node-opcua-pki 6.22.1 → 7.0.1

package/bin/install_prerequisite.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { install_prerequisite } from "node-opcua-pki";
+import { install_prerequisite } from "../lib/toolbox/with_openssl/install_prerequisite.js";
 
 install_prerequisite().catch((err: Error) => {
     console.log("err = ", err.message);

package/bin/pki.ts

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
-import { main as pki_main } from "../lib/ca/crypto_create_CA";
+import { main as pki_main } from "../lib/ca/crypto_create_CA.js";
 
 pki_main(process.argv.splice(2));

package/bin/pki_config.example.js

@@ -1,4 +1,3 @@
-"use strict";
 // ---------------------------------------------------------------------------------------------------------------------
 module.exports = {
     subject: {

package/dist/bin/install_prerequisite.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/install_prerequisite.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import { install_prerequisite } from "../lib/toolbox/with_openssl/install_prerequisite.js";
+install_prerequisite().catch((err) => {
+    console.log("err = ", err.message);
+});
+//# sourceMappingURL=install_prerequisite.js.map

package/dist/bin/install_prerequisite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install_prerequisite.js","sourceRoot":"","sources":["../../bin/install_prerequisite.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAE3F,oBAAoB,EAAE,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;IACxC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC"}

package/dist/bin/pki.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/pki.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { main as pki_main } from "../lib/ca/crypto_create_CA.js";
+pki_main(process.argv.splice(2));
+//# sourceMappingURL=pki.js.map

package/dist/bin/pki.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pki.js","sourceRoot":"","sources":["../../bin/pki.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAEjE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/lib/ca/backends/native_ca_backend.d.ts

@@ -0,0 +1,49 @@
+import { type Params, type ProcessAltNamesParam } from "../../toolbox/index.js";
+import type { CaBackend } from "../core/ca_backend.js";
+import type { CertificateAuthorityCore } from "../core/certificate_authority_core.js";
+/**
+ * A native (pure-JS, no `openssl` child process) {@link CaBackend}: it
+ * bootstraps a CA, signs end-entity and subordinate-CA requests, revokes,
+ * and builds CRLs entirely through `node-opcua-crypto`'s signing
+ * primitives and {@link CaDatabase}'s write path, so the resulting
+ * `index.txt`/`serial`/`crlnumber`/`certs/` are the same on-disk format
+ * `openssl ca` produces and an install can move between backends.
+ *
+ * The signing key reaches every operation through
+ * `CertificateAuthority._getSigningKey()`, which yields either the on-disk
+ * key or an external `CaSigner`. Nothing below can tell the difference,
+ * which is the point: a CA whose key lives in an HSM never has a
+ * `private/cakey.pem` and never needs one.
+ *
+ * Two deliberate differences from the openssl backend, both improvements:
+ * a subordinate CA's certificate is recorded in the issuer's `index.txt`
+ * (`openssl x509 -CAserial` bumps the serial file but records nothing),
+ * and a subordinate's SAN is taken from its own CSR rather than being
+ * stamped with the issuer's.
+ */
+export declare class NativeCaBackend implements CaBackend {
+    #private;
+    /** Nothing to check: this backend spawns no process and needs no tool on PATH. */
+    /** Signing goes through `ca._getSigningKey()`, which may be an external signer. */
+    readonly supportsExternalSigner = true;
+    preflight(): Promise<void>;
+    /**
+     * Write a CSR for the CA's own key, the `[v3_ca_req]` equivalent. The
+     * key comes from the CA rather than from `privateKeyFile`: on a
+     * signer-backed CA that file does not exist.
+     */
+    generateCaCsr(ca: CertificateAuthorityCore, _caRootDir: string, _privateKeyFile: string, csrFile: string): Promise<void>;
+    bootstrap(ca: CertificateAuthorityCore): Promise<void>;
+    /** Sign a subordinate CA's request with this CA's key, the `[v3_ca]` equivalent. */
+    signSubordinateCsr(ca: CertificateAuthorityCore, csrFile: string, certFile: string, validityDays: number): Promise<void>;
+    /**
+     * Self-sign a certificate with a caller-supplied key file and record it
+     * in this CA's database: the native equivalent of `openssl req -new`
+     * followed by `openssl ca -selfsign`, which likewise applies the
+     * end-entity profile and updates `index.txt`.
+     */
+    createSelfSignedCertificate(ca: CertificateAuthorityCore, certificateFile: string, privateKeyFile: string, params: Params): Promise<void>;
+    signEndEntityCsr(ca: CertificateAuthorityCore, certificate: string, csr: string, params: Params, sanOverride: Required<ProcessAltNamesParam>): Promise<void>;
+    regenerateCrl(ca: CertificateAuthorityCore): Promise<void>;
+    revoke(ca: CertificateAuthorityCore, certificate: string, reason: string): Promise<void>;
+}

