@scalebun/cli 1.13.0 → 2.0.1

package/lib/utils/signing.js

@@ -0,0 +1,171 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.spkiFingerprint = spkiFingerprint;
+exports.inspectPublicKey = inspectPublicKey;
+exports.generateRsaKeyPair = generateRsaKeyPair;
+exports.signReleasePayload = signReleasePayload;
+exports.buildReleaseEnvelope = buildReleaseEnvelope;
+/**
+ * RSA-3072 / SHA-256 release signing for SB-OTA-RSA-SHA256-V1.
+ *
+ * Security model (unchanged in spirit from the ed25519 era, stronger in fact):
+ * the private key is generated on the developer's machine and NEVER leaves it —
+ * only the SPKI public key is registered, and only the detached signature +
+ * signed payload are uploaded. A server that cannot sign cannot forge a release.
+ *
+ * The signed object is the exact binary ScaleBunSignedReleaseV1 payload (see the
+ * vendored codec + docs/ota/SB-OTA-RSA-SHA256-V1.md). We sign those bytes and
+ * immediately self-verify with the derived public key before returning, so a
+ * broken key or a codec regression fails here rather than on a user's device.
+ */
+const crypto = __importStar(require("crypto"));
+const ota_protocol_1 = require("../vendor/ota-protocol");
+function modulusBits(key) {
+    const bits = key.asymmetricKeyDetails?.modulusLength;
+    if (typeof bits !== 'number') {
+        throw new Error('key has no RSA modulus length — not an RSA key?');
+    }
+    return bits;
+}
+/** SHA-256 fingerprint over the SPKI DER of a public key. */
+function spkiFingerprint(publicKey) {
+    const der = publicKey.export({ type: 'spki', format: 'der' });
+    const hex = crypto.createHash('sha256').update(der).digest('hex');
+    const display = (hex.match(/.{2}/g) ?? []).join(':').toUpperCase();
+    return { hex, display };
+}
+/**
+ * Validate that a public key is RSA of an acceptable size and describe it.
+ * Throws on non-RSA keys or a modulus below {@link MIN_RSA_MODULUS_BITS}.
+ */
+function inspectPublicKey(pem) {
+    let key;
+    try {
+        key = crypto.createPublicKey(pem);
+    }
+    catch (err) {
+        throw new Error(`not a valid public key: ${err?.message ?? err}`);
+    }
+    if (key.asymmetricKeyType !== 'rsa') {
+        throw new Error(`unsupported key type "${key.asymmetricKeyType}" — SB-OTA-RSA-SHA256-V1 requires RSA`);
+    }
+    const bits = modulusBits(key);
+    if (bits < ota_protocol_1.MIN_RSA_MODULUS_BITS) {
+        throw new Error(`RSA modulus ${bits} bits is below the ${ota_protocol_1.MIN_RSA_MODULUS_BITS}-bit minimum`);
+    }
+    const fp = spkiFingerprint(key);
+    return {
+        algorithm: 'RSA_SHA256',
+        modulusBits: bits,
+        fingerprint: fp.hex,
+        fingerprintDisplay: fp.display,
+        spkiPem: key.export({ type: 'spki', format: 'pem' }),
+    };
+}
+/**
+ * Generate a fresh RSA keypair (default 3072-bit). The private key is exported as
+ * PKCS#8 PEM (encrypted when a passphrase is supplied); the public key as SPKI
+ * PEM. This function never writes to disk or prints the private key — callers own
+ * storage + permissions.
+ */
+function generateRsaKeyPair(opts) {
+    const bits = opts?.modulusBits ?? ota_protocol_1.RECOMMENDED_RSA_MODULUS_BITS;
+    if (bits < ota_protocol_1.MIN_RSA_MODULUS_BITS) {
+        throw new Error(`refusing to generate a ${bits}-bit key; minimum is ${ota_protocol_1.MIN_RSA_MODULUS_BITS}`);
+    }
+    const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', { modulusLength: bits });
+    const privatePem = (opts?.passphrase
+        ? privateKey.export({
+            type: 'pkcs8',
+            format: 'pem',
+            cipher: 'aes-256-cbc',
+            passphrase: opts.passphrase,
+        })
+        : privateKey.export({ type: 'pkcs8', format: 'pem' }));
+    const publicPem = publicKey.export({ type: 'spki', format: 'pem' });
+    return { privatePem, publicPem, info: inspectPublicKey(publicPem) };
+}
+function loadRsaPrivateKey(pem, passphrase) {
+    let key;
+    try {
+        key = crypto.createPrivateKey(passphrase ? { key: pem, passphrase } : pem);
+    }
+    catch (err) {
+        throw new Error(`could not load private key: ${err?.message ?? err}`);
+    }
+    if (key.asymmetricKeyType !== 'rsa') {
+        throw new Error(`private key is ${key.asymmetricKeyType}, not RSA`);
+    }
+    if (modulusBits(key) < ota_protocol_1.MIN_RSA_MODULUS_BITS) {
+        throw new Error(`private key modulus below ${ota_protocol_1.MIN_RSA_MODULUS_BITS} bits`);
+    }
+    return key;
+}
+/**
+ * Serialize + RSA-SHA256 sign a release payload, then self-verify. Throws if the
+ * payload is invalid (codec validation), the key is not usable RSA, or the
+ * self-verify fails.
