@paniniapi/forensics 0.0.0-stage → 0.1.0

package/dist/pdf/content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.js","sourceRoot":"","sources":["../../src/pdf/content.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAkCH,8CA2CC;AA3ED;;;;;GAKG;AAEH,gDAA2E;AAG3E,MAAM,KAAK,GAAG,CAAC,CAAC;AAChB,MAAM,KAAK,GAAG,CAAC,CAAC;AAEhB,SAAS,gBAAgB,CAAC,SAAiC;IACzD,MAAM,IAAI,GAAiC,EAAE,CAAC;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;YACxB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;YACxB,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;gBAAE,SAAS;YAChC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK;gBAAE,SAAS;YACzE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;gBAAE,SAAS,CAAC,sCAAsC;YACvE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,GAAe;IAC/C,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAElD,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC/D,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,oBAAoB;YAC5B,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,GAAG,SAAS,0FAA0F;YAC/G,QAAQ,EAAE,0BAA0B,SAAS,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,SAAiC,CAAC;IACtC,IAAI,CAAC;QACH,SAAS,GAAG,IAAA,6BAAmB,EAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,wBAAwB;YAChC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,6DAA6D;YACtE,QAAQ,EAAE,4BAA4B;SACvC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI;aAChB,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;aACpF,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,sBAAsB;YAC9B,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,oEAAoE;YAC3F,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/pdf/signature.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Copyright 2026 Kapil — Project Panini Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * PDF digital-signature validation (ISO 32000 / RFC 5652 CMS).
+ *
+ * For every `/ByteRange`+`/Contents` signature field:
+ *   1. bytes outside the signed ranges → post-sign modification;
+ *   2. hash the signed byte ranges → compare to the CMS `messageDigest`
+ *      signed attribute → proves the exact bytes the signer saw;
+ *   3. verify the signerInfo signature over signedAttrs with the
+ *      signer's certificate public key (node:crypto, PKCS#1 v1.5 RSA or
+ *      ECDSA-DER);
+ *   4. walk the embedded certificate chain to a caller-supplied trust
+ *      anchor (CCA-India roots or a bank CA loaded by the integrator).
+ */
+import * as crypto from 'node:crypto';
+import type { SignatureCheck } from '../types';
+export interface SignatureOptions {
+    /** Trust anchors as PEM strings or X509Certificate objects. */
+    readonly trustStore?: readonly (string | crypto.X509Certificate)[];
+}
+/**
+ * Validate every signature in the PDF. Never throws — errors land in
+ * `check.errors` and the check's validity fields stay null.
+ */
+export declare function verifyPdfSignatures(pdf: Uint8Array, opts?: SignatureOptions): readonly SignatureCheck[];
+//# sourceMappingURL=signature.d.ts.map

package/dist/pdf/signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../../src/pdf/signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAStC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAoK/C,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;CACpE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,gBAAqB,GAC1B,SAAS,cAAc,EAAE,CAI3B"}

package/dist/pdf/signature.js

@@ -0,0 +1,351 @@
+"use strict";
+/**
+ * Copyright 2026 Kapil — Project Panini Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyPdfSignatures = verifyPdfSignatures;
+/**
+ * PDF digital-signature validation (ISO 32000 / RFC 5652 CMS).
+ *
+ * For every `/ByteRange`+`/Contents` signature field:
+ *   1. bytes outside the signed ranges → post-sign modification;
+ *   2. hash the signed byte ranges → compare to the CMS `messageDigest`
+ *      signed attribute → proves the exact bytes the signer saw;
+ *   3. verify the signerInfo signature over signedAttrs with the
+ *      signer's certificate public key (node:crypto, PKCS#1 v1.5 RSA or
+ *      ECDSA-DER);
+ *   4. walk the embedded certificate chain to a caller-supplied trust
+ *      anchor (CCA-India roots or a bank CA loaded by the integrator).
