node-opcua-pki 6.22.0 → 7.0.0

package/dist/lib/ca/core/ca_backend.d.ts

@@ -0,0 +1,89 @@
+import type { Params, ProcessAltNamesParam } from "../../toolbox/index.js";
+import type { CertificateAuthorityCore } from "./certificate_authority_core.js";
+/**
+ * Everything a {@link CertificateAuthorityCore} delegates to a signing backend:
+ * the operations that need the CA's private key, or that mutate the CA's
+ * certificate database (`index.txt`, `serial`, `crlnumber`,
+ * `certs/<SERIAL>.pem`, `crl/revocation_list.*`). Everything else — directory
+ * layout, PEM/DER file concatenation, `index.txt` *reading*, URL validation,
+ * passphrase handling, `initializeCSR`'s state machine — stays in
+ * {@link CertificateAuthorityCore} and is shared by every backend.
+ *
+ * Two implementations exist. `OpenSslCaBackend` shells out to the `openssl`
+ * CLI exactly as `CertificateAuthority` always has, and remains the default.
+ * `NativeCaBackend` does the same work in pure JS, which is what allows a
+ * CA key held by an HSM or KMS - one that only signs and never exposes key
+ * material - to be used at all: the openssl CLI can only load a key from a
+ * file. Both write the same on-disk database format, so an install can move
+ * between them and external `openssl` tooling keeps working either way.
+ */
+export interface CaBackend {
+    /**
+     * Whether this backend can sign with an external {@link CaSigner} - an
+     * HSM or KMS key that only signs and never exposes key material.
+     * `false` for a backend that can only load a key from a file, so the
+     * CA can refuse the combination up front instead of failing later.
+     */
+    readonly supportsExternalSigner: boolean;
+    /**
+     * Check whatever this backend needs before it can do any work, and
+     * throw if it is missing. `CertificateAuthority` calls it before
+     * delegating, so a missing prerequisite is reported once, up front,
+     * rather than as a failure part-way through an operation.
+     *
+     * This exists because the requirement is the backend's, not the CA's:
+     * the openssl backend needs the `openssl` executable on PATH, and the
+     * native one needs nothing at all. Asking the CA to know that is what
+     * made a `backend: "native"` CA refuse to issue a certificate on a
+     * machine without openssl installed.
+     */
+    preflight(): Promise<void>;
+    /**
+     * Generate the CA's private key (if missing) and its certificate:
+     * self-signed for a root CA, signed by `ca._issuerCA` for a subordinate.
+     * Also produces the initial CRL. Called once, from
+     * {@link CertificateAuthority.initialize}.
+     */
+    bootstrap(ca: CertificateAuthorityCore): Promise<void>;
+    /**
+     * Generate a CSR for the CA's own key (`[v3_ca_req]` profile) — used by
+     * `initializeCSR`/`renewCSR` when the CA certificate is signed
+     * externally.
+     */
+    generateCaCsr(ca: CertificateAuthorityCore, caRootDir: string, privateKeyFile: string, csrFile: string): Promise<void>;
+    /**
+     * Sign a subordinate CA's CSR with this CA's key (`[v3_ca]` profile).
+     * Used by {@link CertificateAuthority.signCACertificateRequest}.
+     */
+    signSubordinateCsr(ca: CertificateAuthorityCore, csrFile: string, certFile: string, validityDays: number): Promise<void>;
+    /**
+     * Sign an end-entity CSR with this CA's key (`[usr_cert]` profile via
+     * `openssl ca`) — the certificate database (`index.txt`, `serial`,
+     * `certs/<SERIAL>.pem`) is updated as a side effect. Used by
+     * {@link CertificateAuthority.signCertificateRequest}.
+     *
+     * `sanOverride` is the applicationUri/dns/ip the caller already
+     * re-derived from the CSR itself (SANs are not copied by `openssl ca`
+     * — see the comment at the call site), so the backend can render the
+     * `subjectAltName` extension without re-parsing the CSR.
+     */
+    signEndEntityCsr(ca: CertificateAuthorityCore, certificate: string, csr: string, params: Params, sanOverride: Required<ProcessAltNamesParam>): Promise<void>;
+    /**
+     * Mark a certificate revoked in the database and regenerate the CRL.
+     * Used by {@link CertificateAuthority.revokeCertificate}.