+ */
+function signReleasePayload(payload, privateKeyPem, passphrase) {
+    const bytes = (0, ota_protocol_1.serializeSignedRelease)(payload);
+    const privateKey = loadRsaPrivateKey(privateKeyPem, passphrase);
+    const signature = crypto.sign('sha256', Buffer.from(bytes), privateKey);
+    // Self-check with the derived public key — the same check the backend runs
+    // after signing (PROMPT §7.9). A failure here means we would have shipped an
+    // unverifiable release.
+    const publicKey = crypto.createPublicKey(privateKey);
+    if (!crypto.verify('sha256', Buffer.from(bytes), publicKey, signature)) {
+        throw new Error('self-verify failed: produced signature does not verify with its own public key');
+    }
+    return {
+        signedPayload: (0, ota_protocol_1.encodeBase64)(bytes),
+        signature: signature.toString('base64'),
+        payloadBytes: bytes,
+    };
+}
+/** Build the full transport envelope (docs §4) around a signed payload. */
+function buildReleaseEnvelope(payload, privateKeyPem, opts) {
+    const signed = signReleasePayload(payload, privateKeyPem, opts?.passphrase);
+    return {
+        protocol: ota_protocol_1.SIGNATURE_ALGORITHM,
+        keyId: payload.keyId,
+        signedPayload: signed.signedPayload,
+        signature: signed.signature,
+        downloadUrl: opts?.downloadUrl,
+        displayMetadata: opts?.displayMetadata,
+    };
+}
+//# sourceMappingURL=signing.js.map

package/lib/utils/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/utils/signing.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,0CAKC;AAMD,4CAsBC;AAcD,gDAqBC;AAgCD,gDAoBC;AAGD,oDAcC;AApLD;;;;;;;;;;;;GAYG;AACH,+CAAiC;AACjC,yDAQgC;AAYhC,SAAS,WAAW,CAAC,GAAqB;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,oBAAoB,EAAE,aAAa,CAAC;IACrD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6DAA6D;AAC7D,SAAgB,eAAe,CAAC,SAA2B;IACzD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IACxE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACnE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,GAAoB;IACnD,IAAI,GAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,GAAG,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,iBAAiB,uCAAuC,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,GAAG,mCAAoB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,sBAAsB,mCAAoB,cAAc,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO;QACL,SAAS,EAAE,YAAY;QACvB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,EAAE,CAAC,GAAG;QACnB,kBAAkB,EAAE,EAAE,CAAC,OAAO;QAC9B,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW;KAC/D,CAAC;AACJ,CAAC;AAQD;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,IAGlC;IACC,MAAM,IAAI,GAAG,IAAI,EAAE,WAAW,IAAI,2CAA4B,CAAC;IAC/D,IAAI,IAAI,GAAG,mCAAoB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,wBAAwB,mCAAoB,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,CACjB,IAAI,EAAE,UAAU;QACd,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;YAChB,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;QACJ,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAC9C,CAAC;IACZ,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IAC9E,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;AACtE,CAAC;AAWD,SAAS,iBAAiB,CAAC,GAAoB,EAAE,UAAmB;IAClE,IAAI,GAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,GAAG,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,iBAAiB,WAAW,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,mCAAoB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,6BAA6B,mCAAoB,OAAO,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAChC,OAAgC,EAChC,aAA8B,EAC9B,UAAmB;IAEnB,MAAM,KAAK,GAAG,IAAA,qCAAsB,EAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,iBAAiB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;IACxE,2EAA2E;IAC3E,6EAA6E;IAC7E,wBAAwB;IACxB,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;IACD,OAAO;QACL,aAAa,EAAE,IAAA,2BAAY,EAAC,KAAK,CAAC;QAClC,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvC,YAAY,EAAE,KAAK;KACpB,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAgB,oBAAoB,CAClC,OAAgC,EAChC,aAA8B,EAC9B,IAA+F;IAE/F,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAC5E,OAAO;QACL,QAAQ,EAAE,kCAAmB;QAC7B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,IAAI,EAAE,WAAW;QAC9B,eAAe,EAAE,IAAI,EAAE,eAAe;KACvC,CAAC;AACJ,CAAC"}

package/lib/vendor/ota-protocol/base64.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Standard Base64 for the transport envelope (docs §4).
+ *
+ * Decoding is STRICT and canonical: only the standard alphabet, correct padding,
+ * length a multiple of 4, and — crucially — the decode→re-encode round trip must
+ * reproduce the input exactly. That last check rejects "alternative encodings"
+ * (non-zero unused trailing bits), which is a protocol requirement.
+ */
+export declare function encodeBase64(bytes: Uint8Array): string;
+export declare function decodeBase64Strict(value: string, maxBytes: number, what?: string): Uint8Array;
+//# sourceMappingURL=base64.d.ts.map

package/lib/vendor/ota-protocol/base64.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64.d.ts","sourceRoot":"","sources":["../../../src/vendor/ota-protocol/base64.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEtD;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,SAAW,GACd,UAAU,CAoBZ"}

package/lib/vendor/ota-protocol/base64.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * Standard Base64 for the transport envelope (docs §4).
