@ziffer-io/verify 0.1.0 → 0.2.0

package/README.md

@@ -1,121 +1,71 @@
 # @ziffer-io/verify
 
-The **third implementation** of ACP receipt verification. The first two live in the
-engine repository at the pin this workspace's `Cargo.toml` names: the Python reference
-(`reference/src/acp_executor.py`, the readable §9.3 checklist) and Rust
-(`crates/acp-decision`, the production decision path). This package lives in ziffer
-**only because the engine repository is publicly frozen and ziffer CI cannot reach new
-engine commits**; the mirrored corpus in `fixtures/` plus `tools/check-verify-mirror.py`
-is what keeps three copies of one rule honest. Engine-home for this package is revisited
-if the freeze lifts.
+Verify a ZIFFER decision receipt in your own process, against a key you configured yourself.
+
+## Install
 
 ```bash
 npm install @ziffer-io/verify
 ```
 
-Most integrations do not install this directly. `@ziffer-io/client` depends on it and re-exports
-`verifyReceipt`, so there is one verifier in your dependency tree rather than two that can
-disagree. Install it on its own when you verify receipts and never call the API.
+Node 22 or later. If you also call the ZIFFER API, install `@ziffer-io/client` instead. It
+depends on this package and re-exports `verifyReceipt`, so one verifier is in your tree.
 
-## What it does
+## Quickstart
 
 ```ts
-import { verifyReceipt, Refusal } from '@ziffer-io/verify';
-
-const verified = verifyReceipt(receiptJson, proposalBytes, {
-  classical, // Ed25519 verification key, 32 bytes, from the signed bundle (PB-12)
-  pq,        // ML-DSA-65 verification key, 1,952 bytes, same home
-  minSuite: 'hybrid-ed25519-mldsa65', // CR-4 floor, from the signed manifest
-});
-// throws Refusal on any defect; verified.proposalHash is the verifier's OWN hash
+import { readFileSync } from 'node:fs';
+import { verifyReceipt, type TrustAnchor } from '@ziffer-io/verify';
+
+const keys = JSON.parse(readFileSync(process.env.ZIFFER_TRUST_ANCHOR, 'utf8'));
+const anchor: TrustAnchor = {
+  classical: Buffer.from(keys.ed25519_pk_hex, 'hex'),
+  pq: Buffer.from(keys.mldsa65_pk_hex, 'hex'),
+  minSuite: process.env.ZIFFER_SUITE_FLOOR,
+};
+
+const proposalBytes = new TextEncoder().encode(JSON.stringify(proposal));
+const verified = verifyReceipt(receipt, proposalBytes, anchor);
+// It returned, so the receipt holds. verified.proposalHash is this verifier's own hash.
+await bank.transfer(amount, toAccount);   // your line, unchanged
 ```
 
-`verifyReceipt` runs exactly the **stateless** portion of the §9.3 checklist — the part
-answerable with only receipt + proposal + identity: AB-0 (receipt version 3 only),
-AB-5/AB-6 (signed-body exclusion and byte cap), CR-1/CR-4/CR-3 (suite known, floor by
-containment, hybrid **conjunctive** — every primitive must verify), 9.3-2 (decision
-domain), 9.3-3 (proposal hash **recomputed** from the caller's own bytes, never read
-from the message — RES-8), 9.3-5/L-14 (temporal position and window ceiling, over
-strictly parsed RFC 3339 UTC instants), WE-4/L-17 (nonce type and size).
-
-A pass means "the stateless set found nothing", never "the receipt may be consumed":
-steps 4 (policy basis), 6's CL-2 claim, 7 (grading recomputation), 7b (the quorum),
-8 (tenant scoping) and 9–10 need the signed bundle, the attester registry, a ledger and
-a context store, and are deliberately absent rather than approximated. The module doc in
-`src/verify.ts` carries the full table and the R/B/T classification.
-
-Every refusal is a thrown `Refusal` whose `clause` is spelled **exactly as the engine's
-Rust clause constants** spell it (`AB-0`, `AB-6`, `CR-1`, `CR-4`, `AT-8a`, `9.3-1`,
-`9.3-2`, `9.3-3`, `9.3-5`, `L-14`, `WE-4`, `L-17`) — the clause is what the three
-implementations are compared on.
