@e-sig/core 0.4.0

package/dist/render-pdf.js

@@ -0,0 +1,86 @@
+// src/lib/integrations/esig/core/render-pdf.ts
+//
+// Portable HTML → PDF renderer. puppeteer-core under the hood; auto-detects
+// Lambda environment to use @sparticuz/chromium, falls back to system Chrome
+// for local dev.
+import puppeteer from "puppeteer-core";
+async function resolveExecutablePath(opts) {
+    if (opts.executablePath)
+        return opts.executablePath;
+    if (process.env.AWS_LAMBDA_FUNCTION_NAME || process.env.VERCEL_ENV) {
+        const chromium = (await import("@sparticuz/chromium")).default;
+        return await chromium.executablePath();
+    }
+    if (process.platform === "darwin") {
+        return "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome";
+    }
+    for (const p of [
+        "/usr/bin/google-chrome",
+        "/usr/bin/chromium",
+        "/usr/bin/chromium-browser",
+        "/snap/bin/chromium",
+    ]) {
+        try {
+            const fs = await import("node:fs");
+            await fs.promises.access(p, fs.constants.X_OK);
+            return p;
+        }
+        catch {
+            // try next
+        }
+    }
+    throw new Error("renderHtmlToPdf: no Chrome/Chromium executable found. Install Chrome or pass options.executablePath.");
+}
+async function resolveLaunchArgs(opts) {
+    if (opts.launchArgs)
+        return opts.launchArgs;
+    if (process.env.AWS_LAMBDA_FUNCTION_NAME || process.env.VERCEL_ENV) {
+        const chromium = (await import("@sparticuz/chromium")).default;
+        return chromium.args;
+    }
+    return ["--no-sandbox", "--disable-setuid-sandbox"];
+}
+export async function renderHtmlToPdf(opts) {
+    const executablePath = await resolveExecutablePath(opts);
+    const args = await resolveLaunchArgs(opts);
+    const jsEnabled = opts.javascriptEnabled ?? false;
+    const timeout = opts.timeoutMs ?? 30_000;
+    let browser;
+    try {
+        browser = await puppeteer.launch({ args, executablePath, headless: true });
+        const page = await browser.newPage();
+        if (!jsEnabled)
+            await page.setJavaScriptEnabled(false);
+        // "load" (not domcontentloaded) so embedded images and logos finish loading
+        // before the snapshot — otherwise page.pdf() can capture a blank signature
+        // image. The load event waits for all referenced subresources.
+        await page.setContent(opts.html, { waitUntil: "load", timeout });
+        if (jsEnabled) {
+            // Belt-and-suspenders: wait for web fonts to settle (only meaningful when
+            // scripting is enabled; reached via globalThis to avoid a DOM-lib dep).
+            await page
+                .evaluate(() => {
+                const d = globalThis.document;
+                return d?.fonts?.ready;
+            })
+                .catch(() => undefined);
+        }
+        const pdfBuf = await page.pdf({
+            format: opts.format ?? "Letter",
+            margin: opts.margin ?? {
+                top: "0.5in",
+                bottom: "0.5in",
+                left: "0.5in",
+                right: "0.5in",
+            },
+            printBackground: opts.printBackground ?? true,
+        });
+        return Buffer.from(pdfBuf);
+    }
+    finally {
+        if (browser) {
+            await browser.close().catch(() => undefined);
+        }
+    }
+}
+//# sourceMappingURL=render-pdf.js.map

package/dist/render-pdf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-pdf.js","sourceRoot":"","sources":["../src/render-pdf.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,iBAAiB;AAEjB,OAAO,SAA6C,MAAM,gBAAgB,CAAC;AA4B3E,KAAK,UAAU,qBAAqB,CAAC,IAA4B;IAC/D,IAAI,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC,cAAc,CAAC;IACpD,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/D,OAAO,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,8DAA8D,CAAC;IACxE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI;QACd,wBAAwB;QACxB,mBAAmB;QACnB,2BAA2B;QAC3B,oBAAoB;KACrB,EAAE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC;QACX,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAA4B;IAC3D,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC,UAAU,CAAC;IAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/D,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAA4B;IAChE,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IACzC,IAAI,OAA4B,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACvD,4EAA4E;QAC5E,2EAA2E;QAC3E,+DAA+D;QAC/D,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACjE,IAAI,SAAS,EAAE,CAAC;YACd,0EAA0E;YAC1E,wEAAwE;YACxE,MAAM,IAAI;iBACP,QAAQ,CAAC,GAAG,EAAE;gBACb,MAAM,CAAC,GAAI,UAAsE,CAAC,QAAQ,CAAC;gBAC3F,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC;YACzB,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,QAAQ;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI;gBACrB,GAAG,EAAE,OAAO;gBACZ,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,OAAO;aACf;YACD,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,IAAI;SAC9C,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;YAAS,CAAC;QACT,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/sign-document.d.ts

