@push.rocks/smartsecret 1.0.1 → 1.1.0

package/dist_ts/smartsecret.keyring.protocol.d.ts

@@ -0,0 +1,57 @@
+import * as plugins from './smartsecret.plugins.js';
+export declare const SMARTSECRET_KEYRING_SCHEMA_VERSION: 1;
+export declare const SMARTSECRET_KEYRING_PROFILE: "smartsecret-aes-256-gcm-dek-kek-v1";
+export type TSmartSecretKeyringProfile = typeof SMARTSECRET_KEYRING_PROFILE;
+export declare const SMARTSECRET_KEYRING_MAX_PAYLOAD_BYTES = 524288;
+export declare const SMARTSECRET_KEYRING_MIN_CONTEXT_BYTES = 1;
+export declare const SMARTSECRET_KEYRING_MAX_CONTEXT_BYTES = 65536;
+export declare const SMARTSECRET_KEYRING_MAX_IDENTIFIER_BYTES = 200;
+export declare const SMARTSECRET_KEYRING_MAX_KEK_VERSION = 2147483647;
+export interface ISmartSecretEnvelopeCiphertext {
+    nonce: string;
+    ciphertext: string;
+    tag: string;
+}
+export interface ISmartSecretEnvelopeV1 {
+    schemaVersion: 1;
+    profile: TSmartSecretKeyringProfile;
+    envelopeId: string;
+    createdAt: number;
+    contextDigest: string;
+    kek: {
+        keyringId: string;
+        version: number;
+        fingerprint: `sha256:${string}`;
+    };
+    payload: ISmartSecretEnvelopeCiphertext;
+    wrappedDek: ISmartSecretEnvelopeCiphertext;
+}
+export interface IParsedSmartSecretEnvelopeV1 {
+    envelope: ISmartSecretEnvelopeV1;
+    contextDigest: Uint8Array;
+    kekFingerprint: Uint8Array;
+    payload: plugins.smartcrypto.IAesGcmCiphertext;
+    wrappedDek: plugins.smartcrypto.IAesGcmCiphertext;
+}
+export interface ISmartSecretWrapAadFields {
+    envelopeId: string;
+    createdAt: number;
+    contextDigest: Uint8Array;
+    payloadDigest: Uint8Array;
+    keyringId: string;
+    kekVersion: number;
+    kekFingerprint: Uint8Array;
+}
+export declare const requireSmartSecretIdentifier: (valueArg: unknown) => string;
+export declare const requireEnvelopeIdentifier: (valueArg: unknown) => string;
+export declare const requireKekVersion: (valueArg: unknown, envelopeArg?: boolean) => number;
+export declare const requireEpochMilliseconds: (valueArg: unknown, envelopeArg?: boolean) => number;
+export declare const requireFingerprint: (valueArg: unknown, envelopeArg?: boolean) => `sha256:${string}`;
+export declare const fingerprintToBytes: (valueArg: `sha256:${string}`) => Uint8Array;
+export declare const encodeCanonicalBase64Url: (valueArg: Uint8Array) => string;
+export declare const parseSmartSecretEnvelope: (valueArg: unknown) => IParsedSmartSecretEnvelopeV1;
+export declare const sha256Bytes: (...valuesArg: Uint8Array[]) => Uint8Array;
+export declare const createSmartSecretPayloadDigest: (payloadArg: plugins.smartcrypto.IAesGcmCiphertext) => Uint8Array;
+export declare const createSmartSecretWrapAad: (fieldsArg: ISmartSecretWrapAadFields) => Uint8Array;
+export declare const wipeCiphertext: (valueArg: plugins.smartcrypto.IAesGcmCiphertext | undefined) => void;
+export declare const timingSafeEqual: (leftArg: Uint8Array, rightArg: Uint8Array) => boolean;

