@e-sig/core 0.5.1 → 0.7.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Opendelphi contributors
+Copyright (c) 2026 VMVTech, Ltd.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -15,6 +15,7 @@ Given an HTML document and a person who wants to sign it, this library:
 2. Generates or reuses a self-signed RSA-2048 X.509 cert for the signing tenant.
 3. Embeds a PKCS#7 detached signature under the **ETSI.CAdES.detached** subfilter, with the ESS **signing-certificate-v2** attribute binding the signer cert into the signed data. Pass `padesStrict: true` for strict **PAdES B-B** (also drops the PAdES-forbidden `signing-time` attribute).
 4. Produces a PDF that opens cleanly in Preview / Adobe Reader with a valid signature panel — any post-signing edit invalidates the signature. `verifyPdfSignature()` checks this cryptographically (recomputes the digest over the signed ByteRange and RSA-verifies the signature).
+5. *(Optional)* Adds a **post-quantum hybrid seal** — **Ed25519 + ML-DSA-65 (FIPS 204)** — embedded under the classical signature so the PDF stays Acrobat-valid while gaining quantum resistance. See [Post-quantum seal](#post-quantum-seal--ml-dsa-65-fips-204).
 
 > **Trust vs. validity.** The signature is cryptographically *valid*, but the cert is *self-issued* — stock Adobe Reader shows "validity unknown" until the cert is trusted (org trust-store import, or plug in an AATL/CA signer). This verifies the signature math and integrity, not third-party trust. See the compliance notes below.
 
@@ -45,6 +46,10 @@ The library gives you **crypto + rendering**. You bring **persistence + UI + aut
 | `render-pdf.ts` | HTML → PDF via puppeteer-core; auto-detects Lambda vs local Chrome | ✅ |
 | `sign-pdf.ts` | Combine placeholder injection + PKCS#7 sign (ETSI.CAdES) | ✅ |
 | `verify-pdf.ts` | Structural verifier (parses /ByteRange + PKCS#7 blob, returns diagnostics) | ✅ |
+| `pq-seal.ts` | Hybrid **Ed25519 + ML-DSA-65 (FIPS 204)** post-quantum seal — keygen, sign, verify | ✅ |
+| `pq-embed.ts` | Embed/extract the seal in a PDF as an append-only incremental update | ✅ |
+| `pq-verify.ts` | `verifyPqSeal` + `verifyDocument` (classical **and** post-quantum verdict) | ✅ |
+| `pq-lifecycle.ts` | `ensureActivePqKeys` / `rotatePqKeys` over a bring-your-own `PqKeyStore` | ✅ |
 | `signature-block.ts` | HTML helper to render N signature blocks for multi-party flows | ✅ |
 | `types.ts` | Shared TS types (`Signer`, `SigningCertPem`, …) | ✅ |
 | `index.ts` | Public re-export barrel | ✅ |
@@ -187,6 +192,93 @@ See `CONSUMING.md` for the full consumer guide.
 
 ---
 
+## Post-quantum seal — ML-DSA-65 (FIPS 204)
+
+Harvest-now-decrypt-later is a real threat to long-lived signed documents: a
+signature that is only RSA/ECDSA today is forgeable the day a cryptographically
+relevant quantum computer exists. `@e-sig/core` can add a **hybrid post-quantum
+seal** — **Ed25519 + ML-DSA-65** (the FIPS 204 module-lattice signature, née
+Dilithium) — to any signed PDF, without giving up compatibility.
+
+**How it stays compatible:** the seal does **not** replace the PKCS#7/PAdES RSA
+signature (no mainstream PDF reader validates ML-DSA in PAdES yet). The seal is
+embedded *first*, as an append-only incremental update, and the classical RSA
+signature is applied on top — so it **cryptographically covers the seal**. Adobe
+Acrobat still shows a valid signature; your verifier additionally confirms the
+quantum-resistant layer. This is the hybrid migration path NIST/CNSA 2.0 
+recommend over a hard cutover.
+
+```ts
+import {
+  generateSelfSignedCert,
+  generatePqKeyBundle,
+  loadPqSigningKeys,
+  signPdf,
+  verifyDocument,
+} from "@e-sig/core";
+
+const cert = generateSelfSignedCert({ subjectName: "Acme Corp" });
+
+// One hybrid key bundle per signer/tenant (persist wrapPqKeyBundle(...) at rest;
+// or use ensureActivePqKeys with a PqKeyStore — see below).
+const pqKeys = loadPqSigningKeys(generatePqKeyBundle().bundle);
+
+const { signedPdf } = await signPdf({
+  pdf: unsigned,
+  keyPem: cert.keyPem,
+  certPem: cert.certPem,
+  reason: "Service Agreement acceptance",
+  location: "",
+  contactInfo: "jane@example.com",
+  name: "Jane Doe",
+  pqSeal: { keys: pqKeys },   // ← adds the post-quantum seal
+});
+
+// One call, two verdicts:
+const v = verifyDocument(signedPdf);
+console.log("classical (PAdES/RSA):", v.classical.ok);          // → true (Acrobat-grade)
+console.log("post-quantum (ML-DSA-65):", v.postQuantum.ok);     // → true
+console.log("PQ signer fingerprint:", v.postQuantum.mldsa65Fpr);
+// v.ok === true only when BOTH layers verify AND the seal lies inside the
+// RSA-signed region. Tampering with one byte of the document fails BOTH.
+```
+
+**Managed keys.** `ensureActivePqKeys({ store, tenantId, passphrase })` mints +
+wraps a bundle on first use and reuses it thereafter (implement the small
+`PqKeyStore` interface against your DB, same pattern as `CertStore`);
+`rotatePqKeys(...)` rolls to a fresh key while old documents keep verifying
+against the public key embedded in each seal. `signDocument({ pq: { keys } })`
+threads it through the end-to-end orchestrator and records the PQ key id +
+ML-DSA fingerprint in the audit row.
+
+**Trust model (v1).** The seal carries the raw ML-DSA-65 public key + its
+SHA-256 fingerprint; a relying party pins/publishes the expected fingerprint
+(TOFU). Assert it in-band:
+
+```ts
+verifyDocument(signedPdf, {
+  expectedMldsa65Fpr: "<the signer's published fingerprint>", // fails if it differs
+  requirePq: true,                                            // fails if no seal present (no silent downgrade)
+});
+```
+
+**X.509 identity (RFC 9881).** For an enterprise-shaped identity, issue a
+self-signed **ML-DSA-65 X.509 certificate** (OID `2.16.840.1.101.3.4.3.18`) —
+its SubjectPublicKeyInfo *and* signature are ML-DSA-65, so it parses and verifies
+in OpenSSL 3.5+ (validated against 3.6). Bind it to a seal at verify time:
+
+```ts
+const cert = issueMlDsaCertificate({ keys, subjectName: "Acme Inc" }); // publish cert.certPem
+verifyDocument(signedPdf, { signerCert: cert.certPem }); // fails unless the cert is valid AND owns the seal's key
+```
+
+`verifyMlDsaCertificate()` checks the self-signature, algorithm, and validity
+window; `certMatchesPqSeal()` ties it to a seal by public-key fingerprint. Both
+seal signatures are required — if either Ed25519 **or** ML-DSA-65 fails (or the
+seal's `fingerprint`/`keyId` don't match its keys), the seal fails.
+
+---
+
 ## Persisting certs + audit logs across requests
 