+ */
+const crypto = __importStar(require("node:crypto"));
+const asn1_1 = require("../asn1");
+const LATIN1 = 'latin1';
+const OID = {
+    signedData: '1.2.840.113549.1.2.1',
+    messageDigest: '1.2.840.113549.1.9.4',
+    signingTime: '1.2.840.113549.1.9.5',
+};
+const DIGEST_OID_TO_NODE = {
+    '1.3.14.3.2.26': 'sha1',
+    '2.16.840.1.101.3.4.2.1': 'sha256',
+    '2.16.840.1.101.3.4.2.2': 'sha384',
+    '2.16.840.1.101.3.4.2.3': 'sha512',
+    '2.16.840.1.101.3.4.2.4': 'sha224',
+};
+const SIG_OID = {
+    '1.2.840.113549.1.1.5': { hash: 'sha1', kind: 'rsa' },
+    '1.2.840.113549.1.1.11': { hash: 'sha256', kind: 'rsa' },
+    '1.2.840.113549.1.1.12': { hash: 'sha384', kind: 'rsa' },
+    '1.2.840.113549.1.1.13': { hash: 'sha512', kind: 'rsa' },
+    '1.2.840.10045.4.3.2': { hash: 'sha256', kind: 'ecdsa' },
+    '1.2.840.10045.4.3.3': { hash: 'sha384', kind: 'ecdsa' },
+    '1.2.840.10045.4.3.4': { hash: 'sha512', kind: 'ecdsa' },
+};
+function findSigFields(latin) {
+    const out = [];
+    const re = /\/ByteRange\s*\[\s*(\d+)\s+(\d+)\s+(\d+)\s+(\d+)\s*\]/g;
+    let m;
+    while ((m = re.exec(latin)) !== null) {
+        // /Contents is the nearest hex string after ByteRange within the sig
+        // dict. CMS blobs are zero-padded — the hex span can be tens of KB.
+        const after = latin.slice(m.index, m.index + (1 << 18));
+        const cm = /\/Contents\s*<([0-9a-fA-F\s]*)>/.exec(after);
+        if (cm === null)
+            continue;
+        const contents = Buffer.from(cm[1].replace(/\s/g, ''), 'hex');
+        const nm = /\/Name\s*\(([^)]*)\)/.exec(after);
+        out.push({
+            byteRange: [Number(m[1]), Number(m[2]), Number(m[3]), Number(m[4])],
+            contents,
+            name: nm !== null ? nm[1] : null,
+        });
+    }
+    return out;
+}
+/** SET OF header (universal 17, constructed) wrapping signedAttrs content —
+ * CMS signs the attrs re-tagged as SET OF, not the [0] context form. */
+function setOfWrap(content) {
+    const len = content.length;
+    let header;
+    if (len < 0x80)
+        header = Buffer.from([0x31, len]);
+    else if (len < 0x100)
+        header = Buffer.from([0x31, 0x81, len]);
+    else
+        header = Buffer.from([0x31, 0x82, len >> 8, len & 0xff]);
+    return Buffer.concat([header, Buffer.from(content)]);
+}
+function parseSignerInfo(si) {
+    let cursor = 1; // skip version
+    const sid = si.children[cursor];
+    let issuerName = null;
+    let serial = null;
+    if (sid.tagClass === 0 && sid.tagNumber === 16) {
+        // issuerAndSerialNumber
+        issuerName = (0, asn1_1.stringValue)(sid.children[0] ?? sid).slice(0, 200);
+        const serialNode = (0, asn1_1.universal)(sid, 2);
+        serial = serialNode ? intLike(serialNode) : null;
+    }
+    cursor++;
+    const digestOid = (0, asn1_1.oidValue)((0, asn1_1.universal)(si.children[cursor], 6) ?? si.children[cursor]);
+    const digestAlg = DIGEST_OID_TO_NODE[digestOid] ?? digestOid;
+    cursor++;
+    // optional signedAttrs [0]
+    let signedAttrsRaw = null;
+    let messageDigest = null;
+    let signingTime = null;
+    if (si.children[cursor].tagClass === 2 && si.children[cursor].tagNumber === 0) {
+        const attrs = si.children[cursor];
+        signedAttrsRaw = setOfWrap(attrs.content);
+        for (const attr of attrs.children) {
+            const oid = attr.children[0] ? (0, asn1_1.oidValue)(attr.children[0]) : '';
+            const valSet = attr.children[1];
+            const first = valSet?.children[0];
+            if (oid === OID.messageDigest && first !== undefined)
+                messageDigest = Buffer.from(first.content);
+            if (oid === OID.signingTime && first !== undefined)
+                signingTime = (0, asn1_1.stringValue)(first);
+        }
+        cursor++;
+    }
+    const sigAlgOid = (0, asn1_1.oidValue)((0, asn1_1.universal)(si.children[cursor], 6) ?? si.children[cursor]);
+    cursor++;
+    const signature = Buffer.from(si.children[cursor].content);
