@aptos-labs/inference-verifier 0.0.0-stage → 0.1.1

package/dist/dcap.js

@@ -0,0 +1,583 @@
+import { createPublicKey, verify, X509Certificate } from "node:crypto";
+import { decodeCanonicalBase64, equalBytes, p256Spki, rsToDer, sha256, zero } from "./bytes.js";
+import { childByOid, encodeOid, parseDer, sequence, unwrapOctet } from "./der.js";
+import { INTEL_PCS_V1 } from "./document.js";
+import { fail } from "./error.js";
+import { assertJson, rawObjectMember } from "./json.js";
+import { INTEL_SGX_ROOT_CA_DER } from "./intel-root.js";
+import { parseQuote } from "./quote.js";
+const TCB_STATUSES = new Set([
+    "UpToDate", "OutOfDate", "ConfigurationNeeded", "Revoked",
+    "OutOfDateConfigurationNeeded", "SWHardeningNeeded", "ConfigurationAndSWHardeningNeeded",
+]);
+const MODULE_STATUSES = new Set(["UpToDate", "OutOfDate", "Revoked"]);
+const QE_STATUSES = new Set([
+    "UpToDate", "OutOfDate", "ConfigurationNeeded", "Revoked", "OutOfDateConfigurationNeeded",
+]);
+const INTEL_VENDOR = Buffer.from("939a7233f79c4ca9940a0db3957f0607", "hex");
+export function verifyDcap(quoteBytes, collateral, now, rootDer = INTEL_SGX_ROOT_CA_DER) {
+    const quote = parseQuote(quoteBytes);
+    if (!quote.qeVendorId.equals(INTEL_VENDOR))
+        fail("dcap", "unexpected QE vendor");
+    const root = new X509Certificate(rootDer);
+    const pcs = loadPcs(collateral);
+    const rootCrl = readCrl(pcs.rootCrl, root.publicKey, root, now);
+    const pckCerts = pemCerts(quote.pckChainPem);
+    if (pckCerts.length < 2)
+        fail("dcap", "PCK chain is too short");
+    const pckIssuer = pckCerts[1];
+    const pckCrl = readCrl(pcs.pckCrl, pckIssuer.publicKey, pckIssuer, now);
+    checkChain(pckCerts, root, now, [rootCrl, pckCrl]);
+    const tcbCerts = pemCerts(Buffer.from(pcs.tcbChain));
+    checkChain(tcbCerts, root, now, [rootCrl, pckCrl]);
+    const tcbRaw = pcs.tcbBody;
+    const tcbSigned = Buffer.from(rawObjectMember(tcbRaw, "tcbInfo", "dcap"));
+    const tcbSignature = decodeHexSignature(JSON.parse(rawObjectMember(tcbRaw, "signature", "dcap")));
+    verifySigned(tcbCerts[0], tcbSigned, tcbSignature);
+    const tcb = parseTcb(JSON.parse(tcbSigned.toString("utf8")));
+    if (now < tcb.issue)
+        fail("dcap", "TCB info is not yet valid");
+    if (now > tcb.next)
+        fail("dcap", "TCB info has expired");
+    const qeCerts = pemCerts(Buffer.from(pcs.qeChain));
+    const sameChain = certsEqual(qeCerts, tcbCerts);
+    if (!sameChain)
+        checkChain(qeCerts, root, now, [rootCrl, pckCrl]);
+    const qeRaw = pcs.qeBody;
+    const qeSigned = Buffer.from(rawObjectMember(qeRaw, "enclaveIdentity", "dcap"));
+    const qeSignature = decodeHexSignature(JSON.parse(rawObjectMember(qeRaw, "signature", "dcap")));
+    verifySigned(qeCerts[0], qeSigned, qeSignature);
+    const qe = parseQeIdentity(JSON.parse(qeSigned.toString("utf8")));
+    if (now < qe.issue)
+        fail("dcap", "QE identity is not yet valid");
+    if (now > qe.next)
+        fail("dcap", "QE identity has expired");
+    if (qe.id !== "TD_QE" || (qe.version !== 2 && qe.version !== 3)) {
+        fail("dcap", "QE identity is not TD_QE");
+    }
