@andrewheberle/serverless-ssh-ca 0.21.0 → 0.23.0

package/dist/utils.d.ts

@@ -1,9 +1,11 @@
 import type { SshCaBindings } from "./types.js";
-import type { Certificate, Key, PrivateKey } from "sshpk";
+import { SshCertificate } from "./ssh/certificate.js";
+import { PublicKey, UnsupportedKeyError, type PrivateKey } from "./ssh/keys.js";
 import z from "zod";
 import { CertificateRequestJWTPayload } from "./types.js";
 import { RenewalProofOfPossession, ProofOfPossession } from "./proof.js";
 import type { isRevoked as IsRevokedFn } from "./db/index.js";
+export { UnsupportedKeyError };
 export declare const fatalIssue: (ctx: z.RefinementCtx, message: string, val: unknown) => never;
 export declare const transformProofOfPossession: (env: SshCaBindings, val: string, ctx: z.core.$RefinementCtx<string>) => ProofOfPossession | never;
 type AccessToken = {
@@ -11,7 +13,13 @@ type AccessToken = {
     sub: string;
 };
 export declare const transformAuthorizationHeader: (env: SshCaBindings, val: string, ctx: z.RefinementCtx) => Promise<AccessToken | never>;
-export declare const transformPublicKey: (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx) => Key | never;
+/**
+ * Parses a public key in OpenSSH format, `${type} ${base64}[ ${comment}]`
+ *
+ * @param val The public key, either base64 encoded or as bytes
+ * @param ctx The Zod context for any errors
+ */
+export declare const transformPublicKey: (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx) => PublicKey | never;
 /**
  * Thrown by {@link identityPrincipals} when the principals claim of an
  * identity token is not a string or an array of strings.
@@ -32,10 +40,10 @@ export declare const transformIdentityToken: (env: SshCaBindings, val: string, c
  * @param ctx The Zod context for any errors
  * @returns
  */
-export declare const transformCertificate: (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx) => Certificate | never;
+export declare const transformCertificate: (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx) => SshCertificate | never;
 type ParsedCertificateRequest = {
     proof: ProofOfPossession;
-    public_key: Key;
+    public_key: PublicKey;
     lifetime: number;
     identity: IdentityToken;
     extensions: string[];
@@ -43,7 +51,7 @@ type ParsedCertificateRequest = {
 export declare const refineCertificateRequest: (env: SshCaBindings, val: ParsedCertificateRequest, ctx: z.RefinementCtx) => Promise<never>;
 export declare const transformRenewalProofOfPossession: (env: SshCaBindings, val: string, ctx: z.RefinementCtx) => RenewalProofOfPossession | never;
 type HostCertificateRequest = {
-    public_key: Key;
+    public_key: PublicKey;
     lifetime: number;
 };
 type ParsedHostCertificateRequest = {
@@ -52,36 +60,47 @@ type ParsedHostCertificateRequest = {
 } & HostCertificateRequest;
 export declare const refineHostCertificateRequest: (env: SshCaBindings, val: ParsedHostCertificateRequest, ctx: z.RefinementCtx) => Promise<never>;
 type ParsedHostCertificateRenewal = {
-    certificate: Certificate;
+    certificate: SshCertificate;
     proof: RenewalProofOfPossession;
 } & HostCertificateRequest;
+/**
+ * Checks a certificate presented for renewal was issued by this CA, is a host
+ * certificate, is within its validity period and has not been revoked.
+ *
+ * @param env The CA bindings
+ * @param isRevoked Returns whether a serial has been revoked
+ * @param certificate The certificate presented for renewal
+ * @returns The reason the certificate cannot be renewed, or undefined if it can be
+ * @throws {@link UnsupportedKeyError} when the CA key is not supported
+ */
+export declare const checkRenewableCertificate: (env: SshCaBindings, isRevoked: typeof IsRevokedFn, certificate: SshCertificate) => Promise<string | undefined>;
+/**
+ * Refines a host certificate renewal so only a certificate that can be
+ * renewed (see {@link checkRenewableCertificate}) is accepted.
