@intlayer/backend 7.0.8 → 7.0.9-canary.2

package/dist/cjs/node_modules/@authenio/xml-encryption/lib/index.cjs

@@ -0,0 +1,16 @@
+const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.cjs');
+const require_xmlenc$1 = require('./xmlenc.cjs');
+
+//#region ../../node_modules/@authenio/xml-encryption/lib/index.js
+var require_lib = /* @__PURE__ */ require_rolldown_runtime.__commonJS({ "../../node_modules/@authenio/xml-encryption/lib/index.js": ((exports, module) => {
+	exports = module.exports = require_xmlenc$1.default;
+}) });
+
+//#endregion
+Object.defineProperty(exports, 'default', {
+  enumerable: true,
+  get: function () {
+    return require_lib();
+  }
+});
+//# sourceMappingURL=index.cjs.map

package/dist/cjs/node_modules/@authenio/xml-encryption/lib/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../../../../../../../node_modules/@authenio/xml-encryption/lib/index.js"],"sourcesContent":["exports = module.exports = require('./xmlenc');"],"x_google_ignoreList":[0],"mappings":";;;;;AAAA,WAAU,OAAO"}

package/dist/cjs/node_modules/@authenio/xml-encryption/lib/templates/encrypted-key.tpl.xml.cjs

@@ -0,0 +1,25 @@
+const require_rolldown_runtime = require('../../../../../_virtual/rolldown_runtime.cjs');
+const require_index = require('../../../../escape-html/index.cjs');
+
+//#region ../../node_modules/@authenio/xml-encryption/lib/templates/encrypted-key.tpl.xml.js
+var require_encrypted_key_tpl_xml = /* @__PURE__ */ require_rolldown_runtime.__commonJS({ "../../node_modules/@authenio/xml-encryption/lib/templates/encrypted-key.tpl.xml.js": ((exports, module) => {
+	var escapehtml = require_index.default;
+	module.exports = ({ contentEncryptionMethod, keyInfo, encryptedContent }) => `
+<xenc:EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
+  <xenc:EncryptionMethod Algorithm="${escapehtml(contentEncryptionMethod)}" />
+  ${keyInfo}
+  <xenc:CipherData>
+    <xenc:CipherValue>${escapehtml(encryptedContent)}</xenc:CipherValue>
+  </xenc:CipherData>
+</xenc:EncryptedData>
+`;
+}) });
+
+//#endregion
+Object.defineProperty(exports, 'default', {
+  enumerable: true,
+  get: function () {
+    return require_encrypted_key_tpl_xml();
+  }
+});
+//# sourceMappingURL=encrypted-key.tpl.xml.cjs.map

package/dist/cjs/node_modules/@authenio/xml-encryption/lib/templates/encrypted-key.tpl.xml.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-key.tpl.xml.cjs","names":[],"sources":["../../../../../../../../../node_modules/@authenio/xml-encryption/lib/templates/encrypted-key.tpl.xml.js"],"sourcesContent":["var escapehtml = require('escape-html');\n\nmodule.exports = ({ contentEncryptionMethod, keyInfo, encryptedContent }) => `\n<xenc:EncryptedData Type=\"http://www.w3.org/2001/04/xmlenc#Element\" xmlns:xenc=\"http://www.w3.org/2001/04/xmlenc#\">\n  <xenc:EncryptionMethod Algorithm=\"${escapehtml(contentEncryptionMethod)}\" />\n  ${keyInfo}\n  <xenc:CipherData>\n    <xenc:CipherValue>${escapehtml(encryptedContent)}</xenc:CipherValue>\n  </xenc:CipherData>\n</xenc:EncryptedData>\n`;\n\n"],"x_google_ignoreList":[0],"mappings":";;;;;CAAA,IAAI;AAEJ,QAAO,WAAW,EAAE,yBAAyB,SAAS,uBAAuB;;sCAEvC,WAAW,wBAAwB,CAAC;IACtE,QAAQ;;wBAEY,WAAW,iBAAiB,CAAC"}

package/dist/cjs/node_modules/@authenio/xml-encryption/lib/templates/keyinfo.tpl.xml.cjs

@@ -0,0 +1,31 @@
+const require_rolldown_runtime = require('../../../../../_virtual/rolldown_runtime.cjs');
+const require_index = require('../../../../escape-html/index.cjs');
+
+//#region ../../node_modules/@authenio/xml-encryption/lib/templates/keyinfo.tpl.xml.js
+var require_keyinfo_tpl_xml = /* @__PURE__ */ require_rolldown_runtime.__commonJS({ "../../node_modules/@authenio/xml-encryption/lib/templates/keyinfo.tpl.xml.js": ((exports, module) => {
+	var escapehtml = require_index.default;
+	module.exports = ({ encryptionPublicCert, encryptedKey, keyEncryptionMethod }) => `
+<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+  <e:EncryptedKey xmlns:e="http://www.w3.org/2001/04/xmlenc#">
+    <e:EncryptionMethod Algorithm="${escapehtml(keyEncryptionMethod)}">
+      <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+    </e:EncryptionMethod>
+    <KeyInfo>
+      ${encryptionPublicCert}
+    </KeyInfo>
+    <e:CipherData>
+      <e:CipherValue>${escapehtml(encryptedKey)}</e:CipherValue>
+    </e:CipherData>
+  </e:EncryptedKey>
+</KeyInfo>
+`;
+}) });
+
+//#endregion
+Object.defineProperty(exports, 'default', {
+  enumerable: true,
+  get: function () {
+    return require_keyinfo_tpl_xml();
+  }
+});
+//# sourceMappingURL=keyinfo.tpl.xml.cjs.map

package/dist/cjs/node_modules/@authenio/xml-encryption/lib/templates/keyinfo.tpl.xml.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyinfo.tpl.xml.cjs","names":[],"sources":["../../../../../../../../../node_modules/@authenio/xml-encryption/lib/templates/keyinfo.tpl.xml.js"],"sourcesContent":["var escapehtml = require('escape-html');\n\nmodule.exports = ({ encryptionPublicCert, encryptedKey, keyEncryptionMethod }) => `\n<KeyInfo xmlns=\"http://www.w3.org/2000/09/xmldsig#\">\n  <e:EncryptedKey xmlns:e=\"http://www.w3.org/2001/04/xmlenc#\">\n    <e:EncryptionMethod Algorithm=\"${escapehtml(keyEncryptionMethod)}\">\n      <DigestMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#sha1\" />\n    </e:EncryptionMethod>\n    <KeyInfo>\n      ${encryptionPublicCert}\n    </KeyInfo>\n    <e:CipherData>\n      <e:CipherValue>${escapehtml(encryptedKey)}</e:CipherValue>\n    </e:CipherData>\n  </e:EncryptedKey>\n</KeyInfo>\n`;\n\n"],"x_google_ignoreList":[0],"mappings":";;;;;CAAA,IAAI;AAEJ,QAAO,WAAW,EAAE,sBAAsB,cAAc,0BAA0B;;;qCAG7C,WAAW,oBAAoB,CAAC;;;;QAI7D,qBAAqB;;;uBAGN,WAAW,aAAa,CAAC"}

