node-opcua-pki 6.22.1 → 7.0.0

package/dist/lib/toolbox/common.d.ts

@@ -0,0 +1,150 @@
+/** RSA key size in bits. */
+export type KeySize = 1024 | 2048 | 3072 | 4096;
+/** Hex-encoded SHA-1 certificate thumbprint. */
+export type Thumbprint = string;
+/** A filesystem path to a file. */
+export type Filename = string;
+/** Status of a certificate in the trust store. */
+export type CertificateStatus = "unknown" | "trusted" | "rejected";
+import type { CaSigner, CertificatePurpose, PrivateKey } from "node-opcua-crypto";
+import type { SubjectOptions } from "../misc/subject.js";
+/**
+ * @deprecated Use {@link KeySize} instead.
+ */
+export type KeyLength = 1024 | 2048 | 3072 | 4096;
+export declare function quote(str?: string): string;
+/**
+ * Subject Alternative Name (SAN) parameters for certificate
+ * generation.
+ */
+export interface ProcessAltNamesParam {
+    /** DNS host names to include in the SAN extension. */
+    dns?: string[];
+    /** IP addresses to include in the SAN extension. */
+    ip?: string[];
+    /** OPC UA application URI for the SAN extension. */
+    applicationUri?: string;
+}
+/**
+ * Options for creating a Certificate Signing Request (CSR).
+ */
+export interface CreateCertificateSigningRequestOptions extends ProcessAltNamesParam {
+    /** X.500 subject for the certificate. */
+    subject?: SubjectOptions | string;
+}
+/**
+ * Extended CSR options that include filesystem paths and
+ * certificate purpose — used internally by the OpenSSL toolbox.
+ */
+export interface CreateCertificateSigningRequestWithConfigOptions extends CreateCertificateSigningRequestOptions {
+    /** Root directory of the PKI store. */
+    rootDir: Filename;
+    /** Path to the OpenSSL configuration file. */
+    configFile: Filename;
+    /**
+     * The private key: a filesystem path to a PEM file (unencrypted;
+     * the historical behavior), an already-resolved in-memory
+     * {@link PrivateKey}, or an opaque {@link CaSigner} (HSM/KMS-held key;
+     * only the openssl-free toolbox supports it — openssl needs a key file)
+     * — see {@link CreateSelfSignCertificateWithConfigParam.privateKey}.
+     */
+    privateKey: Filename | PrivateKey | CaSigner;
+    /** Intended purpose of the certificate. */
+    purpose: CertificatePurpose;
+}
+/**
+ * Narrows the `privateKey` union of the toolbox options: a {@link CaSigner}
+ * is the only member that carries a `sign` method — a path is a string and
+ * a {@link PrivateKey} envelope has only `hidden`.
+ */
+export declare function isOpaqueSigner(privateKey: Filename | PrivateKey | CaSigner): privateKey is CaSigner;
+/**
+ * Validity period parameters for certificate generation.
+ */
+export interface StartDateEndDateParam {
+    /** Certificate "Not Before" date. Defaults to now. */
+    startDate?: Date;
+    /** Certificate "Not After" date (computed from validity). */
+    endDate?: Date;
+    /** Number of days the certificate is valid. @defaultValue 365 */
+    validity?: number;
+    /**
+     * Certificate validity in milliseconds.
+     *
+     * When provided, takes precedence over {@link validity} and enables
+     * sub-day validity (X.509 supports second precision per RFC 5280
+     * §4.1.2.5; OpenSSL is invoked with `-startdate`/`-enddate` already).