+    const pck = pckCerts[0];
+    const platform = readPck(pck.raw);
+    if (!platform.fmspc.equals(tcb.fmspc))
+        fail("dcap", "FMSPC mismatch");
+    verifyRaw(pck.publicKey, quote.qeReport.raw, quote.qeSignature);
+    const bound = sha256(Buffer.concat([quote.attestationKey, quote.qeAuthData]));
+    if (!quote.qeReport.reportData.subarray(0, 32).equals(bound))
+        fail("dcap", "QE report data mismatch");
+    const qeLevel = matchQe(quote.qeReport, qe);
+    verifyRaw(createPublicKey({ key: p256Spki(quote.attestationKey), format: "der", type: "spki" }), quote.signed, quote.signature);
+    if (tcb.version < 3 || tcb.id !== "TDX")
+        fail("dcap", "TCB info is not TDX");
+    const platformLevel = evaluateTdx(tcb, platform.cpuSvn, platform.pceSvn, quote.td.teeTcbSvn);
+    verifyModule(tcb, quote.td);
+    const status = converge(platformLevel.status, qeLevel.status);
+    if (status === "Revoked")
+        fail("dcap", "TCB status is Revoked");
+    const advisories = [...platformLevel.advisories];
+    for (const id of qeLevel.advisories)
+        if (!advisories.includes(id))
+            advisories.push(id);
+    return {
+        quote,
+        tcbStatus: status,
+        advisoryIds: advisories,
+        evalDataNumber: tcb.eval,
+        collateralExpiresAt: Math.min(tcb.next, qe.next),
+    };
+}
+function loadPcs(entries) {
+    const entry = entries.find((item) => item.role === "endorsement" && item.format === INTEL_PCS_V1 && item.subjects.includes("cpu"));
+    if (entry === undefined)
+        fail("dcap", "missing Intel PCS collateral");
+    const responses = entry.data.responses;
+    if (!Array.isArray(responses))
+        fail("dcap", "Intel collateral has no responses");
+    let tcbBody;
+    let tcbChain;
+    let qeBody;
+    let qeChain;
+    let pckCrl;
+    let rootCrl;
+    for (const response of responses) {
+        if (response === null || typeof response !== "object")
+            fail("dcap", "bad PCS response");
+        const record = response;
+        const url = record.url;
+        const body = record.body_base64;
+        if (typeof url !== "string" || typeof body !== "string")
+            fail("dcap", "bad PCS response");
+        const bytes = decodeCanonicalBase64(body, url);
+        const kind = classify(url);
+        if (kind === "pckcrl") {
+            pckCrl = bytes;
+            tcbChain ??= undefined;
+            const chain = header(record.headers, ["SGX-PCK-CRL-Issuer-Chain"]);
+            void chain;
+            continue;
+        }
+        if (kind === "tcb") {
+            tcbBody = bytes.toString("utf8");
+            tcbChain = header(record.headers, ["SGX-TCB-Info-Issuer-Chain", "TCB-Info-Issuer-Chain"]);
+        }
+        else if (kind === "qe") {
+            qeBody = bytes.toString("utf8");
+            qeChain = header(record.headers, ["SGX-Enclave-Identity-Issuer-Chain"]);
+        }
+        else if (kind === "rootcrl") {
+            rootCrl = bytes;
+        }
+        else {
+            fail("dcap", `unrecognized PCS response ${url}`);
+        }
+    }
+    // The loop above stores the PCK CRL issuer only to require the header.
