add send/post test dart

* update icons android

* remove comment

.clang-format

@@ -0,0 +1,39 @@
+BasedOnStyle: WebKit
+AccessModifierOffset: '-4'
+AlignAfterOpenBracket: Align
+AlignConsecutiveMacros: 'true'
+AlignTrailingComments: 'true'
+AllowAllArgumentsOnNextLine: 'true'
+AllowAllParametersOfDeclarationOnNextLine: 'true'
+AllowShortBlocksOnASingleLine: 'false'
+AllowShortCaseLabelsOnASingleLine: 'true'
+AllowShortEnumsOnASingleLine: 'false'
+AllowShortFunctionsOnASingleLine: None
+AlwaysBreakTemplateDeclarations: 'No'
+BreakBeforeBinaryOperators: NonAssignment
+BreakBeforeBraces: Custom
+BraceWrapping:
+    AfterClass: true
+    AfterControlStatement: false
+    AfterEnum: false
+    AfterFunction: true
+    AfterNamespace: true
+    AfterObjCDeclaration: false
+    AfterStruct: true
+    AfterUnion: false
+    BeforeCatch: false
+    BeforeElse: false
+    IndentBraces: false
+BreakConstructorInitializers: BeforeColon
+ColumnLimit: '120'
+CommentPragmas: '"^!|^:"'
+ConstructorInitializerAllOnOneLineOrOnePerLine: 'true'
+ConstructorInitializerIndentWidth: '4'
+ContinuationIndentWidth: '8'
+IndentPPDirectives: BeforeHash
+NamespaceIndentation: All
+PenaltyExcessCharacter: '10'
+PointerAlignment: Right
+SortIncludes: 'true'
+SpaceAfterTemplateKeyword: 'false'
+Standard: Auto

.clang-format-ignore

@@ -0,0 +1,20 @@
+/client/3rd
+/client/3rd-prebuild
+/client/android
+/client/cmake
+/client/core/utils/serialization
+/client/daemon
+/client/fonts
+/client/images
+/client/ios
+/client/mozilla
+/client/platforms/dummy
+/client/platforms/linux
+/client/platforms/macos
+/client/platforms/windows
+/client/server_scripts
+/client/translations
+/deploy
+/docs
+/metadata
+/service/src

.gitattributes

@@ -0,0 +1,6 @@
+deploy/data/windows/x64/tap/windows_7/OemVista.inf eol=crlf
+deploy/data/windows/x64/tap/windows_10/OemVista.inf eol=crlf
+deploy/data/windows/x32/tap/windows_7/OemVista.inf eol=crlf
+deploy/data/windows/x32/tap/windows_10/OemVista.inf eol=crlf
+client/3rd/* linguist-vendored
+client/android/gradlew.bat eol=crlf

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,42 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Log files**
+Attach log files to help explain your problem.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Desktop (please complete the following information):**
+ - OS: [e.g. Windows 10]
+ - Version [e.g. 2.1.2]
+
+**Smartphone (please complete the following information):**
+ - Device: [e.g. iPhone6]
+ - OS: [e.g. iOS8.1]
+ - Version [e.g. 2.1.2]
+
+**Server (please complete the following information):**
+ - OS: [e.g. Ubuntu 22.04]
+
+**Additional context**
+Add any other context about the problem here.

.github/actions/apple-install-cert/action.yml

@@ -0,0 +1,38 @@
+# .github/actions/apple-install-cert/action.yml
+
+name: Setup apple keychain
+description: Creates and configures a temporary build keychain
+
+inputs:
+  keychain-path:
+    description: Path to the keychain
+    required: true
+  keychain-password:
+    description: Password to the keychain
+    required: true
+  cert-base64:
+    description: Base64-encoded certificate
+    required: true
+  cert-password:
+    description: Certificate password
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Create keychain
+      shell: bash
+      env:
+        KEYCHAIN_PATH: ${{ inputs.keychain-path }}
+        KEYCHAIN_PASSWORD: ${{ inputs.keychain-password }}
+        CERT_BASE64: ${{ inputs.cert-base64 }}
+        CERT_PASSWORD: ${{ inputs.cert-password }}
+      run: |
+        CERT_PATH=$(mktemp /tmp/cert_XXXXXX.p12)
+        trap "rm -f '$CERT_PATH'" EXIT
+
+        echo -n "$CERT_BASE64" | base64 --decode -o "$CERT_PATH"
+
+        security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+        security import "$CERT_PATH" -k "$KEYCHAIN_PATH" -P "$CERT_PASSWORD" -A -t cert -f pkcs12
+        security set-key-partition-list -S apple-tool:,apple:,codesign: -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

.github/actions/apple-setup-keychain/action.yml

@@ -0,0 +1,57 @@
+# .github/actions/apple-setup-keychain/action.yml
+
+name: Setup apple keychain
+description: Creates and configures a temporary build keychain
+
+inputs:
+  keychain-name:
+    description: Name of the keychain
+    required: false
+    default: "ci-amnezia"
+  keychain-password:
+    description: The keychain password
+    required: true
+  lock-timeout:
+    description: A timeout after exceeding which the keychain would be locked
+    required: false
+    default: "0"
+
+outputs:
+  keychain-path:
+    description: "Full path to the keychain created"
+    value: ${{ steps.setup.outputs.keychain-path }}
+  keychain-name:
+    description: "Actual name of the keychain created"
+    value: ${{ steps.setup.outputs.keychain-name }}
+
+runs:
+  using: composite
+  steps:
+    - name: Setup keychain
+      id: setup
+      shell: bash
+      env:
+        KEYCHAIN_NAME: ${{ inputs.keychain-name }}
+        KEYCHAIN_PASSWORD: ${{ inputs.keychain-password }}
+        LOCK_TIMEOUT: ${{ inputs.lock-timeout }}
+      run: |
+        KEYCHAIN_PATH="$HOME/Library/Keychains/$KEYCHAIN_NAME.keychain-db"
+
+        security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+
+        if [[ "$LOCK_TIMEOUT" == "0" ]]; then
+          security set-keychain-settings "$KEYCHAIN_PATH"
+        else
+          security set-keychain-settings -u -t "$LOCK_TIMEOUT" "$KEYCHAIN_PATH"
+        fi
+
+        security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+
+        security import "${{ github.action_path }}/DeveloperIDG2CA.cer" -k "$KEYCHAIN_PATH" -A
+        security import "${{ github.action_path }}/AppleWWDRCAG3.cer" -k "$KEYCHAIN_PATH" -A
+
+        security list-keychains -d user -s "$KEYCHAIN_PATH"
+        security default-keychain -s "$KEYCHAIN_PATH"
+
+        echo "keychain-name=$KEYCHAIN_NAME" >> $GITHUB_OUTPUT
+        echo "keychain-path=$KEYCHAIN_PATH" >> $GITHUB_OUTPUT

.github/actions/apple-setup-provisioning-profile/action.yml

@@ -0,0 +1,31 @@
+# .github/actions/apple-setup-provisioning-profile/action.yml
+
+name: Setup provisioning profiles
+description: Decodes and installs provisioning profiles
+
+inputs:
+  provisioning_profile_base64:
+    description: Base64-encoded provisioning profile
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Setup provisioning profile
+      shell: bash
+      run: |
+        PROFILES_DIR="$HOME/Library/MobileDevice/Provisioning Profiles"
+        TEMP_FILE=$(mktemp)
+
+        echo "${{ inputs.provisioning_profile_base64 }}" | base64 --decode > "$TEMP_FILE"
+
+        PROFILE_UUID=$(grep UUID -A1 -a "$TEMP_FILE" | grep -io "[-A-F0-9]\{36\}")
+        if [[ -z "$PROFILE_UUID" ]]; then
+          echo "Failed to extract UUID from provisioning profile"
+          rm -f "$TEMP_FILE"
+          exit 1
+        fi
+
+        mkdir -p "$PROFILES_DIR"
+        mv "$TEMP_FILE" "$PROFILES_DIR/$PROFILE_UUID.mobileprovision"
+        echo "Installed profile: $PROFILE_UUID"

.github/workflows/deploy.yml

@@ -0,0 +1,923 @@
+name: 'Deploy workflow'
+
+on:
+  push:
+    branches:
+      - '**'
+
+env:
+  QT_MIRROR: https://mirrors.ocf.berkeley.edu/qt/ # https://download.qt.io/static/mirrorlist/
+
+jobs:
+  Detect-Changes:
+    runs-on: ubuntu-latest
+    outputs:
+      recipes_changed: ${{ steps.filter.outputs.recipes }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            recipes:
+              - 'recipes/**'
+              - 'conanfile.py'
+              - '.github/workflows/deploy.yml'
+              - 'cmake/conan_provider.cmake'
+              - 'cmake/platform_settings.cmake'
+              - 'cmake/recipes_bootstrap.cmake'
+
+  Bake-Prebuilts-Linux:
+    runs-on: ubuntu-latest
+    needs: Detect-Changes
+    if: needs.Detect-Changes.outputs.recipes_changed == 'true'
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: 'true'
+        fetch-depth: 10
+
+    - uses: actions/setup-python@v6
+      with:
+        python-version: 3.14
+
+    - name: 'Install conan'
+      run: pip install "conan==2.28.0"
+
+    - name: 'Build dependencies'
+      shell: bash
+      run: |
+        for build_type in Release Debug; do
+          cmake -S . -B build -DPREBUILTS_ONLY=1 "-DCMAKE_BUILD_TYPE=$build_type"
+        done
+
+    - name: 'Authorize in remote'
+      if: github.ref == 'refs/heads/dev'
+      run: conan remote login amnezia "${{ secrets.CONAN_USER }}" -p "${{ secrets.CONAN_PASSWORD }}"
+
+    - name: 'Upload baked prebuilts'
+      if: github.ref == 'refs/heads/dev'
+      run: conan upload -r amnezia "*" -c
+
+# ------------------------------------------------------
+
+  Build-Linux-Ubuntu:
+    runs-on: android-runner
+
+    needs: Bake-Prebuilts-Linux
+    if: ${{ always() }}
+
+    env:
+      QT_VERSION: 6.10.1
+      QIF_VERSION: 4.7
+      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
+      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
+      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
+      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
+      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
+      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
+      FREE_V2_ENDPOINT: ${{ secrets.FREE_V2_ENDPOINT }}
+      PREM_V1_ENDPOINT: ${{ secrets.PREM_V1_ENDPOINT }}
+
+    steps:
+    - name: 'Install Qt'
+      uses: jurplel/install-qt-action@v3
+      with:
+        version: ${{ env.QT_VERSION }}
+        host: 'linux'
+        target: 'desktop'
+        arch: 'linux_gcc_64'
+        modules: 'qtremoteobjects qt5compat qtshadertools'
+        dir: ${{ runner.temp }}
+        setup-python: 'true'
+        tools: 'tools_ifw'
+        set-env: 'true'
+        aqtversion: '==3.3.0'       
+        py7zrversion: '==0.22.*'  
+        extra: '--base ${{ env.QT_MIRROR }}'
+
+    - name: 'Setup python'
+      uses: actions/setup-python@v6
+      with:
+        python-version: 3.14
+      
+    - name: 'Install conan'
+      run: pip install "conan==2.28.0"
+
+    - name: 'Install system packages'
+      run: sudo apt-get install libxkbcommon-x11-0 libsecret-1-dev
+
+    - name: 'Get sources'
+      uses: actions/checkout@v4
+      with:
+        submodules: 'true'
+        fetch-depth: 10
+
+    - name: 'Build project'
+      shell: bash
+      env:
+        QT_INSTALL_DIR: ${{ runner.temp }}
+      run: deploy/build.sh --generator Ninja --installer all
+
+    - name: 'Upload installer artifact'
+      uses: actions/upload-artifact@v7
+      with:
+        path: deploy/build/AmneziaVPN_*_linux_x64.run
+        archive: false
+        retention-days: 7
+
+    - name: 'Upload translations artifact'
+      uses: actions/upload-artifact@v4
+      with:
+        name: AmneziaVPN_translations
+        path: client/translations
+        retention-days: 7
+
+# ------------------------------------------------------
+
+  Bake-Prebuilts-Windows:
+    runs-on: windows-latest
+    needs: Detect-Changes
+    if: needs.Detect-Changes.outputs.recipes_changed == 'true'
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: 'true'
+        fetch-depth: 10
+    
+    - uses: actions/setup-python@v6
+      with:
+        python-version: 3.14
+
+    - uses: ilammy/msvc-dev-cmd@v1
+
+    - name: 'Install conan'
+      run: pip install "conan==2.28.0"
+
+    - name: 'Build dependencies'
+      run: cmake -S . -B build -DPREBUILTS_ONLY=1
+    
+    - name: 'Authorize in remote'
+      if: github.ref == 'refs/heads/dev'
+      run: conan remote login amnezia "${{ secrets.CONAN_USER }}" -p "${{ secrets.CONAN_PASSWORD }}"
+
+    - name: 'Upload baked prebuilts'
+      if: github.ref == 'refs/heads/dev'
+      run: conan upload -r amnezia "*" -c
+
+# ------------------------------------------------------
+
+  Build-Windows:
+    runs-on: windows-latest
+
+    needs: Bake-Prebuilts-Windows
+    if: ${{ always() }}
+
+    env:
+      QT_VERSION: 6.10.1
+      QIF_VERSION: 4.7
+      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
+      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
+      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
+      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
+      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
+      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
+      FREE_V2_ENDPOINT: ${{ secrets.FREE_V2_ENDPOINT }}
+      PREM_V1_ENDPOINT: ${{ secrets.PREM_V1_ENDPOINT }}
+
+    steps:
+    - name: 'Get sources'
+      uses: actions/checkout@v4
+      with:
+        submodules: 'true'
+        fetch-depth: 10
+
+    - name: 'Install Qt'
+      uses: jurplel/install-qt-action@v3
+      with:
+        version: ${{ env.QT_VERSION }}
+        host: 'windows'
+        target: 'desktop'
+        arch: 'win64_msvc2022_64'
+        modules: 'qtremoteobjects qt5compat qtshadertools'
+        dir: ${{ runner.temp }}
+        setup-python: 'true'
+        tools: 'tools_ifw'
+        set-env: 'true'
+        aqtversion: '==3.3.0'       
+        py7zrversion: '==0.22.*'  
+        extra: '--base ${{ env.QT_MIRROR }}' 
+
+    - name: 'Setup mvsc'
+      uses: ilammy/msvc-dev-cmd@v1
+      with:
+        arch: 'x64'
+
+    - name: 'Setup .NET SDK'
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: '8.0.x'
+
+    - name: 'Install WiX Toolset'
+      shell: powershell
+      run: |
+        dotnet tool install --global wix --version 4.0.6
+        wix extension add -g WixToolset.UI.wixext/4.0.6
+        wix extension add -g WixToolset.Util.wixext/4.0.6
+        wix extension list -g
+        $wixBinDir = Join-Path $env:USERPROFILE ".dotnet\tools"
+        echo "WIX_BIN_DIR=$wixBinDir" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+    - name: 'Setup python'
+      uses: actions/setup-python@v6
+      with:
+        python-version: 3.14
+
+    - name: 'Install conan'
+      run: pip install "conan==2.28.0"
+
+    - name: 'Build project'
+      shell: cmd
+      env:
+        QT_INSTALL_DIR: ${{ runner.temp }}
+      run: |
+        set WIX_ROOT_PATH="${{ env.USERPROFILE }}\.dotnet\tools"
+        deploy\build.bat --installer all
+
+    - name: 'Upload WIX installer artifact'
+      uses: actions/upload-artifact@v7
+      with:
+        path: deploy/build/AmneziaVPN_*_windows_x64.msi
+        archive: false
+        retention-days: 7
+      
+    - name: 'Upload IFW installer artifact'
+      uses: actions/upload-artifact@v7
+      with:
+        path: deploy/build/AmneziaVPN_*_windows_x64.exe
+        archive: false
+        retention-days: 7
+
+# ------------------------------------------------------
+
+  Bake-Prebuilts-iOS:
+    needs: Detect-Changes
+    if: needs.Detect-Changes.outputs.recipes_changed == 'true'
+
+    strategy:
+      matrix:
+        xcode-version: [26.0, 26.4]
+        include:
+          - xcode-version: 26.4
+            os: macos-26
+
+    runs-on: ${{ matrix.os || 'macos-latest' }}
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: 'true'
+        fetch-depth: 10
+    
+    - uses: actions/setup-python@v6
+      with:
+        python-version: 3.14
+
+    - uses: maxim-lobanov/setup-xcode@v1
+      with:
+        xcode-version: ${{ matrix.xcode-version }}
+
+    - name: 'Install conan'
+      run: pip install "conan==2.28.0"
+
+    - name: 'Build dependencies'
+      run: cmake -S . -B build -G Xcode -DPREBUILTS_ONLY=1 -DCMAKE_SYSTEM_NAME=iOS -DCMAKE_OSX_SYSROOT=iphoneos
+    
+    - name: 'Authorize in remote'
+      if: github.ref == 'refs/heads/dev'
+      run: conan remote login amnezia "${{ secrets.CONAN_USER }}" -p "${{ secrets.CONAN_PASSWORD }}"
+
+    - name: 'Upload baked prebuilts'
+      if: github.ref == 'refs/heads/dev'
+      run: conan upload -r amnezia "*" -c
+
+# ------------------------------------------------------
+
+  Build-iOS:
+    runs-on: macos-latest
+
+    needs: Bake-Prebuilts-iOS
+    if: ${{ always() }}
+
+    env:
+      QT_VERSION: 6.10.1
+      KEYCHAIN_PASSWORD: ""
+
+      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
+      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
+      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
+      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
+      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
+      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
+      FREE_V2_ENDPOINT: ${{ secrets.FREE_V2_ENDPOINT }}
+      PREM_V1_ENDPOINT: ${{ secrets.PREM_V1_ENDPOINT }}
+
+    steps:
+    - name: 'Get sources'
+      uses: actions/checkout@v4
+      with:
+        submodules: 'true'
+        fetch-depth: 10
+
+    - uses: ./.github/actions/apple-setup-keychain
+      id: setup-keychain
+      with:
+        keychain-password: ${{ env.KEYCHAIN_PASSWORD }}
+
+    - name: 'Install signing certificate'
+      uses: ./.github/actions/apple-install-cert
+      with:
+        keychain-path: ${{ steps.setup-keychain.outputs.keychain-path }}
+        keychain-password: ${{ env.KEYCHAIN_PASSWORD }}
+        cert-base64: ${{ secrets.IOS_SIGNING_CERT_BASE64 }}
+        cert-password: ${{ secrets.IOS_SIGNING_CERT_PASSWORD }}
+
+    - name: 'Install app provisioning profile'
+      uses: ./.github/actions/apple-setup-provisioning-profile
+      with:
+        provisioning_profile_base64: ${{ secrets.IOS_APP_PROVISIONING_PROFILE }}
+
+    - name: 'Install NE provisioning profile'
+      uses: ./.github/actions/apple-setup-provisioning-profile
+      with:
+        provisioning_profile_base64: ${{ secrets.IOS_NE_PROVISIONING_PROFILE }}
+
+    - name: 'Setup xcode'
+      uses: maxim-lobanov/setup-xcode@v1
+      with:
+        xcode-version: '26.0'
+
+    - name: 'Install desktop Qt'
+      uses: jurplel/install-qt-action@v3
+      with:
+        version: ${{ env.QT_VERSION }}
+        host: 'mac'
+        target: 'desktop'
+        modules: 'qtremoteobjects qt5compat qtshadertools qtmultimedia'
+        arch: 'clang_64'
+        dir: ${{ runner.temp }}
+        set-env: 'true'
+        extra: '--base ${{ env.QT_MIRROR }}'
+
+    - name: 'Install iOS Qt'
+      uses: jurplel/install-qt-action@v3
+      with:
+        version: ${{ env.QT_VERSION }}
+        host: 'mac'
+        target: 'ios'
+        modules: 'qtremoteobjects qt5compat qtshadertools qtmultimedia'
+        dir: ${{ runner.temp }}
+        setup-python: 'true'
+        set-env: 'true'
+        extra: '--external 7z --base ${{ env.QT_MIRROR }}'
+
+    - name: 'Setup python'
+      uses: actions/setup-python@v6
+      with:
+        python-version: 3.14
+
+    - name: 'Install deps'
+      run: pip install "conan==2.28.0" jsonschema jinja2
+
+    - name: 'Build project'
+      env:
+        QT_INSTALL_DIR: ${{ runner.temp }}
+        APPSTORE_CONNECT_KEY_ID: ${{ secrets.APPSTORE_CONNECT_KEY_ID }}
+        APPSTORE_CONNECT_ISSUER_ID: ${{ secrets.APPSTORE_CONNECT_ISSUER_ID }}
+        APPSTORE_CONNECT_PRIVATE_KEY: ${{ secrets.APPSTORE_CONNECT_PRIVATE_KEY }}
+      run: |
+        sh deploy/build.sh -t ios | \
+          sed -e '/-Xcc -DPROD_AGW_PUBLIC_KEY/,/-Xcc/ { /-Xcc/!d; }' -e '/-Xcc -DPROD_AGW_PUBLIC_KEY/d' | \
+          sed -e '/-Xcc -DDEV_AGW_PUBLIC_KEY/,/-Xcc/ { /-Xcc/!d; }' -e '/-Xcc -DDEV_AGW_PUBLIC_KEY/d' | \
+          sed -e '/-DPROD_AGW_PUBLIC_KEY/,/-D/ { /-D/!d; }' -e '/-DPROD_AGW_PUBLIC_KEY/d' | \
+          sed -e '/-DDEV_AGW_PUBLIC_KEY/,/-D/ { /-D/!d; }' -e '/-DDEV_AGW_PUBLIC_KEY/d'
+
+# ------------------------------------------------------
+
+  Bake-Prebuilts-MacOS:
+    needs: Detect-Changes
+    if: needs.Detect-Changes.outputs.recipes_changed == 'true'
+
+    strategy:
+      matrix:
+        xcode-version: [16.2, 16.4, 26.4]
+        include:
+          - xcode-version: 26.4
+            os: macos-26
+
+    runs-on: ${{ matrix.os || 'macos-latest' }}
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: 'true'
+        fetch-depth: 10
+    
+    - uses: actions/setup-python@v6
+      with:
+        python-version: 3.14
+
+    - uses: maxim-lobanov/setup-xcode@v1
+      with:
+        xcode-version: ${{ matrix.xcode-version }}
+
+    - name: 'Install conan'
+      run: pip install "conan==2.28.0"
+
+    - name: 'Build dependencies'
+      run: cmake -S . -B build -G Xcode -DPREBUILTS_ONLY=1
+    
+    - name: 'Authorize in remote'
+      if: github.ref == 'refs/heads/dev'
+      run: conan remote login amnezia "${{ secrets.CONAN_USER }}" -p "${{ secrets.CONAN_PASSWORD }}"
+
+    - name: 'Upload baked prebuilts'
+      if: github.ref == 'refs/heads/dev'
+      run: conan upload -r amnezia "*" -c
+
+# ------------------------------------------------------
+
+  Build-MacOS:
+    runs-on: macos-latest
+
+    needs: Bake-Prebuilts-MacOS
+    if: ${{ always() }}
+
+    env:
+      QT_VERSION: 6.10.1
+      KEYCHAIN_PASSWORD: ""
+
+      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
+      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
+      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
+      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
+      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
+      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
+      FREE_V2_ENDPOINT: ${{ secrets.FREE_V2_ENDPOINT }}
+      PREM_V1_ENDPOINT: ${{ secrets.PREM_V1_ENDPOINT }}
+
+    steps:
+    - name: 'Get sources'
+      uses: actions/checkout@v4
+      with:
+        submodules: 'true'
+        fetch-depth: 10
+
+    - uses: ./.github/actions/apple-setup-keychain
+      id: setup-keychain
+      with:
+        keychain-password: ${{ env.KEYCHAIN_PASSWORD }}
+
+    - uses: ./.github/actions/apple-install-cert
+      with:
+        keychain-path: ${{ steps.setup-keychain.outputs.keychain-path }}
+        keychain-password: ${{ env.KEYCHAIN_PASSWORD }}
+        cert-base64: ${{ secrets.MAC_APP_CERT_CERT }}
+        cert-password: ${{ secrets.MAC_APP_CERT_PW }}
+
+    - uses: ./.github/actions/apple-install-cert
+      with:
+        keychain-path: ${{ steps.setup-keychain.outputs.keychain-path }}
+        keychain-password: ${{ env.KEYCHAIN_PASSWORD }}
+        cert-base64: ${{ secrets.MAC_INSTALLER_SIGNER_CERT }}
+        cert-password: ${{ secrets.MAC_INSTALL_CERT_PW }}
+
+    - name: 'Setup xcode'
+      uses: maxim-lobanov/setup-xcode@v1
+      with:
+        xcode-version: '16.2.0'
+
+    - name: 'Install Qt'
+      uses: jurplel/install-qt-action@v4
+      with:
+        version: ${{ env.QT_VERSION }}
+        host: 'mac'
+        target: 'desktop'
+        arch: 'clang_64'
+        modules: 'qtremoteobjects qt5compat qtshadertools'
+        dir: ${{ runner.temp }}
+        setup-python: 'true'
+        set-env: 'true'
+        aqtversion: '==3.3.0'       
+        py7zrversion: '==0.22.*'  
+        extra: '--base ${{ env.QT_MIRROR }}'
+
+    - name: 'Setup python'
+      uses: actions/setup-python@v6
+      with:
+        python-version: 3.14
+
+    - name: 'Install conan'
+      run: pip install "conan==2.28.0"
+
+    - name: 'Build project'
+      env:
+        QT_INSTALL_DIR: ${{ runner.temp }}
+        CODESIGN_SIGNATURE: ${{ secrets.MAC_SIGNER_ID }}
+        CODESIGN_INSTALLER_SIGNATURE: ${{ secrets.MAC_INSTALLER_SIGNER_ID }}
+        NOTARYTOOL_TEAM_ID: ${{ secrets.MAC_TEAM_ID }}
+        NOTARYTOOL_EMAIL: ${{ secrets.APPLE_DEV_EMAIL }}
+        NOTARYTOOL_PASSWORD: ${{ secrets.APPLE_DEV_PASSWORD }}
+      shell: bash
+      run: deploy/build.sh --generator Ninja --installer all
+
+    - name: 'Upload installer artifact'
+      uses: actions/upload-artifact@v7
+      with:
+        path: deploy/build/AmneziaVPN_*_macos_x64.pkg
+        archive: false
+        retention-days: 7
+
+# ------------------------------------------------------
+
+  Bake-Prebuilts-MacOS-NE:
+    needs: Detect-Changes
+    if: needs.Detect-Changes.outputs.recipes_changed == 'true'
+
+    strategy:
+      matrix:
+        xcode-version: [16.2, 16.4, 26.4]
+        include:
+          - xcode-version: 26.4
+            os: macos-26
+
+    runs-on: ${{ matrix.os || 'macos-latest' }}
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: 'true'
+        fetch-depth: 10
+    
+    - uses: actions/setup-python@v6
+      with:
+        python-version: 3.14
+
+    - uses: maxim-lobanov/setup-xcode@v1
+      with:
+        xcode-version: ${{ matrix.xcode-version }}
+
+    - name: 'Install conan'
+      run: pip install "conan==2.28.0"
+
+    - name: 'Build dependencies'
+      run: cmake -S . -B build -G Xcode -DPREBUILTS_ONLY=1 -DMACOS_NE=TRUE
+    
+    - name: 'Authorize in remote'
+      if: github.ref == 'refs/heads/dev'
+      run: conan remote login amnezia "${{ secrets.CONAN_USER }}" -p "${{ secrets.CONAN_PASSWORD }}"
+
+    - name: 'Upload baked prebuilts'
+      if: github.ref == 'refs/heads/dev'
+      run: conan upload -r amnezia "*" -c
+
+# ------------------------------------------------------
+
+  Build-MacOS-NE:
+    runs-on: macos-latest
+
+    needs: Bake-Prebuilts-MacOS-NE
+    if: ${{ always() }}
+
+    env:
+      QT_VERSION: 6.10.1
+
+      MAC_TEAM_ID: ${{ secrets.MAC_TEAM_ID }}
+
+      MAC_APP_CERT_CERT: ${{ secrets.MAC_APP_CERT_CERT }}
+      MAC_SIGNER_ID: ${{ secrets.MAC_SIGNER_ID }}
+      MAC_APP_CERT_PW: ${{ secrets.MAC_APP_CERT_PW }}
+
+      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
+      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
+      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
+      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
+      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
+      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
+      FREE_V2_ENDPOINT: ${{ secrets.FREE_V2_ENDPOINT }}
+      PREM_V1_ENDPOINT: ${{ secrets.PREM_V1_ENDPOINT }}
+
+    steps:
+    - uses: ./.github/actions/apple-setup-provisioning-profile
+      with:
+        provisioning_profile_base64: ${{ secrets.MAC_APP_PROVISIONING_PROFILE }}
+
+    - uses: ./.github/actions/apple-setup-provisioning-profile
+      with:
+        provisioning_profile_base64: ${{ secrets.MAC_NE_PROVISIONING_PROFILE }}
+
+    - name: 'Setup xcode'
+      uses: maxim-lobanov/setup-xcode@v1
+      with:
+        xcode-version: '26.1'
+
+    - name: 'Install desktop Qt'
+      uses: jurplel/install-qt-action@v3
+      with:
+        version: ${{ env.QT_VERSION }}
+        host: 'mac'
+        target: 'desktop'
+        modules: 'qtremoteobjects qt5compat qtshadertools qtmultimedia'
+        arch: 'clang_64'
+        dir: ${{ runner.temp }}
+        set-env: 'true'
+        extra: '--base ${{ env.QT_MIRROR }}'
+
+    - name: 'Install go'
+      uses: actions/setup-go@v5
+      with:
+        go-version: '1.24'
+        cache: false
+
+    - name: 'Setup gomobile'
+      run: |
+          export PATH=$PATH:~/go/bin
+          go install golang.org/x/mobile/cmd/gomobile@latest
+          gomobile init
+
+    - name: 'Get sources'
+      uses: actions/checkout@v4
+      with:
+        submodules: 'true'
+        fetch-depth: 10
+
+    - name: 'Setup python'
+      uses: actions/setup-python@v6
+      with:
+        python-version: 3.14
+
+    - name: 'Install conan'
+      run: pip install "conan==2.28.0"
+
+    - name: 'Build project'
+      run: |
+        export QT_BIN_DIR="${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/macos/bin"
+        bash deploy/build_macos_ne.sh
+
+    - name: 'Upload unpacked artifact'
+      uses: actions/upload-artifact@v4
+      with:
+        name: AmneziaVPN_MacOS_unpacked
+        path: deploy/build/client/AmneziaVPN.app
+        retention-days: 7
+
+# ------------------------------------------------------
+
+  Bake-Prebuilts-Android:
+    runs-on: android-runner
+    needs: Detect-Changes
+    if: needs.Detect-Changes.outputs.recipes_changed == 'true'
+
+    env:
+      ANDROID_PLATFORM: android-28
+      NDK_VERSION: 27.0.11718014
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: 'true'
+        fetch-depth: 10
+    
+    - uses: actions/setup-python@v6
+      with:
+        python-version: 3.14
+
+    - name: 'Install conan'
+      run: pip install "conan==2.28.0"
+
+    - name: 'Setup Android SDK'
+      uses: android-actions/setup-android@v4
+      with:
+        packages: "platforms;${{ env.ANDROID_PLATFORM }} ndk;${{ env.NDK_VERSION }}"
+
+    - name: 'Build dependencies'
+      run: |
+        CMAKE_ANDROID_NDK="$ANDROID_HOME/ndk/$NDK_VERSION"
+        args=(
+          -G Ninja
+          -DPREBUILTS_ONLY=1
+          -DCMAKE_SYSTEM_NAME=Android
+          "-DANDROID_PLATFORM=$ANDROID_PLATFORM"
+          "-DCMAKE_ANDROID_NDK=$CMAKE_ANDROID_NDK"
+        )
+
+        for abi in arm64-v8a armeabi-v7a x86 x86_64; do
+          for build_type in Release Debug; do
+            cmake -S . -B build_${abi//-/_} "${args[@]}" "-DCMAKE_ANDROID_ARCH_ABI=$abi" "-DCMAKE_BUILD_TYPE=$build_type"
+          done
+        done
+
+    - name: 'Authorize in remote'
+      if: github.ref == 'refs/heads/dev'
+      run: conan remote login amnezia "${{ secrets.CONAN_USER }}" -p "${{ secrets.CONAN_PASSWORD }}"
+
+    - name: 'Upload baked prebuilts'
+      if: github.ref == 'refs/heads/dev'
+      run: conan upload -r amnezia "*" -c
+
+# ------------------------------------------------------
+
+  Build-Android:
+    runs-on: android-runner
+
+    needs: Bake-Prebuilts-Android
+    if: ${{ always() }}
+
+    env:
+      ANDROID_PLATFORM: android-28
+      NDK_VERSION: 27.0.11718014
+      QT_VERSION: 6.10.3
+      QT_MODULES: 'qtremoteobjects qt5compat qtimageformats qtshadertools'
+      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
+      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
+      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
+      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
+      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
+      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
+      FREE_V2_ENDPOINT: ${{ secrets.FREE_V2_ENDPOINT }}
+      PREM_V1_ENDPOINT: ${{ secrets.PREM_V1_ENDPOINT }}
+
+    steps:
+    - name: 'Get sources'
+      uses: actions/checkout@v4
+      with:
+        submodules: 'true'
+
+    - name: 'Install desktop Qt'
+      uses: jurplel/install-qt-action@v4
+      with:
+        version: ${{ env.QT_VERSION }}
+        host: 'linux'
+        target: 'desktop'
+        arch: 'linux_gcc_64'
+        modules: ${{ env.QT_MODULES }}
+        dir: ${{ runner.temp }}
+        py7zrversion: '==0.22.*'
+        extra: '--base ${{ env.QT_MIRROR }}'
+
+    - name: 'Install android_x86_64 Qt'
+      uses: jurplel/install-qt-action@v4
+      with:
+        version: ${{ env.QT_VERSION }}
+        host: 'linux'
+        target: 'android'
+        arch: 'android_x86_64'
+        modules: ${{ env.QT_MODULES }}
+        dir: ${{ runner.temp }}
+        py7zrversion: '==0.22.*'
+        extra: '--base ${{ env.QT_MIRROR }}'
+
+    - name: 'Install android_x86 Qt'
+      uses: jurplel/install-qt-action@v4
+      with:
+        version: ${{ env.QT_VERSION }}
+        host: 'linux'
+        target: 'android'
+        arch: 'android_x86'
+        modules: ${{ env.QT_MODULES }}
+        dir: ${{ runner.temp }}
+        py7zrversion: '==0.22.*'
+        extra: '--base ${{ env.QT_MIRROR }}'
+
+    - name: 'Install android_armv7 Qt'
+      uses: jurplel/install-qt-action@v4
+      with:
+        version: ${{ env.QT_VERSION }}
+        host: 'linux'
+        target: 'android'
+        arch: 'android_armv7'
+        modules: ${{ env.QT_MODULES }}
+        dir: ${{ runner.temp }}
+        py7zrversion: '==0.22.*'
+        extra: '--base ${{ env.QT_MIRROR }}'
+
+    - name: 'Install android_arm64_v8a Qt'
+      uses: jurplel/install-qt-action@v4
+      with:
+        version: ${{ env.QT_VERSION }}
+        host: 'linux'
+        target: 'android'
+        arch: 'android_arm64_v8a'
+        modules: ${{ env.QT_MODULES }}
+        dir: ${{ runner.temp }}
+        py7zrversion: '==0.22.*'
+        extra: '--base ${{ env.QT_MIRROR }}'
+
+    - name: 'Setup Java'
+      uses: actions/setup-java@v4
+      with:
+        distribution: 'temurin'
+        java-version: '17'
+
+    - name: 'Setup Android SDK'
+      uses: android-actions/setup-android@v4
+      with:
+        packages: "platforms;${{ env.ANDROID_PLATFORM }} ndk;${{ env.NDK_VERSION }}"
+
+    - name: 'Setup python'
+      uses: actions/setup-python@v6
+      with:
+        python-version: 3.14
+
+    - name: 'Install conan'
+      run: pip install "conan==2.28.0"
+
+    - name: 'Decode keystore secret to file'
+      env:
+        KEYSTORE_BASE64: ${{ secrets.ANDROID_RELEASE_KEYSTORE_BASE64 }}
+      shell: bash
+      run: |
+        echo $KEYSTORE_BASE64 | base64 --decode > android.keystore
+
+    - name: 'Build project'
+      env:
+        QT_INSTALL_DIR: ${{ runner.temp }}
+        QT_ANDROID_KEYSTORE_PATH: ${{ github.workspace }}/android.keystore
+        QT_ANDROID_KEYSTORE_ALIAS: ${{ secrets.ANDROID_RELEASE_KEYSTORE_KEY_ALIAS }}
+        QT_ANDROID_KEYSTORE_STORE_PASS: ${{ secrets.ANDROID_RELEASE_KEYSTORE_KEY_PASS }}
+      shell: bash
+      run: |
+        deploy/build.sh -t android --sign --aab
+
+        VERSION=$(grep CMAKE_PROJECT_VERSION:STATIC deploy/build/CMakeCache.txt | cut -d= -f2)
+
+        (cd deploy/build/client/android-build && mv AmneziaVPN.apk AmneziaVPN_${VERSION}_android9+_universal.apk)
+        (cd deploy/build/client/android-build/build/outputs/bundle/release && mv android-build-release.aab AmneziaVPN_${VERSION}.aab)
+
+        for abi in arm64-v8a armeabi-v7a x86 x86_64; do
+          deploy/build.sh -t android --sign --abi ${abi} --build ./deploy/build/${abi}
+          (cd deploy/build/${abi}/client/android-build && mv AmneziaVPN.apk AmneziaVPN_${VERSION}_android9+_${abi}.apk)
+        done
+
+    - name: 'Upload universal APK'
+      uses: actions/upload-artifact@v7
+      with:
+        path: deploy/build/client/android-build/*.apk
+        archive: false
+        retention-days: 7
+
+    - name: 'Upload AAB'
+      uses: actions/upload-artifact@v7
+      with:
+        path: deploy/build/client/android-build/build/outputs/bundle/release/*.aab
+        archive: false
+        retention-days: 7
+
+    - name: 'Upload arm64-v8a APK'
+      uses: actions/upload-artifact@v7
+      with:
+        path: deploy/build/arm64-v8a/client/android-build/*.apk
+        archive: false
+        retention-days: 7
+
+    - name: 'Upload armeabi-v7a APK'
+      uses: actions/upload-artifact@v7
+      with:
+        path: deploy/build/armeabi-v7a/client/android-build/*.apk
+        archive: false
+        retention-days: 7
+
+    - name: 'Upload x86 APK'
+      uses: actions/upload-artifact@v7
+      with:
+        path: deploy/build/x86/client/android-build/*.apk
+        archive: false
+        retention-days: 7
+
+    - name: 'Upload x86_64 APK'
+      uses: actions/upload-artifact@v7
+      with:
+        path: deploy/build/x86_64/client/android-build/*.apk
+        archive: false
+        retention-days: 7
+
+  Extra:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Search a corresponding PR
+        uses: octokit/request-action@v2.x
+        id: pull_request
+        with:
+          route: GET /repos/${{ github.repository }}/pulls
+          head: ${{ github.repository_owner }}:${{ github.ref_name }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Add PR link to build summary
+        if: ${{ fromJSON(steps.pull_request.outputs.data)[0].number != '' }}
+        run: | 
+          echo "Pull request:" >> $GITHUB_STEP_SUMMARY
+          echo "[[#${{ fromJSON(steps.pull_request.outputs.data)[0].number }}] ${{ fromJSON(steps.pull_request.outputs.data)[0].title }}](${{ fromJSON(steps.pull_request.outputs.data)[0].html_url }})" >> $GITHUB_STEP_SUMMARY
+

