@super-protocol/pki-attestation-engine 3.0.1 → 3.0.3

package/dist/certificateGenerator.d.ts

@@ -24,7 +24,7 @@ type GenerateCertificateParams = {
     vmCertificatePem?: string;
 };
 export declare const generateSubrootCertificate: (params: GenerateCertificateParams) => Promise<PKISslCertificate>;
-export declare const generateEntityCertificate: (params: GenerateCertificateParams) => Promise<PKISslCertificate>;
+export declare const generateEndEntityCertificate: (params: GenerateCertificateParams) => Promise<PKISslCertificate>;
 export declare const getParamsFromCSR: (csrPem: string) => Promise<{
     commonName: string | undefined;
     publicKeyPem: string;

package/dist/certificateGenerator.js

@@ -1,11 +1,39 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getParamsFromCSR = exports.generateEntityCertificate = exports.generateSubrootCertificate = exports.generateRootCertificate = void 0;
+exports.getParamsFromCSR = exports.generateEndEntityCertificate = exports.generateSubrootCertificate = exports.generateRootCertificate = void 0;
 const sdk_js_1 = require("@super-protocol/sdk-js");
 const sp_nvtrust_wrapper_1 = require("@super-protocol/sp-nvtrust-wrapper");
+const net_1 = require("net");
 const pki_common_1 = require("@super-protocol/pki-common");
 const MIN_CERT_LIFETIME_DAYS = 1;
 const MAX_CERT_LIFETIME_DAYS = 18250;
+const DNS_LABEL_REGEX = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
+const isValidDomainName = (value) => {
+    const trimmedValue = value.trim();
+    if (!trimmedValue || trimmedValue.length > 253) {
+        return false;
+    }
+    const isWildcard = trimmedValue.startsWith('*.');
+    const hostname = isWildcard ? trimmedValue.slice(2) : trimmedValue;
+    if (!isWildcard && hostname.toLowerCase() === 'localhost') {
+        return true;
+    }
+    if (!hostname || hostname.endsWith('.') || !hostname.includes('.')) {
+        return false;
+    }
+    const labels = hostname.split('.');
+    if (labels.some((label) => !DNS_LABEL_REGEX.test(label))) {
+        return false;
+    }
+    return !isWildcard || labels.length > 1;
+};
+const isValidDomainOrIp = (value) => {
+    const trimmedValue = value.trim();
+    return (0, net_1.isIP)(trimmedValue) !== 0 || isValidDomainName(trimmedValue);
+};
+const filterValidDomainOrIpList = (values) => values
+    .map((value) => value.trim())
+    .filter((value) => value && isValidDomainOrIp(value));
 const addDaysUtc = (base, days) => {
     const next = new Date(base);
     next.setUTCDate(next.getUTCDate() + days);
@@ -200,7 +228,12 @@ const buildCommonExtensions = (params) => {
     return [...filteredClientExtensions, ...extensions];
 };
 const generateCertificate = async (params) => {
-    const signingCert = await sdk_js_1.CertificateGenerator.checkAndParseCert(params.signingCertPem);
+    const signingCertPems = (0, pki_common_1.sortCertsFromLeafToRootWrapper)(params.signingCertPem, (pem) => sdk_js_1.CertificatesHelper.sortCertsFromLeafToRoot(pem).map((c) => sdk_js_1.CertificatesHelper.derToPem(c.cert.toSchema().toBER(false))));
+    if (!signingCertPems.length) {
+        throw new Error('No valid signing certificates found in the provided signingCertPem');
+    }
+    const signingLeafPem = signingCertPems[0];
+    const signingCert = await sdk_js_1.CertificateGenerator.checkAndParseCert(signingLeafPem);
     const customExtensions = buildCommonExtensions({
         certType: params.certType,
         challengeInfo: params.challengeInfo,
@@ -211,6 +244,9 @@ const generateCertificate = async (params) => {
     // customExtensions.push(
     //     ...buildVmGpuExtension(params.vmCertificatePem, customExtensions),
     // );
+    const domains = params.certType === pki_common_1.CertificateType.Basic
+        ? filterValidDomainOrIpList(params.domains)
+        : [];
     const subject = {
         commonName: params.commonName || params.domains[0] || '',
         country: params.certParams.countryName,
@@ -219,7 +255,6 @@ const generateCertificate = async (params) => {
         organization: params.certParams.organizationName,
         organizationalUnit: params.certParams.organizationUnitName,
     };
-    const domains = params.certType === pki_common_1.CertificateType.Basic ? params.domains : [];
     const notAfter = resolveNotAfter(params.certParams);
     const generateCertParams = {
         privateKey: params.signingPrivateKeyPem,
@@ -252,11 +287,11 @@ const generateSubrootCertificate = async (params) => generateCertificate({
