@aptos-labs/inference-verifier 0.0.0-stage → 0.1.1

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAGlC,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACrE,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;AAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;AACpD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;IACtB,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;CACnG,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CAAC,EAAY,EAAE,OAAe,EAAE,MAAc,EAAE,QAAgB;IACzF,IAAI,OAAO,KAAK,CAAC;QAAE,IAAI,CAAC,KAAK,EAAE,iCAAiC,OAAO,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3E,IAAI,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,QAAQ,GAAG,YAAY;QAAE,IAAI,CAAC,KAAK,EAAE,8BAA8B,QAAQ,aAAa,YAAY,EAAE,CAAC,CAAC;IAC5G,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAE,GAAG,WAAW,CAAC,CAAC,CAAE,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,EAAE,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAE,IAAI,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACnG,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC;QAAE,IAAI,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAClF,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAAE,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;AAC7D,CAAC"}

package/dist/quote.d.ts

@@ -0,0 +1,38 @@
+export interface TdReport {
+    teeTcbSvn: Buffer;
+    mrSeam: Buffer;
+    mrSignerSeam: Buffer;
+    seamAttributes: Buffer;
+    tdAttributes: Buffer;
+    xfam: Buffer;
+    mrTd: Buffer;
+    mrConfigId: Buffer;
+    mrOwner: Buffer;
+    mrOwnerConfig: Buffer;
+    rtmrs: [Buffer, Buffer, Buffer, Buffer];
+    reportData: Buffer;
+}
+export interface QeReport {
+    miscSelect: number;
+    attributes: Buffer;
+    mrSigner: Buffer;
+    isvProdId: number;
+    isvSvn: number;
+    reportData: Buffer;
+    raw: Buffer;
+}
+export interface ParsedQuote {
+    version: number;
+    attestationKeyType: number;
+    teeType: number;
+    qeVendorId: Buffer;
+    signed: Buffer;
+    td: TdReport;
+    signature: Buffer;
+    attestationKey: Buffer;
+    qeReport: QeReport;
+    qeSignature: Buffer;
+    qeAuthData: Buffer;
+    pckChainPem: Buffer;
+}
+export declare function parseQuote(quote: Buffer): ParsedQuote;

package/dist/quote.js

@@ -0,0 +1,123 @@
+import { fail } from "./error.js";
+const TD_REPORT_LEN = 584;
+const QE_REPORT_LEN = 384;
+function take(buffer, offset, length) {
+    const end = offset + length;
+    if (end > buffer.length)
+        fail("dcap", "truncated quote");
+    return buffer.subarray(offset, end);
+}
+function u16(buffer, offset) {
+    if (offset + 2 > buffer.length)
+        fail("dcap", "truncated quote");
+    return buffer.readUInt16LE(offset);
+}
+function u32(buffer, offset) {
+    if (offset + 4 > buffer.length)
+        fail("dcap", "truncated quote");
+    return buffer.readUInt32LE(offset);
+}
+export function parseQuote(quote) {
+    if (quote.length < 48 + TD_REPORT_LEN + 4)
+        fail("dcap", "quote is too small");
+    const version = u16(quote, 0);
+    const attestationKeyType = u16(quote, 2);
+    const teeType = u32(quote, 4);
+    const qeVendorId = take(quote, 12, 16);
+    if (version !== 4)
+        fail("tdx", `unsupported quote version ${version}`);
+    if (teeType !== 0x81)
+        fail("tdx", "quote is not a TDX quote");
+    if (attestationKeyType !== 2)
+        fail("dcap", "unsupported attestation key type");
+    const signedLength = 48 + TD_REPORT_LEN;
+    const authLength = u32(quote, signedLength);
+    const authStart = signedLength + 4;
+    if (authLength > 1_048_576 || authStart + authLength > quote.length) {
+        fail("dcap", "quote auth data length is wrong");
+    }
+    const auth = quote.subarray(authStart, authStart + authLength);
+    let offset = 0;
+    const signature = take(auth, offset, 64);
+    offset += 64;
+    const attestationKey = take(auth, offset, 64);
+    offset += 64;
+    const outerType = u16(auth, offset);
+    offset += 2;
+    const outerSize = u32(auth, offset);
+    offset += 4;
+    if (outerType !== 6)
+        fail("dcap", `unexpected certification type ${outerType}`);
+    if (offset + outerSize !== auth.length)
+        fail("dcap", "certification data length is wrong");
+    const body = auth.subarray(offset, offset + outerSize);
+    const qeRaw = take(body, 0, QE_REPORT_LEN);
+    const qeSignature = take(body, QE_REPORT_LEN, 64);
