npm - @opentdf/ctl - Versions diffs - 0.20.0-beta.202 → 0.20.0-beta.203 - Mend

@opentdf/ctl 0.20.0-beta.202 → 0.20.0-beta.203

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/src/cli.js CHANGED Viewed

@@ -14,6 +14,10 @@ class InvalidAuthProvider {
     }
 }
 const containerTypes = ['tdf3', 'ztdf'];
+/** Accepted values for the two integrity-algorithm flags, lowercase by convention. */
+const integrityAlgorithms = ['hs256', 'gmac'];
+/** Flag values are case-insensitive; normalize before yargs checks `choices`. */
+const lowercaseIntegrityAlgorithm = (v) => typeof v === 'string' ? v.toLowerCase() : v;
 const parseJwt = (jwt, field = 1) => {
     return JSON.parse(base64.decode(jwt.split('.')[field]));
 };
@@ -202,11 +206,8 @@ async function parseCreateOptions(argv) {
     c.autoconfigure = !!argv.autoconfigure;
     return c;
 }
-async function parseCreateTDFOptions(argv) {
-    const c = await parseCreateOptions(argv);
-    if (argv.assertions?.length) {
-        c.assertionConfigs = await parseAssertionConfig(argv.assertions);
-    }
+function parseCreateTDFFlags(argv) {
+    const c = {};
     if (argv.encapKeyType?.length) {
         if (!isPublicKeyAlgorithm(argv.encapKeyType)) {
             throw new CLIError('CRITICAL', `Unsupported rewrap key algorithm: [${argv.encapKeyType}]`);
@@ -224,6 +225,29 @@ async function parseCreateTDFOptions(argv) {
     if (argv.tdfSpecVersion) {
         c.tdfSpecVersion = argv.tdfSpecVersion;
     }
+    if (argv.rootIntegrityAlgorithm?.length) {
+        // Only HMAC is supported for the root integrity algorithm.
+        if (argv.rootIntegrityAlgorithm.toLowerCase() !== 'hs256') {
+            throw new CLIError('CRITICAL', `unsupported root integrity algorithm: [${argv.rootIntegrityAlgorithm}]; only [hs256] is supported`);
+        }
+        c.rootIntegrityAlgorithm = 'HS256';
+    }
+    if (argv.segmentIntegrityAlgorithm?.length) {
+        const segmentAlg = argv.segmentIntegrityAlgorithm.toUpperCase();
+        if (segmentAlg !== 'GMAC' && segmentAlg !== 'HS256') {
+            throw new CLIError('CRITICAL', `unsupported segment integrity algorithm: [${argv.segmentIntegrityAlgorithm}]`);
+        }
+        c.segmentIntegrityAlgorithm = segmentAlg;
+    }
+    return c;
+}
+async function parseCreateTDFOptions(argv, flags = parseCreateTDFFlags(argv)) {
+    const c = { ...(await parseCreateOptions(argv)), ...flags };
+    if (argv.assertions?.length) {
+        // Reads from disk (parseAssertionConfig falls back to openAsBlob), so it
+        // stays here rather than in the pure pass.
+        c.assertionConfigs = await parseAssertionConfig(argv.assertions);
+    }
     log('DEBUG', `CreateTDFOptions: ${JSON.stringify(c)}`);
     return c;
 }
@@ -399,6 +423,24 @@ export const handleArgs = (args) => {
             type: 'string',
             default: '',
         },
+        rootIntegrityAlgorithm: {
+            alias: 'root-integrity-algorithm',
+            group: 'Encrypt Options:',
+            desc: 'Algorithm for the root signature. Only hs256 is supported; gmac is rejected',
+            type: 'string',
+            choices: integrityAlgorithms,
+            coerce: lowercaseIntegrityAlgorithm,
+            default: 'hs256',
+        },
+        segmentIntegrityAlgorithm: {
+            alias: 'segment-integrity-algorithm',
+            group: 'Encrypt Options:',
+            desc: 'Algorithm for per-segment integrity',
+            type: 'string',
+            choices: integrityAlgorithms,
+            coerce: lowercaseIntegrityAlgorithm,
+            default: 'gmac',
+        },
         rewrapKeyType: {
             alias: 'rewrap-encapsulation-algorithm',
             group: 'Decrypt Options:',
@@ -536,6 +578,16 @@ export const handleArgs = (args) => {
         });
     }, async (argv) => {
         log('DEBUG', 'Running encrypt command');
+        // Order is deliberate and covered by bin/opentdf.bats:
+        //   1. pure flag checks -- no I/O, so a typo fails instantly
+        //   2. oidcEndpoint, mirroring `decrypt`
+        //   3. open the input file and any assertion files
+        //   4. the auth provider, which may reach the IdP
+        const createFlags = parseCreateTDFFlags(argv);
+        if (!argv.oidcEndpoint) {
+            throw new CLIError('CRITICAL', 'oidcEndpoint must be specified');
+        }
+        const createOptions = await parseCreateTDFOptions(argv, createFlags);
         const authProvider = await processAuth(argv);
         log('DEBUG', `Initialized auth provider ${JSON.stringify(authProvider)}`);
         const guessedPolicyEndpoint = guessPolicyUrl(argv);
@@ -551,7 +603,7 @@ export const handleArgs = (args) => {
         try {
             log('SILLY', `Initialized client`);
             log('DEBUG', `TDF Create`);
-            const ct = await client.createTDF(await parseCreateTDFOptions(argv));
+            const ct = await client.createTDF(createOptions);
             if (!ct) {
                 throw new CLIError('CRITICAL', 'Encrypt configuration error: No output?');
             }

package/dist/src/cli.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAOL,aAAa,EACb,OAAO,EACP,cAAc,EACd,OAAO,EAEP,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAS,GAAG,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,UAAU,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAgBhD,MAAM,mBAAmB;IACvB,KAAK,CAAC,qBAAqB,KAAmB,CAAC;IAC/C,SAAS;QACP,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAExC,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE;IAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,GAAW,EAAE,EAAE;IACvC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9D,CAAC,CAAC;AAEF,KAAK,UAAU,WAAW,CAAC,EACzB,IAAI,EACJ,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,MAAM,GACQ;IACd,GAAG,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACvC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,gCAAgC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,GAAG,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,oDAAoD,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,SAAS,CAAC;IACvC,CAAC;SAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC;QAC1D,QAAQ;QACR,UAAU,EAAE,YAAY;QACxB,QAAQ,EAAE,QAAQ;QAClB,YAAY;KACb,CAAC,CAAC;IACH,IAAI,gBAAgB,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,UAAU,GAAgC,EAAE,CAAC;IACnD,OAAO;QACL,UAAU;QACV,qBAAqB,EAAE,KAAK,EAAE,UAAmB,EAAE,EAAE;YACnD,MAAM,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;YACzC,GAAG,CAAC,OAAO,EAAE,2BAA2B,UAAU,EAAE,SAAS,GAAG,CAAC,CAAC;QACpE,CAAC;QACD,SAAS,EAAE,KAAK,EAAE,OAAkC,EAAE,EAAE;YACtD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACvC,QAAQ,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC;YAC1B,CAAC;YACD,GAAG,CAAC,OAAO,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC7D,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,MAAM,GAAG,GAAG,EAAU,EAAE;IACnD,OAAO,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,KAAK,UAAU,8BAA8B,CAC3C,CAAS;IAET,IAAI,CAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oBAAoB;QACpB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;YACrC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,2EAA2E,GAAG,CAAC,OAAO,EAAE,EACxF,IAAI,CACL,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,8BAA8B;IAC9B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QACjD,IAAI,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAA+C,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,+DAA+D,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,aAAa,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,YAAY,GAA4B,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACpE,4DAA4D;QAC5D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC9D,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,yBAAyB,aAAa,qBAAqB,CAAC,CAAC;QAC9F,CAAC;QAED,IAAI,OAAO,YAAY,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,yBAAyB,aAAa,qCAAqC,CAC5E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,GAAG,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,+CAA+C,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAuB;IACrD,MAAM,CAAC,GAAgB,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,IAAc,CAAC,EAAE,CAAC;IAC3E,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;IACpB,CAAC;IACD,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACnC,CAAC,CAAC,yBAAyB,GAAG,MAAM,8BAA8B,CAChE,IAAI,CAAC,yBAAyB,CAC/B,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;QAC/B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,sCAAsC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;QAC9F,CAAC;QACD,CAAC,CAAC,oBAAoB,GAAG,IAAI,CAAC,aAAa,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,gBAAgB,GAAG,GAAG,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,EAClC,GAAG,EACH,GAAG,GACqB;IACxB,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,mCAAmC;QACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,gCAAgC;IACxE,CAAC;SAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,yCAAyC;QACzC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,gCAAgC,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,mCAAmC;IACnC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,sCAAsC,GAAG,EAAE,CAAC,CAAC,CAAC,0BAA0B;AACzG,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,CAAS;IAC3C,IAAI,CAAC,CAAC;IACN,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oBAAoB;QACpB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;YACrC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,0DAA0D,GAAG,CAAC,OAAO,KAAK,IAAI,GAAG,EACjF,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,KAAK,MAAM,SAAS,IAAI,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,4BAA4B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,SAAS,CAAC,UAAU,CAAC,GAAG,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,+CAA+C,GAAG,CAAC,OAAO,EAAE,EAC5D,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAuB;IACvD,MAAM,CAAC,GAAkB;QACvB,MAAM,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,IAAc,CAAC;KAChD,CAAC;IACF,IAAI,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC5B,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACvC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,IAAuB;IAC1D,MAAM,CAAC,GAAqB,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC5B,CAAC,CAAC,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAC9B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,sCAAsC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;QAC7F,CAAC;QACD,CAAC,CAAC,oBAAoB,GAAG,IAAI,CAAC,YAAY,CAAC;IAC7C,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAiC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC,CAAC,cAAc,GAAG,IAAI,CAAC,cAAuB,CAAC;IAClD,CAAC;IACD,GAAG,CAAC,OAAO,EAAE,qBAAqB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,wBAAwB,IAAI,GAAG,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,2BAA2B,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,GAAG,CAAC,OAAO,EAAE,0BAA0B,IAAI,GAAG,CAAC,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAc,EAAE,EAAE;IAC3C,OAAO,CACL,KAAK,CAAC,IAAI,CAAC;SACR,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE;QACnB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,GAAG,UAAU,CAAC;QACzB,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,IAAI,CAAC,QAAkB,CAAC;YACnC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,WAAW,EAAW,CAAC;QACxC,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACxB,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,GAAG,CAAC,GAAG,CAAC,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,IAAI,GAAG,EAAE,CAAC;YACf,GAAG,CAAC,GAAG,CAAC,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,OAAO,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;QAEF,eAAe;SACd,MAAM,CAAC,aAAa,EAAE;QACrB,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,qDAAqD;KACnE,CAAC;SACD,MAAM,CAAC,aAAa,EAAE;QACrB,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,2DAA2D;KACzE,CAAC;SACD,MAAM,CAAC,cAAc,EAAE;QACtB,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,iDAAiD;KAC/D,CAAC;SACD,MAAM,CAAC,gBAAgB,EAAE;QACxB,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0CAA0C;KACxD,CAAC;SACD,MAAM,CAAC,WAAW,EAAE;QACnB,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,gGAAgG;QACtG,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;KAC5C,CAAC;SACD,MAAM,CAAC,iBAAiB,EAAE;QACzB,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,2CAA2C;QACjD,IAAI,EAAE,SAAS;KAChB,CAAC;SACD,MAAM,CAAC,oBAAoB,EAAE;QAC5B,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,0BAA0B;QAChC,IAAI,EAAE,SAAS;KAChB,CAAC;SACD,MAAM,CAAC,2BAA2B,EAAE;QACnC,KAAK,EAAE,kCAAkC;QACzC,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,mGAAmG;QACzG,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,8BAA8B;KACzC,CAAC;SACD,MAAM,CAAC,kBAAkB,EAAE;QAC1B,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,+CAA+C;QACrD,IAAI,EAAE,QAAQ;KACf,CAAC;SACD,MAAM,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,iBAAiB;QACxB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,+DAA+D;KAC7E,CAAC;SACD,MAAM,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,4BAA4B;QAClC,IAAI,EAAE,SAAS;KAChB,CAAC;SACD,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC;SAChC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC;SAEpC,MAAM,CAAC,UAAU,EAAE;QAClB,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,gDAAgD;KAC9D,CAAC;SACD,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC;SAEnC,MAAM,CAAC,cAAc,EAAE;QACtB,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,oDAAoD;KAClE,CAAC;SACD,OAAO,CAAC,cAAc,EAAE,UAAU,CAAC;SAEnC,MAAM,CAAC,eAAe,EAAE;QACvB,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,4DAA4D;KAC1E,CAAC;SACD,OAAO,CAAC,eAAe,EAAE,UAAU,CAAC;QAErC,WAAW;SACV,OAAO,CAAC,oCAAoC,EAAE,2BAA2B,CAAC;SAE1E,OAAO,CAAC,uDAAuD,EAAE,2BAA2B,CAAC;QAE9F,4CAA4C;SAC3C,OAAO,CAAC;QACP,UAAU,EAAE;YACV,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,+FAA+F;YACrG,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,oBAAoB;SAC/B;QACD,UAAU,EAAE;YACV,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,gCAAgC;YACtC,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;SACxD;QACD,aAAa,EAAE;YACb,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,qEAAqE;YAC3E,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,KAAK;SACf;QACD,aAAa,EAAE;YACb,KAAK,EAAE,kBAAkB;YACzB,KAAK,EAAE,GAAG;YACV,OAAO,EAAE,cAAc;YACvB,WAAW,EAAE,kBAAkB;YAC/B,OAAO,EAAE,MAAM;SAChB;QACD,YAAY,EAAE;YACZ,KAAK,EAAE,yBAAyB;YAChC,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,qBAAqB;YAC9B,OAAO,EAAE,UAAU;SACpB;QACD,QAAQ,EAAE;YACR,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,mCAAmC;YACzC,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE;SACZ;QACD,aAAa,EAAE;YACb,KAAK,EAAE,gCAAgC;YACvC,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,qBAAqB;YAC9B,OAAO,EAAE,UAAU;SACpB;QACD,MAAM,EAAE;YACN,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,qBAAqB;SACnC;QACD,cAAc,EAAE;YACd,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,oCAAoC;YACjD,OAAO,EAAE,cAAc;SACxB;KACF,CAAC;SAED,OAAO,CAAC;QACP,QAAQ,EAAE;YACR,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,WAAW;YAClB,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,mBAAmB;SAC1B;QACD,MAAM,EAAE;YACN,KAAK,EAAE,YAAY;YACnB,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,iBAAiB;SACxB;KACF,CAAC;SACD,MAAM,CAAC,QAAQ,EAAE;QAChB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,aAAa;KAC3B,CAAC;SAED,OAAO,CACN,gBAAgB,EAChB,gEAAgE,EAChE,CAAC,KAAK,EAAE,EAAE;QACR,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE;YAChC,QAAQ,EAAE,wBAAwB;YAClC,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;IACL,CAAC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC;YACrB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,cAAc,CAAC,IAAI,CAAC;YACrD,YAAY,EAAE,IAAI,mBAAmB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;gBACjD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CACF;SAEA,OAAO,CACN,gBAAgB,EAChB,uBAAuB,EACvB,CAAC,KAAK,EAAE,EAAE;QACR,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE;YAChC,QAAQ,EAAE,yBAAyB;YACnC,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;IACL,CAAC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAChD,GAAG,CAAC,OAAO,EAAE,kBAAkB,YAAY,EAAE,CAAC,CAAC;QAC/C,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,gCAAgC,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7C,GAAG,CAAC,OAAO,EAAE,6BAA6B,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC1E,MAAM,qBAAqB,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC;YACzB,YAAY;YACZ,oBAAoB,EAAE;gBACpB,kBAAkB,EAAE,IAAI,CAAC,WAAW;aACrC;YACD,kBAAkB,EAAE;gBAClB,mBAAmB,EAAE,YAAY;gBACjC,eAAe,EAAE,eAAe;gBAChC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB;aACpC;YACD,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI;YACvB,cAAc,EAAE,qBAAqB;YACrC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,qBAAqB;SACvD,CAAC,CAAC;QACH,IAAI,CAAC;YACH,GAAG,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YACnC,GAAG,CAAC,OAAO,EAAE,0BAA0B,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YACrD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YAClF,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAE7C,MAAM,WAAW,GAAG,YAAY,CAAC,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAChF,GAAG,CAAC,OAAO,EAAE,mBAAmB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC/D,IAAI,WAAW,GAAG,IAAI,CAAC;YACvB,IAAI,SAAS,GAAG,IAAI,CAAC;YACrB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxB,KAAK,MAAM;wBACT,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;wBAC1D,SAAS,GAAG,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;wBACrD,GAAG,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;wBAClD,MAAM;oBACR,KAAK,eAAe;wBAClB,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,sCAAsC,CAAC,CAAC;wBACrE,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC7D,GAAG,CAAC,MAAM,EAAE,iBAAiB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;wBAC5D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;4BACd,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,kCAAkC,CAAC,CAAC;wBAC3E,CAAC;wBACD,MAAM;gBACV,CAAC;YACH,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;YACrD,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,EAAE,2BAA2B,CAAC,CAAC;QACvE,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,CACF;SACA,OAAO,CACN,gBAAgB,EAChB,+BAA+B,EAC/B,CAAC,KAAK,EAAE,EAAE;QACR,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE;YAChC,QAAQ,EAAE,yBAAyB;YACnC,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;IACL,CAAC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7C,GAAG,CAAC,OAAO,EAAE,6BAA6B,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC1E,MAAM,qBAAqB,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC;YACzB,YAAY;YACZ,oBAAoB,EAAE;gBACpB,kBAAkB,EAAE,IAAI,CAAC,WAAW;aACrC;YACD,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI;YACvB,cAAc,EAAE,qBAAqB;YACrC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,qBAAqB;SACvD,CAAC,CAAC;QACH,IAAI,CAAC;YACH,GAAG,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YACnC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAC3B,MAAM,EAAE,GAAoB,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;YACtF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,yCAAyC,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YAClF,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAC/C,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,CACF;SACA,KAAK,CAAC,oCAAoC,CAAC;SAC3C,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC;SAClB,aAAa,EAAE;SACf,iBAAiB,EAAE;SACnB,IAAI,CAAC,MAAM,CAAC;SACZ,OAAO,CAAC;QACP,GAAG,EAAE;YACH,IAAI,EAAE,qBAAqB;SAC5B;KACF,CAAC;SAED,OAAO,CACN,SAAS,EACT,IAAI,CAAC,SAAS,CAAC;QACb,cAAc,EAAE,OAAO;QACvB,cAAc;KACf,CAAC,CACH;SACA,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC;SACrB,MAAM,EAAE;SACR,UAAU,EAAE,CAChB,CAAC;AACJ,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,WAAqB,EAAE,EAAE;IAClD,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAEF,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9B,IAAI,CAAC,IAAI,CAAC;KACV,IAAI,CAAC,GAAG,EAAE;IACT,WAAW;AACb,CAAC,CAAC;KACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACb,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC,CAAC,CAAC;AAEL,SAAS,cAAc,CAAC,EACtB,WAAW,EACX,cAAc,GAIf;IACC,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["import { createWriteStream, openAsBlob } from 'node:fs';\nimport { stat } from 'node:fs/promises';\nimport { Writable } from 'node:stream';\nimport yargs from 'yargs';\nimport { hideBin } from 'yargs/helpers';\nimport {\n type AuthProvider,\n type CreateOptions,\n type CreateTDFOptions,\n type HttpRequest,\n type ReadOptions,\n type Source,\n AuthProviders,\n version,\n tdfSpecVersion,\n OpenTDF,\n DecoratedStream,\n isPublicKeyAlgorithm,\n PUBLIC_KEY_ALGORITHMS,\n} from '@opentdf/sdk';\nimport { CLIError, Level, log } from './logger.js';\nimport * as assertions from '@opentdf/sdk/assertions';\nimport { base64 } from '@opentdf/sdk/encodings';\nimport { type KeyPair } from '@opentdf/sdk/singlecontainer';\n\ntype AuthToProcess = {\n auth?: string;\n clientId?: string;\n clientSecret?: string;\n concurrencyLimit?: number;\n oidcEndpoint?: string;\n userId?: string;\n};\n\ntype LoggedAuthProvider = AuthProvider & {\n requestLog: HttpRequest[];\n};\n\nclass InvalidAuthProvider {\n async updateClientPublicKey(): Promise<void> {}\n withCreds(): Promise<HttpRequest> {\n throw new Error('Method not implemented.');\n }\n}\n\nconst containerTypes = ['tdf3', 'ztdf'];\n\nconst parseJwt = (jwt: string, field = 1) => {\n return JSON.parse(base64.decode(jwt.split('.')[field]));\n};\n\nconst parseJwtComplete = (jwt: string) => {\n return { header: parseJwt(jwt, 0), payload: parseJwt(jwt) };\n};\n\nasync function processAuth({\n auth,\n clientId,\n clientSecret,\n concurrencyLimit,\n oidcEndpoint,\n userId,\n}: AuthToProcess): Promise<LoggedAuthProvider> {\n log('DEBUG', 'Processing auth params');\n if (!oidcEndpoint) {\n throw new CLIError('CRITICAL', 'oidcEndpoint must be specified');\n }\n if (auth) {\n log('DEBUG', 'Processing an auth string');\n const authParts = auth.split(':');\n if (authParts.length !== 2) {\n throw new CLIError('CRITICAL', `Auth expects <clientId>:<clientSecret>, received ${auth}`);\n }\n\n [clientId, clientSecret] = authParts;\n } else if (!clientId \|\| !clientSecret) {\n throw new CLIError(\n 'CRITICAL',\n 'Auth expects clientId and clientSecret, or combined auth param'\n );\n }\n const actual = await AuthProviders.clientSecretAuthProvider({\n clientId,\n oidcOrigin: oidcEndpoint,\n exchange: 'client',\n clientSecret,\n });\n if (concurrencyLimit !== 1) {\n await actual.oidcAuth.get();\n }\n const requestLog: AuthProviders.HttpRequest[] = [];\n return {\n requestLog,\n updateClientPublicKey: async (signingKey: KeyPair) => {\n actual.updateClientPublicKey(signingKey);\n log('DEBUG', `updateClientPublicKey: [${signingKey?.publicKey}]`);\n },\n withCreds: async (httpReq: AuthProviders.HttpRequest) => {\n const credible = await actual.withCreds(httpReq);\n if (userId) {\n const url = new URL(credible.url);\n url.searchParams.set('userId', userId);\n credible.url = url.href;\n }\n log('DEBUG', `HTTP Requesting: ${JSON.stringify(credible)}`);\n requestLog.push(credible);\n return credible;\n },\n };\n}\n\nconst rstrip = (str: string, suffix = ' '): string => {\n while (str && suffix && str.endsWith(suffix)) {\n str = str.slice(0, -suffix.length);\n }\n return str;\n};\n\nasync function parseAssertionVerificationKeys(\n s: string\n): Promise<assertions.AssertionVerificationKeys> {\n let u: assertions.AssertionVerificationKeys;\n try {\n u = JSON.parse(s);\n } catch (err) {\n // try as file name:\n try {\n const jsonFile = await openAsBlob(s);\n u = JSON.parse(await jsonFile.text());\n } catch (err2) {\n throw new CLIError(\n 'CRITICAL',\n `Failed to open/parse assertion verification keys as string or file path ${err.message}`,\n err2\n );\n }\n }\n if (typeof u !== 'object' \|\| u === null) {\n throw new Error('Invalid input: The input must be an object');\n }\n // handle both cases of \"keys\"\n if (!('Keys' in u && typeof u.Keys === 'object')) {\n if ('keys' in u && typeof u.keys === 'object') {\n u.Keys = u.keys as Record<string, assertions.AssertionKey>;\n } else {\n throw new CLIError(\n 'CRITICAL',\n 'Invalid input: invalid structure of assertionVerificationKeys'\n );\n }\n }\n for (const assertionName in u.Keys) {\n const assertionKey: assertions.AssertionKey = u.Keys[assertionName];\n // Ensure each entry has the required 'key' and 'alg' fields\n if (typeof assertionKey !== 'object' \|\| assertionKey === null) {\n throw new CLIError('CRITICAL', `Invalid assertion for ${assertionName}: Must be an object`);\n }\n\n if (typeof assertionKey.alg !== 'string') {\n throw new CLIError(\n 'CRITICAL',\n `Invalid assertion for ${assertionName}: Missing or invalid 'key' or 'alg'`\n );\n }\n try {\n u.Keys[assertionName].key = await correctAssertionKeys(assertionKey);\n } catch (err) {\n throw new CLIError('CRITICAL', `Issue converting assertion key from string: ${err.message}`);\n }\n }\n return u;\n}\n\nasync function parseReadOptions(argv: Partial<mainArgs>): Promise<ReadOptions> {\n const r: ReadOptions = { source: await fileAsSource(argv.file as string) };\n if (argv.noVerifyAssertions) {\n r.noVerify = true;\n }\n if (argv.assertionVerificationKeys) {\n r.assertionVerificationKeys = await parseAssertionVerificationKeys(\n argv.assertionVerificationKeys\n );\n }\n if (argv.rewrapKeyType?.length) {\n if (!isPublicKeyAlgorithm(argv.rewrapKeyType)) {\n throw new CLIError('CRITICAL', `Unsupported rewrap key algorithm: [${argv.rewrapKeyType}]`);\n }\n r.wrappingKeyAlgorithm = argv.rewrapKeyType;\n }\n if (argv.concurrencyLimit) {\n r.concurrencyLimit = argv.concurrencyLimit;\n } else {\n r.concurrencyLimit = 100;\n }\n return r;\n}\n\nasync function correctAssertionKeys({\n alg,\n key,\n}: assertions.AssertionKey): Promise<string \| Uint8Array> {\n if (alg === 'HS256') {\n // Convert key string to Uint8Array\n if (typeof key !== 'string') {\n throw new CLIError('CRITICAL', 'HS256 key must be a string');\n }\n return new TextEncoder().encode(key); // Update array element directly\n } else if (alg === 'RS256') {\n // Convert PEM string to a KeyLike object\n if (typeof key !== 'string') {\n throw new CLIError('CRITICAL', 'RS256 key must be a PEM string');\n }\n return key;\n }\n // Otherwise its an unsupported alg\n throw new CLIError('CRITICAL', `Unsupported signing key algorithm: ${alg}`); // Handle unsupported algs\n}\n\nasync function parseAssertionConfig(s: string): Promise<assertions.AssertionConfig[]> {\n let u;\n try {\n u = JSON.parse(s);\n } catch (err) {\n // try as file name:\n try {\n const jsonFile = await openAsBlob(s);\n u = JSON.parse(await jsonFile.text());\n } catch (err2) {\n throw new CLIError(\n 'CRITICAL',\n `Failed to open/parse assertions as string or file path ${err.message} [${err2}]`,\n err\n );\n }\n }\n\n // if u is null or empty, return an empty array\n if (!u) {\n return [];\n }\n const a = Array.isArray(u) ? u : [u];\n for (const assertion of a) {\n if (!assertions.isAssertionConfig(assertion)) {\n throw new CLIError('CRITICAL', `invalid assertion config ${JSON.stringify(assertion)}`);\n }\n if (!assertion.signingKey) {\n continue;\n }\n try {\n assertion.signingKey.key = await correctAssertionKeys(assertion.signingKey);\n } catch (err) {\n throw new CLIError(\n 'CRITICAL',\n `Issue converting assertion key from string: ${err.message}`,\n err\n );\n }\n }\n return a;\n}\n\nasync function parseCreateOptions(argv: Partial<mainArgs>): Promise<CreateOptions> {\n const c: CreateOptions = {\n source: await fileAsSource(argv.file as string),\n };\n if (argv.attributes?.length) {\n c.attributes = argv.attributes.split(',');\n }\n c.autoconfigure = !!argv.autoconfigure;\n return c;\n}\n\nasync function parseCreateTDFOptions(argv: Partial<mainArgs>): Promise<CreateTDFOptions> {\n const c: CreateTDFOptions = await parseCreateOptions(argv);\n if (argv.assertions?.length) {\n c.assertionConfigs = await parseAssertionConfig(argv.assertions);\n }\n if (argv.encapKeyType?.length) {\n if (!isPublicKeyAlgorithm(argv.encapKeyType)) {\n throw new CLIError('CRITICAL', `Unsupported rewrap key algorithm: [${argv.encapKeyType}]`);\n }\n c.wrappingKeyAlgorithm = argv.encapKeyType;\n }\n if (argv.mimeType?.length) {\n if (argv.mimeType && /^[a-z]+\\/[a-z0-9-+.]