.github/workflows/tag-deploy.yml

@@ -0,0 +1,150 @@
+name: 'Release deploy workflow'
+
+on: 
+  workflow_dispatch:
+  # push:
+  # tags:
+  #   - **
+
+jobs:
+
+  Build-Android-Release:
+    name: 'Build-Android-Release'
+    runs-on: ubuntu-latest
+
+    env:
+      QT_VERSION: 6.4.1
+      QIF_VERSION: 4.5
+      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
+      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
+      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
+      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
+      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
+      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
+      FREE_V2_ENDPOINT: ${{ secrets.FREE_V2_ENDPOINT }}
+      PREM_V1_ENDPOINT: ${{ secrets.PREM_V1_ENDPOINT }}
+
+    steps:
+    - name: 'Install desktop Qt'
+      uses: jurplel/install-qt-action@v3
+      with:
+        version: ${{ env.QT_VERSION }}
+        host: 'linux'
+        target: 'desktop'
+        arch: 'gcc_64'
+        modules: 'qtremoteobjects qt5compat qtimageformats qtshadertools'
+        dir: ${{ runner.temp }}
+        setup-python: 'true'
+        set-env: 'true'
+        extra: '--external 7z'
+
+    - name: 'Install android Qt x86_64'
+      uses: jurplel/install-qt-action@v3
+      with:
+        version: ${{ env.QT_VERSION }}
+        host: 'linux'
+        target: 'android'
+        arch: 'android_x86_64'
+        modules: 'qtremoteobjects qt5compat qtimageformats qtshadertools'
+        dir: ${{ runner.temp }}
+        setup-python: 'true'
+        set-env: 'true'
+        extra: '--external 7z'
+
+    - name: 'Install android Qt x86'
+      uses: jurplel/install-qt-action@v3
+      with:
+        version: ${{ env.QT_VERSION }}
+        host: 'linux'
+        target: 'android'
+        arch: 'android_x86'
+        modules: 'qtremoteobjects qt5compat qtimageformats qtshadertools'
+        dir: ${{ runner.temp }}
+        setup-python: 'true'
+        set-env: 'true'
+        extra: '--external 7z'
+
+    - name: 'Install android Qt arm_v7'
+      uses: jurplel/install-qt-action@v3
+      with:
+        version: ${{ env.QT_VERSION }}
+        host: 'linux'
+        target: 'android'
+        arch: 'android_armv7'
+        modules: 'qtremoteobjects qt5compat qtimageformats qtshadertools'
+        dir: ${{ runner.temp }}
+        setup-python: 'true'
+        set-env: 'true'
+        extra: '--external 7z'
+
+    - name: 'Install android Qt arm_v8'
+      uses: jurplel/install-qt-action@v3
+      with:
+        version: ${{ env.QT_VERSION }}
+        host: 'linux'
+        target: 'android'
+        arch: 'android_arm64_v8a'
+        modules: 'qtremoteobjects qt5compat qtimageformats qtshadertools'
+        dir: ${{ runner.temp }}
+        setup-python: 'true'
+        set-env: 'true'
+        extra: '--external 7z'
+
+    - name: 'Get sources'
+      uses: actions/checkout@v3
+      with:
+        path: main
+        submodules: 'true'
+        fetch-depth: 10
+
+    - name: 'Preparations before keystore fetching'
+      run: | 
+        mkdir keystore
+
+    - name: 'Getting keystore'
+      uses: actions/checkout@v3  
+      with:
+        repository: amnezia-vpn/amnezia-android-certificates
+        ssh-key: ${{ secrets.ANDROID_CERTS_SSH_PRIVATE_KEY }}
+        path: keystore
+
+    - name: 'Setup ccache'
+      uses: hendrikmuhs/ccache-action@v1.2
+
+    - name: 'Setup Java'
+      uses: actions/setup-java@v3
+      with:
+        distribution: 'temurin'
+        java-version: '11'
+
+    - name: 'Build project'
+      run: |
+        export QT_HOST_PATH="${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/gcc_64"
+        export NDK_VERSION=23c
+        export ANDROID_NDK_PLATFORM=android-23
+        export ANDROID_NDK_HOME=${{ runner.temp }}/android-ndk-r${NDK_VERSION}
+        export ANDROID_NDK_ROOT=$ANDROID_NDK_HOME
+
+        if [ ! -f $ANDROID_NDK_ROOT/ndk-build ]; then 
+          wget https://dl.google.com/android/repository/android-ndk-r${NDK_VERSION}-linux.zip -qO ${{ runner.temp }}/ndk.zip &&
+          unzip -q -d ${{ runner.temp }} ${{ runner.temp }}/ndk.zip ; 
+        fi
+
+        export QT_BIN_DIR=${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/android_arm64_v8a/bin
+        cd main
+        bash deploy/build_android.sh
+
+    - name: 'Signing APK'
+      run: |
+        pwd
+
+        ANDROID_BUILD_TOOLS_VERSION=30.0.3
+
+        ${ANDROID_HOME}/build-tools/${ANDROID_BUILD_TOOLS_VERSION}/zipalign -f -v 4 AmneziaVPN-release-unsigned.apk AmneziaVPN-release-aligned.apk
+        ${ANDROID_HOME}/build-tools/${ANDROID_BUILD_TOOLS_VERSION}/apksigner sign --out AmneziaVPN-release-signed.apk --ks keystore/debug.keystore --ks-key-alias ${{ secrets.DEBUG_ANDROID_KEYSTORE_KEY_ALIAS }} --ks-pass pass:${{secrets.DEBUG_ANDROID_KEYSTOTE_KEY_PASS }} AmneziaVPN-release-aligned.apk
+
+    - name: 'Upload'
+      uses: actions/upload-artifact@v3
+      with:
+        name: Release APK
+        path: ${{ runner.temp }}/main/AmneziaVPN-release-signed.apk

.github/workflows/tag-upload.yml

@@ -0,0 +1,41 @@
+name: 'Upload a new version'
+
+on:
+  workflow_dispatch:
+    inputs:
+      RELEASE_VERSION:
+        description: 'Release version (e.g. 1.2.3.4)'
+        required: true
+        type: string
+
+jobs:
+  Upload-S3:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.RELEASE_VERSION }}
+          sparse-checkout: |
+            CMakeLists.txt
+            deploy/deploy_s3.sh
+          sparse-checkout-cone-mode: false
+
+      - name: Verify git tag
+        run: |
+          TAG_NAME=${{ inputs.RELEASE_VERSION }}
+          CMAKE_TAG=$(grep 'set(AMNEZIAVPN_VERSION' CMakeLists.txt | sed -E 's/.*AMNEZIAVPN_VERSION ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).*/\1/')
+          if [[ "$TAG_NAME" == "$CMAKE_TAG" ]]; then
+            echo "Git tag ($TAG_NAME) matches CMakeLists.txt version ($CMAKE_TAG)."
+          else
+            echo "::error::Mismatch: Git tag ($TAG_NAME) != CMakeLists.txt version ($CMAKE_TAG). Exiting with error..."
+            exit 1
+          fi
+
+      - name: Setup Rclone
+        uses: AnimMouse/setup-rclone@v1
+        with:
+          rclone_config: ${{ secrets.RCLONE_CONFIG }}
+
+      - name: Send dist to S3
+        run: bash deploy/deploy_s3.sh ${{ inputs.RELEASE_VERSION }}

.gitignore

@@ -8,6 +8,8 @@ deploy/build/*
 deploy/build_32/*
 deploy/build_64/*
 winbuild*.bat
+.cache/
+.vscode/
 
 
 # Qt-es
@@ -23,8 +25,14 @@ qrc_*.cpp
 ui_*.h
 Makefile*
 *build-*
+compile_commands.json
+
+# fastlane
+client/fastlane/report.xml
+client/fastlane/build/*
 
 # Qt-es
+client/Release-iphoneos/
 client/Debug-iphoneos/
 client/.xcode/
 client/.qmake.cache
@@ -39,6 +47,7 @@ client/qrc_*.cpp
 client/ui_*.h
 client/ui_*.cpp
 client/Makefile*
+client/fastlane/build/
 client/*build-*
 client/AmneziaVPN.xcodeproj
 client/Debug-iphonesimulator/
@@ -48,7 +57,7 @@ client/qmlcache_loader.cpp
 client/rep_ipc_interface_replica.h
 client/resources_qmlcache.qrc
 client/3rd/OpenVPNAdpter/build/
-
+client/3rd/ShadowSocks/build/
 # QtCreator
 
 *.autosave
@@ -60,12 +69,19 @@ client/3rd/OpenVPNAdpter/build/
 # QtCtreator CMake
 CMakeLists.txt.user*
 
+# Linux files
+*.7z
+deploy/AppDir
+deploy/Tools
+deploy/AmneziaVPN*Installer*
+
 # MACOS files
 .DS_Store
 client/.DS_Store
 ._.DS_Store
 ._*
 *.dmg
+deploy/data/macos/pf/amn.400.allowPIA.conf
 
 # tmp files
 *.*~
@@ -113,3 +129,18 @@ captures/
 
 # Android Profiling
 *.hprof
+client/3rd/ShadowSocks/ss_ios.xcconfig
+
+# UML generated pics
+out/
+
+# CMake files
+CMakeFiles/
+
+ios-ne-build.sh
+macos-ne-build.sh
+macos-signed-build.sh
+macos-with-sign-build.sh
+DeveloperIdApplicationCertificate.p12
+DeveloperIdInstallerCertificate.p12
+

.gitlab-ci.yml

@@ -1,27 +0,0 @@
-variables:
-    GIT_STRATEGY: clone
-
-stages:
-  - build
-
-build-windows:
-  stage: build
-  tags:
-    - windows
-  script:
-    - cmd.exe /k "deploy\windows-env.bat && cd deploy && windows.bat"
-  artifacts:
-    name: artifacts-windows
-    paths:
-    - AmneziaVPN.exe
-
-build-macos:
-  stage: build
-  tags:
-    - macos
-  script:
-    - cd deploy && ./macos.sh
-  artifacts:
-    name: artifacts-macos
-    paths:
-    - AmneziaVPN.dmg

.gitmodules

@@ -1,15 +1,16 @@
-[submodule "3rd/QtSsh"]
-	path = 3rd/QtSsh
-	url = https://github.com/amnezia-vpn/QtSsh.git
-[submodule "client/3rd/wireguard-tools"]
-	path = client/3rd/wireguard-tools
-	url = https://github.com/WireGuard/wireguard-tools/
-[submodule "client/3rd/wireguard-apple"]
-	path = client/3rd/wireguard-apple
-	url = https://github.com/WireGuard/wireguard-apple
-[submodule "client/3rd/OpenVPNAdapter"]
-	path = client/3rd/OpenVPNAdapter
-	url = https://github.com/ss-abramchuk/OpenVPNAdapter.git
-[submodule "client/3rd/qzxing"]
-	path = client/3rd/qzxing
-	url = https://github.com/ftylitak/qzxing.git
+[submodule "client/3rd/qtkeychain"]
+	path = client/3rd/qtkeychain
+	url = https://github.com/frankosterfeld/qtkeychain.git
+[submodule "client/3rd/SortFilterProxyModel"]
+	path = client/3rd/SortFilterProxyModel
+	url = https://github.com/mitchcurtis/SortFilterProxyModel.git
+[submodule "client/3rd/amneziawg-apple"]
+	path = client/3rd/amneziawg-apple
+	url = https://github.com/amnezia-vpn/amneziawg-apple
+[submodule "client/3rd/QSimpleCrypto"]
+	path = client/3rd/QSimpleCrypto
+	url = https://github.com/amnezia-vpn/QSimpleCrypto.git
+[submodule "client/3rd/qtgamepad"]
+	path = client/3rd/qtgamepad
+	url = https://github.com/amnezia-vpn/qtgamepad.git
+	branch = 6.6

.gitpod.Dockerfile

@@ -0,0 +1,47 @@
+FROM gitpod/workspace-full-vnc
+
+USER gitpod
+
+RUN sudo apt-get -q update \
+    && sudo apt-get install -yq \
+        build-essential \
+        libgl1-mesa-dev \
+        libgstreamer-gl1.0-0 \
+        libpulse-dev \
+        libsecret-1-dev \
+        libxcb-glx0 \
+        libxcb-icccm4 \
+        libxcb-image0 \
+        libxcb-keysyms1 \
+        libxcb-randr0 \
+        libxcb-render-util0 \
+        libxcb-render0 \
+        libxcb-shape0 \
+        libxcb-shm0 \
+        libxcb-sync1 \
+        libxcb-util1 \
+        libxcb-xfixes0 \
+        libxcb-xinerama0 \
+        libxcb1 \
+        libxkbcommon-dev \
+        libxkbcommon-x11-0 \
+        libxcb-xkb-dev \
+        p7zip-full \
+    && sudo rm -rf /var/lib/apt/lists/*
+
+RUN sudo pip3 install aqtinstall
+
+ARG QT_VERSION=6.4.1
+ARG QT_ARCH=gcc_64
+
+ARG QT_DIR=/opt/qt
+RUN sudo aqt install-qt --outputdir ${QT_DIR} linux desktop ${QT_VERSION} ${QT_ARCH} --modules \
+    qtremoteobjects \
+    qt5compat \
+    qtshadertools
+ENV QT_BIN_DIR=${QT_DIR}/${QT_VERSION}/${QT_ARCH}/bin
+
+ARG QIF_VERSION=4.5
+ARG QIF_DIR=/opt/qif
+RUN sudo aqt install-tool --outputdir ${QIF_DIR} linux desktop tools_ifw
+ENV QIF_BIN_DIR=${QIF_DIR}/Tools/QtInstallerFramework/${QIF_VERSION}/bin

.gitpod.yml

@@ -0,0 +1,8 @@
+tasks:
+- init: >-
+    deploy/build_linux.sh
+image:
+  file: .gitpod.Dockerfile
+vscode:
+  extensions:
+  - llvm-vs-code-extensions.vscode-clangd

.travis.yml

@@ -1,144 +0,0 @@
-language: cpp
-
-branches:
-  only:
-    - master
-    - dev
-    - /\d+\.\d+/
-  
-jobs:
-  include:
-    - name: MacOS
-      os: osx
-      osx_image: xcode12.5
-      
-      env:
-        - QT_VERSION=5.15.2
-        - QIF_VERSION=4.1
-        - QT_BIN_DIR=$HOME/Qt/$QT_VERSION/clang_64/bin
-        - QIF_BIN_DIR=$QT_BIN_DIR/../../../Tools/QtInstallerFramework/$QIF_VERSION/bin
-         
-      script:
-        - |
-          if [ ! -f $HOME/Qt/$QT_VERSION/clang_64/bin/qmake ]; then \
-          brew install p7zip && \
-          python3 -m pip install --upgrade pip && \
-          pip install -U aqtinstall requests py7zr && \
-          pip show aqtinstall && \
-          python3 -m aqt install --outputdir $HOME/Qt $QT_VERSION mac desktop clang_64 -m qtbase && \
-          python3 -m aqt tool --outputdir $HOME/Qt mac tools_ifw $QIF_VERSION qt.tools.ifw.${QIF_VERSION/./};
-          fi
-        - bash deploy/build_macos.sh 
-
-      deploy:
-        provider: releases
-        token: $GH_TOKEN
-        skip_cleanup: true
-        file:
-        - "AmneziaVPN_unsigned.dmg"
-        on:
-          tags: true
-          branch: master
-    
-    - name: Windows_x64
-      os: windows
-      
-      env:
-        - PATH=/c/Python39:/c/Python39/Scripts:$PATH
-        - QT_VERSION=5.14.2
-        - QIF_VERSION=4.1
-        - QT_BIN_DIR="c:\\Qt\\$QT_VERSION\\msvc2017_64\\bin"
-        - QIF_BIN_DIR="c:\\Qt\\Tools\\QtInstallerFramework\\${QIF_VERSION}\\bin"
-        - BUILD_ARCH=64
-        
-      before_install:
-        - if [ ! -f /C/Qt/$QT_VERSION/msvc2017_64/bin/qmake ]; then choco install python --version 3.9.1; fi
-        
-      script:
-        - dir "C:\Program Files (x86)\Microsoft Visual Studio\2017\BuildTools\VC\Auxiliary\Build"
-        - dir "C:\Program Files (x86)\Microsoft Visual Studio\2017\BuildTools\Common7\Tools"
-        - |
-          if [ ! -f /C/Qt/$QT_VERSION/msvc2017_64/bin/qmake ]; then \
-          python -m pip install --upgrade pip && \
-          pip3 install -U aqtinstall requests py7zr && \
-          pip3 show aqtinstall && \
-          python -m aqt install --outputdir /C/Qt $QT_VERSION windows desktop win64_msvc2017_64 -m qtbase && \
-          python -m aqt tool --outputdir /C/Qt windows tools_ifw $QIF_VERSION qt.tools.ifw.${QIF_VERSION/./}; \
-          fi
-        - echo set BUILD_ARCH=$BUILD_ARCH > winbuild.bat
-        - echo set QT_BIN_DIR="$QT_BIN_DIR" >> winbuild.bat
-        - echo set QIF_BIN_DIR="$QIF_BIN_DIR" >> winbuild.bat
-        - echo call \""C:\\Program Files (x86)\\Microsoft Visual Studio\\2017\\BuildTools\\VC\\Auxiliary\\Build\\vcvars${BUILD_ARCH}.bat\"" >> winbuild.bat
-        - echo call \""C:\\Program Files (x86)\\Microsoft Visual Studio\\2017\\BuildTools\\Common7\\Tools\\VsDevCmd.bat\" -arch=amd64" >> winbuild.bat
-        - echo set WIN_CERT_PW=$WIN_CERT_PW >> winbuild.bat
-        - echo call deploy\\build_windows.bat >> winbuild.bat
-        - cmd //c winbuild.bat
-
-        
-      deploy:
-        provider: releases
-        token: $GH_TOKEN
-        skip_cleanup: true
-        file:
-        - "AmneziaVPN_x64.exe"
-        on:
-          tags: true
-          branch: master
-
-    - name: Windows_x32
-      os: windows
-
-      env:
-        - PATH=/c/Python39:/c/Python39/Scripts:$PATH
-        - QT_VERSION=5.14.2
-        - QIF_VERSION=4.1
-        - QT_BIN_DIR="c:\\Qt\\${QT_VERSION}\\msvc2017\\bin"
-        - QIF_BIN_DIR="c:\\Qt\\Tools\\QtInstallerFramework\\${QIF_VERSION}\\bin"
-        - BUILD_ARCH=32
-
-      before_install:
-        - if [ ! -f /C/Qt/$QT_VERSION/msvc2017/bin/qmake ]; then choco install python --version 3.9.1; fi
-
-      script:
-        - dir "C:\Program Files (x86)\Microsoft Visual Studio\2017\BuildTools\VC\Auxiliary\Build"
-        - dir "C:\Program Files (x86)\Microsoft Visual Studio\2017\BuildTools\Common7\Tools"
-        - |
-          if [ ! -f /C/Qt/$QT_VERSION/msvc2017/bin/qmake ]; then \
-          python -m pip install --upgrade pip && \
-          pip3 install -U aqtinstall requests py7zr && \
-          pip3 show aqtinstall && \
-          python -m aqt install --outputdir /C/Qt $QT_VERSION windows desktop win32_msvc2017 -m qtbase && \
-          python -m aqt tool --outputdir /C/Qt windows tools_ifw $QIF_VERSION qt.tools.ifw.${QIF_VERSION/./}; \
-          fi
-        - echo call \""C:\\Program Files (x86)\\Microsoft Visual Studio\\2017\\BuildTools\\Common7\\Tools\\VsDevCmd.bat\"" > winbuild.bat
-        - echo set BUILD_ARCH=$BUILD_ARCH >> winbuild.bat
-        - echo set QT_BIN_DIR="$QT_BIN_DIR" >> winbuild.bat
-        - echo set QIF_BIN_DIR="$QIF_BIN_DIR" >> winbuild.bat
-        - echo call \""C:\\Program Files (x86)\\Microsoft Visual Studio\\2017\\BuildTools\\VC\\Auxiliary\\Build\\vcvars${BUILD_ARCH}.bat\"" >> winbuild.bat
-        - echo set WIN_CERT_PW=$WIN_CERT_PW >> winbuild.bat
-        - echo call deploy\\build_windows.bat >> winbuild.bat
-        - cmd //c winbuild.bat
-
-      deploy:
-        provider: releases
-        token: $GH_TOKEN
-        skip_cleanup: true
-        file:
-        - "AmneziaVPN_x32.exe"
-        on:
-          tags: true
-          branch: master
-
-deploy:
-  skip_cleanup: true
-  
-before_cache:
-  - if [ "${TRAVIS_OS_NAME}" = "osx" ]; then brew cleanup; fi
-  # Cache only .git files under "/usr/local/Homebrew" so "brew update" does not take 5min every build
-  - if [ "${TRAVIS_OS_NAME}" = "osx" ]; then find /usr/local/Homebrew \! -regex ".+\.git.+" -delete; fi
-  
-cache:
-  directories:
-    - $HOME/Qt
-    - /C/Qt
-    - $HOME/Library/Caches/Homebrew

AmneziaVPN.pro

@@ -1,6 +0,0 @@
-TEMPLATE = subdirs
-SUBDIRS = client
-
-!ios:!android {
-   SUBDIRS += service platform
-}

CMakeLists.txt

@@ -0,0 +1,78 @@
+cmake_minimum_required(VERSION 3.25.0 FATAL_ERROR)
+
+set(CMAKE_CXX_STANDARD 17)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
+
+set(PROJECT AmneziaVPN)
+set(AMNEZIAVPN_VERSION 4.9.0.2)
+
+set(QT_CREATOR_SKIP_PACKAGE_MANAGER_SETUP ON CACHE BOOL "" FORCE)
+set(CMAKE_PROJECT_TOP_LEVEL_INCLUDES
+    ${CMAKE_SOURCE_DIR}/cmake/platform_settings.cmake
+    ${CMAKE_SOURCE_DIR}/cmake/recipes_bootstrap.cmake
+    ${CMAKE_SOURCE_DIR}/cmake/conan_provider.cmake
+    CACHE STRING "" FORCE)
+
+project(${PROJECT} VERSION ${AMNEZIAVPN_VERSION}
+        DESCRIPTION "AmneziaVPN"
+        HOMEPAGE_URL "https://amnezia.org/"
+)
+
+# trigger conan to kick off `conan install` globally
+find_package(OpenSSL REQUIRED)
+if (PREBUILTS_ONLY)
+    return()
+endif()
+
+string(TIMESTAMP CURRENT_DATE "%Y-%m-%d")
+set(RELEASE_DATE "${CURRENT_DATE}")
+
+set(APP_MAJOR_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})
+set(APP_ANDROID_VERSION_CODE 2123)
+
+if(${CMAKE_SYSTEM_NAME} STREQUAL "Linux")
+    set(MZ_PLATFORM_NAME "linux")
+elseif(${CMAKE_SYSTEM_NAME} STREQUAL "Windows")
+    set(MZ_PLATFORM_NAME "windows")
+elseif(${CMAKE_SYSTEM_NAME} STREQUAL "Darwin")
+    set(MZ_PLATFORM_NAME "macos")
+elseif(${CMAKE_SYSTEM_NAME} STREQUAL "Android")
+    set(MZ_PLATFORM_NAME "android")
+elseif(${CMAKE_SYSTEM_NAME} STREQUAL "iOS")
+    set(MZ_PLATFORM_NAME "ios")
+elseif(${CMAKE_SYSTEM_NAME} STREQUAL "Emscripten")
+    set(MZ_PLATFORM_NAME "wasm")
+endif()
+
+set(QT_BUILD_TOOLS_WHEN_CROSS_COMPILING ON)
+
+if(APPLE AND NOT IOS)
+    if(CMAKE_BUILD_TYPE STREQUAL "Debug")
+        set(AMN_PF_RULE_IDENTITY "user { root }")
+    else()
+        set(AMN_PF_RULE_IDENTITY "group { amnvpn }")
+    endif()
+
+    configure_file(
+        "${CMAKE_SOURCE_DIR}/deploy/data/pf-templates/amn.400.allowPIA.conf.in"
+        "${CMAKE_CURRENT_BINARY_DIR}/amn.400.allowPIA.conf"
+        @ONLY
+    )
+
+    file(COPY_FILE
+        "${CMAKE_CURRENT_BINARY_DIR}/amn.400.allowPIA.conf"
+        "${CMAKE_SOURCE_DIR}/deploy/data/macos/pf/amn.400.allowPIA.conf"
+        ONLY_IF_DIFFERENT
+    )
+endif()
+
+
+add_subdirectory(client)
+
+if(NOT IOS AND NOT ANDROID AND NOT MACOS_NE)
+    add_subdirectory(service)
+endif()
+
+if ((LINUX AND NOT ANDROID) OR (APPLE AND NOT IOS AND NOT MACOS_NE) OR (WIN32))
+    include(${CMAKE_SOURCE_DIR}/cmake/CPack.cmake)
+endif()

README.md

@@ -1,50 +1,185 @@
 # Amnezia VPN
-## _The best client for self-hosted VPN_
 
-[![Build Status](https://travis-ci.com/amnezia-vpn/desktop-client.svg?branch=master)](https://travis-ci.com/amnezia-vpn/desktop-client)
+### _The best client for self-hosted VPN_
 
-Amnezia is a VPN client with the key feature of deploying your own VPN server on you virtual server.
+
+[![Build Status](https://github.com/amnezia-vpn/amnezia-client/actions/workflows/deploy.yml/badge.svg?branch=dev)](https://github.com/amnezia-vpn/amnezia-client/actions/workflows/deploy.yml?query=branch:dev)
+[![Gitpod ready-to-code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/amnezia-vpn/amnezia-client)
+
+### [English]([https://github.com/amnezia-vpn/amnezia-client/blob/dev/README_RU.md](https://github.com/amnezia-vpn/amnezia-client/tree/dev?tab=readme-ov-file#)) | [Русский](https://github.com/amnezia-vpn/amnezia-client/blob/dev/README_RU.md)
+
+
+[Amnezia](https://amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-en) is an open-source VPN client, with a key feature that enables you to deploy your own VPN server on your server.
+
+[![Image](https://github.com/amnezia-vpn/amnezia-client/blob/dev/metadata/img-readme/uipic4.png)](https://amnezia.org)
+
+### [Website](https://amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-en) | [Alt website link](https://storage.googleapis.com/amnezia/amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-en-mirror) | [Documentation](https://docs.amnezia.org) | [Troubleshooting](https://docs.amnezia.org/troubleshooting)
+
+> [!TIP]
+> If the [Amnezia website](https://amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-en) is blocked in your region, you can use an [Alternative website link](https://storage.googleapis.com/amnezia/amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-en-mirror).
+
+<a href="https://amnezia.org/en/downloads?utm_source=github&utm_campaign=amnezia_button-readme-en"><img src="https://github.com/amnezia-vpn/amnezia-client/blob/dev/metadata/img-readme/download-website.svg" width="150" style="max-width: 100%; margin-right: 10px"></a>
+<a href="https://storage.googleapis.com/amnezia/amnezia.org?m-path=/en/downloads&utm_source=github&utm_campaign=amnezia_button-readme-en-mirrow"><img src="https://github.com/amnezia-vpn/amnezia-client/blob/dev/metadata/img-readme/download-alt.svg" width="150" style="max-width: 100%;"></a>
+
+[All releases](https://github.com/amnezia-vpn/amnezia-client/releases)
+
+<br/>
+
+<a href="https://www.testiny.io"><img src="https://github.com/amnezia-vpn/amnezia-client/blob/dev/metadata/img-readme/testiny.png" height="28px"></a>
 
 ## Features
-- Very easy to use - enter your ip address, ssh login and password, and Amnezia client will automatically install VPN docker containers to your server and connect to VPN.
-- OpenVPN and OpenVPN over ShadowSocks protocols support. 
-- Custom VPN routing mode support - add any sites to client to enable VPN only for them.
-- Windows and MacOS support.
-- Unsecure sharing connection profile for family use.
+
+- Very easy to use - enter your IP address, SSH login, password and Amnezia will automatically install VPN docker containers to your server and connect to the VPN.
+- Classic VPN-protocols: OpenVPN, WireGuard and IKEv2 protocols.
+- Protocols with traffic Masking (Obfuscation): OpenVPN over [Cloak](https://github.com/cbeuw/Cloak) plugin, Shadowsocks (OpenVPN over Shadowsocks), [AmneziaWG](https://docs.amnezia.org/documentation/amnezia-wg/) and XRay.
+- Split tunneling support - add any sites to the client to enable VPN only for them or add Apps (only for Android and Desktop).
+- Windows, MacOS, Linux, Android, iOS releases.
+- Support for AmneziaWG protocol configuration on [Keenetic beta firmware](https://docs.keenetic.com/ua/air/kn-1611/en/6319-latest-development-release.html#UUID-186c4108-5afd-c10b-f38a-cdff6c17fab3_section-idm33192196168192-improved).
+
+## Links
+
+- [https://amnezia.org](https://amnezia.org) - Project website | [Alternative link (mirror)](https://storage.googleapis.com/kldscp/amnezia.org)
+- [https://docs.amnezia.org](https://docs.amnezia.org) - Documentation
+- [https://www.reddit.com/r/AmneziaVPN](https://www.reddit.com/r/AmneziaVPN) - Reddit  
+- [https://t.me/amnezia_vpn_en](https://t.me/amnezia_vpn_en) - Telegram support channel (English) 
+- [https://t.me/amnezia_vpn_ir](https://t.me/amnezia_vpn_ir) - Telegram support channel (Farsi) 
+- [https://t.me/amnezia_vpn_mm](https://t.me/amnezia_vpn_mm) - Telegram support channel (Myanmar)  
+- [https://t.me/amnezia_vpn](https://t.me/amnezia_vpn) - Telegram support channel (Russian)
+- [https://vpnpay.io/en/amnezia-premium/](https://vpnpay.io/en/amnezia-premium/) - Amnezia Premium
 
 ## Tech
 
-AmneziaVPN uses a number of open source projects to work:
+AmneziaVPN uses several open-source projects to work:
 
 - [OpenSSL](https://www.openssl.org/)
 - [OpenVPN](https://openvpn.net/)
-- [ShadowSocks](https://shadowsocks.org/)
 - [Qt](https://www.qt.io/)
-- [EasyRSA](https://github.com/OpenVPN/easy-rsa) - part of OpenVPN
-- [CygWin](https://www.cygwin.com/) - only for Windiws, used for launching EasyRSA scripts
-- [QtSsh](https://github.com/jaredtao/QtSsh) - forked form Qt Creator
+- [LibSsh](https://libssh.org)
+- [WireGuard](https://www.wireguard.com/)
+- [Xray-core](https://xtls.github.io/en/)
+- [Conan](https://conan.io/)
 - and more...
 
-## Development
+## Help us with translations
+
+Download the most actual translation files.
+
+Go to ["Actions" tab](https://github.com/amnezia-vpn/amnezia-client/actions?query=is%3Asuccess+branch%3Adev), click on the first line.
+Then scroll down to the "Artifacts" section and download "AmneziaVPN_translations".
+
+Unzip this file.
+Each *.ts file contains strings for one corresponding language.
+
+Translate or correct some strings in one or multiple *.ts files and commit them back to this repository into the ``client/translations`` folder.
+You can do it via a web-interface or any other method you're familiar with.
+
+## Checking out the source code
+
+Make sure to pull all submodules after checking out the repo.
+
+```bash
+git submodule update --init --recursive
+```
+
+## Hacking guide
 
 Want to contribute? Welcome!
 
-### Building sources and deployment
-Easiest way to build your own executables - is to fork project and configure [Travis CI](https://travis-ci.com/)  
-Or you can build sources manually using Qt Creator. Qt >= 14.2 supported.  
-Look to the `build_macos.sh` and `build_windows.bat` scripts in `deploy` folder for details.
+### Build requirements
+
+* [`CMake`](https://cmake.org/download/)
+* Compiler and underlying build system, depending on the target:
+  - [Linux] Any of `make` and `gcc`
+  - [Apple] [`Xcode`](https://developer.apple.com/xcode/) or [`Xcode command line tools`](https://developer.apple.com/xcode/)
+  - [Windows] [`Visual Studio 2022`](https://aka.ms/vs/17/release/vs_community.exe) or [`VS 2022 Build Tools`](https://aka.ms/vs/17/release/vs_buildtools.exe)
+  - [Android] [`Android SDK`](#installing-android-sdk) and [`Ninja`](https://ninja-build.org/)
+* [`Qt 6.10+`](https://www.qt.io/download-open-source) with the following modules:
+  - Core module for targeting platform (Desktop/Android/iOS)
+  - Qt 5 Compatibility module
+  - Qt Remote Objects
+* [`Conan`](https://conan.io/downloads) package manager
+  - On MacOS is enough just to use `homebrew` or install it in `.venv` in project root
+  - Other systems must have it in `PATH`
+* (Optional) Installer dependencies:
+  - [Windows/Linux] [`Qt Installer Framework`](https://www.qt.io/download-open-source)
+  - [Windows] [`WIX toolset`](https://github.com/wixtoolset/wix/releases)
+
+### Building the project using scripts
+
+* Run scripts located in `deploy` directory
+* Basically, if dependencies are located in default installation paths, the scripts will find them automatically.
+* If they differ, specify them using the following variables:
+  - `QT_INSTALL_DIR` - Qt root installation folder
+  - `QT_ROOT_PATH`   - Qt framework root directory
+  - `QIF_ROOT_PATH`  - Qt Installer Framework root path
+  - `ANDROID_HOME`   - Path to Android SDK root folder
+  - and others. Check scripts for more
+
+Unix-like:
+```bash
+# Build executables for the host platform
+deploy/build.sh
+
+# Or just
+deploy/build.sh
+
+# Build executables and installers for the host platform
+deploy/build.sh --installer all
+
+# Build Android APK and AAB
+deploy/build.sh -t android --aab
+
+# Call for help
+deploy/build.sh -h
+```
+
+Windows:
+```batch
+:: Build executables for Windows
+deploy/build.bat
+
+:: Build executables with IFW installer for Windows
+deploy/build.bat --installer ifw
+
+:: Build executables with IFW and WIX installer for Windows
+deploy/build.bat --installer ifw --installer wix
+
+:: Or just
+deploy/build.bat --installer all
+```
+
+### Developing the project in IDEs
+
+* Basically, you can use any IDE that handles CMake and Qt kits properly to run configure and build steps, and to navigate through the code nicely. For example:
+  - `Qt Creator`
+  - `Visual Studio Code` with `Qt Extension Pack`
+  - and so on
+
+* To use `Xcode`, you have to configure project first by using `cmake`. The easiest way to do it is to use `Qt Creator` for configuration. Then open `AmneziaVPN.xcodeproj` file from the build folder by using `Xcode`. Note that none of the files changed are saved - the files actually getting changed in build directory. Copy them manually if necessary
+
+* `Android studio` could be used in the same way - just configure the project by using `cmake` manually or by using `Qt Creator`. Open `<build-dir>/client/android-build` in `Android studio` then. Do not forget to copy the changes - everything you do is saved under the build directory actually.
+
+### Installing Android SDK
+
+* Android SDK could be installed using the following methods:
+  - Using `Qt Creator`. Use `Preferences`->`SDKs`
+  - Using `Android studio`. By default it installs necessary `SDKs` automatically during the installation
+  - Manually by using `sdk-manager`. Check [this](https://developer.android.com/tools) page for details
 
 ## License
-GPL v.3
 
-## Contacts
-[https://t.me/amnezia_vpn_en](https://t.me/amnezia_vpn_en) - Telegram support channel (English)  
-[https://t.me/amnezia_vpn](https://t.me/amnezia_vpn) - Telegram support channel (Russian)  
-[https://signal.group/...](https://signal.group/#CjQKIB2gUf8QH_IXnOJMGQWMDjYz9cNfmRQipGWLFiIgc4MwEhAKBONrSiWHvoUFbbD0xwdh) - Signal channel  
-[https://amnezia.org](https://amnezia.org) - project website  
+This project is licensed under the GNU General Public License v3.0 (see LICENSE) and also includes third-party components distributed under their own terms (see THIRD_PARTY_LICENSES.md).
 
 ## Donate
-Bitcoin: bc1qn9rhsffuxwnhcuuu4qzrwp4upkrq94xnh8r26u  
-XMR: 48spms39jt1L2L5vyw2RQW6CXD6odUd4jFu19GZcDyKKQV9U88wsJVjSbL4CfRys37jVMdoaWVPSvezCQPhHXUW5UKLqUp3  
-payeer.com: P2561305  
-ko-fi.com: [https://ko-fi.com/amnezia_vpn](https://ko-fi.com/amnezia_vpn)  
+
+Patreon: [https://www.patreon.com/amneziavpn](https://www.patreon.com/amneziavpn)
+
+Bitcoin: bc1qmhtgcf9637rl3kqyy22r2a8wa8laka4t9rx2mf <br>
+USDT BEP20: 0x6abD576765a826f87D1D95183438f9408C901bE4 <br>
+USDT TRC20: TELAitazF1MZGmiNjTcnxDjEiH5oe7LC9d <br>
+XMR: 48spms39jt1L2L5vyw2RQW6CXD6odUd4jFu19GZcDyKKQV9U88wsJVjSbL4CfRys37jVMdoaWVPSvezCQPhHXUW5UKLqUp3 <br> 
+TON: UQDpU1CyKRmg7L8mNScKk9FRc2SlESuI7N-Hby4nX-CcVmns
+## Acknowledgments
+
+This project is tested with BrowserStack.
+We express our gratitude to [BrowserStack](https://www.browserstack.com) for supporting our project.

