@antseed/antseed-verifier 0.1.0 → 0.1.1

package/dist/caps/tee-tdx.js

@@ -1,8 +1,13 @@
 import { claimId, computeReportData } from '../shared.js';
 import { generateTdxQuote } from '../collect/configfs.js';
-import { generateDstackQuote } from '../collect/dstack.js';
+import { generateDstackAttestation } from '../collect/dstack.js';
+import { composeHashFromEventLog, parseDstackEventLog, rtmr3Events } from '../dstack-event-log.js';
 import { collectViaHttp, collectTdxAndPubkey } from '../collect/http.js';
 import { antseedRdV1, verifyReportData } from '../report-data.js';
+import { checkAppCompose } from '../dstack-app-compose.js';
+import { checkConfidentialSpaceClaims, confidentialSpaceNonce, defaultVerifyConfidentialSpaceToken, } from '../confidential-space.js';
+import { isTcbAcceptable } from '../tcb-policy.js';
+import { generateConfidentialSpaceToken } from '../collect/confidential-space.js';
 /**
  * A genuine-Intel-TDX capability: proves a party runs in a genuine Intel TDX enclave.
  * It DCAP-verifies the quote (ECDSA sig + PCK chain to Intel's root + TCB), requires an
@@ -19,6 +24,11 @@ import { antseedRdV1, verifyReportData } from '../report-data.js';
 export const NODE_TEE_CAP_ID = 'seller-node-tee-genuine';
 /** The downstream inference provider's TEE (quote fetched from the provider's evidence route). */
 export const PROVIDER_TEE_CAP_ID = 'seller-provider-tee-genuine';
+/**
+ * Reported with a passing seller node claim: the https origins its measured config forwards
+ * prompts to, comma-separated. It describes the node claim and has no evidence of its own.
+ */
+export const NODE_UPSTREAMS_CLAIM = 'seller-node-upstreams';
 /**
  * Config-key convention: each TDX cap reads its own collector settings from `<capId>.<key>`
  * in the shared config map, so the node cap and the provider cap never collide. It lives in
@@ -27,29 +37,29 @@ export const PROVIDER_TEE_CAP_ID = 'seller-provider-tee-genuine';
 export function tdxConfigKey(id, key) {
     return `${id}.${key}`;
 }
-/**
- * TCB acceptance. UpToDate is always genuine hardware. SWHardeningNeeded flags guest-side
- * software mitigations only — not a hardware compromise — and is accepted by default (real
- * GCP TDX quotes often report it). Set ANTSEED_VERIFIER_STRICT_TCB=true to require UpToDate
- * exactly. Anything else (OutOfDate, Revoked, Unknown, ...) is rejected.
- */
-export function isTcbAcceptable(status) {
-    if (status === 'UpToDate')
-        return true;
-    if (status === 'SWHardeningNeeded')
-        return process.env['ANTSEED_VERIFIER_STRICT_TCB'] !== 'true';
-    return false;
+export { isTcbAcceptable } from '../tcb-policy.js';
+/** Node evidence from Google Confidential Space: Google's signed attestation token in place of a quote. */
+export function encodeConfidentialSpaceEvidence(token) {
+    return new TextEncoder().encode(JSON.stringify({ confidentialSpaceToken: token }));
 }
-export function encodeTeeTdxEvidence(quote, collateral, binding) {
+export function encodeTeeTdxEvidence(quote, collateral, binding, dstack) {
     const blob = {
         quote: Buffer.from(quote).toString('base64'),
         ...(collateral !== undefined ? { collateral } : {}),
         ...(binding !== undefined ? { binding } : {}),
+        ...(dstack?.eventLog !== undefined ? { eventLog: dstack.eventLog } : {}),
+        ...(dstack?.appCompose !== undefined ? { appCompose: dstack.appCompose } : {}),
     };
     return new TextEncoder().encode(JSON.stringify(blob));
 }
 export function decodeTeeTdxEvidence(bytes) {
-    const parsed = JSON.parse(new TextDecoder().decode(bytes));
+    return decodeTeeTdxEnvelope(JSON.parse(new TextDecoder().decode(bytes)));
+}
+/** Validate a parsed tee-tdx evidence envelope. */
+function decodeTeeTdxEnvelope(envelope) {
+    if (!envelope || typeof envelope !== 'object')
+        throw new Error('tee-tdx evidence is not an object');
+    const parsed = envelope;
     if (typeof parsed.quote !== 'string' || parsed.quote.length === 0) {
         throw new Error('tee-tdx evidence missing "quote"');
     }
@@ -57,10 +67,26 @@ export function decodeTeeTdxEvidence(bytes) {
     if (quote.length === 0) {
         throw new Error('tee-tdx evidence "quote" is not valid base64');
     }
+    let eventLog;
+    if (parsed.eventLog !== undefined) {
+        try {
+            if (!Array.isArray(parsed.eventLog))
+                throw new Error('not an array');
+            eventLog = parseDstackEventLog(parsed.eventLog);
+        }
+        catch {
+            throw new Error('tee-tdx evidence "eventLog" is not a dstack event log');
+        }
+    }
+    if (parsed.appCompose !== undefined && typeof parsed.appCompose !== 'string') {
+        throw new Error('tee-tdx evidence "appCompose" is not a string');
+    }
     return {
         quote,
         ...(parsed.collateral !== undefined ? { collateral: parsed.collateral } : {}),
         ...(parsed.binding !== undefined ? { binding: parsed.binding } : {}),
+        ...(eventLog !== undefined ? { eventLog } : {}),
+        ...(parsed.appCompose !== undefined ? { appCompose: parsed.appCompose } : {}),
     };
 }
 /**
@@ -96,20 +122,41 @@ export const defaultVerifyQuote = async (quote, collateral, nowSecs) => {
  * decode or verify errors are captured in `error`, so dependent caps still see the raw
  * `quoteEvidence` bytes (seller-bound only needs those to bind identity to the quote).
  */
-export async function verifyTdxEvidence(evidence, verifyQuote, nowSecs) {
+export async function verifyTdxEvidence(evidence, verifyQuote, nowSecs, verifyConfidentialSpaceToken = defaultVerifyConfidentialSpaceToken) {
+    let envelope;
+    try {
+        envelope = JSON.parse(new TextDecoder().decode(evidence));
+    }
+    catch (err) {
+        return { quoteEvidence: evidence, status: '', td: null, error: `malformed tee-tdx evidence: ${msg(err)}` };
+    }
+    const token = envelope && typeof envelope === 'object' ? envelope.confidentialSpaceToken : undefined;
+    if (typeof token === 'string') {
+        try {