+     *
+     * Typical use is short-lived certificates for demos or for renewal
+     * cycle testing. Existing day-based callers are unaffected.
+     */
+    validityMs?: number;
+}
+/**
+ * Parameters for creating a self-signed certificate.
+ */
+export interface CreateSelfSignCertificateParam extends ProcessAltNamesParam, StartDateEndDateParam {
+    /** X.500 subject for the certificate. */
+    subject?: SubjectOptions | string;
+}
+/**
+ * Extended self-signed certificate options that include
+ * filesystem paths and purpose — used internally.
+ */
+export interface CreateSelfSignCertificateWithConfigParam extends CreateSelfSignCertificateParam {
+    /** Root directory of the PKI store. */
+    rootDir: Filename;
+    /** Path to the OpenSSL configuration file. */
+    configFile: Filename;
+    /**
+     * The private key: a filesystem path to a PEM file (unencrypted;
+     * the historical behavior), an already-resolved in-memory
+     * {@link PrivateKey} — used when the key is passphrase-protected on
+     * disk, so the decrypted key material is never written back out in
+     * cleartext — or an opaque {@link CaSigner} (HSM/KMS-held key; only
+     * the openssl-free toolbox supports it — openssl needs a key file).
+     */
+    privateKey: Filename | PrivateKey | CaSigner;
+    /** Intended purpose of the certificate. */
+    purpose: CertificatePurpose;
+}
+/**
+ * A passphrase, or a function resolving one — called lazily, and at most
+ * once per `CertificateManager` / `CertificateAuthority` instance (the
+ * result is cached in memory). Never logged.
+ */
+export type PrivateKeyPassphrase = string | (() => Promise<string>);
+/**
+ * Sources a {@link PrivateKey} from somewhere other than the local
+ * filesystem (an HSM, a KMS, ...). When configured on `CertificateManager`,
+ * it overrides disk entirely — the on-disk `own/private/private_key.pem` is
+ * neither generated nor read. `CertificateAuthority` does not support a
+ * provider (its signing paths are openssl reading a key file); it does
+ * support `privateKeyPassphrase`.
+ */
+export interface PrivateKeyProvider {
+    getPrivateKey(): Promise<PrivateKey>;
+}
+/** Resolve a {@link PrivateKeyPassphrase}, if configured. */
+export declare function resolvePrivateKeyPassphrase(passphrase: PrivateKeyPassphrase | undefined): Promise<string | undefined>;
+/**
+ * General-purpose parameters passed to CA operations such as
+ * {@link CertificateAuthority.signCertificateRequest} and
+ * {@link CertificateAuthority.revokeCertificate}.
+ */
+export interface Params extends ProcessAltNamesParam, StartDateEndDateParam {
+    /** X.500 subject for the certificate. */
+    subject?: SubjectOptions | string;
+    /** Path to the private key file. */
+    privateKey?: string;
+    /** Path to the OpenSSL configuration file. */
+    configFile?: string;
+    /** Root directory of the PKI store. */
+    rootDir?: string;
+    /** Output filename for the generated certificate. */
+    outputFile?: string;
+    /** CRL revocation reason (e.g. `"keyCompromise"`). */
+    reason?: string;
+}
+export declare function adjustDate(params: StartDateEndDateParam): void;
+export declare function adjustApplicationUri(params: Params): void;

