@super-protocol/pki-sync-client 5.0.2 → 5.0.4

package/README.md

@@ -92,6 +92,7 @@ pki-sync-client sync [options]
 | `--retry-attempts` | | number | `3` | Number of retry attempts per server for retryable network/DNS errors |
 | `--retry-timeout` | | number | `10` | Timeout between retries in seconds for retryable network/DNS errors |
 | `--disable-server-identity-check` | | boolean | `false` | Disable server identity verification (not recommended) |
+| `--network-type-file` | | string | | Path to file containing local network type (`trusted` or `untrusted`). Defaults to `untrusted` when omitted |
 | `--save-certs-to-dir` | | string | | Directory to save client certificates (`key.pem`, `ca.pem`, `cert.pem`) |
 | `--save-certs-prefix` | | string | | Prefix for certificate filenames (e.g., `client` → `client_key.pem`) |
 
@@ -119,6 +120,11 @@ pki-sync-client sync -c secrets.yaml --swarm-env /custom/path/swarm-env.yaml
 pki-sync-client sync -c secrets.yaml --retry-attempts 5 --retry-timeout 3
 ```
 
+**Sync with explicit local network type file:**
+```bash
+pki-sync-client sync -c secrets.yaml --network-type-file /sp/swarm/network-type
+```
+
 **Sync and save client certificates:**
 ```bash
 pki-sync-client sync -c secrets.yaml --save-certs-to-dir /etc/app/certs
@@ -213,6 +219,7 @@ interface SyncClientOptions {
   retryDelaySec?: number;          // Delay between retries in seconds (default: 10)
   logLevel?: LogLevel;             // Log level: fatal | error | warn | info | debug | trace; if omitted logs are disabled
   disableServerIdentityCheck?: boolean;  // Disable server verification (default: false)
+  networkTypeFile?: string;        // File containing local network type: trusted | untrusted; defaults to untrusted
   saveCertsToDir?: string;         // Directory to save certificates
   saveCertsPrefix?: string;        // Prefix for certificate filenames
 }
@@ -304,10 +311,11 @@ try {
 ## Security Considerations
 
 1. **Server Identity Verification**: Always enabled by default. Only disable with `--disable-server-identity-check` in trusted development environments.
-2. **Certificate Validation**: CA bundle is used to verify server certificates during TLS handshake.
-3. **Mutual TLS**: Both client and server authenticate each other using certificates.
-4. **TEE Attestation**: In TDX/SEV environments, hardware-backed attestation proves client identity.
-5. **Secure Storage**: Secrets are saved with restrictive file permissions to prevent unauthorized access.
+2. **Root Certificate Trust Verification**: The root certificate network type extension must match the local network type. Trusted roots must include hardware evidence whose mrEnclave is present in the Super Protocol trusted registry.
+3. **Certificate Validation**: CA bundle is used to verify server certificates during TLS handshake.
+4. **Mutual TLS**: Both client and server authenticate each other using certificates.
+5. **TEE Attestation**: In TDX/SEV environments, hardware-backed attestation proves client identity.
+6. **Secure Storage**: Secrets are saved with restrictive file permissions to prevent unauthorized access.
 
 ## Development
 

package/dist/cli.js

@@ -25,6 +25,7 @@ async function sync(argv) {
             disableServerIdentityCheck: argv.disableServerIdentityCheck,
             saveCertsToDir: argv.saveCertsToDir,
             saveCertsPrefix: argv.saveCertsPrefix,
+            networkTypeFile: argv.networkTypeFile,
         });
         await client.sync(config);
         console.log('Sync completed successfully');
@@ -75,6 +76,10 @@ async function main() {
             describe: 'Disable server identity verification',
             type: 'boolean',
             default: false,
+        })
+            .option('network-type-file', {
+            describe: 'Path to file containing local network type (trusted or untrusted)',
+            type: 'string',
         })
             .option('save-certs-to-dir', {
             describe: 'Directory to save client certificates (key.pem, ca.pem, cert.pem)',
@@ -96,4 +101,4 @@ main().catch((error) => {
     console.error('Error:', error.message);
     process.exit(1);
 });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xpLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2NsaS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFDQSxrREFBMEI7QUFDMUIsMkNBQXdDO0FBQ3hDLHFDQUFzRDtBQUN0RCwrQ0FBMkM7QUFDM0MsMkRBQXNEO0FBRXRELE1BQU0sc0JBQXNCLEdBQUcsMEJBQTBCLENBQUM7QUFFMUQsS0FBSyxVQUFVLElBQUksQ0FBQyxJQUFTO0lBQ3pCLElBQUksQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLElBQUEsb0JBQVcsRUFBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDeEMsTUFBTSxRQUFRLEdBQUcsSUFBQSxzQkFBYSxFQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUU5QyxNQUFNLE1BQU0sR0FBRyxJQUFJLHdCQUFVLENBQUM7WUFDMUIsT0FBTyxFQUFFLFFBQVEsQ0FBQyxhQUFhLENBQUMsT0FBTztZQUN2QyxTQUFTLEVBQUUsUUFBUSxDQUFDLGFBQWEsQ0FBQyxTQUFTO1lBQzNDLFFBQVEsRUFBRSxRQUFRLENBQUMsYUFBYSxDQUFDLFFBQVE7WUFDekMsWUFBWSxFQUFFLElBQUksQ0FBQyxZQUFZO1lBQy9CLGFBQWEsRUFBRSxJQUFJLENBQUMsYUFBYTtZQUNqQyxhQUFhLEVBQUUsSUFBSSxDQUFDLFlBQVk7WUFDaEMsUUFBUSxFQUFFLElBQUksQ0FBQyxRQUFRO1lBQ3ZCLDBCQUEwQixFQUFFLElBQUksQ0FBQywwQkFBMEI7WUFDM0QsY0FBYyxFQUFFLElBQUksQ0FBQyxjQUFjO1lBQ25DLGVBQWUsRUFBRSxJQUFJLENBQUMsZUFBZTtTQUN4QyxDQUFDLENBQUM7UUFFSCxNQUFNLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFFMUIsT0FBTyxDQUFDLEdBQUcsQ0FBQyw2QkFBNkIsQ0FBQyxDQUFDO0lBQy9DLENBQUM7SUFBQyxPQUFPLEtBQVUsRUFBRSxDQUFDO1FBQ2xCLE9BQU8sQ0FBQyxLQUFLLENBQUMsY0FBYyxFQUFFLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUM3QyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3BCLENBQUM7QUFDTCxDQUFDO0FBRUQsS0FBSyxVQUFVLElBQUk7SUFDZixNQUFNLElBQUEsZUFBSyxFQUFDLElBQUEsaUJBQU8sRUFBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7U0FDN0IsS0FBSyxDQUFDLDBCQUEwQixDQUFDO1NBQ2pDLE9BQU8sQ0FDSixNQUFNLEVBQ04sOEJBQThCLEVBQzlCLENBQUMsS0FBSyxFQUFFLEVBQUU7UUFDTixPQUFPLEtBQUs7YUFDUCxNQUFNLENBQUMsV0FBVyxFQUFFO1lBQ2pCLFFBQVEsRUFBRSx5Q0FBeUM7WUFDbkQsSUFBSSxFQUFFLFFBQVE7WUFDZCxPQUFPLEVBQUUsc0JBQXNCO1NBQ2xDLENBQUM7YUFDRCxNQUFNLENBQUMsUUFBUSxFQUFFO1lBQ2QsS0FBSyxFQUFFLEdBQUc7WUFDVixRQUFRLEVBQUUsb0NBQW9DO1lBQzlDLElBQUksRUFBRSxRQUFRO1lBQ2QsWUFBWSxFQUFFLElBQUk7U0FDckIsQ0FBQzthQUNELE1BQU0sQ0FBQyxlQUFlLEVBQUU7WUFDckIsUUFBUSxFQUNKLHFGQUFxRjtZQUN6RixJQUFJLEVBQUUsUUFBUTtZQUNkLE9BQU8sRUFBRSxNQUFNO1NBQ2xCLENBQUM7YUFDRCxNQUFNLENBQUMsV0FBVyxFQUFFO1lBQ2pCLEtBQUssRUFBRSxHQUFHO1lBQ1YsUUFBUSxFQUFFLFdBQVc7WUFDckIsT0FBTyxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMscUJBQVEsQ0FBQztZQUNoQyxJQUFJLEVBQUUsUUFBUTtTQUNqQixDQUFDO2FBQ0QsTUFBTSxDQUFDLGdCQUFnQixFQUFFO1lBQ3RCLFFBQVEsRUFDSixzRUFBc0U7WUFDMUUsSUFBSSxFQUFFLFFBQVE7WUFDZCxPQUFPLEVBQUUsd0JBQVUsQ0FBQyxzQkFBc0I7U0FDN0MsQ0FBQzthQUNELE1BQU0sQ0FBQyxlQUFlLEVBQUU7WUFDckIsUUFBUSxFQUNKLHFFQUFxRTtZQUN6RSxJQUFJLEVBQUUsUUFBUTtZQUNkLE9BQU8sRUFBRSx3QkFBVSxDQUFDLHVCQUF1QjtTQUM5QyxDQUFDO2FBQ0QsTUFBTSxDQUFDLCtCQUErQixFQUFFO1lBQ3JDLFFBQVEsRUFBRSxzQ0FBc0M7WUFDaEQsSUFBSSxFQUFFLFNBQVM7WUFDZixPQUFPLEVBQUUsS0FBSztTQUNqQixDQUFDO2FBQ0QsTUFBTSxDQUFDLG1CQUFtQixFQUFFO1lBQ3pCLFFBQVEsRUFDSixtRUFBbUU7WUFDdkUsSUFBSSxFQUFFLFFBQVE7U0FDakIsQ0FBQzthQUNELE1BQU0sQ0FBQyxtQkFBbUIsRUFBRTtZQUN6QixRQUFRLEVBQ0oscUVBQXFFO1lBQ3pFLElBQUksRUFBRSxRQUFRO1NBQ2pCLENBQUMsQ0FBQztJQUNYLENBQUMsRUFDRCxJQUFJLENBQ1A7U0FDQSxhQUFhLENBQUMsQ0FBQyxFQUFFLDRCQUE0QixDQUFDO1NBQzlDLElBQUksRUFBRTtTQUNOLEtBQUssQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDO1NBQ2xCLE9BQU8sRUFBRTtTQUNULEtBQUssQ0FBQyxTQUFTLEVBQUUsR0FBRyxDQUFDO1NBQ3JCLEtBQUssRUFBRSxDQUFDO0FBQ2pCLENBQUM7QUFFRCxJQUFJLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRTtJQUNuQixPQUFPLENBQUMsS0FBSyxDQUFDLFFBQVEsRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDdkMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUNwQixDQUFDLENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xpLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2NsaS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFDQSxrREFBMEI7QUFDMUIsMkNBQXdDO0FBQ3hDLHFDQUFzRDtBQUN0RCwrQ0FBMkM7QUFDM0MsMkRBQXNEO0FBRXRELE1BQU0sc0JBQXNCLEdBQUcsMEJBQTBCLENBQUM7QUFFMUQsS0FBSyxVQUFVLElBQUksQ0FBQyxJQUFTO0lBQ3pCLElBQUksQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLElBQUEsb0JBQVcsRUFBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDeEMsTUFBTSxRQUFRLEdBQUcsSUFBQSxzQkFBYSxFQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUU5QyxNQUFNLE1BQU0sR0FBRyxJQUFJLHdCQUFVLENBQUM7WUFDMUIsT0FBTyxFQUFFLFFBQVEsQ0FBQyxhQUFhLENBQUMsT0FBTztZQUN2QyxTQUFTLEVBQUUsUUFBUSxDQUFDLGFBQWEsQ0FBQyxTQUFTO1lBQzNDLFFBQVEsRUFBRSxRQUFRLENBQUMsYUFBYSxDQUFDLFFBQVE7WUFDekMsWUFBWSxFQUFFLElBQUksQ0FBQyxZQUFZO1lBQy9CLGFBQWEsRUFBRSxJQUFJLENBQUMsYUFBYTtZQUNqQyxhQUFhLEVBQUUsSUFBSSxDQUFDLFlBQVk7WUFDaEMsUUFBUSxFQUFFLElBQUksQ0FBQyxRQUFRO1lBQ3ZCLDBCQUEwQixFQUFFLElBQUksQ0FBQywwQkFBMEI7WUFDM0QsY0FBYyxFQUFFLElBQUksQ0FBQyxjQUFjO1lBQ25DLGVBQWUsRUFBRSxJQUFJLENBQUMsZUFBZTtZQUNyQyxlQUFlLEVBQUUsSUFBSSxDQUFDLGVBQWU7U0FDeEMsQ0FBQyxDQUFDO1FBRUgsTUFBTSxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBRTFCLE9BQU8sQ0FBQyxHQUFHLENBQUMsNkJBQTZCLENBQUMsQ0FBQztJQUMvQyxDQUFDO0lBQUMsT0FBTyxLQUFVLEVBQUUsQ0FBQztRQUNsQixPQUFPLENBQUMsS0FBSyxDQUFDLGNBQWMsRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDN0MsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNwQixDQUFDO0FBQ0wsQ0FBQztBQUVELEtBQUssVUFBVSxJQUFJO0lBQ2YsTUFBTSxJQUFBLGVBQUssRUFBQyxJQUFBLGlCQUFPLEVBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO1NBQzdCLEtBQUssQ0FBQywwQkFBMEIsQ0FBQztTQUNqQyxPQUFPLENBQ0osTUFBTSxFQUNOLDhCQUE4QixFQUM5QixDQUFDLEtBQUssRUFBRSxFQUFFO1FBQ04sT0FBTyxLQUFLO2FBQ1AsTUFBTSxDQUFDLFdBQVcsRUFBRTtZQUNqQixRQUFRLEVBQUUseUNBQXlDO1lBQ25ELElBQUksRUFBRSxRQUFRO1lBQ2QsT0FBTyxFQUFFLHNCQUFzQjtTQUNsQyxDQUFDO2FBQ0QsTUFBTSxDQUFDLFFBQVEsRUFBRTtZQUNkLEtBQUssRUFBRSxHQUFHO1lBQ1YsUUFBUSxFQUFFLG9DQUFvQztZQUM5QyxJQUFJLEVBQUUsUUFBUTtZQUNkLFlBQVksRUFBRSxJQUFJO1NBQ3JCLENBQUM7YUFDRCxNQUFNLENBQUMsZUFBZSxFQUFFO1lBQ3JCLFFBQVEsRUFDSixxRkFBcUY7WUFDekYsSUFBSSxFQUFFLFFBQVE7WUFDZCxPQUFPLEVBQUUsTUFBTTtTQUNsQixDQUFDO2FBQ0QsTUFBTSxDQUFDLFdBQVcsRUFBRTtZQUNqQixLQUFLLEVBQUUsR0FBRztZQUNWLFFBQVEsRUFBRSxXQUFXO1lBQ3JCLE9BQU8sRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLHFCQUFRLENBQUM7WUFDaEMsSUFBSSxFQUFFLFFBQVE7U0FDakIsQ0FBQzthQUNELE1BQU0sQ0FBQyxnQkFBZ0IsRUFBRTtZQUN0QixRQUFRLEVBQ0osc0VBQXNFO1lBQzFFLElBQUksRUFBRSxRQUFRO1lBQ2QsT0FBTyxFQUFFLHdCQUFVLENBQUMsc0JBQXNCO1NBQzdDLENBQUM7YUFDRCxNQUFNLENBQUMsZUFBZSxFQUFFO1lBQ3JCLFFBQVEsRUFDSixxRUFBcUU7WUFDekUsSUFBSSxFQUFFLFFBQVE7WUFDZCxPQUFPLEVBQUUsd0JBQVUsQ0FBQyx1QkFBdUI7U0FDOUMsQ0FBQzthQUNELE1BQU0sQ0FBQywrQkFBK0IsRUFBRTtZQUNyQyxRQUFRLEVBQUUsc0NBQXNDO1lBQ2hELElBQUksRUFBRSxTQUFTO1lBQ2YsT0FBTyxFQUFFLEtBQUs7U0FDakIsQ0FBQzthQUNELE1BQU0sQ0FBQyxtQkFBbUIsRUFBRTtZQUN6QixRQUFRLEVBQ0osbUVBQW1FO1lBQ3ZFLElBQUksRUFBRSxRQUFRO1NBQ2pCLENBQUM7YUFDRCxNQUFNLENBQUMsbUJBQW1CLEVBQUU7WUFDekIsUUFBUSxFQUNKLG1FQUFtRTtZQUN2RSxJQUFJLEVBQUUsUUFBUTtTQUNqQixDQUFDO2FBQ0QsTUFBTSxDQUFDLG1CQUFtQixFQUFFO1lBQ3pCLFFBQVEsRUFDSixxRUFBcUU7WUFDekUsSUFBSSxFQUFFLFFBQVE7U0FDakIsQ0FBQyxDQUFDO0lBQ1gsQ0FBQyxFQUNELElBQUksQ0FDUDtTQUNBLGFBQWEsQ0FBQyxDQUFDLEVBQUUsNEJBQTRCLENBQUM7U0FDOUMsSUFBSSxFQUFFO1NBQ04sS0FBSyxDQUFDLE1BQU0sRUFBRSxHQUFHLENBQUM7U0FDbEIsT0FBTyxFQUFFO1NBQ1QsS0FBSyxDQUFDLFNBQVMsRUFBRSxHQUFHLENBQUM7U0FDckIsS0FBSyxFQUFFLENBQUM7QUFDakIsQ0FBQztBQUVELElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFO0lBQ25CLE9BQU8sQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUN2QyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQ3BCLENBQUMsQ0FBQyxDQUFDIn0=

