@nifrajs/web 5.5.0 → 5.6.0

package/dist/live/hub.js

@@ -0,0 +1,539 @@
+/**
+ * The live socket endpoint and its fan-out. A socket subscribes to the tags of the keys its installed
+ * grants hold; each change goes out as one identical `changed` frame per tag topic, so Bun can send it
+ * with one native publish. Frames carry tags only: never data, key text, subjects or seqs.
+ *
+ * Installing a watch and applying a bus event each run as one synchronous step (subscribe, then scan
+ * history, then `ready`; record in history, then publish), so every event is either reported in
+ * `ready.stale` or delivered after the subscription, and `ready` precedes every later frame.
+ */
+import { isSameOriginRequest } from "@nifrajs/core/server";
+import { MAX_GRANT_CHARS } from "./keyring.js";
+export const CLOSE_BAD_GRANT = 4401;
+export const CLOSE_REVOKED = 4403;
+export const CLOSE_SCOPE = 4409;
+export const CLOSE_CAPACITY = 1013;
+export const CLOSE_PROTOCOL = 1008;
+/** Nothing to watch: a tab with no tag to hear about reconnects only once it has one. */
+export const CLOSE_UNWATCHED = 1000;
+export const MAX_FRAME_BYTES = 32_768;
+export const MAX_WATCH_GRANTS = 3;
+export const MAX_WATCHES_PER_MINUTE = 20;
+/** Every inbound frame, heartbeats included: a client heartbeats twice a minute. */
+export const MAX_FRAMES_PER_MINUTE = 60;
+export const MAX_OUTBOUND_BYTES = 65_536;
+export const MAX_TOPICS = 200_000;
+export const IDLE_MS = 150_000;
+/**
+ * How long a socket may hold no tag: from its open, or from the watch or revocation that left it
+ * none. A tab watches right after its first live load, so only a socket nobody listens on runs out.
+ */
+export const FIRST_WATCH_MS = 60_000;
+export const SWEEP_MS = 10_000;
+export const COALESCE_MS = 25;
+/** How long after closing many sockets at once their reconnects are told to spread their reloads. */
+export const RECONNECT_WINDOW_MS = 30_000;
+const TAG_CACHE_SIZE = 16_384;
+const SPREAD_STEPS = [250, 500, 1000, 2000, 5000];
+const HEARTBEAT = "p";
+export class LiveHub {
+    ring;
+    history;
+    revocations;
+    options;
+    publishers;
+    /** Bus unreachable: no watch is accepted and no socket kept. */
+    down = false;
+    sockets = new Set();
+    /** Local subscribers per tag: the intern table, and the input to `spread`. */
+    members = new Map();
+    /** Socket-tag subscriptions held, the sum of `members`. */
+    memberships = 0;
+    tagOf;
+    coalescing = new Map();
+    /** The last time many sockets were closed at once, and how many. */
+    burstAt = Number.NEGATIVE_INFINITY;
+    burstSize = 0;
+    coalesceTimer;
+    sweepTimer;
+    constructor(ring, history, revocations, options, 
+    /** Where `changed` frames go: each attached app's `publish`. */
+    publishers) {
+        this.ring = ring;
+        this.history = history;
+        this.revocations = revocations;
+        this.options = options;
+        this.publishers = publishers;
+        this.tagOf = options.tags ?? tagCache(ring);
+    }
+    get size() {
+        return this.sockets.size;
+    }
+    /** The tag of `key` under each listed secret, newest first. */
+    tagsOf(key) {
+        const tags = [];
+        for (let secret = 0; secret < this.ring.secretCount; secret++)
+            tags.push(this.tagOf(key, secret));
+        return Promise.all(tags);
+    }
+    /** The handshake: a missing, `null` or untrusted Origin is refused. */
+    upgrade(req) {
+        const origin = req.headers.get("origin");
+        if (origin === null ||
+            !(this.options.trusted.has(origin) || isSameOriginRequest(origin, req))) {
+            return Response.json({ error: "forbidden_origin" }, { status: 403 });
+        }
+        const now = Date.now();
+        return {
+            sid: randomSid(),
+            sub: undefined,
+            received: -1,
+            tags: new Set(),
+            exp: Number.POSITIVE_INFINITY,
+            unwatchedSince: now,
+            window: now,
+            frames: 0,
+            watches: 0,
+            lastSeen: now,
+        };
+    }
+    open(ws) {
+        if (this.down || this.sockets.size >= this.options.maxSockets || this.overRss()) {
+            ws.close(CLOSE_CAPACITY, "at capacity");
+            return;
+        }
+        this.sockets.add(ws);
+        this.startSweep();
+        const spread = Date.now() - this.burstAt < RECONNECT_WINDOW_MS ? this.spread(this.burstSize) : 0;
+        this.send(ws, JSON.stringify(spread > 0
+            ? { t: "welcome", sid: ws.data.sid, spread }
+            : { t: "welcome", sid: ws.data.sid }));
+    }
+    /** The runtime has dropped the closed socket's topics; only the counts are left to settle. */
+    close(ws) {
+        this.forget(ws, false);
+    }
+    /** A change, already in history: publish one frame per tag, at most once per key per window. */
+    change(keys, tags) {
+        for (let i = 0; i < keys.length; i++) {
+            const key = keys[i] ?? "";
+            const keyTags = tags[i] ?? [];
+            // Nobody here watches it: nothing to send now or at the end of a window.
