@invisible-labs/sdk 0.6.0-devnet.4 → 0.6.0-devnet.5

package/dist/chunk-DIA6U2CV.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/attestation/verifier.ts"],"names":["cursor"],"mappings":";;;AAqHA,IAAM,6BAAA,GAAgC,GAAA;AACtC,IAAM,mBAAA,GAAsB,UAAA;AAC5B,IAAM,mBAAA,GAAsB,KAAA;AAgErB,SAAS,qBAAqB,KAAA,EAAiD;AACpF,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA,EAAM;AAC/C,IAAA,MAAM,GAAA,CAAI,gBAAgB,2CAA2C,CAAA;AAAA,EACvE;AACA,EAAA,MAAM,CAAA,GAAI,KAAA;AACV,EAAA,MAAM,SAAmC,CAAC,OAAA,EAAS,OAAA,EAAS,QAAA,EAAU,eAAe,MAAM,CAAA;AAC3F,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,IAAI,OAAO,CAAA,CAAE,KAAK,CAAA,KAAM,QAAA,EAAU;AAChC,MAAA,MAAM,GAAA;AAAA,QACJ,cAAA;AAAA,QACA,sDAAsD,KAAK,CAAA,OAAA,EAAU,OAAO,CAAA,CAAE,KAAK,CAAC,CAAA,CAAA;AAAA,OACtF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,EAAE,MAAM,CAAA,KAAM,SAAS,CAAA,CAAE,MAAM,MAAM,MAAA,EAAQ;AAC/C,IAAA,MAAM,IAAI,cAAA,EAAgB,CAAA,wCAAA,EAA2C,CAAA,CAAE,MAAM,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,EACnF;AACA,EAAA,IACE,CAAA,CAAE,iBAAiB,CAAA,KAAM,MAAA,IACzB,CAAA,CAAE,iBAAiB,CAAA,KAAM,eAAA,IACzB,CAAA,CAAE,iBAAiB,CAAA,KAAM,wBAAA,EACzB;AACA,IAAA,MAAM,GAAA;AAAA,MACJ,cAAA;AAAA,MACA,CAAA,mDAAA,EAAsD,CAAA,CAAE,iBAAiB,CAAC,CAAA,CAAA;AAAA,KAC5E;AAAA,EACF;AACA,EAAA,IAAI,CAAA,CAAE,mBAAmB,CAAA,KAAM,MAAA,IAAa,OAAO,CAAA,CAAE,mBAAmB,MAAM,SAAA,EAAW;AACvF,IAAA,MAAM,GAAA;AAAA,MACJ,cAAA;AAAA,MACA,CAAA,wDAAA,EAA2D,OAAO,CAAA,CAAE,mBAAmB,CAAC,CAAA;AAAA,KAC1F;AAAA,EACF;AACF;AAaO,IAAM,oCAAA,GACX;AA0DF,IAAM,cAAA,GAA0D;AAAA;AAAA,EAE9D,YAAA,EAAc,oBAAA;AAAA,EACd,eAAA,EAAiB,oBAAA;AAAA,EACjB,oBAAA,EAAsB,oBAAA;AAAA,EACtB,iBAAA,EAAmB,oBAAA;AAAA,EACnB,eAAA,EAAiB,oBAAA;AAAA,EACjB,yBAAA,EAA2B,oBAAA;AAAA,EAC3B,mBAAA,EAAqB,oBAAA;AAAA,EACrB,yBAAA,EAA2B,oBAAA;AAAA,EAC3B,uBAAA,EAAyB,cAAA;AAAA,EACzB,qBAAA,EAAuB,cAAA;AAAA,EACvB,uBAAA,EAAyB,cAAA;AAAA,EACzB,mBAAA,EAAqB,cAAA;AAAA,EACrB,oBAAA,EAAsB,cAAA;AAAA,EACtB,eAAA,EAAiB,oBAAA;AAAA,EACjB,iBAAA,EAAmB,oBAAA;AAAA,EACnB,mBAAA,EAAqB,oBAAA;AAAA;AAAA,EAErB,cAAA,EAAgB,0BAAA;AAAA,EAChB,oBAAA,EAAsB,0BAAA;AAAA,EACtB,kBAAA,EAAoB,oCAAA;AAAA;AAAA,EAEpB,wBAAA,EAA0B,wBAAA;AAAA,EAC1B,qBAAA,EAAuB,wBAAA;AAAA,EACvB,kBAAA,EAAoB,wBAAA;AAAA,EACpB,oBAAA,EAAsB,wBAAA;AAAA;AAAA,EAEtB,aAAA,EAAe,eAAA;AAAA,EACf,iBAAA,EAAmB,eAAA;AAAA;AAAA,EAEnB,aAAA,EAAe,eAAA;AAAA,EACf,aAAA,EAAe,eAAA;AAAA,EACf,wBAAA,EAA0B,0BAAA;AAAA;AAAA,EAE1B,0BAAA,EAA4B,cAAA;AAAA;AAAA,EAE5B,iBAAA,EAAmB,wBAAA;AAAA,EACnB,eAAA,EAAiB,wBAAA;AAAA,EACjB,iBAAA,EAAmB,wBAAA;AAAA,EACnB,mBAAA,EAAqB,wBAAA;AAAA,EACrB,wBAAA,EAA0B,2BAAA;AAAA,EAC1B,mBAAA,EAAqB,2BAAA;AAAA,EACrB,iBAAA,EAAmB,wBAAA;AAAA,EACnB,wBAAA,EAA0B,gCAAA;AAAA,EAC1B,uBAAA,EAAyB,yBAAA;AAAA,EACzB,uBAAA,EAAyB,yBAAA;AAAA;AAAA,EAEzB,gBAAA,EAAkB,yBAAA;AAAA,EAClB,sBAAA,EAAwB,yBAAA;AAAA,EACxB,cAAA,EAAgB,sBAAA;AAAA;AAAA,EAEhB,iBAAA,EAAmB,4BAAA;AAAA,EACnB,mBAAA,EAAqB;AACvB,CAAA;AAGA,SAAS,GAAA,CAAI,QAAmB,OAAA,EAAmC;AACjE,EAAA,OAAO,IAAI,iBAAiB,cAAA,CAAe,MAAM,GAAG,CAAA,CAAA,EAAI,MAAM,CAAA,EAAA,EAAK,OAAO,CAAA,CAAE,CAAA;AAC9E;AAKA,IAAM,eAAA,GAAkB,EAAA;AAExB,IAAM,WAAA,GAAc,EAAA;AACpB,IAAM,kBAAA,GAAqB,CAAA;AAC3B,IAAM,kBAAA,GAAqB,CAAA;AAC3B,IAAM,mBAAA,GAAsB,CAAA;AAE5B,IAAM,YAAA,GAAe,GAAA;AACrB,IAAM,mBAAA,GAAsB,CAAA;AAE5B,IAAM,WAAA,GAAc,EAAA;AACpB,IAAM,SAAA,GAAY,GAAA;AAElB,IAAM,oBAAA,GAAuB,CAAA;AAC7B,IAAM,qBAAA,GAAwB,EAAA;AAC9B,IAAM,wBAAA,GAA2B,GAAA;AACjC,IAAM,gBAAA,GAAmB,GAAA;AACzB,IAAM,aAAA,GAAgB,GAAA;AACtB,IAAM,cAAA,GAAiB,GAAA;AACvB,IAAM,cAAA,GAAiB,GAAA;AACvB,IAAM,cAAA,GAAiB,GAAA;AACvB,IAAM,cAAA,GAAiB,GAAA;AACvB,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,oBAAA,GAAuB,EAAA;AAE7B,IAAM,sBAAsB,WAAA,GAAc,SAAA;AAG1C,IAAM,iBAAA,GAAoB,CAAA;AAC1B,IAAM,eAAA,GAAkB,EAAA;AACxB,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,4BAAA,GAA+B,CAAA;AACrC,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,sBAAA,GAAyB,EAAA;AAG/B,IAAM,yBAAA,GAA4B,EAAA;AAClC,IAAM,yBAAA,GAA4B,EAAA;AAClC,IAAM,uBAAA,GAA0B,GAAA;AAChC,IAAM,0BAAA,GAA6B,GAAA;AACnC,IAAM,sBAAA,GAAyB,GAAA;AAC/B,IAAM,mBAAA,GAAsB,GAAA;AAE5B,IAAM,sBAAA,GAAyB,CAAA;AAC/B,IAAM,gCAAA,GAAmC,CAAA;AAEzC,IAAM,4BAAA,GAA+B,uBAAA;AACrC,IAAM,2BAAA,GAA8B,yBAAA;AACpC,IAAM,8BAAA,GAAiC,yBAAA;AACvC,IAAM,6BAAA,GAAgC,yBAAA;AACtC,IAAM,8BAAA,GAAiC,4BAAA;AACvC,IAAM,8BAAA,GAAiC,4BAAA;AACvC,IAAM,gDAAA,GAAmD,0BAAA;AACzD,IAAM,yBAAA,GACJ,2EAAA;AACF,IAAM,wBAAA,GAA2B,iCAAA;AAEjC,IAAM,qBAAA,mBAAwB,IAAI,GAAA,CAAI,CAAC,UAAU,CAAC,CAAA;AAClD,IAAM,4BAAA,mBAA+B,IAAI,GAAA,CAAI,CAAC,UAAU,CAAC,CAAA;AACzD,IAAM,6BAAA,mBAAgC,IAAI,GAAA,CAAI,CAAC,UAAU,CAAC,CAAA;AAI1D,eAAsB,kBAAkB,MAAA,EAMV;AAC5B,EAAA,MAAM,EAAE,QAAA,EAAU,aAAA,EAAe,sBAAA,EAAwB,MAAA,EAAQ,WAAU,GAAI,MAAA;AAE/E,EAAA,IACE,OAAO,sBAAA,KAA2B,MAAA,IAClC,QAAA,CAAS,eAAA,KAAoB,OAAO,sBAAA,EACpC;AACA,IAAA,MAAM,GAAA;AAAA,MACJ,0BAAA;AAAA,MACA,mBAAmB,MAAA,CAAO,QAAA,CAAS,eAAe,CAAC,CAAA,6CAAA,EAAgD,OAAO,sBAAsB,CAAA;AAAA,KAClI;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,sBAAsB,IAAA,EAAM;AACvC,IAAA,OAAO,sBAAA,CAAuB;AAAA,MAC5B,QAAA;AAAA,MACA,aAAA;AAAA,MACA,sBAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAGA,EAAA,MAAM,GAAA,GAAM,cAAA,CAAe,QAAA,CAAS,KAAK,CAAA;AACzC,EAAA,eAAA,CAAgB,GAAG,CAAA;AAKnB,EAAA,IAAI,QAAA,CAAS,aAAa,gBAAA,EAAkB;AAC1C,IAAA,OAAO,yBAAA,CAA0B;AAAA,MAC/B,GAAA;AAAA,MACA,QAAA;AAAA,MACA,aAAA;AAAA,MACA,sBAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AACA,EAAA,IAAI,QAAA,CAAS,QAAA,IAAY,QAAA,CAAS,QAAA,KAAa,UAAA,EAAY;AACzD,IAAA,MAAM,GAAA;AAAA,MACJ,sBAAA;AAAA,MACA,CAAA,wCAAA,EAA2C,SAAS,QAAQ,CAAA,CAAA;AAAA,KAC9D;AAAA,EACF;AAEA,EAAA,OAAO,uBAAA,CAAwB;AAAA,IAC7B,GAAA;AAAA,IACA,QAAA;AAAA,IACA,aAAA;AAAA,IACA,sBAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAEA,eAAe,wBAAwB,MAAA,EAMT;AAC5B,EAAA,MAAM,EAAE,GAAA,EAAK,QAAA,EAAU,aAAA,EAAe,sBAAA,EAAwB,QAAO,GAAI,MAAA;AAEzE,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,QAAA,CAAS,WAAA,EAAa,cAAc,SAAS,CAAA;AAC9D,EAAA,MAAM,aAAa,IAAA,CAAK,QAAA;AAAA,IACtB,oBAAA;AAAA,IACA,oBAAA,GAAuB;AAAA,GACzB;AAGA,EAAA,IAAI,CAAC,eAAe,UAAA,CAAW,QAAA,CAAS,GAAG,EAAE,CAAA,EAAG,aAAa,CAAA,EAAG;AAC9D,IAAA,MAAM,GAAA;AAAA,MACJ,gBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAIA,EAAA,IAAI,SAAS,KAAA,CAAM,WAAA,EAAY,KAAM,UAAA,CAAW,aAAa,CAAA,EAAG;AAC9D,IAAA,MAAM,GAAA,CAAI,sBAAA,EAAwB,CAAA,WAAA,EAAc,QAAA,CAAS,KAAK,CAAA,8BAAA,CAAgC,CAAA;AAAA,EAChG;AAGA,EAAA,IAAI,CAAC,eAAe,UAAA,CAAW,QAAA,CAAS,IAAI,EAAE,CAAA,EAAG,sBAAsB,CAAA,EAAG;AACxE,IAAA,MAAM,GAAA;AAAA,MACJ,0BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,cAAA,GAAiB,WAAW,sBAAsB,CAAA;AACxD,EAAA,IAAI,QAAA,CAAS,MAAA,CAAO,WAAA,EAAY,KAAM,cAAA,EAAgB;AACpD,IAAA,MAAM,GAAA;AAAA,MACJ,uBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAIA,EAAA,IAAI,CAAC,iBAAA,CAAkB,IAAA,CAAK,QAAA,CAAS,WAAW,CAAA,EAAG;AACjD,IAAA,MAAM,GAAA,CAAI,sBAAsB,+CAA+C,CAAA;AAAA,EACjF;AACA,EAAA,IACE,MAAA,CAAO,kBAAA,KAAuB,MAAA,IAC9B,QAAA,CAAS,WAAA,CAAY,aAAY,KAAM,MAAA,CAAO,kBAAA,CAAmB,WAAA,EAAY,EAC7E;AACA,IAAA,MAAM,GAAA;AAAA,MACJ,sBAAA;AAAA,MACA,CAAA,YAAA,EAAe,QAAA,CAAS,WAAA,CAAY,WAAA,EAAa,CAAA,wCAAA;AAAA,KACnD;AAAA,EACF;AAGA,EAAA,MAAM,6BAA6B,EAAE,GAAA,EAAK,IAAA,EAAM,QAAA,EAAU,QAAQ,CAAA;AAKlE,EAAA,mBAAA,CAAoB,IAAI,CAAA;AAIxB,EAAA,MAAM,YAAA,GAAe,kBAAkB,IAAI,CAAA;AAC3C,EAAA,IAAI,OAAO,YAAA,KAAiB,MAAA,IAAa,QAAA,CAAS,IAAA,KAAS,OAAO,YAAA,EAAc;AAC9E,IAAA,MAAM,GAAA;AAAA,MACJ,eAAA;AAAA,MACA,CAAA,iBAAA,EAAoB,QAAA,CAAS,IAAI,CAAA,yBAAA,EAA4B,OAAO,YAAY,CAAA;AAAA,KAClF;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,SAAS,MAAA,EAAQ;AAC5B,IAAA,IAAA,CACG,MAAA,CAAO,iBAAiB,MAAA,IAAa,MAAA,CAAO,iBAAiB,IAAA,KAC9D,MAAA,CAAO,oCAAoC,IAAA,EAC3C;AACA,MAAA,MAAM,GAAA;AAAA,QACJ,eAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IACE,MAAA,CAAO,YAAA,KAAiB,MAAA,IACxB,MAAA,CAAO,YAAA,KAAiB,IAAA,IACxB,YAAA,CAAa,IAAA,KAAS,MAAA,CAAO,YAAA,CAAa,WAAA,EAAY,EACtD;AACA,MAAA,MAAM,GAAA;AAAA,QACJ,eAAA;AAAA,QACA,QAAQ,YAAA,CAAa,IAAI,0BAA0B,MAAA,CAAO,YAAA,CAAa,aAAa,CAAA;AAAA,OACtF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,QAAA,CAAS,IAAA;AAAA,IACf,YAAY,QAAA,CAAS,WAAA;AAAA,IACrB,gBAAgB,QAAA,CAAS,eAAA;AAAA,IACzB,MAAM,YAAA,CAAa,IAAA;AAAA,IACnB,OAAO,YAAA,CAAa,KAAA;AAAA,IACpB,OAAO,YAAA,CAAa,KAAA;AAAA,IACpB,OAAO,YAAA,CAAa,KAAA;AAAA,IACpB,OAAO,YAAA,CAAa,KAAA;AAAA,IACpB,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,WAAA,EAAY;AAAA,IACvC,gBAAA,EAAkB;AAAA,GACpB;AACF;AAIA,eAAe,6BAA6B,MAAA,EAK1B;AAChB,EAAA,MAAM,EAAE,GAAA,EAAK,IAAA,EAAM,QAAA,EAAU,QAAO,GAAI,MAAA;AAExC,EAAA,MAAM,OAAA,GAAU,YAAY,GAAG,CAAA;AAC/B,EAAA,MAAM,UAAA,GAAa,yBAAyB,OAAO,CAAA;AACnD,EAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,UAAA,CAAW,mBAAmB,CAAA;AAE/D,EAAA,MAAM,cAAA,GACJ,MAAA,CAAO,oBAAA,EAAsB,WAAA,EAAY,IAAK,oCAAA;AAChD,EAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU,IAAI,UAAA,CAAW,QAAA,CAAS,QAAA,CAAS,MAAA,GAAS,CAAC,CAAA,CAAE,OAAO,CAAC,CAAA;AACpF,EAAA,IAAI,WAAW,cAAA,EAAgB;AAC7B,IAAA,MAAM,GAAA;AAAA,MACJ,2BAAA;AAAA,MACA,CAAA,qBAAA,EAAwB,MAAM,CAAA,uBAAA,EAA0B,cAAc,CAAA;AAAA,KACxE;AAAA,EACF;AAEA,EAAA,MAAM,sBAAsB,QAAQ,CAAA;AAEpC,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,CAAS,iBAAA,EAAmB,oBAAoB,EAAE,CAAA;AAC3E,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,QAAA,CAAS,eAAA,EAAiB,kBAAkB,EAAE,CAAA;AACrE,EAAA,MAAM,aAAA,GAAgB,GAAA,CAAI,QAAA,CAAS,CAAA,EAAG,cAAc,SAAS,CAAA;AAC7D,EAAA,MAAM,mBAAA;AAAA,IACJ,YAAY,MAAM,CAAA;AAAA,IAClB,QAAA;AAAA,IACA,aAAA;AAAA,IACA,iBAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAa,UAAA,EAAW,GAAI,UAAA;AAC9C,EAAA,MAAM,kBAAkB,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,EAAQ,UAAU,CAAC,CAAA;AAC/D,EAAA,MAAM,YAAA,GAAe,QAAA,CAAS,QAAA,CAAS,mBAAA,EAAqB,sBAAsB,EAAE,CAAA;AACpF,EAAA,IAAI,CAAC,cAAA,CAAe,YAAA,EAAc,eAAe,CAAA,EAAG;AAClD,IAAA,MAAM,GAAA;AAAA,MACJ,mBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,QAAA,CAAS,CAAC,CAAC,CAAA;AAC9C,EAAA,MAAM,mBAAA;AAAA,IACJ,WAAA;AAAA,IACA,WAAA;AAAA,IACA,QAAA;AAAA,IACA,qBAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,MAAM,oBAAA,CAAqB;AAAA,IACzB,YAAY,QAAA,CAAS,eAAA;AAAA,IACrB,QAAA;AAAA,IACA,IAAA;AAAA,IACA,QAAA;AAAA,IACA,MAAM,QAAA,CAAS,IAAA;AAAA,IACf;AAAA,GACD,CAAA;AACH;AAEA,eAAe,qBAAqB,MAAA,EAOlB;AAChB,EAAA,MAAM,EAAE,UAAA,EAAY,QAAA,EAAU,MAAM,QAAA,EAAU,IAAA,EAAM,QAAO,GAAI,MAAA;AAC/D,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,IACE,OAAO,0BAAA,KAA+B,IAAA,IACtC,SAAS,KAAA,IACT,MAAA,CAAO,iBAAiB,KAAA,EACxB;AACA,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,CAAI,2BAA2B,4CAA4C,CAAA;AAAA,EACnF;AAEA,EAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,QAAA,CAAS,MAAA,GAAS,CAAC,CAAA;AAC7C,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,UAAA,CAAW,YAAA,EAAc,aAAa,CAAA;AAC/D,EAAA,MAAM,SAAA,CAAU,OAAA,EAAS,QAAA,EAAU,aAAA,EAAe,GAAG,CAAA;AAErD,EAAA,MAAM,oBAAoB,MAAM,2BAAA;AAAA,IAC9B,wBAAA,CAAyB,UAAA,CAAW,oBAAA,EAAsB,sBAAA,EAAwB,CAAC,CAAA;AAAA,IACnF,MAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAM,sBAAA,CAAuB,OAAA,EAAS,iBAAA,CAAkB,CAAC,GAAG,gBAAgB,CAAA;AAC5E,EAAA,MAAM,sBAAsB,iBAAA,CAAkB,CAAC,GAAG,QAAA,CAAS,CAAC,GAAG,gBAAgB,CAAA;AAE/E,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,UAAA,CAAW,SAAA,EAAW,SAAS,CAAA;AACvD,EAAA,MAAM,UAAU,MAAA,EAAQ,iBAAA,CAAkB,CAAC,CAAA,EAAG,WAAW,GAAG,CAAA;AAC5D,EAAA,IAAI,MAAA,CAAO,WAAA,CAAY,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG;AACnC,IAAA,MAAM,GAAA,CAAI,2BAA2B,4CAA4C,CAAA;AAAA,EACnF;AAEA,EAAA,MAAM,OAAA,GAAU,MAAM,oBAAA,CAAoC;AAAA,IACxD,QAAQ,UAAA,CAAW,OAAA;AAAA,IACnB,YAAA,EAAc,SAAA;AAAA,IACd,MAAA;AAAA,IACA,OAAA;AAAA,IACA,KAAA,EAAO;AAAA,GACR,CAAA;AAED,EAAA,MAAM,UAAA,GAAa,MAAM,oBAAA,CAAuC;AAAA,IAC9D,QAAQ,UAAA,CAAW,UAAA;AAAA,IACnB,YAAA,EAAc,iBAAA;AAAA,IACd,MAAA;AAAA,IACA,OAAA;AAAA,IACA,KAAA,EAAO;AAAA,GACR,CAAA;AACD,EAAA,qCAAA,CAAsC,SAAS,UAAU,CAAA;AACzD,EAAA,aAAA,CAAc,OAAA,EAAS,QAAA,CAAS,CAAC,CAAA,EAAG,MAAM,GAAG,CAAA;AAC7C,EAAA,gBAAA,CAAiB,UAAA,EAAY,UAAU,GAAG,CAAA;AAC5C;AAEA,SAAS,oBAAoB,IAAA,EAAwB;AACnD,EAAA,IAAA,CAAK,IAAA,CAAK,gBAAgB,CAAA,GAAI,CAAA,MAAU,CAAA,EAAG;AACzC,IAAA,MAAM,GAAA,CAAI,iBAAiB,kEAAkE,CAAA;AAAA,EAC/F;AACF;AA+BA,eAAe,qBAAwD,MAAA,EAMxD;AACb,EAAA,MAAM,EAAE,MAAA,EAAQ,YAAA,EAAc,MAAA,EAAQ,OAAA,EAAS,OAAM,GAAI,MAAA;AACzD,EAAA,IACE,CAAC,MAAA,IACD,OAAO,MAAA,CAAO,IAAA,KAAS,QAAA,IACvB,OAAO,MAAA,CAAO,SAAA,KAAc,QAAA,IAC5B,OAAO,MAAA,CAAO,mBAAmB,QAAA,EACjC;AACA,IAAA,MAAM,GAAA,CAAI,yBAAA,EAA2B,CAAA,EAAG,KAAK,CAAA,yBAAA,CAA2B,CAAA;AAAA,EAC1E;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAI,CAAA;AAAA,EACjC,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,uBAAA,EAAyB,CAAA,EAAG,KAAK,CAAA,yBAAA,EAA4B,CAAC,CAAA,CAAE,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,aAAa,uBAAA,CAAwB,MAAA,CAAO,IAAA,EAAM,MAAA,EAAQ,cAAc,KAAK,CAAA;AACnF,EAAA,MAAM,OAAO,UAAA,CAAW,MAAA;AACxB,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AAC5D,IAAA,MAAM,GAAA,CAAI,uBAAA,EAAyB,CAAA,EAAG,KAAK,CAAA,0BAAA,CAA4B,CAAA;AAAA,EACzE;AAEA,EAAA,MAAM,cAAc,MAAM,2BAAA;AAAA,IACxB,yBAAyB,MAAA,CAAO,cAAA,EAAgB,CAAA,EAAG,KAAK,iBAAiB,CAAC,CAAA;AAAA,IAC1E,MAAA;AAAA,IACA,GAAG,KAAK,CAAA,aAAA;AAAA,GACV;AACA,EAAA,MAAM,uBAAuB,OAAA,EAAS,WAAA,CAAY,CAAC,CAAA,EAAG,CAAA,EAAG,KAAK,CAAA,oBAAA,CAAsB,CAAA;AACpF,EAAA,4BAAA,CAA6B,WAAA,CAAY,CAAC,CAAA,EAAG,WAAA,CAAY,YAAY,MAAA,GAAS,CAAC,CAAA,EAAG,MAAA,EAAQ,KAAK,CAAA;AAE/F,EAAA,IAAI,CAAC,kBAAA,CAAmB,IAAA,CAAK,MAAA,CAAO,SAAS,CAAA,EAAG;AAC9C,IAAA,MAAM,GAAA,CAAI,uBAAA,EAAyB,CAAA,EAAG,KAAK,CAAA,+CAAA,CAAiD,CAAA;AAAA,EAC9F;AACA,EAAA,MAAM,mBAAA;AAAA,IACJ,MAAM,QAAA,CAAS,WAAA,CAAY,CAAC,CAAC,CAAA;AAAA,IAC7B,UAAA,CAAW,OAAO,SAAS,CAAA;AAAA,IAC3B,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,WAAW,IAAI,CAAA;AAAA,IACxC,2BAAA;AAAA,IACA,GAAG,KAAK,CAAA,UAAA;AAAA,GACV;AAEA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,uBAAA,CACP,GAAA,EACA,MAAA,EACA,YAAA,EACA,KAAA,EACmC;AACnC,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClE,IAAA,OAAO,EAAE,IAAA,EAAM,GAAA,EAAK,MAAA,EAAO;AAAA,EAC7B;AACA,EAAA,IAAI,EAAE,gBAAgB,MAAA,CAAA,EAAS;AAC7B,IAAA,OAAO,EAAE,IAAA,EAAM,GAAA,EAAK,MAAA,EAAO;AAAA,EAC7B;AACA,EAAA,MAAM,IAAA,GAAO,2BAAA,CAA4B,GAAA,EAAK,YAAY,CAAA;AAC1D,EAAA,IAAI,SAAS,IAAA,EAAM;AACjB,IAAA,MAAM,GAAA;AAAA,MACJ,uBAAA;AAAA,MACA,CAAA,EAAG,KAAK,CAAA,sBAAA,EAAyB,YAAY,CAAA,mDAAA;AAAA,KAC/C;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,EAAE;AAAA,EAC1C,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,uBAAA,EAAyB,CAAA,EAAG,KAAK,CAAA,sCAAA,EAAyC,CAAC,CAAA,CAAE,CAAA;AAAA,EACzF;AACF;AAEA,SAAS,2BAAA,CAA4B,KAAa,QAAA,EAAiC;AACjF,EAAA,IAAI,MAAA,GAAS,kBAAA,CAAmB,GAAA,EAAK,CAAC,CAAA;AACtC,EAAA,IAAI,GAAA,CAAI,MAAM,CAAA,KAAM,GAAA,EAAK,OAAO,IAAA;AAChC,EAAA,MAAA,EAAA;AAEA,EAAA,OAAO,MAAA,GAAS,IAAI,MAAA,EAAQ;AAC1B,IAAA,MAAA,GAAS,kBAAA,CAAmB,KAAK,MAAM,CAAA;AACvC,IAAA,IAAI,GAAA,CAAI,MAAM,CAAA,KAAM,GAAA,EAAK,OAAO,IAAA;AAChC,IAAA,IAAI,GAAA,CAAI,MAAM,CAAA,KAAM,GAAA,EAAK;AACvB,MAAA,MAAA,EAAA;AACA,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,cAAA,CAAe,GAAA,EAAK,MAAM,CAAA;AACtC,IAAA,IAAI,GAAA,KAAQ,MAAM,OAAO,IAAA;AACzB,IAAA,MAAA,GAAS,kBAAA,CAAmB,GAAA,EAAK,GAAA,CAAI,GAAG,CAAA;AACxC,IAAA,IAAI,GAAA,CAAI,MAAM,CAAA,KAAM,GAAA,EAAK,OAAO,IAAA;AAChC,IAAA,MAAA,GAAS,kBAAA,CAAmB,GAAA,EAAK,MAAA,GAAS,CAAC,CAAA;AAC3C,IAAA,MAAM,UAAA,GAAa,MAAA;AACnB,IAAA,MAAM,QAAA,GAAW,gBAAA,CAAiB,GAAA,EAAK,UAAU,CAAA;AACjD,IAAA,IAAI,QAAA,KAAa,MAAM,OAAO,IAAA;AAC9B,IAAA,IAAI,IAAI,KAAA,KAAU,QAAA,SAAiB,GAAA,CAAI,KAAA,CAAM,YAAY,QAAQ,CAAA;AACjE,IAAA,MAAA,GAAS,QAAA;AAAA,EACX;AAEA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,kBAAA,CAAmB,KAAa,MAAA,EAAwB;AAC/D,EAAA,OAAO,MAAA,GAAS,IAAI,MAAA,IAAU,YAAA,CAAa,KAAK,GAAA,CAAI,MAAM,CAAE,CAAA,EAAG,MAAA,EAAA;AAC/D,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,cAAA,CAAe,KAAa,MAAA,EAAuD;AAC1F,EAAA,IAAI,GAAA,CAAI,MAAM,CAAA,KAAM,GAAA,EAAK,OAAO,IAAA;AAChC,EAAA,IAAI,SAAS,MAAA,GAAS,CAAA;AACtB,EAAA,IAAI,OAAA,GAAU,KAAA;AACd,EAAA,OAAO,MAAA,GAAS,IAAI,MAAA,EAAQ;AAC1B,IAAA,MAAM,IAAA,GAAO,IAAI,MAAM,CAAA;AACvB,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,OAAA,GAAU,KAAA;AAAA,IACZ,CAAA,MAAA,IAAW,SAAS,IAAA,EAAM;AACxB,MAAA,OAAA,GAAU,IAAA;AAAA,IACZ,CAAA,MAAA,IAAW,SAAS,GAAA,EAAK;AACvB,MAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,MAAA,EAAQ,SAAS,CAAC,CAAA;AAC1C,MAAA,IAAI;AACF,QAAA,OAAO,EAAE,OAAO,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA,EAAa,GAAA,EAAK,SAAS,CAAA,EAAE;AAAA,MAC/D,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,IACF;AACA,IAAA,MAAA,EAAA;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,gBAAA,CAAiB,KAAa,MAAA,EAA+B;AACpE,EAAA,IAAI,MAAA,IAAU,GAAA,CAAI,MAAA,EAAQ,OAAO,IAAA;AACjC,EAAA,IAAI,GAAA,CAAI,MAAM,CAAA,KAAM,GAAA,SAAY,cAAA,CAAe,GAAA,EAAK,MAAM,CAAA,EAAG,GAAA,IAAO,IAAA;AACpE,EAAA,IAAI,IAAI,MAAM,CAAA,KAAM,OAAO,GAAA,CAAI,MAAM,MAAM,GAAA,EAAK;AAC9C,IAAA,MAAM,KAAA,GAAQ,CAAC,GAAA,CAAI,MAAM,CAAC,CAAA;AAC1B,IAAA,IAAIA,UAAS,MAAA,GAAS,CAAA;AACtB,IAAA,OAAOA,OAAAA,GAAS,IAAI,MAAA,EAAQ;AAC1B,MAAA,MAAM,IAAA,GAAO,IAAIA,OAAM,CAAA;AACvB,MAAA,IAAI,SAAS,GAAA,EAAK;AAChB,QAAA,MAAM,WAAA,GAAc,cAAA,CAAe,GAAA,EAAKA,OAAM,CAAA;AAC9C,QAAA,IAAI,WAAA,KAAgB,MAAM,OAAO,IAAA;AACjC,QAAAA,UAAS,WAAA,CAAY,GAAA;AACrB,QAAA;AAAA,MACF;AACA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,IAAA,KAAS,GAAA,EAAK;AAChC,QAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,MACjB,CAAA,MAAA,IAAW,IAAA,KAAS,GAAA,IAAO,IAAA,KAAS,GAAA,EAAK;AACvC,QAAA,MAAM,IAAA,GAAO,MAAM,GAAA,EAAI;AACvB,QAAA,IAAK,IAAA,KAAS,OAAO,IAAA,KAAS,GAAA,IAAS,SAAS,GAAA,IAAO,IAAA,KAAS,KAAM,OAAO,IAAA;AAC7E,QAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAOA,OAAAA,GAAS,CAAA;AAAA,MAC1C;AACA,MAAAA,OAAAA,EAAAA;AAAA,IACF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA,GAAS,MAAA;AACb,EAAA,OAAO,MAAA,GAAS,IAAI,MAAA,IAAU,CAAC,iBAAiB,IAAA,CAAK,GAAA,CAAI,MAAM,CAAE,CAAA,EAAG,MAAA,EAAA;AACpE,EAAA,OAAO,MAAA,GAAS,SAAS,MAAA,GAAS,IAAA;AACpC;AAEA,SAAS,qCAAA,CACP,SACA,UAAA,EACM;AACN,EAAA,MAAM,YAAY,OAAA,CAAQ,uBAAA;AAC1B,EAAA,MAAM,WAAW,UAAA,CAAW,uBAAA;AAC5B,EAAA,IAAI,CAAC,yBAAA,CAA0B,SAAS,KAAK,CAAC,yBAAA,CAA0B,QAAQ,CAAA,EAAG;AACjF,IAAA,MAAM,GAAA;AAAA,MACJ,qBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,cAAc,QAAA,EAAU;AAC1B,IAAA,MAAM,GAAA;AAAA,MACJ,qBAAA;AAAA,MACA,CAAA,iCAAA,EAAoC,SAAS,CAAA,4BAAA,EAA+B,QAAQ,CAAA;AAAA,KACtF;AAAA,EACF;AACF;AAEA,SAAS,0BAA0B,KAAA,EAAiC;AAClE,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,aAAA,CAAc,KAAK,KAAK,KAAA,IAAS,CAAA;AAC9E;AAEA,eAAe,2BAAA,CACb,KAAA,EACA,MAAA,EACA,KAAA,EACiC;AACjC,EAAA,MAAM,UAAA,GAAa,CAAC,KAAA,EAAO,CAAC,GAAG,KAAK,CAAA,CAAE,SAAS,CAAA;AAC/C,EAAA,IAAI,SAAA;AACJ,EAAA,KAAA,MAAW,SAAS,UAAA,EAAY;AAC9B,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU,IAAI,UAAA,CAAW,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA,CAAE,OAAO,CAAC,CAAA;AAC9E,MAAA,MAAM,cAAA,GACJ,MAAA,CAAO,oBAAA,EAAsB,WAAA,EAAY,IAAK,oCAAA;AAChD,MAAA,IAAI,WAAW,cAAA,EAAgB;AAC7B,QAAA,MAAM,GAAA;AAAA,UACJ,2BAAA;AAAA,UACA,CAAA,EAAG,KAAK,CAAA,kBAAA,EAAqB,MAAM,0BAA0B,cAAc,CAAA;AAAA,SAC7E;AAAA,MACF;AACA,MAAA,MAAM,sBAAsB,KAAK,CAAA;AACjC,MAAA,OAAO,KAAA;AAAA,IACT,SAAS,CAAA,EAAG;AACV,MAAA,SAAA,GAAY,CAAA;AAAA,IACd;AAAA,EACF;AACA,EAAA,IAAI,SAAA,YAAqB,kBAAkB,MAAM,SAAA;AACjD,EAAA,MAAM,GAAA,CAAI,2BAAA,EAA6B,CAAA,EAAG,KAAK,CAAA,sCAAA,CAAwC,CAAA;AACzF;AAEA,SAAS,4BAAA,CACP,IAAA,EACA,IAAA,EACA,MAAA,EACA,KAAA,EACM;AACN,EAAA,MAAM,cAAA,GACJ,MAAA,CAAO,oBAAA,EAAsB,WAAA,EAAY,IAAK,oCAAA;AAChD,EAAA,MAAM,sBAAsB,cAAA,KAAmB,oCAAA;AAC/C,EAAA,MAAM,kBAAkB,mBAAA,GACpB,CAAC,2BAA2B,wBAAwB,CAAA,GACpD,CAAC,yBAAyB,CAAA;AAE9B,EAAA,IAAI,CAAC,eAAA,CAAgB,QAAA,CAAS,IAAA,CAAK,OAAO,CAAA,EAAG;AAC3C,IAAA,MAAM,GAAA;AAAA,MACJ,2BAAA;AAAA,MACA,CAAA,EAAG,KAAK,CAAA,6BAAA,EAAgC,IAAA,CAAK,OAAO,CAAA,yCAAA;AAAA,KACtD;AAAA,EACF;AACA,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,IAAA,CAAK,OAAA,EAAS;AAChC,IAAA,MAAM,GAAA;AAAA,MACJ,2BAAA;AAAA,MACA,GAAG,KAAK,CAAA,4BAAA,EAA+B,KAAK,MAAM,CAAA,qBAAA,EAAwB,KAAK,OAAO,CAAA;AAAA,KACxF;AAAA,EACF;AACA,EAAA,MAAM,gBAAA,GAAmB,IAAA,CAAK,YAAA,CAAkB,IAAA,CAAA,yBAAyB,CAAA;AACzE,EAAA,IAAI,kBAAkB,EAAA,EAAI;AACxB,IAAA,MAAM,GAAA,CAAI,2BAAA,EAA6B,CAAA,EAAG,KAAK,CAAA,qCAAA,CAAuC,CAAA;AAAA,EACxF;AACF;AAEA,SAAS,aAAA,CACP,OAAA,EACA,OAAA,EACA,IAAA,EACA,GAAA,EACM;AACN,EAAA,IAAI,OAAA,CAAQ,OAAO,KAAA,EAAO;AACxB,IAAA,MAAM,IAAI,qBAAA,EAAuB,CAAA,YAAA,EAAe,OAAO,OAAA,CAAQ,EAAE,CAAC,CAAA,WAAA,CAAa,CAAA;AAAA,EACjF;AACA,EAAA,IAAI,OAAA,CAAQ,OAAA,KAAY,CAAA,IAAK,OAAA,CAAQ,YAAY,CAAA,EAAG;AAClD,IAAA,MAAM,GAAA;AAAA,MACJ,qBAAA;AAAA,MACA,CAAA,6BAAA,EAAgC,OAAO,OAAA,CAAQ,OAAO,CAAC,CAAA,SAAA,EAAY,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAC,CAAA;AAAA,KAC5F;AAAA,EACF;AACA,EAAA,yBAAA,CAA0B,OAAA,EAAS,YAAY,GAAG,CAAA;AAElD,EAAA,MAAM,MAAA,GAAS,cAAc,OAAO,CAAA;AACpC,EAAA,IAAI,OAAO,QAAQ,KAAA,KAAU,QAAA,IAAY,QAAQ,KAAA,CAAM,WAAA,EAAY,KAAM,MAAA,CAAO,KAAA,EAAO;AACrF,IAAA,MAAM,GAAA;AAAA,MACJ,qBAAA;AAAA,MACA,kBAAkB,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAC,CAAA,0BAAA,EAA6B,OAAO,KAAK,CAAA;AAAA,KAClF;AAAA,EACF;AACA,EAAA,IAAI,OAAO,QAAQ,KAAA,KAAU,QAAA,IAAY,QAAQ,KAAA,CAAM,WAAA,EAAY,KAAM,MAAA,CAAO,KAAA,EAAO;AACrF,IAAA,MAAM,GAAA;AAAA,MACJ,qBAAA;AAAA,MACA,mBAAmB,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAC,CAAA,2BAAA,EAA8B,OAAO,KAAK,CAAA;AAAA,KACpF;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,SAAS,CAAA,EAAG;AACrC,IAAA,MAAM,GAAA,CAAI,uBAAuB,iCAAiC,CAAA;AAAA,EACpE;AACA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,QAAA,CAAS,oBAAA,EAAsB,uBAAuB,EAAE,CAAA;AAC/E,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,SAAA,CAAU,IAAA,CAAK,CAAC,UAAU,kBAAA,CAAmB,KAAA,EAAO,MAAA,EAAQ,SAAS,CAAC,CAAA;AAC9F,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC3C,IAAA,MAAM,GAAA,CAAI,uBAAuB,6DAA6D,CAAA;AAAA,EAChG;AACA,EAAA,MAAM,MAAA,GAAU,QAAoC,WAAW,CAAA;AAC/D,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,qBAAA,CAAsB,GAAA,CAAI,MAAM,CAAA,EAAG;AACpE,IAAA,MAAM,IAAI,qBAAA,EAAuB,CAAA,WAAA,EAAc,MAAA,CAAO,MAAM,CAAC,CAAA,gBAAA,CAAkB,CAAA;AAAA,EACjF;AACA,EAAA,uBAAA,CAAwB,OAAA,EAAS,MAAM,SAAS,CAAA;AAClD;AAEA,SAAS,gBAAA,CAAiB,QAAA,EAA4B,QAAA,EAAsB,GAAA,EAAiB;AAC3F,EAAA,IAAI,QAAA,CAAS,OAAO,OAAA,EAAS;AAC3B,IAAA,MAAM,IAAI,sBAAA,EAAwB,CAAA,eAAA