README_RU.md

@@ -0,0 +1,180 @@
+# Amnezia VPN
+
+### _Лучший клиент для создания VPN на собственном сервере_
+
+[![Build Status](https://github.com/amnezia-vpn/amnezia-client/actions/workflows/deploy.yml/badge.svg?branch=dev)](https://github.com/amnezia-vpn/amnezia-client/actions/workflows/deploy.yml?query=branch:dev)
+[![Gitpod ready-to-code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/amnezia-vpn/amnezia-client)
+
+### [English](https://github.com/amnezia-vpn/amnezia-client/blob/dev/README.md) | Русский
+[AmneziaVPN](https://amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-ru) — это open source VPN-клиент, ключевая особенность которого заключается в возможности развернуть собственный VPN на вашем сервере.
+
+[![Image](https://github.com/amnezia-vpn/amnezia-client/blob/dev/metadata/img-readme/uipic4.png)](https://amnezia.org)
+
+### [Сайт](https://amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-ru) | [Зеркало сайта](https://storage.googleapis.com/amnezia/amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-ru-mirror) | [Документация](https://docs.amnezia.org) | [Решение проблем](https://docs.amnezia.org/troubleshooting)
+
+> [!TIP]
+> Если [сайт Amnezia](https://amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-ru) заблокирован в вашем регионе, вы можете воспользоваться [ссылкой на зеркало](https://storage.googleapis.com/amnezia/amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-ru-mirror).
+
+<a href="https://storage.googleapis.com/amnezia/amnezia.org?m-path=/ru/downloads&utm_source=github&utm_campaign=amnezia_button-readme-ru-mirror"><img src="https://github.com/amnezia-vpn/amnezia-client/blob/dev/metadata/img-readme/download-website-ru.svg" width="150" style="max-width: 100%; margin-right: 10px"></a>
+
+
+[Все релизы](https://github.com/amnezia-vpn/amnezia-client/releases)
+
+<br/>
+
+<a href="https://www.testiny.io"><img src="https://github.com/amnezia-vpn/amnezia-client/blob/dev/metadata/img-readme/testiny.png" height="28px"></a>
+
+## Особенности
+
+- Простой в использовании — введите IP-адрес, SSH-логин и пароль, и Amnezia автоматически установит VPN-контейнеры Docker на ваш сервер и подключится к VPN.
+- Классические VPN-протоколы: OpenVPN, WireGuard и IKEv2.
+- Протоколы с маскировкой трафика (обфускацией): OpenVPN с плагином [Cloak](https://github.com/cbeuw/Cloak), Shadowsocks (OpenVPN over Shadowsocks), [AmneziaWG](https://docs.amnezia.org/documentation/amnezia-wg/) and XRay.
+- Поддержка Split Tunneling — добавляйте любые сайты или приложения в список, чтобы включить VPN только для них.
+- Поддерживает платформы: Windows, macOS, Linux, Android, iOS.
+- Поддержка конфигурации протокола AmneziaWG на [бета-прошивке Keenetic](https://docs.keenetic.com/ua/air/kn-1611/en/6319-latest-development-release.html#UUID-186c4108-5afd-c10b-f38a-cdff6c17fab3_section-idm33192196168192-improved).
+
+## Ссылки
+
+- [https://amnezia.org](https://amnezia.org) - Веб-сайт проекта | [Альтернативная ссылка (зеркало)](https://storage.googleapis.com/kldscp/amnezia.org)
+- [https://docs.amnezia.org](https://docs.amnezia.org) - Документация
+- [https://www.reddit.com/r/AmneziaVPN](https://www.reddit.com/r/AmneziaVPN) - Reddit  
+- [https://t.me/amnezia_vpn_en](https://t.me/amnezia_vpn_en) - Канал поддержки в Telegram (Английский)
+- [https://t.me/amnezia_vpn_ir](https://t.me/amnezia_vpn_ir) - Канал поддержки в Telegram (Фарси)
+- [https://t.me/amnezia_vpn_mm](https://t.me/amnezia_vpn_mm) - Канал поддержки в Telegram (Мьянма) 
+- [https://t.me/amnezia_vpn](https://t.me/amnezia_vpn) - Канал поддержки в Telegram  (Русский)
+- [https://vpnpay.io/en/amnezia-premium/](https://vpnpay.io/en/amnezia-premium/) - Amnezia Premium | [Зеркало](https://storage.googleapis.com/kldscp/vpnpay.io/ru/amnezia-premium\)
+
+## Технологии
+
+AmneziaVPN использует несколько проектов с открытым исходным кодом:
+
+- [OpenSSL](https://www.openssl.org/)
+- [OpenVPN](https://openvpn.net/)
+- [Qt](https://www.qt.io/)
+- [LibSsh](https://libssh.org)
+- [WireGuard](https://www.wireguard.com/)
+- [Xray-core](https://xtls.github.io/en/)
+- [Conan](https://conan.io/)
+- и другие...
+
+## Помощь с переводами
+
+Загрузите самые актуальные файлы перевода.
+
+Перейдите на [вкладку "Actions"](https://github.com/amnezia-vpn/amnezia-client/actions?query=is%3Asuccess+branch%3Adev), нажмите на первую строку. Затем прокрутите вниз до раздела "Artifacts" и скачайте "AmneziaVPN_translations".
+
+Распакуйте этот файл. Каждый файл с расширением *.ts содержит строки для соответствующего языка.
+
+Переведите или исправьте строки в одном или нескольких файлах *.ts и загрузите их обратно в этот репозиторий в папку ``client/translations``. Это можно сделать через веб-интерфейс или любым другим знакомым вам способом.
+
+## Проверка исходного кода
+
+После клонирования репозитория обязательно загрузите все подмодули.
+
+```bash
+git submodule update --init --recursive
+```
+
+## Руководство по разработке
+
+Хотите внести свой вклад? Добро пожаловать!
+
+### Требования для сборки
+
+* [`CMake`](https://cmake.org/download/)
+* Компилятор и система сборки, в зависимости от таргета:
+  - [Linux] Любые `make` и `gcc`
+  - [Apple] [`Xcode`](https://developer.apple.com/xcode/) или [`Xcode command line tools`](https://developer.apple.com/xcode/)
+  - [Windows] [`Visual Studio 2022`](https://aka.ms/vs/17/release/vs_community.exe) или [`VS 2022 Build Tools`](https://aka.ms/vs/17/release/vs_buildtools.exe)
+  - [Android] [`Android SDK`](#установка-android-sdk) и [`Ninja`](https://ninja-build.org/)
+* [`Qt 6.10+`](https://www.qt.io/download-open-source) со следующими модулями:
+  - Основные модули для таргета (Desktop/Android/iOS)
+  - Qt 5 Compatibility module
+  - Qt Remote Objects
+* Пакетный менеджер [`Conan`](https://conan.io/downloads)
+  - На MacOS достаточно использовать `homebrew` или установить в `.venv` в корень проекта 
+  - Для остальных систем необходимо прописать пути в `PATH`
+* (Необязательно) Заивисимости для установщиков:
+  - [Windows/Linux] [`Qt Installer Framework`](https://www.qt.io/download-open-source)
+  - [Windows] [`WIX toolset`](https://github.com/wixtoolset/wix/releases)
+
+### Сборка проекта через скрипты
+
+* Запустите скрипты, находящиеся в папке `deploy`
+* Если все зависимости установлены в стандартных локациях, скрипт найдёт их самостоятельно
+* Если пути отличаются, их нужно явно указать используя:
+  - `QT_INSTALL_DIR` - корневая папка установки Qt
+  - `QT_ROOT_PATH`   - корневая папка Qt Framework
+  - `QIF_ROOT_PATH`  - корневая папка Qt Installer Framework
+  - `ANDROID_HOME`   - путь к Android SDK
+  - и другие. Их можно получить из вышеуказанных скриптов
+
+Unix-like:
+```bash
+# Build executables for the host platform
+deploy/build.sh
+
+# Or just
+deploy/build.sh
+
+# Build executables and installers for the host platform
+deploy/build.sh --installer all
+
+# Build Android APK and AAB
+deploy/build.sh -t android --aab
+
+# Call for help
+deploy/build.sh -h
+```
+
+Windows:
+```batch
+:: Build executables for Windows
+deploy/build.bat
+
+:: Build executables with IFW installer for Windows
+deploy/build.bat --installer ifw
+
+:: Build executables with IFW and WIX installer for Windows
+deploy/build.bat --installer ifw --installer wix
+
+:: Or just
+deploy/build.bat --installer all
+```
+
+### Разработка в IDE
+
+* Можно использовать любые IDE которые умеют работать с CMake и находить Qt Kits. Например:
+  - `Qt Creator`
+  - `Visual Studio Code` with `Qt Extension Pack`
+  - и так далее
+
+* Для использования `Xcode` нужно сконфигурировать проект с помощью `cmake`. Самый простой способ это сделать - использовать `Qt Creator` для конфигурации. Затем, нужно открыть файл `AmneziaVPN.xcodeproj` из папки сборки с помощью `Xcode`. Учтите, что никакие файлы фактически не сохраняются - они сохраняются в директории сборки. Если требуется, скопируйте файлы вручную
+
+* `Android studio` может быть использована подобным вышеуказанному способу - нужно использовать `cmake` вручную или через `Qt Creator` для конфигурации. Далее, откройте `<build-dir>/client/android-build` в `Android studio`. Не забудьте скопировать изменённые файлы в папку с исходным кодом - все файлы, изменённые в IDE, сохраняются фактически в папке сборки.
+
+### Установка Android SDK
+
+* Android SDK может быть установлен следующими способами:
+  - Используя `Qt Creator`, через настройки в пунктах `Preferences`->`SDKs`
+  - Используя `Android studio`. По умолчанию необходимые `SDK` устанавливаются автоматически.
+  - Вручную, используя `sdk-manager`. Подробности можно найти [здесь](https://developer.android.com/tools)
+
+## Лицензия
+
+GPL v3.0
+
+## Донаты
+
+Patreon: [https://www.patreon.com/amneziavpn](https://www.patreon.com/amneziavpn)
+
+Bitcoin: bc1qmhtgcf9637rl3kqyy22r2a8wa8laka4t9rx2mf <br>
+USDT BEP20: 0x6abD576765a826f87D1D95183438f9408C901bE4 <br>
+USDT TRC20: TELAitazF1MZGmiNjTcnxDjEiH5oe7LC9d <br>
+XMR: 48spms39jt1L2L5vyw2RQW6CXD6odUd4jFu19GZcDyKKQV9U88wsJVjSbL4CfRys37jVMdoaWVPSvezCQPhHXUW5UKLqUp3 <br> 
+TON: UQDpU1CyKRmg7L8mNScKk9FRc2SlESuI7N-Hby4nX-CcVmns
+
+## Благодарности
+
+Этот проект тестируется с помощью BrowserStack.
+Мы выражаем благодарность [BrowserStack](https://www.browserstack.com) за поддержку нашего проекта.

THIRD_PARTY_LICENSES.md

@@ -0,0 +1,149 @@
+# Third-Party Licenses
+
+This project is licensed under the GNU General Public License v3.0.
+This file lists third-party software components used by this repository.
+Each component is distributed under its own license as linked below.
+
+---
+
+## QtKeychain
+
+- Source: https://github.com/frankosterfeld/qtkeychain
+- License: BSD License
+- License Text: https://www.gnu.org/licenses/license-list.html#ModifiedBSD
+
+---
+
+## QSimpleCrypto
+
+- Source: https://github.com/n1flh31mur/QSimpleCrypto
+- License: Apache License 2.0
+- License Text: https://github.com/n1flh31mur/QSimpleCrypto/blob/master/LICENSE
+
+---
+
+## SortFilterProxyModel
+
+- Source: https://github.com/oKcerG/SortFilterProxyModel
+- License: MIT License
+- License Text: https://github.com/oKcerG/SortFilterProxyModel/blob/master/LICENSE
+
+---
+
+## QJsonStruct
+
+- Source: https://github.com/Qv2ray/QJsonStruct
+- License: MIT License
+- License Text: https://github.com/Qv2ray/QJsonStruct/blob/master/LICENSE
+
+---
+
+## QR Code Generator (qrcodegen)
+
+- Source: https://github.com/nayuki/QR-Code-generator
+- License: MIT License
+- License Text: https://www.nayuki.io/page/qr-code-generator-library
+
+---
+
+## Qt Gamepad
+
+- Source: https://github.com/qt/qtgamepad
+- License: GNU General Public License v3.0 (GPL-3.0)
+- License Text: https://www.gnu.org/licenses/gpl-3.0.en.html
+
+---
+
+## AmneziaWG Apple (WireGuard)
+
+- Source: https://github.com/amnezia-vpn/amneziawg-apple
+- License: MIT License
+- License Text: https://github.com/amnezia-vpn/amneziawg-apple/blob/master/COPYING
+
+---
+
+## AmneziaWG Android
+
+- Source: https://github.com/amnezia-vpn/amneziawg-go
+- License: MIT License
+- License Text: https://github.com/amnezia-vpn/amneziawg-go/blob/master/LICENSE
+
+---
+
+## Xray Core
+
+- Source: https://github.com/XTLS/Xray-core
+- License: Mozilla Public License 2.0 (MPL-2.0)
+- License Text: https://github.com/XTLS/Xray-core/blob/main/LICENSE
+
+---
+
+## Cloak
+
+- Source: https://github.com/cbeuw/Cloak
+- License: GNU General Public License v3.0 (GPL-3.0)
+- License Text: https://github.com/cbeuw/Cloak/blob/master/LICENSE
+
+---
+
+## Shadowsocks
+
+- Source: https://github.com/shadowsocks/shadowsocks-libev
+- License: GPL-3.0-or-later
+- License Text: http://www.gnu.org/licenses/
+
+---
+
+## OpenSSL
+
+- Source: https://github.com/openssl/openssl
+- License: Apache License 2.0
+- License Text: https://www.openssl.org/source/license.html
+
+---
+
+## libssh
+
+- Source: https://www.libssh.org/
+- License: GNU Lesser General Public License (LGPL)
+- License Text: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html
+
+---
+
+## OpenVPNAdapter
+
+- Source: https://github.com/ss-abramchuk/OpenVPNAdapter
+- License: GNU Affero General Public License v3.0 (AGPL-3.0)
+- License Text: https://github.com/ss-abramchuk/OpenVPNAdapter/blob/master/LICENSE
+
+---
+
+## Wintun
+
+- Source: https://www.wintun.net/
+- License: Prebuilt Binaries License
+- License Text: https://github.com/WireGuard/wintun/blob/master/prebuilt-binaries-license.txt
+
+---
+
+## Mullvad Split Tunnel Driver
+
+- Source: https://github.com/mullvad/win-split-tunnel
+- License: GNU General Public License v3.0 (GPL-3.0) and Mozilla Public License Version 2.0
+- License Text: https://github.com/mullvad/win-split-tunnel/blob/master/LICENSE-GPL.md https://github.com/mullvad/win-split-tunnel/blob/master/LICENSE-MPL.txt
+
+---
+
+## tun2socks
+
+- Source: https://github.com/eycorsican/go-tun2socks
+- License: MIT License
+- License Text: https://github.com/eycorsican/go-tun2socks/blob/master/LICENSE
+
+---
+
+## TAP-Windows Driver
+
+- Source: https://github.com/OpenVPN/tap-windows6
+- License: tap-windows6 license
+- License Text: https://github.com/OpenVPN/tap-windows6/blob/master/COPYING

agw-sdk/.gitignore

@@ -0,0 +1,14 @@
+# Локальные сборки
+build/
+build-*/
+cmake-build-*/
+
+# Conan
+CMakeUserPresets.json
+conan.lock
+
+# Примеры
+examples/dart_smoke/.dart_tool/
+examples/dart_smoke/pubspec.lock
+examples/c_smoke/smoke
+test_package/

agw-sdk/CMakeLists.txt

@@ -0,0 +1,133 @@
+cmake_minimum_required(VERSION 3.21)
+
+project(agw LANGUAGES CXX VERSION 0.1.0)
+
+# --- стандарт ---------------------------------------------------------------
+# floor C++20 (см. решения в docs/plans/gateway-sdk/README.md). C++23 — opt-in позже.
+set(CMAKE_CXX_STANDARD 20)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
+set(CMAKE_CXX_EXTENSIONS OFF)
+
+if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
+    set(CMAKE_BUILD_TYPE Release CACHE STRING "" FORCE)
+endif()
+
+# --- опции ------------------------------------------------------------------
+# Когда SDK подключают через add_subdirectory (отладочная сборка в клиенте), по умолчанию НЕ строим
+# тесты и НЕ строим shared C-ABI, чтобы не пачкать родительскую сборку. Standalone — всё включено.
+if(PROJECT_IS_TOP_LEVEL)
+    set(_agw_default_aux ON)
+else()
+    set(_agw_default_aux OFF)
+endif()
+option(AGW_BUILD_TESTS "Build agw-sdk tests" ${_agw_default_aux})
+
+# Режимы зависимостей (Фаза 5): shared-deps — общий OpenSSL из Conan; vendored — бандл.
+# На Фазе 1 определяем only-флаг, реальный механизм бандла появится в Фазе 5.
+set(AGW_DEPS_MODE "shared-deps" CACHE STRING "Dependency mode: shared-deps | vendored")
+
+# --- зависимости ------------------------------------------------------------
+find_package(OpenSSL REQUIRED)
+find_package(Threads REQUIRED)
+
+# libcurl (транспорт по умолчанию). Если не найден — SDK собирается без него, а клиент обязан
+# передать свой IHttpClient через Config (см. default_client_fallback.cpp).
+find_package(CURL QUIET)
+
+# nlohmann/json: предпочтительно из Conan (find_package), иначе — вендоренный single-header
+# (он лежит в tests/third_party и нужен только для локальной сборки без Conan).
+find_package(nlohmann_json QUIET)
+if(NOT nlohmann_json_FOUND)
+    add_library(agw_nlohmann_fallback INTERFACE)
+    target_include_directories(agw_nlohmann_fallback INTERFACE
+        ${CMAKE_CURRENT_SOURCE_DIR}/tests/third_party)
+    add_library(nlohmann_json::nlohmann_json ALIAS agw_nlohmann_fallback)
+    message(STATUS "agw: using vendored nlohmann/json fallback (tests/third_party)")
+endif()
+
+# --- библиотека -------------------------------------------------------------
+# Один раз компилируем объекты, из них собираем static (agw) и shared C-ABI (agw_capi).
+add_library(agw_obj OBJECT
+    src/gateway_controller.cpp
+    src/c_abi.cpp
+    src/crypto/rng.cpp
+    src/crypto/aes.cpp
+    src/crypto/rsa.cpp
+    src/crypto/hash.cpp
+    src/http/curl_client.cpp
+    src/http/default_client_fallback.cpp
+    src/protocol/request_builder.cpp
+    src/protocol/response.cpp
+    src/protocol/error_mapping.cpp
+    src/failover/bypass_policy.cpp
+    src/failover/proxy_list.cpp
+    src/failover/proxy_picker.cpp
+    src/util/base64.cpp
+    src/util/uuid.cpp
+    src/util/json.cpp
+    src/util/url.cpp
+    src/util/thread_pool.cpp
+)
+
+target_include_directories(agw_obj
+    PUBLIC  ${CMAKE_CURRENT_SOURCE_DIR}/include
+    PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/src
+)
+# PUBLIC, чтобы зависимости и include-пути дотекли до static/shared (и до тестов).
+target_link_libraries(agw_obj
+    PUBLIC OpenSSL::Crypto nlohmann_json::nlohmann_json Threads::Threads
+)
+# Скрываем всё по умолчанию: наружу торчат только agw_* (AGW_API = visibility default).
+set_target_properties(agw_obj PROPERTIES
+    CXX_VISIBILITY_PRESET hidden
+    VISIBILITY_INLINES_HIDDEN ON
+    POSITION_INDEPENDENT_CODE ON
+)
+
+if(CURL_FOUND)
+    target_compile_definitions(agw_obj PRIVATE AGW_HAVE_CURL)
+    target_link_libraries(agw_obj PUBLIC CURL::libcurl)
+    message(STATUS "agw: libcurl found — default HTTP client enabled")
+else()
+    message(STATUS "agw: libcurl NOT found — default HTTP client disabled (inject IHttpClient via Config)")
+endif()
+
+# Статическая библиотека (C++ API) — для наших приложений / тестов.
+add_library(agw STATIC)
+target_link_libraries(agw PUBLIC agw_obj)
+add_library(agw::agw ALIAS agw)
+
+# Shared C-ABI библиотека (для dart:ffi и сторонних). Экспортирует только agw_*.
+option(AGW_BUILD_CAPI_SHARED "Build shared C-ABI library (agw_capi)" ${_agw_default_aux})
+if(AGW_BUILD_CAPI_SHARED)
+    add_library(agw_capi SHARED $<TARGET_OBJECTS:agw_obj>)
+    target_link_libraries(agw_capi PRIVATE agw_obj)
+    target_compile_definitions(agw_capi PRIVATE AGW_BUILDING_SHARED)
+    set_target_properties(agw_capi PROPERTIES OUTPUT_NAME agw_capi)
+    message(STATUS "agw: deps mode = ${AGW_DEPS_MODE} (vendored — статическая линковка/скрытие символов, через Conan)")
+endif()
+
+set_target_properties(agw PROPERTIES
+    CXX_VISIBILITY_PRESET hidden
+    VISIBILITY_INLINES_HIDDEN ON
+    POSITION_INDEPENDENT_CODE ON
+)
+
+# --- установка (только для Conan-пакета / standalone; не при add_subdirectory) ---------------
+if(PROJECT_IS_TOP_LEVEL)
+    include(GNUInstallDirs)
+    install(TARGETS agw ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR})
+    if(AGW_BUILD_CAPI_SHARED)
+        install(TARGETS agw_capi
+            LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
+            RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
+    endif()
+    install(DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/include/agw
+            DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
+endif()
+
+# --- тесты ------------------------------------------------------------------
+if(AGW_BUILD_TESTS)
+    enable_testing()
+    add_subdirectory(tests)
+endif()

agw-sdk/README.md

@@ -0,0 +1,110 @@
+# agw-sdk
+
+Qt-free C++20 транспорт к API-шлюзу Amnezia (вынос `GatewayController`). Узкая поверхность —
+`post` (sync/async) поверх крипты, выбора эндпоинта и обхода блокировок. Протокол воспроизводится
+байт-в-байт.
+
+План и решения: [../docs/plans/gateway-sdk/](../docs/plans/gateway-sdk/) — начни с
+`agw-sdk-tier1-impl-plan.md` и `README.md` (таблица решений).
+
+## Статус
+
+Тир 1, в работе по фазам:
+
+- [x] **Фаза 1** — каркас + крипта на OpenSSL EVP (AES-256-CBC, RSA-PKCS1 v1.5, SHA-512), base64
+  (std + url), UUID v4, Qt-Indented JSON-сериализатор, golden-тесты крипты.
+- [x] **Фаза 2** — `IHttpClient`(libcurl) + `Config`/`GatewayController`/`executePost` + sync `post`;
+  `request_builder`/`response`/`error_mapping`; интеграционный тест через in-process mock-шлюз
+  (полный round-trip: SDK шифрует → «сервер» расшифровывает → шифрует ответ → SDK расшифровывает).
+- [x] **Фаза 3** — failover: `bypass_policy` (`shouldBypassProxy` дословно), `proxy_list`
+  (S3-пути + prod-расшифровка через `SHA-512(pubkey)`), `proxy_picker` (health-check `lmbd-health`),
+  встройка в `executePost` с кешем рабочего прокси на инстансе (под мьютексом). Интеграционный тест:
+  прямой ответ подозрителен → S3 → health → прокси → успех; повторный запрос идёт сразу на кеш.
+- [x] **Фаза 4** — `util::ThreadPool` (drain в деструкторе), `postAsync`(коллбэк на потоке пула)/
+  `postFuture`(`std::future`) поверх `executePost`, `CancellationToken` (проверки между шагами
+  failover + прерывание трансфера через progress-коллбэк curl → `ErrorCode::Cancelled`). Кеш прокси
+  под мьютексом, пул — последний член Impl (рушится первым, дожидаясь задач). TSan чисто; ASan+UBSan
+  10/10.
+- [x] **Фаза 5** — C-ABI (`include/agw/c_abi.h` + `src/c_abi.cpp`, `agw_*`: создание/уничтожение,
+  sync/async `post`, токен отмены, освобождение результата; на границе только C-типы). Сборка:
+  object-библиотека → static `agw` + shared `agw_capi` (экспортирует **только** `agw_*`, остальное
+  скрыто). C-smoke (чистый C) и Dart-smoke (`dart:ffi`) проходят. `conan create` (shared-deps)
+  зелёный — пакет с `libagw.a` + `libagw_capi.dylib` + заголовками. Режим `vendored` (статические
+  зависимости) задан в conanfile (`-o deps_mode=vendored`).
+- [~] **Фаза 6** — интеграция в Qt-клиент. Готово: `GatewayController` переписан тонким адаптером
+  над `agw::GatewayController` (сигнатуры один в один, байт-паритет payload, персистентный клиент на
+  окружение, `onBeforeRequest` = iOS inet + desktop kill-switch, async через `QPromise`+маршалинг);
+  проводка сборки (корневой `conanfile` requires `agw-sdk/0.1.0`, `client/cmake/3rdparty.cmake`
+  линкует `agw::agw`). Осталось (вне этого окружения): Qt-сборка под все платформы, перевод
+  синхронных вызовов (`subscription`/`servicesCatalog` `executeRequest`) на рабочий поток, регрессия
+  против dev/prod. См. `docs/plans/gateway-sdk/agw-sdk-tier1-phase6-integration.md`.
+
+## Раскладка
+
+```
+include/agw/   публичные заголовки (types, config, client, http, cancellation, c_abi)
+src/crypto/    AES, RSA, SHA-512, RNG
+src/util/      base64, uuid, json (Qt-Indented), url, thread_pool
+src/protocol/  имена полей API, request_builder, response, error_mapping
+src/failover/  bypass_policy, proxy_list, proxy_picker
+src/http/      curl_client (+ fallback)
+src/c_abi.cpp  C-ABI обёртка
+tests/         unit + golden + integration (+ вендоренный nlohmann для офлайн-сборки)
+examples/      c_smoke (чистый C), dart_smoke (dart:ffi)
+```
+
+## C-ABI и потребление из Dart/C
+
+Публичный C-заголовок — `include/agw/c_abi.h`. Shared-библиотека `libagw_capi.*` экспортирует только
+`agw_*`. Примеры:
+
+```sh
+# чистый C
+cc -std=c11 -Iinclude examples/c_smoke/smoke.c -Lbuild-local -lagw_capi -o /tmp/agw_smoke
+DYLD_LIBRARY_PATH=build-local /tmp/agw_smoke         # → код 1105, OK
+
+# Dart (dart:ffi)
+cd examples/dart_smoke && dart pub get && dart run   # → код 1105, OK
+```
+
+## Локальная сборка и тесты (без Conan)
+
+Нужны CMake ≥ 3.21 и OpenSSL 3. nlohmann/json берётся из вендоренного single-header
+(`tests/third_party`), если Conan-пакет не найден.
+
+```sh
+cmake -S . -B build-local -DOPENSSL_ROOT_DIR=$(brew --prefix openssl@3)
+cmake --build build-local -j
+ctest --test-dir build-local --output-on-failure
+```
+
+Санитайзеры (macOS): TSan — на конкурентных тестах; ASan+UBSan — `detect_leaks=0` (LSan на Darwin
+не поддержан):
+
+```sh
+cmake -S . -B build-asan -DOPENSSL_ROOT_DIR=$(brew --prefix openssl@3) \
+  -DCMAKE_CXX_FLAGS="-fsanitize=address,undefined -g -O1" \
+  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address,undefined"
+cmake --build build-asan -j
+ASAN_OPTIONS=detect_leaks=0 ctest --test-dir build-asan --output-on-failure
+```
+
+## Сборка через Conan (как в проекте)
+
+```sh
+conan create . -o build_tests=True
+```
+
+Зависимости: `openssl/3.6.2`, `nlohmann_json/3.11.3` (как в корневом `conanfile.py`); `libcurl` —
+с Фазы 2.
+
+## Заметки по паритету
+
+Крипта сверена с `client/3rd/QSimpleCrypto` и `gatewayController.cpp`. Ключевое:
+
+- AES-256-CBC, ключ 32 байта, IV генерится 32 — CBC берёт первые 16; salt (8 байт) в локальном AES
+  не участвует, уходит только в `key_payload`.
+- RSA PKCS#1 v1.5 — паддинг рандомный, поэтому `key_payload` **не** воспроизводим байт-в-байт;
+  golden проверяет его round-trip, а `api_payload` (AES) — точные байты.
+- JSON собирается в формате `QJsonDocument::toJson(Indented)`: отступ 4 пробела, завершающий `\n`,
+  **отсортированные ключи** (это даёт `aes_iv` раньше `aes_key`).

agw-sdk/conanfile.py

@@ -0,0 +1,65 @@
+from conan import ConanFile
+from conan.tools.cmake import CMake, CMakeToolchain, CMakeDeps, cmake_layout
+
+
+class AgwSdkConan(ConanFile):
+    name = "agw-sdk"
+    version = "0.1.0"
+    license = "TBD"
+    description = "AGW SDK — Qt-free C++ transport to the Amnezia API gateway (Tier 1)"
+    settings = "os", "compiler", "build_type", "arch"
+
+    # shared-deps: линкуем общий OpenSSL/curl/nlohmann из Conan (наши приложения).
+    # vendored: бандлим зависимости статически + скрытие символов (сторонние/standalone).
+    options = {
+        "deps_mode": ["shared-deps", "vendored"],
+        "build_tests": [True, False],
+        "build_capi_shared": [True, False],
+    }
+    default_options = {
+        "deps_mode": "shared-deps",
+        "build_tests": False,
+        "build_capi_shared": True,
+    }
+
+    exports_sources = "CMakeLists.txt", "include/*", "src/*", "tests/*"
+
+    def requirements(self):
+        # Версия OpenSSL совпадает с приложением (корневой conanfile.py) — без второго OpenSSL.
+        self.requires("openssl/3.6.2")
+        self.requires("libcurl/8.10.1")
+        self.requires("nlohmann_json/3.11.3")
+
+    def configure(self):
+        # vendored: тянем статические зависимости, чтобы забандлить их в библиотеку.
+        if self.options.deps_mode == "vendored":
+            self.options["openssl"].shared = False
+            self.options["libcurl"].shared = False
+
+    def layout(self):
+        cmake_layout(self)
+
+    def generate(self):
+        deps = CMakeDeps(self)
+        deps.generate()
+        tc = CMakeToolchain(self)
+        tc.variables["AGW_DEPS_MODE"] = str(self.options.deps_mode)
+        tc.variables["AGW_BUILD_TESTS"] = bool(self.options.build_tests)
+        tc.variables["AGW_BUILD_CAPI_SHARED"] = bool(self.options.build_capi_shared)
+        tc.generate()
+
+    def build(self):
+        cmake = CMake(self)
+        cmake.configure()
+        cmake.build()
+
+    def package(self):
+        cmake = CMake(self)
+        cmake.install()
+
+    def package_info(self):
+        self.cpp_info.libs = ["agw"]
+        self.cpp_info.includedirs = ["include"]
+        # Потребитель подключает: find_package(agw-sdk) + target agw::agw
+        self.cpp_info.set_property("cmake_file_name", "agw-sdk")
+        self.cpp_info.set_property("cmake_target_name", "agw::agw")

agw-sdk/examples/c_smoke/smoke.c

@@ -0,0 +1,39 @@
+/*
+ * Чистый C-потребитель C-ABI: доказывает, что agw_* линкуется и работает из C без C++/Qt.
+ * Детерминированный путь без сети: невалидный публичный ключ → ApiMissingAgwPublicKey (1105).
+ *
+ * Сборка (пример, macOS):
+ *   cc -std=c11 -I ../../include smoke.c -L ../../build-local -lagw_capi -o smoke
+ *   DYLD_LIBRARY_PATH=../../build-local ./smoke
+ */
+
+#include <stdio.h>
+#include <string.h>
+
+#include "agw/c_abi.h"
+
+int main(void)
+{
+    agw_config cfg;
+    memset(&cfg, 0, sizeof(cfg));
+    cfg.gateway_endpoint = "gw.example.test";
+    cfg.agw_public_key_pem = "not a real pem key"; /* → 1105 без обращения к сети */
+    cfg.request_timeout_msecs = 5000;
+
+    agw_client *client = agw_client_create(&cfg);
+    if (client == NULL) {
+        printf("FAIL: agw_client_create returned NULL\n");
+        return 1;
+    }
+
+    agw_response r = agw_client_post(client, "https://%1/api/v1/test", "{\"x\":1}", "", "", NULL);
+    printf("post error code = %d\n", r.error);
+
+    int ok = (r.error == 1105); /* ApiMissingAgwPublicKey */
+
+    agw_response_free(&r);
+    agw_client_destroy(client);
+
+    printf(ok ? "OK\n" : "FAIL\n");
+    return ok ? 0 : 1;
+}