+ *
+ * Decoding is STRICT and canonical: only the standard alphabet, correct padding,
+ * length a multiple of 4, and — crucially — the decode→re-encode round trip must
+ * reproduce the input exactly. That last check rejects "alternative encodings"
+ * (non-zero unused trailing bits), which is a protocol requirement.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encodeBase64 = encodeBase64;
+exports.decodeBase64Strict = decodeBase64Strict;
+const types_1 = require("./types");
+const STD_B64 = /^[A-Za-z0-9+/]*={0,2}$/;
+function encodeBase64(bytes) {
+    return Buffer.from(bytes).toString('base64');
+}
+function decodeBase64Strict(value, maxBytes, what = 'base64') {
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new types_1.OtaProtocolError('INVALID_BASE64', `${what}: empty or not a string`);
+    }
+    // Reject oversized inputs before allocating (a base64 char is ~0.75 bytes).
+    if (value.length > Math.ceil((maxBytes * 4) / 3) + 4) {
+        throw new types_1.OtaProtocolError('INVALID_BASE64', `${what}: exceeds size limit`);
+    }
+    if (value.length % 4 !== 0 || !STD_B64.test(value)) {
+        throw new types_1.OtaProtocolError('INVALID_BASE64', `${what}: not canonical standard base64`);
+    }
+    const decoded = Buffer.from(value, 'base64');
+    // Buffer.from is lenient; enforce canonical form by re-encoding.
+    if (decoded.toString('base64') !== value) {
+        throw new types_1.OtaProtocolError('INVALID_BASE64', `${what}: non-canonical base64`);
+    }
+    if (decoded.length > maxBytes) {
+        throw new types_1.OtaProtocolError('INVALID_BASE64', `${what}: decoded size exceeds limit`);
+    }
+    return new Uint8Array(decoded);
+}
+//# sourceMappingURL=base64.js.map

package/lib/vendor/ota-protocol/base64.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64.js","sourceRoot":"","sources":["../../../src/vendor/ota-protocol/base64.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAMH,oCAEC;AAED,gDAwBC;AAhCD,mCAA2C;AAE3C,MAAM,OAAO,GAAG,wBAAwB,CAAC;AAEzC,SAAgB,YAAY,CAAC,KAAiB;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,SAAgB,kBAAkB,CAChC,KAAa,EACb,QAAgB,EAChB,IAAI,GAAG,QAAQ;IAEf,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,wBAAgB,CAAC,gBAAgB,EAAE,GAAG,IAAI,yBAAyB,CAAC,CAAC;IACjF,CAAC;IACD,4EAA4E;IAC5E,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,wBAAgB,CAAC,gBAAgB,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,wBAAgB,CAAC,gBAAgB,EAAE,GAAG,IAAI,iCAAiC,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,iEAAiE;IACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAgB,CAAC,gBAAgB,EAAE,GAAG,IAAI,wBAAwB,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,wBAAgB,CAAC,gBAAgB,EAAE,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC"}

package/lib/vendor/ota-protocol/codec.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Byte-exact serializer + bounds-checked parser for the ScaleBunSignedReleaseV1
+ * binary payload. This is the TypeScript REFERENCE implementation; the Kotlin and
+ * Swift verifiers and the backend must match it byte-for-byte against the
+ * committed fixtures. See docs/ota/SB-OTA-RSA-SHA256-V1.md.
+ *
+ * The signature is computed/verified over the exact bytes produced by
+ * {@link serializeSignedRelease}; verifiers must NOT re-serialize a parsed struct.
+ */
+import { ScaleBunSignedReleaseV1 } from './types';
+/** Serialize a signed release, validating every field and the overall limits. */
+export declare function serializeSignedRelease(p: ScaleBunSignedReleaseV1): Uint8Array;
+/**
+ * Parse + fully validate a signed payload. Throws {@link OtaProtocolError} with a
+ * stable code on any structural, enum, range, or consistency violation, on
+ * invalid UTF-8, on an oversized length prefix, and on trailing bytes.
+ */
+export declare function parseSignedRelease(bytes: Uint8Array): ScaleBunSignedReleaseV1;
+/**
+ * Parse ONLY enough of the payload to extract `keyId` (docs §5 step 4/5), so a
+ * verifier can resolve the trusted key before spending an RSA verify. Still fully
+ * bounds-checked. The returned keyId is NOT authenticated until the signature is
+ * verified over the whole payload.
+ */
+export declare function peekKeyId(bytes: Uint8Array): string;
+//# sourceMappingURL=codec.d.ts.map

package/lib/vendor/ota-protocol/codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec.d.ts","sourceRoot":"","sources":["../../../src/vendor/ota-protocol/codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAcH,OAAO,EAAoB,uBAAuB,EAAgC,MAAM,SAAS,CAAC;AAqElG,iFAAiF;AACjF,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,uBAAuB,GAAG,UAAU,CAwE7E;AAgED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,uBAAuB,CAkH7E;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAmBnD"}

package/lib/vendor/ota-protocol/codec.js

@@ -0,0 +1,349 @@
+"use strict";
+/**
+ * Byte-exact serializer + bounds-checked parser for the ScaleBunSignedReleaseV1
+ * binary payload. This is the TypeScript REFERENCE implementation; the Kotlin and
+ * Swift verifiers and the backend must match it byte-for-byte against the
+ * committed fixtures. See docs/ota/SB-OTA-RSA-SHA256-V1.md.