+            if (!keyTags.some((tag) => this.members.has(tag)))
+                continue;
+            const pending = this.coalescing.get(key);
+            if (pending !== undefined) {
+                pending.again = true;
+                continue;
+            }
+            this.coalescing.set(key, { tags: keyTags, again: false });
+            this.publishTags(keyTags);
+        }
+        if (this.coalescing.size > 0 && this.coalesceTimer === undefined) {
+            this.coalesceTimer = unref(setTimeout(() => this.flush(), COALESCE_MS));
+        }
+    }
+    /** A revocation, already stored. `tags` are the key's tags for a `revokeKey`. */
+    revoke(event, tags) {
+        if (event.key === null) {
+            for (const ws of [...this.sockets]) {
+                if (event.sub === null || ws.data.sub === event.sub)
+                    this.drop(ws, CLOSE_REVOKED, "revoked");
+            }
+            return;
+        }
+        // One terminal `changed` to every subscriber, then the revoked ones leave the topics: no later
+        // frame for this key reaches them.
+        this.publishTags(tags);
+        for (const ws of this.sockets) {
+            if (event.sub !== null && ws.data.sub !== event.sub)
+                continue;
+            let left = false;
+            for (const tag of tags) {
+                if (!ws.data.tags.has(tag))
+                    continue;
+                this.leave(ws, tag);
+                left = true;
+            }
+            const state = ws.data;
+            if (left && state.tags.size === 0)
+                state.unwatchedSince ??= Date.now();
+            if (left)
+                this.options.store?.saved(ws, {
+                    sub: state.sub ?? null,
+                    exp: state.exp,
+                    tags: [...state.tags],
+                });
+        }
+    }
+    /** Close every socket: history or revocations before now are unknown, or the bus is gone. */
+    closeAll(code, reason) {
+        const sockets = [...this.sockets];
+        this.burst(sockets.length);
+        for (const ws of sockets)
+            this.drop(ws, code, reason);
+    }
+    /**
+     * `count` sockets just closed together and will reconnect together. Each must reload under its new
+     * socket id, so for a while `welcome` tells them to spread those reloads as a change would.
+     */
+    burst(count) {
+        const now = Date.now();
+        const recent = now - this.burstAt < RECONNECT_WINDOW_MS;
+        this.burstSize = recent ? Math.max(this.burstSize, count) : count;
+        this.burstAt = now;
+    }
+    /** Resolves once a watch is installed or refused. */
+    message(ws, data) {
+        // Refused at open or already dropped: a frame still in flight gets no say.
+        if (!this.sockets.has(ws))
+            return undefined;
+        const state = ws.data;
+        const now = Date.now();
+        state.lastSeen = now;
+        if (now - state.window >= 60_000) {
+            state.window = now;
+            state.frames = 0;
+            state.watches = 0;
+        }
+        if (++state.frames > MAX_FRAMES_PER_MINUTE) {
+            this.drop(ws, CLOSE_PROTOCOL, "rate");
+            return undefined;
+        }
+        if (data === HEARTBEAT) {
+            this.send(ws, HEARTBEAT);
+            return undefined;
+        }
+        const watch = typeof data === "string" ? parseWatch(data) : undefined;
+        if (watch === undefined) {
+            this.drop(ws, CLOSE_PROTOCOL, "protocol");
+            return undefined;
+        }
+        if (++state.watches > MAX_WATCHES_PER_MINUTE) {
+            this.drop(ws, CLOSE_PROTOCOL, "rate");
+            return undefined;
+        }
+        if (watch.gen <= state.received)
+            return undefined;
+        state.received = watch.gen;
+        return this.install(ws, watch).catch(() => this.drop(ws, 1011, "error"));
+    }
+    async install(ws, watch) {
+        const state = ws.data;
+        const now = Date.now();
+        const prepared = [];
+        // One grant per path: the page and each open boundary show different URLs.
+        const paths = new Set();
+        for (const token of watch.grants) {
+            const grant = await this.ring.open(token, now);
+            if (grant === undefined || grant.claims.sid !== state.sid) {
+                return this.drop(ws, CLOSE_BAD_GRANT, "grant");
+            }
+            if (paths.has(grant.claims.path))
+                return this.drop(ws, CLOSE_PROTOCOL, "protocol");
+            paths.add(grant.claims.path);
+            const owners = [];
+            const tags = [];
+            for (const [id, owner] of Object.entries(grant.claims.owners)) {
+                owners.push({ id, w: owner.w, hashes: owner.k.map(this.options.hash) });
+                tags.push(...(await Promise.all(owner.k.map((key) => this.tagOf(key, grant.secret)))));
+            }
+            prepared.push({ grant, owners, tags });
+        }
+        // One synchronous step from here to `ready`.