+    for (const response of responses) {
+        const record = response;
+        if (classify(String(record.url)) === "pckcrl") {
+            header(record.headers, ["SGX-PCK-CRL-Issuer-Chain"]);
+        }
+    }
+    if (tcbBody === undefined || tcbChain === undefined || qeBody === undefined || qeChain === undefined || pckCrl === undefined || rootCrl === undefined) {
+        fail("dcap", "Intel collateral is incomplete");
+    }
+    assertJson(tcbBody, "dcap");
+    assertJson(qeBody, "dcap");
+    return { tcbBody, tcbChain, qeBody, qeChain, pckCrl, rootCrl };
+}
+function classify(url) {
+    const rest = url.split("://")[1]?.split(/[?#]/)[0]?.replace(/\/+$/, "");
+    const path = rest?.slice(rest.indexOf("/") + 1);
+    if (path === undefined)
+        return "other";
+    if (path.endsWith("/pckcrl"))
+        return "pckcrl";
+    if (path.endsWith("/tcb"))
+        return "tcb";
+    if (path.endsWith("/qe/identity"))
+        return "qe";
+    if (path.endsWith(".der") || path.endsWith("/rootcacrl"))
+        return "rootcrl";
+    return "other";
+}
+function header(headers, names) {
+    if (headers === null || typeof headers !== "object")
+        fail("dcap", "PCS response has no headers");
+    for (const [key, value] of Object.entries(headers)) {
+        if (!names.some((name) => name.toLowerCase() === key.toLowerCase()))
+            continue;
+        const first = Array.isArray(value) ? value[0] : value;
+        if (typeof first !== "string" || first.length === 0)
+            fail("dcap", `empty ${names[0]} header`);
+        return percentDecode(first);
+    }
+    fail("dcap", `missing ${names[0]} header`);
+}
+function percentDecode(value) {
+    const bytes = [];
+    for (let i = 0; i < value.length; i += 1) {
+        if (value[i] === "%") {
+            const hex = value.slice(i + 1, i + 3);
+            if (!/^[0-9a-fA-F]{2}$/.test(hex))
+                fail("dcap", "bad percent-encoding");
+            bytes.push(Number.parseInt(hex, 16));
+            i += 2;
+        }
+        else {
+            bytes.push(value.charCodeAt(i));
+        }
+    }
+    return Buffer.from(bytes).toString("utf8");
+}
+function readCrl(bytes, key, issuer, now) {
+    const top = parseDer(bytes);
+    const outer = sequence(top);
+    const tbs = outer[0];
+    const signature = outer[2];
+    if (tbs === undefined || signature === undefined || signature.tag !== 0x03)
+        fail("dcap", "malformed CRL");
+    const unused = signature.value[0];
+    if (unused !== 0)
+        fail("dcap", "CRL signature has unused bits");
+    const signed = bytes.subarray(top.start + top.header + tbs.start, top.start + top.header + tbs.end);
+    if (!verify("sha256", signed, key, signature.value.subarray(1)))
+        fail("dcap", "CRL signature is invalid");
+    const fields = sequence(tbs);
+    let index = 0;
+    if (fields[0]?.tag === 0x02)
+        index = 0;
+    if (fields[0]?.tag === 0xa0)
+        index = 1;
+    const issuerName = fields[index + 2];
+    const thisUpdate = fields[index + 3];
+    const next = fields[index + 4];
+    if (issuerName === undefined || thisUpdate === undefined)
+        fail("dcap", "CRL is missing its issuer");
+    if (!issuerName.value.equals(subjectDer(issuer.raw)))
+        fail("dcap", "CRL issuer does not match the signer");
+    const thisSecs = utcTime(thisUpdate);
+    if (thisSecs > now)
+        fail("dcap", "CRL is not yet valid");
+    if (next === undefined || (next.tag !== 0x17 && next.tag !== 0x18))
+        fail("dcap", "CRL has no nextUpdate");
+    if (utcTime(next) < now)
+        fail("dcap", "CRL has expired");
+    const revoked = fields.find((field) => field.tag === 0x30 && field !== fields[index + 1]);
+    const serials = [];
+    if (revoked !== undefined && revoked.start > next.end) {
+        for (const entry of sequence(revoked)) {
+            const serial = sequence(entry)[0];
+            if (serial === undefined || serial.tag !== 0x02)
+                fail("dcap", "bad CRL entry");
+            serials.push(integer(serial.value));
+        }
+    }
+    return { issuer, serials };
+}
+function utcTime(der) {
+    const text = der.value.toString("ascii");
+    if (der.tag === 0x17) {
+        const year = Number(text.slice(0, 2));
+        const full = `${year >= 50 ? "19" : "20"}${text.slice(0, 2)}-${text.slice(2, 4)}-${text.slice(4, 6)}T${text.slice(6, 8)}:${text.slice(8, 10)}:${text.slice(10, 12)}Z`;
+        return Date.parse(full) / 1000;
+    }
+    const full = `${text.slice(0, 4)}-${text.slice(4, 6)}-${text.slice(6, 8)}T${text.slice(8, 10)}:${text.slice(10, 12)}:${text.slice(12, 14)}Z`;
+    return Date.parse(full) / 1000;
+}
+function subjectDer(certDer) {
+    const tbs = sequence(parseDer(certDer))[0];
+    if (tbs === undefined)
+        fail("dcap", "bad certificate");
+    const fields = sequence(tbs);
+    const subject = fields[0]?.tag === 0xa0 ? fields[5] : fields[4];
+    if (subject === undefined)
+        fail("dcap", "certificate has no subject");
+    return subject.value;
+}
+function integer(bytes) {
+    let value = 0n;
+    for (const byte of bytes)
+        value = (value << 8n) | BigInt(byte);
+    return value;
+}
+function pemCerts(pem) {