+    if (signedAttrsRaw === null)
+        throw new asn1_1.Asn1Error('signerInfo has no signedAttrs — non-CMS form');
+    return {
+        digestAlg,
+        sigAlgOid,
+        signature,
+        signedAttrsRaw,
+        messageDigest,
+        signingTime,
+        issuerName,
+        serial,
+    };
+}
+function intLike(node) {
+    let v = 0n;
+    for (const b of node.content)
+        v = (v << 8n) | BigInt(b);
+    return v;
+}
+function parseCms(der) {
+    const contentInfo = (0, asn1_1.parseDerPadded)(der);
+    const typeOid = (0, asn1_1.oidValue)(contentInfo.children[0]);
+    if (typeOid !== OID.signedData) {
+        throw new asn1_1.Asn1Error(`content type ${typeOid} — not signedData (timestamp-only or enveloped)`);
+    }
+    const signedData = contentInfo.children[1].children[0]; // [0] EXPLICIT
+    const certs = [];
+    let signerInfos;
+    for (const c of signedData.children) {
+        if (c.tagClass === 2 && c.tagNumber === 0) {
+            // certificates [0] IMPLICIT SET — children are cert SEQUENCES
+            for (const certNode of c.children) {
+                try {
+                    certs.push(new crypto.X509Certificate(Buffer.from(certNode.tlv)));
+                }
+                catch {
+                    /* attribute certs / non-X509 entries — skip */
+                }
+            }
+        }
+        if (c.tagClass === 0 && c.tagNumber === 17)
+            signerInfos = c; // SET OF SignerInfo
+    }
+    if (signerInfos === undefined || signerInfos.children.length === 0) {
+        throw new asn1_1.Asn1Error('CMS signedData carries no signerInfos');
+    }
+    return { signer: parseSignerInfo(signerInfos.children[0]), certs };
+}
+/**
+ * Validate every signature in the PDF. Never throws — errors land in
+ * `check.errors` and the check's validity fields stay null.
+ */
+function verifyPdfSignatures(pdf, opts = {}) {
+    const latin = Buffer.from(pdf).toString(LATIN1);
+    const fields = findSigFields(latin);
+    return fields.map((f) => checkOne(pdf, f, opts));
+}
+function checkOne(pdf, f, opts) {
+    const errors = [];
+    let postSignBytes = false;
+    let digestValid = null;
+    let signatureValid = null;
+    let chainTrusted = null;
+    const [o1, l1, o2, l2] = f.byteRange;
+    if (o2 + l2 < pdf.length) {
+        postSignBytes = true;
+        errors.push(`${pdf.length - (o2 + l2)} byte(s) after the signed ByteRange`);
+    }
+    let cms;
+    try {
+        cms = parseCms(new Uint8Array(f.contents));
+    }
+    catch (e) {
+        errors.push(`CMS parse failed: ${e instanceof Error ? e.message : String(e)}`);
+        return {
+            present: true,
+            fieldName: f.name,
+            signer: null,
+            signTime: null,
+            digestValid,
+            signatureValid,
+            chainTrusted,
+            postSignBytes,
+            errors,
+        };
+    }
+    const { signer, certs } = cms;
+    const signTime = signer.signingTime;
+    const signerCert = pickSignerCert(certs, signer);
+    const signerName = signerCert?.subject?.match(/CN=([^\n]+)/)?.[1]?.trim() ?? null;
+    // (b) byte-range digest vs messageDigest signed attribute.
+    const nodeHash = DIGEST_OID_TO_NODE[signer.digestAlg] ?? signer.digestAlg;
+    try {
+        const h = crypto.createHash(nodeHash);
+        h.update(pdf.subarray(o1, o1 + l1));
+        h.update(pdf.subarray(o2, o2 + l2));
+        const computed = h.digest();
+        if (signer.messageDigest === null) {
+            errors.push('signedAttrs carry no messageDigest — cannot bind signature to bytes');
+        }
+        else {
+            digestValid = computed.equals(signer.messageDigest);
+            if (!digestValid)
+                errors.push('messageDigest mismatch — signed bytes were altered');
+        }
+    }
+    catch (e) {
+        errors.push(`digest failed (${nodeHash}): ${e instanceof Error ? e.message : String(e)}`);
+    }
+    // (c) cryptographic signature over signedAttrs.
