@zkp2p/zkp2p-attestation 2.0.0 → 3.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/CHANGELOG.md +11 -1
  2. package/README.md +25 -11
  3. package/dist/index.cjs +2 -2
  4. package/dist/index.cjs.map +1 -1
  5. package/dist/index.d.cts +71 -29
  6. package/dist/index.d.ts +71 -29
  7. package/dist/index.js +2 -2
  8. package/dist/index.js.map +1 -1
  9. package/package.json +1 -1
package/dist/index.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/crypto/env.ts","../src/crypto/encoding.ts","../src/jwe/plaintext.ts","../src/jwe/encrypt.ts","../src/encryptBuyerTeeSessionMaterial.ts","../src/attestation/certChain.ts","../src/trust/awsNitroRoot.ts","../src/crypto/cbor.ts","../src/attestation/coseSign1.ts","../src/trust/pcr8.ts","../src/attestation/fetch.ts","../src/attestation/nonce.ts","../src/attestation/payloadFields.ts","../src/trust/pins.ts","../src/trust/resolveExpectedPcr8.ts","../src/fetchAndVerifyAttestation.ts","../src/createEncryptedBuyerTeeSessionMaterial.ts","../src/encryptIdentitySessionMaterial.ts","../src/createEncryptedIdentitySessionMaterial.ts","../src/encryptSellerCredentialUpload.ts","../src/createEncryptedSellerCredentialUpload.ts","../src/serviceResponse.ts","../src/requestIdentityAttestation.ts","../src/uploadSellerCredential.ts","../src/verifyBuyerTeePayment.ts","../src/client.ts","../src/eip712.ts","../src/verifyBuyerTeePaymentAttestation.ts","../src/verifyIdentityAttestation.ts","../src/verifySellerCredentialBundle.ts"],"sourcesContent":["export { createNitroAttestationClient } from \"./client\";\nexport { createEncryptedBuyerTeeSessionMaterial } from \"./createEncryptedBuyerTeeSessionMaterial\";\nexport { createEncryptedIdentitySessionMaterial } from \"./createEncryptedIdentitySessionMaterial\";\nexport { createEncryptedSellerCredentialUpload } from \"./createEncryptedSellerCredentialUpload\";\nexport { getUnifiedPaymentVerifierDomainSeparator, hashUtf8 } from \"./eip712\";\nexport { encryptBuyerTeeSessionMaterial } from \"./encryptBuyerTeeSessionMaterial\";\nexport { encryptIdentitySessionMaterial } from \"./encryptIdentitySessionMaterial\";\nexport { encryptSellerCredentialUpload } from \"./encryptSellerCredentialUpload\";\nexport type { NitroAttestationErrorCode, NitroServiceResponseErrorDetails } from \"./errors\";\nexport { NitroAttestationError } from \"./errors\";\nexport { fetchAndVerifyAttestation } from \"./fetchAndVerifyAttestation\";\nexport { requestIdentityAttestation } from \"./requestIdentityAttestation\";\nexport { AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX, AWS_NITRO_ROOT_PEM } from \"./trust/awsNitroRoot\";\nexport type * from \"./types\";\nexport { uploadSellerCredential } from \"./uploadSellerCredential\";\nexport { verifyBuyerTeePayment } from \"./verifyBuyerTeePayment\";\nexport { verifyBuyerTeePaymentAttestation } from \"./verifyBuyerTeePaymentAttestation\";\nexport { verifyIdentityAttestation } from \"./verifyIdentityAttestation\";\nexport { verifySellerCredentialBundle } from \"./verifySellerCredentialBundle\";\nexport type { NitroAttestationWarning } from \"./warnings\";\n","export type NitroAttestationErrorCode =\n | \"ATTESTATION_FETCH_FAILED\"\n | \"ATTESTATION_RESPONSE_INVALID\"\n | \"SERVICE_RESPONSE_ERROR\"\n | \"ATTESTATION_NONCE_MISMATCH\"\n | \"COSE_STRUCTURE_INVALID\"\n | \"COSE_ALG_UNSUPPORTED\"\n | \"COSE_SIGNATURE_INVALID_SIZE\"\n | \"PAYLOAD_FIELD_MISSING\"\n | \"NONCE_BINDING_FAILED\"\n | \"FRESHNESS_CHECK_FAILED\"\n | \"CERT_CHAIN_INVALID\"\n | \"CERT_NOT_TIME_VALID\"\n | \"AWS_ROOT_FINGERPRINT_MISMATCH\"\n | \"COSE_SIGNATURE_VERIFY_FAILED\"\n | \"PCR8_PIN_MISMATCH\"\n | \"TRUST_PIN_REQUIRED\"\n | \"SIGNER_NOT_TRUSTED\"\n | \"ATTESTATION_SIGNATURE_INVALID\"\n | \"ATTESTATION_BINDING_MISMATCH\"\n | \"ATTESTATION_EXPIRED\"\n | \"INVALID_PARAMETER\"\n | \"TIMEOUT\"\n | \"CRYPTO_UNAVAILABLE\";\n\nexport interface NitroServiceResponseErrorDetails extends Record<string, unknown> {\n status: number;\n statusCode?: number;\n message?: string;\n responseObject?: unknown;\n}\n\nexport class NitroAttestationError extends Error {\n readonly code: NitroAttestationErrorCode;\n override readonly cause?: unknown;\n readonly details?: Record<string, unknown>;\n\n constructor(\n code: NitroAttestationErrorCode,\n message: string,\n options: { cause?: unknown; details?: Record<string, unknown> } = {},\n ) {\n super(message);\n this.name = \"NitroAttestationError\";\n this.code = code;\n this.cause = options.cause;\n this.details = options.details;\n }\n}\n\nexport function fail(\n code: NitroAttestationErrorCode,\n message: string,\n options?: { cause?: unknown; details?: Record<string, unknown> },\n): never {\n throw new NitroAttestationError(code, message, options);\n}\n\nexport async function wrapCryptoFailure<T>(\n promise: Promise<T>,\n code: NitroAttestationErrorCode,\n message: string,\n): Promise<T> {\n try {\n return await promise;\n } catch (cause) {\n fail(code, message, { cause });\n }\n}\n","import { fail } from \"../errors\";\n\nexport interface CryptoProviderParts {\n subtle: SubtleCrypto;\n getRandomValues: (out: Uint8Array) => Uint8Array;\n}\n\nexport function resolveFetch(fetchOverride?: typeof fetch): typeof fetch {\n if (fetchOverride !== undefined) {\n if (typeof fetchOverride !== \"function\") {\n fail(\"CRYPTO_UNAVAILABLE\", \"fetch is unavailable; pass a fetch implementation\");\n }\n return fetchOverride;\n }\n\n if (typeof globalThis.fetch !== \"function\") {\n fail(\"CRYPTO_UNAVAILABLE\", \"fetch is unavailable; pass a fetch implementation\");\n }\n return globalThis.fetch.bind(globalThis);\n}\n\nexport function resolveSubtle(subtleOverride?: SubtleCrypto): SubtleCrypto {\n const subtle = subtleOverride ?? globalThis.crypto?.subtle;\n if (!subtle) {\n fail(\"CRYPTO_UNAVAILABLE\", \"SubtleCrypto is unavailable; pass params.subtle\");\n }\n return subtle;\n}\n\nexport function resolveGetRandomValues(\n getRandomValuesOverride?: (out: Uint8Array) => Uint8Array,\n): (out: Uint8Array) => Uint8Array {\n if (getRandomValuesOverride) {\n return getRandomValuesOverride;\n }\n\n const cryptoRef = globalThis.crypto;\n if (typeof cryptoRef?.getRandomValues !== \"function\") {\n fail(\"CRYPTO_UNAVAILABLE\", \"crypto.getRandomValues is unavailable; pass params.getRandomValues\");\n }\n return (out: Uint8Array) => cryptoRef.getRandomValues(out);\n}\n\nexport function resolveCryptoProvider(params: {\n subtle?: SubtleCrypto;\n getRandomValues?: (out: Uint8Array) => Uint8Array;\n}): CryptoProviderParts {\n return {\n subtle: resolveSubtle(params.subtle),\n getRandomValues: resolveGetRandomValues(params.getRandomValues),\n };\n}\n\nexport function asCrypto(subtle: SubtleCrypto, getRandomValues: (out: Uint8Array) => Uint8Array): Crypto {\n if (typeof getRandomValues !== \"function\") {\n fail(\"CRYPTO_UNAVAILABLE\", \"crypto.getRandomValues is unavailable; pass params.getRandomValues\");\n }\n return {\n subtle,\n getRandomValues,\n randomUUID: () => randomUuidV4(getRandomValues),\n } as Crypto;\n}\n\nfunction randomUuidV4(\n getRandomValues: (out: Uint8Array) => Uint8Array,\n): `${string}-${string}-${string}-${string}-${string}` {\n const bytes = getRandomValues(new Uint8Array(16));\n bytes[6] = (bytes[6] & 0x0f) | 0x40;\n bytes[8] = (bytes[8] & 0x3f) | 0x80;\n const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\"));\n return `${hex.slice(0, 4).join(\"\")}-${hex.slice(4, 6).join(\"\")}-${hex.slice(6, 8).join(\"\")}-${hex\n .slice(8, 10)\n .join(\"\")}-${hex.slice(10).join(\"\")}`;\n}\n","const BASE64_ALPHABET = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\nconst BASE64_LOOKUP = buildLookup(BASE64_ALPHABET);\n\nfunction buildLookup(alphabet: string): Record<string, number> {\n const lookup: Record<string, number> = {};\n for (let index = 0; index < alphabet.length; index += 1) {\n lookup[alphabet[index]] = index;\n }\n return lookup;\n}\n\nexport function bytesToHex(bytes: Uint8Array): string {\n let out = \"\";\n for (const byte of bytes) {\n out += byte.toString(16).padStart(2, \"0\");\n }\n return out;\n}\n\nexport function normalizeHex(value: string): string {\n return value.replace(/^0x/i, \"\").toLowerCase();\n}\n\nexport function hexToBytes(hex: string): Uint8Array {\n const normalized = normalizeHex(hex);\n if (normalized.length % 2 !== 0 || !/^[0-9a-f]*$/.test(normalized)) {\n throw new Error(`Invalid hex string: ${hex}`);\n }\n\n const bytes = new Uint8Array(normalized.length / 2);\n for (let index = 0; index < bytes.length; index += 1) {\n bytes[index] = Number.parseInt(normalized.slice(index * 2, index * 2 + 2), 16);\n }\n return bytes;\n}\n\nexport function utf8Encode(value: string): Uint8Array {\n if (typeof TextEncoder !== \"undefined\") {\n return new TextEncoder().encode(value);\n }\n\n const bytes: number[] = [];\n for (let index = 0; index < value.length; index += 1) {\n const codePoint = value.codePointAt(index) as number;\n if (codePoint > 0xffff) {\n index += 1;\n }\n if (codePoint <= 0x7f) {\n bytes.push(codePoint);\n } else if (codePoint <= 0x7ff) {\n bytes.push(0xc0 | (codePoint >> 6), 0x80 | (codePoint & 0x3f));\n } else if (codePoint <= 0xffff) {\n bytes.push(0xe0 | (codePoint >> 12), 0x80 | ((codePoint >> 6) & 0x3f), 0x80 | (codePoint & 0x3f));\n } else {\n bytes.push(\n 0xf0 | (codePoint >> 18),\n 0x80 | ((codePoint >> 12) & 0x3f),\n 0x80 | ((codePoint >> 6) & 0x3f),\n 0x80 | (codePoint & 0x3f),\n );\n }\n }\n return new Uint8Array(bytes);\n}\n\nexport function utf8Decode(bytes: Uint8Array): string {\n if (typeof TextDecoder !== \"undefined\") {\n return new TextDecoder().decode(bytes);\n }\n\n let out = \"\";\n for (let index = 0; index < bytes.length; index += 1) {\n const first = bytes[index];\n if (first < 0x80) {\n out += String.fromCodePoint(first);\n } else if ((first & 0xe0) === 0xc0) {\n out += String.fromCodePoint(((first & 0x1f) << 6) | (bytes[++index] & 0x3f));\n } else if ((first & 0xf0) === 0xe0) {\n out += String.fromCodePoint(((first & 0x0f) << 12) | ((bytes[++index] & 0x3f) << 6) | (bytes[++index] & 0x3f));\n } else {\n out += String.fromCodePoint(\n ((first & 0x07) << 18) |\n ((bytes[++index] & 0x3f) << 12) |\n ((bytes[++index] & 0x3f) << 6) |\n (bytes[++index] & 0x3f),\n );\n }\n }\n return out;\n}\n\nexport function base64Encode(bytes: Uint8Array): string {\n let out = \"\";\n for (let index = 0; index < bytes.length; index += 3) {\n const first = bytes[index];\n const second = bytes[index + 1] ?? 0;\n const third = bytes[index + 2] ?? 0;\n const triplet = (first << 16) | (second << 8) | third;\n\n out += BASE64_ALPHABET[(triplet >> 18) & 0x3f];\n out += BASE64_ALPHABET[(triplet >> 12) & 0x3f];\n out += index + 1 < bytes.length ? BASE64_ALPHABET[(triplet >> 6) & 0x3f] : \"=\";\n out += index + 2 < bytes.length ? BASE64_ALPHABET[triplet & 0x3f] : \"=\";\n }\n return out;\n}\n\nexport function base64Decode(value: string): Uint8Array {\n return decodeBase64(value, false);\n}\n\nexport function base64UrlEncode(bytes: Uint8Array): string {\n return base64Encode(bytes).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/, \"\");\n}\n\nexport function base64UrlDecode(value: string): Uint8Array {\n return decodeBase64(value, true);\n}\n\nfunction decodeBase64(value: string, urlSafe: boolean): Uint8Array {\n const stripped = value.replace(/\\s+/g, \"\");\n const normalized = urlSafe ? stripped.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\") : stripped;\n if (normalized.length % 4 === 1) {\n throw new Error(\"Invalid base64 length\");\n }\n const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n\n const bytes: number[] = [];\n for (let index = 0; index < padded.length; index += 4) {\n const chars = padded.slice(index, index + 4);\n const pad = chars.endsWith(\"==\") ? 2 : chars.endsWith(\"=\") ? 1 : 0;\n const a = lookupBase64(chars[0], BASE64_LOOKUP);\n const b = lookupBase64(chars[1], BASE64_LOOKUP);\n const c = chars[2] === \"=\" ? 0 : lookupBase64(chars[2], BASE64_LOOKUP);\n const d = chars[3] === \"=\" ? 0 : lookupBase64(chars[3], BASE64_LOOKUP);\n const triplet = (a << 18) | (b << 12) | (c << 6) | d;\n\n bytes.push((triplet >> 16) & 0xff);\n if (pad < 2) {\n bytes.push((triplet >> 8) & 0xff);\n }\n if (pad < 1) {\n bytes.push(triplet & 0xff);\n }\n }\n return new Uint8Array(bytes);\n}\n\nfunction lookupBase64(char: string, lookup: Record<string, number>): number {\n const value = lookup[char];\n if (value === undefined) {\n throw new Error(`Invalid base64 character: ${char}`);\n }\n return value;\n}\n\nexport function concatBytes(parts: Uint8Array[]): Uint8Array {\n const total = parts.reduce((sum, part) => sum + part.length, 0);\n const out = new Uint8Array(total);\n let offset = 0;\n for (const part of parts) {\n out.set(part, offset);\n offset += part.length;\n }\n return out;\n}\n\nexport function toUint8Array(value: ArrayBuffer | Uint8Array): Uint8Array {\n return value instanceof Uint8Array ? value : new Uint8Array(value);\n}\n\nexport function bytesToArrayBuffer(bytes: Uint8Array): ArrayBuffer {\n return new Uint8Array(bytes).buffer;\n}\n","import type {\n AttestedSellerUploadKey,\n BuyerTeeSessionMaterialPayloadFor,\n BuyerTeeSessionMaterialPlatform,\n IdentityPlatform,\n IdentitySessionMaterialPayloadFor,\n SellerCredentialUploadPayload,\n} from \"../types\";\n\nexport interface SellerCredentialUploadPlaintext {\n payeeId?: string;\n sessionMaterial: unknown;\n boundPubKeySha256: string;\n issuedAtMs: number;\n jweId: string;\n}\n\nexport interface BuyerTeeSessionMaterialPlaintext {\n platform: string;\n actionType: string;\n sessionMaterial: unknown;\n boundPubKeySha256: string;\n}\n\nexport type IdentitySessionMaterialPlaintext = BuyerTeeSessionMaterialPlaintext;\n\nexport function buildSellerCredentialUploadPlaintext(\n params: {\n key: AttestedSellerUploadKey;\n issuedAtMs: number;\n jweId: string;\n } & SellerCredentialUploadPayload,\n): SellerCredentialUploadPlaintext {\n const plaintext = {\n sessionMaterial: params.sessionMaterial,\n boundPubKeySha256: params.key.publicKeySha256Hex,\n issuedAtMs: params.issuedAtMs,\n jweId: params.jweId,\n };\n\n if (params.platform === \"wise\") {\n return plaintext;\n }\n\n return {\n payeeId: params.payeeId,\n ...plaintext,\n };\n}\n\nexport function buildBuyerTeeSessionMaterialPlaintext<P extends BuyerTeeSessionMaterialPlatform>(\n params: {\n key: AttestedSellerUploadKey;\n } & BuyerTeeSessionMaterialPayloadFor<P>,\n): BuyerTeeSessionMaterialPlaintext {\n return {\n platform: params.platform,\n actionType: params.actionType,\n sessionMaterial: params.sessionMaterial,\n boundPubKeySha256: params.key.publicKeySha256Hex,\n };\n}\n\nexport function buildIdentitySessionMaterialPlaintext<P extends IdentityPlatform>(\n params: {\n key: AttestedSellerUploadKey;\n } & IdentitySessionMaterialPayloadFor<P>,\n): IdentitySessionMaterialPlaintext {\n // Keep this wire shape in sync with src/common/nitroBridge/teeSessionUploadCipher.ts.\n return {\n platform: params.platform,\n actionType: params.actionType,\n sessionMaterial: params.sessionMaterial,\n boundPubKeySha256: params.key.publicKeySha256Hex,\n };\n}\n\nexport function stringifyUploadPlaintext(\n plaintext: SellerCredentialUploadPlaintext | BuyerTeeSessionMaterialPlaintext | IdentitySessionMaterialPlaintext,\n): string {\n return JSON.stringify(plaintext);\n}\n","import { base64UrlEncode, bytesToArrayBuffer, utf8Encode } from \"../crypto/encoding\";\nimport { fail, wrapCryptoFailure } from \"../errors\";\nimport type {\n AttestedSellerUploadKey,\n BuyerTeeSessionMaterialPlatform,\n EncryptBuyerTeeSessionMaterialParamsFor,\n EncryptIdentitySessionMaterialParamsFor,\n EncryptSellerCredentialUploadParams,\n IdentityPlatform,\n} from \"../types\";\nimport {\n buildBuyerTeeSessionMaterialPlaintext,\n buildIdentitySessionMaterialPlaintext,\n buildSellerCredentialUploadPlaintext,\n stringifyUploadPlaintext,\n} from \"./plaintext\";\n\nconst JWE_PROTECTED_HEADER = { alg: \"RSA-OAEP-256\", enc: \"A256GCM\" } as const;\nconst JWE_ID_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;\n\nexport async function encryptSellerCredentialUploadWithResolvedCrypto(params: {\n request: EncryptSellerCredentialUploadParams;\n subtle: SubtleCrypto;\n getRandomValues: (out: Uint8Array) => Uint8Array;\n now: () => number;\n}): Promise<string> {\n const issuedAtMs = params.request.issuedAtMs ?? params.now();\n const jweId = params.request.jweId ?? randomUuidV4(params.getRandomValues);\n assertJweId(jweId);\n\n return encryptKeyBoundPlaintextWithResolvedCrypto({\n key: params.request.key,\n plaintext: buildSellerCredentialUploadPlaintext({\n ...params.request,\n issuedAtMs,\n jweId,\n }),\n subtle: params.subtle,\n getRandomValues: params.getRandomValues,\n failureContext: \"seller credential upload\",\n });\n}\n\nexport async function encryptBuyerTeeSessionMaterialWithResolvedCrypto<\n P extends BuyerTeeSessionMaterialPlatform,\n>(params: {\n request: EncryptBuyerTeeSessionMaterialParamsFor<P>;\n subtle: SubtleCrypto;\n getRandomValues: (out: Uint8Array) => Uint8Array;\n}): Promise<string> {\n return encryptKeyBoundPlaintextWithResolvedCrypto({\n key: params.request.key,\n plaintext: buildBuyerTeeSessionMaterialPlaintext(params.request),\n subtle: params.subtle,\n getRandomValues: params.getRandomValues,\n failureContext: \"buyer TEE session material\",\n });\n}\n\nexport async function encryptIdentitySessionMaterialWithResolvedCrypto<P extends IdentityPlatform>(params: {\n request: EncryptIdentitySessionMaterialParamsFor<P>;\n subtle: SubtleCrypto;\n getRandomValues: (out: Uint8Array) => Uint8Array;\n}): Promise<string> {\n return encryptKeyBoundPlaintextWithResolvedCrypto({\n key: params.request.key,\n plaintext: buildIdentitySessionMaterialPlaintext(params.request),\n subtle: params.subtle,\n getRandomValues: params.getRandomValues,\n failureContext: \"identity session material\",\n });\n}\n\nasync function encryptKeyBoundPlaintextWithResolvedCrypto(params: {\n key: AttestedSellerUploadKey;\n plaintext: Parameters<typeof stringifyUploadPlaintext>[0];\n subtle: SubtleCrypto;\n getRandomValues: (out: Uint8Array) => Uint8Array;\n failureContext: string;\n}): Promise<string> {\n const plaintext = utf8Encode(stringifyUploadPlaintext(params.plaintext));\n\n const cek = params.getRandomValues(new Uint8Array(32));\n const rsaKey = await wrapCryptoFailure(\n params.subtle.importKey(\n \"spki\",\n bytesToArrayBuffer(params.key.publicKeyDer),\n { name: \"RSA-OAEP\", hash: \"SHA-256\" },\n false,\n [\"encrypt\"],\n ),\n \"CRYPTO_UNAVAILABLE\",\n \"Failed to import attested enclave-upload RSA public key\",\n );\n const encryptedKey = new Uint8Array(\n await wrapCryptoFailure(\n params.subtle.encrypt({ name: \"RSA-OAEP\" }, rsaKey, bytesToArrayBuffer(cek)),\n \"CRYPTO_UNAVAILABLE\",\n \"Failed to RSA-OAEP encrypt the content encryption key\",\n ),\n );\n\n const iv = params.getRandomValues(new Uint8Array(12));\n const protectedHeader = base64UrlEncode(utf8Encode(JSON.stringify(JWE_PROTECTED_HEADER)));\n const aad = utf8Encode(protectedHeader);\n const aesKey = await wrapCryptoFailure(\n params.subtle.importKey(\"raw\", bytesToArrayBuffer(cek), { name: \"AES-GCM\", length: 256 }, false, [\"encrypt\"]),\n \"CRYPTO_UNAVAILABLE\",\n \"Failed to import generated AES-GCM content encryption key\",\n );\n const encryptedPlaintext = new Uint8Array(\n await wrapCryptoFailure(\n params.subtle.encrypt(\n {\n name: \"AES-GCM\",\n iv: bytesToArrayBuffer(iv),\n additionalData: bytesToArrayBuffer(aad),\n tagLength: 128,\n },\n aesKey,\n bytesToArrayBuffer(plaintext),\n ),\n \"CRYPTO_UNAVAILABLE\",\n `Failed to AES-GCM encrypt ${params.failureContext}`,\n ),\n );\n const ciphertext = encryptedPlaintext.slice(0, encryptedPlaintext.length - 16);\n const tag = encryptedPlaintext.slice(encryptedPlaintext.length - 16);\n\n return [\n protectedHeader,\n base64UrlEncode(encryptedKey),\n base64UrlEncode(iv),\n base64UrlEncode(ciphertext),\n base64UrlEncode(tag),\n ].join(\".\");\n}\n\n// Seller upload only — buyer TEE envelopes no longer carry a jweId.\nfunction assertJweId(jweId: string): void {\n if (!JWE_ID_PATTERN.test(jweId)) {\n fail(\"INVALID_PARAMETER\", \"jweId must be 16-128 URL-safe characters\");\n }\n}\n\n// Seller upload only — buyer TEE envelopes no longer carry a jweId.\nfunction randomUuidV4(getRandomValues: (out: Uint8Array) => Uint8Array): string {\n const bytes = getRandomValues(new Uint8Array(16));\n bytes[6] = (bytes[6] & 0x0f) | 0x40;\n bytes[8] = (bytes[8] & 0x3f) | 0x80;\n const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\"));\n return `${hex.slice(0, 4).join(\"\")}-${hex.slice(4, 6).join(\"\")}-${hex.slice(6, 8).join(\"\")}-${hex\n .slice(8, 10)\n .join(\"\")}-${hex.slice(10).join(\"\")}`;\n}\n","import { resolveCryptoProvider } from \"./crypto/env\";\nimport { encryptBuyerTeeSessionMaterialWithResolvedCrypto } from \"./jwe/encrypt\";\nimport type { BuyerTeeSessionMaterialPlatform, EncryptBuyerTeeSessionMaterialParamsFor } from \"./types\";\n\nexport async function encryptBuyerTeeSessionMaterial<P extends BuyerTeeSessionMaterialPlatform>(\n params: EncryptBuyerTeeSessionMaterialParamsFor<P>,\n): Promise<string> {\n const crypto = resolveCryptoProvider(params);\n return encryptBuyerTeeSessionMaterialWithResolvedCrypto({\n request: params,\n subtle: crypto.subtle,\n getRandomValues: crypto.getRandomValues,\n });\n}\n","import { X509Certificate } from \"@peculiar/x509\";\nimport { bytesToHex } from \"../crypto/encoding\";\nimport { asCrypto } from \"../crypto/env\";\nimport { fail, wrapCryptoFailure } from \"../errors\";\nimport { AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX, AWS_NITRO_ROOT_PEM } from \"../trust/awsNitroRoot\";\nimport type { NitroAttestationWarning } from \"../warnings\";\n\nconst CERT_EXPIRY_WARNING_WINDOW_MS = 7 * 24 * 60 * 60 * 1000;\n\nexport interface VerifiedCertificateChain {\n leafCertificate: X509Certificate;\n leafPublicKey: CryptoKey;\n}\n\nexport async function verifyCertificateChain(params: {\n leafCertificateDer: Uint8Array;\n cabundleDer: Uint8Array[];\n rootPem?: string;\n nowMs: number;\n subtle: SubtleCrypto;\n getRandomValues: (out: Uint8Array) => Uint8Array;\n onWarning?: (warning: NitroAttestationWarning) => void;\n}): Promise<VerifiedCertificateChain> {\n const crypto = asCrypto(params.subtle, params.getRandomValues);\n const rootCertificate = parseCertificate(params.rootPem ?? AWS_NITRO_ROOT_PEM, \"AWS Nitro root certificate\");\n const rootFingerprint = await certificateSha256(rootCertificate, params.subtle);\n\n if (rootFingerprint !== AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX) {\n fail(\"AWS_ROOT_FINGERPRINT_MISMATCH\", \"Bundled AWS Nitro root certificate fingerprint mismatch\", {\n details: { expected: AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX, actual: rootFingerprint },\n });\n }\n\n const leafCertificate = parseCertificate(params.leafCertificateDer, \"attestation leaf certificate\");\n const cabundle = params.cabundleDer.map((der, index) => parseCertificate(der, `cabundle[${index}]`));\n const allCertificates = [rootCertificate, ...cabundle, leafCertificate];\n for (const certificate of allCertificates) {\n assertCertificateTimeValid(certificate, params.nowMs);\n warnNearExpiry(certificate, params.nowMs, params.onWarning);\n }\n\n const leafFingerprint = await certificateSha256(leafCertificate, params.subtle);\n const intermediates = [];\n for (const certificate of cabundle) {\n const fingerprint = await certificateSha256(certificate, params.subtle);\n if (fingerprint !== leafFingerprint && fingerprint !== rootFingerprint) {\n intermediates.push(certificate);\n }\n }\n\n const candidates = [\n [leafCertificate, ...intermediates.slice().reverse(), rootCertificate],\n [leafCertificate, ...intermediates, rootCertificate],\n ];\n\n for (const candidate of candidates) {\n if (await verifyChainLinks(candidate, crypto)) {\n const leafPublicKey = await wrapCryptoFailure(\n leafCertificate.publicKey.export({ name: \"ECDSA\", namedCurve: \"P-384\" }, [\"verify\"], crypto),\n \"CERT_CHAIN_INVALID\",\n \"Failed to export attestation leaf public key\",\n );\n return { leafCertificate, leafPublicKey };\n }\n }\n\n fail(\"CERT_CHAIN_INVALID\", \"Attestation certificate chain does not verify to the pinned AWS Nitro root\");\n}\n\nasync function verifyChainLinks(chain: X509Certificate[], crypto: Crypto): Promise<boolean> {\n for (let index = 0; index < chain.length - 1; index += 1) {\n const subject = chain[index];\n const issuer = chain[index + 1];\n const ok = await subject.verify({ publicKey: issuer.publicKey, signatureOnly: true }, crypto);\n if (!ok) {\n return false;\n }\n }\n\n return chain.length > 0 && (await chain[chain.length - 1].isSelfSigned(crypto));\n}\n\nfunction parseCertificate(raw: string | Uint8Array, label: string): X509Certificate {\n try {\n return new X509Certificate(raw);\n } catch (cause) {\n fail(\"CERT_CHAIN_INVALID\", `Could not parse ${label}`, { cause });\n }\n}\n\nasync function certificateSha256(certificate: X509Certificate, subtle: SubtleCrypto): Promise<string> {\n return bytesToHex(new Uint8Array(await subtle.digest(\"SHA-256\", certificate.rawData)));\n}\n\nfunction assertCertificateTimeValid(certificate: X509Certificate, nowMs: number): void {\n if (nowMs < certificate.notBefore.getTime() || nowMs > certificate.notAfter.getTime()) {\n fail(\"CERT_NOT_TIME_VALID\", \"Certificate is outside its validity window\", {\n details: {\n subject: certificate.subject,\n notBefore: certificate.notBefore.toISOString(),\n notAfter: certificate.notAfter.toISOString(),\n },\n });\n }\n}\n\nfunction warnNearExpiry(\n certificate: X509Certificate,\n nowMs: number,\n onWarning?: (warning: NitroAttestationWarning) => void,\n): void {\n if (certificate.notAfter.getTime() < nowMs + CERT_EXPIRY_WARNING_WINDOW_MS) {\n onWarning?.({\n code: \"CERT_VALIDITY_NEAR_EXPIRY\",\n message: \"Certificate in Nitro attestation chain expires within 7 days\",\n details: {\n subject: certificate.subject,\n notAfter: certificate.notAfter.toISOString(),\n },\n });\n }\n}\n","export const AWS_NITRO_ROOT_PEM = `-----BEGIN CERTIFICATE-----\nMIICETCCAZagAwIBAgIRAPkxdWgbkK/hHUbMtOTn+FYwCgYIKoZIzj0EAwMwSTEL\nMAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMRswGQYD\nVQQDDBJhd3Mubml0cm8tZW5jbGF2ZXMwHhcNMTkxMDI4MTMyODA1WhcNNDkxMDI4\nMTQyODA1WjBJMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQL\nDANBV1MxGzAZBgNVBAMMEmF3cy5uaXRyby1lbmNsYXZlczB2MBAGByqGSM49AgEG\nBSuBBAAiA2IABPwCVOumCMHzaHDimtqQvkY4MpJzbolL//Zy2YlES1BR5TSksfbb\n48C8WBoyt7F2Bw7eEtaaP+ohG2bnUs990d0JX28TcPQXCEPZ3BABIeTPYwEoCWZE\nh8l5YoQwTcU/9KNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUkCW1DdkF\nR+eWw5b6cp3PmanfS5YwDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMDA2kAMGYC\nMQCjfy+Rocm9Xue4YnwWmNJVA44fA0P5W2OpYow9OYCVRaEevL8uO1XYru5xtMPW\nrfMCMQCi85sWBbJwKKXdS6BptQFuZbT73o/gBh1qUxl/nNr12UO8Yfwr6wPLb+6N\nIwLz3/Y=\n-----END CERTIFICATE-----\n`;\n\nexport const AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX = \"641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68f79bb5b\";\n","import { concatBytes, utf8Decode, utf8Encode } from \"./encoding\";\n\nexport type CborValue =\n | bigint\n | number\n | string\n | Uint8Array\n | CborValue[]\n | Map<CborValue, CborValue>\n | boolean\n | null;\n\nexport function decodeCbor(bytes: Uint8Array): CborValue {\n const reader = new CborReader(bytes);\n const value = reader.readValue();\n if (!reader.done()) {\n throw new Error(\"Trailing CBOR bytes\");\n }\n return value;\n}\n\nexport function encodeCbor(value: CborValue): Uint8Array {\n if (typeof value === \"number\") {\n if (!Number.isSafeInteger(value)) {\n throw new Error(\"CBOR number must be a safe integer\");\n }\n return value >= 0 ? encodeTypeAndLength(0, value) : encodeTypeAndLength(1, -1 - value);\n }\n if (typeof value === \"bigint\") {\n return value >= 0n ? encodeTypeAndLength(0, value) : encodeTypeAndLength(1, -1n - value);\n }\n if (typeof value === \"string\") {\n const encoded = utf8Encode(value);\n return concatBytes([encodeTypeAndLength(3, encoded.length), encoded]);\n }\n if (value instanceof Uint8Array) {\n return concatBytes([encodeTypeAndLength(2, value.length), value]);\n }\n if (Array.isArray(value)) {\n return concatBytes([encodeTypeAndLength(4, value.length), ...value.map(encodeCbor)]);\n }\n if (value instanceof Map) {\n // This minimal encoder preserves Map insertion order; callers that need canonical map ordering must sort first.\n return concatBytes([\n encodeTypeAndLength(5, value.size),\n ...Array.from(value.entries()).flatMap(([k, v]) => [encodeCbor(k), encodeCbor(v)]),\n ]);\n }\n if (typeof value === \"boolean\") {\n return new Uint8Array([value ? 0xf5 : 0xf4]);\n }\n if (value === null) {\n return new Uint8Array([0xf6]);\n }\n throw new Error(\"Unsupported CBOR value\");\n}\n\nexport function encodeCoseSigStructure1(protectedHeadersBytes: Uint8Array, payloadBytes: Uint8Array): Uint8Array {\n return encodeCbor([\"Signature1\", protectedHeadersBytes, new Uint8Array(), payloadBytes]);\n}\n\nfunction encodeTypeAndLength(majorType: number, length: number | bigint): Uint8Array {\n const bigintLength = BigInt(length);\n if (bigintLength < 24n) {\n return new Uint8Array([(majorType << 5) | Number(bigintLength)]);\n }\n if (bigintLength <= 0xffn) {\n return new Uint8Array([(majorType << 5) | 24, Number(bigintLength)]);\n }\n if (bigintLength <= 0xffffn) {\n return new Uint8Array([(majorType << 5) | 25, Number((bigintLength >> 8n) & 0xffn), Number(bigintLength & 0xffn)]);\n }\n if (bigintLength <= 0xffffffffn) {\n return new Uint8Array([\n (majorType << 5) | 26,\n Number((bigintLength >> 24n) & 0xffn),\n Number((bigintLength >> 16n) & 0xffn),\n Number((bigintLength >> 8n) & 0xffn),\n Number(bigintLength & 0xffn),\n ]);\n }\n\n return new Uint8Array([\n (majorType << 5) | 27,\n Number((bigintLength >> 56n) & 0xffn),\n Number((bigintLength >> 48n) & 0xffn),\n Number((bigintLength >> 40n) & 0xffn),\n Number((bigintLength >> 32n) & 0xffn),\n Number((bigintLength >> 24n) & 0xffn),\n Number((bigintLength >> 16n) & 0xffn),\n Number((bigintLength >> 8n) & 0xffn),\n Number(bigintLength & 0xffn),\n ]);\n}\n\nclass CborReader {\n private offset = 0;\n\n constructor(private readonly bytes: Uint8Array) {}\n\n done(): boolean {\n return this.offset === this.bytes.length;\n }\n\n readValue(): CborValue {\n const head = this.readByte();\n const majorType = head >> 5;\n const additional = head & 0x1f;\n\n if (additional === 31) {\n return this.readIndefiniteValue(majorType);\n }\n\n if (majorType === 0) {\n return this.readLength(additional);\n }\n if (majorType === 1) {\n const value = this.readLength(additional);\n return typeof value === \"bigint\" ? -1n - value : -1 - value;\n }\n if (majorType === 2) {\n const length = this.lengthAsNumber(this.readLength(additional));\n return this.readBytes(length);\n }\n if (majorType === 3) {\n const length = this.lengthAsNumber(this.readLength(additional));\n return utf8Decode(this.readBytes(length));\n }\n if (majorType === 4) {\n const length = this.lengthAsNumber(this.readLength(additional));\n const out: CborValue[] = [];\n for (let index = 0; index < length; index += 1) {\n out.push(this.readValue());\n }\n return out;\n }\n if (majorType === 5) {\n const length = this.lengthAsNumber(this.readLength(additional));\n const out = new Map<CborValue, CborValue>();\n for (let index = 0; index < length; index += 1) {\n out.set(this.readValue(), this.readValue());\n }\n return out;\n }\n if (majorType === 6) {\n this.readLength(additional);\n return this.readValue();\n }\n if (majorType === 7) {\n if (additional === 20) {\n return false;\n }\n if (additional === 21) {\n return true;\n }\n if (additional === 22) {\n return null;\n }\n }\n throw new Error(`Unsupported CBOR major/additional type: ${majorType}/${additional}`);\n }\n\n private readIndefiniteValue(majorType: number): CborValue {\n if (majorType === 2) {\n const chunks: Uint8Array[] = [];\n while (!this.consumeBreak()) {\n const chunk = this.readValue();\n if (!