@intlayer/backend 7.1.4 → 7.1.6

package/dist/cjs/node_modules/xml-crypto/lib/signed-xml.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"signed-xml.cjs","names":["prefix"],"sources":["../../../../../../../node_modules/xml-crypto/lib/signed-xml.js"],"sourcesContent":["\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.SignedXml = void 0;\nconst isDomNode = require(\"@xmldom/is-dom-node\");\nconst xmldom = require(\"@xmldom/xmldom\");\nconst util_1 = require(\"util\");\nconst xpath = require(\"xpath\");\nconst c14n = require(\"./c14n-canonicalization\");\nconst envelopedSignatures = require(\"./enveloped-signature\");\nconst execC14n = require(\"./exclusive-canonicalization\");\nconst hashAlgorithms = require(\"./hash-algorithms\");\nconst signatureAlgorithms = require(\"./signature-algorithms\");\nconst utils = require(\"./utils\");\nclass SignedXml {\n    /**\n     * The SignedXml constructor provides an abstraction for sign and verify xml documents. The object is constructed using\n     * @param options {@link SignedXmlOptions}\n     */\n    constructor(options = {}) {\n        /**\n         * One of the supported signature algorithms.\n         * @see {@link SignatureAlgorithmType}\n         */\n        this.signatureAlgorithm = undefined;\n        /**\n         * Rules used to convert an XML document into its canonical form.\n         */\n        this.canonicalizationAlgorithm = undefined;\n        /**\n         * It specifies a list of namespace prefixes that should be considered \"inclusive\" during the canonicalization process.\n         */\n        this.inclusiveNamespacesPrefixList = [];\n        this.namespaceResolver = {\n            lookupNamespaceURI: function ( /* prefix */) {\n                throw new Error(\"Not implemented\");\n            },\n        };\n        this.implicitTransforms = [];\n        this.keyInfoAttributes = {};\n        this.getKeyInfoContent = SignedXml.getKeyInfoContent;\n        this.getCertFromKeyInfo = SignedXml.getCertFromKeyInfo;\n        // Internal state\n        this.id = 0;\n        this.signedXml = \"\";\n        this.signatureXml = \"\";\n        this.signatureNode = null;\n        this.signatureValue = \"\";\n        this.originalXmlWithIds = \"\";\n        this.keyInfo = null;\n        /**\n         * Contains the references that were signed.\n         * @see {@link Reference}\n         */\n        this.references = [];\n        /**\n         * Contains the canonicalized XML of the references that were validly signed.\n         *\n         * This populates with the canonical XML of the reference only after\n         * verifying the signature is cryptographically authentic.\n         */\n        this.signedReferences = [];\n        /**\n         *  To add a new transformation algorithm create a new class that implements the {@link TransformationAlgorithm} interface, and register it here. More info: {@link https://github.com/node-saml/xml-crypto#customizing-algorithms|Customizing Algorithms}\n         */\n        this.CanonicalizationAlgorithms = {\n            \"http://www.w3.org/TR/2001/REC-xml-c14n-20010315\": c14n.C14nCanonicalization,\n            \"http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments\": c14n.C14nCanonicalizationWithComments,\n            \"http://www.w3.org/2001/10/xml-exc-c14n#\": execC14n.ExclusiveCanonicalization,\n            \"http://www.w3.org/2001/10/xml-exc-c14n#WithComments\": execC14n.ExclusiveCanonicalizationWithComments,\n            \"http://www.w3.org/2000/09/xmldsig#enveloped-signature\": envelopedSignatures.EnvelopedSignature,\n        };\n        // TODO: In v7.x we may consider deprecating sha1\n        /**\n         * To add a new hash algorithm create a new class that implements the {@link HashAlgorithm} interface, and register it here. More info: {@link https://github.com/node-saml/xml-crypto#customizing-algorithms|Customizing Algorithms}\n         */\n        this.HashAlgorithms = {\n            \"http://www.w3.org/2000/09/xmldsig#sha1\": hashAlgorithms.Sha1,\n            \"http://www.w3.org/2001/04/xmlenc#sha256\": hashAlgorithms.Sha256,\n            \"http://www.w3.org/2001/04/xmlenc#sha512\": hashAlgorithms.Sha512,\n        };\n        // TODO: In v7.x we may consider deprecating sha1\n        /**\n         * To add a new signature algorithm create a new class that implements the {@link SignatureAlgorithm} interface, and register it here. More info: {@link https://github.com/node-saml/xml-crypto#customizing-algorithms|Customizing Algorithms}\n         */\n        this.SignatureAlgorithms = {\n            \"http://www.w3.org/2000/09/xmldsig#rsa-sha1\": signatureAlgorithms.RsaSha1,\n            \"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256\": signatureAlgorithms.RsaSha256,\n            \"http://www.w3.org/2001/04/xmldsig-more#rsa-sha512\": signatureAlgorithms.RsaSha512,\n            // Disabled by default due to key confusion concerns.\n            // 'http://www.w3.org/2000/09/xmldsig#hmac-sha1': SignatureAlgorithms.HmacSha1\n        };\n        const { idMode, idAttribute, privateKey, publicCert, signatureAlgorithm, canonicalizationAlgorithm, inclusiveNamespacesPrefixList, implicitTransforms, keyInfoAttributes, getKeyInfoContent, getCertFromKeyInfo, } = options;\n        // Options\n        this.idMode = idMode;\n        this.idAttributes = [\"Id\", \"ID\", \"id\"];\n        if (idAttribute) {\n            this.idAttributes.unshift(idAttribute);\n        }\n        this.privateKey = privateKey;\n        this.publicCert = publicCert;\n        this.signatureAlgorithm = signatureAlgorithm ?? this.signatureAlgorithm;\n        this.canonicalizationAlgorithm = canonicalizationAlgorithm;\n        if (typeof inclusiveNamespacesPrefixList === \"string\") {\n            this.inclusiveNamespacesPrefixList = inclusiveNamespacesPrefixList.split(\" \");\n        }\n        else if (utils.isArrayHasLength(inclusiveNamespacesPrefixList)) {\n            this.inclusiveNamespacesPrefixList = inclusiveNamespacesPrefixList;\n        }\n        this.implicitTransforms = implicitTransforms ?? this.implicitTransforms;\n        this.keyInfoAttributes = keyInfoAttributes ?? this.keyInfoAttributes;\n        this.getKeyInfoContent = getKeyInfoContent ?? this.getKeyInfoContent;\n        this.getCertFromKeyInfo = getCertFromKeyInfo ?? SignedXml.noop;\n        this.CanonicalizationAlgorithms;\n        this.HashAlgorithms;\n        this.SignatureAlgorithms;\n    }\n    /**\n     * Due to key-confusion issues, it's risky to have both hmac\n     * and digital signature algorithms enabled at the same time.\n     * This enables HMAC and disables other signing algorithms.\n     */\n    enableHMAC() {\n        this.SignatureAlgorithms = {\n            \"http://www.w3.org/2000/09/xmldsig#hmac-sha1\": signatureAlgorithms.HmacSha1,\n        };\n        this.getKeyInfoContent = SignedXml.noop;\n    }\n    /**\n     * Builds the contents of a KeyInfo element as an XML string.\n     *\n     * For example, if the value of the prefix argument is 'foo', then\n     * the resultant XML string will be \"<foo:X509Data></foo:X509Data>\"\n     *\n     * @return an XML string representation of the contents of a KeyInfo element, or `null` if no `KeyInfo` element should be included\n     */\n    static getKeyInfoContent({ publicCert, prefix }) {\n        if (publicCert == null) {\n            return null;\n        }\n        prefix = prefix ? `${prefix}:` : \"\";\n        let x509Certs = \"\";\n        if (Buffer.isBuffer(publicCert)) {\n            publicCert = publicCert.toString(\"latin1\");\n        }\n        let publicCertMatches = [];\n        if (typeof publicCert === \"string\") {\n            publicCertMatches = publicCert.match(utils.EXTRACT_X509_CERTS) || [];\n        }\n        if (publicCertMatches.length > 0) {\n            x509Certs = publicCertMatches\n                .map((c) => `<${prefix}X509Certificate>${utils\n                .pemToDer(c)\n                .toString(\"base64\")}</${prefix}X509Certificate>`)\n                .join(\"\");\n        }\n        return `<${prefix}X509Data>${x509Certs}</${prefix}X509Data>`;\n    }\n    /**\n     * Returns the value of the signing certificate based on the contents of the\n     * specified KeyInfo.\n     *\n     * @param keyInfo KeyInfo element (@see https://www.w3.org/TR/2008/REC-xmldsig-core-20080610/#sec-X509Data)\n     * @return the signing certificate as a string in PEM format\n     */\n    static getCertFromKeyInfo(keyInfo) {\n        if (keyInfo != null) {\n            const cert = xpath.select1(\".//*[local-name(.)='X509Certificate']\", keyInfo);\n            if (isDomNode.isNodeLike(cert)) {\n                return utils.derToPem(cert.textContent ?? \"\", \"CERTIFICATE\");\n            }\n        }\n        return null;\n    }\n    checkSignature(xml, callback) {\n        if (callback != null && typeof callback !== \"function\") {\n            throw new Error(\"Last parameter must be a callback function\");\n        }\n        this.signedXml = xml;\n        const doc = new xmldom.DOMParser().parseFromString(xml);\n        // Reset the references as only references from our re-parsed signedInfo node can be trusted\n        this.references = [];\n        const unverifiedSignedInfoCanon = this.getCanonSignedInfoXml(doc);\n        if (!unverifiedSignedInfoCanon) {\n            if (callback) {\n                callback(new Error(\"Canonical signed info cannot be empty\"), false);\n                return;\n            }\n            throw new Error(\"Canonical signed info cannot be empty\");\n        }\n        // unsigned, verify later to keep with consistent callback behavior\n        const parsedUnverifiedSignedInfo = new xmldom.DOMParser().parseFromString(unverifiedSignedInfoCanon, \"text/xml\");\n        const unverifiedSignedInfoDoc = parsedUnverifiedSignedInfo.documentElement;\n        if (!unverifiedSignedInfoDoc) {\n            if (callback) {\n                callback(new Error(\"Could not parse unverifiedSignedInfoCanon into a document\"), false);\n                return;\n            }\n            throw new Error(\"Could not parse unverifiedSignedInfoCanon into a document\");\n        }\n        const references = utils.findChildren(unverifiedSignedInfoDoc, \"Reference\");\n        if (!utils.isArrayHasLength(references)) {\n            if (callback) {\n                callback(new Error(\"could not find any Reference elements\"), false);\n                return;\n            }\n            throw new Error(\"could not find any Reference elements\");\n        }\n        // TODO: In a future release we'd like to load the Signature and its References at the same time,\n        // however, in the `.loadSignature()` method we don't have the entire document,\n        // which we need to to keep the inclusive namespaces\n        for (const reference of references) {\n            this.loadReference(reference);\n        }\n        /* eslint-disable-next-line deprecation/deprecation */\n        if (!this.getReferences().every((ref) => this.validateReference(ref, doc))) {\n            /* Trustworthiness can only be determined if SignedInfo's (which holds References' DigestValue(s)\n               which were validated at this stage) signature is valid. Execution does not proceed to validate\n               signature phase thus each References' DigestValue must be considered to be untrusted (attacker\n               might have injected any data with new new references and/or recalculated new DigestValue for\n               altered Reference(s)). Returning any content via `signedReferences` would give false sense of\n               trustworthiness if/when SignedInfo's (which holds references' DigestValues) signature is not\n               valid(ated). Put simply: if one fails, they are all not trustworthy.