+ */
+export declare const refineRenewableCertificate: (env: SshCaBindings, isRevoked: typeof IsRevokedFn, val: {
+    certificate: SshCertificate;
+}, ctx: z.RefinementCtx) => Promise<never>;
 export declare const refineHostCertificateRenewal: (env: SshCaBindings, isRevoked: typeof IsRevokedFn, val: ParsedHostCertificateRenewal, ctx: z.RefinementCtx) => Promise<never>;
 type ParsedRevokeCertificate = {
     serial: bigint;
-    public_key: Key;
+    public_key: PublicKey;
     proof: ProofOfPossession;
 };
 export declare const refineRevokeCertificate: (env: SshCaBindings, val: ParsedRevokeCertificate, ctx: z.RefinementCtx) => Promise<never>;
 export declare const split: (v?: string | string[]) => string[];
-/**
- * Thrown by {@link getPrivateKey} when the CA private key is of a type that
- * cannot be used.
- */
-export declare class UnsupportedKeyError extends Error {
-    constructor(message: string);
-}
 /**
  * Load and parse the CA private key from the `PRIVATE_KEY` secret.
  *
- * Only Ed25519 and ECDSA keys are supported. RSA keys are rejected because
- * sshpk signs RSA certificates with SHA-1 (`ssh-rsa`), which OpenSSH 8.2 and
- * later refuse by default, and because RSA keys in OpenSSH format are
- * converted with invalid CRT parameters that the Workers runtime rejects.
+ * Only Ed25519 and ECDSA keys are supported, as these are the key types that
+ * certificates and KRLs are signed with (see `createSigner` in `ssh/signer.ts`).
  *
- * @throws KeyParseError when the secret cannot be parsed.
+ * @throws {@link KeyParseError} when the secret cannot be parsed.
  * @throws {@link UnsupportedKeyError} when the key is not Ed25519 or ECDSA.
  */
 export declare const getPrivateKey: (env: SshCaBindings) => Promise<PrivateKey>;
-export declare const getPublic: (env: SshCaBindings, key?: PrivateKey) => Promise<Key>;
-export {};
+/**
+ * Returns the public key of the CA, with `ISSUER_DN` as its comment
+ */
+export declare const getPublic: (env: SshCaBindings, key?: PrivateKey) => Promise<PublicKey>;
 //# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAG/C,OAAO,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,OAAO,CAAA;AACzD,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAwB,MAAM,YAAY,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,eAAe,CAAA;AAQ7D,eAAO,MAAM,UAAU,QAAS,CAAC,CAAC,aAAa,WAAW,MAAM,OAAO,OAAO,UAQ7E,CAAA;AAED,eAAO,MAAM,0BAA0B,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAG,iBAAiB,GAAG,KA0BpI,CAAA;AAED,KAAK,WAAW,GAAG;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACX,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,WAAW,GAAG,KAAK,CA6CrI,CAAA;AAED,eAAO,MAAM,kBAAkB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,GAAG,GAAG,KA+BtG,CAAA;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAID,eAAO,MAAM,kBAAkB,QAAS,aAAa,WAAW,4BAA4B,UAAU,MAAM,KAAG,MAAM,EAsCpH,CAAA;AAED,KAAK,aAAa,GAAG;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,aAAa,QAAe,aAAa,OAAO,MAAM,GAAG,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,aAAa,CActH,CAAA;AAED,eAAO,MAAM,sBAAsB,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,aAAa,GAAG,KAAK,CAajI,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,WAAW,GAAG,KA+BhH,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC/B,KAAK,EAAE,iBAAiB,CAAA;IACxB,UAAU,EAAE,GAAG,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAe,aAAa,OAAO,wBAAwB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBrI,CAAA;AAED,eAAO,MAAM,iCAAiC,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,wBAAwB,GAAG,KAYpI,CAAA;AAED,KAAK,sBAAsB,GAAG;IAC7B,UAAU,EAAE,GAAG,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,EAAE,iBAAiB,CAAA;CACxB,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA4B7I,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,wBAAwB,CAAA;CAC/B,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA+C5K,CAAA;AAED,KAAK,uBAAuB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,GAAG,CAAA;IACf,KAAK,EAAE,iBAAiB,CAAA;CACxB,CAAA;AAED,eAAO,MAAM,uBAAuB,QAAe,aAAa,OAAO,uBAAuB