+            return { quoteEvidence: evidence, status: '', td: null, confidentialSpace: await verifyConfidentialSpaceToken(token) };
+        }
+        catch (err) {
+            return { quoteEvidence: evidence, status: '', td: null, error: `Confidential Space token verification failed: ${msg(err)}` };
+        }
+    }
     let quote;
     let collateral;
     let binding;
+    let eventLog;
+    let appCompose;
     try {
         ;
-        ({ quote, collateral, binding } = decodeTeeTdxEvidence(evidence));
+        ({ quote, collateral, binding, eventLog, appCompose } = decodeTeeTdxEnvelope(envelope));
     }
     catch (err) {
         return { quoteEvidence: evidence, status: '', td: null, error: `malformed tee-tdx evidence: ${msg(err)}` };
     }
     try {
         const raw = await verifyQuote(quote, collateral, nowSecs);
-        return { quoteEvidence: evidence, status: raw.status, td: raw.td, ...(binding ? { binding } : {}) };
+        return {
+            quoteEvidence: evidence, status: raw.status, td: raw.td,
+            ...(binding ? { binding } : {}), ...(eventLog !== undefined ? { eventLog } : {}), ...(appCompose !== undefined ? { appCompose } : {}),
+        };
     }
     catch (err) {
         return { quoteEvidence: evidence, status: '', td: null, ...(binding ? { binding } : {}), error: `quote verification failed: ${msg(err)}` };
@@ -121,12 +168,52 @@ function msg(err) {
 function hex(b) {
     return Buffer.from(b).toString('hex');
 }
+/**
+ * The approved build this quote runs: MRTD and RTMR0-2 must be an approved dstack OS, and the app
+ * compose measured into RTMR3 (replayed from the event log) must run an approved seller image under
+ * the compose rules. Returns the OS, image and upstreams, or why the build is not approved.
+ */
+function approvedBuild(approved, td, eventLog, appCompose) {
+    const base = [td.mrTd, td.rtMr0, td.rtMr1, td.rtMr2].map(hex);
+    const os = approved.os.find((m) => [m.mrtd, m.rtmr0, m.rtmr1, m.rtmr2].every((v, i) => v.toLowerCase() === base[i]));
+    if (!os)
+        return { error: `the CVM OS (MRTD ${base[0].slice(0, 16)}…) is not an approved dstack release` };
+    if (eventLog === undefined)
+        return { error: 'seller sent no dstack event log' };
+    const replay = composeHashFromEventLog(eventLog, td.rtMr3);
+    if ('error' in replay)
+        return replay;
+    if (appCompose === undefined)
+        return { error: 'seller sent no app compose' };
+    const app = checkAppCompose(appCompose, replay.composeHash, approved.images);
+    return 'error' in app ? app : { os, ...app };
+}
+/** The node claim (and its upstreams) for Google Confidential Space evidence: a verified token, checked for this round. */
+function verifyConfidentialSpaceNode(claim, input, claims) {
+    const channelBinding = input.channelBinding;
+    if (!channelBinding) {
+        return { claim, ok: false, detail: 'no connection binding: TEE attestation needs an encrypted TCP connection to the seller' };
+    }
+    // The token's nonce commits to this round's antseed-rd-v1 report data, connection included.
+    const nonce = confidentialSpaceNonce(computeReportData(input.nonce, input.peerId, channelBinding));
+    const images = input.policy?.images ?? [];
+    const checked = checkConfidentialSpaceClaims(claims, nonce, images);
+    if ('error' in checked) {
+        return { claim, ok: false, detail: `Google Confidential Space attestation, but not an approved TEE seller build: ${checked.error}` };
+    }
+    const origins = [...new Set(checked.upstreams.map((u) => u.origin))].sort();
+    return [
+        { claim, ok: true, detail: `Intel TDX on Google Confidential Space (attested by Google); Antseed TEE seller image ${checked.image.version}, bound to this connection; bound to this round (${antseedRdV1.id})` },
+        { claim: claimId(NODE_UPSTREAMS_CLAIM), ok: true, detail: origins.join(', ') },
+    ];
+}
 /**
  * Mint one TDX capability. `id` names the target (node or provider); `defaultSource`
  * is the collector used when config supplies no `<id>.source` override:
- *   'configfs': self-hosted TDX minted locally via configfs-tsm; report_data = antseed-rd-v1 {peerId}
+ *   'configfs': self-hosted TDX minted locally via configfs-tsm; report_data = antseed-rd-v1
+ *               {peerId, channelBinding} for seller-node attestations
  *   'dstack'  : self-hosted TDX minted via the dstack guest-agent socket (Phala CVMs, where
- *               configfs-tsm is absent); same antseed-rd-v1 {peerId} report_data as configfs
+ *               configfs-tsm is absent); the same binding, plus the event log and app compose
  *   'http'    : a pre-made quote fetched from a config-supplied evidence route ({nonce} hex)
  * verify reads this cap's own parsed quote (the orchestrator DCAP-verifies each cap's
  * own evidence entry independently). collect throws when its source is unavailable
@@ -144,18 +231,38 @@ export function makeTdxCap(id, defaultSource, opts) {
                 return { claim, ok: false, detail: 'TDX quote was not verified' };
             if (p.error)
                 return { claim, ok: false, detail: p.error };
+            if (p.confidentialSpace) {
+                if (!opts?.sellerNode)
+                    return { claim, ok: false, detail: 'a Confidential Space token is only accepted for the seller node' };
+                return verifyConfidentialSpaceNode(claim, input, p.confidentialSpace);
+            }
             if (!isTcbAcceptable(p.status))
                 return { claim, ok: false, detail: `TCB status not acceptable: ${p.status || 'unknown'}` };
             if (!p.td)
                 return { claim, ok: false, detail: 'quote is not an Intel TDX quote' };
             if (p.td.debug === true)
                 return { claim, ok: false, detail: 'TDX debug mode is enabled' };
-            // Bind report_data to this round: the node cap to its {peerId} identity, a provider cap
-            // to whatever frozen scheme its evidence declares. Fail-closed — a borrowed, relayed, or
