@push.rocks/smartsecret 1.0.2 → 1.2.0

package/dist_ts/smartsecret.keyring.protocol.d.ts

@@ -0,0 +1,57 @@
+import * as plugins from './smartsecret.plugins.js';
+export declare const SMARTSECRET_KEYRING_SCHEMA_VERSION: 1;
+export declare const SMARTSECRET_KEYRING_PROFILE: "smartsecret-aes-256-gcm-dek-kek-v1";
+export type TSmartSecretKeyringProfile = typeof SMARTSECRET_KEYRING_PROFILE;
+export declare const SMARTSECRET_KEYRING_MAX_PAYLOAD_BYTES = 524288;
+export declare const SMARTSECRET_KEYRING_MIN_CONTEXT_BYTES = 1;
+export declare const SMARTSECRET_KEYRING_MAX_CONTEXT_BYTES = 65536;
+export declare const SMARTSECRET_KEYRING_MAX_IDENTIFIER_BYTES = 200;
+export declare const SMARTSECRET_KEYRING_MAX_KEK_VERSION = 2147483647;
+export interface ISmartSecretEnvelopeCiphertext {
+    nonce: string;
+    ciphertext: string;
+    tag: string;
+}
+export interface ISmartSecretEnvelopeV1 {
+    schemaVersion: 1;
+    profile: TSmartSecretKeyringProfile;
+    envelopeId: string;
+    createdAt: number;
+    contextDigest: string;
+    kek: {
+        keyringId: string;
+        version: number;
+        fingerprint: `sha256:${string}`;
+    };
+    payload: ISmartSecretEnvelopeCiphertext;
+    wrappedDek: ISmartSecretEnvelopeCiphertext;
+}
+export interface IParsedSmartSecretEnvelopeV1 {
+    envelope: ISmartSecretEnvelopeV1;
+    contextDigest: Uint8Array;
+    kekFingerprint: Uint8Array;
+    payload: plugins.smartcrypto.IAesGcmCiphertext;
+    wrappedDek: plugins.smartcrypto.IAesGcmCiphertext;
+}
+export interface ISmartSecretWrapAadFields {
+    envelopeId: string;
+    createdAt: number;
+    contextDigest: Uint8Array;
+    payloadDigest: Uint8Array;
+    keyringId: string;
+    kekVersion: number;
+    kekFingerprint: Uint8Array;
+}
+export declare const requireSmartSecretIdentifier: (valueArg: unknown) => string;
+export declare const requireEnvelopeIdentifier: (valueArg: unknown) => string;
+export declare const requireKekVersion: (valueArg: unknown, envelopeArg?: boolean) => number;
+export declare const requireEpochMilliseconds: (valueArg: unknown, envelopeArg?: boolean) => number;
+export declare const requireFingerprint: (valueArg: unknown, envelopeArg?: boolean) => `sha256:${string}`;
+export declare const fingerprintToBytes: (valueArg: `sha256:${string}`) => Uint8Array;
+export declare const encodeCanonicalBase64Url: (valueArg: Uint8Array) => string;
+export declare const parseSmartSecretEnvelope: (valueArg: unknown) => IParsedSmartSecretEnvelopeV1;
+export declare const sha256Bytes: (...valuesArg: Uint8Array[]) => Uint8Array;
+export declare const createSmartSecretPayloadDigest: (payloadArg: plugins.smartcrypto.IAesGcmCiphertext) => Uint8Array;
+export declare const createSmartSecretWrapAad: (fieldsArg: ISmartSecretWrapAadFields) => Uint8Array;
+export declare const wipeCiphertext: (valueArg: plugins.smartcrypto.IAesGcmCiphertext | undefined) => void;
+export declare const timingSafeEqual: (leftArg: Uint8Array, rightArg: Uint8Array) => boolean;

package/dist_ts/smartsecret.keyring.protocol.js

@@ -0,0 +1,290 @@
+import * as plugins from './smartsecret.plugins.js';
+import { SmartSecretKeyringError, createSmartSecretKeyringError, } from './smartsecret.keyring.error.js';
+export const SMARTSECRET_KEYRING_SCHEMA_VERSION = 1;
+export const SMARTSECRET_KEYRING_PROFILE = 'smartsecret-aes-256-gcm-dek-kek-v1';
+export const SMARTSECRET_KEYRING_MAX_PAYLOAD_BYTES = 524_288;
+export const SMARTSECRET_KEYRING_MIN_CONTEXT_BYTES = 1;
+export const SMARTSECRET_KEYRING_MAX_CONTEXT_BYTES = 65_536;
+export const SMARTSECRET_KEYRING_MAX_IDENTIFIER_BYTES = 200;
+export const SMARTSECRET_KEYRING_MAX_KEK_VERSION = 2_147_483_647;
+const identifierPattern = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
+const fingerprintPattern = /^sha256:[0-9a-f]{64}$/;
+const base64UrlPattern = /^[A-Za-z0-9_-]*$/;
+const wrapAadMagic = Buffer.from('smartsecret-envelope-wrap-aad-v1', 'ascii');
+const payloadDigestMagic = Buffer.from('smartsecret-envelope-payload-digest-v1', 'ascii');
+const requirePlainObject = (valueArg, expectedKeysArg) => {
+    try {
+        if (valueArg === null || typeof valueArg !== 'object' || Array.isArray(valueArg)) {
+            throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+        }
+        const prototype = Object.getPrototypeOf(valueArg);
+        if (prototype !== Object.prototype && prototype !== null) {
