@attestplane/attestplane 0.0.1 → 0.0.3-alpha

package/dist/canonical_text.js

@@ -0,0 +1,100 @@
+// SPDX-FileCopyrightText: 2026 The Attestplane Authors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Canonical text normalizer (TypeScript port of
+ * `sdk/python/src/attestplane/canonical_text.py`).
+ *
+ * Cross-language byte stable with the Python reference implementation
+ * across the conformance vectors in
+ * `sdk/python/tests/conformance/text_vectors.json`.
+ *
+ * Four-stage algorithm locked by `docs/spec/canonical-text-v1.md`:
+ *   1. NFC normalize
+ *   2. Unicode default lowercase
+ *   3. Zero-width strip (U+200B, U+200C, U+200D, U+FEFF)
+ *   4. Whitespace fold (split on \s+, rejoin with single space, trim)
+ */
+import { createHash } from 'node:crypto';
+const ZERO_WIDTH_CODE_POINTS = new Set([0x200b, 0x200c, 0x200d, 0xfeff]);
+export class CanonicalTextError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CanonicalTextError';
+    }
+}
+function rejectForbiddenCodePoints(text) {
+    for (let i = 0; i < text.length; i++) {
+        const code = text.charCodeAt(i);
+        if (code === 0) {
+            throw new CanonicalTextError('input contains U+0000 (null) — forbidden');
+        }
+        // Detect unpaired surrogates: a high surrogate not followed by a low,
+        // or a low surrogate not preceded by a high.
+        if (code >= 0xd800 && code <= 0xdbff) {
+            const next = i + 1 < text.length ? text.charCodeAt(i + 1) : 0;
+            if (next < 0xdc00 || next > 0xdfff) {
+                throw new CanonicalTextError(`input contains unpaired surrogate U+${code.toString(16).toUpperCase().padStart(4, '0')} — forbidden`);
+            }
+            i++; // skip the paired low surrogate
+        }
+        else if (code >= 0xdc00 && code <= 0xdfff) {
+            throw new CanonicalTextError(`input contains unpaired surrogate U+${code.toString(16).toUpperCase().padStart(4, '0')} — forbidden`);
+        }
+    }
+}
+function stripZeroWidth(text) {
+    // Iterate by code point to be robust under astral planes.
+    let out = '';
+    for (const ch of text) {
+        const cp = ch.codePointAt(0);
+        if (cp != null && !ZERO_WIDTH_CODE_POINTS.has(cp)) {
+            out += ch;
+        }
+    }
+    return out;
+}
+function foldWhitespace(text) {
+    // `/\s+/u` matches any run of Unicode whitespace (with the `u` flag);
+    // splitting then rejoining with single ASCII space is the analogue of
+    // Python's `" ".join(text.split())`. Edge empty strings filter out.
+    const parts = text.split(/\s+/u).filter((s) => s.length > 0);
+    return parts.join(' ');
+}
+/**
+ * Return the canonical UTF-8 bytes of `text`.
+ *
+ * Pure, deterministic, cross-language byte stable across the
+ * conformance-vector set. Identical inputs in Python and TypeScript
+ * implementations produce identical output bytes.
+ */
+export function canonicalizeText(text) {
+    if (typeof text !== 'string') {
+        throw new CanonicalTextError(`canonicalizeText expects string, got ${typeof text}`);
+    }
+    rejectForbiddenCodePoints(text);
+    // Stage 1: NFC normalization.
+    const nfc = text.normalize('NFC');
+    // Stage 2: Unicode default lowercase. JavaScript's toLowerCase() applies
+    // the Default Case Conversion (no locale), matching Python's str.lower()
+    // for the ASCII / common-Latin subset documented in the spec.
+    const lowered = nfc.toLowerCase();
+    // Stage 3: zero-width strip.
+    const stripped = stripZeroWidth(lowered);
+    // Stage 4: whitespace fold.