package/dist/lib/toolbox/common.js

@@ -0,0 +1,82 @@
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2026 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022-2026 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+import assert from "node:assert";
+export function quote(str) {
+    return `"${str || ""}"`;
+}
+/**
+ * Narrows the `privateKey` union of the toolbox options: a {@link CaSigner}
+ * is the only member that carries a `sign` method — a path is a string and
+ * a {@link PrivateKey} envelope has only `hidden`.
+ */
+export function isOpaqueSigner(privateKey) {
+    return typeof privateKey !== "string" && typeof privateKey.sign === "function";
+}
+/** Resolve a {@link PrivateKeyPassphrase}, if configured. */
+export async function resolvePrivateKeyPassphrase(passphrase) {
+    if (passphrase === undefined) {
+        return undefined;
+    }
+    return typeof passphrase === "function" ? await passphrase() : passphrase;
+}
+export function adjustDate(params) {
+    assert(params instanceof Object);
+    params.startDate = params.startDate || new Date();
+    assert(params.startDate instanceof Date);
+    // Precedence: validityMs > validity (days) > default 365 days.
+    // When validityMs is set, compute endDate via millisecond arithmetic
+    // (sub-day capable). Otherwise preserve the legacy calendar-day
+    // arithmetic via setDate() so day-based callers remain
+    // bit-for-bit identical (including DST boundary handling).
+    if (params.validityMs !== undefined) {
+        if (params.validityMs <= 0) {
+            throw new RangeError(`validityMs must be > 0 (got ${params.validityMs})`);
+        }
+        params.endDate = new Date(params.startDate.getTime() + params.validityMs);
+        // Keep params.validity in sync as the ceil-rounded day count, so
+        // downstream code paths that read params.validity (e.g. logging,
+        // OpenSSL command echo) still see a sensible value.
+        params.validity = Math.ceil(params.validityMs / 86_400_000);
+    }
+    else {
+        params.validity = params.validity || 365; // one year
+        params.endDate = new Date(params.startDate.getTime());
+        params.endDate.setDate(params.startDate.getDate() + params.validity);
+    }
+    // params.endDate = x509Date(endDate);
+    // params.startDate = x509Date(startDate);
+    assert(params.endDate instanceof Date);
+    assert(params.startDate instanceof Date);
+    // // istanbul ignore next
+    // if (!g_config.silent) {
+    //     warningLog(" start Date ", params.startDate.toUTCString(), x509Date(params.startDate));
+    //     warningLog(" end   Date ", params.endDate.toUTCString(), x509Date(params.endDate));
+    // }
+}
+export function adjustApplicationUri(params) {
+    const applicationUri = params.applicationUri || "";
+    if (applicationUri.length > 200) {
+        throw new Error(`Openssl doesn't support urn with length greater than 200${applicationUri}`);
+    }
+}
+//# sourceMappingURL=common.js.map

package/dist/lib/toolbox/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../lib/toolbox/common.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,iBAAiB;AACjB,wHAAwH;AACxH,gFAAgF;AAChF,yCAAyC;AACzC,wHAAwH;AACxH,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,+GAA+G;AAC/G,sHAAsH;AACtH,kHAAkH;AAClH,mGAAmG;AACnG,EAAE;AACF,uHAAuH;AACvH,YAAY;AACZ,EAAE;AACF,uHAAuH;AACvH,wHAAwH;AACxH,mHAAmH;AACnH,mHAAmH;AACnH,wHAAwH;AACxH,OAAO,MAAM,MAAM,aAAa,CAAC;AAmBjC,MAAM,UAAU,KAAK,CAAC,GAAY;IAC9B,OAAO,IAAI,GAAG,IAAI,EAAE,GAAG,CAAC;AAC5B,CAAC;AA4CD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,UAA4C;IACvE,OAAO,OAAO,UAAU,KAAK,QAAQ,IAAI,OAAQ,UAAuB,CAAC,IAAI,KAAK,UAAU,CAAC;AACjG,CAAC;AA0ED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,UAA4C;IAC1F,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AAC9E,CAAC;AAwBD,MAAM,UAAU,UAAU,CAAC,MAA6B;IACpD,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC;IAClD,MAAM,CAAC,MAAM,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC;IAEzC,+DAA+D;IAC/D,qEAAqE;IACrE,gEAAgE;IAChE,uDAAuD;IACvD,2DAA2D;IAC3D,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,UAAU,CAAC,+BAA+B,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,OAAO,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1E,iEAAiE;QACjE,iEAAiE;QACjE,oDAAoD;QACpD,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACJ,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,WAAW;QACrD,MAAM,CAAC,OAAO,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IAED,sCAAsC;IACtC,0CAA0C;IAE1C,MAAM,CAAC,MAAM,CAAC,OAAO,YAAY,IAAI,CAAC,CAAC;IACvC,MAAM,CAAC,MAAM,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC;IAEzC,0BAA0B;IAC1B,0BAA0B;IAC1B,8FAA8F;IAC9F,0FAA0F;IAC1F,IAAI;AACR,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAc;IAC/C,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;IACnD,IAAI,cAAc,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,2DAA2D,cAAc,EAAE,CAAC,CAAC;IACjG,CAAC;AACL,CAAC"}