package/dist_ts/smartsecret.keyring.protocol.js

@@ -0,0 +1,290 @@
+import * as plugins from './smartsecret.plugins.js';
+import { SmartSecretKeyringError, createSmartSecretKeyringError, } from './smartsecret.keyring.error.js';
+export const SMARTSECRET_KEYRING_SCHEMA_VERSION = 1;
+export const SMARTSECRET_KEYRING_PROFILE = 'smartsecret-aes-256-gcm-dek-kek-v1';
+export const SMARTSECRET_KEYRING_MAX_PAYLOAD_BYTES = 524_288;
+export const SMARTSECRET_KEYRING_MIN_CONTEXT_BYTES = 1;
+export const SMARTSECRET_KEYRING_MAX_CONTEXT_BYTES = 65_536;
+export const SMARTSECRET_KEYRING_MAX_IDENTIFIER_BYTES = 200;
+export const SMARTSECRET_KEYRING_MAX_KEK_VERSION = 2_147_483_647;
+const identifierPattern = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
+const fingerprintPattern = /^sha256:[0-9a-f]{64}$/;
+const base64UrlPattern = /^[A-Za-z0-9_-]*$/;
+const wrapAadMagic = Buffer.from('smartsecret-envelope-wrap-aad-v1', 'ascii');
+const payloadDigestMagic = Buffer.from('smartsecret-envelope-payload-digest-v1', 'ascii');
+const requirePlainObject = (valueArg, expectedKeysArg) => {
+    try {
+        if (valueArg === null || typeof valueArg !== 'object' || Array.isArray(valueArg)) {
+            throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+        }
+        const prototype = Object.getPrototypeOf(valueArg);
+        if (prototype !== Object.prototype && prototype !== null) {
+            throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+        }
+        const ownKeys = Reflect.ownKeys(valueArg);
+        if (ownKeys.length !== expectedKeysArg.length
+            || ownKeys.some((keyArg) => typeof keyArg !== 'string')) {
+            throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+        }
+        const actualKeys = ownKeys;
+        if (expectedKeysArg.some((keyArg) => !actualKeys.includes(keyArg))) {
+            throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+        }
+        const result = Object.create(null);
+        for (const key of actualKeys) {
+            const descriptor = Object.getOwnPropertyDescriptor(valueArg, key);
+            if (!descriptor?.enumerable || !('value' in descriptor)) {
+                throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+            }
+            result[key] = descriptor.value;
+        }
+        return result;
+    }
+    catch (error) {
+        if (error instanceof SmartSecretKeyringError) {
+            throw error;
+        }
+        throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+    }
+};
+export const requireSmartSecretIdentifier = (valueArg) => {
+    if (typeof valueArg !== 'string'
+        || !identifierPattern.test(valueArg)
+        || Buffer.byteLength(valueArg, 'utf8') < 1
+        || Buffer.byteLength(valueArg, 'utf8') > SMARTSECRET_KEYRING_MAX_IDENTIFIER_BYTES) {
+        throw createSmartSecretKeyringError('CONFIG_INVALID');
+    }
+    return valueArg;
+};
+export const requireEnvelopeIdentifier = (valueArg) => {
+    try {
+        return requireSmartSecretIdentifier(valueArg);
+    }
+    catch {
+        throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+    }
+};
+export const requireKekVersion = (valueArg, envelopeArg = false) => {
+    if (!Number.isSafeInteger(valueArg)
+        || valueArg < 1
+        || valueArg > SMARTSECRET_KEYRING_MAX_KEK_VERSION) {
+        throw createSmartSecretKeyringError(envelopeArg ? 'ENVELOPE_INVALID' : 'CONFIG_INVALID');
+    }
+    return valueArg;
+};
+export const requireEpochMilliseconds = (valueArg, envelopeArg = false) => {
+    if (!Number.isSafeInteger(valueArg) || valueArg < 0) {
+        throw createSmartSecretKeyringError(envelopeArg ? 'ENVELOPE_INVALID' : 'CONFIG_INVALID');
+    }
+    return valueArg;
+};
+export const requireFingerprint = (valueArg, envelopeArg = false) => {
+    if (typeof valueArg !== 'string' || !fingerprintPattern.test(valueArg)) {
+        throw createSmartSecretKeyringError(envelopeArg ? 'ENVELOPE_INVALID' : 'CONFIG_INVALID');
+    }
+    return valueArg;
+};
+export const fingerprintToBytes = (valueArg) => new Uint8Array(Buffer.from(valueArg.slice('sha256:'.length), 'hex'));
+export const encodeCanonicalBase64Url = (valueArg) => Buffer.from(valueArg).toString('base64url');
+const decodeCanonicalBase64Url = (valueArg, maximumBytesArg, exactBytesArg) => {
+    if (typeof valueArg !== 'string') {
+        throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+    }
+    const maximumEncodedLength = Math.ceil(maximumBytesArg * 4 / 3);
+    if (valueArg.length > maximumEncodedLength) {
+        throw createSmartSecretKeyringError('SIZE_LIMIT_EXCEEDED');
+    }
+    if (!base64UrlPattern.test(valueArg) || valueArg.length % 4 === 1) {
+        throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+    }
+    let result;
+    let decodedBuffer;
+    let didSucceed = false;
+    try {
+        decodedBuffer = Buffer.from(valueArg, 'base64url');
+        result = new Uint8Array(decodedBuffer);
+        if (result.byteLength > maximumBytesArg) {
+            throw createSmartSecretKeyringError('SIZE_LIMIT_EXCEEDED');
+        }
+        if (exactBytesArg !== undefined && result.byteLength !== exactBytesArg) {
+            throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+        }
+        if (encodeCanonicalBase64Url(result) !== valueArg) {
+            throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+        }
+        didSucceed = true;
+        return result;
+    }
+    catch (error) {
+        if (error instanceof SmartSecretKeyringError) {
+            throw error;
+        }
+        throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+    }
+    finally {
+        decodedBuffer?.fill(0);
+        if (!didSucceed) {
+            result?.fill(0);
+        }
+    }
+};
+const parseCiphertext = (valueArg, maximumCiphertextBytesArg, exactCiphertextBytesArg) => {
+    const value = requirePlainObject(valueArg, ['nonce', 'ciphertext', 'tag']);
+    let nonce;
+    let ciphertext;
+    let tag;
+    let didSucceed = false;
+    try {
+        nonce = decodeCanonicalBase64Url(value.nonce, 12, 12);
+        ciphertext = decodeCanonicalBase64Url(value.ciphertext, maximumCiphertextBytesArg, exactCiphertextBytesArg);
+        tag = decodeCanonicalBase64Url(value.tag, 16, 16);
+        const result = {
+            encoded: {
+                nonce: value.nonce,
+                ciphertext: value.ciphertext,
+                tag: value.tag,
+            },
+            raw: { nonce, ciphertext, tag },
