@l1yp/file-viewer 0.1.0

package/dist/lib/pkcs12.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Zero-dependency PKCS#12 (PFX) reader — for the keystore viewer (JksViewer.vue), so `.p12`/`.pfx` and the very
+ * common `.jks`-that-is-actually-PKCS#12 (keytool defaults to PKCS12 since JDK 9) open with their certificates
+ * and private keys instead of just an opaque blob.
+ *
+ * PKCS#12 (RFC 7292) is a PKCS#7 container whose bags are ALL encrypted (unlike JKS, where certs are plaintext),
+ * so nothing shows without the password. This module parses the PFX / AuthenticatedSafe / SafeBag structure,
+ * verifies the integrity MAC (which doubles as the password check), and decrypts the bags:
+ *   - legacy PBE1 (PKCS#12 KDF, SHA-1): `pbeWithSHA1And3-KeyTripleDES` (3DES, see lib/des.ts),
+ *     `pbeWithSHA1And{40,128}BitRC2` (RC2, see lib/rc2.ts), and the RC4 variants;
+ *   - modern PBES2: PBKDF2 (HMAC-SHA1/SHA256) + AES-CBC (see lib/aes.ts) or 3DES.
+ * The MAC digest supports SHA-1 / SHA-256. Anything outside this set is reported (not decrypted) rather than
+ * failing the whole file. READ-ONLY: no signature/trust verification. WebCrypto ships no 3DES/RC2, hence the
+ * hand-rolled ciphers.
+ */
+export interface P12Cert {
+    der: Uint8Array;
+    friendlyName?: string;
+    localKeyId?: string;
+}
+export interface P12Key {
+    pkcs8: Uint8Array;
+    algorithm: string;
+    bits?: number;
+    curve?: string;
+    friendlyName?: string;
+    localKeyId?: string;
+}
+export interface Pkcs12Result {
+    macPresent: boolean;
+    /** true = MAC verified (password correct); false→never returned (becomes wrong-password); null = no/unsupported MAC. */
+    macVerified: boolean | null;
+    macAlgorithm?: string;
+    certs: P12Cert[];
+    keys: P12Key[];
+    /** Human names of the PBE algorithms encountered (for display). */
+    encryptionAlgos: string[];
+    /** Non-fatal notes (e.g. a bag encrypted with an unsupported algorithm was skipped). */
+    warnings: string[];
+}
+export type Pkcs12Open = {
+    ok: true;
+    result: Pkcs12Result;
+} | {
+    ok: false;
+    reason: 'wrong-password' | 'unsupported' | 'malformed';
+    detail?: string;
+};
+/** Does this look like a PKCS#12 PFX (SEQUENCE { version 3, ContentInfo … })? Cheap structural sniff. */
+export declare function looksLikePkcs12(bytes: Uint8Array): boolean;
+/**
+ * Parse + decrypt a PKCS#12 keystore with `password`. Certificates and private keys come back decrypted; the
+ * MAC (when SHA-1/SHA-256) is verified and doubles as the password check. Returns a structured error for a
+ * wrong password / unsupported algorithm / malformed file rather than throwing.
