ooxml-core 1.13.0 → 1.14.0

package/dist/pptx/signature-node/index.cjs

@@ -6,8 +6,8 @@ var crypto2 = require('crypto');
 var path = require('path');
 var tls = require('tls');
 var forge3 = require('node-forge');
-var http = require('http');
-var https = require('https');
+var dns = require('dns');
+var net = require('net');
 var fs = require('fs/promises');
 var JSZip = require('jszip');
 
@@ -17,8 +17,8 @@ var crypto2__default = /*#__PURE__*/_interopDefault(crypto2);
 var path__default = /*#__PURE__*/_interopDefault(path);
 var tls__default = /*#__PURE__*/_interopDefault(tls);
 var forge3__default = /*#__PURE__*/_interopDefault(forge3);
-var http__default = /*#__PURE__*/_interopDefault(http);
-var https__default = /*#__PURE__*/_interopDefault(https);
+var dns__default = /*#__PURE__*/_interopDefault(dns);
+var net__default = /*#__PURE__*/_interopDefault(net);
 var fs__default = /*#__PURE__*/_interopDefault(fs);
 var JSZip__default = /*#__PURE__*/_interopDefault(JSZip);
 
@@ -72,27 +72,55 @@ function extractTagAttribute(xml, tagName, attributeName) {
   const match = xml.match(pattern);
   return match?.groups?.["attributeValue"]?.trim();
 }
+var isNameChar = (c) => c !== void 0 && /[\w.-]/.test(c);
+var isWordChar = (c) => c !== void 0 && /\w/.test(c);
+function matchName(xml, lowerXml, from, lname) {
+  let pos = from;
+  if (!lowerXml.startsWith(lname, pos)) {
+    let end = pos;
+    while (isNameChar(xml[end])) end++;
+    if (end === pos || xml[end] !== ":") return -1;
+    pos = end + 1;
+    if (!lowerXml.startsWith(lname, pos)) return -1;
+  }
+  return pos + lname.length;
+}
+function findTagText(xml, lowerXml, lname, from) {
+  let lt = xml.indexOf("<", from);
+  while (lt !== -1) {
+    const afterName = matchName(xml, lowerXml, lt + 1, lname);
+    if (afterName !== -1 && !isWordChar(xml[afterName])) {
+      const gt = xml.indexOf(">", afterName);
+      if (gt === -1) return null;
+      let close = xml.indexOf("</", gt + 1);
+      while (close !== -1) {
+        const closeEnd = matchName(xml, lowerXml, close + 2, lname);
+        if (closeEnd !== -1 && xml[closeEnd] === ">") {
+          return { text: xml.slice(gt + 1, close), end: closeEnd + 1 };
+        }
+        close = xml.indexOf("</", close + 2);
+      }
+      return null;
+    }
+    lt = xml.indexOf("<", lt + 1);
+  }
+  return null;
+}
 function extractFirstTagText(xml, localName) {
-  const pattern = new RegExp(
-    `<([\\w.-]+:)?${localName}\\b[^>]*>([\\s\\S]*?)<\\/([\\w.-]+:)?${localName}>`,
-    "i"
-  );
-  const match = xml.match(pattern);
-  return match?.[2]?.replace(/\s+/g, "").trim() || void 0;
+  const found = findTagText(xml, xml.toLowerCase(), localName.toLowerCase(), 0);
+  return found?.text.replace(/\s+/g, "").trim() || void 0;
 }
 function extractAllTagText(xml, localName) {
   const result = [];
-  const regex = new RegExp(
-    `<([\\w.-]+:)?${localName}\\b[^>]*>([\\s\\S]*?)<\\/([\\w.-]+:)?${localName}>`,
-    "gi"
-  );
-  let match = regex.exec(xml);
-  while (match) {
-    const value = match[2]?.replace(/\s+/g, "").trim();
+  const lowerXml = xml.toLowerCase();
+  const lname = localName.toLowerCase();
+  let found = findTagText(xml, lowerXml, lname, 0);
+  while (found) {
+    const value = found.text.replace(/\s+/g, "").trim();
     if (value) {
       result.push(value);
     }
-    match = regex.exec(xml);
+    found = findTagText(xml, lowerXml, lname, found.end);
   }
   return result;
 }
@@ -519,6 +547,108 @@ function loadSigningMaterialFromBuffer(certificateBuffer, certificatePath, certi
