@carchalabs/seal-electron 0.6.0 → 0.6.2

package/LICENSE

@@ -1,109 +1,12 @@
-Carcha Seal SDK License
-Version 1.0, 7 November 2026
+Carcha Seal SDK
+Copyright (c) 2026 Bugra Omer Aydemir (Carcha Labs). All rights reserved.
 
-Copyright (c) 2026 Bugra Omer Aydemir (Carcha Labs) ("we", "us").
-All rights not expressly granted below are reserved.
+This software is proprietary. You may use, copy and distribute it only as section 5 (the SDK license) of the
+Carcha Seal Vendor Terms allows: https://seal.carchalabs.com/terms/. You accept those terms by creating a Carcha
+Seal account or by using this software.
 
-This license covers the software in the carcha-seal-sdk repository and the packages
-built from it (the "SDK"). The source code is published so that you can review it;
-publishing it does not make it open source. Versions of the SDK published before
-7 November 2026 were released under the MIT License, which still applies to those
-versions.
+Open-source components included in this software are licensed under their own licenses, reproduced in
+THIRD-PARTY-NOTICES.txt where a package contains any.
 
-1. Definitions
-
-"Carcha Seal Service" means a license server operated by us, or a license server you
-run under a written agreement with us.
-
-"Your Application" means software that you develop and provide to your own customers,
-that uses the SDK to obtain and check licenses from the Carcha Seal Service, and whose
-main purpose is not licensing, license management, copy protection or software
-protection.
-
-"End Users" means the people and organizations that receive Your Application from you.
-
-2. What you may do
-
-As long as you comply with this license, we grant you a non-exclusive, worldwide,
-royalty-free, non-transferable license, which you may not sublicense except as
-section 2(c) allows, to:
-
-(a) use, copy and modify the SDK to integrate Your Application with the Carcha Seal
-    Service;
-
-(b) read and study the SDK's source code, for example to evaluate the SDK or to review
-    its security; and
-
-(c) distribute the SDK, unmodified or modified under (a), only as part of Your
-    Application, in object code or source code form, and let your End Users use it
-    only as part of Your Application.
-
-3. What you may not do
-
-You may not, and may not allow anyone else to:
-
-(a) sell, license, rent, lend or otherwise distribute the SDK, or any part or modified
-    version of it, on its own or as part of a software development kit, library,
-    framework or other product for developers;
-
-(b) use the SDK, or any part or modified version of it, with a license server or
-    service other than the Carcha Seal Service, except a test server you run only to
-    test Your Application;
-
-(c) use the SDK, or any part, modified version or translation of it, in a product or
-    service that substitutes for the Carcha Seal Service or the SDK, or that offers the
-    same or substantially similar functionality;
-
-(d) reverse engineer, decompile or disassemble the compiled parts of the SDK (such as
-    its native libraries), or otherwise try to derive source code we have not
-    published, except to the extent applicable law permits it despite this
-    restriction;
-
-(e) disable, bypass or tamper with the SDK's license checks, signature verification,
-    encryption or device binding, or help anyone else do so, in any application that
-    uses the Carcha Seal Service, except in Your Application while you test it;
-
-(f) remove or change this license or any copyright or other notice in the SDK; or
-
-(g) use our names, logos or trademarks, including "Carcha Seal" and "Carcha Labs",
-    except to state truthfully that Your Application uses Carcha Seal.
-
-4. Your End Users
-
-Your terms for Your Application must not give your End Users more rights in the SDK
-than to use it as part of Your Application. You are responsible for your End Users'
-use of the SDK as part of Your Application.
-
-5. Contributions
-
-If you send us changes or suggestions for the SDK, you grant us a perpetual,
-irrevocable, worldwide, royalty-free license to use, modify and distribute them for
-any purpose.
-
-6. Termination
-
-Your rights under this license end automatically if you breach it. If you end the
-breach within 30 days after we notify you of it, your rights are restored, unless you
-have breached this license before. When your rights end, you must stop using and
-distributing the SDK; your End Users may keep using copies of Your Application they
-received before then. Sections 3, 5, 7 and 8 continue to apply after termination.
-
-7. No warranty
-
-To the extent the law allows, the SDK is provided "as is", without warranty of any
-kind, express or implied, including warranties of merchantability, fitness for a
-particular purpose and non-infringement. If you have a separate written agreement with
-us for the Carcha Seal Service, its terms on warranty and liability apply to the SDK
-instead of sections 7 and 8.
-
-8. Limitation of liability
-
-To the extent the law allows, we are not liable for any damages arising from the SDK
-or this license. Nothing in this license limits or excludes liability that cannot be
-limited or excluded under applicable law, including liability for intent or gross
-negligence, for death or personal injury, or under product liability law.
-
-9. New versions of this license
-
-We may publish new versions of this license. Each version of the SDK stays under the
-license it was published with.
+Earlier versions keep the license they were published with: versions published before 7 November 2026 are under
+the MIT License; versions published on 7 November 2026 are under the Carcha Seal SDK License 1.0.

package/README.md

@@ -33,4 +33,4 @@ The SDK sends the license key, a per-product SHA-256 hash of the operating syste
 
 **Hardware components.** When `@carchalabs/seal-hwid` is installed, the SDK also sends one keyed hash per hardware part (motherboard, disk, network card, OS install, CPU and graphics models) and whether the computer is a virtual machine. The license server then recognises the computer after a new disk, network card or operating system install, and refuses a copied disk or system image on other hardware. Raw serial numbers never leave the computer. Without the package, or on a platform it has no module for, nothing extra is sent. `hardware: false` turns it off. Bundlers must leave the package to Node (mark it external); electron-builder unpacks its native module from the asar archive.
 
-Integration guide (activate once, check at start, put feature code behind `decrypt`, ship the native module, harden the app): [seal.carchalabs.com/docs/#integration](https://seal.carchalabs.com/docs/#integration). Full reference: [seal.carchalabs.com/docs](https://seal.carchalabs.com/docs/#sdk). Requires Node 22.13 or later. [Carcha Seal SDK License](LICENSE): for apps that use Carcha Seal; versions before 7 November 2026 are MIT.
+Integration guide (activate once, check at start, put feature code behind `decrypt`, ship the native module, harden the app): [seal.carchalabs.com/docs/#integration](https://seal.carchalabs.com/docs/#integration). Full reference: [seal.carchalabs.com/docs](https://seal.carchalabs.com/docs/#sdk). Requires Node 22.13 or later. Proprietary: use under the [Carcha Seal Vendor Terms](https://seal.carchalabs.com/terms/) ([LICENSE](LICENSE)).

package/dist/fingerprint.js

@@ -94,4 +94,3 @@ function fallbackTraits() {
         .sort();
     return [(0, node_os_1.hostname)(), (0, node_os_1.cpus)()[0]?.model ?? '', macs[0] ?? ''].join('|');
 }
-//# sourceMappingURL=fingerprint.js.map

package/dist/index.d.ts

@@ -80,6 +80,8 @@ export declare class Seal {
     /** The native lease verifier, when it trusts every key this app was given (undefined = not looked up yet). */
     private nativeLease?;
     private deviceKeyCache?;
+    /** The end of the operations waiting to run; see serial(). */
+    private queue;
     constructor(opts: SealOptions);
     private get fetch();
     private nowSec;
@@ -89,10 +91,17 @@ export declare class Seal {
     private hardware;
     /** The saved record; null when there is none, or it cannot be read or is not a record (as no license). */
     private load;
-    /** Replaces license.dat whole: written to license.dat.tmp, then renamed over it, so a crash or full disk mid-write
-     * leaves the previous record. */
+    /** Replaces license.dat whole: written to a temporary file of this save, then renamed over it, so a crash or full disk
+     * mid-write leaves the previous record. */
     private save;
     private clear;
+    /**
+     * Runs the operations that change license.dat one at a time, in the order they were called, as the native SDKs' lock
+     * does. Node.js calls writing one file from calls that overlap unsafe, and the answer to an earlier call (a slow
+     * check-in for the old key) must not replace what a later one saved (an activation with a new key). Reads
+     * (decrypt, requireEncrypted) do not wait: the file is replaced whole, so a read sees one record or the other.
+     */
+    private serial;
     private post;
     private emptyState;
     /**
@@ -115,7 +124,9 @@ export declare class Seal {
     private stateFromLease;
     /** machineName: the name to show the vendor for this device. Nothing is sent when the app gives none (host names often hold a person's name). */
     activate(licenseKey: string, machineName?: string): Promise<LicenseState>;
+    private activateNow;
     check(): Promise<LicenseState>;
+    private checkNow;
     /** The state from the saved record when the server gave no usable answer; a usable lease moves lastSeen forward. */
     private offlineCheck;
     /**
@@ -158,13 +169,16 @@ export declare class Seal {
      * LicenseError: `invalid_file`, `wrong_product`, or a lease failure reason such as `wrong_device`.
      */
     activateOffline(licenseFile: string): Promise<LicenseState>;
+    private activateOfflineNow;
     /**
      * Gives an offline machine's seat back: removes the license from this device and returns the
      * deactivation file (JSON text) for the vendor, who frees the seat by uploading it in the console.
      * Throws `unlicensed` when there is no license to remove.
      */
     deactivateOffline(): Promise<string>;
+    private deactivateOfflineNow;
     deactivate(): Promise<void>;
+    private deactivateNow;
     static hasFeature(state: LicenseState, feature: string): boolean;
 }
 /** The SDK class under its earlier name (LicenseKit). Same class; use Seal in new code. */