package/dist/root-certificate-verifier.d.ts

@@ -0,0 +1,23 @@
+/// <reference types="node" />
+import { Log, NetworkType } from '@super-protocol/pki-common';
+import { TeeEvidenceType, type SNPReport } from '@super-protocol/attestation-common';
+interface AttestationWasmNode {
+    verifyTeeEvidence(serialized: Uint8Array | ArrayBuffer): Promise<{
+        evidenceType: TeeEvidenceType;
+    }>;
+    calculateMrEnclave(serialized: Uint8Array | ArrayBuffer): Promise<{
+        mrEnclave: Uint8Array;
+    }>;
+    calculateSnpSingleCoreMrEnclave(report: SNPReport): Promise<Uint8Array>;
+}
+export interface RootCertificateVerifierOptions {
+    caBundle: string;
+    networkTypeFile?: string;
+    log?: Log;
+    getExtensionValue?: (certPem: string, oid: string) => Buffer | undefined;
+    loadAttestationModule?: () => Promise<AttestationWasmNode>;
+    verifySignature?: (mrEnclave: Uint8Array, evidenceType: TeeEvidenceType) => Promise<void>;
+}
+export declare function resolveLocalNetworkType(networkTypeFile?: string): Promise<NetworkType>;
+export declare function verifyRootCertificateTrust(options: RootCertificateVerifierOptions): Promise<void>;
+export {};