+ */
+export declare function readPkcs12(buf: ArrayBuffer, password: string): Pkcs12Open;

package/dist/lib/pkcs12.js

@@ -0,0 +1,356 @@
+import { aesCbcDecrypt as e } from "./aes.js";
+import { Sha1 as t } from "./sha1.js";
+import { TAG as n, decodeAsn1 as r, oidToString as i } from "./asn1.js";
+import { describePrivateKey as a } from "./x509.js";
+import { sha256 as o } from "./sha256.js";
+import { tripleDesCbcDecrypt as s } from "./des.js";
+import { rc2CbcDecrypt as c } from "./rc2.js";
+//#region src/lib/pkcs12.ts
+var l = "1.2.840.113549.1.7.1", u = "1.2.840.113549.1.7.2", d = "1.2.840.113549.1.7.6", f = "1.2.840.113549.1.12.10.1.3", p = "1.2.840.113549.1.12.10.1.1", m = "1.2.840.113549.1.12.10.1.2", h = "1.2.840.113549.1.9.22.1", g = "1.2.840.113549.1.9.20", _ = "1.2.840.113549.1.9.21", v = "1.2.840.113549.1.5.13", y = "1.2.840.113549.1.5.12", b = "1.2.840.113549.3.7", x = "1.2.840.113549.2.7", S = "1.2.840.113549.2.9", C = "1.3.14.3.2.26", w = "2.16.840.1.101.3.4.2.1", T = {
+	"2.16.840.1.101.3.4.1.2": 16,
+	"2.16.840.1.101.3.4.1.22": 24,
+	"2.16.840.1.101.3.4.1.42": 32
+}, E = {
+	"1.2.840.113549.1.12.1.1": {
+		keyLen: 16,
+		ivLen: 0,
+		cipher: "rc4"
+	},
+	"1.2.840.113549.1.12.1.2": {
+		keyLen: 5,
+		ivLen: 0,
+		cipher: "rc4"
+	},
+	"1.2.840.113549.1.12.1.3": {
+		keyLen: 24,
+		ivLen: 8,
+		cipher: "3des"
+	},
+	"1.2.840.113549.1.12.1.4": {
+		keyLen: 16,
+		ivLen: 8,
+		cipher: "3des"
+	},
+	"1.2.840.113549.1.12.1.5": {
+		keyLen: 16,
+		ivLen: 8,
+		effBits: 128,
+		cipher: "rc2"
+	},
+	"1.2.840.113549.1.12.1.6": {
+		keyLen: 5,
+		ivLen: 8,
+		effBits: 40,
+		cipher: "rc2"
+	}
+}, D = {
+	"1.2.840.113549.1.12.1.1": "PBE-SHA1-RC4-128",
+	"1.2.840.113549.1.12.1.2": "PBE-SHA1-RC4-40",
+	"1.2.840.113549.1.12.1.3": "PBE-SHA1-3DES",
+	"1.2.840.113549.1.12.1.4": "PBE-SHA1-2DES",
+	"1.2.840.113549.1.12.1.5": "PBE-SHA1-RC2-128",
+	"1.2.840.113549.1.12.1.6": "PBE-SHA1-RC2-40",
+	[v]: "PBES2"
+};
+function O(...e) {
+	let t = 0;
+	for (let n of e) t += n.length;
+	let n = new Uint8Array(t), r = 0;
+	for (let t of e) n.set(t, r), r += t.length;
+	return n;
+}
+function k(e, t) {
+	if (e.length !== t.length) return !1;
+	for (let n = 0; n < e.length; n++) if (e[n] !== t[n]) return !1;
+	return !0;
+}
+function A(e) {
+	let t = 0;
+	for (let n of e.content) t = t * 256 + n;
+	return t;
+}
+function j(e) {
+	let t = "";
+	for (let n of e) t += n.toString(16).padStart(2, "0");
+	return t;
+}
+var M = {
+	u: 20,
+	v: 64,
+	hash: (e) => new t().update(e).digest()
+}, N = {
+	u: 32,
+	v: 64,
+	hash: (e) => o(e)
+};
+function P(e, t, n) {
+	let r = t.length > e.v ? e.hash(t) : t, i = new Uint8Array(e.v), a = new Uint8Array(e.v);
+	i.set(r), a.set(r);
+	for (let t = 0; t < e.v; t++) i[t] ^= 54, a[t] ^= 92;
+	return e.hash(O(a, e.hash(O(i, n))));
