@hyperbridge/simplex 0.16.8 → 0.16.12

package/dist/config-storage.cjs

@@ -0,0 +1,186 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/config/storage.ts
+var storage_exports = {};
+__export(storage_exports, {
+  decryptConfig: () => decryptConfig,
+  encryptConfig: () => encryptConfig,
+  encryptedConfigStore: () => encryptedConfigStore,
+  isEncryptedConfig: () => isEncryptedConfig,
+  openSecret: () => openSecret,
+  passwordKey: () => passwordKey,
+  readConfigFile: () => readConfigFile,
+  readConfigKey: () => readConfigKey,
+  sealSecret: () => sealSecret,
+  writeSecretAtomic: () => writeSecretAtomic
+});
+module.exports = __toCommonJS(storage_exports);
+var import_node_crypto = require("node:crypto");
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
+var CONFIG_HEADER = "SIMPLEX-ENCRYPTED-CONFIG-V1\n";
+var MAX_CONFIG_BYTES = 2 * 1024 * 1024;
+function writeSecretAtomic(path, content) {
+  const temp = (0, import_node_path.join)((0, import_node_path.dirname)(path), `.${(0, import_node_path.basename)(path)}.${(0, import_node_crypto.randomBytes)(12).toString("hex")}.tmp`);
+  let fd;
+  try {
+    fd = (0, import_node_fs.openSync)(temp, "wx", 384);
+    (0, import_node_fs.writeFileSync)(fd, content);
+    (0, import_node_fs.fsyncSync)(fd);
+    (0, import_node_fs.closeSync)(fd);
+    fd = void 0;
+    (0, import_node_fs.renameSync)(temp, path);
+    if (process.platform !== "win32") {
+      const directory = (0, import_node_fs.openSync)((0, import_node_path.dirname)(path), "r");
+      try {
+        (0, import_node_fs.fsyncSync)(directory);
+      } finally {
+        (0, import_node_fs.closeSync)(directory);
+      }
+    }
+  } catch (error) {
+    if (fd !== void 0) (0, import_node_fs.closeSync)(fd);
+    try {
+      (0, import_node_fs.unlinkSync)(temp);
+    } catch {
+    }
+    throw error;
+  }
+}
+function bytes(value, length) {
+  if (typeof value !== "string" || value.length > MAX_CONFIG_BYTES * 2 || !/^(?:[a-f0-9]{2})*$/.test(value)) {
+    throw new Error("Invalid encrypted data");
+  }
+  const decoded = Buffer.from(value, "hex");
+  if (length !== void 0 && decoded.length !== length) throw new Error("Invalid encrypted data");
+  return decoded;
+}
+function sealSecret(plaintext, key, purpose) {
+  if (key.length !== 32) throw new Error("Invalid encryption key");
+  const iv = (0, import_node_crypto.randomBytes)(12);
+  const cipher = (0, import_node_crypto.createCipheriv)("aes-256-gcm", key, iv);
+  const aad = Buffer.from(purpose);
+  cipher.setAAD(aad);
+  const data = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  return { iv: iv.toString("hex"), tag: cipher.getAuthTag().toString("hex"), data: data.toString("hex") };
+}
+function openSecret(sealed, key, purpose) {
+  if (key.length !== 32 || !sealed || typeof sealed !== "object") throw new Error("Invalid encrypted data");
+  const decipher = (0, import_node_crypto.createDecipheriv)("aes-256-gcm", key, bytes(sealed.iv, 12));
+  decipher.setAAD(Buffer.from(purpose));
+  decipher.setAuthTag(bytes(sealed.tag, 16));
+  return Buffer.concat([decipher.update(bytes(sealed.data)), decipher.final()]);
+}
+function passwordKey(password, salt) {
+  const saltBytes = bytes(salt, 16);
+  return new Promise((resolveKey, reject) => {
+    (0, import_node_crypto.scrypt)(password, saltBytes, 32, { N: 131072, r: 8, p: 1, maxmem: 192 * 1024 * 1024 }, (error, key) => {
+      if (error) reject(error);
+      else resolveKey(key);
+    });
+  });
+}
+function isEncryptedConfig(content) {
+  return content.startsWith("SIMPLEX-ENCRYPTED-CONFIG-");
+}
+function encryptConfig(content, key) {
+  if (Buffer.byteLength(content) > MAX_CONFIG_BYTES) throw new Error("Config is too large");
+  const plaintext = Buffer.from(content);
+  try {
+    return CONFIG_HEADER + JSON.stringify(sealSecret(plaintext, key, "simplex/config/v1")) + "\n";
+  } finally {
+    plaintext.fill(0);
+  }
+}
+function decryptConfig(content, key) {
+  if (!content.startsWith(CONFIG_HEADER) || content.length > MAX_CONFIG_BYTES * 2 + 1024) {
+    throw new Error("Unsupported or invalid encrypted config");
+  }
+  const plaintext = openSecret(JSON.parse(content.slice(CONFIG_HEADER.length)), key, "simplex/config/v1");
+  try {
+    return plaintext.toString("utf8");
+  } finally {
+    plaintext.fill(0);
+  }
+}
+function readConfigFile(path, key) {
+  const content = (0, import_node_fs.readFileSync)(path, "utf8");
+  if (isEncryptedConfig(content)) {
+    if (!key) throw new Error("This config is encrypted. Open Simplex Desktop to unlock it.");
