@layervai/qurl 0.3.1 → 0.5.0

package/dist/esm/node/nhp-wire.js

@@ -0,0 +1,257 @@
+import { createCipheriv, createDecipheriv, createHash, createHmac, createPrivateKey, createPublicKey, diffieHellman, randomBytes, timingSafeEqual, } from "node:crypto";
+import { inflateSync } from "node:zlib";
+export const NHP_TYPE_KNOCK = 1;
+export const NHP_TYPE_ACK = 2;
+export const NHP_TYPE_COOKIE = 7;
+export const NHP_HEADER_SIZE = 240;
+export const NHP_PACKET_SIZE = 4_096;
+export const NHP_MAX_BODY_SIZE = NHP_PACKET_SIZE - NHP_HEADER_SIZE - 16;
+const HEADER_COMMON_SIZE = 24;
+const OFFSET_EPHEMERAL = 24;
+const OFFSET_STATIC = 136;
+const OFFSET_TIMESTAMP = 184;
+const OFFSET_DIGEST = 208;
+const FLAG_COMPRESS = 1 << 1;
+const INITIAL_HASH = Buffer.from("NHP hashgen v.20230421@deepcloudsdp.com", "utf8");
+const INITIAL_CHAIN_KEY = Buffer.from("NHP keygen v.20230421@clouddeep.cn", "utf8");
+const X25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b656e04220420", "hex");
+const X25519_SPKI_PREFIX = Buffer.from("302a300506032b656e032100", "hex");
+export function buildNHPMessage(input) {
+    validateKey(input.devicePrivateKey, "device private key");
+    validateKey(input.serverPublicKey, "server public key");
+    if (input.body.byteLength > NHP_MAX_BODY_SIZE)
+        throw new Error("NHP application body is too large");
+    if (input.type !== NHP_TYPE_KNOCK)
+        throw new Error("unsupported NHP initiator message type");
+    const ephemeralPrivateKey = input.ephemeralPrivateKey
+        ? Buffer.from(input.ephemeralPrivateKey)
+        : randomBytes(32);
+    const secrets = [ephemeralPrivateKey];
+    try {
+        validateKey(ephemeralPrivateKey, "ephemeral private key");
+        const random = input.counter === undefined || input.preamble === undefined ? randomBytes(12) : undefined;
+        const counter = input.counter ?? random.readBigUInt64BE(0);
+        const preamble = input.preamble ?? random.readUInt32BE(8);
+        const timestampNanos = input.timestampNanos ?? BigInt(Date.now()) * 1000000n;
+        const devicePublicKey = rawPublicFromPrivate(input.devicePrivateKey);
+        const ephemeralPublicKey = rawPublicFromPrivate(ephemeralPrivateKey);
+        const nonce = nonceForCounter(counter);
+        const header = Buffer.alloc(NHP_HEADER_SIZE);
+        ephemeralPublicKey.copy(header, OFFSET_EPHEMERAL);
+        let chainHashParts = [INITIAL_HASH];
+        let chainKey = trackSecret(secrets, mixKey(hashParts(chainHashParts), INITIAL_CHAIN_KEY));
+        chainHashParts = [...chainHashParts, Buffer.from(input.serverPublicKey), ephemeralPublicKey];
+        chainKey = trackSecret(secrets, mixKey(chainKey, ephemeralPublicKey));
+        const ephemeralShared = trackSecret(secrets, sharedSecret(ephemeralPrivateKey, input.serverPublicKey));
+        let derived = keyGen2(chainKey, ephemeralShared);
+        secrets.push(...derived);
+        chainKey = derived[0];
+        const sealedStatic = seal(derived[1], nonce, devicePublicKey, hashParts(chainHashParts));
+        sealedStatic.copy(header, OFFSET_STATIC);
+        chainHashParts = [...chainHashParts, sealedStatic];
+        const staticShared = trackSecret(secrets, sharedSecret(input.devicePrivateKey, input.serverPublicKey));
+        derived = keyGen2(chainKey, staticShared);
+        secrets.push(...derived);
+        chainKey = derived[0];
+        const timestamp = Buffer.alloc(8);
+        timestamp.writeBigUInt64BE(timestampNanos);
+        const sealedTimestamp = seal(derived[1], nonce, timestamp, hashParts(chainHashParts));
+        sealedTimestamp.copy(header, OFFSET_TIMESTAMP);
+        chainHashParts = [...chainHashParts, sealedTimestamp];
+        derived = keyGen2(chainKey, sealedTimestamp);
+        secrets.push(...derived);
+        const bodyKey = derived[1];
+        header.writeUInt8(1, 8);
+        header.writeUInt8(1, 9);
+        header.writeUInt16BE(0, 10);
+        header.writeBigUInt64BE(counter, 16);
