@nexart/cli 0.15.1 → 0.16.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +99 -0
- package/README.md +184 -31
- package/dist/index.d.ts +49 -14
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +557 -70
- package/dist/index.js.map +1 -1
- package/dist/standaloneVerify.d.ts +18 -2
- package/dist/standaloneVerify.d.ts.map +1 -1
- package/dist/standaloneVerify.js +40 -1
- package/dist/standaloneVerify.js.map +1 -1
- package/dist/trustRoots.d.ts +6 -0
- package/dist/trustRoots.d.ts.map +1 -0
- package/dist/trustRoots.js +84 -0
- package/dist/trustRoots.js.map +1 -0
- package/dist/tsaVerify.d.ts.map +1 -1
- package/dist/tsaVerify.js +58 -4
- package/dist/tsaVerify.js.map +1 -1
- package/package.json +1 -1
|
@@ -0,0 +1,84 @@
|
|
|
1
|
+
// ─────────────────────────────────────────────────────────────────────────────
|
|
2
|
+
// trustRoots.ts — DEFAULT RFC 3161 TSA trust anchors (embedded, self-contained).
|
|
3
|
+
//
|
|
4
|
+
// The NexArt production node anchors its bundles with a DigiCert-operated RFC 3161
|
|
5
|
+
// Time Stamping Authority. `verify-record` verifies those tokens automatically and
|
|
6
|
+
// offline, so the trust roots must travel WITH the CLI — there is no network call
|
|
7
|
+
// and no system trust store involved. We embed the two public DigiCert roots that
|
|
8
|
+
// the node's TSA chains to:
|
|
9
|
+
//
|
|
10
|
+
// • DigiCert Trusted Root G4
|
|
11
|
+
// SHA-256: 55:2F:7B:DC:F1:A7:AF:9E:6C:E6:72:01:7F:4F:12:AB:
|
|
12
|
+
// F7:72:40:C7:8E:76:1A:C2:03:D1:D9:D2:0A:C8:99:88
|
|
13
|
+
// • DigiCert Assured ID Root CA
|
|
14
|
+
// SHA-256: 3E:90:99:B5:01:5E:8F:48:6C:00:BC:EA:9D:11:1E:E7:
|
|
15
|
+
// 21:FA:BA:35:5A:89:BC:F1:DF:69:56:1E:3D:C6:32:5C
|
|
16
|
+
//
|
|
17
|
+
// These are the verbatim public root certificates published at
|
|
18
|
+
// https://cacerts.digicert.com/ . Intermediate CA certificates ride inside the
|
|
19
|
+
// TimeStampToken itself (CMS `certificates`), so only the roots need to be pinned
|
|
20
|
+
// here. A caller can override this default trust store with `--tsa-roots <pem>`
|
|
21
|
+
// (used, for example, by the test suite, which anchors a freeTSA fixture instead).
|
|
22
|
+
// ─────────────────────────────────────────────────────────────────────────────
|
|
23
|
+
/** DigiCert Trusted Root G4 — public root certificate (PEM). */
|
|
24
|
+
const DIGICERT_TRUSTED_ROOT_G4 = `-----BEGIN CERTIFICATE-----
|
|
25
|
+
MIIFkDCCA3igAwIBAgIQBZsbV56OITLiOQe9p3d1XDANBgkqhkiG9w0BAQwFADBi
|
|
26
|
+
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
|
|
27
|
+
d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg
|
|
28
|
+
RzQwHhcNMTMwODAxMTIwMDAwWhcNMzgwMTE1MTIwMDAwWjBiMQswCQYDVQQGEwJV
|
|
29
|
+
UzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQu
|
|
30
|
+
Y29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwggIiMA0GCSqG
|
|
31
|
+
SIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAiMGkz7MKnJS7JIT3y
|
|
32
|
+
ithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnnyyhHS5F/WBTxSD1If
|
|
33
|
+
xp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE5nQ7bXHiLQwb7iDV
|
|
34
|
+
ySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm7nfISKhmV1efVFiO
|
|
35
|
+
DCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5w3jHtrHEtWoYOAMQ
|
|
36
|
+
jdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsDdV14Ztk6MUSaM0C/
|
|
37
|
+
CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1ZXUJ2h4mXaXpI8OCi
|
|
38
|
+
EhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS00mFt6zPZxd9LBADM
|
|
39
|
+
fRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hkpjPRiQfhvbfmQ6QY
|
|
40
|
+
uKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m800ERElvlEFDrMcXK
|
|
41
|
+
chYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+isX4KJpn15GkvmB0t
|
|
42
|
+
9dmpsh3lGwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB
|
|
43
|
+
hjAdBgNVHQ4EFgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wDQYJKoZIhvcNAQEMBQAD
|
|
44
|
+
ggIBALth2X2pbL4XxJEbw6GiAI3jZGgPVs93rnD5/ZpKmbnJeFwMDF/k5hQpVgs2
|
|
45
|
+
SV1EY+CtnJYYZhsjDT156W1r1lT40jzBQ0CuHVD1UvyQO7uYmWlrx8GnqGikJ9yd
|
|
46
|
+
+SeuMIW59mdNOj6PWTkiU0TryF0Dyu1Qen1iIQqAyHNm0aAFYF/opbSnr6j3bTWc
|
|
47
|
+
fFqK1qI4mfN4i/RN0iAL3gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa
|
|
48
|
+
sjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N
|
|
49
|
+
cCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N
|
|
50
|
+
0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie
|
|
51
|
+
4u1Ki7wb/UdKDd9nZn6yW0HQO+T0O/QEY+nvwlQAUaCKKsnOeMzV6ocEGLPOr0mI
|
|
52
|
+
r/OSmbaz5mEP0oUA51Aa5BuVnRmhuZyxm7EAHu/QD09CbMkKvO5D+jpxpchNJqU1
|
|
53
|
+
/YldvIViHTLSoCtU7ZpXwdv6EM8Zt4tKG48BtieVU+i2iW1bvGjUI+iLUaJW+fCm
|
|
54
|
+
gKDWHrO8Dw9TdSmq6hN35N6MgSGtBxBHEa2HPQfRdbzP82Z+
|
|
55
|
+
-----END CERTIFICATE-----`;
|
|
56
|
+
/** DigiCert Assured ID Root CA — public root certificate (PEM). */
|
|
57
|
+
const DIGICERT_ASSURED_ID_ROOT_CA = `-----BEGIN CERTIFICATE-----
|
|
58
|
+
MIIDtzCCAp+gAwIBAgIQDOfg5RfYRv6P5WD8G/AwOTANBgkqhkiG9w0BAQUFADBl
|
|
59
|
+
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
|
|
60
|
+
d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv
|
|
61
|
+
b3QgQ0EwHhcNMDYxMTEwMDAwMDAwWhcNMzExMTEwMDAwMDAwWjBlMQswCQYDVQQG
|
|
62
|
+
EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl
|
|
63
|
+
cnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgQ0EwggEi
|
|
64
|
+
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtDhXO5EOAXLGH87dg+XESpa7c
|
|
65
|
+
JpSIqvTO9SA5KFhgDPiA2qkVlTJhPLWxKISKityfCgyDF3qPkKyK53lTXDGEKvYP
|
|
66
|
+
mDI2dsze3Tyoou9q+yHyUmHfnyDXH+Kx2f4YZNISW1/5WBg1vEfNoTb5a3/UsDg+
|
|
67
|
+
wRvDjDPZ2C8Y/igPs6eD1sNuRMBhNZYW/lmci3Zt1/GiSw0r/wty2p5g0I6QNcZ4
|
|
68
|
+
VYcgoc/lbQrISXwxmDNsIumH0DJaoroTghHtORedmTpyoeb6pNnVFzF1roV9Iq4/
|
|
69
|
+
AUaG9ih5yLHa5FcXxH4cDrC0kqZWs72yl+2qp/C3xag/lRbQ/6GW6whfGHdPAgMB
|
|
70
|
+
AAGjYzBhMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW
|
|
71
|
+
BBRF66Kv9JLLgjEtUYunpyGd823IDzAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYun
|
|
72
|
+
pyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAog683+Lt8ONyc3pklL/3cmbYMuRC
|
|
73
|
+
dWKuh+vy1dneVrOfzM4UKLkNl2BcEkxY5NM9g0lFWJc1aRqoR+pWxnmrEthngYTf
|
|
74
|
+
fwk8lOa4JiwgvT2zKIn3X/8i4peEH+ll74fg38FnSbNd67IJKusm7Xi+fT8r87cm
|
|
75
|
+
NW1fiQG2SVufAQWbqz0lwcy2f8Lxb4bG+mRo64EtlOtCt/qMHt1i8b5QZ7dsvfPx
|
|
76
|
+
H2sMNgcWfzd8qVttevESRmCD1ycEvkvOl77DZypoEd+A5wwzZr8TDRRu838fYxAe
|
|
77
|
+
+o0bJW1sj6W3YQGx0qMmoRBxna3iw/nDmVG3KwcIzi7mULKn+gpFL6Lw8g==
|
|
78
|
+
-----END CERTIFICATE-----`;
|
|
79
|
+
/**
|
|
80
|
+
* The default DigiCert trust anchors for `verify-record`, as a single concatenated
|
|
81
|
+
* PEM string ready to hand to the RFC 3161 verifier. Override with `--tsa-roots`.
