@layervai/qurl 0.3.1 → 0.4.0

package/dist/esm/internal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.js","sourceRoot":"","sources":["../../src/internal.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,gFAAgF;AAChF,mBAAmB;AAEnB;;sEAEsE;AACtE,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,OAAO,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,CAAC;QAC3D,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC"}

package/dist/esm/node/deployment.d.ts

@@ -0,0 +1,45 @@
+import type { KeyObject } from "node:crypto";
+import { type StrictJsonValue } from "./strict-json.js";
+export interface PortalDeployment {
+    readonly issuers: readonly PortalDeploymentIssuer[];
+    readonly cells: readonly PortalDeploymentCell[];
+}
+export interface PortalDeploymentIssuer {
+    readonly kid: string;
+    readonly spki_der_b64: string;
+}
+export interface PortalDeploymentCell {
+    readonly cell_id?: string;
+    readonly host: string;
+    readonly port: number;
+    readonly server_public_key_b64: string;
+}
+export interface ValidatedDeployment {
+    readonly issuers: ReadonlyMap<string, KeyObject>;
+    readonly cells: ReadonlyMap<string, ValidatedCell>;
+}
+export interface ValidatedCell {
+    readonly host: string;
+    readonly port: 443;
+    readonly serverPublicKey: Uint8Array;
+}
+interface DeploymentFileRuntime {
+    readonly open: (path: string, flags: number) => number;
+    readonly stat: (descriptor: number) => {
+        readonly size: number;
+        isFile(): boolean;
+    };
+    readonly read: (descriptor: number, buffer: Buffer, offset: number, length: number, position: number) => number;
+    readonly close: (descriptor: number) => void;
+}
+/** Load and validate deployment trust once, before an opener can do network I/O. */
+export declare function loadPortalDeployment(explicit?: PortalDeployment): ValidatedDeployment;
+declare function readBoundedDeploymentFile(path: string, runtime?: DeploymentFileRuntime): Buffer;
+export declare function fingerprintKey(key: Uint8Array): string;
+declare function decodeFlexibleBase64(value: StrictJsonValue | undefined, name: string): Uint8Array;
+export declare const deploymentTesting: {
+    readBoundedDeploymentFile: typeof readBoundedDeploymentFile;
+    decodeFlexibleBase64: typeof decodeFlexibleBase64;
+};
+export {};
+//# sourceMappingURL=deployment.d.ts.map

package/dist/esm/node/deployment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../../src/node/deployment.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAuC,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAG7F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACjD;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC;IACnB,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC;CACtC;AAOD,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IACvD,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,IAAI,OAAO,CAAA;KAAE,CAAC;IACpF,QAAQ,CAAC,IAAI,EAAE,CACb,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,KACb,MAAM,CAAC;IACZ,QAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9C;AASD,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,QAAQ,CAAC,EAAE,gBAAgB,GAAG,mBAAmB,CAWrF;AAED,iBAAS,yBAAyB,CAChC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,qBAAoD,GAC5D,MAAM,CA2BR;AAsDD,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAEtD;AAED,iBAAS,oBAAoB,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAgB1F;AAqCD,eAAO,MAAM,iBAAiB;;;CAAsD,CAAC"}