 For real usage you need to:

package/dist/index.d.ts

@@ -1,12 +1,17 @@
 export { PemSigner, type PemSignerInput } from "./pem-signer.js";
 export { generateSelfSignedCert, encryptKeyPem, decryptKeyPem, type GenerateCertOptions, type GeneratedCert, } from "./cert-issuer.js";
 export { renderHtmlToPdf, type RenderHtmlToPdfOptions } from "./render-pdf.js";
-export { signPdf, type SignPdfInput, type SignPdfResult } from "./sign-pdf.js";
+export { signPdf, SUPPORTED_SUBFILTERS, type SubFilter, type SignPdfInput, type SignPdfResult, } from "./sign-pdf.js";
 export { verifyPdfStructure, verifyPdfSignature, type VerifyResult } from "./verify-pdf.js";
 export { buildTimeStampReq, parseTimeStampResp, parseTstInfo, OID_TIMESTAMP_TOKEN, } from "./timestamp.js";
-export type { Signer, SigningCertPem, SignedPdfMetadata, TsaTransport, } from "./types.js";
+export type { Signer, SigningCertPem, SignedPdfMetadata, TsaTransport, ExternalSigner, ExternalSignerKeyType, } from "./types.js";
 export type { StoredCert, CertStore, AuditLogEntry, AuditLogRow, AuditLogStore, EsigAuditAction, PdfStorageStore, } from "./adapters.js";
 export { ensureActiveCert, type EnsureCertResult } from "./cert-lifecycle.js";
 export { createEnvelope, resolveSigningToken, recordSignature, declineEnvelope, voidEnvelope, composeEnvelopeHtml, EnvelopeError, type Envelope, type EnvelopeSigner, type EnvelopeStatus, type EnvelopeSignerStatus, type EnvelopeStore, type CreateEnvelopeInput, type CreateEnvelopeResult, type TokenResolution, } from "./envelope.js";
 export { signDocument, type SignDocumentInput, type SignDocumentResult, } from "./sign-document.js";
+export { generatePqKeyBundle, loadPqSigningKeys, publicMaterialForKeys, wrapPqKeyBundle, unwrapPqKeyBundle, buildPqSeal, verifyPqSealSignatures, isWellFormedUuaidAssertion, canonicalJson, PQ_SEAL_VERSION, PQ_SEAL_ALG, type GeneratePqKeyBundleOptions, type PqKeyBundle, type PqPublicMaterial, type PqSigningKeys, type PqSeal, type PqSealVerification, type BuildPqSealInput, } from "./pq-seal.js";
+export { embedPqSeal, extractPqSeal, hasPqSeal } from "./pq-embed.js";
+export { verifyPqSeal, verifyDocument, type PqSealVerdict, type DocumentVerification, type VerifyPqSealOptions, type VerifyDocumentOptions, } from "./pq-verify.js";
+export { ensureActivePqKeys, rotatePqKeys, type PqKeyStore, type StoredPqKeys, type EnsurePqKeysResult, } from "./pq-lifecycle.js";
+export { issueMlDsaCertificate, parseMlDsaCertificate, verifyMlDsaCertificate, certMatchesPqSeal, ID_ML_DSA_65, type IssueMlDsaCertOptions, type MlDsaCertificate, type ParsedMlDsaCertificate, type MlDsaCertVerdict, } from "./pq-cert.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,MAAM,EACN,cAAc,EACd,iBAAiB,EACjB,YAAY,GACb,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,UAAU,EACV,SAAS,EACT,aAAa,EACb,WAAW,EACX,aAAa,EACb,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACL,OAAO,EACP,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,MAAM,EACN,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,UAAU,EACV,SAAS,EACT,aAAa,EACb,WAAW,EACX,aAAa,EACb,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,0BAA0B,EAC1B,aAAa,EACb,eAAe,EACf,WAAW,EACX,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,MAAM,EACX,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,YAAY,EACZ,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,EACZ,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -11,7 +11,7 @@
 export { PemSigner } from "./pem-signer.js";
 export { generateSelfSignedCert, encryptKeyPem, decryptKeyPem, } from "./cert-issuer.js";
 export { renderHtmlToPdf } from "./render-pdf.js";
-export { signPdf } from "./sign-pdf.js";
+export { signPdf, SUPPORTED_SUBFILTERS, } from "./sign-pdf.js";
 export { verifyPdfStructure, verifyPdfSignature } from "./verify-pdf.js";
 export { buildTimeStampReq, parseTimeStampResp, parseTstInfo, OID_TIMESTAMP_TOKEN, } from "./timestamp.js";
 // ---- Cert lifecycle (stack-agnostic; interface-only) ----
@@ -20,4 +20,10 @@ export { ensureActiveCert } from "./cert-lifecycle.js";
 export { createEnvelope, resolveSigningToken, recordSignature, declineEnvelope, voidEnvelope, composeEnvelopeHtml, EnvelopeError, } from "./envelope.js";
 // ---- End-to-end orchestrator ----
 export { signDocument, } from "./sign-document.js";
+// ---- Post-quantum hybrid seal (Ed25519 + ML-DSA-65, FIPS 204) ----
+export { generatePqKeyBundle, loadPqSigningKeys, publicMaterialForKeys, wrapPqKeyBundle, unwrapPqKeyBundle, buildPqSeal, verifyPqSealSignatures, isWellFormedUuaidAssertion, canonicalJson, PQ_SEAL_VERSION, PQ_SEAL_ALG, } from "./pq-seal.js";
+export { embedPqSeal, extractPqSeal, hasPqSeal } from "./pq-embed.js";
