@carchalabs/seal-electron 0.5.0 → 0.6.1

package/LICENSE

@@ -1,21 +1,12 @@
-MIT License
+Carcha Seal SDK
+Copyright (c) 2026 Bugra Omer Aydemir (Carcha Labs). All rights reserved.
 
-Copyright (c) 2026 Bugra Omer Aydemir
+This software is proprietary. You may use, copy and distribute it only as section 5 (the SDK license) of the
+Carcha Seal Vendor Terms allows: https://seal.carchalabs.com/terms/. You accept those terms by creating a Carcha
+Seal account or by using this software.
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+Open-source components included in this software are licensed under their own licenses, reproduced in
+THIRD-PARTY-NOTICES.txt where a package contains any.
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+Earlier versions keep the license they were published with: versions published before 7 November 2026 are under
+the MIT License; versions published on 7 November 2026 are under the Carcha Seal SDK License 1.0.

package/README.md

@@ -21,7 +21,7 @@ if (state.status === 'unlicensed') await kit.activate(userEnteredKey);
 if (Seal.hasFeature(state, 'export-pdf')) exportPdf();
 ```
 
-`check()` returns one of `valid`, `grace`, `invalid`, `unlicensed` or `clock_suspect`, with `offline` and `storageProtected` flags. A refusal from the server (suspended, expired, device removed, update required) is kept while offline and cleared by the next successful check-in. `notices` carries what the server asks your app to act on, such as `sdk_update_recommended` or `app_update_recommended` with a `minimum` version and a `requiredFrom` date; the SDK shows nothing itself. `activate(key, machineName)` sends the device name you pass; the default is the computer's host name. `deactivate()` releases the seat.
+`check()` returns one of `valid`, `grace`, `invalid`, `unlicensed` or `clock_suspect`, with `offline` and `storageProtected` flags. A refusal from the server (suspended, expired, device removed, update required) is kept while offline and cleared by the next successful check-in. `notices` carries what the server asks your app to act on, such as `sdk_update_recommended` or `app_update_recommended` with a `minimum` version and a `requiredFrom` date; the SDK shows nothing itself. `activate(key, machineName)` sends the device name you pass, and none when you pass nothing (a computer's host name often holds its user's name). `deactivate()` releases the seat.
 
 Code can be protected the same way (Envelope): encrypt a CommonJS module or a folder of them with `seal-encrypt --feature pro dist/premium dist/premium`, and load it with `await kit.requireEncrypted('pro', path.join(__dirname, 'premium/index.js.lke'))`. Without the feature in the license the code cannot be read; a licensed user can still read it from memory.
 
@@ -33,4 +33,4 @@ The SDK sends the license key, a per-product SHA-256 hash of the operating syste
 
 **Hardware components.** When `@carchalabs/seal-hwid` is installed, the SDK also sends one keyed hash per hardware part (motherboard, disk, network card, OS install, CPU and graphics models) and whether the computer is a virtual machine. The license server then recognises the computer after a new disk, network card or operating system install, and refuses a copied disk or system image on other hardware. Raw serial numbers never leave the computer. Without the package, or on a platform it has no module for, nothing extra is sent. `hardware: false` turns it off. Bundlers must leave the package to Node (mark it external); electron-builder unpacks its native module from the asar archive.
 
-Integration guide (activate once, check at start, put feature code behind `decrypt`, ship the native module, harden the app): [seal.carchalabs.com/docs/#integration](https://seal.carchalabs.com/docs/#integration). Full reference: [seal.carchalabs.com/docs](https://seal.carchalabs.com/docs/#sdk). Requires Node 22.13 or later. MIT License.
+Integration guide (activate once, check at start, put feature code behind `decrypt`, ship the native module, harden the app): [seal.carchalabs.com/docs/#integration](https://seal.carchalabs.com/docs/#integration). Full reference: [seal.carchalabs.com/docs](https://seal.carchalabs.com/docs/#sdk). Requires Node 22.13 or later. Proprietary: use under the [Carcha Seal Vendor Terms](https://seal.carchalabs.com/terms/) ([LICENSE](LICENSE)).

package/dist/fingerprint.js

@@ -94,4 +94,3 @@ function fallbackTraits() {
         .sort();
     return [(0, node_os_1.hostname)(), (0, node_os_1.cpus)()[0]?.model ?? '', macs[0] ?? ''].join('|');
 }
-//# sourceMappingURL=fingerprint.js.map

package/dist/index.d.ts

@@ -45,6 +45,7 @@ export interface SecureStore {
     isProtected?(): boolean;
 }
 export interface SealOptions {
+    /** The license server: https://, or http:// on this computer only (localhost, 127.x.x.x, [::1]). */
     serverUrl: string;
     product: string;
     publicKey: string | string[];
@@ -86,7 +87,10 @@ export declare class Seal {
     fingerprint(): Promise<string>;
     /** Read once per instance: hardware does not change while the app runs. Never throws. */
     private hardware;
+    /** The saved record; null when there is none, or it cannot be read or is not a record (as no license). */
     private load;
+    /** Replaces license.dat whole: written to license.dat.tmp, then renamed over it, so a crash or full disk mid-write
+     * leaves the previous record. */
     private save;
     private clear;
     private post;
@@ -109,8 +113,11 @@ export declare class Seal {
      */
     private verify;
     private stateFromLease;
+    /** machineName: the name to show the vendor for this device. Nothing is sent when the app gives none (host names often hold a person's name). */
     activate(licenseKey: string, machineName?: string): Promise<LicenseState>;
     check(): Promise<LicenseState>;
+    /** The state from the saved record when the server gave no usable answer; a usable lease moves lastSeen forward. */
+    private offlineCheck;
     /**
      * Decrypts data you encrypted for a feature (encryptForFeature in @carchalabs/seal-core, with the
      * feature's content key from the console). Works offline: it uses the saved lease, which must be valid

package/dist/index.js

@@ -41,6 +41,12 @@ const MAX_COMPONENTS = 32;
  *  re-activate), so the key is kept and the next successful online check restores the license on its own. */
 const FORGET_KEY = new Set(['invalid_key', 'license_revoked']);
 const CLOCK_TOLERANCE_SECONDS = 24 * 3600;
+/**
+ * A check-in answered 2xx whose lease fails for one of these reasons did not come from this app's license server for
+ * this device (a TLS-inspecting proxy's or captive portal's page, say): it is treated as no answer, and the saved lease
+ * is kept. A lease that fails only on time (not_yet_valid, expired, revalidation_required) is the server's, and is used.
+ */
+const NOT_A_LEASE_FOR_THIS_DEVICE = new Set(['malformed', 'unsupported_algorithm', 'wrong_type', 'unknown_key', 'bad_signature', 'wrong_issuer', 'wrong_product', 'wrong_device']);
 const DEFAULT_GRACE_DAYS = 7;
 const CLOCK_MESSAGE = 'The date and time on this computer look wrong. Correct them, then connect to the internet.';
 class LicenseError extends Error {
@@ -54,6 +60,26 @@ class LicenseError extends Error {
     }
 }
 exports.LicenseError = LicenseError;
+/**
+ * Refuses a server address that would send requests in plain text (OWASP ASVS 4.1.2, 12.2.1): every request
+ * carries the license key and the device's fingerprint. http:// is accepted for this computer only, where a server
+ * under development runs; `localhost` and the loopback addresses do not leave the machine.
