@push.rocks/smartconfig 6.1.1 → 6.2.2

package/dist_ts/sshagent/smartconfig.sshagentsecret.js

@@ -0,0 +1,453 @@
+import { createCipheriv, createDecipheriv, createHash, createPublicKey, hkdfSync, randomBytes, verify, } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import * as net from 'node:net';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+const sshAgentFailure = 5;
+const sshAgentRequestIdentities = 11;
+const sshAgentIdentitiesAnswer = 12;
+const sshAgentSignRequest = 13;
+const sshAgentSignResponse = 14;
+const maxAgentResponseBytes = 16 * 1024 * 1024;
+const maxAgentIdentities = 1024;
+const defaultAgentTimeoutMs = 15_000;
+const secretFormat = 'ssh-agent-sign-v1';
+const aadEncoding = 'utf8';
+class BinaryReader {
+    constructor(buffer) {
+        this.buffer = buffer;
+        this.offset = 0;
+    }
+    readUInt8() {
+        this.ensureAvailable(1);
+        const value = this.buffer.readUInt8(this.offset);
+        this.offset += 1;
+        return value;
+    }
+    readUInt32BE() {
+        this.ensureAvailable(4);
+        const value = this.buffer.readUInt32BE(this.offset);
+        this.offset += 4;
+        return value;
+    }
+    readBuffer(lengthArg) {
+        this.ensureAvailable(lengthArg);
+        const value = this.buffer.subarray(this.offset, this.offset + lengthArg);
+        this.offset += lengthArg;
+        return value;
+    }
+    readSshStringBuffer() {
+        return this.readBuffer(this.readUInt32BE());
+    }
+    readSshStringUtf8() {
+        return this.readSshStringBuffer().toString('utf8');
+    }
+    get remainingBytes() {
+        return this.buffer.length - this.offset;
+    }
+    ensureAvailable(lengthArg) {
+        if (lengthArg < 0 || this.buffer.length - this.offset < lengthArg) {
+            throw new Error('Malformed ssh-agent response.');
+        }
+    }
+}
+class SshAgentClient {
+    constructor(socketPath = process.env.SSH_AUTH_SOCK ?? '') {
+        this.socketPath = socketPath;
+    }
+    async listIdentities() {
+        const response = await this.request(Buffer.from([sshAgentRequestIdentities]));
+        const reader = new BinaryReader(response);
+        const responseType = reader.readUInt8();
+        if (responseType === sshAgentFailure) {
+            throw new Error('ssh-agent refused to list identities.');
+        }
+        if (responseType !== sshAgentIdentitiesAnswer) {
+            throw new Error(`Unexpected ssh-agent response type ${responseType}.`);
+        }
+        const count = reader.readUInt32BE();
+        if (count > maxAgentIdentities) {
+            throw new Error(`Refusing oversized ssh-agent identity list with ${count} identities.`);
+        }
+        const identities = [];
+        for (let i = 0; i < count; i++) {
+            const keyBlob = reader.readSshStringBuffer();
+            const comment = reader.readSshStringUtf8();
+            const parsedKeyBlob = tryParseSupportedKeyBlob(keyBlob);
+            if (!parsedKeyBlob)
+                continue;
+            const fingerprint = fingerprintSha256(keyBlob);
+            const authorizedKey = formatAuthorizedKey(parsedKeyBlob.type, keyBlob, comment);
+            identities.push({
+                type: parsedKeyBlob.type,
+                keyBlob,
+                publicKeyBytes: parsedKeyBlob.publicKeyBytes,
+                comment,
+                fingerprint,
+                authorizedKey,
+            });
+        }
+        return identities;
+    }
+    async sign(keyBlobArg, dataArg) {
+        const payload = Buffer.concat([
+            Buffer.from([sshAgentSignRequest]),
+            sshString(keyBlobArg),
+            sshString(dataArg),
+            uint32(0),
+        ]);
+        const response = await this.request(payload);
+        const reader = new BinaryReader(response);
+        const responseType = reader.readUInt8();
+        if (responseType === sshAgentFailure) {
+            throw new Error('ssh-agent refused to sign. The key may be locked, constrained, or missing.');
+        }
+        if (responseType !== sshAgentSignResponse) {
+            throw new Error(`Unexpected ssh-agent response type ${responseType}.`);
+        }
+        const signatureBlob = reader.readSshStringBuffer();
+        const signatureReader = new BinaryReader(signatureBlob);
+        const algorithm = signatureReader.readSshStringUtf8();
+        const signature = signatureReader.readSshStringBuffer();
+        if (signatureReader.remainingBytes !== 0) {
+            throw new Error('Malformed ssh-agent signature blob.');
+        }
+        return {
+            algorithm,
+            signature,
+            signatureBlob,
+        };
+    }
+    async request(payloadArg) {
+        if (!this.socketPath) {
+            throw new Error('SSH_AUTH_SOCK is not set. Start ssh-agent and add the matching SSH key.');
+        }
+        return await new Promise((resolve, reject) => {
+            const socket = net.createConnection({ path: this.socketPath });
+            const chunks = [];
+            let finished = false;
+            let timeoutRef;
+            const cleanup = () => {
+                if (timeoutRef)
+                    clearTimeout(timeoutRef);
+            };
+            const fail = (errorArg) => {
+                if (finished)
+                    return;
+                finished = true;
+                cleanup();
+                socket.destroy();
+                reject(errorArg);
+            };
+            timeoutRef = setTimeout(() => {
+                fail(new Error(`ssh-agent request timed out after ${defaultAgentTimeoutMs}ms.`));
+            }, defaultAgentTimeoutMs);
+            timeoutRef.unref?.();
+            socket.on('connect', () => {
+                socket.write(Buffer.concat([uint32(payloadArg.length), payloadArg]));
+            });
+            socket.on('error', fail);
+            socket.on('close', () => {
+                if (!finished) {
+                    fail(new Error('ssh-agent closed the connection before sending a complete response.'));
+                }
+            });
+            socket.on('data', (chunkArg) => {