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBnI,CAAA;AAED,eAAO,MAAM,KAAK,OAAQ,MAAM,GAAG,MAAM,EAAE,KAAG,MAAM,EAQnD,CAAA;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,QAAe,aAAa,KAAG,OAAO,CAAC,UAAU,CAY1E,CAAA;AAED,eAAO,MAAM,SAAS,QAAe,aAAa,QAAQ,UAAU,KAAG,OAAO,CAAC,GAAG,CAWjF,CAAA"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,OAAO,EAAyB,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAkC,SAAS,EAAE,mBAAmB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/G,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAwB,MAAM,YAAY,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,eAAe,CAAA;AAK7D,OAAO,EAAE,mBAAmB,EAAE,CAAA;AAE9B,eAAO,MAAM,UAAU,QAAS,CAAC,CAAC,aAAa,WAAW,MAAM,OAAO,OAAO,UAQ7E,CAAA;AAED,eAAO,MAAM,0BAA0B,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAG,iBAAiB,GAAG,KA0BpI,CAAA;AAED,KAAK,WAAW,GAAG;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACX,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,WAAW,GAAG,KAAK,CA6CrI,CAAA;AAOD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,SAAS,GAAG,KA6B5G,CAAA;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAID,eAAO,MAAM,kBAAkB,QAAS,aAAa,WAAW,4BAA4B,UAAU,MAAM,KAAG,MAAM,EAsCpH,CAAA;AAED,KAAK,aAAa,GAAG;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,aAAa,QAAe,aAAa,OAAO,MAAM,GAAG,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,aAAa,CActH,CAAA;AAED,eAAO,MAAM,sBAAsB,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,aAAa,GAAG,KAAK,CAajI,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,cAAc,GAAG,KA6BnH,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC/B,KAAK,EAAE,iBAAiB,CAAA;IACxB,UAAU,EAAE,SAAS,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAe,aAAa,OAAO,wBAAwB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBrI,CAAA;AAED,eAAO,MAAM,iCAAiC,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,wBAAwB,GAAG,KAYpI,CAAA;AAED,KAAK,sBAAsB,GAAG;IAC7B,UAAU,EAAE,SAAS,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,EAAE,iBAAiB,CAAA;CACxB,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA4B7I,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,WAAW,EAAE,cAAc,CAAA;IAC3B,KAAK,EAAE,wBAAwB,CAAA;CAC/B,GAAG,sBAAsB,CAAA;AAE1B;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,QAAe,aAAa,aAAa,OAAO,WAAW,eAAe,cAAc,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CA8B1J,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO;IAAE,WAAW,EAAE,cAAc,CAAA;CAAE,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAkB7K,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA6B5K,CAAA;AAED,KAAK,uBAAuB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,SAAS,CAAA;IACrB,KAAK,EAAE,iBAAiB,CAAA;CACxB,CAAA;AAED,eAAO,MAAM,uBAAuB,QAAe,aAAa,OAAO,uBAAuB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBnI,CAAA;AAED,eAAO,MAAM,KAAK,OAAQ,MAAM,GAAG,MAAM,EAAE,KAAG,MAAM,EAQnD,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,QAAe,aAAa,KAAG,OAAO,CAAC,UAAU,CAK1E,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,QAAe,aAAa,QAAQ,UAAU,KAAG,OAAO,CAAC,SAAS,CAMvF,CAAA"}

package/dist/utils.js

@@ -1,13 +1,13 @@
 import { JWKInvalid, JWKSInvalid, JWSInvalid, JWSSignatureVerificationFailed, JWTClaimValidationFailed, JWTExpired, JWTInvalid } from "jose/errors";
-import sshpk from "sshpk";
+import { CertificateParseError, SshCertificate } from "./ssh/certificate.js";
+import { KeyParseError, parsePrivateKey, PublicKey, UnsupportedKeyError } from "./ssh/keys.js";
 import z from "zod";
 import { verifyJWT } from "./verify.js";
 import { RenewalProofOfPossession, ProofOfPossession, PossessionParseError } from "./proof.js";
 import { logger } from "./logger.js";
 import { ms } from "itty-time";
 import { InternalServerErrorException } from "chanfana";
-// sshpk is CommonJS and Node's ESM loader cannot detect most of its named exports, so values are taken from the default import
-const { KeyParseError, CertificateParseError, parseCertificate, parseKey, parsePrivateKey } = sshpk;
+export { UnsupportedKeyError };
 export const fatalIssue = (ctx, message, val) => {
     ctx.issues.push({
         code: "custom",