package/dist/root-certificate-verifier.js

@@ -0,0 +1,111 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyRootCertificateTrust = exports.resolveLocalNetworkType = void 0;
+const pki_common_1 = require("@super-protocol/pki-common");
+const attestation_common_1 = require("@super-protocol/attestation-common");
+const sdk_js_1 = require("@super-protocol/sdk-js");
+const fs = __importStar(require("fs"));
+const preservedDynamicImport = new Function('specifier', 'return import(specifier)');
+const NETWORK_TYPES = ['trusted', 'untrusted'];
+const isNetworkType = (value) => NETWORK_TYPES.includes(value);
+async function resolveLocalNetworkType(networkTypeFile) {
+    if (!networkTypeFile) {
+        return 'untrusted';
+    }
+    const value = (await fs.promises.readFile(networkTypeFile, 'utf8')).trim();
+    if (!isNetworkType(value)) {
+        throw new Error(`Invalid network type file "${networkTypeFile}": expected trusted or untrusted`);
+    }
+    return value;
+}
+exports.resolveLocalNetworkType = resolveLocalNetworkType;
+const getRootCertificate = (caBundle) => {
+    const { ca } = sdk_js_1.CertificatesHelper.extractCAFromChain(caBundle);
+    const rootCerts = sdk_js_1.CertificatesHelper.splitPemCerts(ca);
+    if (rootCerts.length !== 1) {
+        throw new Error(`Root certificate verification failed: expected exactly one root certificate, got ${rootCerts.length}`);
+    }
+    return `${rootCerts[0].trim()}\n`;
+};
+const readNetworkTypeExtension = (rootCertPem, getExtensionValue) => {
+    const networkType = getExtensionValue(rootCertPem, pki_common_1.OID_CUSTOM_EXTENSION_NETWORK_TYPE)
+        ?.toString('ascii')
+        .trim();
+    if (!networkType || !isNetworkType(networkType)) {
+        throw new Error(`Root certificate verification failed: missing or invalid ${pki_common_1.OID_CUSTOM_EXTENSION_NETWORK_TYPE} extension`);
+    }
+    return networkType;
+};
+const defaultLoadAttestationModule = () => preservedDynamicImport('@super-protocol/attestation-wasm/node');
+const calculateMrEnclave = async (serializedEvidence, evidenceType, attestation) => {
+    switch (evidenceType) {
+        case attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_QEMU:
+        case attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_GCP:
+            return (await attestation.calculateMrEnclave(serializedEvidence))
+                .mrEnclave;
+        case attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_AMD_SEV_SNP_QEMU: {
+            const evidence = attestation_common_1.TeeEvidence.decode(serializedEvidence);
+            const report = evidence.amdSevSnpQemu?.snpReport;
+            if (!report) {
+                throw new Error('Root certificate verification failed: SEV-SNP evidence is missing snpReport');
+            }
+            return attestation.calculateSnpSingleCoreMrEnclave(report);
+        }
+        default:
+            throw new Error(`Root certificate verification failed: unsupported TEE evidence type ${evidenceType}`);
+    }
+};
+async function verifyRootCertificateTrust(options) {
+    const getExtensionValue = options.getExtensionValue ??
+        ((certPem, oid) => sdk_js_1.CertificatesHelper.getExtensionValue(certPem, oid));
+    const verifySignature = options.verifySignature ?? attestation_common_1.verifyMrEnclaveSignature;
+    const localNetworkType = await resolveLocalNetworkType(options.networkTypeFile);
+    const rootCertPem = getRootCertificate(options.caBundle);
+    const rootNetworkType = readNetworkTypeExtension(rootCertPem, getExtensionValue);
+    if (rootNetworkType !== localNetworkType) {
+        throw new Error(`Root certificate verification failed: certificate network type "${rootNetworkType}" does not match local network type "${localNetworkType}"`);
+    }
+    if (rootNetworkType === 'untrusted') {
+        options.log?.info('Root certificate network type verified', {
+            networkType: rootNetworkType,
+        });
+        return;
+    }
+    const serializedEvidence = getExtensionValue(rootCertPem, pki_common_1.OID_TEE_EVIDENCE);
+    if (!serializedEvidence) {
+        throw new Error(`Root certificate verification failed: trusted root certificate is missing ${pki_common_1.OID_TEE_EVIDENCE} evidence extension`);
+    }
+    const attestation = await (options.loadAttestationModule ?? defaultLoadAttestationModule)();
+    const verificationResult = await attestation.verifyTeeEvidence(serializedEvidence);
+    const mrEnclave = await calculateMrEnclave(serializedEvidence, verificationResult.evidenceType, attestation);
+    await verifySignature(mrEnclave, verificationResult.evidenceType);
+    options.log?.info('Trusted root certificate evidence verified', {
+        evidenceType: verificationResult.evidenceType,
+        mrEnclaveHex: Buffer.from(mrEnclave).toString('hex'),
+    });
+}
+exports.verifyRootCertificateTrust = verifyRootCertificateTrust;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9vdC1jZXJ0aWZpY2F0ZS12ZXJpZmllci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9yb290LWNlcnRpZmljYXRlLXZlcmlmaWVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsMkRBS29DO0FBQ3BDLDJFQUs0QztBQUM1QyxtREFBNEQ7QUFDNUQsdUNBQXlCO0FBY3pCLE1BQU0sc0JBQXNCLEdBQUcsSUFBSSxRQUFRLENBQ3ZDLFdBQVcsRUFDWCwwQkFBMEIsQ0FDWixDQUFDO0FBY25CLE1BQU0sYUFBYSxHQUFrQixDQUFDLFNBQVMsRUFBRSxXQUFXLENBQUMsQ0FBQztBQUU5RCxNQUFNLGFBQWEsR0FBRyxDQUFDLEtBQWEsRUFBd0IsRUFBRSxDQUN6RCxhQUEwQixDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUV6QyxLQUFLLFVBQVUsdUJBQXVCLENBQ3pDLGVBQXdCO0lBRXhCLElBQUksQ0FBQyxlQUFlLEVBQUUsQ0FBQztRQUNuQixPQUFPLFdBQVcsQ0FBQztJQUN2QixDQUFDO0lBRUQsTUFBTSxLQUFLLEdBQUcsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLGVBQWUsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQzNFLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUN4QixNQUFNLElBQUksS0FBSyxDQUNYLDhCQUE4QixlQUFlLGtDQUFrQyxDQUNsRixDQUFDO0lBQ04sQ0FBQztJQUVELE9BQU8sS0FBSyxDQUFDO0FBQ2pCLENBQUM7QUFmRCwwREFlQztBQUVELE1BQU0sa0JBQWtCLEdBQUcsQ0FBQyxRQUFnQixFQUFVLEVBQUU7SUFDcEQsTUFBTSxFQUFFLEVBQUUsRUFBRSxHQUFHLDJCQUFrQixDQUFDLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQy9ELE1BQU0sU0FBUyxHQUFHLDJCQUFrQixDQUFDLGFBQWEsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUV2RCxJQUFJLFNBQVMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDekIsTUFBTSxJQUFJLEtBQUssQ0FDWCxvRkFBb0YsU0FBUyxDQUFDLE1BQU0sRUFBRSxDQUN6RyxDQUFDO0lBQ04sQ0FBQztJQUVELE9BQU8sR0FBRyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQztBQUN0QyxDQUFDLENBQUM7QUFFRixNQUFNLHdCQUF3QixHQUFHLENBQzdCLFdBQW1CLEVBQ25CLGlCQUF1RSxFQUM1RCxFQUFFO0lBQ2IsTUFBTSxXQUFXLEdBQUcsaUJBQWlCLENBQ2pDLFdBQVcsRUFDWCw4Q0FBaUMsQ0FDcEM7UUFDRyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUM7U0FDbEIsSUFBSSxFQUFFLENBQUM7SUFFWixJQUFJLENBQUMsV0FBVyxJQUFJLENBQUMsYUFBYSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7UUFDOUMsTUFBTSxJQUFJLEtBQUssQ0FDWCw0REFBNEQsOENBQWlDLFlBQVksQ0FDNUcsQ0FBQztJQUNOLENBQUM7SUFFRCxPQUFPLFdBQVcsQ0FBQztBQUN2QixDQUFDLENBQUM7QUFFRixNQUFNLDRCQUE0QixHQUFHLEdBQWlDLEVBQUUsQ0FDcEUsc0JBQXNCLENBQ2xCLHVDQUF1QyxDQUMxQyxDQUFDO0FBRU4sTUFBTSxrQkFBa0IsR0FBRyxLQUFLLEVBQzVCLGtCQUEwQixFQUMxQixZQUE2QixFQUM3QixXQUFnQyxFQUNiLEVBQUU7SUFDckIsUUFBUSxZQUFZLEVBQUUsQ0FBQztRQUNuQixLQUFLLG9DQUFlLENBQUMsZ0NBQWdDLENBQUM7UUFDdEQsS0FBSyxvQ0FBZSxDQUFDLCtCQUErQjtZQUNoRCxPQUFPLENBQUMsTUFBTSxXQUFXLENBQUMsa0JBQWtCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztpQkFDNUQsU0FBUyxDQUFDO1FBQ25CLEtBQUssb0NBQWUsQ0FBQyxrQ0FBa0MsQ0FBQyxDQUFDLENBQUM7WUFDdEQsTUFBTSxRQUFRLEdBQUcsZ0NBQVcsQ0FBQyxNQUFNLENBQUMsa0JBQWtCLENBQUMsQ0FBQztZQUN4RCxNQUFNLE1BQU0sR0FDUixRQUFRLENBQUMsYUFBYSxFQUFFLFNBQVMsQ0FBQztZQUN0QyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQ1YsTUFBTSxJQUFJLEtBQUssQ0FDWCw2RUFBNkUsQ0FDaEYsQ0FBQztZQUNOLENBQUM7WUFFRCxPQUFPLFdBQVcsQ0FBQywrQkFBK0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMvRCxDQUFDO1FBQ0Q7WUFDSSxNQUFNLElBQUksS0FBSyxDQUNYLHVFQUF1RSxZQUFZLEVBQUUsQ0FDeEYsQ0FBQztJQUNWLENBQUM7QUFDTCxDQUFDLENBQUM7QUFFSyxLQUFLLFVBQVUsMEJBQTBCLENBQzVDLE9BQXVDO0lBRXZDLE1BQU0saUJBQWlCLEdBQ25CLE9BQU8sQ0FBQyxpQkFBaUI7UUFDekIsQ0FBQyxDQUFDLE9BQWUsRUFBRSxHQUFXLEVBQUUsRUFBRSxDQUM5QiwyQkFBa0IsQ0FBQyxpQkFBaUIsQ0FBQyxPQUFPLEVBQUUsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUM1RCxNQUFNLGVBQWUsR0FBRyxPQUFPLENBQUMsZUFBZSxJQUFJLDZDQUF3QixDQUFDO0lBQzVFLE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSx1QkFBdUIsQ0FDbEQsT0FBTyxDQUFDLGVBQWUsQ0FDMUIsQ0FBQztJQUNGLE1BQU0sV0FBVyxHQUFHLGtCQUFrQixDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN6RCxNQUFNLGVBQWUsR0FBRyx3QkFBd0IsQ0FDNUMsV0FBVyxFQUNYLGlCQUFpQixDQUNwQixDQUFDO0lBRUYsSUFBSSxlQUFlLEtBQUssZ0JBQWdCLEVBQUUsQ0FBQztRQUN2QyxNQUFNLElBQUksS0FBSyxDQUNYLG1FQUFtRSxlQUFlLHdDQUF3QyxnQkFBZ0IsR0FBRyxDQUNoSixDQUFDO0lBQ04sQ0FBQztJQUVELElBQUksZUFBZSxLQUFLLFdBQVcsRUFBRSxDQUFDO1FBQ2xDLE9BQU8sQ0FBQyxHQUFHLEVBQUUsSUFBSSxDQUFDLHdDQUF3QyxFQUFFO1lBQ3hELFdBQVcsRUFBRSxlQUFlO1NBQy9CLENBQUMsQ0FBQztRQUNILE9BQU87SUFDWCxDQUFDO0lBRUQsTUFBTSxrQkFBa0IsR0FBRyxpQkFBaUIsQ0FBQyxXQUFXLEVBQUUsNkJBQWdCLENBQUMsQ0FBQztJQUM1RSxJQUFJLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztRQUN0QixNQUFNLElBQUksS0FBSyxDQUNYLDZFQUE2RSw2QkFBZ0IscUJBQXFCLENBQ3JILENBQUM7SUFDTixDQUFDO0lBRUQsTUFBTSxXQUFXLEdBQUcsTUFBTSxDQUN0QixPQUFPLENBQUMscUJBQXFCLElBQUksNEJBQTRCLENBQ2hFLEVBQUUsQ0FBQztJQUNKLE1BQU0sa0JBQWtCLEdBQ3BCLE1BQU0sV0FBVyxDQUFDLGlCQUFpQixDQUFDLGtCQUFrQixDQUFDLENBQUM7SUFDNUQsTUFBTSxTQUFTLEdBQUcsTUFBTSxrQkFBa0IsQ0FDdEMsa0JBQWtCLEVBQ2xCLGtCQUFrQixDQUFDLFlBQVksRUFDL0IsV0FBVyxDQUNkLENBQUM7SUFFRixNQUFNLGVBQWUsQ0FBQyxTQUFTLEVBQUUsa0JBQWtCLENBQUMsWUFBWSxDQUFDLENBQUM7SUFDbEUsT0FBTyxDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUMsNENBQTRDLEVBQUU7UUFDNUQsWUFBWSxFQUFFLGtCQUFrQixDQUFDLFlBQVk7UUFDN0MsWUFBWSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQztLQUN2RCxDQUFDLENBQUM7QUFDUCxDQUFDO0FBckRELGdFQXFEQyJ9