+    return decryptConfig(content, key);
+  }
+  if (key) throw new Error("Refusing to load a plaintext config in protected desktop mode");
+  return content;
+}
+function encryptedConfigStore(path, key) {
+  const target = (0, import_node_path.resolve)(path);
+  return {
+    path: target,
+    exists: () => (0, import_node_fs.existsSync)(target),
+    read: () => readConfigFile(target, key),
+    write: (requestedPath, content) => {
+      if ((0, import_node_path.resolve)(requestedPath) !== target)
+        throw new Error("Desktop config must stay in its protected data directory");
+      writeSecretAtomic(target, encryptConfig(content, key));
+    }
+  };
+}
+function readConfigKey(input, timeoutMs = 5e3) {
+  return new Promise((resolveKey, reject) => {
+    const key = Buffer.alloc(32);
+    let offset = 0;
+    const finish = (error) => {
+      clearTimeout(timer);
+      input.removeListener("data", onData);
+      input.removeListener("end", onEnd);
+      input.removeListener("error", onError);
+      input.destroy();
+      if (error) {
+        key.fill(0);
+        reject(error);
+      } else resolveKey(key);
+    };
+    const onData = (chunk) => {
+      if (!Buffer.isBuffer(chunk) || offset + chunk.length > 32)
+        return finish(new Error("Invalid desktop key handoff"));
+      chunk.copy(key, offset);
+      offset += chunk.length;
+      chunk.fill(0);
+    };
+    const onEnd = () => finish(offset === 32 ? void 0 : new Error("Incomplete desktop key handoff"));
+    const onError = () => finish(new Error("Desktop key handoff failed"));
+    const timer = setTimeout(() => finish(new Error("Desktop key handoff timed out")), timeoutMs);
+    input.on("data", onData).once("end", onEnd).once("error", onError);
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  decryptConfig,
+  encryptConfig,
+  encryptedConfigStore,
+  isEncryptedConfig,
+  openSecret,
+  passwordKey,
+  readConfigFile,
+  readConfigKey,
+  sealSecret,
+  writeSecretAtomic
+});
+//# sourceMappingURL=config-storage.cjs.map

package/dist/config-storage.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/storage.ts"],"sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes, scrypt } from \"node:crypto\"\nimport {\n\tcloseSync,\n\texistsSync,\n\tfsyncSync,\n\topenSync,\n\treadFileSync,\n\trenameSync,\n\tunlinkSync,\n\twriteFileSync,\n} from \"node:fs\"\nimport { basename, dirname, join, resolve } from \"node:path\"\nimport type { Readable } from \"node:stream\"\n\nconst CONFIG_HEADER = \"SIMPLEX-ENCRYPTED-CONFIG-V1\\n\"\nconst MAX_CONFIG_BYTES = 2 * 1024 * 1024\nexport type SealedSecret = { iv: string; tag: string; data: string }\n\n/** Used for both the encrypted config and its wrapped key; no plaintext temp file is created. */\nexport function writeSecretAtomic(path: string, content: string): void {\n\tconst temp = join(dirname(path), `.${basename(path)}.${randomBytes(12).toString(\"hex\")}.tmp`)\n\tlet fd: number | undefined\n\ttry {\n\t\tfd = openSync(temp, \"wx\", 0o600)\n\t\twriteFileSync(fd, content)\n\t\tfsyncSync(fd)\n\t\tcloseSync(fd)\n\t\tfd = undefined\n\t\trenameSync(temp, path)\n\t\t// Persist the directory entry before a following encrypted write relies on\n\t\t// this file (notably the password-wrapped key written before migration).\n\t\tif (process.platform !== \"win32\") {\n\t\t\tconst directory = openSync(dirname(path), \"r\")\n\t\t\ttry {\n\t\t\t\tfsyncSync(directory)\n\t\t\t} finally {\n\t\t\t\tcloseSync(directory)\n\t\t\t}\n\t\t}\n\t} catch (error) {\n\t\tif (fd !== undefined) closeSync(fd)\n\t\ttry {\n\t\t\tunlinkSync(temp)\n\t\t} catch {}\n\t\tthrow error\n\t}\n}\n\nfunction bytes(value: unknown, length?: number): Buffer {\n\tif (typeof value !== \"string\" || value.length > MAX_CONFIG_BYTES * 2 || !/^(?:[a-f0-9]{2})*$/.test(value)) {\n\t\tthrow new Error(\"Invalid encrypted data\")\n\t}\n\tconst decoded = Buffer.from(value, \"hex\")\n\tif (length !== undefined && decoded.length !== length) throw new Error(\"Invalid encrypted data\")\n\treturn decoded\n}\n\nexport function sealSecret(plaintext: Buffer, key: Buffer, purpose: string): SealedSecret {\n\tif (key.length !== 32) throw new Error(\"Invalid encryption key\")\n\tconst iv = randomBytes(12)\n\tconst cipher = createCipheriv(\"aes-256-gcm\", key, iv)\n\tconst aad = Buffer.from(purpose)\n\tcipher.setAAD(aad)\n\tconst data = Buffer.concat([cipher.update(plaintext), cipher.final()])\n\treturn { iv: iv.toString(\"hex\"), tag: cipher.getAuthTag().toString(\"hex\"), data: data.toString(\"hex\") }\n}\n\nexport function openSecret(sealed: SealedSecret, key: Buffer, purpose: string): Buffer {\n\tif (key.length !