app-builder-lib 27.0.0-alpha.1 → 27.0.0-alpha.3

package/dist/Framework.d.ts

@@ -4,6 +4,7 @@ import { AfterPackContext } from "./configuration.js";
 import { Platform } from "./core.js";
 import { ElectronPlatformName } from "./electron/ElectronFramework.js";
 import type { PlatformPackager } from "./platformPackager.js";
+import type { PlatformType } from "./targets/mac/MacTargetHelper.js";
 export interface Framework {
     readonly name: string;
     readonly version: string;
@@ -25,6 +26,7 @@ export interface BeforeCopyExtraFilesOptions {
     appOutDir: string;
     asarIntegrity: AsarIntegrity | null;
     platformName: string;
+    platformType?: PlatformType;
 }
 export interface PrepareApplicationStageDirectoryOptions {
     readonly packager: PlatformPackager<any>;

package/dist/Framework.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Framework.d.ts","sourceRoot":"","sources":["../src/Framework.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAE7D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IAEnC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;IAEtC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAA;IAErC,cAAc,CAAC,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAA;IAElD,WAAW,CAAC,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAA;IAE/C,uBAAuB,CAAC,CAAC,QAAQ,EAAE,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;IAElE,gCAAgC,CAAC,OAAO,EAAE,uCAAuC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAEhG,oBAAoB,CAAC,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAEzE,SAAS,CAAC,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAEnD,iBAAiB,CAAC,IAAI,eAAe,GAAG,IAAI,CAAA;CAC7C;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC/B,SAAS,EAAE,MAAM,CAAA;IAEjB,aAAa,EAAE,aAAa,GAAG,IAAI,CAAA;IAGnC,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACxC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAA;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAE7D"}
+{"version":3,"file":"Framework.d.ts","sourceRoot":"","sources":["../src/Framework.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAA;AAEpE,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IAEnC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;IAEtC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAA;IAErC,cAAc,CAAC,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAA;IAElD,WAAW,CAAC,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAA;IAE/C,uBAAuB,CAAC,CAAC,QAAQ,EAAE,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;IAElE,gCAAgC,CAAC,OAAO,EAAE,uCAAuC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAEhG,oBAAoB,CAAC,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAEzE,SAAS,CAAC,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAEnD,iBAAiB,CAAC,IAAI,eAAe,GAAG,IAAI,CAAA;CAC7C;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC/B,SAAS,EAAE,MAAM,CAAA;IAEjB,aAAa,EAAE,aAAa,GAAG,IAAI,CAAA;IAGnC,YAAY,EAAE,MAAM,CAAA;IAIpB,YAAY,CAAC,EAAE,YAAY,CAAA;CAC5B;AAED,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACxC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAA;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAE7D"}

package/dist/Framework.js.map

@@ -1 +1 @@
-{"version":3,"file":"Framework.js","sourceRoot":"","sources":["../src/Framework.ts"],"names":[],"mappings":"AAsDA,MAAM,UAAU,eAAe,CAAC,SAAoB;IAClD,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU,CAAA;AACtC,CAAC","sourcesContent":["import { FileTransformer } from \"builder-util\"\nimport { AsarIntegrity } from \"./asar/integrity.js\"\nimport { AfterPackContext } from \"./configuration.js\"\nimport { Platform } from \"./core.js\"\nimport { ElectronPlatformName } from \"./electron/ElectronFramework.js\"\nimport type { PlatformPackager } from \"./platformPackager.js\"\n\nexport interface Framework {\n  readonly name: string\n  readonly version: string\n  readonly distMacOsAppName: string\n  readonly macOsDefaultTargets: Array<string>\n  readonly defaultAppIdPrefix: string\n\n  readonly isNpmRebuildRequired: boolean\n\n  readonly isCopyElevateHelper: boolean\n\n  getDefaultIcon?(platform: Platform): string | null\n\n  getMainFile?(platform: Platform): string | null\n\n  getExcludedDependencies?(platform: Platform): Array<string> | null\n\n  prepareApplicationStageDirectory(options: PrepareApplicationStageDirectoryOptions): Promise<any>\n\n  beforeCopyExtraFiles?(options: BeforeCopyExtraFilesOptions): Promise<any>\n\n  afterPack?(context: AfterPackContext): Promise<any>\n\n  createTransformer?(): FileTransformer | null\n}\n\nexport interface BeforeCopyExtraFilesOptions {\n  packager: PlatformPackager<any>\n  appOutDir: string\n\n  asarIntegrity: AsarIntegrity | null\n\n  // ElectronPlatformName\n  platformName: string\n}\n\nexport interface PrepareApplicationStageDirectoryOptions {\n  readonly packager: PlatformPackager<any>\n  /**\n   * Platform doesn't process application output directory in any way. Unpack implementation must create or empty dir if need.\n   */\n  readonly appOutDir: string\n  readonly platformName: ElectronPlatformName\n  readonly arch: string\n  readonly version: string\n}\n\nexport function isElectronBased(framework: Framework): boolean {\n  return framework.name === \"electron\"\n}\n"]}
+{"version":3,"file":"Framework.js","sourceRoot":"","sources":["../src/Framework.ts"],"names":[],"mappings":"AA2DA,MAAM,UAAU,eAAe,CAAC,SAAoB;IAClD,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU,CAAA;AACtC,CAAC","sourcesContent":["import { FileTransformer } from \"builder-util\"\nimport { AsarIntegrity } from \"./asar/integrity.js\"\nimport { AfterPackContext } from \"./configuration.js\"\nimport { Platform } from \"./core.js\"\nimport { ElectronPlatformName } from \"./electron/ElectronFramework.js\"\nimport type { PlatformPackager } from \"./platformPackager.js\"\nimport type { PlatformType } from \"./targets/mac/MacTargetHelper.js\"\n\nexport interface Framework {\n  readonly name: string\n  readonly version: string\n  readonly distMacOsAppName: string\n  readonly macOsDefaultTargets: Array<string>\n  readonly defaultAppIdPrefix: string\n\n  readonly isNpmRebuildRequired: boolean\n\n  readonly isCopyElevateHelper: boolean\n\n  getDefaultIcon?(platform: Platform): string | null\n\n  getMainFile?(platform: Platform): string | null\n\n  getExcludedDependencies?(platform: Platform): Array<string> | null\n\n  prepareApplicationStageDirectory(options: PrepareApplicationStageDirectoryOptions): Promise<any>\n\n  beforeCopyExtraFiles?(options: BeforeCopyExtraFilesOptions): Promise<any>\n\n  afterPack?(context: AfterPackContext): Promise<any>\n\n  createTransformer?(): FileTransformer | null\n}\n\nexport interface BeforeCopyExtraFilesOptions {\n  packager: PlatformPackager<any>\n  appOutDir: string\n\n  asarIntegrity: AsarIntegrity | null\n\n  // ElectronPlatformName\n  platformName: string\n\n  // macOS-only: the authoritative 3-way build flavor (\"mac\" | \"mas\" | \"mas-dev\").\n  // Distinct from `platformName`, which collapses mas/mas-dev to \"mas\".\n  platformType?: PlatformType\n}\n\nexport interface PrepareApplicationStageDirectoryOptions {\n  readonly packager: PlatformPackager<any>\n  /**\n   * Platform doesn't process application output directory in any way. Unpack implementation must create or empty dir if need.\n   */\n  readonly appOutDir: string\n  readonly platformName: ElectronPlatformName\n  readonly arch: string\n  readonly version: string\n}\n\nexport function isElectronBased(framework: Framework): boolean {\n  return framework.name === \"electron\"\n}\n"]}

package/dist/asar/asarFileChecker.d.ts

@@ -1,3 +1,5 @@
-import type { FilesystemEntry } from "@electron/asar/lib/filesystem";
-export declare function checkFileInArchive(asarFile: string, relativeFile: string, messagePrefix: string): Promise<FilesystemEntry>;
+import * as asar from "@electron/asar";
+type FilesystemEntry = ReturnType<typeof asar.statFile>;
+export declare function checkFileInArchive(asarFile: string, relativeFile: string, messagePrefix: string): FilesystemEntry;
+export {};
 //# sourceMappingURL=asarFileChecker.d.ts.map

package/dist/asar/asarFileChecker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asarFileChecker.d.ts","sourceRoot":"","sources":["../../src/asar/asarFileChecker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAuB,MAAM,+BAA+B,CAAA;AAGzF,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAkBhI"}
+{"version":3,"file":"asarFileChecker.d.ts","sourceRoot":"","sources":["../../src/asar/asarFileChecker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,gBAAgB,CAAA;AAGtC,KAAK,eAAe,GAAG,UAAU,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAA;AAGvD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,eAAe,CAiBjH"}

package/dist/asar/asarFileChecker.js

@@ -1,6 +1,5 @@
-import { dynamicImport } from "../util/dynamicImport.js";
-export async function checkFileInArchive(asarFile, relativeFile, messagePrefix) {
-    const asar = await dynamicImport("@electron/asar");
+import * as asar from "@electron/asar";
+export function checkFileInArchive(asarFile, relativeFile, messagePrefix) {
     function error(text) {
         return new Error(`${messagePrefix} "${relativeFile}" in the "${asarFile}" ${text}`);
     }

package/dist/asar/asarFileChecker.js.map

@@ -1 +1 @@
-{"version":3,"file":"asarFileChecker.js","sourceRoot":"","sources":["../../src/asar/asarFileChecker.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAExD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,YAAoB,EAAE,aAAqB;IACpG,MAAM,IAAI,GAAG,MAAM,aAAa,CAAkC,gBAAgB,CAAC,CAAA;IACnF,SAAS,KAAK,CAAC,IAAY;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,aAAa,KAAK,YAAY,aAAa,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,IAAqB,CAAA;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,sDAAsD,CAAC,EAAE,CAAC;YAC/E,MAAM,KAAK,CAAC,mDAAmD,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA;IACnC,CAAC;IACD,IAAK,IAA4B,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["import type { FilesystemEntry, FilesystemFileEntry } from \"@electron/asar/lib/filesystem\"\nimport { dynamicImport } from \"../util/dynamicImport.js\"\n\nexport async function checkFileInArchive(asarFile: string, relativeFile: string, messagePrefix: string): Promise<FilesystemEntry> {\n  const asar = await dynamicImport<typeof import(\"@electron/asar\")>(\"@electron/asar\")\n  function error(text: string) {\n    return new Error(`${messagePrefix} \"${relativeFile}\" in the \"${asarFile}\" ${text}`)\n  }\n  let stat: FilesystemEntry\n  try {\n    stat = asar.statFile(asarFile, relativeFile, false)\n  } catch (e: any) {\n    if (e.message.includes(\"Cannot read properties of undefined (reading 'link')\")) {\n      throw error(\"does not exist. Seems like a wrong configuration.\")\n    }\n    throw error(`is corrupted: ${e}`)\n  }\n  if ((stat as FilesystemFileEntry).size === 0) {\n    throw error(`is corrupted: size 0`)\n  }\n  return stat\n}\n"]}
+{"version":3,"file":"asarFileChecker.js","sourceRoot":"","sources":["../../src/asar/asarFileChecker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,gBAAgB,CAAA;AAMtC,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,YAAoB,EAAE,aAAqB;IAC9F,SAAS,KAAK,CAAC,IAAY;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,aAAa,KAAK,YAAY,aAAa,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,IAAqB,CAAA;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,sDAAsD,CAAC,EAAE,CAAC;YAC/E,MAAM,KAAK,CAAC,mDAAmD,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA;IACnC,CAAC;IACD,IAAK,IAA4B,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["import * as asar from \"@electron/asar\"\n\n// @electron/asar v4 no longer exports its filesystem entry types from the package root, so derive them from `statFile`'s return type.\ntype FilesystemEntry = ReturnType<typeof asar.statFile>\ntype FilesystemFileEntry = Extract<FilesystemEntry, { size: number }>\n\nexport function checkFileInArchive(asarFile: string, relativeFile: string, messagePrefix: string): FilesystemEntry {\n  function error(text: string) {\n    return new Error(`${messagePrefix} \"${relativeFile}\" in the \"${asarFile}\" ${text}`)\n  }\n  let stat: FilesystemEntry\n  try {\n    stat = asar.statFile(asarFile, relativeFile, false)\n  } catch (e: any) {\n    if (e.message.includes(\"Cannot read properties of undefined (reading 'link')\")) {\n      throw error(\"does not exist. Seems like a wrong configuration.\")\n    }\n    throw error(`is corrupted: ${e}`)\n  }\n  if ((stat as FilesystemFileEntry).size === 0) {\n    throw error(`is corrupted: size 0`)\n  }\n  return stat\n}\n"]}

package/dist/codeSign/certInfo.d.ts

@@ -41,6 +41,20 @@ export declare function readCertInfo(file: string, password: string): Promise<{
     commonName: string;
     bloodyMicrosoftSubjectDn: string;
 }>;
+/**
+ * Reads certificate info from a plain X.509 certificate file (.crt / .cer).
+ * Accepts both PEM (base64 with -----BEGIN CERTIFICATE----- headers) and DER (raw binary) encoding.
+ *
+ * Unlike `readCertInfo`, this does not require a password and does not parse PKCS#12.
+ * Used when HSM mode supplies a public-cert-only file alongside /csp + /kc or pkcs11Module.
+ *
+ * Returns `null` when the publisher name cannot be determined (e.g. no CN attribute), so
+ * callers should fall back to requiring an explicit `publisherName` in that case.
+ */
+export declare function readCertInfoFromX509(file: string): Promise<{
+    commonName: string;
+    bloodyMicrosoftSubjectDn: string;
+} | null>;
 /**
  * Internal functions exported exclusively for unit testing.
  * Not part of the public API — do not use outside of test files.

