@opendatalabs/personal-server-ts-lite 0.0.1-canary.00328bf

package/dist/relay-tls.js

@@ -0,0 +1,316 @@
+import forge from "node-forge";
+import initRustls, { TlsServer as RustlsServer, } from "./browser-tls-rustls/browser_tls_rustls.js";
+const TLS_IDENTITY_CACHE_KEY = "personal-server-lite-tls-identity-v1";
+const DEFAULT_PUBLIC_SUFFIX = "34.16.49.200.sslip.io";
+const DEFAULT_ISSUE_CERT_TIMEOUT_MS = 60_000;
+let rustlsInitPromise;
+export function createRustlsPsLiteRelayTlsFactory(options) {
+    // Only a trusted relay identity is memoized for the factory's lifetime. A
+    // self-signed fallback must NOT be: it means issuance failed on this attempt
+    // (no issueToken yet, certificate endpoint error/timeout), and locking it in
+    // would strand the tab on an untrusted cert forever — even after a reconnect
+    // delivers a fresh issueToken (BUI-664). The relay factory outlives every
+    // reconnect, so a first-attempt fallback used to pin the whole session to
+    // self-signed. Leaving it unmemoized lets the next prepare/createStream retry
+    // issuance (or hit the persisted certificate cache once it succeeds).
+    let trustedIdentity;
+    let inFlight;
+    let inFlightToken;
+    // Do not create the browser default here: merely composing a relay factory
+    // must remain safe in a native/SSR host that has not injected localStorage.
+    // The default adapter is resolved only when a relay actually prepares TLS.
+    const identityStore = options.identityStore ??
+        (options.storage
+            ? createLocalStoragePsLiteRelayTlsIdentityStore(options.storage)
+            : undefined);
+    async function resolveIdentity(input) {
+        if (trustedIdentity) {
+            return trustedIdentity;
+        }
+        // Coalesce concurrent callers onto one attempt, but clear on settle so a
+        // failed (self-signed) attempt doesn't block the next retry. A caller that
+        // brings a fresh issueToken must NOT join an in-flight attempt made with
+        // different (or no) credentials: that attempt can settle self-signed even
+        // though this caller could mint a trusted cert, and the first strict-TLS
+        // stream after recovery would still get the untrusted identity. Such a
+        // caller starts its own attempt; the superseded one settles harmlessly.
+        const token = input.issueToken ?? "";
+        if (!inFlight || (token && token !== inFlightToken)) {
+            const attempt = createTlsIdentity(input, options, identityStore ?? createLocalStoragePsLiteRelayTlsIdentityStore()).finally(() => {
+                if (inFlight === attempt) {
+                    inFlight = undefined;
+                    inFlightToken = undefined;
+                }
+            });
+            inFlight = attempt;
+            inFlightToken = token;
+        }
+        const identity = await inFlight;
+        if (identity.trusted) {
+            trustedIdentity = identity;
+        }
+        else if (trustedIdentity) {
+            // A concurrent tokened attempt settled trusted while this caller was
+            // awaiting a fallback attempt — serve the trusted identity instead of
+            // handing one last stream a self-signed cert.
