node-opcua-server-configuration 2.98.0 → 2.98.2

package/dist/server/promote_trust_list.js

@@ -0,0 +1,176 @@
+"use strict";
+/**
+ * @module node-opcua-server-configuration
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installAccessRestrictionOnTrustList = exports.promoteTrustList = void 0;
+const memfs_1 = require("memfs");
+const node_opcua_debug_1 = require("node-opcua-debug");
+const node_opcua_status_code_1 = require("node-opcua-status-code");
+const node_opcua_variant_1 = require("node-opcua-variant");
+const node_opcua_data_model_1 = require("node-opcua-data-model");
+const node_opcua_file_transfer_1 = require("node-opcua-file-transfer");
+const node_opcua_crypto_1 = require("node-opcua-crypto");
+const trust_list_server_1 = require("./trust_list_server");
+const tools_1 = require("./tools");
+const roles_and_permissions_1 = require("./roles_and_permissions");
+const debugLog = (0, node_opcua_debug_1.make_debugLog)("ServerConfiguration");
+const doDebug = (0, node_opcua_debug_1.checkDebugFlag)("ServerConfiguration");
+const warningLog = (0, node_opcua_debug_1.make_warningLog)("ServerConfiguration");
+const errorLog = debugLog;
+function trustListIsAlreadyOpened(trustList) {
+    return false; // to do...
+}
+function _closeAndUpdate(inputArguments, context) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return { statusCode: node_opcua_status_code_1.StatusCodes.Good };
+    });
+}
+// in TrustList
+function _addCertificate(inputArguments, context) {
+    return __awaiter(this, void 0, void 0, function* () {
+        // If the Certificate is issued by a CA then the Client shall provide the entire
+        // chain in the certificate argument (see OPC 10000-6). After validating the Certificate,
+        // the Server shall add the CA Certificates to the Issuers list in the Trust List.
+        // The leaf Certificate is added to the list specified by the isTrustedCertificate argument.
+        if (!(0, tools_1.hasEncryptedChannel)(context)) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadSecurityModeInsufficient };
+        }
+        if (!(0, tools_1.hasExpectedUserAccess)(context)) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadUserAccessDenied };
+        }
+        const trustList = context.object;
+        const cm = trustList.$$certificateManager || null;
+        // The trust list must have been bound
+        if (!cm) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadInternalError };
+        }
+        // This method cannot be called if the file object is open.
+        if (trustListIsAlreadyOpened(trustList)) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadInvalidState };
+        }
+        const certificateChain = inputArguments[0].value;
+        const isTrustedCertificate = inputArguments[1].value;
+        const certificates = (0, node_opcua_crypto_1.split_der)(certificateChain);
+        // validate certificate first
+        const r = yield (0, node_opcua_crypto_1.verifyCertificateChain)(certificates);
+        if (r.status !== "Good") {
+            warningLog("Invalid certificate ", r.status, r.reason);
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadCertificateInvalid };
+        }
+        for (let i = 0; i < certificates.length; i++) {
+            const certificate = certificates[i];
+            if (i === certificates.length - 1 && isTrustedCertificate) {
+                yield cm.trustCertificate(certificate);
+            }
+            else {
+                yield cm.addIssuer(certificate);
+            }
+        }
+        debugLog("_addCertificate - done isTrustedCertificate= ", isTrustedCertificate);
+        return { statusCode: node_opcua_status_code_1.StatusCodes.Good };
+    });
+}
+function _removeCertificate(inputArguments, context) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (!(0, tools_1.hasEncryptedChannel)(context)) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadSecurityModeInsufficient };
+        }
+        if (!(0, tools_1.hasExpectedUserAccess)(context)) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadUserAccessDenied };
+        }
+        return { statusCode: node_opcua_status_code_1.StatusCodes.Good };
+    });
+}
+let counter = 0;
+function promoteTrustList(trustList) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const filename = `/tmpFile${counter}`;
+        counter += 1;
+        (0, node_opcua_file_transfer_1.installFileType)(trustList, { filename, fileSystem: memfs_1.fs });
+        // we need to change the default open method
+        const open = trustList.getChildByName("Open");
+        const _open_asyncExecutionFunction = open._asyncExecutionFunction;
+        // ... and bind the extended methods as well.
+        const closeAndUpdate = trustList.getChildByName("CloseAndUpdate");
+        const openWithMasks = trustList.getChildByName("OpenWithMasks");
+        const addCertificate = trustList.getChildByName("AddCertificate");
+        const removeCertificate = trustList.getChildByName("RemoveCertificate");
+        function _openTrustList(trustMask, inputArgs, context, callback) {
+            if (trustListIsAlreadyOpened(trustList)) {
+                return callback(null, { statusCode: node_opcua_status_code_1.StatusCodes.BadInvalidState });
+            }
+            // if (trustList.isOpened) {
+            //     warningLog("TrustList is already opened")
+            //     return { statusCode: StatusCodes.BadInvalidState};
+            // }
+            // The Open Method shall not support modes other than Read (0x01) and the Write + EraseExisting (0x06).
+            const openMask = inputArgs[0].value;
+            if (openMask !== node_opcua_file_transfer_1.OpenFileMode.Read && openMask !== node_opcua_file_transfer_1.OpenFileMode.WriteEraseExisting) {
+                return callback(null, { statusCode: node_opcua_status_code_1.StatusCodes.BadInvalidArgument });
+            }
+            // possible statusCode: Bad_UserAccessDenied	The current user does not have the rights required.
+            const certificateManager = trustList.$$certificateManager || undefined;
+            if (certificateManager) {
+                (0, trust_list_server_1.writeTrustList)(memfs_1.fs, filename, trustMask, certificateManager)
+                    .then(() => {
+                    //  trustList.isOpened = true;
+                    _open_asyncExecutionFunction.call(this, inputArgs, context, callback);
+                })
+                    .catch((err) => {
+                    errorLog(err);
+                    callback(err, { statusCode: node_opcua_status_code_1.StatusCodes.BadInternalError });
+                });
+            }
+            else {
+                warningLog("certificateManager is not defined on trustlist do something to update the document before we open it");
+                return _open_asyncExecutionFunction.call(this, inputArgs, context, callback);
+            }
+        }
+        function _openCallback(inputArgs, context, callback) {
+            _openTrustList.call(this, trust_list_server_1.TrustListMasks.All, inputArgs, context, callback);
+        }
+        open.bindMethod(_openCallback);
+        function _openWithMaskCallback(inputArgs, context, callback) {
+            const trustListMask = inputArgs[0].value;
+            inputArgs[0] = new node_opcua_variant_1.Variant({ dataType: node_opcua_variant_1.DataType.Byte, value: node_opcua_file_transfer_1.OpenFileMode.Read });
+            _openTrustList.call(this, trustListMask, inputArgs, context, callback);
+        }
+        // The OpenWithMasks Method allows a Client to read only the portion of the Trust List.
+        // This Method can only be used to read the Trust List.