-
-## What it does not do
-
-- **It is not a receipt gate.** A pass is "the stateless set found nothing", not "this receipt may
-  be consumed" — the paragraph above lists the six §9.3 steps that need a signed bundle, an
-  attester registry, a ledger and a context store, and are absent rather than approximated.
-- **It fetches nothing and trusts nothing you did not hand it.** The identity keys and the CR-4
-  suite floor are arguments. It will not read them from the receipt, because a verifier that takes
-  a derived security value from the party it is verifying is the defect class this specification
-  has published five corrections for (RES-8).
-- **It does not hash your proposal for you.** You pass the bytes your own code passes to the API,
-  and the verifier recomputes the hash from them. Handing it the hash would verify nothing.
-- **It has no `approve`, and no test mode that mints a receipt.** Signing lives behind keys this
-  package never holds.
-
-## Strict Ed25519, written out
-
-`@noble/curves`' `verify` with `{ zip215: false }` enforces canonical encodings but —
-like OpenSSL — does **not** refuse small-order points. The ACP-106 rule (a small-order
-public key or a small-order `R` makes the verification equation stop mentioning the
-message) is therefore written out in `src/ed25519.ts`, exactly as the Python reference
-writes it in `verify_prim` and Rust gets from `verify_strict`. The mirrored
-`fixtures/refused_ed25519.json` is the executable statement: every vector is accepted by
-RFC 8032 as OpenSSL implements it and refused by all three implementations. Deleting the
-guard here was observed to accept the corpus's `r_is_the_identity_point` vector.
-
-## Canonicalization, proven not transcribed
-
-`src/canon.ts` reproduces the engine canon (sorted keys at every depth by **code
-point** — not JS's UTF-16 unit order — no whitespace, raw UTF-8). The proof is a
-triangle: `fixtures/canon_vectors.json` was generated by importing and executing the
-engine's own `acp_executor.canon` (`fixtures/gen_canon_vectors.py`), the TS tests assert
-byte-identity with the fixture on every case, and `tools/check-verify-mirror.py`
-re-derives every case against the engine at the pin.
-
-**Disclosed divergence (fail-closed):** the engine accepts a float *nested* in a signed
-structure (the ACP-75 bug-for-bug agreement between Python and Rust). This
-implementation refuses any non-integer number at any depth under `AT-8a`, because
-`JSON.parse` collapses `1000.0` and `1000` into one value and reproducing the engine's
-bytes would be a guess about bytes it never saw. Integers beyond `2^53−1` are refused
-for the same reason (the ACP-54 integer-domain family reached from the JS side). No
-conforming wire receipt carries either — every temporal field is an RFC 3339 string
-since v1.3.28 (ACP-167). Both refusals are pinned by tests so the divergence cannot
-vanish silently.
-
-## Fixtures
-
-Byte-identical mirrors of engine files, each with a `.provenance.json` sidecar (source
-path, rev, sha256 — a header *inside* the JSON would change the bytes the identity claim
-is about): `refused_ed25519.json`, `python_signatures.json` (the reference's signatures,
-which this side must accept — the TS leg of `tests/python_interop.rs`' claim; its seeds
-also pin the test-key derivation mirror in `src/testkeys.ts`), and
-`instant-type-vectors.json` (this package is the shared instant corpus's fourth
-consumer). Plus the derived `canon_vectors.json` above. Re-mirror at a pin bump;
-`tools/check-verify-mirror.py` refuses a mirror whose provenance rev is not the
-workspace pin.
-
-## Running
-
-```sh
-pnpm --filter @ziffer-io/verify test        # tsc -b && node --test (27 tests)
-python3 tools/check-verify-mirror.py  # from the repo root; needs ACP_REPO_PATH at the pin
-```
+It reaches no network and trusts nothing it was not handed. The keys and the suite floor are
+arguments you pass in. The proposal hash is recomputed from your bytes, never read from the
+receipt.
+Key order and spacing do not matter, because the verifier canonicalises your bytes itself.