 function pemCertificateToBase64(pem) {
   return pem.replace(/-----BEGIN CERTIFICATE-----/g, "").replace(/-----END CERTIFICATE-----/g, "").replace(/\s+/g, "").trim();
 }
+var OCSP_TIMEOUT_MS = 1e4;
+var OCSP_MAX_RESPONSE_BYTES = 1024 * 1024;
+function isPrivateIpv4(ip) {
+  const p = ip.split(".").map(Number);
+  const [a = 0, b = 0] = p;
+  return a === 0 || a === 10 || a === 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 100 && b >= 64 && b <= 127;
+}
+function isPrivateAddress(address) {
+  const ip = address.replace(/^\[|\]$/g, "").split("%")[0] ?? "";
+  if (net__default.default.isIPv4(ip)) {
+    return isPrivateIpv4(ip);
+  }
+  if (!net__default.default.isIPv6(ip)) {
+    return true;
+  }
+  const lower = ip.toLowerCase();
+  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(lower);
+  if (mapped?.[1]) {
+    return isPrivateIpv4(mapped[1]);
+  }
+  const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(lower);
+  if (hex?.[1] && hex[2]) {
+    const hi = Number.parseInt(hex[1], 16);
+    const lo = Number.parseInt(hex[2], 16);
+    return isPrivateIpv4(`${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`);
+  }
+  if (lower === "::" || lower === "::1") {
+    return true;
+  }
+  const first = Number.parseInt(lower.split(":")[0] || "0", 16);
+  return (first & 65024) === 64512 || (first & 65472) === 65152;
+}
+async function assertPublicHost(hostname) {
+  const host = hostname.replace(/^\[|\]$/g, "");
+  const addresses = net__default.default.isIP(host) ? [host] : (await dns__default.default.promises.lookup(host, { all: true })).map((entry) => entry.address);
+  if (addresses.length === 0) {
+    throw new Error("Responder host did not resolve");
+  }
+  for (const address of addresses) {
+    if (isPrivateAddress(address)) {
+      throw new Error("Responder host resolves to a private network address");
+    }
+  }
+}
+async function readCapped(response, controller) {
+  const declared = Number(response.headers.get("content-length") ?? 0);
+  if (declared > OCSP_MAX_RESPONSE_BYTES) {
+    controller.abort();
+    throw new Error("Response too large");
+  }
+  if (!response.body) {
+    return Buffer.alloc(0);
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > OCSP_MAX_RESPONSE_BYTES) {
+      controller.abort();
+      await reader.cancel().catch(() => void 0);
+      throw new Error("Response too large");
+    }
+    chunks.push(Buffer.from(value));
+  }
+  return Buffer.concat(chunks);
+}
+async function httpPost(url, body, contentType, options = {}) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error("Invalid URL");
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error("Unsupported protocol");
+  }
+  if (!options.allowPrivateNetwork) {
+    await assertPublicHost(parsed.hostname);
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), OCSP_TIMEOUT_MS);
+  try {
+    const response = await fetch(parsed, {
+      method: "POST",
+      headers: { "Content-Type": contentType },
+      body: new Uint8Array(body),
+      redirect: "manual",
+      signal: controller.signal
+    });
+    if (response.status >= 300 && response.status < 400) {
+      throw new Error("Redirects are not followed");
+    }
+    return await readCapped(response, controller);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// pptx/signature-node/ocsp.ts
 function asn1Child2(node, index) {
   return Array.isArray(node.value) ? node.value[index] : void 0;
 }