\n            */\n            this.signedReferences = [];\n            this.references.forEach((ref) => {\n                ref.signedReference = undefined;\n            });\n            // TODO: add this breaking change here later on for even more security: `this.references = [];`\n            if (callback) {\n                callback(new Error(\"Could not validate all references\"), false);\n                return;\n            }\n            // We return false because some references validated, but not all\n            // We should actually be throwing an error here, but that would be a breaking change\n            // See https://www.w3.org/TR/xmldsig-core/#sec-CoreValidation\n            return false;\n        }\n        // (Stage B authentication step, show that the `signedInfoCanon` is signed)\n        // First find the key & signature algorithm, these should match\n        // Stage B: Take the signature algorithm and key and verify the `SignatureValue` against the canonicalized `SignedInfo`\n        const signer = this.findSignatureAlgorithm(this.signatureAlgorithm);\n        const key = this.getCertFromKeyInfo(this.keyInfo) || this.publicCert || this.privateKey;\n        if (key == null) {\n            throw new Error(\"KeyInfo or publicCert or privateKey is required to validate signature\");\n        }\n        // Check the signature verification to know whether to reset signature value or not.\n        const sigRes = signer.verifySignature(unverifiedSignedInfoCanon, key, this.signatureValue);\n        if (sigRes === true) {\n            if (callback) {\n                callback(null, true);\n            }\n            else {\n                return true;\n            }\n        }\n        else {\n            // Ideally, we would start by verifying the `signedInfoCanon` first,\n            // but that may cause some breaking changes, so we'll handle that in v7.x.\n            // If we were validating `signedInfoCanon` first, we wouldn't have to reset this array.\n            this.signedReferences = [];\n            this.references.forEach((ref) => {\n                ref.signedReference = undefined;\n            });\n            // TODO: add this breaking change here later on for even more security: `this.references = [];`\n            if (callback) {\n                callback(new Error(`invalid signature: the signature value ${this.signatureValue} is incorrect`));\n                return; // return early\n            }\n            else {\n                throw new Error(`invalid signature: the signature value ${this.signatureValue} is incorrect`);\n            }\n        }\n    }\n    getCanonSignedInfoXml(doc) {\n        if (this.signatureNode == null) {\n            throw new Error(\"No signature found.\");\n        }\n        if (typeof this.canonicalizationAlgorithm !== \"string\") {\n            throw new Error(\"Missing canonicalizationAlgorithm when trying to get signed info for XML\");\n        }\n        const signedInfo = utils.findChildren(this.signatureNode, \"SignedInfo\");\n        if (signedInfo.length === 0) {\n            throw new Error(\"could not find SignedInfo element in the message\");\n        }\n        if (signedInfo.length > 1) {\n            throw new Error(\"could not get canonicalized signed info for a signature that contains multiple SignedInfo nodes\");\n        }\n        if (this.canonicalizationAlgorithm === \"http://www.w3.org/TR/2001/REC-xml-c14n-20010315\" ||\n            this.canonicalizationAlgorithm ===\n                \"http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments\") {\n            if (!doc || typeof doc !== \"object\") {\n                throw new Error(\"When canonicalization method is non-exclusive, whole xml dom must be provided as an argument\");\n            }\n        }\n        /**\n         * Search for ancestor namespaces before canonicalization.\n         */\n        const ancestorNamespaces = utils.findAncestorNs(doc, \"//*[local-name()='SignedInfo']\");\n        const c14nOptions = {\n            ancestorNamespaces: ancestorNamespaces,\n        };\n        return this.getCanonXml([this.canonicalizationAlgorithm], signedInfo[0], c14nOptions);\n    }\n    getCanonReferenceXml(doc, ref, node) {\n        /**\n         * Search for ancestor namespaces before canonicalization.\n         */\n        if (Array.isArray(ref.transforms)) {\n            ref.ancestorNamespaces = utils.findAncestorNs(doc, ref.xpath, this.namespaceResolver);\n        }\n        const c14nOptions = {\n            inclusiveNamespacesPrefixList: ref.inclusiveNamespacesPrefixList,\n            ancestorNamespaces: ref.ancestorNamespaces,\n        };\n        return this.getCanonXml(ref.transforms, node, c14nOptions);\n    }\n    calculateSignatureValue(doc, callback) {\n        const signedInfoCanon = this.getCanonSignedInfoXml(doc);\n        const signer = this.findSignatureAlgorithm(this.signatureAlgorithm);\n        if (this.privateKey == null) {\n            throw new Error(\"Private key is required to compute signature\");\n        }\n        if (typeof callback === \"function\") {\n            signer.getSignature(signedInfoCanon, this.privateKey, callback);\n        }\n        else {\n            this.signatureValue = signer.getSignature(signedInfoCanon, this.privateKey);\n        }\n    }\n    findSignatureAlgorithm(name) {\n        if (name == null) {\n            throw new Error(\"signatureAlgorithm is required\");\n        }\n        const algo = this.SignatureAlgorithms[name];\n        if (algo) {\n            return new algo();\n        }\n        else {\n            throw new Error(`signature algorithm '${name}' is not supported`);\n        }\n    }\n    findCanonicalizationAlgorithm(name) {\n        if (name != null) {\n            const algo = this.CanonicalizationAlgorithms[name];\n            if (algo) {\n                return new algo();\n            }\n        }\n        throw new Error(`canonicalization algorithm '${name}' is not supported`);\n    }\n    findHashAlgorithm(name) {\n        const algo = this.HashAlgorithms[name];\n        if (algo) {\n            return new algo();\n        }\n        else {\n            throw new Error(`hash algorithm '${name}' is not supported`);\n        }\n    }\n    validateElementAgainstReferences(elemOrXpath, doc) {\n        let elem;\n        if (typeof elemOrXpath === \"string\") {\n            const firstElem = xpath.select1(elemOrXpath, doc);\n            isDomNode.assertIsElementNode(firstElem);\n            elem = firstElem;\n        }\n        else {\n            elem = elemOrXpath;\n        }\n        /* eslint-disable-next-line deprecation/deprecation */\n        for (const ref of this.getReferences()) {\n            const uri = ref.uri?.[0] === \"#\" ? ref.uri.substring(1) : ref.uri;\n            for (const attr of this.idAttributes) {\n                const elemId = elem.getAttribute(attr);\n                if (uri === elemId) {\n                    ref.xpath = `//*[@*[local-name(.)='${attr}']='${uri}']`;\n                    break; // found the correct element, no need to check further\n                }\n            }\n            const canonXml = this.getCanonReferenceXml(doc, ref, elem);\n            const hash = this.findHashAlgorithm(ref.digestAlgorithm);\n            const digest = hash.getHash(canonXml);\n            if (utils.validateDigestValue(digest, ref.digestValue)) {\n                return ref;\n            }\n        }\n        throw new Error(\"No references passed validation\");\n    }\n    validateReference(ref, doc) {\n        const uri = ref.uri?.[0] === \"#\" ? ref.uri.substring(1) : ref.uri;\n        let elem = null;\n        if (uri === \"\") {\n            elem = xpath.select1(\"//*\", doc);\n        }\n        else if (uri?.indexOf(\"'\") !== -1) {\n            // xpath injection\n            throw new Error(\"Cannot validate a uri with quotes inside it\");\n        }\n        else {\n            let num_elements_for_id = 0;\n            for (const attr of this.idAttributes) {\n                const tmp_elemXpath = `//*[@*[local-name(.)='${attr}']='${uri}']`;\n                const tmp_elem = xpath.select(tmp_elemXpath, doc);\n                if (utils.isArrayHasLength(tmp_elem)) {\n                    num_elements_for_id += tmp_elem.length;\n                    if (num_elements_for_id > 1) {\n                        throw new Error(\"Cannot validate a document which contains multiple elements with the \" +\n                            \"same value for the ID / Id / Id attributes, in order to prevent \" +\n                            \"signature wrapping attack.\");\n                    }\n                    elem = tmp_elem[0];\n                    ref.xpath = tmp_elemXpath;\n                }\n            }\n        }\n        ref.getValidatedNode = (0, util_1.deprecate)((xpathSelector) => {\n            xpathSelector = xpathSelector || ref.xpath;\n            if (typeof xpathSelector !== \"string\" || ref.validationError != null) {\n                return null;\n            }\n            const selectedValue = xpath.select1(xpathSelector, doc);\n            return isDomNode.isNodeLike(selectedValue) ? selectedValue : null;\n        }, \"`ref.getValidatedNode()` is deprecated and insecure. Use `ref.signedReference` or `this.getSignedReferences()` instead.\");\n        if (!isDomNode.isNodeLike(elem)) {\n            const validationError = new Error(`invalid signature: the signature references an element with uri ${ref.uri} but could not find such element in the xml`);\n            ref.validationError = validationError;\n            return false;\n        }\n        const canonXml = this.getCanonReferenceXml(doc, ref, elem);\n        const hash = this.findHashAlgorithm(ref.digestAlgorithm);\n        const digest = hash.getHash(canonXml);\n        if (!utils.validateDigestValue(digest, ref.digestValue)) {\n            const validationError = new Error(`invalid signature: for uri ${ref.uri} calculated digest is ${digest} but the xml to validate supplies digest ${ref.digestValue}`);\n            ref.validationError = validationError;\n            return false;\n        }\n        // This step can only be done after we have verified the `signedInfo`.\n        // We verified that they have same hash,\n        // thus the `canonXml` and _only_ the `canonXml` can be trusted.\n        // Append this to `signedReferences`.\n        this.signedReferences.push(canonXml);\n        ref.signedReference = canonXml;\n        return true;\n    }\n    findSignatures(doc) {\n        const nodes = xpath.select(\"//*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']\", doc);\n        return isDomNode.isArrayOfNodes(nodes) ? nodes : [];\n    }\n    /**\n     * Loads the signature information from the provided XML node or string.\n     *\n     * @param signatureNode The XML node or string representing the signature.\n     */\n    loadSignature(signatureNode) {\n        if (typeof signatureNode === \"string\") {\n            this.signatureNode = signatureNode = new xmldom.DOMParser().parseFromString(signatureNode);\n        }\n        else {\n            this.signatureNode = signatureNode;\n        }\n        this.signatureXml = signatureNode.toString();\n        const node = xpath.select1(\".