+                if (finished)
+                    return;
+                chunks.push(Buffer.from(chunkArg));
+                const buffer = Buffer.concat(chunks);
+                if (buffer.length < 4)
+                    return;
+                const responseLength = buffer.readUInt32BE(0);
+                if (responseLength > maxAgentResponseBytes) {
+                    fail(new Error('Refusing oversized ssh-agent response.'));
+                    return;
+                }
+                if (buffer.length < 4 + responseLength)
+                    return;
+                finished = true;
+                cleanup();
+                socket.destroy();
+                resolve(buffer.subarray(4, 4 + responseLength));
+            });
+        });
+    }
+}
+export class SmartconfigSshAgentSecrets {
+    static async encryptString(valueArg, optionsArg = {}) {
+        const publicKey = await resolvePublicKey(optionsArg);
+        const agent = new SshAgentClient(optionsArg.agentSocket);
+        const identity = await findIdentity(agent, publicKey);
+        const salt = randomBytes(32);
+        const challenge = makeChallenge(publicKey, salt);
+        const signature = await agent.sign(identity.keyBlob, challenge);
+        assertEd25519Signature(signature);
+        assertSignatureMatchesPublicKey(publicKey, challenge, signature.signature);
+        const kek = deriveKek(signature.signature, salt, publicKey);
+        const aad = makeAad(publicKey, salt);
+        const box = encryptAes256Gcm(kek, Buffer.from(valueArg, 'utf8'), aad);
+        return {
+            __smartconfigSecret: secretFormat,
+            keyHint: {
+                format: 'openssh-authorized-key-v1',
+                authorizedKey: publicKey.authorizedKey,
+                fingerprint: publicKey.fingerprint,
+            },
+            payload: {
+                encoding: aadEncoding,
+            },
+            kdf: {
+                name: 'HKDF-SHA256',
+                salt: toBase64(salt),
+            },
+            box,
+        };
+    }
+    static async decryptString(encryptedValueArg, optionsArg = {}) {
+        const buffer = await this.decryptBuffer(encryptedValueArg, optionsArg);
+        return buffer.toString('utf8');
+    }
+    static async decryptBuffer(encryptedValueArg, optionsArg = {}) {
+        const normalized = normalizeEncryptedValue(encryptedValueArg);
+        const publicKey = parseOpenSshPublicKeyLine(normalized.keyHint.authorizedKey);
+        if (publicKey.fingerprint !== normalized.keyHint.fingerprint) {
+            throw new Error('Encrypted value public key does not match its fingerprint.');
+        }
+        const salt = fromBase64(normalized.kdf.salt, 'kdf.salt', 32);
+        const agent = new SshAgentClient(optionsArg.agentSocket);
+        const identity = await findIdentity(agent, publicKey);
+        const challenge = makeChallenge(publicKey, salt);
+        const signature = await agent.sign(identity.keyBlob, challenge);
+        assertEd25519Signature(signature);
+        assertSignatureMatchesPublicKey(publicKey, challenge, signature.signature);
+        const kek = deriveKek(signature.signature, salt, publicKey);
+        return decryptAes256Gcm(kek, normalized.box, makeAad(publicKey, salt));
+    }
+    static isEncryptedValue(valueArg) {
+        return Boolean(valueArg
+            && typeof valueArg === 'object'
+            && valueArg.__smartconfigSecret === secretFormat);
+    }
+    static async writeKey(kvStoreArg, keyArg, valueArg, optionsArg = {}) {
+        const encryptedValue = await this.encryptString(valueArg, optionsArg);
+        await kvStoreArg.writeKey(keyArg, encryptedValue);
+        return encryptedValue;
+    }
+    static async readKey(kvStoreArg, keyArg, optionsArg = {}) {
+        const value = await kvStoreArg.readKey(keyArg);
+        if (!this.isEncryptedValue(value)) {
+            throw new Error(`Key "${keyArg}" does not contain a smartconfig ssh-agent encrypted value.`);
+        }
+        return await this.decryptString(value, optionsArg);
+    }
+}
+async function resolvePublicKey(optionsArg) {
+    if (optionsArg.authorizedKey) {
+        return parseOpenSshPublicKeyLine(optionsArg.authorizedKey);
+    }
+    const authorizedKeyPath = optionsArg.authorizedKeyPath ?? '~/.ssh/id_ed25519.pub';
+    const content = await fs.readFile(expandHome(authorizedKeyPath), 'utf8');
+    return parseOpenSshPublicKeyLine(content);
+}
+async function findIdentity(agentArg, publicKeyArg) {
+    const identities = await agentArg.listIdentities();
+    const identity = identities.find((candidate) => candidate.fingerprint === publicKeyArg.fingerprint && candidate.keyBlob.equals(publicKeyArg.keyBlob));
+    if (!identity) {
+        throw new Error(`Required SSH key ${publicKeyArg.fingerprint} is not loaded in ssh-agent.`);
+    }
+    return identity;
+}
+function normalizeEncryptedValue(valueArg) {
+    if (!SmartconfigSshAgentSecrets.isEncryptedValue(valueArg)) {
+        throw new Error('Value is not a smartconfig ssh-agent encrypted value.');
+    }
+    if (valueArg.keyHint?.format !== 'openssh-authorized-key-v1') {
+        throw new Error('Encrypted value uses an unsupported key hint format.');
+    }
+    if (typeof valueArg.keyHint.authorizedKey !== 'string' || !valueArg.keyHint.authorizedKey) {
+        throw new Error('Encrypted value is missing an authorized key hint.');
+    }
+    if (typeof valueArg.keyHint.fingerprint !== 'string' || !valueArg.keyHint.fingerprint.startsWith('SHA256:')) {
+        throw new Error('Encrypted value is missing a supported SSH key fingerprint.');
+    }
+    if (valueArg.payload?.encoding !== aadEncoding) {
+        throw new Error('Encrypted value uses an unsupported payload encoding.');
+    }
+    if (valueArg.kdf?.name !== 'HKDF-SHA256') {
+        throw new Error('Encrypted value uses an unsupported KDF.');
+    }
+    if (valueArg.box?.alg !== 'AES-256-GCM') {
+        throw new Error('Encrypted value uses an unsupported encryption algorithm.');
+    }
+    return valueArg;
+}
+function parseOpenSshPublicKeyLine(lineOrFileArg) {
