@viewportai/daemon 0.1.0 → 0.2.1

package/dist/relay/bridge-noise-v3.js

@@ -0,0 +1,406 @@
+import crypto from 'node:crypto';
+import { fromBase64Url, normalizeP256PrivateKey, toBase64Url } from './bridge-crypto.js';
+const HASH_LEN = 32;
+const EMPTY = Buffer.alloc(0);
+const PROLOGUE = Buffer.from('viewport-relay-noise-v3', 'utf8');
+const SESSION_INFO_PREFIX = 'viewport-relay-session-v3';
+const MAX_NONCE = (1n << 64n) - 1n;
+function protocolNameFor(profile) {
+    return profile === 'noise-ikpsk2'
+        ? 'Noise_IKpsk2_P256_AESGCM_SHA256'
+        : 'Noise_IK_P256_AESGCM_SHA256';
+}
+function hash(data) {
+    return crypto.createHash('sha256').update(data).digest();
+}
+function hmac(key, data) {
+    return crypto.createHmac('sha256', key).update(data).digest();
+}
+function hkdfOutputs(chainingKey, inputKeyMaterial, count) {
+    const tempKey = hmac(chainingKey, inputKeyMaterial);
+    const out1 = hmac(tempKey, Buffer.from([1]));
+    const out2 = hmac(tempKey, Buffer.concat([out1, Buffer.from([2])]));
+    if (count === 2)
+        return [out1, out2];
+    const out3 = hmac(tempKey, Buffer.concat([out2, Buffer.from([3])]));
+    return [out1, out2, out3];
+}
+function initializeSymmetric(profile) {
+    const protocolName = Buffer.from(protocolNameFor(profile), 'utf8');
+    const h = protocolName.length <= HASH_LEN
+        ? Buffer.concat([protocolName, Buffer.alloc(HASH_LEN - protocolName.length)])
+        : hash(protocolName);
+    return {
+        ck: Buffer.from(h),
+        h,
+        k: null,
+        nonce: 0n,
+    };
+}
+function mixHash(state, data) {
+    state.h = hash(Buffer.concat([state.h, data]));
+}
+function mixKey(state, inputKeyMaterial) {
+    const [ck, key] = hkdfOutputs(state.ck, inputKeyMaterial, 2);
+    state.ck = ck;
+    state.k = key;
+    state.nonce = 0n;
+}
+function mixKeyAndHash(state, inputKeyMaterial) {
+    const [ck, tempHash, key] = hkdfOutputs(state.ck, inputKeyMaterial, 3);
+    state.ck = ck;
+    mixHash(state, tempHash);
+    state.k = key;
+    state.nonce = 0n;
+}
+function nonceToIv(nonce) {
+    if (nonce < 0 || nonce > MAX_NONCE) {
+        throw new Error('noise nonce out of range');
+    }
+    const iv = Buffer.alloc(12);
+    iv.writeUInt32LE(0, 0);
+    iv.writeBigUInt64LE(nonce, 4);
+    return iv;
+}
+function encryptWithAd(key, nonce, ad, plaintext) {
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, nonceToIv(nonce), {
+        authTagLength: 16,
+    });
+    cipher.setAAD(ad);
+    const body = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([body, tag]);
+}
+function decryptWithAd(key, nonce, ad, ciphertext) {
+    if (ciphertext.length < 16) {
+        throw new Error('noise ciphertext too short');
+    }
+    const body = ciphertext.subarray(0, ciphertext.length - 16);
+    const tag = ciphertext.subarray(ciphertext.length - 16);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, nonceToIv(nonce), {
+        authTagLength: 16,
+    });
+    decipher.setAAD(ad);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(body), decipher.final()]);
+}
+function encryptAndHash(state, plaintext) {
+    if (!state.k) {
+        mixHash(state, plaintext);
+        return plaintext;
+    }
+    const ciphertext = encryptWithAd(state.k, state.nonce, state.h, plaintext);
+    mixHash(state, ciphertext);
+    state.nonce += 1n;
+    return ciphertext;
+}
+function decryptAndHash(state, ciphertext) {
+    if (!state.k) {
+        mixHash(state, ciphertext);
+        return ciphertext;
+    }
+    const plaintext = decryptWithAd(state.k, state.nonce, state.h, ciphertext);
+    mixHash(state, ciphertext);
+    state.nonce += 1n;
+    return plaintext;
+}
+function timingSafeEqualBase64Url(left, right) {
+    const leftBytes = fromBase64Url(left);
+    const rightBytes = fromBase64Url(right);
+    const compareLength = Math.max(leftBytes.length, rightBytes.length, 1);
+    const paddedLeft = Buffer.alloc(compareLength);
+    const paddedRight = Buffer.alloc(compareLength);
+    leftBytes.copy(paddedLeft);
+    rightBytes.copy(paddedRight);
+    const equal = crypto.timingSafeEqual(paddedLeft, paddedRight);
+    return equal && leftBytes.length === rightBytes.length;
+}
+function split(state) {
+    const [k1, k2] = hkdfOutputs(state.ck, EMPTY, 2);
+    return [k1, k2];
+}
+function deriveSessionKey(params) {
+    const info = Buffer.from(`${SESSION_INFO_PREFIX}|${params.profile}|${params.sessionId}|${params.epoch}`, 'utf8');
+    const ikm = Buffer.concat([params.k1, params.k2]);
+    const derived = crypto.hkdfSync('sha256', ikm, params.h, info, 32);
+    return Buffer.isBuffer(derived) ? derived : Buffer.from(derived);
+}
+function validatePublicKey(raw, label) {
+    if (raw.length !== 65 || raw[0] !== 0x04) {
+        throw new Error(`invalid ${label} public key`);
+    }
+}
+function ecdhSecret(privateKey, publicKey) {
+    const ecdh = crypto.createECDH('prime256v1');
+    ecdh.setPrivateKey(privateKey);