package/dist/lib/ca/backends/native_ca_backend.js

@@ -0,0 +1,365 @@
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2026 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022-2026 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+import fs from "node:fs";
+import path from "node:path";
+import { CertificatePurpose, createCertificateFromCsr, createCertificateSigningRequest, createCrl, isCaSigner, privateKeyToCryptoKey, readPrivateKey, Subject, x509 } from "node-opcua-crypto";
+import { displaySubtitle, displayTitle } from "../../toolbox/index.js";
+import { CaDatabase } from "../core/ca_database.js";
+/** The CA-certificate lifetime the openssl backend hard-codes (`x509 -req -days 3650`). */
+const CA_CERT_VALIDITY_DAYS = 3650;
+const RSA_SHA256 = { name: "RSASSA-PKCS1-v1_5", hash: { name: "SHA-256" } };
+/** A signer declares its own algorithm; a raw key is always the RSA/SHA-256 this CA generates. */
+function signingAlgorithmOf(key) {
+    return isCaSigner(key) ? key.algorithm : RSA_SHA256;
+}
+function daysFromNow(notBefore, days) {
+    return new Date(notBefore.getTime() + days * 24 * 60 * 60 * 1000);
+}
+/**
+ * The SAN every CA certificate carries. RFC 5280 does not require one on a
+ * CA certificate, but the OPC UA profile does, and validators (UaExpert,
+ * the compliance tools) reject a CA without it - so mirror what the
+ * openssl backend puts in `[v3_ca]`: `URI:urn:<commonName>`.
+ */
+function caSanUri(ca) {
+    return `urn:${ca.subject.commonName || "NodeOPCUA-CA"}`;
+}
+/**
+ * The subject alternative names a CSR asked for, in the shape the signing
+ * primitive wants. `openssl ca` does not copy SANs across from the CSR
+ * (openssl/openssl#10458), which is why the caller has to re-derive them;
+ * peculiar decodes IP addresses to dotted form for us.
+ */
+function sanFromCsr(csrPem) {
+    const request = new x509.Pkcs10CertificateRequest(csrPem);
+    const extension = request.getExtension("2.5.29.17");
+    const dns = [];
+    const ip = [];
+    let applicationUri;
+    for (const name of extension?.names.toJSON() ?? []) {
+        if (name.type === "dns") {
+            dns.push(name.value);
+        }
+        else if (name.type === "ip") {
+            ip.push(name.value);
+        }
+        else if (name.type === "url" && applicationUri === undefined) {
+            applicationUri = name.value;
+        }
+    }
+    return { dns, ip, applicationUri };
+}
+/**
+ * Maps this codebase's CRL revocation reason strings (see
+ * `CertificateAuthority.revokeCertificate`'s `crlReasons` list) to
+ * `@peculiar/x509`'s `X509CrlReason` enum keys — same reasons, but
+ * `X509CrlReason.cACompromise` is lowercase-first where this codebase's
+ * `"CACompromise"` is not.
+ */
+const REASON_TO_X509_CRL_REASON = {
+    unspecified: x509.X509CrlReason.unspecified,
+    keyCompromise: x509.X509CrlReason.keyCompromise,
+    CACompromise: x509.X509CrlReason.cACompromise,
+    affiliationChanged: x509.X509CrlReason.affiliationChanged,
+    superseded: x509.X509CrlReason.superseded,
+    cessationOfOperation: x509.X509CrlReason.cessationOfOperation,
+    certificateHold: x509.X509CrlReason.certificateHold,
+    removeFromCRL: x509.X509CrlReason.removeFromCRL
+};
+/**
+ * Builds OpenSSL's slash-delimited one-line subject (`"/CN=Leaf/O=Acme"`)
+ * from the certificate's parsed subject attributes — NOT by re-splitting
+ * `Name.toString()`. The subject comes verbatim from the requester's CSR,
+ * so it is attacker-controlled; the string form escapes `,` (which a
+ * `split(",")` would then mangle) and, because its control-character
+ * `replace()` has no `g` flag, escapes only the FIRST `\n`/`\t` per value,
+ * letting later ones through raw — which would let a crafted CN inject a
+ * forged row into the tab/newline-delimited `index.txt`. Working from
+ * `toJSON()` sidesteps that entirely; {@link CaDatabase} additionally
+ * escapes every control character it writes, as `X509_NAME_oneline` does.
+ */
+function toOpenSslSubjectString(subjectName) {
+    const parts = [];
+    for (const rdn of subjectName.toJSON()) {