@@ -0,0 +1,54 @@
+import type { CertStore, AuditLogStore, PdfStorageStore, EsigAuditAction } from "./adapters.js";
+import type { TsaTransport } from "./types.js";
+export interface SignDocumentInput {
+    /** Fully-rendered, signature-embedded HTML (the consumer composes this). */
+    html: string;
+    /** Optional signature image to persist alongside the PDF (e.g. the drawn PNG). */
+    signatureImage?: {
+        bytes: Uint8Array;
+        contentType: string;
+    };
+    /** Tenant whose signing cert is used + audit/storage partition key. */
+    tenantId: string;
+    /** Cert subject CN — ASCII-clean tenant/org display name. */
+    subjectName: string;
+    /** Key-at-rest passphrase for the CertStore. */
+    passphrase: string;
+    signer: {
+        name: string;
+        email?: string;
+    };
+    actorUserId?: string | null;
+    certStore: CertStore;
+    auditStore: AuditLogStore;
+    storage: PdfStorageStore;
+    /** Storage path prefix, e.g. `${tenantId}/${documentId}`. A timestamped filename is appended. */
+    pathPrefix: string;
+    /** signPdf signature metadata. */
+    reason?: string;
+    location?: string;
+    signingTime?: Date;
+    /** Optional RFC-3161 timestamp transport. Provide one to upgrade to CAdES-T. */
+    tsa?: TsaTransport;
+    /** Audit row fields. */
+    action?: EsigAuditAction | string;
+    targetTable?: string;
+    targetId?: string;
+    ip?: string;
+    userAgent?: string;
+    sessionId?: string;
+    /** Extra audit metadata merged into the row (consent text, signer email, etc.). */
+    metadata?: Record<string, unknown>;
+}
+export interface SignDocumentResult {
+    signedPdfUrl: string;
+    signatureImageUrl?: string;
+    auditLogId: string;
+    certId: string;
+    certFingerprint: string;
+    /** True when an RFC-3161 token was embedded (CAdES-T); false = CAdES-B. */
+    timestamped: boolean;
+    tsaError?: string;
+}
+export declare function signDocument(input: SignDocumentInput): Promise<SignDocumentResult>;
+//# sourceMappingURL=sign-document.d.ts.map

package/dist/sign-document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-document.d.ts","sourceRoot":"","sources":["../src/sign-document.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,SAAS,EACT,aAAa,EACb,eAAe,EACf,eAAe,EAChB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,cAAc,CAAC,EAAE;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAE5D,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IAEnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5B,SAAS,EAAE,SAAS,CAAC;IACrB,UAAU,EAAE,aAAa,CAAC;IAC1B,OAAO,EAAE,eAAe,CAAC;IAEzB,iGAAiG;IACjG,UAAU,EAAE,MAAM,CAAC;IAEnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,gFAAgF;IAChF,GAAG,CAAC,EAAE,YAAY,CAAC;IAEnB,wBAAwB;IACxB,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,YAAY,CAChC,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAmF7B"}

