app-builder-lib 27.0.0-alpha.7 → 27.0.0-alpha.9

package/dist/codeSign/win/signtoolBaseSignManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"signtoolBaseSignManager.js","sourceRoot":"","sources":["../../../src/codeSign/win/signtoolBaseSignManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AAC7E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EACL,kCAAkC,GAKnC,MAAM,6BAA6B,CAAA;AACpC,OAAO,UAAU,MAAM,iCAAiC,CAAA;AACxD,OAAO,UAAU,MAAM,iCAAiC,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGlD,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAA;AA8C3B,yGAAyG;AACzG,MAAM,UAAU,uBAAuB,CAAC,MAA4B;IAClE,MAAM,CAAC,GAAG,kCAAkC,CAAC,MAAM,CAAC,CAAA;IACpD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACpC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAAC,cAA6B,EAAE,QAAyB;IACtG,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAA;IAC1D,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAChC,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QACxB,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QAC7E,CAAC;QACD,OAAO,IAAI,KAAK,QAAQ,CAAC,UAAU,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,OAAgB,uBAAuB;IAG3C,YAA+B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;QAI3C,0BAAqB,GAAG,IAAI,IAAI,CAAuB,KAAK,IAAI,EAAE;YACzE,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;YAC1E,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,CAAA;YAC5C,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAA;YACb,CAAC;iBAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAA;gBAChD,OAAO,OAAO,CAAC,aAAa,CAAC,CAAA;YAC/B,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAA;YAC9C,OAAO,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QAEO,iBAAY,GAAG,IAAI,QAAQ,CAClC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAClB,KAAK,EAAC,GAAG,EAAC,EAAE;YACV,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAA;YAC/B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAA;YACb,CAAC;YAED,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;gBACzB,MAAM,wBAAwB,GAAG,OAAO,CAAC,OAAO,CAAA;gBAChD,OAAO;oBACL,UAAU,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAE;oBACxD,wBAAwB;iBACzB,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAA;YAC5B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;YACnD,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBAC7C,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;YAChE,CAAC;YACD,uDAAuD;YACvD,iFAAiF;YACjF,OAAO,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAA;QAC5C,CAAC,CACF,CAAA;QAED,2FAA2F;QAC1E,oCAA+B,GAAG,IAAI,IAAI,CAAO,GAAG,EAAE,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC,CAAA;QAqDpG,YAAO,GAAG,IAAI,QAAQ,CAC7B,GAAG,EAAE,CAAC,IAAI,CAAC,4BAA4B,EACvC,4BAA4B,CAAC,EAAE;YAC7B,MAAM,OAAO,GAAG,uBAAuB,CAAC,4BAA4B,CAAC,CAAA;YACrE,qFAAqF;YACrF,4FAA4F;YAC5F,MAAM,UAAU,GAAG,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,CAAA;YAEjE,kDAAkD;YAClD,MAAM,WAAW,GAAI,OAAyE,EAAE,sBAAsB,CAAA;YACtH,MAAM,OAAO,GAAI,OAAyE,EAAE,eAAe,CAAA;YAC3G,IAAI,WAAW,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK;qBAC1B,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;qBAC9E,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;oBAChB,kEAAkE;oBAClE,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;wBAC1B,MAAM,CAAC,CAAA;oBACT,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,mCAAmC,CAAC,CAAA;wBAC5D,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC,CAAC,CAAA;YACN,CAAC;YAED,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAA;YAChD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;gBAC5B,2FAA2F;gBAC3F,MAAM,mBAAmB,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;gBAC9E,OAAO,OAAO,CAAC,OAAO,CAAC;oBACrB,IAAI,EAAE,eAAe;oBACrB,QAAQ,EAAE,mBAAmB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,EAAE;iBAC1E,CAAC,CAAA;YACJ,CAAC;YAED,yFAAyF;YACzF,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;gBACxD,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;oBACtC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC9B,CAAC;gBAED,OAAO,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;qBACtF,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;oBAChB,IAAI,CAAC,YAAY,yBAAyB,EAAE,CAAC;wBAC3C,MAAM,IAAI,yBAAyB,CAAC,oDAAoD,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;oBACtG,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,CAAA;oBACT,CAAC;gBACH,CAAC,CAAC;qBACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACV,IAAI,EAAE,CAAC;oBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE;iBACzC,CAAC,CAAC,CAAA;YACP,CAAC;YAED,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC,CACF,CAAA;QAhKC,IAAI,CAAC,4BAA4B,GAAG,QAAQ,CAAC,eAAe,CAAA;IAC9D,CAAC;IAkDD;;;;;;;;;;;OAWG;IACO,KAAK,CAAC,6BAA6B;QAC3C,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;QAC1E,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,CAAA;QAC5C,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;YAC1B,gFAAgF;YAChF,OAAM;QACR,CAAC;QACD,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;YAC1B,kGAAkG;YAClG,OAAM;QACR,CAAC;QACD,MAAM,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;QAC7C,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAM;QACR,CAAC;QAED,IAAI,QAAgC,CAAA;QACpC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAA;QAC1C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,sFAAsF;YACtF,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,EAAE,kGAAkG,CAAC,CAAA;YACxI,OAAM;QACR,CAAC;QACD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,OAAM;QACR,CAAC;QAED,IAAI,CAAC,+BAA+B,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,yBAAyB,CACjC,2FAA2F;gBACzF,kPAAkP;gBAClP,+BAA+B,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI;gBAC7D,0BAA0B,QAAQ,CAAC,wBAAwB,IAAI;gBAC/D,iJAAiJ,CACpJ,CAAA;QACH,CAAC;IACH,CAAC;IA8DD,UAAU;QACR,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1B,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,aAA4B;QACrE,IAAI,CAAC,MAAM,YAAY,UAAU,IAAI,MAAM,YAAY,UAAU,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YACzG,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,iCAAiC,CAAC,CAAA;YACnF,OAAO,aAAa,IAAI,OAAO,CAAA;QACjC,CAAC;QAED,wFAAwF;QACxF,4FAA4F;QAC5F,8FAA8F;QAC9F,qDAAqD;QACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAA;QAC9C,MAAM,SAAS,GAAG,aAAa,IAAI,QAAQ,EAAE,wBAAwB,IAAI,IAAI,CAAA;QAC7E,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;QAClF,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;OAGG;IACO,iBAAiB,CAAC,UAAyD;QACnF,OAAO,CAAC,UAAU,CAAA,CAAC,qDAAqD;IAC1E,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAA2B;QACxC,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACxD,IAAI,MAAM,GAAG,OAAO,EAAE,qBAAqB,CAAA;QAC3C,oCAAoC;QACpC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,GAAG,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAC3E,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACpH,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;aAAM,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAA;QAE5D,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAA;QAEnI,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;QAExC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,GAAQ;gBACjB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;aACjC,CAAA;YACD,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;gBACtB,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,CAAA;YACzD,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG;oBACR,GAAG,OAAO;oBACV,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,IAAI,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc;iBACrE,CAAA;YACH,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;YAC5B,6FAA6F;YAC7F,8FAA8F;YAC9F,MAAM,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAA;QAClD,CAAC;aAAM,IAAI,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,gDAAgD,CAAC,CAAA;YAChG,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,CAAC,MAA0C,EAAE,QAAqB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QACrI,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,iBAAiB,GAAiC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YACzG,MAAM,OAAO,CAAC,OAAO,CACnB,QAAQ,CACN;gBACE,GAAG,iBAAiB;gBACpB,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC;aACjF,EACD,IAAI,CAAC,QAAQ,CACd,CACF,CAAA;YACD,MAAM,GAAG,IAAI,CAAA;YACb,IAAI,iBAAiB,CAAC,gBAAgB,IAAI,IAAI,EAAE,CAAC;gBAC/C,MAAM,MAAM,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,QAAgB;QAC9C,MAAM,kBAAkB,GAAG,4GAA4G,CAAA;QACvI,IAAI,CAAC;YACH,OAAO,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC3C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,IAAI,yBAAyB,CAAC,GAAG,kBAAkB,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,mBAAmB,CAAC,OAAqC,EAAE,KAAc,EAAE,KAAgB,IAAI,SAAS,EAAE;QACxG,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACrG,CAAC;IAES,eAAe;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAA;QACpD,2GAA2G;QAC3G,OAAO,CAAC,KAAK,OAAO,CAAA;IACtB,CAAC;IAKD,mGAAmG;IACzF,kBAAkB,CAAC,IAAmB,EAAE,OAAqC,EAAE,EAAa,EAAE,KAAc,EAAE,SAAS,GAAG,KAAK;QACvI,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8GAA8G,CAAC,CAAA;QACjI,CAAC;QACD,MAAM,eAAe,GAAI,OAAO,CAAC,OAA+B,CAAC,IAAI,CAAA;QAErE,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;YAC5B,wCAAwC;YACxC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;YACrF,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAmC,CAAA;YAC3D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;YACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YAC9B,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAA;YAEjE,IAAI,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;gBACzD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAA;YACnE,CAAC;iBAAM,IAAI,KAAK,IAAI,SAAS,IAAI,CAAC,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,MAAM,CAAC,EAAE,CAAC;gBACxF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAA;YAC/C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,yBAAyB,CAAC,2CAA2C,eAAe,iBAAiB,CAAC,CAAA;YAClH,CAAC;QACH,CAAC;IACH,CAAC;IAES,oBAAoB,CAAC,IAAmB,EAAE,OAAqC,EAAE,EAAa,EAAE,KAAc;QACtH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9C,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/C,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QACpC,CAAC;QAED,MAAM,QAAQ,GAAI,OAAO,CAAC,OAA+B,EAAE,QAAQ,CAAA;QACnE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACxD,MAAM,cAAc,GAAG,OAAO,EAAE,yBAAyB,CAAA;QACzD,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,IAAY;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,IAAI,GAAG,SAAS,EAAE,CAAC,CAAA;IAChH,CAAC;IAED,KAAK,CAAC,2BAA2B,CAAC,OAA6B,EAAE,EAAa;QAC5E,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAkE,CAAA;QACjH,MAAM,sBAAsB,GAAG,OAAO,EAAE,sBAAsB,CAAA;QAC9D,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;QAE/D,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAC3C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE;YAClC,YAAY;YACZ,iBAAiB;YACjB,UAAU;YACV,oIAAoI;SACrI,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAW,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;QACvF,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;YAChC,IACE,CAAC,sBAAsB,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;gBACtF,CAAC,eAAe,IAAI,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,EAClF,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,CAAA;YACxC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YACpE,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,+BAA+B,CAAC,CAAA;YAC/E,oEAAoE;YACpE,MAAM,mBAAmB,GAAG,UAAU,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAA;YAC5E,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAA;YAC1D,OAAO;gBACL,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,KAAK;gBACL,mBAAmB;aACpB,CAAA;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,2BAA2B,sBAAsB,IAAI,eAAe,gBAAgB,SAAS,EAAE,CAAC,CAAA;IAClH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QACpD,OAAO,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;IAC5G,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,aAAiD,EAAE,QAAqB;QACnF,kEAAkE;QAClE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAuB,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACnF,IAAI,IAAmB,CAAA;QACvB,IAAI,EAAa,CAAA;QACjB,iFAAiF;QACjF,6FAA6F;QAC7F,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAA;QACrC,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAA;QACzG,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,eAAe,CAAA;QAC7D,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;QAC1H,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;QAC1B,IAAI,eAAe,EAAE,CAAC;YACpB,EAAE,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;YAC5B,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;QAC3D,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,IAAI,SAAS,EAAE,CAAA;YACpB,IAAI,GAAG,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;QAED,sGAAsG;QACtG,0GAA0G;QAC1G,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;QACzG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE;YACnE,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,CAAC,CAAM,EAAE,EAAE;gBACtB,IACE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,2CAA2C,CAAC;oBAC/D,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,4DAA4D,CAAC;oBAChF,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,6DAA6D,CAAC;oBACjF,+FAA+F;oBAC/F,qGAAqG;oBACrG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,oEAAoE,CAAC,EACxF,CAAC;oBACD,GAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;oBACjG,OAAO,IAAI,CAAA;gBACb,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,uBAAuB;IACpD,sBAAsB,CAAC,OAAqC,EAAE,EAAa;QACnF,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAExD,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAErB,eAAe;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAA;YAC7D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YACnC,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,sBAAsB,IAAI,+BAA+B,CAAC,CAAC,CAAC,OAAO,EAAE,eAAe,IAAI,+BAA+B,CAAA;YACjK,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACzB,CAAC;QAED,cAAc;QACd,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAEhD,iBAAiB;QACjB,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC3B,+DAA+D;YAC/D,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;oBACpD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wDAAwD;YACxD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;YAC5C,6DAA6D;YAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACrG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAElD,mBAAmB;QACnB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA,CAAC,eAAe;QAEpC,OAAO,IAAI,CAAA;IACb,CAAC;IAES,uBAAuB,CAAC,OAAqC,EAAE,EAAa;QACpF,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAExD,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9D,OAAO,CAAC,gBAAgB,GAAG,UAAU,CAAA;QAErC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;QAE3D,eAAe;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;YACpD,MAAM,YAAY,GAAG,OAAO,EAAE,eAAe,IAAI,+BAA+B,CAAA;YAChF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;QAC/B,CAAC;QAED,mBAAmB;QACnB,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAEjD,iBAAiB;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;QAE3C,mEAAmE;QACnE,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAEnD,gBAAgB;QAChB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;QAC1C,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAC7B,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;CACF","sourcesContent":["import { asArray, InvalidConfigurationError, log, retry } from \"builder-util\"\nimport { MemoLazy, parseDn } from \"builder-util-runtime\"\nimport _fsExtra from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { Target } from \"../../core.js\"\nimport {\n  resolveWindowsSigningConfiguration,\n  WindowsConfiguration,\n  WindowsHsmSigningConfig,\n  WindowsSigntoolFamilyConfig,\n  WindowsSigntoolSigningConfig,\n} from \"../../options/winOptions.js\"\nimport AppXTarget from \"../../targets/win/AppxTarget.js\"\nimport MsixTarget from \"../../targets/win/MsixTarget.js\"\nimport { getSignToolPath } from \"../../toolsets/winCodeSign.js\"\nimport { ToolInfo } from \"../../util/bundledTool.js\"\nimport { resolveFunction } from \"../../util/resolve.js\"\nimport { withSigntoolLock } from \"../../util/toolsetLock.js\"\nimport { readCertInfo, readCertInfoFromX509 } from \"../certInfo.js\"\nimport { VmManager } from \"../../vm/vm.js\"\nimport type { WinPackager } from \"../../winPackager.js\"\nimport { importCertificate } from \"../codesign.js\"\nimport type { SignManager } from \"./signManager.js\"\nimport { WindowsSignOptions } from \"./windowsCodeSign.js\"\nconst { rename } = _fsExtra\n\nexport type CustomWindowsSign = (configuration: CustomWindowsSignTaskConfiguration, packager?: WinPackager) => Promise<any>\n\nexport interface WindowsSignToolOptions extends WindowsSignOptions {\n  readonly name: string\n  readonly site: string | null\n}\n\nexport interface FileCodeSigningInfo {\n  readonly file: string\n  readonly password: string | null\n}\n\nexport interface WindowsSignTaskConfiguration extends WindowsSignToolOptions {\n  readonly cscInfo: FileCodeSigningInfo | CertificateFromStoreInfo | null\n\n  // set if output path differs from input (e.g. osslsigncode cannot sign file in-place)\n  resultOutputPath?: string\n\n  hash: string\n  isNest: boolean\n}\n\nexport interface CustomWindowsSignTaskConfiguration extends WindowsSignTaskConfiguration {\n  computeSignToolArgs(isWin: boolean): Array<string>\n}\n\nexport interface CertificateInfo {\n  readonly commonName: string\n  readonly bloodyMicrosoftSubjectDn: string\n}\n\nexport interface CertificateFromStoreInfo {\n  thumbprint: string\n  subject: string\n  store: string\n  isLocalMachineStore: boolean\n}\n\ninterface CertInfo {\n  Subject: string\n  Thumbprint: string\n  PSParentPath: string\n}\n\n/** Extracts the non-Azure signing config from WindowsConfiguration, or null for Azure/unset/disabled. */\nexport function getSigntoolFamilyConfig(config: WindowsConfiguration): WindowsSigntoolFamilyConfig | null {\n  const s = resolveWindowsSigningConfiguration(config)\n  if (s == null || s.type === \"azure\") {\n    return null\n  }\n  return s\n}\n\n/**\n * Matches configured publisher names against a certificate subject using the same semantics as\n * electron-updater's update signature verifier (windowsExecutableCodeSignatureVerifier): a name that\n * parses as a Distinguished Name (DN) must match every RDN it specifies against the certificate\n * subject (extra subject RDNs are ignored); otherwise it is compared strictly against the\n * certificate's Common Name (CN). Passes when ANY configured name matches — multiple names are\n * supported for certificate rotation.\n */\nexport function publisherNameMatchesCertificate(publisherNames: Array<string>, certInfo: CertificateInfo): boolean {\n  const subject = parseDn(certInfo.bloodyMicrosoftSubjectDn)\n  return publisherNames.some(name => {\n    const dn = parseDn(name)\n    if (dn.size) {\n      return Array.from(dn.keys()).every(key => dn.get(key) === subject.get(key))\n    }\n    return name === certInfo.commonName\n  })\n}\n\nexport abstract class SigntoolBaseSignManager implements SignManager {\n  protected readonly platformSpecificBuildOptions: WindowsConfiguration\n\n  constructor(protected readonly packager: WinPackager) {\n    this.platformSpecificBuildOptions = packager.platformOptions\n  }\n\n  readonly computedPublisherName = new Lazy<Array<string> | null>(async () => {\n    const signing = getSigntoolFamilyConfig(this.platformSpecificBuildOptions)\n    const publisherName = signing?.publisherName\n    if (publisherName === null) {\n      return null\n    } else if (publisherName != null) {\n      await this.explicitPublisherNameValidation.value\n      return asArray(publisherName)\n    }\n\n    const certInfo = await this.lazyCertInfo.value\n    return certInfo == null ? null : [certInfo.commonName]\n  })\n\n  readonly lazyCertInfo = new MemoLazy<MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>, CertificateInfo | null>(\n    () => this.cscInfo,\n    async csc => {\n      const cscInfo = await csc.value\n      if (cscInfo == null) {\n        return null\n      }\n\n      if (\"subject\" in cscInfo) {\n        const bloodyMicrosoftSubjectDn = cscInfo.subject\n        return {\n          commonName: parseDn(bloodyMicrosoftSubjectDn).get(\"CN\")!,\n          bloodyMicrosoftSubjectDn,\n        }\n      }\n\n      const cscFile = cscInfo.file\n      if (cscFile == null) {\n        return null\n      }\n\n      const certExt = path.extname(cscFile).toLowerCase()\n      if (certExt === \".p12\" || certExt === \".pfx\") {\n        return await this.getCertInfo(cscFile, cscInfo.password || \"\")\n      }\n      // Non-PKCS12 files (.crt, .cer): parse as plain X.509.\n      // Returns null when the CN is absent — caller must set publisherName explicitly.