package/dist/index.js

@@ -35,11 +35,44 @@ function loadHwid() {
     }
     return hwidModule;
 }
+/**
+ * The largest answer read, as in the native SDKs: a lease and its notices are a few kilobytes. A longer one is read as no
+ * answer, so a broken or hostile server cannot make the app hold and parse hundreds of megabytes.
+ */
+const MAX_ANSWER_BYTES = 1 << 20;
+/** The answer's body as text; null when it is longer than MAX_ANSWER_BYTES or could not be read to its end. */
+async function readLimited(res) {
+    const declared = Number(res.headers.get('content-length') ?? NaN);
+    if (declared > MAX_ANSWER_BYTES || !res.body) {
+        await res.body?.cancel().catch(() => { });
+        return res.body ? null : '';
+    }
+    const reader = res.body.getReader();
+    const chunks = [];
+    let length = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            length += value.byteLength;
+            if (length > MAX_ANSWER_BYTES) {
+                await reader.cancel().catch(() => { });
+                return null;
+            }
+            chunks.push(value);
+        }
+    }
+    catch {
+        return null;
+    }
+    // UTF-8 as response.json() decodes it (a byte order mark dropped).
+    return new TextDecoder().decode(Buffer.concat(chunks));
+}
+/** Numbers this process's temporary files (see Seal.save). */
+let tempCounter = 0;
 /** The server accepts at most this many components. */
 const MAX_COMPONENTS = 32;
-/** The license itself is gone: forget the key too. The other refusals can be undone on the server (resume, renew,
- *  re-activate), so the key is kept and the next successful online check restores the license on its own. */
-const FORGET_KEY = new Set(['invalid_key', 'license_revoked']);
 const CLOCK_TOLERANCE_SECONDS = 24 * 3600;
 /**
  * A check-in answered 2xx whose lease fails for one of these reasons did not come from this app's license server for
@@ -128,6 +161,8 @@ class Seal {
     /** The native lease verifier, when it trusts every key this app was given (undefined = not looked up yet). */
     nativeLease;
     deviceKeyCache;
+    /** The end of the operations waiting to run; see serial(). */
+    queue = Promise.resolve();
     constructor(opts) {
         this.opts = opts;
         checkServerUrl(opts.serverUrl);
@@ -191,24 +226,53 @@ class Seal {
             return null;
         }
     }
-    /** Replaces license.dat whole: written to license.dat.tmp, then renamed over it, so a crash or full disk mid-write
-     * leaves the previous record. */
+    /** Replaces license.dat whole: written to a temporary file of this save, then renamed over it, so a crash or full disk
+     * mid-write leaves the previous record. */
     async save(stored) {
         await (0, promises_1.mkdir)(this.opts.storageDir, { recursive: true });
         const text = JSON.stringify(stored);
-        const temp = this.file + '.tmp';
-        try {
-            await (0, promises_1.writeFile)(temp, this.opts.secureStore ? await this.opts.secureStore.encrypt(text) : text, { mode: 0o600, flush: true });
-            await (0, promises_1.rename)(temp, this.file);
-        }
-        catch (e) {
-            await (0, promises_1.rm)(temp, { force: true }).catch(() => { });
-            throw e;
+        const data = this.opts.secureStore ? await this.opts.secureStore.encrypt(text) : text;
+        // license.dat.<pid>.<n>.tmp, created only if it does not exist (flag wx; SEI CERT FIO21-C: a unique name, opened
+        // exclusively, owner-only), so two app instances saving at the same time each write and rename their own file.
+        // A name left by a process that crashed is skipped.
+        for (let attempt = 0;; attempt++) {
+            const temp = `${this.file}.${process.pid}.${tempCounter++}.tmp`;
+            try {
+                await (0, promises_1.writeFile)(temp, data, { mode: 0o600, flush: true, flag: 'wx' });
+            }
+            catch (e) {
+                if (e.code === 'EEXIST') {
+                    if (attempt < 100)
+                        continue; // another file's name: not ours to remove
+                    throw e;
+                }
+                await (0, promises_1.rm)(temp, { force: true }).catch(() => { }); // ours, cut off mid-write
+                throw e;
+            }
+            try {
+                await (0, promises_1.rename)(temp, this.file);
+                return;
+            }
+            catch (e) {
+                await (0, promises_1.rm)(temp, { force: true }).catch(() => { });
+                throw e;
+            }
         }
     }
     async clear() {
         await (0, promises_1.rm)(this.file, { force: true });
     }
+    /**
+     * Runs the operations that change license.dat one at a time, in the order they were called, as the native SDKs' lock
+     * does. Node.js calls writing one file from calls that overlap unsafe, and the answer to an earlier call (a slow
+     * check-in for the old key) must not replace what a later one saved (an activation with a new key). Reads
+     * (decrypt, requireEncrypted) do not wait: the file is replaced whole, so a read sees one record or the other.
+     */
+    serial(operation) {
+        const run = this.queue.then(operation);
+        this.queue = run.catch(() => undefined);
+        return run;
+    }
     async post(path, body) {
         let res;
         try {
@@ -225,7 +289,19 @@ class Seal {
         catch {
             throw new LicenseError('network', 'Could not reach the license server.');
         }
-        const json = await res.json().catch(() => ({}));
+        const text = await readLimited(res);
+        // Longer than the limit, or cut off (the timeout, a broken connection): no answer, as in the native SDKs.
+        if (text === null)
+            throw new LicenseError('network', 'Could not reach the license server.');
+        let json;
+        try {
+            json = JSON.parse(text);
+        }
+        catch {
+            json = {};
+        }
+        if (typeof json !== 'object' || json === null)
+            json = {};
         if (!res.ok)
             throw new LicenseError(json.error ?? 'server_error', json.message ?? `License server error (${res.status})`, res.status);
         return json;
@@ -334,7 +410,10 @@ class Seal {
         return this.emptyState('invalid', offline, { reason: strict.reason, message: REASON_TEXT[strict.reason], keyHint });
     }
     /** machineName: the name to show the vendor for this device. Nothing is sent when the app gives none (host names often hold a person's name). */
-    async activate(licenseKey, machineName) {
+    activate(licenseKey, machineName) {
+        return this.serial(() => this.activateNow(licenseKey, machineName));
+    }
+    async activateNow(licenseKey, machineName) {
         const fingerprint = await this.fingerprint();
         const key = licenseKey.trim().toUpperCase();
         const response = await this.post('/v1/activate', {
@@ -355,7 +434,10 @@ class Seal {
         await this.save(stored);
         return state;
     }
-    async check() {
+    check() {
+        return this.serial(() => this.checkNow());
+    }
+    async checkNow() {
         try {
             await this.fingerprint();
         }
@@ -390,11 +472,11 @@ class Seal {
         }
         catch (e) {
             if (e instanceof LicenseError && DEFINITIVE.has(e.code)) {
-                // Persist the refusal: drop the signed lease so going offline cannot bring the license back.
-                if (FORGET_KEY.has(e.code))
-                    await this.clear();
-                else
-                    await this.save({ licenseKey: stored.licenseKey, lastSeen: stored.lastSeen, refused: { code: e.code, message: e.message, at: this.nowSec() } });
+                // Persist the refusal: drop the signed lease so going offline cannot bring the license back. The key is kept, also
+                // for invalid_key and license_revoked: a refusal is not signed, so anything that answers on the connection (a
+                // TLS-inspecting proxy) could send one, and the next check-in the server answers with a lease restores the
+                // license. A refusal that is real stays one: the server refuses the kept key again.
+                await this.save({ licenseKey: stored.licenseKey, lastSeen: stored.lastSeen, refused: { code: e.code, message: e.message, at: this.nowSec() } });
                 const keyHint = `${stored.licenseKey.slice(0, 7)}…${stored.licenseKey.slice(-4)}`;
                 return this.emptyState('invalid', false, { reason: e.code, message: e.message, keyHint });
             }
@@ -539,7 +621,10 @@ class Seal {
      * check() works without the server until the lease's renewal date plus the offline grace. Throws a
      * LicenseError: `invalid_file`, `wrong_product`, or a lease failure reason such as `wrong_device`.
      */
-    async activateOffline(licenseFile) {
+    activateOffline(licenseFile) {
+        return this.serial(() => this.activateOfflineNow(licenseFile));
+    }
+    async activateOfflineNow(licenseFile) {
         await this.fingerprint();
         let file;
         try {
@@ -566,14 +651,20 @@ class Seal {
      * deactivation file (JSON text) for the vendor, who frees the seat by uploading it in the console.
      * Throws `unlicensed` when there is no license to remove.
      */
-    async deactivateOffline() {
+    deactivateOffline() {
+        return this.serial(() => this.deactivateOfflineNow());
+    }
+    async deactivateOfflineNow() {
         const stored = await this.load();
         if (!stored?.token)
             throw new LicenseError('unlicensed', 'This device has no license.');
         await this.clear();
         return JSON.stringify({ format: OFFLINE_DEACTIVATION_FORMAT, version: 1, product: this.opts.product, token: stored.token }, null, 2);
     }
-    async deactivate() {
+    deactivate() {
+        return this.serial(() => this.deactivateNow());
+    }
+    async deactivateNow() {
         const stored = await this.load();
         if (!stored)
             return;
@@ -597,4 +688,3 @@ class Seal {
 }
 exports.Seal = Seal;
 exports.LicenseKit = Seal;
-//# sourceMappingURL=index.js.map