//*[local-name(.)='CanonicalizationMethod']/@Algorithm\", signatureNode);\n        if (!isDomNode.isNodeLike(node)) {\n            throw new Error(\"could not find CanonicalizationMethod/@Algorithm element\");\n        }\n        if (isDomNode.isAttributeNode(node)) {\n            this.canonicalizationAlgorithm = node.value;\n        }\n        const signatureAlgorithm = xpath.select1(\".//*[local-name(.)='SignatureMethod']/@Algorithm\", signatureNode);\n        if (isDomNode.isAttributeNode(signatureAlgorithm)) {\n            this.signatureAlgorithm = signatureAlgorithm.value;\n        }\n        const signedInfoNodes = utils.findChildren(this.signatureNode, \"SignedInfo\");\n        if (!utils.isArrayHasLength(signedInfoNodes)) {\n            throw new Error(\"no signed info node found\");\n        }\n        if (signedInfoNodes.length > 1) {\n            throw new Error(\"could not load signature that contains multiple SignedInfo nodes\");\n        }\n        // Try to operate on the c14n version of `signedInfo`. This forces the initial `getReferences()`\n        // API call to always return references that are loaded under the canonical `SignedInfo`\n        // in the case that the client access the `.references` **before** signature verification.\n        // Ensure canonicalization algorithm is exclusive, otherwise we'd need the entire document\n        let canonicalizationAlgorithmForSignedInfo = this.canonicalizationAlgorithm;\n        if (!canonicalizationAlgorithmForSignedInfo ||\n            canonicalizationAlgorithmForSignedInfo ===\n                \"http://www.w3.org/TR/2001/REC-xml-c14n-20010315\" ||\n            canonicalizationAlgorithmForSignedInfo ===\n                \"http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments\") {\n            canonicalizationAlgorithmForSignedInfo = \"http://www.w3.org/2001/10/xml-exc-c14n#\";\n        }\n        const temporaryCanonSignedInfo = this.getCanonXml([canonicalizationAlgorithmForSignedInfo], signedInfoNodes[0]);\n        const temporaryCanonSignedInfoXml = new xmldom.DOMParser().parseFromString(temporaryCanonSignedInfo, \"text/xml\");\n        const signedInfoDoc = temporaryCanonSignedInfoXml.documentElement;\n        this.references = [];\n        const references = utils.findChildren(signedInfoDoc, \"Reference\");\n        if (!utils.isArrayHasLength(references)) {\n            throw new Error(\"could not find any Reference elements\");\n        }\n        for (const reference of references) {\n            this.loadReference(reference);\n        }\n        const signatureValue = xpath.select1(\".//*[local-name(.)='SignatureValue']/text()\", signatureNode);\n        if (isDomNode.isTextNode(signatureValue)) {\n            this.signatureValue = signatureValue.data.replace(/\\r?\\n/g, \"\");\n        }\n        const keyInfo = xpath.select1(\".//*[local-name(.)='KeyInfo']\", signatureNode);\n        if (isDomNode.isNodeLike(keyInfo)) {\n            this.keyInfo = keyInfo;\n        }\n    }\n    /**\n     * Load the reference xml node to a model\n     *\n     */\n    loadReference(refNode) {\n        let nodes = utils.findChildren(refNode, \"DigestMethod\");\n        if (nodes.length === 0) {\n            throw new Error(`could not find DigestMethod in reference ${refNode.toString()}`);\n        }\n        const digestAlgoNode = nodes[0];\n        const attr = utils.findAttr(digestAlgoNode, \"Algorithm\");\n        if (!attr) {\n            throw new Error(`could not find Algorithm attribute in node ${digestAlgoNode.toString()}`);\n        }\n        const digestAlgo = attr.value;\n        nodes = utils.findChildren(refNode, \"DigestValue\");\n        if (nodes.length === 0) {\n            throw new Error(`could not find DigestValue node in reference ${refNode.toString()}`);\n        }\n        if (nodes.length > 1) {\n            throw new Error(`could not load reference for a node that contains multiple DigestValue nodes: ${refNode.toString()}`);\n        }\n        const digestValue = nodes[0].textContent;\n        if (!digestValue) {\n            throw new Error(`could not find the value of DigestValue in ${refNode.toString()}`);\n        }\n        const transforms = [];\n        let inclusiveNamespacesPrefixList = [];\n        nodes = utils.findChildren(refNode, \"Transforms\");\n        if (nodes.length !== 0) {\n            const transformsNode = nodes[0];\n            const transformsAll = utils.findChildren(transformsNode, \"Transform\");\n            for (const transform of transformsAll) {\n                const transformAttr = utils.findAttr(transform, \"Algorithm\");\n                if (transformAttr) {\n                    transforms.push(transformAttr.value);\n                }\n            }\n            // This is a little strange, we are looking for children of the last child of `transformsNode`\n            const inclusiveNamespaces = utils.findChildren(transformsAll[transformsAll.length - 1], \"InclusiveNamespaces\");\n            if (utils.isArrayHasLength(inclusiveNamespaces)) {\n                // Should really only be one prefix list, but maybe there's some circumstances where more than one to let's handle it\n                inclusiveNamespacesPrefixList = inclusiveNamespaces\n                    .flatMap((namespace) => (namespace.getAttribute(\"PrefixList\") ?? \"\").split(\" \"))\n                    .filter((value) => value.length > 0);\n            }\n        }\n        if (utils.isArrayHasLength(this.implicitTransforms)) {\n            this.implicitTransforms.forEach(function (t) {\n                transforms.push(t);\n            });\n        }\n        /**\n         * DigestMethods take an octet stream rather than a node set. If the output of the last transform is a node set, we\n         * need to canonicalize the node set to an octet stream using non-exclusive canonicalization. If there are no\n         * transforms, we need to canonicalize because URI dereferencing for a same-document reference will return a node-set.\n         * @see:\n         * https://www.w3.org/TR/xmldsig-core1/#sec-DigestMethod\n         * https://www.w3.org/TR/xmldsig-core1/#sec-ReferenceProcessingModel\n         * https://www.w3.org/TR/xmldsig-core1/#sec-Same-Document\n         */\n        if (transforms.length === 0 ||\n            transforms[transforms.length - 1] === \"http://www.w3.org/2000/09/xmldsig#enveloped-signature\") {\n            transforms.push(\"http://www.w3.org/TR/2001/REC-xml-c14n-20010315\");\n        }\n        const refUri = isDomNode.isElementNode(refNode)\n            ? refNode.getAttribute(\"URI\") || undefined\n            : undefined;\n        this.addReference({\n            transforms,\n            digestAlgorithm: digestAlgo,\n            uri: refUri,\n            digestValue,\n            inclusiveNamespacesPrefixList,\n            isEmptyUri: false,\n        });\n    }\n    /**\n     * Adds a reference to the signature.\n     *\n     * @param xpath The XPath expression to select the XML nodes to be referenced.\n     * @param transforms An array of transform algorithms to be applied to the selected nodes.\n     * @param digestAlgorithm The digest algorithm to use for computing the digest value.\n     * @param uri The URI identifier for the reference. If empty, an empty URI will be used.\n     * @param digestValue The expected digest value for the reference.\n     * @param inclusiveNamespacesPrefixList The prefix list for inclusive namespace canonicalization.\n     * @param isEmptyUri Indicates whether the URI is empty. Defaults to `false`.\n     */\n    addReference({ xpath, transforms, digestAlgorithm, uri = \"\", digestValue, inclusiveNamespacesPrefixList = [], isEmptyUri = false, }) {\n        if (digestAlgorithm == null) {\n            throw new Error(\"digestAlgorithm is required\");\n        }\n        if (!utils.isArrayHasLength(transforms)) {\n            throw new Error(\"transforms must contain at least one transform algorithm\");\n        }\n        this.references.push({\n            xpath,\n            transforms,\n            digestAlgorithm,\n            uri,\n            digestValue,\n            inclusiveNamespacesPrefixList,\n            isEmptyUri,\n            getValidatedNode: () => {\n                throw new Error(\"Reference has not been validated yet; Did you call `sig.checkSignature()`?\");\n            },\n        });\n    }\n    /**\n     * Returns the list of references.\n     */\n    getReferences() {\n        // TODO: Refactor once `getValidatedNode` is removed\n        /* Once we completely remove the deprecated `getValidatedNode()` method,\n        we can change this to return a clone to prevent accidental mutations,\n        e.g.:\n        return [...this.references];\n        */\n        return this.references;\n    }\n    getSignedReferences() {\n        return [...this.signedReferences];\n    }\n    computeSignature(xml, options, callbackParam) {\n        let callback;\n        if (typeof options === \"function\" && callbackParam == null) {\n            callback = options;\n            options = {};\n        }\n        else {\n            callback = callbackParam;\n            options = (options ?? {});\n        }\n        const doc = new xmldom.DOMParser().parseFromString(xml);\n        let xmlNsAttr = \"xmlns\";\n        const signatureAttrs = [];\n        let currentPrefix;\n        const validActions = [\"append\", \"prepend\", \"before\", \"after\"];\n        const prefix = options.prefix;\n        const attrs = options.attrs || {};\n        const location = options.location || {};\n        const existingPrefixes = options.existingPrefixes || {};\n        this.namespaceResolver = {\n            lookupNamespaceURI: function (prefix) {\n                return prefix ? existingPrefixes[prefix] : null;\n            },\n        };\n        // defaults to the root node\n        location.reference = location.reference || \"/*\";\n        // defaults to append action\n        location.action = location.action || \"append\";\n        if (validActions.indexOf(location.action) === -1) {\n            const err = new Error(`location.action option has an invalid action: ${location.action}, must be any of the following values: ${validActions.join(\", \")}`);\n            if (!callback) {\n                throw err;\n            }\n            else {\n                callback(err);\n                return;\n            }\n        }\n        // automatic insertion of `:`\n        if (prefix) {\n            xmlNsAttr += `:${prefix}`;\n            currentPrefix = `${prefix}:`;\n        }\n        else {\n            currentPrefix = \"\";\n        }\n        Object.keys(attrs).forEach(function (name) {\n            if (name !== \"xmlns\" && name !