package/dist/cjs/node_modules/@authenio/xml-encryption/lib/utils.cjs

@@ -0,0 +1,38 @@
+const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.cjs');
+const require_encrypted_key_tpl_xml$1 = require('./templates/encrypted-key.tpl.xml.cjs');
+const require_keyinfo_tpl_xml$1 = require('./templates/keyinfo.tpl.xml.cjs');
+
+//#region ../../node_modules/@authenio/xml-encryption/lib/utils.js
+var require_utils = /* @__PURE__ */ require_rolldown_runtime.__commonJS({ "../../node_modules/@authenio/xml-encryption/lib/utils.js": ((exports, module) => {
+	require("path");
+	require("fs");
+	var templates = {
+		"encrypted-key": require_encrypted_key_tpl_xml$1.default,
+		"keyinfo": require_keyinfo_tpl_xml$1.default
+	};
+	function renderTemplate(file, data) {
+		return templates[file](data);
+	}
+	function pemToCert(pem) {
+		var cert = /-----BEGIN CERTIFICATE-----([^-]*)-----END CERTIFICATE-----/g.exec(pem);
+		if (cert.length > 0) return cert[1].replace(/[\n|\r\n]/g, "");
+		return null;
+	}
+	function warnInsecureAlgorithm(algorithm, enabled = true) {
+		if (enabled) console.warn(algorithm + " is no longer recommended due to security reasons. Please deprecate its use as soon as possible.");
+	}
+	module.exports = {
+		renderTemplate,
+		pemToCert,
+		warnInsecureAlgorithm
+	};
+}) });
+
+//#endregion
+Object.defineProperty(exports, 'default', {
+  enumerable: true,
+  get: function () {
+    return require_utils();
+  }
+});
+//# sourceMappingURL=utils.cjs.map

package/dist/cjs/node_modules/@authenio/xml-encryption/lib/utils.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.cjs","names":[],"sources":["../../../../../../../../node_modules/@authenio/xml-encryption/lib/utils.js"],"sourcesContent":["var path = require('path'),\n    fs = require('fs');\n\nvar templates = {\n  'encrypted-key': require('./templates/encrypted-key.tpl.xml'),\n  'keyinfo': require('./templates/keyinfo.tpl.xml'),\n};\n\nfunction renderTemplate(file, data) {\n  return templates[file](data);\n}\n\nfunction pemToCert(pem) {\n  var cert = /-----BEGIN CERTIFICATE-----([^-]*)-----END CERTIFICATE-----/g.exec(pem);\n  if (cert.length > 0) {\n    return cert[1].replace(/[\\n|\\r\\n]/g, '');\n  }\n\n  return null;\n};\n\nfunction warnInsecureAlgorithm(algorithm, enabled = true) {\n  if (enabled) {\n    console.warn(algorithm + \" is no longer recommended due to security reasons. Please deprecate its use as soon as possible.\")\n  }\n}\n\nmodule.exports = {\n  renderTemplate: renderTemplate,\n  pemToCert: pemToCert,\n  warnInsecureAlgorithm: warnInsecureAlgorithm\n};\n"],"x_google_ignoreList":[0],"mappings":";;;;;;AAAW,SAAQ,OAAO;AACjB,SAAQ,KAAK;CAEtB,IAAI,YAAY;EACd;EACA;EACD;CAED,SAAS,eAAe,MAAM,MAAM;AAClC,SAAO,UAAU,MAAM,KAAK;;CAG9B,SAAS,UAAU,KAAK;EACtB,IAAI,OAAO,+DAA+D,KAAK,IAAI;AACnF,MAAI,KAAK,SAAS,EAChB,QAAO,KAAK,GAAG,QAAQ,cAAc,GAAG;AAG1C,SAAO;;CAGT,SAAS,sBAAsB,WAAW,UAAU,MAAM;AACxD,MAAI,QACF,SAAQ,KAAK,YAAY,mGAAmG;;AAIhI,QAAO,UAAU;EACC;EACL;EACY;EACxB"}