package/package.json

@@ -1,24 +1,24 @@
 {
   "name": "@carchalabs/seal-electron",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Carcha Seal (formerly LicenseKit) SDK for the Electron main process and Node: activation, offline verification, grace period",
   "keywords": ["electron", "licensing", "license-key", "software-licensing", "offline-licensing", "node-locked", "ed25519", "jws", "carcha-seal"],
   "homepage": "https://seal.carchalabs.com/docs/",
   "repository": { "type": "git", "url": "git+https://github.com/carcha-labs/carcha-seal-sdk.git", "directory": "packages/sdk-electron" },
-  "bugs": { "url": "https://github.com/carcha-labs/carcha-seal-sdk/issues" },
+  "bugs": { "email": "bugra@carchalabs.com" },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
-  "files": ["dist", "src", "!dist/**/*.test.*", "!src/**/*.test.ts"],
+  "files": ["dist", "!dist/**/*.test.*", "!dist/**/*.map"],
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "prepublishOnly": "npm run build",
     "test": "node --no-warnings=ExperimentalWarning --test dist/*.test.js"
   },
   "dependencies": {
-    "@carchalabs/seal-core": "0.5.0"
+    "@carchalabs/seal-core": "0.5.1"
   },
   "optionalDependencies": {
-    "@carchalabs/seal-hwid": "0.4.0"
+    "@carchalabs/seal-hwid": "0.4.1"
   },
   "engines": { "node": ">=22.13" },
   "publishConfig": { "access": "public" },

package/dist/fingerprint.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":";;;AA4CA,sCAaC;AAzDD,2DAA8C;AAC9C,+CAA4C;AAC5C,qCAAsE;AACtE,yCAAkC;AAClC,yCAAsC;AAEtC,MAAM,aAAa,GAAG,IAAA,qBAAS,EAAC,6BAAQ,CAAC,CAAC;AAE1C;;;GAGG;AACU,QAAA,KAAK,GAAG,iBAAiB,CAAC;AAC1B,QAAA,OAAO,GAAG;IACrB,gCAAgC;IAChC,iBAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC;CAC3E,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;AAC/C,QAAA,cAAc,GAAG,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;AAiB9E,4FAA4F;AAC5F,MAAa,yBAA0B,SAAQ,KAAK;IACzC,IAAI,GAAG,wBAAwB,CAAC;IACzC;QACE,KAAK,CAAC,oGAAoG,CAAC,CAAC;QAC5G,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAND,8DAMC;AAED,2HAA2H;AACpH,KAAK,UAAU,aAAa,CAAC,OAAsB,EAAE;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;IACjD,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC;IAChC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;QACrD,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAClB,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3D,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,aAAa;QAAE,OAAO,YAAY,cAAc,EAAE,EAAE,CAAC;IAC9D,MAAM,IAAI,yBAAyB,EAAE,CAAC;AACxC,CAAC;AAED,yDAAyD;AACzD,KAAK,UAAU,eAAe,CAAC,IAAmB;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAA,kBAAQ,GAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,aAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACpH,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC3D,IAAI,CAAC;gBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9B,CAAC;aAAM,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;YAC1B,KAAK,MAAM,GAAG,IAAI,eAAO,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,uFAAuF;oBACvF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,yCAAyC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE;wBACtH,OAAO,EAAE,IAAI;wBACb,WAAW,EAAE,IAAI;qBAClB,CAAC,CAAC;oBACH,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;oBAC3D,IAAI,CAAC;wBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,2BAA2B;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,sBAAc,EAAE,CAAC;gBAC/B,MAAM,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtD,IAAI,EAAE;oBAAE,OAAO,SAAS,EAAE,EAAE,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAA,2BAAiB,GAAE,CAAC;SAC5C,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,mBAAmB,CAAC;SACzE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,CAAC,GAAG,CAAC;SAClB,IAAI,EAAE,CAAC;IACV,OAAO,CAAC,IAAA,kBAAQ,GAAE,EAAE,IAAA,cAAI,GAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvE,CAAC"}