package/dist/sync-client.d.ts

@@ -12,6 +12,7 @@ export interface SyncClientOptions {
     disableServerIdentityCheck?: boolean;
     saveCertsToDir?: string;
     saveCertsPrefix?: string;
+    networkTypeFile?: string;
 }
 export declare class SyncClient {
     static readonly DEFAULT_RETRY_ATTEMPTS = 1;

package/dist/sync-client.js

@@ -30,6 +30,7 @@ exports.SyncClient = void 0;
 const pki_client_1 = require("@super-protocol/pki-client");
 const pki_common_1 = require("@super-protocol/pki-common");
 const pki_attestation_engine_1 = require("@super-protocol/pki-attestation-engine");
+const root_certificate_verifier_1 = require("./root-certificate-verifier");
 const sdk_js_1 = require("@super-protocol/sdk-js");
 const axios_1 = __importDefault(require("axios"));
 const fs = __importStar(require("fs"));
@@ -244,6 +245,17 @@ class SyncClient {
                     disableServerIdentityCheck: this.options.disableServerIdentityCheck ?? false,
                 });
                 pkiClientFactory = new pki_client_1.PkiClientFactory(pkiConfig, serverLog);
+                const clientCert = await pkiClientFactory.getCert();
+                if (this.options.disableServerIdentityCheck) {
+                    serverLog.warn('Root certificate trust verification is disabled because disableServerIdentityCheck is enabled');
+                }
+                else {
+                    await (0, root_certificate_verifier_1.verifyRootCertificateTrust)({
+                        caBundle: clientCert.caBundle,
+                        networkTypeFile: this.options.networkTypeFile,
+                        log: serverLog,
+                    });
+                }
                 httpsAgent = await pkiClientFactory.getHTTPSAgent();
                 serverLog.info('PKI client prepared successfully');
             }
@@ -304,4 +316,4 @@ class SyncClient {
     }
 }
 exports.SyncClient = SyncClient;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3luYy1jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvc3luYy1jbGllbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFDQSwyREFJb0M7QUFDcEMsMkRBT29DO0FBQ3BDLG1GQUdnRDtBQUNoRCxtREFBaUQ7QUFDakQsa0RBQTBCO0FBQzFCLHVDQUF5QjtBQUN6QiwyQ0FBNkI7QUFlN0IsTUFBYSxVQUFVO0lBQ25CLE1BQU0sQ0FBVSxzQkFBc0IsR0FBRyxDQUFDLENBQUMsQ0FBQyw0QkFBNEI7SUFDeEUsTUFBTSxDQUFVLHVCQUF1QixHQUFHLEVBQUUsQ0FBQztJQUNyQyxNQUFNLENBQVUsNkJBQTZCLEdBQUcsSUFBSSxHQUFHLENBQUM7UUFDNUQsV0FBVztRQUNYLFlBQVk7UUFDWixjQUFjO1FBQ2QsV0FBVztRQUNYLFdBQVc7UUFDWCxjQUFjO0tBQ2pCLENBQUMsQ0FBQztJQUNLLE1BQU0sQ0FBVSwyQkFBMkIsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBRWxFLE9BQU8sQ0FBb0I7SUFDM0IsU0FBUyxDQUFtQjtJQUM1QixNQUFNLENBQU07SUFDWixhQUFhLENBQVM7SUFDdEIsYUFBYSxDQUFTO0lBRXRCLE1BQU0sQ0FBQyxrQkFBa0IsQ0FBQyxhQUFvQztRQUlsRSxRQUFRLGFBQWEsRUFBRSxDQUFDO1lBQ3BCLEtBQUssMEJBQWEsQ0FBQyxHQUFHLENBQUM7WUFDdkIsS0FBSywwQkFBYSxDQUFDLFNBQVMsQ0FBQztZQUM3QixLQUFLLDBCQUFhLENBQUMsTUFBTTtnQkFDckIsT0FBTztvQkFDSCxTQUFTLEVBQUUsSUFBSTtvQkFDZixJQUFJLEVBQUUsYUFBYTtpQkFDdEIsQ0FBQztZQUNOO2dCQUNJLE9BQU87b0JBQ0gsU0FBUyxFQUFFLEtBQUs7b0JBQ2hCLElBQUksRUFBRSxnQkFBZ0I7aUJBQ3pCLENBQUM7UUFDVixDQUFDO0lBQ0wsQ0FBQztJQUVPLE1BQU0sQ0FBQyxhQUFhLENBQUMsT0FBMEI7UUFDbkQsSUFBSSxPQUFPLENBQUMsUUFBUSxJQUFJLElBQUksRUFBRSxDQUFDO1lBQzNCLE9BQU8sSUFBSSwwQkFBTyxFQUFFLENBQUM7UUFDekIsQ0FBQztRQUVELE1BQU0sYUFBYSxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMscUJBQVEsQ0FBYSxDQUFDO1FBQzFELElBQUksQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQzVDLE1BQU0sSUFBSSxLQUFLLENBQ1gsMEJBQTBCLE9BQU8sQ0FBQyxRQUFRLGdCQUFnQixhQUFhLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQ3ZGLENBQUM7UUFDTixDQUFDO1FBRUQsT0FBTyxJQUFJLDBCQUFPLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3pDLENBQUM7SUFFRCxZQUFZLE9BQTBCO1FBQ2xDLElBQUksQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFDO1FBQ3ZCLElBQUksQ0FBQyxNQUFNLEdBQUcsVUFBVSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxLQUFLLENBQUM7WUFDbEQsT0FBTyxFQUFFLFlBQVk7U0FDeEIsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLGFBQWEsR0FBRyxVQUFVLENBQUMsc0JBQXNCLENBQ2xELE9BQU8sQ0FBQyxhQUFhLENBQ3hCLENBQUM7UUFDRixJQUFJLENBQUMsYUFBYSxHQUFHLFVBQVUsQ0FBQyxzQkFBc0IsQ0FDbEQsT0FBTyxDQUFDLGFBQWEsQ0FDeEIsQ0FBQztJQUNOLENBQUM7SUFFTyxNQUFNLENBQUMsb0JBQW9CLENBQy9CLGFBQW9DO1FBRXBDLFFBQVEsYUFBYSxFQUFFLENBQUM7WUFDcEIsS0FBSywwQkFBYSxDQUFDLEdBQUcsQ0FBQztZQUN2QixLQUFLLDBCQUFhLENBQUMsU0FBUyxDQUFDO1lBQzdCLEtBQUssMEJBQWEsQ0FBQyxNQUFNO2dCQUNyQixPQUFPLEVBQUUsSUFBSSxFQUFFLGFBQWEsRUFBRSxDQUFDO1lBQ25DLEtBQUssMEJBQWEsQ0FBQyxTQUFTO2dCQUN4QixPQUFPO29CQUNILElBQUksRUFBRSwwQkFBYSxDQUFDLFNBQVM7b0JBQzdCLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLDhCQUE4QixDQUFDLENBQUMsUUFBUSxDQUN2RCxLQUFLLENBQ1I7aUJBQ0osQ0FBQztZQUNOO2dCQUNJLE1BQU0sSUFBSSxLQUFLLENBQ1gsK0JBQStCLGFBQWEsd0RBQXdELENBQ3ZHLENBQUM7UUFDVixDQUFDO0lBQ0wsQ0FBQztJQUVPLEtBQUssQ0FBQyxnQkFBZ0I7UUFDMUIsSUFBSSxJQUFJLENBQUMsU0FBUyxJQUFJLElBQUksRUFBRSxDQUFDO1lBQ3pCLE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUMxQixDQUFDO1FBRUQsTUFBTSxhQUFhLEdBQ2YsSUFBSSxDQUFDLE9BQU8sQ0FBQyxZQUFZLEtBQUssTUFBTTtZQUNoQyxDQUFDLENBQUMsTUFBTSxJQUFBLDhDQUFxQixHQUFFO1lBQy9CLENBQUMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQztRQUVwQyxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsWUFBWSxLQUFLLE1BQU0sRUFBRSxDQUFDO1lBQ3ZDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLDJDQUEyQyxFQUFFO2dCQUMxRCxhQUFhO2FBQ2hCLENBQUMsQ0FBQztRQUNQLENBQUM7UUFFRCxJQUFJLENBQUMsU0FBUyxHQUFHLFVBQVUsQ0FBQyxvQkFBb0IsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUNoRSxNQUFNLGVBQWUsR0FBRyxVQUFVLENBQUMsa0JBQWtCLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDckUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsdUNBQXVDLEVBQUU7WUFDdEQsYUFBYSxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSTtZQUNsQyxTQUFTLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxTQUFTO1lBQ2pDLDBCQUEwQixFQUN0QixJQUFJLENBQUMsT0FBTyxDQUFDLDBCQUEwQixJQUFJLEtBQUs7WUFDcEQsb0JBQW9CLEVBQUUsZUFBZSxDQUFDLFNBQVM7WUFDL0MsZUFBZSxFQUFFLGVBQWUsQ0FBQyxJQUFJO1NBQ3hDLENBQUMsQ0FBQztRQUNILE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQztJQUMxQixDQUFDO0lBRU8sTUFBTSxDQUFDLHNCQUFzQixDQUFDLEtBQXlCO1FBQzNELElBQUksS0FBSyxJQUFJLElBQUksRUFBRSxDQUFDO1lBQ2hCLE9BQU8sVUFBVSxDQUFDLHNCQUFzQixDQUFDO1FBQzdDLENBQUM7UUFFRCxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDeEMsTUFBTSxJQUFJLEtBQUssQ0FDWCxzRUFBc0UsQ0FDekUsQ0FBQztRQUNOLENBQUM7UUFFRCxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBRU8sTUFBTSxDQUFDLHNCQUFzQixDQUFDLEtBQXlCO1FBQzNELElBQUksS0FBSyxJQUFJLElBQUksRUFBRSxDQUFDO1lBQ2hCLE9BQU8sVUFBVSxDQUFDLHVCQUF1QixDQUFDO1FBQzlDLENBQUM7UUFFRCxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDeEMsTUFBTSxJQUFJLEtBQUssQ0FDWCxzRUFBc0UsQ0FDekUsQ0FBQztRQUNOLENBQUM7UUFFRCxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBRU8sTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFjO1FBSXZDLElBQUksQ0FBQyxlQUFLLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDN0IsT0FBTztnQkFDSCxXQUFXLEVBQUUsS0FBSztnQkFDbEIsTUFBTSxFQUFFLGlCQUFpQjthQUM1QixDQUFDO1FBQ04sQ0FBQztRQUVELE1BQU0sVUFBVSxHQUFHLEtBQUssQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDO1FBQzFDLElBQUksVUFBVSxJQUFJLElBQUksRUFBRSxDQUFDO1lBQ3JCLE1BQU0sTUFBTSxHQUFHLGVBQWUsVUFBVSxFQUFFLENBQUM7WUFDM0MsT0FBTztnQkFDSCxXQUFXLEVBQ1AsVUFBVSxDQUFDLDJCQUEyQixDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUM7Z0JBQzFELE1BQU07YUFDVCxDQUFDO1FBQ04sQ0FBQztRQUVELE1BQU0sU0FBUyxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUM7UUFDN0IsSUFBSSxTQUFTLElBQUksSUFBSSxFQUFFLENBQUM7WUFDcEIsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLFNBQVMsRUFBRSxDQUFDO1lBQzNDLE9BQU87Z0JBQ0gsV0FBVyxFQUNQLFVBQVUsQ0FBQyw2QkFBNkIsQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDO2dCQUMzRCxNQUFNO2FBQ1QsQ0FBQztRQUNOLENBQUM7UUFFRCxPQUFPO1lBQ0gsV0FBVyxFQUFFLEtBQUs7WUFDbEIsTUFBTSxFQUFFLHFCQUFxQjtTQUNoQyxDQUFDO0lBQ04sQ0FBQztJQUVPLEtBQUssQ0FBQyxZQUFZLENBQ3RCLE1BQWMsRUFDZCxNQUFrQixFQUNsQixVQUFrRTtRQUVsRSxNQUFNLFdBQVcsR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBRTVELE1BQU0sUUFBUSxHQUFHLE1BQU0sZUFBSyxDQUFDLElBQUksQ0FDN0IsV0FBVyxNQUFNLHFCQUFxQixFQUN0QyxFQUFFLE9BQU8sRUFBRSxXQUFXLEVBQUUsRUFDeEIsRUFBRSxVQUFVLEVBQUUsQ0FDakIsQ0FBQztRQUVGLE9BQU8sUUFBUSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUM7SUFDakMsQ0FBQztJQUVPLEtBQUssQ0FBQyxXQUFXLENBQ3JCLE1BQWtCLEVBQ2xCLE9BQStCO1FBRS9CLEtBQUssTUFBTSxNQUFNLElBQUksTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2xDLE1BQU0sYUFBYSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDakQsSUFBSSxhQUFhLElBQUksSUFBSSxFQUFFLENBQUM7Z0JBQ3hCLE1BQU0sSUFBSSxLQUFLLENBQ1gsV0FBVyxNQUFNLENBQUMsVUFBVSx5QkFBeUIsQ0FDeEQsQ0FBQztZQUNOLENBQUM7WUFFRCxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUN4QyxNQUFNLEVBQUUsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1lBRWxELE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxhQUFhLEVBQUU7Z0JBQ3RELFFBQVEsRUFBRSxRQUFRO2dCQUNsQixJQUFJLEVBQUUsS0FBSzthQUNkLENBQUMsQ0FBQztZQUVILElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUNaLGlCQUFpQixNQUFNLENBQUMsVUFBVSxRQUFRLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FDNUQsQ0FBQztRQUNOLENBQUM7SUFDTCxDQUFDO0lBRU8sS0FBSyxDQUFDLGFBQWEsQ0FDdkIsTUFBa0IsRUFDbEIsT0FBK0IsRUFDL0IsZ0JBQWtDO1FBRWxDLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFFeEMsSUFBSSxJQUFJLENBQUMsT0FBTyxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQzlCLE1BQU0sSUFBSSxDQUFDLGdCQUFnQixDQUN2QixnQkFBZ0IsRUFDaEIsSUFBSSxDQUFDLE9BQU8sQ0FBQyxjQUFjLEVBQzNCLElBQUksQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUMvQixDQUFDO1FBQ04sQ0FBQztJQUNMLENBQUM7SUFFTyxLQUFLLENBQUMsZ0JBQWdCLENBQzFCLGdCQUFrQyxFQUNsQyxRQUFnQixFQUNoQixNQUFlO1FBRWYsMEJBQTBCO1FBQzFCLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFFdkQsTUFBTSxJQUFJLEdBQUcsTUFBTSxnQkFBZ0IsQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUM5QyxNQUFNLEVBQ0YsSUFBSSxFQUFFLFVBQVUsRUFDaEIsd0JBQXdCLEVBQ3hCLEVBQUUsR0FDTCxHQUFHLElBQUEsNENBQStCLEVBQUMsSUFBSSxDQUFDLENBQUM7UUFFMUMsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLENBQUMsQ0FBQyxHQUFHLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFFN0MsbUJBQW1CO1FBQ25CLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLEdBQUcsU0FBUyxTQUFTLENBQUMsQ0FBQztRQUMzRCxNQUFNLEVBQUUsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLGFBQWEsRUFBRTtZQUM3RCxJQUFJLEVBQUUsS0FBSztTQUNkLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBRXBELHNCQUFzQjtRQUN0QixNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxHQUFHLFNBQVMsUUFBUSxDQUFDLENBQUM7UUFDekQsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDekQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkJBQTJCLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFFdEQsa0RBQWtEO1FBQ2xELE1BQU0sb0JBQW9CLEdBQUcsVUFBVSxHQUFHLHdCQUF3QixDQUFDO1FBQ25FLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLEdBQUcsU0FBUyxVQUFVLENBQUMsQ0FBQztRQUM3RCxNQUFNLEVBQUUsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLFFBQVEsRUFBRSxvQkFBb0IsRUFBRTtZQUN4RCxJQUFJLEVBQUUsS0FBSztTQUNkLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLDhCQUE4QixRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQy9ELENBQUM7SUFFRCxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQWtCO1FBQ3pCLE1BQU0sU0FBUyxHQUFHLE1BQU0sSUFBSSxDQUFDLGdCQUFnQixFQUFFLENBQUM7UUFFaEQsS0FBSyxNQUFNLE1BQU0sSUFBSSxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3hDLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO2dCQUNoQyxNQUFNO2dCQUNOLGFBQWEsRUFBRSxTQUFTLENBQUMsSUFBSTthQUNoQyxDQUFDLENBQUM7WUFDSCxJQUFJLGdCQUFrQyxDQUFDO1lBQ3ZDLElBQUksVUFFSCxDQUFDO1lBRUYsSUFBSSxDQUFDO2dCQUNELFNBQVMsQ0FBQyxJQUFJLENBQUMsb0JBQW9CLENBQUMsQ0FBQztnQkFFckMsTUFBTSxTQUFTLEdBQW9CO29CQUMvQixrQkFBa0IsRUFBRTt3QkFDaEIsSUFBSSxFQUFFLFFBQVE7d0JBQ2QsU0FBUzt3QkFDVCxPQUFPLEVBQUUsV0FBVyxNQUFNLGFBQWE7d0JBQ3ZDLFFBQVEsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVE7d0JBQy9CLDBCQUEwQixFQUN0QixJQUFJLENBQUMsT0FBTyxDQUFDLDBCQUEwQixJQUFJLEtBQUs7cUJBQ3ZEO29CQUNELFNBQVMsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLFNBQVM7aUJBQ3BDLENBQUM7Z0JBRUYsU0FBUyxDQUFDLEtBQUssQ0FBQyxzQ0FBc0MsRUFBRTtvQkFDcEQsMEJBQTBCLEVBQ3RCLElBQUksQ0FBQyxPQUFPLENBQUMsMEJBQTBCLElBQUksS0FBSztpQkFDdkQsQ0FBQyxDQUFDO2dCQUNILGdCQUFnQixHQUFHLElBQUksNkJBQWdCLENBQUMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxDQUFDO2dCQUM5RCxVQUFVLEdBQUcsTUFBTSxnQkFBZ0IsQ0FBQyxhQUFhLEVBQUUsQ0FBQztnQkFDcEQsU0FBUyxDQUFDLElBQUksQ0FBQyxrQ0FBa0MsQ0FBQyxDQUFDO1lBQ3ZELENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNiLE1BQU0sWUFBWSxHQUNkLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDM0QsU0FBUyxDQUFDLEtBQUssQ0FDWCw2Q0FBNkMsWUFBWSwyQkFBMkIsQ0FDdkYsQ0FBQztnQkFDRixTQUFTO1lBQ2IsQ0FBQztZQUVELElBQUksY0FBa0QsQ0FBQztZQUN2RCxJQUFJLE9BQU8sR0FBRyxDQUFDLENBQUM7WUFFaEIsSUFBSSxDQUFDO2dCQUNELGNBQWMsR0FBRyxNQUFNLGdCQUFPLENBQUMsZUFBZSxDQUU1QztvQkFDRSxPQUFPLEVBQUUsS0FBSyxJQUFJLEVBQUU7d0JBQ2hCLE9BQU8sSUFBSSxDQUFDLENBQUM7d0JBQ2IsU0FBUyxDQUFDLElBQUksQ0FDVixnQkFBZ0IsT0FBTyxJQUFJLElBQUksQ0FBQyxhQUFhLGtCQUFrQixDQUNsRSxDQUFDO3dCQUVGLE9BQU8sTUFBTSxJQUFJLENBQUMsWUFBWSxDQUMxQixNQUFNLEVBQ04sTUFBTSxFQUNOLFVBQVUsQ0FDYixDQUFDO29CQUNOLENBQUM7b0JBQ0QsVUFBVSxFQUFFLENBQUMsS0FBSyxFQUFFLEVBQUU7d0JBQ2xCLE1BQU0sWUFBWSxHQUNkLEtBQUssWUFBWSxLQUFLOzRCQUNsQixDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU87NEJBQ2YsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQzt3QkFDeEIsTUFBTSxhQUFhLEdBQUcsVUFBVSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQzt3QkFDdEQsTUFBTSxlQUFlLEdBQUcsT0FBTyxHQUFHLElBQUksQ0FBQyxhQUFhLENBQUM7d0JBRXJELFNBQVMsQ0FBQyxLQUFLLENBQ1gsa0JBQWtCLE9BQU8sSUFBSSxJQUFJLENBQUMsYUFBYSxxQkFBcUIsWUFBWSxhQUFhLGFBQWEsQ0FBQyxNQUFNLEVBQUUsQ0FDdEgsQ0FBQzt3QkFFRixJQUFJLENBQUMsYUFBYSxDQUFDLFdBQVcsRUFBRSxDQUFDOzRCQUM3QixTQUFTLENBQUMsS0FBSyxDQUNYLDBFQUEwRSxhQUFhLENBQUMsTUFBTSxFQUFFLENBQ25HLENBQUM7NEJBQ0YsT0FBTyxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUUsQ0FBQzt3QkFDaEMsQ0FBQzt3QkFFRCxJQUFJLGVBQWUsRUFBRSxDQUFDOzRCQUNsQixTQUFTLENBQUMsSUFBSSxDQUNWLDJCQUEyQixJQUFJLENBQUMsYUFBYSx1QkFBdUIsYUFBYSxDQUFDLE1BQU0sRUFBRSxDQUM3RixDQUFDO3dCQUNOLENBQUM7d0JBQ0QsT0FBTyxFQUFFLFNBQVMsRUFBRSxhQUFhLENBQUMsV0FBVyxFQUFFLENBQUM7b0JBQ3BELENBQUM7b0JBQ0QsYUFBYSxFQUFFLElBQUksQ0FBQyxhQUFhLEdBQUcsSUFBSTtvQkFDeEMsUUFBUSxFQUFFLElBQUksQ0FBQyxhQUFhO2lCQUMvQixDQUFDLENBQUM7WUFDUCxDQUFDO1lBQUMsTUFBTSxDQUFDO2dCQUNMLFNBQVM7WUFDYixDQUFDO1lBRUQsSUFBSSxjQUFjLElBQUksSUFBSSxFQUFFLENBQUM7Z0JBQ3pCLFNBQVM7WUFDYixDQUFDO1lBRUQsSUFBSSxDQUFDO2dCQUNELE1BQU0sSUFBSSxDQUFDLGFBQWEsQ0FDcEIsTUFBTSxFQUNOLGNBQWMsRUFDZCxnQkFBZ0IsQ0FDbkIsQ0FBQztnQkFDRixTQUFTLENBQUMsSUFBSSxDQUFDLGlDQUFpQyxDQUFDLENBQUM7Z0JBQ2xELE9BQU87WUFDWCxDQUFDO1lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztnQkFDYixNQUFNLFlBQVksR0FDZCxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7Z0JBQzNELE1BQU0sTUFBTSxHQUFHLGVBQUssQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDO29CQUNwQyxDQUFDLENBQUMsVUFBVSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxNQUFNO29CQUN4QyxDQUFDLENBQUMsb0JBQW9CLENBQUM7Z0JBQzNCLFNBQVMsQ0FBQyxLQUFLLENBQ1gsOENBQThDLFlBQVksYUFBYSxNQUFNLEVBQUUsQ0FDbEYsQ0FBQztZQUNOLENBQUM7UUFDTCxDQUFDO1FBRUQsTUFBTSxJQUFJLEtBQUssQ0FBQyxpQ0FBaUMsQ0FBQyxDQUFDO0lBQ3ZELENBQUM7O0FBaFpMLGdDQWlaQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3luYy1jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvc3luYy1jbGllbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFDQSwyREFJb0M7QUFDcEMsMkRBT29DO0FBQ3BDLG1GQUdnRDtBQUNoRCwyRUFBeUU7QUFDekUsbURBQWlEO0FBQ2pELGtEQUEwQjtBQUMxQix1Q0FBeUI7QUFDekIsMkNBQTZCO0FBZ0I3QixNQUFhLFVBQVU7SUFDbkIsTUFBTSxDQUFVLHNCQUFzQixHQUFHLENBQUMsQ0FBQyxDQUFDLDRCQUE0QjtJQUN4RSxNQUFNLENBQVUsdUJBQXVCLEdBQUcsRUFBRSxDQUFDO0lBQ3JDLE1BQU0sQ0FBVSw2QkFBNkIsR0FBRyxJQUFJLEdBQUcsQ0FBQztRQUM1RCxXQUFXO1FBQ1gsWUFBWTtRQUNaLGNBQWM7UUFDZCxXQUFXO1FBQ1gsV0FBVztRQUNYLGNBQWM7S0FDakIsQ0FBQyxDQUFDO0lBQ0ssTUFBTSxDQUFVLDJCQUEyQixHQUFHLElBQUksR0FBRyxDQUFDLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFFbEUsT0FBTyxDQUFvQjtJQUMzQixTQUFTLENBQW1CO0lBQzVCLE1BQU0sQ0FBTTtJQUNaLGFBQWEsQ0FBUztJQUN0QixhQUFhLENBQVM7SUFFdEIsTUFBTSxDQUFDLGtCQUFrQixDQUFDLGFBQW9DO1FBSWxFLFFBQVEsYUFBYSxFQUFFLENBQUM7WUFDcEIsS0FBSywwQkFBYSxDQUFDLEdBQUcsQ0FBQztZQUN2QixLQUFLLDBCQUFhLENBQUMsU0FBUyxDQUFDO1lBQzdCLEtBQUssMEJBQWEsQ0FBQyxNQUFNO2dCQUNyQixPQUFPO29CQUNILFNBQVMsRUFBRSxJQUFJO29CQUNmLElBQUksRUFBRSxhQUFhO2lCQUN0QixDQUFDO1lBQ047Z0JBQ0ksT0FBTztvQkFDSCxTQUFTLEVBQUUsS0FBSztvQkFDaEIsSUFBSSxFQUFFLGdCQUFnQjtpQkFDekIsQ0FBQztRQUNWLENBQUM7SUFDTCxDQUFDO0lBRU8sTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUEwQjtRQUNuRCxJQUFJLE9BQU8sQ0FBQyxRQUFRLElBQUksSUFBSSxFQUFFLENBQUM7WUFDM0IsT0FBTyxJQUFJLDBCQUFPLEVBQUUsQ0FBQztRQUN6QixDQUFDO1FBRUQsTUFBTSxhQUFhLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxxQkFBUSxDQUFhLENBQUM7UUFDMUQsSUFBSSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDNUMsTUFBTSxJQUFJLEtBQUssQ0FDWCwwQkFBMEIsT0FBTyxDQUFDLFFBQVEsZ0JBQWdCLGFBQWEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FDdkYsQ0FBQztRQUNOLENBQUM7UUFFRCxPQUFPLElBQUksMEJBQU8sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDekMsQ0FBQztJQUVELFlBQVksT0FBMEI7UUFDbEMsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUM7UUFDdkIsSUFBSSxDQUFDLE1BQU0sR0FBRyxVQUFVLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxDQUFDLEtBQUssQ0FBQztZQUNsRCxPQUFPLEVBQUUsWUFBWTtTQUN4QixDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsYUFBYSxHQUFHLFVBQVUsQ0FBQyxzQkFBc0IsQ0FDbEQsT0FBTyxDQUFDLGFBQWEsQ0FDeEIsQ0FBQztRQUNGLElBQUksQ0FBQyxhQUFhLEdBQUcsVUFBVSxDQUFDLHNCQUFzQixDQUNsRCxPQUFPLENBQUMsYUFBYSxDQUN4QixDQUFDO0lBQ04sQ0FBQztJQUVPLE1BQU0sQ0FBQyxvQkFBb0IsQ0FDL0IsYUFBb0M7UUFFcEMsUUFBUSxhQUFhLEVBQUUsQ0FBQztZQUNwQixLQUFLLDBCQUFhLENBQUMsR0FBRyxDQUFDO1lBQ3ZCLEtBQUssMEJBQWEsQ0FBQyxTQUFTLENBQUM7WUFDN0IsS0FBSywwQkFBYSxDQUFDLE1BQU07Z0JBQ3JCLE9BQU8sRUFBRSxJQUFJLEVBQUUsYUFBYSxFQUFFLENBQUM7WUFDbkMsS0FBSywwQkFBYSxDQUFDLFNBQVM7Z0JBQ3hCLE9BQU87b0JBQ0gsSUFBSSxFQUFFLDBCQUFhLENBQUMsU0FBUztvQkFDN0IsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsOEJBQThCLENBQUMsQ0FBQyxRQUFRLENBQ3ZELEtBQUssQ0FDUjtpQkFDSixDQUFDO1lBQ047Z0JBQ0ksTUFBTSxJQUFJLEtBQUssQ0FDWCwrQkFBK0IsYUFBYSx3REFBd0QsQ0FDdkcsQ0FBQztRQUNWLENBQUM7SUFDTCxDQUFDO0lBRU8sS0FBSyxDQUFDLGdCQUFnQjtRQUMxQixJQUFJLElBQUksQ0FBQyxTQUFTLElBQUksSUFBSSxFQUFFLENBQUM7WUFDekIsT0FBTyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQzFCLENBQUM7UUFFRCxNQUFNLGFBQWEsR0FDZixJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksS0FBSyxNQUFNO1lBQ2hDLENBQUMsQ0FBQyxNQUFNLElBQUEsOENBQXFCLEdBQUU7WUFDL0IsQ0FBQyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDO1FBRXBDLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxZQUFZLEtBQUssTUFBTSxFQUFFLENBQUM7WUFDdkMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkNBQTJDLEVBQUU7Z0JBQzFELGFBQWE7YUFDaEIsQ0FBQyxDQUFDO1FBQ1AsQ0FBQztRQUVELElBQUksQ0FBQyxTQUFTLEdBQUcsVUFBVSxDQUFDLG9CQUFvQixDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQ2hFLE1BQU0sZUFBZSxHQUFHLFVBQVUsQ0FBQyxrQkFBa0IsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUNyRSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyx1Q0FBdUMsRUFBRTtZQUN0RCxhQUFhLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJO1lBQ2xDLFNBQVMsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLFNBQVM7WUFDakMsMEJBQTBCLEVBQ3RCLElBQUksQ0FBQyxPQUFPLENBQUMsMEJBQTBCLElBQUksS0FBSztZQUNwRCxvQkFBb0IsRUFBRSxlQUFlLENBQUMsU0FBUztZQUMvQyxlQUFlLEVBQUUsZUFBZSxDQUFDLElBQUk7U0FDeEMsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxJQUFJLENBQUMsU0FBUyxDQUFDO0lBQzFCLENBQUM7SUFFTyxNQUFNLENBQUMsc0JBQXNCLENBQUMsS0FBeUI7UUFDM0QsSUFBSSxLQUFLLElBQUksSUFBSSxFQUFFLENBQUM7WUFDaEIsT0FBTyxVQUFVLENBQUMsc0JBQXNCLENBQUM7UUFDN0MsQ0FBQztRQUVELElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN4QyxNQUFNLElBQUksS0FBSyxDQUNYLHNFQUFzRSxDQUN6RSxDQUFDO1FBQ04sQ0FBQztRQUVELE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7SUFFTyxNQUFNLENBQUMsc0JBQXNCLENBQUMsS0FBeUI7UUFDM0QsSUFBSSxLQUFLLElBQUksSUFBSSxFQUFFLENBQUM7WUFDaEIsT0FBTyxVQUFVLENBQUMsdUJBQXVCLENBQUM7UUFDOUMsQ0FBQztRQUVELElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN4QyxNQUFNLElBQUksS0FBSyxDQUNYLHNFQUFzRSxDQUN6RSxDQUFDO1FBQ04sQ0FBQztRQUVELE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7SUFFTyxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQWM7UUFJdkMsSUFBSSxDQUFDLGVBQUssQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUM3QixPQUFPO2dCQUNILFdBQVcsRUFBRSxLQUFLO2dCQUNsQixNQUFNLEVBQUUsaUJBQWlCO2FBQzVCLENBQUM7UUFDTixDQUFDO1FBRUQsTUFBTSxVQUFVLEdBQUcsS0FBSyxDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUM7UUFDMUMsSUFBSSxVQUFVLElBQUksSUFBSSxFQUFFLENBQUM7WUFDckIsTUFBTSxNQUFNLEdBQUcsZUFBZSxVQUFVLEVBQUUsQ0FBQztZQUMzQyxPQUFPO2dCQUNILFdBQVcsRUFDUCxVQUFVLENBQUMsMkJBQTJCLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQztnQkFDMUQsTUFBTTthQUNULENBQUM7UUFDTixDQUFDO1FBRUQsTUFBTSxTQUFTLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQztRQUM3QixJQUFJLFNBQVMsSUFBSSxJQUFJLEVBQUUsQ0FBQztZQUNwQixNQUFNLE1BQU0sR0FBRyxnQkFBZ0IsU0FBUyxFQUFFLENBQUM7WUFDM0MsT0FBTztnQkFDSCxXQUFXLEVBQ1AsVUFBVSxDQUFDLDZCQUE2QixDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUM7Z0JBQzNELE1BQU07YUFDVCxDQUFDO1FBQ04sQ0FBQztRQUVELE9BQU87WUFDSCxXQUFXLEVBQUUsS0FBSztZQUNsQixNQUFNLEVBQUUscUJBQXFCO1NBQ2hDLENBQUM7SUFDTixDQUFDO0lBRU8sS0FBSyxDQUFDLFlBQVksQ0FDdEIsTUFBYyxFQUNkLE1BQWtCLEVBQ2xCLFVBQWtFO1FBRWxFLE1BQU0sV0FBVyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLENBQUM7UUFFNUQsTUFBTSxRQUFRLEdBQUcsTUFBTSxlQUFLLENBQUMsSUFBSSxDQUM3QixXQUFXLE1BQU0scUJBQXFCLEVBQ3RDLEVBQUUsT0FBTyxFQUFFLFdBQVcsRUFBRSxFQUN4QixFQUFFLFVBQVUsRUFBRSxDQUNqQixDQUFDO1FBRUYsT0FBTyxRQUFRLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQztJQUNqQyxDQUFDO0lBRU8sS0FBSyxDQUFDLFdBQVcsQ0FDckIsTUFBa0IsRUFDbEIsT0FBK0I7UUFFL0IsS0FBSyxNQUFNLE1BQU0sSUFBSSxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDbEMsTUFBTSxhQUFhLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUNqRCxJQUFJLGFBQWEsSUFBSSxJQUFJLEVBQUUsQ0FBQztnQkFDeEIsTUFBTSxJQUFJLEtBQUssQ0FDWCxXQUFXLE1BQU0sQ0FBQyxVQUFVLHlCQUF5QixDQUN4RCxDQUFDO1lBQ04sQ0FBQztZQUVELE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQ3hDLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7WUFFbEQsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLGFBQWEsRUFBRTtnQkFDdEQsUUFBUSxFQUFFLFFBQVE7Z0JBQ2xCLElBQUksRUFBRSxLQUFLO2FBQ2QsQ0FBQyxDQUFDO1lBRUgsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQ1osaUJBQWlCLE1BQU0sQ0FBQyxVQUFVLFFBQVEsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUM1RCxDQUFDO1FBQ04sQ0FBQztJQUNMLENBQUM7SUFFTyxLQUFLLENBQUMsYUFBYSxDQUN2QixNQUFrQixFQUNsQixPQUErQixFQUMvQixnQkFBa0M7UUFFbEMsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsQ0FBQztRQUV4QyxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDOUIsTUFBTSxJQUFJLENBQUMsZ0JBQWdCLENBQ3ZCLGdCQUFnQixFQUNoQixJQUFJLENBQUMsT0FBTyxDQUFDLGNBQWMsRUFDM0IsSUFBSSxDQUFDLE9BQU8sQ0FBQyxlQUFlLENBQy9CLENBQUM7UUFDTixDQUFDO0lBQ0wsQ0FBQztJQUVPLEtBQUssQ0FBQyxnQkFBZ0IsQ0FDMUIsZ0JBQWtDLEVBQ2xDLFFBQWdCLEVBQ2hCLE1BQWU7UUFFZiwwQkFBMEI7UUFDMUIsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxRQUFRLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUV2RCxNQUFNLElBQUksR0FBRyxNQUFNLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQzlDLE1BQU0sRUFDRixJQUFJLEVBQUUsVUFBVSxFQUNoQix3QkFBd0IsRUFDeEIsRUFBRSxHQUNMLEdBQUcsSUFBQSw0Q0FBK0IsRUFBQyxJQUFJLENBQUMsQ0FBQztRQUUxQyxNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsQ0FBQyxDQUFDLEdBQUcsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUU3QyxtQkFBbUI7UUFDbkIsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsR0FBRyxTQUFTLFNBQVMsQ0FBQyxDQUFDO1FBQzNELE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPLENBQUMsYUFBYSxFQUFFO1lBQzdELElBQUksRUFBRSxLQUFLO1NBQ2QsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLE9BQU8sRUFBRSxDQUFDLENBQUM7UUFFcEQsc0JBQXNCO1FBQ3RCLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLEdBQUcsU0FBUyxRQUFRLENBQUMsQ0FBQztRQUN6RCxNQUFNLEVBQUUsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxFQUFFLEVBQUUsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztRQUN6RCxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQywyQkFBMkIsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUV0RCxrREFBa0Q7UUFDbEQsTUFBTSxvQkFBb0IsR0FBRyxVQUFVLEdBQUcsd0JBQXdCLENBQUM7UUFDbkUsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsR0FBRyxTQUFTLFVBQVUsQ0FBQyxDQUFDO1FBQzdELE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsUUFBUSxFQUFFLG9CQUFvQixFQUFFO1lBQ3hELElBQUksRUFBRSxLQUFLO1NBQ2QsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsOEJBQThCLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDL0QsQ0FBQztJQUVELEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBa0I7UUFDekIsTUFBTSxTQUFTLEdBQUcsTUFBTSxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztRQUVoRCxLQUFLLE1BQU0sTUFBTSxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDeEMsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7Z0JBQ2hDLE1BQU07Z0JBQ04sYUFBYSxFQUFFLFNBQVMsQ0FBQyxJQUFJO2FBQ2hDLENBQUMsQ0FBQztZQUNILElBQUksZ0JBQWtDLENBQUM7WUFDdkMsSUFBSSxVQUVILENBQUM7WUFFRixJQUFJLENBQUM7Z0JBQ0QsU0FBUyxDQUFDLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO2dCQUVyQyxNQUFNLFNBQVMsR0FBb0I7b0JBQy9CLGtCQUFrQixFQUFFO3dCQUNoQixJQUFJLEVBQUUsUUFBUTt3QkFDZCxTQUFTO3dCQUNULE9BQU8sRUFBRSxXQUFXLE1BQU0sYUFBYTt3QkFDdkMsUUFBUSxFQUFFLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUTt3QkFDL0IsMEJBQTBCLEVBQ3RCLElBQUksQ0FBQyxPQUFPLENBQUMsMEJBQTBCLElBQUksS0FBSztxQkFDdkQ7b0JBQ0QsU0FBUyxFQUFFLElBQUksQ0FBQyxPQUFPLENBQUMsU0FBUztpQkFDcEMsQ0FBQztnQkFFRixTQUFTLENBQUMsS0FBSyxDQUFDLHNDQUFzQyxFQUFFO29CQUNwRCwwQkFBMEIsRUFDdEIsSUFBSSxDQUFDLE9BQU8sQ0FBQywwQkFBMEIsSUFBSSxLQUFLO2lCQUN2RCxDQUFDLENBQUM7Z0JBQ0gsZ0JBQWdCLEdBQUcsSUFBSSw2QkFBZ0IsQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDLENBQUM7Z0JBQzlELE1BQU0sVUFBVSxHQUFHLE1BQU0sZ0JBQWdCLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ3BELElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQywwQkFBMEIsRUFBRSxDQUFDO29CQUMxQyxTQUFTLENBQUMsSUFBSSxDQUNWLCtGQUErRixDQUNsRyxDQUFDO2dCQUNOLENBQUM7cUJBQU0sQ0FBQztvQkFDSixNQUFNLElBQUEsc0RBQTBCLEVBQUM7d0JBQzdCLFFBQVEsRUFBRSxVQUFVLENBQUMsUUFBUTt3QkFDN0IsZUFBZSxFQUFFLElBQUksQ0FBQyxPQUFPLENBQUMsZUFBZTt3QkFDN0MsR0FBRyxFQUFFLFNBQVM7cUJBQ2pCLENBQUMsQ0FBQztnQkFDUCxDQUFDO2dCQUNELFVBQVUsR0FBRyxNQUFNLGdCQUFnQixDQUFDLGFBQWEsRUFBRSxDQUFDO2dCQUNwRCxTQUFTLENBQUMsSUFBSSxDQUFDLGtDQUFrQyxDQUFDLENBQUM7WUFDdkQsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2IsTUFBTSxZQUFZLEdBQ2QsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUMzRCxTQUFTLENBQUMsS0FBSyxDQUNYLDZDQUE2QyxZQUFZLDJCQUEyQixDQUN2RixDQUFDO2dCQUNGLFNBQVM7WUFDYixDQUFDO1lBRUQsSUFBSSxjQUFrRCxDQUFDO1lBQ3ZELElBQUksT0FBTyxHQUFHLENBQUMsQ0FBQztZQUVoQixJQUFJLENBQUM7Z0JBQ0QsY0FBYyxHQUFHLE1BQU0sZ0JBQU8sQ0FBQyxlQUFlLENBRTVDO29CQUNFLE9BQU8sRUFBRSxLQUFLLElBQUksRUFBRTt3QkFDaEIsT0FBTyxJQUFJLENBQUMsQ0FBQzt3QkFDYixTQUFTLENBQUMsSUFBSSxDQUNWLGdCQUFnQixPQUFPLElBQUksSUFBSSxDQUFDLGFBQWEsa0JBQWtCLENBQ2xFLENBQUM7d0JBRUYsT0FBTyxNQUFNLElBQUksQ0FBQyxZQUFZLENBQzFCLE1BQU0sRUFDTixNQUFNLEVBQ04sVUFBVSxDQUNiLENBQUM7b0JBQ04sQ0FBQztvQkFDRCxVQUFVLEVBQUUsQ0FBQyxLQUFLLEVBQUUsRUFBRTt3QkFDbEIsTUFBTSxZQUFZLEdBQ2QsS0FBSyxZQUFZLEtBQUs7NEJBQ2xCLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTzs0QkFDZixDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO3dCQUN4QixNQUFNLGFBQWEsR0FBRyxVQUFVLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxDQUFDO3dCQUN0RCxNQUFNLGVBQWUsR0FBRyxPQUFPLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBQzt3QkFFckQsU0FBUyxDQUFDLEtBQUssQ0FDWCxrQkFBa0IsT0FBTyxJQUFJLElBQUksQ0FBQyxhQUFhLHFCQUFxQixZQUFZLGFBQWEsYUFBYSxDQUFDLE1BQU0sRUFBRSxDQUN0SCxDQUFDO3dCQUVGLElBQUksQ0FBQyxhQUFhLENBQUMsV0FBVyxFQUFFLENBQUM7NEJBQzdCLFNBQVMsQ0FBQyxLQUFLLENBQ1gsMEVBQTBFLGFBQWEsQ0FBQyxNQUFNLEVBQUUsQ0FDbkcsQ0FBQzs0QkFDRixPQUFPLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxDQUFDO3dCQUNoQyxDQUFDO3dCQUVELElBQUksZUFBZSxFQUFFLENBQUM7NEJBQ2xCLFNBQVMsQ0FBQyxJQUFJLENBQ1YsMkJBQTJCLElBQUksQ0FBQyxhQUFhLHVCQUF1QixhQUFhLENBQUMsTUFBTSxFQUFFLENBQzdGLENBQUM7d0JBQ04sQ0FBQzt3QkFDRCxPQUFPLEVBQUUsU0FBUyxFQUFFLGFBQWEsQ0FBQyxXQUFXLEVBQUUsQ0FBQztvQkFDcEQsQ0FBQztvQkFDRCxhQUFhLEVBQUUsSUFBSSxDQUFDLGFBQWEsR0FBRyxJQUFJO29CQUN4QyxRQUFRLEVBQUUsSUFBSSxDQUFDLGFBQWE7aUJBQy9CLENBQUMsQ0FBQztZQUNQLENBQUM7WUFBQyxNQUFNLENBQUM7Z0JBQ0wsU0FBUztZQUNiLENBQUM7WUFFRCxJQUFJLGNBQWMsSUFBSSxJQUFJLEVBQUUsQ0FBQztnQkFDekIsU0FBUztZQUNiLENBQUM7WUFFRCxJQUFJLENBQUM7Z0JBQ0QsTUFBTSxJQUFJLENBQUMsYUFBYSxDQUNwQixNQUFNLEVBQ04sY0FBYyxFQUNkLGdCQUFnQixDQUNuQixDQUFDO2dCQUNGLFNBQVMsQ0FBQyxJQUFJLENBQUMsaUNBQWlDLENBQUMsQ0FBQztnQkFDbEQsT0FBTztZQUNYLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNiLE1BQU0sWUFBWSxHQUNkLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDM0QsTUFBTSxNQUFNLEdBQUcsZUFBSyxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUM7b0JBQ3BDLENBQUMsQ0FBQyxVQUFVLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU07b0JBQ3hDLENBQUMsQ0FBQyxvQkFBb0IsQ0FBQztnQkFDM0IsU0FBUyxDQUFDLEtBQUssQ0FDWCw4Q0FBOEMsWUFBWSxhQUFhLE1BQU0sRUFBRSxDQUNsRixDQUFDO1lBQ04sQ0FBQztRQUNMLENBQUM7UUFFRCxNQUFNLElBQUksS0FBSyxDQUFDLGlDQUFpQyxDQUFDLENBQUM7SUFDdkQsQ0FBQzs7QUE1WkwsZ0NBNlpDIn0=