+            // The seller node must also run an approved build and answer on the buyer's own connection:
+            // the quote commits to that connection's session hash, so it was minted by the approved
+            // build terminating this connection, not relayed from another machine.
+            let build;
+            const channelBinding = input.channelBinding;
+            if (opts?.sellerNode) {
+                if (!channelBinding) {
+                    return { claim, ok: false, detail: 'no connection binding: TEE attestation needs an encrypted TCP connection to the seller' };
+                }
+                const match = approvedBuild(input.policy ?? { os: [], images: [] }, p.td, p.eventLog, p.appCompose);
+                if ('error' in match) {
+                    return { claim, ok: false, detail: `genuine Intel TDX hardware, but not an approved TEE seller build: ${match.error}` };
+                }
+                build = match;
+            }
+            // Bind report_data to this round: the node cap to its {peerId, channelBinding}, a provider
+            // cap to whatever frozen scheme its evidence declares. Fail-closed — a borrowed, relayed, or
             // stale quote cannot match a fresh-nonce commitment. A provider quote with no declared
             // scheme still passes on genuineness, but its detail must disclose that freshness was not proven.
-            const binding = opts?.bindNoncePeerId
-                ? { scheme: antseedRdV1.id, ingredients: { peerId: input.peerId } }
+            const binding = opts?.sellerNode
+                ? { scheme: antseedRdV1.id, ingredients: { peerId: input.peerId, ...(channelBinding ? { channelBinding } : {}) } }
                 : p.binding;
             if (binding) {
                 const bad = verifyReportData(binding.scheme, p.td.reportData, input.nonce, binding.ingredients);
@@ -165,22 +272,35 @@ export function makeTdxCap(id, defaultSource, opts) {
             const freshness = binding
                 ? `bound to this round (${binding.scheme})`
                 : 'freshness/instance binding NOT verified (no report_data scheme declared)';
-            return {
-                claim,
-                ok: true,
-                detail: `genuine Intel TDX quote (TCB ${p.status}); MRTD ${hex(p.td.mrTd).slice(0, 16)}…; ${freshness}`,
-            };
+            const scope = build
+                ? `Antseed TEE seller image ${build.image.version} on ${build.os.name}, bound to this connection`
+                : `MRTD ${hex(p.td.mrTd).slice(0, 16)}…`;
+            const result = { claim, ok: true, detail: `genuine Intel TDX quote (TCB ${p.status}); ${scope}; ${freshness}` };
+            if (!build)
+                return result;
+            const origins = [...new Set(build.upstreams.map((u) => u.origin))].sort();
+            return [result, { claim: claimId(NODE_UPSTREAMS_CLAIM), ok: true, detail: origins.join(', ') }];
         },
         async collect(input) {
             const source = input.config[tdxConfigKey(id, 'source')] ?? defaultSource;
+            const channelBinding = input.config[tdxConfigKey(id, 'channelBinding')] || undefined;
             if (source === 'configfs') {
-                const quote = generateTdxQuote(computeReportData(input.nonce, input.peerId));
+                const quote = generateTdxQuote(computeReportData(input.nonce, input.peerId, channelBinding));
                 return encodeTeeTdxEvidence(quote);
             }
+            if (source === 'confidential-space') {
+                const socket = input.config[tdxConfigKey(id, 'confidentialSpace.socket')] || undefined;
+                const nonce = confidentialSpaceNonce(computeReportData(input.nonce, input.peerId, channelBinding));
+                return encodeConfidentialSpaceEvidence(await generateConfidentialSpaceToken(nonce, socket));
+            }
             if (source === 'dstack') {
                 const socket = input.config[tdxConfigKey(id, 'dstack.socket')] || undefined;
-                const quote = await generateDstackQuote(computeReportData(input.nonce, input.peerId), socket);
-                return encodeTeeTdxEvidence(quote);
+                const { quote, eventLog, appCompose } = await generateDstackAttestation(computeReportData(input.nonce, input.peerId, channelBinding), socket);
+                // Only the RTMR3 events: the buyer replays them to the app's compose hash, then checks the compose.
+                return encodeTeeTdxEvidence(quote, undefined, undefined, {
+                    ...(eventLog ? { eventLog: rtmr3Events(eventLog) } : {}),
+                    ...(appCompose ? { appCompose } : {}),
+                });
             }
             if (source === 'http') {
                 const url = input.config[tdxConfigKey(id, 'url')];
@@ -199,12 +319,15 @@ export function makeTdxCap(id, defaultSource, opts) {
                 const ingredients = pubkey ? { e2ePubkey: pubkey } : {};
                 return encodeTeeTdxEvidence(quote, undefined, { scheme, ingredients });
             }
-            throw new Error(`unknown ${id} source "${source}" (expected "configfs", "dstack", or "http")`);
+            throw new Error(`unknown ${id} source "${source}" (expected "configfs", "dstack", "confidential-space", or "http")`);
         },
     };
 }
-/** The AntSeed seller node's own TEE — mints its quote locally via configfs; report_data bound to nonce+peerId. */
-export const nodeTeeCapability = makeTdxCap(NODE_TEE_CAP_ID, 'configfs', { bindNoncePeerId: true });
+/**
+ * The AntSeed seller node's own TEE — mints its quote locally via configfs; report_data bound to
+ * nonce + peerId + the buyer's connection, and the TD measurement must be an approved build.
+ */
+export const nodeTeeCapability = makeTdxCap(NODE_TEE_CAP_ID, 'configfs', { sellerNode: true });
 /** The downstream inference provider's TEE — quote fetched from the provider's evidence route. */
 export const providerTeeCapability = makeTdxCap(PROVIDER_TEE_CAP_ID, 'http');
 //# sourceMappingURL=tee-tdx.js.map