|
|
82
|
+
*/
|
|
83
|
+
export const DIGICERT_DEFAULT_ROOTS_PEM = `${DIGICERT_TRUSTED_ROOT_G4}\n${DIGICERT_ASSURED_ID_ROOT_CA}\n`;
|
|
84
|
+
//# sourceMappingURL=trustRoots.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"trustRoots.js","sourceRoot":"","sources":["../src/trustRoots.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,iFAAiF;AACjF,EAAE;AACF,mFAAmF;AACnF,mFAAmF;AACnF,kFAAkF;AAClF,kFAAkF;AAClF,4BAA4B;AAC5B,EAAE;AACF,+BAA+B;AAC/B,kEAAkE;AAClE,iEAAiE;AACjE,kCAAkC;AAClC,kEAAkE;AAClE,iEAAiE;AACjE,EAAE;AACF,+DAA+D;AAC/D,+EAA+E;AAC/E,kFAAkF;AAClF,gFAAgF;AAChF,mFAAmF;AACnF,gFAAgF;AAEhF,gEAAgE;AAChE,MAAM,wBAAwB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BA+BP,CAAC;AAE3B,mEAAmE;AACnE,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;;;;;;;0BAqBV,CAAC;AAE3B;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,wBAAwB,KAAK,2BAA2B,IAAI,CAAC"}
|
package/dist/tsaVerify.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tsaVerify.d.ts","sourceRoot":"","sources":["../src/tsaVerify.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"tsaVerify.d.ts","sourceRoot":"","sources":["../src/tsaVerify.ts"],"names":[],"mappings":"AAiEA,MAAM,MAAM,SAAS,GACjB,OAAO,GACP,mBAAmB,GACnB,iBAAiB,GACjB,gBAAgB,GAChB,SAAS,GACT,cAAc,GACd,WAAW,GACX,oBAAoB,GACpB,aAAa,CAAC;AAElB,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,eAAe,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mFAAmF;IACnF,EAAE,CAAC,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAC;IAClB,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAqFD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CA2H5F;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAyB7D"}
|
package/dist/tsaVerify.js
CHANGED
|
@@ -6,9 +6,15 @@
|
|
|
6
6
|
// therefore never loaded for ordinary integrity/signature verification.
|
|
7
7
|
//
|
|
8
8
|
// It is STRICTLY ADDITIVE and never touches Integrity, Signature, certificateHash,
|
|
9
|
-
// or the process exit code. It only inspects an already-present RFC 3161
|
|
10
|
-
//
|
|
11
|
-
//
|
|
9
|
+
// or the process exit code. It only inspects an already-present RFC 3161 timestamp
|
|
10
|
+
// and reports whether that token cryptographically anchors the bundle's
|
|
11
|
+
// certificateHash to a point in time, under a caller-supplied trust root.
|
|
12
|
+
//
|
|
13
|
+
// TOKEN WIRE SHAPE: the certification node returns the FULL RFC 3161 TimeStampResp
|
|
14
|
+
// (PKIStatusInfo + timeStampToken), while OpenSSL's `-token_out` and some producers
|
|
15
|
+
// emit a bare TimeStampToken (CMS ContentInfo). resolveTokenContentInfo() accepts
|
|
16
|
+
// both — it structurally detects the wrapper and unwraps to the inner ContentInfo
|
|
17
|
+
// before the unchanged SignedData verification. The CLI adapts to the node output.
|
|
12
18
|
//
|
|
13
19
|
// OFFLINE ONLY: no network. Trust roots are supplied by the caller as PEM.