\n      return await readCertInfoFromX509(cscFile)\n    }\n  )\n\n  // Memoized so the check runs once per build even though signFile is invoked once per file.\n  private readonly explicitPublisherNameValidation = new Lazy<void>(() => this.validateExplicitPublisherName())\n\n  /**\n   * When `publisherName` is explicitly configured and the subject of the local code signing\n   * certificate is known, fail the build if none of the configured names match the certificate.\n   * This catches signing with the wrong certificate at build time — otherwise the mismatch only\n   * surfaces at update time, when electron-updater rejects every update signed with that\n   * certificate.\n   *\n   * The check is intentionally skipped whenever the actual signing certificate's subject is not\n   * genuinely known: custom `sign` hooks, PKCS#11 without an extractable certificate file,\n   * x509 certificate files without a CN, or any error while reading certificate info.\n   * An explicit `publisherName: null` remains a pure opt-out (nothing to validate).\n   */\n  protected async validateExplicitPublisherName(): Promise<void> {\n    const signing = getSigntoolFamilyConfig(this.platformSpecificBuildOptions)\n    const publisherName = signing?.publisherName\n    if (publisherName == null) {\n      // not configured (auto-derive) or explicit `null` opt-out — nothing to validate\n      return\n    }\n    if (signing?.sign != null) {\n      // custom sign hook: electron-builder does not know which certificate the hook actually signs with\n      return\n    }\n    const publisherNames = asArray(publisherName)\n    if (publisherNames.length === 0) {\n      return\n    }\n\n    let certInfo: CertificateInfo | null\n    try {\n      certInfo = await this.lazyCertInfo.value\n    } catch (e: any) {\n      // this check must only fire when the signing certificate's subject is genuinely known\n      log.debug({ error: e.message || e }, \"skipping publisherName validation against the signing certificate (cannot read certificate info)\")\n      return\n    }\n    if (certInfo == null) {\n      return\n    }\n\n    if (!publisherNameMatchesCertificate(publisherNames, certInfo)) {\n      throw new InvalidConfigurationError(\n        `The configured publisherName does not match the subject of the code signing certificate. ` +\n          `This usually means the build is signing with the wrong certificate (for example, a code signing certificate for another platform or team leaked into WIN_CSC_LINK/CSC_LINK in CI) — electron-updater would reject every update signed with it.\\n` +\n          `  Configured publisherName: ${publisherNames.join(\" | \")}\\n` +\n          `  Certificate subject: ${certInfo.bloodyMicrosoftSubjectDn}\\n` +\n          `Fix win.publisherName (or sign with the intended certificate). To opt out of update signature verification entirely, set publisherName to null.`\n      )\n    }\n  }\n\n  readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(\n    () => this.platformSpecificBuildOptions,\n    platformSpecificBuildOptions => {\n      const signing = getSigntoolFamilyConfig(platformSpecificBuildOptions)\n      // signtool is the implicit default when win.sign is unset, so an absent config still\n      // honours the WIN_CSC_LINK/cscLink fallback below (hsm/pkcs11 set signing.type explicitly).\n      const isSigntool = signing == null || signing.type === \"signtool\"\n\n      // signtool + hsm: store-based cert takes priority\n      const subjectName = (signing as WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | null)?.certificateSubjectName\n      const shaType = (signing as WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | null)?.certificateSha1\n      if (subjectName != null || shaType != null) {\n        return this.packager.vm.value\n          .then(vm => this.getCertificateFromStoreInfo(platformSpecificBuildOptions, vm))\n          .catch((e: any) => {\n            // https://github.com/electron-userland/electron-builder/pull/2397\n            if (signing?.sign == null) {\n              throw e\n            } else {\n              log.debug({ error: e }, \"getCertificateFromStoreInfo error\")\n              return null\n            }\n          })\n      }\n\n      const certificateFile = signing?.certificateFile\n      if (certificateFile != null) {\n        // Only signtool mode uses a password (HSM private key lives in the HSM, not the cert file)\n        const certificatePassword = isSigntool ? this.packager.getCscPassword() : null\n        return Promise.resolve({\n          file: certificateFile,\n          password: certificatePassword == null ? null : certificatePassword.trim(),\n        })\n      }\n\n      // WIN_CSC_LINK env var fallback: only for signtool mode (including the implicit default)\n      if (isSigntool) {\n        const cscLink = this.packager.getCscLink(\"WIN_CSC_LINK\")\n        if (cscLink == null || cscLink === \"\") {\n          return Promise.resolve(null)\n        }\n\n        return importCertificate(cscLink, this.packager.tempDirManager, this.packager.projectDir)\n          .catch((e: any) => {\n            if (e instanceof InvalidConfigurationError) {\n              throw new InvalidConfigurationError(`Env WIN_CSC_LINK is not correct, cannot resolve: ${e.message}`)\n            } else {\n              throw e\n            }\n          })\n          .then(p => ({\n            file: p,\n            password: this.packager.getCscPassword(),\n          }))\n      }\n\n      return Promise.resolve(null)\n    }\n  )\n\n  initialize(): Promise<void> {\n    return Promise.resolve()\n  }\n\n  // https://github.com/electron-userland/electron-builder/issues/2108#issuecomment-333200711\n  async computePublisherName(target: Target, publisherName: string | null) {\n    if ((target instanceof AppXTarget || target instanceof MsixTarget) && (await this.cscInfo.value) == null) {\n      log.info({ reason: \"Windows Store only build\" }, \"AppX/MSIX package is not signed\")\n      return publisherName ?? \"CN=ms\"\n    }\n\n    // When a signing cert is available, the cert's subject MUST be used so the APPX package\n    // Publisher attribute matches the certificate — any mismatch causes SignerSign to fail with\n    // ERROR_BAD_FORMAT. Only honour a user-supplied publisherName if it was explicitly configured\n    // (non-null); otherwise derive from the certificate.\n    const certInfo = await this.lazyCertInfo.value\n    const publisher = publisherName ?? certInfo?.bloodyMicrosoftSubjectDn ?? null\n    if (publisher == null) {\n      throw new Error(\"Internal error: cannot compute subject using certificate info\")\n    }\n    return publisher\n  }\n\n  /**\n   * Called when cscInfo is null. Returns true to skip signing, false to proceed, or throws.\n   * Override in subclasses with different null-cert behaviour (HSM throws, PKCS#11 proceeds).\n   */\n  protected handleNullCscInfo(customSign: CustomWindowsSign | string | null | undefined): boolean {\n    return !customSign // default: skip when no cert and no custom sign hook\n  }\n\n  async signFile(options: WindowsSignOptions): Promise<boolean> {\n    const signing = getSigntoolFamilyConfig(options.options)\n    let hashes = signing?.signingHashAlgorithms\n    // msi does not support dual-signing\n    if (options.path.endsWith(\".msi\")) {\n      hashes = [hashes != null && !hashes.includes(\"sha1\") ? \"sha256\" : \"sha1\"]\n    } else if (options.path.endsWith(\".appx\") || options.path.endsWith(\".msix\") || options.path.endsWith(\".msixbundle\")) {\n      hashes = [\"sha256\"]\n    } else if (hashes == null) {\n      hashes = [\"sha1\", \"sha256\"]\n    } else {\n      hashes = Array.isArray(hashes) ? hashes : [hashes]\n    }\n\n    const name = this.packager.appInfo.productName\n    const site = await this.packager.appInfo.computePackageUrl()\n\n    const customSign = await resolveFunction(this.packager.appInfo.type, signing?.sign, \"sign\", await this.packager.getWorkspaceRoot())\n\n    const cscInfo = await this.cscInfo.value\n\n    if (cscInfo) {\n      let logInfo: any = {\n        file: log.filePath(options.path),\n      }\n      if (\"file\" in cscInfo) {\n        logInfo = { ...logInfo, certificateFile: cscInfo.file }\n      } else {\n        logInfo = {\n          ...logInfo,\n          subject: cscInfo.subject,\n          thumbprint: cscInfo.thumbprint,\n          store: cscInfo.store,\n          user: cscInfo.isLocalMachineStore ? \"local machine\" : \"current user\",\n        }\n      }\n      log.info(logInfo, \"signing\")\n      // validate an explicitly configured publisherName against the signing certificate before the\n      // first file is signed, so a wrong-certificate build fails even when no publish config exists\n      await this.explicitPublisherNameValidation.value\n    } else if (this.handleNullCscInfo(customSign)) {\n      log.debug({ signHook: !!customSign, cscInfo }, \"no signing info identified, signing is skipped\")\n      return false\n    }\n\n    const executor = customSign || ((config: CustomWindowsSignTaskConfiguration, packager: WinPackager) => this.doSign(config, packager))\n    let isNest = false\n    for (const hash of hashes) {\n      const taskConfiguration: WindowsSignTaskConfiguration = { ...options, name, site, cscInfo, hash, isNest }\n      await Promise.resolve(\n        executor(\n          {\n            ...taskConfiguration,\n            computeSignToolArgs: isWin => this.computeSignToolArgs(taskConfiguration, isWin),\n          },\n          this.packager\n        )\n      )\n      isNest = true\n      if (taskConfiguration.resultOutputPath != null) {\n        await rename(taskConfiguration.resultOutputPath, options.path)\n      }\n    }\n\n    return true\n  }\n\n  async getCertInfo(file: string, password: string): Promise<CertificateInfo> {\n    const errorMessagePrefix = \"Cannot extract publisher name from code signing certificate. As workaround, set win.publisherName. Error: \"\n    try {\n      return await readCertInfo(file, password)\n    } catch (e: any) {\n      throw new InvalidConfigurationError(`${errorMessagePrefix}${e.message || e}`)\n    }\n  }\n\n  // on windows be aware of http://stackoverflow.com/a/32640183/1910191\n  computeSignToolArgs(options: WindowsSignTaskConfiguration, isWin: boolean, vm: VmManager = new VmManager()): Array<string> {\n    return isWin ? this.computeWindowsSignArgs(options, vm) : this.computeOsslsigncodeArgs(options, vm)\n  }\n\n  protected isLegacyToolset(): boolean {\n    const v = this.packager.config.toolsets?.winCodeSign\n    // Only an explicit \"0.0.0\" pin is legacy; unset / null / \"latest\" / custom now resolve to a modern bundle.\n    return v === \"0.0.0\"\n  }\n\n  protected abstract computeWindowsSignArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string>\n  protected abstract computeOsslsigncodeArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string>\n\n  // allowX509: set to true by HsmSignManager to permit .crt/.cer (public chain only, key is in HSM).\n  protected addCertificateArgs(args: Array<string>, options: WindowsSignTaskConfiguration, vm: VmManager, isWin: boolean, allowX509 = false): void {\n    if (options.cscInfo == null) {\n      throw new Error(\"No code signing certificate configured. Provide certificateFile, certificateSha1, or certificateSubjectName.\")\n    }\n    const certificateFile = (options.cscInfo as FileCodeSigningInfo).file\n\n    if (certificateFile == null) {\n      // Certificate from store (Windows only)\n      if (!isWin) {\n        throw new Error(\"certificateSha1/certificateSubjectName supported only on Windows\")\n      }\n\n      const cscInfo = options.cscInfo as CertificateFromStoreInfo\n      args.push(\"/sha1\", cscInfo.thumbprint)\n      args.push(\"/s\", cscInfo.store)\n      if (cscInfo.isLocalMachineStore) {\n        args.push(\"/sm\")\n      }\n    } else {\n      const certExtension = path.extname(certificateFile).toLowerCase()\n\n      if (certExtension === \".p12\" || certExtension === \".pfx\") {\n        args.push(isWin ? \"/f\" : \"-pkcs12\", vm.toVmFile(certificateFile))\n      } else if (isWin && allowX509 && (certExtension === \".crt\" || certExtension === \".cer\")) {\n        args.push(\"/f\", vm.toVmFile(certificateFile))\n      } else {\n        throw new InvalidConfigurationError(`Please specify pkcs12 (.p12/.pfx) file, ${certificateFile} is not correct`)\n      }\n    }\n  }\n\n  protected addCommonSigningArgs(args: Array<string>, options: WindowsSignTaskConfiguration, vm: VmManager, isWin: boolean): void {\n    if (options.name) {\n      args.push(isWin ? \"/d\" : \"-n\", options.name)\n    }\n\n    if (options.site) {\n      args.push(isWin ? \"/du\" : \"-i\", options.site)\n    }\n\n    if (options.isNest) {\n      args.push(isWin ? \"/as\" : \"-nest\")\n    }\n\n    const password = (options.cscInfo as FileCodeSigningInfo)?.password\n    if (password) {\n      args.push(isWin ? \"/p\" : \"-pass\", password)\n    }\n\n    const signing = getSigntoolFamilyConfig(options.options)\n    const additionalCert = signing?.additionalCertificateFile\n    if (additionalCert) {\n      args.push(isWin ? \"/ac\" : \"-ac\", vm.toVmFile(additionalCert))\n    }\n  }\n\n  getOutputPath(inputPath: string, hash: string) {\n    const extension = path.extname(inputPath)\n    return path.join(path.dirname(inputPath), `${path.basename(inputPath, extension)}-signed-${hash}${extension}`)\n  }\n\n  async getCertificateFromStoreInfo(options: WindowsConfiguration, vm: VmManager): Promise<CertificateFromStoreInfo> {\n    const signing = getSigntoolFamilyConfig(options) as WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | null\n    const certificateSubjectName = signing?.certificateSubjectName\n    const certificateSha1 = signing?.certificateSha1?.toUpperCase()\n\n    const ps = await vm.powershellCommand.value\n    const rawResult = await vm.exec(ps, [\n      \"-NoProfile\",\n      \"-NonInteractive\",\n      \"-Command\",\n      \"Get-ChildItem -Recurse Cert: -CodeSigningCert | Select-Object -Property Subject,PSParentPath,Thumbprint | ConvertTo-Json -Compress\",\n    ])\n    const certList = rawResult.length === 0 ? [] : asArray<CertInfo>(JSON.parse(rawResult))\n    for (const certInfo of certList) {\n      if (\n        (certificateSubjectName != null && !certInfo.Subject.includes(certificateSubjectName)) ||\n        (certificateSha1 != null && certInfo.Thumbprint.toUpperCase() !== certificateSha1)\n      ) {\n        continue\n      }\n\n      const parentPath = certInfo.PSParentPath\n      const store = parentPath.substring(parentPath.lastIndexOf(\"\\\\\") + 1)\n      log.debug({ store, PSParentPath: parentPath }, \"auto-detect certificate store\")\n      // https://github.com/electron-userland/electron-builder/issues/1717\n      const isLocalMachineStore = parentPath.includes(\"Certificate::LocalMachine\")\n      log.debug(null, \"auto-detect using of LocalMachine store\")\n      return {\n        thumbprint: certInfo.Thumbprint,\n        subject: certInfo.Subject,\n        store,\n        isLocalMachineStore,\n      }\n    }\n\n    throw new Error(`Cannot find certificate ${certificateSubjectName || certificateSha1}, all certs: ${rawResult}`)\n  }\n\n  async getToolPath(isWin = process.platform === \"win32\"): Promise<ToolInfo> {\n    return getSignToolPath(this.packager.config.toolsets?.winCodeSign, isWin, this.packager.buildResourcesDir)\n  }\n\n  async doSign(configuration: CustomWindowsSignTaskConfiguration, packager: WinPackager) {\n    // https://github.com/electron-userland/electron-builder/pull/1944\n    const timeout = parseInt(process.env.SIGNTOOL_TIMEOUT as any, 10) || 10 * 60 * 1000\n    let args: Array<string>\n    let vm: VmManager\n    // cscInfo can be null (e.g. PKCS#11 with no cert file); guard before using `in`.\n    // CertificateFromStoreInfo (no `file` property) requires a Windows VM for cert-store lookup.\n    const cscInfo = configuration.cscInfo\n    const useVmIfNotOnWin = configuration.path.endsWith(\".appx\") || (cscInfo != null && !(\"file\" in cscInfo))\n    const isWin = process.platform === \"win32\" || useVmIfNotOnWin\n    const toolInfo = await getSignToolPath(this.packager.config.toolsets?.winCodeSign, isWin, this.packager.buildResourcesDir)\n    const tool = toolInfo.path\n    if (useVmIfNotOnWin) {\n      vm = await packager.vm.value\n      args = this.computeSignToolArgs(configuration, isWin, vm)\n    } else {\n      vm = new VmManager()\n      args = configuration.computeSignToolArgs(isWin)\n    }\n\n    // signtool.exe (`/f`) is not safe to run concurrently — it races on the shared per-user crypto store.\n    // Serialize real-Windows signtool invocations across processes; osslsigncode (`!isWin`) is file-isolated.\n    const execSign = () => vm.exec(tool, args, { timeout, env: { ...process.env, ...(toolInfo.env || {}) } })\n    await retry(() => (isWin ? withSigntoolLock(execSign) : execSign()), {\n      retries: 2,\n      interval: 15000,\n      backoff: 10000,\n      shouldRetry: (e: any) => {\n        if (\n          e.message.includes(\"The file is being used by another process\") ||\n          e.message.includes(\"The specified timestamp server either could not be reached\") ||\n          e.message.includes(\"No certificates were found that met all the given criteria.\") ||\n          // Transient failure of SignerSignEx after cert selection, typically a concurrent-signtool race\n          // on the per-user crypto store; the cross-process lock above makes this rare, retry covers the rest.\n          e.message.includes(\"An error occurred while attempting to load the signing certificate\")\n        ) {\n          log.warn(`Attempt to code sign failed, another attempt will be made in 15 seconds: ${e.message}`)\n          return true\n        }\n        return false\n      },\n    })\n  }\n}\n\nexport class SigntoolSignManager extends SigntoolBaseSignManager {\n  protected computeWindowsSignArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string> {\n    const signing = getSigntoolFamilyConfig(options.options)\n\n    const inputFile = vm.toVmFile(options.path)\n    const args = [\"sign\"]\n\n    // Timestamping\n    if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n      const isRfc3161 = options.isNest || options.hash === \"sha256\"\n      args.push(isRfc3161 ? \"/tr\" : \"/t\")\n      const timestampUrl = isRfc3161 ? signing?.rfc3161TimeStampServer || \"http://timestamp.digicert.com\" : signing?.timeStampServer || \"http://timestamp.digicert.com\"\n      args.push(timestampUrl)\n    }\n\n    // Certificate\n    this.addCertificateArgs(args, options, vm, true)\n\n    // Hash algorithm\n    if (this.isLegacyToolset()) {\n      // Legacy v0.0.0: Only add /fd for non-SHA1 (original behavior)\n      if (options.hash !== \"sha1\") {\n        args.push(\"/fd\", options.hash)\n        if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n          args.push(\"/td\", \"sha256\")\n        }\n      }\n    } else {\n      // Modern: Always add /fd (required by new Windows Kits)\n      args.push(\"/fd\", options.hash.toLowerCase())\n      // Only add /td for RFC3161 timestamps (incompatible with /t)\n      if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\" && (options.isNest || options.hash === \"sha256\")) {\n        args.push(\"/td\", \"sha256\")\n      }\n    }\n\n    // Optional parameters\n    this.addCommonSigningArgs(args, options, vm, true)\n\n    // Windows-specific\n    args.push(\"/debug\")\n    args.push(inputFile) // Must be last\n\n    return args\n  }\n\n  protected computeOsslsigncodeArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string> {\n    const signing = getSigntoolFamilyConfig(options.options)\n\n    const inputFile = vm.toVmFile(options.path)\n    const outputPath = this.getOutputPath(inputFile, options.hash)\n    options.resultOutputPath = outputPath\n\n    const args = [\"sign\", \"-in\", inputFile, \"-out\", outputPath]\n\n    // Timestamping\n    if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n      const timestampUrl = signing?.timeStampServer || \"http://timestamp.digicert.com\"\n      args.push(\"-t\", timestampUrl)\n    }\n\n    // Certificate file\n    this.addCertificateArgs(args, options, vm, false)\n\n    // Hash algorithm\n    args.push(\"-h\", options.hash.toLowerCase())\n\n    // Optional parameters (name, site, nest, password, additionalCert)\n    this.addCommonSigningArgs(args, options, vm, false)\n\n    // Proxy support\n    const httpsProxy = process.env.HTTPS_PROXY\n    if (httpsProxy?.length) {\n      args.push(\"-p\", httpsProxy)\n    }\n\n    return args\n  }\n}\n"]}