== 32 || !sealed || typeof sealed !== \"object\") throw new Error(\"Invalid encrypted data\")\n\tconst decipher = createDecipheriv(\"aes-256-gcm\", key, bytes(sealed.iv, 12))\n\tdecipher.setAAD(Buffer.from(purpose))\n\tdecipher.setAuthTag(bytes(sealed.tag, 16))\n\treturn Buffer.concat([decipher.update(bytes(sealed.data)), decipher.final()])\n}\n\n/** Fixed work factors are versioned by the desktop vault, never supplied by an untrusted file. */\nexport function passwordKey(password: string, salt: string): Promise<Buffer> {\n\tconst saltBytes = bytes(salt, 16)\n\treturn new Promise((resolveKey, reject) => {\n\t\tscrypt(password, saltBytes, 32, { N: 131072, r: 8, p: 1, maxmem: 192 * 1024 * 1024 }, (error, key) => {\n\t\t\tif (error) reject(error)\n\t\t\telse resolveKey(key)\n\t\t})\n\t})\n}\n\nexport function isEncryptedConfig(content: string): boolean {\n\treturn content.startsWith(\"SIMPLEX-ENCRYPTED-CONFIG-\")\n}\n\nexport function encryptConfig(content: string, key: Buffer): string {\n\tif (Buffer.byteLength(content) > MAX_CONFIG_BYTES) throw new Error(\"Config is too large\")\n\tconst plaintext = Buffer.from(content)\n\ttry {\n\t\treturn CONFIG_HEADER + JSON.stringify(sealSecret(plaintext, key, \"simplex/config/v1\")) + \"\\n\"\n\t} finally {\n\t\tplaintext.fill(0)\n\t}\n}\n\nexport function decryptConfig(content: string, key: Buffer): string {\n\tif (!content.startsWith(CONFIG_HEADER) || content.length > MAX_CONFIG_BYTES * 2 + 1024) {\n\t\tthrow new Error(\"Unsupported or invalid encrypted config\")\n\t}\n\tconst plaintext = openSecret(JSON.parse(content.slice(CONFIG_HEADER.length)), key, \"simplex/config/v1\")\n\ttry {\n\t\treturn plaintext.toString(\"utf8\")\n\t} finally {\n\t\tplaintext.fill(0)\n\t}\n}\n\nexport function readConfigFile(path: string, key?: Buffer): string {\n\tconst content = readFileSync(path, \"utf8\")\n\tif (isEncryptedConfig(content)) {\n\t\tif (!key) throw new Error(\"This config is encrypted. Open Simplex Desktop to unlock it.\")\n\t\treturn decryptConfig(content, key)\n\t}\n\tif (key) throw new Error(\"Refusing to load a plaintext config in protected desktop mode\")\n\treturn content\n}\n\n/** One protected destination for initial setup and every subsequent runtime edit. */\nexport function encryptedConfigStore(path: string, key: Buffer) {\n\tconst target = resolve(path)\n\treturn {\n\t\tpath: target,\n\t\texists: () => existsSync(target),\n\t\tread: () => readConfigFile(target, key),\n\t\twrite: (requestedPath: string, content: string) => {\n\t\t\tif (resolve(requestedPath) !== target)\n\t\t\t\tthrow new Error(\"Desktop config must stay in its protected data directory\")\n\t\t\twriteSecretAtomic(target, encryptConfig(content, key))\n\t\t},\n\t}\n}\n\n/** A one-shot inherited pipe avoids keys in argv, the environment, or temporary files. */\nexport function readConfigKey(input: Readable, timeoutMs = 5_000): Promise<Buffer> {\n\treturn new Promise((resolveKey, reject) => {\n\t\tconst key = Buffer.alloc(32)\n\t\tlet offset = 0\n\t\tconst finish = (error?: Error) => {\n\t\t\tclearTimeout(timer)\n\t\t\tinput.removeListener(\"data\", onData)\n\t\t\tinput.removeListener(\"end\", onEnd)\n\t\t\tinput.removeListener(\"error\", onError)\n\t\t\tinput.destroy()\n\t\t\tif (error) {\n\t\t\t\tkey.fill(0)\n\t\t\t\treject(error)\n\t\t\t} else resolveKey(key)\n\t\t}\n\t\tconst onData = (chunk: Buffer) => {\n\t\t\tif (!Buffer.isBuffer(chunk) || offset + chunk.length > 32)\n\t\t\t\treturn finish(new Error(\"Invalid desktop key handoff\"))\n\t\t\tchunk.copy(key, offset)\n\t\t\toffset += chunk.length\n\t\t\tchunk.fill(0)\n\t\t}\n\t\tconst onEnd = () => finish(offset === 32 ? undefined : new Error(\"Incomplete desktop key handoff\"))\n\t\tconst onError = () => finish(new Error(\"Desktop key handoff failed\"))\n\t\tconst timer = setTimeout(() => finish(new Error(\"Desktop key handoff timed