nlcurl 0.6.0 → 0.7.0

package/dist/tls/ech.js

@@ -0,0 +1,401 @@
+/**
+ * Encrypted Client Hello (ECH) support per RFC 9735.
+ *
+ * ECH encrypts the SNI (Server Name Indication) and other sensitive
+ * fields in the TLS ClientHello to prevent passive observers from
+ * learning which domain the client is connecting to.
+ *
+ * This module provides:
+ * 1. ECHConfig parsing from HTTPS-RR DNS records
+ * 2. ECH configuration for Node.js TLS engine (Node.js 22+)
+ * 3. HPKE (RFC 9180) encryption of the inner ClientHello
+ * 4. ECH parameters for the stealth TLS engine's ClientHello builder
+ *
+ * @see https://datatracker.ietf.org/doc/rfc9735/
+ * @see https://datatracker.ietf.org/doc/rfc9180/
+ */
+import { randomBytes, createHmac, createCipheriv, generateKeyPairSync, diffieHellman, createPrivateKey, createPublicKey } from "node:crypto";
+/**
+ * Parses an ECHConfigList from raw bytes (as received from HTTPS-RR or config).
+ *
+ * ECHConfigList format (draft-ietf-tls-esni §4):
+ * ```
+ * struct {
+ *   uint16 length;
+ *   ECHConfig echConfigs<1..2^16-1>;
+ * } ECHConfigList;
+ *
+ * struct {
+ *   uint16 version;
+ *   uint16 length;
+ *   opaque contents<1..2^16-1>;
+ * } ECHConfig;
+ * ```
+ *
+ * @param data Raw ECHConfigList bytes.
+ * @returns Parsed ECH parameters, or null if invalid.
+ */
+export function parseECHConfigList(data) {
+    if (data.length < 4)
+        return null;
+    const totalLength = data.readUInt16BE(0);
+    if (totalLength + 2 > data.length)
+        return null;
+    const configs = [];
+    let offset = 2;
+    while (offset + 4 <= 2 + totalLength) {
+        const version = data.readUInt16BE(offset);
+        offset += 2;
+        const configLength = data.readUInt16BE(offset);
+        offset += 2;
+        if (offset + configLength > 2 + totalLength)
+            break;
+        const contents = data.subarray(offset, offset + configLength);
+        const publicName = extractPublicName(contents);
+        configs.push({
+            version,
+            length: configLength,
+            contents,
+            publicName,
+        });
+        offset += configLength;
+    }
+    if (configs.length === 0)
+        return null;
+    const outerSNI = configs[0].publicName;
+    return {
+        echConfigList: data,
+        outerSNI,
+        configs,
+    };
+}
+/**
+ * Extracts the public_name from ECHConfig contents.
+ *
+ * The contents layout (draft-ietf-tls-esni §4):
+ * ```
+ * struct {
+ *   HpkeKeyConfig key_config;
+ *   uint8 maximum_name_length;
+ *   opaque public_name<1..255>;
+ *   Extension extensions<0..2^16-1>;
+ * } ECHConfigContents;
+ *
+ * struct {
+ *   uint8 config_id;
+ *   uint16 kem_id;
+ *   opaque public_key<1..2^16-1>;
+ *   HpkeSymmetricCipherSuite cipher_suites<4..2^16-4>;
+ * } HpkeKeyConfig;
+ * ```
+ */
+function extractPublicName(contents) {
+    if (contents.length < 7)
+        return "";
+    let offset = 0;
+    offset += 1;
+    offset += 2;
+    if (offset + 2 > contents.length)
+        return "";
+    const pkLen = contents.readUInt16BE(offset);
+    offset += 2 + pkLen;
+    if (offset + 2 > contents.length)
+        return "";
+    const csLen = contents.readUInt16BE(offset);
+    offset += 2 + csLen;
+    if (offset >= contents.length)
+        return "";
+    offset += 1;
+    if (offset >= contents.length)
+        return "";
+    const nameLen = contents[offset];
+    offset += 1;
+    if (offset + nameLen > contents.length)
+        return "";
+    return contents.subarray(offset, offset + nameLen).toString("ascii");
+}
+/**
+ * Generates a GREASE ECH extension for the outer ClientHello.
+ * This makes ECH-capable clients indistinguishable from non-ECH clients
+ * by including a random ECH extension even when no real config is available.
+ *
+ * @returns A plausible-looking random ECH extension payload.
+ */
+export function generateGreaseECH() {
+    const payloadLen = 128 + Math.floor(Math.random() * 64);
+    const buf = Buffer.alloc(1 + 4 + 1 + 2 + 32 + 2 + payloadLen);
+    let offset = 0;
+    buf[offset++] = 0x00;
+    buf.writeUInt16BE(0x0001, offset);
+    offset += 2;
+    buf.writeUInt16BE(0x0001, offset);
+    offset += 2;
+    buf[offset++] = randomBytes(1)[0];
+    const enc = randomBytes(32);
+    buf.writeUInt16BE(32, offset);
+    offset += 2;
+    enc.copy(buf, offset);
+    offset += 32;
+    const payload = randomBytes(payloadLen);
+    buf.writeUInt16BE(payloadLen, offset);
+    offset += 2;
+    payload.copy(buf, offset);
+    return buf;
+}
+/**
+ * Parses the HpkeKeyConfig from ECHConfig contents.