+        openWithMasks.bindMethod(_openWithMaskCallback);
+        addCertificate.bindMethod(_addCertificate);
+        removeCertificate.bindMethod(_removeCertificate);
+        closeAndUpdate === null || closeAndUpdate === void 0 ? void 0 : closeAndUpdate.bindMethod(_closeAndUpdate);
+        function install_method_handle_on_TrustListType(addressSpace) {
+            const fileType = addressSpace.findObjectType("TrustListType");
+            if (!fileType || fileType.addCertificate.isBound()) {
+                return;
+            }
+            fileType.open && fileType.open.bindMethod(_openCallback);
+            fileType.addCertificate.bindMethod(_addCertificate);
+            fileType.removeCertificate.bindMethod(_removeCertificate);
+            fileType.openWithMasks && fileType.openWithMasks.bindMethod(_openWithMaskCallback);
+            fileType.closeAndUpdate && fileType.closeAndUpdate.bindMethod(_closeAndUpdate);
+        }
+        install_method_handle_on_TrustListType(trustList.addressSpace);
+    });
+}
+exports.promoteTrustList = promoteTrustList;
+function installAccessRestrictionOnTrustList(trustList) {
+    for (const m of trustList.getComponents()) {
+        m === null || m === void 0 ? void 0 : m.setRolePermissions(roles_and_permissions_1.rolePermissionAdminOnly);
+        m === null || m === void 0 ? void 0 : m.setAccessRestrictions(node_opcua_data_model_1.AccessRestrictionsFlag.SigningRequired | node_opcua_data_model_1.AccessRestrictionsFlag.EncryptionRequired);
+    }
+}
+exports.installAccessRestrictionOnTrustList = installAccessRestrictionOnTrustList;
+//# sourceMappingURL=promote_trust_list.js.map

package/dist/server/promote_trust_list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"promote_trust_list.js","sourceRoot":"","sources":["../../source/server/promote_trust_list.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;AAEH,iCAAoC;AAWpC,uDAAkF;AAClF,mEAAgE;AAEhE,2DAAuD;AACvD,iEAA+D;AAE/D,uEAAqF;AAErF,yDAAsE;AAEtE,2DAAqE;AAErE,mCAAqE;AACrE,mEAAkE;AAElE,MAAM,QAAQ,GAAG,IAAA,gCAAa,EAAC,qBAAqB,CAAC,CAAC;AACtD,MAAM,OAAO,GAAG,IAAA,iCAAc,EAAC,qBAAqB,CAAC,CAAC;AACtD,MAAM,UAAU,GAAG,IAAA,kCAAe,EAAC,qBAAqB,CAAC,CAAC;AAC1D,MAAM,QAAQ,GAAG,QAAQ,CAAC;AAE1B,SAAS,wBAAwB,CAAC,SAAsB;IACpD,OAAO,KAAK,CAAC,CAAC,WAAW;AAC7B,CAAC;AAED,SAAe,eAAe,CAE1B,cAAyB,EACzB,OAAwB;;QAExB,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,IAAI,EAAE,CAAC;IAC5C,CAAC;CAAA;AAED,eAAe;AACf,SAAe,eAAe,CAE1B,cAAyB,EACzB,OAAwB;;QAExB,gFAAgF;QAChF,yFAAyF;QACzF,kFAAkF;QAClF,4FAA4F;QAC5F,IAAI,CAAC,IAAA,2BAAmB,EAAC,OAAO,CAAC,EAAE;YAC/B,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,2BAA2B,EAAE,CAAC;SAClE;QACD,IAAI,CAAC,IAAA,6BAAqB,EAAC,OAAO,CAAC,EAAE;YACjC,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,mBAAmB,EAAE,CAAC;SAC1D;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,MAAqB,CAAC;QAChD,MAAM,EAAE,GAAK,SAAiB,CAAC,oBAA2C,IAAI,IAAI,CAAC;QAEnF,sCAAsC;QACtC,IAAI,CAAC,EAAE,EAAE;YACL,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,gBAAgB,EAAE,CAAC;SACvD;QACD,2DAA2D;QAC3D,IAAI,wBAAwB,CAAC,SAAS,CAAC,EAAE;YACrC,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,eAAe,EAAE,CAAC;SACtD;QAED,MAAM,gBAAgB,GAAW,cAAc,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;QACnE,MAAM,oBAAoB,GAAY,cAAc,CAAC,CAAC,CAAC,CAAC,KAAgB,CAAC;QAEzE,MAAM,YAAY,GAAG,IAAA,6BAAS,EAAC,gBAAgB,CAAC,CAAC;QAEjD,6BAA6B;QAC7B,MAAM,CAAC,GAAG,MAAM,IAAA,0CAAsB,EAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE;YACrB,UAAU,CAAC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YACvD,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,qBAAqB,EAAE,CAAC;SAC5D;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YAC1C,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,oBAAoB,EAAE;gBACvD,MAAM,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;aAC1C;iBAAM;gBACH,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;aACnC;SACJ;QACD,QAAQ,CAAC,+CAA+C,EAAE,oBAAoB,CAAC,CAAC;QAChF,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,IAAI,EAAE,CAAC;IAC5C,CAAC;CAAA;AACD,SAAe,kBAAkB,CAE7B,cAAyB,EACzB,OAAwB;;QAExB,IAAI,CAAC,IAAA,2BAAmB,EAAC,OAAO,CAAC,EAAE;YAC/B,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,2BAA2B,EAAE,CAAC;SAClE;QAED,IAAI,CAAC,IAAA,6BAAqB,EAAC,OAAO,CAAC,EAAE;YACjC,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,mBAAmB,EAAE,CAAC;SAC1D;QAED,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,IAAI,EAAE,CAAC;IAC5C,CAAC;CAAA;AAED,IAAI,OAAO,GAAG,CAAC,CAAC;AAEhB,SAAsB,gBAAgB,CAAC,SAAsB;;QACzD,MAAM,QAAQ,GAAG,WAAW,OAAO,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC,CAAC;QAEb,IAAA,0CAAe,EAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAmB,EAAE,CAAC,CAAC;QAE1E,4CAA4C;QAC5C,MAAM,IAAI,GAAG,SAAS,CAAC,cAAc,CAAC,MAAM,CAAa,CAAC;QAC1D,MAAM,4BAA4B,GAAI,IAAY,CAAC,uBAAwC,CAAC;QAE5F,6CAA6C;QAC7C,MAAM,cAAc,GAAG,SAAS,CAAC,cAAc,CAAC,gBAAgB,CAAa,CAAC;QAC9E,MAAM,aAAa,GAAG,SAAS,CAAC,cAAc,CAAC,eAAe,CAAa,CAAC;QAC5E,MAAM,cAAc,GAAG,SAAS,CAAC,cAAc,CAAC,gBAAgB,CAAa,CAAC;QAC9E,MAAM,iBAAiB,GAAG,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAa,CAAC;QAEpF,SAAS,cAAc,CAEnB,SAAyB,EACzB,SAAoB,EACpB,OAAwB,EACxB,QAA4C;YAE5C,IAAI,wBAAwB,CAAC,SAAS,CAAC,EAAE;gBACrC,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,oCAAW,CAAC,eAAe,EAAE,CAAC,CAAC;aACtE;YACD,4BAA4B;YAC5B,gDAAgD;YAChD,yDAAyD;YACzD,IAAI;YAEJ,uGAAuG;YACvG,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;YAC9C,IAAI,QAAQ,KAAK,uCAAY,CAAC,IAAI,IAAI,QAAQ,KAAK,uCAAY,CAAC,kBAAkB,EAAE;gBAChF,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,oCAAW,CAAC,kBAAkB,EAAE,CAAC,CAAC;aACzE;YACD,gGAAgG;YAChG,MAAM,kBAAkB,GAAK,SAAiB,CAAC,oBAAgD,IAAI,SAAS,CAAC;YAC7G,IAAI,kBAAkB,EAAE;gBACpB,IAAA,kCAAc,EAAC,UAAmB,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,CAAC;qBACvE,IAAI,CAAC,GAAG,EAAE;oBACP,8BAA8B;oBAE9B,4BAA4B,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC1E,CAAC,CAAC;qBACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACX,QAAQ,CAAC,GAAG,CAAC,CAAC;oBACd,QAAQ,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,oCAAW,CAAC,gBAAgB,EAAE,CAAC,CAAC;gBAChE,CAAC,CAAC,CAAC;aACV;iBAAM;gBACH,UAAU,CAAC,sGAAsG,CAAC,CAAC;gBACnH,OAAO,4BAA4B,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;aAChF;QACL,CAAC;QAED,SAAS,aAAa,CAElB,SAAoB,EACpB,OAAwB,EACxB,QAA4C;YAE5C,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,kCAAc,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAE/B,SAAS,qBAAqB,CAE1B,SAAoB,EACpB,OAAwB,EACxB,QAA4C;YAE5C,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;YACnD,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,4BAAO,CAAC,EAAE,QAAQ,EAAE,6BAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,uCAAY,CAAC,IAAI,EAAE,CAAC,CAAC;YAClF,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3E,CAAC;QACD,uFAAuF;QACvF,uDAAuD;QACvD,aAAa,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;QAChD,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAC3C,iBAAiB,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;QACjD,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,UAAU,CAAC,eAAe,CAAC,CAAC;QAE5C,SAAS,sCAAsC,CAAC,YAA2B;YACvE,MAAM,QAAQ,GAAG,YAAY,CAAC,cAAc,CAAC,eAAe,CAAQ,CAAC;YACrE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE;gBAChD,OAAO;aACV;YACD,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACzD,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YACpD,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;YAC1D,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;YACnF,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QACnF,CAAC;QACD,sCAAsC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACnE,CAAC;CAAA;AA/FD,4CA+FC;AAED,SAAgB,mCAAmC,CAAC,SAAgC;IAChF,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,aAAa,EAAE,EAAE;QACvC,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,kBAAkB,CAAC,+CAAuB,CAAC,CAAC;QAC/C,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,qBAAqB,CAAC,8CAAsB,CAAC,eAAe,GAAG,8CAAsB,CAAC,kBAAkB,CAAC,CAAC;KAChH;AACL,CAAC;AALD,kFAKC"}