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AACA,qCAAmD;AACnD,+CAA0E;AAC1E,6CAA4C;AAC5C,qCAAmC;AACnC,yCAAmD;AACnD,qCAA0C;AAC1C,qDAA4K;AAC5K,+CAAyE;AAEhE,0GAFA,uCAAyB,OAEA;AAAE,8FAFA,2BAAa,OAEA;AAEjD,0GAA0G;AAC1G,iEAAiE;AACpD,QAAA,WAAW,GAAW,OAAO,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC;AAmFtE,0EAA0E;AAC1E,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAC5D,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAC5D,MAAM,2BAA2B,GAAG,iCAAiC,CAAC;AAEtE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACxL,8HAA8H;AAC9H,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAiB7C,iHAAiH;AACjH,IAAI,UAAe,CAAC;AACpB,SAAS,QAAQ;IACf,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,iEAAiE;YACjE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,uDAAuD;AACvD,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B;6GAC6G;AAC7G,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAC/D,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C;;;;GAIG;AACH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC;AACnL,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,aAAa,GAAG,4FAA4F,CAAC;AAEnH,MAAa,YAAa,SAAQ,KAAK;IAEnB;IAEA;IAHlB,YACkB,IAAY,EAC5B,OAAe,EACC,MAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAQ;QAEZ,WAAM,GAAN,MAAM,CAAS;QAG/B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AATD,oCASC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,SAAiB;IACvC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,+BAA+B,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO;IACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtH,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ;QAAE,OAAO;IACjD,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,kEAAkE,CAAC,CAAC;AACpH,CAAC;AAED,MAAM,WAAW,GAAiC;IAChD,SAAS,EAAE,sDAAsD;IACjE,aAAa,EAAE,wDAAwD;IACvE,qBAAqB,EAAE,wBAAwB;IAC/C,UAAU,EAAE,wBAAwB;IACpC,WAAW,EAAE,wBAAwB;IACrC,YAAY,EAAE,wDAAwD;IACtE,aAAa,EAAE,aAAa;IAC5B,aAAa,EAAE,0CAA0C;IACzD,YAAY,EAAE,8CAA8C;IAC5D,OAAO,EAAE,2BAA2B;IACpC,qBAAqB,EAAE,kDAAkD;CAC1E,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAE1E,wGAAwG;AACxG,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,MAAM,GAAW,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;IACpD,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACxD,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IAChG,MAAM,CAAC,GAAG,CAAC,CAAC,OAA8C,CAAC;IAC3D,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QAAE,MAAM,CAAC,OAAO,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;IAClK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAsB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC9H,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;QAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,QAAa;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1H,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,MAAa,IAAI;IASc;IARZ,IAAI,CAAS;IACb,IAAI,CAAyB;IACtC,gBAAgB,CAAU;IAC1B,aAAa,CAAkC;IACvD,8GAA8G;IACtG,WAAW,CAAsB;IACjC,cAAc,CAAiB;IAEvC,YAA6B,IAAiB;QAAjB,SAAI,GAAJ,IAAI,CAAa;QAC5C,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAA,gBAAI,EAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,IAAA,kBAAM,EAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACtC,CAAC;IAEO,MAAM;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,IAAY,gBAAgB;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QACpC,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,IAAA,2BAAa,EAAC,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,uCAAyB;oBAAE,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;gBACtF,MAAM,CAAC,CAAC;YACV,CAAC;YACD,IAAI,CAAC,gBAAgB,GAAG,IAAA,2BAAe,EAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,yFAAyF;IACjF,QAAQ;QACd,IAAI,CAAC,aAAa,KAAK,CAAC,KAAK,IAAI,EAAE;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YAClC,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YAClC,IAAI,CAAC;gBACH,IAAI,MAAM;oBAAE,OAAO,MAAM,MAAM,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI;oBAAE,OAAO,IAAI,CAAC;gBACvB,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3E,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,CAAC,yEAAyE;YACxF,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACxC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAC7H,CAAC;IACJ,CAAC;IAED,0GAA0G;IAClG,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACrG,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;qCACiC;IACzB,KAAK,CAAC,IAAI,CAAC,MAAc;QAC/B,MAAM,IAAA,gBAAK,EAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAA,oBAAS,EAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9H,MAAM,IAAA,iBAAM,EAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAA,aAAE,EAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAChD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,MAAM,IAAA,aAAE,EAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAA6B;QAC5D,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE;gBACrE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,mGAAmG;gBACnG,4FAA4F;gBAC5F,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC;aAChE,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CAAC,SAAS,EAAE,qCAAqC,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,GAAQ,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,cAAc,EAAE,IAAI,CAAC,OAAO,IAAI,yBAAyB,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACtI,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,UAAU,CAAC,MAAqB,EAAE,OAAgB,EAAE,QAA+B,EAAE;QAC3F,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;IAC/G,CAAC;IAED;;;;OAIG;IACK,SAAS;QACf,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,GAAG,GAAkB,IAAI,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACnE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,UAAU,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;oBAC1G,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,GAAG,IAAI,CAAC;YACb,CAAC;YACD,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC;QAC5B,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACK,MAAM;QACZ,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;YACxB,IAAI,MAAM,GAAuB,IAAI,CAAC;YACtC,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,UAAU,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAC7F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;gBACpD,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAAE,MAAM,GAAG,IAAI,CAAC;YAC5E,CAAC;YACD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC;QAC5B,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,KAAa,EAAE,OAA2B;QACvD,MAAM,MAAM,GAAG,IAAA,uBAAW,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE;YACtC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACjD,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;QACtF,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACjE,CAAC;IAEO,cAAc,CAAC,MAAc,EAAE,OAAgB;QACrD,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAiB,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,IAAI,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,GAAG,MAAM,CAAC,QAAQ,GAAG,uBAAuB,EAAE,CAAC;YAChG,OAAO,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,aAAa,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC;QAC5F,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,CAAC,MAAmB,EAAE,EAAE,CAAC,CAAC;YAC3C,QAAQ,EAAE,MAAM,CAAC,GAAG;YACpB,QAAQ,EAAE,MAAM,CAAC,IAAI;YACrB,SAAS,EAAE,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;YAC9D,gBAAgB,EAAE,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;YACrE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,OAAO;YACP,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5G,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,GAAG,KAAK,CAAC;YACvF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;YACrF,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO;oBACL,MAAM,EAAE,OAAO;oBACf,OAAO;oBACP,MAAM,EAAE,eAAe;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACrB,CAAC,CAAC,4GAA4G;wBAC9G,CAAC,CAAC,sEAAsE;oBAC1E,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC7B,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,QAAQ,CAAC,CAAC;iBAC1F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACtH,CAAC;IAED,iJAAiJ;IACjJ,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,WAAoB;QACrD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;YAC/C,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAC1B,WAAW;YACX,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACtC,QAAQ,EAAE,IAAA,kBAAQ,GAAE;YACpB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,UAAU,EAAE,mBAAW;YACvB,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,GAAG,IAAI,CAAC,SAAS,EAAE;SACpB,CAAC,CAAC;QACH,MAAM,MAAM,GAAW,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrH,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO;YAAE,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,KAAK,CAAC,OAAO,IAAI,qCAAqC,CAAC,CAAC;QAC7L,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,yEAAyE;YACzE,IAAI,CAAC,YAAY,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,wBAAwB;gBAAE,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACvJ,MAAM,CAAC,CAAC;QACV,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACnC,2FAA2F;YAC3F,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;YAC5E,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACzD,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,QAAa,CAAC;QAClB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;gBACzC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;gBAC1B,WAAW,EAAE,IAAI,CAAC,gBAAgB;gBAClC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;gBAChC,UAAU,EAAE,mBAAW;gBACvB,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,GAAG,IAAI,CAAC,SAAS,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,YAAY,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,6FAA6F;gBAC7F,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;;oBAC1C,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;gBACrJ,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClF,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5F,CAAC;YACD,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,OAAO,QAAQ,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,KAAK,GAAW,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClI,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAChD,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,2BAA2B,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBACzF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,wEAAwE;QACxE,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,oHAAoH;IAC5G,KAAK,CAAC,YAAY,CAAC,MAAc;QACvC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;YACtH,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5E,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACzD,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,IAAgB;QAC7C,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,IAAY;QAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,aAAa,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IAEgB,gBAAgB,GAAG,IAAI,GAAG,EAA2E,CAAC;IAE/G,aAAa,CAAC,IAAY,EAAE,OAAe,EAAE,IAAkC;QACrF,MAAM,QAAQ,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAA,sBAAY,EAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,EAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1E,sFAAsF;QACtF,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,IAAA,2BAAa,EAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,CAAC,CAAC,OAAe,EAAE,EAAE;YACxC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,GAAG,IAAA,mBAAO,EAAC,IAAA,mBAAO,EAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;gBACjD,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,MAAM,EAAE,GAAG,IAAI,SAAS,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAA,oBAAU,EAAC,SAAS,CAAC,CAAC,CAAC;gBAC3H,IAAI,SAAS;oBAAE,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC,CAAmB,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC;QACpJ,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAA,yBAAe,EAAC,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC/G,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAA,mBAAO,EAAC,QAAQ,CAAC,CAAC,CAAC;QACrF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvC,MAAM,CAAC,CAAC;QACV,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;QAClB,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,MAAM,CAAC,OAAe;QAClC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,EAAE,KAAK;YAAE,MAAM,IAAI,YAAY,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;QACxF,MAAM,MAAM,GAAW,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACzD,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,KAAK,CAAC,OAAO,IAAI,2BAA2B,CAAC,CAAC;QACzJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,uBAAW,EAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACjD,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzH,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7H,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAgB,EAAE,EAAE;YAC1B,MAAM,MAAM,GACV,MAAM,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,UAAU;gBACnD,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3F,CAAC,CAAC,IAAA,0BAAc,EAAC,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACjH,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc;gBAAE,MAAM,IAAI,YAAY,CAAC,sBAAsB,EAAE,kCAAkC,OAAO,IAAI,CAAC,CAAC;YACpI,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB;gBAAE,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,oDAAoD,CAAC,CAAC;YACvI,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,MAAsB,CAAC,IAAI,2BAA2B,CAAC,CAAC;QAChI,CAAC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,UAAkB,EAAE,WAAoB;QAC3D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG;YACjB,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;YAC3C,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAC1B,WAAW;YACX,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACtC,QAAQ,EAAE,IAAA,kBAAQ,GAAE;YACpB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,UAAU,EAAE,mBAAW;YACvB,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,GAAG,IAAI,CAAC,SAAS,EAAE;SACpB,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,WAAmB;QACvC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,IAAI,IAAS,CAAC;QACd,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,iDAAiD,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,sBAAsB,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnJ,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,iDAAiD,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,mDAAmD,CAAC,CAAC;QACrI,MAAM,MAAM,GAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACvI,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,KAAK,CAAC,OAAO,IAAI,4DAA4D,CAAC,CAAC;QACxL,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,EAAE,KAAK;YAAE,MAAM,IAAI,YAAY,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACvI,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE;gBAChC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;gBAC1B,WAAW,EAAE,MAAM,IAAI,CAAC,WAAW,EAAE;gBACrC,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,YAAY,YAAY,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,KAAmB,EAAE,OAAe;QACpD,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpG,CAAC;CACF;AAvdD,oBAudC;AAGgB,0BAAU"}