package/dist/sign-document.js

@@ -0,0 +1,93 @@
+// sign-document.ts
+//
+// Generic server-side signing orchestrator — the reusable spine of a
+// "self-sign" endpoint, stack-agnostic over the three pluggable stores.
+//
+//   renderHtmlToPdf → ensureActiveCert → signPdf (+ optional RFC-3161 TSA)
+//   → PdfStorageStore.upload → AuditLogStore.insert
+//
+// Document-specific glue (loading a row, building the HTML/template, RBAC, and
+// updating your domain table afterward) stays in the CONSUMER. You pass in the
+// fully-rendered `html`, the signer, the stores, and storage layout; you get
+// back the stored URL + audit id + cert fingerprint to persist on your row.
+import { renderHtmlToPdf } from "./render-pdf.js";
+import { signPdf } from "./sign-pdf.js";
+import { ensureActiveCert } from "./cert-lifecycle.js";
+export async function signDocument(input) {
+    const signedAt = input.signingTime ?? new Date();
+    // 1. HTML → unsigned PDF.
+    const unsignedPdf = await renderHtmlToPdf({ html: input.html });
+    // 2. Ensure an active signing cert for the tenant (create/rotate as needed).
+    const cert = await ensureActiveCert({
+        store: input.certStore,
+        tenantId: input.tenantId,
+        subjectName: input.subjectName,
+        passphrase: input.passphrase,
+    });
+    // 3. PKCS#7 detached sign (+ optional TSA → CAdES-T).
+    const r = await signPdf({
+        pdf: unsignedPdf,
+        keyPem: cert.keyPem,
+        certPem: cert.certPem,
+        reason: input.reason ?? "Document acceptance",
+        location: input.location ?? "",
+        contactInfo: input.signer.email ?? "",
+        name: input.signer.name,
+        signingTime: signedAt,
+        tsa: input.tsa,
+    });
+    // 4. Persist the signed PDF (+ optional signature image).
+    const tsKey = signedAt.toISOString().replace(/[:.]/g, "-");
+    const pdfPath = `${input.pathPrefix}/${tsKey}.pdf`;
+    const pdfUp = await input.storage.upload({
+        path: pdfPath,
+        bytes: r.signedPdf,
+        contentType: "application/pdf",
+    });
+    let signatureImageUrl;
+    if (input.signatureImage) {
+        const sigPath = `${input.pathPrefix}/${tsKey}-signature.png`;
+        const sigUp = await input.storage.upload({
+            path: sigPath,
+            bytes: input.signatureImage.bytes,
+            contentType: input.signatureImage.contentType,
+        });
+        signatureImageUrl = sigUp.url;
+    }
+    // 5. Append the attribution audit row (ESIGN R3 / UETA §13).
+    const audit = await input.auditStore.insert({
+        tenantId: input.tenantId,
+        action: input.action ?? "pdf.signed",
+        actorUserId: input.actorUserId ?? null,
+        targetTable: input.targetTable,
+        targetId: input.targetId,
+        certId: cert.cert.id,
+        certFingerprint: cert.cert.certFingerprint,
+        ip: input.ip,
+        userAgent: input.userAgent,
+        sessionId: input.sessionId,
+        signedPdfUrl: pdfUp.url,
+        metadata: {
+            ...(input.metadata ?? {}),
+            ...(signatureImageUrl ? { signature_image_url: signatureImageUrl } : {}),
+            signer_name: input.signer.name,
+            ...(input.signer.email ? { signer_email: input.signer.email } : {}),
+            timestamp: {
+                attempted: !!input.tsa,
+                present: r.timestamped,
+                degraded: !!input.tsa && !r.timestamped,
+                error: r.tsaError ?? null,
+            },
+        },
+    });
+    return {
+        signedPdfUrl: pdfUp.url,
+        signatureImageUrl,
+        auditLogId: audit.id,
+        certId: cert.cert.id,
+        certFingerprint: cert.cert.certFingerprint,
+        timestamped: r.timestamped,
+        tsaError: r.tsaError,
+    };
+}
+//# sourceMappingURL=sign-document.js.map

