (keyId) => typeof keyId === "string" && keys.has(keyId)
-  });
-  privateKeys.set(descriptor, keys);
-  return descriptor;
-}
-function resolveActiveCredentialKey(keyring, activeKeyId) {
-  const keys = privateKeys.get(keyring);
-  if (!keys || typeof activeKeyId !== "string" || !KEY_ID_PATTERN2.test(activeKeyId) || RESERVED_KEY_IDS2.has(activeKeyId) || !keys.has(activeKeyId)) {
-    throw new CredentialSecurityError("KEY_UNAVAILABLE");
-  }
-  return activeKeyId;
-}
-function getCredentialKeyBytes(keyring, keyId) {
-  const bytes = privateKeys.get(keyring)?.get(keyId);
-  if (!bytes) throw new CredentialSecurityError("KEY_UNAVAILABLE");
-  return Uint8Array.from(bytes);
-}
-
-// src/security/credentials/command-hmac-key.ts
-import { Buffer as Buffer2 } from "buffer";
-import { timingSafeEqual } from "crypto";
-var CANONICAL_BASE64_32_BYTE_KEY = /^[A-Za-z0-9+/]{43}=$/;
-function invalidCommandHmacKey() {
-  throw new CredentialSecurityError("INVALID_COMMAND_HMAC_KEY");
-}
-function parseCommerceConnectionCommandHmacKey(raw, aesKeyring) {
-  if (typeof raw !== "string" || !CANONICAL_BASE64_32_BYTE_KEY.test(raw)) {
-    return invalidCommandHmacKey();
-  }
-  const decoded = Buffer2.from(raw, "base64");
-  if (decoded.length !== 32 || decoded.toString("base64") !== raw) {
-    return invalidCommandHmacKey();
-  }
-  let reusesEncryptionKey = false;
-  try {
-    for (const keyId of aesKeyring.keyIds) {
-      const aesBytes = getCredentialKeyBytes(aesKeyring, keyId);
-      try {
-        reusesEncryptionKey = timingSafeEqual(decoded, aesBytes) || reusesEncryptionKey;
-      } finally {
-        aesBytes.fill(0);
-      }
-    }
-    if (aesKeyring.keyIds.length === 0) return invalidCommandHmacKey();
-  } catch {
-    return invalidCommandHmacKey();
-  }
-  if (reusesEncryptionKey) return invalidCommandHmacKey();
-  return Uint8Array.from(decoded);
-}
-
-// src/security/credentials/aead.ts
-import { Buffer as Buffer3 } from "buffer";
-import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-import { TextDecoder } from "util";
-var NONCE_BYTES = 12;
-var AUTH_TAG_BYTES = 16;
-var MAX_CREDENTIAL_BYTES = 8192;
-var MAX_AAD_BYTES = 4096;
-var KEY_ID_PATTERN3 = /^[A-Za-z0-9_-]{1,64}$/;
-var RESERVED_KEY_IDS3 = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
-function invalidCredential() {
-  throw new CredentialSecurityError("INVALID_CREDENTIAL");
-}
-function isValidUnicode(value) {
-  for (let index = 0; index < value.length; index += 1) {
-    const unit = value.charCodeAt(index);
-    if (unit >= 55296 && unit <= 56319) {
-      if (index + 1 === value.length) return false;
-      const next = value.charCodeAt(index + 1);
-      if (next < 56320 || next > 57343) return false;
-      index += 1;
-    } else if (unit >= 56320 && unit <= 57343) {
-      return false;
-    }
-  }
-  return true;
-}
-function aadBytes(value) {
-  let bytes;
-  if (typeof value === "string") {
-    if (!isValidUnicode(value)) return invalidCredential();
-    bytes = Buffer3.from(value, "utf8");
-  } else if (value instanceof Uint8Array) {
-    bytes = Buffer3.from(value);
-  } else {
-    return invalidCredential();
-  }
-  if (bytes.length < 1 || bytes.length > MAX_AAD_BYTES) return invalidCredential();
-  return bytes;
-}
-function validEnvelope(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-  const candidate = value;
-  return typeof candidate.keyId === "string" && KEY_ID_PATTERN3.test(candidate.keyId) && !RESERVED_KEY_IDS3.has(candidate.keyId) && candidate.nonce instanceof Uint8Array && candidate.nonce.byteLength === NONCE_BYTES && candidate.ciphertext instanceof Uint8Array && candidate.ciphertext.byteLength >= 1 && candidate.ciphertext.byteLength <= MAX_CREDENTIAL_BYTES && candidate.authTag instanceof Uint8Array && candidate.authTag.byteLength === AUTH_TAG_BYTES;
-}
-function protectCredentialOperation(operation) {
-  try {
-    return operation();
-  } catch (error) {
-    if (error instanceof CredentialSecurityError) throw error;
-    return invalidCredential();
-  }
-}
-function encryptCredential(input) {