+        const payloadSize = input.body.byteLength === 0 ? 0 : input.body.byteLength + 16;
+        header.writeUInt32BE(preamble >>> 0, 0);
+        header.writeUInt32BE((preamble ^ ((input.type << 16) | payloadSize)) >>> 0, 4);
+        const bodyAad = hashParts([...chainHashParts, header.subarray(0, HEADER_COMMON_SIZE)]);
+        const sealedBody = input.body.byteLength === 0 ? Buffer.alloc(0) : seal(bodyKey, nonce, input.body, bodyAad);
+        headerDigest(input.serverPublicKey, header).copy(header, OFFSET_DIGEST);
+        return { packet: Buffer.concat([header, sealedBody]), counter };
+    }
+    finally {
+        wipeBuffers(secrets);
+    }
+}
+export function decryptNHPReply(devicePrivateKey, expectedServerPublicKey, packetValue) {
+    validateKey(devicePrivateKey, "device private key");
+    validateKey(expectedServerPublicKey, "server public key");
+    const packet = Buffer.from(packetValue);
+    if (packet.byteLength < NHP_HEADER_SIZE || packet.byteLength > NHP_PACKET_SIZE) {
+        throw new Error("NHP reply size is outside the protocol bounds");
+    }
+    if (packet[8] !== 1 || packet[9] < 1)
+        throw new Error("unsupported NHP protocol version");
+    const header = packet.subarray(0, NHP_HEADER_SIZE);
+    const sealedBody = packet.subarray(NHP_HEADER_SIZE);
+    const secrets = [];
+    let body;
+    try {
+        const devicePublicKey = rawPublicFromPrivate(devicePrivateKey);
+        const expectedDigest = headerDigest(devicePublicKey, header);
+        if (!timingSafeEqual(expectedDigest, header.subarray(OFFSET_DIGEST))) {
+            throw new Error("NHP reply header authentication failed");
+        }
+        const counter = header.readBigUInt64BE(16);
+        const nonce = nonceForCounter(counter);
+        const serverEphemeral = header.subarray(OFFSET_EPHEMERAL, OFFSET_EPHEMERAL + 32);
+        const sealedStatic = header.subarray(OFFSET_STATIC, OFFSET_STATIC + 48);
+        const sealedTimestamp = header.subarray(OFFSET_TIMESTAMP, OFFSET_TIMESTAMP + 24);
+        let chainHashParts = [INITIAL_HASH];
+        let chainKey = trackSecret(secrets, mixKey(hashParts(chainHashParts), INITIAL_CHAIN_KEY));
+        chainHashParts = [...chainHashParts, devicePublicKey, serverEphemeral];
+        chainKey = trackSecret(secrets, mixKey(chainKey, serverEphemeral));
+        const ephemeralShared = trackSecret(secrets, sharedSecret(devicePrivateKey, serverEphemeral));
+        let derived = keyGen2(chainKey, ephemeralShared);
+        secrets.push(...derived);
+        chainKey = derived[0];
+        const serverStatic = open(derived[1], nonce, sealedStatic, hashParts(chainHashParts));
+        if (!timingSafeEqual(serverStatic, Buffer.from(expectedServerPublicKey))) {
+            throw new Error("NHP reply came from an unexpected server key");
+        }
+        chainHashParts = [...chainHashParts, sealedStatic];
+        const staticShared = trackSecret(secrets, sharedSecret(devicePrivateKey, serverStatic));
+        derived = keyGen2(chainKey, staticShared);
+        secrets.push(...derived);
+        chainKey = derived[0];
+        const timestamp = open(derived[1], nonce, sealedTimestamp, hashParts(chainHashParts));
+        chainHashParts = [...chainHashParts, sealedTimestamp];
+        derived = keyGen2(chainKey, sealedTimestamp);
+        secrets.push(...derived);
+        const bodyKey = derived[1];
+        const bodyAad = hashParts([...chainHashParts, header.subarray(0, HEADER_COMMON_SIZE)]);
+        body =
+            sealedBody.byteLength === 0 ? Buffer.alloc(0) : open(bodyKey, nonce, sealedBody, bodyAad);
+        const preamble = header.readUInt32BE(0);
+        const encodedTypeSize = (preamble ^ header.readUInt32BE(4)) >>> 0;
+        const type = (encodedTypeSize >>> 16) & 0xffff;
+        const flags = header.readUInt16BE(10);
+        validateReplyProfile(type, flags);
+        body = inflateReplyBody(body, flags);