+ */
+function checkServerUrl(serverUrl) {
+    let url;
+    try {
+        url = new URL(serverUrl);
+    }
+    catch {
+        throw new LicenseError('invalid_server_url', 'serverUrl is not a valid URL.');
+    }
+    if (url.protocol === 'https:')
+        return;
+    const loopback = url.hostname === 'localhost' || url.hostname === '[::1]' || /^127(\.\d{1,3}){3}$/.test(url.hostname);
+    if (url.protocol === 'http:' && loopback)
+        return;
+    throw new LicenseError('insecure_server_url', 'serverUrl must start with https:// (http:// only for localhost).');
+}
 const REASON_TEXT = {
     malformed: 'The saved license is damaged. Please activate again.',
     bad_signature: 'The saved license was modified. Please activate again.',
@@ -68,6 +94,27 @@ const REASON_TEXT = {
     revalidation_required: 'Connect to the internet to confirm your license.',
 };
 const toIso = (seconds) => new Date(seconds * 1000).toISOString();
+/** A saved record of the shape save() writes, keeping only its known fields; null for anything else. */
+function parseStored(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return null;
+    const v = value;
+    if (typeof v.licenseKey !== 'string')
+        return null;
+    const stored = { licenseKey: v.licenseKey };
+    if (typeof v.token === 'string')
+        stored.token = v.token;
+    if (typeof v.lastSeen === 'number' && Number.isFinite(v.lastSeen))
+        stored.lastSeen = v.lastSeen;
+    const r = v.refused;
+    if (r && typeof r.code === 'string' && typeof r.message === 'string' && typeof r.at === 'number')
+        stored.refused = { code: r.code, message: r.message, at: r.at };
+    if (Array.isArray(v.notices))
+        stored.notices = v.notices.filter((n) => !!n && typeof n.code === 'string');
+    if (v.offline === true)
+        stored.offline = true;
+    return stored;
+}
 function noticesFrom(response) {
     const list = Array.isArray(response?.notices) ? response.notices.filter((n) => n && typeof n.code === 'string') : [];
     return list.length ? { notices: list } : {};
@@ -83,6 +130,7 @@ class Seal {
     deviceKeyCache;
     constructor(opts) {
         this.opts = opts;
+        checkServerUrl(opts.serverUrl);
         this.file = (0, node_path_1.join)(opts.storageDir, 'license.dat');
         this.keys = (0, seal_core_1.keySet)(Array.isArray(opts.publicKey) ? opts.publicKey : [opts.publicKey]);
     }
@@ -132,20 +180,31 @@ class Seal {
         })();
         return this.hardwareCache.then((report) => report && report.components.length ? { components: report.components.slice(0, MAX_COMPONENTS), vm: report.vm === true } : {});
     }
+    /** The saved record; null when there is none, or it cannot be read or is not a record (as no license). */
     async load() {
         try {
             const buf = await (0, promises_1.readFile)(this.file);
             const text = this.opts.secureStore ? await this.opts.secureStore.decrypt(buf) : buf.toString('utf8');
-            return JSON.parse(text);
+            return parseStored(JSON.parse(text));
         }
         catch {
             return null;
         }
     }
+    /** Replaces license.dat whole: written to license.dat.tmp, then renamed over it, so a crash or full disk mid-write
+     * leaves the previous record. */
     async save(stored) {
         await (0, promises_1.mkdir)(this.opts.storageDir, { recursive: true });
         const text = JSON.stringify(stored);
-        await (0, promises_1.writeFile)(this.file, this.opts.secureStore ? await this.opts.secureStore.encrypt(text) : text, { mode: 0o600 });
+        const temp = this.file + '.tmp';
+        try {
+            await (0, promises_1.writeFile)(temp, this.opts.secureStore ? await this.opts.secureStore.encrypt(text) : text, { mode: 0o600, flush: true });
+            await (0, promises_1.rename)(temp, this.file);
+        }
+        catch (e) {
+            await (0, promises_1.rm)(temp, { force: true }).catch(() => { });
+            throw e;
+        }
     }
     async clear() {
         await (0, promises_1.rm)(this.file, { force: true });
@@ -157,6 +216,9 @@ class Seal {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
                 body: JSON.stringify(body),
+                // A redirect is refused, not followed: it could take the request, license key included, to another
+                // address or to http:// (ASVS 4.1.2). The server answers its API at the configured address.
+                redirect: 'error',
                 signal: AbortSignal.timeout(this.opts.requestTimeoutMs ?? 8000),
             });
         }
@@ -271,14 +333,15 @@ class Seal {
         }
         return this.emptyState('invalid', offline, { reason: strict.reason, message: REASON_TEXT[strict.reason], keyHint });
     }
-    async activate(licenseKey, machineName = (0, node_os_1.hostname)()) {
+    /** machineName: the name to show the vendor for this device. Nothing is sent when the app gives none (host names often hold a person's name). */
+    async activate(licenseKey, machineName) {
         const fingerprint = await this.fingerprint();
         const key = licenseKey.trim().toUpperCase();
         const response = await this.post('/v1/activate', {
             licenseKey: key,
             product: this.opts.product,
             fingerprint,
-            machineName: machineName.slice(0, 80),
+            machineName: machineName?.slice(0, 80),
             platform: (0, node_os_1.platform)(),
             appVersion: this.opts.appVersion,
             sdkVersion: exports.SDK_VERSION,
@@ -313,8 +376,9 @@ class Seal {
             }
             return state;
         }
+        let response;
         try {
-            const response = await this.post('/v1/validate', {
+            response = await this.post('/v1/validate', {
                 licenseKey: stored.licenseKey,
                 product: this.opts.product,
                 fingerprint: this.fingerprintCache,
@@ -323,30 +387,42 @@ class Seal {
                 ...(await this.hardware()),
                 ...this.deviceKey(),
             });
-            const fresh = { licenseKey: stored.licenseKey, token: response.token, lastSeen: this.nowSec(), ...noticesFrom(response) };
-            await this.save(fresh);
-            return this.stateFromLease(fresh, false);
         }
         catch (e) {
-            const keyHint = `${stored.licenseKey.slice(0, 7)}…${stored.licenseKey.slice(-4)}`;
             if (e instanceof LicenseError && DEFINITIVE.has(e.code)) {
                 // Persist the refusal: drop the signed lease so going offline cannot bring the license back.
                 if (FORGET_KEY.has(e.code))
                     await this.clear();
                 else
                     await this.save({ licenseKey: stored.licenseKey, lastSeen: stored.lastSeen, refused: { code: e.code, message: e.message, at: this.nowSec() } });
+                const keyHint = `${stored.licenseKey.slice(0, 7)}…${stored.licenseKey.slice(-4)}`;
                 return this.emptyState('invalid', false, { reason: e.code, message: e.message, keyHint });
             }
-            if (!stored.token) {
-                const refused = stored.refused ?? { code: 'not_activated', message: 'This device is not activated for this license' };
-                return this.emptyState('invalid', true, { reason: refused.code, message: refused.message, keyHint });
-            }
-            const state = this.stateFromLease({ ...stored, token: stored.token }, true);
-            if (state.status === 'valid' || state.status === 'grace') {
-                await this.save({ ...stored, lastSeen: Math.max(stored.lastSeen ?? 0, this.nowSec()) });
+            return this.offlineCheck(stored);
+        }
+        if (typeof response?.token === 'string') {
+            const fresh = { licenseKey: stored.licenseKey, token: response.token, lastSeen: this.nowSec(), ...noticesFrom(response) };
+            const state = this.stateFromLease(fresh, false);
+            if (!(state.status === 'invalid' && NOT_A_LEASE_FOR_THIS_DEVICE.has(state.reason ?? ''))) {
+                await this.save(fresh);
+                return state;
             }
-            return state;
         }
+        // A 2xx without a lease from this server for this device: as no answer.
+        return this.offlineCheck(stored);
+    }
+    /** The state from the saved record when the server gave no usable answer; a usable lease moves lastSeen forward. */
+    async offlineCheck(stored) {
+        if (!stored.token) {
+            const keyHint = `${stored.licenseKey.slice(0, 7)}…${stored.licenseKey.slice(-4)}`;
+            const refused = stored.refused ?? { code: 'not_activated', message: 'This device is not activated for this license' };
+            return this.emptyState('invalid', true, { reason: refused.code, message: refused.message, keyHint });
+        }
+        const state = this.stateFromLease({ ...stored, token: stored.token }, true);
+        if (state.status === 'valid' || state.status === 'grace') {
+            await this.save({ ...stored, lastSeen: Math.max(stored.lastSeen ?? 0, this.nowSec()) });
+        }
+        return state;
     }
     /**
      * Decrypts data you encrypted for a feature (encryptForFeature in @carchalabs/seal-core, with the
@@ -442,13 +518,13 @@ class Seal {
      * POST /v1/offline/activate (or its offline activation page). It holds what activate() would send:
      * the license key, this device's fingerprint and hashed hardware parts, never raw serial numbers.