+     */
+    revoke(ca: CertificateAuthorityCore, certificate: string, reason: string): Promise<void>;
+    /**
+     * Regenerate `crl/revocation_list.{crl,der}` from the current database
+     * state, without changing any certificate's status. Used after
+     * {@link CertificateAuthority.installCACertificate} installs an
+     * externally-signed CA certificate.
+     */
+    regenerateCrl(ca: CertificateAuthorityCore): Promise<void>;
+    /**
+     * Legacy CLI self-signed certificate creation (`openssl req` +
+     * `openssl ca -selfsign`). Used by
+     * {@link CertificateAuthority.createSelfSignedCertificate}.
+     */
+    createSelfSignedCertificate(ca: CertificateAuthorityCore, certificateFile: string, privateKeyFile: string, params: Params): Promise<void>;
+}

package/dist/lib/ca/core/ca_backend.js

@@ -0,0 +1,24 @@
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2026 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022-2026 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+export {};
+//# sourceMappingURL=ca_backend.js.map

package/dist/lib/ca/core/ca_backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ca_backend.js","sourceRoot":"","sources":["../../../../lib/ca/core/ca_backend.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,iBAAiB;AACjB,wHAAwH;AACxH,gFAAgF;AAChF,yCAAyC;AACzC,wHAAwH;AACxH,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,+GAA+G;AAC/G,sHAAsH;AACtH,kHAAkH;AAClH,mGAAmG;AACnG,EAAE;AACF,uHAAuH;AACvH,YAAY;AACZ,EAAE;AACF,uHAAuH;AACvH,wHAAwH;AACxH,mHAAmH;AACnH,mHAAmH;AACnH,wHAAwH"}

package/dist/lib/ca/core/ca_database.d.ts

@@ -0,0 +1,91 @@
+/**
+ * A record from the OpenSSL CA certificate database (`index.txt`).
+ */
+export interface IssuedCertificateRecord {
+    /** Hex-encoded serial number (e.g. `"1000"`). */
+    serial: string;
+    /** Certificate status. */
+    status: "valid" | "revoked" | "expired";
+    /** X.500 subject string (slash-delimited). */
+    subject: string;
+    /** Certificate expiry date as ISO-8601 string. */
+    expiryDate: string;
+    /**
+     * Revocation date as ISO-8601 string.
+     * Only present when `status === "revoked"`.
+     */
+    revocationDate?: string;
+    /**
+     * CRL revocation reason (e.g. `"keyCompromise"`), as stored after the
+     * comma in the revocation-date field. Only present when
+     * `status === "revoked"` and a reason was recorded.
+     */
+    reason?: string;
+}
+/**
+ * Read and write access to a CA's OpenSSL-format certificate database
+ * (`index.txt`, `serial`, `crlnumber`, `certs/<SERIAL>.pem`).
+ *
+ * This is the format `openssl ca` itself writes and reads; every mutating
+ * method here (`nextSerial`, `nextCrlNumber`, `appendIssued`, `markRevoked`,
+ * `storeCertificate`) exists so a native (non-openssl) signing backend can
+ * write the exact same on-disk format `openssl ca` does, so an install can
+ * move between backends and external `openssl` tooling keeps working on the
+ * same directory. Callers are responsible for serializing access — every
+ * mutating call must happen under the owning CA's directory lock
+ * (`CertificateAuthority._withCaDirectoryLock`), the same guarantee
+ * `OpenSslCaBackend` gets from the lock around each `openssl ca` /
+ * `openssl x509 -CAserial` invocation.
+ */
+export declare class CaDatabase {
+    #private;
+    constructor(rootDir: string);
+    /** Path to the OpenSSL certificate database file (`index.txt`). */
+    get indexFile(): string;
+    /**
+     * Parse the OpenSSL `index.txt` certificate database.
+     *
+     * Each line has tab-separated fields:
+     * ```
+     * status  expiry  [revocationDate]  serial  unknown  subject
+     * ```
+     *
+     * - status: `V` (valid), `R` (revoked), `E` (expired)
+     * - expiry: `YYMMDDHHmmssZ`
+     * - revocationDate: present only for revoked certs
+     * - serial: hex string
+     * - unknown: always `"unknown"`
+     * - subject: X.500 slash-delimited string
+     */
+    readIndex(): IssuedCertificateRecord[];
+    /** Look up one record by serial number (case-insensitive). */
+    findBySerial(serial: string): IssuedCertificateRecord | undefined;
+    /**
+     * Read a specific issued certificate by serial number.