agw-sdk/examples/dart_smoke/bin/smoke.dart

@@ -0,0 +1,235 @@
+// Dart-демо C-ABI agw-sdk через dart:ffi.
+//
+// Показывает поток запроса: подключает лог-хук SDK и onBeforeRequest, поэтому печатаются строки
+// [agw] (post START -> direct request url -> direct response -> failover -> post DONE) — видно,
+// что запрос ушёл и ответ пришёл. Делает синхронный post, а при AGW_ASYNC=1 — ещё и асинхронный
+// (agw_client_post_async + NativeCallable.listener: коллбэк прилетает с потока пула SDK).
+//
+// Конфиг через переменные окружения (все опциональны):
+//   AGW_GATEWAY      хост шлюза с "%1"-подстановкой, напр. "http://gw.dev.amzsvc.com:80/"
+//   AGW_PUBKEY_FILE  путь к PEM ПУБЛИЧНОГО ключа шлюза (по умолчанию — тестовый фикстур)
+//   AGW_S3_PRIMARY   список S3-адресов через запятую (failover)
+//   AGW_DEV          "1" → dev-режим (S3-список открытым текстом)
+//   AGW_ENDPOINT     шаблон пути, по умолчанию "%1v1/services"
+//   AGW_PAYLOAD      JSON тела запроса
+//   AGW_ASYNC        "1" → дополнительно прогнать асинхронный вызов
+//   AGW_CAPI_LIB     путь к libagw_capi.* (иначе ../../build-local)
+
+import 'dart:async';
+import 'dart:ffi';
+import 'dart:io';
+
+import 'package:ffi/ffi.dart';
+
+final class AgwConfig extends Struct {
+  external Pointer<Utf8> gatewayEndpoint;
+  external Pointer<Utf8> agwPublicKeyPem;
+  external Pointer<Pointer<Utf8>> s3Primary;
+  @Size()
+  external int s3PrimaryCount;
+  external Pointer<Pointer<Utf8>> s3Fallback;
+  @Size()
+  external int s3FallbackCount;
+  @Int32()
+  external int isDevEnvironment;
+  @Int32()
+  external int requestTimeoutMsecs;
+  @Int32()
+  external int proxyHealthTimeoutMsecs;
+  @Int32()
+  external int proxyStorageTimeoutMsecs;
+  @Int32()
+  external int threadPoolSize;
+  external Pointer<Void> onBeforeRequest;
+  external Pointer<Void> onBeforeRequestUserData;
+  external Pointer<Void> log;
+  external Pointer<Void> logUserData;
+}
+
+final class AgwResponse extends Struct {
+  @Int32()
+  external int error;
+  external Pointer<Utf8> body;
+  @Size()
+  external int bodyLen;
+}
+
+typedef _CreateC = Pointer<Void> Function(Pointer<AgwConfig>);
+typedef _PostC = AgwResponse Function(Pointer<Void>, Pointer<Utf8>, Pointer<Utf8>,
+    Pointer<Utf8>, Pointer<Utf8>, Pointer<Void>);
+typedef _PostAsyncC = Void Function(Pointer<Void>, Pointer<Utf8>, Pointer<Utf8>,
+    Pointer<Utf8>, Pointer<Utf8>, Pointer<Void>, Pointer<Void>, Pointer<Void>);
+typedef _PostAsyncDart = void Function(Pointer<Void>, Pointer<Utf8>, Pointer<Utf8>,
+    Pointer<Utf8>, Pointer<Utf8>, Pointer<Void>, Pointer<Void>, Pointer<Void>);
+typedef _FreeC = Void Function(Pointer<AgwResponse>);
+typedef _FreeDart = void Function(Pointer<AgwResponse>);
+typedef _DestroyC = Void Function(Pointer<Void>);
+typedef _DestroyDart = void Function(Pointer<Void>);
+
+typedef _LogNative = Void Function(Int32, Pointer<Utf8>, Pointer<Void>);
+typedef _BeforeNative = Void Function(Pointer<Utf8>, Pointer<Void>);
+typedef _PostCbNative = Void Function(AgwResponse, Pointer<Void>);
+
+const _levels = ['DBG', 'INF', 'WRN', 'ERR'];
+
+void _printLog(String tag, int level, Pointer<Utf8> message) {
+  final lvl = (level >= 0 && level < _levels.length) ? _levels[level] : '?';
+  stdout.writeln('   $tag [agw][$lvl] ${message.toDartString()}');
+}
+
+class _Cfg {
+  final Pointer<AgwConfig> ptr;
+  final List<Pointer<NativeType>> allocs;
+  _Cfg(this.ptr, this.allocs);
+  void free() {
+    for (final p in allocs) {
+      calloc.free(p);
+    }
+    calloc.free(ptr);
+  }
+}
+
+String _libPath() {
+  final env = Platform.environment['AGW_CAPI_LIB'];
+  if (env != null) return env;
+  final base = '${Directory.current.path}/../../build-local';
+  if (Platform.isMacOS) return '$base/libagw_capi.dylib';
+  if (Platform.isWindows) return '$base/agw_capi.dll';
+  return '$base/libagw_capi.so';
+}
+
+String _defaultPubKey() {
+  final f = File('${Directory.current.path}/../../tests/golden/fixtures/test_rsa_pub.pem');
+  return f.existsSync() ? f.readAsStringSync() : 'not a real pem key';
+}
+
+late String gateway, pubKey, payload;
+late int isDev;
+late List<String> s3List;
+
+_Cfg buildConfig(Pointer<Void> logFn, Pointer<Void> beforeFn) {
+  final cfg = calloc<AgwConfig>();
+  final allocs = <Pointer<NativeType>>[];
+
+  final gw = gateway.toNativeUtf8();
+  final pk = pubKey.toNativeUtf8();
+  allocs.add(gw);
+  allocs.add(pk);
+  cfg.ref.gatewayEndpoint = gw;
+  cfg.ref.agwPublicKeyPem = pk;
+  cfg.ref.requestTimeoutMsecs = 8000;
+  cfg.ref.isDevEnvironment = isDev;
+  cfg.ref.onBeforeRequest = beforeFn;
+  cfg.ref.log = logFn;
+
+  if (s3List.isNotEmpty) {
+    final arr = calloc<Pointer<Utf8>>(s3List.length);
+    for (var i = 0; i < s3List.length; i++) {
+      arr[i] = s3List[i].toNativeUtf8();
+      allocs.add(arr[i]);
+    }
+    cfg.ref.s3Primary = arr;
+    cfg.ref.s3PrimaryCount = s3List.length;
+    allocs.add(arr);
+  }
+  return _Cfg(cfg, allocs);
+}
+
+Future<int> main() async {
+  final env = Platform.environment;
+  final lib = DynamicLibrary.open(_libPath());
+  final create = lib.lookupFunction<_CreateC, _CreateC>('agw_client_create');
+  final post = lib.lookupFunction<_PostC, _PostC>('agw_client_post');
+  final postAsync = lib.lookupFunction<_PostAsyncC, _PostAsyncDart>('agw_client_post_async');
+  final free = lib.lookupFunction<_FreeC, _FreeDart>('agw_response_free');
+  final destroy = lib.lookupFunction<_DestroyC, _DestroyDart>('agw_client_destroy');
+
+  gateway = env['AGW_GATEWAY'] ?? 'http://gw.example.test/';
+  final pubKeyFile = env['AGW_PUBKEY_FILE'];
+  pubKey = pubKeyFile != null ? File(pubKeyFile).readAsStringSync() : _defaultPubKey();
+  final endpoint = env['AGW_ENDPOINT'] ?? '%1v1/services';
+  payload = env['AGW_PAYLOAD'] ??
+      '{"os_version":"macos","app_version":"4.9.0","cli_name":"amnezia","app_language":"en"}';
+  isDev = (env['AGW_DEV'] == '1') ? 1 : 0;
+  s3List = (env['AGW_S3_PRIMARY'] ?? '')
+      .split(',')
+      .map((s) => s.trim())
+      .where((s) => s.isNotEmpty)
+      .toList();
+
+  stdout.writeln('=== agw-sdk Dart demo ===');
+  stdout.writeln('gateway=$gateway  endpoint=$endpoint  dev=$isDev  s3primary=${s3List.length}');
+  stdout.writeln('pubkey=${pubKeyFile ?? "(test fixture)"}');
+
+  final endpointC = endpoint.toNativeUtf8();
+  final payloadC = payload.toNativeUtf8();
+  final svc = ''.toNativeUtf8();
+
+  // ---------- SYNC (коллбэки isolateLocal: ядро sync исполняется на этом потоке) ----------
+  stdout.writeln('\n--- SYNC post ---');
+  final logSync = NativeCallable<_LogNative>.isolateLocal(
+      (int lvl, Pointer<Utf8> m, Pointer<Void> _) => _printLog('[sync]', lvl, m));
+  final beforeSync = NativeCallable<_BeforeNative>.isolateLocal(
+      (Pointer<Utf8> h, Pointer<Void> _) =>
+          stdout.writeln('   [sync] → onBeforeRequest host=${h.toDartString()}'));
+
+  final cfgSync = buildConfig(logSync.nativeFunction.cast(), beforeSync.nativeFunction.cast());
+  final clientSync = create(cfgSync.ptr);
+  final resp = post(clientSync, endpointC, payloadC, svc, svc, nullptr);
+  stdout.writeln('   [sync] RESULT errorCode=${resp.error} bodyLen=${resp.bodyLen}');
+  if (resp.body != nullptr && resp.bodyLen > 0) {
+    final body = resp.body.toDartString(length: resp.bodyLen);
+    stdout.writeln('   [sync] body=${body.length > 200 ? "${body.substring(0, 200)}…" : body}');
+  }
+  final rp = calloc<AgwResponse>()
+    ..ref.error = resp.error
+    ..ref.body = resp.body
+    ..ref.bodyLen = resp.bodyLen;
+  free(rp);
+  calloc.free(rp);
+  destroy(clientSync);
+  cfgSync.free();
+  logSync.close();
+  beforeSync.close();
+
+  // ---------- ASYNC (коллбэки listener: прилетают с потока пула SDK) ----------
+  if (env['AGW_ASYNC'] == '1') {
+    stdout.writeln('\n--- ASYNC post (коллбэк с потока пула) ---');
+    // ВАЖНО: лог-хук/onBeforeRequest сюда НЕ вешаем. Их const char* живут лишь во время вызова на
+    // потоке пула, а NativeCallable.listener выполняется позже на Dart event-loop → указатель был бы
+    // висячим. Result-коллбэк безопасен: body выделен в куче и принадлежит вызывающему (мы его освобождаем).
+    final done = Completer<void>();
+
+    final resultCb = NativeCallable<_PostCbNative>.listener((AgwResponse r, Pointer<Void> _) {
+      stdout.writeln('   [async] CALLBACK (прилетел с потока пула) errorCode=${r.error} bodyLen=${r.bodyLen}');
+      if (r.body != nullptr && r.bodyLen > 0) {
+        final body = r.body.toDartString(length: r.bodyLen);
+        stdout.writeln('   [async] body=${body.length > 200 ? "${body.substring(0, 200)}…" : body}');
+      }
+      final p = calloc<AgwResponse>()
+        ..ref.error = r.error
+        ..ref.body = r.body
+        ..ref.bodyLen = r.bodyLen;
+      free(p);
+      calloc.free(p);
+      done.complete();
+    });
+
+    final cfgAsync = buildConfig(nullptr, nullptr); // без лог/before-хуков (см. выше)
+    final clientAsync = create(cfgAsync.ptr);
+    stdout.writeln('   [async] post_async отправлен, ждём коллбэк…');
+    postAsync(clientAsync, endpointC, payloadC, svc, svc, resultCb.nativeFunction.cast(),
+        nullptr, nullptr);
+
+    await done.future; // ждём, пока коллбэк прилетит с потока пула
+    destroy(clientAsync);
+    cfgAsync.free();
+    resultCb.close();
+  }
+
+  calloc.free(endpointC);
+  calloc.free(payloadC);
+  calloc.free(svc);
+  stdout.writeln('\n=== done ===');
+  return 0;
+}

agw-sdk/examples/dart_smoke/pubspec.yaml

@@ -0,0 +1,9 @@
+name: agw_dart_smoke
+description: Smoke-вызов C-ABI agw-sdk через dart:ffi.
+publish_to: none
+
+environment:
+  sdk: ">=3.0.0 <4.0.0"
+
+dependencies:
+  ffi: ^2.1.0

agw-sdk/include/agw/agw.h

@@ -0,0 +1,10 @@
+#ifndef AGW_AGW_H
+#define AGW_AGW_H
+
+#include "agw/cancellation.h"
+#include "agw/gateway_controller.h"
+#include "agw/config.h"
+#include "agw/http.h"
+#include "agw/types.h"
+
+#endif

agw-sdk/include/agw/c_abi.h

@@ -0,0 +1,80 @@
+#ifndef AGW_C_ABI_H
+#define AGW_C_ABI_H
+
+#include <stddef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#if defined(_WIN32)
+    #if defined(AGW_BUILDING_SHARED)
+        #define AGW_API __declspec(dllexport)
+    #elif defined(AGW_USING_SHARED)
+        #define AGW_API __declspec(dllimport)
+    #else
+        #define AGW_API
+    #endif
+#else
+    #define AGW_API __attribute__((visibility("default")))
+#endif
+
+typedef struct agw_client agw_client;
+typedef struct agw_cancel_token agw_cancel_token;
+
+typedef void (*agw_before_request_fn)(const char *host, void *user_data);
+typedef void (*agw_log_fn)(int level, const char *message, void *user_data);
+
+typedef struct
+{
+    const char *gateway_endpoint;
+    const char *agw_public_key_pem;
+
+    const char *const *s3_primary_endpoints;
+    size_t s3_primary_count;
+    const char *const *s3_fallback_endpoints;
+    size_t s3_fallback_count;
+
+    int is_dev_environment;
+    int request_timeout_msecs;
+    int proxy_health_timeout_msecs;
+    int proxy_storage_timeout_msecs;
+    int thread_pool_size;
+
+    agw_before_request_fn on_before_request;
+    void *on_before_request_user_data;
+    agw_log_fn log;
+    void *log_user_data;
+} agw_config;
+
+typedef struct
+{
+    int error;
+    char *body;
+    size_t body_len;
+} agw_response;
+
+typedef void (*agw_post_callback)(agw_response response, void *user_data);
+
+AGW_API agw_client *agw_client_create(const agw_config *config);
+AGW_API void agw_client_destroy(agw_client *client);
+
+AGW_API agw_response agw_client_post(agw_client *client, const char *endpoint, const char *payload,
+                                     const char *service_type, const char *user_country_code,
+                                     agw_cancel_token *cancel_token);
+
+AGW_API void agw_client_post_async(agw_client *client, const char *endpoint, const char *payload,
+                                   const char *service_type, const char *user_country_code, agw_post_callback callback,
+                                   void *user_data, agw_cancel_token *cancel_token);
+
+AGW_API void agw_response_free(agw_response *response);
+
+AGW_API agw_cancel_token *agw_cancel_token_create(void);
+AGW_API void agw_cancel_token_cancel(agw_cancel_token *token);
+AGW_API void agw_cancel_token_destroy(agw_cancel_token *token);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

agw-sdk/include/agw/cancellation.h

@@ -0,0 +1,30 @@
+#ifndef AGW_CANCELLATION_H
+#define AGW_CANCELLATION_H
+
+#include <atomic>
+
+namespace agw
+{
+    class CancellationToken
+    {
+    public:
+        CancellationToken() = default;
+
+        CancellationToken(const CancellationToken &) = delete;
+        CancellationToken &operator=(const CancellationToken &) = delete;
+
+        void cancel() noexcept
+        {
+            m_cancelled.store(true, std::memory_order_relaxed);
+        }
+        bool isCancelled() const noexcept
+        {
+            return m_cancelled.load(std::memory_order_relaxed);
+        }
+
+    private:
+        std::atomic<bool> m_cancelled { false };
+    };
+}
+
+#endif

agw-sdk/include/agw/config.h

@@ -0,0 +1,38 @@
+#ifndef AGW_CONFIG_H
+#define AGW_CONFIG_H
+
+#include <functional>
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "agw/http.h"
+#include "agw/types.h"
+
+namespace agw
+{
+    struct Config
+    {
+        std::string gatewayEndpoint;
+
+        std::string agwPublicKeyPem;
+
+        std::vector<std::string> s3PrimaryEndpoints;
+        std::vector<std::string> s3FallbackEndpoints;
+
+        bool isDevEnvironment = false;
+
+        int requestTimeoutMsecs = 12000;
+        int proxyHealthTimeoutMsecs = 1000;
+        int proxyStorageTimeoutMsecs = 3000;
+        int threadPoolSize = 4;
+
+        std::function<void(const std::string &host)> onBeforeRequest;
+
+        std::function<void(LogLevel, const std::string &message)> log;
+
+        std::shared_ptr<IHttpClient> httpClient;
+    };
+}
+
+#endif

agw-sdk/include/agw/gateway_controller.h

@@ -0,0 +1,40 @@
+#ifndef AGW_GATEWAY_CONTROLLER_H
+#define AGW_GATEWAY_CONTROLLER_H
+
+#include <functional>
+#include <future>
+#include <memory>
+#include <string>
+
+#include "agw/cancellation.h"
+#include "agw/config.h"
+#include "agw/types.h"
+
+namespace agw {
+class GatewayController {
+public:
+    explicit GatewayController(Config config);
+    ~GatewayController();
+
+    GatewayController(GatewayController &&) noexcept;
+    GatewayController &operator=(GatewayController &&) noexcept;
+    GatewayController(const GatewayController &) = delete;
+    GatewayController &operator=(const GatewayController &) = delete;
+
+    Response post(const std::string &endpoint, const std::string &payload, const FailoverContext &ctx,
+                  CancellationToken *cancel = nullptr);
+
+    void postAsync(const std::string &endpoint, const std::string &payload,
+                   std::function<void(Response)> onResult, const FailoverContext &ctx,
+                   CancellationToken *cancel = nullptr);
+
+    std::future<Response> postFuture(const std::string &endpoint, const std::string &payload,
+                                     const FailoverContext &ctx, CancellationToken *cancel = nullptr);
+
+private:
+    struct Impl;
+    std::unique_ptr<Impl> m_impl;
+};
+}
+
+#endif

agw-sdk/include/agw/http.h

@@ -0,0 +1,51 @@
+#ifndef AGW_HTTP_H
+#define AGW_HTTP_H
+
+#include <functional>
+#include <memory>
+#include <string>
+#include <utility>
+#include <vector>
+
+namespace agw
+{
+    enum class TransportError {
+        None = 0,
+        Timeout,
+        Canceled,
+        OperationNotImplemented,
+        ConnectionError,
+    };
+
+    struct HttpRequest
+    {
+        std::string url;
+        std::string method;
+        std::string body;
+        std::vector<std::pair<std::string, std::string>> headers;
+        int timeoutMsecs = 0;
+
+        std::function<bool()> cancelCheck;
+    };
+
+    struct HttpResponse
+    {
+        TransportError error = TransportError::None;
+        std::string errorString;
+        int httpStatusCode = 0;
+
+        bool sslError = false;
+        std::string body;
+    };
+
+    class IHttpClient
+    {
+    public:
+        virtual ~IHttpClient() = default;
+        virtual HttpResponse send(const HttpRequest &request) = 0;
+    };
+
+    std::unique_ptr<IHttpClient> makeDefaultHttpClient();
+}
+
+#endif

agw-sdk/include/agw/types.h

@@ -0,0 +1,55 @@
+#ifndef AGW_TYPES_H
+#define AGW_TYPES_H
+
+#include <string>
+
+namespace agw
+{
+    enum class ErrorCode : int {
+        NoError = 0,
+        Cancelled = 1,
+
+        ApiConfigDownloadError = 1100,
+        ApiConfigAlreadyAdded = 1101,
+        ApiConfigEmptyError = 1102,
+        ApiConfigTimeoutError = 1103,
+        ApiConfigSslError = 1104,
+        ApiMissingAgwPublicKey = 1105,
+        ApiConfigDecryptionError = 1106,
+        ApiServicesMissingError = 1107,
+        ApiConfigLimitError = 1108,
+        ApiNotFoundError = 1109,
+        ApiMigrationError = 1110,
+        ApiUpdateRequestError = 1111,
+        ApiSubscriptionExpiredError = 1112,
+        ApiPurchaseError = 1113,
+        ApiSubscriptionNotActiveError = 1114,
+        ApiNoPurchasedSubscriptionsError = 1115,
+        ApiTrialAlreadyUsedError = 1116,
+        ApiCaptchaRequiredError = 1117,
+        ApiCaptchaInvalidError = 1118,
+        ApiCaptchaRefreshError = 1119,
+        ApiRateLimitError = 1120,
+    };
+
+    enum class LogLevel : int {
+        Debug,
+        Info,
+        Warning,
+        Error
+    };
+
+    struct Response
+    {
+        ErrorCode error = ErrorCode::NoError;
+        std::string body;
+    };
+
+    struct FailoverContext
+    {
+        std::string serviceType;
+        std::string userCountryCode;
+    };
+}
+
+#endif

agw-sdk/src/c_abi.cpp

@@ -0,0 +1,201 @@
+#include "agw/c_abi.h"
+
+#include <cstdlib>
+#include <cstring>
+#include <memory>
+#include <mutex>
+#include <string>
+#include <utility>
+
+#include "agw/cancellation.h"
+#include "agw/gateway_controller.h"
+#include "agw/config.h"
+#include "detail/test_hooks.h"
+
+struct agw_client
+{
+    explicit agw_client(agw::Config cfg) : client(std::move(cfg))
+    {
+    }
+    agw::GatewayController client;
+};
+
+struct agw_cancel_token
+{
+    agw::CancellationToken token;
+};
+
+namespace agw::detail
+{
+    namespace
+    {
+        std::mutex g_testHttpMutex;
+        std::shared_ptr<IHttpClient> g_testHttp;
+    }
+
+    void setNextTestHttpClient(std::shared_ptr<IHttpClient> http)
+    {
+        std::lock_guard<std::mutex> lock(g_testHttpMutex);
+        g_testHttp = std::move(http);
+    }
+
+    std::shared_ptr<IHttpClient> takeNextTestHttpClient()
+    {
+        std::lock_guard<std::mutex> lock(g_testHttpMutex);
+        std::shared_ptr<IHttpClient> h = std::move(g_testHttp);
+        g_testHttp.reset();
+        return h;
+    }
+}
+
+namespace
+{
+    std::string cstr(const char *s)
+    {
+        return s ? std::string(s) : std::string();
+    }
+
+    agw_response toCResponse(const agw::Response &r)
+    {
+        agw_response out;
+        out.error = static_cast<int>(r.error);
+        out.body = nullptr;
+        out.body_len = r.body.size();
+
+        char *buf = static_cast<char *>(std::malloc(r.body.size() + 1));
+        if (buf != nullptr) {
+            if (!r.body.empty()) {
+                std::memcpy(buf, r.body.data(), r.body.size());
+            }
+            buf[r.body.size()] = '\0';
+            out.body = buf;
+        } else {
+            out.body_len = 0;
+        }
+        return out;
+    }
+}
+
+extern "C" {
+agw_client *agw_client_create(const agw_config *config)
+{
+    if (config == nullptr) {
+        return nullptr;
+    }
+
+    agw::Config cfg;
+    cfg.gatewayEndpoint = cstr(config->gateway_endpoint);
+    cfg.agwPublicKeyPem = cstr(config->agw_public_key_pem);
+
+    for (size_t i = 0; i < config->s3_primary_count; ++i) {
+        cfg.s3PrimaryEndpoints.push_back(cstr(config->s3_primary_endpoints[i]));
+    }
+    for (size_t i = 0; i < config->s3_fallback_count; ++i) {
+        cfg.s3FallbackEndpoints.push_back(cstr(config->s3_fallback_endpoints[i]));
+    }
+
+    cfg.isDevEnvironment = config->is_dev_environment != 0;
+    if (config->request_timeout_msecs > 0)
+        cfg.requestTimeoutMsecs = config->request_timeout_msecs;
+    if (config->proxy_health_timeout_msecs > 0)
+        cfg.proxyHealthTimeoutMsecs = config->proxy_health_timeout_msecs;
+    if (config->proxy_storage_timeout_msecs > 0)
+        cfg.proxyStorageTimeoutMsecs = config->proxy_storage_timeout_msecs;
+    if (config->thread_pool_size > 0)
+        cfg.threadPoolSize = config->thread_pool_size;
+
+    if (config->on_before_request != nullptr) {
+        agw_before_request_fn fn = config->on_before_request;
+        void *ud = config->on_before_request_user_data;
+        cfg.onBeforeRequest = [fn, ud](const std::string &host) { fn(host.c_str(), ud); };
+    }
+    if (config->log != nullptr) {
+        agw_log_fn fn = config->log;
+        void *ud = config->log_user_data;
+        cfg.log = [fn, ud](agw::LogLevel level, const std::string &msg) { fn(static_cast<int>(level), msg.c_str(), ud); };
+    }
+
+    if (auto http = agw::detail::takeNextTestHttpClient()) {
+        cfg.httpClient = http;
+    }
+
+    try {
+        return new agw_client(std::move(cfg));
+    } catch (...) {
+        return nullptr;
+    }
+}
+
+void agw_client_destroy(agw_client *client)
+{
+    delete client;
+}
+
+agw_response agw_client_post(agw_client *client, const char *endpoint, const char *payload, const char *service_type,
+                             const char *user_country_code, agw_cancel_token *cancel_token)
+{
+    if (client == nullptr) {
+        agw_response out;
+        out.error = static_cast<int>(agw::ErrorCode::ApiConfigDownloadError);
+        out.body = nullptr;
+        out.body_len = 0;
+        return out;
+    }
+
+    agw::FailoverContext ctx { cstr(service_type), cstr(user_country_code) };
+    agw::CancellationToken *tk = cancel_token ? &cancel_token->token : nullptr;
+    agw::Response r = client->client.post(cstr(endpoint), cstr(payload), ctx, tk);
+    return toCResponse(r);
+}
+
+void agw_client_post_async(agw_client *client, const char *endpoint, const char *payload, const char *service_type,
+                           const char *user_country_code, agw_post_callback callback, void *user_data,
+                           agw_cancel_token *cancel_token)
+{
+    if (client == nullptr || callback == nullptr) {
+        return;
+    }
+
+    agw::FailoverContext ctx { cstr(service_type), cstr(user_country_code) };
+    agw::CancellationToken *tk = cancel_token ? &cancel_token->token : nullptr;
+
+    client->client.postAsync(
+            cstr(endpoint), cstr(payload),
+            [callback, user_data](agw::Response r) {
+                agw_response cr = toCResponse(r);
+                callback(cr, user_data);
+            },
+            ctx, tk);
+}
+
+void agw_response_free(agw_response *response)
+{
+    if (response == nullptr) {
+        return;
+    }
+    std::free(response->body);
+    response->body = nullptr;
+    response->body_len = 0;
+}
+
+agw_cancel_token *agw_cancel_token_create(void)
+{
+    try {
+        return new agw_cancel_token();
+    } catch (...) {
+        return nullptr;
+    }
+}
+
+void agw_cancel_token_cancel(agw_cancel_token *token)
+{
+    if (token != nullptr) {
+        token->token.cancel();
+    }
+}
+
+void agw_cancel_token_destroy(agw_cancel_token *token)
+{
+    delete token;
+}
+}

agw-sdk/src/crypto/aes.cpp

@@ -0,0 +1,87 @@
+#include "aes.h"
+
+#include <memory>
+#include <stdexcept>
+
+#include <openssl/evp.h>
+
+namespace agw::crypto
+{
+    namespace
+    {
+        using CtxPtr = std::unique_ptr<EVP_CIPHER_CTX, decltype(&EVP_CIPHER_CTX_free)>;
+
+        constexpr int kAes256KeyLen = 32;
+        constexpr int kAesBlock = 16;
+
+        void checkKeyIv(const std::vector<std::uint8_t> &key, const std::vector<std::uint8_t> &iv)
+        {
+            if (key.size() != static_cast<std::size_t>(kAes256KeyLen)) {
+                throw std::runtime_error("agw::crypto::aes: key must be 32 bytes (AES-256)");
+            }
+            if (iv.size() < static_cast<std::size_t>(kAesBlock)) {
+                throw std::runtime_error("agw::crypto::aes: iv must be at least 16 bytes");
+            }
+        }
+    }
+
+    std::vector<std::uint8_t> aesEncryptCbc(const std::vector<std::uint8_t> &data, const std::vector<std::uint8_t> &key,
+                                            const std::vector<std::uint8_t> &iv)
+    {
+        checkKeyIv(key, iv);
+
+        CtxPtr ctx(EVP_CIPHER_CTX_new(), EVP_CIPHER_CTX_free);
+        if (!ctx) {
+            throw std::runtime_error("agw::crypto::aes: EVP_CIPHER_CTX_new failed");
+        }
+
+        if (EVP_EncryptInit_ex(ctx.get(), EVP_aes_256_cbc(), nullptr, key.data(), iv.data()) != 1) {
+            throw std::runtime_error("agw::crypto::aes: EVP_EncryptInit_ex failed");
+        }
+
+        std::vector<std::uint8_t> out(data.size() + kAesBlock);
+        int len = 0;
+        if (EVP_EncryptUpdate(ctx.get(), out.data(), &len, data.data(), static_cast<int>(data.size())) != 1) {
+            throw std::runtime_error("agw::crypto::aes: EVP_EncryptUpdate failed");
+        }
+        int total = len;
+
+        if (EVP_EncryptFinal_ex(ctx.get(), out.data() + total, &len) != 1) {
+            throw std::runtime_error("agw::crypto::aes: EVP_EncryptFinal_ex failed");
+        }
+        total += len;
+
+        out.resize(static_cast<std::size_t>(total));
+        return out;
+    }
+
+    std::vector<std::uint8_t> aesDecryptCbc(const std::vector<std::uint8_t> &data, const std::vector<std::uint8_t> &key,
+                                            const std::vector<std::uint8_t> &iv)
+    {
+        checkKeyIv(key, iv);
+
+        CtxPtr ctx(EVP_CIPHER_CTX_new(), EVP_CIPHER_CTX_free);
+        if (!ctx) {
+            throw std::runtime_error("agw::crypto::aes: EVP_CIPHER_CTX_new failed");
+        }
+
+        if (EVP_DecryptInit_ex(ctx.get(), EVP_aes_256_cbc(), nullptr, key.data(), iv.data()) != 1) {
+            throw std::runtime_error("agw::crypto::aes: EVP_DecryptInit_ex failed");
+        }
+
+        std::vector<std::uint8_t> out(data.size() + kAesBlock);
+        int len = 0;
+        if (EVP_DecryptUpdate(ctx.get(), out.data(), &len, data.data(), static_cast<int>(data.size())) != 1) {
+            throw std::runtime_error("agw::crypto::aes: EVP_DecryptUpdate failed");
+        }
+        int total = len;
+
+        if (EVP_DecryptFinal_ex(ctx.get(), out.data() + total, &len) != 1) {
+            throw std::runtime_error("agw::crypto::aes: EVP_DecryptFinal_ex failed (bad key/iv/padding)");
+        }
+        total += len;
+
+        out.resize(static_cast<std::size_t>(total));
+        return out;
+    }
+}

agw-sdk/src/crypto/aes.h

@@ -0,0 +1,16 @@
+#ifndef AGW_CRYPTO_AES_H
+#define AGW_CRYPTO_AES_H
+
+#include <cstdint>
+#include <vector>
+
+namespace agw::crypto
+{
+    std::vector<std::uint8_t> aesEncryptCbc(const std::vector<std::uint8_t> &data, const std::vector<std::uint8_t> &key,
+                                            const std::vector<std::uint8_t> &iv);
+
+    std::vector<std::uint8_t> aesDecryptCbc(const std::vector<std::uint8_t> &data, const std::vector<std::uint8_t> &key,
+                                            const std::vector<std::uint8_t> &iv);
+}
+
+#endif

agw-sdk/src/crypto/hash.cpp

@@ -0,0 +1,59 @@
+#include "hash.h"
+
+#include <stdexcept>
+
+#include <openssl/sha.h>
+
+namespace agw::crypto
+{
+    namespace
+    {
+        int hexNibble(char c)
+        {
+            if (c >= '0' && c <= '9')
+                return c - '0';
+            if (c >= 'a' && c <= 'f')
+                return c - 'a' + 10;
+            if (c >= 'A' && c <= 'F')
+                return c - 'A' + 10;
+            return -1;
+        }
+    }
+
+    std::vector<std::uint8_t> sha512(const std::vector<std::uint8_t> &data)
+    {
+        std::vector<std::uint8_t> out(SHA512_DIGEST_LENGTH);
+        SHA512(data.data(), data.size(), out.data());
+        return out;
+    }
+
+    std::string toHex(const std::vector<std::uint8_t> &data)
+    {
+        static const char *digits = "0123456789abcdef";
+        std::string out;
+        out.reserve(data.size() * 2);
+        for (std::uint8_t b : data) {
+            out.push_back(digits[b >> 4]);
+            out.push_back(digits[b & 0x0F]);
+        }
+        return out;
+    }
+
+    std::vector<std::uint8_t> fromHex(const std::string &hex)
+    {
+        if (hex.size() % 2 != 0) {
+            throw std::runtime_error("agw::crypto::fromHex: odd-length input");
+        }
+        std::vector<std::uint8_t> out;
+        out.reserve(hex.size() / 2);
+        for (std::size_t i = 0; i < hex.size(); i += 2) {
+            const int hi = hexNibble(hex[i]);
+            const int lo = hexNibble(hex[i + 1]);
+            if (hi < 0 || lo < 0) {
+                throw std::runtime_error("agw::crypto::fromHex: invalid hex character");
+            }
+            out.push_back(static_cast<std::uint8_t>((hi << 4) | lo));
+        }
+        return out;
+    }
+}

agw-sdk/src/crypto/hash.h

@@ -0,0 +1,17 @@
+#ifndef AGW_CRYPTO_HASH_H
+#define AGW_CRYPTO_HASH_H
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace agw::crypto
+{
+    std::vector<std::uint8_t> sha512(const std::vector<std::uint8_t> &data);
+
+    std::string toHex(const std::vector<std::uint8_t> &data);
+
+    std::vector<std::uint8_t> fromHex(const std::string &hex);
+}
+
+#endif

agw-sdk/src/crypto/rng.cpp

@@ -0,0 +1,20 @@
+#include "rng.h"
+
+#include <stdexcept>
+
+#include <openssl/rand.h>
+
+namespace agw::crypto
+{
+    std::vector<std::uint8_t> DefaultRng::bytes(std::size_t n)
+    {
+        std::vector<std::uint8_t> out(n);
+        if (n == 0) {
+            return out;
+        }
+        if (RAND_priv_bytes(out.data(), static_cast<int>(n)) != 1) {
+            throw std::runtime_error("agw::crypto::DefaultRng: RAND_priv_bytes failed");
+        }
+        return out;
+    }
+}

agw-sdk/src/crypto/rng.h

@@ -0,0 +1,24 @@
+#ifndef AGW_CRYPTO_RNG_H
+#define AGW_CRYPTO_RNG_H
+
+#include <cstddef>
+#include <cstdint>
+#include <vector>
+
+namespace agw::crypto
+{
+    class IRng
+    {
+    public:
+        virtual ~IRng() = default;
+        virtual std::vector<std::uint8_t> bytes(std::size_t n) = 0;
+    };
+
+    class DefaultRng : public IRng
+    {
+    public:
+        std::vector<std::uint8_t> bytes(std::size_t n) override;
+    };
+}
+
+#endif

agw-sdk/src/crypto/rsa.cpp

@@ -0,0 +1,111 @@
+#include "rsa.h"
+
+#include <memory>
+#include <stdexcept>
+
+#include <openssl/bio.h>
+#include <openssl/evp.h>
+#include <openssl/pem.h>
+#include <openssl/rsa.h>
+
+namespace agw::crypto
+{
+    namespace
+    {
+        using BioPtr = std::unique_ptr<BIO, decltype(&BIO_free)>;
+        using PkeyPtr = std::unique_ptr<EVP_PKEY, decltype(&EVP_PKEY_free)>;
+        using PkeyCtxPtr = std::unique_ptr<EVP_PKEY_CTX, decltype(&EVP_PKEY_CTX_free)>;
+
+        PkeyPtr loadPublicKey(const std::string &pem)
+        {
+            BioPtr bio(BIO_new_mem_buf(pem.data(), static_cast<int>(pem.size())), BIO_free);
+            if (!bio) {
+                throw std::runtime_error("agw::crypto::rsa: BIO_new_mem_buf failed");
+            }
+            EVP_PKEY *raw = nullptr;
+            if (!PEM_read_bio_PUBKEY(bio.get(), &raw, nullptr, nullptr)) {
+                throw std::runtime_error("agw::crypto::rsa: PEM_read_bio_PUBKEY failed");
+            }
+            return PkeyPtr(raw, EVP_PKEY_free);
+        }
+
+        PkeyPtr loadPrivateKey(const std::string &pem)
+        {
+            BioPtr bio(BIO_new_mem_buf(pem.data(), static_cast<int>(pem.size())), BIO_free);
+            if (!bio) {
+                throw std::runtime_error("agw::crypto::rsa: BIO_new_mem_buf failed");
+            }
+            EVP_PKEY *raw = nullptr;
+            if (!PEM_read_bio_PrivateKey(bio.get(), &raw, nullptr, nullptr)) {
+                throw std::runtime_error("agw::crypto::rsa: PEM_read_bio_PrivateKey failed");
+            }
+            return PkeyPtr(raw, EVP_PKEY_free);
+        }
+    }
+
+    std::vector<std::uint8_t> rsaEncryptPublicPkcs1(const std::vector<std::uint8_t> &plaintext,
+                                                    const std::string &publicKeyPem)
+    {
+        PkeyPtr key = loadPublicKey(publicKeyPem);
+
+        PkeyCtxPtr ctx(EVP_PKEY_CTX_new(key.get(), nullptr), EVP_PKEY_CTX_free);
+        if (!ctx) {
+            throw std::runtime_error("agw::crypto::rsa: EVP_PKEY_CTX_new failed");
+        }
+        if (EVP_PKEY_encrypt_init(ctx.get()) != 1) {
+            throw std::runtime_error("agw::crypto::rsa: EVP_PKEY_encrypt_init failed");
+        }
+        if (EVP_PKEY_CTX_set_rsa_padding(ctx.get(), RSA_PKCS1_PADDING) != 1) {
+            throw std::runtime_error("agw::crypto::rsa: set_rsa_padding failed");
+        }
+
+        std::size_t outLen = 0;
+        if (EVP_PKEY_encrypt(ctx.get(), nullptr, &outLen, plaintext.data(), plaintext.size()) != 1) {
+            throw std::runtime_error("agw::crypto::rsa: EVP_PKEY_encrypt (size) failed");
+        }
+        std::vector<std::uint8_t> out(outLen);
+        if (EVP_PKEY_encrypt(ctx.get(), out.data(), &outLen, plaintext.data(), plaintext.size()) != 1) {
+            throw std::runtime_error("agw::crypto::rsa: EVP_PKEY_encrypt failed");
+        }
+        out.resize(outLen);
+        return out;
+    }
+
+    bool rsaPublicKeyValid(const std::string &publicKeyPem)
+    {
+        try {
+            loadPublicKey(publicKeyPem);
+            return true;
+        } catch (...) {
+            return false;
+        }
+    }
+
+    std::vector<std::uint8_t> rsaDecryptPrivatePkcs1(const std::vector<std::uint8_t> &ciphertext,
+                                                     const std::string &privateKeyPem)
+    {
+        PkeyPtr key = loadPrivateKey(privateKeyPem);
+
+        PkeyCtxPtr ctx(EVP_PKEY_CTX_new(key.get(), nullptr), EVP_PKEY_CTX_free);
+        if (!ctx) {
+            throw std::runtime_error("agw::crypto::rsa: EVP_PKEY_CTX_new failed");
+        }
+        if (EVP_PKEY_decrypt_init(ctx.get()) != 1) {
+            throw std::runtime_error("agw::crypto::rsa: EVP_PKEY_decrypt_init failed");
+        }
+        if (EVP_PKEY_CTX_set_rsa_padding(ctx.get(), RSA_PKCS1_PADDING) != 1) {
+            throw std::runtime_error("agw::crypto::rsa: set_rsa_padding failed");
+        }
+
+        std::size_t outLen = 0;
+        if (EVP_PKEY_decrypt(ctx.get(), nullptr, &outLen, ciphertext.data(), ciphertext.size()) != 1) {
+            throw std::runtime_error("agw::crypto::rsa: EVP_PKEY_decrypt (size) failed");
+        }
+        std::vector<std::uint8_t> out(outLen);
+        if (EVP_PKEY_decrypt(ctx.get(), out.data(), &outLen, ciphertext.data(), ciphertext.size()) != 1) {
+            throw std::runtime_error("agw::crypto::rsa: EVP_PKEY_decrypt failed");
+        }
+        out.resize(outLen);
+        return out;
+    }
+}

agw-sdk/src/crypto/rsa.h

@@ -0,0 +1,19 @@
+#ifndef AGW_CRYPTO_RSA_H
+#define AGW_CRYPTO_RSA_H
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace agw::crypto
+{
+    std::vector<std::uint8_t> rsaEncryptPublicPkcs1(const std::vector<std::uint8_t> &plaintext,
+                                                    const std::string &publicKeyPem);
+
+    std::vector<std::uint8_t> rsaDecryptPrivatePkcs1(const std::vector<std::uint8_t> &ciphertext,
+                                                     const std::string &privateKeyPem);
+
+    bool rsaPublicKeyValid(const std::string &publicKeyPem);
+}
+
+#endif

agw-sdk/src/detail/test_hooks.h

@@ -0,0 +1,14 @@
+#ifndef AGW_DETAIL_TEST_HOOKS_H
+#define AGW_DETAIL_TEST_HOOKS_H
+
+#include <memory>
+
+#include "agw/http.h"
+
+namespace agw::detail
+{
+    void setNextTestHttpClient(std::shared_ptr<IHttpClient> http);
+    std::shared_ptr<IHttpClient> takeNextTestHttpClient();
+}
+
+#endif

agw-sdk/src/failover/bypass_policy.cpp

@@ -0,0 +1,100 @@
+#include "failover/bypass_policy.h"
+
+#include "protocol/keys.h"
+#include "util/json.h"
+
+namespace agw::failover
+{
+    namespace
+    {
+        constexpr const char *kPattern1 = "No active configuration found for";
+        constexpr const char *kPattern2 = "No non-revoked public key found for";
+        constexpr const char *kPattern3 = "Account not found.";
+        constexpr const char *kPatternQrSessionNotFound = "QR session not found";
+        constexpr const char *kPatternSessionNotFound = "Session not found";
+        constexpr const char *kUpdateRequestPattern = "client version update is required";
+        constexpr const char *kUnprocessableSubscriptionMessage =
+                "Failed to retrieve subscription information. Is it activated?";
+
+        constexpr int kNotFound = 404;
+        constexpr int kNotImplemented = 501;
+        constexpr int kPaymentRequired = 402;
+        constexpr int kConflict = 409;
+        constexpr int kRequestTimeout = 408;
+        constexpr int kUnprocessableEntity = 422;
+
+        bool contains(const std::string &body, const char *needle)
+        {
+            return body.find(needle) != std::string::npos;
+        }
+
+        std::string trim(const std::string &s)
+        {
+            std::size_t b = 0, e = s.size();
+            while (b < e && (s[b] == ' ' || s[b] == '\t' || s[b] == '\n' || s[b] == '\r'))
+                ++b;
+            while (e > b && (s[e - 1] == ' ' || s[e - 1] == '\t' || s[e - 1] == '\n' || s[e - 1] == '\r'))
+                --e;
+            return s.substr(b, e - b);
+        }
+    }
+
+    bool shouldBypassProxy(TransportError transportError, const std::string &decryptedBody, bool decryptionSuccessful)
+    {
+        if (!decryptionSuccessful) {
+            return true;
+        }
+
+        int apiHttpStatus = -1;
+        std::string apiErrorMessage;
+        try {
+            util::Json obj = util::Json::parse(decryptedBody);
+            if (obj.is_object()) {
+                if (auto it = obj.find(protocol::keys::httpStatus); it != obj.end() && it->is_number_integer()) {
+                    apiHttpStatus = it->get<int>();
+                }
+                if (auto it = obj.find(protocol::keys::message); it != obj.end() && it->is_string()) {
+                    apiErrorMessage = trim(it->get<std::string>());
+                }
+            }
+        } catch (...) {
+        }
+
+        if (transportError == TransportError::Canceled || transportError == TransportError::Timeout) {
+            return true;
+        }
+        if (contains(decryptedBody, "html")) {
+            return true;
+        }
+        if (apiHttpStatus == kRequestTimeout) {
+            return false;
+        }
+        if (apiHttpStatus == kNotFound) {
+            if (contains(decryptedBody, kPattern1) || contains(decryptedBody, kPattern2)
+                || contains(decryptedBody, kPattern3) || contains(decryptedBody, kPatternQrSessionNotFound)
+                || contains(decryptedBody, kPatternSessionNotFound)) {
+                return false;
+            }
+            return true;
+        }
+        if (apiHttpStatus == kNotImplemented) {
+            if (contains(decryptedBody, kUpdateRequestPattern)) {
+                return false;
+            }
+            return true;
+        }
+        if (apiHttpStatus == kConflict) {
+            return false;
+        }
+        if (apiHttpStatus == kPaymentRequired) {
+            return false;
+        }
+        if (apiHttpStatus == kUnprocessableEntity) {
+            return apiErrorMessage != kUnprocessableSubscriptionMessage;
+        }
+        if (transportError != TransportError::None) {
+            return true;
+        }
+        return false;
+    }
+}