@@ -84,10 +84,19 @@ export const transformAuthorizationHeader = async (env, val, ctx) => {
         }
     }
 };
+// decodes a value sent as base64, which may already have been decoded by the schema
+const fromBase64 = (val) => {
+    return (typeof val === "string" ? Buffer.from(val, "base64") : Buffer.from(val)).toString("utf8");
+};
+/**
+ * Parses a public key in OpenSSH format, `${type} ${base64}[ ${comment}]`
+ *
+ * @param val The public key, either base64 encoded or as bytes
+ * @param ctx The Zod context for any errors
+ */
 export const transformPublicKey = (val, ctx) => {
     try {
-        const key = typeof val === "string" ? parseKey(Buffer.from(val, "base64")) : parseKey(val);
-        return key;
+        return PublicKey.parse(fromBase64(val));
     }
     catch (err) {
         switch (true) {
@@ -191,8 +200,7 @@ export const transformIdentityToken = async (env, val, ctx) => {
  */
 export const transformCertificate = (val, ctx) => {
     try {
-        const cert = typeof val === "string" ? parseCertificate(Buffer.from(val, "base64"), "openssh") : parseCertificate(val, "openssh");
-        return cert;
+        return SshCertificate.parse(fromBase64(val));
     }
     catch (err) {
         switch (true) {
@@ -257,7 +265,7 @@ export const refineHostCertificateRequest = async (env, val, ctx) => {
     l.debug("started");
     try {
         // check proof of possession fingerprint matches public key
-        l.debug("checking val.proof.matches()", "public_key", val.public_key.toString("ssh"));
+        l.debug("checking val.proof.matches()", "public_key", val.public_key.toString());
         if (!val.proof.matches(val.public_key)) {
             l.warn("proof of possession fingerprint did not match public_key");
             return fatalIssue(ctx, "proof of possession fingerprint did not match public_key", val);
@@ -277,31 +285,75 @@ export const refineHostCertificateRequest = async (env, val, ctx) => {
         return fatalIssue(ctx, "proof of possession verification unhandled error", val);
     }
 };
-export const refineHostCertificateRenewal = async (env, isRevoked, val, ctx) => {
+/**
+ * Checks a certificate presented for renewal was issued by this CA, is a host
+ * certificate, is within its validity period and has not been revoked.
+ *
+ * @param env The CA bindings
+ * @param isRevoked Returns whether a serial has been revoked
+ * @param certificate The certificate presented for renewal
+ * @returns The reason the certificate cannot be renewed, or undefined if it can be
+ * @throws {@link UnsupportedKeyError} when the CA key is not supported
+ */
+export const checkRenewableCertificate = async (env, isRevoked, certificate) => {
+    // ensure certificate is signed by CA
+    const issuer = await getPublic(env);
+    if (!await certificate.isSignedBy(issuer)) {
+        return "the provided certificate was not signed by this CA";
+    }
+    // only host certificates can be renewed, as renewal does not need the
+    // OIDC authentication a user certificate is issued with
+    if (certificate.kind !== "host") {
+        return "the provided certificate is not a host certificate";
+    }
+    // check certificate is within its validity period, allowing for clock
+    // skew at the start as a certificate issued moments ago may have a
+    // validity start up to a second in the future
+    const now = Date.now();
+    if (now >= certificate.validBefore.getTime()) {
+        return "the provided certificate is expired";
+    }
+    if (certificate.validAfter.getTime() > now + ms(env.CERTIFICATE_REQUEST_TIME_SKEW_MAX)) {
+        return "the provided certificate is not yet valid";
+    }
+    // ensure certificate presented for renewal is not revoked
+    if (await isRevoked(env, certificate.serial)) {
+        return "the provided certificate is revoked";
+    }
+    return undefined;
+};
+/**
+ * Refines a host certificate renewal so only a certificate that can be
+ * renewed (see {@link checkRenewableCertificate}) is accepted.