+
+`verifyReceipt` checks the answer. Your own `if` is what stops the action.
+
+## Configuration
+
+| Variable | What it is | Where the value comes from |
+| --- | --- | --- |
+| `ZIFFER_TRUST_ANCHOR` | Path to the public key file your receipts are signed under. | We give you the file. Take it from us, never from the API you are checking. |
+| `ZIFFER_SUITE_FLOOR` | The weakest signature suite you will accept. | You choose it. There is no default. |
+
+## When a request is refused
+
+Every refusal is a thrown `Refusal` whose `clause` names the rule that fired; the table of every
+clause, what it means and what to do is at https://ziffer.io/docs/refusals. Narrow with
+`instanceof Refusal`, record the clause, and do not retry it.
+
+## Documentation
+
+- Quickstart: https://ziffer.io/docs/quickstart
+- Integrating the SDK: https://ziffer.io/docs/developers/sdk
+- Every refusal: https://ziffer.io/docs/refusals
+- The specification: https://ziffer.io/docs/specification
+- Glossary: https://ziffer.io/docs/glossary
+
+## Support
+
+Write to hello@ziffer.io. Your trust anchor file and your suite floor come from us. So does an
+answer about a refusal you cannot explain.
 
-## Licence
+## License
 
-Proprietary. Copyright (c) 2026 code75 SASU, Paris, France. ZIFFER is a registered trademark of code75
-SASU. This package is **not open source**: it is licensed for use with the ZIFFER service under
-your agreement with code75, on the terms in `LICENSE` beside this file. The third-party
-open-source components it redistributes are listed in `THIRD-PARTY-NOTICES` and are governed by
-their own licences.
+Proprietary. Copyright (c) 2026 code75 SASU, Paris, France. ZIFFER is a registered trademark of
+code75 SASU. This package is not open source. Its use is governed by your agreement with code75
+and by `LICENSE` beside this file. The open-source components it redistributes are listed in
+`THIRD-PARTY-NOTICES`, under their own licences.

package/dist/cbor.d.ts

@@ -0,0 +1,87 @@
+/**
+ * AT-8a canonical CBOR (RFC 8949 §4.2) -- the ONE primitive this package did
+ * not already have, added for §8.6c and for nothing else.
+ *
+ * # Why a new module rather than a reused one
+ *
+ * `canon.ts` is the canonical JSON encoding, and it is the right preimage for
+ * every hash this verifier takes: the engine's `attestation_id` and AB-1 entry
+ * digest are `sha256:` over `acp_executor.canon` / `receipt.rs::canon`, both
+ * JSON, and this package reproduces those bytes. What CBOR is needed for is
+ * narrower and unavoidable: HM-3 says a human attester's assertion is canonical
+ * CBOR of `{authenticator_data, client_data_json, signature}`, and HM-1 says the
+ * credential's `public_key` is a COSE_Key, which is CBOR by RFC 9052. Those two
+ * byte strings arrive from the wire and must be DECODED; no JSON encoder can
+ * read them. So this is a decoder for two fixed shapes, not a general codec.
+ *
+ * The engine's twins are `crates/acp-crypto/src/cbor.rs` and
+ * `reference/src/acp_crypto.py`'s `_enc` / `_dec` / `decode_canonical`, and the
+ * rule this file takes from them verbatim is the last one:
+ *
+ * # Canonicity is proved by RE-ENCODING, not by a list of sub-rules
+ *
+ * {@link decodeCanonical} parses, re-encodes what it parsed, and refuses the
+ * input unless the two byte strings are identical. That single comparison
+ * carries every §4.2 requirement at once -- shortest-form arguments, definite
+ * lengths, map keys sorted by their ENCODED bytes, no duplicate keys -- and it
+ * cannot drift from the encoder the way a hand-written checklist of those rules
+ * can. The decoder still refuses the coarse violations itself (indefinite
+ * lengths, non-shortest arguments, reserved additional information) because a
+ * decoder that accepted them would have to invent a canonical form to compare
+ * against, and inventing one is normalising.