package/dist/sign-document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-document.js","sourceRoot":"","sources":["../src/sign-document.ts"],"names":[],"mappings":"AAAA,mBAAmB;AACnB,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,EAAE;AACF,2EAA2E;AAC3E,oDAAoD;AACpD,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAE5E,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AA6DvD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAwB;IAExB,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC;IAEjD,0BAA0B;IAC1B,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAEhE,6EAA6E;IAC7E,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;QAClC,KAAK,EAAE,KAAK,CAAC,SAAS;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,sDAAsD;IACtD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC;QACtB,GAAG,EAAE,WAAW;QAChB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,qBAAqB;QAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;QAC9B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;QACvB,WAAW,EAAE,QAAQ;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,CAAC,CAAC;IAEH,0DAA0D;IAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,MAAM,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACvC,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,CAAC,CAAC,SAAS;QAClB,WAAW,EAAE,iBAAiB;KAC/B,CAAC,CAAC;IAEH,IAAI,iBAAqC,CAAC;IAC1C,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,gBAAgB,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACvC,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK;YACjC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,WAAW;SAC9C,CAAC,CAAC;QACH,iBAAiB,GAAG,KAAK,CAAC,GAAG,CAAC;IAChC,CAAC;IAED,6DAA6D;IAC7D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,YAAY;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACpB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;QAC1C,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,GAAG;QACvB,QAAQ,EAAE;YACR,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;YACzB,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YAC9B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,SAAS,EAAE;gBACT,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG;gBACtB,OAAO,EAAE,CAAC,CAAC,WAAW;gBACtB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW;gBACvC,KAAK,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;aAC1B;SACF;KACF,CAAC,CAAC;IAEH,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,GAAG;QACvB,iBAAiB;QACjB,UAAU,EAAE,KAAK,CAAC,EAAE;QACpB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACpB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;QAC1C,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;KACrB,CAAC;AACJ,CAAC"}

package/dist/sign-pdf.d.ts

@@ -0,0 +1,46 @@
+import type { TsaTransport } from "./types.js";
+export interface SignPdfInput {
+    pdf: Buffer;
+    keyPem: string;
+    certPem: string;
+    reason: string;
+    location: string;
+    contactInfo: string;
+    name: string;
+    signingTime?: Date;
+    /**
+     * Signature length budget in bytes. 8192 fits RSA-2048 + single cert
+     * comfortably (actual PKCS#7 is typically 1.5–2 KB). When `tsa` is provided
+     * and this is omitted, the default rises to 30720 to fit the TimeStampToken.
+     */
+    signatureLength?: number;
+    /**
+     * Subfilter. Default ETSI.CAdES.detached (PAdES B-B baseline). Override
+     * to adbe.pkcs7.detached for legacy Adobe Reader 9+ compatibility.
+     */
+    subFilter?: string;
+    /**
+     * Optional RFC 3161 timestamp transport. When provided, the signature is
+     * upgraded to CAdES-T and the default `signatureLength` rises to 30720. The
+     * caller injects the network POST; the TSA only ever receives a SHA-256 hash,
+     * never PHI.
+     */
+    tsa?: TsaTransport;
+    /**
+     * Strict PAdES baseline mode: drop the PAdES-forbidden `signing-time` signed
+     * attribute (claimed time then comes from the TSA / verifier context). The ESS
+     * `signing-certificate-v2` attribute is always added regardless. Default false
+     * (keeps `signing-time` for backward compatibility).
+     */
+    padesStrict?: boolean;
+}
+export interface SignPdfResult {
+    signedPdf: Buffer;
+    placeholderBudget: number;
+    /** True if an RFC 3161 TimeStampToken was embedded (CAdES-T). */
+    timestamped: boolean;
+    /** Present when a non-required TSA request failed (signature is CAdES-B). */
+    tsaError?: string;
+}
+export declare function signPdf(input: SignPdfInput): Promise<SignPdfResult>;
+//# sourceMappingURL=sign-pdf.d.ts.map

package/dist/sign-pdf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-pdf.d.ts","sourceRoot":"","sources":["../src/sign-pdf.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAW/C,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAC;IACrB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID,wBAAsB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAyCzE"}