+    const line = lineOrFileArg
+        .split(/\r?\n/)
+        .map((candidate) => candidate.trim())
+        .find((candidate) => candidate && !candidate.startsWith('#'));
+    if (!line) {
+        throw new Error('No OpenSSH authorized key line found.');
+    }
+    const tokens = line.split(/\s+/);
+    const keyIndex = tokens.findIndex((token) => token === 'ssh-ed25519');
+    if (keyIndex === -1 || !tokens[keyIndex + 1]) {
+        throw new Error('Only ssh-ed25519 authorized key hints are supported.');
+    }
+    const keyBlob = fromBase64(tokens[keyIndex + 1], 'authorizedKey.keyBlob');
+    const parsedKeyBlob = parseSupportedKeyBlob(keyBlob);
+    if (parsedKeyBlob.type !== tokens[keyIndex]) {
+        throw new Error(`SSH public key type mismatch: line says ${tokens[keyIndex]}, blob says ${parsedKeyBlob.type}.`);
+    }
+    const comment = tokens.slice(keyIndex + 2).join(' ');
+    const fingerprint = fingerprintSha256(keyBlob);
+    return {
+        type: parsedKeyBlob.type,
+        keyBlob,
+        publicKeyBytes: parsedKeyBlob.publicKeyBytes,
+        comment,
+        fingerprint,
+        authorizedKey: formatAuthorizedKey(parsedKeyBlob.type, keyBlob, comment),
+    };
+}
+function parseSupportedKeyBlob(keyBlobArg) {
+    const reader = new BinaryReader(keyBlobArg);
+    const type = reader.readSshStringUtf8();
+    if (type !== 'ssh-ed25519') {
+        throw new Error(`Unsupported SSH key type: ${type}.`);
+    }
+    const publicKeyBytes = reader.readSshStringBuffer();
+    if (publicKeyBytes.length !== 32) {
+        throw new Error(`Expected 32-byte Ed25519 public key, got ${publicKeyBytes.length} bytes.`);
+    }
+    if (reader.remainingBytes !== 0) {
+        throw new Error('Malformed ssh-ed25519 public key blob.');
+    }
+    return { type, publicKeyBytes };
+}
+function tryParseSupportedKeyBlob(keyBlobArg) {
+    try {
+        return parseSupportedKeyBlob(keyBlobArg);
+    }
+    catch (error) {
+        if (error.message.startsWith('Unsupported SSH key type:')) {
+            return undefined;
+        }
+        throw error;
+    }
+}
+function assertEd25519Signature(signatureArg) {
+    if (signatureArg.algorithm !== 'ssh-ed25519') {
+        throw new Error(`Expected ssh-ed25519 signature, got ${signatureArg.algorithm}.`);
+    }
+    if (signatureArg.signature.length !== 64) {
+        throw new Error(`Expected 64-byte Ed25519 signature, got ${signatureArg.signature.length} bytes.`);
+    }
+}
+function assertSignatureMatchesPublicKey(publicKeyArg, challengeArg, signatureArg) {
+    const spkiPrefix = Buffer.from('302a300506032b6570032100', 'hex');
+    const keyObject = createPublicKey({
+        key: Buffer.concat([spkiPrefix, publicKeyArg.publicKeyBytes]),
+        format: 'der',
+        type: 'spki',
+    });
+    const valid = verify(null, challengeArg, keyObject, signatureArg);
+    if (!valid) {
+        throw new Error('ssh-agent signature does not match the encrypted value key hint.');
+    }
+}
+function makeChallenge(publicKeyArg, saltArg) {
+    return Buffer.concat([
+        Buffer.from('smartconfig:ssh-agent-sign-v1:kek\n', 'utf8'),
+        sshString(publicKeyArg.fingerprint),
+        sshString(publicKeyArg.authorizedKey),
+        sshString(saltArg),
+    ]);
+}
+function deriveKek(signatureArg, saltArg, publicKeyArg) {
+    const info = Buffer.concat([
+        Buffer.from('smartconfig:ssh-agent-sign-v1:hkdf-info\n', 'utf8'),
+        sshString(publicKeyArg.fingerprint),
+        sshString(publicKeyArg.authorizedKey),
+    ]);
+    return Buffer.from(hkdfSync('sha256', signatureArg, saltArg, info, 32));
+}
+function makeAad(publicKeyArg, saltArg) {
+    return Buffer.from(JSON.stringify({
+        format: secretFormat,
+        keyHint: {
+            format: 'openssh-authorized-key-v1',
+            authorizedKey: publicKeyArg.authorizedKey,
+            fingerprint: publicKeyArg.fingerprint,
+        },
+        payload: {
+            encoding: aadEncoding,
+        },
+        kdf: {
+            name: 'HKDF-SHA256',
+            salt: toBase64(saltArg),
+        },
+    }), 'utf8');
+}
+function encryptAes256Gcm(keyArg, plaintextArg, aadArg) {
+    const nonce = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', keyArg, nonce);
+    cipher.setAAD(aadArg);
+    const ciphertext = Buffer.concat([cipher.update(plaintextArg), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return {
+        alg: 'AES-256-GCM',
+        nonce: toBase64(nonce),
+        ciphertext: toBase64(ciphertext),
+        tag: toBase64(tag),
+    };
+}
+function decryptAes256Gcm(keyArg, boxArg, aadArg) {
+    if (boxArg.alg !== 'AES-256-GCM') {
+        throw new Error(`Unsupported encryption algorithm: ${boxArg.alg}.`);
+    }
+    const nonce = fromBase64(boxArg.nonce, 'box.nonce', 12);
+    const ciphertext = fromBase64(boxArg.ciphertext, 'box.ciphertext');
+    const tag = fromBase64(boxArg.tag, 'box.tag', 16);
+    const decipher = createDecipheriv('aes-256-gcm', keyArg, nonce);
+    decipher.setAAD(aadArg);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+}
+function formatAuthorizedKey(typeArg, keyBlobArg, commentArg) {
+    return `${typeArg} ${keyBlobArg.toString('base64')}${commentArg ? ` ${commentArg}` : ''}`;
+}
+function fingerprintSha256(keyBlobArg) {
+    return `SHA256:${createHash('sha256').update(keyBlobArg).digest('base64').replace(/=+$/g, '')}`;
+}
+function sshString(valueArg) {
+    const buffer = Buffer.isBuffer(valueArg) ? valueArg : Buffer.from(valueArg, 'utf8');
+    return Buffer.concat([uint32(buffer.length), buffer]);
+}
+function uint32(valueArg) {
+    const buffer = Buffer.alloc(4);
+    buffer.writeUInt32BE(valueArg, 0);
+    return buffer;
+}
+function toBase64(valueArg) {
+    return valueArg.toString('base64');
+}
+function fromBase64(valueArg, fieldNameArg, expectedLengthArg) {
+    if (typeof valueArg !== 'string' || !valueArg || valueArg.length % 4 === 1 || !/^[A-Za-z0-9+/]+={0,2}$/.test(valueArg)) {
+        throw new Error(`${fieldNameArg} must be a base64 string.`);
+    }
+    const buffer = Buffer.from(valueArg, 'base64');