+            throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+        }
+        const ownKeys = Reflect.ownKeys(valueArg);
+        if (ownKeys.length !== expectedKeysArg.length
+            || ownKeys.some((keyArg) => typeof keyArg !== 'string')) {
+            throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+        }
+        const actualKeys = ownKeys;
+        if (expectedKeysArg.some((keyArg) => !actualKeys.includes(keyArg))) {
+            throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+        }
+        const result = Object.create(null);
+        for (const key of actualKeys) {
+            const descriptor = Object.getOwnPropertyDescriptor(valueArg, key);
+            if (!descriptor?.enumerable || !('value' in descriptor)) {
+                throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+            }
+            result[key] = descriptor.value;
+        }
+        return result;
+    }
+    catch (error) {
+        if (error instanceof SmartSecretKeyringError) {
+            throw error;
+        }
+        throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+    }
+};
+export const requireSmartSecretIdentifier = (valueArg) => {
+    if (typeof valueArg !== 'string'
+        || !identifierPattern.test(valueArg)
+        || Buffer.byteLength(valueArg, 'utf8') < 1
+        || Buffer.byteLength(valueArg, 'utf8') > SMARTSECRET_KEYRING_MAX_IDENTIFIER_BYTES) {
+        throw createSmartSecretKeyringError('CONFIG_INVALID');
+    }
+    return valueArg;
+};
+export const requireEnvelopeIdentifier = (valueArg) => {
+    try {
+        return requireSmartSecretIdentifier(valueArg);
+    }
+    catch {
+        throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+    }
+};
+export const requireKekVersion = (valueArg, envelopeArg = false) => {
+    if (!Number.isSafeInteger(valueArg)
+        || valueArg < 1
+        || valueArg > SMARTSECRET_KEYRING_MAX_KEK_VERSION) {
+        throw createSmartSecretKeyringError(envelopeArg ? 'ENVELOPE_INVALID' : 'CONFIG_INVALID');
+    }
+    return valueArg;
+};
+export const requireEpochMilliseconds = (valueArg, envelopeArg = false) => {
+    if (!Number.isSafeInteger(valueArg) || valueArg < 0) {
+        throw createSmartSecretKeyringError(envelopeArg ? 'ENVELOPE_INVALID' : 'CONFIG_INVALID');
+    }
+    return valueArg;
+};
+export const requireFingerprint = (valueArg, envelopeArg = false) => {
+    if (typeof valueArg !== 'string' || !fingerprintPattern.test(valueArg)) {
+        throw createSmartSecretKeyringError(envelopeArg ? 'ENVELOPE_INVALID' : 'CONFIG_INVALID');
+    }
+    return valueArg;
+};
+export const fingerprintToBytes = (valueArg) => new Uint8Array(Buffer.from(valueArg.slice('sha256:'.length), 'hex'));
+export const encodeCanonicalBase64Url = (valueArg) => Buffer.from(valueArg).toString('base64url');
+const decodeCanonicalBase64Url = (valueArg, maximumBytesArg, exactBytesArg) => {
+    if (typeof valueArg !== 'string') {
+        throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+    }
+    const maximumEncodedLength = Math.ceil(maximumBytesArg * 4 / 3);
+    if (valueArg.length > maximumEncodedLength) {
+        throw createSmartSecretKeyringError('SIZE_LIMIT_EXCEEDED');
+    }
+    if (!base64UrlPattern.test(valueArg) || valueArg.length % 4 === 1) {
+        throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+    }
+    let result;
+    let decodedBuffer;
+    let didSucceed = false;
+    try {
+        decodedBuffer = Buffer.from(valueArg, 'base64url');
+        result = new Uint8Array(decodedBuffer);
+        if (result.byteLength > maximumBytesArg) {
+            throw createSmartSecretKeyringError('SIZE_LIMIT_EXCEEDED');
+        }
+        if (exactBytesArg !== undefined && result.byteLength !== exactBytesArg) {
+            throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+        }
+        if (encodeCanonicalBase64Url(result) !== valueArg) {
+            throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+        }
+        didSucceed = true;
+        return result;
+    }
+    catch (error) {
+        if (error instanceof SmartSecretKeyringError) {
+            throw error;
+        }
+        throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+    }
+    finally {
+        decodedBuffer?.fill(0);
+        if (!didSucceed) {
+            result?.fill(0);
+        }
+    }
+};