package/dist/esm/node/deployment.js

@@ -0,0 +1,163 @@
+import { closeSync, constants as fsConstants, fstatSync, openSync, readSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { isStrictJsonObject, parseStrictJson } from "./strict-json.js";
+import { issuerKeyFromSpki } from "./qv2.js";
+const DEPLOYMENT_KEYS = new Set(["issuers", "cells", "relay_allowlist", "hub"]);
+const ISSUER_KEYS = new Set(["kid", "spki_der_b64"]);
+const CELL_KEYS = new Set(["cell_id", "host", "port", "server_public_key_b64"]);
+const MAX_DEPLOYMENT_BYTES = 1_048_576;
+const defaultDeploymentFileRuntime = {
+    open: openSync,
+    stat: fstatSync,
+    read: readSync,
+    close: closeSync,
+};
+/** Load and validate deployment trust once, before an opener can do network I/O. */
+export function loadPortalDeployment(explicit) {
+    if (explicit !== undefined)
+        return validateDeployment(explicit);
+    const configured = process.env.QURL_DEPLOYMENT;
+    if (!configured || configured.trim() === "") {
+        throw new Error("native qURL opening requires deployment trust in QURL_DEPLOYMENT");
+    }
+    const trimmed = configured.trim();
+    const raw = trimmed.startsWith("{")
+        ? Buffer.from(trimmed, "utf8")
+        : readBoundedDeploymentFile(trimmed);
+    return validateDeploymentValue(parseStrictJson(raw, MAX_DEPLOYMENT_BYTES));
+}
+function readBoundedDeploymentFile(path, runtime = defaultDeploymentFileRuntime) {
+    // O_NONBLOCK prevents a FIFO or device path from hanging construction before
+    // fstat can enforce the regular-file contract. It has no effect on files.
+    const descriptor = runtime.open(path, fsConstants.O_RDONLY | fsConstants.O_NONBLOCK);
+    try {
+        const metadata = runtime.stat(descriptor);
+        if (!metadata.isFile())
+            throw new Error("native qURL deployment path must be a regular file");
+        if (!Number.isSafeInteger(metadata.size) || metadata.size > MAX_DEPLOYMENT_BYTES) {
+            throw new Error("native qURL deployment file exceeds its 1 MiB limit");
+        }
+        const bytes = Buffer.alloc(metadata.size);
+        let offset = 0;
+        while (offset < bytes.byteLength) {
+            const count = runtime.read(descriptor, bytes, offset, bytes.byteLength - offset, offset);
+            if (count === 0) {
+                throw new Error("native qURL deployment file changed while it was read");
+            }
+            offset += count;
+        }
+        const extra = Buffer.alloc(1);
+        if (runtime.read(descriptor, extra, 0, 1, offset) !== 0) {
+            throw new Error("native qURL deployment file changed while it was read");
+        }
+        return bytes.subarray(0, offset);
+    }
+    finally {
+        runtime.close(descriptor);
+    }
+}
+function validateDeployment(explicit) {
+    // Convert through JSON only to give the programmatic form the same strict,
+    // immutable validation path as the environment/file form. Deployment data is
+    // public trust material, not a secret.
+    let encoded;
+    try {
+        encoded = JSON.stringify(explicit);
+    }
+    catch {
+        throw new Error("native qURL deployment is not JSON serializable");
+    }
+    if (encoded === undefined)
+        throw new Error("native qURL deployment is missing");
+    return validateDeploymentValue(parseStrictJson(Buffer.from(encoded, "utf8"), MAX_DEPLOYMENT_BYTES));
+}
+function validateDeploymentValue(value) {
+    const root = requireObject(value, "deployment");
+    rejectUnknown(root, DEPLOYMENT_KEYS, "deployment");
+    const issuerRows = requireArray(root.issuers, "deployment issuers");
+    const cellRows = requireArray(root.cells, "deployment cells");
+    if (issuerRows.length === 0)
+        throw new Error("deployment must contain at least one issuer");
+    if (cellRows.length === 0)
+        throw new Error("native-only deployment must contain at least one cell");
+    const issuers = new Map();
+    for (const row of issuerRows) {
+        const item = requireObject(row, "deployment issuer");
+        rejectUnknown(item, ISSUER_KEYS, "deployment issuer");
+        const kid = requireTrimmed(item.kid, "deployment issuer kid");
+        if (issuers.has(kid))
+            throw new Error("deployment contains a duplicate issuer kid");
+        issuers.set(kid, issuerKeyFromSpki(decodeFlexibleBase64(item.spki_der_b64, "issuer key")));
+    }
+    const cells = new Map();
+    for (const row of cellRows) {
+        const item = requireObject(row, "deployment cell");
+        rejectUnknown(item, CELL_KEYS, "deployment cell");
+        const host = requireTrimmed(item.host, "deployment cell host");
+        if (item.port !== 443n)
+            throw new Error("deployment cell must use NHP UDP port 443");
+        const serverPublicKey = decodeFlexibleBase64(item.server_public_key_b64, "cell public key");
+        if (serverPublicKey.byteLength !== 32)
+            throw new Error("cell public key must be 32 bytes");
+        const fingerprint = fingerprintKey(serverPublicKey);
+        if (cells.has(fingerprint))
+            throw new Error("deployment contains a duplicate cell public key");
+        // Validate cell_id for schema parity, but do not use it as identity. The
+        // full X25519 public key is the cryptographic cell binding.
+        if (item.cell_id !== undefined)
+            requireString(item.cell_id, "cell id");
+        cells.set(fingerprint, { host, port: 443, serverPublicKey });
+    }
+    return { issuers, cells };
+}
+export function fingerprintKey(key) {
+    return createHash("sha256").update(key).digest().subarray(0, 8).toString("base64url");
+}
+function decodeFlexibleBase64(value, name) {
+    const encoded = requireTrimmed(value, name);
+    const hasStandard = /[+/]/.test(encoded);
+    const hasUrl = /[-_]/.test(encoded);
+    if (hasStandard && hasUrl)
+        throw new Error(`${name} mixes base64 alphabets`);
+    if (!/^(?:[A-Za-z0-9+/_-]{4})*(?:[A-Za-z0-9+/_-]{2}==|[A-Za-z0-9+/_-]{3}=)?$/.test(encoded)) {
+        // Also permit the unpadded two/three-character tail used by Raw encodings.
+        if (!/^[A-Za-z0-9+/_-]+$/.test(encoded) || encoded.length % 4 === 1) {
+            throw new Error(`${name} is not valid base64`);
+        }
+    }
+    const normalized = encoded.replace(/-/g, "+").replace(/_/g, "/").replace(/=+$/, "");
+    const decoded = Buffer.from(normalized, "base64");
+    const canonical = decoded.toString("base64").replace(/=+$/, "");
+    if (canonical !== normalized)
+        throw new Error(`${name} is not canonical base64`);
+    return new Uint8Array(decoded);
+}
+function requireObject(value, name) {
+    if (!isStrictJsonObject(value))
+        throw new Error(`${name} must be one JSON object`);
+    return value;
+}
+function requireArray(value, name) {
+    if (!Array.isArray(value))
+        throw new Error(`${name} must be an array`);
+    return value;
+}
+function requireString(value, name) {
+    if (typeof value !== "string")
+        throw new Error(`${name} must be a string`);
+    return value;
+}
+function requireTrimmed(value, name) {
+    const string = requireString(value, name);
+    if (string === "" || string.trim() !== string)
+        throw new Error(`${name} must be non-empty and trimmed`);
+    return string;
+}
+function rejectUnknown(value, allowed, name) {
+    for (const key of Object.keys(value)) {
+        if (!allowed.has(key))
+            throw new Error(`${name} contains an unknown field`);
+    }
+}
+export const deploymentTesting = { readBoundedDeploymentFile, decodeFlexibleBase64 };
+//# sourceMappingURL=deployment.js.map

package/dist/esm/node/deployment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment.js","sourceRoot":"","sources":["../../../src/node/deployment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,IAAI,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7F,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAwB,MAAM,kBAAkB,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AA8B7C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC;AAChF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;AACrD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC,CAAC;AAChF,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAevC,MAAM,4BAA4B,GAA0B;IAC1D,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,SAAS;CACjB,CAAC;AAEF,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,QAA2B;IAC9D,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC/C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACjC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;QAC9B,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,uBAAuB,CAAC,eAAe,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,yBAAyB,CAChC,IAAY,EACZ,OAAO,GAA0B,4BAA4B;IAE7D,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC9F,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,GAAG,oBAAoB,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC;YACzF,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,QAA0B;IACpD,2EAA2E;IAC3E,6EAA6E;IAC7E,uCAAuC;IACvC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAChF,OAAO,uBAAuB,CAC5B,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,oBAAoB,CAAC,CACpE,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAsB;IACrD,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAChD,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC9D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC5F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAE3E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACrD,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACpF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACnD,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACrF,MAAM,eAAe,GAAG,oBAAoB,CAAC,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;QAC5F,IAAI,eAAe,CAAC,UAAU,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC3F,MAAM,WAAW,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAC/F,yEAAyE;QACzE,4DAA4D;QAC5D,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACvE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAe;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAkC,EAAE,IAAY;IAC5E,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,WAAW,IAAI,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yBAAyB,CAAC,CAAC;IAC7E,IAAI,CAAC,wEAAwE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5F,2EAA2E;QAC3E,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sBAAsB,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,SAAS,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0BAA0B,CAAC,CAAC;IACjF,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CACpB,KAAkC,EAClC,IAAY;IAEZ,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0BAA0B,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAkC,EAAE,IAAY;IACpE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAkC,EAAE,IAAY;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;IAC3E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAkC,EAAE,IAAY;IACtE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM;QAC3C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gCAAgC,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CACpB,KAAyC,EACzC,OAA4B,EAC5B,IAAY;IAEZ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4BAA4B,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/esm/node/native-udp.d.ts