(chunk instanceof Uint8Array)) {\n throw new Error(\"Indefinite CBOR byte string chunk must be a byte string\");\n }\n chunks.push(chunk);\n }\n return concatBytes(chunks);\n }\n if (majorType === 3) {\n let out = \"\";\n while (!this.consumeBreak()) {\n const chunk = this.readValue();\n if (typeof chunk !== \"string\") {\n throw new Error(\"Indefinite CBOR text string chunk must be a text string\");\n }\n out += chunk;\n }\n return out;\n }\n if (majorType === 4) {\n const out: CborValue[] = [];\n while (!this.consumeBreak()) {\n out.push(this.readValue());\n }\n return out;\n }\n if (majorType === 5) {\n const out = new Map<CborValue, CborValue>();\n while (!this.consumeBreak()) {\n const key = this.readValue();\n if (this.peekBreak()) {\n throw new Error(\"Indefinite CBOR map ended after a key\");\n }\n out.set(key, this.readValue());\n }\n return out;\n }\n throw new Error(`Indefinite CBOR major type ${majorType} is not supported`);\n }\n\n private readLength(additional: number): number | bigint {\n if (additional < 24) {\n return additional;\n }\n if (additional === 24) {\n return this.readByte();\n }\n if (additional === 25) {\n return (this.readByte() << 8) | this.readByte();\n }\n if (additional === 26) {\n return (this.readByte() * 0x1000000 + (this.readByte() << 16) + (this.readByte() << 8) + this.readByte()) >>> 0;\n }\n if (additional === 27) {\n let value = 0n;\n for (let index = 0; index < 8; index += 1) {\n value = (value << 8n) | BigInt(this.readByte());\n }\n return value <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(value) : value;\n }\n throw new Error(\"Indefinite CBOR lengths are not supported\");\n }\n\n private readByte(): number {\n if (this.offset >= this.bytes.length) {\n throw new Error(\"Unexpected end of CBOR input\");\n }\n return this.bytes[this.offset++];\n }\n\n private peekBreak(): boolean {\n return this.offset < this.bytes.length && this.bytes[this.offset] === 0xff;\n }\n\n private consumeBreak(): boolean {\n if (this.peekBreak()) {\n this.offset += 1;\n return true;\n }\n return false;\n }\n\n private readBytes(length: number): Uint8Array {\n if (this.offset + length > this.bytes.length) {\n throw new Error(\"Unexpected end of CBOR byte string\");\n }\n const out = this.bytes.slice(this.offset, this.offset + length);\n this.offset += length;\n return out;\n }\n\n private lengthAsNumber(value: number | bigint): number {\n if (typeof value === \"bigint\") {\n throw new Error(\"CBOR length exceeds JavaScript safe integer range\");\n }\n return value;\n }\n}\n","import { decodeCbor, encodeCoseSigStructure1 } from \"../crypto/cbor\";\nimport { fail, wrapCryptoFailure } from \"../errors\";\n\nexport interface DecodedCoseSign1 {\n protectedHeadersBytes: Uint8Array;\n payloadBytes: Uint8Array;\n signature: Uint8Array;\n}\n\nexport function decodeCoseSign1(attestationDocument: Uint8Array): DecodedCoseSign1 {\n const untagged = attestationDocument[0] === 0xd2 ? attestationDocument.slice(1) : attestationDocument;\n let decoded: unknown;\n try {\n decoded = decodeCbor(untagged);\n } catch (cause) {\n fail(\"COSE_STRUCTURE_INVALID\", \"Attestation document is not a valid COSE_Sign1 CBOR value\", { cause });\n }\n\n if (!Array.isArray(decoded) || decoded.length !== 4) {\n fail(\"COSE_STRUCTURE_INVALID\", \"COSE_Sign1 must be [protected, unprotected, payload, signature]\");\n }\n\n const [protectedHeadersBytes, unprotectedHeaders, payloadBytes, signature] = decoded;\n if (\n !(protectedHeadersBytes instanceof Uint8Array) ||\n !(unprotectedHeaders instanceof Map) ||\n !(payloadBytes instanceof Uint8Array) ||\n !(signature instanceof Uint8Array)\n ) {\n fail(\"COSE_STRUCTURE_INVALID\", \"COSE_Sign1 fields have invalid CBOR types\");\n }\n\n assertProtectedHeader(protectedHeadersBytes);\n if (signature.length !== 96) {\n fail(\"COSE_SIGNATURE_INVALID_SIZE\", `Expected a 96-byte ES384 signature, got ${signature.length} bytes`);\n }\n\n return { protectedHeadersBytes, payloadBytes, signature };\n}\n\nexport async function verifyCoseSignature(params: {\n protectedHeadersBytes: Uint8Array;\n payloadBytes: Uint8Array;\n signature: Uint8Array;\n leafPublicKey: CryptoKey;\n subtle: SubtleCrypto;\n}): Promise<void> {\n const sigStructure = encodeCoseSigStructure1(params.protectedHeadersBytes, params.payloadBytes);\n const ok = await wrapCryptoFailure(\n params.subtle.verify({ name: \"ECDSA\", hash: \"SHA-384\" }, params.leafPublicKey, params.signature, sigStructure),\n \"COSE_SIGNATURE_VERIFY_FAILED\",\n \"COSE_Sign1 signature verification failed\",\n );\n if (!ok) {\n fail(\"COSE_SIGNATURE_VERIFY_FAILED\", \"COSE_Sign1 signature does not verify with the attestation leaf certificate\");\n }\n}\n\nfunction assertProtectedHeader(protectedHeadersBytes: Uint8Array): void {\n let decoded: unknown;\n try {\n decoded = decodeCbor(protectedHeadersBytes);\n } catch (cause) {\n fail(\"COSE_STRUCTURE_INVALID\", \"COSE protected headers are not a valid CBOR map\", { cause });\n }\n if (!(decoded instanceof Map)) {\n fail(\"COSE_STRUCTURE_INVALID\", \"COSE protected headers must be a CBOR map\");\n }\n if (decoded.get(1) !== -35) {\n fail(\"COSE_ALG_UNSUPPORTED\", \"COSE protected header alg must be -35 (ES384)\");\n }\n}\n","import { fail } from \"../errors\";\n\nconst PCR8_HEX_LENGTH = 96;\n\nexport function normalizePcr8Pin(value: string, label: string): string {\n const normalized = value.replace(/^0x/i, \"\").toLowerCase();\n if (normalized.length !== PCR8_HEX_LENGTH || !/^[0-9a-f]+$/.test(normalized)) {\n fail(\"TRUST_PIN_REQUIRED\", `${label} must be ${PCR8_HEX_LENGTH} lowercase hex characters`);\n }\n return normalized;\n}\n\nexport function parseAdvertisedPcr8(value: string, label: string): string {\n const normalized = normalizePcr8Pin(value, label);\n if (value !== normalized) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", `${label} must be ${PCR8_HEX_LENGTH} lowercase hex characters`);\n }\n return normalized;\n}\n","import { base64Decode, concatBytes, utf8Decode, utf8Encode } from \"../crypto/encoding\";\nimport { fail, NitroAttestationError } from \"../errors\";\nimport { parseAdvertisedPcr8 } from \"../trust/pcr8\";\n\nconst MAX_ATTESTATION_RESPONSE_BYTES = 256 * 1024;\nconst NETWORK_LAYER_FETCH_ATTEMPTS = 3;\nconst NETWORK_LAYER_RETRY_DELAY_MS = 150;\nconst ETH_ADDRESS_PATTERN = /^0x[0-9a-fA-F]{40}$/;\n\nexport interface AttestationEnvelope {\n attestationDocument: Uint8Array;\n nonce: string;\n advertised: {\n chainId?: number;\n verifyingContract?: string;\n expectedSigner?: string;\n expectedPcr8?: string;\n };\n}\n\nexport function buildAttestationUrl(attestationServiceUrl: string, nonceHex: string): URL {\n const url = new URL(attestationServiceUrl);\n const strippedPath = url.pathname.replace(/\\/+$/, \"\");\n url.pathname = strippedPath.endsWith(\"/attestation\") ? strippedPath : `${strippedPath}/attestation`;\n url.search = \"\";\n url.searchParams.set(\"nonce\", nonceHex);\n return url;\n}\n\nexport async function fetchAttestationEnvelope(params: {\n attestationServiceUrl: string;\n nonceHex: string;\n fetch: typeof fetch;\n timeoutMs: number;\n}): Promise<AttestationEnvelope> {\n const url = buildAttestationUrl(params.attestationServiceUrl, params.nonceHex);\n const response = await fetchWithNetworkRetry(url.toString(), params.fetch, params.timeoutMs);\n const responseText = await readResponseText(response);\n if (!response.ok) {\n fail(\"ATTESTATION_FETCH_FAILED\", `GET /attestation failed with HTTP ${response.status}`, {\n details: { status: response.status, body: responseText.slice(0, 400) },\n });\n }\n\n let body: unknown;\n try {\n body = JSON.parse(responseText);\n } catch (cause) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", \"GET /attestation returned non-JSON response\", { cause });\n }\n\n return validateAttestationEnvelope(body);\n}\n\nfunction validateAttestationEnvelope(body: unknown): AttestationEnvelope {\n if (!isRecord(body) || body.success !== true || !isRecord(body.responseObject)) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", \"Expected { success: true, responseObject: {...} }\");\n }\n\n const responseObject = body.responseObject;\n if (typeof responseObject.attestationDocument !== \"string\" || typeof responseObject.nonce !== \"string\") {\n fail(\"ATTESTATION_RESPONSE_INVALID\", \"Attestation response is missing attestationDocument or nonce\");\n }\n\n let attestationDocument: Uint8Array;\n try {\n attestationDocument = base64Decode(responseObject.attestationDocument);\n } catch (cause) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", \"attestationDocument is not valid base64\", { cause });\n }\n if (attestationDocument.length === 0) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", \"attestationDocument decoded to empty bytes\");\n }\n\n return {\n attestationDocument,\n nonce: responseObject.nonce.toLowerCase(),\n advertised: {\n chainId: typeof responseObject.chainId === \"number\" ? responseObject.chainId : undefined,\n verifyingContract: parseOptionalAddress(responseObject.verifyingContract, \"verifyingContract\"),\n expectedSigner: parseOptionalAddress(responseObject.expectedSigner, \"expectedSigner\"),\n expectedPcr8: parseOptionalAdvertisedPcr8(responseObject.expectedPcr8, \"expectedPcr8\"),\n },\n };\n}\n\nasync function readResponseText(response: Response): Promise<string> {\n if (!response.body) {\n const responseText = await response.text();\n assertResponseSize(utf8Encode(responseText).length);\n return responseText;\n }\n\n const reader = response.body.getReader();\n const chunks: Uint8Array[] = [];\n let totalBytes = 0;\n while (true) {\n const { done, value } = await reader.read();\n if (done) {\n break;\n }\n if (value) {\n totalBytes += value.length;\n assertResponseSize(totalBytes);\n chunks.push(value);\n }\n }\n return utf8Decode(concatBytes(chunks));\n}\n\nfunction assertResponseSize(totalBytes: number): void {\n if (totalBytes > MAX_ATTESTATION_RESPONSE_BYTES) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", \"GET /attestation response exceeded maximum size\", {\n details: { maxBytes: MAX_ATTESTATION_RESPONSE_BYTES, actualBytes: totalBytes },\n });\n }\n}\n\nfunction parseOptionalAddress(value: unknown, label: string): string | undefined {\n if (value === undefined) {\n return undefined;\n }\n if (typeof value !== \"string\" || !ETH_ADDRESS_PATTERN.test(value)) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", `${label} must be a 0x-prefixed 20-byte hex address`);\n }\n return value.toLowerCase();\n}\n\nfunction parseOptionalAdvertisedPcr8(value: unknown, label: string): string | undefined {\n if (value === undefined) {\n return undefined;\n }\n if (typeof value !== \"string\") {\n fail(\"ATTESTATION_RESPONSE_INVALID\", `${label} must be a 96-character lowercase hex string`);\n }\n try {\n return parseAdvertisedPcr8(value, label);\n } catch (cause) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", `${label} must be a 96-character lowercase hex string`, { cause });\n }\n}\n\nasync function fetchWithNetworkRetry(url: string, fetcher: typeof fetch, timeoutMs: number): Promise<Response> {\n let attempt = 1;\n while (true) {\n try {\n return await fetchWithTimeout(url, fetcher, timeoutMs);\n } catch (cause) {\n if (!isNetworkLayerFetchFailure(cause) || attempt >= NETWORK_LAYER_FETCH_ATTEMPTS) {\n throw cause;\n }\n await sleep(NETWORK_LAYER_RETRY_DELAY_MS * attempt);\n attempt += 1;\n }\n }\n}\n\nasync function fetchWithTimeout(url: string, fetcher: typeof fetch, timeoutMs: number): Promise<Response> {\n const controller = typeof AbortController !== \"undefined\" ? new AbortController() : undefined;\n let timeoutHandle: ReturnType<typeof setTimeout> | undefined;\n const timeoutPromise = new Promise<never>((_, reject) => {\n timeoutHandle = setTimeout(() => {\n controller?.abort();\n reject(new Error(\"timeout\"));\n }, timeoutMs);\n });\n\n try {\n const response = await Promise.race([\n fetcher(url, {\n headers: { accept: \"application/json\" },\n signal: controller?.signal,\n }),\n timeoutPromise,\n ]);\n if (timeoutHandle !== undefined) {\n clearTimeout(timeoutHandle);\n }\n return response;\n } catch (cause) {\n if (timeoutHandle !== undefined) {\n clearTimeout(timeoutHandle);\n }\n if (cause instanceof Error && (cause.name === \"AbortError\" || cause.message === \"timeout\")) {\n fail(\"TIMEOUT\", `GET /attestation timed out after ${timeoutMs}ms`, { cause });\n }\n fail(\"ATTESTATION_FETCH_FAILED\", \"GET /attestation failed at the network layer\", {\n cause,\n details: { layer: \"network\" },\n });\n }\n}\n\nfunction isNetworkLayerFetchFailure(cause: unknown): boolean {\n return (\n cause instanceof NitroAttestationError &&\n cause.code === \"ATTESTATION_FETCH_FAILED\" &&\n cause.details?.layer === \"network\"\n );\n}\n\nfunction sleep(ms: number): Promise<void> {\n return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n","import { bytesToHex } from \"../crypto/encoding\";\nimport { fail } from \"../errors\";\n\nexport const NONCE_BYTE_LENGTH = 32;\n\nexport function generateNonceHex(getRandomValues: (out: Uint8Array) => Uint8Array): string {\n return bytesToHex(getRandomValues(new Uint8Array(NONCE_BYTE_LENGTH)));\n}\n\nexport function assertNonceEcho(echoedNonce: string, expectedNonce: string): void {\n if (echoedNonce.toLowerCase() !== expectedNonce) {\n fail(\"ATTESTATION_NONCE_MISMATCH\", \"Attestation service echoed a different nonce\", {\n details: { expectedNonce, echoedNonce },\n });\n }\n}\n","import { decodeCbor } from \"../crypto/cbor\";\nimport { bytesToHex, utf8Decode } from \"../crypto/encoding\";\nimport { fail } from \"../errors\";\n\nexport interface DecodedAttestationPayload {\n timestampMs: number;\n nonceHex: string;\n pcr0Hex: string;\n pcr1Hex: string;\n pcr2Hex: string;\n pcr8Hex: string;\n certificateDer: Uint8Array;\n cabundleDer: Uint8Array[];\n publicKeyDer: Uint8Array;\n}\n\nexport function decodeAttestationPayload(payloadBytes: Uint8Array): DecodedAttestationPayload {\n let decoded: unknown;\n try {\n decoded = decodeCbor(payloadBytes);\n } catch (cause) {\n fail(\"PAYLOAD_FIELD_MISSING\", \"Attestation payload is not a valid CBOR map\", { cause });\n }\n\n const payload = requireMap(decoded, \"payload\");\n const pcrs = requireMap(payload.get(\"pcrs\"), \"pcrs\");\n const userData = requireBytes(payload.get(\"user_data\"), \"user_data\");\n\n return {\n timestampMs: requireTimestamp(payload.get(\"timestamp\")),\n nonceHex: utf8Decode(userData),\n pcr0Hex: optionalPcrHex(pcrs, 0),\n pcr1Hex: optionalPcrHex(pcrs, 1),\n pcr2Hex: optionalPcrHex(pcrs, 2),\n pcr8Hex: bytesToHex(requireBytes(pcrs.get(8), \"pcrs[8]\")),\n certificateDer: requireBytes(payload.get(\"certificate\"), \"certificate\"),\n cabundleDer: requireArray(payload.get(\"cabundle\"), \"cabundle\").map((entry, index) =>\n requireBytes(entry, `cabundle[${index}]`),\n ),\n publicKeyDer: requireBytes(payload.get(\"public_key\"), \"public_key\"),\n };\n}\n\nfunction optionalPcrHex(pcrs: Map<unknown, unknown>, index: number): string {\n const value = pcrs.get(index);\n return value instanceof Uint8Array ? bytesToHex(value) : \"\";\n}\n\nfunction requireTimestamp(value: unknown): number {\n if (typeof value === \"number\" && Number.isSafeInteger(value) && value >= 0) {\n return value;\n }\n fail(\"PAYLOAD_FIELD_MISSING\", \"Attestation payload timestamp must be an unsigned safe integer\");\n}\n\nfunction requireMap(value: unknown, label: string): Map<unknown, unknown> {\n if (value instanceof Map) {\n return value;\n }\n fail(\"PAYLOAD_FIELD_MISSING\", `Attestation payload field ${label} must be a CBOR map`);\n}\n\nfunction requireBytes(value: unknown, label: string): Uint8Array {\n if (value instanceof Uint8Array) {\n return value;\n }\n fail(\"PAYLOAD_FIELD_MISSING\", `Attestation payload field ${label} must be a byte string`);\n}\n\nfunction requireArray(value: unknown, label: string): unknown[] {\n if (Array.isArray(value)) {\n return value;\n }\n fail(\"PAYLOAD_FIELD_MISSING\", `Attestation payload field ${label} must be an array`);\n}\n","import type { NitroAttestationEnvironment } from \"../types\";\nimport { normalizePcr8Pin } from \"./pcr8\";\n\nexport const STAGING_ATTESTATION_SERVICE_URL = \"https://attestation-service-staging.zkp2p.xyz\";\nexport const PRODUCTION_ATTESTATION_SERVICE_URL = \"https://attestation-service.zkp2p.xyz\";\nexport const PREPROD_ATTESTATION_SERVICE_URL = \"https://attestation-service-preprod.zkp2p.xyz\";\n\nexport const STAGING_PCR8 =\n \"5636e3bd96f847cf12cfd9de7faa8cad0e6fa00962ce16ba185f8e5ea57105abb3cc9cc34f1e1e4de3444ceabcca7485\";\nexport const PRODUCTION_PCR8 =\n \"41a4ae0b9b96752cab5addb7d22689b3070e564e29f90a54316fa33fa38ea51387a6e887ea4f5a4b0cc34f69cea3f40e\";\nexport const PREPROD_PCR8 =\n \"5453c5bfb7d040285be5ba9af142f4fbdd9685d082f244b66c62bf7b22d8d02a638fa2e02b9a6fe8877953a9429209e0\";\n\nexport const DEFAULT_EXPECTED_PCR8_BY_HOST: Record<string, string> = {\n \"attestation-service-staging.zkp2p.xyz\": normalizePcr8Pin(STAGING_PCR8, \"bundled staging PCR8\"),\n \"attestation-service-preprod.zkp2p.xyz\": normalizePcr8Pin(PREPROD_PCR8, \"bundled preprod PCR8\"),\n \"attestation-service.zkp2p.xyz\": normalizePcr8Pin(PRODUCTION_PCR8, \"bundled production PCR8\"),\n};\n\nexport const DEFAULT_ENVIRONMENT_CONFIG: Record<\n NitroAttestationEnvironment,\n {\n attestationServiceUrl: string;\n expectedPcr8Hex: string;\n }\n> = {\n staging: {\n attestationServiceUrl: STAGING_ATTESTATION_SERVICE_URL,\n expectedPcr8Hex: STAGING_PCR8,\n },\n production: {\n attestationServiceUrl: PRODUCTION_ATTESTATION_SERVICE_URL,\n expectedPcr8Hex: PRODUCTION_PCR8,\n },\n};\n","import { fail } from \"../errors\";\nimport type { TrustPins } from \"../types\";\nimport type { NitroAttestationWarning } from \"../warnings\";\nimport { normalizePcr8Pin } from \"./pcr8\";\nimport { DEFAULT_EXPECTED_PCR8_BY_HOST } from \"./pins\";\n\nexport function resolveExpectedPcr8(params: {\n trust?: TrustPins;\n hostname: string;\n advertisedExpectedPcr8?: string;\n onWarning?: (warning: NitroAttestationWarning) => void;\n}): string {\n const { trust, advertisedExpectedPcr8, onWarning } = params;\n const hostname = params.hostname.toLowerCase();\n\n if (trust?.expectedPcr8Hex) {\n return normalizePcr8Pin(trust.expectedPcr8Hex, \"trust.expectedPcr8Hex\");\n }\n\n const hostPins = trust?.expectedPcr8ByHost;\n const hostPin = hostPins ? findHostPin(hostPins, hostname) : undefined;\n if (hostPin) {\n return normalizePcr8Pin(hostPin, `trust.expectedPcr8ByHost[${hostname}]`);\n }\n\n const bundledPin = DEFAULT_EXPECTED_PCR8_BY_HOST[hostname];\n if (bundledPin) {\n return bundledPin;\n }\n\n if (trust?.strictPin === true) {\n fail(\"TRUST_PIN_REQUIRED\", `No trusted PCR8 pin is configured for ${hostname}`);\n }\n\n if (advertisedExpectedPcr8) {\n const normalizedAdvertisedPin = normalizePcr8Pin(advertisedExpectedPcr8, \"service-advertised expectedPcr8\");\n onWarning?.({\n code: \"TRUST_PIN_NOT_PROVIDED\",\n message: `No caller or bundled PCR8 pin was available for ${hostname}; falling back to service-advertised expectedPcr8`,\n details: { hostname, expectedPcr8: normalizedAdvertisedPin },\n });\n return normalizedAdvertisedPin;\n }\n\n fail(\"TRUST_PIN_REQUIRED\", `No trusted or service-advertised PCR8 pin is available for ${hostname}`);\n}\n\nfunction findHostPin(hostPins: Record<string, string>, hostname: string): string | undefined {\n for (const [configuredHost, pin] of Object.entries(hostPins)) {\n if (configuredHost.toLowerCase() === hostname) {\n return pin;\n }\n }\n return undefined;\n}\n","import { verifyCertificateChain } from \"./attestation/certChain\";\nimport { decodeCoseSign1, verifyCoseSignature } from \"./attestation/coseSign1\";\nimport { fetchAttestationEnvelope } from \"./attestation/fetch\";\nimport { assertNonceEcho, generateNonceHex } from \"./attestation/nonce\";\nimport { decodeAttestationPayload } from \"./attestation/payloadFields\";\nimport { bytesToArrayBuffer, bytesToHex } from \"./crypto/encoding\";\nimport { resolveCryptoProvider, resolveFetch } from \"./crypto/env\";\nimport { fail } from \"./errors\";\nimport { DEFAULT_TIMEOUT_MS } from \"./timeout\";\nimport { resolveExpectedPcr8 } from \"./trust/resolveExpectedPcr8\";\nimport type { FetchAndVerifyAttestationParams, VerifiedAttestation } from \"./types\";\n\nconst DEFAULT_FRESHNESS_WINDOW_MS = 5 * 60 * 1000;\n\nexport async function fetchAndVerifyAttestation(params: FetchAndVerifyAttestationParams): Promise<VerifiedAttestation> {\n const fetcher = resolveFetch(params.fetch);\n const crypto = resolveCryptoProvider(params);\n const now = params.now ?? Date.now;\n const nonceHex = generateNonceHex(crypto.getRandomValues);\n const response = await fetchAttestationEnvelope({\n attestationServiceUrl: params.attestationServiceUrl,\n nonceHex,\n fetch: fetcher,\n timeoutMs: params.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n });\n assertNonceEcho(response.nonce, nonceHex);\n\n const { protectedHeadersBytes, payloadBytes, signature } = decodeCoseSign1(response.attestationDocument);\n const payload = decodeAttestationPayload(payloadBytes);\n\n if (payload.nonceHex !== nonceHex) {\n fail(\"NONCE_BINDING_FAILED\", \"Attestation payload user_data did not match the request nonce\", {\n details: { expectedNonce: nonceHex, payloadNonce: payload.nonceHex },\n });\n }\n\n const freshnessWindowMs = params.trust?.freshnessWindowMs ?? DEFAULT_FRESHNESS_WINDOW_MS;\n const nowMs = now();\n if (Math.abs(nowMs - payload.timestampMs) > freshnessWindowMs) {\n fail(\"FRESHNESS_CHECK_FAILED\", `Attestation timestamp skew exceeds ${freshnessWindowMs}ms`, {\n details: { timestampMs: payload.timestampMs, nowMs, freshnessWindowMs },\n });\n }\n\n const hostname = new URL(params.attestationServiceUrl).hostname;\n const expectedPcr8 = resolveExpectedPcr8({\n trust: params.trust,\n hostname,\n advertisedExpectedPcr8: response.advertised.expectedPcr8,\n onWarning: params.onWarning,\n });\n if (payload.pcr8Hex !== expectedPcr8) {\n fail(\"PCR8_PIN_MISMATCH\", \"Attestation PCR8 does not match the trusted pin\", {\n details: { expectedPcr8, actualPcr8: payload.pcr8Hex },\n });\n }\n\n const { leafPublicKey } = await verifyCertificateChain({\n leafCertificateDer: payload.certificateDer,\n cabundleDer: payload.cabundleDer,\n rootPem: params.trust?.awsNitroRootPem,\n nowMs,\n subtle: crypto.subtle,\n getRandomValues: crypto.getRandomValues,\n onWarning: params.onWarning,\n });\n await verifyCoseSignature({ protectedHeadersBytes, payloadBytes, signature, leafPublicKey, subtle: crypto.subtle });\n\n return {\n attestedSellerUploadKey: {\n publicKeyDer: payload.publicKeyDer,\n publicKeySha256Hex: bytesToHex(\n new Uint8Array(await crypto.subtle.digest(\"SHA-256\", bytesToArrayBuffer(payload.publicKeyDer))),\n ),\n },\n payload: {\n timestampMs: payload.timestampMs,\n pcr0Hex: payload.pcr0Hex,\n pcr1Hex: payload.pcr1Hex,\n pcr2Hex: payload.pcr2Hex,\n pcr8Hex: payload.pcr8Hex,\n nonceHex: payload.nonceHex,\n advertised: response.advertised,\n },\n };\n}\n","import { encryptBuyerTeeSessionMaterial } from \"./encryptBuyerTeeSessionMaterial\";\nimport { fetchAndVerifyAttestation } from \"./fetchAndVerifyAttestation\";\nimport type { BuyerTeeSessionMaterialPlatform, CreateEncryptedBuyerTeeSessionMaterialParamsFor } from \"./types\";\n\nexport async function createEncryptedBuyerTeeSessionMaterial<P extends BuyerTeeSessionMaterialPlatform>(\n params: CreateEncryptedBuyerTeeSessionMaterialParamsFor<P>,\n): Promise<string> {\n const verified = await fetchAndVerifyAttestation({\n attestationServiceUrl: params.attestationServiceUrl,\n trust: params.trust,\n fetch: params.fetch,\n subtle: params.subtle,\n getRandomValues: params.getRandomValues,\n now: params.now,\n onWarning: params.onWarning,\n timeoutMs: params.timeoutMs,\n });\n return encryptBuyerTeeSessionMaterial({\n ...params,\n key: verified.attestedSellerUploadKey,\n });\n}\n","import { resolveCryptoProvider } from \"./crypto/env\";\nimport { encryptIdentitySessionMaterialWithResolvedCrypto } from \"./jwe/encrypt\";\nimport type { EncryptIdentitySessionMaterialParamsFor, IdentityPlatform } from \"./types\";\n\nexport async function encryptIdentitySessionMaterial<P extends IdentityPlatform>(\n params: EncryptIdentitySessionMaterialParamsFor<P>,\n): Promise<string> {\n const crypto = resolveCryptoProvider(params);\n return encryptIdentitySessionMaterialWithResolvedCrypto({\n request: params,\n subtle: crypto.subtle,\n getRandomValues: crypto.getRandomValues,\n });\n}\n","import { encryptIdentitySessionMaterial } from \"./encryptIdentitySessionMaterial\";\nimport { fetchAndVerifyAttestation } from \"./fetchAndVerifyAttestation\";\nimport type { CreateEncryptedIdentitySessionMaterialParamsFor, IdentityPlatform } from \"./types\";\n\nexport async function createEncryptedIdentitySessionMaterial<P extends IdentityPlatform>(\n params: CreateEncryptedIdentitySessionMaterialParamsFor<P>,\n): Promise<string> {\n const verified = await fetchAndVerifyAttestation({\n attestationServiceUrl: params.attestationServiceUrl,\n trust: params.trust,\n fetch: params.fetch,\n subtle: params.subtle,\n getRandomValues: params.getRandomValues,\n now: params.now,\n onWarning: params.onWarning,\n timeoutMs: params.timeoutMs,\n });\n return encryptIdentitySessionMaterial({\n key: verified.attestedSellerUploadKey,\n platform: params.platform,\n actionType: params.actionType,\n sessionMaterial: params.sessionMaterial,\n subtle: params.subtle,\n getRandomValues: params.getRandomValues,\n });\n}\n","import { resolveCryptoProvider } from \"./crypto/env\";\nimport { encryptSellerCredentialUploadWithResolvedCrypto } from \"./jwe/encrypt\";\nimport type { EncryptSellerCredentialUploadParams } from \"./types\";\n\nexport async function encryptSellerCredentialUpload(params: EncryptSellerCredentialUploadParams): Promise<string> {\n const crypto = resolveCryptoProvider(params);\n return encryptSellerCredentialUploadWithResolvedCrypto({\n request: params,\n subtle: crypto.subtle,\n getRandomValues: crypto.getRandomValues,\n now: params.now ?? Date.now,\n });\n}\n","import { encryptSellerCredentialUpload } from \"./encryptSellerCredentialUpload\";\nimport { fetchAndVerifyAttestation } from \"./fetchAndVerifyAttestation\";\nimport type { CreateEncryptedSellerCredentialUploadParams } from \"./types\";\n\nexport async function createEncryptedSellerCredentialUpload(\n params: CreateEncryptedSellerCredentialUploadParams,\n): Promise<string> {\n const { attestationServiceUrl, trust, fetch, onWarning, timeoutMs, ...encryptParams } = params;\n const verified = await fetchAndVerifyAttestation({\n attestationServiceUrl,\n trust,\n fetch,\n subtle: params.subtle,\n getRandomValues: params.getRandomValues,\n now: params.now,\n onWarning,\n timeoutMs,\n });\n return encryptSellerCredentialUpload({\n ...encryptParams,\n key: verified.attestedSellerUploadKey,\n });\n}\n","import { resolveFetch } from \"./crypto/env\";\nimport { fail, type NitroServiceResponseErrorDetails } from \"./errors\";\nimport { DEFAULT_TIMEOUT_MS } from \"./timeout\";\n\ninterface ServiceResponseEnvelope<T> {\n success?: boolean;\n statusCode?: number;\n message?: string;\n responseObject?: T;\n}\n\nconst SERVICE_RESPONSE_SNIPPET_LENGTH = 400;\n\nexport async function postJsonServiceResponse<T>(params: {\n attestationServiceUrl: string;\n path: string;\n body: unknown;\n fetch?: typeof fetch;\n failureContext: string;\n timeoutMs?: number;\n}): Promise<T> {\n const fetcher = resolveFetch(params.fetch);\n const timeoutMs = params.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n const controller = new AbortController();\n let timeoutHandle: ReturnType<typeof setTimeout> | undefined;\n const timeoutPromise = new Promise<never>((_, reject) => {\n timeoutHandle = setTimeout(() => {\n controller.abort();\n reject(new Error(\"timeout\"));\n }, timeoutMs);\n });\n let response: Response;\n let responseText: string;\n try {\n response = await Promise.race([\n fetcher(buildServiceUrl(params.attestationServiceUrl, params.path), {\n method: \"POST\",\n headers: {\n accept: \"application/json\",\n \"content-type\": \"application/json\",\n },\n body: JSON.stringify(params.body),\n signal: controller.signal,\n }),\n timeoutPromise,\n ]);\n responseText = await Promise.race([response.text(), timeoutPromise]);\n } catch (cause) {\n if (controller.signal.aborted) {\n fail(\"TIMEOUT\", `${params.failureContext} timed out after ${timeoutMs}ms`, { cause });\n }\n fail(\"ATTESTATION_FETCH_FAILED\", `${params.failureContext} failed at the network layer`, { cause });\n } finally {\n clearTimeout(timeoutHandle);\n }\n\n if (!response.ok) {\n const envelope = parseServiceResponseEnvelope(responseText);\n if (envelope?.success === false) {\n failWithServiceResponseEnvelope(params.failureContext, response.status, envelope);\n }\n\n fail(\"ATTESTATION_FETCH_FAILED\", `${params.failureContext} failed with HTTP ${response.status}`, {\n details: { status: response.status, body: responseText.slice(0, 400) },\n });\n }\n\n let envelope: ServiceResponseEnvelope<T>;\n try {\n envelope = JSON.parse(responseText) as typeof envelope;\n } catch (cause) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", `${params.failureContext} returned a non-JSON ServiceResponse`, { cause });\n }\n\n if (envelope.success !