+{"version":3,"file":"signtoolBaseSignManager.js","sourceRoot":"","sources":["../../../src/codeSign/win/signtoolBaseSignManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AAC7E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EACL,kCAAkC,GAKnC,MAAM,6BAA6B,CAAA;AACpC,OAAO,UAAU,MAAM,iCAAiC,CAAA;AACxD,OAAO,UAAU,MAAM,iCAAiC,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAIlD,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAA;AA8C3B,yGAAyG;AACzG,MAAM,UAAU,uBAAuB,CAAC,MAA4B;IAClE,MAAM,CAAC,GAAG,kCAAkC,CAAC,MAAM,CAAC,CAAA;IACpD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACpC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAAC,cAA6B,EAAE,QAAyB;IACtG,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAA;IAC1D,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAChC,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QACxB,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QAC7E,CAAC;QACD,OAAO,IAAI,KAAK,QAAQ,CAAC,UAAU,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,OAAgB,uBAAuB;IAG3C,YAA+B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;QAI3C,0BAAqB,GAAG,IAAI,IAAI,CAAuB,KAAK,IAAI,EAAE;YACzE,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;YAC1E,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,CAAA;YAC5C,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAA;YACb,CAAC;iBAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAA;gBAChD,OAAO,OAAO,CAAC,aAAa,CAAC,CAAA;YAC/B,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAA;YAC9C,OAAO,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QAEO,iBAAY,GAAG,IAAI,QAAQ,CAClC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAClB,KAAK,EAAC,GAAG,EAAC,EAAE;YACV,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAA;YAC/B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAA;YACb,CAAC;YAED,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;gBACzB,MAAM,wBAAwB,GAAG,OAAO,CAAC,OAAO,CAAA;gBAChD,OAAO;oBACL,UAAU,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAE;oBACxD,wBAAwB;iBACzB,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAA;YAC5B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;YACnD,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBAC7C,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;YAChE,CAAC;YACD,uDAAuD;YACvD,iFAAiF;YACjF,OAAO,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAA;QAC5C,CAAC,CACF,CAAA;QAED,2FAA2F;QAC1E,oCAA+B,GAAG,IAAI,IAAI,CAAO,GAAG,EAAE,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC,CAAA;QAqDpG,YAAO,GAAG,IAAI,QAAQ,CAC7B,GAAG,EAAE,CAAC,IAAI,CAAC,4BAA4B,EACvC,4BAA4B,CAAC,EAAE;YAC7B,MAAM,OAAO,GAAG,uBAAuB,CAAC,4BAA4B,CAAC,CAAA;YACrE,qFAAqF;YACrF,4FAA4F;YAC5F,MAAM,UAAU,GAAG,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,CAAA;YAEjE,kDAAkD;YAClD,MAAM,WAAW,GAAI,OAAyE,EAAE,sBAAsB,CAAA;YACtH,MAAM,OAAO,GAAI,OAAyE,EAAE,eAAe,CAAA;YAC3G,IAAI,WAAW,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK;qBAC1B,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;qBAC9E,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;oBAChB,kEAAkE;oBAClE,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;wBAC1B,MAAM,CAAC,CAAA;oBACT,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,mCAAmC,CAAC,CAAA;wBAC5D,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC,CAAC,CAAA;YACN,CAAC;YAED,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAA;YAChD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;gBAC5B,2FAA2F;gBAC3F,MAAM,mBAAmB,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;gBAC9E,OAAO,OAAO,CAAC,OAAO,CAAC;oBACrB,IAAI,EAAE,eAAe;oBACrB,QAAQ,EAAE,mBAAmB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,EAAE;iBAC1E,CAAC,CAAA;YACJ,CAAC;YAED,yFAAyF;YACzF,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;gBACxD,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;oBACtC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC9B,CAAC;gBAED,OAAO,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;qBACtF,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;oBAChB,IAAI,CAAC,YAAY,yBAAyB,EAAE,CAAC;wBAC3C,MAAM,IAAI,yBAAyB,CAAC,oDAAoD,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;oBACtG,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,CAAA;oBACT,CAAC;gBACH,CAAC,CAAC;qBACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACV,IAAI,EAAE,CAAC;oBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE;iBACzC,CAAC,CAAC,CAAA;YACP,CAAC;YAED,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC,CACF,CAAA;QAhKC,IAAI,CAAC,4BAA4B,GAAG,QAAQ,CAAC,eAAe,CAAA;IAC9D,CAAC;IAkDD;;;;;;;;;;;OAWG;IACO,KAAK,CAAC,6BAA6B;QAC3C,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;QAC1E,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,CAAA;QAC5C,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;YAC1B,gFAAgF;YAChF,OAAM;QACR,CAAC;QACD,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;YAC1B,kGAAkG;YAClG,OAAM;QACR,CAAC;QACD,MAAM,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;QAC7C,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAM;QACR,CAAC;QAED,IAAI,QAAgC,CAAA;QACpC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAA;QAC1C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,sFAAsF;YACtF,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,EAAE,kGAAkG,CAAC,CAAA;YACxI,OAAM;QACR,CAAC;QACD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,OAAM;QACR,CAAC;QAED,IAAI,CAAC,+BAA+B,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,yBAAyB,CACjC,2FAA2F;gBACzF,kPAAkP;gBAClP,+BAA+B,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI;gBAC7D,0BAA0B,QAAQ,CAAC,wBAAwB,IAAI;gBAC/D,iJAAiJ,CACpJ,CAAA;QACH,CAAC;IACH,CAAC;IA8DD,UAAU;QACR,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1B,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,aAA4B;QACrE,IAAI,CAAC,MAAM,YAAY,UAAU,IAAI,MAAM,YAAY,UAAU,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YACzG,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,iCAAiC,CAAC,CAAA;YACnF,OAAO,aAAa,IAAI,OAAO,CAAA;QACjC,CAAC;QAED,wFAAwF;QACxF,4FAA4F;QAC5F,8FAA8F;QAC9F,qDAAqD;QACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAA;QAC9C,MAAM,SAAS,GAAG,aAAa,IAAI,QAAQ,EAAE,wBAAwB,IAAI,IAAI,CAAA;QAC7E,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;QAClF,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;OAGG;IACO,iBAAiB,CAAC,UAAyD;QACnF,OAAO,CAAC,UAAU,CAAA,CAAC,qDAAqD;IAC1E,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAA2B;QACxC,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACxD,IAAI,MAAM,GAAG,OAAO,EAAE,qBAAqB,CAAA;QAC3C,oCAAoC;QACpC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,GAAG,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAC3E,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACpH,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;aAAM,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAA;QAE5D,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAA;QAEnI,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;QAExC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,GAAQ;gBACjB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;aACjC,CAAA;YACD,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;gBACtB,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,CAAA;YACzD,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG;oBACR,GAAG,OAAO;oBACV,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,IAAI,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc;iBACrE,CAAA;YACH,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;YAC5B,6FAA6F;YAC7F,8FAA8F;YAC9F,MAAM,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAA;QAClD,CAAC;aAAM,IAAI,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,oGAAoG;YACpG,OAAO,wBAAwB,CAAA;QACjC,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,CAAC,MAA0C,EAAE,QAAqB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QACrI,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,iBAAiB,GAAiC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YACzG,MAAM,OAAO,CAAC,OAAO,CACnB,QAAQ,CACN;gBACE,GAAG,iBAAiB;gBACpB,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC;aACjF,EACD,IAAI,CAAC,QAAQ,CACd,CACF,CAAA;YACD,MAAM,GAAG,IAAI,CAAA;YACb,IAAI,iBAAiB,CAAC,gBAAgB,IAAI,IAAI,EAAE,CAAC;gBAC/C,MAAM,MAAM,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,QAAgB;QAC9C,MAAM,kBAAkB,GAAG,4GAA4G,CAAA;QACvI,IAAI,CAAC;YACH,OAAO,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC3C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,IAAI,yBAAyB,CAAC,GAAG,kBAAkB,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,mBAAmB,CAAC,OAAqC,EAAE,KAAc,EAAE,KAAgB,IAAI,SAAS,EAAE;QACxG,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACrG,CAAC;IAES,eAAe;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAA;QACpD,2GAA2G;QAC3G,OAAO,CAAC,KAAK,OAAO,CAAA;IACtB,CAAC;IAKD,mGAAmG;IACzF,kBAAkB,CAAC,IAAmB,EAAE,OAAqC,EAAE,EAAa,EAAE,KAAc,EAAE,SAAS,GAAG,KAAK;QACvI,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8GAA8G,CAAC,CAAA;QACjI,CAAC;QACD,MAAM,eAAe,GAAI,OAAO,CAAC,OAA+B,CAAC,IAAI,CAAA;QAErE,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;YAC5B,wCAAwC;YACxC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;YACrF,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAmC,CAAA;YAC3D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;YACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YAC9B,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAA;YAEjE,IAAI,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;gBACzD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAA;YACnE,CAAC;iBAAM,IAAI,KAAK,IAAI,SAAS,IAAI,CAAC,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,MAAM,CAAC,EAAE,CAAC;gBACxF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAA;YAC/C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,yBAAyB,CAAC,2CAA2C,eAAe,iBAAiB,CAAC,CAAA;YAClH,CAAC;QACH,CAAC;IACH,CAAC;IAES,oBAAoB,CAAC,IAAmB,EAAE,OAAqC,EAAE,EAAa,EAAE,KAAc;QACtH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9C,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/C,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QACpC,CAAC;QAED,MAAM,QAAQ,GAAI,OAAO,CAAC,OAA+B,EAAE,QAAQ,CAAA;QACnE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACxD,MAAM,cAAc,GAAG,OAAO,EAAE,yBAAyB,CAAA;QACzD,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,IAAY;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,IAAI,GAAG,SAAS,EAAE,CAAC,CAAA;IAChH,CAAC;IAED,KAAK,CAAC,2BAA2B,CAAC,OAA6B,EAAE,EAAa;QAC5E,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAkE,CAAA;QACjH,MAAM,sBAAsB,GAAG,OAAO,EAAE,sBAAsB,CAAA;QAC9D,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;QAE/D,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAC3C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE;YAClC,YAAY;YACZ,iBAAiB;YACjB,UAAU;YACV,oIAAoI;SACrI,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAW,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;QACvF,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;YAChC,IACE,CAAC,sBAAsB,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;gBACtF,CAAC,eAAe,IAAI,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,EAClF,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,CAAA;YACxC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YACpE,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,+BAA+B,CAAC,CAAA;YAC/E,oEAAoE;YACpE,MAAM,mBAAmB,GAAG,UAAU,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAA;YAC5E,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAA;YAC1D,OAAO;gBACL,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,KAAK;gBACL,mBAAmB;aACpB,CAAA;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,2BAA2B,sBAAsB,IAAI,eAAe,gBAAgB,SAAS,EAAE,CAAC,CAAA;IAClH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QACpD,OAAO,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;IAC5G,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,aAAiD,EAAE,QAAqB;QACnF,kEAAkE;QAClE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAuB,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACnF,IAAI,IAAmB,CAAA;QACvB,IAAI,EAAa,CAAA;QACjB,iFAAiF;QACjF,6FAA6F;QAC7F,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAA;QACrC,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAA;QACzG,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,eAAe,CAAA;QAC7D,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;QAC1H,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;QAC1B,IAAI,eAAe,EAAE,CAAC;YACpB,EAAE,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;YAC5B,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;QAC3D,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,IAAI,SAAS,EAAE,CAAA;YACpB,IAAI,GAAG,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;QAED,sGAAsG;QACtG,0GAA0G;QAC1G,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;QACzG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE;YACnE,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,CAAC,CAAM,EAAE,EAAE;gBACtB,IACE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,2CAA2C,CAAC;oBAC/D,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,4DAA4D,CAAC;oBAChF,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,6DAA6D,CAAC;oBACjF,+FAA+F;oBAC/F,qGAAqG;oBACrG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,oEAAoE,CAAC,EACxF,CAAC;oBACD,GAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;oBACjG,OAAO,IAAI,CAAA;gBACb,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,uBAAuB;IACpD,sBAAsB,CAAC,OAAqC,EAAE,EAAa;QACnF,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAExD,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAErB,eAAe;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAA;YAC7D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YACnC,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,sBAAsB,IAAI,+BAA+B,CAAC,CAAC,CAAC,OAAO,EAAE,eAAe,IAAI,+BAA+B,CAAA;YACjK,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACzB,CAAC;QAED,cAAc;QACd,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAEhD,iBAAiB;QACjB,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC3B,+DAA+D;YAC/D,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;oBACpD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wDAAwD;YACxD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;YAC5C,6DAA6D;YAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACrG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAElD,mBAAmB;QACnB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA,CAAC,eAAe;QAEpC,OAAO,IAAI,CAAA;IACb,CAAC;IAES,uBAAuB,CAAC,OAAqC,EAAE,EAAa;QACpF,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAExD,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9D,OAAO,CAAC,gBAAgB,GAAG,UAAU,CAAA;QAErC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;QAE3D,eAAe;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;YACpD,MAAM,YAAY,GAAG,OAAO,EAAE,eAAe,IAAI,+BAA+B,CAAA;YAChF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;QAC/B,CAAC;QAED,mBAAmB;QACnB,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAEjD,iBAAiB;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;QAE3C,mEAAmE;QACnE,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAEnD,gBAAgB;QAChB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;QAC1C,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAC7B,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;CACF","sourcesContent":["import { asArray, InvalidConfigurationError, log, retry } from \"builder-util\"\nimport { MemoLazy, parseDn } from \"builder-util-runtime\"\nimport _fsExtra from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { Target } from \"../../core.js\"\nimport {\n  resolveWindowsSigningConfiguration,\n  WindowsConfiguration,\n  WindowsHsmSigningConfig,\n  WindowsSigntoolFamilyConfig,\n  WindowsSigntoolSigningConfig,\n} from \"../../options/winOptions.js\"\nimport AppXTarget from \"../../targets/win/AppxTarget.js\"\nimport MsixTarget from \"../../targets/win/MsixTarget.js\"\nimport { getSignToolPath } from \"../../toolsets/winCodeSign.js\"\nimport { ToolInfo } from \"../../util/bundledTool.js\"\nimport { resolveFunction } from \"../../util/resolve.js\"\nimport { withSigntoolLock } from \"../../util/toolsetLock.js\"\nimport { readCertInfo, readCertInfoFromX509 } from \"../certInfo.js\"\nimport { VmManager } from \"../../vm/vm.js\"\nimport type { WinPackager } from \"../../winPackager.js\"\nimport { importCertificate } from \"../codesign.js\"\nimport type { SignManager } from \"./signManager.js\"\nimport { WindowsSignOptions } from \"./windowsCodeSign.js\"\nimport { SignFileResult } from \"../signResult.js\"\nconst { rename } = _fsExtra\n\nexport type CustomWindowsSign = (configuration: CustomWindowsSignTaskConfiguration, packager?: WinPackager) => Promise<any>\n\nexport interface WindowsSignToolOptions extends WindowsSignOptions {\n  readonly name: string\n  readonly site: string | null\n}\n\nexport interface FileCodeSigningInfo {\n  readonly file: string\n  readonly password: string | null\n}\n\nexport interface WindowsSignTaskConfiguration extends WindowsSignToolOptions {\n  readonly cscInfo: FileCodeSigningInfo | CertificateFromStoreInfo | null\n\n  // set if output path differs from input (e.g. osslsigncode cannot sign file in-place)\n  resultOutputPath?: string\n\n  hash: string\n  isNest: boolean\n}\n\nexport interface CustomWindowsSignTaskConfiguration extends WindowsSignTaskConfiguration {\n  computeSignToolArgs(isWin: boolean): Array<string>\n}\n\nexport interface CertificateInfo {\n  readonly commonName: string\n  readonly bloodyMicrosoftSubjectDn: string\n}\n\nexport interface CertificateFromStoreInfo {\n  thumbprint: string\n  subject: string\n  store: string\n  isLocalMachineStore: boolean\n}\n\ninterface CertInfo {\n  Subject: string\n  Thumbprint: string\n  PSParentPath: string\n}\n\n/** Extracts the non-Azure signing config from WindowsConfiguration, or null for Azure/unset/disabled. */\nexport function getSigntoolFamilyConfig(config: WindowsConfiguration): WindowsSigntoolFamilyConfig | null {\n  const s = resolveWindowsSigningConfiguration(config)\n  if (s == null || s.type === \"azure\") {\n    return null\n  }\n  return s\n}\n\n/**\n * Matches configured publisher names against a certificate subject using the same semantics as\n * electron-updater's update signature verifier (windowsExecutableCodeSignatureVerifier): a name that\n * parses as a Distinguished Name (DN) must match every RDN it specifies against the certificate\n * subject (extra subject RDNs are ignored); otherwise it is compared strictly against the\n * certificate's Common Name (CN). Passes when ANY configured name matches — multiple names are\n * supported for certificate rotation.\n */\nexport function publisherNameMatchesCertificate(publisherNames: Array<string>, certInfo: CertificateInfo): boolean {\n  const subject = parseDn(certInfo.bloodyMicrosoftSubjectDn)\n  return publisherNames.some(name => {\n    const dn = parseDn(name)\n    if (dn.size) {\n      return Array.from(dn.keys()).every(key => dn.get(key) === subject.get(key))\n    }\n    return name === certInfo.commonName\n  })\n}\n\nexport abstract class SigntoolBaseSignManager implements SignManager {\n  protected readonly platformSpecificBuildOptions: WindowsConfiguration\n\n  constructor(protected readonly packager: WinPackager) {\n    this.platformSpecificBuildOptions = packager.platformOptions\n  }\n\n  readonly computedPublisherName = new Lazy<Array<string> | null>(async () => {\n    const signing = getSigntoolFamilyConfig(this.platformSpecificBuildOptions)\n    const publisherName = signing?.publisherName\n    if (publisherName === null) {\n      return null\n    } else if (publisherName != null) {\n      await this.explicitPublisherNameValidation.value\n      return asArray(publisherName)\n    }\n\n    const certInfo = await this.lazyCertInfo.value\n    return certInfo == null ? null : [certInfo.commonName]\n  })\n\n  readonly lazyCertInfo = new MemoLazy<MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>, CertificateInfo | null>(\n    () => this.cscInfo,\n    async csc => {\n      const cscInfo = await csc.value\n      if (cscInfo == null) {\n        return null\n      }\n\n      if (\"subject\" in cscInfo) {\n        const bloodyMicrosoftSubjectDn = cscInfo.subject\n        return {\n          commonName: parseDn(bloodyMicrosoftSubjectDn).get(\"CN\")!,\n          bloodyMicrosoftSubjectDn,\n        }\n      }\n\n      const cscFile = cscInfo.file\n      if (cscFile == null) {\n        return null\n      }\n\n      const certExt = path.extname(cscFile).toLowerCase()\n      if (certExt === \".p12\" || certExt === \".pfx\") {\n        return await this.getCertInfo(cscFile, cscInfo.password || \"\")\n      }\n      // Non-PKCS12 files (.crt, .cer): parse as plain X.509.\n      // Returns null when the CN is absent — caller must set publisherName explicitly.