package/dist/server/push_certificate_manager_helpers.d.ts

@@ -0,0 +1,4 @@
+import { AddressSpace, UACertificateGroup } from "node-opcua-address-space";
+import { PushCertificateManagerServerOptions } from "./push_certificate_manager_server_impl";
+export declare function promoteCertificateGroup(certificateGroup: UACertificateGroup): Promise<void>;
+export declare function installPushCertificateManagement(addressSpace: AddressSpace, options: PushCertificateManagerServerOptions): Promise<void>;

package/dist/server/push_certificate_manager_helpers.js

@@ -0,0 +1,412 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installPushCertificateManagement = exports.promoteCertificateGroup = void 0;
+/**
+ * @module node-opcua-server-configuration
+ */
+const path = require("path");
+const fs = require("fs");
+const node_opcua_address_space_1 = require("node-opcua-address-space");
+const node_opcua_address_space_base_1 = require("node-opcua-address-space-base");
+const node_opcua_debug_1 = require("node-opcua-debug");
+const node_opcua_nodeid_1 = require("node-opcua-nodeid");
+const node_opcua_status_code_1 = require("node-opcua-status-code");
+const node_opcua_variant_1 = require("node-opcua-variant");
+const node_opcua_data_model_1 = require("node-opcua-data-model");
+const node_opcua_constants_1 = require("node-opcua-constants");
+const node_opcua_crypto_1 = require("node-opcua-crypto");
+const push_certificate_manager_server_impl_1 = require("./push_certificate_manager_server_impl");
+const promote_trust_list_1 = require("./promote_trust_list");
+const tools_1 = require("./tools");
+const roles_and_permissions_1 = require("./roles_and_permissions");
+const install_certificate_file_watcher_1 = require("./install_certificate_file_watcher");
+const debugLog = (0, node_opcua_debug_1.make_debugLog)("ServerConfiguration");
+const doDebug = (0, node_opcua_debug_1.checkDebugFlag)("ServerConfiguration");
+const warningLog = (0, node_opcua_debug_1.make_warningLog)("ServerConfiguration");
+const errorLog = debugLog;
+function expected(variant, dataType, variantArrayType) {
+    if (!variant) {
+        return false;
+    }
+    if (variant.dataType !== dataType) {
+        return false;
+    }
+    if (variant.arrayType !== variantArrayType) {
+        return false;
+    }
+    return true;
+}
+function getPushCertificateManager(method) {
+    const serverConfiguration = method.addressSpace.rootFolder.objects.server.getChildByName("ServerConfiguration");
+    const serverConfigurationPriv = serverConfiguration;
+    if (serverConfigurationPriv.$pushCertificateManager) {
+        return serverConfigurationPriv.$pushCertificateManager;
+    }
+    // throw new Error("Cannot find pushCertificateManager object");
+    return null;
+}
+function _createSigningRequest(inputArguments, context) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const certificateGroupIdVariant = inputArguments[0];
+        const certificateTypeIdVariant = inputArguments[1];
+        const subjectNameVariant = inputArguments[2];
+        const regeneratePrivateKeyVariant = inputArguments[3];
+        const nonceVariant = inputArguments[4];
+        if (!expected(certificateGroupIdVariant, node_opcua_variant_1.DataType.NodeId, node_opcua_variant_1.VariantArrayType.Scalar)) {
+            warningLog("expecting an NodeId for certificateGroupId - 0");
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadInvalidArgument };
+        }
+        if (!expected(certificateTypeIdVariant, node_opcua_variant_1.DataType.NodeId, node_opcua_variant_1.VariantArrayType.Scalar)) {
+            warningLog("expecting an NodeId for certificateTypeId - 1");
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadInvalidArgument };
+        }
+        if (!expected(subjectNameVariant, node_opcua_variant_1.DataType.String, node_opcua_variant_1.VariantArrayType.Scalar)) {
+            warningLog("expecting an String for subjectName - 2");
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadInvalidArgument };
+        }
+        if (!expected(regeneratePrivateKeyVariant, node_opcua_variant_1.DataType.Boolean, node_opcua_variant_1.VariantArrayType.Scalar)) {
+            warningLog("expecting an Boolean for regeneratePrivateKey - 3");
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadInvalidArgument };
+        }
+        if (!expected(nonceVariant, node_opcua_variant_1.DataType.ByteString, node_opcua_variant_1.VariantArrayType.Scalar)) {
+            warningLog("expecting an ByteString for nonceVariant - 4");
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadInvalidArgument };
+        }
+        if (!(0, tools_1.hasEncryptedChannel)(context)) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadSecurityModeInsufficient };
+        }
+        if (!(0, tools_1.hasExpectedUserAccess)(context)) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadUserAccessDenied };
+        }
+        const certificateGroupId = certificateGroupIdVariant.value;
+        const certificateTypeId = certificateTypeIdVariant.value;
+        const subjectName = subjectNameVariant.value;
+        const regeneratePrivateKey = regeneratePrivateKeyVariant.value;
+        const nonce = nonceVariant.value;
+        const pushCertificateManager = getPushCertificateManager(this);
+        if (!pushCertificateManager) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadNotImplemented };
+        }
+        const result = yield pushCertificateManager.createSigningRequest(certificateGroupId, certificateTypeId, subjectName, regeneratePrivateKey, nonce);
+        if (result.statusCode.isNotGood()) {
+            return { statusCode: result.statusCode };
+        }
+        const callMethodResult = {
+            outputArguments: [
+                {
+                    dataType: node_opcua_variant_1.DataType.ByteString,
+                    value: result.certificateSigningRequest
+                }
+            ],
+            statusCode: result.statusCode
+        };
+        return callMethodResult;
+    });
+}
+function _updateCertificate(inputArguments, context) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const certificateGroupId = inputArguments[0].value;
+        const certificateTypeId = inputArguments[1].value;
+        const certificate = inputArguments[2].value;
+        const issuerCertificates = inputArguments[3].value;
+        const privateKeyFormat = inputArguments[4].value;
+        const privateKey = inputArguments[5].value;
+        // This Method requires an encrypted channel and that the Client provides credentials with
+        // administrative rights on the Server
+        if (!(0, tools_1.hasEncryptedChannel)(context)) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadSecurityModeInsufficient };
+        }
+        if (!(0, tools_1.hasExpectedUserAccess)(context)) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadUserAccessDenied };
+        }
+        if (privateKeyFormat && privateKeyFormat !== "" && privateKeyFormat.toLowerCase() !== "pem") {
+            errorLog("_updateCertificate: Invalid PEM format requested " + privateKeyFormat);
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadInvalidArgument };
+        }
+        const pushCertificateManager = getPushCertificateManager(this);
+        if (!pushCertificateManager) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadNotImplemented };
+        }
+        const result = yield pushCertificateManager.updateCertificate(certificateGroupId, certificateTypeId, certificate, issuerCertificates, privateKeyFormat, privateKey);
+        // todo   raise a CertificateUpdatedAuditEventType
+        if (result.statusCode.isNotGood()) {
+            return { statusCode: result.statusCode };
+        }
+        const callMethodResult = {
+            outputArguments: [
+                {
+                    dataType: node_opcua_variant_1.DataType.Boolean,
+                    value: !!result.applyChangesRequired
+                }
+            ],
+            statusCode: result.statusCode
+        };
+        return callMethodResult;
+    });
+}
+function _getRejectedList(inputArguments, context) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (!(0, tools_1.hasEncryptedChannel)(context)) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadSecurityModeInsufficient };
+        }
+        if (!(0, tools_1.hasExpectedUserAccess)(context)) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadUserAccessDenied };
+        }
+        const pushCertificateManager = getPushCertificateManager(this);
+        if (!pushCertificateManager) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadNotImplemented };
+        }
+        const result = yield pushCertificateManager.getRejectedList();
+        if (result.statusCode.isNotGood()) {
+            return { statusCode: result.statusCode };
+        }
+        return {
+            outputArguments: [
+                {
+                    arrayType: node_opcua_variant_1.VariantArrayType.Array,
+                    dataType: node_opcua_variant_1.DataType.ByteString,
+                    value: result.certificates
+                }
+            ],
+            statusCode: node_opcua_status_code_1.StatusCodes.Good
+        };
+    });
+}
+function _applyChanges(inputArguments, context) {
+    return __awaiter(this, void 0, void 0, function* () {
+        // This Method requires an encrypted channel and that the Client provide credentials with
+        // administrative rights on the Server.
+        if (!(0, tools_1.hasEncryptedChannel)(context)) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadSecurityModeInsufficient };
+        }
+        if (!(0, tools_1.hasExpectedUserAccess)(context)) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadUserAccessDenied };
+        }
+        const pushCertificateManager = getPushCertificateManager(this);
+        if (!pushCertificateManager) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadNotImplemented };
+        }
+        const statusCode = yield pushCertificateManager.applyChanges();
+        return { statusCode };
+    });
+}
+function getCertificateFilename(certificateManager) {
+    return path.join(certificateManager.rootDir, "own/certs/certificate.pem"); // to do , find a better way
+}
+function getCertificate(certificateManager) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            const certificateFile = getCertificateFilename(certificateManager);
+            if (fs.existsSync(certificateFile)) {
+                const certificate = yield (0, node_opcua_crypto_1.readCertificate)(certificateFile);
+                return certificate;
+            }
+            return null;
+        }
+        catch (err) {
+            warningLog("getCertificate Error", err.message);
+            return null;
+        }
+    });
+}
+function bindCertificateGroup(certificateGroup, certificateManager) {
+    if (certificateManager) {
+        const certificateFile = getCertificateFilename(certificateManager);
+        const changeDetector = (0, install_certificate_file_watcher_1.installCertificateFileWatcher)(certificateGroup, certificateFile);
+        changeDetector.on("certificateChange", () => {
+            debugLog("detecting certificate change", certificateFile);
+            updateCertificateAlarm();
+        });
+    }
+    function updateCertificateAlarm() {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                debugLog("updateCertificateAlarm", certificateGroup.browseName.toString());
+                const certificateExpired = certificateGroup.getComponentByName("CertificateExpired");
+                if (certificateExpired && certificateManager) {
+                    const certificateExpiredEx = certificateExpired;
+                    const certificate = yield getCertificate(certificateManager);
+                    certificateExpiredEx.setCertificate(certificate);
+                }
+            }
+            catch (err) {
+                warningLog("updateCertificateAlarm Error", err.message);
+            }
+        });
+    }
+    const addressSpace = certificateGroup.addressSpace;
+    if (!certificateManager) {
+        return;
+    }
+    const trustList = certificateGroup.getComponentByName("TrustList");
+    if (trustList) {
+        trustList.$$certificateManager = certificateManager;
+    }
+    const certificateExpired = certificateGroup.getComponentByName("CertificateExpired");
+    if (certificateExpired) {
+        certificateExpired.$$certificateManager = certificateManager;
+        // install alarm handling
+        const timerId = setInterval(updateCertificateAlarm, 60 * 1000);
+        addressSpace.registerShutdownTask(() => clearInterval(timerId));
+        updateCertificateAlarm();
+    }
+}
+function bindCertificateManager(addressSpace, options) {
+    const serverConfiguration = addressSpace.rootFolder.objects.server.getChildByName("ServerConfiguration");
+    const defaultApplicationGroup = serverConfiguration.certificateGroups.getComponentByName("DefaultApplicationGroup");
+    if (defaultApplicationGroup) {
+        bindCertificateGroup(defaultApplicationGroup, options.applicationGroup);
+    }
+    const defaultTokenGroup = serverConfiguration.certificateGroups.getComponentByName("DefaultUserTokenGroup");
+    if (defaultTokenGroup) {
+        bindCertificateGroup(defaultTokenGroup, options.userTokenGroup);
+    }
+}
+function setNotifierOfChain(childObject) {
+    if (!childObject) {
+        return;
+    }
+    const parentObject = childObject.parent;
+    if (!parentObject) {
+        return;
+    }
+    const notifierOf = childObject.findReferencesEx("HasNotifier", node_opcua_data_model_1.BrowseDirection.Inverse);
+    if (notifierOf.length === 0) {
+        const notifierOfNode = childObject.addReference({
+            referenceType: "HasNotifier",
+            nodeId: parentObject.nodeId,
+            isForward: false
+        });
+    }
+    parentObject.setEventNotifier(parentObject.eventNotifier | node_opcua_address_space_base_1.EventNotifierFlags.SubscribeToEvents);
+    if (parentObject.nodeId.namespace === 0 && parentObject.nodeId.value === node_opcua_constants_1.ObjectIds.Server) {
+        return;
+    }
+    setNotifierOfChain(parentObject);
+}
+function promoteCertificateGroup(certificateGroup) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const trustList = certificateGroup.getChildByName("TrustList");
+        if (trustList) {
+            yield (0, promote_trust_list_1.promoteTrustList)(trustList);
+        }
+        if (!certificateGroup.certificateExpired) {
+            const namespace = certificateGroup.addressSpace.getOwnNamespace();
+            // certificateGroup.