+        };
+        didSucceed = true;
+        return result;
+    }
+    finally {
+        if (!didSucceed) {
+            nonce?.fill(0);
+            ciphertext?.fill(0);
+            tag?.fill(0);
+        }
+    }
+};
+export const parseSmartSecretEnvelope = (valueArg) => {
+    const value = requirePlainObject(valueArg, [
+        'schemaVersion',
+        'profile',
+        'envelopeId',
+        'createdAt',
+        'contextDigest',
+        'kek',
+        'payload',
+        'wrappedDek',
+    ]);
+    if (value.schemaVersion !== SMARTSECRET_KEYRING_SCHEMA_VERSION) {
+        throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+    }
+    if (value.profile !== SMARTSECRET_KEYRING_PROFILE) {
+        throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+    }
+    let contextDigest;
+    let kekFingerprint;
+    let payload;
+    let wrappedDek;
+    let didSucceed = false;
+    try {
+        const envelopeId = requireEnvelopeIdentifier(value.envelopeId);
+        const createdAt = requireEpochMilliseconds(value.createdAt, true);
+        contextDigest = decodeCanonicalBase64Url(value.contextDigest, 32, 32);
+        const kekValue = requirePlainObject(value.kek, ['keyringId', 'version', 'fingerprint']);
+        const keyringId = requireEnvelopeIdentifier(kekValue.keyringId);
+        const version = requireKekVersion(kekValue.version, true);
+        const fingerprint = requireFingerprint(kekValue.fingerprint, true);
+        kekFingerprint = fingerprintToBytes(fingerprint);
+        payload = parseCiphertext(value.payload, SMARTSECRET_KEYRING_MAX_PAYLOAD_BYTES);
+        wrappedDek = parseCiphertext(value.wrappedDek, 32, 32);
+        const result = {
+            envelope: {
+                schemaVersion: SMARTSECRET_KEYRING_SCHEMA_VERSION,
+                profile: SMARTSECRET_KEYRING_PROFILE,
+                envelopeId,
+                createdAt,
+                contextDigest: value.contextDigest,
+                kek: { keyringId, version, fingerprint },
+                payload: payload.encoded,
+                wrappedDek: wrappedDek.encoded,
+            },
+            contextDigest,
+            kekFingerprint,
+            payload: payload.raw,
+            wrappedDek: wrappedDek.raw,
+        };
+        didSucceed = true;
+        return result;
+    }
+    finally {
+        if (!didSucceed) {
+            contextDigest?.fill(0);
+            kekFingerprint?.fill(0);
+            wipeCiphertext(payload?.raw);
+            wipeCiphertext(wrappedDek?.raw);
+        }
+    }
+};
+export const sha256Bytes = (...valuesArg) => {
+    const hash = plugins.crypto.createHash('sha256');
+    for (const value of valuesArg) {
+        hash.update(value);
+    }
+    return new Uint8Array(hash.digest());
+};
+const uint32Bytes = (valueArg) => {
+    const result = Buffer.allocUnsafe(4);
+    result.writeUInt32BE(valueArg, 0);
+    return result;
+};
+const uint64Bytes = (valueArg) => {
+    const result = Buffer.allocUnsafe(8);
+    result.writeBigUInt64BE(BigInt(valueArg), 0);
+    return result;
+};
+const lengthPrefixed = (valueArg) => {
+    if (valueArg.byteLength > 0xffff_ffff) {
+        throw createSmartSecretKeyringError('SIZE_LIMIT_EXCEEDED');
+    }
+    return Buffer.concat([uint32Bytes(valueArg.byteLength), valueArg]);
+};
+export const createSmartSecretPayloadDigest = (payloadArg) => {
+    const hash = plugins.crypto.createHash('sha256');
+    hash.update(payloadDigestMagic);
+    for (const value of [payloadArg.nonce, payloadArg.ciphertext, payloadArg.tag]) {
+        const length = uint32Bytes(value.byteLength);
+        try {
+            hash.update(length);
+            hash.update(value);
+        }
+        finally {
+            length.fill(0);
+        }
+    }
+    return new Uint8Array(hash.digest());
+};
+export const createSmartSecretWrapAad = (fieldsArg) => {
+    if (fieldsArg.contextDigest.byteLength !== 32
+        || fieldsArg.payloadDigest.byteLength !== 32
+        || fieldsArg.kekFingerprint.byteLength !== 32) {
+        throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+    }
+    const profile = Buffer.from(SMARTSECRET_KEYRING_PROFILE, 'utf8');
+    const envelopeId = Buffer.from(requireEnvelopeIdentifier(fieldsArg.envelopeId), 'utf8');
+    const keyringId = Buffer.from(requireEnvelopeIdentifier(fieldsArg.keyringId), 'utf8');
+    const createdAt = requireEpochMilliseconds(fieldsArg.createdAt, true);
+    const kekVersion = requireKekVersion(fieldsArg.kekVersion, true);
+    return Buffer.concat([
+        wrapAadMagic,
+        uint64Bytes(SMARTSECRET_KEYRING_SCHEMA_VERSION),
+        lengthPrefixed(profile),
+        lengthPrefixed(envelopeId),
+        uint64Bytes(createdAt),
+        fieldsArg.contextDigest,
+        fieldsArg.payloadDigest,
+        lengthPrefixed(keyringId),
+        uint64Bytes(kekVersion),
+        fieldsArg.kekFingerprint,
+    ]);
+};
+export const wipeCiphertext = (valueArg) => {
+    valueArg?.nonce.fill(0);
+    valueArg?.ciphertext.fill(0);
+    valueArg?.tag.fill(0);
+};
+export const timingSafeEqual = (leftArg, rightArg) => leftArg.byteLength === rightArg.byteLength
+    && plugins.crypto.timingSafeEqual(leftArg, rightArg);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnRzZWNyZXQua2V5cmluZy5wcm90b2NvbC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3NtYXJ0c2VjcmV0LmtleXJpbmcucHJvdG9jb2wudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSwwQkFBMEIsQ0FBQztBQUNwRCxPQUFPLEVBQ0wsdUJBQXVCLEVBQ3ZCLDZCQUE2QixHQUM5QixNQUFNLGdDQUFnQyxDQUFDO0FBRXhDLE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQVUsQ0FBQztBQUM3RCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxvQ0FBNkMsQ0FBQztBQUd6RixNQUFNLENBQUMsTUFBTSxxQ0FBcUMsR0FBRyxPQUFPLENBQUM7QUFDN0QsTUFBTSxDQUFDLE1BQU0scUNBQXFDLEdBQUcsQ0FBQyxDQUFDO0FBQ3ZELE1BQU0sQ0FBQyxNQUFNLHFDQUFxQyxHQUFHLE1BQU0sQ0FBQztBQUM1RCxNQUFNLENBQUMsTUFBTSx3Q0FBd0MsR0FBRyxHQUFHLENBQUM7QUFDNUQsTUFBTSxDQUFDLE1BQU0sbUNBQW1DLEdBQUcsYUFBYSxDQUFDO0FBRWpFLE1BQU0saUJBQWlCLEdBQUcscUNBQXFDLENBQUM7QUFDaEUsTUFBTSxrQkFBa0IsR0FBRyx1QkFBdUIsQ0FBQztBQUNuRCxNQUFNLGdCQUFnQixHQUFHLGtCQUFrQixDQUFDO0FBQzVDLE1BQU0sWUFBWSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsa0NBQWtDLEVBQUUsT0FBTyxDQUFDLENBQUM7QUFDOUUsTUFBTSxrQkFBa0IsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLHdDQUF3QyxFQUFFLE9BQU8sQ0FBQyxDQUFDO0FBeUMxRixNQUFNLGtCQUFrQixHQUFHLENBQ3pCLFFBQWlCLEVBQ2pCLGVBQWtDLEVBQ1QsRUFBRTtJQUMzQixJQUFJLENBQUM7UUFDSCxJQUFJLFFBQVEsS0FBSyxJQUFJLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUNqRixNQUFNLDZCQUE2QixDQUFDLGtCQUFrQixDQUFDLENBQUM7UUFDMUQsQ0FBQztRQUNELE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDbEQsSUFBSSxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVMsSUFBSSxTQUFTLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDekQsTUFBTSw2QkFBNkIsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBQzFELENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQzFDLElBQ0UsT0FBTyxDQUFDLE1BQU0sS0FBSyxlQUFlLENBQUMsTUFBTTtlQUN0QyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxPQUFPLE1BQU0sS0FBSyxRQUFRLENBQUMsRUFDdkQsQ0FBQztZQUNELE1BQU0sNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztRQUMxRCxDQUFDO1FBQ0QsTUFBTSxVQUFVLEdBQUcsT0FBbUIsQ0FBQztRQUN2QyxJQUFJLGVBQWUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDbkUsTUFBTSw2QkFBNkIsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBQzFELENBQUM7UUFDRCxNQUFNLE1BQU0sR0FBNEIsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM1RCxLQUFLLE1BQU0sR0FBRyxJQUFJLFVBQVUsRUFBRSxDQUFDO1lBQzdCLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLEVBQUUsR0FBRyxDQUFDLENBQUM7WUFDbEUsSUFBSSxDQUFDLFVBQVUsRUFBRSxVQUFVLElBQUksQ0FBQyxDQUFDLE9BQU8sSUFBSSxVQUFVLENBQUMsRUFBRSxDQUFDO2dCQUN4RCxNQUFNLDZCQUE2QixDQUFDLGtCQUFrQixDQUFDLENBQUM7WUFDMUQsQ0FBQztZQUNELE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDO1FBQ2pDLENBQUM7UUFDRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLElBQUksS0FBSyxZQUFZLHVCQUF1QixFQUFFLENBQUM7WUFDN0MsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDO1FBQ0QsTUFBTSw2QkFBNkIsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0lBQzFELENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUN4RSxJQUNFLE9BQU8sUUFBUSxLQUFLLFFBQVE7V0FDekIsQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDO1dBQ2pDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUM7V0FDdkMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLEdBQUcsd0NBQXdDLEVBQ2pGLENBQUM7UUFDRCxNQUFNLDZCQUE2QixDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQ3JFLElBQUksQ0FBQztRQUNILE9BQU8sNEJBQTRCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE1BQU0sNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztJQUMxRCxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLFdBQVcsR0FBRyxLQUFLLEVBQVUsRUFBRTtJQUNsRixJQUNFLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUM7V0FDM0IsUUFBbUIsR0FBRyxDQUFDO1dBQ3ZCLFFBQW1CLEdBQUcsbUNBQW1DLEVBQzdELENBQUM7UUFDRCxNQUFNLDZCQUE2QixDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsa0JBQWtCLENBQUMsQ0FBQyxDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDM0YsQ0FBQztJQUNELE9BQU8sUUFBa0IsQ0FBQztBQUM1QixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxDQUFDLFFBQWlCLEVBQUUsV0FBVyxHQUFHLEtBQUssRUFBVSxFQUFFO0lBQ3pGLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQW1CLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDaEUsTUFBTSw2QkFBNkIsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLGtCQUFrQixDQUFDLENBQUMsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQzNGLENBQUM7SUFDRCxPQUFPLFFBQWtCLENBQUM7QUFDNUIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLFdBQVcsR0FBRyxLQUFLLEVBQXNCLEVBQUU7SUFDL0YsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUN2RSxNQUFNLDZCQUE2QixDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsa0JBQWtCLENBQUMsQ0FBQyxDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDM0YsQ0FBQztJQUNELE9BQU8sUUFBOEIsQ0FBQztBQUN4QyxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLFFBQTRCLEVBQWMsRUFBRSxDQUM3RSxJQUFJLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUM7QUFFdkUsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxRQUFvQixFQUFVLEVBQUUsQ0FDdkUsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUM7QUFFOUMsTUFBTSx3QkFBd0IsR0FBRyxDQUMvQixRQUFpQixFQUNqQixlQUF1QixFQUN2QixhQUFzQixFQUNWLEVBQUU7SUFDZCxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ2pDLE1BQU0sNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLGVBQWUsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDaEUsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLG9CQUFvQixFQUFFLENBQUM7UUFDM0MsTUFBTSw2QkFBNkIsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO0lBQzdELENBQUM7SUFDRCxJQUFJLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2xFLE1BQU0sNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsSUFBSSxNQUE4QixDQUFDO0lBQ25DLElBQUksYUFBaUMsQ0FBQztJQUN0QyxJQUFJLFVBQVUsR0FBRyxLQUFLLENBQUM7SUFDdkIsSUFBSSxDQUFDO1FBQ0gsYUFBYSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLFdBQVcsQ0FBQyxDQUFDO1FBQ25ELE1BQU0sR0FBRyxJQUFJLFVBQVUsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUN2QyxJQUFJLE1BQU0sQ0FBQyxVQUFVLEdBQUcsZUFBZSxFQUFFLENBQUM7WUFDeEMsTUFBTSw2QkFBNkIsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO1FBQzdELENBQUM7UUFDRCxJQUFJLGFBQWEsS0FBSyxTQUFTLElBQUksTUFBTSxDQUFDLFVBQVUsS0FBSyxhQUFhLEVBQUUsQ0FBQztZQUN2RSxNQUFNLDZCQUE2QixDQUFDLGtCQUFrQixDQUFDLENBQUM7UUFDMUQsQ0FBQztRQUNELElBQUksd0JBQXdCLENBQUMsTUFBTSxDQUFDLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDbEQsTUFBTSw2QkFBNkIsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBQzFELENBQUM7UUFDRCxVQUFVLEdBQUcsSUFBSSxDQUFDO1FBQ2xCLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxLQUFLLFlBQVksdUJBQXVCLEVBQUUsQ0FBQztZQUM3QyxNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7UUFDRCxNQUFNLDZCQUE2QixDQUFDLGtCQUFrQixDQUFDLENBQUM7SUFDMUQsQ0FBQztZQUFTLENBQUM7UUFDVCxhQUFhLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3ZCLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUNoQixNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2xCLENBQUM7SUFDSCxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxlQUFlLEdBQUcsQ0FDdEIsUUFBaUIsRUFDakIseUJBQWlDLEVBQ2pDLHVCQUFnQyxFQUN5RCxFQUFFO0lBQzNGLE1BQU0sS0FBSyxHQUFHLGtCQUFrQixDQUFDLFFBQVEsRUFBRSxDQUFDLE9BQU8sRUFBRSxZQUFZLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUMzRSxJQUFJLEtBQTZCLENBQUM7SUFDbEMsSUFBSSxVQUFrQyxDQUFDO0lBQ3ZDLElBQUksR0FBMkIsQ0FBQztJQUNoQyxJQUFJLFVBQVUsR0FBRyxLQUFLLENBQUM7SUFDdkIsSUFBSSxDQUFDO1FBQ0gsS0FBSyxHQUFHLHdCQUF3QixDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3RELFVBQVUsR0FBRyx3QkFBd0IsQ0FDbkMsS0FBSyxDQUFDLFVBQVUsRUFDaEIseUJBQXlCLEVBQ3pCLHVCQUF1QixDQUN4QixDQUFDO1FBQ0YsR0FBRyxHQUFHLHdCQUF3QixDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ2xELE1BQU0sTUFBTSxHQUFHO1lBQ2IsT0FBTyxFQUFFO2dCQUNQLEtBQUssRUFBRSxLQUFLLENBQUMsS0FBZTtnQkFDNUIsVUFBVSxFQUFFLEtBQUssQ0FBQyxVQUFvQjtnQkFDdEMsR0FBRyxFQUFFLEtBQUssQ0FBQyxHQUFhO2FBQ3pCO1lBQ0QsR0FBRyxFQUFFLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxHQUFHLEVBQUU7U0FDaEMsQ0FBQztRQUNGLFVBQVUsR0FBRyxJQUFJLENBQUM7UUFDbEIsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztZQUFTLENBQUM7UUFDVCxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDaEIsS0FBSyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNmLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDcEIsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNmLENBQUM7SUFDSCxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxRQUFpQixFQUFnQyxFQUFFO0lBQzFGLE1BQU0sS0FBSyxHQUFHLGtCQUFrQixDQUFDLFFBQVEsRUFBRTtRQUN6QyxlQUFlO1FBQ2YsU0FBUztRQUNULFlBQVk7UUFDWixXQUFXO1FBQ1gsZUFBZTtRQUNmLEtBQUs7UUFDTCxTQUFTO1FBQ1QsWUFBWTtLQUNiLENBQUMsQ0FBQztJQUNILElBQUksS0FBSyxDQUFDLGFBQWEsS0FBSyxrQ0FBa0MsRUFBRSxDQUFDO1FBQy9ELE1BQU0sNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsSUFBSSxLQUFLLENBQUMsT0FBTyxLQUFLLDJCQUEyQixFQUFFLENBQUM7UUFDbEQsTUFBTSw2QkFBNkIsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFDRCxJQUFJLGFBQXFDLENBQUM7SUFDMUMsSUFBSSxjQUFzQyxDQUFDO0lBQzNDLElBQUksT0FBdUQsQ0FBQztJQUM1RCxJQUFJLFVBQTBELENBQUM7SUFDL0QsSUFBSSxVQUFVLEdBQUcsS0FBSyxDQUFDO0lBQ3ZCLElBQUksQ0FBQztRQUNILE1BQU0sVUFBVSxHQUFHLHlCQUF5QixDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUMvRCxNQUFNLFNBQVMsR0FBRyx3QkFBd0IsQ0FBQyxLQUFLLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ2xFLGFBQWEsR0FBRyx3QkFBd0IsQ0FBQyxLQUFLLENBQUMsYUFBYSxFQUFFLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUN0RSxNQUFNLFFBQVEsR0FBRyxrQkFBa0IsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsV0FBVyxFQUFFLFNBQVMsRUFBRSxhQUFhLENBQUMsQ0FBQyxDQUFDO1FBQ3hGLE1BQU0sU0FBUyxHQUFHLHlCQUF5QixDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNoRSxNQUFNLE9BQU8sR0FBRyxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzFELE1BQU0sV0FBVyxHQUFHLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxXQUFXLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDbkUsY0FBYyxHQUFHLGtCQUFrQixDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ2pELE9BQU8sR0FBRyxlQUFlLENBQUMsS0FBSyxDQUFDLE9BQU8sRUFBRSxxQ0FBcUMsQ0FBQyxDQUFDO1FBQ2hGLFVBQVUsR0FBRyxlQUFlLENBQUMsS0FBSyxDQUFDLFVBQVUsRUFBRSxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDdkQsTUFBTSxNQUFNLEdBQUc7WUFDYixRQUFRLEVBQUU7Z0JBQ1IsYUFBYSxFQUFFLGtDQUFrQztnQkFDakQsT0FBTyxFQUFFLDJCQUEyQjtnQkFDcEMsVUFBVTtnQkFDVixTQUFTO2dCQUNULGFBQWEsRUFBRSxLQUFLLENBQUMsYUFBdUI7Z0JBQzVDLEdBQUcsRUFBRSxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFO2dCQUN4QyxPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU87Z0JBQ3hCLFVBQVUsRUFBRSxVQUFVLENBQUMsT0FBTzthQUMvQjtZQUNELGFBQWE7WUFDYixjQUFjO1lBQ2QsT0FBTyxFQUFFLE9BQU8sQ0FBQyxHQUFHO1lBQ3BCLFVBQVUsRUFBRSxVQUFVLENBQUMsR0FBRztTQUMzQixDQUFDO1FBQ0YsVUFBVSxHQUFHLElBQUksQ0FBQztRQUNsQixPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO1lBQVMsQ0FBQztRQUNULElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUNoQixhQUFhLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ3ZCLGNBQWMsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDeEIsY0FBYyxDQUFDLE9BQU8sRUFBRSxHQUFHLENBQUMsQ0FBQztZQUM3QixjQUFjLENBQUMsVUFBVSxFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQ2xDLENBQUM7SUFDSCxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sV0FBVyxHQUFHLENBQUMsR0FBRyxTQUF1QixFQUFjLEVBQUU7SUFDcEUsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDakQsS0FBSyxNQUFNLEtBQUssSUFBSSxTQUFTLEVBQUUsQ0FBQztRQUM5QixJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3JCLENBQUM7SUFDRCxPQUFPLElBQUksVUFBVSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO0FBQ3ZDLENBQUMsQ0FBQztBQUVGLE1BQU0sV0FBVyxHQUFHLENBQUMsUUFBZ0IsRUFBYyxFQUFFO0lBQ25ELE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDckMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDbEMsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxXQUFXLEdBQUcsQ0FBQyxRQUFnQixFQUFjLEVBQUU7SUFDbkQsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNyQyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQzdDLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sY0FBYyxHQUFHLENBQUMsUUFBb0IsRUFBYyxFQUFFO0lBQzFELElBQUksUUFBUSxDQUFDLFVBQVUsR0FBRyxXQUFXLEVBQUUsQ0FBQztRQUN0QyxNQUFNLDZCQUE2QixDQUFDLHFCQUFxQixDQUFDLENBQUM7SUFDN0QsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztBQUNyRSxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxDQUM1QyxVQUFpRCxFQUNyQyxFQUFFO0lBQ2QsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDakQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0lBQ2hDLEtBQUssTUFBTSxLQUFLLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFLFVBQVUsQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDOUUsTUFBTSxNQUFNLEdBQUcsV0FBVyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUM3QyxJQUFJLENBQUM7WUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQ3BCLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDckIsQ0FBQztnQkFBUyxDQUFDO1lBQ1QsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNqQixDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sSUFBSSxVQUFVLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7QUFDdkMsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FDdEMsU0FBb0MsRUFDeEIsRUFBRTtJQUNkLElBQ0UsU0FBUyxDQUFDLGFBQWEsQ0FBQyxVQUFVLEtBQUssRUFBRTtXQUN0QyxTQUFTLENBQUMsYUFBYSxDQUFDLFVBQVUsS0FBSyxFQUFFO1dBQ3pDLFNBQVMsQ0FBQyxjQUFjLENBQUMsVUFBVSxLQUFLLEVBQUUsRUFDN0MsQ0FBQztRQUNELE1BQU0sNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQywyQkFBMkIsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUNqRSxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLHlCQUF5QixDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUN4RixNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLHlCQUF5QixDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUN0RixNQUFNLFNBQVMsR0FBRyx3QkFBd0IsQ0FBQyxTQUFTLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQ3RFLE1BQU0sVUFBVSxHQUFHLGlCQUFpQixDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDakUsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDO1FBQ25CLFlBQVk7UUFDWixXQUFXLENBQUMsa0NBQWtDLENBQUM7UUFDL0MsY0FBYyxDQUFDLE9BQU8sQ0FBQztRQUN2QixjQUFjLENBQUMsVUFBVSxDQUFDO1FBQzFCLFdBQVcsQ0FBQyxTQUFTLENBQUM7UUFDdEIsU0FBUyxDQUFDLGFBQWE7UUFDdkIsU0FBUyxDQUFDLGFBQWE7UUFDdkIsY0FBYyxDQUFDLFNBQVMsQ0FBQztRQUN6QixXQUFXLENBQUMsVUFBVSxDQUFDO1FBQ3ZCLFNBQVMsQ0FBQyxjQUFjO0tBQ3pCLENBQUMsQ0FBQztBQUNMLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGNBQWMsR0FBRyxDQUFDLFFBQTJELEVBQVEsRUFBRTtJQUNsRyxRQUFRLEVBQUUsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN4QixRQUFRLEVBQUUsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM3QixRQUFRLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUN4QixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsQ0FBQyxPQUFtQixFQUFFLFFBQW9CLEVBQVcsRUFBRSxDQUNwRixPQUFPLENBQUMsVUFBVSxLQUFLLFFBQVEsQ0FBQyxVQUFVO09BQ3ZDLE9BQU8sQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FBQyJ9