+export { verifyPqSeal, verifyDocument, } from "./pq-verify.js";
+export { ensureActivePqKeys, rotatePqKeys, } from "./pq-lifecycle.js";
+export { issueMlDsaCertificate, parseMlDsaCertificate, verifyMlDsaCertificate, certMatchesPqSeal, ID_ML_DSA_65, } from "./pq-cert.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,kEAAkE;AAClE,EAAE;AACF,mFAAmF;AACnF,iFAAiF;AACjF,gFAAgF;AAEhF,8BAA8B;AAC9B,OAAO,EAAE,SAAS,EAAuB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,GAGd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAA+B,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAyC,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAqB,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAmBxB,4DAA4D;AAC5D,OAAO,EAAE,gBAAgB,EAAyB,MAAM,qBAAqB,CAAC;AAE9E,6DAA6D;AAC7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,GASd,MAAM,eAAe,CAAC;AAEvB,oCAAoC;AACpC,OAAO,EACL,YAAY,GAGb,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,kEAAkE;AAClE,EAAE;AACF,mFAAmF;AACnF,iFAAiF;AACjF,gFAAgF;AAEhF,8BAA8B;AAC9B,OAAO,EAAE,SAAS,EAAuB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,GAGd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAA+B,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACL,OAAO,EACP,oBAAoB,GAIrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAqB,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAqBxB,4DAA4D;AAC5D,OAAO,EAAE,gBAAgB,EAAyB,MAAM,qBAAqB,CAAC;AAE9E,6DAA6D;AAC7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,GASd,MAAM,eAAe,CAAC;AAEvB,oCAAoC;AACpC,OAAO,EACL,YAAY,GAGb,MAAM,oBAAoB,CAAC;AAE5B,qEAAqE;AACrE,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,0BAA0B,EAC1B,aAAa,EACb,eAAe,EACf,WAAW,GAQZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,YAAY,EACZ,cAAc,GAKf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,YAAY,GAIb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,GAKb,MAAM,cAAc,CAAC"}

package/dist/pem-signer.d.ts

@@ -1,8 +1,20 @@
 import { Signer } from "@signpdf/utils";
-import type { TsaTransport } from "./types.js";
+import type { ExternalSigner, TsaTransport } from "./types.js";
 export interface PemSignerInput {
-    keyPem: string;
-    certPem: string;
+    /** PEM-encoded RSA private key. Required unless `externalSigner` is provided. */
+    keyPem?: string;
+    /**
+     * PEM-encoded X.509 certificate. Required on the `keyPem` path; on the
+     * `externalSigner` path it defaults to `externalSigner.certificatePem`.
+     */
+    certPem?: string;
+    /**
+     * External signing seam (HSM / KMS — see `ExternalSigner` in types.ts).
+     * Mutually exclusive with `keyPem`. The private key never enters this
+     * process; the PKCS#7 signature is produced by `signRsaSha256` (sync or
+     * async) over the final signed-attributes SET.
+     */
+    externalSigner?: ExternalSigner;
     /**
      * Optional RFC 3161 timestamp transport. When provided, each produced
      * signature is upgraded from CAdES-B to CAdES-T by embedding a
@@ -20,7 +32,9 @@ export interface PemSignerInput {
     padesStrict?: boolean;
 }
 export declare class PemSigner extends Signer {
-    private privateKey;
+    /** Present on the in-memory path; absent when an ExternalSigner is used. */
+    private privateKey?;
+    private externalSigner?;
     private certificate;
     private tsa?;
     private padesStrict;
@@ -28,7 +42,9 @@ export declare class PemSigner extends Signer {
     lastTimestamped: boolean;
     /** Set when a non-required TSA call failed (signature falls back to CAdES-B). */
     lastTsaError?: string;
-    constructor({ keyPem, certPem, tsa, padesStrict }: PemSignerInput);
+    constructor({ keyPem, certPem, tsa, padesStrict, externalSigner }: PemSignerInput);
+    /** RSA modulus size in bytes (a PKCS1-v1_5 signature is exactly this long). */
+    private modulusBytes;
     sign(pdfBuffer: Buffer, signingTime?: Date): Promise<Buffer>;
     /**
      * Insert the ESS signing-certificate-v2 signed attribute into the first
@@ -36,6 +52,11 @@ export declare class PemSigner extends Signer {
      * modified set. In `padesStrict` mode the PAdES-forbidden signing-time
      * attribute is also removed. Returns the new signatureValue (forge binary
      * string) so the caller can timestamp the FINAL signature.
+     *
+     * This is the single point where the real signature is produced (the value
+     * forge computed during p7.sign() is overwritten unconditionally) — so it is
+     * also the ExternalSigner seam: on that path the raw DER of the SET is handed
+     * to `signRsaSha256` (awaited; sync or async), instead of the in-memory key.
      */
     private addSigningCertV2AndResign;
 }