      */
-    async offlineRequest(licenseKey, machineName = (0, node_os_1.hostname)()) {
+    async offlineRequest(licenseKey, machineName) {
         const fingerprint = await this.fingerprint();
         const activation = {
             licenseKey: licenseKey.trim().toUpperCase(),
             product: this.opts.product,
             fingerprint,
-            machineName: machineName.slice(0, 80),
+            machineName: machineName?.slice(0, 80),
             platform: (0, node_os_1.platform)(),
             appVersion: this.opts.appVersion,
             sdkVersion: exports.SDK_VERSION,
@@ -521,4 +597,3 @@ class Seal {
 }
 exports.Seal = Seal;
 exports.LicenseKit = Seal;
-//# sourceMappingURL=index.js.map

package/package.json

@@ -1,26 +1,26 @@
 {
   "name": "@carchalabs/seal-electron",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "Carcha Seal (formerly LicenseKit) SDK for the Electron main process and Node: activation, offline verification, grace period",
   "keywords": ["electron", "licensing", "license-key", "software-licensing", "offline-licensing", "node-locked", "ed25519", "jws", "carcha-seal"],
   "homepage": "https://seal.carchalabs.com/docs/",
   "repository": { "type": "git", "url": "git+https://github.com/carcha-labs/carcha-seal-sdk.git", "directory": "packages/sdk-electron" },
-  "bugs": { "url": "https://github.com/carcha-labs/carcha-seal-sdk/issues" },
+  "bugs": { "email": "bugra@carchalabs.com" },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
-  "files": ["dist", "src", "!dist/**/*.test.*", "!src/**/*.test.ts"],
+  "files": ["dist", "!dist/**/*.test.*", "!dist/**/*.map"],
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "prepublishOnly": "npm run build",
     "test": "node --no-warnings=ExperimentalWarning --test dist/*.test.js"
   },
   "dependencies": {
-    "@carchalabs/seal-core": "0.4.0"
+    "@carchalabs/seal-core": "0.5.1"
   },
   "optionalDependencies": {
-    "@carchalabs/seal-hwid": "0.3.0"
+    "@carchalabs/seal-hwid": "0.4.1"
   },
   "engines": { "node": ">=22.13" },
   "publishConfig": { "access": "public" },
-  "license": "MIT"
+  "license": "SEE LICENSE IN LICENSE"
 }

package/dist/fingerprint.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":";;;AA4CA,sCAaC;AAzDD,2DAA8C;AAC9C,+CAA4C;AAC5C,qCAAsE;AACtE,yCAAkC;AAClC,yCAAsC;AAEtC,MAAM,aAAa,GAAG,IAAA,qBAAS,EAAC,6BAAQ,CAAC,CAAC;AAE1C;;;GAGG;AACU,QAAA,KAAK,GAAG,iBAAiB,CAAC;AAC1B,QAAA,OAAO,GAAG;IACrB,gCAAgC;IAChC,iBAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC;CAC3E,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;AAC/C,QAAA,cAAc,GAAG,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;AAiB9E,4FAA4F;AAC5F,MAAa,yBAA0B,SAAQ,KAAK;IACzC,IAAI,GAAG,wBAAwB,CAAC;IACzC;QACE,KAAK,CAAC,oGAAoG,CAAC,CAAC;QAC5G,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAND,8DAMC;AAED,2HAA2H;AACpH,KAAK,UAAU,aAAa,CAAC,OAAsB,EAAE;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;IACjD,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC;IAChC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;QACrD,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAClB,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3D,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,aAAa;QAAE,OAAO,YAAY,cAAc,EAAE,EAAE,CAAC;IAC9D,MAAM,IAAI,yBAAyB,EAAE,CAAC;AACxC,CAAC;AAED,yDAAyD;AACzD,KAAK,UAAU,eAAe,CAAC,IAAmB;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAA,kBAAQ,GAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,aAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACpH,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC3D,IAAI,CAAC;gBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9B,CAAC;aAAM,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;YAC1B,KAAK,MAAM,GAAG,IAAI,eAAO,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,uFAAuF;oBACvF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,yCAAyC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE;wBACtH,OAAO,EAAE,IAAI;wBACb,WAAW,EAAE,IAAI;qBAClB,CAAC,CAAC;oBACH,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;oBAC3D,IAAI,CAAC;wBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,2BAA2B;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,sBAAc,EAAE,CAAC;gBAC/B,MAAM,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtD,IAAI,EAAE;oBAAE,OAAO,SAAS,EAAE,EAAE,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAA,2BAAiB,GAAE,CAAC;SAC5C,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,mBAAmB,CAAC;SACzE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,CAAC,GAAG,CAAC;SAClB,IAAI,EAAE,CAAC;IACV,OAAO,CAAC,IAAA,kBAAQ,GAAE,EAAE,IAAA,cAAI,GAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvE,CAAC"}

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AACA,qCAAmD;AACnD,+CAAkE;AAClE,6CAA4C;AAC5C,qCAA6C;AAC7C,yCAAmD;AACnD,qCAA0C;AAC1C,qDAA4K;AAC5K,+CAAyE;AAEhE,0GAFA,uCAAyB,OAEA;AAAE,8FAFA,2BAAa,OAEA;AAEjD,0GAA0G;AAC1G,iEAAiE;AACpD,QAAA,WAAW,GAAW,OAAO,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC;AAkFtE,0EAA0E;AAC1E,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAC5D,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAC5D,MAAM,2BAA2B,GAAG,iCAAiC,CAAC;AAEtE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACxL,8HAA8H;AAC9H,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAiB7C,iHAAiH;AACjH,IAAI,UAAe,CAAC;AACpB,SAAS,QAAQ;IACf,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,iEAAiE;YACjE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,uDAAuD;AACvD,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B;6GAC6G;AAC7G,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAC/D,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,aAAa,GAAG,4FAA4F,CAAC;AAEnH,MAAa,YAAa,SAAQ,KAAK;IAEnB;IAEA;IAHlB,YACkB,IAAY,EAC5B,OAAe,EACC,MAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAQ;QAEZ,WAAM,GAAN,MAAM,CAAS;QAG/B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AATD,oCASC;AAED,MAAM,WAAW,GAAiC;IAChD,SAAS,EAAE,sDAAsD;IACjE,aAAa,EAAE,wDAAwD;IACvE,qBAAqB,EAAE,wBAAwB;IAC/C,UAAU,EAAE,wBAAwB;IACpC,WAAW,EAAE,wBAAwB;IACrC,YAAY,EAAE,wDAAwD;IACtE,aAAa,EAAE,aAAa;IAC5B,aAAa,EAAE,0CAA0C;IACzD,YAAY,EAAE,8CAA8C;IAC5D,OAAO,EAAE,2BAA2B;IACpC,qBAAqB,EAAE,kDAAkD;CAC1E,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAE1E,SAAS,WAAW,CAAC,QAAa;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1H,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,MAAa,IAAI;IASc;IARZ,IAAI,CAAS;IACb,IAAI,CAAyB;IACtC,gBAAgB,CAAU;IAC1B,aAAa,CAAkC;IACvD,8GAA8G;IACtG,WAAW,CAAsB;IACjC,cAAc,CAAiB;IAEvC,YAA6B,IAAiB;QAAjB,SAAI,GAAJ,IAAI,CAAa;QAC5C,IAAI,CAAC,IAAI,GAAG,IAAA,gBAAI,EAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,IAAA,kBAAM,EAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACtC,CAAC;IAEO,MAAM;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,IAAY,gBAAgB;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QACpC,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,IAAA,2BAAa,EAAC,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,uCAAyB;oBAAE,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;gBACtF,MAAM,CAAC,CAAC;YACV,CAAC;YACD,IAAI,CAAC,gBAAgB,GAAG,IAAA,2BAAe,EAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,yFAAyF;IACjF,QAAQ;QACd,IAAI,CAAC,aAAa,KAAK,CAAC,KAAK,IAAI,EAAE;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YAClC,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YAClC,IAAI,CAAC;gBACH,IAAI,MAAM;oBAAE,OAAO,MAAM,MAAM,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI;oBAAE,OAAO,IAAI,CAAC;gBACvB,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3E,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,CAAC,yEAAyE;YACxF,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACxC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAC7H,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACrG,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,MAAc;QAC/B,MAAM,IAAA,gBAAK,EAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,IAAA,oBAAS,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxH,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,MAAM,IAAA,aAAE,EAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAA6B;QAC5D,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE;gBACrE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC;aAChE,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CAAC,SAAS,EAAE,qCAAqC,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,GAAQ,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,cAAc,EAAE,IAAI,CAAC,OAAO,IAAI,yBAAyB,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACtI,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,UAAU,CAAC,MAAqB,EAAE,OAAgB,EAAE,QAA+B,EAAE;QAC3F,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;IAC/G,CAAC;IAED;;;;OAIG;IACK,SAAS;QACf,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,GAAG,GAAkB,IAAI,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACnE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,UAAU,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;oBAC1G,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,GAAG,IAAI,CAAC;YACb,CAAC;YACD,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC;QAC5B,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACK,MAAM;QACZ,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;YACxB,IAAI,MAAM,GAAuB,IAAI,CAAC;YACtC,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,UAAU,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAC7F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;gBACpD,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAAE,MAAM,GAAG,IAAI,CAAC;YAC5E