,EAAkB,OAAO,QAAA,CAAS,EAAE,CAAC,CAAA,aAAA,CAAe,CAAA;AAAA,EACxF;AACA,EAAA,IAAI,QAAA,CAAS,YAAY,CAAA,EAAG;AAC1B,IAAA,MAAM,GAAA;AAAA,MACJ,sBAAA;AAAA,MACA,CAAA,gCAAA,EAAmC,MAAA,CAAO,QAAA,CAAS,OAAO,CAAC,CAAA;AAAA,KAC7D;AAAA,EACF;AACA,EAAA,yBAAA,CAA0B,QAAA,EAAU,eAAe,GAAG,CAAA;AAEtD,EAAA,sBAAA,CAAuB;AAAA,IACrB,MAAA,EAAQ,QAAA,CAAS,QAAA,CAAS,yBAAA,EAA2B,4BAA4B,CAAC,CAAA;AAAA,IAClF,aAAa,QAAA,CAAS,UAAA;AAAA,IACtB,SAAS,QAAA,CAAS,cAAA;AAAA,IAClB,KAAA,EAAO,wBAAA;AAAA,IACP,MAAA,EAAQ;AAAA,GACT,CAAA;AACD,EAAA,sBAAA,CAAuB;AAAA,IACrB,MAAA,EAAQ,QAAA,CAAS,QAAA,CAAS,yBAAA,EAA2B,4BAA4B,EAAE,CAAA;AAAA,IACnF,aAAa,QAAA,CAAS,UAAA;AAAA,IACtB,SAAS,QAAA,CAAS,cAAA;AAAA,IAClB,KAAA,EAAO,wBAAA;AAAA,IACP,MAAA,EAAQ;AAAA,GACT,CAAA;AAED,EAAA,MAAM,gBAAA,GAAmB,UAAA;AAAA,IACvB,QAAA,CAAS,QAAA,CAAS,uBAAA,EAAyB,uBAAA,GAA0B,EAAE;AAAA,GACzE;AACA,EAAA,IACE,OAAO,SAAS,QAAA,KAAa,QAAA,IAC7B,SAAS,QAAA,CAAS,WAAA,OAAkB,gBAAA,EACpC;AACA,IAAA,MAAM,GAAA;AAAA,MACJ,sBAAA;AAAA,MACA,wBAAwB,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAC,6BAA6B,gBAAgB,CAAA;AAAA,KAChG;AAAA,EACF;AACA,EAAA,MAAM,SAAA,GAAY,SAAA,CAAU,QAAA,EAAU,0BAA0B,CAAA;AAChE,EAAA,IAAI,QAAA,CAAS,cAAc,SAAA,EAAW;AACpC,IAAA,MAAM,GAAA;AAAA,MACJ,sBAAA;AAAA,MACA,yBAAyB,MAAA,CAAO,QAAA,CAAS,SAAS,CAAC,6BAA6B,SAAS,CAAA;AAAA,KAC3F;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,QAAA,CAAS,SAAS,CAAA,EAAG;AACtC,IAAA,MAAM,GAAA,CAAI,wBAAwB,oCAAoC,CAAA;AAAA,EACxE;AACA,EAAA,MAAM,MAAA,GAAS,SAAA,CAAU,QAAA,EAAU,sBAAsB,CAAA;AACzD,EAAA,MAAM,OAAA,GAAU,SAAS,SAAA,CAAU,IAAA,CAAK,CAAC,KAAA,KAAU,sBAAA,CAAuB,KAAA,EAAO,MAAM,CAAC,CAAA;AACxF,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC3C,IAAA,MAAM,GAAA,CAAI,wBAAwB,+CAA+C,CAAA;AAAA,EACnF;AACA,EAAA,MAAM,MAAA,GAAU,QAAoC,WAAW,CAAA;AAC/D,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,6BAAA,CAA8B,GAAA,CAAI,MAAM,CAAA,EAAG;AAC5E,IAAA,MAAM,IAAI,sBAAA,EAAwB,CAAA,mBAAA,EAAsB,MAAA,CAAO,MAAM,CAAC,CAAA,gBAAA,CAAkB,CAAA;AAAA,EAC1F;AACF;AAUA,SAAS,kBAAA,CAAmB,KAAA,EAAgB,MAAA,EAAgB,SAAA,EAAgC;AAC1F,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,UAAU,OAAO,KAAA;AAChD,EAAA,MAAM,GAAA,GAAO,MAAkC,KAAK,CAAA;AACpD,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,MAAA,GAAS,GAAA;AACf,EAAA,MAAM,aAAA,GAAgB,OAAO,kBAAkB,CAAA;AAC/C,EAAA,IAAI,CAAC,kBAAA,CAAmB,aAAA,EAAe,OAAO,UAAA,EAAY,CAAC,GAAG,OAAO,KAAA;AACrE,EAAA,MAAM,MAAA,GAAS,OAAO,QAAQ,CAAA;AAC9B,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,MAAA,GAAS,QAAQ,OAAO,KAAA;AACjE,EAAA,MAAM,aAAA,GAAgB,OAAO,kBAAkB,CAAA;AAC/C,EAAA,MAAM,aAAA,GAAgB,SAAA,CAAU,CAAC,CAAA,KAAM,IAAI,CAAA,GAAI,CAAA;AAC/C,EAAA,OAAO,mBAAmB,aAAA,EAAe,KAAA,CAAM,IAAA,CAAK,SAAS,GAAG,aAAa,CAAA;AAC/E;AAEA,SAAS,kBAAA,CACP,UAAA,EACA,UAAA,EACA,UAAA,EACS;AACT,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,UAAU,KAAK,UAAA,CAAW,MAAA,GAAS,IAAI,OAAO,KAAA;AACjE,EAAA,KAAA,IAAS,KAAA,GAAQ,UAAA,EAAY,KAAA,GAAQ,EAAA,EAAI,KAAA,EAAA,EAAS;AAChD,IAAA,MAAM,SAAA,GAAY,WAAW,KAAK,CAAA;AAClC,IAAA,IAAI,CAAC,SAAA,IAAa,OAAO,SAAA,KAAc,UAAU,OAAO,KAAA;AACxD,IAAA,MAAM,GAAA,GAAO,UAAsC,KAAK,CAAA;AACxD,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,WAAW,KAAK,CAAA,GAAI,KAAK,OAAO,KAAA;AAAA,EACjE;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,uBAAA,CACP,OAAA,EACA,IAAA,EACA,SAAA,EACM;AACN,EAAA,MAAM,aAAA,GAAgB,UAAU,CAAC,CAAA;AACjC,EAAA,MAAM,QAAA,GAAW,oBAAA,CAAqB,OAAA,EAAS,aAAa,CAAA;AAC5D,EAAA,MAAM,gBAAA,GAAmB,UAAA;AAAA,IACvB,IAAA,CAAK,QAAA,CAAS,qBAAA,EAAuB,qBAAA,GAAwB,EAAE;AAAA,GACjE;AACA,EAAA,IACE,OAAO,QAAA,CAAS,UAAU,CAAA,KAAM,QAAA,IAChC,SAAS,UAAU,CAAA,CAAE,WAAA,EAAY,KAAM,gBAAA,EACvC;AACA,IAAA,MAAM,GAAA;AAAA,MACJ,qBAAA;AAAA,MACA,gCAAgC,MAAA,CAAO,QAAA,CAAS,UAAU,CAAC,CAAC,yBAAyB,gBAAgB,CAAA;AAAA,KACvG;AAAA,EACF;AACA,EAAA,sBAAA,CAAuB;AAAA,IACrB,MAAA,EAAQ,IAAA,CAAK,QAAA,CAAS,wBAAA,EAA0B,2BAA2B,CAAC,CAAA;AAAA,IAC5E,WAAA,EAAa,SAAS,YAAY,CAAA;AAAA,IAClC,OAAA,EAAS,SAAS,gBAAgB,CAAA;AAAA,IAClC,KAAA,EAAO,gCAAA;AAAA,IACP,MAAA,EAAQ;AAAA,GACT,CAAA;AACD,EAAA,IAAI,gBAAgB,CAAA,EAAG;AAEvB,EAAA,MAAM,SAAA,GAAY,SAAS,WAAW,CAAA;AACtC,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC7B,IAAA,MAAM,GAAA,CAAI,uBAAuB,4CAA4C,CAAA;AAAA,EAC/E;AACA,EAAA,MAAM,OAAA,GAAU,SAAA,CAAU,IAAA,CAAK,CAAC,KAAA,KAAU,yBAAyB,KAAA,EAAO,SAAA,CAAU,CAAC,CAAC,CAAC,CAAA;AACvF,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC3C,IAAA,MAAM,GAAA,CAAI,uBAAuB,yDAAyD,CAAA;AAAA,EAC5F;AACA,EAAA,MAAM,MAAA,GAAU,QAAoC,WAAW,CAAA;AAC/D,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,4BAAA,CAA6B,GAAA,CAAI,MAAM,CAAA,EAAG;AAC3E,IAAA,MAAM,IAAI,qBAAA,EAAuB,CAAA,kBAAA,EAAqB,MAAA,CAAO,MAAM,CAAC,CAAA,gBAAA,CAAkB,CAAA;AAAA,EACxF;AACF;AAEA,SAAS,oBAAA,CACP,SACA,aAAA,EACyB;AACzB,EAAA,IAAI,gBAAgB,CAAA,EAAG;AACrB,IAAA,MAAM,SAAS,OAAA,CAAQ,SAAA;AACvB,IAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClE,MAAA,MAAM,GAAA,CAAI,uBAAuB,kCAAkC,CAAA;AAAA,IACrE;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAM,aAAa,OAAA,CAAQ,mBAAA;AAC3B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA,EAAG;AAC9B,IAAA,MAAM,GAAA,CAAI,uBAAuB,2CAA2C,CAAA;AAAA,EAC9E;AACA,EAAA,MAAM,cAAA,GAAiB,UAAA,CAAW,IAAA,CAAK,CAAC,SAAA,KAAc;AACpD,IAAA,IAAI,CAAC,aAAa,OAAO,SAAA,KAAc,YAAY,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,EAAG,OAAO,KAAA;AACpF,IAAA,MAAM,EAAA,GAAM,UAAsC,IAAI,CAAA;AACtD,IAAA,OAAO,OAAO,EAAA,KAAO,QAAA,IAAY,kBAAA,CAAmB,IAAI,aAAa,CAAA;AAAA,EACvE,CAAC,CAAA;AACD,EAAA,IAAI,CAAC,cAAA,IAAkB,OAAO,cAAA,KAAmB,QAAA,EAAU;AACzD,IAAA,MAAM,GAAA;AAAA,MACJ,qBAAA;AAAA,MACA,6DAA6D,aAAa,CAAA;AAAA,KAC5E;AAAA,EACF;AACA,EAAA,OAAO,cAAA;AACT;AAEA,SAAS,kBAAA,CAAmB,IAAY,aAAA,EAAgC;AACtE,EAAA,MAAM,KAAA,GAAQ,aAAA,CAAc,IAAA,CAAK,EAAE,CAAA;AACnC,EAAA,OAAO,KAAA,KAAU,QAAQ,MAAA,CAAO,QAAA,CAAS,MAAM,CAAC,CAAA,EAAG,EAAE,CAAA,KAAM,aAAA;AAC7D;AAEA,SAAS,wBAAA,CAAyB,OAAgB,MAAA,EAAyB;AACzE,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,UAAU,OAAO,KAAA;AAChD,EAAA,MAAM,GAAA,GAAO,MAAkC,KAAK,CAAA;AACpD,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,MAAA,GAAS,GAAA;AACf,EAAA,MAAM,WACJ,OAAO,MAAA,CAAO,QAAQ,CAAA,KAAM,WACxB,MAAA,CAAO,QAAQ,CAAA,GACf,OAAO,OAAO,SAAS,CAAA,KAAM,QAAA,GAC3B,MAAA,CAAO,SAAS,CAAA,GAChB,MAAA;AACR,EAAA,OAAO,OAAO,QAAA,KAAa,QAAA,IAAY,MAAA,IAAU,QAAA;AACnD;AAEA,SAAS,sBAAA,CAAuB,OAAgB,MAAA,EAAyB;AACvE,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,UAAU,OAAO,KAAA;AAChD,EAAA,MAAM,GAAA,GAAO,MAAkC,KAAK,CAAA;AACpD,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,cAAA,GAAkB,IAAgC,QAAQ,CAAA;AAChE,EAAA,OAAO,OAAO,cAAA,KAAmB,QAAA,IAAY,MAAA,IAAU,cAAA;AACzD;AAEA,SAAS,uBAAuB,MAAA,EAMvB;AACP,EAAA,MAAM,EAAE,MAAA,EAAQ,WAAA,EAAa,OAAA,EAAS,KAAA,EAAO,QAAO,GAAI,MAAA;AACxD,EAAA,IAAI,OAAO,gBAAgB,QAAA,IAAY,CAAC,gBAAgB,WAAA,EAAa,MAAA,CAAO,MAAM,CAAA,EAAG;AACnF,IAAA,MAAM,IAAI,MAAA,EAAQ,CAAA,EAAG,KAAK,CAAA,mBAAA,EAAsB,MAAA,CAAO,MAAM,CAAA,aAAA,CAAe,CAAA;AAAA,EAC9E;AACA,EAAA,IAAI,OAAO,YAAY,QAAA,IAAY,CAAC,gBAAgB,OAAA,EAAS,MAAA,CAAO,MAAM,CAAA,EAAG;AAC3E,IAAA,MAAM,IAAI,MAAA,EAAQ,CAAA,EAAG,KAAK,CAAA,wBAAA,EAA2B,MAAA,CAAO,MAAM,CAAA,aAAA,CAAe,CAAA;AAAA,EACnF;AACA,EAAA,MAAM,QAAA,GAAW,WAAW,WAAW,CAAA;AACvC,EAAA,MAAM,IAAA,GAAO,WAAW,OAAO,CAAA;AAC/B,EAAA,KAAA,IAAS,KAAA,GAAQ,CAAA,EAAG,KAAA,GAAQ,MAAA,CAAO,QAAQ,KAAA,EAAA,EAAS;AAClD,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,CAAA,GAAK,IAAA,CAAK,KAAK,CAAA,OAAS,QAAA,CAAS,KAAK,CAAA,GAAK,IAAA,CAAK,KAAK,CAAA,CAAA,EAAK;AACzE,MAAA,MAAM,IAAI,MAAA,EAAQ,CAAA,EAAG,KAAK,CAAA,aAAA,EAAgB,KAAK,CAAA,wCAAA,CAA0C,CAAA;AAAA,IAC3F;AAAA,EACF;AACF;AAEA,SAAS,eAAA,CAAgB,OAAe,UAAA,EAA6B;AACnE,EAAA,OAAO,MAAM,MAAA,KAAW,UAAA,GAAa,CAAA,IAAK,cAAA,CAAe,KAAK,KAAK,CAAA;AACrE;AAEA,SAAS,yBAAA,CACP,KAAA,EACA,KAAA,EACA,GAAA,EACM;AACN,EAAA,IAAI,OAAO,KAAA,CAAM,SAAA,KAAc,YAAY,OAAO,KAAA,CAAM,eAAe,QAAA,EAAU;AAC/E,IAAA,MAAM,GAAA,CAAI,uBAAA,EAAyB,CAAA,EAAG,KAAK,CAAA,mCAAA,CAAqC,CAAA;AAAA,EAClF;AACA,EAAA,MAAM,SAAA,GAAY,IAAI,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA;AAC1C,EAAA,MAAM,UAAA,GAAa,IAAI,IAAA,CAAK,KAAA,CAAM,UAAU,CAAA;AAC5C,EAAA,IAAI,MAAA,CAAO,KAAA,CAAM,SAAA,CAAU,OAAA,EAAS,CAAA,IAAK,MAAA,CAAO,KAAA,CAAM,UAAA,CAAW,OAAA,EAAS,CAAA,EAAG;AAC3E,IAAA,MAAM,GAAA,CAAI,uBAAA,EAAyB,CAAA,EAAG,KAAK,CAAA,oCAAA,CAAsC,CAAA;AAAA,EACnF;AACA,EAAA,IAAI,MAAM,SAAA,EAAW;AACnB,IAAA,MAAM,GAAA,CAAI,qBAAA,EAAuB,CAAA,EAAG,KAAK,CAAA,iBAAA,CAAmB,CAAA;AAAA,EAC9D;AACA,EAAA,IAAI,MAAM,UAAA,EAAY;AACpB,IAAA,MAAM,GAAA,CAAI,qBAAA,EAAuB,CAAA,EAAG,KAAK,CAAA,yBAAA,CAA2B,CAAA;AAAA,EACtE;AACF;AAEA,SAAS,QAAA,CAAS,KAAa,KAAA,EAA6B;AAC1D,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,WAAW,CAAA,EAAG;AAC/C,IAAA,MAAM,GAAA,CAAI,yBAAA,EAA2B,CAAA,EAAG,KAAK,CAAA,WAAA,CAAa,CAAA;AAAA,EAC5D;AACA,EAAA,IAAI;AACF,IAAA,OAAO,IAAS,aAAQ,GAAG,CAAA;AAAA,EAC7B,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,uBAAA,EAAyB,CAAA,EAAG,KAAK,CAAA,+BAAA,EAAkC,CAAC,CAAA,CAAE,CAAA;AAAA,EAClF;AACF;AAEA,eAAe,SAAA,CACb,GAAA,EACA,MAAA,EACA,KAAA,EACA,GAAA,EACe;AACf,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,MAAA,CAAO,OAAA,EAAS;AACjC,IAAA,MAAM,GAAA;AAAA,MACJ,2BAAA;AAAA,MACA,GAAG,KAAK,CAAA,QAAA,EAAW,IAAI,MAAM,CAAA,yBAAA,EAA4B,OAAO,OAAO,CAAA;AAAA,KACzE;AAAA,EACF;AACA,EAAA,IAAI,GAAA,GAAM,IAAI,UAAA,EAAY;AACxB,IAAA,MAAM,GAAA,CAAI,qBAAA,EAAuB,CAAA,EAAG,KAAK,CAAA,iBAAA,CAAmB,CAAA;AAAA,EAC9D;AACA,EAAA,IAAI,CAAC,GAAA,CAAI,UAAA,IAAc,GAAA,GAAM,IAAI,UAAA,EAAY;AAC3C,IAAA,MAAM,GAAA,CAAI,qBAAA,EAAuB,CAAA,EAAG,KAAK,CAAA,yBAAA,CAA2B,CAAA;AAAA,EACtE;AACA,EAAA,IAAI,EAAA;AACJ,EAAA,IAAI;AACF,IAAA,EAAA,GAAK,MAAM,GAAA,CAAI,MAAA,CAAO,EAAE,SAAA,EAAW,QAAQ,CAAA;AAAA,EAC7C,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,2BAAA,EAA6B,CAAA,EAAG,KAAK,CAAA,+BAAA,EAAkC,CAAC,CAAA,CAAE,CAAA;AAAA,EACtF;AACA,EAAA,IAAI,CAAC,EAAA,EAAI;AACP,IAAA,MAAM,GAAA,CAAI,2BAAA,EAA6B,CAAA,EAAG,KAAK,CAAA,8BAAA,CAAgC,CAAA;AAAA,EACjF;AACF;AAEA,eAAe,sBAAA,CACb,OAAA,EACA,IAAA,EACA,KAAA,EACe;AACf,EAAA,IAAI,OAAA,CAAQ,WAAA,CAAY,IAAI,CAAA,EAAG;AAC7B,IAAA,MAAM,GAAA,CAAI,yBAAA,EAA2B,CAAA,EAAG,KAAK,CAAA,6BAAA,CAA+B,CAAA;AAAA,EAC9E;AACF;AAEA,eAAe,qBAAA,CACb,MAAA,EACA,QAAA,EACA,KAAA,EACe;AACf,EAAA,MAAM,WAAW,MAAM,SAAA,CAAU,IAAI,UAAA,CAAW,MAAA,CAAO,OAAO,CAAC,CAAA;AAC/D,EAAA,MAAM,aAAa,MAAM,SAAA,CAAU,IAAI,UAAA,CAAW,QAAA,CAAS,OAAO,CAAC,CAAA;AACnE,EAAA,IAAI,aAAa,UAAA,EAAY;AAC3B,IAAA,MAAM,GAAA;AAAA,MACJ,2BAAA;AAAA,MACA,CAAA,EAAG,KAAK,CAAA,aAAA,EAAgB,QAAQ,sCAAsC,UAAU,CAAA;AAAA,KAClF;AAAA,EACF;AACF;AAEA,SAAS,wBAAA,CACP,GAAA,EACA,KAAA,EACA,QAAA,EACwB;AACxB,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,WAAW,CAAA,EAAG;AAC/C,IAAA,MAAM,GAAA,CAAI,yBAAA,EAA2B,CAAA,EAAG,KAAK,CAAA,WAAA,CAAa,CAAA;AAAA,EAC5D;AACA,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,KAAA,CAAM,+DAA+D,KAAK,EAAC;AAC/F,EAAA,IAAI,OAAA,CAAQ,SAAS,QAAA,EAAU;AAC7B,IAAA,MAAM,GAAA;AAAA,MACJ,uBAAA;AAAA,MACA,GAAG,KAAK,CAAA,KAAA,EAAQ,OAAA,CAAQ,MAAM,+BAA+B,QAAQ,CAAA;AAAA,KACvE;AAAA,EACF;AACA,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,CAAC,OAAA,EAAS,KAAA,KAAU;AACrC,IAAA,IAAI;AACF,MAAA,OAAO,IAAS,qBAAgB,OAAO,CAAA;AAAA,IACzC,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,GAAA,CAAI,yBAAyB,CAAA,EAAG,KAAK,SAAS,KAAK,CAAA,oBAAA,EAAuB,CAAC,CAAA,CAAE,CAAA;AAAA,IACrF;AAAA,EACF,CAAC,CAAA;AACH;AAEA,SAAS,cAAc,IAAA,EAAoC;AACzD,EAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,YAAA,CAAa,4BAA4B,CAAA;AACpE,EAAA,IAAI,aAAA,EAAe;AACjB,IAAA,OAAO,qBAAA,CAAsB,IAAI,UAAA,CAAW,aAAA,CAAc,KAAK,CAAC,CAAA;AAAA,EAClE;AAEA,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,sBAAA,CAAuB,IAAA,EAAM,6BAAA,EAA+B,GAAG,OAAO,CAAA;AAAA,IAC7E,KAAA,EAAO,sBAAA,CAAuB,IAAA,EAAM,8BAAA,EAAgC,GAAG,QAAQ,CAAA;AAAA,IAC/E,YAAY,KAAA,CAAM,IAAA;AAAA,MAAK,EAAE,QAAQ,EAAA,EAAG;AAAA,MAAG,CAAC,GAAG,KAAA,KACzC,0BAAA;AAAA,QACE,IAAA;AAAA,QACA,CAAA,EAAG,gDAAgD,CAAA,EAAG,KAAA,GAAQ,CAAC,CAAA,CAAA;AAAA,QAC/D,CAAA,kBAAA,EAAqB,QAAQ,CAAC,CAAA;AAAA;AAChC,KACF;AAAA,IACA,MAAA,EAAQ,0BAAA,CAA2B,IAAA,EAAM,8BAAA,EAAgC,QAAQ,CAAA;AAAA,IACjF,QAAQ,UAAA,CAAW,sBAAA,CAAuB,MAAM,8BAAA,EAAgC,EAAA,EAAI,QAAQ,CAAC;AAAA,GAC/F;AACF;AAEA,SAAS,sBAAsB,KAAA,EAA2B;AACxD,EAAA,MAAM,QAAA,GAAW,8BAA8B,KAAK,CAAA;AACpD,EAAA,MAAM,UAAA,GAAa,YAAY,YAAA,CAAa,UAAA,CAAW,UAAU,CAAC,CAAA,EAAG,EAAA,EAAM,gBAAgB,CAAC,CAAA;AAC5F,EAAA,MAAM,SAA0B,EAAC;AACjC,EAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,IAAA,MAAM,UAAA,GAAa,yBAAyB,SAAS,CAAA;AACrD,IAAA,IAAI,eAAe,CAAA,EAAG;AACpB,MAAA,MAAA,CAAO,KAAA,GAAQ,UAAA,CAAW,sBAAA,CAAuB,SAAA,EAAW,QAAQ,CAAC,CAAA;AACrE,MAAA;AAAA,IACF;AACA,IAAA,IAAI,eAAe,CAAA,EAAG;AACpB,MAAA,MAAA,CAAO,KAAA,GAAQ,UAAA,CAAW,sBAAA,CAAuB,SAAA,EAAW,OAAO,CAAC,CAAA;AACpE,MAAA;AAAA,IACF;AACA,IAAA,IAAI,eAAe,CAAA,EAAG;AACpB,MAAA,MAAM,GAAA,GAAM,qBAAqB,SAAS,CAAA;AAC1C,MAAA,MAAA,CAAO,aAAa,GAAA,CAAI,UAAA;AACxB,MAAA,MAAA,CAAO,SAAS,GAAA,CAAI,MAAA;AACpB,MAAA,MAAA,CAAO,SAAS,GAAA,CAAI,MAAA;AACpB,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,WAAW,WAAA,CAAY,YAAA,CAAa,SAAA,EAAW,EAAA,EAAM,oBAAoB,CAAC,CAAA;AAChF,IAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,MAAA,MAAM,GAAA,CAAI,uBAAuB,uDAAuD,CAAA;AAAA,IAC1F;AACA,IAAA,MAAM,GAAA,GAAM,UAAA,CAAW,QAAA,CAAS,CAAC,CAAE,CAAA;AACnC,IAAA,MAAM,KAAA,GAAQ,SAAS,CAAC,CAAA;AACxB,IAAA,IAAI,QAAQ,8BAAA,EAAgC;AAC1C,MAAA,MAAA,CAAO,QAAQ,UAAA,CAAW,wBAAA,CAAyB,KAAA,EAAO,CAAA,EAAG,QAAQ,CAAC,CAAA;AAAA,IACxE,CAAA,MAAA,IAAW,QAAQ,6BAAA,EAA+B;AAChD,MAAA,MAAA,CAAO,QAAQ,UAAA,CAAW,wBAAA,CAAyB,KAAA,EAAO,CAAA,EAAG,OAAO,CAAC,CAAA;AAAA,IACvE,CAAA,MAAA,IAAW,QAAQ,2BAAA,EAA6B;AAC9C,MAAA,MAAM,GAAA,GAAM,qBAAqB,KAAK,CAAA;AACtC,MAAA,MAAA,CAAO,aAAa,GAAA,CAAI,UAAA;AACxB,MAAA,MAAA,CAAO,SAAS,GAAA,CAAI,MAAA;AACpB,MAAA,MAAA,CAAO,SAAS,GAAA,CAAI,MAAA;AAAA,IACtB;AAAA,EACF;AAEA,EAAA,IACE,MAAA,CAAO,KAAA,KAAU,MAAA,IACjB,MAAA,CAAO,UAAU,MAAA,IACjB,MAAA,CAAO,UAAA,KAAe,MAAA,IACtB,MAAA,CAAO,MAAA,KAAW,MAAA,IAClB,MAAA,CAAO,WAAW,MAAA,EAClB;AACA,IAAA,MAAM,GAAA,CAAI,uBAAuB,2DAA2D,CAAA;AAAA,EAC9F;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,qBAAqB,KAAA,EAAiE;AAC7F,EAAA,MAAM,QAAA,GAAW,eAAe,KAAK,CAAA;AACrC,EAAA,MAAM,aAAuB,EAAC;AAC9B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,MAAA;AACJ,EAAA,KAAA,MAAW,QAAQ,QAAA,EAAU;AAC3B,IAAA,MAAM,UAAA,GAAa,yBAAyB,IAAI,CAAA;AAChD,IAAA,IAAI,eAAe,IAAA,EAAM;AACvB,MAAA,IAAI,eAAe,EAAA,EAAI;AACrB,QAAA,MAAA,GAAS,kBAAA,CAAmB,MAAM,QAAQ,CAAA;AAAA,MAC5C,CAAA,MAAA,IAAW,eAAe,EAAA,EAAI;AAC5B,QAAA,MAAA,GAAS,sBAAA,CAAuB,MAAM,QAAQ,CAAA;AAAA,MAChD,CAAA,MAAA,IAAW,UAAA,IAAc,CAAA,IAAK,UAAA,IAAc,EAAA,EAAI;AAC9C,QAAA,UAAA,CAAW,UAAU,CAAA,GAAI,kBAAA,CAAmB,MAAM,CAAA,kBAAA,EAAqB,UAAA,GAAa,CAAC,CAAA,CAAE,CAAA;AAAA,MACzF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,WAAW,WAAA,CAAY,YAAA,CAAa,IAAA,EAAM,EAAA,EAAM,cAAc,CAAC,CAAA;AACrE,IAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,MAAA,MAAM,GAAA,CAAI,uBAAuB,6CAA6C,CAAA;AAAA,IAChF;AACA,IAAA,MAAM,GAAA,GAAM,UAAA,CAAW,QAAA,CAAS,CAAC,CAAE,CAAA;AACnC,IAAA,MAAM,QAAA,GAAW,SAAS,CAAC,CAAA;AAC3B,IAAA,IAAI,QAAQ,8BAAA,EAAgC;AAC1C,MAAA,MAAA,GAAS,oBAAA,CAAqB,QAAA,EAAU,EAAA,EAAI,QAAQ,CAAA;AAAA,IACtD,CAAA,MAAA,IAAW,QAAQ,8BAAA,EAAgC;AACjD,MAAA,MAAA,GAAS,wBAAA,CAAyB,QAAA,EAAU,EAAA,EAAI,QAAQ,CAAA;AAAA,IAC1D,CAAA,MAAA,IAAW,GAAA,CAAI,UAAA,CAAW,gDAAgD,CAAA,EAAG;AAC3E,MAAA,MAAM,QAAQ,MAAA,CAAO,QAAA;AAAA,QACnB,GAAA,CAAI,KAAA,CAAM,gDAAA,CAAiD,MAAM,CAAA;AAAA,QACjE;AAAA,OACF;AACA,MAAA,IAAI,CAAC,OAAO,SAAA,CAAU,KAAK,KAAK,KAAA,GAAQ,CAAA,IAAK,QAAQ,EAAA,EAAI;AACvD,QAAA,MAAM,GAAA,CAAI,qBAAA,EAAuB,CAAA,sBAAA,EAAyB,GAAG,CAAA,gBAAA,CAAkB,CAAA;AAAA,MACjF;AACA,MAAA,UAAA,CAAW,KAAA,GAAQ,CAAC,CAAA,GAAI,oBAAA;AAAA,QACtB,QAAA;AAAA,QACA,KAAA,GAAQ,CAAA;AAAA,QACR,qBAAqB,KAAK,CAAA;AAAA,OAC5B;AAAA,IACF;AAAA,EACF;AACA,EAAA,IACE,UAAA,CAAW,WAAW,EAAA,IACtB,KAAA,CAAM,KAAK,EAAE,MAAA,EAAQ,IAAG,EAAG,CAAC,GAAG,KAAA,KAAU,UAAA,CAAW,KAAK,CAAC,CAAA,CAAE,KAAK,CAAC,GAAA,KAAQ,GAAA,KAAQ,MAAS,CAAA,EAC3F;AACA,IAAA,MAAM,GAAA,CAAI,uBAAuB,iDAAiD,CAAA;AAAA,EACpF;AACA,EAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,MAAA,EAAW;AAChD,IAAA,MAAM,GAAA,CAAI,uBAAuB,+CAA+C,CAAA;AAAA,EAClF;AACA,EAAA,IAAI,MAAA,CAAO,WAAW,EAAA,EAAI;AACxB,IAAA,MAAM,GAAA,CAAI,qBAAA,EAAuB,CAAA,eAAA,EAAkB,MAAA,CAAO,MAAM,CAAA,mBAAA,CAAqB,CAAA;AAAA,EACvF;AACA,EAAA,OAAO,EAAE,UAAA,EAAY,MAAA,EAAQ,MAAA,EAAO;AACtC;AAEA,SAAS,sBAAA,CACP,IAAA,EACA,GAAA,EACA,aAAA,EACA,KAAA,EACQ;AACR,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,YAAA,CAAa,GAAG,CAAA;AACjC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,qBAAA,EAAuB,CAAA,oBAAA,EAAuB,KAAK,CAAA,WAAA,EAAc,GAAG,CAAA,CAAE,CAAA;AAAA,EAClF;AACA,EAAA,MAAM,UAAU,6BAAA,CAA8B,IAAI,UAAA,CAAW,GAAA,CAAI,KAAK,CAAC,CAAA;AACvE,EAAA,IAAI,OAAA,CAAQ,WAAW,aAAA,EAAe;AACpC,IAAA,MAAM,GAAA;AAAA,MACJ,qBAAA;AAAA,MACA,OAAO,KAAK,CAAA,eAAA,EAAkB,OAAA,CAAQ,MAAM,oBAAoB,aAAa,CAAA;AAAA,KAC/E;AAAA,EACF;AACA,EAAA,OAAO,WAAW,OAAO,CAAA;AAC3B;AAEA,SAAS,0BAAA,CACP,IAAA,EACA,GAAA,EACA,KAAA,EACQ;AACR,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,YAAA,CAAa,GAAG,CAAA;AACjC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,qBAAA,EAAuB,CAAA,oBAAA,EAAuB,KAAK,CAAA,WAAA,EAAc,GAAG,CAAA,CAAE,CAAA;AAAA,EAClF;AACA,EAAA,OAAO,cAAA,CAAe,WAAW,IAAI,UAAA,CAAW,IAAI,KAAK,CAAA,EAAG,CAAC,CAAA,EAAG,KAAK,CAAA;AACvE;AAWA,SAAS,UAAA,CAAW,QAAoB,KAAA,EAAuB;AAC7D,EAAA,IAAI,KAAA,GAAQ,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ;AAC7B,IAAA,MAAM,GAAA,CAAI,uBAAuB,qBAAqB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,EAAA,IAAI,SAAS,KAAA,GAAQ,CAAA;AACrB,EAAA,MAAM,WAAA,GAAc,OAAO,MAAA,EAAQ,CAAA;AACnC,EAAA,IAAI,MAAA;AACJ,EAAA,IAAA,CAAK,WAAA,GAAc,SAAU,CAAA,EAAG;AAC9B,IAAA,MAAA,GAAS,WAAA;AAAA,EACX,CAAA,MAAO;AACL,IAAA,MAAM,SAAS,WAAA,GAAc,GAAA;AAC7B,IAAA,IAAI,WAAW,CAAA,IAAK,MAAA,GAAS,KAAK,MAAA,GAAS,MAAA,GAAS,OAAO,MAAA,EAAQ;AACjE,MAAA,MAAM,GAAA,CAAI,uBAAuB,wBAAwB,CAAA;AAAA,IAC3D;AACA,IAAA,MAAA,GAAS,CAAA;AACT,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,EAAQ,CAAA,EAAA,EAAK;AAC/B,MAAA,MAAA,GAAU,MAAA,IAAU,CAAA,GAAK,MAAA,CAAO,MAAA,EAAQ,CAAA;AAAA,IAC1C;AAAA,EACF;AACA,EAAA,MAAM,UAAA,GAAa,MAAA;AACnB,EAAA,MAAM,WAAW,UAAA,GAAa,MAAA;AAC9B,EAAA,IAAI,QAAA,GAAW,OAAO,MAAA,EAAQ;AAC5B,IAAA,MAAM,GAAA,CAAI,uBAAuB,iCAAiC,CAAA;AAAA,EACpE;AACA,EAAA,OAAO,EAAE,GAAA,EAAK,KAAA,EAAO,YAAY,QAAA,EAAU,GAAA,EAAK,UAAU,MAAA,EAAO;AACnE;AAEA,SAAS,YAAA,CAAa,GAAA,EAAa,GAAA,EAAa,KAAA,EAAuB;AACrE,EAAA,IAAI,GAAA,CAAI,QAAQ,GAAA,EAAK;AACnB,IAAA,MAAM,GAAA,CAAI,qBAAA,EAAuB,CAAA,EAAG,KAAK,CAAA,eAAA,EAAkB,IAAI,GAAA,CAAI,QAAA,CAAS,EAAE,CAAC,CAAA,CAAE,CAAA;AAAA,EACnF;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,YAAY,GAAA,EAAuB;AAC1C,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,IAAI,SAAS,GAAA,CAAI,UAAA;AACjB,EAAA,OAAO,MAAA,GAAS,IAAI,QAAA,EAAU;AAC5B,IAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,MAAA,EAAQ,MAAM,CAAA;AAC3C,IAAA,IAAI,KAAA,CAAM,GAAA,GAAM,GAAA,CAAI,QAAA,EAAU;AAC5B,MAAA,MAAM,GAAA,CAAI,uBAAuB,0BAA0B,CAAA;AAAA,IAC7D;AACA,IAAA,QAAA,CAAS,KAAK,KAAK,CAAA;AACnB,IAAA,MAAA,GAAS,KAAA,CAAM,GAAA;AAAA,EACjB;AACA,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,WAAW,GAAA,EAAqB;AACvC,EAAA,YAAA,CAAa,GAAA,EAAK,GAAM,KAAK,CAAA;AAC7B,EAAA,MAAM,QAAQ,GAAA,CAAI,MAAA,CAAO,SAAS,GAAA,CAAI,UAAA,EAAY,IAAI,QAAQ,CAAA;AAC9D,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,GAAA,CAAI,uBAAuB,eAAe,CAAA;AAAA,EAClD;AACA,EAAA,MAAM,KAAA,GAAQ,CAAC,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,CAAC,CAAA,GAAK,EAAE,CAAA,EAAG,KAAA,CAAM,CAAC,CAAA,GAAK,EAAE,CAAA;AACzD,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,CAAM,QAAA,CAAS,CAAC,CAAA,EAAG;AACpC,IAAA,KAAA,GAAS,KAAA,IAAS,IAAM,IAAA,GAAO,GAAA;AAC/B,IAAA,IAAA,CAAK,IAAA,GAAO,SAAU,CAAA,EAAG;AACvB,MAAA,KAAA,CAAM,KAAK,KAAK,CAAA;AAChB,MAAA,KAAA,GAAQ,CAAA;AAAA,IACV;AAAA,EACF;AACA,EAAA,IAAI,UAAU,CAAA,EAAG;AACf,IAAA,MAAM,GAAA,CAAI,uBAAuB,mBAAmB,CAAA;AAAA,EACtD;AACA,EAAA,OAAO,KAAA,CAAM,KAAK,GAAG,CAAA;AACvB;AAEA,SAAS,cAAA,CAAe,KAAa,KAAA,EAAuB;AAC1D,EAAA,YAAA,CAAa,GAAA,EAAK,GAAM,KAAK,CAAA;AAC7B,EAAA,MAAM,QAAQ,GAAA,CAAI,MAAA,CAAO,SAAS,GAAA,CAAI,UAAA,EAAY,IAAI,QAAQ,CAAA;AAC9D,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,IAAA,CAAM,MAAM,CAAC,CAAA,GAAK,SAAU,CAAA,EAAG;AAClD,IAAA,MAAM,GAAA,CAAI,qBAAA,EAAuB,CAAA,EAAG,KAAK,CAAA,8BAAA,CAAgC,CAAA;AAAA,EAC3E;AACA,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,KAAA,GAAS,KAAA,IAAS,CAAA,GAAK,IAAA;AACjD,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,kBAAA,CAAmB,KAAa,KAAA,EAA2B;AAClE,EAAA,YAAA,CAAa,GAAA,EAAK,GAAM,KAAK,CAAA;AAC7B,EAAA,OAAO,IAAI,MAAA,CAAO,QAAA,CAAS,GAAA,CAAI,UAAA,EAAY,IAAI,QAAQ,CAAA;AACzD;AAEA,SAAS,eAAe,KAAA,EAAyB;AAC/C,EAAA,IAAI,wBAAA,CAAyB,KAAK,CAAA,KAAM,CAAA,EAAG;AACzC,IAAA,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,EAAA,MAAU,CAAA,EAAG;AAC5B,MAAA,MAAM,GAAA,CAAI,uBAAuB,kCAAkC,CAAA;AAAA,IACrE;AACA,IAAA,MAAM,QAAA,GAAW,YAAY,KAAK,CAAA;AAClC,IAAA,IAAI,SAAS,MAAA,KAAW,CAAA,IAAK,SAAS,CAAC,CAAA,CAAG,QAAQ,EAAA,EAAM;AACtD,MAAA,OAAO,WAAA,CAAY,QAAA,CAAS,CAAC,CAAE,CAAA;AAAA,IACjC;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,OAAO,WAAA,CAAY,YAAA,CAAa,KAAA,EAAO,EAAA,EAAM,mBAAmB,CAAC,CAAA;AACnE;AAEA,SAAS,oBAAA,CAAqB,GAAA,EAAa,WAAA,EAAqB,KAAA,EAAuB;AACrF,EAAA,MAAM,UAAA,GAAa,yBAAyB,GAAG,CAAA;AAC/C,EAAA,IAAI,eAAe,IAAA,EAAM;AACvB,IAAA,IAAI,eAAe,WAAA,EAAa;AAC9B,MAAA,MAAM,GAAA;AAAA,QACJ,qBAAA;AAAA,QACA,CAAA,EAAG,KAAK,CAAA,kBAAA,EAAqB,UAAU,cAAc,WAAW,CAAA;AAAA,OAClE;AAAA,IACF;AACA,IAAA,OAAO,kBAAA,CAAmB,KAAK,KAAK,CAAA;AAAA,EACtC;AACA,EAAA,OAAO,cAAA,CAAe,KAAK,KAAK,CAAA;AAClC;AAEA,SAAS,wBAAA,CAAyB,GAAA,EAAa,WAAA,EAAqB,KAAA,EAA2B;AAC7F,EAAA,MAAM,UAAA,GAAa,yBAAyB,GAAG,CAAA;AAC/C,EAAA,IAAI,eAAe,IAAA,EAAM;AACvB,IAAA,IAAI,eAAe,WAAA,EAAa;AAC9B,MAAA,MAAM,GAAA;AAAA,QACJ,qBAAA;AAAA,QACA,CAAA,EAAG,KAAK,CAAA,kBAAA,EAAqB,UAAU,cAAc,WAAW,CAAA;AAAA,OAClE;AAAA,IACF;AACA,IAAA,OAAO,sBAAA,CAAuB,KAAK,KAAK,CAAA;AAAA,EAC1C;AACA,EAAA,OAAO,kBAAA,CAAmB,KAAK,KAAK,CAAA;AACtC;AAEA,SAAS,yBAAyB,GAAA,EAA4B;AAC5D,EAAA,IAAA,CAAK,GAAA,CAAI,GAAA,GAAM,GAAA,MAAU,GAAA,EAAM,OAAO,IAAA;AACtC,EAAA,MAAM,SAAA,GAAY,IAAI,GAAA,GAAM,EAAA;AAC5B,EAAA,OAAO,SAAA,KAAc,KAAO,IAAA,GAAO,SAAA;AACrC;AAEA,SAAS,iBAAiB,GAAA,EAAqB;AAC7C,EAAA,IAAA,CAAK,GAAA,CAAI,GAAA,GAAM,EAAA,MAAU,CAAA,EAAG;AAC1B,IAAA,MAAM,GAAA,CAAI,uBAAuB,+CAA+C,CAAA;AAAA,EAClF;AACA,EAAA,MAAM,QAAA,GAAW,YAAY,GAAG,CAAA;AAChC,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,MAAM,GAAA,CAAI,uBAAuB,gDAAgD,CAAA;AAAA,EACnF;AACA,EAAA,OAAO,SAAS,CAAC,CAAA;AACnB;AAEA,SAAS,kBAAA,CAAmB,KAAa,KAAA,EAAuB;AAC9D,EAAA,MAAM,SAAS,GAAA,CAAI,GAAA,GAAM,QAAU,CAAA,GAAI,gBAAA,CAAiB,GAAG,CAAA,GAAI,GAAA;AAC/D,EAAA,IAAA,CAAK,IAAI,GAAA,GAAM,EAAA,MAAU,GAAG,OAAO,cAAA,CAAe,OAAO,KAAK,CAAA;AAC9D,EAAA,OAAO,mBAAA,CAAoB,MAAM,MAAA,CAAO,QAAA,CAAS,MAAM,UAAA,EAAY,KAAA,CAAM,QAAQ,CAAA,EAAG,KAAK,CAAA;AAC3F;AAEA,SAAS,sBAAA,CAAuB,KAAa,KAAA,EAA2B;AACtE,EAAA,MAAM,SAAS,GAAA,CAAI,GAAA,GAAM,QAAU,CAAA,GAAI,gBAAA,CAAiB,GAAG,CAAA,GAAI,GAAA;AAC/D,EAAA,IAAA,CAAK,IAAI,GAAA,GAAM,EAAA,MAAU,GAAG,OAAO,kBAAA,CAAmB,OAAO,KAAK,CAAA;AAClE,EAAA,OAAO,MAAM,MAAA,CAAO,QAAA,CAAS,KAAA,CAAM,UAAA,EAAY,MAAM,QAAQ,CAAA;AAC/D;AAEA,SAAS,mBAAA,CAAoB,OAAmB,KAAA,EAAuB;AACrE,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,IAAA,CAAM,MAAM,CAAC,CAAA,GAAK,SAAU,CAAA,EAAG;AAClD,IAAA,MAAM,GAAA,CAAI,qBAAA,EAAuB,CAAA,EAAG,KAAK,CAAA,8BAAA,CAAgC,CAAA;AAAA,EAC3E;AACA,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,KAAA,GAAS,KAAA,IAAS,CAAA,GAAK,IAAA;AACjD,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,8BAA8B,KAAA,EAA+B;AACpE,EAAA,IAAI,MAAM,MAAA,IAAU,CAAA,IAAK,KAAA,CAAM,CAAC,MAAM,CAAA,EAAM;AAC1C,IAAA,MAAM,GAAA,GAAM,UAAA,CAAW,KAAA,EAAO,CAAC,CAAA;AAC/B,IAAA,IAAI,GAAA,CAAI,GAAA,KAAQ,KAAA,CAAM,MAAA,EAAQ,OAAO,MAAM,QAAA,CAAS,GAAA,CAAI,UAAA,EAAY,GAAA,CAAI,QAAQ,CAAA;AAAA,EAClF;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,WAAW,GAAA,EAAyB;AAC3C,EAAA,IAAI,GAAA,CAAI,SAAS,CAAA,KAAM,CAAA,IAAK,CAAC,cAAA,CAAe,IAAA,CAAK,GAAG,CAAA,EAAG;AACrD,IAAA,MAAM,GAAA,CAAI,yBAAyB,oBAAoB,CAAA;AAAA,EACzD;AACA,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA;AACzC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK;AACnC,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,GAAA;AACT;AAcA,IAAM,eAAA,GAAkB,8DAAA;AAGxB,SAAS,gBAAgB,CAAA,EAAmB;AAC1C,EAAA,MAAM,SAAS,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,EAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,GAAI,IAAI,MAAA,CAAA,CAAQ,CAAA,GAAK,CAAA,CAAE,MAAA,GAAS,KAAM,CAAC,CAAA;AAC5F,EAAA,OAAO,KAAK,MAAM,CAAA;AACpB;AAGA,SAAS,kBAAkB,CAAA,EAAuB;AAChD,EAAA,MAAM,OAAA,GAAU,gBAAgB,CAAC,CAAA;AACjC,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,OAAA,CAAQ,MAAM,CAAA;AACzC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,OAAA,CAAQ,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,OAAA,CAAQ,UAAA,CAAW,CAAC,CAAA;AACtE,EAAA,OAAO,GAAA;AACT;AAkBA,eAAe,mBAAA,CACb,KAAA,EACA,MAAA,EACA,SAAA,GAAoB,6BAAA,EACM;AAC1B,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,GAAA,CAAI,iBAAA,EAAmB,CAAA,8BAAA,EAAiC,KAAA,CAAM,MAAM,CAAA,OAAA,CAAS,CAAA;AAAA,EACrF;AACA,EAAA,MAAM,CAAC,SAAA,EAAW,UAAA,EAAY,MAAM,CAAA,GAAI,KAAA;AAExC,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,SAAS,CAAC,CAAA;AAC9C,IAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,UAAU,CAAC,CAAA;AAAA,EAClD,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,GAAA,CAAI,iBAAA,EAAmB,CAAA,yCAAA,EAA4C,CAAC,CAAA,CAAE,CAAA;AAAA,EAC9E;AAGA,EAAA,MAAM,GAAA,GAAM,QAAQ,KAAK,CAAA;AACzB,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,IAAA,CAAK,KAAA,CAAM,KAAK,GAAA,EAAI,GAAI,GAAI,CAAA,GAAI,GAAA,EAAK;AAClE,IAAA,MAAM,GAAA,CAAI,mBAAA,EAAqB,CAAA,mBAAA,EAAsB,IAAI,IAAA,CAAK,MAAM,GAAI,CAAA,CAAE,WAAA,EAAa,CAAA,CAAE,CAAA;AAAA,EAC3F;AAEA,EAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,EAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,EAAA,IAAI,CAAC,GAAA,IAAO,CAAC,GAAA,EAAK;AAChB,IAAA,MAAM,GAAA,CAAI,mBAAmB,mCAAmC,CAAA;AAAA,EAClE;AACA,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAA,KAAM,MAAA,CAAO,cAAA,EAAgB;AAC5C,IAAA,MAAM,GAAA;AAAA,MACJ,qBAAA;AAAA,MACA,CAAA,eAAA,EAAkB,OAAO,OAAA,CAAQ,KAAK,CAAC,CAAC,CAAA,uBAAA,EAA0B,OAAO,cAAc,CAAA;AAAA,KACzF;AAAA,EACF;AACA,EAAA,IAAI,GAAA,KAAQ,OAAO,eAAA,EAAiB;AAClC,IAAA,MAAM,GAAA;AAAA,MACJ,mBAAA;AAAA,MACA,CAAA,YAAA,EAAe,GAAG,CAAA,uBAAA,EAA0B,MAAA,CAAO,eAAe,CAAA;AAAA,KACpE;AAAA,EACF;AACA,EAAA,IAAI,CAAC,eAAA,CAAgB,IAAA,CAAK,MAAA,CAAO,eAAe,CAAA,EAAG;AACjD,IAAA,MAAM,GAAA;AAAA,MACJ,mBAAA;AAAA,MACA,CAAA,6DAAA,EAAgE,OAAO,eAAe,CAAA;AAAA,KACxF;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,kBAAkB,CAAA,KAAM,MAAA,CAAO,kBAAA,EAAoB;AAC7D,IAAA,MAAM,GAAA;AAAA,MACJ,0BAAA;AAAA,MACA,CAAA,gBAAA,EAAmB,OAAO,OAAA,CAAQ,kBAAkB,CAAC,CAAC,CAAA,uBAAA,EAA0B,OAAO,kBAAkB,CAAA;AAAA,KAC3G;AAAA,EACF;AAGA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,YAAA,CAAa,MAAA,CAAO,eAAA,EAAiB,SAAS,CAAA;AAAA,EAC7D,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,GAAA;AAAA,MACJ,qBAAA;AAAA,MACA,CAAA,8BAAA,EAAiC,MAAA,CAAO,eAAe,CAAA,EAAA,EAAK,CAAC,CAAA;AAAA,KAC/D;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,KAAK,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,GAAG,CAAA;AAC/C,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,GAAA,CAAI,qBAAA,EAAuB,CAAA,gBAAA,EAAmB,GAAG,CAAA,kBAAA,CAAoB,CAAA;AAAA,EAC7E;AAGA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,MAAM,OAAO,MAAA,CAAO,SAAA;AAAA,MAC9B,KAAA;AAAA,MACA,EAAE,GAAA,EAAK,KAAA,EAAO,CAAA,EAAG,GAAA,CAAI,CAAA,EAAG,CAAA,EAAG,GAAA,CAAI,CAAA,EAAG,GAAA,EAAK,OAAA,EAAS,GAAA,EAAK,IAAA,EAAK;AAAA,MAC1D,EAAE,IAAA,EAAM,mBAAA,EAAqB,IAAA,EAAM,SAAA,EAAU;AAAA,MAC7C,KAAA;AAAA,MACA,CAAC,QAAQ;AAAA,KACX;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,GAAA,CAAI,qBAAA,EAAuB,CAAA,0BAAA,EAA6B,CAAC,CAAA,CAAE,CAAA;AAAA,EACnE;AAEA,EAAA,MAAM,GAAA,GAAM,IAAI,WAAA,EAAY,CAAE,OAAO,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAE,CAAA;AACjE,EAAA,MAAM,GAAA,GAAM,kBAAkB,MAAM,CAAA;AACpC,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA;AAAA,IAChC,EAAE,MAAM,mBAAA,EAAoB;AAAA,IAC5B,SAAA;AAAA,IACA,GAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,GAAA,CAAI,uBAAuB,6CAA6C,CAAA;AAAA,EAChF;AAGA,EAAA,IAAI,OAAA,CAAQ,wBAAwB,CAAA,KAAM,qBAAA,EAAuB;AAC/D,IAAA,MAAM,GAAA;AAAA,MACJ,yBAAA;AAAA,MACA,CAAA,wBAAA,EAA2B,OAAA,CAAQ,wBAAwB,CAAC,CAAA,kCAAA;AAAA,KAC9D;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,yBAAyB,CAAA,KAAM,KAAA,EAAO;AAChD,IAAA,MAAM,GAAA,CAAI,qBAAqB,qCAAqC,CAAA;AAAA,EACtE;AAEA,EAAA,MAAM,UAAA,GAAa,QAAQ,iBAAiB,CAAA;AAC5C,EAAA,IAAI,OAAO,UAAA,KAAe,QAAA,IAAY,CAAC,kBAAA,CAAmB,IAAA,CAAK,UAAU,CAAA,EAAG;AAC1E,IAAA,MAAM,GAAA,CAAI,2BAA2B,uDAAuD,CAAA;AAAA,EAC9F;AAEA,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,WAAW,WAAA,EAAY;AAAA,IACnC,IAAA,EAAM,kBAAA,CAAmB,OAAA,EAAS,UAAU,CAAA;AAAA,IAC5C,KAAA,EAAO,kBAAA,CAAmB,OAAA,EAAS,WAAW,CAAA;AAAA,IAC9C,KAAA,EAAO,kBAAA,CAAmB,OAAA,EAAS,WAAW,CAAA;AAAA,IAC9C,KAAA,EAAO,kBAAA,CAAmB,OAAA,EAAS,WAAW,CAAA;AAAA,IAC9C,KAAA,EAAO,kBAAA,CAAmB,OAAA,EAAS,WAAW;AAAA,GAChD;AACF;AAEA,SAAS,kBAAA,CAAmB,SAAkC,KAAA,EAAuB;AACnF,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAK,CAAA;AAC3B,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,iBAAA,CAAkB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/D,IAAA,MAAM,GAAA,CAAI,yBAAA,EAA2B,CAAA,wBAAA,EAA2B,KAAK,CAAA,MAAA,CAAQ,CAAA;AAAA,EAC/E;AACA,EAAA,OAAO,MAAM,WAAA,EAAY;AAC3B;AAEA,SAAS,8BAAA,CAA+B,KAAsB,IAAA,EAA+B;AAC3F,EAAA,MAAM,SAAS,CAAC,MAAA,EAAQ,OAAA,EAAS,OAAA,EAAS,SAAS,OAAO,CAAA;AAC1D,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,IAAI,GAAA,CAAI,KAAK,CAAA,KAAM,IAAA,CAAK,KAAK,CAAA,EAAG;AAC9B,MAAA,MAAM,GAAA;AAAA,QACJ,yBAAA;AAAA,QACA,CAAA,IAAA,EAAO,KAAK,CAAA,CAAA,EAAI,GAAA,CAAI,KAAK,CAAC,CAAA,2BAAA,EAA8B,KAAA,CAAM,WAAA,EAAa,CAAA,CAAA,EAAI,IAAA,CAAK,KAAK,CAAC,CAAA;AAAA,OAC5F;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,YAAA,CACb,KACA,SAAA,EAC8E;AAC9E,EAAA,MAAM,mBACJ,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,IAAK,SAAA,GAAY,IAAI,SAAA,GAAY,6BAAA;AAC5D,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,IAAI,SAAA,GAAkD,IAAA;AACtD,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAe,CAAC,GAAG,MAAA,KAAW;AAChD,IAAA,SAAA,GAAY,WAAW,MAAM;AAC3B,MAAA,UAAA,CAAW,KAAA,EAAM;AACjB,MAAA,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,gBAAgB,IAAI,CAAC,CAAA;AAAA,IAC3D,GAAG,gBAAgB,CAAA;AAAA,EACrB,CAAC,CAAA;AAED,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,QAAQ,IAAA,CAAK;AAAA,MAAA,CACvB,YAAY;AACX,QAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,MAAA,EAAQ,UAAA,CAAW,QAAQ,CAAA;AAC3D,QAAA,IAAI,CAAC,KAAK,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AACnD,QAAA,OAAQ,MAAM,KAAK,IAAA,EAAK;AAAA,MAG1B,CAAA,GAAG;AAAA,MACH;AAAA,KACD,CAAA;AAAA,EACH,CAAA,SAAE;AACA,IAAA,IAAI,SAAA,KAAc,IAAA,EAAM,YAAA,CAAa,SAAS,CAAA;AAAA,EAChD;AACF;AAWA,eAAe,mBAAA,CACb,WAAA,EACA,QAAA,EACA,aAAA,EACA,wBACA,kBAAA,EACe;AACf,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,cAAc,WAAW,CAAA;AAAA,EACjC,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,GAAA,CAAI,qBAAA,EAAuB,CAAA,4BAAA,EAA+B,CAAC,CAAA,CAAE,CAAA;AAAA,EACrE;AAEA,EAAA,IAAI,GAAA,CAAI,SAAS,CAAA,EAAG;AAClB,IAAA,MAAM,GAAA,CAAI,uBAAuB,qBAAqB,CAAA;AAAA,EACxD;AAIA,EAAA,MAAM,SAAS,IAAI,QAAA,CAAS,IAAI,MAAA,EAAQ,GAAA,CAAI,UAAU,CAAA,CAAE,SAAA;AAAA,IAAU,CAAA;AAAA,IAAG;AAAA;AAAA,GAAwB;AAC7F,EAAA,IAAI,CAAA,GAAI,MAAA,GAAS,GAAA,CAAI,MAAA,EAAQ;AAC3B,IAAA,MAAM,GAAA,CAAI,qBAAA,EAAuB,CAAA,kBAAA,EAAqB,MAAM,CAAA,eAAA,CAAiB,CAAA;AAAA,EAC/E;AACA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,IAAI,MAAM,CAAA;AAC1C,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,KAAA,CAAM,CAAA,GAAI,MAAM,CAAA;AAGpC,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,MAAM,GAAA,CAAI,uBAAuB,0BAA0B,CAAA;AAAA,EAC7D;AACA,EAAA,MAAM,UAAW,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,GAAK,QAAQ,CAAC,CAAA;AAC7C,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,IAAI,OAAO,CAAA;AAC7C,EAAA,IAAI,QAAA,CAAS,WAAW,OAAA,EAAS;AAC/B,IAAA,MAAM,GAAA;AAAA,MACJ,qBAAA;AAAA,MACA,CAAA,+BAAA,EAAkC,OAAO,CAAA,OAAA,EAAU,QAAA,CAAS,MAAM,CAAA;AAAA,KACpE;AAAA,EACF;AAGA,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA;AAAA,IAChC,EAAE,MAAM,mBAAA,EAAoB;AAAA,IAC5B,QAAA;AAAA,IACA,QAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,GAAA,CAAI,uBAAuB,0CAA0C,CAAA;AAAA,EAC7E;AAKA,EAAA,MAAM,UAAU,IAAI,UAAA;AAAA,IAClB,aAAA,CAAc,MAAA,GAAS,sBAAA,CAAuB,MAAA,GAAS,kBAAA,CAAmB;AAAA,GAC5E;AACA,EAAA,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAC,CAAA;AAC5B,EAAA,OAAA,CAAQ,GAAA,CAAI,sBAAA,EAAwB,aAAA,CAAc,MAAM,CAAA;AACxD,EAAA,OAAA,CAAQ,GAAA,CAAI,kBAAA,EAAoB,aAAA,CAAc,MAAA,GAAS,uBAAuB,MAAM,CAAA;AACpF,EAAA,MAAM,UAAA,GAAa,IAAI,UAAA,CAAW,MAAM,OAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,OAAuB,CAAC,CAAA;AAEhG,EAAA,MAAM,SAAA,GAAY,wBAAwB,UAAU,CAAA;AACpD,EAAA,IAAI,CAAC,cAAA,CAAe,SAAA,EAAW,UAAU,CAAA,EAAG;AAC1C,IAAA,MAAM,GAAA;AAAA,MACJ,oBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACF;AAEA,SAAS,wBAAwB,UAAA,EAAoC;AACnE,EAAA,IAAI,UAAA,CAAW,SAAS,EAAA,EAAI;AAC1B,IAAA,MAAM,GAAA,CAAI,uBAAuB,uBAAuB,CAAA;AAAA,EAC1D;AAEA,EAAA,MAAM,IAAA,GAAO,IAAI,QAAA,CAAS,UAAA,CAAW,QAAQ,UAAA,CAAW,UAAA,EAAY,WAAW,UAAU,CAAA;AACzF,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,SAAA,CAAU,CAAA,EAAG,KAAK,CAAA;AACrC,EAAA,IAAI,UAAU,mBAAA,EAAqB;AACjC,IAAA,MAAM,GAAA;AAAA,MACJ,qBAAA;AAAA,MACA,CAAA,kBAAA,EAAqB,KAAA,CAAM,QAAA,CAAS,EAAE,CAAC,CAAA,2BAAA;AAAA,KACzC;AAAA,EACF;AACA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,SAAA,CAAU,CAAA,EAAG,KAAK,CAAA;AAC1C,EAAA,IAAI,eAAe,mBAAA,EAAqB;AACtC,IAAA,MAAM,IAAI,qBAAA,EAAuB,CAAA,iBAAA,EAAoB,WAAW,QAAA,CAAS,EAAE,CAAC,CAAA,aAAA,CAAe,CAAA;AAAA,EAC7F;AAEA,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,MAAA,GAAS,SAAA,CAAU,UAAA,EAAY,MAAA,EAAQ,iBAAiB,CAAA,CAAE,UAAA;AAC1D,EAAA,OAAO,SAAA,CAAU,UAAA,EAAY,MAAA,EAAQ,WAAW,CAAA,CAAE,IAAA;AACpD;AAEA,SAAS,SAAA,CACP,KAAA,EACA,MAAA,EACA,KAAA,EAC0C;AAC1C,EAAA,IAAI,MAAA,GAAS,CAAA,GAAI,KAAA,CAAM,MAAA,EAAQ;AAC7B,IAAA,MAAM,GAAA,CAAI,qBAAA,EAAuB,CAAA,6BAAA,EAAgC,KAAK,CAAA,KAAA,CAAO,CAAA;AAAA,EAC/E;AACA,EAAA,MAAM,OAAQ,KAAA,CAAM,MAAM,KAAK,CAAA,GAAK,KAAA,CAAM,SAAS,CAAC,CAAA;AACpD,EAAA,MAAM,QAAQ,MAAA,GAAS,CAAA;AACvB,EAAA,MAAM,MAAM,KAAA,GAAQ,IAAA;AACpB,EAAA,IAAI,GAAA,GAAM,MAAM,MAAA,EAAQ;AACtB,IAAA,MAAM,GAAA,CAAI,qBAAA,EAAuB,CAAA,yBAAA,EAA4B,KAAK,CAAA,CAAE,CAAA;AAAA,EACtE;AACA,EAAA,OAAO,EAAE,MAAM,KAAA,CAAM,KAAA,CAAM,OAAO,GAAG,CAAA,EAAG,YAAY,GAAA,EAAI;AAC1D;AAGA,SAAS,cAAc,GAAA,EAAyB;AAC9C,EAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC3D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AACxE,EAAA,MAAM,SAAA,GAAY,KAAK,MAAM,CAAA;AAC7B,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,SAAA,CAAU,MAAM,CAAA;AAC3C,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,SAAA,CAAU,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,SAAA,CAAU,UAAA,CAAW,CAAC,CAAA;AAC1E,EAAA,OAAO,GAAA;AACT;AAEA,eAAe,0BAA0B,MAAA,EAOX;AAC5B,EAAA,MAAM,EAAE,GAAA,EAAK,QAAA,EAAU,eAAe,sBAAA,EAAwB,MAAA,EAAQ,WAAU,GAAI,MAAA;AAEpF,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,QAAA,CAAS,WAAA,EAAa,cAAc,SAAS,CAAA;AAC9D,EAAA,MAAM,gBAAA,GAAmB,kBAAkB,IAAI,CAAA;AAC/C,EAAA,MAAM,aAAa,IAAA,CAAK,QAAA;AAAA,IACtB,oBAAA;AAAA,IACA,oBAAA,GAAuB;AAAA,GACzB;AAEA,EAAA,MAAM,6BAA6B,EAAE,GAAA,EAAK,IAAA,EAAM,QAAA,EAAU,QAAQ,CAAA;AAClE,EAAA,mBAAA,CAAoB,IAAI,CAAA;AAIxB,EAAA,IAAI,CAAC,SAAS,SAAA,EAAW;AACvB,IAAA,MAAM,GAAA,CAAI,qBAAqB,2CAA2C,CAAA;AAAA,EAC5E;AACA,EAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AACpB,IAAA,MAAM,GAAA;AAAA,MACJ,0BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,eAAe,MAAM,mBAAA,CAAoB,SAAS,SAAA,EAAW,MAAA,CAAO,UAAU,SAAS,CAAA;AAC7F,EAAA,MAAM,aAAA,GAAgB,WAAW,UAAU,CAAA;AAC3C,EAAA,IAAI,YAAA,CAAa,eAAe,aAAA,EAAe;AAC7C,IAAA,MAAM,GAAA;AAAA,MACJ,yBAAA;AAAA,MACA,CAAA,oBAAA,EAAuB,YAAA,CAAa,UAAU,CAAA,gCAAA,EAAmC,aAAa,CAAA;AAAA,KAChG;AAAA,EACF;AACA,EAAA,8BAAA,CAA+B,cAAc,gBAAgB,CAAA;AAG7D,EAAA,IAAI,CAAC,SAAS,aAAA,EAAe;AAC3B,IAAA,MAAM,GAAA,CAAI,oBAAoB,+CAA+C,CAAA;AAAA,EAC/E;AACA,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI;AACF,IAAA,YAAA,GAAe,aAAA,CAAc,SAAS,aAAa,CAAA;AAAA,EACrD,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,GAAA,CAAI,gBAAA,EAAkB,CAAA,uCAAA,EAA0C,CAAC,CAAA,CAAE,CAAA;AAAA,EAC3E;AACA,EAAA,MAAM,cAAA,GAAiB,UAAA,CAAW,QAAA,CAAS,CAAA,EAAG,EAAE,CAAA;AAChD,EAAA,MAAM,cAAc,IAAI,UAAA;AAAA,IACtB,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,YAA4B;AAAA,GACpE;AACA,EAAA,IAAI,CAAC,cAAA,CAAe,WAAA,EAAa,cAAc,CAAA,EAAG;AAChD,IAAA,MAAM,GAAA;AAAA,MACJ,wBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAKA,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,EAC7D,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,GAAA,CAAI,gBAAA,EAAkB,CAAA,+BAAA,EAAkC,CAAC,CAAA,CAAE,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,SAAA,GAAa,QAAoC,MAAM,CAAA;AAC7D,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,GAChC,SAAA,CAA6C,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,KAAK,CAAA,KAAM,UAAU,CAAA,GACjF,MAAA;AACJ,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,GAAA,CAAI,kBAAkB,0DAA0D,CAAA;AAAA,EACxF;AACA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,OAAO,MAAA,CAAO,SAAA;AAAA,MAC7B,KAAA;AAAA,MACA,EAAE,GAAA,EAAK,KAAA,EAAO,CAAA,EAAG,KAAA,CAAM,GAAG,CAAA,EAAa,CAAA,EAAG,KAAA,CAAM,GAAG,CAAA,EAAa,GAAA,EAAK,IAAA,EAAK;AAAA,MAC1E,EAAE,IAAA,EAAM,mBAAA,EAAqB,IAAA,EAAM,SAAA,EAAU;AAAA,MAC7C,KAAA;AAAA,MACA,CAAC,QAAQ;AAAA,KACX;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,GAAA,CAAI,gBAAA,EAAkB,CAAA,8CAAA,EAAiD,CAAC,CAAA,CAAE,CAAA;AAAA,EAClF;AAGA,EAAA,IAAI,CAAC,SAAS,SAAA,EAAW;AACvB,IAAA,MAAM,GAAA,CAAI,qBAAqB,2CAA2C,CAAA;AAAA,EAC5E;AACA,EAAA,IAAI,CAAC,iBAAA,CAAkB,IAAA,CAAK,QAAA,CAAS,WAAW,CAAA,EAAG;AACjD,IAAA,MAAM,GAAA,CAAI,sBAAsB,+CAA+C,CAAA;AAAA,EACjF;AACA,EAAA,IAAI,QAAA,CAAS,IAAA,KAAS,MAAA,IAAU,MAAA,CAAO,uBAAuB,MAAA,EAAW;AACvE,IAAA,MAAM,GAAA;AAAA,MACJ,sBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IACE,MAAA,CAAO,kBAAA,KAAuB,MAAA,IAC9B,QAAA,CAAS,WAAA,CAAY,aAAY,KAAM,MAAA,CAAO,kBAAA,CAAmB,WAAA,EAAY,EAC7E;AACA,IAAA,MAAM,GAAA;AAAA,MACJ,sBAAA;AAAA,MACA,CAAA,YAAA,EAAe,QAAA,CAAS,WAAA,CAAY,WAAA,EAAa,CAAA,wCAAA;AAAA,KACnD;AAAA,EACF;AACA,EAAA,MAAM,mBAAA;AAAA,IACJ,QAAA,CAAS,SAAA;AAAA,IACT,QAAA;AAAA,IACA,aAAA;AAAA,IACA,sBAAA;AAAA,IACA,UAAA,CAAW,SAAS,WAAW;AAAA,GACjC;AAGA,EAAA,IAAI,SAAS,KAAA,CAAM,WAAA,EAAY,KAAM,UAAA,CAAW,aAAa,CAAA,EAAG;AAC9D,IAAA,MAAM,GAAA,CAAI,sBAAA,EAAwB,CAAA,WAAA,EAAc,QAAA,CAAS,KAAK,CAAA,8BAAA,CAAgC,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,SAAS,MAAA,CAAO,WAAA,EAAY,KAAM,UAAA,CAAW,sBAAsB,CAAA,EAAG;AACxE,IAAA,MAAM,GAAA;AAAA,MACJ,uBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,iBAAA,CAAkB,IAAA,CAAK,QAAA,CAAS,WAAW,CAAA,EAAG;AACjD,IAAA,MAAM,GAAA,CAAI,sBAAsB,+CAA+C,CAAA;AAAA,EACjF;AAGA,EAAA,IAAI,OAAO,YAAA,KAAiB,MAAA,IAAa,QAAA,CAAS,IAAA,KAAS,OAAO,YAAA,EAAc;AAC9E,IAAA,MAAM,GAAA;AAAA,MACJ,eAAA;AAAA,MACA,CAAA,iBAAA,EAAoB,QAAA,CAAS,IAAI,CAAA,yBAAA,EAA4B,OAAO,YAAY,CAAA;AAAA,KAClF;AAAA,EACF;AACA,EAAA,IAAI,QAAA,CAAS,SAAS,MAAA,EAAQ;AAC5B,IAAA,IAAA,CACG,MAAA,CAAO,iBAAiB,MAAA,IAAa,MAAA,CAAO,iBAAiB,IAAA,KAC9D,MAAA,CAAO,oCAAoC,IAAA,EAC3C;AACA,MAAA,MAAM,GAAA;AAAA,QACJ,eAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,IACE,MAAA,CAAO,YAAA,KAAiB,MAAA,IACxB,MAAA,CAAO,YAAA,KAAiB,IAAA,IACxB,gBAAA,CAAiB,IAAA,KAAS,MAAA,CAAO,YAAA,CAAa,WAAA,EAAY,EAC1D;AACA,MAAA,MAAM,GAAA;AAAA,QACJ,eAAA;AAAA,QACA,QAAQ,gBAAA,CAAiB,IAAI,0BAA0B,MAAA,CAAO,YAAA,CAAa,aAAa,CAAA;AAAA,OAC1F;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,QAAA,CAAS,IAAA;AAAA,IACf,YAAY,QAAA,CAAS,WAAA;AAAA,IACrB,gBAAgB,QAAA,CAAS,eAAA;AAAA,IACzB,MAAM,gBAAA,CAAiB,IAAA;AAAA,IACvB,OAAO,gBAAA,CAAiB,KAAA;AAAA,IACxB,OAAO,gBAAA,CAAiB,KAAA;AAAA,IACxB,OAAO,gBAAA,CAAiB,KAAA;AAAA,IACxB,OAAO,gBAAA,CAAiB,KAAA;AAAA,IACxB,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,WAAA,EAAY;AAAA,IACvC,gBAAA,EAAkB;AAAA,GACpB;AACF;AAEA,SAAS,uBAAuB,MAAA,EAKX;AACnB,EAAA,MAAM,EAAE,QAAA,EAAU,aAAA,EAAe,sBAAA,EAAwB,QAAO,GAAI,MAAA;AAEpE,EAAA,IAAI,MAAA,CAAO,0BAA0B,IAAA,EAAM;AACzC,IAAA,MAAM,GAAA;AAAA,MACJ,4BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAO,YAAA,KAAiB,MAAA,IAAa,QAAA,CAAS,IAAA,KAAS,OAAO,YAAA,EAAc;AAC9E,IAAA,MAAM,GAAA;AAAA,MACJ,eAAA;AAAA,MACA,CAAA,iBAAA,EAAoB,QAAA,CAAS,IAAI,CAAA,yBAAA,EAA4B,OAAO,YAAY,CAAA;AAAA,KAClF;AAAA,EACF;AACA,EAAA,IAAI,QAAA,CAAS,SAAS,KAAA,EAAO;AAC3B,IAAA,MAAM,GAAA;AAAA,MACJ,4BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,SAAS,KAAA,CAAM,WAAA,EAAY,KAAM,UAAA,CAAW,aAAa,CAAA,EAAG;AAC9D,IAAA,MAAM,GAAA,CAAI,sBAAA,EAAwB,CAAA,WAAA,EAAc,QAAA,CAAS,KAAK,CAAA,8BAAA,CAAgC,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,CAAC,iBAAA,CAAkB,IAAA,CAAK,QAAA,CAAS,WAAW,CAAA,EAAG;AACjD,IAAA,MAAM,GAAA,CAAI,sBAAsB,+CAA+C,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,cAAA,GAAiB,WAAW,sBAAsB,CAAA;AACxD,EAAA,IAAI,QAAA,CAAS,MAAA,CAAO,WAAA,EAAY,KAAM,cAAA,EAAgB;AACpD,IAAA,MAAM,GAAA;AAAA,MACJ,uBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,QAAA,CAAS,IAAA;AAAA,IACf,UAAA,EAAY,QAAA,CAAS,WAAA,CAAY,WAAA,EAAY;AAAA,IAC7C,gBAAgB,QAAA,CAAS,eAAA;AAAA,IACzB,IAAA,EAAM,mBAAA;AAAA,IACN,KAAA,EAAO,oBAAA;AAAA,IACP,KAAA,EAAO,oBAAA;AAAA,IACP,KAAA,EAAO,oBAAA;AAAA,IACP,KAAA,EAAO,oBAAA;AAAA,IACP,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,WAAA,EAAY;AAAA,IACvC,gBAAA,EAAkB;AAAA,GACpB;AACF;AAIA,SAAS,eAAe,GAAA,EAAyB;AAC/C,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,KAAK,GAAG,CAAA;AAAA,EAChB,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,GAAA,CAAI,cAAA,EAAgB,CAAA,iCAAA,EAAoC,CAAC,CAAA,CAAE,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACrC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC9D,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,gBAAgB,GAAA,EAAuB;AAC9C,EAAA,IAAI,GAAA,CAAI,MAAA,GAAS,WAAA,GAAc,SAAA,GAAY,CAAA,EAAG;AAC5C,IAAA,MAAM,GAAA;AAAA,MACJ,iBAAA;AAAA,MACA,oBAAoB,GAAA,CAAI,MAAM,CAAA,gBAAA,EAAmB,WAAA,GAAc,YAAY,CAAC,CAAA,CAAA;AAAA,KAC9E;AAAA,EACF;AACA,EAAA,MAAM,OAAA,GAAU,SAAA,CAAU,GAAA,EAAK,kBAAkB,CAAA;AACjD,EAAA,MAAM,MAAA,GAAS,SAAA,CAAU,GAAA,EAAK,kBAAkB,CAAA;AAChD,EAAA,MAAM,OAAA,GAAU,SAAA,CAAU,GAAA,EAAK,mBAAmB,CAAA;AAClD,EAAA,IAAI,YAAY,CAAA,EAAG;AACjB,IAAA,MAAM,GAAA,CAAI,iBAAA,EAAmB,CAAA,0BAAA,EAA6B,OAAO,CAAA,CAAE,CAAA;AAAA,EACrE;AACA,EAAA,IAAI,YAAY,YAAA,EAAc;AAC5B,IAAA,MAAM,IAAI,iBAAA,EAAmB,CAAA,4BAAA,EAA+B,QAAQ,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,EACrF;AACA,EAAA,IAAI,WAAW,mBAAA,EAAqB;AAClC,IAAA,MAAM,GAAA;AAAA,MACJ,iBAAA;AAAA,MACA,oCAAoC,MAAM,CAAA,sBAAA;AAAA,KAC5C;AAAA,EACF;AACF;AAEA,SAAS,YAAY,GAAA,EAA6B;AAChD,EAAA,MAAM,UAAA,GAAa,SAAA,CAAU,GAAA,EAAK,mBAAmB,CAAA;AACrD,EAAA,MAAM,WAAW,mBAAA,GAAsB,CAAA;AACvC,EAAA,IAAI,GAAA,CAAI,MAAA,GAAS,QAAA,GAAW,UAAA,EAAY;AACtC,IAAA,MAAM,GAAA,CAAI,mBAAmB,mCAAmC,CAAA;AAAA,EAClE;AACA,EAAA,OAAO,GAAA,CAAI,QAAA,CAAS,QAAA,EAAU,QAAA,GAAW,UAAU,CAAA;AACrD;AAEA,SAAS,kBAAkB,IAAA,EAOzB;AACA,EAAA,MAAM,CAAA,GAAI,CAAC,GAAA,KAAgB,UAAA,CAAW,KAAK,QAAA,CAAS,GAAA,EAAK,GAAA,GAAM,eAAe,CAAC,CAAA;AAC/E,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,EAAE,aAAa,CAAA;AAAA,IACrB,KAAA,EAAO,EAAE,cAAc,CAAA;AAAA,IACvB,KAAA,EAAO,EAAE,cAAc,CAAA;AAAA,IACvB,KAAA,EAAO,EAAE,cAAc,CAAA;AAAA,IACvB,KAAA,EAAO,EAAE,cAAc,CAAA;AAAA,IACvB,QAAQ,UAAA,CAAW,IAAA,CAAK,SAAS,gBAAA,EAAkB,gBAAA,GAAmB,CAAC,CAAC;AAAA,GAC1E;AACF;AAIA,IAAM,SAAA,GAAY,6BAAA;AAClB,IAAM,OAAA,GAAU,2BAAA;AAChB,IAAM,eAAA,GAAkB,IAAI,WAAA,EAAY,CAAE,OAAO,SAAS,CAAA;AAC1D,IAAM,aAAA,GAAgB,IAAI,WAAA,EAAY,CAAE,OAAO,OAAO,CAAA;AAOtD,SAAS,SAAA,CAAU,GAAA,EAAiB,MAAA,EAAoB,IAAA,GAAO,CAAA,EAAW;AACxE,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,MAAA,GAAS,MAAA,CAAO,MAAA;AACjC,EAAA,KAAA,EAAO,KAAA,IAAS,CAAA,GAAI,IAAA,EAAM,CAAA,IAAK,MAAM,CAAA,EAAA,EAAK;AACxC,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACtC,MAAA,IAAI,IAAI,CAAA,GAAI,CAAC,MAAM,MAAA,CAAO,CAAC,GAAG,SAAS,KAAA;AAAA,IACzC;AACA,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,OAAO,EAAA;AACT;AASA,SAAS,yBAAyB,OAAA,EAAgD;AAGhF,EAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,oBAAA,GAAuB,4BAAA,EAA8B;AACxE,IAAA,MAAM,GAAA,CAAI,mBAAmB,8DAA8D,CAAA;AAAA,EAC7F;AACA,EAAA,MAAM,aAAA,GAAgB,SAAA,CAAU,OAAA,EAAS,oBAAoB,CAAA;AAC7D,EAAA,MAAM,aAAA,GAAgB,SAAA,CAAU,OAAA,EAAS,oBAAA,GAAuB,CAAC,CAAA;AACjE,EAAA,IAAI,kBAAkB,gCAAA,EAAkC;AACtD,IAAA,MAAM,GAAA;AAAA,MACJ,iBAAA;AAAA,MACA,CAAA,sCAAA,EAAyC,aAAa,CAAA,WAAA,EAAc,gCAAgC,CAAA,CAAA;AAAA,KACtG;AAAA,EACF;AAEA,EAAA,MAAM,iBAAiB,oBAAA,GAAuB,4BAAA;AAC9C,EAAA,MAAM,eAAe,cAAA,GAAiB,aAAA;AACtC,EAAA,IAAI,OAAA,CAAQ,SAAS,YAAA,EAAc;AACjC,IAAA,MAAM,GAAA,CAAI,mBAAmB,yDAAyD,CAAA;AAAA,EACxF;AACA,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,QAAA,CAAS,cAAA,EAAgB,YAAY,CAAA;AAC/D,EAAA,MAAM,cAAA,GAAiB,kBAAA;AACvB,EAAA,MAAM,gBAAgB,cAAA,GAAiB,sBAAA;AACvC,EAAA,MAAM,gBAAgB,aAAA,GAAgB,CAAA;AAEtC,EAAA,IAAI,SAAA,CAAU,MAAA,GAAS,aAAA,GAAgB,4BAAA,EAA8B;AACnE,IAAA,MAAM,GAAA;AAAA,MACJ,iBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,QAAA,GAAW,SAAA,CAAU,QAAA,CAAS,CAAA,EAAG,kBAAkB,CAAA;AACzD,EAAA,MAAM,WAAA,GAAc,SAAA,CAAU,QAAA,CAAS,cAAA,EAAgB,iBAAiB,sBAAsB,CAAA;AAC9F,EAAA,MAAM,QAAA,GAAW,SAAA,CAAU,SAAA,EAAW,aAAa,CAAA;AACnD,EAAA,MAAM,gBAAgB,aAAA,GAAgB,QAAA;AACtC,EAAA,IAAI,SAAA,CAAU,MAAA,GAAS,aAAA,GAAgB,4BAAA,EAA8B;AACnE,IAAA,MAAM,GAAA,CAAI,mBAAmB,0CAA0C,CAAA;AAAA,EACzE;AAEA,EAAA,MAAM,UAAA,GAAa,SAAA,CAAU,QAAA,CAAS,aAAA,EAAe,aAAa,CAAA;AAClE,EAAA,MAAM,cAAA,GAAiB,SAAA,CAAU,SAAA,EAAW,aAAa,CAAA;AACzD,EAAA,MAAM,cAAA,GAAiB,SAAA,CAAU,SAAA,EAAW,aAAA,GAAgB,CAAC,CAAA;AAC7D,EAAA,IAAI,mBAAmB,sBAAA,EAAwB;AAC7C,IAAA,MAAM,GAAA;AAAA,MACJ,mBAAA;AAAA,MACA,CAAA,eAAA,EAAkB,cAAc,CAAA,4BAAA,EAA+B,sBAAsB,CAAA,CAAA;AAAA,KACvF;AAAA,EACF;AACA,EAAA,MAAM,aAAA,GAAgB,gBAAgB,4BAAA,GAA+B,cAAA;AACrE,EAAA,IAAI,SAAA,CAAU,SAAS,aAAA,EAAe;AACpC,IAAA,MAAM,GAAA,CAAI,mBAAmB,0DAA0D,CAAA;AAAA,EACzF;AAEA,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,WAAA;AAAA,IACA,UAAA;AAAA,IACA,mBAAA,EAAqB,SAAA,CAAU,QAAA,CAAS,aAAA,EAAe,aAAa;AAAA,GACtE;AACF;AAEA,SAAS,gBAAgB,mBAAA,EAAyD;AAChF,EAAA,IAAI,mBAAA,CAAoB,SAAS,4BAAA,EAA8B;AAC7D,IAAA,MAAM,GAAA,CAAI,mBAAmB,+CAA+C,CAAA;AAAA,EAC9E;AACA,EAAA,MAAM,QAAA,GAAW,SAAA,CAAU,mBAAA,EAAqB,CAAC,CAAA;AACjD,EAAA,MAAM,QAAA,GAAW,SAAA,CAAU,mBAAA,EAAqB,CAAC,CAAA;AACjD,EAAA,IAAI,aAAa,sBAAA,EAAwB;AACvC,IAAA,MAAM,GAAA;AAAA,MACJ,mBAAA;AAAA,MACA,CAAA,eAAA,EAAkB,QAAQ,CAAA,4BAAA,EAA+B,sBAAsB,CAAA,CAAA;AAAA,KACjF;AAAA,EACF;AACA,EAAA,IAAI,mBAAA,CAAoB,MAAA,GAAS,4BAAA,GAA+B,QAAA,EAAU;AACxE,IAAA,MAAM,GAAA,CAAI,mBAAmB,wCAAwC,CAAA;AAAA,EACvE;AAEA,EAAA,MAAM,YAAY,mBAAA,CAAoB,QAAA;AAAA,IACpC,4BAAA;AAAA,IACA,4BAAA,GAA+B;AAAA,GACjC;AACA,EAAA,MAAM,QAAgC,EAAC;AACvC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,OAAO,MAAA,GAAS,UAAU,MAAA,EAAQ;AAChC,IAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,SAAA,EAAW,eAAA,EAAiB,MAAM,CAAA;AAC1D,IAAA,IAAI,UAAU,EAAA,EAAI;AAClB,IAAA,MAAM,MAAA,GAAS,SAAA,CAAU,SAAA,EAAW,aAAA,EAAe,KAAK,CAAA;AACxD,IAAA,IAAI,WAAW,EAAA,EAAI;AACjB,MAAA,MAAM,GAAA,CAAI,mBAAmB,wBAAwB,CAAA;AAAA,IACvD;AACA,IAAA,MAAM,GAAA,GAAM,SAAS,aAAA,CAAc,MAAA;AAEnC,IAAA,MAAM,GAAA,GAAM,IAAI,WAAA,CAAY,OAAO,CAAA,CAAE,OAAO,SAAA,CAAU,QAAA,CAAS,KAAA,EAAO,GAAG,CAAC,CAAA;AAC1E,IAAA,IAAI;AACF,MAAA,KAAA,CAAM,IAAA,CAAK,IAAS,IAAA,CAAA,eAAA,CAAgB,GAAG,CAAC,CAAA;AAAA,IAC1C,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,GAAA,CAAI,iBAAA,EAAmB,CAAA,0BAAA,EAA6B,CAAC,CAAA,CAAE,CAAA;AAAA,IAC/D;AACA,IAAA,MAAA,GAAS,GAAA;AAAA,EACX;AAEA,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,GAAA,CAAI,qBAAqB,iCAAiC,CAAA;AAAA,EAClE;AAEA,EAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG;AACpB,IAAA,MAAM,GAAA;AAAA,MACJ,mBAAA;AAAA,MACA,CAAA,mBAAA,EAAsB,MAAM,MAAM,CAAA,sDAAA;AAAA,KACpC;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEA,eAAe,sBAAsB,KAAA,EAA8C;AACjF,EAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,GAAS,GAAG,CAAA,EAAA,EAAK;AACzC,IAAA,MAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AAEpB,IAAA,IAAI,GAAA,GAAM,KAAK,SAAA,EAAW;AACxB,MAAA,MAAM,GAAA;AAAA,QACJ,qBAAA;AAAA,QACA,CAAA,KAAA,EAAQ,CAAC,CAAA,GAAA,EAAM,IAAA,CAAK,OAAO,CAAA,8BAAA,EAAiC,IAAA,CAAK,SAAA,CAAU,WAAA,EAAa,CAAA,CAAA;AAAA,OAC1F;AAAA,IACF;AACA,IAAA,IAAI,GAAA,GAAM,KAAK,QAAA,EAAU;AACvB,MAAA,MAAM,GAAA;AAAA,QACJ,qBAAA;AAAA,QACA,CAAA,KAAA,EAAQ,CAAC,CAAA,GAAA,EAAM,IAAA,CAAK,OAAO,CAAA,wBAAA,EAA2B,IAAA,CAAK,QAAA,CAAS,WAAA,EAAa,CAAA,CAAA;AAAA,OACnF;AAAA,IACF;AACA,IAAA,IAAI,EAAA;AACJ,IAAA,IAAI;AACF,MAAA,EAAA,GAAK,MAAM,KAAA,CAAM,CAAC,CAAA,CAAE,MAAA,CAAO,EAAE,SAAA,EAAW,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA,CAAE,SAAA,EAAW,CAAA;AAAA,IAClE,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,GAAA;AAAA,QACJ,qBAAA;AAAA,QACA,CAAA,KAAA,EAAQ,CAAC,CAAA,GAAA,EAAM,KAAA,CAAM,CAAC,CAAA,CAAE,OAAO,mCAAmC,CAAC,CAAA;AAAA,OACrE;AAAA,IACF;AACA,IAAA,IAAI,CAAC,EAAA,EAAI;AACP,MAAA,MAAM,GAAA;AAAA,QACJ,qBAAA;AAAA,QACA,CAAA,KAAA,EAAQ,CAAC,CAAA,GAAA,EAAM,KAAA,CAAM,CAAC,CAAA,CAAE,OAAO,CAAA,gDAAA,EAAmD,CAAA,GAAI,CAAC,CAAA,CAAA;AAAA,OACzF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA;AACnC,EAAA,IAAI,GAAA,GAAM,KAAK,SAAA,EAAW;AACxB,IAAA,MAAM,GAAA;AAAA,MACJ,qBAAA;AAAA,MACA,cAAc,IAAA,CAAK,OAAO,iCAAiC,IAAA,CAAK,SAAA,CAAU,aAAa,CAAA,CAAA;AAAA,KACzF;AAAA,EACF;AACA,EAAA,IAAI,GAAA,GAAM,KAAK,QAAA,EAAU;AACvB,IAAA,MAAM,GAAA;AAAA,MACJ,qBAAA;AAAA,MACA,cAAc,IAAA,CAAK,OAAO,2BAA2B,IAAA,CAAK,QAAA,CAAS,aAAa,CAAA,CAAA;AAAA,KAClF;AAAA,EACF;AACA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,EAAE,SAAA,EAAW,IAAA,CAAK,WAAW,CAAA;AAAA,EAC1D,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,GAAA;AAAA,MACJ,qBAAA;AAAA,MACA,CAAA,WAAA,EAAc,IAAA,CAAK,OAAO,CAAA,qCAAA,EAAwC,CAAC,CAAA;AAAA,KACrE;AAAA,EACF;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,GAAA,CAAI,qBAAA,EAAuB,CAAA,WAAA,EAAc,IAAA,CAAK,OAAO,CAAA,oBAAA,CAAsB,CAAA;AAAA,EACnF;AAIA,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,EAAA,GAAK,KAAA,CAAM,CAAC,CAAA,CAAE,aAAkB,IAAA,CAAA,yBAAyB,CAAA;AAC/D,IAAA,IAAI,CAAC,EAAA,IAAM,CAAC,EAAA,CAAG,EAAA,EAAI;AACjB,MAAA,MAAM,GAAA;AAAA,QACJ,qBAAA;AAAA,QACA,QAAQ,CAAC,CAAA,GAAA,EAAM,KAAA,CAAM,CAAC,EAAE,OAAO,CAAA,oDAAA;AAAA,OACjC;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,SAAS,IAAA,EAAiD;AACvE,EAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,MAAA,EAAO;AACxC,EAAA,MAAM,OAAO,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,QAAQ,GAAG,CAAA;AACtD,EAAA,OAAO,IAAI,WAAW,IAAI,CAAA;AAC5B;AAKA,SAAS,YAAY,EAAA,EAA4B;AAC/C,EAAA,IAAI,EAAA,CAAG,WAAW,EAAA,EAAI;AACpB,IAAA,MAAM,GAAA,CAAI,iBAAA,EAAmB,CAAA,yCAAA,EAA4C,EAAA,CAAG,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EACvF;AACA,EAAA,MAAM,YAAA,GAAe,IAAI,UAAA,CAAW,EAAE,CAAA;AACtC,EAAA,YAAA,CAAa,CAAC,CAAA,GAAI,CAAA;AAClB,EAAA,YAAA,CAAa,GAAA,CAAI,IAAI,CAAC,CAAA;AAGtB,EAAA,MAAM,MAAA,GAAS,IAAI,UAAA,CAAW;AAAA,IAC5B,EAAA;AAAA,IAAM,EAAA;AAAA,IAAM,EAAA;AAAA,IAAM,EAAA;AAAA,IAAM,CAAA;AAAA,IAAM,CAAA;AAAA,IAAM,EAAA;AAAA,IAAM,GAAA;AAAA,IAAM,EAAA;AAAA,IAAM,GAAA;AAAA,IAAM,EAAA;AAAA,IAAM,CAAA;AAAA,IAAM,CAAA;AAAA,IAAM,CAAA;AAAA,IAAM,CAAA;AAAA,IAAM,EAAA;AAAA,IAC1F,GAAA;AAAA,IAAM,EAAA;AAAA,IAAM,GAAA;AAAA,IAAM,EAAA;AAAA,IAAM,CAAA;AAAA,IAAM,CAAA;AAAA,IAAM,CAAA;AAAA,IAAM,CAAA;AAAA,IAAM,EAAA;AAAA,IAAM;AAAA,GACvD,CAAA;AACD,EAAA,OAAO,MAAA,CAAO,QAAQ,YAAY,CAAA;AACpC;AAEA,eAAe,mBAAA,CACb,IAAA,EACA,KAAA,EACA,IAAA,EACA,eACA,IAAA,EACe;AACf,EAAA,IAAI,KAAA,CAAM,WAAW,EAAA,EAAI;AACvB,IAAA,MAAM,GAAA,CAAI,aAAA,EAAe,CAAA,EAAG,IAAI,CAAA,mCAAA,CAAqC,CAAA;AAAA,EACvE;AACA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,OAAO,MAAA,CAAO,SAAA;AAAA,MACxB,MAAA;AAAA,MACA,IAAA;AAAA,MACA,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,OAAA,EAAQ;AAAA,MACrC,KAAA;AAAA,MACA,CAAC,QAAQ;AAAA,KACX;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,aAAA,EAAe,CAAA,EAAG,IAAI,CAAA,wBAAA,EAA2B,CAAC,CAAA,CAAE,CAAA;AAAA,EAChE;AACA,EAAA,MAAM,EAAA,GAAK,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA;AAAA,IAC7B,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,IACjC,GAAA;AAAA,IACA,KAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,CAAC,EAAA,EAAI;AACP,IAAA,MAAM,GAAA,CAAI,aAAA,EAAe,CAAA,EAAG,IAAI,CAAA,2BAAA,CAA6B,CAAA;AAAA,EAC/D;AACF;AAEA,eAAe,OAAO,IAAA,EAAuC;AAC3D,EAAA,OAAO,IAAI,WAAW,MAAM,MAAA,CAAO,OAAO,MAAA,CAAO,SAAA,EAAW,IAAoB,CAAC,CAAA;AACnF;AAEA,eAAe,UAAU,IAAA,EAAmC;AAC1D,EAAA,OAAO,UAAA,CAAW,MAAM,MAAA,CAAO,IAAI,CAAC,CAAA;AACtC;AAIA,SAAS,SAAA,CAAU,KAAiB,GAAA,EAAqB;AACvD,EAAA,OAAO,IAAI,GAAG,CAAA,GAAK,GAAA,CAAI,GAAA,GAAM,CAAC,CAAA,IAAK,CAAA;AACrC;AAEA,SAAS,SAAA,CAAU,KAAiB,GAAA,EAAqB;AAEvD,EAAA,OAAA,CAAQ,IAAI,GAAG,CAAA,GAAK,GAAA,CAAI,GAAA,GAAM,CAAC,CAAA,IAAK,CAAA,GAAM,GAAA,CAAI,GAAA,GAAM,CAAC,CAAA,IAAK,EAAA,GAAO,IAAI,GAAA,GAAM,CAAC,KAAK,EAAA,MAAS,CAAA;AAC5F;AAEA,SAAS,cAAA,CAAe,GAAe,CAAA,EAAwB;AAC7D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAA,EAAA,EAAK,IAAA,IAAQ,CAAA,CAAE,CAAC,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA;AACrD,EAAA,OAAO,IAAA,KAAS,CAAA;AAClB;AAEA,SAAS,MAAA,CAAO,GAAe,CAAA,EAA2B;AACxD,EAAA,MAAM,MAAM,IAAI,UAAA,CAAW,CAAA,CAAE,MAAA,GAAS,EAAE,MAAM,CAAA;AAC9C,EAAA,GAAA,CAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AACZ,EAAA,GAAA,CAAI,GAAA,CAAI,CAAA,EAAG,CAAA,CAAE,MAAM,CAAA;AACnB,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,WAAW,CAAA,EAAuB;AACzC,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK,CAAA,IAAK,CAAA,CAAE,CAAC,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AACzE,EAAA,OAAO,CAAA;AACT","file":"chunk-DIA6U2CV.js","sourcesContent":["/**\n * TDX DCAP attestation verifier (SDK port of\n * `web/src/lib/coordinator/tdx-attestation.ts`).\n *\n * Verifies a TDX DCAP quote on three paths, using Web Crypto (`crypto.subtle`,\n * a Node 22 / browser global) and `@peculiar/x509`:\n *\n *   - GCP  (spec section 5.1): cert chain to the pinned Intel SGX Root CA, TCB\n *     validity, freshness nonce == REPORT_DATA[0:32], Noise binding ==\n *     REPORT_DATA[32:64], debug bit clear, MRTD pin.\n *   - Azure (spec section 5.2): MAA JWT issuer / JWKS / policy-hash / compliance\n *     / debug, MAA<->DCAP REPORTDATA binding, hcl_keys hash binding, HCL AK pub\n *     extraction, raw DCAP measurement binding, TPM AK quote signature, TPM\n *     qualifying data binding.\n *   - Local (loopback dev fallback): checks nonce and Noise pubkey consistency\n *     only; no hardware attestation.\n *\n * Throws the SDK {@link AttestationError} (from `../core/errors.js`) with a\n * closed `code` on any failure. Callers fail-closed: tear down the Noise\n * transport rather than surface an unverified channel.\n *\n * Never log secrets, nonces, or raw decrypted payloads (spec section 9).\n *\n * @module JW-145 / JW-431\n */\n\nimport * as x509 from \"@peculiar/x509\";\nimport { AttestationError, type AttestationErrorCode } from \"../core/errors.js\";\n\n// ── Public API ───────────────────────────────────────────────────────────────\n\nexport type AttestationMode = \"dev\" | \"prod\";\nexport type CoordinatorRuntimeProfile = \"prod-hardened\" | \"prod-devnet-simplified\";\n\nexport type AzureMaaPolicy = {\n  /** Expected MAA token issuer for the approved Azure Attestation provider. */\n  expectedIssuer: string;\n  /** Expected JWKS endpoint for that provider. Token headers must not choose it. */\n  expectedJwksUrl: string;\n  /** Expected Azure Attestation evaluation policy hash from the signed token. */\n  expectedPolicyHash: string;\n};\n\nexport type AttestationPolicy = {\n  /**\n   * Expected MRTD for the published production coordinator build.\n   * Dev mode ignores this pin entirely.\n   */\n  expectedMrtd?: string;\n  /**\n   * SHA-256 hash of the approved coordinator binary. Azure production\n   * attestation requires this pin because binary_hash is otherwise only\n   * response metadata, even though the TPM quote binds it cryptographically.\n   */\n  expectedBinaryHash?: string;\n  /** Expected compile-time runtime profile carried by the approved artifact. */\n  expectedRuntimeProfile?: CoordinatorRuntimeProfile;\n  /**\n   * Runtime mode the client expects for this coordinator route. Production\n   * builds set this to \"prod\" so a prod hostname cannot silently accept an\n   * unpinned dev coordinator after DNS or load-balancer misrouting.\n   */\n  requiredMode?: AttestationMode;\n  /**\n   * Release tooling only: verify a prod quote before the new MRTD has been\n   * published. Runtime policy must leave this unset so prod stays fail-closed\n   * when the pin is missing.\n   */\n  allowUnpinnedProdMrtdForRelease?: boolean;\n  /**\n   * SHA-256 fingerprint (lowercase hex) of the DER-encoded Intel SGX Root CA.\n   * Defaults to {@link INTEL_SGX_ROOT_CA_FINGERPRINT_SHA256}. Override only in tests.\n   */\n  intelRootFingerprint?: string;\n  /**\n   * Temporary non-prod rollout escape hatch for legacy coordinators that have\n   * not rolled out `dcap_collateral`. When collateral is present, it is always\n   * verified. Production mode never honors this flag.\n   */\n  allowMissingDcapCollateral?: boolean;\n  /**\n   * Development-only escape hatch for a local coordinator running on a non-TDX\n   * machine. The transport only honors this for loopback coordinator URLs.\n   */\n  allowLocalAttestation?: boolean;\n  /**\n   * Azure-specific trust policy. Required for platform=\"azure-tdx-dcap\" because\n   * MAA providers and policies are customer-configurable Azure resources.\n   */\n  azureMaa?: AzureMaaPolicy;\n};\n\nexport type SignedDcapJson = {\n  /**\n   * JSON string returned by Intel PCS. May be either the inner body\n   * (`tcbInfo` / `enclaveIdentity`) or the full PCS wrapper.\n   */\n  body: string;\n  /** Hex signature over the exact signed body bytes. */\n  signature: string;\n  /** PEM chain whose first certificate verifies `signature`, ending at Intel root. */\n  issuerChainPem: string;\n};\n\nexport type DcapCollateral = {\n  /** PEM X.509 CRL for the PCK certificate issuer. */\n  pckCrlPem: string;\n  /** PEM chain for the PCK CRL issuer, ending at Intel root. */\n  pckCrlIssuerChainPem: string;\n  /** PEM X.509 CRL issued by Intel root, covering collateral signing certs. */\n  rootCaCrlPem: string;\n  /** Signed Intel TDX TCB Info V3. */\n  tcbInfo: SignedDcapJson;\n  /** Signed Intel TD QE Identity V2. */\n  qeIdentity: SignedDcapJson;\n};\n\nconst DEFAULT_AZURE_JWKS_TIMEOUT_MS = 30_000;\nconst TPM_GENERATED_VALUE = 0xff544347;\nconst TPM_ST_ATTEST_QUOTE = 0x8018;\n\nexport type AttestedMetadata = {\n  mode: AttestationMode;\n  binaryHash: string;\n  runtimeProfile?: CoordinatorRuntimeProfile;\n  mrtd: string;\n  rtmr0: string;\n  rtmr1: string;\n  rtmr2: string;\n  rtmr3: string;\n  pubkeyHex: string;\n  localAttestation: boolean;\n};\n\nexport type AttestResponse = {\n  quote: string; // base64\n  /**\n   * Nonce echoed back by the coordinator. Informational only: freshness is\n   * enforced cryptographically via REPORT_DATA[0:32] inside the TDX quote, not\n   * by trusting this JSON field.\n   */\n  nonce: string; // hex (64 chars)\n  pubkey: string; // hex (64 chars - X25519 pubkey)\n  binary_hash: string; // hex (64 chars - sha256)\n  mode: AttestationMode;\n  /** Compile-time runtime profile embedded in the coordinator artifact. */\n  runtime_profile?: CoordinatorRuntimeProfile;\n  /**\n   * Platform identifier set by the coordinator. Absent on GCP (tdx-dcap).\n   * Azure returns \"azure-tdx-dcap\".\n   */\n  platform?: string;\n  /**\n   * Azure only: MAA JWT from /attest/TdxVm, RS256-signed by MAA. Contains\n   * tdx_mrtd, tdx_td_attributes_debug, and x-ms-compliance-status.\n   */\n  maa_token?: string;\n  /**\n   * Azure only: TPM PCR quote packed as\n   * [4-byte msg_len LE][TPM2B_ATTEST][TPMT_SIGNATURE].\n   * qualifying_data = SHA-256(nonce || noise_pubkey || binary_hash). Base64-encoded.\n   */\n  tpm_quote?: string;\n  /**\n   * Azure only: raw bytes (base64) of the JSON key-blob from HCL report NV\n   * 0x1400001 [1056:]. SHA-256(hcl_keys_json_bytes) == DCAP REPORTDATA[0:32].\n   * Contains the AK public key as kid=\"HCLAkPub\".\n   */\n  hcl_keys_json?: string;\n  /**\n   * Intel DCAP verification collateral. When present, the verifier evaluates\n   * PCK revocation, TCB Info, and TD QE Identity. Policies can require it.\n   */\n  dcap_collateral?: DcapCollateral;\n  local_attestation?: boolean;\n};\n\n/**\n * Assert that an unknown JSON value has the shape of {@link AttestResponse}.\n * Throws {@link AttestationError} (\"NOT_ATTESTED\") on any missing or wrong-typed\n * field. Replaces an unsafe cast so missing fields produce a typed error rather\n * than silently reaching downstream checks as `undefined`.\n */\nexport function assertAttestResponse(value: unknown): asserts value is AttestResponse {\n  if (typeof value !== \"object\" || value === null) {\n    throw err(\"QUOTE_DECODE\", \"attestation response is not a JSON object\");\n  }\n  const v = value as Record<string, unknown>;\n  const fields: (keyof AttestResponse)[] = [\"quote\", \"nonce\", \"pubkey\", \"binary_hash\", \"mode\"];\n  for (const field of fields) {\n    if (typeof v[field] !== \"string\") {\n      throw err(\n        \"QUOTE_DECODE\",\n        `attestation response missing or non-string field: \"${field}\" (got ${typeof v[field]})`,\n      );\n    }\n  }\n  if (v[\"mode\"] !== \"dev\" && v[\"mode\"] !== \"prod\") {\n    throw err(\"QUOTE_DECODE\", `attestation response has unknown mode: \"${v[\"mode\"]}\"`);\n  }\n  if (\n    v[\"runtime_profile\"] !== undefined &&\n    v[\"runtime_profile\"] !== \"prod-hardened\" &&\n    v[\"runtime_profile\"] !== \"prod-devnet-simplified\"\n  ) {\n    throw err(\n      \"QUOTE_DECODE\",\n      `attestation response has unknown runtime profile: \"${v[\"runtime_profile\"]}\"`,\n    );\n  }\n  if (v[\"local_attestation\"] !== undefined && typeof v[\"local_attestation\"] !== \"boolean\") {\n    throw err(\n      \"QUOTE_DECODE\",\n      `attestation response has non-boolean local_attestation: ${typeof v[\"local_attestation\"]}`,\n    );\n  }\n}\n\n/**\n * SHA-256 fingerprint of the DER-encoded Intel SGX Root CA certificate\n * (CN=\"Intel SGX Root CA\"). Trust anchor for all PCK chains in DCAP quotes.\n *\n * Source:\n *   https://certificates.trustedservices.intel.com/Intel_SGX_Provisioning_Certification_RootCA.pem\n * Re-derive with:\n *   curl -s <url> | openssl x509 -outform DER | shasum -a 256\n *\n * Pinned: rotation requires a coordinator release.\n */\nexport const INTEL_SGX_ROOT_CA_FINGERPRINT_SHA256 =\n  \"44a0196b2b99f889b8e149e95b807a350e7424964399e885a7cbb8ccfab674d3\";\n\n// ── Error taxonomy mapping ───────────────────────────────────────────────────\n//\n// The reference verifier carried its own fine-grained code union. The SDK error\n// taxonomy (core/errors.ts, spec section 8.3) is a smaller closed set. Each\n// reference failure reason is mapped here to the closest SDK AttestationErrorCode.\n// The reference code is kept as a prefix in the message so failures stay\n// diagnosable without widening the public union.\n\n/** The reference verifier's internal failure reasons (port traceability only). */\ntype RefReason =\n  | \"QUOTE_DECODE\"\n  | \"QUOTE_STRUCTURE\"\n  | \"UNSUPPORTED_PLATFORM\"\n  | \"NONCE_MISMATCH\"\n  | \"NONCE_FIELD_MISMATCH\"\n  | \"PUBKEY_FIELD_MISMATCH\"\n  | \"CHANNEL_BINDING_MISMATCH\"\n  | \"BINARY_HASH_FORMAT\"\n  | \"BINARY_HASH_MISMATCH\"\n  | \"PCK_CHAIN_MISSING\"\n  | \"PCK_CHAIN_PARSE\"\n  | \"ROOT_FINGERPRINT_MISMATCH\"\n  | \"PCK_CHAIN_SIGNATURE\"\n  | \"DCAP_COLLATERAL_MISSING\"\n  | \"DCAP_COLLATERAL_PARSE\"\n  | \"DCAP_COLLATERAL_SIGNATURE\"\n  | \"DCAP_COLLATERAL_REVOKED\"\n  | \"TCB_STATUS_REJECTED\"\n  | \"QE_IDENTITY_REJECTED\"\n  | \"QUOTE_SIGNATURE\"\n  | \"QE_REPORT_BINDING\"\n  | \"QE_REPORT_SIGNATURE\"\n  | \"DEBUG_BIT_SET\"\n  | \"MODE_MISMATCH\"\n  | \"MRTD_MISMATCH\"\n  | \"RUNTIME_PROFILE_MISMATCH\"\n  | \"LOCAL_ATTESTATION_DISABLED\"\n  | \"MAA_TOKEN_MISSING\"\n  | \"MAA_TOKEN_PARSE\"\n  | \"MAA_TOKEN_EXPIRED\"\n  | \"MAA_TOKEN_SIGNATURE\"\n  | \"MAA_TRUST_POLICY_MISSING\"\n  | \"MAA_ISSUER_MISMATCH\"\n  | \"MAA_JWKS_MISMATCH\"\n  | \"MAA_POLICY_HASH_MISMATCH\"\n  | \"MAA_REPORTDATA_MISMATCH\"\n  | \"MAA_COMPLIANCE_MISMATCH\"\n  | \"MAA_DEBUG_BIT_SET\"\n  | \"TPM_QUOTE_MISSING\"\n  | \"TPM_QUOTE_SIGNATURE\"\n  | \"TPM_NONCE_MISMATCH\"\n  | \"HCL_KEYS_MISSING\"\n  | \"HCL_KEYS_PARSE\"\n  | \"HCL_KEYS_HASH_MISMATCH\";\n\n/** Map each reference reason to the closest SDK AttestationErrorCode. */\nconst REASON_TO_CODE: Record<RefReason, AttestationErrorCode> = {\n  // Structural / chain / quote-signature failures -> the cert-chain bucket.\n  QUOTE_DECODE: \"CERT_CHAIN_INVALID\",\n  QUOTE_STRUCTURE: \"CERT_CHAIN_INVALID\",\n  UNSUPPORTED_PLATFORM: \"CERT_CHAIN_INVALID\",\n  PCK_CHAIN_MISSING: \"CERT_CHAIN_INVALID\",\n  PCK_CHAIN_PARSE: \"CERT_CHAIN_INVALID\",\n  ROOT_FINGERPRINT_MISMATCH: \"CERT_CHAIN_INVALID\",\n  PCK_CHAIN_SIGNATURE: \"CERT_CHAIN_INVALID\",\n  DCAP_COLLATERAL_SIGNATURE: \"CERT_CHAIN_INVALID\",\n  DCAP_COLLATERAL_MISSING: \"TCB_REJECTED\",\n  DCAP_COLLATERAL_PARSE: \"TCB_REJECTED\",\n  DCAP_COLLATERAL_REVOKED: \"TCB_REJECTED\",\n  TCB_STATUS_REJECTED: \"TCB_REJECTED\",\n  QE_IDENTITY_REJECTED: \"TCB_REJECTED\",\n  QUOTE_SIGNATURE: \"CERT_CHAIN_INVALID\",\n  QE_REPORT_BINDING: \"CERT_CHAIN_INVALID\",\n  QE_REPORT_SIGNATURE: \"CERT_CHAIN_INVALID\",\n  // Freshness.\n  NONCE_MISMATCH: \"FRESHNESS_NONCE_MISMATCH\",\n  NONCE_FIELD_MISMATCH: \"FRESHNESS_NONCE_MISMATCH\",\n  TPM_NONCE_MISMATCH: \"AZURE_TPM_QUALIFYING_DATA_MISMATCH\",\n  // Noise channel binding (pubkey / report-data binding / bound JSON fields).\n  CHANNEL_BINDING_MISMATCH: \"NOISE_BINDING_MISMATCH\",\n  PUBKEY_FIELD_MISMATCH: \"NOISE_BINDING_MISMATCH\",\n  BINARY_HASH_FORMAT: \"NOISE_BINDING_MISMATCH\",\n  BINARY_HASH_MISMATCH: \"NOISE_BINDING_MISMATCH\",\n  // Debug bit.