+ */
+export const refineRenewableCertificate = async (env, isRevoked, val, ctx) => {
     const l = logger(env);
     try {
-        // ensure certificate is signed by CA
-        const issuer = await getPublic(env);
-        if (!val.certificate.isSignedByKey(issuer)) {
-            return fatalIssue(ctx, "the provided certificate was not signed by this CA", val);
-        }
-        // check certificate is within its validity period, allowing for clock
-        // skew at the start as a certificate issued moments ago may have a
-        // validity start up to a second in the future
-        const now = Date.now();
-        if (now >= val.certificate.validUntil.getTime()) {
-            return fatalIssue(ctx, "the provided certificate is expired", val);
+        const reason = await checkRenewableCertificate(env, isRevoked, val.certificate);
+        if (reason !== undefined) {
+            return fatalIssue(ctx, reason, val);
         }
-        if (val.certificate.validFrom.getTime() > now + ms(env.CERTIFICATE_REQUEST_TIME_SKEW_MAX)) {
-            return fatalIssue(ctx, "the provided certificate is not yet valid", val);
+        return z.NEVER;
+    }
+    catch (err) {
+        // a misconfigured CA key is a server error, not a validation failure
+        if (err instanceof UnsupportedKeyError) {
+            l.error(err.message, "in", "refineRenewableCertificate");
+            throw new InternalServerErrorException(err.message);
         }
-        // ensure certificate presented for renewal is not revoked
-        const serial = val.certificate.serial.readBigUInt64BE(0);
-        if (await isRevoked(env, serial)) {
-            return fatalIssue(ctx, "the provided certificate is revoked", val);
+        l.error("certificate renewal check unhandled error", "in", "refineRenewableCertificate", "error", err);
+        return fatalIssue(ctx, "certificate renewal check unhandled error", val);
+    }
+};
+export const refineHostCertificateRenewal = async (env, isRevoked, val, ctx) => {
+    const l = logger(env);
+    try {
+        const reason = await checkRenewableCertificate(env, isRevoked, val.certificate);
+        if (reason !== undefined) {
+            return fatalIssue(ctx, reason, val);
         }
         // check proof of possession fingerprint matches public key and certificate subject key
-        if (!val.proof.matches(val.public_key, val.certificate.subjectKey)) {
+        if (!val.proof.matches(val.public_key, val.certificate.publicKey)) {
             return fatalIssue(ctx, "proof of possession fingerprints did not match public_key and/or certificate", val);
         }
         // verify proof of possession signature
@@ -349,46 +401,27 @@ export const split = (v) => {
                 : v.split(",")
             : v;
 };
-/**
- * Thrown by {@link getPrivateKey} when the CA private key is of a type that
- * cannot be used.
- */
-export class UnsupportedKeyError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "UnsupportedKeyError";
-        Object.setPrototypeOf(this, UnsupportedKeyError.prototype);
-    }
-}
 /**
  * Load and parse the CA private key from the `PRIVATE_KEY` secret.
  *
- * Only Ed25519 and ECDSA keys are supported. RSA keys are rejected because
- * sshpk signs RSA certificates with SHA-1 (`ssh-rsa`), which OpenSSH 8.2 and
- * later refuse by default, and because RSA keys in OpenSSH format are
- * converted with invalid CRT parameters that the Workers runtime rejects.
+ * Only Ed25519 and ECDSA keys are supported, as these are the key types that
+ * certificates and KRLs are signed with (see `createSigner` in `ssh/signer.ts`).
  *
- * @throws KeyParseError when the secret cannot be parsed.
+ * @throws {@link KeyParseError} when the secret cannot be parsed.
  * @throws {@link UnsupportedKeyError} when the key is not Ed25519 or ECDSA.
  */
 export const getPrivateKey = async (env) => {
     // grab private key from secret store
     const secret = await env.PRIVATE_KEY.get();
-    // parse it
-    const key = parsePrivateKey(secret);
-    if (key.type !== "ed25519" && key.type !== "ecdsa") {
-        throw new UnsupportedKeyError(`CA key type ${key.type} is not supported, the CA key must be Ed25519 or ECDSA`);
-    }
-    return key;
+    return parsePrivateKey(secret);
 };
+/**
+ * Returns the public key of the CA, with `ISSUER_DN` as its comment
+ */
 export const getPublic = async (env, key) => {
     if (key === undefined) {
         key = await getPrivateKey(env);
     }
-    // convert to a public key and add comment
-    const pub = key.toPublic();
-    pub.comment = env.ISSUER_DN;
-    // return in ssh format trimmed of any whitespace
-    return pub;
+    return key.publicKey.withComment(env.ISSUER_DN);
 };
 //# sourceMappingURL=utils.js.map