+    return ecdh.computeSecret(publicKey);
+}
+function generateP256Keypair() {
+    const ecdh = crypto.createECDH('prime256v1');
+    const publicKey = ecdh.generateKeys();
+    const privateKey = normalizeP256PrivateKey(ecdh.getPrivateKey());
+    if (!privateKey) {
+        throw new Error('failed to generate p256 keypair');
+    }
+    return { privateKey, publicKey };
+}
+function cloneSymmetricState(state) {
+    return {
+        ck: Buffer.from(state.ck),
+        h: Buffer.from(state.h),
+        k: state.k ? Buffer.from(state.k) : null,
+        nonce: state.nonce,
+    };
+}
+function initializeHandshakeState(profile, daemonPublicKeyRaw) {
+    const state = initializeSymmetric(profile);
+    mixHash(state, PROLOGUE);
+    mixHash(state, daemonPublicKeyRaw);
+    return state;
+}
+function parseMetadata(value) {
+    const parsed = JSON.parse(value.toString('utf8'));
+    if (!parsed ||
+        typeof parsed !== 'object' ||
+        typeof parsed.sessionId !== 'string' ||
+        !Number.isInteger(parsed.epoch) ||
+        parsed.epoch < 1) {
+        throw new Error('invalid noise metadata payload');
+    }
+    return {
+        sessionId: parsed.sessionId,
+        epoch: parsed.epoch,
+    };
+}
+export function parseRelayKeyExchangeInitFrameV3(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const frame = value;
+    if (frame['type'] !== 'relay_key_exchange_init' ||
+        frame['version'] !== 3 ||
+        (frame['profile'] !== 'noise-ik' && frame['profile'] !== 'noise-ikpsk2') ||
+        typeof frame['requestId'] !== 'string' ||
+        typeof frame['clientEphemeralPublicKey'] !== 'string' ||
+        typeof frame['encryptedClientStatic'] !== 'string') {
+        return null;
+    }
+    const previousSessionId = typeof frame['previousSessionId'] === 'string' ? frame['previousSessionId'] : undefined;
+    const pairingPeerId = typeof frame['pairingPeerId'] === 'string' ? frame['pairingPeerId'] : undefined;
+    if (frame['profile'] === 'noise-ikpsk2' &&
+        (!pairingPeerId || pairingPeerId.trim().length === 0)) {
+        return null;
+    }
+    return {
+        type: 'relay_key_exchange_init',
+        version: 3,
+        profile: frame['profile'],
+        requestId: frame['requestId'],
+        clientEphemeralPublicKey: frame['clientEphemeralPublicKey'],
+        encryptedClientStatic: frame['encryptedClientStatic'],
+        pairingPeerId,
+        previousSessionId,
+    };
+}
+export function isRelayKeyExchangeResponseFrameV3(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const frame = value;
+    return (frame['type'] === 'relay_key_exchange_response' &&
+        frame['version'] === 3 &&
+        (frame['profile'] === 'noise-ik' || frame['profile'] === 'noise-ikpsk2') &&
+        typeof frame['requestId'] === 'string' &&
+        typeof frame['daemonPublicKey'] === 'string' &&
+        typeof frame['daemonEphemeralPublicKey'] === 'string' &&
+        typeof frame['encryptedMetadata'] === 'string' &&
+        typeof frame['sessionId'] === 'string' &&
+        typeof frame['epoch'] === 'number' &&
+        Number.isInteger(frame['epoch']) &&
+        frame['epoch'] >= 1 &&
+        typeof frame['proof'] === 'string');
+}
+export function createNoiseV3Init(params) {
+    if (params.profile === 'noise-ikpsk2' && !params.pairingSecret) {
+        throw new Error('pairing secret required for noise-ikpsk2');
+    }
+    const daemonPublicKeyRaw = fromBase64Url(params.daemonPublicKey);
+    validatePublicKey(daemonPublicKeyRaw, 'daemon');
+    const staticKeys = params.clientStaticPrivateKeyOverride
+        ? (() => {
+            const ecdh = crypto.createECDH('prime256v1');
+            ecdh.setPrivateKey(params.clientStaticPrivateKeyOverride);
+            return { privateKey: ecdh.getPrivateKey(), publicKey: ecdh.getPublicKey() };
+        })()
+        : generateP256Keypair();
+    const ephemeralKeys = params.clientEphemeralPrivateKeyOverride
+        ? (() => {
+            const ecdh = crypto.createECDH('prime256v1');
+            ecdh.setPrivateKey(params.clientEphemeralPrivateKeyOverride);
+            return { privateKey: ecdh.getPrivateKey(), publicKey: ecdh.getPublicKey() };
+        })()
+        : generateP256Keypair();
+    validatePublicKey(staticKeys.publicKey, 'client static');
+    validatePublicKey(ephemeralKeys.publicKey, 'client ephemeral');
+    const state = initializeHandshakeState(params.profile, daemonPublicKeyRaw);
+    mixHash(state, ephemeralKeys.publicKey);
+    mixKey(state, ecdhSecret(ephemeralKeys.privateKey, daemonPublicKeyRaw));
+    const encryptedClientStatic = encryptAndHash(state, staticKeys.publicKey);
+    mixKey(state, ecdhSecret(staticKeys.privateKey, daemonPublicKeyRaw));
+    if (params.profile === 'noise-ikpsk2' && params.pairingSecret) {
+        if (params.pairingSecret.length !== 32) {
+            throw new Error('pairing secret must be 32 bytes');
+        }
+    }