package/dist/codeSign/certInfo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"certInfo.d.ts","sourceRoot":"","sources":["../../src/codeSign/certInfo.ts"],"names":[],"mappings":"AAwHA;;;;;;;;;GASG;AACH,iBAAS,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CA0E3F;AAqBD;;;;;;GAMG;AACH,iBAAS,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAqElH;AAED;;;;GAIG;AACH,iBAAS,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CASvD;AAyCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,wBAAwB,EAAE,MAAM,CAAA;CAAE,CAAC,CAuIpI;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY;;;;;CAKxB,CAAA"}
+{"version":3,"file":"certInfo.d.ts","sourceRoot":"","sources":["../../src/codeSign/certInfo.ts"],"names":[],"mappings":"AAwHA;;;;;;;;;GASG;AACH,iBAAS,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CA0E3F;AAqBD;;;;;;GAMG;AACH,iBAAS,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAqElH;AAED;;;;GAIG;AACH,iBAAS,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CASvD;AAyCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,wBAAwB,EAAE,MAAM,CAAA;CAAE,CAAC,CAuIpI;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,wBAAwB,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAyCjI;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY;;;;;CAKxB,CAAA"}

package/dist/codeSign/certInfo.js

@@ -446,6 +446,55 @@ export async function readCertInfo(file, password) {
         .join(",");
     return { commonName, bloodyMicrosoftSubjectDn };
 }
+/**
+ * Reads certificate info from a plain X.509 certificate file (.crt / .cer).
+ * Accepts both PEM (base64 with -----BEGIN CERTIFICATE----- headers) and DER (raw binary) encoding.
+ *
+ * Unlike `readCertInfo`, this does not require a password and does not parse PKCS#12.
+ * Used when HSM mode supplies a public-cert-only file alongside /csp + /kc or pkcs11Module.
+ *
+ * Returns `null` when the publisher name cannot be determined (e.g. no CN attribute), so
+ * callers should fall back to requiring an explicit `publisherName` in that case.
+ */
+export async function readCertInfoFromX509(file) {
+    const raw = await readFile(file);
+    // Support PEM (ASCII armor) and DER (raw binary) encoding.
+    let derBytes;
+    const pemContent = raw.toString("ascii");
+    if (pemContent.includes("-----BEGIN CERTIFICATE-----")) {
+        const b64 = pemContent
+            .replace(/-----BEGIN CERTIFICATE-----/g, "")
+            .replace(/-----END CERTIFICATE-----/g, "")
+            .replace(/\s+/g, "");
+        derBytes = Buffer.from(b64, "base64");
+    }
+    else {
+        derBytes = raw;
+    }
+    let cert;
+    try {
+        const asn1Result = asn1js.fromBER(toArrayBuffer(derBytes));
+        if (asn1Result.offset === -1) {
+            throw new Error("offset -1: invalid BER encoding");
+        }
+        cert = new pkijs.Certificate({ schema: asn1Result.result });
+    }
+    catch (err) {
+        throw new Error(`X.509 certificate file "${file}" could not be parsed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const cnAttr = cert.subject.typesAndValues.find(a => a.type === "2.5.4.3");
+    if (cnAttr == null) {
+        return null;
+    }
+    const commonName = String(cnAttr.value.valueBlock.value);
+    const bloodyMicrosoftSubjectDn = cert.subject.typesAndValues
+        .map(a => {
+        const typeName = ATTRIBUTE_TYPE_NAMES[a.type] ?? a.type;
+        return `${typeName}=${escapeDnValue(String(a.value.valueBlock.value))}`;
+    })
+        .join(",");
+    return { commonName, bloodyMicrosoftSubjectDn };
+}
 /**
  * Internal functions exported exclusively for unit testing.
  * Not part of the public API — do not use outside of test files.