== xmlNsAttr) {\n                signatureAttrs.push(`${name}=\"${attrs[name]}\"`);\n            }\n        });\n        // add the xml namespace attribute\n        signatureAttrs.push(`${xmlNsAttr}=\"http://www.w3.org/2000/09/xmldsig#\"`);\n        let signatureXml = `<${currentPrefix}Signature ${signatureAttrs.join(\" \")}>`;\n        signatureXml += this.createSignedInfo(doc, prefix);\n        signatureXml += this.getKeyInfo(prefix);\n        signatureXml += `</${currentPrefix}Signature>`;\n        this.originalXmlWithIds = doc.toString();\n        let existingPrefixesString = \"\";\n        Object.keys(existingPrefixes).forEach(function (key) {\n            existingPrefixesString += `xmlns:${key}=\"${existingPrefixes[key]}\" `;\n        });\n        // A trick to remove the namespaces that already exist in the xml\n        // This only works if the prefix and namespace match with those in the xml\n        const dummySignatureWrapper = `<Dummy ${existingPrefixesString}>${signatureXml}</Dummy>`;\n        const nodeXml = new xmldom.DOMParser().parseFromString(dummySignatureWrapper);\n        // Because we are using a dummy wrapper hack described above, we know there will be a `firstChild`\n        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n        const signatureDoc = nodeXml.documentElement.firstChild;\n        const referenceNode = xpath.select1(location.reference, doc);\n        if (!isDomNode.isNodeLike(referenceNode)) {\n            const err2 = new Error(`the following xpath cannot be used because it was not found: ${location.reference}`);\n            if (!callback) {\n                throw err2;\n            }\n            else {\n                callback(err2);\n                return;\n            }\n        }\n        if (location.action === \"append\") {\n            referenceNode.appendChild(signatureDoc);\n        }\n        else if (location.action === \"prepend\") {\n            referenceNode.insertBefore(signatureDoc, referenceNode.firstChild);\n        }\n        else if (location.action === \"before\") {\n            if (referenceNode.parentNode == null) {\n                throw new Error(\"`location.reference` refers to the root node (by default), so we can't insert `before`\");\n            }\n            referenceNode.parentNode.insertBefore(signatureDoc, referenceNode);\n        }\n        else if (location.action === \"after\") {\n            if (referenceNode.parentNode == null) {\n                throw new Error(\"`location.reference` refers to the root node (by default), so we can't insert `after`\");\n            }\n            referenceNode.parentNode.insertBefore(signatureDoc, referenceNode.nextSibling);\n        }\n        this.signatureNode = signatureDoc;\n        const signedInfoNodes = utils.findChildren(this.signatureNode, \"SignedInfo\");\n        if (signedInfoNodes.length === 0) {\n            const err3 = new Error(\"could not find SignedInfo element in the message\");\n            if (!callback) {\n                throw err3;\n            }\n            else {\n                callback(err3);\n                return;\n            }\n        }\n        const signedInfoNode = signedInfoNodes[0];\n        if (typeof callback === \"function\") {\n            // Asynchronous flow\n            this.calculateSignatureValue(doc, (err, signature) => {\n                if (err) {\n                    callback(err);\n                }\n                else {\n                    this.signatureValue = signature || \"\";\n                    signatureDoc.insertBefore(this.createSignature(prefix), signedInfoNode.nextSibling);\n                    this.signatureXml = signatureDoc.toString();\n                    this.signedXml = doc.toString();\n                    callback(null, this);\n                }\n            });\n        }\n        else {\n            // Synchronous flow\n            this.calculateSignatureValue(doc);\n            signatureDoc.insertBefore(this.createSignature(prefix), signedInfoNode.nextSibling);\n            this.signatureXml = signatureDoc.toString();\n            this.signedXml = doc.toString();\n        }\n    }\n    getKeyInfo(prefix) {\n        const currentPrefix = prefix ? `${prefix}:` : \"\";\n        let keyInfoAttrs = \"\";\n        if (this.keyInfoAttributes) {\n            Object.keys(this.keyInfoAttributes).forEach((name) => {\n                keyInfoAttrs += ` ${name}=\"${this.keyInfoAttributes[name]}\"`;\n            });\n        }\n        const keyInfoContent = this.getKeyInfoContent({ publicCert: this.publicCert, prefix });\n        if (keyInfoAttrs || keyInfoContent) {\n            return `<${currentPrefix}KeyInfo${keyInfoAttrs}>${keyInfoContent}</${currentPrefix}KeyInfo>`;\n        }\n        return \"\";\n    }\n    /**\n     * Generate the Reference nodes (as part of the signature process)\n     *\n     */\n    createReferences(doc, prefix) {\n        let res = \"\";\n        prefix = prefix || \"\";\n        prefix = prefix ? `${prefix}:` : prefix;\n        /* eslint-disable-next-line deprecation/deprecation */\n        for (const ref of this.getReferences()) {\n            const nodes = xpath.selectWithResolver(ref.xpath ?? \"\", doc, this.namespaceResolver);\n            if (!utils.isArrayHasLength(nodes)) {\n                throw new Error(`the following xpath cannot be signed because it was not found: ${ref.xpath}`);\n            }\n            for (const node of nodes) {\n                if (ref.isEmptyUri) {\n                    res += `<${prefix}Reference URI=\"\">`;\n                }\n                else {\n                    const id = this.ensureHasId(node);\n                    ref.uri = id;\n                    res += `<${prefix}Reference URI=\"#${id}\">`;\n                }\n                res += `<${prefix}Transforms>`;\n                for (const trans of ref.transforms || []) {\n                    const transform = this.findCanonicalizationAlgorithm(trans);\n                    res += `<${prefix}Transform Algorithm=\"${transform.getAlgorithmName()}\"`;\n                    if (utils.isArrayHasLength(ref.inclusiveNamespacesPrefixList)) {\n                        res += \">\";\n                        res += `<InclusiveNamespaces PrefixList=\"${ref.inclusiveNamespacesPrefixList.join(\" \")}\" xmlns=\"${transform.getAlgorithmName()}\"/>`;\n                        res += `</${prefix}Transform>`;\n                    }\n                    else {\n                        res += \" />\";\n                    }\n                }\n                const canonXml = this.getCanonReferenceXml(doc, ref, node);\n                const digestAlgorithm = this.findHashAlgorithm(ref.digestAlgorithm);\n                res +=\n                    `</${prefix}Transforms>` +\n                        `<${prefix}DigestMethod Algorithm=\"${digestAlgorithm.getAlgorithmName()}\" />` +\n                        `<${prefix}DigestValue>${digestAlgorithm.getHash(canonXml)}</${prefix}DigestValue>` +\n                        `</${prefix}Reference>`;\n            }\n        }\n        return res;\n    }\n    getCanonXml(transforms, node, options = {}) {\n        options.defaultNsForPrefix = options.defaultNsForPrefix ?? SignedXml.defaultNsForPrefix;\n        options.signatureNode = this.signatureNode;\n        const canonXml = node.cloneNode(true); // Deep clone\n        let transformedXml = canonXml;\n        transforms.forEach((transformName) => {\n            if (isDomNode.isNodeLike(transformedXml)) {\n                // If, after processing, `transformedNode` is a string, we can't do anymore transforms on it\n                const transform = this.findCanonicalizationAlgorithm(transformName);\n                transformedXml = transform.process(transformedXml, options);\n            }\n            //TODO: currently transform.process may return either Node or String value (enveloped transformation returns Node, exclusive-canonicalization returns String).\n            //This either needs to be more explicit in the API, or all should return the same.\n            //exclusive-canonicalization returns String since it builds the Xml by hand. If it had used xmldom it would incorrectly minimize empty tags\n            //to <x/> instead of <x></x> and also incorrectly handle some delicate line break issues.\n            //enveloped transformation returns Node since if it would return String consider this case:\n            //<x xmlns:p='ns'><p:y/></x>\n            //if only y is the node to sign then a string would be <p:y/> without the definition of the p namespace. probably xmldom toString() should have added it.\n        });\n        return transformedXml.toString();\n    }\n    /**\n     * Ensure an element has Id attribute. If not create it with unique value.\n     * Work with both normal and wssecurity Id flavour\n     */\n    ensureHasId(node) {\n        let attr;\n        if (this.idMode === \"wssecurity\") {\n            attr = utils.findAttr(node, \"Id\", \"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\");\n        }\n        else {\n            this.idAttributes.some((idAttribute) => {\n                attr = utils.findAttr(node, idAttribute);\n                return !!attr; // This will break the loop as soon as a truthy attr is found.\n            });\n        }\n        if (attr) {\n            return attr.value;\n        }\n        //add the attribute\n        const id = `_${this.id++}`;\n        if (this.idMode === \"wssecurity\") {\n            node.setAttributeNS(\"http://www.w3.org/2000/xmlns/\", \"xmlns:wsu\", \"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\");\n            node.setAttributeNS(\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\", \"wsu:Id\", id);\n        }\n        else {\n            node.setAttribute(\"Id\", id);\n        }\n        return id;\n    }\n    /**\n     * Create the SignedInfo element\n     *\n     */\n    createSignedInfo(doc, prefix) {\n        if (typeof this.canonicalizationAlgorithm !== \"string\") {\n            throw new Error(\"Missing canonicalizationAlgorithm when trying to create signed info for XML\");\n        }\n        const transform = this.findCanonicalizationAlgorithm(this.canonicalizationAlgorithm);\n        const algo = this.findSignatureAlgorithm(this.signatureAlgorithm);\n        let currentPrefix;\n        currentPrefix = prefix || \"\";\n        currentPrefix = currentPrefix ? `${currentPrefix}:` : currentPrefix;\n        let res = `<${currentPrefix}SignedInfo>`;\n        res += `<${currentPrefix}CanonicalizationMethod Algorithm=\"${transform.getAlgorithmName()}\"`;\n        if (utils.isArrayHasLength(this.inclusiveNamespacesPrefixList)) {\n            res += \">\";\n            res += `<InclusiveNamespaces PrefixList=\"${this.inclusiveNamespacesPrefixList.join(\" \")}\" xmlns=\"${transform.getAlgorithmName()}\"/>`;\n            res += `</${currentPrefix}CanonicalizationMethod>`;\n        }\n        else {\n            res += \" />\";\n        }\n        res += `<${currentPrefix}SignatureMethod Algorithm=\"${algo.getAlgorithmName()}\" />`;\n        res += this.createReferences(doc, prefix);\n        res += `</${currentPrefix}SignedInfo>`;\n        return res;\n    }\n    /**\n     * Create the Signature element\n     *\n     */\n    createSignature(prefix) {\n        let xmlNsAttr = \"xmlns\";\n        if (prefix) {\n            xmlNsAttr += `:${prefix}`;\n            prefix += \":\";\n        }\n        else {\n            prefix = \"\";\n        }\n        const signatureValueXml = `<${prefix}SignatureValue>${this.signatureValue}</${prefix}SignatureValue>`;\n        //the canonicalization requires to get a valid xml node.\n        //we need to wrap the info in a dummy signature since it contains the default namespace.\n        const dummySignatureWrapper = `<${prefix}Signature ${xmlNsAttr}=\"http://www.w3.org/2000/09/xmldsig#\">${signatureValueXml}</${prefix}Signature>`;\n        const doc = new xmldom.DOMParser().parseFromString(dummySignatureWrapper);\n        // Because we are using a dummy wrapper hack described above, we know there will be a `firstChild`\n        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n        return doc.documentElement.firstChild;\n    }\n    /**\n     * Returns just the signature part, must be called only after {@link computeSignature}\n     *\n     * @returns The signature XML.