@@ -0,0 +1,38 @@
+import { lookup } from "node:dns/promises";
+import { type Socket } from "node:dgram";
+import { buildNHPMessage, decryptNHPReply, type NHPMessage } from "./nhp-wire.js";
+import type { ValidatedCell } from "./deployment.js";
+export declare const NATIVE_DEFAULT_TIMEOUT_MS = 3000;
+export declare const NATIVE_DEFAULT_MAX_ADDRESSES = 3;
+export interface NativeExchangeOptions {
+    readonly signal?: AbortSignal;
+    /** Per-address timeout; serial fallback can use maxAddresses times this value. */
+    readonly timeoutMs?: number;
+    /** Maximum number of resolved addresses tried serially. */
+    readonly maxAddresses?: number;
+}
+interface NativeKnockRuntime {
+    readonly buildMessage: typeof buildNHPMessage;
+    readonly resolveAddresses: typeof resolvePublicAddresses;
+    readonly exchange: typeof exchangeDatagram;
+    readonly decryptReply: typeof decryptNHPReply;
+}
+export declare function nativeKnock(cell: ValidatedCell, devicePrivateKey: Uint8Array, body: Uint8Array, options?: NativeExchangeOptions): Promise<NHPMessage>;
+declare function nativeKnockWithRuntime(cell: ValidatedCell, devicePrivateKey: Uint8Array, body: Uint8Array, options: NativeExchangeOptions, runtime: NativeKnockRuntime): Promise<NHPMessage>;
+declare function resolvePublicAddresses(host: string, maximum: number, signal?: AbortSignal, lookupAddresses?: typeof lookup): Promise<Array<{
+    address: string;
+    family: 4 | 6;
+}>>;
+declare function isPublicAddress(address: string, family: number): boolean;
+declare function exchangeDatagram(address: string, family: 4 | 6, port: number, packet: Uint8Array, timeoutMs: number, signal?: AbortSignal): Promise<Uint8Array>;
+declare function sendOwnedDatagram(socket: Socket, packet: Uint8Array, finish: (error: unknown) => void): void;
+export declare const nativeUdpTesting: {
+    isPublicAddress: typeof isPublicAddress;
+    resolvePublicAddresses: typeof resolvePublicAddresses;
+    nativeKnockWithRuntime: typeof nativeKnockWithRuntime;
+    exchangeDatagram: typeof exchangeDatagram;
+    sendOwnedDatagram: typeof sendOwnedDatagram;
+    socketExchangeError: (cause: unknown) => Error;
+};
+export {};
+//# sourceMappingURL=native-udp.d.ts.map

package/dist/esm/node/native-udp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-udp.d.ts","sourceRoot":"","sources":["../../../src/node/native-udp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,YAAY,CAAC;AAEvD,OAAO,EACL,eAAe,EACf,eAAe,EAIf,KAAK,UAAU,EAChB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAIrD,eAAO,MAAM,yBAAyB,OAAQ,CAAC;AAC/C,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAmF9C,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,2DAA2D;IAC3D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,eAAe,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,OAAO,sBAAsB,CAAC;IACzD,QAAQ,CAAC,QAAQ,EAAE,OAAO,gBAAgB,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,OAAO,eAAe,CAAC;CAC/C;AASD,wBAAsB,WAAW,CAC/B,IAAI,EAAE,aAAa,EACnB,gBAAgB,EAAE,UAAU,EAC5B,IAAI,EAAE,UAAU,EAChB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,UAAU,CAAC,CAErB;AAED,iBAAe,sBAAsB,CACnC,IAAI,EAAE,aAAa,EACnB,gBAAgB,EAAE,UAAU,EAC5B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,UAAU,CAAC,CA+CrB;AAED,iBAAe,sBAAsB,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,WAAW,EACpB,eAAe,GAAE,OAAO,MAAe,GACtC,OAAO,CAAC,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAA;CAAE,CAAC,CAAC,CAsBpD;AAED,iBAAS,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIjE;AAoBD,iBAAS,gBAAgB,CACvB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,CAAC,GAAG,CAAC,EACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,CAyCrB;AAED,iBAAS,iBAAiB,CACxB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAC/B,IAAI,CAiBN;AA2BD,eAAO,MAAM,gBAAgB;;;;;;iCAME,OAAO,KAAG,KAAK;CAC7C,CAAC"}