+ *
+ * HpkeKeyConfig layout:
+ * ```
+ * struct {
+ *   uint8  config_id;
+ *   uint16 kem_id;
+ *   opaque public_key<1..2^16-1>;
+ *   HpkeSymmetricCipherSuite cipher_suites<4..2^16-4>;
+ * } HpkeKeyConfig;
+ * ```
+ */
+export function parseHpkeKeyConfig(contents) {
+    if (contents.length < 7)
+        return null;
+    let offset = 0;
+    const configId = contents[offset];
+    offset += 1;
+    const kemId = contents.readUInt16BE(offset);
+    offset += 2;
+    if (offset + 2 > contents.length)
+        return null;
+    const pkLen = contents.readUInt16BE(offset);
+    offset += 2;
+    if (offset + pkLen > contents.length)
+        return null;
+    const publicKey = Buffer.from(contents.subarray(offset, offset + pkLen));
+    offset += pkLen;
+    if (offset + 2 > contents.length)
+        return null;
+    const csLen = contents.readUInt16BE(offset);
+    offset += 2;
+    const cipherSuites = [];
+    const csEnd = offset + csLen;
+    while (offset + 4 <= csEnd) {
+        const kdfId = contents.readUInt16BE(offset);
+        offset += 2;
+        const aeadId = contents.readUInt16BE(offset);
+        offset += 2;
+        cipherSuites.push({ kdfId, aeadId });
+    }
+    return { configId, kemId, publicKey, cipherSuites };
+}
+/**
+ * Extracts the `maximum_name_length` field from ECHConfig contents.
+ * This value determines how much padding is added to the inner ClientHello.
+ */
+export function getMaxNameLength(contents) {
+    if (contents.length < 7)
+        return 0;
+    let offset = 0;
+    offset += 1;
+    offset += 2;
+    if (offset + 2 > contents.length)
+        return 0;
+    const pkLen = contents.readUInt16BE(offset);
+    offset += 2 + pkLen;
+    if (offset + 2 > contents.length)
+        return 0;
+    const csLen = contents.readUInt16BE(offset);
+    offset += 2 + csLen;
+    if (offset >= contents.length)
+        return 0;
+    return contents[offset];
+}
+function hpkeHkdfExtract(salt, ikm) {
+    const s = salt.length === 0 ? Buffer.alloc(32) : salt;
+    return Buffer.from(createHmac("sha256", s).update(ikm).digest());
+}
+function hpkeHkdfExpand(prk, info, length) {
+    const N = Math.ceil(length / 32);
+    const okm = Buffer.alloc(N * 32);
+    let T = Buffer.alloc(0);
+    for (let i = 1; i <= N; i++) {
+        const hmac = createHmac("sha256", prk);
+        hmac.update(T);
+        hmac.update(info);
+        hmac.update(Buffer.from([i]));
+        T = Buffer.from(hmac.digest());
+        T.copy(okm, (i - 1) * 32);
+    }
+    return okm.subarray(0, length);
+}
+function labeledExtract(suiteId, salt, label, ikm) {
+    const hpkeV1 = Buffer.from("HPKE-v1", "ascii");
+    const labelBuf = Buffer.from(label, "ascii");
+    const labeledIkm = Buffer.concat([hpkeV1, suiteId, labelBuf, ikm]);
+    return hpkeHkdfExtract(salt, labeledIkm);
+}
+function labeledExpand(suiteId, prk, label, info, length) {
+    const hpkeV1 = Buffer.from("HPKE-v1", "ascii");
+    const labelBuf = Buffer.from(label, "ascii");
+    const lenBuf = Buffer.alloc(2);
+    lenBuf.writeUInt16BE(length);
+    const labeledInfo = Buffer.concat([lenBuf, hpkeV1, suiteId, labelBuf, info]);
+    return hpkeHkdfExpand(prk, labeledInfo, length);
+}
+function buildX25519PKCS8(raw) {
+    return Buffer.concat([Buffer.from([0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x6e, 0x04, 0x22, 0x04, 0x20]), raw]);
+}
+function buildX25519SPKI(raw) {
+    return Buffer.concat([Buffer.from([0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x6e, 0x03, 0x21, 0x00]), raw]);
+}
+/**
+ * DHKEM(X25519, HKDF-SHA256) Encapsulate (RFC 9180 §4.1).
+ * Generates an ephemeral X25519 key pair, performs DH with the recipient's
+ * public key, and derives the shared secret.