+ *
+ * Refused, never normalised (AT-8a): the AB-1 entry digest is taken over the
+ * bytes that arrived, so a second encoding of one assertion is a second digest
+ * for one human decision, and accepting both would put two receipt identities
+ * behind one approval -- the Z4 encoding split, reached through the assertion.
+ *
+ * # Floats and tags are absent on purpose
+ *
+ * Neither is encodable, so neither is decodable: a float has several
+ * representations of one value and no deterministic ordering story (WE-1), and
+ * a tag is a type this verifier has no shape for. They refuse as
+ * {@link CborError} rather than being skipped, because a decoder that silently
+ * ignores what it does not understand is a parser an attacker can steer.
+ */
+/** The input is not canonical CBOR, or is not CBOR at all. */
+export declare class CborError extends Error {
+    constructor(message: string);
+}
+/**
+ * What this decoder can produce. Deliberately NOT a general CBOR value type:
+ * a map key is an integer (COSE labels, RFC 9052 §7) or text (HM-3's three
+ * fields), and nothing here needs more.
+ */
+export type Cbor = boolean | null | bigint | Uint8Array | string | Cbor[] | CborMap;
+/**
+ * A CBOR map, kept as ordered entries rather than a JS object.
+ *
+ * An object would key everything by string and collapse the integer label `1`
+ * and the text key `"1"` into one entry -- two distinct CBOR values, and in
+ * COSE_Key the integer form is the only legal one. The order is the order the
+ * bytes carried, which the re-encode check has already proved canonical.
+ */
+export interface CborMap {
+    readonly entries: readonly (readonly [Cbor, Cbor])[];
+}
+/** Whether a decoded value is a map -- the narrowing the callers need. */
+export declare function cborIsMap(v: Cbor): v is CborMap;
+/** A map's keys, in the (canonical) order the bytes carried. */
+export declare function cborKeys(m: CborMap): Cbor[];
+/** The value at an integer label, or undefined. COSE_Key's accessor. */
+export declare function cborGetInt(m: CborMap, label: bigint): Cbor | undefined;
+/** The value at a text key, or undefined. The assertion map's accessor. */
+export declare function cborGetText(m: CborMap, key: string): Cbor | undefined;
+/** A decoded value as bytes, or null if it is not a byte string. */
+export declare function cborAsBytes(v: Cbor | undefined): Uint8Array | null;
+/** The canonical CBOR bytes of a value. Used by {@link decodeCanonical}'s proof. */
+export declare function cborEncode(value: Cbor): Uint8Array;
+/**
+ * AT-8a: parse AND prove canonicity. Any input that is not byte-identical to
+ * the canonical encoding of what it decodes to is REFUSED, never normalised.
+ *
+ * The engine's `decode_canonical` in one sentence, and the same sentence is the
+ * whole specification of this function.
+ */
+export declare function decodeCanonical(buf: Uint8Array): Cbor;
+//# sourceMappingURL=cbor.d.ts.map

package/dist/cbor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cbor.d.ts","sourceRoot":"","sources":["../src/cbor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,8DAA8D;AAC9D,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,IAAI,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;AAEpF;;;;;;;GAOG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;CACtD;AAMD,0EAA0E;AAC1E,wBAAgB,SAAS,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,OAAO,CAE/C;AAED,gEAAgE;AAChE,wBAAgB,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,EAAE,CAE3C;AAED,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAGtE;AAED,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAGrE;AAED,oEAAoE;AACpE,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,GAAG,SAAS,GAAG,UAAU,GAAG,IAAI,CAElE;AAsHD,oFAAoF;AACpF,wBAAgB,UAAU,CAAC,KAAK,EAAE,IAAI,GAAG,UAAU,CAIlD;AA0FD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAQrD"}

package/dist/cbor.js

@@ -0,0 +1,326 @@
+/**
+ * AT-8a canonical CBOR (RFC 8949 §4.2) -- the ONE primitive this package did
+ * not already have, added for §8.6c and for nothing else.