package/dist/caps/tee-tdx.js.map

@@ -1 +1 @@
-{"version":3,"file":"tee-tdx.js","sourceRoot":"","sources":["../../src/caps/tee-tdx.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAA2B,MAAM,mBAAmB,CAAA;AAQ1F;;;;;;;;;;;GAWG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,yBAAyB,CAAA;AACxD,kGAAkG;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAG,6BAA6B,CAAA;AAEhE;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,EAAU,EAAE,GAAW;IAClD,OAAO,GAAG,EAAE,IAAI,GAAG,EAAE,CAAA;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,IAAI,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAA;IACtC,IAAI,MAAM,KAAK,mBAAmB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,KAAK,MAAM,CAAA;IAChG,OAAO,KAAK,CAAA;AACd,CAAC;AAkDD,MAAM,UAAU,oBAAoB,CAAC,KAAiB,EAAE,UAAoB,EAAE,OAA2B;IACvG,MAAM,IAAI,GAAmB;QAC3B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5C,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAA;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AACvD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAiB;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAA4B,CAAA;IACrF,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAA;IACjE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IACD,OAAO;QACL,KAAK;QACL,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAkB,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;IAEpF,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAA8B,CAAA;IAC1E,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAA;IAC/B,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS;QACvC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,UAAmB,EAAE,OAAO,CAAC;QAC/D,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACzD,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;IACnC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IACrD,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,EAAE,EAAE;YACF,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;SAC9E;KACF,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAoB,EACpB,WAA0B,EAC1B,OAAe;IAEf,IAAI,KAAiB,CAAA;IACrB,IAAI,UAAmB,CAAA;IACvB,IAAI,OAAsC,CAAA;IAC1C,IAAI,CAAC;QACH,CAAC;QAAA,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAA;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,+BAA+B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;IAC5G,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;QACzD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IACrG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,8BAA8B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;IAC5I,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,GAAG,CAAC,CAAa;IACxB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACvC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CACxB,EAAU,EACV,aAAkC,EAClC,IAAoC;IAEpC,OAAO;QACL,EAAE;QAEF,MAAM,CAAC,KAA4B;YACjC,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC,CAAA;YACzB,IAAI,CAAC,KAAK,CAAC,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAA;YACxF,MAAM,CAAC,GAAG,KAAK,CAAC,WAAyC,CAAA;YACzD,IAAI,CAAC,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAA;YACzE,IAAI,CAAC,CAAC,KAAK;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;YACzD,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,CAAC,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,CAAA;YAC1H,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAA;YACjF,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAA;YACzF,wFAAwF;YACxF,yFAAyF;YACzF,uFAAuF;YACvF,kGAAkG;YAClG,MAAM,OAAO,GAAkC,IAAI,EAAE,eAAe;gBAClE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE;gBACnE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;YACb,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;gBAC/F,IAAI,GAAG;oBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;YACnD,CAAC;YACD,MAAM,SAAS,GAAG,OAAO;gBACvB,CAAC,CAAC,wBAAwB,OAAO,CAAC,MAAM,GAAG;gBAC3C,CAAC,CAAC,0EAA0E,CAAA;YAC9E,OAAO;gBACL,KAAK;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,gCAAgC,CAAC,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,SAAS,EAAE;aACxG,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAA6B;YACzC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,IAAI,aAAa,CAAA;YACxE,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;gBAC5E,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAA;YACpC,CAAC;YACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC,IAAI,SAAS,CAAA;gBAC3E,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;gBAC7F,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAA;YACpC,CAAC;YACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAA;gBACjD,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAA;gBACpF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI,OAAO,CAAA;gBAChE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAA;gBAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,oBAAoB,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;gBAC5E,CAAC;gBACD,qFAAqF;gBACrF,uFAAuF;gBACvF,uFAAuF;gBACvF,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAA;gBACzE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAA;gBACzF,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;gBACvD,OAAO,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;YACxE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,YAAY,MAAM,8CAA8C,CAAC,CAAA;QAChG,CAAC;KACF,CAAA;AACH,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,eAAe,EAAE,UAAU,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAA;AACnG,kGAAkG;AAClG,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAA"}
+{"version":3,"file":"tee-tdx.js","sourceRoot":"","sources":["../../src/caps/tee-tdx.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,WAAW,EAAoB,MAAM,wBAAwB,CAAA;AACpH,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAA2B,MAAM,mBAAmB,CAAA;AAE1F,OAAO,EAAE,eAAe,EAA0B,MAAM,0BAA0B,CAAA;AAElF,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,mCAAmC,GAEpC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAA;AAQjF;;;;;;;;;;;GAWG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,yBAAyB,CAAA;AACxD,kGAAkG;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAG,6BAA6B,CAAA;AAChE;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAA;AAE3D;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,EAAU,EAAE,GAAW;IAClD,OAAO,GAAG,EAAE,IAAI,GAAG,EAAE,CAAA;AACvB,CAAC;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAiDlD,2GAA2G;AAC3G,MAAM,UAAU,+BAA+B,CAAC,KAAa;IAC3D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;AACpF,CAAC;AAcD,MAAM,UAAU,oBAAoB,CAClC,KAAiB,EACjB,UAAoB,EACpB,OAA2B,EAC3B,MAA0D;IAE1D,MAAM,IAAI,GAAmB;QAC3B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5C,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,MAAM,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAA;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AACvD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAiB;IACpD,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC1E,CAAC;AAED,mDAAmD;AACnD,SAAS,oBAAoB,CAAC,QAAiB;IAC7C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACnG,MAAM,MAAM,GAAG,QAAmC,CAAA;IAClD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAA;IACjE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,QAAmC,CAAA;IACvC,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;YACpE,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QAC1E,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,OAAO;QACL,KAAK;QACL,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAkB,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;IAEpF,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAA8B,CAAA;IAC1E,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAA;IAC/B,