-  return protectCredentialOperation(() => {
-    if (typeof input !== "object" || input === null || Array.isArray(input)) return invalidCredential();
-    const { keyring, activeKeyId, plaintext, aad } = input;
-    if (typeof plaintext !== "string" || !isValidUnicode(plaintext)) return invalidCredential();
-    const plaintextBytes = Buffer3.from(plaintext, "utf8");
-    if (plaintextBytes.length < 1 || plaintextBytes.length > MAX_CREDENTIAL_BYTES) {
-      plaintextBytes.fill(0);
-      return invalidCredential();
-    }
-    let key;
-    try {
-      const authenticatedData = aadBytes(aad);
-      const keyId = resolveActiveCredentialKey(keyring, activeKeyId);
-      key = getCredentialKeyBytes(keyring, keyId);
-      const nonce = randomBytes(NONCE_BYTES);
-      const cipher = createCipheriv("aes-256-gcm", key, nonce, { authTagLength: AUTH_TAG_BYTES });
-      cipher.setAAD(authenticatedData);
-      const ciphertext = Buffer3.concat([cipher.update(plaintextBytes), cipher.final()]);
-      return Object.freeze({
-        keyId,
-        nonce: Uint8Array.from(nonce),
-        ciphertext: Uint8Array.from(ciphertext),
-        authTag: Uint8Array.from(cipher.getAuthTag())
-      });
-    } finally {
-      key?.fill(0);
-      plaintextBytes.fill(0);
-    }
-  });
-}
-function decryptCredential(input) {
-  return protectCredentialOperation(() => {
-    if (typeof input !== "object" || input === null || Array.isArray(input)) return invalidCredential();
-    const { keyring, envelope, aad } = input;
-    if (!validEnvelope(envelope)) return invalidCredential();
-    const authenticatedData = aadBytes(aad);
-    const key = getCredentialKeyBytes(keyring, envelope.keyId);
-    let plaintextBytes;
-    try {
-      const decipher = createDecipheriv("aes-256-gcm", key, Buffer3.from(envelope.nonce), {
-        authTagLength: AUTH_TAG_BYTES
-      });
-      decipher.setAAD(authenticatedData);
-      decipher.setAuthTag(Buffer3.from(envelope.authTag));
-      plaintextBytes = Buffer3.concat([
-        decipher.update(Buffer3.from(envelope.ciphertext)),
-        decipher.final()
-      ]);
-      return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(plaintextBytes);
-    } finally {
-      plaintextBytes?.fill(0);
-      key.fill(0);
-    }
-  });
-}
+  CredentialSecurityError,
+  createCommerceEmbeddingCredentialAad,
+  createWooRestReadGrantAad,
+  decryptCredential,
+  encryptCredential,
+  parseCommerceConnectionCommandHmacKey,
+  parseCredentialKeyring,
+  resolveActiveCredentialKey
+} from "../../chunk-PZZJFC2L.js";
+import "../../chunk-FTUTJH7W.js";
+import "../../chunk-AUS3WQIW.js";
 export {
   CredentialSecurityError,
   createCommerceEmbeddingCredentialAad,

package/dist/security/credentials/node.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/security/credentials/errors.ts","../../../src/security/credentials/aad.ts","../../../src/security/credentials/keyring.ts","../../../src/security/credentials/command-hmac-key.ts","../../../src/security/credentials/aead.ts"],"sourcesContent":["/** A stable, secret-free error vocabulary shared by credential-security operations. */\nexport type CredentialSecurityErrorCode =\n  | \"INVALID_KEYRING\"\n  | \"KEY_UNAVAILABLE\"\n  | \"INVALID_CREDENTIAL\"\n  | \"INVALID_COMMAND_HMAC_KEY\";\n\nconst MESSAGES: Readonly<Record<CredentialSecurityErrorCode, string>> = {\n  INVALID_KEYRING: \"Invalid credential keyring configuration\",\n  KEY_UNAVAILABLE: \"Credential encryption key is unavailable\",\n  INVALID_CREDENTIAL: \"Invalid encrypted credential\",\n  INVALID_COMMAND_HMAC_KEY: \"Invalid command authentication key\",\n};\n\nexport class CredentialSecurityError extends Error {\n  readonly code: CredentialSecurityErrorCode;\n\n  constructor(code: CredentialSecurityErrorCode) {\n    super(MESSAGES[code]);\n    this.name = \"CredentialSecurityError\";\n    this.code = code;\n  }\n}\n","import { canonicalJson } from \"../../commerce/canonical-json.js\";\nimport {\n  CommerceEnvironmentSchema,\n  type CommerceEnvironment,\n} from \"../../commerce/model/index.js\";\nimport { CredentialSecurityError } from \"./errors.js\";\n\nconst KEY_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;\nconst PURPOSES = new Set([\"MERCHANT_KNOWLEDGE\", \"REFERENCE_TAXONOMY\"]);\nconst FORBIDDEN_ID_CHARACTERS = /[\\r\\n\\0]/;\nconst INVALID_UNICODE = /\\p{Surrogate}/u;\nconst RESERVED_KEY_IDS = new Set([\"__proto__\", \"prototype\", \"constructor\"]);\n\ntype EmbeddingPurpose = \"MERCHANT_KNOWLEDGE\" | \"REFERENCE_TAXONOMY\";\n\nexport type CommerceEmbeddingCredentialAadInput = Readonly<{\n  environment: CommerceEnvironment;\n  purpose: EmbeddingPurpose;\n  provider: string;\n  keyId: string;\n}>;\n\nexport type WooRestReadGrantAadInput = Readonly<{\n  shopId: string;\n  installationId: string;\n  authorizationAttemptId: string;\n  credentialVersionSnapshot: number;\n}>;\n\nfunction invalidAad(): never {\n  // The message/code are constant: never interpolate merchant identifiers or secrets.\n  throw new CredentialSecurityError(\"INVALID_CREDENTIAL\");\n}\n\nfunction isBoundedIdentifier(value: unknown, limit: number): value is string {\n  return typeof value === \"string\" &&\n    value.length >= 1 && value.length <= limit &&\n    value.trim().length > 0 &&\n    !FORBIDDEN_ID_CHARACTERS.test(value) &&\n    !INVALID_UNICODE.test(value);\n}\n\n/** Preserve the existing embedding canonical-JSON AAD bytes across writer/readers. */\nexport function createCommerceEmbeddingCredentialAad(\n  input: CommerceEmbeddingCredentialAadInput,\n): string {\n  if (\n    input === null || typeof input !== \"object\" ||\n    !CommerceEnvironmentSchema.safeParse(input.environment).success ||\n    !PURPOSES.has(input.purpose) ||\n    !isBoundedIdentifier(input.provider, 128) ||\n    typeof input.keyId !== \"string\" ||\n    !KEY_ID_PATTERN.test(input.keyId) ||\n    RESERVED_KEY_IDS.has(input.keyId)\n  ) {\n    return invalidAad();\n  }\n\n  return canonicalJson({\n    credentialType: \"EMBEDDING\",\n    environment: input.environment,\n    purpose: input.purpose,\n    provider: input.provider,\n    keyId: input.keyId,\n  });\n}\n\n/** Preserve the existing Woo API/Background JSON-array AAD bytes exactly. */\nexport function createWooRestReadGrantAad(input: WooRestReadGrantAadInput): string {\n  if (\n    input === null || typeof input !== \"object\" ||\n    !isBoundedIdentifier(input.shopId, 128) ||\n    !isBoundedIdentifier(input.installationId, 128) ||\n    !isBoundedIdentifier(input.authorizationAttemptId, 128) ||\n    !Number.isSafeInteger(input.credentialVersionSnapshot) ||\n    input.credentialVersionSnapshot < 1\n  ) {\n    return invalidAad();\n  }\n\n  return JSON.stringify([\n    \"moda-woo-rest-read-v1\",\n    input.shopId,\n    input.installationId,\n    input.authorizationAttemptId,\n    input.credentialVersionSnapshot,\n  ]);\n}\n","import { Buffer } from \"node:buffer\";\nimport { CredentialSecurityError } from \"./errors.js\";\n\nconst KEY_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;\nconst STANDARD_BASE64_KEY_PATTERN = /^[A-Za-z0-9+/]{43}=$/;\nconst RESERVED_KEY_IDS = new Set([\"__proto__\", \"prototype\", \"constructor\"]);\nconst MAX_CONFIG_BYTES = 4096;\nconst MAX_KEYS = 16;\nconst KEY_BYTES = 32;\n\nexport interface CredentialKeyring {\n  readonly keyIds: readonly string[];\n  hasKey(keyId: string): boolean;\n}\n\n// The keyring descriptor never contains key material. In particular, consumers cannot\n// obtain a reference to any retained secret through keyIds, hasKey, or object inspection.\nconst privateKeys = new WeakMap<CredentialKeyring, ReadonlyMap<string, Uint8Array>>();\n\nfunction invalidKeyring(): never {\n  throw new CredentialSecurityError(\"INVALID_KEYRING\");\n}\n\n/**\n * Read a JSON string token, returning the decoded contents and the next offset.\n * JSON.parse validates escapes (including Unicode escapes) and rejects malformed text.\n * Only decoded property names are compared, preventing escaped duplicate aliases.\n */\nfunction readJsonString(raw: string, start: number): [string, number] {\n  if (raw[start] !