package/dist/codeSign/certInfo.js.map

@@ -1 +1 @@
-{"version":3,"file":"certInfo.js","sourceRoot":"","sources":["../../src/codeSign/certInfo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACrD,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAChC,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAC9B,OAAO,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAE9D,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAA;AAE7B,yCAAyC;AACzC,MAAM,gBAAgB,GAAG,mBAAmB,CAAA;AAE5C,2CAA2C;AAC3C,MAAM,YAAY,GAAG,4BAA4B,CAAA;AAEjD,wDAAwD;AACxD,iFAAiF;AACjF,yEAAyE;AACzE,MAAM,oBAAoB,GAA2B;IACnD,SAAS,EAAE,GAAG;IACd,UAAU,EAAE,GAAG;IACf,UAAU,EAAE,IAAI;IAChB,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,GAAG;IACd,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,QAAQ;IACnB,UAAU,EAAE,YAAY;CACzB,CAAA;AAED,wFAAwF;AACxF,MAAM,iBAAiB,GAAG,YAAY,CAAA;AAEtC,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,mFAAmF;QACnF,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAA;IACzC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,4FAA4F;AAC5F,uFAAuF;AACvF,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAA;AAC3C,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,cAAqB,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAQ,CAAC,CAAA;AAE9I,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,EAAE,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC1C,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC3B,OAAO,EAAE,CAAA;AACX,CAAC;AAED,8EAA8E;AAC9E,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,2EAA2E;AAC3E,0EAA0E;AAC1E,oEAAoE;AACpE,yEAAyE;AACzE,yCAAyC;AAEzC,+EAA+E;AAE/E,uCAAuC;AACvC,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC;IAClC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CAC/I,CAAC,CAAA;AAEF,qEAAqE;AACrE,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAU,CAAA;AAErC;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,aAAqB;IACtD,0EAA0E;IAC1E,4EAA4E;IAC5E,+EAA+E;IAC/E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,IAAI,aAAa,GAAG,IAAI,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,oEAAoE,aAAa,EAAE,CAAC,CAAA;IACtG,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAA;IACpB,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAA;IACvC,8EAA8E;IAC9E,sDAAsD;IACtD,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAA;IACtC,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;IACf,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IAClD,CAAC;IACD,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,GAAG,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAC1C,CAAC;IACD,MAAM,CAAC,GAAa,IAAI,KAAK,CAAC,EAAE,CAAC,CAAA;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,sDAAsD;AACtD,SAAS,KAAK,CAAC,IAAY,EAAE,IAAY;IACvC,OAAO,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAA;AACrE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,EAAU,EAAE,IAAY,EAAE,aAAqB;IACjF,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,MAAM,0DAA0D,CAAC,CAAA;IAC5H,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,kDAAkD,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAChF,CAAC;IACD,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA,CAAC,sCAAsC;IAEnE,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAA;QAC5C,4DAA4D;QAC5D,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAA;QAE9I,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,CAAC,GAAG,EAAE,CAAA;QAEV,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC9B,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;gBACzB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAA;gBACvF,CAAC,EAAE,CAAA;YACL,CAAC;QACH,CAAC,CAAA;QAED,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,MAAM,CAAA;YACjD,CAAC;QACH,CAAC,CAAA;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAA;QACR,CAAC;QACD,KAAK,EAAE,CAAA;QACP,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAA;QACR,CAAC;QACD,KAAK,EAAE,CAAA;QACP,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAA;QACR,CAAC;QAED,gEAAgE;QAChE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACjD,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QACzD,CAAC;QACD,gDAAgD;QAChD,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IAED,qCAAqC;IACrC,iFAAiF;IACjF,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAClC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,2DAA2D,CAAC,CAAA;IAC9J,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAA;QACnH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;AAC7C,CAAC;AAED,2EAA2E;AAC3E,MAAM,gBAAgB,GAAwF;IAC5G,yBAAyB,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,gCAAgC;IAC7G,yBAAyB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,iCAAiC;IAC7G,yBAAyB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,4BAA4B;IAClH,yBAAyB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,4BAA4B;CACjH,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,yBAAyB,GAAG,OAAO,CAAA;AAEzC;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,QAAgB,EAAE,IAAY,EAAE,UAAkB,EAAE,EAAU,EAAE,MAAc;IACxG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,yBAAyB,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CACb,+BAA+B,UAAU,8BAA8B,yBAAyB,iEAAiE,CAClK,CAAA;IACH,CAAC;IACD,sFAAsF;IACtF,sEAAsE;IACtE,MAAM,cAAc,GAAG,IAAI,CAAA;IAC3B,IAAI,IAAI,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,MAAM,gCAAgC,cAAc,oDAAoD,CAAC,CAAA;IAC3J,CAAC;IAED,MAAM,CAAC,GAAG,EAAE,CAAA,CAAC,qBAAqB;IAClC,MAAM,CAAC,GAAG,EAAE,CAAA,CAAC,oBAAoB;IAEjC,uCAAuC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAE7B,0EAA0E;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACjE,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC9B,CAAC;IAED,kFAAkF;IAClF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACzE,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;IACtC,CAAC;IAED,mDAAmD;IACnD,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAE/C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,sCAAsC;QACtC,IAAI,EAAE,GAAW,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;QAC7E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;QAC7C,CAAC;QACD,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QAEtB,4CAA4C;QAC5C,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAClB,CAAC;QAED,wEAAwE;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,IAAI,KAAK,GAAG,CAAC,CAAA;YACb,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACrB,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;oBACnB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAA;oBACjC,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,IAAI,CAAA;oBACnB,KAAK,GAAG,GAAG,IAAI,CAAC,CAAA;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACnC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;QAC/B,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAC9B,CAAC;IACD,4EAA4E;IAC5E,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,KAAa,EAAE,SAAc,EAAE,UAAe,EAAE,QAAgB;IAC9F,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAEpC,yEAAyE;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;IAC/E,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;IAE5E,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAC1E,MAAM,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAExE,kEAAkE;IAClE,iFAAiF;IACjF,IAAI,QAAgB,CAAA;IACpB,IAAI,UAAU,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;QACtC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAE,UAAU,CAAC,UAAU,CAAC,KAAe,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAC1H,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;IAC5D,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACzB,4EAA4E;QAC5E,6EAA6E;QAC7E,mCAAmC;QACnC,OAAO,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;AACrE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IAC/D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IAEnC,sCAAsC;IACtC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,IAAuC,CAAA;IAC3C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAChI,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IAClD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;IAE3D,yFAAyF;IACzF,8EAA8E;IAC9E,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,mBAAmB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;QAClC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACpH,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,0DAA0D,MAAM,EAAE,CAAC,CAAA;QACrI,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,0EAA0E,CAAC,CAAA;QAC9G,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,6FAA6F,MAAM,EAAE,CAAC,CAAA;IAC9J,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAA;IACnD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,GAAG,CAAC,CAAA;IAChF,CAAC;IAED,yFAAyF;IACzF,EAAE;IACF,0FAA0F;IAC1F,uFAAuF;IACvF,4FAA4F;IAC5F,0FAA0F;IAC1F,MAAM,KAAK,GAAwB,EAAE,CAAA;IAErC,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACvC,IAAI,OAAoB,CAAA;QAExB,IAAI,EAAE,CAAC,WAAW,KAAK,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACjD,wEAAwE;YACxE,OAAO,GAAI,EAAE,CAAC,OAA8B,CAAC,QAAQ,EAAE,CAAA;QACzD,CAAC;aAAM,IAAI,EAAE,CAAC,WAAW,KAAK,KAAK,CAAC,4BAA4B,EAAE,CAAC;YACjE,qEAAqE;YACrE,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;YAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,oBAAoB,CAAC,0BAA0B,CAAC,WAAW,CAAA;YAEjF,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC;gBAClE,yEAAyE;gBACzE,MAAM,SAAS,GAAG,sBAAsB,CACtC,KAAK,EACL,OAAO,CAAC,oBAAoB,CAAC,0BAA0B,CAAC,eAAe,EACvE,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,EAC7C,QAAQ,CACT,CAAA;gBACD,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;YACpC,CAAC;iBAAM,CAAC;gBACN,4DAA4D;gBAC5D,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;YACtD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,SAAQ;QACV,CAAC;QAED,oEAAoE;QACpE,MAAM,EAAE,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC9C,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,QAAyB,CAAA;gBAC7C,IAAI,OAAO,CAAC,WAAW,YAAY,KAAK,CAAC,WAAW,EAAE,CAAC;oBACrD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;gBACjC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,gDAAgD,CAAC,CAAA;IACjH,CAAC;IAED,gEAAgE;IAChE,4FAA4F;IAC5F,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc,CAAC,CAAA;QAC5E,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,YAAY,KAAK,CAAC,WAAW,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAClE,CAAC;QACD,4DAA4D;QAC5D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;YACtE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAA;YACd,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;YAC3D,OAAO,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,wDAAwD,IAAI,OAAO,KAAK,CAAC,MAAM,4EAA4E;YACzJ,uFAAuF,CAC1F,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;IACjF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IAE/D,mEAAmE;IACnE,sFAAsF;IACtF,yFAAyF;IACzF,kEAAkE;IAClE,MAAM,wBAAwB,GAAG,WAAW,CAAC,OAAO,CAAC,cAAc;SAChE,GAAG,CAAC,CAAC,CAAC,EAAE;QACP,MAAM,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;QACvD,OAAO,GAAG,QAAQ,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAA;IACzE,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAA;IAEZ,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,CAAA;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,kBAAkB;IAClB,qBAAqB;IACrB,aAAa;IACb,yBAAyB;CAC1B,CAAA","sourcesContent":["import { createDecipheriv, createHash } from \"crypto\"\nimport * as asn1js from \"asn1js\"\nimport * as pkijs from \"pkijs\"\nimport { Crypto as PeculiarCrypto } from \"@peculiar/webcrypto\"\n\nimport { log } from \"builder-util\"\nimport _fsExtra from \"fs-extra\"\nconst { readFile } = _fsExtra\n\n// OID for codeSigning extended key usage\nconst CODE_SIGNING_OID = \"1.3.6.1.5.5.7.3.3\"\n\n// OID for the PKCS#12 certificate bag type\nconst CERT_BAG_OID = \"1.2.840.113549.1.12.10.1.3\"\n\n// Maps certificate attribute OIDs to their short names.\n// Matches the attributeTypeNames map in the Go reference implementation exactly:\n// https://github.com/develar/app-builder/blob/master/pkg/codesign/p12.go\nconst ATTRIBUTE_TYPE_NAMES: Record<string, string> = {\n  \"2.5.4.6\": \"C\",\n  \"2.5.4.10\": \"O\",\n  \"2.5.4.11\": \"OU\",\n  \"2.5.4.3\": \"CN\",\n  \"2.5.4.5\": \"SERIALNUMBER\",\n  \"2.5.4.7\": \"L\",\n  \"2.5.4.8\": \"ST\",\n  \"2.5.4.9\": \"STREET\",\n  \"2.5.4.17\": \"POSTALCODE\",\n}\n\n// Characters that must be quoted in a DN value to match Go binary BloodyMsString output\nconst NEEDS_DN_ESCAPING = /[,+\"\\\\<>;]/\n\nfunction escapeDnValue(value: string): string {\n  if (NEEDS_DN_ESCAPING.test(value)) {\n    // Escape embedded double-quotes by doubling them, then wrap entire value in quotes\n    return `\"${value.replace(/\"/g, '\"\"')}\"`\n  }\n  return value\n}\n\n// Set up the pkijs WebCrypto engine once. @peculiar/webcrypto supports legacy cipher suites\n// (RC2, 3DES) used by real-world CA-issued PFX files, unlike native Node.js WebCrypto.\nconst peculiarCrypto = new PeculiarCrypto()\npkijs.setEngine(\"peculiar\", new pkijs.CryptoEngine({ name: \"peculiar\", crypto: peculiarCrypto as any, subtle: peculiarCrypto.subtle }) as any)\n\nfunction toArrayBuffer(buf: Buffer): ArrayBuffer {\n  const ab = new ArrayBuffer(buf.byteLength)\n  new Uint8Array(ab).set(buf)\n  return ab\n}\n\n// ── PKCS#12 legacy PBE support (RFC 7292 Appendix B) ───────────────────────\n//\n// pkijs's CryptoEngine.decryptEncryptedContentInfo only handles PBES2\n// (OID 1.2.840.113549.1.5.13). Many real-world PFX files use the older\n// pkcs-12PbeIds ciphers (SHA1+3DES, SHA1+2DES, SHA1+RC2-128, SHA1+RC2-40).\n// We implement 3DES/2DES using Node.js's built-in `crypto` module and RC2\n// with a pure-TypeScript RFC 2268 implementation — RC2 was moved to\n// OpenSSL 3's legacy provider (not loaded by default) and is unavailable\n// via `createDecipheriv` in Node.js 22+.