\n  DEBUG_BIT_SET: \"DEBUG_BIT_SET\",\n  MAA_DEBUG_BIT_SET: \"DEBUG_BIT_SET\",\n  // Mode / measurement pinning.\n  MODE_MISMATCH: \"MRTD_MISMATCH\",\n  MRTD_MISMATCH: \"MRTD_MISMATCH\",\n  RUNTIME_PROFILE_MISMATCH: \"RUNTIME_PROFILE_MISMATCH\",\n  // Local fallback disabled -> not attested.\n  LOCAL_ATTESTATION_DISABLED: \"NOT_ATTESTED\",\n  // Azure MAA token issuer / JWKS / policy / signature / compliance / binding.\n  MAA_TOKEN_MISSING: \"AZURE_MAA_JWKS_INVALID\",\n  MAA_TOKEN_PARSE: \"AZURE_MAA_JWKS_INVALID\",\n  MAA_TOKEN_EXPIRED: \"AZURE_MAA_JWKS_INVALID\",\n  MAA_TOKEN_SIGNATURE: \"AZURE_MAA_JWKS_INVALID\",\n  MAA_TRUST_POLICY_MISSING: \"AZURE_MAA_ISSUER_MISMATCH\",\n  MAA_ISSUER_MISMATCH: \"AZURE_MAA_ISSUER_MISMATCH\",\n  MAA_JWKS_MISMATCH: \"AZURE_MAA_JWKS_INVALID\",\n  MAA_POLICY_HASH_MISMATCH: \"AZURE_MAA_POLICY_HASH_MISMATCH\",\n  MAA_COMPLIANCE_MISMATCH: \"AZURE_MAA_NOT_COMPLIANT\",\n  MAA_REPORTDATA_MISMATCH: \"AZURE_MAA_DCAP_MISMATCH\",\n  // Azure HCL key blob hash binding.\n  HCL_KEYS_MISSING: \"AZURE_HCL_KEYS_MISMATCH\",\n  HCL_KEYS_HASH_MISMATCH: \"AZURE_HCL_KEYS_MISMATCH\",\n  HCL_KEYS_PARSE: \"AZURE_AK_PUB_INVALID\",\n  // Azure TPM AK quote.\n  TPM_QUOTE_MISSING: \"AZURE_TPM_AK_QUOTE_INVALID\",\n  TPM_QUOTE_SIGNATURE: \"AZURE_TPM_AK_QUOTE_INVALID\",\n};\n\n/** Build an SDK AttestationError, mapping the reference reason and prefixing it. */\nfunction err(reason: RefReason, message: string): AttestationError {\n  return new AttestationError(REASON_TO_CODE[reason], `[${reason}] ${message}`);\n}\n\n// ── TDX quote v4 layout (mirrors test-attest.py) ─────────────────────────────\n\n/** Length of one TDX measurement (SHA-384 digest). */\nconst MEASUREMENT_LEN = 48;\n\nconst HEADER_SIZE = 48;\nconst HEADER_VERSION_OFF = 0;\nconst HEADER_ATT_KEY_OFF = 2;\nconst HEADER_TEE_TYPE_OFF = 4;\n\nconst TDX_TEE_TYPE = 0x00000081;\nconst ECDSA_P256_KEY_TYPE = 2;\n\nconst BODY_OFFSET = 48;\nconst BODY_SIZE = 584;\n\nconst BODY_TEE_TCB_SVN_OFF = 0;\nconst BODY_MRSIGNERSEAM_OFF = 64;\nconst BODY_SEAM_ATTRIBUTES_OFF = 112;\nconst BODY_TD_ATTR_OFF = 120;\nconst BODY_MRTD_OFF = 136;\nconst BODY_RTMR0_OFF = 328;\nconst BODY_RTMR1_OFF = 376;\nconst BODY_RTMR2_OFF = 424;\nconst BODY_RTMR3_OFF = 472;\nconst BODY_REPORT_DATA_OFF = 520;\nconst BODY_REPORT_DATA_LEN = 64;\n\nconst SIG_DATA_LEN_OFFSET = BODY_OFFSET + BODY_SIZE; // u32 LE @ offset 632\n\n// Within ECDSA-P256 quote signature data\nconst SIG_QUOTE_SIG_OFF = 0; // 64 bytes (r || s) over header+body\nconst SIG_ATT_KEY_OFF = 64; // 64 bytes raw P-256 (X || Y), no 0x04 prefix\nconst SIG_QE_CERT_DATA_OFF = 128; // QE Certification Data - Version 4 (type+size+data)\nconst SIG_QE_CERT_DATA_HEADER_SIZE = 6; // uint16 type + uint32 size\nconst SIG_QE_REPORT_SIZE = 384; // Intel TDX DCAP Quote Library API, A.3.11\nconst SIG_QE_REPORT_SIG_SIZE = 64; // ECDSA-P256 over QE report\n\n// SGX report body (384 bytes) - REPORT_DATA is at offset 320, 64 bytes\nconst SGX_REPORT_MISCSELECT_OFF = 16;\nconst SGX_REPORT_ATTRIBUTES_OFF = 48;\nconst SGX_REPORT_MRSIGNER_OFF = 128;\nconst SGX_REPORT_ISV_PROD_ID_OFF = 256;\nconst SGX_REPORT_ISV_SVN_OFF = 258;\nconst SGX_REPORT_DATA_OFF = 320;\n\nconst QE_CERT_TYPE_PCK_CHAIN = 5;\nconst QE_CERT_TYPE_QE_REPORT_CERT_DATA = 6;\n\nconst INTEL_PCK_SGX_EXTENSIONS_OID = \"1.2.840.113741.1.13.1\";\nconst INTEL_PCK_EXTENSION_TCB_OID = \"1.2.840.113741.1.13.1.2\";\nconst INTEL_PCK_EXTENSION_PCE_ID_OID = \"1.2.840.113741.1.13.1.3\";\nconst INTEL_PCK_EXTENSION_FMSPC_OID = \"1.2.840.113741.1.13.1.4\";\nconst INTEL_PCK_EXTENSION_PCESVN_OID = \"1.2.840.113741.1.13.1.2.17\";\nconst INTEL_PCK_EXTENSION_CPUSVN_OID = \"1.2.840.113741.1.13.1.2.18\";\nconst INTEL_PCK_EXTENSION_SGX_TCB_COMPONENT_OID_PREFIX = \"1.2.840.113741.1.13.1.2.\";\nconst INTEL_TCB_SIGNING_SUBJECT =\n  \"CN=Intel SGX TCB Signing, O=Intel Corporation, L=Santa Clara, ST=CA, C=US\";\nconst TEST_TCB_SIGNING_SUBJECT = \"CN=Test SGX and TDX TCB Signing\";\n\nconst ACCEPTED_TCB_STATUSES = new Set([\"UpToDate\"]);\nconst ACCEPTED_TDX_MODULE_STATUSES = new Set([\"UpToDate\"]);\nconst ACCEPTED_QE_IDENTITY_STATUSES = new Set([\"UpToDate\"]);\n\n// ── Main entry point ─────────────────────────────────────────────────────────\n\nexport async function verifyAttestation(params: {\n  response: AttestResponse;\n  expectedNonce: Uint8Array; // 32 bytes the client sent\n  expectedNoiseStaticPub: Uint8Array; // 32 bytes seen in readMessage2\n  policy: AttestationPolicy;\n  timeoutMs?: number;\n}): Promise<AttestedMetadata> {\n  const { response, expectedNonce, expectedNoiseStaticPub, policy, timeoutMs } = params;\n\n  if (\n    policy.expectedRuntimeProfile !== undefined &&\n    response.runtime_profile !== policy.expectedRuntimeProfile\n  ) {\n    throw err(\n      \"RUNTIME_PROFILE_MISMATCH\",\n      `runtime profile ${String(response.runtime_profile)} does not match the approved release profile ${policy.expectedRuntimeProfile}`,\n    );\n  }\n\n  if (response.local_attestation === true) {\n    return verifyLocalAttestation({\n      response,\n      expectedNonce,\n      expectedNoiseStaticPub,\n      policy,\n    });\n  }\n\n  // 0. Decode and unpack\n  const raw = decodeQuoteB64(response.quote);\n  ensureStructure(raw);\n\n  // 1. Platform dispatch. Azure DCAP REPORTDATA[0:32] = SHA-256(hcl_keys_json),\n  // set by the Azure hypervisor. Nonce+pubkey binding is proven via the TPM AK\n  // quote; MRTD and compliance status via the MAA JWT.\n  if (response.platform === \"azure-tdx-dcap\") {\n    return verifyAzureTdxAttestation({\n      raw,\n      response,\n      expectedNonce,\n      expectedNoiseStaticPub,\n      policy,\n      timeoutMs,\n    });\n  }\n  if (response.platform && response.platform !== \"tdx-dcap\") {\n    throw err(\n      \"UNSUPPORTED_PLATFORM\",\n      `attestation not supported for platform \"${response.platform}\"`,\n    );\n  }\n\n  return verifyGcpTdxAttestation({\n    raw,\n    response,\n    expectedNonce,\n    expectedNoiseStaticPub,\n    policy,\n  });\n}\n\nasync function verifyGcpTdxAttestation(params: {\n  raw: Uint8Array;\n  response: AttestResponse;\n  expectedNonce: Uint8Array;\n  expectedNoiseStaticPub: Uint8Array;\n  policy: AttestationPolicy;\n}): Promise<AttestedMetadata> {\n  const { raw, response, expectedNonce, expectedNoiseStaticPub, policy } = params;\n\n  const body = raw.subarray(BODY_OFFSET, BODY_OFFSET + BODY_SIZE);\n  const reportData = body.subarray(\n    BODY_REPORT_DATA_OFF,\n    BODY_REPORT_DATA_OFF + BODY_REPORT_DATA_LEN,\n  );\n\n  // 2. Freshness\n  if (!constantTimeEq(reportData.subarray(0, 32), expectedNonce)) {\n    throw err(\n      \"NONCE_MISMATCH\",\n      \"REPORT_DATA[0:32] does not match verifier nonce - possible replay\",\n    );\n  }\n  // The quote is the cryptographic source of truth for freshness, but the JSON\n  // `nonce` field is still checked to keep the API contract honest and fail fast\n  // on malformed or mismatched responses.\n  if (response.nonce.toLowerCase() !== bytesToHex(expectedNonce)) {\n    throw err(\"NONCE_FIELD_MISMATCH\", `JSON nonce ${response.nonce} does not match verifier nonce`);\n  }\n\n  // 3. Channel binding (REPORT_DATA[32:64] and JSON pubkey field both)\n  if (!constantTimeEq(reportData.subarray(32, 64), expectedNoiseStaticPub)) {\n    throw err(\n      \"CHANNEL_BINDING_MISMATCH\",\n      \"REPORT_DATA[32:64] does not match Noise static pubkey from handshake\",\n    );\n  }\n  const expectedPubHex = bytesToHex(expectedNoiseStaticPub);\n  if (response.pubkey.toLowerCase() !== expectedPubHex) {\n    throw err(\n      \"PUBKEY_FIELD_MISMATCH\",\n      \"attestation pubkey field does not match Noise static pubkey from handshake\",\n    );\n  }\n\n  // 4. Binary hash sanity (32-byte hex). Azure binds it again in TPM\n  // qualifying data below; the GCP quote does not currently measure userspace.\n  if (!/^[0-9a-f]{64}$/i.test(response.binary_hash)) {\n    throw err(\"BINARY_HASH_FORMAT\", \"binary_hash field is not a 32-byte hex digest\");\n  }\n  if (\n    policy.expectedBinaryHash !== undefined &&\n    response.binary_hash.toLowerCase() !== policy.expectedBinaryHash.toLowerCase()\n  ) {\n    throw err(\n      \"BINARY_HASH_MISMATCH\",\n      `binary hash ${response.binary_hash.toLowerCase()} does not match the approved release pin`,\n    );\n  }\n\n  // 5. Quote, PCK chain, PCK CRL, TCB Info, and TD QE Identity.\n  await verifyDcapQuoteAndCollateral({ raw, body, response, policy });\n\n  // 6. TD_ATTRIBUTES DEBUG bit must be cleared. Bit 0 of byte 0 at offset 120:\n  // when set, the host can inspect guest memory; a debuggable TD offers no\n  // confidentiality, so any quote with DEBUG=1 is refused.\n  assertDebugBitClear(body);\n\n  // 7. MRTD pinning. Dev is intentionally unpinned (the coordinator image\n  // rotates during iteration). Prod must compare against a release pin.\n  const measurements = parseMeasurements(body);\n  if (policy.requiredMode !== undefined && response.mode !== policy.requiredMode) {\n    throw err(\n      \"MODE_MISMATCH\",\n      `attestation mode ${response.mode} does not match required ${policy.requiredMode}`,\n    );\n  }\n\n  if (response.mode === \"prod\") {\n    if (\n      (policy.expectedMrtd === undefined || policy.expectedMrtd === null) &&\n      policy.allowUnpinnedProdMrtdForRelease !== true\n    ) {\n      throw err(\n        \"MRTD_MISMATCH\",\n        \"production attestation requires a pinned MRTD but none was configured\",\n      );\n    }\n\n    if (\n      policy.expectedMrtd !== undefined &&\n      policy.expectedMrtd !== null &&\n      measurements.mrtd !== policy.expectedMrtd.toLowerCase()\n    ) {\n      throw err(\n        \"MRTD_MISMATCH\",\n        `MRTD ${measurements.mrtd} does not match pinned ${policy.expectedMrtd.toLowerCase()}`,\n      );\n    }\n  }\n\n  return {\n    mode: response.mode,\n    binaryHash: response.binary_hash,\n    runtimeProfile: response.runtime_profile,\n    mrtd: measurements.mrtd,\n    rtmr0: measurements.rtmr0,\n    rtmr1: measurements.rtmr1,\n    rtmr2: measurements.rtmr2,\n    rtmr3: measurements.rtmr3,\n    pubkeyHex: response.pubkey.toLowerCase(),\n    localAttestation: false,\n  };\n}\n\n// ── DCAP quote collateral ────────────────────────────────────────────────────\n\nasync function verifyDcapQuoteAndCollateral(params: {\n  raw: Uint8Array;\n  body: Uint8Array;\n  response: AttestResponse;\n  policy: AttestationPolicy;\n}): Promise<void> {\n  const { raw, body, response, policy } = params;\n\n  const sigData = readSigData(raw);\n  const qeCertData = parseQeCertificationData(sigData);\n  const pckChain = extractPckChain(qeCertData.qeCertificationData);\n\n  const expectedRootFp =\n    policy.intelRootFingerprint?.toLowerCase() ?? INTEL_SGX_ROOT_CA_FINGERPRINT_SHA256;\n  const rootFp = await sha256Hex(new Uint8Array(pckChain[pckChain.length - 1].rawData));\n  if (rootFp !== expectedRootFp) {\n    throw err(\n      \"ROOT_FINGERPRINT_MISMATCH\",\n      `PCK root fingerprint ${rootFp} does not match pinned ${expectedRootFp}`,\n    );\n  }\n\n  await verifyChainSignatures(pckChain);\n\n  const quoteSig = sigData.subarray(SIG_QUOTE_SIG_OFF, SIG_QUOTE_SIG_OFF + 64);\n  const attKey = sigData.subarray(SIG_ATT_KEY_OFF, SIG_ATT_KEY_OFF + 64);\n  const headerAndBody = raw.subarray(0, BODY_OFFSET + BODY_SIZE);\n  await verifyP256Signature(\n    rawXyToSpki(attKey),\n    quoteSig,\n    headerAndBody,\n    \"QUOTE_SIGNATURE\",\n    \"quote header||body signature\",\n  );\n\n  const { qeReport, qeReportSig, qeAuthData } = qeCertData;\n  const expectedBinding = await sha256(concat(attKey, qeAuthData));\n  const qeReportData = qeReport.subarray(SGX_REPORT_DATA_OFF, SGX_REPORT_DATA_OFF + 32);\n  if (!constantTimeEq(qeReportData, expectedBinding)) {\n    throw err(\n      \"QE_REPORT_BINDING\",\n      \"QE report does not bind the in-quote attestation key (REPORT_DATA mismatch)\",\n    );\n  }\n\n  const pckLeafSpki = await leafSpki(pckChain[0]);\n  await verifyP256Signature(\n    pckLeafSpki,\n    qeReportSig,\n    qeReport,\n    \"QE_REPORT_SIGNATURE\",\n    \"QE report signature\",\n  );\n\n  await verifyDcapCollateral({\n    collateral: response.dcap_collateral,\n    pckChain,\n    body,\n    qeReport,\n    mode: response.mode,\n    policy,\n  });\n}\n\nasync function verifyDcapCollateral(params: {\n  collateral: DcapCollateral | undefined;\n  pckChain: x509.X509Certificate[];\n  body: Uint8Array;\n  qeReport: Uint8Array;\n  mode: AttestResponse[\"mode\"];\n  policy: AttestationPolicy;\n}): Promise<void> {\n  const { collateral, pckChain, body, qeReport, mode, policy } = params;\n  if (!collateral) {\n    if (\n      policy.allowMissingDcapCollateral === true &&\n      mode === \"dev\" &&\n      policy.requiredMode === \"dev\"\n    ) {\n      return;\n    }\n    throw err(\"DCAP_COLLATERAL_MISSING\", \"TDX quote is missing Intel DCAP collateral\");\n  }\n\n  const now = new Date();\n  const rootCert = pckChain[pckChain.length - 1];\n  const rootCrl = parseCrl(collateral.rootCaCrlPem, \"root_ca_crl\");\n  await verifyCrl(rootCrl, rootCert, \"root_ca_crl\", now);\n\n  const pckCrlIssuerChain = await verifyCollateralIssuerChain(\n    parsePemCertificateChain(collateral.pckCrlIssuerChainPem, \"pck_crl_issuer_chain\", 2),\n    policy,\n    \"pck_crl_issuer_chain\",\n  );\n  await assertNotRevokedByRoot(rootCrl, pckCrlIssuerChain[0], \"PCK CRL issuer\");\n  await assertSameCertificate(pckCrlIssuerChain[0], pckChain[1], \"PCK CRL issuer\");\n\n  const pckCrl = parseCrl(collateral.pckCrlPem, \"pck_crl\");\n  await verifyCrl(pckCrl, pckCrlIssuerChain[0], \"pck_crl\", now);\n  if (pckCrl.findRevoked(pckChain[0])) {\n    throw err(\"DCAP_COLLATERAL_REVOKED\", \"PCK leaf certificate is revoked by PCK CRL\");\n  }\n\n  const tcbInfo = await verifySignedDcapJson<ParsedTcbInfo>({\n    signed: collateral.tcbInfo,\n    wrapperField: \"tcbInfo\",\n    policy,\n    rootCrl,\n    label: \"tcb_info\",\n  });\n\n  const qeIdentity = await verifySignedDcapJson<ParsedQeIdentity>({\n    signed: collateral.qeIdentity,\n    wrapperField: \"enclaveIdentity\",\n    policy,\n    rootCrl,\n    label: \"qe_identity\",\n  });\n  assertMatchingTcbEvaluationDataNumber(tcbInfo, qeIdentity);\n  verifyTcbInfo(tcbInfo, pckChain[0], body, now);\n  verifyQeIdentity(qeIdentity, qeReport, now);\n}\n\nfunction assertDebugBitClear(body: Uint8Array): void {\n  if ((body[BODY_TD_ATTR_OFF] & 0x01) !== 0) {\n    throw err(\"DEBUG_BIT_SET\", \"TD_ATTRIBUTES DEBUG bit set - refusing to attest a debuggable TD\");\n  }\n}\n\ntype ParsedTcbInfo = {\n  id?: unknown;\n  version?: unknown;\n  issueDate?: unknown;\n  nextUpdate?: unknown;\n  fmspc?: unknown;\n  pceId?: unknown;\n  tcbType?: unknown;\n  tcbEvaluationDataNumber?: unknown;\n  tcbLevels?: unknown;\n  tdxModule?: unknown;\n  tdxModuleIdentities?: unknown;\n};\n\ntype ParsedQeIdentity = {\n  id?: unknown;\n  version?: unknown;\n  issueDate?: unknown;\n  nextUpdate?: unknown;\n  miscselect?: unknown;\n  miscselectMask?: unknown;\n  attributes?: unknown;\n  attributesMask?: unknown;\n  mrsigner?: unknown;\n  isvprodid?: unknown;\n  tcbEvaluationDataNumber?: unknown;\n  tcbLevels?: unknown;\n};\n\nasync function verifySignedDcapJson<T extends Record<string, unknown>>(params: {\n  signed: SignedDcapJson;\n  wrapperField: \"tcbInfo\" | \"enclaveIdentity\";\n  policy: AttestationPolicy;\n  rootCrl: x509.X509Crl;\n  label: string;\n}): Promise<T> {\n  const { signed, wrapperField, policy, rootCrl, label } = params;\n  if (\n    !signed ||\n    typeof signed.body !== \"string\" ||\n    typeof signed.signature !== \"string\" ||\n    typeof signed.issuerChainPem !== \"string\"\n  ) {\n    throw err(\"DCAP_COLLATERAL_MISSING\", `${label} collateral is incomplete`);\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(signed.body);\n  } catch (e) {\n    throw err(\"DCAP_COLLATERAL_PARSE\", `${label} body is not valid JSON: ${e}`);\n  }\n\n  const signedBody = exactSignedDcapJsonBody(signed.body, parsed, wrapperField, label);\n  const body = signedBody.parsed;\n  if (!body || typeof body !== \"object\" || Array.isArray(body)) {\n    throw err(\"DCAP_COLLATERAL_PARSE\", `${label} body is not a JSON object`);\n  }\n\n  const issuerChain = await verifyCollateralIssuerChain(\n    parsePemCertificateChain(signed.issuerChainPem, `${label}_issuer_chain`, 2),\n    policy,\n    `${label}_issuer_chain`,\n  );\n  await assertNotRevokedByRoot(rootCrl, issuerChain[0], `${label} signing certificate`);\n  assertDcapJsonSignerIdentity(issuerChain[0], issuerChain[issuerChain.length - 1], policy, label);\n\n  if (!/^[0-9a-f]{128}$/i.test(signed.signature)) {\n    throw err(\"DCAP_COLLATERAL_PARSE\", `${label} signature is not a 64-byte hex ECDSA signature`);\n  }\n  await verifyP256Signature(\n    await leafSpki(issuerChain[0]),\n    hexToBytes(signed.signature),\n    new TextEncoder().encode(signedBody.body),\n    \"DCAP_COLLATERAL_SIGNATURE\",\n    `${label} signature`,\n  );\n\n  return body as T;\n}\n\nfunction exactSignedDcapJsonBody(\n  raw: string,\n  parsed: unknown,\n  wrapperField: \"tcbInfo\" | \"enclaveIdentity\",\n  label: string,\n): { body: string; parsed: unknown } {\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    return { body: raw, parsed };\n  }\n  if (!(wrapperField in parsed)) {\n    return { body: raw, parsed };\n  }\n  const body = extractTopLevelJsonProperty(raw, wrapperField);\n  if (body === null) {\n    throw err(\n      \"DCAP_COLLATERAL_PARSE\",\n      `${label} PCS wrapper contains ${wrapperField} but exact signed body bytes could not be extracted`,\n    );\n  }\n  try {\n    return { body, parsed: JSON.parse(body) };\n  } catch (e) {\n    throw err(\"DCAP_COLLATERAL_PARSE\", `${label} exact signed body is not valid JSON: ${e}`);\n  }\n}\n\nfunction extractTopLevelJsonProperty(raw: string, property: string): string | null {\n  let offset = skipJsonWhitespace(raw, 0);\n  if (raw[offset] !== \"{\") return null;\n  offset++;\n\n  while (offset < raw.length) {\n    offset = skipJsonWhitespace(raw, offset);\n    if (raw[offset] === \"}\") return null;\n    if (raw[offset] === \",\") {\n      offset++;\n      continue;\n    }\n    const key = readJsonString(raw, offset);\n    if (key === null) return null;\n    offset = skipJsonWhitespace(raw, key.end);\n    if (raw[offset] !== \":\") return null;\n    offset = skipJsonWhitespace(raw, offset + 1);\n    const valueStart = offset;\n    const valueEnd = findJsonValueEnd(raw, valueStart);\n    if (valueEnd === null) return null;\n    if (key.value === property) return raw.slice(valueStart, valueEnd);\n    offset = valueEnd;\n  }\n\n  return null;\n}\n\nfunction skipJsonWhitespace(raw: string, offset: number): number {\n  while (offset < raw.length && /[\\t\\n\\r ]/u.test(raw[offset]!)) offset++;\n  return offset;\n}\n\nfunction readJsonString(raw: string, offset: number): { value: string; end: number } | null {\n  if (raw[offset] !== '\"') return null;\n  let cursor = offset + 1;\n  let escaped = false;\n  while (cursor < raw.length) {\n    const char = raw[cursor]!;\n    if (escaped) {\n      escaped = false;\n    } else if (char === \"\\\\\") {\n      escaped = true;\n    } else if (char === '\"') {\n      const token = raw.slice(offset, cursor + 1);\n      try {\n        return { value: JSON.parse(token) as string, end: cursor + 1 };\n      } catch {\n        return null;\n      }\n    }\n    cursor++;\n  }\n  return null;\n}\n\nfunction findJsonValueEnd(raw: string, offset: number): number | null {\n  if (offset >= raw.length) return null;\n  if (raw[offset] === '\"') return readJsonString(raw, offset)?.end ?? null;\n  if (raw[offset] === \"{\" || raw[offset] === \"[\") {\n    const stack = [raw[offset]];\n    let cursor = offset + 1;\n    while (cursor < raw.length) {\n      const char = raw[cursor]!;\n      if (char === '\"') {\n        const stringToken = readJsonString(raw, cursor);\n        if (stringToken === null) return null;\n        cursor = stringToken.end;\n        continue;\n      }\n      if (char === \"{\" || char === \"[\") {\n        stack.push(char);\n      } else if (char === \"}\" || char === \"]\") {\n        const open = stack.pop();\n        if ((char === \"}\" && open !== \"{\") || (char === \"]\" && open !== \"[\")) return null;\n        if (stack.length === 0) return cursor + 1;\n      }\n      cursor++;\n    }\n    return null;\n  }\n\n  let cursor = offset;\n  while (cursor < raw.length && !/[\\t\\n\\r ,}\\]]/u.test(raw[cursor]!)) cursor++;\n  return cursor > offset ? cursor : null;\n}\n\nfunction assertMatchingTcbEvaluationDataNumber(\n  tcbInfo: ParsedTcbInfo,\n  qeIdentity: ParsedQeIdentity,\n): void {\n  const tcbNumber = tcbInfo.tcbEvaluationDataNumber;\n  const qeNumber = qeIdentity.tcbEvaluationDataNumber;\n  if (!isTcbEvaluationDataNumber(tcbNumber) || !isTcbEvaluationDataNumber(qeNumber)) {\n    throw err(\n      \"TCB_STATUS_REJECTED\",\n      \"TCB Info and QE Identity must include valid tcbEvaluationDataNumber values\",\n    );\n  }\n  if (tcbNumber !