package/src/fingerprint.ts

@@ -1,103 +0,0 @@
-import { execFile } from 'node:child_process';
-import { readFile } from 'node:fs/promises';
-import { cpus, hostname, networkInterfaces, platform } from 'node:os';
-import { win32 } from 'node:path';
-import { promisify } from 'node:util';
-
-const execFileAsync = promisify(execFile);
-
-/**
- * The OS tools are run by absolute path, never looked up through PATH: an app started from a terminal inherits the
- * user's PATH, and a fake `ioreg` or `reg` placed first in it could report another computer's id.
- */
-export const IOREG = '/usr/sbin/ioreg';
-export const REG_EXE = [
-  'C:\\Windows\\System32\\reg.exe',
-  win32.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'reg.exe'),
-].filter((file, index, all) => all.indexOf(file) === index);
-export const LINUX_ID_FILES = ['/etc/machine-id', '/var/lib/dbus/machine-id'];
-
-export interface MachineIdDeps {
-  platform?: NodeJS.Platform;
-  /** Attempts to read the OS id before giving up (default 3). */
-  attempts?: number;
-  /** Pause between attempts (default 250 ms, doubled each time). */
-  delayMs?: number;
-  /**
-   * Use hostname + CPU + MAC when the OS id cannot be read. Off by default: that value differs from the OS id, so the
-   * same computer would look like a new device and take another seat.
-   */
-  allowFallback?: boolean;
-  run?: (file: string, args: string[], options: { timeout: number; windowsHide: boolean }) => Promise<{ stdout: string }>;
-  readText?: (file: string) => Promise<string>;
-}
-
-/** The OS id could not be read; licensing on this computer cannot continue until it can. */
-export class MachineIdUnavailableError extends Error {
-  readonly code = 'machine_id_unavailable';
-  constructor() {
-    super('This computer\'s id could not be read. Try again; if it keeps failing, contact the app\'s support.');
-    this.name = 'MachineIdUnavailableError';
-  }
-}
-
-/** Reads a stable, OS-provided machine id, retrying a few times. Throws MachineIdUnavailableError unless allowFallback. */
-export async function readMachineId(deps: MachineIdDeps = {}): Promise<string> {
-  const attempts = Math.max(1, deps.attempts ?? 3);
-  let delay = deps.delayMs ?? 250;
-  for (let attempt = 1; attempt <= attempts; attempt++) {
-    const id = await readOsMachineId(deps);
-    if (id) return id;
-    if (attempt < attempts) {
-      await new Promise((resolve) => setTimeout(resolve, delay));
-      delay *= 2;
-    }
-  }
-  if (deps.allowFallback) return `fallback:${fallbackTraits()}`;
-  throw new MachineIdUnavailableError();
-}
-
-/** One attempt; null when the OS id is not available. */
-async function readOsMachineId(deps: MachineIdDeps): Promise<string | null> {
-  const os = deps.platform ?? platform();
-  const run = deps.run ?? ((file, args, options) => execFileAsync(file, args, options));
-  const readText = deps.readText ?? ((file) => readFile(file, 'utf8'));
-  try {
-    if (os === 'darwin') {
-      const { stdout } = await run(IOREG, ['-rd1', '-c', 'IOPlatformExpertDevice'], { timeout: 3000, windowsHide: true });
-      const m = stdout.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
-      if (m) return `mac:${m[1]}`;
-    } else if (os === 'win32') {
-      for (const reg of REG_EXE) {
-        try {
-          // /reg:64 reads the 64-bit registry view, so a 32-bit build sees the same MachineGuid.
-          const { stdout } = await run(reg, ['query', 'HKLM\\SOFTWARE\\Microsoft\\Cryptography', '/v', 'MachineGuid', '/reg:64'], {
-            timeout: 3000,
-            windowsHide: true,
-          });
-          const m = stdout.match(/MachineGuid\s+REG_SZ\s+([\w-]+)/i);
-          if (m) return `win:${m[1]}`;
-        } catch {
-          /* try the next location */
-        }
-      }
-    } else {
-      for (const f of LINUX_ID_FILES) {
-        const id = (await readText(f).catch(() => '')).trim();
-        if (id) return `linux:${id}`;
-      }
-    }
-  } catch {
-    /* fall through */
-  }
-  return null;
-}
-
-function fallbackTraits(): string {
-  const macs = Object.values(networkInterfaces())
-    .flat()
-    .filter((i) => i && !i.internal && i.mac && i.mac !== '00:00:00:00:00:00')
-    .map((i) => i!.mac)
-    .sort();
-  return [hostname(), cpus()[0]?.model ?? '', macs[0] ?? ''].join('|');
-}

package/src/index.ts

@@ -1,692 +0,0 @@
-import { KeyObject } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
-import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
-import { createRequire } from 'node:module';
-import { platform } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
-import { compileFunction } from 'node:vm';
-import { decodeLease, decryptFeature, hashFingerprint, keySet, LeaseClaims, LeaseFailure, LeaseVerifyOptions, LeaseVerifyResult, verifyLease } from '@carchalabs/seal-core';
-import { MachineIdUnavailableError, readMachineId } from './fingerprint';
-
-export { MachineIdUnavailableError, readMachineId };
-
-/** This SDK's version, sent to the server so vendors can see (and require) which SDK each device runs. */
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-export const SDK_VERSION: string = require('../package.json').version;
-
-export type LicenseStatus = 'valid' | 'grace' | 'invalid' | 'unlicensed' | 'clock_suspect';
-
-/**
- * Something the server asks the app to act on: sdk_update_recommended (update the Carcha Seal SDK in the app) or
- * app_update_recommended (the vendor's minimum app version), each with minimum and requiredFrom.
- */
-export interface LicenseNotice {
-  code: string;
-  minimum?: string;
-  /** ISO date from which an older SDK is refused; null when the update is only recommended. */
-  requiredFrom?: string | null;
-}
-
-export interface LicenseState {
-  status: LicenseStatus;
-  offline: boolean;
-  storageProtected: boolean;
-  reason?: string;
-  message?: string;
-  customer?: string;
-  features: string[];
-  expiresAt: string | null;
-  maintenanceUntil?: string | null;
-  revalidateBy?: string;
-  keyHint?: string;
-  /** From the last successful check-in; kept while offline. The app decides how to show them. */
-  notices?: LicenseNotice[];
-  /** True when the license came from an offline license file (activateOffline); renew it with a new file. */
-  offlineActivated?: boolean;
-}
-
-/** Hashed hardware components (see @carchalabs/seal-hwid); the server matches a device by them. */
-export interface HardwareReport {
-  components: { kind: string; hash: string }[];
-  /** True when the device runs as a virtual machine. */
-  vm: boolean;
-}
-
-export interface SecureStore {
-  encrypt(plain: string): Buffer | Promise<Buffer>;
-  decrypt(cipher: Buffer): string | Promise<string>;
-  isProtected?(): boolean;
-}
-
-export interface SealOptions {
-  /** The license server: https://, or http:// on this computer only (localhost, 127.x.x.x, [::1]). */
-  serverUrl: string;
-  product: string;
-  publicKey: string | string[];
-  storageDir: string;
-  appVersion?: string;
-  graceDays?: number;
-  secureStore?: SecureStore;
-  requestTimeoutMs?: number;
-  fetchImpl?: typeof fetch;
-  machineId?: () => Promise<string>;
-  /** Use hostname + CPU + MAC when the OS machine id cannot be read (default false; see readMachineId). */
-  allowFallbackFingerprint?: boolean;
-  /**
-   * Hardware components sent with each request, so the device keeps its seat after a new disk, network
-   * card or OS install. Default: read with @carchalabs/seal-hwid when it is installed; nothing is
-   * sent when it is not (or cannot load on this platform). false: never send them. A function: your own.
-   */
-  hardware?: false | (() => HardwareReport | null | Promise<HardwareReport | null>);
-  now?: () => number;
-}
-
-interface Stored {
-  licenseKey: string;
-  /** Signed lease. Absent after the server refused this device: nothing is left to verify offline. */
-  token?: string;
-  lastSeen?: number;
-  /** The server's last definitive refusal, kept so an offline check reports it instead of an old lease. */
-  refused?: { code: string; message: string; at: number };
-  notices?: LicenseNotice[];
-  /** Activated from an offline license file: check() never calls the server; a new file renews it. */
-  offline?: boolean;
-}
-
-type Leased = Stored & { token: string };
-
-/** File formats of offline activation, shared with the license server. */
-const OFFLINE_REQUEST_FORMAT = 'licensekit-offline-request';
-const OFFLINE_LICENSE_FORMAT = 'licensekit-offline-license';
-const OFFLINE_DEACTIVATION_FORMAT = 'licensekit-offline-deactivation';
-
-const DEFINITIVE = new Set(['invalid_key', 'not_activated', 'license_suspended', 'license_revoked', 'license_expired', 'sdk_update_required', 'app_update_required', 'vm_not_allowed']);
-/** The native hardware module. A non-literal require: bundlers leave it to Node, which must load the .node file from disk. */
-const HWID_PACKAGE = '@carchalabs/seal-hwid';
-/** The native module's lease verifier (@carchalabs/seal-hwid 0.2+): its keys are compiled in. */
-interface NativeLease {
-  verifyLease(token: string, check: { product: string; fingerprintHash: string; now: number; graceSeconds?: number }): { ok: boolean; reason?: string };
-  leaseKeyIds(): string[];
-  /** This machine's X25519 public key from its hardware (base64url), or null. */
-  devicePublicKey?(key: string): string | null;
-  /** @carchalabs/seal-hwid 0.2+ with feature keys. */
-  decryptFeature?(
-    token: string,
-    check: { product: string; fingerprintHash: string; now: number; graceSeconds?: number },
-    licenseKey: string,
-    feature: string,
-    data: Buffer,
-  ): { ok: boolean; data?: Buffer; reason?: string };
-}
-
-/** Loads the native module once per process; null when it is not installed or has no build for this platform. */
-let hwidModule: any;
-function loadHwid(): any {
-  if (hwidModule === undefined) {
-    try {
-      // eslint-disable-next-line @typescript-eslint/no-require-imports
-      hwidModule = require(HWID_PACKAGE);
-    } catch {
-      hwidModule = null;
-    }
-  }
-  return hwidModule;
-}
-
-/** The server accepts at most this many components. */
-const MAX_COMPONENTS = 32;
-/** The license itself is gone: forget the key too. The other refusals can be undone on the server (resume, renew,
- *  re-activate), so the key is kept and the next successful online check restores the license on its own. */
-const FORGET_KEY = new Set(['invalid_key', 'license_revoked']);
-const CLOCK_TOLERANCE_SECONDS = 24 * 3600;
-/**
- * A check-in answered 2xx whose lease fails for one of these reasons did not come from this app's license server for
- * this device (a TLS-inspecting proxy's or captive portal's page, say): it is treated as no answer, and the saved lease
- * is kept. A lease that fails only on time (not_yet_valid, expired, revalidation_required) is the server's, and is used.
- */
-const NOT_A_LEASE_FOR_THIS_DEVICE = new Set(['malformed', 'unsupported_algorithm', 'wrong_type', 'unknown_key', 'bad_signature', 'wrong_issuer', 'wrong_product', 'wrong_device']);
-const DEFAULT_GRACE_DAYS = 7;
-const CLOCK_MESSAGE = 'The date and time on this computer look wrong. Correct them, then connect to the internet.';
-
-export class LicenseError extends Error {
-  constructor(
-    public readonly code: string,
-    message: string,
-    public readonly status?: number,
-  ) {
-    super(message);
-    this.name = 'LicenseError';
-  }
-}
-
-/**
- * Refuses a server address that would send requests in plain text (OWASP ASVS 4.1.2, 12.2.1): every request
- * carries the license key and the device's fingerprint. http:// is accepted for this computer only, where a server
- * under development runs; `localhost` and the loopback addresses do not leave the machine.
- */
-function checkServerUrl(serverUrl: string): void {
-  let url: URL;
-  try {
-    url = new URL(serverUrl);
-  } catch {
-    throw new LicenseError('invalid_server_url', 'serverUrl is not a valid URL.');
-  }
-  if (url.protocol === 'https:') return;
-  const loopback = url.hostname === 'localhost' || url.hostname === '[::1]' || /^127(\.\d{1,3}){3}$/.test(url.hostname);
-  if (url.protocol === 'http:' && loopback) return;
-  throw new LicenseError('insecure_server_url', 'serverUrl must start with https:// (http:// only for localhost).');
-}
-
-const REASON_TEXT: Record<LeaseFailure, string> = {
-  malformed: 'The saved license is damaged. Please activate again.',
-  bad_signature: 'The saved license was modified. Please activate again.',
-  unsupported_algorithm: 'Please update the app.',
-  wrong_type: 'Please update the app.',
-  unknown_key: 'Please update the app.',
-  wrong_issuer: 'This license was issued by a different license server.',
-  not_yet_valid: CLOCK_MESSAGE,
-  wrong_product: 'This license is for a different product.',
-  wrong_device: 'This license is activated on another device.',
-  expired: 'Your license has expired.',
-  revalidation_required: 'Connect to the internet to confirm your license.',
-};
-
-const toIso = (seconds: number) => new Date(seconds * 1000).toISOString();
-
-/** A saved record of the shape save() writes, keeping only its known fields; null for anything else. */
-function parseStored(value: unknown): Stored | null {
-  if (typeof value !== 'object' || value === null || Array.isArray(value)) return null;
-  const v = value as Record<string, unknown>;
-  if (typeof v.licenseKey !== 'string') return null;
-  const stored: Stored = { licenseKey: v.licenseKey };
-  if (typeof v.token === 'string') stored.token = v.token;
-  if (typeof v.lastSeen === 'number' && Number.isFinite(v.lastSeen)) stored.lastSeen = v.lastSeen;
-  const r = v.refused as Record<string, unknown> | undefined;
-  if (r && typeof r.code === 'string' && typeof r.message === 'string' && typeof r.at === 'number') stored.refused = { code: r.code, message: r.message, at: r.at };
-  if (Array.isArray(v.notices)) stored.notices = v.notices.filter((n): n is LicenseNotice => !!n && typeof n.code === 'string');
-  if (v.offline === true) stored.offline = true;
-  return stored;
-}
-
-function noticesFrom(response: any): { notices?: LicenseNotice[] } {
-  const list = Array.isArray(response?.notices) ? response.notices.filter((n: any) => n && typeof n.code === 'string') : [];
-  return list.length ? { notices: list } : {};
-}
-
-export class Seal {
-  private readonly file: string;
-  private readonly keys: Map<string, KeyObject>;
-  private fingerprintCache?: string;
-  private hardwareCache?: Promise<HardwareReport | null>;
-  /** The native lease verifier, when it trusts every key this app was given (undefined = not looked up yet). */
-  private nativeLease?: NativeLease | null;
-  private deviceKeyCache?: string | null;
-
-  constructor(private readonly opts: SealOptions) {
-    checkServerUrl(opts.serverUrl);
-    this.file = join(opts.storageDir, 'license.dat');
-    this.keys = keySet(Array.isArray(opts.publicKey) ? opts.publicKey : [opts.publicKey]);
-  }
-
-  private get fetch() {
-    return this.opts.fetchImpl ?? fetch;
-  }
-
-  private nowSec() {
-    return Math.floor((this.opts.now?.() ?? Date.now()) / 1000);
-  }
-
-  private get storageProtected(): boolean {
-    const store = this.opts.secureStore;
-    return store !== undefined && (store.isProtected?.() ?? true);
-  }
-
-  async fingerprint(): Promise<string> {
-    if (!this.fingerprintCache) {
-      let raw: string;
-      try {
-        raw = await (this.opts.machineId ?? (() => readMachineId({ allowFallback: this.opts.allowFallbackFingerprint })))();