,CAAC;YACD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC;QAC5B,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,KAAa,EAAE,OAA2B;QACvD,MAAM,MAAM,GAAG,IAAA,uBAAW,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE;YACtC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACjD,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;QACtF,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACjE,CAAC;IAEO,cAAc,CAAC,MAAc,EAAE,OAAgB;QACrD,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAiB,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,IAAI,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,GAAG,MAAM,CAAC,QAAQ,GAAG,uBAAuB,EAAE,CAAC;YAChG,OAAO,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,aAAa,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC;QAC5F,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,CAAC,MAAmB,EAAE,EAAE,CAAC,CAAC;YAC3C,QAAQ,EAAE,MAAM,CAAC,GAAG;YACpB,QAAQ,EAAE,MAAM,CAAC,IAAI;YACrB,SAAS,EAAE,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;YAC9D,gBAAgB,EAAE,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;YACrE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,OAAO;YACP,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5G,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,GAAG,KAAK,CAAC;YACvF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;YACrF,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO;oBACL,MAAM,EAAE,OAAO;oBACf,OAAO;oBACP,MAAM,EAAE,eAAe;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACrB,CAAC,CAAC,4GAA4G;wBAC9G,CAAC,CAAC,sEAAsE;oBAC1E,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC7B,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,QAAQ,CAAC,CAAC;iBAC1F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACtH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,WAAW,GAAG,IAAA,kBAAQ,GAAE;QACzD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;YAC/C,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAC1B,WAAW;YACX,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACrC,QAAQ,EAAE,IAAA,kBAAQ,GAAE;YACpB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,UAAU,EAAE,mBAAW;YACvB,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,GAAG,IAAI,CAAC,SAAS,EAAE;SACpB,CAAC,CAAC;QACH,MAAM,MAAM,GAAW,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrH,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO;YAAE,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,KAAK,CAAC,OAAO,IAAI,qCAAqC,CAAC,CAAC;QAC7L,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,yEAAyE;YACzE,IAAI,CAAC,YAAY,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,wBAAwB;gBAAE,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACvJ,MAAM,CAAC,CAAC;QACV,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACnC,2FAA2F;YAC3F,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;YAC5E,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACzD,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;gBAC/C,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;gBAC1B,WAAW,EAAE,IAAI,CAAC,gBAAgB;gBAClC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;gBAChC,UAAU,EAAE,mBAAW;gBACvB,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,GAAG,IAAI,CAAC,SAAS,EAAE;aACpB,CAAC,CAAC;YACH,MAAM,KAAK,GAAW,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClI,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,YAAY,YAAY,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,6FAA6F;gBAC7F,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;;oBAC1C,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;gBACrJ,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;gBACtH,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;YAC5E,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACzD,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,IAAgB;QAC7C,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,IAAY;QAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,aAAa,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IAEgB,gBAAgB,GAAG,IAAI,GAAG,EAA2E,CAAC;IAE/G,aAAa,CAAC,IAAY,EAAE,OAAe,EAAE,IAAkC;QACrF,MAAM,QAAQ,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAA,sBAAY,EAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,EAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1E,sFAAsF;QACtF,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,IAAA,2BAAa,EAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,CAAC,CAAC,OAAe,EAAE,EAAE;YACxC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,GAAG,IAAA,mBAAO,EAAC,IAAA,mBAAO,EAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;gBACjD,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,MAAM,EAAE,GAAG,IAAI,SAAS,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAA,oBAAU,EAAC,SAAS,CAAC,CAAC,CAAC;gBAC3H,IAAI,SAAS;oBAAE,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC,CAAmB,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC;QACpJ,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAA,yBAAe,EAAC,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC/G,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAA,mBAAO,EAAC,QAAQ,CAAC,CAAC,CAAC;QACrF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvC,MAAM,CAAC,CAAC;QACV,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;QAClB,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,MAAM,CAAC,OAAe;QAClC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,EAAE,KAAK;YAAE,MAAM,IAAI,YAAY,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;QACxF,MAAM,MAAM,GAAW,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACzD,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,KAAK,CAAC,OAAO,IAAI,2BAA2B,CAAC,CAAC;QACzJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,uBAAW,EAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACjD,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzH,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7H,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAgB,EAAE,EAAE;YAC1B,MAAM,MAAM,GACV,MAAM,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,UAAU;gBACnD,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3F,CAAC,CAAC,IAAA,0BAAc,EAAC,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACjH,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc;gBAAE,MAAM,IAAI,YAAY,CAAC,sBAAsB,EAAE,kCAAkC,OAAO,IAAI,CAAC,CAAC;YACpI,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB;gBAAE,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,oDAAoD,CAAC,CAAC;YACvI,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,MAAsB,CAAC,IAAI,2BAA2B,CAAC,CAAC;QAChI,CAAC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,UAAkB,EAAE,WAAW,GAAG,IAAA,kBAAQ,GAAE;QAC/D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG;YACjB,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;YAC3C,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAC1B,WAAW;YACX,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACrC,QAAQ,EAAE,IAAA,kBAAQ,GAAE;YACpB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,UAAU,EAAE,mBAAW;YACvB,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,GAAG,IAAI,CAAC,SAAS,EAAE;SACpB,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,WAAmB;QACvC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,IAAI,IAAS,CAAC;QACd,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,iDAAiD,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,sBAAsB,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnJ,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,iDAAiD,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,mDAAmD,CAAC,CAAC;QACrI,MAAM,MAAM,GAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACvI,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,KAAK,CAAC,OAAO,IAAI,4DAA4D,CAAC,CAAC;QACxL,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,EAAE,KAAK;YAAE,MAAM,IAAI,YAAY,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACvI,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE;gBAChC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;gBAC1B,WAAW,EAAE,MAAM,IAAI,CAAC,WAAW,EAAE;gBACrC,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,YAAY,YAAY,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,KAAmB,EAAE,OAAe;QACpD,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpG,CAAC;CACF;AA1bD,oBA0bC;AAGgB,0BAAU"}

package/src/fingerprint.ts

@@ -1,103 +0,0 @@
-import { execFile } from 'node:child_process';
-import { readFile } from 'node:fs/promises';
-import { cpus, hostname, networkInterfaces, platform } from 'node:os';
-import { win32 } from 'node:path';
-import { promisify } from 'node:util';
-
-const execFileAsync = promisify(execFile);
-
-/**
- * The OS tools are run by absolute path, never looked up through PATH: an app started from a terminal inherits the
- * user's PATH, and a fake `ioreg` or `reg` placed first in it could report another computer's id.
- */
-export const IOREG = '/usr/sbin/ioreg';
-export const REG_EXE = [
-  'C:\\Windows\\System32\\reg.exe',
-  win32.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'reg.exe'),
-].filter((file, index, all) => all.indexOf(file) === index);
-export const LINUX_ID_FILES = ['/etc/machine-id', '/var/lib/dbus/machine-id'];
-
-export interface MachineIdDeps {
-  platform?: NodeJS.Platform;
-  /** Attempts to read the OS id before giving up (default 3). */
-  attempts?: number;
-  /** Pause between attempts (default 250 ms, doubled each time). */
-  delayMs?: number;
-  /**
-   * Use hostname + CPU + MAC when the OS id cannot be read. Off by default: that value differs from the OS id, so the
-   * same computer would look like a new device and take another seat.