+    const folded = foldWhitespace(stripped);
+    return new TextEncoder().encode(folded);
+}
+/** SHA-256 of `canonicalizeText(text)`. Returns 32 raw bytes. */
+export function textHash(text) {
+    return new Uint8Array(createHash('sha256').update(canonicalizeText(text)).digest());
+}
+/** Lowercase hex form of `textHash`. */
+export function textHashHex(text) {
+    const bytes = textHash(text);
+    let out = '';
+    for (let i = 0; i < bytes.length; i++) {
+        out += bytes[i].toString(16).padStart(2, '0');
+    }
+    return out;
+}
+//# sourceMappingURL=canonical_text.js.map

package/dist/canonical_text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical_text.js","sourceRoot":"","sources":["../src/canonical_text.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,sCAAsC;AACtC;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEzE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAAC,0CAA0C,CAAC,CAAC;QAC3E,CAAC;QACD,sEAAsE;QACtE,6CAA6C;QAC7C,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,IAAI,GAAG,MAAM,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;gBACnC,MAAM,IAAI,kBAAkB,CAC1B,uCAAuC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,cAAc,CACtG,CAAC;YACJ,CAAC;YACD,CAAC,EAAE,CAAC,CAAC,gCAAgC;QACvC,CAAC;aAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YAC5C,MAAM,IAAI,kBAAkB,CAC1B,uCAAuC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,cAAc,CACtG,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,0DAA0D;IAC1D,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAClD,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,sEAAsE;IACtE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,kBAAkB,CAAC,wCAAwC,OAAO,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAEhC,8BAA8B;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAElC,yEAAyE;IACzE,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAElC,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAEzC,4BAA4B;IAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAExC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,IAAK,KAAK,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/der.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Minimal DER (Distinguished Encoding Rules) reader.
+ *
+ * Scope: enough to parse RFC-3161 TimeStampResp, RFC-5652 CMS
+ * SignedData, RFC-3161 TSTInfo, and the subset of X.509 needed to
+ * extract a leaf RSA public key. Hand-rolled rather than pulling in a
+ * full ASN.1 library — we read sequentially and extract specific
+ * fields by tag.
+ *
+ * Not a general-purpose ASN.1 library. Does NOT handle indefinite-
+ * length encodings (forbidden in DER anyway), does NOT validate every
+ * field's tag, does NOT handle constructed BIT STRINGs.
+ *
+ * Reading discipline: every parse function takes a Uint8Array and
+ * returns either the parsed value or throws DerParseError. The
+ * caller knows the expected structure from the spec.
+ */
+export declare class DerParseError extends Error {
+    constructor(message: string);
+}
+/** Parsed TLV (Tag-Length-Value) chunk. */
+export interface DerTlv {
+    /** ASN.1 tag byte (0x30 for SEQUENCE, 0x02 for INTEGER, etc.). */
+    readonly tag: number;
+    /** Length of the value portion (in bytes). */
+    readonly length: number;
+    /** Offset within the original buffer where the value starts. */
+    readonly valueStart: number;
+    /** Offset where this TLV ends (valueStart + length). */
+    readonly end: number;
+    /** Reference into the original buffer. */
+    readonly buffer: Uint8Array;
+}
+/** Read one TLV starting at `offset` in `buffer`. */
+export declare function readTlv(buffer: Uint8Array, offset: number): DerTlv;
+/** Read sequential TLVs inside a SEQUENCE/SET value. */
+export declare function readSequence(tlv: DerTlv): DerTlv[];
+/** Return the raw value bytes of a TLV (a fresh slice). */
+export declare function getValueBytes(tlv: DerTlv): Uint8Array;
+/** Decode an INTEGER. Throws if larger than safe integer range. */
+export declare function readInteger(tlv: DerTlv): bigint;
+/** Decode an OID. */
+export declare function readOid(tlv: DerTlv): string;
+/** Decode an OCTET STRING. */
+export declare function readOctetString(tlv: DerTlv): Uint8Array;
+/** Decode a BIT STRING. Returns the raw bits (without the leading "unused bits" byte). */
+export declare function readBitString(tlv: DerTlv): {
+    unusedBits: number;
+    bytes: Uint8Array;
+};
+/** Decode a GeneralizedTime to a Date. Format: YYYYMMDDhhmmss[.uuuuuu]Z. */
+export declare function readGeneralizedTime(tlv: DerTlv): Date;
+/** Return the DER bytes of this TLV (including tag+length+value). */
+export declare function tlvDer(tlv: DerTlv): Uint8Array;
+//# sourceMappingURL=der.d.ts.map

package/dist/der.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"der.d.ts","sourceRoot":"","sources":["../src/der.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AAEH,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,EAAE,MAAM;CAI5B;AAED,2CAA2C;AAC3C,MAAM,WAAW,MAAM;IACrB,kEAAkE;IAClE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED,qDAAqD;AACrD,wBAAgB,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAmClE;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CASlD;AAED,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAErD;AAED,mEAAmE;AACnE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAa/C;AAED,qBAAqB;AACrB,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAwB3C;AAED,8BAA8B;AAC9B,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAKvD;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAUpF;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAwBrD;AAED,qEAAqE;AACrE,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAM9C"}

package/dist/der.js

@@ -0,0 +1,200 @@
+// SPDX-FileCopyrightText: 2026 The Attestplane Authors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Minimal DER (Distinguished Encoding Rules) reader.