+ */
+function dhkemX25519Encap(pkR) {
+    const kp = generateKeyPairSync("x25519");
+    const pkEDer = Buffer.from(kp.publicKey.export({ type: "spki", format: "der" }));
+    const skEDer = Buffer.from(kp.privateKey.export({ type: "pkcs8", format: "der" }));
+    const pkE = Buffer.from(pkEDer.subarray(pkEDer.length - 32));
+    const skE = Buffer.from(skEDer.subarray(skEDer.length - 32));
+    const privKey = createPrivateKey({ key: buildX25519PKCS8(skE), format: "der", type: "pkcs8" });
+    const pubKey = createPublicKey({ key: buildX25519SPKI(pkR), format: "der", type: "spki" });
+    const dh = Buffer.from(diffieHellman({ privateKey: privKey, publicKey: pubKey }));
+    const enc = Buffer.from(pkE);
+    const kemContext = Buffer.concat([enc, pkR]);
+    const kemSuiteId = Buffer.from([0x4b, 0x45, 0x4d, 0x00, 0x20]);
+    const prk = labeledExtract(kemSuiteId, Buffer.alloc(0), "shared_secret", dh);
+    const sharedSecret = labeledExpand(kemSuiteId, prk, "shared_secret", kemContext, 32);
+    return { sharedSecret, enc };
+}
+/** AEAD key/nonce/tag sizes for supported cipher suites. */
+function aeadParams(aeadId) {
+    switch (aeadId) {
+        case 0x0001:
+            return { Nk: 16, Nn: 12 };
+        case 0x0002:
+            return { Nk: 32, Nn: 12 };
+        case 0x0003:
+            return { Nk: 32, Nn: 12 };
+        default:
+            throw new Error(`Unsupported HPKE AEAD: 0x${aeadId.toString(16)}`);
+    }
+}
+function aeadAlgorithm(aeadId) {
+    switch (aeadId) {
+        case 0x0001:
+            return "aes-128-gcm";
+        case 0x0002:
+            return "aes-256-gcm";
+        case 0x0003:
+            return "chacha20-poly1305";
+        default:
+            throw new Error(`Unsupported HPKE AEAD: 0x${aeadId.toString(16)}`);
+    }
+}
+/**
+ * HPKE KeyScheduleS in base mode (RFC 9180 §5.1).
+ * Derives the encryption key and base nonce from the shared secret and info.
+ */
+function hpkeKeyScheduleS(kemId, kdfId, aeadId, sharedSecret, info) {
+    const suiteId = Buffer.alloc(10);
+    suiteId.write("HPKE", 0, "ascii");
+    suiteId.writeUInt16BE(kemId, 4);
+    suiteId.writeUInt16BE(kdfId, 6);
+    suiteId.writeUInt16BE(aeadId, 8);
+    const { Nk, Nn } = aeadParams(aeadId);
+    const pskIdHash = labeledExtract(suiteId, Buffer.alloc(0), "psk_id_hash", Buffer.alloc(0));
+    const infoHash = labeledExtract(suiteId, Buffer.alloc(0), "info_hash", info);
+    const ksContext = Buffer.concat([Buffer.from([0x00]), pskIdHash, infoHash]);
+    const secret = labeledExtract(suiteId, sharedSecret, "secret", Buffer.alloc(0));
+    const key = labeledExpand(suiteId, secret, "key", ksContext, Nk);
+    const baseNonce = labeledExpand(suiteId, secret, "base_nonce", ksContext, Nn);
+    return { key, baseNonce };
+}
+/**
+ * HPKE single-shot Seal (AEAD encrypt, seq=0). Returns ciphertext || tag.
+ */
+function hpkeSeal(key, baseNonce, aad, plaintext, aeadId) {
+    const alg = aeadAlgorithm(aeadId);
+    const cipher = createCipheriv(alg, key, baseNonce, { authTagLength: 16 });
+    cipher.setAAD(aad);
+    const encrypted = cipher.update(plaintext);
+    const final = cipher.final();
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([encrypted, final, tag]);
+}
+/**
+ * Builds the ECH outer extension data (type=outer) for the ClientHello.
+ *
+ * Layout:
+ * ```
+ * uint8  type = 0x00 (outer)
+ * uint16 kdf_id
+ * uint16 aead_id
+ * uint8  config_id
+ * opaque enc<0..2^16-1>
+ * opaque payload<1..2^16-1>
+ * ```
+ */
+export function buildECHOuterExtData(kdfId, aeadId, configId, enc, payload) {
+    const len = 1 + 2 + 2 + 1 + 2 + enc.length + 2 + payload.length;
+    const buf = Buffer.alloc(len);
+    let off = 0;
+    buf[off++] = 0x00;
+    buf.writeUInt16BE(kdfId, off);
+    off += 2;
+    buf.writeUInt16BE(aeadId, off);
+    off += 2;
+    buf[off++] = configId;
+    buf.writeUInt16BE(enc.length, off);
+    off += 2;
+    enc.copy(buf, off);
+    off += enc.length;
+    buf.writeUInt16BE(payload.length, off);
+    off += 2;
+    payload.copy(buf, off);
+    return buf;
+}
+/**
+ * Extracts the raw bytes of the first ECHConfig entry from an ECHConfigList.
+ * Returns the `version(2) + length(2) + contents(configLength)` bytes.
+ */
+export function extractFirstECHConfigRaw(echConfigList) {
+    if (echConfigList.length < 6)
+        return null;
+    const totalLength = echConfigList.readUInt16BE(0);
+    if (totalLength + 2 > echConfigList.length)
+        return null;
+    const version = echConfigList.readUInt16BE(2);
+    const configLength = echConfigList.readUInt16BE(4);
+    if (6 + configLength > echConfigList.length)
+        return null;
+    return Buffer.from(echConfigList.subarray(2, 6 + configLength));
+}
+/**
+ * Core ECH encryption: encrypts an inner ClientHello body using HPKE and
+ * returns all values needed to populate the outer ECH extension.
+ *
+ * @param innerCHBody  Serialized inner ClientHello body (after handshake header).
+ * @param outerCHAAD   Full outer ClientHello handshake message with ECH payload zeroed.
+ * @param config       The selected ECHConfig entry.
+ * @param configRaw    Raw bytes of the ECHConfig entry (version + length + contents).
+ * @returns ECH outer extension data and HPKE metadata.