agw-sdk/src/failover/bypass_policy.h

@@ -0,0 +1,13 @@
+#ifndef AGW_FAILOVER_BYPASS_POLICY_H
+#define AGW_FAILOVER_BYPASS_POLICY_H
+
+#include <string>
+
+#include "agw/http.h"
+
+namespace agw::failover
+{
+    bool shouldBypassProxy(TransportError transportError, const std::string &decryptedBody, bool decryptionSuccessful);
+}
+
+#endif

agw-sdk/src/failover/proxy_list.cpp

@@ -0,0 +1,71 @@
+#include "failover/proxy_list.h"
+
+#include "crypto/aes.h"
+#include "crypto/hash.h"
+#include "util/base64.h"
+#include "util/json.h"
+
+namespace agw::failover
+{
+    namespace
+    {
+        void appendStorageUrls(const std::vector<std::string> &baseUrls, const FailoverContext &ctx,
+                               std::vector<std::string> &target)
+        {
+            if (!ctx.serviceType.empty()) {
+                const std::string token = "endpoints-" + ctx.serviceType + "-" + ctx.userCountryCode;
+                const std::string encoded =
+                        util::base64UrlEncodeNoPad(std::vector<std::uint8_t>(token.begin(), token.end()));
+                for (const auto &base : baseUrls) {
+                    target.push_back(base + encoded + ".json");
+                }
+            }
+            for (const auto &base : baseUrls) {
+                target.push_back(base + "endpoints.json");
+            }
+        }
+
+        std::vector<std::string> parseEndpointsArray(const std::string &json)
+        {
+            std::vector<std::string> out;
+            try {
+                util::Json doc = util::Json::parse(json);
+                if (doc.is_array()) {
+                    for (const auto &el : doc) {
+                        if (el.is_string()) {
+                            out.push_back(el.get<std::string>());
+                        }
+                    }
+                }
+            } catch (...) {
+            }
+            return out;
+        }
+    }
+
+    std::vector<std::string> buildStorageUrls(const std::vector<std::string> &primaryBaseUrls,
+                                              const std::vector<std::string> &fallbackBaseUrls,
+                                              const FailoverContext &ctx)
+    {
+        std::vector<std::string> result;
+        appendStorageUrls(primaryBaseUrls, ctx, result);
+        appendStorageUrls(fallbackBaseUrls, ctx, result);
+        return result;
+    }
+
+    std::vector<std::string> decodeProxyList(const std::string &body, bool isDevEnvironment, const std::string &pubKeyPem)
+    {
+        if (isDevEnvironment) {
+            return parseEndpointsArray(body);
+        }
+
+        const std::vector<std::uint8_t> pubBytes(pubKeyPem.begin(), pubKeyPem.end());
+        const std::string h = crypto::toHex(crypto::sha512(pubBytes));
+        const std::vector<std::uint8_t> key = crypto::fromHex(h.substr(0, 64));
+        const std::vector<std::uint8_t> iv = crypto::fromHex(h.substr(64, 32));
+
+        const std::vector<std::uint8_t> cipher = util::base64Decode(body);
+        const std::vector<std::uint8_t> plain = crypto::aesDecryptCbc(cipher, key, iv);
+        return parseEndpointsArray(std::string(plain.begin(), plain.end()));
+    }
+}

agw-sdk/src/failover/proxy_list.h

@@ -0,0 +1,19 @@
+#ifndef AGW_FAILOVER_PROXY_LIST_H
+#define AGW_FAILOVER_PROXY_LIST_H
+
+#include <string>
+#include <vector>
+
+#include "agw/types.h"
+
+namespace agw::failover
+{
+    std::vector<std::string> buildStorageUrls(const std::vector<std::string> &primaryBaseUrls,
+                                              const std::vector<std::string> &fallbackBaseUrls,
+                                              const FailoverContext &ctx);
+
+    std::vector<std::string> decodeProxyList(const std::string &body, bool isDevEnvironment,
+                                             const std::string &pubKeyPem);
+}
+
+#endif

agw-sdk/src/failover/proxy_picker.cpp

@@ -0,0 +1,21 @@
+#include "failover/proxy_picker.h"
+
+namespace agw::failover
+{
+    std::string pickHealthyProxy(IHttpClient &http, const std::vector<std::string> &proxyUrls, int timeoutMsecs)
+    {
+        for (const auto &proxy : proxyUrls) {
+            HttpRequest req;
+            req.url = proxy + "lmbd-health";
+            req.method = "GET";
+            req.headers = { { "Content-Type", "application/json" } };
+            req.timeoutMsecs = timeoutMsecs;
+
+            const HttpResponse resp = http.send(req);
+            if (resp.error == TransportError::None && !resp.sslError) {
+                return proxy;
+            }
+        }
+        return { };
+    }
+}

agw-sdk/src/failover/proxy_picker.h

@@ -0,0 +1,14 @@
+#ifndef AGW_FAILOVER_PROXY_PICKER_H
+#define AGW_FAILOVER_PROXY_PICKER_H
+
+#include <string>
+#include <vector>
+
+#include "agw/http.h"
+
+namespace agw::failover
+{
+    std::string pickHealthyProxy(IHttpClient &http, const std::vector<std::string> &proxyUrls, int timeoutMsecs);
+}
+
+#endif

agw-sdk/src/gateway_controller.cpp

@@ -0,0 +1,364 @@
+#include "agw/gateway_controller.h"
+
+#include <algorithm>
+#include <chrono>
+#include <functional>
+#include <future>
+#include <memory>
+#include <mutex>
+#include <random>
+#include <sstream>
+#include <string>
+#include <thread>
+#include <utility>
+#include <vector>
+
+#include "crypto/rng.h"
+#include "failover/bypass_policy.h"
+#include "failover/proxy_list.h"
+#include "failover/proxy_picker.h"
+#include "protocol/error_mapping.h"
+#include "protocol/request_builder.h"
+#include "protocol/response.h"
+#include "util/thread_pool.h"
+#include "util/url.h"
+#include "util/uuid.h"
+
+namespace agw {
+namespace {
+bool isCancelled(const CancellationToken *cancel)
+{
+    return cancel != nullptr && cancel->isCancelled();
+}
+
+std::function<bool()> makeCancelCheck(CancellationToken *cancel)
+{
+    if (cancel == nullptr) {
+        return {};
+    }
+    return [cancel] { return cancel->isCancelled(); };
+}
+
+std::string threadIdStr()
+{
+    std::ostringstream oss;
+    oss << std::this_thread::get_id();
+    return oss.str();
+}
+
+const char *transportErrorName(TransportError e)
+{
+    switch (e) {
+    case TransportError::None: return "None";
+    case TransportError::Timeout: return "Timeout";
+    case TransportError::Canceled: return "Canceled";
+    case TransportError::OperationNotImplemented: return "OperationNotImplemented";
+    case TransportError::ConnectionError: return "ConnectionError";
+    }
+    return "?";
+}
+}
+
+struct GatewayController::Impl {
+    Config config;
+    std::shared_ptr<IHttpClient> http;
+    std::unique_ptr<crypto::IRng> rng;
+
+    std::mutex proxyMutex;
+    std::string cachedProxy;
+
+    util::ThreadPool pool;
+
+    explicit Impl(Config cfg)
+        : config(std::move(cfg)),
+          rng(std::make_unique<crypto::DefaultRng>()),
+          pool(static_cast<std::size_t>(config.threadPoolSize))
+    {
+        http = config.httpClient ? config.httpClient
+                                  : std::shared_ptr<IHttpClient>(makeDefaultHttpClient());
+        log(LogLevel::Info,
+            "client created: dev=" + std::string(config.isDevEnvironment ? "1" : "0")
+                + " timeout=" + std::to_string(config.requestTimeoutMsecs) + "ms"
+                + " pool=" + std::to_string(config.threadPoolSize)
+                + " s3primary=" + std::to_string(config.s3PrimaryEndpoints.size())
+                + " s3fallback=" + std::to_string(config.s3FallbackEndpoints.size())
+                + " customHttp=" + std::string(config.httpClient ? "1" : "0"));
+    }
+
+    void log(LogLevel level, const std::string &message) const
+    {
+        if (config.log) {
+            config.log(level, message);
+        }
+    }
+    void dbg(const std::string &message) const { log(LogLevel::Debug, message); }
+
+    std::string getCachedProxy()
+    {
+        std::lock_guard<std::mutex> lock(proxyMutex);
+        return cachedProxy;
+    }
+
+    void setCachedProxy(const std::string &proxy)
+    {
+        std::lock_guard<std::mutex> lock(proxyMutex);
+        cachedProxy = proxy;
+    }
+
+    bool attempt(const std::string &endpoint, const std::string &host, const HttpRequest &baseReq,
+                 const std::vector<std::uint8_t> &key, const std::vector<std::uint8_t> &iv,
+                 HttpResponse &resp, protocol::DecryptResult &dec)
+    {
+        HttpRequest req = baseReq;
+        req.url = util::formatEndpoint(endpoint, host);
+        dbg("  proxy attempt: POST " + req.url);
+
+        const auto t0 = std::chrono::steady_clock::now();
+        resp = http->send(req);
+        const auto ms = std::chrono::duration_cast<std::chrono::milliseconds>(
+                            std::chrono::steady_clock::now() - t0).count();
+
+        dec = protocol::tryDecryptResponse(resp.body, key, iv);
+        const bool bypass = resp.sslError || failover::shouldBypassProxy(resp.error, dec.decryptedBody, dec.ok);
+        dbg("  proxy attempt result: transport=" + std::string(transportErrorName(resp.error))
+            + " ssl=" + std::string(resp.sslError ? "1" : "0") + " http=" + std::to_string(resp.httpStatusCode)
+            + " bodyLen=" + std::to_string(resp.body.size()) + " decryptOk=" + std::string(dec.ok ? "1" : "0")
+            + " bypassAgain=" + std::string(bypass ? "1" : "0") + " (" + std::to_string(ms) + "ms)");
+        return !bypass;
+    }
+
+    void runFailover(const std::string &endpoint, const HttpRequest &baseReq, const FailoverContext &ctx,
+                     const std::vector<std::uint8_t> &key, const std::vector<std::uint8_t> &iv,
+                     HttpResponse &resp, protocol::DecryptResult &dec, CancellationToken *cancel)
+    {
+        if (isCancelled(cancel)) {
+            dbg("failover: cancelled before start");
+            return;
+        }
+
+        std::random_device rd;
+        std::mt19937 gen(rd());
+
+        std::vector<std::string> primary = config.s3PrimaryEndpoints;
+        std::vector<std::string> fallback = config.s3FallbackEndpoints;
+        std::shuffle(primary.begin(), primary.end(), gen);
+        std::shuffle(fallback.begin(), fallback.end(), gen);
+
+        const std::vector<std::string> storageUrls = failover::buildStorageUrls(primary, fallback, ctx);
+        dbg("failover: storage urls=" + std::to_string(storageUrls.size())
+            + " service='" + ctx.serviceType + "' country='" + ctx.userCountryCode + "'");
+
+        std::vector<std::string> proxyUrls;
+        for (const auto &storageUrl : storageUrls) {
+            if (isCancelled(cancel)) {
+                dbg("failover: cancelled during storage fetch");
+                return;
+            }
+            HttpRequest g;
+            g.url = storageUrl;
+            g.method = "GET";
+            g.headers = {{"Content-Type", "application/json"}};
+            g.timeoutMsecs = config.proxyStorageTimeoutMsecs;
+            g.cancelCheck = makeCancelCheck(cancel);
+
+            const HttpResponse gr = http->send(g);
+            dbg("  storage GET " + storageUrl + " → transport=" + std::string(transportErrorName(gr.error))
+                + " ssl=" + std::string(gr.sslError ? "1" : "0") + " http=" + std::to_string(gr.httpStatusCode)
+                + " bodyLen=" + std::to_string(gr.body.size()));
+            if (gr.error != TransportError::None || gr.sslError) {
+                continue;
+            }
+            try {
+                proxyUrls = failover::decodeProxyList(gr.body, config.isDevEnvironment, config.agwPublicKeyPem);
+                dbg("  decoded proxy list: " + std::to_string(proxyUrls.size()) + " proxies");
+                break;
+            } catch (...) {
+                dbg("  proxy list decode failed → next storage");
+                continue;
+            }
+        }
+
+        std::shuffle(proxyUrls.begin(), proxyUrls.end(), gen);
+
+        std::string proxy = getCachedProxy();
+        if (proxy.empty()) {
+            if (isCancelled(cancel)) {
+                dbg("failover: cancelled before health-check");
+                return;
+            }
+            dbg("failover: no cached proxy → health-check of " + std::to_string(proxyUrls.size()) + " proxies");
+            proxy = failover::pickHealthyProxy(*http, proxyUrls, config.proxyHealthTimeoutMsecs);
+            if (!proxy.empty()) {
+                dbg("failover: healthy proxy = " + proxy + " (cached)");
+                setCachedProxy(proxy);
+            } else {
+                dbg("failover: no healthy proxy found");
+            }
+        } else {
+            dbg("failover: using cached proxy = " + proxy);
+        }
+
+        if (!proxy.empty()) {
+            if (isCancelled(cancel)) {
+                return;
+            }
+            if (attempt(endpoint, proxy, baseReq, key, iv, resp, dec)) {
+                dbg("failover: succeeded via cached/first proxy");
+                return;
+            }
+        }
+        for (const auto &p : proxyUrls) {
+            if (isCancelled(cancel)) {
+                return;
+            }
+            if (attempt(endpoint, p, baseReq, key, iv, resp, dec)) {
+                dbg("failover: succeeded via proxy " + p + " (cached)");
+                setCachedProxy(p);
+                return;
+            }
+        }
+        dbg("failover: exhausted all proxies (using last attempt result)");
+    }
+
+    Response executePost(const std::string &endpoint, const std::string &payload,
+                         const FailoverContext &ctx, CancellationToken *cancel)
+    {
+        const auto tStart = std::chrono::steady_clock::now();
+        log(LogLevel::Info, "post START endpoint='" + endpoint + "' service='" + ctx.serviceType
+            + "' country='" + ctx.userCountryCode + "' payloadLen=" + std::to_string(payload.size())
+            + " thread=" + threadIdStr());
+
+        if (isCancelled(cancel)) {
+            log(LogLevel::Info, "post: cancelled before start");
+            return Response{ErrorCode::Cancelled, std::string()};
+        }
+
+        protocol::EncryptedRequest enc =
+            protocol::buildEncryptedRequest(payload, config.agwPublicKeyPem, *rng);
+        if (enc.error != ErrorCode::NoError) {
+            log(LogLevel::Warning, "post: request build failed error="
+                + std::to_string(static_cast<int>(enc.error)));
+            return Response{enc.error, std::string()};
+        }
+        dbg("request built: bodyLen=" + std::to_string(enc.body.size()) + " (key/iv/salt generated)");
+        if (isCancelled(cancel)) {
+            return Response{ErrorCode::Cancelled, std::string()};
+        }
+
+        const std::string requestId = util::makeUuidV4(*rng);
+        const std::string cached = getCachedProxy();
+        const std::string directHost = cached.empty() ? config.gatewayEndpoint : cached;
+        const std::string url = util::formatEndpoint(endpoint, directHost);
+        dbg("direct request: url=" + url + " reqId=" + requestId
+            + " viaCachedProxy=" + std::string(cached.empty() ? "0" : "1"));
+
+        if (config.onBeforeRequest) {
+            const std::string host = util::extractHost(url);
+            dbg("onBeforeRequest(host=" + host + ")");
+            config.onBeforeRequest(host);
+        }
+
+        HttpRequest req;
+        req.url = url;
+        req.method = "POST";
+        req.body = enc.body;
+        req.headers = {
+            {"Content-Type", "application/json"},
+            {"X-Client-Request-ID", requestId},
+        };
+        req.timeoutMsecs = config.requestTimeoutMsecs;
+        req.cancelCheck = makeCancelCheck(cancel);
+
+        const auto t0 = std::chrono::steady_clock::now();
+        HttpResponse resp = http->send(req);
+        const auto httpMs = std::chrono::duration_cast<std::chrono::milliseconds>(
+                                std::chrono::steady_clock::now() - t0).count();
+        if (isCancelled(cancel)) {
+            log(LogLevel::Info, "post: cancelled after direct send");
+            return Response{ErrorCode::Cancelled, std::string()};
+        }
+
+        protocol::DecryptResult dec = protocol::tryDecryptResponse(resp.body, enc.key, enc.iv);
+        dbg("direct response: transport=" + std::string(transportErrorName(resp.error))
+            + " ssl=" + std::string(resp.sslError ? "1" : "0") + " http=" + std::to_string(resp.httpStatusCode)
+            + " bodyLen=" + std::to_string(resp.body.size()) + " decryptOk=" + std::string(dec.ok ? "1" : "0")
+            + " (" + std::to_string(httpMs) + "ms)");
+
+        const bool bypass = !resp.sslError
+            && failover::shouldBypassProxy(resp.error, dec.decryptedBody, dec.ok);
+        if (bypass) {
+            log(LogLevel::Info, "direct response suspicious — running failover");
+            runFailover(endpoint, req, ctx, enc.key, enc.iv, resp, dec, cancel);
+            if (isCancelled(cancel)) {
+                log(LogLevel::Info, "post: cancelled during failover");
+                return Response{ErrorCode::Cancelled, std::string()};
+            }
+        } else {
+            dbg("direct response accepted (no failover)");
+        }
+
+        Response out;
+        out.body = dec.decryptedBody;
+
+        const ErrorCode mapped = protocol::mapResponseError(resp.sslError, resp.error, dec.decryptedBody);
+        const auto totalMs = std::chrono::duration_cast<std::chrono::milliseconds>(
+                                 std::chrono::steady_clock::now() - tStart).count();
+        if (mapped != ErrorCode::NoError) {
+            out.error = mapped;
+            log(LogLevel::Warning, "post DONE error=" + std::to_string(static_cast<int>(mapped))
+                + " bodyLen=" + std::to_string(out.body.size()) + " (" + std::to_string(totalMs) + "ms)");
+            return out;
+        }
+        if (!dec.ok) {
+            out.error = ErrorCode::ApiConfigDecryptionError;
+            log(LogLevel::Error, "post DONE: response decryption failed (1106) ("
+                + std::to_string(totalMs) + "ms)");
+            return out;
+        }
+        out.error = ErrorCode::NoError;
+        log(LogLevel::Info, "post DONE ok bodyLen=" + std::to_string(out.body.size())
+            + " (" + std::to_string(totalMs) + "ms)");
+        return out;
+    }
+};
+
+GatewayController::GatewayController(Config config) : m_impl(std::make_unique<Impl>(std::move(config))) {}
+GatewayController::~GatewayController() = default;
+GatewayController::GatewayController(GatewayController &&) noexcept = default;
+GatewayController &GatewayController::operator=(GatewayController &&) noexcept = default;
+
+Response GatewayController::post(const std::string &endpoint, const std::string &payload,
+                             const FailoverContext &ctx, CancellationToken *cancel)
+{
+    return m_impl->executePost(endpoint, payload, ctx, cancel);
+}
+
+void GatewayController::postAsync(const std::string &endpoint, const std::string &payload,
+                              std::function<void(Response)> onResult, const FailoverContext &ctx,
+                              CancellationToken *cancel)
+{
+    Impl *impl = m_impl.get();
+    impl->dbg("postAsync: submitting to pool (caller thread=" + threadIdStr() + ")");
+    impl->pool.submit([impl, endpoint, payload, onResult = std::move(onResult), ctx, cancel]() {
+        impl->dbg("postAsync: running on pool thread=" + threadIdStr());
+        Response r = impl->executePost(endpoint, payload, ctx, cancel);
+        if (onResult) {
+            onResult(std::move(r));
+        }
+    });
+}
+
+std::future<Response> GatewayController::postFuture(const std::string &endpoint, const std::string &payload,
+                                                const FailoverContext &ctx, CancellationToken *cancel)
+{
+    auto promise = std::make_shared<std::promise<Response>>();
+    std::future<Response> fut = promise->get_future();
+    Impl *impl = m_impl.get();
+    impl->dbg("postFuture: submitting to pool (caller thread=" + threadIdStr() + ")");
+    impl->pool.submit([impl, endpoint, payload, ctx, cancel, promise]() {
+        impl->dbg("postFuture: running on pool thread=" + threadIdStr());
+        promise->set_value(impl->executePost(endpoint, payload, ctx, cancel));
+    });
+    return fut;
+}
+}

agw-sdk/src/http/curl_client.cpp

@@ -0,0 +1,132 @@
+#ifdef AGW_HAVE_CURL
+
+    #include "http/curl_client.h"
+
+    #include <mutex>
+    #include <string>
+
+    #include <curl/curl.h>
+
+namespace agw
+{
+    namespace
+    {
+        std::once_flag g_curlInitOnce;
+
+        void ensureCurlGlobalInit()
+        {
+            std::call_once(g_curlInitOnce, []() { curl_global_init(CURL_GLOBAL_DEFAULT); });
+        }
+
+        std::size_t writeCallback(char *ptr, std::size_t size, std::size_t nmemb, void *userdata)
+        {
+            const std::size_t total = size * nmemb;
+            auto *buf = static_cast<std::string *>(userdata);
+            buf->append(ptr, total);
+            return total;
+        }
+
+        int xferCallback(void *clientp, curl_off_t, curl_off_t, curl_off_t, curl_off_t)
+        {
+            auto *check = static_cast<const std::function<bool()> *>(clientp);
+            if (check && *check && (*check)()) {
+                return 1;
+            }
+            return 0;
+        }
+
+        TransportError mapCurlError(CURLcode code, bool &sslError)
+        {
+            sslError = false;
+            switch (code) {
+            case CURLE_OK: return TransportError::None;
+            case CURLE_OPERATION_TIMEDOUT: return TransportError::Timeout;
+            case CURLE_ABORTED_BY_CALLBACK: return TransportError::Canceled;
+            case CURLE_SSL_CONNECT_ERROR:
+            case CURLE_PEER_FAILED_VERIFICATION:
+            case CURLE_SSL_CERTPROBLEM:
+            case CURLE_SSL_CIPHER:
+            case CURLE_SSL_CACERT_BADFILE:
+            case CURLE_SSL_ISSUER_ERROR: sslError = true; return TransportError::ConnectionError;
+            default: return TransportError::ConnectionError;
+            }
+        }
+    }
+
+    CurlHttpClient::CurlHttpClient()
+    {
+        ensureCurlGlobalInit();
+    }
+
+    CurlHttpClient::~CurlHttpClient() = default;
+
+    HttpResponse CurlHttpClient::send(const HttpRequest &request)
+    {
+        HttpResponse response;
+
+        CURL *curl = curl_easy_init();
+        if (!curl) {
+            response.error = TransportError::ConnectionError;
+            response.errorString = "curl_easy_init failed";
+            return response;
+        }
+
+        struct curl_slist *headers = nullptr;
+        for (const auto &h : request.headers) {
+            const std::string line = h.first + ": " + h.second;
+            headers = curl_slist_append(headers, line.c_str());
+        }
+
+        curl_easy_setopt(curl, CURLOPT_URL, request.url.c_str());
+        if (headers) {
+            curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
+        }
+        if (request.timeoutMsecs > 0) {
+            curl_easy_setopt(curl, CURLOPT_TIMEOUT_MS, static_cast<long>(request.timeoutMsecs));
+        }
+        curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writeCallback);
+        curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response.body);
+        curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1L);
+
+        curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, "");
+
+        if (request.cancelCheck) {
+            curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
+            curl_easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, xferCallback);
+            curl_easy_setopt(curl, CURLOPT_XFERINFODATA, &request.cancelCheck);
+        }
+
+        if (request.method == "POST") {
+            curl_easy_setopt(curl, CURLOPT_POST, 1L);
+            curl_easy_setopt(curl, CURLOPT_POSTFIELDS, request.body.data());
+            curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, static_cast<long>(request.body.size()));
+        } else {
+            curl_easy_setopt(curl, CURLOPT_HTTPGET, 1L);
+        }
+
+        const CURLcode code = curl_easy_perform(curl);
+        bool sslError = false;
+        response.error = mapCurlError(code, sslError);
+        response.sslError = sslError;
+        if (code != CURLE_OK) {
+            response.errorString = curl_easy_strerror(code);
+        }
+
+        long httpCode = 0;
+        curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpCode);
+        response.httpStatusCode = static_cast<int>(httpCode);
+
+        if (headers) {
+            curl_slist_free_all(headers);
+        }
+        curl_easy_cleanup(curl);
+        return response;
+    }
+
+    std::unique_ptr<IHttpClient> makeDefaultHttpClient()
+    {
+        return std::make_unique<CurlHttpClient>();
+    }
+}
+
+#endif

agw-sdk/src/http/curl_client.h

@@ -0,0 +1,17 @@
+#ifndef AGW_HTTP_CURL_CLIENT_H
+#define AGW_HTTP_CURL_CLIENT_H
+
+#include "agw/http.h"
+
+namespace agw
+{
+    class CurlHttpClient : public IHttpClient
+    {
+    public:
+        CurlHttpClient();
+        ~CurlHttpClient() override;
+        HttpResponse send(const HttpRequest &request) override;
+    };
+}
+
+#endif

agw-sdk/src/http/default_client_fallback.cpp

@@ -0,0 +1,15 @@
+#ifndef AGW_HAVE_CURL
+
+    #include <stdexcept>
+
+    #include "agw/http.h"
+
+namespace agw
+{
+    std::unique_ptr<IHttpClient> makeDefaultHttpClient()
+    {
+        throw std::runtime_error("agw: SDK built without libcurl; provide Config::httpClient (your own IHttpClient)");
+    }
+}
+
+#endif

agw-sdk/src/protocol/error_mapping.cpp

@@ -0,0 +1,133 @@
+#include "protocol/error_mapping.h"
+
+#include <algorithm>
+#include <cctype>
+
+#include "protocol/keys.h"
+#include "util/json.h"
+
+namespace agw::protocol
+{
+    namespace
+    {
+        constexpr int kConflict = 409;
+        constexpr int kNotFound = 404;
+        constexpr int kNotImplemented = 501;
+        constexpr int kPaymentRequired = 402;
+        constexpr int kTooManyRequests = 429;
+        constexpr int kRequestTimeout = 408;
+        constexpr int kUnprocessableEntity = 422;
+
+        constexpr const char *kUnprocessableSubscriptionMessage =
+                "Failed to retrieve subscription information. Is it activated?";
+        constexpr const char *kTrialAlreadyUsedMessage = "trial subscription already used";
+
+        std::string trim(const std::string &s)
+        {
+            std::size_t b = 0;
+            std::size_t e = s.size();
+            while (b < e && std::isspace(static_cast<unsigned char>(s[b])))
+                ++b;
+            while (e > b && std::isspace(static_cast<unsigned char>(s[e - 1])))
+                --e;
+            return s.substr(b, e - b);
+        }
+
+        std::string toLower(std::string s)
+        {
+            std::transform(s.begin(), s.end(), s.begin(),
+                           [](unsigned char c) { return static_cast<char>(std::tolower(c)); });
+            return s;
+        }
+
+        bool containsCI(const std::string &haystack, const std::string &needle)
+        {
+            return toLower(haystack).find(toLower(needle)) != std::string::npos;
+        }
+
+        std::string messageFrom(const util::Json &obj)
+        {
+            auto it = obj.find(keys::message);
+            if (it != obj.end() && it->is_string()) {
+                return trim(it->get<std::string>());
+            }
+            return { };
+        }
+    }
+
+    ErrorCode mapResponseError(bool sslError, TransportError transportError, const std::string &decryptedBody)
+    {
+        if (sslError) {
+            return ErrorCode::ApiConfigSslError;
+        }
+        if (transportError == TransportError::Timeout || transportError == TransportError::Canceled) {
+            return ErrorCode::ApiConfigTimeoutError;
+        }
+        if (transportError == TransportError::OperationNotImplemented) {
+            return ErrorCode::ApiUpdateRequestError;
+        }
+
+        util::Json obj;
+        bool isObject = false;
+        try {
+            obj = util::Json::parse(decryptedBody);
+            isObject = obj.is_object();
+        } catch (...) {
+            isObject = false;
+        }
+
+        if (isObject) {
+            int httpStatus = -1;
+            if (auto it = obj.find(keys::httpStatus); it != obj.end() && it->is_number_integer()) {
+                httpStatus = it->get<int>();
+            }
+            const std::string message = messageFrom(obj);
+
+            if (httpStatus == kTooManyRequests) {
+                return ErrorCode::ApiRateLimitError;
+            }
+            if (httpStatus == kConflict) {
+                if (containsCI(message, kTrialAlreadyUsedMessage)) {
+                    return ErrorCode::ApiTrialAlreadyUsedError;
+                }
+                return ErrorCode::ApiConfigLimitError;
+            }
+            if (httpStatus == kNotFound) {
+                return ErrorCode::ApiNotFoundError;
+            }
+            if (httpStatus == kRequestTimeout) {
+                return ErrorCode::ApiConfigTimeoutError;
+            }
+            if (httpStatus == kNotImplemented) {
+                return ErrorCode::ApiUpdateRequestError;
+            }
+            if (httpStatus == kUnprocessableEntity) {
+                if (message == kUnprocessableSubscriptionMessage) {
+                    return ErrorCode::ApiSubscriptionExpiredError;
+                }
+                return ErrorCode::ApiConfigDownloadError;
+            }
+            if (httpStatus == kPaymentRequired) {
+                if (containsCI(message, "refresh_captcha")) {
+                    return ErrorCode::ApiCaptchaRefreshError;
+                }
+                if (containsCI(message, "invalid_captcha")) {
+                    return ErrorCode::ApiCaptchaInvalidError;
+                }
+                if (obj.contains("captcha_id") || obj.contains("captcha_image")
+                    || containsCI(message, "rate_limit_exceeded")) {
+                    return ErrorCode::ApiCaptchaRequiredError;
+                }
+                return ErrorCode::ApiSubscriptionNotActiveError;
+            }
+            if (httpStatus >= 300) {
+                return ErrorCode::ApiConfigDownloadError;
+            }
+        }
+
+        if (transportError == TransportError::None) {
+            return ErrorCode::NoError;
+        }
+        return ErrorCode::ApiConfigDownloadError;
+    }
+}

agw-sdk/src/protocol/error_mapping.h

@@ -0,0 +1,14 @@
+#ifndef AGW_PROTOCOL_ERROR_MAPPING_H
+#define AGW_PROTOCOL_ERROR_MAPPING_H
+
+#include <string>
+
+#include "agw/http.h"
+#include "agw/types.h"
+
+namespace agw::protocol
+{
+    ErrorCode mapResponseError(bool sslError, TransportError transportError, const std::string &decryptedBody);
+}
+
+#endif

agw-sdk/src/protocol/keys.h

@@ -0,0 +1,18 @@
+#ifndef AGW_PROTOCOL_KEYS_H
+#define AGW_PROTOCOL_KEYS_H
+
+namespace agw::protocol::keys {
+inline constexpr const char *aesKey = "aes_key";
+inline constexpr const char *aesIv = "aes_iv";
+inline constexpr const char *aesSalt = "aes_salt";
+inline constexpr const char *apiPayload = "api_payload";
+inline constexpr const char *keyPayload = "key_payload";
+
+inline constexpr const char *serviceType = "service_type";
+inline constexpr const char *userCountryCode = "user_country_code";
+
+inline constexpr const char *httpStatus = "http_status";
+inline constexpr const char *message = "message";
+}
+
+#endif

agw-sdk/src/protocol/request_builder.cpp

@@ -0,0 +1,55 @@
+#include "protocol/request_builder.h"
+
+#include "crypto/aes.h"
+#include "crypto/rsa.h"
+#include "protocol/keys.h"
+#include "util/base64.h"
+#include "util/json.h"
+
+namespace agw::protocol
+{
+    namespace
+    {
+        std::vector<std::uint8_t> bytesOf(const std::string &s)
+        {
+            return std::vector<std::uint8_t>(s.begin(), s.end());
+        }
+    }
+
+    EncryptedRequest buildEncryptedRequest(const std::string &payload, const std::string &publicKeyPem, crypto::IRng &rng)
+    {
+        namespace k = keys;
+
+        EncryptedRequest out;
+        out.key = rng.bytes(32);
+        out.iv = rng.bytes(32);
+        out.salt = rng.bytes(8);
+
+        if (!crypto::rsaPublicKeyValid(publicKeyPem)) {
+            out.error = ErrorCode::ApiMissingAgwPublicKey;
+            return out;
+        }
+
+        util::Json keysJson;
+        keysJson[k::aesKey] = util::base64Encode(out.key);
+        keysJson[k::aesIv] = util::base64Encode(out.iv);
+        keysJson[k::aesSalt] = util::base64Encode(out.salt);
+        const std::string keysSerialized = util::qtIndentedDump(keysJson);
+
+        std::string keyPayloadB64;
+        std::string apiPayloadB64;
+        try {
+            keyPayloadB64 = util::base64Encode(crypto::rsaEncryptPublicPkcs1(bytesOf(keysSerialized), publicKeyPem));
+            apiPayloadB64 = util::base64Encode(crypto::aesEncryptCbc(bytesOf(payload), out.key, out.iv));
+        } catch (...) {
+            out.error = ErrorCode::ApiConfigDecryptionError;
+            return out;
+        }
+
+        util::Json body;
+        body[k::keyPayload] = keyPayloadB64;
+        body[k::apiPayload] = apiPayloadB64;
+        out.body = util::qtIndentedDump(body);
+        return out;
+    }
+}

agw-sdk/src/protocol/request_builder.h

@@ -0,0 +1,26 @@
+#ifndef AGW_PROTOCOL_REQUEST_BUILDER_H
+#define AGW_PROTOCOL_REQUEST_BUILDER_H
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "agw/types.h"
+#include "crypto/rng.h"
+
+namespace agw::protocol
+{
+    struct EncryptedRequest
+    {
+        std::string body;
+        std::vector<std::uint8_t> key;
+        std::vector<std::uint8_t> iv;
+        std::vector<std::uint8_t> salt;
+        ErrorCode error = ErrorCode::NoError;
+    };
+
+    EncryptedRequest buildEncryptedRequest(const std::string &payload, const std::string &publicKeyPem,
+                                           crypto::IRng &rng);
+}
+
+#endif

agw-sdk/src/protocol/response.cpp

@@ -0,0 +1,24 @@
+#include "protocol/response.h"
+
+#include "crypto/aes.h"
+
+namespace agw::protocol
+{
+    DecryptResult tryDecryptResponse(const std::string &encrypted, const std::vector<std::uint8_t> &key,
+                                     const std::vector<std::uint8_t> &iv)
+    {
+        DecryptResult result;
+        result.decryptedBody = encrypted;
+        result.ok = false;
+        try {
+            const std::vector<std::uint8_t> in(encrypted.begin(), encrypted.end());
+            const std::vector<std::uint8_t> out = crypto::aesDecryptCbc(in, key, iv);
+            result.decryptedBody.assign(out.begin(), out.end());
+            result.ok = true;
+        } catch (...) {
+            result.decryptedBody = encrypted;
+            result.ok = false;
+        }
+        return result;
+    }
+}

agw-sdk/src/protocol/response.h

@@ -0,0 +1,20 @@
+#ifndef AGW_PROTOCOL_RESPONSE_H
+#define AGW_PROTOCOL_RESPONSE_H
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace agw::protocol
+{
+    struct DecryptResult
+    {
+        std::string decryptedBody;
+        bool ok = false;
+    };
+
+    DecryptResult tryDecryptResponse(const std::string &encrypted, const std::vector<std::uint8_t> &key,
+                                     const std::vector<std::uint8_t> &iv);
+}
+
+#endif