package/npm-shrinkwrap.json

@@ -1,15 +1,17 @@
 {
   "name": "@super-protocol/pki-sync-client",
-  "version": "5.0.2",
+  "version": "5.0.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@super-protocol/pki-sync-client",
-      "version": "5.0.2",
+      "version": "5.0.4",
       "license": "ISC",
       "dependencies": {
         "@sinclair/typebox": "0.33.22",
+        "@super-protocol/attestation-common": "0.1.2",
+        "@super-protocol/attestation-wasm": "0.1.2",
         "@super-protocol/pki-attestation-engine": "5.0.2",
         "@super-protocol/pki-client": "5.0.2",
         "@super-protocol/pki-common": "5.0.1",
@@ -27,6 +29,10 @@
         "@types/js-yaml": "^4.0.9",
         "@types/node": "^20.11.0",
         "@types/yargs": "^17.0.33"
+      },
+      "engines": {
+        "node": ">=24.0.0",
+        "npm": ">=11.0.0"
       }
     },
     "node_modules/@adraffy/ens-normalize": {
@@ -1321,19 +1327,21 @@
       "integrity": "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg=="
     },
     "node_modules/@protobufjs/codegen": {
-      "version": "2.0.4",
-      "integrity": "sha512-YyFaikqM5sH0ziFZCN3xDC7zeGaB/d0IUb9CATugHWbd1FRFwWwt4ld4OYMPWu5a3Xe01mGAULCdqhMlPl29Jg=="
+      "version": "2.0.5",
+      "integrity": "sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g==",
+      "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/eventemitter": {
-      "version": "1.1.0",
-      "integrity": "sha512-j9ednRT81vYJ9OfVuXG6ERSTdEL1xVsNgqpkxMsbIabzSo3goCjDIveeGv5d03om39ML71RdmrGNjG5SReBP/Q=="
+      "version": "1.1.1",
+      "integrity": "sha512-vW1GmwMZNnL+gMRaovlh9yZX74kc+TTU3FObkkurpMaRtBfLP3ldjS9KQWlwZgraRE0+dheEEoAxdzcJQ8eXZg==",
+      "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/fetch": {
-      "version": "1.1.0",
-      "integrity": "sha512-lljVXpqXebpsijW71PZaCYeIcE5on1w5DlQy5WH6GLbFryLUrBD4932W/E2BSpfRJWseIL4v/KPgBFxDOIdKpQ==",
+      "version": "1.1.1",
+      "integrity": "sha512-GpptLrs57adMSuHi3VNj0mAF8dwh36LMaYF6XyJ6JMWlVsc+t42tm1HSEDmOs3A8fC9yyeisgLhsTVQokOZ0zw==",
+      "license": "BSD-3-Clause",
       "dependencies": {
-        "@protobufjs/aspromise": "^1.1.1",
-        "@protobufjs/inquire": "^1.1.0"
+        "@protobufjs/aspromise": "^1.1.1"
       }
     },
     "node_modules/@protobufjs/float": {
@@ -1353,8 +1361,9 @@
       "integrity": "sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw=="
     },
     "node_modules/@protobufjs/utf8": {
-      "version": "1.1.0",
-      "integrity": "sha512-Vvn3zZrhQZkkBE8LSuW3em98c0FwgO4nxzv6OdSxPKJIEKY2bGbHn+mhGIPerzI4twdxaP8/0+06HBpwf345Lw=="
+      "version": "1.1.2",
+      "integrity": "sha512-b1UQwcEZ4yCnMCD8DAL1VlbvBJE9/IX4FTIp7BG1xYpf29SLazLSrqUkj4w7Y5y7cCVP6E5tcqqcI0xemPkHug==",
+      "license": "BSD-3-Clause"
     },
     "node_modules/@scure/base": {
       "version": "1.1.9",
@@ -2117,6 +2126,87 @@
       "integrity": "sha512-75232GRx3wp3P7NP+yc4nRK3XUAnaQShxTAzapgmQrgs0QvSq0/mOJGoZXRpH15cFCKyys+4laCPbBselqJ5Ag==",
       "license": "MIT"
     },
+    "node_modules/@super-protocol/attestation-common": {
+      "version": "0.1.2",
+      "integrity": "sha512-j+uEOuoppwuUHlSDupSpBdG+o5eknGSv5lIzfH1KQwAGVXA78OcA93dp1eeXlPfss/+cNyD+GprZyKXd3J1Qhw==",
+      "license": "BSL-1.0",
+      "dependencies": {
+        "@aws-sdk/client-s3": "^3.735.0",
+        "@sinclair/typebox": "^0.33.17",
+        "protobufjs": "^7.4.0"
+      },
+      "engines": {
+        "node": ">=24.0",
+        "npm": ">=11.0"
+      }
+    },
+    "node_modules/@super-protocol/attestation-common/node_modules/long": {
+      "version": "5.3.2",
+      "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/@super-protocol/attestation-common/node_modules/protobufjs": {
+      "version": "7.6.5",
+      "integrity": "sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==",
+      "hasInstallScript": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@protobufjs/aspromise": "^1.1.2",
+        "@protobufjs/base64": "^1.1.2",
+        "@protobufjs/codegen": "^2.0.5",
+        "@protobufjs/eventemitter": "^1.1.1",
+        "@protobufjs/fetch": "^1.1.1",
+        "@protobufjs/float": "^1.0.2",
+        "@protobufjs/path": "^1.1.2",
+        "@protobufjs/pool": "^1.1.0",
+        "@protobufjs/utf8": "^1.1.1",
+        "@types/node": ">=13.7.0",
+        "long": "^5.3.2"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
+    "node_modules/@super-protocol/attestation-wasm": {
+      "version": "0.1.2",
+      "integrity": "sha512-1WR6AA3CGxb0V4Egw1fpHBSjqMe8zI5O9fuInfPPfuQMKBQ8YJpNBOTG0qWGAMLlEd1C2Dkt3e+cZ8WXhtQPuA==",
+      "license": "BSL-1.0",
+      "dependencies": {
+        "@super-protocol/attestation-common": "^0.1.2",
+        "protobufjs": "^7.4.0"
+      },
+      "engines": {
+        "node": ">=24.0",
+        "npm": ">=11.0"
+      }
+    },
+    "node_modules/@super-protocol/attestation-wasm/node_modules/long": {
+      "version": "5.3.2",
+      "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/@super-protocol/attestation-wasm/node_modules/protobufjs": {
+      "version": "7.6.5",
+      "integrity": "sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==",
+      "hasInstallScript": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@protobufjs/aspromise": "^1.1.2",
+        "@protobufjs/base64": "^1.1.2",
+        "@protobufjs/codegen": "^2.0.5",
+        "@protobufjs/eventemitter": "^1.1.1",
+        "@protobufjs/fetch": "^1.1.1",
+        "@protobufjs/float": "^1.0.2",
+        "@protobufjs/path": "^1.1.2",
+        "@protobufjs/pool": "^1.1.0",
+        "@protobufjs/utf8": "^1.1.1",
+        "@types/node": ">=13.7.0",
+        "long": "^5.3.2"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/@super-protocol/dto-js": {
       "version": "1.3.0",
       "integrity": "sha512-BeSZqYCYBINUa3JnrOEvu3qKrvAx8ShEYcoQ0RD/PwMxMZ4X60RvzEVN4Q0G2QzMLdNYGbNsNP5dvDZU4T5eGQ==",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@super-protocol/pki-sync-client",
-  "version": "5.0.2",
+  "version": "5.0.4",
   "description": "PKI sync client utility",
   "main": "dist/index.js",
   "bin": {
@@ -22,8 +22,14 @@
   },
   "author": "Super Protocol",
   "license": "ISC",
+  "engines": {
+    "node": ">=24.0.0",
+    "npm": ">=11.0.0"
+  },
   "dependencies": {
     "@sinclair/typebox": "0.33.22",
+    "@super-protocol/attestation-common": "0.1.2",
+    "@super-protocol/attestation-wasm": "0.1.2",
     "@super-protocol/pki-attestation-engine": "5.0.2",
     "@super-protocol/pki-client": "5.0.2",
     "@super-protocol/pki-common": "5.0.1",