+            return trustedIdentity;
+        }
+        else {
+            options.logger?.(`serving self-signed cert for ${identity.hostname}; relay certificate unavailable this attempt, will retry on the next stream/reconnect`);
+        }
+        return identity;
+    }
+    return {
+        async prepare(input) {
+            await resolveIdentity(input);
+        },
+        async createStream(input) {
+            await ensureRustls();
+            const identity = await resolveIdentity(input);
+            const tls = new RustlsServer(identity.certPem, identity.keyPem);
+            return createRustlsStream(tls);
+        },
+    };
+}
+export function psLiteRelayPublicHost(sessionId, publicSuffix = DEFAULT_PUBLIC_SUFFIX) {
+    return `${sessionId}.${publicSuffix.replace(/^\./, "")}`;
+}
+export function psLiteRelayPublicUrl(sessionId, publicSuffix = DEFAULT_PUBLIC_SUFFIX) {
+    return `https://${psLiteRelayPublicHost(sessionId, publicSuffix)}`;
+}
+function createRustlsStream(tls) {
+    return {
+        processTls(payload) {
+            return normalizeTlsStep(tls.process_tls(payload));
+        },
+        writePlaintext(payload, endStream) {
+            return normalizeTlsStep(tls.write_plaintext(payload, endStream));
+        },
+        close() {
+            tls.free();
+        },
+    };
+}
+function ensureRustls() {
+    rustlsInitPromise ??= initRustls();
+    return rustlsInitPromise;
+}
+function normalizeTlsStep(value) {
+    const step = value;
+    return {
+        plaintext: step.plaintext instanceof Uint8Array ? step.plaintext : new Uint8Array(),
+        tls: step.tls instanceof Uint8Array ? step.tls : new Uint8Array(),
+        handshaking: Boolean(step.handshaking),
+    };
+}
+async function createTlsIdentity(input, options, identityStore) {
+    const hostname = psLiteRelayPublicHost(input.sessionId, options.publicSuffix);
+    const cached = await readCachedTlsIdentity(hostname, identityStore);
+    if (cached) {
+        return cached;
+    }
+    // Fetch the relay's shared wildcard cert+key for this session (POST
+    // /session-cert). This replaces per-session ACME: the relay issues one
+    // `*.<suffix>` cert and hands it to every session, so there is no per-session
+    // DNS-01 challenge, no TXT-propagation race, and no Let's Encrypt rate-limit
+    // exposure. The wildcard SAN covers our `<sessionId>.<suffix>` hostname.
+    const wildcard = await requestSessionCertificate({
+        issuerUrl: resolveSessionCertUrl(options),
+        sessionId: input.sessionId,
+        issueToken: input.issueToken ?? "",
+        hostname,
+        identityStore,
+        logger: options.logger,
+        timeoutMs: options.issueCertTimeoutMs ?? DEFAULT_ISSUE_CERT_TIMEOUT_MS,
+    });
+    if (wildcard) {
+        return wildcard;
+    }
+    // Unmemoized self-signed fallback (BUI-664): the relay was unreachable or the
+    // wildcard was unavailable this attempt; retry issuance on the next stream.
+    const keys = await generateKeyPair();
+    const keyPem = forge.pki.privateKeyToPem(keys.privateKey);
+    return createSelfSignedIdentity(hostname, keyPem, keys);
+}
+function generateKeyPair() {
+    return new Promise((resolve, reject) => {
+        forge.pki.rsa.generateKeyPair({ bits: 2048, workers: -1 }, (error, keyPair) => {
+            if (error || !keyPair) {
+                reject(error ?? new Error("failed to generate keypair"));
+                return;
+            }
+            resolve(keyPair);
+        });
+    });
+}
+function createSelfSignedIdentity(hostname, keyPem, keys) {
+    const cert = forge.pki.createCertificate();
+    cert.publicKey = keys.publicKey;
+    cert.serialNumber = Array.from(crypto.getRandomValues(new Uint8Array(12)), (byte) => byte.toString(16).padStart(2, "0")).join("");
+    cert.validity.notBefore = new Date(Date.now() - 60_000);
+    cert.validity.notAfter = new Date(Date.now() + 24 * 60 * 60 * 1000);
+    const attrs = [{ name: "commonName", value: hostname }];
+    cert.setSubject(attrs);
+    cert.setIssuer(attrs);
+    cert.setExtensions([
+        { name: "basicConstraints", cA: false },
+        { name: "keyUsage", digitalSignature: true, keyEncipherment: true },
+        { name: "extKeyUsage", serverAuth: true },
+        {
+            name: "subjectAltName",
+            altNames: [{ type: 2, value: hostname }],
+        },
+    ]);
+    cert.sign(keys.privateKey, forge.md.sha256.create());
+    return {
+        certPem: forge.pki.certificateToPem(cert),
+        keyPem,
+        hostname,
+        source: "self-signed",
+        trusted: false,
+    };
+}
+function issueCertAbortSignal(timeoutMs) {
+    return typeof AbortSignal !== "undefined" &&
+        typeof AbortSignal.timeout === "function"
+        ? AbortSignal.timeout(timeoutMs)
+        : undefined;
+}
+function withIssueCertTimeout(promise, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            reject(new Error(`certificate issuer did not respond within ${timeoutMs}ms`));
+        }, timeoutMs);
+        promise.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+}
+function resolveSessionCertUrl(options) {
+    const base = options.certIssuerUrl
+        ? options.certIssuerUrl.replace(/\/+$/, "").replace(/\/issue-cert$/, "")
+        : (() => {
+            const url = new URL(options.controlUrl);
+            url.protocol = url.protocol === "wss:" ? "https:" : "http:";
+            url.pathname = "";
+            url.search = "";
+            url.hash = "";
+            return url.toString().replace(/\/+$/, "");
+        })();
+    return `${base}/session-cert`;
+}
+/**
+ * Fetch the relay's shared wildcard cert+key for this browser session. Unlike
+ * the per-session ACME path, the relay already holds the cert, so this is a
+ * fast lookup with no DNS challenge. Returns undefined (self-signed fallback)
+ * on any failure.
+ */
+async function requestSessionCertificate(input) {
+    if (!input.issueToken) {
+        input.logger?.("session issue token unavailable; using self-signed certificate");
+        return undefined;
+    }
+    try {
+        return await withIssueCertTimeout(fetchSessionCert(input), input.timeoutMs);
+    }
+    catch (error) {
+        input.logger?.(error instanceof Error ? error.message : String(error));
+        input.logger?.("session certificate request failed; using self-signed certificate");
+        return undefined;
+    }
+}
+async function fetchSessionCert(input) {
+    const response = await fetch(input.issuerUrl, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+            sessionId: input.sessionId,
+            issueToken: input.issueToken,
+        }),
+        signal: issueCertAbortSignal(input.timeoutMs),
+    });
+    if (!response.ok) {
+        const detail = await response.text();
+        input.logger?.(`session-cert unavailable (${response.status}); using self-signed certificate`);
+        input.logger?.(detail.slice(0, 240));
+        return undefined;
+    }
+    const payload = (await response.json());
+    if (!payload.certPem || !payload.keyPem) {
+        input.logger?.("session-cert returned no certificate; using self-signed certificate");
+        return undefined;
+    }
+    const identity = {
+        certPem: payload.certPem,
+        keyPem: payload.keyPem,
+        hostname: input.hostname,
+        source: "acme",
+        trusted: true,
+    };
+    try {
+        await cacheTlsIdentity(identity, input.identityStore);
+    }
+    catch (error) {
+        input.logger?.(`failed to persist session certificate (${error instanceof Error ? error.message : String(error)}); continuing with the in-memory identity`);
+    }
+    return identity;
+}
+/**
+ * Browser default relay TLS identity store: persists the issued cert in
+ * `localStorage`, matching PS Lite's pre-injection behavior byte for byte. This
+ * is the one place the relay TLS path is allowed to touch a browser global; the
+ * resolution logic above goes through the injected {@link PsLiteRelayTlsIdentityStore}.