+ *
+ * # Why a new module rather than a reused one
+ *
+ * `canon.ts` is the canonical JSON encoding, and it is the right preimage for
+ * every hash this verifier takes: the engine's `attestation_id` and AB-1 entry
+ * digest are `sha256:` over `acp_executor.canon` / `receipt.rs::canon`, both
+ * JSON, and this package reproduces those bytes. What CBOR is needed for is
+ * narrower and unavoidable: HM-3 says a human attester's assertion is canonical
+ * CBOR of `{authenticator_data, client_data_json, signature}`, and HM-1 says the
+ * credential's `public_key` is a COSE_Key, which is CBOR by RFC 9052. Those two
+ * byte strings arrive from the wire and must be DECODED; no JSON encoder can
+ * read them. So this is a decoder for two fixed shapes, not a general codec.
+ *
+ * The engine's twins are `crates/acp-crypto/src/cbor.rs` and
+ * `reference/src/acp_crypto.py`'s `_enc` / `_dec` / `decode_canonical`, and the
+ * rule this file takes from them verbatim is the last one:
+ *
+ * # Canonicity is proved by RE-ENCODING, not by a list of sub-rules
+ *
+ * {@link decodeCanonical} parses, re-encodes what it parsed, and refuses the
+ * input unless the two byte strings are identical. That single comparison
+ * carries every §4.2 requirement at once -- shortest-form arguments, definite
+ * lengths, map keys sorted by their ENCODED bytes, no duplicate keys -- and it
+ * cannot drift from the encoder the way a hand-written checklist of those rules
+ * can. The decoder still refuses the coarse violations itself (indefinite
+ * lengths, non-shortest arguments, reserved additional information) because a
+ * decoder that accepted them would have to invent a canonical form to compare
+ * against, and inventing one is normalising.
+ *
+ * Refused, never normalised (AT-8a): the AB-1 entry digest is taken over the
+ * bytes that arrived, so a second encoding of one assertion is a second digest
+ * for one human decision, and accepting both would put two receipt identities
+ * behind one approval -- the Z4 encoding split, reached through the assertion.
+ *
+ * # Floats and tags are absent on purpose
+ *
+ * Neither is encodable, so neither is decodable: a float has several
+ * representations of one value and no deterministic ordering story (WE-1), and
+ * a tag is a type this verifier has no shape for. They refuse as
+ * {@link CborError} rather than being skipped, because a decoder that silently
+ * ignores what it does not understand is a parser an attacker can steer.
+ */
+/** The input is not canonical CBOR, or is not CBOR at all. */
+export class CborError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CborError';
+    }
+}
+function isCborMap(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v) && !(v instanceof Uint8Array);
+}
+/** Whether a decoded value is a map -- the narrowing the callers need. */
+export function cborIsMap(v) {
+    return isCborMap(v);
+}
+/** A map's keys, in the (canonical) order the bytes carried. */
+export function cborKeys(m) {
+    return m.entries.map(([k]) => k);
+}
+/** The value at an integer label, or undefined. COSE_Key's accessor. */
+export function cborGetInt(m, label) {
+    for (const [k, v] of m.entries)
+        if (typeof k === 'bigint' && k === label)
+            return v;
+    return undefined;
+}
+/** The value at a text key, or undefined. The assertion map's accessor. */
+export function cborGetText(m, key) {
+    for (const [k, v] of m.entries)
+        if (typeof k === 'string' && k === key)
+            return v;
+    return undefined;
+}
+/** A decoded value as bytes, or null if it is not a byte string. */
+export function cborAsBytes(v) {
+    return v instanceof Uint8Array ? v : null;
+}
+const MAJOR_UINT = 0;
+const MAJOR_NINT = 1;
+const MAJOR_BYTES = 2;
+const MAJOR_TEXT = 3;
+const MAJOR_ARRAY = 4;
+const MAJOR_MAP = 5;
+const MAJOR_SIMPLE = 7;
+/**
+ * RFC 8949 §4.2.1: the argument MUST use the shortest form that holds it.
+ *
+ * `bigint` throughout rather than `number`, because a CBOR argument is a full
+ * 64-bit unsigned integer and `number` loses digits past 2^53-1 -- the same
+ * defect `canon.ts` refuses on the JSON side, and here it would mean re-encoding
+ * a length to different bytes than arrived and calling the input non-canonical
+ * for the decoder's own reason.