+     *
+     * OpenSSL stores signed certificates in the `certs/` directory using
+     * the naming convention `<SERIAL>.pem`.
+     *
+     * @param serial - hex-encoded serial number (e.g. `"1000"`)
+     * @returns the DER buffer, or `undefined` if not found
+     */
+    getCertificateBySerial(serial: string): Buffer | undefined;
+    /** Hand out the next certificate serial number, bumping the `serial` file. */
+    nextSerial(): string;
+    /** Hand out the next CRL number, bumping the `crlnumber` file. */
+    nextCrlNumber(): string;
+    /** Append a newly-issued certificate's `V` (valid) row to `index.txt`. */
+    appendIssued(record: {
+        serial: string;
+        expiryDate: Date;
+        subject: string;
+    }): void;
+    /**
+     * Rewrite a certificate's `index.txt` row from `V` to `R` (revoked).
+     * Throws if the serial is not found, or is already revoked — the same
+     * "already revoked" case `openssl ca -revoke` itself rejects.
+     */
+    markRevoked(serial: string, revocationDate: Date, reason: string): void;
+    /** Store a signed certificate's PEM under `certs/<SERIAL>.pem`, as `openssl ca` does. */
+    storeCertificate(serial: string, pem: string): void;
+}

package/dist/lib/ca/core/ca_database.js

@@ -0,0 +1,267 @@
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2026 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022-2026 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+import fs from "node:fs";
+import path from "node:path";
+import { convertPEMtoDER, readCertificatePEM } from "node-opcua-crypto";
+/**
+ * Parse an OpenSSL date string (`YYMMDDHHmmssZ`) into an ISO-8601 string.
+ */
+function parseOpenSSLDate(dateStr) {
+    // Revocation dates may have a reason suffix: "YYMMDDHHmmssZ,reason"
+    // Strip anything after the first comma.
+    const raw = dateStr?.split(",")[0] ?? "";
+    if (raw.length < 12)
+        return "";
+    // OpenSSL uses 2-digit year; 70+ is 19xx, <70 is 20xx
+    const yy = parseInt(raw.substring(0, 2), 10);
+    const year = yy >= 70 ? 1900 + yy : 2000 + yy;
+    const month = raw.substring(2, 4);
+    const day = raw.substring(4, 6);
+    const hour = raw.substring(6, 8);
+    const min = raw.substring(8, 10);
+    const sec = raw.substring(10, 12);
+    return `${year}-${month}-${day}T${hour}:${min}:${sec}Z`;
+}
+/** The inverse of {@link parseOpenSSLDate}: format a `Date` as `YYMMDDHHmmssZ` (UTC). */
+function formatOpenSSLDate(date) {
+    const yy = String(date.getUTCFullYear() % 100).padStart(2, "0");
+    const mm = String(date.getUTCMonth() + 1).padStart(2, "0");
+    const dd = String(date.getUTCDate()).padStart(2, "0");
+    const hh = String(date.getUTCHours()).padStart(2, "0");
+    const mi = String(date.getUTCMinutes()).padStart(2, "0");
+    const ss = String(date.getUTCSeconds()).padStart(2, "0");
+    return `${yy}${mm}${dd}${hh}${mi}${ss}Z`;
+}
+/** Extract the reason suffix (after the first comma) from a revocation-date field, if any. */
+function parseRevocationReason(dateStr) {
+    const parts = dateStr?.split(",");
+    return parts && parts.length > 1 ? parts[1] : undefined;
+}
+/** Pad a hex string to an even number of digits, matching OpenSSL's `serial`/`crlnumber` file convention. */
+function evenLengthHex(value) {
+    const hex = value.toString(16).toUpperCase();
+    return hex.length % 2 === 0 ? hex : `0${hex}`;
+}
+/**
+ * Escape every control character (and backslash) as `\xHH`, the way
+ * OpenSSL's `X509_NAME_oneline` does before writing a subject to
+ * `index.txt`. `index.txt` is a tab/newline-delimited table: a subject
+ * (which comes verbatim from the requester's CSR, so is attacker
+ * controlled) containing a raw `\n` or `\t` would otherwise inject a
+ * forged row — e.g. an `R` entry naming a victim's serial, which the next
+ * CRL regeneration would then faithfully publish as revoked.
