@opentdf/sdk 0.11.0 → 0.12.0-beta.112

package/dist/web/src/platform.js

@@ -91,15 +91,28 @@ function createAuthInterceptor(authProvider) {
         const url = new URL(req.url);
         const pathOnly = url.pathname;
         // Signs only the path of the url in the request
-        const token = await authProvider.withCreds({
-            url: pathOnly,
-            method: 'POST',
-            // Start with any headers Connect already has
-            headers: {
-                ...Object.fromEntries(req.header.entries()),
-                'Content-Type': 'application/json',
-            },
-        });
+        let token;
+        try {
+            token = await authProvider.withCreds({
+                url: pathOnly,
+                method: 'POST',
+                // Start with any headers Connect already has
+                headers: {
+                    ...Object.fromEntries(req.header.entries()),
+                    'Content-Type': 'application/json',
+                },
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (msg.includes('public key') || msg.includes('updateClientPublicKey')) {
+                throw new Error('PlatformClient: DPoP key binding is not complete. ' +
+                    'If you are using OpenTDF with PlatformClient, create OpenTDF first and ' +
+                    '`await client.ready` before constructing PlatformClient. ' +
+                    `Original error: ${msg}`);
+            }
+            throw err;
+        }
         Object.entries(token.headers).forEach(([key, value]) => {
             req.header.set(key, value);
         });
@@ -107,4 +120,4 @@ function createAuthInterceptor(authProvider) {
     };
     return authInterceptor;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGxhdGZvcm0uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvcGxhdGZvcm0udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0JBQStCO0FBQy9CLE9BQU8sS0FBSyxrQkFBa0IsTUFBTSx5QkFBeUIsQ0FBQztBQUM5RCxPQUFPLEtBQUssZUFBZSxNQUFNLHFCQUFxQixDQUFDO0FBRXZELE9BQU8sRUFBRSxzQkFBc0IsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBR2pFLE9BQU8sRUFBVSxZQUFZLEVBQWUsTUFBTSxxQkFBcUIsQ0FBQztBQUN4RSxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxpRUFBaUUsQ0FBQztBQUNuRyxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSw4Q0FBOEMsQ0FBQztBQUNwRixPQUFPLEVBQUUsb0JBQW9CLElBQUksc0JBQXNCLEVBQUUsTUFBTSxpREFBaUQsQ0FBQztBQUNqSCxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsTUFBTSxxREFBcUQsQ0FBQztBQUM5RixPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLHlDQUF5QyxDQUFDO0FBQ3hFLE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxNQUFNLCtDQUErQyxDQUFDO0FBQ2xGLE9BQU8sRUFBRSw4QkFBOEIsRUFBRSxNQUFNLGdFQUFnRSxDQUFDO0FBQ2hILE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxNQUFNLHNEQUFzRCxDQUFDO0FBQzVGLE9BQU8sRUFBRSxPQUFPLElBQUksaUJBQWlCLEVBQUUsTUFBTSxpREFBaUQsQ0FBQztBQUMvRixPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSwrQ0FBK0MsQ0FBQztBQUNqRixPQUFPLEVBQUUsMEJBQTBCLEVBQUUsTUFBTSxrRUFBa0UsQ0FBQztBQUM5RyxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsTUFBTSwwREFBMEQsQ0FBQztBQUNsRyxPQUFPLEVBQUUscUJBQXFCLEVBQUUsTUFBTSx3REFBd0QsQ0FBQztBQUMvRixPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0sdUNBQXVDLENBQUM7QUFnQ3RFOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQXVCRztBQUVILE1BQU0sT0FBTyxjQUFjO0lBSXpCLFlBQVksT0FBOEI7UUFDeEMsTUFBTSxZQUFZLEdBQWtCLEVBQUUsQ0FBQztRQUV2QyxJQUFJLE9BQU8sQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUN6QixNQUFNLGVBQWUsR0FBRyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLENBQUM7WUFDcEUsWUFBWSxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUNyQyxDQUFDO1FBRUQsSUFBSSxPQUFPLENBQUMsWUFBWSxFQUFFLE1BQU0sRUFBRSxDQUFDO1lBQ2pDLFlBQVksQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDN0MsQ0FBQztRQUVELE1BQU0sU0FBUyxHQUFHLHNCQUFzQixDQUFDO1lBQ3ZDLE9BQU8sRUFBRSxPQUFPLENBQUMsV0FBVztZQUM1QixZQUFZO1NBQ2IsQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLEVBQUUsR0FBRztZQUNSLGFBQWEsRUFBRSxZQUFZLENBQUMsb0JBQW9CLEVBQUUsU0FBUyxDQUFDO1lBQzVELGdCQUFnQixFQUFFLFlBQVksQ0FBQyx1QkFBdUIsRUFBRSxTQUFTLENBQUM7WUFDbEUsTUFBTSxFQUFFLFlBQVksQ0FBQyxhQUFhLEVBQUUsU0FBUyxDQUFDO1lBQzlDLE1BQU0sRUFBRSxZQUFZLENBQUMsYUFBYSxFQUFFLFNBQVMsQ0FBQztZQUM5QyxVQUFVLEVBQUUsWUFBWSxDQUFDLGlCQUFpQixFQUFFLFNBQVMsQ0FBQztZQUN0RCx1QkFBdUIsRUFBRSxZQUFZLENBQUMsOEJBQThCLEVBQUUsU0FBUyxDQUFDO1lBQ2hGLGFBQWEsRUFBRSxZQUFZLENBQUMsb0JBQW9CLEVBQUUsU0FBUyxDQUFDO1lBQzVELFNBQVMsRUFBRSxZQUFZLENBQUMsZ0JBQWdCLEVBQUUsU0FBUyxDQUFDO1lBQ3BELFVBQVUsRUFBRSxZQUFZLENBQUMsaUJBQWlCLEVBQUUsU0FBUyxDQUFDO1lBQ3RELG1CQUFtQixFQUFFLFlBQVksQ0FBQywwQkFBMEIsRUFBRSxTQUFTLENBQUM7WUFDeEUsZUFBZSxFQUFFLFlBQVksQ0FBQyxzQkFBc0IsRUFBRSxTQUFTLENBQUM7WUFDaEUsY0FBYyxFQUFFLFlBQVksQ0FBQyxxQkFBcUIsRUFBRSxTQUFTLENBQUM7WUFDOUQsTUFBTSxFQUFFLFlBQVksQ0FBQyxhQUFhLEVBQUUsU0FBUyxDQUFDO1lBQzlDLFNBQVMsRUFBRSxZQUFZLENBQUMsZ0JBQWdCLEVBQUUsU0FBUyxDQUFDO1NBQ3JELENBQUM7UUFFRixJQUFJLENBQUMsRUFBRSxHQUFHO1lBQ1IsYUFBYSxFQUFFLFlBQVksQ0FBQyxzQkFBc0IsRUFBRSxTQUFTLENBQUM7U0FDL0QsQ0FBQztJQUNKLENBQUM7Q0FDRjtBQUVEOzs7Ozs7OztHQVFHO0FBQ0gsU0FBUyxxQkFBcUIsQ0FBQyxZQUEwQjtJQUN2RCxNQUFNLGVBQWUsR0FBZ0IsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsRUFBRTtRQUMzRCxNQUFNLEdBQUcsR0FBRyxJQUFJLEdBQUcsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDN0IsTUFBTSxRQUFRLEdBQUcsR0FBRyxDQUFDLFFBQVEsQ0FBQztRQUM5QixnREFBZ0Q7UUFDaEQsTUFBTSxLQUFLLEdBQUcsTUFBTSxZQUFZLENBQUMsU0FBUyxDQUFDO1lBQ3pDLEdBQUcsRUFBRSxRQUFRO1lBQ2IsTUFBTSxFQUFFLE1BQU07WUFDZCw2Q0FBNkM7WUFDN0MsT0FBTyxFQUFFO2dCQUNQLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUMzQyxjQUFjLEVBQUUsa0JBQWtCO2FBQ25DO1NBQ0YsQ0FBQyxDQUFDO1FBRUgsTUFBTSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLEVBQUUsRUFBRTtZQUNyRCxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDN0IsQ0FBQyxDQUFDLENBQUM7UUFFSCxPQUFPLE1BQU0sSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3pCLENBQUMsQ0FBQztJQUNGLE9BQU8sZUFBZSxDQUFDO0FBQ3pCLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGxhdGZvcm0uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvcGxhdGZvcm0udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0JBQStCO0FBQy9CLE9BQU8sS0FBSyxrQkFBa0IsTUFBTSx5QkFBeUIsQ0FBQztBQUM5RCxPQUFPLEtBQUssZUFBZSxNQUFNLHFCQUFxQixDQUFDO0FBRXZELE9BQU8sRUFBRSxzQkFBc0IsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBR2pFLE9BQU8sRUFBVSxZQUFZLEVBQWUsTUFBTSxxQkFBcUIsQ0FBQztBQUN4RSxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxpRUFBaUUsQ0FBQztBQUNuRyxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSw4Q0FBOEMsQ0FBQztBQUNwRixPQUFPLEVBQUUsb0JBQW9CLElBQUksc0JBQXNCLEVBQUUsTUFBTSxpREFBaUQsQ0FBQztBQUNqSCxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsTUFBTSxxREFBcUQsQ0FBQztBQUM5RixPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLHlDQUF5QyxDQUFDO0FBQ3hFLE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxNQUFNLCtDQUErQyxDQUFDO0FBQ2xGLE9BQU8sRUFBRSw4QkFBOEIsRUFBRSxNQUFNLGdFQUFnRSxDQUFDO0FBQ2hILE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxNQUFNLHNEQUFzRCxDQUFDO0FBQzVGLE9BQU8sRUFBRSxPQUFPLElBQUksaUJBQWlCLEVBQUUsTUFBTSxpREFBaUQsQ0FBQztBQUMvRixPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSwrQ0FBK0MsQ0FBQztBQUNqRixPQUFPLEVBQUUsMEJBQTBCLEVBQUUsTUFBTSxrRUFBa0UsQ0FBQztBQUM5RyxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsTUFBTSwwREFBMEQsQ0FBQztBQUNsRyxPQUFPLEVBQUUscUJBQXFCLEVBQUUsTUFBTSx3REFBd0QsQ0FBQztBQUMvRixPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0sdUNBQXVDLENBQUM7QUFnQ3RFOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQXVCRztBQUVILE1BQU0sT0FBTyxjQUFjO0lBSXpCLFlBQVksT0FBOEI7UUFDeEMsTUFBTSxZQUFZLEdBQWtCLEVBQUUsQ0FBQztRQUV2QyxJQUFJLE9BQU8sQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUN6QixNQUFNLGVBQWUsR0FBRyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLENBQUM7WUFDcEUsWUFBWSxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUNyQyxDQUFDO1FBRUQsSUFBSSxPQUFPLENBQUMsWUFBWSxFQUFFLE1BQU0sRUFBRSxDQUFDO1lBQ2pDLFlBQVksQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDN0MsQ0FBQztRQUVELE1BQU0sU0FBUyxHQUFHLHNCQUFzQixDQUFDO1lBQ3ZDLE9BQU8sRUFBRSxPQUFPLENBQUMsV0FBVztZQUM1QixZQUFZO1NBQ2IsQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLEVBQUUsR0FBRztZQUNSLGFBQWEsRUFBRSxZQUFZLENBQUMsb0JBQW9CLEVBQUUsU0FBUyxDQUFDO1lBQzVELGdCQUFnQixFQUFFLFlBQVksQ0FBQyx1QkFBdUIsRUFBRSxTQUFTLENBQUM7WUFDbEUsTUFBTSxFQUFFLFlBQVksQ0FBQyxhQUFhLEVBQUUsU0FBUyxDQUFDO1lBQzlDLE1BQU0sRUFBRSxZQUFZLENBQUMsYUFBYSxFQUFFLFNBQVMsQ0FBQztZQUM5QyxVQUFVLEVBQUUsWUFBWSxDQUFDLGlCQUFpQixFQUFFLFNBQVMsQ0FBQztZQUN0RCx1QkFBdUIsRUFBRSxZQUFZLENBQUMsOEJBQThCLEVBQUUsU0FBUyxDQUFDO1lBQ2hGLGFBQWEsRUFBRSxZQUFZLENBQUMsb0JBQW9CLEVBQUUsU0FBUyxDQUFDO1lBQzVELFNBQVMsRUFBRSxZQUFZLENBQUMsZ0JBQWdCLEVBQUUsU0FBUyxDQUFDO1lBQ3BELFVBQVUsRUFBRSxZQUFZLENBQUMsaUJBQWlCLEVBQUUsU0FBUyxDQUFDO1lBQ3RELG1CQUFtQixFQUFFLFlBQVksQ0FBQywwQkFBMEIsRUFBRSxTQUFTLENBQUM7WUFDeEUsZUFBZSxFQUFFLFlBQVksQ0FBQyxzQkFBc0IsRUFBRSxTQUFTLENBQUM7WUFDaEUsY0FBYyxFQUFFLFlBQVksQ0FBQyxxQkFBcUIsRUFBRSxTQUFTLENBQUM7WUFDOUQsTUFBTSxFQUFFLFlBQVksQ0FBQyxhQUFhLEVBQUUsU0FBUyxDQUFDO1lBQzlDLFNBQVMsRUFBRSxZQUFZLENBQUMsZ0JBQWdCLEVBQUUsU0FBUyxDQUFDO1NBQ3JELENBQUM7UUFFRixJQUFJLENBQUMsRUFBRSxHQUFHO1lBQ1IsYUFBYSxFQUFFLFlBQVksQ0FBQyxzQkFBc0IsRUFBRSxTQUFTLENBQUM7U0FDL0QsQ0FBQztJQUNKLENBQUM7Q0FDRjtBQUVEOzs7Ozs7OztHQVFHO0FBQ0gsU0FBUyxxQkFBcUIsQ0FBQyxZQUEwQjtJQUN2RCxNQUFNLGVBQWUsR0FBZ0IsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsRUFBRTtRQUMzRCxNQUFNLEdBQUcsR0FBRyxJQUFJLEdBQUcsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDN0IsTUFBTSxRQUFRLEdBQUcsR0FBRyxDQUFDLFFBQVEsQ0FBQztRQUM5QixnREFBZ0Q7UUFDaEQsSUFBSSxLQUFLLENBQUM7UUFDVixJQUFJLENBQUM7WUFDSCxLQUFLLEdBQUcsTUFBTSxZQUFZLENBQUMsU0FBUyxDQUFDO2dCQUNuQyxHQUFHLEVBQUUsUUFBUTtnQkFDYixNQUFNLEVBQUUsTUFBTTtnQkFDZCw2Q0FBNkM7Z0JBQzdDLE9BQU8sRUFBRTtvQkFDUCxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztvQkFDM0MsY0FBYyxFQUFFLGtCQUFrQjtpQkFDbkM7YUFDRixDQUFDLENBQUM7UUFDTCxDQUFDO1FBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztZQUNiLE1BQU0sR0FBRyxHQUFHLEdBQUcsWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUM3RCxJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyx1QkFBdUIsQ0FBQyxFQUFFLENBQUM7Z0JBQ3hFLE1BQU0sSUFBSSxLQUFLLENBQ2Isb0RBQW9EO29CQUNsRCx5RUFBeUU7b0JBQ3pFLDJEQUEyRDtvQkFDM0QsbUJBQW1CLEdBQUcsRUFBRSxDQUMzQixDQUFDO1lBQ0osQ0FBQztZQUNELE1BQU0sR0FBRyxDQUFDO1FBQ1osQ0FBQztRQUVELE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUU7WUFDckQsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQzdCLENBQUMsQ0FBQyxDQUFDO1FBRUgsT0FBTyxNQUFNLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUN6QixDQUFDLENBQUM7SUFDRixPQUFPLGVBQWUsQ0FBQztBQUN6QixDQUFDIn0=

package/dist/web/src/version.js

@@ -1,7 +1,7 @@
 /**
  * Exposes the released version number of the `@opentdf/sdk` package
  */
-export const version = '0.11.0'; // x-release-please-version
+export const version = '0.12.0'; // x-release-please-version
 /**
  * A string name used to label requests as coming from this library client.
  */

package/dist/web/tdf3/src/crypto/core/ec.js

@@ -0,0 +1,84 @@
+import { ConfigurationError } from '../../../../src/errors.js';
+import { unwrapKey, wrapPrivateKey, wrapPublicKey, wrapSymmetricKey } from './keys.js';
+/**
+ * Map ECCurve to Web Crypto named curve.
+ */
+function curveToNamedCurve(curve) {
+    switch (curve) {
+        case 'P-256':
+            return 'P-256';
+        case 'P-384':
+            return 'P-384';
+        case 'P-521':
+            return 'P-521';
+        default:
+            throw new ConfigurationError(`Unsupported curve: ${curve}`);
+    }
+}
+/**
+ * Generate an EC key pair for ECDH key agreement.
+ */
+export async function generateECKeyPair(curve = 'P-256') {
+    const namedCurve = curveToNamedCurve(curve);
+    // Generate key pair for ECDH key agreement
+    const keyPair = await crypto.subtle.generateKey({ name: 'ECDH', namedCurve }, true, [
+        'deriveBits',
+    ]);
+    // Map to KeyAlgorithm literal type
+    let algorithm;
+    switch (namedCurve) {
+        case 'P-256':
+            algorithm = 'ec:secp256r1';
+            break;
+        case 'P-384':
+            algorithm = 'ec:secp384r1';
+            break;
+        case 'P-521':
+            algorithm = 'ec:secp521r1';
+            break;
+        default:
+            throw new ConfigurationError(`Unsupported curve: ${namedCurve}`);
+    }
+    return {
+        publicKey: wrapPublicKey(keyPair.publicKey, algorithm),
+        privateKey: wrapPrivateKey(keyPair.privateKey, algorithm),
+    };
+}
+/**
+ * Perform ECDH key agreement followed by HKDF key derivation.