+        if (body.byteLength > NHP_PACKET_SIZE) {
+            throw new Error("NHP reply body exceeds the post-inflate limit");
+        }
+        const returnedBody = body;
+        body = undefined;
+        return {
+            type,
+            flags,
+            counter,
+            timestampNanos: timestamp.readBigUInt64BE(0),
+            body: returnedBody,
+        };
+    }
+    finally {
+        body?.fill(0);
+        wipeBuffers(secrets);
+    }
+}
+function validateReplyProfile(type, flags) {
+    if (![NHP_TYPE_ACK, NHP_TYPE_COOKIE].includes(type) || (flags !== 0 && flags !== FLAG_COMPRESS)) {
+        throw new Error("NHP reply type or flags are outside the reply profile");
+    }
+}
+function inflateReplyBody(body, flags) {
+    if (body.byteLength === 0 || (flags & FLAG_COMPRESS) === 0)
+        return body;
+    try {
+        return inflateSync(body, { maxOutputLength: NHP_PACKET_SIZE });
+    }
+    finally {
+        body.fill(0);
+    }
+}
+function validateKey(key, name) {
+    if (key.byteLength !== 32)
+        throw new Error(`${name} must be 32 bytes`);
+}
+function rawPrivateKey(raw) {
+    const der = Buffer.alloc(X25519_PKCS8_PREFIX.byteLength + raw.byteLength);
+    X25519_PKCS8_PREFIX.copy(der);
+    der.set(raw, X25519_PKCS8_PREFIX.byteLength);
+    try {
+        return createPrivateKey({ key: der, format: "der", type: "pkcs8" });
+    }
+    finally {
+        der.fill(0);
+    }
+}
+function rawPublicKey(raw) {
+    return createPublicKey({
+        key: Buffer.concat([X25519_SPKI_PREFIX, Buffer.from(raw)]),
+        format: "der",
+        type: "spki",
+    });
+}
+function rawPublicFromPrivate(raw) {
+    const spki = createPublicKey(rawPrivateKey(raw)).export({ format: "der", type: "spki" });
+    return spki.subarray(spki.byteLength - 32);
+}
+function sharedSecret(privateValue, publicValue) {
+    return diffieHellman({
+        privateKey: rawPrivateKey(privateValue),
+        publicKey: rawPublicKey(publicValue),
+    });
+}
+function hashParts(parts) {
+    const hash = createHash("blake2s256");
+    for (const part of parts)
+        hash.update(part);
+    return hash.digest();
+}
+function hmac(key, ...parts) {
+    const mac = createHmac("blake2s256", key);
+    for (const part of parts)
+        mac.update(part);
+    return mac.digest();
+}
+function mixKey(key, input) {
+    const prk = hmac(key, input);
+    const mixed = hmac(prk, Uint8Array.of(1));
+    prk.fill(0);
+    return mixed;
+}
+function keyGen2(key, input) {
+    const prk = hmac(key, input);
+    const first = hmac(prk, Uint8Array.of(1));
+    const second = hmac(prk, first, Uint8Array.of(2));
+    prk.fill(0);
+    return [first, second];
+}
+function nonceForCounter(counter) {
+    const nonce = Buffer.alloc(12);
+    nonce.writeBigUInt64BE(counter, 4);
+    return nonce;
+}
+function seal(key, nonce, plaintext, aad) {
+    const cipher = createCipheriv("aes-256-gcm", key, nonce);
+    cipher.setAAD(aad);
+    return Buffer.concat([cipher.update(plaintext), cipher.final(), cipher.getAuthTag()]);
+}
+function open(key, nonce, sealed, aad) {
+    if (sealed.byteLength < 16)
+        throw new Error("NHP sealed field is shorter than its tag");
+    const ciphertext = sealed.subarray(0, sealed.byteLength - 16);
+    const tag = sealed.subarray(sealed.byteLength - 16);
+    const decipher = createDecipheriv("aes-256-gcm", key, nonce);
+    decipher.setAAD(aad);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+}
+function headerDigest(peerStaticPublicKey, header) {
+    return hashParts([INITIAL_HASH, peerStaticPublicKey, header.subarray(0, OFFSET_DIGEST)]);
+}
+function trackSecret(secrets, value) {
+    secrets.push(value);
+    return value;
+}
+function wipeBuffers(values) {
+    for (const value of values)
+        value.fill(0);
+}
+export const nhpWireTesting = { validateReplyProfile, inflateReplyBody };
+//# sourceMappingURL=nhp-wire.js.map