+        for (const [type, values] of Object.entries(rdn)) {
+            for (const value of values) {
+                parts.push(`${type}=${value}`);
+            }
+        }
+    }
+    return `/${parts.join("/")}`;
+}
+/**
+ * A native (pure-JS, no `openssl` child process) {@link CaBackend}: it
+ * bootstraps a CA, signs end-entity and subordinate-CA requests, revokes,
+ * and builds CRLs entirely through `node-opcua-crypto`'s signing
+ * primitives and {@link CaDatabase}'s write path, so the resulting
+ * `index.txt`/`serial`/`crlnumber`/`certs/` are the same on-disk format
+ * `openssl ca` produces and an install can move between backends.
+ *
+ * The signing key reaches every operation through
+ * `CertificateAuthority._getSigningKey()`, which yields either the on-disk
+ * key or an external `CaSigner`. Nothing below can tell the difference,
+ * which is the point: a CA whose key lives in an HSM never has a
+ * `private/cakey.pem` and never needs one.
+ *
+ * Two deliberate differences from the openssl backend, both improvements:
+ * a subordinate CA's certificate is recorded in the issuer's `index.txt`
+ * (`openssl x509 -CAserial` bumps the serial file but records nothing),
+ * and a subordinate's SAN is taken from its own CSR rather than being
+ * stamped with the issuer's.
+ */
+export class NativeCaBackend {
+    /** Nothing to check: this backend spawns no process and needs no tool on PATH. */
+    /** Signing goes through `ca._getSigningKey()`, which may be an external signer. */
+    supportsExternalSigner = true;
+    async preflight() {
+        // intentionally empty
+    }
+    /**
+     * Write a CSR for the CA's own key, the `[v3_ca_req]` equivalent. The
+     * key comes from the CA rather than from `privateKeyFile`: on a
+     * signer-backed CA that file does not exist.
+     */
+    async generateCaCsr(ca, _caRootDir, _privateKeyFile, csrFile) {
+        displayTitle("Generate a certificate request for the CA key");
+        const signingKey = await ca._getSigningKey();
+        const { csr } = await createCertificateSigningRequest({
+            privateKey: signingKey,
+            subject: ca.subject.toString(),
+            applicationUri: caSanUri(ca),
+            purpose: CertificatePurpose.ForCertificateAuthority
+        });
+        await fs.promises.writeFile(csrFile, csr);
+    }
+    async bootstrap(ca) {
+        const caRootDir = path.resolve(ca.rootDir);
+        const csrFile = path.join(caRootDir, "private/cakey.csr");
+        await this.generateCaCsr(ca, caRootDir, path.join(caRootDir, "private/cakey.pem"), csrFile);
+        const issuerCA = ca._issuerCA;
+        if (issuerCA) {
+            displayTitle("Generate CA Certificate (signed by issuer CA)");
+            // The issuer's serial file and database are mutated here, so the
+            // issuer's own lock is required - the caller only holds this
+            // (subordinate) CA's. Subordinate -> issuer is the only cross-CA
+            // lock edge in this codebase and it is never reversed, so it
+            // cannot deadlock; the exception is two CAs sharing one rootDir,
+            // where the lock is already held and re-acquiring the
+            // non-reentrant file lock would deadlock against itself.
+            const signWithIssuer = () => this.signSubordinateCsr(issuerCA, csrFile, ca.caCertificate, CA_CERT_VALIDITY_DAYS);
+            if (path.resolve(issuerCA.rootDir) === caRootDir) {
+                await signWithIssuer();
+            }
+            else {
+                await issuerCA._withCaDirectoryLock(signWithIssuer);
+            }
+        }
+        else {
+            displayTitle("Generate CA Certificate (self-signed)");
+            const csrPem = await fs.promises.readFile(csrFile, "utf-8");
+            const signingKey = await ca._getSigningKey();
+            const request = new x509.Pkcs10CertificateRequest(csrPem);
+            const notBefore = new Date();
+            const { cert } = await createCertificateFromCsr({
+                csr: csrPem,
+                // the CSR's own parsed subject, so issuer and subject are