package/dist/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACnJ,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAE9F,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AAC9B,OAAO,EAAE,4BAA4B,EAAE,MAAM,UAAU,CAAA;AAEvD,+HAA+H;AAC/H,MAAM,EAAE,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,KAAK,CAAA;AAEnG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAoB,EAAE,OAAe,EAAE,GAAY,EAAE,EAAE;IACjF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACf,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,GAAG;KACV,CAAC,CAAA;IAEF,OAAO,CAAC,CAAC,KAAK,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,GAAkC,EAA6B,EAAE;IAC5I,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;QAExG,OAAO,KAAK,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,mCAAmC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1D,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,oBAAoB,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,+CAA+C;oBACxD,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAgC,EAAE;IACzI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC,GAAG,EAAE,6CAA6C,EAAE,GAAG,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,UAAU,CAAC,GAAG,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,CAAC;QACJ,aAAa;QACb,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAE7C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,UAAU,CAAC,GAAG,EAAE,uDAAuD,EAAE,GAAG,CAAC,CAAA;QACrF,CAAC;QAED,OAAO;YACN,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;SAChB,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;YAC5D,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAA;YACpE,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAA;YAChE,KAAK,CAAC,GAAG,YAAY,WAAW,CAAC;gBAChC,OAAO,UAAU,CAAC,GAAG,EAAE,mCAAmC,EAAE,GAAG,CAAC,CAAA;YACjE,KAAK,CAAC,GAAG,YAAY,wBAAwB,CAAC;gBAC7C,OAAO,UAAU,CAAC,GAAG,EAAE,oCAAoC,EAAE,GAAG,CAAC,CAAA;YAClE,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;YAC5D,KAAK,CAAC,GAAG,YAAY,8BAA8B,CAAC;gBACnD,OAAO,UAAU,CAAC,GAAG,EAAE,gDAAgD,EAAE,GAAG,CAAC,CAAA;YAC9E;gBACC,CAAC,CAAC,KAAK,CAAC,yCAAyC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;gBACtG,OAAO,UAAU,CAAC,GAAG,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAA;QACxE,CAAC;IACF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAqC,EAAE,GAAoB,EAAe,EAAE;IAC9G,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QAE1F,OAAO,GAAG,CAAA;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN,KAAK,CAAC,GAAG,YAAY,aAAa,CAAC;gBAClC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,oCAAoC;oBAC7C,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAElC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC5D,CAAC;CACD;AAED,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;AAElF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAkB,EAAE,OAAqC,EAAE,KAAc,EAAY,EAAE;IACzH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,GAAG,GAAG,CAAC,oCAAoC,CAAA;IACjD,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,6DAA6D;IAC7D,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,+CAA+C,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACvE,MAAM,IAAI,oBAAoB,CAAC,OAAO,KAAK,gDAAgD,CAAC,CAAA;IAC7F,CAAC;IAEA,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAA;IAEtB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,kDAAkD,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAC1E,OAAO,EAAE,CAAA;IACV,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC,IAAI,CAAC,gCAAgC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACxD,OAAO,EAAE,CAAA;IACV,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,2CAA2C,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACnE,OAAO,EAAE,CAAA;IACV,CAAC;IAED,0EAA0E;IAC1E,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACjD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAE7C,CAAC,CAAC,KAAK,CAAC,oCAAoC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAA;IAEvE,OAAO,UAAU,CAAA;AAClB,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAuB,EAAE,KAAc,EAA0B,EAAE;IAC1H,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC9B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;IAE1F,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IAE1D,OAAO;QACN,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,UAAU;KACtB,CAAA;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAkC,EAAE;IACrI,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,oCAAoC,CAAC,CAAA;QAExF,OAAO,QAAQ,CAAA;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,GAAG,YAAY,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC;YAC7F,KAAK,EAAE,GAAG;SACV,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAqC,EAAE,GAAoB,EAAuB,EAAE;IACxH,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAEjI,OAAO,IAAI,CAAA;IACZ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN,KAAK,CAAC,GAAG,YAAY,qBAAqB,CAAC;gBAC1C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,qCAAqC;oBAC9C,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAUD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAA6B,EAAE,GAAoB,EAAkB,EAAE;IACzI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC3G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAoC,EAAE;IAC5I,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,OAAO,IAAI,wBAAwB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;IACzG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACzC,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACpH,OAAO,UAAU,CAAC,GAAG,EAAE,+CAA+C,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC;AACF,CAAC,CAAA;AAYD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAiC,EAAE,GAAoB,EAAkB,EAAE;IACjJ,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAA;IAEhE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAElB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QACrF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;YAClE,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACnC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAA;YACzD,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAEf,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACzE,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,GAAiC,EAAE,GAAoB,EAAkB,EAAE;IAChL,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,qCAAqC;QACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,OAAO,UAAU,CAAC,GAAG,EAAE,oDAAoD,EAAE,GAAG,CAAC,CAAA;QAClF,CAAC;QAED,sEAAsE;QACtE,mEAAmE;QACnE,8CAA8C;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,OAAO,UAAU,CAAC,GAAG,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAA;QACnE,CAAC;QACD,IAAI,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC;YAC3F,OAAO,UAAU,CAAC,GAAG,EAAE,2CAA2C,EAAE,GAAG,CAAC,CAAA;QACzE,CAAC;QAED,0DAA0D;QAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;QACxD,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,UAAU,CAAC,GAAG,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAA;QACnE,CAAC;QAED,uFAAuF;QACvF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;YACpE,OAAO,UAAU,CAAC,GAAG,EAAE,8EAA8E,EAAE,GAAG,CAAC,CAAA;QAC5G,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,qEAAqE;QACrE,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,8BAA8B,CAAC,CAAA;YAC1D,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAQD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAA4B,EAAE,GAAoB,EAAkB,EAAE;IACvI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAY,EAAE;IACxD,OAAO,CAAC,KAAK,SAAS;QACrB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;YACtB,CAAC,CAAC,CAAC,KAAK,EAAE;gBACT,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,CAAC,CAAA;AACN,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;QAEjC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAA;IAC3D,CAAC;CACD;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAkB,EAAuB,EAAE;IAC9E,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,CAAA;IAE1C,WAAW;IACX,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAEnC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACpD,MAAM,IAAI,mBAAmB,CAAC,eAAe,GAAG,CAAC,IAAI,wDAAwD,CAAC,CAAA;IAC/G,CAAC;IAED,OAAO,GAAG,CAAA;AACX,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAgB,EAAgB,EAAE;IACrF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;IAC/B,CAAC;IAED,0CAA0C;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAA;IAC1B,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,SAAS,CAAA;IAE3B,iDAAiD;IACjD,OAAO,GAAG,CAAA;AACX,CAAC,CAAA"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACnJ,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,mBAAmB,EAAmB,MAAM,eAAe,CAAA;AAC/G,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAE9F,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AAC9B,OAAO,EAAE,4BAA4B,EAAE,MAAM,UAAU,CAAA;AAEvD,OAAO,EAAE,mBAAmB,EAAE,CAAA;AAE9B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAoB,EAAE,OAAe,EAAE,GAAY,EAAE,EAAE;IACjF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACf,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,GAAG;KACV,CAAC,CAAA;IAEF,OAAO,CAAC,CAAC,KAAK,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,GAAkC,EAA6B,EAAE;IAC5I,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;QAExG,OAAO,KAAK,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,mCAAmC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1D,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,oBAAoB,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,+CAA+C;oBACxD,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAgC,EAAE;IACzI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC,GAAG,EAAE,6CAA6C,EAAE,GAAG,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,UAAU,CAAC,GAAG,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,CAAC;QACJ,aAAa;QACb,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAE7C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,UAAU,CAAC,GAAG,EAAE,uDAAuD,EAAE,GAAG,CAAC,CAAA;QACrF,CAAC;QAED,OAAO;YACN,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;SAChB,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;YAC5D,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAA;YACpE,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAA;YAChE,KAAK,CAAC,GAAG,YAAY,WAAW,CAAC;gBAChC,OAAO,UAAU,CAAC,GAAG,EAAE,mCAAmC,EAAE,GAAG,CAAC,CAAA;YACjE,KAAK,CAAC,GAAG,YAAY,wBAAwB,CAAC;gBAC7C,OAAO,UAAU,CAAC,GAAG,EAAE,oCAAoC,EAAE,GAAG,CAAC,CAAA;YAClE,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;YAC5D,KAAK,CAAC,GAAG,YAAY,8BAA8B,CAAC;gBACnD,OAAO,UAAU,CAAC,GAAG,EAAE,gDAAgD,EAAE,GAAG,CAAC,CAAA;YAC9E;gBACC,CAAC,CAAC,KAAK,CAAC,yCAAyC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;gBACtG,OAAO,UAAU,CAAC,GAAG,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAA;QACxE,CAAC;IACF,CAAC;AACF,CAAC,CAAA;AAED,oFAAoF;AACpF,MAAM,UAAU,GAAG,CAAC,GAAqC,EAAU,EAAE;IACpE,OAAO,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAClG,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAqC,EAAE,GAAoB,EAAqB,EAAE;IACpH,IAAI,CAAC;QACJ,OAAO,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN,KAAK,CAAC,GAAG,YAAY,aAAa,CAAC;gBAClC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,oCAAoC;oBAC7C,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAElC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC5D,CAAC;CACD;AAED,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;AAElF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAkB,EAAE,OAAqC,EAAE,KAAc,EAAY,EAAE;IACzH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,GAAG,GAAG,CAAC,oCAAoC,CAAA;IACjD,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,6DAA6D;IAC7D,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,+CAA+C,