agw-sdk/src/util/base64.cpp

@@ -0,0 +1,108 @@
+#include "base64.h"
+
+#include <array>
+
+namespace agw::util
+{
+    namespace
+    {
+        const char *kStd = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+        const char *kUrl = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+
+        std::string encode(const std::vector<std::uint8_t> &data, const char *alphabet, bool pad)
+        {
+            std::string out;
+            out.reserve((data.size() + 2) / 3 * 4);
+
+            std::size_t i = 0;
+            const std::size_t n = data.size();
+            while (i + 3 <= n) {
+                const std::uint32_t v = (std::uint32_t(data[i]) << 16) | (std::uint32_t(data[i + 1]) << 8) | data[i + 2];
+                out.push_back(alphabet[(v >> 18) & 0x3F]);
+                out.push_back(alphabet[(v >> 12) & 0x3F]);
+                out.push_back(alphabet[(v >> 6) & 0x3F]);
+                out.push_back(alphabet[v & 0x3F]);
+                i += 3;
+            }
+
+            const std::size_t rem = n - i;
+            if (rem == 1) {
+                const std::uint32_t v = std::uint32_t(data[i]) << 16;
+                out.push_back(alphabet[(v >> 18) & 0x3F]);
+                out.push_back(alphabet[(v >> 12) & 0x3F]);
+                if (pad) {
+                    out.push_back('=');
+                    out.push_back('=');
+                }
+            } else if (rem == 2) {
+                const std::uint32_t v = (std::uint32_t(data[i]) << 16) | (std::uint32_t(data[i + 1]) << 8);
+                out.push_back(alphabet[(v >> 18) & 0x3F]);
+                out.push_back(alphabet[(v >> 12) & 0x3F]);
+                out.push_back(alphabet[(v >> 6) & 0x3F]);
+                if (pad) {
+                    out.push_back('=');
+                }
+            }
+            return out;
+        }
+
+        int decodeChar(char c)
+        {
+            if (c >= 'A' && c <= 'Z')
+                return c - 'A';
+            if (c >= 'a' && c <= 'z')
+                return c - 'a' + 26;
+            if (c >= '0' && c <= '9')
+                return c - '0' + 52;
+            if (c == '+' || c == '-')
+                return 62;
+            if (c == '/' || c == '_')
+                return 63;
+            return -1;
+        }
+    }
+
+    std::string base64Encode(const std::vector<std::uint8_t> &data)
+    {
+        return encode(data, kStd, true);
+    }
+
+    std::string base64UrlEncodeNoPad(const std::vector<std::uint8_t> &data)
+    {
+        return encode(data, kUrl, false);
+    }
+
+    std::string base64Encode(const std::string &data)
+    {
+        return base64Encode(std::vector<std::uint8_t>(data.begin(), data.end()));
+    }
+
+    std::vector<std::uint8_t> base64Decode(const std::string &text)
+    {
+        std::vector<std::uint8_t> out;
+        out.reserve(text.size() / 4 * 3 + 3);
+
+        std::array<int, 4> quad { };
+        int count = 0;
+        for (char c : text) {
+            const int v = decodeChar(c);
+            if (v < 0) {
+                continue;
+            }
+            quad[count++] = v;
+            if (count == 4) {
+                out.push_back(static_cast<std::uint8_t>((quad[0] << 2) | (quad[1] >> 4)));
+                out.push_back(static_cast<std::uint8_t>((quad[1] << 4) | (quad[2] >> 2)));
+                out.push_back(static_cast<std::uint8_t>((quad[2] << 6) | quad[3]));
+                count = 0;
+            }
+        }
+        if (count == 2) {
+            out.push_back(static_cast<std::uint8_t>((quad[0] << 2) | (quad[1] >> 4)));
+        } else if (count == 3) {
+            out.push_back(static_cast<std::uint8_t>((quad[0] << 2) | (quad[1] >> 4)));
+            out.push_back(static_cast<std::uint8_t>((quad[1] << 4) | (quad[2] >> 2)));
+        }
+        return out;
+    }
+}

agw-sdk/src/util/base64.h

@@ -0,0 +1,19 @@
+#ifndef AGW_UTIL_BASE64_H
+#define AGW_UTIL_BASE64_H
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace agw::util
+{
+    std::string base64Encode(const std::vector<std::uint8_t> &data);
+
+    std::string base64UrlEncodeNoPad(const std::vector<std::uint8_t> &data);
+
+    std::vector<std::uint8_t> base64Decode(const std::string &text);
+
+    std::string base64Encode(const std::string &data);
+}
+
+#endif

agw-sdk/src/util/json.cpp

@@ -0,0 +1,108 @@
+#include "json.h"
+
+#include <cstdint>
+
+namespace agw::util
+{
+    namespace
+    {
+        const char *kHex = "0123456789abcdef";
+
+        void appendEscaped(std::string &out, const std::string &s)
+        {
+            out.push_back('"');
+            for (unsigned char c : s) {
+                switch (c) {
+                case '"': out += "\\\""; break;
+                case '\\': out += "\\\\"; break;
+                case '\b': out += "\\b"; break;
+                case '\f': out += "\\f"; break;
+                case '\n': out += "\\n"; break;
+                case '\r': out += "\\r"; break;
+                case '\t': out += "\\t"; break;
+                default:
+                    if (c < 0x20) {
+                        out += "\\u00";
+                        out.push_back(kHex[c >> 4]);
+                        out.push_back(kHex[c & 0x0F]);
+                    } else {
+                        out.push_back(static_cast<char>(c));
+                    }
+                }
+            }
+            out.push_back('"');
+        }
+
+        void appendIndent(std::string &out, int level)
+        {
+            out.append(static_cast<std::size_t>(level) * 4, ' ');
+        }
+
+        void dumpValue(std::string &out, const Json &j, int indent);
+
+        void dumpObject(std::string &out, const Json &j, int indent)
+        {
+            out += "{\n";
+            const int inner = indent + 1;
+            std::size_t i = 0;
+            const std::size_t n = j.size();
+            for (auto it = j.begin(); it != j.end(); ++it, ++i) {
+                appendIndent(out, inner);
+                appendEscaped(out, it.key());
+                out += ": ";
+                dumpValue(out, it.value(), inner);
+                if (i + 1 < n) {
+                    out.push_back(',');
+                }
+                out.push_back('\n');
+            }
+            appendIndent(out, indent);
+            out.push_back('}');
+        }
+
+        void dumpArray(std::string &out, const Json &j, int indent)
+        {
+            out += "[\n";
+            const int inner = indent + 1;
+            std::size_t i = 0;
+            const std::size_t n = j.size();
+            for (const auto &el : j) {
+                appendIndent(out, inner);
+                dumpValue(out, el, inner);
+                if (i + 1 < n) {
+                    out.push_back(',');
+                }
+                out.push_back('\n');
+                ++i;
+            }
+            appendIndent(out, indent);
+            out.push_back(']');
+        }
+
+        void dumpValue(std::string &out, const Json &j, int indent)
+        {
+            switch (j.type()) {
+            case Json::value_t::object: dumpObject(out, j, indent); break;
+            case Json::value_t::array: dumpArray(out, j, indent); break;
+            case Json::value_t::string: appendEscaped(out, j.get<std::string>()); break;
+            case Json::value_t::boolean: out += j.get<bool>() ? "true" : "false"; break;
+            case Json::value_t::null: out += "null"; break;
+            case Json::value_t::number_integer:
+            case Json::value_t::number_unsigned:
+            case Json::value_t::number_float:
+            default:
+
+                out += j.dump();
+                break;
+            }
+        }
+    }
+
+    std::string qtIndentedDump(const Json &j)
+    {
+        std::string out;
+        dumpValue(out, j, 0);
+        out.push_back('\n');
+        return out;
+    }
+}

agw-sdk/src/util/json.h

@@ -0,0 +1,15 @@
+#ifndef AGW_UTIL_JSON_H
+#define AGW_UTIL_JSON_H
+
+#include <string>
+
+#include <nlohmann/json.hpp>
+
+namespace agw::util
+{
+    using Json = nlohmann::json;
+
+    std::string qtIndentedDump(const Json &j);
+}
+
+#endif

agw-sdk/src/util/thread_pool.cpp

@@ -0,0 +1,59 @@
+#include "util/thread_pool.h"
+
+namespace agw::util
+{
+    ThreadPool::ThreadPool(std::size_t threadCount)
+    {
+        if (threadCount == 0) {
+            threadCount = 1;
+        }
+        m_workers.reserve(threadCount);
+        for (std::size_t i = 0; i < threadCount; ++i) {
+            m_workers.emplace_back([this] { workerLoop(); });
+        }
+    }
+
+    ThreadPool::~ThreadPool()
+    {
+        {
+            std::lock_guard<std::mutex> lock(m_mutex);
+            m_stopping = true;
+        }
+        m_cv.notify_all();
+        for (auto &w : m_workers) {
+            if (w.joinable()) {
+                w.join();
+            }
+        }
+    }
+
+    void ThreadPool::submit(std::function<void()> task)
+    {
+        {
+            std::lock_guard<std::mutex> lock(m_mutex);
+            m_tasks.push(std::move(task));
+        }
+        m_cv.notify_one();
+    }
+
+    void ThreadPool::workerLoop()
+    {
+        for (;;) {
+            std::function<void()> task;
+            {
+                std::unique_lock<std::mutex> lock(m_mutex);
+                m_cv.wait(lock, [this] { return m_stopping || !m_tasks.empty(); });
+
+                if (m_tasks.empty()) {
+                    if (m_stopping) {
+                        return;
+                    }
+                    continue;
+                }
+                task = std::move(m_tasks.front());
+                m_tasks.pop();
+            }
+            task();
+        }
+    }
+}

agw-sdk/src/util/thread_pool.h

@@ -0,0 +1,36 @@
+#ifndef AGW_UTIL_THREAD_POOL_H
+#define AGW_UTIL_THREAD_POOL_H
+
+#include <condition_variable>
+#include <cstddef>
+#include <functional>
+#include <mutex>
+#include <queue>
+#include <thread>
+#include <vector>
+
+namespace agw::util
+{
+    class ThreadPool
+    {
+    public:
+        explicit ThreadPool(std::size_t threadCount);
+        ~ThreadPool();
+
+        ThreadPool(const ThreadPool &) = delete;
+        ThreadPool &operator=(const ThreadPool &) = delete;
+
+        void submit(std::function<void()> task);
+
+    private:
+        void workerLoop();
+
+        std::vector<std::thread> m_workers;
+        std::queue<std::function<void()>> m_tasks;
+        std::mutex m_mutex;
+        std::condition_variable m_cv;
+        bool m_stopping = false;
+    };
+}
+
+#endif

agw-sdk/src/util/url.cpp

@@ -0,0 +1,48 @@
+#include "util/url.h"
+
+namespace agw::util
+{
+    std::string formatEndpoint(const std::string &endpoint, const std::string &host)
+    {
+        const std::string token = "%1";
+        const std::size_t pos = endpoint.find(token);
+        if (pos == std::string::npos) {
+            return endpoint;
+        }
+        std::string out = endpoint;
+        out.replace(pos, token.size(), host);
+        return out;
+    }
+
+    std::string extractHost(const std::string &url)
+    {
+        std::size_t start = 0;
+        const std::size_t scheme = url.find("://");
+        if (scheme != std::string::npos) {
+            start = scheme + 3;
+        }
+
+        std::size_t end = url.size();
+        for (std::size_t i = start; i < url.size(); ++i) {
+            const char c = url[i];
+            if (c == '/' || c == '?' || c == '#') {
+                end = i;
+                break;
+            }
+        }
+
+        std::string authority = url.substr(start, end - start);
+
+        const std::size_t at = authority.find('@');
+        if (at != std::string::npos) {
+            authority = authority.substr(at + 1);
+        }
+
+        const std::size_t colon = authority.find(':');
+        if (colon != std::string::npos) {
+            authority = authority.substr(0, colon);
+        }
+
+        return authority;
+    }
+}

agw-sdk/src/util/url.h

@@ -0,0 +1,13 @@
+#ifndef AGW_UTIL_URL_H
+#define AGW_UTIL_URL_H
+
+#include <string>
+
+namespace agw::util
+{
+    std::string formatEndpoint(const std::string &endpoint, const std::string &host);
+
+    std::string extractHost(const std::string &url);
+}
+
+#endif

agw-sdk/src/util/uuid.cpp

@@ -0,0 +1,36 @@
+#include "uuid.h"
+
+#include <cstdint>
+#include <vector>
+
+namespace agw::util
+{
+    namespace
+    {
+        const char *kHex = "0123456789abcdef";
+
+        void appendHex(std::string &out, std::uint8_t b)
+        {
+            out.push_back(kHex[b >> 4]);
+            out.push_back(kHex[b & 0x0F]);
+        }
+    }
+
+    std::string makeUuidV4(crypto::IRng &rng)
+    {
+        std::vector<std::uint8_t> b = rng.bytes(16);
+
+        b[6] = static_cast<std::uint8_t>((b[6] & 0x0F) | 0x40);
+        b[8] = static_cast<std::uint8_t>((b[8] & 0x3F) | 0x80);
+
+        std::string out;
+        out.reserve(36);
+        for (int i = 0; i < 16; ++i) {
+            if (i == 4 || i == 6 || i == 8 || i == 10) {
+                out.push_back('-');
+            }
+            appendHex(out, b[i]);
+        }
+        return out;
+    }
+}

agw-sdk/src/util/uuid.h

@@ -0,0 +1,13 @@
+#ifndef AGW_UTIL_UUID_H
+#define AGW_UTIL_UUID_H
+
+#include <string>
+
+#include "crypto/rng.h"
+
+namespace agw::util
+{
+    std::string makeUuidV4(crypto::IRng &rng);
+}
+
+#endif

agw-sdk/tests/CMakeLists.txt

@@ -0,0 +1,27 @@
+# Тесты agw-sdk. Локально — на встроенном harness (agw_test.h), без внешнего фреймворка.
+
+set(AGW_FIXTURES_DIR "${CMAKE_CURRENT_SOURCE_DIR}/golden/fixtures")
+
+function(agw_add_test name src)
+    add_executable(${name} ${src})
+    target_include_directories(${name} PRIVATE
+        ${CMAKE_CURRENT_SOURCE_DIR}
+        ${CMAKE_SOURCE_DIR}/include
+        ${CMAKE_SOURCE_DIR}/src
+    )
+    target_link_libraries(${name} PRIVATE agw OpenSSL::Crypto nlohmann_json::nlohmann_json Threads::Threads)
+    target_compile_definitions(${name} PRIVATE AGW_FIXTURES_DIR="${AGW_FIXTURES_DIR}")
+    add_test(NAME ${name} COMMAND ${name})
+endfunction()
+
+agw_add_test(test_crypto        unit/test_crypto.cpp)
+agw_add_test(test_json          unit/test_json.cpp)
+agw_add_test(test_golden        golden/test_golden.cpp)
+agw_add_test(test_error_mapping unit/test_error_mapping.cpp)
+agw_add_test(test_bypass_policy unit/test_bypass_policy.cpp)
+agw_add_test(test_proxy_list    unit/test_proxy_list.cpp)
+agw_add_test(test_thread_pool   unit/test_thread_pool.cpp)
+agw_add_test(test_post          integration/test_post.cpp)
+agw_add_test(test_failover      integration/test_failover.cpp)
+agw_add_test(test_async         integration/test_async.cpp)
+agw_add_test(test_c_abi         integration/test_c_abi.cpp)

agw-sdk/tests/agw_test.h

@@ -0,0 +1,39 @@
+#ifndef AGW_TEST_H
+#define AGW_TEST_H
+
+#include <cstdio>
+#include <cstdlib>
+#include <string>
+
+namespace agw_test {
+inline int &failCount()
+{
+    static int n = 0;
+    return n;
+}
+
+inline void report(bool ok, const char *expr, const char *file, int line)
+{
+    if (!ok) {
+        std::fprintf(stderr, "FAIL: %s\n  at %s:%d\n", expr, file, line);
+        ++failCount();
+    }
+}
+
+inline void reportEq(const std::string &a, const std::string &b, const char *expr, const char *file, int line)
+{
+    if (a != b) {
+        std::fprintf(stderr, "FAIL: %s\n  at %s:%d\n  lhs=[%s]\n  rhs=[%s]\n",
+                     expr, file, line, a.c_str(), b.c_str());
+        ++failCount();
+    }
+}
+}
+
+#define CHECK(expr) ::agw_test::report((expr), #expr, __FILE__, __LINE__)
+#define CHECK_EQ(a, b) ::agw_test::reportEq((a), (b), #a " == " #b, __FILE__, __LINE__)
+
+#define AGW_TEST_MAIN_RETURN() \
+    (::agw_test::failCount() == 0 ? (std::printf("OK\n"), 0) : (std::fprintf(stderr, "%d check(s) failed\n", ::agw_test::failCount()), 1))
+
+#endif

agw-sdk/tests/golden/fixtures/aes_cipher.bin

@@ -0,0 +1 @@
+ыaГ
цЖ7И~▐>ъl╛▌Ц╗ЦaJ╩┤ъ%фTхO╒╢^

agw-sdk/tests/golden/fixtures/aes_plaintext.bin

@@ -0,0 +1 @@
+{"hello":"world"}

agw-sdk/tests/golden/fixtures/aes_vector.txt

@@ -0,0 +1,4 @@
+AES_KEY_HEX=000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
+AES_IV_HEX=101112131415161718191a1b1c1d1e1f
+AES_PLAINTEXT={"hello":"world"}
+AES_CIPHER_B64=2WHnAcP2N+l+jz7fbKyO46jjYUq7h98lxlTIT6K0Xg8=

agw-sdk/tests/golden/fixtures/test_rsa_priv.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDL3pxE7uI3RacQ
+jvyFz5tbkL87aqpFBvAVFS0OFzVLbApaJ6nv2jZNfidbPCN5SMeNoa2kNTC+MZNQ
+qORgr77TgaRuFap5dSun9qci0ll5Y/zBQHb8/Xihah8YpkbO/8SV1aFWLtWKQiQL
+xrFTD9ShXC7S6IQrdGcngUhLShinWmjveZJ//B7no3wUP3xPF+EkTXTq5QyD/SfQ
+/w0BUosy55sCn5OyP6iSJ4cqujA7WCEd48XpS5zgceqdnE98mvjhriMDfORXsSnx
+ymsDnPyX/wkrLOynpN5KPoCMwXS0knTSGADUPMm/EQXa5fjEDxg0OnJQcJV/mZJk
+4Rgi+gZJAgMBAAECggEAXWW2ob3u1POL/gIDninmOqStd0L+jnEHPCFfar0nJU5x
+z6usJr4JcqcA0MNUXRQCl9gh/MCBfCCqJKG7PrBE9BDIi8ZROyN6xJAzMbi8VOiB
+uucVnAFjak97v4ctmVeDcEFWkG0UVyrF6L82LZ9rAiGBMg5jvqStPWP1AskHUmM+
+drJZYsrvqqqZLVbB34I6logBcD0IKEib8uBM3brLrO1t86XpLvOIJEjCsD+GRtmJ
+vnjjVcIqHFM+VyA+RvpgMnfbTcG3D4YZhDtdgsbnOHs4mydM/I6C7a5pLftKsdoC
+lKgb6CIqJoXvW2goljHfQiBre56hwhBjRgzmdo+BoQKBgQD+aM+P1+nAsIUxWmXf
+jexL8LIQ+POxNztz/d9EIYLXOztiS3epwt8e/Xqffu4B5+D1j6u/gtnK90SNcMi2
+IhetBwkTGdz6s/JHTt92f7okRbSnzwZwj03Ppkgg3VAPp3LL4nP/a1kcHi+9aqBB
+kPPkQ0k9BS/JOmEVPOKpOx0ABwKBgQDNJOjDyhKesjjLK33xJdD6sdhwxFJrSMs3
+TtMd0KvPu26Z+gn+5ybE/rzOoO7YZIUmB8AXvNKLu8U/5FRE6eOeaumz2LvFNCzE
+IC6J2Oixt/lVxxuR0mSRTJI/hR0CtrofXRke8YjeU3VjtkMW6k2QrPAAMMTPieRW
+fkfb8oWTLwKBgQCt0B/W77XFLxSgplkphgYlz/loPR4JOmoFEjLCkn6Y29/zhQnp
+UrkrrBRl+ctUQ/7e5lx5yEVSNOOCGscWIG66iS76/NWL9vsVGt7zT8p106XcbEXD
+CzUnJDztLybuuwFkKIAFxmqoGjuVls6MXSM0FYBpDy0Ztyfy4Zkd88QZawKBgHB8
+rKWvSEZ8s2e0kXqJoe3VVzl+bTMm10eckWbn5U4jGKKV2KVNWpTqmd0zocRGWjxg
+Q5TAlTLJ438FVK/1EDrtpPhY/51C3sksXFh5+B57It1GMHflRf/mXMs30pCKYcSQ
+6BVvm/1NBjGG34LRN3b9XRy9oS2sDujelcilU1lBAoGBAMHx0oFSlNUHGofigo3p
+26kWJw7BE/o8HVIrfI2vekXOgTVgJWGiubjp3qUKgNf1lbRy/Ur9F4ElW7hEINjC
+aMJUZWc/xYwAmKHe/7ITZByfRXdGMwlvo8QudbzDC6vvCqn7wQW56kyTTEEHF54k
+21jK19EBX4JWibzJotv8ShkU
+-----END PRIVATE KEY-----

agw-sdk/tests/golden/fixtures/test_rsa_pub.pem

@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy96cRO7iN0WnEI78hc+b
+W5C/O2qqRQbwFRUtDhc1S2wKWiep79o2TX4nWzwjeUjHjaGtpDUwvjGTUKjkYK++
+04GkbhWqeXUrp/anItJZeWP8wUB2/P14oWofGKZGzv/EldWhVi7VikIkC8axUw/U
+oVwu0uiEK3RnJ4FIS0oYp1po73mSf/we56N8FD98TxfhJE106uUMg/0n0P8NAVKL
+MuebAp+Tsj+okieHKrowO1ghHePF6Uuc4HHqnZxPfJr44a4jA3zkV7Ep8cprA5z8
+l/8JKyzsp6TeSj6AjMF0tJJ00hgA1DzJvxEF2uX4xA8YNDpyUHCVf5mSZOEYIvoG
+SQIDAQAB
+-----END PUBLIC KEY-----

agw-sdk/tests/golden/test_golden.cpp

@@ -0,0 +1,97 @@
+#include "agw_test.h"
+
+#include <fstream>
+#include <sstream>
+#include <string>
+#include <vector>
+
+#include "crypto/aes.h"
+#include "crypto/hash.h"
+#include "crypto/rsa.h"
+#include "protocol/keys.h"
+#include "util/base64.h"
+#include "util/json.h"
+
+using namespace agw;
+
+namespace {
+std::vector<std::uint8_t> bytesOf(const std::string &s)
+{
+    return std::vector<std::uint8_t>(s.begin(), s.end());
+}
+
+std::string toStr(const std::vector<std::uint8_t> &v)
+{
+    return std::string(v.begin(), v.end());
+}
+
+std::string readFile(const std::string &path)
+{
+    std::ifstream f(path, std::ios::binary);
+    std::ostringstream ss;
+    ss << f.rdbuf();
+    return ss.str();
+}
+}
+
+int main()
+{
+    namespace k = protocol::keys;
+
+    const auto key = crypto::fromHex("000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f");
+    const auto iv = crypto::fromHex("101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f");
+    const auto salt = crypto::fromHex("a0a1a2a3a4a5a6a7");
+    const std::string payload = "{\"hello\":\"world\"}";
+
+    util::Json keysJson;
+    keysJson[k::aesKey] = util::base64Encode(key);
+    keysJson[k::aesIv] = util::base64Encode(iv);
+    keysJson[k::aesSalt] = util::base64Encode(salt);
+    const std::string keysSerialized = util::qtIndentedDump(keysJson);
+
+    const std::string expectedKeysJson =
+        "{\n"
+        "    \"aes_iv\": \"EBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8=\",\n"
+        "    \"aes_key\": \"AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=\",\n"
+        "    \"aes_salt\": \"oKGio6Slpqc=\"\n"
+        "}\n";
+    CHECK_EQ(keysSerialized, expectedKeysJson);
+
+    const auto apiCipher = crypto::aesEncryptCbc(bytesOf(payload), key, iv);
+    const std::string apiPayloadB64 = util::base64Encode(apiCipher);
+    CHECK_EQ(apiPayloadB64, std::string("2WHnAcP2N+l+jz7fbKyO46jjYUq7h98lxlTIT6K0Xg8="));
+
+    const std::string pub = readFile(std::string(AGW_FIXTURES_DIR) + "/test_rsa_pub.pem");
+    const std::string priv = readFile(std::string(AGW_FIXTURES_DIR) + "/test_rsa_priv.pem");
+    CHECK(!pub.empty());
+    CHECK(!priv.empty());
+
+    const auto keyCipher = crypto::rsaEncryptPublicPkcs1(bytesOf(keysSerialized), pub);
+    const std::string keyPayloadB64 = util::base64Encode(keyCipher);
+
+    const auto keyCipherBack = util::base64Decode(keyPayloadB64);
+    const auto recovered = crypto::rsaDecryptPrivatePkcs1(keyCipherBack, priv);
+    CHECK_EQ(toStr(recovered), keysSerialized);
+
+    util::Json body;
+    body[k::keyPayload] = keyPayloadB64;
+    body[k::apiPayload] = apiPayloadB64;
+    const std::string bodySerialized = util::qtIndentedDump(body);
+
+    util::Json parsed = util::Json::parse(bodySerialized);
+    CHECK_EQ(parsed[k::apiPayload].get<std::string>(), apiPayloadB64);
+    {
+        const auto cBack = util::base64Decode(parsed[k::keyPayload].get<std::string>());
+        const auto rec = crypto::rsaDecryptPrivatePkcs1(cBack, priv);
+        CHECK_EQ(toStr(rec), keysSerialized);
+    }
+
+    {
+        const auto respPlain = bytesOf("{\"ok\":true}");
+        const auto respCipher = crypto::aesEncryptCbc(respPlain, key, iv);
+        const auto back = crypto::aesDecryptCbc(respCipher, key, iv);
+        CHECK(back == respPlain);
+    }
+
+    return AGW_TEST_MAIN_RETURN();
+}

agw-sdk/tests/integration/test_async.cpp

@@ -0,0 +1,174 @@
+#include "agw_test.h"
+
+#include <atomic>
+#include <chrono>
+#include <fstream>
+#include <future>
+#include <memory>
+#include <sstream>
+#include <string>
+#include <thread>
+#include <vector>
+
+#include "agw/cancellation.h"
+#include "agw/gateway_controller.h"
+#include "agw/config.h"
+#include "crypto/aes.h"
+#include "crypto/rsa.h"
+#include "mock_gateway/mock_gateway.h"
+#include "protocol/keys.h"
+#include "util/base64.h"
+#include "util/json.h"
+
+using namespace agw;
+
+namespace {
+std::string readFile(const std::string &path)
+{
+    std::ifstream f(path, std::ios::binary);
+    std::ostringstream ss;
+    ss << f.rdbuf();
+    return ss.str();
+}
+
+Config baseConfig(std::shared_ptr<IHttpClient> http, const std::string &pub)
+{
+    Config c;
+    c.gatewayEndpoint = "gw.example.test";
+    c.agwPublicKeyPem = pub;
+    c.requestTimeoutMsecs = 5000;
+    c.httpClient = std::move(http);
+    return c;
+}
+
+class BlockingUntilCancelMock : public IHttpClient {
+public:
+    std::atomic<int> entered{0};
+    HttpResponse send(const HttpRequest &req) override
+    {
+        entered.fetch_add(1);
+        while (!(req.cancelCheck && req.cancelCheck())) {
+            std::this_thread::sleep_for(std::chrono::milliseconds(2));
+        }
+        HttpResponse r;
+        r.error = TransportError::Canceled;
+        return r;
+    }
+};
+
+class StatelessMock : public IHttpClient {
+public:
+    explicit StatelessMock(std::string priv) : m_priv(std::move(priv)) {}
+    std::atomic<int> count{0};
+    HttpResponse send(const HttpRequest &req) override
+    {
+        count.fetch_add(1);
+        namespace k = protocol::keys;
+        util::Json body = util::Json::parse(req.body);
+        const auto keyCipher = util::base64Decode(body[k::keyPayload].get<std::string>());
+        const auto keysBytes = crypto::rsaDecryptPrivatePkcs1(keyCipher, m_priv);
+        util::Json keysJson = util::Json::parse(std::string(keysBytes.begin(), keysBytes.end()));
+        const auto aesKey = util::base64Decode(keysJson[k::aesKey].get<std::string>());
+        const auto aesIv = util::base64Decode(keysJson[k::aesIv].get<std::string>());
+
+        const std::string plain = R"({"ok":true})";
+        const std::vector<std::uint8_t> pv(plain.begin(), plain.end());
+        const auto cipher = crypto::aesEncryptCbc(pv, aesKey, aesIv);
+        HttpResponse r;
+        r.httpStatusCode = 200;
+        r.body.assign(cipher.begin(), cipher.end());
+        return r;
+    }
+
+private:
+    std::string m_priv;
+};
+}
+
+int main()
+{
+    const std::string pub = readFile(std::string(AGW_FIXTURES_DIR) + "/test_rsa_pub.pem");
+    const std::string priv = readFile(std::string(AGW_FIXTURES_DIR) + "/test_rsa_priv.pem");
+    const std::string endpoint = "https://%1/api/v1/test";
+    const FailoverContext ctx{"prem", "US"};
+    const std::string payload = R"({"hello":"world"})";
+
+    {
+        auto mock = std::make_shared<agw_test::MockGateway>(priv);
+        mock->responsePlain = R"({"ok":true,"v":1})";
+        GatewayController client(baseConfig(mock, pub));
+        std::future<Response> f = client.postFuture(endpoint, payload, ctx);
+        Response r = f.get();
+        CHECK(r.error == ErrorCode::NoError);
+        CHECK_EQ(r.body, std::string(R"({"ok":true,"v":1})"));
+        CHECK_EQ(mock->lastDecryptedPayload, payload);
+    }
+
+    {
+        auto mock = std::make_shared<agw_test::MockGateway>(priv);
+        mock->responsePlain = R"({"async":true})";
+        GatewayController client(baseConfig(mock, pub));
+
+        std::promise<Response> p;
+        std::future<Response> f = p.get_future();
+        client.postAsync(
+            endpoint, payload, [&p](Response r) { p.set_value(std::move(r)); }, ctx);
+        Response r = f.get();
+        CHECK(r.error == ErrorCode::NoError);
+        CHECK_EQ(r.body, std::string(R"({"async":true})"));
+    }
+
+    {
+        auto mock = std::make_shared<agw_test::MockGateway>(priv);
+        GatewayController client(baseConfig(mock, pub));
+        CancellationToken token;
+        token.cancel();
+        std::future<Response> f = client.postFuture(endpoint, payload, ctx, &token);
+        Response r = f.get();
+        CHECK(r.error == ErrorCode::Cancelled);
+        CHECK(mock->requestCount == 0);
+    }
+
+    {
+        auto mock = std::make_shared<BlockingUntilCancelMock>();
+        GatewayController client(baseConfig(mock, pub));
+        CancellationToken token;
+
+        std::promise<Response> p;
+        std::future<Response> f = p.get_future();
+        client.postAsync(
+            endpoint, payload, [&p](Response r) { p.set_value(std::move(r)); }, ctx, &token);
+
+        while (mock->entered.load() == 0) {
+            std::this_thread::sleep_for(std::chrono::milliseconds(2));
+        }
+        token.cancel();
+        Response r = f.get();
+        CHECK(r.error == ErrorCode::Cancelled);
+    }
+
+    {
+        auto mock = std::make_shared<StatelessMock>(priv);
+        Config cfg = baseConfig(mock, pub);
+        cfg.threadPoolSize = 8;
+        GatewayController client(std::move(cfg));
+
+        constexpr int N = 64;
+        std::vector<std::future<Response>> futs;
+        futs.reserve(N);
+        for (int i = 0; i < N; ++i) {
+            futs.push_back(client.postFuture(endpoint, payload, ctx));
+        }
+        int ok = 0;
+        for (auto &fut : futs) {
+            Response r = fut.get();
+            if (r.error == ErrorCode::NoError && r.body == R"({"ok":true})") {
+                ++ok;
+            }
+        }
+        CHECK(ok == N);
+        CHECK(mock->count.load() == N);
+    }
+
+    return AGW_TEST_MAIN_RETURN();
+}

agw-sdk/tests/integration/test_c_abi.cpp

@@ -0,0 +1,118 @@
+#include "agw_test.h"
+
+#include <fstream>
+#include <future>
+#include <memory>
+#include <sstream>
+#include <string>
+#include <utility>
+
+#include "agw/c_abi.h"
+#include "agw/types.h"
+#include "detail/test_hooks.h"
+#include "mock_gateway/mock_gateway.h"
+
+namespace {
+std::string readFile(const std::string &path)
+{
+    std::ifstream f(path, std::ios::binary);
+    std::ostringstream ss;
+    ss << f.rdbuf();
+    return ss.str();
+}
+
+agw_config makeConfig(const char *gateway, const char *pem)
+{
+    agw_config c{};
+    c.gateway_endpoint = gateway;
+    c.agw_public_key_pem = pem;
+    c.request_timeout_msecs = 5000;
+    return c;
+}
+
+struct AsyncSink {
+    std::promise<std::pair<int, std::string>> promise;
+};
+
+void asyncCallback(agw_response r, void *ud)
+{
+    auto *sink = static_cast<AsyncSink *>(ud);
+    sink->promise.set_value({r.error, r.body ? std::string(r.body, r.body_len) : std::string()});
+    agw_response_free(&r);
+}
+}
+
+int main()
+{
+    const std::string pub = readFile(std::string(AGW_FIXTURES_DIR) + "/test_rsa_pub.pem");
+    const std::string priv = readFile(std::string(AGW_FIXTURES_DIR) + "/test_rsa_priv.pem");
+    const std::string payload = R"({"hello":"world"})";
+
+    {
+        auto mock = std::make_shared<agw_test::MockGateway>(priv);
+        mock->responsePlain = R"({"ok":true,"c":1})";
+        agw::detail::setNextTestHttpClient(mock);
+
+        agw_config cfg = makeConfig("gw.example.test", pub.c_str());
+        agw_client *client = agw_client_create(&cfg);
+        CHECK(client != nullptr);
+
+        agw_response r = agw_client_post(client, "https://%1/api/v1/test", payload.c_str(), "prem", "US", nullptr);
+        CHECK(r.error == 0);
+        CHECK(r.body != nullptr);
+        CHECK_EQ(std::string(r.body, r.body_len), std::string(R"({"ok":true,"c":1})"));
+        CHECK_EQ(mock->lastDecryptedPayload, payload);
+        agw_response_free(&r);
+        CHECK(r.body == nullptr);
+
+        mock->responsePlain = R"({"async":1})";
+        AsyncSink sink;
+        auto fut = sink.promise.get_future();
+        agw_client_post_async(client, "https://%1/api/v1/test", payload.c_str(), "prem", "US",
+                              &asyncCallback, &sink, nullptr);
+        auto [err, body] = fut.get();
+        CHECK(err == 0);
+        CHECK_EQ(body, std::string(R"({"async":1})"));
+
+        agw_client_destroy(client);
+    }
+
+    {
+        auto mock = std::make_shared<agw_test::MockGateway>(priv);
+        agw::detail::setNextTestHttpClient(mock);
+        agw_config cfg = makeConfig("gw.example.test", pub.c_str());
+        agw_client *client = agw_client_create(&cfg);
+
+        agw_cancel_token *token = agw_cancel_token_create();
+        CHECK(token != nullptr);
+        agw_cancel_token_cancel(token);
+
+        agw_response r = agw_client_post(client, "https://%1/api/v1/test", payload.c_str(), "", "", token);
+        CHECK(r.error == static_cast<int>(agw::ErrorCode::Cancelled));
+        CHECK(mock->requestCount == 0);
+        agw_response_free(&r);
+
+        agw_cancel_token_destroy(token);
+        agw_client_destroy(client);
+    }
+
+    {
+        agw_config cfg = makeConfig("gw.example.test", "not a pem");
+        agw_client *client = agw_client_create(&cfg);
+        CHECK(client != nullptr);
+        agw_response r = agw_client_post(client, "https://%1/x", payload.c_str(), "", "", nullptr);
+        CHECK(r.error == static_cast<int>(agw::ErrorCode::ApiMissingAgwPublicKey));
+        agw_response_free(&r);
+        agw_client_destroy(client);
+    }
+
+    {
+        CHECK(agw_client_create(nullptr) == nullptr);
+        agw_response r = agw_client_post(nullptr, "e", "p", "", "", nullptr);
+        CHECK(r.error != 0);
+        agw_response_free(&r);
+        agw_client_destroy(nullptr);
+    }
+
+    return AGW_TEST_MAIN_RETURN();
+}

agw-sdk/tests/integration/test_failover.cpp

@@ -0,0 +1,125 @@
+#include "agw_test.h"
+
+#include <fstream>
+#include <memory>
+#include <sstream>
+#include <string>
+#include <vector>
+
+#include "agw/gateway_controller.h"
+#include "agw/config.h"
+#include "crypto/aes.h"
+#include "crypto/rsa.h"
+#include "protocol/keys.h"
+#include "util/base64.h"
+#include "util/json.h"
+
+using namespace agw;
+
+namespace {
+std::string readFile(const std::string &path)
+{
+    std::ifstream f(path, std::ios::binary);
+    std::ostringstream ss;
+    ss << f.rdbuf();
+    return ss.str();
+}
+
+bool contains(const std::string &h, const std::string &n) { return h.find(n) != std::string::npos; }
+
+class FailoverMock : public IHttpClient {
+public:
+    explicit FailoverMock(std::string priv) : m_priv(std::move(priv)) {}
+
+    int directPosts = 0, proxyPosts = 0, storageGets = 0, healthGets = 0;
+
+    HttpResponse send(const HttpRequest &req) override
+    {
+        HttpResponse resp;
+        resp.httpStatusCode = 200;
+
+        if (req.method == "GET") {
+            if (contains(req.url, "lmbd-health")) {
+                ++healthGets;
+                if (!contains(req.url, "proxy.good.test")) {
+                    resp.error = TransportError::ConnectionError;
+                }
+                return resp;
+            }
+
+            ++storageGets;
+            resp.body = R"(["https://proxy.good.test/"])";
+            return resp;
+        }
+
+        namespace k = protocol::keys;
+        util::Json body = util::Json::parse(req.body);
+        const auto keyCipher = util::base64Decode(body[k::keyPayload].get<std::string>());
+        const auto keysBytes = crypto::rsaDecryptPrivatePkcs1(keyCipher, m_priv);
+        util::Json keysJson = util::Json::parse(std::string(keysBytes.begin(), keysBytes.end()));
+        const auto aesKey = util::base64Decode(keysJson[k::aesKey].get<std::string>());
+        const auto aesIv = util::base64Decode(keysJson[k::aesIv].get<std::string>());
+
+        std::string plain;
+        if (contains(req.url, "proxy.good.test")) {
+            ++proxyPosts;
+            plain = R"({"ok":true,"via":"proxy"})";
+        } else {
+            ++directPosts;
+            plain = R"({"http_status":404,"message":"blocked"})";
+        }
+        const std::vector<std::uint8_t> pv(plain.begin(), plain.end());
+        const auto cipher = crypto::aesEncryptCbc(pv, aesKey, aesIv);
+        resp.body.assign(cipher.begin(), cipher.end());
+        return resp;
+    }
+
+private:
+    std::string m_priv;
+};
+}
+
+int main()
+{
+    const std::string pub = readFile(std::string(AGW_FIXTURES_DIR) + "/test_rsa_pub.pem");
+    const std::string priv = readFile(std::string(AGW_FIXTURES_DIR) + "/test_rsa_priv.pem");
+
+    auto mock = std::make_shared<FailoverMock>(priv);
+
+    Config cfg;
+    cfg.gatewayEndpoint = "https://gw.example.test/";
+    cfg.agwPublicKeyPem = pub;
+    cfg.isDevEnvironment = true;
+    cfg.s3PrimaryEndpoints = {"https://s3.example.test/"};
+    cfg.requestTimeoutMsecs = 5000;
+    cfg.httpClient = mock;
+
+    GatewayController client(std::move(cfg));
+    const std::string endpoint = "%1api/v1/test";
+    const FailoverContext ctx{"prem", "US"};
+    const std::string payload = R"({"hello":"world"})";
+
+    {
+        Response r = client.post(endpoint, payload, ctx);
+        CHECK(r.error == ErrorCode::NoError);
+        CHECK_EQ(r.body, std::string(R"({"ok":true,"via":"proxy"})"));
+        CHECK(mock->directPosts == 1);
+        CHECK(mock->storageGets >= 1);
+        CHECK(mock->healthGets >= 1);
+        CHECK(mock->proxyPosts == 1);
+    }
+
+    {
+        const int storageBefore = mock->storageGets;
+        const int healthBefore = mock->healthGets;
+        Response r = client.post(endpoint, payload, ctx);
+        CHECK(r.error == ErrorCode::NoError);
+        CHECK_EQ(r.body, std::string(R"({"ok":true,"via":"proxy"})"));
+
+        CHECK(mock->storageGets == storageBefore);
+        CHECK(mock->healthGets == healthBefore);
+        CHECK(mock->directPosts == 1);
+    }
+
+    return AGW_TEST_MAIN_RETURN();
+}