+ */
+export function echEncryptInner(innerCHBody, outerCHAAD, config, configRaw) {
+    const hpkeConfig = parseHpkeKeyConfig(config.contents);
+    if (!hpkeConfig)
+        throw new Error("Invalid ECHConfig: cannot parse HPKE key config");
+    if (hpkeConfig.kemId !== 0x0020) {
+        throw new Error(`Unsupported KEM: 0x${hpkeConfig.kemId.toString(16)} (only DHKEM(X25519, HKDF-SHA256) = 0x0020)`);
+    }
+    const suite = hpkeConfig.cipherSuites.find((cs) => cs.kdfId === 0x0001 && (cs.aeadId === 0x0001 || cs.aeadId === 0x0003));
+    if (!suite)
+        throw new Error("No supported HPKE cipher suite in ECHConfig");
+    const hpkeInfo = Buffer.concat([Buffer.from("tls ech\x00", "ascii"), configRaw]);
+    const { sharedSecret, enc } = dhkemX25519Encap(hpkeConfig.publicKey);
+    const { key, baseNonce } = hpkeKeyScheduleS(hpkeConfig.kemId, suite.kdfId, suite.aeadId, sharedSecret, hpkeInfo);
+    const payload = hpkeSeal(key, baseNonce, outerCHAAD, innerCHBody, suite.aeadId);
+    const extensionData = buildECHOuterExtData(suite.kdfId, suite.aeadId, hpkeConfig.configId, enc, payload);
+    return { extensionData, enc, kdfId: suite.kdfId, aeadId: suite.aeadId, configId: hpkeConfig.configId };
+}
+//# sourceMappingURL=ech.js.map

package/dist/tls/ech.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ech.js","sourceRoot":"","sources":["../../src/tls/ech.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAuB,MAAM,aAAa,CAAC;AAkDlK;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAE/C,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,CAAC,CAAC;QACZ,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,CAAC;QAEZ,IAAI,MAAM,GAAG,YAAY,GAAG,CAAC,GAAG,WAAW;YAAE,MAAM;QAEnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAAC,CAAC;QAE9D,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAE/C,OAAO,CAAC,IAAI,CAAC;YACX,OAAO;YACP,MAAM,EAAE,YAAY;YACpB,QAAQ;YACR,UAAU;SACX,CAAC,CAAC;QAEH,MAAM,IAAI,YAAY,CAAC;IACzB,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC;IAExC,OAAO;QACL,aAAa,EAAE,IAAI;QACnB,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnC,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,MAAM,IAAI,CAAC,CAAC;IACZ,MAAM,IAAI,CAAC,CAAC;IACZ,IAAI,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,CAAC,GAAG,KAAK,CAAC;IAEpB,IAAI,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,CAAC,GAAG,KAAK,CAAC;IAEpB,IAAI,MAAM,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,IAAI,CAAC,CAAC;IAEZ,IAAI,MAAM,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAE,CAAC;IAClC,MAAM,IAAI,CAAC,CAAC;IAEZ,IAAI,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAClD,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;IAC9D,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;IAErB,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,IAAI,CAAC,CAAC;IACZ,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,IAAI,CAAC,CAAC;IAEZ,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IAEnC,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5B,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9B,MAAM,IAAI,CAAC,CAAC;IACZ,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtB,MAAM,IAAI,EAAE,CAAC;IAEb,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACxC,GAAG,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,IAAI,CAAC,CAAC;IACZ,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE1B,OAAO,GAAG,CAAC;AACb,CAAC;AAUD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAE,CAAC;IACnC,MAAM,IAAI,CAAC,CAAC;IAEZ,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,CAAC,CAAC;IAEZ,IAAI,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,CAAC,CAAC;IAEZ,IAAI,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,KAAK,CAAC;IAEhB,IAAI,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,CAAC,CAAC;IAEZ,MAAM,YAAY,GAA6C,EAAE,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IAC7B,OAAO,MAAM,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,CAAC;QACZ,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,IAAI,CAAC,CAAC;QACZ,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAElC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,IAAI,CAAC,CAAC;IACZ,MAAM,IAAI,CAAC,CAAC;IAEZ,IAAI,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,CAAC,GAAG,KAAK,CAAC;IAEpB,IAAI,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,CAAC,GAAG,KAAK,CAAC;IAEpB,IAAI,MAAM,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,CAAE,CAAC;AAC3B,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,GAAW;IAChD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,IAAY,EAAE,MAAc;IAC/D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,IAAY,EAAE,KAAa,EAAE,GAAW;IAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IACnE,OAAO,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,GAAW,EAAE,KAAa,EAAE,IAAY,EAAE,MAAc;IAC9F,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7E,OAAO,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7I,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AACrH,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,EAAE,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;IAE7D,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3F,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAElF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAE7C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAE/D,MAAM,GAAG,GAAG,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,aAAa,CAAC,UAAU,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAErF,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AAC/B,CAAC;AAED,4DAA4D;AAC5D,SAAS,UAAU,CAAC,MAAc;IAChC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAC5B,KAAK,MAAM;YACT,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAC5B,KAAK,MAAM;YACT,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAC5B;YACE,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,mBAAmB,CAAC;QAC7B;YACE,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAAa,EAAE,KAAa,EAAE,MAAc,EAAE,YAAoB,EAAE,IAAY;IACxG,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAEjC,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAEtC,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAE7E,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE5E,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhF,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAE9E,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,GAAW,EAAE,SAAiB,EAAE,GAAW,EAAE,SAAiB,EAAE,MAAc;IAC9F,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAqB,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5F,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,MAAc,EAAE,QAAgB,EAAE,GAAW,EAAE,OAAe;IAChH,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAChE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IAClB,GAAG,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,GAAG,IAAI,CAAC,CAAC;IACT,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,GAAG,IAAI,CAAC,CAAC;IACT,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC;IACtB,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC,GAAG,IAAI,CAAC,CAAC;IACT,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC;IAClB,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvC,GAAG,IAAI,CAAC,CAAC;IACT,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvB,OAAO,GAAG,CAAC;AACb,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,aAAqB;IAC5D,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,WAAW,GAAG,CAAC,GAAG,aAAa,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAExD,MAAM,OAAO,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,YAAY,GAAG,aAAa,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzD,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,UAAkB,EAAE,MAAiB,EAAE,SAAiB;IAC3G,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAEpF,IAAI,UAAU,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,sBAAsB,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,6CAA6C,CAAC,CAAC;IACpH,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC;IAC1H,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAE3E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAEjF,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACrE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,gBAAgB,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAEjH,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAEhF,MAAM,aAAa,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzG,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;AACzG,CAAC"}

package/dist/tls/node-engine.d.ts

@@ -1,5 +1,6 @@
 import type { ITLSEngine, TLSConnectOptions, TLSSocket } from "./types.js";
 import type { BrowserProfile } from "../fingerprints/types.js";
+import { TLSSessionCache } from "./session-cache.js";
 /**
  * TLS engine that delegates to Node.js’s built-in `tls` module. Provides
  * standard TLS connectivity with optional browser-profile cipher and curve
@@ -8,10 +9,17 @@ import type { BrowserProfile } from "../fingerprints/types.js";
  * fidelity is required.
  */
 export declare class NodeTLSEngine implements ITLSEngine {
+    private readonly sessionCache;
+    constructor(sessionCache?: TLSSessionCache);
     /**
-     * Establishes a TLS connection to the given host and port using Node.js’s
+     * Returns the session ticket cache used by this engine.
+     */
+    getSessionCache(): TLSSessionCache;
+    /**
+     * Establishes a TLS connection to the given host and port using Node.js's
      * native `tls.connect()`. When a `profile` is supplied the cipher list,
      * ECDH curves, and signature algorithms are overridden to match that profile.
+     * Reuses cached session tickets for session resumption when available.
      *
      * @param {TLSConnectOptions} options  - Connection parameters.
      * @param {BrowserProfile}    [profile] - Optional browser profile to apply cipher/curve overrides.

package/dist/tls/node-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-engine.d.ts","sourceRoot":"","sources":["../../src/tls/node-engine.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAqB,SAAS,EAAE,MAAM,YAAY,CAAC;AAC9F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAmF/D;;;;;;GAMG;AACH,qBAAa,aAAc,YAAW,UAAU;IAC9C;;;;;;;;;OASG;IACG,OAAO,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC;CAiHxF"}
+{"version":3,"file":"node-engine.d.ts","sourceRoot":"","sources":["../../src/tls/node-engine.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAqB,SAAS,EAAE,MAAM,YAAY,CAAC;AAC9F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG/D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAkFrD;;;;;;GAMG;AACH,qBAAa,aAAc,YAAW,UAAU;IAC9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAkB;gBAEnC,YAAY,CAAC,EAAE,eAAe;IAI1C;;OAEG;IACH,eAAe,IAAI,eAAe;IAIlC;;;;;;;;;;OAUG;IACG,OAAO,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC;CA6IxF"}

package/dist/tls/node-engine.js

@@ -1,6 +1,8 @@
 import * as tls from "node:tls";
 import { CipherSuite, NamedGroup, SignatureScheme } from "./constants.js";
 import { TLSError } from "../core/errors.js";
+import { TLSSessionCache } from "./session-cache.js";
+import { verifyPinnedPublicKey } from "./pin-verification.js";
 const CIPHER_NAME = new Map([
     [CipherSuite.TLS_AES_128_GCM_SHA256, "TLS_AES_128_GCM_SHA256"],
     [CipherSuite.TLS_AES_256_GCM_SHA384, "TLS_AES_256_GCM_SHA384"],
@@ -84,10 +86,21 @@ function buildSigalgs(algs) {
  * fidelity is required.
  */
 export class NodeTLSEngine {
+    sessionCache;
+    constructor(sessionCache) {
+        this.sessionCache = sessionCache ?? new TLSSessionCache();
+    }
+    /**
+     * Returns the session ticket cache used by this engine.
+     */
+    getSessionCache() {
+        return this.sessionCache;
+    }
     /**
-     * Establishes a TLS connection to the given host and port using Node.js’s
+     * Establishes a TLS connection to the given host and port using Node.js's
      * native `tls.connect()`. When a `profile` is supplied the cipher list,
      * ECDH curves, and signature algorithms are overridden to match that profile.
+     * Reuses cached session tickets for session resumption when available.
      *
      * @param {TLSConnectOptions} options  - Connection parameters.
      * @param {BrowserProfile}    [profile] - Optional browser profile to apply cipher/curve overrides.
