@intlayer/backend 7.1.4 → 7.1.5

package/dist/esm/node_modules/node-forge/lib/pkcs12.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"pkcs12.mjs","names":["error"],"sources":["../../../../../../../node_modules/node-forge/lib/pkcs12.js"],"sourcesContent":["/**\n * Javascript implementation of PKCS#12.\n *\n * @author Dave Longley\n * @author Stefan Siegl <stesie@brokenpipe.de>\n *\n * Copyright (c) 2010-2014 Digital Bazaar, Inc.\n * Copyright (c) 2012 Stefan Siegl <stesie@brokenpipe.de>\n *\n * The ASN.1 representation of PKCS#12 is as follows\n * (see ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-12/pkcs-12-tc1.pdf for details)\n *\n * PFX ::= SEQUENCE {\n *   version  INTEGER {v3(3)}(v3,...),\n *   authSafe ContentInfo,\n *   macData  MacData OPTIONAL\n * }\n *\n * MacData ::= SEQUENCE {\n *   mac DigestInfo,\n *   macSalt OCTET STRING,\n *   iterations INTEGER DEFAULT 1\n * }\n * Note: The iterations default is for historical reasons and its use is\n * deprecated. A higher value, like 1024, is recommended.\n *\n * DigestInfo is defined in PKCS#7 as follows:\n *\n * DigestInfo ::= SEQUENCE {\n *   digestAlgorithm DigestAlgorithmIdentifier,\n *   digest Digest\n * }\n *\n * DigestAlgorithmIdentifier ::= AlgorithmIdentifier\n *\n * The AlgorithmIdentifier contains an Object Identifier (OID) and parameters\n * for the algorithm, if any. In the case of SHA1 there is none.\n *\n * AlgorithmIdentifer ::= SEQUENCE {\n *    algorithm OBJECT IDENTIFIER,\n *    parameters ANY DEFINED BY algorithm OPTIONAL\n * }\n *\n * Digest ::= OCTET STRING\n *\n *\n * ContentInfo ::= SEQUENCE {\n *   contentType ContentType,\n *   content     [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL\n * }\n *\n * ContentType ::= OBJECT IDENTIFIER\n *\n * AuthenticatedSafe ::= SEQUENCE OF ContentInfo\n * -- Data if unencrypted\n * -- EncryptedData if password-encrypted\n * -- EnvelopedData if public key-encrypted\n *\n *\n * SafeContents ::= SEQUENCE OF SafeBag\n *\n * SafeBag ::= SEQUENCE {\n *   bagId     BAG-TYPE.&id ({PKCS12BagSet})\n *   bagValue  [0] EXPLICIT BAG-TYPE.&Type({PKCS12BagSet}{@bagId}),\n *   bagAttributes SET OF PKCS12Attribute OPTIONAL\n * }\n *\n * PKCS12Attribute ::= SEQUENCE {\n *   attrId ATTRIBUTE.&id ({PKCS12AttrSet}),\n *   attrValues SET OF ATTRIBUTE.&Type ({PKCS12AttrSet}{@attrId})\n * } -- This type is compatible with the X.500 type 'Attribute'\n *\n * PKCS12AttrSet ATTRIBUTE ::= {\n *   friendlyName | -- from PKCS #9\n *   localKeyId, -- from PKCS #9\n *   ... -- Other attributes are allowed\n * }\n *\n * CertBag ::= SEQUENCE {\n *   certId    BAG-TYPE.&id   ({CertTypes}),\n *   certValue [0] EXPLICIT BAG-TYPE.&Type ({CertTypes}{@certId})\n * }\n *\n * x509Certificate BAG-TYPE ::= {OCTET STRING IDENTIFIED BY {certTypes 1}}\n *   -- DER-encoded X.509 certificate stored in OCTET STRING\n *\n * sdsiCertificate BAG-TYPE ::= {IA5String IDENTIFIED BY {certTypes 2}}\n * -- Base64-encoded SDSI certificate stored in IA5String\n *\n * CertTypes BAG-TYPE ::= {\n *   x509Certificate |\n *   sdsiCertificate,\n *   ... -- For future extensions\n * }\n */\nvar forge = require('./forge');\nrequire('./asn1');\nrequire('./hmac');\nrequire('./oids');\nrequire('./pkcs7asn1');\nrequire('./pbe');\nrequire('./random');\nrequire('./rsa');\nrequire('./sha1');\nrequire('./util');\nrequire('./x509');\n\n// shortcut for asn.1 & PKI API\nvar asn1 = forge.asn1;\nvar pki = forge.pki;\n\n// shortcut for PKCS#12 API\nvar p12 = module.exports = forge.pkcs12 = forge.pkcs12 || {};\n\nvar contentInfoValidator = {\n  name: 'ContentInfo',\n  tagClass: asn1.Class.UNIVERSAL,\n  type: asn1.Type.SEQUENCE,  // a ContentInfo\n  constructed: true,\n  value: [{\n    name: 'ContentInfo.contentType',\n    tagClass: asn1.Class.UNIVERSAL,\n    type: asn1.Type.OID,\n    constructed: false,\n    capture: 'contentType'\n  }, {\n    name: 'ContentInfo.content',\n    tagClass: asn1.Class.CONTEXT_SPECIFIC,\n    constructed: true,\n    captureAsn1: 'content'\n  }]\n};\n\nvar pfxValidator = {\n  name: 'PFX',\n  tagClass: asn1.Class.UNIVERSAL,\n  type: asn1.Type.SEQUENCE,\n  constructed: true,\n  value: [{\n    name: 'PFX.version',\n    tagClass: asn1.Class.UNIVERSAL,\n    type: asn1.Type.INTEGER,\n    constructed: false,\n    capture: 'version'\n  },\n  contentInfoValidator, {\n    name: 'PFX.macData',\n    tagClass: asn1.Class.UNIVERSAL,\n    type: asn1.Type.SEQUENCE,\n    constructed: true,\n    optional: true,\n    captureAsn1: 'mac',\n    value: [{\n      name: 'PFX.macData.mac',\n      tagClass: asn1.Class.UNIVERSAL,\n      type: asn1.Type.SEQUENCE,  // DigestInfo\n      constructed: true,\n      value: [{\n        name: 'PFX.macData.mac.digestAlgorithm',\n        tagClass: asn1.Class.UNIVERSAL,\n        type: asn1.Type.SEQUENCE,  // DigestAlgorithmIdentifier\n        constructed: true,\n        value: [{\n          name: 'PFX.macData.mac.digestAlgorithm.algorithm',\n          tagClass: asn1.Class.UNIVERSAL,\n          type: asn1.Type.OID,\n          constructed: false,\n          capture: 'macAlgorithm'\n        }, {\n          name: 'PFX.macData.mac.digestAlgorithm.parameters',\n          tagClass: asn1.Class.UNIVERSAL,\n          captureAsn1: 'macAlgorithmParameters'\n        }]\n      }, {\n        name: 'PFX.macData.mac.digest',\n        tagClass: asn1.Class.UNIVERSAL,\n        type: asn1.Type.OCTETSTRING,\n        constructed: false,\n        capture: 'macDigest'\n      }]\n    }, {\n      name: 'PFX.macData.macSalt',\n      tagClass: asn1.Class.UNIVERSAL,\n      type: asn1.Type.OCTETSTRING,\n      constructed: false,\n      capture: 'macSalt'\n    }, {\n      name: 'PFX.macData.iterations',\n      tagClass: asn1.Class.UNIVERSAL,\n      type: asn1.Type.INTEGER,\n      constructed: false,\n      optional: true,\n      capture: 'macIterations'\n    }]\n  }]\n};\n\nvar safeBagValidator = {\n  name: 'SafeBag',\n  tagClass: asn1.Class.UNIVERSAL,\n  type: asn1.Type.SEQUENCE,\n  constructed: true,\n  value: [{\n    name: 'SafeBag.bagId',\n    tagClass: asn1.Class.UNIVERSAL,\n    type: asn1.Type.OID,\n    constructed: false,\n    capture: 'bagId'\n  }, {\n    name: 'SafeBag.bagValue',\n    tagClass: asn1.Class.CONTEXT_SPECIFIC,\n    constructed: true,\n    captureAsn1: 'bagValue'\n  }, {\n    name: 'SafeBag.bagAttributes',\n    tagClass: asn1.Class.UNIVERSAL,\n    type: asn1.Type.SET,\n    constructed: true,\n    optional: true,\n    capture: 'bagAttributes'\n  }]\n};\n\nvar attributeValidator = {\n  name: 'Attribute',\n  tagClass: asn1.Class.UNIVERSAL,\n  type: asn1.Type.SEQUENCE,\n  constructed: true,\n  value: [{\n    name: 'Attribute.attrId',\n    tagClass: asn1.Class.UNIVERSAL,\n    type: asn1.Type.OID,\n    constructed: false,\n    capture: 'oid'\n  }, {\n    name: 'Attribute.attrValues',\n    tagClass: asn1.Class.UNIVERSAL,\n    type: asn1.Type.SET,\n    constructed: true,\n    capture: 'values'\n  }]\n};\n\nvar certBagValidator = {\n  name: 'CertBag',\n  tagClass: asn1.Class.UNIVERSAL,\n  type: asn1.Type.SEQUENCE,\n  constructed: true,\n  value: [{\n    name: 'CertBag.certId',\n    tagClass: asn1.Class.UNIVERSAL,\n    type: asn1.Type.OID,\n    constructed: false,\n    capture: 'certId'\n  }, {\n    name: 'CertBag.certValue',\n    tagClass: asn1.Class.CONTEXT_SPECIFIC,\n    constructed: true,\n    /* So far we only support X.509 certificates (which are wrapped in\n       an OCTET STRING, hence hard code that here). */\n    value: [{\n      name: 'CertBag.certValue[0]',\n      tagClass: asn1.Class.UNIVERSAL,\n      type: asn1.Class.OCTETSTRING,\n      constructed: false,\n      capture: 'cert'\n    }]\n  }]\n};\n\n/**\n * Search SafeContents structure for bags with matching attributes.\n *\n * The search can optionally be narrowed by a certain bag type.\n *\n * @param safeContents the SafeContents structure to search in.\n * @param attrName the name of the attribute to compare against.\n * @param attrValue the attribute value to search for.\n * @param [bagType] bag type to narrow search by.\n *\n * @return an array of matching bags.\n */\nfunction _getBagsByAttribute(safeContents, attrName, attrValue, bagType) {\n  var result = [];\n\n  for(var i = 0; i < safeContents.length; i++) {\n    for(var j = 0; j < safeContents[i].safeBags.length; j++) {\n      var bag = safeContents[i].safeBags[j];\n      if(bagType !== undefined && bag.type !== bagType) {\n        continue;\n      }\n      // only filter by bag type, no attribute specified\n      if(attrName === null) {\n        result.push(bag);\n        continue;\n      }\n      if(bag.attributes[attrName] !== undefined &&\n        bag.attributes[attrName].indexOf(attrValue) >= 0) {\n        result.push(bag);\n      }\n    }\n  }\n\n  return result;\n}\n\n/**\n * Converts a PKCS#12 PFX in ASN.1 notation into a PFX object.\n *\n * @param obj The PKCS#12 PFX in ASN.1 notation.\n * @param strict true to use strict DER decoding, false not to (default: true).\n * @param {String} password Password to decrypt with (optional).\n *\n * @return PKCS#12 PFX object.\n */\np12.pkcs12FromAsn1 = function(obj, strict, password) {\n  // handle args\n  if(typeof strict === 'string') {\n    password = strict;\n    strict = true;\n  } else if(strict === undefined) {\n    strict = true;\n  }\n\n  // validate PFX and capture data\n  var capture = {};\n  var errors = [];\n  if(!asn1.validate(obj, pfxValidator, capture, errors)) {\n    var error = new Error('Cannot read PKCS#12 PFX. ' +\n      'ASN.1 object is not an PKCS#12 PFX.');\n    error.errors = error;\n    throw error;\n  }\n\n  var pfx = {\n    version: capture.version.charCodeAt(0),\n    safeContents: [],\n\n    /**\n     * Gets bags with matching attributes.\n     *\n     * @param filter the attributes to filter by:\n     *          [localKeyId] the localKeyId to search for.\n     *          [localKeyIdHex] the localKeyId in hex to search for.\n     *          [friendlyName] the friendly name to search for.\n     *          [bagType] bag type to narrow each attribute search by.\n     *\n     * @return a map of attribute type to an array of matching bags or, if no\n     *           attribute was given but a bag type, the map key will be the\n     *           bag type.\n     */\n    getBags: function(filter) {\n      var rval = {};\n\n      var localKeyId;\n      if('localKeyId' in filter) {\n        localKeyId = filter.localKeyId;\n      } else if('localKeyIdHex' in filter) {\n        localKeyId = forge.util.hexToBytes(filter.localKeyIdHex);\n      }\n\n      // filter on bagType only\n      if(localKeyId === undefined && !('friendlyName' in filter) &&\n        'bagType' in filter) {\n        rval[filter.bagType] = _getBagsByAttribute(\n          pfx.safeContents, null, null, filter.bagType);\n      }\n\n      if(localKeyId !== undefined) {\n        rval.localKeyId = _getBagsByAttribute(\n          pfx.safeContents, 'localKeyId',\n          localKeyId, filter.bagType);\n      }\n      if('friendlyName' in filter) {\n        rval.friendlyName = _getBagsByAttribute(\n          pfx.safeContents, 'friendlyName',\n          filter.friendlyName, filter.bagType);\n      }\n\n      return rval;\n    },\n\n    /**\n     * DEPRECATED: use getBags() instead.\n     *\n     * Get bags with matching friendlyName attribute.\n     *\n     * @param friendlyName the friendly name to search for.\n     * @param [bagType] bag type to narrow search by.\n     *\n     * @return an array of bags with matching friendlyName attribute.\n     */\n    getBagsByFriendlyName: function(friendlyName, bagType) {\n      return _getBagsByAttribute(\n        pfx.safeContents, 'friendlyName', friendlyName, bagType);\n    },\n\n    /**\n     * DEPRECATED: use getBags() instead.\n     *\n     * Get bags with matching localKeyId attribute.\n     *\n     * @param localKeyId the localKeyId to search for.\n     * @param [bagType] bag type to narrow search by.\n     *\n     * @return an array of bags with matching localKeyId attribute.\n     */\n    getBagsByLocalKeyId: function(localKeyId, bagType) {\n      return _getBagsByAttribute(\n        pfx.safeContents, 'localKeyId', localKeyId, bagType);\n    }\n  };\n\n  if(capture.version.charCodeAt(0) !