out\")), timeoutMs)\n\t\tinput.on(\"data\", onData).once(\"end\", onEnd).once(\"error\", onError)\n\t})\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAAsE;AACtE,qBASO;AACP,uBAAiD;AAGjD,IAAM,gBAAgB;AACtB,IAAM,mBAAmB,IAAI,OAAO;AAI7B,SAAS,kBAAkB,MAAc,SAAuB;AACtE,QAAM,WAAO,2BAAK,0BAAQ,IAAI,GAAG,QAAI,2BAAS,IAAI,CAAC,QAAI,gCAAY,EAAE,EAAE,SAAS,KAAK,CAAC,MAAM;AAC5F,MAAI;AACJ,MAAI;AACH,aAAK,yBAAS,MAAM,MAAM,GAAK;AAC/B,sCAAc,IAAI,OAAO;AACzB,kCAAU,EAAE;AACZ,kCAAU,EAAE;AACZ,SAAK;AACL,mCAAW,MAAM,IAAI;AAGrB,QAAI,QAAQ,aAAa,SAAS;AACjC,YAAM,gBAAY,6BAAS,0BAAQ,IAAI,GAAG,GAAG;AAC7C,UAAI;AACH,sCAAU,SAAS;AAAA,MACpB,UAAE;AACD,sCAAU,SAAS;AAAA,MACpB;AAAA,IACD;AAAA,EACD,SAAS,OAAO;AACf,QAAI,OAAO,OAAW,+BAAU,EAAE;AAClC,QAAI;AACH,qCAAW,IAAI;AAAA,IAChB,QAAQ;AAAA,IAAC;AACT,UAAM;AAAA,EACP;AACD;AAEA,SAAS,MAAM,OAAgB,QAAyB;AACvD,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,mBAAmB,KAAK,CAAC,qBAAqB,KAAK,KAAK,GAAG;AAC1G,UAAM,IAAI,MAAM,wBAAwB;AAAA,EACzC;AACA,QAAM,UAAU,OAAO,KAAK,OAAO,KAAK;AACxC,MAAI,WAAW,UAAa,QAAQ,WAAW,OAAQ,OAAM,IAAI,MAAM,wBAAwB;AAC/F,SAAO;AACR;AAEO,SAAS,WAAW,WAAmB,KAAa,SAA+B;AACzF,MAAI,IAAI,WAAW,GAAI,OAAM,IAAI,MAAM,wBAAwB;AAC/D,QAAM,SAAK,gCAAY,EAAE;AACzB,QAAM,aAAS,mCAAe,eAAe,KAAK,EAAE;AACpD,QAAM,MAAM,OAAO,KAAK,OAAO;AAC/B,SAAO,OAAO,GAAG;AACjB,QAAM,OAAO,OAAO,OAAO,CAAC,OAAO,OAAO,SAAS,GAAG,OAAO,MAAM,CAAC,CAAC;AACrE,SAAO,EAAE,IAAI,GAAG,SAAS,KAAK,GAAG,KAAK,OAAO,WAAW,EAAE,SAAS,KAAK,GAAG,MAAM,KAAK,SAAS,KAAK,EAAE;AACvG;AAEO,SAAS,WAAW,QAAsB,KAAa,SAAyB;AACtF,MAAI,IAAI,WAAW,MAAM,CAAC,UAAU,OAAO,WAAW,SAAU,OAAM,IAAI,MAAM,wBAAwB;AACxG,QAAM,eAAW,qCAAiB,eAAe,KAAK,MAAM,OAAO,IAAI,EAAE,CAAC;AAC1E,WAAS,OAAO,OAAO,KAAK,OAAO,CAAC;AACpC,WAAS,WAAW,MAAM,OAAO,KAAK,EAAE,CAAC;AACzC,SAAO,OAAO,OAAO,CAAC,SAAS,OAAO,MAAM,OAAO,IAAI,CAAC,GAAG,SAAS,MAAM,CAAC,CAAC;AAC7E;AAGO,SAAS,YAAY,UAAkB,MAA+B;AAC5E,QAAM,YAAY,MAAM,MAAM,EAAE;AAChC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW;AAC1C,mCAAO,UAAU,WAAW,IAAI,EAAE,GAAG,QAAQ,GAAG,GAAG,GAAG,GAAG,QAAQ,MAAM,OAAO,KAAK,GAAG,CAAC,OAAO,QAAQ;AACrG,UAAI,MAAO,QAAO,KAAK;AAAA,UAClB,YAAW,GAAG;AAAA,IACpB,CAAC;AAAA,EACF,CAAC;AACF;AAEO,SAAS,kBAAkB,SAA0B;AAC3D,SAAO,QAAQ,WAAW,2BAA2B;AACtD;AAEO,SAAS,cAAc,SAAiB,KAAqB;AACnE,MAAI,OAAO,WAAW,OAAO,IAAI,iBAAkB,OAAM,IAAI,MAAM,qBAAqB;AACxF,QAAM,YAAY,OAAO,KAAK,OAAO;AACrC,MAAI;AACH,WAAO,gBAAgB,KAAK,UAAU,WAAW,WAAW,KAAK,mBAAmB,CAAC,IAAI;AAAA,EAC1F,UAAE;AACD,cAAU,KAAK,CAAC;AAAA,EACjB;AACD;AAEO,SAAS,cAAc,SAAiB,KAAqB;AACnE,MAAI,CAAC,QAAQ,WAAW,aAAa,KAAK,QAAQ,SAAS,mBAAmB,IAAI,MAAM;AACvF,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC1D;AACA,QAAM,YAAY,WAAW,KAAK,MAAM,QAAQ,MAAM,cAAc,MAAM,CAAC,GAAG,KAAK,mBAAmB;AACtG,MAAI;AACH,WAAO,UAAU,SAAS,MAAM;AAAA,EACjC,UAAE;AACD,cAAU,KAAK,CAAC;AAAA,EACjB;AACD;AAEO,SAAS,eAAe,MAAc,KAAsB;AAClE,QAAM,cAAU,6BAAa,MAAM,MAAM;AACzC,MAAI,kBAAkB,OAAO,GAAG;AAC/B,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,8DAA8D;AACxF,WAAO,cAAc,SAAS,GAAG;AAAA,EAClC;AACA,MAAI,IAAK,OAAM,IAAI,MAAM,+DAA+D;AACxF,SAAO;AACR;AAGO,SAAS,qBAAqB,MAAc,KAAa;AAC/D,QAAM,aAAS,0BAAQ,IAAI;AAC3B,SAAO;AAAA,IACN,MAAM;AAAA,IACN,QAAQ,UAAM,2BAAW,MAAM;AAAA,IAC/B,MAAM,MAAM,eAAe,QAAQ,GAAG;AAAA,IACtC,OAAO,CAAC,eAAuB,YAAoB;AAClD,cAAI,0BAAQ,aAAa,MAAM;AAC9B,cAAM,IAAI,MAAM,0DAA0D;AAC3E,wBAAkB,QAAQ,cAAc,SAAS,GAAG,CAAC;AAAA,IACtD;AAAA,EACD;AACD;AAGO,SAAS,cAAc,OAAiB,YAAY,KAAwB;AAClF,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW;AAC1C,UAAM,MAAM,OAAO,MAAM,EAAE;AAC3B,QAAI,SAAS;AACb,UAAM,SAAS,CAAC,UAAkB;AACjC,mBAAa,KAAK;AAClB,YAAM,eAAe,QAAQ,MAAM;AACnC,YAAM,eAAe,OAAO,KAAK;AACjC,YAAM,eAAe,SAAS,OAAO;AACrC,YAAM,QAAQ;AACd,UAAI,OAAO;AACV,YAAI,KAAK,CAAC;AACV,eAAO,KAAK;AAAA,MACb,MAAO,YAAW,GAAG;AAAA,IACtB;AACA,UAAM,SAAS,CAAC,UAAkB;AACjC,UAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,MAAM,SAAS;AACtD,eAAO,OAAO,IAAI,MAAM,6BAA6B,CAAC;AACvD,YAAM,KAAK,KAAK,MAAM;AACtB,gBAAU,MAAM;AAChB,YAAM,KAAK,CAAC;AAAA,IACb;AACA,UAAM,QAAQ,MAAM,OAAO,WAAW,KAAK,SAAY,IAAI,MAAM,gCAAgC,CAAC;AAClG,UAAM,UAAU,MAAM,OAAO,IAAI,MAAM,4BAA4B,CAAC;AACpE,UAAM,QAAQ,WAAW,MAAM,OAAO,IAAI,MAAM,+BAA+B,CAAC,GAAG,SAAS;AAC5F,UAAM,GAAG,QAAQ,MAAM,EAAE,KAAK,OAAO,KAAK,EAAE,KAAK,SAAS,OAAO;AAAA,EAClE,CAAC;AACF;","names":[]}

package/dist/config-storage.d.cts

@@ -0,0 +1,28 @@
+import { Readable } from 'node:stream';
+
+type SealedSecret = {
+    iv: string;
+    tag: string;
+    data: string;
+};
+/** Used for both the encrypted config and its wrapped key; no plaintext temp file is created. */
+declare function writeSecretAtomic(path: string, content: string): void;
+declare function sealSecret(plaintext: Buffer, key: Buffer, purpose: string): SealedSecret;
+declare function openSecret(sealed: SealedSecret, key: Buffer, purpose: string): Buffer;
+/** Fixed work factors are versioned by the desktop vault, never supplied by an untrusted file. */
+declare function passwordKey(password: string, salt: string): Promise<Buffer>;
+declare function isEncryptedConfig(content: string): boolean;
+declare function encryptConfig(content: string, key: Buffer): string;
+declare function decryptConfig(content: string, key: Buffer): string;
+declare function readConfigFile(path: string, key?: Buffer): string;
+/** One protected destination for initial setup and every subsequent runtime edit. */
+declare function encryptedConfigStore(path: string, key: Buffer): {
+    path: string;
+    exists: () => boolean;