+    const requestId = params.requestId ?? `kex-${crypto.randomBytes(8).toString('hex')}`;
+    return {
+        frame: {
+            type: 'relay_key_exchange_init',
+            version: 3,
+            profile: params.profile,
+            requestId,
+            clientEphemeralPublicKey: toBase64Url(ephemeralKeys.publicKey),
+            encryptedClientStatic: toBase64Url(encryptedClientStatic),
+            pairingPeerId: params.pairingPeerId,
+            previousSessionId: params.previousSessionId,
+        },
+        state: {
+            profile: params.profile,
+            requestId,
+            daemonPublicKey: params.daemonPublicKey,
+            clientStaticPrivateKey: staticKeys.privateKey,
+            clientEphemeralPrivateKey: ephemeralKeys.privateKey,
+            pairingPeerId: params.pairingPeerId,
+            ck: Buffer.from(state.ck),
+            h: Buffer.from(state.h),
+            k: state.k ? Buffer.from(state.k) : null,
+            nonce: state.nonce,
+        },
+    };
+}
+export function deriveNoiseV3SessionFromInit(params) {
+    const daemonPublicKeyRaw = fromBase64Url(params.daemonIdentity.publicKey);
+    validatePublicKey(daemonPublicKeyRaw, 'daemon static');
+    const daemonPrivateKeyRaw = normalizeP256PrivateKey(fromBase64Url(params.daemonIdentity.privateKey));
+    if (!daemonPrivateKeyRaw) {
+        throw new Error('invalid daemon private key');
+    }
+    if (params.init.profile === 'noise-ikpsk2') {
+        if (!params.pairingSecret || params.pairingSecret.length !== 32) {
+            throw new Error('pairing secret required for noise-ikpsk2');
+        }
+    }
+    const clientEphemeralPublicKeyRaw = fromBase64Url(params.init.clientEphemeralPublicKey);
+    validatePublicKey(clientEphemeralPublicKeyRaw, 'client ephemeral');
+    const encryptedClientStaticRaw = fromBase64Url(params.init.encryptedClientStatic);
+    const state = initializeHandshakeState(params.init.profile, daemonPublicKeyRaw);
+    mixHash(state, clientEphemeralPublicKeyRaw);
+    mixKey(state, ecdhSecret(daemonPrivateKeyRaw, clientEphemeralPublicKeyRaw));
+    const clientStaticPublicKeyRaw = decryptAndHash(state, encryptedClientStaticRaw);
+    validatePublicKey(clientStaticPublicKeyRaw, 'client static');
+    mixKey(state, ecdhSecret(daemonPrivateKeyRaw, clientStaticPublicKeyRaw));
+    const responderEphemeral = params.daemonEphemeralPrivateKeyOverride
+        ? (() => {
+            const ecdh = crypto.createECDH('prime256v1');
+            ecdh.setPrivateKey(params.daemonEphemeralPrivateKeyOverride);
+            return { privateKey: ecdh.getPrivateKey(), publicKey: ecdh.getPublicKey() };
+        })()
+        : generateP256Keypair();
+    validatePublicKey(responderEphemeral.publicKey, 'daemon ephemeral');
+    mixHash(state, responderEphemeral.publicKey);
+    mixKey(state, ecdhSecret(responderEphemeral.privateKey, clientEphemeralPublicKeyRaw));
+    mixKey(state, ecdhSecret(responderEphemeral.privateKey, clientStaticPublicKeyRaw));
+    if (params.init.profile === 'noise-ikpsk2' && params.pairingSecret) {
+        mixKeyAndHash(state, params.pairingSecret);
+    }
+    const sessionId = params.sessionIdOverride ?? `rs_${crypto.randomBytes(12).toString('hex')}`;
+    const epoch = Math.max(1, params.nextEpoch);
+    const metadata = Buffer.from(JSON.stringify({ sessionId, epoch }), 'utf8');
+    const encryptedMetadata = encryptAndHash(state, metadata);
+    const [k1, k2] = split(state);
+    const sessionKey = deriveSessionKey({
+        k1,
+        k2,
+        h: state.h,
+        profile: params.init.profile,
+        sessionId,
+        epoch,
+    });
+    return {
+        session: {
+            key: sessionKey,
+            profile: params.init.profile,
+            sessionId,
+            epoch,
+        },
+        response: {
+            type: 'relay_key_exchange_response',
+            version: 3,
+            profile: params.init.profile,
+            requestId: params.init.requestId,
+            daemonPublicKey: params.daemonIdentity.publicKey,
+            daemonEphemeralPublicKey: toBase64Url(responderEphemeral.publicKey),
+            encryptedMetadata: toBase64Url(encryptedMetadata),
+            sessionId,
+            epoch,
+            proof: toBase64Url(state.h),
+        },
+    };
+}
+export function finalizeNoiseV3Response(params) {
+    if (params.response.version !== 3) {
+        throw new Error('unsupported relay key exchange response version');
+    }
+    if (params.response.requestId !== params.state.requestId) {
+        throw new Error('key exchange response requestId mismatch');
+    }
+    if (params.response.profile !== params.state.profile) {
+        throw new Error('key exchange response profile mismatch');
+    }
+    if (params.state.profile === 'noise-ikpsk2') {
+        if (!params.pairingSecret || params.pairingSecret.length !== 32) {
+            throw new Error('pairing secret required for noise-ikpsk2');
+        }
+    }