== '\"') invalidKeyring();\n  let cursor = start + 1;\n  while (cursor < raw.length) {\n    const character = raw[cursor];\n    if (character === \"\\\\\") {\n      cursor += 2;\n      continue;\n    }\n    if (character === '\"') {\n      const decoded: unknown = JSON.parse(raw.slice(start, cursor + 1));\n      if (typeof decoded !== \"string\") invalidKeyring();\n      return [decoded, cursor + 1];\n    }\n    cursor += 1;\n  }\n  return invalidKeyring();\n}\n\n/**\n * A small strict JSON-object scanner: the only supported format is a top-level\n * object mapping JSON string IDs to JSON string key values. Using JSON.parse(raw)\n * alone would silently discard duplicate property names, which we must reject.\n */\nfunction parseUniqueStringObject(raw: string): Map<string, string> {\n  // Validate the complete JSON grammar, including escape sequences and trailing data.\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(raw);\n  } catch {\n    return invalidKeyring();\n  }\n  if (decoded === null || typeof decoded !== \"object\" || Array.isArray(decoded)) {\n    return invalidKeyring();\n  }\n\n  let index = 0;\n  const skipWhitespace = (): void => {\n    while (index < raw.length && /[ \\t\\r\\n]/.test(raw[index]!)) index += 1;\n  };\n\n  const entries = new Map<string, string>();\n  skipWhitespace();\n  if (raw[index++] !== \"{\") return invalidKeyring();\n  skipWhitespace();\n  if (raw[index] === \"}\") return invalidKeyring();\n\n  while (index < raw.length) {\n    const [key, afterKey] = readJsonString(raw, index);\n    if (entries.has(key)) return invalidKeyring();\n    if (!KEY_ID_PATTERN.test(key) || RESERVED_KEY_IDS.has(key)) return invalidKeyring();\n    index = afterKey;\n    skipWhitespace();\n    if (raw[index++] !== \":\") return invalidKeyring();\n    skipWhitespace();\n    const [value, afterValue] = readJsonString(raw, index);\n    entries.set(key, value);\n    if (entries.size > MAX_KEYS) return invalidKeyring();\n    index = afterValue;\n    skipWhitespace();\n    const separator = raw[index++];\n    if (separator === \"}\") break;\n    if (separator !== \",\") return invalidKeyring();\n    skipWhitespace();\n  }\n  skipWhitespace();\n  if (index !== raw.length || entries.size === 0) return invalidKeyring();\n  return entries;\n}\n\n/** Validate and retain canonical 32-byte AES key material without exposing the bytes. */\nexport function parseCredentialKeyring(raw: string | undefined): CredentialKeyring {\n  if (typeof raw !== \"string\" || raw.trim().length === 0 || Buffer.byteLength(raw, \"utf8\") > MAX_CONFIG_BYTES) {\n    return invalidKeyring();\n  }\n\n  let entries: Map<string, string>;\n  try {\n    entries = parseUniqueStringObject(raw);\n  } catch {\n    // No native JSON parsing error or untrusted data may escape this boundary.\n    return invalidKeyring();\n  }\n\n  const keys = new Map<string, Uint8Array>();\n  for (const [keyId, encoded] of entries) {\n    if (!STANDARD_BASE64_KEY_PATTERN.test(encoded)) return invalidKeyring();\n    const bytes = Buffer.from(encoded, \"base64\");\n    if (bytes.length !== KEY_BYTES || bytes.toString(\"base64\") !== encoded) {\n      return invalidKeyring();\n    }\n    keys.set(keyId, Uint8Array.from(bytes));\n  }\n\n  const keyIds = Object.freeze([...keys.keys()].sort());\n  const descriptor: CredentialKeyring = Object.freeze({\n    keyIds,\n    hasKey: (keyId: string): boolean => typeof keyId === \"string\" && keys.has(keyId),\n  });\n  privateKeys.set(descriptor, keys);\n  return descriptor;\n}\n\n/** An explicit writer selection; never select the first key or trim an input. */\nexport function resolveActiveCredentialKey(\n  keyring: CredentialKeyring,\n  activeKeyId: string | undefined,\n): string {\n  const keys = privateKeys.get(keyring);\n  if (\n    !keys ||\n    typeof activeKeyId !== \"string\" ||\n    !KEY_ID_PATTERN.test(activeKeyId) ||\n    RESERVED_KEY_IDS.has(activeKeyId) ||\n    !keys.has(activeKeyId)\n  ) {\n    throw new CredentialSecurityError(\"KEY_UNAVAILABLE\");\n  }\n  return activeKeyId;\n}\n\n/**\n * Package-internal helper for SHARED-002. Never re-export from the public Node\n * entrypoint. Return a defensive copy so an AEAD consumer cannot mutate the\n * retained key material (including after an encryption failure).