@super-protocol/sdk-js 4.0.14 → 4.0.16

package/dist/mjs/certificates/generator.js

@@ -1,230 +0,0 @@
-import assert from 'assert';
-import forge from 'node-forge';
-import { X509CertificateGenerator, BasicConstraintsExtension, ExtendedKeyUsageExtension, Extension, SubjectAlternativeNameExtension, ExtendedKeyUsage, KeyUsageFlags, KeyUsagesExtension, Pkcs10CertificateRequestGenerator, Pkcs10CertificateRequest, X509Certificate, AuthorityInfoAccessExtension, AuthorityKeyIdentifierExtension, SubjectKeyIdentifierExtension, } from '@peculiar/x509';
-import { cryptoProvider } from './setup-crypto.js';
-import { CryptoKeysTransformer } from '../utils/CryptoKeysTransformer.js';
-import { isIpAddress } from '../utils/helper.js';
-import { CertificatesHelper } from './helper.js';
-const ONE_HOUR_MS = 60 * 60 * 1000; // 1 hour in milliseconds
-const notAllowedCertificateCustomExtensions = [...Object.values(forge.pki.oids)];
-export class CertificateGenerator {
-    /**
-     * Generates certificate based on the provided parameters.
-     * @param params - Parameters for generating the certificate.
-     * @returns The generated certificate in PEM format.
-     */
-    static async generateCert(params) {
-        const ca = Boolean(params.ca);
-        const { publicKey: subjectPublicKey, privateKey: signerPrivateKey } = await CertificateGenerator.getCryptoKeys(params);
-        const signingAlgorithm = subjectPublicKey.algorithm;
-        const extensions = [new BasicConstraintsExtension(ca, undefined, true)];
-        const extendedKeyUsageItems = [];
-        if (signingAlgorithm.namedCurve !== 'K-256' && params.dnsNames?.length) {
-            const generalNames = params.dnsNames.map((dnsName) => ({
-                type: (isIpAddress(dnsName) ? 'ip' : 'dns'),
-                value: dnsName,
-            }));
-            extensions.push(new SubjectAlternativeNameExtension(generalNames));
-            extendedKeyUsageItems.push(...[ExtendedKeyUsage.serverAuth, ExtendedKeyUsage.clientAuth]);
-        }
-        if (params.ocspSigning) {
-            extendedKeyUsageItems.push(ExtendedKeyUsage.ocspSigning);
-        }
-        if (params.ocspExtension) {
-            const { ocspUrl, issuerCertUrl } = params.ocspExtension;
-            extensions.push(new AuthorityInfoAccessExtension({
-                ocsp: [ocspUrl],
-                ...(issuerCertUrl ? { caIssuers: [issuerCertUrl] } : {}),
-            }));
-        }
-        if (extendedKeyUsageItems.length) {
-            extensions.push(new ExtendedKeyUsageExtension(extendedKeyUsageItems, false));
-        }
-        let keyUsageFlags = KeyUsageFlags.digitalSignature | KeyUsageFlags.keyEncipherment;
-        if (params.ca) {
-            keyUsageFlags |= KeyUsageFlags.keyCertSign;
-        }
-        extensions.push(new KeyUsagesExtension(keyUsageFlags, true));
-        const signerPublicKey = await CryptoKeysTransformer.cryptoPublicFromCryptoPrivate(signerPrivateKey);
-        extensions.push(...[
-            await AuthorityKeyIdentifierExtension.create(signerPublicKey),
-            await SubjectKeyIdentifierExtension.create(subjectPublicKey),
-        ]);
-        if (params.customExtensions?.length) {
-            const filteredExtensions = params.customExtensions.filter((ext) => !notAllowedCertificateCustomExtensions.includes(ext.oid));
-            for (const customExtension of filteredExtensions) {
-                if (!customExtension.oid || !customExtension.value) {
-                    throw new Error('Custom extension OID and value are required');
-                }
-                extensions.push(new Extension(customExtension.oid, false, customExtension.value));
-            }
-        }
-        const createCertificateParams = {
-            serialNumber: CertificatesHelper.generateSerialNumber().toString(16),
-            issuer: CertificatesHelper.serializePrincipalInfo(params.issuer),
-            subject: CertificatesHelper.serializePrincipalInfo(params.subject),
-            notBefore: new Date(Date.now() - ONE_HOUR_MS), //1 hour ago to avoid clock skew issues between servers
-            notAfter: params.notAfter,
-            publicKey: subjectPublicKey,
-            signingKey: signerPrivateKey,
-            signingAlgorithm,
-            extensions,
-        };
-        const cert = await X509CertificateGenerator.create(createCertificateParams);
-        return cert.toString('pem');
-    }
-    /**
-     * Generates a pair of cryptographic keys based on the specified signature algorithm.