|
|
14
20
|
//
|
|
@@ -50,6 +56,9 @@ const OID_ID_DATA = '1.2.840.113549.1.7.1';
|
|
|
50
56
|
const OID_ID_CT_TSTINFO = '1.2.840.113549.1.9.16.1.4';
|
|
51
57
|
const OID_CONTENT_TYPE_ATTR = '1.2.840.113549.1.9.3';
|
|
52
58
|
const OID_SHA256 = '2.16.840.1.101.3.4.2.1';
|
|
59
|
+
// ASN.1 universal tag numbers used for structural detection of the token wrapper.
|
|
60
|
+
const ASN1_TAG_OID = 6;
|
|
61
|
+
const ASN1_TAG_SEQUENCE = 16;
|
|
53
62
|
let engineReady = false;
|
|
54
63
|
function ensureEngine() {
|
|
55
64
|
if (engineReady)
|
|
@@ -89,6 +98,46 @@ function hexFromCertificateHash(certificateHash) {
|
|
|
89
98
|
const m = /^sha256:([0-9a-fA-F]{64})$/.exec(certificateHash.trim());
|
|
90
99
|
return m ? m[1].toLowerCase() : null;
|
|
91
100
|
}
|
|
101
|
+
/**
|
|
102
|
+
* Resolve the CMS ContentInfo (the SignedData wrapper) from a decoded RFC 3161 token,
|
|
103
|
+
* accepting BOTH wire shapes the ecosystem produces:
|
|
104
|
+
*
|
|
105
|
+
* TimeStampToken ::= ContentInfo -- a bare CMS SignedData wrapper
|
|
106
|
+
* TimeStampResp ::= SEQUENCE { -- the full TSA response
|
|
107
|
+
* status PKIStatusInfo,
|
|
108
|
+
* timeStampToken TimeStampToken OPTIONAL }
|
|
109
|
+
*
|
|
110
|
+
* The NexArt certification node returns the FULL TimeStampResp; other producers (and
|
|
111
|
+
* older fixtures) may hand us a bare TimeStampToken. Detection is purely structural:
|
|
112
|
+
* a ContentInfo opens with an OBJECT IDENTIFIER (the contentType), whereas a
|
|
113
|
+
* TimeStampResp opens with the PKIStatusInfo SEQUENCE. This mirrors the Node reference
|
|
114
|
+
* (src/tsa-verify.js → extractSignedData()). Parsing layer only — no change to any
|
|
115
|
+
* cryptographic check, the imprint binding, or certificateHash.
|
|
116
|
+
*
|
|
117
|
+
* Returns the inner ContentInfo, or null if neither shape is present.
|
|
118
|
+
*/
|
|
119
|
+
function resolveTokenContentInfo(schema) {
|
|
120
|
+
const first = schema
|
|
121
|
+
?.valueBlock?.value?.[0];
|
|
122
|
+
const tagNumber = first?.idBlock?.tagNumber;
|
|
123
|
+
// Bare TimeStampToken — a CMS ContentInfo (opens with the contentType OID).
|
|
124
|
+
if (tagNumber === ASN1_TAG_OID) {
|
|
125
|
+
return new pkijs.ContentInfo({ schema });
|
|
126
|
+
}
|
|
127
|
+
// Full TimeStampResp — opens with the PKIStatusInfo SEQUENCE; extract timeStampToken.
|
|
128
|
+
if (tagNumber === ASN1_TAG_SEQUENCE) {
|
|
129
|
+
const resp = new pkijs.TimeStampResp({ schema });
|
|
130
|
+
// PKIStatus: only `granted` (0) or `grantedWithMods` (1) carry a usable token.
|
|
131
|
+
// Any other status (rejection/waiting/revocation*) means there is no trustworthy
|
|
132
|
+
// timestamp — fail closed (caller renders this as malformed / not verified).
|
|
133
|
+
const pkiStatus = Number(resp.status?.status);
|
|
134
|
+
if (pkiStatus !== 0 && pkiStatus !== 1)
|
|
135
|
+
return null;
|
|
136
|
+
const tst = resp.timeStampToken;
|
|
137
|
+
return tst ?? null;
|
|
138
|
+
}
|
|
139
|
+
return null;
|
|
140
|
+
}
|
|
92
141
|
/**
|
|
93
142
|
* Verify an RFC 3161 TimeStampToken against a bundle's certificateHash.