-      } catch (e) {
-        if (e instanceof MachineIdUnavailableError) throw new LicenseError(e.code, e.message);
-        throw e;
-      }
-      this.fingerprintCache = hashFingerprint(raw, this.opts.product);
-    }
-    return this.fingerprintCache;
-  }
-
-  /** Read once per instance: hardware does not change while the app runs. Never throws. */
-  private hardware(): Promise<{ components?: HardwareReport['components']; vm?: boolean }> {
-    this.hardwareCache ??= (async () => {
-      const source = this.opts.hardware;
-      if (source === false) return null;
-      try {
-        if (source) return await source();
-        const hwid = loadHwid();
-        if (!hwid) return null;
-        const { components, vm } = hwid.collect(`licensekit:${this.opts.product}`);
-        return { components, vm };
-      } catch {
-        return null; // not installed, or no module for this platform: send nothing, as before
-      }
-    })();
-    return this.hardwareCache.then((report) =>
-      report && report.components.length ? { components: report.components.slice(0, MAX_COMPONENTS), vm: report.vm === true } : {},
-    );
-  }
-
-  /** The saved record; null when there is none, or it cannot be read or is not a record (as no license). */
-  private async load(): Promise<Stored | null> {
-    try {
-      const buf = await readFile(this.file);
-      const text = this.opts.secureStore ? await this.opts.secureStore.decrypt(buf) : buf.toString('utf8');
-      return parseStored(JSON.parse(text));
-    } catch {
-      return null;
-    }
-  }
-
-  /** Replaces license.dat whole: written to license.dat.tmp, then renamed over it, so a crash or full disk mid-write
-   * leaves the previous record. */
-  private async save(stored: Stored) {
-    await mkdir(this.opts.storageDir, { recursive: true });
-    const text = JSON.stringify(stored);
-    const temp = this.file + '.tmp';
-    try {
-      await writeFile(temp, this.opts.secureStore ? await this.opts.secureStore.encrypt(text) : text, { mode: 0o600, flush: true });
-      await rename(temp, this.file);
-    } catch (e) {
-      await rm(temp, { force: true }).catch(() => {});
-      throw e;
-    }
-  }
-
-  private async clear() {
-    await rm(this.file, { force: true });
-  }
-
-  private async post(path: string, body: Record<string, unknown>): Promise<any> {
-    let res: Response;
-    try {
-      res = await this.fetch(this.opts.serverUrl.replace(/\/+$/, '') + path, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify(body),
-        // A redirect is refused, not followed: it could take the request, license key included, to another
-        // address or to http:// (ASVS 4.1.2). The server answers its API at the configured address.
-        redirect: 'error',
-        signal: AbortSignal.timeout(this.opts.requestTimeoutMs ?? 8000),
-      });
-    } catch {
-      throw new LicenseError('network', 'Could not reach the license server.');
-    }
-    const json: any = await res.json().catch(() => ({}));
-    if (!res.ok) throw new LicenseError(json.error ?? 'server_error', json.message ?? `License server error (${res.status})`, res.status);
-    return json;
-  }
-
-  private emptyState(status: LicenseStatus, offline: boolean, extra: Partial<LicenseState> = {}): LicenseState {
-    return { status, offline, storageProtected: this.storageProtected, features: [], expiresAt: null, ...extra };
-  }
-
-  /**
-   * The device's public key, sent with activation and check-ins so the server wraps feature keys for
-   * this machine only. Only when the native module verifies for this app (it then also decrypts, with
-   * the matching secret it derives itself) and hardware is not turned off. Never throws.
-   */
-  private deviceKey(): { devicePublicKey?: string } {
-    if (this.deviceKeyCache === undefined) {
-      let key: string | null = null;
-      try {
-        const native = this.opts.hardware === false ? null : this.native();
-        if (native && typeof native.devicePublicKey === 'function' && typeof native.decryptFeature === 'function') {
-          key = native.devicePublicKey(`licensekit:${this.opts.product}`);
-        }
-      } catch {
-        key = null;
-      }
-      this.deviceKeyCache = key;
-    }
-    return this.deviceKeyCache ? { devicePublicKey: this.deviceKeyCache } : {};
-  }
-
-  /**
-   * The native verifier, used only when its compiled-in keys include every key this app was given:
-   * an app that trusts other keys (a self-hosted server) is checked by the JavaScript verifier alone.
-   */
-  private native(): NativeLease | null {
-    if (this.nativeLease === undefined) {
-      const hwid = loadHwid();
-      let native: NativeLease | null = null;
-      if (hwid && typeof hwid.verifyLease === 'function' && typeof hwid.leaseKeyIds === 'function') {
-        const trusted = new Set<string>(hwid.leaseKeyIds());
-        if ([...this.keys.keys()].every((kid) => trusted.has(kid))) native = hwid;
-      }
-      this.nativeLease = native;
-    }
-    return this.nativeLease;
-  }
-
-  /**
-   * Verifies a lease twice, in JavaScript and in the native module, when the native verifier applies.
-   * Both follow the same rules, so a different answer means one of them was tampered with: the lease
-   * is then treated as modified.
-   */
-  private verify(token: string, options: LeaseVerifyOptions): LeaseVerifyResult {
-    const result = verifyLease(token, options);
-    const native = this.native();
-    if (!native) return result;
-    const check = native.verifyLease(token, {
-      product: options.product,
-      fingerprintHash: options.fingerprintHash,
-      now: options.now ?? Math.floor(Date.now() / 1000),
-      ...(options.graceSeconds !== undefined ? { graceSeconds: options.graceSeconds } : {}),
-    });
-    const agree = check.ok === result.ok && (result.ok || check.reason === result.reason);
-    return agree ? result : { ok: false, reason: 'bad_signature' };
-  }
-
-  private stateFromLease(stored: Leased, offline: boolean): LicenseState {
-    const fingerprintHash = this.fingerprintCache!;
-    const now = this.nowSec();
-    const keyHint = `${stored.licenseKey.slice(0, 7)}…${stored.licenseKey.slice(-4)}`;
-    if (offline && stored.lastSeen !== undefined && now < stored.lastSeen - CLOCK_TOLERANCE_SECONDS) {
-      return this.emptyState('clock_suspect', offline, { reason: 'clock_rollback', message: CLOCK_MESSAGE, keyHint });
-    }
-    const verifyOptions = { keys: this.keys, product: this.opts.product, fingerprintHash, now };
-    const strict = this.verify(stored.token, verifyOptions);
-    const fromClaims = (claims: LeaseClaims) => ({
-      customer: claims.cus,
-      features: claims.feat,
-      expiresAt: claims.exp === undefined ? null : toIso(claims.exp),
-      maintenanceUntil: claims.mnt === undefined ? null : toIso(claims.mnt),
-      storageProtected: this.storageProtected,
-      keyHint,
-      ...(stored.notices ? { notices: stored.notices } : {}),
-      ...(stored.offline ? { offlineActivated: true } : {}),
-    });
-    if (strict.ok) {
-      return { status: 'valid', offline, ...fromClaims(strict.claims), revalidateBy: toIso(strict.claims.rev) };
-    }
-    if (strict.reason === 'not_yet_valid') {
-      return this.emptyState('clock_suspect', offline, { reason: 'lease_from_future', message: CLOCK_MESSAGE, keyHint });
-    }
-    if (strict.reason === 'revalidation_required' && strict.claims) {
-      const grace = strict.claims.grc ?? (this.opts.graceDays ?? DEFAULT_GRACE_DAYS) * 86400;
-      const lenient = this.verify(stored.token, { ...verifyOptions, graceSeconds: grace });
-      if (lenient.ok) {
-        return {
-          status: 'grace',
-          offline,
-          reason: 'offline_grace',
-          message: stored.offline
-            ? 'This offline license is past its renewal date. Load a new offline license file soon to keep using the app.'
-            : 'Working offline. Connect to the internet soon to keep using the app.',
-          ...fromClaims(lenient.claims),
-          revalidateBy: toIso(Math.min(lenient.claims.rev + grace, lenient.claims.exp ?? Infinity)),
-        };
-      }
-    }
-    return this.emptyState('invalid', offline, { reason: strict.reason, message: REASON_TEXT[strict.reason], keyHint });
-  }
-
-  /** machineName: the name to show the vendor for this device. Nothing is sent when the app gives none (host names often hold a person's name). */
-  async activate(licenseKey: string, machineName?: string): Promise<LicenseState> {
-    const fingerprint = await this.fingerprint();
-    const key = licenseKey.trim().toUpperCase();
-    const response = await this.post('/v1/activate', {
-      licenseKey: key,
-      product: this.opts.product,
-      fingerprint,
-      machineName: machineName?.slice(0, 80),
-      platform: platform(),
-      appVersion: this.opts.appVersion,
-      sdkVersion: SDK_VERSION,
-      ...(await this.hardware()),
-      ...this.deviceKey(),
-    });
-    const stored: Leased = { licenseKey: key, token: response.token, lastSeen: this.nowSec(), ...noticesFrom(response) };
-    const state = this.stateFromLease(stored, false);
-    if (state.status !== 'valid') throw new LicenseError(state.status === 'clock_suspect' ? 'clock_suspect' : state.reason ?? 'invalid', state.message ?? 'Server returned an unusable license');
-    await this.save(stored);
-    return state;
-  }
-
-  async check(): Promise<LicenseState> {
-    try {
-      await this.fingerprint();
-    } catch (e) {
-      // Nothing is changed on disk: the next check tries to read the id again.
-      if (e instanceof LicenseError && e.code === 'machine_id_unavailable') return this.emptyState('invalid', false, { reason: e.code, message: e.message });
-      throw e;
-    }
-    const stored = await this.load();
-    if (!stored) return this.emptyState('unlicensed', false);
-    if (stored.offline && stored.token) {
-      // Activated from an offline license file: the machine is not expected to reach the server.
-      const state = this.stateFromLease({ ...stored, token: stored.token }, true);
-      if (state.status === 'valid' || state.status === 'grace') {
-        await this.save({ ...stored, lastSeen: Math.max(stored.lastSeen ?? 0, this.nowSec()) });
-      }
-      return state;
-    }
-    let response: any;
-    try {
-      response = await this.post('/v1/validate', {
-        licenseKey: stored.licenseKey,
-        product: this.opts.product,
-        fingerprint: this.fingerprintCache,
-        appVersion: this.opts.appVersion,
-        sdkVersion: SDK_VERSION,
-        ...(await this.hardware()),
-        ...this.deviceKey(),
-      });
-    } catch (e) {
-      if (e instanceof LicenseError && DEFINITIVE.has(e.code)) {
-        // Persist the refusal: drop the signed lease so going offline cannot bring the license back.
-        if (FORGET_KEY.has(e.code)) await this.clear();
-        else await this.save({ licenseKey: stored.licenseKey, lastSeen: stored.lastSeen, refused: { code: e.code, message: e.message, at: this.nowSec() } });
-        const keyHint = `${stored.licenseKey.slice(0, 7)}…${stored.licenseKey.slice(-4)}`;