package/dist/esm/node/nhp-wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nhp-wire.js","sourceRoot":"","sources":["../../../src/node/nhp-wire.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAChC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AACjC,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AACnC,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,GAAG,eAAe,GAAG,EAAE,CAAC;AAExE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,CAAC;AAC7B,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,MAAM,CAAC,CAAC;AACpF,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,MAAM,CAAC,CAAC;AACpF,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;AACnF,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAqB1E,MAAM,UAAU,eAAe,CAAC,KAA2B;IAIzD,WAAW,CAAC,KAAK,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;IAC1D,WAAW,CAAC,KAAK,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,iBAAiB;QAC3C,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAE7F,MAAM,mBAAmB,GAAG,KAAK,CAAC,mBAAmB;QACnD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;QACxC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACpB,MAAM,OAAO,GAAiB,CAAC,mBAAmB,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,WAAW,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAC;QAC1D,MAAM,MAAM,GACV,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,MAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,MAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,QAAU,CAAC;QAE/E,MAAM,eAAe,GAAG,oBAAoB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACrE,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC7C,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAElD,IAAI,cAAc,GAAa,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC1F,cAAc,GAAG,CAAC,GAAG,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAC7F,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAEtE,MAAM,eAAe,GAAG,WAAW,CACjC,OAAO,EACP,YAAY,CAAC,mBAAmB,EAAE,KAAK,CAAC,eAAe,CAAC,CACzD,CAAC;QACF,IAAI,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QACzB,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;QACzF,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACzC,cAAc,GAAG,CAAC,GAAG,cAAc,EAAE,YAAY,CAAC,CAAC;QAEnD,MAAM,YAAY,GAAG,WAAW,CAC9B,OAAO,EACP,YAAY,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,eAAe,CAAC,CAC5D,CAAC;QACF,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QACzB,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,SAAS,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAC3C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;QACtF,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC/C,cAAc,GAAG,CAAC,GAAG,cAAc,EAAE,eAAe,CAAC,CAAC;QACtD,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAE3B,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACjF,MAAM,CAAC,aAAa,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/E,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,GAAG,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACvF,MAAM,UAAU,GACd,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5F,YAAY,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAExE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,WAAW,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,gBAA4B,EAC5B,uBAAmC,EACnC,WAAuB;IAEvB,WAAW,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;IACpD,WAAW,CAAC,uBAAuB,EAAE,mBAAmB,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,UAAU,GAAG,eAAe,IAAI,MAAM,CAAC,UAAU,GAAG,eAAe,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,EAAE,CAAC,CAAC;QACjF,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,EAAE,CAAC,CAAC;QACxE,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,EAAE,CAAC,CAAC;QAEjF,IAAI,cAAc,GAAa,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC1F,cAAc,GAAG,CAAC,GAAG,cAAc,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;QACvE,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;QAEnE,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC;QAC9F,IAAI,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