+$/.test(argv.mimeType)) {\n c.mimeType = argv.mimeType as `${string}/${string}`;\n } else {\n throw new CLIError('CRITICAL', 'Invalid mimeType format');\n }\n }\n if (argv.tdfSpecVersion) {\n c.tdfSpecVersion = argv.tdfSpecVersion as never;\n }\n log('DEBUG', `CreateTDFOptions: ${JSON.stringify(c)}`);\n return c;\n}\n\nasync function fileAsSource(file: string): Promise<Source> {\n if (!file) {\n throw new CLIError('CRITICAL', 'Must specify file or pipe');\n }\n try {\n const stats = await stat(file);\n if (!stats?.isFile()) {\n throw new CLIError('CRITICAL', `File does not exist [${file}]`);\n }\n } catch (e) {\n throw new CLIError('CRITICAL', `File is not accessable [${file}]`, e);\n }\n log('DEBUG', `Using input from file [${file}]`);\n return { type: 'file-browser', location: await openAsBlob(file) };\n}\n\nexport const handleArgs = (args: string[]) => {\n return (\n yargs(args)\n .middleware((argv) => {\n if (argv.silent) {\n log.level = 'CRITICAL';\n } else if (argv.logLevel) {\n const ll = argv.logLevel as string;\n log.level = ll.toUpperCase() as Level;\n }\n })\n .fail((msg, err, yargs) => {\n if (err instanceof CLIError) {\n log(err);\n process.exit(1);\n } else if (err) {\n log(err);\n process.exit(2);\n } else {\n console.error(`${msg}\\n\\n${yargs.help()}`);\n process.exit(1);\n }\n })\n\n // AUTH OPTIONS\n .option('kasEndpoint', {\n group: 'Server Endpoints:',\n type: 'string',\n description: 'URL to non-default KAS instance (https://mykas.net)',\n })\n .option('platformUrl', {\n group: 'Server Endpoints:',\n type: 'string',\n description: 'Location of policy service and KAS (https://opentdf.demo)',\n })\n .option('oidcEndpoint', {\n group: 'Server Endpoints:',\n type: 'string',\n description: 'URL to non-default OIDC IdP (https://myidp.net)',\n })\n .option('policyEndpoint', {\n group: 'Server Endpoints:',\n type: 'string',\n description: 'Attribute and key grant service endpoint',\n })\n .option('allowList', {\n group: 'Security:',\n desc: 'allowed KAS origins, comma separated; defaults to the list from \"/key-access-servers\" endpoint',\n type: 'string',\n validate: (uris: string) => uris.split(','),\n })\n .option('ignoreAllowList', {\n group: 'Security:',\n desc: 'disable KAS allowlist feature for decrypt',\n type: 'boolean',\n })\n .option('noVerifyAssertions', {\n alias: 'no-verify-assertions',\n group: 'Decrypt',\n desc: 'Do not verify assertions',\n type: 'boolean',\n })\n .option('assertionVerificationKeys', {\n alias: 'with-assertion-verification-keys',\n group: 'Decrypt',\n desc: 'keys for assertion verification or path to a json file containing keys for assertion verification',\n type: 'string',\n default: '',\n validate: parseAssertionVerificationKeys,\n })\n .option('concurrencyLimit', {\n alias: 'concurrency-limit',\n group: 'Decrypt',\n desc: 'Enable concurrent key split and share lookups',\n type: 'number',\n })\n .option('auth', {\n group: 'OAuth and OIDC:',\n type: 'string',\n description: 'Combined OAuth Client Credentials (<clientId>:<clientSecret>)',\n })\n .option('dpop', {\n group: 'Security:',\n desc: 'Use DPoP for token binding',\n type: 'boolean',\n })\n .implies('auth', '--no-clientId')\n .implies('auth', '--no-clientSecret')\n\n .option('clientId', {\n group: 'OAuth and OIDC:',\n alias: 'cid',\n type: 'string',\n description: 'OAuth Client Credentials: IdP-issued Client ID',\n })\n .implies('clientId', 'clientSecret')\n\n .option('clientSecret', {\n group: 'OAuth and OIDC:',\n alias: 'cs',\n type: 'string',\n description: 'OAuth Client Credentials: IdP-issued Client Secret',\n })\n .implies('clientSecret', 'clientId')\n\n .option('exchangeToken', {\n group: 'OAuth and OIDC:',\n alias: 'et',\n type: 'string',\n description: 'OAuth Token Exchange: Token issued by trusted external IdP',\n })\n .implies('exchangeToken', 'clientId')\n\n // Examples\n .example('$0 --auth ClientID123:Cli3nt$ecret', '# OIDC client credentials')\n\n .example('$0 --clientId ClientID123 --clientSecret Cli3nt$ecret', '# OIDC client credentials')\n\n // Policy, encryption, and container options\n .options({\n assertions: {\n group: 'Encrypt Options:',\n desc: 'ZTDF assertion config objects or path to a json file containing ZTDF assertion config objects',\n type: 'string',\n default: '',\n validate: parseAssertionConfig,\n },\n attributes: {\n group: 'Encrypt Options:',\n desc: 'Data attributes for the policy',\n type: 'string',\n default: '',\n validate: (attributes: string) => attributes.split(','),\n },\n autoconfigure: {\n group: 'Encrypt Options:',\n desc: 'Enable automatic configuration from attributes using policy service',\n type: 'boolean',\n default: false,\n },\n containerType: {\n group: 'Encrypt Options:',\n alias: 't',\n choices: containerTypes,\n description: 'Container format',\n default: 'ztdf',\n },\n encapKeyType: {\n alias: 'encapsulation-algorithm',\n group: 'Encrypt Options:',\n desc: 'Key type for wrapping keys',\n type: 'string',\n choices: PUBLIC_KEY_ALGORITHMS,\n default: 'rsa:2048',\n },\n mimeType: {\n group: 'Encrypt Options:',\n desc: 'Mime type for the plain text file',\n type: 'string',\n default: '',\n },\n rewrapKeyType: {\n alias: 'rewrap-encapsulation-algorithm',\n group: 'Decrypt Options:',\n desc: 'Key type for rewrap',\n type: 'string',\n choices: PUBLIC_KEY_ALGORITHMS,\n default: 'rsa:2048',\n },\n userId: {\n group: 'Encrypt Options:',\n type: 'string',\n description: 'Owner email address',\n },\n tdfSpecVersion: {\n group: 'Encrypt Options:',\n type: 'string',\n description: 'TDF spec version for file creation',\n default: tdfSpecVersion,\n },\n })\n\n .options({\n logLevel: {\n group: 'Verbosity:',\n alias: 'log-level',\n type: 'string',\n default: 'info',\n desc: 'Set logging level',\n },\n silent: {\n group: 'Verbosity:',\n type: 'boolean',\n default: false,\n desc: 'Disable logging',\n },\n })\n .option('output', {\n type: 'string',\n description: 'output file',\n })\n\n .command(\n 'inspect [file]',\n 'Inspect TDF and extract header information, without decrypting',\n (yargs) => {\n yargs.strict().positional('file', {\n describe: 'path to encrypted file',\n type: 'string',\n });\n },\n async (argv) => {\n log('DEBUG', 'Running inspect command');\n const ct = new OpenTDF({\n platformUrl: argv.platformUrl \|\| guessPolicyUrl(argv),\n authProvider: new InvalidAuthProvider(),\n });\n try {\n const reader = ct.open(await parseReadOptions(argv));\n const manifest = await reader.manifest();\n try {\n const dataAttributes = await reader.attributes();\n console.log(JSON.stringify({ manifest, dataAttributes }, null, 2));\n } catch (err) {\n console.error(err);\n console.log(JSON.stringify({ manifest }, null, 2));\n }\n } finally {\n ct.close();\n }\n }\n )\n\n .command(\n 'decrypt [file]',\n 'Decrypt TDF to string',\n (yargs) => {\n yargs.strict().positional('file', {\n describe: 'path to plain text file',\n type: 'string',\n });\n },\n async (argv) => {\n log('DEBUG', 'Running decrypt command');\n const allowedKases = argv.allowList?.split(',');\n log('DEBUG', `Allowed KASes: ${allowedKases}`);\n const ignoreAllowList = !!argv.ignoreAllowList;\n if (!argv.oidcEndpoint) {\n throw new CLIError('CRITICAL', 'oidcEndpoint must be specified');\n }\n const authProvider = await processAuth(argv);\n log('DEBUG', `Initialized auth provider ${JSON.stringify(authProvider)}`);\n const guessedPolicyEndpoint = guessPolicyUrl(argv);\n const client = new OpenTDF({\n authProvider,\n defaultCreateOptions: {\n defaultKASEndpoint: argv.kasEndpoint,\n },\n defaultReadOptions: {\n allowedKASEndpoints: allowedKases,\n ignoreAllowlist: ignoreAllowList,\n noVerify: !!argv.noVerifyAssertions,\n },\n disableDPoP: !argv.dpop,\n policyEndpoint: guessedPolicyEndpoint,\n platformUrl: argv.platformUrl \|\| guessedPolicyEndpoint,\n });\n try {\n log('SILLY', `Initialized client`);\n log('DEBUG', `About to TDF3 decrypt [${argv.file}]`);\n const ct = await client.read(await parseReadOptions(argv));\n const destination = argv.output ? createWriteStream(argv.output) : process.stdout;\n await ct.pipeTo(Writable.toWeb(destination));\n\n const lastRequest = authProvider.requestLog[authProvider.requestLog.length - 1];\n log('SILLY', `last request is ${JSON.stringify(lastRequest)}`);\n let accessToken = null;\n let dpopToken = null;\n for (const h of Object.keys(lastRequest.headers)) {\n switch (h.toLowerCase()) {\n case 'dpop':\n console.assert(!dpopToken, 'Multiple dpop headers found');\n dpopToken = parseJwtComplete(lastRequest.headers[h]);\n log('INFO', `dpop: ${JSON.stringify(dpopToken)}`);\n break;\n case 'authorization':\n console.assert(!accessToken, 'Multiple authorization headers found');\n accessToken = parseJwt(lastRequest.headers[h].split(' ')[1]);\n log('INFO', `Access Token: ${JSON.stringify(accessToken)}`);\n if (argv.dpop) {\n console.assert(accessToken.cnf?.jkt, 'Access token must have a cnf.jkt');\n }\n break;\n }\n }\n console.assert(accessToken, 'No access_token found');\n console.assert(!argv.dpop \|\| dpopToken, 'DPoP requested but absent');\n } finally {\n client.close();\n }\n }\n )\n .command(\n 'encrypt [file]',\n 'Encrypt file or pipe to a TDF',\n (yargs) => {\n yargs.strict().positional('file', {\n describe: 'path to plain text file',\n type: 'string',\n });\n },\n async (argv) => {\n log('DEBUG', 'Running encrypt command');\n const authProvider = await processAuth(argv);\n log('DEBUG', `Initialized auth provider ${JSON.stringify(authProvider)}`);\n const guessedPolicyEndpoint = guessPolicyUrl(argv);\n\n const client = new OpenTDF({\n authProvider,\n defaultCreateOptions: {\n defaultKASEndpoint: argv.kasEndpoint,\n },\n disableDPoP: !argv.dpop,\n policyEndpoint: guessedPolicyEndpoint,\n platformUrl: argv.platformUrl \|\| guessedPolicyEndpoint,\n });\n try {\n log('SILLY', `Initialized client`);\n log('DEBUG', `TDF Create`);\n const ct: DecoratedStream = await client.createTDF(await parseCreateTDFOptions(argv));\n if (!ct) {\n throw new CLIError('CRITICAL', 'Encrypt configuration error: No output?');\n }\n const destination = argv.output ? createWriteStream(argv.output) : process.stdout;\n await ct.pipeTo(Writable.toWeb(destination));\n } finally {\n client.close();\n }\n }\n )\n .usage('openTDF CLI\\n\\nUsage: $0 [options]')\n .alias('help', 'h')\n .demandCommand()\n .recommendCommands()\n .help('help')\n .options({\n env: {\n desc: 'Set the environment',\n },\n })\n\n .version(\n 'version',\n JSON.stringify({\n '@opentdf/sdk': version,\n tdfSpecVersion,\n })\n )\n .alias('version', 'V')\n .strict()\n .parseAsync()\n );\n};\n\nexport type mainArgs = Awaited<ReturnType<typeof handleArgs>>;\nexport const main = async (argsPromise: mainArgs) => {\n return argsPromise;\n};\n\nhandleArgs(hideBin(process.argv))\n .then(main)\n .then(() => {\n // Nothing;\n })\n .catch((err) => {\n console.error(err);\n });\n\nfunction guessPolicyUrl({\n kasEndpoint,\n policyEndpoint,\n}: {\n kasEndpoint?: string;\n policyEndpoint?: string;\n}): string \| undefined {\n if (policyEndpoint) {\n return rstrip(policyEndpoint, '/');\n }\n if (kasEndpoint) {\n const uNoSlash = rstrip(kasEndpoint, '/');\n return uNoSlash.endsWith('/kas') ? uNoSlash.slice(0, -4) : uNoSlash;\n }\n return undefined;\n}\n"]}