+    let inner = QE_REPORT_LEN + 64;
+    const authDataLen = u16(body, inner);
+    inner += 2;
+    if (authDataLen !== 32)
+        fail("dcap", "QE auth data must be 32 bytes");
+    const qeAuthData = take(body, inner, authDataLen);
+    inner += authDataLen;
+    const certType = u16(body, inner);
+    inner += 2;
+    const certSize = u32(body, inner);
+    inner += 4;
+    if (certType !== 5)
+        fail("dcap", `PCK chain type ${certType} is not supported`);
+    if (inner + certSize !== body.length)
+        fail("dcap", "PCK chain length is wrong");
+    return {
+        version,
+        attestationKeyType,
+        teeType,
+        qeVendorId,
+        signed: quote.subarray(0, signedLength),
+        td: parseTd(quote.subarray(48, signedLength)),
+        signature,
+        attestationKey,
+        qeReport: parseQe(qeRaw),
+        qeSignature,
+        qeAuthData,
+        pckChainPem: body.subarray(inner),
+    };
+}
+function parseTd(body) {
+    let offset = 0;
+    const next = (length) => {
+        const value = body.subarray(offset, offset + length);
+        offset += length;
+        return value;
+    };
+    const teeTcbSvn = next(16);
+    const mrSeam = next(48);
+    const mrSignerSeam = next(48);
+    const seamAttributes = next(8);
+    const tdAttributes = next(8);
+    const xfam = next(8);
+    const mrTd = next(48);
+    const mrConfigId = next(48);
+    const mrOwner = next(48);
+    const mrOwnerConfig = next(48);
+    const rtmrs = [next(48), next(48), next(48), next(48)];
+    const reportData = next(64);
+    if (offset !== body.length)
+        fail("dcap", "TD report length is wrong");
+    return {
+        teeTcbSvn, mrSeam, mrSignerSeam, seamAttributes, tdAttributes, xfam, mrTd,
+        mrConfigId, mrOwner, mrOwnerConfig, rtmrs, reportData,
+    };
+}
+function parseQe(raw) {
+    return {
+        raw,
+        miscSelect: raw.readUInt32LE(16),
+        attributes: raw.subarray(48, 64),
+        mrSigner: raw.subarray(128, 160),
+        isvProdId: raw.readUInt16LE(256),
+        isvSvn: raw.readUInt16LE(258),
+        reportData: raw.subarray(320, 384),
+    };
+}
+//# sourceMappingURL=quote.js.map

package/dist/quote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quote.js","sourceRoot":"","sources":["../src/quote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AA0ClC,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,SAAS,IAAI,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc;IAC1D,MAAM,GAAG,GAAG,MAAM,GAAG,MAAM,CAAC;IAC5B,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,GAAG,CAAC,MAAc,EAAE,MAAc;IACzC,IAAI,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,GAAG,CAAC,MAAc,EAAE,MAAc;IACzC,IAAI,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,aAAa,GAAG,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9B,MAAM,kBAAkB,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,CAAC;QAAE,IAAI,CAAC,KAAK,EAAE,6BAA6B,OAAO,EAAE,CAAC,CAAC;IACvE,IAAI,OAAO,KAAK,IAAI;QAAE,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;IAC9D,IAAI,kBAAkB,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,EAAE,GAAG,aAAa,CAAC;IACxC,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,YAAY,GAAG,CAAC,CAAC;IACnC,IAAI,UAAU,GAAG,SAAS,IAAI,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACpE,IAAI,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC;IAC/D,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,IAAI,EAAE,CAAC;IACb,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,EAAE,CAAC;IACb,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,CAAC,CAAC;IACZ,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,CAAC,CAAC;IACZ,IAAI,SAAS,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,iCAAiC,SAAS,EAAE,CAAC,CAAC;IAChF,IAAI,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,GAAG,aAAa,GAAG,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,CAAC;IACX,IAAI,WAAW,KAAK,EAAE;QAAE,IAAI,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAClD,KAAK,IAAI,WAAW,CAAC;IACrB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,CAAC;IACX,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,CAAC;IACX,IAAI,QAAQ,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,EAAE,kBAAkB,QAAQ,mBAAmB,CAAC,CAAC;IAChF,IAAI,KAAK,GAAG,QAAQ,KAAK,IAAI,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IAChF,OAAO;QACL,OAAO;QACP,kBAAkB;QAClB,OAAO;QACP,UAAU;QACV,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC;QACvC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAC7C,SAAS;QACT,cAAc;QACd,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;QACxB,WAAW;QACX,UAAU;QACV,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,IAAI,GAAG,CAAC,MAAc,EAAU,EAAE;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;QACrD,MAAM,IAAI,MAAM,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACxB,MAAM,YAAY,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACtB,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACzB,MAAM,aAAa,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAqC,CAAC;IAC3F,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IACtE,OAAO;QACL,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI;QACzE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO;QACL,GAAG;QACH,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;QAChC,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC;QAChC,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC;QAC7B,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;KACnC,CAAC;AACJ,CAAC"}

package/dist/sigstore.d.ts

@@ -0,0 +1,44 @@
+interface TrustRoot {
+    tlogs: Array<{
+        publicKey: {
+            rawBytes: string;
+            keyDetails: string;
+            validFor: {
+                start?: string;
+                end?: string;
+            };
+        };
+        logId: {
+            keyId: string;
+        };
+    }>;
+    certificateAuthorities: Array<{
+        certChain: {
+            certificates: Array<{
+                rawBytes: string;
+            }>;
+        };
+        validFor: {
+            start?: string;
+            end?: string;
+        };
+    }>;
+}
+export interface CodeProof {
+    tag: string;
+    digest: string;
+    snp: string;
+    rtmr1: string;
+    rtmr2: string;
+}
+export interface HardwareEntry {
+    name: string;
+    mrtd: string;
+    rtmr0: string;
+}
+export interface SigstoreRoots {
+    trustedRoot: TrustRoot;
+}
+export declare function verifyCode(bundle: unknown, repo: string, tag: string | undefined, digest: string, roots?: SigstoreRoots): CodeProof;
+export declare function verifyHardware(bundle: unknown, repo: string, digest: string, roots?: SigstoreRoots): HardwareEntry[];
+export {};

package/dist/sigstore.js

@@ -0,0 +1,385 @@
+import { createPublicKey, verify, X509Certificate } from "node:crypto";
+import { decodeCanonicalBase64, sha256 } from "./bytes.js";
+import { parseDer, sequence } from "./der.js";
+import { fail } from "./error.js";
+import trustedRootJson from "./trusted_root.json" with { type: "json" };
+const GITHUB_ISSUER = "https://token.actions.githubusercontent.com";
+const TAG_PREFIX = "refs/tags/";
+const PREDICATE = "https://tinfoil.sh/predicate/snp-tdx-multiplatform/v1";
+const HARDWARE_PREDICATE = "https://tinfoil.sh/predicate/hardware-measurements/v1";
+const trustedRoot = trustedRootJson;
+export function verifyCode(bundle, repo, tag, digest, roots = { trustedRoot }) {
+    const statement = verifyBundle(bundle, repo, tag, digest, roots);
+    if (statement.predicateType !== PREDICATE)
+        fail("provenance", "unsupported code predicate");
+    const predicate = object(statement.predicate);
+    const tdx = object(predicate.tdx_measurement);
+    return {
+        tag: statement.tag,
+        digest,
+        snp: register(predicate.snp_measurement, "SNP"),
+        rtmr1: register(tdx.rtmr1, "RTMR1"),
+        rtmr2: register(tdx.rtmr2, "RTMR2"),
+    };
+}
+export function verifyHardware(bundle, repo, digest, roots = { trustedRoot }) {
+    const statement = verifyBundle(bundle, repo, undefined, digest, roots);
+    if (statement.predicateType !== HARDWARE_PREDICATE)
+        fail("provenance", "unsupported hardware predicate");
+    const entries = object(statement.predicate);
+    const measurements = Object.entries(entries).map(([name, value]) => {
+        const record = object(value);
+        return {
+            name: `${name}@${digest}`,
+            mrtd: register(record.mrtd, "MRTD"),
+            rtmr0: register(record.rtmr0, "RTMR0"),
+        };
+    });
+    if (measurements.length === 0)
+        fail("provenance", "hardware catalog is empty");
+    return measurements;
+}
+function verifyBundle(bundle, repo, tag, digest, roots) {
+    const record = object(bundle);
+    if (record.verificationMaterial !== undefined) {