+ *
+ * The signature is computed/verified over the exact bytes produced by
+ * {@link serializeSignedRelease}; verifiers must NOT re-serialize a parsed struct.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serializeSignedRelease = serializeSignedRelease;
+exports.parseSignedRelease = parseSignedRelease;
+exports.peekKeyId = peekKeyId;
+const limits_1 = require("./limits");
+const types_1 = require("./types");
+const hex_1 = require("./hex");
+const utf8Encoder = new TextEncoder();
+const utf8DecoderFatal = new TextDecoder('utf-8', { fatal: true });
+// ─── serialize ──────────────────────────────────────────────────────────────
+class ByteWriter {
+    constructor() {
+        this.out = [];
+    }
+    u16(n) {
+        this.out.push((n >>> 8) & 0xff, n & 0xff);
+    }
+    u32(n) {
+        this.out.push((n >>> 24) & 0xff, (n >>> 16) & 0xff, (n >>> 8) & 0xff, n & 0xff);
+    }
+    u64(n) {
+        let big = BigInt(n);
+        const bytes = new Array(8);
+        for (let i = 7; i >= 0; i--) {
+            bytes[i] = Number(big & 0xffn);
+            big >>= 8n;
+        }
+        this.out.push(...bytes);
+    }
+    bytes(b) {
+        for (let i = 0; i < b.length; i++)
+            this.out.push(b[i]);
+    }
+    lenBytes(b) {
+        this.u32(b.length);
+        this.bytes(b);
+    }
+    string(s) {
+        this.lenBytes(utf8Encoder.encode(s));
+    }
+    finish() {
+        return Uint8Array.from(this.out);
+    }
+}
+function requireEnum(value, allowed, field) {
+    if (!allowed.includes(value)) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', `${field}: invalid value ${JSON.stringify(value)}`);
+    }
+    return value;
+}
+function requireString(value, field, minLen) {
+    if (typeof value !== 'string') {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', `${field}: not a string`);
+    }
+    const byteLen = utf8Encoder.encode(value).length;
+    if (byteLen < minLen) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', `${field}: too short`);
+    }
+    if (byteLen > limits_1.MAX_STRING_FIELD_BYTES) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', `${field}: exceeds ${limits_1.MAX_STRING_FIELD_BYTES} bytes`);
+    }
+    return value;
+}
+function requireUint(value, field, min = 0) {
+    if (!Number.isInteger(value) || value < min || value > limits_1.MAX_SAFE_UINT64) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', `${field}: out of range`);
+    }
+    return value;
+}
+/** Serialize a signed release, validating every field and the overall limits. */
+function serializeSignedRelease(p) {
+    if (p.signatureAlgorithm !== limits_1.SIGNATURE_ALGORITHM) {
+        throw new types_1.OtaProtocolError('UNSUPPORTED_SIGNATURE_ALGORITHM', p.signatureAlgorithm);
+    }
+    if (p.hashAlgorithm !== limits_1.HASH_ALGORITHM) {
+        throw new types_1.OtaProtocolError('UNSUPPORTED_HASH_ALGORITHM', p.hashAlgorithm);
+    }
+    const platform = requireEnum(p.platform, limits_1.PLATFORMS, 'platform');
+    const artifactType = requireEnum(p.artifactType, limits_1.ARTIFACT_TYPES, 'artifactType');
+    requireString(p.keyId, 'keyId', 1);
+    requireString(p.projectId, 'projectId', 1);
+    requireString(p.applicationId, 'applicationId', 1);
+    requireString(p.releaseId, 'releaseId', 1);
+    requireString(p.bundleId, 'bundleId', 1);
+    requireString(p.targetAppVersion, 'targetAppVersion', 0);
+    requireString(p.targetRuntimeVersion, 'targetRuntimeVersion', 0);
+    requireString(p.minimumSdkVersion, 'minimumSdkVersion', 0);
+    requireUint(p.releaseSequence, 'releaseSequence');
+    requireUint(p.issuedAtEpochSeconds, 'issuedAtEpochSeconds', 1);
+    requireUint(p.expiresAtEpochSeconds, 'expiresAtEpochSeconds', 0);
+    requireUint(p.artifactSize, 'artifactSize', 1);
+    if (p.expiresAtEpochSeconds !== 0 && p.expiresAtEpochSeconds < p.issuedAtEpochSeconds) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', 'expiresAt < issuedAt');
+    }
+    const artifactSha = (0, hex_1.hexToBytes)(p.artifactSha256, limits_1.SHA256_LEN);
+    const resultSha = (0, hex_1.hexToBytes)(p.resultArtifactSha256, limits_1.SHA256_LEN);
+    // full/patch consistency (docs §3.3).