\n\n// ── RFC 2268 RC2-CBC implementation ─────────────────────────────────────────\n\n/** Permutation table from RFC 2268. */\nconst RC2_PITABLE = Uint8Array.from([\n  0xd9, 0x78, 0xf9, 0xc4, 0x19, 0xdd, 0xb5, 0xed, 0x28, 0xe9, 0xfd, 0x79, 0x4a, 0xa0, 0xd8, 0x9d, 0xc6, 0x7e, 0x37, 0x83, 0x2b, 0x76, 0x53, 0x8e, 0x62, 0x4c, 0x64, 0x88, 0x44,\n  0x8b, 0xfb, 0xa2, 0x17, 0x9a, 0x59, 0xf5, 0x87, 0xb3, 0x4f, 0x13, 0x61, 0x45, 0x6d, 0x8d, 0x09, 0x81, 0x7d, 0x32, 0xbd, 0x8f, 0x40, 0xeb, 0x86, 0xb7, 0x7b, 0x0b, 0xf0, 0x95,\n  0x21, 0x22, 0x5c, 0x6b, 0x4e, 0x82, 0x54, 0xd6, 0x65, 0x93, 0xce, 0x60, 0xb2, 0x1c, 0x73, 0x56, 0xc0, 0x14, 0xa7, 0x8c, 0xf1, 0xdc, 0x12, 0x75, 0xca, 0x1f, 0x3b, 0xbe, 0xe4,\n  0xd1, 0x42, 0x3d, 0xd4, 0x30, 0xa3, 0x3c, 0xb6, 0x26, 0x6f, 0xbf, 0x0e, 0xda, 0x46, 0x69, 0x07, 0x57, 0x27, 0xf2, 0x1d, 0x9b, 0xbc, 0x94, 0x43, 0x03, 0xf8, 0x11, 0xc7, 0xf6,\n  0x90, 0xef, 0x3e, 0xe7, 0x06, 0xc3, 0xd5, 0x2f, 0xc8, 0x66, 0x1e, 0xd7, 0x08, 0xe8, 0xea, 0xde, 0x80, 0x52, 0xee, 0xf7, 0x84, 0xaa, 0x72, 0xac, 0x35, 0x4d, 0x6a, 0x2a, 0x96,\n  0x1a, 0xd2, 0x71, 0x5a, 0x15, 0x49, 0x74, 0x4b, 0x9f, 0xd0, 0x5e, 0x04, 0x18, 0xa4, 0xec, 0xc2, 0xe0, 0x41, 0x6e, 0x0f, 0x51, 0xcb, 0xcc, 0x24, 0x91, 0xaf, 0x50, 0xa1, 0xf4,\n  0x70, 0x39, 0x99, 0x7c, 0x3a, 0x85, 0x23, 0xb8, 0xb4, 0x7a, 0xfc, 0x02, 0x36, 0x5b, 0x25, 0x55, 0x97, 0x31, 0x2d, 0x5d, 0xfa, 0x98, 0xe3, 0x8a, 0x92, 0xae, 0x05, 0xdf, 0x29,\n  0x10, 0x67, 0x6c, 0xba, 0xc9, 0xd3, 0x00, 0xe6, 0xcf, 0xe1, 0x9e, 0xa8, 0x2c, 0x63, 0x16, 0x01, 0x3f, 0x58, 0xe2, 0x89, 0xa9, 0x0d, 0x38, 0x34, 0x1b, 0xab, 0x33, 0xff, 0xb0,\n  0xbb, 0x48, 0x0c, 0x5f, 0xb9, 0xb1, 0xcd, 0x2e, 0xc5, 0xf3, 0xdb, 0x47, 0xe5, 0xa5, 0x9c, 0x77, 0x0a, 0xa6, 0x20, 0x68, 0xfe, 0x7f, 0xc1, 0xad,\n])\n\n/** Rotation amounts for R[0], R[1], R[2], R[3] in each mix round. */\nconst RC2_ROT = [1, 2, 3, 5] as const\n\n/**\n * Expand a variable-length key to 64 sixteen-bit subkeys (RFC 2268 Section 2).\n * `effectiveBits` controls the effective key length for export-grade keys\n * (40 = RC2-40, 128 = RC2-128).\n */\nfunction rc2ExpandKey(key: Buffer, effectiveBits: number): number[] {\n  // Guard: effectiveBits = 0 causes T8 = 0, making L[128-0] = L[128] an OOB\n  // access on a 128-element Uint8Array (silently returns undefined, producing\n  // a wrong key schedule). Values > 1024 exceed the RFC 2268 key schedule table.\n  if (!Number.isInteger(effectiveBits) || effectiveBits < 1 || effectiveBits > 1024) {\n    throw new Error(`rc2ExpandKey: effectiveBits must be an integer in [1, 1024], got ${effectiveBits}`)\n  }\n  const T = key.length\n  const T8 = Math.ceil(effectiveBits / 8)\n  // 0xff >> (effectiveBits & 7) gives 0xff for multiples-of-8 effective lengths\n  // (no masking), and a smaller mask for non-multiples.\n  const TM = 0xff >> (effectiveBits & 7)\n  const L = new Uint8Array(128)\n  for (let i = 0; i < T; i++) {\n    L[i] = key[i]\n  }\n  for (let i = T; i < 128; i++) {\n    L[i] = RC2_PITABLE[(L[i - 1] + L[i - T]) & 0xff]\n  }\n  L[128 - T8] = RC2_PITABLE[L[128 - T8] & TM]\n  for (let i = 127 - T8; i >= 0; i--) {\n    L[i] = RC2_PITABLE[L[i + 1] ^ L[i + T8]]\n  }\n  const K: number[] = new Array(64)\n  for (let i = 0; i < 64; i++) {\n    K[i] = L[2 * i] | (L[2 * i + 1] << 8)\n  }\n  return K\n}\n\n/** Rotate a 16-bit word right by `bits` positions. */\nfunction ror16(word: number, bits: number): number {\n  return ((word & 0xffff) >> bits) | ((word << (16 - bits)) & 0xffff)\n}\n\n/**\n * Decrypt `data` using RC2-CBC with PKCS#7 padding removal (RFC 2268).\n *\n * Used for pbeWithSHAAnd40BitRC2CBC  (OID 1.2.840.113549.1.12.1.6) and\n *          pbeWithSHAAnd128BitRC2CBC (OID 1.2.840.113549.1.12.1.5).\n *\n * These OIDs are commonly used to encrypt certificate bags in PKCS#12\n * files produced by OpenSSL and Windows with default settings. Node.js 22+\n * (OpenSSL 3 default provider) does not support RC2 via `createDecipheriv`.\n */\nfunction rc2CbcDecrypt(key: Buffer, iv: Buffer, data: Buffer, effectiveBits: number): Buffer {\n  // Guard: a non-multiple-of-8 ciphertext causes the last partial block to be\n  // processed with `undefined` bytes.  In JS, `undefined | (undefined << 8)`\n  // produces NaN, and `NaN & 0xffff` produces 0 — so partial blocks silently\n  // produce garbage output rather than throwing.\n  if (data.length === 0 || data.length % 8 !== 0) {\n    throw new Error(`rc2CbcDecrypt: ciphertext length ${data.length} is not a positive multiple of the 8-byte RC2 block size`)\n  }\n  if (iv.length !== 8) {\n    throw new Error(`rc2CbcDecrypt: IV must be exactly 8 bytes, got ${iv.length}`)\n  }\n  const K = rc2ExpandKey(key, effectiveBits)\n  const out = Buffer.alloc(data.length)\n  const prev = Buffer.from(iv) // CBC running state; starts as the IV\n\n  for (let offset = 0; offset < data.length; offset += 8) {\n    const ct = data.subarray(offset, offset + 8)\n    // Parse ciphertext block as four little-endian 16-bit words\n    const R = [(ct[0] | (ct[1] << 8)) & 0xffff, (ct[2] | (ct[3] << 8)) & 0xffff, (ct[4] | (ct[5] << 8)) & 0xffff, (ct[6] | (ct[7] << 8)) & 0xffff]\n\n    // Reverse the encryption round plan [5 mix, 1 mash, 6 mix, 1 mash, 5 mix].\n    // For decryption j starts at 63 and decrements in each reverse-mix step.\n    let j = 63\n\n    const rMix = () => {\n      for (let i = 3; i >= 0; i--) {\n        R[i] = ror16(R[i], RC2_ROT[i])\n        const r3 = R[(i + 3) % 4]\n        R[i] = (R[i] - K[j] - (r3 & R[(i + 2) % 4]) - (~r3 & 0xffff & R[(i + 1) % 4])) & 0xffff\n        j--\n      }\n    }\n\n    const rMash = () => {\n      for (let i = 3; i >= 0; i--) {\n        R[i] = (R[i] - K[R[(i + 3) % 4] & 63]) & 0xffff\n      }\n    }\n\n    for (let n = 0; n < 5; n++) {\n      rMix()\n    }\n    rMash()\n    for (let n = 0; n < 6; n++) {\n      rMix()\n    }\n    rMash()\n    for (let n = 0; n < 5; n++) {\n      rMix()\n    }\n\n    // XOR decrypted words with previous ciphertext block (CBC mode)\n    for (let i = 0; i < 4; i++) {\n      out[offset + i * 2] = (R[i] & 0xff) ^ prev[i * 2]\n      out[offset + i * 2 + 1] = (R[i] >> 8) ^ prev[i * 2 + 1]\n    }\n    // Advance CBC state to current ciphertext block\n    ct.copy(prev)\n  }\n\n  // Validate and strip PKCS#7 padding.\n  // Without this guard, padLen = 0 silently returns the full buffer (no stripping)\n  // and padLen > 8 causes Buffer.subarray(0, negative) → empty buffer, both\n  // silently.  A wrong key/IV produces decrypted bytes that fail this check.\n  const padLen = out[out.length - 1]\n  if (padLen < 1 || padLen > 8) {\n    throw new Error(`rc2CbcDecrypt: invalid PKCS#7 pad byte 0x${padLen.toString(16).padStart(2, \"0\")} — the ciphertext is corrupt or the wrong key/IV was used`)\n  }\n  for (let i = out.length - padLen; i < out.length; i++) {\n    if (out[i] !== padLen) {\n      throw new Error(`rc2CbcDecrypt: invalid PKCS#7 padding — the ciphertext is corrupt or the wrong key/IV was used`)\n    }\n  }\n  return out.subarray(0, out.length - padLen)\n}\n\n/** PKCS#12 legacy PBE OIDs (pkcs-12PbeIds) and their cipher parameters. */\nconst PKCS12_PBE_ALGOS: Record<string, { cipher: string; keyLen: number; ivLen: number; rc2Bits?: number }> = {\n  \"1.2.840.113549.1.12.1.3\": { cipher: \"des-ede3-cbc\", keyLen: 24, ivLen: 8 }, // pbeWithSHAAnd3KeyTripleDESCBC\n  \"1.2.840.113549.1.12.1.4\": { cipher: \"des-ede-cbc\", keyLen: 16, ivLen: 8 }, //  pbeWithSHAAnd2KeyTripleDESCBC\n  \"1.2.840.113549.1.12.1.5\": { cipher: \"rc2-cbc\", keyLen: 16, ivLen: 8, rc2Bits: 128 }, // pbeWithSHAAnd128BitRC2CBC\n  \"1.2.840.113549.1.12.1.6\": { cipher: \"rc2-cbc\", keyLen: 5, ivLen: 8, rc2Bits: 40 }, //  pbeWithSHAAnd40BitRC2CBC\n}\n\n/**\n * Maximum PKCS#12 PBE iteration count accepted.\n *\n * A maliciously crafted PFX can set iterations to Number.MAX_SAFE_INTEGER,\n * causing the SHA-1 loop to run for an arbitrary amount of time (DoS).\n * Real-world PFX files use 1 000–50 000 iterations; this cap is generous\n * enough to accommodate even unusually high-security certs while blocking\n * obviously hostile inputs.\n */\nconst MAX_PKCS12_PBE_ITERATIONS = 300_000\n\n/**\n * PKCS#12 key/IV derivation function from RFC 7292 Appendix B (SHA-1 variant).\n * id = 1 to derive a key, id = 2 to derive an IV.\n *\n * Throws if `iterations` is outside [1, MAX_PKCS12_PBE_ITERATIONS] to prevent\n * CPU exhaustion from a crafted PFX file.\n */\nfunction pkcs12PbeDeriveKey(password: Buffer, salt: Buffer, iterations: number, id: number, length: number): Buffer {\n  if (!Number.isInteger(iterations) || iterations < 1 || iterations > MAX_PKCS12_PBE_ITERATIONS) {\n    throw new Error(\n      `PKCS#12 PBE iteration count ${iterations} is outside safe range [1, ${MAX_PKCS12_PBE_ITERATIONS}]; refusing to process — the file may be crafted to exhaust CPU`\n    )\n  }\n  // A crafted PFX could supply a multi-megabyte salt, causing Buffer.alloc(sLen) inside\n  // the KDF to allocate gigabytes (sLen = ceil(salt.length / 64) * 64).\n  const MAX_SALT_BYTES = 4096\n  if (salt.length > MAX_SALT_BYTES) {\n    throw new Error(`PKCS#12 PBE salt length ${salt.length} exceeds the safe maximum of ${MAX_SALT_BYTES} bytes — the file may be crafted to exhaust memory`)\n  }\n\n  const u = 20 // SHA-1 output bytes\n  const v = 64 // SHA-1 block bytes\n\n  // Step 1: D = ID byte repeated v times\n  const D = Buffer.alloc(v, id)\n\n  // Step 2: S = salt bytes repeated to fill ceil(salt.length / v) * v bytes\n  const sLen = salt.length > 0 ? Math.ceil(salt.length / v) * v : 0\n  const S = Buffer.alloc(sLen)\n  for (let i = 0; i < sLen; i++) {\n    S[i] = salt[i % salt.length]\n  }\n\n  // Step 3: P = password bytes repeated to fill ceil(password.length / v) * v bytes\n  const pLen = password.length > 0 ? Math.ceil(password.length / v) * v : 0\n  const P = Buffer.alloc(pLen)\n  for (let i = 0; i < pLen; i++) {\n    P[i] = password[i % password.length]\n  }\n\n  // Step 4: I = S || P (mutable, updated in step 6C)\n  const I = new Uint8Array(Buffer.concat([S, P]))\n\n  const c = Math.ceil(length / u)\n  const result = Buffer.alloc(c * u)\n\n  for (let i = 0; i < c; i++) {\n    // Step 6A: A_i = H^iterations(D || I)\n    let Ai: Buffer = createHash(\"sha1\").update(D).update(Buffer.from(I)).digest()\n    for (let j = 1; j < iterations; j++) {\n      Ai = createHash(\"sha1\").update(Ai).digest()\n    }\n    Ai.copy(result, i * u)\n\n    // Step 6B: B = A_i repeated to fill v bytes\n    const B = new Uint8Array(v)\n    for (let j = 0; j < v; j++) {\n      B[j] = Ai[j % u]\n    }\n\n    // Step 6C: each v-byte block of I is incremented by (B + 1) mod 2^(v*8)\n    const blockCount = Math.ceil(I.length / v)\n    for (let j = 0; j < blockCount; j++) {\n      let carry = 1\n      for (let b = v - 1; b >= 0; b--) {\n        const idx = j * v + b\n        if (idx < I.length) {\n          const sum = I[idx] + B[b] + carry\n          I[idx] = sum & 0xff\n          carry = sum >> 8\n        }\n      }\n    }\n  }\n\n  return result.subarray(0, length)\n}\n\n/**\n * Encode a password as UTF-16 Big Endian with a null terminator, which is the\n * format required by PKCS#12 PBE key derivation (RFC 7292).\n * An empty string yields [0x00, 0x00] (just the null terminator).\n */\nfunction pkcs12PasswordToUtf16(password: string): Buffer {\n  const buf = Buffer.alloc((password.length + 1) * 2)\n  for (let i = 0; i < password.length; i++) {\n    const code = password.charCodeAt(i)\n    buf[i * 2] = (code >> 8) & 0xff\n    buf[i * 2 + 1] = code & 0xff\n  }\n  // Last two bytes are already 0x00 0x00 (null terminator) from Buffer.alloc.\n  return buf\n}\n\n/**\n * Decrypt PKCS#12 legacy PBE encrypted content using Node.js crypto.\n *\n * @param algId   - OID from PKCS12_PBE_ALGOS\n * @param algParams - asn1js object for PKCS12PBEParams (SEQUENCE { OCTET STRING, INTEGER })\n * @param encContent - asn1js object for the encrypted content (Constructed or Primitive [0] IMPLICIT)\n * @param password - plain-text password string\n */\nfunction decryptLegacyPkcs12Pbe(algId: string, algParams: any, encContent: any, password: string): Buffer {\n  const algo = PKCS12_PBE_ALGOS[algId]\n\n  // PKCS12PBEParams ::= SEQUENCE { salt OCTET STRING, iterations INTEGER }\n  const salt = Buffer.from(algParams.valueBlock.value[0].valueBlock.valueHexView)\n  const iterations = Number(algParams.valueBlock.value[1].valueBlock.valueDec)\n\n  const pwdBytes = pkcs12PasswordToUtf16(password)\n  const key = pkcs12PbeDeriveKey(pwdBytes, salt, iterations, 1, algo.keyLen)\n  const iv = pkcs12PbeDeriveKey(pwdBytes, salt, iterations, 2, algo.ivLen)\n\n  // Extract raw encrypted bytes from the [0] IMPLICIT OCTET STRING.\n  // The encryptedContent field can be a Constructed (fragmented) or Primitive tag.\n  let encBytes: Buffer\n  if (encContent.idBlock?.isConstructed) {\n    encBytes = Buffer.concat((encContent.valueBlock.value as any[]).map((p: any) => Buffer.from(p.valueBlock.valueHexView)))\n  } else {\n    encBytes = Buffer.from(encContent.valueBlock.valueHexView)\n  }\n\n  if (algo.rc2Bits != null) {\n    // RC2 is not available in Node.js 22+ via createDecipheriv (OpenSSL 3 moved\n    // it to the legacy provider which is not loaded by default). Use our pure-TS\n    // RFC 2268 implementation instead.\n    return rc2CbcDecrypt(key, iv, encBytes, algo.rc2Bits)\n  }\n\n  const decipher = createDecipheriv(algo.cipher, key, iv)\n  return Buffer.concat([decipher.update(encBytes), decipher.final()])\n}\n\n/**\n * Reads certificate info from a PKCS#12 (.pfx) file using pkijs (unobfuscated TypeScript).\n * Mirrors the `certificate-info` subcommand of app-builder-bin.\n * https://github.com/develar/app-builder/blob/master/pkg/codesign/p12.go\n *\n * Returns { commonName, bloodyMicrosoftSubjectDn } on success.\n *\n * Known divergences from the Go binary:\n * - No OpenSSL fallback when the pure PKCS#12 decoder fails for a non-password reason.\n * - Unknown OIDs are rendered using the raw numeric OID as the type name (e.g. `2.5.4.100=value`); Go uses `OID=#hexbytes` when ASN.1 marshal succeeds.\n * - RDN ordering uses DER order; Go normalizes via pkix.Name.ToRDNSequence then reverses via\n *   BloodyMsString. These coincide for pkijs-generated certs (CN-first DER) but may\n *   differ for real CA-issued certs stored in traditional C-first DER order.\n */\nexport async function readCertInfo(file: string, password: string): Promise<{ commonName: string; bloodyMicrosoftSubjectDn: string }> {\n  const pfxDer = await readFile(file)\n\n  // asn1js requires a plain ArrayBuffer\n  const pfxBuf = toArrayBuffer(pfxDer)\n  let asn1: ReturnType<typeof asn1js.fromBER>\n  try {\n    asn1 = asn1js.fromBER(pfxBuf)\n    if (asn1.offset === -1) {\n      throw new Error(\"offset -1: invalid BER encoding\")\n    }\n  } catch (err) {\n    throw new Error(`PKCS#12 file \"${file}\" contains invalid ASN.1/DER data: ${err instanceof Error ? err.message : String(err)}`)\n  }\n\n  const pfx = new pkijs.PFX({ schema: asn1.result })\n  const pwBuf = toArrayBuffer(Buffer.from(password, \"utf-8\"))\n\n  // Step 1: Verify MAC (or signature) integrity and parse the AuthenticatedSafe container.\n  // pkijs throws \"Integrity for the PKCS#12 data is broken!\" on wrong password.