\n      return await readCertInfoFromX509(cscFile)\n    }\n  )\n\n  // Memoized so the check runs once per build even though signFile is invoked once per file.\n  private readonly explicitPublisherNameValidation = new Lazy<void>(() => this.validateExplicitPublisherName())\n\n  /**\n   * When `publisherName` is explicitly configured and the subject of the local code signing\n   * certificate is known, fail the build if none of the configured names match the certificate.\n   * This catches signing with the wrong certificate at build time — otherwise the mismatch only\n   * surfaces at update time, when electron-updater rejects every update signed with that\n   * certificate.\n   *\n   * The check is intentionally skipped whenever the actual signing certificate's subject is not\n   * genuinely known: custom `sign` hooks, PKCS#11 without an extractable certificate file,\n   * x509 certificate files without a CN, or any error while reading certificate info.\n   * An explicit `publisherName: null` remains a pure opt-out (nothing to validate).\n   */\n  protected async validateExplicitPublisherName(): Promise<void> {\n    const signing = getSigntoolFamilyConfig(this.platformSpecificBuildOptions)\n    const publisherName = signing?.publisherName\n    if (publisherName == null) {\n      // not configured (auto-derive) or explicit `null` opt-out — nothing to validate\n      return\n    }\n    if (signing?.sign != null) {\n      // custom sign hook: electron-builder does not know which certificate the hook actually signs with\n      return\n    }\n    const publisherNames = asArray(publisherName)\n    if (publisherNames.length === 0) {\n      return\n    }\n\n    let certInfo: CertificateInfo | null\n    try {\n      certInfo = await this.lazyCertInfo.value\n    } catch (e: any) {\n      // this check must only fire when the signing certificate's subject is genuinely known\n      log.debug({ error: e.message || e }, \"skipping publisherName validation against the signing certificate (cannot read certificate info)\")\n      return\n    }\n    if (certInfo == null) {\n      return\n    }\n\n    if (!publisherNameMatchesCertificate(publisherNames, certInfo)) {\n      throw new InvalidConfigurationError(\n        `The configured publisherName does not match the subject of the code signing certificate. ` +\n          `This usually means the build is signing with the wrong certificate (for example, a code signing certificate for another platform or team leaked into WIN_CSC_LINK/CSC_LINK in CI) — electron-updater would reject every update signed with it.\\n` +\n          `  Configured publisherName: ${publisherNames.join(\" | \")}\\n` +\n          `  Certificate subject: ${certInfo.bloodyMicrosoftSubjectDn}\\n` +\n          `Fix win.publisherName (or sign with the intended certificate). To opt out of update signature verification entirely, set publisherName to null.`\n      )\n    }\n  }\n\n  readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(\n    () => this.platformSpecificBuildOptions,\n    platformSpecificBuildOptions => {\n      const signing = getSigntoolFamilyConfig(platformSpecificBuildOptions)\n      // signtool is the implicit default when win.sign is unset, so an absent config still\n      // honours the WIN_CSC_LINK/cscLink fallback below (hsm/pkcs11 set signing.type explicitly).\n      const isSigntool = signing == null || signing.type === \"signtool\"\n\n      // signtool + hsm: store-based cert takes priority\n      const subjectName = (signing as WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | null)?.certificateSubjectName\n      const shaType = (signing as WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | null)?.certificateSha1\n      if (subjectName != null || shaType != null) {\n        return this.packager.vm.value\n          .then(vm => this.getCertificateFromStoreInfo(platformSpecificBuildOptions, vm))\n          .catch((e: any) => {\n            // https://github.com/electron-userland/electron-builder/pull/2397\n            if (signing?.sign == null) {\n              throw e\n            } else {\n              log.debug({ error: e }, \"getCertificateFromStoreInfo error\")\n              return null\n            }\n          })\n      }\n\n      const certificateFile = signing?.certificateFile\n      if (certificateFile != null) {\n        // Only signtool mode uses a password (HSM private key lives in the HSM, not the cert file)\n        const certificatePassword = isSigntool ? this.packager.getCscPassword() : null\n        return Promise.resolve({\n          file: certificateFile,\n          password: certificatePassword == null ? null : certificatePassword.trim(),\n        })\n      }\n\n      // WIN_CSC_LINK env var fallback: only for signtool mode (including the implicit default)\n      if (isSigntool) {\n        const cscLink = this.packager.getCscLink(\"WIN_CSC_LINK\")\n        if (cscLink == null || cscLink === \"\") {\n          return Promise.resolve(null)\n        }\n\n        return importCertificate(cscLink, this.packager.tempDirManager, this.packager.projectDir)\n          .catch((e: any) => {\n            if (e instanceof InvalidConfigurationError) {\n              throw new InvalidConfigurationError(`Env WIN_CSC_LINK is not correct, cannot resolve: ${e.message}`)\n            } else {\n              throw e\n            }\n          })\n          .then(p => ({\n            file: p,\n            password: this.packager.getCscPassword(),\n          }))\n      }\n\n      return Promise.resolve(null)\n    }\n  )\n\n  initialize(): Promise<void> {\n    return Promise.resolve()\n  }\n\n  // https://github.com/electron-userland/electron-builder/issues/2108#issuecomment-333200711\n  async computePublisherName(target: Target, publisherName: string | null) {\n    if ((target instanceof AppXTarget || target instanceof MsixTarget) && (await this.cscInfo.value) == null) {\n      log.info({ reason: \"Windows Store only build\" }, \"AppX/MSIX package is not signed\")\n      return publisherName ?? \"CN=ms\"\n    }\n\n    // When a signing cert is available, the cert's subject MUST be used so the APPX package\n    // Publisher attribute matches the certificate — any mismatch causes SignerSign to fail with\n    // ERROR_BAD_FORMAT. Only honour a user-supplied publisherName if it was explicitly configured\n    // (non-null); otherwise derive from the certificate.\n    const certInfo = await this.lazyCertInfo.value\n    const publisher = publisherName ?? certInfo?.bloodyMicrosoftSubjectDn ?? null\n    if (publisher == null) {\n      throw new Error(\"Internal error: cannot compute subject using certificate info\")\n    }\n    return publisher\n  }\n\n  /**\n   * Called when cscInfo is null. Returns true to skip signing, false to proceed, or throws.\n   * Override in subclasses with different null-cert behaviour (HSM throws, PKCS#11 proceeds).\n   */\n  protected handleNullCscInfo(customSign: CustomWindowsSign | string | null | undefined): boolean {\n    return !customSign // default: skip when no cert and no custom sign hook\n  }\n\n  async signFile(options: WindowsSignOptions): Promise<SignFileResult> {\n    const signing = getSigntoolFamilyConfig(options.options)\n    let hashes = signing?.signingHashAlgorithms\n    // msi does not support dual-signing\n    if (options.path.endsWith(\".msi\")) {\n      hashes = [hashes != null && !hashes.includes(\"sha1\") ? \"sha256\" : \"sha1\"]\n    } else if (options.path.endsWith(\".appx\") || options.path.endsWith(\".msix\") || options.path.endsWith(\".msixbundle\")) {\n      hashes = [\"sha256\"]\n    } else if (hashes == null) {\n      hashes = [\"sha1\", \"sha256\"]\n    } else {\n      hashes = Array.isArray(hashes) ? hashes : [hashes]\n    }\n\n    const name = this.packager.appInfo.productName\n    const site = await this.packager.appInfo.computePackageUrl()\n\n    const customSign = await resolveFunction(this.packager.appInfo.type, signing?.sign, \"sign\", await this.packager.getWorkspaceRoot())\n\n    const cscInfo = await this.cscInfo.value\n\n    if (cscInfo) {\n      let logInfo: any = {\n        file: log.filePath(options.path),\n      }\n      if (\"file\" in cscInfo) {\n        logInfo = { ...logInfo, certificateFile: cscInfo.file }\n      } else {\n        logInfo = {\n          ...logInfo,\n          subject: cscInfo.subject,\n          thumbprint: cscInfo.thumbprint,\n          store: cscInfo.store,\n          user: cscInfo.isLocalMachineStore ? \"local machine\" : \"current user\",\n        }\n      }\n      log.info(logInfo, \"signing\")\n      // validate an explicitly configured publisherName against the signing certificate before the\n      // first file is signed, so a wrong-certificate build fails even when no publish config exists\n      await this.explicitPublisherNameValidation.value\n    } else if (this.handleNullCscInfo(customSign)) {\n      // the canonical \"signing skipped\" message is logged once in signWindows, which receives this reason\n      return \"skipped:no-certificate\"\n    }\n\n    const executor = customSign || ((config: CustomWindowsSignTaskConfiguration, packager: WinPackager) => this.doSign(config, packager))\n    let isNest = false\n    for (const hash of hashes) {\n      const taskConfiguration: WindowsSignTaskConfiguration = { ...options, name, site, cscInfo, hash, isNest }\n      await Promise.resolve(\n        executor(\n          {\n            ...taskConfiguration,\n            computeSignToolArgs: isWin => this.computeSignToolArgs(taskConfiguration, isWin),\n          },\n          this.packager\n        )\n      )\n      isNest = true\n      if (taskConfiguration.resultOutputPath != null) {\n        await rename(taskConfiguration.resultOutputPath, options.path)\n      }\n    }\n\n    return customSign ? \"signed:custom\" : \"signed\"\n  }\n\n  async getCertInfo(file: string, password: string): Promise<CertificateInfo> {\n    const errorMessagePrefix = \"Cannot extract publisher name from code signing certificate. As workaround, set win.publisherName. Error: \"\n    try {\n      return await readCertInfo(file, password)\n    } catch (e: any) {\n      throw new InvalidConfigurationError(`${errorMessagePrefix}${e.message || e}`)\n    }\n  }\n\n  // on windows be aware of http://stackoverflow.com/a/32640183/1910191\n  computeSignToolArgs(options: WindowsSignTaskConfiguration, isWin: boolean, vm: VmManager = new VmManager()): Array<string> {\n    return isWin ? this.computeWindowsSignArgs(options, vm) : this.computeOsslsigncodeArgs(options, vm)\n  }\n\n  protected isLegacyToolset(): boolean {\n    const v = this.packager.config.toolsets?.winCodeSign\n    // Only an explicit \"0.0.0\" pin is legacy; unset / null / \"latest\" / custom now resolve to a modern bundle.\n    return v === \"0.0.0\"\n  }\n\n  protected abstract computeWindowsSignArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string>\n  protected abstract computeOsslsigncodeArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string>\n\n  // allowX509: set to true by HsmSignManager to permit .crt/.cer (public chain only, key is in HSM).\n  protected addCertificateArgs(args: Array<string>, options: WindowsSignTaskConfiguration, vm: VmManager, isWin: boolean, allowX509 = false): void {\n    if (options.cscInfo == null) {\n      throw new Error(\"No code signing certificate configured. Provide certificateFile, certificateSha1, or certificateSubjectName.\")\n    }\n    const certificateFile = (options.cscInfo as FileCodeSigningInfo).file\n\n    if (certificateFile == null) {\n      // Certificate from store (Windows only)\n      if (!isWin) {\n        throw new Error(\"certificateSha1/certificateSubjectName supported only on Windows\")\n      }\n\n      const cscInfo = options.cscInfo as CertificateFromStoreInfo\n      args.push(\"/sha1\", cscInfo.thumbprint)\n      args.push(\"/s\", cscInfo.store)\n      if (cscInfo.isLocalMachineStore) {\n        args.push(\"/sm\")\n      }\n    } else {\n      const certExtension = path.extname(certificateFile).toLowerCase()\n\n      if (certExtension === \".p12\" || certExtension === \".pfx\") {\n        args.push(isWin ? \"/f\" : \"-pkcs12\", vm.toVmFile(certificateFile))\n      } else if (isWin && allowX509 && (certExtension === \".crt\" || certExtension === \".cer\")) {\n        args.push(\"/f\", vm.toVmFile(certificateFile))\n      } else {\n        throw new InvalidConfigurationError(`Please specify pkcs12 (.p12/.pfx) file, ${certificateFile} is not correct`)\n      }\n    }\n  }\n\n  protected addCommonSigningArgs(args: Array<string>, options: WindowsSignTaskConfiguration, vm: VmManager, isWin: boolean): void {\n    if (options.name) {\n      args.push(isWin ? \"/d\" : \"-n\", options.name)\n    }\n\n    if (options.site) {\n      args.push(isWin ? \"/du\" : \"-i\", options.site)\n    }\n\n    if (options.isNest) {\n      args.push(isWin ? \"/as\" : \"-nest\")\n    }\n\n    const password = (options.cscInfo as FileCodeSigningInfo)?.password\n    if (password) {\n      args.push(isWin ? \"/p\" : \"-pass\", password)\n    }\n\n    const signing = getSigntoolFamilyConfig(options.options)\n    const additionalCert = signing?.additionalCertificateFile\n    if (additionalCert) {\n      args.push(isWin ? \"/ac\" : \"-ac\", vm.toVmFile(additionalCert))\n    }\n  }\n\n  getOutputPath(inputPath: string, hash: string) {\n    const extension = path.extname(inputPath)\n    return path.join(path.dirname(inputPath), `${path.basename(inputPath, extension)}-signed-${hash}${extension}`)\n  }\n\n  async getCertificateFromStoreInfo(options: WindowsConfiguration, vm: VmManager): Promise<CertificateFromStoreInfo> {\n    const signing = getSigntoolFamilyConfig(options) as WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | null\n    const certificateSubjectName = signing?.certificateSubjectName\n    const certificateSha1 = signing?.certificateSha1?.toUpperCase()\n\n    const ps = await vm.powershellCommand.value\n    const rawResult = await vm.exec(ps, [\n      \"-NoProfile\",\n      \"-NonInteractive\",\n      \"-Command\",\n      \"Get-ChildItem -Recurse Cert: -CodeSigningCert | Select-Object -Property Subject,PSParentPath,Thumbprint | ConvertTo-Json -Compress\",\n    ])\n    const certList = rawResult.length === 0 ? [] : asArray<CertInfo>(JSON.parse(rawResult))\n    for (const certInfo of certList) {\n      if (\n        (certificateSubjectName != null && !certInfo.Subject.includes(certificateSubjectName)) ||\n        (certificateSha1 != null && certInfo.Thumbprint.toUpperCase() !== certificateSha1)\n      ) {\n        continue\n      }\n\n      const parentPath = certInfo.PSParentPath\n      const store = parentPath.substring(parentPath.lastIndexOf(\"\\\\\") + 1)\n      log.debug({ store, PSParentPath: parentPath }, \"auto-detect certificate store\")\n      // https://github.com/electron-userland/electron-builder/issues/1717\n      const isLocalMachineStore = parentPath.includes(\"Certificate::LocalMachine\")\n      log.debug(null, \"auto-detect using of LocalMachine store\")\n      return {\n        thumbprint: certInfo.Thumbprint,\n        subject: certInfo.Subject,\n        store,\n        isLocalMachineStore,\n      }\n    }\n\n    throw new Error(`Cannot find certificate ${certificateSubjectName || certificateSha1}, all certs: ${rawResult}`)\n  }\n\n  async getToolPath(isWin = process.platform === \"win32\"): Promise<ToolInfo> {\n    return getSignToolPath(this.packager.config.toolsets?.winCodeSign, isWin, this.packager.buildResourcesDir)\n  }\n\n  async doSign(configuration: CustomWindowsSignTaskConfiguration, packager: WinPackager) {\n    // https://github.com/electron-userland/electron-builder/pull/1944\n    const timeout = parseInt(process.env.SIGNTOOL_TIMEOUT as any, 10) || 10 * 60 * 1000\n    let args: Array<string>\n    let vm: VmManager\n    // cscInfo can be null (e.g. PKCS#11 with no cert file); guard before using `in`.\n    // CertificateFromStoreInfo (no `file` property) requires a Windows VM for cert-store lookup.\n    const cscInfo = configuration.cscInfo\n    const useVmIfNotOnWin = configuration.path.endsWith(\".appx\") || (cscInfo != null && !(\"file\" in cscInfo))\n    const isWin = process.platform === \"win32\" || useVmIfNotOnWin\n    const toolInfo = await getSignToolPath(this.packager.config.toolsets?.winCodeSign, isWin, this.packager.buildResourcesDir)\n    const tool = toolInfo.path\n    if (useVmIfNotOnWin) {\n      vm = await packager.vm.value\n      args = this.computeSignToolArgs(configuration, isWin, vm)\n    } else {\n      vm = new VmManager()\n      args = configuration.computeSignToolArgs(isWin)\n    }\n\n    // signtool.exe (`/f`) is not safe to run concurrently — it races on the shared per-user crypto store.\n    // Serialize real-Windows signtool invocations across processes; osslsigncode (`!isWin`) is file-isolated.\n    const execSign = () => vm.exec(tool, args, { timeout, env: { ...process.env, ...(toolInfo.env || {}) } })\n    await retry(() => (isWin ? withSigntoolLock(execSign) : execSign()), {\n      retries: 2,\n      interval: 15000,\n      backoff: 10000,\n      shouldRetry: (e: any) => {\n        if (\n          e.message.includes(\"The file is being used by another process\") ||\n          e.message.includes(\"The specified timestamp server either could not be reached\") ||\n          e.message.includes(\"No certificates were found that met all the given criteria.\") ||\n          // Transient failure of SignerSignEx after cert selection, typically a concurrent-signtool race\n          // on the per-user crypto store; the cross-process lock above makes this rare, retry covers the rest.\n          e.message.includes(\"An error occurred while attempting to load the signing certificate\")\n        ) {\n          log.warn(`Attempt to code sign failed, another attempt will be made in 15 seconds: ${e.message}`)\n          return true\n        }\n        return false\n      },\n    })\n  }\n}\n\nexport class SigntoolSignManager extends SigntoolBaseSignManager {\n  protected computeWindowsSignArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string> {\n    const signing = getSigntoolFamilyConfig(options.options)\n\n    const inputFile = vm.toVmFile(options.path)\n    const args = [\"sign\"]\n\n    // Timestamping\n    if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n      const isRfc3161 = options.isNest || options.hash === \"sha256\"\n      args.push(isRfc3161 ? \"/tr\" : \"/t\")\n      const timestampUrl = isRfc3161 ? signing?.rfc3161TimeStampServer || \"http://timestamp.digicert.com\" : signing?.timeStampServer || \"http://timestamp.digicert.com\"\n      args.push(timestampUrl)\n    }\n\n    // Certificate\n    this.addCertificateArgs(args, options, vm, true)\n\n    // Hash algorithm\n    if (this.isLegacyToolset()) {\n      // Legacy v0.0.0: Only add /fd for non-SHA1 (original behavior)\n      if (options.hash !== \"sha1\") {\n        args.push(\"/fd\", options.hash)\n        if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n          args.push(\"/td\", \"sha256\")\n        }\n      }\n    } else {\n      // Modern: Always add /fd (required by new Windows Kits)\n      args.push(\"/fd\", options.hash.toLowerCase())\n      // Only add /td for RFC3161 timestamps (incompatible with /t)\n      if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\" && (options.isNest || options.hash === \"sha256\")) {\n        args.push(\"/td\", \"sha256\")\n      }\n    }\n\n    // Optional parameters\n    this.addCommonSigningArgs(args, options, vm, true)\n\n    // Windows-specific\n    args.push(\"/debug\")\n    args.push(inputFile) // Must be last\n\n    return args\n  }\n\n  protected computeOsslsigncodeArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string> {\n    const signing = getSigntoolFamilyConfig(options.options)\n\n    const inputFile = vm.toVmFile(options.path)\n    const outputPath = this.getOutputPath(inputFile, options.hash)\n    options.resultOutputPath = outputPath\n\n    const args = [\"sign\", \"-in\", inputFile, \"-out\", outputPath]\n\n    // Timestamping\n    if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n      const timestampUrl = signing?.timeStampServer || \"http://timestamp.digicert.com\"\n      args.push(\"-t\", timestampUrl)\n    }\n\n    // Certificate file\n    this.addCertificateArgs(args, options, vm, false)\n\n    // Hash algorithm\n    args.push(\"-h\", options.hash.toLowerCase())\n\n    // Optional parameters (name, site, nest, password, additionalCert)\n    this.addCommonSigningArgs(args, options, vm, false)\n\n    // Proxy support\n    const httpsProxy = process.env.HTTPS_PROXY\n    if (httpsProxy?.length) {\n      args.push(\"-p\", httpsProxy)\n    }\n\n    return args\n  }\n}\n"]}