+                // byte-identical on a self-signed root: re-encoding a string
+                // form could differ and break chain building
+                issuerName: request.subjectName,
+                issuerPublicKey: request.publicKey,
+                signingKey,
+                signingAlgorithm: signingAlgorithmOf(signingKey),
+                notBefore,
+                notAfter: daysFromNow(notBefore, CA_CERT_VALIDITY_DAYS),
+                purpose: CertificatePurpose.ForCertificateAuthority,
+                applicationUri: caSanUri(ca),
+                revocation: {
+                    crlDistributionUrl: ca.crlDistributionUrl,
+                    ocspResponderUrl: ca.ocspResponderUrl,
+                    caIssuersUrl: ca.caIssuersUrl
+                }
+            });
+            await fs.promises.writeFile(ca.caCertificate, cert);
+        }
+        displaySubtitle("generate initial CRL (Certificate Revocation List)");
+        await this.#regenerateCrlLocked(ca, new CaDatabase(ca.rootDir));
+        displayTitle("Create Certificate Authority (CA) ---> DONE");
+    }
+    /** Sign a subordinate CA's request with this CA's key, the `[v3_ca]` equivalent. */
+    async signSubordinateCsr(ca, csrFile, certFile, validityDays) {
+        const { signingKey, signingAlgorithm, issuerPublicKey, issuerName } = await this.#issuerContext(ca);
+        const csrPem = await fs.promises.readFile(csrFile, "utf-8");
+        const db = new CaDatabase(ca.rootDir);
+        const serialNumber = db.nextSerial();
+        const notBefore = new Date();
+        const notAfter = daysFromNow(notBefore, validityDays);
+        const { cert } = await createCertificateFromCsr({
+            csr: csrPem,
+            issuerName,
+            issuerPublicKey,
+            signingKey,
+            signingAlgorithm,
+            serialNumber,
+            notBefore,
+            notAfter,
+            purpose: CertificatePurpose.ForCertificateAuthority,
+            // the subordinate's own SAN, not the issuer's
+            ...sanFromCsr(csrPem),
+            revocation: {
+                crlDistributionUrl: ca.crlDistributionUrl,
+                ocspResponderUrl: ca.ocspResponderUrl,
+                caIssuersUrl: ca.caIssuersUrl
+            }
+        });
+        await fs.promises.writeFile(certFile, cert);
+        this.#record(db, serialNumber, cert, notAfter);
+    }
+    /**
+     * Self-sign a certificate with a caller-supplied key file and record it
+     * in this CA's database: the native equivalent of `openssl req -new`
+     * followed by `openssl ca -selfsign`, which likewise applies the
+     * end-entity profile and updates `index.txt`.
+     */
+    async createSelfSignedCertificate(ca, certificateFile, privateKeyFile, params) {
+        displaySubtitle("- the certificate signing request");
+        const key = await privateKeyToCryptoKey(readPrivateKey(privateKeyFile, await ca._privateKeyPassphrase()));
+        const { csr } = await createCertificateSigningRequest({
+            privateKey: key,
+            subject: params.subject ? new Subject(params.subject).toString() : ca.subject.toString(),
+            dns: params.dns,
+            ip: params.ip,
+            applicationUri: params.applicationUri,
+            purpose: CertificatePurpose.ForApplication
+        });
+        displaySubtitle("- creating the self-signed certificate");
+        const request = new x509.Pkcs10CertificateRequest(csr);
+        const db = new CaDatabase(ca.rootDir);
+        const serialNumber = db.nextSerial();
+        const notBefore = params.startDate ?? new Date();
+        const notAfter = params.endDate ?? daysFromNow(notBefore, params.validity ?? 365);
+        const { cert } = await createCertificateFromCsr({
+            csr,
+            issuerName: request.subjectName,
+            issuerPublicKey: request.publicKey,
+            signingKey: key,
+            signingAlgorithm: RSA_SHA256,
+            serialNumber,
+            notBefore,
+            notAfter,
+            purpose: CertificatePurpose.ForApplication,
+            ...sanFromCsr(csr)
+        });