package/dist/esm/node/native-udp.js

@@ -0,0 +1,291 @@
+import { lookup } from "node:dns/promises";
+import { createSocket } from "node:dgram";
+import { BlockList, isIP } from "node:net";
+import { buildNHPMessage, decryptNHPReply, NHP_PACKET_SIZE, NHP_TYPE_COOKIE, NHP_TYPE_KNOCK, } from "./nhp-wire.js";
+// Keep these defaults exported inside the Node implementation so the portal
+// lifecycle can derive one bounded whole-open deadline from the same values.
+export const NATIVE_DEFAULT_TIMEOUT_MS = 3_000;
+export const NATIVE_DEFAULT_MAX_ADDRESSES = 3;
+const ipv4Denied = new BlockList();
+// Keep this set in lockstep with qurl-go's nonRoutablePrefixes plus the
+// IsPrivate/IsLoopback/IsLinkLocal/IsMulticast predicates it applies first.
+for (const [network, prefix] of [
+    ["0.0.0.0", 8],
+    ["10.0.0.0", 8],
+    ["100.64.0.0", 10],
+    ["127.0.0.0", 8],
+    ["169.254.0.0", 16],
+    ["172.16.0.0", 12],
+    ["192.0.0.0", 24],
+    ["192.0.2.0", 24],
+    ["192.168.0.0", 16],
+    ["192.88.99.0", 24],
+    ["198.18.0.0", 15],
+    ["198.51.100.0", 24],
+    ["203.0.113.0", 24],
+    ["224.0.0.0", 4],
+    ["240.0.0.0", 4],
+]) {
+    ipv4Denied.addSubnet(network, prefix, "ipv4");
+}
+const ipv6Allowed = new BlockList();
+for (const [network, prefix] of [
+    ["2001:200::", 23],
+    ["2001:400::", 23],
+    ["2001:600::", 23],
+    ["2001:800::", 22],
+    ["2001:c00::", 23],
+    ["2001:e00::", 23],
+    ["2001:1200::", 23],
+    ["2001:1400::", 22],
+    ["2001:1800::", 23],
+    ["2001:1a00::", 23],
+    ["2001:1c00::", 22],
+    ["2001:2000::", 19],
+    ["2001:4000::", 23],
+    ["2001:4200::", 23],
+    ["2001:4400::", 23],
+    ["2001:4600::", 23],
+    ["2001:4800::", 23],
+    ["2001:4a00::", 23],
+    ["2001:4c00::", 23],
+    ["2001:5000::", 20],
+    ["2001:8000::", 19],
+    ["2001:a000::", 20],
+    ["2001:b000::", 20],
+    ["2003::", 18],
+    ["2400::", 12],
+    ["2410::", 12],
+    ["2600::", 12],
+    ["2610::", 23],
+    ["2620::", 23],
+    ["2630::", 12],
+    ["2800::", 12],
+    ["2a00::", 12],
+    ["2a10::", 12],
+    ["2c00::", 12],
+]) {
+    ipv6Allowed.addSubnet(network, prefix, "ipv6");
+}
+const ipv6Denied = new BlockList();
+for (const [network, prefix] of [
+    ["100::", 64],
+    ["64:ff9b::", 96],
+    ["64:ff9b:1::", 48],
+    ["2001::", 23],
+    ["2001:db8::", 32],
+    ["2002::", 16],
+    ["3fff::", 20],
+    ["5f00::", 16],
+    ["fc00::", 7],
+    ["fe80::", 10],
+    ["fec0::", 10],
+    ["ff00::", 8],
+]) {
+    ipv6Denied.addSubnet(network, prefix, "ipv6");
+}
+const defaultNativeKnockRuntime = {
+    buildMessage: buildNHPMessage,
+    resolveAddresses: resolvePublicAddresses,
+    exchange: exchangeDatagram,
+    decryptReply: decryptNHPReply,
+};
+export async function nativeKnock(cell, devicePrivateKey, body, options = {}) {
+    return nativeKnockWithRuntime(cell, devicePrivateKey, body, options, defaultNativeKnockRuntime);
+}
+async function nativeKnockWithRuntime(cell, devicePrivateKey, body, options, runtime) {
+    if (options.signal?.aborted)
+        throw options.signal.reason;
+    const built = runtime.buildMessage({
+        type: NHP_TYPE_KNOCK,
+        devicePrivateKey,
+        serverPublicKey: cell.serverPublicKey,
+        body,
+    });
+    try {
+        const addresses = await runtime.resolveAddresses(cell.host, options.maxAddresses ?? NATIVE_DEFAULT_MAX_ADDRESSES, options.signal);
+        let lastError;
+        for (const address of addresses) {
+            try {
+                const packet = await runtime.exchange(address.address, address.family, cell.port, built.packet, options.timeoutMs ?? NATIVE_DEFAULT_TIMEOUT_MS, options.signal);
+                const reply = runtime.decryptReply(devicePrivateKey, cell.serverPublicKey, packet);
+                // NHP 1.1 COOKIE is a stateless busy response. Go intentionally does
+                // not bind its counter to the request; only an ACK must match it.
+                if (reply.type === NHP_TYPE_COOKIE)
+                    return reply;
+                if (reply.counter !== built.counter) {
+                    reply.body.fill(0);
+                    throw new Error("NHP reply counter does not match the request");
+                }
+                return reply;
+            }
+            catch (error) {
+                if (options.signal?.aborted)
+                    throw options.signal.reason;
+                // Authentication and reply-policy failures happen after a datagram was
+                // received. They are terminal and must not fall through to another DNS
+                // address. Only local socket failures carry this private marker.
+                if (!isSocketExchangeError(error))
+                    throw error;
+                lastError = error.cause;
+            }
+        }
+        throw new Error("native NHP exchange failed", { cause: lastError });
+    }
+    finally {
+        built.packet.fill(0);
+    }
+}
+async function resolvePublicAddresses(host, maximum, signal, lookupAddresses = lookup) {
+    if (!Number.isInteger(maximum) || maximum < 1 || maximum > 16) {
+        throw new Error("native NHP maxAddresses must be an integer from 1 to 16");
+    }
+    if (signal?.aborted)
+        throw signal.reason;
+    let rows;
+    try {