-   */
-  allowFallback?: boolean;
-  run?: (file: string, args: string[], options: { timeout: number; windowsHide: boolean }) => Promise<{ stdout: string }>;
-  readText?: (file: string) => Promise<string>;
-}
-
-/** The OS id could not be read; licensing on this computer cannot continue until it can. */
-export class MachineIdUnavailableError extends Error {
-  readonly code = 'machine_id_unavailable';
-  constructor() {
-    super('This computer\'s id could not be read. Try again; if it keeps failing, contact the app\'s support.');
-    this.name = 'MachineIdUnavailableError';
-  }
-}
-
-/** Reads a stable, OS-provided machine id, retrying a few times. Throws MachineIdUnavailableError unless allowFallback. */
-export async function readMachineId(deps: MachineIdDeps = {}): Promise<string> {
-  const attempts = Math.max(1, deps.attempts ?? 3);
-  let delay = deps.delayMs ?? 250;
-  for (let attempt = 1; attempt <= attempts; attempt++) {
-    const id = await readOsMachineId(deps);
-    if (id) return id;
-    if (attempt < attempts) {
-      await new Promise((resolve) => setTimeout(resolve, delay));
-      delay *= 2;
-    }
-  }
-  if (deps.allowFallback) return `fallback:${fallbackTraits()}`;
-  throw new MachineIdUnavailableError();
-}
-
-/** One attempt; null when the OS id is not available. */
-async function readOsMachineId(deps: MachineIdDeps): Promise<string | null> {
-  const os = deps.platform ?? platform();
-  const run = deps.run ?? ((file, args, options) => execFileAsync(file, args, options));
-  const readText = deps.readText ?? ((file) => readFile(file, 'utf8'));
-  try {
-    if (os === 'darwin') {
-      const { stdout } = await run(IOREG, ['-rd1', '-c', 'IOPlatformExpertDevice'], { timeout: 3000, windowsHide: true });
-      const m = stdout.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
-      if (m) return `mac:${m[1]}`;
-    } else if (os === 'win32') {
-      for (const reg of REG_EXE) {
-        try {
-          // /reg:64 reads the 64-bit registry view, so a 32-bit build sees the same MachineGuid.
-          const { stdout } = await run(reg, ['query', 'HKLM\\SOFTWARE\\Microsoft\\Cryptography', '/v', 'MachineGuid', '/reg:64'], {
-            timeout: 3000,
-            windowsHide: true,
-          });
-          const m = stdout.match(/MachineGuid\s+REG_SZ\s+([\w-]+)/i);
-          if (m) return `win:${m[1]}`;
-        } catch {
-          /* try the next location */
-        }
-      }
-    } else {
-      for (const f of LINUX_ID_FILES) {
-        const id = (await readText(f).catch(() => '')).trim();
-        if (id) return `linux:${id}`;
-      }
-    }
-  } catch {
-    /* fall through */
-  }
-  return null;
-}
-
-function fallbackTraits(): string {
-  const macs = Object.values(networkInterfaces())
-    .flat()
-    .filter((i) => i && !i.internal && i.mac && i.mac !== '00:00:00:00:00:00')
-    .map((i) => i!.mac)
-    .sort();
-  return [hostname(), cpus()[0]?.model ?? '', macs[0] ?? ''].join('|');
-}

package/src/index.ts

@@ -1,623 +0,0 @@
-import { KeyObject } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
-import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
-import { createRequire } from 'node:module';
-import { hostname, platform } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
-import { compileFunction } from 'node:vm';
-import { decodeLease, decryptFeature, hashFingerprint, keySet, LeaseClaims, LeaseFailure, LeaseVerifyOptions, LeaseVerifyResult, verifyLease } from '@carchalabs/seal-core';
-import { MachineIdUnavailableError, readMachineId } from './fingerprint';
-
-export { MachineIdUnavailableError, readMachineId };
-
-/** This SDK's version, sent to the server so vendors can see (and require) which SDK each device runs. */
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-export const SDK_VERSION: string = require('../package.json').version;
-
-export type LicenseStatus = 'valid' | 'grace' | 'invalid' | 'unlicensed' | 'clock_suspect';
-
-/**
- * Something the server asks the app to act on: sdk_update_recommended (update the Carcha Seal SDK in the app) or
- * app_update_recommended (the vendor's minimum app version), each with minimum and requiredFrom.
- */
-export interface LicenseNotice {
-  code: string;
-  minimum?: string;
-  /** ISO date from which an older SDK is refused; null when the update is only recommended. */
-  requiredFrom?: string | null;
-}
-
-export interface LicenseState {
-  status: LicenseStatus;
-  offline: boolean;
-  storageProtected: boolean;
-  reason?: string;
-  message?: string;
-  customer?: string;
-  features: string[];
-  expiresAt: string | null;
-  maintenanceUntil?: string | null;
-  revalidateBy?: string;
-  keyHint?: string;
-  /** From the last successful check-in; kept while offline. The app decides how to show them. */
-  notices?: LicenseNotice[];
-  /** True when the license came from an offline license file (activateOffline); renew it with a new file. */
-  offlineActivated?: boolean;
-}
-
-/** Hashed hardware components (see @carchalabs/seal-hwid); the server matches a device by them. */
-export interface HardwareReport {
-  components: { kind: string; hash: string }[];
-  /** True when the device runs as a virtual machine. */
-  vm: boolean;
-}
-
-export interface SecureStore {
-  encrypt(plain: string): Buffer | Promise<Buffer>;
-  decrypt(cipher: Buffer): string | Promise<string>;
-  isProtected?(): boolean;
-}
-
-export interface SealOptions {
-  serverUrl: string;
-  product: string;
-  publicKey: string | string[];
-  storageDir: string;
-  appVersion?: string;
-  graceDays?: number;
-  secureStore?: SecureStore;
-  requestTimeoutMs?: number;
-  fetchImpl?: typeof fetch;
-  machineId?: () => Promise<string>;
-  /** Use hostname + CPU + MAC when the OS machine id cannot be read (default false; see readMachineId). */
-  allowFallbackFingerprint?: boolean;
-  /**
-   * Hardware components sent with each request, so the device keeps its seat after a new disk, network
-   * card or OS install. Default: read with @carchalabs/seal-hwid when it is installed; nothing is
-   * sent when it is not (or cannot load on this platform). false: never send them. A function: your own.