== qeNumber) {\n    throw err(\n      \"TCB_STATUS_REJECTED\",\n      `TCB Info tcbEvaluationDataNumber ${tcbNumber} does not match QE Identity ${qeNumber}`,\n    );\n  }\n}\n\nfunction isTcbEvaluationDataNumber(value: unknown): value is number {\n  return typeof value === \"number\" && Number.isSafeInteger(value) && value >= 0;\n}\n\nasync function verifyCollateralIssuerChain(\n  certs: x509.X509Certificate[],\n  policy: AttestationPolicy,\n  label: string,\n): Promise<x509.X509Certificate[]> {\n  const candidates = [certs, [...certs].reverse()];\n  let lastError: unknown;\n  for (const chain of candidates) {\n    try {\n      const rootFp = await sha256Hex(new Uint8Array(chain[chain.length - 1].rawData));\n      const expectedRootFp =\n        policy.intelRootFingerprint?.toLowerCase() ?? INTEL_SGX_ROOT_CA_FINGERPRINT_SHA256;\n      if (rootFp !== expectedRootFp) {\n        throw err(\n          \"ROOT_FINGERPRINT_MISMATCH\",\n          `${label} root fingerprint ${rootFp} does not match pinned ${expectedRootFp}`,\n        );\n      }\n      await verifyChainSignatures(chain);\n      return chain;\n    } catch (e) {\n      lastError = e;\n    }\n  }\n  if (lastError instanceof AttestationError) throw lastError;\n  throw err(\"DCAP_COLLATERAL_SIGNATURE\", `${label} certificate chain failed verification`);\n}\n\nfunction assertDcapJsonSignerIdentity(\n  leaf: x509.X509Certificate,\n  root: x509.X509Certificate,\n  policy: AttestationPolicy,\n  label: string,\n): void {\n  const expectedRootFp =\n    policy.intelRootFingerprint?.toLowerCase() ?? INTEL_SGX_ROOT_CA_FINGERPRINT_SHA256;\n  const allowsSyntheticRoot = expectedRootFp !== INTEL_SGX_ROOT_CA_FINGERPRINT_SHA256;\n  const allowedSubjects = allowsSyntheticRoot\n    ? [INTEL_TCB_SIGNING_SUBJECT, TEST_TCB_SIGNING_SUBJECT]\n    : [INTEL_TCB_SIGNING_SUBJECT];\n\n  if (!allowedSubjects.includes(leaf.subject)) {\n    throw err(\n      \"DCAP_COLLATERAL_SIGNATURE\",\n      `${label} signing certificate subject ${leaf.subject} is not an Intel PCS TCB signing identity`,\n    );\n  }\n  if (leaf.issuer !== root.subject) {\n    throw err(\n      \"DCAP_COLLATERAL_SIGNATURE\",\n      `${label} signing certificate issuer ${leaf.issuer} does not match root ${root.subject}`,\n    );\n  }\n  const basicConstraints = leaf.getExtension(x509.BasicConstraintsExtension);\n  if (basicConstraints?.ca) {\n    throw err(\"DCAP_COLLATERAL_SIGNATURE\", `${label} signing certificate must not be a CA`);\n  }\n}\n\nfunction verifyTcbInfo(\n  tcbInfo: ParsedTcbInfo,\n  pckLeaf: x509.X509Certificate,\n  body: Uint8Array,\n  now: Date,\n): void {\n  if (tcbInfo.id !== \"TDX\") {\n    throw err(\"TCB_STATUS_REJECTED\", `TCB Info id ${String(tcbInfo.id)} is not TDX`);\n  }\n  if (tcbInfo.version !== 3 || tcbInfo.tcbType !== 0) {\n    throw err(\n      \"TCB_STATUS_REJECTED\",\n      `unsupported TCB Info version=${String(tcbInfo.version)} tcbType=${String(tcbInfo.tcbType)}`,\n    );\n  }\n  assertFreshDcapJsonWindow(tcbInfo, \"TCB Info\", now);\n\n  const pckTcb = extractPckTcb(pckLeaf);\n  if (typeof tcbInfo.fmspc !== \"string\" || tcbInfo.fmspc.toLowerCase() !== pckTcb.fmspc) {\n    throw err(\n      \"TCB_STATUS_REJECTED\",\n      `TCB Info FMSPC ${String(tcbInfo.fmspc)} does not match PCK FMSPC ${pckTcb.fmspc}`,\n    );\n  }\n  if (typeof tcbInfo.pceId !== \"string\" || tcbInfo.pceId.toLowerCase() !== pckTcb.pceId) {\n    throw err(\n      \"TCB_STATUS_REJECTED\",\n      `TCB Info PCE ID ${String(tcbInfo.pceId)} does not match PCK PCE ID ${pckTcb.pceId}`,\n    );\n  }\n\n  if (!Array.isArray(tcbInfo.tcbLevels)) {\n    throw err(\"TCB_STATUS_REJECTED\", \"TCB Info has no tcbLevels array\");\n  }\n  const teeTcbSvn = body.subarray(BODY_TEE_TCB_SVN_OFF, BODY_TEE_TCB_SVN_OFF + 16);\n  const matched = tcbInfo.tcbLevels.find((level) => tdxTcbLevelMatches(level, pckTcb, teeTcbSvn));\n  if (!matched || typeof matched !== \"object\") {\n    throw err(\"TCB_STATUS_REJECTED\", \"no TCB Info level matches PCK SGX TCB and quote TEE_TCB_SVN\");\n  }\n  const status = (matched as Record<string, unknown>)[\"tcbStatus\"];\n  if (typeof status !== \"string\" || !ACCEPTED_TCB_STATUSES.has(status)) {\n    throw err(\"TCB_STATUS_REJECTED\", `TCB status ${String(status)} is not accepted`);\n  }\n  verifyTdxModuleIdentity(tcbInfo, body, teeTcbSvn);\n}\n\nfunction verifyQeIdentity(identity: ParsedQeIdentity, qeReport: Uint8Array, now: Date): void {\n  if (identity.id !== \"TD_QE\") {\n    throw err(\"QE_IDENTITY_REJECTED\", `QE Identity id ${String(identity.id)} is not TD_QE`);\n  }\n  if (identity.version !== 2) {\n    throw err(\n      \"QE_IDENTITY_REJECTED\",\n      `unsupported QE Identity version ${String(identity.version)}`,\n    );\n  }\n  assertFreshDcapJsonWindow(identity, \"QE Identity\", now);\n\n  assertMaskedHexMatches({\n    actual: qeReport.subarray(SGX_REPORT_MISCSELECT_OFF, SGX_REPORT_MISCSELECT_OFF + 4),\n    expectedHex: identity.miscselect,\n    maskHex: identity.miscselectMask,\n    label: \"QE Identity MISCSELECT\",\n    reason: \"QE_IDENTITY_REJECTED\",\n  });\n  assertMaskedHexMatches({\n    actual: qeReport.subarray(SGX_REPORT_ATTRIBUTES_OFF, SGX_REPORT_ATTRIBUTES_OFF + 16),\n    expectedHex: identity.attributes,\n    maskHex: identity.attributesMask,\n    label: \"QE Identity ATTRIBUTES\",\n    reason: \"QE_IDENTITY_REJECTED\",\n  });\n\n  const expectedMrSigner = bytesToHex(\n    qeReport.subarray(SGX_REPORT_MRSIGNER_OFF, SGX_REPORT_MRSIGNER_OFF + 32),\n  );\n  if (\n    typeof identity.mrsigner !== \"string\" ||\n    identity.mrsigner.toLowerCase() !== expectedMrSigner\n  ) {\n    throw err(\n      \"QE_IDENTITY_REJECTED\",\n      `QE Identity MRSIGNER ${String(identity.mrsigner)} does not match QE report ${expectedMrSigner}`,\n    );\n  }\n  const isvProdId = readU16LE(qeReport, SGX_REPORT_ISV_PROD_ID_OFF);\n  if (identity.isvprodid !== isvProdId) {\n    throw err(\n      \"QE_IDENTITY_REJECTED\",\n      `QE Identity ISVProdID ${String(identity.isvprodid)} does not match QE report ${isvProdId}`,\n    );\n  }\n\n  if (!Array.isArray(identity.tcbLevels)) {\n    throw err(\"QE_IDENTITY_REJECTED\", \"QE Identity has no tcbLevels array\");\n  }\n  const isvSvn = readU16LE(qeReport, SGX_REPORT_ISV_SVN_OFF);\n  const matched = identity.tcbLevels.find((level) => qeIdentityLevelMatches(level, isvSvn));\n  if (!matched || typeof matched !== \"object\") {\n    throw err(\"QE_IDENTITY_REJECTED\", \"no QE Identity level matches QE report ISVSVN\");\n  }\n  const status = (matched as Record<string, unknown>)[\"tcbStatus\"];\n  if (typeof status !== \"string\" || !ACCEPTED_QE_IDENTITY_STATUSES.has(status)) {\n    throw err(\"QE_IDENTITY_REJECTED\", `QE Identity status ${String(status)} is not accepted`);\n  }\n}\n\ntype PckTcb = {\n  fmspc: string;\n  pceId: string;\n  sgxTcbSvns: number[];\n  pceSvn: number;\n  cpuSvn: Uint8Array;\n};\n\nfunction tdxTcbLevelMatches(level: unknown, pckTcb: PckTcb, teeTcbSvn: Uint8Array): boolean {\n  if (!level || typeof level !== \"object\") return false;\n  const tcb = (level as Record<string, unknown>)[\"tcb\"];\n  if (!tcb || typeof tcb !== \"object\") return false;\n  const record = tcb as Record<string, unknown>;\n  const sgxComponents = record[\"sgxtcbcomponents\"];\n  if (!tcbComponentsMatch(sgxComponents, pckTcb.sgxTcbSvns, 0)) return false;\n  const pceSvn = record[\"pcesvn\"];\n  if (typeof pceSvn !== \"number\" || pckTcb.pceSvn < pceSvn) return false;\n  const tdxComponents = record[\"tdxtcbcomponents\"];\n  const tdxStartIndex = teeTcbSvn[1] === 0 ? 0 : 2;\n  return tcbComponentsMatch(tdxComponents, Array.from(teeTcbSvn), tdxStartIndex);\n}\n\nfunction tcbComponentsMatch(\n  components: unknown,\n  actualSvns: ArrayLike<number>,\n  startIndex: number,\n): boolean {\n  if (!Array.isArray(components) || components.length < 16) return false;\n  for (let index = startIndex; index < 16; index++) {\n    const component = components[index];\n    if (!component || typeof component !== \"object\") return false;\n    const svn = (component as Record<string, unknown>)[\"svn\"];\n    if (typeof svn !== \"number\" || actualSvns[index] < svn) return false;\n  }\n  return true;\n}\n\nfunction verifyTdxModuleIdentity(\n  tcbInfo: ParsedTcbInfo,\n  body: Uint8Array,\n  teeTcbSvn: Uint8Array,\n): void {\n  const moduleVersion = teeTcbSvn[1];\n  const identity = getTdxModuleIdentity(tcbInfo, moduleVersion);\n  const expectedMrSigner = bytesToHex(\n    body.subarray(BODY_MRSIGNERSEAM_OFF, BODY_MRSIGNERSEAM_OFF + 48),\n  );\n  if (\n    typeof identity[\"mrsigner\"] !== \"string\" ||\n    identity[\"mrsigner\"].toLowerCase() !== expectedMrSigner\n  ) {\n    throw err(\n      \"TCB_STATUS_REJECTED\",\n      `TDX Module Identity MRSIGNER ${String(identity[\"mrsigner\"])} does not match quote ${expectedMrSigner}`,\n    );\n  }\n  assertMaskedHexMatches({\n    actual: body.subarray(BODY_SEAM_ATTRIBUTES_OFF, BODY_SEAM_ATTRIBUTES_OFF + 8),\n    expectedHex: identity[\"attributes\"],\n    maskHex: identity[\"attributesMask\"],\n    label: \"TDX Module Identity ATTRIBUTES\",\n    reason: \"TCB_STATUS_REJECTED\",\n  });\n  if (moduleVersion < 1) return;\n\n  const tcbLevels = identity[\"tcbLevels\"];\n  if (!Array.isArray(tcbLevels)) {\n    throw err(\"TCB_STATUS_REJECTED\", \"TDX Module Identity has no tcbLevels array\");\n  }\n  const matched = tcbLevels.find((level) => tdxModuleTcbLevelMatches(level, teeTcbSvn[0]));\n  if (!matched || typeof matched !== \"object\") {\n    throw err(\"TCB_STATUS_REJECTED\", \"no TDX Module Identity level matches TEE_TCB_SVN ISVSVN\");\n  }\n  const status = (matched as Record<string, unknown>)[\"tcbStatus\"];\n  if (typeof status !== \"string\" || !ACCEPTED_TDX_MODULE_STATUSES.has(status)) {\n    throw err(\"TCB_STATUS_REJECTED\", `TDX Module status ${String(status)} is not accepted`);\n  }\n}\n\nfunction getTdxModuleIdentity(\n  tcbInfo: ParsedTcbInfo,\n  moduleVersion: number,\n): Record<string, unknown> {\n  if (moduleVersion < 1) {\n    const module = tcbInfo.tdxModule;\n    if (!module || typeof module !== \"object\" || Array.isArray(module)) {\n      throw err(\"TCB_STATUS_REJECTED\", \"TCB Info has no tdxModule object\");\n    }\n    return module as Record<string, unknown>;\n  }\n\n  const identities = tcbInfo.tdxModuleIdentities;\n  if (!Array.isArray(identities)) {\n    throw err(\"TCB_STATUS_REJECTED\", \"TCB Info has no tdxModuleIdentities array\");\n  }\n  const moduleIdentity = identities.find((candidate) => {\n    if (!candidate || typeof candidate !== \"object\" || Array.isArray(candidate)) return false;\n    const id = (candidate as Record<string, unknown>)[\"id\"];\n    return typeof id === \"string\" && tdxModuleIdMatches(id, moduleVersion);\n  });\n  if (!moduleIdentity || typeof moduleIdentity !== \"object\") {\n    throw err(\n      \"TCB_STATUS_REJECTED\",\n      `no TDX Module Identity matches TEE_TCB_SVN module version ${moduleVersion}`,\n    );\n  }\n  return moduleIdentity as Record<string, unknown>;\n}\n\nfunction tdxModuleIdMatches(id: string, moduleVersion: number): boolean {\n  const match = /^TDX_(\\d+)$/.exec(id);\n  return match !== null && Number.parseInt(match[1], 10) === moduleVersion;\n}\n\nfunction tdxModuleTcbLevelMatches(level: unknown, isvSvn: number): boolean {\n  if (!level || typeof level !== \"object\") return false;\n  const tcb = (level as Record<string, unknown>)[\"tcb\"];\n  if (!tcb || typeof tcb !== \"object\") return false;\n  const record = tcb as Record<string, unknown>;\n  const required =\n    typeof record[\"isvsvn\"] === \"number\"\n      ? record[\"isvsvn\"]\n      : typeof record[\"isvnsvn\"] === \"number\"\n        ? record[\"isvnsvn\"]\n        : undefined;\n  return typeof required === \"number\" && isvSvn >= required;\n}\n\nfunction qeIdentityLevelMatches(level: unknown, isvSvn: number): boolean {\n  if (!level || typeof level !== \"object\") return false;\n  const tcb = (level as Record<string, unknown>)[\"tcb\"];\n  if (!tcb || typeof tcb !== \"object\") return false;\n  const requiredIsvSvn = (tcb as Record<string, unknown>)[\"isvsvn\"];\n  return typeof requiredIsvSvn === \"number\" && isvSvn >= requiredIsvSvn;\n}\n\nfunction assertMaskedHexMatches(params: {\n  actual: Uint8Array;\n  expectedHex: unknown;\n  maskHex: unknown;\n  label: string;\n  reason: Extract<RefReason, \"TCB_STATUS_REJECTED\" | \"QE_IDENTITY_REJECTED\">;\n}): void {\n  const { actual, expectedHex, maskHex, label, reason } = params;\n  if (typeof expectedHex !== \"string\" || !isHexByteLength(expectedHex, actual.length)) {\n    throw err(reason, `${label} is missing or not ${actual.length} bytes of hex`);\n  }\n  if (typeof maskHex !== \"string\" || !isHexByteLength(maskHex, actual.length)) {\n    throw err(reason, `${label} mask is missing or not ${actual.length} bytes of hex`);\n  }\n  const expected = hexToBytes(expectedHex);\n  const mask = hexToBytes(maskHex);\n  for (let index = 0; index < actual.length; index++) {\n    if ((actual[index]! & mask[index]!) !== (expected[index]! & mask[index]!)) {\n      throw err(reason, `${label} masked byte ${index} does not match signed collateral policy`);\n    }\n  }\n}\n\nfunction isHexByteLength(value: string, byteLength: number): boolean {\n  return value.length === byteLength * 2 && /^[0-9a-f]+$/i.test(value);\n}\n\nfunction assertFreshDcapJsonWindow(\n  value: { issueDate?: unknown; nextUpdate?: unknown },\n  label: string,\n  now: Date,\n): void {\n  if (typeof value.issueDate !== \"string\" || typeof value.nextUpdate !== \"string\") {\n    throw err(\"DCAP_COLLATERAL_PARSE\", `${label} is missing issueDate or nextUpdate`);\n  }\n  const issueDate = new Date(value.issueDate);\n  const nextUpdate = new Date(value.nextUpdate);\n  if (Number.isNaN(issueDate.getTime()) || Number.isNaN(nextUpdate.getTime())) {\n    throw err(\"DCAP_COLLATERAL_PARSE\", `${label} has invalid issueDate or nextUpdate`);\n  }\n  if (now < issueDate) {\n    throw err(\"TCB_STATUS_REJECTED\", `${label} is not yet valid`);\n  }\n  if (now > nextUpdate) {\n    throw err(\"TCB_STATUS_REJECTED\", `${label} is stale past nextUpdate`);\n  }\n}\n\nfunction parseCrl(pem: string, label: string): x509.X509Crl {\n  if (typeof pem !== \"string\" || pem.length === 0) {\n    throw err(\"DCAP_COLLATERAL_MISSING\", `${label} is missing`);\n  }\n  try {\n    return new x509.X509Crl(pem);\n  } catch (e) {\n    throw err(\"DCAP_COLLATERAL_PARSE\", `${label} is not a parseable X.509 CRL: ${e}`);\n  }\n}\n\nasync function verifyCrl(\n  crl: x509.X509Crl,\n  issuer: x509.X509Certificate,\n  label: string,\n  now: Date,\n): Promise<void> {\n  if (crl.issuer !== issuer.subject) {\n    throw err(\n      \"DCAP_COLLATERAL_SIGNATURE\",\n      `${label} issuer ${crl.issuer} does not match expected ${issuer.subject}`,\n    );\n  }\n  if (now < crl.thisUpdate) {\n    throw err(\"TCB_STATUS_REJECTED\", `${label} is not yet valid`);\n  }\n  if (!crl.nextUpdate || now > crl.nextUpdate) {\n    throw err(\"TCB_STATUS_REJECTED\", `${label} is stale past nextUpdate`);\n  }\n  let ok: boolean;\n  try {\n    ok = await crl.verify({ publicKey: issuer });\n  } catch (e) {\n    throw err(\"DCAP_COLLATERAL_SIGNATURE\", `${label} signature verification threw: ${e}`);\n  }\n  if (!ok) {\n    throw err(\"DCAP_COLLATERAL_SIGNATURE\", `${label} signature verification failed`);\n  }\n}\n\nasync function assertNotRevokedByRoot(\n  rootCrl: x509.X509Crl,\n  cert: x509.X509Certificate,\n  label: string,\n): Promise<void> {\n  if (rootCrl.findRevoked(cert)) {\n    throw err(\"DCAP_COLLATERAL_REVOKED\", `${label} is revoked by Intel root CRL`);\n  }\n}\n\nasync function assertSameCertificate(\n  actual: x509.X509Certificate,\n  expected: x509.X509Certificate,\n  label: string,\n): Promise<void> {\n  const actualFp = await sha256Hex(new Uint8Array(actual.rawData));\n  const expectedFp = await sha256Hex(new Uint8Array(expected.rawData));\n  if (actualFp !== expectedFp) {\n    throw err(\n      \"DCAP_COLLATERAL_SIGNATURE\",\n      `${label} fingerprint ${actualFp} does not match quote chain issuer ${expectedFp}`,\n    );\n  }\n}\n\nfunction parsePemCertificateChain(\n  pem: string,\n  label: string,\n  minCerts: number,\n): x509.X509Certificate[] {\n  if (typeof pem !== \"string\" || pem.length === 0) {\n    throw err(\"DCAP_COLLATERAL_MISSING\", `${label} is missing`);\n  }\n  const matches = pem.match(/-----BEGIN CERTIFICATE-----[\\s\\S]+?-----END CERTIFICATE-----/g) ?? [];\n  if (matches.length < minCerts) {\n    throw err(\n      \"DCAP_COLLATERAL_PARSE\",\n      `${label} has ${matches.length} cert(s), expected at least ${minCerts}`,\n    );\n  }\n  return matches.map((certPem, index) => {\n    try {\n      return new x509.X509Certificate(certPem);\n    } catch (e) {\n      throw err(\"DCAP_COLLATERAL_PARSE\", `${label} cert[${index}] is not parseable: ${e}`);\n    }\n  });\n}\n\nfunction extractPckTcb(cert: x509.X509Certificate): PckTcb {\n  const sgxExtensions = cert.getExtension(INTEL_PCK_SGX_EXTENSIONS_OID);\n  if (sgxExtensions) {\n    return parsePckSgxExtensions(new Uint8Array(sgxExtensions.value));\n  }\n\n  return {\n    fmspc: extractPckExtensionHex(cert, INTEL_PCK_EXTENSION_FMSPC_OID, 6, \"FMSPC\"),\n    pceId: extractPckExtensionHex(cert, INTEL_PCK_EXTENSION_PCE_ID_OID, 2, \"PCE ID\"),\n    sgxTcbSvns: Array.from({ length: 16 }, (_, index) =>\n      extractPckIntegerExtension(\n        cert,\n        `${INTEL_PCK_EXTENSION_SGX_TCB_COMPONENT_OID_PREFIX}${index + 1}`,\n        `SGX TCB component ${index + 1}`,\n      ),\n    ),\n    pceSvn: extractPckIntegerExtension(cert, INTEL_PCK_EXTENSION_PCESVN_OID, \"PCESVN\"),\n    cpuSvn: hexToBytes(extractPckExtensionHex(cert, INTEL_PCK_EXTENSION_CPUSVN_OID, 16, \"CPUSVN\")),\n  };\n}\n\nfunction parsePckSgxExtensions(bytes: Uint8Array): PckTcb {\n  const topLevel = unwrapDerOctetStringIfPresent(bytes);\n  const extensions = derChildren(expectDerTag(readDerTlv(topLevel, 0), 0x30, \"SGX extensions\"));\n  const parsed: Partial<PckTcb> = {};\n  for (const extension of extensions) {\n    const contextTag = contextSpecificTagNumber(extension);\n    if (contextTag === 2) {\n      parsed.pceId = bytesToHex(readContextOctetString(extension, \"PCE ID\"));\n      continue;\n    }\n    if (contextTag === 3) {\n      parsed.fmspc = bytesToHex(readContextOctetString(extension, \"FMSPC\"));\n      continue;\n    }\n    if (contextTag === 1) {\n      const tcb = parsePckTcbExtension(extension);\n      parsed.sgxTcbSvns = tcb.sgxTcbSvns;\n      parsed.pceSvn = tcb.pceSvn;\n      parsed.cpuSvn = tcb.cpuSvn;\n      continue;\n    }\n\n    const children = derChildren(expectDerTag(extension, 0x30, \"SGX extension item\"));\n    if (children.length !== 2) {\n      throw err(\"TCB_STATUS_REJECTED\", \"PCK SGX extension item does not contain OID and value\");\n    }\n    const oid = readDerOid(children[0]!);\n    const value = children[1]!;\n    if (oid === INTEL_PCK_EXTENSION_PCE_ID_OID) {\n      parsed.pceId = bytesToHex(readPckChoiceOctetString(value, 2, \"PCE ID\"));\n    } else if (oid === INTEL_PCK_EXTENSION_FMSPC_OID) {\n      parsed.fmspc = bytesToHex(readPckChoiceOctetString(value, 3, \"FMSPC\"));\n    } else if (oid === INTEL_PCK_EXTENSION_TCB_OID) {\n      const tcb = parsePckTcbExtension(value);\n      parsed.sgxTcbSvns = tcb.sgxTcbSvns;\n      parsed.pceSvn = tcb.pceSvn;\n      parsed.cpuSvn = tcb.cpuSvn;\n    }\n  }\n\n  if (\n    parsed.fmspc === undefined ||\n    parsed.pceId === undefined ||\n    parsed.sgxTcbSvns === undefined ||\n    parsed.pceSvn === undefined ||\n    parsed.cpuSvn === undefined\n  ) {\n    throw err(\"TCB_STATUS_REJECTED\", \"PCK SGX extension is missing FMSPC, PCE ID, or TCB fields\");\n  }\n  return parsed as PckTcb;\n}\n\nfunction parsePckTcbExtension(value: DerTlv): Pick<PckTcb, \"sgxTcbSvns\" | \"pceSvn\" | \"cpuSvn\"> {\n  const tcbItems = pckTcbChildren(value);\n  const sgxTcbSvns: number[] = [];\n  let pceSvn: number | undefined;\n  let cpuSvn: Uint8Array | undefined;\n  for (const item of tcbItems) {\n    const contextTag = contextSpecificTagNumber(item);\n    if (contextTag !== null) {\n      if (contextTag === 16) {\n        pceSvn = readContextInteger(item, \"PCESVN\");\n      } else if (contextTag === 17) {\n        cpuSvn = readContextOctetString(item, \"CPUSVN\");\n      } else if (contextTag >= 0 && contextTag <= 15) {\n        sgxTcbSvns[contextTag] = readContextInteger(item, `SGX TCB component ${contextTag + 1}`);\n      }\n      continue;\n    }\n\n    const children = derChildren(expectDerTag(item, 0x30, \"PCK TCB item\"));\n    if (children.length !== 2) {\n      throw err(\"TCB_STATUS_REJECTED\", \"PCK TCB item does not contain OID and value\");\n    }\n    const oid = readDerOid(children[0]!);\n    const valueTlv = children[1]!;\n    if (oid === INTEL_PCK_EXTENSION_PCESVN_OID) {\n      pceSvn = readPckChoiceInteger(valueTlv, 16, \"PCESVN\");\n    } else if (oid === INTEL_PCK_EXTENSION_CPUSVN_OID) {\n      cpuSvn = readPckChoiceOctetString(valueTlv, 17, \"CPUSVN\");\n    } else if (oid.startsWith(INTEL_PCK_EXTENSION_SGX_TCB_COMPONENT_OID_PREFIX)) {\n      const index = Number.parseInt(\n        oid.slice(INTEL_PCK_EXTENSION_SGX_TCB_COMPONENT_OID_PREFIX.length),\n        10,\n      );\n      if (!Number.isInteger(index) || index < 1 || index > 16) {\n        throw err(\"TCB_STATUS_REJECTED\", `PCK TCB component OID ${oid} is out of range`);\n      }\n      sgxTcbSvns[index - 1] = readPckChoiceInteger(\n        valueTlv,\n        index - 1,\n        `SGX TCB component ${index}`,\n      );\n    }\n  }\n  if (\n    sgxTcbSvns.length !