@super-protocol/pki-sync-client 0.0.0-nvidia-local-verifier

package/dist/sync-client.js

@@ -0,0 +1,366 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SyncClient = void 0;
+const pki_client_1 = require("@super-protocol/pki-client");
+const pki_api_client_1 = require("@super-protocol/pki-api-client");
+const pki_common_1 = require("@super-protocol/pki-common");
+const pki_attestation_engine_1 = require("@super-protocol/pki-attestation-engine");
+const root_certificate_verifier_1 = require("./root-certificate-verifier");
+const sdk_js_1 = require("@super-protocol/sdk-js");
+const axios_1 = __importDefault(require("axios"));
+const fs = __importStar(require("fs"));
+const https = __importStar(require("https"));
+const path = __importStar(require("path"));
+class SyncClient {
+    static DEFAULT_RETRY_ATTEMPTS = 1; // (default disable retries)
+    static DEFAULT_RETRY_DELAY_SEC = 10;
+    static RETRYABLE_NETWORK_ERROR_CODES = new Set([
+        'ETIMEDOUT',
+        'ECONNRESET',
+        'ECONNREFUSED',
+        'EAI_AGAIN',
+        'ENOTFOUND',
+        'ECONNABORTED',
+    ]);
+    static RETRYABLE_HTTP_STATUS_CODES = new Set([429, 502]);
+    options;
+    challenge;
+    logger;
+    retryAttempts;
+    retryDelaySec;
+    static getNvidiaTokenMode(challengeType) {
+        switch (challengeType) {
+            case pki_common_1.ChallengeType.TDX:
+            case pki_common_1.ChallengeType.TDXGOOGLE:
+            case pki_common_1.ChallengeType.TDXAZURE:
+            case pki_common_1.ChallengeType.SEVSNP:
+            case pki_common_1.ChallengeType.SEVSNPAZURE:
+                return {
+                    supported: true,
+                    mode: 'auto-detect',
+                };
+            default:
+                return {
+                    supported: false,
+                    mode: 'not-applicable',
+                };
+        }
+    }
+    static resolveLogger(options) {
+        if (options.logLevel == null) {
+            return new pki_common_1.CommonMockLog();
+        }
+        const allowedLevels = Object.values(pki_common_1.LogLevel);
+        if (!allowedLevels.includes(options.logLevel)) {
+            throw new Error(`Unsupported log level: ${options.logLevel}. Supported: ${allowedLevels.join(', ')}`);
+        }
+        return new pki_common_1.CommonPinoLog(options.logLevel);
+    }
+    constructor(options) {
+        this.options = options;
+        this.logger = SyncClient.resolveLogger(options).child({
+            service: 'SyncClient',
+        });
+        this.retryAttempts = SyncClient.normalizeRetryAttempts(options.retryAttempts);
+        this.retryDelaySec = SyncClient.normalizeRetryDelaySec(options.retryDelaySec);
+    }
+    static buildChallengeConfig(challengeType) {
+        switch (challengeType) {
+            case pki_common_1.ChallengeType.TDX:
+            case pki_common_1.ChallengeType.TDXGOOGLE:
+            case pki_common_1.ChallengeType.TDXAZURE:
+            case pki_common_1.ChallengeType.SEVSNP:
+            case pki_common_1.ChallengeType.SEVSNPAZURE:
+                return { type: challengeType };
+            case pki_common_1.ChallengeType.Untrusted:
+                return {
+                    type: pki_common_1.ChallengeType.Untrusted,
+                    idHex: Buffer.from('pki-sync-client-untrusted-id').toString('hex'),
+                };
+            default:
+                throw new Error(`Unsupported challenge type: ${challengeType}. Supported: tdx, tdx-google, tdx-azure, sev-snp, sev-snp-azure, untrusted, auto`);
+        }
+    }
+    async resolveChallenge() {
+        if (this.challenge != null) {
+            return this.challenge;
+        }
+        const challengeType = this.options.ownChallenge === 'auto'
+            ? await (0, pki_attestation_engine_1.detectAttestationType)()
+            : this.options.ownChallenge;
+        if (this.options.ownChallenge === 'auto') {
+            this.logger.info('Detected attestation type for sync client', {
+                challengeType,
+            });
+        }
+        this.challenge = SyncClient.buildChallengeConfig(challengeType);