-   */
-  hardware?: false | (() => HardwareReport | null | Promise<HardwareReport | null>);
-  now?: () => number;
-}
-
-interface Stored {
-  licenseKey: string;
-  /** Signed lease. Absent after the server refused this device: nothing is left to verify offline. */
-  token?: string;
-  lastSeen?: number;
-  /** The server's last definitive refusal, kept so an offline check reports it instead of an old lease. */
-  refused?: { code: string; message: string; at: number };
-  notices?: LicenseNotice[];
-  /** Activated from an offline license file: check() never calls the server; a new file renews it. */
-  offline?: boolean;
-}
-
-type Leased = Stored & { token: string };
-
-/** File formats of offline activation, shared with the license server. */
-const OFFLINE_REQUEST_FORMAT = 'licensekit-offline-request';
-const OFFLINE_LICENSE_FORMAT = 'licensekit-offline-license';
-const OFFLINE_DEACTIVATION_FORMAT = 'licensekit-offline-deactivation';
-
-const DEFINITIVE = new Set(['invalid_key', 'not_activated', 'license_suspended', 'license_revoked', 'license_expired', 'sdk_update_required', 'app_update_required', 'vm_not_allowed']);
-/** The native hardware module. A non-literal require: bundlers leave it to Node, which must load the .node file from disk. */
-const HWID_PACKAGE = '@carchalabs/seal-hwid';
-/** The native module's lease verifier (@carchalabs/seal-hwid 0.2+): its keys are compiled in. */
-interface NativeLease {
-  verifyLease(token: string, check: { product: string; fingerprintHash: string; now: number; graceSeconds?: number }): { ok: boolean; reason?: string };
-  leaseKeyIds(): string[];
-  /** This machine's X25519 public key from its hardware (base64url), or null. */
-  devicePublicKey?(key: string): string | null;
-  /** @carchalabs/seal-hwid 0.2+ with feature keys. */
-  decryptFeature?(
-    token: string,
-    check: { product: string; fingerprintHash: string; now: number; graceSeconds?: number },
-    licenseKey: string,
-    feature: string,
-    data: Buffer,
-  ): { ok: boolean; data?: Buffer; reason?: string };
-}
-
-/** Loads the native module once per process; null when it is not installed or has no build for this platform. */
-let hwidModule: any;
-function loadHwid(): any {
-  if (hwidModule === undefined) {
-    try {
-      // eslint-disable-next-line @typescript-eslint/no-require-imports
-      hwidModule = require(HWID_PACKAGE);
-    } catch {
-      hwidModule = null;
-    }
-  }
-  return hwidModule;
-}
-
-/** The server accepts at most this many components. */
-const MAX_COMPONENTS = 32;
-/** The license itself is gone: forget the key too. The other refusals can be undone on the server (resume, renew,
- *  re-activate), so the key is kept and the next successful online check restores the license on its own. */
-const FORGET_KEY = new Set(['invalid_key', 'license_revoked']);
-const CLOCK_TOLERANCE_SECONDS = 24 * 3600;
-const DEFAULT_GRACE_DAYS = 7;
-const CLOCK_MESSAGE = 'The date and time on this computer look wrong. Correct them, then connect to the internet.';
-
-export class LicenseError extends Error {
-  constructor(
-    public readonly code: string,
-    message: string,
-    public readonly status?: number,
-  ) {
-    super(message);
-    this.name = 'LicenseError';
-  }
-}
-
-const REASON_TEXT: Record<LeaseFailure, string> = {
-  malformed: 'The saved license is damaged. Please activate again.',
-  bad_signature: 'The saved license was modified. Please activate again.',
-  unsupported_algorithm: 'Please update the app.',
-  wrong_type: 'Please update the app.',
-  unknown_key: 'Please update the app.',
-  wrong_issuer: 'This license was issued by a different license server.',
-  not_yet_valid: CLOCK_MESSAGE,
-  wrong_product: 'This license is for a different product.',
-  wrong_device: 'This license is activated on another device.',
-  expired: 'Your license has expired.',
-  revalidation_required: 'Connect to the internet to confirm your license.',
-};
-
-const toIso = (seconds: number) => new Date(seconds * 1000).toISOString();
-
-function noticesFrom(response: any): { notices?: LicenseNotice[] } {
-  const list = Array.isArray(response?.notices) ? response.notices.filter((n: any) => n && typeof n.code === 'string') : [];
-  return list.length ? { notices: list } : {};
-}
-
-export class Seal {
-  private readonly file: string;
-  private readonly keys: Map<string, KeyObject>;
-  private fingerprintCache?: string;
-  private hardwareCache?: Promise<HardwareReport | null>;
-  /** The native lease verifier, when it trusts every key this app was given (undefined = not looked up yet). */
-  private nativeLease?: NativeLease | null;
-  private deviceKeyCache?: string | null;
-
-  constructor(private readonly opts: SealOptions) {
-    this.file = join(opts.storageDir, 'license.dat');
-    this.keys = keySet(Array.isArray(opts.publicKey) ? opts.publicKey : [opts.publicKey]);
-  }
-
-  private get fetch() {
-    return this.opts.fetchImpl ?? fetch;
-  }
-
-  private nowSec() {
-    return Math.floor((this.opts.now?.() ?? Date.now()) / 1000);
-  }
-
-  private get storageProtected(): boolean {
-    const store = this.opts.secureStore;
-    return store !== undefined && (store.isProtected?.() ?? true);
-  }
-
-  async fingerprint(): Promise<string> {
-    if (!this.fingerprintCache) {
-      let raw: string;
-      try {
-        raw = await (this.opts.machineId ?? (() => readMachineId({ allowFallback: this.opts.allowFallbackFingerprint })))();
-      } catch (e) {
-        if (e instanceof MachineIdUnavailableError) throw new LicenseError(e.code, e.message);
-        throw e;
-      }
-      this.fingerprintCache = hashFingerprint(raw, this.opts.product);
-    }
-    return this.fingerprintCache;
-  }
-
-  /** Read once per instance: hardware does not change while the app runs. Never throws. */
-  private hardware(): Promise<{ components?: HardwareReport['components']; vm?: boolean }> {
-    this.hardwareCache ??= (async () => {
-      const source = this.opts.hardware;
-      if (source === false) return null;
-      try {
-        if (source) return await source();
-        const hwid = loadHwid();
-        if (!hwid) return null;
-        const { components, vm } = hwid.collect(`licensekit:${this.opts.product}`);
-        return { components, vm };
-      } catch {
-        return null; // not installed, or no module for this platform: send nothing, as before
-      }
-    })();
-    return this.hardwareCache.then((report) =>
-      report && report.components.length ? { components: report.components.slice(0, MAX_COMPONENTS), vm: report.vm === true } : {},
-    );
-  }
-
-  private async load(): Promise<Stored | null> {
-    try {
-      const buf = await readFile(this.file);
-      const text = this.opts.secureStore ? await this.opts.secureStore.decrypt(buf) : buf.toString('utf8');
-      return JSON.parse(text);
-    } catch {
-      return null;
-    }
-  }
-
-  private async save(stored: Stored) {
-    await mkdir(this.opts.storageDir, { recursive: true });
-    const text = JSON.stringify(stored);
-    await writeFile(this.file, this.opts.secureStore ? await this.opts.secureStore.encrypt(text) : text, { mode: 0o600 });
-  }
-
-  private async clear() {
-    await rm(this.file, { force: true });
-  }
-
-  private async post(path: string, body: Record<string, unknown>): Promise<any> {
-    let res: Response;
-    try {
-      res = await this.fetch(this.opts.serverUrl.replace(/\/+$/, '') + path, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify(body),
-        signal: AbortSignal.timeout(this.opts.requestTimeoutMs ?? 8000),
-      });
-    } catch {
-      throw new LicenseError('network', 'Could not reach the license server.');
-    }
-    const json: any = await res.json().catch(() => ({}));
-    if (!res.ok) throw new LicenseError(json.error ?? 'server_error', json.message ?? `License server error (${res.status})`, res.status);
-    return json;
-  }
-
-  private emptyState(status: LicenseStatus, offline: boolean, extra: Partial<LicenseState> = {}): LicenseState {
-    return { status, offline, storageProtected: this.storageProtected, features: [], expiresAt: null, ...extra };
-  }
-
-  /**
-   * The device's public key, sent with activation and check-ins so the server wraps feature keys for
-   * this machine only. Only when the native module verifies for this app (it then also decrypts, with
-   * the matching secret it derives itself) and hardware is not turned off. Never throws.
-   */
-  private deviceKey(): { devicePublicKey?: string } {
-    if (this.deviceKeyCache === undefined) {
-      let key: string | null = null;
-      try {
-        const native = this.opts.hardware === false ? null : this.native();
-        if (native && typeof native.devicePublicKey === 'function' && typeof native.decryptFeature === 'function') {
-          key = native.devicePublicKey(`licensekit:${this.opts.product}`);
-        }
-      } catch {
-        key = null;
-      }
-      this.deviceKeyCache = key;
-    }
-    return this.deviceKeyCache ? { devicePublicKey: this.deviceKeyCache } : {};
-  }
-
-  /**
-   * The native verifier, used only when its compiled-in keys include every key this app was given:
-   * an app that trusts other keys (a self-hosted server) is checked by the JavaScript verifier alone.
-   */
-  private native(): NativeLease | null {
-    if (this.nativeLease === undefined) {
-      const hwid = loadHwid();
-      let native: NativeLease | null = null;
-      if (hwid && typeof hwid.verifyLease === 'function' && typeof hwid.leaseKeyIds === 'function') {
-        const trusted = new Set<string>(hwid.leaseKeyIds());
-        if ([...this.keys.keys()].every((kid) => trusted.has(kid))) native = hwid;
-      }
-      this.nativeLease = native;
-    }
-    return this.nativeLease;
-  }
-
-  /**
-   * Verifies a lease twice, in JavaScript and in the native module, when the native verifier applies.