package/dist/codeSign/win/windowsCodeSign.d.ts

@@ -1,8 +1,9 @@
 import { WindowsConfiguration } from "../../options/winOptions.js";
 import { WinPackager } from "../../winPackager.js";
+import { SignFileResult } from "../signResult.js";
 export interface WindowsSignOptions {
     readonly path: string;
     readonly options: WindowsConfiguration;
 }
-export declare function signWindows(options: WindowsSignOptions, packager: WinPackager): Promise<boolean>;
+export declare function signWindows(options: WindowsSignOptions, packager: WinPackager): Promise<SignFileResult>;
 //# sourceMappingURL=windowsCodeSign.d.ts.map

package/dist/codeSign/win/windowsCodeSign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"windowsCodeSign.d.ts","sourceRoot":"","sources":["../../../src/codeSign/win/windowsCodeSign.ts"],"names":[],"mappings":"AACA,OAAO,EAAsC,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AACtG,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAElD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CACvC;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAatG"}
+{"version":3,"file":"windowsCodeSign.d.ts","sourceRoot":"","sources":["../../../src/codeSign/win/windowsCodeSign.ts"],"names":[],"mappings":"AACA,OAAO,EAAsC,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AACtG,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEjD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CACvC;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CAuB7G"}

package/dist/codeSign/win/windowsCodeSign.js

@@ -2,20 +2,29 @@ import { log, retry } from "builder-util";
 import { resolveWindowsSigningConfiguration } from "../../options/winOptions.js";
 export async function signWindows(options, packager) {
     const signing = resolveWindowsSigningConfiguration(options.options);
-    if (signing?.type === "azure") {
-        log.info({ path: log.filePath(options.path) }, "signing with Azure Trusted Signing");
+    const packageManager = await packager.signingManager.value;
+    const path = log.filePath(options.path);
+    // no "signing..." pre-log here: the sign managers already log "signing" with certificate details right before executing
+    const result = await signWithRetry(async () => packageManager.signFile(options));
+    if (result === "skipped:no-certificate") {
+        log.info({ path, reason: "no code signing certificate configured" }, "signing skipped");
+    }
+    else if (result === "signed:custom") {
+        log.info({ path }, "signed with custom `sign` hook");
+    }
+    else if (signing?.type === "azure") {
+        log.info({ path }, "signed with Azure Trusted Signing");
     }
     else if (signing?.type === "hsm") {
-        log.info({ path: log.filePath(options.path) }, "signing with signtool.exe (HSM)");
+        log.info({ path }, "signed with signtool.exe (HSM)");
     }
     else if (signing?.type === "pkcs11") {
-        log.info({ path: log.filePath(options.path) }, "signing with osslsigncode (PKCS#11)");
+        log.info({ path }, "signed with osslsigncode (PKCS#11)");
     }
     else {
-        log.info({ path: log.filePath(options.path) }, "signing with signtool.exe");
+        log.info({ path }, "signed with signtool.exe");
     }
-    const packageManager = await packager.signingManager.value;
-    return signWithRetry(async () => packageManager.signFile(options));
+    return result;
 }
 function signWithRetry(signer) {
     return retry(signer, {

package/dist/codeSign/win/windowsCodeSign.js.map

@@ -1 +1 @@
-{"version":3,"file":"windowsCodeSign.js","sourceRoot":"","sources":["../../../src/codeSign/win/windowsCodeSign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,kCAAkC,EAAwB,MAAM,6BAA6B,CAAA;AAQtG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA2B,EAAE,QAAqB;IAClF,MAAM,OAAO,GAAG,kCAAkC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACnE,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAA;IACtF,CAAC;SAAM,IAAI,OAAO,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;IACnF,CAAC;SAAM,IAAI,OAAO,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,qCAAqC,CAAC,CAAA;IACvF,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAA;IAC1D,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;AACpE,CAAC;AAED,SAAS,aAAa,CAAC,MAA8B;IACnD,OAAO,KAAK,CAAC,MAAM,EAAE;QACnB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,CAAC,CAAM,EAAE,EAAE;YACtB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAA;YACzB;YACE,oEAAoE;YACpE,OAAO,EAAE,QAAQ,CAAC,4BAA4B,CAAC;gBAC/C,oEAAoE;gBACpE,OAAO,EAAE,QAAQ,CAAC,gCAAgC,CAAC,EACnD,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,sDAAsD,CAAC,CAAA;gBACpF,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { log, retry } from \"builder-util\"\nimport { resolveWindowsSigningConfiguration, WindowsConfiguration } from \"../../options/winOptions.js\"\nimport { WinPackager } from \"../../winPackager.js\"\n\nexport interface WindowsSignOptions {\n  readonly path: string\n  readonly options: WindowsConfiguration\n}\n\nexport async function signWindows(options: WindowsSignOptions, packager: WinPackager): Promise<boolean> {\n  const signing = resolveWindowsSigningConfiguration(options.options)\n  if (signing?.type === \"azure\") {\n    log.info({ path: log.filePath(options.path) }, \"signing with Azure Trusted Signing\")\n  } else if (signing?.type === \"hsm\") {\n    log.info({ path: log.filePath(options.path) }, \"signing with signtool.exe (HSM)\")\n  } else if (signing?.type === \"pkcs11\") {\n    log.info({ path: log.filePath(options.path) }, \"signing with osslsigncode (PKCS#11)\")\n  } else {\n    log.info({ path: log.filePath(options.path) }, \"signing with signtool.exe\")\n  }\n  const packageManager = await packager.signingManager.value\n  return signWithRetry(async () => packageManager.signFile(options))\n}\n\nfunction signWithRetry(signer: () => Promise<boolean>): Promise<boolean> {\n  return retry(signer, {\n    retries: 3,\n    interval: 1000,\n    backoff: 1000,\n    shouldRetry: (e: any) => {\n      const message = e.message\n      if (\n        // https://github.com/electron-userland/electron-builder/issues/1414\n        message?.includes(\"Couldn't resolve host name\") ||\n        // https://github.com/electron-userland/electron-builder/issues/8615\n        message?.includes(\"being used by another process.\")\n      ) {\n        log.warn({ error: message }, \"attempt to sign failed, another attempt will be made\")\n        return true\n      }\n      return false\n    },\n  })\n}\n"]}
+{"version":3,"file":"windowsCodeSign.js","sourceRoot":"","sources":["../../../src/codeSign/win/windowsCodeSign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,kCAAkC,EAAwB,MAAM,6BAA6B,CAAA;AAStG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA2B,EAAE,QAAqB;IAClF,MAAM,OAAO,GAAG,kCAAkC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACnE,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAA;IAE1D,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,wHAAwH;IACxH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;IAEhF,IAAI,MAAM,KAAK,wBAAwB,EAAE,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,wCAAwC,EAAE,EAAE,iBAAiB,CAAC,CAAA;IACzF,CAAC;SAAM,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,gCAAgC,CAAC,CAAA;IACtD,CAAC;SAAM,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,mCAAmC,CAAC,CAAA;IACzD,CAAC;SAAM,IAAI,OAAO,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,gCAAgC,CAAC,CAAA;IACtD,CAAC;SAAM,IAAI,OAAO,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,oCAAoC,CAAC,CAAA;IAC1D,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,0BAA0B,CAAC,CAAA;IAChD,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,aAAa,CAAI,MAAwB;IAChD,OAAO,KAAK,CAAC,MAAM,EAAE;QACnB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,CAAC,CAAM,EAAE,EAAE;YACtB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAA;YACzB;YACE,oEAAoE;YACpE,OAAO,EAAE,QAAQ,CAAC,4BAA4B,CAAC;gBAC/C,oEAAoE;gBACpE,OAAO,EAAE,QAAQ,CAAC,gCAAgC,CAAC,EACnD,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,sDAAsD,CAAC,CAAA;gBACpF,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { log, retry } from \"builder-util\"\nimport { resolveWindowsSigningConfiguration, WindowsConfiguration } from \"../../options/winOptions.js\"\nimport { WinPackager } from \"../../winPackager.js\"\nimport { SignFileResult } from \"../signResult.js\"\n\nexport interface WindowsSignOptions {\n  readonly path: string\n  readonly options: WindowsConfiguration\n}\n\nexport async function signWindows(options: WindowsSignOptions, packager: WinPackager): Promise<SignFileResult> {\n  const signing = resolveWindowsSigningConfiguration(options.options)\n  const packageManager = await packager.signingManager.value\n\n  const path = log.filePath(options.path)\n  // no \"signing...\" pre-log here: the sign managers already log \"signing\" with certificate details right before executing\n  const result = await signWithRetry(async () => packageManager.signFile(options))\n\n  if (result === \"skipped:no-certificate\") {\n    log.info({ path, reason: \"no code signing certificate configured\" }, \"signing skipped\")\n  } else if (result === \"signed:custom\") {\n    log.info({ path }, \"signed with custom `sign` hook\")\n  } else if (signing?.type === \"azure\") {\n    log.info({ path }, \"signed with Azure Trusted Signing\")\n  } else if (signing?.type === \"hsm\") {\n    log.info({ path }, \"signed with signtool.exe (HSM)\")\n  } else if (signing?.type === \"pkcs11\") {\n    log.info({ path }, \"signed with osslsigncode (PKCS#11)\")\n  } else {\n    log.info({ path }, \"signed with signtool.exe\")\n  }\n\n  return result\n}\n\nfunction signWithRetry<T>(signer: () => Promise<T>): Promise<T> {\n  return retry(signer, {\n    retries: 3,\n    interval: 1000,\n    backoff: 1000,\n    shouldRetry: (e: any) => {\n      const message = e.message\n      if (\n        // https://github.com/electron-userland/electron-builder/issues/1414\n        message?.includes(\"Couldn't resolve host name\") ||\n        // https://github.com/electron-userland/electron-builder/issues/8615\n        message?.includes(\"being used by another process.\")\n      ) {\n        log.warn({ error: message }, \"attempt to sign failed, another attempt will be made\")\n        return true\n      }\n      return false\n    },\n  })\n}\n"]}

package/dist/codeSign/win/windowsSignAzureManager.d.ts

@@ -5,6 +5,7 @@ import { WindowsConfiguration } from "../../options/winOptions.js";
 import { WinPackager } from "../../winPackager.js";
 import { SignManager } from "./signManager.js";
 import { WindowsSignOptions } from "./windowsCodeSign.js";
+import { SignFileResult } from "../signResult.js";
 import { CertificateFromStoreInfo, FileCodeSigningInfo } from "./windowsSignToolManager.js";
 export declare class WindowsSignAzureManager implements SignManager {
     private readonly packager;
@@ -17,7 +18,7 @@ export declare class WindowsSignAzureManager implements SignManager {
     initialize(): Promise<void>;
     computePublisherName(_target: Target, publisherName: string | null): Promise<string>;
     readonly cscInfo: MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>;
-    signFile(options: WindowsSignOptions): Promise<boolean>;
+    signFile(options: WindowsSignOptions): Promise<SignFileResult>;
     private signFileLegacy;
     private signFileWithDlib;
 }

package/dist/codeSign/win/windowsSignAzureManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"windowsSignAzureManager.d.ts","sourceRoot":"","sources":["../../../src/codeSign/win/windowsSignAzureManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAW,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAiE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAKjI,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAI3F,qBAAa,uBAAwB,YAAW,WAAW;IAkB7C,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAjBrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAGnD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAsJ;IAEzK,QAAQ,CAAC,qBAAqB,wBAE5B;IAEF,OAAO,KAAK,aAAa,GAMxB;gBAE4B,QAAQ,EAAE,WAAW;IAQlD,OAAO,CAAC,YAAY;IAYd,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAyBjC,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAIpF,QAAQ,CAAC,OAAO,wFAGf;IAEK,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;YAI/C,cAAc;YA0Cd,gBAAgB;CAyE/B"}
+{"version":3,"file":"windowsSignAzureManager.d.ts","sourceRoot":"","sources":["../../../src/codeSign/win/windowsSignAzureManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAW,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAiE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAKjI,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAI3F,qBAAa,uBAAwB,YAAW,WAAW;IAkB7C,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAjBrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAGnD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAsJ;IAEzK,QAAQ,CAAC,qBAAqB,wBAE5B;IAEF,OAAO,KAAK,aAAa,GAMxB;gBAE4B,QAAQ,EAAE,WAAW;IAQlD,OAAO,CAAC,YAAY;IAYd,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAyBjC,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAIpF,QAAQ,CAAC,OAAO,wFAGf;IAEK,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC;YAItD,cAAc;YA0Cd,gBAAgB;CAyE/B"}

package/dist/codeSign/win/windowsSignAzureManager.js

@@ -102,7 +102,7 @@ export class WindowsSignAzureManager {
         const psCommand = `Invoke-TrustedSigning ${paramsString}`;
         const encodedCommand = Buffer.from(psCommand, "utf16le").toString("base64");
         await vm.exec(ps, ["-NoProfile", "-NonInteractive", "-EncodedCommand", encodedCommand]);
-        return true;
+        return "signed";
     }
     async signFileWithDlib(options) {
         const { signing } = this;
@@ -166,7 +166,7 @@ export class WindowsSignAzureManager {
         // back to the same location on the host filesystem.
         const execOptions = dotnetRootPath != null ? { env: { DOTNET_ROOT: this.vm.toVmFile(dotnetRootPath) } } : undefined;
         await this.vm.exec(signtoolPath, args, execOptions);
-        return true;
+        return "signed";
     }
 }
 //# sourceMappingURL=windowsSignAzureManager.js.map