+    if (signerCert === null) {
+        errors.push('no signer certificate embedded');
+    }
+    else {
+        const alg = SIG_OID[signer.sigAlgOid];
+        if (alg === undefined) {
+            errors.push(`unsupported signature algorithm ${signer.sigAlgOid} (e.g. RSA-PSS)`);
+        }
+        else {
+            try {
+                const key = alg.kind === 'ecdsa'
+                    ? { key: signerCert.publicKey, dsaEncoding: 'der' }
+                    : { key: signerCert.publicKey };
+                signatureValid = crypto.verify(alg.hash, signer.signedAttrsRaw, key, signer.signature);
+                if (!signatureValid)
+                    errors.push('signature does not verify over signedAttrs');
+            }
+            catch (e) {
+                errors.push(`verify failed: ${e instanceof Error ? e.message : String(e)}`);
+            }
+        }
+    }
+    // (d) chain to caller trust anchor.
+    if (opts.trustStore !== undefined && opts.trustStore.length > 0 && signerCert !== null) {
+        chainTrusted = chainToAnchor(signerCert, certs, opts.trustStore, errors);
+    }
+    return {
+        present: true,
+        fieldName: f.name,
+        signer: signerName,
+        signTime,
+        digestValid,
+        signatureValid,
+        chainTrusted,
+        postSignBytes,
+        errors,
+    };
+}
+function pickSignerCert(certs, signer) {
+    if (certs.length === 0)
+        return null;
+    // Match issuerAndSerialNumber when present; else the only leaf.
+    if (signer.serial !== null) {
+        const hit = certs.find((c) => c.serialNumber !== '' && BigInt(`0x${c.serialNumber}`) === signer.serial);
+        if (hit !== undefined)
+            return hit;
+    }
+    return certs[0] ?? null;
+}
+/** Walk issuer links among embedded certs; anchor must be in trustStore. */
+function chainToAnchor(leaf, pool, trustStore, errors) {
+    const anchors = [];
+    for (const t of trustStore) {
+        try {
+            anchors.push(typeof t === 'string' ? new crypto.X509Certificate(t) : t);
+        }
+        catch {
+            errors.push('unparsable trust anchor skipped');
+        }
+    }
+    const trustedFp = new Set(anchors.map((a) => a.fingerprint256));
+    let cur = leaf;
+    for (let depth = 0; depth < 8; depth++) {
+        if (trustedFp.has(cur.fingerprint256))
+            return true;
+        const issuer = pool.find((c) => c.subject === cur.issuer && c !== cur) ?? cur;
+        if (issuer === cur)
+            break; // self-signed, not trusted
+        try {
+            if (!cur.verify(issuer.publicKey)) {
+                errors.push(`chain link failed: ${cur.subject.slice(0, 60)} not signed by issuer`);
+                return false;
+            }
+        }
+        catch (e) {
+            errors.push(`chain verify error: ${e instanceof Error ? e.message : String(e)}`);
+            return false;
+        }
+        cur = issuer;
+    }
+    return false;
+}
+//# sourceMappingURL=signature.js.map

package/dist/pdf/signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.js","sourceRoot":"","sources":["../../src/pdf/signature.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsMH,kDAOC;AA3MD;;;;;;;;;;;;GAYG;AAEH,oDAAsC;AACtC,kCAOiB;AAGjB,MAAM,MAAM,GAAG,QAAQ,CAAC;AAExB,MAAM,GAAG,GAAG;IACV,UAAU,EAAE,sBAAsB;IAClC,aAAa,EAAE,sBAAsB;IACrC,WAAW,EAAE,sBAAsB;CAC3B,CAAC;AAEX,MAAM,kBAAkB,GAAqC;IAC3D,eAAe,EAAE,MAAM;IACvB,wBAAwB,EAAE,QAAQ;IAClC,wBAAwB,EAAE,QAAQ;IAClC,wBAAwB,EAAE,QAAQ;IAClC,wBAAwB,EAAE,QAAQ;CACnC,CAAC;AAEF,MAAM,OAAO,GAAsE;IACjF,sBAAsB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE;IACrD,uBAAuB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;IACxD,uBAAuB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;IACxD,uBAAuB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;IACxD,qBAAqB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE;IACxD,qBAAqB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE;IACxD,qBAAqB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE;CACzD,CAAC;AAQF,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,MAAM,EAAE,GAAG,wDAAwD,CAAC;IACpE,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrC,qEAAqE;QACrE,oEAAoE;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC;YACP,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnE,QAAQ;YACR,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI;SAClC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;wEACwE;AACxE,SAAS,SAAS,CAAC,OAAmB;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,IAAI,MAAc,CAAC;IACnB,IAAI,GAAG,GAAG,IAAI;QAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;SAC7C,IAAI,GAAG,GAAG,KAAK;QAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;;QACzD,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAaD,SAAS,eAAe,CAAC,EAAY;IACnC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,eAAe;IAC/B,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAE,CAAC;IACjC,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,GAAG,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QAC/C,wBAAwB;QACxB,UAAU,GAAG,IAAA,kBAAW,EAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,IAAA,gBAAS,