+        const nvidiaTokenMode = SyncClient.getNvidiaTokenMode(challengeType);
+        this.logger.info('Resolved sync challenge configuration', {
+            challengeType: this.challenge.type,
+            networkID: this.options.networkID,
+            disableServerIdentityCheck: this.options.disableServerIdentityCheck ?? false,
+            nvidiaTokenSupported: nvidiaTokenMode.supported,
+            nvidiaTokenMode: nvidiaTokenMode.mode,
+        });
+        return this.challenge;
+    }
+    static normalizeRetryAttempts(value) {
+        if (value == null) {
+            return SyncClient.DEFAULT_RETRY_ATTEMPTS;
+        }
+        if (!Number.isInteger(value) || value < 1) {
+            throw new Error('Invalid retryAttempts: must be an integer greater than or equal to 1');
+        }
+        return value;
+    }
+    static normalizeRetryDelaySec(value) {
+        if (value == null) {
+            return SyncClient.DEFAULT_RETRY_DELAY_SEC;
+        }
+        if (!Number.isInteger(value) || value < 0) {
+            throw new Error('Invalid retryDelaySec: must be an integer greater than or equal to 0');
+        }
+        return value;
+    }
+    static evaluateRetry(error) {
+        if (!axios_1.default.isAxiosError(error)) {
+            return {
+                isRetryable: false,
+                reason: 'non-axios-error',
+            };
+        }
+        const httpStatus = error.response?.status;
+        if (httpStatus != null) {
+            const reason = `http-status:${httpStatus}`;
+            return {
+                isRetryable: SyncClient.RETRYABLE_HTTP_STATUS_CODES.has(httpStatus),
+                reason,
+            };
+        }
+        const errorCode = error.code;
+        if (errorCode != null) {
+            const reason = `network-code:${errorCode}`;
+            return {
+                isRetryable: SyncClient.RETRYABLE_NETWORK_ERROR_CODES.has(errorCode),
+                reason,
+            };
+        }
+        return {
+            isRetryable: false,
+            reason: 'unknown-axios-error',
+        };
+    }
+    static buildChallengeProvider(challenge, log, verifier) {
+        switch (challenge.type) {
+            case pki_common_1.ChallengeType.TDX:
+            case pki_common_1.ChallengeType.TDXGOOGLE:
+                return new pki_client_1.ChallengeProviderTdx(log, challenge.type, verifier);
+            case pki_common_1.ChallengeType.SEVSNP:
+                return new pki_client_1.ChallengeProviderSevSnp(log, verifier);
+            case pki_common_1.ChallengeType.TDXAZURE:
+            case pki_common_1.ChallengeType.SEVSNPAZURE:
+                return new pki_client_1.ChallengeProviderAzure(log, challenge.type, verifier);
+            case pki_common_1.ChallengeType.Untrusted:
+                return new pki_client_1.ChallengeProviderUntrusted(Buffer.from(challenge.idHex, 'hex'), log);
+            default:
+                throw new Error(`Unsupported challenge type: ${challenge.type}. Supported: tdx, tdx-google, tdx-azure, sev-snp, sev-snp-azure, untrusted, auto`);
+        }
+    }
+    createHttpsAgent(clientCert) {
+        const { cert, intermediateCertificates } = (0, pki_common_1.extractIntermediateCertificates)(clientCert);
+        return new https.Agent({
+            ca: this.options.caBundle,
+            cert: cert + intermediateCertificates,
+            key: clientCert.keyPair.privateKeyPem,
+            ...(this.options.disableServerIdentityCheck && {
+                checkServerIdentity: () => undefined,
+            }),
+        });
+    }
+    createAttestationServiceClient(server) {
+        return new pki_api_client_1.StaticAttestationServiceClient({
+            baseUrls: `https://${server}/api/v1/pki`,
+            caBundle: this.options.caBundle,
+            useRootCerts: false,
+            disableServerIdentityCheck: this.options.disableServerIdentityCheck ?? false,
+        });
+    }
+    async preparePkiClient(server, challenge, log) {
+        const attestationServiceClient = this.createAttestationServiceClient(server);