1	+ {"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAOL,aAAa,EACb,OAAO,EACP,cAAc,EACd,OAAO,EAEP,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAS,GAAG,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,UAAU,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAgBhD,MAAM,mBAAmB;IACvB,KAAK,CAAC,qBAAqB,KAAmB,CAAC;IAC/C,SAAS;QACP,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAExC,sFAAsF;AACtF,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC;AAEvD,iFAAiF;AACjF,MAAM,2BAA2B,GAAG,CAAC,CAAU,EAAE,EAAE,CACjD,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAE,CAAY,CAAC;AAE1D,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE;IAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,GAAW,EAAE,EAAE;IACvC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9D,CAAC,CAAC;AAEF,KAAK,UAAU,WAAW,CAAC,EACzB,IAAI,EACJ,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,MAAM,GACQ;IACd,GAAG,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACvC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,gCAAgC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,GAAG,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,oDAAoD,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,SAAS,CAAC;IACvC,CAAC;SAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC;QAC1D,QAAQ;QACR,UAAU,EAAE,YAAY;QACxB,QAAQ,EAAE,QAAQ;QAClB,YAAY;KACb,CAAC,CAAC;IACH,IAAI,gBAAgB,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,UAAU,GAAgC,EAAE,CAAC;IACnD,OAAO;QACL,UAAU;QACV,qBAAqB,EAAE,KAAK,EAAE,UAAmB,EAAE,EAAE;YACnD,MAAM,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;YACzC,GAAG,CAAC,OAAO,EAAE,2BAA2B,UAAU,EAAE,SAAS,GAAG,CAAC,CAAC;QACpE,CAAC;QACD,SAAS,EAAE,KAAK,EAAE,OAAkC,EAAE,EAAE;YACtD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACvC,QAAQ,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC;YAC1B,CAAC;YACD,GAAG,CAAC,OAAO,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC7D,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,MAAM,GAAG,GAAG,EAAU,EAAE;IACnD,OAAO,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,KAAK,UAAU,8BAA8B,CAC3C,CAAS;IAET,IAAI,CAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oBAAoB;QACpB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;YACrC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,2EAA2E,GAAG,CAAC,OAAO,EAAE,EACxF,IAAI,CACL,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,8BAA8B;IAC9B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QACjD,IAAI,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAA+C,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,+DAA+D,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,aAAa,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,YAAY,GAA4B,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACpE,4DAA4D;QAC5D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC9D,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,yBAAyB,aAAa,qBAAqB,CAAC,CAAC;QAC9F,CAAC;QAED,IAAI,OAAO,YAAY,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,yBAAyB,aAAa,qCAAqC,CAC5E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,GAAG,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,+CAA+C,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAuB;IACrD,MAAM,CAAC,GAAgB,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,IAAc,CAAC,EAAE,CAAC;IAC3E,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;IACpB,CAAC;IACD,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACnC,CAAC,CAAC,yBAAyB,GAAG,MAAM,8BAA8B,CAChE,IAAI,CAAC,yBAAyB,CAC/B,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;QAC/B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,sCAAsC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;QAC9F,CAAC;QACD,CAAC,CAAC,oBAAoB,GAAG,IAAI,CAAC,aAAa,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,gBAAgB,GAAG,GAAG,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,EAClC,GAAG,EACH,GAAG,GACqB;IACxB,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,mCAAmC;QACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,gCAAgC;IACxE,CAAC;SAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,yCAAyC;QACzC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,gCAAgC,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,mCAAmC;IACnC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,sCAAsC,GAAG,EAAE,CAAC,CAAC,CAAC,0BAA0B;AACzG,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,CAAS;IAC3C,IAAI,CAAC,CAAC;IACN,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oBAAoB;QACpB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;YACrC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,0DAA0D,GAAG,CAAC,OAAO,KAAK,IAAI,GAAG,EACjF,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,KAAK,MAAM,SAAS,IAAI,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,4BAA4B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,SAAS,CAAC,UAAU,CAAC,GAAG,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,+CAA+C,GAAG,CAAC,OAAO,EAAE,EAC5D,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAuB;IACvD,MAAM,CAAC,GAAkB;QACvB,MAAM,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,IAAc,CAAC;KAChD,CAAC;IACF,IAAI,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC5B,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACvC,OAAO,CAAC,CAAC;AACX,CAAC;AAgBD,SAAS,mBAAmB,CAAC,IAAuB;IAClD,MAAM,CAAC,GAAmB,EAAE,CAAC;IAC7B,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAC9B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,sCAAsC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;QAC7F,CAAC;QACD,CAAC,CAAC,oBAAoB,GAAG,IAAI,CAAC,YAAY,CAAC;IAC7C,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAiC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC,CAAC,cAAc,GAAG,IAAI,CAAC,cAAuB,CAAC;IAClD,CAAC;IACD,IAAI,IAAI,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC;QACxC,2DAA2D;QAC3D,IAAI,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;YAC1D,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,0CAA0C,IAAI,CAAC,sBAAsB,8BAA8B,CACpG,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,sBAAsB,GAAG,OAAO,CAAC;IACrC,CAAC;IACD,IAAI,IAAI,CAAC,yBAAyB,EAAE,MAAM,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,yBAAyB,CAAC,WAAW,EAAE,CAAC;QAChE,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YACpD,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,6CAA6C,IAAI,CAAC,yBAAyB,GAAG,CAC/E,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,yBAAyB,GAAG,UAAU,CAAC;IAC3C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAAuB,EACvB,QAAwB,mBAAmB,CAAC,IAAI,CAAC;IAEjD,MAAM,CAAC,GAAqB,EAAE,GAAG,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;IAC9E,IAAI,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC5B,yEAAyE;QACzE,2CAA2C;QAC3C,CAAC,CAAC,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnE,CAAC;IACD,GAAG,CAAC,OAAO,EAAE,qBAAqB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,wBAAwB,IAAI,GAAG,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,2BAA2B,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,GAAG,CAAC,OAAO,EAAE,0BAA0B,IAAI,GAAG,CAAC,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAc,EAAE,EAAE;IAC3C,OAAO,CACL,KAAK,CAAC,IAAI,CAAC;SACR,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE;QACnB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,GAAG,UAAU,CAAC;QACzB,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,IAAI,CAAC,QAAkB,CAAC;YACnC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,WAAW,EAAW,CAAC;QACxC,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACxB,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,GAAG,CAAC,GAAG,CAAC,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,IAAI,GAAG,EAAE,CAAC;YACf,GAAG,CAAC,GAAG,CAAC,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,OAAO,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;QAEF,eAAe;SACd,MAAM,CAAC,aAAa,EAAE;QACrB,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,qDAAqD;KACnE,CAAC;SACD,MAAM,CAAC,aAAa,EAAE;QACrB,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,2DAA2D;KACzE,CAAC;SACD,MAAM,CAAC,cAAc,EAAE;QACtB,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,iDAAiD;KAC/D,CAAC;SACD,MAAM,CAAC,gBAAgB,EAAE;QACxB,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0CAA0C;KACxD,CAAC;SACD,MAAM,CAAC,WAAW,EAAE;QACnB,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,gGAAgG;QACtG,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;KAC5C,CAAC;SACD,MAAM,CAAC,iBAAiB,EAAE;QACzB,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,2CAA2C;QACjD,IAAI,EAAE,SAAS;KAChB,CAAC;SACD,MAAM,CAAC,oBAAoB,EAAE;QAC5B,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,0BAA0B;QAChC,IAAI,EAAE,SAAS;KAChB,CAAC;SACD,MAAM,CAAC,2BAA2B,EAAE;QACnC,KAAK,EAAE,kCAAkC;QACzC,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,mGAAmG;QACzG,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,8BAA8B;KACzC,CAAC;SACD,MAAM,CAAC,kBAAkB,EAAE;QAC1B,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,+CAA+C;QACrD,IAAI,EAAE,QAAQ;KACf,CAAC;SACD,MAAM,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,iBAAiB;QACxB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,+DAA+D;KAC7E,CAAC;SACD,MAAM,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,4BAA4B;QAClC,IAAI,EAAE,SAAS;KAChB,CAAC;SACD,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC;SAChC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC;SAEpC,MAAM,CAAC,UAAU,EAAE;QAClB,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,gDAAgD;KAC9D,CAAC;SACD,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC;SAEnC,MAAM,CAAC,cAAc,EAAE;QACtB,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,oDAAoD;KAClE,CAAC;SACD,OAAO,CAAC,cAAc,EAAE,UAAU,CAAC;SAEnC,MAAM,CAAC,eAAe,EAAE;QACvB,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,4DAA4D;KAC1E,CAAC;SACD,OAAO,CAAC,eAAe,EAAE,UAAU,CAAC;QAErC,WAAW;SACV,OAAO,CAAC,oCAAoC,EAAE,2BAA2B,CAAC;SAE1E,OAAO,CAAC,uDAAuD,EAAE,2BAA2B,CAAC;QAE9F,4CAA4C;SAC3C,OAAO,CAAC;QACP,UAAU,EAAE;YACV,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