+    const daemonPublicKeyRaw = fromBase64Url(params.state.daemonPublicKey);
+    validatePublicKey(daemonPublicKeyRaw, 'daemon static');
+    const daemonEphemeralPublicKeyRaw = fromBase64Url(params.response.daemonEphemeralPublicKey);
+    validatePublicKey(daemonEphemeralPublicKeyRaw, 'daemon ephemeral');
+    const encryptedMetadataRaw = fromBase64Url(params.response.encryptedMetadata);
+    const state = cloneSymmetricState({
+        ck: params.state.ck,
+        h: params.state.h,
+        k: params.state.k,
+        nonce: params.state.nonce,
+    });
+    mixHash(state, daemonEphemeralPublicKeyRaw);
+    mixKey(state, ecdhSecret(params.state.clientEphemeralPrivateKey, daemonEphemeralPublicKeyRaw));
+    mixKey(state, ecdhSecret(params.state.clientStaticPrivateKey, daemonEphemeralPublicKeyRaw));
+    if (params.state.profile === 'noise-ikpsk2' && params.pairingSecret) {
+        mixKeyAndHash(state, params.pairingSecret);
+    }
+    const metadataRaw = decryptAndHash(state, encryptedMetadataRaw);
+    const metadata = parseMetadata(metadataRaw);
+    if (metadata.sessionId !== params.response.sessionId ||
+        metadata.epoch !== params.response.epoch) {
+        throw new Error('relay metadata mismatch');
+    }
+    const expectedProof = toBase64Url(state.h);
+    if (!timingSafeEqualBase64Url(expectedProof, params.response.proof)) {
+        throw new Error('noise handshake proof mismatch');
+    }
+    const [k1, k2] = split(state);
+    const sessionKey = deriveSessionKey({
+        k1,
+        k2,
+        h: state.h,
+        profile: params.response.profile,
+        sessionId: params.response.sessionId,
+        epoch: params.response.epoch,
+    });
+    return {
+        key: sessionKey,
+        profile: params.response.profile,
+        sessionId: params.response.sessionId,
+        epoch: params.response.epoch,
+    };
+}
+//# sourceMappingURL=bridge-noise-v3.js.map

package/dist/relay/bridge-noise-v3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-noise-v3.js","sourceRoot":"","sources":["../../src/relay/bridge-noise-v3.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAwDzF,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC;AAChE,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AACxD,MAAM,SAAS,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;AAEnC,SAAS,eAAe,CAAC,OAAgC;IACvD,OAAO,OAAO,KAAK,cAAc;QAC/B,CAAC,CAAC,iCAAiC;QACnC,CAAC,CAAC,6BAA6B,CAAC;AACpC,CAAC;AAED,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,IAAY;IACrC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;AAChE,CAAC;AAQD,SAAS,WAAW,CAAC,WAAmB,EAAE,gBAAwB,EAAE,KAAY;IAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgC;IAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,CAAC,GACL,YAAY,CAAC,MAAM,IAAI,QAAQ;QAC7B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,CAAC,EAAE,IAAI;QACP,KAAK,EAAE,EAAE;KACV,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,KAA0B,EAAE,IAAY;IACvD,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,MAAM,CAAC,KAA0B,EAAE,gBAAwB;IAClE,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;IAC7D,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC;IACd,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC;IACd,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,KAA0B,EAAE,gBAAwB;IACzE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;IACvE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzB,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC;IACd,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5B,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvB,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,KAAa,EAAE,EAAU,EAAE,SAAiB;IAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE;QACzE,aAAa,EAAE,EAAE;KAClB,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,KAAa,EAAE,EAAU,EAAE,UAAkB;IAC/E,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE;QAC7E,aAAa,EAAE,EAAE;KAClB,CAAC,CAAC;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,cAAc,CAAC,KAA0B,EAAE,SAAiB;IACnE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3E,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC3B,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;IAClB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,KAA0B,EAAE,UAAkB;IACpE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC3B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC3E,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC3B,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;IAClB,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY,EAAE,KAAa;IAC3D,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAChD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3B,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC9D,OAAO,KAAK,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC;AACzD,CAAC;AAED,SAAS,KAAK,CAAC,KAA0B;IACvC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,MAOzB;IACC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CACtB,GAAG,mBAAmB,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