== 3) {\n    var error = new Error('PKCS#12 PFX of version other than 3 not supported.');\n    error.version = capture.version.charCodeAt(0);\n    throw error;\n  }\n\n  if(asn1.derToOid(capture.contentType) !== pki.oids.data) {\n    var error = new Error('Only PKCS#12 PFX in password integrity mode supported.');\n    error.oid = asn1.derToOid(capture.contentType);\n    throw error;\n  }\n\n  var data = capture.content.value[0];\n  if(data.tagClass !== asn1.Class.UNIVERSAL ||\n     data.type !== asn1.Type.OCTETSTRING) {\n    throw new Error('PKCS#12 authSafe content data is not an OCTET STRING.');\n  }\n  data = _decodePkcs7Data(data);\n\n  // check for MAC\n  if(capture.mac) {\n    var md = null;\n    var macKeyBytes = 0;\n    var macAlgorithm = asn1.derToOid(capture.macAlgorithm);\n    switch(macAlgorithm) {\n    case pki.oids.sha1:\n      md = forge.md.sha1.create();\n      macKeyBytes = 20;\n      break;\n    case pki.oids.sha256:\n      md = forge.md.sha256.create();\n      macKeyBytes = 32;\n      break;\n    case pki.oids.sha384:\n      md = forge.md.sha384.create();\n      macKeyBytes = 48;\n      break;\n    case pki.oids.sha512:\n      md = forge.md.sha512.create();\n      macKeyBytes = 64;\n      break;\n    case pki.oids.md5:\n      md = forge.md.md5.create();\n      macKeyBytes = 16;\n      break;\n    }\n    if(md === null) {\n      throw new Error('PKCS#12 uses unsupported MAC algorithm: ' + macAlgorithm);\n    }\n\n    // verify MAC (iterations default to 1)\n    var macSalt = new forge.util.ByteBuffer(capture.macSalt);\n    var macIterations = (('macIterations' in capture) ?\n      parseInt(forge.util.bytesToHex(capture.macIterations), 16) : 1);\n    var macKey = p12.generateKey(\n      password, macSalt, 3, macIterations, macKeyBytes, md);\n    var mac = forge.hmac.create();\n    mac.start(md, macKey);\n    mac.update(data.value);\n    var macValue = mac.getMac();\n    if(macValue.getBytes() !== capture.macDigest) {\n      throw new Error('PKCS#12 MAC could not be verified. Invalid password?');\n    }\n  }\n\n  _decodeAuthenticatedSafe(pfx, data.value, strict, password);\n  return pfx;\n};\n\n/**\n * Decodes PKCS#7 Data. PKCS#7 (RFC 2315) defines \"Data\" as an OCTET STRING,\n * but it is sometimes an OCTET STRING that is composed/constructed of chunks,\n * each its own OCTET STRING. This is BER-encoding vs. DER-encoding. This\n * function transforms this corner-case into the usual simple,\n * non-composed/constructed OCTET STRING.\n *\n * This function may be moved to ASN.1 at some point to better deal with\n * more BER-encoding issues, should they arise.\n *\n * @param data the ASN.1 Data object to transform.\n */\nfunction _decodePkcs7Data(data) {\n  // handle special case of \"chunked\" data content: an octet string composed\n  // of other octet strings\n  if(data.composed || data.constructed) {\n    var value = forge.util.createBuffer();\n    for(var i = 0; i < data.value.length; ++i) {\n      value.putBytes(data.value[i].value);\n    }\n    data.composed = data.constructed = false;\n    data.value = value.getBytes();\n  }\n  return data;\n}\n\n/**\n * Decode PKCS#12 AuthenticatedSafe (BER encoded) into PFX object.\n *\n * The AuthenticatedSafe is a BER-encoded SEQUENCE OF ContentInfo.\n *\n * @param pfx The PKCS#12 PFX object to fill.\n * @param {String} authSafe BER-encoded AuthenticatedSafe.\n * @param strict true to use strict DER decoding, false not to.\n * @param {String} password Password to decrypt with (optional).\n */\nfunction _decodeAuthenticatedSafe(pfx, authSafe, strict, password) {\n  authSafe = asn1.fromDer(authSafe, strict);  /* actually it's BER encoded */\n\n  if(authSafe.tagClass !== asn1.Class.UNIVERSAL ||\n     authSafe.type !== asn1.Type.SEQUENCE ||\n     authSafe.constructed !== true) {\n    throw new Error('PKCS#12 AuthenticatedSafe expected to be a ' +\n      'SEQUENCE OF ContentInfo');\n  }\n\n  for(var i = 0; i < authSafe.value.length; i++) {\n    var contentInfo = authSafe.value[i];\n\n    // validate contentInfo and capture data\n    var capture = {};\n    var errors = [];\n    if(!asn1.validate(contentInfo, contentInfoValidator, capture, errors)) {\n      var error = new Error('Cannot read ContentInfo.');\n      error.errors = errors;\n      throw error;\n    }\n\n    var obj = {\n      encrypted: false\n    };\n    var safeContents = null;\n    var data = capture.content.value[0];\n    switch(asn1.derToOid(capture.contentType)) {\n    case pki.oids.data:\n      if(data.tagClass !== asn1.Class.UNIVERSAL ||\n         data.type !== asn1.Type.OCTETSTRING) {\n        throw new Error('PKCS#12 SafeContents Data is not an OCTET STRING.');\n      }\n      safeContents = _decodePkcs7Data(data).value;\n      break;\n    case pki.oids.encryptedData:\n      safeContents = _decryptSafeContents(data, password);\n      obj.encrypted = true;\n      break;\n    default:\n      var error = new Error('Unsupported PKCS#12 contentType.');\n      error.contentType = asn1.derToOid(capture.contentType);\n      throw error;\n    }\n\n    obj.safeBags = _decodeSafeContents(safeContents, strict, password);\n    pfx.safeContents.push(obj);\n  }\n}\n\n/**\n * Decrypt PKCS#7 EncryptedData structure.\n *\n * @param data ASN.1 encoded EncryptedContentInfo object.\n * @param password The user-provided password.\n *\n * @return The decrypted SafeContents (ASN.1 object).\n */\nfunction _decryptSafeContents(data, password) {\n  var capture = {};\n  var errors = [];\n  if(!asn1.validate(\n    data, forge.pkcs7.asn1.encryptedDataValidator, capture, errors)) {\n    var error = new Error('Cannot read EncryptedContentInfo.');\n    error.errors = errors;\n    throw error;\n  }\n\n  var oid = asn1.derToOid(capture.contentType);\n  if(oid !== pki.oids.data) {\n    var error = new Error(\n      'PKCS#12 EncryptedContentInfo ContentType is not Data.');\n    error.oid = oid;\n    throw error;\n  }\n\n  // get cipher\n  oid = asn1.derToOid(capture.encAlgorithm);\n  var cipher = pki.pbe.getCipher(oid, capture.encParameter, password);\n\n  // get encrypted data\n  var encryptedContentAsn1 = _decodePkcs7Data(capture.encryptedContentAsn1);\n  var encrypted = forge.util.createBuffer(encryptedContentAsn1.value);\n\n  cipher.update(encrypted);\n  if(!cipher.finish()) {\n    throw new Error('Failed to decrypt PKCS#12 SafeContents.');\n  }\n\n  return cipher.output.getBytes();\n}\n\n/**\n * Decode PKCS#12 SafeContents (BER-encoded) into array of Bag objects.