package/dist/sign-pdf.js

@@ -0,0 +1,60 @@
+// src/lib/integrations/esig/core/sign-pdf.ts
+//
+// Portable PDF signing — placeholder injection + PKCS#7 detached sign.
+// Uses ETSI.CAdES.detached subfilter (modern PAdES, not legacy Adobe).
+//
+// RFC 3161 (CAdES-T): pass `tsa` to embed an RFC 3161 TimeStampToken. When a
+// TSA is supplied the default /Contents budget is raised to fit the TST + TSA
+// cert chain, and an overflow guard rejects a result whose PKCS#7 exceeded the
+// placeholder (which @signpdf would otherwise silently truncate).
+import { SignPdf } from "@signpdf/signpdf";
+import { plainAddPlaceholder } from "@signpdf/placeholder-plain";
+import { PemSigner } from "./pem-signer.js";
+import { verifyPdfStructure } from "./verify-pdf.js";
+/** Default /Contents budget (bytes) when no timestamp is embedded. */
+const DEFAULT_SIGNATURE_LENGTH = 8192;
+/**
+ * Default /Contents budget (bytes) when an RFC 3161 timestamp is embedded.
+ * A TST plus the TSA cert chain adds several KB; /Contents is hex so 30720
+ * bytes ≈ 15 KB of DER headroom.
+ */
+const TIMESTAMPED_SIGNATURE_LENGTH = 30720;
+const signpdfInstance = new SignPdf();
+export async function signPdf(input) {
+    const budget = input.signatureLength ??
+        (input.tsa ? TIMESTAMPED_SIGNATURE_LENGTH : DEFAULT_SIGNATURE_LENGTH);
+    const withPlaceholder = plainAddPlaceholder({
+        pdfBuffer: input.pdf,
+        reason: input.reason,
+        contactInfo: input.contactInfo,
+        name: input.name,
+        location: input.location,
+        signatureLength: budget,
+        subFilter: input.subFilter ?? "ETSI.CAdES.detached",
+    });
+    const signer = new PemSigner({
+        keyPem: input.keyPem,
+        certPem: input.certPem,
+        tsa: input.tsa,
+        padesStrict: input.padesStrict,
+    });
+    const signed = await signpdfInstance.sign(withPlaceholder, signer, input.signingTime);
+    // Overflow guard: @signpdf silently truncates if the PKCS#7 exceeds the
+    // /Contents placeholder. Re-parse and fail loudly if it did not fit (this
+    // matters most on the timestamped path, where the TST is large). We compare
+    // the actual PKCS#7 size against the structurally-measured /Contents budget.
+    const structure = verifyPdfStructure(signed);
+    const actual = structure.pkcs7ActualSize ?? 0;
+    const measuredBudget = structure.pkcs7BudgetSize ?? budget;
+    if (actual >= measuredBudget) {
+        throw new Error(`PKCS#7 (${actual} bytes) exceeded placeholder budget (${measuredBudget}) — increase signatureLength`);
+    }
+    // placeholderBudget reports the requested budget (backward compatible).
+    return {
+        signedPdf: signed,
+        placeholderBudget: budget,
+        timestamped: signer.lastTimestamped,
+        tsaError: signer.lastTsaError,
+    };
+}
+//# sourceMappingURL=sign-pdf.js.map

package/dist/sign-pdf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-pdf.js","sourceRoot":"","sources":["../src/sign-pdf.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,kEAAkE;AAElE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGrD,sEAAsE;AACtE,MAAM,wBAAwB,GAAG,IAAI,CAAC;AACtC;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,KAAK,CAAC;AA+C3C,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAmB;IAC/C,MAAM,MAAM,GACV,KAAK,CAAC,eAAe;QACrB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,eAAe,GAAG,mBAAmB,CAAC;QAC1C,SAAS,EAAE,KAAK,CAAC,GAAG;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,eAAe,EAAE,MAAM;QACvB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,qBAAqB;KACpD,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAEtF,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,IAAI,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,SAAS,CAAC,eAAe,IAAI,MAAM,CAAC;IAC3D,IAAI,MAAM,IAAI,cAAc,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,WAAW,MAAM,wCAAwC,cAAc,8BAA8B,CACtG,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,OAAO;QACL,SAAS,EAAE,MAAM;QACjB,iBAAiB,EAAE,MAAM;QACzB,WAAW,EAAE,MAAM,CAAC,eAAe;QACnC,QAAQ,EAAE,MAAM,CAAC,YAAY;KAC9B,CAAC;AACJ,CAAC"}