+            (0, node_opcua_address_space_1.instantiateCertificateExpirationAlarm)(namespace, "CertificateExpirationAlarmType", {
+                browseName: (0, node_opcua_data_model_1.coerceQualifiedName)("0:CertificateExpired"),
+                componentOf: certificateGroup,
+                conditionSource: null,
+                conditionOf: certificateGroup,
+                inputNode: node_opcua_nodeid_1.NodeId.nullNodeId,
+                normalState: node_opcua_nodeid_1.NodeId.nullNodeId,
+                optionals: ["ExpirationLimit"],
+                conditionName: "CertificateExpired",
+                conditionClass: (0, node_opcua_nodeid_1.resolveNodeId)("CertificateExpirationAlarmType"),
+            });
+        }
+        certificateGroup.setEventNotifier(node_opcua_address_space_base_1.EventNotifierFlags.SubscribeToEvents);
+        setNotifierOfChain(certificateGroup);
+    });
+}
+exports.promoteCertificateGroup = promoteCertificateGroup;
+;
+function installPushCertificateManagement(addressSpace, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        addressSpace.installAlarmsAndConditionsService();
+        const serverConfiguration = addressSpace.rootFolder.objects.server.getChildByName("ServerConfiguration");
+        const serverConfigurationPriv = serverConfiguration;
+        if (serverConfigurationPriv.$pushCertificateManager) {
+            warningLog("PushCertificateManagement has already been installed");
+            return;
+        }
+        const accessRestrictionFlag = node_opcua_data_model_1.AccessRestrictionsFlag.SigningRequired | node_opcua_data_model_1.AccessRestrictionsFlag.EncryptionRequired;
+        function installAccessRestrictions(serverConfiguration) {
+            serverConfiguration.setRolePermissions(roles_and_permissions_1.rolePermissionRestricted);
+            serverConfiguration.setAccessRestrictions(node_opcua_data_model_1.AccessRestrictionsFlag.None);
+            const applyName = serverConfiguration.getMethodByName("ApplyChanges");
+            applyName === null || applyName === void 0 ? void 0 : applyName.setRolePermissions(roles_and_permissions_1.rolePermissionAdminOnly);
+            applyName === null || applyName === void 0 ? void 0 : applyName.setAccessRestrictions(node_opcua_data_model_1.AccessRestrictionsFlag.SigningRequired | node_opcua_data_model_1.AccessRestrictionsFlag.EncryptionRequired);
+            const createSigningRequest = serverConfiguration.getMethodByName("CreateSigningRequest");
+            createSigningRequest === null || createSigningRequest === void 0 ? void 0 : createSigningRequest.setRolePermissions(roles_and_permissions_1.rolePermissionAdminOnly);
+            createSigningRequest === null || createSigningRequest === void 0 ? void 0 : createSigningRequest.setAccessRestrictions(accessRestrictionFlag);
+            const getRejectedList = serverConfiguration.getMethodByName("GetRejectedList");
+            getRejectedList === null || getRejectedList === void 0 ? void 0 : getRejectedList.setRolePermissions(roles_and_permissions_1.rolePermissionAdminOnly);
+            getRejectedList === null || getRejectedList === void 0 ? void 0 : getRejectedList.setAccessRestrictions(accessRestrictionFlag);
+            const updateCertificate = serverConfiguration.getMethodByName("UpdateCertificate");
+            updateCertificate === null || updateCertificate === void 0 ? void 0 : updateCertificate.setRolePermissions(roles_and_permissions_1.rolePermissionAdminOnly);
+            updateCertificate === null || updateCertificate === void 0 ? void 0 : updateCertificate.setAccessRestrictions(accessRestrictionFlag);
+            const certificateGroups = serverConfiguration.getComponentByName("CertificateGroups");
+            certificateGroups.setRolePermissions(roles_and_permissions_1.rolePermissionRestricted);
+            certificateGroups.setAccessRestrictions(node_opcua_data_model_1.AccessRestrictionsFlag.None);
+            function installAccessRestrictionOnGroup(group) {
+                const trustList = group.getComponentByName("TrustList");
+                if (trustList) {
+                    (0, promote_trust_list_1.installAccessRestrictionOnTrustList)(trustList);
+                }
+            }
+            for (const group of certificateGroups.getComponents()) {
+                group.setRolePermissions(roles_and_permissions_1.rolePermissionAdminOnly);
+                group.setAccessRestrictions(node_opcua_data_model_1.AccessRestrictionsFlag.SigningRequired | node_opcua_data_model_1.AccessRestrictionsFlag.EncryptionRequired);
+                if (group.nodeClass === node_opcua_data_model_1.NodeClass.Object) {
+                    installAccessRestrictionOnGroup(group);
+                }
+            }
+        }
+        installAccessRestrictions(serverConfiguration);
+        serverConfigurationPriv.$pushCertificateManager = new push_certificate_manager_server_impl_1.PushCertificateManagerServerImpl(options);
+        serverConfiguration.supportedPrivateKeyFormats.setValueFromSource({
+            arrayType: node_opcua_variant_1.VariantArrayType.Array,
+            dataType: node_opcua_variant_1.DataType.String,
+            value: ["PEM"]
+        });
+        function install_method_handle_on_type(addressSpace) {
+            const serverConfigurationType = addressSpace.findObjectType("ServerConfigurationType");
+            if (serverConfigurationType.createSigningRequest.isBound()) {
+                return;
+            }
+            serverConfigurationType.createSigningRequest.bindMethod(_createSigningRequest);
+            serverConfigurationType.getRejectedList.bindMethod(_getRejectedList);