+ * Returns opaque symmetric key for symmetric encryption.
+ */
+export async function deriveKeyFromECDH(privateKey, publicKey, hkdfParams) {
+    // Unwrap the internal CryptoKeys
+    const privateKeyCrypto = unwrapKey(privateKey);
+    const publicKeyCrypto = unwrapKey(publicKey);
+    // Get curve from key metadata
+    const curve = publicKey.curve;
+    if (!curve) {
+        throw new ConfigurationError('EC curve not found on public key');
+    }
+    // Determine bits based on curve
+    const curveBits = {
+        'P-256': 256,
+        'P-384': 384,
+        // P-521 derives 528 bits (66 bytes)
+        'P-521': 528,
+    };
+    const bits = curveBits[curve];
+    // Perform ECDH to get shared secret
+    const sharedSecret = await crypto.subtle.deriveBits({ name: 'ECDH', public: publicKeyCrypto }, privateKeyCrypto, bits);
+    // Import shared secret as HKDF key material
+    const hkdfKey = await crypto.subtle.importKey('raw', sharedSecret, 'HKDF', false, ['deriveKey']);
+    // Derive the final key using HKDF
+    const keyLength = hkdfParams.keyLength ?? 256;
+    const derivedKey = await crypto.subtle.deriveKey({
+        name: 'HKDF',
+        hash: hkdfParams.hash,
+        salt: hkdfParams.salt,
+        info: hkdfParams.info ?? new Uint8Array(0),
+    }, hkdfKey, { name: 'AES-GCM', length: keyLength }, true, ['encrypt', 'decrypt']);
+    // Export the derived key as raw bytes and wrap as SymmetricKey
+    const keyBytes = await crypto.subtle.exportKey('raw', derivedKey);
+    return wrapSymmetricKey(new Uint8Array(keyBytes));
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZWMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi90ZGYzL3NyYy9jcnlwdG8vY29yZS9lYy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFTQSxPQUFPLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSwyQkFBMkIsQ0FBQztBQUMvRCxPQUFPLEVBQUUsU0FBUyxFQUFFLGNBQWMsRUFBRSxhQUFhLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxXQUFXLENBQUM7QUFFdkY7O0dBRUc7QUFDSCxTQUFTLGlCQUFpQixDQUFDLEtBQWM7SUFDdkMsUUFBUSxLQUFLLEVBQUUsQ0FBQztRQUNkLEtBQUssT0FBTztZQUNWLE9BQU8sT0FBTyxDQUFDO1FBQ2pCLEtBQUssT0FBTztZQUNWLE9BQU8sT0FBTyxDQUFDO1FBQ2pCLEtBQUssT0FBTztZQUNWLE9BQU8sT0FBTyxDQUFDO1FBQ2pCO1lBQ0UsTUFBTSxJQUFJLGtCQUFrQixDQUFDLHNCQUFzQixLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ2hFLENBQUM7QUFDSCxDQUFDO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLGlCQUFpQixDQUFDLFFBQWlCLE9BQU87SUFDOUQsTUFBTSxVQUFVLEdBQUcsaUJBQWlCLENBQUMsS0FBSyxDQUFDLENBQUM7SUFFNUMsMkNBQTJDO0lBQzNDLE1BQU0sT0FBTyxHQUFHLE1BQU0sTUFBTSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxFQUFFLElBQUksRUFBRTtRQUNsRixZQUFZO0tBQ2IsQ0FBQyxDQUFDO0lBRUgsbUNBQW1DO0lBQ25DLElBQUksU0FBdUIsQ0FBQztJQUM1QixRQUFRLFVBQVUsRUFBRSxDQUFDO1FBQ25CLEtBQUssT0FBTztZQUNWLFNBQVMsR0FBRyxjQUFjLENBQUM7WUFDM0IsTUFBTTtRQUNSLEtBQUssT0FBTztZQUNWLFNBQVMsR0FBRyxjQUFjLENBQUM7WUFDM0IsTUFBTTtRQUNSLEtBQUssT0FBTztZQUNWLFNBQVMsR0FBRyxjQUFjLENBQUM7WUFDM0IsTUFBTTtRQUNSO1lBQ0UsTUFBTSxJQUFJLGtCQUFrQixDQUFDLHNCQUFzQixVQUFVLEVBQUUsQ0FBQyxDQUFDO0lBQ3JFLENBQUM7SUFFRCxPQUFPO1FBQ0wsU0FBUyxFQUFFLGFBQWEsQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLFNBQVMsQ0FBQztRQUN0RCxVQUFVLEVBQUUsY0FBYyxDQUFDLE9BQU8sQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDO0tBQzFELENBQUM7QUFDSixDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxpQkFBaUIsQ0FDckMsVUFBc0IsRUFDdEIsU0FBb0IsRUFDcEIsVUFBc0I7SUFFdEIsaUNBQWlDO0lBQ2pDLE1BQU0sZ0JBQWdCLEdBQUcsU0FBUyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQy9DLE1BQU0sZUFBZSxHQUFHLFNBQVMsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUU3Qyw4QkFBOEI7SUFDOUIsTUFBTSxLQUFLLEdBQUcsU0FBUyxDQUFDLEtBQUssQ0FBQztJQUM5QixJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDWCxNQUFNLElBQUksa0JBQWtCLENBQUMsa0NBQWtDLENBQUMsQ0FBQztJQUNuRSxDQUFDO0lBRUQsZ0NBQWdDO0lBQ2hDLE1BQU0sU0FBUyxHQUE0QjtRQUN6QyxPQUFPLEVBQUUsR0FBRztRQUNaLE9BQU8sRUFBRSxHQUFHO1FBQ1osb0NBQW9DO1FBQ3BDLE9BQU8sRUFBRSxHQUFHO0tBQ2IsQ0FBQztJQUNGLE1BQU0sSUFBSSxHQUFHLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUU5QixvQ0FBb0M7SUFDcEMsTUFBTSxZQUFZLEdBQUcsTUFBTSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FDakQsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxlQUFlLEVBQUUsRUFDekMsZ0JBQWdCLEVBQ2hCLElBQUksQ0FDTCxDQUFDO0lBRUYsNENBQTRDO0lBQzVDLE1BQU0sT0FBTyxHQUFHLE1BQU0sTUFBTSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsS0FBSyxFQUFFLFlBQVksRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQztJQUVqRyxrQ0FBa0M7SUFDbEMsTUFBTSxTQUFTLEdBQUcsVUFBVSxDQUFDLFNBQVMsSUFBSSxHQUFHLENBQUM7SUFDOUMsTUFBTSxVQUFVLEdBQUcsTUFBTSxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FDOUM7UUFDRSxJQUFJLEVBQUUsTUFBTTtRQUNaLElBQUksRUFBRSxVQUFVLENBQUMsSUFBSTtRQUNyQixJQUFJLEVBQUUsVUFBVSxDQUFDLElBQUk7UUFDckIsSUFBSSxFQUFFLFVBQVUsQ0FBQyxJQUFJLElBQUksSUFBSSxVQUFVLENBQUMsQ0FBQyxDQUFDO0tBQzNDLEVBQ0QsT0FBTyxFQUNQLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLEVBQ3RDLElBQUksRUFDSixDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FDdkIsQ0FBQztJQUVGLCtEQUErRDtJQUMvRCxNQUFNLFFBQVEsR0FBRyxNQUFNLE1BQU0sQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLEtBQUssRUFBRSxVQUFVLENBQUMsQ0FBQztJQUNsRSxPQUFPLGdCQUFnQixDQUFDLElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7QUFDcEQsQ0FBQyJ9

package/dist/web/tdf3/src/crypto/core/key-format.js

@@ -0,0 +1,348 @@
+import { MIN_ASYMMETRIC_KEY_SIZE_BITS, } from '../declarations.js';
+import { ConfigurationError } from '../../../../src/errors.js';
+import { formatAsPem, removePemFormatting } from '../crypto-utils.js';
+import { encodeArrayBuffer as hexEncode } from '../../../../src/encodings/hex.js';
+import { decodeArrayBuffer as base64Decode } from '../../../../src/encodings/base64.js';
+import { exportSPKI, importX509 } from 'jose';
+import { guessAlgorithmName, guessCurveName, toJwsAlg, } from '../../../../src/crypto/pemPublicToCrypto.js';
+import { unwrapKey, wrapPrivateKey, wrapPublicKey } from './keys.js';
+import { rsaOaepSha1 } from './rsa.js';
+/**
+ * Extract PEM public key from X.509 certificate or return PEM key as-is.