+    if (expectedLengthArg !== undefined && buffer.length !== expectedLengthArg) {
+        throw new Error(`${fieldNameArg} must decode to ${expectedLengthArg} bytes.`);
+    }
+    return buffer;
+}
+function expandHome(pathArg) {
+    if (pathArg === '~')
+        return homedir();
+    if (pathArg.startsWith('~/'))
+        return join(homedir(), pathArg.slice(2));
+    return pathArg;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnRjb25maWcuc3NoYWdlbnRzZWNyZXQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9zc2hhZ2VudC9zbWFydGNvbmZpZy5zc2hhZ2VudHNlY3JldC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQ0wsY0FBYyxFQUNkLGdCQUFnQixFQUNoQixVQUFVLEVBQ1YsZUFBZSxFQUNmLFFBQVEsRUFDUixXQUFXLEVBQ1gsTUFBTSxHQUNQLE1BQU0sYUFBYSxDQUFDO0FBQ3JCLE9BQU8sRUFBRSxRQUFRLElBQUksRUFBRSxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQ3pDLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBQ2hDLE9BQU8sRUFBRSxPQUFPLEVBQUUsTUFBTSxTQUFTLENBQUM7QUFDbEMsT0FBTyxFQUFFLElBQUksRUFBRSxNQUFNLFdBQVcsQ0FBQztBQW1FakMsTUFBTSxlQUFlLEdBQUcsQ0FBQyxDQUFDO0FBQzFCLE1BQU0seUJBQXlCLEdBQUcsRUFBRSxDQUFDO0FBQ3JDLE1BQU0sd0JBQXdCLEdBQUcsRUFBRSxDQUFDO0FBQ3BDLE1BQU0sbUJBQW1CLEdBQUcsRUFBRSxDQUFDO0FBQy9CLE1BQU0sb0JBQW9CLEdBQUcsRUFBRSxDQUFDO0FBQ2hDLE1BQU0scUJBQXFCLEdBQUcsRUFBRSxHQUFHLElBQUksR0FBRyxJQUFJLENBQUM7QUFDL0MsTUFBTSxrQkFBa0IsR0FBRyxJQUFJLENBQUM7QUFDaEMsTUFBTSxxQkFBcUIsR0FBRyxNQUFNLENBQUM7QUFDckMsTUFBTSxZQUFZLEdBQTZCLG1CQUFtQixDQUFDO0FBQ25FLE1BQU0sV0FBVyxHQUFzQyxNQUFNLENBQUM7QUFFOUQsTUFBTSxZQUFZO0lBR2hCLFlBQTZCLE1BQWM7UUFBZCxXQUFNLEdBQU4sTUFBTSxDQUFRO1FBRm5DLFdBQU0sR0FBRyxDQUFDLENBQUM7SUFFMkIsQ0FBQztJQUV4QyxTQUFTO1FBQ2QsSUFBSSxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN4QixNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDakQsSUFBSSxDQUFDLE1BQU0sSUFBSSxDQUFDLENBQUM7UUFDakIsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRU0sWUFBWTtRQUNqQixJQUFJLENBQUMsZUFBZSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3hCLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNwRCxJQUFJLENBQUMsTUFBTSxJQUFJLENBQUMsQ0FBQztRQUNqQixPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFFTSxVQUFVLENBQUMsU0FBaUI7UUFDakMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNoQyxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLEdBQUcsU0FBUyxDQUFDLENBQUM7UUFDekUsSUFBSSxDQUFDLE1BQU0sSUFBSSxTQUFTLENBQUM7UUFDekIsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRU0sbUJBQW1CO1FBQ3hCLE9BQU8sSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUMsQ0FBQztJQUM5QyxDQUFDO0lBRU0saUJBQWlCO1FBQ3RCLE9BQU8sSUFBSSxDQUFDLG1CQUFtQixFQUFFLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3JELENBQUM7SUFFRCxJQUFXLGNBQWM7UUFDdkIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDO0lBQzFDLENBQUM7SUFFTyxlQUFlLENBQUMsU0FBaUI7UUFDdkMsSUFBSSxTQUFTLEdBQUcsQ0FBQyxJQUFJLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLEdBQUcsU0FBUyxFQUFFLENBQUM7WUFDbEUsTUFBTSxJQUFJLEtBQUssQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO1FBQ25ELENBQUM7SUFDSCxDQUFDO0NBQ0Y7QUFFRCxNQUFNLGNBQWM7SUFDbEIsWUFBNkIsYUFBYSxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsSUFBSSxFQUFFO1FBQTVDLGVBQVUsR0FBVixVQUFVLENBQWtDO0lBQUcsQ0FBQztJQUV0RSxLQUFLLENBQUMsY0FBYztRQUN6QixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLHlCQUF5QixDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzlFLE1BQU0sTUFBTSxHQUFHLElBQUksWUFBWSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQzFDLE1BQU0sWUFBWSxHQUFHLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztRQUV4QyxJQUFJLFlBQVksS0FBSyxlQUFlLEVBQUUsQ0FBQztZQUNyQyxNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7UUFDM0QsQ0FBQztRQUNELElBQUksWUFBWSxLQUFLLHdCQUF3QixFQUFFLENBQUM7WUFDOUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxzQ0FBc0MsWUFBWSxHQUFHLENBQUMsQ0FBQztRQUN6RSxDQUFDO1FBRUQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ3BDLElBQUksS0FBSyxHQUFHLGtCQUFrQixFQUFFLENBQUM7WUFDL0IsTUFBTSxJQUFJLEtBQUssQ0FBQyxtREFBbUQsS0FBSyxjQUFjLENBQUMsQ0FBQztRQUMxRixDQUFDO1FBRUQsTUFBTSxVQUFVLEdBQW1DLEVBQUUsQ0FBQztRQUN0RCxLQUFLLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLEdBQUcsS0FBSyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDL0IsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLG1CQUFtQixFQUFFLENBQUM7WUFDN0MsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLGlCQUFpQixFQUFFLENBQUM7WUFDM0MsTUFBTSxhQUFhLEdBQUcsd0JBQXdCLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDeEQsSUFBSSxDQUFDLGFBQWE7Z0JBQUUsU0FBUztZQUM3QixNQUFNLFdBQVcsR0FBRyxpQkFBaUIsQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUMvQyxNQUFNLGFBQWEsR0FBRyxtQkFBbUIsQ0FBQyxhQUFhLENBQUMsSUFBSSxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQztZQUVoRixVQUFVLENBQUMsSUFBSSxDQUFDO2dCQUNkLElBQUksRUFBRSxhQUFhLENBQUMsSUFBSTtnQkFDeEIsT0FBTztnQkFDUCxjQUFjLEVBQUUsYUFBYSxDQUFDLGNBQWM7Z0JBQzVDLE9BQU87Z0JBQ1AsV0FBVztnQkFDWCxhQUFhO2FBQ2QsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUVELE9BQU8sVUFBVSxDQUFDO0lBQ3BCLENBQUM7SUFFTSxLQUFLLENBQUMsSUFBSSxDQUFDLFVBQWtCLEVBQUUsT0FBZTtRQUNuRCxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO1lBQzVCLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO1lBQ2xDLFNBQVMsQ0FBQyxVQUFVLENBQUM7WUFDckIsU0FBUyxDQUFDLE9BQU8sQ0FBQztZQUNsQixNQUFNLENBQUMsQ0FBQyxDQUFDO1NBQ1YsQ0FBQyxDQUFDO1FBRUgsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzdDLE1BQU0sTUFBTSxHQUFHLElBQUksWUFBWSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQzFDLE1BQU0sWUFBWSxHQUFHLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztRQUV4QyxJQUFJLFlBQVksS0FBSyxlQUFlLEVBQUUsQ0FBQztZQUNyQyxNQUFNLElBQUksS0FBSyxDQUFDLDRFQUE0RSxDQUFDLENBQUM7UUFDaEcsQ0FBQztRQUNELElBQUksWUFBWSxLQUFLLG9CQUFvQixFQUFFLENBQUM7WUFDMUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxzQ0FBc0MsWUFBWSxHQUFHLENBQUMsQ0FBQztRQUN6RSxDQUFDO1FBRUQsTUFBTSxhQUFhLEdBQUcsTUFBTSxDQUFDLG1CQUFtQixFQUFFLENBQUM7UUFDbkQsTUFBTSxlQUFlLEdBQUcsSUFBSSxZQUFZLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDeEQsTUFBTSxTQUFTLEdBQUcsZUFBZSxDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFDdEQsTUFBTSxTQUFTLEdBQUcsZUFBZSxDQUFDLG1CQUFtQixFQUFFLENBQUM7UUFDeEQsSUFBSSxlQUFlLENBQUMsY0FBYyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3pDLE1BQU0sSUFBSSxLQUFLLENBQUMscUNBQXFDLENBQUMsQ0FBQztRQUN6RCxDQUFDO1FBRUQsT0FBTztZQUNMLFNBQVM7WUFDVCxTQUFTO1lBQ1QsYUFBYTtTQUNkLENBQUM7SUFDSixDQUFDO0lBRU8sS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFrQjtRQUN0QyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ3JCLE1BQU0sSUFBSSxLQUFLLENBQUMseUVBQXlFLENBQUMsQ0FBQztRQUM3RixDQUFDO1FBRUQsT0FBTyxNQUFNLElBQUksT0FBTyxDQUFTLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxFQUFFO1lBQ25ELE1BQU0sTUFBTSxHQUFHLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQztZQUMvRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7WUFDNUIsSUFBSSxRQUFRLEdBQUcsS0FBSyxDQUFDO1lBQ3JCLElBQUksVUFBc0MsQ0FBQztZQUUzQyxNQUFNLE9BQU8sR0FBRyxHQUFTLEVBQUU7Z0JBQ3pCLElBQUksVUFBVTtvQkFBRSxZQUFZLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDM0MsQ0FBQyxDQUFDO1lBRUYsTUFBTSxJQUFJLEdBQUcsQ0FBQyxRQUFlLEVBQVEsRUFBRTtnQkFDckMsSUFBSSxRQUFRO29CQUFFLE9BQU87Z0JBQ3JCLFFBQVEsR0FBRyxJQUFJLENBQUM7Z0JBQ2hCLE9BQU8sRUFBRSxDQUFDO2dCQUNWLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDakIsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQ25CLENBQUMsQ0FBQztZQUVGLFVBQVUsR0FBRyxVQUFVLENBQUMsR0FBRyxFQUFFO2dCQUMzQixJQUFJLENBQUMsSUFBSSxLQUFLLENBQUMscUNBQXFDLHFCQUFxQixLQUFLLENBQUMsQ0FBQyxDQUFDO1lBQ25GLENBQUMsRUFBRSxxQkFBcUIsQ0FBQyxDQUFDO1lBQzFCLFVBQVUsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDO1lBRXJCLE1BQU0sQ0FBQyxFQUFFLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRTtnQkFDeEIsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDdkUsQ0FBQyxDQUFDLENBQUM7WUFDSCxNQUFNLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsQ0FBQztZQUN6QixNQUFNLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxHQUFHLEVBQUU7Z0JBQ3RCLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztvQkFDZCxJQUFJLENBQUMsSUFBSSxLQUFLLENBQUMscUVBQXFFLENBQUMsQ0FBQyxDQUFDO2dCQUN6RixDQUFDO1lBQ0gsQ0FBQyxDQUFDLENBQUM7WUFDSCxNQUFNLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRSxFQUFFO2dCQUM3QixJQUFJLFFBQVE7b0JBQUUsT0FBTztnQkFDckIsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7Z0JBQ25DLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUM7Z0JBQ3JDLElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDO29CQUFFLE9BQU87Z0JBRTlCLE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLENBQUM7Z0JBQzlDLElBQUksY0FBYyxHQUFHLHFCQUFxQixFQUFFLENBQUM7b0JBQzNDLElBQUksQ0FBQyxJQUFJLEtBQUssQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDLENBQUM7b0JBQzFELE9BQU87Z0JBQ1QsQ0FBQztnQkFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxHQUFHLGNBQWM7b0JBQUUsT0FBTztnQkFFL0MsUUFBUSxHQUFHLElBQUksQ0FBQztnQkFDaEIsT0FBTyxFQUFFLENBQUM7Z0JBQ1YsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUNqQixPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxHQUFHLGNBQWMsQ0FBQyxDQUFDLENBQUM7WUFDbEQsQ0FBQyxDQUFDLENBQUM7UUFDTCxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7Q0FDRjtBQUVELE1BQU0sT0FBTywwQkFBMEI7SUFDOUIsTUFBTSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQy9CLFFBQWdCLEVBQ2hCLGFBQXVELEVBQUU7UUFFekQsTUFBTSxTQUFTLEdBQUcsTUFBTSxnQkFBZ0IsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUNyRCxNQUFNLEtBQUssR0FBRyxJQUFJLGNBQWMsQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDekQsTUFBTSxRQUFRLEdBQUcsTUFBTSxZQUFZLENBQUMsS0FBSyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQ3RELE1BQU0sSUFBSSxHQUFHLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUM3QixNQUFNLFNBQVMsR0FBRyxhQUFhLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ2pELE1BQU0sU0FBUyxHQUFHLE1BQU0sS0FBSyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBRWhFLHNCQUFzQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ2xDLCtCQUErQixDQUFDLFNBQVMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBRTNFLE1BQU0sR0FBRyxHQUFHLFNBQVMsQ0FBQyxTQUFTLENBQUMsU0FBUyxFQUFFLElBQUksRUFBRSxTQUFTLENBQUMsQ0FBQztRQUM1RCxNQUFNLEdBQUcsR0FBRyxPQUFPLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ3JDLE1BQU0sR0FBRyxHQUFHLGdCQUFnQixDQUFDLEdBQUcsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQztRQUV0RSxPQUFPO1lBQ0wsbUJBQW1CLEVBQUUsWUFBWTtZQUNqQyxPQUFPLEVBQUU7Z0JBQ1AsTUFBTSxFQUFFLDJCQUEyQjtnQkFDbkMsYUFBYSxFQUFFLFNBQVMsQ0FBQyxhQUFhO2dCQUN0QyxXQUFXLEVBQUUsU0FBUyxDQUFDLFdBQVc7YUFDbkM7WUFDRCxPQUFPLEVBQUU7Z0JBQ1AsUUFBUSxFQUFFLFdBQVc7YUFDdEI7WUFDRCxHQUFHLEVBQUU7Z0JBQ0gsSUFBSSxFQUFFLGFBQWE7Z0JBQ25CLElBQUksRUFBRSxRQUFRLENBQUMsSUFBSSxDQUFDO2FBQ3JCO1lBQ0QsR0FBRztTQUNKLENBQUM7SUFDSixDQUFDO0lBRU0sTUFBTSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQy9CLGlCQUE2QyxFQUM3QyxhQUF1RCxFQUFFO1FBRXpELE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLGFBQWEsQ0FBQyxpQkFBaUIsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUN2RSxPQUFPLE1BQU0sQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDakMsQ0FBQztJQUVNLE1BQU0sQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUMvQixpQkFBNkMsRUFDN0MsYUFBdUQsRUFBRTtRQUV6RCxNQUFNLFVBQVUsR0FBRyx1QkFBdUIsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBQzlELE1BQU0sU0FBUyxHQUFHLHlCQUF5QixDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDOUUsSUFBSSxTQUFTLENBQUMsV0FBVyxLQUFLLFVBQVUsQ0FBQyxPQUFPLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDN0QsTUFBTSxJQUFJLEtBQUssQ0FBQyw0REFBNEQsQ0FBQyxDQUFDO1FBQ2hGLENBQUM7UUFFRCxNQUFNLElBQUksR0FBRyxVQUFVLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsVUFBVSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQzdELE1BQU0sS0FBSyxHQUFHLElBQUksY0FBYyxDQUFDLFVBQVUsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUN6RCxNQUFNLFFBQVEsR0FBRyxNQUFNLFlBQVksQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDdEQsTUFBTSxTQUFTLEdBQUcsYUFBYSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUNqRCxNQUFNLFNBQVMsR0FBRyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLE9BQU8sRUFBRSxTQUFTLENBQUMsQ0FBQztRQUVoRSxzQkFBc0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNsQywrQkFBK0IsQ0FBQyxTQUFTLEVBQUUsU0FBUyxFQUFFLFNBQVMsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUUzRSxNQUFNLEdBQUcsR0FBRyxTQUFTLENBQUMsU0FBUyxDQUFDLFNBQVMsRUFBRSxJQUFJLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDNUQsT0FBTyxnQkFBZ0IsQ0FBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLEdBQUcsRUFBRSxPQUFPLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUVNLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFpQjtRQUM5QyxPQUFPLE9BQU8sQ0FDWixRQUFRO2VBQ0wsT0FBTyxRQUFRLEtBQUssUUFBUTtlQUMzQixRQUFnRCxDQUFDLG1CQUFtQixLQUFLLFlBQVksQ0FDMUYsQ0FBQztJQUNKLENBQUM7SUFFTSxNQUFNLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FDMUIsVUFBZ0QsRUFDaEQsTUFBYyxFQUNkLFFBQWdCLEVBQ2hCLGFBQXVELEVBQUU7UUFFekQsTUFBTSxjQUFjLEdBQUcsTUFBTSxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUN0RSxNQUFNLFVBQVUsQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLGNBQWMsQ0FBQyxDQUFDO1FBQ2xELE9BQU8sY0FBYyxDQUFDO0lBQ3hCLENBQUM7SUFFTSxNQUFNLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FDekIsVUFBK0MsRUFDL0MsTUFBYyxFQUNkLGFBQXVELEVBQUU7UUFFekQsTUFBTSxLQUFLLEdBQUcsTUFBTSxVQUFVLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQy9DLElBQUksQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNsQyxNQUFNLElBQUksS0FBSyxDQUFDLFFBQVEsTUFBTSw2REFBNkQsQ0FBQyxDQUFDO1FBQy9GLENBQUM7UUFDRCxPQUFPLE1BQU0sSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDckQsQ0FBQztDQUNGO0FBRUQsS0FBSyxVQUFVLGdCQUFnQixDQUFDLFVBQW9EO0lBQ2xGLElBQUksVUFBVSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQzdCLE9BQU8seUJBQXlCLENBQUMsVUFBVSxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQzdELENBQUM7SUFDRCxNQUFNLGlCQUFpQixHQUFHLFVBQVUsQ0FBQyxpQkFBaUIsSUFBSSx1QkFBdUIsQ0FBQztJQUNsRixNQUFNLE9BQU8sR0FBRyxNQUFNLEVBQUUsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLGlCQUFpQixDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDekUsT0FBTyx5QkFBeUIsQ0FBQyxPQUFPLENBQUMsQ0FBQztBQUM1QyxDQUFDO0FBRUQsS0FBSyxVQUFVLFlBQVksQ0FBQyxRQUF3QixFQUFFLFlBQXNDO0lBQzFGLE1BQU0sVUFBVSxHQUFHLE1BQU0sUUFBUSxDQUFDLGNBQWMsRUFBRSxDQUFDO0lBQ25ELE1BQU0sUUFBUSxHQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxXQUFXLEtBQUssWUFBWSxDQUFDLFdBQVcsSUFBSSxTQUFTLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUN0SixJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDZCxNQUFNLElBQUksS0FBSyxDQUFDLG9CQUFvQixZQUFZLENBQUMsV0FBVyw4QkFBOEIsQ0FBQyxDQUFDO0lBQzlGLENBQUM7SUFDRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDO0FBRUQsU0FBUyx1QkFBdUIsQ0FBQyxRQUFpQjtJQUNoRCxJQUFJLENBQUMsMEJBQTBCLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUMzRCxNQUFNLElBQUksS0FBSyxDQUFDLHVEQUF1RCxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLE9BQU8sRUFBRSxNQUFNLEtBQUssMkJBQTJCLEVBQUUsQ0FBQztRQUM3RCxNQUFNLElBQUksS0FBSyxDQUFDLHNEQUFzRCxDQUFDLENBQUM7SUFDMUUsQ0FBQztJQUNELElBQUksT0FBTyxRQUFRLENBQUMsT0FBTyxDQUFDLGFBQWEsS0FBSyxRQUFRLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQzFGLE1BQU0sSUFBSSxLQUFLLENBQUMsb0RBQW9ELENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBQ0QsSUFBSSxPQUFPLFFBQVEsQ0FBQyxPQUFPLENBQUMsV0FBVyxLQUFLLFFBQVEsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQzVHLE1BQU0sSUFBSSxLQUFLLENBQUMsNkRBQTZELENBQUMsQ0FBQztJQUNqRixDQUFDO0lBQ0QsSUFBSSxRQUFRLENBQUMsT0FBTyxFQUFFLFFBQVEsS0FBSyxXQUFXLEVBQUUsQ0FBQztRQUMvQyxNQUFNLElBQUksS0FBSyxDQUFDLHVEQUF1RCxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLEdBQUcsRUFBRSxJQUFJLEtBQUssYUFBYSxFQUFFLENBQUM7UUFDekMsTUFBTSxJQUFJLEtBQUssQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxHQUFHLEVBQUUsR0FBRyxLQUFLLGFBQWEsRUFBRSxDQUFDO1FBQ3hDLE1BQU0sSUFBSSxLQUFLLENBQUMsMkRBQTJELENBQUMsQ0FBQztJQUMvRSxDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQztBQUVELFNBQVMseUJBQXlCLENBQUMsYUFBcUI7SUFDdEQsTUFBTSxJQUFJLEdBQUcsYUFBYTtTQUN2QixLQUFLLENBQUMsT0FBTyxDQUFDO1NBQ2QsR0FBRyxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUM7U0FDcEMsSUFBSSxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxTQUFTLElBQUksQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFFaEUsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ1YsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFFRCxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ2pDLE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssS0FBSyxhQUFhLENBQUMsQ0FBQztJQUN0RSxJQUFJLFFBQVEsS0FBSyxDQUFDLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLEdBQUcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUM3QyxNQUFNLElBQUksS0FBSyxDQUFDLHNEQUFzRCxDQUFDLENBQUM7SUFDMUUsQ0FBQztJQUVELE1BQU0sT0FBTyxHQUFHLFVBQVUsQ0FBQyxNQUFNLENBQUMsUUFBUSxHQUFHLENBQUMsQ0FBQyxFQUFFLHVCQUF1QixDQUFDLENBQUM7SUFDMUUsTUFBTSxhQUFhLEdBQUcscUJBQXFCLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDckQsSUFBSSxhQUFhLENBQUMsSUFBSSxLQUFLLE1BQU0sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQzVDLE1BQU0sSUFBSSxLQUFLLENBQUMsMkNBQTJDLE1BQU0sQ0FBQyxRQUFRLENBQUMsZUFBZSxhQUFhLENBQUMsSUFBSSxHQUFHLENBQUMsQ0FBQztJQUNuSCxDQUFDO0lBRUQsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxRQUFRLEdBQUcsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3JELE1BQU0sV0FBVyxHQUFHLGlCQUFpQixDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQy9DLE9BQU87UUFDTCxJQUFJLEVBQUUsYUFBYSxDQUFDLElBQUk7UUFDeEIsT0FBTztRQUNQLGNBQWMsRUFBRSxhQUFhLENBQUMsY0FBYztRQUM1QyxPQUFPO1FBQ1AsV0FBVztRQUNYLGFBQWEsRUFBRSxtQkFBbUIsQ0FBQyxhQUFhLENBQUMsSUFBSSxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUM7S0FDekUsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLHFCQUFxQixDQUFDLFVBQWtCO0lBQy9DLE1BQU0sTUFBTSxHQUFHLElBQUksWUFBWSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzVDLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO0lBQ3hDLElBQUksSUFBSSxLQUFLLGFBQWEsRUFBRSxDQUFDO1FBQzNCLE1BQU0sSUFBSSxLQUFLLENBQUMsNkJBQTZCLElBQUksR0FBRyxDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUNELE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO0lBQ3BELElBQUksY0FBYyxDQUFDLE1BQU0sS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUNqQyxNQUFNLElBQUksS0FBSyxDQUFDLDRDQUE0QyxjQUFjLENBQUMsTUFBTSxTQUFTLENBQUMsQ0FBQztJQUM5RixDQUFDO0lBQ0QsSUFBSSxNQUFNLENBQUMsY0FBYyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2hDLE1BQU0sSUFBSSxLQUFLLENBQUMsd0NBQXdDLENBQUMsQ0FBQztJQUM1RCxDQUFDO0lBQ0QsT0FBTyxFQUFFLElBQUksRUFBRSxjQUFjLEVBQUUsQ0FBQztBQUNsQyxDQUFDO0FBRUQsU0FBUyx3QkFBd0IsQ0FBQyxVQUFrQjtJQUNsRCxJQUFJLENBQUM7UUFDSCxPQUFPLHFCQUFxQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzNDLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSyxLQUFlLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQywyQkFBMkIsQ0FBQyxFQUFFLENBQUM7WUFDckUsT0FBTyxTQUFTLENBQUM7UUFDbkIsQ0FBQztRQUNELE1BQU0sS0FBSyxDQUFDO0lBQ2QsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLHNCQUFzQixDQUFDLFlBQTJDO0lBQ3pFLElBQUksWUFBWSxDQUFDLFNBQVMsS0FBSyxhQUFhLEVBQUUsQ0FBQztRQUM3QyxNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxZQUFZLENBQUMsU0FBUyxHQUFHLENBQUMsQ0FBQztJQUNwRixDQUFDO0lBQ0QsSUFBSSxZQUFZLENBQUMsU0FBUyxDQUFDLE1BQU0sS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUN6QyxNQUFNLElBQUksS0FBSyxDQUFDLDJDQUEyQyxZQUFZLENBQUMsU0FBUyxDQUFDLE1BQU0sU0FBUyxDQUFDLENBQUM7SUFDckcsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLCtCQUErQixDQUN0QyxZQUFzQyxFQUN0QyxZQUFvQixFQUNwQixZQUFvQjtJQUVwQixNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLDBCQUEwQixFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQ2xFLE1BQU0sU0FBUyxHQUFHLGVBQWUsQ0FBQztRQUNoQyxHQUFHLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFVBQVUsRUFBRSxZQUFZLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDN0QsTUFBTSxFQUFFLEtBQUs7UUFDYixJQUFJLEVBQUUsTUFBTTtLQUNiLENBQUMsQ0FBQztJQUNILE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxJQUFJLEVBQUUsWUFBWSxFQUFFLFNBQVMsRUFBRSxZQUFZLENBQUMsQ0FBQztJQUNsRSxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDWCxNQUFNLElBQUksS0FBSyxDQUFDLGtFQUFrRSxDQUFDLENBQUM7SUFDdEYsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLGFBQWEsQ0FBQyxZQUFzQyxFQUFFLE9BQWU7SUFDNUUsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDO1FBQ25CLE1BQU0sQ0FBQyxJQUFJLENBQUMscUNBQXFDLEVBQUUsTUFBTSxDQUFDO1FBQzFELFNBQVMsQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDO1FBQ25DLFNBQVMsQ0FBQyxZQUFZLENBQUMsYUFBYSxDQUFDO1FBQ3JDLFNBQVMsQ0FBQyxPQUFPLENBQUM7S0FDbkIsQ0FBQyxDQUFDO0FBQ0wsQ0FBQztBQUVELFNBQVMsU0FBUyxDQUFDLFlBQW9CLEVBQUUsT0FBZSxFQUFFLFlBQXNDO0lBQzlGLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7UUFDekIsTUFBTSxDQUFDLElBQUksQ0FBQywyQ0FBMkMsRUFBRSxNQUFNLENBQUM7UUFDaEUsU0FBUyxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUM7UUFDbkMsU0FBUyxDQUFDLFlBQVksQ0FBQyxhQUFhLENBQUM7S0FDdEMsQ0FBQyxDQUFDO0lBQ0gsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsWUFBWSxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQztBQUMxRSxDQUFDO0FBRUQsU0FBUyxPQUFPLENBQUMsWUFBc0MsRUFBRSxPQUFlO0lBQ3RFLE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQ2hDLE1BQU0sRUFBRSxZQUFZO1FBQ3BCLE9BQU8sRUFBRTtZQUNQLE1BQU0sRUFBRSwyQkFBMkI7WUFDbkMsYUFBYSxFQUFFLFlBQVksQ0FBQyxhQUFhO1lBQ3pDLFdBQVcsRUFBRSxZQUFZLENBQUMsV0FBVztTQUN0QztRQUNELE9BQU8sRUFBRTtZQUNQLFFBQVEsRUFBRSxXQUFXO1NBQ3RCO1FBQ0QsR0FBRyxFQUFFO1lBQ0gsSUFBSSxFQUFFLGFBQWE7WUFDbkIsSUFBSSxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUM7U0FDeEI7S0FDRixDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUM7QUFDZCxDQUFDO0FBRUQsU0FBUyxnQkFBZ0IsQ0FBQyxNQUFjLEVBQUUsWUFBb0IsRUFBRSxNQUFjO0lBQzVFLE1BQU0sS0FBSyxHQUFHLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUM5QixNQUFNLE1BQU0sR0FBRyxjQUFjLENBQUMsYUFBYSxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsQ0FBQztJQUM1RCxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3RCLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxFQUFFLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDaEYsTUFBTSxHQUFHLEdBQUcsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDO0lBQ2hDLE9BQU87UUFDTCxHQUFHLEVBQUUsYUFBYTtRQUNsQixLQUFLLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQztRQUN0QixVQUFVLEVBQUUsUUFBUSxDQUFDLFVBQVUsQ0FBQztRQUNoQyxHQUFHLEVBQUUsUUFBUSxDQUFDLEdBQUcsQ0FBQztLQUNuQixDQUFDO0FBQ0osQ0FBQztBQUVELFNBQVMsZ0JBQWdCLENBQUMsTUFBYyxFQUFFLE1BQTZCLEVBQUUsTUFBYztJQUNyRixJQUFJLE1BQU0sQ0FBQyxHQUFHLEtBQUssYUFBYSxFQUFFLENBQUM7UUFDakMsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQ0FBcUMsTUFBTSxDQUFDLEdBQUcsR0FBRyxDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUNELE1BQU0sS0FBSyxHQUFHLFVBQVUsQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLFdBQVcsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUN4RCxNQUFNLFVBQVUsR0FBRyxVQUFVLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO0lBQ25FLE1BQU0sR0FBRyxHQUFHLFVBQVUsQ0FBQyxNQUFNLENBQUMsR0FBRyxFQUFFLFNBQVMsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNsRCxNQUFNLFFBQVEsR0FBRyxnQkFBZ0IsQ0FBQyxhQUFhLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQ2hFLFFBQVEsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDeEIsUUFBUSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUN6QixPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxFQUFFLFFBQVEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUM7QUFDeEUsQ0FBQztBQUVELFNBQVMsbUJBQW1CLENBQUMsT0FBK0IsRUFBRSxVQUFrQixFQUFFLFVBQWtCO0lBQ2xHLE9BQU8sR0FBRyxPQUFPLElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRyxVQUFVLENBQUMsQ0FBQyxDQUFDLElBQUksVUFBVSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDO0FBQzVGLENBQUM7QUFFRCxTQUFTLGlCQUFpQixDQUFDLFVBQWtCO0lBQzNDLE9BQU8sVUFBVSxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxFQUFFLENBQUM7QUFDbEcsQ0FBQztBQUVELFNBQVMsU0FBUyxDQUFDLFFBQXlCO0lBQzFDLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDcEYsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO0FBQ3hELENBQUM7QUFFRCxTQUFTLE1BQU0sQ0FBQyxRQUFnQjtJQUM5QixNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQy9CLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQ2xDLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUM7QUFFRCxTQUFTLFFBQVEsQ0FBQyxRQUFnQjtJQUNoQyxPQUFPLFFBQVEsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDckMsQ0FBQztBQUVELFNBQVMsVUFBVSxDQUFDLFFBQWdCLEVBQUUsWUFBb0IsRUFBRSxpQkFBMEI7SUFDcEYsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxRQUFRLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsd0JBQXdCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDdkgsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLFlBQVksMkJBQTJCLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDL0MsSUFBSSxpQkFBaUIsS0FBSyxTQUFTLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxpQkFBaUIsRUFBRSxDQUFDO1FBQzNFLE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxZQUFZLG1CQUFtQixpQkFBaUIsU0FBUyxDQUFDLENBQUM7SUFDaEYsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUM7QUFFRCxTQUFTLFVBQVUsQ0FBQyxPQUFlO0lBQ2pDLElBQUksT0FBTyxLQUFLLEdBQUc7UUFBRSxPQUFPLE9BQU8sRUFBRSxDQUFDO0lBQ3RDLElBQUksT0FBTyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUM7UUFBRSxPQUFPLElBQUksQ0FBQyxPQUFPLEVBQUUsRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDdkUsT0FBTyxPQUFPLENBQUM7QUFDakIsQ0FBQyJ9