+            serverConfigurationType.updateCertificate.bindMethod(_updateCertificate);
+            serverConfigurationType.applyChanges.bindMethod(_applyChanges);
+        }
+        install_method_handle_on_type(addressSpace);
+        serverConfiguration.createSigningRequest.bindMethod(_createSigningRequest);
+        serverConfiguration.updateCertificate.bindMethod(_updateCertificate);
+        serverConfiguration.getRejectedList.bindMethod(_getRejectedList);
+        if (serverConfiguration.applyChanges) {
+            serverConfiguration.applyChanges.bindMethod(_applyChanges);
+        }
+        const cg = serverConfiguration.certificateGroups.getComponents();
+        const defaultApplicationGroup = serverConfiguration.certificateGroups.getComponentByName("DefaultApplicationGroup");
+        const certificateTypes = defaultApplicationGroup.getPropertyByName("CertificateTypes");
+        certificateTypes.setValueFromSource({
+            dataType: node_opcua_variant_1.DataType.NodeId,
+            arrayType: node_opcua_variant_1.VariantArrayType.Array,
+            value: [(0, node_opcua_nodeid_1.resolveNodeId)(node_opcua_constants_1.ObjectTypeIds.RsaSha256ApplicationCertificateType)]
+        });
+        const certificateGroupType = addressSpace.findObjectType("CertificateGroupType");
+        for (const certificateGroup of cg) {
+            if (certificateGroup.nodeClass !== node_opcua_data_model_1.NodeClass.Object) {
+                continue;
+            }
+            const o = certificateGroup;
+            if (!o.typeDefinitionObj.isSubtypeOf(certificateGroupType)) {
+                continue;
+            }
+            yield promoteCertificateGroup(certificateGroup);
+        }
+        yield bindCertificateManager(addressSpace, options);
+    });
+}
+exports.installPushCertificateManagement = installPushCertificateManagement;
+//# sourceMappingURL=push_certificate_manager_helpers.js.map

package/dist/server/push_certificate_manager_helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push_certificate_manager_helpers.js","sourceRoot":"","sources":["../../source/server/push_certificate_manager_helpers.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;GAEG;AACH,6BAA6B;AAC7B,yBAAyB;AACzB,uEAUkC;AAClC,iFAAyF;AAEzF,uDAAkF;AAClF,yDAA0D;AAC1D,mEAAqD;AAErD,2DAAyE;AACzE,iEAO+B;AAE/B,+DAAgE;AAEhE,yDAAiE;AAIjE,iGAA+H;AAC/H,6DAA6F;AAC7F,mCAAqE;AACrE,mEAA4F;AAC5F,yFAAmF;AAEnF,MAAM,QAAQ,GAAG,IAAA,gCAAa,EAAC,qBAAqB,CAAC,CAAC;AACtD,MAAM,OAAO,GAAG,IAAA,iCAAc,EAAC,qBAAqB,CAAC,CAAC;AACtD,MAAM,UAAU,GAAG,IAAA,kCAAe,EAAC,qBAAqB,CAAC,CAAC;AAC1D,MAAM,QAAQ,GAAG,QAAQ,CAAC;AAE1B,SAAS,QAAQ,CAAC,OAA4B,EAAE,QAAkB,EAAE,gBAAkC;IAClG,IAAI,CAAC,OAAO,EAAE;QACV,OAAO,KAAK,CAAC;KAChB;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE;QAC/B,OAAO,KAAK,CAAC;KAChB;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,gBAAgB,EAAE;QACxC,OAAO,KAAK,CAAC;KAChB;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAgB;IAC/C,MAAM,mBAAmB,GAAG,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC;IAChH,MAAM,uBAAuB,GAAG,mBAA0B,CAAC;IAC3D,IAAI,uBAAuB,CAAC,uBAAuB,EAAE;QACjD,OAAO,uBAAuB,CAAC,uBAAuB,CAAC;KAC1D;IACD,gEAAgE;IAChE,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAe,qBAAqB,CAEhC,cAAyB,EACzB,OAAwB;;QAExB,MAAM,yBAAyB,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,wBAAwB,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,kBAAkB,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC7C,MAAM,2BAA2B,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAEvC,IAAI,CAAC,QAAQ,CAAC,yBAAyB,EAAE,6BAAQ,CAAC,MAAM,EAAE,qCAAgB,CAAC,MAAM,CAAC,EAAE;YAChF,UAAU,CAAC,gDAAgD,CAAC,CAAC;YAC7D,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,kBAAkB,EAAE,CAAC;SACzD;QACD,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE,6BAAQ,CAAC,MAAM,EAAE,qCAAgB,CAAC,MAAM,CAAC,EAAE;YAC/E,UAAU,CAAC,+CAA+C,CAAC,CAAC;YAC5D,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,kBAAkB,EAAE,CAAC;SACzD;QACD,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,6BAAQ,CAAC,MAAM,EAAE,qCAAgB,CAAC,MAAM,CAAC,EAAE;YACzE,UAAU,CAAC,yCAAyC,CAAC,CAAC;YACtD,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,kBAAkB,EAAE,CAAC;SACzD;QACD,IAAI,CAAC,QAAQ,CAAC,2BAA2B,EAAE,6BAAQ,CAAC,OAAO,EAAE,qCAAgB,CAAC,MAAM,CAAC,EAAE;YACnF,UAAU,CAAC,mDAAmD,CAAC,CAAC;YAChE,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,kBAAkB,EAAE,CAAC;SACzD;QACD,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,6BAAQ,CAAC,UAAU,EAAE,qCAAgB,CAAC,MAAM,CAAC,EAAE;YACvE,UAAU,CAAC,8CAA8C,CAAC,CAAC;YAC3D,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,kBAAkB,EAAE,CAAC;SACzD;QAED,IAAI,CAAC,IAAA,2BAAmB,EAAC,OAAO,CAAC,EAAE;YAC/B,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,2BAA2B,EAAE,CAAC;SAClE;QAED,IAAI,CAAC,IAAA,6BAAqB,EAAC,OAAO,CAAC,EAAE;YACjC,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,mBAAmB,EAAE,CAAC;SAC1D;QAED,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,KAAe,CAAC;QACrE,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,KAAe,CAAC;QACnE,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAe,CAAC;QACvD,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,KAAgB,CAAC;QAC1E,MAAM,KAAK,GAAG,YAAY,CAAC,KAAe,CAAC;QAE3C,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,sBAAsB,EAAE;YACzB,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,iBAAiB,EAAE,CAAC;SACxD;QACD,MAAM,MAAM,GAA+B,MAAM,sBAAsB,CAAC,oBAAoB,CACxF,kBAAkB,EAClB,iBAAiB,EACjB,WAAW,EACX,oBAAoB,EACpB,KAAK,CACR,CAAC;QAEF,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE;YAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;SAC5C;QAED,MAAM,gBAAgB,GAAG;YACrB,eAAe,EAAE;gBACb;oBACI,QAAQ,EAAE,6BAAQ,CAAC,UAAU;oBAC7B,KAAK,EAAE,MAAM,CAAC,yBAAyB;iBAC1C;aACJ;YACD,UAAU,EAAE,MAAM,CAAC,UAAU;SAChC,CAAC;