package/dist/pem-signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pem-signer.d.ts","sourceRoot":"","sources":["../src/pem-signer.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,MAAM,EAAgB,MAAM,gBAAgB,CAAC;AAStD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAS/C,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,qBAAa,SAAU,SAAQ,MAAM;IACnC,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,GAAG,CAAC,CAAe;IAC3B,OAAO,CAAC,WAAW,CAAU;IAE7B,6EAA6E;IACtE,eAAe,UAAS;IAC/B,iFAAiF;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;gBAEjB,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,cAAc;IAc3D,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IA2ElE;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;CAwClC"}
+{"version":3,"file":"pem-signer.d.ts","sourceRoot":"","sources":["../src/pem-signer.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,MAAM,EAAgB,MAAM,gBAAgB,CAAC;AAStD,OAAO,KAAK,EAAE,cAAc,EAAyB,YAAY,EAAE,MAAM,YAAY,CAAC;AAgBtF,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;OAKG;IACH,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,qBAAa,SAAU,SAAQ,MAAM;IACnC,4EAA4E;IAC5E,OAAO,CAAC,UAAU,CAAC,CAA2B;IAC9C,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,GAAG,CAAC,CAAe;IAC3B,OAAO,CAAC,WAAW,CAAU;IAE7B,6EAA6E;IACtE,eAAe,UAAS;IAC/B,iFAAiF;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;gBAEjB,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,cAAc;IAuCjF,+EAA+E;IAC/E,OAAO,CAAC,YAAY;IAMd,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAsFlE;;;;;;;;;;;OAWG;YACW,yBAAyB;CAuDxC"}