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IACD,MAAM,EAAE,CAAC;IACT,MAAM,SAAS,GAAG,IAAA,eAAQ,EAAC,IAAA,gBAAS,EAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAE,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;IAC7D,MAAM,EAAE,CAAC;IACT,2BAA2B;IAC3B,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAE,CAAC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAE,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QAChF,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAE,CAAC;QACnC,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,eAAQ,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,KAAK,GAAG,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,GAAG,KAAK,GAAG,CAAC,aAAa,IAAI,KAAK,KAAK,SAAS;gBAClD,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,GAAG,KAAK,GAAG,CAAC,WAAW,IAAI,KAAK,KAAK,SAAS;gBAAE,WAAW,GAAG,IAAA,kBAAW,EAAC,KAAK,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,EAAE,CAAC;IACX,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,eAAQ,EAAC,IAAA,gBAAS,EAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAE,CAAC,CAAC;IACvF,MAAM,EAAE,CAAC;IACT,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAE,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,cAAc,KAAK,IAAI;QAAE,MAAM,IAAI,gBAAS,CAAC,8CAA8C,CAAC,CAAC;IACjG,OAAO;QACL,SAAS;QACT,SAAS;QACT,SAAS;QACT,cAAc;QACd,aAAa;QACb,WAAW;QACX,UAAU;QACV,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,IAAc;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,CAAC;AACX,CAAC;AAOD,SAAS,QAAQ,CAAC,GAAe;IAC/B,MAAM,WAAW,GAAG,IAAA,qBAAc,EAAC,GAAG,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAA,eAAQ,EAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC;IACnD,IAAI,OAAO,KAAK,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,gBAAS,CAAC,gBAAgB,OAAO,iDAAiD,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,eAAe;IACzE,MAAM,KAAK,GAA6B,EAAE,CAAC;IAC3C,IAAI,WAAiC,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;YAC1C,8DAA8D;YAC9D,KAAK,MAAM,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACpE,CAAC;gBAAC,MAAM,CAAC;oBACP,+CAA+C;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,EAAE;YAAE,WAAW,GAAG,CAAC,CAAC,CAAC,oBAAoB;IACnF,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,gBAAS,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AACtE,CAAC;AAOD;;;GAGG;AACH,SAAgB,mBAAmB,CACjC,GAAe,EACf,OAAyB,EAAE;IAE3B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAe,EAAE,CAAW,EAAE,IAAsB;IACpE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,WAAW,GAAmB,IAAI,CAAC;IACvC,IAAI,cAAc,GAAmB,IAAI,CAAC;IAC1C,IAAI,YAAY,GAAmB,IAAI,CAAC;IAExC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;IACrC,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACzB,aAAa,GAAG,IAAI,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,GAAc,CAAC;IACnB,IAAI,CAAC;QACH,GAAG,GAAG,QAAQ,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,CAAC,CAAC,IAAI;YACjB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,IAAI;YACd,WAAW;YACX,cAAc;YACd,YAAY;YACZ,aAAa;YACb,MAAM;SACP,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC;IAEpC,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAElF,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QACrF,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACpD,IAAI,CAAC,WAAW;gBAAE,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,kBAAkB,QAAQ,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,gDAAgD;IAChD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,mCAAmC,MAAM,CAAC,SAAS,iBAAiB,CAAC,CAAC;QACpF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,GAAG,GACP,GAAG,CAAC,IAAI,KAAK,OAAO;oBAClB,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE;oBACnD,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;gBACpC,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;gBACvF,IAAI,CAAC,cAAc;oBAAE,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACvF,YAAY,GAAG,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,CAAC,CAAC,IAAI;QACjB,MAAM,EAAE,UAAU;QAClB,QAAQ;QACR,WAAW;QACX,cAAc;QACd,YAAY;QACZ,aAAa;QACb,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,KAAwC,EACxC,MAAkB;IAElB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,gEAAgE;IAChE,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAChF,CAAC;QACF,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC;IACpC,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC1B,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CACpB,IAA4B,EAC5B,IAAuC,EACvC,UAAwD,EACxD,MAAgB;IAEhB,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IAChE,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC;QAC9E,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM,CAAC,2BAA2B;QACtD,IAAI,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,sBAAsB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC;gBACnF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/pdf/structure.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Copyright 2026 Kapil — Project Panini Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Raw-byte structural forensics for PDF statement files. Everything here
+ * works on the container — no content trust required. Each check emits
+ * explainable signals; none of them auto-proves fraud alone.