\n     */\n    getSignatureXml() {\n        return this.signatureXml;\n    }\n    /**\n     * Returns the original xml with Id attributes added on relevant elements (required for validation), must be called only after {@link computeSignature}\n     *\n     * @returns The original XML with IDs.\n     */\n    getOriginalXmlWithIds() {\n        return this.originalXmlWithIds;\n    }\n    /**\n     * Returns the original xml document with the signature in it, must be called only after {@link computeSignature}\n     *\n     * @returns The signed XML.\n     */\n    getSignedXml() {\n        return this.signedXml;\n    }\n}\nexports.SignedXml = SignedXml;\nSignedXml.defaultNsForPrefix = {\n    ds: \"http://www.w3.org/2000/09/xmldsig#\",\n};\nSignedXml.noop = () => null;\n//# sourceMappingURL=signed-xml.js.map"],"x_google_ignoreList":[0],"mappings":";;;;;;;;;;;;;AACA,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,YAAY,KAAK;CACzB,MAAM;CACN,MAAM;CACN,MAAM,SAAS,QAAQ,OAAO;CAC9B,MAAM;CACN,MAAM;CACN,MAAM;CACN,MAAM;CACN,MAAM;CACN,MAAM;CACN,MAAM;CACN,IAAM,YAAN,MAAM,UAAU;;;;;EAKZ,YAAY,UAAU,EAAE,EAAE;;;;;AAKtB,QAAK,qBAAqB;;;;AAI1B,QAAK,4BAA4B;;;;AAIjC,QAAK,gCAAgC,EAAE;AACvC,QAAK,oBAAoB,EACrB,oBAAoB,WAAyB;AACzC,UAAM,IAAI,MAAM,kBAAkB;MAEzC;AACD,QAAK,qBAAqB,EAAE;AAC5B,QAAK,oBAAoB,EAAE;AAC3B,QAAK,oBAAoB,UAAU;AACnC,QAAK,qBAAqB,UAAU;AAEpC,QAAK,KAAK;AACV,QAAK,YAAY;AACjB,QAAK,eAAe;AACpB,QAAK,gBAAgB;AACrB,QAAK,iBAAiB;AACtB,QAAK,qBAAqB;AAC1B,QAAK,UAAU;;;;;AAKf,QAAK,aAAa,EAAE;;;;;;;AAOpB,QAAK,mBAAmB,EAAE;;;;AAI1B,QAAK,6BAA6B;IAC9B,mDAAmD,KAAK;IACxD,gEAAgE,KAAK;IACrE,2CAA2C,SAAS;IACpD,uDAAuD,SAAS;IAChE,yDAAyD,oBAAoB;IAChF;;;;AAKD,QAAK,iBAAiB;IAClB,0CAA0C,eAAe;IACzD,2CAA2C,eAAe;IAC1D,2CAA2C,eAAe;IAC7D;;;;AAKD,QAAK,sBAAsB;IACvB,8CAA8C,oBAAoB;IAClE,qDAAqD,oBAAoB;IACzE,qDAAqD,oBAAoB;IAG5E;GACD,MAAM,EAAE,QAAQ,aAAa,YAAY,YAAY,oBAAoB,2BAA2B,+BAA+B,oBAAoB,mBAAmB,mBAAmB,uBAAwB;AAErN,QAAK,SAAS;AACd,QAAK,eAAe;IAAC;IAAM;IAAM;IAAK;AACtC,OAAI,YACA,MAAK,aAAa,QAAQ,YAAY;AAE1C,QAAK,aAAa;AAClB,QAAK,aAAa;AAClB,QAAK,qBAAqB,sBAAsB,KAAK;AACrD,QAAK,4BAA4B;AACjC,OAAI,OAAO,kCAAkC,SACzC,MAAK,gCAAgC,8BAA8B,MAAM,IAAI;YAExE,MAAM,iBAAiB,8BAA8B,CAC1D,MAAK,gCAAgC;AAEzC,QAAK,qBAAqB,sBAAsB,KAAK;AACrD,QAAK,oBAAoB,qBAAqB,KAAK;AACnD,QAAK,oBAAoB,qBAAqB,KAAK;AACnD,QAAK,qBAAqB,sBAAsB,UAAU;AAC1D,QAAK;AACL,QAAK;AACL,QAAK;;;;;;;EAOT,aAAa;AACT,QAAK,sBAAsB,EACvB,+CAA+C,oBAAoB,UACtE;AACD,QAAK,oBAAoB,UAAU;;;;;;;;;;EAUvC,OAAO,kBAAkB,EAAE,YAAY,UAAU;AAC7C,OAAI,cAAc,KACd,QAAO;AAEX,YAAS,SAAS,GAAG,OAAO,KAAK;GACjC,IAAI,YAAY;AAChB,OAAI,OAAO,SAAS,WAAW,CAC3B,cAAa,WAAW,SAAS,SAAS;GAE9C,IAAI,oBAAoB,EAAE;AAC1B,OAAI,OAAO,eAAe,SACtB,qBAAoB,WAAW,MAAM,MAAM,mBAAmB,IAAI,EAAE;AAExE,OAAI,kBAAkB,SAAS,EAC3B,aAAY,kBACP,KAAK,MAAM,IAAI,OAAO,kBAAkB,MACxC,SAAS,EAAE,CACX,SAAS,SAAS,CAAC,IAAI,OAAO,kBAAkB,CAChD,KAAK,GAAG;AAEjB,UAAO,IAAI,OAAO,WAAW,UAAU,IAAI,OAAO;;;;;;;;;EAStD,OAAO,mBAAmB,SAAS;AAC/B,OAAI,WAAW,MAAM;IACjB,MAAM,OAAO,MAAM,QAAQ,yCAAyC,QAAQ;AAC5E,QAAI,UAAU,WAAW,KAAK,CAC1B,QAAO,MAAM,SAAS,KAAK,eAAe,IAAI,cAAc;;AAGpE,UAAO;;EAEX,eAAe,KAAK,UAAU;AAC1B,OAAI,YAAY,QAAQ,OAAO,aAAa,WACxC,OAAM,IAAI,MAAM,6CAA6C;AAEjE,QAAK,YAAY;GACjB,MAAM,MAAM,IAAI,OAAO,WAAW,CAAC,gBAAgB,IAAI;AAEvD,QAAK,aAAa,EAAE;GACpB,MAAM,4BAA4B,KAAK,sBAAsB,IAAI;AACjE,OAAI,CAAC,2BAA2B;AAC5B,QAAI,UAAU;AACV,8BAAS,IAAI,MAAM,wCAAwC,EAAE,MAAM;AACnE;;AAEJ,UAAM,IAAI,MAAM,wCAAwC;;GAI5D,MAAM,0BAD6B,IAAI,OAAO,WAAW,CAAC,gBAAgB,2BAA2B,WAAW,CACrD;AAC3D,OAAI,CAAC,yBAAyB;AAC1B,QAAI,UAAU;AACV,8BAAS,IAAI,MAAM,4DAA4D,EAAE,MAAM;AACvF;;AAEJ,UAAM,IAAI,MAAM,4DAA4D;;GAEhF,MAAM,aAAa,MAAM,aAAa,yBAAyB,YAAY;AAC3E,OAAI,CAAC,MAAM,iBAAiB,WAAW,EAAE;AACrC,QAAI,UAAU;AACV,8BAAS,IAAI,MAAM,wCAAwC,EAAE,MAAM;AACnE;;AAEJ,UAAM,IAAI,MAAM,wCAAwC;;AAK5D,QAAK,MAAM,aAAa,WACpB,MAAK,cAAc,UAAU;AAGjC,OAAI,CAAC,KAAK,eAAe,CAAC,OAAO,QAAQ,KAAK,kBAAkB,KAAK,IAAI,CAAC,EAAE;AASxE,SAAK,mBAAmB,EAAE;AAC1B,SAAK,WAAW,SAAS,QAAQ;AAC7B,SAAI,kBAAkB;MACxB;AAEF,QAAI,UAAU;AACV,8BAAS,IAAI,MAAM,oCAAoC,EAAE,MAAM;AAC/D;;AAKJ,WAAO;;GAKX,MAAM,SAAS,KAAK,uBAAuB,KAAK,mBAAmB;GACnE,MAAM,MAAM,KAAK,mBAAmB,KAAK,QAAQ,IAAI,KAAK,cAAc,KAAK;AAC7E,OAAI,OAAO,KACP,OAAM,IAAI,MAAM,wEAAwE;AAI5F,OADe,OAAO,gBAAgB,2BAA2B,KAAK,KAAK,eAAe,KAC3E,KACX,KAAI,SACA,UAAS,MAAM,KAAK;OAGpB,QAAO;QAGV;AAID,SAAK,mBAAmB,EAAE;AAC1B,SAAK,WAAW,SAAS,QAAQ;AAC7B,SAAI,kBAAkB;MACxB;AAEF,QAAI,UAAU;AACV,8BAAS,IAAI,MAAM,0CAA0C,KAAK,eAAe,eAAe,CAAC;AACjG;UAGA,OAAM,IAAI,MAAM,0CAA0C,KAAK,eAAe,eAAe;;;EAIzG,sBAAsB,KAAK;AACvB,OAAI,KAAK,iBAAiB,KACtB,OAAM,IAAI,MAAM,sBAAsB;AAE1C,OAAI,OAAO,KAAK,8BAA8B,SAC1C,OAAM,IAAI,MAAM,2EAA2E;GAE/F,MAAM,aAAa,MAAM,aAAa,KAAK,eAAe,aAAa;AACvE,OAAI,WAAW,WAAW,EACtB,OAAM,IAAI,MAAM,mDAAmD;AAEvE,OAAI,WAAW,SAAS,EACpB,OAAM,IAAI,MAAM,kGAAkG;AAEtH,OAAI,KAAK,8BAA8B,qDACnC,KAAK,8BACD,gEACJ;QAAI,CAAC,OAAO,OAAO,QAAQ,SACvB,OAAM,IAAI,MAAM,+FAA+F;;GAOvH,MAAM,cAAc,EAChB,oBAFuB,MAAM,eAAe,KAAK,iCAAiC,EAGrF;AACD,UAAO,KAAK,YAAY,CAAC,KAAK,0BAA0B,EAAE,WAAW,IAAI,YAAY;;EAEzF,qBAAqB,KAAK,KAAK,MAAM;;;;AAIjC,OAAI,MAAM,QAAQ,IAAI,WAAW,CAC7B,KAAI,qBAAqB,MAAM,eAAe,KAAK,IAAI,OAAO,KAAK,kBAAkB;GAEzF,MAAM,cAAc;IAChB,+BAA+B,IAAI;IACnC,oBAAoB,IAAI;IAC3B;AACD,UAAO,KAAK,YAAY,IAAI,YAAY,MAAM,YAAY;;EAE9D,wBAAwB,KAAK,UAAU;GACnC,MAAM,kBAAkB,KAAK,sBAAsB,IAAI;GACvD,MAAM,SAAS,KAAK,uBAAuB,KAAK,mBAAmB;AACnE,OAAI,KAAK,cAAc,KACnB,OAAM,IAAI,MAAM,+CAA+C;AAEnE,OAAI,OAAO,aAAa,WACpB,QAAO,aAAa,iBAAiB,KAAK,YAAY,SAAS;OAG/D,MAAK,iBAAiB,OAAO,aAAa,iBAAiB,KAAK,WAAW;;EAGnF,uBAAuB,MAAM;AACzB,OAAI,QAAQ,KACR,OAAM,IAAI,MAAM,iCAAiC;GAErD,MAAM,OAAO,KAAK,oBAAoB;AACtC,OAAI,KACA,QAAO,IAAI,MAAM;OAGjB,OAAM,IAAI,MAAM,wBAAwB,KAAK,oBAAoB;;EAGzE,8BAA8B,MAAM;AAChC,OAAI,QAAQ,MAAM;IACd,MAAM,OAAO,KAAK,2BAA2B;AAC7C,QAAI,KACA,QAAO,IAAI,MAAM;;AAGzB,SAAM,IAAI,MAAM,+BAA+B,KAAK,oBAAoB;;EAE5E,kBAAkB,MAAM;GACpB,MAAM,OAAO,KAAK,eAAe;AACjC,OAAI,KACA,QAAO,IAAI,MAAM;OAGjB,OAAM,IAAI,MAAM,mBAAmB,KAAK,oBAAoB;;EAGpE,iCAAiC,aAAa,KAAK;GAC/C,IAAI;AACJ,OAAI,OAAO,gBAAgB,UAAU;IACjC,MAAM,YAAY,MAAM,QAAQ,aAAa,IAAI;AACjD,cAAU,oBAAoB,UAAU;AACxC,WAAO;SAGP,QAAO;AAGX,QAAK,MAAM,OAAO,KAAK,eAAe,EAAE;IACpC,MAAM,MAAM,IAAI,MAAM,OAAO,MAAM,IAAI,IAAI,UAAU,EAAE,GAAG,IAAI;AAC9D,SAAK,MAAM,QAAQ,KAAK,aAEpB,KAAI,QADW,KAAK,aAAa,KAAK,EAClB;AAChB,SAAI,QAAQ,yBAAyB,KAAK,MAAM,IAAI;AACpD;;IAGR,MAAM,WAAW,KAAK,qBAAqB,KAAK,KAAK,KAAK;IAE1D,MAAM,SADO,KAAK,kBAAkB,IAAI,gBAAgB,CACpC,QAAQ,SAAS;AACrC,QAAI,MAAM,oBAAoB,QAAQ,IAAI,YAAY,CAClD,QAAO;;AAGf,SAAM,IAAI,MAAM,kCAAkC;;EAEtD,kBAAkB,KAAK,KAAK;GACxB,MAAM,MAAM,IAAI,MAAM,OAAO,MAAM,IAAI,IAAI,UAAU,EAAE,GAAG,IAAI;GAC9D,IAAI,OAAO;AACX,OAAI,QAAQ,GACR,QAAO,MAAM,QAAQ,OAAO,IAAI;YAE3B,KAAK,QAAQ,IAAI,KAAK,GAE3B,OAAM,IAAI,MAAM,8CAA8C;QAE7D;IACD,IAAI,sBAAsB;AAC1B,SAAK,MAAM,QAAQ,KAAK,cAAc;KAClC,MAAM,gBAAgB,yBAAyB,KAAK,MAAM,IAAI;KAC9D,MAAM,WAAW,MAAM,OAAO,eAAe,IAAI;AACjD,SAAI,MAAM,iBAAiB,SAAS,EAAE;AAClC,6BAAuB,SAAS;AAChC,UAAI,sBAAsB,EACtB,OAAM,IAAI,MAAM,kKAEiB;AAErC,aAAO,SAAS;AAChB,UAAI,QAAQ;;;;AAIxB,OAAI,oBAAoB,GAAG,OAAO,YAAY,kBAAkB;AAC5D,oBAAgB,iBAAiB,IAAI;AACrC,QAAI,OAAO,kBAAkB,YAAY,IAAI,mBAAmB,KAC5D,QAAO;IAEX,MAAM,gBAAgB,MAAM,QAAQ,eAAe,IAAI;AACvD,WAAO,UAAU,WAAW,cAAc,GAAG,gBAAgB;MAC9D,0HAA0H;AAC7H,OAAI,CAAC,UAAU,WAAW,KAAK,EAAE;AAE7B,QAAI,kCADoB,IAAI,MAAM,mEAAmE,IAAI,IAAI,6CAA6C;AAE1J,WAAO;;GAEX,MAAM,WAAW,KAAK,qBAAqB,KAAK,KAAK,KAAK;GAE1D,MAAM,SADO,KAAK,kBAAkB,IAAI,gBAAgB,CACpC,QAAQ,SAAS;AACrC,OAAI,CAAC,MAAM,oBAAoB,QAAQ,IAAI,YAAY,EAAE;AAErD,QAAI,kCADoB,IAAI,MAAM,8BAA8B,IAAI,IAAI,wBAAwB,OAAO,2CAA2C,IAAI,cAAc;AAEpK,WAAO;;AAMX,QAAK,iBAAiB,KAAK,SAAS;AACpC,OAAI,kBAAkB;AACtB,UAAO;;EAEX,eAAe,KAAK;GAChB,MAAM,QAAQ,MAAM,OAAO,4FAA4F,IAAI;AAC3H,UAAO,UAAU,eAAe,MAAM,GAAG,QAAQ,EAAE;;;;;;;EAOvD,cAAc,eAAe;AACzB,OAAI,OAAO,kBAAkB,SACzB,MAAK,gBAAgB,gBAAgB,IAAI,OAAO,WAAW,CAAC,gBAAgB,cAAc;OAG1F,MAAK,gBAAgB;AAEzB,QAAK,eAAe,cAAc,UAAU;GAC5C,MAAM,OAAO,MAAM,QAAQ,2DAA2D,cAAc;AACpG,OAAI,CAAC,UAAU,WAAW,KAAK,CAC3B,OAAM,IAAI,MAAM,2DAA2D;AAE/E,OAAI,UAAU,gBAAgB,KAAK,CAC/B,MAAK,4BAA4B,KAAK;GAE1C,MAAM,qBAAqB,MAAM,QAAQ,oDAAoD,cAAc;AAC3G,OAAI,UAAU,gBAAgB,mBAAmB,CAC7C,MAAK,qBAAqB,mBAAmB;GAEjD,MAAM,kBAAkB,MAAM,aAAa,KAAK,eAAe,aAAa;AAC5E,OAAI,CAAC,MAAM,iBAAiB,gBAAgB,CACxC,OAAM,IAAI,MAAM,4BAA4B;AAEhD,OAAI,gBAAgB,SAAS,EACzB,OAAM,IAAI,MAAM,mEAAmE;GAMvF,IAAI,yCAAyC,KAAK;AAClD,OAAI,CAAC,0CACD,2CACI,qDACJ,2CACI,+DACJ,0CAAyC;GAE7C,MAAM,2BAA2B,KAAK,YAAY,CAAC,uCAAuC,EAAE,gBAAgB,GAAG;GAE/G,MAAM,gBAD8B,IAAI,OAAO,WAAW,CAAC,gBAAgB,0BAA0B,WAAW,CAC9D;AAClD,QAAK,aAAa,EAAE;GACpB,MAAM,aAAa,MAAM,aAAa,eAAe,YAAY;AACjE,OAAI,CAAC,MAAM,iBAAiB,WAAW,CACnC,OAAM,IAAI,MAAM,wCAAwC;AAE5D,QAAK,MAAM,aAAa,WACpB,MAAK,cAAc,UAAU;GAEjC,MAAM,iBAAiB,MAAM,QAAQ,+CAA+C,cAAc;AAClG,OAAI,UAAU,WAAW,eAAe,CACpC,MAAK,iBAAiB,eAAe,KAAK,QAAQ,UAAU,GAAG;GAEnE,MAAM,UAAU,MAAM,QAAQ,iCAAiC,cAAc;AAC7E,OAAI,UAAU,WAAW,QAAQ,CAC7B,MAAK,UAAU;;;;;;EAOvB,cAAc,SAAS;GACnB,IAAI,QAAQ,MAAM,aAAa,SAAS,eAAe;AACvD,OAAI,MAAM,WAAW,EACjB,OAAM,IAAI,MAAM,4CAA4C,QAAQ,UAAU,GAAG;GAErF,MAAM,iBAAiB,MAAM;GAC7B,MAAM,OAAO,MAAM,SAAS,gBAAgB,YAAY;AACxD,OAAI,CAAC,KACD,OAAM,IAAI,MAAM,8CAA8C,eAAe,UAAU,GAAG;GAE9F,MAAM,aAAa,KAAK;AACxB,WAAQ,MAAM,aAAa,SAAS,cAAc;AAClD,OAAI,MAAM,WAAW,EACjB,OAAM,IAAI,MAAM,gDAAgD,QAAQ,UAAU,GAAG;AAEzF,OAAI,MAAM,SAAS,EACf,OAAM,IAAI,MAAM,iFAAiF,QAAQ,UAAU,GAAG;GAE1H,MAAM,cAAc,MAAM,GAAG;AAC7B,OAAI,CAAC,YACD,OAAM,IAAI,MAAM,8CAA8C,QAAQ,UAAU,GAAG;GAEvF,MAAM,aAAa,EAAE;GACrB,IAAI,gCAAgC,EAAE;AACtC,WAAQ,MAAM,aAAa,SAAS,aAAa;AACjD,OAAI,MAAM,WAAW,GAAG;IACpB,MAAM,iBAAiB,MAAM;IAC7B,MAAM,gBAAgB,MAAM,aAAa,gBAAgB,YAAY;AACrE,SAAK,MAAM,aAAa,eAAe;KACnC,MAAM,gBAAgB,MAAM,SAAS,WAAW,YAAY;AAC5D,SAAI,cACA,YAAW,KAAK,cAAc,MAAM;;IAI5C,MAAM,sBAAsB,MAAM,aAAa,cAAc,cAAc,SAAS,IAAI,sBAAsB;AAC9G,QAAI,MAAM,iBAAiB,oBAAoB,CAE3C,iCAAgC,oBAC3B,SAAS,eAAe,UAAU,aAAa,aAAa,IAAI,IAAI,MAAM,IAAI,CAAC,CAC/E,QAAQ,UAAU,MAAM,SAAS,EAAE;;AAGhD,OAAI,MAAM,iBAAiB,KAAK,mBAAmB,CAC/C,MAAK,mBAAmB,QAAQ,SAAU,GAAG;AACzC,eAAW,KAAK,EAAE;KACpB;;;;;;;;;;AAWN,OAAI,WAAW,WAAW,KACtB,WAAW,WAAW,SAAS,OAAO,wDACtC,YAAW,KAAK,kDAAkD;GAEtE,MAAM,SAAS,UAAU,cAAc,QAAQ,GACzC,QAAQ,aAAa,MAAM,IAAI,SAC/B;AACN,QAAK,aAAa;IACd;IACA,iBAAiB;IACjB,KAAK;IACL;IACA;IACA,YAAY;IACf,CAAC;;;;;;;;;;;;;EAaN,aAAa,EAAE,gBAAO,YAAY,iBAAiB,MAAM,IAAI,aAAa,gCAAgC,EAAE,EAAE,aAAa,SAAU;AACjI,OAAI,mBAAmB,KACnB,OAAM,IAAI,MAAM,8BAA8B;AAElD,OAAI,CAAC,MAAM,iBAAiB,WAAW,CACnC,OAAM,IAAI,MAAM,2DAA2D;AAE/E,QAAK,WAAW,KAAK;IACjB;IACA;IACA;IACA;IACA;IACA;IACA;IACA,wBAAwB;AACpB,WAAM,IAAI,MAAM,6EAA6E;;IAEpG,CAAC;;;;;EAKN,gBAAgB;AAOZ,UAAO,KAAK;;EAEhB,sBAAsB;AAClB,UAAO,CAAC,GAAG,KAAK,iBAAiB;;EAErC,iBAAiB,KAAK,SAAS,eAAe;GAC1C,IAAI;AACJ,OAAI,OAAO,YAAY,cAAc,iBAAiB,MAAM;AACxD,eAAW;AACX,cAAU,EAAE;UAEX;AACD,eAAW;AACX,cAAW,WAAW,EAAE;;GAE5B,MAAM,MAAM,IAAI,OAAO,WAAW,CAAC,gBAAgB,IAAI;GACvD,IAAI,YAAY;GAChB,MAAM,iBAAiB,EAAE;GACzB,IAAI;GACJ,MAAM,eAAe;IAAC;IAAU;IAAW;IAAU;IAAQ;GAC7D,MAAM,SAAS,QAAQ;GACvB,MAAM,QAAQ,QAAQ,SAAS,EAAE;GACjC,MAAM,WAAW,QAAQ,YAAY,EAAE;GACvC,MAAM,mBAAmB,QAAQ,oBAAoB,EAAE;AACvD,QAAK,oBAAoB,EACrB,oBAAoB,SAAU,UAAQ;AAClC,WAAOA,WAAS,iBAAiBA,YAAU;MAElD;AAED,YAAS,YAAY,SAAS,aAAa;AAE3C,YAAS,SAAS,SAAS,UAAU;AACrC,OAAI,aAAa,QAAQ,SAAS,OAAO,KAAK,IAAI;IAC9C,MAAM,sBAAM,IAAI,MAAM,iDAAiD,SAAS,OAAO,yCAAyC,aAAa,KAAK,KAAK,GAAG;AAC1J,QAAI,CAAC,SACD,OAAM;SAEL;AACD,cAAS,IAAI;AACb;;;AAIR,OAAI,QAAQ;AACR,iBAAa,IAAI;AACjB,oBAAgB,GAAG,OAAO;SAG1B,iBAAgB;AAEpB,UAAO,KAAK,MAAM,CAAC,QAAQ,SAAU,MAAM;AACvC,QAAI,SAAS,WAAW,SAAS,UAC7B,gBAAe,KAAK,GAAG,KAAK,IAAI,MAAM,MAAM,GAAG;KAErD;AAEF,kBAAe,KAAK,GAAG,UAAU,uCAAuC;GACxE,IAAI,eAAe,IAAI,cAAc,YAAY,eAAe,KAAK,IAAI,CAAC;AAC1E,mBAAgB,KAAK,iBAAiB,KAAK,OAAO;AAClD,mBAAgB,KAAK,WAAW,OAAO;AACvC,mBAAgB,KAAK,cAAc;AACnC,QAAK,qBAAqB,IAAI,UAAU;GACxC,IAAI,yBAAyB;AAC7B,UAAO,KAAK,iBAAiB,CAAC,QAAQ,SAAU,KAAK;AACjD,8BAA0B,SAAS,IAAI,IAAI,iBAAiB,KAAK;KACnE;GAGF,MAAM,wBAAwB,UAAU,uBAAuB,GAAG,aAAa;GAI/E,MAAM,eAHU,IAAI,OAAO,WAAW,CAAC,gBAAgB,sBAAsB,CAGhD,gBAAgB;GAC7C,MAAM,gBAAgB,MAAM,QAAQ,SAAS,WAAW,IAAI;AAC5D,OAAI,CAAC,UAAU,WAAW,cAAc,EAAE;IACtC,MAAM,uBAAO,IAAI,MAAM,gEAAgE,SAAS,YAAY;AAC5G,QAAI,CAAC,SACD,OAAM;SAEL;AACD,cAAS,KAAK;AACd;;;AAGR,OAAI,SAAS,WAAW,SACpB,eAAc,YAAY,aAAa;YAElC,SAAS,WAAW,UACzB,eAAc,aAAa,cAAc,cAAc,WAAW;YAE7D,SAAS,WAAW,UAAU;AACnC,QAAI,cAAc,cAAc,KAC5B,OAAM,IAAI,MAAM,yFAAyF;AAE7G,kBAAc,WAAW,aAAa,cAAc,cAAc;cAE7D,SAAS,WAAW,SAAS;AAClC,QAAI,cAAc,cAAc,KAC5B,OAAM,IAAI,MAAM,wFAAwF;AAE5G,kBAAc,WAAW,aAAa,cAAc,cAAc,YAAY;;AAElF,QAAK,gBAAgB;GACrB,MAAM,kBAAkB,MAAM,aAAa,KAAK,eAAe,aAAa;AAC5E,OAAI,gBAAgB,WAAW,GAAG;IAC9B,MAAM,uBAAO,IAAI,MAAM,mDAAmD;AAC1E,QAAI,CAAC,SACD,OAAM;SAEL;AACD,cAAS,KAAK;AACd;;;GAGR,MAAM,iBAAiB,gBAAgB;AACvC,OAAI,OAAO,aAAa,WAEpB,MAAK,wBAAwB,MAAM,KAAK,cAAc;AAClD,QAAI,IACA,UAAS,IAAI;SAEZ;AACD,UAAK,iBAAiB,aAAa;AACnC,kBAAa,aAAa,KAAK,gBAAgB,OAAO,EAAE,eAAe,YAAY;AACnF,UAAK,eAAe,aAAa,UAAU;AAC3C,UAAK,YAAY,IAAI,UAAU;AAC/B,cAAS,MAAM,KAAK;;KAE1B;QAED;AAED,SAAK,wBAAwB,IAAI;AACjC,iBAAa,aAAa,KAAK,gBAAgB,OAAO,EAAE,eAAe,YAAY;AACnF,SAAK,eAAe,aAAa,UAAU;AAC3C,SAAK,YAAY,IAAI,UAAU;;;EAGvC,WAAW,QAAQ;GACf,MAAM,gBAAgB,SAAS,GAAG,OAAO,KAAK;GAC9C,IAAI,eAAe;AACnB,OAAI,KAAK,kBACL,QAAO,KAAK,KAAK,kBAAkB,CAAC,SAAS,SAAS;AAClD,oBAAgB,IAAI,KAAK,IAAI,KAAK,kBAAkB,MAAM;KAC5D;GAEN,MAAM,iBAAiB,KAAK,kBAAkB;IAAE,YAAY,KAAK;IAAY;IAAQ,CAAC;AACtF,OAAI,gBAAgB,eAChB,QAAO,IAAI,cAAc,SAAS,aAAa,GAAG,eAAe,IAAI,cAAc;AAEvF,UAAO;;;;;;EAMX,iBAAiB,KAAK,QAAQ;GAC1B,IAAI,MAAM;AACV,YAAS,UAAU;AACnB,YAAS,SAAS,GAAG,OAAO,KAAK;AAEjC,QAAK,MAAM,OAAO,KAAK,eAAe,EAAE;IACpC,MAAM,QAAQ,MAAM,mBAAmB,IAAI,SAAS,IAAI,KAAK,KAAK,kBAAkB;AACpF,QAAI,CAAC,MAAM,iBAAiB,MAAM,CAC9B,OAAM,IAAI,MAAM,kEAAkE,IAAI,QAAQ;AAElG,SAAK,MAAM,QAAQ,OAAO;AACtB,SAAI,IAAI,WACJ,QAAO,IAAI,OAAO;UAEjB;MACD,MAAM,KAAK,KAAK,YAAY,KAAK;AACjC,UAAI,MAAM;AACV,aAAO,IAAI,OAAO,kBAAkB,GAAG;;AAE3C,YAAO,IAAI,OAAO;AAClB,UAAK,MAAM,SAAS,IAAI,cAAc,EAAE,EAAE;MACtC,MAAM,YAAY,KAAK,8BAA8B,MAAM;AAC3D,aAAO,IAAI,OAAO,uBAAuB,UAAU,kBAAkB,CAAC;AACtE,UAAI,MAAM,iBAAiB,IAAI,8BAA8B,EAAE;AAC3D,cAAO;AACP,cAAO,oCAAoC,IAAI,8BAA8B,KAAK,IAAI,CAAC,WAAW,UAAU,kBAAkB,CAAC;AAC/H,cAAO,KAAK,OAAO;YAGnB,QAAO;;KAGf,MAAM,WAAW,KAAK,qBAAqB,KAAK,KAAK,KAAK;KAC1D,MAAM,kBAAkB,KAAK,kBAAkB,IAAI,gBAAgB;AACnE,YACI,KAAK,OAAO,cACJ,OAAO,0BAA0B,gBAAgB,kBAAkB,CAAC,OACpE,OAAO,cAAc,gBAAgB,QAAQ,SAAS,CAAC,IAAI,OAAO,gBACjE,OAAO;;;AAG5B,UAAO;;EAEX,YAAY,YAAY,MAAM,UAAU,EAAE,EAAE;AACxC,WAAQ,qBAAqB,QAAQ,sBAAsB,UAAU;AACrE,WAAQ,gBAAgB,KAAK;GAE7B,IAAI,iBADa,KAAK,UAAU,KAAK;AAErC,cAAW,SAAS,kBAAkB;AAClC,QAAI,UAAU,WAAW,eAAe,CAGpC,kBADkB,KAAK,8BAA8B,cAAc,CACxC,QAAQ,gBAAgB,QAAQ;KASjE;AACF,UAAO,eAAe,UAAU;;;;;;EAMpC,YAAY,MAAM;GACd,IAAI;AACJ,OAAI,KAAK,WAAW,aAChB,QAAO,MAAM,SAAS,MAAM,MAAM,qFAAqF;OAGvH,MAAK,aAAa,MAAM,gBAAgB;AACpC,WAAO,MAAM,SAAS,MAAM,YAAY;AACxC,WAAO,CAAC,CAAC;KACX;AAEN,OAAI,KACA,QAAO,KAAK;GAGhB,MAAM,KAAK,IAAI,KAAK;AACpB,OAAI,KAAK,WAAW,cAAc;AAC9B,SAAK,eAAe,iCAAiC,aAAa,qFAAqF;AACvJ,SAAK,eAAe,sFAAsF,UAAU,GAAG;SAGvH,MAAK,aAAa,MAAM,GAAG;AAE/B,UAAO;;;;;;EAMX,iBAAiB,KAAK,QAAQ;AAC1B,OAAI,OAAO,KAAK,8BAA8B,SAC1C,OAAM,IAAI,MAAM,8EAA8E;GAElG,MAAM,YAAY,KAAK,8BAA8B,KAAK,0BAA0B;GACpF,MAAM,OAAO,KAAK,uBAAuB,KAAK,mBAAmB;GACjE,IAAI;AACJ,mBAAgB,UAAU;AAC1B,mBAAgB,gBAAgB,GAAG,cAAc,KAAK;GACtD,IAAI,MAAM,IAAI,cAAc;AAC5B,UAAO,IAAI,cAAc,oCAAoC,UAAU,kBAAkB,CAAC;AAC1F,OAAI,MAAM,iBAAiB,KAAK,8BAA8B,EAAE;AAC5D,WAAO;AACP,WAAO,oCAAoC,KAAK,8BAA8B,KAAK,IAAI,CAAC,WAAW,UAAU,kBAAkB,CAAC;AAChI,WAAO,KAAK,cAAc;SAG1B,QAAO;AAEX,UAAO,IAAI,cAAc,6BAA6B,KAAK,kBAAkB,CAAC;AAC9E,UAAO,KAAK,iBAAiB,KAAK,OAAO;AACzC,UAAO,KAAK,cAAc;AAC1B,UAAO;;;;;;EAMX,gBAAgB,QAAQ;GACpB,IAAI,YAAY;AAChB,OAAI,QAAQ;AACR,iBAAa,IAAI;AACjB,cAAU;SAGV,UAAS;GAEb,MAAM,oBAAoB,IAAI,OAAO,iBAAiB,KAAK,eAAe,IAAI,OAAO;GAGrF,MAAM,wBAAwB,IAAI,OAAO,YAAY,UAAU,wCAAwC,kBAAkB,IAAI,OAAO;AAIpI,UAHY,IAAI,OAAO,WAAW,CAAC,gBAAgB,sBAAsB,CAG9D,gBAAgB;;;;;;;EAO/B,kBAAkB;AACd,UAAO,KAAK;;;;;;;EAOhB,wBAAwB;AACpB,UAAO,KAAK;;;;;;;EAOhB,eAAe;AACX,UAAO,KAAK;;;AAGpB,SAAQ,YAAY;AACpB,WAAU,qBAAqB,EAC3B,IAAI,sCACP;AACD,WAAU,aAAa"}

package/dist/cjs/node_modules/xml-crypto/lib/types.cjs

@@ -1,58 +0,0 @@
-const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
-
-//#region ../../node_modules/xml-crypto/lib/types.js
-var require_types = /* @__PURE__ */ require_rolldown_runtime.__commonJS({ "../../node_modules/xml-crypto/lib/types.js": ((exports) => {
-	Object.defineProperty(exports, "__esModule", { value: true });
-	exports.createOptionalCallbackFunction = void 0;
-	/**
-	* ### Sign
-	* #### Properties
-	* - {@link SignedXml#privateKey} [required]
-	* - {@link SignedXml#publicCert} [optional]
-	* - {@link SignedXml#signatureAlgorithm} [optional]
-	* - {@link SignedXml#canonicalizationAlgorithm} [optional]
-	* #### Api
-	*  - {@link SignedXml#addReference}
-	*  - {@link SignedXml#computeSignature}
-	*  - {@link SignedXml#getSignedXml}
-	*  - {@link SignedXml#getSignatureXml}
-	*  - {@link SignedXml#getOriginalXmlWithIds}
-	*
-	* ### Verify
-	* #### Properties
-	* -  {@link SignedXml#publicCert} [optional]
-	* #### Api
-	*  - {@link SignedXml#loadSignature}
-	*  - {@link SignedXml#checkSignature}
-	*/
-	function isErrorFirstCallback(possibleCallback) {
-		return typeof possibleCallback === "function";
-	}
-	/**
-	* This function will add a callback version of a sync function.
-	*
-	* This follows the factory pattern.
-	* Just call this function, passing the function that you'd like to add a callback version of.
-	*/
-	function createOptionalCallbackFunction(syncVersion) {
-		return ((...args) => {
-			const possibleCallback = args[args.length - 1];
-			if (isErrorFirstCallback(possibleCallback)) try {
-				possibleCallback(null, syncVersion(...args.slice(0, -1)));
-			} catch (err) {
-				possibleCallback(err instanceof Error ? err : /* @__PURE__ */ new Error("Unknown error"));
-			}
-			else return syncVersion(...args);
-		});
-	}
-	exports.createOptionalCallbackFunction = createOptionalCallbackFunction;
-}) });
-
-//#endregion
-Object.defineProperty(exports, 'default', {
-  enumerable: true,
-  get: function () {
-    return require_types();
-  }
-});
-//# sourceMappingURL=types.cjs.map

package/dist/cjs/node_modules/xml-crypto/lib/types.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.cjs","names":[],"sources":["../../../../../../../node_modules/xml-crypto/lib/types.js"],"sourcesContent":["\"use strict\";\n/* eslint-disable no-unused-vars */\n// Type definitions for @node-saml/xml-crypto\n// Project: https://github.com/node-saml/xml-crypto#readme\n// Original definitions by: Eric Heikes <https://github.com/eheikes>\n//                          Max Chehab <https://github.com/maxchehab>\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.createOptionalCallbackFunction = void 0;\n/**\n * ### Sign\n * #### Properties\n * - {@link SignedXml#privateKey} [required]\n * - {@link SignedXml#publicCert} [optional]\n * - {@link SignedXml#signatureAlgorithm} [optional]\n * - {@link SignedXml#canonicalizationAlgorithm} [optional]\n * #### Api\n *  - {@link SignedXml#addReference}\n *  - {@link SignedXml#computeSignature}\n *  - {@link SignedXml#getSignedXml}\n *  - {@link SignedXml#getSignatureXml}\n *  - {@link SignedXml#getOriginalXmlWithIds}\n *\n * ### Verify\n * #### Properties\n * -  {@link SignedXml#publicCert} [optional]\n * #### Api\n *  - {@link SignedXml#loadSignature}\n *  - {@link SignedXml#checkSignature}\n */\nfunction isErrorFirstCallback(possibleCallback) {\n    return typeof possibleCallback === \"function\";\n}\n/**\n * This function will add a callback version of a sync function.\n *\n * This follows the factory pattern.\n * Just call this function, passing the function that you'd like to add a callback version of.\n */\nfunction createOptionalCallbackFunction(syncVersion) {\n    return ((...args) => {\n        const possibleCallback = args[args.length - 1];\n        if (isErrorFirstCallback(possibleCallback)) {\n            try {\n                const result = syncVersion(...args.slice(0, -1));\n                possibleCallback(null, result);\n            }\n            catch (err) {\n                possibleCallback(err instanceof Error ? err : new Error(\"Unknown error\"));\n            }\n        }\n        else {\n            return syncVersion(...args);\n        }\n    });\n}\nexports.createOptionalCallbackFunction = createOptionalCallbackFunction;\n//# sourceMappingURL=types.js.map"],"x_google_ignoreList":[0],"mappings":";;;;AAMA,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,iCAAiC,KAAK;;;;;;;;;;;;;;;;;;;;;;CAsB9C,SAAS,qBAAqB,kBAAkB;AAC5C,SAAO,OAAO,qBAAqB;;;;;;;;CAQvC,SAAS,+BAA+B,aAAa;AACjD,WAAS,GAAG,SAAS;GACjB,MAAM,mBAAmB,KAAK,KAAK,SAAS;AAC5C,OAAI,qBAAqB,iBAAiB,CACtC,KAAI;AAEA,qBAAiB,MADF,YAAY,GAAG,KAAK,MAAM,GAAG,GAAG,CAAC,CAClB;YAE3B,KAAK;AACR,qBAAiB,eAAe,QAAQ,sBAAM,IAAI,MAAM,gBAAgB,CAAC;;OAI7E,QAAO,YAAY,GAAG,KAAK;;;AAIvC,SAAQ,iCAAiC"}

package/dist/cjs/node_modules/xml-crypto/lib/utils.cjs

@@ -1,213 +0,0 @@
-const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
-const require_xpath$1 = require('../node_modules/xpath/xpath.cjs');
-const require_index = require('../../@xmldom/is-dom-node/dist/index.cjs');
-
-//#region ../../node_modules/xml-crypto/lib/utils.js
-var require_utils = /* @__PURE__ */ require_rolldown_runtime.__commonJS({ "../../node_modules/xml-crypto/lib/utils.js": ((exports) => {
-	Object.defineProperty(exports, "__esModule", { value: true });
-	exports.validateDigestValue = exports.findAncestorNs = exports.derToPem = exports.pemToDer = exports.normalizePem = exports.BASE64_REGEX = exports.EXTRACT_X509_CERTS = exports.PEM_FORMAT_REGEX = exports.encodeSpecialCharactersInText = exports.encodeSpecialCharactersInAttribute = exports.findChilds = exports.findChildren = exports.findAttr = exports.isArrayHasLength = void 0;
-	const xpath = require_xpath$1.default;
-	const isDomNode = require_index.default;
-	function isArrayHasLength(array) {
-		return Array.isArray(array) && array.length > 0;
-	}
-	exports.isArrayHasLength = isArrayHasLength;
-	function attrEqualsExplicitly(attr, localName, namespace) {
-		return attr.localName === localName && (attr.namespaceURI === namespace || namespace == null);
-	}
-	function attrEqualsImplicitly(attr, localName, namespace, node) {
-		return attr.localName === localName && (!attr.namespaceURI && node?.namespaceURI === namespace || namespace == null);
-	}
-	function findAttr(element, localName, namespace) {
-		for (let i = 0; i < element.attributes.length; i++) {
-			const attr = element.attributes[i];
-			if (attrEqualsExplicitly(attr, localName, namespace) || attrEqualsImplicitly(attr, localName, namespace, element)) return attr;
-		}
-		return null;
-	}
-	exports.findAttr = findAttr;
-	function findChildren(node, localName, namespace) {
-		const element = node.documentElement ?? node;
-		const res = [];
-		for (let i = 0; i < element.childNodes.length; i++) {
-			const child = element.childNodes[i];
-			if (isDomNode.isElementNode(child) && child.localName === localName && (child.namespaceURI === namespace || namespace == null)) res.push(child);
-		}
-		return res;
-	}
-	exports.findChildren = findChildren;
-	/** @deprecated */
-	function findChilds(node, localName, namespace) {
-		return findChildren(node, localName, namespace);
-	}
-	exports.findChilds = findChilds;
-	const xml_special_to_encoded_attribute = {
-		"&": "&amp;",
-		"<": "&lt;",
-		"\"": "&quot;",
-		"\r": "&#xD;",
-		"\n": "&#xA;",
-		"	": "&#x9;"
-	};
-	const xml_special_to_encoded_text = {
-		"&": "&amp;",
-		"<": "&lt;",
-		">": "&gt;",
-		"\r": "&#xD;"
-	};
-	function encodeSpecialCharactersInAttribute(attributeValue) {
-		return attributeValue.replace(/([&<"\r\n\t])/g, function(str, item) {
-			/** Special character normalization.
