@northstartech/cipher 0.0.0-stage → 1.0.0

package/dist/integrations/typeorm.js

@@ -0,0 +1,457 @@
+/**
+ * TypeORM integration: an `@Encrypted()` property decorator and an entity subscriber.
+ *
+ * ```ts
+ * import { Encrypted, northstarCipherSubscriber, cipherWhere } from '@northstartech/cipher/typeorm'
+ *
+ * @Entity('todos')
+ * class Todo {
+ *   @PrimaryGeneratedColumn('uuid') id!: string
+ *   @Encrypted() @Column({ type: 'text', nullable: true }) title!: string | null
+ *   @Encrypted({ searchable: 'email' }) @Column({ type: 'text', nullable: true }) email!: string | null
+ *   @Index() @Column({ type: 'varchar', length: 64, nullable: true }) email_bidx!: string | null
+ * }
+ *
+ * const ds = new DataSource({ …, entities: [Todo], subscribers: [northstarCipherSubscriber(cipher)] })
+ * await ds.getRepository(Todo).save({ title: 'Buy milk', email: 'ana@example.com' })
+ * const todos = await ds.getRepository(Todo).find()          // afterLoad decrypts in one batch request
+ * const mine = await ds.getRepository(Todo).findBy(await cipherWhere(ds, Todo, 'email', 'ANA@example.com'))
+ * ```
+ *
+ * Record ids: `uuid` primary keys are generated client-side before the insert;
+ * generated integer keys (increment/identity/rowid) use the two-phase write
+ * (sentinel, then ciphertext in `afterInsert`, inside `save()`'s transaction).
+ *
+ * Northstar Search: `northstarCipherSubscriber(cipher, { search: [{ entity: Todo, index: cipher.index('todos'), fields: ['title', 'email'] }] })`
+ * keeps an index in sync after each transaction commits (encrypted properties are
+ * indexed from their stored ciphertext, which the enclave decrypts);
+ * `searchDocuments(ds, Todo, rows, fields)` builds documents for a (re)index.
+ */
+import { EventSubscriber, In, } from 'typeorm';
+import { CipherError } from '../errors.js';
+import { INDEX_SUFFIX, PENDING_SENTINEL, PlaintextLedger, SearchChangeSet, applySearchChange, configError, decryptOne, encryptCoalescer, isCiphertext, normalizeFieldSpec, normalizeSearchSync, plaintextOf, recordIdOf, requestError, searchDocumentOf, searchTokensFor, } from './shared.js';
+export { CIPHERTEXT_PREFIX, PENDING_SENTINEL } from './shared.js';
+/** Decorated properties per class (inherited through the prototype chain). */
+const decorated = new Map();
+/**
+ * Mark an entity property as encrypted. Use with a text column:
+ * `@Encrypted() @Column({ type: 'text', nullable: true }) title!: string | null`.
+ * Searchable properties need a `<property>_bidx` varchar(64) column (or `indexField`).
+ */
+export function Encrypted(options = {}) {
+    normalizeFieldSpec(Object.keys(options).length ? options : true, 'TypeORM: @Encrypted()');
+    return (target, propertyKey) => {
+        if (typeof propertyKey !== 'string')
+            throw configError('TypeORM: @Encrypted() needs a string property name');
+        const ctor = target.constructor;
+        let m = decorated.get(ctor);
+        if (!m)
+            decorated.set(ctor, (m = new Map()));
+        m.set(propertyKey, options);
+    };
+}
+const STRING_COLUMN_TYPES = new Set([
+    'text', 'varchar', 'character varying', 'nvarchar', 'national varchar', 'ntext', 'tinytext', 'mediumtext', 'longtext',
+    'char', 'nchar', 'character', 'citext', 'clob', 'nclob', 'string', 'varchar2', 'nvarchar2', 'shorttext', 'alphanum',
+]);
+const plans = new WeakMap();
+function decoratedProps(target) {
+    const out = new Map();
+    const chain = [];
+    for (let c = target; typeof c === 'function' && c !== Function.prototype; c = Object.getPrototypeOf(c))
+        chain.unshift(c);
+    for (const c of chain)
+        for (const [k, v] of decorated.get(c) ?? [])
+            out.set(k, v);
+    return out;
+}
+function planFor(metadata) {
+    const cached = plans.get(metadata);
+    if (cached !== undefined)
+        return cached;
+    const props = decoratedProps(metadata.target);
+    if (!props.size) {
+        plans.set(metadata, null);
+        return null;
+    }
+    const name = metadata.name;
+    if (metadata.primaryColumns.length !== 1)
+        throw configError(`TypeORM: ${name} must have exactly one primary column to bind ciphertext to records`);
+    const pkCol = metadata.primaryColumns[0];
+    const fields = [];
+    for (const [prop, opts] of props) {
+        const lb = `TypeORM: ${name}.${prop}`;
+        const col = metadata.findColumnWithPropertyPath(prop);
+        if (!col)
+            throw configError(`${lb}: @Encrypted() properties need a @Column()`);
+        if (col === pkCol)
+            throw configError(`${lb}: the primary key cannot be encrypted`);
+        const t = col.type;
+        if (!(t === String || (typeof t === 'string' && STRING_COLUMN_TYPES.has(t.toLowerCase()))))