package/dist/cjs/node_modules/@authenio/xml-encryption/lib/xmlenc.cjs

@@ -0,0 +1,231 @@
+const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.cjs');
+const require_xpath$1 = require('../../../xpath/xpath.cjs');
+const require_index = require('../../../@xmldom/xmldom/lib/index.cjs');
+const require_utils$1 = require('./utils.cjs');
+
+//#region ../../node_modules/@authenio/xml-encryption/lib/xmlenc.js
+var require_xmlenc = /* @__PURE__ */ require_rolldown_runtime.__commonJS({ "../../node_modules/@authenio/xml-encryption/lib/xmlenc.js": ((exports, module) => {
+	var crypto = require("crypto");
+	var xmldom = require_index.default;
+	var xpath = require_xpath$1.default;
+	var utils = require_utils$1.default;
+	const insecureAlgorithms = ["http://www.w3.org/2001/04/xmlenc#rsa-1_5", "http://www.w3.org/2001/04/xmlenc#tripledes-cbc"];
+	function encryptKeyInfoWithScheme(symmetricKey, options, scheme, callback$1) {
+		const padding = scheme === "RSA-OAEP" ? crypto.constants.RSA_PKCS1_OAEP_PADDING : crypto.constants.RSA_PKCS1_PADDING;
+		const symmetricKeyBuffer = Buffer.isBuffer(symmetricKey) ? symmetricKey : Buffer.from(symmetricKey, "utf-8");
+		try {
+			var params = {
+				encryptedKey: crypto.publicEncrypt({
+					key: options.rsa_pub,
+					padding
+				}, symmetricKeyBuffer).toString("base64"),
+				encryptionPublicCert: "<X509Data><X509Certificate>" + utils.pemToCert(options.pem.toString()) + "</X509Certificate></X509Data>",
+				keyEncryptionMethod: options.keyEncryptionAlgorithm
+			};
+			callback$1(null, utils.renderTemplate("keyinfo", params));
+		} catch (e) {
+			callback$1(e);
+		}
+	}
+	function encryptKeyInfo(symmetricKey, options, callback$1) {
+		if (!options) return callback$1(/* @__PURE__ */ new Error("must provide options"));
+		if (!options.rsa_pub) return callback$1(/* @__PURE__ */ new Error("must provide options.rsa_pub with public key RSA"));
+		if (!options.pem) return callback$1(/* @__PURE__ */ new Error("must provide options.pem with certificate"));
+		if (!options.keyEncryptionAlgorithm) return callback$1(/* @__PURE__ */ new Error("encryption without encrypted key is not supported yet"));
+		if (options.disallowEncryptionWithInsecureAlgorithm && insecureAlgorithms.indexOf(options.keyEncryptionAlgorithm) >= 0) return callback$1(/* @__PURE__ */ new Error("encryption algorithm " + options.keyEncryptionAlgorithm + "is not secure"));
+		switch (options.keyEncryptionAlgorithm) {
+			case "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p": return encryptKeyInfoWithScheme(symmetricKey, options, "RSA-OAEP", callback$1);
+			case "http://www.w3.org/2001/04/xmlenc#rsa-1_5":
+				utils.warnInsecureAlgorithm(options.keyEncryptionAlgorithm, options.warnInsecureAlgorithm);
+				return encryptKeyInfoWithScheme(symmetricKey, options, "RSAES-PKCS1-V1_5", callback$1);
+			default: return callback$1(/* @__PURE__ */ new Error("encryption key algorithm not supported"));
+		}
+	}
+	function encrypt(content, options, callback$1) {
+		if (!options) return callback$1(/* @__PURE__ */ new Error("must provide options"));
+		if (!content) return callback$1(/* @__PURE__ */ new Error("must provide content to encrypt"));
+		if (!options.rsa_pub) return callback$1(/* @__PURE__ */ new Error("rsa_pub option is mandatory and you should provide a valid RSA public key"));
+		if (!options.pem) return callback$1(/* @__PURE__ */ new Error("pem option is mandatory and you should provide a valid x509 certificate encoded as PEM"));
+		if (options.disallowEncryptionWithInsecureAlgorithm && (insecureAlgorithms.indexOf(options.keyEncryptionAlgorithm) >= 0 || insecureAlgorithms.indexOf(options.encryptionAlgorithm) >= 0)) return callback$1(/* @__PURE__ */ new Error("encryption algorithm " + options.keyEncryptionAlgorithm + " is not secure"));
+		options.input_encoding = options.input_encoding || "utf8";
+		function generate_symmetric_key(cb) {
+			switch (options.encryptionAlgorithm) {
+				case "http://www.w3.org/2001/04/xmlenc#aes128-cbc":
+					crypto.randomBytes(16, cb);
+					break;
+				case "http://www.w3.org/2001/04/xmlenc#aes256-cbc":
+					crypto.randomBytes(32, cb);
+					break;
+				case "http://www.w3.org/2009/xmlenc11#aes128-gcm":
+					crypto.randomBytes(16, cb);
+					break;
+				case "http://www.w3.org/2009/xmlenc11#aes256-gcm":
+					crypto.randomBytes(32, cb);
+					break;
+				case "http://www.w3.org/2001/04/xmlenc#tripledes-cbc":
+					utils.warnInsecureAlgorithm(options.encryptionAlgorithm, options.warnInsecureAlgorithm);
+					crypto.randomBytes(24, cb);
+					break;
+				default: crypto.randomBytes(32, cb);
+			}
+		}
+		function encrypt_content(symmetricKey, cb) {
+			switch (options.encryptionAlgorithm) {
+				case "http://www.w3.org/2001/04/xmlenc#aes128-cbc":
+					encryptWithAlgorithm("aes-128-cbc", symmetricKey, 16, content, options.input_encoding, function(err, encryptedContent) {
+						if (err) return cb(err);
+						cb(null, encryptedContent);
+					});
+					break;
+				case "http://www.w3.org/2001/04/xmlenc#aes256-cbc":
+					encryptWithAlgorithm("aes-256-cbc", symmetricKey, 16, content, options.input_encoding, function(err, encryptedContent) {
+						if (err) return cb(err);
+						cb(null, encryptedContent);
+					});
+					break;
+				case "http://www.w3.org/2009/xmlenc11#aes128-gcm":
+					encryptWithAlgorithm("aes-128-gcm", symmetricKey, 12, content, options.input_encoding, function(err, encryptedContent) {
+						if (err) return cb(err);
+						cb(null, encryptedContent);
+					});
+					break;
+				case "http://www.w3.org/2009/xmlenc11#aes256-gcm":
+					encryptWithAlgorithm("aes-256-gcm", symmetricKey, 12, content, options.input_encoding, function(err, encryptedContent) {
+						if (err) return cb(err);
+						cb(null, encryptedContent);
+					});
+					break;
+				case "http://www.w3.org/2001/04/xmlenc#tripledes-cbc":
+					utils.warnInsecureAlgorithm(options.encryptionAlgorithm, options.warnInsecureAlgorithm);
+					encryptWithAlgorithm("des-ede3-cbc", symmetricKey, 8, content, options.input_encoding, function(err, encryptedContent) {
+						if (err) return cb(err);
+						cb(null, encryptedContent);
+					});
+					break;
+				default: cb(/* @__PURE__ */ new Error("encryption algorithm not supported"));
+			}
+		}
+		function encrypt_key(symmetricKey, encryptedContent, cb) {
+			encryptKeyInfo(symmetricKey, options, function(err, keyInfo) {
+				if (err) return cb(err);
+				cb(null, utils.renderTemplate("encrypted-key", {
+					encryptedContent: encryptedContent.toString("base64"),
+					keyInfo,
+					contentEncryptionMethod: options.encryptionAlgorithm
+				}));
+			});
+		}
+		generate_symmetric_key(function(genKeyError, symmetricKey) {