,+FAA+F;YACrG,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,oBAAoB;SAC/B;QACD,UAAU,EAAE;YACV,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,gCAAgC;YACtC,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;SACxD;QACD,aAAa,EAAE;YACb,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,qEAAqE;YAC3E,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,KAAK;SACf;QACD,aAAa,EAAE;YACb,KAAK,EAAE,kBAAkB;YACzB,KAAK,EAAE,GAAG;YACV,OAAO,EAAE,cAAc;YACvB,WAAW,EAAE,kBAAkB;YAC/B,OAAO,EAAE,MAAM;SAChB;QACD,YAAY,EAAE;YACZ,KAAK,EAAE,yBAAyB;YAChC,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,qBAAqB;YAC9B,OAAO,EAAE,UAAU;SACpB;QACD,QAAQ,EAAE;YACR,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,mCAAmC;YACzC,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE;SACZ;QACD,sBAAsB,EAAE;YACtB,KAAK,EAAE,0BAA0B;YACjC,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,6EAA6E;YACnF,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,mBAAmB;YAC5B,MAAM,EAAE,2BAA2B;YACnC,OAAO,EAAE,OAAO;SACjB;QACD,yBAAyB,EAAE;YACzB,KAAK,EAAE,6BAA6B;YACpC,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,qCAAqC;YAC3C,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,mBAAmB;YAC5B,MAAM,EAAE,2BAA2B;YACnC,OAAO,EAAE,MAAM;SAChB;QACD,aAAa,EAAE;YACb,KAAK,EAAE,gCAAgC;YACvC,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,qBAAqB;YAC9B,OAAO,EAAE,UAAU;SACpB;QACD,MAAM,EAAE;YACN,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,qBAAqB;SACnC;QACD,cAAc,EAAE;YACd,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,oCAAoC;YACjD,OAAO,EAAE,cAAc;SACxB;KACF,CAAC;SAED,OAAO,CAAC;QACP,QAAQ,EAAE;YACR,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,WAAW;YAClB,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,mBAAmB;SAC1B;QACD,MAAM,EAAE;YACN,KAAK,EAAE,YAAY;YACnB,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,iBAAiB;SACxB;KACF,CAAC;SACD,MAAM,CAAC,QAAQ,EAAE;QAChB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,aAAa;KAC3B,CAAC;SAED,OAAO,CACN,gBAAgB,EAChB,gEAAgE,EAChE,CAAC,KAAK,EAAE,EAAE;QACR,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE;YAChC,QAAQ,EAAE,wBAAwB;YAClC,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;IACL,CAAC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC;YACrB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,cAAc,CAAC,IAAI,CAAC;YACrD,YAAY,EAAE,IAAI,mBAAmB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;gBACjD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CACF;SAEA,OAAO,CACN,gBAAgB,EAChB,uBAAuB,EACvB,CAAC,KAAK,EAAE,EAAE;QACR,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE;YAChC,QAAQ,EAAE,yBAAyB;YACnC,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;IACL,CAAC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAChD,GAAG,CAAC,OAAO,EAAE,kBAAkB,YAAY,EAAE,CAAC,CAAC;QAC/C,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,gCAAgC,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7C,GAAG,CAAC,OAAO,EAAE,6BAA6B,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC1E,MAAM,qBAAqB,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC;YACzB,YAAY;YACZ,oBAAoB,EAAE;gBACpB,kBAAkB,EAAE,IAAI,CAAC,WAAW;aACrC;YACD,kBAAkB,EAAE;gBAClB,mBAAmB,EAAE,YAAY;gBACjC,eAAe,EAAE,eAAe;gBAChC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB;aACpC;YACD,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI;YACvB,cAAc,EAAE,qBAAqB;YACrC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,qBAAqB;SACvD,CAAC,CAAC;QACH,IAAI,CAAC;YACH,GAAG,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YACnC,GAAG,CAAC,OAAO,EAAE,0BAA0B,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YACrD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YAClF,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAE7C,MAAM,WAAW,GAAG,YAAY,CAAC,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAChF,GAAG,CAAC,OAAO,EAAE,mBAAmB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC/D,IAAI,WAAW,GAAG,IAAI,CAAC;YACvB,IAAI,SAAS,GAAG,IAAI,CAAC;YACrB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxB,KAAK,MAAM;wBACT,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;wBAC1D,SAAS,GAAG,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;wBACrD,GAAG,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;wBAClD,MAAM;oBACR,KAAK,eAAe;wBAClB,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,sCAAsC,CAAC,CAAC;wBACrE,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC7D,GAAG,CAAC,MAAM,EAAE,iBAAiB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;wBAC5D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;4BACd,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,kCAAkC,CAAC,CAAC;wBAC3E,CAAC;wBACD,MAAM;gBACV,CAAC;YACH,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;YACrD,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,EAAE,2BAA2B,CAAC,CAAC;QACvE,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,CACF;SACA,OAAO,CACN,gBAAgB,EAChB,+BAA+B,EAC/B,CAAC,KAAK,EAAE,EAAE;QACR,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE;YAChC,QAAQ,EAAE,yBAAyB;YACnC,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;IACL,CAAC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;QACxC,uDAAuD;QACvD,6DAA6D;QAC7D,yCAAyC;QACzC,mDAAmD;QACnD,kDAAkD;QAClD,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,gCAAgC,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACrE,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7C,GAAG,CAAC,OAAO,EAAE,6BAA6B,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC1E,MAAM,qBAAqB,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC;YACzB,YAAY;YACZ,oBAAoB,EAAE;gBACpB,kBAAkB,EAAE,IAAI,CAAC,WAAW;aACrC;YACD,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI;YACvB,cAAc,EAAE,qBAAqB;YACrC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,qBAAqB;SACvD,CAAC,CAAC;QACH,IAAI,CAAC;YACH,GAAG,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YACnC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAC3B,MAAM,EAAE,GAAoB,MAAM,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YAClE,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,yCAAyC,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YAClF,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAC/C,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,CACF;SACA,KAAK,CAAC,oCAAoC,CAAC;SAC3C,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC;SAClB,aAAa,EAAE;SACf,iBAAiB,EAAE;SACnB,IAAI,CAAC,MAAM,CAAC;SACZ,OAAO,CAAC;QACP,GAAG,EAAE;YACH,IAAI,EAAE,qBAAqB;SAC5B;KACF,CAAC;SAED,OAAO,CACN,SAAS,EACT,IAAI,CAAC,SAAS,CAAC;QACb,cAAc,EAAE,OAAO;QACvB,cAAc;KACf,CAAC,CACH;SACA,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC;SACrB,MAAM,EAAE;SACR,UAAU,EAAE,CAChB,CAAC;AACJ,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,WAAqB,EAAE,EAAE;IAClD,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAEF,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9B,IAAI,CAAC,IAAI,CAAC;KACV,IAAI,CAAC,GAAG,EAAE;IACT,WAAW;AACb,CAAC,CAAC;KACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACb,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC,CAAC,CAAC;AAEL,SAAS,cAAc,CAAC,EACtB,WAAW,EACX,cAAc,GAIf;IACC,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["import { createWriteStream, openAsBlob } from 'node:fs';\nimport { stat } from 'node:fs/promises';\nimport { Writable } from 'node:stream';\nimport yargs from 'yargs';\nimport { hideBin } from 'yargs/helpers';\nimport {\n type AuthProvider,\n type CreateOptions,\n type CreateTDFOptions,\n type HttpRequest,\n type ReadOptions,\n type Source,\n AuthProviders,\n version,\n tdfSpecVersion,\n OpenTDF,\n DecoratedStream,\n isPublicKeyAlgorithm,\n PUBLIC_KEY_ALGORITHMS,\n} from '@opentdf/sdk';\nimport { CLIError, Level, log } from './logger.js';\nimport * as assertions from '@opentdf/sdk/assertions';\nimport { base64 } from '@opentdf/sdk/encodings';\nimport { type KeyPair } from '@opentdf/sdk/singlecontainer';\n\ntype AuthToProcess = {\n auth?: string;\n clientId?: string;\n clientSecret?: string;\n concurrencyLimit?: number;\n oidcEndpoint?: string;\n userId?: string;\n};\n\ntype LoggedAuthProvider = AuthProvider & {\n requestLog: HttpRequest[];\n};\n\nclass InvalidAuthProvider {\n async updateClientPublicKey(): Promise<void> {}\n withCreds(): Promise<HttpRequest> {\n throw new Error('Method not implemented.');\n }\n}\n\nconst containerTypes = ['tdf3', 'ztdf'];\n\n/** Accepted values for the two integrity-algorithm flags, lowercase by convention. /\nconst integrityAlgorithms = ['hs256', 'gmac'] as const;\n\n/* Flag values are case-insensitive; normalize before yargs checks `choices`. /\nconst lowercaseIntegrityAlgorithm = (v: unknown) =>\n typeof v === 'string' ? v.toLowerCase() : (v as string);\n\nconst parseJwt = (jwt: string, field = 1) => {\n return JSON.parse(base64.decode(jwt.split('.')[field]));\n};\n\nconst parseJwtComplete = (jwt: string) => {\n return { header: parseJwt(jwt, 0), payload: parseJwt(jwt) };\n};\n\nasync function processAuth({\n auth,\n clientId,\n clientSecret,\n concurrencyLimit,\n oidcEndpoint,\n userId,\n}: AuthToProcess): Promise<LoggedAuthProvider> {\n log('DEBUG', 'Processing auth params');\n if (!oidcEndpoint) {\n throw new CLIError('CRITICAL', 'oidcEndpoint must be specified');\n }\n if (auth) {\n log('DEBUG', 'Processing an auth string');\n const authParts = auth.split(':');\n if (authParts.length !== 2) {\n throw new CLIError('CRITICAL', `Auth expects <clientId>:<clientSecret>, received ${auth}`);\n }\n\n [clientId, clientSecret] = authParts;\n } else if (!clientId \|\| !clientSecret) {\n throw new CLIError(\n 'CRITICAL',\n 'Auth expects clientId and clientSecret, or combined auth param'\n );\n }\n const actual = await AuthProviders.clientSecretAuthProvider({\n clientId,\n oidcOrigin: oidcEndpoint,\n exchange: 'client',\n clientSecret,\n });\n if (concurrencyLimit !