+        rows = await waitForAbort(lookupAddresses(host, { all: true, verbatim: true }), signal);
+    }
+    catch (error) {
+        if (signal?.aborted)
+            throw signal.reason;
+        throw new Error("native NHP endpoint DNS resolution failed", { cause: error });
+    }
+    if (signal?.aborted)
+        throw signal.reason;
+    const accepted = [];
+    for (const row of rows) {
+        if (row.family !== 4 && row.family !== 6)
+            continue;
+        if (!isPublicAddress(row.address, row.family))
+            continue;
+        accepted.push({ address: row.address, family: row.family });
+        if (accepted.length === maximum)
+            break;
+    }
+    if (accepted.length === 0)
+        throw new Error("native NHP endpoint resolved to no public address");
+    return accepted;
+}
+function isPublicAddress(address, family) {
+    if (isIP(address) !== family)
+        return false;
+    if (family === 4)
+        return !ipv4Denied.check(address, "ipv4");
+    return ipv6Allowed.check(address, "ipv6") && !ipv6Denied.check(address, "ipv6");
+}
+class SocketExchangeError extends Error {
+    constructor(cause) {
+        super("native NHP socket exchange failed", { cause });
+        this.name = "SocketExchangeError";
+    }
+}
+// A received datagram is an authority-bearing response attempt. Its malformed
+// shape must stop address fallback instead of being treated as a local socket
+// miss that can send the same knock to another address.
+class ReceivedDatagramError extends Error {
+}
+function isSocketExchangeError(error) {
+    return error instanceof SocketExchangeError;
+}
+function exchangeDatagram(address, family, port, packet, timeoutMs, signal) {
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 60_000) {
+        return Promise.reject(new Error("native NHP timeout must be from 1 to 60000 milliseconds"));
+    }
+    if (signal?.aborted) {
+        return Promise.reject(signal.reason ?? new DOMException("Aborted", "AbortError"));
+    }
+    return new Promise((resolve, reject) => {
+        const socket = createSocket(family === 6 ? "udp6" : "udp4");
+        let settled = false;
+        const finish = (error, reply) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", abort);
+            // An error that arrives while close settles must not become an unhandled
+            // EventEmitter error after the one-shot operational listener ran.
+            socket.on("error", () => undefined);
+            try {
+                socket.close();
+            }
+            catch {
+                // The socket can already be closed by a synchronous setup failure.
+            }
+            if (error instanceof ReceivedDatagramError)
+                reject(error);
+            else if (error !== undefined)
+                reject(new SocketExchangeError(error));
+            else
+                resolve(new Uint8Array(reply));
+        };
+        const abort = () => finish(signal?.reason ?? new DOMException("Aborted", "AbortError"));
+        const timer = setTimeout(() => finish(new Error("native NHP reply timed out")), timeoutMs);
+        timer.unref();
+        signal?.addEventListener("abort", abort, { once: true });
+        socket.once("error", (error) => finish(error));
+        socket.once("message", (reply) => {
+            if (reply.byteLength > NHP_PACKET_SIZE) {
+                finish(new ReceivedDatagramError("native NHP reply is too large"));
+            }
+            else
+                finish(undefined, reply);
+        });
+        socket.connect(port, address, () => {
+            sendOwnedDatagram(socket, packet, finish);
+        });
+    });
+}
+function sendOwnedDatagram(socket, packet, finish) {
+    // dgram owns its input until this callback. Use an independent encrypted
+    // datagram so nativeKnock can wipe the builder's packet immediately when an
+    // abort settles the exchange. Wipe this copy only after libuv releases it.
+    const outbound = Buffer.from(packet);
+    try {
+        socket.send(outbound, (error) => {
+            try {
+                if (error)
+                    finish(error);
+            }
+            finally {
+                outbound.fill(0);
+            }
+        });
+    }
+    catch (error) {
+        outbound.fill(0);
+        finish(error);
+    }
+}
+function waitForAbort(promise, signal) {
+    if (!signal)
+        return promise;
+    if (signal.aborted) {
+        return Promise.reject(signal.reason ?? new DOMException("Aborted", "AbortError"));
+    }
+    return new Promise((resolve, reject) => {
+        const abort = () => {
+            cleanup();
+            reject(signal.reason ?? new DOMException("Aborted", "AbortError"));
+        };
+        const cleanup = () => signal.removeEventListener("abort", abort);
+        signal.addEventListener("abort", abort, { once: true });
+        promise.then((value) => {
+            cleanup();
+            resolve(value);
+        }, (error) => {
+            cleanup();
+            reject(error);
+        });
+    });
+}
+export const nativeUdpTesting = {
+    isPublicAddress,
+    resolvePublicAddresses,
+    nativeKnockWithRuntime,
+    exchangeDatagram,
+    sendOwnedDatagram,
+    socketExchangeError: (cause) => new SocketExchangeError(cause),
+};
+//# sourceMappingURL=native-udp.js.map