\n  try {\n    await pfx.parseInternalValues({ password: pwBuf, checkIntegrity: true })\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err)\n    const lower = detail.toLowerCase()\n    if (lower.includes(\"integrity\") || lower.includes(\"mac\") || lower.includes(\"password\") || lower.includes(\"pkcs#12\")) {\n      throw new Error(`password incorrect for certificate file \"${file}\" — verify the password matches the PFX. pkijs detail: ${detail}`)\n    }\n    log.debug({ file, error: detail }, \"pkijs failed to decode PKCS#12; no OpenSSL fallback available in Node.js\")\n    throw new Error(`Failed to decode PKCS#12 file \"${file}\" — the file may be corrupt, use an unsupported cipher, or require OpenSSL. pkijs detail: ${detail}`)\n  }\n\n  const authSafe = pfx.parsedValue?.authenticatedSafe\n  if (authSafe == null) {\n    throw new Error(`Failed to parse AuthenticatedSafe in PKCS#12 file \"${file}\"`)\n  }\n\n  // Step 2: Iterate over the authenticated-safe ContentInfos and extract all certificates.\n  //\n  // We do NOT call authSafe.parseInternalValues() because pkijs's CryptoEngine only handles\n  // PBES2 (OID 1.2.840.113549.1.5.13) for EncryptedData. Real-world PFX files (including\n  // CA-issued and electron-builder-generated certs) often use the older pkcs-12PbeIds ciphers\n  // (e.g. pbeWithSHAAnd3KeyTripleDESCBC). We handle those with our own Node.js crypto path.\n  const certs: pkijs.Certificate[] = []\n\n  for (const ci of authSafe.safeContents) {\n    let safeBER: ArrayBuffer\n\n    if (ci.contentType === pkijs.id_ContentType_Data) {\n      // Data: content is an OCTET STRING containing DER-encoded SafeContents.\n      safeBER = (ci.content as asn1js.OctetString).getValue()\n    } else if (ci.contentType === pkijs.id_ContentType_EncryptedData) {\n      // EncryptedData: decrypt the SafeContents, routing by algorithm OID.\n      const encData = new pkijs.EncryptedData({ schema: ci.content })\n      const algId = encData.encryptedContentInfo.contentEncryptionAlgorithm.algorithmId\n\n      if (Object.prototype.hasOwnProperty.call(PKCS12_PBE_ALGOS, algId)) {\n        // Legacy PKCS#12 PBE (pbeWithSHAAnd*) — use our RFC 7292 implementation.\n        const decrypted = decryptLegacyPkcs12Pbe(\n          algId,\n          encData.encryptedContentInfo.contentEncryptionAlgorithm.algorithmParams,\n          encData.encryptedContentInfo.encryptedContent,\n          password\n        )\n        safeBER = toArrayBuffer(decrypted)\n      } else {\n        // PBES2 or other modern OID — delegate to the pkijs engine.\n        safeBER = await encData.decrypt({ password: pwBuf })\n      }\n    } else {\n      // EnvelopedData or other types — skip (not needed for cert extraction).\n      continue\n    }\n\n    // Parse SafeContents and collect X.509 certificates from cert bags.\n    const sc = pkijs.SafeContents.fromBER(safeBER)\n    for (const bag of sc.safeBags) {\n      if (bag.bagId === CERT_BAG_OID) {\n        const certBag = bag.bagValue as pkijs.CertBag\n        if (certBag.parsedValue instanceof pkijs.Certificate) {\n          certs.push(certBag.parsedValue)\n        }\n      }\n    }\n  }\n\n  if (certs.length === 0) {\n    throw new Error(`No certificates found in PKCS#12 file \"${file}\" — the file may be a key-only PFX or be empty`)\n  }\n\n  // Find the certificate with the codeSigning Extended Key Usage.\n  // pkijs auto-parses known extensions via ExtensionValueFactory (registered at module init).\n  const signingCert = certs.find(cert => {\n    const ekuExt = cert.extensions?.find(e => e.extnID === pkijs.id_ExtKeyUsage)\n    if (ekuExt == null) {\n      return false\n    }\n    if (ekuExt.parsedValue instanceof pkijs.ExtKeyUsage) {\n      return ekuExt.parsedValue.keyPurposes.includes(CODE_SIGNING_OID)\n    }\n    // Fallback: manually parse the extension OctetString value.\n    try {\n      const inner = asn1js.fromBER(ekuExt.extnValue.valueBlock.valueHexView)\n      if (inner.offset === -1) {\n        return false\n      }\n      const eku = new pkijs.ExtKeyUsage({ schema: inner.result })\n      return eku.keyPurposes.includes(CODE_SIGNING_OID)\n    } catch {\n      return false\n    }\n  })\n\n  if (signingCert == null) {\n    throw new Error(\n      `No certificate with ExtKeyUsageCodeSigning found in \"${file}\" — ${certs.length} certificate(s) present but none have the codeSigning extended key usage. ` +\n        `Ensure the PFX contains a code-signing certificate, not just a CA or TLS certificate.`\n    )\n  }\n\n  const cnAttr = signingCert.subject.typesAndValues.find(a => a.type === \"2.5.4.3\")\n  const commonName = String(cnAttr?.value.valueBlock.value ?? \"\")\n\n  // Format DN as \"CN=X,O=X,...\" matching Go's BloodyMsString output.\n  // Uses ATTRIBUTE_TYPE_NAMES to mirror Go's attributeTypeNames map exactly, so STREET,\n  // POSTALCODE, and SERIALNUMBER (present in EV code-signing certs) are handled correctly.\n  // Unknown OIDs fall back to the bare OID string as the type name.\n  const bloodyMicrosoftSubjectDn = signingCert.subject.typesAndValues\n    .map(a => {\n      const typeName = ATTRIBUTE_TYPE_NAMES[a.type] ?? a.type\n      return `${typeName}=${escapeDnValue(String(a.value.valueBlock.value))}`\n    })\n    .join(\",\")\n\n  return { commonName, bloodyMicrosoftSubjectDn }\n}\n\n/**\n * Internal functions exported exclusively for unit testing.\n * Not part of the public API — do not use outside of test files.\n */\nexport const _testingOnly = {\n  pkcs12PbeDeriveKey,\n  pkcs12PasswordToUtf16,\n  rc2CbcDecrypt,\n  MAX_PKCS12_PBE_ITERATIONS,\n}\n"]}
+{"version":3,"file":"certInfo.js","sourceRoot":"","sources":["../../src/codeSign/certInfo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACrD,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAChC,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAC9B,OAAO,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAE9D,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAA;AAE7B,yCAAyC;AACzC,MAAM,gBAAgB,GAAG,mBAAmB,CAAA;AAE5C,2CAA2C;AAC3C,MAAM,YAAY,GAAG,4BAA4B,CAAA;AAEjD,wDAAwD;AACxD,iFAAiF;AACjF,yEAAyE;AACzE,MAAM,oBAAoB,GAA2B;IACnD,SAAS,EAAE,GAAG;IACd,UAAU,EAAE,GAAG;IACf,UAAU,EAAE,IAAI;IAChB,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,GAAG;IACd,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,QAAQ;IACnB,UAAU,EAAE,YAAY;CACzB,CAAA;AAED,wFAAwF;AACxF,MAAM,iBAAiB,GAAG,YAAY,CAAA;AAEtC,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,mFAAmF;QACnF,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAA;IACzC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,4FAA4F;AAC5F,uFAAuF;AACvF,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAA;AAC3C,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,cAAqB,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAQ,CAAC,CAAA;AAE9I,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,EAAE,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC1C,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC3B,OAAO,EAAE,CAAA;AACX,CAAC;AAED,8EAA8E;AAC9E,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,2EAA2E;AAC3E,0EAA0E;AAC1E,oEAAoE;AACpE,yEAAyE;AACzE,yCAAyC;AAEzC,+EAA+E;AAE/E,uCAAuC;AACvC,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC;IAClC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CAC/I,CAAC,CAAA;AAEF,qEAAqE;AACrE,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAU,CAAA;AAErC;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,aAAqB;IACtD,0EAA0E;IAC1E,4EAA4E;IAC5E,+EAA+E;IAC/E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,IAAI,aAAa,GAAG,IAAI,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,oEAAoE,aAAa,EAAE,CAAC,CAAA;IACtG,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAA;IACpB,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAA;IACvC,8EAA8E;IAC9E,sDAAsD;IACtD,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAA;IACtC,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;IACf,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IAClD,CAAC;IACD,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,GAAG,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAC1C,CAAC;IACD,MAAM,CAAC,GAAa,IAAI,KAAK,CAAC,EAAE,CAAC,CAAA;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,sDAAsD;AACtD,SAAS,KAAK,CAAC,IAAY,EAAE,IAAY;IACvC,OAAO,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAA;AACrE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,EAAU,EAAE,IAAY,EAAE,aAAqB;IACjF,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,MAAM,0DAA0D,CAAC,CAAA;IAC5H,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,kDAAkD,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAChF,CAAC;IACD,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA,CAAC,sCAAsC;IAEnE,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAA;QAC5C,4DAA4D;QAC5D,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAA;QAE9I,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,CAAC,GAAG,EAAE,CAAA;QAEV,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC9B,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;gBACzB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAA;gBACvF,CAAC,EAAE,CAAA;YACL,CAAC;QACH,CAAC,CAAA;QAED,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,MAAM,CAAA;YACjD,CAAC;QACH,CAAC,CAAA;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAA;QACR,CAAC;QACD,KAAK,EAAE,CAAA;QACP,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAA;QACR,CAAC;QACD,KAAK,EAAE,CAAA;QACP,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAA;QACR,CAAC;QAED,gEAAgE;QAChE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACjD,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QACzD,CAAC;QACD,gDAAgD;QAChD,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IAED,qCAAqC;IACrC,iFAAiF;IACjF,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAClC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,2DAA2D,CAAC,CAAA;IAC9J,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAA;QACnH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;AAC7C,CAAC;AAED,2EAA2E;AAC3E,MAAM,gBAAgB,GAAwF;IAC5G,yBAAyB,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,gCAAgC;IAC7G,yBAAyB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,iCAAiC;IAC7G,yBAAyB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,4BAA4B;IAClH,yBAAyB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,4BAA4B;CACjH,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,yBAAyB,GAAG,OAAO,CAAA;AAEzC;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,QAAgB,EAAE,IAAY,EAAE,UAAkB,EAAE,EAAU,EAAE,MAAc;IACxG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,yBAAyB,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CACb,+BAA+B,UAAU,8BAA8B,yBAAyB,iEAAiE,CAClK,CAAA;IACH,CAAC;IACD,sFAAsF;IACtF,sEAAsE;IACtE,MAAM,cAAc,GAAG,IAAI,CAAA;IAC3B,IAAI,IAAI,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,MAAM,gCAAgC,cAAc,oDAAoD,CAAC,CAAA;IAC3J,CAAC;IAED,MAAM,CAAC,GAAG,EAAE,CAAA,CAAC,qBAAqB;IAClC,MAAM,CAAC,GAAG,EAAE,CAAA,CAAC,oBAAoB;IAEjC,uCAAuC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAE7B,0EAA0E;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACjE,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC9B,CAAC;IAED,kFAAkF;IAClF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACzE,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;IACtC,CAAC;IAED,mDAAmD;IACnD,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAE/C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,sCAAsC;QACtC,IAAI,EAAE,GAAW,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;QAC7E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;QAC7C,CAAC;QACD,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QAEtB,4CAA4C;QAC5C,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAClB,CAAC;QAED,wEAAwE;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,IAAI,KAAK,GAAG,CAAC,CAAA;YACb,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACrB,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;oBACnB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAA;oBACjC,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,IAAI,CAAA;oBACnB,KAAK,GAAG,GAAG,IAAI,CAAC,CAAA;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACnC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;QAC/B,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAC9B,CAAC;IACD,4EAA4E;IAC5E,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,KAAa,EAAE,SAAc,EAAE,UAAe,EAAE,QAAgB;IAC9F,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAEpC,yEAAyE;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;IAC/E,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;IAE5E,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAC1E,MAAM,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAExE,kEAAkE;IAClE,iFAAiF;IACjF,IAAI,QAAgB,CAAA;IACpB,IAAI,UAAU,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;QACtC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAE,UAAU,CAAC,UAAU,CAAC,KAAe,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAC1H,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;IAC5D,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACzB,4EAA4E;QAC5E,6EAA6E;QAC7E,mCAAmC;QACnC,OAAO,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;AACrE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IAC/D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IAEnC,sCAAsC;IACtC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,IAAuC,CAAA;IAC3C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAChI,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IAClD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;IAE3D,yFAAyF;IACzF,8EAA8E;IAC9E,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,mBAAmB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;QAClC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACpH,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,0DAA0D,MAAM,EAAE,CAAC,CAAA;QACrI,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,0EAA0E,CAAC,CAAA;QAC9G,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,6FAA6F,MAAM,EAAE,CAAC,CAAA;IAC9J,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAA;IACnD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,GAAG,CAAC,CAAA;IAChF,CAAC;IAED,yFAAyF;IACzF,EAAE;IACF,0FAA0F;IAC1F,uFAAuF;IACvF,4FAA4F;IAC5F,0FAA0F;IAC1F,MAAM,KAAK,GAAwB,EAAE,CAAA;IAErC,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACvC,IAAI,OAAoB,CAAA;QAExB,IAAI,EAAE,CAAC,WAAW,KAAK,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACjD,wEAAwE;YACxE,OAAO,GAAI,EAAE,CAAC,OAA8B,CAAC,QAAQ,EAAE,CAAA;QACzD,CAAC;aAAM,IAAI,EAAE,CAAC