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS;QACvC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,UAAmB,EAAE,OAAO,CAAC;QAC/D,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACzD,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;IACnC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IACrD,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,EAAE,EAAE;YACF,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;SAC9E;KACF,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAoB,EACpB,WAA0B,EAC1B,OAAe,EACf,+BAA+D,mCAAmC;IAElG,IAAI,QAAiB,CAAA;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,+BAA+B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;IAC5G,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAiD,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9I,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAA;QACxH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,iDAAiD,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;QAC9H,CAAC;IACH,CAAC;IACD,IAAI,KAAiB,CAAA;IACrB,IAAI,UAAmB,CAAA;IACvB,IAAI,OAAsC,CAAA;IAC1C,IAAI,QAAmC,CAAA;IACvC,IAAI,UAA8B,CAAA;IAClC,IAAI,CAAC;QACH,CAAC;QAAA,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,+BAA+B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;IAC5G,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;QACzD,OAAO;YACL,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE;YACvD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtI,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,8BAA8B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;IAC5I,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,GAAG,CAAC,CAAa;IACxB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CACpB,QAA4B,EAC5B,EAAkB,EAClB,QAAmC,EACnC,UAA8B;IAE9B,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC7D,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACpH,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,IAAI,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,sCAAsC,EAAE,CAAA;IAC1G,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAA;IAC/E,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,CAAA;IAC1D,IAAI,OAAO,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACpC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAA;IAC5E,MAAM,GAAG,GAAG,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC5E,OAAO,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,CAAA;AAC9C,CAAC;AAED,2HAA2H;AAC3H,SAAS,2BAA2B,CAAC,KAAa,EAAE,KAA4B,EAAE,MAAkB;IAClG,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAA;IAC3C,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wFAAwF,EAAE,CAAA;IAC/H,CAAC;IACD,4FAA4F;IAC5F,MAAM,KAAK,GAAG,sBAAsB,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;IAClG,MAAM,MAAM,GAAI,KAAK,CAAC,MAAyC,EAAE,MAAM,IAAI,EAAE,CAAA;IAC7E,MAAM,OAAO,GAAG,4BAA4B,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;IACnE,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gFAAgF,OAAO,CAAC,KAAK,EAAE,EAAE,CAAA;IACtI,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC3E,OAAO;QACL,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,yFAAyF,OAAO,CAAC,KAAK,CAAC,OAAO,oDAAoD,WAAW,CAAC,EAAE,GAAG,EAAE;QAChN,EAAE,KAAK,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KAC/E,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,UAAU,CACxB,EAAU,EACV,aAAkC,EAClC,IAA+B;IAE/B,OAAO;QACL,EAAE;QAEF,MAAM,CAAC,KAA4B;YACjC,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC,CAAA;YACzB,IAAI,CAAC,KAAK,CAAC,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAA;YACxF,MAAM,CAAC,GAAG,KAAK,CAAC,WAAyC,CAAA;YACzD,IAAI,CAAC,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAA;YACzE,IAAI,CAAC,CAAC,KAAK;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;YACzD,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,EAAE,UAAU;oBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAA;gBAC7H,OAAO,2BAA2B,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAA;YACvE,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,CAAC,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,CAAA;YAC1H,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAA;YACjF,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAA;YACzF,4FAA4F;YAC5F,wFAAwF;YACxF,uEAAuE;YACvE,IAAI,KAAiE,CAAA;YACrE,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAA;YAC3C,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC;gBACrB,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wFAAwF,EAAE,CAAA;gBAC/H,CAAC;gBACD,MAAM,KAAK,GAAG,aAAa,CAAE,KAAK,CAAC,MAAyC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;gBACvI,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;oBACrB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qEAAqE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;gBACzH,CAAC;gBACD,KAAK,GAAG,KAAK,CAAA;YACf,CAAC;YACD,2FAA2F;YAC3F,6FAA6F;YAC7F,uFAAuF;YACvF,kGAAkG;YAClG,MAAM,OAAO,GAAkC,IAAI,EAAE,UAAU;gBAC7D,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBAClH,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;YACb,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;gBAC/F,IAAI,GAAG;oBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;YACnD,CAAC;YACD,MAAM,SAAS,GAAG,OAAO;gBACvB,CAAC,CAAC,wBAAwB,OAAO,CAAC,MAAM,GAAG;gBAC3C,CAAC,CAAC,0EAA0E,CAAA;YAC9E,MAAM,KAAK,GAAG,KAAK;gBACjB,CAAC,CAAC,4BAA4B,KAAK,CAAC,KAAK,CAAC,OAAO,OAAO,KAAK,CAAC,EAAE,CAAC,IAAI,4BAA4B;gBACjG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAA;YAC1C,MAAM,MAAM,GAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,gCAAgC,CAAC,CAAC,MAAM,MAAM,KAAK,KAAK,SAAS,EAAE,EAAE,CAAA;YAC5H,IAAI,CAAC,KAAK;gBAAE,OAAO,MAAM,CAAA;YACzB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACzE,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACjG,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAA6B;YACzC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,IAAI,aAAa,CAAA;YACxE,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC,IAAI,SAAS,CAAA;YACpF,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;gBAC5F,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAA;YACpC,CAAC;YACD,IAAI,MAAM,KAAK,oBAAoB,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,0BAA0B,CAAC,CAAC,IAAI,SAAS,CAAA;gBACtF,MAAM,KAAK,GAAG,sBAAsB,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;gBAClG,OAAO,+BAA+B,CAAC,MAAM,8BAA8B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;YAC7F,CAAC;YACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC,IAAI,SAAS,CAAA;gBAC3E,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,yBAAyB,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAA;gBAC7I,oGAAoG;gBACpG,OAAO,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE;oBACvD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtC,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAA;gBACjD,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAA;gBACpF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI,OAAO,CAAA;gBAChE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAA;gBAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,oBAAoB,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;gBAC5E,CAAC;gBACD,qFAAqF;gBACrF,uFAAuF;gBACvF,uFAAuF;gBACvF,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAA;gBACzE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAA;gBACzF,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;gBACvD,OAAO,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;YACxE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,YAAY,MAAM,oEAAoE,CAAC,CAAA;QACtH,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,eAAe,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;AAC9F,kGAAkG;AAClG,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAA"}