+        await fs.promises.writeFile(certificateFile, cert);
+        this.#record(db, serialNumber, cert, notAfter);
+    }
+    /** `certs/<SERIAL>.pem` plus the `V` row, exactly as `openssl ca` writes them. */
+    #record(db, serialNumber, certPem, notAfter) {
+        db.storeCertificate(serialNumber, certPem);
+        db.appendIssued({
+            serial: serialNumber,
+            expiryDate: notAfter,
+            subject: toOpenSslSubjectString(new x509.X509Certificate(certPem).subjectName)
+        });
+    }
+    /**
+     * The CA's signing key and issuer identity, resolved fresh on every
+     * call and never cached across operations. The identity is read back
+     * from the CA certificate on disk so that the issuer field of anything
+     * this CA signs is byte-identical to that certificate's subject.
+     */
+    async #issuerContext(ca) {
+        const signingKey = await ca._getSigningKey();
+        const caCertPem = await fs.promises.readFile(ca.caCertificate, "utf-8");
+        const caCert = new x509.X509Certificate(caCertPem);
+        return {
+            signingKey,
+            signingAlgorithm: signingAlgorithmOf(signingKey),
+            issuerPublicKey: caCert.publicKey,
+            issuerName: caCert.subjectName
+        };
+    }
+    async signEndEntityCsr(ca, certificate, csr, params, sanOverride) {
+        const { signingKey, signingAlgorithm, issuerPublicKey, issuerName } = await this.#issuerContext(ca);
+        const db = new CaDatabase(ca.rootDir);
+        const serialNumber = db.nextSerial();
+        const csrPem = await fs.promises.readFile(csr, "utf-8");
+        const notBefore = params.startDate ?? new Date();
+        const notAfter = params.endDate ?? new Date(notBefore.getTime() + (params.validity ?? 365) * 24 * 60 * 60 * 1000);
+        const { cert } = await createCertificateFromCsr({
+            csr: csrPem,
+            issuerName,
+            issuerPublicKey,
+            signingKey,
+            signingAlgorithm,
+            serialNumber,
+            notBefore,
+            notAfter,
+            purpose: CertificatePurpose.ForApplication,
+            dns: sanOverride.dns,
+            ip: sanOverride.ip,
+            applicationUri: sanOverride.applicationUri,
+            revocation: {
+                crlDistributionUrl: ca.crlDistributionUrl,
+                ocspResponderUrl: ca.ocspResponderUrl,
+                caIssuersUrl: ca.caIssuersUrl
+            }
+        });
+        await fs.promises.writeFile(certificate, cert);
+        this.#record(db, serialNumber, cert, notAfter);
+    }
+    async #regenerateCrlLocked(ca, db) {
+        const { signingKey, signingAlgorithm, issuerPublicKey, issuerName } = await this.#issuerContext(ca);
+        const crlNumber = db.nextCrlNumber();
+        const entries = db
+            .readIndex()
+            .filter((r) => r.status === "revoked")
+            .map((r) => ({
+            serialNumber: r.serial,
+            revocationDate: r.revocationDate ? new Date(r.revocationDate) : new Date(),
+            reason: r.reason ? REASON_TO_X509_CRL_REASON[r.reason] : undefined
+        }));
+        const { crl } = await createCrl({
+            issuerName,
+            issuerPublicKey,
+            signingKey,
+            signingAlgorithm,
+            crlNumber: BigInt(`0x${crlNumber}`),
+            entries
+        });
+        await fs.promises.writeFile(ca.revocationList, crl);
+        const der = new x509.X509Crl(crl).rawData;
+        await fs.promises.writeFile(ca.revocationListDER, Buffer.from(der));
+    }
+    async regenerateCrl(ca) {
+        const db = new CaDatabase(ca.rootDir);
+        await this.#regenerateCrlLocked(ca, db);
+    }
+    async revoke(ca, certificate, reason) {
+        const certPem = await fs.promises.readFile(certificate, "utf-8");
+        const cert = new x509.X509Certificate(certPem);
+        const db = new CaDatabase(ca.rootDir);
+        db.markRevoked(cert.serialNumber, new Date(), reason);
+        await this.#regenerateCrlLocked(ca, db);
+    }
+}
+//# sourceMappingURL=native_ca_backend.js.map