== 16 ||\n    Array.from({ length: 16 }, (_, index) => sgxTcbSvns[index]).some((svn) => svn === undefined)\n  ) {\n    throw err(\"TCB_STATUS_REJECTED\", \"PCK TCB extension is missing SGX TCB components\");\n  }\n  if (pceSvn === undefined || cpuSvn === undefined) {\n    throw err(\"TCB_STATUS_REJECTED\", \"PCK TCB extension is missing PCESVN or CPUSVN\");\n  }\n  if (cpuSvn.length !== 16) {\n    throw err(\"TCB_STATUS_REJECTED\", `PCK CPUSVN has ${cpuSvn.length} bytes, expected 16`);\n  }\n  return { sgxTcbSvns, pceSvn, cpuSvn };\n}\n\nfunction extractPckExtensionHex(\n  cert: x509.X509Certificate,\n  oid: string,\n  expectedBytes: number,\n  label: string,\n): string {\n  const ext = cert.getExtension(oid);\n  if (!ext) {\n    throw err(\"TCB_STATUS_REJECTED\", `PCK leaf is missing ${label} extension ${oid}`);\n  }\n  const decoded = unwrapDerOctetStringIfPresent(new Uint8Array(ext.value));\n  if (decoded.length !== expectedBytes) {\n    throw err(\n      \"TCB_STATUS_REJECTED\",\n      `PCK ${label} extension has ${decoded.length} bytes, expected ${expectedBytes}`,\n    );\n  }\n  return bytesToHex(decoded);\n}\n\nfunction extractPckIntegerExtension(\n  cert: x509.X509Certificate,\n  oid: string,\n  label: string,\n): number {\n  const ext = cert.getExtension(oid);\n  if (!ext) {\n    throw err(\"TCB_STATUS_REJECTED\", `PCK leaf is missing ${label} extension ${oid}`);\n  }\n  return readDerInteger(readDerTlv(new Uint8Array(ext.value), 0), label);\n}\n\ntype DerTlv = {\n  tag: number;\n  start: number;\n  valueStart: number;\n  valueEnd: number;\n  end: number;\n  source: Uint8Array;\n};\n\nfunction readDerTlv(source: Uint8Array, start: number): DerTlv {\n  if (start + 2 > source.length) {\n    throw err(\"TCB_STATUS_REJECTED\", \"truncated DER value\");\n  }\n  const tag = source[start]!;\n  let offset = start + 1;\n  const firstLength = source[offset++]!;\n  let length: number;\n  if ((firstLength & 0x80) === 0) {\n    length = firstLength;\n  } else {\n    const octets = firstLength & 0x7f;\n    if (octets === 0 || octets > 4 || offset + octets > source.length) {\n      throw err(\"TCB_STATUS_REJECTED\", \"unsupported DER length\");\n    }\n    length = 0;\n    for (let i = 0; i < octets; i++) {\n      length = (length << 8) | source[offset++]!;\n    }\n  }\n  const valueStart = offset;\n  const valueEnd = valueStart + length;\n  if (valueEnd > source.length) {\n    throw err(\"TCB_STATUS_REJECTED\", \"DER value length exceeds buffer\");\n  }\n  return { tag, start, valueStart, valueEnd, end: valueEnd, source };\n}\n\nfunction expectDerTag(tlv: DerTlv, tag: number, label: string): DerTlv {\n  if (tlv.tag !== tag) {\n    throw err(\"TCB_STATUS_REJECTED\", `${label} has DER tag 0x${tlv.tag.toString(16)}`);\n  }\n  return tlv;\n}\n\nfunction derChildren(tlv: DerTlv): DerTlv[] {\n  const children: DerTlv[] = [];\n  let offset = tlv.valueStart;\n  while (offset < tlv.valueEnd) {\n    const child = readDerTlv(tlv.source, offset);\n    if (child.end > tlv.valueEnd) {\n      throw err(\"TCB_STATUS_REJECTED\", \"DER child exceeds parent\");\n    }\n    children.push(child);\n    offset = child.end;\n  }\n  return children;\n}\n\nfunction readDerOid(tlv: DerTlv): string {\n  expectDerTag(tlv, 0x06, \"OID\");\n  const bytes = tlv.source.subarray(tlv.valueStart, tlv.valueEnd);\n  if (bytes.length === 0) {\n    throw err(\"TCB_STATUS_REJECTED\", \"empty DER OID\");\n  }\n  const parts = [Math.floor(bytes[0]! / 40), bytes[0]! % 40];\n  let value = 0;\n  for (const byte of bytes.subarray(1)) {\n    value = (value << 7) | (byte & 0x7f);\n    if ((byte & 0x80) === 0) {\n      parts.push(value);\n      value = 0;\n    }\n  }\n  if (value !== 0) {\n    throw err(\"TCB_STATUS_REJECTED\", \"truncated DER OID\");\n  }\n  return parts.join(\".\");\n}\n\nfunction readDerInteger(tlv: DerTlv, label: string): number {\n  expectDerTag(tlv, 0x02, label);\n  const bytes = tlv.source.subarray(tlv.valueStart, tlv.valueEnd);\n  if (bytes.length === 0 || (bytes[0]! & 0x80) !== 0) {\n    throw err(\"TCB_STATUS_REJECTED\", `${label} is not a positive DER integer`);\n  }\n  let value = 0;\n  for (const byte of bytes) value = (value << 8) | byte;\n  return value;\n}\n\nfunction readDerOctetString(tlv: DerTlv, label: string): Uint8Array {\n  expectDerTag(tlv, 0x04, label);\n  return tlv.source.subarray(tlv.valueStart, tlv.valueEnd);\n}\n\nfunction pckTcbChildren(value: DerTlv): DerTlv[] {\n  if (contextSpecificTagNumber(value) === 1) {\n    if ((value.tag & 0x20) === 0) {\n      throw err(\"TCB_STATUS_REJECTED\", \"PCK TCB field is not constructed\");\n    }\n    const children = derChildren(value);\n    if (children.length === 1 && children[0]!.tag === 0x30) {\n      return derChildren(children[0]!);\n    }\n    return children;\n  }\n  return derChildren(expectDerTag(value, 0x30, \"PCK TCB extension\"));\n}\n\nfunction readPckChoiceInteger(tlv: DerTlv, expectedTag: number, label: string): number {\n  const contextTag = contextSpecificTagNumber(tlv);\n  if (contextTag !== null) {\n    if (contextTag !== expectedTag) {\n      throw err(\n        \"TCB_STATUS_REJECTED\",\n        `${label} uses context tag ${contextTag}, expected ${expectedTag}`,\n      );\n    }\n    return readContextInteger(tlv, label);\n  }\n  return readDerInteger(tlv, label);\n}\n\nfunction readPckChoiceOctetString(tlv: DerTlv, expectedTag: number, label: string): Uint8Array {\n  const contextTag = contextSpecificTagNumber(tlv);\n  if (contextTag !== null) {\n    if (contextTag !== expectedTag) {\n      throw err(\n        \"TCB_STATUS_REJECTED\",\n        `${label} uses context tag ${contextTag}, expected ${expectedTag}`,\n      );\n    }\n    return readContextOctetString(tlv, label);\n  }\n  return readDerOctetString(tlv, label);\n}\n\nfunction contextSpecificTagNumber(tlv: DerTlv): number | null {\n  if ((tlv.tag & 0xc0) !== 0x80) return null;\n  const tagNumber = tlv.tag & 0x1f;\n  return tagNumber === 0x1f ? null : tagNumber;\n}\n\nfunction readContextInner(tlv: DerTlv): DerTlv {\n  if ((tlv.tag & 0x20) === 0) {\n    throw err(\"TCB_STATUS_REJECTED\", \"PCK context-specific field is not constructed\");\n  }\n  const children = derChildren(tlv);\n  if (children.length !== 1) {\n    throw err(\"TCB_STATUS_REJECTED\", \"PCK context-specific field has multiple values\");\n  }\n  return children[0]!;\n}\n\nfunction readContextInteger(tlv: DerTlv, label: string): number {\n  const inner = (tlv.tag & 0x20) !== 0 ? readContextInner(tlv) : tlv;\n  if ((tlv.tag & 0x20) !== 0) return readDerInteger(inner, label);\n  return readDerIntegerValue(inner.source.subarray(inner.valueStart, inner.valueEnd), label);\n}\n\nfunction readContextOctetString(tlv: DerTlv, label: string): Uint8Array {\n  const inner = (tlv.tag & 0x20) !== 0 ? readContextInner(tlv) : tlv;\n  if ((tlv.tag & 0x20) !== 0) return readDerOctetString(inner, label);\n  return inner.source.subarray(inner.valueStart, inner.valueEnd);\n}\n\nfunction readDerIntegerValue(bytes: Uint8Array, label: string): number {\n  if (bytes.length === 0 || (bytes[0]! & 0x80) !== 0) {\n    throw err(\"TCB_STATUS_REJECTED\", `${label} is not a positive DER integer`);\n  }\n  let value = 0;\n  for (const byte of bytes) value = (value << 8) | byte;\n  return value;\n}\n\nfunction unwrapDerOctetStringIfPresent(bytes: Uint8Array): Uint8Array {\n  if (bytes.length >= 2 && bytes[0] === 0x04) {\n    const tlv = readDerTlv(bytes, 0);\n    if (tlv.end === bytes.length) return bytes.subarray(tlv.valueStart, tlv.valueEnd);\n  }\n  return bytes;\n}\n\nfunction hexToBytes(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0 || !/^[0-9a-f]*$/i.test(hex)) {\n    throw err(\"DCAP_COLLATERAL_PARSE\", \"invalid hex string\");\n  }\n  const out = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < out.length; i++) {\n    out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n  }\n  return out;\n}\n\n// ── Azure TDX + MAA attestation ───────────────────────────────────────────────\n//\n// azure-tdx-dcap combines four evidence sources:\n//   1. DCAP quote (Intel PCK chain) - genuine TDX VM.\n//      REPORTDATA[0:32] = SHA-256(hcl_keys_json) - set by the Azure hypervisor.\n//   2. MAA JWT (/attest/TdxVm) - RS256-signed by Microsoft Azure Attestation.\n//      Contains tdx_report_data, tdx_mrtd, tdx_td_attributes_debug, compliance.\n//   3. hcl_keys_json - raw JSON blob from HCL NV index 0x1400001.\n//      SHA-256(hcl_keys_json_bytes) == DCAP REPORTDATA[0:32]. Contains the AK.\n//   4. TPM AK quote - signed by the AK from hcl_keys_json.\n//      qualifying_data = SHA-256(nonce || noise_pubkey || binary_hash).\n\nconst MAA_JKU_PATTERN = /^https:\\/\\/[a-z0-9-]+\\.[a-z0-9]+\\.attest\\.azure\\.net\\/certs$/;\n\n/** Base64url decode to string (for JWT header/payload JSON). */\nfunction b64urlDecodeStr(s: string): string {\n  const padded = s.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"=\".repeat((4 - (s.length % 4)) % 4);\n  return atob(padded);\n}\n\n/** Base64url decode to Uint8Array (for JWT signature bytes). */\nfunction b64urlDecodeBytes(s: string): Uint8Array {\n  const decoded = b64urlDecodeStr(s);\n  const out = new Uint8Array(decoded.length);\n  for (let i = 0; i < decoded.length; i++) out[i] = decoded.charCodeAt(i);\n  return out;\n}\n\ntype MaaMeasurements = {\n  reportData: string;\n  mrtd: string;\n  rtmr0: string;\n  rtmr1: string;\n  rtmr2: string;\n  rtmr3: string;\n};\n\ntype QuoteMeasurements = Omit<MaaMeasurements, \"reportData\">;\n\n/**\n * Verify a MAA JWT from /attest/TdxVm and extract TDX measurements. Validates\n * the RS256 signature against the MAA JWKS, expiry, compliance status, and the\n * debug bit. AK extraction is done separately from hcl_keys_json.\n */\nasync function verifyAzureMaaToken(\n  token: string,\n  policy: AzureMaaPolicy,\n  timeoutMs: number = DEFAULT_AZURE_JWKS_TIMEOUT_MS,\n): Promise<MaaMeasurements> {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) {\n    throw err(\"MAA_TOKEN_PARSE\", `MAA token is not a valid JWT (${parts.length} parts)`);\n  }\n  const [headerB64, payloadB64, sigB64] = parts;\n\n  let header: Record<string, unknown>;\n  let payload: Record<string, unknown>;\n  try {\n    header = JSON.parse(b64urlDecodeStr(headerB64));\n    payload = JSON.parse(b64urlDecodeStr(payloadB64));\n  } catch (e) {\n    throw err(\"MAA_TOKEN_PARSE\", `failed to decode MAA JWT header/payload: ${e}`);\n  }\n\n  // Token expiry: reject stale tokens before any network fetch.\n  const exp = payload[\"exp\"];\n  if (typeof exp === \"number\" && Math.floor(Date.now() / 1000) > exp) {\n    throw err(\"MAA_TOKEN_EXPIRED\", `MAA JWT expired at ${new Date(exp * 1000).toISOString()}`);\n  }\n\n  const jku = header[\"jku\"] as string | undefined;\n  const kid = header[\"kid\"] as string | undefined;\n  if (!jku || !kid) {\n    throw err(\"MAA_TOKEN_PARSE\", \"MAA JWT header missing jku or kid\");\n  }\n  if (payload[\"iss\"] !== policy.expectedIssuer) {\n    throw err(\n      \"MAA_ISSUER_MISMATCH\",\n      `MAA JWT issuer ${String(payload[\"iss\"])} does not match pinned ${policy.expectedIssuer}`,\n    );\n  }\n  if (jku !== policy.expectedJwksUrl) {\n    throw err(\n      \"MAA_JWKS_MISMATCH\",\n      `MAA JWT jku ${jku} does not match pinned ${policy.expectedJwksUrl}`,\n    );\n  }\n  if (!MAA_JKU_PATTERN.test(policy.expectedJwksUrl)) {\n    throw err(\n      \"MAA_JWKS_MISMATCH\",\n      `pinned MAA JWKS URL does not match Azure attestation domain: ${policy.expectedJwksUrl}`,\n    );\n  }\n  if (payload[\"x-ms-policy-hash\"] !== policy.expectedPolicyHash) {\n    throw err(\n      \"MAA_POLICY_HASH_MISMATCH\",\n      `MAA policy hash ${String(payload[\"x-ms-policy-hash\"])} does not match pinned ${policy.expectedPolicyHash}`,\n    );\n  }\n\n  // Fetch the pinned MAA JWKS. The token header must not select the trust root.\n  let jwks: { keys: Array<{ kid: string; kty: string; n: string; e: string }> };\n  try {\n    jwks = await fetchMaaJwks(policy.expectedJwksUrl, timeoutMs);\n  } catch (e) {\n    throw err(\n      \"MAA_TOKEN_SIGNATURE\",\n      `failed to fetch MAA JWKS from ${policy.expectedJwksUrl}: ${e}`,\n    );\n  }\n\n  const jwk = jwks.keys.find((k) => k.kid === kid);\n  if (!jwk) {\n    throw err(\"MAA_TOKEN_SIGNATURE\", `no key with kid=${kid} found in MAA JWKS`);\n  }\n\n  // Import RSA-2048 public key and verify RS256 signature.\n  let sigPubKey: CryptoKey;\n  try {\n    sigPubKey = await crypto.subtle.importKey(\n      \"jwk\",\n      { kty: \"RSA\", n: jwk.n, e: jwk.e, alg: \"RS256\", ext: true },\n      { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\n      false,\n      [\"verify\"],\n    );\n  } catch (e) {\n    throw err(\"MAA_TOKEN_SIGNATURE\", `failed to import MAA JWK: ${e}`);\n  }\n\n  const msg = new TextEncoder().encode(`${headerB64}.${payloadB64}`);\n  const sig = b64urlDecodeBytes(sigB64);\n  const valid = await crypto.subtle.verify(\n    { name: \"RSASSA-PKCS1-v1_5\" },\n    sigPubKey,\n    sig as BufferSource,\n    msg as BufferSource,\n  );\n  if (!valid) {\n    throw err(\"MAA_TOKEN_SIGNATURE\", \"MAA JWT RS256 signature verification failed\");\n  }\n\n  // Compliance status: MAA certifies this is a genuine Azure CVM.\n  if (payload[\"x-ms-compliance-status\"] !== \"azure-compliant-cvm\") {\n    throw err(\n      \"MAA_COMPLIANCE_MISMATCH\",\n      `MAA compliance status: \"${payload[\"x-ms-compliance-status\"]}\" (expected \"azure-compliant-cvm\")`,\n    );\n  }\n\n  // Debug bit: refuse a debuggable TD.\n  if (payload[\"tdx_td_attributes_debug\"] !== false) {\n    throw err(\"MAA_DEBUG_BIT_SET\", \"MAA token reports TDX debug bit set\");\n  }\n\n  const reportData = payload[\"tdx_report_data\"];\n  if (typeof reportData !== \"string\" || !/^[0-9a-f]{128}$/i.test(reportData)) {\n    throw err(\"MAA_REPORTDATA_MISMATCH\", \"MAA token missing valid 64-byte tdx_report_data claim\");\n  }\n\n  return {\n    reportData: reportData.toLowerCase(),\n    mrtd: readMaaMeasurement(payload, \"tdx_mrtd\"),\n    rtmr0: readMaaMeasurement(payload, \"tdx_rtmr0\"),\n    rtmr1: readMaaMeasurement(payload, \"tdx_rtmr1\"),\n    rtmr2: readMaaMeasurement(payload, \"tdx_rtmr2\"),\n    rtmr3: readMaaMeasurement(payload, \"tdx_rtmr3\"),\n  };\n}\n\nfunction readMaaMeasurement(payload: Record<string, unknown>, claim: string): string {\n  const value = payload[claim];\n  if (typeof value !== \"string\" || !/^[0-9a-f]{96}$/i.test(value)) {\n    throw err(\"MAA_REPORTDATA_MISMATCH\", `MAA token missing valid ${claim} claim`);\n  }\n  return value.toLowerCase();\n}\n\nfunction assertMaaMeasurementsMatchDcap(maa: MaaMeasurements, dcap: QuoteMeasurements): void {\n  const fields = [\"mrtd\", \"rtmr0\", \"rtmr1\", \"rtmr2\", \"rtmr3\"] as const;\n  for (const field of fields) {\n    if (maa[field] !== dcap[field]) {\n      throw err(\n        \"MAA_REPORTDATA_MISMATCH\",\n        `MAA ${field} ${maa[field]} does not match DCAP quote ${field.toUpperCase()} ${dcap[field]}`,\n      );\n    }\n  }\n}\n\nasync function fetchMaaJwks(\n  url: string,\n  timeoutMs: number,\n): Promise<{ keys: Array<{ kid: string; kty: string; n: string; e: string }> }> {\n  const boundedTimeoutMs =\n    Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : DEFAULT_AZURE_JWKS_TIMEOUT_MS;\n  const controller = new AbortController();\n  let timeoutId: ReturnType<typeof setTimeout> | null = null;\n  const timeout = new Promise<never>((_, reject) => {\n    timeoutId = setTimeout(() => {\n      controller.abort();\n      reject(new Error(`timed out after ${boundedTimeoutMs}ms`));\n    }, boundedTimeoutMs);\n  });\n\n  try {\n    return await Promise.race([\n      (async () => {\n        const resp = await fetch(url, { signal: controller.signal });\n        if (!resp.ok) throw new Error(`HTTP ${resp.status}`);\n        return (await resp.json()) as {\n          keys: Array<{ kid: string; kty: string; n: string; e: string }>;\n        };\n      })(),\n      timeout,\n    ]);\n  } finally {\n    if (timeoutId !== null) clearTimeout(timeoutId);\n  }\n}\n\n/**\n * Verify the Azure TPM AK quote nonce binding.\n *\n * Wire format: [4-byte msg_len LE][TPM2B_ATTEST][TPMT_SIGNATURE].\n * Signature: RSA-2048 RSASSA-PKCS1v15-SHA256 over the TPMS_ATTEST body.\n * qualifying_data = SHA-256(nonce_bytes || noise_pubkey_bytes || binary_hash)\n * must appear\n * verbatim in the TPMS_ATTEST extraData field.\n */\nasync function verifyTpmQuoteNonce(\n  tpmQuoteB64: string,\n  akPubKey: CryptoKey,\n  expectedNonce: Uint8Array,\n  expectedNoiseStaticPub: Uint8Array,\n  expectedBinaryHash: Uint8Array,\n): Promise<void> {\n  let raw: Uint8Array;\n  try {\n    raw = base64ToBytes(tpmQuoteB64);\n  } catch (e) {\n    throw err(\"TPM_QUOTE_SIGNATURE\", `failed to decode tpm_quote: ${e}`);\n  }\n\n  if (raw.length < 8) {\n    throw err(\"TPM_QUOTE_SIGNATURE\", \"tpm_quote too short\");\n  }\n\n  // [4-byte msg_len LE][TPMS_ATTEST raw bytes][TPMT_SIGNATURE raw bytes].\n  // tpm2_quote -m writes the raw TPMS_ATTEST directly (no TPM2B size prefix).\n  const msgLen = new DataView(raw.buffer, raw.byteOffset).getUint32(0, true /* little-endian */);\n  if (4 + msgLen > raw.length) {\n    throw err(\"TPM_QUOTE_SIGNATURE\", `tpm_quote msg_len=${msgLen} exceeds buffer`);\n  }\n  const tpmsAttest = raw.slice(4, 4 + msgLen); // starts with ff544347 (TPM_GENERATED_VALUE)\n  const sigBlob = raw.slice(4 + msgLen);\n\n  // TPMT_SIGNATURE: [sigAlg u16 BE][hashAlg u16 BE][size u16 BE][sig bytes]\n  if (sigBlob.length < 6) {\n    throw err(\"TPM_QUOTE_SIGNATURE\", \"TPMT_SIGNATURE too short\");\n  }\n  const sigSize = (sigBlob[4] << 8) | sigBlob[5];\n  const sigBytes = sigBlob.slice(6, 6 + sigSize);\n  if (sigBytes.length !== sigSize) {\n    throw err(\n      \"TPM_QUOTE_SIGNATURE\",\n      `TPMT_SIGNATURE truncated: need ${sigSize}, have ${sigBytes.length}`,\n    );\n  }\n\n  // Verify RSA signature over tpmsAttest using the MAA-certified AK public key.\n  const valid = await crypto.subtle.verify(\n    { name: \"RSASSA-PKCS1-v1_5\" },\n    akPubKey,\n    sigBytes as BufferSource,\n    tpmsAttest as BufferSource,\n  );\n  if (!valid) {\n    throw err(\"TPM_QUOTE_SIGNATURE\", \"TPM AK RSA signature verification failed\");\n  }\n\n  // Verify qualifying_data == SHA-256(nonce || noise_pubkey || binary_hash) exactly matches\n  // TPMS_ATTEST.extraData. A substring search would accept unrelated signed\n  // fields that happen to contain the challenge bytes.\n  const qdInput = new Uint8Array(\n    expectedNonce.length + expectedNoiseStaticPub.length + expectedBinaryHash.length,\n  );\n  qdInput.set(expectedNonce, 0);\n  qdInput.set(expectedNoiseStaticPub, expectedNonce.length);\n  qdInput.set(expectedBinaryHash, expectedNonce.length + expectedNoiseStaticPub.length);\n  const expectedQd = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", qdInput as BufferSource));\n\n  const extraData = readTpmsAttestExtraData(tpmsAttest);\n  if (!constantTimeEq(extraData, expectedQd)) {\n    throw err(\n      \"TPM_NONCE_MISMATCH\",\n      \"TPMS_ATTEST extraData does not equal SHA-256(nonce || noise_pubkey || binary_hash)\",\n    );\n  }\n}\n\nfunction readTpmsAttestExtraData(tpmsAttest: Uint8Array): Uint8Array {\n  if (tpmsAttest.length < 10) {\n    throw err(\"TPM_QUOTE_SIGNATURE\", \"TPMS_ATTEST too short\");\n  }\n\n  const view = new DataView(tpmsAttest.buffer, tpmsAttest.byteOffset, tpmsAttest.byteLength);\n  const magic = view.getUint32(0, false);\n  if (magic !== TPM_GENERATED_VALUE) {\n    throw err(\n      \"TPM_QUOTE_SIGNATURE\",\n      `TPMS_ATTEST magic ${magic.toString(16)} is not TPM_GENERATED_VALUE`,\n    );\n  }\n  const attestType = view.getUint16(4, false);\n  if (attestType !== TPM_ST_ATTEST_QUOTE) {\n    throw err(\"TPM_QUOTE_SIGNATURE\", `TPMS_ATTEST type ${attestType.toString(16)} is not quote`);\n  }\n\n  let offset = 6;\n  offset = readTpm2b(tpmsAttest, offset, \"qualifiedSigner\").nextOffset;\n  return readTpm2b(tpmsAttest, offset, \"extraData\").data;\n}\n\nfunction readTpm2b(\n  bytes: Uint8Array,\n  offset: number,\n  label: string,\n): { data: Uint8Array; nextOffset: number } {\n  if (offset + 2 > bytes.length) {\n    throw err(\"TPM_QUOTE_SIGNATURE\", `TPMS_ATTEST truncated before ${label} size`);\n  }\n  const size = (bytes[offset] << 8) | bytes[offset + 1];\n  const start = offset + 2;\n  const end = start + size;\n  if (end > bytes.length) {\n    throw err(\"TPM_QUOTE_SIGNATURE\", `TPMS_ATTEST truncated in ${label}`);\n  }\n  return { data: bytes.slice(start, end), nextOffset: end };\n}\n\n/** Base64 (standard or URL-safe) decode to Uint8Array. */\nfunction base64ToBytes(b64: string): Uint8Array {\n  const normalized = b64.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n  const binaryStr = atob(padded);\n  const out = new Uint8Array(binaryStr.length);\n  for (let i = 0; i < binaryStr.length; i++) out[i] = binaryStr.charCodeAt(i);\n  return out;\n}\n\nasync function verifyAzureTdxAttestation(params: {\n  raw: Uint8Array;\n  response: AttestResponse;\n  expectedNonce: Uint8Array;\n  expectedNoiseStaticPub: Uint8Array;\n  policy: AttestationPolicy;\n  timeoutMs?: number;\n}): Promise<AttestedMetadata> {\n  const { raw, response, expectedNonce, expectedNoiseStaticPub, policy, timeoutMs } = params;\n\n  const body = raw.subarray(BODY_OFFSET, BODY_OFFSET + BODY_SIZE);\n  const dcapMeasurements = parseMeasurements(body);\n  const reportData = body.subarray(\n    BODY_REPORT_DATA_OFF,\n    BODY_REPORT_DATA_OFF + BODY_REPORT_DATA_LEN,\n  );\n\n  await verifyDcapQuoteAndCollateral({ raw, body, response, policy });\n  assertDebugBitClear(body);\n\n  // A. MAA JWT: verify RS256 signature, expiry, compliance status, debug bit,\n  //    and that MAA attested the exact REPORTDATA read from the DCAP quote.