,WAAW,KAAK,KAAK,CAAC,4BAA4B,EAAE,CAAC;YACjE,qEAAqE;YACrE,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;YAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,oBAAoB,CAAC,0BAA0B,CAAC,WAAW,CAAA;YAEjF,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC;gBAClE,yEAAyE;gBACzE,MAAM,SAAS,GAAG,sBAAsB,CACtC,KAAK,EACL,OAAO,CAAC,oBAAoB,CAAC,0BAA0B,CAAC,eAAe,EACvE,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,EAC7C,QAAQ,CACT,CAAA;gBACD,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;YACpC,CAAC;iBAAM,CAAC;gBACN,4DAA4D;gBAC5D,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;YACtD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,SAAQ;QACV,CAAC;QAED,oEAAoE;QACpE,MAAM,EAAE,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC9C,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,QAAyB,CAAA;gBAC7C,IAAI,OAAO,CAAC,WAAW,YAAY,KAAK,CAAC,WAAW,EAAE,CAAC;oBACrD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;gBACjC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,gDAAgD,CAAC,CAAA;IACjH,CAAC;IAED,gEAAgE;IAChE,4FAA4F;IAC5F,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc,CAAC,CAAA;QAC5E,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,YAAY,KAAK,CAAC,WAAW,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAClE,CAAC;QACD,4DAA4D;QAC5D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;YACtE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAA;YACd,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;YAC3D,OAAO,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,wDAAwD,IAAI,OAAO,KAAK,CAAC,MAAM,4EAA4E;YACzJ,uFAAuF,CAC1F,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;IACjF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IAE/D,mEAAmE;IACnE,sFAAsF;IACtF,yFAAyF;IACzF,kEAAkE;IAClE,MAAM,wBAAwB,GAAG,WAAW,CAAC,OAAO,CAAC,cAAc;SAChE,GAAG,CAAC,CAAC,CAAC,EAAE;QACP,MAAM,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;QACvD,OAAO,GAAG,QAAQ,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAA;IACzE,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAA;IAEZ,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,CAAA;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY;IACrD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IAEhC,2DAA2D;IAC3D,IAAI,QAAgB,CAAA;IACpB,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IACxC,IAAI,UAAU,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,UAAU;aACnB,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC;aAC3C,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;aACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACtB,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACvC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,GAAG,CAAA;IAChB,CAAC;IAED,IAAI,IAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC1D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACpD,CAAC;QACD,IAAI,GAAG,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC9H,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;IAC1E,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAExD,MAAM,wBAAwB,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc;SACzD,GAAG,CAAC,CAAC,CAAC,EAAE;QACP,MAAM,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;QACvD,OAAO,GAAG,QAAQ,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAA;IACzE,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAA;IAEZ,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,CAAA;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,kBAAkB;IAClB,qBAAqB;IACrB,aAAa;IACb,yBAAyB;CAC1B,CAAA","sourcesContent":["import { createDecipheriv, createHash } from \"crypto\"\nimport * as asn1js from \"asn1js\"\nimport * as pkijs from \"pkijs\"\nimport { Crypto as PeculiarCrypto } from \"@peculiar/webcrypto\"\n\nimport { log } from \"builder-util\"\nimport _fsExtra from \"fs-extra\"\nconst { readFile } = _fsExtra\n\n// OID for codeSigning extended key usage\nconst CODE_SIGNING_OID = \"1.3.6.1.5.5.7.3.3\"\n\n// OID for the PKCS#12 certificate bag type\nconst CERT_BAG_OID = \"1.2.840.113549.1.12.10.1.3\"\n\n// Maps certificate attribute OIDs to their short names.\n// Matches the attributeTypeNames map in the Go reference implementation exactly:\n// https://github.com/develar/app-builder/blob/master/pkg/codesign/p12.go\nconst ATTRIBUTE_TYPE_NAMES: Record<string, string> = {\n  \"2.5.4.6\": \"C\",\n  \"2.5.4.10\": \"O\",\n  \"2.5.4.11\": \"OU\",\n  \"2.5.4.3\": \"CN\",\n  \"2.5.4.5\": \"SERIALNUMBER\",\n  \"2.5.4.7\": \"L\",\n  \"2.5.4.8\": \"ST\",\n  \"2.5.4.9\": \"STREET\",\n  \"2.5.4.17\": \"POSTALCODE\",\n}\n\n// Characters that must be quoted in a DN value to match Go binary BloodyMsString output\nconst NEEDS_DN_ESCAPING = /[,+\"\\\\<>;]/\n\nfunction escapeDnValue(value: string): string {\n  if (NEEDS_DN_ESCAPING.test(value)) {\n    // Escape embedded double-quotes by doubling them, then wrap entire value in quotes\n    return `\"${value.replace(/\"/g, '\"\"')}\"`\n  }\n  return value\n}\n\n// Set up the pkijs WebCrypto engine once. @peculiar/webcrypto supports legacy cipher suites\n// (RC2, 3DES) used by real-world CA-issued PFX files, unlike native Node.js WebCrypto.\nconst peculiarCrypto = new PeculiarCrypto()\npkijs.setEngine(\"peculiar\", new pkijs.CryptoEngine({ name: \"peculiar\", crypto: peculiarCrypto as any, subtle: peculiarCrypto.subtle }) as any)\n\nfunction toArrayBuffer(buf: Buffer): ArrayBuffer {\n  const ab = new ArrayBuffer(buf.byteLength)\n  new Uint8Array(ab).set(buf)\n  return ab\n}\n\n// ── PKCS#12 legacy PBE support (RFC 7292 Appendix B) ───────────────────────\n//\n// pkijs's CryptoEngine.decryptEncryptedContentInfo only handles PBES2\n// (OID 1.2.840.113549.1.5.13). Many real-world PFX files use the older\n// pkcs-12PbeIds ciphers (SHA1+3DES, SHA1+2DES, SHA1+RC2-128, SHA1+RC2-40).\n// We implement 3DES/2DES using Node.js's built-in `crypto` module and RC2\n// with a pure-TypeScript RFC 2268 implementation — RC2 was moved to\n// OpenSSL 3's legacy provider (not loaded by default) and is unavailable\n// via `createDecipheriv` in Node.js 22+.\n\n// ── RFC 2268 RC2-CBC implementation ─────────────────────────────────────────\n\n/** Permutation table from RFC 2268. */\nconst RC2_PITABLE = Uint8Array.from([\n  0xd9, 0x78, 0xf9, 0xc4, 0x19, 0xdd, 0xb5, 0xed, 0x28, 0xe9, 0xfd, 0x79, 0x4a, 0xa0, 0xd8, 0x9d, 0xc6, 0x7e, 0x37, 0x83, 0x2b, 0x76, 0x53, 0x8e, 0x62, 0x4c, 0x64, 0x88, 0x44,\n  0x8b, 0xfb, 0xa2, 0x17, 0x9a, 0x59, 0xf5, 0x87, 0xb3, 0x4f, 0x13, 0x61, 0x45, 0x6d, 0x8d, 0x09, 0x81, 0x7d, 0x32, 0xbd, 0x8f, 0x40, 0xeb, 0x86, 0xb7, 0x7b, 0x0b, 0xf0, 0x95,\n  0x21, 0x22, 0x5c, 0x6b, 0x4e, 0x82, 0x54, 0xd6, 0x65, 0x93, 0xce, 0x60, 0xb2, 0x1c, 0x73, 0x56, 0xc0, 0x14, 0xa7, 0x8c, 0xf1, 0xdc, 0x12, 0x75, 0xca, 0x1f, 0x3b, 0xbe, 0xe4,\n  0xd1, 0x42, 0x3d, 0xd4, 0x30, 0xa3, 0x3c, 0xb6, 0x26, 0x6f, 0xbf, 0x0e, 0xda, 0x46, 0x69, 0x07, 0x57, 0x27, 0xf2, 0x1d, 0x9b, 0xbc, 0x94, 0x43, 0x03, 0xf8, 0x11, 0xc7, 0xf6,\n  0x90, 0xef, 0x3e, 0xe7, 0x06, 0xc3, 0xd5, 0x2f, 0xc8, 0x66, 0x1e, 0xd7, 0x08, 0xe8, 0xea, 0xde, 0x80, 0x52, 0xee, 0xf7, 0x84, 0xaa, 0x72, 0xac, 0x35, 0x4d, 0x6a, 0x2a, 0x96,\n  0x1a, 0xd2, 0x71, 0x5a, 0x15, 0x49, 0x74, 0x4b, 0x9f, 0xd0, 0x5e, 0x04, 0x18, 0xa4, 0xec, 0xc2, 0xe0, 0x41, 0x6e, 0x0f, 0x51, 0xcb, 0xcc, 0x24, 0x91, 0xaf, 0x50, 0xa1, 0xf4,\n  0x70, 0x39, 0x99, 0x7c, 0x3a, 0x85, 0x23, 0xb8, 0xb4, 0x7a, 0xfc, 0x02, 0x36, 0x5b, 0x25, 0x55, 0x97, 0x31, 0x2d, 0x5d, 0xfa, 0x98, 0xe3, 0x8a, 0x92, 0xae, 0x05, 0xdf, 0x29,\n  0x10, 0x67, 0x6c, 0xba, 0xc9, 0xd3, 0x00, 0xe6, 0xcf, 0xe1, 0x9e, 0xa8, 0x2c, 0x63, 0x16, 0x01, 0x3f, 0x58, 0xe2, 0x89, 0xa9, 0x0d, 0x38, 0x34, 0x1b, 0xab, 0x33, 0xff, 0xb0,\n  0xbb, 0x48, 0x0c, 0x5f, 0xb9, 0xb1, 0xcd, 0x2e, 0xc5, 0xf3, 0xdb, 0x47, 0xe5, 0xa5, 0x9c, 0x77, 0x0a, 0xa6, 0x20, 0x68, 0xfe, 0x7f, 0xc1, 0xad,\n])\n\n/** Rotation amounts for R[0], R[1], R[2], R[3] in each mix round. */\nconst RC2_ROT = [1, 2, 3, 5] as const\n\n/**\n * Expand a variable-length key to 64 sixteen-bit subkeys (RFC 2268 Section 2).\n * `effectiveBits` controls the effective key length for export-grade keys\n * (40 = RC2-40, 128 = RC2-128).\n */\nfunction rc2ExpandKey(key: Buffer, effectiveBits: number): number[] {\n  // Guard: effectiveBits = 0 causes T8 = 0, making L[128-0] = L[128] an OOB\n  // access on a 128-element Uint8Array (silently returns undefined, producing\n  // a wrong key schedule). Values > 1024 exceed the RFC 2268 key schedule table.\n  if (!Number.isInteger(effectiveBits) || effectiveBits < 1 || effectiveBits > 1024) {\n    throw new Error(`rc2ExpandKey: effectiveBits must be an integer in [1, 1024], got ${effectiveBits}`)\n  }\n  const T = key.length\n  const T8 = Math.ceil(effectiveBits / 8)\n  // 0xff >> (effectiveBits & 7) gives 0xff for multiples-of-8 effective lengths\n  // (no masking), and a smaller mask for non-multiples.\n  const TM = 0xff >> (effectiveBits & 7)\n  const L = new Uint8Array(128)\n  for (let i = 0; i < T; i++) {\n    L[i] = key[i]\n  }\n  for (let i = T; i < 128; i++) {\n    L[i] = RC2_PITABLE[(L[i - 1] + L[i - T]) & 0xff]\n  }\n  L[128 - T8] = RC2_PITABLE[L[128 - T8] & TM]\n  for (let i = 127 - T8; i >= 0; i--) {\n    L[i] = RC2_PITABLE[L[i + 1] ^ L[i + T8]]\n  }\n  const K: number[] = new Array(64)\n  for (let i = 0; i < 64; i++) {\n    K[i] = L[2 * i] | (L[2 * i + 1] << 8)\n  }\n  return K\n}\n\n/** Rotate a 16-bit word right by `bits` positions. */\nfunction ror16(word: number, bits: number): number {\n  return ((word & 0xffff) >> bits) | ((word << (16 - bits)) & 0xffff)\n}\n\n/**\n * Decrypt `data` using RC2-CBC with PKCS#7 padding removal (RFC 2268).\n *\n * Used for pbeWithSHAAnd40BitRC2CBC  (OID 1.2.840.113549.1.12.1.6) and\n *          pbeWithSHAAnd128BitRC2CBC (OID 1.2.840.113549.1.12.1.5).\n *\n * These OIDs are commonly used to encrypt certificate bags in PKCS#12\n * files produced by OpenSSL and Windows with default settings. Node.js 22+\n * (OpenSSL 3 default provider) does not support RC2 via `createDecipheriv`.\n */\nfunction rc2CbcDecrypt(key: Buffer, iv: Buffer, data: Buffer, effectiveBits: number): Buffer {\n  // Guard: a non-multiple-of-8 ciphertext causes the last partial block to be\n  // processed with `undefined` bytes.  In JS, `undefined | (undefined << 8)`\n  // produces NaN, and `NaN & 0xffff` produces 0 — so partial blocks silently\n  // produce garbage output rather than throwing.\n  if (data.length === 0 || data.length % 8 !== 0) {\n    throw new Error(`rc2CbcDecrypt: ciphertext length ${data.length} is not a positive multiple of the 8-byte RC2 block size`)\n  }\n  if (iv.length !== 8) {\n    throw new Error(`rc2CbcDecrypt: IV must be exactly 8 bytes, got ${iv.length}`)\n  }\n  const K = rc2ExpandKey(key, effectiveBits)\n  const out = Buffer.alloc(data.length)\n  const prev = Buffer.from(iv) // CBC running state; starts as the IV\n\n  for (let offset = 0; offset < data.length; offset += 8) {\n    const ct = data.subarray(offset, offset + 8)\n    // Parse ciphertext block as four little-endian 16-bit words\n    const R = [(ct[0] | (ct[1] << 8)) & 0xffff, (ct[2] | (ct[3] << 8)) & 0xffff, (ct[4] | (ct[5] << 8)) & 0xffff, (ct[6] | (ct[7] << 8)) & 0xffff]\n\n    // Reverse the encryption round plan [5 mix, 1 mash, 6 mix, 1 mash, 5 mix].\n    // For decryption j starts at 63 and decrements in each reverse-mix step.\n    let j = 63\n\n    const rMix = () => {\n      for (let i = 3; i >= 0; i--) {\n        R[i] = ror16(R[i], RC2_ROT[i])\n        const r3 = R[(i + 3) % 4]\n        R[i] = (R[i] - K[j] - (r3 & R[(i + 2) % 4]) - (~r3 & 0xffff & R[(i + 1) % 4])) & 0xffff\n        j--\n      }\n    }\n\n    const rMash = () => {\n      for (let i = 3; i >= 0; i--) {\n        R[i] = (R[i] - K[R[(i + 3) % 4] & 63]) & 0xffff\n      }\n    }\n\n    for (let n = 0; n < 5; n++) {\n      rMix()\n    }\n    rMash()\n    for (let n = 0; n < 6; n++) {\n      rMix()\n    }\n    rMash()\n    for (let n = 0; n < 5; n++) {\n      rMix()\n    }\n\n    // XOR decrypted words with previous ciphertext block (CBC mode)\n    for (let i = 0; i < 4; i++) {\n      out[offset + i * 2] = (R[i] & 0xff) ^ prev[i * 2]\n      out[offset + i * 2 + 1] = (R[i] >> 8) ^ prev[i * 2 + 1]\n    }\n    // Advance CBC state to current ciphertext block\n    ct.copy(prev)\n  }\n\n  // Validate and strip PKCS#7 padding.\n  // Without this guard, padLen = 0 silently returns the full buffer (no stripping)\n  // and padLen > 8 causes Buffer.subarray(0, negative) → empty buffer, both\n  // silently.  A wrong key/IV produces decrypted bytes that fail this check.\n  const padLen = out[out.length - 1]\n  if (padLen < 1 || padLen > 8) {\n    throw new Error(`rc2CbcDecrypt: invalid PKCS#7 pad byte 0x${padLen.toString(16).padStart(2, \"0\")} — the ciphertext is corrupt or the wrong key/IV was used`)\n  }\n  for (let i = out.length - padLen; i < out.length; i++) {\n    if (out[i] !== padLen) {\n      throw new Error(`rc2CbcDecrypt: invalid PKCS#7 padding — the ciphertext is corrupt or the wrong key/IV was used`)\n    }\n  }\n  return out.subarray(0, out.length - padLen)\n}\n\n/** PKCS#12 legacy PBE OIDs (pkcs-12PbeIds) and their cipher parameters. */\nconst PKCS12_PBE_ALGOS: Record<string, { cipher: string; keyLen: number; ivLen: number; rc2Bits?: number }> = {\n  \"1.2.840.113549.1.12.1.3\": { cipher: \"des-ede3-cbc\", keyLen: 24, ivLen: 8 }, // pbeWithSHAAnd3KeyTripleDESCBC\n  \"1.2.840.113549.1.12.1.4\": { cipher: \"des-ede-cbc\", keyLen: 16, ivLen: 8 }, //  pbeWithSHAAnd2KeyTripleDESCBC\n  \"1.2.840.113549.1.12.1.5\": { cipher: \"rc2-cbc\", keyLen: 16, ivLen: 8, rc2Bits: 128 }, // pbeWithSHAAnd128BitRC2CBC\n  \"1.2.840.113549.1.12.1.6\": { cipher: \"rc2-cbc\", keyLen: 5, ivLen: 8, rc2Bits: 40 }, //  pbeWithSHAAnd40BitRC2CBC\n}\n\n/**\n * Maximum PKCS#12 PBE iteration count accepted.\n *\n * A maliciously crafted PFX can set iterations to Number.MAX_SAFE_INTEGER,\n * causing the SHA-1 loop to run for an arbitrary amount of time (DoS).\n * Real-world PFX files use 1 000–50 000 iterations; this cap is generous\n * enough to accommodate even unusually high-security certs while blocking\n * obviously hostile inputs.\n */\nconst MAX_PKCS12_PBE_ITERATIONS = 300_000\n\n/**\n * PKCS#12 key/IV derivation function from RFC 7292 Appendix B (SHA-1 variant).\n * id = 1 to derive a key, id = 2 to derive an IV.\n *\n * Throws if `iterations` is outside [1, MAX_PKCS12_PBE_ITERATIONS] to prevent\n * CPU exhaustion from a crafted PFX file.