QACzB,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,cAAc,GAAG,CAAC,GAAG,cAAc,EAAE,YAAY,CAAC,CAAC;QAEnD,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC;QACxF,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QACzB,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;QACtF,cAAc,GAAG,CAAC,GAAG,cAAc,EAAE,eAAe,CAAC,CAAC;QACtD,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,GAAG,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI;YACF,UAAU,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAE5F,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,eAAe,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,CAAC,eAAe,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACtC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,UAAU,GAAG,eAAe,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC;QAC1B,IAAI,GAAG,SAAS,CAAC;QACjB,OAAO;YACL,IAAI;YACJ,KAAK;YACL,OAAO;YACP,cAAc,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC;YAC5C,IAAI,EAAE,YAAY;SACnB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,WAAW,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,KAAa;IACvD,IAAI,CAAC,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,aAAa,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAa;IACnD,IAAI,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC,CAAC;IACjE,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAe,EAAE,IAAY;IAChD,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,aAAa,CAAC,GAAe;IACpC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1E,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAe;IACnC,OAAO,eAAe,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAe;IAC3C,MAAM,IAAI,GAAG,eAAe,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACzF,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,YAAwB,EAAE,WAAuB;IACrE,OAAO,aAAa,CAAC;QACnB,UAAU,EAAE,aAAa,CAAC,YAAY,CAAC;QACvC,SAAS,EAAE,YAAY,CAAC,WAAW,CAAC;KACrC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAA4B;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,IAAI,CAAC,GAAe,EAAE,GAAG,KAA4B;IAC5D,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,MAAM,CAAC,GAAe,EAAE,KAAiB;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,GAAe,EAAE,KAAiB;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,GAAe,EAAE,KAAiB,EAAE,SAAqB,EAAE,GAAe;IACtF,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,IAAI,CAAC,GAAe,EAAE,KAAiB,EAAE,MAAkB,EAAE,GAAe;IACnF,IAAI,MAAM,CAAC,UAAU,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACxF,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,YAAY,CAAC,mBAA+B,EAAE,MAAkB;IACvE,OAAO,SAAS,CAAC,CAAC,YAAY,EAAE,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,WAAW,CAAuB,OAAqB,EAAE,KAAQ;IACxE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,MAA6B;IAChD,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/esm/node/portal-opener.d.ts

@@ -0,0 +1,115 @@
+import type { NHPMessage } from "./nhp-wire.js";
+import { type PortalDeployment, type ValidatedCell, type ValidatedDeployment } from "./deployment.js";
+import { type NativeExchangeOptions } from "./native-udp.js";
+import { type VerifiedQv2Link } from "./qv2.js";
+export interface CreatePortalOpenerOptions {
+    /** Full qv2t1 qURL. The opener re-verifies it before each native open. */
+    readonly qurl: string;
+    /** Public deployment trust. Omit to load QURL_DEPLOYMENT on the first start. */
+    readonly deployment?: PortalDeployment;
+    /** Whole-operation deadline for each NHP open. The default is 15 seconds. */
+    readonly openTimeoutMs?: number;
+    /** Protected-content fetch implementation. Native NHP opening never uses it. */
+    readonly fetch?: typeof globalThis.fetch;
+}
+export interface PortalStartOptions {
+    readonly signal?: AbortSignal;
+}
+/**
+ * Build one request for the exact target selected by `fetch` or
+ * `fetchDescendant`. The URL is a disposable copy; the opener pins the final
+ * request URL and Host to its SDK-owned target after this function returns.