== 1) {\n await actual.oidcAuth.get();\n }\n const requestLog: AuthProviders.HttpRequest[] = [];\n return {\n requestLog,\n updateClientPublicKey: async (signingKey: KeyPair) => {\n actual.updateClientPublicKey(signingKey);\n log('DEBUG', `updateClientPublicKey: [${signingKey?.publicKey}]`);\n },\n withCreds: async (httpReq: AuthProviders.HttpRequest) => {\n const credible = await actual.withCreds(httpReq);\n if (userId) {\n const url = new URL(credible.url);\n url.searchParams.set('userId', userId);\n credible.url = url.href;\n }\n log('DEBUG', `HTTP Requesting: ${JSON.stringify(credible)}`);\n requestLog.push(credible);\n return credible;\n },\n };\n}\n\nconst rstrip = (str: string, suffix = ' '): string => {\n while (str && suffix && str.endsWith(suffix)) {\n str = str.slice(0, -suffix.length);\n }\n return str;\n};\n\nasync function parseAssertionVerificationKeys(\n s: string\n): Promise<assertions.AssertionVerificationKeys> {\n let u: assertions.AssertionVerificationKeys;\n try {\n u = JSON.parse(s);\n } catch (err) {\n // try as file name:\n try {\n const jsonFile = await openAsBlob(s);\n u = JSON.parse(await jsonFile.text());\n } catch (err2) {\n throw new CLIError(\n 'CRITICAL',\n `Failed to open/parse assertion verification keys as string or file path ${err.message}`,\n err2\n );\n }\n }\n if (typeof u !== 'object' \|\| u === null) {\n throw new Error('Invalid input: The input must be an object');\n }\n // handle both cases of \"keys\"\n if (!('Keys' in u && typeof u.Keys === 'object')) {\n if ('keys' in u && typeof u.keys === 'object') {\n u.Keys = u.keys as Record<string, assertions.AssertionKey>;\n } else {\n throw new CLIError(\n 'CRITICAL',\n 'Invalid input: invalid structure of assertionVerificationKeys'\n );\n }\n }\n for (const assertionName in u.Keys) {\n const assertionKey: assertions.AssertionKey = u.Keys[assertionName];\n // Ensure each entry has the required 'key' and 'alg' fields\n if (typeof assertionKey !== 'object' \|\| assertionKey === null) {\n throw new CLIError('CRITICAL', `Invalid assertion for ${assertionName}: Must be an object`);\n }\n\n if (typeof assertionKey.alg !== 'string') {\n throw new CLIError(\n 'CRITICAL',\n `Invalid assertion for ${assertionName}: Missing or invalid 'key' or 'alg'`\n );\n }\n try {\n u.Keys[assertionName].key = await correctAssertionKeys(assertionKey);\n } catch (err) {\n throw new CLIError('CRITICAL', `Issue converting assertion key from string: ${err.message}`);\n }\n }\n return u;\n}\n\nasync function parseReadOptions(argv: Partial<mainArgs>): Promise<ReadOptions> {\n const r: ReadOptions = { source: await fileAsSource(argv.file as string) };\n if (argv.noVerifyAssertions) {\n r.noVerify = true;\n }\n if (argv.assertionVerificationKeys) {\n r.assertionVerificationKeys = await parseAssertionVerificationKeys(\n argv.assertionVerificationKeys\n );\n }\n if (argv.rewrapKeyType?.length) {\n if (!isPublicKeyAlgorithm(argv.rewrapKeyType)) {\n throw new CLIError('CRITICAL', `Unsupported rewrap key algorithm: [${argv.rewrapKeyType}]`);\n }\n r.wrappingKeyAlgorithm = argv.rewrapKeyType;\n }\n if (argv.concurrencyLimit) {\n r.concurrencyLimit = argv.concurrencyLimit;\n } else {\n r.concurrencyLimit = 100;\n }\n return r;\n}\n\nasync function correctAssertionKeys({\n alg,\n key,\n}: assertions.AssertionKey): Promise<string \| Uint8Array> {\n if (alg === 'HS256') {\n // Convert key string to Uint8Array\n if (typeof key !== 'string') {\n throw new CLIError('CRITICAL', 'HS256 key must be a string');\n }\n return new TextEncoder().encode(key); // Update array element directly\n } else if (alg === 'RS256') {\n // Convert PEM string to a KeyLike object\n if (typeof key !== 'string') {\n throw new CLIError('CRITICAL', 'RS256 key must be a PEM string');\n }\n return key;\n }\n // Otherwise its an unsupported alg\n throw new CLIError('CRITICAL', `Unsupported signing key algorithm: ${alg}`); // Handle unsupported algs\n}\n\nasync function parseAssertionConfig(s: string): Promise<assertions.AssertionConfig[]> {\n let u;\n try {\n u = JSON.parse(s);\n } catch (err) {\n // try as file name:\n try {\n const jsonFile = await openAsBlob(s);\n u = JSON.parse(await jsonFile.text());\n } catch (err2) {\n throw new CLIError(\n 'CRITICAL',\n `Failed to open/parse assertions as string or file path ${err.message} [${err2}]`,\n err\n );\n }\n }\n\n // if u is null or empty, return an empty array\n if (!u) {\n return [];\n }\n const a = Array.isArray(u) ? u : [u];\n for (const assertion of a) {\n if (!assertions.isAssertionConfig(assertion)) {\n throw new CLIError('CRITICAL', `invalid assertion config ${JSON.stringify(assertion)}`);\n }\n if (!assertion.signingKey) {\n continue;\n }\n try {\n assertion.signingKey.key = await correctAssertionKeys(assertion.signingKey);\n } catch (err) {\n throw new CLIError(\n 'CRITICAL',\n `Issue converting assertion key from string: ${err.message}`,\n err\n );\n }\n }\n return a;\n}\n\nasync function parseCreateOptions(argv: Partial<mainArgs>): Promise<CreateOptions> {\n const c: CreateOptions = {\n source: await fileAsSource(argv.file as string),\n };\n if (argv.attributes?.length) {\n c.attributes = argv.attributes.split(',');\n }\n c.autoconfigure = !!argv.autoconfigure;\n return c;\n}\n\n/\n The subset of `CreateTDFOptions` derived purely from flags -- no filesystem, no\n * network. Split out so `encrypt` can reject a bad flag before it opens anything.\n * Synchronous on purpose: the missing `async` is the contract.\n */\ntype CreateTDFFlags = Pick<\n CreateTDFOptions,\n \| 'wrappingKeyAlgorithm'\n \| 'mimeType'\n \| 'tdfSpecVersion'\n \| 'rootIntegrityAlgorithm'\n \| 'segmentIntegrityAlgorithm'\n>;\n\nfunction parseCreateTDFFlags(argv: Partial<mainArgs>): CreateTDFFlags {\n const c: CreateTDFFlags = {};\n if (argv.encapKeyType?.length) {\n if (!isPublicKeyAlgorithm(argv.encapKeyType)) {\n throw new CLIError('CRITICAL', `Unsupported rewrap key algorithm: [${argv.encapKeyType}]`);\n }\n c.wrappingKeyAlgorithm = argv.encapKeyType;\n }\n if (argv.mimeType?.length) {\n if (argv.mimeType && /^[a-z]+\\/[a-z0-9-+.]+$/.test(argv.mimeType)) {\n c.mimeType = argv.mimeType as `${string}/${string}`;\n } else {\n throw new CLIError('CRITICAL', 'Invalid mimeType format');\n }\n }\n if (argv.tdfSpecVersion) {\n c.tdfSpecVersion = argv.tdfSpecVersion as never;\n }\n if (argv.rootIntegrityAlgorithm?.length) {\n // Only HMAC is supported for the root integrity algorithm.\n if (argv.rootIntegrityAlgorithm.toLowerCase() !== 'hs256') {\n throw new CLIError(\n 'CRITICAL',\n `unsupported root integrity algorithm: [${argv.rootIntegrityAlgorithm}]; only [hs256] is supported`\n );\n }\n c.rootIntegrityAlgorithm = 'HS256';\n }\n if (argv.segmentIntegrityAlgorithm?.length) {\n const segmentAlg = argv.segmentIntegrityAlgorithm.toUpperCase();\n if (segmentAlg !== 'GMAC' && segmentAlg !== 'HS256') {\n throw new CLIError(\n 'CRITICAL',\n `unsupported segment integrity algorithm: [${argv.segmentIntegrityAlgorithm}]`\n );\n }\n c.segmentIntegrityAlgorithm = segmentAlg;\n }\n return c;\n}\n\nasync function parseCreateTDFOptions(\n argv: Partial<mainArgs>,\n flags: CreateTDFFlags = parseCreateTDFFlags(argv)\n): Promise<CreateTDFOptions> {\n const c: CreateTDFOptions = { ...(await parseCreateOptions(argv)), ...flags };\n if (argv.assertions?.length) {\n // Reads from disk (parseAssertionConfig falls back to openAsBlob), so it\n // stays here rather than in the pure pass.\n c.assertionConfigs = await parseAssertionConfig(argv.assertions);\n }\n log('DEBUG', `CreateTDFOptions: ${JSON.stringify(c)}`);\n return c;\n}\n\nasync function fileAsSource(file: string): Promise<Source> {\n if (!file) {\n throw new CLIError('CRITICAL', 'Must specify file or pipe');\n }\n try {\n const stats = await stat(file);\n if (!stats?.isFile()) {\n throw new CLIError('CRITICAL', `File does not exist [${file}]`);\n }\n } catch (e) {\n throw new CLIError('CRITICAL', `File is not accessable [${file}]`, e);\n }\n log('DEBUG', `Using input from file [${file}]`);\n return { type: 'file-browser', location: await openAsBlob(file) };\n}\n\nexport const handleArgs = (args: string[]) => {\n return (\n yargs(args)\n .middleware((argv) => {\n if (argv.silent) {\n log.level = 'CRITICAL';\n } else if (argv.logLevel) {\n const ll = argv.logLevel as string;\n log.level = ll.toUpperCase() as Level;\n }\n })\n .fail((msg, err, yargs) => {\n if (err instanceof CLIError) {\n log(err);\n process.exit(1);\n } else if (err) {\n log(err);\n process.exit(2);\n } else {\n console.error(`${msg}\\n\\n${yargs.help()}`);\n process.exit(1);\n }\n })\n\n // AUTH OPTIONS\n .option('kasEndpoint', {\n group: 'Server Endpoints:',\n type: 'string',\n description: 'URL to non-default KAS instance (https://mykas.net)',\n })\n .option('platformUrl', {\n group: 'Server Endpoints:',\n type: 'string',\n description: 'Location of policy service and KAS (https://opentdf.demo)',\n })\n .option('oidcEndpoint', {\n group: 'Server Endpoints:',\n type: 'string',\n description: 'URL to non-default OIDC IdP (https://myidp.net)',\n })\n .option('policyEndpoint', {\n group: 'Server Endpoints:',\n type: 'string',\n description: 'Attribute and key grant service endpoint',\n })\n .option('allowList', {\n group: 'Security:',\n desc: 'allowed KAS origins, comma separated; defaults to the list from \"/key-access-servers\" endpoint',\n type: 'string',\n validate: (uris: string) => uris.split(','),\n })\n .option('ignoreAllowList', {\n group: 'Security:',\n desc: 'disable KAS allowlist feature for decrypt',\n type: 'boolean',\n })\n .option('noVerifyAssertions', {\n alias: 'no-verify-assertions',\n group: 'Decrypt',\n desc: 'Do not verify assertions',\n type: 'boolean',\n })\n .option('assertionVerificationKeys', {\n alias: 'with-assertion-verification-keys',\n group: 'Decrypt',\n desc: 'keys for assertion verification or path to a json file containing keys for assertion verification',\n type: 'string',\n default: '',\n validate: parseAssertionVerificationKeys,\n })\n .option('concurrencyLimit', {\n alias: 