+ */
+import type { IntegritySignal } from '../types';
+export interface StructureOptions {
+    /** Statement period end (YYYY-MM-DD) when known — dates after it on ModDate are suspicious. */
+    readonly statementPeriodEnd?: string | null;
+}
+/**
+ * Structural signals from raw PDF bytes. Never throws — malformed input
+ * yields a `structure_unreadable` warning signal, not an exception.
+ */
+export declare function inspectPdfStructure(pdf: Uint8Array, opts?: StructureOptions): IntegritySignal[];
+//# sourceMappingURL=structure.d.ts.map

package/dist/pdf/structure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"structure.d.ts","sourceRoot":"","sources":["../../src/pdf/structure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AA4DhD,MAAM,WAAW,gBAAgB;IAC/B,+FAA+F;IAC/F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,gBAAqB,GAC1B,eAAe,EAAE,CA6GnB"}

package/dist/pdf/structure.js

@@ -0,0 +1,172 @@
+"use strict";
+/**
+ * Copyright 2026 Kapil — Project Panini Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectPdfStructure = inspectPdfStructure;
+const LATIN1 = 'latin1';
+/** Producer/Creator strings strongly associated with interactive PDF editors. */
+const EDITOR_SIGNATURES = [
+    /ilovepdf/i,
+    /pdfescape/i,
+    /smallpdf/i,
+    /sejda/i,
+    /pdf-xchange/i,
+    /foxit\s+(?:phantompdf|editor)/i,
+    /nitro/i,
+    /wkhtmltopdf/i, // HTML→PDF — statements must not be regenerated
+    /weasyprint/i,
+    /cairosvg/i,
+    /reportlab/i,
+    /fpdf/i,
+    /tcpdf/i,
+    /dompdf/i,
+    /itext(?!.*(?:bank|rbi))/i, // iText is also a legit bank generator — warning only
+];
+const PDF_DATE_RE = /D:?(\d{4})(\d{2})(\d{2})(\d{2})?(\d{2})?(\d{2})?/;
+function pdfDateToIso(raw) {
+    const m = PDF_DATE_RE.exec(raw);
+    if (m === null)
+        return null;
+    return `${m[1]}-${m[2]}-${m[3]}`;
+}
+function infoString(dict, key) {
+    // /Key (literal) or /Key <hex>
+    const lit = new RegExp(`/${key}\\s*\\(([^)]*)\\)`).exec(dict);
+    if (lit !== null)
+        return lit[1];
+    const hex = new RegExp(`/${key}\\s*<([0-9a-fA-F]*)>`).exec(dict);
+    if (hex !== null) {
+        const raw = Buffer.from(hex[1] ?? '', 'hex');
+        if (raw.length % 2 === 1)
+            return raw.toString('latin1');
+        return Buffer.from(raw).swap16().toString('utf16le');
+    }
+    return undefined;
+}
+function findInfoDict(latin) {
+    const ref = /\/Info\s+(\d+)\s+(\d+)\s+R/.exec(latin);
+    if (ref === null)
+        return null;
+    const objRe = new RegExp(`${ref[1]}\\s+${ref[2]}\\s+obj\\s*<<([\\s\\S]*?)>>`, 'm');
+    const m = objRe.exec(latin);
+    return m ? `<<${m[1]}>>` : null;
+}
+/**
+ * Structural signals from raw PDF bytes. Never throws — malformed input
+ * yields a `structure_unreadable` warning signal, not an exception.