     ca: true,
 });
 exports.generateSubrootCertificate = generateSubrootCertificate;
-const generateEntityCertificate = async (params) => generateCertificate({
+const generateEndEntityCertificate = async (params) => generateCertificate({
     ...params,
     ca: false,
 });
-exports.generateEntityCertificate = generateEntityCertificate;
+exports.generateEndEntityCertificate = generateEndEntityCertificate;
 const getParamsFromCSR = async (csrPem) => {
     const parsedCsr = await sdk_js_1.CertificateGenerator.checkAndParseCsr(csrPem);
     const commonName = parsedCsr.subject.match(/CN=([^,]+)/)?.[1]?.trim();
@@ -268,4 +303,4 @@ const getParamsFromCSR = async (csrPem) => {
     };
 };
 exports.getParamsFromCSR = getParamsFromCSR;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2VydGlmaWNhdGVHZW5lcmF0b3IuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvY2VydGlmaWNhdGVHZW5lcmF0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsbURBUWdDO0FBQ2hDLDJFQUc0QztBQUM1QywyREFrQm9DO0FBRXBDLE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxDQUFDO0FBQ2pDLE1BQU0sc0JBQXNCLEdBQUcsS0FBSyxDQUFDO0FBRXJDLE1BQU0sVUFBVSxHQUFHLENBQUMsSUFBVSxFQUFFLElBQVksRUFBUSxFQUFFO0lBQ2xELE1BQU0sSUFBSSxHQUFHLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzVCLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxHQUFHLElBQUksQ0FBQyxDQUFDO0lBQzFDLE9BQU8sSUFBSSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sZUFBZSxHQUFHLENBQUMsVUFBeUIsRUFBUSxFQUFFO0lBQ3hELE1BQU0sRUFBRSxZQUFZLEVBQUUsR0FBRyxVQUFVLENBQUM7SUFFcEMsSUFDSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDO1FBQy9CLFlBQVksR0FBRyxzQkFBc0I7UUFDckMsWUFBWSxHQUFHLHNCQUFzQixFQUN2QyxDQUFDO1FBQ0MsTUFBTSxJQUFJLEtBQUssQ0FDWCxzREFBc0Qsc0JBQXNCLFFBQVEsc0JBQXNCLEVBQUUsQ0FDL0csQ0FBQztJQUNOLENBQUM7SUFFRCxPQUFPLFVBQVUsQ0FBQyxJQUFJLElBQUksRUFBRSxFQUFFLFlBQVksQ0FBQyxDQUFDO0FBQ2hELENBQUMsQ0FBQztBQUVGLE1BQU0sY0FBYyxHQUFHLENBQUMsVUFBeUIsRUFBd0IsRUFBRSxDQUFDLENBQUM7SUFDekUsVUFBVSxFQUFFLFVBQVUsQ0FBQyxVQUFVO0lBQ2pDLE9BQU8sRUFBRSxVQUFVLENBQUMsV0FBVztJQUMvQixTQUFTLEVBQUUsVUFBVSxDQUFDLFNBQVM7SUFDL0IsWUFBWSxFQUFFLFVBQVUsQ0FBQyxZQUFZO0lBQ3JDLFlBQVksRUFBRSxVQUFVLENBQUMsZ0JBQWdCO0lBQ3pDLGtCQUFrQixFQUFFLFVBQVUsQ0FBQyxvQkFBb0I7Q0FDdEQsQ0FBQyxDQUFDO0FBRUgsTUFBTSwyQkFBMkIsR0FBRyxDQUNoQyxTQUFvQixFQUM2QyxFQUFFO0lBQ25FLElBQUksV0FBVyxDQUFDO0lBRWhCLFFBQVEsU0FBUyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3JCLEtBQUssMEJBQWEsQ0FBQyxPQUFPLENBQUM7UUFDM0IsS0FBSywwQkFBYSxDQUFDLEdBQUc7WUFDbEIsV0FBVyxHQUFHLFNBQVMsQ0FBQyxXQUFXLENBQUM7WUFDcEMsTUFBTTtRQUNWLEtBQUssMEJBQWEsQ0FBQyxNQUFNO1lBQ3JCLFdBQVcsR0FBRyxTQUFTLENBQUMsc0JBQXNCLENBQUM7WUFDL0MsTUFBTTtJQUNkLENBQUM7SUFFRCxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDZixPQUFPO0lBQ1gsQ0FBQztJQUVELE9BQU8sRUFBRSxhQUFhLEVBQUUsU0FBUyxDQUFDLElBQUksRUFBRSxXQUFXLEVBQUUsQ0FBQztBQUMxRCxDQUFDLENBQUM7QUFFSyxNQUFNLHVCQUF1QixHQUFHLEtBQUssRUFBRSxNQU83QyxFQUFtQixFQUFFO0lBQ2xCLE1BQU0sU0FBUyxHQUFHLGNBQWMsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDcEQsTUFBTSxRQUFRLEdBQUcsZUFBZSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUVwRCxNQUFNLGdCQUFnQixHQUFzQjtRQUN4QztZQUNJLEdBQUcsRUFBRSxnREFBbUM7WUFDeEMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDO1NBQ3JEO0tBQ0osQ0FBQztJQUVGLElBQUksTUFBTSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQ3JCLGdCQUFnQixDQUFDLElBQUksQ0FBQztZQUNsQixHQUFHLEVBQUUsOENBQWlDO1lBQ3RDLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsT0FBTyxDQUFDO1NBQ2xELENBQUMsQ0FBQztJQUNQLENBQUM7SUFFRCxNQUFNLFNBQVMsR0FBRywyQkFBMkIsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDaEUsSUFBSSxTQUFTLEVBQUUsQ0FBQztRQUNaLGdCQUFnQixDQUFDLElBQUksQ0FBQztZQUNsQixHQUFHLEVBQUUsMEJBQWE7WUFDbEIsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFdBQVcsRUFBRSxRQUFRLENBQUM7U0FDdEQsQ0FBQyxDQUFDO0lBQ1AsQ0FBQztJQUVELE1BQU0sa0JBQWtCLEdBQXVCO1FBQzNDLFVBQVUsRUFBRSxNQUFNLENBQUMsYUFBYTtRQUNoQyxTQUFTLEVBQUUsTUFBTSxDQUFDLFlBQVk7UUFDOUIsT0FBTyxFQUFFLFNBQVM7UUFDbEIsTUFBTSxFQUFFLFNBQVM7UUFDakIsUUFBUTtRQUNSLFFBQVEsRUFBRSxNQUFNLENBQUMsT0FBTztRQUN4QixFQUFFLEVBQUUsSUFBSTtRQUNSLGdCQUFnQjtLQUNuQixDQUFDO0lBRUYsT0FBTyw2QkFBb0IsQ0FBQyxZQUFZLENBQUMsa0JBQWtCLENBQUMsQ0FBQztBQUNqRSxDQUFDLENBQUM7QUE3Q1csUUFBQSx1QkFBdUIsMkJBNkNsQztBQUVGLE1BQU0sNkJBQTZCLEdBQUc7SUFDbEMsMEJBQWE7SUFDYixnREFBbUM7SUFDbkMsOENBQWlDO0lBQ2pDLHFEQUF3QztJQUN4QyxpREFBb0M7SUFDcEMsbURBQXNDO0lBQ3RDLDBEQUE2QztDQUNoRCxDQUFDO0FBRUYsTUFBTSxzQkFBc0IsR0FBRyxDQUMzQixhQUFnQyxFQUFFLEVBQ2pCLEVBQUUsQ0FDbkIsVUFBVSxDQUFDLE1BQU0sQ0FDYixDQUFDLEdBQUcsRUFBRSxFQUFFLENBQ0osQ0FBQyw2QkFBNkIsQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUN4QyxHQUFHLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FDMUIsQ0FDUixDQUFDO0FBRU4sTUFBTSx1QkFBdUIsR0FBRyxDQUFDLFNBQW9CLEVBQXFCLEVBQUU7SUFDeEUsSUFBSSxDQUFDLElBQUEsb0NBQXVCLEVBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUN0QyxPQUFPLEVBQUUsQ0FBQztJQUNkLENBQUM7SUFFRCxNQUFNLFFBQVEsR0FBRyxtQ0FBYyxDQUFDLHVCQUF1QixDQUFDO1FBQ3BELEdBQUcsRUFBRSxTQUFTLENBQUMsWUFBWSxDQUFDLFFBQVE7S0FDdkMsQ0FBQyxDQUFDO0lBRUgsT0FBTztRQUNIO1lBQ0ksR0FBRyxFQUFFLGlEQUFvQztZQUN6QyxLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxtQ0FBYyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQztTQUMvRDtLQUNKLENBQUM7QUFDTixDQUFDLENBQUM7QUFFRixNQUFNLG1DQUFtQyxHQUFHLENBQ3hDLFNBQW9CLEVBQ0gsRUFBRTtJQUNuQixJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssMEJBQWEsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUMvQyxPQUFPLEVBQUUsQ0FBQztJQUNkLENBQUM7SUFFRCxNQUFNLGdCQUFnQixHQUFHLDJCQUFrQixDQUFDLGlCQUFpQixDQUN6RCxTQUFTLENBQUMsZ0JBQWdCLEVBQzFCLGdEQUFtQyxDQUN0QyxDQUFDO0lBQ0YsTUFBTSxhQUFhLEdBQUcsMkJBQWtCLENBQUMsaUJBQWlCLENBQ3RELFNBQVMsQ0FBQyxnQkFBZ0IsRUFDMUIsa0JBQVMsQ0FBQyw4QkFBOEIsQ0FDM0MsQ0FBQztJQUVGLElBQUksQ0FBQyxnQkFBZ0IsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sSUFBSSxLQUFLLENBQ1gseURBQXlELGdEQUFtQyxPQUFPLGtCQUFTLENBQUMsOEJBQThCLEVBQUUsQ0FDaEosQ0FBQztJQUNOLENBQUM7SUFFRCxPQUFPO1FBQ0g7WUFDSSxHQUFHLEVBQUUsbURBQXNDO1lBQzNDLEtBQUssRUFBRSxnQkFBZ0I7U0FDMUI7UUFDRDtZQUNJLEdBQUcsRUFBRSwwREFBNkM7WUFDbEQsS0FBSyxFQUFFLGFBQWE7U0FDdkI7S0FDSixDQUFDO0FBQ04sQ0FBQyxDQUFDO0FBRUYsTUFBTSx1QkFBdUIsR0FBRyxDQUFDLFNBQW1CLEVBQXFCLEVBQUU7SUFDdkUsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ2IsT0FBTyxFQUFFLENBQUM7SUFDZCxDQUFDO0lBRUQsT0FBTztRQUNIO1lBQ0ksR0FBRyxFQUFFLHFEQUF3QztZQUM3QyxLQUFLLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7U0FDekI7S0FDSixDQUFDO0FBQ04sQ0FBQyxDQUFDO0FBRUYsNkJBQTZCO0FBQzdCLGdDQUFnQztBQUNoQyw0Q0FBNEM7QUFDNUMsNkNBQTZDO0FBQzdDLDRCQUE0QjtBQUM1QiwrQkFBK0I7QUFDL0IscUJBQXFCO0FBQ3JCLFFBQVE7QUFDUixFQUFFO0FBQ0YsNERBQTREO0FBQzVELDRCQUE0QjtBQUM1QixnREFBZ0Q7QUFDaEQsU0FBUztBQUNULEVBQUU7QUFDRixXQUFXO0FBQ1gscUJBQXFCO0FBQ3JCLG9DQUFvQztBQUNwQyx5RUFBeUU7QUFDekUsWUFBWTtBQUNaLFVBQVU7QUFDVixtQkFBbUI7QUFDbkIsZ0JBQWdCO0FBQ2hCLDZEQUE2RDtBQUM3RCxrQ0FBa0M7QUFDbEMsaUJBQWlCO0FBQ2pCLGFBQWE7QUFDYixRQUFRO0FBQ1IsRUFBRTtBQUNGLGlCQUFpQjtBQUNqQixLQUFLO0FBRUwsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLE1BSTlCLEVBQXFCLEVBQUU7SUFDcEIsTUFBTSxVQUFVLEdBQXNCLEVBQUUsQ0FBQztJQUV6QyxJQUFJLE1BQU0sQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUN2QixNQUFNLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxXQUFXLEVBQUUsR0FBRyxNQUFNLENBQUMsYUFBYSxDQUFDO1FBRS9ELFVBQVUsQ0FBQyxJQUFJLENBQUM7WUFDWixHQUFHLEVBQUUsZ0RBQW1DO1lBQ3hDLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDO1NBQzlDLENBQUMsQ0FBQztRQUVILElBQUksU0FBUyxDQUFDLElBQUksS0FBSywwQkFBYSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ3pDLFVBQVUsQ0FBQyxJQUFJLENBQUM7Z0JBQ1osR0FBRyxFQUFFLDhDQUFpQztnQkFDdEMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQzthQUNuQyxDQUFDLENBQUM7WUFFSCxJQUFJLFdBQVcsRUFBRSxDQUFDO2dCQUNkLFVBQVUsQ0FBQyxJQUFJLENBQUM7b0JBQ1osR0FBRyxFQUFFLHFEQUF3QztvQkFDN0MsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLEtBQUssQ0FBQztpQkFDekMsQ0FBQyxDQUFDO1lBQ1AsQ0FBQztZQUVELElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyw0QkFBZSxDQUFDLEtBQUssRUFBRSxDQUFDO2dCQUM1QyxNQUFNLEtBQUssR0FBRywyQkFBMkIsQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDckQsSUFBSSxLQUFLLEVBQUUsQ0FBQztvQkFDUixVQUFVLENBQUMsSUFBSSxDQUFDO3dCQUNaLEdBQUcsRUFBRSwwQkFBYTt3QkFDbEIsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsRUFBRSxRQUFRLENBQUM7cUJBQ2xELENBQUMsQ0FBQztnQkFDUCxDQUFDO1lBQ0wsQ0FBQztZQUVELFVBQVUsQ0FBQyxJQUFJLENBQUMsR0FBRyx1QkFBdUIsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO1lBQ3ZELFVBQVUsQ0FBQyxJQUFJLENBQUMsR0FBRyxtQ0FBbUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ3ZFLENBQUM7SUFDTCxDQUFDO0lBRUQsTUFBTSx3QkFBd0IsR0FBRyxzQkFBc0IsQ0FDbkQsTUFBTSxDQUFDLG9CQUFvQixDQUM5QixDQUFDO0lBRUYsT0FBTyxDQUFDLEdBQUcsd0JBQXdCLEVBQUUsR0FBRyxVQUFVLENBQUMsQ0FBQztBQUN4RCxDQUFDLENBQUM7QUFrQkYsTUFBTSxtQkFBbUIsR0FBRyxLQUFLLEVBQzdCLE1BQW1ELEVBQ3pCLEVBQUU7SUFDNUIsTUFBTSxXQUFXLEdBQUcsTUFBTSw2QkFBb0IsQ0FBQyxpQkFBaUIsQ0FDNUQsTUFBTSxDQUFDLGNBQWMsQ0FDeEIsQ0FBQztJQUVGLE1BQU0sZ0JBQWdCLEdBQUcscUJBQXFCLENBQUM7UUFDM0MsUUFBUSxFQUFFLE1BQU0sQ0FBQyxRQUFRO1FBQ3pCLGFBQWEsRUFBRSxNQUFNLENBQUMsYUFBYTtRQUNuQyxvQkFBb0IsRUFBRSxNQUFNLENBQUMsb0JBQW9CO0tBQ3BELENBQUMsQ0FBQztJQUVILGdCQUFnQixDQUFDLElBQUksQ0FBQyxHQUFHLHVCQUF1QixDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO0lBQ3BFLDZCQUE2QjtJQUM3Qix5QkFBeUI7SUFDekIseUVBQXlFO0lBQ3pFLEtBQUs7SUFFTCxNQUFNLE9BQU8sR0FBeUI7UUFDbEMsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFO1FBQ3hELE9BQU8sRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLFdBQVc7UUFDdEMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsU0FBUztRQUN0QyxZQUFZLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxZQUFZO1FBQzVDLFlBQVksRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLGdCQUFnQjtRQUNoRCxrQkFBa0IsRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLG9CQUFvQjtLQUM3RCxDQUFDO0lBRUYsTUFBTSxPQUFPLEdBQ1QsTUFBTSxDQUFDLFFBQVEsS0FBSyw0QkFBZSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ3BFLE1BQU0sUUFBUSxHQUFHLGVBQWUsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7SUFFcEQsTUFBTSxrQkFBa0IsR0FBdUI7UUFDM0MsVUFBVSxFQUFFLE1BQU0sQ0FBQyxvQkFBb0I7UUFDdkMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxZQUFZO1FBQzlCLE9BQU87UUFDUCxRQUFRLEVBQUUsT0FBTztRQUNqQixFQUFFLEVBQUUsTUFBTSxDQUFDLEVBQUU7UUFDYixXQUFXLEVBQUUsTUFBTSxDQUFDLFdBQVc7UUFDL0IsTUFBTSxFQUFFLFdBQVcsQ0FBQyxPQUFPO1FBQzNCLFFBQVE7UUFDUixnQkFBZ0I7S0FDbkIsQ0FBQztJQUVGLElBQUksTUFBTSxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUM1QixrQkFBa0IsQ0FBQyxhQUFhLEdBQUc7WUFDL0IsT0FBTyxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsT0FBTztTQUNyQyxDQUFDO0lBQ04sQ0FBQztJQUVELE1BQU0sT0FBTyxHQUFHLE1BQU0sNkJBQW9CLENBQUMsWUFBWSxDQUFDLGtCQUFrQixDQUFDLENBQUM7SUFFNUUsTUFBTSxZQUFZLEdBQ2QsTUFBTSxDQUFDLFFBQVEsS0FBSyxNQUFNLENBQUMsY0FBYztRQUNyQyxDQUFDLENBQUMsTUFBTSxDQUFDLGNBQWM7UUFDdkIsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxjQUFjLEdBQUcsSUFBSSxHQUFHLE1BQU0sQ0FBQyxRQUFRLENBQUM7SUFFekQsT0FBTztRQUNILE9BQU87UUFDUCxPQUFPO1FBQ1AsWUFBWTtLQUNmLENBQUM7QUFDTixDQUFDLENBQUM7QUFFSyxNQUFNLDBCQUEwQixHQUFHLEtBQUssRUFDM0MsTUFBaUMsRUFDUCxFQUFFLENBQzVCLG1CQUFtQixDQUFDO0lBQ2hCLEdBQUcsTUFBTTtJQUNULEVBQUUsRUFBRSxJQUFJO0NBQ1gsQ0FBQyxDQUFDO0FBTk0sUUFBQSwwQkFBMEIsOEJBTWhDO0FBRUEsTUFBTSx5QkFBeUIsR0FBRyxLQUFLLEVBQzFDLE1BQWlDLEVBQ1AsRUFBRSxDQUM1QixtQkFBbUIsQ0FBQztJQUNoQixHQUFHLE1BQU07SUFDVCxFQUFFLEVBQUUsS0FBSztDQUNaLENBQUMsQ0FBQztBQU5NLFFBQUEseUJBQXlCLDZCQU0vQjtBQUVBLE1BQU0sZ0JBQWdCLEdBQUcsS0FBSyxFQUFFLE1BQWMsRUFBRSxFQUFFO0lBQ3JELE1BQU0sU0FBUyxHQUFHLE1BQU0sNkJBQW9CLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLENBQUM7SUFFdEUsTUFBTSxVQUFVLEdBQUcsU0FBUyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUN0RSxPQUFPO1FBQ0gsVUFBVTtRQUNWLFlBQVksRUFBRSxNQUFNLDhCQUFxQixDQUFDLGtCQUFrQixDQUN4RCxTQUFTLENBQUMsU0FBUyxDQUN0QjtRQUNELGFBQWEsRUFBRSxTQUFTLENBQUMsUUFBUSxJQUFJLEVBQUU7UUFDdkMsb0JBQW9CLEVBQUUsU0FBUyxDQUFDLFVBQVUsSUFBSSxFQUFFO0tBQ25ELENBQUM7QUFDTixDQUFDLENBQUM7QUFaVyxRQUFBLGdCQUFnQixvQkFZM0IifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2VydGlmaWNhdGVHZW5lcmF0b3IuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvY2VydGlmaWNhdGVHZW5lcmF0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsbURBUWdDO0FBQ2hDLDJFQUc0QztBQUM1Qyw2QkFBMkI7QUFDM0IsMkRBbUJvQztBQUVwQyxNQUFNLHNCQUFzQixHQUFHLENBQUMsQ0FBQztBQUNqQyxNQUFNLHNCQUFzQixHQUFHLEtBQUssQ0FBQztBQUNyQyxNQUFNLGVBQWUsR0FBRyx5Q0FBeUMsQ0FBQztBQUVsRSxNQUFNLGlCQUFpQixHQUFHLENBQUMsS0FBYSxFQUFXLEVBQUU7SUFDakQsTUFBTSxZQUFZLEdBQUcsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2xDLElBQUksQ0FBQyxZQUFZLElBQUksWUFBWSxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUM3QyxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBRUQsTUFBTSxVQUFVLEdBQUcsWUFBWSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNqRCxNQUFNLFFBQVEsR0FBRyxVQUFVLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQztJQUVuRSxJQUFJLENBQUMsVUFBVSxJQUFJLFFBQVEsQ0FBQyxXQUFXLEVBQUUsS0FBSyxXQUFXLEVBQUUsQ0FBQztRQUN4RCxPQUFPLElBQUksQ0FBQztJQUNoQixDQUFDO0lBRUQsSUFBSSxDQUFDLFFBQVEsSUFBSSxRQUFRLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ2pFLE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7SUFFRCxNQUFNLE1BQU0sR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ25DLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN2RCxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBRUQsT0FBTyxDQUFDLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQztBQUM1QyxDQUFDLENBQUM7QUFFRixNQUFNLGlCQUFpQixHQUFHLENBQUMsS0FBYSxFQUFXLEVBQUU7SUFDakQsTUFBTSxZQUFZLEdBQUcsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2xDLE9BQU8sSUFBQSxVQUFJLEVBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxJQUFJLGlCQUFpQixDQUFDLFlBQVksQ0FBQyxDQUFDO0FBQ3ZFLENBQUMsQ0FBQztBQUVGLE1BQU0seUJBQXlCLEdBQUcsQ0FBQyxNQUFnQixFQUFZLEVBQUUsQ0FDN0QsTUFBTTtLQUNELEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO0tBQzVCLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxJQUFJLGlCQUFpQixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7QUFFOUQsTUFBTSxVQUFVLEdBQUcsQ0FBQyxJQUFVLEVBQUUsSUFBWSxFQUFRLEVBQUU7SUFDbEQsTUFBTSxJQUFJLEdBQUcsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDNUIsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLEdBQUcsSUFBSSxDQUFDLENBQUM7SUFDMUMsT0FBTyxJQUFJLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxlQUFlLEdBQUcsQ0FBQyxVQUF5QixFQUFRLEVBQUU7SUFDeEQsTUFBTSxFQUFFLFlBQVksRUFBRSxHQUFHLFVBQVUsQ0FBQztJQUVwQyxJQUNJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUM7UUFDL0IsWUFBWSxHQUFHLHNCQUFzQjtRQUNyQyxZQUFZLEdBQUcsc0JBQXNCLEVBQ3ZDLENBQUM7UUFDQyxNQUFNLElBQUksS0FBSyxDQUNYLHNEQUFzRCxzQkFBc0IsUUFBUSxzQkFBc0IsRUFBRSxDQUMvRyxDQUFDO0lBQ04sQ0FBQztJQUVELE9BQU8sVUFBVSxDQUFDLElBQUksSUFBSSxFQUFFLEVBQUUsWUFBWSxDQUFDLENBQUM7QUFDaEQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxjQUFjLEdBQUcsQ0FBQyxVQUF5QixFQUF3QixFQUFFLENBQUMsQ0FBQztJQUN6RSxVQUFVLEVBQUUsVUFBVSxDQUFDLFVBQVU7SUFDakMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxXQUFXO0lBQy9CLFNBQVMsRUFBRSxVQUFVLENBQUMsU0FBUztJQUMvQixZQUFZLEVBQUUsVUFBVSxDQUFDLFlBQVk7SUFDckMsWUFBWSxFQUFFLFVBQVUsQ0FBQyxnQkFBZ0I7SUFDekMsa0JBQWtCLEVBQUUsVUFBVSxDQUFDLG9CQUFvQjtDQUN0RCxDQUFDLENBQUM7QUFFSCxNQUFNLDJCQUEyQixHQUFHLENBQ2hDLFNBQW9CLEVBQzZDLEVBQUU7SUFDbkUsSUFBSSxXQUFXLENBQUM7SUFFaEIsUUFBUSxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDckIsS0FBSywwQkFBYSxDQUFDLE9BQU8sQ0FBQztRQUMzQixLQUFLLDBCQUFhLENBQUMsR0FBRztZQUNsQixXQUFXLEdBQUcsU0FBUyxDQUFDLFdBQVcsQ0FBQztZQUNwQyxNQUFNO1FBQ1YsS0FBSywwQkFBYSxDQUFDLE1BQU07WUFDckIsV0FBVyxHQUFHLFNBQVMsQ0FBQyxzQkFBc0IsQ0FBQztZQUMvQyxNQUFNO0lBQ2QsQ0FBQztJQUVELElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNmLE9BQU87SUFDWCxDQUFDO0lBRUQsT0FBTyxFQUFFLGFBQWEsRUFBRSxTQUFTLENBQUMsSUFBSSxFQUFFLFdBQVcsRUFBRSxDQUFDO0FBQzFELENBQUMsQ0FBQztBQUVLLE1BQU0sdUJBQXVCLEdBQUcsS0FBSyxFQUFFLE1BTzdDLEVBQW1CLEVBQUU7SUFDbEIsTUFBTSxTQUFTLEdBQUcsY0FBYyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNwRCxNQUFNLFFBQVEsR0FBRyxlQUFlLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBRXBELE1BQU0sZ0JBQWdCLEdBQXNCO1FBQ3hDO1lBQ0ksR0FBRyxFQUFFLGdEQUFtQztZQUN4QyxLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxPQUFPLENBQUM7U0FDckQ7S0FDSixDQUFDO0lBRUYsSUFBSSxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDckIsZ0JBQWdCLENBQUMsSUFBSSxDQUFDO1lBQ2xCLEdBQUcsRUFBRSw4Q0FBaUM7WUFDdEMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsRUFBRSxPQUFPLENBQUM7U0FDbEQsQ0FBQyxDQUFDO0lBQ1AsQ0FBQztJQUVELE1BQU0sU0FBUyxHQUFHLDJCQUEyQixDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNoRSxJQUFJLFNBQVMsRUFBRSxDQUFDO1FBQ1osZ0JBQWdCLENBQUMsSUFBSSxDQUFDO1lBQ2xCLEdBQUcsRUFBRSwwQkFBYTtZQUNsQixLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsV0FBVyxFQUFFLFFBQVEsQ0FBQztTQUN0RCxDQUFDLENBQUM7SUFDUCxDQUFDO0lBRUQsTUFBTSxrQkFBa0IsR0FBdUI7UUFDM0MsVUFBVSxFQUFFLE1BQU0sQ0FBQyxhQUFhO1FBQ2hDLFNBQVMsRUFBRSxNQUFNLENBQUMsWUFBWTtRQUM5QixPQUFPLEVBQUUsU0FBUztRQUNsQixNQUFNLEVBQUUsU0FBUztRQUNqQixRQUFRO1FBQ1IsUUFBUSxFQUFFLE1BQU0sQ0FBQyxPQUFPO1FBQ3hCLEVBQUUsRUFBRSxJQUFJO1FBQ1IsZ0JBQWdCO0tBQ25CLENBQUM7SUFFRixPQUFPLDZCQUFvQixDQUFDLFlBQVksQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0FBQ2pFLENBQUMsQ0FBQztBQTdDVyxRQUFBLHVCQUF1QiwyQkE2Q2xDO0FBRUYsTUFBTSw2QkFBNkIsR0FBRztJQUNsQywwQkFBYTtJQUNiLGdEQUFtQztJQUNuQyw4Q0FBaUM7SUFDakMscURBQXdDO0lBQ3hDLGlEQUFvQztJQUNwQyxtREFBc0M7SUFDdEMsMERBQTZDO0NBQ2hELENBQUM7QUFFRixNQUFNLHNCQUFzQixHQUFHLENBQzNCLGFBQWdDLEVBQUUsRUFDakIsRUFBRSxDQUNuQixVQUFVLENBQUMsTUFBTSxDQUNiLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FDSixDQUFDLDZCQUE2QixDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQ3hDLEdBQUcsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUMxQixDQUNSLENBQUM7QUFFTixNQUFNLHVCQUF1QixHQUFHLENBQUMsU0FBb0IsRUFBcUIsRUFBRTtJQUN4RSxJQUFJLENBQUMsSUFBQSxvQ0FBdUIsRUFBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQ3RDLE9BQU8sRUFBRSxDQUFDO0lBQ2QsQ0FBQztJQUVELE1BQU0sUUFBUSxHQUFHLG1DQUFjLENBQUMsdUJBQXVCLENBQUM7UUFDcEQsR0FBRyxFQUFFLFNBQVMsQ0FBQyxZQUFZLENBQUMsUUFBUTtLQUN2QyxDQUFDLENBQUM7SUFFSCxPQUFPO1FBQ0g7WUFDSSxHQUFHLEVBQUUsaURBQW9DO1lBQ3pDLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLG1DQUFjLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDO1NBQy9EO0tBQ0osQ0FBQztBQUNOLENBQUMsQ0FBQztBQUVGLE1BQU0sbUNBQW1DLEdBQUcsQ0FDeEMsU0FBb0IsRUFDSCxFQUFFO0lBQ25CLElBQUksU0FBUyxDQUFDLElBQUksS0FBSywwQkFBYSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQy9DLE9BQU8sRUFBRSxDQUFDO0lBQ2QsQ0FBQztJQUVELE1BQU0sZ0JBQWdCLEdBQUcsMkJBQWtCLENBQUMsaUJBQWlCLENBQ3pELFNBQVMsQ0FBQyxnQkFBZ0IsRUFDMUIsZ0RBQW1DLENBQ3RDLENBQUM7SUFDRixNQUFNLGFBQWEsR0FBRywyQkFBa0IsQ0FBQyxpQkFBaUIsQ0FDdEQsU0FBUyxDQUFDLGdCQUFnQixFQUMxQixrQkFBUyxDQUFDLDhCQUE4QixDQUMzQyxDQUFDO0lBRUYsSUFBSSxDQUFDLGdCQUFnQixJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDdEMsTUFBTSxJQUFJLEtBQUssQ0FDWCx5REFBeUQsZ0RBQW1DLE9BQU8sa0JBQVMsQ0FBQyw4QkFBOEIsRUFBRSxDQUNoSixDQUFDO0lBQ04sQ0FBQztJQUVELE9BQU87UUFDSDtZQUNJLEdBQUcsRUFBRSxtREFBc0M7WUFDM0MsS0FBSyxFQUFFLGdCQUFnQjtTQUMxQjtRQUNEO1lBQ0ksR0FBRyxFQUFFLDBEQUE2QztZQUNsRCxLQUFLLEVBQUUsYUFBYTtTQUN2QjtLQUNKLENBQUM7QUFDTixDQUFDLENBQUM7QUFFRixNQUFNLHVCQUF1QixHQUFHLENBQUMsU0FBbUIsRUFBcUIsRUFBRTtJQUN2RSxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDYixPQUFPLEVBQUUsQ0FBQztJQUNkLENBQUM7SUFFRCxPQUFPO1FBQ0g7WUFDSSxHQUFHLEVBQUUscURBQXdDO1lBQzdDLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztTQUN6QjtLQUNKLENBQUM7QUFDTixDQUFDLENBQUM7QUFFRiw2QkFBNkI7QUFDN0IsZ0NBQWdDO0FBQ2hDLDRDQUE0QztBQUM1Qyw2Q0FBNkM7QUFDN0MsNEJBQTRCO0FBQzVCLCtCQUErQjtBQUMvQixxQkFBcUI7QUFDckIsUUFBUTtBQUNSLEVBQUU7QUFDRiw0REFBNEQ7QUFDNUQsNEJBQTRCO0FBQzVCLGdEQUFnRDtBQUNoRCxTQUFTO0FBQ1QsRUFBRTtBQUNGLFdBQVc7QUFDWCxxQkFBcUI7QUFDckIsb0NBQW9DO0FBQ3BDLHlFQUF5RTtBQUN6RSxZQUFZO0FBQ1osVUFBVTtBQUNWLG1CQUFtQjtBQUNuQixnQkFBZ0I7QUFDaEIsNkRBQTZEO0FBQzdELGtDQUFrQztBQUNsQyxpQkFBaUI7QUFDakIsYUFBYTtBQUNiLFFBQVE7QUFDUixFQUFFO0FBQ0YsaUJBQWlCO0FBQ2pCLEtBQUs7QUFFTCxNQUFNLHFCQUFxQixHQUFHLENBQUMsTUFJOUIsRUFBcUIsRUFBRTtJQUNwQixNQUFNLFVBQVUsR0FBc0IsRUFBRSxDQUFDO0lBRXpDLElBQUksTUFBTSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFLFdBQVcsRUFBRSxHQUFHLE1BQU0sQ0FBQyxhQUFhLENBQUM7UUFFL0QsVUFBVSxDQUFDLElBQUksQ0FBQztZQUNaLEdBQUcsRUFBRSxnREFBbUM7WUFDeEMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxPQUFPLENBQUM7U0FDOUMsQ0FBQyxDQUFDO1FBRUgsSUFBSSxTQUFTLENBQUMsSUFBSSxLQUFLLDBCQUFhLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDekMsVUFBVSxDQUFDLElBQUksQ0FBQztnQkFDWixHQUFHLEVBQUUsOENBQWlDO2dCQUN0QyxLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDO2FBQ25DLENBQUMsQ0FBQztZQUVILElBQUksV0FBVyxFQUFFLENBQUM7Z0JBQ2QsVUFBVSxDQUFDLElBQUksQ0FBQztvQkFDWixHQUFHLEVBQUUscURBQXdDO29CQUM3QyxLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsS0FBSyxDQUFDO2lCQUN6QyxDQUFDLENBQUM7WUFDUCxDQUFDO1lBRUQsSUFBSSxNQUFNLENBQUMsUUFBUSxLQUFLLDRCQUFlLENBQUMsS0FBSyxFQUFFLENBQUM7Z0JBQzVDLE1BQU0sS0FBSyxHQUFHLDJCQUEyQixDQUFDLFNBQVMsQ0FBQyxDQUFDO2dCQUNyRCxJQUFJLEtBQUssRUFBRSxDQUFDO29CQUNSLFVBQVUsQ0FBQyxJQUFJLENBQUM7d0JBQ1osR0FBRyxFQUFFLDBCQUFhO3dCQUNsQixLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsV0FBVyxFQUFFLFFBQVEsQ0FBQztxQkFDbEQsQ0FBQyxDQUFDO2dCQUNQLENBQUM7WUFDTCxDQUFDO1lBRUQsVUFBVSxDQUFDLElBQUksQ0FBQyxHQUFHLHVCQUF1QixDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7WUFDdkQsVUFBVSxDQUFDLElBQUksQ0FBQyxHQUFHLG1DQUFtQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFDdkUsQ0FBQztJQUNMLENBQUM7SUFFRCxNQUFNLHdCQUF3QixHQUFHLHNCQUFzQixDQUNuRCxNQUFNLENBQUMsb0JBQW9CLENBQzlCLENBQUM7SUFFRixPQUFPLENBQUMsR0FBRyx3QkFBd0IsRUFBRSxHQUFHLFVBQVUsQ0FBQyxDQUFDO0FBQ3hELENBQUMsQ0FBQztBQWtCRixNQUFNLG1CQUFtQixHQUFHLEtBQUssRUFDN0IsTUFBbUQsRUFDekIsRUFBRTtJQUM1QixNQUFNLGVBQWUsR0FBRyxJQUFBLDJDQUE4QixFQUNsRCxNQUFNLENBQUMsY0FBYyxFQUNyQixDQUFDLEdBQUcsRUFBRSxFQUFFLENBQ0osMkJBQWtCLENBQUMsdUJBQXVCLENBQUMsR0FBRyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FDdEQsMkJBQWtCLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQzlELENBQ1IsQ0FBQztJQUVGLElBQUksQ0FBQyxlQUFlLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDMUIsTUFBTSxJQUFJLEtBQUssQ0FDWCxvRUFBb0UsQ0FDdkUsQ0FBQztJQUNOLENBQUM7SUFFRCxNQUFNLGNBQWMsR0FBRyxlQUFlLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDMUMsTUFBTSxXQUFXLEdBQ2IsTUFBTSw2QkFBb0IsQ0FBQyxpQkFBaUIsQ0FBQyxjQUFjLENBQUMsQ0FBQztJQUVqRSxNQUFNLGdCQUFnQixHQUFHLHFCQUFxQixDQUFDO1FBQzNDLFFBQVEsRUFBRSxNQUFNLENBQUMsUUFBUTtRQUN6QixhQUFhLEVBQUUsTUFBTSxDQUFDLGFBQWE7UUFDbkMsb0JBQW9CLEVBQUUsTUFBTSxDQUFDLG9CQUFvQjtLQUNwRCxDQUFDLENBQUM7SUFFSCxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsR0FBRyx1QkFBdUIsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztJQUNwRSw2QkFBNkI7SUFDN0IseUJBQXlCO0lBQ3pCLHlFQUF5RTtJQUN6RSxLQUFLO0lBRUwsTUFBTSxPQUFPLEdBQ1QsTUFBTSxDQUFDLFFBQVEsS0FBSyw0QkFBZSxDQUFDLEtBQUs7UUFDckMsQ0FBQyxDQUFDLHlCQUF5QixDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7UUFDM0MsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUViLE1BQU0sT0FBTyxHQUF5QjtRQUNsQyxVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVUsSUFBSSxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUU7UUFDeEQsT0FBTyxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsV0FBVztRQUN0QyxTQUFTLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxTQUFTO1FBQ3RDLFlBQVksRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLFlBQVk7UUFDNUMsWUFBWSxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsZ0JBQWdCO1FBQ2hELGtCQUFrQixFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsb0JBQW9CO0tBQzdELENBQUM7SUFFRixNQUFNLFFBQVEsR0FBRyxlQUFlLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBRXBELE1BQU0sa0JBQWtCLEdBQXVCO1FBQzNDLFVBQVUsRUFBRSxNQUFNLENBQUMsb0JBQW9CO1FBQ3ZDLFNBQVMsRUFBRSxNQUFNLENBQUMsWUFBWTtRQUM5QixPQUFPO1FBQ1AsUUFBUSxFQUFFLE9BQU87UUFDakIsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFO1FBQ2IsV0FBVyxFQUFFLE1BQU0sQ0FBQyxXQUFXO1FBQy9CLE1BQU0sRUFBRSxXQUFXLENBQUMsT0FBTztRQUMzQixRQUFRO1FBQ1IsZ0JBQWdCO0tBQ25CLENBQUM7SUFFRixJQUFJLE1BQU0sQ0FBQyxVQUFVLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDNUIsa0JBQWtCLENBQUMsYUFBYSxHQUFHO1lBQy9CLE9BQU8sRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLE9BQU87U0FDckMsQ0FBQztJQUNOLENBQUM7SUFFRCxNQUFNLE9BQU8sR0FBRyxNQUFNLDZCQUFvQixDQUFDLFlBQVksQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0lBRTVFLE1BQU0sWUFBWSxHQUNkLE1BQU0sQ0FBQyxRQUFRLEtBQUssTUFBTSxDQUFDLGNBQWM7UUFDckMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxjQUFjO1FBQ3ZCLENBQUMsQ0FBQyxNQUFNLENBQUMsY0FBYyxHQUFHLElBQUksR0FBRyxNQUFNLENBQUMsUUFBUSxDQUFDO0lBRXpELE9BQU87UUFDSCxPQUFPO1FBQ1AsT0FBTztRQUNQLFlBQVk7S0FDZixDQUFDO0FBQ04sQ0FBQyxDQUFDO0FBRUssTUFBTSwwQkFBMEIsR0FBRyxLQUFLLEVBQzNDLE1BQWlDLEVBQ1AsRUFBRSxDQUM1QixtQkFBbUIsQ0FBQztJQUNoQixHQUFHLE1BQU07SUFDVCxFQUFFLEVBQUUsSUFBSTtDQUNYLENBQUMsQ0FBQztBQU5NLFFBQUEsMEJBQTBCLDhCQU1oQztBQUVBLE1BQU0sNEJBQTRCLEdBQUcsS0FBSyxFQUM3QyxNQUFpQyxFQUNQLEVBQUUsQ0FDNUIsbUJBQW1CLENBQUM7SUFDaEIsR0FBRyxNQUFNO0lBQ1QsRUFBRSxFQUFFLEtBQUs7Q0FDWixDQUFDLENBQUM7QUFOTSxRQUFBLDRCQUE0QixnQ0FNbEM7QUFFQSxNQUFNLGdCQUFnQixHQUFHLEtBQUssRUFBRSxNQUFjLEVBQUUsRUFBRTtJQUNyRCxNQUFNLFNBQVMsR0FBRyxNQUFNLDZCQUFvQixDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBRXRFLE1BQU0sVUFBVSxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDdEUsT0FBTztRQUNILFVBQVU7UUFDVixZQUFZLEVBQUUsTUFBTSw4QkFBcUIsQ0FBQyxrQkFBa0IsQ0FDeEQsU0FBUyxDQUFDLFNBQVMsQ0FDdEI7UUFDRCxhQUFhLEVBQUUsU0FBUyxDQUFDLFFBQVEsSUFBSSxFQUFFO1FBQ3ZDLG9CQUFvQixFQUFFLFNBQVMsQ0FBQyxVQUFVLElBQUksRUFBRTtLQUNuRCxDQUFDO0FBQ04sQ0FBQyxDQUFDO0FBWlcsUUFBQSxnQkFBZ0Isb0JBWTNCIn0=

package/dist/index.d.ts

@@ -1,3 +1,4 @@
 export * from './certificateGenerator';
 export * from './challengeProvider';
 export * from './challengeValidator';
+export * from './swarmCertValidation';

package/dist/index.js

@@ -17,4 +17,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./certificateGenerator"), exports);
 __exportStar(require("./challengeProvider"), exports);
 __exportStar(require("./challengeValidator"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLHlEQUF1QztBQUN2QyxzREFBb0M7QUFDcEMsdURBQXFDIn0=
+__exportStar(require("./swarmCertValidation"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLHlEQUF1QztBQUN2QyxzREFBb0M7QUFDcEMsdURBQXFDO0FBQ3JDLHdEQUFzQyJ9

package/dist/swarmCertValidation.d.ts

@@ -0,0 +1,6 @@
+import { Log } from '@super-protocol/pki-common';
+export declare const validateClientCertificateChain: (certChainPem: string, rootCaPem: string, log?: Log) => Promise<{
+    isValid: boolean;
+    errorMessage?: string;
+    leafCertPem?: string;
+}>;

package/dist/swarmCertValidation.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateClientCertificateChain = void 0;
+const pki_common_1 = require("@super-protocol/pki-common");
+const sdk_js_1 = require("@super-protocol/sdk-js");
+const validateClientCertificateChain = async (certChainPem, rootCaPem, log) => {
+    try {
+        const { isValid, errorMessage } = await sdk_js_1.CertificatesHelper.validateCertChain(certChainPem, rootCaPem);
+        if (!isValid) {
+            const message = errorMessage || 'Certificate chain validation failed';
+            log?.warn('Certificate validation failed', { error: message });
+            return {
+                isValid: false,
+                errorMessage: message,
+            };
+        }
+        // Sort certificates from leaf to root to get leaf certificate