+			if (genKeyError) return callback$1(genKeyError);
+			encrypt_content(symmetricKey, function(encryptContentError, encryptedContent) {
+				if (encryptContentError) return callback$1(encryptContentError);
+				encrypt_key(symmetricKey, encryptedContent, function(encryptKeyError, result) {
+					if (encryptKeyError) return callback$1(encryptKeyError);
+					callback$1(null, result);
+				});
+			});
+		});
+	}
+	function decrypt(xml, options, callback$1) {
+		if (!options) return callback$1(/* @__PURE__ */ new Error("must provide options"));
+		if (!xml) return callback$1(/* @__PURE__ */ new Error("must provide XML to encrypt"));
+		if (!options.key) return callback$1(/* @__PURE__ */ new Error("key option is mandatory and you should provide a valid RSA private key"));
+		try {
+			var doc = typeof xml === "string" ? new xmldom.DOMParser().parseFromString(xml) : xml;
+			var symmetricKey = decryptKeyInfo(doc, options);
+			var encryptionAlgorithm = xpath.select("//*[local-name(.)='EncryptedData']/*[local-name(.)='EncryptionMethod']", doc)[0].getAttribute("Algorithm");
+			if (options.disallowDecryptionWithInsecureAlgorithm && insecureAlgorithms.indexOf(encryptionAlgorithm) >= 0) return callback$1(/* @__PURE__ */ new Error("encryption algorithm " + encryptionAlgorithm + " is not secure, fail to decrypt"));
+			var encryptedContent = xpath.select("//*[local-name(.)='EncryptedData']/*[local-name(.)='CipherData']/*[local-name(.)='CipherValue']", doc)[0];
+			var encrypted = Buffer.from(encryptedContent.textContent, "base64");
+			switch (encryptionAlgorithm) {
+				case "http://www.w3.org/2001/04/xmlenc#aes128-cbc": return callback$1(null, decryptWithAlgorithm("aes-128-cbc", symmetricKey, 16, encrypted));
+				case "http://www.w3.org/2001/04/xmlenc#aes256-cbc": return callback$1(null, decryptWithAlgorithm("aes-256-cbc", symmetricKey, 16, encrypted));
+				case "http://www.w3.org/2001/04/xmlenc#tripledes-cbc":
+					utils.warnInsecureAlgorithm(encryptionAlgorithm, options.warnInsecureAlgorithm);
+					return callback$1(null, decryptWithAlgorithm("des-ede3-cbc", symmetricKey, 8, encrypted));
+				case "http://www.w3.org/2009/xmlenc11#aes128-gcm": return callback$1(null, decryptWithAlgorithm("aes-128-gcm", symmetricKey, 12, encrypted));
+				case "http://www.w3.org/2009/xmlenc11#aes256-gcm": return callback$1(null, decryptWithAlgorithm("aes-256-gcm", symmetricKey, 12, encrypted));
+				default: return callback$1(/* @__PURE__ */ new Error("encryption algorithm " + encryptionAlgorithm + " not supported"));
+			}
+		} catch (e) {
+			return callback$1(e);
+		}
+	}
+	function decryptKeyInfo(doc, options) {
+		if (typeof doc === "string") doc = new xmldom.DOMParser().parseFromString(doc);
+		var keyRetrievalMethodUri;
+		var keyInfo = xpath.select("//*[local-name(.)='KeyInfo' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']", doc)[0];
+		var keyEncryptionMethod = xpath.select("//*[local-name(.)='KeyInfo']/*[local-name(.)='EncryptedKey']/*[local-name(.)='EncryptionMethod']", doc)[0];
+		if (!keyEncryptionMethod) {
+			var keyRetrievalMethod = xpath.select("//*[local-name(.)='EncryptedData']/*[local-name(.)='KeyInfo']/*[local-name(.)='RetrievalMethod']", doc)[0];
+			keyRetrievalMethodUri = keyRetrievalMethod ? keyRetrievalMethod.getAttribute("URI") : null;
+			keyEncryptionMethod = keyRetrievalMethodUri ? xpath.select("//*[local-name(.)='EncryptedKey' and @Id='" + keyRetrievalMethodUri.substring(1) + "']/*[local-name(.)='EncryptionMethod']", doc)[0] : null;
+		}
+		if (!keyEncryptionMethod) throw new Error("cant find encryption algorithm");
+		var keyEncryptionAlgorithm = keyEncryptionMethod.getAttribute("Algorithm");
+		if (options.disallowDecryptionWithInsecureAlgorithm && insecureAlgorithms.indexOf(keyEncryptionAlgorithm) >= 0) throw new Error("encryption algorithm " + keyEncryptionAlgorithm + " is not secure, fail to decrypt");
+		var encryptedKey = keyRetrievalMethodUri ? xpath.select("//*[local-name(.)='EncryptedKey' and @Id='" + keyRetrievalMethodUri.substring(1) + "']/*[local-name(.)='CipherData']/*[local-name(.)='CipherValue']", keyInfo)[0] : xpath.select("//*[local-name(.)='CipherValue']", keyInfo)[0];
+		switch (keyEncryptionAlgorithm) {
+			case "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p": return decryptKeyInfoWithScheme(encryptedKey, options, "RSA-OAEP");
+			case "http://www.w3.org/2001/04/xmlenc#rsa-1_5":
+				utils.warnInsecureAlgorithm(keyEncryptionAlgorithm, options.warnInsecureAlgorithm);
+				return decryptKeyInfoWithScheme(encryptedKey, options, "RSAES-PKCS1-V1_5");
+			default: throw new Error("key encryption algorithm " + keyEncryptionAlgorithm + " not supported");
+		}
+	}
+	function decryptKeyInfoWithScheme(encryptedKey, options, scheme) {
+		var padding = scheme === "RSA-OAEP" ? crypto.constants.RSA_PKCS1_OAEP_PADDING : crypto.constants.RSA_PKCS1_PADDING;
+		var key = Buffer.from(encryptedKey.textContent, "base64");
+		var decrypted = crypto.privateDecrypt({
+			key: options.key,
+			padding
+		}, key);
+		return Buffer.from(decrypted, "binary");
+	}
+	function encryptWithAlgorithm(algorithm, symmetricKey, ivLength, content, encoding, callback$1) {
+		crypto.randomBytes(ivLength, function(err, iv) {
+			if (err) return callback$1(err);
+			var cipher = crypto.createCipheriv(algorithm, symmetricKey, iv);
+			var encrypted = cipher.update(content, encoding, "binary") + cipher.final("binary");
+			var authTag = algorithm.slice(-3) === "gcm" ? cipher.getAuthTag() : Buffer.from("");
+			return callback$1(null, Buffer.concat([
+				iv,
+				Buffer.from(encrypted, "binary"),
+				authTag
+			]));
+		});
+	}
+	function decryptWithAlgorithm(algorithm, symmetricKey, ivLength, content) {
+		var decipher = crypto.createDecipheriv(algorithm, symmetricKey, content.slice(0, ivLength));
+		decipher.setAutoPadding(false);
+		if (algorithm.slice(-3) === "gcm") {
+			decipher.setAuthTag(content.slice(-16));
+			content = content.slice(0, -16);
+		}
+		var decrypted = decipher.update(content.slice(ivLength), null, "binary") + decipher.final("binary");
+		if (algorithm.slice(-3) !== "gcm") {
+			var padding = decrypted.charCodeAt(decrypted.length - 1);
+			if (1 <= padding && padding <= ivLength) decrypted = decrypted.substr(0, decrypted.length - padding);
+			else {
+				callback(/* @__PURE__ */ new Error("padding length invalid"));
+				return;
+			}
+		}
+		return Buffer.from(decrypted, "binary").toString("utf8");
+	}
+	exports = module.exports = {
+		decrypt,
+		encrypt,
+		encryptKeyInfo,
+		decryptKeyInfo
+	};
+}) });
+
+//#endregion
+Object.defineProperty(exports, 'default', {
+  enumerable: true,
+  get: function () {
+    return require_xmlenc();
+  }
+});
+//# sourceMappingURL=xmlenc.cjs.map