+ */
+export function createLocalStoragePsLiteRelayTlsIdentityStore(storage = globalThis.localStorage) {
+    return {
+        read(hostname) {
+            const raw = storage.getItem(`${TLS_IDENTITY_CACHE_KEY}:${hostname}`);
+            return raw ? JSON.parse(raw) : null;
+        },
+        write(identity) {
+            storage.setItem(`${TLS_IDENTITY_CACHE_KEY}:${identity.hostname}`, JSON.stringify(identity));
+        },
+    };
+}
+async function readCachedTlsIdentity(hostname, identityStore) {
+    try {
+        const identity = await identityStore.read(hostname);
+        if (!identity ||
+            identity.hostname !== hostname ||
+            !identity.certPem ||
+            !identity.keyPem ||
+            identity.source !== "acme") {
+            return undefined;
+        }
+        const notAfter = firstCertificateNotAfter(identity.certPem);
+        if (notAfter.getTime() - Date.now() < 24 * 60 * 60 * 1000) {
+            return undefined;
+        }
+        return {
+            ...identity,
+            source: "cached-acme",
+            trusted: true,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+async function cacheTlsIdentity(identity, identityStore) {
+    if (identity.source !== "acme") {
+        return;
+    }
+    await identityStore.write(identity);
+}
+function firstCertificateNotAfter(certPem) {
+    const match = certPem.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/);
+    if (!match) {
+        return new Date(0);
+    }
+    return forge.pki.certificateFromPem(match[0]).validity.notAfter;
+}
+//# sourceMappingURL=relay-tls.js.map

package/dist/relay-tls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-tls.js","sourceRoot":"","sources":["../src/relay-tls.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,UAAU,EAAE,EACjB,SAAS,IAAI,YAAY,GAC1B,MAAM,4CAA4C,CAAC;AASpD,MAAM,sBAAsB,GAAG,sCAAsC,CAAC;AACtE,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AACtD,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAwD7C,IAAI,iBAA+C,CAAC;AAEpD,MAAM,UAAU,iCAAiC,CAC/C,OAAoC;IAEpC,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,sEAAsE;IACtE,IAAI,eAAmD,CAAC;IACxD,IAAI,QAAqD,CAAC;IAC1D,IAAI,aAAiC,CAAC;IACtC,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa;QACrB,CAAC,OAAO,CAAC,OAAO;YACd,CAAC,CAAC,6CAA6C,CAAC,OAAO,CAAC,OAAO,CAAC;YAChE,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,KAAK,UAAU,eAAe,CAC5B,KAAiC;QAEjC,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,aAAa,CAAC,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,iBAAiB,CAC/B,KAAK,EACL,OAAO,EACP,aAAa,IAAI,6CAA6C,EAAE,CACjE,CAAC,OAAO,CAAC,GAAG,EAAE;gBACb,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;oBACzB,QAAQ,GAAG,SAAS,CAAC;oBACrB,aAAa,GAAG,SAAS,CAAC;gBAC5B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,QAAQ,GAAG,OAAO,CAAC;YACnB,aAAa,GAAG,KAAK,CAAC;QACxB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC;QAChC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,eAAe,GAAG,QAAQ,CAAC;QAC7B,CAAC;aAAM,IAAI,eAAe,EAAE,CAAC;YAC3B,qEAAqE;YACrE,sEAAsE;YACtE,8CAA8C;YAC9C,OAAO,eAAe,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,EAAE,CACd,gCAAgC,QAAQ,CAAC,QAAQ,uFAAuF,CACzI,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,KAAiC;YAC7C,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,KAAgC;YACjD,MAAM,YAAY,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChE,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,SAAiB,EACjB,YAAY,GAAG,qBAAqB;IAEpC,OAAO,GAAG,SAAS,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,SAAiB,EACjB,YAAY,GAAG,qBAAqB;IAEpC,OAAO,WAAW,qBAAqB,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAiB;IAC3C,OAAO;QACL,UAAU,CAAC,OAAO;YAChB,OAAO,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,cAAc,CAAC,OAAO,EAAE,SAAS;YAC/B,OAAO,gBAAgB,CAAC,GAAG,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,KAAK;YACH,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,iBAAiB,KAAK,UAAU,EAAE,CAAC;IACnC,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,MAAM,IAAI,GAAG,KAAoC,CAAC;IAClD,OAAO;QACL,SAAS,EACP,IAAI,CAAC,SAAS,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE;QAC1E,GAAG,EAAE,IAAI,CAAC,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE;QACjE,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAiC,EACjC,OAAoC,EACpC,aAA0C;IAE1C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACpE,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,8EAA8E;IAC9E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC;QAC/C,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACzC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE;QAClC,QAAQ;QACR,aAAa;QACb,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,kBAAkB,IAAI,6BAA6B;KACvE,CAAC,CAAC;IACH,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,MAAM,IAAI,GAAG,MAAM,eAAe,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1D,OAAO,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAC3B,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAC3B,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACjB,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACtB,MAAM,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;gBACzD,OAAO;YACT,CAAC;YACD,OAAO,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,wBAAwB,CAC/B,QAAgB,EAChB,MAAc,EACd,IAA2B;IAE3B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;IAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,IAAI,CAC5B,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,EAC1C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAC7C,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACvB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtB,IAAI,CAAC,aAAa,CAAC;QACjB,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,KAAK,EAAE;QACvC,EAAE,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;QACnE,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE;QACzC;YACE,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;SACzC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAErD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC;QACzC,MAAM;QACN,QAAQ;QACR,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB;IAC7C,OAAO,OAAO,WAAW,KAAK,WAAW;QACvC,OAAO,WAAW,CAAC,OAAO,KAAK,UAAU;QACzC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;QAChC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAmB,EACnB,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CACJ,IAAI,KAAK,CAAC,6CAA6C,SAAS,IAAI,CAAC,CACtE,CAAC;QACJ,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAoC;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa;QAChC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;QACxE,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACxC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5D,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;YACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,GAAG,IAAI,eAAe,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,yBAAyB,CAAC,KAQxC;IACC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACtB,KAAK,CAAC,MAAM,EAAE,CACZ,gEAAgE,CACjE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,MAAM,EAAE,CACZ,mEAAmE,CACpE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,KAQ/B;IACC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC;QACF,MAAM,EAAE,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;KAC9C,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACrC,KAAK,CAAC,MAAM,EAAE,CACZ,6BAA6B,QAAQ,CAAC,MAAM,kCAAkC,CAC/E,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGrC,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACxC,KAAK,CAAC,MAAM,EAAE,CACZ,qEAAqE,CACtE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAA2B;QACvC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,IAAI;KACd,CAAC;IACF,IAAI,CAAC;QACH,MAAM,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,MAAM,EAAE,CACZ,0CAA0C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAC5I,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6CAA6C,CAC3D,UAAmB,UAAU,CAAC,YAAY;IAE1C,OAAO;QACL,IAAI,CAAC,QAAQ;YACX,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,sBAAsB,IAAI,QAAQ,EAAE,CAAC,CAAC;YACrE,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,OAAO,CAAC,OAAO,CACb,GAAG,sBAAsB,IAAI,QAAQ,CAAC,QAAQ,EAAE,EAChD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CACzB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,QAAgB,EAChB,aAA0C;IAE1C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpD,IACE,CAAC,QAAQ;YACT,QAAQ,CAAC,QAAQ,KAAK,QAAQ;YAC9B,CAAC,QAAQ,CAAC,OAAO;YACjB,CAAC,QAAQ,CAAC,MAAM;YAChB,QAAQ,CAAC,MAAM,KAAK,MAAM,EAC1B,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,QAAQ,GAAG,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAC1D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,GAAG,QAAQ;YACX,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAgC,EAChC,aAA0C;IAE1C,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IACD,MAAM,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CACzB,8DAA8D,CAC/D,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAClE,CAAC"}

package/dist/relay.d.ts

@@ -0,0 +1,149 @@
+import type { PersonalServerReadFulfillmentReporter } from "@opendatalabs/personal-server-ts-core/api";
+import { type PsLiteBridgeResponse } from "./bridge.js";
+import type { PsLiteRelayTlsIdentityStore } from "./relay-tls.js";
+import type { PsLiteRuntime } from "./runtime.js";
+export interface PsLiteRelayClientOptions {
+    sessionId: string;
+    runtime: PsLiteRuntime;
+    controlUrl?: string;
+    publicSuffix?: string;
+    certIssuerUrl?: string;
+    origin?: string;
+    webSocketFactory?: PsLiteRelayWebSocketFactory;
+    tls?: PsLiteRelayTlsFactory | false;
+    /** Host-owned cache for the issued relay certificate identity. */
+    tlsIdentityStore?: PsLiteRelayTlsIdentityStore;
+    logger?: (line: string) => void;
+    onStatus?: (status: PsLiteRelayStatus, detail?: PsLiteRelayStatusDetail) => void;
+    /** Heartbeat ping cadence (ms). Default 20_000. */
+    heartbeatIntervalMs?: number;
+    /**
+     * Force-reconnect when a ping the client actually sent goes unanswered by
+     * ANY relay frame for this long, measured by wall clock (ms). Default 45_000.