+ */
+function encodeHead(major, value, out) {
+    const head = major << 5;
+    if (value < 24n) {
+        out.push(head | Number(value));
+        return;
+    }
+    let width;
+    if (value < 0x100n) {
+        out.push(head | 24);
+        width = 1;
+    }
+    else if (value < 0x10000n) {
+        out.push(head | 25);
+        width = 2;
+    }
+    else if (value < 0x100000000n) {
+        out.push(head | 26);
+        width = 4;
+    }
+    else if (value < 0x10000000000000000n) {
+        out.push(head | 27);
+        width = 8;
+    }
+    else {
+        throw new CborError('integer exceeds the 64-bit CBOR argument');
+    }
+    for (let i = width - 1; i >= 0; i -= 1) {
+        out.push(Number((value >> BigInt(i * 8)) & 0xffn));
+    }
+}
+function encodeInto(value, out) {
+    if (value === true) {
+        out.push(0xf5);
+        return;
+    }
+    if (value === false) {
+        out.push(0xf4);
+        return;
+    }
+    if (value === null) {
+        out.push(0xf6);
+        return;
+    }
+    if (typeof value === 'bigint') {
+        if (value >= 0n)
+            encodeHead(MAJOR_UINT, value, out);
+        else
+            encodeHead(MAJOR_NINT, -value - 1n, out);
+        return;
+    }
+    if (value instanceof Uint8Array) {
+        encodeHead(MAJOR_BYTES, BigInt(value.length), out);
+        for (const b of value)
+            out.push(b);
+        return;
+    }
+    if (typeof value === 'string') {
+        const bytes = new TextEncoder().encode(value);
+        encodeHead(MAJOR_TEXT, BigInt(bytes.length), out);
+        for (const b of bytes)
+            out.push(b);
+        return;
+    }
+    if (Array.isArray(value)) {
+        encodeHead(MAJOR_ARRAY, BigInt(value.length), out);
+        for (const item of value)
+            encodeInto(item, out);
+        return;
+    }
+    if (isCborMap(value)) {
+        // §4.2.1: keys sorted by their ENCODED bytes, bytewise lexicographic.
+        // Sorting by the decoded value would put the integer label -2 and the text
+        // key "x" in an order that depends on the comparison chosen rather than on
+        // the bytes, and the encoded order is the one the rule names.
+        const keyed = value.entries.map(([k, v]) => {
+            const kb = [];
+            encodeInto(k, kb);
+            return { kb, v };
+        });
+        keyed.sort((a, b) => compareBytes(a.kb, b.kb));
+        for (let i = 1; i < keyed.length; i += 1) {
+            const prev = keyed[i - 1];
+            const cur = keyed[i];
+            if (prev === undefined || cur === undefined)
+                continue; // unreachable; index in range
+            if (compareBytes(prev.kb, cur.kb) === 0)
+                throw new CborError('duplicate map key');
+        }
+        encodeHead(MAJOR_MAP, BigInt(keyed.length), out);
+        for (const { kb, v } of keyed) {
+            for (const b of kb)
+                out.push(b);
+            encodeInto(v, out);
+        }
+        return;
+    }
+    throw new CborError('value is not canonically encodable');
+}
+function compareBytes(a, b) {
+    const n = Math.min(a.length, b.length);
+    for (let i = 0; i < n; i += 1) {
+        const x = a[i];
+        const y = b[i];
+        if (x === undefined || y === undefined)
+            continue; // unreachable; index in range
+        if (x !== y)
+            return x - y;
+    }
+    return a.length - b.length;
+}
+/** The canonical CBOR bytes of a value. Used by {@link decodeCanonical}'s proof. */
+export function cborEncode(value) {
+    const out = [];
+    encodeInto(value, out);
+    return Uint8Array.from(out);
+}
+function decodeAt(buf, start) {
+    if (start >= buf.length)
+        throw new CborError('truncated');
+    const ib = buf[start];
+    if (ib === undefined)
+        throw new CborError('truncated'); // unreachable; bound checked
+    const major = ib >> 5;
+    const ai = ib & 0x1f;
+    let i = start + 1;
+    let value;
+    if (ai < 24) {
+        value = BigInt(ai);
+    }
+    else if (ai <= 27) {
+        const width = 1 << (ai - 24);
+        if (i + width > buf.length)
+            throw new CborError('truncated argument');
+        value = 0n;
+        for (let k = 0; k < width; k += 1) {
+            const b = buf[i + k];
+            if (b === undefined)
+                throw new CborError('truncated argument'); // unreachable
+            value = (value << 8n) | BigInt(b);
+        }
+        i += width;
+        // Shortest form (§4.2.1). Refused here as well as by the re-encode proof,
+        // because the value that re-encodes shorter would otherwise be decoded
+        // first and any shape check above would run on attacker-chosen bytes.