+const parseCiphertext = (valueArg, maximumCiphertextBytesArg, exactCiphertextBytesArg) => {
+    const value = requirePlainObject(valueArg, ['nonce', 'ciphertext', 'tag']);
+    let nonce;
+    let ciphertext;
+    let tag;
+    let didSucceed = false;
+    try {
+        nonce = decodeCanonicalBase64Url(value.nonce, 12, 12);
+        ciphertext = decodeCanonicalBase64Url(value.ciphertext, maximumCiphertextBytesArg, exactCiphertextBytesArg);
+        tag = decodeCanonicalBase64Url(value.tag, 16, 16);
+        const result = {
+            encoded: {
+                nonce: value.nonce,
+                ciphertext: value.ciphertext,
+                tag: value.tag,
+            },
+            raw: { nonce, ciphertext, tag },
+        };
+        didSucceed = true;
+        return result;
+    }
+    finally {
+        if (!didSucceed) {
+            nonce?.fill(0);
+            ciphertext?.fill(0);
+            tag?.fill(0);
+        }
+    }
+};
+export const parseSmartSecretEnvelope = (valueArg) => {
+    const value = requirePlainObject(valueArg, [
+        'schemaVersion',
+        'profile',
+        'envelopeId',
+        'createdAt',
+        'contextDigest',
+        'kek',
+        'payload',
+        'wrappedDek',
+    ]);
+    if (value.schemaVersion !== SMARTSECRET_KEYRING_SCHEMA_VERSION) {
+        throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+    }
+    if (value.profile !== SMARTSECRET_KEYRING_PROFILE) {
+        throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+    }
+    let contextDigest;
+    let kekFingerprint;
+    let payload;
+    let wrappedDek;
+    let didSucceed = false;
+    try {
+        const envelopeId = requireEnvelopeIdentifier(value.envelopeId);
+        const createdAt = requireEpochMilliseconds(value.createdAt, true);
+        contextDigest = decodeCanonicalBase64Url(value.contextDigest, 32, 32);
+        const kekValue = requirePlainObject(value.kek, ['keyringId', 'version', 'fingerprint']);
+        const keyringId = requireEnvelopeIdentifier(kekValue.keyringId);
+        const version = requireKekVersion(kekValue.version, true);
+        const fingerprint = requireFingerprint(kekValue.fingerprint, true);
+        kekFingerprint = fingerprintToBytes(fingerprint);
+        payload = parseCiphertext(value.payload, SMARTSECRET_KEYRING_MAX_PAYLOAD_BYTES);
+        wrappedDek = parseCiphertext(value.wrappedDek, 32, 32);
+        const result = {
+            envelope: {
+                schemaVersion: SMARTSECRET_KEYRING_SCHEMA_VERSION,
+                profile: SMARTSECRET_KEYRING_PROFILE,
+                envelopeId,
+                createdAt,
+                contextDigest: value.contextDigest,
+                kek: { keyringId, version, fingerprint },
+                payload: payload.encoded,
+                wrappedDek: wrappedDek.encoded,
+            },
+            contextDigest,
+            kekFingerprint,
+            payload: payload.raw,
+            wrappedDek: wrappedDek.raw,
+        };
+        didSucceed = true;
+        return result;
+    }
+    finally {
+        if (!didSucceed) {
+            contextDigest?.fill(0);
+            kekFingerprint?.fill(0);
+            wipeCiphertext(payload?.raw);
+            wipeCiphertext(wrappedDek?.raw);
+        }
+    }
+};
+export const sha256Bytes = (...valuesArg) => {
+    const hash = plugins.crypto.createHash('sha256');
+    for (const value of valuesArg) {
+        hash.update(value);
+    }
+    return new Uint8Array(hash.digest());
+};
+const uint32Bytes = (valueArg) => {
+    const result = Buffer.allocUnsafe(4);
+    result.writeUInt32BE(valueArg, 0);
+    return result;
+};
+const uint64Bytes = (valueArg) => {
+    const result = Buffer.allocUnsafe(8);
+    result.writeBigUInt64BE(BigInt(valueArg), 0);
+    return result;
+};
+const lengthPrefixed = (valueArg) => {
+    if (valueArg.byteLength > 0xffff_ffff) {
+        throw createSmartSecretKeyringError('SIZE_LIMIT_EXCEEDED');
+    }
+    return Buffer.concat([uint32Bytes(valueArg.byteLength), valueArg]);
+};
+export const createSmartSecretPayloadDigest = (payloadArg) => {
+    const hash = plugins.crypto.createHash('sha256');
+    hash.update(payloadDigestMagic);
+    for (const value of [payloadArg.nonce, payloadArg.ciphertext, payloadArg.tag]) {
+        const length = uint32Bytes(value.byteLength);
+        try {
+            hash.update(length);
+            hash.update(value);