+            throw configError(`${lb}: encrypted columns must be text (got ${String(typeof t === 'function' ? t.name : t)})`);
+        const n = normalizeFieldSpec(Object.keys(opts).length ? opts : true, lb);
+        let indexProp;
+        if (n.searchable) {
+            indexProp = n.indexField ?? [`${prop}${INDEX_SUFFIX}`, `${prop}Bidx`].find((p) => metadata.findColumnWithPropertyPath(p));
+            if (!indexProp || !metadata.findColumnWithPropertyPath(indexProp))
+                throw configError(`${lb}: searchable properties need a blind-index column (${prop}${INDEX_SUFFIX} varchar(64), indexed) or indexField`);
+        }
+        fields.push({ prop, column: col.databaseName, ...(n.normalization ? { normalization: n.normalization } : {}), ...(indexProp ? { indexProp } : {}) });
+    }
+    const gen = pkCol.isGenerated ? pkCol.generationStrategy : undefined;
+    const plan = {
+        table: metadata.tableName,
+        pk: pkCol.propertyName,
+        strategy: gen === 'uuid' ? 'uuid' : gen ? 'two-phase' : 'explicit',
+        fields,
+        byProp: new Map(fields.map((f) => [f.prop, f])),
+    };
+    plans.set(metadata, plan);
+    return plan;
+}
+/** Search document fields of an entity (encrypted properties carry the context of their stored ciphertext). */
+function searchFieldPlans(metadata, props) {
+    const plan = planFor(metadata);
+    return props.map((prop) => {
+        if (!metadata.findColumnWithPropertyPath(prop))
+            throw configError(`TypeORM: ${metadata.name}.${prop}: search fields must be columns`);
+        const f = plan?.byProp.get(prop);
+        return { attr: prop, ...(f ? { encrypted: { collection: plan.table, field: f.column } } : {}) };
+    });
+}
+function primaryProp(metadata) {
+    if (metadata.primaryColumns.length !== 1)
+        throw configError(`TypeORM: ${metadata.name} must have exactly one primary column to be indexed`);
+    return metadata.primaryColumns[0].propertyName;
+}
+/**
+ * Entity subscriber that encrypts `@Encrypted()` properties before INSERT/UPDATE
+ * and decrypts them after load. Register an instance (or use
+ * {@link northstarCipherSubscriber} for the DataSource `subscribers` option).
+ */
+export class NorthstarCipherSubscriber {
+    cipher;
+    options;
+    ledger = new PlaintextLedger();
+    encrypt;
+    searchPlans = new WeakMap();
+    /** Index changes per query runner and transaction depth, applied when the outermost transaction commits. */
+    pendingSearch = new WeakMap();
+    constructor(cipher, options = {}) {
+        if (!cipher || typeof cipher.encryptManySettled !== 'function')
+            throw configError('TypeORM: NorthstarCipherSubscriber requires a NorthstarCipher client');
+        this.cipher = cipher;
+        this.options = options;
+        this.encrypt = encryptCoalescer(cipher, { keyId: options.keyId });
+        if (options.search !== undefined && !Array.isArray(options.search))
+            throw configError('TypeORM: search must be a list of { entity, index, fields }');
+        for (const s of options.search ?? []) {
+            normalizeSearchSync(s, 'TypeORM: search');
+            if (typeof s.entity !== 'function' && (typeof s.entity !== 'string' || !s.entity))
+                throw configError('TypeORM: search entries need an entity (class or name)');
+        }
+    }
+    searchPlanFor(metadata) {
+        const cached = this.searchPlans.get(metadata);
+        if (cached !== undefined)
+            return cached;
+        const sync = this.options.search?.find((s) => s.entity === metadata.target || s.entity === metadata.name) ?? null;
+        const plan = sync ? { sync, pk: primaryProp(metadata), fields: searchFieldPlans(metadata, sync.fields), label: metadata.tableName } : null;
+        this.searchPlans.set(metadata, plan);
+        return plan;
+    }
+    /** Index a change now, or once the transaction it belongs to commits. */
+    async queueSearch(queryRunner, sync, change) {
+        if (!queryRunner?.isTransactionActive)
+            return applySearchChange(sync, change);
+        const depth = queryRunner.transactionDepth ?? 1;
+        let levels = this.pendingSearch.get(queryRunner);
+        if (!levels)
+            this.pendingSearch.set(queryRunner, (levels = new Map()));
+        let set = levels.get(depth);
+        if (!set)
+            levels.set(depth, (set = new SearchChangeSet()));
+        set.add(sync, change);
+    }
+    async afterTransactionCommit(event) {
+        const levels = this.pendingSearch.get(event.queryRunner);
+        if (!levels)
+            return;
+        const depth = event.queryRunner.transactionDepth ?? 0;
+        if (event.queryRunner.isTransactionActive) {
+            // A savepoint was released: its changes now belong to the enclosing transaction.