+        const material = object(record.verificationMaterial);
+        if ("x509CertificateChain" in material)
+            fail("provenance", "legacy bundle format");
+    }
+    const envelope = object(record.dsseEnvelope);
+    const payloadType = string(envelope.payloadType);
+    if (payloadType !== "application/vnd.in-toto+json")
+        fail("provenance", "unexpected DSSE payload type");
+    const payload = decodeCanonicalBase64(string(envelope.payload), "DSSE payload");
+    const signatures = envelope.signatures;
+    if (!Array.isArray(signatures) || signatures.length !== 1)
+        fail("provenance", "expected one DSSE signature");
+    const signature = decodeCanonicalBase64(string(object(signatures[0]).sig), "DSSE signature");
+    const certificate = leafCertificate(record);
+    const pae = Buffer.concat([
+        Buffer.from("DSSEv1 "),
+        Buffer.from(String(Buffer.byteLength(payloadType))),
+        Buffer.from(" "),
+        Buffer.from(payloadType),
+        Buffer.from(" "),
+        Buffer.from(String(payload.length)),
+        Buffer.from(" "),
+        payload,
+    ]);
+    if (!verify("sha256", pae, certificate.publicKey, signature))
+        fail("provenance", "DSSE signature is invalid");
+    const identity = verifyFulcio(certificate, roots.trustedRoot);
+    checkIdentity(identity, repo, tag);
+    const integrated = verifyRekor(record, certificate.raw, signature, payload, identity.notBefore, identity.notAfter, roots.trustedRoot);
+    if (integrated < identity.notBefore || integrated > identity.notAfter) {
+        fail("provenance", "Rekor time is outside the certificate validity");
+    }
+    const statement = object(JSON.parse(payload.toString("utf8")));
+    const subjects = statement.subject;
+    if (!Array.isArray(subjects) || subjects.length === 0)
+        fail("provenance", "statement has no subject");
+    const subjectDigest = object(object(subjects[0]).digest).sha256;
+    if (typeof subjectDigest !== "string" || subjectDigest.toLowerCase() !== digest) {
+        fail("provenance", "subject digest mismatch");
+    }
+    return {
+        predicateType: string(statement.predicateType),
+        predicate: statement.predicate,
+        tag: identity.ref.slice(TAG_PREFIX.length),
+    };
+}
+function leafCertificate(bundle) {
+    const raw = object(object(bundle.verificationMaterial).certificate).rawBytes;
+    return new X509Certificate(decodeCanonicalBase64(string(raw), "signing certificate"));
+}
+function verifyFulcio(leaf, root) {
+    if (!hasKeyUsage(leaf.raw, 0x80) || !hasCodeSigning(leaf.raw)) {
+        fail("provenance", "certificate cannot sign code");
+    }
+    const notBefore = Date.parse(leaf.validFrom) / 1000;
+    const notAfter = Date.parse(leaf.validTo) / 1000;
+    let matched = false;
+    for (const authority of root.certificateAuthorities) {
+        const start = authority.validFor.start === undefined ? undefined : Date.parse(authority.validFor.start) / 1000;
+        const end = authority.validFor.end === undefined ? undefined : Date.parse(authority.validFor.end) / 1000;
+        if ((start !== undefined && notBefore < start) || (end !== undefined && notBefore > end))
+            continue;
+        const certs = authority.certChain.certificates.map((item) => new X509Certificate(Buffer.from(item.rawBytes, "base64")));
+        for (const issuer of certs) {
+            if (leaf.verify(issuer.publicKey) && leaf.checkIssued(issuer)) {
+                verifyAuthority(certs, issuer);
+                matched = true;
+            }
+        }
+    }
+    if (!matched)
+        fail("provenance", "certificate is not signed by a trusted Fulcio authority");
+    return { ...readIdentity(leaf), notBefore, notAfter };
+}
+function verifyAuthority(certs, issuer) {
+    const start = certs.indexOf(issuer);
+    for (let i = start; i < certs.length - 1; i += 1) {
+        const cert = certs[i];
+        const parent = certs[i + 1];
+        if (!cert.verify(parent.publicKey))
+            fail("provenance", "Fulcio chain is invalid");
+    }
+    const last = certs[certs.length - 1];
+    if (!last.verify(last.publicKey))
+        fail("provenance", "Fulcio chain does not end at a root");
+}
+function readIdentity(cert) {
+    const values = new Map();
+    // Extensions are read from the DER so the values are the ones Fulcio signed.