\n */\nfunction pkcs12PbeDeriveKey(password: Buffer, salt: Buffer, iterations: number, id: number, length: number): Buffer {\n  if (!Number.isInteger(iterations) || iterations < 1 || iterations > MAX_PKCS12_PBE_ITERATIONS) {\n    throw new Error(\n      `PKCS#12 PBE iteration count ${iterations} is outside safe range [1, ${MAX_PKCS12_PBE_ITERATIONS}]; refusing to process — the file may be crafted to exhaust CPU`\n    )\n  }\n  // A crafted PFX could supply a multi-megabyte salt, causing Buffer.alloc(sLen) inside\n  // the KDF to allocate gigabytes (sLen = ceil(salt.length / 64) * 64).\n  const MAX_SALT_BYTES = 4096\n  if (salt.length > MAX_SALT_BYTES) {\n    throw new Error(`PKCS#12 PBE salt length ${salt.length} exceeds the safe maximum of ${MAX_SALT_BYTES} bytes — the file may be crafted to exhaust memory`)\n  }\n\n  const u = 20 // SHA-1 output bytes\n  const v = 64 // SHA-1 block bytes\n\n  // Step 1: D = ID byte repeated v times\n  const D = Buffer.alloc(v, id)\n\n  // Step 2: S = salt bytes repeated to fill ceil(salt.length / v) * v bytes\n  const sLen = salt.length > 0 ? Math.ceil(salt.length / v) * v : 0\n  const S = Buffer.alloc(sLen)\n  for (let i = 0; i < sLen; i++) {\n    S[i] = salt[i % salt.length]\n  }\n\n  // Step 3: P = password bytes repeated to fill ceil(password.length / v) * v bytes\n  const pLen = password.length > 0 ? Math.ceil(password.length / v) * v : 0\n  const P = Buffer.alloc(pLen)\n  for (let i = 0; i < pLen; i++) {\n    P[i] = password[i % password.length]\n  }\n\n  // Step 4: I = S || P (mutable, updated in step 6C)\n  const I = new Uint8Array(Buffer.concat([S, P]))\n\n  const c = Math.ceil(length / u)\n  const result = Buffer.alloc(c * u)\n\n  for (let i = 0; i < c; i++) {\n    // Step 6A: A_i = H^iterations(D || I)\n    let Ai: Buffer = createHash(\"sha1\").update(D).update(Buffer.from(I)).digest()\n    for (let j = 1; j < iterations; j++) {\n      Ai = createHash(\"sha1\").update(Ai).digest()\n    }\n    Ai.copy(result, i * u)\n\n    // Step 6B: B = A_i repeated to fill v bytes\n    const B = new Uint8Array(v)\n    for (let j = 0; j < v; j++) {\n      B[j] = Ai[j % u]\n    }\n\n    // Step 6C: each v-byte block of I is incremented by (B + 1) mod 2^(v*8)\n    const blockCount = Math.ceil(I.length / v)\n    for (let j = 0; j < blockCount; j++) {\n      let carry = 1\n      for (let b = v - 1; b >= 0; b--) {\n        const idx = j * v + b\n        if (idx < I.length) {\n          const sum = I[idx] + B[b] + carry\n          I[idx] = sum & 0xff\n          carry = sum >> 8\n        }\n      }\n    }\n  }\n\n  return result.subarray(0, length)\n}\n\n/**\n * Encode a password as UTF-16 Big Endian with a null terminator, which is the\n * format required by PKCS#12 PBE key derivation (RFC 7292).\n * An empty string yields [0x00, 0x00] (just the null terminator).\n */\nfunction pkcs12PasswordToUtf16(password: string): Buffer {\n  const buf = Buffer.alloc((password.length + 1) * 2)\n  for (let i = 0; i < password.length; i++) {\n    const code = password.charCodeAt(i)\n    buf[i * 2] = (code >> 8) & 0xff\n    buf[i * 2 + 1] = code & 0xff\n  }\n  // Last two bytes are already 0x00 0x00 (null terminator) from Buffer.alloc.\n  return buf\n}\n\n/**\n * Decrypt PKCS#12 legacy PBE encrypted content using Node.js crypto.\n *\n * @param algId   - OID from PKCS12_PBE_ALGOS\n * @param algParams - asn1js object for PKCS12PBEParams (SEQUENCE { OCTET STRING, INTEGER })\n * @param encContent - asn1js object for the encrypted content (Constructed or Primitive [0] IMPLICIT)\n * @param password - plain-text password string\n */\nfunction decryptLegacyPkcs12Pbe(algId: string, algParams: any, encContent: any, password: string): Buffer {\n  const algo = PKCS12_PBE_ALGOS[algId]\n\n  // PKCS12PBEParams ::= SEQUENCE { salt OCTET STRING, iterations INTEGER }\n  const salt = Buffer.from(algParams.valueBlock.value[0].valueBlock.valueHexView)\n  const iterations = Number(algParams.valueBlock.value[1].valueBlock.valueDec)\n\n  const pwdBytes = pkcs12PasswordToUtf16(password)\n  const key = pkcs12PbeDeriveKey(pwdBytes, salt, iterations, 1, algo.keyLen)\n  const iv = pkcs12PbeDeriveKey(pwdBytes, salt, iterations, 2, algo.ivLen)\n\n  // Extract raw encrypted bytes from the [0] IMPLICIT OCTET STRING.\n  // The encryptedContent field can be a Constructed (fragmented) or Primitive tag.\n  let encBytes: Buffer\n  if (encContent.idBlock?.isConstructed) {\n    encBytes = Buffer.concat((encContent.valueBlock.value as any[]).map((p: any) => Buffer.from(p.valueBlock.valueHexView)))\n  } else {\n    encBytes = Buffer.from(encContent.valueBlock.valueHexView)\n  }\n\n  if (algo.rc2Bits != null) {\n    // RC2 is not available in Node.js 22+ via createDecipheriv (OpenSSL 3 moved\n    // it to the legacy provider which is not loaded by default). Use our pure-TS\n    // RFC 2268 implementation instead.\n    return rc2CbcDecrypt(key, iv, encBytes, algo.rc2Bits)\n  }\n\n  const decipher = createDecipheriv(algo.cipher, key, iv)\n  return Buffer.concat([decipher.update(encBytes), decipher.final()])\n}\n\n/**\n * Reads certificate info from a PKCS#12 (.pfx) file using pkijs (unobfuscated TypeScript).\n * Mirrors the `certificate-info` subcommand of app-builder-bin.\n * https://github.com/develar/app-builder/blob/master/pkg/codesign/p12.go\n *\n * Returns { commonName, bloodyMicrosoftSubjectDn } on success.\n *\n * Known divergences from the Go binary:\n * - No OpenSSL fallback when the pure PKCS#12 decoder fails for a non-password reason.\n * - Unknown OIDs are rendered using the raw numeric OID as the type name (e.g. `2.5.4.100=value`); Go uses `OID=#hexbytes` when ASN.1 marshal succeeds.\n * - RDN ordering uses DER order; Go normalizes via pkix.Name.ToRDNSequence then reverses via\n *   BloodyMsString. These coincide for pkijs-generated certs (CN-first DER) but may\n *   differ for real CA-issued certs stored in traditional C-first DER order.\n */\nexport async function readCertInfo(file: string, password: string): Promise<{ commonName: string; bloodyMicrosoftSubjectDn: string }> {\n  const pfxDer = await readFile(file)\n\n  // asn1js requires a plain ArrayBuffer\n  const pfxBuf = toArrayBuffer(pfxDer)\n  let asn1: ReturnType<typeof asn1js.fromBER>\n  try {\n    asn1 = asn1js.fromBER(pfxBuf)\n    if (asn1.offset === -1) {\n      throw new Error(\"offset -1: invalid BER encoding\")\n    }\n  } catch (err) {\n    throw new Error(`PKCS#12 file \"${file}\" contains invalid ASN.1/DER data: ${err instanceof Error ? err.message : String(err)}`)\n  }\n\n  const pfx = new pkijs.PFX({ schema: asn1.result })\n  const pwBuf = toArrayBuffer(Buffer.from(password, \"utf-8\"))\n\n  // Step 1: Verify MAC (or signature) integrity and parse the AuthenticatedSafe container.\n  // pkijs throws \"Integrity for the PKCS#12 data is broken!\" on wrong password.\n  try {\n    await pfx.parseInternalValues({ password: pwBuf, checkIntegrity: true })\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err)\n    const lower = detail.toLowerCase()\n    if (lower.includes(\"integrity\") || lower.includes(\"mac\") || lower.includes(\"password\") || lower.includes(\"pkcs#12\")) {\n      throw new Error(`password incorrect for certificate file \"${file}\" — verify the password matches the PFX. pkijs detail: ${detail}`)\n    }\n    log.debug({ file, error: detail }, \"pkijs failed to decode PKCS#12; no OpenSSL fallback available in Node.js\")\n    throw new Error(`Failed to decode PKCS#12 file \"${file}\" — the file may be corrupt, use an unsupported cipher, or require OpenSSL. pkijs detail: ${detail}`)\n  }\n\n  const authSafe = pfx.parsedValue?.authenticatedSafe\n  if (authSafe == null) {\n    throw new Error(`Failed to parse AuthenticatedSafe in PKCS#12 file \"${file}\"`)\n  }\n\n  // Step 2: Iterate over the authenticated-safe ContentInfos and extract all certificates.\n  //\n  // We do NOT call authSafe.parseInternalValues() because pkijs's CryptoEngine only handles\n  // PBES2 (OID 1.2.840.113549.1.5.13) for EncryptedData. Real-world PFX files (including\n  // CA-issued and electron-builder-generated certs) often use the older pkcs-12PbeIds ciphers\n  // (e.g. pbeWithSHAAnd3KeyTripleDESCBC). We handle those with our own Node.js crypto path.\n  const certs: pkijs.Certificate[] = []\n\n  for (const ci of authSafe.safeContents) {\n    let safeBER: ArrayBuffer\n\n    if (ci.contentType === pkijs.id_ContentType_Data) {\n      // Data: content is an OCTET STRING containing DER-encoded SafeContents.\n      safeBER = (ci.content as asn1js.OctetString).getValue()\n    } else if (ci.contentType === pkijs.id_ContentType_EncryptedData) {\n      // EncryptedData: decrypt the SafeContents, routing by algorithm OID.\n      const encData = new pkijs.EncryptedData({ schema: ci.content })\n      const algId = encData.encryptedContentInfo.contentEncryptionAlgorithm.algorithmId\n\n      if (Object.prototype.hasOwnProperty.call(PKCS12_PBE_ALGOS, algId)) {\n        // Legacy PKCS#12 PBE (pbeWithSHAAnd*) — use our RFC 7292 implementation.\n        const decrypted = decryptLegacyPkcs12Pbe(\n          algId,\n          encData.encryptedContentInfo.contentEncryptionAlgorithm.algorithmParams,\n          encData.encryptedContentInfo.encryptedContent,\n          password\n        )\n        safeBER = toArrayBuffer(decrypted)\n      } else {\n        // PBES2 or other modern OID — delegate to the pkijs engine.\n        safeBER = await encData.decrypt({ password: pwBuf })\n      }\n    } else {\n      // EnvelopedData or other types — skip (not needed for cert extraction).\n      continue\n    }\n\n    // Parse SafeContents and collect X.509 certificates from cert bags.\n    const sc = pkijs.SafeContents.fromBER(safeBER)\n    for (const bag of sc.safeBags) {\n      if (bag.bagId === CERT_BAG_OID) {\n        const certBag = bag.bagValue as pkijs.CertBag\n        if (certBag.parsedValue instanceof pkijs.Certificate) {\n          certs.push(certBag.parsedValue)\n        }\n      }\n    }\n  }\n\n  if (certs.length === 0) {\n    throw new Error(`No certificates found in PKCS#12 file \"${file}\" — the file may be a key-only PFX or be empty`)\n  }\n\n  // Find the certificate with the codeSigning Extended Key Usage.\n  // pkijs auto-parses known extensions via ExtensionValueFactory (registered at module init).\n  const signingCert = certs.find(cert => {\n    const ekuExt = cert.extensions?.find(e => e.extnID === pkijs.id_ExtKeyUsage)\n    if (ekuExt == null) {\n      return false\n    }\n    if (ekuExt.parsedValue instanceof pkijs.ExtKeyUsage) {\n      return ekuExt.parsedValue.keyPurposes.includes(CODE_SIGNING_OID)\n    }\n    // Fallback: manually parse the extension OctetString value.\n    try {\n      const inner = asn1js.fromBER(ekuExt.extnValue.valueBlock.valueHexView)\n      if (inner.offset === -1) {\n        return false\n      }\n      const eku = new pkijs.ExtKeyUsage({ schema: inner.result })\n      return eku.keyPurposes.includes(CODE_SIGNING_OID)\n    } catch {\n      return false\n    }\n  })\n\n  if (signingCert == null) {\n    throw new Error(\n      `No certificate with ExtKeyUsageCodeSigning found in \"${file}\" — ${certs.length} certificate(s) present but none have the codeSigning extended key usage. ` +\n        `Ensure the PFX contains a code-signing certificate, not just a CA or TLS certificate.`\n    )\n  }\n\n  const cnAttr = signingCert.subject.typesAndValues.find(a => a.type === \"2.5.4.3\")\n  const commonName = String(cnAttr?.value.valueBlock.value ?? \"\")\n\n  // Format DN as \"CN=X,O=X,...\" matching Go's BloodyMsString output.\n  // Uses ATTRIBUTE_TYPE_NAMES to mirror Go's attributeTypeNames map exactly, so STREET,\n  // POSTALCODE, and SERIALNUMBER (present in EV code-signing certs) are handled correctly.\n  // Unknown OIDs fall back to the bare OID string as the type name.\n  const bloodyMicrosoftSubjectDn = signingCert.subject.typesAndValues\n    .map(a => {\n      const typeName = ATTRIBUTE_TYPE_NAMES[a.type] ?? a.type\n      return `${typeName}=${escapeDnValue(String(a.value.valueBlock.value))}`\n    })\n    .join(\",\")\n\n  return { commonName, bloodyMicrosoftSubjectDn }\n}\n\n/**\n * Reads certificate info from a plain X.509 certificate file (.crt / .cer).\n * Accepts both PEM (base64 with -----BEGIN CERTIFICATE----- headers) and DER (raw binary) encoding.\n *\n * Unlike `readCertInfo`, this does not require a password and does not parse PKCS#12.\n * Used when HSM mode supplies a public-cert-only file alongside /csp + /kc or pkcs11Module.\n *\n * Returns `null` when the publisher name cannot be determined (e.g. no CN attribute), so\n * callers should fall back to requiring an explicit `publisherName` in that case.\n */\nexport async function readCertInfoFromX509(file: string): Promise<{ commonName: string; bloodyMicrosoftSubjectDn: string } | null> {\n  const raw = await readFile(file)\n\n  // Support PEM (ASCII armor) and DER (raw binary) encoding.\n  let derBytes: Buffer\n  const pemContent = raw.toString(\"ascii\")\n  if (pemContent.includes(\"-----BEGIN CERTIFICATE-----\")) {\n    const b64 = pemContent\n      .replace(/-----BEGIN CERTIFICATE-----/g, \"\")\n      .replace(/-----END CERTIFICATE-----/g, \"\")\n      .replace(/\\s+/g, \"\")\n    derBytes = Buffer.from(b64, \"base64\")\n  } else {\n    derBytes = raw\n  }\n\n  let cert: pkijs.Certificate\n  try {\n    const asn1Result = asn1js.fromBER(toArrayBuffer(derBytes))\n    if (asn1Result.offset === -1) {\n      throw new Error(\"offset -1: invalid BER encoding\")\n    }\n    cert = new pkijs.Certificate({ schema: asn1Result.result })\n  } catch (err) {\n    throw new Error(`X.509 certificate file \"${file}\" could not be parsed: ${err instanceof Error ? err.message : String(err)}`)\n  }\n\n  const cnAttr = cert.subject.typesAndValues.find(a => a.type === \"2.5.4.3\")\n  if (cnAttr == null) {\n    return null\n  }\n  const commonName = String(cnAttr.value.valueBlock.value)\n\n  const bloodyMicrosoftSubjectDn = cert.subject.typesAndValues\n    .map(a => {\n      const typeName = ATTRIBUTE_TYPE_NAMES[a.type] ?? a.type\n      return `${typeName}=${escapeDnValue(String(a.value.valueBlock.value))}`\n    })\n    .join(\",\")\n\n  return { commonName, bloodyMicrosoftSubjectDn }\n}\n\n/**\n * Internal functions exported exclusively for unit testing.\n * Not part of the public API — do not use outside of test files.\n */\nexport const _testingOnly = {\n  pkcs12PbeDeriveKey,\n  pkcs12PasswordToUtf16,\n  rc2CbcDecrypt,\n  MAX_PKCS12_PBE_ITERATIONS,\n}\n"]}