+        if (!this.sockets.has(ws) || ws.readyState !== 1 || state.received !== watch.gen)
+            return;
+        if (this.down)
+            return this.drop(ws, CLOSE_CAPACITY, "unavailable");
+        let sub = state.sub;
+        for (const { grant } of prepared) {
+            const claims = grant.claims;
+            if (this.revocations.grantRevoked(claims))
+                return this.drop(ws, CLOSE_REVOKED, "revoked");
+            for (const owner of Object.values(claims.owners)) {
+                for (const key of owner.k) {
+                    if (this.revocations.keyRevoked(key, claims)) {
+                        return this.drop(ws, CLOSE_BAD_GRANT, "grant");
+                    }
+                }
+            }
+            if (sub !== undefined && sub !== claims.sub)
+                return this.drop(ws, CLOSE_SCOPE, "scope");
+            sub = claims.sub;
+        }
+        // At most 3 grants of 64 keys each (`parseWatch`, the keyring): 192 memberships per socket.
+        const next = new Set();
+        for (const { tags } of prepared)
+            for (const tag of tags)
+                next.add(tag);
+        let added = 0;
+        for (const tag of next)
+            if (!this.members.has(tag))
+                added++;
+        const budget = this.options.maxMemberships ?? Number.POSITIVE_INFINITY;
+        if (this.members.size + added > (this.options.maxTopics ?? MAX_TOPICS) ||
+            this.memberships - state.tags.size + next.size > budget) {
+            return this.drop(ws, CLOSE_CAPACITY, "at capacity");
+        }
+        state.sub = sub;
+        for (const tag of state.tags)
+            if (!next.has(tag))
+                this.leave(ws, tag);
+        for (const tag of next) {
+            if (state.tags.has(tag))
+                continue;
+            this.join(ws, tag);
+        }
+        // An empty watch does not restart the clock: only holding a tag stops it.
+        state.unwatchedSince = next.size === 0 ? (state.unwatchedSince ?? now) : undefined;
+        // Per grant, in watch order: two frames can hold an owner of the same id.
+        const stale = [];
+        let exp = Number.POSITIVE_INFINITY;
+        for (const { grant, owners } of prepared) {
+            exp = Math.min(exp, grant.claims.exp * 1000);
+            const changed = [];
+            for (const owner of owners) {
+                if (!this.history.known(owner.w) ||
+                    owner.hashes.some((hash) => this.history.changedSince(hash, owner.w)))
+                    changed.push(owner.id);
+            }
+            stale.push(changed);
+        }
+        state.exp = exp;
+        this.options.store?.saved(ws, { sub: state.sub ?? null, exp, tags: [...state.tags] });
+        this.send(ws, JSON.stringify({ t: "ready", gen: watch.gen, stale }));
+    }
+    /**
+     * A socket whose hub lost its memory but not its connection: its membership comes back as stored.
+     * Every revocation since was applied to what is stored, so nothing here is checked again.
+     */
+    restore(ws, stored) {
+        this.sockets.add(ws);
+        if (stored === undefined)
+            return;
+        const state = ws.data;
+        state.sub = stored.sub;
+        state.exp = stored.exp;
+        for (const tag of stored.tags)
+            if (!state.tags.has(tag))
+                this.join(ws, tag);
+        if (state.tags.size > 0)
+            state.unwatchedSince = undefined;
+    }
+    flush() {
+        this.coalesceTimer = undefined;
+        for (const [key, pending] of this.coalescing) {
+            if (!pending.again) {
+                this.coalescing.delete(key);
+                continue;
+            }
+            pending.again = false;
+            this.publishTags(pending.tags);
+        }
+        if (this.coalescing.size > 0) {
+            this.coalesceTimer = unref(setTimeout(() => this.flush(), COALESCE_MS));
+        }
+    }
+    publishTags(tags) {
+        for (const tag of tags) {
+            const subscribers = this.members.get(tag);
+            if (subscribers === undefined)
+                continue;
+            const frame = JSON.stringify({ t: "changed", tag, spread: this.spread(subscribers) });
+            for (const publish of this.publishers)
+                publish(this.topic(tag), frame);
+        }
+    }
+    /**
+     * How long clients spread their reloads, from this process's subscriber count, rounded up to a few
+     * steps so the frame shows no more than its order of magnitude.