+    for (const [oid, value] of certificateExtensions(cert.raw))
+        values.set(oid, value);
+    const issuer = values.get("1.3.6.1.4.1.57264.1.8") ?? values.get("1.3.6.1.4.1.57264.1.1") ?? "";
+    let repository = values.get("1.3.6.1.4.1.57264.1.5") ?? "";
+    if (repository.length === 0) {
+        repository = (values.get("1.3.6.1.4.1.57264.1.12") ?? "").replace(/^https:\/\/github\.com\//, "");
+    }
+    const workflow = values.get("1.3.6.1.4.1.57264.1.9") ?? "";
+    if (issuer.length === 0 || repository.length === 0 || workflow.length === 0) {
+        fail("provenance", "certificate is missing a Fulcio identity extension");
+    }
+    return {
+        issuer,
+        repository,
+        workflow,
+        runner: values.get("1.3.6.1.4.1.57264.1.11") ?? "",
+        ref: values.get("1.3.6.1.4.1.57264.1.14") ?? "",
+        commit: values.get("1.3.6.1.4.1.57264.1.13") ?? "",
+    };
+}
+function extensionValue(der, oid) {
+    const tbs = sequence(parseDer(der))[0];
+    if (tbs === undefined)
+        return undefined;
+    const extensions = sequence(tbs).find((field) => field.tag === 0xa3);
+    if (extensions === undefined)
+        return undefined;
+    for (const extension of sequence(parseDer(extensions.value))) {
+        const parts = sequence(extension);
+        if (parts[0] !== undefined && decodeOid(parts[0].value) === oid) {
+            return parts.find((part) => part.tag === 0x04)?.value;
+        }
+    }
+    return undefined;
+}
+function hasKeyUsage(der, bit) {
+    const value = extensionValue(der, "2.5.29.15");
+    if (value === undefined || value[0] !== 0x03)
+        return false;
+    const unused = value[2] ?? 8;
+    const data = value[3] ?? 0;
+    return unused < 8 && (data & bit) !== 0;
+}
+function hasCodeSigning(der) {
+    const value = extensionValue(der, "2.5.29.37");
+    return value?.includes(Buffer.from("2b06010505070303", "hex")) ?? false;
+}
+function certificateExtensions(der) {
+    const tbs = sequence(parseDer(der))[0];
+    if (tbs === undefined)
+        return [];
+    const fields = sequence(tbs);
+    const extensions = fields.find((field) => field.tag === 0xa3);
+    if (extensions === undefined)
+        return [];
+    const list = sequence(parseDer(extensions.value));
+    const out = [];
+    for (const extension of list) {
+        const parts = sequence(extension);
+        const oid = parts[0];
+        const value = parts.find((part) => part.tag === 0x04);
+        if (oid === undefined || value === undefined)
+            continue;
+        out.push([decodeOid(oid.value), decodeAsn1String(value.value)]);
+    }
+    return out;
+}
+function decodeAsn1String(bytes) {
+    if (bytes[0] === 0x0c || bytes[0] === 0x16 || bytes[0] === 0x13) {
+        const length = bytes[1] ?? 0;
+        return bytes.subarray(2, 2 + length).toString("utf8");
+    }
+    return bytes.toString("utf8");
+}
+function decodeOid(bytes) {
+    const first = bytes[0] ?? 0;
+    const parts = [Math.floor(first / 40), first % 40];
+    let value = 0;
+    for (const byte of bytes.subarray(1)) {
+        value = (value << 7) | (byte & 0x7f);
+        if ((byte & 0x80) === 0) {
+            parts.push(value);
+            value = 0;
+        }
+    }
+    return parts.join(".");
+}
+function checkIdentity(identity, repo, tag) {
+    if (identity.issuer !== GITHUB_ISSUER)
+        fail("provenance", "certificate is not from GitHub Actions");
+    if (identity.repository !== repo)
+        fail("provenance", "certificate repository does not match");
+    const workflow = new RegExp(`^https://github\\.com/${escapeRegex(repo)}/\\.github/workflows/[^/@]+@refs/tags/[^@]+$`);
+    if (!workflow.test(identity.workflow))
+        fail("provenance", "certificate workflow does not match");
+    if (identity.runner !== "github-hosted")
+        fail("provenance", "build did not run on a GitHub-hosted runner");
+    if (!/^refs\/tags\/[^@]+$/.test(identity.ref))
+        fail("provenance", "build ref is not a tag");
+    if (tag !== undefined && identity.ref !== `${TAG_PREFIX}${tag}`)
+        fail("provenance", "build ref does not match the tag");
+    if (!/^[0-9a-f]{40}$/.test(identity.commit))
+        fail("provenance", "source digest is not a commit SHA");
+}
+function verifyRekor(bundle, certificate, signature, payload, notBefore, notAfter, root) {
+    const entries = object(bundle.verificationMaterial).tlogEntries;
+    if (!Array.isArray(entries) || entries.length !== 1)
+        fail("provenance", "expected one Rekor entry");
+    const entry = object(entries[0]);
+    const integrated = integer(entry.integratedTime);
+    if (integrated < notBefore || integrated > notAfter)
+        fail("provenance", "integrated time is outside the certificate");
+    const body = decodeCanonicalBase64(string(entry.canonicalizedBody), "Rekor body");
+    const parsed = object(JSON.parse(body.toString("utf8")));
+    const kind = object(entry.kindVersion);
+    if (parsed.kind !== kind.kind || parsed.apiVersion !== kind.version)
+        fail("provenance", "Rekor kind does not match");