+    const text = pem.toString("utf8");
+    const blocks = text.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g);
+    if (blocks === null || blocks.length === 0)
+        fail("dcap", "certificate chain is not PEM");
+    const leftover = text
+        .replace(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g, "")
+        .replace(/[\s\0]/g, "");
+    if (leftover.length > 0)
+        fail("dcap", "PEM chain has extra content");
+    return blocks.map((block) => new X509Certificate(block));
+}
+function checkChain(certs, root, now, crls) {
+    const chain = certs[certs.length - 1]?.publicKey.equals(root.publicKey) ? certs.slice(0, -1) : certs;
+    const anchors = [...chain, root];
+    for (let i = 0; i < chain.length; i += 1) {
+        const cert = chain[i];
+        const issuer = anchors[i + 1];
+        if (!cert.verify(issuer.publicKey) || !cert.checkIssued(issuer))
+            fail("dcap", "certificate chain is invalid");
+        const from = Date.parse(cert.validFrom) / 1000;
+        const to = Date.parse(cert.validTo) / 1000;
+        if (now < from || now >= to)
+            fail("dcap", "certificate is outside its validity");
+        const crl = crls.find((item) => item.issuer.raw.equals(issuer.raw) || item.issuer.publicKey.equals(issuer.publicKey));
+        if (crl === undefined)
+            fail("dcap", "no CRL covers a certificate issuer");
+        const serial = BigInt(`0x${cert.serialNumber}`);
+        if (crl.serials.includes(serial))
+            fail("dcap", "certificate is revoked");
+    }
+}
+function certsEqual(left, right) {
+    return left.length === right.length && left.every((cert, index) => cert.raw.equals(right[index].raw));
+}
+function verifySigned(cert, payload, signature) {
+    if (!verify("sha256", payload, cert.publicKey, rsToDer(signature))) {
+        fail("dcap", "Intel signature is invalid");
+    }
+}
+function verifyRaw(key, payload, signature) {
+    if (!verify("sha256", payload, key, rsToDer(signature)))
+        fail("dcap", "quote signature is invalid");
+}
+function decodeHexSignature(value) {
+    if (!/^[0-9a-fA-F]+$/.test(value) || value.length !== 128)
+        fail("dcap", "Intel signature is not 64 bytes of hex");
+    return Buffer.from(value, "hex");
+}
+function parseTcb(info) {
+    const levels = Array.isArray(info.tcbLevels) ? info.tcbLevels.map(parseLevel) : [];
+    levels.sort((a, b) => compareLevels(a, b));
+    const module = object(info.tdxModule);
+    const identities = Array.isArray(info.tdxModuleIdentities) ? info.tdxModuleIdentities.map(parseIdentity) : [];
+    return {
+        id: string(info.id),
+        version: number(info.version),
+        issue: time(string(info.issueDate)),
+        next: time(string(info.nextUpdate)),
+        fmspc: Buffer.from(string(info.fmspc), "hex"),
+        eval: number(info.tcbEvaluationDataNumber),
+        module: {
+            mrsigner: hexBuf(string(module.mrsigner), 48),
+            attributes: hexBuf(string(module.attributes), 8),
+            attributesMask: hexBuf(string(module.attributesMask), 8),
+        },
+        identities,
+        levels,
+    };
+}
+function parseIdentity(value) {
+    const record = object(value);
+    const levels = Array.isArray(record.tcbLevels) ? record.tcbLevels.map((level) => {
+        const item = object(level);
+        const tcb = object(item.tcb);
+        return {
+            isvsvn: number(tcb.isvsvn),
+            status: string(item.tcbStatus),
+            date: string(item.tcbDate),
+            advisories: advisories(item.advisoryIDs),
+        };
+    }) : [];
+    return {
+        id: string(record.id),
+        mrsigner: hexBuf(string(record.mrsigner), 48),
+        attributes: hexBuf(string(record.attributes), 8),
+        attributesMask: hexBuf(string(record.attributesMask), 8),
+        levels,
+    };
+}
+function parseLevel(value) {
+    const record = object(value);
+    const tcb = object(record.tcb);
+    return {
+        sgx: components(tcb.sgxtcbcomponents),
+        tdx: components(tcb.tdxtcbcomponents),
+        pce: number(tcb.pcesvn),
+        status: string(record.tcbStatus),
+        date: string(record.tcbDate),
+        advisories: advisories(record.advisoryIDs),
+    };
+}
+function parseQeIdentity(info) {
+    const levels = Array.isArray(info.tcbLevels) ? info.tcbLevels.map((level) => {
+        const item = object(level);
+        return {
+            isvsvn: number(object(item.tcb).isvsvn),
+            status: string(item.tcbStatus),
+            date: string(item.tcbDate),
+            advisories: advisories(item.advisoryIDs),
+        };
+    }) : [];
+    return {
+        id: string(info.id),
+        version: number(info.version),
+        issue: time(string(info.issueDate)),
+        next: time(string(info.nextUpdate)),
+        miscselect: hexBuf(string(info.miscselect), 4).readUInt32LE(),
+        miscselectMask: hexBuf(string(info.miscselectMask), 4).readUInt32LE(),
+        attributes: hexBuf(string(info.attributes), 16),
+        attributesMask: hexBuf(string(info.attributesMask), 16),
+        mrsigner: hexBuf(string(info.mrsigner), 32),
+        isvProdId: number(info.isvprodid),
+        levels,
+    };
+}