+ *
+ * Scope: enough to parse RFC-3161 TimeStampResp, RFC-5652 CMS
+ * SignedData, RFC-3161 TSTInfo, and the subset of X.509 needed to
+ * extract a leaf RSA public key. Hand-rolled rather than pulling in a
+ * full ASN.1 library — we read sequentially and extract specific
+ * fields by tag.
+ *
+ * Not a general-purpose ASN.1 library. Does NOT handle indefinite-
+ * length encodings (forbidden in DER anyway), does NOT validate every
+ * field's tag, does NOT handle constructed BIT STRINGs.
+ *
+ * Reading discipline: every parse function takes a Uint8Array and
+ * returns either the parsed value or throws DerParseError. The
+ * caller knows the expected structure from the spec.
+ */
+export class DerParseError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'DerParseError';
+    }
+}
+/** Read one TLV starting at `offset` in `buffer`. */
+export function readTlv(buffer, offset) {
+    if (offset >= buffer.length) {
+        throw new DerParseError(`offset ${offset} past end of buffer (${buffer.length})`);
+    }
+    const tag = buffer[offset];
+    let cursor = offset + 1;
+    if (cursor >= buffer.length) {
+        throw new DerParseError('truncated: missing length byte');
+    }
+    let length;
+    const firstLen = buffer[cursor];
+    cursor += 1;
+    if ((firstLen & 0x80) === 0) {
+        length = firstLen;
+    }
+    else {
+        const lenBytes = firstLen & 0x7f;
+        if (lenBytes === 0) {
+            throw new DerParseError('indefinite-length form not allowed in DER');
+        }
+        if (lenBytes > 4) {
+            throw new DerParseError(`length field too large (${lenBytes} bytes)`);
+        }
+        if (cursor + lenBytes > buffer.length) {
+            throw new DerParseError('truncated: length octets extend past buffer');
+        }
+        length = 0;
+        for (let i = 0; i < lenBytes; i++) {
+            length = (length << 8) | buffer[cursor + i];
+        }
+        cursor += lenBytes;
+    }
+    if (cursor + length > buffer.length) {
+        throw new DerParseError(`truncated: value of length ${length} extends past buffer end`);
+    }
+    return { tag, length, valueStart: cursor, end: cursor + length, buffer };
+}
+/** Read sequential TLVs inside a SEQUENCE/SET value. */
+export function readSequence(tlv) {
+    const out = [];
+    let cursor = tlv.valueStart;
+    while (cursor < tlv.end) {
+        const item = readTlv(tlv.buffer, cursor);
+        out.push(item);
+        cursor = item.end;
+    }
+    return out;
+}
+/** Return the raw value bytes of a TLV (a fresh slice). */
+export function getValueBytes(tlv) {
+    return tlv.buffer.slice(tlv.valueStart, tlv.end);
+}
+/** Decode an INTEGER. Throws if larger than safe integer range. */
+export function readInteger(tlv) {
+    if (tlv.tag !== 0x02) {
+        throw new DerParseError(`expected INTEGER (0x02), got tag 0x${tlv.tag.toString(16)}`);
+    }
+    let result = 0n;
+    for (let i = 0; i < tlv.length; i++) {
+        result = (result << 8n) | BigInt(tlv.buffer[tlv.valueStart + i]);
+    }
+    // Two's complement for signed: if high bit set, subtract.