|
|
94
143
|
* Pure, offline, additive. Never throws for verification failures — every
|
|
@@ -109,7 +158,12 @@ export async function verifyRfc3161Timestamp(input) {
|
|
|
109
158
|
const ciAsn1 = asn1js.fromBER(toArrayBuffer(new Uint8Array(der)));
|
|
110
159
|
if (ciAsn1.offset === -1)
|
|
111
160
|
return { status: 'malformed', reason: 'not valid DER' };
|
|
112
|
-
|
|
161
|
+
// Accept a bare TimeStampToken OR a full RFC 3161 TimeStampResp (Node returns the
|
|
162
|
+
// latter): unwrap to the CMS ContentInfo before the unchanged SignedData handling.
|
|
163
|
+
const ci = resolveTokenContentInfo(ciAsn1.result);
|
|
164
|
+
if (!ci) {
|
|
165
|
+
return { status: 'malformed', reason: 'token is neither a TimeStampToken nor a TimeStampResp carrying one' };
|
|
166
|
+
}
|
|
113
167
|
if (ci.contentType !== OID_SIGNED_DATA) {
|
|
114
168
|
return { status: 'malformed', reason: `unexpected contentType ${ci.contentType}` };
|
|
115
169
|
}
|
package/dist/tsaVerify.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tsaVerify.js","sourceRoot":"","sources":["../src/tsaVerify.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,iFAAiF;AACjF,EAAE;AACF,kFAAkF;AAClF,gFAAgF;AAChF,wEAAwE;AACxE,EAAE;AACF,mFAAmF;AACnF,
|
|
1
|
+
{"version":3,"file":"tsaVerify.js","sourceRoot":"","sources":["../src/tsaVerify.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,iFAAiF;AACjF,EAAE;AACF,kFAAkF;AAClF,gFAAgF;AAChF,wEAAwE;AACxE,EAAE;AACF,mFAAmF;AACnF,mFAAmF;AACnF,wEAAwE;AACxE,0EAA0E;AAC1E,EAAE;AACF,mFAAmF;AACnF,oFAAoF;AACpF,kFAAkF;AAClF,kFAAkF;AAClF,mFAAmF;AACnF,EAAE;AACF,2EAA2E;AAC3E,EAAE;AACF,sDAAsD;AACtD,mFAAmF;AACnF,kFAAkF;AAClF,+EAA+E;AAC/E,oFAAoF;AACpF,mFAAmF;AACnF,6EAA6E;AAC7E,wEAAwE;AACxE,EAAE;AACF,kFAAkF;AAClF,4EAA4E;AAC5E,8DAA8D;AAC9D,4EAA4E;AAC5E,mFAAmF;AACnF,iFAAiF;AACjF,0EAA0E;AAC1E,uEAAuE;AACvE,kFAAkF;AAClF,8FAA8F;AAC9F,oEAAoE;AACpE,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,iFAAiF;AACjF,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,0EAA0E;AAC1E,gFAAgF;AAEhF,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAC/C,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAC3C,MAAM,iBAAiB,GAAG,2BAA2B,CAAC;AACtD,MAAM,qBAAqB,GAAG,sBAAsB,CAAC;AACrD,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAE5C,kFAAkF;AAClF,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAoC7B,IAAI,WAAW,GAAG,KAAK,CAAC;AACxB,SAAS,YAAY;IACnB,IAAI,WAAW;QAAE,OAAO;IACxB,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,SAAmB,EAAE,CAAC,CAAC,CAAC;IAC7G,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,EAAc;IACnC,OAAO,EAAE,CAAC,UAAU,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,KAAK,EAAE,CAAC,MAAM,CAAC,UAAU;QAClE,CAAC,CAAE,EAAE,CAAC,MAAsB;QAC5B,CAAC,CAAE,EAAE,CAAC,KAAK,EAAE,CAAC,MAAsB,CAAC;AACzC,CAAC;AAED,sEAAsE;AACtE,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,MAAM,EAAE,GAAG,iEAAiE,CAAC;IAC7E,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;YAAE,SAAS;QACjC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,IAA0C;IAClE,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC7C,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,sBAAsB,CAAC,eAAuB;IACrD,MAAM,CAAC,GAAG,4BAA4B,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,uBAAuB,CAAC,MAAmD;IAClF,MAAM,KAAK,GAAI,MAAmF;QAChG,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,SAAS,GAAG,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC;IAE5C,4EAA4E;IAC5E,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,sFAAsF;IACtF,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,+EAA+E;QAC/E,iFAAiF;QACjF,6EAA6E;QAC7E,MAAM,SAAS,GAAG,MAAM,CAAE,IAA0C,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrF,IAAI,SAAS,KAAK,CAAC,IAAI,SAAS,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,GAAG,GAAI,IAA+C,CAAC,cAAc,CAAC;QAC5E,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAqB;IAChE,YAAY,EAAE,CAAC;IAEf,2DAA2D;IAC3D,IAAI,EAAoB,CAAC;IACzB,IAAI,aAAyB,CAAC;IAC9B,IAAI,GAAkB,CAAC;