@coderifts/agent-guard 17.2.0 → 17.3.1

package/dist/cjs/vendor/verify-evidence.js

@@ -36,8 +36,18 @@ const crypto = require('node:crypto');
 const { verifyReceipt, keyringFromDocument } = require('./verify.js');
 const { verifyExecutionGrant } = require('./verify-grant.js');
 const { verifyProveTranscript } = require('./verify-prove-transcript.js');
+const {
+  ROOT_V, SLOTS, SLOT_NAMES, digestToken, verifyEvidenceRoot, canonicalJson,
+} = require('./evidence-root.js');
 
 const CORRELATION_V = 'cr.exec.correlation.v1';
+
+/**
+ * The version four consumers must agree on. `verifyEvidenceRootBinding` returns it, so "prove,
+ * conformance, the guard and the provider all ran the same library" is something a report can
+ * SHOW rather than assert. Bump it when a check is added, removed or changed in meaning.
+ */
+const LIBRARY_VERSION = 'cr.evidence-verifier.1';
 const US = '\x1f';
 
 /** The slots this verifier knows how to authenticate. */
@@ -227,7 +237,169 @@ function verifyEvidenceEnvelope(artifact, o = {}) {
   return { ok: failures.length === 0, slots, failures };
 }
 
+/**
+ * THE ROOT CHECK — is this set of tokens ONE run?
+ *
+ * Ten questions, in the order a reader would ask them. Each is answered against something the
+ * producer signed, never against a value copied out of the thing being checked.
+ *
+ *  1  the root's own signature verifies against the executor key
+ *  2  every mandatory slot is present in the root (absence is refused, not skipped)
+ *  3  every token PRESENT in the envelope has the EXACT byte digest the root recorded
+ *  4  every token the root records is present to be checked, or named as unavailable
+ *  5  the grant's claims match the root's claims (grant_id, scope, policy)
+ *  6  grant.receipt_hash === sha256(the chain_receipt bytes actually carried)
+ *  7  grant_id === the consumed jti === the attested jti
+ *  8  run_id === the transcript's run_id === the correlation's scope binding
+ *  9  the outer artifact's summaries agree with what the tokens say
+ * 10  the verifier reports its own version, so four consumers can be shown to run one library
+ *
+ * @param {object} artifact
+ * @param {object} o
+ * @param {import('crypto').KeyObject} o.executorKey  the key the root and correlation are signed with
+ * @param {object} [o.sidecars]  tokens the artifact does not carry but the caller holds, by slot
+ *                               name (e.g. provider_readback bytes, atomic_attestation token)
+ */
+function verifyEvidenceRootBinding(artifact, o = {}) {
+  const failures = [];
+  const checks = [];
+  const note = (id, ok, detail) => { checks.push({ id, ok, detail }); if (!ok) failures.push(detail); };
+
+  const root = artifact && artifact.evidence_root;
+  if (!root) {
+    return {
+      ok: false,
+      present: false,
+      library: LIBRARY_VERSION,
+      checks: [],
+      failures: ['cross_run_collage: the artifact carries no cr.evidence.root.v1, so nothing binds '
+        + 'its tokens to ONE run'],
+    };
+  }
+
+  // 1 — the root's own signature.
+  const rv = verifyEvidenceRoot(root, o.executorKey);
+  note('root_signature', rv.valid,
+    rv.valid ? 'the evidence root is signed by the executor key'
+      : `the evidence root signature does not verify (${rv.status}: ${rv.reason})`);
+  // Everything below reads the root. A root that does not verify is not a source of truth about
+  // anything, so the remaining checks are not run rather than run against unsigned values.
+  if (!rv.valid) return { ok: false, present: true, library: LIBRARY_VERSION, checks, failures };
+
+  // The tokens as they travel, by slot. Sidecars are tokens the artifact does not republish but
+  // the caller holds — the provider readback is one, and binding it is what stops a readback from
+  // another run being paired with this artifact.
+  const carried = {
+    chain_receipt: artifact.issuance && artifact.issuance.chain_receipt,
+    execution_grant: artifact.issuance && artifact.issuance.execution_grant,
+    transcript_token: artifact.transcript_token,
+    correlation: artifact.correlation || null,
+    atomic_attestation: null,
+    provider_readback: null,
+    ...(o.sidecars || {}),
+  };
+
+  // 2 — mandatory slots. A root that omits a token would make deletion look like "not applicable".
+  for (const name of SLOT_NAMES) {
+    if (!SLOTS[name].mandatory) continue;
+    note(`root_slot_${name}`, root.artifact_digests && root.artifact_digests[name] != null,
+      `the root records no digest for the mandatory ${name}`);
+  }
+
+  // 3 & 4 — EXACT BYTES. This is the check the collage fails: a substituted token is authentic and
+  // has different bytes, so its digest cannot match whatever it says inside.
+  for (const name of SLOT_NAMES) {
+    const want = root.artifact_digests ? root.artifact_digests[name] : null;
+    const got = digestToken(carried[name]);
+    if (want == null && got == null) continue;
+    if (want == null) {
+      note(`digest_${name}`, false,
+        `the envelope carries a ${name} the root does not account for — an extra token is not evidence`);
+      continue;
+    }
+    if (got == null) {
+      // Not a failure for an optional slot the caller simply did not supply: it is UNCHECKED, and
+      // saying so beats grading a token nobody looked at.
+      note(`digest_${name}`, !SLOTS[name].mandatory,
+        `the root records a ${name} digest but no such token was supplied to check it`);
+      continue;
+    }
+    note(`digest_${name}`, got === want,
+      got === want ? `${name} bytes match the root`
+        : `${name} does not match the root's digest — these bytes were not emitted by run ${root.run_id}`);
+  }
+
+  // 5 — the grant's own claims vs the root's.
+  const grantBody = (() => {
+    const t = carried.execution_grant;
+    if (typeof t !== 'string') return null;
+    try { return JSON.parse(Buffer.from(t.split('.')[0], 'base64url').toString('utf8')); } catch (_) { return null; }
+  })();
+  if (grantBody) {
+    const gid = grantBody.grant_id || grantBody.jti || null;
+    note('claim_grant_id', root.grant_id == null || root.grant_id === gid,
+      `the root names grant ${root.grant_id} but the grant it carries is ${gid}`);
+    const scope = grantBody.after_payload_hash || grantBody.scope_hash || null;
+    note('claim_scope_hash', root.scope_hash == null || root.scope_hash === scope,
+      `the root names scope ${root.scope_hash} but the grant scopes ${scope}`);
+    note('claim_policy_hash', root.policy_hash == null || grantBody.policy_hash == null
+      || root.policy_hash === grantBody.policy_hash,
+      'the root and the grant disagree about policy_hash');
+
+    // 6 — grant → receipt, by the digest of the receipt actually carried, not by a copied string.
+    const rh = grantBody.receipt_hash || grantBody.receipt_digest || null;
+    if (rh && typeof carried.chain_receipt === 'string') {
+      const actual = digestToken(carried.chain_receipt);
+      note('grant_binds_receipt', rh === actual,
+        `the grant was issued against receipt ${rh}, but the receipt carried here hashes to ${actual}`);
+    }
+  }
+
+  // 7 — one grant, through consume and attestation. Read from the continuity block the producer
+  // signed into the transcript, re-derived rather than trusted: the identities must agree with the
+  // root's grant_id too, or the root and the chain are describing different executions.
+  const ids = (artifact.continuity && artifact.continuity.identities) || {};
+  if (root.grant_id != null && ids.issued_jti != null) {
+    const oneGrant = ids.issued_jti === root.grant_id
+      && ids.consumed_jti === root.grant_id
+      && ids.attestation_jti === root.grant_id;
+    note('identity_chain', oneGrant,
+      `the root names grant ${root.grant_id}, the chain records issued ${ids.issued_jti} / `
+      + `consumed ${ids.consumed_jti} / attested ${ids.attestation_jti}`);
+  }
+
+  // 8 — one run, through the transcript and the correlation.
+  note('run_id_artifact', artifact.run_id === root.run_id,
+    `the artifact says run ${artifact.run_id}, the root says ${root.run_id}`);
+  if (carried.correlation && root.scope_hash != null) {
+    note('run_id_correlation', carried.correlation.scope_hash === root.scope_hash,
+      `the correlation binds scope ${carried.correlation.scope_hash}, the root ${root.scope_hash}`);
+  }
+  if (root.contract_commit != null && carried.correlation) {
+    note('contract_commit', carried.correlation.contract_commit === root.contract_commit,
+      `the correlation names commit ${carried.correlation.contract_commit}, the root ${root.contract_commit}`);
+  }
+
+  // 9 — the outer summary vs the tokens. The artifact is a wrapper; a wrapper that disagrees with
+  // what it wraps is the thing that is wrong.
+  const tv = typeof carried.transcript_token === 'string'
+    ? verifyProveTranscript(carried.transcript_token, { keyring: null, publicKey: o.executorKey })
+    : null;
+  if (tv && tv.valid && tv.payload) {
+    const claimed = tv.payload.run_id || tv.payload.deployment_id || null;
+    if (claimed && tv.payload.run_id) {
+      note('transcript_run_id', tv.payload.run_id === root.run_id,
+        `the signed transcript is run ${tv.payload.run_id}, the root says ${root.run_id}`);
+    }
+  }
+
+  return { ok: failures.length === 0, present: true, library: LIBRARY_VERSION, checks, failures };
+}
+
 module.exports = {
+  verifyEvidenceRootBinding,
+  LIBRARY_VERSION,
+  ROOT_V,
   verifyEvidenceEnvelope,
   verifyCorrelation,
   verifyAtomicAttestationToken,