+ */
+export type PortalRequestBuilder = (authenticatedTarget: URL) => RequestInit;
+export interface PortalFetchOptions {
+    /** Use `error` for signed requests whose method, target, timestamp, and nonce must not be replayed. */
+    readonly redirects?: "follow" | "error";
+}
+export type PortalOpenerState = "new" | "starting" | "ready" | "degraded" | "closed";
+export type PortalOpenerFailureClass = "" | "open_failed" | "target_changed";
+/** Secret-free, nonblocking lifecycle snapshot. */
+export interface PortalOpenerHealth {
+    readonly state: PortalOpenerState;
+    readonly ready: boolean;
+    readonly expiresAt?: Date;
+    readonly renewAt?: Date;
+    readonly lastOpenSucceededAt?: Date;
+    readonly lastFailureClass: PortalOpenerFailureClass;
+    readonly consecutiveFailures: number;
+}
+export interface PortalOpener {
+    /** Open now and schedule renewal before the admission expires. */
+    start(options?: PortalStartOptions): Promise<void>;
+    /** Start a fetch at the exact ACK URL. Same-origin redirects follow only when allowed. */
+    fetch(init?: RequestInit | PortalRequestBuilder, options?: PortalFetchOptions): Promise<Response>;
+    /**
+     * Start a fetch below the ACK URL. Each caller value is one raw path segment;
+     * the opener validates and escapes each segment before use. The ACK target's
+     * query is preserved.
+     */
+    fetchDescendant(pathSegments: readonly string[], init?: RequestInit | PortalRequestBuilder, options?: PortalFetchOptions): Promise<Response>;
+    /** Read local session state. This method does no I/O and exposes no capability. */
+    health(): PortalOpenerHealth;
+    /** Stop renewal and wipe mutable private-key, visitor-secret, and token buffers. */
+    close(): Promise<void>;
+}
+export declare class PortalConfigurationError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+export declare class PortalVerificationError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+export declare class PortalDenyError extends Error {
+    readonly errCode: string;
+    constructor(errCode: string);
+}
+export declare class PortalStateError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+export declare class PortalOpenerNotStartedError extends PortalStateError {
+    constructor();
+}
+export declare class PortalOpenerNotReadyError extends PortalStateError {
+    constructor(options?: ErrorOptions);
+}
+export declare class PortalOpenerClosedError extends PortalStateError {
+    constructor(options?: ErrorOptions);
+}
+export declare class PortalOpenTimeoutError extends PortalStateError {
+    constructor();
+}
+export declare class PortalTargetChangedError extends PortalStateError {
+    constructor();
+}
+export declare class PortalRedirectError extends PortalStateError {
+    constructor(message?: string, options?: ErrorOptions);
+}
+export declare class PortalTooManyRedirectsError extends PortalStateError {
+    constructor();
+}
+export declare class PortalBusyError extends PortalStateError {
+    constructor();
+}
+export declare class PortalInvalidReplyError extends PortalStateError {
+    constructor(message: string, options?: ErrorOptions);
+}
+interface PortalRuntime {
+    readonly knock: (cell: ValidatedCell, key: Uint8Array, body: Uint8Array, options: NativeExchangeOptions) => Promise<NHPMessage>;
+    readonly fetch: typeof globalThis.fetch;
+    readonly nowNanos: () => bigint;
+    readonly nowEpochMs: () => number;
+    readonly setTimer: (callback: () => void, delayMs: number) => NodeJS.Timeout;
+    readonly clearTimer: (timer: NodeJS.Timeout) => void;
+    readonly setDeadlineTimer: (callback: () => void, delayMs: number) => NodeJS.Timeout;
+    readonly clearDeadlineTimer: (timer: NodeJS.Timeout) => void;