+        const floor = ai === 24 ? 24n : 1n << BigInt((width / 2) * 8);
+        if (value < floor)
+            throw new CborError('non-shortest argument');
+    }
+    else if (ai === 31) {
+        throw new CborError('indefinite length forbidden in canonical CBOR');
+    }
+    else {
+        throw new CborError(`reserved additional information ${ai}`);
+    }
+    switch (major) {
+        case MAJOR_UINT:
+            return { value, next: i };
+        case MAJOR_NINT:
+            return { value: -value - 1n, next: i };
+        case MAJOR_BYTES:
+        case MAJOR_TEXT: {
+            const len = Number(value);
+            if (!Number.isSafeInteger(len) || i + len > buf.length) {
+                throw new CborError('truncated string');
+            }
+            const slice = buf.subarray(i, i + len);
+            if (major === MAJOR_BYTES)
+                return { value: Uint8Array.from(slice), next: i + len };
+            // fatal: true -- invalid UTF-8 is a refusal, not a run of U+FFFD. A
+            // replacement character would make two distinct byte strings decode to
+            // one text value, which the re-encode proof would then report as
+            // non-canonical for the wrong reason.
+            return { value: new TextDecoder('utf-8', { fatal: true }).decode(slice), next: i + len };
+        }
+        case MAJOR_ARRAY: {
+            const n = Number(value);
+            if (!Number.isSafeInteger(n) || n > buf.length - i)
+                throw new CborError('truncated array');
+            const items = [];
+            for (let k = 0; k < n; k += 1) {
+                const d = decodeAt(buf, i);
+                items.push(d.value);
+                i = d.next;
+            }
+            return { value: items, next: i };
+        }
+        case MAJOR_MAP: {
+            const n = Number(value);
+            if (!Number.isSafeInteger(n) || n > buf.length - i)
+                throw new CborError('truncated map');
+            const entries = [];
+            for (let k = 0; k < n; k += 1) {
+                const key = decodeAt(buf, i);
+                const val = decodeAt(buf, key.next);
+                entries.push([key.value, val.value]);
+                i = val.next;
+            }
+            return { value: { entries }, next: i };
+        }
+        case MAJOR_SIMPLE:
+            if (value === 20n)
+                return { value: false, next: i };
+            if (value === 21n)
+                return { value: true, next: i };
+            if (value === 22n)
+                return { value: null, next: i };
+            throw new CborError('float or unsupported simple value');
+        default:
+            throw new CborError(`unsupported major type ${major}`);
+    }
+}
+/**
+ * AT-8a: parse AND prove canonicity. Any input that is not byte-identical to
+ * the canonical encoding of what it decodes to is REFUSED, never normalised.
+ *
+ * The engine's `decode_canonical` in one sentence, and the same sentence is the
+ * whole specification of this function.