package/dist/cjs/node_modules/@authenio/xml-encryption/lib/xmlenc.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"xmlenc.cjs","names":["callback"],"sources":["../../../../../../../../node_modules/@authenio/xml-encryption/lib/xmlenc.js"],"sourcesContent":["var crypto  = require('crypto');\nvar xmldom  = require('@xmldom/xmldom');\nvar xpath   = require('xpath');\nvar utils   = require('./utils');\n\nconst insecureAlgorithms = [\n  //https://www.w3.org/TR/xmlenc-core1/#rsav15note\n  'http://www.w3.org/2001/04/xmlenc#rsa-1_5',\n  //https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA\n  'http://www.w3.org/2001/04/xmlenc#tripledes-cbc'];\n\nfunction encryptKeyInfoWithScheme(symmetricKey, options, scheme, callback) {\n  const padding = scheme === 'RSA-OAEP' ? crypto.constants.RSA_PKCS1_OAEP_PADDING : crypto.constants.RSA_PKCS1_PADDING;\n  const symmetricKeyBuffer = Buffer.isBuffer(symmetricKey) ? symmetricKey : Buffer.from(symmetricKey, 'utf-8');\n\n  try {\n    var encrypted = crypto.publicEncrypt({\n      key: options.rsa_pub,\n      padding: padding\n    }, symmetricKeyBuffer);\n    var base64EncodedEncryptedKey = encrypted.toString('base64');\n\n    var params = {\n      encryptedKey:  base64EncodedEncryptedKey,\n      encryptionPublicCert: '<X509Data><X509Certificate>' + utils.pemToCert(options.pem.toString()) + '</X509Certificate></X509Data>',\n      keyEncryptionMethod: options.keyEncryptionAlgorithm\n    };\n\n    var result = utils.renderTemplate('keyinfo', params);\n    callback(null, result);\n  } catch (e) {\n    callback(e);\n  }\n}\n\nfunction encryptKeyInfo(symmetricKey, options, callback) {\n  if (!options)\n    return callback(new Error('must provide options'));\n  if (!options.rsa_pub)\n    return callback(new Error('must provide options.rsa_pub with public key RSA'));\n  if (!options.pem)\n    return callback(new Error('must provide options.pem with certificate'));\n\n  if (!options.keyEncryptionAlgorithm)\n    return callback(new Error('encryption without encrypted key is not supported yet'));\n  if (options.disallowEncryptionWithInsecureAlgorithm\n    && insecureAlgorithms.indexOf(options.keyEncryptionAlgorithm) >= 0) {\n    return callback(new Error('encryption algorithm ' + options.keyEncryptionAlgorithm + 'is not secure'));\n  }\n  switch (options.keyEncryptionAlgorithm) {\n    case 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p':\n      return encryptKeyInfoWithScheme(symmetricKey, options, 'RSA-OAEP', callback);\n\n    case 'http://www.w3.org/2001/04/xmlenc#rsa-1_5':\n      utils.warnInsecureAlgorithm(options.keyEncryptionAlgorithm, options.warnInsecureAlgorithm);\n      return encryptKeyInfoWithScheme(symmetricKey, options, 'RSAES-PKCS1-V1_5', callback);\n\n    default:\n      return callback(new Error('encryption key algorithm not supported'));\n  }\n}\n\nfunction encrypt(content, options, callback) {\n  if (!options)\n    return callback(new Error('must provide options'));\n  if (!content)\n    return callback(new Error('must provide content to encrypt'));\n  if (!options.rsa_pub)\n    return callback(new Error('rsa_pub option is mandatory and you should provide a valid RSA public key'));\n  if (!options.pem)\n    return callback(new Error('pem option is mandatory and you should provide a valid x509 certificate encoded as PEM'));\n  if (options.disallowEncryptionWithInsecureAlgorithm\n    && (insecureAlgorithms.indexOf(options.keyEncryptionAlgorithm) >= 0\n      || insecureAlgorithms.indexOf(options.encryptionAlgorithm) >= 0)) {\n    return callback(new Error('encryption algorithm ' + options.keyEncryptionAlgorithm + ' is not secure'));\n  }\n  options.input_encoding = options.input_encoding || 'utf8';\n\n  function generate_symmetric_key(cb) {\n    switch (options.encryptionAlgorithm) {\n      case 'http://www.w3.org/2001/04/xmlenc#aes128-cbc':\n        crypto.randomBytes(16, cb); // generate a symmetric random key 16 bytes length\n        break;\n      case 'http://www.w3.org/2001/04/xmlenc#aes256-cbc':\n        crypto.randomBytes(32, cb); // generate a symmetric random key 32 bytes length\n        break;\n      case 'http://www.w3.org/2009/xmlenc11#aes128-gcm':\n        crypto.randomBytes(16, cb); // generate a symmetric random key 16 bytes length\n        break;\n      case 'http://www.w3.org/2009/xmlenc11#aes256-gcm':\n        crypto.randomBytes(32, cb); // generate a symmetric random key 32 bytes length\n        break;\n      case 'http://www.w3.org/2001/04/xmlenc#tripledes-cbc':\n        utils.warnInsecureAlgorithm(options.encryptionAlgorithm, options.warnInsecureAlgorithm);\n        crypto.randomBytes(24, cb); // generate a symmetric random key 24 bytes (192 bits) length\n        break;\n      default:\n        crypto.randomBytes(32, cb); // generate a symmetric random key 32 bytes length\n    }\n  }\n\n  function encrypt_content(symmetricKey, cb) {\n    switch (options.encryptionAlgorithm) {\n      case 'http://www.w3.org/2001/04/xmlenc#aes128-cbc':\n        encryptWithAlgorithm('aes-128-cbc', symmetricKey, 16, content, options.input_encoding, function (err, encryptedContent) {\n          