package/dist_ts/smartsecret.plugins.d.ts

@@ -3,4 +3,5 @@ import * as crypto from 'crypto';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-export { childProcess, crypto, fs, os, path };
+import * as smartcrypto from '@push.rocks/smartcrypto';
+export { childProcess, crypto, fs, os, path, smartcrypto };

package/dist_ts/smartsecret.plugins.js

@@ -4,5 +4,7 @@ import * as crypto from 'crypto';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-export { childProcess, crypto, fs, os, path };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnRzZWNyZXQucGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3NtYXJ0c2VjcmV0LnBsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxZQUFZLE1BQU0sZUFBZSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxNQUFNLE1BQU0sUUFBUSxDQUFDO0FBQ2pDLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3pCLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3pCLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBRTdCLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxFQUFFLEVBQUUsRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLENBQUMifQ==
+// @push.rocks scope
+import * as smartcrypto from '@push.rocks/smartcrypto';
+export { childProcess, crypto, fs, os, path, smartcrypto };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnRzZWNyZXQucGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3NtYXJ0c2VjcmV0LnBsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxZQUFZLE1BQU0sZUFBZSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxNQUFNLE1BQU0sUUFBUSxDQUFDO0FBQ2pDLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3pCLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3pCLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBRTdCLG9CQUFvQjtBQUNwQixPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBRXZELE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxFQUFFLEVBQUUsRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLFdBQVcsRUFBRSxDQUFDIn0=