+ */
+function escapeIndexField(value) {
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: escaping control characters is the point
+    return value.replace(/[\x00-\x1f\x7f\\]/g, (c) => `\\x${c.charCodeAt(0).toString(16).toUpperCase().padStart(2, "0")}`);
+}
+/** A hex serial handed to a writer must be exactly that — never something that could carry a field or row separator. */
+function assertHexSerial(serial) {
+    if (!/^[0-9A-Fa-f]+$/.test(serial)) {
+        throw new Error(`Invalid certificate serial number: ${JSON.stringify(serial)}`);
+    }
+    return serial.toUpperCase();
+}
+/**
+ * Read and write access to a CA's OpenSSL-format certificate database
+ * (`index.txt`, `serial`, `crlnumber`, `certs/<SERIAL>.pem`).
+ *
+ * This is the format `openssl ca` itself writes and reads; every mutating
+ * method here (`nextSerial`, `nextCrlNumber`, `appendIssued`, `markRevoked`,
+ * `storeCertificate`) exists so a native (non-openssl) signing backend can
+ * write the exact same on-disk format `openssl ca` does, so an install can
+ * move between backends and external `openssl` tooling keeps working on the
+ * same directory. Callers are responsible for serializing access — every
+ * mutating call must happen under the owning CA's directory lock
+ * (`CertificateAuthority._withCaDirectoryLock`), the same guarantee
+ * `OpenSslCaBackend` gets from the lock around each `openssl ca` /
+ * `openssl x509 -CAserial` invocation.
+ */
+export class CaDatabase {
+    #rootDir;
+    constructor(rootDir) {
+        this.#rootDir = rootDir;
+    }
+    /** Path to the OpenSSL certificate database file (`index.txt`). */
+    get indexFile() {
+        return path.join(this.#rootDir, "index.txt");
+    }
+    /**
+     * Parse the OpenSSL `index.txt` certificate database.
+     *
+     * Each line has tab-separated fields:
+     * ```
+     * status  expiry  [revocationDate]  serial  unknown  subject
+     * ```
+     *
+     * - status: `V` (valid), `R` (revoked), `E` (expired)
+     * - expiry: `YYMMDDHHmmssZ`
+     * - revocationDate: present only for revoked certs
+     * - serial: hex string
+     * - unknown: always `"unknown"`
+     * - subject: X.500 slash-delimited string
+     */
+    readIndex() {
+        const indexPath = this.indexFile;
+        if (!fs.existsSync(indexPath)) {
+            return [];
+        }
+        const content = fs.readFileSync(indexPath, "utf-8");
+        const lines = content.split("\n").filter((l) => l.trim().length > 0);
+        const records = [];
+        for (const line of lines) {
+            const fields = line.split("\t");
+            if (fields.length < 4)
+                continue;
+            const statusChar = fields[0];
+            const expiryStr = fields[1];
+            let serial;
+            let subject;
+            let revocationDate;
+            if (statusChar === "R") {
+                // Revoked: status  expiry  revocationDate  serial  unknown  subject
+                revocationDate = fields[2];
+                serial = fields[3];
+                subject = fields.length >= 6 ? fields[5] : "";
+            }
+            else {
+                // Valid/Expired: status  expiry  (empty)  serial  unknown  subject
+                serial = fields[3];
+                subject = fields.length >= 6 ? fields[5] : "";
+            }
+            let status;
+            switch (statusChar) {
+                case "V":
+                    status = "valid";
+                    break;
+                case "R":
+                    status = "revoked";
+                    break;
+                case "E":
+                    status = "expired";
+                    break;
+                default:
+                    continue; // skip unknown status
+            }
+            records.push({
+                serial,
+                status,
+                subject,
+                expiryDate: parseOpenSSLDate(expiryStr),
+                revocationDate: revocationDate ? parseOpenSSLDate(revocationDate) : undefined,
+                reason: revocationDate ? parseRevocationReason(revocationDate) : undefined
+            });
+        }
+        return records;
+    }
+    /** Look up one record by serial number (case-insensitive). */
+    findBySerial(serial) {
+        const upper = serial.toUpperCase();
+        return this.readIndex().find((r) => r.serial.toUpperCase() === upper);
+    }
+    /**
+     * Read a specific issued certificate by serial number.