package/dist/lib/toolbox/common2.d.ts

@@ -0,0 +1,25 @@
+export declare function certificateFileExist(certificateFile: string): boolean;
+export declare function mkdirRecursiveSync(folder: string): void;
+/**
+ * Restrict a file or directory to owner-only access (mode 0600/0700).
+ *
+ * fs.chmod only toggles the read-only attribute on Windows and cannot express
+ * POSIX-style owner-only permissions, so this is a no-op there rather than a
+ * false sense of protection. Errors are logged, not thrown: a read-only mount
+ * or an unexpected ownership mismatch should not prevent the server from
+ * starting.
+ */
+export declare function restrictPrivateFilePermissions(target: string, mode: 0o600 | 0o700): void;
+/**
+ * Create (or repair) a directory intended to hold private key material,
+ * restricted to owner-only access. Safe to call on an existing directory
+ * to repair permissions left by an earlier, less restrictive version.
+ */
+export declare function ensurePrivateDirectory(dir: string): void;
+/**
+ * `true` if the PEM file at `filename` holds a passphrase-encrypted PKCS#8
+ * key (`-----BEGIN ENCRYPTED PRIVATE KEY-----`). Header check only; it does
+ * not validate or decrypt the key. Throws if the file cannot be read.
+ */
+export declare function isEncryptedPrivateKeyFile(filename: string): boolean;
+export declare function makePath(folderName: string, filename?: string): string;

package/dist/lib/toolbox/common2.js

@@ -0,0 +1,97 @@
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2026 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022-2026 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+import assert from "node:assert";
+import fs from "node:fs";
+import path from "node:path";
+import chalk from "chalk";
+import { g_config } from "./config.js";
+import { debugLog, warningLog } from "./debug.js";
+export function certificateFileExist(certificateFile) {
+    // istanbul ignore next
+    if (fs.existsSync(certificateFile) && !g_config.force) {
+        warningLog(chalk.yellow("        certificate ") + chalk.cyan(certificateFile) + chalk.yellow(" already exists => do not overwrite"));
+        return false;
+    }
+    return true;
+}
+export function mkdirRecursiveSync(folder) {
+    if (!fs.existsSync(folder)) {
+        // istanbul ignore next
+        debugLog(chalk.white(" .. constructing "), folder);
+        fs.mkdirSync(folder, { recursive: true });
+    }
+}
+/**
+ * Restrict a file or directory to owner-only access (mode 0600/0700).
+ *
+ * fs.chmod only toggles the read-only attribute on Windows and cannot express
+ * POSIX-style owner-only permissions, so this is a no-op there rather than a
+ * false sense of protection. Errors are logged, not thrown: a read-only mount
+ * or an unexpected ownership mismatch should not prevent the server from
+ * starting.
+ */
+export function restrictPrivateFilePermissions(target, mode) {
+    // istanbul ignore if
+    if (process.platform === "win32") {
+        return;
+    }
+    try {
+        fs.chmodSync(target, mode);
+    }
+    catch (err) {
+        // istanbul ignore next
+        warningLog(chalk.yellow("        could not restrict permissions on "), target, err.message);
+    }
+}
+/**
+ * Create (or repair) a directory intended to hold private key material,
+ * restricted to owner-only access. Safe to call on an existing directory
+ * to repair permissions left by an earlier, less restrictive version.
+ */
+export function ensurePrivateDirectory(dir) {
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+    restrictPrivateFilePermissions(dir, 0o700);
+}
+/**
+ * `true` if the PEM file at `filename` holds a passphrase-encrypted PKCS#8
+ * key (`-----BEGIN ENCRYPTED PRIVATE KEY-----`). Header check only; it does
+ * not validate or decrypt the key. Throws if the file cannot be read.
+ */
+export function isEncryptedPrivateKeyFile(filename) {
+    return fs.readFileSync(filename, "utf-8").includes("-----BEGIN ENCRYPTED PRIVATE KEY-----");
+}
+export function makePath(folderName, filename) {
+    let s;
+    if (filename) {
+        s = path.join(path.normalize(folderName), filename);
+    }
+    else {
+        assert(folderName);
+        s = folderName;
+    }
+    s = s.replace(/\\/g, "/");
+    return s;
+}
+//# sourceMappingURL=common2.js.map