+            let target = levels.get(depth);
+            if (!target)
+                levels.set(depth, (target = new SearchChangeSet()));
+            for (const [d, set] of levels) {
+                if (d > depth) {
+                    target.merge(set);
+                    levels.delete(d);
+                }
+            }
+            return;
+        }
+        this.pendingSearch.delete(event.queryRunner);
+        for (const d of [...levels.keys()].sort((a, b) => a - b))
+            await levels.get(d).apply(true);
+    }
+    afterTransactionRollback(event) {
+        const levels = this.pendingSearch.get(event.queryRunner);
+        if (!levels)
+            return;
+        if (!event.queryRunner.isTransactionActive)
+            return void this.pendingSearch.delete(event.queryRunner);
+        const depth = event.queryRunner.transactionDepth ?? 0;
+        for (const d of [...levels.keys()])
+            if (d > depth)
+                levels.delete(d);
+    }
+    searchDocument(sp, entity, id) {
+        return searchDocumentOf(entity, { id, fields: sp.fields, label: sp.label });
+    }
+    /** Encrypt `fields` of one entity (one batch, coalesced with other entities of the same save). */
+    async encryptEntity(plan, entity, id, fields) {
+        const items = [];
+        const targets = [];
+        for (const f of fields) {
+            const v = this.ledger.resolve(entity, f.prop, entity[f.prop]);
+            if (v === null) {
+                entity[f.prop] = null;
+                if (f.indexProp)
+                    entity[f.indexProp] = null;
+                continue;
+            }
+            const lb = `${plan.table}.${f.column}`;
+            const recordId = recordIdOf(id, lb);
+            items.push({ collection: plan.table, field: f.column, recordId, plaintext: plaintextOf(v, lb), normalization: f.normalization, label: `${lb} (${plan.pk}=${recordId})` });
+            targets.push({ f, plaintext: v });
+        }
+        const enc = await this.encrypt(items);
+        enc.forEach((e, i) => {
+            const { f, plaintext } = targets[i];
+            entity[f.prop] = e.ciphertext;
+            if (f.indexProp)
+                entity[f.indexProp] = e.index ?? null;
+            this.ledger.set(entity, f.prop, plaintext, e.ciphertext);
+        });
+    }
+    restore(entity) {
+        for (const [prop, e] of this.ledger.entries(entity))
+            if (entity[prop] === e.ciphertext)
+                entity[prop] = e.plaintext;
+        this.ledger.clear(entity);
+    }
+    async beforeInsert(event) {
+        const entity = event.entity;
+        const plan = entity && event.metadata ? planFor(event.metadata) : null;
+        if (!plan)
+            return;
+        const touched = plan.fields.filter((f) => entity[f.prop] !== undefined);
+        if (!touched.length)
+            return;
+        let id = entity[plan.pk];
+        if (id === undefined || id === null) {
+            if (plan.strategy === 'uuid')
+                entity[plan.pk] = id = globalThis.crypto.randomUUID();
+            else if (plan.strategy === 'two-phase') {
+                for (const f of touched) {
+                    const v = this.ledger.resolve(entity, f.prop, entity[f.prop]);
+                    if (f.indexProp)
+                        entity[f.indexProp] = null;
+                    if (v === null)
+                        continue;
+                    this.ledger.set(entity, f.prop, plaintextOf(v, `${plan.table}.${f.column}`), PENDING_SENTINEL);
+                    entity[f.prop] = PENDING_SENTINEL;
+                }
+                return;
+            }
+            else
+                throw requestError(`${plan.table}.${plan.pk} must be set before writing encrypted columns`);
+        }
+        await this.encryptEntity(plan, entity, id, touched);
+    }
+    async afterInsert(event) {
+        const entity = event.entity;
+        const plan = entity && event.metadata ? planFor(event.metadata) : null;
+        if (!plan)
+            return this.indexPlain(event);
+        const pending = plan.fields.filter((f) => this.ledger.get(entity, f.prop)?.ciphertext === PENDING_SENTINEL);
+        if (pending.length) {
+            // Two-phase write, step 2: bind to the generated id and replace the sentinel in the same transaction.
+            const id = entity[plan.pk] ?? event.entityId?.[plan.pk];
+            try {
+                if (id === undefined || id === null)
+                    throw new CipherError('PROTOCOL_ERROR', `${plan.table}: the generated id is not available after insert`);
+                await this.encryptEntity(plan, entity, id, pending);
+                const set = {};
+                const where = { [plan.pk]: id };
+                for (const f of pending) {
+                    set[f.prop] = entity[f.prop];
+                    if (f.indexProp)
+                        set[f.indexProp] = entity[f.indexProp];
+                    where[f.prop] = PENDING_SENTINEL;
+                }
+                const res = await event.queryRunner.manager
+                    .createQueryBuilder()
+                    .update(event.metadata.target)
+                    .set(set)
+                    .where(where)
+                    .callListeners(false)
+                    .updateEntity(false)
+                    .execute();
+                if (res.affected !== undefined && res.affected !== 1)
+                    throw new CipherError('PROTOCOL_ERROR', `${plan.table}: two-phase write could not find the pending row ${plan.pk}=${String(id)}`);
+            }
+            catch (e) {
+                // Fail closed: drop the sentinel row (save() also rolls its transaction back).