+    if (tlv.length > 0 && (tlv.buffer[tlv.valueStart] & 0x80) !== 0) {
+        result -= 1n << BigInt(tlv.length * 8);
+    }
+    return result;
+}
+/** Decode an OID. */
+export function readOid(tlv) {
+    if (tlv.tag !== 0x06) {
+        throw new DerParseError(`expected OBJECT IDENTIFIER (0x06), got tag 0x${tlv.tag.toString(16)}`);
+    }
+    const bytes = tlv.buffer;
+    const start = tlv.valueStart;
+    const end = tlv.end;
+    if (end <= start)
+        return '';
+    const first = bytes[start];
+    const arc1 = Math.floor(first / 40);
+    const arc2 = first % 40;
+    const arcs = [String(arc1), String(arc2)];
+    let i = start + 1;
+    while (i < end) {
+        let value = 0n;
+        while (i < end) {
+            const b = bytes[i];
+            i += 1;
+            value = (value << 7n) | BigInt(b & 0x7f);
+            if ((b & 0x80) === 0)
+                break;
+        }
+        arcs.push(value.toString());
+    }
+    return arcs.join('.');
+}
+/** Decode an OCTET STRING. */
+export function readOctetString(tlv) {
+    if (tlv.tag !== 0x04) {
+        throw new DerParseError(`expected OCTET STRING (0x04), got tag 0x${tlv.tag.toString(16)}`);
+    }
+    return getValueBytes(tlv);
+}
+/** Decode a BIT STRING. Returns the raw bits (without the leading "unused bits" byte). */
+export function readBitString(tlv) {
+    if (tlv.tag !== 0x03) {
+        throw new DerParseError(`expected BIT STRING (0x03), got tag 0x${tlv.tag.toString(16)}`);
+    }
+    if (tlv.length === 0) {
+        throw new DerParseError('BIT STRING is empty');
+    }
+    const unusedBits = tlv.buffer[tlv.valueStart];
+    const bytes = tlv.buffer.slice(tlv.valueStart + 1, tlv.end);
+    return { unusedBits, bytes };
+}
+/** Decode a GeneralizedTime to a Date. Format: YYYYMMDDhhmmss[.uuuuuu]Z. */
+export function readGeneralizedTime(tlv) {
+    if (tlv.tag !== 0x18) {
+        throw new DerParseError(`expected GeneralizedTime (0x18), got tag 0x${tlv.tag.toString(16)}`);
+    }
+    const text = new TextDecoder('ascii').decode(getValueBytes(tlv));
+    // Strict: must end with Z.
+    if (!text.endsWith('Z')) {
+        throw new DerParseError(`GeneralizedTime not in UTC Z form: ${text}`);
+    }
+    const stripped = text.slice(0, -1);
+    // Match YYYYMMDDhhmmss with optional fractional seconds.
+    const m = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(?:\.(\d+))?$/.exec(stripped);
+    if (!m) {
+        throw new DerParseError(`GeneralizedTime not parseable: ${text}`);
+    }
+    const [, yy, mo, dd, hh, mi, ss, frac] = m;
+    // Build a JS Date in UTC. JS uses ms precision; truncate sub-ms.
+    const isoFrac = frac ? `.${frac.slice(0, 3).padEnd(3, '0')}` : '';
+    const iso = `${yy}-${mo}-${dd}T${hh}:${mi}:${ss}${isoFrac}Z`;
+    const d = new Date(iso);
+    if (Number.isNaN(d.getTime())) {
+        throw new DerParseError(`GeneralizedTime produced invalid Date: ${text}`);
+    }
+    return d;
+}
+/** Return the DER bytes of this TLV (including tag+length+value). */
+export function tlvDer(tlv) {
+    // Find the start of this TLV. We track valueStart but tag is at the
+    // position before length-bytes; reconstruct by walking back.
+    // Easier: build from the buffer using known offsets.
+    const tagAt = _tagOffsetOf(tlv);
+    return tlv.buffer.slice(tagAt, tlv.end);
+}
+function _tagOffsetOf(tlv) {
+    // We know valueStart and length and the buffer. Walk back from
+    // valueStart to find the tag offset: there is exactly 1 byte for the
+    // tag, then 1 or more length bytes.
+    // length-form bytes count: length < 0x80 → 1 byte; else 1 + (firstLen & 0x7f).
+    // We can compute this from the recorded length.
+    // Actually it's simpler: tagOffset = valueStart - 1 - lenOctets.