package/dist/collect/confidential-space.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Confidential Space collector: asks the container launcher for a Google attestation token
+ * carrying `nonce` (the round's binding). The launcher mounts its socket into the workload
+ * container; it throws when the socket is absent, so the prover omits the capability elsewhere.
+ *
+ * Wire contract (POST http://localhost/v1/token over the socket):
+ *   request  { "audience": "antseed-verifier", "token_type": "OIDC", "nonces": ["<nonce>"] }
+ *   response the signed token (JWT text)
+ */
+export declare const CS_LAUNCHER_SOCKET = "/run/container_launcher/teeserver.sock";
+export declare function generateConfidentialSpaceToken(nonce: string, socketPath?: string): Promise<string>;
+//# sourceMappingURL=confidential-space.d.ts.map

package/dist/collect/confidential-space.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confidential-space.d.ts","sourceRoot":"","sources":["../../src/collect/confidential-space.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,2CAA2C,CAAA;AAE1E,wBAAsB,8BAA8B,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,SAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAMpH"}

package/dist/collect/confidential-space.js

@@ -0,0 +1,22 @@
+import { CS_AUDIENCE } from '../confidential-space.js';
+import { postUnix } from './unix-http.js';
+/**
+ * Confidential Space collector: asks the container launcher for a Google attestation token
+ * carrying `nonce` (the round's binding). The launcher mounts its socket into the workload
+ * container; it throws when the socket is absent, so the prover omits the capability elsewhere.
+ *
+ * Wire contract (POST http://localhost/v1/token over the socket):
+ *   request  { "audience": "antseed-verifier", "token_type": "OIDC", "nonces": ["<nonce>"] }
+ *   response the signed token (JWT text)
+ */
+export const CS_LAUNCHER_SOCKET = '/run/container_launcher/teeserver.sock';
+export async function generateConfidentialSpaceToken(nonce, socketPath = CS_LAUNCHER_SOCKET) {
+    const body = JSON.stringify({ audience: CS_AUDIENCE, token_type: 'OIDC', nonces: [nonce] });
+    const { status, body: token } = await postUnix(socketPath, '/v1/token', body);
+    if (status !== 200)
+        throw new Error(`Confidential Space token request returned HTTP ${status}: ${token.slice(0, 200)}`);
+    if (!/^[\w-]+\.[\w-]+\.[\w-]+$/.test(token.trim()))
+        throw new Error('Confidential Space token response is not a JWT');
+    return token.trim();
+}
+//# sourceMappingURL=confidential-space.js.map

package/dist/collect/confidential-space.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confidential-space.js","sourceRoot":"","sources":["../../src/collect/confidential-space.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEzC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,wCAAwC,CAAA;AAE1E,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAAa,EAAE,UAAU,GAAG,kBAAkB;IACjG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC3F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;IAC7E,IAAI,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IACvH,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACrH,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;AACrB,CAAC"}