package/dist/cjs/vendor/verify-grant.js

@@ -58,6 +58,35 @@ const V2_REQUIRED_STRINGS = Object.freeze([
   'operation', 'target_uri', 'expected_state_token', 'after_payload_hash',
   'nonce_hash', 'policy_hash', 'audience_hash', 'not_before', 'expires_at',
 ]);
+/**
+ * RESERVED, AND INERT. Optional v2 fields a grant MAY carry and this verifier reads as NOTHING.
+ *
+ * ── WHY THEY EXIST BEFORE THE GATE THAT USES THEM ───────────────────────────────────────────
+ *
+ * The admitted key set is closed: an unknown field is `MALFORMED/unknown_field`, which is the
+ * right default and also means a future field cannot be introduced without every deployed
+ * verifier refusing the grants that carry it. Reserving the two names now is what keeps that
+ * introduction from being a breaking change later.
+ *
+ * ── WHAT THEY DO NOT DO, WHICH IS THE POINT ─────────────────────────────────────────────────
+ *
+ * NOTHING. A grant carrying `call_hash` is graded EXACTLY as one without it. There is no check,
+ * no comparison, and no `intended` field they bind to.
+ *
+ * A VERIFIER THAT READS THEIR PRESENCE AS AUTHORIZATION IS WRONG. `call_hash` present does not
+ * mean a tool call was bound; `executor_image_digest` present does not mean an executor image was
+ * pinned. Nothing signs a promise that the value is true, nothing compares it to anything, and an
+ * attacker who can mint a grant can put any value in them. Presence is not proof — it is a slot.
+ *
+ * They are unsigned-by-default only in the sense that no separate signature covers them: the v2
+ * signing input is the canonical JSON of the WHOLE body, so a grant that carries them signs
+ * different bytes than one that does not, and neither can be edited into the other. That binds
+ * the VALUE to the issuer; it says nothing about whether the value means anything.
+ *
+ * When a gate for them lands it will be a NEW check with its own negative fixtures, and this
+ * comment is what a reader should be shown if anyone claims otherwise before then.
+ */
+const V2_RESERVED_INERT = Object.freeze(['call_hash', 'executor_image_digest']);
 const TARGET_SCHEMES = Object.freeze(['fs', 'git', 'api', 'db', 'registry', 'deploy']);
 const DEFAULT_FETCH_URL = 'https://app.coderifts.com/api/v1/attestation/public-key';
 