agw-sdk/tests/integration/test_post.cpp

@@ -0,0 +1,103 @@
+#include "agw_test.h"
+
+#include <fstream>
+#include <memory>
+#include <sstream>
+#include <string>
+
+#include "agw/gateway_controller.h"
+#include "agw/config.h"
+#include "mock_gateway/mock_gateway.h"
+
+using namespace agw;
+
+namespace {
+std::string readFile(const std::string &path)
+{
+    std::ifstream f(path, std::ios::binary);
+    std::ostringstream ss;
+    ss << f.rdbuf();
+    return ss.str();
+}
+
+Config baseConfig(std::shared_ptr<IHttpClient> http, const std::string &pubPem)
+{
+    Config c;
+    c.gatewayEndpoint = "gw.example.test";
+    c.agwPublicKeyPem = pubPem;
+    c.requestTimeoutMsecs = 5000;
+    c.httpClient = std::move(http);
+    return c;
+}
+}
+
+int main()
+{
+    const std::string pub = readFile(std::string(AGW_FIXTURES_DIR) + "/test_rsa_pub.pem");
+    const std::string priv = readFile(std::string(AGW_FIXTURES_DIR) + "/test_rsa_priv.pem");
+    const std::string endpoint = "https://%1/api/v1/test";
+    const FailoverContext ctx{"premium", "US"};
+    const std::string payload = R"({"hello":"world","n":42})";
+
+    {
+        auto mock = std::make_shared<agw_test::MockGateway>(priv);
+        mock->responsePlain = R"({"ok":true,"data":"hi"})";
+
+        std::string seenHost;
+        Config cfg = baseConfig(mock, pub);
+        cfg.onBeforeRequest = [&](const std::string &h) { seenHost = h; };
+
+        GatewayController client(std::move(cfg));
+        Response r = client.post(endpoint, payload, ctx);
+
+        CHECK(r.error == ErrorCode::NoError);
+        CHECK_EQ(r.body, std::string(R"({"ok":true,"data":"hi"})"));
+
+        CHECK_EQ(mock->lastDecryptedPayload, payload);
+
+        CHECK_EQ(mock->lastUrl, std::string("https://gw.example.test/api/v1/test"));
+        CHECK_EQ(seenHost, std::string("gw.example.test"));
+        CHECK(mock->requestCount == 1);
+
+        CHECK(mock->lastRequestId.size() == 36);
+        CHECK(mock->lastRequestId[14] == '4');
+    }
+
+    {
+        auto mock = std::make_shared<agw_test::MockGateway>(priv);
+        mock->responsePlain = R"({"http_status":409,"message":"limit"})";
+        GatewayController client(baseConfig(mock, pub));
+        Response r = client.post(endpoint, payload, ctx);
+        CHECK(r.error == ErrorCode::ApiConfigLimitError);
+
+        CHECK_EQ(r.body, std::string(R"({"http_status":409,"message":"limit"})"));
+    }
+
+    {
+        auto mock = std::make_shared<agw_test::MockGateway>(priv);
+        mock->simulateSsl = true;
+        GatewayController client(baseConfig(mock, pub));
+        Response r = client.post(endpoint, payload, ctx);
+        CHECK(r.error == ErrorCode::ApiConfigSslError);
+    }
+
+    {
+        auto mock = std::make_shared<agw_test::MockGateway>(priv);
+        mock->simulateTransport = TransportError::Timeout;
+        GatewayController client(baseConfig(mock, pub));
+        Response r = client.post(endpoint, payload, ctx);
+        CHECK(r.error == ErrorCode::ApiConfigTimeoutError);
+    }
+
+    {
+        auto mock = std::make_shared<agw_test::MockGateway>(priv);
+        Config cfg = baseConfig(mock, "not a pem key");
+        GatewayController client(std::move(cfg));
+        Response r = client.post(endpoint, payload, ctx);
+        CHECK(r.error == ErrorCode::ApiMissingAgwPublicKey);
+
+        CHECK(mock->requestCount == 0);
+    }
+
+    return AGW_TEST_MAIN_RETURN();
+}

agw-sdk/tests/mock_gateway/mock_gateway.h

@@ -0,0 +1,77 @@
+#ifndef AGW_TEST_MOCK_GATEWAY_H
+#define AGW_TEST_MOCK_GATEWAY_H
+
+#include <string>
+#include <vector>
+
+#include "agw/http.h"
+#include "crypto/aes.h"
+#include "crypto/rsa.h"
+#include "protocol/keys.h"
+#include "util/base64.h"
+#include "util/json.h"
+
+namespace agw_test {
+class MockGateway : public agw::IHttpClient {
+public:
+    explicit MockGateway(std::string privateKeyPem) : m_priv(std::move(privateKeyPem)) {}
+
+    std::string responsePlain = "{\"ok\":true}";
+    bool simulateSsl = false;
+    agw::TransportError simulateTransport = agw::TransportError::None;
+    int httpStatusCode = 200;
+
+    std::string lastUrl;
+    std::string lastRequestId;
+    std::string lastDecryptedPayload;
+    int requestCount = 0;
+
+    agw::HttpResponse send(const agw::HttpRequest &req) override
+    {
+        ++requestCount;
+        lastUrl = req.url;
+        for (const auto &h : req.headers) {
+            if (h.first == "X-Client-Request-ID") {
+                lastRequestId = h.second;
+            }
+        }
+
+        agw::HttpResponse resp;
+        resp.httpStatusCode = httpStatusCode;
+
+        if (simulateSsl) {
+            resp.sslError = true;
+            resp.error = agw::TransportError::ConnectionError;
+            return resp;
+        }
+        if (simulateTransport != agw::TransportError::None) {
+            resp.error = simulateTransport;
+            return resp;
+        }
+
+        namespace k = agw::protocol::keys;
+        agw::util::Json body = agw::util::Json::parse(req.body);
+
+        const auto keyCipher = agw::util::base64Decode(body[k::keyPayload].get<std::string>());
+        const auto keysBytes = agw::crypto::rsaDecryptPrivatePkcs1(keyCipher, m_priv);
+        agw::util::Json keysJson = agw::util::Json::parse(std::string(keysBytes.begin(), keysBytes.end()));
+        const auto aesKey = agw::util::base64Decode(keysJson[k::aesKey].get<std::string>());
+        const auto aesIv = agw::util::base64Decode(keysJson[k::aesIv].get<std::string>());
+
+        const auto apiCipher = agw::util::base64Decode(body[k::apiPayload].get<std::string>());
+        const auto payloadBytes = agw::crypto::aesDecryptCbc(apiCipher, aesKey, aesIv);
+        lastDecryptedPayload.assign(payloadBytes.begin(), payloadBytes.end());
+
+        const std::vector<std::uint8_t> respPlain(responsePlain.begin(), responsePlain.end());
+        const auto respCipher = agw::crypto::aesEncryptCbc(respPlain, aesKey, aesIv);
+        resp.body.assign(respCipher.begin(), respCipher.end());
+        resp.error = agw::TransportError::None;
+        return resp;
+    }
+
+private:
+    std::string m_priv;
+};
+}
+
+#endif

agw-sdk/tests/unit/test_bypass_policy.cpp

@@ -0,0 +1,48 @@
+#include "agw_test.h"
+
+#include <string>
+
+#include "failover/bypass_policy.h"
+
+using namespace agw;
+using agw::failover::shouldBypassProxy;
+
+namespace {
+bool bypassBody(const std::string &body)
+{
+    return shouldBypassProxy(TransportError::None, body, true);
+}
+}
+
+int main()
+{
+    CHECK(shouldBypassProxy(TransportError::None, "garbage", false) == true);
+
+    CHECK(shouldBypassProxy(TransportError::Timeout, R"({"http_status":200})", true) == true);
+    CHECK(shouldBypassProxy(TransportError::Canceled, R"({"http_status":200})", true) == true);
+
+    CHECK(bypassBody("<html><body>blocked</body></html>") == true);
+
+    CHECK(bypassBody(R"({"http_status":408})") == false);
+    CHECK(bypassBody(R"({"http_status":409})") == false);
+    CHECK(bypassBody(R"({"http_status":402})") == false);
+
+    CHECK(bypassBody(R"({"http_status":404,"message":"whatever"})") == true);
+    CHECK(bypassBody(R"({"http_status":404,"message":"No active configuration found for x"})") == false);
+    CHECK(bypassBody(R"({"http_status":404,"detail":"Account not found."})") == false);
+    CHECK(bypassBody(R"({"http_status":404,"message":"Session not found"})") == false);
+
+    CHECK(bypassBody(R"({"http_status":501})") == true);
+    CHECK(bypassBody(R"({"http_status":501,"message":"client version update is required"})") == false);
+
+    CHECK(bypassBody(R"({"http_status":422,"message":"Failed to retrieve subscription information. Is it activated?"})") == false);
+    CHECK(bypassBody(R"({"http_status":422,"message":"other"})") == true);
+
+    CHECK(bypassBody(R"({"http_status":200})") == false);
+
+    CHECK(bypassBody("plain ok") == false);
+
+    CHECK(shouldBypassProxy(TransportError::ConnectionError, R"({"http_status":200})", true) == true);
+
+    return AGW_TEST_MAIN_RETURN();
+}

agw-sdk/tests/unit/test_crypto.cpp

@@ -0,0 +1,123 @@
+#include "agw_test.h"
+
+#include <fstream>
+#include <sstream>
+#include <string>
+#include <vector>
+
+#include "crypto/aes.h"
+#include "crypto/hash.h"
+#include "crypto/rng.h"
+#include "crypto/rsa.h"
+#include "util/base64.h"
+#include "util/uuid.h"
+
+using namespace agw;
+
+namespace {
+std::vector<std::uint8_t> bytesOf(const std::string &s)
+{
+    return std::vector<std::uint8_t>(s.begin(), s.end());
+}
+
+std::string readFile(const std::string &path)
+{
+    std::ifstream f(path, std::ios::binary);
+    std::ostringstream ss;
+    ss << f.rdbuf();
+    return ss.str();
+}
+
+class FixedRng : public crypto::IRng {
+public:
+    explicit FixedRng(std::vector<std::uint8_t> data) : m_data(std::move(data)) {}
+    std::vector<std::uint8_t> bytes(std::size_t n) override
+    {
+        std::vector<std::uint8_t> out(n);
+        for (std::size_t i = 0; i < n; ++i) {
+            out[i] = m_data[(m_pos + i) % m_data.size()];
+        }
+        m_pos += n;
+        return out;
+    }
+private:
+    std::vector<std::uint8_t> m_data;
+    std::size_t m_pos = 0;
+};
+}
+
+int main()
+{
+    CHECK_EQ(util::base64Encode(std::string("")), std::string(""));
+    CHECK_EQ(util::base64Encode(std::string("f")), std::string("Zg=="));
+    CHECK_EQ(util::base64Encode(std::string("fo")), std::string("Zm8="));
+    CHECK_EQ(util::base64Encode(std::string("foo")), std::string("Zm9v"));
+    CHECK_EQ(util::base64Encode(std::string("foob")), std::string("Zm9vYg=="));
+    CHECK_EQ(util::base64Encode(std::string("fooba")), std::string("Zm9vYmE="));
+    CHECK_EQ(util::base64Encode(std::string("foobar")), std::string("Zm9vYmFy"));
+
+    {
+        std::vector<std::uint8_t> v{0xfb, 0xff, 0xbf};
+        CHECK_EQ(util::base64UrlEncodeNoPad(v), std::string("-_-_"));
+        CHECK_EQ(util::base64Encode(v), std::string("+/+/"));
+    }
+
+    {
+        auto v = bytesOf("any carnal pleasure.");
+        CHECK(util::base64Decode(util::base64Encode(v)) == v);
+        CHECK(util::base64Decode(util::base64UrlEncodeNoPad(v)) == v);
+    }
+
+    CHECK_EQ(crypto::toHex(crypto::sha512(bytesOf("abc"))),
+             std::string("ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a"
+                          "2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f"));
+
+    {
+        std::vector<std::uint8_t> v{0x00, 0x01, 0xab, 0xff};
+        CHECK_EQ(crypto::toHex(v), std::string("0001abff"));
+        CHECK(crypto::fromHex("0001abff") == v);
+    }
+
+    {
+        auto key = crypto::fromHex("000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f");
+        auto iv = crypto::fromHex("101112131415161718191a1b1c1d1e1f");
+        auto pt = bytesOf("{\"hello\":\"world\"}");
+        auto ct = crypto::aesEncryptCbc(pt, key, iv);
+        CHECK_EQ(util::base64Encode(ct), std::string("2WHnAcP2N+l+jz7fbKyO46jjYUq7h98lxlTIT6K0Xg8="));
+
+        CHECK(crypto::aesDecryptCbc(ct, key, iv) == pt);
+    }
+
+    {
+        auto key = crypto::fromHex("000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f");
+        auto iv16 = crypto::fromHex("101112131415161718191a1b1c1d1e1f");
+        auto iv32 = crypto::fromHex("101112131415161718191a1b1c1d1e1fdeadbeefdeadbeefdeadbeefdeadbeef");
+        auto pt = bytesOf("{\"hello\":\"world\"}");
+        CHECK(crypto::aesEncryptCbc(pt, key, iv16) == crypto::aesEncryptCbc(pt, key, iv32));
+    }
+
+    {
+        std::string pub = readFile(std::string(AGW_FIXTURES_DIR) + "/test_rsa_pub.pem");
+        std::string priv = readFile(std::string(AGW_FIXTURES_DIR) + "/test_rsa_priv.pem");
+        CHECK(!pub.empty());
+        CHECK(!priv.empty());
+        auto msg = bytesOf("{\"aes_key\":\"...\",\"aes_iv\":\"...\",\"aes_salt\":\"...\"}");
+        auto ct = crypto::rsaEncryptPublicPkcs1(msg, pub);
+        auto rt = crypto::rsaDecryptPrivatePkcs1(ct, priv);
+        CHECK(rt == msg);
+
+        auto ct2 = crypto::rsaEncryptPublicPkcs1(msg, pub);
+        CHECK(ct != ct2);
+    }
+
+    {
+        FixedRng rng(std::vector<std::uint8_t>(16, 0xFF));
+        std::string u = util::makeUuidV4(rng);
+        CHECK_EQ(u, std::string("ffffffff-ffff-4fff-bfff-ffffffffffff"));
+        CHECK(u.size() == 36);
+        CHECK(u[14] == '4');
+        CHECK(u[19] == '8' || u[19] == '9' || u[19] == 'a' || u[19] == 'b');
+    }
+
+    return AGW_TEST_MAIN_RETURN();
+}

agw-sdk/tests/unit/test_error_mapping.cpp

@@ -0,0 +1,54 @@
+#include "agw_test.h"
+
+#include <string>
+
+#include "protocol/error_mapping.h"
+
+using namespace agw;
+using agw::protocol::mapResponseError;
+
+namespace {
+int code(ErrorCode e) { return static_cast<int>(e); }
+
+ErrorCode mapBody(const std::string &body)
+{
+    return mapResponseError(false, TransportError::None, body);
+}
+}
+
+int main()
+{
+    CHECK(mapResponseError(true, TransportError::None, "") == ErrorCode::ApiConfigSslError);
+    CHECK(mapResponseError(false, TransportError::Timeout, "") == ErrorCode::ApiConfigTimeoutError);
+    CHECK(mapResponseError(false, TransportError::Canceled, "") == ErrorCode::ApiConfigTimeoutError);
+    CHECK(mapResponseError(false, TransportError::OperationNotImplemented, "") == ErrorCode::ApiUpdateRequestError);
+    CHECK(mapResponseError(false, TransportError::ConnectionError, "") == ErrorCode::ApiConfigDownloadError);
+    CHECK(mapResponseError(false, TransportError::None, "") == ErrorCode::NoError);
+
+    CHECK(mapBody("not a json") == ErrorCode::NoError);
+
+    CHECK(mapBody(R"({"http_status":429})") == ErrorCode::ApiRateLimitError);
+    CHECK(mapBody(R"({"http_status":409})") == ErrorCode::ApiConfigLimitError);
+    CHECK(mapBody(R"({"http_status":409,"message":"Trial Subscription Already Used"})") == ErrorCode::ApiTrialAlreadyUsedError);
+    CHECK(mapBody(R"({"http_status":404})") == ErrorCode::ApiNotFoundError);
+    CHECK(mapBody(R"({"http_status":408})") == ErrorCode::ApiConfigTimeoutError);
+    CHECK(mapBody(R"({"http_status":501})") == ErrorCode::ApiUpdateRequestError);
+
+    CHECK(mapBody(R"({"http_status":422,"message":"Failed to retrieve subscription information. Is it activated?"})")
+          == ErrorCode::ApiSubscriptionExpiredError);
+    CHECK(mapBody(R"({"http_status":422,"message":"something else"})") == ErrorCode::ApiConfigDownloadError);
+
+    CHECK(mapBody(R"({"http_status":402,"message":"refresh_captcha"})") == ErrorCode::ApiCaptchaRefreshError);
+    CHECK(mapBody(R"({"http_status":402,"message":"invalid_captcha"})") == ErrorCode::ApiCaptchaInvalidError);
+    CHECK(mapBody(R"({"http_status":402,"captcha_id":"x"})") == ErrorCode::ApiCaptchaRequiredError);
+    CHECK(mapBody(R"({"http_status":402,"captcha_image":"x"})") == ErrorCode::ApiCaptchaRequiredError);
+    CHECK(mapBody(R"({"http_status":402,"message":"rate_limit_exceeded"})") == ErrorCode::ApiCaptchaRequiredError);
+    CHECK(mapBody(R"({"http_status":402,"message":"nope"})") == ErrorCode::ApiSubscriptionNotActiveError);
+
+    CHECK(mapBody(R"({"http_status":500})") == ErrorCode::ApiConfigDownloadError);
+
+    CHECK(mapBody(R"({"http_status":200})") == ErrorCode::NoError);
+
+    (void)code;
+    return AGW_TEST_MAIN_RETURN();
+}

agw-sdk/tests/unit/test_json.cpp

@@ -0,0 +1,61 @@
+#include "agw_test.h"
+
+#include <string>
+
+#include "util/json.h"
+
+using namespace agw;
+
+int main()
+{
+    {
+        util::Json j;
+        j["aes_key"] = "KEY";
+        j["aes_iv"] = "IV";
+        j["aes_salt"] = "SALT";
+
+        const std::string expected =
+            "{\n"
+            "    \"aes_iv\": \"IV\",\n"
+            "    \"aes_key\": \"KEY\",\n"
+            "    \"aes_salt\": \"SALT\"\n"
+            "}\n";
+        CHECK_EQ(util::qtIndentedDump(j), expected);
+    }
+
+    {
+        util::Json j;
+        j["key_payload"] = "K";
+        j["api_payload"] = "A";
+        const std::string expected =
+            "{\n"
+            "    \"api_payload\": \"A\",\n"
+            "    \"key_payload\": \"K\"\n"
+            "}\n";
+        CHECK_EQ(util::qtIndentedDump(j), expected);
+    }
+
+    {
+        util::Json j;
+        j["s"] = std::string("a\"b\\c\nd\te\x01");
+        const std::string expected =
+            "{\n"
+            "    \"s\": \"a\\\"b\\\\c\\nd\\te\\u0001\"\n"
+            "}\n";
+        CHECK_EQ(util::qtIndentedDump(j), expected);
+    }
+
+    {
+        util::Json j;
+        j["outer"]["inner"] = "v";
+        const std::string expected =
+            "{\n"
+            "    \"outer\": {\n"
+            "        \"inner\": \"v\"\n"
+            "    }\n"
+            "}\n";
+        CHECK_EQ(util::qtIndentedDump(j), expected);
+    }
+
+    return AGW_TEST_MAIN_RETURN();
+}

agw-sdk/tests/unit/test_proxy_list.cpp

@@ -0,0 +1,87 @@
+#include "agw_test.h"
+
+#include <string>
+#include <vector>
+
+#include "crypto/aes.h"
+#include "crypto/hash.h"
+#include "failover/proxy_list.h"
+#include "util/base64.h"
+
+using namespace agw;
+
+namespace {
+std::vector<std::uint8_t> bytesOf(const std::string &s)
+{
+    return std::vector<std::uint8_t>(s.begin(), s.end());
+}
+}
+
+int main()
+{
+    {
+        const std::vector<std::string> primary{"https://a/", "https://b/"};
+        const std::vector<std::string> fallback{"https://f/"};
+        const FailoverContext ctx{"prem", "US"};
+
+        const std::string enc =
+            util::base64UrlEncodeNoPad(bytesOf("endpoints-prem-US"));
+
+        const auto urls = failover::buildStorageUrls(primary, fallback, ctx);
+        const std::vector<std::string> expected{
+            "https://a/" + enc + ".json",
+            "https://b/" + enc + ".json",
+            "https://a/endpoints.json",
+            "https://b/endpoints.json",
+            "https://f/" + enc + ".json",
+            "https://f/endpoints.json",
+        };
+        CHECK(urls == expected);
+    }
+
+    {
+        const std::vector<std::string> primary{"https://a/", "https://b/"};
+        const std::vector<std::string> fallback{"https://f/"};
+        const FailoverContext ctx{"", ""};
+        const auto urls = failover::buildStorageUrls(primary, fallback, ctx);
+        const std::vector<std::string> expected{
+            "https://a/endpoints.json",
+            "https://b/endpoints.json",
+            "https://f/endpoints.json",
+        };
+        CHECK(urls == expected);
+    }
+
+    {
+        const auto list = failover::decodeProxyList(R"(["https://p1/","https://p2/"])", true, "");
+        const std::vector<std::string> expected{"https://p1/", "https://p2/"};
+        CHECK(list == expected);
+
+        CHECK(failover::decodeProxyList(R"({"x":1})", true, "").empty());
+    }
+
+    {
+        const std::string pub = "PUBKEYDATA-pem-like";
+        const std::string h = crypto::toHex(crypto::sha512(bytesOf(pub)));
+        const auto key = crypto::fromHex(h.substr(0, 64));
+        const auto iv = crypto::fromHex(h.substr(64, 32));
+
+        const std::string arr = R"(["https://prod1/","https://prod2/"])";
+        const auto cipher = crypto::aesEncryptCbc(bytesOf(arr), key, iv);
+        const std::string b64 = util::base64Encode(cipher);
+
+        const auto list = failover::decodeProxyList(b64, false, pub);
+        const std::vector<std::string> expected{"https://prod1/", "https://prod2/"};
+        CHECK(list == expected);
+
+        bool threw = false;
+        try {
+            failover::decodeProxyList("###not base64 cipher###", false, pub);
+        } catch (...) {
+            threw = true;
+        }
+        CHECK(threw);
+    }
+
+    return AGW_TEST_MAIN_RETURN();
+}

agw-sdk/tests/unit/test_thread_pool.cpp

@@ -0,0 +1,33 @@
+#include "agw_test.h"
+
+#include <atomic>
+#include <memory>
+
+#include "util/thread_pool.h"
+
+using namespace agw;
+
+int main()
+{
+    {
+        std::atomic<int> counter{0};
+        {
+            util::ThreadPool pool(4);
+            for (int i = 0; i < 1000; ++i) {
+                pool.submit([&counter] { counter.fetch_add(1, std::memory_order_relaxed); });
+            }
+        }
+        CHECK(counter.load() == 1000);
+    }
+
+    {
+        std::atomic<bool> ran{false};
+        {
+            util::ThreadPool pool(0);
+            pool.submit([&ran] { ran.store(true); });
+        }
+        CHECK(ran.load());
+    }
+
+    return AGW_TEST_MAIN_RETURN();
+}

client/3rd/OpenSSL/include/openssl/__DECC_INCLUDE_EPILOGUE.H

@@ -1,22 +0,0 @@
-/*
- * Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the OpenSSL license (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-/*
- * This file is only used by HP C/C++ on VMS, and is included automatically
- * after each header file from this directory
- */
-
-/*
- * The C++ compiler doesn't understand these pragmas, even though it
- * understands the corresponding command line qualifier.
- */
-#ifndef __cplusplus
-/* restore state.  Must correspond to the save in __decc_include_prologue.h */
-# pragma names restore
-#endif

client/3rd/OpenSSL/include/openssl/__DECC_INCLUDE_PROLOGUE.H

@@ -1,26 +0,0 @@
-/*
- * Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the OpenSSL license (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-/*
- * This file is only used by HP C/C++ on VMS, and is included automatically
- * after each header file from this directory
- */
-
-/*
- * The C++ compiler doesn't understand these pragmas, even though it
- * understands the corresponding command line qualifier.
- */
-#ifndef __cplusplus
-/* save state */
-# pragma names save
-/* have the compiler shorten symbols larger than 31 chars to 23 chars
- * followed by a 8 hex char CRC
- */
-# pragma names as_is,shortened
-#endif

client/3rd/OpenSSL/include/openssl/aes.h

@@ -1,92 +0,0 @@
-/*
- * Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the OpenSSL license (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-#ifndef HEADER_AES_H
-# define HEADER_AES_H
-
-# include <openssl/opensslconf.h>
-
-# include <stddef.h>
-# ifdef  __cplusplus
-extern "C" {
-# endif
-
-# define AES_ENCRYPT     1
-# define AES_DECRYPT     0
-
-/*
- * Because array size can't be a const in C, the following two are macros.
- * Both sizes are in bytes.
- */
-# define AES_MAXNR 14
-# define AES_BLOCK_SIZE 16
-
-/* This should be a hidden type, but EVP requires that the size be known */
-struct aes_key_st {
-# ifdef AES_LONG
-    unsigned long rd_key[4 * (AES_MAXNR + 1)];
-# else
-    unsigned int rd_key[4 * (AES_MAXNR + 1)];
-# endif
-    int rounds;
-};
-typedef struct aes_key_st AES_KEY;
-
-const char *AES_options(void);
-
-int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
-                        AES_KEY *key);
-int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
-                        AES_KEY *key);
-
-void AES_encrypt(const unsigned char *in, unsigned char *out,
-                 const AES_KEY *key);
-void AES_decrypt(const unsigned char *in, unsigned char *out,
-                 const AES_KEY *key);
-
-void AES_ecb_encrypt(const unsigned char *in, unsigned char *out,
-                     const AES_KEY *key, const int enc);
-void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
-                     size_t length, const AES_KEY *key,
-                     unsigned char *ivec, const int enc);
-void AES_cfb128_encrypt(const unsigned char *in, unsigned char *out,
-                        size_t length, const AES_KEY *key,
-                        unsigned char *ivec, int *num, const int enc);
-void AES_cfb1_encrypt(const unsigned char *in, unsigned char *out,
-                      size_t length, const AES_KEY *key,
-                      unsigned char *ivec, int *num, const int enc);
-void AES_cfb8_encrypt(const unsigned char *in, unsigned char *out,
-                      size_t length, const AES_KEY *key,
-                      unsigned char *ivec, int *num, const int enc);
-void AES_ofb128_encrypt(const unsigned char *in, unsigned char *out,
-                        size_t length, const AES_KEY *key,
-                        unsigned char *ivec, int *num);
-/* NB: the IV is _two_ blocks long */
-void AES_ige_encrypt(const unsigned char *in, unsigned char *out,
-                     size_t length, const AES_KEY *key,
-                     unsigned char *ivec, const int enc);
-/* NB: the IV is _four_ blocks long */
-void AES_bi_ige_encrypt(const unsigned char *in, unsigned char *out,
-                        size_t length, const AES_KEY *key,
-                        const AES_KEY *key2, const unsigned char *ivec,
-                        const int enc);
-
-int AES_wrap_key(AES_KEY *key, const unsigned char *iv,
-                 unsigned char *out,
-                 const unsigned char *in, unsigned int inlen);
-int AES_unwrap_key(AES_KEY *key, const unsigned char *iv,
-                   unsigned char *out,
-                   const unsigned char *in, unsigned int inlen);
-
-
-# ifdef  __cplusplus
-}
-# endif
-
-#endif

client/3rd/OpenSSL/include/openssl/applink.c

@@ -1,138 +0,0 @@
-  /*
- * Copyright 2004-2016 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the OpenSSL license (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-#define APPLINK_STDIN   1
-#define APPLINK_STDOUT  2
-#define APPLINK_STDERR  3
-#define APPLINK_FPRINTF 4
-#define APPLINK_FGETS   5
-#define APPLINK_FREAD   6
-#define APPLINK_FWRITE  7
-#define APPLINK_FSETMOD 8
-#define APPLINK_FEOF    9
-#define APPLINK_FCLOSE  10      /* should not be used */
-
-#define APPLINK_FOPEN   11      /* solely for completeness */
-#define APPLINK_FSEEK   12
-#define APPLINK_FTELL   13
-#define APPLINK_FFLUSH  14
-#define APPLINK_FERROR  15
-#define APPLINK_CLEARERR 16
-#define APPLINK_FILENO  17      /* to be used with below */
-
-#define APPLINK_OPEN    18      /* formally can't be used, as flags can vary */
-#define APPLINK_READ    19
-#define APPLINK_WRITE   20
-#define APPLINK_LSEEK   21
-#define APPLINK_CLOSE   22
-#define APPLINK_MAX     22      /* always same as last macro */
-
-#ifndef APPMACROS_ONLY
-# include <stdio.h>
-# include <io.h>
-# include <fcntl.h>
-
-static void *app_stdin(void)
-{
-    return stdin;
-}
-
-static void *app_stdout(void)
-{
-    return stdout;
-}
-
-static void *app_stderr(void)
-{
-    return stderr;
-}
-
-static int app_feof(FILE *fp)
-{
-    return feof(fp);
-}
-
-static int app_ferror(FILE *fp)
-{
-    return ferror(fp);
-}
-
-static void app_clearerr(FILE *fp)
-{
-    clearerr(fp);
-}
-
-static int app_fileno(FILE *fp)
-{
-    return _fileno(fp);
-}
-
-static int app_fsetmod(FILE *fp, char mod)
-{
-    return _setmode(_fileno(fp), mod == 'b' ? _O_BINARY : _O_TEXT);
-}
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-__declspec(dllexport)
-void **
-# if defined(__BORLANDC__)
-/*
- * __stdcall appears to be the only way to get the name
- * decoration right with Borland C. Otherwise it works
- * purely incidentally, as we pass no parameters.
- */
-__stdcall
-# else
-__cdecl
-# endif
-OPENSSL_Applink(void)
-{
-    static int once = 1;
-    static void *OPENSSL_ApplinkTable[APPLINK_MAX + 1] =
-        { (void *)APPLINK_MAX };
-
-    if (once) {
-        OPENSSL_ApplinkTable[APPLINK_STDIN] = app_stdin;
-        OPENSSL_ApplinkTable[APPLINK_STDOUT] = app_stdout;
-        OPENSSL_ApplinkTable[APPLINK_STDERR] = app_stderr;
-        OPENSSL_ApplinkTable[APPLINK_FPRINTF] = fprintf;
-        OPENSSL_ApplinkTable[APPLINK_FGETS] = fgets;
-        OPENSSL_ApplinkTable[APPLINK_FREAD] = fread;
-        OPENSSL_ApplinkTable[APPLINK_FWRITE] = fwrite;
-        OPENSSL_ApplinkTable[APPLINK_FSETMOD] = app_fsetmod;
-        OPENSSL_ApplinkTable[APPLINK_FEOF] = app_feof;
-        OPENSSL_ApplinkTable[APPLINK_FCLOSE] = fclose;
-
-        OPENSSL_ApplinkTable[APPLINK_FOPEN] = fopen;
-        OPENSSL_ApplinkTable[APPLINK_FSEEK] = fseek;
-        OPENSSL_ApplinkTable[APPLINK_FTELL] = ftell;
-        OPENSSL_ApplinkTable[APPLINK_FFLUSH] = fflush;
-        OPENSSL_ApplinkTable[APPLINK_FERROR] = app_ferror;
-        OPENSSL_ApplinkTable[APPLINK_CLEARERR] = app_clearerr;
-        OPENSSL_ApplinkTable[APPLINK_FILENO] = app_fileno;
-
-        OPENSSL_ApplinkTable[APPLINK_OPEN] = _open;
-        OPENSSL_ApplinkTable[APPLINK_READ] = _read;
-        OPENSSL_ApplinkTable[APPLINK_WRITE] = _write;
-        OPENSSL_ApplinkTable[APPLINK_LSEEK] = _lseek;
-        OPENSSL_ApplinkTable[APPLINK_CLOSE] = _close;
-
-        once = 0;
-    }
-
-    return OPENSSL_ApplinkTable;
-}
-
-#ifdef __cplusplus
-}
-#endif
-#endif