package/dist/signature-block.d.ts

@@ -0,0 +1,23 @@
+export interface SignatureBlockEntry {
+    name: string;
+    email: string;
+    signatureImageDataUrl: string;
+    signedAt: Date;
+    /** Optional human role label shown above the signature ("Principal investigator", "Witness", ...). */
+    roleLabel?: string;
+}
+/**
+ * Render a stack of signature blocks as standalone HTML, suitable for
+ * concatenating into a document body before HTML→PDF rendering.
+ *
+ * Pattern: one signature per row, with name + role + image + timestamp.
+ * Plus a trailing audit line tying the PDF back to the platform.
+ */
+export declare function renderSignatureBlocksHtml(opts: {
+    signers: SignatureBlockEntry[];
+    platformLabel?: string;
+    platformUrl?: string;
+}): string;
+export declare function escapeHtml(s: string): string;
+export declare function assertImageDataUrl(dataUrl: string): string;
+//# sourceMappingURL=signature-block.d.ts.map

package/dist/signature-block.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-block.d.ts","sourceRoot":"","sources":["../src/signature-block.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,IAAI,CAAC;IACf,sGAAsG;IACtG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAiCT;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAO5C;AASD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAS1D"}

package/dist/signature-block.js

@@ -0,0 +1,63 @@
+// src/lib/integrations/esig/core/signature-block.ts
+//
+// Phase 21 — portable HTML signature-block rendering for the e-sig pipeline.
+// Used by both single-party and multi-party flows. Project-agnostic.
+/**
+ * Render a stack of signature blocks as standalone HTML, suitable for
+ * concatenating into a document body before HTML→PDF rendering.
+ *
+ * Pattern: one signature per row, with name + role + image + timestamp.
+ * Plus a trailing audit line tying the PDF back to the platform.
+ */
+export function renderSignatureBlocksHtml(opts) {
+    const platform = opts.platformLabel ?? "self-contained e-signature pipeline";
+    const url = opts.platformUrl ?? "";
+    const rows = opts.signers
+        .map((s) => `
+  <div class="signature-row">
+    ${s.roleLabel ? `<p class="role-label">${escapeHtml(s.roleLabel)}</p>` : ""}
+    <p><strong>Signed electronically by:</strong> ${escapeHtml(s.name)}${s.email ? ` &lt;${escapeHtml(s.email)}&gt;` : ""}</p>
+    <img src="${assertImageDataUrl(s.signatureImageDataUrl)}" alt="Signature of ${escapeHtml(s.name)}">
+    <p class="signature-meta">Signed at ${s.signedAt.toISOString()}</p>
+  </div>`)
+        .join("\n");
+    return `<div class="signature-block">
+  <style>
+    .signature-block { margin-top: 64px; border-top: 1px solid #999; padding-top: 16px; }
+    .signature-row { margin: 16px 0; padding: 12px 0; border-bottom: 1px dashed #ddd; }
+    .signature-row:last-child { border-bottom: none; }
+    .signature-row img { display: block; max-height: 96px; margin: 8px 0; }
+    .signature-meta { color: #555; font-size: 11px; margin-top: 4px; }
+    .role-label { font-style: italic; color: #444; margin: 0 0 4px; }
+    .audit-footer { color: #555; font-size: 11px; margin-top: 12px; }
+  </style>
+  ${rows}
+  <p class="audit-footer">
+    Cryptographically sealed via the Opendelphi ${platform}${url ? ` (${escapeHtml(url)})` : ""}.
+    Any post-signing modification invalidates the signature panel in Adobe Reader / Preview.
+  </p>
+</div>`;
+}
+export function escapeHtml(s) {
+    return s
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+/**
+ * A base64 image data URL (png/jpeg/webp/gif) — the only shape allowed into the
+ * signature `<img src>`. Rejecting anything else prevents attribute-breakout /
+ * script/URL injection into the rendered (and then signed) PDF.
+ */
+const IMAGE_DATA_URL = /^data:image\/(png|jpe?g|webp|gif);base64,[A-Za-z0-9+/]+={0,2}$/;
+export function assertImageDataUrl(dataUrl) {
+    const compact = (dataUrl ?? "").replace(/\s+/g, "");
+    if (!IMAGE_DATA_URL.test(compact)) {
+        throw new Error("renderSignatureBlocksHtml: signatureImageDataUrl must be a base64 image data URL " +
+            "(data:image/png;base64,…). Refusing to interpolate untrusted content into the signed PDF.");
+    }
+    return compact;
+}
+//# sourceMappingURL=signature-block.js.map