QACF,OAAO,gBAAgB,CAAC;IAC5B,CAAC;CAAA;AAED,SAAe,kBAAkB,CAE7B,cAAyB,EACzB,OAAwB;;QAExB,MAAM,kBAAkB,GAAW,cAAc,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;QACrE,MAAM,iBAAiB,GAAW,cAAc,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;QACpE,MAAM,WAAW,GAAW,cAAc,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;QAC9D,MAAM,kBAAkB,GAAa,cAAc,CAAC,CAAC,CAAC,CAAC,KAAiB,CAAC;QACzE,MAAM,gBAAgB,GAAa,cAAc,CAAC,CAAC,CAAC,CAAC,KAAiB,CAAC;QACvE,MAAM,UAAU,GAAW,cAAc,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC;QAEjE,0FAA0F;QAC1F,sCAAsC;QACtC,IAAI,CAAC,IAAA,2BAAmB,EAAC,OAAO,CAAC,EAAE;YAC/B,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,2BAA2B,EAAE,CAAC;SAClE;QACD,IAAI,CAAC,IAAA,6BAAqB,EAAC,OAAO,CAAC,EAAE;YACjC,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,mBAAmB,EAAE,CAAC;SAC1D;QAED,IAAI,gBAAgB,IAAI,gBAAgB,KAAK,EAAE,IAAI,gBAAgB,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE;YACzF,QAAQ,CAAC,mDAAmD,GAAG,gBAAgB,CAAC,CAAC;YACjF,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,kBAAkB,EAAE,CAAC;SACzD;QAED,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,sBAAsB,EAAE;YACzB,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,iBAAiB,EAAE,CAAC;SACxD;QAED,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,iBAAiB,CACzD,kBAAkB,EAClB,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,CACb,CAAC;QAEF,kDAAkD;QAElD,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE;YAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;SAC5C;QACD,MAAM,gBAAgB,GAAG;YACrB,eAAe,EAAE;gBACb;oBACI,QAAQ,EAAE,6BAAQ,CAAC,OAAO;oBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,oBAAqB;iBACxC;aACJ;YACD,UAAU,EAAE,MAAM,CAAC,UAAU;SAChC,CAAC;QACF,OAAO,gBAAgB,CAAC;IAC5B,CAAC;CAAA;AAED,SAAe,gBAAgB,CAE3B,cAAyB,EACzB,OAAwB;;QAExB,IAAI,CAAC,IAAA,2BAAmB,EAAC,OAAO,CAAC,EAAE;YAC/B,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,2BAA2B,EAAE,CAAC;SAClE;QACD,IAAI,CAAC,IAAA,6BAAqB,EAAC,OAAO,CAAC,EAAE;YACjC,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,mBAAmB,EAAE,CAAC;SAC1D;QAED,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,sBAAsB,EAAE;YACzB,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,iBAAiB,EAAE,CAAC;SACxD;QAED,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,eAAe,EAAE,CAAC;QAE9D,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE;YAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;SAC5C;QAED,OAAO;YACH,eAAe,EAAE;gBACb;oBACI,SAAS,EAAE,qCAAgB,CAAC,KAAK;oBACjC,QAAQ,EAAE,6BAAQ,CAAC,UAAU;oBAC7B,KAAK,EAAE,MAAM,CAAC,YAAY;iBAC7B;aACJ;YACD,UAAU,EAAE,oCAAW,CAAC,IAAI;SAC/B,CAAC;IACN,CAAC;CAAA;AAED,SAAe,aAAa,CAExB,cAAyB,EACzB,OAAwB;;QAExB,yFAAyF;QACzF,uCAAuC;QACvC,IAAI,CAAC,IAAA,2BAAmB,EAAC,OAAO,CAAC,EAAE;YAC/B,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,2BAA2B,EAAE,CAAC;SAClE;QACD,IAAI,CAAC,IAAA,6BAAqB,EAAC,OAAO,CAAC,EAAE;YACjC,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,mBAAmB,EAAE,CAAC;SAC1D;QAED,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,sBAAsB,EAAE;YACzB,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,iBAAiB,EAAE,CAAC;SACxD;QACD,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,YAAY,EAAE,CAAC;QAC/D,OAAO,EAAE,UAAU,EAAE,CAAC;IAC1B,CAAC;CAAA;AAED,SAAS,sBAAsB,CAAC,kBAAsC;IAClE,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,4BAA4B;AAC3G,CAAC;AACD,SAAe,cAAc,CAAC,kBAAsC;;QAChE,IAAI;YACA,MAAM,eAAe,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;YACnE,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE;gBAChC,MAAM,WAAW,GAAG,MAAM,IAAA,mCAAe,EAAC,eAAe,CAAC,CAAC;gBAC3D,OAAO,WAAW,CAAC;aACtB;YACD,OAAO,IAAI,CAAC;SACf;QAAC,OAAO,GAAG,EAAE;YACV,UAAU,CAAC,sBAAsB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;SACf;IACL,CAAC;CAAA;AAED,SAAS,oBAAoB,CAAC,gBAAoC,EAAE,kBAAuC;IACvG,IAAI,kBAAkB,EAAE;QACpB,MAAM,eAAe,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,IAAA,gEAA6B,EAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;QACxF,cAAc,CAAC,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;YACxC,QAAQ,CAAC,8BAA8B,EAAE,eAAe,CAAC,CAAC;YAC1D,sBAAsB,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;KACN;IAED,SAAe,sBAAsB;;YACjC,IAAI;gBACA,QAAQ,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC3E,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;gBACrF,IAAI,kBAAkB,IAAI,kBAAkB,EAAE;oBAC1C,MAAM,oBAAoB,GAAG,kBAA+D,CAAC;oBAC7F,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,kBAAkB,CAAC,CAAC;oBAC7D,oBAAoB,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;iBACpD;aACJ;YAAC,OAAO,GAAG,EAAE;gBACV,UAAU,CAAC,8BAA8B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;aACtE;QACL,CAAC;KAAA;IAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,YAAY,CAAC;IACnD,IAAI,CAAC,kBAAkB,EAAE;QACrB,OAAO;KACV;IACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACnE,IAAI,SAAS,EAAE;QACV,SAAiB,CAAC,oBAAoB,GAAG,kBAAkB,CAAC;KAChE;IACD,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;IACrF,IAAI,kBAAkB,EAAE;QACnB,kBAA0B,CAAC,oBAAoB,GAAG,kBAAkB,CAAC;QACtE,yBAAyB;QACzB,MAAM,OAAO,GAAG,WAAW,CAAC,sBAAsB,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QAC/D,YAAY,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,sBAAsB,EAAE,CAAC;KAC5B;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,YAA0B,EAAE,OAA4C;IACpG,MAAM,mBAAmB,GAAG,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAC7E,qBAAqB,CACE,CAAC;IAE5B,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,kBAAkB,CACpF,yBAAyB,CACC,CAAC;IAC/B,IAAI,uBAAuB,EAAE;QACzB,oBAAoB,CAAC,uBAAuB,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;KAC3E;IACD,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,kBAAkB,CAC9E,uBAAuB,CACG,CAAC;IAC/B,IAAI,iBAAiB,EAAE;QACnB,oBAAoB,CAAC,iBAAiB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;KACnE;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