@@ -70,8 +99,39 @@ function scalar(v) {
   return v == null ? '' : String(v);
 }
 
+/**
+ * cr.exec.v1 OPTIONAL signed fields — the ATOMIC profile's, and a DELIBERATE widening (1470).
+ *
+ * ── MEASURED BEFORE OPENING THE SET ─────────────────────────────────────────────────────────
+ *
+ * This verifier's allowed set was `['v', ...SIGNED_FIELDS]`, so a v1 grant carrying `state_nonce`
+ * read MALFORMED / unknown_field. That grant is not malformed: it is what the demo executor issues
+ * for the ATOMIC profile, and capability-demo's middleware has always signed and accepted it
+ * (OPTIONAL_SIGNED_FIELDS = ['state_nonce', 'deployment_id']). Fail-CLOSED, and wrong — this core
+ * is vendored into five consumers, so every one of them refused a valid ATOMIC grant.
+ *
+ * ── WHY WIDENING IS SAFE HERE, AND WHY IT IS STILL A DECISION ───────────────────────────────
+ *
+ * These fields are SIGNED: appended to the preimage, so a forger cannot add one without breaking
+ * the signature. The closed set never protected against injection; it protects against SEMANTIC
+ * DRIFT — a future field that RESTRICTS use must not be silently ignored by an older verifier that
+ * then says GRANT_CURRENT. `state_nonce` and `deployment_id` do not restrict: they NARROW, and a
+ * verifier that ignores them is not more permissive than one that does not know them.
+ *
+ * So the set is widened BY NAME, not opened. An actually-unknown field is still unknown_field, and
+ * test/v1-atomic-optional-fields.test.js records both halves so the next change is a decision
+ * rather than a rediscovery.
+ *
+ * ── APPENDED ONLY WHEN NON-EMPTY ────────────────────────────────────────────────────────────
+ *
+ * Byte-identical to capability-demo/packages/middleware/src/verify-grant.js. A BEARER grant's
+ * signing input must stay exactly what it was before ATOMIC existed, or every pre-ATOMIC issuance
+ * stops verifying — which is why presence, not declaration, decides the slot.
+ */
+const V1_OPTIONAL_SIGNED_FIELDS = Object.freeze(['state_nonce', 'deployment_id']);
+
 function reconstructSignedInput(payload) {
-  return [
+  const parts = [
     SIGNING_PREFIX,
     scalar(payload.kid),
     scalar(payload.receipt_digest),
@@ -82,7 +142,11 @@ function reconstructSignedInput(payload) {
     scalar(payload.jti),
     scalar(payload.iat),
     scalar(payload.exp),
-  ].join('|');
+  ];
+  for (const k of V1_OPTIONAL_SIGNED_FIELDS) {
+    if (payload[k] != null && String(payload[k]).length > 0) parts.push(String(payload[k]));
+  }
+  return parts.join('|');
 }
 
 function sha256pref(s) {
@@ -142,7 +206,9 @@ function verifyExecutionGrantV2(payload, sigB64, ctx, opts = {}) {
   if (!Number.isInteger(payload.max_attempts) || payload.max_attempts < 1) {
     return { valid: false, status: 'MALFORMED', reason: 'bad_max_attempts', payload };
   }
-  const allowed = new Set([...V2_REQUIRED_STRINGS, 'max_attempts']);
+  // The reserved names are ADMITTED, never inspected. Everything below this line treats a payload
+  // carrying them identically to one that does not — verified by test, not by intent.
+  const allowed = new Set([...V2_REQUIRED_STRINGS, 'max_attempts', ...V2_RESERVED_INERT]);
   for (const k of Object.keys(payload)) {
     if (!allowed.has(k)) return { valid: false, status: 'MALFORMED', reason: 'unknown_field', payload };
   }
@@ -262,13 +328,19 @@ function verifyExecutionGrantInner(token, ctx, opts = {}) {
       return { valid: false, status: 'MALFORMED', reason: 'missing_field', payload };
     }
   }
-  const allowed = new Set(['v', ...SIGNED_FIELDS]);
+  const allowed = new Set(['v', ...SIGNED_FIELDS, ...V1_OPTIONAL_SIGNED_FIELDS]);
   for (const k of Object.keys(payload)) {
     if (!allowed.has(k)) {
       return { valid: false, status: 'MALFORMED', reason: 'unknown_field', payload };
     }
   }
 
+  for (const k of V1_OPTIONAL_SIGNED_FIELDS) {
+    if (payload[k] != null && typeof payload[k] !== 'string') {
+      return { valid: false, status: 'MALFORMED', reason: 'missing_field', payload };
+    }
+  }
+
   // 3. delimiter guard
   for (const k of SIGNED_FIELDS) {
     if (payload[k].includes('|')) {
@@ -513,6 +585,9 @@ module.exports = {
   SIGNING_PREFIX,
   SIGNING_PREFIX_V2,
   SIGNED_FIELDS,
+  V1_OPTIONAL_SIGNED_FIELDS,
+  V2_REQUIRED_STRINGS,
+  V2_RESERVED_INERT,
   CLOCK_SKEW_LEEWAY_MS,
   isIssuedInFuture,
 };

package/dist/cjs/vendor/verify.js

@@ -23,13 +23,13 @@
  * the command, so it left.
  *
  * CLI usage now:
- *   node cli.js <receipt> [--key pub.pem | --keys <url|file>] [--kid <kid>] [--fetch <url>]
- *   node cli.js --chain receipts.txt [--key pub.pem | --keys <url|file>] [--kid <kid>] [--fetch <url>]
+ *   node cli.js <receipt> [--key pub.pem | --keys <url|file>] [--kid <kid>] [--fetch <url>] [--refresh-keys]
+ *   node cli.js --chain receipts.txt [--key pub.pem | --keys <url|file>] [--kid <kid>] [--fetch <url>] [--refresh-keys]
  *
- * Key discovery: with no --key/--keys, keys are fetched from
- *   https://app.coderifts.com/.well-known/coderifts-keys.json  (override with --fetch <url>).
- * The fetch-and-resolve path accepts BOTH the registry array (active + retired)
- * and the legacy single-key body from /api/v1/attestation/public-key.
+ * Key discovery: with no --key/--keys/--fetch/--refresh-keys, the command loads the
+ * vendored snapshot at keys/coderifts-keys.json (offline). Live fetch is opt-in
+ * (--refresh-keys or --fetch <url> / --keys <url>). DEFAULT_FETCH_URL is the well-known
+ * registry used by those opt-in flags. This library never fetches.
  * --keys resolves each receipt's key by kid from a registry
  *   ({ keys: [{ kid, public_key_pem, status, valid_from, retired_at }] }); accepts a URL or file.
  *

package/dist/esm/cas-attestation.d.ts

@@ -178,6 +178,21 @@ export type EvaluateCasEvidenceOpts = {
             status?: string;
         }>;
     } | null;
+    /**
+     * The decision receipt's own bytes, and the keyring that signs them.
+     *
+     * Optional, and their ABSENCE is what it looks like: the core marks the result caller-asserted
+     * and says so in its shortfalls. Supplying them moves the receipt from "this guard's own bind
+     * step said so" to "the shared predicate verified a signature".
+     */
+    receipt_token?: string | null;
+    receipt_keyring?: {
+        keys?: Array<{
+            kid?: string;
+            public_key_pem?: string;
+            status?: string;
+        }>;
+    } | null;
     /** Clock injection for grant expiry, tests only. */
     now?: number;
     /** Strict-only tightening of derived.authorized_and_committed. Absent = 9.0.0 formula. */