+    let lenOctets;
+    if (tlv.length < 0x80) {
+        lenOctets = 1;
+    }
+    else if (tlv.length < 0x100) {
+        lenOctets = 2;
+    }
+    else if (tlv.length < 0x10000) {
+        lenOctets = 3;
+    }
+    else if (tlv.length < 0x1000000) {
+        lenOctets = 4;
+    }
+    else {
+        lenOctets = 5;
+    }
+    return tlv.valueStart - lenOctets - 1;
+}
+//# sourceMappingURL=der.js.map

package/dist/der.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"der.js","sourceRoot":"","sources":["../src/der.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,sCAAsC;AACtC;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAgBD,qDAAqD;AACrD,MAAM,UAAU,OAAO,CAAC,MAAkB,EAAE,MAAc;IACxD,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,aAAa,CAAC,UAAU,MAAM,wBAAwB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAW,CAAC;IACrC,IAAI,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC;IACxB,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,aAAa,CAAC,gCAAgC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,MAAc,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAW,CAAC;IAC1C,MAAM,IAAI,CAAC,CAAC;IACZ,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAC;QACjC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,aAAa,CAAC,2CAA2C,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,aAAa,CAAC,2BAA2B,QAAQ,SAAS,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,aAAa,CAAC,6CAA6C,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,GAAG,CAAC,CAAC;QACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAY,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,aAAa,CAAC,8BAA8B,MAAM,0BAA0B,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;AAC3E,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC;IAC5B,OAAO,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,aAAa,CAAC,sCAAsC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,CAAW,CAAC,CAAC;IAC7E,CAAC;IACD,0DAA0D;IAC1D,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAY,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qBAAqB;AACrB,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,aAAa,CAAC,gDAAgD,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC;IACzB,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;IAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,GAAG,IAAI,KAAK;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAW,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;IACxB,MAAM,IAAI,GAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAClB,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC;QACf,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;YAC7B,CAAC,IAAI,CAAC,CAAC;YACP,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM;QAC9B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED,8BAA8B;AAC9B,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,aAAa,CAAC,2CAA2C,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,aAAa,CAAC,yCAAyC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,aAAa,CAAC,qBAAqB,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAW,CAAC;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5D,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,aAAa,CAAC,8CAA8C,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,2BAA2B;IAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,aAAa,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnC,yDAAyD;IACzD,MAAM,CAAC,GAAG,0DAA0D,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpF,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,GAAG,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,GAAG,CAAC;IAC7D,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,aAAa,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,oEAAoE;IACpE,6DAA6D;IAC7D,qDAAqD;IACrD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,+DAA+D;IAC/D,qEAAqE;IACrE,oCAAoC;IACpC,+EAA+E;IAC/E,gDAAgD;IAChD,iEAAiE;IACjE,IAAI,SAAiB,CAAC;IACtB,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACtB,SAAS,GAAG,CAAC,CAAC;IAChB,CAAC;SAAM,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QAC9B,SAAS,GAAG,CAAC,CAAC;IAChB,CAAC;SAAM,IAAI,GAAG,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;QAChC,SAAS,GAAG,CAAC,CAAC;IAChB,CAAC;SAAM,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAClC,SAAS,GAAG,CAAC,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC,UAAU,GAAG,SAAS,GAAG,CAAC,CAAC;AACxC,CAAC"}

package/dist/event_payloads.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Event-payload interfaces + validators per ADR-0009 Mode A.6.
+ *
+ * Each interface here describes the **payload slot** of an `AuditEvent`
+ * for one v1 `event_type` (per `./event_types.ts` / ADR-0008). The
+ * substrate's `ChainedEvent` shape stays frozen — INV 2. Payload
+ * schemas are versioned independently of `chain.schema_version` /
+ * `anchor_schema_version` / `signature_schema_version` /
+ * `reason_code_schema_version`.
+ *
+ * Each payload schema also defines a small `validate*()` function that
+ * rejects malformed payloads (wrong types, missing required fields,
+ * forbidden field names per ADR-0004 § 2 column 3).
+ */
+/**
+ * Per ADR-0004 § 2 column 3 + ADR-0009 § 1 Mode A.6 redaction policy.
+ * Payload field names that MUST NEVER appear at the root of any event
+ * payload.
+ */
+export declare const FORBIDDEN_PAYLOAD_FIELDS: ReadonlySet<string>;
+export declare class PayloadValidationError extends Error {
+    constructor(message: string);
+}
+export type LeaseLifecycle = 'granted' | 'consumed' | 'expired' | 'revoked';
+/**
+ * Payload shape for the `lease_lifecycle_event` event_type.
+ *
+ * Schema-shape re-issue (Mode A.6 per ADR-0009 § 1) of fields
+ * originally observed at `~/aios/crates/aios-sdk-evidence/src/artifact.rs`
+ * and `~/aios/schemas/lease/lease.schema.json`. Authority-bearing
+ * fields (`signature`, `capability_required`, `budget_cap`, `hmac`)
+ * are explicitly NOT absorbed.