+ */
+function inspectPdfStructure(pdf, opts = {}) {
+    const signals = [];
+    const latin = Buffer.from(pdf).toString(LATIN1);
+    // ── Incremental updates ──────────────────────────────────────────────
+    const eofCount = (latin.match(/%%EOF/g) ?? []).length;
+    const xrefCount = (latin.match(/startxref/g) ?? []).length;
+    if (eofCount > 1 || xrefCount > 1) {
+        signals.push({
+            ruleId: 'pdf.incremental_update',
+            severity: 'warning',
+            message: `document carries ${Math.max(eofCount, xrefCount)} revision(s) — content was appended after generation`,
+            evidence: `%%EOF×${eofCount} startxref×${xrefCount}`,
+        });
+    }
+    // ── Producer / Creator / dates ───────────────────────────────────────
+    const infoDict = findInfoDict(latin);
+    const info = {
+        producer: undefined,
+        creator: undefined,
+        creationDate: undefined,
+        modDate: undefined,
+    };
+    if (infoDict !== null) {
+        info.producer = infoString(infoDict, 'Producer');
+        info.creator = infoString(infoDict, 'Creator');
+        info.creationDate = infoString(infoDict, 'CreationDate');
+        info.modDate = infoString(infoDict, 'ModDate');
+    }
+    for (const [key, value] of [
+        ['Producer', info.producer],
+        ['Creator', info.creator],
+    ]) {
+        if (value === undefined)
+            continue;
+        const editor = EDITOR_SIGNATURES.find((re) => re.test(value));
+        if (editor !== undefined) {
+            signals.push({
+                ruleId: 'pdf.editor_producer',
+                severity: 'critical',
+                message: `/${key} '${value}' is a consumer PDF editor — bank-generated statements do not carry this`,
+                evidence: `/${key} (${value})`,
+            });
+        }
+    }
+    // ModDate implies a post-generation save.
+    const createdIso = info.creationDate !== undefined ? pdfDateToIso(info.creationDate) : null;
+    const modifiedIso = info.modDate !== undefined ? pdfDateToIso(info.modDate) : null;
+    if (modifiedIso !== null && createdIso !== null && modifiedIso > createdIso) {
+        signals.push({
+            ruleId: 'pdf.modified_after_creation',
+            severity: 'warning',
+            message: `ModDate ${modifiedIso} is after CreationDate ${createdIso} — file was re-saved after generation`,
+            evidence: `CreationDate=${createdIso} ModDate=${modifiedIso}`,
+        });
+    }
+    if (opts.statementPeriodEnd != null &&
+        modifiedIso !== null &&
+        modifiedIso > opts.statementPeriodEnd &&
+        createdIso !== null &&
+        modifiedIso > createdIso) {
+        signals.push({
+            ruleId: 'pdf.modified_after_period',
+            severity: 'critical',
+            message: `file modified ${modifiedIso}, after the statement period ended ${opts.statementPeriodEnd}`,
+            evidence: `ModDate=${modifiedIso} periodEnd=${opts.statementPeriodEnd}`,
+        });
+    }
+    // ── Interactive overlays ─────────────────────────────────────────────
+    // AcroForm + signature fields are the normal carrier for signed
+    // statements — only suspicious when interactive fields exist with NO
+    // signature dict at all (fill-in overlays without signer evidence).