\n */\nexport function getCredentialKeyBytes(keyring: CredentialKeyring, keyId: string): Uint8Array {\n  const bytes = privateKeys.get(keyring)?.get(keyId);\n  if (!bytes) throw new CredentialSecurityError(\"KEY_UNAVAILABLE\");\n  return Uint8Array.from(bytes);\n}\n","import { Buffer } from \"node:buffer\";\nimport { timingSafeEqual } from \"node:crypto\";\nimport { CredentialSecurityError } from \"./errors.js\";\nimport { getCredentialKeyBytes, type CredentialKeyring } from \"./keyring.js\";\n\nconst CANONICAL_BASE64_32_BYTE_KEY = /^[A-Za-z0-9+/]{43}=$/;\n\nfunction invalidCommandHmacKey(): never {\n  throw new CredentialSecurityError(\"INVALID_COMMAND_HMAC_KEY\");\n}\n\n/**\n * Decode the Commerce connection-command HMAC secret, without accessing service\n * configuration or exposing AES key bytes. The caller supplies the configured\n * value and the canonical AES keyring explicitly.\n */\nexport function parseCommerceConnectionCommandHmacKey(\n  raw: string | undefined,\n  aesKeyring: CredentialKeyring,\n): Uint8Array {\n  if (typeof raw !== \"string\" || !CANONICAL_BASE64_32_BYTE_KEY.test(raw)) {\n    return invalidCommandHmacKey();\n  }\n\n  const decoded = Buffer.from(raw, \"base64\");\n  if (decoded.length !== 32 || decoded.toString(\"base64\") !== raw) {\n    return invalidCommandHmacKey();\n  }\n\n  // Examine *every* AES key, rather than returning on the first match. A\n  // failed or forged keyring must never bypass the separation requirement.\n  let reusesEncryptionKey = false;\n  try {\n    for (const keyId of aesKeyring.keyIds) {\n      const aesBytes = getCredentialKeyBytes(aesKeyring, keyId);\n      try {\n        reusesEncryptionKey = timingSafeEqual(decoded, aesBytes) || reusesEncryptionKey;\n      } finally {\n        aesBytes.fill(0); // Only wipes the defensive copy, not the keyring.\n      }\n    }\n    // The parser creates a nonempty keyring; reject invalid caller-supplied\n    // substitutes rather than treating them as an empty, trusted keyring.\n    if (aesKeyring.keyIds.length === 0) return invalidCommandHmacKey();\n  } catch {\n    return invalidCommandHmacKey();\n  }\n\n  if (reusesEncryptionKey) return invalidCommandHmacKey();\n  return Uint8Array.from(decoded);\n}\n","import { Buffer } from \"node:buffer\";\nimport { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\nimport { TextDecoder } from \"node:util\";\nimport { CredentialSecurityError } from \"./errors.js\";\nimport {\n  getCredentialKeyBytes,\n  resolveActiveCredentialKey,\n  type CredentialKeyring,\n} from \"./keyring.js\";\n\nconst NONCE_BYTES = 12;\nconst AUTH_TAG_BYTES = 16;\nconst MAX_CREDENTIAL_BYTES = 8192;\nconst MAX_AAD_BYTES = 4096;\nconst KEY_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;\nconst RESERVED_KEY_IDS = new Set([\"__proto__\", \"prototype\", \"constructor\"]);\n\n/** Crypto envelope only; persistence and AAD construction belong to the caller. */\nexport type CredentialEnvelope = Readonly<{\n  keyId: string;\n  nonce: Uint8Array;\n  ciphertext: Uint8Array;\n  authTag: Uint8Array;\n}>;\n\nfunction invalidCredential(): never {\n  throw new CredentialSecurityError(\"INVALID_CREDENTIAL\");\n}\n\n/** Reject UTF-16 strings that Node would otherwise encode with replacement bytes. */\nfunction isValidUnicode(value: string): boolean {\n  for (let index = 0; index < value.length; index += 1) {\n    const unit = value.charCodeAt(index);\n    if (unit >= 0xd800 && unit <= 0xdbff) {\n      if (index + 1 === value.length) return false;\n      const next = value.charCodeAt(index + 1);\n      if (next < 0xdc00 || next > 0xdfff) return false;\n      index += 1;\n    } else if (unit >= 0xdc00 && unit <= 0xdfff) {\n      return false;\n    }\n  }\n  return true;\n}\n\nfunction aadBytes(value: unknown): Buffer {\n  let bytes: Buffer;\n  if (typeof value === \"string\") {\n    if (!isValidUnicode(value)) return invalidCredential();\n    bytes = Buffer.from(value, \"utf8\");\n  } else if (value instanceof Uint8Array) {\n    // Copy the exact view, not its possibly larger underlying ArrayBuffer.