+    let baseBundleId = '';
+    let baseSha = new Uint8Array(0);
+    if (artifactType === 'patch') {
+        baseBundleId = requireString(p.baseBundleId, 'baseBundleId', 1);
+        baseSha = (0, hex_1.hexToBytes)(p.baseArtifactSha256, limits_1.SHA256_LEN);
+    }
+    else {
+        if (p.baseBundleId !== '' || p.baseArtifactSha256 !== '') {
+            throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', 'full artifact must not carry base fields');
+        }
+    }
+    const w = new ByteWriter();
+    w.bytes(limits_1.MAGIC_BYTES);
+    w.u16(limits_1.SCHEMA_VERSION);
+    w.string(limits_1.SIGNATURE_ALGORITHM);
+    w.string(limits_1.HASH_ALGORITHM);
+    w.string(p.keyId);
+    w.string(p.projectId);
+    w.string(p.applicationId);
+    w.string(p.releaseId);
+    w.string(p.bundleId);
+    w.string(platform);
+    w.string(artifactType);
+    w.string(p.targetAppVersion);
+    w.string(p.targetRuntimeVersion);
+    w.string(p.minimumSdkVersion);
+    w.u64(p.releaseSequence);
+    w.u64(p.issuedAtEpochSeconds);
+    w.u64(p.expiresAtEpochSeconds);
+    w.u64(p.artifactSize);
+    w.bytes(artifactSha);
+    w.string(baseBundleId);
+    w.lenBytes(baseSha);
+    w.bytes(resultSha);
+    const bytes = w.finish();
+    if (bytes.length > limits_1.MAX_SIGNED_PAYLOAD_BYTES) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', `payload exceeds ${limits_1.MAX_SIGNED_PAYLOAD_BYTES} bytes`);
+    }
+    return bytes;
+}
+// ─── parse ──────────────────────────────────────────────────────────────────
+class ByteReader {
+    constructor(buf) {
+        this.buf = buf;
+        this.pos = 0;
+    }
+    ensure(n) {
+        if (n < 0 || this.pos + n > this.buf.length) {
+            throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', 'truncated payload');
+        }
+    }
+    fixed(n) {
+        this.ensure(n);
+        const slice = this.buf.subarray(this.pos, this.pos + n);
+        this.pos += n;
+        return slice;
+    }
+    u16() {
+        const b = this.fixed(2);
+        return (b[0] << 8) | b[1];
+    }
+    u32() {
+        const b = this.fixed(4);
+        // multiplication avoids the sign bit that << would set for values ≥ 2^31.
+        return b[0] * 0x1000000 + (b[1] << 16) + (b[2] << 8) + b[3];
+    }
+    u64() {
+        const b = this.fixed(8);
+        let big = 0n;
+        for (let i = 0; i < 8; i++)
+            big = (big << 8n) | BigInt(b[i]);
+        if (big > BigInt(limits_1.MAX_SAFE_UINT64)) {
+            throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', 'uint64 exceeds safe range');
+        }
+        return Number(big);
+    }
+    lenBytes(max, field) {
+        const len = this.u32();
+        if (len > max) {
+            throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', `${field}: length ${len} exceeds ${max}`);
+        }
+        return this.fixed(len);
+    }
+    string(max, field) {
+        const bytes = this.lenBytes(max, field);
+        try {
+            return utf8DecoderFatal.decode(bytes);
+        }
+        catch {
+            throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', `${field}: invalid UTF-8`);
+        }
+    }
+    remaining() {
+        return this.buf.length - this.pos;
+    }
+}
+function equalBytes(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+/**
+ * Parse + fully validate a signed payload. Throws {@link OtaProtocolError} with a
+ * stable code on any structural, enum, range, or consistency violation, on
+ * invalid UTF-8, on an oversized length prefix, and on trailing bytes.
+ */
+function parseSignedRelease(bytes) {
+    if (!(bytes instanceof Uint8Array)) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', 'input is not bytes');
+    }
+    if (bytes.length > limits_1.MAX_SIGNED_PAYLOAD_BYTES) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', 'payload exceeds size limit');
+    }
+    const r = new ByteReader(bytes);
+    const magic = r.fixed(limits_1.MAGIC_BYTES.length);
+    if (!equalBytes(magic, limits_1.MAGIC_BYTES)) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', 'bad magic');
+    }
+    const schemaVersion = r.u16();
+    if (schemaVersion !== limits_1.SCHEMA_VERSION) {
+        throw new types_1.OtaProtocolError('UNSUPPORTED_SCHEMA', `schemaVersion ${schemaVersion}`);
+    }
+    const signatureAlgorithm = r.string(limits_1.MAX_STRING_FIELD_BYTES, 'signatureAlgorithm');