package/dist/pem-signer.js

@@ -21,12 +21,20 @@ import forge from "node-forge";
 import { Signer, SignPdfError } from "@signpdf/utils";
 import { buildTimeStampReq, parseTimeStampResp, derStringToUint8, uint8ToDerString, OID_TIMESTAMP_TOKEN, } from "./timestamp.js";
 const asn1 = forge.asn1;
+/** Expected RSA modulus bit length per ExternalSigner keyType. */
+const EXTERNAL_KEY_BITS = {
+    "rsa-2048": 2048,
+    "rsa-3072": 3072,
+    "rsa-4096": 4096,
+};
 /** id-aa-signingCertificateV2 (ESS, RFC 5035) — binds the signer cert into the signed data. */
 const OID_SIGNING_CERT_V2 = "1.2.840.113549.1.9.16.2.47";
 /** id-signingTime (PKCS#9) — PAdES forbids this signed attribute (time belongs in /M). */
 const OID_SIGNING_TIME = "1.2.840.113549.1.9.5";
 export class PemSigner extends Signer {
+    /** Present on the in-memory path; absent when an ExternalSigner is used. */
     privateKey;
+    externalSigner;
     certificate;
     tsa;
     padesStrict;
@@ -34,19 +42,45 @@ export class PemSigner extends Signer {
     lastTimestamped = false;
     /** Set when a non-required TSA call failed (signature falls back to CAdES-B). */
     lastTsaError;
-    constructor({ keyPem, certPem, tsa, padesStrict }) {
+    constructor({ keyPem, certPem, tsa, padesStrict, externalSigner }) {
         super();
-        if (!keyPem.includes("-----BEGIN")) {
-            throw new Error("PemSigner: keyPem must be PEM-encoded");
+        if (externalSigner) {
+            if (keyPem) {
+                throw new Error("PemSigner: pass either keyPem or externalSigner, not both");
+            }
+            const pem = certPem ?? externalSigner.certificatePem;
+            if (!pem || !pem.includes("-----BEGIN CERTIFICATE-----")) {
+                throw new Error("PemSigner: certPem must be a PEM-encoded X.509 certificate");
+            }
+            this.certificate = forge.pki.certificateFromPem(pem);
+            const expectedBits = EXTERNAL_KEY_BITS[externalSigner.keyType];
+            if (!expectedBits) {
+                throw new Error(`PemSigner: unsupported externalSigner.keyType "${String(externalSigner.keyType)}"`);
+            }
+            const actualBits = this.certificate.publicKey.n.bitLength();
+            if (actualBits !== expectedBits) {
+                throw new Error(`PemSigner: externalSigner.keyType ${externalSigner.keyType} does not match the ` +
+                    `certificate's RSA modulus (${actualBits} bits)`);
+            }
+            this.externalSigner = externalSigner;
         }
-        if (!certPem.includes("-----BEGIN CERTIFICATE-----")) {
-            throw new Error("PemSigner: certPem must be a PEM-encoded X.509 certificate");
+        else {
+            if (!keyPem || !keyPem.includes("-----BEGIN")) {
+                throw new Error("PemSigner: keyPem must be PEM-encoded");
+            }
+            if (!certPem || !certPem.includes("-----BEGIN CERTIFICATE-----")) {
+                throw new Error("PemSigner: certPem must be a PEM-encoded X.509 certificate");
+            }
+            this.privateKey = forge.pki.privateKeyFromPem(keyPem);
+            this.certificate = forge.pki.certificateFromPem(certPem);
         }
-        this.privateKey = forge.pki.privateKeyFromPem(keyPem);
-        this.certificate = forge.pki.certificateFromPem(certPem);
         this.tsa = tsa;
         this.padesStrict = padesStrict ?? false;
     }
+    /** RSA modulus size in bytes (a PKCS1-v1_5 signature is exactly this long). */
+    modulusBytes() {
+        return Math.ceil(this.certificate.publicKey.n.bitLength() / 8);
+    }
     async sign(pdfBuffer, signingTime) {
         if (!Buffer.isBuffer(pdfBuffer)) {
             throw new SignPdfError("PDF expected as Buffer.", SignPdfError.TYPE_INPUT);
@@ -54,11 +88,20 @@ export class PemSigner extends Signer {
         // Reset per-call timestamp state (signpdf calls sign() once per signature).
         this.lastTimestamped = false;
         this.lastTsaError = undefined;
+        // Key handed to forge's synchronous p7.sign() pass. On the externalSigner
+        // path this is a placeholder shim: forge only needs an object with a
+        // sign(md) method, and the signature it produces here is ALWAYS discarded —
+        // addSigningCertV2AndResign() below recomputes the signature over the final
+        // (spliced) signed-attributes SET on BOTH paths. Doing the real external
+        // call there (in our own async code, with the raw to-be-signed bytes in
+        // hand) is what makes async HSM signers possible without a two-pass sign.
+        const forgeSigningKey = this.privateKey ??
+            placeholderForgeKey(this.modulusBytes());
         const p7 = forge.pkcs7.createSignedData();
         p7.content = forge.util.createBuffer(pdfBuffer.toString("binary"));
         p7.addCertificate(this.certificate);
         p7.addSigner({
-            key: this.privateKey,
+            key: forgeSigningKey,
             certificate: this.certificate,
             digestAlgorithm: forge.pki.oids.sha256,
             authenticatedAttributes: [
@@ -76,7 +119,7 @@ export class PemSigner extends Signer {
         // authenticatedAttributes list, so we splice it in and recompute the RSA
         // signature over the exact bytes. Returns the NEW signatureValue.
         const p7Asn1 = p7.toAsn1();
-        const sigValue = this.addSigningCertV2AndResign(p7Asn1);
+        const sigValue = await this.addSigningCertV2AndResign(p7Asn1);
         // No timestamp requested → CAdES-B (now cert-bound).
         if (!this.tsa) {
             return Buffer.from(forge.asn1.toDer(p7Asn1).getBytes(), "binary");
@@ -114,8 +157,13 @@ export class PemSigner extends Signer {
      * modified set. In `padesStrict` mode the PAdES-forbidden signing-time
      * attribute is also removed. Returns the new signatureValue (forge binary
      * string) so the caller can timestamp the FINAL signature.
+     *
+     * This is the single point where the real signature is produced (the value
+     * forge computed during p7.sign() is overwritten unconditionally) — so it is
+     * also the ExternalSigner seam: on that path the raw DER of the SET is handed
+     * to `signRsaSha256` (awaited; sync or async), instead of the in-memory key.
      */
-    addSigningCertV2AndResign(p7Asn1) {
+    async addSigningCertV2AndResign(p7Asn1) {
         const signerInfo = firstSignerInfoSeq(p7Asn1);
         const siChildren = signerInfo.value;
         // signedAttrs = the [0] IMPLICIT context node; encryptedDigest = the
@@ -144,13 +192,36 @@ export class PemSigner extends Signer {
         signedAttrs.value = attrs;
         // Re-sign: RSA over DER(signedAttrs re-tagged as SET OF), SHA-256.
         const setDer = asn1.toDer(asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SET, true, attrs)).getBytes();
-        const md = forge.md.sha256.create();
-        md.update(setDer);
-        const newSig = this.privateKey.sign(md); // RSASSA-PKCS1-V1_5 (forge default)
+        let newSig;
+        if (this.externalSigner) {
+            // External seam: RSASSA-PKCS1-v1_5/SHA-256 over the same raw bytes —
+            // byte-identical to forge's key.sign(md) for the same key.
+            const sig = await this.externalSigner.signRsaSha256(derStringToUint8(setDer));
+            const expected = this.modulusBytes();
+            if (!(sig instanceof Uint8Array) || sig.length !== expected) {
+                throw new Error(`PemSigner: externalSigner.signRsaSha256 returned ${sig instanceof Uint8Array ? sig.length : typeof sig} bytes; expected exactly ${expected} (RSASSA-PKCS1-v1_5 signatures are modulus-sized)`);
+            }
+            newSig = uint8ToDerString(sig);
+        }
+        else {
+            const md = forge.md.sha256.create();
+            md.update(setDer);
+            newSig = this.privateKey.sign(md); // RSASSA-PKCS1-V1_5 (forge default)
+        }
         sigOctet.value = newSig;
         return newSig;
     }
 }
+/**
+ * Stand-in key for forge's internal (always-discarded) signing pass on the
+ * ExternalSigner path. node-forge accepts any object with a `sign(md)` method
+ * as a SignerInfo key; this one emits modulus-sized zero bytes so the ASN.1
+ * tree has a correctly-shaped signature OCTET STRING until
+ * addSigningCertV2AndResign() overwrites it with the real external signature.
+ */
+function placeholderForgeKey(modulusBytes) {
+    return { sign: () => "\x00".repeat(modulusBytes) };
+}
 /**
  * Build the ESS signing-certificate-v2 signed attribute (RFC 5035) binding the
  * signer certificate into the signed data:

package/dist/pem-signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"pem-signer.js","sourceRoot":"","sources":["../src/pem-signer.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,wEAAwE;AACxE,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,kFAAkF;AAClF,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,iDAAiD;AACjD,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,gBAAgB;AAEhB,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;AAExB,+FAA+F;AAC/F,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AACzD,0FAA0F;AAC1F,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAsBhD,MAAM,OAAO,SAAU,SAAQ,MAAM;IAC3B,UAAU,CAA2B;IACrC,WAAW,CAAwB;IACnC,GAAG,CAAgB;IACnB,WAAW,CAAU;IAE7B,6EAA6E;IACtE,eAAe,GAAG,KAAK,CAAC;IAC/B,iFAAiF;IAC1E,YAAY,CAAU;IAE7B,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAkB;QAC/D,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAA6B,CAAC;QAClF,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,IAAI,KAAK,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,WAAkB;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QAC7E,CAAC;QACD,4EAA4E;QAC5E,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAE9B,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC1C,EAAE,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpC,EAAE,CAAC,SAAS,CAAC;YACX,GAAG,EAAE,IAAI,CAAC,UAAU;YACpB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM;YACtC,uBAAuB,EAAE;gBACvB,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;gBAChE,qEAAqE;gBACrE,8DAA8D;gBAC9D,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAsB,EAAE;gBAC7F,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE;aACvC;SACF,CAAC,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5B,4EAA4E;QAC5E,uEAAuE;QACvE,4EAA4E;QAC5E,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAExD,qDAAqD;QACrD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;QACpE,CAAC;QAED,gFAAgF;QAChF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;YACjE,MAAM,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;YAElE,4EAA4E;YAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;gBAC1E,IAAI,CAAC,MAAM,CACT,IAAI,CAAC,KAAK,CAAC,SAAS,EACpB,IAAI,CAAC,IAAI,CAAC,GAAG,EACb,KAAK,EACL,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAC9C;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;aAChE,CAAC,CAAC;YAEH,kDAAkD;YAClD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAEnF,qEAAqE;YACrE,0EAA0E;YAC1E,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YAE3C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,CAAC,CAAC;YACV,CAAC;YACD,+CAA+C;YAC/C,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;YAC7B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACK,yBAAyB,CAAC,MAAuB;QACvD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,KAA0B,CAAC;QAEzD,qEAAqE;QACrE,uDAAuD;QACvD,IAAI,WAAwC,CAAC;QAC7C,IAAI,QAAqC,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACvE,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpF,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,KAAK,GAAG,WAAW,CAAC,KAA0B,CAAC;QACnD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrF,OAAO,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAe,CAAC,KAAK,gBAAgB,CAAC,CAAC;YAC/G,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACrD,WAAW,CAAC,KAAK,GAAG,KAAK,CAAC;QAE1B,mEAAmE;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAC9D,CAAC,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,oCAAoC;QAC7E,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzE,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACpC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;IAExC,0EAA0E;IAC1E,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,oBAAoB;IACzG,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAChG,IAAI,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,WAAW,GAAG,MAAM,GAAG,WAAW,CAAC,CAAC,4BAA4B;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACxF,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAEzG,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QAC5E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC;QACzE,YAAY;KACb,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE9F,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC;KACxE,CAAC,CAAC;AACL,CAAC;AAED,oEAAoE;AACpE,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CAAC,WAA4B;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,UAAuC,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,KAA0B,EAAE,CAAC;QAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjF,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;QACjD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,WAAwC,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAA0B,EAAE,CAAC;QAC1D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1G,WAAW,GAAG,KAAK,CAAC,CAAC,mCAAmC;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,mBAAmB,CAC1B,WAA4B,EAC5B,aAA8B;IAE9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,6CAA6C;IAC7C,IAAI,UAAuC,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,KAA0B,EAAE,CAAC;QAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjF,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;QACjD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,kEAAkE;IAClE,IAAI,WAAwC,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAA0B,EAAE,CAAC;QAC1D,IACE,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS;YACvC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAC5B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAC1B,CAAC;YACD,WAAW,GAAG,KAAK,CAAC,CAAC,gCAAgC;QACvD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAEA,UAAU,CAAC,KAA2B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"pem-signer.js","sourceRoot":"","sources":["../src/pem-signer.