\n    bytes = Buffer.from(value);\n  } else {\n    return invalidCredential();\n  }\n  if (bytes.length < 1 || bytes.length > MAX_AAD_BYTES) return invalidCredential();\n  return bytes;\n}\n\nfunction validEnvelope(value: unknown): value is CredentialEnvelope {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return false;\n  const candidate = value as Partial<CredentialEnvelope>;\n  return (\n    typeof candidate.keyId === \"string\" &&\n    KEY_ID_PATTERN.test(candidate.keyId) &&\n    !RESERVED_KEY_IDS.has(candidate.keyId) &&\n    candidate.nonce instanceof Uint8Array &&\n    candidate.nonce.byteLength === NONCE_BYTES &&\n    candidate.ciphertext instanceof Uint8Array &&\n    candidate.ciphertext.byteLength >= 1 &&\n    candidate.ciphertext.byteLength <= MAX_CREDENTIAL_BYTES &&\n    candidate.authTag instanceof Uint8Array &&\n    candidate.authTag.byteLength === AUTH_TAG_BYTES\n  );\n}\n\n/** Keep native crypto and UTF-8 decoding exceptions out of the public error contract. */\nfunction protectCredentialOperation<T>(operation: () => T): T {\n  try {\n    return operation();\n  } catch (error) {\n    if (error instanceof CredentialSecurityError) throw error;\n    return invalidCredential();\n  }\n}\n\n/** Encrypt a UTF-8 credential with caller-provided, mandatory authenticated data. */\nexport function encryptCredential(input: {\n  keyring: CredentialKeyring;\n  activeKeyId: string;\n  plaintext: string;\n  aad: string | Uint8Array;\n}): CredentialEnvelope {\n  return protectCredentialOperation(() => {\n    if (typeof input !== \"object\" || input === null || Array.isArray(input)) return invalidCredential();\n    const { keyring, activeKeyId, plaintext, aad } = input;\n    if (typeof plaintext !== \"string\" || !isValidUnicode(plaintext)) return invalidCredential();\n    const plaintextBytes = Buffer.from(plaintext, \"utf8\");\n    if (plaintextBytes.length < 1 || plaintextBytes.length > MAX_CREDENTIAL_BYTES) {\n      plaintextBytes.fill(0);\n      return invalidCredential();\n    }\n    let key: Uint8Array | undefined;\n    try {\n      const authenticatedData = aadBytes(aad);\n      const keyId = resolveActiveCredentialKey(keyring, activeKeyId);\n      key = getCredentialKeyBytes(keyring, keyId);\n      const nonce = randomBytes(NONCE_BYTES);\n      const cipher = createCipheriv(\"aes-256-gcm\", key, nonce, { authTagLength: AUTH_TAG_BYTES });\n      cipher.setAAD(authenticatedData);\n      const ciphertext = Buffer.concat([cipher.update(plaintextBytes), cipher.final()]);\n      return Object.freeze({\n        keyId,\n        nonce: Uint8Array.from(nonce),\n        ciphertext: Uint8Array.from(ciphertext),\n        authTag: Uint8Array.from(cipher.getAuthTag()),\n      });\n    } finally {\n      key?.fill(0);\n      plaintextBytes.fill(0);\n    }\n  });\n}\n\n/** Decrypt only authenticated UTF-8 text; never return unauthenticated bytes. */\nexport function decryptCredential(input: {\n  keyring: CredentialKeyring;\n  envelope: CredentialEnvelope;\n  aad: string | Uint8Array;\n}): string {\n  return protectCredentialOperation(() => {\n    if (typeof input !== \"object\" || input === null || Array.isArray(input)) return invalidCredential();\n    const { keyring, envelope, aad } = input;\n    if (!validEnvelope(envelope)) return invalidCredential();\n    const authenticatedData = aadBytes(aad);\n    const key = getCredentialKeyBytes(keyring, envelope.keyId);\n    let plaintextBytes: Buffer | undefined;\n    try {\n      const decipher = createDecipheriv(\"aes-256-gcm\", key, Buffer.from(envelope.nonce), {\n        authTagLength: AUTH_TAG_BYTES,\n      });\n      decipher.setAAD(authenticatedData);\n      decipher.setAuthTag(Buffer.from(envelope.authTag));\n      plaintextBytes = Buffer.concat([\n        decipher.update(Buffer.from(envelope.ciphertext)),\n        decipher.final(),\n      ]);\n      // ignoreBOM preserves a leading U+FEFF so decrypt(encrypt(text)) is exact.