IACvB,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAClF,kFAAkF;QAClF,mFAAmF;QACnF,MAAM,EAAE,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,oEAAoE,EAAE,CAAC;QAC/G,CAAC;QACD,IAAI,EAAE,CAAC,WAAW,KAAK,eAAe,EAAE,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACrF,CAAC;QACD,EAAE,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAElD,IAAI,EAAE,CAAC,gBAAgB,CAAC,YAAY,KAAK,iBAAiB,EAAE,CAAC;YAC3D,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC,gBAAgB,CAAC,YAAY,GAAG,EAAE,CAAC;QACrH,CAAC;QACD,MAAM,QAAQ,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC;QAC9C,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;QACvF,aAAa,GAAG,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QAC9F,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAEpD,+EAA+E;QAC/E,4EAA4E;QAC5E,sEAAsE;QACtE,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,iBAAiB,GAAG,KAAK,KAAK,iBAAiB,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3F,CAAC;IAED,MAAM,OAAO,GAAqB,GAAG,CAAC,OAAO,YAAY,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAE/D,oDAAoD;IACpD,IAAI,UAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,gFAAgF;QAChF,EAAE,CAAC,gBAAgB,CAAC,YAAY,GAAG,WAAW,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,UAAU,GAAI,EAAgD,CAAC,iBAAiB,CAAC;QACjF,IAAI,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,gBAAgB,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QACzI,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,gBAAgB,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IACxJ,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAEzC,mEAAmE;IACnE,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,2CAA2C,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC7I,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,WAAW,CAAC;IAChE,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,yCAAyC,UAAU,GAAG,EAAE,CAAC;IACjI,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACnH,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,MAAM,uBAAuB,OAAO,EAAE,EAAE,CAAC;IAC5H,CAAC;IAED,oEAAoE;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IACvH,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,EAAE,IAAI,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC;IACpD,MAAM,SAAS,GAAG,CAAC,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAA0B,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,WAAW,CAAC,CAAC;IAChH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,gCAAgC,CAAC;YACxD,YAAY,EAAE,KAAK;YACnB,KAAK,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE;YACxE,SAAS;SACV,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC;QAChC,QAAQ,GAAG,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,wEAAwE;IACxE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC;QAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC3C,IAAI,SAAS,GAAG,SAAS,IAAI,SAAS,GAAG,QAAQ,EAAE,CAAC;YAClD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,oCAAoC,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;QAChI,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,IAAI,2BAA2B,EAAE,CAAC;IACjH,CAAC;IAED,iCAAiC;IACjC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACzF,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,UAAU,uBAAuB,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACrI,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAAuB;IACnD,MAAM,KAAK,GAAG,QAAQ,CAAC;IACvB,MAAM,KAAK,GAAG,QAAQ,CAAC;IACvB,MAAM,MAAM,GAAG,QAAQ,CAAC;IACxB,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO,GAAG,KAAK,uCAAuC,CAAC;QACzD,KAAK,mBAAmB;YACtB,OAAO,GAAG,KAAK,qDAAqD,CAAC;QACvE,KAAK,iBAAiB;YACpB,OAAO,GAAG,KAAK,4DAA4D,CAAC;QAC9E,KAAK,gBAAgB;YACnB,OAAO,GAAG,KAAK,0DAA0D,CAAC;QAC5E,KAAK,SAAS;YACZ,OAAO,GAAG,KAAK,mDAAmD,CAAC;QACrE,KAAK,cAAc;YACjB,OAAO,GAAG,KAAK,gDAAgD,CAAC;QAClE,KAAK,WAAW;YACd,OAAO,GAAG,KAAK,2DAA2D,CAAC;QAC7E,KAAK,oBAAoB;YACvB,OAAO,GAAG,MAAM,wDAAwD,CAAC;QAC3E,KAAK,aAAa,CAAC;QACnB;YACE,OAAO,GAAG,MAAM,6CAA6C,CAAC;IAClE,CAAC;AACH,CAAC"}
|