package/dist/esm/cas-attestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cas-attestation.d.ts","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAErF,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3G,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,oBAA6B,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,uEAAuE;IACvE,iCAAiC,EAAE,IAAI,CAAC;IACxC,mGAAmG;IACnG,mDAAmD,EAAE,IAAI,CAAC;IAC1D,qGAAqG;IACrG,sCAAsC,EAAE,IAAI,CAAC;IAC7C,4FAA4F;IAC5F,qDAAqD,EAAE,IAAI,CAAC;IAC5D,yFAAyF;IACzF,iCAAiC,EAAE,IAAI,CAAC;IACxC,yFAAyF;IACzF,oCAAoC,EAAE,IAAI,CAAC;CAC5C,CAAC;AAWF,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GACzB;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,GACD;IACE,MAAM,EAAE,0BAA0B,CAAC;IACnC,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;CACxC,GACD;IACE,MAAM,EAAE,eAAe,CAAC;IACxB;;;OAGG;IACH,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,cAAc,EAAE,YAAY,CAAC;IAC7B,cAAc,EAAE,YAAY,GAAG,IAAI,CAAC;CACrC,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,EAAE,OAAO,oBAAoB,CAAC;IAC9C,UAAU,EAAE;QACV,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,qBAAqB,EAAE,mBAAmB,CAAC;QAC3C,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE;QACP;;;WAGG;QACH,wBAAwB,EAAE,OAAO,CAAC;QAClC;;;WAGG;QACH,sCAAsC,CAAC,EAAE,OAAO,CAAC;QACjD,iEAAiE;QACjE,SAAS,EAAE,OAAO,CAAC;QACnB,qDAAqD;QACrD,mBAAmB,EAAE,OAAO,CAAC;QAC7B,oCAAoC;QACpC,OAAO,EAAE,OAAO,CAAC;QACjB;;;WAGG;QACH,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF;;;;;OAKG;IACH,YAAY,EAAE,WAAW,CAAC;IAC1B,MAAM,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAEF,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,GAAG,QAAQ,CAAC;AAE/E,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,+EAA+E;IAC/E,QAAQ,EAAE,mBAAmB,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;CACrG,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI,CAAC;IACT;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,aAAa,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IACpG,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,OAAO,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,CAAC;CACnD,CAAC;AAEF,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,GAAG;IAChC,uEAAuE;IACvE,aAAa,EAAE,OAAO,CAAC;IACvB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,EAAE,uBAAuB,CAAC,eAAe,CAAC,EACjD,GAAG,CAAC,EAAE,MAAM,GACX,mBAAmB,CA0CrB;AAED,6FAA6F;AAC7F,MAAM,MAAM,WAAW,GAAG,0BAA0B,GAAG,0BAA0B,GAAG,wCAAwC,CAAC;AAC7H,eAAO,MAAM,uBAAuB,EAAG,yBAAkC,CAAC;AAE1E,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,WAAW,CAAC;IAC1B,sBAAsB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CACzD,CAAC;AA8CF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,WAAW,GAAG,SAAS,EACjC,IAAI,GAAE,uBAA4B,GACjC,uBAAuB,CAWzB;AAkBD,qFAAqF;AACrF,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAY/E;AAiBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,uBAA4B,GACjC,WAAW,CAsDb;AAED,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAQ1E;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAuB/F;AA0CD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAC3C,IAAI,GAAE,uBAA4B,GACjC,cAAc,CA8DhB"}
+{"version":3,"file":"cas-attestation.d.ts","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAErF,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3G,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,oBAA6B,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,uEAAuE;IACvE,iCAAiC,EAAE,IAAI,CAAC;IACxC,mGAAmG;IACnG,mDAAmD,EAAE,IAAI,CAAC;IAC1D,qGAAqG;IACrG,sCAAsC,EAAE,IAAI,CAAC;IAC7C,4FAA4F;IAC5F,qDAAqD,EAAE,IAAI,CAAC;IAC5D,yFAAyF;IACzF,iCAAiC,EAAE,IAAI,CAAC;IACxC,yFAAyF;IACzF,oCAAoC,EAAE,IAAI,CAAC;CAC5C,CAAC;AAWF,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GACzB;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,GACD;IACE,MAAM,EAAE,0BAA0B,CAAC;IACnC,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;CACxC,GACD;IACE,MAAM,EAAE,eAAe,CAAC;IACxB;;;OAGG;IACH,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,cAAc,EAAE,YAAY,CAAC;IAC7B,cAAc,EAAE,YAAY,GAAG,IAAI,CAAC;CACrC,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,EAAE,OAAO,oBAAoB,CAAC;IAC9C,UAAU,EAAE;QACV,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,qBAAqB,EAAE,mBAAmB,CAAC;QAC3C,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE;QACP;;;WAGG;QACH,wBAAwB,EAAE,OAAO,CAAC;QAClC;;;WAGG;QACH,sCAAsC,CAAC,EAAE,OAAO,CAAC;QACjD,iEAAiE;QACjE,SAAS,EAAE,OAAO,CAAC;QACnB,qDAAqD;QACrD,mBAAmB,EAAE,OAAO,CAAC;QAC7B,oCAAoC;QACpC,OAAO,EAAE,OAAO,CAAC;QACjB;;;WAGG;QACH,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF;;;;;OAKG;IACH,YAAY,EAAE,WAAW,CAAC;IAC1B,MAAM,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAEF,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,GAAG,QAAQ,CAAC;AAE/E,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,+EAA+E;IAC/E,QAAQ,EAAE,mBAAmB,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;CACrG,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI,CAAC;IACT;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,aAAa,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IACpG;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IACtG,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,OAAO,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,CAAC;CACnD,CAAC;AAwBF,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,GAAG;IAChC,uEAAuE;IACvE,aAAa,EAAE,OAAO,CAAC;IACvB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,EAAE,uBAAuB,CAAC,eAAe,CAAC,EACjD,GAAG,CAAC,EAAE,MAAM,GACX,mBAAmB,CA0CrB;AAED,6FAA6F;AAC7F,MAAM,MAAM,WAAW,GAAG,0BAA0B,GAAG,0BAA0B,GAAG,wCAAwC,CAAC;AAC7H,eAAO,MAAM,uBAAuB,EAAG,yBAAkC,CAAC;AAE1E,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,WAAW,CAAC;IAC1B,sBAAsB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CACzD,CAAC;AA8CF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,WAAW,GAAG,SAAS,EACjC,IAAI,GAAE,uBAA4B,GACjC,uBAAuB,CAWzB;AAkBD,qFAAqF;AACrF,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAY/E;AAiBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,uBAA4B,GACjC,WAAW,CAsDb;AAED,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAQ1E;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAuB/F;AA0CD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAC3C,IAAI,GAAE,uBAA4B,GACjC,cAAc,CAuKhB"}