+        const challengeProvider = SyncClient.buildChallengeProvider(challenge, log, this.options.nvtrust?.verifier);
+        const pkiClient = new pki_client_1.PkiClient({
+            challengeProvider,
+            attestationServiceClient,
+            networkID: this.options.networkID,
+        });
+        const clientCert = await pkiClient.generateSslCertificate([
+            'localhost',
+        ]);
+        (0, root_certificate_verifier_1.verifyRootCertificatesMatch)(this.options.caBundle, clientCert.caBundle, log);
+        return {
+            clientCert,
+            httpsAgent: this.createHttpsAgent(clientCert),
+        };
+    }
+    async fetchSecrets(server, config, httpsAgent) {
+        const secretNames = config.secrets.map((s) => s.secretName);
+        const response = await axios_1.default.post(`https://${server}/api/v1/secrets/get`, { objects: secretNames }, { httpsAgent });
+        return response.data.secrets;
+    }
+    async saveSecrets(config, secrets) {
+        for (const secret of config.secrets) {
+            const base64Content = secrets[secret.secretName];
+            if (base64Content == null) {
+                throw new Error(`Secret "${secret.secretName}" not found in response`);
+            }
+            const dir = path.dirname(secret.saveTo);
+            await fs.promises.mkdir(dir, { recursive: true });
+            await fs.promises.writeFile(secret.saveTo, base64Content, {
+                encoding: 'base64',
+                mode: 0o600,
+            });
+            this.logger.info(`Saved secret "${secret.secretName}" to ${secret.saveTo}`);
+        }
+    }
+    async saveArtifacts(config, secrets, clientCert) {
+        await this.saveSecrets(config, secrets);
+        if (this.options.saveCertsToDir) {
+            await this.saveCertificates(clientCert, this.options.saveCertsToDir, this.options.saveCertsPrefix);
+        }
+    }
+    async saveCertificates(cert, certsDir, prefix) {
+        // Ensure directory exists
+        await fs.promises.mkdir(certsDir, { recursive: true });
+        const { cert: clientCert, intermediateCertificates, ca, } = (0, pki_common_1.extractIntermediateCertificates)(cert);
+        const prefixStr = prefix ? `${prefix}_` : '';
+        // Save private key
+        const keyPath = path.join(certsDir, `${prefixStr}key.pem`);
+        await fs.promises.writeFile(keyPath, cert.keyPair.privateKeyPem, {
+            mode: 0o600,
+        });
+        this.logger.info(`Saved private key to ${keyPath}`);
+        // Save CA certificate
+        const caPath = path.join(certsDir, `${prefixStr}ca.pem`);
+        await fs.promises.writeFile(caPath, ca, { mode: 0o644 });
+        this.logger.info(`Saved CA certificate to ${caPath}`);
+        // Save client certificate with intermediate chain
+        const certWithIntermediate = clientCert + intermediateCertificates;
+        const certPath = path.join(certsDir, `${prefixStr}cert.pem`);
+        await fs.promises.writeFile(certPath, certWithIntermediate, {
+            mode: 0o644,
+        });
+        this.logger.info(`Saved certificate chain to ${certPath}`);
+    }
+    async sync(config) {
+        const challenge = await this.resolveChallenge();
+        if (this.options.disableServerIdentityCheck) {
+            this.logger.warn('Server identity verification is disabled because disableServerIdentityCheck is enabled');
+        }
+        await (0, root_certificate_verifier_1.verifyRootCertificateTrust)({
+            caBundle: this.options.caBundle,
+            networkTypeFile: this.options.networkTypeFile,
+            log: this.logger,
+        });
+        this.logger.info('Configured PKI authority CA bundle verified successfully');
+        for (const server of this.options.servers) {
+            const serverLog = this.logger.child({
+                server,
+                challengeType: challenge.type,
+            });
+            let clientCert;
+            let httpsAgent;
+            try {
+                serverLog.info('Trying sync server');
+                serverLog.debug('Preparing PKI client for sync server', {
+                    disableServerIdentityCheck: this.options.disableServerIdentityCheck ?? false,