+    if (signatureAlgorithm !== limits_1.SIGNATURE_ALGORITHM) {
+        throw new types_1.OtaProtocolError('UNSUPPORTED_SIGNATURE_ALGORITHM', signatureAlgorithm);
+    }
+    const hashAlgorithm = r.string(limits_1.MAX_STRING_FIELD_BYTES, 'hashAlgorithm');
+    if (hashAlgorithm !== limits_1.HASH_ALGORITHM) {
+        throw new types_1.OtaProtocolError('UNSUPPORTED_HASH_ALGORITHM', hashAlgorithm);
+    }
+    const keyId = r.string(limits_1.MAX_STRING_FIELD_BYTES, 'keyId');
+    const projectId = r.string(limits_1.MAX_STRING_FIELD_BYTES, 'projectId');
+    const applicationId = r.string(limits_1.MAX_STRING_FIELD_BYTES, 'applicationId');
+    const releaseId = r.string(limits_1.MAX_STRING_FIELD_BYTES, 'releaseId');
+    const bundleId = r.string(limits_1.MAX_STRING_FIELD_BYTES, 'bundleId');
+    for (const [name, v] of [
+        ['keyId', keyId],
+        ['projectId', projectId],
+        ['applicationId', applicationId],
+        ['releaseId', releaseId],
+        ['bundleId', bundleId],
+    ]) {
+        if (v.length === 0)
+            throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', `${name}: empty`);
+    }
+    const platformStr = r.string(limits_1.MAX_STRING_FIELD_BYTES, 'platform');
+    if (!limits_1.PLATFORMS.includes(platformStr)) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', `platform: ${platformStr}`);
+    }
+    const artifactTypeStr = r.string(limits_1.MAX_STRING_FIELD_BYTES, 'artifactType');
+    if (!limits_1.ARTIFACT_TYPES.includes(artifactTypeStr)) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', `artifactType: ${artifactTypeStr}`);
+    }
+    const platform = platformStr;
+    const artifactType = artifactTypeStr;
+    const targetAppVersion = r.string(limits_1.MAX_STRING_FIELD_BYTES, 'targetAppVersion');
+    const targetRuntimeVersion = r.string(limits_1.MAX_STRING_FIELD_BYTES, 'targetRuntimeVersion');
+    const minimumSdkVersion = r.string(limits_1.MAX_STRING_FIELD_BYTES, 'minimumSdkVersion');
+    const releaseSequence = r.u64();
+    const issuedAtEpochSeconds = r.u64();
+    const expiresAtEpochSeconds = r.u64();
+    const artifactSize = r.u64();
+    if (issuedAtEpochSeconds === 0) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', 'issuedAt is zero');
+    }
+    if (artifactSize === 0) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', 'artifactSize is zero');
+    }
+    if (expiresAtEpochSeconds !== 0 && expiresAtEpochSeconds < issuedAtEpochSeconds) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', 'expiresAt < issuedAt');
+    }
+    const artifactSha256 = (0, hex_1.bytesToHex)(r.fixed(limits_1.SHA256_LEN));
+    const baseBundleId = r.string(limits_1.MAX_STRING_FIELD_BYTES, 'baseBundleId');
+    const baseShaBytes = r.lenBytes(limits_1.SHA256_LEN, 'baseArtifactSha256');
+    const resultArtifactSha256 = (0, hex_1.bytesToHex)(r.fixed(limits_1.SHA256_LEN));
+    // full/patch consistency (docs §3.3).
+    if (artifactType === 'full') {
+        if (baseBundleId.length !== 0 || baseShaBytes.length !== 0) {
+            throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', 'full artifact carries base fields');
+        }
+    }
+    else {
+        if (baseBundleId.length === 0 || baseShaBytes.length !== limits_1.SHA256_LEN) {
+            throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', 'patch artifact missing base fields');
+        }
+    }
+    if (r.remaining() !== 0) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', 'trailing bytes after payload');
+    }
+    return {
+        signatureAlgorithm,
+        hashAlgorithm,
+        keyId,
+        projectId,
+        applicationId,
+        releaseId,
+        bundleId,
+        platform,
+        artifactType,
+        targetAppVersion,
+        targetRuntimeVersion,
+        minimumSdkVersion,
+        releaseSequence,
+        issuedAtEpochSeconds,
+        expiresAtEpochSeconds,
+        artifactSize,
+        artifactSha256,
+        baseBundleId,
+        baseArtifactSha256: baseShaBytes.length === limits_1.SHA256_LEN ? (0, hex_1.bytesToHex)(baseShaBytes) : '',
+        resultArtifactSha256,
+    };
+}
+/**
+ * Parse ONLY enough of the payload to extract `keyId` (docs §5 step 4/5), so a
+ * verifier can resolve the trusted key before spending an RSA verify. Still fully
+ * bounds-checked. The returned keyId is NOT authenticated until the signature is
+ * verified over the whole payload.