,EAAE,EAC9E,MAAM,CACP,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,KAAa;IACnD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,aAAa,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,UAAkB,EAAE,SAAiB;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAA0B;IACrD,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACvB,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QACxC,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAgC,EAChC,kBAA0B;IAE1B,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzB,OAAO,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAG/C,CAAC;IACF,IACE,CAAC,MAAM;QACP,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9B,MAAM,CAAC,KAAgB,GAAG,CAAC,EAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAe;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IACE,KAAK,CAAC,MAAM,CAAC,KAAK,yBAAyB;QAC3C,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC;QACtB,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,cAAc,CAAC;QACxE,OAAO,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ;QACtC,OAAO,KAAK,CAAC,0BAA0B,CAAC,KAAK,QAAQ;QACrD,OAAO,KAAK,CAAC,uBAAuB,CAAC,KAAK,QAAQ,EAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,iBAAiB,GACrB,OAAO,KAAK,CAAC,mBAAmB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,MAAM,aAAa,GACjB,OAAO,KAAK,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,IACE,KAAK,CAAC,SAAS,CAAC,KAAK,cAAc;QACnC,CAAC,CAAC,aAAa,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,EACrD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC;QACzB,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC;QAC7B,wBAAwB,EAAE,KAAK,CAAC,0BAA0B,CAAC;QAC3D,qBAAqB,EAAE,KAAK,CAAC,uBAAuB,CAAC;QACrD,aAAa;QACb,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,OAAO,CACL,KAAK,CAAC,MAAM,CAAC,KAAK,6BAA6B;QAC/C,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC;QACtB,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,cAAc,CAAC;QACxE,OAAO,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ;QACtC,OAAO,KAAK,CAAC,iBAAiB,CAAC,KAAK,QAAQ;QAC5C,OAAO,KAAK,CAAC,0BAA0B,CAAC,KAAK,QAAQ;QACrD,OAAO,KAAK,CAAC,mBAAmB,CAAC,KAAK,QAAQ;QAC9C,OAAO,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ;QACtC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ;QAClC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,KAAK,CAAC,OAAO,CAAY,IAAI,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,CACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MASjC;IACC,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,kBAAkB,GAAG,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjE,iBAAiB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;IAEhD,MAAM,UAAU,GAAG,MAAM,CAAC,8BAA8B;QACtD,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;YAC1D,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QAC9E,CAAC,CAAC,EAAE;QACN,CAAC,CAAC,mBAAmB,EAAE,CAAC;IAE1B,MAAM,aAAa,GAAG,MAAM,CAAC,iCAAiC;QAC5D,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC;YAC7D,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QAC9E,CAAC,CAAC,EAAE;QACN,CAAC,CAAC,mBAAmB,EAAE,CAAC;IAE1B,iBAAiB,CAAC,UAAU,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACzD,iBAAiB,CAAC,aAAa,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAE/D,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAE3E,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,aAAa,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAExE,MAAM,qBAAqB,GAAG,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAErE,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAC9D,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAErF,OAAO;QACL,KAAK,EAAE;YACL,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS;YACT,wBAAwB,EAAE,WAAW,CAAC,aAAa,CAAC,SAAS,CAAC;YAC9D,qBAAqB,EAAE,WAAW,CAAC,qBAAqB,CAAC;YACzD,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C;QACD,KAAK,EAAE;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS;YACT,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,sBAAsB,EAAE,UAAU,CAAC,UAAU;YAC7C,yBAAyB,EAAE,aAAa,CAAC,UAAU;YACnD,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACvB,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;YACxC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAO5C;IACC,MAAM,kBAAkB,GAAG,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IAC1E,iBAAiB,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;IACvD,MAAM,mBAAmB,GAAG,uBAAuB,CACjD,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAChD,CAAC;IACF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,MAAM,2BAA2B,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACxF,iBAAiB,CAAC,2BAA2B,EAAE,kBAAkB,CAAC,CAAC;IACnE,MAAM,wBAAwB,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAElF,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAEhF,OAAO,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAE5E,MAAM,wBAAwB,GAAG,cAAc,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IACjF,iBAAiB,CAAC,wBAAwB,EAAE,eAAe,CAAC,CAAC;IAE7D,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAEzE,MAAM,kBAAkB,GAAG,MAAM,CAAC,iCAAiC;QACjE,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC;YAC7D,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QAC9E,CAAC,CAAC,EAAE;QACN,CAAC,CAAC,mBAAmB,EAAE,CAAC;IAE1B,iBAAiB,CAAC,kBAAkB,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAEpE,OAAO,CAAC,KAAK,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,kBAAkB,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAC,CAAC;IACtF,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,kBAAkB,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAEnF,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,cAAc,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACnE,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7F,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3E,MAAM,iBAAiB,GAAG,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAE1D,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,EAAE;QACF,EAAE;QACF,CAAC,EAAE,KAAK,CAAC,CAAC;QACV,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;QAC5B,SAAS;QACT,KAAK;KACN,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE;YACP,GAAG,EAAE,UAAU;YACf,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK;SACN;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;YAC5B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;YAChC,eAAe,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS;YAChD,wBAAwB,EAAE,WAAW,CAAC,kBAAkB,CAAC,SAAS,CAAC;YACnE,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,CAAC;YACjD,SAAS;YACT,KAAK;YACL,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;SAC5B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAIvC;IACC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACvE,iBAAiB,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;IACvD,MAAM,2BAA2B,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IAC5F,iBAAiB,CAAC,2BAA2B,EAAE,kBAAkB,CAAC,CAAC;IACnE,MAAM,oBAAoB,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAE9E,MAAM,KAAK,GAAwB,mBAAmB,CAAC;QACrD,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;QACnB,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;KAC1B,CAAC,CAAC;IAEH,OAAO,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAC/F,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAE5F,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,cAAc,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACpE,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAE5C,IACE,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,QAAQ,CAAC,SAAS;QAChD,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ,CAAC,KAAK,EACxC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,wBAAwB,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,EAAE;QACF,EAAE;QACF,CAAC,EAAE,KAAK,CAAC,CAAC;QACV,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;QAChC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;QACpC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;KAC7B,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,EAAE,UAAU;QACf,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;QAChC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;QACpC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;KAC7B,CAAC;AACJ,CAAC"}

package/dist/relay/bridge-pairing-channel.d.ts

@@ -0,0 +1,12 @@
+export declare function derivePairingChannelKey(sharedSecret: Buffer, saltLabel: string): Buffer;
+export declare function encryptPairingPayload(key: Buffer, plaintext: string, aadLabel: string): {
+    encIv: string;
+    encTag: string;
+    encCiphertext: string;
+};
+export declare function decryptPairingPayload(key: Buffer, encrypted: {
+    encIv: string;
+    encTag: string;
+    encCiphertext: string;
+}, aadLabel: string): string;
+//# sourceMappingURL=bridge-pairing-channel.d.ts.map

package/dist/relay/bridge-pairing-channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-pairing-channel.d.ts","sourceRoot":"","sources":["../../src/relay/bridge-pairing-channel.ts"],"names":[],"mappings":"AAGA,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAUvF;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAW1D;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,EACnE,QAAQ,EAAE,MAAM,GACf,MAAM,CASR"}

package/dist/relay/bridge-pairing-channel.js

@@ -0,0 +1,30 @@
+import crypto from 'node:crypto';
+import { fromBase64Url, toBase64Url } from './bridge-crypto.js';
+export function derivePairingChannelKey(sharedSecret, saltLabel) {
+    const salt = crypto.createHash('sha256').update(saltLabel, 'utf8').digest();
+    const raw = crypto.hkdfSync('sha256', sharedSecret, salt, Buffer.from('viewport-relay-pairing-channel-v1', 'utf8'), 32);
+    return Buffer.isBuffer(raw) ? raw : Buffer.from(raw);
+}
+export function encryptPairingPayload(key, plaintext, aadLabel) {
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    cipher.setAAD(Buffer.from(aadLabel, 'utf8'));
+    const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return {
+        encIv: toBase64Url(iv),
+        encTag: toBase64Url(tag),
+        encCiphertext: toBase64Url(ciphertext),
+    };
+}