+     */
+    spread(subscribers) {
+        const { instances, reloadRate, spreadFloor } = this.options;
+        const raw = Math.max(spreadFloor, ((subscribers * instances) / reloadRate) * 1000);
+        if (raw <= 100)
+            return 0;
+        return SPREAD_STEPS.find((step) => step >= raw) ?? 5000;
+    }
+    join(ws, tag) {
+        ws.data.tags.add(tag);
+        this.members.set(tag, (this.members.get(tag) ?? 0) + 1);
+        this.memberships++;
+        ws.subscribe(this.topic(tag));
+    }
+    leave(ws, tag, open = true) {
+        ws.data.tags.delete(tag);
+        if (open)
+            ws.unsubscribe(this.topic(tag));
+        this.memberships--;
+        const count = (this.members.get(tag) ?? 1) - 1;
+        if (count === 0)
+            this.members.delete(tag);
+        else
+            this.members.set(tag, count);
+    }
+    /** Leave every topic before closing: nothing published after this reaches the socket. */
+    drop(ws, code, reason) {
+        this.forget(ws);
+        ws.close(code, reason);
+    }
+    forget(ws, open = true) {
+        if (!this.sockets.delete(ws))
+            return;
+        for (const tag of [...ws.data.tags])
+            this.leave(ws, tag, open);
+        this.options.store?.removed(ws);
+        if (this.sockets.size === 0)
+            this.stopSweep();
+    }
+    send(ws, frame) {
+        ws.send(frame);
+        if (bufferedOf(ws) > MAX_OUTBOUND_BYTES)
+            this.drop(ws, CLOSE_CAPACITY, "backpressure");
+    }
+    topic(tag) {
+        return topicOf(this.options.appId, tag);
+    }
+    /** Read on every open, never cached: a burst of opens must not all pass on one stale reading. */
+    overRss() {
+        const cap = this.options.maxRssBytes;
+        return cap !== undefined && rss() > cap;
+    }
+    startSweep() {
+        if (this.options.store !== undefined)
+            return;
+        this.sweepTimer ??= unref(setInterval(() => this.sweep(), SWEEP_MS));
+    }
+    stopSweep() {
+        if (this.sweepTimer === undefined)
+            return;
+        clearInterval(this.sweepTimer);
+        this.sweepTimer = undefined;
+    }
+    /**
+     * Drop the socket when its earliest grant has expired. A host whose sweep can run late (an alarm)
+     * asks before every frame it sends.
+     */
+    expired(ws, now) {
+        if (ws.data.exp > now)
+            return false;
+        this.drop(ws, CLOSE_BAD_GRANT, "expired");
+        return true;
+    }
+    /**
+     * Expired grants, silent peers, sockets with nothing to watch and slow readers. Returns the earliest
+     * deadline left: a grant expiry, the silence limit, or the end of {@link FIRST_WATCH_MS}; infinite
+     * with no socket.
+     */
+    sweep() {
+        const now = Date.now();
+        const store = this.options.store;
+        let next = Number.POSITIVE_INFINITY;
+        for (const ws of [...this.sockets]) {
+            const state = ws.data;
+            const seen = store === undefined ? state.lastSeen : Math.max(state.lastSeen, store.lastBeat(ws));
+            const unwatched = state.unwatchedSince;
+            if (state.exp <= now)
+                this.drop(ws, CLOSE_BAD_GRANT, "expired");
+            else if (now - seen > IDLE_MS)
+                this.drop(ws, CLOSE_PROTOCOL, "idle");
+            else if (unwatched !== undefined && now - unwatched >= FIRST_WATCH_MS) {
+                this.drop(ws, CLOSE_UNWATCHED, "unwatched");
+            }
+            else if (bufferedOf(ws) > MAX_OUTBOUND_BYTES)
+                this.drop(ws, CLOSE_CAPACITY, "backpressure");
+            else {
+                const due = Number.isFinite(state.exp) ? state.exp : seen + IDLE_MS;
+                next = Math.min(next, due, unwatched === undefined ? due : unwatched + FIRST_WATCH_MS);
+            }
+        }
+        return next;
+    }
+}
+/** The pub/sub topic of one tag. */
+export const topicOf = (appId, tag) => `nifra:live:${appId}:${tag}`;
+/** {@link Keyring.tag}, kept: a key's tag changes only with the secrets. Oldest entry out first. */
+export function tagCache(ring, size = TAG_CACHE_SIZE) {
+    const cache = new Map();
+    return (key, secret) => {
+        const name = `${secret}:${key}`;
+        const cached = cache.get(name);
+        if (cached !== undefined)
+            return cached;
+        if (cache.size >= size) {
+            const oldest = cache.keys().next().value;
+            if (oldest !== undefined)
+                cache.delete(oldest);
+        }
+        const tag = ring.tag(key, secret);
+        cache.set(name, tag);
+        return tag;
+    };
+}
+function parseWatch(text) {
+    if (text.length > MAX_FRAME_BYTES || utf8Length(text) > MAX_FRAME_BYTES)
+        return undefined;
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    if (!isRecord(value))
+        return undefined;
+    const { t, gen, grants } = value;
+    if (t !== "watch" || typeof gen !== "number" || !Number.isSafeInteger(gen) || gen < 0)
+        return undefined;
+    if (!Array.isArray(grants) || grants.length > MAX_WATCH_GRANTS)
+        return undefined;
+    const list = [];
+    for (const grant of grants) {
+        if (typeof grant !== "string" || grant.length > MAX_GRANT_CHARS)
+            return undefined;
+        list.push(grant);
+    }
+    return { gen, grants: list };
+}
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function utf8Length(text) {
+    let bytes = 0;
+    for (let i = 0; i < text.length; i++) {
+        const code = text.charCodeAt(i);
+        // A surrogate pair is 4 bytes, counted as 2 + 2.