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,wEAAwE;AACxE,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,kFAAkF;AAClF,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,iDAAiD;AACjD,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,gBAAgB;AAEhB,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;AAExB,kEAAkE;AAClE,MAAM,iBAAiB,GAA0C;IAC/D,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,IAAI;CACjB,CAAC;AAEF,+FAA+F;AAC/F,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AACzD,0FAA0F;AAC1F,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAkChD,MAAM,OAAO,SAAU,SAAQ,MAAM;IACnC,4EAA4E;IACpE,UAAU,CAA4B;IACtC,cAAc,CAAkB;IAChC,WAAW,CAAwB;IACnC,GAAG,CAAgB;IACnB,WAAW,CAAU;IAE7B,6EAA6E;IACtE,eAAe,GAAG,KAAK,CAAC;IAC/B,iFAAiF;IAC1E,YAAY,CAAU;IAE7B,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAkB;QAC/E,KAAK,EAAE,CAAC;QACR,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,IAAI,cAAc,CAAC,cAAc,CAAC;YACrD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,iBAAiB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YAC/D,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CACb,kDAAkD,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CACpF,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAI,IAAI,CAAC,WAAW,CAAC,SAAqC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACzF,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACb,qCAAqC,cAAc,CAAC,OAAO,sBAAsB;oBAC/E,8BAA8B,UAAU,QAAQ,CACnD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,CAAC;YACD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAA6B,CAAC;YAClF,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,IAAI,KAAK,CAAC;IAC1C,CAAC;IAED,+EAA+E;IACvE,YAAY;QAClB,OAAO,IAAI,CAAC,IAAI,CACb,IAAI,CAAC,WAAW,CAAC,SAAqC,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAC1E,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,WAAkB;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QAC7E,CAAC;QACD,4EAA4E;QAC5E,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAE9B,0EAA0E;QAC1E,qEAAqE;QACrE,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,MAAM,eAAe,GACnB,IAAI,CAAC,UAAU;YACd,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,CAAyC,CAAC;QAEpF,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC1C,EAAE,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpC,EAAE,CAAC,SAAS,CAAC;YACX,GAAG,EAAE,eAAe;YACpB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM;YACtC,uBAAuB,EAAE;gBACvB,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;gBAChE,qEAAqE;gBACrE,8DAA8D;gBAC9D,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAsB,EAAE;gBAC7F,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE;aACvC;SACF,CAAC,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5B,4EAA4E;QAC5E,uEAAuE;QACvE,4EAA4E;QAC5E,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAE9D,qDAAqD;QACrD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;QACpE,CAAC;QAED,gFAAgF;QAChF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;YACjE,MAAM,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;YAElE,4EAA4E;YAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;gBAC1E,IAAI,CAAC,MAAM,CACT,IAAI,CAAC,KAAK,CAAC,SAAS,EACpB,IAAI,CAAC,IAAI,CAAC,GAAG,EACb,KAAK,EACL,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAC9C;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;aAChE,CAAC,CAAC;YAEH,kDAAkD;YAClD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAEnF,qEAAqE;YACrE,0EAA0E;YAC1E,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YAE3C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,CAAC,CAAC;YACV,CAAC;YACD,+CAA+C;YAC/C,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;YAC7B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,yBAAyB,CAAC,MAAuB;QAC7D,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,KAA0B,CAAC;QAEzD,qEAAqE;QACrE,uDAAuD;QACvD,IAAI,WAAwC,CAAC;QAC7C,IAAI,QAAqC,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACvE,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpF,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,KAAK,GAAG,WAAW,CAAC,KAA0B,CAAC;QACnD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrF,OAAO,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAe,CAAC,KAAK,gBAAgB,CAAC,CAAC;YAC/G,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACrD,WAAW,CAAC,KAAK,GAAG,KAAK,CAAC;QAE1B,mEAAmE;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAC9D,CAAC,QAAQ,EAAE,CAAC;QACb,IAAI,MAAc,CAAC;QACnB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,qEAAqE;YACrE,2DAA2D;YAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CACb,oDAAoD,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,GACpG,4BAA4B,QAAQ,mDAAmD,CACxF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACpC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClB,MAAM,GAAG,IAAI,CAAC,UAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,oCAAoC;QAC1E,CAAC;QACD,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,YAAoB;IAG/C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzE,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACpC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;IAExC,0EAA0E;IAC1E,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,oBAAoB;IACzG,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAChG,IAAI,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,WAAW,GAAG,MAAM,GAAG,WAAW,CAAC,CAAC,4BAA4B;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACxF,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAEzG,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QAC5E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC;QACzE,YAAY;KACb,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE9F,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC;KACxE,CAAC,CAAC;AACL,CAAC;AAED,oEAAoE;AACpE,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CAAC,WAA4B;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,UAAuC,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,KAA0B,EAAE,CAAC;QAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjF,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;QACjD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,WAAwC,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAA0B,EAAE,CAAC;QAC1D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1G,WAAW,GAAG,KAAK,CAAC,CAAC,mCAAmC;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,mBAAmB,CAC1B,WAA4B,EAC5B,aAA8B;IAE9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,6CAA6C;IAC7C,IAAI,UAAuC,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,KAA0B,EAAE,CAAC;QAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjF,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;QACjD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,kEAAkE;IAClE,IAAI,WAAwC,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAA0B,EAAE,CAAC;QAC1D,IACE,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS;YACvC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAC5B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAC1B,CAAC;YACD,WAAW,GAAG,KAAK,CAAC,CAAC,gCAAgC;QACvD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAEA,UAAU,CAAC,KAA2B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAC9D,CAAC"}