package/dist/lib/ca/backends/native_ca_backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native_ca_backend.js","sourceRoot":"","sources":["../../../../lib/ca/backends/native_ca_backend.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,iBAAiB;AACjB,wHAAwH;AACxH,gFAAgF;AAChF,yCAAyC;AACzC,wHAAwH;AACxH,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,+GAA+G;AAC/G,sHAAsH;AACtH,kHAAkH;AAClH,mGAAmG;AACnG,EAAE;AACF,uHAAuH;AACvH,YAAY;AACZ,EAAE;AACF,uHAAuH;AACvH,wHAAwH;AACxH,mHAAmH;AACnH,mHAAmH;AACnH,wHAAwH;AAExH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAGH,kBAAkB,EAClB,wBAAwB,EACxB,+BAA+B,EAC/B,SAAS,EACT,UAAU,EACV,qBAAqB,EACrB,cAAc,EACd,OAAO,EACP,IAAI,EACP,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,YAAY,EAA0C,MAAM,wBAAwB,CAAC;AAE/G,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGpD,2FAA2F;AAC3F,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEnC,MAAM,UAAU,GAAoB,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;AAE7F,kGAAkG;AAClG,SAAS,kBAAkB,CAAC,GAAyB;IACjD,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAC,SAAe,EAAE,IAAY;IAC9C,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,EAA4B;IAC1C,OAAO,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,cAAc,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,MAAc;IAC9B,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,WAAW,CAAgD,CAAC;IACnG,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,EAAE,GAAa,EAAE,CAAC;IACxB,IAAI,cAAkC,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC5B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAC7D,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC;QAChC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAuC;IAClE,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,WAAW;IAC3C,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,aAAa;IAC/C,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,YAAY;IAC7C,kBAAkB,EAAE,IAAI,CAAC,aAAa,CAAC,kBAAkB;IACzD,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,UAAU;IACzC,oBAAoB,EAAE,IAAI,CAAC,aAAa,CAAC,oBAAoB;IAC7D,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC,eAAe;IACnD,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,aAAa;CAClD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,SAAS,sBAAsB,CAAC,WAAsB;IAClD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;YACnC,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,eAAe;IACxB,kFAAkF;IAClF,mFAAmF;IACnE,sBAAsB,GAAG,IAAI,CAAC;IAEvC,KAAK,CAAC,SAAS;QAClB,sBAAsB;IAC1B,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,aAAa,CACtB,EAA4B,EAC5B,UAAkB,EAClB,eAAuB,EACvB,OAAe;QAEf,YAAY,CAAC,+CAA+C,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC;QAC7C,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,+BAA+B,CAAC;YAClD,UAAU,EAAE,UAAU;YACtB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE;YAC9B,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,kBAAkB,CAAC,uBAAuB;SACtD,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,EAA4B;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC,CAAC;QAE5F,MAAM,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC;QAC9B,IAAI,QAAQ,EAAE,CAAC;YACX,YAAY,CAAC,+CAA+C,CAAC,CAAC;YAC9D,iEAAiE;YACjE,6DAA6D;YAC7D,iEAAiE;YACjE,6DAA6D;YAC7D,iEAAiE;YACjE,sDAAsD;YACtD,yDAAyD;YACzD,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;YACjH,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,cAAc,EAAE,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACJ,MAAM,QAAQ,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;YACxD,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,YAAY,CAAC,uCAAuC,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;YAC1D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;YAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC;gBAC5C,GAAG,EAAE,MAAM;gBACX,0DAA0D;gBAC1D,6DAA6D;gBAC7D,6CAA6C;gBAC7C,UAAU,EAAE,OAAO,CAAC,WAAW;gBAC/B,eAAe,EAAE,OAAO,CAAC,SAAS;gBAClC,UAAU;gBACV,gBAAgB,EAAE,kBAAkB,CAAC,UAAU,CAAC;gBAChD,SAAS;gBACT,QAAQ,EAAE,WAAW,CAAC,SAAS,EAAE,qBAAqB,CAAC;gBACvD,OAAO,EAAE,kBAAkB,CAAC,uBAAuB;gBACnD,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC5B,UAAU,EAAE;oBACR,kBAAkB,EAAE,EAAE,CAAC,kBAAkB;oBACzC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB;oBACrC,YAAY,EAAE,EAAE,CAAC,YAAY;iBAChC;aACJ,CAAC,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACxD,CAAC;QAED,eAAe,CAAC,oDAAoD,CAAC,CAAC;QACtE,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,YAAY,CAAC,6CAA6C,CAAC,CAAC;IAChE,CAAC;IAED,oFAAoF;IAC7E,KAAK,CAAC,kBAAkB,CAC3B,EAA4B,EAC5B,OAAe,EACf,QAAgB,EAChB,YAAoB;QAEpB,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAEtD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC;YAC5C,GAAG,EAAE,MAAM;YACX,UAAU;YACV,eAAe;YACf,UAAU;YACV,gBAAgB;YAChB,YAAY;YACZ,SAAS;YACT,QAAQ;YACR,OAAO,EAAE,kBAAkB,CAAC,uBAAuB;YACnD,8CAA8C;YAC9C,GAAG,UAAU,CAAC,MAAM,CAAC;YACrB,UAAU,EAAE;gBACR,kBAAkB,EAAE,EAAE,CAAC,kBAAkB;gBACzC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB;gBACrC,YAAY,EAAE,EAAE,CAAC,YAAY;aAChC;SACJ,CAAC,CAAC;QAEH,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,2BAA2B,CACpC,EAA4B,EAC5B,eAAuB,EACvB,cAAsB,EACtB,MAAc;QAEd,eAAe,CAAC,mCAAmC,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC;QAC1G,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,+BAA+B,CAAC;YAClD,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE;YACxF,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,OAAO,EAAE,kBAAkB,CAAC,cAAc;SAC7C,CAAC,CAAC;QAEH,eAAe,CAAC,wCAAwC,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;QAElF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC;YAC5C,GAAG;YACH,UAAU,EAAE,OAAO,CAAC,WAAW;YAC/B,eAAe,EAAE,OAAO,CAAC,SAAS;YAClC,UAAU,EAAE,GAAG;YACf,gBAAgB,EAAE,UAAU;YAC5B,YAAY;YACZ,SAAS;YACT,QAAQ;YACR,OAAO,EAAE,kBAAkB,CAAC,cAAc;YAC1C,GAAG,UAAU,CAAC,GAAG,CAAC;SACrB,CAAC,CAAC;QAEH,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED,kFAAkF;IAClF,OAAO,CAAC,EAAc,EAAE,YAAoB,EAAE,OAAe,EAAE,QAAc;QACzE,EAAE,CAAC,gBAAgB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC3C,EAAE,CAAC,YAAY,CAAC;YACZ,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,sBAAsB,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC;SACjF,CAAC,CAAC;IACP,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,EAA4B;QAM7C,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACnD,OAAO;YACH,UAAU;YACV,gBAAgB,EAAE,kBAAkB,CAAC,UAAU,CAAC;YAChD,eAAe,EAAE,MAAM,CAAC,SAAS;YACjC,UAAU,EAAE,MAAM,CAAC,WAAW;SACjC,CAAC;IACN,CAAC;IAEM,KAAK,CAAC,gBAAgB,CACzB,EAA4B,EAC5B,WAAmB,EACnB,GAAW,EACX,MAAc,EACd,WAA2C;QAE3C,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACpG,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAExD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAElH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC;YAC5C,GAAG,EAAE,MAAM;YACX,UAAU;YACV,eAAe;YACf,UAAU;YACV,gBAAgB;YAChB,YAAY;YACZ,SAAS;YACT,QAAQ;YACR,OAAO,EAAE,kBAAkB,CAAC,cAAc;YAC1C,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,EAAE,EAAE,WAAW,CAAC,EAAE;YAClB,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,UAAU,EAAE;gBACR,kBAAkB,EAAE,EAAE,CAAC,kBAAkB;gBACzC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB;gBACrC,YAAY,EAAE,EAAE,CAAC,YAAY;aAChC;SACJ,CAAC,CAAC;QAEH,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,EAA4B,EAAE,EAAc;QACnE,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACpG,MAAM,SAAS,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,EAAE;aACb,SAAS,EAAE;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACT,YAAY,EAAE,CAAC,CAAC,MAAM;YACtB,cAAc,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE;YAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;SACrE,CAAC,CAAC,CAAC;QAER,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC;YAC5B,UAAU;YACV,eAAe;YACf,UAAU;YACV,gBAAgB;YAChB,SAAS,EAAE,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO;SACV,CAAC,CAAC;QAEH,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;QAC1C,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,EAA4B;QACnD,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,EAA4B,EAAE,WAAmB,EAAE,MAAc;QACjF,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACtC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;CACJ"}