+}
+function F(e, t, n, r, i) {
+	let a = new Uint8Array(Math.ceil(i / e.u) * e.u), o = a.length / e.u;
+	for (let i = 1; i <= o; i++) {
+		let o = P(e, t, O(n, new Uint8Array([
+			i >>> 24 & 255,
+			i >>> 16 & 255,
+			i >>> 8 & 255,
+			i & 255
+		]))), s = o.slice();
+		for (let n = 1; n < r; n++) {
+			o = P(e, t, o);
+			for (let t = 0; t < e.u; t++) s[t] ^= o[t];
+		}
+		a.set(s, (i - 1) * e.u);
+	}
+	return a.subarray(0, i);
+}
+function I(e, t) {
+	if (e.length === 0) return new Uint8Array();
+	let n = t * Math.ceil(e.length / t), r = new Uint8Array(n);
+	for (let t = 0; t < n; t++) r[t] = e[t % e.length];
+	return r;
+}
+function L(e, t, n, r, i, a) {
+	let { u: o, v: s } = e, c = new Uint8Array(s).fill(i), l = O(I(n, s), I(t, s)), u = new Uint8Array(a), d = 0;
+	for (; d < a;) {
+		let t = e.hash(O(c, l));
+		for (let n = 1; n < r; n++) t = e.hash(t);
+		if (u.set(t.subarray(0, Math.min(o, a - d)), d), d += o, d < a) {
+			let e = I(t, s);
+			for (let t = 0; t < l.length; t += s) {
+				let n = 1;
+				for (let r = s - 1; r >= 0; r--) {
+					let i = l[t + r] + e[r] + n;
+					l[t + r] = i & 255, n = i >> 8;
+				}
+			}
+		}
+	}
+	return u;
+}
+function R(e) {
+	let t = new Uint8Array(e.length * 2 + 2);
+	for (let n = 0; n < e.length; n++) {
+		let r = e.charCodeAt(n);
+		t[2 * n] = r >>> 8 & 255, t[2 * n + 1] = r & 255;
+	}
+	return t;
+}
+function z(e, t) {
+	let n = new Uint8Array(256);
+	for (let e = 0; e < 256; e++) n[e] = e;
+	let r = 0;
+	for (let t = 0; t < 256; t++) {
+		r = r + n[t] + e[t % e.length] & 255;
+		let i = n[t];
+		n[t] = n[r], n[r] = i;
+	}
+	let i = new Uint8Array(t.length), a = 0, o = 0;
+	for (let e = 0; e < t.length; e++) {
+		a = a + 1 & 255, o = o + n[a] & 255;
+		let r = n[a];
+		n[a] = n[o], n[o] = r, i[e] = t[e] ^ n[n[a] + n[o] & 255];
+	}
+	return i;
+}
+function B(e, t) {
+	if (e.length === 0 || e.length % t !== 0) return null;
+	let n = e[e.length - 1];
+	if (n < 1 || n > t) return null;
+	for (let t = e.length - n; t < e.length; t++) if (e[t] !== n) return null;
+	return e.subarray(0, e.length - n);
+}
+var V = class extends Error {};
+function H(e) {
+	return i(e.children[0].content);
+}
+function U(e) {
+	return e.children.length ? e.children[0] : r(e.content)[0];
+}
+function W(e) {
+	return e.constructed ? O(...e.children.map((e) => W(e))) : e.content;
+}
+function G(t, r, a) {
+	let o = H(t), l = t.children[1], u = E[o];
+	if (u) {
+		let e = l.children[0].content, t = A(l.children[1]), n = R(a), i = L(M, n, e, t, 1, u.keyLen);
+		if (u.cipher === "rc4") return z(i, r);
+		let o = L(M, n, e, t, 2, u.ivLen);
+		return B(u.cipher === "3des" ? s(i, o, r) : c(i, o, r, u.effBits), 8);
+	}
+	if (o === v) {
+		let t = l.children[0];
+		if (H(t) !== y) throw new V("PBES2 KDF " + H(t));