-     * @param signatureAlgorithm - The algorithm to use for key generation.
-     * @returns A promise that resolves to a CryptoKeyPair containing the public and private keys.
-     */
-    static generateKeys(signatureAlgorithm) {
-        const algorithm = CertificateGenerator.getAlgorithm(signatureAlgorithm);
-        return cryptoProvider.subtle.generateKey(algorithm, true, ['sign', 'verify']);
-    }
-    /**
-     * Generates a Certificate Signing Request (CSR) based on the provided parameters.
-     * @param params - Parameters for generating the CSR.
-     * @returns The generated CSR in PEM format.
-     */
-    static async generateCsr(params) {
-        const keys = await CertificateGenerator.getCryptoKeys(params);
-        const signingAlgorithm = keys.publicKey.algorithm;
-        signingAlgorithm.hash = { name: 'SHA-256' };
-        const extensions = [];
-        if (signingAlgorithm.namedCurve !== 'K-256' && params.dnsNames?.length) {
-            const generalNames = params.dnsNames.map((dnsName) => ({
-                type: (isIpAddress(dnsName) ? 'ip' : 'dns'),
-                value: dnsName,
-            }));
-            extensions.push(new SubjectAlternativeNameExtension(generalNames));
-        }
-        if (params.customExtensions?.length) {
-            for (const customExtension of params.customExtensions) {
-                if (!customExtension.oid || !customExtension.value) {
-                    throw new Error(`Some custom extension missed OID or value`);
-                }
-                extensions.push(new Extension(customExtension.oid, false, customExtension.value));
-            }
-        }
-        const createCsrParams = {
-            name: CertificatesHelper.serializePrincipalInfo(params.subject),
-            keys,
-            signingAlgorithm,
-            extensions,
-        };
-        const csr = await Pkcs10CertificateRequestGenerator.create(createCsrParams);
-        return csr.toString('pem');
-    }
-    /**
-     * Verifies self-signed certificate
-     * @param rawCert - the certificate
-     * @returns An object containing the verification result.
-     */
-    verifySelfSignedCert(rawCert) {
-        const cert = new X509Certificate(rawCert);
-        if (cert.issuer !== cert.subject) {
-            return Promise.resolve({ isValid: false });
-        }
-        return cert.verify().then((isValid) => ({ isValid }));
-    }
-    /**
-     * Parses a certificate
-     * @param rawCert - the certificate
-     * @returns An object containing the parsed certificate details.
-     */
-    static async parseCert(rawCert) {
-        const cert = new X509Certificate(rawCert);
-        const publicKey = await cryptoProvider.subtle.importKey('spki', cert.publicKey.rawData, Object.assign(cert.signatureAlgorithm, cert.publicKey.algorithm), true, ['verify']);
-        const authorityKeyIdentifierExt = cert.extensions.find((ext) => ext instanceof AuthorityKeyIdentifierExtension);
-        const authorityKeyIdentifier = authorityKeyIdentifierExt?.keyId;
-        const subjectKeyIdentifierExt = cert.extensions.find((ext) => ext instanceof SubjectKeyIdentifierExtension);
-        const subjectKeyIdentifier = subjectKeyIdentifierExt?.keyId;
-        return {
-            serialNumberHex: cert.serialNumber,
-            publicKey,
-            subject: cert.subject,
-            issuer: cert.issuer,
-            notBefore: cert.notBefore,
-            notAfter: cert.notAfter,
-            dnsNames: CertificateGenerator.extractDnsNamesFromExtensions(cert.extensions),
-            authorityKeyIdentifier,
-            subjectKeyIdentifier,
-            extensions: cert.extensions
-                .filter((ext) => ext.type !== forge.pki.oids['subjectAltName'])
-                .map((ext) => ({
-                oid: ext.type,
-                value: Buffer.from(ext.value),
-            })),
-        };
-    }
-    /**
-     * Checks and parses a Certificate Signing Request (CSR) in PEM format.
