@freedomofpress/sigstore-browser 0.1.4 → 0.1.6

package/dist/policy.js

@@ -0,0 +1,371 @@
+/**
+ * Adapted from sigstore-python sigstore/verify/policy.py
+ *
+ * This module provides policy verification for checking certificate identity claims.
+ * Each policy class verifies a specific X.509 extension value against an expected value.
+ *
+ * There are two types of extension formats:
+ * - V1 extensions: Raw OCTET STRING containing the value directly
+ * - V2 extensions: DER-encoded UTF8String (RFC 5280 compliant)
+ *
+ * Policies can be combined using:
+ * - AllOf: All child policies must pass (logical AND)
+ * - AnyOf: At least one child policy must pass (logical OR)
+ * - Identity: Verifies SAN with optional issuer check
+ */
+import { PolicyError } from "./errors.js";
+import { EXTENSION_OID_FULCIO_ISSUER_V1, EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER, EXTENSION_OID_GITHUB_WORKFLOW_SHA, EXTENSION_OID_GITHUB_WORKFLOW_NAME, EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY, EXTENSION_OID_GITHUB_WORKFLOW_REF, EXTENSION_OID_OTHERNAME, EXTENSION_OID_FULCIO_ISSUER_V2, EXTENSION_OID_BUILD_SIGNER_URI, EXTENSION_OID_BUILD_SIGNER_DIGEST, EXTENSION_OID_RUNNER_ENVIRONMENT, EXTENSION_OID_SOURCE_REPOSITORY_URI, EXTENSION_OID_SOURCE_REPOSITORY_DIGEST, EXTENSION_OID_SOURCE_REPOSITORY_REF, EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER, EXTENSION_OID_BUILD_CONFIG_URI, EXTENSION_OID_BUILD_CONFIG_DIGEST, EXTENSION_OID_BUILD_TRIGGER, EXTENSION_OID_RUN_INVOCATION_URI, EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY, } from "./x509/cert.js";
+// Standard GitHub Actions OIDC issuer
+// https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect
+export const GITHUB_OIDC_ISSUER = "https://token.actions.githubusercontent.com";
+/**
+ * Base class for V1 extension policies (raw OCTET STRING value).
+ */
+class SingleX509ExtPolicyV1 {
+    expectedValue;
+    constructor(value) {
+        this.expectedValue = value;
+    }
+    verify(cert) {
+        const extValue = this.getExtensionValue(cert);
+        if (extValue === undefined) {
+            throw new PolicyError(`Certificate does not contain ${this.name} (${this.oid}) extension`);
+        }
+        if (extValue !== this.expectedValue) {
+            throw new PolicyError(`Certificate's ${this.name} does not match ` +
+                `(got '${extValue}', expected '${this.expectedValue}')`);
+        }
+    }
+}
+/**
+ * Base class for V2 extension policies (DER-encoded UTF8String).
+ * Uses the same verify logic as V1 since our extension classes handle the parsing.
+ */
+class SingleX509ExtPolicyV2 extends SingleX509ExtPolicyV1 {
+}
+// ============================================================================
+// V1 Extension Policies (OID 1.3.6.1.4.1.57264.1.1 - 1.3.6.1.4.1.57264.1.6)
+// ============================================================================
+/**
+ * Verifies the certificate's OIDC issuer (V1 format).
+ * OID: 1.3.6.1.4.1.57264.1.1
+ */
+export class OIDCIssuer extends SingleX509ExtPolicyV1 {
+    oid = EXTENSION_OID_FULCIO_ISSUER_V1;
+    name = "OIDCIssuer";
+    getExtensionValue(cert) {
+        return cert.extFulcioIssuerV1?.issuer;
+    }
+}
+/**
+ * Verifies the certificate's GitHub Actions workflow trigger.
+ * OID: 1.3.6.1.4.1.57264.1.2
+ */
+export class GitHubWorkflowTrigger extends SingleX509ExtPolicyV1 {
+    oid = EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER;
+    name = "GitHubWorkflowTrigger";
+    getExtensionValue(cert) {
+        return cert.extGitHubWorkflowTrigger?.workflowTrigger;
+    }
+}
+/**
+ * Verifies the certificate's GitHub Actions workflow commit SHA.