+    const sigFieldCount = (latin.match(/\/FT\s*\/Sig\b/g) ?? []).length;
+    const hasAcroForm = /\/AcroForm\b/.test(latin) || /\/SigFlags\s*\d/.test(latin);
+    if (hasAcroForm && sigFieldCount === 0 && !/\/Type\s*\/Sig\b/.test(latin)) {
+        signals.push({
+            ruleId: 'pdf.acroform_overlay',
+            severity: 'warning',
+            message: 'document carries interactive form fields but no signature — values can overlay or replace rendered text',
+            evidence: '/AcroForm present, /FT /Sig absent',
+        });
+    }
+    const annotCount = (latin.match(/\/Subtype\s*\/(?:FreeText|Stamp|Highlight|Squiggly|StrikeOut)/g) ?? []).length;
+    if (annotCount > 0) {
+        signals.push({
+            ruleId: 'pdf.covering_annotations',
+            severity: 'warning',
+            message: `${annotCount} markup annotation(s) can visually cover underlying statement text`,
+            evidence: `annotation subtypes ×${annotCount}`,
+        });
+    }
+    // ── Header sanity ────────────────────────────────────────────────────
+    if (!latin.startsWith('%PDF-')) {
+        signals.push({
+            ruleId: 'pdf.bad_header',
+            severity: 'warning',
+            message: 'file does not open with a %PDF- header',
+            evidence: `first bytes: ${latin.slice(0, 8)}`,
+        });
+    }
+    return signals;
+}
+//# sourceMappingURL=structure.js.map

package/dist/pdf/structure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"structure.js","sourceRoot":"","sources":["../../src/pdf/structure.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AA6EH,kDAgHC;AAnLD,MAAM,MAAM,GAAG,QAAQ,CAAC;AAExB,iFAAiF;AACjF,MAAM,iBAAiB,GAAsB;IAC3C,WAAW;IACX,YAAY;IACZ,WAAW;IACX,QAAQ;IACR,cAAc;IACd,gCAAgC;IAChC,QAAQ;IACR,cAAc,EAAE,gDAAgD;IAChE,aAAa;IACb,WAAW;IACX,YAAY;IACZ,OAAO;IACP,QAAQ;IACR,SAAS;IACT,0BAA0B,EAAE,sDAAsD;CACnF,CAAC;AAUF,MAAM,WAAW,GAAG,kDAAkD,CAAC;AAEvE,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,GAAW;IAC3C,+BAA+B;IAC/B,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,sBAAsB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,GAAG,GAAG,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IACnF,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAOD;;;GAGG;AACH,SAAgB,mBAAmB,CACjC,GAAe,EACf,OAAyB,EAAE;IAE3B,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEhD,wEAAwE;IACxE,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACtD,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC3D,IAAI,QAAQ,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,wBAAwB;YAChC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,oBAAoB,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,sDAAsD;YAChH,QAAQ,EAAE,SAAS,QAAQ,cAAc,SAAS,EAAE;SACrD,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,IAAI,GAAa;QACrB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,SAAS;QAClB,YAAY,EAAE,SAAS;QACvB,OAAO,EAAE,SAAS;KACnB,CAAC;IACF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI;QACzB,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC;KACjB,EAAE,CAAC;QACX,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,qBAAqB;gBAC7B,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,IAAI,GAAG,KAAK,KAAK,0EAA0E;gBACpG,QAAQ,EAAE,IAAI,GAAG,KAAK,KAAK,GAAG;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,IAAI,WAAW,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI,IAAI,WAAW,GAAG,UAAU,EAAE,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,6BAA6B;YACrC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,WAAW,WAAW,0BAA0B,UAAU,uCAAuC;YAC1G,QAAQ,EAAE,gBAAgB,UAAU,YAAY,WAAW,EAAE;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,IACE,IAAI,CAAC,kBAAkB,IAAI,IAAI;QAC/B,WAAW,KAAK,IAAI;QACpB,WAAW,GAAG,IAAI,CAAC,kBAAkB;QACrC,UAAU,KAAK,IAAI;QACnB,WAAW,GAAG,UAAU,EACxB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,2BAA2B;YACnC,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,iBAAiB,WAAW,sCAAsC,IAAI,CAAC,kBAAkB,EAAE;YACpG,QAAQ,EAAE,WAAW,WAAW,cAAc,IAAI,CAAC,kBAAkB,EAAE;SACxE,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,gEAAgE;IAChE,qEAAqE;IACrE,oEAAoE;IACpE,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACpE,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChF,IAAI,WAAW,IAAI,aAAa,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,sBAAsB;YAC9B,QAAQ,EAAE,SAAS;YACnB,OAAO,EACL,yGAAyG;YAC3G,QAAQ,EAAE,oCAAoC;SAC/C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,UAAU,GAAG,CACjB,KAAK,CAAC,KAAK,CAAC,gEAAgE,CAAC,IAAI,EAAE,CACpF,CAAC,MAAM,CAAC;IACT,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,0BAA0B;YAClC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,GAAG,UAAU,oEAAoE;YAC1F,QAAQ,EAAE,wBAAwB,UAAU,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,wCAAwC;YACjD,QAAQ,EAAE,gBAAgB,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}