if (err) return cb(err);\n          cb(null, encryptedContent);\n        });\n        break;\n      case 'http://www.w3.org/2001/04/xmlenc#aes256-cbc':\n        encryptWithAlgorithm('aes-256-cbc', symmetricKey, 16, content, options.input_encoding, function (err, encryptedContent) {\n          if (err) return cb(err);\n          cb(null, encryptedContent);\n        });\n        break;\n      case 'http://www.w3.org/2009/xmlenc11#aes128-gcm':\n        encryptWithAlgorithm('aes-128-gcm', symmetricKey, 12, content, options.input_encoding, function (err, encryptedContent) {\n          if (err) return cb(err);\n          cb(null, encryptedContent);\n        });\n        break;\n      case 'http://www.w3.org/2009/xmlenc11#aes256-gcm':\n        encryptWithAlgorithm('aes-256-gcm', symmetricKey, 12, content, options.input_encoding, function (err, encryptedContent) {\n          if (err) return cb(err);\n          cb(null, encryptedContent);\n        });\n        break;\n      case 'http://www.w3.org/2001/04/xmlenc#tripledes-cbc':\n        utils.warnInsecureAlgorithm(options.encryptionAlgorithm, options.warnInsecureAlgorithm);\n        encryptWithAlgorithm('des-ede3-cbc', symmetricKey, 8, content, options.input_encoding, function (err, encryptedContent) {\n          if (err) return cb(err);\n          cb(null, encryptedContent);\n        });\n        break;\n      default:\n        cb(new Error('encryption algorithm not supported'));\n    }\n  }\n\n  function encrypt_key(symmetricKey, encryptedContent, cb) {\n    encryptKeyInfo(symmetricKey, options, function(err, keyInfo) {\n      if (err) return cb(err);\n      var result = utils.renderTemplate('encrypted-key', {\n        encryptedContent: encryptedContent.toString('base64'),\n        keyInfo: keyInfo,\n        contentEncryptionMethod: options.encryptionAlgorithm\n      });\n\n      cb(null, result);\n    });\n  }\n\n\n  generate_symmetric_key(function (genKeyError, symmetricKey) {\n    if (genKeyError) {\n      return callback(genKeyError);\n    }\n\n    encrypt_content(symmetricKey, function(encryptContentError, encryptedContent) {\n      if (encryptContentError) {\n        return callback(encryptContentError);\n      }\n\n      encrypt_key(symmetricKey, encryptedContent, function (encryptKeyError, result) {\n        if (encryptKeyError) {\n          return callback(encryptKeyError);\n        }\n\n        callback(null, result);\n      });\n\n    });\n\n  });\n}\n\nfunction decrypt(xml, options, callback) {\n  if (!options)\n    return callback(new Error('must provide options'));\n  if (!xml)\n    return callback(new Error('must provide XML to encrypt'));\n  if (!options.key)\n    return callback(new Error('key option is mandatory and you should provide a valid RSA private key'));\n  try {\n    var doc = typeof xml === 'string' ? new xmldom.DOMParser().parseFromString(xml) : xml;\n\n    var symmetricKey = decryptKeyInfo(doc, options);\n    var encryptionMethod = xpath.select(\"//*[local-name(.)='EncryptedData']/*[local-name(.)='EncryptionMethod']\", doc)[0];\n    var encryptionAlgorithm = encryptionMethod.getAttribute('Algorithm');\n\n    if (options.disallowDecryptionWithInsecureAlgorithm\n      && insecureAlgorithms.indexOf(encryptionAlgorithm) >= 0) {\n      return callback(new Error('encryption algorithm ' + encryptionAlgorithm + ' is not secure, fail to decrypt'));\n    }\n    var encryptedContent = xpath.select(\"//*[local-name(.)='EncryptedData']/*[local-name(.)='CipherData']/*[local-name(.)='CipherValue']\", doc)[0];\n\n    var encrypted = Buffer.from(encryptedContent.textContent, 'base64');\n    switch (encryptionAlgorithm) {\n      case 'http://www.w3.org/2001/04/xmlenc#aes128-cbc':\n        return callback(null, decryptWithAlgorithm('aes-128-cbc', symmetricKey, 16, encrypted));\n      case 'http://www.w3.org/2001/04/xmlenc#aes256-cbc':\n        return callback(null, decryptWithAlgorithm('aes-256-cbc', symmetricKey, 16, encrypted));\n      case 'http://www.w3.org/2001/04/xmlenc#tripledes-cbc':\n        utils.warnInsecureAlgorithm(encryptionAlgorithm, options.warnInsecureAlgorithm);\n        return callback(null, decryptWithAlgorithm('des-ede3-cbc', symmetricKey, 8, encrypted));\n      case 'http://www.w3.org/2009/xmlenc11#aes128-gcm':\n        return callback(null, decryptWithAlgorithm('aes-128-gcm', symmetricKey, 12, encrypted));\n      case 'http://www.w3.org/2009/xmlenc11#aes256-gcm':\n        return callback(null, decryptWithAlgorithm('aes-256-gcm', symmetricKey, 12, encrypted));\n      default:\n        return callback(new Error('encryption algorithm ' + encryptionAlgorithm + ' not supported'));\n    }\n  } catch (e) {\n    return callback(e);\n  }\n}\n\nfunction decryptKeyInfo(doc, options) {\n  if (typeof doc === 'string') doc = new xmldom.DOMParser().parseFromString(doc);\n\n  var keyRetrievalMethodUri;\n  var keyInfo = xpath.select(\"//*[local-name(.)='KeyInfo' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']\", doc)[0];\n  var keyEncryptionMethod = xpath.select(\"//*[local-name(.)='KeyInfo']/*[local-name(.)='EncryptedKey']/*[local-name(.)