+function components(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.map((item) => number(object(item).svn));
+}
+function advisories(value) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.some((item) => typeof item !== "string"))
+        fail("dcap", "bad advisory IDs");
+    return value;
+}
+function compareLevels(a, b) {
+    return compareBytes(b.sgx, a.sgx) || b.pce - a.pce || compareBytes(b.tdx, a.tdx);
+}
+function compareBytes(left, right) {
+    const count = Math.min(left.length, right.length);
+    for (let i = 0; i < count; i += 1) {
+        if (left[i] !== right[i])
+            return left[i] - right[i];
+    }
+    return left.length - right.length;
+}
+function evaluateTdx(tcb, cpu, pce, tee) {
+    const level = tcb.levels.find((candidate) => meets(candidate, cpu, pce, tee));
+    if (level === undefined)
+        fail("dcap", "no matching TCB level");
+    if (!TCB_STATUSES.has(level.status))
+        fail("dcap", `unrecognized TCB status ${level.status}`);
+    const module = matchModule(tcb, tee);
+    if (module === undefined)
+        return level;
+    if (!MODULE_STATUSES.has(module.status))
+        fail("dcap", `unrecognized module status ${module.status}`);
+    const advisories = [...level.advisories];
+    for (const id of module.advisories)
+        if (!advisories.includes(id))
+            advisories.push(id);
+    return {
+        ...level,
+        status: converge(level.status, module.status),
+        date: time(module.date) < time(level.date) ? module.date : level.date,
+        advisories,
+    };
+}
+function meets(level, cpu, pce, tee) {
+    if (pce < level.pce || level.sgx.length !== cpu.length)
+        return false;
+    if (cpu.some((byte, index) => byte < level.sgx[index]))
+        return false;
+    if (level.tdx.length !== tee.length)
+        return false;
+    const skip = tee[1] > 0 ? 2 : 0;
+    return !tee.some((byte, index) => index >= skip && byte < level.tdx[index]);
+}
+function matchModule(tcb, tee) {
+    if (tee[1] === 0)
+        return undefined;
+    const wanted = `TDX_${tee[1].toString(16).padStart(2, "0")}`.toUpperCase();
+    const identity = tcb.identities.find((item) => item.id.toUpperCase() === wanted);
+    if (identity === undefined)
+        fail("dcap", `missing TDX module identity ${wanted}`);
+    const level = identity.levels.find((item) => tee[0] >= item.isvsvn);
+    if (level === undefined)
+        fail("dcap", "TDX module SVN is below the published minimum");
+    return level;
+}
+function verifyModule(tcb, td) {
+    let expected = tcb.module;
+    const version = td.teeTcbSvn[1] ?? 0;
+    if (version > 0) {
+        const wanted = `TDX_${version.toString(16).padStart(2, "0")}`.toUpperCase();
+        const identity = tcb.identities.find((item) => item.id.toUpperCase() === wanted);
+        if (identity === undefined)
+            fail("dcap", "missing TDX module identity");
+        expected = identity;
+    }
+    if (!td.mrSignerSeam.equals(expected.mrsigner))
+        fail("dcap", "TDX module signer mismatch");
+    for (let i = 0; i < 8; i += 1) {
+        const mask = expected.attributesMask[i];
+        if ((td.seamAttributes[i] & mask) !== (expected.attributes[i] & mask)) {
+            fail("dcap", "TDX module attributes mismatch");
+        }
+        if ((td.seamAttributes[i] & ~mask & 0xff) !== 0)
+            fail("dcap", "TDX module attributes outside the mask");
+    }
+}
+function matchQe(report, identity) {
+    if (!report.mrSigner.equals(identity.mrsigner))
+        fail("dcap", "QE signer mismatch");
+    if ((report.attributes[0] & 0x02) !== 0)
+        fail("dcap", "QE debug mode is enabled");
+    if (report.isvProdId !== identity.isvProdId)
+        fail("dcap", "QE product id mismatch");
+    if ((report.miscSelect & identity.miscselectMask) !== (identity.miscselect & identity.miscselectMask)) {
+        fail("dcap", "QE miscselect mismatch");
+    }
+    for (let i = 0; i < 16; i += 1) {
+        const mask = identity.attributesMask[i];
+        if ((report.attributes[i] & mask) !== (identity.attributes[i] & mask))
+            fail("dcap", "QE attributes mismatch");
+    }
+    const level = identity.levels.find((item) => report.isvSvn >= item.isvsvn);
+    if (level === undefined)
+        fail("dcap", "QE SVN is below the published minimum");
+    if (!QE_STATUSES.has(level.status))
+        fail("dcap", `unrecognized QE status ${level.status}`);
+    return level;
+}
+function converge(self, component) {
+    if (component === "Revoked")
+        return "Revoked";
+    if (component === "OutOfDate" && (self === "UpToDate" || self === "SWHardeningNeeded"))
+        return "OutOfDate";
+    if (component === "OutOfDate" && (self === "ConfigurationNeeded" || self === "ConfigurationAndSWHardeningNeeded")) {
+        return "OutOfDateConfigurationNeeded";
+    }
+    return self;
+}
+function readPck(der) {
+    const cert = sequence(parseDer(der));
+    const tbs = cert[0];
+    if (tbs === undefined)
+        fail("dcap", "bad PCK certificate");
+    const fields = sequence(tbs);
+    const extensions = fields.find((field) => field.tag === 0xa3);
+    if (extensions === undefined)
+        fail("dcap", "PCK certificate has no SGX extension");