+    read: () => string;
+    write: (requestedPath: string, content: string) => void;
+};
+/** A one-shot inherited pipe avoids keys in argv, the environment, or temporary files. */
+declare function readConfigKey(input: Readable, timeoutMs?: number): Promise<Buffer>;
+
+export { type SealedSecret, decryptConfig, encryptConfig, encryptedConfigStore, isEncryptedConfig, openSecret, passwordKey, readConfigFile, readConfigKey, sealSecret, writeSecretAtomic };

package/dist/config-storage.d.ts

@@ -0,0 +1,28 @@
+import { Readable } from 'node:stream';
+
+type SealedSecret = {
+    iv: string;
+    tag: string;
+    data: string;
+};
+/** Used for both the encrypted config and its wrapped key; no plaintext temp file is created. */
+declare function writeSecretAtomic(path: string, content: string): void;
+declare function sealSecret(plaintext: Buffer, key: Buffer, purpose: string): SealedSecret;
+declare function openSecret(sealed: SealedSecret, key: Buffer, purpose: string): Buffer;
+/** Fixed work factors are versioned by the desktop vault, never supplied by an untrusted file. */
+declare function passwordKey(password: string, salt: string): Promise<Buffer>;
+declare function isEncryptedConfig(content: string): boolean;
+declare function encryptConfig(content: string, key: Buffer): string;
+declare function decryptConfig(content: string, key: Buffer): string;
+declare function readConfigFile(path: string, key?: Buffer): string;
+/** One protected destination for initial setup and every subsequent runtime edit. */
+declare function encryptedConfigStore(path: string, key: Buffer): {
+    path: string;
+    exists: () => boolean;
+    read: () => string;
+    write: (requestedPath: string, content: string) => void;
+};
+/** A one-shot inherited pipe avoids keys in argv, the environment, or temporary files. */
+declare function readConfigKey(input: Readable, timeoutMs?: number): Promise<Buffer>;
+
+export { type SealedSecret, decryptConfig, encryptConfig, encryptedConfigStore, isEncryptedConfig, openSecret, passwordKey, readConfigFile, readConfigKey, sealSecret, writeSecretAtomic };

package/dist/config-storage.js

@@ -0,0 +1,163 @@
+import { createRequire } from 'module'; const require = createRequire(import.meta.url);
+
+// src/config/storage.ts
+import { createCipheriv, createDecipheriv, randomBytes, scrypt } from "node:crypto";
+import {
+  closeSync,
+  existsSync,
+  fsyncSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+var CONFIG_HEADER = "SIMPLEX-ENCRYPTED-CONFIG-V1\n";
+var MAX_CONFIG_BYTES = 2 * 1024 * 1024;
+function writeSecretAtomic(path, content) {
+  const temp = join(dirname(path), `.${basename(path)}.${randomBytes(12).toString("hex")}.tmp`);
+  let fd;
+  try {
+    fd = openSync(temp, "wx", 384);
+    writeFileSync(fd, content);
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = void 0;
+    renameSync(temp, path);
+    if (process.platform !== "win32") {
+      const directory = openSync(dirname(path), "r");
+      try {
+        fsyncSync(directory);
+      } finally {
+        closeSync(directory);
+      }
+    }
+  } catch (error) {
+    if (fd !== void 0) closeSync(fd);
+    try {
+      unlinkSync(temp);
+    } catch {
+    }
+    throw error;
+  }
+}
+function bytes(value, length) {
+  if (typeof value !== "string" || value.length > MAX_CONFIG_BYTES * 2 || !/^(?:[a-f0-9]{2})*$/.test(value)) {
+    throw new Error("Invalid encrypted data");
+  }
+  const decoded = Buffer.from(value, "hex");
+  if (length !== void 0 && decoded.length !== length) throw new Error("Invalid encrypted data");
+  return decoded;
+}
+function sealSecret(plaintext, key, purpose) {
+  if (key.length !== 32) throw new Error("Invalid encryption key");
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const aad = Buffer.from(purpose);
+  cipher.setAAD(aad);
+  const data = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  return { iv: iv.toString("hex"), tag: cipher.getAuthTag().toString("hex"), data: data.toString("hex") };
+}
+function openSecret(sealed, key, purpose) {
+  if (key.length !== 32 || !sealed || typeof sealed !== "object") throw new Error("Invalid encrypted data");
+  const decipher = createDecipheriv("aes-256-gcm", key, bytes(sealed.iv, 12));
+  decipher.setAAD(Buffer.from(purpose));
+  decipher.setAuthTag(bytes(sealed.tag, 16));
+  return Buffer.concat([decipher.update(bytes(sealed.data)), decipher.final()]);
+}
+function passwordKey(password, salt) {
+  const saltBytes = bytes(salt, 16);
+  return new Promise((resolveKey, reject) => {