+		let o = t.children[1], c = o.children[0].content, u = A(o.children[1]), d = 0, f = M;
+		for (let e = 2; e < o.children.length; e++) {
+			let t = o.children[e];
+			if (t.tagNumber === n.INTEGER) d = A(t);
+			else if (t.tagNumber === n.SEQUENCE) {
+				let e = i(t.children[0].content);
+				f = e === S ? N : e === x ? M : (() => {
+					throw new V("PBKDF2 PRF " + e);
+				})();
+			}
+		}
+		let p = l.children[1], m = H(p), h = p.children[1];
+		if (T[m]) {
+			let t = T[m], n = h.content;
+			return B(e(F(f, new TextEncoder().encode(a), c, u, d || t), n, r), 16);
+		}
+		if (m === b) {
+			let e = h.content;
+			return B(s(F(f, new TextEncoder().encode(a), c, u, d || 24), e, r), 8);
+		}
+		throw new V("PBES2 cipher " + m);
+	}
+	throw new V(D[o] ?? o);
+}
+function K(e) {
+	try {
+		let t = r(e)[0];
+		if (!t || t.tagNumber !== n.SEQUENCE) return !1;
+		let a = t.children[0];
+		if (!a || a.tagNumber !== n.INTEGER || A(a) !== 3) return !1;
+		let o = i(t.children[1].children[0].content);
+		return o === l || o === u;
+	} catch {
+		return !1;
+	}
+}
+function q(e) {
+	return e === C ? "HMAC-SHA1" : e === w ? "HMAC-SHA256" : e;
+}
+function J(e) {
+	let t = {};
+	if (!e) return t;
+	for (let n of e.children) {
+		let e = i(n.children[0].content), r = n.children[1]?.children[0];
+		if (r) if (e === g) try {
+			t.friendlyName = new TextDecoder("utf-16be").decode(r.content);
+		} catch {}
+		else e === _ && (t.localKeyId = j(r.content));
+	}
+	return t;
+}
+function Y(e, t) {
+	try {
+		let o = r(new Uint8Array(e))[0];
+		if (!o || o.tagNumber !== n.SEQUENCE) return {
+			ok: !1,
+			reason: "malformed"
+		};
+		let s = o.children[1];
+		if (!s || i(s.children[0].content) !== l) return {
+			ok: !1,
+			reason: "unsupported",
+			detail: "仅支持口令完整性（pkcs7-data）的 PKCS#12"
+		};
+		let c = W(U(s.children[1])), u = !1, g = null, _;
+		if (o.children.length >= 3) {
+			u = !0;
+			let e = o.children[2], n = e.children[0], r = i(n.children[0].children[0].content), a = n.children[1].content, s = e.children[1].content, l = e.children[2] ? A(e.children[2]) : 1;
+			_ = q(r);
+			let d = r === C ? M : r === w ? N : null;
+			if (d) {
+				if (!k(P(d, L(d, R(t), s, l, 3, d.u), c), a)) return {
+					ok: !1,
+					reason: "wrong-password"
+				};
+				g = !0;
+			}
+		}
+		let v = [], y = [], b = /* @__PURE__ */ new Set(), x = [], S = !1, T = (e) => {
+			for (let n of e) {
+				let e = i(n.children[0].content), r = U(n.children[1]), o = J(n.children[2]);
+				if (e === f) i(r.children[0].content) === h && v.push({
+					der: W(U(r.children[1])).slice(),
+					...o
+				});
+				else if (e === p) {
+					let e = X(r);
+					y.push({
+						pkcs8: e,
+						...a(e),
+						...o
+					});
+				} else if (e === m) {
+					let e = r.children[0];