package/dist/lib/ca/backends/openssl_ca_backend.d.ts

@@ -0,0 +1,47 @@
+import { type Params, type ProcessAltNamesParam } from "../../toolbox/index.js";
+import type { CaBackend } from "../core/ca_backend.js";
+import type { CertificateAuthorityCore } from "../core/certificate_authority_core.js";
+/**
+ * Every render of `conf/caconfig.cnf` needs `ALTNAME` / `CDP_URL` /
+ * `AIA_VALUE` resolved, **even for an `openssl` subcommand that only reads
+ * a different section** (`ca -gencrl` only needs `[crl_ext]`, `ca -revoke`
+ * only needs `[ca]`): openssl's config loader (`NCONF_load`) expands every
+ * `$ENV::NAME` reference in the file line by line as it parses it, not
+ * lazily per queried section, and every section in this template — not
+ * just the two gated behind `{{#CDP_URL}}` / `{{#AIA_VALUE}}` — references
+ * `$ENV::ALTNAME` unconditionally. Leaving any of the three unresolved
+ * makes openssl fall through to its own native `$ENV::` resolution (a real
+ * OS environment variable, which is never set) and fail with "variable has
+ * no value".
+ *
+ * Passed explicitly rather than relying on whatever `setEnv()` last wrote
+ * to the shared registry (see {@link generateStaticConfig}'s
+ * `envOverrides`) — empty string means "omit the extension" for the two
+ * gated keys (the template's `{{#KEY}}` block strips itself on an empty
+ * value), never "fall back to the registry".
+ *
+ * Exported as the single implementation of the CDP/AIA value format:
+ * `CertificateAuthority._wireRevocationEnvVars` (the legacy registry shim)
+ * delegates here so the format cannot drift between the two mechanisms.
+ */
+export declare function caConfigEnvOverrides(ca: CertificateAuthorityCore, altName?: string): Record<string, string>;
+/**
+ * The default {@link CaBackend}: shells out to the `openssl` CLI, exactly as
+ * `CertificateAuthority` always has — this is a pure code move (plus a lock
+ * around every database-mutating operation, temp-config cleanup, and
+ * explicit `envOverrides` on every config render) with no change in the
+ * openssl commands issued or the files produced.
+ */
+export declare class OpenSslCaBackend implements CaBackend {
+    #private;
+    /** The openssl CLI loads its key from a file, so it cannot call out to an HSM. */
+    readonly supportsExternalSigner = false;
+    preflight(): Promise<void>;
+    generateCaCsr(ca: CertificateAuthorityCore, _caRootDir: string, privateKeyFile: string, csrFile: string): Promise<void>;
+    bootstrap(ca: CertificateAuthorityCore): Promise<void>;
+    regenerateCrl(ca: CertificateAuthorityCore): Promise<void>;
+    signSubordinateCsr(ca: CertificateAuthorityCore, csrFile: string, certFile: string, validityDays: number): Promise<void>;
+    signEndEntityCsr(ca: CertificateAuthorityCore, certificate: string, csr: string, params1: Params, sanOverride: Required<ProcessAltNamesParam>): Promise<void>;
+    revoke(ca: CertificateAuthorityCore, certificate: string, reason: string): Promise<void>;
+    createSelfSignedCertificate(ca: CertificateAuthorityCore, certificateFile: string, privateKeyFile: string, params: Params): Promise<void>;
+}