+    scrypt(password, saltBytes, 32, { N: 131072, r: 8, p: 1, maxmem: 192 * 1024 * 1024 }, (error, key) => {
+      if (error) reject(error);
+      else resolveKey(key);
+    });
+  });
+}
+function isEncryptedConfig(content) {
+  return content.startsWith("SIMPLEX-ENCRYPTED-CONFIG-");
+}
+function encryptConfig(content, key) {
+  if (Buffer.byteLength(content) > MAX_CONFIG_BYTES) throw new Error("Config is too large");
+  const plaintext = Buffer.from(content);
+  try {
+    return CONFIG_HEADER + JSON.stringify(sealSecret(plaintext, key, "simplex/config/v1")) + "\n";
+  } finally {
+    plaintext.fill(0);
+  }
+}
+function decryptConfig(content, key) {
+  if (!content.startsWith(CONFIG_HEADER) || content.length > MAX_CONFIG_BYTES * 2 + 1024) {
+    throw new Error("Unsupported or invalid encrypted config");
+  }
+  const plaintext = openSecret(JSON.parse(content.slice(CONFIG_HEADER.length)), key, "simplex/config/v1");
+  try {
+    return plaintext.toString("utf8");
+  } finally {
+    plaintext.fill(0);
+  }
+}
+function readConfigFile(path, key) {
+  const content = readFileSync(path, "utf8");
+  if (isEncryptedConfig(content)) {
+    if (!key) throw new Error("This config is encrypted. Open Simplex Desktop to unlock it.");
+    return decryptConfig(content, key);
+  }
+  if (key) throw new Error("Refusing to load a plaintext config in protected desktop mode");
+  return content;
+}
+function encryptedConfigStore(path, key) {
+  const target = resolve(path);
+  return {
+    path: target,
+    exists: () => existsSync(target),
+    read: () => readConfigFile(target, key),
+    write: (requestedPath, content) => {
+      if (resolve(requestedPath) !== target)
+        throw new Error("Desktop config must stay in its protected data directory");
+      writeSecretAtomic(target, encryptConfig(content, key));
+    }
+  };
+}
+function readConfigKey(input, timeoutMs = 5e3) {
+  return new Promise((resolveKey, reject) => {
+    const key = Buffer.alloc(32);
+    let offset = 0;
+    const finish = (error) => {
+      clearTimeout(timer);
+      input.removeListener("data", onData);
+      input.removeListener("end", onEnd);
+      input.removeListener("error", onError);
+      input.destroy();
+      if (error) {
+        key.fill(0);
+        reject(error);
+      } else resolveKey(key);
+    };
+    const onData = (chunk) => {
+      if (!Buffer.isBuffer(chunk) || offset + chunk.length > 32)
+        return finish(new Error("Invalid desktop key handoff"));
+      chunk.copy(key, offset);
+      offset += chunk.length;
+      chunk.fill(0);
+    };
+    const onEnd = () => finish(offset === 32 ? void 0 : new Error("Incomplete desktop key handoff"));
+    const onError = () => finish(new Error("Desktop key handoff failed"));
+    const timer = setTimeout(() => finish(new Error("Desktop key handoff timed out")), timeoutMs);
+    input.on("data", onData).once("end", onEnd).once("error", onError);
+  });
+}
+export {
+  decryptConfig,
+  encryptConfig,
+  encryptedConfigStore,
+  isEncryptedConfig,
+  openSecret,
+  passwordKey,
+  readConfigFile,
+  readConfigKey,
+  sealSecret,
+  writeSecretAtomic
+};
+//# sourceMappingURL=config-storage.js.map

package/dist/config-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/storage.ts"],"sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes, scrypt } from \"node:crypto\"\nimport {\n\tcloseSync,\n\texistsSync,\n\tfsyncSync,\n\topenSync,\n\treadFileSync,\n\trenameSync,\n\tunlinkSync,\n\twriteFileSync,\n} from \"node:fs\"\nimport { basename, dirname, join, resolve } from \"node:path\"\nimport type { Readable } from \"node:stream\"\n\nconst CONFIG_HEADER = \"SIMPLEX-ENCRYPTED-CONFIG-V1\\n\"\nconst MAX_CONFIG_BYTES = 2 * 1024 * 1024\nexport type SealedSecret = { iv: string; tag: string; data: string }\n\n/** Used for both the encrypted config and its wrapped key; no plaintext temp file is created. */\nexport function writeSecretAtomic(path: string, content: string): void {\n\tconst temp = join(dirname(path), `.${basename(path)}.${randomBytes(12).toString(\"hex\")}.tmp`)\n\tlet fd: number | undefined\n\ttry {\n\t\tfd = openSync(temp, \"wx\", 0o600)\n\t\twriteFileSync(fd, content)\n\t\tfsyncSync(fd)\n\t\tcloseSync(fd)\n\t\tfd = undefined\n\t\trenameSync(temp, path)\n\t\t// Persist the directory entry before a following encrypted write relies on\n\t\t// this file (notably the password-wrapped key written before migration).\n\t\tif (process.platform !== \"win32\") {\n\t\t\tconst directory = openSync(dirname(path), \"r\")\n\t\t\ttry {\n\t\t\t\tfsyncSync(directory)\n\t\t\t} finally {\n\t\t\t\tcloseSync(directory)\n\t\t\t}\n\t\t}\n\t} catch (error) {\n\t\tif (fd !