package/dist/collect/dstack.d.ts

@@ -5,4 +5,14 @@
  * this source" and omits the capability, like configfs off-TEE.
  */
 export declare function generateDstackQuote(reportData: Uint8Array, socketPath?: string): Promise<Uint8Array>;
+/**
+ * The quote plus what a buyer needs to check the app it measured: the agent's event log (a JSON
+ * string), which replays RTMR3 to the app's compose hash, and the app-compose.json that hash
+ * covers. Either is undefined when the agent does not return it.
+ */
+export declare function generateDstackAttestation(reportData: Uint8Array, socketPath?: string): Promise<{
+    quote: Uint8Array;
+    eventLog?: string;
+    appCompose?: string;
+}>;
 //# sourceMappingURL=dstack.d.ts.map

package/dist/collect/dstack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dstack.d.ts","sourceRoot":"","sources":["../../src/collect/dstack.ts"],"names":[],"mappings":"AAmDA;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAyB1G"}
+{"version":3,"file":"dstack.d.ts","sourceRoot":"","sources":["../../src/collect/dstack.ts"],"names":[],"mappings":"AA4BA;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAE1G;AAeD;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,UAAU,EACtB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA2BxE"}

package/dist/collect/dstack.js

@@ -1,4 +1,4 @@
-import { request } from 'node:http';
+import { postUnix } from './unix-http.js';
 /**
  * dstack collector: it mints a TDX quote via the dstack guest-agent unix socket. This is the
  * canonical quoting path inside dstack CVMs (e.g. Phala), where the Linux configfs-tsm
@@ -6,13 +6,13 @@ import { request } from 'node:http';
  * raw (no hashing, max 64 bytes). The quote's report_data is then byte-identical to the configfs
  * path, and the buyer verifies it unchanged.
  *
- * Wire contract (POST http://dstack/GetQuote over the socket):
- *   request  { "report_data": "<hex, <=64 bytes>" }
- *   response { "quote": "<hex>", "event_log": ..., ... }
+ * Wire contract (POST over the socket):
+ *   /GetQuote  request { "report_data": "<hex, <=64 bytes>" }  response { "quote": "<hex>", "event_log": "<json>", ... }
+ *   /Info      request {}  response { "tcb_info": "<json with app_compose>", ... }
  */
 /** Default guest-agent socket locations, tried in order (mirrors @phala/dstack-sdk). */
 const DEFAULT_DSTACK_SOCKETS = ['/var/run/dstack.sock', '/run/dstack.sock'];
-const DSTACK_TIMEOUT_MS = 20_000;
+const DSTACK_REQUEST = { timeoutMs: 20_000, timeoutMessage: 'dstack request timed out' };
 function msg(err) {
     return err instanceof Error ? err.message : String(err);
 }
@@ -21,25 +21,6 @@ function isConnError(err) {
     const code = err?.code;
     return code === 'ENOENT' || code === 'ECONNREFUSED' || code === 'EACCES';
 }
-/** POST JSON to a unix-socket HTTP server and read the whole response body. */
-function postUnix(socketPath, path, body) {
-    return new Promise((resolve, reject) => {
-        const req = request({
-            socketPath,
-            path,
-            method: 'POST',
-            headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body) },
-            timeout: DSTACK_TIMEOUT_MS,
-        }, (res) => {
-            const chunks = [];
-            res.on('data', (c) => chunks.push(c));
-            res.on('end', () => resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString('utf8') }));
-        });
-        req.on('error', reject);
-        req.on('timeout', () => req.destroy(new Error('dstack request timed out')));
-        req.end(body);
-    });
-}
 /**
  * Generate a raw Intel TDX quote bound to `reportData` (64 bytes) via the dstack guest agent.
  * `socketPath` overrides the default locations (e.g. a custom mount or the dstack simulator).
@@ -47,6 +28,28 @@ function postUnix(socketPath, path, body) {
  * this source" and omits the capability, like configfs off-TEE.
  */
 export async function generateDstackQuote(reportData, socketPath) {
+    return (await generateDstackAttestation(reportData, socketPath)).quote;
+}
+/** The app-compose.json the CVM was measured with (tcb_info.app_compose of the agent's Info), if available. */
+async function readAppCompose(socketPath) {
+    try {
+        const { status, body } = await postUnix(socketPath, '/Info', '{}', DSTACK_REQUEST);
+        if (status !== 200)
+            return undefined;
+        const info = JSON.parse(body);
+        const tcb = (typeof info.tcb_info === 'string' ? JSON.parse(info.tcb_info) : info.tcb_info);
+        return typeof tcb?.app_compose === 'string' && tcb.app_compose.length > 0 ? tcb.app_compose : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The quote plus what a buyer needs to check the app it measured: the agent's event log (a JSON
+ * string), which replays RTMR3 to the app's compose hash, and the app-compose.json that hash
+ * covers. Either is undefined when the agent does not return it.
+ */
+export async function generateDstackAttestation(reportData, socketPath) {
     if (reportData.length !== 64) {
         throw new Error(`reportData must be 64 bytes, got ${reportData.length}`);
     }
@@ -55,7 +58,7 @@ export async function generateDstackQuote(reportData, socketPath) {
     let lastErr;
     for (const sock of candidates) {
         try {
-            const { status, body: resp } = await postUnix(sock, '/GetQuote', body);
+            const { status, body: resp } = await postUnix(sock, '/GetQuote', body, DSTACK_REQUEST);
             if (status !== 200)
                 throw new Error(`dstack GetQuote returned HTTP ${status}`);
             const parsed = JSON.parse(resp);
@@ -65,7 +68,9 @@ export async function generateDstackQuote(reportData, socketPath) {
             const quote = Buffer.from(parsed.quote.replace(/^0x/, ''), 'hex');
             if (quote.length === 0)
                 throw new Error('dstack GetQuote "quote" is not valid hex');
-            return new Uint8Array(quote);
+            const eventLog = typeof parsed.event_log === 'string' && parsed.event_log.length > 0 ? parsed.event_log : undefined;
+            const appCompose = await readAppCompose(sock);
+            return { quote: new Uint8Array(quote), ...(eventLog ? { eventLog } : {}), ...(appCompose ? { appCompose } : {}) };
         }
         catch (err) {
             lastErr = err;