+     */
+    heartbeatTimeoutMs?: number;
+    /** First reconnect backoff delay (ms); doubles up to the max. Default 1_000. */
+    reconnectInitialDelayMs?: number;
+    /** Max reconnect backoff delay (ms). Default 30_000. */
+    reconnectMaxDelayMs?: number;
+}
+export type PsLiteRelayStatus = "connecting" | "connected" | "disconnected" | "closed" | "replaced" | "error";
+/**
+ * Extra context for a relay status transition — the WebSocket close code/reason
+ * on `disconnected` / `closed` / `replaced`. Lets consumers distinguish an
+ * abnormal drop (1006) from a takeover (1012) or a clean close (1000) for
+ * reliability telemetry. Optional and additive: 1-arg `onStatus` handlers stay
+ * valid.
+ */
+export interface PsLiteRelayStatusDetail {
+    code?: number;
+    reason?: string;
+}
+/**
+ * Close code the relay sends to the losing side when a new connection claims
+ * the same sessionId. Terminal for this client: reconnecting would evict the
+ * winner right back and the two tabs would trade the session every backoff
+ * tick (observed live as a 1012 eviction loop every ~2s with two app tabs).
+ */
+export declare const RELAY_CLOSE_SESSION_REPLACED = 1012;
+export interface PsLiteRelayClient {
+    readonly sessionId: string;
+    readonly url: string;
+    close(reason?: string): void;
+    /**
+     * Resolves once the relay has finished delivering everything in flight: no
+     * HTTP streams open and the socket's send buffer empty. A non-OPEN socket
+     * counts as drained (its buffered bytes died with it and reconnect starts
+     * from a clean slate). Resolves after `timeoutMs` regardless, so callers can
+     * never deadlock on a wedged tunnel.
+     */
+    whenDrained(options?: {
+        /** Max time to wait before resolving anyway (ms). Default 20_000. */
+        timeoutMs?: number;
+        /** Drain-state poll cadence (ms). Default 50. */
+        pollIntervalMs?: number;
+    }): Promise<void>;
+}
+export interface PsLiteRelayWebSocketFactory {
+    (url: string): PsLiteRelayWebSocket;
+}
+/**
+ * Subset of the standard CloseEvent the relay client reads. Browser
+ * WebSockets pass a full CloseEvent here; fakes may call onclose with
+ * nothing (treated as an abnormal close).
+ */
+export interface PsLiteRelayCloseEvent {
+    code?: number;
+    reason?: string;
+}
+export interface PsLiteRelayWebSocket {
+    binaryType: string;
+    readonly readyState: number;
+    readonly OPEN: number;
+    readonly CONNECTING: number;
+    /**
+     * Bytes accepted by send() but not yet flushed to the network (standard
+     * WebSocket.bufferedAmount). Optional so lightweight fakes can omit it;
+     * treated as 0 when absent.