package/dist/lib/toolbox/common2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common2.js","sourceRoot":"","sources":["../../../lib/toolbox/common2.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,iBAAiB;AACjB,wHAAwH;AACxH,gFAAgF;AAChF,yCAAyC;AACzC,wHAAwH;AACxH,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,+GAA+G;AAC/G,sHAAsH;AACtH,kHAAkH;AAClH,mGAAmG;AACnG,EAAE;AACF,uHAAuH;AACvH,YAAY;AACZ,EAAE;AACF,uHAAuH;AACvH,wHAAwH;AACxH,mHAAmH;AACnH,mHAAmH;AACnH,wHAAwH;AAExH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,UAAU,oBAAoB,CAAC,eAAuB;IACxD,uBAAuB;IACvB,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpD,UAAU,CACN,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAC3H,CAAC;QACF,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,uBAAuB;QACvB,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC;QACnD,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAc,EAAE,IAAmB;IAC9E,qBAAqB;IACrB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO;IACX,CAAC;IACD,IAAI,CAAC;QACD,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,uBAAuB;QACvB,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,4CAA4C,CAAC,EAAE,MAAM,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAC3G,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,8BAA8B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACtD,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,UAAkB,EAAE,QAAiB;IAC1D,IAAI,CAAS,CAAC;IACd,IAAI,QAAQ,EAAE,CAAC;QACX,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACJ,MAAM,CAAC,UAAU,CAAC,CAAC;QACnB,CAAC,GAAG,UAAU,CAAC;IACnB,CAAC;IACD,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC;AACb,CAAC"}

package/dist/lib/toolbox/config.d.ts

@@ -0,0 +1,5 @@
+export declare const g_config: {
+    opensslVersion: string;
+    silent: boolean;
+    force: boolean;
+};

package/dist/lib/toolbox/config.js

@@ -0,0 +1,28 @@
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2026 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022-2026 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+export const g_config = {
+    opensslVersion: "unset",
+    silent: process.env.VERBOSE ? !process.env.VERBOSE : true,
+    force: false
+};
+//# sourceMappingURL=config.js.map

package/dist/lib/toolbox/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../lib/toolbox/config.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,iBAAiB;AACjB,wHAAwH;AACxH,gFAAgF;AAChF,yCAAyC;AACzC,wHAAwH;AACxH,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,+GAA+G;AAC/G,sHAAsH;AACtH,kHAAkH;AAClH,mGAAmG;AACnG,EAAE;AACF,uHAAuH;AACvH,YAAY;AACZ,EAAE;AACF,uHAAuH;AACvH,wHAAwH;AACxH,mHAAmH;AACnH,mHAAmH;AACnH,wHAAwH;AACxH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACpB,cAAc,EAAE,OAAO;IACvB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;IACzD,KAAK,EAAE,KAAK;CACf,CAAC"}

package/dist/lib/toolbox/debug.d.ts

@@ -0,0 +1,5 @@
+export declare const doDebug: string | boolean;
+export declare const displayError = true;
+export declare const displayDebug: boolean;
+export declare function debugLog(...args: unknown[]): void;
+export declare function warningLog(...args: unknown[]): void;

package/dist/lib/toolbox/debug.js

@@ -0,0 +1,35 @@
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2026 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022-2026 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+export const doDebug = process.env.NODEOPCUAPKIDEBUG || false;
+export const displayError = true;
+export const displayDebug = !!process.env.NODEOPCUAPKIDEBUG || false;
+export function debugLog(...args) {
+    // istanbul ignore next
+    if (displayDebug) {
+        console.log.apply(null, args);
+    }
+}
+export function warningLog(...args) {
+    console.log.apply(null, args);
+}
+//# sourceMappingURL=debug.js.map