+                if (id !== undefined && id !== null) {
+                    await event.queryRunner.manager
+                        .createQueryBuilder()
+                        .delete()
+                        .from(event.metadata.target)
+                        .where({ [plan.pk]: id })
+                        .callListeners(false)
+                        .execute()
+                        .catch(() => undefined);
+                }
+                this.restore(entity);
+                throw e;
+            }
+        }
+        const sp = event.metadata ? this.searchPlanFor(event.metadata) : null;
+        const id = sp ? (entity[sp.pk] ?? event.entityId?.[sp.pk]) : undefined;
+        // Before restore(): encrypted properties still hold the ciphertext just written.
+        const doc = sp && id !== undefined && id !== null ? this.searchDocument(sp, entity, id) : undefined;
+        this.restore(entity);
+        if (sp && doc)
+            await this.queueSearch(event.queryRunner, sp.sync, { upsert: [doc] });
+    }
+    async beforeUpdate(event) {
+        const entity = event.entity;
+        const plan = entity && event.metadata ? planFor(event.metadata) : null;
+        if (!plan || !entity)
+            return;
+        const db = event.databaseEntity;
+        if (!db) {
+            // QueryBuilder/Repository.update(): the target rows (and so the record ids) are unknown here.
+            if (plan.fields.some((f) => entity[f.prop] !== undefined) || plan.fields.some((f) => f.indexProp && entity[f.indexProp] !== undefined)) {
+                throw requestError(`${plan.table}: update() cannot write encrypted columns (each row needs its own ciphertext); load the entity and save() it`);
+            }
+            return;
+        }
+        if (entity[plan.pk] !== undefined && entity[plan.pk] !== null && String(entity[plan.pk]) !== String(db[plan.pk])) {
+            throw requestError(`${plan.table}.${plan.pk}: changing the primary key would invalidate the record's ciphertext`);
+        }
+        const touched = plan.fields.filter((f) => {
+            const v = this.ledger.resolve(entity, f.prop, entity[f.prop]);
+            return v !== undefined && v !== db[f.prop];
+        });
+        if (!touched.length)
+            return;
+        await this.encryptEntity(plan, entity, db[plan.pk], touched);
+    }
+    async afterUpdate(event) {
+        const entity = event.entity;
+        if (!entity)
+            return;
+        const sp = event.metadata ? this.searchPlanFor(event.metadata) : null;
+        // Only full saves (the stored row is known): QueryBuilder updates do not say which rows changed.
+        const id = sp && event.databaseEntity ? event.databaseEntity[sp.pk] : undefined;
+        const touched = sp && id !== undefined && id !== null && event.updatedColumns.some((c) => sp.sync.fields.includes(c.propertyName));
+        const doc = touched ? this.searchDocument(sp, entity, id) : undefined;
+        this.restore(entity);
+        if (sp && doc)
+            await this.queueSearch(event.queryRunner, sp.sync, { upsert: [doc] });
+    }
+    async afterRemove(event) {
+        await this.unindex(event);
+    }
+    async afterSoftRemove(event) {
+        await this.unindex(event);
+    }
+    async unindex(event) {
+        const sp = event.metadata ? this.searchPlanFor(event.metadata) : null;
+        if (!sp)
+            return;
+        const id = event.entityId?.[sp.pk] ?? event.databaseEntity?.[sp.pk] ?? event.entity?.[sp.pk];
+        if (id !== undefined && id !== null)
+            await this.queueSearch(event.queryRunner, sp.sync, { delete: [recordIdOf(id, sp.label)] });
+    }
+    /** afterInsert of an entity without encrypted properties. */
+    async indexPlain(event) {
+        const sp = event.entity && event.metadata ? this.searchPlanFor(event.metadata) : null;
+        if (!sp)
+            return;
+        const id = event.entity[sp.pk] ?? event.entityId?.[sp.pk];
+        if (id !== undefined && id !== null)
+            await this.queueSearch(event.queryRunner, sp.sync, { upsert: [this.searchDocument(sp, event.entity, id)] });
+    }
+    afterLoad(entity, event) {
+        const metadata = event?.metadata;
+        const plan = metadata ? planFor(metadata) : null;
+        if (!plan)
+            return;
+        const opts = { purpose: this.options.purpose, readLegacyPlaintext: this.options.readLegacyPlaintext === true };
+        const jobs = [];
+        for (const f of plan.fields) {
+            const stored = entity[f.prop];
+            if (stored === undefined || stored === null)
+                continue;
+            const lb = `${plan.table}.${f.column}`;
+            const recordId = recordIdOf(entity[plan.pk], lb);
+            // One `cipher.decrypt` per value: the SDK coalesces every call made while TypeORM maps a result set into batch requests.