package/package.json

@@ -1,16 +1,11 @@
 {
   "name": "@push.rocks/smartsecret",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "private": false,
   "description": "OS keychain-based secret storage with encrypted-file fallback for Node.js.",
   "main": "dist_ts/index.js",
   "typings": "dist_ts/index.d.ts",
   "type": "module",
-  "scripts": {
-    "test": "(tstest test/ --verbose)",
-    "build": "(tsbuild)",
-    "buildDocs": "tsdoc"
-  },
   "repository": {
     "type": "git",
     "url": "https://code.foss.global/push.rocks/smartsecret.git"
@@ -34,11 +29,10 @@
   },
   "homepage": "https://code.foss.global/push.rocks/smartsecret",
   "devDependencies": {
-    "@git.zone/tsbuild": "^4.1.2",
-    "@git.zone/tsrun": "^2.0.1",
-    "@git.zone/tstest": "^3.1.8",
-    "@push.rocks/tapbundle": "^6.0.3",
-    "@types/node": "^22.15.0"
+    "@git.zone/tsbuild": "^4.4.2",
+    "@git.zone/tsrun": "^2.0.6",
+    "@git.zone/tstest": "^3.6.7",
+    "@types/node": "^22.20.1"
   },
   "files": [
     "ts/**/*",
@@ -49,10 +43,18 @@
     "dist_ts_web/**/*",
     "assets/**/*",
     "cli.js",
-    "npmextra.json",
+    ".smartconfig.json",
     "readme.md"
   ],
   "browserslist": [
     "last 1 chrome versions"
-  ]
-}
+  ],
+  "dependencies": {
+    "@push.rocks/smartcrypto": "^2.2.0"
+  },
+  "scripts": {
+    "test": "(tstest test/ --verbose)",
+    "build": "(tsbuild)",
+    "buildDocs": "tsdoc"
+  }
+}

package/readme.hints.md

@@ -2,7 +2,7 @@
 
 ## Architecture
 - 3-tier backend: macOS Keychain → Linux secret-tool → encrypted file vault
-- Zero runtime dependencies (Node.js built-ins only)
+- The legacy SmartSecret backends use Node.js built-ins only
 - All OS interactions via child_process.execFile (no shell injection)
 
 ## File Backend
@@ -10,3 +10,10 @@
 - Keyfile: auto-generated 32 random bytes at ~/.config/smartsecret/.keyfile (mode 0600)
 - Key derivation: PBKDF2 (SHA-512, 100k iterations, service-name salt)
 - Atomic writes: write .tmp then rename()
+
+## SmartSecret Keyring
+- Separate Linux-only API; it does not alter legacy SmartSecret backend selection or behavior
+- Uses @push.rocks/smartcrypto for AES-GCM payload encryption and DEK wrap/unwrap/rewrap
+- Loads exact 32-byte KEKs from validated absolute credential paths into immutable per-instance snapshots
+- Consumers own envelope persistence and compare-and-swap coordination
+- JavaScript key and plaintext zeroization is best effort

package/readme.md

@@ -2,6 +2,10 @@
 
 OS keychain-based secret storage with encrypted-file fallback for Node.js.
 
+## Issue Reporting and Security
+
+For reporting bugs, issues, or security vulnerabilities, please visit [community.foss.global/](https://community.foss.global/). This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a [code.foss.global/](https://code.foss.global/) account to submit Pull Requests directly.
+
 ## Install
 
 To install `@push.rocks/smartsecret`, use pnpm:
@@ -23,7 +27,7 @@ import { SmartSecret } from '@push.rocks/smartsecret';
 const secretStore = new SmartSecret();
 