+    const spec = object(parsed.spec);
+    const logged = object(spec.signatures?.[0]);
+    const loggedCert = new X509Certificate(Buffer.from(decodeCanonicalBase64(string(logged.verifier), "verifier").toString("utf8")));
+    if (!loggedCert.raw.equals(certificate))
+        fail("provenance", "Rekor certificate does not match the bundle");
+    const loggedSig = decodeCanonicalBase64(string(logged.signature), "Rekor signature");
+    if (!loggedSig.equals(signature))
+        fail("provenance", "Rekor signature does not match the bundle");
+    const hash = object(spec.payloadHash);
+    if (hash.algorithm !== "sha256" || hash.value !== sha256(payload).toString("hex")) {
+        fail("provenance", "Rekor payload hash does not match");
+    }
+    const logId = string(object(entry.logId).keyId);
+    const key = rekorKey(root, logId, integrated);
+    const setPayload = `{"body":${JSON.stringify(string(entry.canonicalizedBody))},"integratedTime":${integrated},"logID":"${Buffer.from(logId, "base64").toString("hex")}","logIndex":${integer(entry.logIndex)}}`;
+    const set = decodeCanonicalBase64(string(object(entry.inclusionPromise).signedEntryTimestamp), "SET");
+    if (!verify("sha256", Buffer.from(setPayload), key, set))
+        fail("provenance", "signed entry timestamp is invalid");
+    const proof = object(object(entry.inclusionProof));
+    const checkpoint = verifyCheckpoint(string(object(proof.checkpoint).envelope), key);
+    const rootHash = decodeCanonicalBase64(string(proof.rootHash), "root hash");
+    if (!rootHash.equals(checkpoint))
+        fail("provenance", "inclusion root does not match the checkpoint");
+    const index = integer(proof.logIndex);
+    const size = integer(proof.treeSize);
+    const hashes = proof.hashes.map((item) => decodeCanonicalBase64(string(item), "proof hash"));
+    const leaf = sha256(Buffer.concat([Buffer.from([0]), body]));
+    if (!inclusionRoot(index, leaf, size, hashes).equals(rootHash))
+        fail("provenance", "inclusion proof is invalid");
+    return integrated;
+}
+function rekorKey(root, logId, at) {
+    for (const log of root.tlogs) {
+        if (log.logId.keyId !== logId)
+            continue;
+        const start = log.publicKey.validFor.start === undefined ? undefined : Date.parse(log.publicKey.validFor.start) / 1000;
+        const end = log.publicKey.validFor.end === undefined ? undefined : Date.parse(log.publicKey.validFor.end) / 1000;
+        if ((start !== undefined && at < start) || (end !== undefined && at > end))
+            continue;
+        return createPublicKey({ key: Buffer.from(log.publicKey.rawBytes, "base64"), format: "der", type: "spki" });
+    }
+    fail("provenance", "no Rekor key for this log");
+}
+function verifyCheckpoint(envelope, key) {
+    const [note, signatures] = splitOnce(envelope.trim(), "\n\n");
+    if (signatures === undefined)
+        fail("provenance", "checkpoint has no signature");
+    const lines = note.split("\n");
+    const origin = lines[0];
+    const size = lines[1];
+    const hash = lines[2];
+    if (origin === undefined || size === undefined || hash === undefined)
+        fail("provenance", "bad checkpoint");
+    const other = lines.slice(3).map((line) => `${line}\n`).join("");
+    const message = `${origin}\n${size}\n${hash}\n${other}`;
+    for (const line of signatures.split("\n")) {
+        if (line.trim().length === 0)
+            continue;
+        if (!line.startsWith("—"))
+            fail("provenance", "bad checkpoint signature");
+        const parts = line.split(" ");
+        const raw = Buffer.from(parts[2] ?? "", "base64");
+        if (raw.length <= 4)
+            continue;
+        if (verify("sha256", Buffer.from(message), key, raw.subarray(4)))
+            return Buffer.from(hash, "base64");
+    }
+    fail("provenance", "checkpoint signature is invalid");
+}
+function inclusionRoot(index, leaf, size, proof) {
+    if (index < 0 || index >= size)
+        fail("provenance", "inclusion index is outside the tree");
+    const inner = bitLength(index ^ (size - 1));
+    const border = bitCount(Math.floor(index / 2 ** inner));
+    if (proof.length !== inner + border)
+        fail("provenance", "inclusion proof has the wrong size");
+    let hash = leaf;
+    for (let i = 0; i < inner; i += 1) {
+        const sibling = proof[i];
+        hash = ((index >> i) & 1) === 0 ? node(hash, sibling) : node(sibling, hash);
+    }
+    for (const sibling of proof.slice(inner))
+        hash = node(sibling, hash);
+    return hash;
+}
+function node(left, right) {
+    return sha256(Buffer.concat([Buffer.from([1]), left, right]));
+}
+function bitLength(value) {
+    if (value <= 0)
+        return 0;
+    return Math.floor(Math.log2(value)) + 1;
+}
+function bitCount(value) {
+    let count = 0;
+    let rest = value;
+    while (rest > 0) {
+        count += rest & 1;
+        rest >>>= 1;
+    }
+    return count;
+}
+function integer(value) {
+    const parsed = typeof value === "number" ? value : typeof value === "string" ? Number(value) : NaN;
+    if (!Number.isSafeInteger(parsed) || parsed < 0)