+					b.add(D[H(e)] ?? H(e));
+					let n;
+					try {
+						n = G(e, r.children[1].content, t);
+					} catch (e) {
+						x.push(`私钥加密方式不支持：${e instanceof Error ? e.message : String(e)}`);
+						continue;
+					}
+					if (!n) {
+						S = !0;
+						continue;
+					}
+					y.push({
+						pkcs8: n.slice(),
+						...a(n),
+						...o
+					});
+				}
+			}
+		}, E = r(c)[0];
+		for (let e of E.children) {
+			let n = i(e.children[0].content);
+			if (n === l) {
+				let t = r(W(U(e.children[1])))[0];
+				t && T(t.children);
+			} else if (n === d) {
+				let n = U(e.children[1]).children[1], i = n.children[1];
+				b.add(D[H(i)] ?? H(i));
+				let a = n.children[2], o = a.constructed ? W(a) : a.content, s;
+				try {
+					s = G(i, o, t);
+				} catch (e) {
+					x.push(`证书加密方式不支持：${e instanceof Error ? e.message : String(e)}`);
+					continue;
+				}
+				if (!s) {
+					S = !0;
+					continue;
+				}
+				let c = r(s)[0];
+				c && T(c.children);
+			}
+		}
+		return S && !v.length && !y.length && g !== !0 ? {
+			ok: !1,
+			reason: "wrong-password"
+		} : {
+			ok: !0,
+			result: {
+				macPresent: u,
+				macVerified: g,
+				macAlgorithm: _,
+				certs: v,
+				keys: y,
+				encryptionAlgos: [...b],
+				warnings: x
+			}
+		};
+	} catch (e) {
+		return {
+			ok: !1,
+			reason: "malformed",
+			detail: e instanceof Error ? e.message : String(e)
+		};
+	}
+}
+function X(e) {
+	let t = e.tagClass << 6 | (e.constructed ? 32 : 0) | e.tagNumber, n = e.content.length, r = n < 128 ? [n] : [];
+	if (n >= 128) {
+		let e = [], t = n;
+		for (; t > 0;) e.unshift(t & 255), t >>= 8;
+		r.push(128 | e.length, ...e);
+	}
+	return O(new Uint8Array([t, ...r]), e.content);
+}
+//#endregion
+export { K as looksLikePkcs12, Y as readPkcs12 };

package/dist/lib/qmc.d.ts

@@ -0,0 +1,50 @@
+/**
+ * QQ 音乐加密音频（QMCv2）的纯前端解密器 —— 零依赖，照搬 unlock-music / parakeet-crypto 的算法。
+ *
+ * QQ 音乐客户端下载的「会员歌曲」是被加密的，扩展名形如 `.mflac`（FLAC）、`.mgg`（OGG/Vorbis）、
+ * `.qmcflac`/`.qmc0` 等。文件主体是用一段「文件密钥」做的逐字节流加密，密钥本身（EKey）以 base64
+ * 形式追加在文件末尾。解出原始密钥后即可还原成标准的 FLAC/OGG/MP3 字节，丢给 <audio> 直接播放。
+ *
+ * 整条链路（均在浏览器内完成，本函数纯计算、不联网）：
+ *   1. {@link parseFooter} 解析文件尾，取出 base64 的 EKey 与尾部长度（PC v1 / Android QTag 两种容器）。
+ *   2. {@link decryptEKey} 还原文件密钥：base64 解码 → 可选的 EncV2 两轮 TEA → EncV1（8 字节明文头 +
+ *      其余走 TC-TEA/CBC 解密，TEA 密钥由「simple key」与密钥头交织而成）。
+ *   3. 按密钥长度选择流密码：>300 字节用 {@link rc4Decrypt}（分段 RC4 + 跳表），否则用 {@link mapDecrypt}
+ *      （把密钥摊成 128 字节查找表逐字节异或）。
+ *   4. 去掉尾部，得到明文音频，再用文件头 magic 判定真实格式（fLaC / OggS / ID3·MP3 / ftyp·M4A / WAV）。
+ *
+ * 这套算法已用本仓库的真实样例逐字节验证：`.mflac` → 合法 FLAC、`.mgg` → 合法 OGG/Vorbis（ffprobe 可解）。
+ * 解密是 XOR 流密码，与「加密」同构；这里只做解密。详见 https://git.unlock-music.dev/um/web 。
+ */
+/** 把文件尾的 base64 EKey 字符串还原成文件密钥；失败返回 null。 */