+                    useSystemRootCertificates: false,
+                });
+                const preparedClient = await this.preparePkiClient(server, challenge, serverLog);
+                clientCert = preparedClient.clientCert;
+                httpsAgent = preparedClient.httpsAgent;
+                serverLog.info('PKI client prepared successfully');
+            }
+            catch (error) {
+                const errorMessage = error instanceof Error ? error.message : String(error);
+                serverLog.error(`Failed to prepare client for sync server: ${errorMessage}. Reason: non-axios-error`);
+                continue;
+            }
+            let fetchedSecrets;
+            let attempt = 0;
+            try {
+                fetchedSecrets = await sdk_js_1.helpers.tryWithInterval({
+                    handler: async () => {
+                        attempt += 1;
+                        serverLog.info(`POST attempt ${attempt}/${this.retryAttempts} for sync server`);
+                        return await this.fetchSecrets(server, config, httpsAgent);
+                    },
+                    checkError: (error) => {
+                        const errorMessage = error instanceof Error
+                            ? error.message
+                            : String(error);
+                        const retryDecision = SyncClient.evaluateRetry(error);
+                        const hasMoreAttempts = attempt < this.retryAttempts;
+                        serverLog.error(`Failed attempt ${attempt}/${this.retryAttempts} for sync server: ${errorMessage}. Reason: ${retryDecision.reason}`);
+                        if (!retryDecision.isRetryable) {
+                            serverLog.error(`Error is not retryable for sync server; moving to next server. Reason: ${retryDecision.reason}`);
+                            return { retryable: false };
+                        }
+                        if (hasMoreAttempts) {
+                            serverLog.info(`Retrying sync server in ${this.retryDelaySec} second(s). Reason: ${retryDecision.reason}`);
+                        }
+                        return { retryable: retryDecision.isRetryable };
+                    },
+                    retryInterval: this.retryDelaySec * 1000,
+                    retryMax: this.retryAttempts,
+                });
+            }
+            catch {
+                continue;
+            }
+            if (fetchedSecrets == null) {
+                continue;
+            }
+            try {
+                await this.saveArtifacts(config, fetchedSecrets, clientCert);
+                serverLog.info('Successfully synced from server');
+                return;
+            }
+            catch (error) {
+                const errorMessage = error instanceof Error ? error.message : String(error);
+                const reason = axios_1.default.isAxiosError(error)
+                    ? SyncClient.evaluateRetry(error).reason
+                    : 'unknown-post-error';
+                serverLog.error(`Failed to process sync results for server: ${errorMessage}. Reason: ${reason}`);
+            }
+        }
+        throw new Error('Failed to sync from all servers');
+    }
+}
+exports.SyncClient = SyncClient;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3luYy1jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvc3luYy1jbGllbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFDQSwyREFRb0M7QUFDcEMsbUVBQWdGO0FBQ2hGLDJEQVFvQztBQUNwQyxtRkFHZ0Q7QUFDaEQsMkVBR3FDO0FBQ3JDLG1EQUFpRDtBQUNqRCxrREFBMEI7QUFDMUIsdUNBQXlCO0FBQ3pCLDZDQUErQjtBQUMvQiwyQ0FBNkI7QUFtQjdCLE1BQWEsVUFBVTtJQUNuQixNQUFNLENBQVUsc0JBQXNCLEdBQUcsQ0FBQyxDQUFDLENBQUMsNEJBQTRCO0lBQ3hFLE1BQU0sQ0FBVSx1QkFBdUIsR0FBRyxFQUFFLENBQUM7SUFDckMsTUFBTSxDQUFVLDZCQUE2QixHQUFHLElBQUksR0FBRyxDQUFDO1FBQzVELFdBQVc7UUFDWCxZQUFZO1FBQ1osY0FBYztRQUNkLFdBQVc7UUFDWCxXQUFXO1FBQ1gsY0FBYztLQUNqQixDQUFDLENBQUM7SUFDSyxNQUFNLENBQVUsMkJBQTJCLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQyxHQUFHLEVBQUUsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUVsRSxPQUFPLENBQW9CO0lBQzNCLFNBQVMsQ0FBbUI7SUFDNUIsTUFBTSxDQUFNO0lBQ1osYUFBYSxDQUFTO0lBQ3RCLGFBQWEsQ0FBUztJQUV0QixNQUFNLENBQUMsa0JBQWtCLENBQUMsYUFBb0M7UUFJbEUsUUFBUSxhQUFhLEVBQUUsQ0FBQztZQUNwQixLQUFLLDBCQUFhLENBQUMsR0FBRyxDQUFDO1lBQ3ZCLEtBQUssMEJBQWEsQ0FBQyxTQUFTLENBQUM7WUFDN0IsS0FBSywwQkFBYSxDQUFDLFFBQVEsQ0FBQztZQUM1QixLQUFLLDBCQUFhLENBQUMsTUFBTSxDQUFDO1lBQzFCLEtBQUssMEJBQWEsQ0FBQyxXQUFXO2dCQUMxQixPQUFPO29CQUNILFNBQVMsRUFBRSxJQUFJO29CQUNmLElBQUksRUFBRSxhQUFhO2lCQUN0QixDQUFDO1lBQ047Z0JBQ0ksT0FBTztvQkFDSCxTQUFTLEVBQUUsS0FBSztvQkFDaEIsSUFBSSxFQUFFLGdCQUFnQjtpQkFDekIsQ0FBQztRQUNWLENBQUM7SUFDTCxDQUFDO0lBRU8sTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUEwQjtRQUNuRCxJQUFJLE9BQU8sQ0FBQyxRQUFRLElBQUksSUFBSSxFQUFFLENBQUM7WUFDM0IsT0FBTyxJQUFJLDBCQUFPLEVBQUUsQ0FBQztRQUN6QixDQUFDO1FBRUQsTUFBTSxhQUFhLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxxQkFBUSxDQUFhLENBQUM7UUFDMUQsSUFBSSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDNUMsTUFBTSxJQUFJLEtBQUssQ0FDWCwwQkFBMEIsT0FBTyxDQUFDLFFBQVEsZ0JBQWdCLGFBQWEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FDdkYsQ0FBQztRQUNOLENBQUM7UUFFRCxPQUFPLElBQUksMEJBQU8sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDekMsQ0FBQztJQUVELFlBQVksT0FBMEI7UUFDbEMsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUM7UUFDdkIsSUFBSSxDQUFDLE1BQU0sR0FBRyxVQUFVLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxDQUFDLEtBQUssQ0FBQztZQUNsRCxPQUFPLEVBQUUsWUFBWTtTQUN4QixDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsYUFBYSxHQUFHLFVBQVUsQ0FBQyxzQkFBc0IsQ0FDbEQsT0FBTyxDQUFDLGFBQWEsQ0FDeEIsQ0FBQztRQUNGLElBQUksQ0FBQyxhQUFhLEdBQUcsVUFBVSxDQUFDLHNCQUFzQixDQUNsRCxPQUFPLENBQUMsYUFBYSxDQUN4QixDQUFDO0lBQ04sQ0FBQztJQUVPLE1BQU0sQ0FBQyxvQkFBb0IsQ0FDL0IsYUFBb0M7UUFFcEMsUUFBUSxhQUFhLEVBQUUsQ0FBQztZQUNwQixLQUFLLDBCQUFhLENBQUMsR0FBRyxDQUFDO1lBQ3ZCLEtBQUssMEJBQWEsQ0FBQyxTQUFTLENBQUM7WUFDN0IsS0FBSywwQkFBYSxDQUFDLFFBQVEsQ0FBQztZQUM1QixLQUFLLDBCQUFhLENBQUMsTUFBTSxDQUFDO1lBQzFCLEtBQUssMEJBQWEsQ0FBQyxXQUFXO2dCQUMxQixPQUFPLEVBQUUsSUFBSSxFQUFFLGFBQWEsRUFBRSxDQUFDO1lBQ25DLEtBQUssMEJBQWEsQ0FBQyxTQUFTO2dCQUN4QixPQUFPO29CQUNILElBQUksRUFBRSwwQkFBYSxDQUFDLFNBQVM7b0JBQzdCLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLDhCQUE4QixDQUFDLENBQUMsUUFBUSxDQUN2RCxLQUFLLENBQ1I7aUJBQ0osQ0FBQztZQUNOO2dCQUNJLE1BQU0sSUFBSSxLQUFLLENBQ1gsK0JBQStCLGFBQWEsa0ZBQWtGLENBQ2pJLENBQUM7UUFDVixDQUFDO0lBQ0wsQ0FBQztJQUVPLEtBQUssQ0FBQyxnQkFBZ0I7UUFDMUIsSUFBSSxJQUFJLENBQUMsU0FBUyxJQUFJLElBQUksRUFBRSxDQUFDO1lBQ3pCLE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUMxQixDQUFDO1FBRUQsTUFBTSxhQUFhLEdBQ2YsSUFBSSxDQUFDLE9BQU8sQ0FBQyxZQUFZLEtBQUssTUFBTTtZQUNoQyxDQUFDLENBQUMsTUFBTSxJQUFBLDhDQUFxQixHQUFFO1lBQy9CLENBQUMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQztRQUVwQyxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsWUFBWSxLQUFLLE1BQU0sRUFBRSxDQUFDO1lBQ3ZDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLDJDQUEyQyxFQUFFO2dCQUMxRCxhQUFhO2FBQ2hCLENBQUMsQ0FBQztRQUNQLENBQUM7UUFFRCxJQUFJLENBQUMsU0FBUyxHQUFHLFVBQVUsQ0FBQyxvQkFBb0IsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUNoRSxNQUFNLGVBQWUsR0FBRyxVQUFVLENBQUMsa0JBQWtCLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDckUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsdUNBQXVDLEVBQUU7WUFDdEQsYUFBYSxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSTtZQUNsQyxTQUFTLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxTQUFTO1lBQ2pDLDBCQUEwQixFQUN0QixJQUFJLENBQUMsT0FBTyxDQUFDLDBCQUEwQixJQUFJLEtBQUs7WUFDcEQsb0JBQW9CLEVBQUUsZUFBZSxDQUFDLFNBQVM7WUFDL0MsZUFBZSxFQUFFLGVBQWUsQ0FBQyxJQUFJO1NBQ3hDLENBQUMsQ0FBQztRQUNILE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQztJQUMxQixDQUFDO0lBRU8sTUFBTSxDQUFDLHNCQUFzQixDQUFDLEtBQXlCO1FBQzNELElBQUksS0FBSyxJQUFJLElBQUksRUFBRSxDQUFDO1lBQ2hCLE9BQU8sVUFBVSxDQUFDLHNCQUFzQixDQUFDO1FBQzdDLENBQUM7UUFFRCxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDeEMsTUFBTSxJQUFJLEtBQUssQ0FDWCxzRUFBc0UsQ0FDekUsQ0FBQztRQUNOLENBQUM7UUFFRCxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBRU8sTUFBTSxDQUFDLHNCQUFzQixDQUFDLEtBQXlCO1FBQzNELElBQUksS0FBSyxJQUFJLElBQUksRUFBRSxDQUFDO1lBQ2hCLE9BQU8sVUFBVSxDQUFDLHVCQUF1QixDQUFDO1FBQzlDLENBQUM7UUFFRCxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDeEMsTUFBTSxJQUFJLEtBQUssQ0FDWCxzRUFBc0UsQ0FDekUsQ0FBQztRQUNOLENBQUM7UUFFRCxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBRU8sTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFjO1FBSXZDLElBQUksQ0FBQyxlQUFLLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDN0IsT0FBTztnQkFDSCxXQUFXLEVBQUUsS0FBSztnQkFDbEIsTUFBTSxFQUFFLGlCQUFpQjthQUM1QixDQUFDO1FBQ04sQ0FBQztRQUVELE1BQU0sVUFBVSxHQUFHLEtBQUssQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDO1FBQzFDLElBQUksVUFBVSxJQUFJLElBQUksRUFBRSxDQUFDO1lBQ3JCLE1BQU0sTUFBTSxHQUFHLGVBQWUsVUFBVSxFQUFFLENBQUM7WUFDM0MsT0FBTztnQkFDSCxXQUFXLEVBQ1AsVUFBVSxDQUFDLDJCQUEyQixDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUM7Z0JBQzFELE1BQU07YUFDVCxDQUFDO1FBQ04sQ0FBQztRQUVELE1BQU0sU0FBUyxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUM7UUFDN0IsSUFBSSxTQUFTLElBQUksSUFBSSxFQUFFLENBQUM7WUFDcEIsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLFNBQVMsRUFBRSxDQUFDO1lBQzNDLE9BQU87Z0JBQ0gsV0FBVyxFQUNQLFVBQVUsQ0FBQyw2QkFBNkIsQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDO2dCQUMzRCxNQUFNO2FBQ1QsQ0FBQztRQUNOLENBQUM7UUFFRCxPQUFPO1lBQ0gsV0FBVyxFQUFFLEtBQUs7WUFDbEIsTUFBTSxFQUFFLHFCQUFxQjtTQUNoQyxDQUFDO0lBQ04sQ0FBQztJQUVPLE1BQU0sQ0FBQyxzQkFBc0IsQ0FDakMsU0FBMEIsRUFDMUIsR0FBUSxFQUNSLFFBQTZCO1FBRTdCLFFBQVEsU0FBUyxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ3JCLEtBQUssMEJBQWEsQ0FBQyxHQUFHLENBQUM7WUFDdkIsS0FBSywwQkFBYSxDQUFDLFNBQVM7Z0JBQ3hCLE9BQU8sSUFBSSxpQ0FBb0IsQ0FBQyxHQUFHLEVBQUUsU0FBUyxDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsQ0FBQztZQUNuRSxLQUFLLDBCQUFhLENBQUMsTUFBTTtnQkFDckIsT0FBTyxJQUFJLG9DQUF1QixDQUFDLEdBQUcsRUFBRSxRQUFRLENBQUMsQ0FBQztZQUN0RCxLQUFLLDBCQUFhLENBQUMsUUFBUSxDQUFDO1lBQzVCLEtBQUssMEJBQWEsQ0FBQyxXQUFXO2dCQUMxQixPQUFPLElBQUksbUNBQXNCLENBQzdCLEdBQUcsRUFDSCxTQUFTLENBQUMsSUFBSSxFQUNkLFFBQVEsQ0FDWCxDQUFDO1lBQ04sS0FBSywwQkFBYSxDQUFDLFNBQVM7Z0JBQ3hCLE9BQU8sSUFBSSx1Q0FBMEIsQ0FDakMsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQyxFQUNuQyxHQUFHLENBQ04sQ0FBQztZQUNOO2dCQUNJLE1BQU0sSUFBSSxLQUFLLENBQ1gsK0JBQStCLFNBQVMsQ0FBQyxJQUFJLGtGQUFrRixDQUNsSSxDQUFDO1FBQ1YsQ0FBQztJQUNMLENBQUM7SUFFTyxnQkFBZ0IsQ0FBQyxVQUE2QjtRQUNsRCxNQUFNLEVBQUUsSUFBSSxFQUFFLHdCQUF3QixFQUFFLEdBQ3BDLElBQUEsNENBQStCLEVBQUMsVUFBVSxDQUFDLENBQUM7UUFFaEQsT0FBTyxJQUFJLEtBQUssQ0FBQyxLQUFLLENBQUM7WUFDbkIsRUFBRSxFQUFFLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUTtZQUN6QixJQUFJLEVBQUUsSUFBSSxHQUFHLHdCQUF3QjtZQUNyQyxHQUFHLEVBQUUsVUFBVSxDQUFDLE9BQU8sQ0FBQyxhQUFhO1lBQ3JDLEdBQUcsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLDBCQUEwQixJQUFJO2dCQUMzQyxtQkFBbUIsRUFBRSxHQUFHLEVBQUUsQ0FBQyxTQUFTO2FBQ3ZDLENBQUM7U0FDTCxDQUFDLENBQUM7SUFDUCxDQUFDO0lBRU8sOEJBQThCLENBQ2xDLE1BQWM7UUFFZCxPQUFPLElBQUksK0NBQThCLENBQUM7WUFDdEMsUUFBUSxFQUFFLFdBQVcsTUFBTSxhQUFhO1lBQ3hDLFFBQVEsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVE7WUFDL0IsWUFBWSxFQUFFLEtBQUs7WUFDbkIsMEJBQTBCLEVBQ3RCLElBQUksQ0FBQyxPQUFPLENBQUMsMEJBQTBCLElBQUksS0FBSztTQUN2RCxDQUFDLENBQUM7SUFDUCxDQUFDO0lBRU8sS0FBSyxDQUFDLGdCQUFnQixDQUMxQixNQUFjLEVBQ2QsU0FBMEIsRUFDMUIsR0FBUTtRQUtSLE1BQU0sd0JBQXdCLEdBQzFCLElBQUksQ0FBQyw4QkFBOEIsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNoRCxNQUFNLGlCQUFpQixHQUFHLFVBQVUsQ0FBQyxzQkFBc0IsQ0FDdkQsU0FBUyxFQUNULEdBQUcsRUFDSCxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxRQUFRLENBQ2pDLENBQUM7UUFDRixNQUFNLFNBQVMsR0FBRyxJQUFJLHNCQUFTLENBQUM7WUFDNUIsaUJBQWlCO1lBQ2pCLHdCQUF3QjtZQUN4QixTQUFTLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxTQUFTO1NBQ3BDLENBQUMsQ0FBQztRQUNILE1BQU0sVUFBVSxHQUFHLE1BQU0sU0FBUyxDQUFDLHNCQUFzQixDQUFDO1lBQ3RELFdBQVc7U0FDZCxDQUFDLENBQUM7UUFFSCxJQUFBLHVEQUEyQixFQUN2QixJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsRUFDckIsVUFBVSxDQUFDLFFBQVEsRUFDbkIsR0FBRyxDQUNOLENBQUM7UUFFRixPQUFPO1lBQ0gsVUFBVTtZQUNWLFVBQVUsRUFBRSxJQUFJLENBQUMsZ0JBQWdCLENBQUMsVUFBVSxDQUFDO1NBQ2hELENBQUM7SUFDTixDQUFDO0lBRU8sS0FBSyxDQUFDLFlBQVksQ0FDdEIsTUFBYyxFQUNkLE1BQWtCLEVBQ2xCLFVBQXVCO1FBRXZCLE1BQU0sV0FBVyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLENBQUM7UUFFNUQsTUFBTSxRQUFRLEdBQUcsTUFBTSxlQUFLLENBQUMsSUFBSSxDQUM3QixXQUFXLE1BQU0scUJBQXFCLEVBQ3RDLEVBQUUsT0FBTyxFQUFFLFdBQVcsRUFBRSxFQUN4QixFQUFFLFVBQVUsRUFBRSxDQUNqQixDQUFDO1FBRUYsT0FBTyxRQUFRLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQztJQUNqQyxDQUFDO0lBRU8sS0FBSyxDQUFDLFdBQVcsQ0FDckIsTUFBa0IsRUFDbEIsT0FBK0I7UUFFL0IsS0FBSyxNQUFNLE1BQU0sSUFBSSxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDbEMsTUFBTSxhQUFhLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUNqRCxJQUFJLGFBQWEsSUFBSSxJQUFJLEVBQUUsQ0FBQztnQkFDeEIsTUFBTSxJQUFJLEtBQUssQ0FDWCxXQUFXLE1BQU0sQ0FBQyxVQUFVLHlCQUF5QixDQUN4RCxDQUFDO1lBQ04sQ0FBQztZQUVELE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQ3hDLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7WUFFbEQsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLGFBQWEsRUFBRTtnQkFDdEQsUUFBUSxFQUFFLFFBQVE7Z0JBQ2xCLElBQUksRUFBRSxLQUFLO2FBQ2QsQ0FBQyxDQUFDO1lBRUgsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQ1osaUJBQWlCLE1BQU0sQ0FBQyxVQUFVLFFBQVEsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUM1RCxDQUFDO1FBQ04sQ0FBQztJQUNMLENBQUM7SUFFTyxLQUFLLENBQUMsYUFBYSxDQUN2QixNQUFrQixFQUNsQixPQUErQixFQUMvQixVQUE2QjtRQUU3QixNQUFNLElBQUksQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBRXhDLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUM5QixNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FDdkIsVUFBVSxFQUNWLElBQUksQ0FBQyxPQUFPLENBQUMsY0FBYyxFQUMzQixJQUFJLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FDL0IsQ0FBQztRQUNOLENBQUM7SUFDTCxDQUFDO0lBRU8sS0FBSyxDQUFDLGdCQUFnQixDQUMxQixJQUF1QixFQUN2QixRQUFnQixFQUNoQixNQUFlO1FBRWYsMEJBQTBCO1FBQzFCLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFFdkQsTUFBTSxFQUNGLElBQUksRUFBRSxVQUFVLEVBQ2hCLHdCQUF3QixFQUN4QixFQUFFLEdBQ0wsR0FBRyxJQUFBLDRDQUErQixFQUFDLElBQUksQ0FBQyxDQUFDO1FBRTFDLE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxDQUFDLENBQUMsR0FBRyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBRTdDLG1CQUFtQjtRQUNuQixNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxHQUFHLFNBQVMsU0FBUyxDQUFDLENBQUM7UUFDM0QsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxhQUFhLEVBQUU7WUFDN0QsSUFBSSxFQUFFLEtBQUs7U0FDZCxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyx3QkFBd0IsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUVwRCxzQkFBc0I7UUFDdEIsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsR0FBRyxTQUFTLFFBQVEsQ0FBQyxDQUFDO1FBQ3pELE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsTUFBTSxFQUFFLEVBQUUsRUFBRSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO1FBQ3pELElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBRXRELGtEQUFrRDtRQUNsRCxNQUFNLG9CQUFvQixHQUFHLFVBQVUsR0FBRyx3QkFBd0IsQ0FBQztRQUNuRSxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxHQUFHLFNBQVMsVUFBVSxDQUFDLENBQUM7UUFDN0QsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxRQUFRLEVBQUUsb0JBQW9CLEVBQUU7WUFDeEQsSUFBSSxFQUFFLEtBQUs7U0FDZCxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyw4QkFBOEIsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUMvRCxDQUFDO0lBRUQsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFrQjtRQUN6QixNQUFNLFNBQVMsR0FBRyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1FBRWhELElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQywwQkFBMEIsRUFBRSxDQUFDO1lBQzFDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUNaLHdGQUF3RixDQUMzRixDQUFDO1FBQ04sQ0FBQztRQUNELE1BQU0sSUFBQSxzREFBMEIsRUFBQztZQUM3QixRQUFRLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRO1lBQy9CLGVBQWUsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLGVBQWU7WUFDN0MsR0FBRyxFQUFFLElBQUksQ0FBQyxNQUFNO1NBQ25CLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUNaLDBEQUEwRCxDQUM3RCxDQUFDO1FBRUYsS0FBSyxNQUFNLE1BQU0sSUFBSSxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3hDLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO2dCQUNoQyxNQUFNO2dCQUNOLGFBQWEsRUFBRSxTQUFTLENBQUMsSUFBSTthQUNoQyxDQUFDLENBQUM7WUFDSCxJQUFJLFVBQTZCLENBQUM7WUFDbEMsSUFBSSxVQUF1QixDQUFDO1lBRTVCLElBQUksQ0FBQztnQkFDRCxTQUFTLENBQUMsSUFBSSxDQUFDLG9CQUFvQixDQUFDLENBQUM7Z0JBRXJDLFNBQVMsQ0FBQyxLQUFLLENBQUMsc0NBQXNDLEVBQUU7b0JBQ3BELDBCQUEwQixFQUN0QixJQUFJLENBQUMsT0FBTyxDQUFDLDBCQUEwQixJQUFJLEtBQUs7b0JBQ3BELHlCQUF5QixFQUFFLEtBQUs7aUJBQ25DLENBQUMsQ0FBQztnQkFDSCxNQUFNLGNBQWMsR0FBRyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FDOUMsTUFBTSxFQUNOLFNBQVMsRUFDVCxTQUFTLENBQ1osQ0FBQztnQkFDRixVQUFVLEdBQUcsY0FBYyxDQUFDLFVBQVUsQ0FBQztnQkFDdkMsVUFBVSxHQUFHLGNBQWMsQ0FBQyxVQUFVLENBQUM7Z0JBQ3ZDLFNBQVMsQ0FBQyxJQUFJLENBQUMsa0NBQWtDLENBQUMsQ0FBQztZQUN2RCxDQUFDO1lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztnQkFDYixNQUFNLFlBQVksR0FDZCxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7Z0JBQzNELFNBQVMsQ0FBQyxLQUFLLENBQ1gsNkNBQTZDLFlBQVksMkJBQTJCLENBQ3ZGLENBQUM7Z0JBQ0YsU0FBUztZQUNiLENBQUM7WUFFRCxJQUFJLGNBQWtELENBQUM7WUFDdkQsSUFBSSxPQUFPLEdBQUcsQ0FBQyxDQUFDO1lBRWhCLElBQUksQ0FBQztnQkFDRCxjQUFjLEdBQUcsTUFBTSxnQkFBTyxDQUFDLGVBQWUsQ0FFNUM7b0JBQ0UsT0FBTyxFQUFFLEtBQUssSUFBSSxFQUFFO3dCQUNoQixPQUFPLElBQUksQ0FBQyxDQUFDO3dCQUNiLFNBQVMsQ0FBQyxJQUFJLENBQ1YsZ0JBQWdCLE9BQU8sSUFBSSxJQUFJLENBQUMsYUFBYSxrQkFBa0IsQ0FDbEUsQ0FBQzt3QkFFRixPQUFPLE1BQU0sSUFBSSxDQUFDLFlBQVksQ0FDMUIsTUFBTSxFQUNOLE1BQU0sRUFDTixVQUFVLENBQ2IsQ0FBQztvQkFDTixDQUFDO29CQUNELFVBQVUsRUFBRSxDQUFDLEtBQUssRUFBRSxFQUFFO3dCQUNsQixNQUFNLFlBQVksR0FDZCxLQUFLLFlBQVksS0FBSzs0QkFDbEIsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPOzRCQUNmLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7d0JBQ3hCLE1BQU0sYUFBYSxHQUFHLFVBQVUsQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUM7d0JBQ3RELE1BQU0sZUFBZSxHQUFHLE9BQU8sR0FBRyxJQUFJLENBQUMsYUFBYSxDQUFDO3dCQUVyRCxTQUFTLENBQUMsS0FBSyxDQUNYLGtCQUFrQixPQUFPLElBQUksSUFBSSxDQUFDLGFBQWEscUJBQXFCLFlBQVksYUFBYSxhQUFhLENBQUMsTUFBTSxFQUFFLENBQ3RILENBQUM7d0JBRUYsSUFBSSxDQUFDLGFBQWEsQ0FBQyxXQUFXLEVBQUUsQ0FBQzs0QkFDN0IsU0FBUyxDQUFDLEtBQUssQ0FDWCwwRUFBMEUsYUFBYSxDQUFDLE1BQU0sRUFBRSxDQUNuRyxDQUFDOzRCQUNGLE9BQU8sRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFLENBQUM7d0JBQ2hDLENBQUM7d0JBRUQsSUFBSSxlQUFlLEVBQUUsQ0FBQzs0QkFDbEIsU0FBUyxDQUFDLElBQUksQ0FDViwyQkFBMkIsSUFBSSxDQUFDLGFBQWEsdUJBQXVCLGFBQWEsQ0FBQyxNQUFNLEVBQUUsQ0FDN0YsQ0FBQzt3QkFDTixDQUFDO3dCQUNELE9BQU8sRUFBRSxTQUFTLEVBQUUsYUFBYSxDQUFDLFdBQVcsRUFBRSxDQUFDO29CQUNwRCxDQUFDO29CQUNELGFBQWEsRUFBRSxJQUFJLENBQUMsYUFBYSxHQUFHLElBQUk7b0JBQ3hDLFFBQVEsRUFBRSxJQUFJLENBQUMsYUFBYTtpQkFDL0IsQ0FBQyxDQUFDO1lBQ1AsQ0FBQztZQUFDLE1BQU0sQ0FBQztnQkFDTCxTQUFTO1lBQ2IsQ0FBQztZQUVELElBQUksY0FBYyxJQUFJLElBQUksRUFBRSxDQUFDO2dCQUN6QixTQUFTO1lBQ2IsQ0FBQztZQUVELElBQUksQ0FBQztnQkFDRCxNQUFNLElBQUksQ0FBQyxhQUFhLENBQUMsTUFBTSxFQUFFLGNBQWMsRUFBRSxVQUFVLENBQUMsQ0FBQztnQkFDN0QsU0FBUyxDQUFDLElBQUksQ0FBQyxpQ0FBaUMsQ0FBQyxDQUFDO2dCQUNsRCxPQUFPO1lBQ1gsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2IsTUFBTSxZQUFZLEdBQ2QsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUMzRCxNQUFNLE1BQU0sR0FBRyxlQUFLLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQztvQkFDcEMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTTtvQkFDeEMsQ0FBQyxDQUFDLG9CQUFvQixDQUFDO2dCQUMzQixTQUFTLENBQUMsS0FBSyxDQUNYLDhDQUE4QyxZQUFZLGFBQWEsTUFBTSxFQUFFLENBQ2xGLENBQUM7WUFDTixDQUFDO1FBQ0wsQ0FBQztRQUVELE1BQU0sSUFBSSxLQUFLLENBQUMsaUNBQWlDLENBQUMsQ0FBQztJQUN2RCxDQUFDOztBQWpmTCxnQ0FrZkMifQ==

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@super-protocol/pki-sync-client",
+  "version": "0.0.0-nvidia-local-verifier",
+  "description": "PKI sync client utility",
+  "main": "dist/index.js",
+  "bin": {
+    "pki-sync-client": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "directories": {
+    "lib": "dist"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "start": "ts-node src/cli.ts",
+    "lint": "eslint --max-warnings=0 src",
+    "lint:fix": "eslint --fix src"
+  },
+  "author": "Super Protocol",
+  "license": "ISC",
+  "engines": {
+    "node": ">=24.0.0",
+    "npm": ">=11.0.0"
+  },
+  "dependencies": {
+    "@sinclair/typebox": "0.33.22",
+    "@super-protocol/attestation-common": "^0.3.1",
+    "@super-protocol/attestation-wasm": "^0.3.0",
+    "@super-protocol/pki-api-client": "^5.1.0",
+    "@super-protocol/pki-attestation-engine": "0.0.0-nvidia-local-verifier",
+    "@super-protocol/pki-client": "0.0.0-nvidia-local-verifier",
+    "@super-protocol/pki-common": "0.0.0-nvidia-local-verifier",
+    "axios": "^1.16.0",
+    "js-yaml": "^4.1.0",
+    "yargs": "^17.7.2"
+  },
+  "devDependencies": {
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^20.11.0",
+    "@types/yargs": "^17.0.33"
+  },
+  "peerDependencies": {
+    "@super-protocol/sdk-js": "*"
+  }
+}