\n  if (!response.maa_token) {\n    throw err(\"MAA_TOKEN_MISSING\", \"azure-tdx-dcap response missing maa_token\");\n  }\n  if (!policy.azureMaa) {\n    throw err(\n      \"MAA_TRUST_POLICY_MISSING\",\n      \"azure-tdx-dcap attestation requires pinned MAA issuer, JWKS URL, and policy hash\",\n    );\n  }\n  const measurements = await verifyAzureMaaToken(response.maa_token, policy.azureMaa, timeoutMs);\n  const reportDataHex = bytesToHex(reportData);\n  if (measurements.reportData !== reportDataHex) {\n    throw err(\n      \"MAA_REPORTDATA_MISMATCH\",\n      `MAA tdx_report_data ${measurements.reportData} does not match DCAP REPORTDATA ${reportDataHex}`,\n    );\n  }\n  assertMaaMeasurementsMatchDcap(measurements, dcapMeasurements);\n\n  // B. hcl_keys_json SHA-256 binding: REPORTDATA[0:32] == SHA-256(hcl_keys_json_bytes).\n  if (!response.hcl_keys_json) {\n    throw err(\"HCL_KEYS_MISSING\", \"azure-tdx-dcap response missing hcl_keys_json\");\n  }\n  let hclKeysBytes: Uint8Array;\n  try {\n    hclKeysBytes = base64ToBytes(response.hcl_keys_json);\n  } catch (e) {\n    throw err(\"HCL_KEYS_PARSE\", `failed to decode hcl_keys_json base64: ${e}`);\n  }\n  const reportData0_32 = reportData.subarray(0, 32);\n  const hclKeysHash = new Uint8Array(\n    await crypto.subtle.digest(\"SHA-256\", hclKeysBytes as BufferSource),\n  );\n  if (!constantTimeEq(hclKeysHash, reportData0_32)) {\n    throw err(\n      \"HCL_KEYS_HASH_MISMATCH\",\n      \"SHA-256(hcl_keys_json) does not match DCAP quote REPORTDATA[0:32]\",\n    );\n  }\n\n  // C. Extract AK public key from hcl_keys_json (kid=\"HCLAkPub\"). Trusting this\n  //    key is safe because the signed MAA tdx_report_data matched this raw quote\n  //    REPORTDATA, and REPORTDATA[0:32] matched hcl_keys_json.\n  let hclKeys: unknown;\n  try {\n    hclKeys = JSON.parse(new TextDecoder().decode(hclKeysBytes));\n  } catch (e) {\n    throw err(\"HCL_KEYS_PARSE\", `failed to parse hcl_keys_json: ${e}`);\n  }\n  const keysArray = (hclKeys as Record<string, unknown>)[\"keys\"];\n  const akJwk = Array.isArray(keysArray)\n    ? (keysArray as Array<Record<string, unknown>>).find((k) => k[\"kid\"] === \"HCLAkPub\")\n    : undefined;\n  if (!akJwk) {\n    throw err(\"HCL_KEYS_PARSE\", 'hcl_keys_json does not contain a key with kid=\"HCLAkPub\"');\n  }\n  let akPubKey: CryptoKey;\n  try {\n    akPubKey = await crypto.subtle.importKey(\n      \"jwk\",\n      { kty: \"RSA\", n: akJwk[\"n\"] as string, e: akJwk[\"e\"] as string, ext: true },\n      { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\n      false,\n      [\"verify\"],\n    );\n  } catch (e) {\n    throw err(\"HCL_KEYS_PARSE\", `failed to import HCLAkPub from hcl_keys_json: ${e}`);\n  }\n\n  // D. TPM AK quote: verify RSA signature using the DCAP-certified AK + nonce binding.\n  if (!response.tpm_quote) {\n    throw err(\"TPM_QUOTE_MISSING\", \"azure-tdx-dcap response missing tpm_quote\");\n  }\n  if (!/^[0-9a-f]{64}$/i.test(response.binary_hash)) {\n    throw err(\"BINARY_HASH_FORMAT\", \"binary_hash field is not a 32-byte hex digest\");\n  }\n  if (response.mode === \"prod\" && policy.expectedBinaryHash === undefined) {\n    throw err(\n      \"BINARY_HASH_MISMATCH\",\n      \"production Azure attestation requires a pinned coordinator binary hash\",\n    );\n  }\n  if (\n    policy.expectedBinaryHash !== undefined &&\n    response.binary_hash.toLowerCase() !== policy.expectedBinaryHash.toLowerCase()\n  ) {\n    throw err(\n      \"BINARY_HASH_MISMATCH\",\n      `binary hash ${response.binary_hash.toLowerCase()} does not match the approved release pin`,\n    );\n  }\n  await verifyTpmQuoteNonce(\n    response.tpm_quote,\n    akPubKey,\n    expectedNonce,\n    expectedNoiseStaticPub,\n    hexToBytes(response.binary_hash),\n  );\n\n  // E. JSON field consistency.\n  if (response.nonce.toLowerCase() !== bytesToHex(expectedNonce)) {\n    throw err(\"NONCE_FIELD_MISMATCH\", `JSON nonce ${response.nonce} does not match verifier nonce`);\n  }\n  if (response.pubkey.toLowerCase() !== bytesToHex(expectedNoiseStaticPub)) {\n    throw err(\n      \"PUBKEY_FIELD_MISMATCH\",\n      \"attestation pubkey field does not match Noise static pubkey from handshake\",\n    );\n  }\n  if (!/^[0-9a-f]{64}$/i.test(response.binary_hash)) {\n    throw err(\"BINARY_HASH_FORMAT\", \"binary_hash field is not a 32-byte hex digest\");\n  }\n\n  // F. Mode and MRTD pinning (same policy as GCP path).\n  if (policy.requiredMode !== undefined && response.mode !== policy.requiredMode) {\n    throw err(\n      \"MODE_MISMATCH\",\n      `attestation mode ${response.mode} does not match required ${policy.requiredMode}`,\n    );\n  }\n  if (response.mode === \"prod\") {\n    if (\n      (policy.expectedMrtd === undefined || policy.expectedMrtd === null) &&\n      policy.allowUnpinnedProdMrtdForRelease !== true\n    ) {\n      throw err(\n        \"MRTD_MISMATCH\",\n        \"production attestation requires a pinned MRTD but none was configured\",\n      );\n    }\n    if (\n      policy.expectedMrtd !== undefined &&\n      policy.expectedMrtd !== null &&\n      dcapMeasurements.mrtd !== policy.expectedMrtd.toLowerCase()\n    ) {\n      throw err(\n        \"MRTD_MISMATCH\",\n        `MRTD ${dcapMeasurements.mrtd} does not match pinned ${policy.expectedMrtd.toLowerCase()}`,\n      );\n    }\n  }\n\n  return {\n    mode: response.mode,\n    binaryHash: response.binary_hash,\n    runtimeProfile: response.runtime_profile,\n    mrtd: dcapMeasurements.mrtd,\n    rtmr0: dcapMeasurements.rtmr0,\n    rtmr1: dcapMeasurements.rtmr1,\n    rtmr2: dcapMeasurements.rtmr2,\n    rtmr3: dcapMeasurements.rtmr3,\n    pubkeyHex: response.pubkey.toLowerCase(),\n    localAttestation: false,\n  };\n}\n\nfunction verifyLocalAttestation(params: {\n  response: AttestResponse;\n  expectedNonce: Uint8Array;\n  expectedNoiseStaticPub: Uint8Array;\n  policy: AttestationPolicy;\n}): AttestedMetadata {\n  const { response, expectedNonce, expectedNoiseStaticPub, policy } = params;\n\n  if (policy.allowLocalAttestation !== true) {\n    throw err(\n      \"LOCAL_ATTESTATION_DISABLED\",\n      \"local attestation response received but local attestation is not enabled\",\n    );\n  }\n  if (policy.requiredMode !== undefined && response.mode !== policy.requiredMode) {\n    throw err(\n      \"MODE_MISMATCH\",\n      `attestation mode ${response.mode} does not match required ${policy.requiredMode}`,\n    );\n  }\n  if (response.mode !== \"dev\") {\n    throw err(\n      \"LOCAL_ATTESTATION_DISABLED\",\n      \"local attestation is only accepted for dev mode responses\",\n    );\n  }\n  if (response.nonce.toLowerCase() !== bytesToHex(expectedNonce)) {\n    throw err(\"NONCE_FIELD_MISMATCH\", `JSON nonce ${response.nonce} does not match verifier nonce`);\n  }\n  if (!/^[0-9a-f]{64}$/i.test(response.binary_hash)) {\n    throw err(\"BINARY_HASH_FORMAT\", \"binary_hash field is not a 32-byte hex digest\");\n  }\n\n  const expectedPubHex = bytesToHex(expectedNoiseStaticPub);\n  if (response.pubkey.toLowerCase() !== expectedPubHex) {\n    throw err(\n      \"PUBKEY_FIELD_MISMATCH\",\n      \"local attestation pubkey field does not match Noise static pubkey from handshake\",\n    );\n  }\n\n  return {\n    mode: response.mode,\n    binaryHash: response.binary_hash.toLowerCase(),\n    runtimeProfile: response.runtime_profile,\n    mrtd: \"local-dev-no-mrtd\",\n    rtmr0: \"local-dev-no-rtmr0\",\n    rtmr1: \"local-dev-no-rtmr1\",\n    rtmr2: \"local-dev-no-rtmr2\",\n    rtmr3: \"local-dev-no-rtmr3\",\n    pubkeyHex: response.pubkey.toLowerCase(),\n    localAttestation: true,\n  };\n}\n\n// ── Quote parsing ────────────────────────────────────────────────────────────\n\nfunction decodeQuoteB64(b64: string): Uint8Array {\n  let bin: string;\n  try {\n    bin = atob(b64);\n  } catch (e) {\n    throw err(\"QUOTE_DECODE\", `quote field is not valid base64: ${e}`);\n  }\n  const out = new Uint8Array(bin.length);\n  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n  return out;\n}\n\nfunction ensureStructure(raw: Uint8Array): void {\n  if (raw.length < HEADER_SIZE + BODY_SIZE + 4) {\n    throw err(\n      \"QUOTE_STRUCTURE\",\n      `quote too short: ${raw.length} bytes (need >= ${HEADER_SIZE + BODY_SIZE + 4})`,\n    );\n  }\n  const version = readU16LE(raw, HEADER_VERSION_OFF);\n  const attKey = readU16LE(raw, HEADER_ATT_KEY_OFF);\n  const teeType = readU32LE(raw, HEADER_TEE_TYPE_OFF);\n  if (version !== 4) {\n    throw err(\"QUOTE_STRUCTURE\", `unsupported quote version ${version}`);\n  }\n  if (teeType !== TDX_TEE_TYPE) {\n    throw err(\"QUOTE_STRUCTURE\", `not a TDX quote (TEE type 0x${teeType.toString(16)})`);\n  }\n  if (attKey !== ECDSA_P256_KEY_TYPE) {\n    throw err(\n      \"QUOTE_STRUCTURE\",\n      `unsupported attestation key type ${attKey} (expected ECDSA-P256)`,\n    );\n  }\n}\n\nfunction readSigData(raw: Uint8Array): Uint8Array {\n  const sigDataLen = readU32LE(raw, SIG_DATA_LEN_OFFSET);\n  const sigStart = SIG_DATA_LEN_OFFSET + 4;\n  if (raw.length < sigStart + sigDataLen) {\n    throw err(\"QUOTE_STRUCTURE\", \"quote truncated in signature data\");\n  }\n  return raw.subarray(sigStart, sigStart + sigDataLen);\n}\n\nfunction parseMeasurements(body: Uint8Array): {\n  mrtd: string;\n  rtmr0: string;\n  rtmr1: string;\n  rtmr2: string;\n  rtmr3: string;\n  tdAttr: string;\n} {\n  const m = (off: number) => bytesToHex(body.subarray(off, off + MEASUREMENT_LEN));\n  return {\n    mrtd: m(BODY_MRTD_OFF),\n    rtmr0: m(BODY_RTMR0_OFF),\n    rtmr1: m(BODY_RTMR1_OFF),\n    rtmr2: m(BODY_RTMR2_OFF),\n    rtmr3: m(BODY_RTMR3_OFF),\n    tdAttr: bytesToHex(body.subarray(BODY_TD_ATTR_OFF, BODY_TD_ATTR_OFF + 8)),\n  };\n}\n\n// ── PCK chain ────────────────────────────────────────────────────────────────\n\nconst PEM_BEGIN = \"-----BEGIN CERTIFICATE-----\";\nconst PEM_END = \"-----END CERTIFICATE-----\";\nconst PEM_BEGIN_BYTES = new TextEncoder().encode(PEM_BEGIN);\nconst PEM_END_BYTES = new TextEncoder().encode(PEM_END);\n\n/**\n * Byte-level substring search. Cannot use utf8 decode + string.indexOf here:\n * sig data is binary, and TextDecoder replaces invalid sequences with 0xFFFD\n * (3 bytes -> 1 char), so string indices do not line up with byte offsets.\n */\nfunction findBytes(hay: Uint8Array, needle: Uint8Array, from = 0): number {\n  if (needle.length === 0) return from;\n  const last = hay.length - needle.length;\n  outer: for (let i = from; i <= last; i++) {\n    for (let j = 0; j < needle.length; j++) {\n      if (hay[i + j] !== needle[j]) continue outer;\n    }\n    return i;\n  }\n  return -1;\n}\n\ntype ParsedQeCertificationData = {\n  qeReport: Uint8Array;\n  qeReportSig: Uint8Array;\n  qeAuthData: Uint8Array;\n  qeCertificationData: Uint8Array; // nested QE Certification Data v4 header + payload\n};\n\nfunction parseQeCertificationData(sigData: Uint8Array): ParsedQeCertificationData {\n  // Intel TDX DCAP Quote Library API, A.3.8 / A.3.11:\n  // Quote Signature Data v4 = quoteSig || attKey || QE Certification Data (type=6)\n  if (sigData.length < SIG_QE_CERT_DATA_OFF + SIG_QE_CERT_DATA_HEADER_SIZE) {\n    throw err(\"QUOTE_STRUCTURE\", \"signature data truncated before QE certification data header\");\n  }\n  const outerCertType = readU16LE(sigData, SIG_QE_CERT_DATA_OFF);\n  const outerCertSize = readU32LE(sigData, SIG_QE_CERT_DATA_OFF + 2);\n  if (outerCertType !== QE_CERT_TYPE_QE_REPORT_CERT_DATA) {\n    throw err(\n      \"QUOTE_STRUCTURE\",\n      `unexpected QE certification data type ${outerCertType} (expected ${QE_CERT_TYPE_QE_REPORT_CERT_DATA})`,\n    );\n  }\n\n  const outerDataStart = SIG_QE_CERT_DATA_OFF + SIG_QE_CERT_DATA_HEADER_SIZE;\n  const outerDataEnd = outerDataStart + outerCertSize;\n  if (sigData.length < outerDataEnd) {\n    throw err(\"QUOTE_STRUCTURE\", \"signature data truncated in outer QE certification data\");\n  }\n  const outerData = sigData.subarray(outerDataStart, outerDataEnd);\n  const qeReportSigOff = SIG_QE_REPORT_SIZE;\n  const qeAuthSizeOff = qeReportSigOff + SIG_QE_REPORT_SIG_SIZE;\n  const qeAuthDataOff = qeAuthSizeOff + 2;\n\n  if (outerData.length < qeAuthDataOff + SIG_QE_CERT_DATA_HEADER_SIZE) {\n    throw err(\n      \"QUOTE_STRUCTURE\",\n      \"signature data truncated before QE auth_data and nested certification data\",\n    );\n  }\n\n  const qeReport = outerData.subarray(0, SIG_QE_REPORT_SIZE);\n  const qeReportSig = outerData.subarray(qeReportSigOff, qeReportSigOff + SIG_QE_REPORT_SIG_SIZE);\n  const authSize = readU16LE(outerData, qeAuthSizeOff);\n  const qeAuthDataEnd = qeAuthDataOff + authSize;\n  if (outerData.length < qeAuthDataEnd + SIG_QE_CERT_DATA_HEADER_SIZE) {\n    throw err(\"QUOTE_STRUCTURE\", \"signature data truncated in QE auth_data\");\n  }\n\n  const qeAuthData = outerData.subarray(qeAuthDataOff, qeAuthDataEnd);\n  const nestedCertType = readU16LE(outerData, qeAuthDataEnd);\n  const nestedCertSize = readU32LE(outerData, qeAuthDataEnd + 2);\n  if (nestedCertType !== QE_CERT_TYPE_PCK_CHAIN) {\n    throw err(\n      \"PCK_CHAIN_MISSING\",\n      `cert data type ${nestedCertType} is not PCK chain (expected ${QE_CERT_TYPE_PCK_CHAIN})`,\n    );\n  }\n  const nestedDataEnd = qeAuthDataEnd + SIG_QE_CERT_DATA_HEADER_SIZE + nestedCertSize;\n  if (outerData.length < nestedDataEnd) {\n    throw err(\"QUOTE_STRUCTURE\", \"signature data truncated in nested QE certification data\");\n  }\n\n  return {\n    qeReport,\n    qeReportSig,\n    qeAuthData,\n    qeCertificationData: outerData.subarray(qeAuthDataEnd, nestedDataEnd),\n  };\n}\n\nfunction extractPckChain(qeCertificationData: Uint8Array): x509.X509Certificate[] {\n  if (qeCertificationData.length < SIG_QE_CERT_DATA_HEADER_SIZE) {\n    throw err(\"PCK_CHAIN_PARSE\", \"nested QE certification data header truncated\");\n  }\n  const certType = readU16LE(qeCertificationData, 0);\n  const certSize = readU32LE(qeCertificationData, 2);\n  if (certType !== QE_CERT_TYPE_PCK_CHAIN) {\n    throw err(\n      \"PCK_CHAIN_MISSING\",\n      `cert data type ${certType} is not PCK chain (expected ${QE_CERT_TYPE_PCK_CHAIN})`,\n    );\n  }\n  if (qeCertificationData.length < SIG_QE_CERT_DATA_HEADER_SIZE + certSize) {\n    throw err(\"PCK_CHAIN_PARSE\", \"nested QE certification data truncated\");\n  }\n\n  const certBytes = qeCertificationData.subarray(\n    SIG_QE_CERT_DATA_HEADER_SIZE,\n    SIG_QE_CERT_DATA_HEADER_SIZE + certSize,\n  );\n  const certs: x509.X509Certificate[] = [];\n  let cursor = 0;\n  while (cursor < certBytes.length) {\n    const begin = findBytes(certBytes, PEM_BEGIN_BYTES, cursor);\n    if (begin === -1) break;\n    const endTag = findBytes(certBytes, PEM_END_BYTES, begin);\n    if (endTag === -1) {\n      throw err(\"PCK_CHAIN_PARSE\", \"unterminated PEM block\");\n    }\n    const end = endTag + PEM_END_BYTES.length;\n    // PEM is ASCII inside the BEGIN..END markers, safe to decode.\n    const pem = new TextDecoder(\"utf-8\").decode(certBytes.subarray(begin, end));\n    try {\n      certs.push(new x509.X509Certificate(pem));\n    } catch (e) {\n      throw err(\"PCK_CHAIN_PARSE\", `failed to parse PEM cert: ${e}`);\n    }\n    cursor = end;\n  }\n\n  if (certs.length === 0) {\n    throw err(\"PCK_CHAIN_MISSING\", \"no parseable certs in PCK chain\");\n  }\n  // Intel DCAP requires at least: PCK leaf + Platform/Processor CA + Intel SGX Root CA.\n  if (certs.length < 3) {\n    throw err(\n      \"PCK_CHAIN_MISSING\",\n      `PCK chain has only ${certs.length} cert(s); Intel DCAP requires leaf + CA + Root (min 3)`,\n    );\n  }\n  return certs;\n}\n\nasync function verifyChainSignatures(chain: x509.X509Certificate[]): Promise<void> {\n  const now = new Date();\n  for (let i = 0; i < chain.length - 1; i++) {\n    const cert = chain[i];\n    // Validity period check - an expired PCK cert is invalid even with a good signature.\n    if (now < cert.notBefore) {\n      throw err(\n        \"PCK_CHAIN_SIGNATURE\",\n        `cert[${i}] (${cert.subject}) is not yet valid (notBefore=${cert.notBefore.toISOString()})`,\n      );\n    }\n    if (now > cert.notAfter) {\n      throw err(\n        \"PCK_CHAIN_SIGNATURE\",\n        `cert[${i}] (${cert.subject}) has expired (notAfter=${cert.notAfter.toISOString()})`,\n      );\n    }\n    let ok: boolean;\n    try {\n      ok = await chain[i].verify({ publicKey: chain[i + 1].publicKey });\n    } catch (e) {\n      throw err(\n        \"PCK_CHAIN_SIGNATURE\",\n        `cert[${i}] (${chain[i].subject}) signature verification threw: ${e}`,\n      );\n    }\n    if (!ok) {\n      throw err(\n        \"PCK_CHAIN_SIGNATURE\",\n        `cert[${i}] (${chain[i].subject}) signature does not verify against issuer cert[${i + 1}]`,\n      );\n    }\n  }\n  // Root must be self-signed and currently valid\n  const root = chain[chain.length - 1];\n  if (now < root.notBefore) {\n    throw err(\n      \"PCK_CHAIN_SIGNATURE\",\n      `root cert (${root.subject}) is not yet valid (notBefore=${root.notBefore.toISOString()})`,\n    );\n  }\n  if (now > root.notAfter) {\n    throw err(\n      \"PCK_CHAIN_SIGNATURE\",\n      `root cert (${root.subject}) has expired (notAfter=${root.notAfter.toISOString()})`,\n    );\n  }\n  let rootOk: boolean;\n  try {\n    rootOk = await root.verify({ publicKey: root.publicKey });\n  } catch (e) {\n    throw err(\n      \"PCK_CHAIN_SIGNATURE\",\n      `root cert (${root.subject}) self-signature verification threw: ${e}`,\n    );\n  }\n  if (!rootOk) {\n    throw err(\"PCK_CHAIN_SIGNATURE\", `root cert (${root.subject}) is not self-signed`);\n  }\n\n  // BasicConstraints structural check: every cert above the leaf must declare\n  // itself a CA (cA=true). Checking length alone is insufficient.\n  for (let i = 1; i < chain.length; i++) {\n    const bc = chain[i].getExtension(x509.BasicConstraintsExtension);\n    if (!bc || !bc.ca) {\n      throw err(\n        \"PCK_CHAIN_SIGNATURE\",\n        `cert[${i}] (${chain[i].subject}) is not a CA cert (BasicConstraints.cA is not true)`,\n      );\n    }\n  }\n}\n\nasync function leafSpki(leaf: x509.X509Certificate): Promise<Uint8Array> {\n  const key = await leaf.publicKey.export();\n  const spki = await crypto.subtle.exportKey(\"spki\", key);\n  return new Uint8Array(spki);\n}\n\n// ── Web Crypto helpers ───────────────────────────────────────────────────────\n\n/** Convert raw P-256 X||Y (64 bytes) into uncompressed SPKI bytes. */\nfunction rawXyToSpki(xy: Uint8Array): Uint8Array {\n  if (xy.length !== 64) {\n    throw err(\"QUOTE_STRUCTURE\", `attestation pubkey must be 64 bytes (got ${xy.length})`);\n  }\n  const uncompressed = new Uint8Array(65);\n  uncompressed[0] = 0x04;\n  uncompressed.set(xy, 1);\n\n  // SPKI prefix for ecPublicKey + secp256r1 (P-256), then BIT STRING wrapping the point.\n  const prefix = new Uint8Array([\n    0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a,\n    0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00,\n  ]);\n  return concat(prefix, uncompressed);\n}\n\nasync function verifyP256Signature(\n  spki: Uint8Array,\n  rsSig: Uint8Array,\n  data: Uint8Array,\n  failureReason: RefReason,\n  what: string,\n): Promise<void> {\n  if (rsSig.length !== 64) {\n    throw err(failureReason, `${what}: signature must be 64 bytes (r||s)`);\n  }\n  let key: CryptoKey;\n  try {\n    key = await crypto.subtle.importKey(\n      \"spki\",\n      spki as BufferSource,\n      { name: \"ECDSA\", namedCurve: \"P-256\" },\n      false,\n      [\"verify\"],\n    );\n  } catch (e) {\n    throw err(failureReason, `${what}: failed to import key: ${e}`);\n  }\n  const ok = await crypto.subtle.verify(\n    { name: \"ECDSA\", hash: \"SHA-256\" },\n    key,\n    rsSig as BufferSource,\n    data as BufferSource,\n  );\n  if (!ok) {\n    throw err(failureReason, `${what}: ECDSA verification failed`);\n  }\n}\n\nasync function sha256(data: Uint8Array): Promise<Uint8Array> {\n  return new Uint8Array(await crypto.subtle.digest(\"SHA-256\", data as BufferSource));\n}\n\nasync function sha256Hex(data: Uint8Array): Promise<string> {\n  return bytesToHex(await sha256(data));\n}\n\n// ── Tiny utilities ───────────────────────────────────────────────────────────\n\nfunction readU16LE(buf: Uint8Array, off: number): number {\n  return buf[off] | (buf[off + 1] << 8);\n}\n\nfunction readU32LE(buf: Uint8Array, off: number): number {\n  // >>> 0 to coerce to unsigned 32-bit\n  return (buf[off] | (buf[off + 1] << 8) | (buf[off + 2] << 16) | (buf[off + 3] << 24)) >>> 0;\n}\n\nfunction constantTimeEq(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n  return diff === 0;\n}\n\nfunction concat(a: Uint8Array, b: Uint8Array): Uint8Array {\n  const out = new Uint8Array(a.length + b.length);\n  out.set(a, 0);\n  out.set(b, a.length);\n  return out;\n}\n\nfunction bytesToHex(b: Uint8Array): string {\n  let s = \"\";\n  for (let i = 0; i < b.length; i++) s += b[i].toString(16).padStart(2, \"0\");\n  return s;\n}\n"]}