+ */
+function peekKeyId(bytes) {
+    if (bytes.length > limits_1.MAX_SIGNED_PAYLOAD_BYTES) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', 'payload exceeds size limit');
+    }
+    const r = new ByteReader(bytes);
+    const magic = r.fixed(limits_1.MAGIC_BYTES.length);
+    if (!equalBytes(magic, limits_1.MAGIC_BYTES)) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', 'bad magic');
+    }
+    if (r.u16() !== limits_1.SCHEMA_VERSION) {
+        throw new types_1.OtaProtocolError('UNSUPPORTED_SCHEMA', 'schemaVersion');
+    }
+    r.string(limits_1.MAX_STRING_FIELD_BYTES, 'signatureAlgorithm');
+    r.string(limits_1.MAX_STRING_FIELD_BYTES, 'hashAlgorithm');
+    const keyId = r.string(limits_1.MAX_STRING_FIELD_BYTES, 'keyId');
+    if (keyId.length === 0) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', 'keyId: empty');
+    }
+    return keyId;
+}
+//# sourceMappingURL=codec.js.map

package/lib/vendor/ota-protocol/codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec.js","sourceRoot":"","sources":["../../../src/vendor/ota-protocol/codec.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAoFH,wDAwEC;AAqED,gDAkHC;AAQD,8BAmBC;AA5WD,qCAWkB;AAClB,mCAAkG;AAClG,+BAA+C;AAE/C,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AACtC,MAAM,gBAAgB,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAEnE,+EAA+E;AAE/E,MAAM,UAAU;IAAhB;QACmB,QAAG,GAAa,EAAE,CAAC;IA8BtC,CAAC;IA5BC,GAAG,CAAC,CAAS;QACX,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,GAAG,CAAC,CAAS;QACX,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAClF,CAAC;IACD,GAAG,CAAC,CAAS;QACX,IAAI,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAS,CAAC,CAAC,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC;YAC/B,GAAG,KAAK,EAAE,CAAC;QACb,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,CAAa;QACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,QAAQ,CAAC,CAAa;QACpB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IACD,MAAM,CAAC,CAAS;QACd,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,MAAM;QACJ,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;CACF;AAED,SAAS,WAAW,CAAmB,KAAa,EAAE,OAAqB,EAAE,KAAa;IACxF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAU,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,GAAG,KAAK,mBAAmB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,KAAU,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa,EAAE,MAAc;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,GAAG,KAAK,gBAAgB,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,OAAO,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,GAAG,+BAAsB,EAAE,CAAC;QACrC,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,GAAG,KAAK,aAAa,+BAAsB,QAAQ,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa,EAAE,GAAG,GAAG,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,wBAAe,EAAE,CAAC;QACvE,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,GAAG,KAAK,gBAAgB,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,SAAgB,sBAAsB,CAAC,CAA0B;IAC/D,IAAI,CAAC,CAAC,kBAAkB,KAAK,4BAAmB,EAAE,CAAC;QACjD,MAAM,IAAI,wBAAgB,CAAC,iCAAiC,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,CAAC,aAAa,KAAK,uBAAc,EAAE,CAAC;QACvC,MAAM,IAAI,wBAAgB,CAAC,4BAA4B,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAgB,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,kBAAS,EAAE,UAAU,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAoB,WAAW,CAAC,CAAC,CAAC,YAAY,EAAE,uBAAc,EAAE,cAAc,CAAC,CAAC;IAElG,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACnC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAC3C,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;IACnD,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAC3C,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACzC,aAAa,CAAC,CAAC,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;IACzD,aAAa,CAAC,CAAC,CAAC,oBAAoB,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;IACjE,aAAa,CAAC,CAAC,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;IAE3D,WAAW,CAAC,CAAC,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IAClD,WAAW,CAAC,CAAC,CAAC,oBAAoB,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;IAC/D,WAAW,CAAC,CAAC,CAAC,qBAAqB,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;IACjE,WAAW,CAAC,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,CAAC,qBAAqB,GAAG,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACtF,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,sBAAsB,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,WAAW,GAAG,IAAA,gBAAU,EAAC,CAAC,CAAC,cAAc,EAAE,mBAAU,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAA,gBAAU,EAAC,CAAC,CAAC,oBAAoB,EAAE,mBAAU,CAAC,CAAC;IAEjE,sCAAsC;IACtC,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,OAAO,GAAe,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;QAC7B,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;QAChE,OAAO,GAAG,IAAA,gBAAU,EAAC,CAAC,CAAC,kBAAkB,EAAE,mBAAU,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,CAAC,YAAY,KAAK,EAAE,IAAI,CAAC,CAAC,kBAAkB,KAAK,EAAE,EAAE,CAAC;YACzD,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,0CAA0C,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,IAAI,UAAU,EAAE,CAAC;IAC3B,CAAC,CAAC,KAAK,CAAC,oBAAW,CAAC,CAAC;IACrB,CAAC,CAAC,GAAG,CAAC,uBAAc,CAAC,CAAC;IACtB,CAAC,CAAC,MAAM,CAAC,4BAAmB,CAAC,CAAC;IAC9B,CAAC,CAAC,MAAM,CAAC,uBAAc,CAAC,CAAC;IACzB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAC1B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnB,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACvB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAC7B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;IACjC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC9B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IACzB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAC9B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;IAC/B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACtB,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACrB,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACvB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEnB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,IAAI,KAAK,CAAC,MAAM,GAAG,iCAAwB,EAAE,CAAC;QAC5C,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,mBAAmB,iCAAwB,QAAQ,