\n      return new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: true }).decode(plaintextBytes);\n    } finally {\n      plaintextBytes?.fill(0);\n      key.fill(0);\n    }\n  });\n}\n"],"mappings":";;;;;;;;AAOA,IAAM,WAAkE;AAAA,EACtE,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,0BAA0B;AAC5B;AAEO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACxC;AAAA,EAET,YAAY,MAAmC;AAC7C,UAAM,SAAS,IAAI,CAAC;AACpB,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;;;ACfA,IAAM,iBAAiB;AACvB,IAAM,WAAW,oBAAI,IAAI,CAAC,sBAAsB,oBAAoB,CAAC;AACrE,IAAM,0BAA0B;AAChC,IAAM,kBAAkB;AACxB,IAAM,mBAAmB,oBAAI,IAAI,CAAC,aAAa,aAAa,aAAa,CAAC;AAkB1E,SAAS,aAAoB;AAE3B,QAAM,IAAI,wBAAwB,oBAAoB;AACxD;AAEA,SAAS,oBAAoB,OAAgB,OAAgC;AAC3E,SAAO,OAAO,UAAU,YACtB,MAAM,UAAU,KAAK,MAAM,UAAU,SACrC,MAAM,KAAK,EAAE,SAAS,KACtB,CAAC,wBAAwB,KAAK,KAAK,KACnC,CAAC,gBAAgB,KAAK,KAAK;AAC/B;AAGO,SAAS,qCACd,OACQ;AACR,MACE,UAAU,QAAQ,OAAO,UAAU,YACnC,CAAC,0BAA0B,UAAU,MAAM,WAAW,EAAE,WACxD,CAAC,SAAS,IAAI,MAAM,OAAO,KAC3B,CAAC,oBAAoB,MAAM,UAAU,GAAG,KACxC,OAAO,MAAM,UAAU,YACvB,CAAC,eAAe,KAAK,MAAM,KAAK,KAChC,iBAAiB,IAAI,MAAM,KAAK,GAChC;AACA,WAAO,WAAW;AAAA,EACpB;AAEA,SAAO,cAAc;AAAA,IACnB,gBAAgB;AAAA,IAChB,aAAa,MAAM;AAAA,IACnB,SAAS,MAAM;AAAA,IACf,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM;AAAA,EACf,CAAC;AACH;AAGO,SAAS,0BAA0B,OAAyC;AACjF,MACE,UAAU,QAAQ,OAAO,UAAU,YACnC,CAAC,oBAAoB,MAAM,QAAQ,GAAG,KACtC,CAAC,oBAAoB,MAAM,gBAAgB,GAAG,KAC9C,CAAC,oBAAoB,MAAM,wBAAwB,GAAG,KACtD,CAAC,OAAO,cAAc,MAAM,yBAAyB,KACrD,MAAM,4BAA4B,GAClC;AACA,WAAO,WAAW;AAAA,EACpB;AAEA,SAAO,KAAK,UAAU;AAAA,IACpB;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AACH;;;ACvFA,SAAS,cAAc;AAGvB,IAAMA,kBAAiB;AACvB,IAAM,8BAA8B;AACpC,IAAMC,oBAAmB,oBAAI,IAAI,CAAC,aAAa,aAAa,aAAa,CAAC;AAC1E,IAAM,mBAAmB;AACzB,IAAM,WAAW;AACjB,IAAM,YAAY;AASlB,IAAM,cAAc,oBAAI,QAA4D;AAEpF,SAAS,iBAAwB;AAC/B,QAAM,IAAI,wBAAwB,iBAAiB;AACrD;AAOA,SAAS,eAAe,KAAa,OAAiC;AACpE,MAAI,IAAI,KAAK,MAAM,IAAK,gBAAe;AACvC,MAAI,SAAS,QAAQ;AACrB,SAAO,SAAS,IAAI,QAAQ;AAC1B,UAAM,YAAY,IAAI,MAAM;AAC5B,QAAI,cAAc,MAAM;AACtB,gBAAU;AACV;AAAA,IACF;AACA,QAAI,cAAc,KAAK;AACrB,YAAM,UAAmB,KAAK,MAAM,IAAI,MAAM,OAAO,SAAS,CAAC,CAAC;AAChE,UAAI,OAAO,YAAY,SAAU,gBAAe;AAChD,aAAO,CAAC,SAAS,SAAS,CAAC;AAAA,IAC7B;AACA,cAAU;AAAA,EACZ;AACA,SAAO,eAAe;AACxB;AAOA,SAAS,wBAAwB,KAAkC;AAEjE,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,GAAG;AAAA,EAC1B,QAAQ;AACN,WAAO,eAAe;AAAA,EACxB;AACA,MAAI,YAAY,QAAQ,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AAC7E,WAAO,eAAe;AAAA,EACxB;AAEA,MAAI,QAAQ;AACZ,QAAM,iBAAiB,MAAY;AACjC,WAAO,QAAQ,IAAI,UAAU,YAAY,KAAK,IAAI,KAAK,CAAE,EAAG,UAAS;AAAA,EACvE;AAEA,QAAM,UAAU,oBAAI,IAAoB;AACxC,iBAAe;AACf,MAAI,IAAI,OAAO,MAAM,IAAK,QAAO,eAAe;AAChD,iBAAe;AACf,MAAI,IAAI,KAAK,MAAM,IAAK,QAAO,eAAe;AAE9C,SAAO,QAAQ,IAAI,QAAQ;AACzB,UAAM,CAAC,KAAK,QAAQ,IAAI,eAAe,KAAK,KAAK;AACjD,QAAI,QAAQ,IAAI,GAAG,EAAG,QAAO,eAAe;AAC5C,QAAI,CAACD,gBAAe,KAAK,GAAG,KAAKC,kBAAiB,IAAI,GAAG,EAAG,QAAO,eAAe;AAClF,YAAQ;AACR,mBAAe;AACf,QAAI,IAAI,OAAO,MAAM,IAAK,QAAO,eAAe;AAChD,mBAAe;AACf,UAAM,CAAC,OAAO,UAAU,IAAI,eAAe,KAAK,KAAK;AACrD,YAAQ,IAAI,KAAK,KAAK;AACtB,QAAI,QAAQ,OAAO,SAAU,QAAO,eAAe;AACnD,YAAQ;AACR,mBAAe;AACf,UAAM,YAAY,IAAI,OAAO;AAC7B,QAAI,cAAc,IAAK;AACvB,QAAI,cAAc,IAAK,QAAO,eAAe;AAC7C,mBAAe;AAAA,EACjB;AACA,iBAAe;AACf,MAAI,UAAU,IAAI,UAAU,QAAQ,SAAS,EAAG,QAAO,eAAe;AACtE,SAAO;AACT;AAGO,SAAS,uBAAuB,KAA4C;AACjF,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,WAAW,KAAK,OAAO,WAAW,KAAK,MAAM,IAAI,kBAAkB;AAC3G,WAAO,eAAe;AAAA,EACxB;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,wBAAwB,GAAG;AAAA,EACvC,QAAQ;AAEN,WAAO,eAAe;AAAA,EACxB;AAEA,QAAM,OAAO,oBAAI,IAAwB;AACzC,aAAW,CAAC,OAAO,OAAO,KAAK,SAAS;AACtC,QAAI,CAAC,4BAA4B,KAAK,OAAO,EAAG,QAAO,eAAe;AACtE,UAAM,QAAQ,OAAO,KAAK,SAAS,QAAQ;AAC3C,QAAI,MAAM,WAAW,aAAa,MAAM,SAAS,QAAQ,MAAM,SAAS;AACtE,aAAO,eAAe;AAAA,IACxB;AACA,SAAK,IAAI,OAAO,WAAW,KAAK,KAAK,CAAC;AAAA,EACxC;AAEA,QAAM,SAAS,OAAO,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC;AACpD,QAAM,aAAgC,OAAO,OAAO;AAAA,IAClD;AAAA,IACA,QAAQ,CAAC,UAA2B,OAAO,UAAU,YAAY,KAAK,IAAI,KAAK;AAAA,EACjF,CAAC;AACD,cAAY,IAAI,YAAY,IAAI;AAChC,SAAO;AACT;AAGO,SAAS,2BACd,SACA,aACQ;AACR,QAAM,OAAO,YAAY,IAAI,OAAO;AACpC,MACE,CAAC,QACD,OAAO