+ */
+export function decodeCanonical(buf) {
+    const { value, next } = decodeAt(buf, 0);
+    if (next !== buf.length)
+        throw new CborError('trailing bytes');
+    const re = cborEncode(value);
+    if (re.length !== buf.length || !re.every((b, i) => b === buf[i])) {
+        throw new CborError('input is not the canonical encoding of its value');
+    }
+    return value;
+}
+//# sourceMappingURL=cbor.js.map

package/dist/cbor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cbor.js","sourceRoot":"","sources":["../src/cbor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,8DAA8D;AAC9D,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAqBD,SAAS,SAAS,CAAC,CAAO;IACxB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC;AAChG,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,CAAO;IAC/B,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,QAAQ,CAAC,CAAU;IACjC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,UAAU,CAAC,CAAU,EAAE,KAAa;IAClD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;QAAE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,CAAC,CAAC;IACnF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,CAAU,EAAE,GAAW;IACjD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;QAAE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,CAAC,CAAC;IACjF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,WAAW,CAAC,CAAmB;IAC7C,OAAO,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,KAAa,EAAE,KAAa,EAAE,GAAa;IAC7D,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC;IACxB,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/B,OAAO;IACT,CAAC;IACD,IAAI,KAAa,CAAC;IAClB,IAAI,KAAK,GAAG,MAAM,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACpB,KAAK,GAAG,CAAC,CAAC;IACZ,CAAC;SAAM,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACpB,KAAK,GAAG,CAAC,CAAC;IACZ,CAAC;SAAM,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACpB,KAAK,GAAG,CAAC,CAAC;IACZ,CAAC;SAAM,IAAI,KAAK,GAAG,oBAAoB,EAAE,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACpB,KAAK,GAAG,CAAC,CAAC;IACZ,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IAClE,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAW,EAAE,GAAa;IAC5C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,OAAO;IACT,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,OAAO;IACT,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,IAAI,EAAE;YAAE,UAAU,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;;YAC/C,UAAU,CAAC,UAAU,EAAE,CAAC,KAAK,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,sEAAsE;QACtE,2EAA2E;QAC3E,2EAA2E;QAC3E,8DAA8D;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;YACzC,MAAM,EAAE,GAAa,EAAE,CAAC;YACxB,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClB,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;gBAAE,SAAS,CAAC,8BAA8B;YACrF,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACpF,CAAC;QACD,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACjD,KAAK,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,KAAK,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY,CAAC,CAAoB,EAAE,CAAoB;IAC9D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS,CAAC,8BAA8B;QAChF,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;AAC7B,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,UAAU,CAAC,KAAW;IACpC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvB,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAOD,SAAS,QAAQ,CAAC,GAAe,EAAE,KAAa;IAC9C,IAAI,KAAK,IAAI,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,IAAI,EAAE,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,6BAA6B;IACrF,MAAM,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAClB,IAAI,KAAa,CAAC;IAClB,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;QACZ,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;SAAM,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACtE,KAAK,GAAG,EAAE,CAAC;QACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAI,SAAS,CAAC,oBAAoB,CAAC,CAAC,CAAC,cAAc;YAC9E,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,CAAC,IAAI,KAAK,CAAC;QACX,0EAA0E;QAC1E,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,IAAI,KAAK,GAAG,KAAK;YAAE,MAAM,IAAI,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,SAAS,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,UAAU;YACb,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5B,KAAK,UAAU;YACb,OAAO,EAAE,KAAK,EAAE,CAAC,KAAK,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACzC,KAAK,WAAW,CAAC;QACjB,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;gBACvD,MAAM,IAAI,SAAS,CAAC,kBAAkB,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;YACvC,IAAI,KAAK,KAAK,WAAW;gBAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC;YACnF,oEAAoE;YACpE,uEAAuE;YACvE,iEAAiE;YACjE,sCAAsC;YACtC,OAAO,EAAE,KAAK,EAAE,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC;QAC3F,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,CAAC,CAAC;YAC3F,MAAM,KAAK,GAAW,EAAE,CAAC;YACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACpB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACb,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACnC,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,eAAe,CAAC,CAAC;YACzF,MAAM,OAAO,GAA8B,EAAE,CAAC;YAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrC,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;YACf,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACzC,CAAC;QACD,KAAK,YAAY;YACf,IAAI,KAAK,KAAK,GAAG;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,KAAK,GAAG;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACnD,IAAI,KAAK,KAAK,GAAG;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;QAC3D;YACE,MAAM,IAAI,SAAS,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,GAAe;IAC7C,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC/D,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,EAAE,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}