+ */
+export async function extractPublicKeyPem(certOrPem, jwaAlgorithm) {
+    // If it's a certificate, extract the public key
+    if (certOrPem.includes('-----BEGIN CERTIFICATE-----')) {
+        let alg = jwaAlgorithm;
+        if (!alg) {
+            // Auto-detect algorithm from certificate OIDs
+            const certBody = certOrPem.replace(/-----(BEGIN|END) CERTIFICATE-----|\s/g, '');
+            const certBytes = base64Decode(certBody);
+            const hex = hexEncode(certBytes);
+            alg = toJwsAlg(hex);
+        }
+        const cert = await importX509(certOrPem, alg, { extractable: true });
+        return exportSPKI(cert);
+    }
+    // If it's already a PEM public key, return as-is
+    if (certOrPem.includes('-----BEGIN PUBLIC KEY-----')) {
+        return certOrPem;
+    }
+    throw new ConfigurationError('Input must be a PEM-encoded certificate or public key');
+}
+const SUPPORTED_EC_CURVES = ['P-256', 'P-384', 'P-521'];
+/**
+ * Decode base64url string and return byte length.
+ * Uses the existing base64 decoder which handles both standard and URL-safe encoding.
+ */
+function base64urlByteLength(base64url) {
+    // Add padding if needed (base64url omits padding)
+    const padding = (4 - (base64url.length % 4)) % 4;
+    const padded = base64url + '='.repeat(padding);
+    return base64Decode(padded).byteLength;
+}
+/**
+ * Extract EC curve from a public key by parsing ASN.1 OIDs.
+ * Reuses the existing guessCurveName function that checks for curve OIDs.
+ */
+function extractEcCurveFromPublicKey(keyData) {
+    // Convert to hex for OID parsing
+    const hexKey = hexEncode(keyData);
+    // Use existing OID parser (returns 'P-256', 'P-384', or 'P-521')
+    const curveName = guessCurveName(hexKey);
+    return curveName;
+}
+/**
+ * Extract RSA modulus bit length by importing key and exporting as JWK.
+ * Uses Web Crypto's built-in ASN.1 parsing for robustness.
+ */
+async function extractRsaModulusBitLength(keyData) {
+    const key = await crypto.subtle.importKey('spki', keyData, { name: 'RSA-OAEP', hash: 'SHA-256' }, true, ['encrypt']);
+    const jwk = await crypto.subtle.exportKey('jwk', key);
+    if (!jwk.n) {
+        throw new ConfigurationError('Invalid RSA key: missing modulus');
+    }
+    // JWK 'n' is base64url-encoded modulus
+    // Decode and count bytes, multiply by 8 for bits
+    return base64urlByteLength(jwk.n) * 8;
+}
+/**
+ * Import and validate a PEM public key, returning algorithm info.
+ * Uses JWK export for robust key parameter detection.
+ */
+export async function parsePublicKeyPem(pem) {
+    // First extract public key if it's a certificate
+    let publicKeyPem = pem;
+    if (pem.includes('-----BEGIN CERTIFICATE-----')) {
+        publicKeyPem = await extractPublicKeyPem(pem);
+    }
+    if (!publicKeyPem.includes('-----BEGIN PUBLIC KEY-----')) {
+        throw new ConfigurationError('Input must be a PEM-encoded public key or certificate');
+    }
+    const keyData = base64Decode(removePemFormatting(publicKeyPem));
+    // Try RSA first - use JWK export to get modulus size
+    try {
+        const modulusBits = await extractRsaModulusBitLength(keyData);
+        let algorithm;
+        if (modulusBits < MIN_ASYMMETRIC_KEY_SIZE_BITS) {
+            throw new ConfigurationError(`RSA key size ${modulusBits} bits is below the minimum of ${MIN_ASYMMETRIC_KEY_SIZE_BITS} bits`);
+        }
+        else if (modulusBits <= 2048) {
+            algorithm = 'rsa:2048';
+        }
+        else if (modulusBits <= 4096) {
+            algorithm = 'rsa:4096';
+        }
+        else {
+            throw new ConfigurationError(`Unsupported RSA key size: ${modulusBits} bits`);
+        }
+        return { algorithm, pem: publicKeyPem };
+    }
+    catch (e) {
+        // If it's our own ConfigurationError, rethrow
+        if (e instanceof ConfigurationError) {
+            throw e;
+        }
+        // Not an RSA key, try EC next
+    }
+    // Try EC - parse curve from OID
+    try {
+        const detectedCurve = extractEcCurveFromPublicKey(keyData);
+        const curveMap = {
+            'P-256': 'ec:secp256r1',
+            'P-384': 'ec:secp384r1',
+            'P-521': 'ec:secp521r1',
+        };
+        return { algorithm: curveMap[detectedCurve], pem: publicKeyPem };
+    }
+    catch {
+        // Not a valid EC key
+    }
+    throw new ConfigurationError('Unable to determine public key algorithm - unsupported key type');
+}
+/**
+ * Convert a JWK (JSON Web Key) to PEM format.
+ */
+export async function jwkToPublicKeyPem(jwk) {
+    let key;
+    if (jwk.kty === 'RSA') {
+        // RSA key
+        key = await crypto.subtle.importKey('jwk', jwk, { name: 'RSA-OAEP', hash: 'SHA-256' }, true, [
+            'encrypt',
+        ]);
+    }
+    else if (jwk.kty === 'EC') {
+        // EC key
+        const crv = jwk.crv;
+        if (!crv || !['P-256', 'P-384', 'P-521'].includes(crv)) {
+            throw new ConfigurationError(`Unsupported EC curve: ${crv}`);
+        }
+        key = await crypto.subtle.importKey('jwk', jwk, { name: 'ECDH', namedCurve: crv }, true, []);
+    }
+    else {
+        throw new ConfigurationError(`Unsupported JWK key type: ${jwk.kty}`);
+    }
+    const spkiBuffer = await crypto.subtle.exportKey('spki', key);
+    return formatAsPem(spkiBuffer, 'PUBLIC KEY');
+}
+/**
+ * Convert a PEM public key to JWK format.
+ * Returns only public key components (no private key data).
+ */
+export async function publicKeyPemToJwk(publicKeyPem) {
+    const keyDataBase64 = removePemFormatting(publicKeyPem);
+    const keyBuffer = base64Decode(keyDataBase64);
+    const hex = hexEncode(keyBuffer);
+    // Detect key type using OID
+    const algorithmName = guessAlgorithmName(hex);
+    if (algorithmName === 'ECDH' || algorithmName === 'ECDSA') {
+        // EC key - detect curve from OID
+        const namedCurve = guessCurveName(hex);
+        const key = await crypto.subtle.importKey('spki', keyBuffer, { name: 'ECDSA', namedCurve }, true, ['verify']);
+        const jwk = await crypto.subtle.exportKey('jwk', key);
+        // Return only public key components
+        const { kty, crv, x, y } = jwk;
+        return { kty, crv, x, y };
+    }
+    else {
+        // RSA key
+        const key = await crypto.subtle.importKey('spki', keyBuffer, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, true, ['verify']);
+        const jwk = await crypto.subtle.exportKey('jwk', key);
+        // Return only public key components
+        const { kty, e, n } = jwk;
+        return { kty, e, n };
+    }
+}
+/**
+ * Import a PEM public key as an opaque key.
+ */
+export async function importPublicKey(pem, options) {
+    const { usage = 'encrypt', extractable = true, algorithmHint } = options;
+    // Detect algorithm from PEM; also normalises certificates → plain SPKI PEM.
+    const keyInfo = await parsePublicKeyPem(pem);
+    const algorithm = algorithmHint || keyInfo.algorithm;
+    // Use keyInfo.pem (normalised SPKI) not the original pem, which may be a certificate.
+    // Passing raw X.509 DER bytes to crypto.subtle.importKey('spki') would throw DataError.
+    const keyData = removePemFormatting(keyInfo.pem);
+    const keyBuffer = base64Decode(keyData);
+    // Determine Web Crypto algorithm and usages based on key type and usage
+    let cryptoAlgorithm;
+    let keyUsages;
+    if (algorithm.startsWith('rsa:')) {
+        if (usage === 'encrypt') {
+            cryptoAlgorithm = rsaOaepSha1();
+            keyUsages = ['encrypt'];
+        }
+        else if (usage === 'sign') {
+            cryptoAlgorithm = { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' };
+            keyUsages = ['verify'];
+        }
+        else {
+            throw new ConfigurationError('RSA keys only support usage: encrypt or sign');
+        }
+    }
+    else if (algorithm.startsWith('ec:')) {
+        const curve = algorithm.split(':')[1];
+        const namedCurve = curve === 'secp256r1'
+            ? 'P-256'
+            : curve === 'secp384r1'
+                ? 'P-384'
+                : curve === 'secp521r1'
+                    ? 'P-521'
+                    : (() => {
+                        throw new ConfigurationError(`Unsupported EC curve: ${curve}`);
+                    })();
+        if (usage === 'derive') {
+            cryptoAlgorithm = { name: 'ECDH', namedCurve };
+            keyUsages = [];
+        }
+        else if (usage === 'sign') {
+            cryptoAlgorithm = { name: 'ECDSA', namedCurve };
+            keyUsages = ['verify'];
+        }
+        else {
+            throw new ConfigurationError('EC keys only support usage: derive or sign');
+        }
+    }
+    else {
+        throw new ConfigurationError(`Unsupported algorithm: ${algorithm}`);
+    }
+    // Import as CryptoKey
+    const cryptoKey = await crypto.subtle.importKey('spki', keyBuffer, cryptoAlgorithm, extractable, keyUsages);
+    return wrapPublicKey(cryptoKey, algorithm);
+}
+/**
+ * Import a PEM private key as an opaque key.