@@ -544,49 +674,6 @@ function extractOcspUrls(certPem) {
     return [];
   }
 }
-var HTTP_TIMEOUT_MS = 1e4;
-function httpPost(url, body, contentType) {
-  return new Promise((resolve, reject) => {
-    let parsed;
-    try {
-      parsed = new URL(url);
-    } catch {
-      reject(new Error("Invalid URL"));
-      return;
-    }
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      reject(new Error("Unsupported protocol"));
-      return;
-    }
-    const transport = parsed.protocol === "https:" ? https__default.default : http__default.default;
-    const req = transport.request(
-      {
-        hostname: parsed.hostname,
-        port: parsed.port || void 0,
-        path: parsed.pathname + parsed.search,
-        method: "POST",
-        headers: {
-          "Content-Type": contentType,
-          "Content-Length": body.length
-        },
-        timeout: HTTP_TIMEOUT_MS
-      },
-      (res) => {
-        const chunks = [];
-        res.on("data", (chunk) => chunks.push(chunk));
-        res.on("end", () => resolve(Buffer.concat(chunks)));
-        res.on("error", reject);
-      }
-    );
-    req.on("error", reject);
-    req.on("timeout", () => {
-      req.destroy();
-      reject(new Error("Timeout"));
-    });
-    req.write(body);
-    req.end();
-  });
-}
 var SHA1_OID = "1.3.14.3.2.26";
 function buildOcspRequestDer(leafPem, issuerPem) {
   try {
@@ -693,7 +780,7 @@ function parseOcspResponseStatus(data) {
     return "error";
   }
 }
-async function evaluateCertificateRevocation(leafCertPem, issuerCertPem) {
+async function evaluateCertificateRevocation(leafCertPem, issuerCertPem, options = {}) {
   const ocspUrls = extractOcspUrls(leafCertPem);
   const checkedOcspUrls = [];
   const checkedCrlUrls = [];
@@ -703,7 +790,7 @@ async function evaluateCertificateRevocation(leafCertPem, issuerCertPem) {
       for (const url of ocspUrls) {
         checkedOcspUrls.push(url);
         try {
-          const resp = await httpPost(url, reqDer, "application/ocsp-request");
+          const resp = await httpPost(url, reqDer, "application/ocsp-request", options);
           const status = parseOcspResponseStatus(resp);
           if (status === "good" || status === "revoked") {
             return { status, checkedOcspUrls, checkedCrlUrls };
@@ -1034,9 +1121,199 @@ async function buildReferenceChecksFromPptxViewerManifest(zip, signatureXml) {
   }
   return checks;
 }
+var DEFAULT_ZIP_LIMITS = {
+  maxInputBytes: 100 * 1024 * 1024,
+  maxEntries: 1e4,
+  maxEntryBytes: 100 * 1024 * 1024,
+  maxTotalBytes: 100 * 1024 * 1024
+};
+var ZipLimitError = class extends Error {
+  code = "ZIP_BOMB";
+  limit;
+  constructor(message, details) {
+    super(message);
+    this.name = "ZipLimitError";
+    this.limit = details.limit;
+  }
+};
+var mib = (bytes) => Math.round(bytes / 1048576);
+function isSafePartName(name) {
+  if (name.includes("\0") || name.includes("\\")) return false;
+  if (/^[A-Za-z]:/u.test(name)) return false;
+  const body = name.startsWith("/") ? name.slice(1) : name;
+  if (body.startsWith("/")) return false;
+  return !body.split("/").some((segment) => segment === "..");
+}
+function declaredEntrySize(entry) {
+  const data = entry._data;
+  const size = Number(data?.uncompressedSize ?? 0);
+  return Number.isFinite(size) && size > 0 ? size : 0;
+}
+function resolveLimits(limits) {
+  const create = limits.createError;
+  return {
+    maxEntries: limits.maxEntries ?? DEFAULT_ZIP_LIMITS.maxEntries,
+    maxEntryBytes: limits.maxEntryBytes ?? DEFAULT_ZIP_LIMITS.maxEntryBytes,