+export declare function decryptEKey(ekey: string): Uint8Array | null;
+export interface QmcFooter {
+    /** base64 的 EKey 字符串。 */
+    ekey: string;
+    /** 需要从文件末尾去掉的字节数（密钥块 + 长度/标记）。 */
+    tailLen: number;
+}
+/**
+ * 解析 QMC 文件尾，取出 EKey。支持两种容器：
+ *  - **PC v1**：末 4 字节小端 = EKey 长度，其前即 EKey（去尾部 0）。
+ *  - **Android QTag**：末 4 字节为 ASCII "QTag"，再往前 4 字节大端为 payload 长度，payload 为
+ *    `ekey,resourceId,version` 逗号分隔。
+ * 解析不出（或像无嵌入密钥的 STag/musicex）返回 null。
+ */
+export declare function parseFooter(buf: Uint8Array): QmcFooter | null;
+export interface QmcDecrypted {
+    data: Uint8Array;
+    /** 探测出的真实格式：flac / ogg / mp3 / m4a / wav / bin。 */
+    format: string;
+    /** 对应的 MIME，用于 <audio> 的 Blob。 */
+    mime: string;
+    /** 建议的下载扩展名（不含点）。 */
+    ext: string;
+}
+export declare class QmcError extends Error {
+}
+/**
+ * 解密一个 QMC 加密音频。`input` 是整个文件字节。成功返回明文音频 + 探测出的格式信息；
+ * 解析/解密失败抛 {@link QmcError}（调用方据此给出友好提示）。
+ */
+export declare function decryptQmc(input: ArrayBuffer | Uint8Array): QmcDecrypted;

package/dist/lib/qmc.js

@@ -0,0 +1,213 @@
+//#region src/lib/qmc.ts
+var e = 16, t = 2654435769, n = (e) => e >>> 0, r = (e, t) => n(e + t), i = (e, t) => n(e - t);
+function a(e, t) {
+	return n(e[t] << 24 | e[t + 1] << 16 | e[t + 2] << 8 | e[t + 3]);
+}
+function o(e, t, n) {
+	e[t] = n >>> 24 & 255, e[t + 1] = n >>> 16 & 255, e[t + 2] = n >>> 8 & 255, e[t + 3] = n & 255;
+}
+function s(e, t, i, a) {
+	return n(r(n(e << 4), i) ^ r(t, e) ^ r(e >>> 5, a));
+}
+function c(r, c, l) {
+	let u = a(r, c), d = a(r, c + 4), f = n(t * e);
+	for (let n = 0; n < e; n++) d = i(d, s(u, f, l[2], l[3])), u = i(u, s(d, f, l[0], l[1])), f = i(f, t);
+	o(r, c, u), o(r, c + 4, d);
+}
+var l = 2, u = 7, d = 10;
+function f(e, t) {
+	if (t.length < 16) return null;
+	let n = [
+		a(t, 0),
+		a(t, 4),
+		a(t, 8),
+		a(t, 12)
+	], r = e.length;
+	if (r < d || r % 8 != 0) return null;
+	let i = e.slice();
+	c(i, 0, n);
+	for (let e = 8; e < r; e += 8) {
+		for (let t = 0; t < 8; t++) i[e + t] ^= i[e - 8 + t];
+		c(i, e, n);
+	}
+	for (let t = 8; t < r; t++) i[t] ^= e[t - 8];
+	let o = 1 + (i[0] & 7) + l, s = r - u;
+	if (o > s) return null;
+	for (let e = s; e < r; e++) if (i[e] !== 0) return null;
+	return i.slice(o, s);
+}
+var p = "UVFNdXNpYyBFbmNWMixLZXk6", m = v("386ZJY!@#*$%^&)("), h = v("**#!(#$%&^a1cZ,T"), g = 106, _ = 1280;
+function v(e) {
+	let t = new Uint8Array(e.length);
+	for (let n = 0; n < e.length; n++) t[n] = e.charCodeAt(n) & 255;
+	return t;
+}
+function y(e) {
+	let t = e.replace(/[^A-Za-z0-9+/]/g, ""), n = t + "=".repeat((4 - t.length % 4) % 4), r = atob(n), i = new Uint8Array(r.length);
+	for (let e = 0; e < r.length; e++) i[e] = r.charCodeAt(e);
+	return i;
+}
+function b() {
+	let e = new Uint8Array(8);
+	for (let t = 0; t < 8; t++) e[t] = Math.trunc(Math.abs(Math.tan(g + t * .1)) * 100) & 255;