== undefined) closeSync(fd)\n\t\ttry {\n\t\t\tunlinkSync(temp)\n\t\t} catch {}\n\t\tthrow error\n\t}\n}\n\nfunction bytes(value: unknown, length?: number): Buffer {\n\tif (typeof value !== \"string\" || value.length > MAX_CONFIG_BYTES * 2 || !/^(?:[a-f0-9]{2})*$/.test(value)) {\n\t\tthrow new Error(\"Invalid encrypted data\")\n\t}\n\tconst decoded = Buffer.from(value, \"hex\")\n\tif (length !== undefined && decoded.length !== length) throw new Error(\"Invalid encrypted data\")\n\treturn decoded\n}\n\nexport function sealSecret(plaintext: Buffer, key: Buffer, purpose: string): SealedSecret {\n\tif (key.length !== 32) throw new Error(\"Invalid encryption key\")\n\tconst iv = randomBytes(12)\n\tconst cipher = createCipheriv(\"aes-256-gcm\", key, iv)\n\tconst aad = Buffer.from(purpose)\n\tcipher.setAAD(aad)\n\tconst data = Buffer.concat([cipher.update(plaintext), cipher.final()])\n\treturn { iv: iv.toString(\"hex\"), tag: cipher.getAuthTag().toString(\"hex\"), data: data.toString(\"hex\") }\n}\n\nexport function openSecret(sealed: SealedSecret, key: Buffer, purpose: string): Buffer {\n\tif (key.length !== 32 || !sealed || typeof sealed !== \"object\") throw new Error(\"Invalid encrypted data\")\n\tconst decipher = createDecipheriv(\"aes-256-gcm\", key, bytes(sealed.iv, 12))\n\tdecipher.setAAD(Buffer.from(purpose))\n\tdecipher.setAuthTag(bytes(sealed.tag, 16))\n\treturn Buffer.concat([decipher.update(bytes(sealed.data)), decipher.final()])\n}\n\n/** Fixed work factors are versioned by the desktop vault, never supplied by an untrusted file. */\nexport function passwordKey(password: string, salt: string): Promise<Buffer> {\n\tconst saltBytes = bytes(salt, 16)\n\treturn new Promise((resolveKey, reject) => {\n\t\tscrypt(password, saltBytes, 32, { N: 131072, r: 8, p: 1, maxmem: 192 * 1024 * 1024 }, (error, key) => {\n\t\t\tif (error) reject(error)\n\t\t\telse resolveKey(key)\n\t\t})\n\t})\n}\n\nexport function isEncryptedConfig(content: string): boolean {\n\treturn content.startsWith(\"SIMPLEX-ENCRYPTED-CONFIG-\")\n}\n\nexport function encryptConfig(content: string, key: Buffer): string {\n\tif (Buffer.byteLength(content) > MAX_CONFIG_BYTES) throw new Error(\"Config is too large\")\n\tconst plaintext = Buffer.from(content)\n\ttry {\n\t\treturn CONFIG_HEADER + JSON.stringify(sealSecret(plaintext, key, \"simplex/config/v1\")) + \"\\n\"\n\t} finally {\n\t\tplaintext.fill(0)\n\t}\n}\n\nexport function decryptConfig(content: string, key: Buffer): string {\n\tif (!content.startsWith(CONFIG_HEADER) || content.length > MAX_CONFIG_BYTES * 2 + 1024) {\n\t\tthrow new Error(\"Unsupported or invalid encrypted config\")\n\t}\n\tconst plaintext = openSecret(JSON.parse(content.slice(CONFIG_HEADER.length)), key, \"simplex/config/v1\")\n\ttry {\n\t\treturn plaintext.toString(\"utf8\")\n\t} finally {\n\t\tplaintext.fill(0)\n\t}\n}\n\nexport function readConfigFile(path: string, key?: Buffer): string {\n\tconst content = readFileSync(path, \"utf8\")\n\tif (isEncryptedConfig(content)) {\n\t\tif (!key) throw new Error(\"This config is encrypted. Open Simplex Desktop to unlock it.\")\n\t\treturn decryptConfig(content, key)\n\t}\n\tif (key) throw new Error(\"Refusing to load a plaintext config in protected desktop mode\")\n\treturn content\n}\n\n/** One protected destination for initial setup and every subsequent runtime edit. */\nexport function encryptedConfigStore(path: string, key: Buffer) {\n\tconst target = resolve(path)\n\treturn {\n\t\tpath: target,\n\t\texists: () => existsSync(target),\n\t\tread: () => readConfigFile(target, key),\n\t\twrite: (requestedPath: string, content: string) => {\n\t\t\tif (resolve(requestedPath) !== target)\n\t\t\t\tthrow new Error(\"Desktop config must stay in its protected data directory\")\n\t\t\twriteSecretAtomic(target, encryptConfig(content, key))\n\t\t},\n\t}\n}\n\n/** A one-shot inherited pipe avoids keys in argv, the environment, or temporary files. */\nexport function readConfigKey(input: Readable, timeoutMs = 5_000): Promise<Buffer> {\n\treturn new Promise((resolveKey, reject) => {\n\t\tconst key = Buffer.alloc(32)\n\t\tlet offset = 0\n\t\tconst finish = (error?: Error) => {\n\t\t\tclearTimeout(timer)\n\t\t\tinput.removeListener(\"data\", onData)\n\t\t\tinput.removeListener(\"end\", onEnd)\n\t\t\tinput.removeListener(\"error\", onError)\n\t\t\tinput.destroy()\n\t\t\tif (error) {\n\t\t\t\tkey.fill(0)\n\t\t\t\treject(error)\n\t\t\t} else resolveKey(key)\n\t\t}\n\t\tconst onData = (chunk: Buffer) => {\n\t\t\tif (!Buffer.isBuffer(chunk) || offset + chunk.length > 32)\n\t\t\t\treturn finish(new Error(\"Invalid desktop key handoff\"))\n\t\t\tchunk.copy(key, offset)\n\t\t\toffset += chunk.length\n\t\t\tchunk.fill(0)\n\t\t}\n\t\tconst onEnd = () => finish(offset === 32 ? undefined : new Error(\"Incomplete desktop key handoff\"))\n\t\tconst onError = () => finish(new Error(\"Desktop key handoff failed\"))\n\t\tconst timer = setTimeout(() => finish(new Error(\"Desktop key handoff timed out\")), timeoutMs)\n\t\tinput.on(\"data\", onData).once(\"end\", onEnd).once(\"error\", onError)\n\t})\n}\n"],"mappings":";;;AAAA,SAAS,gBAAgB,kBAAkB,aAAa,cAAc;AACtE;AAAA,EACC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACM;AACP,SAAS,UAAU,SAAS,MAAM,eAAe;AAGjD,IAAM,gBAAgB;AACtB,IAAM,mBAAmB,IAAI,OAAO;AAI7B,SAAS,kBAAkB,MAAc,SAAuB;AACtE,QAAM,OAAO,KAAK,QAAQ,IAAI,GAAG,IAAI,SAAS,IAAI,CAAC,IAAI,YAAY,EAAE,EAAE,SAAS,KAAK,CAAC,MAAM;AAC5F,MAAI;AACJ,MAAI;AACH,SAAK,SAAS,MAAM,MAAM,GAAK;AAC/B,kBAAc,IAAI,OAAO;AACzB,cAAU,EAAE;AACZ,cAAU,EAAE;AACZ,SAAK;AACL,eAAW,MAAM,IAAI;AAGrB,QAAI,QAAQ,aAAa,SAAS;AACjC,YAAM,YAAY,SAAS,QAAQ,IAAI,GAAG,GAAG;AAC7C,UAAI;AACH,kBAAU,SAAS;AAAA,MACpB,UAAE;AACD,kBAAU,SAAS;AAAA,MACpB;AAAA,IACD;AAAA,EACD,SAAS,OAAO;AACf,QAAI,OAAO,OAAW,WAAU,EAAE;AAClC,QAAI;AACH,iBAAW,IAAI;AAAA,IAChB,QAAQ;AAAA,IAAC;AACT,UAAM;AAAA,EACP;AACD;AAEA,SAAS,MAAM,OAAgB,QAAyB;AACvD,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,mBAAmB,KAAK,CAAC,qBAAqB,KAAK,KAAK,GAAG;AAC1G,UAAM,IAAI,MAAM,wBAAwB;AAAA,EACzC;AACA,QAAM,UAAU,OAAO,KAAK,OAAO,KAAK;AACxC,MAAI,WAAW,UAAa,QAAQ,WAAW,OAAQ,OAAM,IAAI,MAAM,wBAAwB;AAC/F,SAAO;AACR;AAEO,SAAS,WAAW,WAAmB,KAAa,SAA+B;AACzF,MAAI,IAAI,WAAW,GAAI,OAAM,IAAI,MAAM,wBAAwB;AAC/D,QAAM,KAAK,YAAY,EAAE;AACzB,QAAM,SAAS,eAAe,eAAe,KAAK,EAAE;AACpD,QAAM,MAAM,OAAO,KAAK,OAAO;AAC/B,SAAO,OAAO,GAAG;AACjB,QAAM,OAAO,OAAO,OAAO,CAAC,OAAO,OAAO,SAAS,GAAG,OAAO,MAAM,CAAC,CAAC;AACrE,SAAO,EAAE,IAAI,GAAG,SAAS,KAAK,GAAG,KAAK,OAAO,WAAW,EAAE,SAAS,KAAK,GAAG,MAAM,KAAK,SAAS,KAAK,EAAE;AACvG;AAEO,SAAS,WAAW,QAAsB,KAAa,SAAyB;AACtF,MAAI,IAAI,WAAW,MAAM,CAAC,UAAU,OAAO,WAAW,SAAU,OAAM,IAAI,MAAM,wBAAwB;AACxG,QAAM,WAAW,iBAAiB,eAAe,KAAK,MAAM,OAAO,IAAI,EAAE,CAAC;AAC1E,WAAS,OAAO,OAAO,KAAK,OAAO,CAAC;AACpC,WAAS,WAAW,MAAM,OAAO,KAAK,EAAE,CAAC;AACzC,SAAO,OAAO,OAAO,CAAC,SAAS,OAAO,MAAM,OAAO,IAAI,CAAC,GAAG,SAAS,MAAM,CAAC,CAAC;AAC7E;AAGO,SAAS,YAAY,UAAkB,MAA+B;AAC5E,QAAM,YAAY,MAAM,MAAM,EAAE;AAChC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW;AAC1C,WAAO,UAAU,WAAW,IAAI,EAAE,GAAG,QAAQ,GAAG,GAAG,GAAG,GAAG,QAAQ,MAAM,OAAO,KAAK,GAAG,CAAC,OAAO,QAAQ;AACrG,UAAI,MAAO,QAAO,KAAK;AAAA,UAClB,YAAW,GAAG;AAAA,IACpB,CAAC;AAAA,EACF,CAAC;AACF;AAEO,SAAS,kBAAkB,SAA0B;AAC3D,SAAO,QAAQ,WAAW,2BAA2B;AACtD;AAEO,SAAS,cAAc,SAAiB,KAAqB;AACnE,MAAI,OAAO,WAAW,OAAO,IAAI,iBAAkB,OAAM,IAAI,MAAM,qBAAqB;AACxF,QAAM,YAAY,OAAO,KAAK,OAAO;AACrC,MAAI;AACH,WAAO,gBAAgB,KAAK,UAAU,WAAW,WAAW,KAAK,mBAAmB,CAAC,IAAI;AAAA,EAC1F,UAAE;AACD,cAAU,KAAK,CAAC;AAAA,EACjB;AACD;AAEO,SAAS,cAAc,SAAiB,KAAqB;AACnE,MAAI,CAAC,QAAQ,WAAW,aAAa,KAAK,QAAQ,SAAS,mBAAmB,IAAI,MAAM;AACvF,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC1D;AACA,QAAM,YAAY,WAAW,KAAK,MAAM,QAAQ,MAAM,cAAc,MAAM,CAAC,GAAG,KAAK,mBAAmB;AACtG,MAAI;AACH,WAAO,UAAU,SAAS,MAAM;AAAA,EACjC,UAAE;AACD,cAAU,KAAK,CAAC;AAAA,EACjB;AACD;AAEO,SAAS,eAAe,MAAc,KAAsB;AAClE,QAAM,UAAU,aAAa,MAAM,MAAM;AACzC,MAAI,kBAAkB,OAAO,GAAG;AAC/B,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,8DAA8D;AACxF,WAAO,cAAc,SAAS,GAAG;AAAA,EAClC;AACA,MAAI,IAAK,OAAM,IAAI,MAAM,+DAA+D;AACxF,SAAO;AACR;AAGO,SAAS,qBAAqB,MAAc,KAAa;AAC/D,QAAM,SAAS,QAAQ,IAAI;AAC3B,SAAO;AAAA,IACN,MAAM;AAAA,IACN,QAAQ,MAAM,WAAW,MAAM;AAAA,IAC/B,MAAM,MAAM,eAAe,QAAQ,GAAG;AAAA,IACtC,OAAO,CAAC,eAAuB,YAAoB;AAClD,UAAI,QAAQ,aAAa,MAAM;AAC9B,cAAM,IAAI,MAAM,0DAA0D;AAC3E,wBAAkB,QAAQ,cAAc,SAAS,GAAG,CAAC;AAAA,IACtD;AAAA,EACD;AACD;AAGO,SAAS,cAAc,OAAiB,YAAY,KAAwB;AAClF,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW;AAC1C,UAAM,MAAM,OAAO,MAAM,EAAE;AAC3B,QAAI,SAAS;AACb,UAAM,SAAS,CAAC,UAAkB;AACjC,mBAAa,KAAK;AAClB,YAAM,eAAe,QAAQ,MAAM;AACnC,YAAM,eAAe,OAAO,KAAK;AACjC,YAAM,eAAe,SAAS,OAAO;AACrC,YAAM,QAAQ;AACd,UAAI,OAAO;AACV,YAAI,KAAK,CAAC;AACV,eAAO,KAAK;AAAA,MACb,MAAO,YAAW,GAAG;AAAA,IACtB;AACA,UAAM,SAAS,CAAC,UAAkB;AACjC,UAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,MAAM,SAAS;AACtD,eAAO,OAAO,IAAI,MAAM,6BAA6B,CAAC;AACvD,YAAM,KAAK,KAAK,MAAM;AACtB,gBAAU,MAAM;AAChB,YAAM,KAAK,CAAC;AAAA,IACb;AACA,UAAM,QAAQ,MAAM,OAAO,WAAW,KAAK,SAAY,IAAI,MAAM,gCAAgC,CAAC;AAClG,UAAM,UAAU,MAAM,OAAO,IAAI,MAAM,4BAA4B,CAAC;AACpE,UAAM,QAAQ,WAAW,MAAM,OAAO,IAAI,MAAM,+BAA+B,CAAC,GAAG,SAAS;AAC5F,UAAM,GAAG,QAAQ,MAAM,EAAE,KAAK,OAAO,KAAK,EAAE,KAAK,SAAS,OAAO;AAAA,EAClE,CAAC;AACF;","names":[]}