+    maxTotalBytes: limits.maxTotalBytes ?? DEFAULT_ZIP_LIMITS.maxTotalBytes,
+    label: limits.label ?? "ZIP",
+    fail: (message, limit) => create ? create(message, { limit }) : new ZipLimitError(message, { limit })
+  };
+}
+function inflateEntryGuarded(entry, alreadyRead, limits) {
+  const r = resolveLimits(limits);
+  const declared = declaredEntrySize(entry);
+  return new Promise((resolvePromise, reject) => {
+    const chunks = [];
+    let size = 0;
+    let done = false;
+    const stream = entry.internalStream("uint8array");
+    const abort = (error) => {
+      if (done) return;
+      done = true;
+      stream.pause();
+      chunks.length = 0;
+      reject(error);
+    };
+    stream.on("data", (chunk) => {
+      if (done) return;
+      size += chunk.byteLength;
+      if (size > declared || size > r.maxEntryBytes)
+        return abort(
+          r.fail(`${r.label} part ${entry.name} inflates past its declared size`, r.maxEntryBytes)
+        );
+      if (alreadyRead + size > r.maxTotalBytes)
+        return abort(
+          r.fail(
+            `${r.label} package exceeds the ${mib(r.maxTotalBytes)} MiB uncompressed content limit`,
+            r.maxTotalBytes
+          )
+        );
+      chunks.push(chunk);
+    });
+    stream.on("error", (error) => abort(error));
+    stream.on("end", () => {
+      if (done) return;
+      done = true;
+      if (chunks.length === 1 && chunks[0]) return resolvePromise(chunks[0]);
+      const out = new Uint8Array(size);
+      let offset = 0;
+      for (const chunk of chunks) {
+        out.set(chunk, offset);
+        offset += chunk.byteLength;
+      }
+      resolvePromise(out);
+    });
+    stream.resume();
+  });
+}
+function toBase64(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += 32768)
+    binary += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  return btoa(binary);
+}
+function guardZip(zip, limits = {}) {
+  const r = resolveLimits(limits);
+  const entries = Object.values(zip.files);
+  if (entries.length > r.maxEntries)
+    throw r.fail(
+      `${r.label} package exceeds the ${r.maxEntries.toLocaleString("en-US")} part limit`,
+      r.maxEntries
+    );
+  let declared = 0;
+  for (const entry of entries) {
+    const original = entry.unsafeOriginalName;
+    if (!isSafePartName(entry.name) || original !== void 0 && !isSafePartName(original))
+      throw r.fail(`${r.label} package has an unsafe part name`, r.maxEntries);
+    if (entry.dir) continue;
+    const size = declaredEntrySize(entry);
+    if (size > r.maxEntryBytes)
+      throw r.fail(
+        `${r.label} part ${entry.name} exceeds the uncompressed part size limit`,
+        r.maxEntryBytes
+      );
+    declared += size;
+  }
+  if (declared > r.maxTotalBytes)
+    throw r.fail(
+      `${r.label} package exceeds the ${mib(r.maxTotalBytes)} MiB uncompressed content limit`,
+      r.maxTotalBytes
+    );
+  const produced = /* @__PURE__ */ new Map();
+  let total = 0;
+  for (const entry of entries) {
+    if (entry.dir) continue;
+    const inflateOriginal = entry.async.bind(entry);
+    entry.async = async (type, onUpdate) => {
+      const previous = produced.get(entry.name) ?? 0;
+      const bytes = await inflateEntryGuarded(entry, total - previous, limits);
+      if (bytes.byteLength > previous) {
+        total += bytes.byteLength - previous;
+        produced.set(entry.name, bytes.byteLength);
+      }
+      switch (type) {
+        case "uint8array":