package/dist/codeSign/win/windowsSignAzureManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"windowsSignAzureManager.js","sourceRoot":"","sources":["../../../src/codeSign/win/windowsSignAzureManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,kCAAkC,EAAmD,MAAM,6BAA6B,CAAA;AACjI,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AAC/H,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAKlD,OAAO,MAAM,MAAM,QAAQ,CAAA;AAE3B,MAAM,gCAAgC,GAAG,OAAO,CAAA;AAChD,MAAM,OAAO,uBAAuB;IAUlC,IAAY,aAAa;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAA;QACzC,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAA;QAC/H,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,YAA6B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;QAflD,4FAA4F;QAC3E,OAAE,GAAc,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;QAEhK,0BAAqB,GAAG,IAAI,IAAI,CAAuB,GAAG,EAAE;YACnE,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;QA2DO,YAAO,GAAG,IAAI,QAAQ,CAC7B,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,EACnC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CACnC,CAAA;QAnDC,MAAM,OAAO,GAAG,kCAAkC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC5E,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,iEAAiE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QACnG,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;IAEO,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAA;QACtD,sGAAsG;QACtG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAA;QACd,CAAC;QACD,iGAAiG;QACjG,2FAA2F;QAC3F,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;QAChE,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACzB,OAAM;QACR,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAA;QACtD,GAAG,CAAC,IAAI,CACN;YACE,MAAM,EAAE,yBAAyB,MAAM,CAAC,GAAG,CAAC,2BAA2B,gCAAgC,GAAG;YAC1G,QAAQ,EAAE,mDAAmD,gCAAgC,4DAA4D;SAC1J,EACD,kFAAkF,CACnF,CAAA;QAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAC3C,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,oEAAoE,CAAC,CAAA;QACpF,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,yFAAyF,CAAC,CAAC,CAAA;QAC7J,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,kEAAkE,CAAC,CAAA;QAC1H,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,2GAA2G,CAAC,CAAC,CAAA;IAC/K,CAAC;IAED,oBAAoB,CAAC,OAAe,EAAE,aAA4B;QAChE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,CAAA;IAC7D,CAAC;IAOD,KAAK,CAAC,QAAQ,CAAC,OAA2B;QACxC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC5F,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAA2B;QACtD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;QACxB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAE3C,2EAA2E;QAC3E,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,aAAa,GAAG,0BAA0B,CAAA;QAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,sIAAsI,CACrK,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAuC;YACjD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,oCAAoC;YAClF,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,QAAQ;YACpD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,QAAQ;YAC1C,GAAG,OAAO,CAAC,kBAAkB;YAC7B,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;SACjC,CAAA;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;aAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;QAEZ,+EAA+E;QAC/E,gFAAgF;QAChF,mGAAmG;QACnG,MAAM,SAAS,GAAG,yBAAyB,YAAY,EAAE,CAAA;QACzD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC3E,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAA;QACvF,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,OAA2B;QACxD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAA;QAC9D,MAAM,QAAQ,GAAG,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,IAAI,IAAI,CAAA;QAEvE,yFAAyF;QACzF,wFAAwF;QACxF,wEAAwE;QACxE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA;QAC3D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAA;QAClH,uFAAuF;QACvF,2FAA2F;QAC3F,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAClG,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;QAE1D,IAAI,QAAgB,CAAA;QACpB,IAAI,cAAc,GAAkB,IAAI,CAAA;QAExC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;YAC3D,4EAA4E;YAC5E,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAA;QAChE,CAAC;aAAM,CAAC;YACN,wFAAwF;YACxF,4FAA4F;YAC5F,4FAA4F;YAC5F,6FAA6F;YAC7F,oBAAoB;YACpB,MAAM,OAAO,GAAG,qBAAqB,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAA;YACvE,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;YAClE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAA;YAClG,cAAc,GAAG,eAAe,CAAC,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAA;QACtE,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7D,MAAM,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;YACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,GAAG,OAAO,CAAC,kBAAkB;SAC9B,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG;YACX,MAAM;YACN,KAAK;YACL,CAAC,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE;YAC9C,KAAK;YACL,OAAO,CAAC,gBAAgB,IAAI,oCAAoC;YAChE,KAAK;YACL,CAAC,OAAO,CAAC,eAAe,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE;YACnD,OAAO;YACP,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC1B,OAAO;YACP,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;SAC/B,CAAA;QAED,GAAG,CAAC,IAAI,CACN;YACE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,sBAAsB;YACvC,OAAO,EAAE,OAAO,CAAC,sBAAsB;SACxC,EACD,qDAAqD,CACtD,CAAA;QAED,oFAAoF;QACpF,yFAAyF;QACzF,oDAAoD;QACpD,MAAM,WAAW,GAAG,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QACnH,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,WAAW,CAAC,CAAA;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;CACF","sourcesContent":["import { Arch, isEmptyOrSpaces, log, sanitizeDirPath } from \"builder-util\"\nimport { asArray, MemoLazy } from \"builder-util-runtime\"\nimport _fsExtra from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { Target } from \"../../core.js\"\nimport { resolveWindowsSigningConfiguration, WindowsAzureSigningConfig, WindowsConfiguration } from \"../../options/winOptions.js\"\nimport { getAtsBundleDir, getDotnetRuntimeDir, getWindowsKitsBundle, WIN_CODESIGN_LATEST } from \"../../toolsets/winCodeSign.js\"\nimport { resolveToolsetVersion } from \"../../toolsets/version.js\"\nimport { VmManager } from \"../../vm/vm.js\"\nimport { WineVmManager } from \"../../vm/WineVm.js\"\nimport { WinPackager } from \"../../winPackager.js\"\nimport { SignManager } from \"./signManager.js\"\nimport { WindowsSignOptions } from \"./windowsCodeSign.js\"\nimport { CertificateFromStoreInfo, FileCodeSigningInfo } from \"./windowsSignToolManager.js\"\nimport semver from \"semver\"\n\nconst minimumWinCodeSignVersionForDlib = \"1.3.0\"\nexport class WindowsSignAzureManager implements SignManager {\n  private readonly signing: WindowsAzureSigningConfig\n\n  // signtool.exe is a Windows PE binary; use Wine on non-Windows (same pattern as MsiTarget).\n  private readonly vm: VmManager = process.platform === \"win32\" ? new VmManager() : new WineVmManager(this.packager.config.toolsets?.wine, this.packager.buildResourcesDir)\n\n  readonly computedPublisherName = new Lazy<Array<string> | null>(() => {\n    return Promise.resolve(asArray(this.publisherName))\n  })\n\n  private get publisherName(): string {\n    const result = this.signing.publisherName\n    if (isEmptyOrSpaces(result)) {\n      throw new Error(\"Azure Trusted Signing requires 'publisherName' in win.sign config (no local certificate to derive it from)\")\n    }\n    return result\n  }\n\n  constructor(private readonly packager: WinPackager) {\n    const signing = resolveWindowsSigningConfiguration(packager.platformOptions)\n    if (signing?.type !== \"azure\") {\n      throw new Error(`WindowsSignAzureManager requires signing.type = \"azure\", got: ${signing?.type}`)\n    }\n    this.signing = signing\n  }\n\n  private isLegacyMode(): boolean {\n    const wcs = this.packager.config.toolsets?.winCodeSign\n    // ToolsetCustom object = user-managed bundle (provides its own dlib alongside signtool) → not legacy.\n    if (typeof wcs === \"object\" && wcs != null) {\n      return false\n    }\n    // Unset / null / \"latest\" resolve to the newest bundle, which ships the ATS dlib + .NET payload.\n    // An explicit version below 1.3.0 (e.g. \"0.0.0\", \"1.2.1\") has no dlib → legacy PowerShell.\n    const resolved = resolveToolsetVersion(wcs, WIN_CODESIGN_LATEST)\n    return semver.lt(resolved, minimumWinCodeSignVersionForDlib)\n  }\n\n  async initialize(): Promise<void> {\n    if (!this.isLegacyMode()) {\n      return\n    }\n\n    const wcs = this.packager.config.toolsets?.winCodeSign\n    log.info(\n      {\n        reason: `toolsets.winCodeSign \"${String(wcs)}\" is below the minimum \"${minimumWinCodeSignVersionForDlib}\"`,\n        guidance: `leave toolsets.winCodeSign unset (or set it to \"${minimumWinCodeSignVersionForDlib}\" / \"latest\") to use the faster signtool /dlib integration`,\n      },\n      `Azure Trusted Signing: falling back to legacy PowerShell (Invoke-TrustedSigning)`\n    )\n\n    const vm = await this.packager.vm.value\n    const ps = await vm.powershellCommand.value\n    log.info(null, \"installing required module (TrustedSigning) with scope CurrentUser\")\n    try {\n      await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser\"])\n    } catch (error: any) {\n      log.debug({ message: error.message || error.stack }, \"unable to install PackageProvider NuGet — may already be present\")\n    }\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-Module -Name TrustedSigning -MinimumVersion 0.5.0 -Force -Repository PSGallery -Scope CurrentUser\"])\n  }\n\n  computePublisherName(_target: Target, publisherName: string | null): Promise<string> {\n    return Promise.resolve(this.publisherName ?? publisherName)\n  }\n\n  readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(\n    () => this.packager.platformOptions,\n    _selected => Promise.resolve(null)\n  )\n\n  async signFile(options: WindowsSignOptions): Promise<boolean> {\n    return this.isLegacyMode() ? this.signFileLegacy(options) : this.signFileWithDlib(options)\n  }\n\n  private async signFileLegacy(options: WindowsSignOptions): Promise<boolean> {\n    const { signing } = this\n    const vm = await this.packager.vm.value\n    const ps = await vm.powershellCommand.value\n\n    // Validate additionalMetadata keys before embedding as PS parameter names.\n    // Keys flow directly into `-${field} '...'` in the command string; a key\n    // containing semicolons or quotes would be PowerShell injection.\n    const PS_PARAM_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/\n    for (const key of Object.keys(signing.additionalMetadata ?? {})) {\n      if (!PS_PARAM_NAME.test(key)) {\n        throw new Error(\n          `additionalMetadata key \"${key}\" is not a valid PowerShell parameter name. Keys must match /^[A-Za-z_][A-Za-z0-9_]*$/ (e.g. \"ExcludeCredentials\", \"CorrelationId\").`\n        )\n      }\n    }\n\n    const params: Record<string, string | undefined> = {\n      Endpoint: signing.endpoint,\n      CertificateProfileName: signing.certificateProfileName,\n      CodeSigningAccountName: signing.codeSigningAccountName,\n      TimestampRfc3161: signing.timestampRfc3161 ?? \"http://timestamp.acs.microsoft.com\",\n      TimestampDigest: signing.timestampDigest ?? \"SHA256\",\n      FileDigest: signing.fileDigest ?? \"SHA256\",\n      ...signing.additionalMetadata,\n      Files: vm.toVmFile(options.path),\n    }\n\n    const paramsString = Object.entries(params)\n      .filter(([, value]) => value != null)\n      .map(([field, value]) => `-${field} '${String(value).replace(/'/g, \"''\")}'`)\n      .join(\" \")\n\n    // Use -EncodedCommand (Base64 UTF-16LE) so the command string is opaque to any\n    // intermediate shell or argument parser — no cmd.exe / ConHost escaping needed.\n    // PowerShell still parses the decoded string, so PS-level single-quote escaping above is retained.\n    const psCommand = `Invoke-TrustedSigning ${paramsString}`\n    const encodedCommand = Buffer.from(psCommand, \"utf16le\").toString(\"base64\")\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-EncodedCommand\", encodedCommand])\n    return true\n  }\n\n  private async signFileWithDlib(options: WindowsSignOptions): Promise<boolean> {\n    const { signing } = this\n    const winCodeSign = this.packager.config.toolsets?.winCodeSign\n    const isCustom = typeof winCodeSign === \"object\" && winCodeSign != null\n\n    // The ATS payload (dlib + its dependency closure) ships x64/x86 only; the bundle's arm64\n    // dir has no dlib. On arm64 hosts use the x64 signtool + dlib — x64 signtool runs under\n    // Windows-on-ARM emulation natively, and under x64 Wine on macOS/Linux.\n    const arch = process.arch === \"ia32\" ? Arch.ia32 : Arch.x64\n    const { kit: kitDir } = await getWindowsKitsBundle({ winCodeSign, resourcesDir: this.packager.buildResourcesDir })\n    // For custom toolsets the kit lives within buildResourcesDir; enforce that constraint.\n    // For versioned/cached bundles no base constraint is needed (paths are in the tool cache).\n    const safeKitDir = sanitizeDirPath(kitDir, isCustom ? this.packager.buildResourcesDir : undefined)\n    const signtoolPath = path.join(safeKitDir, \"signtool.exe\")\n\n    let dlibPath: string\n    let dotnetRootPath: string | null = null\n\n    if (typeof winCodeSign === \"object\" && winCodeSign != null) {\n      // Custom toolset: user provides the dlib alongside signtool in the kit dir.\n      dlibPath = path.join(safeKitDir, \"Azure.CodeSigning.Dlib.dll\")\n    } else {\n      // Built-in bundle. Unset / null / \"latest\" resolve to the newest version (>= 1.3.0); an\n      // explicit >= 1.3.0 version is used as-is. The dlib ships in a separate ats-bundle with its\n      // full native dependency closure (Ijwhost.dll, VC++ runtime, etc.). The .NET 8 framework is\n      // in a separate dotnet-runtime bundle; DOTNET_ROOT tells Ijwhost where to find hostfxr.dll →\n      // shared framework.\n      const version = resolveToolsetVersion(winCodeSign, WIN_CODESIGN_LATEST)\n      const safeAtsDir = sanitizeDirPath(await getAtsBundleDir(version))\n      dlibPath = path.join(safeAtsDir, arch === Arch.ia32 ? \"x86\" : \"x64\", \"Azure.CodeSigning.Dlib.dll\")\n      dotnetRootPath = sanitizeDirPath(await getDotnetRuntimeDir(version))\n    }\n\n    const metadataPath = await this.packager.getTempFile(\".json\")\n    await _fsExtra.writeJson(metadataPath, {\n      Endpoint: signing.endpoint,\n      CodeSigningAccountName: signing.codeSigningAccountName,\n      CertificateProfileName: signing.certificateProfileName,\n      ...signing.additionalMetadata,\n    })\n\n    const args = [\n      \"sign\",\n      \"/fd\",\n      (signing.fileDigest ?? \"SHA256\").toUpperCase(),\n      \"/tr\",\n      signing.timestampRfc3161 ?? \"http://timestamp.acs.microsoft.com\",\n      \"/td\",\n      (signing.timestampDigest ?? \"SHA256\").toUpperCase(),\n      \"/dlib\",\n      this.vm.toVmFile(dlibPath),\n      \"/dmdf\",\n      this.vm.toVmFile(metadataPath),\n      this.vm.toVmFile(options.path),\n    ]\n\n    log.info(\n      {\n        file: log.filePath(options.path),\n        endpoint: signing.endpoint,\n        account: signing.codeSigningAccountName,\n        profile: signing.certificateProfileName,\n      },\n      \"signing with Azure Trusted Signing (signtool /dlib)\"\n    )\n\n    // DOTNET_ROOT: Ijwhost.dll (shipped in the ats-bundle) reads this env var to locate\n    // hostfxr.dll. On Wine, toVmFile converts the host path to a Z:\\ path that Wine resolves\n    // back to the same location on the host filesystem.\n    const execOptions = dotnetRootPath != null ? { env: { DOTNET_ROOT: this.vm.toVmFile(dotnetRootPath) } } : undefined\n    await this.vm.exec(signtoolPath, args, execOptions)\n    return true\n  }\n}\n"]}
+{"version":3,"file":"windowsSignAzureManager.js","sourceRoot":"","sources":["../../../src/codeSign/win/windowsSignAzureManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,kCAAkC,EAAmD,MAAM,6BAA6B,CAAA;AACjI,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AAC/H,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAMlD,OAAO,MAAM,MAAM,QAAQ,CAAA;AAE3B,MAAM,gCAAgC,GAAG,OAAO,CAAA;AAChD,MAAM,OAAO,uBAAuB;IAUlC,IAAY,aAAa;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAA;QACzC,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAA;QAC/H,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,YAA6B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;QAflD,4FAA4F;QAC3E,OAAE,GAAc,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;QAEhK,0BAAqB,GAAG,IAAI,IAAI,CAAuB,GAAG,EAAE;YACnE,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;QA2DO,YAAO,GAAG,IAAI,QAAQ,CAC7B,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,EACnC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CACnC,CAAA;QAnDC,MAAM,OAAO,GAAG,kCAAkC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC5E,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,iEAAiE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QACnG,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;IAEO,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAA;QACtD,sGAAsG;QACtG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAA;QACd,CAAC;QACD,iGAAiG;QACjG,2FAA2F;QAC3F,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;QAChE,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACzB,OAAM;QACR,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAA;QACtD,GAAG,CAAC,IAAI,CACN;YACE,MAAM,EAAE,yBAAyB,MAAM,CAAC,GAAG,CAAC,2BAA2B,gCAAgC,GAAG;YAC1G,QAAQ,EAAE,mDAAmD,gCAAgC,4DAA4D;SAC1J,EACD,kFAAkF,CACnF,CAAA;QAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAC3C,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,oEAAoE,CAAC,CAAA;QACpF,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,yFAAyF,CAAC,CAAC,CAAA;QAC7J,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,kEAAkE,CAAC,CAAA;QAC1H,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,2GAA2G,CAAC,CAAC,CAAA;IAC/K,CAAC;IAED,oBAAoB,CAAC,OAAe,EAAE,aAA4B;QAChE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,CAAA;IAC7D,CAAC;IAOD,KAAK,CAAC,QAAQ,CAAC,OAA2B;QACxC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC5F,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAA2B;QACtD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;QACxB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAE3C,2EAA2E;QAC3E,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,aAAa,GAAG,0BAA0B,CAAA;QAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,sIAAsI,CACrK,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAuC;YACjD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,oCAAoC;YAClF,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,QAAQ;YACpD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,QAAQ;YAC1C,GAAG,OAAO,CAAC,kBAAkB;YAC7B,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;SACjC,CAAA;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;aAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;QAEZ,+EAA+E;QAC/E,gFAAgF;QAChF,mGAAmG;QACnG,MAAM,SAAS,GAAG,yBAAyB,YAAY,EAAE,CAAA;QACzD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC3E,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAA;QACvF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,OAA2B;QACxD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAA;QAC9D,MAAM,QAAQ,GAAG,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,IAAI,IAAI,CAAA;QAEvE,yFAAyF;QACzF,wFAAwF;QACxF,wEAAwE;QACxE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA;QAC3D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAA;QAClH,uFAAuF;QACvF,2FAA2F;QAC3F,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAClG,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;QAE1D,IAAI,QAAgB,CAAA;QACpB,IAAI,cAAc,GAAkB,IAAI,CAAA;QAExC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;YAC3D,4EAA4E;YAC5E,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAA;QAChE,CAAC;aAAM,CAAC;YACN,wFAAwF;YACxF,4FAA4F;YAC5F,4FAA4F;YAC5F,6FAA6F;YAC7F,oBAAoB;YACpB,MAAM,OAAO,GAAG,qBAAqB,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAA;YACvE,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;YAClE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAA;YAClG,cAAc,GAAG,eAAe,CAAC,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAA;QACtE,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7D,MAAM,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;YACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,GAAG,OAAO,CAAC,kBAAkB;SAC9B,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG;YACX,MAAM;YACN,KAAK;YACL,CAAC,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE;YAC9C,KAAK;YACL,OAAO,CAAC,gBAAgB,IAAI,oCAAoC;YAChE,KAAK;YACL,CAAC,OAAO,CAAC,eAAe,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE;YACnD,OAAO;YACP,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC1B,OAAO;YACP,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;SAC/B,CAAA;QAED,GAAG,CAAC,IAAI,CACN;YACE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,sBAAsB;YACvC,OAAO,EAAE,OAAO,CAAC,sBAAsB;SACxC,EACD,qDAAqD,CACtD,CAAA;QAED,oFAAoF;QACpF,yFAAyF;QACzF,oDAAoD;QACpD,MAAM,WAAW,GAAG,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QACnH,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,WAAW,CAAC,CAAA;QACnD,OAAO,QAAQ,CAAA;IACjB,CAAC;CACF","sourcesContent":["import { Arch, isEmptyOrSpaces, log, sanitizeDirPath } from \"builder-util\"\nimport { asArray, MemoLazy } from \"builder-util-runtime\"\nimport _fsExtra from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { Target } from \"../../core.js\"\nimport { resolveWindowsSigningConfiguration, WindowsAzureSigningConfig, WindowsConfiguration } from \"../../options/winOptions.js\"\nimport { getAtsBundleDir, getDotnetRuntimeDir, getWindowsKitsBundle, WIN_CODESIGN_LATEST } from \"../../toolsets/winCodeSign.js\"\nimport { resolveToolsetVersion } from \"../../toolsets/version.js\"\nimport { VmManager } from \"../../vm/vm.js\"\nimport { WineVmManager } from \"../../vm/WineVm.js\"\nimport { WinPackager } from \"../../winPackager.js\"\nimport { SignManager } from \"./signManager.js\"\nimport { WindowsSignOptions } from \"./windowsCodeSign.js\"\nimport { SignFileResult } from \"../signResult.js\"\nimport { CertificateFromStoreInfo, FileCodeSigningInfo } from \"./windowsSignToolManager.js\"\nimport semver from \"semver\"\n\nconst minimumWinCodeSignVersionForDlib = \"1.3.0\"\nexport class WindowsSignAzureManager implements SignManager {\n  private readonly signing: WindowsAzureSigningConfig\n\n  // signtool.exe is a Windows PE binary; use Wine on non-Windows (same pattern as MsiTarget).\n  private readonly vm: VmManager = process.platform === \"win32\" ? new VmManager() : new WineVmManager(this.packager.config.toolsets?.wine, this.packager.buildResourcesDir)\n\n  readonly computedPublisherName = new Lazy<Array<string> | null>(() => {\n    return Promise.resolve(asArray(this.publisherName))\n  })\n\n  private get publisherName(): string {\n    const result = this.signing.publisherName\n    if (isEmptyOrSpaces(result)) {\n      throw new Error(\"Azure Trusted Signing requires 'publisherName' in win.sign config (no local certificate to derive it from)\")\n    }\n    return result\n  }\n\n  constructor(private readonly packager: WinPackager) {\n    const signing = resolveWindowsSigningConfiguration(packager.platformOptions)\n    if (signing?.type !== \"azure\") {\n      throw new Error(`WindowsSignAzureManager requires signing.type = \"azure\", got: ${signing?.type}`)\n    }\n    this.signing = signing\n  }\n\n  private isLegacyMode(): boolean {\n    const wcs = this.packager.config.toolsets?.winCodeSign\n    // ToolsetCustom object = user-managed bundle (provides its own dlib alongside signtool) → not legacy.\n    if (typeof wcs === \"object\" && wcs != null) {\n      return false\n    }\n    // Unset / null / \"latest\" resolve to the newest bundle, which ships the ATS dlib + .NET payload.\n    // An explicit version below 1.3.0 (e.g. \"0.0.0\", \"1.2.1\") has no dlib → legacy PowerShell.\n    const resolved = resolveToolsetVersion(wcs, WIN_CODESIGN_LATEST)\n    return semver.lt(resolved, minimumWinCodeSignVersionForDlib)\n  }\n\n  async initialize(): Promise<void> {\n    if (!this.isLegacyMode()) {\n      return\n    }\n\n    const wcs = this.packager.config.toolsets?.winCodeSign\n    log.info(\n      {\n        reason: `toolsets.winCodeSign \"${String(wcs)}\" is below the minimum \"${minimumWinCodeSignVersionForDlib}\"`,\n        guidance: `leave toolsets.winCodeSign unset (or set it to \"${minimumWinCodeSignVersionForDlib}\" / \"latest\") to use the faster signtool /dlib integration`,\n      },\n      `Azure Trusted Signing: falling back to legacy PowerShell (Invoke-TrustedSigning)`\n    )\n\n    const vm = await this.packager.vm.value\n    const ps = await vm.powershellCommand.value\n    log.info(null, \"installing required module (TrustedSigning) with scope CurrentUser\")\n    try {\n      await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser\"])\n    } catch (error: any) {\n      log.debug({ message: error.message || error.stack }, \"unable to install PackageProvider NuGet — may already be present\")\n    }\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-Module -Name TrustedSigning -MinimumVersion 0.5.0 -Force -Repository PSGallery -Scope CurrentUser\"])\n  }\n\n  computePublisherName(_target: Target, publisherName: string | null): Promise<string> {\n    return Promise.resolve(this.publisherName ?? publisherName)\n  }\n\n  readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(\n    () => this.packager.platformOptions,\n    _selected => Promise.resolve(null)\n  )\n\n  async signFile(options: WindowsSignOptions): Promise<SignFileResult> {\n    return this.isLegacyMode() ? this.signFileLegacy(options) : this.signFileWithDlib(options)\n  }\n\n  private async signFileLegacy(options: WindowsSignOptions): Promise<SignFileResult> {\n    const { signing } = this\n    const vm = await this.packager.vm.value\n    const ps = await vm.powershellCommand.value\n\n    // Validate additionalMetadata keys before embedding as PS parameter names.\n    // Keys flow directly into `-${field} '...'` in the command string; a key\n    // containing semicolons or quotes would be PowerShell injection.\n    const PS_PARAM_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/\n    for (const key of Object.keys(signing.additionalMetadata ?? {})) {\n      if (!PS_PARAM_NAME.test(key)) {\n        throw new Error(\n          `additionalMetadata key \"${key}\" is not a valid PowerShell parameter name. Keys must match /^[A-Za-z_][A-Za-z0-9_]*$/ (e.g. \"ExcludeCredentials\", \"CorrelationId\").`\n        )\n      }\n    }\n\n    const params: Record<string, string | undefined> = {\n      Endpoint: signing.endpoint,\n      CertificateProfileName: signing.certificateProfileName,\n      CodeSigningAccountName: signing.codeSigningAccountName,\n      TimestampRfc3161: signing.timestampRfc3161 ?? \"http://timestamp.acs.microsoft.com\",\n      TimestampDigest: signing.timestampDigest ?? \"SHA256\",\n      FileDigest: signing.fileDigest ?? \"SHA256\",\n      ...signing.additionalMetadata,\n      Files: vm.toVmFile(options.path),\n    }\n\n    const paramsString = Object.entries(params)\n      .filter(([, value]) => value != null)\n      .map(([field, value]) => `-${field} '${String(value).replace(/'/g, \"''\")}'`)\n      .join(\" \")\n\n    // Use -EncodedCommand (Base64 UTF-16LE) so the command string is opaque to any\n    // intermediate shell or argument parser — no cmd.exe / ConHost escaping needed.\n    // PowerShell still parses the decoded string, so PS-level single-quote escaping above is retained.\n    const psCommand = `Invoke-TrustedSigning ${paramsString}`\n    const encodedCommand = Buffer.from(psCommand, \"utf16le\").toString(\"base64\")\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-EncodedCommand\", encodedCommand])\n    return \"signed\"\n  }\n\n  private async signFileWithDlib(options: WindowsSignOptions): Promise<SignFileResult> {\n    const { signing } = this\n    const winCodeSign = this.packager.config.toolsets?.winCodeSign\n    const isCustom = typeof winCodeSign === \"object\" && winCodeSign != null\n\n    // The ATS payload (dlib + its dependency closure) ships x64/x86 only; the bundle's arm64\n    // dir has no dlib. On arm64 hosts use the x64 signtool + dlib — x64 signtool runs under\n    // Windows-on-ARM emulation natively, and under x64 Wine on macOS/Linux.\n    const arch = process.arch === \"ia32\" ? Arch.ia32 : Arch.x64\n    const { kit: kitDir } = await getWindowsKitsBundle({ winCodeSign, resourcesDir: this.packager.buildResourcesDir })\n    // For custom toolsets the kit lives within buildResourcesDir; enforce that constraint.\n    // For versioned/cached bundles no base constraint is needed (paths are in the tool cache).\n    const safeKitDir = sanitizeDirPath(kitDir, isCustom ? this.packager.buildResourcesDir : undefined)\n    const signtoolPath = path.join(safeKitDir, \"signtool.exe\")\n\n    let dlibPath: string\n    let dotnetRootPath: string | null = null\n\n    if (typeof winCodeSign === \"object\" && winCodeSign != null) {\n      // Custom toolset: user provides the dlib alongside signtool in the kit dir.\n      dlibPath = path.join(safeKitDir, \"Azure.CodeSigning.Dlib.dll\")\n    } else {\n      // Built-in bundle. Unset / null / \"latest\" resolve to the newest version (>= 1.3.0); an\n      // explicit >= 1.3.0 version is used as-is. The dlib ships in a separate ats-bundle with its\n      // full native dependency closure (Ijwhost.dll, VC++ runtime, etc.). The .NET 8 framework is\n      // in a separate dotnet-runtime bundle; DOTNET_ROOT tells Ijwhost where to find hostfxr.dll →\n      // shared framework.\n      const version = resolveToolsetVersion(winCodeSign, WIN_CODESIGN_LATEST)\n      const safeAtsDir = sanitizeDirPath(await getAtsBundleDir(version))\n      dlibPath = path.join(safeAtsDir, arch === Arch.ia32 ? \"x86\" : \"x64\", \"Azure.CodeSigning.Dlib.dll\")\n      dotnetRootPath = sanitizeDirPath(await getDotnetRuntimeDir(version))\n    }\n\n    const metadataPath = await this.packager.getTempFile(\".json\")\n    await _fsExtra.writeJson(metadataPath, {\n      Endpoint: signing.endpoint,\n      CodeSigningAccountName: signing.codeSigningAccountName,\n      CertificateProfileName: signing.certificateProfileName,\n      ...signing.additionalMetadata,\n    })\n\n    const args = [\n      \"sign\",\n      \"/fd\",\n      (signing.fileDigest ?? \"SHA256\").toUpperCase(),\n      \"/tr\",\n      signing.timestampRfc3161 ?? \"http://timestamp.acs.microsoft.com\",\n      \"/td\",\n      (signing.timestampDigest ?? \"SHA256\").toUpperCase(),\n      \"/dlib\",\n      this.vm.toVmFile(dlibPath),\n      \"/dmdf\",\n      this.vm.toVmFile(metadataPath),\n      this.vm.toVmFile(options.path),\n    ]\n\n    log.info(\n      {\n        file: log.filePath(options.path),\n        endpoint: signing.endpoint,\n        account: signing.codeSigningAccountName,\n        profile: signing.certificateProfileName,\n      },\n      \"signing with Azure Trusted Signing (signtool /dlib)\"\n    )\n\n    // DOTNET_ROOT: Ijwhost.dll (shipped in the ats-bundle) reads this env var to locate\n    // hostfxr.dll. On Wine, toVmFile converts the host path to a Z:\\ path that Wine resolves\n    // back to the same location on the host filesystem.\n    const execOptions = dotnetRootPath != null ? { env: { DOTNET_ROOT: this.vm.toVmFile(dotnetRootPath) } } : undefined\n    await this.vm.exec(signtoolPath, args, execOptions)\n    return \"signed\"\n  }\n}\n"]}