='EncryptionMethod']\", doc)[0];\n\n  if (!keyEncryptionMethod) { // try with EncryptedData->KeyInfo->RetrievalMethod\n    var keyRetrievalMethod = xpath.select(\"//*[local-name(.)='EncryptedData']/*[local-name(.)='KeyInfo']/*[local-name(.)='RetrievalMethod']\", doc)[0];\n    keyRetrievalMethodUri = keyRetrievalMethod ? keyRetrievalMethod.getAttribute('URI') : null;\n    keyEncryptionMethod = keyRetrievalMethodUri ? xpath.select(\"//*[local-name(.)='EncryptedKey' and @Id='\" + keyRetrievalMethodUri.substring(1) + \"']/*[local-name(.)='EncryptionMethod']\", doc)[0] : null;\n  }\n\n  if (!keyEncryptionMethod) {\n    throw new Error('cant find encryption algorithm');\n  }\n\n  var keyEncryptionAlgorithm = keyEncryptionMethod.getAttribute('Algorithm');\n  if (options.disallowDecryptionWithInsecureAlgorithm\n    && insecureAlgorithms.indexOf(keyEncryptionAlgorithm) >= 0) {\n    throw new Error('encryption algorithm ' + keyEncryptionAlgorithm + ' is not secure, fail to decrypt');\n  }\n  var encryptedKey = keyRetrievalMethodUri ?\n    xpath.select(\"//*[local-name(.)='EncryptedKey' and @Id='\" + keyRetrievalMethodUri.substring(1) + \"']/*[local-name(.)='CipherData']/*[local-name(.)='CipherValue']\", keyInfo)[0] :\n    xpath.select(\"//*[local-name(.)='CipherValue']\", keyInfo)[0];\n\n  switch (keyEncryptionAlgorithm) {\n    case 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p':\n      return decryptKeyInfoWithScheme(encryptedKey, options, 'RSA-OAEP');\n    case 'http://www.w3.org/2001/04/xmlenc#rsa-1_5':\n      utils.warnInsecureAlgorithm(keyEncryptionAlgorithm, options.warnInsecureAlgorithm);\n      return decryptKeyInfoWithScheme(encryptedKey, options, 'RSAES-PKCS1-V1_5');\n    default:\n      throw new Error('key encryption algorithm ' + keyEncryptionAlgorithm + ' not supported');\n  }\n}\n\nfunction decryptKeyInfoWithScheme(encryptedKey, options, scheme) {\n  var padding = scheme === 'RSA-OAEP' ? crypto.constants.RSA_PKCS1_OAEP_PADDING : crypto.constants.RSA_PKCS1_PADDING;\n  var key = Buffer.from(encryptedKey.textContent, 'base64');\n  var decrypted = crypto.privateDecrypt({ key: options.key, padding: padding}, key);\n  return Buffer.from(decrypted, 'binary');\n}\n\nfunction encryptWithAlgorithm(algorithm, symmetricKey, ivLength, content, encoding, callback) {\n  // create a random iv for algorithm\n  crypto.randomBytes(ivLength, function(err, iv) {\n    if (err) return callback(err);\n\n    var cipher = crypto.createCipheriv(algorithm, symmetricKey, iv);\n    // encrypted content\n    var encrypted = cipher.update(content, encoding, 'binary') + cipher.final('binary');\n    var authTag = algorithm.slice(-3) === \"gcm\" ? cipher.getAuthTag() : Buffer.from(\"\");\n    //Format mentioned: https://www.w3.org/TR/xmlenc-core1/#sec-AES-GCM\n    var r = Buffer.concat([iv, Buffer.from(encrypted, 'binary'), authTag]);\n    return callback(null, r);\n  });\n}\n\nfunction decryptWithAlgorithm(algorithm, symmetricKey, ivLength, content) {\n  var decipher = crypto.createDecipheriv(algorithm, symmetricKey, content.slice(0,ivLength));\n  decipher.setAutoPadding(false);\n\n  if (algorithm.slice(-3) === \"gcm\") {\n    decipher.setAuthTag(content.slice(-16));\n    content = content.slice(0,-16);\n  }\n  var decrypted = decipher.update(content.slice(ivLength), null, 'binary') + decipher.final('binary');\n\nif (algorithm.slice(-3) !== \"gcm\") {\n  // Remove padding bytes equal to the value of the last byte of the returned data.\n  // Padding for GCM not required per: https://www.w3.org/TR/xmlenc-core1/#sec-AES-GCM\n  var padding = decrypted.charCodeAt(decrypted.length - 1);\n  if (1 <= padding && padding <= ivLength) {\n    decrypted = decrypted.substr(0, decrypted.length - padding);\n  } else {\n    callback(new Error('padding length invalid'));\n    return;\n  }\n}\n\n  return Buffer.from(decrypted, 'binary').toString('utf8');\n}\n\nexports = module.exports = {\n  decrypt: decrypt,\n  encrypt: encrypt,\n  encryptKeyInfo: encryptKeyInfo,\n  decryptKeyInfo: decryptKeyInfo\n};\n"],"x_google_ignoreList":[0],"mappings":";;;;;;;CAAA,IAAI,SAAU,QAAQ,SAAS;CAC/B,IAAI;CACJ,IAAI;CACJ,IAAI;CAEJ,MAAM,qBAAqB,CAEzB,4CAEA,iDAAiD;CAEnD,SAAS,yBAAyB,cAAc,SAAS,QAAQ,YAAU;EACzE,MAAM,UAAU,WAAW,aAAa,OAAO,UAAU,yBAAyB,OAAO,UAAU;EACnG,MAAM,qBAAqB,OAAO,SAAS,aAAa,GAAG,eAAe,OAAO,KAAK,cAAc,QAAQ;AAE5G,MAAI;GAOF,IAAI,SAAS;IACX,cAPc,OAAO,cAAc;KACnC,KAAK,QAAQ;KACJ;KACV,EAAE,mBAAmB,CACoB,SAAS,SAAS;IAI1D,sBAAsB,gCAAgC,MAAM,UAAU,QAAQ,IAAI,UAAU,CAAC,GAAG;IAChG,qBAAqB,QAAQ;IAC9B;AAGD,cAAS,MADI,MAAM,eAAe,WAAW,OAAO,CAC9B;WACf,GAAG;AACV,cAAS,EAAE;;;CAIf,SAAS,eAAe,cAAc,SAAS,YAAU;AACvD,MAAI,CAAC,QACH,QAAOA,2BAAS,IAAI,MAAM,uBAAuB,CAAC;AACpD,MAAI,CAAC,QAAQ,QACX,QAAOA,2BAAS,IAAI,MAAM,mDAAmD,CAAC;AAChF,MAAI,CAAC,QAAQ,IACX,QAAOA,2BAAS,IAAI,MAAM,4CAA4C,CAAC;AAEzE,MAAI,CAAC,QAAQ,uBACX,QAAOA,2BAAS,IAAI,MAAM,wDAAwD,CAAC;AACrF,MAAI,QAAQ,2CACP,mBAAmB,QAAQ,QAAQ,uBAAuB,IAAI,EACjE,QAAOA,2BAAS,IAAI,MAAM,0BAA0B,QAAQ,yBAAyB,gBAAgB,CAAC;AAExG,UAAQ,QAAQ,wBAAhB;GACE,KAAK,kDACH,QAAO,yBAAyB,cAAc,SAAS,YAAYA,WAAS;GAE9E,KAAK;AACH,UAAM,sBAAsB,QAAQ,wBAAwB,QAAQ,sBAAsB;AAC1F,WAAO,yBAAyB,cAAc,SAAS,oBAAoBA,WAAS;GAEtF,QACE,QAAOA,2BAAS,IAAI,MAAM,yCAAyC,CAAC;;;CAI1E,SAAS,QAAQ,SAAS,SAAS,YAAU;AAC3C,MAAI,CAAC,QACH,QAAOA,2BAAS,IAAI,MAAM,uBAAuB,CAAC;AACpD,MAAI,CAAC,QACH,QAAOA,2BAAS,IAAI,MAAM,kCAAkC,CAAC;AAC/D,MAAI,CAAC,QAAQ,QACX,QAAOA,2BAAS,IAAI,MAAM,4EAA4E,CAAC;AACzG,MAAI,CAAC,QAAQ,IACX,QAAOA,2BAAS,IAAI,MAAM,yFAAyF,CAAC;AACtH,MAAI,QAAQ,4CACN,mBAAmB,QAAQ,QAAQ,uBAAuB,IAAI,KAC7D,mBAAmB,QAAQ,QAAQ,oBAAoB,IAAI,GAChE,QAAOA,2BAAS,IAAI,MAAM,0BAA0B,QAAQ,yBAAyB,iBAAiB,CAAC;AAEzG,UAAQ,iBAAiB,QAAQ,kBAAkB;EAEnD,SAAS,uBAAuB,IAAI;AAClC,WAAQ,QAAQ,qBAAhB;IACE,KAAK;AACH,YAAO,YAAY,IAAI,GAAG;AAC1B;IACF,KAAK;AACH,YAAO,YAAY,IAAI,GAAG;AAC1B;IACF,KAAK;AACH,YAAO,YAAY,IAAI,GAAG;AAC1B;IACF,KAAK;AACH,YAAO,YAAY,IAAI,GAAG;AAC1B;IACF,KAAK;AACH,WAAM,sBAAsB,QAAQ,qBAAqB,QAAQ,sBAAsB;AACvF,YAAO,YAAY,IAAI,GAAG;AAC1B;IACF,QACE,QAAO,YAAY,IAAI,GAAG;;;EAIhC,SAAS,gBAAgB,cAAc,IAAI;AACzC,WAAQ,QAAQ,qBAAhB;IACE,KAAK;AACH,0BAAqB,eAAe,cAAc,IAAI,SAAS,QAAQ,gBAAgB,SAAU,KAAK,kBAAkB;AACtH,UAAI,IAAK,QAAO,GAAG,IAAI;AACvB,SAAG,MAAM,iBAAiB;OAC1B;AACF;IACF,KAAK;AACH,0BAAqB,eAAe,cAAc,IAAI,SAAS,QAAQ,gBAAgB,SAAU,KAAK,kBAAkB;AACtH,UAAI,IAAK,QAAO,GAAG,IAAI;AACvB,SAAG,MAAM,iBAAiB;OAC1B;AACF;IACF,KAAK;AACH,0BAAqB,eAAe,cAAc,IAAI,SAAS,QAAQ,gBAAgB,SAAU,KAAK,kBAAkB;AACtH,UAAI,IAAK,QAAO,GAAG,IAAI;AACvB,SAAG,MAAM,iBAAiB;OAC1B;AACF;IACF,KAAK;AACH,0BAAqB,eAAe,cAAc,IAAI,SAAS,QAAQ,gBAAgB,SAAU,KAAK,kBAAkB;AACtH,UAAI,IAAK,QAAO,GAAG,IAAI;AACvB,SAAG,MAAM,iBAAiB;OAC1B;AACF;IACF,KAAK;AACH,WAAM,sBAAsB,QAAQ,qBAAqB,QAAQ,sBAAsB;AACvF,0BAAqB,gBAAgB,cAAc,GAAG,SAAS,QAAQ,gBAAgB,SAAU,KAAK,kBAAkB;AACtH,UAAI,IAAK,QAAO,GAAG,IAAI;AACvB,SAAG,MAAM,iBAAiB;OAC1B;AACF;IACF,QACE,oBAAG,IAAI,MAAM,qCAAqC,CAAC;;;EAIzD,SAAS,YAAY,cAAc,kBAAkB,IAAI;AACvD,kBAAe,cAAc,SAAS,SAAS,KAAK,SAAS;AAC3D,QAAI,IAAK,QAAO,GAAG,IAAI;AAOvB,OAAG,MANU,MAAM,eAAe,iBAAiB;KACjD,kBAAkB,iBAAiB,SAAS,SAAS;KAC5C;KACT,yBAAyB,QAAQ;KAClC,CAAC,CAEc;KAChB;;AAIJ,yBAAuB,SAAU,aAAa,cAAc;AAC1D,OAAI,YACF,QAAOA,WAAS,YAAY;AAG9B,mBAAgB,cAAc,SAAS,qBAAqB,kBAAkB;AAC5E,QAAI,oBACF,QAAOA,WAAS,oBAAoB;AAGtC,gBAAY,cAAc,kBAAkB,SAAU,iBAAiB,QAAQ;AAC7E,SAAI,gBACF,QAAOA,WAAS,gBAAgB;AAGlC,gBAAS,MAAM,OAAO;MACtB;KAEF;IAEF;;CAGJ,SAAS,QAAQ,KAAK,SAAS,YAAU;AACvC,MAAI,CAAC,QACH,QAAOA,2BAAS,IAAI,MAAM,uBAAuB,CAAC;AACpD,MAAI,CAAC,IACH,QAAOA,2BAAS,IAAI,MAAM,8BAA8B,CAAC;AAC3D,MAAI,CAAC,QAAQ,IACX,QAAOA,2BAAS,IAAI,MAAM,yEAAyE,CAAC;AACtG,MAAI;GACF,IAAI,MAAM,OAAO,QAAQ,WAAW,IAAI,OAAO,WAAW,CAAC,gBAAgB,IAAI,GAAG;GAElF,IAAI,eAAe,eAAe,KAAK,QAAQ;GAE/C,IAAI,sBADmB,MAAM,OAAO,0EAA0E,IAAI,CAAC,GACxE,aAAa,YAAY;AAEpE,OAAI,QAAQ,2CACP,mBAAmB,QAAQ,oBAAoB,IAAI,EACtD,QAAOA,2BAAS,IAAI,MAAM,0BAA0B,sBAAsB,kCAAkC,CAAC;GAE/G,IAAI,mBAAmB,MAAM,OAAO,mGAAmG,IAAI,CAAC;GAE5I,IAAI,YAAY,OAAO,KAAK,iBAAiB,aAAa,SAAS;AACnE,WAAQ,qBAAR;IACE,KAAK,8CACH,QAAOA,WAAS,MAAM,qBAAqB,eAAe,cAAc,IAAI,UAAU,CAAC;IACzF,KAAK,8CACH,QAAOA,WAAS,MAAM,qBAAqB,eAAe,cAAc,IAAI,UAAU,CAAC;IACzF,KAAK;AACH,WAAM,sBAAsB,qBAAqB,QAAQ,sBAAsB;AAC/E,YAAOA,WAAS,MAAM,qBAAqB,gBAAgB,cAAc,GAAG,UAAU,CAAC;IACzF,KAAK,6CACH,QAAOA,WAAS,MAAM,qBAAqB,eAAe,cAAc,IAAI,UAAU,CAAC;IACzF,KAAK,6CACH,QAAOA,WAAS,MAAM,qBAAqB,eAAe,cAAc,IAAI,UAAU,CAAC;IACzF,QACE,QAAOA,2BAAS,IAAI,MAAM,0BAA0B,sBAAsB,iBAAiB,CAAC;;WAEzF,GAAG;AACV,UAAOA,WAAS,EAAE;;;CAItB,SAAS,eAAe,KAAK,SAAS;AACpC,MAAI,OAAO,QAAQ,SAAU,OAAM,IAAI,OAAO,WAAW,CAAC,gBAAgB,IAAI;EAE9E,IAAI;EACJ,IAAI,UAAU,MAAM,OAAO,0FAA0F,IAAI,CAAC;EAC1H,IAAI,sBAAsB,MAAM,OAAO,oGAAoG,IAAI,CAAC;AAEhJ,MAAI,CAAC,qBAAqB;GACxB,IAAI,qBAAqB,MAAM,OAAO,oGAAoG,IAAI,CAAC;AAC/I,2BAAwB,qBAAqB,mBAAmB,aAAa,MAAM,GAAG;AACtF,yBAAsB,wBAAwB,MAAM,OAAO,+CAA+C,sBAAsB,UAAU,EAAE,GAAG,0CAA0C,IAAI,CAAC,KAAK;;AAGrM,MAAI,CAAC,oBACH,OAAM,IAAI,MAAM,iCAAiC;EAGnD,IAAI,yBAAyB,oBAAoB,aAAa,YAAY;AAC1E,MAAI,QAAQ,2CACP,mBAAmB,QAAQ,uBAAuB,IAAI,EACzD,OAAM,IAAI,MAAM,0BAA0B,yBAAyB,kCAAkC;EAEvG,IAAI,eAAe,wBACjB,MAAM,OAAO,+CAA+C,sBAAsB,UAAU,EAAE,GAAG,mEAAmE,QAAQ,CAAC,KAC7K,MAAM,OAAO,oCAAoC,QAAQ,CAAC;AAE5D,UAAQ,wBAAR;GACE,KAAK,kDACH,QAAO,yBAAyB,cAAc,SAAS,WAAW;GACpE,KAAK;AACH,UAAM,sBAAsB,wBAAwB,QAAQ,sBAAsB;AAClF,WAAO,yBAAyB,cAAc,SAAS,mBAAmB;GAC5E,QACE,OAAM,IAAI,MAAM,8BAA8B,yBAAyB,iBAAiB;;;CAI9F,SAAS,yBAAyB,cAAc,SAAS,QAAQ;EAC/D,IAAI,UAAU,WAAW,aAAa,OAAO,UAAU,yBAAyB,OAAO,UAAU;EACjG,IAAI,MAAM,OAAO,KAAK,aAAa,aAAa,SAAS;EACzD,IAAI,YAAY,OAAO,eAAe;GAAE,KAAK,QAAQ;GAAc;GAAQ,EAAE,IAAI;AACjF,SAAO,OAAO,KAAK,WAAW,SAAS;;CAGzC,SAAS,qBAAqB,WAAW,cAAc,UAAU,SAAS,UAAU,YAAU;AAE5F,SAAO,YAAY,UAAU,SAAS,KAAK,IAAI;AAC7C,OAAI,IAAK,QAAOA,WAAS,IAAI;GAE7B,IAAI,SAAS,OAAO,eAAe,WAAW,cAAc,GAAG;GAE/D,IAAI,YAAY,OAAO,OAAO,SAAS,UAAU,SAAS,GAAG,OAAO,MAAM,SAAS;GACnF,IAAI,UAAU,UAAU,MAAM,GAAG,KAAK,QAAQ,OAAO,YAAY,GAAG,OAAO,KAAK,GAAG;AAGnF,UAAOA,WAAS,MADR,OAAO,OAAO;IAAC;IAAI,OAAO,KAAK,WAAW,SAAS;IAAE;IAAQ,CAAC,CAC9C;IACxB;;CAGJ,SAAS,qBAAqB,WAAW,cAAc,UAAU,SAAS;EACxE,IAAI,WAAW,OAAO,iBAAiB,WAAW,cAAc,QAAQ,MAAM,GAAE,SAAS,CAAC;AAC1F,WAAS,eAAe,MAAM;AAE9B,MAAI,UAAU,MAAM,GAAG,KAAK,OAAO;AACjC,YAAS,WAAW,QAAQ,MAAM,IAAI,CAAC;AACvC,aAAU,QAAQ,MAAM,GAAE,IAAI;;EAEhC,IAAI,YAAY,SAAS,OAAO,QAAQ,MAAM,SAAS,EAAE,MAAM,SAAS,GAAG,SAAS,MAAM,SAAS;AAErG,MAAI,UAAU,MAAM,GAAG,KAAK,OAAO;GAGjC,IAAI,UAAU,UAAU,WAAW,UAAU,SAAS,EAAE;AACxD,OAAI,KAAK,WAAW,WAAW,SAC7B,aAAY,UAAU,OAAO,GAAG,UAAU,SAAS,QAAQ;QACtD;AACL,6BAAS,IAAI,MAAM,yBAAyB,CAAC;AAC7C;;;AAIF,SAAO,OAAO,KAAK,WAAW,SAAS,CAAC,SAAS,OAAO;;AAG1D,WAAU,OAAO,UAAU;EAChB;EACA;EACO;EACA;EACjB"}