+          return bytes;
+        case "string":
+        case "text":
+          return new TextDecoder("utf-8", { ignoreBOM: true }).decode(bytes);
+        case "arraybuffer":
+          return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+        case "base64":
+          return toBase64(bytes);
+        default:
+          return inflateOriginal(type, onUpdate);
+      }
+    };
+  }
+  return zip;
+}
+async function openZip(input, limits = {}) {
+  const r = resolveLimits(limits);
+  const maxInput = limits.maxInputBytes ?? DEFAULT_ZIP_LIMITS.maxInputBytes;
+  const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
+  if (bytes.byteLength > maxInput)
+    throw r.fail(
+      `${r.label} package exceeds the ${mib(maxInput)} MiB compressed input limit`,
+      maxInput
+    );
+  return guardZip(await JSZip__default.default.loadAsync(bytes), limits);
+}
+
+// pptx/core/core/types.ts
+var DEFAULT_MAX_UNCOMPRESSED_BYTES = 500 * 1024 * 1024;
+var MAX_ZIP_ENTRY_COUNT = 65536;
+var ZipBombError = class extends Error {
+  code = "ZIP_BOMB";
+  uncompressedBytes;
+  limit;
+  entryCount;
+  constructor(message, details) {
+    super(message);
+    this.name = "ZipBombError";
+    this.uncompressedBytes = details.uncompressedBytes;
+    this.limit = details.limit;
+    this.entryCount = details.entryCount;
+  }
+};
+
+// pptx/core/utils/zip-open.ts
+var createError = (message, details) => new ZipBombError(message, details);
+function openPptxZip(bytes) {
+  return openZip(bytes, {
+    label: "PPTX",
+    maxInputBytes: DEFAULT_MAX_UNCOMPRESSED_BYTES,
+    maxEntries: MAX_ZIP_ENTRY_COUNT,
+    maxEntryBytes: DEFAULT_MAX_UNCOMPRESSED_BYTES,
+    maxTotalBytes: DEFAULT_MAX_UNCOMPRESSED_BYTES,
+    createError
+  });
+}
+
+// pptx/signature-node/inspection.ts
 async function inspectPptxDigitalSignatures(data) {
   try {
-    const zip = await JSZip__default.default.loadAsync(Buffer.from(data));
+    const zip = await openPptxZip(Buffer.from(data));
     const signaturePaths = Object.keys(zip.files).filter(
       (entryPath) => entryPath.startsWith("_xmlsignatures/") && entryPath.endsWith(".xml")
     );
@@ -1235,7 +1512,7 @@ async function signPptxWithCertificate(data, certificateBuffer, options) {
       options.certificatePath,
       options.certificatePassword
     );
-    const zip = await JSZip__default.default.loadAsync(Buffer.from(data));
+    const zip = await openPptxZip(Buffer.from(data));
     for (const entryPath of Object.keys(zip.files)) {
       if (entryPath.startsWith("_xmlsignatures/")) {
         zip.remove(entryPath);

package/dist/pptx/signature-node/index.d.ts

@@ -91,11 +91,22 @@ export declare function evaluateTimestampAuthority(signatureXml: string): Promis
   error?: string;
 }>;
 //#endregion
+//#region pptx/signature-node/ocsp-network.d.ts
+/**
+ * Guarded HTTP POST for OCSP responders. Responder URLs come from the
+ * certificate's AIA extension, i.e. from the (untrusted) document, so the
+ * request must not become an SSRF primitive.
+ */
+interface OcspNetworkOptions {
+  /** Allow responders on loopback, link-local, private and metadata addresses. Default false. */
+  allowPrivateNetwork?: boolean;
+}
+//#endregion
 //#region pptx/signature-node/ocsp.d.ts
 export declare function extractOcspUrls(certPem: string): string[];
 export declare function buildOcspRequestDer(leafPem: string, issuerPem: string): Buffer | undefined;
 export declare function parseOcspResponseStatus(data: Buffer): CertificateRevocationStatus;