-     * @param csrPem - The CSR in PEM format.
-     * @returns An object containing the parsed CSR details.
-     */
-    static async checkAndParseCsr(csrPem) {
-        const csr = new Pkcs10CertificateRequest(csrPem);
-        const isValid = await csr.verify();
-        if (!isValid) {
-            throw new Error('CSR signature verification failed');
-        }
-        const publicKey = await cryptoProvider.subtle.importKey('spki', csr.publicKey.rawData, Object.assign(csr.signatureAlgorithm, csr.publicKey.algorithm), true, ['verify']);
-        const parsedCsr = {
-            subject: csr.subject,
-            publicKey,
-            dnsNames: CertificateGenerator.extractDnsNamesFromExtensions(csr.extensions),
-            extensions: csr.extensions
-                .filter((ext) => ext.type !== forge.pki.oids['subjectAltName'])
-                .map((ext) => ({
-                oid: ext.type,
-                value: Buffer.from(ext.value),
-            })),
-        };
-        return parsedCsr;
-    }
-    static async getCryptoKeys({ privateKey, publicKey }) {
-        const [pubKey, privKey] = await Promise.all([
-            typeof publicKey === 'string'
-                ? CryptoKeysTransformer.spkiPemToCryptoKey(publicKey)
-                : publicKey,
-            typeof privateKey === 'string'
-                ? CryptoKeysTransformer.pkcs8PemToCryptoKey(privateKey)
-                : privateKey,
-        ]);
-        assert.deepEqual(pubKey.algorithm, privKey.algorithm, 'Both keys must have same algorithm defined');
-        return { publicKey: pubKey, privateKey: privKey };
-    }
-    static getAlgorithm(signatureAlgorithm) {
-        switch (signatureAlgorithm) {
-            case 'RSASSA-PKCS1-SHA256':
-                return {
-                    name: 'RSASSA-PKCS1-v1_5',
-                    hash: 'SHA-256',
-                    publicExponent: new Uint8Array([1, 0, 1]), // 65537
-                    modulusLength: 2048,
-                };
-            case 'ECDSA-P-256-SHA256':
-                return {
-                    name: 'ECDSA',
-                    namedCurve: 'P-256',
-                };
-            case 'ECDSA-secp256k1-SHA256':
-                return {
-                    name: 'ECDSA',
-                    namedCurve: 'K-256',
-                };
-            default:
-                throw new Error(`Unsupported signature algorithm: ${signatureAlgorithm}`);
-        }
-    }
-    static extractDnsNamesFromExtensions(extensions) {
-        const subjectAltNameExt = extensions.find((ext) => ext.type === forge.pki.oids['subjectAltName']);
-        if (!subjectAltNameExt) {
-            return;
-        }
-        const dnsNames = subjectAltNameExt.names.items.map((item) => item.value);
-        return dnsNames;
-    }
-}