+     */
+    readonly bufferedAmount?: number;
+    onopen: (() => void) | null;
+    onmessage: ((event: {
+        data: string | ArrayBuffer | Uint8Array;
+    }) => void) | null;
+    onclose: ((event?: PsLiteRelayCloseEvent) => void) | null;
+    onerror: (() => void) | null;
+    send(data: string | Uint8Array): void;
+    close(code?: number, reason?: string): void;
+}
+export interface PsLiteRelayTlsFactory {
+    prepare?(input: PsLiteRelayTlsPrepareInput): Promise<void>;
+    createStream(input: PsLiteRelayTlsStreamInput): Promise<PsLiteRelayTlsStream>;
+}
+export interface PsLiteRelayTlsPrepareInput {
+    sessionId: string;
+    issueToken?: string;
+}
+export interface PsLiteRelayTlsStreamInput {
+    sessionId: string;
+    streamId: number;
+    issueToken?: string;
+}
+export interface PsLiteRelayTlsStream {
+    processTls(payload: Uint8Array): PsLiteRelayTlsStep;
+    writePlaintext(payload: Uint8Array, endStream: boolean): PsLiteRelayTlsStep;
+    close?(): void;
+}
+export interface PsLiteRelayTlsStep {
+    plaintext: Uint8Array;
+    tls: Uint8Array;
+    handshaking?: boolean;
+}
+export declare function psLiteRelayControlUrl(sessionId: string, controlUrl?: string): string;
+export declare function psLiteRelayPublicUrl(sessionId: string, publicSuffix?: string): string;
+/**
+ * Defers read-fulfillment reports until the relay has delivered the in-flight
+ * response. The core data handler reports fulfillment as soon as it BUILDS the
+ * response, but over the relay the (potentially multi-MB) body still has to be
+ * pumped through TLS over the WebSocket. Consumers act on the report
+ * immediately — the DCR approval page closes the tab hosting this PS — so an
+ * eager report kills the tunnel mid-transfer and the builder gets a truncated
+ * body (UND_ERR_RES_CONTENT_LENGTH_MISMATCH) after escrow already settled.
+ * Gating the report on relay drain makes "fulfilled" mean "delivered".
+ *
+ * `getRelayClient` is late-bound: the runtime needs the reporter at
+ * construction time, before the relay client exists. When it returns
+ * undefined (relay disabled / not started yet), reports pass straight through.
+ */
+export declare function createRelayDrainGatedReadFulfillmentReporter(reporter: PersonalServerReadFulfillmentReporter, getRelayClient: () => Pick<PsLiteRelayClient, "whenDrained"> | undefined): PersonalServerReadFulfillmentReporter;
+export declare function startPsLiteRelayClient(options: PsLiteRelayClientOptions): PsLiteRelayClient;
+export declare function buildHttpResponse(response: PsLiteBridgeResponse, opts?: {
+    bodyOverride?: Uint8Array;
+    contentEncoding?: string;
+}): string;
+export declare function encodeDataFrame(streamId: number, payload: Uint8Array): Uint8Array;
+export declare function decodeDataFrame(data: string | ArrayBuffer | Uint8Array): {
+    streamId: number;
+    payload: Uint8Array;
+} | null;
+//# sourceMappingURL=relay.d.ts.map

package/dist/relay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay.d.ts","sourceRoot":"","sources":["../src/relay.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AASlD,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;IAC/C,GAAG,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAC;IACpC,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;IAC/C,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,QAAQ,CAAC,EAAE,CACT,MAAM,EAAE,iBAAiB,EACzB,MAAM,CAAC,EAAE,uBAAuB,KAC7B,IAAI,CAAC;IACV,mDAAmD;IACnD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wDAAwD;IACxD,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,iBAAiB,GAC3B,YAAY,GAAG,WAAW,GAAG,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC;AAEhF;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAUjD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,OAAO,CAAC,EAAE;QACpB,qEAAqE;QACrE,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iDAAiD;QACjD,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,SAAS,EACP,CAAC,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,UAAU,CAAA;KAAE,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACxE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,qBAAqB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1D,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7C;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,YAAY,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,OAAO,EAAE,UAAU,GAAG,kBAAkB,CAAC;IACpD,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,GAAG,kBAAkB,CAAC;IAC5E,KAAK,CAAC,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,UAAU,CAAC;IACtB,GAAG,EAAE,UAAU,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAuBD,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,UAAU,SAAsB,GAC/B,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,YAAY,SAAwB,GACnC,MAAM,CAER;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4CAA4C,CAC1D,QAAQ,EAAE,qCAAqC,EAC/C,cAAc,EAAE,MAAM,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAC,GAAG,SAAS,GACvE,qCAAqC,CAOvC;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,wBAAwB,GAChC,iBAAiB,CA2ZnB;AA+ED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,oBAAoB,EAC9B,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,UAAU,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7D,MAAM,CA+BR;AAeD,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,UAAU,GAClB,UAAU,CAMZ;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,UAAU,GACtC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,GAAG,IAAI,CAclD"}