package/dist/esm/cas-attestation.js

@@ -23,6 +23,30 @@ const LIMITS = Object.freeze({
     does_not_claim_host_cannot_bypass: true,
     does_not_claim_governance_redecision: true,
 });
+/**
+ * THE CORE PREDICATE, quoted rather than recomputed (1459).
+ *
+ * MEASURED before this wiring: the guard reached the right answer with a formula of its own —
+ * `receipt_verified && committed && class === 'executor_attested' && strictCommitObservation(...)`.
+ * Correct, and bespoke. The auditor's point is that a predicate written twice is a predicate that
+ * drifts, and the Atomic bypass was exactly that: two formulas for one question, disagreeing.
+ *
+ * So the guard now shapes its inputs and QUOTES `verifiedExecutionBinding`. The named shortfall
+ * states (UNAUTHORIZED / COMMIT_UNPROVEN / ONE_RUN_UNPROVEN / …) surface here as a result, so an
+ * operator reads the same vocabulary the CLI, Prove and conformance print.
+ *
+ * Loaded lazily and behind try/catch: a packaging fault must surface as NOT authorized, never as a
+ * crash inside the guard, and never as a silent fallback to the old local formula.
+ */
+function coreBinding() {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires, global-require
+        return require('./vendor/verified-execution-binding.js');
+    }
+    catch (_) {
+        return null;
+    }
+}
 /**
  * Authenticate an execution grant against the pinned ISSUER keyring, through the vendored
  * canonical core (receipt-verifier verify-grant.js — cr.exec.v1 AND cr.exec.v2).
@@ -339,19 +363,123 @@ export function buildCasAttestation(proof, outcome, opts = {}) {
     const indeterminate = cas.status === 'indeterminate';
     const cas_evidence = evaluateCasEvidence(outcome, opts);
     let authorized_and_committed = receipt_verified && cas.status === 'committed';
+    let binding = null;
     let authorized_and_host_reported_committed = false;
     // ENFORCING_STRICT: the existing derived name now requires executor_attested + kernel
     // cross-check. Non-strict keeps the 9.0.0 formula (receipt verified + clean commit).
-    if (opts.profile === 'ENFORCING_STRICT') {
-        const obs = strictCommitObservation(outcome, cas_evidence, opts);
-        authorized_and_committed = authorized_and_committed
-            && obs.commit_label === 'authorized_and_committed';
+    // ── ONE PREDICATE FOR BOTH ENFORCING PROFILES ────────────────────────────────────────────
+    //
+    // The intersection is computed by the vendored core; this block only SHAPES the guard's inputs
+    // into the core's vocabulary. `required` names the two authorities an enforcing guard can
+    // actually establish from a tool outcome: it holds a grant and an attestation, and it does not
+    // hold a prove artifact or a provider readback — asking the core for `one_run_root` here would
+    // report a shortfall about evidence this surface never receives.
+    const enforcingProfile = opts.profile === 'ENFORCING_STRICT' || opts.profile === 'ENFORCING_ATOMIC';
+    if (enforcingProfile) {
+        const core = coreBinding();
+        const from = intendedFromOutcome(outcome);
+        const grantToken = (opts.grant && String(opts.grant)) || (from.grant && String(from.grant)) || '';
+        const attToken = extractExecutorAttestationToken(outcome);
+        if (!core) {
+            // FAIL-CLOSED, and named. Falling back to the local formula would recreate the second
+            // predicate this change exists to remove.
+            authorized_and_committed = false;
+            binding = { state: 'UNAUTHORIZED', shortfalls: ['the vendored core predicate could not be loaded'] };
+        }
+        else {
+            // eslint-disable-next-line global-require, @typescript-eslint/no-var-requires
+            const { createPublicKey: createPk } = require('node:crypto');
+            const receiptKeyring = opts.receipt_keyring && Array.isArray(opts.receipt_keyring.keys)
+                ? new Map(opts.receipt_keyring.keys
+                    .filter((k) => k && k.kid && k.public_key_pem)
+                    .map((k) => [k.kid, {
+                        publicKey: createPk(k.public_key_pem),
+                        status: k.status || 'active',
+                        retired_at: null,
+                        compromised_at: null,
+                    }]))
+                : null;
+            const keyring = opts.grant_keyring && Array.isArray(opts.grant_keyring.keys)
+                ? new Map(opts.grant_keyring.keys
+                    .filter((k) => k && typeof k.kid === 'string' && typeof k.public_key_pem === 'string')
+                    .map((k) => [k.kid, {
+                        // eslint-disable-next-line @typescript-eslint/no-var-requires, global-require
+                        publicKey: require('node:crypto').createPublicKey(k.public_key_pem),
+                        status: k.status || 'active',
+                        retired_at: null,
+                        compromised_at: null,
+                    }]))
+                : null;
+            const r = core.verifiedExecutionBinding({
+                // ── THE RECEIPT, HANDED OVER WHEN THE CALLER HAS IT ─────────────────────────────
+                //
+                // `proof.receipt` records the guard's OWN bind step — it carries no token, by design. So
+                // when a caller supplies the receipt bytes and a keyring, the core verifies them; when it
+                // does not, `verified` is still passed and the core marks the result caller-asserted.
+                //
+                // That marking is not cosmetic any more: a caller-asserted receipt can no longer reach the
+                // global success token. It does not change THIS surface's answer, because this surface
+                // asks a CUSTOM authority set and reads `requirements_satisfied` — but the distinction is
+                // now visible in the state rather than only in a boolean nobody branched on.
+                receipt: opts.receipt_token
+                    ? {
+                        token: opts.receipt_token,
+                        keyring: receiptKeyring,
+                        expectedKid: null,
+                        ...(Number.isFinite(opts.now) ? { now: opts.now } : {}),
+                    }
+                    : { verified: receipt_verified },
+                grant: { token: grantToken, keyring, expectedKid: null, ...(Number.isFinite(opts.now) ? { now: opts.now } : {}) },
+                attestation: {
+                    token: attToken,
+                    registry: opts.registry,
+                    // The SDK's verifier, handed in rather than reimplemented — the core holds no
+                    // attestation format knowledge of its own.
+                    // eslint-disable-next-line @typescript-eslint/no-var-requires, global-require
+                    verify: (t, o) => require('@coderifts/sdk').verifyExecutionAttestation(t, o),
+                },
+                committed: cas.status === 'committed',
+                required: ['issuer_grant', 'executor_attestation'],
+            });
+            binding = { state: r.state, shortfalls: r.shortfalls };
+            // ── THE FIELD THIS SURFACE IS ENTITLED TO ────────────────────────────────────────
+            //
+            // This asks a CUSTOM authority set (issuer_grant + executor_attestation), and the core no
+            // longer lets a custom set reach `authorized_and_committed` — asking for less must not
+            // produce the word every consumer reads as the answer. `requirements_satisfied` is "the set
+            // I asked for is met", which is exactly the question this surface asks.
+            //
+            // MEASURED: reading `authorized_and_committed` after the core change would have made this
+            // permanently false, and a guard that refuses everything looks like a guard that works.
+            authorized_and_committed = r.requirements_satisfied === true;
+        }
     }
     if (opts.profile === 'ENFORCING_ATOMIC') {
-        const executorOk = cas_evidence.class === 'executor_attested';
+        // ── REPRODUCED THEN CLOSED (1447 / 1459) ────────────────────────────────────────────
+        //
+        // This branch used to read:
+        //
+        //     authorized_and_committed = receipt_verified && committed && class === 'executor_attested'
+        //
+        // and never asked whether the GRANT was signed by anyone. Measured on the public 17.2.0, with
+        // a forged-signature grant and a REAL attestation from a trusted executor bound to that
+        // grant's jti and scope:
+        //
+        //     ENFORCING_STRICT  authorized_and_committed = false
+        //     ENFORCING_ATOMIC  authorized_and_committed = true
+        //
+        // Two profiles of one product, one set of bytes, opposite answers. The attestation was doing
+        // all the work, and an attestation only ever says "I committed the grant with these ids" — it
+        // cannot say the ids belonged to a grant anyone authorized.
+        //
+        // BOTH branches now QUOTE the same predicate rather than each computing a formula. Strict is
+        // unchanged in behaviour and Atomic is brought up to it, which is the direction a disagreement
+        // between two enforcing profiles has to be resolved in.
+        // The verdict itself now comes from the core above — both enforcing profiles quote it, which
+        // is what makes them incapable of disagreeing. This branch keeps only the ATOMIC-only
+        // OBSERVATION name, which is a different fact and was never part of the bypass.
         const hostClaimed = cas_evidence.class === 'host_claimed';
         authorized_and_host_reported_committed = receipt_verified && cas.status === 'committed' && hostClaimed;
-        authorized_and_committed = receipt_verified && cas.status === 'committed' && executorOk;
     }
     const attestation = {
         attestation_spec: CAS_ATTESTATION_SPEC,
@@ -372,6 +500,8 @@ export function buildCasAttestation(proof, outcome, opts = {}) {
             ...(opts.profile === 'ENFORCING_ATOMIC'
                 ? { authorized_and_host_reported_committed }
                 : {}),
+            // The core's NAMED state, carried so an operator reads why rather than only whether.
+            ...(binding ? { authorization_state: binding.state } : {}),
         }),
         cas_evidence,
         limits: LIMITS,