\n *\n * The safeContents is a BER-encoded SEQUENCE OF SafeBag.\n *\n * @param {String} safeContents BER-encoded safeContents.\n * @param strict true to use strict DER decoding, false not to.\n * @param {String} password Password to decrypt with (optional).\n *\n * @return {Array} Array of Bag objects.\n */\nfunction _decodeSafeContents(safeContents, strict, password) {\n  // if strict and no safe contents, return empty safes\n  if(!strict && safeContents.length === 0) {\n    return [];\n  }\n\n  // actually it's BER-encoded\n  safeContents = asn1.fromDer(safeContents, strict);\n\n  if(safeContents.tagClass !== asn1.Class.UNIVERSAL ||\n    safeContents.type !== asn1.Type.SEQUENCE ||\n    safeContents.constructed !== true) {\n    throw new Error(\n      'PKCS#12 SafeContents expected to be a SEQUENCE OF SafeBag.');\n  }\n\n  var res = [];\n  for(var i = 0; i < safeContents.value.length; i++) {\n    var safeBag = safeContents.value[i];\n\n    // validate SafeBag and capture data\n    var capture = {};\n    var errors = [];\n    if(!asn1.validate(safeBag, safeBagValidator, capture, errors)) {\n      var error = new Error('Cannot read SafeBag.');\n      error.errors = errors;\n      throw error;\n    }\n\n    /* Create bag object and push to result array. */\n    var bag = {\n      type: asn1.derToOid(capture.bagId),\n      attributes: _decodeBagAttributes(capture.bagAttributes)\n    };\n    res.push(bag);\n\n    var validator, decoder;\n    var bagAsn1 = capture.bagValue.value[0];\n    switch(bag.type) {\n      case pki.oids.pkcs8ShroudedKeyBag:\n        /* bagAsn1 has a EncryptedPrivateKeyInfo, which we need to decrypt.\n           Afterwards we can handle it like a keyBag,\n           which is a PrivateKeyInfo. */\n        bagAsn1 = pki.decryptPrivateKeyInfo(bagAsn1, password);\n        if(bagAsn1 === null) {\n          throw new Error(\n            'Unable to decrypt PKCS#8 ShroudedKeyBag, wrong password?');\n        }\n\n        /* fall through */\n      case pki.oids.keyBag:\n        /* A PKCS#12 keyBag is a simple PrivateKeyInfo as understood by our\n           PKI module, hence we don't have to do validation/capturing here,\n           just pass what we already got. */\n        try {\n          bag.key = pki.privateKeyFromAsn1(bagAsn1);\n        } catch(e) {\n          // ignore unknown key type, pass asn1 value\n          bag.key = null;\n          bag.asn1 = bagAsn1;\n        }\n        continue;  /* Nothing more to do. */\n\n      case pki.oids.certBag:\n        /* A PKCS#12 certBag can wrap both X.509 and sdsi certificates.\n           Therefore put the SafeBag content through another validator to\n           capture the fields.  Afterwards check & store the results. */\n        validator = certBagValidator;\n        decoder = function() {\n          if(asn1.derToOid(capture.certId) !== pki.oids.x509Certificate) {\n            var error = new Error(\n              'Unsupported certificate type, only X.509 supported.');\n            error.oid = asn1.derToOid(capture.certId);\n            throw error;\n          }\n\n          // true=produce cert hash\n          var certAsn1 = asn1.fromDer(capture.cert, strict);\n          try {\n            bag.cert = pki.certificateFromAsn1(certAsn1, true);\n          } catch(e) {\n            // ignore unknown cert type, pass asn1 value\n            bag.cert = null;\n            bag.asn1 = certAsn1;\n          }\n        };\n        break;\n\n      default:\n        var error = new Error('Unsupported PKCS#12 SafeBag type.');\n        error.oid = bag.type;\n        throw error;\n    }\n\n    /* Validate SafeBag value (i.e. CertBag, etc.) and capture data if needed. */\n    if(validator !== undefined &&\n       !asn1.validate(bagAsn1, validator, capture, errors)) {\n      var error = new Error('Cannot read PKCS#12 ' + validator.name);\n      error.errors = errors;\n      throw error;\n    }\n\n    /* Call decoder function from above to store the results. */\n    decoder();\n  }\n\n  return res;\n}\n\n/**\n * Decode PKCS#12 SET OF PKCS12Attribute into JavaScript object.\n *\n * @param attributes SET OF PKCS12Attribute (ASN.1 object).\n *\n * @return the decoded attributes.\n */\nfunction _decodeBagAttributes(attributes) {\n  var decodedAttrs = {};\n\n  if(attributes !== undefined) {\n    for(var i = 0; i < attributes.length; ++i) {\n      var capture = {};\n      var errors = [];\n      if(!asn1.validate(attributes[i], attributeValidator, capture, errors)) {\n        var error = new Error('Cannot read PKCS#12 BagAttribute.');\n        error.errors = errors;\n        throw error;\n      }\n\n      var oid = asn1.derToOid(capture.oid);\n      if(pki.oids[oid] === undefined) {\n        // unsupported attribute type, ignore.\n        continue;\n      }\n\n      decodedAttrs[pki.oids[oid]] = [];\n      for(var j = 0; j < capture.values.length; ++j) {\n        decodedAttrs[pki.oids[oid]].push(capture.values[j].value);\n      }\n    }\n  }\n\n  return decodedAttrs;\n}\n\n/**\n * Wraps a private key and certificate in a PKCS#12 PFX wrapper. If a\n * password is provided then the private key will be encrypted.\n *\n * An entire certificate chain may also be included. To do this, pass\n * an array for the \"cert\" parameter where the first certificate is\n * the one that is paired with the private key and each subsequent one\n * verifies the previous one. The certificates may be in PEM format or\n * have been already parsed by Forge.\n *\n * @todo implement password-based-encryption for the whole package\n *\n * @param key the private key.\n * @param cert the certificate (may be an array of certificates in order\n *          to specify a certificate chain).\n * @param password the password to use, null for none.\n * @param options:\n *          algorithm the encryption algorithm to use\n *            ('aes128', 'aes192', 'aes256', '3des'), defaults to 'aes128'.