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2VuZXJhdG9yLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2NlcnRpZmljYXRlcy9nZW5lcmF0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxNQUFNLE1BQU0sUUFBUSxDQUFDO0FBQzVCLE9BQU8sS0FBSyxNQUFNLFlBQVksQ0FBQztBQUMvQixPQUFPLEVBRUwsd0JBQXdCLEVBQ3hCLHlCQUF5QixFQUN6Qix5QkFBeUIsRUFDekIsU0FBUyxFQUNULCtCQUErQixFQUcvQixnQkFBZ0IsRUFDaEIsYUFBYSxFQUNiLGtCQUFrQixFQUNsQixpQ0FBaUMsRUFFakMsd0JBQXdCLEVBQ3hCLGVBQWUsRUFDZiw0QkFBNEIsRUFDNUIsK0JBQStCLEVBQy9CLDZCQUE2QixHQUU5QixNQUFNLGdCQUFnQixDQUFDO0FBVXhCLE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSxtQkFBbUIsQ0FBQztBQUNuRCxPQUFPLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxtQ0FBbUMsQ0FBQztBQUMxRSxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDakQsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sYUFBYSxDQUFDO0FBRWpELE1BQU0sV0FBVyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLENBQUMseUJBQXlCO0FBRTdELE1BQU0scUNBQXFDLEdBQUcsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0FBRWpGLE1BQU0sT0FBTyxvQkFBb0I7SUFDL0I7Ozs7T0FJRztJQUNILE1BQU0sQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDLE1BQTBCO1FBQ2xELE1BQU0sRUFBRSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7UUFFOUIsTUFBTSxFQUFFLFNBQVMsRUFBRSxnQkFBZ0IsRUFBRSxVQUFVLEVBQUUsZ0JBQWdCLEVBQUUsR0FDakUsTUFBTSxvQkFBb0IsQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDbkQsTUFBTSxnQkFBZ0IsR0FBRyxnQkFBZ0IsQ0FBQyxTQUF5QixDQUFDO1FBRXBFLE1BQU0sVUFBVSxHQUFnQixDQUFDLElBQUkseUJBQXlCLENBQUMsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDO1FBRXJGLE1BQU0scUJBQXFCLEdBQXVCLEVBQUUsQ0FBQztRQUVyRCxJQUFJLGdCQUFnQixDQUFDLFVBQVUsS0FBSyxPQUFPLElBQUksTUFBTSxDQUFDLFFBQVEsRUFBRSxNQUFNLEVBQUUsQ0FBQztZQUN2RSxNQUFNLFlBQVksR0FBcUIsTUFBTSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQUM7Z0JBQ3ZFLElBQUksRUFBRSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQW9CO2dCQUM5RCxLQUFLLEVBQUUsT0FBTzthQUNmLENBQUMsQ0FBQyxDQUFDO1lBQ0osVUFBVSxDQUFDLElBQUksQ0FBQyxJQUFJLCtCQUErQixDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUM7WUFFbkUscUJBQXFCLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxVQUFVLEVBQUUsZ0JBQWdCLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztRQUM1RixDQUFDO1FBRUQsSUFBSSxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDdkIscUJBQXFCLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQzNELENBQUM7UUFFRCxJQUFJLE1BQU0sQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUN6QixNQUFNLEVBQUUsT0FBTyxFQUFFLGFBQWEsRUFBRSxHQUFHLE1BQU0sQ0FBQyxhQUFhLENBQUM7WUFDeEQsVUFBVSxDQUFDLElBQUksQ0FDYixJQUFJLDRCQUE0QixDQUFDO2dCQUMvQixJQUFJLEVBQUUsQ0FBQyxPQUFPLENBQUM7Z0JBQ2YsR0FBRyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsQ0FBQyxhQUFhLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7YUFDekQsQ0FBQyxDQUNILENBQUM7UUFDSixDQUFDO1FBRUQsSUFBSSxxQkFBcUIsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNqQyxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUkseUJBQXlCLENBQUMscUJBQXFCLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQztRQUMvRSxDQUFDO1FBRUQsSUFBSSxhQUFhLEdBQUcsYUFBYSxDQUFDLGdCQUFnQixHQUFHLGFBQWEsQ0FBQyxlQUFlLENBQUM7UUFDbkYsSUFBSSxNQUFNLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDZCxhQUFhLElBQUksYUFBYSxDQUFDLFdBQVcsQ0FBQztRQUM3QyxDQUFDO1FBQ0QsVUFBVSxDQUFDLElBQUksQ0FBQyxJQUFJLGtCQUFrQixDQUFDLGFBQWEsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDO1FBRTdELE1BQU0sZUFBZSxHQUNuQixNQUFNLHFCQUFxQixDQUFDLDZCQUE2QixDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDOUUsVUFBVSxDQUFDLElBQUksQ0FDYixHQUFHO1lBQ0QsTUFBTSwrQkFBK0IsQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDO1lBQzdELE1BQU0sNkJBQTZCLENBQUMsTUFBTSxDQUFDLGdCQUFnQixDQUFDO1NBQzdELENBQ0YsQ0FBQztRQUVGLElBQUksTUFBTSxDQUFDLGdCQUFnQixFQUFFLE1BQU0sRUFBRSxDQUFDO1lBQ3BDLE1BQU0sa0JBQWtCLEdBQUcsTUFBTSxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FDdkQsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUMscUNBQXFDLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FDbEUsQ0FBQztZQUNGLEtBQUssTUFBTSxlQUFlLElBQUksa0JBQWtCLEVBQUUsQ0FBQztnQkFDakQsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLElBQUksQ0FBQyxlQUFlLENBQUMsS0FBSyxFQUFFLENBQUM7b0JBQ25ELE1BQU0sSUFBSSxLQUFLLENBQUMsNkNBQTZDLENBQUMsQ0FBQztnQkFDakUsQ0FBQztnQkFDRCxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksU0FBUyxDQUFDLGVBQWUsQ0FBQyxHQUFHLEVBQUUsS0FBSyxFQUFFLGVBQWUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1lBQ3BGLENBQUM7UUFDSCxDQUFDO1FBRUQsTUFBTSx1QkFBdUIsR0FBZ0M7WUFDM0QsWUFBWSxFQUFFLGtCQUFrQixDQUFDLG9CQUFvQixFQUFFLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUNwRSxNQUFNLEVBQUUsa0JBQWtCLENBQUMsc0JBQXNCLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQztZQUNoRSxPQUFPLEVBQUUsa0JBQWtCLENBQUMsc0JBQXNCLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztZQUNsRSxTQUFTLEVBQUUsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLFdBQVcsQ0FBQyxFQUFFLHVEQUF1RDtZQUN0RyxRQUFRLEVBQUUsTUFBTSxDQUFDLFFBQVE7WUFDekIsU0FBUyxFQUFFLGdCQUFnQjtZQUMzQixVQUFVLEVBQUUsZ0JBQWdCO1lBQzVCLGdCQUFnQjtZQUNoQixVQUFVO1NBQ1gsQ0FBQztRQUVGLE1BQU0sSUFBSSxHQUFHLE1BQU0sd0JBQXdCLENBQUMsTUFBTSxDQUFDLHVCQUF1QixDQUFDLENBQUM7UUFFNUUsT0FBTyxJQUFJLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzlCLENBQUM7SUFFRDs7OztPQUlHO0lBQ0gsTUFBTSxDQUFDLFlBQVksQ0FBQyxrQkFBc0M7UUFDeEQsTUFBTSxTQUFTLEdBQUcsb0JBQW9CLENBQUMsWUFBWSxDQUFDLGtCQUFrQixDQUFDLENBQUM7UUFDeEUsT0FBTyxjQUFjLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxTQUFTLEVBQUUsSUFBSSxFQUFFLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDaEYsQ0FBQztJQUVEOzs7O09BSUc7SUFDSCxNQUFNLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxNQUF5QjtRQUNoRCxNQUFNLElBQUksR0FBRyxNQUFNLG9CQUFvQixDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM5RCxNQUFNLGdCQUFnQixHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsU0FBeUIsQ0FBQztRQUNsRSxnQkFBZ0IsQ0FBQyxJQUFJLEdBQUcsRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLENBQUM7UUFFNUMsTUFBTSxVQUFVLEdBQWdCLEVBQUUsQ0FBQztRQUVuQyxJQUFJLGdCQUFnQixDQUFDLFVBQVUsS0FBSyxPQUFPLElBQUksTUFBTSxDQUFDLFFBQVEsRUFBRSxNQUFNLEVBQUUsQ0FBQztZQUN2RSxNQUFNLFlBQVksR0FBcUIsTUFBTSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQUM7Z0JBQ3ZFLElBQUksRUFBRSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQW9CO2dCQUM5RCxLQUFLLEVBQUUsT0FBTzthQUNmLENBQUMsQ0FBQyxDQUFDO1lBQ0osVUFBVSxDQUFDLElBQUksQ0FBQyxJQUFJLCtCQUErQixDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUM7UUFDckUsQ0FBQztRQUVELElBQUksTUFBTSxDQUFDLGdCQUFnQixFQUFFLE1BQU0sRUFBRSxDQUFDO1lBQ3BDLEtBQUssTUFBTSxlQUFlLElBQUksTUFBTSxDQUFDLGdCQUFnQixFQUFFLENBQUM7Z0JBQ3RELElBQUksQ0FBQyxlQUFlLENBQUMsR0FBRyxJQUFJLENBQUMsZUFBZSxDQUFDLEtBQUssRUFBRSxDQUFDO29CQUNuRCxNQUFNLElBQUksS0FBSyxDQUFDLDJDQUEyQyxDQUFDLENBQUM7Z0JBQy9ELENBQUM7Z0JBQ0QsVUFBVSxDQUFDLElBQUksQ0FBQyxJQUFJLFNBQVMsQ0FBQyxlQUFlLENBQUMsR0FBRyxFQUFFLEtBQUssRUFBRSxlQUFlLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztZQUNwRixDQUFDO1FBQ0gsQ0FBQztRQUVELE1BQU0sZUFBZSxHQUF5QztZQUM1RCxJQUFJLEVBQUUsa0JBQWtCLENBQUMsc0JBQXNCLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztZQUMvRCxJQUFJO1lBQ0osZ0JBQWdCO1lBQ2hCLFVBQVU7U0FDWCxDQUFDO1FBRUYsTUFBTSxHQUFHLEdBQUcsTUFBTSxpQ0FBaUMsQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLENBQUM7UUFFNUUsT0FBTyxHQUFHLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzdCLENBQUM7SUFFRDs7OztPQUlHO0lBQ0gsb0JBQW9CLENBQUMsT0FBdUI7UUFDMUMsTUFBTSxJQUFJLEdBQUcsSUFBSSxlQUFlLENBQUMsT0FBTyxDQUFDLENBQUM7UUFFMUMsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNqQyxPQUFPLE9BQU8sQ0FBQyxPQUFPLENBQUMsRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztRQUM3QyxDQUFDO1FBRUQsT0FBTyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQ3hELENBQUM7SUFFRDs7OztPQUlHO0lBQ0gsTUFBTSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsT0FBdUI7UUFDNUMsTUFBTSxJQUFJLEdBQUcsSUFBSSxlQUFlLENBQUMsT0FBTyxDQUFDLENBQUM7UUFFMUMsTUFBTSxTQUFTLEdBQUcsTUFBTSxjQUFjLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FDckQsTUFBTSxFQUNOLElBQUksQ0FBQyxTQUFTLENBQUMsT0FBTyxFQUN0QixNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxrQkFBa0IsRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxFQUNoRSxJQUFJLEVBQ0osQ0FBQyxRQUFRLENBQUMsQ0FDWCxDQUFDO1FBRUYsTUFBTSx5QkFBeUIsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FDcEQsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLEdBQUcsWUFBWSwrQkFBK0IsQ0FDVCxDQUFDO1FBQ2pELE1BQU0sc0JBQXNCLEdBQUcseUJBQXlCLEVBQUUsS0FBSyxDQUFDO1FBRWhFLE1BQU0sdUJBQXVCLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQ2xELENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxHQUFHLFlBQVksNkJBQTZCLENBQ1QsQ0FBQztRQUMvQyxNQUFNLG9CQUFvQixHQUFHLHVCQUF1QixFQUFFLEtBQUssQ0FBQztRQUU1RCxPQUFPO1lBQ0wsZUFBZSxFQUFFLElBQUksQ0FBQyxZQUFZO1lBQ2xDLFNBQVM7WUFDVCxPQUFPLEVBQUUsSUFBSSxDQUFDLE9BQU87WUFDckIsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNO1lBQ25CLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUztZQUN6QixRQUFRLEVBQUUsSUFBSSxDQUFDLFFBQVE7WUFDdkIsUUFBUSxFQUFFLG9CQUFvQixDQUFDLDZCQUE2QixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUM7WUFDN0Usc0JBQXNCO1lBQ3RCLG9CQUFvQjtZQUNwQixVQUFVLEVBQUUsSUFBSSxDQUFDLFVBQVU7aUJBQ3hCLE1BQU0sQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsR0FBRyxDQUFDLElBQUksS0FBSyxLQUFLLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO2lCQUM5RCxHQUFHLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUM7Z0JBQ2IsR0FBRyxFQUFFLEdBQUcsQ0FBQyxJQUFJO2dCQUNiLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUM7YUFDOUIsQ0FBQyxDQUFDO1NBQ04sQ0FBQztJQUNKLENBQUM7SUFFRDs7OztPQUlHO0lBQ0gsTUFBTSxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFjO1FBQzFDLE1BQU0sR0FBRyxHQUFHLElBQUksd0JBQXdCLENBQUMsTUFBTSxDQUFDLENBQUM7UUFFakQsTUFBTSxPQUFPLEdBQUcsTUFBTSxHQUFHLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDbkMsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2IsTUFBTSxJQUFJLEtBQUssQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDO1FBQ3ZELENBQUM7UUFFRCxNQUFNLFNBQVMsR0FBRyxNQUFNLGNBQWMsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUNyRCxNQUFNLEVBQ04sR0FBRyxDQUFDLFNBQVMsQ0FBQyxPQUFPLEVBQ3JCLE1BQU0sQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLGtCQUFrQixFQUFFLEdBQUcsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLEVBQzlELElBQUksRUFDSixDQUFDLFFBQVEsQ0FBQyxDQUNYLENBQUM7UUFFRixNQUFNLFNBQVMsR0FBYztZQUMzQixPQUFPLEVBQUUsR0FBRyxDQUFDLE9BQU87WUFDcEIsU0FBUztZQUNULFFBQVEsRUFBRSxvQkFBb0IsQ0FBQyw2QkFBNkIsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDO1lBQzVFLFVBQVUsRUFBRSxHQUFHLENBQUMsVUFBVTtpQkFDdkIsTUFBTSxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxHQUFHLENBQUMsSUFBSSxLQUFLLEtBQUssQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLENBQUM7aUJBQzlELEdBQUcsQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQztnQkFDYixHQUFHLEVBQUUsR0FBRyxDQUFDLElBQUk7Z0JBQ2IsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQzthQUM5QixDQUFDLENBQUM7U0FDTixDQUFDO1FBRUYsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQztJQUVPLE1BQU0sQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLEVBQUUsVUFBVSxFQUFFLFNBQVMsRUFBbUI7UUFJM0UsTUFBTSxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUM7WUFDMUMsT0FBTyxTQUFTLEtBQUssUUFBUTtnQkFDM0IsQ0FBQyxDQUFDLHFCQUFxQixDQUFDLGtCQUFrQixDQUFDLFNBQVMsQ0FBQztnQkFDckQsQ0FBQyxDQUFDLFNBQVM7WUFDYixPQUFPLFVBQVUsS0FBSyxRQUFRO2dCQUM1QixDQUFDLENBQUMscUJBQXFCLENBQUMsbUJBQW1CLENBQUMsVUFBVSxDQUFDO2dCQUN2RCxDQUFDLENBQUMsVUFBVTtTQUNmLENBQUMsQ0FBQztRQUVILE1BQU0sQ0FBQyxTQUFTLENBQ2QsTUFBTSxDQUFDLFNBQVMsRUFDaEIsT0FBTyxDQUFDLFNBQVMsRUFDakIsNENBQTRDLENBQzdDLENBQUM7UUFFRixPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsT0FBTyxFQUFFLENBQUM7SUFDcEQsQ0FBQztJQUVPLE1BQU0sQ0FBQyxZQUFZLENBQUMsa0JBQTBCO1FBQ3BELFFBQVEsa0JBQWtCLEVBQUUsQ0FBQztZQUMzQixLQUFLLHFCQUFxQjtnQkFDeEIsT0FBTztvQkFDTCxJQUFJLEVBQUUsbUJBQW1CO29CQUN6QixJQUFJLEVBQUUsU0FBUztvQkFDZixjQUFjLEVBQUUsSUFBSSxVQUFVLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsUUFBUTtvQkFDbkQsYUFBYSxFQUFFLElBQUk7aUJBQ3BCLENBQUM7WUFDSixLQUFLLG9CQUFvQjtnQkFDdkIsT0FBTztvQkFDTCxJQUFJLEVBQUUsT0FBTztvQkFDYixVQUFVLEVBQUUsT0FBTztpQkFDcEIsQ0FBQztZQUNKLEtBQUssd0JBQXdCO2dCQUMzQixPQUFPO29CQUNMLElBQUksRUFBRSxPQUFPO29CQUNiLFVBQVUsRUFBRSxPQUFPO2lCQUNwQixDQUFDO1lBQ0o7Z0JBQ0UsTUFBTSxJQUFJLEtBQUssQ0FBQyxvQ0FBb0Msa0JBQWtCLEVBQUUsQ0FBQyxDQUFDO1FBQzlFLENBQUM7SUFDSCxDQUFDO0lBRU8sTUFBTSxDQUFDLDZCQUE2QixDQUFDLFVBQXVCO1FBQ2xFLE1BQU0saUJBQWlCLEdBQUcsVUFBVSxDQUFDLElBQUksQ0FDdkMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLEdBQUcsQ0FBQyxJQUFJLEtBQUssS0FBSyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsQ0FDUixDQUFDO1FBQ2pELElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1lBQ3ZCLE9BQU87UUFDVCxDQUFDO1FBRUQsTUFBTSxRQUFRLEdBQUcsaUJBQWlCLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN6RSxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDO0NBQ0YifQ==