package/dist/esm/cas-attestation.js.map

@@ -1 +1 @@
-{"version":3,"file":"cas-attestation.js","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAG5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG5D,uEAAuE;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAA6B,CAAC;AAqBlE,MAAM,MAAM,GAAyB,MAAM,CAAC,MAAM,CAAC;IACjD,iCAAiC,EAAE,IAAI;IACvC,mDAAmD,EAAE,IAAI;IACzD,sCAAsC,EAAE,IAAI;IAC5C,qDAAqD,EAAE,IAAI;IAC3D,iCAAiC,EAAE,IAAI;IACvC,oCAAoC,EAAE,IAAI;CAC3C,CAAC,CAAC;AA8JH;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAgC,EAChC,OAAiD,EACjD,GAAY;IAEZ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QACnD,8DAA8D;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ;gBAAE,SAAS;YACtF,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;gBACd,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;gBAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ;gBAC5B,UAAU,EAAE,IAAI;gBAChB,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QACnG,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE;YACzC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;YACzC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzC,CAAC,CAAC;QACH,OAAO;YACL,aAAa,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI;YAC/B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC;YACrC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;SAC3C,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO;YACL,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,OAAO,IAAI,2CAA2C;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAID,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAkC,CAAC;AAO1E;;;;;;;;;;;GAWG;AACH,SAAS,uBAAuB,CAAC,OAAgB,EAAE,IAA6B;IAC9E,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;WACtC,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;IAC1E,IAAI,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAEpC,4FAA4F;IAC5F,EAAE;IACF,+FAA+F;IAC/F,gGAAgG;IAChG,2CAA2C;IAC3C,EAAE;IACF,0FAA0F;IAC1F,2FAA2F;IAC3F,2FAA2F;IAC3F,4EAA4E;IAC5E,EAAE;IACF,8FAA8F;IAC9F,gGAAgG;IAChG,gGAAgG;IAChG,wFAAwF;IACxF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,KAAK,kBAAkB,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC;IAC7F,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAE5B,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAgB,EAChB,QAAiC,EACjC,OAAgC,EAAE;IAElC,MAAM,YAAY,GAAG,QAAQ,IAAI,IAAI;WAChC,QAAQ,CAAC,KAAK,KAAK,mBAAmB;WACtC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,YAAY,EAAE,0BAA0B,EAAE,CAAC;IACtD,CAAC;IACD,OAAO;QACL,YAAY,EAAE,0BAA0B;QACxC,sBAAsB,EAAE,uBAAuB;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAgB,MAAM,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,IAAI;IACnB,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,MAAqB,EAAE,GAAkB,EAAE,GAAkB;IAChF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,MAAM;QACrB,YAAY,EAAE,GAAG;QACjB,SAAS,EAAE,GAAG;KACf,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,+BAA+B,CAAC,OAAgB;IAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,IAAI,OAAO,CAAC,CAAC,oBAAoB,KAAK,QAAQ,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpF,OAAO,CAAC,CAAC,oBAAoB,CAAC;IAChC,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAI,CAA6B,CAAC,oBAAoB,CAAC;QAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,QAAQ,GAAgD,EAAE,CAAC;IACjE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC7D,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SAC3E,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/E,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,eAAe,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAgB,EAChB,OAAgC,EAAE;IAElC,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC;QAAE,OAAO,eAAe,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IAEzD,MAAM,KAAK,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,IAAI,IAAI,CAAC;IACtD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,WAAW,CAAC,cAAc,IAAI,IAAI,CAAC;IACjF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAE/C,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAIV,EAAE,CAAC;IACP,IAAI,KAAK;QAAE,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;IAClC,IAAI,cAAc;QAAE,QAAQ,CAAC,cAAc,GAAG,cAAc,CAAC;IAC7D,IAAI,YAAY;QAAE,QAAQ,CAAC,YAAY,GAAG,YAAY,CAAC;IACvD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,0BAA0B,CAAC,KAAK,EAAE;YAC3C,QAAQ;YACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;QACtE,CAAC,CAAC,QAAQ,CAAC,OAAkC;QAC7C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAExF,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI;WACpB,CAAC,QAAQ,CAAC,MAAM,KAAK,cAAc,IAAI,QAAQ,CAAC,MAAM,KAAK,mCAAmC,CAAC,EAAE,CAAC;QACvG,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,mBAAmB;YAC1B,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,YAAY,EAAE,GAAG;YACjB,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,qBAAqB,CAAC,CAAU;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAiF,CAAC;IAC5F,OAAO,CAAC,CAAC,UAAU,KAAK,oBAAoB;WACvC,CAAC,CAAC,OAAO,IAAI,IAAI;WACjB,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;WAC7B,CAAC,CAAC,qBAAqB,IAAI,IAAI;WAC/B,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ,CAAC;AACnD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,2BAA2B,CAAC,CAAU;IACpD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAyB,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAgC,CAAC;QAC3C,OAAO,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe;eAC/B,CAAC,CAAC,MAAM,KAAK,0BAA0B;eACvC,CAAC,CAAC,MAAM,KAAK,oBAAoB,CAAC;eAClC,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,CAAsB;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAwB,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,OAA2C;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,IAAa;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAc;YACzB,MAAM,EAAE,qBAA8B;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;SAC5E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,SAAkB;YAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc;SAC/E,CAAC,CAAC;IACL,CAAC;IACD,2BAA2B;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,0BAA0B;QAClC,SAAS,EAAE,IAAa;QACxB,MAAM,EAAE,qBAA8B;QACtC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB;KACxF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAA0B,EAC1B,OAA2C,EAC3C,OAAgC,EAAE;IAElC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CACjB,+FAA+F;cAC7F,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CACjB,yFAAyF;cACvF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC;IACzD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC;IACzC,MAAM,mBAAmB,GAAG,GAAG,CAAC,MAAM,KAAK,0BAA0B,CAAC;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC;IACzC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,KAAK,eAAe,CAAC;IACrD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,wBAAwB,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC;IAC9E,IAAI,sCAAsC,GAAG,KAAK,CAAC;IACnD,sFAAsF;IACtF,qFAAqF;IACrF,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QACjE,wBAAwB,GAAG,wBAAwB;eAC9C,GAAG,CAAC,YAAY,KAAK,0BAA0B,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,KAAK,mBAAmB,CAAC;QAC9D,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,KAAK,cAAc,CAAC;QAC1D,sCAAsC,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,WAAW,CAAC;QACvG,wBAAwB,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC;IAC1F,CAAC;IAED,MAAM,WAAW,GAAmB;QAClC,gBAAgB,EAAE,oBAAoB;QACtC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,qBAAqB,EAAE,yBAAyB,CAAC,KAAK,CAAC,qBAAqB,CAAC;YAC7E,gBAAgB;SACjB,CAAC;QACF,GAAG;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,wBAAwB;YACxB,SAAS;YACT,mBAAmB;YACnB,OAAO;YACP,aAAa;YACb,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,kBAAkB;gBACrC,CAAC,CAAC,EAAE,sCAAsC,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,YAAY;QACZ,MAAM,EAAE,MAAM;KACf,CAAC;IAEF,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAiB;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"cas-attestation.js","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAG5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG5D,uEAAuE;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAA6B,CAAC;AAqBlE,MAAM,MAAM,GAAyB,MAAM,CAAC,MAAM,CAAC;IACjD,iCAAiC,EAAE,IAAI;IACvC,mDAAmD,EAAE,IAAI;IACzD,sCAAsC,EAAE,IAAI;IAC5C,qDAAqD,EAAE,IAAI;IAC3D,iCAAiC,EAAE,IAAI;IACvC,oCAAoC,EAAE,IAAI;CAC3C,CAAC,CAAC;AA8JH;;;;;;;;;;;;;;GAcG;AACH,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,8EAA8E;QAC9E,OAAO,OAAO,CAAC,wCAAwC,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC9B,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAgC,EAChC,OAAiD,EACjD,GAAY;IAEZ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QACnD,8DAA8D;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ;gBAAE,SAAS;YACtF,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;gBACd,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;gBAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ;gBAC5B,UAAU,EAAE,IAAI;gBAChB,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QACnG,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE;YACzC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;YACzC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzC,CAAC,CAAC;QACH,OAAO;YACL,aAAa,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI;YAC/B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC;YACrC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;SAC3C,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO;YACL,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,OAAO,IAAI,2CAA2C;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAID,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAkC,CAAC;AAO1E;;;;;;;;;;;GAWG;AACH,SAAS,uBAAuB,CAAC,OAAgB,EAAE,IAA6B;IAC9E,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;WACtC,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;IAC1E,IAAI,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAEpC,4FAA4F;IAC5F,EAAE;IACF,+FAA+F;IAC/F,gGAAgG;IAChG,2CAA2C;IAC3C,EAAE;IACF,0FAA0F;IAC1F,2FAA2F;IAC3F,2FAA2F;IAC3F,4EAA4E;IAC5E,EAAE;IACF,8FAA8F;IAC9F,gGAAgG;IAChG,gGAAgG;IAChG,wFAAwF;IACxF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,KAAK,kBAAkB,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC;IAC7F,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAE5B,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAgB,EAChB,QAAiC,EACjC,OAAgC,EAAE;IAElC,MAAM,YAAY,GAAG,QAAQ,IAAI,IAAI;WAChC,QAAQ,CAAC,KAAK,KAAK,mBAAmB;WACtC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,YAAY,EAAE,0BAA0B,EAAE,CAAC;IACtD,CAAC;IACD,OAAO;QACL,YAAY,EAAE,0BAA0B;QACxC,sBAAsB,EAAE,uBAAuB;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAgB,MAAM,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,IAAI;IACnB,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,MAAqB,EAAE,GAAkB,EAAE,GAAkB;IAChF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,MAAM;QACrB,YAAY,EAAE,GAAG;QACjB,SAAS,EAAE,GAAG;KACf,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,+BAA+B,CAAC,OAAgB;IAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,IAAI,OAAO,CAAC,CAAC,oBAAoB,KAAK,QAAQ,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpF,OAAO,CAAC,CAAC,oBAAoB,CAAC;IAChC,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAI,CAA6B,CAAC,oBAAoB,CAAC;QAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,QAAQ,GAAgD,EAAE,CAAC;IACjE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC7D,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SAC3E,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/E,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,eAAe,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAgB,EAChB,OAAgC,EAAE;IAElC,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC;QAAE,OAAO,eAAe,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IAEzD,MAAM,KAAK,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,IAAI,IAAI,CAAC;IACtD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,WAAW,CAAC,cAAc,IAAI,IAAI,CAAC;IACjF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAE/C,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAIV,EAAE,CAAC;IACP,IAAI,KAAK;QAAE,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;IAClC,IAAI,cAAc;QAAE,QAAQ,CAAC,cAAc,GAAG,cAAc,CAAC;IAC7D,IAAI,YAAY;QAAE,QAAQ,CAAC,YAAY,GAAG,YAAY,CAAC;IACvD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,0BAA0B,CAAC,KAAK,EAAE;YAC3C,QAAQ;YACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;QACtE,CAAC,CAAC,QAAQ,CAAC,OAAkC;QAC7C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAExF,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI;WACpB,CAAC,QAAQ,CAAC,MAAM,KAAK,cAAc,IAAI,QAAQ,CAAC,MAAM,KAAK,mCAAmC,CAAC,EAAE,CAAC;QACvG,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,mBAAmB;YAC1B,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,YAAY,EAAE,GAAG;YACjB,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,qBAAqB,CAAC,CAAU;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAiF,CAAC;IAC5F,OAAO,CAAC,CAAC,UAAU,KAAK,oBAAoB;WACvC,CAAC,CAAC,OAAO,IAAI,IAAI;WACjB,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;WAC7B,CAAC,CAAC,qBAAqB,IAAI,IAAI;WAC/B,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ,CAAC;AACnD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,2BAA2B,CAAC,CAAU;IACpD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAyB,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAgC,CAAC;QAC3C,OAAO,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe;eAC/B,CAAC,CAAC,MAAM,KAAK,0BAA0B;eACvC,CAAC,CAAC,MAAM,KAAK,oBAAoB,CAAC;eAClC,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,CAAsB;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAwB,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,OAA2C;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,IAAa;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAc;YACzB,MAAM,EAAE,qBAA8B;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;SAC5E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,SAAkB;YAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc;SAC/E,CAAC,CAAC;IACL,CAAC;IACD,2BAA2B;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,0BAA0B;QAClC,SAAS,EAAE,IAAa;QACxB,MAAM,EAAE,qBAA8B;QACtC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB;KACxF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAA0B,EAC1B,OAA2C,EAC3C,OAAgC,EAAE;IAElC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CACjB,+FAA+F;cAC7F,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CACjB,yFAAyF;cACvF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC;IACzD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC;IACzC,MAAM,mBAAmB,GAAG,GAAG,CAAC,MAAM,KAAK,0BAA0B,CAAC;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC;IACzC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,KAAK,eAAe,CAAC;IACrD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,wBAAwB,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC;IAC9E,IAAI,OAAO,GAAqD,IAAI,CAAC;IACrE,IAAI,sCAAsC,GAAG,KAAK,CAAC;IACnD,sFAAsF;IACtF,qFAAqF;IACrF,4FAA4F;IAC5F,EAAE;IACF,+FAA+F;IAC/F,0FAA0F;IAC1F,+FAA+F;IAC/F,+FAA+F;IAC/F,iEAAiE;IACjE,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,KAAK,kBAAkB,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC;IACpG,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAClG,MAAM,QAAQ,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,sFAAsF;YACtF,0CAA0C;YAC1C,wBAAwB,GAAG,KAAK,CAAC;YACjC,OAAO,GAAG,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,iDAAiD,CAAC,EAAE,CAAC;QACvG,CAAC;aAAM,CAAC;YACN,8EAA8E;YAC9E,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;YAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;gBACrF,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI;qBAChC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,cAAc,CAAC;qBAClD,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE;wBACvB,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC;wBACrC,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ;wBAC5B,UAAU,EAAE,IAAI;wBAChB,cAAc,EAAE,IAAI;qBACrB,CAAC,CAAC,CAAC;gBACN,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;gBAC1E,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI;qBAC9B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;qBACrF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE;wBAClB,8EAA8E;wBAC9E,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;wBACnE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ;wBAC5B,UAAU,EAAE,IAAI;wBAChB,cAAc,EAAE,IAAI;qBACrB,CAAC,CAAC,CAAC;gBACN,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,CAAC,GAAG,IAAI,CAAC,wBAAwB,CAAC;gBACtC,mFAAmF;gBACnF,EAAE;gBACF,yFAAyF;gBACzF,0FAA0F;gBAC1F,sFAAsF;gBACtF,EAAE;gBACF,2FAA2F;gBAC3F,uFAAuF;gBACvF,0FAA0F;gBAC1F,6EAA6E;gBAC7E,OAAO,EAAE,IAAI,CAAC,aAAa;oBACzB,CAAC,CAAC;wBACA,KAAK,EAAE,IAAI,CAAC,aAAa;wBACzB,OAAO,EAAE,cAAc;wBACvB,WAAW,EAAE,IAAI;wBACjB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACxD;oBACD,CAAC,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAClC,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBACjH,WAAW,EAAE;oBACX,KAAK,EAAE,QAAQ;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,8EAA8E;oBAC9E,2CAA2C;oBAC3C,8EAA8E;oBAC9E,MAAM,EAAE,CAAC,CAAS,EAAE,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC;iBAC9F;gBACD,SAAS,EAAE,GAAG,CAAC,MAAM,KAAK,WAAW;gBACrC,QAAQ,EAAE,CAAC,cAAc,EAAE,sBAAsB,CAAC;aACnD,CAAC,CAAC;YACH,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;YACvD,oFAAoF;YACpF,EAAE;YACF,0FAA0F;YAC1F,uFAAuF;YACvF,4FAA4F;YAC5F,wEAAwE;YACxE,EAAE;YACF,0FAA0F;YAC1F,wFAAwF;YACxF,wBAAwB,GAAG,CAAC,CAAC,sBAAsB,KAAK,IAAI,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACxC,uFAAuF;QACvF,EAAE;QACF,4BAA4B;QAC5B,EAAE;QACF,gGAAgG;QAChG,EAAE;QACF,8FAA8F;QAC9F,wFAAwF;QACxF,yBAAyB;QACzB,EAAE;QACF,yDAAyD;QACzD,wDAAwD;QACxD,EAAE;QACF,6FAA6F;QAC7F,8FAA8F;QAC9F,4DAA4D;QAC5D,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,wDAAwD;QACxD,6FAA6F;QAC7F,sFAAsF;QACtF,gFAAgF;QAChF,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,KAAK,cAAc,CAAC;QAC1D,sCAAsC,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,WAAW,CAAC;IACzG,CAAC;IAED,MAAM,WAAW,GAAmB;QAClC,gBAAgB,EAAE,oBAAoB;QACtC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,qBAAqB,EAAE,yBAAyB,CAAC,KAAK,CAAC,qBAAqB,CAAC;YAC7E,gBAAgB;SACjB,CAAC;QACF,GAAG;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,wBAAwB;YACxB,SAAS;YACT,mBAAmB;YACnB,OAAO;YACP,aAAa;YACb,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,kBAAkB;gBACrC,CAAC,CAAC,EAAE,sCAAsC,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,qFAAqF;YACrF,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC;QACF,YAAY;QACZ,MAAM,EAAE,MAAM;KACf,CAAC;IAEF,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAiB;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}