+        fail("provenance", "expected an unsigned integer");
+    return parsed;
+}
+function splitOnce(value, separator) {
+    const index = value.indexOf(separator);
+    if (index < 0)
+        return [value, undefined];
+    return [value.slice(0, index), value.slice(index + separator.length)];
+}
+function register(value, name) {
+    const length = name === "SNP" ? 96 : 96;
+    if (typeof value !== "string" || value.length !== length || !/^[0-9a-f]+$/.test(value)) {
+        fail("provenance", `${name} is malformed`);
+    }
+    return value;
+}
+function object(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        fail("provenance", "expected an object");
+    return value;
+}
+function string(value) {
+    if (typeof value !== "string")
+        fail("provenance", "expected a string");
+    return value;
+}
+function escapeRegex(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+//# sourceMappingURL=sigstore.js.map

package/dist/sigstore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigstore.js","sourceRoot":"","sources":["../src/sigstore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAEvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,eAAe,MAAM,qBAAqB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAExE,MAAM,aAAa,GAAG,6CAA6C,CAAC;AACpE,MAAM,UAAU,GAAG,YAAY,CAAC;AAChC,MAAM,SAAS,GAAG,uDAAuD,CAAC;AAC1E,MAAM,kBAAkB,GAAG,uDAAuD,CAAC;AAanF,MAAM,WAAW,GAAG,eAA4B,CAAC;AAoBjD,MAAM,UAAU,UAAU,CACxB,MAAe,EACf,IAAY,EACZ,GAAuB,EACvB,MAAc,EACd,QAAuB,EAAE,WAAW,EAAE;IAEtC,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACjE,IAAI,SAAS,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,EAAE,4BAA4B,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC9C,OAAO;QACL,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,MAAM;QACN,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC;QAC/C,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC;QACnC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,MAAe,EACf,IAAY,EACZ,MAAc,EACd,QAAuB,EAAE,WAAW,EAAE;IAEtC,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACvE,IAAI,SAAS,CAAC,aAAa,KAAK,kBAAkB;QAAE,IAAI,CAAC,YAAY,EAAE,gCAAgC,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;QACjE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,GAAG,IAAI,IAAI,MAAM,EAAE;YACzB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;YACnC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC;SACvC,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;IAC/E,OAAO,YAAY,CAAC;AACtB,CAAC;AAQD,SAAS,YAAY,CACnB,MAAe,EACf,IAAY,EACZ,GAAuB,EACvB,MAAc,EACd,KAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrD,IAAI,sBAAsB,IAAI,QAAQ;YAAE,IAAI,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,WAAW,KAAK,8BAA8B;QAAE,IAAI,CAAC,YAAY,EAAE,8BAA8B,CAAC,CAAC;IACvG,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC;IAChF,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;IAC7G,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC7F,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAChB,OAAO;KACR,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC;QAAE,IAAI,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9D,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACtI,IAAI,UAAU,GAAG,QAAQ,CAAC,SAAS,IAAI,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtE,IAAI,CAAC,YAAY,EAAE,gDAAgD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC;IACtG,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAChE,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QAChF,IAAI,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;IAChD,CAAC;IACD,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC;QAC9C,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;KAC3C,CAAC;AACJ,CAAC;AAaD,SAAS,eAAe,CAAC,MAA+B;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;IAC7E,OAAO,IAAI,eAAe,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,YAAY,CAAC,IAAqB,EAAE,IAAe;IAC1D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,YAAY,EAAE,8BAA8B,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IACjD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC/G,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACzG,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,SAAS,GAAG,GAAG,CAAC;YAAE,SAAS;QACnG,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxH,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9D,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC/B,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,YAAY,EAAE,yDAAyD,CAAC,CAAC;IAC5F,OAAO,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,eAAe,CAAC,KAAwB,EAAE,MAAuB;IACxE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACtC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,IAAI,CAAC,YAAY,EAAE,qCAAqC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,YAAY,CAAC,IAAqB;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,6EAA6E;IAC7E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC;IAChG,IAAI,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC;IAC3D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,UAAU,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,YAAY,EAAE,oDAAoD