-   * Both follow the same rules, so a different answer means one of them was tampered with: the lease
-   * is then treated as modified.
-   */
-  private verify(token: string, options: LeaseVerifyOptions): LeaseVerifyResult {
-    const result = verifyLease(token, options);
-    const native = this.native();
-    if (!native) return result;
-    const check = native.verifyLease(token, {
-      product: options.product,
-      fingerprintHash: options.fingerprintHash,
-      now: options.now ?? Math.floor(Date.now() / 1000),
-      ...(options.graceSeconds !== undefined ? { graceSeconds: options.graceSeconds } : {}),
-    });
-    const agree = check.ok === result.ok && (result.ok || check.reason === result.reason);
-    return agree ? result : { ok: false, reason: 'bad_signature' };
-  }
-
-  private stateFromLease(stored: Leased, offline: boolean): LicenseState {
-    const fingerprintHash = this.fingerprintCache!;
-    const now = this.nowSec();
-    const keyHint = `${stored.licenseKey.slice(0, 7)}…${stored.licenseKey.slice(-4)}`;
-    if (offline && stored.lastSeen !== undefined && now < stored.lastSeen - CLOCK_TOLERANCE_SECONDS) {
-      return this.emptyState('clock_suspect', offline, { reason: 'clock_rollback', message: CLOCK_MESSAGE, keyHint });
-    }
-    const verifyOptions = { keys: this.keys, product: this.opts.product, fingerprintHash, now };
-    const strict = this.verify(stored.token, verifyOptions);
-    const fromClaims = (claims: LeaseClaims) => ({
-      customer: claims.cus,
-      features: claims.feat,
-      expiresAt: claims.exp === undefined ? null : toIso(claims.exp),
-      maintenanceUntil: claims.mnt === undefined ? null : toIso(claims.mnt),
-      storageProtected: this.storageProtected,
-      keyHint,
-      ...(stored.notices ? { notices: stored.notices } : {}),
-      ...(stored.offline ? { offlineActivated: true } : {}),
-    });
-    if (strict.ok) {
-      return { status: 'valid', offline, ...fromClaims(strict.claims), revalidateBy: toIso(strict.claims.rev) };
-    }
-    if (strict.reason === 'not_yet_valid') {
-      return this.emptyState('clock_suspect', offline, { reason: 'lease_from_future', message: CLOCK_MESSAGE, keyHint });
-    }
-    if (strict.reason === 'revalidation_required' && strict.claims) {
-      const grace = strict.claims.grc ?? (this.opts.graceDays ?? DEFAULT_GRACE_DAYS) * 86400;
-      const lenient = this.verify(stored.token, { ...verifyOptions, graceSeconds: grace });
-      if (lenient.ok) {
-        return {
-          status: 'grace',
-          offline,
-          reason: 'offline_grace',
-          message: stored.offline
-            ? 'This offline license is past its renewal date. Load a new offline license file soon to keep using the app.'
-            : 'Working offline. Connect to the internet soon to keep using the app.',
-          ...fromClaims(lenient.claims),
-          revalidateBy: toIso(Math.min(lenient.claims.rev + grace, lenient.claims.exp ?? Infinity)),
-        };
-      }
-    }
-    return this.emptyState('invalid', offline, { reason: strict.reason, message: REASON_TEXT[strict.reason], keyHint });
-  }
-
-  async activate(licenseKey: string, machineName = hostname()): Promise<LicenseState> {
-    const fingerprint = await this.fingerprint();
-    const key = licenseKey.trim().toUpperCase();
-    const response = await this.post('/v1/activate', {
-      licenseKey: key,
-      product: this.opts.product,
-      fingerprint,
-      machineName: machineName.slice(0, 80),
-      platform: platform(),
-      appVersion: this.opts.appVersion,
-      sdkVersion: SDK_VERSION,
-      ...(await this.hardware()),
-      ...this.deviceKey(),
-    });
-    const stored: Leased = { licenseKey: key, token: response.token, lastSeen: this.nowSec(), ...noticesFrom(response) };
-    const state = this.stateFromLease(stored, false);
-    if (state.status !== 'valid') throw new LicenseError(state.status === 'clock_suspect' ? 'clock_suspect' : state.reason ?? 'invalid', state.message ?? 'Server returned an unusable license');
-    await this.save(stored);
-    return state;
-  }
-
-  async check(): Promise<LicenseState> {
-    try {
-      await this.fingerprint();
-    } catch (e) {
-      // Nothing is changed on disk: the next check tries to read the id again.
-      if (e instanceof LicenseError && e.code === 'machine_id_unavailable') return this.emptyState('invalid', false, { reason: e.code, message: e.message });
-      throw e;
-    }
-    const stored = await this.load();
-    if (!stored) return this.emptyState('unlicensed', false);
-    if (stored.offline && stored.token) {
-      // Activated from an offline license file: the machine is not expected to reach the server.
-      const state = this.stateFromLease({ ...stored, token: stored.token }, true);
-      if (state.status === 'valid' || state.status === 'grace') {
-        await this.save({ ...stored, lastSeen: Math.max(stored.lastSeen ?? 0, this.nowSec()) });
-      }
-      return state;
-    }
-    try {
-      const response = await this.post('/v1/validate', {
-        licenseKey: stored.licenseKey,
-        product: this.opts.product,
-        fingerprint: this.fingerprintCache,
-        appVersion: this.opts.appVersion,
-        sdkVersion: SDK_VERSION,
-        ...(await this.hardware()),
-        ...this.deviceKey(),
-      });
-      const fresh: Leased = { licenseKey: stored.licenseKey, token: response.token, lastSeen: this.nowSec(), ...noticesFrom(response) };
-      await this.save(fresh);
-      return this.stateFromLease(fresh, false);
-    } catch (e) {
-      const keyHint = `${stored.licenseKey.slice(0, 7)}…${stored.licenseKey.slice(-4)}`;
-      if (e instanceof LicenseError && DEFINITIVE.has(e.code)) {
-        // Persist the refusal: drop the signed lease so going offline cannot bring the license back.
-        if (FORGET_KEY.has(e.code)) await this.clear();
-        else await this.save({ licenseKey: stored.licenseKey, lastSeen: stored.lastSeen, refused: { code: e.code, message: e.message, at: this.nowSec() } });
-        return this.emptyState('invalid', false, { reason: e.code, message: e.message, keyHint });
-      }
-      if (!stored.token) {
-        const refused = stored.refused ?? { code: 'not_activated', message: 'This device is not activated for this license' };
-        return this.emptyState('invalid', true, { reason: refused.code, message: refused.message, keyHint });
-      }
-      const state = this.stateFromLease({ ...stored, token: stored.token }, true);
-      if (state.status === 'valid' || state.status === 'grace') {
-        await this.save({ ...stored, lastSeen: Math.max(stored.lastSeen ?? 0, this.nowSec()) });
-      }
-      return state;
-    }
-  }
-
-  /**
-   * Decrypts data you encrypted for a feature (encryptForFeature in @carchalabs/seal-core, with the
-   * feature's content key from the console). Works offline: it uses the saved lease, which must be valid
-   * (or in its offline grace period), grant the feature and carry its key, and the saved license key.
-   * The native module does the work when it trusts this app's keys, so the content key never reaches
-   * JavaScript; without it the JavaScript implementation is used. Throws a LicenseError:
-   * `unlicensed`, a lease failure reason, `clock_suspect`, `feature_not_licensed` or `decrypt_failed`.
-   */
-  async decrypt(feature: string, data: Uint8Array): Promise<Buffer> {
-    return (await this.opener(feature))(data);
-  }
-
-  /**
-   * Envelope: loads a CommonJS module you encrypted for a feature (seal-encrypt, one file or a
-   * folder) and returns its exports, like require(). The code is decrypted with the lease's feature key
-   * (see decrypt) and compiled from memory; it never exists as a plain file. Relative requires inside
-   * it load encrypted neighbours (`./x` finds `x.lke`, `x.js.lke` or `x/index.js.lke`), anything else
-   * goes to Node as usual. Loaded once per process, like require(). Throws the same LicenseErrors as
-   * decrypt. A licensed user can still read the code from memory: this keeps an app with the license
-   * check removed from having the feature, it does not hide the code from its licensed users.