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU;IAEd,YAA6B,GAAe;QAAf,QAAG,GAAH,GAAG,CAAY;QAD5C,QAAG,GAAG,CAAC,CAAC;IACuC,CAAC;IAExC,MAAM,CAAC,CAAS;QACtB,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAC5C,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,KAAK,CAAC,CAAS;QACb,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IACD,GAAG;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,GAAG;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,0EAA0E;QAC1E,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,GAAG;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,GAAG,GAAG,MAAM,CAAC,wBAAe,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,2BAA2B,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,QAAQ,CAAC,GAAW,EAAE,KAAa;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,GAAG,KAAK,YAAY,GAAG,YAAY,GAAG,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,CAAC,GAAW,EAAE,KAAa;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,GAAG,KAAK,iBAAiB,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,SAAS;QACP,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC;IACpC,CAAC;CACF;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,KAAiB;IAClD,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,oBAAoB,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,iCAAwB,EAAE,CAAC;QAC5C,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,4BAA4B,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAEhC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,oBAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,oBAAW,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9B,IAAI,aAAa,KAAK,uBAAc,EAAE,CAAC;QACrC,MAAM,IAAI,wBAAgB,CAAC,oBAAoB,EAAE,iBAAiB,aAAa,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,+BAAsB,EAAE,oBAAoB,CAAC,CAAC;IAClF,IAAI,kBAAkB,KAAK,4BAAmB,EAAE,CAAC;QAC/C,MAAM,IAAI,wBAAgB,CAAC,iCAAiC,EAAE,kBAAkB,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,+BAAsB,EAAE,eAAe,CAAC,CAAC;IACxE,IAAI,aAAa,KAAK,uBAAc,EAAE,CAAC;QACrC,MAAM,IAAI,wBAAgB,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,+BAAsB,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,+BAAsB,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,+BAAsB,EAAE,eAAe,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,+BAAsB,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,+BAAsB,EAAE,UAAU,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI;QACtB,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,WAAW,EAAE,SAAS,CAAC;QACxB,CAAC,eAAe,EAAE,aAAa,CAAC;QAChC,CAAC,WAAW,EAAE,SAAS,CAAC;QACxB,CAAC,UAAU,EAAE,QAAQ,CAAC;KACd,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,+BAAsB,EAAE,UAAU,CAAC,CAAC;IACjE,IAAI,CAAC,kBAAS,CAAC,QAAQ,CAAC,WAA0B,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,aAAa,WAAW,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,+BAAsB,EAAE,cAAc,CAAC,CAAC;IACzE,IAAI,CAAC,uBAAc,CAAC,QAAQ,CAAC,eAAkC,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,iBAAiB,eAAe,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,QAAQ,GAAG,WAA0B,CAAC;IAC5C,MAAM,YAAY,GAAG,eAAkC,CAAC;IAExD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,+BAAsB,EAAE,kBAAkB,CAAC,CAAC;IAC9E,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,+BAAsB,EAAE,sBAAsB,CAAC,CAAC;IACtF,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,+BAAsB,EAAE,mBAAmB,CAAC,CAAC;IAEhF,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,oBAAoB,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACrC,MAAM,qBAAqB,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,oBAAoB,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,sBAAsB,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,qBAAqB,KAAK,CAAC,IAAI,qBAAqB,GAAG,oBAAoB,EAAE,CAAC;QAChF,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,sBAAsB,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,cAAc,GAAG,IAAA,gBAAU,EAAC,CAAC,CAAC,KAAK,CAAC,mBAAU,CAAC,CAAC,CAAC;IAEvD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,+BAAsB,EAAE,cAAc,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,CAAC,CAAC,QAAQ,CAAC,mBAAU,EAAE,oBAAoB,CAAC,CAAC;IAClE,MAAM,oBAAoB,GAAG,IAAA,gBAAU,EAAC,CAAC,CAAC,KAAK,CAAC,mBAAU,CAAC,CAAC,CAAC;IAE7D,sCAAsC;IACtC,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,mCAAmC,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,mBAAU,EAAE,CAAC;YACpE,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,oCAAoC,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,8BAA8B,CAAC,CAAC;IACvF,CAAC;IAED,OAAO;QACL,kBAAkB;QAClB,aAAa;QACb,KAAK;QACL,SAAS;QACT,aAAa;QACb,SAAS;QACT,QAAQ;QACR,QAAQ;QACR,YAAY;QACZ,gBAAgB;QAChB,oBAAoB;QACpB,iBAAiB;QACjB,eAAe;QACf,oBAAoB;QACpB,qBAAqB;QACrB,YAAY;QACZ,cAAc;QACd,YAAY;QACZ,kBAAkB,EAAE,YAAY,CAAC,MAAM,KAAK,mBAAU,CAAC,CAAC,CAAC,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE;QACtF,oBAAoB;KACrB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,SAAS,CAAC,KAAiB;IACzC,IAAI,KAAK,CAAC,MAAM,GAAG,iCAAwB,EAAE,CAAC;QAC5C,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,4BAA4B,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,oBAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,oBAAW,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,uBAAc,EAAE,CAAC;QAC/B,MAAM,IAAI,wBAAgB,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;IACpE,CAAC;IACD,CAAC,CAAC,MAAM,CAAC,+BAAsB,EAAE,oBAAoB,CAAC,CAAC;IACvD,CAAC,CAAC,MAAM,CAAC,+BAAsB,EAAE,eAAe,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,+BAAsB,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/lib/vendor/ota-protocol/hex.d.ts

@@ -0,0 +1,8 @@
+/** Strict lowercase-hex helpers (no `0x`, even length, exact alphabet). */
+export declare function bytesToHex(bytes: Uint8Array): string;
+/**
+ * Parse hex to bytes, rejecting anything that is not canonical lowercase-or-mixed
+ * hex of even length. `expectedLen`, when given, pins the output byte count.
+ */
+export declare function hexToBytes(hex: string, expectedLen?: number): Uint8Array;
+//# sourceMappingURL=hex.d.ts.map

package/lib/vendor/ota-protocol/hex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hex.d.ts","sourceRoot":"","sources":["../../../src/vendor/ota-protocol/hex.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAI3E,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAMpD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAexE"}