+ * OID: 1.3.6.1.4.1.57264.1.3
+ */
+export class GitHubWorkflowSHA extends SingleX509ExtPolicyV1 {
+    oid = EXTENSION_OID_GITHUB_WORKFLOW_SHA;
+    name = "GitHubWorkflowSHA";
+    getExtensionValue(cert) {
+        return cert.extGitHubWorkflowSHA?.workflowSHA;
+    }
+}
+/**
+ * Verifies the certificate's GitHub Actions workflow name.
+ * OID: 1.3.6.1.4.1.57264.1.4
+ */
+export class GitHubWorkflowName extends SingleX509ExtPolicyV1 {
+    oid = EXTENSION_OID_GITHUB_WORKFLOW_NAME;
+    name = "GitHubWorkflowName";
+    getExtensionValue(cert) {
+        return cert.extGitHubWorkflowName?.workflowName;
+    }
+}
+/**
+ * Verifies the certificate's GitHub Actions workflow repository.
+ * OID: 1.3.6.1.4.1.57264.1.5
+ */
+export class GitHubWorkflowRepository extends SingleX509ExtPolicyV1 {
+    oid = EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY;
+    name = "GitHubWorkflowRepository";
+    getExtensionValue(cert) {
+        return cert.extGitHubWorkflowRepository?.workflowRepository;
+    }
+}
+/**
+ * Verifies the certificate's GitHub Actions workflow ref.
+ * OID: 1.3.6.1.4.1.57264.1.6
+ */
+export class GitHubWorkflowRef extends SingleX509ExtPolicyV1 {
+    oid = EXTENSION_OID_GITHUB_WORKFLOW_REF;
+    name = "GitHubWorkflowRef";
+    getExtensionValue(cert) {
+        return cert.extGitHubWorkflowRef?.workflowRef;
+    }
+}
+// ============================================================================
+// V2 Extension Policies (OID 1.3.6.1.4.1.57264.1.8 - 1.3.6.1.4.1.57264.1.22)
+// ============================================================================
+/**
+ * Verifies the certificate's OIDC issuer (V2 format, DER-encoded).
+ * OID: 1.3.6.1.4.1.57264.1.8
+ */
+export class OIDCIssuerV2 extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_FULCIO_ISSUER_V2;
+    name = "OIDCIssuerV2";
+    getExtensionValue(cert) {
+        return cert.extFulcioIssuerV2?.issuer;
+    }
+}
+/**
+ * Verifies the certificate's Build Signer URI.
+ * OID: 1.3.6.1.4.1.57264.1.9
+ */
+export class OIDCBuildSignerURI extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_BUILD_SIGNER_URI;
+    name = "OIDCBuildSignerURI";
+    getExtensionValue(cert) {
+        return cert.extBuildSignerURI?.buildSignerURI;
+    }
+}
+/**
+ * Verifies the certificate's Build Signer Digest.
+ * OID: 1.3.6.1.4.1.57264.1.10
+ */
+export class OIDCBuildSignerDigest extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_BUILD_SIGNER_DIGEST;
+    name = "OIDCBuildSignerDigest";
+    getExtensionValue(cert) {
+        return cert.extBuildSignerDigest?.buildSignerDigest;
+    }
+}
+/**
+ * Verifies the certificate's Runner Environment.
+ * OID: 1.3.6.1.4.1.57264.1.11
+ */
+export class OIDCRunnerEnvironment extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_RUNNER_ENVIRONMENT;
+    name = "OIDCRunnerEnvironment";
+    getExtensionValue(cert) {
+        return cert.extRunnerEnvironment?.runnerEnvironment;
+    }
+}
+/**
+ * Verifies the certificate's Source Repository URI.
+ * OID: 1.3.6.1.4.1.57264.1.12
+ */
+export class OIDCSourceRepositoryURI extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_SOURCE_REPOSITORY_URI;
+    name = "OIDCSourceRepositoryURI";
+    getExtensionValue(cert) {
+        return cert.extSourceRepositoryURI?.sourceRepositoryURI;
+    }
+}
+/**
+ * Verifies the certificate's Source Repository Digest.