+        }
+        finally {
+            length.fill(0);
+        }
+    }
+    return new Uint8Array(hash.digest());
+};
+export const createSmartSecretWrapAad = (fieldsArg) => {
+    if (fieldsArg.contextDigest.byteLength !== 32
+        || fieldsArg.payloadDigest.byteLength !== 32
+        || fieldsArg.kekFingerprint.byteLength !== 32) {
+        throw createSmartSecretKeyringError('ENVELOPE_INVALID');
+    }
+    const profile = Buffer.from(SMARTSECRET_KEYRING_PROFILE, 'utf8');
+    const envelopeId = Buffer.from(requireEnvelopeIdentifier(fieldsArg.envelopeId), 'utf8');
+    const keyringId = Buffer.from(requireEnvelopeIdentifier(fieldsArg.keyringId), 'utf8');
+    const createdAt = requireEpochMilliseconds(fieldsArg.createdAt, true);
+    const kekVersion = requireKekVersion(fieldsArg.kekVersion, true);
+    return Buffer.concat([
+        wrapAadMagic,
+        uint64Bytes(SMARTSECRET_KEYRING_SCHEMA_VERSION),
+        lengthPrefixed(profile),
+        lengthPrefixed(envelopeId),
+        uint64Bytes(createdAt),
+        fieldsArg.contextDigest,
+        fieldsArg.payloadDigest,
+        lengthPrefixed(keyringId),
+        uint64Bytes(kekVersion),
+        fieldsArg.kekFingerprint,
+    ]);
+};
+export const wipeCiphertext = (valueArg) => {
+    valueArg?.nonce.fill(0);
+    valueArg?.ciphertext.fill(0);
+    valueArg?.tag.fill(0);
+};
+export const timingSafeEqual = (leftArg, rightArg) => leftArg.byteLength === rightArg.byteLength
+    && plugins.crypto.timingSafeEqual(leftArg, rightArg);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnRzZWNyZXQua2V5cmluZy5wcm90b2NvbC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3NtYXJ0c2VjcmV0LmtleXJpbmcucHJvdG9jb2wudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSwwQkFBMEIsQ0FBQztBQUNwRCxPQUFPLEVBQ0wsdUJBQXVCLEVBQ3ZCLDZCQUE2QixHQUM5QixNQUFNLGdDQUFnQyxDQUFDO0FBRXhDLE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQVUsQ0FBQztBQUM3RCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxvQ0FBNkMsQ0FBQztBQUd6RixNQUFNLENBQUMsTUFBTSxxQ0FBcUMsR0FBRyxPQUFPLENBQUM7QUFDN0QsTUFBTSxDQUFDLE1BQU0scUNBQXFDLEdBQUcsQ0FBQyxDQUFDO0FBQ3ZELE1BQU0sQ0FBQyxNQUFNLHFDQUFxQyxHQUFHLE1BQU0sQ0FBQztBQUM1RCxNQUFNLENBQUMsTUFBTSx3Q0FBd0MsR0FBRyxHQUFHLENBQUM7QUFDNUQsTUFBTSxDQUFDLE1BQU0sbUNBQW1DLEdBQUcsYUFBYSxDQUFDO0FBRWpFLE1BQU0saUJBQWlCLEdBQUcscUNBQXFDLENBQUM7QUFDaEUsTUFBTSxrQkFBa0IsR0FBRyx1QkFBdUIsQ0FBQztBQUNuRCxNQUFNLGdCQUFnQixHQUFHLGtCQUFrQixDQUFDO0FBQzVDLE1BQU0sWUFBWSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsa0NBQWtDLEVBQUUsT0FBTyxDQUFDLENBQUM7QUFDOUUsTUFBTSxrQkFBa0IsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLHdDQUF3QyxFQUFFLE9BQU8sQ0FBQyxDQUFDO0FBeUMxRixNQUFNLGtCQUFrQixHQUFHLENBQ3pCLFFBQWlCLEVBQ2pCLGVBQWtDLEVBQ1QsRUFBRTtJQUMzQixJQUFJLENBQUM7UUFDSCxJQUFJLFFBQVEsS0FBSyxJQUFJLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUNqRixNQUFNLDZCQUE2QixDQUFDLGtCQUFrQixDQUFDLENBQUM7UUFDMUQsQ0FBQztRQUNELE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDbEQsSUFBSSxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVMsSUFBSSxTQUFTLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDekQsTUFBTSw2QkFBNkIsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBQzFELENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQzFDLElBQ0UsT0FBTyxDQUFDLE1BQU0sS0FBSyxlQUFlLENBQUMsTUFBTTtlQUN0QyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxPQUFPLE1BQU0sS0FBSyxRQUFRLENBQUMsRUFDdkQsQ0FBQztZQUNELE1BQU0sNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztRQUMxRCxDQUFDO1FBQ0QsTUFBTSxVQUFVLEdBQUcsT0FBbUIsQ0FBQztRQUN2QyxJQUFJLGVBQWUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDbkUsTUFBTSw2QkFBNkIsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBQzFELENBQUM7UUFDRCxNQUFNLE1BQU0sR0FBNEIsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM1RCxLQUFLLE1BQU0sR0FBRyxJQUFJLFVBQVUsRUFBRSxDQUFDO1lBQzdCLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLEVBQUUsR0FBRyxDQUFDLENBQUM7WUFDbEUsSUFBSSxDQUFDLFVBQVUsRUFBRSxVQUFVLElBQUksQ0FBQyxDQUFDLE9BQU8sSUFBSSxVQUFVLENBQUMsRUFBRSxDQUFDO2dCQUN4RCxNQUFNLDZCQUE2QixDQUFDLGtCQUFrQixDQUFDLENBQUM7WUFDMUQsQ0FBQztZQUNELE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDO1FBQ2pDLENBQUM7UUFDRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLElBQUksS0FBSyxZQUFZLHVCQUF1QixFQUFFLENBQUM7WUFDN0MsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDO1FBQ0QsTUFBTSw2QkFBNkIsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0lBQzFELENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUN4RSxJQUNFLE9BQU8sUUFBUSxLQUFLLFFBQVE7V0FDekIsQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDO1dBQ2pDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUM7V0FDdkMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLEdBQUcsd0NBQXdDLEVBQ2pGLENBQUM7UUFDRCxNQUFNLDZCQUE2QixDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQ3JFLElBQUksQ0FBQztRQUNILE9BQU8sNEJBQTRCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE1BQU0sNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztJQUMxRCxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLFdBQVcsR0FBRyxLQUFLLEVBQVUsRUFBRTtJQUNsRixJQUNFLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUM7V0FDM0IsUUFBbUIsR0FBRyxDQUFDO1dBQ3ZCLFFBQW1CLEdBQUcsbUNBQW1DLEVBQzdELENBQUM7UUFDRCxNQUFNLDZCQUE2QixDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsa0JBQWtCLENBQUMsQ0FBQyxDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDM0YsQ0FBQztJQUNELE9BQU8sUUFBa0IsQ0FBQztBQUM1QixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxDQUFDLFFBQWlCLEVBQUUsV0FBVyxHQUFHLEtBQUssRUFBVSxFQUFFO0lBQ3pGLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQW1CLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDaEUsTUFBTSw2QkFBNkIsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLGtCQUFrQixDQUFDLENBQUMsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQzNGLENBQUM7SUFDRCxPQUFPLFFBQWtCLENBQUM7QUFDNUIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLFdBQVcsR0FBRyxLQUFLLEVBQXNCLEVBQUU7SUFDL0YsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUN2RSxNQUFNLDZCQUE2QixDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsa0JBQWtCLENBQUMsQ0FBQyxDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDM0YsQ0FBQztJQUNELE9BQU8sUUFBOEIsQ0FBQztBQUN4QyxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLFFBQTRCLEVBQWMsRUFBRSxDQUM3RSxJQUFJLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUM7QUFFdkUsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxRQUFvQixFQUFVLEVBQUUsQ0FDdkUsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUM7QUFFOUMsTUFBTSx3QkFBd0IsR0FBRyxDQUMvQixRQUFpQixFQUNqQixlQUF1QixFQUN2QixhQUFzQixFQUNWLEVBQUU7SUFDZCxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ2pDLE1BQU0sNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLGVBQWUsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDaEUsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLG9CQUFvQixFQUFFLENBQUM7UUFDM0MsTUFBTSw2QkFBNkIsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO0lBQzdELENBQUM7SUFDRCxJQUFJLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2xFLE1BQU0sNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsSUFBSSxNQUE4QixDQUFDO0lBQ25DLElBQUksYUFBaUMsQ0FBQztJQUN0QyxJQUFJLFVBQVUsR0FBRyxLQUFLLENBQUM7SUFDdkIsSUFBSSxDQUFDO1FBQ0gsYUFBYSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLFdBQVcsQ0FBQyxDQUFDO1FBQ25ELE1BQU0sR0FBRyxJQUFJLFVBQVUsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUN2QyxJQUFJLE1BQU0sQ0FBQyxVQUFVLEdBQUcsZUFBZSxFQUFFLENBQUM7WUFDeEMsTUFBTSw2QkFBNkIsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO1FBQzdELENBQUM7UUFDRCxJQUFJLGFBQWEsS0FBSyxTQUFTLElBQUksTUFBTSxDQUFDLFVBQVUsS0FBSyxhQUFhLEVBQUUsQ0FBQztZQUN2RSxNQUFNLDZCQUE2QixDQUFDLGtCQUFrQixDQUFDLENBQUM7UUFDMUQsQ0FBQztRQUNELElBQUksd0JBQXdCLENBQUMsTUFBTSxDQUFDLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDbEQsTUFBTSw2QkFBNkIsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBQzFELENBQUM7UUFDRCxVQUFVLEdBQUcsSUFBSSxDQUFDO1FBQ2xCLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxLQUFLLFlBQVksdUJBQXVCLEVBQUUsQ0FBQztZQUM3QyxNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7UUFDRCxNQUFNLDZCQUE2QixDQUFDLGtCQUFrQixDQUFDLENBQUM7SUFDMUQsQ0FBQztZQUFTLENBQUM7UUFDVCxhQUFhLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3ZCLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUNoQixNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2xCLENBQUM7SUFDSCxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxlQUFlLEdBQUcsQ0FDdEIsUUFBaUIsRUFDakIseUJBQWlDLEVBQ2pDLHVCQUFnQyxFQUN5RCxFQUFFO0lBQzNGLE1BQU0sS0FBSyxHQUFHLGtCQUFrQixDQUFDLFFBQVEsRUFBRSxDQUFDLE9BQU8sRUFBRSxZQUFZLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUMzRSxJQUFJLEtBQTZCLENBQUM7SUFDbEMsSUFBSSxVQUFrQyxDQUFDO0lBQ3ZDLElBQUksR0FBMkIsQ0FBQztJQUNoQyxJQUFJLFVBQVUsR0FBRyxLQUFLLENBQUM7SUFDdkIsSUFBSSxDQUFDO1FBQ0gsS0FBSyxHQUFHLHdCQUF3QixDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3RELFVBQVUsR0FBRyx3QkFBd0IsQ0FDbkMsS0FBSyxDQUFDLFVBQVUsRUFDaEIseUJBQXlCLEVBQ3pCLHVCQUF1QixDQUN4QixDQUFDO1FBQ0YsR0FBRyxHQUFHLHdCQUF3QixDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ2xELE1BQU0sTUFBTSxHQUFHO1lBQ2IsT0FBTyxFQUFFO2dCQUNQLEtBQUssRUFBRSxLQUFLLENBQUMsS0FBZTtnQkFDNUIsVUFBVSxFQUFFLEtBQUssQ0FBQyxVQUFvQjtnQkFDdEMsR0FBRyxFQUFFLEtBQUssQ0FBQyxHQUFhO2FBQ3pCO1lBQ0QsR0FBRyxFQUFFLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxHQUFHLEVBQUU7U0FDaEMsQ0FBQztRQUNGLFVBQVUsR0FBRyxJQUFJLENBQUM7UUFDbEIsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztZQUFTLENBQUM7UUFDVCxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDaEIsS0FBSyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNmLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDcEIsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNmLENBQUM7SUFDSCxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxRQUFpQixFQUFnQyxFQUFFO0lBQzFGLE1BQU0sS0FBSyxHQUFHLGtCQUFrQixDQUFDLFFBQVEsRUFBRTtRQUN6QyxlQUFlO1FBQ2YsU0FBUztRQUNULFlBQVk7UUFDWixXQUFXO1FBQ1gsZUFBZTtRQUNmLEtBQUs7UUFDTCxTQUFTO1FBQ1QsWUFBWTtLQUNiLENBQUMsQ0FBQztJQUNILElBQUksS0FBSyxDQUFDLGFBQWEsS0FBSyxrQ0FBa0MsRUFBRSxDQUFDO1FBQy9ELE1BQU0sNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsSUFBSSxLQUFLLENBQUMsT0FBTyxLQUFLLDJCQUEyQixFQUFFLENBQUM7UUFDbEQsTUFBTSw2QkFBNkIsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFDRCxJQUFJLGFBQXFDLENBQUM7SUFDMUMsSUFBSSxjQUFzQyxDQUFDO0lBQzNDLElBQUksT0FBdUQsQ0FBQztJQUM1RCxJQUFJLFVBQTBELENBQUM7SUFDL0QsSUFBSSxVQUFVLEdBQUcsS0FBSyxDQUFDO0lBQ3ZCLElBQUksQ0FBQztRQUNILE1BQU0sVUFBVSxHQUFHLHlCQUF5QixDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUMvRCxNQUFNLFNBQVMsR0FBRyx3QkFBd0IsQ0FBQyxLQUFLLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ2xFLGFBQWEsR0FBRyx3QkFBd0IsQ0FBQyxLQUFLLENBQUMsYUFBYSxFQUFFLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUN0RSxNQUFNLFFBQVEsR0FBRyxrQkFBa0IsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsV0FBVyxFQUFFLFNBQVMsRUFBRSxhQUFhLENBQUMsQ0FBQyxDQUFDO1FBQ3hGLE1BQU0sU0FBUyxHQUFHLHlCQUF5QixDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNoRSxNQUFNLE9BQU8sR0FBRyxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzFELE1BQU0sV0FBVyxHQUFHLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxXQUFXLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDbkUsY0FBYyxHQUFHLGtCQUFrQixDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ2pELE9BQU8sR0FBRyxlQUFlLENBQUMsS0FBSyxDQUFDLE9BQU8sRUFBRSxxQ0FBcUMsQ0FBQyxDQUFDO1FBQ2hGLFVBQVUsR0FBRyxlQUFlLENBQUMsS0FBSyxDQUFDLFVBQVUsRUFBRSxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDdkQsTUFBTSxNQUFNLEdBQUc7WUFDYixRQUFRLEVBQUU7Z0JBQ1IsYUFBYSxFQUFFLGtDQUFrQztnQkFDakQsT0FBTyxFQUFFLDJCQUEyQjtnQkFDcEMsVUFBVTtnQkFDVixTQUFTO2dCQUNULGFBQWEsRUFBRSxLQUFLLENBQUMsYUFBdUI7Z0JBQzVDLEdBQUcsRUFBRSxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFO2dCQUN4QyxPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU87Z0JBQ3hCLFVBQVUsRUFBRSxVQUFVLENBQUMsT0FBTzthQUMvQjtZQUNELGFBQWE7WUFDYixjQUFjO1lBQ2QsT0FBTyxFQUFFLE9BQU8sQ0FBQyxHQUFHO1lBQ3BCLFVBQVUsRUFBRSxVQUFVLENBQUMsR0FBRztTQUMzQixDQUFDO1FBQ0YsVUFBVSxHQUFHLElBQUksQ0FBQztRQUNsQixPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO1lBQVMsQ0FBQztRQUNULElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUNoQixhQUFhLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ3ZCLGNBQWMsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDeEIsY0FBYyxDQUFDLE9BQU8sRUFBRSxHQUFHLENBQUMsQ0FBQztZQUM3QixjQUFjLENBQUMsVUFBVSxFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQ2xDLENBQUM7SUFDSCxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sV0FBVyxHQUFHLENBQUMsR0FBRyxTQUF1QixFQUFjLEVBQUU7SUFDcEUsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDakQsS0FBSyxNQUFNLEtBQUssSUFBSSxTQUFTLEVBQUUsQ0FBQztRQUM5QixJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3JCLENBQUM7SUFDRCxPQUFPLElBQUksVUFBVSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO0FBQ3ZDLENBQUMsQ0FBQztBQUVGLE1BQU0sV0FBVyxHQUFHLENBQUMsUUFBZ0IsRUFBYyxFQUFFO0lBQ25ELE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDckMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDbEMsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxXQUFXLEdBQUcsQ0FBQyxRQUFnQixFQUFjLEVBQUU7SUFDbkQsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNyQyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQzdDLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sY0FBYyxHQUFHLENBQUMsUUFBb0IsRUFBYyxFQUFFO0lBQzFELElBQUksUUFBUSxDQUFDLFVBQVUsR0FBRyxXQUFXLEVBQUUsQ0FBQztRQUN0QyxNQUFNLDZCQUE2QixDQUFDLHFCQUFxQixDQUFDLENBQUM7SUFDN0QsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztBQUNyRSxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxDQUM1QyxVQUFpRCxFQUNyQyxFQUFFO0lBQ2QsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDakQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0lBQ2hDLEtBQUssTUFBTSxLQUFLLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFLFVBQVUsQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDOUUsTUFBTSxNQUFNLEdBQUcsV0FBVyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUM3QyxJQUFJLENBQUM7WUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQ3BCLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDckIsQ0FBQztnQkFBUyxDQUFDO1lBQ1QsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNqQixDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sSUFBSSxVQUFVLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7QUFDdkMsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FDdEMsU0FBb0MsRUFDeEIsRUFBRTtJQUNkLElBQ0UsU0FBUyxDQUFDLGFBQWEsQ0FBQyxVQUFVLEtBQUssRUFBRTtXQUN0QyxTQUFTLENBQUMsYUFBYSxDQUFDLFVBQVUsS0FBSyxFQUFFO1dBQ3pDLFNBQVMsQ0FBQyxjQUFjLENBQUMsVUFBVSxLQUFLLEVBQUUsRUFDN0MsQ0FBQztRQUNELE1BQU0sNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQywyQkFBMkIsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUNqRSxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLHlCQUF5QixDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUN4RixNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLHlCQUF5QixDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUN0RixNQUFNLFNBQVMsR0FBRyx3QkFBd0IsQ0FBQyxTQUFTLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQ3RFLE1BQU0sVUFBVSxHQUFHLGlCQUFpQixDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDakUsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDO1FBQ25CLFlBQVk7UUFDWixXQUFXLENBQUMsa0NBQWtDLENBQUM7UUFDL0MsY0FBYyxDQUFDLE9BQU8sQ0FBQztRQUN2QixjQUFjLENBQUMsVUFBVSxDQUFDO1FBQzFCLFdBQVcsQ0FBQyxTQUFTLENBQUM7UUFDdEIsU0FBUyxDQUFDLGFBQWE7UUFDdkIsU0FBUyxDQUFDLGFBQWE7UUFDdkIsY0FBYyxDQUFDLFNBQVMsQ0FBQztRQUN6QixXQUFXLENBQUMsVUFBVSxDQUFDO1FBQ3ZCLFNBQVMsQ0FBQyxjQUFjO0tBQ3pCLENBQUMsQ0FBQztBQUNMLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGNBQWMsR0FBRyxDQUFDLFFBQTJELEVBQVEsRUFBRTtJQUNsRyxRQUFRLEVBQUUsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN4QixRQUFRLEVBQUUsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM3QixRQUFRLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUN4QixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsQ0FBQyxPQUFtQixFQUFFLFFBQW9CLEVBQVcsRUFBRSxDQUNwRixPQUFPLENBQUMsVUFBVSxLQUFLLFFBQVEsQ0FBQyxVQUFVO09BQ3ZDLE9BQU8sQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FBQyJ9

package/dist_ts/smartsecret.plugins.d.ts

@@ -3,4 +3,8 @@ import * as crypto from 'crypto';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-export { childProcess, crypto, fs, os, path };
+import * as url from 'url';
+import * as smartcrypto from '@push.rocks/smartcrypto';
+import * as smartipc from '@push.rocks/smartipc';
+import * as smartrust from '@push.rocks/smartrust';
+export { childProcess, crypto, fs, os, path, url, smartcrypto, smartipc, smartrust };

package/dist_ts/smartsecret.plugins.js

@@ -4,5 +4,10 @@ import * as crypto from 'crypto';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-export { childProcess, crypto, fs, os, path };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnRzZWNyZXQucGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3NtYXJ0c2VjcmV0LnBsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxZQUFZLE1BQU0sZUFBZSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxNQUFNLE1BQU0sUUFBUSxDQUFDO0FBQ2pDLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3pCLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3pCLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBRTdCLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxFQUFFLEVBQUUsRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLENBQUMifQ==
+import * as url from 'url';
+// @push.rocks scope
+import * as smartcrypto from '@push.rocks/smartcrypto';
+import * as smartipc from '@push.rocks/smartipc';
+import * as smartrust from '@push.rocks/smartrust';