+            jobs.push(decryptOne(this.cipher, { collection: plan.table, field: f.column, recordId, stored, label: `${lb} (${plan.pk}=${recordId})` }, opts).then((p) => {
+                entity[f.prop] = p;
+            }));
+        }
+        if (jobs.length)
+            return Promise.all(jobs).then(() => undefined);
+    }
+}
+/** Subscriber class bound to `cipher`, for `new DataSource({ subscribers: [northstarCipherSubscriber(cipher)] })`. */
+export function northstarCipherSubscriber(cipher, options = {}) {
+    class BoundNorthstarCipherSubscriber extends NorthstarCipherSubscriber {
+        constructor() {
+            super(cipher, options);
+        }
+    }
+    // TypeORM only instantiates `subscribers` classes registered with @EventSubscriber(); the
+    // registration is inert until a DataSource lists this class.
+    EventSubscriber()(BoundNorthstarCipherSubscriber);
+    return BoundNorthstarCipherSubscriber;
+}
+/**
+ * Exact-match condition for a searchable encrypted property:
+ * `repo.findBy(await cipherWhere(ds, Todo, 'email', 'ana@example.com'))` → `{ email_bidx: In(tokens) }`.
+ */
+export async function cipherWhere(dataSource, entity, property, value) {
+    const sub = dataSource.subscribers.find((s) => s instanceof NorthstarCipherSubscriber);
+    if (!sub)
+        throw configError('TypeORM: register northstarCipherSubscriber(cipher) on the DataSource first');
+    const metadata = dataSource.getMetadata(entity);
+    const plan = planFor(metadata);
+    const f = plan?.byProp.get(property);
+    if (!plan || !f)
+        throw configError(`TypeORM: ${metadata.name}.${property} is not @Encrypted()`);
+    if (!f.indexProp)
+        throw configError(`TypeORM: ${metadata.name}.${property} is not searchable (@Encrypted({ searchable: … }))`);
+    const tokens = await searchTokensFor(sub.cipher, { collection: plan.table, field: f.column, normalization: f.normalization, values: value, keyId: sub.options.keyId, label: `${plan.table}.${f.column}` });
+    return { [f.indexProp]: In(tokens) };
+}
+/**
+ * Northstar Search documents for entities or rows of `entity`. Rows read without
+ * the subscriber's decryption (e.g. `ds.createQueryBuilder(Todo, 't').getRawMany()`
+ * mapped to property names, or a DataSource without the subscriber) hold stored
+ * ciphertext, sent with the context it is bound to and decrypted inside the
+ * enclave; decrypted entities send their plaintext.
+ */
+export function searchDocuments(dataSource, entity, rows, fields) {
+    const metadata = dataSource.getMetadata(entity);
+    const pk = primaryProp(metadata);
+    const plans = searchFieldPlans(metadata, fields);
+    return rows.map((row) => searchDocumentOf(row, { id: row[pk], fields: plans, label: metadata.tableName }));
+}
+/** True when a raw column value is Northstar ciphertext (useful in migrations and tests). */
+export { isCiphertext };
+export { CipherError };
+//# sourceMappingURL=typeorm.js.map

package/dist/integrations/typeorm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"typeorm.js","sourceRoot":"","sources":["../../src/integrations/typeorm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAIL,eAAe,EACf,EAAE,GAUH,MAAM,SAAS,CAAA;AAEhB,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAIL,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,eAAe,EAGf,iBAAiB,EACjB,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,eAAe,GAChB,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAKjE,8EAA8E;AAC9E,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4C,CAAA;AAErE;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,UAAiC,EAAE;IAC3D,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAA;IACzF,OAAO,CAAC,MAAc,EAAE,WAA4B,EAAE,EAAE;QACtD,IAAI,OAAO,WAAW,KAAK,QAAQ;YAAE,MAAM,WAAW,CAAC,oDAAoD,CAAC,CAAA;QAC5G,MAAM,IAAI,GAAI,MAAgC,CAAC,WAAW,CAAA;QAC1D,IAAI,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC3B,IAAI,CAAC,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAA;QAC5C,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAC7B,CAAC,CAAA;AACH,CAAC;AAiBD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,UAAU,EAAE,kBAAkB,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU;IACrH,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU;CACpH,CAAC,CAAA;AAEF,MAAM,KAAK,GAAG,IAAI,OAAO,EAA+B,CAAA;AAExD,SAAS,cAAc,CAAC,MAAe;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAiC,CAAA;IACpD,MAAM,KAAK,GAAW,EAAE,CAAA;IACxB,KAAK,IAAI,CAAC,GAAG,MAAqB,EAAE,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAgB;QAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACtJ,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACjF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,OAAO,CAAC,QAAwB;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAClC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAA;IACvC,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC7C,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACzB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;IAC1B,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,WAAW,CAAC,YAAY,IAAI,qEAAqE,CAAC,CAAA;IAClJ,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAE,CAAA;IACzC,MAAM,MAAM,GAAgB,EAAE,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,YAAY,IAAI,IAAI,IAAI,EAAE,CAAA;QACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAA;QACrD,IAAI,CAAC,GAAG;YAAE,MAAM,WAAW,CAAC,GAAG,EAAE,4CAA4C,CAAC,CAAA;QAC9E,IAAI,GAAG,KAAK,KAAK;YAAE,MAAM,WAAW,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAA;QAClF,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAA;QAClB,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAAE,MAAM,WAAW,CAAC,GAAG,