+        bytes += code < 0x80 ? 1 : code < 0x800 ? 2 : code >= 0xd800 && code < 0xe000 ? 2 : 3;
+    }
+    return bytes;
+}
+function randomSid() {
+    let sid = "";
+    for (const byte of crypto.getRandomValues(new Uint8Array(16)))
+        sid += byte.toString(16).padStart(2, "0");
+    return sid;
+}
+/** Bytes queued for a socket: Bun's `getBufferedAmount()`, or a standard socket's `bufferedAmount`. */
+function bufferedOf(ws) {
+    const raw = ws.raw;
+    if (typeof raw !== "object" || raw === null)
+        return 0;
+    if ("getBufferedAmount" in raw && typeof raw.getBufferedAmount === "function") {
+        const amount = raw.getBufferedAmount();
+        return typeof amount === "number" ? amount : 0;
+    }
+    if ("bufferedAmount" in raw && typeof raw.bufferedAmount === "number")
+        return raw.bufferedAmount;
+    return 0;
+}
+function rss() {
+    const usage = typeof process === "undefined" ? undefined : process.memoryUsage;
+    return typeof usage?.rss === "function" ? usage.rss() : 0;
+}
+export function unref(timer) {
+    if (typeof timer === "object" && timer !== null && "unref" in timer) {
+        const release = timer.unref;
+        if (typeof release === "function")
+            release.call(timer);
+    }
+    return timer;
+}
+//# sourceMappingURL=hub.js.map

package/dist/live/hub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub.js","sourceRoot":"","sources":["../../src/live/hub.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,mBAAmB,EAA2C,MAAM,sBAAsB,CAAA;AAGnG,OAAO,EAAgB,eAAe,EAAoB,MAAM,cAAc,CAAA;AAG9E,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAA;AACnC,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAA;AACjC,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAA;AAC/B,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAA;AAClC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAA;AAClC,yFAAyF;AACzF,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAA;AAEnC,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAA;AACrC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAA;AACjC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAA;AACxC,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAA;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AACxC,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAA;AACjC,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAA;AAC9B;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAA;AACpC,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAA;AAC9B,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAA;AAC7B,qGAAqG;AACrG,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAA;AACzC,MAAM,cAAc,GAAG,MAAM,CAAA;AAC7B,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AACjD,MAAM,SAAS,GAAG,GAAG,CAAA;AA4ErB,MAAM,OAAO,OAAO;IAiBC;IACA;IACA;IACA;IAEA;IArBnB,gEAAgE;IAChE,IAAI,GAAG,KAAK,CAAA;IACK,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAA;IAChE,8EAA8E;IAC7D,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IACpD,2DAA2D;IACnD,WAAW,GAAG,CAAC,CAAA;IACN,KAAK,CAAO;IACZ,UAAU,GAAG,IAAI,GAAG,EAAmB,CAAA;IACxD,oEAAoE;IAC5D,OAAO,GAAG,MAAM,CAAC,iBAAiB,CAAA;IAClC,SAAS,GAAG,CAAC,CAAA;IACb,aAAa,CAA2C;IACxD,UAAU,CAA4C;IAE9D,YACmB,IAAa,EACb,OAAgB,EAChB,WAAwB,EACxB,OAAmB;IACpC,gEAAgE;IAC/C,UAA+D;QAL/D,SAAI,GAAJ,IAAI,CAAS;QACb,YAAO,GAAP,OAAO,CAAS;QAChB,gBAAW,GAAX,WAAW,CAAa;QACxB,YAAO,GAAP,OAAO,CAAY;QAEnB,eAAU,GAAV,UAAU,CAAqD;QAEhF,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC7C,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAA;IAC1B,CAAC;IAED,+DAA+D;IAC/D,MAAM,CAAC,GAAW;QAChB,MAAM,IAAI,GAAsB,EAAE,CAAA;QAClC,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE;YAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;QACpC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IAED,uEAAuE;IACvE,OAAO,CAAC,GAAY;QAClB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACxC,IACE,MAAM,KAAK,IAAI;YACf,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EACvE,CAAC;YACD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACtE,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,OAAO;YACL,GAAG,EAAE,SAAS,EAAE;YAChB,GAAG,EAAE,SAAS;YACd,QAAQ,EAAE,CAAC,CAAC;YACZ,IAAI,EAAE,IAAI,GAAG,EAAU;YACvB,GAAG,EAAE,MAAM,CAAC,iBAAiB;YAC7B,cAAc,EAAE,GAAG;YACnB,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,GAAG;SACd,CAAA;IACH,CAAC;IAED,IAAI,CAAC,EAA8B;QACjC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YAChF,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,aAAa,CAAC,CAAA;YACvC,OAAM;QACR,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACpB,IAAI,CAAC,UAAU,EAAE,CAAA;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAChG,IAAI,CAAC,IAAI,CACP,EAAE,EACF,IAAI,CAAC,SAAS,CACZ,MAAM,GAAG,CAAC;YACR,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CACvC,CACF,CAAA;IACH,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,EAA8B;QAClC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;IAED,gGAAgG;IAChG,MAAM,CAAC,IAAuB,EAAE,IAAoC;QAClE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAC7B,yEAAyE;YACzE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAAE,SAAQ;YAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAK,GAAG,IAAI,CAAA;gBACpB,SAAQ;YACV,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;YACzD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC3B,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACjE,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,WAAW,CAAC,CAAC,CAAA;QACzE,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,MAAM,CAAC,KAAqB,EAAE,IAAuB;QACnD,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACvB,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;oBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,SAAS,CAAC,CAAA;YAC9F,CAAC;YACD,OAAM;QACR,CAAC;QACD,+FAA+F;QAC/F,mCAAmC;QACnC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QACtB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;gBAAE,SAAQ;YAC7D,IAAI,IAAI,GAAG,KAAK,CAAA;YAChB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAQ;gBACpC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;gBACnB,IAAI,GAAG,IAAI,CAAA;YACb,CAAC;YACD,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAA;YACrB,IAAI,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;gBAAE,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,GAAG,EAAE,CAAA;YACtE,IAAI,IAAI;gBACN,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;oBAC5B,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI;oBACtB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;iBACtB,CAAC,CAAA;QACN,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,QAAQ,CAAC,IAAY,EAAE,MAAc;QACnC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC1B,KAAK,MAAM,EAAE,IAAI,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;IACvD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAa;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,mBAAmB,CAAA;QACvD,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACjE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAA;IACpB,CAAC;IAED,qDAAqD;IACrD,OAAO,CAAC,EAA8B,EAAE,IAAmB;QACzD,2EAA2E;QAC3E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,SAAS,CAAA;QAC3C,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAA;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAA;QACpB,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;YACjC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAA;YAClB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;YAChB,KAAK,CAAC,OAAO,GAAG,CAAC,CAAA;QACnB,CAAC;QACD,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;YACrC,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;YACxB,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACrE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,CAAA;YACzC,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,EAAE,KAAK,CAAC,OAAO,GAAG,sBAAsB,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;YACrC,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAA;QACjD,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAA;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;IAC1E,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,EAA8B,EAAE,KAAY;QAChE,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAA;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,QAAQ,GAAe,EAAE,CAAA;QAC/B,2EAA2E;QAC3E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;QAC/B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC9C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,CAAA;YAChD,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,CAAA;YAClF,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAC5B,MAAM,MAAM,GAAkD,EAAE,CAAA;YAChE,MAAM,IAAI,GAAa,EAAE,CAAA;YACzB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9D,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBACvE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACxF,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QACxC,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,GAAG;YAAE,OAAM;QACxF,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,aAAa,CAAC,CAAA;QAClE,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;QACnB,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;YAC3B,IAAI,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,SAAS,CAAC,CAAA;YACzF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC1B,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;wBAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,CAAA;oBAChD,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,MAAM,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;YACvF,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;QAClB,CAAC;QACD,4FAA4F;QAC5F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ;YAAE,KAAK,MAAM,GAAG,IAAI,IAAI;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACtE,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,EAAE,CAAA;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC,iBAAiB,CAAA;QACtE,IACE,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC;YAClE,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,MAAM,EACvD,CAAC;YACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,aAAa,CAAC,CAAA;QACrD,CAAC;QACD,KAAK,CAAC,GAAG,GAAG,GAAG,CAAA;QACf,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAQ;YACjC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QACpB,CAAC;QACD,0EAA0E;QAC1E,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAClF,0EAA0E;QAC1E,MAAM,KAAK,GAAe,EAAE,CAAA;QAC5B,IAAI,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAA;QAClC,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YACzC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAA;YAC5C,MAAM,OAAO,GAAa,EAAE,CAAA;YAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IACE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC5B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;oBAErE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC1B,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACrB,CAAC;QACD,KAAK,CAAC,GAAG,GAAG,GAAG,CAAA;QACf,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACrF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IACtE,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,EAA8B,EAAE,MAAgC;QACtE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACpB,IAAI,MAAM,KAAK,SAAS;YAAE,OAAM;QAChC,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAA;QACrB,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;QACtB,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;QACtB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QAC3E,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;YAAE,KAAK,CAAC,cAAc,GAAG,SAAS,CAAA;IAC3D,CAAC;IAEO,KAAK;QACX,IAAI,CAAC,aAAa,GAAG,SAAS,CAAA;QAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC7C,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC3B,SAAQ;YACV,CAAC;YACD,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;YACrB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAChC,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,WAAW,CAAC,CAAC,CAAA;QACzE,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,IAAuB;QACzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACzC,IAAI,WAAW,KAAK,SAAS;gBAAE,SAAQ;YACvC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;YACrF,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,UAAU;gBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,WAAmB;QAChC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAA;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,GAAG,SAAS,CAAC,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAA;QAClF,IAAI,GAAG,IAAI,GAAG;YAAE,OAAO,CAAC,CAAA;QACxB,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,CAAA;IACzD,CAAC;IAEO,IAAI,CAAC,EAA8B,EAAE,GAAW;QACtD,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACrB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACvD,IAAI,CAAC,WAAW,EAAE,CAAA;QAClB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/B,CAAC;IAEO,KAAK,CAAC,