+export function decryptPairingPayload(key, encrypted, aadLabel) {
+    const iv = fromBase64Url(encrypted.encIv);
+    const tag = fromBase64Url(encrypted.encTag);
+    const ciphertext = fromBase64Url(encrypted.encCiphertext);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAAD(Buffer.from(aadLabel, 'utf8'));
+    decipher.setAuthTag(tag);
+    const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    return plaintext.toString('utf8');
+}
+//# sourceMappingURL=bridge-pairing-channel.js.map

package/dist/relay/bridge-pairing-channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-pairing-channel.js","sourceRoot":"","sources":["../../src/relay/bridge-pairing-channel.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEhE,MAAM,UAAU,uBAAuB,CAAC,YAAoB,EAAE,SAAiB;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CACzB,QAAQ,EACR,YAAY,EACZ,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,MAAM,CAAC,EACxD,EAAE,CACH,CAAC;IACF,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,SAAiB,EACjB,QAAgB;IAEhB,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO;QACL,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QACtB,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC;QACxB,aAAa,EAAE,WAAW,CAAC,UAAU,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,SAAmE,EACnE,QAAgB;IAEhB,MAAM,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC"}

package/dist/relay/bridge-pairing-control-handler.d.ts

@@ -0,0 +1,26 @@
+import type { RelayPairingOfferRequestFrame, RelayPairingRedeemRequestFrame } from './relay-control-frames.js';
+export interface PairingChannelKey {
+    key: Buffer;
+    createdAt: number;
+}
+export type PairingChannelKeyStore = Map<string, PairingChannelKey>;
+export type RelayPairingControlReply = (payload: Record<string, unknown>) => void;
+interface PairingControlBaseOptions {
+    pairingChannelKeys: PairingChannelKeyStore;
+    reply: RelayPairingControlReply;
+    maxAgeMs: number;
+    maxEntries: number;
+}
+interface PairingOfferControlOptions extends PairingControlBaseOptions {
+    frame: RelayPairingOfferRequestFrame;
+    workspaceId: string;
+    daemonWsUrl: string;
+}
+interface PairingRedeemControlOptions extends PairingControlBaseOptions {
+    frame: RelayPairingRedeemRequestFrame;
+}
+export declare function handleRelayPairingOfferRequest({ frame, reply, pairingChannelKeys, workspaceId, daemonWsUrl, maxAgeMs, maxEntries, }: PairingOfferControlOptions): Promise<void>;
+export declare function handleRelayPairingRedeemRequest({ frame, reply, pairingChannelKeys, maxAgeMs, maxEntries, }: PairingRedeemControlOptions): Promise<void>;
+export declare function pruneRelayPairingChannelKeys(pairingChannelKeys: PairingChannelKeyStore, now: number, maxAgeMs: number, maxEntries: number): void;
+export {};
+//# sourceMappingURL=bridge-pairing-control-handler.d.ts.map

package/dist/relay/bridge-pairing-control-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-pairing-control-handler.d.ts","sourceRoot":"","sources":["../../src/relay/bridge-pairing-control-handler.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,6BAA6B,EAC7B,8BAA8B,EAC/B,MAAM,2BAA2B,CAAC;AAGnC,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,sBAAsB,GAAG,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AACpE,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;AAElF,UAAU,yBAAyB;IACjC,kBAAkB,EAAE,sBAAsB,CAAC;IAC3C,KAAK,EAAE,wBAAwB,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,0BAA2B,SAAQ,yBAAyB;IACpE,KAAK,EAAE,6BAA6B,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,2BAA4B,SAAQ,yBAAyB;IACrE,KAAK,EAAE,8BAA8B,CAAC;CACvC;AAED,wBAAsB,8BAA8B,CAAC,EACnD,KAAK,EACL,KAAK,EACL,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,QAAQ,EACR,UAAU,GACX,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5C;AAED,wBAAsB,+BAA+B,CAAC,EACpD,KAAK,EACL,KAAK,EACL,kBAAkB,EAClB,QAAQ,EACR,UAAU,GACX,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgF7C;AAED,wBAAgB,4BAA4B,CAC1C,kBAAkB,EAAE,sBAAsB,EAC1C,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,IAAI,CAgBN"}

package/dist/relay/bridge-pairing-control-handler.js

@@ -0,0 +1,136 @@
+import crypto from 'node:crypto';
+import { fromBase64Url, toBase64Url } from './bridge-crypto.js';
+import { decryptPairingPayload, derivePairingChannelKey, encryptPairingPayload, } from './bridge-pairing-channel.js';
+import { issuePairingOffer, redeemPairingOffer } from '../server/pairing-offers.js';
+export async function handleRelayPairingOfferRequest({ frame, reply, pairingChannelKeys, workspaceId, daemonWsUrl, maxAgeMs, maxEntries, }) {
+    const requestId = frame.requestId;
+    try {
+        pruneRelayPairingChannelKeys(pairingChannelKeys, Date.now(), maxAgeMs, maxEntries);
+        const clientChannelPublicKey = fromBase64Url(frame.clientChannelPublicKey);
+        if (clientChannelPublicKey.length !== 65) {
+            throw new Error('invalid clientChannelPublicKey');
+        }
+        const daemonChannel = crypto.createECDH('prime256v1');