package/dist/codeSign/mac/macCodeSign.d.ts

@@ -1,4 +1,4 @@
-import type { SignOptions } from "@electron/osx-sign/dist/cjs/types";
+import type { SignOptions } from "@electron/osx-sign";
 import { TmpDir } from "builder-util";
 import { Nullish } from "builder-util-runtime";
 export declare const appleCertificatePrefixes: string[];
@@ -22,8 +22,8 @@ export declare function sign(opts: SignOptions): Promise<void>;
 export declare let findIdentityRawResult: Promise<Array<string>> | null;
 export declare class Identity {
     readonly name: string;
-    readonly hash?: string;
-    constructor(name: string, hash?: string);
+    readonly hash?: string | undefined;
+    constructor(name: string, hash?: string | undefined);
 }
 export declare function findIdentity(certType: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null>;
 //# sourceMappingURL=macCodeSign.d.ts.map

package/dist/codeSign/mac/macCodeSign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"macCodeSign.d.ts","sourceRoot":"","sources":["../../../src/codeSign/mac/macCodeSign.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAA;AACpE,OAAO,EAAyG,MAAM,EAAkB,MAAM,cAAc,CAAA;AAC5J,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAW9C,eAAO,MAAM,wBAAwB,UAAyI,CAAA;AAE9K,MAAM,MAAM,QAAQ,GAChB,0BAA0B,GAC1B,wBAAwB,GACxB,qCAAqC,GACrC,mCAAmC,GACnC,eAAe,GACf,mBAAmB,GACnB,oBAAoB,CAAA;AAExB,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,wBAAgB,aAAa,CAAC,WAAW,UAAO,GAAG,OAAO,CA6BzD;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,EAAE,kBAAkB,EAAE,OAAO,iBAqCvK;AAsCD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,UAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAOnF;AAED,wBAAsB,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CA6ChK;AAiBD,wBAAsB,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3D;AAED,eAAO,IAAI,qBAAqB,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,IAAW,CAAA;AAsFtE,MAAM,CAAC,OAAO,OAAO,QAAQ;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;gBAEV,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;CACxC;AAUD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAe9H"}
+{"version":3,"file":"macCodeSign.d.ts","sourceRoot":"","sources":["../../../src/codeSign/mac/macCodeSign.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAErD,OAAO,EAAyG,MAAM,EAAkB,MAAM,cAAc,CAAA;AAC5J,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAU9C,eAAO,MAAM,wBAAwB,UAAyI,CAAA;AAE9K,MAAM,MAAM,QAAQ,GAChB,0BAA0B,GAC1B,wBAAwB,GACxB,qCAAqC,GACrC,mCAAmC,GACnC,eAAe,GACf,mBAAmB,GACnB,oBAAoB,CAAA;AAExB,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,wBAAgB,aAAa,CAAC,WAAW,UAAO,GAAG,OAAO,CA6BzD;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,EAAE,kBAAkB,EAAE,OAAO,iBAqCvK;AAsCD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,UAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAOnF;AAED,wBAAsB,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CA6ChK;AAiBD,wBAAsB,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3D;AAED,eAAO,IAAI,qBAAqB,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,IAAW,CAAA;AAiHtE,qBAAa,QAAQ;IAEjB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;gBADb,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,YAAA;CAEzB;AASD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAe9H"}

package/dist/codeSign/mac/macCodeSign.js

@@ -1,3 +1,4 @@
+import { sign as _sign } from "@electron/osx-sign";
 import { copyFile, exec, InvalidConfigurationError, isEmptyOrSpaces, isPullRequest, log, Logger, retry, unlinkIfExists } from "builder-util";
 import { createHash, randomBytes } from "crypto";
 import { rename } from "fs/promises";
@@ -5,7 +6,6 @@ import { Lazy } from "lazy-val";
 import { homedir, tmpdir } from "os";
 import * as path from "path";
 import { getTempName } from "temp-file";
-import { dynamicImport } from "../../util/dynamicImport.js";
 import { isAutoDiscoveryCodeSignIdentity, isCscForPullRequest, isTravis } from "../../util/flags.js";
 import { importCertificate } from "../codesign.js";
 export const appleCertificatePrefixes = ["Developer ID Application:", "Developer ID Installer:", "3rd Party Mac Developer Application:", "3rd Party Mac Developer Installer:"];
@@ -80,7 +80,7 @@ const bundledCertKeychainAdded = new Lazy(async () => {
     const keychainPath = path.join(cacheDir, "electron-builder-root-certs.keychain");
     const results = await Promise.all([
         listUserKeychains(),
-        copyFile(path.join(import.meta.dirname, "..", "..", "certs", "root_certs.keychain"), tmpKeychainPath).then(() => rename(tmpKeychainPath, keychainPath)),
+        copyFile(path.join(import.meta.dirname, "..", "..", "..", "certs", "root_certs.keychain"), tmpKeychainPath).then(() => rename(tmpKeychainPath, keychainPath)),
     ]);
     const list = results[0];
     if (!list.includes(keychainPath)) {
@@ -161,14 +161,22 @@ async function importCerts(keychainFile, paths, keyPasswords) {
     };
 }
 export async function sign(opts) {
-    const { signAsync } = await dynamicImport("@electron/osx-sign");
-    return retry(() => signAsync(opts), {
+    return retry(() => _sign(opts), {
         retries: 3,
         interval: 5000,
         backoff: 5000,
     });
 }
 export let findIdentityRawResult = null;
+// Discovery of untrusted self-signed identities is OFF in production, and there is intentionally NO env var
+// or build-config option to enable it: an untrusted identity must never be silently accepted in a real
+// build. This in-process flag exists solely as a seam for electron-builder's own signing tests, which
+// provision an ephemeral self-signed cert and flip it via setAllowUntrustedSelfSignedIdentityForTesting().
+let allowUntrustedSelfSignedIdentity = false;
+/** @internal Test-only. Enables discovery of untrusted self-signed code-signing identities. Never use in production. */
+export function setAllowUntrustedSelfSignedIdentityForTesting(value) {
+    allowUntrustedSelfSignedIdentity = value;
+}
 async function getValidIdentities(keychain) {
     function addKeychain(args) {
         if (keychain != null) {
@@ -180,7 +188,7 @@ async function getValidIdentities(keychain) {
     if (result == null || keychain != null) {
         // https://github.com/electron-userland/electron-builder/issues/481
         // https://github.com/electron-userland/electron-builder/issues/535
-        result = Promise.all([
+        const commands = [
             exec("/usr/bin/security", addKeychain(["find-identity", "-v"])).then(it => it
                 .trim()
                 .split("\n")
@@ -193,10 +201,22 @@ async function getValidIdentities(keychain) {
                 return false;
             })),
             exec("/usr/bin/security", addKeychain(["find-identity", "-v", "-p", "codesigning"])).then(it => it.trim().split("\n")),
-        ]).then(it => {
-            const array = it[0]
-                .concat(it[1])
-                .filter(it => !it.includes("(Missing required extension)") && !it.includes("valid identities found") && !it.includes("iPhone ") && !it.includes("com.apple.idms.appleid.prd."))
+        ];
+        // Test-only seam: also accept untrusted self-signed identities. `find-identity` without `-v` lists them;
+        // trusted identities discovered above still take precedence (they appear first and dupes are de-duped).
+        if (allowUntrustedSelfSignedIdentity) {
+            commands.push(exec("/usr/bin/security", addKeychain(["find-identity"])).then(it => it.trim().split("\n")));
+        }
+        result = Promise.all(commands).then(it => {
+            const array = it
+                .flat()
+                .filter(it => !it.includes("(Missing required extension)") &&
+                !it.includes("identities found") &&
+                !it.includes("Policy: X.509 Basic") &&
+                !it.includes("Matching identities") &&
+                !it.includes("Valid identities only") &&
+                !it.includes("iPhone ") &&
+                !it.includes("com.apple.idms.appleid.prd."))
                 // remove 1)
                 .map(it => it.substring(it.indexOf(")") + 1).trim());
             return Array.from(new Set(array));
@@ -217,7 +237,7 @@ async function _findIdentity(type, qualifier, keychain) {
             continue;
         }
         if (line.includes(namePrefix)) {
-            return await parseIdentity(line);
+            return parseIdentity(line);
         }
     }
     if (type === "Developer ID Application") {
@@ -235,17 +255,23 @@ async function _findIdentity(type, qualifier, keychain) {
                     continue l;
                 }
             }
-            return await parseIdentity(line);
+            return parseIdentity(line);
         }
     }
     return null;
 }
-async function parseIdentity(line) {
+// @electron/osx-sign v2 no longer exposes its `Identity` class via the package's public exports, so we own this lightweight equivalent.
+export class Identity {
+    constructor(name, hash) {
+        this.name = name;
+        this.hash = hash;
+    }
+}
+function parseIdentity(line) {
     const firstQuoteIndex = line.indexOf('"');
     const name = line.substring(firstQuoteIndex + 1, line.lastIndexOf('"'));
     const hash = line.substring(0, firstQuoteIndex - 1);
-    const { Identity: IdentityClass } = await dynamicImport("@electron/osx-sign/dist/cjs/util-identities");
-    return new IdentityClass(name, hash);
+    return new Identity(name, hash);
 }
 export function findIdentity(certType, qualifier, keychain) {
     let identity = qualifier || process.env.CSC_NAME;