== true) {\n if (envelope.success === false) {\n failWithServiceResponseEnvelope(params.failureContext, response.status, envelope);\n }\n\n fail(\"ATTESTATION_RESPONSE_INVALID\", `${params.failureContext} returned an unsuccessful ServiceResponse`);\n }\n\n if (!isRecord(envelope.responseObject)) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", `${params.failureContext} returned a ServiceResponse without responseObject`, {\n details: {\n status: response.status,\n envelopeSnippet: formatEnvelopeSnippet(envelope),\n },\n });\n }\n\n return envelope.responseObject as T;\n}\n\nfunction parseServiceResponseEnvelope(responseText: string): ServiceResponseEnvelope<unknown> | undefined {\n try {\n return JSON.parse(responseText) as ServiceResponseEnvelope<unknown>;\n } catch {\n return undefined;\n }\n}\n\nfunction failWithServiceResponseEnvelope(\n failureContext: string,\n status: number,\n envelope: ServiceResponseEnvelope<unknown>,\n): never {\n const details: NitroServiceResponseErrorDetails = {\n status,\n statusCode: envelope.statusCode,\n message: envelope.message,\n responseObject: envelope.responseObject,\n };\n\n fail(\"SERVICE_RESPONSE_ERROR\", `${failureContext} returned an unsuccessful ServiceResponse`, { details });\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction formatEnvelopeSnippet(envelope: ServiceResponseEnvelope<unknown>): string {\n return JSON.stringify(envelope).slice(0, SERVICE_RESPONSE_SNIPPET_LENGTH);\n}\n\nfunction buildServiceUrl(attestationServiceUrl: string, path: string): string {\n const url = new URL(attestationServiceUrl);\n url.pathname = `${url.pathname.replace(/\\/+$/u, \"\")}${path}`;\n url.search = \"\";\n return url.toString();\n}\n","import { createEncryptedIdentitySessionMaterial } from \"./createEncryptedIdentitySessionMaterial\";\nimport { postJsonServiceResponse } from \"./serviceResponse\";\nimport type { IdentityAttestationOutputFor, IdentityPlatform, RequestIdentityAttestationParamsFor } from \"./types\";\n\nexport async function requestIdentityAttestation<P extends IdentityPlatform>(\n params: RequestIdentityAttestationParamsFor<P>,\n): Promise<IdentityAttestationOutputFor<P>> {\n const encryptedSessionMaterial = await createEncryptedIdentitySessionMaterial({\n attestationServiceUrl: params.attestationServiceUrl,\n trust: params.trust,\n fetch: params.fetch,\n subtle: params.subtle,\n getRandomValues: params.getRandomValues,\n now: params.now,\n onWarning: params.onWarning,\n timeoutMs: params.timeoutMs,\n platform: params.platform,\n actionType: params.actionType,\n sessionMaterial: params.sessionMaterial,\n });\n\n return postJsonServiceResponse<IdentityAttestationOutputFor<P>>({\n attestationServiceUrl: params.attestationServiceUrl,\n path: \"/identity\",\n fetch: params.fetch,\n failureContext: \"POST /identity\",\n timeoutMs: params.timeoutMs,\n body: {\n platform: params.platform,\n actionType: params.actionType,\n callerAddress: params.callerAddress,\n encryptedSessionMaterial,\n params: params.params,\n },\n });\n}\n","import { createEncryptedSellerCredentialUpload } from \"./createEncryptedSellerCredentialUpload\";\nimport { postJsonServiceResponse } from \"./serviceResponse\";\nimport type { SellerCredentialBundle, UploadSellerCredentialParams } from \"./types\";\n\nexport async function uploadSellerCredential(params: UploadSellerCredentialParams): Promise<SellerCredentialBundle> {\n const encryptedUpload = await createEncryptedSellerCredentialUpload(params);\n\n return postJsonServiceResponse<SellerCredentialBundle>({\n attestationServiceUrl: params.attestationServiceUrl,\n path: `/seller/credentials/${encodeURIComponent(params.platform)}`,\n fetch: params.fetch,\n failureContext: \"POST /seller/credentials\",\n timeoutMs: params.timeoutMs,\n body: { encryptedUpload },\n });\n}\n","import { createEncryptedBuyerTeeSessionMaterial } from \"./createEncryptedBuyerTeeSessionMaterial\";\nimport { postJsonServiceResponse } from \"./serviceResponse\";\nimport type {\n BuyerTeeAttestationOutputFor,\n BuyerTeeSessionMaterialPlatform,\n VerifyBuyerTeePaymentParamsFor,\n} from \"./types\";\n\nexport async function verifyBuyerTeePayment<P extends BuyerTeeSessionMaterialPlatform>(\n params: VerifyBuyerTeePaymentParamsFor<P>,\n): Promise<BuyerTeeAttestationOutputFor<P>> {\n const encryptedSessionMaterial = await createEncryptedBuyerTeeSessionMaterial(params);\n\n return postJsonServiceResponse<BuyerTeeAttestationOutputFor<P>>({\n attestationServiceUrl: params.attestationServiceUrl,\n path: `/buyer/verify/${encodeURIComponent(params.platform)}/${encodeURIComponent(params.actionType)}`,\n fetch: params.fetch,\n failureContext: \"POST /buyer/verify\",\n timeoutMs: params.timeoutMs,\n body: {\n encryptedSessionMaterial,\n params: params.params,\n chainId: params.chainId,\n intent: params.intent,\n },\n });\n}\n","import { createEncryptedBuyerTeeSessionMaterial as createEncryptedBuyerTeeSessionMaterialOnce } from \"./createEncryptedBuyerTeeSessionMaterial\";\nimport { createEncryptedIdentitySessionMaterial as createEncryptedIdentitySessionMaterialOnce } from \"./createEncryptedIdentitySessionMaterial\";\nimport { createEncryptedSellerCredentialUpload as createEncryptedSellerCredentialUploadOnce } from \"./createEncryptedSellerCredentialUpload\";\nimport { encryptBuyerTeeSessionMaterial as encryptBuyerTeeSessionMaterialOnce } from \"./encryptBuyerTeeSessionMaterial\";\nimport { encryptIdentitySessionMaterial as encryptIdentitySessionMaterialOnce } from \"./encryptIdentitySessionMaterial\";\nimport { encryptSellerCredentialUpload as encryptSellerCredentialUploadOnce } from \"./encryptSellerCredentialUpload\";\nimport { fetchAndVerifyAttestation as fetchAndVerifyAttestationOnce } from \"./fetchAndVerifyAttestation\";\nimport { requestIdentityAttestation as requestIdentityAttestationOnce } from \"./requestIdentityAttestation\";\nimport { DEFAULT_ENVIRONMENT_CONFIG } from \"./trust/pins\";\nimport type {\n BuyerTeeAttestationOutputFor,\n BuyerTeeSessionMaterialPlatform,\n IdentityAttestationOutputFor,\n IdentityPlatform,\n NitroAttestationClient,\n NitroAttestationClientOptions,\n NitroAttestationClientVerifyBuyerTeePaymentParamsFor,\n RequestIdentityAttestationParamsFor,\n TrustPins,\n VerifyBuyerTeePaymentParamsFor,\n} from \"./types\";\nimport { uploadSellerCredential as uploadSellerCredentialOnce } from \"./uploadSellerCredential\";\nimport { verifyBuyerTeePayment as verifyBuyerTeePaymentOnce } from \"./verifyBuyerTeePayment\";\n\nexport function createNitroAttestationClient(options: NitroAttestationClientOptions): NitroAttestationClient {\n const environmentDefaults = DEFAULT_ENVIRONMENT_CONFIG[options.environment];\n const baseUrl = options.attestationServiceUrl ?? environmentDefaults.attestationServiceUrl;\n const baseTrust = mergeTrust({ strictPin: true }, options.trust);\n\n return {\n createEncryptedBuyerTeeSessionMaterial: (params) => {\n const {\n attestationServiceUrl,\n trust,\n fetch,\n subtle,\n getRandomValues,\n now,\n onWarning,\n timeoutMs,\n ...sessionParams\n } = params;\n\n return createEncryptedBuyerTeeSessionMaterialOnce({\n ...sessionParams,\n attestationServiceUrl: attestationServiceUrl ?? baseUrl,\n trust: mergeTrust(baseTrust, trust),\n fetch: fetch ?? options.fetch,\n subtle: subtle ?? options.subtle,\n getRandomValues: getRandomValues ?? options.getRandomValues,\n now: now ?? options.now,\n onWarning: onWarning ?? options.onWarning,\n timeoutMs: timeoutMs ?? options.timeoutMs,\n });\n },\n createEncryptedIdentitySessionMaterial: (params) => {\n const {\n attestationServiceUrl,\n trust,\n fetch,\n subtle,\n getRandomValues,\n now,\n onWarning,\n timeoutMs,\n ...sessionParams\n } = params;\n\n return createEncryptedIdentitySessionMaterialOnce({\n ...sessionParams,\n attestationServiceUrl: attestationServiceUrl ?? baseUrl,\n trust: mergeTrust(baseTrust, trust),\n fetch: fetch ?? options.fetch,\n subtle: subtle ?? options.subtle,\n getRandomValues: getRandomValues ?? options.getRandomValues,\n now: now ?? options.now,\n onWarning: onWarning ?? options.onWarning,\n timeoutMs: timeoutMs ?? options.timeoutMs,\n });\n },\n createEncryptedSellerCredentialUpload: (params) => {\n const {\n attestationServiceUrl,\n trust,\n fetch,\n subtle,\n getRandomValues,\n now,\n onWarning,\n timeoutMs,\n ...uploadParams\n } = params;\n\n return createEncryptedSellerCredentialUploadOnce({\n ...uploadParams,\n attestationServiceUrl: attestationServiceUrl ?? baseUrl,\n trust: mergeTrust(baseTrust, trust),\n fetch: fetch ?? options.fetch,\n subtle: subtle ?? options.subtle,\n getRandomValues: getRandomValues ?? options.getRandomValues,\n now: now ?? options.now,\n onWarning: onWarning ?? options.onWarning,\n timeoutMs: timeoutMs ?? options.timeoutMs,\n });\n },\n requestIdentityAttestation: <P extends IdentityPlatform>(\n params: Omit<RequestIdentityAttestationParamsFor<P>, \"attestationServiceUrl\"> & {\n attestationServiceUrl?: string;\n },\n ): Promise<IdentityAttestationOutputFor<P>> => {\n return requestIdentityAttestationOnce<P>({\n attestationServiceUrl: params.attestationServiceUrl ?? baseUrl,\n trust: mergeTrust(baseTrust, params.trust),\n fetch: params.fetch ?? options.fetch,\n subtle: params.subtle ?? options.subtle,\n getRandomValues: params.getRandomValues ?? options.getRandomValues,\n now: params.now ?? options.now,\n onWarning: params.onWarning ?? options.onWarning,\n timeoutMs: params.timeoutMs ?? options.timeoutMs,\n platform: params.platform,\n actionType: params.actionType,\n callerAddress: params.callerAddress,\n sessionMaterial: params.sessionMaterial,\n params: params.params,\n });\n },\n uploadSellerCredential: (params) => {\n const {\n attestationServiceUrl,\n trust,\n fetch,\n subtle,\n getRandomValues,\n now,\n onWarning,\n timeoutMs,\n ...uploadParams\n } = params;\n\n return uploadSellerCredentialOnce({\n ...uploadParams,\n attestationServiceUrl: attestationServiceUrl ?? baseUrl,\n trust: mergeTrust(baseTrust, trust),\n fetch: fetch ?? options.fetch,\n subtle: subtle ?? options.subtle,\n getRandomValues: getRandomValues ?? options.getRandomValues,\n now: now ?? options.now,\n onWarning: onWarning ?? options.onWarning,\n timeoutMs: timeoutMs ?? options.timeoutMs,\n });\n },\n verifyBuyerTeePayment: <P extends BuyerTeeSessionMaterialPlatform>(\n params: NitroAttestationClientVerifyBuyerTeePaymentParamsFor<P>,\n ): Promise<BuyerTeeAttestationOutputFor<P>> => {\n const verifyParams = {\n attestationServiceUrl: params.attestationServiceUrl ?? baseUrl,\n trust: mergeTrust(baseTrust, params.trust),\n fetch: params.fetch ?? options.fetch,\n subtle: params.subtle ?? options.subtle,\n getRandomValues: params.getRandomValues ?? options.getRandomValues,\n now: params.now ?? options.now,\n onWarning: params.onWarning ?? options.onWarning,\n timeoutMs: params.timeoutMs ?? options.timeoutMs,\n platform: params.platform,\n actionType: params.actionType,\n sessionMaterial: params.sessionMaterial,\n params: params.params,\n chainId: params.chainId,\n intent: params.intent,\n } as unknown as VerifyBuyerTeePaymentParamsFor<P>;\n\n return verifyBuyerTeePaymentOnce<P>(verifyParams);\n },\n fetchAndVerifyAttestation: (params = {}) =>\n fetchAndVerifyAttestationOnce({\n attestationServiceUrl: params.attestationServiceUrl ?? baseUrl,\n trust: mergeTrust(baseTrust, params.trust),\n fetch: params.fetch ?? options.fetch,\n subtle: params.subtle ?? options.subtle,\n getRandomValues: params.getRandomValues ?? options.getRandomValues,\n now: params.now ?? options.now,\n onWarning: params.onWarning ?? options.onWarning,\n timeoutMs: params.timeoutMs ?? options.timeoutMs,\n }),\n encryptBuyerTeeSessionMaterial: ({ subtle, getRandomValues, ...params }) =>\n encryptBuyerTeeSessionMaterialOnce({\n ...params,\n subtle: subtle ?? options.subtle,\n getRandomValues: getRandomValues ?? options.getRandomValues,\n }),\n encryptIdentitySessionMaterial: ({ subtle, getRandomValues, ...params }) =>\n encryptIdentitySessionMaterialOnce({\n ...params,\n subtle: subtle ?? options.subtle,\n getRandomValues: getRandomValues ?? options.getRandomValues,\n }),\n encryptSellerCredentialUpload: ({ subtle, getRandomValues, now, ...params }) =>\n encryptSellerCredentialUploadOnce({\n ...params,\n subtle: subtle ?? options.subtle,\n getRandomValues: getRandomValues ?? options.getRandomValues,\n now: now ?? options.now,\n }),\n };\n}\n\nfunction mergeTrust(base: TrustPins, override: TrustPins | undefined): TrustPins {\n if (!override) {\n return base;\n }\n return {\n ...base,\n ...override,\n expectedPcr8ByHost: {\n ...base.expectedPcr8ByHost,\n ...override.expectedPcr8ByHost,\n },\n };\n}\n","import { concat, getAddress, keccak256, recoverAddress, TypedDataEncoder, toUtf8Bytes, verifyTypedData } from \"ethers\";\nimport { fail } from \"./errors\";\nimport type { Eip712Field, UnifiedPaymentVerifierDomain } from \"./types\";\n\n// Duplicated from src/common/constants/unifiedPaymentVerifier.ts.\nexport const UNIFIED_PAYMENT_VERIFIER_DOMAIN = {\n name: \"UnifiedPaymentVerifier\",\n version: \"1\",\n} as const;\n\nexport const PAYMENT_ATTESTATION_TYPES: Record<string, Eip712Field[]> = {\n PaymentAttestation: [\n { name: \"intentHash\", type: \"bytes32\" },\n { name: \"releaseAmount\", type: \"uint256\" },\n { name: \"dataHash\", type: \"bytes32\" },\n ],\n};\n\nexport const PAYMENT_ATTESTATION_TYPESTRING =\n \"PaymentAttestation(bytes32 intentHash,uint256 releaseAmount,bytes32 dataHash)\";\nexport const PAYMENT_ATTESTATION_TYPEHASH = hashUtf8(PAYMENT_ATTESTATION_TYPESTRING);\n\n// Duplicated from src/identity/identityTypedData.ts.\nexport const IDENTITY_DOMAIN = {\n name: \"ZKP2PIdentityVerifier\",\n version: \"1\",\n} as const;\n\nexport const IDENTITY_ATTESTATION_TYPES: Record<string, Eip712Field[]> = {\n IdentityAttestation: [\n { name: \"method\", type: \"bytes32\" },\n { name: \"actionType\", type: \"bytes32\" },\n { name: \"callerAddress\", type: \"address\" },\n { name: \"payeeIdHash\", type: \"bytes32\" },\n { name: \"dataHash\", type: \"bytes32\" },\n { name: \"issuedAt\", type: \"uint256\" },\n { name: \"validUntil\", type: \"uint256\" },\n ],\n};\n\nexport const IDENTITY_ATTESTATION_TYPESTRING =\n \"IdentityAttestation(bytes32 method,bytes32 actionType,address callerAddress,bytes32 payeeIdHash,bytes32 dataHash,uint256 issuedAt,uint256 validUntil)\";\nexport const IDENTITY_ATTESTATION_TYPEHASH = hashUtf8(IDENTITY_ATTESTATION_TYPESTRING);\nexport const IDENTITY_DOMAIN_SEPARATOR = TypedDataEncoder.hashDomain(IDENTITY_DOMAIN).toLowerCase();\n\n// Duplicated from src/api/seller/sellerBundleSignature.ts.\nexport const SELLER_CREDENTIAL_BUNDLE_DOMAIN = {\n name: \"ZKP2P Seller Credential Bundle\",\n version: \"1\",\n} as const;\n\nexport const SELLER_CREDENTIAL_BUNDLE_TYPES: Record<string, Eip712Field[]> = {\n SellerCredentialBundle: [\n { name: \"platform\", type: \"string\" },\n { name: \"payeeIdHash\", type: \"bytes32\" },\n { name: \"encryptedBlobHash\", type: \"bytes32\" },\n { name: \"encryptedDataKeyHash\", type: \"bytes32\" },\n { name: \"nonceHash\", type: \"bytes32\" },\n { name: \"credentialType\", type: \"string\" },\n { name: \"credentialValidatedAt\", type: \"string\" },\n { name: \"credentialExpiresAt\", type: \"string\" },\n ],\n};\n\nexport function getUnifiedPaymentVerifierDomain(params: UnifiedPaymentVerifierDomain) {\n return {\n ...UNIFIED_PAYMENT_VERIFIER_DOMAIN,\n chainId: params.chainId,\n verifyingContract: getAddress(params.verifyingContract),\n };\n}\n\nexport function getUnifiedPaymentVerifierDomainSeparator(params: UnifiedPaymentVerifierDomain): string {\n return TypedDataEncoder.hashDomain(getUnifiedPaymentVerifierDomain(params)).toLowerCase();\n}\n\nexport function hashUtf8(value: string): string {\n return keccak256(toUtf8Bytes(value)).toLowerCase();\n}\n\nexport function hashHexBytes(hex: string): string {\n return keccak256(hex).toLowerCase();\n}\n\nexport function recoverSignerFromDomainSeparator(params: {\n domainSeparator: string;\n types: Record<string, Eip712Field[]>;\n value: Record<string, unknown>;\n signature: string;\n}): string {\n try {\n const structHash = TypedDataEncoder.from(params.types).hash(params.value);\n const digest = keccak256(concat([\"0x1901\", params.domainSeparator, structHash]));\n return normalizeAddress(recoverAddress(digest, params.signature));\n } catch (cause) {\n fail(\"ATTESTATION_SIGNATURE_INVALID\", \"Unable to recover signer from attestation signature\", { cause });\n }\n}\n\nexport function recoverSignerFromKnownDomain(params: {\n domain: Record<string, unknown>;\n types: Record<string, Eip712Field[]>;\n value: Record<string, unknown>;\n signature: string;\n}): string {\n try {\n return normalizeAddress(verifyTypedData(params.domain, params.types, params.value, params.signature));\n } catch (cause) {\n fail(\"ATTESTATION_SIGNATURE_INVALID\", \"Unable to verify attestation signature\", { cause });\n }\n}\n\nexport function assertTrustedSigner(recoveredSigner: string, trustedSigners: readonly string[]): string {\n const recovered = normalizeAddress(recoveredSigner);\n const normalizedTrustedSigners = new Set(trustedSigners.map((signer) => normalizeAddress(signer)));\n if (!normalizedTrustedSigners.has(recovered)) {\n fail(\"SIGNER_NOT_TRUSTED\", \"Recovered signer is not in trustedSigners\", {\n details: { recoveredSigner: recovered, trustedSigners: Array.from(normalizedTrustedSigners) },\n });\n }\n return recovered;\n}\n\nexport function assertTrustedPayloadSigner(params: {\n payloadSigner: string;\n recoveredSigner: string;\n trustedSigners: readonly string[];\n}): string {\n const recovered = assertTrustedSigner(params.recoveredSigner, params.trustedSigners);\n const payloadSigner = normalizeAddress(params.payloadSigner);\n if (payloadSigner !== recovered) {\n fail(\"ATTESTATION_SIGNATURE_INVALID\", \"Payload signer does not match the recovered signer\", {\n details: { payloadSigner, recoveredSigner: recovered },\n });\n }\n return recovered;\n}\n\nexport function assertLowercaseHexEqual(actual: string, expected: string, label: string): void {\n if (actual.toLowerCase() !== expected.toLowerCase()) {\n fail(\"ATTESTATION_BINDING_MISMATCH\", `${label} did not match expected value`, {\n details: { actual, expected },\n });\n }\n}\n\nexport function assertAddressEqual(actual: string, expected: string, label: string): void {\n let normalizedActual: string;\n let normalizedExpected: string;\n try {\n normalizedActual = normalizeAddress(actual);\n normalizedExpected = normalizeAddress(expected);\n } catch (cause) {\n fail(\"INVALID_PARAMETER\", `${label} must be a valid Ethereum address`, { cause });\n }\n\n if (normalizedActual !== normalizedExpected) {\n fail(\"ATTESTATION_BINDING_MISMATCH\", `${label} did not match expected value`, {\n details: { actual, expected },\n });\n }\n}\n\nexport function assertStringEqual(actual: string, expected: string, label: string): void {\n if (actual !== expected) {\n fail(\"ATTESTATION_BINDING_MISMATCH\", `${label} did not match expected value`, {\n details: { actual, expected },\n });\n }\n}\n\nexport function assertTypedDataTypesEqual(\n actual: Record<string, Eip712Field[]>,\n expected: Record<string, Eip712Field[]>,\n): void {\n if (JSON.stringify(actual) !== JSON.stringify(expected)) {\n fail(\"ATTESTATION_BINDING_MISMATCH\", \"typedDataSpec.types did not match the expected EIP-712 types\");\n }\n}\n\nexport function requireVerifierOption(value: string | undefined, label: string): string {\n if (typeof value !== \"string\") {\n fail(\"INVALID_PARAMETER\", `${label} is required`);\n }\n return value;\n}\n\nfunction normalizeAddress(address: string): string {\n return getAddress(address).toLowerCase();\n}\n","import {\n assertLowercaseHexEqual,\n assertStringEqual,\n assertTrustedPayloadSigner,\n assertTypedDataTypesEqual,\n getUnifiedPaymentVerifierDomainSeparator,\n hashHexBytes,\n PAYMENT_ATTESTATION_TYPEHASH,\n PAYMENT_ATTESTATION_TYPES,\n recoverSignerFromDomainSeparator,\n requireVerifierOption,\n} from \"./eip712\";\nimport type {\n BuyerTeeAttestationOutputFor,\n BuyerTeeSessionMaterialPlatform,\n VerifyBuyerTeePaymentAttestationOptionsFor,\n} from \"./types\";\n\nexport function verifyBuyerTeePaymentAttestation<P extends BuyerTeeSessionMaterialPlatform>(\n payload: BuyerTeeAttestationOutputFor<P>,\n options: VerifyBuyerTeePaymentAttestationOptionsFor<P>,\n): BuyerTeeAttestationOutputFor<P> {\n assertStringEqual(payload.platform, options.expectedPlatform, \"platform\");\n assertStringEqual(payload.actionType, options.expectedActionType, \"actionType\");\n assertStringEqual(payload.typedDataSpec.primaryType, \"PaymentAttestation\", \"typedDataSpec.primaryType\");\n assertTypedDataTypesEqual(payload.typedDataSpec.types, PAYMENT_ATTESTATION_TYPES);\n assertLowercaseHexEqual(payload.typeHash, PAYMENT_ATTESTATION_TYPEHASH, \"typeHash\");\n assertLowercaseHexEqual(\n payload.domainSeparator,\n getUnifiedPaymentVerifierDomainSeparator(options.expectedDomain),\n \"domainSeparator\",\n );\n\n // Pin encodedPaymentDetails to the signed dataHash so a proxy can't swap the\n // plaintext payment details while keeping the signed typedDataValue intact.\n assertLowercaseHexEqual(\n hashHexBytes(payload.encodedPaymentDetails),\n payload.typedDataValue.dataHash,\n \"encodedPaymentDetails\",\n );\n assertLowercaseHexEqual(\n payload.typedDataValue.intentHash,\n requireVerifierOption(options.expectedIntentHash, \"expectedIntentHash\"),\n \"typedDataValue.intentHash\",\n );\n\n const recoveredSigner = recoverSignerFromDomainSeparator({\n domainSeparator: payload.domainSeparator,\n types: PAYMENT_ATTESTATION_TYPES,\n value: { ...payload.typedDataValue },\n signature: payload.signature,\n });\n assertTrustedPayloadSigner({\n payloadSigner: payload.signer,\n recoveredSigner,\n trustedSigners: options.trustedSigners,\n });\n\n return payload;\n}\n","import {\n assertAddressEqual,\n assertLowercaseHexEqual,\n assertStringEqual,\n assertTrustedPayloadSigner,\n assertTypedDataTypesEqual,\n hashUtf8,\n IDENTITY_ATTESTATION_TYPEHASH,\n IDENTITY_ATTESTATION_TYPES,\n IDENTITY_DOMAIN,\n IDENTITY_DOMAIN_SEPARATOR,\n recoverSignerFromKnownDomain,\n requireVerifierOption,\n} from \"./eip712\";\nimport { fail } from \"./errors\";\nimport type {\n IdentityAttestationOutputFor,\n IdentityPlatform,\n NormalizedIdentityDetails,\n VerifyIdentityAttestationOptionsFor,\n} from \"./types\";\n\nconst IDENTITY_CANONICAL_FIELD_ORDER = [\"platform\", \"actionType\", \"payeeId\", \"username\", \"metadata\"] as const;\n\nexport function verifyIdentityAttestation<P extends IdentityPlatform>(\n payload: IdentityAttestationOutputFor<P>,\n options: VerifyIdentityAttestationOptionsFor<P>,\n): NormalizedIdentityDetails<P> {\n assertStringEqual(payload.platform, options.expectedPlatform, \"platform\");\n assertStringEqual(payload.actionType, options.expectedActionType, \"actionType\");\n assertStringEqual(payload.identity.platform, payload.platform, \"identity.platform\");\n assertStringEqual(payload.identity.actionType, payload.actionType, \"identity.actionType\");\n assertStringEqual(payload.typedDataSpec.primaryType, \"IdentityAttestation\", \"typedDataSpec.primaryType\");\n assertTypedDataTypesEqual(payload.typedDataSpec.types, IDENTITY_ATTESTATION_TYPES);\n assertLowercaseHexEqual(payload.domainSeparator, IDENTITY_DOMAIN_SEPARATOR, \"domainSeparator\");\n assertLowercaseHexEqual(payload.typeHash, IDENTITY_ATTESTATION_TYPEHASH, \"typeHash\");\n assertLowercaseHexEqual(payload.identity.method, hashUtf8(payload.identity.platform), \"identity.method\");\n // Bind the plaintext payeeId to the signed payeeIdHash so a malformed response\n // can't return a different plaintext while keeping a valid signature.\n assertLowercaseHexEqual(payload.identity.payeeIdHash, hashUtf8(payload.identity.payeeId), \"identity.payeeIdHash\");\n assertLowercaseHexEqual(payload.typedDataValue.method, payload.identity.method, \"typedDataValue.method\");\n assertLowercaseHexEqual(\n payload.typedDataValue.actionType,\n hashUtf8(payload.identity.actionType),\n \"typedDataValue.actionType\",\n );\n assertAddressEqual(\n payload.typedDataValue.callerAddress,\n requireVerifierOption(options.expectedCallerAddress, \"expectedCallerAddress\"),\n \"typedDataValue.callerAddress\",\n );\n assertLowercaseHexEqual(\n payload.typedDataValue.payeeIdHash,\n payload.identity.payeeIdHash,\n \"typedDataValue.payeeIdHash\",\n );\n assertLowercaseHexEqual(\n payload.typedDataValue.payeeIdHash,\n requireVerifierOption(options.expectedPayeeIdHash, \"expectedPayeeIdHash\"),\n \"typedDataValue.payeeIdHash\",\n );\n assertLowercaseHexEqual(\n payload.typedDataValue.dataHash,\n hashIdentityData(payload.identity),\n \"typedDataValue.dataHash\",\n );\n assertNotExpired(payload.typedDataValue.validUntil, options.now ?? Date.now);\n\n const recoveredSigner = recoverSignerFromKnownDomain({\n domain: IDENTITY_DOMAIN,\n types: IDENTITY_ATTESTATION_TYPES,\n value: { ...payload.typedDataValue },\n signature: payload.signature,\n });\n assertTrustedPayloadSigner({\n payloadSigner: payload.signer,\n recoveredSigner,\n trustedSigners: options.trustedSigners,\n });\n\n return payload.identity;\n}\n\nfunction hashIdentityData(details: NormalizedIdentityDetails): string {\n const canonicalFields = {\n platform: details.platform,\n actionType: details.actionType,\n payeeId: details.payeeId,\n username: details.username,\n metadata: sortMetadata(details.metadata),\n };\n const canonical = JSON.stringify(\n Object.fromEntries(IDENTITY_CANONICAL_FIELD_ORDER.map((field) => [field, canonicalFields[field]])),\n );\n\n return hashUtf8(canonical);\n}\n\nfunction sortMetadata(metadata: Record<string, string>): Record<string, string> {\n return Object.fromEntries(Object.entries(metadata).sort(([left], [right]) => left.localeCompare(right)));\n}\n\nfunction assertNotExpired(validUntil: string, now: () => number): void {\n const nowMs = now();\n if (BigInt(nowMs) > BigInt(validUntil)) {\n fail(\"ATTESTATION_EXPIRED\", \"Identity attestation validUntil is in the past\", {\n details: { validUntil, nowMs },\n });\n }\n}\n","import {\n assertLowercaseHexEqual,\n assertStringEqual,\n assertTrustedSigner,\n hashUtf8,\n recoverSignerFromKnownDomain,\n requireVerifierOption,\n SELLER_CREDENTIAL_BUNDLE_DOMAIN,\n SELLER_CREDENTIAL_BUNDLE_TYPES,\n} from \"./eip712\";\nimport { fail } from \"./errors\";\nimport type {\n SellerCredentialBundleFor,\n SellerCredentialUploadPlatform,\n VerifySellerCredentialBundleOptionsFor,\n} from \"./types\";\n\nexport function verifySellerCredentialBundle<P extends SellerCredentialUploadPlatform>(\n bundle: SellerCredentialBundleFor<P>,\n options: VerifySellerCredentialBundleOptionsFor<P>,\n): SellerCredentialBundleFor<P> {\n assertStringEqual(bundle.platform, options.expectedPlatform, \"platform\");\n assertLowercaseHexEqual(\n bundle.payeeIdHash,\n requireVerifierOption(options.expectedPayeeIdHash, \"expectedPayeeIdHash\"),\n \"payeeIdHash\",\n );\n assertCredentialNotExpired(bundle.credentialExpiresAt, options.now ?? Date.now);\n\n const recoveredSigner = recoverSignerFromKnownDomain({\n domain: SELLER_CREDENTIAL_BUNDLE_DOMAIN,\n types: SELLER_CREDENTIAL_BUNDLE_TYPES,\n value: buildSellerCredentialBundleValue(bundle),\n signature: bundle.bundleSignature,\n });\n assertTrustedSigner(recoveredSigner, options.trustedSigners);\n\n return bundle;\n}\n\nfunction buildSellerCredentialBundleValue(bundle: SellerCredentialBundleFor<SellerCredentialUploadPlatform>) {\n return {\n platform: bundle.platform,\n payeeIdHash: bundle.payeeIdHash,\n encryptedBlobHash: hashUtf8(bundle.encryptedBlob),\n encryptedDataKeyHash: hashUtf8(bundle.encryptedDataKey),\n nonceHash: hashUtf8(bundle.nonce),\n credentialType: bundle.credentialType,\n credentialValidatedAt: bundle.credentialValidatedAt,\n credentialExpiresAt: bundle.credentialExpiresAt ?? \"\",\n };\n}\n\nfunction assertCredentialNotExpired(credentialExpiresAt: string | null, now: () => number): void {\n const nowMs = now();\n if (credentialExpiresAt !== null && BigInt(nowMs) > BigInt(credentialExpiresAt)) {\n fail(\"ATTESTATION_EXPIRED\", \"Seller credential bundle credentialExpiresAt is in the past\", {\n details: { credentialExpiresAt, nowMs },\n });\n }\n}\n"],"mappings":"ubAAA,IAAAA,GAAA,GAAAC,GAAAD,GAAA,2CAAAE,EAAA,uBAAAC,EAAA,0BAAAC,EAAA,2CAAAC,EAAA,2CAAAC,EAAA,0CAAAC,EAAA,iCAAAC,GAAA,mCAAAC,EAAA,mCAAAC,EAAA,kCAAAC,EAAA,8BAAAC,EAAA,6CAAAC,EAAA,aAAAC,EAAA,+BAAAC,EAAA,2BAAAC,EAAA,0BAAAC,EAAA,qCAAAC,GAAA,8BAAAC,GAAA,iCAAAC,KAAA,eAAAC,GAAArB,ICgCO,IAAMsB,EAAN,cAAoC,KAAM,CACtC,KACS,MACT,QAET,YACEC,EACAC,EACAC,EAAkE,CAAC,EACnE,CACA,MAAMD,CAAO,EACb,KAAK,KAAO,wBACZ,KAAK,KAAOD,EACZ,KAAK,MAAQE,EAAQ,MACrB,KAAK,QAAUA,EAAQ,OACzB,CACF,EAEO,SAASC,EACdH,EACAC,EACAC,EACO,CACP,MAAM,IAAIH,EAAsBC,EAAMC,EAASC,CAAO,CACxD,CAEA,eAAsBE,EACpBC,EACAL,EACAC,EACY,CACZ,GAAI,CACF,OAAO,MAAMI,CACf,OAASC,EAAO,CACdH,EAAKH,EAAMC,EAAS,CAAE,MAAAK,CAAM,CAAC,CAC/B,CACF,CC7DO,SAASC,EAAaC,EAA4C,CACvE,OAAIA,IAAkB,QAChB,OAAOA,GAAkB,YAC3BC,EAAK,qBAAsB,mDAAmD,EAEzED,IAGL,OAAO,WAAW,OAAU,YAC9BC,EAAK,qBAAsB,mDAAmD,EAEzE,WAAW,MAAM,KAAK,UAAU,EACzC,CAEO,SAASC,GAAcC,EAA6C,CACzE,IAAMC,EAASD,GAAkB,WAAW,QAAQ,OACpD,OAAKC,GACHH,EAAK,qBAAsB,iDAAiD,EAEvEG,CACT,CAEO,SAASC,GACdC,EACiC,CACjC,GAAIA,EACF,OAAOA,EAGT,IAAMC,EAAY,WAAW,OAC7B,OAAI,OAAOA,GAAW,iBAAoB,YACxCN,EAAK,qBAAsB,oEAAoE,EAEzFO,GAAoBD,EAAU,gBAAgBC,CAAG,CAC3D,CAEO,SAASC,EAAsBC,EAGd,CACtB,MAAO,CACL,OAAQR,GAAcQ,EAAO,MAAM,EACnC,gBAAiBL,GAAuBK,EAAO,eAAe,CAChE,CACF,CAEO,SAASC,GAASP,EAAsBQ,EAA0D,CACvG,OAAI,OAAOA,GAAoB,YAC7BX,EAAK,qBAAsB,oEAAoE,EAE1F,CACL,OAAAG,EACA,gBAAAQ,EACA,WAAY,IAAMC,GAAaD,CAAe,CAChD,CACF,CAEA,SAASC,GACPD,EACqD,CACrD,IAAME,EAAQF,EAAgB,IAAI,WAAW,EAAE,CAAC,EAChDE,EAAM,CAAC,EAAKA,EAAM,CAAC,EAAI,GAAQ,GAC/BA,EAAM,CAAC,EAAKA,EAAM,CAAC,EAAI,GAAQ,IAC/B,IAAMC,EAAM,MAAM,KAAKD,EAAQE,GAASA,EAAK,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,CAAC,EAC1E,MAAO,GAAGD,EAAI,MAAM,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAIA,EAAI,MAAM,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAIA,EAAI,MAAM,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAIA,EAC3F,MAAM,EAAG,EAAE,EACX,KAAK,EAAE,CAAC,IAAIA,EAAI,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EACvC,CC1EA,IAAME,EAAkB,mEAClBC,EAAgBC,GAAYF,CAAe,EAEjD,SAASE,GAAYC,EAA0C,CAC7D,IAAMC,EAAiC,CAAC,EACxC,QAASC,EAAQ,EAAGA,EAAQF,EAAS,OAAQE,GAAS,EACpDD,EAAOD,EAASE,CAAK,CAAC,EAAIA,EAE5B,OAAOD,CACT,CAEO,SAASE,EAAWC,EAA2B,CACpD,IAAIC,EAAM,GACV,QAAWC,KAAQF,EACjBC,GAAOC,EAAK,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,EAE1C,OAAOD,CACT,CAmBO,SAASE,EAAWC,EAA2B,CACpD,GAAI,OAAO,YAAgB,IACzB,OAAO,IAAI,YAAY,EAAE,OAAOA,CAAK,EAGvC,IAAMC,EAAkB,CAAC,EACzB,QAASC,EAAQ,EAAGA,EAAQF,EAAM,OAAQE,GAAS,EAAG,CACpD,IAAMC,EAAYH,EAAM,YAAYE,CAAK,EACrCC,EAAY,QACdD,GAAS,GAEPC,GAAa,IACfF,EAAM,KAAKE,CAAS,EACXA,GAAa,KACtBF,EAAM,KAAK,IAAQE,GAAa,EAAI,IAAQA,EAAY,EAAK,EACpDA,GAAa,MACtBF,EAAM,KAAK,IAAQE,GAAa,GAAK,IAASA,GAAa,EAAK,GAAO,IAAQA,EAAY,EAAK,EAEhGF,EAAM,KACJ,IAAQE,GAAa,GACrB,IAASA,GAAa,GAAM,GAC5B,IAASA,GAAa,EAAK,GAC3B,IAAQA,EAAY,EACtB,CAEJ,CACA,OAAO,IAAI,WAAWF,CAAK,CAC7B,CAEO,SAASG,EAAWH,EAA2B,CACpD,GAAI,OAAO,YAAgB,IACzB,OAAO,IAAI,YAAY,EAAE,OAAOA,CAAK,EAGvC,IAAII,EAAM,GACV,QAASH,EAAQ,EAAGA,EAAQD,EAAM,OAAQC,GAAS,EAAG,CACpD,IAAMI,EAAQL,EAAMC,CAAK,EACrBI,EAAQ,IACVD,GAAO,OAAO,cAAcC,CAAK,GACvBA,EAAQ,OAAU,IAC5BD,GAAO,OAAO,eAAgBC,EAAQ,KAAS,EAAML,EAAM,EAAEC,CAAK,EAAI,EAAK,GACjEI,EAAQ,OAAU,IAC5BD,GAAO,OAAO,eAAgBC,EAAQ,KAAS,IAAQL,EAAM,EAAEC,CAAK,EAAI,KAAS,EAAMD,EAAM,EAAEC,CAAK,EAAI,EAAK,EAE7GG,GAAO,OAAO,eACVC,EAAQ,IAAS,IACfL,EAAM,EAAEC,CAAK,EAAI,KAAS,IAC1BD,EAAM,EAAEC,CAAK,EAAI,KAAS,EAC3BD,EAAM,EAAEC,CAAK,EAAI,EACtB,CAEJ,CACA,OAAOG,CACT,CAEO,SAASE,GAAaN,EAA2B,CACtD,IAAII,EAAM,GACV,QAASH,EAAQ,EAAGA,EAAQD,EAAM,OAAQC,GAAS,EAAG,CACpD,IAAMI,EAAQL,EAAMC,CAAK,EACnBM,EAASP,EAAMC,EAAQ,CAAC,GAAK,EAC7BO,EAAQR,EAAMC,EAAQ,CAAC,GAAK,EAC5BQ,EAAWJ,GAAS,GAAOE,GAAU,EAAKC,EAEhDJ,GAAOM,EAAiBD,GAAW,GAAM,EAAI,EAC7CL,GAAOM,EAAiBD,GAAW,GAAM,EAAI,EAC7CL,GAAOH,EAAQ,EAAID,EAAM,OAASU,EAAiBD,GAAW,EAAK,EAAI,EAAI,IAC3EL,GAAOH,EAAQ,EAAID,EAAM,OAASU,EAAgBD,EAAU,EAAI,EAAI,GACtE,CACA,OAAOL,CACT,CAEO,SAASO,GAAaZ,EAA2B,CACtD,OAAOa,GAAab,EAAO,EAAK,CAClC,CAEO,SAASc,EAAgBb,EAA2B,CACzD,OAAOM,GAAaN,CAAK,EAAE,WAAW,IAAK,GAAG,EAAE,WAAW,IAAK,GAAG,EAAE,QAAQ,MAAO,EAAE,CACxF,CAMA,SAASc,GAAaC,EAAeC,EAA8B,CACjE,IAAMC,EAAWF,EAAM,QAAQ,OAAQ,EAAE,EACnCG,EAAaF,EAAUC,EAAS,WAAW,IAAK,GAAG,EAAE,WAAW,IAAK,GAAG,EAAIA,EAClF,GAAIC,EAAW,OAAS,IAAM,EAC5B,MAAM,IAAI,MAAM,uBAAuB,EAEzC,IAAMC,EAASD,EAAa,IAAI,QAAQ,EAAKA,EAAW,OAAS,GAAM,CAAC,EAElEE,EAAkB,CAAC,EACzB,QAASC,EAAQ,EAAGA,EAAQF,EAAO,OAAQE,GAAS,EAAG,CACrD,IAAMC,EAAQH,EAAO,MAAME,EAAOA,EAAQ,CAAC,EACrCE,EAAMD,EAAM,SAAS,IAAI,EAAI,EAAIA,EAAM,SAAS,GAAG,EAAI,EAAI,EAC3DE,EAAIC,EAAaH,EAAM,CAAC,EAAGI,CAAa,EACxCC,EAAIF,EAAaH,EAAM,CAAC,EAAGI,CAAa,EACxCE,EAAIN,EAAM,CAAC,IAAM,IAAM,EAAIG,EAAaH,EAAM,CAAC,EAAGI,CAAa,EAC/DG,EAAIP,EAAM,CAAC,IAAM,IAAM,EAAIG,EAAaH,EAAM,CAAC,EAAGI,CAAa,EAC/DI,EAAWN,GAAK,GAAOG,GAAK,GAAOC,GAAK,EAAKC,EAEnDT,EAAM,KAAMU,GAAW,GAAM,GAAI,EAC7BP,EAAM,GACRH,EAAM,KAAMU,GAAW,EAAK,GAAI,EAE9BP,EAAM,GACRH,EAAM,KAAKU,EAAU,GAAI,CAE7B,CACA,OAAO,IAAI,WAAWV,CAAK,CAC7B,CAEA,SAASK,EAAaM,EAAcC,EAAwC,CAC1E,IAAMjB,EAAQiB,EAAOD,CAAI,EACzB,GAAIhB,IAAU,OACZ,MAAM,IAAI,MAAM,6BAA6BgB,CAAI,EAAE,EAErD,OAAOhB,CACT,CAEO,SAASkB,EAAYC,EAAiC,CAC3D,IAAMC,EAAQD,EAAM,OAAO,CAACE,EAAKC,IAASD,EAAMC,EAAK,OAAQ,CAAC,EACxDC,EAAM,IAAI,WAAWH,CAAK,EAC5BI,EAAS,EACb,QAAWF,KAAQH,EACjBI,EAAI,IAAID,EAAME,CAAM,EACpBA,GAAUF,EAAK,OAEjB,OAAOC,CACT,CAMO,SAASE,EAAmBC,EAAgC,CACjE,OAAO,IAAI,WAAWA,CAAK,EAAE,MAC/B,CCnJO,SAASC,GACdC,EAKiC,CACjC,IAAMC,EAAY,CAChB,gBAAiBD,EAAO,gBACxB,kBAAmBA,EAAO,IAAI,mBAC9B,WAAYA,EAAO,WACnB,MAAOA,EAAO,KAChB,EAEA,OAAIA,EAAO,WAAa,OACfC,EAGF,CACL,QAASD,EAAO,QAChB,GAAGC,CACL,CACF,CAEO,SAASC,GACdF,EAGkC,CAClC,MAAO,CACL,SAAUA,EAAO,SACjB,WAAYA,EAAO,WACnB,gBAAiBA,EAAO,gBACxB,kBAAmBA,EAAO,IAAI,kBAChC,CACF,CAEO,SAASG,GACdH,EAGkC,CAElC,MAAO,CACL,SAAUA,EAAO,SACjB,WAAYA,EAAO,WACnB,gBAAiBA,EAAO,gBACxB,kBAAmBA,EAAO,IAAI,kBAChC,CACF,CAEO,SAASI,GACdH,EACQ,CACR,OAAO,KAAK,UAAUA,CAAS,CACjC,CChEA,IAAMI,GAAuB,CAAE,IAAK,eAAgB,IAAK,SAAU,EAC7DC,GAAiB,0BAEvB,eAAsBC,GAAgDC,EAKlD,CAClB,IAAMC,EAAaD,EAAO,QAAQ,YAAcA,EAAO,IAAI,EACrDE,EAAQF,EAAO,QAAQ,OAASG,GAAaH,EAAO,eAAe,EACzE,OAAAI,GAAYF,CAAK,EAEVG,GAA2C,CAChD,IAAKL,EAAO,QAAQ,IACpB,UAAWM,GAAqC,CAC9C,GAAGN,EAAO,QACV,WAAAC,EACA,MAAAC,CACF,CAAC,EACD,OAAQF,EAAO,OACf,gBAAiBA,EAAO,gBACxB,eAAgB,0BAClB,CAAC,CACH,CAEA,eAAsBO,GAEpBP,EAIkB,CAClB,OAAOK,GAA2C,CAChD,IAAKL,EAAO,QAAQ,IACpB,UAAWQ,GAAsCR,EAAO,OAAO,EAC/D,OAAQA,EAAO,OACf,gBAAiBA,EAAO,gBACxB,eAAgB,4BAClB,CAAC,CACH,CAEA,eAAsBS,GAA6ET,EAI/E,CAClB,OAAOK,GAA2C,CAChD,IAAKL,EAAO,QAAQ,IACpB,UAAWU,GAAsCV,EAAO,OAAO,EAC/D,OAAQA,EAAO,OACf,gBAAiBA,EAAO,gBACxB,eAAgB,2BAClB,CAAC,CACH,CAEA,eAAeK,GAA2CL,EAMtC,CAClB,IAAMW,EAAYC,EAAWC,GAAyBb,EAAO,SAAS,CAAC,EAEjEc,EAAMd,EAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,EAC/Ce,EAAS,MAAMC,EACnBhB,EAAO,OAAO,UACZ,OACAiB,EAAmBjB,EAAO,IAAI,YAAY,EAC1C,CAAE,KAAM,WAAY,KAAM,SAAU,EACpC,GACA,CAAC,SAAS,CACZ,EACA,qBACA,yDACF,EACMkB,EAAe,IAAI,WACvB,MAAMF,EACJhB,EAAO,OAAO,QAAQ,CAAE,KAAM,UAAW,EAAGe,EAAQE,EAAmBH,CAAG,CAAC,EAC3E,qBACA,uDACF,CACF,EAEMK,EAAKnB,EAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,EAC9CoB,EAAkBC,EAAgBT,EAAW,KAAK,UAAUf,EAAoB,CAAC,CAAC,EAClFyB,EAAMV,EAAWQ,CAAe,EAChCG,EAAS,MAAMP,EACnBhB,EAAO,OAAO,UAAU,MAAOiB,EAAmBH,CAAG,EAAG,CAAE,KAAM,UAAW,OAAQ,GAAI,EAAG,GAAO,CAAC,SAAS,CAAC,EAC5G,qBACA,2DACF,EACMU,EAAqB,IAAI,WAC7B,MAAMR,EACJhB,EAAO,OAAO,QACZ,CACE,KAAM,UACN,GAAIiB,EAAmBE,CAAE,EACzB,eAAgBF,EAAmBK,CAAG,EACtC,UAAW,GACb,EACAC,EACAN,EAAmBN,CAAS,CAC9B,EACA,qBACA,6BAA6BX,EAAO,cAAc,EACpD,CACF,EACMyB,EAAaD,EAAmB,MAAM,EAAGA,EAAmB,OAAS,EAAE,EACvEE,EAAMF,EAAmB,MAAMA,EAAmB,OAAS,EAAE,EAEnE,MAAO,CACLJ,EACAC,EAAgBH,CAAY,EAC5BG,EAAgBF,CAAE,EAClBE,EAAgBI,CAAU,EAC1BJ,EAAgBK,CAAG,CACrB,EAAE,KAAK,GAAG,CACZ,CAGA,SAAStB,GAAYF,EAAqB,CACnCJ,GAAe,KAAKI,CAAK,GAC5ByB,EAAK,oBAAqB,0CAA0C,CAExE,CAGA,SAASxB,GAAayB,EAA0D,CAC9E,IAAMC,EAAQD,EAAgB,IAAI,WAAW,EAAE,CAAC,EAChDC,EAAM,CAAC,EAAKA,EAAM,CAAC,EAAI,GAAQ,GAC/BA,EAAM,CAAC,EAAKA,EAAM,CAAC,EAAI,GAAQ,IAC/B,IAAMC,EAAM,MAAM,KAAKD,EAAQE,GAASA,EAAK,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,CAAC,EAC1E,MAAO,GAAGD,EAAI,MAAM,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAIA,EAAI,MAAM,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAIA,EAAI,MAAM,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAIA,EAC3F,MAAM,EAAG,EAAE,EACX,KAAK,EAAE,CAAC,IAAIA,EAAI,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EACvC,CCtJA,eAAsBE,EACpBC,EACiB,CACjB,IAAMC,EAASC,EAAsBF,CAAM,EAC3C,OAAOG,GAAiD,CACtD,QAASH,EACT,OAAQC,EAAO,OACf,gBAAiBA,EAAO,eAC1B,CAAC,CACH,CCbA,IAAAG,GAAgC,0BCAzB,IAAMC,EAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBrBC,EAAwC,mEDTrD,IAAMC,GAAgC,MAAc,GAAK,IAOzD,eAAsBC,GAAuBC,EAQP,CACpC,IAAMC,EAASC,GAASF,EAAO,OAAQA,EAAO,eAAe,EACvDG,EAAkBC,GAAiBJ,EAAO,SAAWK,EAAoB,4BAA4B,EACrGC,EAAkB,MAAMC,GAAkBJ,EAAiBH,EAAO,MAAM,EAE1EM,IAAoBE,GACtBC,EAAK,gCAAiC,0DAA2D,CAC/F,QAAS,CAAE,SAAUD,EAAuC,OAAQF,CAAgB,CACtF,CAAC,EAGH,IAAMI,EAAkBN,GAAiBJ,EAAO,mBAAoB,8BAA8B,EAC5FW,EAAWX,EAAO,YAAY,IAAI,CAACY,EAAKC,IAAUT,GAAiBQ,EAAK,YAAYC,CAAK,GAAG,CAAC,EAC7FC,EAAkB,CAACX,EAAiB,GAAGQ,EAAUD,CAAe,EACtE,QAAWK,KAAeD,EACxBE,GAA2BD,EAAaf,EAAO,KAAK,EACpDiB,GAAeF,EAAaf,EAAO,MAAOA,EAAO,SAAS,EAG5D,IAAMkB,EAAkB,MAAMX,GAAkBG,EAAiBV,EAAO,MAAM,EACxEmB,EAAgB,CAAC,EACvB,QAAWJ,KAAeJ,EAAU,CAClC,IAAMS,EAAc,MAAMb,GAAkBQ,EAAaf,EAAO,MAAM,EAClEoB,IAAgBF,GAAmBE,IAAgBd,GACrDa,EAAc,KAAKJ,CAAW,CAElC,CAEA,IAAMM,EAAa,CACjB,CAACX,EAAiB,GAAGS,EAAc,MAAM,EAAE,QAAQ,EAAGhB,CAAe,EACrE,CAACO,EAAiB,GAAGS,EAAehB,CAAe,CACrD,EAEA,QAAWmB,KAAaD,EACtB,GAAI,MAAME,GAAiBD,EAAWrB,CAAM,EAAG,CAC7C,IAAMuB,EAAgB,MAAMC,EAC1Bf,EAAgB,UAAU,OAAO,CAAE,KAAM,QAAS,WAAY,OAAQ,EAAG,CAAC,QAAQ,EAAGT,CAAM,EAC3F,qBACA,8CACF,EACA,MAAO,CAAE,gBAAAS,EAAiB,cAAAc,CAAc,CAC1C,CAGFf,EAAK,qBAAsB,4EAA4E,CACzG,CAEA,eAAec,GAAiBG,EAA0BzB,EAAkC,CAC1F,QAASY,EAAQ,EAAGA,EAAQa,EAAM,OAAS,EAAGb,GAAS,EAAG,CACxD,IAAMc,EAAUD,EAAMb,CAAK,EACrBe,EAASF,EAAMb,EAAQ,CAAC,EAE9B,GAAI,CADO,MAAMc,EAAQ,OAAO,CAAE,UAAWC,EAAO,UAAW,cAAe,EAAK,EAAG3B,CAAM,EAE1F,MAAO,EAEX,CAEA,OAAOyB,EAAM,OAAS,GAAM,MAAMA,EAAMA,EAAM,OAAS,CAAC,EAAE,aAAazB,CAAM,CAC/E,CAEA,SAASG,GAAiByB,EAA0BC,EAAgC,CAClF,GAAI,CACF,OAAO,IAAI,mBAAgBD,CAAG,CAChC,OAASE,EAAO,CACdtB,EAAK,qBAAsB,mBAAmBqB,CAAK,GAAI,CAAE,MAAAC,CAAM,CAAC,CAClE,CACF,CAEA,eAAexB,GAAkBQ,EAA8BiB,EAAuC,CACpG,OAAOC,EAAW,IAAI,WAAW,MAAMD,EAAO,OAAO,UAAWjB,EAAY,OAAO,CAAC,CAAC,CACvF,CAEA,SAASC,GAA2BD,EAA8BmB,EAAqB,EACjFA,EAAQnB,EAAY,UAAU,QAAQ,GAAKmB,EAAQnB,EAAY,SAAS,QAAQ,IAClFN,EAAK,sBAAuB,6CAA8C,CACxE,QAAS,CACP,QAASM,EAAY,QACrB,UAAWA,EAAY,UAAU,YAAY,EAC7C,SAAUA,EAAY,SAAS,YAAY,CAC7C,CACF,CAAC,CAEL,CAEA,SAASE,GACPF,EACAmB,EACAC,EACM,CACFpB,EAAY,SAAS,QAAQ,EAAImB,EAAQpC,IAC3CqC,IAAY,CACV,KAAM,4BACN,QAAS,+DACT,QAAS,CACP,QAASpB,EAAY,QACrB,SAAUA,EAAY,SAAS,YAAY,CAC7C,CACF,CAAC,CAEL,CE7GO,SAASqB,EAAWC,EAA8B,CACvD,IAAMC,EAAS,IAAIC,GAAWF,CAAK,EAC7BG,EAAQF,EAAO,UAAU,EAC/B,GAAI,CAACA,EAAO,KAAK,EACf,MAAM,IAAI,MAAM,qBAAqB,EAEvC,OAAOE,CACT,CAEO,SAASC,EAAWD,EAA8B,CACvD,GAAI,OAAOA,GAAU,SAAU,CAC7B,GAAI,CAAC,OAAO,cAAcA,CAAK,EAC7B,MAAM,IAAI,MAAM,oCAAoC,EAEtD,OAAOA,GAAS,EAAIE,EAAoB,EAAGF,CAAK,EAAIE,EAAoB,EAAG,GAAKF,CAAK,CACvF,CACA,GAAI,OAAOA,GAAU,SACnB,OAAOA,GAAS,GAAKE,EAAoB,EAAGF,CAAK,EAAIE,EAAoB,EAAG,CAAC,GAAKF,CAAK,EAEzF,GAAI,OAAOA,GAAU,SAAU,CAC7B,IAAMG,EAAUC,EAAWJ,CAAK,EAChC,OAAOK,EAAY,CAACH,EAAoB,EAAGC,EAAQ,MAAM,EAAGA,CAAO,CAAC,CACtE,CACA,GAAIH,aAAiB,WACnB,OAAOK,EAAY,CAACH,EAAoB,EAAGF,EAAM,MAAM,EAAGA,CAAK,CAAC,EAElE,GAAI,MAAM,QAAQA,CAAK,EACrB,OAAOK,EAAY,CAACH,EAAoB,EAAGF,EAAM,MAAM,EAAG,GAAGA,EAAM,IAAIC,CAAU,CAAC,CAAC,EAErF,GAAID,aAAiB,IAEnB,OAAOK,EAAY,CACjBH,EAAoB,EAAGF,EAAM,IAAI,EACjC,GAAG,MAAM,KAAKA,EAAM,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAACM,EAAGC,CAAC,IAAM,CAACN,EAAWK,CAAC,EAAGL,EAAWM,CAAC,CAAC,CAAC,CACnF,CAAC,EAEH,GAAI,OAAOP,GAAU,UACnB,OAAO,IAAI,WAAW,CAACA,EAAQ,IAAO,GAAI,CAAC,EAE7C,GAAIA,IAAU,KACZ,OAAO,IAAI,WAAW,CAAC,GAAI,CAAC,EAE9B,MAAM,IAAI,MAAM,wBAAwB,CAC1C,CAEO,SAASQ,GAAwBC,EAAmCC,EAAsC,CAC/G,OAAOT,EAAW,CAAC,aAAcQ,EAAuB,IAAI,WAAcC,CAAY,CAAC,CACzF,CAEA,SAASR,EAAoBS,EAAmBC,EAAqC,CACnF,IAAMC,EAAe,OAAOD,CAAM,EAClC,OAAIC,EAAe,IACV,IAAI,WAAW,CAAEF,GAAa,EAAK,OAAOE,CAAY,CAAC,CAAC,EAE7DA,GAAgB,MACX,IAAI,WAAW,CAAEF,GAAa,EAAK,GAAI,OAAOE,CAAY,CAAC,CAAC,EAEjEA,GAAgB,QACX,IAAI,WAAW,CAAEF,GAAa,EAAK,GAAI,OAAQE,GAAgB,GAAM,KAAK,EAAG,OAAOA,EAAe,KAAK,CAAC,CAAC,EAE/GA,GAAgB,YACX,IAAI,WAAW,CACnBF,GAAa,EAAK,GACnB,OAAQE,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,GAAM,KAAK,EACnC,OAAOA,EAAe,KAAK,CAC7B,CAAC,EAGI,IAAI,WAAW,CACnBF,GAAa,EAAK,GACnB,OAAQE,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,GAAM,KAAK,EACnC,OAAOA,EAAe,KAAK,CAC7B,CAAC,CACH,CAEA,IAAMd,GAAN,KAAiB,CAGf,YAA6BF,EAAmB,CAAnB,WAAAA,CAAoB,CAApB,MAFrB,OAAS,EAIjB,MAAgB,CACd,OAAO,KAAK,SAAW,KAAK,MAAM,MACpC,CAEA,WAAuB,CACrB,IAAMiB,EAAO,KAAK,SAAS,EACrBH,EAAYG,GAAQ,EACpBC,EAAaD,EAAO,GAE1B,GAAIC,IAAe,GACjB,OAAO,KAAK,oBAAoBJ,CAAS,EAG3C,GAAIA,IAAc,EAChB,OAAO,KAAK,WAAWI,CAAU,EAEnC,GAAIJ,IAAc,EAAG,CACnB,IAAMX,EAAQ,KAAK,WAAWe,CAAU,EACxC,OAAO,OAAOf,GAAU,SAAW,CAAC,GAAKA,EAAQ,GAAKA,CACxD,CACA,GAAIW,IAAc,EAAG,CACnB,IAAMC,EAAS,KAAK,eAAe,KAAK,WAAWG,CAAU,CAAC,EAC9D,OAAO,KAAK,UAAUH,CAAM,CAC9B,CACA,GAAID,IAAc,EAAG,CACnB,IAAMC,EAAS,KAAK,eAAe,KAAK,WAAWG,CAAU,CAAC,EAC9D,OAAOC,EAAW,KAAK,UAAUJ,CAAM,CAAC,CAC1C,CACA,GAAID,IAAc,EAAG,CACnB,IAAMC,EAAS,KAAK,eAAe,KAAK,WAAWG,CAAU,CAAC,EACxDE,EAAmB,CAAC,EAC1B,QAASC,EAAQ,EAAGA,EAAQN,EAAQM,GAAS,EAC3CD,EAAI,KAAK,KAAK,UAAU,CAAC,EAE3B,OAAOA,CACT,CACA,GAAIN,IAAc,EAAG,CACnB,IAAMC,EAAS,KAAK,eAAe,KAAK,WAAWG,CAAU,CAAC,EACxDE,EAAM,IAAI,IAChB,QAASC,EAAQ,EAAGA,EAAQN,EAAQM,GAAS,EAC3CD,EAAI,IAAI,KAAK,UAAU,EAAG,KAAK,UAAU,CAAC,EAE5C,OAAOA,CACT,CACA,GAAIN,IAAc,EAChB,YAAK,WAAWI,CAAU,EACnB,KAAK,UAAU,EAExB,GAAIJ,IAAc,EAAG,CACnB,GAAII,IAAe,GACjB,MAAO,GAET,GAAIA,IAAe,GACjB,MAAO,GAET,GAAIA,IAAe,GACjB,OAAO,IAEX,CACA,MAAM,IAAI,MAAM,2CAA2CJ,CAAS,IAAII,CAAU,EAAE,CACtF,CAEQ,oBAAoBJ,EAA8B,CACxD,GAAIA,IAAc,EAAG,CACnB,IAAMQ,EAAuB,CAAC,EAC9B,KAAO,CAAC,KAAK,aAAa,GAAG,CAC3B,IAAMC,EAAQ,KAAK,UAAU,EAC7B,GAAI,EAAEA,aAAiB,YACrB,MAAM,IAAI,MAAM,yDAAyD,EAE3ED,EAAO,KAAKC,CAAK,CACnB,CACA,OAAOf,EAAYc,CAAM,CAC3B,CACA,GAAIR,IAAc,EAAG,CACnB,IAAIM,EAAM,GACV,KAAO,CAAC,KAAK,aAAa,GAAG,CAC3B,IAAMG,EAAQ,KAAK,UAAU,EAC7B,GAAI,OAAOA,GAAU,SACnB,MAAM,IAAI,MAAM,yDAAyD,EAE3EH,GAAOG,CACT,CACA,OAAOH,CACT,CACA,GAAIN,IAAc,EAAG,CACnB,IAAMM,EAAmB,CAAC,EAC1B,KAAO,CAAC,KAAK,aAAa,GACxBA,EAAI,KAAK,KAAK,UAAU,CAAC,EAE3B,OAAOA,CACT,CACA,GAAIN,IAAc,EAAG,CACnB,IAAMM,EAAM,IAAI,IAChB,KAAO,CAAC,KAAK,aAAa,GAAG,CAC3B,IAAMI,EAAM,KAAK,UAAU,EAC3B,GAAI,KAAK,UAAU,EACjB,MAAM,IAAI,MAAM,uCAAuC,EAEzDJ,EAAI,IAAII,EAAK,KAAK,UAAU,CAAC,CAC/B,CACA,OAAOJ,CACT,CACA,MAAM,IAAI,MAAM,8BAA8BN,CAAS,mBAAmB,CAC5E,CAEQ,WAAWI,EAAqC,CACtD,GAAIA,EAAa,GACf,OAAOA,EAET,GAAIA,IAAe,GACjB,OAAO,KAAK,SAAS,EAEvB,GAAIA,IAAe,GACjB,OAAQ,KAAK,SAAS,GAAK,EAAK,KAAK,SAAS,EAEhD,GAAIA,IAAe,GACjB,OAAQ,KAAK,SAAS,EAAI,UAAa,KAAK,SAAS,GAAK,KAAO,KAAK,SAAS,GAAK,GAAK,KAAK,SAAS,IAAO,EAEhH,GAAIA,IAAe,GAAI,CACrB,IAAIf,EAAQ,GACZ,QAASkB,EAAQ,EAAGA,EAAQ,EAAGA,GAAS,EACtClB,EAASA,GAAS,GAAM,OAAO,KAAK,SAAS,CAAC,EAEhD,OAAOA,GAAS,OAAO,OAAO,gBAAgB,EAAI,OAAOA,CAAK,EAAIA,CACpE,CACA,MAAM,IAAI,MAAM,2CAA2C,CAC7D,CAEQ,UAAmB,CACzB,GAAI,KAAK,QAAU,KAAK,MAAM,OAC5B,MAAM,IAAI,MAAM,8BAA8B,EAEhD,OAAO,KAAK,MAAM,KAAK,QAAQ,CACjC,CAEQ,WAAqB,CAC3B,OAAO,KAAK,OAAS,KAAK,MAAM,QAAU,KAAK,MAAM,KAAK,MAAM,IAAM,GACxE,CAEQ,cAAwB,CAC9B,OAAI,KAAK,UAAU,GACjB,KAAK,QAAU,EACR,IAEF,EACT,CAEQ,UAAUY,EAA4B,CAC5C,GAAI,KAAK,OAASA,EAAS,KAAK,MAAM,OACpC,MAAM,IAAI,MAAM,oCAAoC,EAEtD,IAAMK,EAAM,KAAK,MAAM,MAAM,KAAK,OAAQ,KAAK,OAASL,CAAM,EAC9D,YAAK,QAAUA,EACRK,CACT,CAEQ,eAAejB,EAAgC,CACrD,GAAI,OAAOA,GAAU,SACnB,MAAM,IAAI,MAAM,mDAAmD,EAErE,OAAOA,CACT,CACF,EC9PO,SAASsB,GAAgBC,EAAmD,CACjF,IAAMC,EAAWD,EAAoB,CAAC,IAAM,IAAOA,EAAoB,MAAM,CAAC,EAAIA,EAC9EE,EACJ,GAAI,CACFA,EAAUC,EAAWF,CAAQ,CAC/B,OAASG,EAAO,CACdC,EAAK,yBAA0B,4DAA6D,CAAE,MAAAD,CAAM,CAAC,CACvG,EAEI,CAAC,MAAM,QAAQF,CAAO,GAAKA,EAAQ,SAAW,IAChDG,EAAK,yBAA0B,iEAAiE,EAGlG,GAAM,CAACC,EAAuBC,EAAoBC,EAAcC,CAAS,EAAIP,EAC7E,OACE,EAAEI,aAAiC,aACnC,EAAEC,aAA8B,MAChC,EAAEC,aAAwB,aAC1B,EAAEC,aAAqB,cAEvBJ,EAAK,yBAA0B,2CAA2C,EAG5EK,GAAsBJ,CAAqB,EACvCG,EAAU,SAAW,IACvBJ,EAAK,8BAA+B,2CAA2CI,EAAU,MAAM,QAAQ,EAGlG,CAAE,sBAAAH,EAAuB,aAAAE,EAAc,UAAAC,CAAU,CAC1D,CAEA,eAAsBE,GAAoBC,EAMxB,CAChB,IAAMC,EAAeC,GAAwBF,EAAO,sBAAuBA,EAAO,YAAY,EACnF,MAAMG,EACfH,EAAO,OAAO,OAAO,CAAE,KAAM,QAAS,KAAM,SAAU,EAAGA,EAAO,cAAeA,EAAO,UAAWC,CAAY,EAC7G,+BACA,0CACF,GAEER,EAAK,+BAAgC,4EAA4E,CAErH,CAEA,SAASK,GAAsBJ,EAAyC,CACtE,IAAIJ,EACJ,GAAI,CACFA,EAAUC,EAAWG,CAAqB,CAC5C,OAASF,EAAO,CACdC,EAAK,yBAA0B,kDAAmD,CAAE,MAAAD,CAAM,CAAC,CAC7F,CACMF,aAAmB,KACvBG,EAAK,yBAA0B,2CAA2C,EAExEH,EAAQ,IAAI,CAAC,IAAM,KACrBG,EAAK,uBAAwB,+CAA+C,CAEhF,CCrEA,IAAMW,GAAkB,GAEjB,SAASC,EAAiBC,EAAeC,EAAuB,CACrE,IAAMC,EAAaF,EAAM,QAAQ,OAAQ,EAAE,EAAE,YAAY,EACzD,OAAIE,EAAW,SAAWJ,IAAmB,CAAC,cAAc,KAAKI,CAAU,IACzEC,EAAK,qBAAsB,GAAGF,CAAK,YAAYH,EAAe,2BAA2B,EAEpFI,CACT,CAEO,SAASE,GAAoBJ,EAAeC,EAAuB,CACxE,IAAMC,EAAaH,EAAiBC,EAAOC,CAAK,EAChD,OAAID,IAAUE,GACZC,EAAK,+BAAgC,GAAGF,CAAK,YAAYH,EAAe,2BAA2B,EAE9FI,CACT,CCdA,IAAMG,GAAiC,IAAM,KACvCC,GAA+B,EAC/BC,GAA+B,IAC/BC,GAAsB,sBAarB,SAASC,GAAoBC,EAA+BC,EAAuB,CACxF,IAAMC,EAAM,IAAI,IAAIF,CAAqB,EACnCG,EAAeD,EAAI,SAAS,QAAQ,OAAQ,EAAE,EACpD,OAAAA,EAAI,SAAWC,EAAa,SAAS,cAAc,EAAIA,EAAe,GAAGA,CAAY,eACrFD,EAAI,OAAS,GACbA,EAAI,aAAa,IAAI,QAASD,CAAQ,EAC/BC,CACT,CAEA,eAAsBE,GAAyBC,EAKd,CAC/B,IAAMH,EAAMH,GAAoBM,EAAO,sBAAuBA,EAAO,QAAQ,EACvEC,EAAW,MAAMC,GAAsBL,EAAI,SAAS,EAAGG,EAAO,MAAOA,EAAO,SAAS,EACrFG,EAAe,MAAMC,GAAiBH,CAAQ,EAC/CA,EAAS,IACZI,EAAK,2BAA4B,qCAAqCJ,EAAS,MAAM,GAAI,CACvF,QAAS,CAAE,OAAQA,EAAS,OAAQ,KAAME,EAAa,MAAM,EAAG,GAAG,CAAE,CACvE,CAAC,EAGH,IAAIG,EACJ,GAAI,CACFA,EAAO,KAAK,MAAMH,CAAY,CAChC,OAASI,EAAO,CACdF,EAAK,+BAAgC,8CAA+C,CAAE,MAAAE,CAAM,CAAC,CAC/F,CAEA,OAAOC,GAA4BF,CAAI,CACzC,CAEA,SAASE,GAA4BF,EAAoC,EACnE,CAACG,GAASH,CAAI,GAAKA,EAAK,UAAY,IAAQ,CAACG,GAASH,EAAK,cAAc,IAC3ED,EAAK,+BAAgC,mDAAmD,EAG1F,IAAMK,EAAiBJ,EAAK,gBACxB,OAAOI,EAAe,qBAAwB,UAAY,OAAOA,EAAe,OAAU,WAC5FL,EAAK,+BAAgC,8DAA8D,EAGrG,IAAIM,EACJ,GAAI,CACFA,EAAsBC,GAAaF,EAAe,mBAAmB,CACvE,OAASH,EAAO,CACdF,EAAK,+BAAgC,0CAA2C,CAAE,MAAAE,CAAM,CAAC,CAC3F,CACA,OAAII,EAAoB,SAAW,GACjCN,EAAK,+BAAgC,4CAA4C,EAG5E,CACL,oBAAAM,EACA,MAAOD,EAAe,MAAM,YAAY,EACxC,WAAY,CACV,QAAS,OAAOA,EAAe,SAAY,SAAWA,EAAe,QAAU,OAC/E,kBAAmBG,GAAqBH,EAAe,kBAAmB,mBAAmB,EAC7F,eAAgBG,GAAqBH,EAAe,eAAgB,gBAAgB,EACpF,aAAcI,GAA4BJ,EAAe,aAAc,cAAc,CACvF,CACF,CACF,CAEA,eAAeN,GAAiBH,EAAqC,CACnE,GAAI,CAACA,EAAS,KAAM,CAClB,IAAME,EAAe,MAAMF,EAAS,KAAK,EACzC,OAAAc,GAAmBC,EAAWb,CAAY,EAAE,MAAM,EAC3CA,CACT,CAEA,IAAMc,EAAShB,EAAS,KAAK,UAAU,EACjCiB,EAAuB,CAAC,EAC1BC,EAAa,EACjB,OAAa,CACX,GAAM,CAAE,KAAAC,EAAM,MAAAC,CAAM,EAAI,MAAMJ,EAAO,KAAK,EAC1C,GAAIG,EACF,MAEEC,IACFF,GAAcE,EAAM,OACpBN,GAAmBI,CAAU,EAC7BD,EAAO,KAAKG,CAAK,EAErB,CACA,OAAOC,EAAWC,EAAYL,CAAM,CAAC,CACvC,CAEA,SAASH,GAAmBI,EAA0B,CAChDA,EAAa7B,IACfe,EAAK,+BAAgC,kDAAmD,CACtF,QAAS,CAAE,SAAUf,GAAgC,YAAa6B,CAAW,CAC/E,CAAC,CAEL,CAEA,SAASN,GAAqBQ,EAAgBG,EAAmC,CAC/E,GAAIH,IAAU,OAGd,OAAI,OAAOA,GAAU,UAAY,CAAC5B,GAAoB,KAAK4B,CAAK,IAC9DhB,EAAK,+BAAgC,GAAGmB,CAAK,4CAA4C,EAEpFH,EAAM,YAAY,CAC3B,CAEA,SAASP,GAA4BO,EAAgBG,EAAmC,CACtF,GAAIH,IAAU,OAGd,CAAI,OAAOA,GAAU,UACnBhB,EAAK,+BAAgC,GAAGmB,CAAK,8CAA8C,EAE7F,GAAI,CACF,OAAOC,GAAoBJ,EAAOG,CAAK,CACzC,OAASjB,EAAO,CACdF,EAAK,+BAAgC,GAAGmB,CAAK,+CAAgD,CAAE,MAAAjB,CAAM,CAAC,CACxG,EACF,CAEA,eAAeL,GAAsBL,EAAa6B,EAAuBC,EAAsC,CAC7G,IAAIC,EAAU,EACd,OACE,GAAI,CACF,OAAO,MAAMC,GAAiBhC,EAAK6B,EAASC,CAAS,CACvD,OAASpB,EAAO,CACd,GAAI,CAACuB,GAA2BvB,CAAK,GAAKqB,GAAWrC,GACnD,MAAMgB,EAER,MAAMwB,GAAMvC,GAA+BoC,CAAO,EAClDA,GAAW,CACb,CAEJ,CAEA,eAAeC,GAAiBhC,EAAa6B,EAAuBC,EAAsC,CACxG,IAAMK,EAAa,OAAO,gBAAoB,IAAc,IAAI,gBAAoB,OAChFC,EACEC,EAAiB,IAAI,QAAe,CAACC,EAAGC,IAAW,CACvDH,EAAgB,WAAW,IAAM,CAC/BD,GAAY,MAAM,EAClBI,EAAO,IAAI,MAAM,SAAS,CAAC,CAC7B,EAAGT,CAAS,CACd,CAAC,EAED,GAAI,CACF,IAAM1B,EAAW,MAAM,QAAQ,KAAK,CAClCyB,EAAQ7B,EAAK,CACX,QAAS,CAAE,OAAQ,kBAAmB,EACtC,OAAQmC,GAAY,MACtB,CAAC,EACDE,CACF,CAAC,EACD,OAAID,IAAkB,QACpB,aAAaA,CAAa,EAErBhC,CACT,OAASM,EAAO,CACV0B,IAAkB,QACpB,aAAaA,CAAa,EAExB1B,aAAiB,QAAUA,EAAM,OAAS,cAAgBA,EAAM,UAAY,YAC9EF,EAAK,UAAW,oCAAoCsB,CAAS,KAAM,CAAE,MAAApB,CAAM,CAAC,EAE9EF,EAAK,2BAA4B,+CAAgD,CAC/E,MAAAE,EACA,QAAS,CAAE,MAAO,SAAU,CAC9B,CAAC,CACH,CACF,CAEA,SAASuB,GAA2BvB,EAAyB,CAC3D,OACEA,aAAiB8B,GACjB9B,EAAM,OAAS,4BACfA,EAAM,SAAS,QAAU,SAE7B,CAEA,SAASwB,GAAMO,EAA2B,CACxC,OAAO,IAAI,QAASC,GAAY,WAAWA,EAASD,CAAE,CAAC,CACzD,CAEA,SAAS7B,GAASY,EAAkD,CAClE,OAAO,OAAOA,GAAU,UAAYA,IAAU,MAAQ,CAAC,MAAM,QAAQA,CAAK,CAC5E,CC5MO,IAAMmB,GAAoB,GAE1B,SAASC,GAAiBC,EAA0D,CACzF,OAAOC,EAAWD,EAAgB,IAAI,WAAWF,EAAiB,CAAC,CAAC,CACtE,CAEO,SAASI,GAAgBC,EAAqBC,EAA6B,CAC5ED,EAAY,YAAY,IAAMC,GAChCC,EAAK,6BAA8B,+CAAgD,CACjF,QAAS,CAAE,cAAAD,EAAe,YAAAD,CAAY,CACxC,CAAC,CAEL,CCCO,SAASG,GAAyBC,EAAqD,CAC5F,IAAIC,EACJ,GAAI,CACFA,EAAUC,EAAWF,CAAY,CACnC,OAASG,EAAO,CACdC,EAAK,wBAAyB,8CAA+C,CAAE,MAAAD,CAAM,CAAC,CACxF,CAEA,IAAME,EAAUC,GAAWL,EAAS,SAAS,EACvCM,EAAOD,GAAWD,EAAQ,IAAI,MAAM,EAAG,MAAM,EAC7CG,EAAWC,EAAaJ,EAAQ,IAAI,WAAW,EAAG,WAAW,EAEnE,MAAO,CACL,YAAaK,GAAiBL,EAAQ,IAAI,WAAW,CAAC,EACtD,SAAUM,EAAWH,CAAQ,EAC7B,QAASI,GAAeL,EAAM,CAAC,EAC/B,QAASK,GAAeL,EAAM,CAAC,EAC/B,QAASK,GAAeL,EAAM,CAAC,EAC/B,QAASM,EAAWJ,EAAaF,EAAK,IAAI,CAAC,EAAG,SAAS,CAAC,EACxD,eAAgBE,EAAaJ,EAAQ,IAAI,aAAa,EAAG,aAAa,EACtE,YAAaS,GAAaT,EAAQ,IAAI,UAAU,EAAG,UAAU,EAAE,IAAI,CAACU,EAAOC,IACzEP,EAAaM,EAAO,YAAYC,CAAK,GAAG,CAC1C,EACA,aAAcP,EAAaJ,EAAQ,IAAI,YAAY,EAAG,YAAY,CACpE,CACF,CAEA,SAASO,GAAeL,EAA6BS,EAAuB,CAC1E,IAAMC,EAAQV,EAAK,IAAIS,CAAK,EAC5B,OAAOC,aAAiB,WAAaJ,EAAWI,CAAK,EAAI,EAC3D,CAEA,SAASP,GAAiBO,EAAwB,CAChD,GAAI,OAAOA,GAAU,UAAY,OAAO,cAAcA,CAAK,GAAKA,GAAS,EACvE,OAAOA,EAETb,EAAK,wBAAyB,gEAAgE,CAChG,CAEA,SAASE,GAAWW,EAAgBC,EAAsC,CACxE,GAAID,aAAiB,IACnB,OAAOA,EAETb,EAAK,wBAAyB,6BAA6Bc,CAAK,qBAAqB,CACvF,CAEA,SAAST,EAAaQ,EAAgBC,EAA2B,CAC/D,GAAID,aAAiB,WACnB,OAAOA,EAETb,EAAK,wBAAyB,6BAA6Bc,CAAK,wBAAwB,CAC1F,CAEA,SAASJ,GAAaG,EAAgBC,EAA0B,CAC9D,GAAI,MAAM,QAAQD,CAAK,EACrB,OAAOA,EAETb,EAAK,wBAAyB,6BAA6Bc,CAAK,mBAAmB,CACrF,CCvEO,IAAMC,GAAkC,gDAClCC,GAAqC,wCAG3C,IAAMC,GACX,mGACWC,GACX,mGACWC,GACX,mGAEWC,GAAwD,CACnE,wCAAyCC,EAAiBJ,GAAc,sBAAsB,EAC9F,wCAAyCI,EAAiBF,GAAc,sBAAsB,EAC9F,gCAAiCE,EAAiBH,GAAiB,yBAAyB,CAC9F,EAEaI,GAMT,CACF,QAAS,CACP,sBAAuBC,GACvB,gBAAiBN,EACnB,EACA,WAAY,CACV,sBAAuBO,GACvB,gBAAiBN,EACnB,CACF,EC7BO,SAASO,GAAoBC,EAKzB,CACT,GAAM,CAAE,MAAAC,EAAO,uBAAAC,EAAwB,UAAAC,CAAU,EAAIH,EAC/CI,EAAWJ,EAAO,SAAS,YAAY,EAE7C,GAAIC,GAAO,gBACT,OAAOI,EAAiBJ,EAAM,gBAAiB,uBAAuB,EAGxE,IAAMK,EAAWL,GAAO,mBAClBM,EAAUD,EAAWE,GAAYF,EAAUF,CAAQ,EAAI,OAC7D,GAAIG,EACF,OAAOF,EAAiBE,EAAS,4BAA4BH,CAAQ,GAAG,EAG1E,IAAMK,EAAaC,GAA8BN,CAAQ,EACzD,GAAIK,EACF,OAAOA,EAOT,GAJIR,GAAO,YAAc,IACvBU,EAAK,qBAAsB,yCAAyCP,CAAQ,EAAE,EAG5EF,EAAwB,CAC1B,IAAMU,EAA0BP,EAAiBH,EAAwB,iCAAiC,EAC1G,OAAAC,IAAY,CACV,KAAM,yBACN,QAAS,mDAAmDC,CAAQ,oDACpE,QAAS,CAAE,SAAAA,EAAU,aAAcQ,CAAwB,CAC7D,CAAC,EACMA,CACT,CAEAD,EAAK,qBAAsB,8DAA8DP,CAAQ,EAAE,CACrG,CAEA,SAASI,GAAYF,EAAkCF,EAAsC,CAC3F,OAAW,CAACS,EAAgBC,CAAG,IAAK,OAAO,QAAQR,CAAQ,EACzD,GAAIO,EAAe,YAAY,IAAMT,EACnC,OAAOU,CAIb,CC1CA,IAAMC,GAA8B,IAAS,IAE7C,eAAsBC,EAA0BC,EAAuE,CACrH,IAAMC,EAAUC,EAAaF,EAAO,KAAK,EACnCG,EAASC,EAAsBJ,CAAM,EACrCK,EAAML,EAAO,KAAO,KAAK,IACzBM,EAAWC,GAAiBJ,EAAO,eAAe,EAClDK,EAAW,MAAMC,GAAyB,CAC9C,sBAAuBT,EAAO,sBAC9B,SAAAM,EACA,MAAOL,EACP,UAAWD,EAAO,WAAa,GACjC,CAAC,EACDU,GAAgBF,EAAS,MAAOF,CAAQ,EAExC,GAAM,CAAE,sBAAAK,EAAuB,aAAAC,EAAc,UAAAC,CAAU,EAAIC,GAAgBN,EAAS,mBAAmB,EACjGO,EAAUC,GAAyBJ,CAAY,EAEjDG,EAAQ,WAAaT,GACvBW,EAAK,uBAAwB,gEAAiE,CAC5F,QAAS,CAAE,cAAeX,EAAU,aAAcS,EAAQ,QAAS,CACrE,CAAC,EAGH,IAAMG,EAAoBlB,EAAO,OAAO,mBAAqBF,GACvDqB,EAAQd,EAAI,EACd,KAAK,IAAIc,EAAQJ,EAAQ,WAAW,EAAIG,GAC1CD,EAAK,yBAA0B,sCAAsCC,CAAiB,KAAM,CAC1F,QAAS,CAAE,YAAaH,EAAQ,YAAa,MAAAI,EAAO,kBAAAD,CAAkB,CACxE,CAAC,EAGH,IAAME,EAAW,IAAI,IAAIpB,EAAO,qBAAqB,EAAE,SACjDqB,EAAeC,GAAoB,CACvC,MAAOtB,EAAO,MACd,SAAAoB,EACA,uBAAwBZ,EAAS,WAAW,aAC5C,UAAWR,EAAO,SACpB,CAAC,EACGe,EAAQ,UAAYM,GACtBJ,EAAK,oBAAqB,kDAAmD,CAC3E,QAAS,CAAE,aAAAI,EAAc,WAAYN,EAAQ,OAAQ,CACvD,CAAC,EAGH,GAAM,CAAE,cAAAQ,EAAc,EAAI,MAAMC,GAAuB,CACrD,mBAAoBT,EAAQ,eAC5B,YAAaA,EAAQ,YACrB,QAASf,EAAO,OAAO,gBACvB,MAAAmB,EACA,OAAQhB,EAAO,OACf,gBAAiBA,EAAO,gBACxB,UAAWH,EAAO,SACpB,CAAC,EACD,aAAMyB,GAAoB,CAAE,sBAAAd,EAAuB,aAAAC,EAAc,UAAAC,EAAW,cAAAU,GAAe,OAAQpB,EAAO,MAAO,CAAC,EAE3G,CACL,wBAAyB,CACvB,aAAcY,EAAQ,aACtB,mBAAoBW,EAClB,IAAI,WAAW,MAAMvB,EAAO,OAAO,OAAO,UAAWwB,EAAmBZ,EAAQ,YAAY,CAAC,CAAC,CAChG,CACF,EACA,QAAS,CACP,YAAaA,EAAQ,YACrB,QAASA,EAAQ,QACjB,QAASA,EAAQ,QACjB,QAASA,EAAQ,QACjB,QAASA,EAAQ,QACjB,SAAUA,EAAQ,SAClB,WAAYP,EAAS,UACvB,CACF,CACF,CCjFA,eAAsBoB,EACpBC,EACiB,CACjB,IAAMC,EAAW,MAAMC,EAA0B,CAC/C,sBAAuBF,EAAO,sBAC9B,MAAOA,EAAO,MACd,MAAOA,EAAO,MACd,OAAQA,EAAO,OACf,gBAAiBA,EAAO,gBACxB,IAAKA,EAAO,IACZ,UAAWA,EAAO,UAClB,UAAWA,EAAO,SACpB,CAAC,EACD,OAAOG,EAA+B,CACpC,GAAGH,EACH,IAAKC,EAAS,uBAChB,CAAC,CACH,CCjBA,eAAsBG,EACpBC,EACiB,CACjB,IAAMC,EAASC,EAAsBF,CAAM,EAC3C,OAAOG,GAAiD,CACtD,QAASH,EACT,OAAQC,EAAO,OACf,gBAAiBA,EAAO,eAC1B,CAAC,CACH,CCTA,eAAsBG,EACpBC,EACiB,CACjB,IAAMC,EAAW,MAAMC,EAA0B,CAC/C,sBAAuBF,EAAO,sBAC9B,MAAOA,EAAO,MACd,MAAOA,EAAO,MACd,OAAQA,EAAO,OACf,gBAAiBA,EAAO,gBACxB,IAAKA,EAAO,IACZ,UAAWA,EAAO,UAClB,UAAWA,EAAO,SACpB,CAAC,EACD,OAAOG,EAA+B,CACpC,IAAKF,EAAS,wBACd,SAAUD,EAAO,SACjB,WAAYA,EAAO,WACnB,gBAAiBA,EAAO,gBACxB,OAAQA,EAAO,OACf,gBAAiBA,EAAO,eAC1B,CAAC,CACH,CCrBA,eAAsBI,EAA8BC,EAA8D,CAChH,IAAMC,EAASC,EAAsBF,CAAM,EAC3C,OAAOG,GAAgD,CACrD,QAASH,EACT,OAAQC,EAAO,OACf,gBAAiBA,EAAO,gBACxB,IAAKD,EAAO,KAAO,KAAK,GAC1B,CAAC,CACH,CCRA,eAAsBI,EACpBC,EACiB,CACjB,GAAM,CAAE,sBAAAC,EAAuB,MAAAC,EAAO,MAAAC,EAAO,UAAAC,EAAW,UAAAC,EAAW,GAAGC,CAAc,EAAIN,EAClFO,EAAW,MAAMC,EAA0B,CAC/C,sBAAAP,EACA,MAAAC,EACA,MAAAC,EACA,OAAQH,EAAO,OACf,gBAAiBA,EAAO,gBACxB,IAAKA,EAAO,IACZ,UAAAI,EACA,UAAAC,CACF,CAAC,EACD,OAAOI,EAA8B,CACnC,GAAGH,EACH,IAAKC,EAAS,uBAChB,CAAC,CACH,CCXA,IAAMG,GAAkC,IAExC,eAAsBC,EAA2BC,EAOlC,CACb,IAAMC,EAAUC,EAAaF,EAAO,KAAK,EACnCG,EAAYH,EAAO,WAAa,IAChCI,EAAa,IAAI,gBACnBC,EACEC,EAAiB,IAAI,QAAe,CAACC,EAAGC,IAAW,CACvDH,EAAgB,WAAW,IAAM,CAC/BD,EAAW,MAAM,EACjBI,EAAO,IAAI,MAAM,SAAS,CAAC,CAC7B,EAAGL,CAAS,CACd,CAAC,EACGM,EACAC,EACJ,GAAI,CACFD,EAAW,MAAM,QAAQ,KAAK,CAC5BR,EAAQU,GAAgBX,EAAO,sBAAuBA,EAAO,IAAI,EAAG,CAClE,OAAQ,OACR,QAAS,CACP,OAAQ,mBACR,eAAgB,kBAClB,EACA,KAAM,KAAK,UAAUA,EAAO,IAAI,EAChC,OAAQI,EAAW,MACrB,CAAC,EACDE,CACF,CAAC,EACDI,EAAe,MAAM,QAAQ,KAAK,CAACD,EAAS,KAAK,EAAGH,CAAc,CAAC,CACrE,OAASM,EAAO,CACVR,EAAW,OAAO,SACpBS,EAAK,UAAW,GAAGb,EAAO,cAAc,oBAAoBG,CAAS,KAAM,CAAE,MAAAS,CAAM,CAAC,EAEtFC,EAAK,2BAA4B,GAAGb,EAAO,cAAc,+BAAgC,CAAE,MAAAY,CAAM,CAAC,CACpG,QAAE,CACA,aAAaP,CAAa,CAC5B,CAEA,GAAI,CAACI,EAAS,GAAI,CAChB,IAAMK,EAAWC,GAA6BL,CAAY,EACtDI,GAAU,UAAY,IACxBE,GAAgChB,EAAO,eAAgBS,EAAS,OAAQK,CAAQ,EAGlFD,EAAK,2BAA4B,GAAGb,EAAO,cAAc,qBAAqBS,EAAS,MAAM,GAAI,CAC/F,QAAS,CAAE,OAAQA,EAAS,OAAQ,KAAMC,EAAa,MAAM,EAAG,GAAG,CAAE,CACvE,CAAC,CACH,CAEA,IAAII,EACJ,GAAI,CACFA,EAAW,KAAK,MAAMJ,CAAY,CACpC,OAASE,EAAO,CACdC,EAAK,+BAAgC,GAAGb,EAAO,cAAc,uCAAwC,CAAE,MAAAY,CAAM,CAAC,CAChH,CAEA,OAAIE,EAAS,UAAY,KACnBA,EAAS,UAAY,IACvBE,GAAgChB,EAAO,eAAgBS,EAAS,OAAQK,CAAQ,EAGlFD,EAAK,+BAAgC,GAAGb,EAAO,cAAc,2CAA2C,GAGrGiB,GAASH,EAAS,cAAc,GACnCD,EAAK,+BAAgC,GAAGb,EAAO,cAAc,qDAAsD,CACjH,QAAS,CACP,OAAQS,EAAS,OACjB,gBAAiBS,GAAsBJ,CAAQ,CACjD,CACF,CAAC,EAGIA,EAAS,cAClB,CAEA,SAASC,GAA6BL,EAAoE,CACxG,GAAI,CACF,OAAO,KAAK,MAAMA,CAAY,CAChC,MAAQ,CACN,MACF,CACF,CAEA,SAASM,GACPG,EACAC,EACAN,EACO,CACP,IAAMO,EAA4C,CAChD,OAAAD,EACA,WAAYN,EAAS,WACrB,QAASA,EAAS,QAClB,eAAgBA,EAAS,cAC3B,EAEAD,EAAK,yBAA0B,GAAGM,CAAc,4CAA6C,CAAE,QAAAE,CAAQ,CAAC,CAC1G,CAEA,SAASJ,GAASK,EAAkD,CAClE,OAAO,OAAOA,GAAU,UAAYA,IAAU,MAAQ,CAAC,MAAM,QAAQA,CAAK,CAC5E,CAEA,SAASJ,GAAsBJ,EAAoD,CACjF,OAAO,KAAK,UAAUA,CAAQ,EAAE,MAAM,EAAGhB,EAA+B,CAC1E,CAEA,SAASa,GAAgBY,EAA+BC,EAAsB,CAC5E,IAAMC,EAAM,IAAI,IAAIF,CAAqB,EACzC,OAAAE,EAAI,SAAW,GAAGA,EAAI,SAAS,QAAQ,QAAS,EAAE,CAAC,GAAGD,CAAI,GAC1DC,EAAI,OAAS,GACNA,EAAI,SAAS,CACtB,CC9HA,eAAsBC,EACpBC,EAC0C,CAC1C,IAAMC,EAA2B,MAAMC,EAAuC,CAC5E,sBAAuBF,EAAO,sBAC9B,MAAOA,EAAO,MACd,MAAOA,EAAO,MACd,OAAQA,EAAO,OACf,gBAAiBA,EAAO,gBACxB,IAAKA,EAAO,IACZ,UAAWA,EAAO,UAClB,UAAWA,EAAO,UAClB,SAAUA,EAAO,SACjB,WAAYA,EAAO,WACnB,gBAAiBA,EAAO,eAC1B,CAAC,EAED,OAAOG,EAAyD,CAC9D,sBAAuBH,EAAO,sBAC9B,KAAM,YACN,MAAOA,EAAO,MACd,eAAgB,iBAChB,UAAWA,EAAO,UAClB,KAAM,CACJ,SAAUA,EAAO,SACjB,WAAYA,EAAO,WACnB,cAAeA,EAAO,cACtB,yBAAAC,EACA,OAAQD,EAAO,MACjB,CACF,CAAC,CACH,CC/BA,eAAsBI,EAAuBC,EAAuE,CAClH,IAAMC,EAAkB,MAAMC,EAAsCF,CAAM,EAE1E,OAAOG,EAAgD,CACrD,sBAAuBH,EAAO,sBAC9B,KAAM,uBAAuB,mBAAmBA,EAAO,QAAQ,CAAC,GAChE,MAAOA,EAAO,MACd,eAAgB,2BAChB,UAAWA,EAAO,UAClB,KAAM,CAAE,gBAAAC,CAAgB,CAC1B,CAAC,CACH,CCPA,eAAsBG,EACpBC,EAC0C,CAC1C,IAAMC,EAA2B,MAAMC,EAAuCF,CAAM,EAEpF,OAAOG,EAAyD,CAC9D,sBAAuBH,EAAO,sBAC9B,KAAM,iBAAiB,mBAAmBA,EAAO,QAAQ,CAAC,IAAI,mBAAmBA,EAAO,UAAU,CAAC,GACnG,MAAOA,EAAO,MACd,eAAgB,qBAChB,UAAWA,EAAO,UAClB,KAAM,CACJ,yBAAAC,EACA,OAAQD,EAAO,OACf,QAASA,EAAO,QAChB,OAAQA,EAAO,MACjB,CACF,CAAC,CACH,CCFO,SAASI,GAA6BC,EAAgE,CAC3G,IAAMC,EAAsBC,GAA2BF,EAAQ,WAAW,EACpEG,EAAUH,EAAQ,uBAAyBC,EAAoB,sBAC/DG,EAAYC,EAAW,CAAE,UAAW,EAAK,EAAGL,EAAQ,KAAK,EAE/D,MAAO,CACL,uCAAyCM,GAAW,CAClD,GAAM,CACJ,sBAAAC,EACA,MAAAC,EACA,MAAAC,EACA,OAAAC,EACA,gBAAAC,EACA,IAAAC,EACA,UAAAC,EACA,UAAAC,EACA,GAAGC,CACL,EAAIT,EAEJ,OAAOU,EAA2C,CAChD,GAAGD,EACH,sBAAuBR,GAAyBJ,EAChD,MAAOE,EAAWD,EAAWI,CAAK,EAClC,MAAOC,GAAST,EAAQ,MACxB,OAAQU,GAAUV,EAAQ,OAC1B,gBAAiBW,GAAmBX,EAAQ,gBAC5C,IAAKY,GAAOZ,EAAQ,IACpB,UAAWa,GAAab,EAAQ,UAChC,UAAWc,GAAad,EAAQ,SAClC,CAAC,CACH,EACA,uCAAyCM,GAAW,CAClD,GAAM,CACJ,sBAAAC,EACA,MAAAC,EACA,MAAAC,EACA,OAAAC,EACA,gBAAAC,EACA,IAAAC,EACA,UAAAC,EACA,UAAAC,EACA,GAAGC,CACL,EAAIT,EAEJ,OAAOW,EAA2C,CAChD,GAAGF,EACH,sBAAuBR,GAAyBJ,EAChD,MAAOE,EAAWD,EAAWI,CAAK,EAClC,MAAOC,GAAST,EAAQ,MACxB,OAAQU,GAAUV,EAAQ,OAC1B,gBAAiBW,GAAmBX,EAAQ,gBAC5C,IAAKY,GAAOZ,EAAQ,IACpB,UAAWa,GAAab,EAAQ,UAChC,UAAWc,GAAad,EAAQ,SAClC,CAAC,CACH,EACA,sCAAwCM,GAAW,CACjD,GAAM,CACJ,sBAAAC,EACA,MAAAC,EACA,MAAAC,EACA,OAAAC,EACA,gBAAAC,EACA,IAAAC,EACA,UAAAC,EACA,UAAAC,EACA,GAAGI,CACL,EAAIZ,EAEJ,OAAOa,EAA0C,CAC/C,GAAGD,EACH,sBAAuBX,GAAyBJ,EAChD,MAAOE,EAAWD,EAAWI,CAAK,EAClC,MAAOC,GAAST,EAAQ,MACxB,OAAQU,GAAUV,EAAQ,OAC1B,gBAAiBW,GAAmBX,EAAQ,gBAC5C,IAAKY,GAAOZ,EAAQ,IACpB,UAAWa,GAAab,EAAQ,UAChC,UAAWc,GAAad,EAAQ,SAClC,CAAC,CACH,EACA,2BACEM,GAIOc,EAAkC,CACvC,sBAAuBd,EAAO,uBAAyBH,EACvD,MAAOE,EAAWD,EAAWE,EAAO,KAAK,EACzC,MAAOA,EAAO,OAASN,EAAQ,MAC/B,OAAQM,EAAO,QAAUN,EAAQ,OACjC,gBAAiBM,EAAO,iBAAmBN,EAAQ,gBACnD,IAAKM,EAAO,KAAON,EAAQ,IAC3B,UAAWM,EAAO,WAAaN,EAAQ,UACvC,UAAWM,EAAO,WAAaN,EAAQ,UACvC,SAAUM,EAAO,SACjB,WAAYA,EAAO,WACnB,cAAeA,EAAO,cACtB,gBAAiBA,EAAO,gBACxB,OAAQA,EAAO,MACjB,CAAC,EAEH,uBAAyBA,GAAW,CAClC,GAAM,CACJ,sBAAAC,EACA,MAAAC,EACA,MAAAC,EACA,OAAAC,EACA,gBAAAC,EACA,IAAAC,EACA,UAAAC,EACA,UAAAC,EACA,GAAGI,CACL,EAAIZ,EAEJ,OAAOe,EAA2B,CAChC,GAAGH,EACH,sBAAuBX,GAAyBJ,EAChD,MAAOE,EAAWD,EAAWI,CAAK,EAClC,MAAOC,GAAST,EAAQ,MACxB,OAAQU,GAAUV,EAAQ,OAC1B,gBAAiBW,GAAmBX,EAAQ,gBAC5C,IAAKY,GAAOZ,EAAQ,IACpB,UAAWa,GAAab,EAAQ,UAChC,UAAWc,GAAad,EAAQ,SAClC,CAAC,CACH,EACA,sBACEM,GAC6C,CAC7C,IAAMgB,EAAe,CACnB,sBAAuBhB,EAAO,uBAAyBH,EACvD,MAAOE,EAAWD,EAAWE,EAAO,KAAK,EACzC,MAAOA,EAAO,OAASN,EAAQ,MAC/B,OAAQM,EAAO,QAAUN,EAAQ,OACjC,gBAAiBM,EAAO,iBAAmBN,EAAQ,gBACnD,IAAKM,EAAO,KAAON,EAAQ,IAC3B,UAAWM,EAAO,WAAaN,EAAQ,UACvC,UAAWM,EAAO,WAAaN,EAAQ,UACvC,SAAUM,EAAO,SACjB,WAAYA,EAAO,WACnB,gBAAiBA,EAAO,gBACxB,OAAQA,EAAO,OACf,QAASA,EAAO,QAChB,OAAQA,EAAO,MACjB,EAEA,OAAOiB,EAA6BD,CAAY,CAClD,EACA,0BAA2B,CAAChB,EAAS,CAAC,IACpCkB,EAA8B,CAC5B,sBAAuBlB,EAAO,uBAAyBH,EACvD,MAAOE,EAAWD,EAAWE,EAAO,KAAK,EACzC,MAAOA,EAAO,OAASN,EAAQ,MAC/B,OAAQM,EAAO,QAAUN,EAAQ,OACjC,gBAAiBM,EAAO,iBAAmBN,EAAQ,gBACnD,IAAKM,EAAO,KAAON,EAAQ,IAC3B,UAAWM,EAAO,WAAaN,EAAQ,UACvC,UAAWM,EAAO,WAAaN,EAAQ,SACzC,CAAC,EACH,+BAAgC,CAAC,CAAE,OAAAU,EAAQ,gBAAAC,EAAiB,GAAGL,CAAO,IACpEmB,EAAmC,CACjC,GAAGnB,EACH,OAAQI,GAAUV,EAAQ,OAC1B,gBAAiBW,GAAmBX,EAAQ,eAC9C,CAAC,EACH,+BAAgC,CAAC,CAAE,OAAAU,EAAQ,gBAAAC,EAAiB,GAAGL,CAAO,IACpEoB,EAAmC,CACjC,GAAGpB,EACH,OAAQI,GAAUV,EAAQ,OAC1B,gBAAiBW,GAAmBX,EAAQ,eAC9C,CAAC,EACH,8BAA+B,CAAC,CAAE,OAAAU,EAAQ,gBAAAC,EAAiB,IAAAC,EAAK,GAAGN,CAAO,IACxEqB,EAAkC,CAChC,GAAGrB,EACH,OAAQI,GAAUV,EAAQ,OAC1B,gBAAiBW,GAAmBX,EAAQ,gBAC5C,IAAKY,GAAOZ,EAAQ,GACtB,CAAC,CACL,CACF,CAEA,SAASK,EAAWuB,EAAiBC,EAA4C,CAC/E,OAAKA,EAGE,CACL,GAAGD,EACH,GAAGC,EACH,mBAAoB,CAClB,GAAGD,EAAK,mBACR,GAAGC,EAAS,kBACd,CACF,EATSD,CAUX,CC1NA,IAAAE,EAA8G,kBAKvG,IAAMC,GAAkC,CAC7C,KAAM,yBACN,QAAS,GACX,EAEaC,GAA2D,CACtE,mBAAoB,CAClB,CAAE,KAAM,aAAc,KAAM,SAAU,EACtC,CAAE,KAAM,gBAAiB,KAAM,SAAU,EACzC,CAAE,KAAM,WAAY,KAAM,SAAU,CACtC,CACF,EAEaC,GACX,gFACWC,GAA+BC,EAASF,EAA8B,EAGtEG,GAAkB,CAC7B,KAAM,wBACN,QAAS,GACX,EAEaC,GAA4D,CACvE,oBAAqB,CACnB,CAAE,KAAM,SAAU,KAAM,SAAU,EAClC,CAAE,KAAM,aAAc,KAAM,SAAU,EACtC,CAAE,KAAM,gBAAiB,KAAM,SAAU,EACzC,CAAE,KAAM,cAAe,KAAM,SAAU,EACvC,CAAE,KAAM,WAAY,KAAM,SAAU,EACpC,CAAE,KAAM,WAAY,KAAM,SAAU,EACpC,CAAE,KAAM,aAAc,KAAM,SAAU,CACxC,CACF,EAEaC,GACX,wJACWC,GAAgCJ,EAASG,EAA+B,EACxEE,GAA4B,mBAAiB,WAAWJ,EAAe,EAAE,YAAY,EAGrFK,GAAkC,CAC7C,KAAM,iCACN,QAAS,GACX,EAEaC,GAAgE,CAC3E,uBAAwB,CACtB,CAAE,KAAM,WAAY,KAAM,QAAS,EACnC,CAAE,KAAM,cAAe,KAAM,SAAU,EACvC,CAAE,KAAM,oBAAqB,KAAM,SAAU,EAC7C,CAAE,KAAM,uBAAwB,KAAM,SAAU,EAChD,CAAE,KAAM,YAAa,KAAM,SAAU,EACrC,CAAE,KAAM,iBAAkB,KAAM,QAAS,EACzC,CAAE,KAAM,wBAAyB,KAAM,QAAS,EAChD,CAAE,KAAM,sBAAuB,KAAM,QAAS,CAChD,CACF,EAEO,SAASC,GAAgCC,EAAsC,CACpF,MAAO,CACL,GAAGb,GACH,QAASa,EAAO,QAChB,qBAAmB,cAAWA,EAAO,iBAAiB,CACxD,CACF,CAEO,SAASC,EAAyCD,EAA8C,CACrG,OAAO,mBAAiB,WAAWD,GAAgCC,CAAM,CAAC,EAAE,YAAY,CAC1F,CAEO,SAAST,EAASW,EAAuB,CAC9C,SAAO,gBAAU,eAAYA,CAAK,CAAC,EAAE,YAAY,CACnD,CAEO,SAASC,GAAaC,EAAqB,CAChD,SAAO,aAAUA,CAAG,EAAE,YAAY,CACpC,CAEO,SAASC,GAAiCL,EAKtC,CACT,GAAI,CACF,IAAMM,EAAa,mBAAiB,KAAKN,EAAO,KAAK,EAAE,KAAKA,EAAO,KAAK,EAClEO,KAAS,gBAAU,UAAO,CAAC,SAAUP,EAAO,gBAAiBM,CAAU,CAAC,CAAC,EAC/E,OAAOE,KAAiB,kBAAeD,EAAQP,EAAO,SAAS,CAAC,CAClE,OAASS,EAAO,CACdC,EAAK,gCAAiC,sDAAuD,CAAE,MAAAD,CAAM,CAAC,CACxG,CACF,CAEO,SAASE,GAA6BX,EAKlC,CACT,GAAI,CACF,OAAOQ,KAAiB,mBAAgBR,EAAO,OAAQA,EAAO,MAAOA,EAAO,MAAOA,EAAO,SAAS,CAAC,CACtG,OAASS,EAAO,CACdC,EAAK,gCAAiC,yCAA0C,CAAE,MAAAD,CAAM,CAAC,CAC3F,CACF,CAEO,SAASG,GAAoBC,EAAyBC,EAA2C,CACtG,IAAMC,EAAYP,EAAiBK,CAAe,EAC5CG,EAA2B,IAAI,IAAIF,EAAe,IAAKG,GAAWT,EAAiBS,CAAM,CAAC,CAAC,EACjG,OAAKD,EAAyB,IAAID,CAAS,GACzCL,EAAK,qBAAsB,4CAA6C,CACtE,QAAS,CAAE,gBAAiBK,EAAW,eAAgB,MAAM,KAAKC,CAAwB,CAAE,CAC9F,CAAC,EAEID,CACT,CAEO,SAASG,GAA2BlB,EAIhC,CACT,IAAMe,EAAYH,GAAoBZ,EAAO,gBAAiBA,EAAO,cAAc,EAC7EmB,EAAgBX,EAAiBR,EAAO,aAAa,EAC3D,OAAImB,IAAkBJ,GACpBL,EAAK,gCAAiC,qDAAsD,CAC1F,QAAS,CAAE,cAAAS,EAAe,gBAAiBJ,CAAU,CACvD,CAAC,EAEIA,CACT,CAEO,SAASK,EAAwBC,EAAgBC,EAAkBC,EAAqB,CACzFF,EAAO,YAAY,IAAMC,EAAS,YAAY,GAChDZ,EAAK,+BAAgC,GAAGa,CAAK,gCAAiC,CAC5E,QAAS,CAAE,OAAAF,EAAQ,SAAAC,CAAS,CAC9B,CAAC,CAEL,CAEO,SAASE,GAAmBH,EAAgBC,EAAkBC,EAAqB,CACxF,IAAIE,EACAC,EACJ,GAAI,CACFD,EAAmBjB,EAAiBa,CAAM,EAC1CK,EAAqBlB,EAAiBc,CAAQ,CAChD,OAASb,EAAO,CACdC,EAAK,oBAAqB,GAAGa,CAAK,oCAAqC,CAAE,MAAAd,CAAM,CAAC,CAClF,CAEIgB,IAAqBC,GACvBhB,EAAK,+BAAgC,GAAGa,CAAK,gCAAiC,CAC5E,QAAS,CAAE,OAAAF,EAAQ,SAAAC,CAAS,CAC9B,CAAC,CAEL,CAEO,SAASK,EAAkBN,EAAgBC,EAAkBC,EAAqB,CACnFF,IAAWC,GACbZ,EAAK,+BAAgC,GAAGa,CAAK,gCAAiC,CAC5E,QAAS,CAAE,OAAAF,EAAQ,SAAAC,CAAS,CAC9B,CAAC,CAEL,CAEO,SAASM,GACdP,EACAC,EACM,CACF,KAAK,UAAUD,CAAM,IAAM,KAAK,UAAUC,CAAQ,GACpDZ,EAAK,+BAAgC,8DAA8D,CAEvG,CAEO,SAASmB,EAAsB3B,EAA2BqB,EAAuB,CACtF,OAAI,OAAOrB,GAAU,UACnBQ,EAAK,oBAAqB,GAAGa,CAAK,cAAc,EAE3CrB,CACT,CAEA,SAASM,EAAiBsB,EAAyB,CACjD,SAAO,cAAWA,CAAO,EAAE,YAAY,CACzC,CC3KO,SAASC,GACdC,EACAC,EACiC,CACjCC,EAAkBF,EAAQ,SAAUC,EAAQ,iBAAkB,UAAU,EACxEC,EAAkBF,EAAQ,WAAYC,EAAQ,mBAAoB,YAAY,EAC9EC,EAAkBF,EAAQ,cAAc,YAAa,qBAAsB,2BAA2B,EACtGG,GAA0BH,EAAQ,cAAc,MAAOI,EAAyB,EAChFC,EAAwBL,EAAQ,SAAUM,GAA8B,UAAU,EAClFD,EACEL,EAAQ,gBACRO,EAAyCN,EAAQ,cAAc,EAC/D,iBACF,EAIAI,EACEG,GAAaR,EAAQ,qBAAqB,EAC1CA,EAAQ,eAAe,SACvB,uBACF,EACAK,EACEL,EAAQ,eAAe,WACvBS,EAAsBR,EAAQ,mBAAoB,oBAAoB,EACtE,2BACF,EAEA,IAAMS,EAAkBC,GAAiC,CACvD,gBAAiBX,EAAQ,gBACzB,MAAOI,GACP,MAAO,CAAE,GAAGJ,EAAQ,cAAe,EACnC,UAAWA,EAAQ,SACrB,CAAC,EACD,OAAAY,GAA2B,CACzB,cAAeZ,EAAQ,OACvB,gBAAAU,EACA,eAAgBT,EAAQ,cAC1B,CAAC,EAEMD,CACT,CCrCA,IAAMa,GAAiC,CAAC,WAAY,aAAc,UAAW,WAAY,UAAU,EAE5F,SAASC,GACdC,EACAC,EAC8B,CAC9BC,EAAkBF,EAAQ,SAAUC,EAAQ,iBAAkB,UAAU,EACxEC,EAAkBF,EAAQ,WAAYC,EAAQ,mBAAoB,YAAY,EAC9EC,EAAkBF,EAAQ,SAAS,SAAUA,EAAQ,SAAU,mBAAmB,EAClFE,EAAkBF,EAAQ,SAAS,WAAYA,EAAQ,WAAY,qBAAqB,EACxFE,EAAkBF,EAAQ,cAAc,YAAa,sBAAuB,2BAA2B,EACvGG,GAA0BH,EAAQ,cAAc,MAAOI,EAA0B,EACjFC,EAAwBL,EAAQ,gBAAiBM,GAA2B,iBAAiB,EAC7FD,EAAwBL,EAAQ,SAAUO,GAA+B,UAAU,EACnFF,EAAwBL,EAAQ,SAAS,OAAQQ,EAASR,EAAQ,SAAS,QAAQ,EAAG,iBAAiB,EAGvGK,EAAwBL,EAAQ,SAAS,YAAaQ,EAASR,EAAQ,SAAS,OAAO,EAAG,sBAAsB,EAChHK,EAAwBL,EAAQ,eAAe,OAAQA,EAAQ,SAAS,OAAQ,uBAAuB,EACvGK,EACEL,EAAQ,eAAe,WACvBQ,EAASR,EAAQ,SAAS,UAAU,EACpC,2BACF,EACAS,GACET,EAAQ,eAAe,cACvBU,EAAsBT,EAAQ,sBAAuB,uBAAuB,EAC5E,8BACF,EACAI,EACEL,EAAQ,eAAe,YACvBA,EAAQ,SAAS,YACjB,4BACF,EACAK,EACEL,EAAQ,eAAe,YACvBU,EAAsBT,EAAQ,oBAAqB,qBAAqB,EACxE,4BACF,EACAI,EACEL,EAAQ,eAAe,SACvBW,GAAiBX,EAAQ,QAAQ,EACjC,yBACF,EACAY,GAAiBZ,EAAQ,eAAe,WAAYC,EAAQ,KAAO,KAAK,GAAG,EAE3E,IAAMY,EAAkBC,GAA6B,CACnD,OAAQC,GACR,MAAOX,GACP,MAAO,CAAE,GAAGJ,EAAQ,cAAe,EACnC,UAAWA,EAAQ,SACrB,CAAC,EACD,OAAAgB,GAA2B,CACzB,cAAehB,EAAQ,OACvB,gBAAAa,EACA,eAAgBZ,EAAQ,cAC1B,CAAC,EAEMD,EAAQ,QACjB,CAEA,SAASW,GAAiBM,EAA4C,CACpE,IAAMC,EAAkB,CACtB,SAAUD,EAAQ,SAClB,WAAYA,EAAQ,WACpB,QAASA,EAAQ,QACjB,SAAUA,EAAQ,SAClB,SAAUE,GAAaF,EAAQ,QAAQ,CACzC,EACMG,EAAY,KAAK,UACrB,OAAO,YAAYtB,GAA+B,IAAKuB,GAAU,CAACA,EAAOH,EAAgBG,CAAK,CAAC,CAAC,CAAC,CACnG,EAEA,OAAOb,EAASY,CAAS,CAC3B,CAEA,SAASD,GAAaG,EAA0D,CAC9E,OAAO,OAAO,YAAY,OAAO,QAAQA,CAAQ,EAAE,KAAK,CAAC,CAACC,CAAI,EAAG,CAACC,CAAK,IAAMD,EAAK,cAAcC,CAAK,CAAC,CAAC,CACzG,CAEA,SAASZ,GAAiBa,EAAoBC,EAAyB,CACrE,IAAMC,EAAQD,EAAI,EACd,OAAOC,CAAK,EAAI,OAAOF,CAAU,GACnCG,EAAK,sBAAuB,iDAAkD,CAC5E,QAAS,CAAE,WAAAH,EAAY,MAAAE,CAAM,CAC/B,CAAC,CAEL,CC5FO,SAASE,GACdC,EACAC,EAC8B,CAC9BC,EAAkBF,EAAO,SAAUC,EAAQ,iBAAkB,UAAU,EACvEE,EACEH,EAAO,YACPI,EAAsBH,EAAQ,oBAAqB,qBAAqB,EACxE,aACF,EACAI,GAA2BL,EAAO,oBAAqBC,EAAQ,KAAO,KAAK,GAAG,EAE9E,IAAMK,EAAkBC,GAA6B,CACnD,OAAQC,GACR,MAAOC,GACP,MAAOC,GAAiCV,CAAM,EAC9C,UAAWA,EAAO,eACpB,CAAC,EACD,OAAAW,GAAoBL,EAAiBL,EAAQ,cAAc,EAEpDD,CACT,CAEA,SAASU,GAAiCV,EAAmE,CAC3G,MAAO,CACL,SAAUA,EAAO,SACjB,YAAaA,EAAO,YACpB,kBAAmBY,EAASZ,EAAO,aAAa,EAChD,qBAAsBY,EAASZ,EAAO,gBAAgB,EACtD,UAAWY,EAASZ,EAAO,KAAK,EAChC,eAAgBA,EAAO,eACvB,sBAAuBA,EAAO,sBAC9B,oBAAqBA,EAAO,qBAAuB,EACrD,CACF,CAEA,SAASK,GAA2BQ,EAAoCC,EAAyB,CAC/F,IAAMC,EAAQD,EAAI,EACdD,IAAwB,MAAQ,OAAOE,CAAK,EAAI,OAAOF,CAAmB,GAC5EG,EAAK,sBAAuB,8DAA+D,CACzF,QAAS,CAAE,oBAAAH,EAAqB,MAAAE,CAAM,CACxC,CAAC,CAEL","names":["src_exports","__export","AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX","AWS_NITRO_ROOT_PEM","NitroAttestationError","createEncryptedBuyerTeeSessionMaterial","createEncryptedIdentitySessionMaterial","createEncryptedSellerCredentialUpload","createNitroAttestationClient","encryptBuyerTeeSessionMaterial","encryptIdentitySessionMaterial","encryptSellerCredentialUpload","fetchAndVerifyAttestation","getUnifiedPaymentVerifierDomainSeparator","hashUtf8","requestIdentityAttestation","uploadSellerCredential","verifyBuyerTeePayment","verifyBuyerTeePaymentAttestation","verifyIdentityAttestation","verifySellerCredentialBundle","__toCommonJS","NitroAttestationError","code","message","options","fail","wrapCryptoFailure","promise","cause","resolveFetch","fetchOverride","fail","resolveSubtle","subtleOverride","subtle","resolveGetRandomValues","getRandomValuesOverride","cryptoRef","out","resolveCryptoProvider","params","asCrypto","getRandomValues","randomUuidV4","bytes","hex","byte","BASE64_ALPHABET","BASE64_LOOKUP","buildLookup","alphabet","lookup","index","bytesToHex","bytes","out","byte","utf8Encode","value","bytes","index","codePoint","utf8Decode","out","first","base64Encode","second","third","triplet","BASE64_ALPHABET","base64Decode","decodeBase64","base64UrlEncode","decodeBase64","value","urlSafe","stripped","normalized","padded","bytes","index","chars","pad","a","lookupBase64","BASE64_LOOKUP","b","c","d","triplet","char","lookup","concatBytes","parts","total","sum","part","out","offset","bytesToArrayBuffer","bytes","buildSellerCredentialUploadPlaintext","params","plaintext","buildBuyerTeeSessionMaterialPlaintext","buildIdentitySessionMaterialPlaintext","stringifyUploadPlaintext","JWE_PROTECTED_HEADER","JWE_ID_PATTERN","encryptSellerCredentialUploadWithResolvedCrypto","params","issuedAtMs","jweId","randomUuidV4","assertJweId","encryptKeyBoundPlaintextWithResolvedCrypto","buildSellerCredentialUploadPlaintext","encryptBuyerTeeSessionMaterialWithResolvedCrypto","buildBuyerTeeSessionMaterialPlaintext","encryptIdentitySessionMaterialWithResolvedCrypto","buildIdentitySessionMaterialPlaintext","plaintext","utf8Encode","stringifyUploadPlaintext","cek","rsaKey","wrapCryptoFailure","bytesToArrayBuffer","encryptedKey","iv","protectedHeader","base64UrlEncode","aad","aesKey","encryptedPlaintext","ciphertext","tag","fail","getRandomValues","bytes","hex","byte","encryptBuyerTeeSessionMaterial","params","crypto","resolveCryptoProvider","encryptBuyerTeeSessionMaterialWithResolvedCrypto","import_x509","AWS_NITRO_ROOT_PEM","AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX","CERT_EXPIRY_WARNING_WINDOW_MS","verifyCertificateChain","params","crypto","asCrypto","rootCertificate","parseCertificate","AWS_NITRO_ROOT_PEM","rootFingerprint","certificateSha256","AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX","fail","leafCertificate","cabundle","der","index","allCertificates","certificate","assertCertificateTimeValid","warnNearExpiry","leafFingerprint","intermediates","fingerprint","candidates","candidate","verifyChainLinks","leafPublicKey","wrapCryptoFailure","chain","subject","issuer","raw","label","cause","subtle","bytesToHex","nowMs","onWarning","decodeCbor","bytes","reader","CborReader","value","encodeCbor","encodeTypeAndLength","encoded","utf8Encode","concatBytes","k","v","encodeCoseSigStructure1","protectedHeadersBytes","payloadBytes","majorType","length","bigintLength","head","additional","utf8Decode","out","index","chunks","chunk","key","decodeCoseSign1","attestationDocument","untagged","decoded","decodeCbor","cause","fail","protectedHeadersBytes","unprotectedHeaders","payloadBytes","signature","assertProtectedHeader","verifyCoseSignature","params","sigStructure","encodeCoseSigStructure1","wrapCryptoFailure","PCR8_HEX_LENGTH","normalizePcr8Pin","value","label","normalized","fail","parseAdvertisedPcr8","MAX_ATTESTATION_RESPONSE_BYTES","NETWORK_LAYER_FETCH_ATTEMPTS","NETWORK_LAYER_RETRY_DELAY_MS","ETH_ADDRESS_PATTERN","buildAttestationUrl","attestationServiceUrl","nonceHex","url","strippedPath","fetchAttestationEnvelope","params","response","fetchWithNetworkRetry","responseText","readResponseText","fail","body","cause","validateAttestationEnvelope","isRecord","responseObject","attestationDocument","base64Decode","parseOptionalAddress","parseOptionalAdvertisedPcr8","assertResponseSize","utf8Encode","reader","chunks","totalBytes","done","value","utf8Decode","concatBytes","label","parseAdvertisedPcr8","fetcher","timeoutMs","attempt","fetchWithTimeout","isNetworkLayerFetchFailure","sleep","controller","timeoutHandle","timeoutPromise","_","reject","NitroAttestationError","ms","resolve","NONCE_BYTE_LENGTH","generateNonceHex","getRandomValues","bytesToHex","assertNonceEcho","echoedNonce","expectedNonce","fail","decodeAttestationPayload","payloadBytes","decoded","decodeCbor","cause","fail","payload","requireMap","pcrs","userData","requireBytes","requireTimestamp","utf8Decode","optionalPcrHex","bytesToHex","requireArray","entry","index","value","label","STAGING_ATTESTATION_SERVICE_URL","PRODUCTION_ATTESTATION_SERVICE_URL","STAGING_PCR8","PRODUCTION_PCR8","PREPROD_PCR8","DEFAULT_EXPECTED_PCR8_BY_HOST","normalizePcr8Pin","DEFAULT_ENVIRONMENT_CONFIG","STAGING_ATTESTATION_SERVICE_URL","PRODUCTION_ATTESTATION_SERVICE_URL","resolveExpectedPcr8","params","trust","advertisedExpectedPcr8","onWarning","hostname","normalizePcr8Pin","hostPins","hostPin","findHostPin","bundledPin","DEFAULT_EXPECTED_PCR8_BY_HOST","fail","normalizedAdvertisedPin","configuredHost","pin","DEFAULT_FRESHNESS_WINDOW_MS","fetchAndVerifyAttestation","params","fetcher","resolveFetch","crypto","resolveCryptoProvider","now","nonceHex","generateNonceHex","response","fetchAttestationEnvelope","assertNonceEcho","protectedHeadersBytes","payloadBytes","signature","decodeCoseSign1","payload","decodeAttestationPayload","fail","freshnessWindowMs","nowMs","hostname","expectedPcr8","resolveExpectedPcr8","leafPublicKey","verifyCertificateChain","verifyCoseSignature","bytesToHex","bytesToArrayBuffer","createEncryptedBuyerTeeSessionMaterial","params","verified","fetchAndVerifyAttestation","encryptBuyerTeeSessionMaterial","encryptIdentitySessionMaterial","params","crypto","resolveCryptoProvider","encryptIdentitySessionMaterialWithResolvedCrypto","createEncryptedIdentitySessionMaterial","params","verified","fetchAndVerifyAttestation","encryptIdentitySessionMaterial","encryptSellerCredentialUpload","params","crypto","resolveCryptoProvider","encryptSellerCredentialUploadWithResolvedCrypto","createEncryptedSellerCredentialUpload","params","attestationServiceUrl","trust","fetch","onWarning","timeoutMs","encryptParams","verified","fetchAndVerifyAttestation","encryptSellerCredentialUpload","SERVICE_RESPONSE_SNIPPET_LENGTH","postJsonServiceResponse","params","fetcher","resolveFetch","timeoutMs","controller","timeoutHandle","timeoutPromise","_","reject","response","responseText","buildServiceUrl","cause","fail","envelope","parseServiceResponseEnvelope","failWithServiceResponseEnvelope","isRecord","formatEnvelopeSnippet","failureContext","status","details","value","attestationServiceUrl","path","url","requestIdentityAttestation","params","encryptedSessionMaterial","createEncryptedIdentitySessionMaterial","postJsonServiceResponse","uploadSellerCredential","params","encryptedUpload","createEncryptedSellerCredentialUpload","postJsonServiceResponse","verifyBuyerTeePayment","params","encryptedSessionMaterial","createEncryptedBuyerTeeSessionMaterial","postJsonServiceResponse","createNitroAttestationClient","options","environmentDefaults","DEFAULT_ENVIRONMENT_CONFIG","baseUrl","baseTrust","mergeTrust","params","attestationServiceUrl","trust","fetch","subtle","getRandomValues","now","onWarning","timeoutMs","sessionParams","createEncryptedBuyerTeeSessionMaterial","createEncryptedIdentitySessionMaterial","uploadParams","createEncryptedSellerCredentialUpload","requestIdentityAttestation","uploadSellerCredential","verifyParams","verifyBuyerTeePayment","fetchAndVerifyAttestation","encryptBuyerTeeSessionMaterial","encryptIdentitySessionMaterial","encryptSellerCredentialUpload","base","override","import_ethers","UNIFIED_PAYMENT_VERIFIER_DOMAIN","PAYMENT_ATTESTATION_TYPES","PAYMENT_ATTESTATION_TYPESTRING","PAYMENT_ATTESTATION_TYPEHASH","hashUtf8","IDENTITY_DOMAIN","IDENTITY_ATTESTATION_TYPES","IDENTITY_ATTESTATION_TYPESTRING","IDENTITY_ATTESTATION_TYPEHASH","IDENTITY_DOMAIN_SEPARATOR","SELLER_CREDENTIAL_BUNDLE_DOMAIN","SELLER_CREDENTIAL_BUNDLE_TYPES","getUnifiedPaymentVerifierDomain","params","getUnifiedPaymentVerifierDomainSeparator","value","hashHexBytes","hex","recoverSignerFromDomainSeparator","structHash","digest","normalizeAddress","cause","fail","recoverSignerFromKnownDomain","assertTrustedSigner","recoveredSigner","trustedSigners","recovered","normalizedTrustedSigners","signer","assertTrustedPayloadSigner","payloadSigner","assertLowercaseHexEqual","actual","expected","label","assertAddressEqual","normalizedActual","normalizedExpected","assertStringEqual","assertTypedDataTypesEqual","requireVerifierOption","address","verifyBuyerTeePaymentAttestation","payload","options","assertStringEqual","assertTypedDataTypesEqual","PAYMENT_ATTESTATION_TYPES","assertLowercaseHexEqual","PAYMENT_ATTESTATION_TYPEHASH","getUnifiedPaymentVerifierDomainSeparator","hashHexBytes","requireVerifierOption","recoveredSigner","recoverSignerFromDomainSeparator","assertTrustedPayloadSigner","IDENTITY_CANONICAL_FIELD_ORDER","verifyIdentityAttestation","payload","options","assertStringEqual","assertTypedDataTypesEqual","IDENTITY_ATTESTATION_TYPES","assertLowercaseHexEqual","IDENTITY_DOMAIN_SEPARATOR","IDENTITY_ATTESTATION_TYPEHASH","hashUtf8","assertAddressEqual","requireVerifierOption","hashIdentityData","assertNotExpired","recoveredSigner","recoverSignerFromKnownDomain","IDENTITY_DOMAIN","assertTrustedPayloadSigner","details","canonicalFields","sortMetadata","canonical","field","metadata","left","right","validUntil","now","nowMs","fail","verifySellerCredentialBundle","bundle","options","assertStringEqual","assertLowercaseHexEqual","requireVerifierOption","assertCredentialNotExpired","recoveredSigner","recoverSignerFromKnownDomain","SELLER_CREDENTIAL_BUNDLE_DOMAIN","SELLER_CREDENTIAL_BUNDLE_TYPES","buildSellerCredentialBundleValue","assertTrustedSigner","hashUtf8","credentialExpiresAt","now","nowMs","fail"]}
1
+ {"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/crypto/env.ts","../src/crypto/encoding.ts","../src/jwe/plaintext.ts","../src/jwe/encrypt.ts","../src/encryptBuyerTeeSessionMaterial.ts","../src/attestation/certChain.ts","../src/trust/awsNitroRoot.ts","../src/crypto/cbor.ts","../src/attestation/coseSign1.ts","../src/trust/pcr8.ts","../src/attestation/fetch.ts","../src/attestation/nonce.ts","../src/attestation/payloadFields.ts","../src/trust/pins.ts","../src/trust/resolveExpectedPcr8.ts","../src/fetchAndVerifyAttestation.ts","../src/createEncryptedBuyerTeeSessionMaterial.ts","../src/encryptIdentitySessionMaterial.ts","../src/createEncryptedIdentitySessionMaterial.ts","../src/encryptSellerCredentialUpload.ts","../src/createEncryptedSellerCredentialUpload.ts","../src/identityCallerAddress.ts","../src/serviceResponse.ts","../src/requestIdentityAttestation.ts","../src/uploadSellerCredential.ts","../src/verifyBuyerTeePayment.ts","../src/client.ts","../src/eip712.ts","../src/verifyBuyerTeePaymentAttestation.ts","../src/verifyIdentityAttestation.ts","../src/verifySellerCredentialBundle.ts"],"sourcesContent":["export { createNitroAttestationClient } from \"./client\";\nexport { createEncryptedBuyerTeeSessionMaterial } from \"./createEncryptedBuyerTeeSessionMaterial\";\nexport { createEncryptedIdentitySessionMaterial } from \"./createEncryptedIdentitySessionMaterial\";\nexport { createEncryptedSellerCredentialUpload } from \"./createEncryptedSellerCredentialUpload\";\nexport { getUnifiedPaymentVerifierDomainSeparator, hashUtf8 } from \"./eip712\";\nexport { encryptBuyerTeeSessionMaterial } from \"./encryptBuyerTeeSessionMaterial\";\nexport { encryptIdentitySessionMaterial } from \"./encryptIdentitySessionMaterial\";\nexport { encryptSellerCredentialUpload } from \"./encryptSellerCredentialUpload\";\nexport type { NitroAttestationErrorCode, NitroServiceResponseErrorDetails } from \"./errors\";\nexport { NitroAttestationError } from \"./errors\";\nexport { fetchAndVerifyAttestation } from \"./fetchAndVerifyAttestation\";\nexport { requestIdentityAttestation } from \"./requestIdentityAttestation\";\nexport { AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX, AWS_NITRO_ROOT_PEM } from \"./trust/awsNitroRoot\";\nexport type * from \"./types\";\nexport { uploadSellerCredential } from \"./uploadSellerCredential\";\nexport { verifyBuyerTeePayment } from \"./verifyBuyerTeePayment\";\nexport { verifyBuyerTeePaymentAttestation } from \"./verifyBuyerTeePaymentAttestation\";\nexport { verifyIdentityAttestation } from \"./verifyIdentityAttestation\";\nexport { verifySellerCredentialBundle } from \"./verifySellerCredentialBundle\";\nexport type { NitroAttestationWarning } from \"./warnings\";\n","export type NitroAttestationErrorCode =\n | \"ATTESTATION_FETCH_FAILED\"\n | \"ATTESTATION_RESPONSE_INVALID\"\n | \"SERVICE_RESPONSE_ERROR\"\n | \"ATTESTATION_NONCE_MISMATCH\"\n | \"COSE_STRUCTURE_INVALID\"\n | \"COSE_ALG_UNSUPPORTED\"\n | \"COSE_SIGNATURE_INVALID_SIZE\"\n | \"PAYLOAD_FIELD_MISSING\"\n | \"NONCE_BINDING_FAILED\"\n | \"FRESHNESS_CHECK_FAILED\"\n | \"CERT_CHAIN_INVALID\"\n | \"CERT_NOT_TIME_VALID\"\n | \"AWS_ROOT_FINGERPRINT_MISMATCH\"\n | \"COSE_SIGNATURE_VERIFY_FAILED\"\n | \"PCR8_PIN_MISMATCH\"\n | \"TRUST_PIN_REQUIRED\"\n | \"SIGNER_NOT_TRUSTED\"\n | \"ATTESTATION_SIGNATURE_INVALID\"\n | \"ATTESTATION_BINDING_MISMATCH\"\n | \"ATTESTATION_EXPIRED\"\n | \"INVALID_PARAMETER\"\n | \"TIMEOUT\"\n | \"CRYPTO_UNAVAILABLE\";\n\nexport interface NitroServiceResponseErrorDetails extends Record<string, unknown> {\n status: number;\n statusCode?: number;\n message?: string;\n responseObject?: unknown;\n}\n\nexport class NitroAttestationError extends Error {\n readonly code: NitroAttestationErrorCode;\n override readonly cause?: unknown;\n readonly details?: Record<string, unknown>;\n\n constructor(\n code: NitroAttestationErrorCode,\n message: string,\n options: { cause?: unknown; details?: Record<string, unknown> } = {},\n ) {\n super(message);\n this.name = \"NitroAttestationError\";\n this.code = code;\n this.cause = options.cause;\n this.details = options.details;\n }\n}\n\nexport function fail(\n code: NitroAttestationErrorCode,\n message: string,\n options?: { cause?: unknown; details?: Record<string, unknown> },\n): never {\n throw new NitroAttestationError(code, message, options);\n}\n\nexport async function wrapCryptoFailure<T>(\n promise: Promise<T>,\n code: NitroAttestationErrorCode,\n message: string,\n): Promise<T> {\n try {\n return await promise;\n } catch (cause) {\n fail(code, message, { cause });\n }\n}\n","import { fail } from \"../errors\";\n\nexport interface CryptoProviderParts {\n subtle: SubtleCrypto;\n getRandomValues: (out: Uint8Array) => Uint8Array;\n}\n\nexport function resolveFetch(fetchOverride?: typeof fetch): typeof fetch {\n if (fetchOverride !== undefined) {\n if (typeof fetchOverride !== \"function\") {\n fail(\"CRYPTO_UNAVAILABLE\", \"fetch is unavailable; pass a fetch implementation\");\n }\n return fetchOverride;\n }\n\n if (typeof globalThis.fetch !== \"function\") {\n fail(\"CRYPTO_UNAVAILABLE\", \"fetch is unavailable; pass a fetch implementation\");\n }\n return globalThis.fetch.bind(globalThis);\n}\n\nexport function resolveSubtle(subtleOverride?: SubtleCrypto): SubtleCrypto {\n const subtle = subtleOverride ?? globalThis.crypto?.subtle;\n if (!subtle) {\n fail(\"CRYPTO_UNAVAILABLE\", \"SubtleCrypto is unavailable; pass params.subtle\");\n }\n return subtle;\n}\n\nexport function resolveGetRandomValues(\n getRandomValuesOverride?: (out: Uint8Array) => Uint8Array,\n): (out: Uint8Array) => Uint8Array {\n if (getRandomValuesOverride) {\n return getRandomValuesOverride;\n }\n\n const cryptoRef = globalThis.crypto;\n if (typeof cryptoRef?.getRandomValues !== \"function\") {\n fail(\"CRYPTO_UNAVAILABLE\", \"crypto.getRandomValues is unavailable; pass params.getRandomValues\");\n }\n return (out: Uint8Array) => cryptoRef.getRandomValues(out);\n}\n\nexport function resolveCryptoProvider(params: {\n subtle?: SubtleCrypto;\n getRandomValues?: (out: Uint8Array) => Uint8Array;\n}): CryptoProviderParts {\n return {\n subtle: resolveSubtle(params.subtle),\n getRandomValues: resolveGetRandomValues(params.getRandomValues),\n };\n}\n\nexport function asCrypto(subtle: SubtleCrypto, getRandomValues: (out: Uint8Array) => Uint8Array): Crypto {\n if (typeof getRandomValues !== \"function\") {\n fail(\"CRYPTO_UNAVAILABLE\", \"crypto.getRandomValues is unavailable; pass params.getRandomValues\");\n }\n return {\n subtle,\n getRandomValues,\n randomUUID: () => randomUuidV4(getRandomValues),\n } as Crypto;\n}\n\nfunction randomUuidV4(\n getRandomValues: (out: Uint8Array) => Uint8Array,\n): `${string}-${string}-${string}-${string}-${string}` {\n const bytes = getRandomValues(new Uint8Array(16));\n bytes[6] = (bytes[6] & 0x0f) | 0x40;\n bytes[8] = (bytes[8] & 0x3f) | 0x80;\n const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\"));\n return `${hex.slice(0, 4).join(\"\")}-${hex.slice(4, 6).join(\"\")}-${hex.slice(6, 8).join(\"\")}-${hex\n .slice(8, 10)\n .join(\"\")}-${hex.slice(10).join(\"\")}`;\n}\n","const BASE64_ALPHABET = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\nconst BASE64_LOOKUP = buildLookup(BASE64_ALPHABET);\n\nfunction buildLookup(alphabet: string): Record<string, number> {\n const lookup: Record<string, number> = {};\n for (let index = 0; index < alphabet.length; index += 1) {\n lookup[alphabet[index]] = index;\n }\n return lookup;\n}\n\nexport function bytesToHex(bytes: Uint8Array): string {\n let out = \"\";\n for (const byte of bytes) {\n out += byte.toString(16).padStart(2, \"0\");\n }\n return out;\n}\n\nexport function normalizeHex(value: string): string {\n return value.replace(/^0x/i, \"\").toLowerCase();\n}\n\nexport function hexToBytes(hex: string): Uint8Array {\n const normalized = normalizeHex(hex);\n if (normalized.length % 2 !== 0 || !/^[0-9a-f]*$/.test(normalized)) {\n throw new Error(`Invalid hex string: ${hex}`);\n }\n\n const bytes = new Uint8Array(normalized.length / 2);\n for (let index = 0; index < bytes.length; index += 1) {\n bytes[index] = Number.parseInt(normalized.slice(index * 2, index * 2 + 2), 16);\n }\n return bytes;\n}\n\nexport function utf8Encode(value: string): Uint8Array {\n if (typeof TextEncoder !== \"undefined\") {\n return new TextEncoder().encode(value);\n }\n\n const bytes: number[] = [];\n for (let index = 0; index < value.length; index += 1) {\n const codePoint = value.codePointAt(index) as number;\n if (codePoint > 0xffff) {\n index += 1;\n }\n if (codePoint <= 0x7f) {\n bytes.push(codePoint);\n } else if (codePoint <= 0x7ff) {\n bytes.push(0xc0 | (codePoint >> 6), 0x80 | (codePoint & 0x3f));\n } else if (codePoint <= 0xffff) {\n bytes.push(0xe0 | (codePoint >> 12), 0x80 | ((codePoint >> 6) & 0x3f), 0x80 | (codePoint & 0x3f));\n } else {\n bytes.push(\n 0xf0 | (codePoint >> 18),\n 0x80 | ((codePoint >> 12) & 0x3f),\n 0x80 | ((codePoint >> 6) & 0x3f),\n 0x80 | (codePoint & 0x3f),\n );\n }\n }\n return new Uint8Array(bytes);\n}\n\nexport function utf8Decode(bytes: Uint8Array): string {\n if (typeof TextDecoder !== \"undefined\") {\n return new TextDecoder().decode(bytes);\n }\n\n let out = \"\";\n for (let index = 0; index < bytes.length; index += 1) {\n const first = bytes[index];\n if (first < 0x80) {\n out += String.fromCodePoint(first);\n } else if ((first & 0xe0) === 0xc0) {\n out += String.fromCodePoint(((first & 0x1f) << 6) | (bytes[++index] & 0x3f));\n } else if ((first & 0xf0) === 0xe0) {\n out += String.fromCodePoint(((first & 0x0f) << 12) | ((bytes[++index] & 0x3f) << 6) | (bytes[++index] & 0x3f));\n } else {\n out += String.fromCodePoint(\n ((first & 0x07) << 18) |\n ((bytes[++index] & 0x3f) << 12) |\n ((bytes[++index] & 0x3f) << 6) |\n (bytes[++index] & 0x3f),\n );\n }\n }\n return out;\n}\n\nexport function base64Encode(bytes: Uint8Array): string {\n let out = \"\";\n for (let index = 0; index < bytes.length; index += 3) {\n const first = bytes[index];\n const second = bytes[index + 1] ?? 0;\n const third = bytes[index + 2] ?? 0;\n const triplet = (first << 16) | (second << 8) | third;\n\n out += BASE64_ALPHABET[(triplet >> 18) & 0x3f];\n out += BASE64_ALPHABET[(triplet >> 12) & 0x3f];\n out += index + 1 < bytes.length ? BASE64_ALPHABET[(triplet >> 6) & 0x3f] : \"=\";\n out += index + 2 < bytes.length ? BASE64_ALPHABET[triplet & 0x3f] : \"=\";\n }\n return out;\n}\n\nexport function base64Decode(value: string): Uint8Array {\n return decodeBase64(value, false);\n}\n\nexport function base64UrlEncode(bytes: Uint8Array): string {\n return base64Encode(bytes).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/, \"\");\n}\n\nexport function base64UrlDecode(value: string): Uint8Array {\n return decodeBase64(value, true);\n}\n\nfunction decodeBase64(value: string, urlSafe: boolean): Uint8Array {\n const stripped = value.replace(/\\s+/g, \"\");\n const normalized = urlSafe ? stripped.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\") : stripped;\n if (normalized.length % 4 === 1) {\n throw new Error(\"Invalid base64 length\");\n }\n const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n\n const bytes: number[] = [];\n for (let index = 0; index < padded.length; index += 4) {\n const chars = padded.slice(index, index + 4);\n const pad = chars.endsWith(\"==\") ? 2 : chars.endsWith(\"=\") ? 1 : 0;\n const a = lookupBase64(chars[0], BASE64_LOOKUP);\n const b = lookupBase64(chars[1], BASE64_LOOKUP);\n const c = chars[2] === \"=\" ? 0 : lookupBase64(chars[2], BASE64_LOOKUP);\n const d = chars[3] === \"=\" ? 0 : lookupBase64(chars[3], BASE64_LOOKUP);\n const triplet = (a << 18) | (b << 12) | (c << 6) | d;\n\n bytes.push((triplet >> 16) & 0xff);\n if (pad < 2) {\n bytes.push((triplet >> 8) & 0xff);\n }\n if (pad < 1) {\n bytes.push(triplet & 0xff);\n }\n }\n return new Uint8Array(bytes);\n}\n\nfunction lookupBase64(char: string, lookup: Record<string, number>): number {\n const value = lookup[char];\n if (value === undefined) {\n throw new Error(`Invalid base64 character: ${char}`);\n }\n return value;\n}\n\nexport function concatBytes(parts: Uint8Array[]): Uint8Array {\n const total = parts.reduce((sum, part) => sum + part.length, 0);\n const out = new Uint8Array(total);\n let offset = 0;\n for (const part of parts) {\n out.set(part, offset);\n offset += part.length;\n }\n return out;\n}\n\nexport function toUint8Array(value: ArrayBuffer | Uint8Array): Uint8Array {\n return value instanceof Uint8Array ? value : new Uint8Array(value);\n}\n\nexport function bytesToArrayBuffer(bytes: Uint8Array): ArrayBuffer {\n return new Uint8Array(bytes).buffer;\n}\n","import type {\n AttestedSellerUploadKey,\n BuyerTeeSessionMaterialPayloadFor,\n BuyerTeeSessionMaterialPlatform,\n IdentityRequestPlatform,\n IdentitySessionMaterialPayloadFor,\n SellerCredentialUploadPayload,\n} from \"../types\";\n\nexport interface SellerCredentialUploadPlaintext {\n payeeId?: string;\n callerAddress?: string;\n sessionMaterial: unknown;\n boundPubKeySha256: string;\n issuedAtMs: number;\n jweId: string;\n}\n\nexport interface BuyerTeeSessionMaterialPlaintext {\n platform: string;\n actionType: string;\n sessionMaterial: unknown;\n boundPubKeySha256: string;\n}\n\nexport type IdentitySessionMaterialPlaintext = BuyerTeeSessionMaterialPlaintext;\n\nexport function buildSellerCredentialUploadPlaintext(\n params: {\n key: AttestedSellerUploadKey;\n issuedAtMs: number;\n jweId: string;\n } & SellerCredentialUploadPayload,\n): SellerCredentialUploadPlaintext {\n const plaintext = {\n sessionMaterial: params.sessionMaterial,\n ...(params.callerAddress !== undefined ? { callerAddress: params.callerAddress } : {}),\n boundPubKeySha256: params.key.publicKeySha256Hex,\n issuedAtMs: params.issuedAtMs,\n jweId: params.jweId,\n };\n\n if (params.platform === \"wise\" || params.platform === \"monobank\") {\n return plaintext;\n }\n\n return {\n payeeId: params.payeeId,\n ...plaintext,\n };\n}\n\nexport function buildBuyerTeeSessionMaterialPlaintext<P extends BuyerTeeSessionMaterialPlatform>(\n params: {\n key: AttestedSellerUploadKey;\n } & BuyerTeeSessionMaterialPayloadFor<P>,\n): BuyerTeeSessionMaterialPlaintext {\n return {\n platform: params.platform,\n actionType: params.actionType,\n sessionMaterial: params.sessionMaterial,\n boundPubKeySha256: params.key.publicKeySha256Hex,\n };\n}\n\nexport function buildIdentitySessionMaterialPlaintext<P extends IdentityRequestPlatform>(\n params: {\n key: AttestedSellerUploadKey;\n } & IdentitySessionMaterialPayloadFor<P>,\n): IdentitySessionMaterialPlaintext {\n // Keep this wire shape in sync with src/common/nitroBridge/teeSessionUploadCipher.ts.\n return {\n platform: params.platform,\n actionType: params.actionType,\n sessionMaterial: params.sessionMaterial,\n boundPubKeySha256: params.key.publicKeySha256Hex,\n };\n}\n\nexport function stringifyUploadPlaintext(\n plaintext: SellerCredentialUploadPlaintext | BuyerTeeSessionMaterialPlaintext | IdentitySessionMaterialPlaintext,\n): string {\n return JSON.stringify(plaintext);\n}\n","import { base64UrlEncode, bytesToArrayBuffer, utf8Encode } from \"../crypto/encoding\";\nimport { fail, wrapCryptoFailure } from \"../errors\";\nimport type {\n AttestedSellerUploadKey,\n BuyerTeeSessionMaterialPlatform,\n EncryptBuyerTeeSessionMaterialParamsFor,\n EncryptIdentitySessionMaterialParamsFor,\n EncryptSellerCredentialUploadParams,\n IdentityRequestPlatform,\n} from \"../types\";\nimport {\n buildBuyerTeeSessionMaterialPlaintext,\n buildIdentitySessionMaterialPlaintext,\n buildSellerCredentialUploadPlaintext,\n stringifyUploadPlaintext,\n} from \"./plaintext\";\n\nconst JWE_PROTECTED_HEADER = { alg: \"RSA-OAEP-256\", enc: \"A256GCM\" } as const;\nconst JWE_ID_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;\n\nexport async function encryptSellerCredentialUploadWithResolvedCrypto(params: {\n request: EncryptSellerCredentialUploadParams;\n subtle: SubtleCrypto;\n getRandomValues: (out: Uint8Array) => Uint8Array;\n now: () => number;\n}): Promise<string> {\n const issuedAtMs = params.request.issuedAtMs ?? params.now();\n const jweId = params.request.jweId ?? randomUuidV4(params.getRandomValues);\n assertJweId(jweId);\n\n return encryptKeyBoundPlaintextWithResolvedCrypto({\n key: params.request.key,\n plaintext: buildSellerCredentialUploadPlaintext({\n ...params.request,\n issuedAtMs,\n jweId,\n }),\n subtle: params.subtle,\n getRandomValues: params.getRandomValues,\n failureContext: \"seller credential upload\",\n });\n}\n\nexport async function encryptBuyerTeeSessionMaterialWithResolvedCrypto<\n P extends BuyerTeeSessionMaterialPlatform,\n>(params: {\n request: EncryptBuyerTeeSessionMaterialParamsFor<P>;\n subtle: SubtleCrypto;\n getRandomValues: (out: Uint8Array) => Uint8Array;\n}): Promise<string> {\n return encryptKeyBoundPlaintextWithResolvedCrypto({\n key: params.request.key,\n plaintext: buildBuyerTeeSessionMaterialPlaintext(params.request),\n subtle: params.subtle,\n getRandomValues: params.getRandomValues,\n failureContext: \"buyer TEE session material\",\n });\n}\n\nexport async function encryptIdentitySessionMaterialWithResolvedCrypto<P extends IdentityRequestPlatform>(params: {\n request: EncryptIdentitySessionMaterialParamsFor<P>;\n subtle: SubtleCrypto;\n getRandomValues: (out: Uint8Array) => Uint8Array;\n}): Promise<string> {\n return encryptKeyBoundPlaintextWithResolvedCrypto({\n key: params.request.key,\n plaintext: buildIdentitySessionMaterialPlaintext(params.request),\n subtle: params.subtle,\n getRandomValues: params.getRandomValues,\n failureContext: \"identity session material\",\n });\n}\n\nasync function encryptKeyBoundPlaintextWithResolvedCrypto(params: {\n key: AttestedSellerUploadKey;\n plaintext: Parameters<typeof stringifyUploadPlaintext>[0];\n subtle: SubtleCrypto;\n getRandomValues: (out: Uint8Array) => Uint8Array;\n failureContext: string;\n}): Promise<string> {\n const plaintext = utf8Encode(stringifyUploadPlaintext(params.plaintext));\n\n const cek = params.getRandomValues(new Uint8Array(32));\n const rsaKey = await wrapCryptoFailure(\n params.subtle.importKey(\n \"spki\",\n bytesToArrayBuffer(params.key.publicKeyDer),\n { name: \"RSA-OAEP\", hash: \"SHA-256\" },\n false,\n [\"encrypt\"],\n ),\n \"CRYPTO_UNAVAILABLE\",\n \"Failed to import attested enclave-upload RSA public key\",\n );\n const encryptedKey = new Uint8Array(\n await wrapCryptoFailure(\n params.subtle.encrypt({ name: \"RSA-OAEP\" }, rsaKey, bytesToArrayBuffer(cek)),\n \"CRYPTO_UNAVAILABLE\",\n \"Failed to RSA-OAEP encrypt the content encryption key\",\n ),\n );\n\n const iv = params.getRandomValues(new Uint8Array(12));\n const protectedHeader = base64UrlEncode(utf8Encode(JSON.stringify(JWE_PROTECTED_HEADER)));\n const aad = utf8Encode(protectedHeader);\n const aesKey = await wrapCryptoFailure(\n params.subtle.importKey(\"raw\", bytesToArrayBuffer(cek), { name: \"AES-GCM\", length: 256 }, false, [\"encrypt\"]),\n \"CRYPTO_UNAVAILABLE\",\n \"Failed to import generated AES-GCM content encryption key\",\n );\n const encryptedPlaintext = new Uint8Array(\n await wrapCryptoFailure(\n params.subtle.encrypt(\n {\n name: \"AES-GCM\",\n iv: bytesToArrayBuffer(iv),\n additionalData: bytesToArrayBuffer(aad),\n tagLength: 128,\n },\n aesKey,\n bytesToArrayBuffer(plaintext),\n ),\n \"CRYPTO_UNAVAILABLE\",\n `Failed to AES-GCM encrypt ${params.failureContext}`,\n ),\n );\n const ciphertext = encryptedPlaintext.slice(0, encryptedPlaintext.length - 16);\n const tag = encryptedPlaintext.slice(encryptedPlaintext.length - 16);\n\n return [\n protectedHeader,\n base64UrlEncode(encryptedKey),\n base64UrlEncode(iv),\n base64UrlEncode(ciphertext),\n base64UrlEncode(tag),\n ].join(\".\");\n}\n\n// Seller upload only — buyer TEE envelopes no longer carry a jweId.\nfunction assertJweId(jweId: string): void {\n if (!JWE_ID_PATTERN.test(jweId)) {\n fail(\"INVALID_PARAMETER\", \"jweId must be 16-128 URL-safe characters\");\n }\n}\n\n// Seller upload only — buyer TEE envelopes no longer carry a jweId.\nfunction randomUuidV4(getRandomValues: (out: Uint8Array) => Uint8Array): string {\n const bytes = getRandomValues(new Uint8Array(16));\n bytes[6] = (bytes[6] & 0x0f) | 0x40;\n bytes[8] = (bytes[8] & 0x3f) | 0x80;\n const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\"));\n return `${hex.slice(0, 4).join(\"\")}-${hex.slice(4, 6).join(\"\")}-${hex.slice(6, 8).join(\"\")}-${hex\n .slice(8, 10)\n .join(\"\")}-${hex.slice(10).join(\"\")}`;\n}\n","import { resolveCryptoProvider } from \"./crypto/env\";\nimport { encryptBuyerTeeSessionMaterialWithResolvedCrypto } from \"./jwe/encrypt\";\nimport type { BuyerTeeSessionMaterialPlatform, EncryptBuyerTeeSessionMaterialParamsFor } from \"./types\";\n\nexport async function encryptBuyerTeeSessionMaterial<P extends BuyerTeeSessionMaterialPlatform>(\n params: EncryptBuyerTeeSessionMaterialParamsFor<P>,\n): Promise<string> {\n const crypto = resolveCryptoProvider(params);\n return encryptBuyerTeeSessionMaterialWithResolvedCrypto({\n request: params,\n subtle: crypto.subtle,\n getRandomValues: crypto.getRandomValues,\n });\n}\n","import { X509Certificate } from \"@peculiar/x509\";\nimport { bytesToHex } from \"../crypto/encoding\";\nimport { asCrypto } from \"../crypto/env\";\nimport { fail, wrapCryptoFailure } from \"../errors\";\nimport { AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX, AWS_NITRO_ROOT_PEM } from \"../trust/awsNitroRoot\";\nimport type { NitroAttestationWarning } from \"../warnings\";\n\nconst CERT_EXPIRY_WARNING_WINDOW_MS = 7 * 24 * 60 * 60 * 1000;\n\nexport interface VerifiedCertificateChain {\n leafCertificate: X509Certificate;\n leafPublicKey: CryptoKey;\n}\n\nexport async function verifyCertificateChain(params: {\n leafCertificateDer: Uint8Array;\n cabundleDer: Uint8Array[];\n rootPem?: string;\n nowMs: number;\n subtle: SubtleCrypto;\n getRandomValues: (out: Uint8Array) => Uint8Array;\n onWarning?: (warning: NitroAttestationWarning) => void;\n}): Promise<VerifiedCertificateChain> {\n const crypto = asCrypto(params.subtle, params.getRandomValues);\n const rootCertificate = parseCertificate(params.rootPem ?? AWS_NITRO_ROOT_PEM, \"AWS Nitro root certificate\");\n const rootFingerprint = await certificateSha256(rootCertificate, params.subtle);\n\n if (rootFingerprint !== AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX) {\n fail(\"AWS_ROOT_FINGERPRINT_MISMATCH\", \"Bundled AWS Nitro root certificate fingerprint mismatch\", {\n details: { expected: AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX, actual: rootFingerprint },\n });\n }\n\n const leafCertificate = parseCertificate(params.leafCertificateDer, \"attestation leaf certificate\");\n const cabundle = params.cabundleDer.map((der, index) => parseCertificate(der, `cabundle[${index}]`));\n const allCertificates = [rootCertificate, ...cabundle, leafCertificate];\n for (const certificate of allCertificates) {\n assertCertificateTimeValid(certificate, params.nowMs);\n warnNearExpiry(certificate, params.nowMs, params.onWarning);\n }\n\n const leafFingerprint = await certificateSha256(leafCertificate, params.subtle);\n const intermediates = [];\n for (const certificate of cabundle) {\n const fingerprint = await certificateSha256(certificate, params.subtle);\n if (fingerprint !== leafFingerprint && fingerprint !== rootFingerprint) {\n intermediates.push(certificate);\n }\n }\n\n const candidates = [\n [leafCertificate, ...intermediates.slice().reverse(), rootCertificate],\n [leafCertificate, ...intermediates, rootCertificate],\n ];\n\n for (const candidate of candidates) {\n if (await verifyChainLinks(candidate, crypto)) {\n const leafPublicKey = await wrapCryptoFailure(\n leafCertificate.publicKey.export({ name: \"ECDSA\", namedCurve: \"P-384\" }, [\"verify\"], crypto),\n \"CERT_CHAIN_INVALID\",\n \"Failed to export attestation leaf public key\",\n );\n return { leafCertificate, leafPublicKey };\n }\n }\n\n fail(\"CERT_CHAIN_INVALID\", \"Attestation certificate chain does not verify to the pinned AWS Nitro root\");\n}\n\nasync function verifyChainLinks(chain: X509Certificate[], crypto: Crypto): Promise<boolean> {\n for (let index = 0; index < chain.length - 1; index += 1) {\n const subject = chain[index];\n const issuer = chain[index + 1];\n const ok = await subject.verify({ publicKey: issuer.publicKey, signatureOnly: true }, crypto);\n if (!ok) {\n return false;\n }\n }\n\n return chain.length > 0 && (await chain[chain.length - 1].isSelfSigned(crypto));\n}\n\nfunction parseCertificate(raw: string | Uint8Array, label: string): X509Certificate {\n try {\n return new X509Certificate(raw);\n } catch (cause) {\n fail(\"CERT_CHAIN_INVALID\", `Could not parse ${label}`, { cause });\n }\n}\n\nasync function certificateSha256(certificate: X509Certificate, subtle: SubtleCrypto): Promise<string> {\n return bytesToHex(new Uint8Array(await subtle.digest(\"SHA-256\", certificate.rawData)));\n}\n\nfunction assertCertificateTimeValid(certificate: X509Certificate, nowMs: number): void {\n if (nowMs < certificate.notBefore.getTime() || nowMs > certificate.notAfter.getTime()) {\n fail(\"CERT_NOT_TIME_VALID\", \"Certificate is outside its validity window\", {\n details: {\n subject: certificate.subject,\n notBefore: certificate.notBefore.toISOString(),\n notAfter: certificate.notAfter.toISOString(),\n },\n });\n }\n}\n\nfunction warnNearExpiry(\n certificate: X509Certificate,\n nowMs: number,\n onWarning?: (warning: NitroAttestationWarning) => void,\n): void {\n if (certificate.notAfter.getTime() < nowMs + CERT_EXPIRY_WARNING_WINDOW_MS) {\n onWarning?.({\n code: \"CERT_VALIDITY_NEAR_EXPIRY\",\n message: \"Certificate in Nitro attestation chain expires within 7 days\",\n details: {\n subject: certificate.subject,\n notAfter: certificate.notAfter.toISOString(),\n },\n });\n }\n}\n","export const AWS_NITRO_ROOT_PEM = `-----BEGIN CERTIFICATE-----\nMIICETCCAZagAwIBAgIRAPkxdWgbkK/hHUbMtOTn+FYwCgYIKoZIzj0EAwMwSTEL\nMAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMRswGQYD\nVQQDDBJhd3Mubml0cm8tZW5jbGF2ZXMwHhcNMTkxMDI4MTMyODA1WhcNNDkxMDI4\nMTQyODA1WjBJMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQL\nDANBV1MxGzAZBgNVBAMMEmF3cy5uaXRyby1lbmNsYXZlczB2MBAGByqGSM49AgEG\nBSuBBAAiA2IABPwCVOumCMHzaHDimtqQvkY4MpJzbolL//Zy2YlES1BR5TSksfbb\n48C8WBoyt7F2Bw7eEtaaP+ohG2bnUs990d0JX28TcPQXCEPZ3BABIeTPYwEoCWZE\nh8l5YoQwTcU/9KNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUkCW1DdkF\nR+eWw5b6cp3PmanfS5YwDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMDA2kAMGYC\nMQCjfy+Rocm9Xue4YnwWmNJVA44fA0P5W2OpYow9OYCVRaEevL8uO1XYru5xtMPW\nrfMCMQCi85sWBbJwKKXdS6BptQFuZbT73o/gBh1qUxl/nNr12UO8Yfwr6wPLb+6N\nIwLz3/Y=\n-----END CERTIFICATE-----\n`;\n\nexport const AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX = \"641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68f79bb5b\";\n","import { concatBytes, utf8Decode, utf8Encode } from \"./encoding\";\n\nexport type CborValue =\n | bigint\n | number\n | string\n | Uint8Array\n | CborValue[]\n | Map<CborValue, CborValue>\n | boolean\n | null;\n\nexport function decodeCbor(bytes: Uint8Array): CborValue {\n const reader = new CborReader(bytes);\n const value = reader.readValue();\n if (!reader.done()) {\n throw new Error(\"Trailing CBOR bytes\");\n }\n return value;\n}\n\nexport function encodeCbor(value: CborValue): Uint8Array {\n if (typeof value === \"number\") {\n if (!Number.isSafeInteger(value)) {\n throw new Error(\"CBOR number must be a safe integer\");\n }\n return value >= 0 ? encodeTypeAndLength(0, value) : encodeTypeAndLength(1, -1 - value);\n }\n if (typeof value === \"bigint\") {\n return value >= 0n ? encodeTypeAndLength(0, value) : encodeTypeAndLength(1, -1n - value);\n }\n if (typeof value === \"string\") {\n const encoded = utf8Encode(value);\n return concatBytes([encodeTypeAndLength(3, encoded.length), encoded]);\n }\n if (value instanceof Uint8Array) {\n return concatBytes([encodeTypeAndLength(2, value.length), value]);\n }\n if (Array.isArray(value)) {\n return concatBytes([encodeTypeAndLength(4, value.length), ...value.map(encodeCbor)]);\n }\n if (value instanceof Map) {\n // This minimal encoder preserves Map insertion order; callers that need canonical map ordering must sort first.\n return concatBytes([\n encodeTypeAndLength(5, value.size),\n ...Array.from(value.entries()).flatMap(([k, v]) => [encodeCbor(k), encodeCbor(v)]),\n ]);\n }\n if (typeof value === \"boolean\") {\n return new Uint8Array([value ? 0xf5 : 0xf4]);\n }\n if (value === null) {\n return new Uint8Array([0xf6]);\n }\n throw new Error(\"Unsupported CBOR value\");\n}\n\nexport function encodeCoseSigStructure1(protectedHeadersBytes: Uint8Array, payloadBytes: Uint8Array): Uint8Array {\n return encodeCbor([\"Signature1\", protectedHeadersBytes, new Uint8Array(), payloadBytes]);\n}\n\nfunction encodeTypeAndLength(majorType: number, length: number | bigint): Uint8Array {\n const bigintLength = BigInt(length);\n if (bigintLength < 24n) {\n return new Uint8Array([(majorType << 5) | Number(bigintLength)]);\n }\n if (bigintLength <= 0xffn) {\n return new Uint8Array([(majorType << 5) | 24, Number(bigintLength)]);\n }\n if (bigintLength <= 0xffffn) {\n return new Uint8Array([(majorType << 5) | 25, Number((bigintLength >> 8n) & 0xffn), Number(bigintLength & 0xffn)]);\n }\n if (bigintLength <= 0xffffffffn) {\n return new Uint8Array([\n (majorType << 5) | 26,\n Number((bigintLength >> 24n) & 0xffn),\n Number((bigintLength >> 16n) & 0xffn),\n Number((bigintLength >> 8n) & 0xffn),\n Number(bigintLength & 0xffn),\n ]);\n }\n\n return new Uint8Array([\n (majorType << 5) | 27,\n Number((bigintLength >> 56n) & 0xffn),\n Number((bigintLength >> 48n) & 0xffn),\n Number((bigintLength >> 40n) & 0xffn),\n Number((bigintLength >> 32n) & 0xffn),\n Number((bigintLength >> 24n) & 0xffn),\n Number((bigintLength >> 16n) & 0xffn),\n Number((bigintLength >> 8n) & 0xffn),\n Number(bigintLength & 0xffn),\n ]);\n}\n\nclass CborReader {\n private offset = 0;\n\n constructor(private readonly bytes: Uint8Array) {}\n\n done(): boolean {\n return this.offset === this.bytes.length;\n }\n\n readValue(): CborValue {\n const head = this.readByte();\n const majorType = head >> 5;\n const additional = head & 0x1f;\n\n if (additional === 31) {\n return this.readIndefiniteValue(majorType);\n }\n\n if (majorType === 0) {\n return this.readLength(additional);\n }\n if (majorType === 1) {\n const value = this.readLength(additional);\n return typeof value === \"bigint\" ? -1n - value : -1 - value;\n }\n if (majorType === 2) {\n const length = this.lengthAsNumber(this.readLength(additional));\n return this.readBytes(length);\n }\n if (majorType === 3) {\n const length = this.lengthAsNumber(this.readLength(additional));\n return utf8Decode(this.readBytes(length));\n }\n if (majorType === 4) {\n const length = this.lengthAsNumber(this.readLength(additional));\n const out: CborValue[] = [];\n for (let index = 0; index < length; index += 1) {\n out.push(this.readValue());\n }\n return out;\n }\n if (majorType === 5) {\n const length = this.lengthAsNumber(this.readLength(additional));\n const out = new Map<CborValue, CborValue>();\n for (let index = 0; index < length; index += 1) {\n out.set(this.readValue(), this.readValue());\n }\n return out;\n }\n if (majorType === 6) {\n this.readLength(additional);\n return this.readValue();\n }\n if (majorType === 7) {\n if (additional === 20) {\n return false;\n }\n if (additional === 21) {\n return true;\n }\n if (additional === 22) {\n return null;\n }\n }\n throw new Error(`Unsupported CBOR major/additional type: ${majorType}/${additional}`);\n }\n\n private readIndefiniteValue(majorType: number): CborValue {\n if (majorType === 2) {\n const chunks: Uint8Array[] = [];\n while (!this.consumeBreak()) {\n const chunk = this.readValue();\n if (!(chunk instanceof Uint8Array)) {\n throw new Error(\"Indefinite CBOR byte string chunk must be a byte string\");\n }\n chunks.push(chunk);\n }\n return concatBytes(chunks);\n }\n if (majorType === 3) {\n let out = \"\";\n while (!this.consumeBreak()) {\n const chunk = this.readValue();\n if (typeof chunk !== \"string\") {\n throw new Error(\"Indefinite CBOR text string chunk must be a text string\");\n }\n out += chunk;\n }\n return out;\n }\n if (majorType === 4) {\n const out: CborValue[] = [];\n while (!this.consumeBreak()) {\n out.push(this.readValue());\n }\n return out;\n }\n if (majorType === 5) {\n const out = new Map<CborValue, CborValue>();\n while (!this.consumeBreak()) {\n const key = this.readValue();\n if (this.peekBreak()) {\n throw new Error(\"Indefinite CBOR map ended after a key\");\n }\n out.set(key, this.readValue());\n }\n return out;\n }\n throw new Error(`Indefinite CBOR major type ${majorType} is not supported`);\n }\n\n private readLength(additional: number): number | bigint {\n if (additional < 24) {\n return additional;\n }\n if (additional === 24) {\n return this.readByte();\n }\n if (additional === 25) {\n return (this.readByte() << 8) | this.readByte();\n }\n if (additional === 26) {\n return (this.readByte() * 0x1000000 + (this.readByte() << 16) + (this.readByte() << 8) + this.readByte()) >>> 0;\n }\n if (additional === 27) {\n let value = 0n;\n for (let index = 0; index < 8; index += 1) {\n value = (value << 8n) | BigInt(this.readByte());\n }\n return value <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(value) : value;\n }\n throw new Error(\"Indefinite CBOR lengths are not supported\");\n }\n\n private readByte(): number {\n if (this.offset >= this.bytes.length) {\n throw new Error(\"Unexpected end of CBOR input\");\n }\n return this.bytes[this.offset++];\n }\n\n private peekBreak(): boolean {\n return this.offset < this.bytes.length && this.bytes[this.offset] === 0xff;\n }\n\n private consumeBreak(): boolean {\n if (this.peekBreak()) {\n this.offset += 1;\n return true;\n }\n return false;\n }\n\n private readBytes(length: number): Uint8Array {\n if (this.offset + length > this.bytes.length) {\n throw new Error(\"Unexpected end of CBOR byte string\");\n }\n const out = this.bytes.slice(this.offset, this.offset + length);\n this.offset += length;\n return out;\n }\n\n private lengthAsNumber(value: number | bigint): number {\n if (typeof value === \"bigint\") {\n throw new Error(\"CBOR length exceeds JavaScript safe integer range\");\n }\n return value;\n }\n}\n","import { decodeCbor, encodeCoseSigStructure1 } from \"../crypto/cbor\";\nimport { fail, wrapCryptoFailure } from \"../errors\";\n\nexport interface DecodedCoseSign1 {\n protectedHeadersBytes: Uint8Array;\n payloadBytes: Uint8Array;\n signature: Uint8Array;\n}\n\nexport function decodeCoseSign1(attestationDocument: Uint8Array): DecodedCoseSign1 {\n const untagged = attestationDocument[0] === 0xd2 ? attestationDocument.slice(1) : attestationDocument;\n let decoded: unknown;\n try {\n decoded = decodeCbor(untagged);\n } catch (cause) {\n fail(\"COSE_STRUCTURE_INVALID\", \"Attestation document is not a valid COSE_Sign1 CBOR value\", { cause });\n }\n\n if (!Array.isArray(decoded) || decoded.length !== 4) {\n fail(\"COSE_STRUCTURE_INVALID\", \"COSE_Sign1 must be [protected, unprotected, payload, signature]\");\n }\n\n const [protectedHeadersBytes, unprotectedHeaders, payloadBytes, signature] = decoded;\n if (\n !(protectedHeadersBytes instanceof Uint8Array) ||\n !(unprotectedHeaders instanceof Map) ||\n !(payloadBytes instanceof Uint8Array) ||\n !(signature instanceof Uint8Array)\n ) {\n fail(\"COSE_STRUCTURE_INVALID\", \"COSE_Sign1 fields have invalid CBOR types\");\n }\n\n assertProtectedHeader(protectedHeadersBytes);\n if (signature.length !== 96) {\n fail(\"COSE_SIGNATURE_INVALID_SIZE\", `Expected a 96-byte ES384 signature, got ${signature.length} bytes`);\n }\n\n return { protectedHeadersBytes, payloadBytes, signature };\n}\n\nexport async function verifyCoseSignature(params: {\n protectedHeadersBytes: Uint8Array;\n payloadBytes: Uint8Array;\n signature: Uint8Array;\n leafPublicKey: CryptoKey;\n subtle: SubtleCrypto;\n}): Promise<void> {\n const sigStructure = encodeCoseSigStructure1(params.protectedHeadersBytes, params.payloadBytes);\n const ok = await wrapCryptoFailure(\n params.subtle.verify({ name: \"ECDSA\", hash: \"SHA-384\" }, params.leafPublicKey, params.signature, sigStructure),\n \"COSE_SIGNATURE_VERIFY_FAILED\",\n \"COSE_Sign1 signature verification failed\",\n );\n if (!ok) {\n fail(\"COSE_SIGNATURE_VERIFY_FAILED\", \"COSE_Sign1 signature does not verify with the attestation leaf certificate\");\n }\n}\n\nfunction assertProtectedHeader(protectedHeadersBytes: Uint8Array): void {\n let decoded: unknown;\n try {\n decoded = decodeCbor(protectedHeadersBytes);\n } catch (cause) {\n fail(\"COSE_STRUCTURE_INVALID\", \"COSE protected headers are not a valid CBOR map\", { cause });\n }\n if (!(decoded instanceof Map)) {\n fail(\"COSE_STRUCTURE_INVALID\", \"COSE protected headers must be a CBOR map\");\n }\n if (decoded.get(1) !== -35) {\n fail(\"COSE_ALG_UNSUPPORTED\", \"COSE protected header alg must be -35 (ES384)\");\n }\n}\n","import { fail } from \"../errors\";\n\nconst PCR8_HEX_LENGTH = 96;\n\nexport function normalizePcr8Pin(value: string, label: string): string {\n const normalized = value.replace(/^0x/i, \"\").toLowerCase();\n if (normalized.length !== PCR8_HEX_LENGTH || !/^[0-9a-f]+$/.test(normalized)) {\n fail(\"TRUST_PIN_REQUIRED\", `${label} must be ${PCR8_HEX_LENGTH} lowercase hex characters`);\n }\n return normalized;\n}\n\nexport function parseAdvertisedPcr8(value: string, label: string): string {\n const normalized = normalizePcr8Pin(value, label);\n if (value !== normalized) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", `${label} must be ${PCR8_HEX_LENGTH} lowercase hex characters`);\n }\n return normalized;\n}\n","import { base64Decode, concatBytes, utf8Decode, utf8Encode } from \"../crypto/encoding\";\nimport { fail, NitroAttestationError } from \"../errors\";\nimport { parseAdvertisedPcr8 } from \"../trust/pcr8\";\n\nconst MAX_ATTESTATION_RESPONSE_BYTES = 256 * 1024;\nconst NETWORK_LAYER_FETCH_ATTEMPTS = 3;\nconst NETWORK_LAYER_RETRY_DELAY_MS = 150;\nconst ETH_ADDRESS_PATTERN = /^0x[0-9a-fA-F]{40}$/;\n\nexport interface AttestationEnvelope {\n attestationDocument: Uint8Array;\n nonce: string;\n advertised: {\n chainId?: number;\n verifyingContract?: string;\n expectedSigner?: string;\n expectedPcr8?: string;\n };\n}\n\nexport function buildAttestationUrl(attestationServiceUrl: string, nonceHex: string): URL {\n const url = new URL(attestationServiceUrl);\n const strippedPath = url.pathname.replace(/\\/+$/, \"\");\n url.pathname = strippedPath.endsWith(\"/attestation\") ? strippedPath : `${strippedPath}/attestation`;\n url.search = \"\";\n url.searchParams.set(\"nonce\", nonceHex);\n return url;\n}\n\nexport async function fetchAttestationEnvelope(params: {\n attestationServiceUrl: string;\n nonceHex: string;\n fetch: typeof fetch;\n timeoutMs: number;\n}): Promise<AttestationEnvelope> {\n const url = buildAttestationUrl(params.attestationServiceUrl, params.nonceHex);\n const response = await fetchWithNetworkRetry(url.toString(), params.fetch, params.timeoutMs);\n const responseText = await readResponseText(response);\n if (!response.ok) {\n fail(\"ATTESTATION_FETCH_FAILED\", `GET /attestation failed with HTTP ${response.status}`, {\n details: { status: response.status, body: responseText.slice(0, 400) },\n });\n }\n\n let body: unknown;\n try {\n body = JSON.parse(responseText);\n } catch (cause) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", \"GET /attestation returned non-JSON response\", { cause });\n }\n\n return validateAttestationEnvelope(body);\n}\n\nfunction validateAttestationEnvelope(body: unknown): AttestationEnvelope {\n if (!isRecord(body) || body.success !== true || !isRecord(body.responseObject)) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", \"Expected { success: true, responseObject: {...} }\");\n }\n\n const responseObject = body.responseObject;\n if (typeof responseObject.attestationDocument !== \"string\" || typeof responseObject.nonce !== \"string\") {\n fail(\"ATTESTATION_RESPONSE_INVALID\", \"Attestation response is missing attestationDocument or nonce\");\n }\n\n let attestationDocument: Uint8Array;\n try {\n attestationDocument = base64Decode(responseObject.attestationDocument);\n } catch (cause) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", \"attestationDocument is not valid base64\", { cause });\n }\n if (attestationDocument.length === 0) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", \"attestationDocument decoded to empty bytes\");\n }\n\n return {\n attestationDocument,\n nonce: responseObject.nonce.toLowerCase(),\n advertised: {\n chainId: typeof responseObject.chainId === \"number\" ? responseObject.chainId : undefined,\n verifyingContract: parseOptionalAddress(responseObject.verifyingContract, \"verifyingContract\"),\n expectedSigner: parseOptionalAddress(responseObject.expectedSigner, \"expectedSigner\"),\n expectedPcr8: parseOptionalAdvertisedPcr8(responseObject.expectedPcr8, \"expectedPcr8\"),\n },\n };\n}\n\nasync function readResponseText(response: Response): Promise<string> {\n if (!response.body) {\n const responseText = await response.text();\n assertResponseSize(utf8Encode(responseText).length);\n return responseText;\n }\n\n const reader = response.body.getReader();\n const chunks: Uint8Array[] = [];\n let totalBytes = 0;\n while (true) {\n const { done, value } = await reader.read();\n if (done) {\n break;\n }\n if (value) {\n totalBytes += value.length;\n assertResponseSize(totalBytes);\n chunks.push(value);\n }\n }\n return utf8Decode(concatBytes(chunks));\n}\n\nfunction assertResponseSize(totalBytes: number): void {\n if (totalBytes > MAX_ATTESTATION_RESPONSE_BYTES) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", \"GET /attestation response exceeded maximum size\", {\n details: { maxBytes: MAX_ATTESTATION_RESPONSE_BYTES, actualBytes: totalBytes },\n });\n }\n}\n\nfunction parseOptionalAddress(value: unknown, label: string): string | undefined {\n if (value === undefined) {\n return undefined;\n }\n if (typeof value !== \"string\" || !ETH_ADDRESS_PATTERN.test(value)) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", `${label} must be a 0x-prefixed 20-byte hex address`);\n }\n return value.toLowerCase();\n}\n\nfunction parseOptionalAdvertisedPcr8(value: unknown, label: string): string | undefined {\n if (value === undefined) {\n return undefined;\n }\n if (typeof value !== \"string\") {\n fail(\"ATTESTATION_RESPONSE_INVALID\", `${label} must be a 96-character lowercase hex string`);\n }\n try {\n return parseAdvertisedPcr8(value, label);\n } catch (cause) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", `${label} must be a 96-character lowercase hex string`, { cause });\n }\n}\n\nasync function fetchWithNetworkRetry(url: string, fetcher: typeof fetch, timeoutMs: number): Promise<Response> {\n let attempt = 1;\n while (true) {\n try {\n return await fetchWithTimeout(url, fetcher, timeoutMs);\n } catch (cause) {\n if (!isNetworkLayerFetchFailure(cause) || attempt >= NETWORK_LAYER_FETCH_ATTEMPTS) {\n throw cause;\n }\n await sleep(NETWORK_LAYER_RETRY_DELAY_MS * attempt);\n attempt += 1;\n }\n }\n}\n\nasync function fetchWithTimeout(url: string, fetcher: typeof fetch, timeoutMs: number): Promise<Response> {\n const controller = typeof AbortController !== \"undefined\" ? new AbortController() : undefined;\n let timeoutHandle: ReturnType<typeof setTimeout> | undefined;\n const timeoutPromise = new Promise<never>((_, reject) => {\n timeoutHandle = setTimeout(() => {\n controller?.abort();\n reject(new Error(\"timeout\"));\n }, timeoutMs);\n });\n\n try {\n const response = await Promise.race([\n fetcher(url, {\n headers: { accept: \"application/json\" },\n signal: controller?.signal,\n }),\n timeoutPromise,\n ]);\n if (timeoutHandle !== undefined) {\n clearTimeout(timeoutHandle);\n }\n return response;\n } catch (cause) {\n if (timeoutHandle !== undefined) {\n clearTimeout(timeoutHandle);\n }\n if (cause instanceof Error && (cause.name === \"AbortError\" || cause.message === \"timeout\")) {\n fail(\"TIMEOUT\", `GET /attestation timed out after ${timeoutMs}ms`, { cause });\n }\n fail(\"ATTESTATION_FETCH_FAILED\", \"GET /attestation failed at the network layer\", {\n cause,\n details: { layer: \"network\" },\n });\n }\n}\n\nfunction isNetworkLayerFetchFailure(cause: unknown): boolean {\n return (\n cause instanceof NitroAttestationError &&\n cause.code === \"ATTESTATION_FETCH_FAILED\" &&\n cause.details?.layer === \"network\"\n );\n}\n\nfunction sleep(ms: number): Promise<void> {\n return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n","import { bytesToHex } from \"../crypto/encoding\";\nimport { fail } from \"../errors\";\n\nexport const NONCE_BYTE_LENGTH = 32;\n\nexport function generateNonceHex(getRandomValues: (out: Uint8Array) => Uint8Array): string {\n return bytesToHex(getRandomValues(new Uint8Array(NONCE_BYTE_LENGTH)));\n}\n\nexport function assertNonceEcho(echoedNonce: string, expectedNonce: string): void {\n if (echoedNonce.toLowerCase() !== expectedNonce) {\n fail(\"ATTESTATION_NONCE_MISMATCH\", \"Attestation service echoed a different nonce\", {\n details: { expectedNonce, echoedNonce },\n });\n }\n}\n","import { decodeCbor } from \"../crypto/cbor\";\nimport { bytesToHex, utf8Decode } from \"../crypto/encoding\";\nimport { fail } from \"../errors\";\n\nexport interface DecodedAttestationPayload {\n timestampMs: number;\n nonceHex: string;\n pcr0Hex: string;\n pcr1Hex: string;\n pcr2Hex: string;\n pcr8Hex: string;\n certificateDer: Uint8Array;\n cabundleDer: Uint8Array[];\n publicKeyDer: Uint8Array;\n}\n\nexport function decodeAttestationPayload(payloadBytes: Uint8Array): DecodedAttestationPayload {\n let decoded: unknown;\n try {\n decoded = decodeCbor(payloadBytes);\n } catch (cause) {\n fail(\"PAYLOAD_FIELD_MISSING\", \"Attestation payload is not a valid CBOR map\", { cause });\n }\n\n const payload = requireMap(decoded, \"payload\");\n const pcrs = requireMap(payload.get(\"pcrs\"), \"pcrs\");\n const userData = requireBytes(payload.get(\"user_data\"), \"user_data\");\n\n return {\n timestampMs: requireTimestamp(payload.get(\"timestamp\")),\n nonceHex: utf8Decode(userData),\n pcr0Hex: optionalPcrHex(pcrs, 0),\n pcr1Hex: optionalPcrHex(pcrs, 1),\n pcr2Hex: optionalPcrHex(pcrs, 2),\n pcr8Hex: bytesToHex(requireBytes(pcrs.get(8), \"pcrs[8]\")),\n certificateDer: requireBytes(payload.get(\"certificate\"), \"certificate\"),\n cabundleDer: requireArray(payload.get(\"cabundle\"), \"cabundle\").map((entry, index) =>\n requireBytes(entry, `cabundle[${index}]`),\n ),\n publicKeyDer: requireBytes(payload.get(\"public_key\"), \"public_key\"),\n };\n}\n\nfunction optionalPcrHex(pcrs: Map<unknown, unknown>, index: number): string {\n const value = pcrs.get(index);\n return value instanceof Uint8Array ? bytesToHex(value) : \"\";\n}\n\nfunction requireTimestamp(value: unknown): number {\n if (typeof value === \"number\" && Number.isSafeInteger(value) && value >= 0) {\n return value;\n }\n fail(\"PAYLOAD_FIELD_MISSING\", \"Attestation payload timestamp must be an unsigned safe integer\");\n}\n\nfunction requireMap(value: unknown, label: string): Map<unknown, unknown> {\n if (value instanceof Map) {\n return value;\n }\n fail(\"PAYLOAD_FIELD_MISSING\", `Attestation payload field ${label} must be a CBOR map`);\n}\n\nfunction requireBytes(value: unknown, label: string): Uint8Array {\n if (value instanceof Uint8Array) {\n return value;\n }\n fail(\"PAYLOAD_FIELD_MISSING\", `Attestation payload field ${label} must be a byte string`);\n}\n\nfunction requireArray(value: unknown, label: string): unknown[] {\n if (Array.isArray(value)) {\n return value;\n }\n fail(\"PAYLOAD_FIELD_MISSING\", `Attestation payload field ${label} must be an array`);\n}\n","import type { NitroAttestationEnvironment } from \"../types\";\nimport { normalizePcr8Pin } from \"./pcr8\";\n\nexport const STAGING_ATTESTATION_SERVICE_URL = \"https://attestation-service-staging.zkp2p.xyz\";\nexport const PRODUCTION_ATTESTATION_SERVICE_URL = \"https://attestation-service.zkp2p.xyz\";\nexport const PREPROD_ATTESTATION_SERVICE_URL = \"https://attestation-service-preprod.zkp2p.xyz\";\n\nexport const STAGING_PCR8 =\n \"5636e3bd96f847cf12cfd9de7faa8cad0e6fa00962ce16ba185f8e5ea57105abb3cc9cc34f1e1e4de3444ceabcca7485\";\nexport const PRODUCTION_PCR8 =\n \"41a4ae0b9b96752cab5addb7d22689b3070e564e29f90a54316fa33fa38ea51387a6e887ea4f5a4b0cc34f69cea3f40e\";\nexport const PREPROD_PCR8 =\n \"5453c5bfb7d040285be5ba9af142f4fbdd9685d082f244b66c62bf7b22d8d02a638fa2e02b9a6fe8877953a9429209e0\";\n\nexport const DEFAULT_EXPECTED_PCR8_BY_HOST: Record<string, string> = {\n \"attestation-service-staging.zkp2p.xyz\": normalizePcr8Pin(STAGING_PCR8, \"bundled staging PCR8\"),\n \"attestation-service-preprod.zkp2p.xyz\": normalizePcr8Pin(PREPROD_PCR8, \"bundled preprod PCR8\"),\n \"attestation-service.zkp2p.xyz\": normalizePcr8Pin(PRODUCTION_PCR8, \"bundled production PCR8\"),\n};\n\nexport const DEFAULT_ENVIRONMENT_CONFIG: Record<\n NitroAttestationEnvironment,\n {\n attestationServiceUrl: string;\n expectedPcr8Hex: string;\n }\n> = {\n staging: {\n attestationServiceUrl: STAGING_ATTESTATION_SERVICE_URL,\n expectedPcr8Hex: STAGING_PCR8,\n },\n production: {\n attestationServiceUrl: PRODUCTION_ATTESTATION_SERVICE_URL,\n expectedPcr8Hex: PRODUCTION_PCR8,\n },\n};\n","import { fail } from \"../errors\";\nimport type { TrustPins } from \"../types\";\nimport type { NitroAttestationWarning } from \"../warnings\";\nimport { normalizePcr8Pin } from \"./pcr8\";\nimport { DEFAULT_EXPECTED_PCR8_BY_HOST } from \"./pins\";\n\nexport function resolveExpectedPcr8(params: {\n trust?: TrustPins;\n hostname: string;\n advertisedExpectedPcr8?: string;\n onWarning?: (warning: NitroAttestationWarning) => void;\n}): string {\n const { trust, advertisedExpectedPcr8, onWarning } = params;\n const hostname = params.hostname.toLowerCase();\n\n if (trust?.expectedPcr8Hex) {\n return normalizePcr8Pin(trust.expectedPcr8Hex, \"trust.expectedPcr8Hex\");\n }\n\n const hostPins = trust?.expectedPcr8ByHost;\n const hostPin = hostPins ? findHostPin(hostPins, hostname) : undefined;\n if (hostPin) {\n return normalizePcr8Pin(hostPin, `trust.expectedPcr8ByHost[${hostname}]`);\n }\n\n const bundledPin = DEFAULT_EXPECTED_PCR8_BY_HOST[hostname];\n if (bundledPin) {\n return bundledPin;\n }\n\n if (trust?.strictPin === true) {\n fail(\"TRUST_PIN_REQUIRED\", `No trusted PCR8 pin is configured for ${hostname}`);\n }\n\n if (advertisedExpectedPcr8) {\n const normalizedAdvertisedPin = normalizePcr8Pin(advertisedExpectedPcr8, \"service-advertised expectedPcr8\");\n onWarning?.({\n code: \"TRUST_PIN_NOT_PROVIDED\",\n message: `No caller or bundled PCR8 pin was available for ${hostname}; falling back to service-advertised expectedPcr8`,\n details: { hostname, expectedPcr8: normalizedAdvertisedPin },\n });\n return normalizedAdvertisedPin;\n }\n\n fail(\"TRUST_PIN_REQUIRED\", `No trusted or service-advertised PCR8 pin is available for ${hostname}`);\n}\n\nfunction findHostPin(hostPins: Record<string, string>, hostname: string): string | undefined {\n for (const [configuredHost, pin] of Object.entries(hostPins)) {\n if (configuredHost.toLowerCase() === hostname) {\n return pin;\n }\n }\n return undefined;\n}\n","import { verifyCertificateChain } from \"./attestation/certChain\";\nimport { decodeCoseSign1, verifyCoseSignature } from \"./attestation/coseSign1\";\nimport { fetchAttestationEnvelope } from \"./attestation/fetch\";\nimport { assertNonceEcho, generateNonceHex } from \"./attestation/nonce\";\nimport { decodeAttestationPayload } from \"./attestation/payloadFields\";\nimport { bytesToArrayBuffer, bytesToHex } from \"./crypto/encoding\";\nimport { resolveCryptoProvider, resolveFetch } from \"./crypto/env\";\nimport { fail } from \"./errors\";\nimport { DEFAULT_TIMEOUT_MS } from \"./timeout\";\nimport { resolveExpectedPcr8 } from \"./trust/resolveExpectedPcr8\";\nimport type { FetchAndVerifyAttestationParams, VerifiedAttestation } from \"./types\";\n\nconst DEFAULT_FRESHNESS_WINDOW_MS = 5 * 60 * 1000;\n\nexport async function fetchAndVerifyAttestation(params: FetchAndVerifyAttestationParams): Promise<VerifiedAttestation> {\n const fetcher = resolveFetch(params.fetch);\n const crypto = resolveCryptoProvider(params);\n const now = params.now ?? Date.now;\n const nonceHex = generateNonceHex(crypto.getRandomValues);\n const response = await fetchAttestationEnvelope({\n attestationServiceUrl: params.attestationServiceUrl,\n nonceHex,\n fetch: fetcher,\n timeoutMs: params.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n });\n assertNonceEcho(response.nonce, nonceHex);\n\n const { protectedHeadersBytes, payloadBytes, signature } = decodeCoseSign1(response.attestationDocument);\n const payload = decodeAttestationPayload(payloadBytes);\n\n if (payload.nonceHex !