,gBAAgB,YACvB,CAACD,gBAAe,KAAK,WAAW,KAChCC,kBAAiB,IAAI,WAAW,KAChC,CAAC,KAAK,IAAI,WAAW,GACrB;AACA,UAAM,IAAI,wBAAwB,iBAAiB;AAAA,EACrD;AACA,SAAO;AACT;AAOO,SAAS,sBAAsB,SAA4B,OAA2B;AAC3F,QAAM,QAAQ,YAAY,IAAI,OAAO,GAAG,IAAI,KAAK;AACjD,MAAI,CAAC,MAAO,OAAM,IAAI,wBAAwB,iBAAiB;AAC/D,SAAO,WAAW,KAAK,KAAK;AAC9B;;;AC9JA,SAAS,UAAAC,eAAc;AACvB,SAAS,uBAAuB;AAIhC,IAAM,+BAA+B;AAErC,SAAS,wBAA+B;AACtC,QAAM,IAAI,wBAAwB,0BAA0B;AAC9D;AAOO,SAAS,sCACd,KACA,YACY;AACZ,MAAI,OAAO,QAAQ,YAAY,CAAC,6BAA6B,KAAK,GAAG,GAAG;AACtE,WAAO,sBAAsB;AAAA,EAC/B;AAEA,QAAM,UAAUC,QAAO,KAAK,KAAK,QAAQ;AACzC,MAAI,QAAQ,WAAW,MAAM,QAAQ,SAAS,QAAQ,MAAM,KAAK;AAC/D,WAAO,sBAAsB;AAAA,EAC/B;AAIA,MAAI,sBAAsB;AAC1B,MAAI;AACF,eAAW,SAAS,WAAW,QAAQ;AACrC,YAAM,WAAW,sBAAsB,YAAY,KAAK;AACxD,UAAI;AACF,8BAAsB,gBAAgB,SAAS,QAAQ,KAAK;AAAA,MAC9D,UAAE;AACA,iBAAS,KAAK,CAAC;AAAA,MACjB;AAAA,IACF;AAGA,QAAI,WAAW,OAAO,WAAW,EAAG,QAAO,sBAAsB;AAAA,EACnE,QAAQ;AACN,WAAO,sBAAsB;AAAA,EAC/B;AAEA,MAAI,oBAAqB,QAAO,sBAAsB;AACtD,SAAO,WAAW,KAAK,OAAO;AAChC;;;AClDA,SAAS,UAAAC,eAAc;AACvB,SAAS,gBAAgB,kBAAkB,mBAAmB;AAC9D,SAAS,mBAAmB;AAQ5B,IAAM,cAAc;AACpB,IAAM,iBAAiB;AACvB,IAAM,uBAAuB;AAC7B,IAAM,gBAAgB;AACtB,IAAMC,kBAAiB;AACvB,IAAMC,oBAAmB,oBAAI,IAAI,CAAC,aAAa,aAAa,aAAa,CAAC;AAU1E,SAAS,oBAA2B;AAClC,QAAM,IAAI,wBAAwB,oBAAoB;AACxD;AAGA,SAAS,eAAe,OAAwB;AAC9C,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,UAAI,QAAQ,MAAM,MAAM,OAAQ,QAAO;AACvC,YAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;AACvC,UAAI,OAAO,SAAU,OAAO,MAAQ,QAAO;AAC3C,eAAS;AAAA,IACX,WAAW,QAAQ,SAAU,QAAQ,OAAQ;AAC3C,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,SAAS,OAAwB;AACxC,MAAI;AACJ,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,eAAe,KAAK,EAAG,QAAO,kBAAkB;AACrD,YAAQC,QAAO,KAAK,OAAO,MAAM;AAAA,EACnC,WAAW,iBAAiB,YAAY;AAEtC,YAAQA,QAAO,KAAK,KAAK;AAAA,EAC3B,OAAO;AACL,WAAO,kBAAkB;AAAA,EAC3B;AACA,MAAI,MAAM,SAAS,KAAK,MAAM,SAAS,cAAe,QAAO,kBAAkB;AAC/E,SAAO;AACT;AAEA,SAAS,cAAc,OAA6C;AAClE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,YAAY;AAClB,SACE,OAAO,UAAU,UAAU,YAC3BF,gBAAe,KAAK,UAAU,KAAK,KACnC,CAACC,kBAAiB,IAAI,UAAU,KAAK,KACrC,UAAU,iBAAiB,cAC3B,UAAU,MAAM,eAAe,eAC/B,UAAU,sBAAsB,cAChC,UAAU,WAAW,cAAc,KACnC,UAAU,WAAW,cAAc,wBACnC,UAAU,mBAAmB,cAC7B,UAAU,QAAQ,eAAe;AAErC;AAGA,SAAS,2BAA8B,WAAuB;AAC5D,MAAI;AACF,WAAO,UAAU;AAAA,EACnB,SAAS,OAAO;AACd,QAAI,iBAAiB,wBAAyB,OAAM;AACpD,WAAO,kBAAkB;AAAA,EAC3B;AACF;AAGO,SAAS,kBAAkB,OAKX;AACrB,SAAO,2BAA2B,MAAM;AACtC,QAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO,kBAAkB;AAClG,UAAM,EAAE,SAAS,aAAa,WAAW,IAAI,IAAI;AACjD,QAAI,OAAO,cAAc,YAAY,CAAC,eAAe,SAAS,EAAG,QAAO,kBAAkB;AAC1F,UAAM,iBAAiBC,QAAO,KAAK,WAAW,MAAM;AACpD,QAAI,eAAe,SAAS,KAAK,eAAe,SAAS,sBAAsB;AAC7E,qBAAe,KAAK,CAAC;AACrB,aAAO,kBAAkB;AAAA,IAC3B;AACA,QAAI;AACJ,QAAI;AACF,YAAM,oBAAoB,SAAS,GAAG;AACtC,YAAM,QAAQ,2BAA2B,SAAS,WAAW;AAC7D,YAAM,sBAAsB,SAAS,KAAK;AAC1C,YAAM,QAAQ,YAAY,WAAW;AACrC,YAAM,SAAS,eAAe,eAAe,KAAK,OAAO,EAAE,eAAe,eAAe,CAAC;AAC1F,aAAO,OAAO,iBAAiB;AAC/B,YAAM,aAAaA,QAAO,OAAO,CAAC,OAAO,OAAO,cAAc,GAAG,OAAO,MAAM,CAAC,CAAC;AAChF,aAAO,OAAO,OAAO;AAAA,QACnB;AAAA,QACA,OAAO,WAAW,KAAK,KAAK;AAAA,QAC5B,YAAY,WAAW,KAAK,UAAU;AAAA,QACtC,SAAS,WAAW,KAAK,OAAO,WAAW,CAAC;AAAA,MAC9C,CAAC;AAAA,IACH,UAAE;AACA,WAAK,KAAK,CAAC;AACX,qBAAe,KAAK,CAAC;AAAA,IACvB;AAAA,EACF,CAAC;AACH;AAGO,SAAS,kBAAkB,OAIvB;AACT,SAAO,2BAA2B,MAAM;AACtC,QAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO,kBAAkB;AAClG,UAAM,EAAE,SAAS,UAAU,IAAI,IAAI;AACnC,QAAI,CAAC,cAAc,QAAQ,EAAG,QAAO,kBAAkB;AACvD,UAAM,oBAAoB,SAAS,GAAG;AACtC,UAAM,MAAM,sBAAsB,SAAS,SAAS,KAAK;AACzD,QAAI;AACJ,QAAI;AACF,YAAM,WAAW,iBAAiB,eAAe,KAAKA,QAAO,KAAK,SAAS,KAAK,GAAG;AAAA,QACjF,eAAe;AAAA,MACjB,CAAC;AACD,eAAS,OAAO,iBAAiB;AACjC,eAAS,WAAWA,QAAO,KAAK,SAAS,OAAO,CAAC;AACjD,uBAAiBA,QAAO,OAAO;AAAA,QAC7B,SAAS,OAAOA,QAAO,KAAK,SAAS,UAAU,CAAC;AAAA,QAChD,SAAS,MAAM;AAAA,MACjB,CAAC;AAED,aAAO,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,WAAW,KAAK,CAAC,EAAE,OAAO,cAAc;AAAA,IACzF,UAAE;AACA,sBAAgB,KAAK,CAAC;AACtB,UAAI,KAAK,CAAC;AAAA,IACZ;AAAA,EACF,CAAC;AACH;","names":["KEY_ID_PATTERN","RESERVED_KEY_IDS","Buffer","Buffer","Buffer","KEY_ID_PATTERN","RESERVED_KEY_IDS","Buffer"]}
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}