,WAA4B;IACpD,IAAI,CAAC,WAAW,EAAE;QACd,OAAO;KACV;IACD,MAAM,YAAY,GAAoB,WAAW,CAAC,MAAyB,CAAC;IAC5E,IAAI,CAAC,YAAY,EAAE;QACf,OAAO;KACV;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,gBAAgB,CAAC,aAAa,EAAE,uCAAe,CAAC,OAAO,CAAC,CAAC;IACxF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE;QACzB,MAAM,cAAc,GAAG,WAAW,CAAC,YAAY,CAAC;YAC5C,aAAa,EAAE,aAAa;YAC5B,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,SAAS,EAAE,KAAK;SACnB,CAAC,CAAC;KACN;IACD,YAAY,CAAC,gBAAgB,CAAC,YAAY,CAAC,aAAa,GAAG,kDAAkB,CAAC,iBAAiB,CAAC,CAAC;IACjG,IAAI,YAAY,CAAC,MAAM,CAAC,SAAS,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,KAAK,gCAAS,CAAC,MAAM,EAAE;QACvF,OAAO;KACV;IACD,kBAAkB,CAAC,YAAY,CAAC,CAAC;AACrC,CAAC;AAED,SAAsB,uBAAuB,CAAC,gBAAoC;;QAC9E,MAAM,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC,WAAW,CAAgB,CAAC;QAC9E,IAAI,SAAS,EAAE;YACX,MAAM,IAAA,qCAAgB,EAAC,SAAS,CAAC,CAAC;SACrC;QACD,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE;YACtC,MAAM,SAAS,GAAG,gBAAgB,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC;YAElE,oBAAoB;YACpB,IAAA,gEAAqC,EAAC,SAAS,EAAE,gCAAgC,EAAE;gBAC/E,UAAU,EAAE,IAAA,2CAAmB,EAAC,sBAAsB,CAAC;gBACvD,WAAW,EAAE,gBAAgB;gBAC7B,eAAe,EAAE,IAAI;gBACrB,WAAW,EAAE,gBAAgB;gBAC7B,SAAS,EAAE,0BAAM,CAAC,UAAU;gBAC5B,WAAW,EAAE,0BAAM,CAAC,UAAU;gBAC9B,SAAS,EAAE,CAAC,iBAAiB,CAAC;gBAC9B,aAAa,EAAE,oBAAoB;gBACnC,cAAc,EAAE,IAAA,iCAAa,EAAC,gCAAgC,CAAC;aAClE,CAAC,CAAC;SACN;QACD,gBAAgB,CAAC,gBAAgB,CAAC,kDAAkB,CAAC,iBAAiB,CAAC,CAAC;QACxE,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IACzC,CAAC;CAAA;AAvBD,0DAuBC;AAC6H,CAAC;AAC/H,SAAsB,gCAAgC,CAClD,YAA0B,EAC1B,OAA4C;;QAE5C,YAAY,CAAC,iCAAiC,EAAE,CAAC;QAEjD,MAAM,mBAAmB,GAAG,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAC7E,qBAAqB,CACE,CAAC;QAE5B,MAAM,uBAAuB,GAAG,mBAAgD,CAAC;QACjF,IAAI,uBAAuB,CAAC,uBAAuB,EAAE;YACjD,UAAU,CAAC,sDAAsD,CAAC,CAAC;YACnE,OAAO;SACV;QAED,MAAM,qBAAqB,GAAG,8CAAsB,CAAC,eAAe,GAAG,8CAAsB,CAAC,kBAAkB,CAAC;QAEjH,SAAS,yBAAyB,CAAC,mBAA6B;YAC5D,mBAAmB,CAAC,kBAAkB,CAAC,gDAAwB,CAAC,CAAC;YACjE,mBAAmB,CAAC,qBAAqB,CAAC,8CAAsB,CAAC,IAAI,CAAC,CAAC;YAEvE,MAAM,SAAS,GAAG,mBAAmB,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;YACtE,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,kBAAkB,CAAC,+CAAuB,CAAC,CAAC;YACvD,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,qBAAqB,CAAC,8CAAsB,CAAC,eAAe,GAAG,8CAAsB,CAAC,kBAAkB,CAAC,CAAC;YAErH,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC;YACzF,oBAAoB,aAApB,oBAAoB,uBAApB,oBAAoB,CAAE,kBAAkB,CAAC,+CAAuB,CAAC,CAAC;YAClE,oBAAoB,aAApB,oBAAoB,uBAApB,oBAAoB,CAAE,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;YAEnE,MAAM,eAAe,GAAG,mBAAmB,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC;YAC/E,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,kBAAkB,CAAC,+CAAuB,CAAC,CAAC;YAC7D,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;YAE9D,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,eAAe,CAAC,mBAAmB,CAAC,CAAC;YACnF,iBAAiB,aAAjB,iBAAiB,uBAAjB,iBAAiB,CAAE,kBAAkB,CAAC,+CAAuB,CAAC,CAAC;YAC/D,iBAAiB,aAAjB,iBAAiB,uBAAjB,iBAAiB,CAAE,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;YAEhE,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,kBAAkB,CAAC,mBAAmB,CAAE,CAAC;YACvF,iBAAiB,CAAC,kBAAkB,CAAC,gDAAwB,CAAC,CAAC;YAC/D,iBAAiB,CAAC,qBAAqB,CAAC,8CAAsB,CAAC,IAAI,CAAC,CAAC;YAErE,SAAS,+BAA+B,CAAC,KAAe;gBACpD,MAAM,SAAS,GAAG,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAE,CAAC;gBACzD,IAAI,SAAS,EAAE;oBACX,IAAA,wDAAmC,EAAC,SAAS,CAAC,CAAC;iBAClD;YACL,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,aAAa,EAAE,EAAE;gBACnD,KAAK,CAAC,kBAAkB,CAAC,+CAAuB,CAAC,CAAC;gBAClD,KAAK,CAAC,qBAAqB,CAAC,8CAAsB,CAAC,eAAe,GAAG,8CAAsB,CAAC,kBAAkB,CAAC,CAAC;gBAChH,IAAI,KAAK,CAAC,SAAS,KAAK,iCAAS,CAAC,MAAM,EAAE;oBACtC,+BAA+B,CAAC,KAAiB,CAAC,CAAC;iBACtD;aACJ;QACL,CAAC;QACD,yBAAyB,CAAC,mBAAmB,CAAC,CAAC;QAE/C,uBAAuB,CAAC,uBAAuB,GAAG,IAAI,uEAAgC,CAAC,OAAO,CAAC,CAAC;QAEhG,mBAAmB,CAAC,0BAA0B,CAAC,kBAAkB,CAAC;YAC9D,SAAS,EAAE,qCAAgB,CAAC,KAAK;YACjC,QAAQ,EAAE,6BAAQ,CAAC,MAAM;YACzB,KAAK,EAAE,CAAC,KAAK,CAAC;SACjB,CAAC,CAAC;QAEH,SAAS,6BAA6B,CAAC,YAA0B;YAC7D,MAAM,uBAAuB,GAAG,YAAY,CAAC,cAAc,CAAC,yBAAyB,CAAS,CAAC;YAC/F,IAAI,uBAAuB,CAAC,oBAAoB,CAAC,OAAO,EAAE,EAAE;gBACxD,OAAO;aACV;YACD,uBAAuB,CAAC,oBAAoB,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;YAC/E,uBAAuB,CAAC,eAAe,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;YACrE,uBAAuB,CAAC,iBAAiB,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;YACzE,uBAAuB,CAAC,YAAY,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QACnE,CAAC;QAED,6BAA6B,CAAC,YAAY,CAAC,CAAC;QAE5C,mBAAmB,CAAC,oBAAoB,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;QAC3E,mBAAmB,CAAC,iBAAiB,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;QACrE,mBAAmB,CAAC,eAAe,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QACjE,IAAI,mBAAmB,CAAC,YAAY,EAAE;YAClC,mBAAmB,CAAC,YAAa,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;SAC/D;QAED,MAAM,EAAE,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,aAAa,EAAE,CAAC;QAEjE,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,yBAAyB,CAAE,CAAC;QACrH,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,iBAAiB,CAAC,kBAAkB,CAAe,CAAC;QACrG,gBAAgB,CAAC,kBAAkB,CAAC;YAChC,QAAQ,EAAE,6BAAQ,CAAC,MAAM;YACzB,SAAS,EAAE,qCAAgB,CAAC,KAAK;YACjC,KAAK,EAAE,CAAC,IAAA,iCAAa,EAAC,oCAAa,CAAC,mCAAmC,CAAC,CAAC;SAC5E,CAAC,CAAC;QAEH,MAAM,oBAAoB,GAAG,YAAY,CAAC,cAAc,CAAC,sBAAsB,CAAE,CAAC;QAElF,KAAK,MAAM,gBAAgB,IAAI,EAAE,EAAE;YAC/B,IAAI,gBAAgB,CAAC,SAAS,KAAK,iCAAS,CAAC,MAAM,EAAE;gBACjD,SAAS;aACZ;YACD,MAAM,CAAC,GAAG,gBAA4B,CAAC;YACvC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,oBAAoB,CAAC,EAAE;gBACxD,SAAS;aACZ;YACD,MAAM,uBAAuB,CAAC,gBAAsC,CAAC,CAAC;SACzE;QACD,MAAM,sBAAsB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CAAA;AA7GD,4EA6GC"}