\n *          count the iteration count to use.\n *          saltSize the salt size to use.\n *          useMac true to include a MAC, false not to, defaults to true.\n *          localKeyId the local key ID to use, in hex.\n *          friendlyName the friendly name to use.\n *          generateLocalKeyId true to generate a random local key ID,\n *            false not to, defaults to true.\n *\n * @return the PKCS#12 PFX ASN.1 object.\n */\np12.toPkcs12Asn1 = function(key, cert, password, options) {\n  // set default options\n  options = options || {};\n  options.saltSize = options.saltSize || 8;\n  options.count = options.count || 2048;\n  options.algorithm = options.algorithm || options.encAlgorithm || 'aes128';\n  if(!('useMac' in options)) {\n    options.useMac = true;\n  }\n  if(!('localKeyId' in options)) {\n    options.localKeyId = null;\n  }\n  if(!('generateLocalKeyId' in options)) {\n    options.generateLocalKeyId = true;\n  }\n\n  var localKeyId = options.localKeyId;\n  var bagAttrs;\n  if(localKeyId !== null) {\n    localKeyId = forge.util.hexToBytes(localKeyId);\n  } else if(options.generateLocalKeyId) {\n    // use SHA-1 of paired cert, if available\n    if(cert) {\n      var pairedCert = forge.util.isArray(cert) ? cert[0] : cert;\n      if(typeof pairedCert === 'string') {\n        pairedCert = pki.certificateFromPem(pairedCert);\n      }\n      var sha1 = forge.md.sha1.create();\n      sha1.update(asn1.toDer(pki.certificateToAsn1(pairedCert)).getBytes());\n      localKeyId = sha1.digest().getBytes();\n    } else {\n      // FIXME: consider using SHA-1 of public key (which can be generated\n      // from private key components), see: cert.generateSubjectKeyIdentifier\n      // generate random bytes\n      localKeyId = forge.random.getBytes(20);\n    }\n  }\n\n  var attrs = [];\n  if(localKeyId !== null) {\n    attrs.push(\n      // localKeyID\n      asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [\n        // attrId\n        asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OID, false,\n          asn1.oidToDer(pki.oids.localKeyId).getBytes()),\n        // attrValues\n        asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SET, true, [\n          asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OCTETSTRING, false,\n            localKeyId)\n        ])\n      ]));\n  }\n  if('friendlyName' in options) {\n    attrs.push(\n      // friendlyName\n      asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [\n        // attrId\n        asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OID, false,\n          asn1.oidToDer(pki.oids.friendlyName).getBytes()),\n        // attrValues\n        asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SET, true, [\n          asn1.create(asn1.Class.UNIVERSAL, asn1.Type.BMPSTRING, false,\n            options.friendlyName)\n        ])\n      ]));\n  }\n\n  if(attrs.length > 0) {\n    bagAttrs = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SET, true, attrs);\n  }\n\n  // collect contents for AuthenticatedSafe\n  var contents = [];\n\n  // create safe bag(s) for certificate chain\n  var chain = [];\n  if(cert !== null) {\n    if(forge.util.isArray(cert)) {\n      chain = cert;\n    } else {\n      chain = [cert];\n    }\n  }\n\n  var certSafeBags = [];\n  for(var i = 0; i < chain.length; ++i) {\n    // convert cert from PEM as necessary\n    cert = chain[i];\n    if(typeof cert === 'string') {\n      cert = pki.certificateFromPem(cert);\n    }\n\n    // SafeBag\n    var certBagAttrs = (i === 0) ? bagAttrs : undefined;\n    var certAsn1 = pki.certificateToAsn1(cert);\n    var certSafeBag =\n      asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [\n        // bagId\n        asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OID, false,\n          asn1.oidToDer(pki.oids.certBag).getBytes()),\n        // bagValue\n        asn1.create(asn1.Class.CONTEXT_SPECIFIC, 0, true, [\n          // CertBag\n          asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [\n            // certId\n            asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OID, false,\n              asn1.oidToDer(pki.oids.x509Certificate).getBytes()),\n            // certValue (x509Certificate)\n            asn1.create(asn1.Class.CONTEXT_SPECIFIC, 0, true, [\n              asn1.create(\n                asn1.Class.UNIVERSAL, asn1.Type.OCTETSTRING, false,\n                asn1.toDer(certAsn1).getBytes())\n            ])])]),\n        // bagAttributes (OPTIONAL)\n        certBagAttrs\n      ]);\n    certSafeBags.push(certSafeBag);\n  }\n\n  if(certSafeBags.length > 0) {\n    // SafeContents\n    var certSafeContents = asn1.create(\n      asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, certSafeBags);\n\n    // ContentInfo\n    var certCI =\n      // PKCS#7 ContentInfo\n      asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [\n        // contentType\n        asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OID, false,\n          // OID for the content type is 'data'\n          asn1.oidToDer(pki.oids.data).getBytes()),\n        // content\n        asn1.create(asn1.Class.CONTEXT_SPECIFIC, 0, true, [\n          asn1.create(\n            asn1.Class.UNIVERSAL, asn1.Type.OCTETSTRING, false,\n            asn1.toDer(certSafeContents).getBytes())\n        ])\n      ]);\n    contents.push(certCI);\n  }\n\n  // create safe contents for private key\n  var keyBag = null;\n  if(key !