@@ -123,6 +136,9 @@ export class NodeTLSEngine {
             if (options.ca) {
                 tlsOpts.ca = options.ca;
             }
+            if (options.echConfigList) {
+                tlsOpts["encryptedClientHello"] = options.echConfigList;
+            }
             if (profile) {
                 const { ciphers, ciphersuites } = buildCipherString(profile.tls.cipherSuites);
                 tlsOpts.ciphers = ciphers;
@@ -134,6 +150,11 @@ export class NodeTLSEngine {
             if (options.socket) {
                 tlsOpts.socket = options.socket;
             }
+            const origin = `${options.servername ?? options.host}:${options.port}`;
+            const cached = this.sessionCache.get(origin);
+            if (cached) {
+                tlsOpts.session = cached.ticket;
+            }
             const timeoutMs = options.timeout ?? 30_000;
             const socket = tls.connect(tlsOpts);
             let settled = false;
@@ -169,13 +190,30 @@ export class NodeTLSEngine {
                 settled = true;
                 if (timer)
                     clearTimeout(timer);
+                if (options.pinnedPublicKey) {
+                    try {
+                        const peerCert = socket.getPeerCertificate(true);
+                        if (peerCert && peerCert.raw) {
+                            verifyPinnedPublicKey(peerCert.raw, options.pinnedPublicKey);
+                        }
+                    }
+                    catch (err) {
+                        socket.destroy();
+                        reject(err instanceof Error ? err : new TLSError(String(err)));
+                        return;
+                    }
+                }
                 const cipher = socket.getCipher();
                 const proto = socket.getProtocol();
                 const connectionInfo = {
                     version: proto ?? "unknown",
                     alpnProtocol: socket.alpnProtocol || null,
                     cipher: cipher?.name ?? "unknown",
+                    resumed: socket.isSessionReused(),
                 };
+                socket.on("session", (session) => {
+                    this.sessionCache.set(origin, session, undefined, socket.alpnProtocol || undefined);
+                });
                 const tlsSocket = Object.assign(socket, {
                     connectionInfo,
                     destroyTLS() {

package/dist/tls/node-engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"node-engine.js","sourceRoot":"","sources":["../../src/tls/node-engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAKhC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,MAAM,WAAW,GAAgC,IAAI,GAAG,CAAC;IACvD,CAAC,WAAW,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;IAC9D,CAAC,WAAW,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;IAC9D,CAAC,WAAW,CAAC,4BAA4B,EAAE,8BAA8B,CAAC;IAC1E,CAAC,WAAW,CAAC,uCAAuC,EAAE,+BAA+B,CAAC;IACtF,CAAC,WAAW,CAAC,qCAAqC,EAAE,6BAA6B,CAAC;IAClF,CAAC,WAAW,CAAC,uCAAuC,EAAE,+BAA+B,CAAC;IACtF,CAAC,WAAW,CAAC,qCAAqC,EAAE,6BAA6B,CAAC;IAClF,CAAC,WAAW,CAAC,6CAA6C,EAAE,+BAA+B,CAAC;IAC5F,CAAC,WAAW,CAAC,2CAA2C,EAAE,6BAA6B,CAAC;IACxF,CAAC,WAAW,CAAC,kCAAkC,EAAE,sBAAsB,CAAC;IACxE,CAAC,WAAW,CAAC,kCAAkC,EAAE,sBAAsB,CAAC;IACxE,CAAC,WAAW,CAAC,+BAA+B,EAAE,mBAAmB,CAAC;IAClE,CAAC,WAAW,CAAC,+BAA+B,EAAE,mBAAmB,CAAC;IAClE,CAAC,WAAW,CAAC,4BAA4B,EAAE,YAAY,CAAC;IACxD,CAAC,WAAW,CAAC,4BAA4B,EAAE,YAAY,CAAC;IACxD,CAAC,WAAW,CAAC,oCAAoC,EAAE,wBAAwB,CAAC;IAC5E,CAAC,WAAW,CAAC,oCAAoC,EAAE,wBAAwB,CAAC;IAC5E,CAAC,WAAW,CAAC,4BAA4B,EAAE,YAAY,CAAC;IACxD,CAAC,WAAW,CAAC,4BAA4B,EAAE,YAAY,CAAC;CACzD,CAAC,CAAC;AAEH,MAAM,UAAU,GAAgC,IAAI,GAAG,CAAC;IACtD,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC7B,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC;IAC/B,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC;IAC/B,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC;IAC/B,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC;IACzB,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;IACnC,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,WAAW,GAAgC,IAAI,GAAG,CAAC;IACvD,CAAC,eAAe,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;IAClE,CAAC,eAAe,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;IAClE,CAAC,eAAe,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;IAClE,CAAC,eAAe,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;IAC5D,CAAC,eAAe,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;IAC5D,CAAC,eAAe,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;IAC5D,CAAC,eAAe,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IACtD,CAAC,eAAe,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IACtD,CAAC,eAAe,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IACtD,CAAC,eAAe,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;IAC1D,CAAC,eAAe,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;IAC1D,CAAC,eAAe,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;CAC3D,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,MAAgB;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QACxB,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAgB;IACtC,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC7B,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAC3C,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,IAAc;IAClC,OAAO,IAAI;SACR,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC9B,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAC3C,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,aAAa;IACxB;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,CAAC,OAA0B,EAAE,OAAwB;QAChE,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChD,MAAM,OAAO,GAA0B;gBACrC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI;gBAC9C,kBAAkB,EAAE,CAAC,OAAO,CAAC,QAAQ;gBACrC,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,SAAS;aACtB,CAAC;YAEF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAmC,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