package/dist/lib/toolbox/debug.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug.js","sourceRoot":"","sources":["../../../lib/toolbox/debug.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,iBAAiB;AACjB,wHAAwH;AACxH,gFAAgF;AAChF,yCAAyC;AACzC,wHAAwH;AACxH,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,+GAA+G;AAC/G,sHAAsH;AACtH,kHAAkH;AAClH,mGAAmG;AACnG,EAAE;AACF,uHAAuH;AACvH,YAAY;AACZ,EAAE;AACF,uHAAuH;AACvH,wHAAwH;AACxH,mHAAmH;AACnH,mHAAmH;AACnH,wHAAwH;AACxH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,KAAK,CAAC;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,KAAK,CAAC;AACrE,MAAM,UAAU,QAAQ,CAAC,GAAG,IAAe;IACvC,uBAAuB;IACvB,IAAI,YAAY,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;AACL,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,GAAG,IAAe;IACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC"}

package/dist/lib/toolbox/display.d.ts

@@ -0,0 +1,4 @@
+export declare function displayChapter(str: string): void;
+export declare function displayTitle(str: string): void;
+export declare function displaySubtitle(str: string): void;
+export declare function display(str: string): void;

package/dist/lib/toolbox/display.js

@@ -0,0 +1,56 @@
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2026 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022-2026 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+import chalk from "chalk";
+import { g_config } from "./config.js";
+import { warningLog } from "./debug.js";
+// istanbul ignore next
+export function displayChapter(str) {
+    const l = "                                                                                               ";
+    warningLog(`${chalk.bgWhite(l)} `);
+    str = `        ${str}${l}`.substring(0, l.length);
+    warningLog(chalk.bgWhite.cyan(str));
+    warningLog(`${chalk.bgWhite(l)} `);
+}
+export function displayTitle(str) {
+    // istanbul ignore next
+    if (!g_config.silent) {
+        warningLog("");
+        warningLog(chalk.yellowBright(str));
+        warningLog(chalk.yellow(new Array(str.length + 1).join("=")), "\n");
+    }
+}
+export function displaySubtitle(str) {
+    // istanbul ignore next
+    if (!g_config.silent) {
+        warningLog("");
+        warningLog(`    ${chalk.yellowBright(str)}`);
+        warningLog(`    ${chalk.white(new Array(str.length + 1).join("-"))}`, "\n");
+    }
+}
+export function display(str) {
+    // istanbul ignore next
+    if (!g_config.silent) {
+        warningLog(`       ${str}`);
+    }
+}
+//# sourceMappingURL=display.js.map

package/dist/lib/toolbox/display.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"display.js","sourceRoot":"","sources":["../../../lib/toolbox/display.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,iBAAiB;AACjB,wHAAwH;AACxH,gFAAgF;AAChF,yCAAyC;AACzC,wHAAwH;AACxH,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,+GAA+G;AAC/G,sHAAsH;AACtH,kHAAkH;AAClH,mGAAmG;AACnG,EAAE;AACF,uHAAuH;AACvH,YAAY;AACZ,EAAE;AACF,uHAAuH;AACvH,wHAAwH;AACxH,mHAAmH;AACnH,mHAAmH;AACnH,wHAAwH;AACxH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,uBAAuB;AACvB,MAAM,UAAU,cAAc,CAAC,GAAW;IACtC,MAAM,CAAC,GAAG,iGAAiG,CAAC;IAC5G,UAAU,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnC,GAAG,GAAG,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAClD,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,UAAU,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACpC,uBAAuB;IACvB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,EAAE,CAAC,CAAC;QACf,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACvC,uBAAuB;IACvB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,EAAE,CAAC,CAAC;QACf,UAAU,CAAC,OAAO,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7C,UAAU,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAChF,CAAC;AACL,CAAC;AACD,MAAM,UAAU,OAAO,CAAC,GAAW;IAC/B,uBAAuB;IACvB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;IAChC,CAAC;AACL,CAAC"}