package/dist/esm/node/native-udp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-udp.js","sourceRoot":"","sources":["../../../src/node/native-udp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAe,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,GAEf,MAAM,eAAe,CAAC;AAGvB,4EAA4E;AAC5E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAC/C,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAE9C,MAAM,UAAU,GAAG,IAAI,SAAS,EAAE,CAAC;AACnC,wEAAwE;AACxE,4EAA4E;AAC5E,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,SAAS,EAAE,CAAC,CAAC;IACd,CAAC,UAAU,EAAE,CAAC,CAAC;IACf,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,WAAW,EAAE,CAAC,CAAC;IAChB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,cAAc,EAAE,EAAE,CAAC;IACpB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,WAAW,EAAE,CAAC,CAAC;IAChB,CAAC,WAAW,EAAE,CAAC,CAAC;CACR,EAAE,CAAC;IACX,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,SAAS,EAAE,CAAC;AACpC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,EAAE,CAAC;CACN,EAAE,CAAC;IACX,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,SAAS,EAAE,CAAC;AACnC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,OAAO,EAAE,EAAE,CAAC;IACb,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,CAAC,CAAC;IACb,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,CAAC,CAAC;CACL,EAAE,CAAC;IACX,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAiBD,MAAM,yBAAyB,GAAuB;IACpD,YAAY,EAAE,eAAe;IAC7B,gBAAgB,EAAE,sBAAsB;IACxC,QAAQ,EAAE,gBAAgB;IAC1B,YAAY,EAAE,eAAe;CAC9B,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAmB,EACnB,gBAA4B,EAC5B,IAAgB,EAChB,OAAO,GAA0B,EAAE;IAEnC,OAAO,sBAAsB,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC;AAClG,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,IAAmB,EACnB,gBAA4B,EAC5B,IAAgB,EAChB,OAA8B,EAC9B,OAA2B;IAE3B,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC;QACjC,IAAI,EAAE,cAAc;QACpB,gBAAgB;QAChB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,IAAI;KACL,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAC9C,IAAI,CAAC,IAAI,EACT,OAAO,CAAC,YAAY,IAAI,4BAA4B,EACpD,OAAO,CAAC,MAAM,CACf,CAAC;QACF,IAAI,SAAkB,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CACnC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,MAAM,EACd,IAAI,CAAC,IAAI,EACT,KAAK,CAAC,MAAM,EACZ,OAAO,CAAC,SAAS,IAAI,yBAAyB,EAC9C,OAAO,CAAC,MAAM,CACf,CAAC;gBACF,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;gBACnF,qEAAqE;gBACrE,kEAAkE;gBAClE,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;oBAAE,OAAO,KAAK,CAAC;gBACjD,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;oBACpC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACnB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAClE,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;oBAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBACzD,uEAAuE;gBACvE,uEAAuE;gBACvE,iEAAiE;gBACjE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC/C,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,IAAY,EACZ,OAAe,EACf,MAAoB,EACpB,eAAe,GAAkB,MAAM;IAEvC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,MAAM,CAAC,MAAM,CAAC;IACzC,IAAI,IAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,2CAA2C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,MAAM,CAAC,MAAM,CAAC;IACzC,MAAM,QAAQ,GAA8C,EAAE,CAAC;IAC/D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO;YAAE,MAAM;IACzC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAChG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,MAAc;IACtD,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5D,OAAO,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,mBAAoB,SAAQ,KAAK;IAGrC,YAAY,KAAc;QACxB,KAAK,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,wDAAwD;AACxD,MAAM,qBAAsB,SAAQ,KAAK;CAAG;AAE5C,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,KAAK,YAAY,mBAAmB,CAAC;AAC9C,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAe,EACf,MAAa,EACb,IAAY,EACZ,MAAkB,EAClB,SAAiB,EACjB,MAAoB;IAEpB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,GAAG,MAAM,EAAE,CAAC;QACxE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;QACpB,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,KAAe,EAAE,KAAc,EAAQ,EAAE;YACvD,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5C,yEAAyE;YACzE,kEAAkE;YAClE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;YACrE,CAAC;YACD,IAAI,KAAK,YAAY,qBAAqB;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;iBACrD,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;;gBAChE,OAAO,CAAC,IAAI,UAAU,CAAC,KAAM,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;QAC9F,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC3F,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YAC/B,IAAI,KAAK,CAAC,UAAU,GAAG,eAAe,EAAE,CAAC;gBACvC,MAAM,CAAC,IAAI,qBAAqB,CAAC,+BAA+B,CAAC,CAAC,CAAC;YACrE,CAAC;;gBAAM,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;YACjC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAc,EACd,MAAkB,EAClB,MAAgC;IAEhC,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;YAC9B,IAAI,CAAC;gBACH,IAAI,KAAK;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;oBAAS,CAAC;gBACT,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAI,OAAmB,EAAE,MAAoB;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjE,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,eAAe;IACf,sBAAsB;IACtB,sBAAsB;IACtB,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB,EAAE,CAAC,KAAc,EAAS,EAAE,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC;CAC/E,CAAC"}