 // Or specify a custom service name and vault path
-const secretStore = new SmartSecret({
+const customSecretStore = new SmartSecret({
   service: 'my-application',
   vaultPath: '/path/to/custom/vault.json',
 });
@@ -98,6 +102,76 @@ const appToken = await appSecrets.getSecret('token');  // 'app-token-value'
 const ciToken = await ciSecrets.getSecret('token');     // 'ci-token-value'
 ```
 
+## SmartSecret Keyring
+
+`SmartSecretKeyring` is a separate Node.js API for DEK/KEK envelopes. It does not change `SmartSecret` or any backend API. The keyring is intentionally Linux-only and fails closed on other platforms.
+
+The consumer supplies an ordered key configuration containing exactly one active KEK. Active and retired KEKs are read from absolute credential paths. Each credential must be a regular, non-symlinked, exact 32-byte file without group or world write permissions. Every path component is checked for symlinks, and the loaded key must match its configured SHA-256 fingerprint. Revoked descriptors never contain credential paths or fingerprints.
+
+```typescript
+import { SmartSecretKeyring } from '@push.rocks/smartsecret';
+
+const keyring = await SmartSecretKeyring.create({
+  keyringId: 'billing.production',
+  keys: [
+    {
+      version: 1,
+      status: 'retired',
+      credentialPath: '/run/credentials/billing-kek-v1',
+      expectedFingerprint: 'sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef',
+      createdAt: 1_700_000_000_000,
+      activatedAt: 1_700_000_100_000,
+      retiredAt: 1_710_000_000_000,
+      escrowReference: 'escrow.billing-v1',
+      escrowedAt: 1_700_000_050_000,
+      recoveryTestedAt: 1_700_000_075_000,
+    },
+    {
+      version: 2,
+      status: 'active',
+      credentialPath: '/run/credentials/billing-kek-v2',
+      expectedFingerprint: 'sha256:abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789',
+      createdAt: 1_709_000_000_000,
+      activatedAt: 1_710_000_000_000,
+    },
+  ],
+});
+
+const context = new TextEncoder().encode('tenant:acme/secret:database-password');
+const plaintext = new TextEncoder().encode('secret value');
+
+const envelope = await keyring.encryptEnvelope({
+  envelopeId: 'secret.database-password',
+  plaintext,
+  context,
+});
+
+const decrypted = await keyring.decryptEnvelope({
+  envelope,
+  expectedEnvelopeId: 'secret.database-password',
+  context,
+});
+
+const rewrapped = await keyring.rewrapEnvelope({
+  envelope,
+  expectedEnvelopeId: 'secret.database-password',
+  context,
+  targetVersion: 2,
+});
+
+const recoveryResult = await keyring.recoverySelfTest(2);
+const inspection = keyring.inspect();
+keyring.destroy();
+```
+
+`encryptEnvelope()` always uses the sole active KEK. `decryptEnvelope()` permits active and retired KEKs, but rejects revoked and unknown versions. `rewrapEnvelope()` authenticates the current wrapper and context, then calls SmartCrypto's DEK rewrap operation without decrypting the payload. It preserves the payload nonce, ciphertext, and tag exactly.
+
+The profile is fixed to `smartsecret-aes-256-gcm-dek-kek-v1`. Payloads may contain 0 through 524,288 bytes. Context is mandatory and may contain 1 through 65,536 bytes. Identifiers use the pattern `^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$` and are limited to 200 UTF-8 bytes.
+
+Key loading is an immutable per-instance snapshot. Replacing a credential file does not reload an existing keyring; create a new instance and swap it at the application boundary. `destroy()` marks an instance unusable and best-effort wipes retained key arrays. Operation-owned key, plaintext, and context copies are also wiped in `finally` blocks. JavaScript runtimes, garbage collectors, and native cryptographic implementations can retain copies outside package control, so zeroization is best effort rather than a hard memory-erasure guarantee.
+
+The package never persists envelopes. The consumer owns durable envelope storage, compare-and-swap coordination during rewrap, and any metadata updates after recovery testing.
+
 ## API Reference
 
 ### `SmartSecret`
@@ -125,6 +199,25 @@ new SmartSecret(options?: ISmartSecretOptions)
 | `listAccounts` | `() => Promise<string[]>` | List all account names for the configured service |
 | `getBackendType` | `() => Promise<TBackendType>` | Returns the active backend identifier |
 
+### `SmartSecretKeyring`
+
+Create keyrings through the asynchronous factory. The constructor is not public.
+
+```typescript
+SmartSecretKeyring.create(config: ISmartSecretKeyringConfig): Promise<SmartSecretKeyring>
+```
+
+| Method | Signature | Description |
+| --- | --- | --- |
+| `encryptEnvelope` | `(options: IEncryptSmartSecretEnvelopeOptions) => Promise<ISmartSecretEnvelopeV1>` | Encrypt with a random DEK and wrap it under the active KEK |
+| `decryptEnvelope` | `(options: IDecryptSmartSecretEnvelopeOptions) => Promise<Uint8Array>` | Strictly parse, authenticate, and decrypt an envelope |
+| `rewrapEnvelope` | `(options: IRewrapSmartSecretEnvelopeOptions) => Promise<ISmartSecretEnvelopeV1>` | Rewrap only the DEK under the active KEK |
+| `recoverySelfTest` | `(version: number) => Promise<ISmartSecretRecoverySelfTestResult>` | Wrap and unwrap a synthetic random DEK for an active or retired version |
+| `inspect` | `() => ISmartSecretKeyringInspection` | Return cloned, value-free metadata without credential paths or key bytes |
+| `destroy` | `() => void` | Mark the instance unusable and best-effort wipe retained key arrays |
+
+All keyring failures are `SmartSecretKeyringError` instances with a stable `TSmartSecretKeyringErrorCode`. Their message, JSON representation, Node.js inspection output, and stack contain only the code and fixed package boilerplate. Filesystem and SmartCrypto causes are not retained.
+
 ### Types
 
 ```typescript
@@ -188,6 +281,21 @@ Both paths can be influenced by providing a custom `vaultPath` in the constructo
 
 ## License and Legal Information
 
-This project is licensed under the MIT license. For more details, see the `license` file in the repository.
+This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the repository license file.
+
+**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.
+
+### Trademarks
+
+This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH or third parties, and are not included within the scope of the MIT license granted herein.
+
+Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines or the guidelines of the respective third-party owners, and any usage must be approved in writing. Third-party trademarks used herein are the property of their respective owners and used only in a descriptive manner, e.g. for an implementation of an API or similar.
+
+### Company Information
+
+Task Venture Capital GmbH<br>
+Registered at District Court Bremen HRB 35230 HB, Germany
+
+For any legal inquiries or further information, please contact us via email at hello@task.vc.
 
-By using this package, you agree to the licensing terms.
+By using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartsecret',
-  version: '1.0.1',
+  version: '1.1.0',
   description: 'OS keychain-based secret storage with encrypted-file fallback for Node.js.'
 }

package/ts/index.ts

@@ -3,3 +3,13 @@ export type { ISecretBackend, TBackendType } from './smartsecret.backends.base.j
 export { MacosKeychainBackend } from './smartsecret.backends.macos.js';
 export { LinuxSecretServiceBackend } from './smartsecret.backends.linux.js';
 export { FileEncryptedBackend } from './smartsecret.backends.file.js';
+export * from './smartsecret.keyring.js';
+export { SmartSecretKeyringError } from './smartsecret.keyring.error.js';
+export type {
+  ISmartSecretKeyringErrorJson,
+  TSmartSecretKeyringErrorCode,
+} from './smartsecret.keyring.error.js';
+export type {
+  ISmartSecretEnvelopeV1,
+  TSmartSecretKeyringProfile,
+} from './smartsecret.keyring.protocol.js';