== nonceHex) {\n fail(\"NONCE_BINDING_FAILED\", \"Attestation payload user_data did not match the request nonce\", {\n details: { expectedNonce: nonceHex, payloadNonce: payload.nonceHex },\n });\n }\n\n const freshnessWindowMs = params.trust?.freshnessWindowMs ?? DEFAULT_FRESHNESS_WINDOW_MS;\n const nowMs = now();\n if (Math.abs(nowMs - payload.timestampMs) > freshnessWindowMs) {\n fail(\"FRESHNESS_CHECK_FAILED\", `Attestation timestamp skew exceeds ${freshnessWindowMs}ms`, {\n details: { timestampMs: payload.timestampMs, nowMs, freshnessWindowMs },\n });\n }\n\n const hostname = new URL(params.attestationServiceUrl).hostname;\n const expectedPcr8 = resolveExpectedPcr8({\n trust: params.trust,\n hostname,\n advertisedExpectedPcr8: response.advertised.expectedPcr8,\n onWarning: params.onWarning,\n });\n if (payload.pcr8Hex !== expectedPcr8) {\n fail(\"PCR8_PIN_MISMATCH\", \"Attestation PCR8 does not match the trusted pin\", {\n details: { expectedPcr8, actualPcr8: payload.pcr8Hex },\n });\n }\n\n const { leafPublicKey } = await verifyCertificateChain({\n leafCertificateDer: payload.certificateDer,\n cabundleDer: payload.cabundleDer,\n rootPem: params.trust?.awsNitroRootPem,\n nowMs,\n subtle: crypto.subtle,\n getRandomValues: crypto.getRandomValues,\n onWarning: params.onWarning,\n });\n await verifyCoseSignature({ protectedHeadersBytes, payloadBytes, signature, leafPublicKey, subtle: crypto.subtle });\n\n return {\n attestedSellerUploadKey: {\n publicKeyDer: payload.publicKeyDer,\n publicKeySha256Hex: bytesToHex(\n new Uint8Array(await crypto.subtle.digest(\"SHA-256\", bytesToArrayBuffer(payload.publicKeyDer))),\n ),\n },\n payload: {\n timestampMs: payload.timestampMs,\n pcr0Hex: payload.pcr0Hex,\n pcr1Hex: payload.pcr1Hex,\n pcr2Hex: payload.pcr2Hex,\n pcr8Hex: payload.pcr8Hex,\n nonceHex: payload.nonceHex,\n advertised: response.advertised,\n },\n };\n}\n","import { encryptBuyerTeeSessionMaterial } from \"./encryptBuyerTeeSessionMaterial\";\nimport { fetchAndVerifyAttestation } from \"./fetchAndVerifyAttestation\";\nimport type { BuyerTeeSessionMaterialPlatform, CreateEncryptedBuyerTeeSessionMaterialParamsFor } from \"./types\";\n\nexport async function createEncryptedBuyerTeeSessionMaterial<P extends BuyerTeeSessionMaterialPlatform>(\n params: CreateEncryptedBuyerTeeSessionMaterialParamsFor<P>,\n): Promise<string> {\n const verified = await fetchAndVerifyAttestation({\n attestationServiceUrl: params.attestationServiceUrl,\n trust: params.trust,\n fetch: params.fetch,\n subtle: params.subtle,\n getRandomValues: params.getRandomValues,\n now: params.now,\n onWarning: params.onWarning,\n timeoutMs: params.timeoutMs,\n });\n return encryptBuyerTeeSessionMaterial({\n ...params,\n key: verified.attestedSellerUploadKey,\n });\n}\n","import { resolveCryptoProvider } from \"./crypto/env\";\nimport { encryptIdentitySessionMaterialWithResolvedCrypto } from \"./jwe/encrypt\";\nimport type { EncryptIdentitySessionMaterialParamsFor, IdentityRequestPlatform } from \"./types\";\n\nexport async function encryptIdentitySessionMaterial<P extends IdentityRequestPlatform>(\n params: EncryptIdentitySessionMaterialParamsFor<P>,\n): Promise<string> {\n const crypto = resolveCryptoProvider(params);\n return encryptIdentitySessionMaterialWithResolvedCrypto({\n request: params,\n subtle: crypto.subtle,\n getRandomValues: crypto.getRandomValues,\n });\n}\n","import { encryptIdentitySessionMaterial } from \"./encryptIdentitySessionMaterial\";\nimport { fetchAndVerifyAttestation } from \"./fetchAndVerifyAttestation\";\nimport type { CreateEncryptedIdentitySessionMaterialParamsFor, IdentityRequestPlatform } from \"./types\";\n\nexport async function createEncryptedIdentitySessionMaterial<P extends IdentityRequestPlatform>(\n params: CreateEncryptedIdentitySessionMaterialParamsFor<P>,\n): Promise<string> {\n const verified = await fetchAndVerifyAttestation({\n attestationServiceUrl: params.attestationServiceUrl,\n trust: params.trust,\n fetch: params.fetch,\n subtle: params.subtle,\n getRandomValues: params.getRandomValues,\n now: params.now,\n onWarning: params.onWarning,\n timeoutMs: params.timeoutMs,\n });\n return encryptIdentitySessionMaterial({\n key: verified.attestedSellerUploadKey,\n platform: params.platform,\n actionType: params.actionType,\n sessionMaterial: params.sessionMaterial,\n subtle: params.subtle,\n getRandomValues: params.getRandomValues,\n });\n}\n","import { resolveCryptoProvider } from \"./crypto/env\";\nimport { encryptSellerCredentialUploadWithResolvedCrypto } from \"./jwe/encrypt\";\nimport type { EncryptSellerCredentialUploadParams } from \"./types\";\n\nexport async function encryptSellerCredentialUpload(params: EncryptSellerCredentialUploadParams): Promise<string> {\n const crypto = resolveCryptoProvider(params);\n return encryptSellerCredentialUploadWithResolvedCrypto({\n request: params,\n subtle: crypto.subtle,\n getRandomValues: crypto.getRandomValues,\n now: params.now ?? Date.now,\n });\n}\n","import { encryptSellerCredentialUpload } from \"./encryptSellerCredentialUpload\";\nimport { fetchAndVerifyAttestation } from \"./fetchAndVerifyAttestation\";\nimport type { CreateEncryptedSellerCredentialUploadParams } from \"./types\";\n\nexport async function createEncryptedSellerCredentialUpload(\n params: CreateEncryptedSellerCredentialUploadParams,\n): Promise<string> {\n const { attestationServiceUrl, trust, fetch, onWarning, timeoutMs, ...encryptParams } = params;\n const verified = await fetchAndVerifyAttestation({\n attestationServiceUrl,\n trust,\n fetch,\n subtle: params.subtle,\n getRandomValues: params.getRandomValues,\n now: params.now,\n onWarning,\n timeoutMs,\n });\n return encryptSellerCredentialUpload({\n ...encryptParams,\n key: verified.attestedSellerUploadKey,\n });\n}\n","import { getAddress } from \"ethers\";\nimport { fail } from \"./errors\";\n\nexport function normalizeIdentityCallerAddress(callerAddress: string): string {\n try {\n return getAddress(callerAddress);\n } catch (cause) {\n fail(\"INVALID_PARAMETER\", \"callerAddress must be a valid Ethereum address\", { cause });\n }\n}\n","import { resolveFetch } from \"./crypto/env\";\nimport { fail, type NitroServiceResponseErrorDetails } from \"./errors\";\nimport { DEFAULT_TIMEOUT_MS } from \"./timeout\";\n\ninterface ServiceResponseEnvelope<T> {\n success?: boolean;\n statusCode?: number;\n message?: string;\n responseObject?: T;\n}\n\nconst SERVICE_RESPONSE_SNIPPET_LENGTH = 400;\n\nexport async function postJsonServiceResponse<T>(params: {\n attestationServiceUrl: string;\n path: string;\n body: unknown;\n fetch?: typeof fetch;\n failureContext: string;\n timeoutMs?: number;\n}): Promise<T> {\n const fetcher = resolveFetch(params.fetch);\n const timeoutMs = params.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n const controller = new AbortController();\n let timeoutHandle: ReturnType<typeof setTimeout> | undefined;\n const timeoutPromise = new Promise<never>((_, reject) => {\n timeoutHandle = setTimeout(() => {\n controller.abort();\n reject(new Error(\"timeout\"));\n }, timeoutMs);\n });\n let response: Response;\n let responseText: string;\n try {\n response = await Promise.race([\n fetcher(buildServiceUrl(params.attestationServiceUrl, params.path), {\n method: \"POST\",\n headers: {\n accept: \"application/json\",\n \"content-type\": \"application/json\",\n },\n body: JSON.stringify(params.body),\n signal: controller.signal,\n }),\n timeoutPromise,\n ]);\n responseText = await Promise.race([response.text(), timeoutPromise]);\n } catch (cause) {\n if (controller.signal.aborted) {\n fail(\"TIMEOUT\", `${params.failureContext} timed out after ${timeoutMs}ms`, { cause });\n }\n fail(\"ATTESTATION_FETCH_FAILED\", `${params.failureContext} failed at the network layer`, { cause });\n } finally {\n clearTimeout(timeoutHandle);\n }\n\n if (!response.ok) {\n const envelope = parseServiceResponseEnvelope(responseText);\n if (envelope?.success === false) {\n failWithServiceResponseEnvelope(params.failureContext, response.status, envelope);\n }\n\n fail(\"ATTESTATION_FETCH_FAILED\", `${params.failureContext} failed with HTTP ${response.status}`, {\n details: { status: response.status, body: responseText.slice(0, 400) },\n });\n }\n\n let envelope: ServiceResponseEnvelope<T>;\n try {\n envelope = JSON.parse(responseText) as typeof envelope;\n } catch (cause) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", `${params.failureContext} returned a non-JSON ServiceResponse`, { cause });\n }\n\n if (envelope.success !== true) {\n if (envelope.success === false) {\n failWithServiceResponseEnvelope(params.failureContext, response.status, envelope);\n }\n\n fail(\"ATTESTATION_RESPONSE_INVALID\", `${params.failureContext} returned an unsuccessful ServiceResponse`);\n }\n\n if (!isRecord(envelope.responseObject)) {\n fail(\"ATTESTATION_RESPONSE_INVALID\", `${params.failureContext} returned a ServiceResponse without responseObject`, {\n details: {\n status: response.status,\n envelopeSnippet: formatEnvelopeSnippet(envelope),\n },\n });\n }\n\n return envelope.responseObject as T;\n}\n\nfunction parseServiceResponseEnvelope(responseText: string): ServiceResponseEnvelope<unknown> | undefined {\n try {\n return JSON.parse(responseText) as ServiceResponseEnvelope<unknown>;\n } catch {\n return undefined;\n }\n}\n\nfunction failWithServiceResponseEnvelope(\n failureContext: string,\n status: number,\n envelope: ServiceResponseEnvelope<unknown>,\n): never {\n const details: NitroServiceResponseErrorDetails = {\n status,\n statusCode: envelope.statusCode,\n message: envelope.message,\n responseObject: envelope.responseObject,\n };\n\n fail(\"SERVICE_RESPONSE_ERROR\", `${failureContext} returned an unsuccessful ServiceResponse`, { details });\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction formatEnvelopeSnippet(envelope: ServiceResponseEnvelope<unknown>): string {\n return JSON.stringify(envelope).slice(0, SERVICE_RESPONSE_SNIPPET_LENGTH);\n}\n\nfunction buildServiceUrl(attestationServiceUrl: string, path: string): string {\n const url = new URL(attestationServiceUrl);\n url.pathname = `${url.pathname.replace(/\\/+$/u, \"\")}${path}`;\n url.search = \"\";\n return url.toString();\n}\n","import { createEncryptedIdentitySessionMaterial } from \"./createEncryptedIdentitySessionMaterial\";\nimport { normalizeIdentityCallerAddress } from \"./identityCallerAddress\";\nimport { postJsonServiceResponse } from \"./serviceResponse\";\nimport type {\n IdentityAttestationOutputFor,\n IdentityRequestPlatform,\n RequestIdentityAttestationParamsFor,\n} from \"./types\";\n\nexport async function requestIdentityAttestation<P extends IdentityRequestPlatform>(\n params: RequestIdentityAttestationParamsFor<P>,\n): Promise<IdentityAttestationOutputFor<P>> {\n const callerAddress = normalizeIdentityCallerAddress(params.callerAddress);\n const encryptedSessionMaterial = await createEncryptedIdentitySessionMaterial({\n attestationServiceUrl: params.attestationServiceUrl,\n trust: params.trust,\n fetch: params.fetch,\n subtle: params.subtle,\n getRandomValues: params.getRandomValues,\n now: params.now,\n onWarning: params.onWarning,\n timeoutMs: params.timeoutMs,\n platform: params.platform,\n actionType: params.actionType,\n sessionMaterial: params.sessionMaterial,\n });\n\n return postJsonServiceResponse<IdentityAttestationOutputFor<P>>({\n attestationServiceUrl: params.attestationServiceUrl,\n path: \"/identity\",\n fetch: params.fetch,\n failureContext: \"POST /identity\",\n timeoutMs: params.timeoutMs,\n body: {\n platform: params.platform,\n actionType: params.actionType,\n callerAddress,\n encryptedSessionMaterial,\n params: params.params,\n },\n });\n}\n","import { createEncryptedSellerCredentialUpload } from \"./createEncryptedSellerCredentialUpload\";\nimport { postJsonServiceResponse } from \"./serviceResponse\";\nimport type { SellerCredentialBundle, UploadSellerCredentialParams } from \"./types\";\n\nexport async function uploadSellerCredential(params: UploadSellerCredentialParams): Promise<SellerCredentialBundle> {\n const encryptedUpload = await createEncryptedSellerCredentialUpload(params);\n\n return postJsonServiceResponse<SellerCredentialBundle>({\n attestationServiceUrl: params.attestationServiceUrl,\n path: `/seller/credentials/${encodeURIComponent(params.platform)}`,\n fetch: params.fetch,\n failureContext: \"POST /seller/credentials\",\n timeoutMs: params.timeoutMs,\n body: { encryptedUpload },\n });\n}\n","import { createEncryptedBuyerTeeSessionMaterial } from \"./createEncryptedBuyerTeeSessionMaterial\";\nimport { postJsonServiceResponse } from \"./serviceResponse\";\nimport type {\n BuyerTeeAttestationOutputFor,\n BuyerTeeSessionMaterialPlatform,\n VerifyBuyerTeePaymentParamsFor,\n} from \"./types\";\n\nexport async function verifyBuyerTeePayment<P extends BuyerTeeSessionMaterialPlatform>(\n params: VerifyBuyerTeePaymentParamsFor<P>,\n): Promise<BuyerTeeAttestationOutputFor<P>> {\n const encryptedSessionMaterial = await createEncryptedBuyerTeeSessionMaterial(params);\n\n return postJsonServiceResponse<BuyerTeeAttestationOutputFor<P>>({\n attestationServiceUrl: params.attestationServiceUrl,\n path: `/buyer/verify/${encodeURIComponent(params.platform)}/${encodeURIComponent(params.actionType)}`,\n fetch: params.fetch,\n failureContext: \"POST /buyer/verify\",\n timeoutMs: params.timeoutMs,\n body: {\n encryptedSessionMaterial,\n params: params.params,\n chainId: params.chainId,\n intent: params.intent,\n },\n });\n}\n","import { createEncryptedBuyerTeeSessionMaterial as createEncryptedBuyerTeeSessionMaterialOnce } from \"./createEncryptedBuyerTeeSessionMaterial\";\nimport { createEncryptedIdentitySessionMaterial as createEncryptedIdentitySessionMaterialOnce } from \"./createEncryptedIdentitySessionMaterial\";\nimport { createEncryptedSellerCredentialUpload as createEncryptedSellerCredentialUploadOnce } from \"./createEncryptedSellerCredentialUpload\";\nimport { encryptBuyerTeeSessionMaterial as encryptBuyerTeeSessionMaterialOnce } from \"./encryptBuyerTeeSessionMaterial\";\nimport { encryptIdentitySessionMaterial as encryptIdentitySessionMaterialOnce } from \"./encryptIdentitySessionMaterial\";\nimport { encryptSellerCredentialUpload as encryptSellerCredentialUploadOnce } from \"./encryptSellerCredentialUpload\";\nimport { fetchAndVerifyAttestation as fetchAndVerifyAttestationOnce } from \"./fetchAndVerifyAttestation\";\nimport { requestIdentityAttestation as requestIdentityAttestationOnce } from \"./requestIdentityAttestation\";\nimport { DEFAULT_ENVIRONMENT_CONFIG } from \"./trust/pins\";\nimport type {\n BuyerTeeAttestationOutputFor,\n BuyerTeeSessionMaterialPlatform,\n IdentityAttestationOutputFor,\n IdentityRequestPlatform,\n NitroAttestationClient,\n NitroAttestationClientOptions,\n NitroAttestationClientVerifyBuyerTeePaymentParamsFor,\n RequestIdentityAttestationParamsFor,\n TrustPins,\n VerifyBuyerTeePaymentParamsFor,\n} from \"./types\";\nimport { uploadSellerCredential as uploadSellerCredentialOnce } from \"./uploadSellerCredential\";\nimport { verifyBuyerTeePayment as verifyBuyerTeePaymentOnce } from \"./verifyBuyerTeePayment\";\n\nexport function createNitroAttestationClient(options: NitroAttestationClientOptions): NitroAttestationClient {\n const environmentDefaults = DEFAULT_ENVIRONMENT_CONFIG[options.environment];\n const baseUrl = options.attestationServiceUrl ?? environmentDefaults.attestationServiceUrl;\n const baseTrust = mergeTrust({ strictPin: true }, options.trust);\n\n return {\n createEncryptedBuyerTeeSessionMaterial: (params) => {\n const {\n attestationServiceUrl,\n trust,\n fetch,\n subtle,\n getRandomValues,\n now,\n onWarning,\n timeoutMs,\n ...sessionParams\n } = params;\n\n return createEncryptedBuyerTeeSessionMaterialOnce({\n ...sessionParams,\n attestationServiceUrl: attestationServiceUrl ?? baseUrl,\n trust: mergeTrust(baseTrust, trust),\n fetch: fetch ?? options.fetch,\n subtle: subtle ?? options.subtle,\n getRandomValues: getRandomValues ?? options.getRandomValues,\n now: now ?? options.now,\n onWarning: onWarning ?? options.onWarning,\n timeoutMs: timeoutMs ?? options.timeoutMs,\n });\n },\n createEncryptedIdentitySessionMaterial: (params) => {\n const {\n attestationServiceUrl,\n trust,\n fetch,\n subtle,\n getRandomValues,\n now,\n onWarning,\n timeoutMs,\n ...sessionParams\n } = params;\n\n return createEncryptedIdentitySessionMaterialOnce({\n ...sessionParams,\n attestationServiceUrl: attestationServiceUrl ?? baseUrl,\n trust: mergeTrust(baseTrust, trust),\n fetch: fetch ?? options.fetch,\n subtle: subtle ?? options.subtle,\n getRandomValues: getRandomValues ?? options.getRandomValues,\n now: now ?? options.now,\n onWarning: onWarning ?? options.onWarning,\n timeoutMs: timeoutMs ?? options.timeoutMs,\n });\n },\n createEncryptedSellerCredentialUpload: (params) => {\n const {\n attestationServiceUrl,\n trust,\n fetch,\n subtle,\n getRandomValues,\n now,\n onWarning,\n timeoutMs,\n ...uploadParams\n } = params;\n\n return createEncryptedSellerCredentialUploadOnce({\n ...uploadParams,\n attestationServiceUrl: attestationServiceUrl ?? baseUrl,\n trust: mergeTrust(baseTrust, trust),\n fetch: fetch ?? options.fetch,\n subtle: subtle ?? options.subtle,\n getRandomValues: getRandomValues ?? options.getRandomValues,\n now: now ?? options.now,\n onWarning: onWarning ?? options.onWarning,\n timeoutMs: timeoutMs ?? options.timeoutMs,\n });\n },\n requestIdentityAttestation: <P extends IdentityRequestPlatform>(\n params: Omit<RequestIdentityAttestationParamsFor<P>, \"attestationServiceUrl\"> & {\n attestationServiceUrl?: string;\n },\n ): Promise<IdentityAttestationOutputFor<P>> => {\n return requestIdentityAttestationOnce<P>({\n attestationServiceUrl: params.attestationServiceUrl ?? baseUrl,\n trust: mergeTrust(baseTrust, params.trust),\n fetch: params.fetch ?? options.fetch,\n subtle: params.subtle ?? options.subtle,\n getRandomValues: params.getRandomValues ?? options.getRandomValues,\n now: params.now ?? options.now,\n onWarning: params.onWarning ?? options.onWarning,\n timeoutMs: params.timeoutMs ?? options.timeoutMs,\n platform: params.platform,\n actionType: params.actionType,\n callerAddress: params.callerAddress,\n sessionMaterial: params.sessionMaterial,\n params: params.params,\n });\n },\n uploadSellerCredential: (params) => {\n const {\n attestationServiceUrl,\n trust,\n fetch,\n subtle,\n getRandomValues,\n now,\n onWarning,\n timeoutMs,\n ...uploadParams\n } = params;\n\n return uploadSellerCredentialOnce({\n ...uploadParams,\n attestationServiceUrl: attestationServiceUrl ?? baseUrl,\n trust: mergeTrust(baseTrust, trust),\n fetch: fetch ?? options.fetch,\n subtle: subtle ?? options.subtle,\n getRandomValues: getRandomValues ?? options.getRandomValues,\n now: now ?? options.now,\n onWarning: onWarning ?? options.onWarning,\n timeoutMs: timeoutMs ?? options.timeoutMs,\n });\n },\n verifyBuyerTeePayment: <P extends BuyerTeeSessionMaterialPlatform>(\n params: NitroAttestationClientVerifyBuyerTeePaymentParamsFor<P>,\n ): Promise<BuyerTeeAttestationOutputFor<P>> => {\n const verifyParams = {\n attestationServiceUrl: params.attestationServiceUrl ?? baseUrl,\n trust: mergeTrust(baseTrust, params.trust),\n fetch: params.fetch ?? options.fetch,\n subtle: params.subtle ?? options.subtle,\n getRandomValues: params.getRandomValues ?? options.getRandomValues,\n now: params.now ?? options.now,\n onWarning: params.onWarning ?? options.onWarning,\n timeoutMs: params.timeoutMs ?? options.timeoutMs,\n platform: params.platform,\n actionType: params.actionType,\n sessionMaterial: params.sessionMaterial,\n params: params.params,\n chainId: params.chainId,\n intent: params.intent,\n } as unknown as VerifyBuyerTeePaymentParamsFor<P>;\n\n return verifyBuyerTeePaymentOnce<P>(verifyParams);\n },\n fetchAndVerifyAttestation: (params = {}) =>\n fetchAndVerifyAttestationOnce({\n attestationServiceUrl: params.attestationServiceUrl ?? baseUrl,\n trust: mergeTrust(baseTrust, params.trust),\n fetch: params.fetch ?? options.fetch,\n subtle: params.subtle ?? options.subtle,\n getRandomValues: params.getRandomValues ?? options.getRandomValues,\n now: params.now ?? options.now,\n onWarning: params.onWarning ?? options.onWarning,\n timeoutMs: params.timeoutMs ?? options.timeoutMs,\n }),\n encryptBuyerTeeSessionMaterial: ({ subtle, getRandomValues, ...params }) =>\n encryptBuyerTeeSessionMaterialOnce({\n ...params,\n subtle: subtle ?? options.subtle,\n getRandomValues: getRandomValues ?? options.getRandomValues,\n }),\n encryptIdentitySessionMaterial: ({ subtle, getRandomValues, ...params }) =>\n encryptIdentitySessionMaterialOnce({\n ...params,\n subtle: subtle ?? options.subtle,\n getRandomValues: getRandomValues ?? options.getRandomValues,\n }),\n encryptSellerCredentialUpload: ({ subtle, getRandomValues, now, ...params }) =>\n encryptSellerCredentialUploadOnce({\n ...params,\n subtle: subtle ?? options.subtle,\n getRandomValues: getRandomValues ?? options.getRandomValues,\n now: now ?? options.now,\n }),\n };\n}\n\nfunction mergeTrust(base: TrustPins, override: TrustPins | undefined): TrustPins {\n if (!override) {\n return base;\n }\n return {\n ...base,\n ...override,\n expectedPcr8ByHost: {\n ...base.expectedPcr8ByHost,\n ...override.expectedPcr8ByHost,\n },\n };\n}\n","import { concat, getAddress, keccak256, recoverAddress, TypedDataEncoder, toUtf8Bytes, verifyTypedData } from \"ethers\";\nimport { fail } from \"./errors\";\nimport type { Eip712Field, UnifiedPaymentVerifierDomain } from \"./types\";\n\n// Duplicated from src/common/constants/unifiedPaymentVerifier.ts.\nexport const UNIFIED_PAYMENT_VERIFIER_DOMAIN = {\n name: \"UnifiedPaymentVerifier\",\n version: \"1\",\n} as const;\n\nexport const PAYMENT_ATTESTATION_TYPES: Record<string, Eip712Field[]> = {\n PaymentAttestation: [\n { name: \"intentHash\", type: \"bytes32\" },\n { name: \"releaseAmount\", type: \"uint256\" },\n { name: \"dataHash\", type: \"bytes32\" },\n ],\n};\n\nexport const PAYMENT_ATTESTATION_TYPESTRING =\n \"PaymentAttestation(bytes32 intentHash,uint256 releaseAmount,bytes32 dataHash)\";\nexport const PAYMENT_ATTESTATION_TYPEHASH = hashUtf8(PAYMENT_ATTESTATION_TYPESTRING);\n\n// Duplicated from src/identity/identityTypedData.ts.\nexport const IDENTITY_DOMAIN = {\n name: \"ZKP2PIdentityVerifier\",\n version: \"1\",\n} as const;\n\nexport const IDENTITY_ATTESTATION_TYPES: Record<string, Eip712Field[]> = {\n IdentityAttestation: [\n { name: \"method\", type: \"bytes32\" },\n { name: \"actionType\", type: \"bytes32\" },\n { name: \"callerAddress\", type: \"address\" },\n { name: \"payeeIdHash\", type: \"bytes32\" },\n { name: \"dataHash\", type: \"bytes32\" },\n { name: \"issuedAt\", type: \"uint256\" },\n { name: \"validUntil\", type: \"uint256\" },\n ],\n};\n\nexport const IDENTITY_ATTESTATION_TYPESTRING =\n \"IdentityAttestation(bytes32 method,bytes32 actionType,address callerAddress,bytes32 payeeIdHash,bytes32 dataHash,uint256 issuedAt,uint256 validUntil)\";\nexport const IDENTITY_ATTESTATION_TYPEHASH = hashUtf8(IDENTITY_ATTESTATION_TYPESTRING);\nexport const IDENTITY_DOMAIN_SEPARATOR = TypedDataEncoder.hashDomain(IDENTITY_DOMAIN).toLowerCase();\n\n// Duplicated from src/api/seller/sellerBundleSignature.ts.\nexport const SELLER_CREDENTIAL_BUNDLE_DOMAIN = {\n name: \"ZKP2P Seller Credential Bundle\",\n version: \"1\",\n} as const;\n\nexport const SELLER_CREDENTIAL_BUNDLE_TYPES: Record<string, Eip712Field[]> = {\n SellerCredentialBundle: [\n { name: \"platform\", type: \"string\" },\n { name: \"payeeIdHash\", type: \"bytes32\" },\n { name: \"encryptedBlobHash\", type: \"bytes32\" },\n { name: \"encryptedDataKeyHash\", type: \"bytes32\" },\n { name: \"nonceHash\", type: \"bytes32\" },\n { name: \"credentialType\", type: \"string\" },\n { name: \"credentialValidatedAt\", type: \"string\" },\n { name: \"credentialExpiresAt\", type: \"string\" },\n ],\n};\n\nexport function getUnifiedPaymentVerifierDomain(params: UnifiedPaymentVerifierDomain) {\n return {\n ...UNIFIED_PAYMENT_VERIFIER_DOMAIN,\n chainId: params.chainId,\n verifyingContract: getAddress(params.verifyingContract),\n };\n}\n\nexport function getUnifiedPaymentVerifierDomainSeparator(params: UnifiedPaymentVerifierDomain): string {\n return TypedDataEncoder.hashDomain(getUnifiedPaymentVerifierDomain(params)).toLowerCase();\n}\n\nexport function hashUtf8(value: string): string {\n return keccak256(toUtf8Bytes(value)).toLowerCase();\n}\n\nexport function hashHexBytes(hex: string): string {\n return keccak256(hex).toLowerCase();\n}\n\nexport function recoverSignerFromDomainSeparator(params: {\n domainSeparator: string;\n types: Record<string, Eip712Field[]>;\n value: Record<string, unknown>;\n signature: string;\n}): string {\n try {\n const structHash = TypedDataEncoder.from(params.types).hash(params.value);\n const digest = keccak256(concat([\"0x1901\", params.domainSeparator, structHash]));\n return normalizeAddress(recoverAddress(digest, params.signature));\n } catch (cause) {\n fail(\"ATTESTATION_SIGNATURE_INVALID\", \"Unable to recover signer from attestation signature\", { cause });\n }\n}\n\nexport function recoverSignerFromKnownDomain(params: {\n domain: Record<string, unknown>;\n types: Record<string, Eip712Field[]>;\n value: Record<string, unknown>;\n signature: string;\n}): string {\n try {\n return normalizeAddress(verifyTypedData(params.domain, params.types, params.value, params.signature));\n } catch (cause) {\n fail(\"ATTESTATION_SIGNATURE_INVALID\", \"Unable to verify attestation signature\", { cause });\n }\n}\n\nexport function assertTrustedSigner(recoveredSigner: string, trustedSigners: readonly string[]): string {\n const recovered = normalizeAddress(recoveredSigner);\n const normalizedTrustedSigners = new Set(trustedSigners.map((signer) => normalizeAddress(signer)));\n if (!normalizedTrustedSigners.has(recovered)) {\n fail(\"SIGNER_NOT_TRUSTED\", \"Recovered signer is not in trustedSigners\", {\n details: { recoveredSigner: recovered, trustedSigners: Array.from(normalizedTrustedSigners) },\n });\n }\n return recovered;\n}\n\nexport function assertTrustedPayloadSigner(params: {\n payloadSigner: string;\n recoveredSigner: string;\n trustedSigners: readonly string[];\n}): string {\n const recovered = assertTrustedSigner(params.recoveredSigner, params.trustedSigners);\n const payloadSigner = normalizeAddress(params.payloadSigner);\n if (payloadSigner !== recovered) {\n fail(\"ATTESTATION_SIGNATURE_INVALID\", \"Payload signer does not match the recovered signer\", {\n details: { payloadSigner, recoveredSigner: recovered },\n });\n }\n return recovered;\n}\n\nexport function assertLowercaseHexEqual(actual: string, expected: string, label: string): void {\n if (actual.toLowerCase() !== expected.toLowerCase()) {\n fail(\"ATTESTATION_BINDING_MISMATCH\", `${label} did not match expected value`, {\n details: { actual, expected },\n });\n }\n}\n\nexport function assertAddressEqual(actual: string, expected: string, label: string): void {\n let normalizedActual: string;\n let normalizedExpected: string;\n try {\n normalizedActual = normalizeAddress(actual);\n normalizedExpected = normalizeAddress(expected);\n } catch (cause) {\n fail(\"INVALID_PARAMETER\", `${label} must be a valid Ethereum address`, { cause });\n }\n\n if (normalizedActual !== normalizedExpected) {\n fail(\"ATTESTATION_BINDING_MISMATCH\", `${label} did not match expected value`, {\n details: { actual, expected },\n });\n }\n}\n\nexport function assertStringEqual(actual: string, expected: string, label: string): void {\n if (actual !== expected) {\n fail(\"ATTESTATION_BINDING_MISMATCH\", `${label} did not match expected value`, {\n details: { actual, expected },\n });\n }\n}\n\nexport function assertTypedDataTypesEqual(\n actual: Record<string, Eip712Field[]>,\n expected: Record<string, Eip712Field[]>,\n): void {\n if (JSON.stringify(actual) !== JSON.stringify(expected)) {\n fail(\"ATTESTATION_BINDING_MISMATCH\", \"typedDataSpec.types did not match the expected EIP-712 types\");\n }\n}\n\nexport function requireVerifierOption(value: string | undefined, label: string): string {\n if (typeof value !== \"string\") {\n fail(\"INVALID_PARAMETER\", `${label} is required`);\n }\n return value;\n}\n\nfunction normalizeAddress(address: string): string {\n return getAddress(address).toLowerCase();\n}\n","import {\n assertLowercaseHexEqual,\n assertStringEqual,\n assertTrustedPayloadSigner,\n assertTypedDataTypesEqual,\n getUnifiedPaymentVerifierDomainSeparator,\n hashHexBytes,\n PAYMENT_ATTESTATION_TYPEHASH,\n PAYMENT_ATTESTATION_TYPES,\n recoverSignerFromDomainSeparator,\n requireVerifierOption,\n} from \"./eip712\";\nimport type {\n BuyerTeeAttestationOutputFor,\n BuyerTeeSessionMaterialPlatform,\n VerifyBuyerTeePaymentAttestationOptionsFor,\n} from \"./types\";\n\nexport function verifyBuyerTeePaymentAttestation<P extends BuyerTeeSessionMaterialPlatform>(\n payload: BuyerTeeAttestationOutputFor<P>,\n options: VerifyBuyerTeePaymentAttestationOptionsFor<P>,\n): BuyerTeeAttestationOutputFor<P> {\n assertStringEqual(payload.platform, options.expectedPlatform, \"platform\");\n assertStringEqual(payload.actionType, options.expectedActionType, \"actionType\");\n assertStringEqual(payload.typedDataSpec.primaryType, \"PaymentAttestation\", \"typedDataSpec.primaryType\");\n assertTypedDataTypesEqual(payload.typedDataSpec.types, PAYMENT_ATTESTATION_TYPES);\n assertLowercaseHexEqual(payload.typeHash, PAYMENT_ATTESTATION_TYPEHASH, \"typeHash\");\n assertLowercaseHexEqual(\n payload.domainSeparator,\n getUnifiedPaymentVerifierDomainSeparator(options.expectedDomain),\n \"domainSeparator\",\n );\n\n // Pin encodedPaymentDetails to the signed dataHash so a proxy can't swap the\n // plaintext payment details while keeping the signed typedDataValue intact.\n assertLowercaseHexEqual(\n hashHexBytes(payload.encodedPaymentDetails),\n payload.typedDataValue.dataHash,\n \"encodedPaymentDetails\",\n );\n assertLowercaseHexEqual(\n payload.typedDataValue.intentHash,\n requireVerifierOption(options.expectedIntentHash, \"expectedIntentHash\"),\n \"typedDataValue.intentHash\",\n );\n\n const recoveredSigner = recoverSignerFromDomainSeparator({\n domainSeparator: payload.domainSeparator,\n types: PAYMENT_ATTESTATION_TYPES,\n value: { ...payload.typedDataValue },\n signature: payload.signature,\n });\n assertTrustedPayloadSigner({\n payloadSigner: payload.signer,\n recoveredSigner,\n trustedSigners: options.trustedSigners,\n });\n\n return payload;\n}\n","import {\n assertAddressEqual,\n assertLowercaseHexEqual,\n assertStringEqual,\n assertTrustedPayloadSigner,\n assertTypedDataTypesEqual,\n hashUtf8,\n IDENTITY_ATTESTATION_TYPEHASH,\n IDENTITY_ATTESTATION_TYPES,\n IDENTITY_DOMAIN,\n IDENTITY_DOMAIN_SEPARATOR,\n recoverSignerFromKnownDomain,\n requireVerifierOption,\n} from \"./eip712\";\nimport { fail } from \"./errors\";\nimport type {\n IdentityAttestationOutputFor,\n IdentityPlatform,\n NormalizedIdentityDetails,\n VerifyIdentityAttestationOptionsFor,\n} from \"./types\";\n\nconst IDENTITY_CANONICAL_FIELD_ORDER = [\"platform\", \"actionType\", \"payeeId\", \"username\", \"metadata\"] as const;\n\nexport function verifyIdentityAttestation<P extends IdentityPlatform>(\n payload: IdentityAttestationOutputFor<P>,\n options: VerifyIdentityAttestationOptionsFor<P>,\n): NormalizedIdentityDetails<P> {\n assertStringEqual(payload.platform, options.expectedPlatform, \"platform\");\n assertStringEqual(payload.actionType, options.expectedActionType, \"actionType\");\n assertStringEqual(payload.identity.platform, payload.platform, \"identity.platform\");\n assertStringEqual(payload.identity.actionType, payload.actionType, \"identity.actionType\");\n assertStringEqual(payload.typedDataSpec.primaryType, \"IdentityAttestation\", \"typedDataSpec.primaryType\");\n assertTypedDataTypesEqual(payload.typedDataSpec.types, IDENTITY_ATTESTATION_TYPES);\n assertLowercaseHexEqual(payload.domainSeparator, IDENTITY_DOMAIN_SEPARATOR, \"domainSeparator\");\n assertLowercaseHexEqual(payload.typeHash, IDENTITY_ATTESTATION_TYPEHASH, \"typeHash\");\n assertLowercaseHexEqual(payload.identity.method, hashUtf8(payload.identity.platform), \"identity.method\");\n // Bind the plaintext payeeId to the signed payeeIdHash so a malformed response\n // can't return a different plaintext while keeping a valid signature.