client/3rd/OpenSSL/include/openssl/asn1.h

@@ -1,886 +0,0 @@
-/*
- * Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the OpenSSL license (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-#ifndef HEADER_ASN1_H
-# define HEADER_ASN1_H
-
-# include <time.h>
-# include <openssl/e_os2.h>
-# include <openssl/opensslconf.h>
-# include <openssl/bio.h>
-# include <openssl/safestack.h>
-# include <openssl/asn1err.h>
-# include <openssl/symhacks.h>
-
-# include <openssl/ossl_typ.h>
-# if OPENSSL_API_COMPAT < 0x10100000L
-#  include <openssl/bn.h>
-# endif
-
-# ifdef OPENSSL_BUILD_SHLIBCRYPTO
-#  undef OPENSSL_EXTERN
-#  define OPENSSL_EXTERN OPENSSL_EXPORT
-# endif
-
-#ifdef  __cplusplus
-extern "C" {
-#endif
-
-# define V_ASN1_UNIVERSAL                0x00
-# define V_ASN1_APPLICATION              0x40
-# define V_ASN1_CONTEXT_SPECIFIC         0x80
-# define V_ASN1_PRIVATE                  0xc0
-
-# define V_ASN1_CONSTRUCTED              0x20
-# define V_ASN1_PRIMITIVE_TAG            0x1f
-# define V_ASN1_PRIMATIVE_TAG /*compat*/ V_ASN1_PRIMITIVE_TAG
-
-# define V_ASN1_APP_CHOOSE               -2/* let the recipient choose */
-# define V_ASN1_OTHER                    -3/* used in ASN1_TYPE */
-# define V_ASN1_ANY                      -4/* used in ASN1 template code */
-
-# define V_ASN1_UNDEF                    -1
-/* ASN.1 tag values */
-# define V_ASN1_EOC                      0
-# define V_ASN1_BOOLEAN                  1 /**/
-# define V_ASN1_INTEGER                  2
-# define V_ASN1_BIT_STRING               3
-# define V_ASN1_OCTET_STRING             4
-# define V_ASN1_NULL                     5
-# define V_ASN1_OBJECT                   6
-# define V_ASN1_OBJECT_DESCRIPTOR        7
-# define V_ASN1_EXTERNAL                 8
-# define V_ASN1_REAL                     9
-# define V_ASN1_ENUMERATED               10
-# define V_ASN1_UTF8STRING               12
-# define V_ASN1_SEQUENCE                 16
-# define V_ASN1_SET                      17
-# define V_ASN1_NUMERICSTRING            18 /**/
-# define V_ASN1_PRINTABLESTRING          19
-# define V_ASN1_T61STRING                20
-# define V_ASN1_TELETEXSTRING            20/* alias */
-# define V_ASN1_VIDEOTEXSTRING           21 /**/
-# define V_ASN1_IA5STRING                22
-# define V_ASN1_UTCTIME                  23
-# define V_ASN1_GENERALIZEDTIME          24 /**/
-# define V_ASN1_GRAPHICSTRING            25 /**/
-# define V_ASN1_ISO64STRING              26 /**/
-# define V_ASN1_VISIBLESTRING            26/* alias */
-# define V_ASN1_GENERALSTRING            27 /**/
-# define V_ASN1_UNIVERSALSTRING          28 /**/
-# define V_ASN1_BMPSTRING                30
-
-/*
- * NB the constants below are used internally by ASN1_INTEGER
- * and ASN1_ENUMERATED to indicate the sign. They are *not* on
- * the wire tag values.
- */
-
-# define V_ASN1_NEG                      0x100
-# define V_ASN1_NEG_INTEGER              (2 | V_ASN1_NEG)
-# define V_ASN1_NEG_ENUMERATED           (10 | V_ASN1_NEG)
-
-/* For use with d2i_ASN1_type_bytes() */
-# define B_ASN1_NUMERICSTRING    0x0001
-# define B_ASN1_PRINTABLESTRING  0x0002
-# define B_ASN1_T61STRING        0x0004
-# define B_ASN1_TELETEXSTRING    0x0004
-# define B_ASN1_VIDEOTEXSTRING   0x0008
-# define B_ASN1_IA5STRING        0x0010
-# define B_ASN1_GRAPHICSTRING    0x0020
-# define B_ASN1_ISO64STRING      0x0040
-# define B_ASN1_VISIBLESTRING    0x0040
-# define B_ASN1_GENERALSTRING    0x0080
-# define B_ASN1_UNIVERSALSTRING  0x0100
-# define B_ASN1_OCTET_STRING     0x0200
-# define B_ASN1_BIT_STRING       0x0400
-# define B_ASN1_BMPSTRING        0x0800
-# define B_ASN1_UNKNOWN          0x1000
-# define B_ASN1_UTF8STRING       0x2000
-# define B_ASN1_UTCTIME          0x4000
-# define B_ASN1_GENERALIZEDTIME  0x8000
-# define B_ASN1_SEQUENCE         0x10000
-/* For use with ASN1_mbstring_copy() */
-# define MBSTRING_FLAG           0x1000
-# define MBSTRING_UTF8           (MBSTRING_FLAG)
-# define MBSTRING_ASC            (MBSTRING_FLAG|1)
-# define MBSTRING_BMP            (MBSTRING_FLAG|2)
-# define MBSTRING_UNIV           (MBSTRING_FLAG|4)
-# define SMIME_OLDMIME           0x400
-# define SMIME_CRLFEOL           0x800
-# define SMIME_STREAM            0x1000
-    struct X509_algor_st;
-DEFINE_STACK_OF(X509_ALGOR)
-
-# define ASN1_STRING_FLAG_BITS_LEFT 0x08/* Set if 0x07 has bits left value */
-/*
- * This indicates that the ASN1_STRING is not a real value but just a place
- * holder for the location where indefinite length constructed data should be
- * inserted in the memory buffer
- */
-# define ASN1_STRING_FLAG_NDEF 0x010
-
-/*
- * This flag is used by the CMS code to indicate that a string is not
- * complete and is a place holder for content when it had all been accessed.
- * The flag will be reset when content has been written to it.
- */
-
-# define ASN1_STRING_FLAG_CONT 0x020
-/*
- * This flag is used by ASN1 code to indicate an ASN1_STRING is an MSTRING
- * type.
- */
-# define ASN1_STRING_FLAG_MSTRING 0x040
-/* String is embedded and only content should be freed */
-# define ASN1_STRING_FLAG_EMBED 0x080
-/* String should be parsed in RFC 5280's time format */
-# define ASN1_STRING_FLAG_X509_TIME 0x100
-/* This is the base type that holds just about everything :-) */
-struct asn1_string_st {
-    int length;
-    int type;
-    unsigned char *data;
-    /*
-     * The value of the following field depends on the type being held.  It
-     * is mostly being used for BIT_STRING so if the input data has a
-     * non-zero 'unused bits' value, it will be handled correctly
-     */
-    long flags;
-};
-
-/*
- * ASN1_ENCODING structure: this is used to save the received encoding of an
- * ASN1 type. This is useful to get round problems with invalid encodings
- * which can break signatures.
- */
-
-typedef struct ASN1_ENCODING_st {
-    unsigned char *enc;         /* DER encoding */
-    long len;                   /* Length of encoding */
-    int modified;               /* set to 1 if 'enc' is invalid */
-} ASN1_ENCODING;
-
-/* Used with ASN1 LONG type: if a long is set to this it is omitted */
-# define ASN1_LONG_UNDEF 0x7fffffffL
-
-# define STABLE_FLAGS_MALLOC     0x01
-/*
- * A zero passed to ASN1_STRING_TABLE_new_add for the flags is interpreted
- * as "don't change" and STABLE_FLAGS_MALLOC is always set. By setting
- * STABLE_FLAGS_MALLOC only we can clear the existing value. Use the alias
- * STABLE_FLAGS_CLEAR to reflect this.
- */
-# define STABLE_FLAGS_CLEAR      STABLE_FLAGS_MALLOC
-# define STABLE_NO_MASK          0x02
-# define DIRSTRING_TYPE  \
- (B_ASN1_PRINTABLESTRING|B_ASN1_T61STRING|B_ASN1_BMPSTRING|B_ASN1_UTF8STRING)
-# define PKCS9STRING_TYPE (DIRSTRING_TYPE|B_ASN1_IA5STRING)
-
-typedef struct asn1_string_table_st {
-    int nid;
-    long minsize;
-    long maxsize;
-    unsigned long mask;
-    unsigned long flags;
-} ASN1_STRING_TABLE;
-
-DEFINE_STACK_OF(ASN1_STRING_TABLE)
-
-/* size limits: this stuff is taken straight from RFC2459 */
-
-# define ub_name                         32768
-# define ub_common_name                  64
-# define ub_locality_name                128
-# define ub_state_name                   128
-# define ub_organization_name            64
-# define ub_organization_unit_name       64
-# define ub_title                        64
-# define ub_email_address                128
-
-/*
- * Declarations for template structures: for full definitions see asn1t.h
- */
-typedef struct ASN1_TEMPLATE_st ASN1_TEMPLATE;
-typedef struct ASN1_TLC_st ASN1_TLC;
-/* This is just an opaque pointer */
-typedef struct ASN1_VALUE_st ASN1_VALUE;
-
-/* Declare ASN1 functions: the implement macro in in asn1t.h */
-
-# define DECLARE_ASN1_FUNCTIONS(type) DECLARE_ASN1_FUNCTIONS_name(type, type)
-
-# define DECLARE_ASN1_ALLOC_FUNCTIONS(type) \
-        DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, type)
-
-# define DECLARE_ASN1_FUNCTIONS_name(type, name) \
-        DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, name) \
-        DECLARE_ASN1_ENCODE_FUNCTIONS(type, name, name)
-
-# define DECLARE_ASN1_FUNCTIONS_fname(type, itname, name) \
-        DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, name) \
-        DECLARE_ASN1_ENCODE_FUNCTIONS(type, itname, name)
-
-# define DECLARE_ASN1_ENCODE_FUNCTIONS(type, itname, name) \
-        type *d2i_##name(type **a, const unsigned char **in, long len); \
-        int i2d_##name(type *a, unsigned char **out); \
-        DECLARE_ASN1_ITEM(itname)
-
-# define DECLARE_ASN1_ENCODE_FUNCTIONS_const(type, name) \
-        type *d2i_##name(type **a, const unsigned char **in, long len); \
-        int i2d_##name(const type *a, unsigned char **out); \
-        DECLARE_ASN1_ITEM(name)
-
-# define DECLARE_ASN1_NDEF_FUNCTION(name) \
-        int i2d_##name##_NDEF(name *a, unsigned char **out);
-
-# define DECLARE_ASN1_FUNCTIONS_const(name) \
-        DECLARE_ASN1_ALLOC_FUNCTIONS(name) \
-        DECLARE_ASN1_ENCODE_FUNCTIONS_const(name, name)
-
-# define DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, name) \
-        type *name##_new(void); \
-        void name##_free(type *a);
-
-# define DECLARE_ASN1_PRINT_FUNCTION(stname) \
-        DECLARE_ASN1_PRINT_FUNCTION_fname(stname, stname)
-
-# define DECLARE_ASN1_PRINT_FUNCTION_fname(stname, fname) \
-        int fname##_print_ctx(BIO *out, stname *x, int indent, \
-                                         const ASN1_PCTX *pctx);
-
-# define D2I_OF(type) type *(*)(type **,const unsigned char **,long)
-# define I2D_OF(type) int (*)(type *,unsigned char **)
-# define I2D_OF_const(type) int (*)(const type *,unsigned char **)
-
-# define CHECKED_D2I_OF(type, d2i) \
-    ((d2i_of_void*) (1 ? d2i : ((D2I_OF(type))0)))
-# define CHECKED_I2D_OF(type, i2d) \
-    ((i2d_of_void*) (1 ? i2d : ((I2D_OF(type))0)))
-# define CHECKED_NEW_OF(type, xnew) \
-    ((void *(*)(void)) (1 ? xnew : ((type *(*)(void))0)))
-# define CHECKED_PTR_OF(type, p) \
-    ((void*) (1 ? p : (type*)0))
-# define CHECKED_PPTR_OF(type, p) \
-    ((void**) (1 ? p : (type**)0))
-
-# define TYPEDEF_D2I_OF(type) typedef type *d2i_of_##type(type **,const unsigned char **,long)
-# define TYPEDEF_I2D_OF(type) typedef int i2d_of_##type(type *,unsigned char **)
-# define TYPEDEF_D2I2D_OF(type) TYPEDEF_D2I_OF(type); TYPEDEF_I2D_OF(type)
-
-TYPEDEF_D2I2D_OF(void);
-
-/*-
- * The following macros and typedefs allow an ASN1_ITEM
- * to be embedded in a structure and referenced. Since
- * the ASN1_ITEM pointers need to be globally accessible
- * (possibly from shared libraries) they may exist in
- * different forms. On platforms that support it the
- * ASN1_ITEM structure itself will be globally exported.
- * Other platforms will export a function that returns
- * an ASN1_ITEM pointer.
- *
- * To handle both cases transparently the macros below
- * should be used instead of hard coding an ASN1_ITEM
- * pointer in a structure.
- *
- * The structure will look like this:
- *
- * typedef struct SOMETHING_st {
- *      ...
- *      ASN1_ITEM_EXP *iptr;
- *      ...
- * } SOMETHING;
- *
- * It would be initialised as e.g.:
- *
- * SOMETHING somevar = {...,ASN1_ITEM_ref(X509),...};
- *
- * and the actual pointer extracted with:
- *
- * const ASN1_ITEM *it = ASN1_ITEM_ptr(somevar.iptr);
- *
- * Finally an ASN1_ITEM pointer can be extracted from an
- * appropriate reference with: ASN1_ITEM_rptr(X509). This
- * would be used when a function takes an ASN1_ITEM * argument.
- *
- */
-
-# ifndef OPENSSL_EXPORT_VAR_AS_FUNCTION
-
-/* ASN1_ITEM pointer exported type */
-typedef const ASN1_ITEM ASN1_ITEM_EXP;
-
-/* Macro to obtain ASN1_ITEM pointer from exported type */
-#  define ASN1_ITEM_ptr(iptr) (iptr)
-
-/* Macro to include ASN1_ITEM pointer from base type */
-#  define ASN1_ITEM_ref(iptr) (&(iptr##_it))
-
-#  define ASN1_ITEM_rptr(ref) (&(ref##_it))
-
-#  define DECLARE_ASN1_ITEM(name) \
-        OPENSSL_EXTERN const ASN1_ITEM name##_it;
-
-# else
-
-/*
- * Platforms that can't easily handle shared global variables are declared as
- * functions returning ASN1_ITEM pointers.
- */
-
-/* ASN1_ITEM pointer exported type */
-typedef const ASN1_ITEM *ASN1_ITEM_EXP (void);
-
-/* Macro to obtain ASN1_ITEM pointer from exported type */
-#  define ASN1_ITEM_ptr(iptr) (iptr())
-
-/* Macro to include ASN1_ITEM pointer from base type */
-#  define ASN1_ITEM_ref(iptr) (iptr##_it)
-
-#  define ASN1_ITEM_rptr(ref) (ref##_it())
-
-#  define DECLARE_ASN1_ITEM(name) \
-        const ASN1_ITEM * name##_it(void);
-
-# endif
-
-/* Parameters used by ASN1_STRING_print_ex() */
-
-/*
- * These determine which characters to escape: RFC2253 special characters,
- * control characters and MSB set characters
- */
-
-# define ASN1_STRFLGS_ESC_2253           1
-# define ASN1_STRFLGS_ESC_CTRL           2
-# define ASN1_STRFLGS_ESC_MSB            4
-
-/*
- * This flag determines how we do escaping: normally RC2253 backslash only,
- * set this to use backslash and quote.
- */
-
-# define ASN1_STRFLGS_ESC_QUOTE          8
-
-/* These three flags are internal use only. */
-
-/* Character is a valid PrintableString character */
-# define CHARTYPE_PRINTABLESTRING        0x10
-/* Character needs escaping if it is the first character */
-# define CHARTYPE_FIRST_ESC_2253         0x20
-/* Character needs escaping if it is the last character */
-# define CHARTYPE_LAST_ESC_2253          0x40
-
-/*
- * NB the internal flags are safely reused below by flags handled at the top
- * level.
- */
-
-/*
- * If this is set we convert all character strings to UTF8 first
- */
-
-# define ASN1_STRFLGS_UTF8_CONVERT       0x10
-
-/*
- * If this is set we don't attempt to interpret content: just assume all
- * strings are 1 byte per character. This will produce some pretty odd
- * looking output!
- */
-
-# define ASN1_STRFLGS_IGNORE_TYPE        0x20
-
-/* If this is set we include the string type in the output */
-# define ASN1_STRFLGS_SHOW_TYPE          0x40
-
-/*
- * This determines which strings to display and which to 'dump' (hex dump of
- * content octets or DER encoding). We can only dump non character strings or
- * everything. If we don't dump 'unknown' they are interpreted as character
- * strings with 1 octet per character and are subject to the usual escaping
- * options.
- */
-
-# define ASN1_STRFLGS_DUMP_ALL           0x80
-# define ASN1_STRFLGS_DUMP_UNKNOWN       0x100
-
-/*
- * These determine what 'dumping' does, we can dump the content octets or the
- * DER encoding: both use the RFC2253 #XXXXX notation.
- */
-
-# define ASN1_STRFLGS_DUMP_DER           0x200
-
-/*
- * This flag specifies that RC2254 escaping shall be performed.
- */
-#define ASN1_STRFLGS_ESC_2254           0x400
-
-/*
- * All the string flags consistent with RFC2253, escaping control characters
- * isn't essential in RFC2253 but it is advisable anyway.
- */
-
-# define ASN1_STRFLGS_RFC2253    (ASN1_STRFLGS_ESC_2253 | \
-                                ASN1_STRFLGS_ESC_CTRL | \
-                                ASN1_STRFLGS_ESC_MSB | \
-                                ASN1_STRFLGS_UTF8_CONVERT | \
-                                ASN1_STRFLGS_DUMP_UNKNOWN | \
-                                ASN1_STRFLGS_DUMP_DER)
-
-DEFINE_STACK_OF(ASN1_INTEGER)
-
-DEFINE_STACK_OF(ASN1_GENERALSTRING)
-
-DEFINE_STACK_OF(ASN1_UTF8STRING)
-
-typedef struct asn1_type_st {
-    int type;
-    union {
-        char *ptr;
-        ASN1_BOOLEAN boolean;
-        ASN1_STRING *asn1_string;
-        ASN1_OBJECT *object;
-        ASN1_INTEGER *integer;
-        ASN1_ENUMERATED *enumerated;
-        ASN1_BIT_STRING *bit_string;
-        ASN1_OCTET_STRING *octet_string;
-        ASN1_PRINTABLESTRING *printablestring;
-        ASN1_T61STRING *t61string;
-        ASN1_IA5STRING *ia5string;
-        ASN1_GENERALSTRING *generalstring;
-        ASN1_BMPSTRING *bmpstring;
-        ASN1_UNIVERSALSTRING *universalstring;
-        ASN1_UTCTIME *utctime;
-        ASN1_GENERALIZEDTIME *generalizedtime;
-        ASN1_VISIBLESTRING *visiblestring;
-        ASN1_UTF8STRING *utf8string;
-        /*
-         * set and sequence are left complete and still contain the set or
-         * sequence bytes
-         */
-        ASN1_STRING *set;
-        ASN1_STRING *sequence;
-        ASN1_VALUE *asn1_value;
-    } value;
-} ASN1_TYPE;
-
-DEFINE_STACK_OF(ASN1_TYPE)
-
-typedef STACK_OF(ASN1_TYPE) ASN1_SEQUENCE_ANY;
-
-DECLARE_ASN1_ENCODE_FUNCTIONS_const(ASN1_SEQUENCE_ANY, ASN1_SEQUENCE_ANY)
-DECLARE_ASN1_ENCODE_FUNCTIONS_const(ASN1_SEQUENCE_ANY, ASN1_SET_ANY)
-
-/* This is used to contain a list of bit names */
-typedef struct BIT_STRING_BITNAME_st {
-    int bitnum;
-    const char *lname;
-    const char *sname;
-} BIT_STRING_BITNAME;
-
-# define B_ASN1_TIME \
-                        B_ASN1_UTCTIME | \
-                        B_ASN1_GENERALIZEDTIME
-
-# define B_ASN1_PRINTABLE \
-                        B_ASN1_NUMERICSTRING| \
-                        B_ASN1_PRINTABLESTRING| \
-                        B_ASN1_T61STRING| \
-                        B_ASN1_IA5STRING| \
-                        B_ASN1_BIT_STRING| \
-                        B_ASN1_UNIVERSALSTRING|\
-                        B_ASN1_BMPSTRING|\
-                        B_ASN1_UTF8STRING|\
-                        B_ASN1_SEQUENCE|\
-                        B_ASN1_UNKNOWN
-
-# define B_ASN1_DIRECTORYSTRING \
-                        B_ASN1_PRINTABLESTRING| \
-                        B_ASN1_TELETEXSTRING|\
-                        B_ASN1_BMPSTRING|\
-                        B_ASN1_UNIVERSALSTRING|\
-                        B_ASN1_UTF8STRING
-
-# define B_ASN1_DISPLAYTEXT \
-                        B_ASN1_IA5STRING| \
-                        B_ASN1_VISIBLESTRING| \
-                        B_ASN1_BMPSTRING|\
-                        B_ASN1_UTF8STRING
-
-DECLARE_ASN1_FUNCTIONS_fname(ASN1_TYPE, ASN1_ANY, ASN1_TYPE)
-
-int ASN1_TYPE_get(const ASN1_TYPE *a);
-void ASN1_TYPE_set(ASN1_TYPE *a, int type, void *value);
-int ASN1_TYPE_set1(ASN1_TYPE *a, int type, const void *value);
-int ASN1_TYPE_cmp(const ASN1_TYPE *a, const ASN1_TYPE *b);
-
-ASN1_TYPE *ASN1_TYPE_pack_sequence(const ASN1_ITEM *it, void *s, ASN1_TYPE **t);
-void *ASN1_TYPE_unpack_sequence(const ASN1_ITEM *it, const ASN1_TYPE *t);
-
-ASN1_OBJECT *ASN1_OBJECT_new(void);
-void ASN1_OBJECT_free(ASN1_OBJECT *a);
-int i2d_ASN1_OBJECT(const ASN1_OBJECT *a, unsigned char **pp);
-ASN1_OBJECT *d2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
-                             long length);
-
-DECLARE_ASN1_ITEM(ASN1_OBJECT)
-
-DEFINE_STACK_OF(ASN1_OBJECT)
-
-ASN1_STRING *ASN1_STRING_new(void);
-void ASN1_STRING_free(ASN1_STRING *a);
-void ASN1_STRING_clear_free(ASN1_STRING *a);
-int ASN1_STRING_copy(ASN1_STRING *dst, const ASN1_STRING *str);
-ASN1_STRING *ASN1_STRING_dup(const ASN1_STRING *a);
-ASN1_STRING *ASN1_STRING_type_new(int type);
-int ASN1_STRING_cmp(const ASN1_STRING *a, const ASN1_STRING *b);
-  /*
-   * Since this is used to store all sorts of things, via macros, for now,
-   * make its data void *
-   */
-int ASN1_STRING_set(ASN1_STRING *str, const void *data, int len);
-void ASN1_STRING_set0(ASN1_STRING *str, void *data, int len);
-int ASN1_STRING_length(const ASN1_STRING *x);
-void ASN1_STRING_length_set(ASN1_STRING *x, int n);
-int ASN1_STRING_type(const ASN1_STRING *x);
-DEPRECATEDIN_1_1_0(unsigned char *ASN1_STRING_data(ASN1_STRING *x))
-const unsigned char *ASN1_STRING_get0_data(const ASN1_STRING *x);
-
-DECLARE_ASN1_FUNCTIONS(ASN1_BIT_STRING)
-int ASN1_BIT_STRING_set(ASN1_BIT_STRING *a, unsigned char *d, int length);
-int ASN1_BIT_STRING_set_bit(ASN1_BIT_STRING *a, int n, int value);
-int ASN1_BIT_STRING_get_bit(const ASN1_BIT_STRING *a, int n);
-int ASN1_BIT_STRING_check(const ASN1_BIT_STRING *a,
-                          const unsigned char *flags, int flags_len);
-
-int ASN1_BIT_STRING_name_print(BIO *out, ASN1_BIT_STRING *bs,
-                               BIT_STRING_BITNAME *tbl, int indent);
-int ASN1_BIT_STRING_num_asc(const char *name, BIT_STRING_BITNAME *tbl);
-int ASN1_BIT_STRING_set_asc(ASN1_BIT_STRING *bs, const char *name, int value,
-                            BIT_STRING_BITNAME *tbl);
-
-DECLARE_ASN1_FUNCTIONS(ASN1_INTEGER)
-ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, const unsigned char **pp,
-                                long length);
-ASN1_INTEGER *ASN1_INTEGER_dup(const ASN1_INTEGER *x);
-int ASN1_INTEGER_cmp(const ASN1_INTEGER *x, const ASN1_INTEGER *y);
-
-DECLARE_ASN1_FUNCTIONS(ASN1_ENUMERATED)
-
-int ASN1_UTCTIME_check(const ASN1_UTCTIME *a);
-ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s, time_t t);
-ASN1_UTCTIME *ASN1_UTCTIME_adj(ASN1_UTCTIME *s, time_t t,
-                               int offset_day, long offset_sec);
-int ASN1_UTCTIME_set_string(ASN1_UTCTIME *s, const char *str);
-int ASN1_UTCTIME_cmp_time_t(const ASN1_UTCTIME *s, time_t t);
-
-int ASN1_GENERALIZEDTIME_check(const ASN1_GENERALIZEDTIME *a);
-ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,
-                                               time_t t);
-ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_adj(ASN1_GENERALIZEDTIME *s,
-                                               time_t t, int offset_day,
-                                               long offset_sec);
-int ASN1_GENERALIZEDTIME_set_string(ASN1_GENERALIZEDTIME *s, const char *str);
-
-int ASN1_TIME_diff(int *pday, int *psec,
-                   const ASN1_TIME *from, const ASN1_TIME *to);
-
-DECLARE_ASN1_FUNCTIONS(ASN1_OCTET_STRING)
-ASN1_OCTET_STRING *ASN1_OCTET_STRING_dup(const ASN1_OCTET_STRING *a);
-int ASN1_OCTET_STRING_cmp(const ASN1_OCTET_STRING *a,
-                          const ASN1_OCTET_STRING *b);
-int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *str, const unsigned char *data,
-                          int len);
-
-DECLARE_ASN1_FUNCTIONS(ASN1_VISIBLESTRING)
-DECLARE_ASN1_FUNCTIONS(ASN1_UNIVERSALSTRING)
-DECLARE_ASN1_FUNCTIONS(ASN1_UTF8STRING)
-DECLARE_ASN1_FUNCTIONS(ASN1_NULL)
-DECLARE_ASN1_FUNCTIONS(ASN1_BMPSTRING)
-
-int UTF8_getc(const unsigned char *str, int len, unsigned long *val);
-int UTF8_putc(unsigned char *str, int len, unsigned long value);
-
-DECLARE_ASN1_FUNCTIONS_name(ASN1_STRING, ASN1_PRINTABLE)
-
-DECLARE_ASN1_FUNCTIONS_name(ASN1_STRING, DIRECTORYSTRING)
-DECLARE_ASN1_FUNCTIONS_name(ASN1_STRING, DISPLAYTEXT)
-DECLARE_ASN1_FUNCTIONS(ASN1_PRINTABLESTRING)
-DECLARE_ASN1_FUNCTIONS(ASN1_T61STRING)
-DECLARE_ASN1_FUNCTIONS(ASN1_IA5STRING)
-DECLARE_ASN1_FUNCTIONS(ASN1_GENERALSTRING)
-DECLARE_ASN1_FUNCTIONS(ASN1_UTCTIME)
-DECLARE_ASN1_FUNCTIONS(ASN1_GENERALIZEDTIME)
-DECLARE_ASN1_FUNCTIONS(ASN1_TIME)
-
-DECLARE_ASN1_ITEM(ASN1_OCTET_STRING_NDEF)
-
-ASN1_TIME *ASN1_TIME_set(ASN1_TIME *s, time_t t);
-ASN1_TIME *ASN1_TIME_adj(ASN1_TIME *s, time_t t,
-                         int offset_day, long offset_sec);
-int ASN1_TIME_check(const ASN1_TIME *t);
-ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(const ASN1_TIME *t,
-                                                   ASN1_GENERALIZEDTIME **out);
-int ASN1_TIME_set_string(ASN1_TIME *s, const char *str);
-int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str);
-int ASN1_TIME_to_tm(const ASN1_TIME *s, struct tm *tm);
-int ASN1_TIME_normalize(ASN1_TIME *s);
-int ASN1_TIME_cmp_time_t(const ASN1_TIME *s, time_t t);
-int ASN1_TIME_compare(const ASN1_TIME *a, const ASN1_TIME *b);
-
-int i2a_ASN1_INTEGER(BIO *bp, const ASN1_INTEGER *a);
-int a2i_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *bs, char *buf, int size);
-int i2a_ASN1_ENUMERATED(BIO *bp, const ASN1_ENUMERATED *a);
-int a2i_ASN1_ENUMERATED(BIO *bp, ASN1_ENUMERATED *bs, char *buf, int size);
-int i2a_ASN1_OBJECT(BIO *bp, const ASN1_OBJECT *a);
-int a2i_ASN1_STRING(BIO *bp, ASN1_STRING *bs, char *buf, int size);
-int i2a_ASN1_STRING(BIO *bp, const ASN1_STRING *a, int type);
-int i2t_ASN1_OBJECT(char *buf, int buf_len, const ASN1_OBJECT *a);
-
-int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num);
-ASN1_OBJECT *ASN1_OBJECT_create(int nid, unsigned char *data, int len,
-                                const char *sn, const char *ln);
-
-int ASN1_INTEGER_get_int64(int64_t *pr, const ASN1_INTEGER *a);
-int ASN1_INTEGER_set_int64(ASN1_INTEGER *a, int64_t r);
-int ASN1_INTEGER_get_uint64(uint64_t *pr, const ASN1_INTEGER *a);
-int ASN1_INTEGER_set_uint64(ASN1_INTEGER *a, uint64_t r);
-
-int ASN1_INTEGER_set(ASN1_INTEGER *a, long v);
-long ASN1_INTEGER_get(const ASN1_INTEGER *a);
-ASN1_INTEGER *BN_to_ASN1_INTEGER(const BIGNUM *bn, ASN1_INTEGER *ai);
-BIGNUM *ASN1_INTEGER_to_BN(const ASN1_INTEGER *ai, BIGNUM *bn);
-
-int ASN1_ENUMERATED_get_int64(int64_t *pr, const ASN1_ENUMERATED *a);
-int ASN1_ENUMERATED_set_int64(ASN1_ENUMERATED *a, int64_t r);
-
-
-int ASN1_ENUMERATED_set(ASN1_ENUMERATED *a, long v);
-long ASN1_ENUMERATED_get(const ASN1_ENUMERATED *a);
-ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(const BIGNUM *bn, ASN1_ENUMERATED *ai);
-BIGNUM *ASN1_ENUMERATED_to_BN(const ASN1_ENUMERATED *ai, BIGNUM *bn);
-
-/* General */
-/* given a string, return the correct type, max is the maximum length */
-int ASN1_PRINTABLE_type(const unsigned char *s, int max);
-
-unsigned long ASN1_tag2bit(int tag);
-
-/* SPECIALS */
-int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
-                    int *pclass, long omax);
-int ASN1_check_infinite_end(unsigned char **p, long len);
-int ASN1_const_check_infinite_end(const unsigned char **p, long len);
-void ASN1_put_object(unsigned char **pp, int constructed, int length,
-                     int tag, int xclass);
-int ASN1_put_eoc(unsigned char **pp);
-int ASN1_object_size(int constructed, int length, int tag);
-
-/* Used to implement other functions */
-void *ASN1_dup(i2d_of_void *i2d, d2i_of_void *d2i, void *x);
-
-# define ASN1_dup_of(type,i2d,d2i,x) \
-    ((type*)ASN1_dup(CHECKED_I2D_OF(type, i2d), \
-                     CHECKED_D2I_OF(type, d2i), \
-                     CHECKED_PTR_OF(type, x)))
-
-# define ASN1_dup_of_const(type,i2d,d2i,x) \
-    ((type*)ASN1_dup(CHECKED_I2D_OF(const type, i2d), \
-                     CHECKED_D2I_OF(type, d2i), \
-                     CHECKED_PTR_OF(const type, x)))
-
-void *ASN1_item_dup(const ASN1_ITEM *it, void *x);
-
-/* ASN1 alloc/free macros for when a type is only used internally */
-
-# define M_ASN1_new_of(type) (type *)ASN1_item_new(ASN1_ITEM_rptr(type))
-# define M_ASN1_free_of(x, type) \
-                ASN1_item_free(CHECKED_PTR_OF(type, x), ASN1_ITEM_rptr(type))
-
-# ifndef OPENSSL_NO_STDIO
-void *ASN1_d2i_fp(void *(*xnew) (void), d2i_of_void *d2i, FILE *in, void **x);
-
-#  define ASN1_d2i_fp_of(type,xnew,d2i,in,x) \
-    ((type*)ASN1_d2i_fp(CHECKED_NEW_OF(type, xnew), \
-                        CHECKED_D2I_OF(type, d2i), \
-                        in, \
-                        CHECKED_PPTR_OF(type, x)))
-
-void *ASN1_item_d2i_fp(const ASN1_ITEM *it, FILE *in, void *x);
-int ASN1_i2d_fp(i2d_of_void *i2d, FILE *out, void *x);
-
-#  define ASN1_i2d_fp_of(type,i2d,out,x) \
-    (ASN1_i2d_fp(CHECKED_I2D_OF(type, i2d), \
-                 out, \
-                 CHECKED_PTR_OF(type, x)))
-
-#  define ASN1_i2d_fp_of_const(type,i2d,out,x) \
-    (ASN1_i2d_fp(CHECKED_I2D_OF(const type, i2d), \
-                 out, \
-                 CHECKED_PTR_OF(const type, x)))
-
-int ASN1_item_i2d_fp(const ASN1_ITEM *it, FILE *out, void *x);
-int ASN1_STRING_print_ex_fp(FILE *fp, const ASN1_STRING *str, unsigned long flags);
-# endif
-
-int ASN1_STRING_to_UTF8(unsigned char **out, const ASN1_STRING *in);
-
-void *ASN1_d2i_bio(void *(*xnew) (void), d2i_of_void *d2i, BIO *in, void **x);
-
-#  define ASN1_d2i_bio_of(type,xnew,d2i,in,x) \
-    ((type*)ASN1_d2i_bio( CHECKED_NEW_OF(type, xnew), \
-                          CHECKED_D2I_OF(type, d2i), \
-                          in, \
-                          CHECKED_PPTR_OF(type, x)))
-
-void *ASN1_item_d2i_bio(const ASN1_ITEM *it, BIO *in, void *x);
-int ASN1_i2d_bio(i2d_of_void *i2d, BIO *out, unsigned char *x);
-
-#  define ASN1_i2d_bio_of(type,i2d,out,x) \
-    (ASN1_i2d_bio(CHECKED_I2D_OF(type, i2d), \
-                  out, \
-                  CHECKED_PTR_OF(type, x)))
-
-#  define ASN1_i2d_bio_of_const(type,i2d,out,x) \
-    (ASN1_i2d_bio(CHECKED_I2D_OF(const type, i2d), \
-                  out, \
-                  CHECKED_PTR_OF(const type, x)))
-
-int ASN1_item_i2d_bio(const ASN1_ITEM *it, BIO *out, void *x);
-int ASN1_UTCTIME_print(BIO *fp, const ASN1_UTCTIME *a);
-int ASN1_GENERALIZEDTIME_print(BIO *fp, const ASN1_GENERALIZEDTIME *a);
-int ASN1_TIME_print(BIO *fp, const ASN1_TIME *a);
-int ASN1_STRING_print(BIO *bp, const ASN1_STRING *v);
-int ASN1_STRING_print_ex(BIO *out, const ASN1_STRING *str, unsigned long flags);
-int ASN1_buf_print(BIO *bp, const unsigned char *buf, size_t buflen, int off);
-int ASN1_bn_print(BIO *bp, const char *number, const BIGNUM *num,
-                  unsigned char *buf, int off);
-int ASN1_parse(BIO *bp, const unsigned char *pp, long len, int indent);
-int ASN1_parse_dump(BIO *bp, const unsigned char *pp, long len, int indent,
-                    int dump);
-const char *ASN1_tag2str(int tag);
-
-/* Used to load and write Netscape format cert */
-
-int ASN1_UNIVERSALSTRING_to_string(ASN1_UNIVERSALSTRING *s);
-
-int ASN1_TYPE_set_octetstring(ASN1_TYPE *a, unsigned char *data, int len);
-int ASN1_TYPE_get_octetstring(const ASN1_TYPE *a, unsigned char *data, int max_len);
-int ASN1_TYPE_set_int_octetstring(ASN1_TYPE *a, long num,
-                                  unsigned char *data, int len);
-int ASN1_TYPE_get_int_octetstring(const ASN1_TYPE *a, long *num,
-                                  unsigned char *data, int max_len);
-
-void *ASN1_item_unpack(const ASN1_STRING *oct, const ASN1_ITEM *it);
-
-ASN1_STRING *ASN1_item_pack(void *obj, const ASN1_ITEM *it,
-                            ASN1_OCTET_STRING **oct);
-
-void ASN1_STRING_set_default_mask(unsigned long mask);
-int ASN1_STRING_set_default_mask_asc(const char *p);
-unsigned long ASN1_STRING_get_default_mask(void);
-int ASN1_mbstring_copy(ASN1_STRING **out, const unsigned char *in, int len,
-                       int inform, unsigned long mask);
-int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
-                        int inform, unsigned long mask,
-                        long minsize, long maxsize);
-
-ASN1_STRING *ASN1_STRING_set_by_NID(ASN1_STRING **out,
-                                    const unsigned char *in, int inlen,
-                                    int inform, int nid);
-ASN1_STRING_TABLE *ASN1_STRING_TABLE_get(int nid);
-int ASN1_STRING_TABLE_add(int, long, long, unsigned long, unsigned long);
-void ASN1_STRING_TABLE_cleanup(void);
-
-/* ASN1 template functions */
-
-/* Old API compatible functions */
-ASN1_VALUE *ASN1_item_new(const ASN1_ITEM *it);
-void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it);
-ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **val, const unsigned char **in,
-                          long len, const ASN1_ITEM *it);
-int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it);
-int ASN1_item_ndef_i2d(ASN1_VALUE *val, unsigned char **out,
-                       const ASN1_ITEM *it);
-
-void ASN1_add_oid_module(void);
-void ASN1_add_stable_module(void);
-
-ASN1_TYPE *ASN1_generate_nconf(const char *str, CONF *nconf);
-ASN1_TYPE *ASN1_generate_v3(const char *str, X509V3_CTX *cnf);
-int ASN1_str2mask(const char *str, unsigned long *pmask);
-
-/* ASN1 Print flags */
-
-/* Indicate missing OPTIONAL fields */
-# define ASN1_PCTX_FLAGS_SHOW_ABSENT             0x001
-/* Mark start and end of SEQUENCE */
-# define ASN1_PCTX_FLAGS_SHOW_SEQUENCE           0x002
-/* Mark start and end of SEQUENCE/SET OF */
-# define ASN1_PCTX_FLAGS_SHOW_SSOF               0x004
-/* Show the ASN1 type of primitives */
-# define ASN1_PCTX_FLAGS_SHOW_TYPE               0x008
-/* Don't show ASN1 type of ANY */
-# define ASN1_PCTX_FLAGS_NO_ANY_TYPE             0x010
-/* Don't show ASN1 type of MSTRINGs */
-# define ASN1_PCTX_FLAGS_NO_MSTRING_TYPE         0x020
-/* Don't show field names in SEQUENCE */
-# define ASN1_PCTX_FLAGS_NO_FIELD_NAME           0x040
-/* Show structure names of each SEQUENCE field */
-# define ASN1_PCTX_FLAGS_SHOW_FIELD_STRUCT_NAME  0x080
-/* Don't show structure name even at top level */
-# define ASN1_PCTX_FLAGS_NO_STRUCT_NAME          0x100
-
-int ASN1_item_print(BIO *out, ASN1_VALUE *ifld, int indent,
-                    const ASN1_ITEM *it, const ASN1_PCTX *pctx);
-ASN1_PCTX *ASN1_PCTX_new(void);
-void ASN1_PCTX_free(ASN1_PCTX *p);
-unsigned long ASN1_PCTX_get_flags(const ASN1_PCTX *p);
-void ASN1_PCTX_set_flags(ASN1_PCTX *p, unsigned long flags);
-unsigned long ASN1_PCTX_get_nm_flags(const ASN1_PCTX *p);
-void ASN1_PCTX_set_nm_flags(ASN1_PCTX *p, unsigned long flags);
-unsigned long ASN1_PCTX_get_cert_flags(const ASN1_PCTX *p);
-void ASN1_PCTX_set_cert_flags(ASN1_PCTX *p, unsigned long flags);
-unsigned long ASN1_PCTX_get_oid_flags(const ASN1_PCTX *p);
-void ASN1_PCTX_set_oid_flags(ASN1_PCTX *p, unsigned long flags);
-unsigned long ASN1_PCTX_get_str_flags(const ASN1_PCTX *p);
-void ASN1_PCTX_set_str_flags(ASN1_PCTX *p, unsigned long flags);
-
-ASN1_SCTX *ASN1_SCTX_new(int (*scan_cb) (ASN1_SCTX *ctx));
-void ASN1_SCTX_free(ASN1_SCTX *p);
-const ASN1_ITEM *ASN1_SCTX_get_item(ASN1_SCTX *p);
-const ASN1_TEMPLATE *ASN1_SCTX_get_template(ASN1_SCTX *p);
-unsigned long ASN1_SCTX_get_flags(ASN1_SCTX *p);
-void ASN1_SCTX_set_app_data(ASN1_SCTX *p, void *data);
-void *ASN1_SCTX_get_app_data(ASN1_SCTX *p);
-
-const BIO_METHOD *BIO_f_asn1(void);
-
-BIO *BIO_new_NDEF(BIO *out, ASN1_VALUE *val, const ASN1_ITEM *it);
-
-int i2d_ASN1_bio_stream(BIO *out, ASN1_VALUE *val, BIO *in, int flags,
-                        const ASN1_ITEM *it);
-int PEM_write_bio_ASN1_stream(BIO *out, ASN1_VALUE *val, BIO *in, int flags,
-                              const char *hdr, const ASN1_ITEM *it);
-int SMIME_write_ASN1(BIO *bio, ASN1_VALUE *val, BIO *data, int flags,
-                     int ctype_nid, int econt_nid,
-                     STACK_OF(X509_ALGOR) *mdalgs, const ASN1_ITEM *it);
-ASN1_VALUE *SMIME_read_ASN1(BIO *bio, BIO **bcont, const ASN1_ITEM *it);
-int SMIME_crlf_copy(BIO *in, BIO *out, int flags);
-int SMIME_text(BIO *in, BIO *out);
-
-const ASN1_ITEM *ASN1_ITEM_lookup(const char *name);
-const ASN1_ITEM *ASN1_ITEM_get(size_t i);
-
-# ifdef  __cplusplus
-}
-# endif
-#endif

client/3rd/OpenSSL/include/openssl/asn1_mac.h

@@ -1,10 +0,0 @@
-/*
- * Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the OpenSSL license (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-#error "This file is obsolete; please update your software."