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACvE,MAAM,IAAI,oBAAoB,CAAC,OAAO,KAAK,gDAAgD,CAAC,CAAA;IAC7F,CAAC;IAEA,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAA;IAEtB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,kDAAkD,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAC1E,OAAO,EAAE,CAAA;IACV,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC,IAAI,CAAC,gCAAgC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACxD,OAAO,EAAE,CAAA;IACV,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,2CAA2C,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACnE,OAAO,EAAE,CAAA;IACV,CAAC;IAED,0EAA0E;IAC1E,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACjD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAE7C,CAAC,CAAC,KAAK,CAAC,oCAAoC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAA;IAEvE,OAAO,UAAU,CAAA;AAClB,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAuB,EAAE,KAAc,EAA0B,EAAE;IAC1H,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC9B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;IAE1F,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IAE1D,OAAO;QACN,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,UAAU;KACtB,CAAA;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAkC,EAAE;IACrI,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,oCAAoC,CAAC,CAAA;QAExF,OAAO,QAAQ,CAAA;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,GAAG,YAAY,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC;YAC7F,KAAK,EAAE,GAAG;SACV,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAqC,EAAE,GAAoB,EAA0B,EAAE;IAC3H,IAAI,CAAC;QACJ,OAAO,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN,KAAK,CAAC,GAAG,YAAY,qBAAqB,CAAC;gBAC1C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,qCAAqC;oBAC9C,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAUD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAA6B,EAAE,GAAoB,EAAkB,EAAE;IACzI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC3G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAoC,EAAE;IAC5I,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,OAAO,IAAI,wBAAwB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;IACzG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACzC,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACpH,OAAO,UAAU,CAAC,GAAG,EAAE,+CAA+C,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC;AACF,CAAC,CAAA;AAYD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAiC,EAAE,GAAoB,EAAkB,EAAE;IACjJ,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAA;IAEhE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAElB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;YAClE,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACnC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAA;YACzD,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAEf,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACzE,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAOD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,WAA2B,EAA+B,EAAE;IAC9J,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO,oDAAoD,CAAA;IAC5D,CAAC;IAED,sEAAsE;IACtE,wDAAwD;IACxD,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO,oDAAoD,CAAA;IAC5D,CAAC;IAED,sEAAsE;IACtE,mEAAmE;IACnE,8CAA8C;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,IAAI,GAAG,IAAI,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,OAAO,qCAAqC,CAAA;IAC7C,CAAC;IACD,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC;QACxF,OAAO,2CAA2C,CAAA;IACnD,CAAC;IAED,0DAA0D;IAC1D,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,OAAO,qCAAqC,CAAA;IAC7C,CAAC;IAED,OAAO,SAAS,CAAA;AACjB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,GAAoC,EAAE,GAAoB,EAAkB,EAAE;IACjL,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;QAC/E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QACpC,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,qEAAqE;QACrE,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,4BAA4B,CAAC,CAAA;YACxD,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,2CAA2C,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACtG,OAAO,UAAU,CAAC,GAAG,EAAE,2CAA2C,EAAE,GAAG,CAAC,CAAA;IACzE,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,GAAiC,EAAE,GAAoB,EAAkB,EAAE;IAChL,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;QAC/E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QACpC,CAAC;QAED,uFAAuF;QACvF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YACnE,OAAO,UAAU,CAAC,GAAG,EAAE,8EAA8E,EAAE,GAAG,CAAC,CAAA;QAC5G,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,qEAAqE;QACrE,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,8BAA8B,CAAC,CAAA;YAC1D,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAQD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAA4B,EAAE,GAAoB,EAAkB,EAAE;IACvI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAY,EAAE;IACxD,OAAO,CAAC,KAAK,SAAS;QACrB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;YACtB,CAAC,CAAC,CAAC,KAAK,EAAE;gBACT,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,CAAC,CAAA;AACN,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAkB,EAAuB,EAAE;IAC9E,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,CAAA;IAE1C,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;AAC/B,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAgB,EAAsB,EAAE;IAC3F,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;IAC/B,CAAC;IAED,OAAO,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AAChD,CAAC,CAAA"}