;YAClE,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC9B,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YAC5B,CAAC;YACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YAC1C,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YAC5B,CAAC;YAED,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;YAC1B,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC9E,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;gBACzB,OAAmC,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC;gBACpE,OAAO,CAAC,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAChE,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAChE,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YACpD,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAoB,CAAC;YAChD,CAAC;YAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;YAE5C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAEpC,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,KAAgD,CAAC;YAErD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,OAAO,GAAG,IAAI,CAAC;wBACf,MAAM,CAAC,OAAO,EAAE,CAAC;wBACjB,MAAM,CAAC,IAAI,QAAQ,CAAC,yBAAyB,CAAC,CAAC,CAAC;oBAClD,CAAC;gBACH,CAAC,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,GAAG,EAAE;oBACnB,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,OAAO,GAAG,IAAI,CAAC;wBACf,IAAI,KAAK;4BAAE,YAAY,CAAC,KAAK,CAAC,CAAC;wBAC/B,MAAM,CAAC,OAAO,EAAE,CAAC;wBACjB,MAAM,CAAC,IAAI,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC;oBACjD,CAAC;gBACH,CAAC,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC3B,OAAO,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE;gBAChC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAE/B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;gBAEnC,MAAM,cAAc,GAAsB;oBACxC,OAAO,EAAE,KAAK,IAAI,SAAS;oBAC3B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;oBACzC,MAAM,EAAE,MAAM,EAAE,IAAI,IAAI,SAAS;iBAClC,CAAC;gBAEF,MAAM,SAAS,GAAc,MAAM,CAAC,MAAM,CAAC,MAA2B,EAAE;oBACtE,cAAc;oBACd,UAAU;wBACR,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,CAAC;iBACF,CAAc,CAAC;gBAEhB,OAAO,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;gBAClC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC/B,MAAM,CAAC,GAAG,GAAkD,CAAC;gBAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC;gBACvG,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"node-engine.js","sourceRoot":"","sources":["../../src/tls/node-engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAKhC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,MAAM,WAAW,GAAgC,IAAI,GAAG,CAAC;IACvD,CAAC,WAAW,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;IAC9D,CAAC,WAAW,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;IAC9D,CAAC,WAAW,CAAC,4BAA4B,EAAE,8BAA8B,CAAC;IAC1E,CAAC,WAAW,CAAC,uCAAuC,EAAE,+BAA+B,CAAC;IACtF,CAAC,WAAW,CAAC,qCAAqC,EAAE,6BAA6B,CAAC;IAClF,CAAC,WAAW,CAAC,uCAAuC,EAAE,+BAA+B,CAAC;IACtF,CAAC,WAAW,CAAC,qCAAqC,EAAE,6BAA6B,CAAC;IAClF,CAAC,WAAW,CAAC,6CAA6C,EAAE,+BAA+B,CAAC;IAC5F,CAAC,WAAW,CAAC,2CAA2C,EAAE,6BAA6B,CAAC;IACxF,CAAC,WAAW,CAAC,kCAAkC,EAAE,sBAAsB,CAAC;IACxE,CAAC,WAAW,CAAC,kCAAkC,EAAE,sBAAsB,CAAC;IACxE,CAAC,WAAW,CAAC,+BAA+B,EAAE,mBAAmB,CAAC;IAClE,CAAC,WAAW,CAAC,+BAA+B,EAAE,mBAAmB,CAAC;IAClE,CAAC,WAAW,CAAC,4BAA4B,EAAE,YAAY,CAAC;IACxD,CAAC,WAAW,CAAC,4BAA4B,EAAE,YAAY,CAAC;IACxD,CAAC,WAAW,CAAC,oCAAoC,EAAE,wBAAwB,CAAC;IAC5E,CAAC,WAAW,CAAC,oCAAoC,EAAE,wBAAwB,CAAC;IAC5E,CAAC,WAAW,CAAC,4BAA4B,EAAE,YAAY,CAAC;IACxD,CAAC,WAAW,CAAC,4BAA4B,EAAE,YAAY,CAAC;CACzD,CAAC,CAAC;AAEH,MAAM,UAAU,GAAgC,IAAI,GAAG,CAAC;IACtD,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC7B,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC;IAC/B,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC;IAC/B,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC;IAC/B,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC;IACzB,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;IACnC,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,WAAW,GAAgC,IAAI,GAAG,CAAC;IACvD,CAAC,eAAe,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;IAClE,CAAC,eAAe,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;IAClE,CAAC,eAAe,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;IAClE,CAAC,eAAe,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;IAC5D,CAAC,eAAe,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;IAC5D,CAAC,eAAe,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;IAC5D,CAAC,eAAe,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IACtD,CAAC,eAAe,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IACtD,CAAC,eAAe,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IACtD,CAAC,eAAe,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;IAC1D,CAAC,eAAe,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;IAC1D,CAAC,eAAe,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;CAC3D,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,MAAgB;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QACxB,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAgB;IACtC,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC7B,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAC3C,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,IAAc;IAClC,OAAO,IAAI;SACR,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC9B,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAC3C,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,aAAa;IACP,YAAY,CAAkB;IAE/C,YAAY,YAA8B;QACxC,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,IAAI,eAAe,EAAE,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CAAC,OAA0B,EAAE,OAAwB;QAChE,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChD,MAAM,OAAO,GAA0B;gBACrC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI;gBAC9C,kBAAkB,EAAE,CAAC,OAAO,CAAC,QAAQ;gBACrC,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,SAAS;aACtB,CAAC;YAEF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAmC,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;YAClE,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC9B,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YAC5B,CAAC;YACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YAC1C,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YAC5B,CAAC;YAED,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;YAC1B,CAAC;YAED,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;gBACzB,OAAmC,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;YACvF,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC9E,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;gBACzB,OAAmC,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC;gBACpE,OAAO,CAAC,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAChE,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAChE,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YACpD,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAoB,CAAC;YAChD,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACvE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;YAClC,CAAC;YAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;YAE5C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAEpC,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,KAAgD,CAAC;YAErD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,OAAO,GAAG,IAAI,CAAC;wBACf,MAAM,CAAC,OAAO,EAAE,CAAC;wBACjB,MAAM,CAAC,IAAI,QAAQ,CAAC,yBAAyB,CAAC,CAAC,CAAC;oBAClD,CAAC;gBACH,CAAC,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,GAAG,EAAE;oBACnB,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,OAAO,GAAG,IAAI,CAAC;wBACf,IAAI,KAAK;4BAAE,YAAY,CAAC,KAAK,CAAC,CAAC;wBAC/B,MAAM,CAAC,OAAO,EAAE,CAAC;wBACjB,MAAM,CAAC,IAAI,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC;oBACjD,CAAC;gBACH,CAAC,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC3B,OAAO,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE;gBAChC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAE/B,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;oBAC5B,IAAI,CAAC;wBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;wBACjD,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;4BAC7B,qBAAqB,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;wBAC/D,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,OAAO,EAAE,CAAC;wBACjB,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;wBAC/D,OAAO;oBACT,CAAC;gBACH,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;gBAEnC,MAAM,cAAc,GAAsB;oBACxC,OAAO,EAAE,KAAK,IAAI,SAAS;oBAC3B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;oBACzC,MAAM,EAAE,MAAM,EAAE,IAAI,IAAI,SAAS;oBACjC,OAAO,EAAE,MAAM,CAAC,eAAe,EAAE;iBAClC,CAAC;gBAEF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAe,EAAE,EAAE;oBACvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS,CAAC,CAAC;gBACtF,CAAC,CAAC,CAAC;gBAEH,MAAM,SAAS,GAAc,MAAM,CAAC,MAAM,CAAC,MAA2B,EAAE;oBACtE,cAAc;oBACd,UAAU;wBACR,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,CAAC;iBACF,CAAc,CAAC;gBAEhB,OAAO,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;gBAClC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC/B,MAAM,CAAC,GAAG,GAAkD,CAAC;gBAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC;gBACvG,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/tls/pin-verification.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Verifies that the leaf certificate's SPKI SHA-256 hash matches at least
+ * one of the supplied pins. Throws {@link TLSError} on mismatch.
+ *
+ * @param certDer  DER-encoded leaf certificate bytes.
+ * @param pins     One or more pins in `"sha256//base64hash"` format.
+ */
+export declare function verifyPinnedPublicKey(certDer: Buffer, pins: string | string[]): void;
+//# sourceMappingURL=pin-verification.d.ts.map

package/dist/tls/pin-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin-verification.d.ts","sourceRoot":"","sources":["../../src/tls/pin-verification.ts"],"names":[],"mappings":"AAUA;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAiBpF"}

package/dist/tls/pin-verification.js

@@ -0,0 +1,34 @@
+/**
+ * Certificate public key pinning (RFC 7469 concept, curl-style format).
+ *
+ * Verifies that a server's leaf certificate matches one of a set of
+ * SHA-256 hashes computed over the DER-encoded Subject Public Key Info
+ * (SPKI). Pin format: `"sha256//base64hash"` (same as curl `--pinnedpubkey`).
+ */
+import { createHash, X509Certificate } from "node:crypto";
+import { TLSError } from "../core/errors.js";
+/**
+ * Verifies that the leaf certificate's SPKI SHA-256 hash matches at least
+ * one of the supplied pins. Throws {@link TLSError} on mismatch.
+ *
+ * @param certDer  DER-encoded leaf certificate bytes.
+ * @param pins     One or more pins in `"sha256//base64hash"` format.
+ */
+export function verifyPinnedPublicKey(certDer, pins) {
+    const pinArray = typeof pins === "string" ? [pins] : pins;
+    if (pinArray.length === 0)
+        return;
+    const x509 = new X509Certificate(certDer);
+    const spki = Buffer.from(x509.publicKey.export({ type: "spki", format: "der" }));
+    const hash = createHash("sha256").update(spki).digest("base64");
+    const certPin = `sha256//${hash}`;
+    const matches = pinArray.some((pin) => {
+        if (!pin.startsWith("sha256//"))
+            return false;
+        return pin === certPin;
+    });
+    if (!matches) {
+        throw new TLSError(`Certificate public key pin mismatch. Server pin: ${certPin}`);
+    }
+}
+//# sourceMappingURL=pin-verification.js.map

package/dist/tls/pin-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin-verification.js","sourceRoot":"","sources":["../../src/tls/pin-verification.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,IAAuB;IAC5E,MAAM,QAAQ,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,WAAW,IAAI,EAAE,CAAC;IAElC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACpC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,OAAO,GAAG,KAAK,OAAO,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,oDAAoD,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC"}