EAAE,yCAAyC,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC5M,MAAM,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACxE,IAAI,SAA6B,CAAA;QACjC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YACjB,SAAS,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,IAAI,GAAG,YAAY,EAAE,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAA;YACzH,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC,SAAS,CAAC;gBAAE,MAAM,WAAW,CAAC,GAAG,EAAE,sDAAsD,IAAI,GAAG,YAAY,sCAAsC,CAAC,CAAA;QAC5M,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IACtJ,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAA;IACpE,MAAM,IAAI,GAAS;QACjB,KAAK,EAAE,QAAQ,CAAC,SAAS;QACzB,EAAE,EAAE,KAAK,CAAC,YAAY;QACtB,QAAQ,EAAE,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU;QAClE,MAAM;QACN,MAAM,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;KAChD,CAAA;IACD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACzB,OAAO,IAAI,CAAA;AACb,CAAC;AA0BD,+GAA+G;AAC/G,SAAS,gBAAgB,CAAC,QAAwB,EAAE,KAAe;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC,IAAI,CAAC;YAAE,MAAM,WAAW,CAAC,YAAY,QAAQ,CAAC,IAAI,IAAI,IAAI,iCAAiC,CAAC,CAAA;QACrI,MAAM,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAChC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,IAAK,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IAClG,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,QAAwB;IAC3C,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,WAAW,CAAC,YAAY,QAAQ,CAAC,IAAI,qDAAqD,CAAC,CAAA;IAC3I,OAAO,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAE,CAAC,YAAY,CAAA;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,yBAAyB;IAC3B,MAAM,CAAiB;IACvB,OAAO,CAAyB;IACxB,MAAM,GAAG,IAAI,eAAe,EAAU,CAAA;IACtC,OAAO,CAAqC;IAC5C,WAAW,GAAG,IAAI,OAAO,EAAqC,CAAA;IAC/E,4GAA4G;IAC3F,aAAa,GAAG,IAAI,OAAO,EAA6C,CAAA;IAEzF,YAAY,MAAuB,EAAE,UAAmC,EAAE;QACxE,IAAI,CAAC,MAAM,IAAI,OAAQ,MAA2C,CAAC,kBAAkB,KAAK,UAAU;YAAE,MAAM,WAAW,CAAC,sEAAsE,CAAC,CAAA;QAC/L,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QACjE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,WAAW,CAAC,6DAA6D,CAAC,CAAA;QACpJ,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACrC,mBAAmB,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAA;YACzC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,MAAM,WAAW,CAAC,wDAAwD,CAAC,CAAA;QAChK,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,QAAwB;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC7C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;QACjH,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1I,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACpC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,yEAAyE;IACjE,KAAK,CAAC,WAAW,CAAC,WAAoC,EAAE,IAAuB,EAAE,MAAwD;QAC/I,IAAI,CAAC,WAAW,EAAE,mBAAmB;YAAE,OAAO,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC7E,MAAM,KAAK,GAAI,WAAwD,CAAC,gBAAgB,IAAI,CAAC,CAAA;QAC7F,IAAI,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAChD,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAA;QACtE,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC3B,IAAI,CAAC,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACvB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAA6B;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QACxD,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,MAAM,KAAK,GAAI,KAAK,CAAC,WAAwD,CAAC,gBAAgB,IAAI,CAAC,CAAA;QACnG,IAAI,KAAK,CAAC,WAAW,CAAC,mBAAmB,EAAE,CAAC;YAC1C,iFAAiF;YACjF,IAAI,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAC9B,IAAI,CAAC,MAAM;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC,CAAC,CAAA;YAChE,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;gBAC9B,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;oBACd,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBACjB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBAClB,CAAC;YACH,CAAC;YACD,OAAM;QACR,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAC5C,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5F,CAAC;IAED,wBAAwB,CAAC,KAA+B;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QACxD,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,mBAAmB;YAAE,OAAO,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QACpG,MAAM,KAAK,GAAI,KAAK,CAAC,WAAwD,CAAC,gBAAgB,IAAI,CAAC,CAAA;QACnG,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAAE,IAAI,CAAC,GAAG,KAAK;gBAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACrE,CAAC;IAEO,cAAc,CAAC,EAAc,EAAE,MAAc,EAAE,EAAW;QAChE,OAAO,gBAAgB,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,CAAA;IAC7E,CAAC;IAED,kGAAkG;IAC1F,KAAK,CAAC,aAAa,CAAC,IAAU,EAAE,MAAc,EAAE,EAAW,EAAE,MAAmB;QACtF,MAAM,KAAK,GAAkB,EAAE,CAAA;QAC/B,MAAM,OAAO,GAA0C,EAAE,CAAA;QACzD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;YAC7D,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;gBACrB,IAAI,CAAC,CAAC,SAAS;oBAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAA;gBAC3C,SAAQ;YACV,CAAC;YACD,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAA;YACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;YACnC,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,QAAQ,GAAG,EAAE,CAAC,CAAA;YACzK,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAW,EAAE,CAAC,CAAA;QAC7C,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACrC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACnB,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,CAAC,CAAE,CAAA;YACpC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,CAAA;YAC7B,IAAI,CAAC,CAAC,SAAS;gBAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,CAAA;YACtD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;QAC1D,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,OAAO,CAAC,MAAc;QAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAA;QAClH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC3B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAA0B;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACtE,IAAI,CAAC,IAAI;YAAE,OAAM;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAA;QACvE,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAM;QAC3B,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACxB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAA;iBAC9E,IAAI,IAAI,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACvC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;oBAC7D,IAAI,CAAC,CAAC,SAAS;wBAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAA;oBAC3C,IAAI,CAAC,KAAK,IAAI;wBAAE,SAAQ;oBACxB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAA;oBAC9F,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAA;gBACnC,CAAC;gBACD,OAAM;YACR,CAAC;;gBAAM,MAAM,YAAY,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,+CAA+C,CAAC,CAAA;QACpG,CAAC;QACD,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;IACrD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA0B;QAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACtE,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,KAAK,gBAAgB,CAAC,CAAA;QAC3G,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,sGAAsG;YACtG,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAK,KAAK,CAAC,QAAgD,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAChG,IAAI,CAAC;gBACH,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI;oBAAE,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,GAAG,IAAI,CAAC,KAAK,kDAAkD,CAAC,CAAA;gBAC7I,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;gBACnD,MAAM,GAAG,GAA4B,EAAE,CAAA;gBACvC,MAAM,KAAK,GAA4B,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAA;gBACxD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;oBAC5B,IAAI,CAAC,CAAC,SAAS;wBAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;oBACvD,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAA;gBAClC,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO;qBACxC,kBAAkB,EAAE;qBACpB,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;qBAC7B,GAAG,CAAC,GAAG,CAAC;qBACR,KAAK,CAAC,KAAK,CAAC;qBACZ,aAAa,CAAC,KAAK,CAAC;qBACpB,YAAY,CAAC,KAAK,CAAC;qBACnB,OAAO,EAAE,CAAA;gBACZ,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC;oBAAE,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,GAAG,IAAI,CAAC,KAAK,oDAAoD,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;YACzL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,+EAA+E;gBAC/E,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;oBACpC,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO;yBAC5B,kBAAkB,EAAE;yBACpB,MAAM,EAAE;yBACR,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;yBAC3B,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;yBACxB,aAAa,CAAC,KAAK,CAAC;yBACpB,OAAO,EAAE;yBACT,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;gBAC3B,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;gBACpB,MAAM,CAAC,CAAA;YACT,CAAC;QACH,CAAC;QACD,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACrE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,IAAK,KAAK,CAAC,QAAgD,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/G,iFAAiF;QACjF,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACnG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACpB,IAAI,EAAE,IAAI,GAAG;YAAE,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACtF,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAA0B;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAA4B,CAAA;QACjD,MAAM,IAAI,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACtE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAM;QAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,cAAc,CAAA;QAC/B,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,8FAA8F;YAC9F,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;gBACvI,MAAM,YAAY,CAAC,GAAG,IAAI,CAAC,KAAK,8GAA8G,CAAC,CAAA;YACjJ,CAAC;YACD,OAAM;QACR,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACjH,MAAM,YAAY,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,qEAAqE,CAAC,CAAA;QACnH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACvC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;YAC7D,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC5C,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAM;QAC3B,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA0B;QAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,MAA4B,CAAA;QACjD,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACrE,iGAAiG;QACjG,MAAM,EAAE,GAAG,EAAE,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/E,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAA;QAClI,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,EAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACtE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACpB,IAAI,EAAE,IAAI,GAAG;YAAE,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACtF,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA0B;QAC1C,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC3B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAA8B;QAClD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC3B,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,KAAoD;QACxE,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACrE,IAAI,CAAC,EAAE;YAAE,OAAM;QACf,MAAM,EAAE,GAAI,KAAK,CAAC,QAAgD,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAK,KAAK,CAAC,MAA6B,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAC7J,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI;YAAE,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;IACjI,CAAC;IAED,6DAA6D;IACrD,KAAK,CAAC,UAAU,CAAC,KAA0B;QACjD,