EAA8B,EAAE,GAAW,EAAE,IAAI,GAAG,IAAI;QACpE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACxB,IAAI,IAAI;YAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;QACzC,IAAI,CAAC,WAAW,EAAE,CAAA;QAClB,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QAC9C,IAAI,KAAK,KAAK,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;;YACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACnC,CAAC;IAED,yFAAyF;IACjF,IAAI,CAAC,EAA8B,EAAE,IAAY,EAAE,MAAc;QACvE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACf,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACxB,CAAC;IAEO,MAAM,CAAC,EAA8B,EAAE,IAAI,GAAG,IAAI;QACxD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,OAAM;QACpC,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAC9D,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;QAC/B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,SAAS,EAAE,CAAA;IAC/C,CAAC;IAEO,IAAI,CAAC,EAA8B,EAAE,KAAa;QACxD,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACd,IAAI,UAAU,CAAC,EAAE,CAAC,GAAG,kBAAkB;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,cAAc,CAAC,CAAA;IACxF,CAAC;IAEO,KAAK,CAAC,GAAW;QACvB,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACzC,CAAC;IAED,iGAAiG;IACzF,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAA;QACpC,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,EAAE,GAAG,GAAG,CAAA;IACzC,CAAC;IAEO,UAAU;QAChB,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,OAAM;QAC5C,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAA;IACtE,CAAC;IAEO,SAAS;QACf,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,OAAM;QACzC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC9B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAA;IAC7B,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,EAA8B,EAAE,GAAW;QACjD,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG;YAAE,OAAO,KAAK,CAAA;QACnC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,SAAS,CAAC,CAAA;QACzC,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;QAChC,IAAI,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAA;QACnC,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAA;YACrB,MAAM,IAAI,GACR,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;YACrF,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAA;YACtC,IAAI,KAAK,CAAC,GAAG,IAAI,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,SAAS,CAAC,CAAA;iBAC1D,IAAI,GAAG,GAAG,IAAI,GAAG,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;iBAC/D,IAAI,SAAS,KAAK,SAAS,IAAI,GAAG,GAAG,SAAS,IAAI,cAAc,EAAE,CAAC;gBACtE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,WAAW,CAAC,CAAA;YAC7C,CAAC;iBAAM,IAAI,UAAU,CAAC,EAAE,CAAC,GAAG,kBAAkB;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,cAAc,CAAC,CAAA;iBACxF,CAAC;gBACJ,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAA;gBACnE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,cAAc,CAAC,CAAA;YACxF,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAED,oCAAoC;AACpC,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,GAAW,EAAU,EAAE,CAAC,cAAc,KAAK,IAAI,GAAG,EAAE,CAAA;AAK3F,oGAAoG;AACpG,MAAM,UAAU,QAAQ,CAAC,IAAa,EAAE,IAAI,GAAG,cAAc;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAA;IAChD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QACrB,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,GAAG,EAAE,CAAA;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;QACvC,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YACxC,IAAI,MAAM,KAAK,SAAS;gBAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAChD,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACjC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACpB,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,eAAe;QAAE,OAAO,SAAS,CAAA;IACzF,IAAI,KAAc,CAAA;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACtC,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;IAChC,IAAI,CAAC,KAAK,OAAO,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QACnF,OAAO,SAAS,CAAA;IAClB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,gBAAgB;QAAE,OAAO,SAAS,CAAA;IAChF,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe;YAAE,OAAO,SAAS,CAAA;QACjF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;AAC9B,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAEtE,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC/B,iDAAiD;QACjD,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACvF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC3D,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC3C,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,uGAAuG;AACvG,SAAS,UAAU,CAAC,EAA8B;IAChD,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAA;IAClB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,CAAC,CAAA;IACrD,IAAI,mBAAmB,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,iBAAiB,KAAK,UAAU,EAAE,CAAC;QAC9E,MAAM,MAAM,GAAY,GAAG,CAAC,iBAAiB,EAAE,CAAA;QAC/C,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,gBAAgB,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,cAAc,CAAA;IAChG,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,GAAG;IACV,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAA;IAC9E,OAAO,OAAO,KAAK,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED,MAAM,UAAU,KAAK,CAAI,KAAQ;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAA;QAC3B,IAAI,OAAO,OAAO,KAAK,UAAU;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/live/keyring.d.ts

@@ -0,0 +1,87 @@
+/**
+ * The live keyring: AES-256-GCM grants under hourly per-process subkeys, and the HMAC tags and subject
+ * tags derived from the same secrets. Everything here is WebCrypto, so it runs unchanged on Bun, Node,
+ * Deno and Workers.
+ *
+ * Token: `base64url(kid || nonce || AES-256-GCM(JSON claims))`, with the 16-byte `kid` authenticated as
+ * associated data. `kid = secretId (4) || processId (8) || hour (4)`.
+ */
+export declare const MIN_SECRET_BYTES = 32;
+export declare const MAX_SECRETS = 3;
+/** A grant token longer than this is refused before decoding, and never issued. */
+export declare const MAX_GRANT_CHARS = 10240;
+export declare const MAX_KEYS_PER_FRAME = 64;
+/** The cache-tag charset: a letter, then up to 127 of `A-Z a-z 0-9 . _ : / -`. */
+export declare const KEY_PATTERN: RegExp;
+export declare const SID_PATTERN: RegExp;
+/**
+ * Seals under one subkey before it refuses more. Random 96-bit nonces stay safe for about 2^32
+ * encryptions per key; an hourly per-process subkey at 10,000 grants a second sees 3.6e7.