package/dist/signature-block.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-block.js","sourceRoot":"","sources":["../src/signature-block.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,6EAA6E;AAC7E,qEAAqE;AAWrE;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAIzC;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI,qCAAqC,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO;SACtB,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CAAC;;MAEP,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,yBAAyB,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;oDAC3B,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAChE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAChD;gBACY,kBAAkB,CAAC,CAAC,CAAC,qBAAqB,CAAC,uBAAuB,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;0CAC1D,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE;SACzD,CACJ;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;;;;;;;IAUL,IAAI;;kDAE0C,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;;;OAGxF,CAAC;AACR,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,cAAc,GAAG,gEAAgE,CAAC;AAExF,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,mFAAmF;YACjF,2FAA2F,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/timestamp.d.ts

@@ -0,0 +1,59 @@
+import forge from "node-forge";
+/** OID for the id-aa-timeStampToken unsigned attribute (RFC 3161). */
+export declare const OID_TIMESTAMP_TOKEN = "1.2.840.113549.1.9.16.2.14";
+/** Convert a forge binary string (DER) to a Uint8Array. */
+export declare function derStringToUint8(der: string): Uint8Array;
+/** Convert a Uint8Array to a forge binary string (DER). */
+export declare function uint8ToDerString(bytes: Uint8Array): string;
+/**
+ * Build an RFC 3161 TimeStampReq (DER, forge binary string) over the given
+ * signatureValue bytes.
+ *
+ *   TimeStampReq ::= SEQUENCE {
+ *     version        INTEGER { v1(1) },
+ *     messageImprint MessageImprint,
+ *     reqPolicy      TSAPolicyId OPTIONAL,   -- omitted
+ *     nonce          INTEGER OPTIONAL,
+ *     certReq        BOOLEAN DEFAULT FALSE }
+ *
+ *   MessageImprint ::= SEQUENCE {
+ *     hashAlgorithm AlgorithmIdentifier,
+ *     hashedMessage OCTET STRING }
+ *
+ * The messageImprint hash input is the RAW signatureValue bytes (a forge
+ * binary string), hashed with SHA-256.
+ */
+export declare function buildTimeStampReq(sigValueBinary: string): string;
+/**
+ * Parse an RFC 3161 TimeStampResp (DER forge binary string) and return the
+ * embedded TimeStampToken as a forge ASN.1 object.
+ *
+ *   TimeStampResp ::= SEQUENCE {
+ *     status         PKIStatusInfo,
+ *     timeStampToken TimeStampToken OPTIONAL }
+ *
+ *   PKIStatusInfo ::= SEQUENCE {
+ *     status       PKIStatus (INTEGER),
+ *     statusString PKIFreeText OPTIONAL,
+ *     failInfo     PKIFailureInfo OPTIONAL }
+ *
+ * Accepts status 0 (granted) or 1 (grantedWithMods); throws otherwise, with the
+ * integer status and (if present) failInfo bits.
+ */
+export declare function parseTimeStampResp(respBinary: string): {
+    token: forge.asn1.Asn1;
+};
+/**
+ * Parse a TimeStampToken (a CMS SignedData ContentInfo whose eContentType is
+ * id-ct-TSTInfo) and extract best-effort metadata. Only
+ * `messageImprintHashHex` is treated as load-bearing (used by the verifier's
+ * §2.4.2 binding check); the rest are returned as undefined on any parse miss
+ * rather than throwing.
+ */
+export declare function parseTstInfo(tokenAsn1: forge.asn1.Asn1): {
+    genTime?: string;
+    serialHex?: string;
+    tsaCommonName?: string;
+    messageImprintHashHex?: string;
+};
+//# sourceMappingURL=timestamp.d.ts.map

package/dist/timestamp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timestamp.d.ts","sourceRoot":"","sources":["../src/timestamp.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,MAAM,YAAY,CAAC;AAI/B,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,+BAA+B,CAAC;AAOhE,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAIxD;AAED,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAW1D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAsDhE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAA;CAAE,CAgCjF;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,CAsGA"}