+ * OID: 1.3.6.1.4.1.57264.1.13
+ */
+export class OIDCSourceRepositoryDigest extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_SOURCE_REPOSITORY_DIGEST;
+    name = "OIDCSourceRepositoryDigest";
+    getExtensionValue(cert) {
+        return cert.extSourceRepositoryDigest?.sourceRepositoryDigest;
+    }
+}
+/**
+ * Verifies the certificate's Source Repository Ref.
+ * OID: 1.3.6.1.4.1.57264.1.14
+ */
+export class OIDCSourceRepositoryRef extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_SOURCE_REPOSITORY_REF;
+    name = "OIDCSourceRepositoryRef";
+    getExtensionValue(cert) {
+        return cert.extSourceRepositoryRef?.sourceRepositoryRef;
+    }
+}
+/**
+ * Verifies the certificate's Source Repository Identifier.
+ * OID: 1.3.6.1.4.1.57264.1.15
+ */
+export class OIDCSourceRepositoryIdentifier extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER;
+    name = "OIDCSourceRepositoryIdentifier";
+    getExtensionValue(cert) {
+        return cert.extSourceRepositoryIdentifier?.sourceRepositoryIdentifier;
+    }
+}
+/**
+ * Verifies the certificate's Source Repository Owner URI.
+ * OID: 1.3.6.1.4.1.57264.1.16
+ */
+export class OIDCSourceRepositoryOwnerURI extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI;
+    name = "OIDCSourceRepositoryOwnerURI";
+    getExtensionValue(cert) {
+        return cert.extSourceRepositoryOwnerURI?.sourceRepositoryOwnerURI;
+    }
+}
+/**
+ * Verifies the certificate's Source Repository Owner Identifier.
+ * OID: 1.3.6.1.4.1.57264.1.17
+ */
+export class OIDCSourceRepositoryOwnerIdentifier extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER;
+    name = "OIDCSourceRepositoryOwnerIdentifier";
+    getExtensionValue(cert) {
+        return cert.extSourceRepositoryOwnerIdentifier?.sourceRepositoryOwnerIdentifier;
+    }
+}
+/**
+ * Verifies the certificate's Build Config URI.
+ * OID: 1.3.6.1.4.1.57264.1.18
+ */
+export class OIDCBuildConfigURI extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_BUILD_CONFIG_URI;
+    name = "OIDCBuildConfigURI";
+    getExtensionValue(cert) {
+        return cert.extBuildConfigURI?.buildConfigURI;
+    }
+}
+/**
+ * Verifies the certificate's Build Config Digest.
+ * OID: 1.3.6.1.4.1.57264.1.19
+ */
+export class OIDCBuildConfigDigest extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_BUILD_CONFIG_DIGEST;
+    name = "OIDCBuildConfigDigest";
+    getExtensionValue(cert) {
+        return cert.extBuildConfigDigest?.buildConfigDigest;
+    }
+}
+/**
+ * Verifies the certificate's Build Trigger.
+ * OID: 1.3.6.1.4.1.57264.1.20
+ */
+export class OIDCBuildTrigger extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_BUILD_TRIGGER;
+    name = "OIDCBuildTrigger";
+    getExtensionValue(cert) {
+        return cert.extBuildTrigger?.buildTrigger;
+    }
+}
+/**
+ * Verifies the certificate's Run Invocation URI.
+ * OID: 1.3.6.1.4.1.57264.1.21
+ */
+export class OIDCRunInvocationURI extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_RUN_INVOCATION_URI;
+    name = "OIDCRunInvocationURI";
+    getExtensionValue(cert) {
+        return cert.extRunInvocationURI?.runInvocationURI;
+    }
+}
+/**
+ * Verifies the certificate's Source Repository Visibility at signing.
+ * OID: 1.3.6.1.4.1.57264.1.22
+ */
+export class OIDCSourceRepositoryVisibility extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY;
+    name = "OIDCSourceRepositoryVisibility";
+    getExtensionValue(cert) {
+        return cert.extSourceRepositoryVisibility?.sourceRepositoryVisibility;
+    }
+}
+// ============================================================================
+// Policy Combinators
+// ============================================================================
+/**
+ * The "any of" policy, corresponding to a logical OR between child policies.
+ * An empty list of child policies is considered trivially invalid.