+        daemonChannel.generateKeys();
+        const shared = daemonChannel.computeSecret(clientChannelPublicKey);
+        const channelKey = derivePairingChannelKey(shared, `offer:${frame.requestId}`);
+        const daemonUrl = new URL(daemonWsUrl);
+        const issued = await issuePairingOffer({
+            ttlSeconds: frame.ttlSeconds ?? 600,
+            connection: {
+                host: daemonUrl.hostname || '127.0.0.1',
+                port: daemonUrl.port ? Number(daemonUrl.port) : 7070,
+                listen: `relay:${workspaceId}`,
+                profile: 'relay',
+            },
+        });
+        pairingChannelKeys.set(issued.offerId, { key: channelKey, createdAt: Date.now() });
+        const encryptedOffer = encryptPairingPayload(channelKey, JSON.stringify({
+            offerId: issued.offerId,
+            createdAt: issued.createdAt,
+            expiresAt: issued.expiresAt,
+            redeemSecret: issued.redeemSecret,
+            trustAnchor: issued.trustAnchor,
+            daemonDeviceId: issued.daemonDeviceId,
+            daemonPublicKey: issued.daemonPublicKey,
+        }), `offer:${frame.requestId}`);
+        reply({
+            type: 'relay_pairing_offer_response',
+            requestId,
+            ok: true,
+            daemonChannelPublicKey: toBase64Url(daemonChannel.getPublicKey()),
+            ...encryptedOffer,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        reply({
+            type: 'relay_pairing_offer_response',
+            requestId,
+            ok: false,
+            errorCode: 'PAIRING_OFFER_FAILED',
+            error: message,
+        });
+    }
+}
+export async function handleRelayPairingRedeemRequest({ frame, reply, pairingChannelKeys, maxAgeMs, maxEntries, }) {
+    const requestId = frame.requestId;
+    try {
+        pruneRelayPairingChannelKeys(pairingChannelKeys, Date.now(), maxAgeMs, maxEntries);
+        const channel = pairingChannelKeys.get(frame.offerId);
+        if (!channel) {
+            throw new Error('pairing channel missing or expired');
+        }
+        const decrypted = decryptPairingPayload(channel.key, {
+            encIv: frame.encIv,
+            encTag: frame.encTag,
+            encCiphertext: frame.encCiphertext,
+        }, `redeem:${frame.requestId}:${frame.offerId}`);
+        const parsed = JSON.parse(decrypted);
+        if (typeof parsed.redeemSecret !== 'string' ||
+            typeof parsed.trustAnchor !== 'string' ||
+            typeof parsed.clientPublicKey !== 'string' ||
+            typeof parsed.clientProof !== 'string' ||
+            parsed.redeemSecret.trim().length === 0 ||
+            parsed.trustAnchor.trim().length === 0 ||
+            parsed.clientPublicKey.trim().length === 0 ||
+            parsed.clientProof.trim().length === 0) {
+            throw new Error('invalid encrypted pairing payload');
+        }
+        const redeemed = await redeemPairingOffer(frame.offerId, parsed.redeemSecret, parsed.trustAnchor, parsed.clientPublicKey, parsed.clientProof);
+        if (!redeemed) {
+            reply({
+                type: 'relay_pairing_redeem_response',
+                requestId,
+                ok: false,
+                errorCode: 'PAIRING_REDEEM_FAILED',
+                error: 'offer not found or no longer valid',
+            });
+            return;
+        }
+        reply({
+            type: 'relay_pairing_redeem_response',
+            requestId,
+            ok: true,
+            redeemed: {
+                offerId: redeemed.offerId,
+                createdAt: redeemed.createdAt,
+                expiresAt: redeemed.expiresAt,
+                peerId: redeemed.peerId,
+                daemonDeviceId: redeemed.daemonDeviceId,
+                daemonPublicKey: redeemed.daemonPublicKey,
+                relayPairingPeerId: redeemed.relayPairingPeerId,
+                serverSignature: redeemed.serverSignature,
+            },
+        });
+        pairingChannelKeys.delete(frame.offerId);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        reply({
+            type: 'relay_pairing_redeem_response',
+            requestId,
+            ok: false,
+            errorCode: 'PAIRING_REDEEM_FAILED',
+            error: message,
+        });
+    }
+}
+export function pruneRelayPairingChannelKeys(pairingChannelKeys, now, maxAgeMs, maxEntries) {
+    for (const [offerId, channel] of pairingChannelKeys.entries()) {
+        if (now - channel.createdAt > maxAgeMs) {
+            pairingChannelKeys.delete(offerId);
+        }
+    }
+    const overflow = pairingChannelKeys.size - maxEntries;
+    if (overflow <= 0) {
+        return;
+    }
+    const oldest = Array.from(pairingChannelKeys.entries())
+        .sort((a, b) => a[1].createdAt - b[1].createdAt)
+        .slice(0, overflow);
+    for (const [offerId] of oldest) {
+        pairingChannelKeys.delete(offerId);
+    }
+}
+//# sourceMappingURL=bridge-pairing-control-handler.js.map