package/dist/configuration.d.ts

@@ -672,6 +672,12 @@ export interface ToolsetConfig {
      * |---------|-------------|-----------------|-------|
      * | `"0.0.0"` | 4.0.1 | macOS | Legacy portable bundle (pre-v27) |
      * | `"1.0.1"` | 11.0 | macOS | Supports arm64 macOS via Rosetta |
+     * | `"system"` | host install | macOS, Linux | Uses the `wine` binary on `PATH` instead of a bundle |
+     *
+     * `"system"` is the replacement for the `USE_SYSTEM_WINE` environment variable removed in v27, and
+     * is what `"latest"` (the default) currently resolves to on every platform: the published `"1.0.1"`
+     * bundles ship no PE builtins, so a host Wine installation is required to build Windows targets on
+     * macOS or Linux.
      *
      * To use a custom Wine binary, use a `ToolsetCustom` object.
      *
@@ -679,7 +685,7 @@ export interface ToolsetConfig {
      *
      * @default "latest"
      */
-    readonly wine?: "0.0.0" | "1.0.1" | ToolsetCustom | "latest";
+    readonly wine?: "0.0.0" | "1.0.1" | "system" | ToolsetCustom | "latest";
     /**
      * Version of the FPM bundle used to build Linux packages (`.deb`, `.rpm`, `.pacman`, etc.)
      * on macOS and Linux hosts.
@@ -704,12 +710,13 @@ export interface ToolsetConfig {
      * | Version | Notes |
      * |---------|-------|
      * | `"1.0.0"` | gnu-tar, lzip, makedepend, glib, libgsf, libtool, pcre, gettext, binutils |
+     * | `"1.0.1"` | Same tools rebuilt on macOS 15 runners — binaries run on macOS 15+ (1.0.0 required macOS 26) |
      *
      * Releases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/linux-tools-mac/CHANGELOG.md
      *
      * @default "latest"
      */
-    readonly linuxToolsMac?: "1.0.0" | ToolsetCustom | "latest";
+    readonly linuxToolsMac?: "1.0.0" | "1.0.1" | ToolsetCustom | "latest";
     /**
      * Version of the 7-Zip binary bundle used internally to extract `.7z` and `.tar.xz` archives.
      *
@@ -721,9 +728,17 @@ export interface ToolsetConfig {
      * (or a bare `file://` directory). `.7z` and `.tar.xz` archives cannot be used here because
      * extracting them requires 7za — a circular dependency.
      *
+     * Available versions:
+     * | Version | Notes |
+     * |---------|-------|
+     * | `"1.0.0"` | Shipped the 32-bit `7za.exe` for every Windows arch (1.75 GiB memory cap, no LZMA2 multithreading on x64/arm64) |
+     * | `"1.0.1"` | Correct per-arch Windows binaries (x64, ia32, arm64) |
+     *
+     * Releases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/7zip/CHANGELOG.md
+     *
      * @default "latest"
      */
-    readonly sevenZip?: "1.0.0" | ToolsetCustom | "latest";
+    readonly sevenZip?: "1.0.0" | "1.0.1" | ToolsetCustom | "latest";
     /**
      * Version of the icons-conversion bundle used to convert source images to `.icns`, `.ico`,
      * and PNG icon sets.
@@ -740,6 +755,30 @@ export interface ToolsetConfig {
      * @default "latest"
      */
     readonly icons?: "1.2.3" | ToolsetCustom | "latest";
+    /**
+     * Version of the `squirrel.windows` bundle used to build Squirrel.Windows installers.
+     *
+     * The bundle ships the Squirrel vendor toolset under `electron-winstaller/vendor/`:
+     * - **`Squirrel.exe`** / **`Squirrel-Mono.exe`** — releasify the app into `Setup.exe` (and an optional MSI).
+     * - **`SyncReleases.exe`** — downloads prior releases to produce delta packages.
+     * - **`nuget.exe`**, **`7z`** — pack the app into a `.nupkg` and compress release assets.
+     *
+     * `rcedit.exe` is provisioned from the {@link winCodeSign} toolset at runtime (on every platform;
+     * under Wine on non-Windows hosts). Building an MSI additionally uses the shared WiX toolset.
+     *
+     * Available versions:
+     * | Version | Notes |
+     * |---------|-------|
+     * | `"1.1.1"` | Squirrel.Windows 2.0.1 (patched) with a standalone, checksum-verified `nuget.exe` 6.14.0 |
+     *
+     * Set to a {@link ToolsetCustom} object to supply your own bundle — it must contain the
+     * `electron-winstaller/vendor/` subtree. Only used when building the `squirrelWindows` target.
+     *
+     * Releases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/squirrel.windows/CHANGELOG.md
+     *
+     * @default "latest"
+     */
+    readonly squirrel?: "1.1.1" | ToolsetCustom | "latest";
 }
 /**
  * A custom toolset bundle supplied by the user in place of a built-in versioned bundle.
@@ -775,7 +814,9 @@ export interface ToolsetCustom {
      */
     readonly url: string;
     /**
-     * SHA checksum of the custom toolset bundle for verification.
+     * SHA-256 checksum of the custom toolset bundle for verification, as a lowercase hex string
+     * (e.g. the output of `shasum -a 256 bundle.tar.gz`) — not the base64 values GitHub release
+     * notes may show.
      * Required for remote (`https://`) URLs and local archive files (`file://`).
      * Not needed for bare directory paths — the directory is used as-is with no caching.
      */

package/dist/configuration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configuration.d.ts","sourceRoot":"","sources":["../src/configuration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AACzE,OAAO,EAAE,uCAAuC,EAAE,MAAM,gBAAgB,CAAA;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAClK,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAA;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,uCAAuC,EAAE,aAAa,CAAC,MAAM,CAAoC,CAAA;AAG9G;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE9B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEpC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAElC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAEjD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IAExC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACtC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACtC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACzC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAChC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAEhC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAA;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,GAAG,IAAI,CAAA;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;IAClC,sGAAsG;IACtG,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAC9C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAA;IACxD;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAChC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IAC5C;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,GAAG,IAAI,CAAA;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IACtC;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAChC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAA;IACpD;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAA;IAChD;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAA;IAEhD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;IAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;IAElE;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAEnD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAErC;;;;;;;;OAQG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAA;IAE1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,GAAG,CAAA;IAE5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAEnC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAE7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAEvC;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAExC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IAE7C;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CAC1C;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAc,SAAQ,mBAAmB,EAAE,4BAA4B,EAAE,KAAK;IAC7F;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAEhD;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;IAEnD;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAA;IAErC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IAEjC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAE7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,GAAG,UAAU,GAAG,IAAI,CAAA;CACxD;AAED,MAAM,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;AAE7D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACxC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAChC;AACD,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAA;AAC1C,MAAM,MAAM,iBAAiB,GAAG,WAAW,CAAA;AAC3C,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAA;AAE7C;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAE3G;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAE1E;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAE5D;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAE5D;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAEjD;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAE3D;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAEtD;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IAEpB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAE1B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,KAAK;IACpB;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEnE;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEvE;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEjE;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEjE;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEhF;;;;;;;OAOG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAE7E;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEjF;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAE/D;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEjE;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAExE;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAE/E;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,uCAAuC,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;CAC9F;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEvC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/B;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;OASG;IACH,IAAI,EAAE,MAAM,CAAA;CACb"}
+{"version":3,"file":"configuration.d.ts","sourceRoot":"","sources":["../src/configuration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AACzE,OAAO,EAAE,uCAAuC,EAAE,MAAM,gBAAgB,CAAA;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAClK,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAA;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,uCAAuC,EAAE,aAAa,CAAC,MAAM,CAAoC,CAAA;AAG9G;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE9B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEpC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAElC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAEjD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IAExC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACtC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACtC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACzC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAChC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAEhC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAA;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,GAAG,IAAI,CAAA;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;IAClC,sGAAsG;IACtG,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAC9C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAA;IACxD;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAChC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IAC5C;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,GAAG,IAAI,CAAA;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IACtC;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAChC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAA;IACpD;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAA;IAChD;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAA;IAEhD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;IAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;IAElE;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAEnD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAErC;;;;;;;;OAQG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAA;IAE1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,GAAG,CAAA;IAE5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAEnC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAE7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAEvC;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAExC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IAE7C;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CAC1C;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAc,SAAQ,mBAAmB,EAAE,4BAA4B,EAAE,KAAK;IAC7F;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAEhD;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;IAEnD;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAA;IAErC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IAEjC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAE7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,GAAG,UAAU,GAAG,IAAI,CAAA;CACxD;AAED,MAAM,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;AAE7D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACxC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAChC;AACD,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAA;AAC1C,MAAM,MAAM,iBAAiB,GAAG,WAAW,CAAA;AAC3C,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAA;AAE7C;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAE3G;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAE1E;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAE5D;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,QAAQ,CAAA;IAEvE;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAEjD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAErE;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAEhE;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAEnD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;CACvD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IAEpB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAE1B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,KAAK;IACpB;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEnE;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEvE;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEjE;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEjE;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEhF;;;;;;;OAOG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAE7E;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEjF;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAE/D;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEjE;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAExE;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAE/E;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,uCAAuC,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;CAC9F;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEvC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/B;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;OASG;IACH,IAAI,EAAE,MAAM,CAAA;CACb"}