'concurrency-limit',\n group: 'Decrypt',\n desc: 'Enable concurrent key split and share lookups',\n type: 'number',\n })\n .option('auth', {\n group: 'OAuth and OIDC:',\n type: 'string',\n description: 'Combined OAuth Client Credentials (<clientId>:<clientSecret>)',\n })\n .option('dpop', {\n group: 'Security:',\n desc: 'Use DPoP for token binding',\n type: 'boolean',\n })\n .implies('auth', '--no-clientId')\n .implies('auth', '--no-clientSecret')\n\n .option('clientId', {\n group: 'OAuth and OIDC:',\n alias: 'cid',\n type: 'string',\n description: 'OAuth Client Credentials: IdP-issued Client ID',\n })\n .implies('clientId', 'clientSecret')\n\n .option('clientSecret', {\n group: 'OAuth and OIDC:',\n alias: 'cs',\n type: 'string',\n description: 'OAuth Client Credentials: IdP-issued Client Secret',\n })\n .implies('clientSecret', 'clientId')\n\n .option('exchangeToken', {\n group: 'OAuth and OIDC:',\n alias: 'et',\n type: 'string',\n description: 'OAuth Token Exchange: Token issued by trusted external IdP',\n })\n .implies('exchangeToken', 'clientId')\n\n // Examples\n .example('$0 --auth ClientID123:Cli3nt$ecret', '# OIDC client credentials')\n\n .example('$0 --clientId ClientID123 --clientSecret Cli3nt$ecret', '# OIDC client credentials')\n\n // Policy, encryption, and container options\n .options({\n assertions: {\n group: 'Encrypt Options:',\n desc: 'ZTDF assertion config objects or path to a json file containing ZTDF assertion config objects',\n type: 'string',\n default: '',\n validate: parseAssertionConfig,\n },\n attributes: {\n group: 'Encrypt Options:',\n desc: 'Data attributes for the policy',\n type: 'string',\n default: '',\n validate: (attributes: string) => attributes.split(','),\n },\n autoconfigure: {\n group: 'Encrypt Options:',\n desc: 'Enable automatic configuration from attributes using policy service',\n type: 'boolean',\n default: false,\n },\n containerType: {\n group: 'Encrypt Options:',\n alias: 't',\n choices: containerTypes,\n description: 'Container format',\n default: 'ztdf',\n },\n encapKeyType: {\n alias: 'encapsulation-algorithm',\n group: 'Encrypt Options:',\n desc: 'Key type for wrapping keys',\n type: 'string',\n choices: PUBLIC_KEY_ALGORITHMS,\n default: 'rsa:2048',\n },\n mimeType: {\n group: 'Encrypt Options:',\n desc: 'Mime type for the plain text file',\n type: 'string',\n default: '',\n },\n rootIntegrityAlgorithm: {\n alias: 'root-integrity-algorithm',\n group: 'Encrypt Options:',\n desc: 'Algorithm for the root signature. Only hs256 is supported; gmac is rejected',\n type: 'string',\n choices: integrityAlgorithms,\n coerce: lowercaseIntegrityAlgorithm,\n default: 'hs256',\n },\n segmentIntegrityAlgorithm: {\n alias: 'segment-integrity-algorithm',\n group: 'Encrypt Options:',\n desc: 'Algorithm for per-segment integrity',\n type: 'string',\n choices: integrityAlgorithms,\n coerce: lowercaseIntegrityAlgorithm,\n default: 'gmac',\n },\n rewrapKeyType: {\n alias: 'rewrap-encapsulation-algorithm',\n group: 'Decrypt Options:',\n desc: 'Key type for rewrap',\n type: 'string',\n choices: PUBLIC_KEY_ALGORITHMS,\n default: 'rsa:2048',\n },\n userId: {\n group: 'Encrypt Options:',\n type: 'string',\n description: 'Owner email address',\n },\n tdfSpecVersion: {\n group: 'Encrypt Options:',\n type: 'string',\n description: 'TDF spec version for file creation',\n default: tdfSpecVersion,\n },\n })\n\n .options({\n logLevel: {\n group: 'Verbosity:',\n alias: 'log-level',\n type: 'string',\n default: 'info',\n desc: 'Set logging level',\n },\n silent: {\n group: 'Verbosity:',\n type: 'boolean',\n default: false,\n desc: 'Disable logging',\n },\n })\n .option('output', {\n type: 'string',\n description: 'output file',\n })\n\n .command(\n 'inspect [file]',\n 'Inspect TDF and extract header information, without decrypting',\n (yargs) => {\n yargs.strict().positional('file', {\n describe: 'path to encrypted file',\n type: 'string',\n });\n },\n async (argv) => {\n log('DEBUG', 'Running inspect command');\n const ct = new OpenTDF({\n platformUrl: argv.platformUrl \|\| guessPolicyUrl(argv),\n authProvider: new InvalidAuthProvider(),\n });\n try {\n const reader = ct.open(await parseReadOptions(argv));\n const manifest = await reader.manifest();\n try {\n const dataAttributes = await reader.attributes();\n console.log(JSON.stringify({ manifest, dataAttributes }, null, 2));\n } catch (err) {\n console.error(err);\n console.log(JSON.stringify({ manifest }, null, 2));\n }\n } finally {\n ct.close();\n }\n }\n )\n\n .command(\n 'decrypt [file]',\n 'Decrypt TDF to string',\n (yargs) => {\n yargs.strict().positional('file', {\n describe: 'path to plain text file',\n type: 'string',\n });\n },\n async (argv) => {\n log('DEBUG', 'Running decrypt command');\n const allowedKases = argv.allowList?.split(',');\n log('DEBUG', `Allowed KASes: ${allowedKases}`);\n const ignoreAllowList = !!argv.ignoreAllowList;\n if (!argv.oidcEndpoint) {\n throw new CLIError('CRITICAL', 'oidcEndpoint must be specified');\n }\n const authProvider = await processAuth(argv);\n log('DEBUG', `Initialized auth provider ${JSON.stringify(authProvider)}`);\n const guessedPolicyEndpoint = guessPolicyUrl(argv);\n const client = new OpenTDF({\n authProvider,\n defaultCreateOptions: {\n defaultKASEndpoint: argv.kasEndpoint,\n },\n defaultReadOptions: {\n allowedKASEndpoints: allowedKases,\n ignoreAllowlist: ignoreAllowList,\n noVerify: !!argv.noVerifyAssertions,\n },\n disableDPoP: !argv.dpop,\n policyEndpoint: guessedPolicyEndpoint,\n platformUrl: argv.platformUrl \|\| guessedPolicyEndpoint,\n });\n try {\n log('SILLY', `Initialized client`);\n log('DEBUG', `About to TDF3 decrypt [${argv.file}]`);\n const ct = await client.read(await parseReadOptions(argv));\n const destination = argv.output ? createWriteStream(argv.output) : process.stdout;\n await ct.pipeTo(Writable.toWeb(destination));\n\n const lastRequest = authProvider.requestLog[authProvider.requestLog.length - 1];\n log('SILLY', `last request is ${JSON.stringify(lastRequest)}`);\n let accessToken = null;\n let dpopToken = null;\n for (const h of Object.keys(lastRequest.headers)) {\n switch (h.toLowerCase()) {\n case 'dpop':\n console.assert(!dpopToken, 'Multiple dpop headers found');\n dpopToken = parseJwtComplete(lastRequest.headers[h]);\n log('INFO', `dpop: ${JSON.stringify(dpopToken)}`);\n break;\n case 'authorization':\n console.assert(!accessToken, 'Multiple authorization headers found');\n accessToken = parseJwt(lastRequest.headers[h].split(' ')[1]);\n log('INFO', `Access Token: ${JSON.stringify(accessToken)}`);\n if (argv.dpop) {\n console.assert(accessToken.cnf?.jkt, 'Access token must have a cnf.jkt');\n }\n break;\n }\n }\n console.assert(accessToken, 'No access_token found');\n console.assert(!argv.dpop \|\| dpopToken, 'DPoP requested but absent');\n } finally {\n client.close();\n }\n }\n )\n .command(\n 'encrypt [file]',\n 'Encrypt file or pipe to a TDF',\n (yargs) => {\n yargs.strict().positional('file', {\n describe: 'path to plain text file',\n type: 'string',\n });\n },\n async (argv) => {\n log('DEBUG', 'Running encrypt command');\n // Order is deliberate and covered by bin/opentdf.bats:\n // 1. pure flag checks -- no I/O, so a typo fails instantly\n // 2. oidcEndpoint, mirroring `decrypt`\n // 3. open the input file and any assertion files\n // 4. the auth provider, which may reach the IdP\n const createFlags = parseCreateTDFFlags(argv);\n if (!argv.oidcEndpoint) {\n throw new CLIError('CRITICAL', 'oidcEndpoint must be specified');\n }\n const createOptions = await parseCreateTDFOptions(argv, createFlags);\n const authProvider = await processAuth(argv);\n log('DEBUG', `Initialized auth provider ${JSON.stringify(authProvider)}`);\n const guessedPolicyEndpoint = guessPolicyUrl(argv);\n\n const client = new OpenTDF({\n authProvider,\n defaultCreateOptions: {\n defaultKASEndpoint: argv.kasEndpoint,\n },\n disableDPoP: !argv.dpop,\n policyEndpoint: guessedPolicyEndpoint,\n platformUrl: argv.platformUrl \|\| guessedPolicyEndpoint,\n });\n try {\n log('SILLY', `Initialized client`);\n log('DEBUG', `TDF Create`);\n const ct: DecoratedStream = await client.createTDF(createOptions);\n if (!ct) {\n throw new CLIError('CRITICAL', 'Encrypt configuration error: No output?');\n }\n const destination = argv.output ? createWriteStream(argv.output) : process.stdout;\n await ct.pipeTo(Writable.toWeb(destination));\n } finally {\n client.close();\n }\n }\n )\n .usage('openTDF CLI\\n\\nUsage: $0 [options]')\n .alias('help', 'h')\n .demandCommand()\n .recommendCommands()\n .help('help')\n .options({\n env: {\n desc: 'Set the environment',\n },\n })\n\n .version(\n 'version',\n JSON.stringify({\n '@opentdf/sdk': version,\n tdfSpecVersion,\n })\n )\n .alias('version', 'V')\n .strict()\n .parseAsync()\n );\n};\n\nexport type mainArgs = Awaited<ReturnType<typeof handleArgs>>;\nexport const main = async (argsPromise: mainArgs) => {\n return argsPromise;\n};\n\nhandleArgs(hideBin(process.argv))\n .then(main)\n .then(() => {\n // Nothing;\n })\n .catch((err) => {\n console.error(err);\n });\n\nfunction guessPolicyUrl({\n kasEndpoint,\n policyEndpoint,\n}: {\n kasEndpoint?: string;\n policyEndpoint?: string;\n}): string \| undefined {\n if (policyEndpoint) {\n return rstrip(policyEndpoint, '/');\n }\n if (kasEndpoint) {\n const uNoSlash = rstrip(kasEndpoint, '/');\n return uNoSlash.endsWith('/kas') ? uNoSlash.slice(0, -4) : uNoSlash;\n }\n return undefined;\n}\n"]}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@opentdf/ctl",
-  "version": "0.20.0-beta.202",
+  "version": "0.20.0-beta.203",
   "description": "Node based CLI for opentdf",
   "repository": {
     "type": "git",
@@ -55,7 +55,7 @@
     "diff": "^8.0.3"
   },
   "dependencies": {
-    "@opentdf/sdk": "^0.20.0-beta.202",
+    "@opentdf/sdk": "^0.20.0-beta.203",
     "yargs": "^18.0.0"
   }
 }