+export { childProcess, crypto, fs, os, path, url, smartcrypto, smartipc, smartrust };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnRzZWNyZXQucGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3NtYXJ0c2VjcmV0LnBsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxZQUFZLE1BQU0sZUFBZSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxNQUFNLE1BQU0sUUFBUSxDQUFDO0FBQ2pDLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3pCLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3pCLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBQzdCLE9BQU8sS0FBSyxHQUFHLE1BQU0sS0FBSyxDQUFDO0FBRTNCLG9CQUFvQjtBQUNwQixPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxRQUFRLE1BQU0sc0JBQXNCLENBQUM7QUFDakQsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUVuRCxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sRUFBRSxFQUFFLEVBQUUsRUFBRSxFQUFFLElBQUksRUFBRSxHQUFHLEVBQUUsV0FBVyxFQUFFLFFBQVEsRUFBRSxTQUFTLEVBQUUsQ0FBQyJ9

package/package.json

@@ -1,16 +1,11 @@
 {
   "name": "@push.rocks/smartsecret",
-  "version": "1.0.2",
+  "version": "1.2.0",
   "private": false,
-  "description": "OS keychain-based secret storage with encrypted-file fallback for Node.js.",
+  "description": "OS-backed secret storage plus strict Linux kernel-keyring and envelope APIs for Node.js.",
   "main": "dist_ts/index.js",
   "typings": "dist_ts/index.d.ts",
   "type": "module",
-  "scripts": {
-    "test": "(tstest test/ --verbose)",
-    "build": "(tsbuild)",
-    "buildDocs": "tsdoc"
-  },
   "repository": {
     "type": "git",
     "url": "https://code.foss.global/push.rocks/smartsecret.git"
@@ -34,10 +29,11 @@
   },
   "homepage": "https://code.foss.global/push.rocks/smartsecret",
   "devDependencies": {
-    "@git.zone/tsbuild": "^4.1.2",
-    "@git.zone/tsrun": "^2.0.1",
-    "@git.zone/tstest": "^3.1.8",
-    "@types/node": "^22.15.0"
+    "@git.zone/tsbuild": "^4.4.2",
+    "@git.zone/tsrun": "^2.0.6",
+    "@git.zone/tsrust": "^1.7.0",
+    "@git.zone/tstest": "^3.6.7",
+    "@types/node": "^25.9.5"
   },
   "files": [
     "ts/**/*",
@@ -48,10 +44,22 @@
     "dist_ts_web/**/*",
     "assets/**/*",
     "cli.js",
-    "npmextra.json",
-    "readme.md"
+    ".smartconfig.json",
+    "readme.md",
+    "third-party-notices.md"
   ],
   "browserslist": [
     "last 1 chrome versions"
-  ]
-}
+  ],
+  "dependencies": {
+    "@push.rocks/smartcrypto": "^2.2.0",
+    "@push.rocks/smartipc": "^2.4.0",
+    "@push.rocks/smartrust": "^1.6.0"
+  },
+  "scripts": {
+    "test": "(tstest test/ --verbose)",
+    "test:before": "(tsrust) && (cargo test --manifest-path rust/Cargo.toml --target-dir .nogit/cargo-test-target)",
+    "build": "(tsbuild) && (tsrust)",
+    "buildDocs": "tsdoc"
+  }
+}

package/readme.hints.md

@@ -2,7 +2,7 @@
 
 ## Architecture
 - 3-tier backend: macOS Keychain → Linux secret-tool → encrypted file vault
-- Zero runtime dependencies (Node.js built-ins only)
+- The legacy SmartSecret backends use Node.js built-ins only
 - All OS interactions via child_process.execFile (no shell injection)
 
 ## File Backend
@@ -10,3 +10,21 @@
 - Keyfile: auto-generated 32 random bytes at ~/.config/smartsecret/.keyfile (mode 0600)
 - Key derivation: PBKDF2 (SHA-512, 100k iterations, service-name salt)
 - Atomic writes: write .tmp then rename()
+
+## SmartSecret Keyring
+- Separate Linux-only API; it does not alter legacy SmartSecret backend selection or behavior
+- Uses @push.rocks/smartcrypto for AES-GCM payload encryption and DEK wrap/unwrap/rewrap
+- Loads exact 32-byte KEKs from validated absolute credential paths into immutable per-instance snapshots
+- Consumers own envelope persistence and compare-and-swap coordination
+- JavaScript key and plaintext zeroization is best effort
+
+## SmartSecret Kernel Store
+- Additive strict API; legacy SmartSecret backend selection remains unchanged
+- Requires Node.js 25, Linux x64, Linux keyutils, and the exact package-owned static Rust worker
+- No shell, PATH lookup, environment override, Secret Service, or filesystem secret fallback
+- Generic values are framed and limited to 0..1024 bytes; service/account names are valid scalar UTF-8 strings of 1..1024 bytes
+- Persistent-root service rings are revalidated on every operation; process keyring ownership is staging-only
+- Service-wide SmartIPC NamedMutex plus a single monotonic 1..60000 ms deadline bounds cooperating cross-process access
+- Any post-dispatch mutation ambiguity or worker integrity failure terminates and poisons the store
+- DevIdP v1 migration is opaque, receipt-bound, keyutils-only, and requires a quiescent legacy writer
+- Same-UID readability and kernel expiry/reboot behavior are part of the security model