+	return e;
+}
+var x = b();
+function S(e) {
+	if (e.length < 8) return null;
+	let t = e.slice(0, 8), n = e.slice(8), r = new Uint8Array(16);
+	for (let e = 0; e < 8; e++) r[e * 2] = x[e], r[e * 2 + 1] = t[e];
+	let i = f(n, r);
+	if (!i) return null;
+	let a = new Uint8Array(8 + i.length);
+	return a.set(t, 0), a.set(i, 8), a;
+}
+function C(e) {
+	let t = e.replace(/\s+/g, "");
+	if (t.startsWith(p)) {
+		let e = y(t.slice(24));
+		if (e = f(e, m), !e || (e = f(e, h), !e)) return null;
+		let n = "";
+		for (let t of e) n += String.fromCharCode(t);
+		return S(y(n));
+	}
+	return S(y(t));
+}
+var w = new TextDecoder("latin1");
+function T(e) {
+	if (e.length < 8) return null;
+	if (w.decode(e.subarray(e.length - 4)) === "QTag") {
+		let t = a(e, e.length - 8) + 8;
+		if (t > e.length) return null;
+		let n = w.decode(e.subarray(e.length - t, e.length - 8)).split(",")[0];
+		return n ? {
+			ekey: n,
+			tailLen: t
+		} : null;
+	}
+	let t = n(e[e.length - 4] | e[e.length - 3] << 8 | e[e.length - 2] << 16 | e[e.length - 1] << 24);
+	if (t === 0 || t > _ || t + 4 > e.length) return null;
+	let r = e.length - 4, i = r - t;
+	for (; r > i && e[r - 1] === 0;) r--;
+	let o = w.decode(e.subarray(i, r));
+	return /^[A-Za-z0-9+/=]+$/.test(o) ? {
+		ekey: o,
+		tailLen: t + 4
+	} : null;
+}
+function E(e) {
+	let t = new Uint8Array(128), n = e.length;
+	if (n === 0) return t;
+	let r = new Uint8Array(n), i = 4;
+	for (let t = 0; t < n; t++) {
+		let n = e[t];
+		r[t] = (n << i & 255 | n >>> i) & 255, i = i + 1 & 7;
+	}
+	for (let e = 0; e < 128; e++) t[e] = r[(e * e + 71214) % n];
+	return t;
+}
+function D(e, t) {
+	let n = E(t);
+	for (let t = 0; t < e.length; t++) {
+		let r = t;
+		r > 32767 && (r %= 32767), e[t] ^= n[r & 127];
+	}
+}
+var O = 128, k = 5120, A = 5631;
+function j(e, t) {
+	let n = e.length, r = new Uint8Array(n);
+	for (let e = 0; e < n; e++) r[e] = e & 255;
+	let i = 0;
+	for (let t = 0; t < n; t++) {
+		i = (i + r[t] + e[t % n]) % n;
+		let a = r[t];
+		r[t] = r[i], r[i] = a;
+	}
+	let a = new Uint8Array(t), o = 0;
+	i = 0;
+	for (let e = 0; e < t; e++) {
+		o = (o + 1) % n, i = (i + r[o]) % n;
+		let t = r[o];
+		r[o] = r[i], r[i] = t, a[e] = r[(r[o] + r[i]) % n];
+	}
+	return a;
+}
+function M(e) {
+	let t = 1;
+	for (let n = 0; n < e.length; n++) {
+		let r = e[n];
+		if (r === 0) continue;
+		let i = Math.imul(t, r) >>> 0;
+		if (i <= t >>> 0) break;
+		t = i;
+	}
+	return t >>> 0;
+}
+function N(e, t) {
+	let n = t.length, r = M(t), i = j(t, A), a = (e, t) => t === 0 ? 0 : Math.floor(r / (t * (e + 1)) * 100), o = 0, s = 0, c = e.length;
+	if (o < O) {
+		let r = Math.min(c - s, O - o), i = o;
+		for (let o = 0; o < r; o++) e[s + o] ^= t[a(i, t[i % n]) % n], i++;
+		o += r, s += r;