+ */
+export class AnyOf {
+    children;
+    constructor(children) {
+        this.children = children;
+    }
+    verify(cert) {
+        for (const child of this.children) {
+            try {
+                child.verify(cert);
+                return;
+            }
+            catch {
+                // Continue to next policy
+            }
+        }
+        throw new PolicyError(`0 of ${this.children.length} policies succeeded`);
+    }
+}
+/**
+ * The "all of" policy, corresponding to a logical AND between child policies.
+ * An empty list of child policies is considered trivially invalid.
+ */
+export class AllOf {
+    children;
+    constructor(children) {
+        this.children = children;
+    }
+    verify(cert) {
+        if (this.children.length < 1) {
+            throw new PolicyError("no child policies to verify");
+        }
+        for (const child of this.children) {
+            child.verify(cert);
+        }
+    }
+}
+// ============================================================================
+// Identity Policy
+// ============================================================================
+/**
+ * Verifies the certificate's "identity", corresponding to the X.509v3 SAN.
+ *
+ * Identities can be verified modulo an OIDC issuer, to prevent an unexpected
+ * issuer from offering a particular identity.
+ *
+ * Supported SAN types include emails, URIs, and Sigstore-specific "other names".
+ */
+export class Identity {
+    identity;
+    issuerPolicy;
+    constructor(options) {
+        this.identity = options.identity;
+        this.issuerPolicy = options.issuer ? new OIDCIssuer(options.issuer) : null;
+    }
+    verify(cert) {
+        if (this.issuerPolicy) {
+            this.issuerPolicy.verify(cert);
+        }
+        const sanExt = cert.extSubjectAltName;
+        if (!sanExt) {
+            throw new PolicyError("Certificate does not contain SubjectAlternativeName extension");
+        }
+        const allSans = new Set();
+        // Add email (rfc822Name)
+        if (sanExt.rfc822Name) {
+            allSans.add(sanExt.rfc822Name);
+        }
+        // Add URI
+        if (sanExt.uri) {
+            allSans.add(sanExt.uri);
+        }
+        // Add Sigstore-specific otherName
+        const otherName = sanExt.otherName(EXTENSION_OID_OTHERNAME);
+        if (otherName) {
+            allSans.add(otherName);
+        }
+        if (!allSans.has(this.identity)) {
+            throw new PolicyError(`Certificate's SANs do not match ${this.identity}; actual SANs: ${Array.from(allSans).join(", ")}`);
+        }
+    }
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAEL,8BAA8B,EAC9B,qCAAqC,EACrC,iCAAiC,EACjC,kCAAkC,EAClC,wCAAwC,EACxC,iCAAiC,EACjC,uBAAuB,EACvB,8BAA8B,EAC9B,8BAA8B,EAC9B,iCAAiC,EACjC,gCAAgC,EAChC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,EACnC,0CAA0C,EAC1C,yCAAyC,EACzC,gDAAgD,EAChD,8BAA8B,EAC9B,iCAAiC,EACjC,2BAA2B,EAC3B,gCAAgC,EAChC,0CAA0C,GAC3C,MAAM,gBAAgB,CAAC;AAExB,sCAAsC;AACtC,kJAAkJ;AAClJ,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAShF;;GAEG;AACH,MAAe,qBAAqB;IAGf,aAAa,CAAS;IAEzC,YAAY,KAAa;QACvB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAID,MAAM,CAAC,IAAqB;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CACnB,gCAAgC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,aAAa,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,IAAI,WAAW,CACnB,iBAAiB,IAAI,CAAC,IAAI,kBAAkB;gBAC5C,SAAS,QAAQ,gBAAgB,IAAI,CAAC,aAAa,IAAI,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAe,qBAAsB,SAAQ,qBAAqB;CAAG;AAErE,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,qBAAqB;IAC1C,GAAG,GAAG,8BAA8B,CAAC;IACrC,IAAI,GAAG,YAAY,CAAC;IAEnB,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IACrD,GAAG,GAAG,qCAAqC,CAAC;IAC5C,IAAI,GAAG,uBAAuB,CAAC;IAE9B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,wBAAwB,EAAE,eAAe,CAAC;IACxD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,qBAAqB;IACjD,GAAG,GAAG,iCAAiC,CAAC;IACxC,IAAI,GAAG,mBAAmB,CAAC;IAE1B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAClD,GAAG,GAAG,kCAAkC,CAAC;IACzC,IAAI,GAAG,oBAAoB,CAAC;IAE3B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC;IAClD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,qBAAqB;IACxD,GAAG,GAAG,wCAAwC,CAAC;IAC/C,IAAI,GAAG,0BAA0B,CAAC;IAEjC,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,2BAA2B,EAAE,kBAAkB,CAAC;IAC9D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,qBAAqB;IACjD,GAAG,GAAG,iCAAiC,CAAC;IACxC,IAAI,GAAG,mBAAmB,CAAC;IAE1B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAChD,CAAC;CACF;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,YAAa,SAAQ,qBAAqB;IAC5C,GAAG,GAAG,8BAA8B,CAAC;IACrC,IAAI,GAAG,cAAc,CAAC;IAErB,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAClD,GAAG,GAAG,8BAA8B,CAAC;IACrC,IAAI,GAAG,oBAAoB,CAAC;IAE3B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IACrD,GAAG,GAAG,iCAAiC,CAAC;IACxC,IAAI,GAAG,uBAAuB,CAAC;IAE9B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IACrD,GAAG,GAAG,gCAAgC,CAAC;IACvC,IAAI,GAAG,uBAAuB,CAAC;IAE9B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,qBAAqB;IACvD,GAAG,GAAG,mCAAmC,CAAC;IAC1C,IAAI,GAAG,yBAAyB,CAAC;IAEhC,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;IAC1D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,qBAAqB;IAC1D,GAAG,GAAG,sCAAsC,CAAC;IAC7C,IAAI,GAAG,4BAA4B,CAAC;IAEnC,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,yBAAyB,EAAE,sBAAsB,CAAC;IAChE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,qBAAqB;IACvD,GAAG,GAAG,mCAAmC,CAAC;IAC1C,IAAI,GAAG,yBAAyB,CAAC;IAEhC,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;IAC1D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IAC9D,GAAG,GAAG,0CAA0C,CAAC;IACjD,IAAI,GAAG,gCAAgC,CAAC;IAEvC,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,6BAA6B,EAAE,0BAA0B,CAAC;IACxE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,4BAA6B,SAAQ,qBAAqB;IAC5D,GAAG,GAAG,yCAAyC,CAAC;IAChD,IAAI,GAAG,8BAA8B,CAAC;IAErC,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,2BAA2B,EAAE,wBAAwB,CAAC;IACpE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mCAAoC,SAAQ,qBAAqB;IACnE,GAAG,GAAG,gDAAgD,CAAC;IACvD,IAAI,GAAG,qCAAqC,CAAC;IAE5C,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,kCAAkC,EAAE,+BAA+B,CAAC;IAClF,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAClD,GAAG,GAAG,8BAA8B,CAAC;IACrC,IAAI,GAAG,oBAAoB,CAAC;IAE3B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IACrD,GAAG,GAAG,iCAAiC,CAAC;IACxC,IAAI,GAAG,uBAAuB,CAAC;IAE9B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,qBAAqB;IAChD,GAAG,GAAG,2BAA2B,CAAC;IAClC,IAAI,GAAG,kBAAkB,CAAC;IAEzB,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC;IAC5C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,qBAAqB;IACpD,GAAG,GAAG,gCAAgC,CAAC;IACvC,IAAI,GAAG,sBAAsB,CAAC;IAE7B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;IACpD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IAC9D,GAAG,GAAG,0CAA0C,CAAC;IACjD,IAAI,GAAG,gCAAgC,CAAC;IAEvC,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,6BAA6B,EAAE,0BAA0B,CAAC;IACxE,CAAC;CACF;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,KAAK;IACR,QAAQ,CAAuB;IAEvC,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,IAAqB;QAC1B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,qBAAqB,CAAC,CAAC;IAC3E,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,KAAK;IACR,QAAQ,CAAuB;IAEvC,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,IAAqB;QAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,WAAW,CAAC,6BAA6B,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,OAAO,QAAQ;IACX,QAAQ,CAAS;IACjB,YAAY,CAAoB;IAExC,YAAY,OAA8C;QACxD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,CAAC;IAED,MAAM,CAAC,IAAqB;QAC1B,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,yBAAyB;QACzB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAED,UAAU;QACV,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,kCAAkC;QAClC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC5D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CACnB,mCAAmC,IAAI,CAAC,QAAQ,kBAAkB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}