+ */
+export async function importPrivateKey(pem, options) {
+    const { usage = 'encrypt', extractable = true, algorithmHint } = options;
+    // Detect algorithm from PEM structure (similar to public key detection)
+    // For now, use algorithmHint if provided, otherwise detect from key structure
+    let algorithm;
+    const keyData = removePemFormatting(pem);
+    const keyBuffer = base64Decode(keyData);
+    if (algorithmHint) {
+        algorithm = algorithmHint;
+    }
+    else {
+        // PKCS#8 PrivateKeyInfo embeds the same AlgorithmIdentifier OIDs as SPKI,
+        // so guessAlgorithmName / guessCurveName work on private key bytes too.
+        const hex = hexEncode(keyBuffer);
+        const algorithmName = guessAlgorithmName(hex); // throws on unrecognised OID
+        if (algorithmName === 'ECDH' || algorithmName === 'ECDSA') {
+            const namedCurve = guessCurveName(hex);
+            const curveMap = {
+                'P-256': 'ec:secp256r1',
+                'P-384': 'ec:secp384r1',
+                'P-521': 'ec:secp521r1',
+            };
+            const mapped = curveMap[namedCurve];
+            if (!mapped)
+                throw new ConfigurationError(`Unsupported EC curve in private key: ${namedCurve}`);
+            algorithm = mapped;
+        }
+        else {
+            // RSA — determine key size by importing and reading modulus length from JWK
+            const tempKey = await crypto.subtle.importKey('pkcs8', keyBuffer, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, true, ['sign']);
+            const jwk = await crypto.subtle.exportKey('jwk', tempKey);
+            if (!jwk.n) {
+                throw new ConfigurationError('Invalid RSA private key: missing modulus');
+            }
+            const modulusBits = base64urlByteLength(jwk.n) * 8;
+            if (modulusBits < MIN_ASYMMETRIC_KEY_SIZE_BITS) {
+                throw new ConfigurationError(`RSA key size ${modulusBits} bits is below the minimum of ${MIN_ASYMMETRIC_KEY_SIZE_BITS} bits`);
+            }
+            algorithm = modulusBits <= 2048 ? 'rsa:2048' : 'rsa:4096';
+        }
+    }
+    // Determine Web Crypto algorithm and usages
+    let cryptoAlgorithm;
+    let keyUsages;
+    if (algorithm.startsWith('rsa:')) {
+        if (usage === 'encrypt') {
+            cryptoAlgorithm = rsaOaepSha1();
+            keyUsages = ['decrypt'];
+        }
+        else if (usage === 'sign') {
+            cryptoAlgorithm = { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' };
+            keyUsages = ['sign'];
+        }
+        else {
+            throw new ConfigurationError('RSA keys only support usage: encrypt or sign');
+        }
+    }
+    else if (algorithm.startsWith('ec:')) {
+        const curve = algorithm.split(':')[1];
+        const namedCurve = curve === 'secp256r1'
+            ? 'P-256'
+            : curve === 'secp384r1'
+                ? 'P-384'
+                : curve === 'secp521r1'
+                    ? 'P-521'
+                    : (() => {
+                        throw new ConfigurationError(`Unsupported EC curve: ${curve}`);
+                    })();
+        if (usage === 'derive') {
+            cryptoAlgorithm = { name: 'ECDH', namedCurve };
+            keyUsages = ['deriveBits'];
+        }
+        else if (usage === 'sign') {
+            cryptoAlgorithm = { name: 'ECDSA', namedCurve };
+            keyUsages = ['sign'];
+        }
+        else {
+            throw new ConfigurationError('EC keys only support usage: derive or sign');
+        }
+    }
+    else {
+        throw new ConfigurationError(`Unsupported algorithm: ${algorithm}`);
+    }
+    // Import as CryptoKey
+    const cryptoKey = await crypto.subtle.importKey('pkcs8', keyBuffer, cryptoAlgorithm, extractable, keyUsages);
+    return wrapPrivateKey(cryptoKey, algorithm);
+}
+/**
+ * Export an opaque public key to PEM format.
+ */
+export async function exportPublicKeyPem(key) {
+    const cryptoKey = unwrapKey(key);
+    const keyBuffer = await crypto.subtle.exportKey('spki', cryptoKey);
+    return formatAsPem(keyBuffer, 'PUBLIC KEY');
+}
+/**
+ * Export an opaque private key to PEM format.
+ * ONLY USE FOR TESTING/DEVELOPMENT. Private keys should NOT be exportable in secure environments.
+ */
+export async function exportPrivateKeyPem(key) {
+    const cryptoKey = unwrapKey(key);
+    const keyBuffer = await crypto.subtle.exportKey('pkcs8', cryptoKey);
+    return formatAsPem(keyBuffer, 'PRIVATE KEY');
+}
+/**
+ * Export an opaque public key to JWK format.
+ */
+export async function exportPublicKeyJwk(key) {
+    const cryptoKey = unwrapKey(key);
+    return await crypto.subtle.exportKey('jwk', cryptoKey);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia2V5LWZvcm1hdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uLy4uL3RkZjMvc3JjL2NyeXB0by9jb3JlL2tleS1mb3JtYXQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUdMLDRCQUE0QixHQUk3QixNQUFNLG9CQUFvQixDQUFDO0FBQzVCLE9BQU8sRUFBRSxrQkFBa0IsRUFBRSxNQUFNLDJCQUEyQixDQUFDO0FBQy9ELE9BQU8sRUFBRSxXQUFXLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUN0RSxPQUFPLEVBQUUsaUJBQWlCLElBQUksU0FBUyxFQUFFLE1BQU0sa0NBQWtDLENBQUM7QUFDbEYsT0FBTyxFQUFFLGlCQUFpQixJQUFJLFlBQVksRUFBRSxNQUFNLHFDQUFxQyxDQUFDO0FBQ3hGLE9BQU8sRUFBRSxVQUFVLEVBQUUsVUFBVSxFQUFFLE1BQU0sTUFBTSxDQUFDO0FBQzlDLE9BQU8sRUFDTCxrQkFBa0IsRUFDbEIsY0FBYyxFQUNkLFFBQVEsR0FDVCxNQUFNLDZDQUE2QyxDQUFDO0FBQ3JELE9BQU8sRUFBRSxTQUFTLEVBQUUsY0FBYyxFQUFFLGFBQWEsRUFBRSxNQUFNLFdBQVcsQ0FBQztBQUNyRSxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sVUFBVSxDQUFDO0FBRXZDOztHQUVHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxtQkFBbUIsQ0FDdkMsU0FBaUIsRUFDakIsWUFBcUI7SUFFckIsZ0RBQWdEO0lBQ2hELElBQUksU0FBUyxDQUFDLFFBQVEsQ0FBQyw2QkFBNkIsQ0FBQyxFQUFFLENBQUM7UUFDdEQsSUFBSSxHQUFHLEdBQUcsWUFBWSxDQUFDO1FBQ3ZCLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUNULDhDQUE4QztZQUM5QyxNQUFNLFFBQVEsR0FBRyxTQUFTLENBQUMsT0FBTyxDQUFDLHVDQUF1QyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1lBQ2hGLE1BQU0sU0FBUyxHQUFHLFlBQVksQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUN6QyxNQUFNLEdBQUcsR0FBRyxTQUFTLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDakMsR0FBRyxHQUFHLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUN0QixDQUFDO1FBQ0QsTUFBTSxJQUFJLEdBQUcsTUFBTSxVQUFVLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxFQUFFLFdBQVcsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ3JFLE9BQU8sVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzFCLENBQUM7SUFFRCxpREFBaUQ7SUFDakQsSUFBSSxTQUFTLENBQUMsUUFBUSxDQUFDLDRCQUE0QixDQUFDLEVBQUUsQ0FBQztRQUNyRCxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBRUQsTUFBTSxJQUFJLGtCQUFrQixDQUFDLHVEQUF1RCxDQUFDLENBQUM7QUFDeEYsQ0FBQztBQUVELE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFLE9BQU8sQ0FBVSxDQUFDO0FBR2pFOzs7R0FHRztBQUNILFNBQVMsbUJBQW1CLENBQUMsU0FBaUI7SUFDNUMsa0RBQWtEO0lBQ2xELE1BQU0sT0FBTyxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNqRCxNQUFNLE1BQU0sR0FBRyxTQUFTLEdBQUcsR0FBRyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUMvQyxPQUFPLFlBQVksQ0FBQyxNQUFNLENBQUMsQ0FBQyxVQUFVLENBQUM7QUFDekMsQ0FBQztBQUVEOzs7R0FHRztBQUNILFNBQVMsMkJBQTJCLENBQUMsT0FBb0I7SUFDdkQsaUNBQWlDO0lBQ2pDLE1BQU0sTUFBTSxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUNsQyxpRUFBaUU7SUFDakUsTUFBTSxTQUFTLEdBQUcsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3pDLE9BQU8sU0FBNkIsQ0FBQztBQUN2QyxDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsS0FBSyxVQUFVLDBCQUEwQixDQUFDLE9BQW9CO0lBQzVELE1BQU0sR0FBRyxHQUFHLE1BQU0sTUFBTSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQ3ZDLE1BQU0sRUFDTixPQUFPLEVBQ1AsRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsRUFDckMsSUFBSSxFQUNKLENBQUMsU0FBUyxDQUFDLENBQ1osQ0FBQztJQUNGLE1BQU0sR0FBRyxHQUFHLE1BQU0sTUFBTSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxDQUFDO0lBQ3RELElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDWCxNQUFNLElBQUksa0JBQWtCLENBQUMsa0NBQWtDLENBQUMsQ0FBQztJQUNuRSxDQUFDO0lBQ0QsdUNBQXVDO0lBQ3ZDLGlEQUFpRDtJQUNqRCxPQUFPLG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUM7QUFDeEMsQ0FBQztBQUVEOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsaUJBQWlCLENBQUMsR0FBVztJQUNqRCxpREFBaUQ7SUFDakQsSUFBSSxZQUFZLEdBQUcsR0FBRyxDQUFDO0lBQ3ZCLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyw2QkFBNkIsQ0FBQyxFQUFFLENBQUM7UUFDaEQsWUFBWSxHQUFHLE1BQU0sbUJBQW1CLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUVELElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLDRCQUE0QixDQUFDLEVBQUUsQ0FBQztRQUN6RCxNQUFNLElBQUksa0JBQWtCLENBQUMsdURBQXVELENBQUMsQ0FBQztJQUN4RixDQUFDO0lBRUQsTUFBTSxPQUFPLEdBQUcsWUFBWSxDQUFDLG1CQUFtQixDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFFaEUscURBQXFEO0lBQ3JELElBQUksQ0FBQztRQUNILE1BQU0sV0FBVyxHQUFHLE1BQU0sMEJBQTBCLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDOUQsSUFBSSxTQUFxQyxDQUFDO1FBQzFDLElBQUksV0FBVyxHQUFHLDRCQUE0QixFQUFFLENBQUM7WUFDL0MsTUFBTSxJQUFJLGtCQUFrQixDQUMxQixnQkFBZ0IsV0FBVyxpQ0FBaUMsNEJBQTRCLE9BQU8sQ0FDaEcsQ0FBQztRQUNKLENBQUM7YUFBTSxJQUFJLFdBQVcsSUFBSSxJQUFJLEVBQUUsQ0FBQztZQUMvQixTQUFTLEdBQUcsVUFBVSxDQUFDO1FBQ3pCLENBQUM7YUFBTSxJQUFJLFdBQVcsSUFBSSxJQUFJLEVBQUUsQ0FBQztZQUMvQixTQUFTLEdBQUcsVUFBVSxDQUFDO1FBQ3pCLENBQUM7YUFBTSxDQUFDO1lBQ04sTUFBTSxJQUFJLGtCQUFrQixDQUFDLDZCQUE2QixXQUFXLE9BQU8sQ0FBQyxDQUFDO1FBQ2hGLENBQUM7UUFDRCxPQUFPLEVBQUUsU0FBUyxFQUFFLEdBQUcsRUFBRSxZQUFZLEVBQUUsQ0FBQztJQUMxQyxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNYLDhDQUE4QztRQUM5QyxJQUFJLENBQUMsWUFBWSxrQkFBa0IsRUFBRSxDQUFDO1lBQ3BDLE1BQU0sQ0FBQyxDQUFDO1FBQ1YsQ0FBQztRQUNELDhCQUE4QjtJQUNoQyxDQUFDO0lBRUQsZ0NBQWdDO0lBQ2hDLElBQUksQ0FBQztRQUNILE1BQU0sYUFBYSxHQUFHLDJCQUEyQixDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzNELE1BQU0sUUFBUSxHQUFHO1lBQ2YsT0FBTyxFQUFFLGNBQWM7WUFDdkIsT0FBTyxFQUFFLGNBQWM7WUFDdkIsT0FBTyxFQUFFLGNBQWM7U0FDZixDQUFDO1FBQ1gsT0FBTyxFQUFFLFNBQVMsRUFBRSxRQUFRLENBQUMsYUFBYSxDQUFDLEVBQUUsR0FBRyxFQUFFLFlBQVksRUFBRSxDQUFDO0lBQ25FLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxxQkFBcUI7SUFDdkIsQ0FBQztJQUVELE1BQU0sSUFBSSxrQkFBa0IsQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0FBQ2xHLENBQUM7QUFFRDs7R0FFRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsaUJBQWlCLENBQUMsR0FBZTtJQUNyRCxJQUFJLEdBQWMsQ0FBQztJQUVuQixJQUFJLEdBQUcsQ0FBQyxHQUFHLEtBQUssS0FBSyxFQUFFLENBQUM7UUFDdEIsVUFBVTtRQUNWLEdBQUcsR0FBRyxNQUFNLE1BQU0sQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsRUFBRSxJQUFJLEVBQUU7WUFDM0YsU0FBUztTQUNWLENBQUMsQ0FBQztJQUNMLENBQUM7U0FBTSxJQUFJLEdBQUcsQ0FBQyxHQUFHLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDNUIsU0FBUztRQUNULE1BQU0sR0FBRyxHQUFHLEdBQUcsQ0FBQyxHQUFHLENBQUM7UUFDcEIsSUFBSSxDQUFDLEdBQUcsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN2RCxNQUFNLElBQUksa0JBQWtCLENBQUMseUJBQXlCLEdBQUcsRUFBRSxDQUFDLENBQUM7UUFDL0QsQ0FBQztRQUNELEdBQUcsR0FBRyxNQUFNLE1BQU0sQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxHQUFHLEVBQUUsRUFBRSxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDL0YsQ0FBQztTQUFNLENBQUM7UUFDTixNQUFNLElBQUksa0JBQWtCLENBQUMsNkJBQTZCLEdBQUcsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFFRCxNQUFNLFVBQVUsR0FBRyxNQUFNLE1BQU0sQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxHQUFHLENBQUMsQ0FBQztJQUM5RCxPQUFPLFdBQVcsQ0FBQyxVQUFVLEVBQUUsWUFBWSxDQUFDLENBQUM7QUFDL0MsQ0FBQztBQUVEOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsaUJBQWlCLENBQUMsWUFBb0I7SUFDMUQsTUFBTSxhQUFhLEdBQUcsbUJBQW1CLENBQUMsWUFBWSxDQUFDLENBQUM7SUFDeEQsTUFBTSxTQUFTLEdBQUcsWUFBWSxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQzlDLE1BQU0sR0FBRyxHQUFHLFNBQVMsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUVqQyw0QkFBNEI7SUFDNUIsTUFBTSxhQUFhLEdBQUcsa0JBQWtCLENBQUMsR0FBRyxDQUFDLENBQUM7SUFFOUMsSUFBSSxhQUFhLEtBQUssTUFBTSxJQUFJLGFBQWEsS0FBSyxPQUFPLEVBQUUsQ0FBQztRQUMxRCxpQ0FBaUM7UUFDakMsTUFBTSxVQUFVLEdBQUcsY0FBYyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3ZDLE1BQU0sR0FBRyxHQUFHLE1BQU0sTUFBTSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQ3ZDLE1BQU0sRUFDTixTQUFTLEVBQ1QsRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxFQUM3QixJQUFJLEVBQ0osQ0FBQyxRQUFRLENBQUMsQ0FDWCxDQUFDO1FBQ0YsTUFBTSxHQUFHLEdBQUcsTUFBTSxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDdEQsb0NBQW9DO1FBQ3BDLE1BQU0sRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLENBQUMsRUFBRSxDQUFDLEVBQUUsR0FBRyxHQUFHLENBQUM7UUFDL0IsT0FBTyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDO0lBQzVCLENBQUM7U0FBTSxDQUFDO1FBQ04sVUFBVTtRQUNWLE1BQU0sR0FBRyxHQUFHLE1BQU0sTUFBTSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQ3ZDLE1BQU0sRUFDTixTQUFTLEVBQ1QsRUFBRSxJQUFJLEVBQUUsbUJBQW1CLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxFQUM5QyxJQUFJLEVBQ0osQ0FBQyxRQUFRLENBQUMsQ0FDWCxDQUFDO1FBQ0YsTUFBTSxHQUFHLEdBQUcsTUFBTSxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDdEQsb0NBQW9DO1FBQ3BDLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxHQUFHLEdBQUcsQ0FBQztRQUMxQixPQUFPLEVBQUUsR0FBRyxFQUFFLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQztJQUN2QixDQUFDO0FBQ0gsQ0FBQztBQUVEOztHQUVHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxlQUFlLENBQUMsR0FBVyxFQUFFLE9BQW1CO0lBQ3BFLE1BQU0sRUFBRSxLQUFLLEdBQUcsU0FBUyxFQUFFLFdBQVcsR0FBRyxJQUFJLEVBQUUsYUFBYSxFQUFFLEdBQUcsT0FBTyxDQUFDO0lBRXpFLDRFQUE0RTtJQUM1RSxNQUFNLE9BQU8sR0FBRyxNQUFNLGlCQUFpQixDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQzdDLE1BQU0sU0FBUyxHQUFHLGFBQWEsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDO0lBQ3JELHNGQUFzRjtJQUN0Rix3RkFBd0Y7SUFDeEYsTUFBTSxPQUFPLEdBQUcsbUJBQW1CLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ2pELE1BQU0sU0FBUyxHQUFHLFlBQVksQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUV4Qyx3RUFBd0U7SUFDeEUsSUFBSSxlQUEwRCxDQUFDO0lBQy9ELElBQUksU0FBcUIsQ0FBQztJQUUxQixJQUFJLFNBQVMsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUNqQyxJQUFJLEtBQUssS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN4QixlQUFlLEdBQUcsV0FBVyxFQUFFLENBQUM7WUFDaEMsU0FBUyxHQUFHLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDMUIsQ0FBQzthQUFNLElBQUksS0FBSyxLQUFLLE1BQU0sRUFBRSxDQUFDO1lBQzVCLGVBQWUsR0FBRyxFQUFFLElBQUksRUFBRSxtQkFBbUIsRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLENBQUM7WUFDakUsU0FBUyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDekIsQ0FBQzthQUFNLENBQUM7WUFDTixNQUFNLElBQUksa0JBQWtCLENBQUMsOENBQThDLENBQUMsQ0FBQztRQUMvRSxDQUFDO0lBQ0gsQ0FBQztTQUFNLElBQUksU0FBUyxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sS0FBSyxHQUFHLFNBQVMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDdEMsTUFBTSxVQUFVLEdBQ2QsS0FBSyxLQUFLLFdBQVc7WUFDbkIsQ0FBQyxDQUFDLE9BQU87WUFDVCxDQUFDLENBQUMsS0FBSyxLQUFLLFdBQVc7Z0JBQ3JCLENBQUMsQ0FBQyxPQUFPO2dCQUNULENBQUMsQ0FBQyxLQUFLLEtBQUssV0FBVztvQkFDckIsQ0FBQyxDQUFDLE9BQU87b0JBQ1QsQ0FBQyxDQUFDLENBQUMsR0FBRyxFQUFFO3dCQUNKLE1BQU0sSUFBSSxrQkFBa0IsQ0FBQyx5QkFBeUIsS0FBSyxFQUFFLENBQUMsQ0FBQztvQkFDakUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUVmLElBQUksS0FBSyxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ3ZCLGVBQWUsR0FBRyxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLENBQUM7WUFDL0MsU0FBUyxHQUFHLEVBQUUsQ0FBQztRQUNqQixDQUFDO2FBQU0sSUFBSSxLQUFLLEtBQUssTUFBTSxFQUFFLENBQUM7WUFDNUIsZUFBZSxHQUFHLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsQ0FBQztZQUNoRCxTQUFTLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUN6QixDQUFDO2FBQU0sQ0FBQztZQUNOLE1BQU0sSUFBSSxrQkFBa0IsQ0FBQyw0Q0FBNEMsQ0FBQyxDQUFDO1FBQzdFLENBQUM7SUFDSCxDQUFDO1NBQU0sQ0FBQztRQUNOLE1BQU0sSUFBSSxrQkFBa0IsQ0FBQywwQkFBMEIsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUN0RSxDQUFDO0lBRUQsc0JBQXNCO0lBQ3RCLE1BQU0sU0FBUyxHQUFHLE1BQU0sTUFBTSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQzdDLE1BQU0sRUFDTixTQUFTLEVBQ1QsZUFBZSxFQUNmLFdBQVcsRUFDWCxTQUFTLENBQ1YsQ0FBQztJQUVGLE9BQU8sYUFBYSxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQztBQUM3QyxDQUFDO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLGdCQUFnQixDQUFDLEdBQVcsRUFBRSxPQUFtQjtJQUNyRSxNQUFNLEVBQUUsS0FBSyxHQUFHLFNBQVMsRUFBRSxXQUFXLEdBQUcsSUFBSSxFQUFFLGFBQWEsRUFBRSxHQUFHLE9BQU8sQ0FBQztJQUV6RSx3RUFBd0U7SUFDeEUsOEVBQThFO0lBQzlFLElBQUksU0FBdUIsQ0FBQztJQUU1QixNQUFNLE9BQU8sR0FBRyxtQkFBbUIsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUN6QyxNQUFNLFNBQVMsR0FBRyxZQUFZLENBQUMsT0FBTyxDQUFDLENBQUM7SUFFeEMsSUFBSSxhQUFhLEVBQUUsQ0FBQztRQUNsQixTQUFTLEdBQUcsYUFBYSxDQUFDO0lBQzVCLENBQUM7U0FBTSxDQUFDO1FBQ04sMEVBQTBFO1FBQzFFLHdFQUF3RTtRQUN4RSxNQUFNLEdBQUcsR0FBRyxTQUFTLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDakMsTUFBTSxhQUFhLEdBQUcsa0JBQWtCLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyw2QkFBNkI7UUFDNUUsSUFBSSxhQUFhLEtBQUssTUFBTSxJQUFJLGFBQWEsS0FBSyxPQUFPLEVBQUUsQ0FBQztZQUMxRCxNQUFNLFVBQVUsR0FBRyxjQUFjLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDdkMsTUFBTSxRQUFRLEdBQWlDO2dCQUM3QyxPQUFPLEVBQUUsY0FBYztnQkFDdkIsT0FBTyxFQUFFLGNBQWM7Z0JBQ3ZCLE9BQU8sRUFBRSxjQUFjO2FBQ3hCLENBQUM7WUFDRixNQUFNLE1BQU0sR0FBRyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDcEMsSUFBSSxDQUFDLE1BQU07Z0JBQ1QsTUFBTSxJQUFJLGtCQUFrQixDQUFDLHdDQUF3QyxVQUFVLEVBQUUsQ0FBQyxDQUFDO1lBQ3JGLFNBQVMsR0FBRyxNQUFNLENBQUM7UUFDckIsQ0FBQzthQUFNLENBQUM7WUFDTiw0RUFBNEU7WUFDNUUsTUFBTSxPQUFPLEdBQUcsTUFBTSxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FDM0MsT0FBTyxFQUNQLFNBQVMsRUFDVCxFQUFFLElBQUksRUFBRSxtQkFBbUIsRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLEVBQzlDLElBQUksRUFDSixDQUFDLE1BQU0sQ0FBQyxDQUNULENBQUM7WUFDRixNQUFNLEdBQUcsR0FBRyxNQUFNLE1BQU0sQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQztZQUMxRCxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO2dCQUNYLE1BQU0sSUFBSSxrQkFBa0IsQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO1lBQzNFLENBQUM7WUFDRCxNQUFNLFdBQVcsR0FBRyxtQkFBbUIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQ25ELElBQUksV0FBVyxHQUFHLDRCQUE0QixFQUFFLENBQUM7Z0JBQy9DLE1BQU0sSUFBSSxrQkFBa0IsQ0FDMUIsZ0JBQWdCLFdBQVcsaUNBQWlDLDRCQUE0QixPQUFPLENBQ2hHLENBQUM7WUFDSixDQUFDO1lBQ0QsU0FBUyxHQUFHLFdBQVcsSUFBSSxJQUFJLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDO1FBQzVELENBQUM7SUFDSCxDQUFDO0lBRUQsNENBQTRDO0lBQzVDLElBQUksZUFBMEQsQ0FBQztJQUMvRCxJQUFJLFNBQXFCLENBQUM7SUFFMUIsSUFBSSxTQUFTLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDakMsSUFBSSxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDeEIsZUFBZSxHQUFHLFdBQVcsRUFBRSxDQUFDO1lBQ2hDLFNBQVMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzFCLENBQUM7YUFBTSxJQUFJLEtBQUssS0FBSyxNQUFNLEVBQUUsQ0FBQztZQUM1QixlQUFlLEdBQUcsRUFBRSxJQUFJLEVBQUUsbUJBQW1CLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxDQUFDO1lBQ2pFLFNBQVMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3ZCLENBQUM7YUFBTSxDQUFDO1lBQ04sTUFBTSxJQUFJLGtCQUFrQixDQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDL0UsQ0FBQztJQUNILENBQUM7U0FBTSxJQUFJLFNBQVMsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUN2QyxNQUFNLEtBQUssR0FBRyxTQUFTLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3RDLE1BQU0sVUFBVSxHQUNkLEtBQUssS0FBSyxXQUFXO1lBQ25CLENBQUMsQ0FBQyxPQUFPO1lBQ1QsQ0FBQyxDQUFDLEtBQUssS0FBSyxXQUFXO2dCQUNyQixDQUFDLENBQUMsT0FBTztnQkFDVCxDQUFDLENBQUMsS0FBSyxLQUFLLFdBQVc7b0JBQ3JCLENBQUMsQ0FBQyxPQUFPO29CQUNULENBQUMsQ0FBQyxDQUFDLEdBQUcsRUFBRTt3QkFDSixNQUFNLElBQUksa0JBQWtCLENBQUMseUJBQXlCLEtBQUssRUFBRSxDQUFDLENBQUM7b0JBQ2pFLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFFZixJQUFJLEtBQUssS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUN2QixlQUFlLEdBQUcsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxDQUFDO1lBQy9DLFNBQVMsR0FBRyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQzdCLENBQUM7YUFBTSxJQUFJLEtBQUssS0FBSyxNQUFNLEVBQUUsQ0FBQztZQUM1QixlQUFlLEdBQUcsRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxDQUFDO1lBQ2hELFNBQVMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3ZCLENBQUM7YUFBTSxDQUFDO1lBQ04sTUFBTSxJQUFJLGtCQUFrQixDQUFDLDRDQUE0QyxDQUFDLENBQUM7UUFDN0UsQ0FBQztJQUNILENBQUM7U0FBTSxDQUFDO1FBQ04sTUFBTSxJQUFJLGtCQUFrQixDQUFDLDBCQUEwQixTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7SUFFRCxzQkFBc0I7SUFDdEIsTUFBTSxTQUFTLEdBQUcsTUFBTSxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FDN0MsT0FBTyxFQUNQLFNBQVMsRUFDVCxlQUFlLEVBQ2YsV0FBVyxFQUNYLFNBQVMsQ0FDVixDQUFDO0lBRUYsT0FBTyxjQUFjLENBQUMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxDQUFDO0FBQzlDLENBQUM7QUFFRDs7R0FFRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsa0JBQWtCLENBQUMsR0FBYztJQUNyRCxNQUFNLFNBQVMsR0FBRyxTQUFTLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDakMsTUFBTSxTQUFTLEdBQUcsTUFBTSxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxNQUFNLEVBQUUsU0FBUyxDQUFDLENBQUM7SUFDbkUsT0FBTyxXQUFXLENBQUMsU0FBUyxFQUFFLFlBQVksQ0FBQyxDQUFDO0FBQzlDLENBQUM7QUFFRDs7O0dBR0c7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLG1CQUFtQixDQUFDLEdBQWU7SUFDdkQsTUFBTSxTQUFTLEdBQUcsU0FBUyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ2pDLE1BQU0sU0FBUyxHQUFHLE1BQU0sTUFBTSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsT0FBTyxFQUFFLFNBQVMsQ0FBQyxDQUFDO0lBQ3BFLE9BQU8sV0FBVyxDQUFDLFNBQVMsRUFBRSxhQUFhLENBQUMsQ0FBQztBQUMvQyxDQUFDO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLGtCQUFrQixDQUFDLEdBQWM7SUFDckQsTUFBTSxTQUFTLEdBQUcsU0FBUyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ2pDLE9BQU8sTUFBTSxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDLENBQUM7QUFDekQsQ0FBQyJ9

package/dist/web/tdf3/src/crypto/core/keys.js

@@ -0,0 +1,78 @@
+/**
+ * Wrap a CryptoKey as an opaque PublicKey.
+ * @internal
+ */
+export function wrapPublicKey(key, algorithm) {
+    const result = {
+        _brand: 'PublicKey',
+        algorithm,
+        _internal: key,
+    };
+    if (algorithm.startsWith('rsa:')) {
+        result.modulusBits = parseInt(algorithm.split(':')[1], 10);
+    }
+    else if (algorithm.startsWith('ec:')) {
+        const curvePart = algorithm.split(':')[1];
+        result.curve =
+            curvePart === 'secp256r1'
+                ? 'P-256'
+                : curvePart === 'secp384r1'
+                    ? 'P-384'
+                    : curvePart === 'secp521r1'
+                        ? 'P-521'
+                        : undefined;
+    }
+    return result;
+}
+/**
+ * Wrap a CryptoKey as an opaque PrivateKey.
+ * @internal
+ */
+export function wrapPrivateKey(key, algorithm) {
+    const result = {
+        _brand: 'PrivateKey',
+        algorithm,
+        _internal: key,
+    };
+    if (algorithm.startsWith('rsa:')) {
+        result.modulusBits = parseInt(algorithm.split(':')[1], 10);
+    }
+    else if (algorithm.startsWith('ec:')) {
+        const curvePart = algorithm.split(':')[1];
+        result.curve =
+            curvePart === 'secp256r1'
+                ? 'P-256'
+                : curvePart === 'secp384r1'
+                    ? 'P-384'
+                    : curvePart === 'secp521r1'
+                        ? 'P-521'
+                        : undefined;
+    }
+    return result;
+}
+/**
+ * Unwrap an opaque key to get the internal CryptoKey.
+ * @internal
+ */
+export function unwrapKey(key) {
+    return key._internal;
+}
+/**
+ * Wrap raw key bytes as an opaque SymmetricKey.
+ * @internal
+ */
+export function wrapSymmetricKey(keyBytes) {
+    return {
+        _brand: 'SymmetricKey',
+        length: keyBytes.length * 8, // bits
+        _internal: keyBytes,
+    };
+}
+/**
+ * Unwrap an opaque SymmetricKey to get raw bytes.
+ * @internal
+ */
+export function unwrapSymmetricKey(key) {
+    return key._internal;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia2V5cy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uLy4uL3RkZjMvc3JjL2NyeXB0by9jb3JlL2tleXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBT0E7OztHQUdHO0FBQ0gsTUFBTSxVQUFVLGFBQWEsQ0FBQyxHQUFjLEVBQUUsU0FBdUI7SUFDbkUsTUFBTSxNQUFNLEdBQVE7UUFDbEIsTUFBTSxFQUFFLFdBQVc7UUFDbkIsU0FBUztRQUNULFNBQVMsRUFBRSxHQUFHO0tBQ2YsQ0FBQztJQUNGLElBQUksU0FBUyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ2pDLE1BQU0sQ0FBQyxXQUFXLEdBQUcsUUFBUSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDN0QsQ0FBQztTQUFNLElBQUksU0FBUyxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sU0FBUyxHQUFHLFNBQVMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDMUMsTUFBTSxDQUFDLEtBQUs7WUFDVixTQUFTLEtBQUssV0FBVztnQkFDdkIsQ0FBQyxDQUFDLE9BQU87Z0JBQ1QsQ0FBQyxDQUFDLFNBQVMsS0FBSyxXQUFXO29CQUN6QixDQUFDLENBQUMsT0FBTztvQkFDVCxDQUFDLENBQUMsU0FBUyxLQUFLLFdBQVc7d0JBQ3pCLENBQUMsQ0FBQyxPQUFPO3dCQUNULENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDdEIsQ0FBQztJQUNELE9BQU8sTUFBbUIsQ0FBQztBQUM3QixDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxVQUFVLGNBQWMsQ0FBQyxHQUFjLEVBQUUsU0FBdUI7SUFDcEUsTUFBTSxNQUFNLEdBQVE7UUFDbEIsTUFBTSxFQUFFLFlBQVk7UUFDcEIsU0FBUztRQUNULFNBQVMsRUFBRSxHQUFHO0tBQ2YsQ0FBQztJQUNGLElBQUksU0FBUyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ2pDLE1BQU0sQ0FBQyxXQUFXLEdBQUcsUUFBUSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDN0QsQ0FBQztTQUFNLElBQUksU0FBUyxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sU0FBUyxHQUFHLFNBQVMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDMUMsTUFBTSxDQUFDLEtBQUs7WUFDVixTQUFTLEtBQUssV0FBVztnQkFDdkIsQ0FBQyxDQUFDLE9BQU87Z0JBQ1QsQ0FBQyxDQUFDLFNBQVMsS0FBSyxXQUFXO29CQUN6QixDQUFDLENBQUMsT0FBTztvQkFDVCxDQUFDLENBQUMsU0FBUyxLQUFLLFdBQVc7d0JBQ3pCLENBQUMsQ0FBQyxPQUFPO3dCQUNULENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDdEIsQ0FBQztJQUNELE9BQU8sTUFBb0IsQ0FBQztBQUM5QixDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxVQUFVLFNBQVMsQ0FBQyxHQUEyQjtJQUNuRCxPQUFRLEdBQVcsQ0FBQyxTQUFTLENBQUM7QUFDaEMsQ0FBQztBQUVEOzs7R0FHRztBQUNILE1BQU0sVUFBVSxnQkFBZ0IsQ0FBQyxRQUFvQjtJQUNuRCxPQUFPO1FBQ0wsTUFBTSxFQUFFLGNBQWM7UUFDdEIsTUFBTSxFQUFFLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLE9BQU87UUFDcEMsU0FBUyxFQUFFLFFBQVE7S0FDSixDQUFDO0FBQ3BCLENBQUM7QUFFRDs7O0dBR0c7QUFDSCxNQUFNLFVBQVUsa0JBQWtCLENBQUMsR0FBaUI7SUFDbEQsT0FBUSxHQUFXLENBQUMsU0FBUyxDQUFDO0FBQ2hDLENBQUMifQ==