+     *
+     * OpenSSL stores signed certificates in the `certs/` directory using
+     * the naming convention `<SERIAL>.pem`.
+     *
+     * @param serial - hex-encoded serial number (e.g. `"1000"`)
+     * @returns the DER buffer, or `undefined` if not found
+     */
+    getCertificateBySerial(serial) {
+        const upper = serial.toUpperCase();
+        const certFile = path.join(this.#rootDir, "certs", `${upper}.pem`);
+        if (!fs.existsSync(certFile)) {
+            return undefined;
+        }
+        const pem = readCertificatePEM(certFile);
+        return convertPEMtoDER(pem);
+    }
+    /**
+     * Read-increment-write a hex counter file (`serial`/`crlnumber`),
+     * returning the value to hand out — matching `openssl ca`'s own
+     * behavior: the file holds the *next* value to assign, and is bumped
+     * to the following one immediately after being read. A `.old` backup
+     * of the pre-bump content is kept, as `openssl` itself does.
+     */
+    #nextHexCounter(fileName) {
+        const counterFile = path.join(this.#rootDir, fileName);
+        const current = BigInt(`0x${fs.readFileSync(counterFile, "utf-8").trim()}`);
+        fs.copyFileSync(counterFile, `${counterFile}.old`);
+        fs.writeFileSync(counterFile, evenLengthHex(current + 1n));
+        return evenLengthHex(current);
+    }
+    /** Hand out the next certificate serial number, bumping the `serial` file. */
+    nextSerial() {
+        return this.#nextHexCounter("serial");
+    }
+    /** Hand out the next CRL number, bumping the `crlnumber` file. */
+    nextCrlNumber() {
+        return this.#nextHexCounter("crlnumber");
+    }
+    /** Append a newly-issued certificate's `V` (valid) row to `index.txt`. */
+    appendIssued(record) {
+        const serial = assertHexSerial(record.serial);
+        const subject = escapeIndexField(record.subject);
+        const line = `V\t${formatOpenSSLDate(record.expiryDate)}\t\t${serial}\tunknown\t${subject}\n`;
+        fs.appendFileSync(this.indexFile, line);
+    }
+    /**
+     * Rewrite a certificate's `index.txt` row from `V` to `R` (revoked).
+     * Throws if the serial is not found, or is already revoked — the same
+     * "already revoked" case `openssl ca -revoke` itself rejects.
+     */
+    markRevoked(serial, revocationDate, reason) {
+        const upper = assertHexSerial(serial);
+        if (!/^[A-Za-z]+$/.test(reason)) {
+            throw new Error(`Invalid CRL reason: ${JSON.stringify(reason)}`);
+        }
+        const lines = fs
+            .readFileSync(this.indexFile, "utf-8")
+            .split("\n")
+            .filter((l) => l.trim().length > 0);
+        let found = false;
+        const rewritten = lines.map((line) => {
+            const fields = line.split("\t");
+            if (fields.length < 4 || fields[3]?.toUpperCase() !== upper) {
+                return line;
+            }
+            if (fields[0] === "R") {
+                throw new Error(`Certificate ${upper} is already revoked`);
+            }
+            found = true;
+            const subject = fields.length >= 6 ? fields[5] : "";
+            return `R\t${fields[1]}\t${formatOpenSSLDate(revocationDate)},${reason}\t${upper}\tunknown\t${subject}`;
+        });
+        if (!found) {
+            throw new Error(`Certificate ${upper} not found in the certificate database`);
+        }
+        fs.writeFileSync(this.indexFile, `${rewritten.join("\n")}\n`);
+    }
+    /** Store a signed certificate's PEM under `certs/<SERIAL>.pem`, as `openssl ca` does. */
+    storeCertificate(serial, pem) {
+        const certFile = path.join(this.#rootDir, "certs", `${assertHexSerial(serial)}.pem`);
+        fs.writeFileSync(certFile, pem);
+    }
+}
+//# sourceMappingURL=ca_database.js.map