-export declare function evaluateCertificateRevocation(leafCertPem: string, issuerCertPem: string | undefined): Promise<{
+export declare function evaluateCertificateRevocation(leafCertPem: string, issuerCertPem: string | undefined, options?: OcspNetworkOptions): Promise<{
   status: CertificateRevocationStatus;
   error?: string;
   checkedOcspUrls: string[];

package/dist/pptx/signature-node/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../../pptx/signature-node/xml-canonicalization.ts","../../../pptx/signature-node/certificate-utils.ts","../../../pptx/signature-node/pki-validation.ts","../../../pptx/signature-node/ocsp.ts","../../../pptx/signature-node/environment.ts","../../../pptx/signature-node/reference-transforms.ts","../../../pptx/signature-node/reference-checks.ts","../../../pptx/signature-node/signing.ts","../../../pptx/signature-node/inspection.ts"],"mappings":";;;;;;;;;;;;;;;;;UAkBiB;WACP;EACT,KAAK,gBAAgB;GACpB,gBAAgB;GAChB,OAAO,aAAa,SAAS;;;UAId;WACP;WACA;WACA;WACA;IAAc,YAAY,OAAO,aAAa;;EACvD,aAAa;EACb,qBAAqB,oBAAoB;EACzC,uBAAuB,6BAA6B,oBAAoB;;;UAIxD;WACP,iBAAiB;EAC1B,qBAAqB,oBAAoB;EACzC,uBAAuB,6BAA6B,oBAAoB;;;wBAIzD,iBAAiB,MAAM;;;;;wBAavB,qCACf,QAAQ,cAAc,YACtB,oBACE;;;;;;;wBAqBa,iBAAiB,WAAW;;;;;wBAS5B,0BAA0B;;;;wBC3D1B,0BACf,qBACE;;;;wBAsEa,yBACf,0BACA;EAEA;EACA;;;;;;wBA8Ce,qBACf,sBACA;;;;wBAiDe,8BACf,mBAAmB,YACnB,yBACA,+BACE;;wBAmCa,uBAAuB;;;;wBC/NvB,kBAAkB;;wBAkBlB,sBAAsB;wBAqBhB,2BACrB,uBACE;EAAU,QAAQ;EAA0B;;;;wBC/B/B,gBAAgB;wBA2EhB,oBAAoB,iBAAiB,oBAAoB;wBA8DzD,wBAAwB,MAAM,SAAS;wBA8DjC,8BACrB,qBACA,oCACE;EACF,QAAQ;EACR;EACA;EACA;;;;;wBCzNe,+BAA+B;;;;;;;wBA8BzB,4BAA4B;;;;wBAqBlC,gCAAgC;;;;;;wBC3ChC,2BAA2B,eAAe,aAAa;;;;;wBAyEvD,yBACf,WAAW,YACX,YAAY,6BACV;;;;;;wBC9Ea,oBACf,SAAS,YACT;;;;wBAYqB,qCACrB,KAAK,OACL,uBACE,QAAQ;;;;wBAkGW,2CACrB,KAAK,OACL,uBACE,QAAQ;;;;;;;;;;wBCuBW,wBACrB,MAAM,YACN,mBAAmB,YACnB,SAAS,cACP,QAAQ;;;;;;;;;;;;;;;;wBCxHW,6BACrB,MAAM,aACJ,QAAQ"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../pptx/signature-node/xml-canonicalization.ts","../../../pptx/signature-node/certificate-utils.ts","../../../pptx/signature-node/pki-validation.ts","../../../pptx/signature-node/ocsp-network.ts","../../../pptx/signature-node/ocsp.ts","../../../pptx/signature-node/environment.ts","../../../pptx/signature-node/reference-transforms.ts","../../../pptx/signature-node/reference-checks.ts","../../../pptx/signature-node/signing.ts","../../../pptx/signature-node/inspection.ts"],"mappings":";;;;;;;;;;;;;;;;;UAkBiB;WACP;EACT,KAAK,gBAAgB;GACpB,gBAAgB;GAChB,OAAO,aAAa,SAAS;;;UAId;WACP;WACA;WACA;WACA;IAAc,YAAY,OAAO,aAAa;;EACvD,aAAa;EACb,qBAAqB,oBAAoB;EACzC,uBAAuB,6BAA6B,oBAAoB;;;UAIxD;WACP,iBAAiB;EAC1B,qBAAqB,oBAAoB;EACzC,uBAAuB,6BAA6B,oBAAoB;;;wBAIzD,iBAAiB,MAAM;;;;;wBAavB,qCACf,QAAQ,cAAc,YACtB,oBACE;;;;;;;wBAqBa,iBAAiB,WAAW;;;;;wBAS5B,0BAA0B;;;;wBC3D1B,0BACf,qBACE;;;;wBAsEa,yBACf,0BACA;EAEA;EACA;;;;;;wBA8Ce,qBACf,sBACA;;;;wBAiDe,8BACf,mBAAmB,YACnB,yBACA,+BACE;;wBAmCa,uBAAuB;;;;wBC/NvB,kBAAkB;;wBAkBlB,sBAAsB;wBAqBhB,2BACrB,uBACE;EAAU,QAAQ;EAA0B;;;;;;;;;UCrD9B;;EAEhB;;;;wBCmBe,gBAAgB;wBA0BhB,oBAAoB,iBAAiB,oBAAoB;wBA8DzD,wBAAwB,MAAM,SAAS;wBA8DjC,8BACrB,qBACA,mCACA,UAAS,qBACP;EACF,QAAQ;EACR;EACA;EACA;;;;;wBCxKe,+BAA+B;;;;;;;wBA8BzB,4BAA4B;;;;wBAqBlC,gCAAgC;;;;;;wBC3ChC,2BAA2B,eAAe,aAAa;;;;;wBAyEvD,yBACf,WAAW,YACX,YAAY,6BACV;;;;;;wBC9Ea,oBACf,SAAS,YACT;;;;wBAYqB,qCACrB,KAAK,OACL,uBACE,QAAQ;;;;wBAkGW,2CACrB,KAAK,OACL,uBACE,QAAQ;;;;;;;;;;wBCwBW,wBACrB,MAAM,YACN,mBAAmB,YACnB,SAAS,cACP,QAAQ;;;;;;;;;;;;;;;;wBCzHW,6BACrB,MAAM,aACJ,QAAQ"}