+}
+export declare function createPortalOpener(options: CreatePortalOpenerOptions): PortalOpener;
+export declare function createPortalOpenerWithRuntime(options: CreatePortalOpenerOptions, runtime: PortalRuntime): PortalOpener;
+declare function validatedCellForLink(link: VerifiedQv2Link, deployment: ValidatedDeployment): ValidatedCell;
+declare function validateSessionToken(value: string, decode?: (part: string) => Buffer): void;
+export declare const portalOpenerTesting: {
+    validatedCellForLink: typeof validatedCellForLink;
+    validateSessionToken: typeof validateSessionToken;
+};
+export {};
+//# sourceMappingURL=portal-opener.d.ts.map

package/dist/esm/node/portal-opener.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portal-opener.d.ts","sourceRoot":"","sources":["../../../src/node/portal-opener.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAe,KAAK,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE1E,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,UAAU,CAAC;AAiB/D,MAAM,WAAW,yBAAyB;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,gFAAgF;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAC1C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,mBAAmB,EAAE,GAAG,KAAK,WAAW,CAAC;AAE7E,MAAM,WAAW,kBAAkB;IACjC,uGAAuG;IACvG,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CACzC;AAED,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,UAAU,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AAErF,MAAM,MAAM,wBAAwB,GAAG,EAAE,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAE7E,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,wBAAwB,CAAC;IACpD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,KAAK,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,0FAA0F;IAC1F,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,oBAAoB,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClG;;;;OAIG;IACH,eAAe,CACb,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,IAAI,CAAC,EAAE,WAAW,GAAG,oBAAoB,EACzC,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrB,mFAAmF;IACnF,MAAM,IAAI,kBAAkB,CAAC;IAC7B,oFAAoF;IACpF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,EAGlD;CACF;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,EAGlD;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,YAAY,OAAO,EAAE,MAAM,EAI1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,EAGlD;CACF;AAED,qBAAa,2BAA4B,SAAQ,gBAAgB;IAC/D,cAGC;CACF;AAED,qBAAa,yBAA0B,SAAQ,gBAAgB;IAC7D,YAAY,OAAO,CAAC,EAAE,YAAY,EAGjC;CACF;AAED,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,YAAY,OAAO,CAAC,EAAE,YAAY,EAGjC;CACF;AAED,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC1D,cAGC;CACF;AAED,qBAAa,wBAAyB,SAAQ,gBAAgB;IAC5D,cAGC;CACF;AAED,qBAAa,mBAAoB,SAAQ,gBAAgB;IACvD,YAAY,OAAO,SAAuC,EAAE,OAAO,CAAC,EAAE,YAAY,EAGjF;CACF;AAED,qBAAa,2BAA4B,SAAQ,gBAAgB;IAC/D,cAGC;CACF;AAED,qBAAa,eAAgB,SAAQ,gBAAgB;IACnD,cAGC;CACF;AAED,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,EAGlD;CACF;AAED,UAAU,aAAa;IACrB,QAAQ,CAAC,KAAK,EAAE,CACd,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,qBAAqB,KAC3B,OAAO,CAAC,UAAU,CAAC,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,OAAO,CAAC;IAC7E,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACrD,QAAQ,CAAC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,OAAO,CAAC;IACrF,QAAQ,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;CAC9D;AA2BD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,YAAY,CAEnF;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,yBAAyB,EAClC,OAAO,EAAE,aAAa,GACrB,YAAY,CAqBd;AA4tBD,iBAAS,oBAAoB,CAC3B,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,mBAAmB,GAC9B,aAAa,CAWf;AAmDD,iBAAS,oBAAoB,CAC3B,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAiD,GAC1E,IAAI,CA4BN;AAiJD,eAAO,MAAM,mBAAmB;;;CAG/B,CAAC"}