-			* @see:
-			* - https://www.w3.org/TR/xml-c14n#ProcessingModel (Attribute Nodes)
-			* - https://www.w3.org/TR/xml-c14n#Example-Chars
-			*/
-			return xml_special_to_encoded_attribute[item];
-		});
-	}
-	exports.encodeSpecialCharactersInAttribute = encodeSpecialCharactersInAttribute;
-	function encodeSpecialCharactersInText(text) {
-		return text.replace(/([&<>\r])/g, function(str, item) {
-			/** Special character normalization.
-			* @see:
-			* - https://www.w3.org/TR/xml-c14n#ProcessingModel (Text Nodes)
-			* - https://www.w3.org/TR/xml-c14n#Example-Chars
-			*/
-			return xml_special_to_encoded_text[item];
-		});
-	}
-	exports.encodeSpecialCharactersInText = encodeSpecialCharactersInText;
-	/**
-	* PEM format has wide range of usages, but this library
-	* is enforcing RFC7468 which focuses on PKIX, PKCS and CMS.
-	*
-	* https://www.rfc-editor.org/rfc/rfc7468
-	*
-	* PEM_FORMAT_REGEX is validating given PEM file against RFC7468 'stricttextualmsg' definition.
-	*
-	* With few exceptions;
-	*  - 'posteb' MAY have 'eol', but it is not mandatory.
-	*  - 'preeb' and 'posteb' lines are limited to 64 characters, but
-	*     should not cause any issues in context of PKIX, PKCS and CMS.
-	*/
-	exports.PEM_FORMAT_REGEX = new RegExp("^-----BEGIN [A-Z ]{1,48}-----([^-]*)-----END [A-Z ]{1,48}-----$", "s");
-	exports.EXTRACT_X509_CERTS = new RegExp("-----BEGIN CERTIFICATE-----[^-]*-----END CERTIFICATE-----", "g");
-	exports.BASE64_REGEX = new RegExp("^(?:[A-Za-z0-9\\+\\/]{4}\\n{0,1})*(?:[A-Za-z0-9\\+\\/]{2}==|[A-Za-z0-9\\+\\/]{3}=)?$", "s");
-	/**
-	* -----BEGIN [LABEL]-----
-	* base64([DATA])
-	* -----END [LABEL]-----
-	*
-	* Above is shown what PEM file looks like. As can be seen, base64 data
-	* can be in single line or multiple lines.
-	*
-	* This function normalizes PEM presentation to;
-	*  - contain PEM header and footer as they are given
-	*  - normalize line endings to '\n'
-	*  - normalize line length to maximum of 64 characters
-	*  - ensure that 'preeb' has line ending '\n'
-	*
-	* With a couple of notes:
-	*  - 'eol' is normalized to '\n'
-	*
-	* @param pem The PEM string to normalize to RFC7468 'stricttextualmsg' definition
-	*/
-	function normalizePem(pem) {
-		return `${(pem.trim().replace(/(\r\n|\r)/g, "\n").match(/.{1,64}/g) ?? []).join("\n")}\n`;
-	}
-	exports.normalizePem = normalizePem;
-	/**
-	* @param pem The PEM-encoded base64 certificate to strip headers from
-	*/
-	function pemToDer(pem) {
-		if (!exports.PEM_FORMAT_REGEX.test(pem.trim())) throw new Error("Invalid PEM format.");
-		return Buffer.from(pem.replace(/(\r\n|\r)/g, "").replace(/-----BEGIN [A-Z\x20]{1,48}-----\n?/, "").replace(/-----END [A-Z\x20]{1,48}-----\n?/, ""), "base64");
-	}
-	exports.pemToDer = pemToDer;
-	/**
-	* @param der The DER-encoded base64 certificate to add PEM headers too
-	* @param pemLabel The label of the header and footer to add
-	*/
-	function derToPem(der, pemLabel) {
-		const base64Der = Buffer.isBuffer(der) ? der.toString("base64").trim() : der.replace(/(\r\n|\r)/g, "").trim();
-		if (exports.PEM_FORMAT_REGEX.test(base64Der)) return normalizePem(base64Der);
-		if (exports.BASE64_REGEX.test(base64Der.replace(/ /g, ""))) {
-			if (pemLabel == null) throw new Error("PEM label is required when DER is given.");
-			return normalizePem(`-----BEGIN ${pemLabel}-----\n${base64Der.replace(/ /g, "")}\n-----END ${pemLabel}-----`);
-		}
-		throw new Error("Unknown DER format.");
-	}
-	exports.derToPem = derToPem;
-	function collectAncestorNamespaces(node, nsArray = []) {
-		if (!isDomNode.isElementNode(node.parentNode)) return nsArray;
-		const parent = node.parentNode;
-		if (!parent) return nsArray;
-		if (parent.attributes && parent.attributes.length > 0) for (let i = 0; i < parent.attributes.length; i++) {
-			const attr = parent.attributes[i];
-			if (attr && attr.nodeName && attr.nodeName.search(/^xmlns:?/) !== -1) nsArray.push({
-				prefix: attr.nodeName.replace(/^xmlns:?/, ""),
-				namespaceURI: attr.nodeValue || ""
-			});
-		}
-		return collectAncestorNamespaces(parent, nsArray);
-	}
-	function findNSPrefix(subset) {
-		const subsetAttributes = subset.attributes;
-		for (let k = 0; k < subsetAttributes.length; k++) {
-			const nodeName = subsetAttributes[k].nodeName;
-			if (nodeName.search(/^xmlns:?/) !== -1) return nodeName.replace(/^xmlns:?/, "");
-		}
-		return subset.prefix || "";
-	}
-	function isElementSubset(docSubset) {
-		return docSubset.every((node) => isDomNode.isElementNode(node));
-	}
-	/**
-	* Extract ancestor namespaces in order to import it to root of document subset
-	* which is being canonicalized for non-exclusive c14n.
-	*
-	* @param doc - Usually a product from `new xmldom.DOMParser().parseFromString()`
-	* @param docSubsetXpath - xpath query to get document subset being canonicalized
-	* @param namespaceResolver - xpath namespace resolver
-	* @returns i.e. [{prefix: "saml", namespaceURI: "urn:oasis:names:tc:SAML:2.0:assertion"}]
-	*/
-	function findAncestorNs(doc, docSubsetXpath, namespaceResolver) {
-		if (docSubsetXpath == null) return [];
-		const docSubset = xpath.selectWithResolver(docSubsetXpath, doc, namespaceResolver);
-		if (!isArrayHasLength(docSubset)) return [];
-		if (!isElementSubset(docSubset)) throw new Error("Document subset must be list of elements");
-		const ancestorNs = collectAncestorNamespaces(docSubset[0]);
-		const ancestorNsWithoutDuplicate = [];
-		for (let i = 0; i < ancestorNs.length; i++) {
-			let notOnTheList = true;
-			for (const v in ancestorNsWithoutDuplicate) if (ancestorNsWithoutDuplicate[v].prefix === ancestorNs[i].prefix) {
-				notOnTheList = false;
-				break;
-			}
-			if (notOnTheList) ancestorNsWithoutDuplicate.push(ancestorNs[i]);
-		}
-		const returningNs = [];
-		const subsetNsPrefix = findNSPrefix(docSubset[0]);
-		for (const ancestorNs$1 of ancestorNsWithoutDuplicate) if (ancestorNs$1.prefix !== subsetNsPrefix) returningNs.push(ancestorNs$1);
-		return returningNs;
-	}
-	exports.findAncestorNs = findAncestorNs;
-	function validateDigestValue(digest, expectedDigest) {
-		const buffer = Buffer.from(digest, "base64");
-		const expectedBuffer = Buffer.from(expectedDigest, "base64");
-		if (typeof buffer.equals === "function") return buffer.equals(expectedBuffer);
-		if (buffer.length !== expectedBuffer.length) return false;
-		for (let i = 0; i < buffer.length; i++) if (buffer[i] !== expectedBuffer[i]) return false;
-		return true;
-	}
-	exports.validateDigestValue = validateDigestValue;
-}) });
-
-//#endregion
-Object.defineProperty(exports, 'default', {
-  enumerable: true,
-  get: function () {
-    return require_utils();
-  }
-});
-//# sourceMappingURL=utils.cjs.map

package/dist/cjs/node_modules/xml-crypto/lib/utils.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"utils.cjs","names":["ancestorNs"],"sources":["../../../../../../../node_modules/xml-crypto/lib/utils.js"],"sourcesContent":["\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.validateDigestValue = exports.findAncestorNs = exports.derToPem = exports.pemToDer = exports.normalizePem = exports.BASE64_REGEX = exports.EXTRACT_X509_CERTS = exports.PEM_FORMAT_REGEX = exports.encodeSpecialCharactersInText = exports.encodeSpecialCharactersInAttribute = exports.findChilds = exports.findChildren = exports.findAttr = exports.isArrayHasLength = void 0;\nconst xpath = require(\"xpath\");\nconst isDomNode = require(\"@xmldom/is-dom-node\");\nfunction isArrayHasLength(array) {\n    return Array.isArray(array) && array.length > 0;\n}\nexports.isArrayHasLength = isArrayHasLength;\nfunction attrEqualsExplicitly(attr, localName, namespace) {\n    return attr.localName === localName && (attr.namespaceURI === namespace || namespace == null);\n}\nfunction attrEqualsImplicitly(attr, localName, namespace, node) {\n    return (attr.localName === localName &&\n        ((!attr.namespaceURI && node?.namespaceURI === namespace) || namespace == null));\n}\nfunction findAttr(element, localName, namespace) {\n    for (let i = 0; i < element.attributes.length; i++) {\n        const attr = element.attributes[i];\n        if (attrEqualsExplicitly(attr, localName, namespace) ||\n            attrEqualsImplicitly(attr, localName, namespace, element)) {\n            return attr;\n        }\n    }\n    return null;\n}\nexports.findAttr = findAttr;\nfunction findChildren(node, localName, namespace) {\n    const element = node.documentElement ?? node;\n    const res = [];\n    for (let i = 0; i < element.childNodes.length; i++) {\n        const child = element.childNodes[i];\n        if (isDomNode.isElementNode(child) &&\n            child.localName === localName &&\n            (child.namespaceURI === namespace || namespace == null)) {\n            res.push(child);\n        }\n    }\n    return res;\n}\nexports.findChildren = findChildren;\n/** @deprecated */\nfunction findChilds(node, localName, namespace) {\n    return findChildren(node, localName, namespace);\n}\nexports.findChilds = findChilds;\nconst xml_special_to_encoded_attribute = {\n    \"&\": \"&amp;\",\n    \"<\": \"&lt;\",\n    '\"': \"&quot;\",\n    \"\\r\": \"&#xD;\",\n    \"\\n\": \"&#xA;\",\n    \"\\t\": \"&#x9;\",\n};\nconst xml_special_to_encoded_text = {\n    \"&\": \"&amp;\",\n    \"<\": \"&lt;\",\n    \">\": \"&gt;\",\n    \"\\r\": \"&#xD;\",\n};\nfunction encodeSpecialCharactersInAttribute(attributeValue) {\n    return attributeValue.replace(/([&<\"\\r\\n\\t])/g, function (str, item) {\n        /** Special character normalization.\n         * @see:\n         * - https://www.w3.org/TR/xml-c14n#ProcessingModel (Attribute Nodes)\n         * - https://www.w3.org/TR/xml-c14n#Example-Chars\n         */\n        return xml_special_to_encoded_attribute[item];\n    });\n}\nexports.encodeSpecialCharactersInAttribute = encodeSpecialCharactersInAttribute;\nfunction encodeSpecialCharactersInText(text) {\n    return text.replace(/([&<>\\r])/g, function (str, item) {\n        /** Special character normalization.\n         * @see:\n         * - https://www.w3.org/TR/xml-c14n#ProcessingModel (Text Nodes)\n         * - https://www.w3.org/TR/xml-c14n#Example-Chars\n         */\n        return xml_special_to_encoded_text[item];\n    });\n}\nexports.encodeSpecialCharactersInText = encodeSpecialCharactersInText;\n/**\n * PEM format has wide range of usages, but this library\n * is enforcing RFC7468 which focuses on PKIX, PKCS and CMS.\n *\n * https://www.rfc-editor.org/rfc/rfc7468\n *\n * PEM_FORMAT_REGEX is validating given PEM file against RFC7468 'stricttextualmsg' definition.