package/dist/lib/toolbox/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./common.js";
+export * from "./common2.js";
+export * from "./config.js";
+export * from "./debug.js";
+export * from "./display.js";

package/dist/lib/toolbox/index.js

@@ -0,0 +1,28 @@
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2026 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022-2026 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+export * from "./common.js";
+export * from "./common2.js";
+export * from "./config.js";
+export * from "./debug.js";
+export * from "./display.js";
+//# sourceMappingURL=index.js.map

package/dist/lib/toolbox/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../lib/toolbox/index.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,iBAAiB;AACjB,wHAAwH;AACxH,gFAAgF;AAChF,yCAAyC;AACzC,wHAAwH;AACxH,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,+GAA+G;AAC/G,sHAAsH;AACtH,kHAAkH;AAClH,mGAAmG;AACnG,EAAE;AACF,uHAAuH;AACvH,YAAY;AACZ,EAAE;AACF,uHAAuH;AACvH,wHAAwH;AACxH,mHAAmH;AACnH,mHAAmH;AACnH,wHAAwH;AACxH,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC"}

package/dist/lib/toolbox/with_openssl/_create_random_file.d.ts

@@ -0,0 +1,4 @@
+import { type ExecuteOptions } from "./execute_openssl.js";
+export declare function createRandomFile(randomFile: string, options: ExecuteOptions): Promise<void>;
+export declare function createRandomFileIfNotExist(randomFile: string, options: ExecuteOptions): Promise<void>;
+export declare function useRandFile(): boolean;

package/dist/lib/toolbox/with_openssl/_create_random_file.js

@@ -0,0 +1,50 @@
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2026 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022-2026 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+import fs from "node:fs";
+import path from "node:path";
+import { g_config } from "../config.js";
+import { execute_openssl } from "./execute_openssl.js";
+export async function createRandomFile(randomFile, options) {
+    // istanbul ignore next
+    if (!useRandFile()) {
+        return;
+    }
+    await execute_openssl(["rand", "-out", randomFile, "-hex", "256"], options);
+}
+export async function createRandomFileIfNotExist(randomFile, options) {
+    const randomFilePath = options.cwd ? path.join(options.cwd, randomFile) : randomFile;
+    if (fs.existsSync(randomFilePath)) {
+        return;
+    }
+    else {
+        await createRandomFile(randomFile, options);
+    }
+}
+export function useRandFile() {
+    // istanbul ignore next
+    if (g_config.opensslVersion && g_config.opensslVersion.toLowerCase().indexOf("libressl") > -1) {
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=_create_random_file.js.map

package/dist/lib/toolbox/with_openssl/_create_random_file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_create_random_file.js","sourceRoot":"","sources":["../../../../lib/toolbox/with_openssl/_create_random_file.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,iBAAiB;AACjB,wHAAwH;AACxH,gFAAgF;AAChF,yCAAyC;AACzC,wHAAwH;AACxH,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,+GAA+G;AAC/G,sHAAsH;AACtH,kHAAkH;AAClH,mGAAmG;AACnG,EAAE;AACF,uHAAuH;AACvH,YAAY;AACZ,EAAE;AACF,uHAAuH;AACvH,wHAAwH;AACxH,mHAAmH;AACnH,mHAAmH;AACnH,wHAAwH;AAExH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAuB,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB,EAAE,OAAuB;IAC9E,uBAAuB;IACvB,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACjB,OAAO;IACX,CAAC;IACD,MAAM,eAAe,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,UAAkB,EAAE,OAAuB;IACxF,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACrF,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,OAAO;IACX,CAAC;SAAM,CAAC;QACJ,MAAM,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW;IACvB,uBAAuB;IACvB,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5F,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}