+    const extensionList = sequence(parseDer(extensions.value));
+    const sgx = extensionList.find((item) => {
+        const [oid] = sequence(item);
+        return oid?.tag === 0x06 && oid.value.equals(encodeOid("1.2.840.113741.1.13.1"));
+    });
+    if (sgx === undefined)
+        fail("dcap", "PCK certificate has no SGX extension");
+    const octet = sequence(sgx).find((part) => part.tag === 0x04);
+    if (octet === undefined)
+        fail("dcap", "SGX extension is empty");
+    const entries = sequence(parseDer(unwrapOctet(octet)));
+    const fmspc = childByOid(entries, "1.2.840.113741.1.13.1.4");
+    const tcb = childByOid(entries, "1.2.840.113741.1.13.1.2");
+    if (fmspc === undefined || tcb === undefined)
+        fail("dcap", "PCK certificate is missing FMSPC");
+    const tcbEntries = sequence(tcb.tag === 0x04 ? parseDer(unwrapOctet(tcb)) : tcb);
+    const cpu = childByOid(tcbEntries, "1.2.840.113741.1.13.1.2.18");
+    const pce = childByOid(tcbEntries, "1.2.840.113741.1.13.1.2.17");
+    if (cpu === undefined || pce === undefined || fmspc.value.length !== 6 || cpu.value.length !== 16) {
+        fail("dcap", "PCK TCB extension is malformed");
+    }
+    const pceBytes = pce.value;
+    const pceSvn = pceBytes.length === 1 ? pceBytes[0] : pceBytes.length === 2 ? pceBytes.readUInt16BE() : NaN;
+    if (!Number.isInteger(pceSvn))
+        fail("dcap", "PCE SVN is malformed");
+    return { fmspc: fmspc.value, cpuSvn: cpu.value, pceSvn };
+}
+function object(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        fail("dcap", "expected an object");
+    return value;
+}
+function string(value) {
+    if (typeof value !== "string")
+        fail("dcap", "expected a string");
+    return value;
+}
+function number(value) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value))
+        fail("dcap", "expected an integer");
+    return value;
+}
+function hexBuf(value, length) {
+    if (!/^[0-9a-fA-F]+$/.test(value) || value.length !== length * 2)
+        fail("dcap", "bad hex field");
+    return Buffer.from(value, "hex");
+}
+function time(value) {
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed))
+        fail("dcap", "bad timestamp");
+    return parsed / 1000;
+}
+export function reportDataMatches(quote, expected) {
+    if (!equalBytes(quote.td.reportData, expected))
+        fail("dcap", "quote report data mismatch");
+}
+export function launchInputsAreZero(td) {
+    for (const [name, value] of [
+        ["MR_CONFIG_ID", td.mrConfigId],
+        ["MR_OWNER", td.mrOwner],
+        ["MR_OWNER_CONFIG", td.mrOwnerConfig],
+    ]) {
+        if (!zero(value))
+            fail("tdx", `${name} must be zero`);
+    }
+}
+//# sourceMappingURL=dcap.js.map

package/dist/dcap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dcap.js","sourceRoot":"","sources":["../src/dcap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAEvF,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAChG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAElF,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAkD,MAAM,YAAY,CAAC;AA2DxF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,UAAU,EAAE,WAAW,EAAE,qBAAqB,EAAE,SAAS;IACzD,8BAA8B,EAAE,mBAAmB,EAAE,mCAAmC;CACzF,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AACtE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,UAAU,EAAE,WAAW,EAAE,qBAAqB,EAAE,SAAS,EAAE,8BAA8B;CAC1F,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;AAE5E,MAAM,UAAU,UAAU,CACxB,UAAkB,EAClB,UAA6B,EAC7B,GAAW,EACX,UAAkB,qBAAqB;IAEvC,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACxE,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;IAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1E,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,CAAW,CAAC,CAAC;IAC5G,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC,CAAC;IACxF,IAAI,GAAG,GAAG,GAAG,CAAC,KAAK;QAAE,IAAI,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IAC/D,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI;QAAE,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAEzD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS;QAAE,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC;IACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,CAAW,CAAC,CAAC;IAC1G,YAAY,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC,CAAC;IAC7F,IAAI,GAAG,GAAG,EAAE,CAAC,KAAK;QAAE,IAAI,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;IACjE,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI;QAAE,IAAI,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IAC3D,IAAI,EAAE,CAAC,EAAE,KAAK,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACtE,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5C,SAAS,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAEhI,IAAI,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,KAAK;QAAE,IAAI,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC7E,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IAC7F,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,CAAC,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACjD,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,UAAU;QAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO;QACL,KAAK;QACL,SAAS,EAAE,MAAM;QACjB,WAAW,EAAE,UAAU;QACvB,cAAc,EAAE,GAAG,CAAC,IAAI;QACxB,mBAAmB,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,OAA0B;IAGzC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACnI,IAAI,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,mCAAmC,CAAC,CAAC;IACjF,IAAI,OAA2B,CAAC;IAChC,IAAI,QAA4B,CAAC;IACjC,IAAI,MAA0B,CAAC;IAC/B,IAAI,OAA2B,CAAC;IAChC,IAAI,MAA0B,CAAC;IAC/B,IAAI,OAA2B,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,QAAmC,CAAC;QACnD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;QAChC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,GAAG,KAAK,CAAC;YACf,QAAQ,KAAK,SAAS,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;YACnE,KAAK,KAAK,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,2BAA2B,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAC5F,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,mCAAmC,CAAC,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,EAAE,6BAA6B,GAAG,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,QAAmC,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACtJ,IAAI,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC;IACjD,CAAC;IACD,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5B,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACvC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,MAAM,CAAC,OAAgB,EAAE,KAAe;IAC/C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,IAAI,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;IACjG,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,MAAM,EAAE,SAAS,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9F,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;YACxE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;YACrC,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAOD,SAAS,OAAO,CAAC,KAAa,EAAE,GAAc,EAAE,MAAuB,EAAE,GAAW;IAClF,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,KAAK,IAAI;QAAE,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACpG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,IAAI;QAAE,KAAK,GAAG,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,IAAI;QAAE,KAAK,GAAG,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IACpG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,sCAAsC,CAAC,CAAC;IAC3G,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,QAAQ,GAAG,GAAG;QAAE,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAC1G,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG;QAAE,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI;gBAAE,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YAC/E,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,OAAO,CAAC,GAAmC;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC;QACtK,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACjC,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC;IAC7I,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;IACtE,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAC3F,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,IAAI;SAClB,OAAO,CAAC,+DAA+D,EAAE,EAAE,CAAC;SAC5E,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC1B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,KAAwB,EAAE,IAAqB,EAAE,GAAW,EAAE,IAAW;IAC3F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrG,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;QAC9G,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;QAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;QAC3C,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,IAAI,EAAE;YAAE,IAAI,CAAC,MAAM,EAAE,qCAAqC,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACtH,IAAI,GAAG,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QAChD,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAuB,EAAE,KAAwB;IACnE,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,YAAY,CAAC,IAAqB,EAAE,OAAe,EAAE,SAAiB;IAC7E,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAc,EAAE,OAAe,EAAE,SAAiB;IACnE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QAAE,IAAI,CAAC,MAAM,EAAE,wCAAwC,CAAC,CAAC;IAClH,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,QAAQ,CAAC,IAA6B;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAC7B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;QAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC;QAC1C,MAAM,EAAE;YACN,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC7C,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAChD,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;SACzD;QACD,UAAU;QACV,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YAC1B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAC9B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1B,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;SACzC,CAAC;IACJ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACR,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC7C,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAChD,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO;QACL,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACrC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACrC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QAChC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAC5B,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAA6B;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YACvC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAC9B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1B,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;SACzC,CAAC;IACJ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACR,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAC7B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE;QAC7D,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE;QACrE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QAC/C,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;QACvD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC3C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC9G,OAAO,KAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,CAAW,EAAE,CAAW;IAC7C,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,YAAY,CAAC,IAAc,EAAE,KAAe;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,GAAW,EAAE,GAAW,EAAE,GAAW;IACtE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9E,IAAI,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAC/D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,2BAA2B,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,8BAA8B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACrG,MAAM,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,UAAU;QAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtF,OAAO;QACL,GAAG,KAAK;QACR,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI;QACrE,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAe,EAAE,GAAW,EAAE,GAAW,EAAE,GAAW;IACnE,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,GAAW;IAC5C,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5E,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;IACjF,IAAI,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,EAAE,+BAA+B,MAAM,EAAE,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAE,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IACrE,IAAI,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,EAAE,+CAA+C,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,EAAY;IAC9C,IAAI,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5E,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;QACjF,IAAI,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;QACxE,QAAQ,GAAG,QAAQ,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;IAC3F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAE,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,MAAM,EAAE,wCAAwC,CAAC,CAAC;IAC3G,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,MAAgB,EAAE,QAAoB;IACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACnF,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IACnF,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;QAAE,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACpF,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,GAAG,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACtG,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACzC,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAE,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC;YAAE,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3E,IAAI,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,EAAE,uCAAuC,CAAC,CAAC;IAC/E,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,0BAA0B,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAC/C,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,SAAS,KAAK,WAAW,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,mBAAmB,CAAC;QAAE,OAAO,WAAW,CAAC;IAC3G,IAAI,SAAS,KAAK,WAAW,IAAI,CAAC,IAAI,KAAK,qBAAqB,IAAI,IAAI,KAAK,mCAAmC,CAAC,EAAE,CAAC;QAClH,OAAO,8BAA8B,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IAC9D,IAAI,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,EAAE,sCAAsC,CAAC,CAAC;IACnF,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IACH,IAAI,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,EAAE,sCAAsC,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IAC3D,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;IACjE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAClG,IAAI,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC;IAC3B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5G,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACpE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC5G,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACnG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,MAAc;IAC3C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5D,OAAO,MAAM,GAAG,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAkB,EAAE,QAAgB;IACpE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAY;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,cAAc,EAAE,EAAE,CAAC,UAAU,CAAC;QAC/B,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC;QACxB,CAAC,iBAAiB,EAAE,EAAE,CAAC,aAAa,CAAC;KAC7B,EAAE,CAAC;QACX,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC;IACxD,CAAC;AACH,CAAC"}

package/dist/der.d.ts

@@ -0,0 +1,12 @@
+export interface Der {
+    tag: number;
+    start: number;
+    header: number;
+    end: number;
+    value: Buffer;
+}
+export declare function parseDer(bytes: Buffer, at?: number): Der;
+export declare function sequence(der: Der): Der[];
+export declare function encodeOid(oid: string): Buffer;
+export declare function childByOid(items: Der[], oid: string): Der | undefined;
+export declare function unwrapOctet(der: Der): Buffer;