package/dist/esm/node/nhp-wire.d.ts

@@ -0,0 +1,36 @@
+export declare const NHP_TYPE_KNOCK = 1;
+export declare const NHP_TYPE_ACK = 2;
+export declare const NHP_TYPE_COOKIE = 7;
+export declare const NHP_HEADER_SIZE = 240;
+export declare const NHP_PACKET_SIZE = 4096;
+export declare const NHP_MAX_BODY_SIZE: number;
+export interface NHPMessage {
+    readonly type: number;
+    readonly flags: number;
+    readonly counter: bigint;
+    readonly timestampNanos: bigint;
+    readonly body: Uint8Array;
+}
+export interface BuildNHPMessageInput {
+    readonly type: number;
+    readonly devicePrivateKey: Uint8Array;
+    readonly serverPublicKey: Uint8Array;
+    readonly body: Uint8Array;
+    readonly ephemeralPrivateKey?: Uint8Array;
+    readonly timestampNanos?: bigint;
+    readonly counter?: bigint;
+    readonly preamble?: number;
+}
+export declare function buildNHPMessage(input: BuildNHPMessageInput): {
+    packet: Uint8Array;
+    counter: bigint;
+};
+export declare function decryptNHPReply(devicePrivateKey: Uint8Array, expectedServerPublicKey: Uint8Array, packetValue: Uint8Array): NHPMessage;
+declare function validateReplyProfile(type: number, flags: number): void;
+declare function inflateReplyBody(body: Buffer, flags: number): Buffer;
+export declare const nhpWireTesting: {
+    validateReplyProfile: typeof validateReplyProfile;
+    inflateReplyBody: typeof inflateReplyBody;
+};
+export {};
+//# sourceMappingURL=nhp-wire.d.ts.map

package/dist/esm/node/nhp-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nhp-wire.d.ts","sourceRoot":"","sources":["../../../src/node/nhp-wire.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,cAAc,IAAI,CAAC;AAChC,eAAO,MAAM,YAAY,IAAI,CAAC;AAC9B,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,eAAO,MAAM,eAAe,MAAM,CAAC;AACnC,eAAO,MAAM,eAAe,OAAQ,CAAC;AACrC,eAAO,MAAM,iBAAiB,QAAyC,CAAC;AAaxE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,gBAAgB,EAAE,UAAU,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,UAAU,CAAC;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG;IAC5D,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,CAyEA;AAED,wBAAgB,eAAe,CAC7B,gBAAgB,EAAE,UAAU,EAC5B,uBAAuB,EAAE,UAAU,EACnC,WAAW,EAAE,UAAU,GACtB,UAAU,CA4EZ;AAED,iBAAS,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAI/D;AAED,iBAAS,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAO7D;AAmGD,eAAO,MAAM,cAAc;;;CAA6C,CAAC"}