+ */
+export declare const MAX_SEALS_PER_SUBKEY: number;
+export interface GrantOwner {
+    /** The keys the owner's loader declared. */
+    readonly k: readonly string[];
+    /** The bus seq read before the owner's data was loaded. */
+    readonly w: number;
+}
+export interface GrantClaims {
+    readonly v: 1;
+    readonly sid: string;
+    readonly sub: string | null;
+    readonly path: string;
+    readonly frame: string;
+    readonly owners: Readonly<Record<string, GrantOwner>>;
+    /** The seq read at issuance: revocations above it refuse the grant. */
+    readonly s: number;
+    /** Renewals re-signed without loaders since the last load that ran them all. */
+    readonly r: number;
+    readonly iat: number;
+    readonly exp: number;
+    readonly aud: string;
+}
+export type GrantInput = Omit<GrantClaims, "v" | "iat" | "exp" | "aud">;
+export interface OpenedGrant {
+    readonly claims: GrantClaims;
+    /** Index of the secret that decrypted it; that secret also derives the grant's tags. */
+    readonly secret: number;
+}
+export interface Keyring {
+    readonly appId: string;
+    /** Grant lifetime in seconds. */
+    readonly ttl: number;
+    readonly secretCount: number;
+    /** Each secret's public 32-bit id, newest first: a token names its secret by it. */
+    readonly secretIds: readonly number[];
+    /**
+     * Encrypt under the first secret; `undefined` when the token would exceed {@link MAX_GRANT_CHARS} or
+     * the hour's subkey reached {@link MAX_SEALS_PER_SUBKEY}.
+     */
+    seal(input: GrantInput, nowMs: number): Promise<string | undefined>;
+    /** Authenticate and decrypt, or `undefined` for anything not issued by this keyring and still valid. */
+    open(token: unknown, nowMs: number): Promise<OpenedGrant | undefined>;
+    /** The 128-bit wire tag of a key under one secret (default: the first). */
+    tag(key: string, secret?: number): Promise<string>;
+    /**
+     * The subject's stable opaque tag under each listed secret, newest first. Across a rotation the
+     * same viewer keeps one tag in common, whichever process served the load.
+     */
+    subjectTags(subject: string | null): Promise<string[]>;
+}
+/** A rotation list: newest first, never empty. */
+export type LiveSecrets = readonly [string, ...string[]];
+export interface KeyringOptions {
+    readonly secrets: LiveSecrets;
+    readonly appId: string;
+    readonly ttl: number;
+    /** Fixed per process; random when omitted. Tests pin it. */
+    readonly processId?: Uint8Array;
+    /** Tests lower it; see {@link MAX_SEALS_PER_SUBKEY}. */
+    readonly maxSealsPerSubkey?: number;
+}
+/** Synchronous boot checks: count and strength. Duplicate ids need derivation, see {@link createKeyring}. */
+export declare function assertLiveSecrets(secrets: readonly unknown[]): asserts secrets is LiveSecrets;
+/** Derive every key a secret needs. Rejects when two secrets share a `secretId`. */
+export declare function createKeyring(options: KeyringOptions): Promise<Keyring>;
+export declare const toBase64Url: (bytes: Uint8Array) => string;
+//# sourceMappingURL=keyring.d.ts.map

package/dist/live/keyring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyring.d.ts","sourceRoot":"","sources":["../../src/live/keyring.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,eAAO,MAAM,gBAAgB,KAAK,CAAA;AAClC,eAAO,MAAM,WAAW,IAAI,CAAA;AAC5B,mFAAmF;AACnF,eAAO,MAAM,eAAe,QAAS,CAAA;AACrC,eAAO,MAAM,kBAAkB,KAAK,CAAA;AACpC,kFAAkF;AAClF,eAAO,MAAM,WAAW,QAAsC,CAAA;AAC9D,eAAO,MAAM,WAAW,QAAmB,CAAA;AAU3C;;;GAGG;AACH,eAAO,MAAM,oBAAoB,QAAU,CAAA;AAQ3C,MAAM,WAAW,UAAU;IACzB,4CAA4C;IAC5C,QAAQ,CAAC,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAA;IACb,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;IACrD,uEAAuE;IACvE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;IAClB,gFAAgF;IAChF,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAA;AAEvE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC;;;OAGG;IACH,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACnE,wGAAwG;IACxG,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;IACrE,2EAA2E;IAC3E,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAClD;;;OAGG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;CACvD;AAED,kDAAkD;AAClD,MAAM,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;AAExD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAA;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CACpC;AAWD,6GAA6G;AAC7G,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,IAAI,WAAW,CAe7F;AAED,oFAAoF;AACpF,wBAAsB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAmK7E;AA8DD,eAAO,MAAM,WAAW,GAAI,OAAO,UAAU,KAAG,MACgC,CAAA"}