+	}
+	if (o % k !== 0) {
+		let t = Math.min(c - s, k - o % k);
+		l(e, s, t, o), o += t, s += t;
+	}
+	for (; s < c;) {
+		let t = Math.min(c - s, k);
+		l(e, s, t, o), o += t, s += t;
+	}
+	function l(e, r, o, s) {
+		let c = Math.floor(s / k), l = s % k, u = a(c, t[c % n]) % 512 + l;
+		for (let t = 0; t < o; t++) e[r + t] ^= i[u + t];
+	}
+}
+function P(e) {
+	let t = (t, n) => {
+		for (let r = 0; r < n.length; r++) if (e[t + r] !== n.charCodeAt(r)) return !1;
+		return !0;
+	};
+	return t(0, "fLaC") ? {
+		format: "flac",
+		mime: "audio/flac",
+		ext: "flac"
+	} : t(0, "OggS") ? {
+		format: "ogg",
+		mime: "audio/ogg",
+		ext: "ogg"
+	} : t(0, "ID3") || e[0] === 255 && (e[1] & 224) == 224 ? {
+		format: "mp3",
+		mime: "audio/mpeg",
+		ext: "mp3"
+	} : e.length > 11 && t(4, "ftyp") ? {
+		format: "m4a",
+		mime: "audio/mp4",
+		ext: "m4a"
+	} : t(0, "RIFF") && t(8, "WAVE") ? {
+		format: "wav",
+		mime: "audio/wav",
+		ext: "wav"
+	} : {
+		format: "bin",
+		mime: "application/octet-stream",
+		ext: "bin"
+	};
+}
+var F = class extends Error {};
+function I(e) {
+	let t = e instanceof Uint8Array ? e : new Uint8Array(e), n = T(t);
+	if (!n) throw new F("未能解析文件尾部的密钥（可能不是 QQ 音乐加密文件，或为需要外部密钥的 STag 格式）");
+	let r = C(n.ekey);
+	if (!r || r.length === 0) throw new F("EKey 解密失败");
+	let i = t.slice(0, t.length - n.tailLen);
+	r.length > 300 ? N(i, r) : D(i, r);
+	let a = P(i);
+	if (a.format === "bin") throw new F("解密结果不是可识别的音频格式（密钥或格式不支持）");
+	return {
+		data: i,
+		...a
+	};
+}
+//#endregion
+export { F as QmcError, C as decryptEKey, I as decryptQmc, T as parseFooter };

package/dist/lib/rar.d.ts

@@ -0,0 +1,16 @@
+/**
+ * In-browser RAR reader, wrapping the WASM unrar port (node-unrar-js).
+ *
+ * RAR is the one archive format in this viewer we don't hand-roll: RAR3/RAR5 decompression is a large,
+ * proprietary LZ+filter pipeline, so — unlike zip/7z/tar — we lean on the upstream `unrar` C sources
+ * compiled to WebAssembly. The ESM build (`node-unrar-js/esm`) is browser-targeted; we feed it the wasm
+ * binary fetched as a same-origin asset (Vite emits `unrar.wasm` via the `?url` import) so nothing loads
+ * from a CDN. The module + wasm are pulled in lazily (this file is dynamic-imported by ArchiveBrowser),
+ * keeping the ~200KB wasm out of the main bundle until a `.rar` is actually opened.
+ *
+ * Exposed through the shared {@link OpenedArchive} interface like the other archives. The upstream bytes are
+ * decoded entirely client-side; the WASM sandbox never reaches the network or filesystem.
+ */
+import type { OpenedArchive } from '@/lib/archive';
+/** Open a RAR archive: list its entries, extracting each file's bytes on demand via the WASM extractor. */
+export declare function openRar(buf: ArrayBuffer): Promise<OpenedArchive>;