package/dist/pq-cert.d.ts

@@ -0,0 +1,76 @@
+import type { PqSigningKeys, PqSeal } from "./pq-seal.js";
+/** RFC 9881 / NIST: id-ml-dsa-65. Used for BOTH the SPKI alg and the cert signature alg. */
+export declare const ID_ML_DSA_65: "2.16.840.1.101.3.4.3.18";
+export interface IssueMlDsaCertOptions {
+    /** The signing keys — the ML-DSA-65 keypair is both subject and issuer (self-signed). */
+    keys: PqSigningKeys;
+    /** Subject CN / O seed. ASCII-only (matches cert-issuer's node-forge round-trip guard). */
+    subjectName: string;
+    /** Validity window in days. Default 365. */
+    validityDays?: number;
+    /** Optional 16-byte serial; a CSPRNG positive serial is generated otherwise. */
+    serial?: Uint8Array;
+    /** Backdate notBefore by this many seconds to tolerate clock skew. Default 0. */
+    notBefore?: Date;
+}
+export interface MlDsaCertificate {
+    certPem: string;
+    certDer: Uint8Array;
+    /** SHA-256 hex of the DER-encoded certificate. */
+    fingerprint: string;
+    /** SHA-256 hex of the raw ML-DSA-65 public key — equals a seal's `keys.mldsa65Fpr`. */
+    publicKeyFingerprint: string;
+    notBefore: Date;
+    notAfter: Date;
+}
+/**
+ * Issue a self-signed ML-DSA-65 X.509 certificate for the given signing keys.
+ * The certificate's public key is the raw 1952-byte ML-DSA-65 key, and its own
+ * signature is ML-DSA-65 over the TBSCertificate.
+ */
+export declare function issueMlDsaCertificate(opts: IssueMlDsaCertOptions): MlDsaCertificate;
+export interface ParsedMlDsaCertificate {
+    subjectCommonName: string;
+    notBefore: Date;
+    notAfter: Date;
+    /** Raw ML-DSA-65 public key (1952 bytes). */
+    publicKey: Uint8Array;
+    /** SHA-256 hex of `publicKey` — compare to a seal's `keys.mldsa65Fpr`. */
+    publicKeyFingerprint: string;
+    /** signatureAlgorithm OID (must be ID_ML_DSA_65). */
+    signatureAlgOid: string;
+    /** Exact DER of the TBSCertificate (byte-sliced, not re-encoded) — what the signature covers. */
+    tbsDer: Uint8Array;
+    /** Raw ML-DSA-65 signature (3309 bytes). */
+    signature: Uint8Array;
+}
+/**
+ * Parse a self-signed ML-DSA-65 certificate. The TBS bytes are recovered by a
+ * raw TLV slice of the original DER (never re-encoded), so signature
+ * verification is over the exact signed bytes.
+ */
+export declare function parseMlDsaCertificate(cert: string | Uint8Array): ParsedMlDsaCertificate;
+export interface MlDsaCertVerdict {
+    ok: boolean;
+    /** signatureAlgorithm is id-ml-dsa-65. */
+    algOk: boolean;
+    /** The ML-DSA-65 self-signature over the TBS verifies against the cert's own public key. */
+    selfSignatureOk: boolean;
+    /** `now` is within [notBefore, notAfter]. */
+    timeValid: boolean;
+    failures: string[];
+}
+/**
+ * Verify a self-signed ML-DSA-65 certificate: correct algorithm, the self
+ * signature validates against the embedded public key, and it is within its
+ * validity window. Never throws.
+ */
+export declare function verifyMlDsaCertificate(cert: string | Uint8Array, now?: Date): MlDsaCertVerdict;
+/**
+ * Bind a certificate to a post-quantum seal: the cert must be valid AND its
+ * public key must be the one that produced the seal (fingerprint match). This
+ * is how a relying party upgrades from raw-fingerprint pinning to an X.509
+ * identity without changing the seal format.
+ */
+export declare function certMatchesPqSeal(cert: string | Uint8Array, seal: PqSeal, now?: Date): boolean;
+//# sourceMappingURL=pq-cert.d.ts.map

package/dist/pq-cert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-cert.d.ts","sourceRoot":"","sources":["../src/pq-cert.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE1D,4FAA4F;AAC5F,eAAO,MAAM,YAAY,EAAG,yBAAkC,CAAC;AAoF/D,MAAM,WAAW,qBAAqB;IACpC,yFAAyF;IACzF,IAAI,EAAE,aAAa,CAAC;IACpB,2FAA2F;IAC3F,WAAW,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,iFAAiF;IACjF,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC;IACpB,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,GAAG,gBAAgB,CA8EnF;AAwCD,MAAM,WAAW,sBAAsB;IACrC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,IAAI,CAAC;IACf,6CAA6C;IAC7C,SAAS,EAAE,UAAU,CAAC;IACtB,0EAA0E;IAC1E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qDAAqD;IACrD,eAAe,EAAE,MAAM,CAAC;IACxB,iGAAiG;IACjG,MAAM,EAAE,UAAU,CAAC;IACnB,4CAA4C;IAC5C,SAAS,EAAE,UAAU,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,sBAAsB,CA2CvF;AAcD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,0CAA0C;IAC1C,KAAK,EAAE,OAAO,CAAC;IACf,4FAA4F;IAC5F,eAAe,EAAE,OAAO,CAAC;IACzB,6CAA6C;IAC7C,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,GAAG,GAAE,IAAiB,GAAG,gBAAgB,CAmC1G;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAK1G"}