== null) {\n    // SafeBag\n    var pkAsn1 = pki.wrapRsaPrivateKey(pki.privateKeyToAsn1(key));\n    if(password === null) {\n      // no encryption\n      keyBag = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [\n        // bagId\n        asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OID, false,\n          asn1.oidToDer(pki.oids.keyBag).getBytes()),\n        // bagValue\n        asn1.create(asn1.Class.CONTEXT_SPECIFIC, 0, true, [\n          // PrivateKeyInfo\n          pkAsn1\n        ]),\n        // bagAttributes (OPTIONAL)\n        bagAttrs\n      ]);\n    } else {\n      // encrypted PrivateKeyInfo\n      keyBag = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [\n        // bagId\n        asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OID, false,\n          asn1.oidToDer(pki.oids.pkcs8ShroudedKeyBag).getBytes()),\n        // bagValue\n        asn1.create(asn1.Class.CONTEXT_SPECIFIC, 0, true, [\n          // EncryptedPrivateKeyInfo\n          pki.encryptPrivateKeyInfo(pkAsn1, password, options)\n        ]),\n        // bagAttributes (OPTIONAL)\n        bagAttrs\n      ]);\n    }\n\n    // SafeContents\n    var keySafeContents =\n      asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [keyBag]);\n\n    // ContentInfo\n    var keyCI =\n      // PKCS#7 ContentInfo\n      asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [\n        // contentType\n        asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OID, false,\n          // OID for the content type is 'data'\n          asn1.oidToDer(pki.oids.data).getBytes()),\n        // content\n        asn1.create(asn1.Class.CONTEXT_SPECIFIC, 0, true, [\n          asn1.create(\n            asn1.Class.UNIVERSAL, asn1.Type.OCTETSTRING, false,\n            asn1.toDer(keySafeContents).getBytes())\n        ])\n      ]);\n    contents.push(keyCI);\n  }\n\n  // create AuthenticatedSafe by stringing together the contents\n  var safe = asn1.create(\n    asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, contents);\n\n  var macData;\n  if(options.useMac) {\n    // MacData\n    var sha1 = forge.md.sha1.create();\n    var macSalt = new forge.util.ByteBuffer(\n      forge.random.getBytes(options.saltSize));\n    var count = options.count;\n    // 160-bit key\n    var key = p12.generateKey(password, macSalt, 3, count, 20);\n    var mac = forge.hmac.create();\n    mac.start(sha1, key);\n    mac.update(asn1.toDer(safe).getBytes());\n    var macValue = mac.getMac();\n    macData = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [\n      // mac DigestInfo\n      asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [\n        // digestAlgorithm\n        asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [\n          // algorithm = SHA-1\n          asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OID, false,\n            asn1.oidToDer(pki.oids.sha1).getBytes()),\n          // parameters = Null\n          asn1.create(asn1.Class.UNIVERSAL, asn1.Type.NULL, false, '')\n        ]),\n        // digest\n        asn1.create(\n          asn1.Class.UNIVERSAL, asn1.Type.OCTETSTRING,\n          false, macValue.getBytes())\n      ]),\n      // macSalt OCTET STRING\n      asn1.create(\n        asn1.Class.UNIVERSAL, asn1.Type.OCTETSTRING, false, macSalt.getBytes()),\n      // iterations INTEGER (XXX: Only support count < 65536)\n      asn1.create(asn1.Class.UNIVERSAL, asn1.Type.INTEGER, false,\n        asn1.integerToDer(count).getBytes()\n      )\n    ]);\n  }\n\n  // PFX\n  return asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [\n    // version (3)\n    asn1.create(asn1.Class.UNIVERSAL, asn1.Type.INTEGER, false,\n      asn1.integerToDer(3).getBytes()),\n    // PKCS#7 ContentInfo\n    asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [\n      // contentType\n      asn1.create(asn1.Class.UNIVERSAL, asn1.Type.OID, false,\n        // OID for the content type is 'data'\n        asn1.oidToDer(pki.oids.data).getBytes()),\n      // content\n      asn1.create(asn1.Class.CONTEXT_SPECIFIC, 0, true, [\n        asn1.create(\n          asn1.Class.UNIVERSAL, asn1.Type.OCTETSTRING, false,\n          asn1.toDer(safe).getBytes())\n      ])\n    ]),\n    macData\n  ]);\n};\n\n/**\n * Derives a PKCS#12 key.\n *\n * @param password the password to derive the key material from, null or\n *          undefined for none.\n * @param salt the salt, as a ByteBuffer, to use.\n * @param id the PKCS#12 ID byte (1 = key material, 2 = IV, 3 = MAC).\n * @param iter the iteration count.\n * @param n the number of bytes to derive from the password.\n * @param md the message digest to use, defaults to SHA-1.\n *\n * @return a ByteBuffer with the bytes derived from the password.\n */\np12.generateKey = forge.pbe.generatePkcs12Key;\n"],"x_google_ignoreList":[0],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+FA,IAAI;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;CAGA,IAAI,OAAO,MAAM;CACjB,IAAI,MAAM,MAAM;CAGhB,IAAI,MAAM,OAAO,UAAU,MAAM,SAAS,MAAM,UAAU,EAAE;CAE5D,IAAI,uBAAuB;EACzB,MAAM;EACN,UAAU,KAAK,MAAM;EACrB,MAAM,KAAK,KAAK;EAChB,aAAa;EACb,OAAO,CAAC;GACN,MAAM;GACN,UAAU,KAAK,MAAM;GACrB,MAAM,KAAK,KAAK;GAChB,aAAa;GACb,SAAS;GACV,EAAE;GACD,MAAM;GACN,UAAU,KAAK,MAAM;GACrB,aAAa;GACb,aAAa;GACd,CAAC;EACH;CAED,IAAI,eAAe;EACjB,MAAM;EACN,UAAU,KAAK,MAAM;EACrB,MAAM,KAAK,KAAK;EAChB,aAAa;EACb,OAAO;GAAC;IACN,MAAM;IACN,UAAU,KAAK,MAAM;IACrB,MAAM,KAAK,KAAK;IAChB,aAAa;IACb,SAAS;IACV;GACD;GAAsB;IACpB,MAAM;IACN,UAAU,KAAK,MAAM;IACrB,MAAM,KAAK,KAAK;IAChB,aAAa;IACb,UAAU;IACV,aAAa;IACb,OAAO;KAAC;MACN,MAAM;MACN,UAAU,KAAK,MAAM;MACrB,MAAM,KAAK,KAAK;MAChB,aAAa;MACb,OAAO,CAAC;OACN,MAAM;OACN,UAAU,KAAK,MAAM;OACrB,MAAM,KAAK,KAAK;OAChB,aAAa;OACb,OAAO,CAAC;QACN,MAAM;QACN,UAAU,KAAK,MAAM;QACrB,MAAM,KAAK,KAAK;QAChB,aAAa;QACb,SAAS;QACV,EAAE;QACD,MAAM;QACN,UAAU,KAAK,MAAM;QACrB,aAAa;QACd,CAAC;OACH,EAAE;OACD,MAAM;OACN,UAAU,KAAK,MAAM;OACrB,MAAM,KAAK,KAAK;OAChB,aAAa;OACb,SAAS;OACV,CAAC;MACH;KAAE;MACD,MAAM;MACN,UAAU,KAAK,MAAM;MACrB,MAAM,KAAK,KAAK;MAChB,aAAa;MACb,SAAS;MACV;KAAE;MACD,MAAM;MACN,UAAU,KAAK,MAAM;MACrB,MAAM,KAAK,KAAK;MAChB,aAAa;MACb,UAAU;MACV,SAAS;MACV;KAAC;IACH;GAAC;EACH;CAED,IAAI,mBAAmB;EACrB,MAAM;EACN,UAAU,KAAK,MAAM;EACrB,MAAM,KAAK,KAAK;EAChB,aAAa;EACb,OAAO;GAAC;IACN,MAAM;IACN,UAAU,KAAK,MAAM;IACrB,MAAM,KAAK,KAAK;IAChB,aAAa;IACb,SAAS;IACV;GAAE;IACD,MAAM;IACN,UAAU,KAAK,MAAM;IACrB,aAAa;IACb,aAAa;IACd;GAAE;IACD,MAAM;IACN,UAAU,KAAK,MAAM;IACrB,MAAM,KAAK,KAAK;IAChB,aAAa;IACb,UAAU;IACV,SAAS;IACV;GAAC;EACH;CAED,IAAI,qBAAqB;EACvB,MAAM;EACN,UAAU,KAAK,MAAM;EACrB,MAAM,KAAK,KAAK;EAChB,aAAa;EACb,OAAO,CAAC;GACN,MAAM;GACN,UAAU,KAAK,MAAM;GACrB,MAAM,KAAK,KAAK;GAChB,aAAa;GACb,SAAS;GACV,EAAE;GACD,MAAM;GACN,UAAU,KAAK,MAAM;GACrB,MAAM,KAAK,KAAK;GAChB,aAAa;GACb,SAAS;GACV,CAAC;EACH;CAED,IAAI,mBAAmB;EACrB,MAAM;EACN,