package/dist/lib/ca/core/ca_database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ca_database.js","sourceRoot":"","sources":["../../../../lib/ca/core/ca_database.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,iBAAiB;AACjB,wHAAwH;AACxH,gFAAgF;AAChF,yCAAyC;AACzC,wHAAwH;AACxH,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,+GAA+G;AAC/G,sHAAsH;AACtH,kHAAkH;AAClH,mGAAmG;AACnG,EAAE;AACF,uHAAuH;AACvH,YAAY;AACZ,EAAE;AACF,uHAAuH;AACvH,wHAAwH;AACxH,mHAAmH;AACnH,mHAAmH;AACnH,wHAAwH;AAExH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AA2BxE;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACrC,oEAAoE;IACpE,wCAAwC;IACxC,MAAM,GAAG,GAAG,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,EAAE,CAAC;IAC/B,sDAAsD;IACtD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAClC,OAAO,GAAG,IAAI,IAAI,KAAK,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,GAAG,GAAG,CAAC;AAC5D,CAAC;AAED,yFAAyF;AACzF,SAAS,iBAAiB,CAAC,IAAU;IACjC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;AAC7C,CAAC;AAED,8FAA8F;AAC9F,SAAS,qBAAqB,CAAC,OAAe;IAC1C,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED,6GAA6G;AAC7G,SAAS,aAAa,CAAC,KAAa;IAChC,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7C,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACnC,oGAAoG;IACpG,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AAC3H,CAAC;AAED,wHAAwH;AACxH,SAAS,eAAe,CAAC,MAAc;IACnC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,UAAU;IACV,QAAQ,CAAS;IAE1B,YAAY,OAAe;QACvB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC5B,CAAC;IAED,mEAAmE;IACnE,IAAW,SAAS;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,SAAS;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrE,MAAM,OAAO,GAA8B,EAAE,CAAC;QAE9C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAEhC,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YAE5B,IAAI,MAAc,CAAC;YACnB,IAAI,OAAe,CAAC;YACpB,IAAI,cAAkC,CAAC;YAEvC,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;gBACrB,oEAAoE;gBACpE,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC3B,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACnB,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACJ,mEAAmE;gBACnE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACnB,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,CAAC;YAED,IAAI,MAAuC,CAAC;YAC5C,QAAQ,UAAU,EAAE,CAAC;gBACjB,KAAK,GAAG;oBACJ,MAAM,GAAG,OAAO,CAAC;oBACjB,MAAM;gBACV,KAAK,GAAG;oBACJ,MAAM,GAAG,SAAS,CAAC;oBACnB,MAAM;gBACV,KAAK,GAAG;oBACJ,MAAM,GAAG,SAAS,CAAC;oBACnB,MAAM;gBACV;oBACI,SAAS,CAAC,sBAAsB;YACxC,CAAC;YAED,OAAO,CAAC,IAAI,CAAC;gBACT,MAAM;gBACN,MAAM;gBACN,OAAO;gBACP,UAAU,EAAE,gBAAgB,CAAC,SAAS,CAAC;gBACvC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC7E,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;aAC7E,CAAC,CAAC;QACP,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,8DAA8D;IACvD,YAAY,CAAC,MAAc;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACI,sBAAsB,CAAC,MAAc;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,MAAM,CAAC,CAAC;QACnE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACzC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,QAAgB;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5E,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,WAAW,MAAM,CAAC,CAAC;QACnD,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC;QAC3D,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,8EAA8E;IACvE,UAAU;QACb,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED,kEAAkE;IAC3D,aAAa;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED,0EAA0E;IACnE,YAAY,CAAC,MAA6D;QAC7E,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,MAAM,cAAc,OAAO,IAAI,CAAC;QAC9F,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED;;;;OAIG;IACI,WAAW,CAAC,MAAc,EAAE,cAAoB,EAAE,MAAc;QACnE,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,KAAK,GAAG,EAAE;aACX,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;aACrC,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAExC,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC1D,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,eAAe,KAAK,qBAAqB,CAAC,CAAC;YAC/D,CAAC;YACD,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,iBAAiB,CAAC,cAAc,CAAC,IAAI,MAAM,KAAK,KAAK,cAAc,OAAO,EAAE,CAAC;QAC5G,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,eAAe,KAAK,wCAAwC,CAAC,CAAC;QAClF,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IAED,yFAAyF;IAClF,gBAAgB,CAAC,MAAc,EAAE,GAAW;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrF,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;CACJ"}