+ */
+export interface LeaseLifecycleEventPayload {
+    readonly lease_event_schema_version: 1;
+    readonly lease_id_hash: string;
+    readonly lifecycle: LeaseLifecycle;
+    readonly observed_at: string;
+    readonly grantor_runtime_id?: string;
+    readonly tenant_id_ref?: string;
+    readonly step_id_ref?: string;
+    readonly run_id_ref?: string;
+    readonly artifact_hash_ref?: string;
+    readonly reason_code?: string;
+    readonly reason_text?: string;
+}
+/**
+ * Throw `PayloadValidationError` if `payload` violates A.7 invariants.
+ *
+ * Mirrors `validate_lease_lifecycle_event_payload` in Python.
+ */
+export declare function validateLeaseLifecycleEventPayload(payload: unknown): void;
+export type PolicyDecision = 'allow' | 'deny' | 'abstain' | 'require_approval';
+export type PolicyEffect = 'INFO' | 'WARN' | 'BLOCK';
+/**
+ * Payload shape for the `policy_check_event` event_type.
+ *
+ * Schema-shape re-issue (Mode A.6 per ADR-0009 § 1) of fields
+ * originally observed at `~/aios/schemas/policy/policy.schema.json`.
+ * Authority lifecycle fields (`expression` body / `PolicyUpdateCandidate`
+ * / `activated_at` / `deprecated_at`) are explicitly NOT absorbed —
+ * ADR-0004 § 2 case #10 keeps expression as hash only.
+ */
+export interface PolicyCheckEventPayload {
+    readonly policy_event_schema_version: 1;
+    readonly policy_id: string;
+    readonly rule_id: string;
+    readonly decision: PolicyDecision;
+    readonly observed_at: string;
+    readonly policy_version?: number;
+    readonly kind?: string;
+    readonly effect?: PolicyEffect;
+    readonly expression_hash?: string;
+    readonly evidence_refs?: readonly string[];
+    readonly reason_code?: string;
+    readonly reason_text?: string;
+}
+/**
+ * Throw `PayloadValidationError` if `payload` violates A.8 invariants.
+ *
+ * Mirrors `validate_policy_check_event_payload` in Python.
+ */
+export declare function validatePolicyCheckEventPayload(payload: unknown): void;
+/**
+ * Payload shape for the `replay_event` event_type.
+ *
+ * Schema-shape re-issue (Mode A.6 per ADR-0009 § 1 + A.9) of fields
+ * observed at `~/aios/crates/aios-sdk-evidence/src/replay.rs` +
+ * `~/aios/schemas/replay/replay_proof.schema.json`. Records that an
+ * external runner observed the four boolean outcomes of a replay.
+ * Attestplane substrate does NOT re-execute — replay execution lives
+ * in REDLINE C.13 `aios-replay-runner`.
+ *
+ * The `deterministic_result` field MUST equal the logical AND of
+ * `input_hash_match`, `artifact_hash_match`, `audit_chain_match`.
+ * Validators enforce this cross-check.
+ */
+export interface ReplayEventPayload {
+    readonly replay_event_schema_version: 1;
+    readonly replay_run_id: string;
+    readonly original_run_id: string;
+    readonly input_hash_match: boolean;
+    readonly artifact_hash_match: boolean;
+    readonly audit_chain_match: boolean;
+    readonly deterministic_result: boolean;
+    readonly observed_at: string;
+    readonly snapshot_id_ref?: string;
+    readonly diff_summary_hash?: string;
+    readonly reason_code?: string;
+    readonly reason_text?: string;
+}
+/**
+ * Throw `PayloadValidationError` if `payload` violates A.9 invariants.
+ *
+ * Mirrors `validate_replay_event_payload` in Python.
+ */
+export declare function validateReplayEventPayload(payload: unknown): void;
+//# sourceMappingURL=event_payloads.d.ts.map

package/dist/event_payloads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event_payloads.d.ts","sourceRoot":"","sources":["../src/event_payloads.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAKH;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAkBvD,CAAC;AAEH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAwED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,0BAA0B,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AA6BD;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsDzE;AAID,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,kBAAkB,CAAC;AAE/E,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAErD;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,2BAA2B,EAAE,CAAC,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAiCD;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA6FtE;AAID;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,2BAA2B,EAAE,CAAC,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AA2BD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA4EjE"}