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACrF,IAAI,CAAC,EAAE;YAAE,OAAM;QACf,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,IAAK,KAAK,CAAC,QAAgD,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAClG,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI;YAAE,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;IAClJ,CAAC;IAED,SAAS,CAAC,MAAc,EAAE,KAAyB;QACjD,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,CAAA;QAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAChD,IAAI,CAAC,IAAI;YAAE,OAAM;QACjB,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAA;QAC9G,MAAM,IAAI,GAAoB,EAAE,CAAA;QAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YAC7B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;gBAAE,SAAQ;YACrD,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAA;YACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;YAChD,yHAAyH;YACzH,IAAI,CAAC,IAAI,CACP,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,QAAQ,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC/I,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACpB,CAAC,CAAC,CACH,CAAA;QACH,CAAC;QACD,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACjE,CAAC;CACF;AAED,sHAAsH;AACtH,MAAM,UAAU,yBAAyB,CAAC,MAAuB,EAAE,UAAmC,EAAE;IACtG,MAAM,8BAA+B,SAAQ,yBAAyB;QACpE;YACE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACxB,CAAC;KACF;IACD,0FAA0F;IAC1F,6DAA6D;IAC7D,eAAe,EAAE,CAAC,8BAA8B,CAAC,CAAA;IACjD,OAAO,8BAA8B,CAAA;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAsB,EAAE,MAAqB,EAAE,QAAgB,EAAE,KAAwB;IACzH,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAkC,EAAE,CAAC,CAAC,YAAY,yBAAyB,CAAC,CAAA;IACtH,IAAI,CAAC,GAAG;QAAE,MAAM,WAAW,CAAC,6EAA6E,CAAC,CAAA;IAC1G,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,MAAe,CAAC,CAAA;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9B,MAAM,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACpC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QAAE,MAAM,WAAW,CAAC,YAAY,QAAQ,CAAC,IAAI,IAAI,QAAQ,sBAAsB,CAAC,CAAA;IAC/F,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,MAAM,WAAW,CAAC,YAAY,QAAQ,CAAC,IAAI,IAAI,QAAQ,oDAAoD,CAAC,CAAA;IAC9H,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAC1M,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAA;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,UAAsB,EAAE,MAAqB,EAAE,IAAc,EAAE,MAAgB;IAC7G,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,MAAe,CAAC,CAAA;IACxD,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;IAChC,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAChD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;AAC5G,CAAC;AAED,6FAA6F;AAC7F,OAAO,EAAE,YAAY,EAAE,CAAA;AACvB,OAAO,EAAE,WAAW,EAAE,CAAA"}

package/dist/object.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Object encryption, format NSOB v1 (protocol §13): AES-256-GCM in blocks under
+ * a content key derived from a random per-object key and the object's context.
+ * Pure functions; `NorthstarCipher.encryptObject()` / `decryptObject()` generate
+ * the object key and protect it with Cipher.
+ *
+ * ```
+ * header      = "NSOB" ‖ 0x01 ‖ log2(B) ‖ 0^10 ‖ object_id (16)
+ * content_key = HKDF-SHA-256(object_key, salt = object_id, info = "northstar-cipher/v1/object" ‖ 0x00 ‖ ctx)
+ * block i     = AES-256-GCM(content_key, 0^4 ‖ u64(i), aad = header ‖ u64(i) ‖ u8(last))
+ * ```
+ */
+import { type CipherContext } from './client.js';
+import { CipherError } from './errors.js';
+/**
+ * Result of `NorthstarCipher.encryptObject()`. Store `wrappedKey` with the record
+ * (it is an ordinary `nsc:v1:` ciphertext) and `object` in object storage.
+ * `toString()` and `util.inspect` never show the wrapped key or the object bytes.
+ */
+export declare class EncryptedObject {
+    /** The object key encrypted by Cipher for the object's context (`nsc:v1:…`). */
+    readonly wrappedKey: string;
+    /** The NSOB v1 object. */
+    readonly object: Uint8Array;
+    readonly keyId: string;
+    readonly keyVersion: number;
+    constructor(wrappedKey: string, object: Uint8Array, keyId: string, keyVersion: number);
+    toString(): string;
+}
+/**
+ * Seal `plaintext` under `objectKey` (32 random bytes, never reused) for `context`.
+ * `objectId` is 16 random bytes; `blockLog2` is 12 … 24 (default 16, 64 KiB blocks).
+ */
+export declare function sealObject(objectKey: Uint8Array, objectId: Uint8Array, context: CipherContext, plaintext: Uint8Array | string, blockLog2?: number): Promise<Uint8Array>;
+/**
+ * Open an NSOB v1 object. Every block is authenticated before the plaintext is
+ * returned. Any failure is `INVALID_CIPHERTEXT` with one message.
+ */
+export declare function openObject(objectKey: Uint8Array, context: CipherContext, object: Uint8Array): Promise<Uint8Array>;
+/**
+ * The content key (32 bytes): HKDF-SHA-256(object_key, salt = object_id,
+ * info = "northstar-cipher/v1/object" ‖ 0x00 ‖ canonical context). For the vectors.
+ */
+export declare function objectContentKey(objectKey: Uint8Array, objectId: Uint8Array, context: CipherContext): Promise<Uint8Array>;
+/**
+ * Canonical context bytes (protocol §3.1): u32(count) ‖ for each (k, v) sorted by k: lp(k) ‖ lp(v).
+ * camelCase keys become snake_case and `undefined`/`null` values are dropped, as for every request.
+ */
+export declare function canonicalContext(context: CipherContext): Uint8Array;
+/** Size of the object for a plaintext of `length` bytes. */
+export declare function objectLength(length: number, blockLog2?: number): number;
+/** The single error for every failure to open an object (also a wrapped key that is not an object key). */
+export declare function invalidObject(): CipherError;