-   */
-  async requireEncrypted(feature: string, file: string): Promise<any> {
-    const open = await this.opener(feature);
-    return this.loadEncrypted(resolve(file), feature, open);
-  }
-
-  private readonly encryptedModules = new Map<string, { exports: any; filename: string; id: string; loaded: boolean }>();
-
-  private loadEncrypted(file: string, feature: string, open: (data: Uint8Array) => Buffer): any {
-    const cacheKey = `${feature}\0${file}`;
-    const cached = this.encryptedModules.get(cacheKey);
-    if (cached) return cached.exports;
-    const source = open(readFileSync(file)).toString('utf8');
-    const filename = file.replace(/\.lke$/, '');
-    const mod = { exports: {} as any, filename, id: filename, loaded: false };
-    // Registered before it runs, so a require cycle gets the partial exports, as in Node.
-    this.encryptedModules.set(cacheKey, mod);
-    const nodeRequire = createRequire(filename);
-    const localRequire = ((request: string) => {
-      if (request.startsWith('./') || request.startsWith('../')) {
-        const base = resolve(dirname(filename), request);
-        const encrypted = [`${base}.lke`, `${base}.js.lke`, join(base, 'index.js.lke')].find((candidate) => existsSync(candidate));
-        if (encrypted) return this.loadEncrypted(encrypted, feature, open);
-      }
-      return nodeRequire(request);
-    }) as NodeJS.Require;
-    Object.assign(localRequire, { resolve: nodeRequire.resolve, cache: nodeRequire.cache, main: nodeRequire.main, extensions: nodeRequire.extensions });
-    try {
-      const run = compileFunction(source, ['exports', 'require', 'module', '__filename', '__dirname'], { filename });
-      run.call(mod.exports, mod.exports, localRequire, mod, filename, dirname(filename));
-    } catch (e) {
-      this.encryptedModules.delete(cacheKey);
-      throw e;
-    }
-    mod.loaded = true;
-    return mod.exports;
-  }
-
-  /**
-   * Checks the saved lease once for a feature and returns a synchronous decrypter bound to it: decrypt
-   * uses it once, requireEncrypted for a module and the encrypted modules it requires.
-   */
-  private async opener(feature: string): Promise<(data: Uint8Array) => Buffer> {
-    const fingerprintHash = await this.fingerprint();
-    const stored = await this.load();
-    if (!stored?.token) throw new LicenseError('unlicensed', 'This device has no license.');
-    const leased: Leased = { ...stored, token: stored.token };
-    const state = this.stateFromLease(leased, true);
-    if (state.status !== 'valid' && state.status !== 'grace') {
-      throw new LicenseError(state.status === 'clock_suspect' ? 'clock_suspect' : (state.reason ?? 'invalid'), state.message ?? 'The license is not valid.');
-    }
-    const claims = decodeLease(leased.token)?.claims;
-    const graceSeconds = state.status === 'grace' ? (claims?.grc ?? (this.opts.graceDays ?? DEFAULT_GRACE_DAYS) * 86400) : 0;
-    const check = { product: this.opts.product, fingerprintHash, now: this.nowSec(), ...(graceSeconds ? { graceSeconds } : {}) };
-    const native = this.native();
-    return (data: Uint8Array) => {
-      const result: { ok: boolean; data?: Buffer; reason?: string } =
-        native && typeof native.decryptFeature === 'function'
-          ? native.decryptFeature(leased.token, check, leased.licenseKey, feature, Buffer.from(data))
-          : decryptFeature(leased.token, { keys: this.keys, ...check }, leased.licenseKey, feature, Buffer.from(data));
-      if (result.ok && result.data) return Buffer.from(result.data);
-      if (result.reason === 'not_licensed') throw new LicenseError('feature_not_licensed', `This license does not include "${feature}".`);
-      if (result.reason === 'decrypt_failed') throw new LicenseError('decrypt_failed', 'The data could not be decrypted with this license.');
-      throw new LicenseError(result.reason ?? 'invalid', REASON_TEXT[result.reason as LeaseFailure] ?? 'The license is not valid.');
-    };
-  }
-
-  /**
-   * Offline activation, step 1 on a machine that cannot reach the server: the request file (JSON text)
-   * the user takes to a connected device. The license server turns it into a license file at
-   * POST /v1/offline/activate (or its offline activation page). It holds what activate() would send:
-   * the license key, this device's fingerprint and hashed hardware parts, never raw serial numbers.
-   */
-  async offlineRequest(licenseKey: string, machineName = hostname()): Promise<string> {
-    const fingerprint = await this.fingerprint();
-    const activation = {
-      licenseKey: licenseKey.trim().toUpperCase(),
-      product: this.opts.product,
-      fingerprint,
-      machineName: machineName.slice(0, 80),
-      platform: platform(),
-      appVersion: this.opts.appVersion,
-      sdkVersion: SDK_VERSION,
-      ...(await this.hardware()),
-      ...this.deviceKey(),
-    };
-    return JSON.stringify({ format: OFFLINE_REQUEST_FORMAT, version: 1, activation }, null, 2);
-  }
-
-  /**
-   * Offline activation, step 2: loads the license file the server issued for this machine's request.
-   * It is verified like an online lease (signature, product, this device) and then saved; from then on
-   * check() works without the server until the lease's renewal date plus the offline grace. Throws a
-   * LicenseError: `invalid_file`, `wrong_product`, or a lease failure reason such as `wrong_device`.
-   */
-  async activateOffline(licenseFile: string): Promise<LicenseState> {
-    await this.fingerprint();
-    let file: any;
-    try {
-      file = JSON.parse(licenseFile);
-    } catch {
-      throw new LicenseError('invalid_file', 'This is not a Carcha Seal offline license file.');
-    }
-    if (!file || file.format !== OFFLINE_LICENSE_FORMAT || file.version !== 1 || typeof file.token !== 'string' || typeof file.licenseKey !== 'string') {
-      throw new LicenseError('invalid_file', 'This is not a Carcha Seal offline license file.');
-    }
-    if (file.product !== this.opts.product) throw new LicenseError('wrong_product', 'This offline license file is for another product.');
-    const stored: Leased = { licenseKey: file.licenseKey.trim().toUpperCase(), token: file.token, lastSeen: this.nowSec(), offline: true };
-    const state = this.stateFromLease(stored, true);
-    if (state.status !== 'valid') {
-      throw new LicenseError(state.status === 'clock_suspect' ? 'clock_suspect' : state.reason ?? 'invalid', state.message ?? 'This offline license file cannot be used on this computer.');
-    }
-    await this.save(stored);
-    return state;
-  }
-
-  /**
-   * Gives an offline machine's seat back: removes the license from this device and returns the
-   * deactivation file (JSON text) for the vendor, who frees the seat by uploading it in the console.
-   * Throws `unlicensed` when there is no license to remove.
-   */
-  async deactivateOffline(): Promise<string> {
-    const stored = await this.load();
-    if (!stored?.token) throw new LicenseError('unlicensed', 'This device has no license.');
-    await this.clear();
-    return JSON.stringify({ format: OFFLINE_DEACTIVATION_FORMAT, version: 1, product: this.opts.product, token: stored.token }, null, 2);
-  }
-
-  async deactivate(): Promise<void> {
-    const stored = await this.load();
-    if (!stored) return;
-    try {
-      await this.post('/v1/deactivate', {
-        licenseKey: stored.licenseKey,
-        product: this.opts.product,
-        fingerprint: await this.fingerprint(),
-        ...(await this.hardware()),
-      });
-    } catch (e) {
-      if (!(e instanceof LicenseError && (e.code === 'not_activated' || e.code === 'invalid_key'))) throw e;
-    }
-    await this.clear();
-  }
-
-  static hasFeature(state: LicenseState, feature: string): boolean {
-    return (state.status === 'valid' || state.status === 'grace') && state.features.includes(feature);
-  }
-}
-
-/** The SDK class under its earlier name (LicenseKit). Same class; use Seal in new code. */
-export { Seal as LicenseKit };
-/** @deprecated The options under the class's earlier name; use SealOptions. */
-export type LicenseKitOptions = SealOptions;