UAAU,KAAK,MAAM;EACrB,MAAM,KAAK,KAAK;EAChB,aAAa;EACb,OAAO,CAAC;GACN,MAAM;GACN,UAAU,KAAK,MAAM;GACrB,MAAM,KAAK,KAAK;GAChB,aAAa;GACb,SAAS;GACV,EAAE;GACD,MAAM;GACN,UAAU,KAAK,MAAM;GACrB,aAAa;GAGb,OAAO,CAAC;IACN,MAAM;IACN,UAAU,KAAK,MAAM;IACrB,MAAM,KAAK,MAAM;IACjB,aAAa;IACb,SAAS;IACV,CAAC;GACH,CAAC;EACH;;;;;;;;;;;;;CAcD,SAAS,oBAAoB,cAAc,UAAU,WAAW,SAAS;EACvE,IAAI,SAAS,EAAE;AAEf,OAAI,IAAI,IAAI,GAAG,IAAI,aAAa,QAAQ,IACtC,MAAI,IAAI,IAAI,GAAG,IAAI,aAAa,GAAG,SAAS,QAAQ,KAAK;GACvD,IAAI,MAAM,aAAa,GAAG,SAAS;AACnC,OAAG,YAAY,UAAa,IAAI,SAAS,QACvC;AAGF,OAAG,aAAa,MAAM;AACpB,WAAO,KAAK,IAAI;AAChB;;AAEF,OAAG,IAAI,WAAW,cAAc,UAC9B,IAAI,WAAW,UAAU,QAAQ,UAAU,IAAI,EAC/C,QAAO,KAAK,IAAI;;AAKtB,SAAO;;;;;;;;;;;AAYT,KAAI,iBAAiB,SAAS,KAAK,QAAQ,UAAU;AAEnD,MAAG,OAAO,WAAW,UAAU;AAC7B,cAAW;AACX,YAAS;aACD,WAAW,OACnB,UAAS;EAIX,IAAI,UAAU,EAAE;AAEhB,MAAG,CAAC,KAAK,SAAS,KAAK,cAAc,SADxB,EAAE,CACsC,EAAE;GACrD,IAAI,wBAAQ,IAAI,MAAM,+DACkB;AACxC,SAAM,SAAS;AACf,SAAM;;EAGR,IAAI,MAAM;GACR,SAAS,QAAQ,QAAQ,WAAW,EAAE;GACtC,cAAc,EAAE;GAehB,SAAS,SAAS,QAAQ;IACxB,IAAI,OAAO,EAAE;IAEb,IAAI;AACJ,QAAG,gBAAgB,OACjB,cAAa,OAAO;aACZ,mBAAmB,OAC3B,cAAa,MAAM,KAAK,WAAW,OAAO,cAAc;AAI1D,QAAG,eAAe,UAAa,EAAE,kBAAkB,WACjD,aAAa,OACb,MAAK,OAAO,WAAW,oBACrB,IAAI,cAAc,MAAM,MAAM,OAAO,QAAQ;AAGjD,QAAG,eAAe,OAChB,MAAK,aAAa,oBAChB,IAAI,cAAc,cAClB,YAAY,OAAO,QAAQ;AAE/B,QAAG,kBAAkB,OACnB,MAAK,eAAe,oBAClB,IAAI,cAAc,gBAClB,OAAO,cAAc,OAAO,QAAQ;AAGxC,WAAO;;GAaT,uBAAuB,SAAS,cAAc,SAAS;AACrD,WAAO,oBACL,IAAI,cAAc,gBAAgB,cAAc,QAAQ;;GAa5D,qBAAqB,SAAS,YAAY,SAAS;AACjD,WAAO,oBACL,IAAI,cAAc,cAAc,YAAY,QAAQ;;GAEzD;AAED,MAAG,QAAQ,QAAQ,WAAW,EAAE,KAAK,GAAG;GACtC,IAAI,wBAAQ,IAAI,MAAM,qDAAqD;AAC3E,SAAM,UAAU,QAAQ,QAAQ,WAAW,EAAE;AAC7C,SAAM;;AAGR,MAAG,KAAK,SAAS,QAAQ,YAAY,KAAK,IAAI,KAAK,MAAM;GACvD,IAAI,wBAAQ,IAAI,MAAM,yDAAyD;AAC/E,SAAM,MAAM,KAAK,SAAS,QAAQ,YAAY;AAC9C,SAAM;;EAGR,IAAI,OAAO,QAAQ,QAAQ,MAAM;AACjC,MAAG,KAAK,aAAa,KAAK,MAAM,aAC7B,KAAK,SAAS,KAAK,KAAK,YACzB,OAAM,IAAI,MAAM,wDAAwD;AAE1E,SAAO,iBAAiB,KAAK;AAG7B,MAAG,QAAQ,KAAK;GACd,IAAI,KAAK;GACT,IAAI,cAAc;GAClB,IAAI,eAAe,KAAK,SAAS,QAAQ,aAAa;AACtD,WAAO,cAAP;IACA,KAAK,IAAI,KAAK;AACZ,UAAK,MAAM,GAAG,KAAK,QAAQ;AAC3B,mBAAc;AACd;IACF,KAAK,IAAI,KAAK;AACZ,UAAK,MAAM,GAAG,OAAO,QAAQ;AAC7B,mBAAc;AACd;IACF,KAAK,IAAI,KAAK;AACZ,UAAK,MAAM,GAAG,OAAO,QAAQ;AAC7B,mBAAc;AACd;IACF,KAAK,IAAI,KAAK;AACZ,UAAK,MAAM,GAAG,OAAO,QAAQ;AAC7B,mBAAc;AACd;IACF,KAAK,IAAI,KAAK;AACZ,UAAK,MAAM,GAAG,IAAI,QAAQ;AAC1B,mBAAc;AACd;;AAEF,OAAG,OAAO,KACR,OAAM,IAAI,MAAM,6CAA6C,aAAa;GAI5E,IAAI,UAAU,IAAI,MAAM,KAAK,WAAW,QAAQ,QAAQ;GACxD,IAAI,gBAAkB,mBAAmB,UACvC,SAAS,MAAM,KAAK,WAAW,QAAQ,cAAc,EAAE,GAAG,GAAG;GAC/D,IAAI,SAAS,IAAI,YACf,UAAU,SAAS,GAAG,eAAe,aAAa,GAAG;GACvD,IAAI,MAAM,MAAM,KAAK,QAAQ;AAC7B,OAAI,MAAM,IAAI,OAAO;AACrB,OAAI,OAAO,KAAK,MAAM;AAEtB,OADe,IAAI,QAAQ,CACf,UAAU,KAAK,QAAQ,UACjC,OAAM,IAAI,MAAM,uDAAuD;;AAI3E,2BAAyB,KAAK,KAAK,OAAO,QAAQ,SAAS;AAC3D,SAAO;;;;;;;;;;;;;;CAeT,SAAS,iBAAiB,MAAM;AAG9B,MAAG,KAAK,YAAY,KAAK,aAAa;GACpC,IAAI,QAAQ,MAAM,KAAK,cAAc;AACrC,QAAI,IAAI,IAAI,GAAG,IAAI,KAAK,MAAM,QAAQ,EAAE,EACtC,OAAM,SAAS,KAAK,MAAM,GAAG,MAAM;AAErC,QAAK,WAAW,KAAK,cAAc;AACnC,QAAK,QAAQ,MAAM,UAAU;;AAE/B,SAAO;;;;;;;;;;;;CAaT,SAAS,yBAAyB,KAAK,UAAU,QAAQ,UAAU;AACjE,aAAW,KAAK,QAAQ,UAAU,OAAO;AAEzC,MAAG,SAAS,aAAa,KAAK,MAAM,aACjC,SAAS,SAAS,KAAK,KAAK,YAC5B,SAAS,gBAAgB,KAC1B,OAAM,IAAI,MAAM,qEACY;AAG9B,OAAI,IAAI,IAAI,GAAG,IAAI,SAAS,MAAM,QAAQ,KAAK;GAC7C,IAAI,cAAc,SAAS,MAAM;GAGjC,IAAI,UAAU,EAAE;GAChB,IAAI,SAAS,EAAE;AACf,OAAG,CAAC,KAAK,SAAS,aAAa,sBAAsB,SAAS,OAAO,EAAE;IACrE,IAAI,wBAAQ,IAAI,MAAM,2BAA2B;AACjD,UAAM,SAAS;AACf,UAAM;;GAGR,IAAI,MAAM,EACR,WAAW,OACZ;GACD,IAAI,eAAe;GACnB,IAAI,OAAO,QAAQ,QAAQ,MAAM;AACjC,WAAO,KAAK,SAAS,QAAQ,YAAY,EAAzC;IACA,KAAK,IAAI,KAAK;AACZ,SAAG,KAAK,aAAa,KAAK,MAAM,aAC7B,KAAK,SAAS,KAAK,KAAK,YACzB,OAAM,IAAI,MAAM,oDAAoD;AAEtE,oBAAe,iBAAiB,KAAK,CAAC;AACtC;IACF,KAAK,IAAI,KAAK;AACZ,oBAAe,qBAAqB,MAAM,SAAS;AACnD,SAAI,YAAY;AAChB;IACF;KACE,IAAI,wBAAQ,IAAI,MAAM,mCAAmC;AACzD,WAAM,cAAc,KAAK,SAAS,QAAQ,YAAY;AACtD,WAAM;;AAGR,OAAI,WAAW,oBAAoB,cAAc,QAAQ,SAAS;AAClE,OAAI,aAAa,KAAK,IAAI;;;;;;;;;;;CAY9B,SAAS,qBAAqB,MAAM,UAAU;EAC5C,IAAI,UAAU,EAAE;EAChB,IAAI,SAAS,EAAE;AACf,MAAG,CAAC,KAAK,SACP,MAAM,MAAM,MAAM,KAAK,wBAAwB,SAAS,OAAO,EAAE;GACjE,IAAI,wBAAQ,IAAI,MAAM,oCAAoC;AAC1D,SAAM,SAAS;AACf,SAAM;;EAGR,IAAI,MAAM,KAAK,SAAS,QAAQ,YAAY;AAC5C,MAAG,QAAQ,IAAI,KAAK,MAAM;GACxB,IAAI,wBAAQ,IAAI,MACd,wDAAwD;AAC1D,SAAM,MAAM;AACZ,SAAM;;AAIR,QAAM,KAAK,SAAS,QAAQ,aAAa;EACzC,IAAI,SAAS,IAAI,IAAI,UAAU,KAAK,QAAQ,cAAc,SAAS;EAGnE,IAAI,uBAAuB,iBAAiB,QAAQ,qBAAqB;EACzE,IAAI,YAAY,MAAM,KAAK,aAAa,qBAAqB,MAAM;AAEnE,SAAO,OAAO,UAAU;AACxB,MAAG,CAAC,OAAO,QAAQ,CACjB,OAAM,IAAI,MAAM,0CAA0C;AAG5D,SAAO,OAAO,OAAO,UAAU;;;;;;;;;;;;;CAcjC,SAAS,oBAAoB,cAAc,QAAQ,UAAU;AAE3D,MAAG,CAAC,UAAU,aAAa,WAAW,EACpC,QAAO,EAAE;AAIX,iBAAe,KAAK,QAAQ,cAAc,OAAO;AAEjD,MAAG,aAAa,aAAa,KAAK,MAAM,aACtC,aAAa,SAAS,KAAK,KAAK,YAChC,aAAa,gBAAgB,KAC7B,OAAM,IAAI,MACR,6DAA6D;EAGjE,IAAI,MAAM,EAAE;AACZ,OAAI,IAAI,IAAI,GAAG,IAAI,aAAa,MAAM,QAAQ,KAAK;GACjD,IAAI,UAAU,aAAa,MAAM;GAGjC,IAAI,UAAU,EAAE;GAChB,IAAI,SAAS,EAAE;AACf,OAAG,CAAC,KAAK,SAAS,SAAS,kBAAkB,SAAS,OAAO,EAAE;IAC7D,IAAI,wBAAQ,IAAI,MAAM,uBAAuB;AAC7C,UAAM,SAAS;AACf,UAAM;;GAIR,IAAI,MAAM;IACR,MAAM,KAAK,SAAS,QAAQ,MAAM;IAClC,YAAY,qBAAqB,QAAQ,cAAc;IACxD;AACD,OAAI,KAAK,IAAI;GAEb,IAAI,WAAW;GACf,IAAI,UAAU,QAAQ,SAAS,MAAM;AACrC,WAAO,IAAI,MAAX;IACE,KAAK,IAAI,KAAK;AAIZ,eAAU,IAAI,sBAAsB,SAAS,SAAS;AACtD,SAAG,YAAY,KACb,OAAM,IAAI,MACR,2DAA2D;IAIjE,KAAK,IAAI,KAAK;AAIZ,SAAI;AACF,UAAI,MAAM,IAAI,mBAAmB,QAAQ;cACnC,GAAG;AAET,UAAI,MAAM;AACV,UAAI,OAAO;;AAEb;IAEF,KAAK,IAAI,KAAK;AAIZ,iBAAY;AACZ,eAAU,WAAW;AACnB,UAAG,KAAK,SAAS,QAAQ,OAAO,KAAK,IAAI,KAAK,iBAAiB;OAC7D,IAAIA,0BAAQ,IAAI,MACd,sDAAsD;AACxD,eAAM,MAAM,KAAK,SAAS,QAAQ,OAAO;AACzC,aAAMA;;MAIR,IAAI,WAAW,KAAK,QAAQ,QAAQ,MAAM,OAAO;AACjD,UAAI;AACF,WAAI,OAAO,IAAI,oBAAoB,UAAU,KAAK;eAC5C,GAAG;AAET,WAAI,OAAO;AACX,WAAI,OAAO;;;AAGf;IAEF;KACE,IAAI,wBAAQ,IAAI,MAAM,oCAAoC;AAC1D,WAAM,MAAM,IAAI;AAChB,WAAM;;AAIV,OAAG,cAAc,UACd,CAAC,KAAK,SAAS,SAAS,WAAW,SAAS,OAAO,EAAE;IACtD,IAAI,wBAAQ,IAAI,MAAM,yBAAyB,UAAU,KAAK;AAC9D,UAAM,SAAS;AACf,UAAM;;AAIR,YAAS;;AAGX,SAAO;;;;;;;;;CAUT,SAAS,qBAAqB,YAAY;EACxC,IAAI,eAAe,EAAE;AAErB,MAAG,eAAe,OAChB,MAAI,IAAI,IAAI,GAAG,IAAI,WAAW,QAAQ,EAAE,GAAG;GACzC,IAAI,UAAU,EAAE;GAChB,IAAI,SAAS,EAAE;AACf,OAAG,CAAC,KAAK,SAAS,WAAW,IAAI,oBAAoB,SAAS,OAAO,EAAE;IACrE,IAAI,wBAAQ,IAAI,MAAM,oCAAoC;AAC1D,UAAM,SAAS;AACf,UAAM;;GAGR,IAAI,MAAM,KAAK,SAAS,QAAQ,IAAI;AACpC,OAAG,IAAI,KAAK,SAAS,OAEnB;AAGF,gBAAa,IAAI,KAAK,QAAQ,EAAE;AAChC,QAAI,IAAI,IAAI,GAAG,IAAI,QAAQ,OAAO,QAAQ,EAAE,EAC1C,cAAa,IAAI,KAAK,MAAM,KAAK,QAAQ,OAAO,GAAG,MAAM;;AAK/D,SAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCT,KAAI,eAAe,SAAS,KAAK,MAAM,UAAU,SAAS;AAExD,YAAU,WAAW,EAAE;AACvB,UAAQ,WAAW,QAAQ,YAAY;AACvC,UAAQ,QAAQ,QAAQ,SAAS;AACjC,UAAQ,YAAY,QAAQ,aAAa,QAAQ,gBAAgB;AACjE,MAAG,EAAE,YAAY,SACf,SAAQ,SAAS;AAEnB,MAAG,EAAE,gBAAgB,SACnB,SAAQ,aAAa;AAEvB,MAAG,EAAE,wBAAwB,SAC3B,SAAQ,qBAAqB;EAG/B,IAAI,aAAa,QAAQ;EACzB,IAAI;AACJ,MAAG,eAAe,KAChB,cAAa,MAAM,KAAK,WAAW,WAAW;WACtC,QAAQ,mBAEhB,KAAG,MAAM;GACP,IAAI,aAAa,MAAM,KAAK,QAAQ,KAAK,GAAG,KAAK,KAAK;AACtD,OAAG,OAAO,eAAe,SACvB,cAAa,IAAI,mBAAmB,WAAW;GAEjD,IAAI,OAAO,MAAM,GAAG,KAAK,QAAQ;AACjC,QAAK,OAAO,KAAK,MAAM,IAAI,kBAAkB,WAAW,CAAC,CAAC,UAAU,CAAC;AACrE,gBAAa,KAAK,QAAQ,CAAC,UAAU;QAKrC,cAAa,MAAM,OAAO,SAAS,GAAG;EAI1C,IAAI,QAAQ,EAAE;AACd,MAAG,eAAe,KAChB,OAAM,KAEJ,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,UAAU,MAAM,CAE1D,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,KAAK,OAC/C,KAAK,SAAS,IAAI,KAAK,WAAW,CAAC,UAAU,CAAC,EAEhD,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,KAAK,MAAM,CACrD,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,aAAa,OACvD,WAAW,CACd,CAAC,CACH,CAAC,CAAC;AAEP,MAAG,kBAAkB,QACnB,OAAM,KAEJ,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,UAAU,MAAM,CAE1D,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,KAAK,OAC/C,KAAK,SAAS,IAAI,KAAK,aAAa,CAAC,UAAU,CAAC,EAElD,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,KAAK,MAAM,CACrD,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,WAAW,OACrD,QAAQ,aAAa,CACxB,CAAC,CACH,CAAC,CAAC;AAGP,MAAG,MAAM,SAAS,EAChB,YAAW,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,KAAK,MAAM,MAAM;EAI1E,IAAI,WAAW,EAAE;EAGjB,IAAI,QAAQ,EAAE;AACd,MAAG,SAAS,KACV,KAAG,MAAM,KAAK,QAAQ,KAAK,CACzB,SAAQ;MAER,SAAQ,CAAC,KAAK;EAIlB,IAAI,eAAe,EAAE;AACrB,OAAI,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,EAAE,GAAG;AAEpC,UAAO,MAAM;AACb,OAAG,OAAO,SAAS,SACjB,QAAO,IAAI,mBAAmB,KAAK;GAIrC,IAAI,eAAgB,MAAM,IAAK,WAAW;GAC1C,IAAI,WAAW,IAAI,kBAAkB,KAAK;GAC1C,IAAI,cACF,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,UAAU,MAAM;IAE1D,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,KAAK,OAC/C,KAAK,SAAS,IAAI,KAAK,QAAQ,CAAC,UAAU,CAAC;IAE7C,KAAK,OAAO,KAAK,MAAM,kBAAkB,GAAG,MAAM,CAEhD,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,UAAU,MAAM,CAE1D,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,KAAK,OAC/C,KAAK,SAAS,IAAI,KAAK,gBAAgB,CAAC,UAAU,CAAC,EAErD,KAAK,OAAO,KAAK,MAAM,kBAAkB,GAAG,MAAM,CAChD,KAAK,OACH,KAAK,MAAM,WAAW,KAAK,KAAK,aAAa,OAC7C,KAAK,MAAM,SAAS,CAAC,UAAU,CAAC,CACnC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEV;IACD,CAAC;AACJ,gBAAa,KAAK,YAAY;;AAGhC,MAAG,aAAa,SAAS,GAAG;GAE1B,IAAI,mBAAmB,KAAK,OAC1B,KAAK,MAAM,WAAW,KAAK,KAAK,UAAU,MAAM,aAAa;GAG/D,IAAI,SAEF,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,UAAU,MAAM,CAE1D,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,KAAK,OAE/C,KAAK,SAAS,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,EAE1C,KAAK,OAAO,KAAK,MAAM,kBAAkB,GAAG,MAAM,CAChD,KAAK,OACH,KAAK,MAAM,WAAW,KAAK,KAAK,aAAa,OAC7C,KAAK,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAC3C,CAAC,CACH,CAAC;AACJ,YAAS,KAAK,OAAO;;EAIvB,IAAI,SAAS;AACb,MAAG,QAAQ,MAAM;GAEf,IAAI,SAAS,IAAI,kBAAkB,IAAI,iBAAiB,IAAI,CAAC;AAC7D,OAAG,aAAa,KAEd,UAAS,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,UAAU,MAAM;IAEnE,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,KAAK,OAC/C,KAAK,SAAS,IAAI,KAAK,OAAO,CAAC,UAAU,CAAC;IAE5C,KAAK,OAAO,KAAK,MAAM,kBAAkB,GAAG,MAAM,CAEhD,OACD,CAAC;IAEF;IACD,CAAC;OAGF,UAAS,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,UAAU,MAAM;IAEnE,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,KAAK,OAC/C,KAAK,SAAS,IAAI,KAAK,oBAAoB,CAAC,UAAU,CAAC;IAEzD,KAAK,OAAO,KAAK,MAAM,kBAAkB,GAAG,MAAM,CAEhD,IAAI,sBAAsB,QAAQ,UAAU,QAAQ,CACrD,CAAC;IAEF;IACD,CAAC;GAIJ,IAAI,kBACF,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,UAAU,MAAM,CAAC,OAAO,CAAC;GAGvE,IAAI,QAEF,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,UAAU,MAAM,CAE1D,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,KAAK,OAE/C,KAAK,SAAS,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,EAE1C,KAAK,OAAO,KAAK,MAAM,kBAAkB,GAAG,MAAM,CAChD,KAAK,OACH,KAAK,MAAM,WAAW,KAAK,KAAK,aAAa,OAC7C,KAAK,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAC1C,CAAC,CACH,CAAC;AACJ,YAAS,KAAK,MAAM;;EAItB,IAAI,OAAO,KAAK,OACd,KAAK,MAAM,WAAW,KAAK,KAAK,UAAU,MAAM,SAAS;EAE3D,IAAI;AACJ,MAAG,QAAQ,QAAQ;GAEjB,IAAI,OAAO,MAAM,GAAG,KAAK,QAAQ;GACjC,IAAI,UAAU,IAAI,MAAM,KAAK,WAC3B,MAAM,OAAO,SAAS,QAAQ,SAAS,CAAC;GAC1C,IAAI,QAAQ,QAAQ;GAEpB,IAAI,MAAM,IAAI,YAAY,UAAU,SAAS,GAAG,OAAO,GAAG;GAC1D,IAAI,MAAM,MAAM,KAAK,QAAQ;AAC7B,OAAI,MAAM,MAAM,IAAI;AACpB,OAAI,OAAO,KAAK,MAAM,KAAK,CAAC,UAAU,CAAC;GACvC,IAAI,WAAW,IAAI,QAAQ;AAC3B,aAAU,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,UAAU,MAAM;IAEpE,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,UAAU,MAAM,CAE1D,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,UAAU,MAAM,CAE1D,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,KAAK,OAC/C,KAAK,SAAS,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,EAE1C,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,MAAM,OAAO,GAAG,CAC7D,CAAC,EAEF,KAAK,OACH,KAAK,MAAM,WAAW,KAAK,KAAK,aAChC,OAAO,SAAS,UAAU,CAAC,CAC9B,CAAC;IAEF,KAAK,OACH,KAAK,MAAM,WAAW,KAAK,KAAK,aAAa,OAAO,QAAQ,UAAU,CAAC;IAEzE,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,SAAS,OACnD,KAAK,aAAa,MAAM,CAAC,UAAU,CACpC;IACF,CAAC;;AAIJ,SAAO,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,UAAU,MAAM;GAEjE,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,SAAS,OACnD,KAAK,aAAa,EAAE,CAAC,UAAU,CAAC;GAElC,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,UAAU,MAAM,CAE1D,KAAK,OAAO,KAAK,MAAM,WAAW,KAAK,KAAK,KAAK,OAE/C,KAAK,SAAS,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,EAE1C,KAAK,OAAO,KAAK,MAAM,kBAAkB,GAAG,MAAM,CAChD,KAAK,OACH,KAAK,MAAM,WAAW,KAAK,KAAK,aAAa,OAC7C,KAAK,MAAM,KAAK,CAAC,UAAU,CAAC,CAC/B,CAAC,CACH,CAAC;GACF;GACD,CAAC;;;;;;;;;;;;;;;AAgBJ,KAAI,cAAc,MAAM,IAAI"}