-        return this.emptyState('invalid', false, { reason: e.code, message: e.message, keyHint });
-      }
-      return this.offlineCheck(stored);
-    }
-    if (typeof response?.token === 'string') {
-      const fresh: Leased = { licenseKey: stored.licenseKey, token: response.token, lastSeen: this.nowSec(), ...noticesFrom(response) };
-      const state = this.stateFromLease(fresh, false);
-      if (!(state.status === 'invalid' && NOT_A_LEASE_FOR_THIS_DEVICE.has(state.reason ?? ''))) {
-        await this.save(fresh);
-        return state;
-      }
-    }
-    // A 2xx without a lease from this server for this device: as no answer.
-    return this.offlineCheck(stored);
-  }
-
-  /** The state from the saved record when the server gave no usable answer; a usable lease moves lastSeen forward. */
-  private async offlineCheck(stored: Stored): Promise<LicenseState> {
-    if (!stored.token) {
-      const keyHint = `${stored.licenseKey.slice(0, 7)}…${stored.licenseKey.slice(-4)}`;
-      const refused = stored.refused ?? { code: 'not_activated', message: 'This device is not activated for this license' };
-      return this.emptyState('invalid', true, { reason: refused.code, message: refused.message, keyHint });
-    }
-    const state = this.stateFromLease({ ...stored, token: stored.token }, true);
-    if (state.status === 'valid' || state.status === 'grace') {
-      await this.save({ ...stored, lastSeen: Math.max(stored.lastSeen ?? 0, this.nowSec()) });
-    }
-    return state;
-  }
-
-  /**
-   * Decrypts data you encrypted for a feature (encryptForFeature in @carchalabs/seal-core, with the
-   * feature's content key from the console). Works offline: it uses the saved lease, which must be valid
-   * (or in its offline grace period), grant the feature and carry its key, and the saved license key.
-   * The native module does the work when it trusts this app's keys, so the content key never reaches
-   * JavaScript; without it the JavaScript implementation is used. Throws a LicenseError:
-   * `unlicensed`, a lease failure reason, `clock_suspect`, `feature_not_licensed` or `decrypt_failed`.
-   */
-  async decrypt(feature: string, data: Uint8Array): Promise<Buffer> {
-    return (await this.opener(feature))(data);
-  }
-
-  /**
-   * Envelope: loads a CommonJS module you encrypted for a feature (seal-encrypt, one file or a
-   * folder) and returns its exports, like require(). The code is decrypted with the lease's feature key
-   * (see decrypt) and compiled from memory; it never exists as a plain file. Relative requires inside
-   * it load encrypted neighbours (`./x` finds `x.lke`, `x.js.lke` or `x/index.js.lke`), anything else
-   * goes to Node as usual. Loaded once per process, like require(). Throws the same LicenseErrors as
-   * decrypt. A licensed user can still read the code from memory: this keeps an app with the license
-   * check removed from having the feature, it does not hide the code from its licensed users.
-   */
-  async requireEncrypted(feature: string, file: string): Promise<any> {
-    const open = await this.opener(feature);
-    return this.loadEncrypted(resolve(file), feature, open);
-  }
-
-  private readonly encryptedModules = new Map<string, { exports: any; filename: string; id: string; loaded: boolean }>();
-
-  private loadEncrypted(file: string, feature: string, open: (data: Uint8Array) => Buffer): any {
-    const cacheKey = `${feature}\0${file}`;
-    const cached = this.encryptedModules.get(cacheKey);
-    if (cached) return cached.exports;
-    const source = open(readFileSync(file)).toString('utf8');
-    const filename = file.replace(/\.lke$/, '');
-    const mod = { exports: {} as any, filename, id: filename, loaded: false };
-    // Registered before it runs, so a require cycle gets the partial exports, as in Node.
-    this.encryptedModules.set(cacheKey, mod);
-    const nodeRequire = createRequire(filename);
-    const localRequire = ((request: string) => {
-      if (request.startsWith('./') || request.startsWith('../')) {
-        const base = resolve(dirname(filename), request);
-        const encrypted = [`${base}.lke`, `${base}.js.lke`, join(base, 'index.js.lke')].find((candidate) => existsSync(candidate));
-        if (encrypted) return this.loadEncrypted(encrypted, feature, open);
-      }
-      return nodeRequire(request);
-    }) as NodeJS.Require;
-    Object.assign(localRequire, { resolve: nodeRequire.resolve, cache: nodeRequire.cache, main: nodeRequire.main, extensions: nodeRequire.extensions });
-    try {
-      const run = compileFunction(source, ['exports', 'require', 'module', '__filename', '__dirname'], { filename });
-      run.call(mod.exports, mod.exports, localRequire, mod, filename, dirname(filename));
-    } catch (e) {
-      this.encryptedModules.delete(cacheKey);
-      throw e;
-    }
-    mod.loaded = true;
-    return mod.exports;
-  }
-
-  /**
-   * Checks the saved lease once for a feature and returns a synchronous decrypter bound to it: decrypt
-   * uses it once, requireEncrypted for a module and the encrypted modules it requires.
-   */
-  private async opener(feature: string): Promise<(data: Uint8Array) => Buffer> {
-    const fingerprintHash = await this.fingerprint();
-    const stored = await this.load();
-    if (!stored?.token) throw new LicenseError('unlicensed', 'This device has no license.');
-    const leased: Leased = { ...stored, token: stored.token };
-    const state = this.stateFromLease(leased, true);
-    if (state.status !== 'valid' && state.status !== 'grace') {
-      throw new LicenseError(state.status === 'clock_suspect' ? 'clock_suspect' : (state.reason ?? 'invalid'), state.message ?? 'The license is not valid.');
-    }
-    const claims = decodeLease(leased.token)?.claims;
-    const graceSeconds = state.status === 'grace' ? (claims?.grc ?? (this.opts.graceDays ?? DEFAULT_GRACE_DAYS) * 86400) : 0;
-    const check = { product: this.opts.product, fingerprintHash, now: this.nowSec(), ...(graceSeconds ? { graceSeconds } : {}) };
-    const native = this.native();
-    return (data: Uint8Array) => {
-      const result: { ok: boolean; data?: Buffer; reason?: string } =
-        native && typeof native.decryptFeature === 'function'
-          ? native.decryptFeature(leased.token, check, leased.licenseKey, feature, Buffer.from(data))
-          : decryptFeature(leased.token, { keys: this.keys, ...check }, leased.licenseKey, feature, Buffer.from(data));
-      if (result.ok && result.data) return Buffer.from(result.data);
-      if (result.reason === 'not_licensed') throw new LicenseError('feature_not_licensed', `This license does not include "${feature}".`);
-      if (result.reason === 'decrypt_failed') throw new LicenseError('decrypt_failed', 'The data could not be decrypted with this license.');
-      throw new LicenseError(result.reason ?? 'invalid', REASON_TEXT[result.reason as LeaseFailure] ?? 'The license is not valid.');
-    };
-  }
-
-  /**
-   * Offline activation, step 1 on a machine that cannot reach the server: the request file (JSON text)
-   * the user takes to a connected device. The license server turns it into a license file at
-   * POST /v1/offline/activate (or its offline activation page). It holds what activate() would send:
-   * the license key, this device's fingerprint and hashed hardware parts, never raw serial numbers.
-   */
-  async offlineRequest(licenseKey: string, machineName?: string): Promise<string> {
-    const fingerprint = await this.fingerprint();
-    const activation = {
-      licenseKey: licenseKey.trim().toUpperCase(),
-      product: this.opts.product,
-      fingerprint,
-      machineName: machineName?.slice(0, 80),
-      platform: platform(),
-      appVersion: this.opts.appVersion,
-      sdkVersion: SDK_VERSION,
-      ...(await this.hardware()),
-      ...this.deviceKey(),
-    };
-    return JSON.stringify({ format: OFFLINE_REQUEST_FORMAT, version: 1, activation }, null, 2);
-  }
-
-  /**
-   * Offline activation, step 2: loads the license file the server issued for this machine's request.
-   * It is verified like an online lease (signature, product, this device) and then saved; from then on
-   * check() works without the server until the lease's renewal date plus the offline grace. Throws a
-   * LicenseError: `invalid_file`, `wrong_product`, or a lease failure reason such as `wrong_device`.
-   */
-  async activateOffline(licenseFile: string): Promise<LicenseState> {
-    await this.fingerprint();
-    let file: any;
-    try {
-      file = JSON.parse(licenseFile);
-    } catch {
-      throw new LicenseError('invalid_file', 'This is not a Carcha Seal offline license file.');
-    }
-    if (!file || file.format !== OFFLINE_LICENSE_FORMAT || file.version !== 1 || typeof file.token !== 'string' || typeof file.licenseKey !== 'string') {
-      throw new LicenseError('invalid_file', 'This is not a Carcha Seal offline license file.');
-    }
-    if (file.product !== this.opts.product) throw new LicenseError('wrong_product', 'This offline license file is for another product.');
-    const stored: Leased = { licenseKey: file.licenseKey.trim().toUpperCase(), token: file.token, lastSeen: this.nowSec(), offline: true };
-    const state = this.stateFromLease(stored, true);
-    if (state.status !== 'valid') {
-      throw new LicenseError(state.status === 'clock_suspect' ? 'clock_suspect' : state.reason ?? 'invalid', state.message ?? 'This offline license file cannot be used on this computer.');
-    }
-    await this.save(stored);
-    return state;
-  }
-
-  /**
-   * Gives an offline machine's seat back: removes the license from this device and returns the
-   * deactivation file (JSON text) for the vendor, who frees the seat by uploading it in the console.
-   * Throws `unlicensed` when there is no license to remove.
-   */
-  async deactivateOffline(): Promise<string> {
-    const stored = await this.load();
-    if (!stored?.token) throw new LicenseError('unlicensed', 'This device has no license.');
-    await this.clear();
-    return JSON.stringify({ format: OFFLINE_DEACTIVATION_FORMAT, version: 1, product: this.opts.product, token: stored.token }, null, 2);
-  }
-
-  async deactivate(): Promise<void> {
-    const stored = await this.load();
-    if (!stored) return;
-    try {
-      await this.post('/v1/deactivate', {
-        licenseKey: stored.licenseKey,
-        product: this.opts.product,
-        fingerprint: await this.fingerprint(),
-        ...(await this.hardware()),
-      });
-    } catch (e) {
-      if (!(e instanceof LicenseError && (e.code === 'not_activated' || e.code === 'invalid_key'))) throw e;
-    }
-    await this.clear();
-  }
-
-  static hasFeature(state: LicenseState, feature: string): boolean {
-    return (state.status === 'valid' || state.status === 'grace') && state.features.includes(feature);
-  }
-}
-
-/** The SDK class under its earlier name (LicenseKit). Same class; use Seal in new code. */
-export { Seal as LicenseKit };
-/** @deprecated The options under the class's earlier name; use SealOptions. */
-export type LicenseKitOptions = SealOptions;