\n *\n * With few exceptions;\n *  - 'posteb' MAY have 'eol', but it is not mandatory.\n *  - 'preeb' and 'posteb' lines are limited to 64 characters, but\n *     should not cause any issues in context of PKIX, PKCS and CMS.\n */\nexports.PEM_FORMAT_REGEX = new RegExp(\"^-----BEGIN [A-Z\\x20]{1,48}-----([^-]*)-----END [A-Z\\x20]{1,48}-----$\", \"s\");\nexports.EXTRACT_X509_CERTS = new RegExp(\"-----BEGIN CERTIFICATE-----[^-]*-----END CERTIFICATE-----\", \"g\");\nexports.BASE64_REGEX = new RegExp(\"^(?:[A-Za-z0-9\\\\+\\\\/]{4}\\\\n{0,1})*(?:[A-Za-z0-9\\\\+\\\\/]{2}==|[A-Za-z0-9\\\\+\\\\/]{3}=)?$\", \"s\");\n/**\n * -----BEGIN [LABEL]-----\n * base64([DATA])\n * -----END [LABEL]-----\n *\n * Above is shown what PEM file looks like. As can be seen, base64 data\n * can be in single line or multiple lines.\n *\n * This function normalizes PEM presentation to;\n *  - contain PEM header and footer as they are given\n *  - normalize line endings to '\\n'\n *  - normalize line length to maximum of 64 characters\n *  - ensure that 'preeb' has line ending '\\n'\n *\n * With a couple of notes:\n *  - 'eol' is normalized to '\\n'\n *\n * @param pem The PEM string to normalize to RFC7468 'stricttextualmsg' definition\n */\nfunction normalizePem(pem) {\n    return `${(pem\n        .trim()\n        .replace(/(\\r\\n|\\r)/g, \"\\n\")\n        .match(/.{1,64}/g) ?? []).join(\"\\n\")}\\n`;\n}\nexports.normalizePem = normalizePem;\n/**\n * @param pem The PEM-encoded base64 certificate to strip headers from\n */\nfunction pemToDer(pem) {\n    if (!exports.PEM_FORMAT_REGEX.test(pem.trim())) {\n        throw new Error(\"Invalid PEM format.\");\n    }\n    return Buffer.from(pem\n        .replace(/(\\r\\n|\\r)/g, \"\")\n        .replace(/-----BEGIN [A-Z\\x20]{1,48}-----\\n?/, \"\")\n        .replace(/-----END [A-Z\\x20]{1,48}-----\\n?/, \"\"), \"base64\");\n}\nexports.pemToDer = pemToDer;\n/**\n * @param der The DER-encoded base64 certificate to add PEM headers too\n * @param pemLabel The label of the header and footer to add\n */\nfunction derToPem(der, pemLabel) {\n    const base64Der = Buffer.isBuffer(der)\n        ? der.toString(\"base64\").trim()\n        : der.replace(/(\\r\\n|\\r)/g, \"\").trim();\n    if (exports.PEM_FORMAT_REGEX.test(base64Der)) {\n        return normalizePem(base64Der);\n    }\n    if (exports.BASE64_REGEX.test(base64Der.replace(/ /g, \"\"))) {\n        if (pemLabel == null) {\n            throw new Error(\"PEM label is required when DER is given.\");\n        }\n        const pem = `-----BEGIN ${pemLabel}-----\\n${base64Der.replace(/ /g, \"\")}\\n-----END ${pemLabel}-----`;\n        return normalizePem(pem);\n    }\n    throw new Error(\"Unknown DER format.\");\n}\nexports.derToPem = derToPem;\nfunction collectAncestorNamespaces(node, nsArray = []) {\n    if (!isDomNode.isElementNode(node.parentNode)) {\n        return nsArray;\n    }\n    const parent = node.parentNode;\n    if (!parent) {\n        return nsArray;\n    }\n    if (parent.attributes && parent.attributes.length > 0) {\n        for (let i = 0; i < parent.attributes.length; i++) {\n            const attr = parent.attributes[i];\n            if (attr && attr.nodeName && attr.nodeName.search(/^xmlns:?/) !== -1) {\n                nsArray.push({\n                    prefix: attr.nodeName.replace(/^xmlns:?/, \"\"),\n                    namespaceURI: attr.nodeValue || \"\",\n                });\n            }\n        }\n    }\n    return collectAncestorNamespaces(parent, nsArray);\n}\nfunction findNSPrefix(subset) {\n    const subsetAttributes = subset.attributes;\n    for (let k = 0; k < subsetAttributes.length; k++) {\n        const nodeName = subsetAttributes[k].nodeName;\n        if (nodeName.search(/^xmlns:?/) !== -1) {\n            return nodeName.replace(/^xmlns:?/, \"\");\n        }\n    }\n    return subset.prefix || \"\";\n}\nfunction isElementSubset(docSubset) {\n    return docSubset.every((node) => isDomNode.isElementNode(node));\n}\n/**\n * Extract ancestor namespaces in order to import it to root of document subset\n * which is being canonicalized for non-exclusive c14n.\n *\n * @param doc - Usually a product from `new xmldom.DOMParser().parseFromString()`\n * @param docSubsetXpath - xpath query to get document subset being canonicalized\n * @param namespaceResolver - xpath namespace resolver\n * @returns i.e. [{prefix: \"saml\", namespaceURI: \"urn:oasis:names:tc:SAML:2.0:assertion\"}]\n */\nfunction findAncestorNs(doc, docSubsetXpath, namespaceResolver) {\n    if (docSubsetXpath == null) {\n        return [];\n    }\n    const docSubset = xpath.selectWithResolver(docSubsetXpath, doc, namespaceResolver);\n    if (!isArrayHasLength(docSubset)) {\n        return [];\n    }\n    if (!isElementSubset(docSubset)) {\n        throw new Error(\"Document subset must be list of elements\");\n    }\n    // Remove duplicate on ancestor namespace\n    const ancestorNs = collectAncestorNamespaces(docSubset[0]);\n    const ancestorNsWithoutDuplicate = [];\n    for (let i = 0; i < ancestorNs.length; i++) {\n        let notOnTheList = true;\n        for (const v in ancestorNsWithoutDuplicate) {\n            if (ancestorNsWithoutDuplicate[v].prefix === ancestorNs[i].prefix) {\n                notOnTheList = false;\n                break;\n            }\n        }\n        if (notOnTheList) {\n            ancestorNsWithoutDuplicate.push(ancestorNs[i]);\n        }\n    }\n    // Remove namespaces which are already declared in the subset with the same prefix\n    const returningNs = [];\n    const subsetNsPrefix = findNSPrefix(docSubset[0]);\n    for (const ancestorNs of ancestorNsWithoutDuplicate) {\n        if (ancestorNs.prefix !== subsetNsPrefix) {\n            returningNs.push(ancestorNs);\n        }\n    }\n    return returningNs;\n}\nexports.findAncestorNs = findAncestorNs;\nfunction validateDigestValue(digest, expectedDigest) {\n    const buffer = Buffer.from(digest, \"base64\");\n    const expectedBuffer = Buffer.from(expectedDigest, \"base64\");\n    if (typeof buffer.equals === \"function\") {\n        return buffer.equals(expectedBuffer);\n    }\n    if (buffer.length !== expectedBuffer.length) {\n        return false;\n    }\n    for (let i = 0; i < buffer.length; i++) {\n        if (buffer[i] !== expectedBuffer[i]) {\n            return false;\n        }\n    }\n    return true;\n}\nexports.validateDigestValue = validateDigestValue;\n//# sourceMappingURL=utils.js.map"],"x_google_ignoreList":[0],"mappings":";;;;;;AACA,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,sBAAsB,QAAQ,iBAAiB,QAAQ,WAAW,QAAQ,WAAW,QAAQ,eAAe,QAAQ,eAAe,QAAQ,qBAAqB,QAAQ,mBAAmB,QAAQ,gCAAgC,QAAQ,qCAAqC,QAAQ,aAAa,QAAQ,eAAe,QAAQ,WAAW,QAAQ,mBAAmB,KAAK;CACvX,MAAM;CACN,MAAM;CACN,SAAS,iBAAiB,OAAO;AAC7B,SAAO,MAAM,QAAQ,MAAM,IAAI,MAAM,SAAS;;AAElD,SAAQ,mBAAmB;CAC3B,SAAS,qBAAqB,MAAM,WAAW,WAAW;AACtD,SAAO,KAAK,cAAc,cAAc,KAAK,iBAAiB,aAAa,aAAa;;CAE5F,SAAS,qBAAqB,MAAM,WAAW,WAAW,MAAM;AAC5D,SAAQ,KAAK,cAAc,cACrB,CAAC,KAAK,gBAAgB,MAAM,iBAAiB,aAAc,aAAa;;CAElF,SAAS,SAAS,SAAS,WAAW,WAAW;AAC7C,OAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,WAAW,QAAQ,KAAK;GAChD,MAAM,OAAO,QAAQ,WAAW;AAChC,OAAI,qBAAqB,MAAM,WAAW,UAAU,IAChD,qBAAqB,MAAM,WAAW,WAAW,QAAQ,CACzD,QAAO;;AAGf,SAAO;;AAEX,SAAQ,WAAW;CACnB,SAAS,aAAa,MAAM,WAAW,WAAW;EAC9C,MAAM,UAAU,KAAK,mBAAmB;EACxC,MAAM,MAAM,EAAE;AACd,OAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,WAAW,QAAQ,KAAK;GAChD,MAAM,QAAQ,QAAQ,WAAW;AACjC,OAAI,UAAU,cAAc,MAAM,IAC9B,MAAM,cAAc,cACnB,MAAM,iBAAiB,aAAa,aAAa,MAClD,KAAI,KAAK,MAAM;;AAGvB,SAAO;;AAEX,SAAQ,eAAe;;CAEvB,SAAS,WAAW,MAAM,WAAW,WAAW;AAC5C,SAAO,aAAa,MAAM,WAAW,UAAU;;AAEnD,SAAQ,aAAa;CACrB,MAAM,mCAAmC;EACrC,KAAK;EACL,KAAK;EACL,MAAK;EACL,MAAM;EACN,MAAM;EACN,KAAM;EACT;CACD,MAAM,8BAA8B;EAChC,KAAK;EACL,KAAK;EACL,KAAK;EACL,MAAM;EACT;CACD,SAAS,mCAAmC,gBAAgB;AACxD,SAAO,eAAe,QAAQ,kBAAkB,SAAU,KAAK,MAAM;;;;;;AAMjE,UAAO,iCAAiC;IAC1C;;AAEN,SAAQ,qCAAqC;CAC7C,SAAS,8BAA8B,MAAM;AACzC,SAAO,KAAK,QAAQ,cAAc,SAAU,KAAK,MAAM;;;;;;AAMnD,UAAO,4BAA4B;IACrC;;AAEN,SAAQ,gCAAgC;;;;;;;;;;;;;;AAcxC,SAAQ,mBAAmB,IAAI,OAAO,mEAAyE,IAAI;AACnH,SAAQ,qBAAqB,IAAI,OAAO,6DAA6D,IAAI;AACzG,SAAQ,eAAe,IAAI,OAAO,wFAAwF,IAAI;;;;;;;;;;;;;;;;;;;;CAoB9H,SAAS,aAAa,KAAK;AACvB,SAAO,IAAI,IACN,MAAM,CACN,QAAQ,cAAc,KAAK,CAC3B,MAAM,WAAW,IAAI,EAAE,EAAE,KAAK,KAAK,CAAC;;AAE7C,SAAQ,eAAe;;;;CAIvB,SAAS,SAAS,KAAK;AACnB,MAAI,CAAC,QAAQ,iBAAiB,KAAK,IAAI,MAAM,CAAC,CAC1C,OAAM,IAAI,MAAM,sBAAsB;AAE1C,SAAO,OAAO,KAAK,IACd,QAAQ,cAAc,GAAG,CACzB,QAAQ,sCAAsC,GAAG,CACjD,QAAQ,oCAAoC,GAAG,EAAE,SAAS;;AAEnE,SAAQ,WAAW;;;;;CAKnB,SAAS,SAAS,KAAK,UAAU;EAC7B,MAAM,YAAY,OAAO,SAAS,IAAI,GAChC,IAAI,SAAS,SAAS,CAAC,MAAM,GAC7B,IAAI,QAAQ,cAAc,GAAG,CAAC,MAAM;AAC1C,MAAI,QAAQ,iBAAiB,KAAK,UAAU,CACxC,QAAO,aAAa,UAAU;AAElC,MAAI,QAAQ,aAAa,KAAK,UAAU,QAAQ,MAAM,GAAG,CAAC,EAAE;AACxD,OAAI,YAAY,KACZ,OAAM,IAAI,MAAM,2CAA2C;AAG/D,UAAO,aADK,cAAc,SAAS,SAAS,UAAU,QAAQ,MAAM,GAAG,CAAC,aAAa,SAAS,OACtE;;AAE5B,QAAM,IAAI,MAAM,sBAAsB;;AAE1C,SAAQ,WAAW;CACnB,SAAS,0BAA0B,MAAM,UAAU,EAAE,EAAE;AACnD,MAAI,CAAC,UAAU,cAAc,KAAK,WAAW,CACzC,QAAO;EAEX,MAAM,SAAS,KAAK;AACpB,MAAI,CAAC,OACD,QAAO;AAEX,MAAI,OAAO,cAAc,OAAO,WAAW,SAAS,EAChD,MAAK,IAAI,IAAI,GAAG,IAAI,OAAO,WAAW,QAAQ,KAAK;GAC/C,MAAM,OAAO,OAAO,WAAW;AAC/B,OAAI,QAAQ,KAAK,YAAY,KAAK,SAAS,OAAO,WAAW,KAAK,GAC9D,SAAQ,KAAK;IACT,QAAQ,KAAK,SAAS,QAAQ,YAAY,GAAG;IAC7C,cAAc,KAAK,aAAa;IACnC,CAAC;;AAId,SAAO,0BAA0B,QAAQ,QAAQ;;CAErD,SAAS,aAAa,QAAQ;EAC1B,MAAM,mBAAmB,OAAO;AAChC,OAAK,IAAI,IAAI,GAAG,IAAI,iBAAiB,QAAQ,KAAK;GAC9C,MAAM,WAAW,iBAAiB,GAAG;AACrC,OAAI,SAAS,OAAO,WAAW,KAAK,GAChC,QAAO,SAAS,QAAQ,YAAY,GAAG;;AAG/C,SAAO,OAAO,UAAU;;CAE5B,SAAS,gBAAgB,WAAW;AAChC,SAAO,UAAU,OAAO,SAAS,UAAU,cAAc,KAAK,CAAC;;;;;;;;;;;CAWnE,SAAS,eAAe,KAAK,gBAAgB,mBAAmB;AAC5D,MAAI,kBAAkB,KAClB,QAAO,EAAE;EAEb,MAAM,YAAY,MAAM,mBAAmB,gBAAgB,KAAK,kBAAkB;AAClF,MAAI,CAAC,iBAAiB,UAAU,CAC5B,QAAO,EAAE;AAEb,MAAI,CAAC,gBAAgB,UAAU,CAC3B,OAAM,IAAI,MAAM,2CAA2C;EAG/D,MAAM,aAAa,0BAA0B,UAAU,GAAG;EAC1D,MAAM,6BAA6B,EAAE;AACrC,OAAK,IAAI,IAAI,GAAG,IAAI,WAAW,QAAQ,KAAK;GACxC,IAAI,eAAe;AACnB,QAAK,MAAM,KAAK,2BACZ,KAAI,2BAA2B,GAAG,WAAW,WAAW,GAAG,QAAQ;AAC/D,mBAAe;AACf;;AAGR,OAAI,aACA,4BAA2B,KAAK,WAAW,GAAG;;EAItD,MAAM,cAAc,EAAE;EACtB,MAAM,iBAAiB,aAAa,UAAU,GAAG;AACjD,OAAK,MAAMA,gBAAc,2BACrB,KAAIA,aAAW,WAAW,eACtB,aAAY,KAAKA,aAAW;AAGpC,SAAO;;AAEX,SAAQ,iBAAiB;CACzB,SAAS,oBAAoB,QAAQ,gBAAgB;EACjD,MAAM,SAAS,OAAO,KAAK,QAAQ,SAAS;EAC5C,MAAM,iBAAiB,OAAO,KAAK,gBAAgB,SAAS;AAC5D,MAAI,OAAO,OAAO,WAAW,WACzB,QAAO,OAAO,OAAO,eAAe;AAExC,MAAI,OAAO,WAAW,eAAe,OACjC,QAAO;AAEX,OAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,IAC/B,KAAI,OAAO,OAAO,eAAe,GAC7B,QAAO;AAGf,SAAO;;AAEX,SAAQ,sBAAsB"}