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO;QACL,MAAM;QACN,UAAU;QACV,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,EAAE;QAClD,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,EAAE;QAC/C,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,EAAE;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,GAAW;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IACrE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/C,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YAChE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,KAAK,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,GAAW;IAC3C,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC/C,OAAO,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC;AAC1E,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IAC9D,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACtD,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACvD,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,KAAK,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,aAAa,CAAC,QAAkD,EAAE,IAAY,EAAE,GAAuB;IAC9G,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa;QAAE,IAAI,CAAC,YAAY,EAAE,wCAAwC,CAAC,CAAC;IACpG,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI;QAAE,IAAI,CAAC,YAAY,EAAE,uCAAuC,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,IAAI,MAAM,CACzB,yBAAyB,WAAW,CAAC,IAAI,CAAC,8CAA8C,CACzF,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,YAAY,EAAE,qCAAqC,CAAC,CAAC;IACjG,IAAI,QAAQ,CAAC,MAAM,KAAK,eAAe;QAAE,IAAI,CAAC,YAAY,EAAE,6CAA6C,CAAC,CAAC;IAC3G,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;IAC5F,IAAI,GAAG,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,UAAU,GAAG,GAAG,EAAE;QAAE,IAAI,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;IACxH,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,YAAY,EAAE,mCAAmC,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,WAAW,CAClB,MAA+B,EAC/B,WAAmB,EACnB,SAAiB,EACjB,OAAe,EACf,SAAiB,EACjB,QAAgB,EAChB,IAAe;IAEf,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,WAAW,CAAC;IAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC;IACpG,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACjD,IAAI,UAAU,GAAG,SAAS,IAAI,UAAU,GAAG,QAAQ;QAAE,IAAI,CAAC,YAAY,EAAE,4CAA4C,CAAC,CAAC;IACtH,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,YAAY,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;IACrH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,UAAwB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;QAAE,IAAI,CAAC,YAAY,EAAE,6CAA6C,CAAC,CAAC;IAC3G,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACrF,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,IAAI,CAAC,YAAY,EAAE,2CAA2C,CAAC,CAAC;IAClG,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClF,IAAI,CAAC,YAAY,EAAE,mCAAmC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,qBAAqB,UAAU,aAAa,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;IAChN,MAAM,GAAG,GAAG,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAAC,CAAC;IACtG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC;QAAE,IAAI,CAAC,YAAY,EAAE,mCAAmC,CAAC,CAAC;IAClH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;IAC5E,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,YAAY,EAAE,8CAA8C,CAAC,CAAC;IACrG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,MAAM,GAAI,KAAK,CAAC,MAAoB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;IAC5G,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,YAAY,EAAE,4BAA4B,CAAC,CAAC;IACjH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAe,EAAE,KAAa,EAAE,EAAU;IAC1D,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK;YAAE,SAAS;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QACvH,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACjH,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,GAAG,CAAC;YAAE,SAAS;QACrF,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,GAAc;IACxD,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IAC3G,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,GAAG,MAAM,KAAK,IAAI,KAAK,IAAI,KAAK,KAAK,EAAE,CAAC;IACxD,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC;YAAE,SAAS;QAC9B,IAAI,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,iCAAiC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY,EAAE,IAAY,EAAE,KAAe;IAC/E,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI;QAAE,IAAI,CAAC,YAAY,EAAE,qCAAqC,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,GAAG,MAAM;QAAE,IAAI,CAAC,YAAY,EAAE,oCAAoC,CAAC,CAAC;IAC9F,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,KAAa;IACvC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;QAChB,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC;QAClB,IAAI,MAAM,CAAC,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACnG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,YAAY,EAAE,8BAA8B,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,SAAiB;IACjD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACzC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,IAAY;IAC5C,MAAM,MAAM,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvF,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;IAClH,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC"}