package/dist/collect/dstack.js.map

@@ -1 +1 @@
-{"version":3,"file":"dstack.js","sourceRoot":"","sources":["../../src/collect/dstack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC;;;;;;;;;;GAUG;AAEH,wFAAwF;AACxF,MAAM,sBAAsB,GAAG,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,CAAA;AAC3E,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAEhC,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAED,kGAAkG;AAClG,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,IAAI,GAAI,GAAqC,EAAE,IAAI,CAAA;IACzD,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,QAAQ,CAAA;AAC1E,CAAC;AAED,+EAA+E;AAC/E,SAAS,QAAQ,CAAC,UAAkB,EAAE,IAAY,EAAE,IAAY;IAC9D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,OAAO,CACjB;YACE,UAAU;YACV,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;YAC1F,OAAO,EAAE,iBAAiB;SAC3B,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC,CAAA;YAC/C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;QAC7G,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAA;QAC3E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAsB,EAAE,UAAmB;IACnF,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACrF,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAA;IACrE,IAAI,OAAgB,CAAA;IACpB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;YACtE,IAAI,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAA;YAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAA;YACrD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;YAC7D,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;YACjE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;YACnF,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,GAAG,CAAA;YACb,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,SAAQ,CAAC,oDAAoD;YACnF,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAClG,CAAC"}
+{"version":3,"file":"dstack.js","sourceRoot":"","sources":["../../src/collect/dstack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEzC;;;;;;;;;;GAUG;AAEH,wFAAwF;AACxF,MAAM,sBAAsB,GAAG,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,CAAA;AAC3E,MAAM,cAAc,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAA;AAExF,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAED,kGAAkG;AAClG,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,IAAI,GAAI,GAAqC,EAAE,IAAI,CAAA;IACzD,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,QAAQ,CAAA;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAsB,EAAE,UAAmB;IACnF,OAAO,CAAC,MAAM,yBAAyB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAA;AACxE,CAAC;AAED,+GAA+G;AAC/G,KAAK,UAAU,cAAc,CAAC,UAAkB;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;QAClF,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAA;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAA;QACvD,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAA0C,CAAA;QACpI,OAAO,OAAO,GAAG,EAAE,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAA;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,UAAsB,EACtB,UAAmB;IAEnB,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACrF,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAA;IACrE,IAAI,OAAgB,CAAA;IACpB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;YACtF,IAAI,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAA;YAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4C,CAAA;YAC1E,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;YAC7D,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;YACjE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;YACnF,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;YACnH,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAA;YAC7C,OAAO,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;QACnH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,GAAG,CAAA;YACb,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,SAAQ,CAAC,oDAAoD;YACnF,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAClG,CAAC"}

package/dist/collect/unix-http.d.ts

@@ -0,0 +1,9 @@
+/** POST JSON to a unix-socket HTTP server and read the whole response body. */
+export declare function postUnix(socketPath: string, path: string, body: string, { timeoutMs, timeoutMessage }?: {
+    timeoutMs?: number;
+    timeoutMessage?: string;
+}): Promise<{
+    status: number;
+    body: string;
+}>;
+//# sourceMappingURL=unix-http.d.ts.map

package/dist/collect/unix-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unix-http.d.ts","sourceRoot":"","sources":["../../src/collect/unix-http.ts"],"names":[],"mappings":"AAEA,+EAA+E;AAC/E,wBAAgB,QAAQ,CACtB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,EAAE,SAAkB,EAAE,cAAgD,EAAE,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7H,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAoB3C"}

package/dist/collect/unix-http.js

@@ -0,0 +1,21 @@
+import { request } from 'node:http';
+/** POST JSON to a unix-socket HTTP server and read the whole response body. */
+export function postUnix(socketPath, path, body, { timeoutMs = 20_000, timeoutMessage = 'unix socket request timed out' } = {}) {
+    return new Promise((resolve, reject) => {
+        const req = request({
+            socketPath,
+            path,
+            method: 'POST',
+            headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body) },
+            timeout: timeoutMs,
+        }, (res) => {
+            const chunks = [];
+            res.on('data', (c) => chunks.push(c));
+            res.on('end', () => resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString('utf8') }));
+        });
+        req.on('error', reject);
+        req.on('timeout', () => req.destroy(new Error(timeoutMessage)));
+        req.end(body);
+    });
+}
+//# sourceMappingURL=unix-http.js.map

package/dist/collect/unix-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unix-http.js","sourceRoot":"","sources":["../../src/collect/unix-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,+EAA+E;AAC/E,MAAM,UAAU,QAAQ,CACtB,UAAkB,EAClB,IAAY,EACZ,IAAY,EACZ,EAAE,SAAS,GAAG,MAAM,EAAE,cAAc,GAAG,+BAA+B,KAAsD,EAAE;IAE9H,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,OAAO,CACjB;YACE,UAAU;YACV,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;YAC1F,OAAO,EAAE,SAAS;SACnB,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC,CAAA;YAC/C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;QAC7G,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAA;QAC/D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC"}