+        const sortedCertPems = (0, pki_common_1.sortCertsFromLeafToRootWrapper)(certChainPem, (pem) => sdk_js_1.CertificatesHelper.sortCertsFromLeafToRoot(pem).map((c) => sdk_js_1.CertificatesHelper.derToPem(c.cert.toSchema().toBER(false))));
+        if (sortedCertPems.length === 0) {
+            const message = 'No certificates found in chain';
+            log?.warn('Certificate validation failed', { error: message });
+            return {
+                isValid: false,
+                errorMessage: message,
+            };
+        }
+        // First certificate after sorting is leaf
+        const leafCertPem = sortedCertPems[0];
+        // Check for OID_CUSTOM_EXTENSION_CHALLENGE_VALIDATED in leaf certificate
+        const challengeValidated = sdk_js_1.CertificatesHelper.getExtensionValue(leafCertPem, pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_VALIDATED);
+        if (!challengeValidated) {
+            const message = 'Certificate is missing challenge validation extension';
+            log?.warn('Certificate validation failed', { error: message });
+            return {
+                isValid: false,
+                errorMessage: message,
+            };
+        }
+        return { isValid: true, leafCertPem };
+    }
+    catch (error) {
+        log?.error('Error validating certificate', {
+            error: error.message,
+        });
+        return {
+            isValid: false,
+            errorMessage: `Certificate validation error: ${error.message}`,
+        };
+    }
+};
+exports.validateClientCertificateChain = validateClientCertificateChain;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3dhcm1DZXJ0VmFsaWRhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9zd2FybUNlcnRWYWxpZGF0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDJEQUlvQztBQUNwQyxtREFBNEQ7QUFFckQsTUFBTSw4QkFBOEIsR0FBRyxLQUFLLEVBQy9DLFlBQW9CLEVBQ3BCLFNBQWlCLEVBQ2pCLEdBQVMsRUFLVixFQUFFO0lBQ0QsSUFBSSxDQUFDO1FBQ0QsTUFBTSxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsR0FDM0IsTUFBTSwyQkFBa0IsQ0FBQyxpQkFBaUIsQ0FBQyxZQUFZLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFFeEUsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ1gsTUFBTSxPQUFPLEdBQ1QsWUFBWSxJQUFJLHFDQUFxQyxDQUFDO1lBQzFELEdBQUcsRUFBRSxJQUFJLENBQUMsK0JBQStCLEVBQUUsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztZQUMvRCxPQUFPO2dCQUNILE9BQU8sRUFBRSxLQUFLO2dCQUNkLFlBQVksRUFBRSxPQUFPO2FBQ3hCLENBQUM7UUFDTixDQUFDO1FBRUQsOERBQThEO1FBQzlELE1BQU0sY0FBYyxHQUFHLElBQUEsMkNBQThCLEVBQ2pELFlBQVksRUFDWixDQUFDLEdBQUcsRUFBRSxFQUFFLENBQ0osMkJBQWtCLENBQUMsdUJBQXVCLENBQUMsR0FBRyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FDdEQsMkJBQWtCLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQzlELENBQ1IsQ0FBQztRQUVGLElBQUksY0FBYyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUM5QixNQUFNLE9BQU8sR0FBRyxnQ0FBZ0MsQ0FBQztZQUNqRCxHQUFHLEVBQUUsSUFBSSxDQUFDLCtCQUErQixFQUFFLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7WUFDL0QsT0FBTztnQkFDSCxPQUFPLEVBQUUsS0FBSztnQkFDZCxZQUFZLEVBQUUsT0FBTzthQUN4QixDQUFDO1FBQ04sQ0FBQztRQUVELDBDQUEwQztRQUMxQyxNQUFNLFdBQVcsR0FBRyxjQUFjLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFFdEMseUVBQXlFO1FBQ3pFLE1BQU0sa0JBQWtCLEdBQUcsMkJBQWtCLENBQUMsaUJBQWlCLENBQzNELFdBQVcsRUFDWCxxREFBd0MsQ0FDM0MsQ0FBQztRQUVGLElBQUksQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO1lBQ3RCLE1BQU0sT0FBTyxHQUNULHVEQUF1RCxDQUFDO1lBQzVELEdBQUcsRUFBRSxJQUFJLENBQUMsK0JBQStCLEVBQUUsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztZQUMvRCxPQUFPO2dCQUNILE9BQU8sRUFBRSxLQUFLO2dCQUNkLFlBQVksRUFBRSxPQUFPO2FBQ3hCLENBQUM7UUFDTixDQUFDO1FBQ0QsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLENBQUM7SUFDMUMsQ0FBQztJQUFDLE9BQU8sS0FBVSxFQUFFLENBQUM7UUFDbEIsR0FBRyxFQUFFLEtBQUssQ0FBQyw4QkFBOEIsRUFBRTtZQUN2QyxLQUFLLEVBQUUsS0FBSyxDQUFDLE9BQU87U0FDdkIsQ0FBQyxDQUFDO1FBQ0gsT0FBTztZQUNILE9BQU8sRUFBRSxLQUFLO1lBQ2QsWUFBWSxFQUFFLGlDQUFpQyxLQUFLLENBQUMsT0FBTyxFQUFFO1NBQ2pFLENBQUM7SUFDTixDQUFDO0FBQ0wsQ0FBQyxDQUFDO0FBckVXLFFBQUEsOEJBQThCLGtDQXFFekMifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@super-protocol/pki-attestation-engine",
-  "version": "3.0.1",
+  "version": "3.0.3",
   "description": "",
   "main": "dist/index.js",
   "module": "dist/index.js",
@@ -21,7 +21,7 @@
   "dependencies": {
     "@sinclair/typebox": "0.33.22",
     "@super-protocol/addons-tee": "^1.0.0",
-    "@super-protocol/pki-common": "^3.0.0",
+    "@super-protocol/pki-common": "^3.0.1",
     "@super-protocol/sp-nvtrust-wrapper": "^2.0.6"
   },
   "peerDependencies": {