package/package.json

@@ -1,14 +1,24 @@
 {
   "name": "@push.rocks/smartconfig",
-  "version": "6.1.1",
+  "version": "6.2.2",
   "private": false,
   "description": "A comprehensive configuration management library providing key-value storage, environment variable mapping, and tool configuration.",
   "main": "dist_ts/index.js",
   "typings": "dist_ts/index.d.ts",
-  "scripts": {
-    "test": "(tstest test/ --verbose --logfile --timeout 20)",
-    "build": "(tsbuild --web)",
-    "buildDocs": "tsdoc"
+  "exports": {
+    ".": {
+      "types": "./dist_ts/index.d.ts",
+      "import": "./dist_ts/index.js",
+      "default": "./dist_ts/index.js"
+    },
+    "./sshagent": {
+      "types": "./dist_ts/sshagent/index.d.ts",
+      "import": "./dist_ts/sshagent/index.js",
+      "default": "./dist_ts/sshagent/index.js"
+    },
+    "./dist_ts/*": "./dist_ts/*",
+    "./ts/*": "./ts/*",
+    "./package.json": "./package.json"
   },
   "repository": {
     "type": "git",
@@ -32,11 +42,11 @@
     "@tsclass/tsclass": "^9.5.1"
   },
   "devDependencies": {
-    "@git.zone/tsbuild": "^4.4.0",
-    "@git.zone/tsrun": "^2.0.2",
-    "@git.zone/tstest": "^3.6.3",
+    "@git.zone/tsbuild": "^4.4.2",
+    "@git.zone/tsrun": "^2.0.6",
+    "@git.zone/tstest": "^4.0.0",
     "@types/lodash.clonedeep": "^4.5.9",
-    "@types/node": "^25.6.0"
+    "@types/node": "26.4.0"
   },
   "files": [
     "ts/**/*",
@@ -72,5 +82,9 @@
     "workflow improvement",
     "persistent storage"
   ],
-  "packageManager": "pnpm@10.28.2"
-}
+  "scripts": {
+    "test": "(tstest test/ --verbose --logfile --timeout 20)",
+    "build": "(tsbuild --web)",
+    "buildDocs": "tsdoc"
+  }
+}

package/readme.md

@@ -133,6 +133,61 @@ kv.changeSubject.subscribe((data) => console.log('changed:', data));
 
 ---
 
+### SSH-Agent Encrypted Single Values
+
+For Node.js CLI tools, individual `KeyValueStore` values can be stored as encrypted JSON envelopes and unlocked later through a matching SSH key loaded in `ssh-agent`. This API is intentionally exposed from the Node-only subpath `@push.rocks/smartconfig/sshagent` so browser bundles do not pull in `node:net`, `node:fs`, or `node:crypto`.
+
+```typescript
+import { KeyValueStore } from '@push.rocks/smartconfig';
+import { SmartconfigSshAgentSecrets } from '@push.rocks/smartconfig/sshagent';
+
+const kv = new KeyValueStore({
+  typeArg: 'userHomeDir',
+  identityArg: 'my-tool',
+});
+
+await SmartconfigSshAgentSecrets.writeKey(kv, 'apiToken', 'secret-token', {
+  authorizedKeyPath: '~/.ssh/id_ed25519.pub',
+});
+
+const apiToken = await SmartconfigSshAgentSecrets.readKey(kv, 'apiToken');
+```
+
+The stored value is a single self-describing object. Other keys in the same config can remain plain JSON values.
+
+```json
+{
+  "apiUrl": "https://api.example.test",
+  "apiToken": {
+    "__smartconfigSecret": "ssh-agent-sign-v1",
+    "keyHint": {
+      "format": "openssh-authorized-key-v1",
+      "authorizedKey": "ssh-ed25519 AAAAC3... user@host",
+      "fingerprint": "SHA256:..."
+    },
+    "payload": {
+      "encoding": "utf8"
+    },
+    "kdf": {
+      "name": "HKDF-SHA256",
+      "salt": "..."
+    },
+    "box": {
+      "alg": "AES-256-GCM",
+      "nonce": "...",
+      "ciphertext": "...",
+      "tag": "..."
+    }
+  }
+}
+```
+
+The encrypted value includes an OpenSSH authorized-key-style hint. Smartconfig uses the hint's public key blob and `SHA256:` fingerprint to find the matching identity in `ssh-agent`; the key comment is not trusted for matching.
+
+This is ssh-agent-signature-derived encryption, not public-key encryption. Encryption and decryption both require the matching `ssh-ed25519` key to be available through `ssh-agent`. Anyone who can access your `SSH_AUTH_SOCK` can ask the agent to sign the unlock challenge, so this protects config values at rest on disk, not an already-compromised unlocked session.
+
+---
+
 ### 3. `AppData<T>` — Environment Variable Mapping 🌟
 
 The flagship class. Maps environment variables (or hardcoded values) into a typed config object with automatic type conversions, nested object support, and smart storage path selection.
@@ -250,7 +305,19 @@ const port      = await AppData.valueAsNumber('PORT');
 
 ## Security 🔐
 
-AppData automatically redacts sensitive values in its console logs. Keys matching patterns like `secret`, `token`, `password`, `api`, `auth`, `jwt`, etc. are truncated. JWT tokens (starting with `eyJ`) are also detected and shortened. Your actual stored values are never modified — only log output is redacted.
+AppData diagnostics report configuration key names, environment-variable names,
+source kinds, transforms, presence and value types, never configuration values.
+This applies to ordinary-looking names as well as credentials, nested values,
+hardcoded literals, boolean conversions and overrides. No prefixes or previews
+of secret values are emitted. Mapping-failure diagnostics identify the affected
+key without logging arbitrary exception messages or objects, which may contain
+values. Keep key names, environment-variable names and storage paths free of secrets.
+
+This logging guarantee does not encrypt stored values or change configuration
+results. AppData persists evaluated values by default; use `ephemeral: true` for
+runtime secrets that must stay in memory. Previously exposed credentials must
+be rotated or revoked in their owning service; upgrading the logger does not
+invalidate credentials or remove historical logs.
 
 ---
 
@@ -302,7 +369,7 @@ console.log(`Model: ${settings.model}, Cache: ${settings.cache.enabled}`);
 
 ## License and Legal Information
 
-This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [LICENSE](./LICENSE) file.
+This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [license](./license) file.
 
 **Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartconfig',
-  version: '6.1.1',
+  version: '6.2.2',
   description: 'A comprehensive configuration management library providing key-value storage, environment variable mapping, and tool configuration.'
 }