\n assertLowercaseHexEqual(payload.identity.payeeIdHash, hashUtf8(payload.identity.payeeId), \"identity.payeeIdHash\");\n assertLowercaseHexEqual(payload.typedDataValue.method, payload.identity.method, \"typedDataValue.method\");\n assertLowercaseHexEqual(\n payload.typedDataValue.actionType,\n hashUtf8(payload.identity.actionType),\n \"typedDataValue.actionType\",\n );\n assertAddressEqual(\n payload.typedDataValue.callerAddress,\n requireVerifierOption(options.expectedCallerAddress, \"expectedCallerAddress\"),\n \"typedDataValue.callerAddress\",\n );\n assertLowercaseHexEqual(\n payload.typedDataValue.payeeIdHash,\n payload.identity.payeeIdHash,\n \"typedDataValue.payeeIdHash\",\n );\n assertLowercaseHexEqual(\n payload.typedDataValue.payeeIdHash,\n requireVerifierOption(options.expectedPayeeIdHash, \"expectedPayeeIdHash\"),\n \"typedDataValue.payeeIdHash\",\n );\n assertLowercaseHexEqual(\n payload.typedDataValue.dataHash,\n hashIdentityData(payload.identity),\n \"typedDataValue.dataHash\",\n );\n assertNotExpired(payload.typedDataValue.validUntil, options.now ?? Date.now);\n\n const recoveredSigner = recoverSignerFromKnownDomain({\n domain: IDENTITY_DOMAIN,\n types: IDENTITY_ATTESTATION_TYPES,\n value: { ...payload.typedDataValue },\n signature: payload.signature,\n });\n assertTrustedPayloadSigner({\n payloadSigner: payload.signer,\n recoveredSigner,\n trustedSigners: options.trustedSigners,\n });\n\n return payload.identity;\n}\n\nfunction hashIdentityData(details: NormalizedIdentityDetails): string {\n const canonicalFields = {\n platform: details.platform,\n actionType: details.actionType,\n payeeId: details.payeeId,\n username: details.username,\n metadata: sortMetadata(details.metadata),\n };\n const canonical = JSON.stringify(\n Object.fromEntries(IDENTITY_CANONICAL_FIELD_ORDER.map((field) => [field, canonicalFields[field]])),\n );\n\n return hashUtf8(canonical);\n}\n\nfunction sortMetadata(metadata: Record<string, string>): Record<string, string> {\n return Object.fromEntries(Object.entries(metadata).sort(([left], [right]) => left.localeCompare(right)));\n}\n\nfunction assertNotExpired(validUntil: string, now: () => number): void {\n const nowMs = now();\n if (BigInt(nowMs) > BigInt(validUntil)) {\n fail(\"ATTESTATION_EXPIRED\", \"Identity attestation validUntil is in the past\", {\n details: { validUntil, nowMs },\n });\n }\n}\n","import {\n assertLowercaseHexEqual,\n assertStringEqual,\n assertTrustedSigner,\n hashUtf8,\n recoverSignerFromKnownDomain,\n requireVerifierOption,\n SELLER_CREDENTIAL_BUNDLE_DOMAIN,\n SELLER_CREDENTIAL_BUNDLE_TYPES,\n} from \"./eip712\";\nimport { fail } from \"./errors\";\nimport type {\n SellerCredentialBundleFor,\n SellerCredentialUploadPlatform,\n VerifySellerCredentialBundleOptionsFor,\n} from \"./types\";\n\nexport function verifySellerCredentialBundle<P extends SellerCredentialUploadPlatform>(\n bundle: SellerCredentialBundleFor<P>,\n options: VerifySellerCredentialBundleOptionsFor<P>,\n): SellerCredentialBundleFor<P> {\n assertStringEqual(bundle.platform, options.expectedPlatform, \"platform\");\n assertLowercaseHexEqual(\n bundle.payeeIdHash,\n requireVerifierOption(options.expectedPayeeIdHash, \"expectedPayeeIdHash\"),\n \"payeeIdHash\",\n );\n assertCredentialNotExpired(bundle.credentialExpiresAt, options.now ?? Date.now);\n\n const recoveredSigner = recoverSignerFromKnownDomain({\n domain: SELLER_CREDENTIAL_BUNDLE_DOMAIN,\n types: SELLER_CREDENTIAL_BUNDLE_TYPES,\n value: buildSellerCredentialBundleValue(bundle),\n signature: bundle.bundleSignature,\n });\n assertTrustedSigner(recoveredSigner, options.trustedSigners);\n\n return bundle;\n}\n\nfunction buildSellerCredentialBundleValue(bundle: SellerCredentialBundleFor<SellerCredentialUploadPlatform>) {\n return {\n platform: bundle.platform,\n payeeIdHash: bundle.payeeIdHash,\n encryptedBlobHash: hashUtf8(bundle.encryptedBlob),\n encryptedDataKeyHash: hashUtf8(bundle.encryptedDataKey),\n nonceHash: hashUtf8(bundle.nonce),\n credentialType: bundle.credentialType,\n credentialValidatedAt: bundle.credentialValidatedAt,\n credentialExpiresAt: bundle.credentialExpiresAt ?? \"\",\n };\n}\n\nfunction assertCredentialNotExpired(credentialExpiresAt: string | null, now: () => number): void {\n const nowMs = now();\n if (credentialExpiresAt !== null && BigInt(nowMs) > BigInt(credentialExpiresAt)) {\n fail(\"ATTESTATION_EXPIRED\", \"Seller credential bundle credentialExpiresAt is in the past\", {\n details: { credentialExpiresAt, nowMs },\n });\n }\n}\n"],"mappings":"ubAAA,IAAAA,GAAA,GAAAC,GAAAD,GAAA,2CAAAE,EAAA,uBAAAC,EAAA,0BAAAC,EAAA,2CAAAC,EAAA,2CAAAC,EAAA,0CAAAC,EAAA,iCAAAC,GAAA,mCAAAC,EAAA,mCAAAC,EAAA,kCAAAC,EAAA,8BAAAC,EAAA,6CAAAC,EAAA,aAAAC,EAAA,+BAAAC,EAAA,2BAAAC,EAAA,0BAAAC,EAAA,qCAAAC,GAAA,8BAAAC,GAAA,iCAAAC,KAAA,eAAAC,GAAArB,ICgCO,IAAMsB,EAAN,cAAoC,KAAM,CACtC,KACS,MACT,QAET,YACEC,EACAC,EACAC,EAAkE,CAAC,EACnE,CACA,MAAMD,CAAO,EACb,KAAK,KAAO,wBACZ,KAAK,KAAOD,EACZ,KAAK,MAAQE,EAAQ,MACrB,KAAK,QAAUA,EAAQ,OACzB,CACF,EAEO,SAASC,EACdH,EACAC,EACAC,EACO,CACP,MAAM,IAAIH,EAAsBC,EAAMC,EAASC,CAAO,CACxD,CAEA,eAAsBE,EACpBC,EACAL,EACAC,EACY,CACZ,GAAI,CACF,OAAO,MAAMI,CACf,OAASC,EAAO,CACdH,EAAKH,EAAMC,EAAS,CAAE,MAAAK,CAAM,CAAC,CAC/B,CACF,CC7DO,SAASC,EAAaC,EAA4C,CACvE,OAAIA,IAAkB,QAChB,OAAOA,GAAkB,YAC3BC,EAAK,qBAAsB,mDAAmD,EAEzED,IAGL,OAAO,WAAW,OAAU,YAC9BC,EAAK,qBAAsB,mDAAmD,EAEzE,WAAW,MAAM,KAAK,UAAU,EACzC,CAEO,SAASC,GAAcC,EAA6C,CACzE,IAAMC,EAASD,GAAkB,WAAW,QAAQ,OACpD,OAAKC,GACHH,EAAK,qBAAsB,iDAAiD,EAEvEG,CACT,CAEO,SAASC,GACdC,EACiC,CACjC,GAAIA,EACF,OAAOA,EAGT,IAAMC,EAAY,WAAW,OAC7B,OAAI,OAAOA,GAAW,iBAAoB,YACxCN,EAAK,qBAAsB,oEAAoE,EAEzFO,GAAoBD,EAAU,gBAAgBC,CAAG,CAC3D,CAEO,SAASC,EAAsBC,EAGd,CACtB,MAAO,CACL,OAAQR,GAAcQ,EAAO,MAAM,EACnC,gBAAiBL,GAAuBK,EAAO,eAAe,CAChE,CACF,CAEO,SAASC,GAASP,EAAsBQ,EAA0D,CACvG,OAAI,OAAOA,GAAoB,YAC7BX,EAAK,qBAAsB,oEAAoE,EAE1F,CACL,OAAAG,EACA,gBAAAQ,EACA,WAAY,IAAMC,GAAaD,CAAe,CAChD,CACF,CAEA,SAASC,GACPD,EACqD,CACrD,IAAME,EAAQF,EAAgB,IAAI,WAAW,EAAE,CAAC,EAChDE,EAAM,CAAC,EAAKA,EAAM,CAAC,EAAI,GAAQ,GAC/BA,EAAM,CAAC,EAAKA,EAAM,CAAC,EAAI,GAAQ,IAC/B,IAAMC,EAAM,MAAM,KAAKD,EAAQE,GAASA,EAAK,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,CAAC,EAC1E,MAAO,GAAGD,EAAI,MAAM,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAIA,EAAI,MAAM,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAIA,EAAI,MAAM,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAIA,EAC3F,MAAM,EAAG,EAAE,EACX,KAAK,EAAE,CAAC,IAAIA,EAAI,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EACvC,CC1EA,IAAME,EAAkB,mEAClBC,EAAgBC,GAAYF,CAAe,EAEjD,SAASE,GAAYC,EAA0C,CAC7D,IAAMC,EAAiC,CAAC,EACxC,QAASC,EAAQ,EAAGA,EAAQF,EAAS,OAAQE,GAAS,EACpDD,EAAOD,EAASE,CAAK,CAAC,EAAIA,EAE5B,OAAOD,CACT,CAEO,SAASE,EAAWC,EAA2B,CACpD,IAAIC,EAAM,GACV,QAAWC,KAAQF,EACjBC,GAAOC,EAAK,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,EAE1C,OAAOD,CACT,CAmBO,SAASE,EAAWC,EAA2B,CACpD,GAAI,OAAO,YAAgB,IACzB,OAAO,IAAI,YAAY,EAAE,OAAOA,CAAK,EAGvC,IAAMC,EAAkB,CAAC,EACzB,QAASC,EAAQ,EAAGA,EAAQF,EAAM,OAAQE,GAAS,EAAG,CACpD,IAAMC,EAAYH,EAAM,YAAYE,CAAK,EACrCC,EAAY,QACdD,GAAS,GAEPC,GAAa,IACfF,EAAM,KAAKE,CAAS,EACXA,GAAa,KACtBF,EAAM,KAAK,IAAQE,GAAa,EAAI,IAAQA,EAAY,EAAK,EACpDA,GAAa,MACtBF,EAAM,KAAK,IAAQE,GAAa,GAAK,IAASA,GAAa,EAAK,GAAO,IAAQA,EAAY,EAAK,EAEhGF,EAAM,KACJ,IAAQE,GAAa,GACrB,IAASA,GAAa,GAAM,GAC5B,IAASA,GAAa,EAAK,GAC3B,IAAQA,EAAY,EACtB,CAEJ,CACA,OAAO,IAAI,WAAWF,CAAK,CAC7B,CAEO,SAASG,EAAWH,EAA2B,CACpD,GAAI,OAAO,YAAgB,IACzB,OAAO,IAAI,YAAY,EAAE,OAAOA,CAAK,EAGvC,IAAII,EAAM,GACV,QAASH,EAAQ,EAAGA,EAAQD,EAAM,OAAQC,GAAS,EAAG,CACpD,IAAMI,EAAQL,EAAMC,CAAK,EACrBI,EAAQ,IACVD,GAAO,OAAO,cAAcC,CAAK,GACvBA,EAAQ,OAAU,IAC5BD,GAAO,OAAO,eAAgBC,EAAQ,KAAS,EAAML,EAAM,EAAEC,CAAK,EAAI,EAAK,GACjEI,EAAQ,OAAU,IAC5BD,GAAO,OAAO,eAAgBC,EAAQ,KAAS,IAAQL,EAAM,EAAEC,CAAK,EAAI,KAAS,EAAMD,EAAM,EAAEC,CAAK,EAAI,EAAK,EAE7GG,GAAO,OAAO,eACVC,EAAQ,IAAS,IACfL,EAAM,EAAEC,CAAK,EAAI,KAAS,IAC1BD,EAAM,EAAEC,CAAK,EAAI,KAAS,EAC3BD,EAAM,EAAEC,CAAK,EAAI,EACtB,CAEJ,CACA,OAAOG,CACT,CAEO,SAASE,GAAaN,EAA2B,CACtD,IAAII,EAAM,GACV,QAASH,EAAQ,EAAGA,EAAQD,EAAM,OAAQC,GAAS,EAAG,CACpD,IAAMI,EAAQL,EAAMC,CAAK,EACnBM,EAASP,EAAMC,EAAQ,CAAC,GAAK,EAC7BO,EAAQR,EAAMC,EAAQ,CAAC,GAAK,EAC5BQ,EAAWJ,GAAS,GAAOE,GAAU,EAAKC,EAEhDJ,GAAOM,EAAiBD,GAAW,GAAM,EAAI,EAC7CL,GAAOM,EAAiBD,GAAW,GAAM,EAAI,EAC7CL,GAAOH,EAAQ,EAAID,EAAM,OAASU,EAAiBD,GAAW,EAAK,EAAI,EAAI,IAC3EL,GAAOH,EAAQ,EAAID,EAAM,OAASU,EAAgBD,EAAU,EAAI,EAAI,GACtE,CACA,OAAOL,CACT,CAEO,SAASO,GAAaZ,EAA2B,CACtD,OAAOa,GAAab,EAAO,EAAK,CAClC,CAEO,SAASc,EAAgBb,EAA2B,CACzD,OAAOM,GAAaN,CAAK,EAAE,WAAW,IAAK,GAAG,EAAE,WAAW,IAAK,GAAG,EAAE,QAAQ,MAAO,EAAE,CACxF,CAMA,SAASc,GAAaC,EAAeC,EAA8B,CACjE,IAAMC,EAAWF,EAAM,QAAQ,OAAQ,EAAE,EACnCG,EAAaF,EAAUC,EAAS,WAAW,IAAK,GAAG,EAAE,WAAW,IAAK,GAAG,EAAIA,EAClF,GAAIC,EAAW,OAAS,IAAM,EAC5B,MAAM,IAAI,MAAM,uBAAuB,EAEzC,IAAMC,EAASD,EAAa,IAAI,QAAQ,EAAKA,EAAW,OAAS,GAAM,CAAC,EAElEE,EAAkB,CAAC,EACzB,QAASC,EAAQ,EAAGA,EAAQF,EAAO,OAAQE,GAAS,EAAG,CACrD,IAAMC,EAAQH,EAAO,MAAME,EAAOA,EAAQ,CAAC,EACrCE,EAAMD,EAAM,SAAS,IAAI,EAAI,EAAIA,EAAM,SAAS,GAAG,EAAI,EAAI,EAC3DE,EAAIC,EAAaH,EAAM,CAAC,EAAGI,CAAa,EACxCC,EAAIF,EAAaH,EAAM,CAAC,EAAGI,CAAa,EACxCE,EAAIN,EAAM,CAAC,IAAM,IAAM,EAAIG,EAAaH,EAAM,CAAC,EAAGI,CAAa,EAC/DG,EAAIP,EAAM,CAAC,IAAM,IAAM,EAAIG,EAAaH,EAAM,CAAC,EAAGI,CAAa,EAC/DI,EAAWN,GAAK,GAAOG,GAAK,GAAOC,GAAK,EAAKC,EAEnDT,EAAM,KAAMU,GAAW,GAAM,GAAI,EAC7BP,EAAM,GACRH,EAAM,KAAMU,GAAW,EAAK,GAAI,EAE9BP,EAAM,GACRH,EAAM,KAAKU,EAAU,GAAI,CAE7B,CACA,OAAO,IAAI,WAAWV,CAAK,CAC7B,CAEA,SAASK,EAAaM,EAAcC,EAAwC,CAC1E,IAAMjB,EAAQiB,EAAOD,CAAI,EACzB,GAAIhB,IAAU,OACZ,MAAM,IAAI,MAAM,6BAA6BgB,CAAI,EAAE,EAErD,OAAOhB,CACT,CAEO,SAASkB,EAAYC,EAAiC,CAC3D,IAAMC,EAAQD,EAAM,OAAO,CAACE,EAAKC,IAASD,EAAMC,EAAK,OAAQ,CAAC,EACxDC,EAAM,IAAI,WAAWH,CAAK,EAC5BI,EAAS,EACb,QAAWF,KAAQH,EACjBI,EAAI,IAAID,EAAME,CAAM,EACpBA,GAAUF,EAAK,OAEjB,OAAOC,CACT,CAMO,SAASE,EAAmBC,EAAgC,CACjE,OAAO,IAAI,WAAWA,CAAK,EAAE,MAC/B,CClJO,SAASC,GACdC,EAKiC,CACjC,IAAMC,EAAY,CAChB,gBAAiBD,EAAO,gBACxB,GAAIA,EAAO,gBAAkB,OAAY,CAAE,cAAeA,EAAO,aAAc,EAAI,CAAC,EACpF,kBAAmBA,EAAO,IAAI,mBAC9B,WAAYA,EAAO,WACnB,MAAOA,EAAO,KAChB,EAEA,OAAIA,EAAO,WAAa,QAAUA,EAAO,WAAa,WAC7CC,EAGF,CACL,QAASD,EAAO,QAChB,GAAGC,CACL,CACF,CAEO,SAASC,GACdF,EAGkC,CAClC,MAAO,CACL,SAAUA,EAAO,SACjB,WAAYA,EAAO,WACnB,gBAAiBA,EAAO,gBACxB,kBAAmBA,EAAO,IAAI,kBAChC,CACF,CAEO,SAASG,GACdH,EAGkC,CAElC,MAAO,CACL,SAAUA,EAAO,SACjB,WAAYA,EAAO,WACnB,gBAAiBA,EAAO,gBACxB,kBAAmBA,EAAO,IAAI,kBAChC,CACF,CAEO,SAASI,GACdH,EACQ,CACR,OAAO,KAAK,UAAUA,CAAS,CACjC,CClEA,IAAMI,GAAuB,CAAE,IAAK,eAAgB,IAAK,SAAU,EAC7DC,GAAiB,0BAEvB,eAAsBC,GAAgDC,EAKlD,CAClB,IAAMC,EAAaD,EAAO,QAAQ,YAAcA,EAAO,IAAI,EACrDE,EAAQF,EAAO,QAAQ,OAASG,GAAaH,EAAO,eAAe,EACzE,OAAAI,GAAYF,CAAK,EAEVG,GAA2C,CAChD,IAAKL,EAAO,QAAQ,IACpB,UAAWM,GAAqC,CAC9C,GAAGN,EAAO,QACV,WAAAC,EACA,MAAAC,CACF,CAAC,EACD,OAAQF,EAAO,OACf,gBAAiBA,EAAO,gBACxB,eAAgB,0BAClB,CAAC,CACH,CAEA,eAAsBO,GAEpBP,EAIkB,CAClB,OAAOK,GAA2C,CAChD,IAAKL,EAAO,QAAQ,IACpB,UAAWQ,GAAsCR,EAAO,OAAO,EAC/D,OAAQA,EAAO,OACf,gBAAiBA,EAAO,gBACxB,eAAgB,4BAClB,CAAC,CACH,CAEA,eAAsBS,GAAoFT,EAItF,CAClB,OAAOK,GAA2C,CAChD,IAAKL,EAAO,QAAQ,IACpB,UAAWU,GAAsCV,EAAO,OAAO,EAC/D,OAAQA,EAAO,OACf,gBAAiBA,EAAO,gBACxB,eAAgB,2BAClB,CAAC,CACH,CAEA,eAAeK,GAA2CL,EAMtC,CAClB,IAAMW,EAAYC,EAAWC,GAAyBb,EAAO,SAAS,CAAC,EAEjEc,EAAMd,EAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,EAC/Ce,EAAS,MAAMC,EACnBhB,EAAO,OAAO,UACZ,OACAiB,EAAmBjB,EAAO,IAAI,YAAY,EAC1C,CAAE,KAAM,WAAY,KAAM,SAAU,EACpC,GACA,CAAC,SAAS,CACZ,EACA,qBACA,yDACF,EACMkB,EAAe,IAAI,WACvB,MAAMF,EACJhB,EAAO,OAAO,QAAQ,CAAE,KAAM,UAAW,EAAGe,EAAQE,EAAmBH,CAAG,CAAC,EAC3E,qBACA,uDACF,CACF,EAEMK,EAAKnB,EAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,EAC9CoB,EAAkBC,EAAgBT,EAAW,KAAK,UAAUf,EAAoB,CAAC,CAAC,EAClFyB,EAAMV,EAAWQ,CAAe,EAChCG,EAAS,MAAMP,EACnBhB,EAAO,OAAO,UAAU,MAAOiB,EAAmBH,CAAG,EAAG,CAAE,KAAM,UAAW,OAAQ,GAAI,EAAG,GAAO,CAAC,SAAS,CAAC,EAC5G,qBACA,2DACF,EACMU,EAAqB,IAAI,WAC7B,MAAMR,EACJhB,EAAO,OAAO,QACZ,CACE,KAAM,UACN,GAAIiB,EAAmBE,CAAE,EACzB,eAAgBF,EAAmBK,CAAG,EACtC,UAAW,GACb,EACAC,EACAN,EAAmBN,CAAS,CAC9B,EACA,qBACA,6BAA6BX,EAAO,cAAc,EACpD,CACF,EACMyB,EAAaD,EAAmB,MAAM,EAAGA,EAAmB,OAAS,EAAE,EACvEE,EAAMF,EAAmB,MAAMA,EAAmB,OAAS,EAAE,EAEnE,MAAO,CACLJ,EACAC,EAAgBH,CAAY,EAC5BG,EAAgBF,CAAE,EAClBE,EAAgBI,CAAU,EAC1BJ,EAAgBK,CAAG,CACrB,EAAE,KAAK,GAAG,CACZ,CAGA,SAAStB,GAAYF,EAAqB,CACnCJ,GAAe,KAAKI,CAAK,GAC5ByB,EAAK,oBAAqB,0CAA0C,CAExE,CAGA,SAASxB,GAAayB,EAA0D,CAC9E,IAAMC,EAAQD,EAAgB,IAAI,WAAW,EAAE,CAAC,EAChDC,EAAM,CAAC,EAAKA,EAAM,CAAC,EAAI,GAAQ,GAC/BA,EAAM,CAAC,EAAKA,EAAM,CAAC,EAAI,GAAQ,IAC/B,IAAMC,EAAM,MAAM,KAAKD,EAAQE,GAASA,EAAK,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,CAAC,EAC1E,MAAO,GAAGD,EAAI,MAAM,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAIA,EAAI,MAAM,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAIA,EAAI,MAAM,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAIA,EAC3F,MAAM,EAAG,EAAE,EACX,KAAK,EAAE,CAAC,IAAIA,EAAI,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EACvC,CCtJA,eAAsBE,EACpBC,EACiB,CACjB,IAAMC,EAASC,EAAsBF,CAAM,EAC3C,OAAOG,GAAiD,CACtD,QAASH,EACT,OAAQC,EAAO,OACf,gBAAiBA,EAAO,eAC1B,CAAC,CACH,CCbA,IAAAG,GAAgC,0BCAzB,IAAMC,EAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBrBC,EAAwC,mEDTrD,IAAMC,GAAgC,MAAc,GAAK,IAOzD,eAAsBC,GAAuBC,EAQP,CACpC,IAAMC,EAASC,GAASF,EAAO,OAAQA,EAAO,eAAe,EACvDG,EAAkBC,GAAiBJ,EAAO,SAAWK,EAAoB,4BAA4B,EACrGC,EAAkB,MAAMC,GAAkBJ,EAAiBH,EAAO,MAAM,EAE1EM,IAAoBE,GACtBC,EAAK,gCAAiC,0DAA2D,CAC/F,QAAS,CAAE,SAAUD,EAAuC,OAAQF,CAAgB,CACtF,CAAC,EAGH,IAAMI,EAAkBN,GAAiBJ,EAAO,mBAAoB,8BAA8B,EAC5FW,EAAWX,EAAO,YAAY,IAAI,CAACY,EAAKC,IAAUT,GAAiBQ,EAAK,YAAYC,CAAK,GAAG,CAAC,EAC7FC,EAAkB,CAACX,EAAiB,GAAGQ,EAAUD,CAAe,EACtE,QAAWK,KAAeD,EACxBE,GAA2BD,EAAaf,EAAO,KAAK,EACpDiB,GAAeF,EAAaf,EAAO,MAAOA,EAAO,SAAS,EAG5D,IAAMkB,EAAkB,MAAMX,GAAkBG,EAAiBV,EAAO,MAAM,EACxEmB,EAAgB,CAAC,EACvB,QAAWJ,KAAeJ,EAAU,CAClC,IAAMS,EAAc,MAAMb,GAAkBQ,EAAaf,EAAO,MAAM,EAClEoB,IAAgBF,GAAmBE,IAAgBd,GACrDa,EAAc,KAAKJ,CAAW,CAElC,CAEA,IAAMM,EAAa,CACjB,CAACX,EAAiB,GAAGS,EAAc,MAAM,EAAE,QAAQ,EAAGhB,CAAe,EACrE,CAACO,EAAiB,GAAGS,EAAehB,CAAe,CACrD,EAEA,QAAWmB,KAAaD,EACtB,GAAI,MAAME,GAAiBD,EAAWrB,CAAM,EAAG,CAC7C,IAAMuB,EAAgB,MAAMC,EAC1Bf,EAAgB,UAAU,OAAO,CAAE,KAAM,QAAS,WAAY,OAAQ,EAAG,CAAC,QAAQ,EAAGT,CAAM,EAC3F,qBACA,8CACF,EACA,MAAO,CAAE,gBAAAS,EAAiB,cAAAc,CAAc,CAC1C,CAGFf,EAAK,qBAAsB,4EAA4E,CACzG,CAEA,eAAec,GAAiBG,EAA0BzB,EAAkC,CAC1F,QAASY,EAAQ,EAAGA,EAAQa,EAAM,OAAS,EAAGb,GAAS,EAAG,CACxD,IAAMc,EAAUD,EAAMb,CAAK,EACrBe,EAASF,EAAMb,EAAQ,CAAC,EAE9B,GAAI,CADO,MAAMc,EAAQ,OAAO,CAAE,UAAWC,EAAO,UAAW,cAAe,EAAK,EAAG3B,CAAM,EAE1F,MAAO,EAEX,CAEA,OAAOyB,EAAM,OAAS,GAAM,MAAMA,EAAMA,EAAM,OAAS,CAAC,EAAE,aAAazB,CAAM,CAC/E,CAEA,SAASG,GAAiByB,EAA0BC,EAAgC,CAClF,GAAI,CACF,OAAO,IAAI,mBAAgBD,CAAG,CAChC,OAASE,EAAO,CACdtB,EAAK,qBAAsB,mBAAmBqB,CAAK,GAAI,CAAE,MAAAC,CAAM,CAAC,CAClE,CACF,CAEA,eAAexB,GAAkBQ,EAA8BiB,EAAuC,CACpG,OAAOC,EAAW,IAAI,WAAW,MAAMD,EAAO,OAAO,UAAWjB,EAAY,OAAO,CAAC,CAAC,CACvF,CAEA,SAASC,GAA2BD,EAA8BmB,EAAqB,EACjFA,EAAQnB,EAAY,UAAU,QAAQ,GAAKmB,EAAQnB,EAAY,SAAS,QAAQ,IAClFN,EAAK,sBAAuB,6CAA8C,CACxE,QAAS,CACP,QAASM,EAAY,QACrB,UAAWA,EAAY,UAAU,YAAY,EAC7C,SAAUA,EAAY,SAAS,YAAY,CAC7C,CACF,CAAC,CAEL,CAEA,SAASE,GACPF,EACAmB,EACAC,EACM,CACFpB,EAAY,SAAS,QAAQ,EAAImB,EAAQpC,IAC3CqC,IAAY,CACV,KAAM,4BACN,QAAS,+DACT,QAAS,CACP,QAASpB,EAAY,QACrB,SAAUA,EAAY,SAAS,YAAY,CAC7C,CACF,CAAC,CAEL,CE7GO,SAASqB,EAAWC,EAA8B,CACvD,IAAMC,EAAS,IAAIC,GAAWF,CAAK,EAC7BG,EAAQF,EAAO,UAAU,EAC/B,GAAI,CAACA,EAAO,KAAK,EACf,MAAM,IAAI,MAAM,qBAAqB,EAEvC,OAAOE,CACT,CAEO,SAASC,EAAWD,EAA8B,CACvD,GAAI,OAAOA,GAAU,SAAU,CAC7B,GAAI,CAAC,OAAO,cAAcA,CAAK,EAC7B,MAAM,IAAI,MAAM,oCAAoC,EAEtD,OAAOA,GAAS,EAAIE,EAAoB,EAAGF,CAAK,EAAIE,EAAoB,EAAG,GAAKF,CAAK,CACvF,CACA,GAAI,OAAOA,GAAU,SACnB,OAAOA,GAAS,GAAKE,EAAoB,EAAGF,CAAK,EAAIE,EAAoB,EAAG,CAAC,GAAKF,CAAK,EAEzF,GAAI,OAAOA,GAAU,SAAU,CAC7B,IAAMG,EAAUC,EAAWJ,CAAK,EAChC,OAAOK,EAAY,CAACH,EAAoB,EAAGC,EAAQ,MAAM,EAAGA,CAAO,CAAC,CACtE,CACA,GAAIH,aAAiB,WACnB,OAAOK,EAAY,CAACH,EAAoB,EAAGF,EAAM,MAAM,EAAGA,CAAK,CAAC,EAElE,GAAI,MAAM,QAAQA,CAAK,EACrB,OAAOK,EAAY,CAACH,EAAoB,EAAGF,EAAM,MAAM,EAAG,GAAGA,EAAM,IAAIC,CAAU,CAAC,CAAC,EAErF,GAAID,aAAiB,IAEnB,OAAOK,EAAY,CACjBH,EAAoB,EAAGF,EAAM,IAAI,EACjC,GAAG,MAAM,KAAKA,EAAM,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAACM,EAAGC,CAAC,IAAM,CAACN,EAAWK,CAAC,EAAGL,EAAWM,CAAC,CAAC,CAAC,CACnF,CAAC,EAEH,GAAI,OAAOP,GAAU,UACnB,OAAO,IAAI,WAAW,CAACA,EAAQ,IAAO,GAAI,CAAC,EAE7C,GAAIA,IAAU,KACZ,OAAO,IAAI,WAAW,CAAC,GAAI,CAAC,EAE9B,MAAM,IAAI,MAAM,wBAAwB,CAC1C,CAEO,SAASQ,GAAwBC,EAAmCC,EAAsC,CAC/G,OAAOT,EAAW,CAAC,aAAcQ,EAAuB,IAAI,WAAcC,CAAY,CAAC,CACzF,CAEA,SAASR,EAAoBS,EAAmBC,EAAqC,CACnF,IAAMC,EAAe,OAAOD,CAAM,EAClC,OAAIC,EAAe,IACV,IAAI,WAAW,CAAEF,GAAa,EAAK,OAAOE,CAAY,CAAC,CAAC,EAE7DA,GAAgB,MACX,IAAI,WAAW,CAAEF,GAAa,EAAK,GAAI,OAAOE,CAAY,CAAC,CAAC,EAEjEA,GAAgB,QACX,IAAI,WAAW,CAAEF,GAAa,EAAK,GAAI,OAAQE,GAAgB,GAAM,KAAK,EAAG,OAAOA,EAAe,KAAK,CAAC,CAAC,EAE/GA,GAAgB,YACX,IAAI,WAAW,CACnBF,GAAa,EAAK,GACnB,OAAQE,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,GAAM,KAAK,EACnC,OAAOA,EAAe,KAAK,CAC7B,CAAC,EAGI,IAAI,WAAW,CACnBF,GAAa,EAAK,GACnB,OAAQE,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,GAAM,KAAK,EACnC,OAAOA,EAAe,KAAK,CAC7B,CAAC,CACH,CAEA,IAAMd,GAAN,KAAiB,CAGf,YAA6BF,EAAmB,CAAnB,WAAAA,CAAoB,CAApB,MAFrB,OAAS,EAIjB,MAAgB,CACd,OAAO,KAAK,SAAW,KAAK,MAAM,MACpC,CAEA,WAAuB,CACrB,IAAMiB,EAAO,KAAK,SAAS,EACrBH,EAAYG,GAAQ,EACpBC,EAAaD,EAAO,GAE1B,GAAIC,IAAe,GACjB,OAAO,KAAK,oBAAoBJ,CAAS,EAG3C,GAAIA,IAAc,EAChB,OAAO,KAAK,WAAWI,CAAU,EAEnC,GAAIJ,IAAc,EAAG,CACnB,IAAMX,EAAQ,KAAK,WAAWe,CAAU,EACxC,OAAO,OAAOf,GAAU,SAAW,CAAC,GAAKA,EAAQ,GAAKA,CACxD,CACA,GAAIW,IAAc,EAAG,CACnB,IAAMC,EAAS,KAAK,eAAe,KAAK,WAAWG,CAAU,CAAC,EAC9D,OAAO,KAAK,UAAUH,CAAM,CAC9B,CACA,GAAID,IAAc,EAAG,CACnB,IAAMC,EAAS,KAAK,eAAe,KAAK,WAAWG,CAAU,CAAC,EAC9D,OAAOC,EAAW,KAAK,UAAUJ,CAAM,CAAC,CAC1C,CACA,GAAID,IAAc,EAAG,CACnB,IAAMC,EAAS,KAAK,eAAe,KAAK,WAAWG,CAAU,CAAC,EACxDE,EAAmB,CAAC,EAC1B,QAASC,EAAQ,EAAGA,EAAQN,EAAQM,GAAS,EAC3CD,EAAI,KAAK,KAAK,UAAU,CAAC,EAE3B,OAAOA,CACT,CACA,GAAIN,IAAc,EAAG,CACnB,IAAMC,EAAS,KAAK,eAAe,KAAK,WAAWG,CAAU,CAAC,EACxDE,EAAM,IAAI,IAChB,QAASC,EAAQ,EAAGA,EAAQN,EAAQM,GAAS,EAC3CD,EAAI,IAAI,KAAK,UAAU,EAAG,KAAK,UAAU,CAAC,EAE5C,OAAOA,CACT,CACA,GAAIN,IAAc,EAChB,YAAK,WAAWI,CAAU,EACnB,KAAK,UAAU,EAExB,GAAIJ,IAAc,EAAG,CACnB,GAAII,IAAe,GACjB,MAAO,GAET,GAAIA,IAAe,GACjB,MAAO,GAET,GAAIA,IAAe,GACjB,OAAO,IAEX,CACA,MAAM,IAAI,MAAM,2CAA2CJ,CAAS,IAAII,CAAU,EAAE,CACtF,CAEQ,oBAAoBJ,EAA8B,CACxD,GAAIA,IAAc,EAAG,CACnB,IAAMQ,EAAuB,CAAC,EAC9B,KAAO,CAAC,KAAK,aAAa,GAAG,CAC3B,IAAMC,EAAQ,KAAK,UAAU,EAC7B,GAAI,EAAEA,aAAiB,YACrB,MAAM,IAAI,MAAM,yDAAyD,EAE3ED,EAAO,KAAKC,CAAK,CACnB,CACA,OAAOf,EAAYc,CAAM,CAC3B,CACA,GAAIR,IAAc,EAAG,CACnB,IAAIM,EAAM,GACV,KAAO,CAAC,KAAK,aAAa,GAAG,CAC3B,IAAMG,EAAQ,KAAK,UAAU,EAC7B,GAAI,OAAOA,GAAU,SACnB,MAAM,IAAI,MAAM,yDAAyD,EAE3EH,GAAOG,CACT,CACA,OAAOH,CACT,CACA,GAAIN,IAAc,EAAG,CACnB,IAAMM,EAAmB,CAAC,EAC1B,KAAO,CAAC,KAAK,aAAa,GACxBA,EAAI,KAAK,KAAK,UAAU,CAAC,EAE3B,OAAOA,CACT,CACA,GAAIN,IAAc,EAAG,CACnB,IAAMM,EAAM,IAAI,IAChB,KAAO,CAAC,KAAK,aAAa,GAAG,CAC3B,IAAMI,EAAM,KAAK,UAAU,EAC3B,GAAI,KAAK,UAAU,EACjB,MAAM,IAAI,MAAM,uCAAuC,EAEzDJ,EAAI,IAAII,EAAK,KAAK,UAAU,CAAC,CAC/B,CACA,OAAOJ,CACT,CACA,MAAM,IAAI,MAAM,8BAA8BN,CAAS,mBAAmB,CAC5E,CAEQ,WAAWI,EAAqC,CACtD,GAAIA,EAAa,GACf,OAAOA,EAET,GAAIA,IAAe,GACjB,OAAO,KAAK,SAAS,EAEvB,GAAIA,IAAe,GACjB,OAAQ,KAAK,SAAS,GAAK,EAAK,KAAK,SAAS,EAEhD,GAAIA,IAAe,GACjB,OAAQ,KAAK,SAAS,EAAI,UAAa,KAAK,SAAS,GAAK,KAAO,KAAK,SAAS,GAAK,GAAK,KAAK,SAAS,IAAO,EAEhH,GAAIA,IAAe,GAAI,CACrB,IAAIf,EAAQ,GACZ,QAASkB,EAAQ,EAAGA,EAAQ,EAAGA,GAAS,EACtClB,EAASA,GAAS,GAAM,OAAO,KAAK,SAAS,CAAC,EAEhD,OAAOA,GAAS,OAAO,OAAO,gBAAgB,EAAI,OAAOA,CAAK,EAAIA,CACpE,CACA,MAAM,IAAI,MAAM,2CAA2C,CAC7D,CAEQ,UAAmB,CACzB,GAAI,KAAK,QAAU,KAAK,MAAM,OAC5B,MAAM,IAAI,MAAM,8BAA8B,EAEhD,OAAO,KAAK,MAAM,KAAK,QAAQ,CACjC,CAEQ,WAAqB,CAC3B,OAAO,KAAK,OAAS,KAAK,MAAM,QAAU,KAAK,MAAM,KAAK,MAAM,IAAM,GACxE,CAEQ,cAAwB,CAC9B,OAAI,KAAK,UAAU,GACjB,KAAK,QAAU,EACR,IAEF,EACT,CAEQ,UAAUY,EAA4B,CAC5C,GAAI,KAAK,OAASA,EAAS,KAAK,MAAM,OACpC,MAAM,IAAI,MAAM,oCAAoC,EAEtD,IAAMK,EAAM,KAAK,MAAM,MAAM,KAAK,OAAQ,KAAK,OAASL,CAAM,EAC9D,YAAK,QAAUA,EACRK,CACT,CAEQ,eAAejB,EAAgC,CACrD,GAAI,OAAOA,GAAU,SACnB,MAAM,IAAI,MAAM,mDAAmD,EAErE,OAAOA,CACT,CACF,EC9PO,SAASsB,GAAgBC,EAAmD,CACjF,IAAMC,EAAWD,EAAoB,CAAC,IAAM,IAAOA,EAAoB,MAAM,CAAC,EAAIA,EAC9EE,EACJ,GAAI,CACFA,EAAUC,EAAWF,CAAQ,CAC/B,OAASG,EAAO,CACdC,EAAK,yBAA0B,4DAA6D,CAAE,MAAAD,CAAM,CAAC,CACvG,EAEI,CAAC,MAAM,QAAQF,CAAO,GAAKA,EAAQ,SAAW,IAChDG,EAAK,yBAA0B,iEAAiE,EAGlG,GAAM,CAACC,EAAuBC,EAAoBC,EAAcC,CAAS,EAAIP,EAC7E,OACE,EAAEI,aAAiC,aACnC,EAAEC,aAA8B,MAChC,EAAEC,aAAwB,aAC1B,EAAEC,aAAqB,cAEvBJ,EAAK,yBAA0B,2CAA2C,EAG5EK,GAAsBJ,CAAqB,EACvCG,EAAU,SAAW,IACvBJ,EAAK,8BAA+B,2CAA2CI,EAAU,MAAM,QAAQ,EAGlG,CAAE,sBAAAH,EAAuB,aAAAE,EAAc,UAAAC,CAAU,CAC1D,CAEA,eAAsBE,GAAoBC,EAMxB,CAChB,IAAMC,EAAeC,GAAwBF,EAAO,sBAAuBA,EAAO,YAAY,EACnF,MAAMG,EACfH,EAAO,OAAO,OAAO,CAAE,KAAM,QAAS,KAAM,SAAU,EAAGA,EAAO,cAAeA,EAAO,UAAWC,CAAY,EAC7G,+BACA,0CACF,GAEER,EAAK,+BAAgC,4EAA4E,CAErH,CAEA,SAASK,GAAsBJ,EAAyC,CACtE,IAAIJ,EACJ,GAAI,CACFA,EAAUC,EAAWG,CAAqB,CAC5C,OAASF,EAAO,CACdC,EAAK,yBAA0B,kDAAmD,CAAE,MAAAD,CAAM,CAAC,CAC7F,CACMF,aAAmB,KACvBG,EAAK,yBAA0B,2CAA2C,EAExEH,EAAQ,IAAI,CAAC,IAAM,KACrBG,EAAK,uBAAwB,+CAA+C,CAEhF,CCrEA,IAAMW,GAAkB,GAEjB,SAASC,EAAiBC,EAAeC,EAAuB,CACrE,IAAMC,EAAaF,EAAM,QAAQ,OAAQ,EAAE,EAAE,YAAY,EACzD,OAAIE,EAAW,SAAWJ,IAAmB,CAAC,cAAc,KAAKI,CAAU,IACzEC,EAAK,qBAAsB,GAAGF,CAAK,YAAYH,EAAe,2BAA2B,EAEpFI,CACT,CAEO,SAASE,GAAoBJ,EAAeC,EAAuB,CACxE,IAAMC,EAAaH,EAAiBC,EAAOC,CAAK,EAChD,OAAID,IAAUE,GACZC,EAAK,+BAAgC,GAAGF,CAAK,YAAYH,EAAe,2BAA2B,EAE9FI,CACT,CCdA,IAAMG,GAAiC,IAAM,KACvCC,GAA+B,EAC/BC,GAA+B,IAC/BC,GAAsB,sBAarB,SAASC,GAAoBC,EAA+BC,EAAuB,CACxF,IAAMC,EAAM,IAAI,IAAIF,CAAqB,EACnCG,EAAeD,EAAI,SAAS,QAAQ,OAAQ,EAAE,EACpD,OAAAA,EAAI,SAAWC,EAAa,SAAS,cAAc,EAAIA,EAAe,GAAGA,CAAY,eACrFD,EAAI,OAAS,GACbA,EAAI,aAAa,IAAI,QAASD,CAAQ,EAC/BC,CACT,CAEA,eAAsBE,GAAyBC,EAKd,CAC/B,IAAMH,EAAMH,GAAoBM,EAAO,sBAAuBA,EAAO,QAAQ,EACvEC,EAAW,MAAMC,GAAsBL,EAAI,SAAS,EAAGG,EAAO,MAAOA,EAAO,SAAS,EACrFG,EAAe,MAAMC,GAAiBH,CAAQ,EAC/CA,EAAS,IACZI,EAAK,2BAA4B,qCAAqCJ,EAAS,MAAM,GAAI,CACvF,QAAS,CAAE,OAAQA,EAAS,OAAQ,KAAME,EAAa,MAAM,EAAG,GAAG,CAAE,CACvE,CAAC,EAGH,IAAIG,EACJ,GAAI,CACFA,EAAO,KAAK,MAAMH,CAAY,CAChC,OAASI,EAAO,CACdF,EAAK,+BAAgC,8CAA+C,CAAE,MAAAE,CAAM,CAAC,CAC/F,CAEA,OAAOC,GAA4BF,CAAI,CACzC,CAEA,SAASE,GAA4BF,EAAoC,EACnE,CAACG,GAASH,CAAI,GAAKA,EAAK,UAAY,IAAQ,CAACG,GAASH,EAAK,cAAc,IAC3ED,EAAK,+BAAgC,mDAAmD,EAG1F,IAAMK,EAAiBJ,EAAK,gBACxB,OAAOI,EAAe,qBAAwB,UAAY,OAAOA,EAAe,OAAU,WAC5FL,EAAK,+BAAgC,8DAA8D,EAGrG,IAAIM,EACJ,GAAI,CACFA,EAAsBC,GAAaF,EAAe,mBAAmB,CACvE,OAASH,EAAO,CACdF,EAAK,+BAAgC,0CAA2C,CAAE,MAAAE,CAAM,CAAC,CAC3F,CACA,OAAII,EAAoB,SAAW,GACjCN,EAAK,+BAAgC,4CAA4C,EAG5E,CACL,oBAAAM,EACA,MAAOD,EAAe,MAAM,YAAY,EACxC,WAAY,CACV,QAAS,OAAOA,EAAe,SAAY,SAAWA,EAAe,QAAU,OAC/E,kBAAmBG,GAAqBH,EAAe,kBAAmB,mBAAmB,EAC7F,eAAgBG,GAAqBH,EAAe,eAAgB,gBAAgB,EACpF,aAAcI,GAA4BJ,EAAe,aAAc,cAAc,CACvF,CACF,CACF,CAEA,eAAeN,GAAiBH,EAAqC,CACnE,GAAI,CAACA,EAAS,KAAM,CAClB,IAAME,EAAe,MAAMF,EAAS,KAAK,EACzC,OAAAc,GAAmBC,EAAWb,CAAY,EAAE,MAAM,EAC3CA,CACT,CAEA,IAAMc,EAAShB,EAAS,KAAK,UAAU,EACjCiB,EAAuB,CAAC,EAC1BC,EAAa,EACjB,OAAa,CACX,GAAM,CAAE,KAAAC,EAAM,MAAAC,CAAM,EAAI,MAAMJ,EAAO,KAAK,EAC1C,GAAIG,EACF,MAEEC,IACFF,GAAcE,EAAM,OACpBN,GAAmBI,CAAU,EAC7BD,EAAO,KAAKG,CAAK,EAErB,CACA,OAAOC,EAAWC,EAAYL,CAAM,CAAC,CACvC,CAEA,SAASH,GAAmBI,EAA0B,CAChDA,EAAa7B,IACfe,EAAK,+BAAgC,kDAAmD,CACtF,QAAS,CAAE,SAAUf,GAAgC,YAAa6B,CAAW,CAC/E,CAAC,CAEL,CAEA,SAASN,GAAqBQ,EAAgBG,EAAmC,CAC/E,GAAIH,IAAU,OAGd,OAAI,OAAOA,GAAU,UAAY,CAAC5B,GAAoB,KAAK4B,CAAK,IAC9DhB,EAAK,+BAAgC,GAAGmB,CAAK,4CAA4C,EAEpFH,EAAM,YAAY,CAC3B,CAEA,SAASP,GAA4BO,EAAgBG,EAAmC,CACtF,GAAIH,IAAU,OAGd,CAAI,OAAOA,GAAU,UACnBhB,EAAK,+BAAgC,GAAGmB,CAAK,8CAA8C,EAE7F,GAAI,CACF,OAAOC,GAAoBJ,EAAOG,CAAK,CACzC,OAASjB,EAAO,CACdF,EAAK,+BAAgC,GAAGmB,CAAK,+CAAgD,CAAE,MAAAjB,CAAM,CAAC,CACxG,EACF,CAEA,eAAeL,GAAsBL,EAAa6B,EAAuBC,EAAsC,CAC7G,IAAIC,EAAU,EACd,OACE,GAAI,CACF,OAAO,MAAMC,GAAiBhC,EAAK6B,EAASC,CAAS,CACvD,OAASpB,EAAO,CACd,GAAI,CAACuB,GAA2BvB,CAAK,GAAKqB,GAAWrC,GACnD,MAAMgB,EAER,MAAMwB,GAAMvC,GAA+BoC,CAAO,EAClDA,GAAW,CACb,CAEJ,CAEA,eAAeC,GAAiBhC,EAAa6B,EAAuBC,EAAsC,CACxG,IAAMK,EAAa,OAAO,gBAAoB,IAAc,IAAI,gBAAoB,OAChFC,EACEC,EAAiB,IAAI,QAAe,CAACC,EAAGC,IAAW,CACvDH,EAAgB,WAAW,IAAM,CAC/BD,GAAY,MAAM,EAClBI,EAAO,IAAI,MAAM,SAAS,CAAC,CAC7B,EAAGT,CAAS,CACd,CAAC,EAED,GAAI,CACF,IAAM1B,EAAW,MAAM,QAAQ,KAAK,CAClCyB,EAAQ7B,EAAK,CACX,QAAS,CAAE,OAAQ,kBAAmB,EACtC,OAAQmC,GAAY,MACtB,CAAC,EACDE,CACF,CAAC,EACD,OAAID,IAAkB,QACpB,aAAaA,CAAa,EAErBhC,CACT,OAASM,EAAO,CACV0B,IAAkB,QACpB,aAAaA,CAAa,EAExB1B,aAAiB,QAAUA,EAAM,OAAS,cAAgBA,EAAM,UAAY,YAC9EF,EAAK,UAAW,oCAAoCsB,CAAS,KAAM,CAAE,MAAApB,CAAM,CAAC,EAE9EF,EAAK,2BAA4B,+CAAgD,CAC/E,MAAAE,EACA,QAAS,CAAE,MAAO,SAAU,CAC9B,CAAC,CACH,CACF,CAEA,SAASuB,GAA2BvB,EAAyB,CAC3D,OACEA,aAAiB8B,GACjB9B,EAAM,OAAS,4BACfA,EAAM,SAAS,QAAU,SAE7B,CAEA,SAASwB,GAAMO,EAA2B,CACxC,OAAO,IAAI,QAASC,GAAY,WAAWA,EAASD,CAAE,CAAC,CACzD,CAEA,SAAS7B,GAASY,EAAkD,CAClE,OAAO,OAAOA,GAAU,UAAYA,IAAU,MAAQ,CAAC,MAAM,QAAQA,CAAK,CAC5E,CC5MO,IAAMmB,GAAoB,GAE1B,SAASC,GAAiBC,EAA0D,CACzF,OAAOC,EAAWD,EAAgB,IAAI,WAAWF,EAAiB,CAAC,CAAC,CACtE,CAEO,SAASI,GAAgBC,EAAqBC,EAA6B,CAC5ED,EAAY,YAAY,IAAMC,GAChCC,EAAK,6BAA8B,+CAAgD,CACjF,QAAS,CAAE,cAAAD,EAAe,YAAAD,CAAY,CACxC,CAAC,CAEL,CCCO,SAASG,GAAyBC,EAAqD,CAC5F,IAAIC,EACJ,GAAI,CACFA,EAAUC,EAAWF,CAAY,CACnC,OAASG,EAAO,CACdC,EAAK,wBAAyB,8CAA+C,CAAE,MAAAD,CAAM,CAAC,CACxF,CAEA,IAAME,EAAUC,GAAWL,EAAS,SAAS,EACvCM,EAAOD,GAAWD,EAAQ,IAAI,MAAM,EAAG,MAAM,EAC7CG,EAAWC,EAAaJ,EAAQ,IAAI,WAAW,EAAG,WAAW,EAEnE,MAAO,CACL,YAAaK,GAAiBL,EAAQ,IAAI,WAAW,CAAC,EACtD,SAAUM,EAAWH,CAAQ,EAC7B,QAASI,GAAeL,EAAM,CAAC,EAC/B,QAASK,GAAeL,EAAM,CAAC,EAC/B,QAASK,GAAeL,EAAM,CAAC,EAC/B,QAASM,EAAWJ,EAAaF,EAAK,IAAI,CAAC,EAAG,SAAS,CAAC,EACxD,eAAgBE,EAAaJ,EAAQ,IAAI,aAAa,EAAG,aAAa,EACtE,YAAaS,GAAaT,EAAQ,IAAI,UAAU,EAAG,UAAU,EAAE,IAAI,CAACU,EAAOC,IACzEP,EAAaM,EAAO,YAAYC,CAAK,GAAG,CAC1C,EACA,aAAcP,EAAaJ,EAAQ,IAAI,YAAY,EAAG,YAAY,CACpE,CACF,CAEA,SAASO,GAAeL,EAA6BS,EAAuB,CAC1E,IAAMC,EAAQV,EAAK,IAAIS,CAAK,EAC5B,OAAOC,aAAiB,WAAaJ,EAAWI,CAAK,EAAI,EAC3D,CAEA,SAASP,GAAiBO,EAAwB,CAChD,GAAI,OAAOA,GAAU,UAAY,OAAO,cAAcA,CAAK,GAAKA,GAAS,EACvE,OAAOA,EAETb,EAAK,wBAAyB,gEAAgE,CAChG,CAEA,SAASE,GAAWW,EAAgBC,EAAsC,CACxE,GAAID,aAAiB,IACnB,OAAOA,EAETb,EAAK,wBAAyB,6BAA6Bc,CAAK,qBAAqB,CACvF,CAEA,SAAST,EAAaQ,EAAgBC,EAA2B,CAC/D,GAAID,aAAiB,WACnB,OAAOA,EAETb,EAAK,wBAAyB,6BAA6Bc,CAAK,wBAAwB,CAC1F,CAEA,SAASJ,GAAaG,EAAgBC,EAA0B,CAC9D,GAAI,MAAM,QAAQD,CAAK,EACrB,OAAOA,EAETb,EAAK,wBAAyB,6BAA6Bc,CAAK,mBAAmB,CACrF,CCvEO,IAAMC,GAAkC,gDAClCC,GAAqC,wCAG3C,IAAMC,GACX,mGACWC,GACX,mGACWC,GACX,mGAEWC,GAAwD,CACnE,wCAAyCC,EAAiBJ,GAAc,sBAAsB,EAC9F,wCAAyCI,EAAiBF,GAAc,sBAAsB,EAC9F,gCAAiCE,EAAiBH,GAAiB,yBAAyB,CAC9F,EAEaI,GAMT,CACF,QAAS,CACP,sBAAuBC,GACvB,gBAAiBN,EACnB,EACA,WAAY,CACV,sBAAuBO,GACvB,gBAAiBN,EACnB,CACF,EC7BO,SAASO,GAAoBC,EAKzB,CACT,GAAM,CAAE,MAAAC,EAAO,uBAAAC,EAAwB,UAAAC,CAAU,EAAIH,EAC/CI,EAAWJ,EAAO,SAAS,YAAY,EAE7C,GAAIC,GAAO,gBACT,OAAOI,EAAiBJ,EAAM,gBAAiB,uBAAuB,EAGxE,IAAMK,EAAWL,GAAO,mBAClBM,EAAUD,EAAWE,GAAYF,EAAUF,CAAQ,EAAI,OAC7D,GAAIG,EACF,OAAOF,EAAiBE,EAAS,4BAA4BH,CAAQ,GAAG,EAG1E,IAAMK,EAAaC,GAA8BN,CAAQ,EACzD,GAAIK,EACF,OAAOA,EAOT,GAJIR,GAAO,YAAc,IACvBU,EAAK,qBAAsB,yCAAyCP,CAAQ,EAAE,EAG5EF,EAAwB,CAC1B,IAAMU,EAA0BP,EAAiBH,EAAwB,iCAAiC,EAC1G,OAAAC,IAAY,CACV,KAAM,yBACN,QAAS,mDAAmDC,CAAQ,oDACpE,QAAS,CAAE,SAAAA,EAAU,aAAcQ,CAAwB,CAC7D,CAAC,EACMA,CACT,CAEAD,EAAK,qBAAsB,8DAA8DP,CAAQ,EAAE,CACrG,CAEA,SAASI,GAAYF,EAAkCF,EAAsC,CAC3F,OAAW,CAACS,EAAgBC,CAAG,IAAK,OAAO,QAAQR,CAAQ,EACzD,GAAIO,EAAe,YAAY,IAAMT,EACnC,OAAOU,CAIb,CC1CA,IAAMC,GAA8B,IAAS,IAE7C,eAAsBC,EAA0BC,EAAuE,CACrH,IAAMC,EAAUC,EAAaF,EAAO,KAAK,EACnCG,EAASC,EAAsBJ,CAAM,EACrCK,EAAML,EAAO,KAAO,KAAK,IACzBM,EAAWC,GAAiBJ,EAAO,eAAe,EAClDK,EAAW,MAAMC,GAAyB,CAC9C,sBAAuBT,EAAO,sBAC9B,SAAAM,EACA,MAAOL,EACP,UAAWD,EAAO,WAAa,GACjC,CAAC,EACDU,GAAgBF,EAAS,MAAOF,CAAQ,EAExC,GAAM,CAAE,sBAAAK,EAAuB,aAAAC,EAAc,UAAAC,CAAU,EAAIC,GAAgBN,EAAS,mBAAmB,EACjGO,EAAUC,GAAyBJ,CAAY,EAEjDG,EAAQ,WAAaT,GACvBW,EAAK,uBAAwB,gEAAiE,CAC5F,QAAS,CAAE,cAAeX,EAAU,aAAcS,EAAQ,QAAS,CACrE,CAAC,EAGH,IAAMG,EAAoBlB,EAAO,OAAO,mBAAqBF,GACvDqB,EAAQd,EAAI,EACd,KAAK,IAAIc,EAAQJ,EAAQ,WAAW,EAAIG,GAC1CD,EAAK,yBAA0B,sCAAsCC,CAAiB,KAAM,CAC1F,QAAS,CAAE,YAAaH,EAAQ,YAAa,MAAAI,EAAO,kBAAAD,CAAkB,CACxE,CAAC,EAGH,IAAME,EAAW,IAAI,IAAIpB,EAAO,qBAAqB,EAAE,SACjDqB,EAAeC,GAAoB,CACvC,MAAOtB,EAAO,MACd,SAAAoB,EACA,uBAAwBZ,EAAS,WAAW,aAC5C,UAAWR,EAAO,SACpB,CAAC,EACGe,EAAQ,UAAYM,GACtBJ,EAAK,oBAAqB,kDAAmD,CAC3E,QAAS,CAAE,aAAAI,EAAc,WAAYN,EAAQ,OAAQ,CACvD,CAAC,EAGH,GAAM,CAAE,cAAAQ,EAAc,EAAI,MAAMC,GAAuB,CACrD,mBAAoBT,EAAQ,eAC5B,YAAaA,EAAQ,YACrB,QAASf,EAAO,OAAO,gBACvB,MAAAmB,EACA,OAAQhB,EAAO,OACf,gBAAiBA,EAAO,gBACxB,UAAWH,EAAO,SACpB,CAAC,EACD,aAAMyB,GAAoB,CAAE,sBAAAd,EAAuB,aAAAC,EAAc,UAAAC,EAAW,cAAAU,GAAe,OAAQpB,EAAO,MAAO,CAAC,EAE3G,CACL,wBAAyB,CACvB,aAAcY,EAAQ,aACtB,mBAAoBW,EAClB,IAAI,WAAW,MAAMvB,EAAO,OAAO,OAAO,UAAWwB,EAAmBZ,EAAQ,YAAY,CAAC,CAAC,CAChG,CACF,EACA,QAAS,CACP,YAAaA,EAAQ,YACrB,QAASA,EAAQ,QACjB,QAASA,EAAQ,QACjB,QAASA,EAAQ,QACjB,QAASA,EAAQ,QACjB,SAAUA,EAAQ,SAClB,WAAYP,EAAS,UACvB,CACF,CACF,CCjFA,eAAsBoB,EACpBC,EACiB,CACjB,IAAMC,EAAW,MAAMC,EAA0B,CAC/C,sBAAuBF,EAAO,sBAC9B,MAAOA,EAAO,MACd,MAAOA,EAAO,MACd,OAAQA,EAAO,OACf,gBAAiBA,EAAO,gBACxB,IAAKA,EAAO,IACZ,UAAWA,EAAO,UAClB,UAAWA,EAAO,SACpB,CAAC,EACD,OAAOG,EAA+B,CACpC,GAAGH,EACH,IAAKC,EAAS,uBAChB,CAAC,CACH,CCjBA,eAAsBG,EACpBC,EACiB,CACjB,IAAMC,EAASC,EAAsBF,CAAM,EAC3C,OAAOG,GAAiD,CACtD,QAASH,EACT,OAAQC,EAAO,OACf,gBAAiBA,EAAO,eAC1B,CAAC,CACH,CCTA,eAAsBG,EACpBC,EACiB,CACjB,IAAMC,EAAW,MAAMC,EAA0B,CAC/C,sBAAuBF,EAAO,sBAC9B,MAAOA,EAAO,MACd,MAAOA,EAAO,MACd,OAAQA,EAAO,OACf,gBAAiBA,EAAO,gBACxB,IAAKA,EAAO,IACZ,UAAWA,EAAO,UAClB,UAAWA,EAAO,SACpB,CAAC,EACD,OAAOG,EAA+B,CACpC,IAAKF,EAAS,wBACd,SAAUD,EAAO,SACjB,WAAYA,EAAO,WACnB,gBAAiBA,EAAO,gBACxB,OAAQA,EAAO,OACf,gBAAiBA,EAAO,eAC1B,CAAC,CACH,CCrBA,eAAsBI,EAA8BC,EAA8D,CAChH,IAAMC,EAASC,EAAsBF,CAAM,EAC3C,OAAOG,GAAgD,CACrD,QAASH,EACT,OAAQC,EAAO,OACf,gBAAiBA,EAAO,gBACxB,IAAKD,EAAO,KAAO,KAAK,GAC1B,CAAC,CACH,CCRA,eAAsBI,EACpBC,EACiB,CACjB,GAAM,CAAE,sBAAAC,EAAuB,MAAAC,EAAO,MAAAC,EAAO,UAAAC,EAAW,UAAAC,EAAW,GAAGC,CAAc,EAAIN,EAClFO,EAAW,MAAMC,EAA0B,CAC/C,sBAAAP,EACA,MAAAC,EACA,MAAAC,EACA,OAAQH,EAAO,OACf,gBAAiBA,EAAO,gBACxB,IAAKA,EAAO,IACZ,UAAAI,EACA,UAAAC,CACF,CAAC,EACD,OAAOI,EAA8B,CACnC,GAAGH,EACH,IAAKC,EAAS,uBAChB,CAAC,CACH,CCtBA,IAAAG,GAA2B,kBAGpB,SAASC,GAA+BC,EAA+B,CAC5E,GAAI,CACF,SAAO,eAAWA,CAAa,CACjC,OAASC,EAAO,CACdC,EAAK,oBAAqB,iDAAkD,CAAE,MAAAD,CAAM,CAAC,CACvF,CACF,CCEA,IAAME,GAAkC,IAExC,eAAsBC,EAA2BC,EAOlC,CACb,IAAMC,EAAUC,EAAaF,EAAO,KAAK,EACnCG,EAAYH,EAAO,WAAa,IAChCI,EAAa,IAAI,gBACnBC,EACEC,EAAiB,IAAI,QAAe,CAACC,EAAGC,IAAW,CACvDH,EAAgB,WAAW,IAAM,CAC/BD,EAAW,MAAM,EACjBI,EAAO,IAAI,MAAM,SAAS,CAAC,CAC7B,EAAGL,CAAS,CACd,CAAC,EACGM,EACAC,EACJ,GAAI,CACFD,EAAW,MAAM,QAAQ,KAAK,CAC5BR,EAAQU,GAAgBX,EAAO,sBAAuBA,EAAO,IAAI,EAAG,CAClE,OAAQ,OACR,QAAS,CACP,OAAQ,mBACR,eAAgB,kBAClB,EACA,KAAM,KAAK,UAAUA,EAAO,IAAI,EAChC,OAAQI,EAAW,MACrB,CAAC,EACDE,CACF,CAAC,EACDI,EAAe,MAAM,QAAQ,KAAK,CAACD,EAAS,KAAK,EAAGH,CAAc,CAAC,CACrE,OAASM,EAAO,CACVR,EAAW,OAAO,SACpBS,EAAK,UAAW,GAAGb,EAAO,cAAc,oBAAoBG,CAAS,KAAM,CAAE,MAAAS,CAAM,CAAC,EAEtFC,EAAK,2BAA4B,GAAGb,EAAO,cAAc,+BAAgC,CAAE,MAAAY,CAAM,CAAC,CACpG,QAAE,CACA,aAAaP,CAAa,CAC5B,CAEA,GAAI,CAACI,EAAS,GAAI,CAChB,IAAMK,EAAWC,GAA6BL,CAAY,EACtDI,GAAU,UAAY,IACxBE,GAAgChB,EAAO,eAAgBS,EAAS,OAAQK,CAAQ,EAGlFD,EAAK,2BAA4B,GAAGb,EAAO,cAAc,qBAAqBS,EAAS,MAAM,GAAI,CAC/F,QAAS,CAAE,OAAQA,EAAS,OAAQ,KAAMC,EAAa,MAAM,EAAG,GAAG,CAAE,CACvE,CAAC,CACH,CAEA,IAAII,EACJ,GAAI,CACFA,EAAW,KAAK,MAAMJ,CAAY,CACpC,OAASE,EAAO,CACdC,EAAK,+BAAgC,GAAGb,EAAO,cAAc,uCAAwC,CAAE,MAAAY,CAAM,CAAC,CAChH,CAEA,OAAIE,EAAS,UAAY,KACnBA,EAAS,UAAY,IACvBE,GAAgChB,EAAO,eAAgBS,EAAS,OAAQK,CAAQ,EAGlFD,EAAK,+BAAgC,GAAGb,EAAO,cAAc,2CAA2C,GAGrGiB,GAASH,EAAS,cAAc,GACnCD,EAAK,+BAAgC,GAAGb,EAAO,cAAc,qDAAsD,CACjH,QAAS,CACP,OAAQS,EAAS,OACjB,gBAAiBS,GAAsBJ,CAAQ,CACjD,CACF,CAAC,EAGIA,EAAS,cAClB,CAEA,SAASC,GAA6BL,EAAoE,CACxG,GAAI,CACF,OAAO,KAAK,MAAMA,CAAY,CAChC,MAAQ,CACN,MACF,CACF,CAEA,SAASM,GACPG,EACAC,EACAN,EACO,CACP,IAAMO,EAA4C,CAChD,OAAAD,EACA,WAAYN,EAAS,WACrB,QAASA,EAAS,QAClB,eAAgBA,EAAS,cAC3B,EAEAD,EAAK,yBAA0B,GAAGM,CAAc,4CAA6C,CAAE,QAAAE,CAAQ,CAAC,CAC1G,CAEA,SAASJ,GAASK,EAAkD,CAClE,OAAO,OAAOA,GAAU,UAAYA,IAAU,MAAQ,CAAC,MAAM,QAAQA,CAAK,CAC5E,CAEA,SAASJ,GAAsBJ,EAAoD,CACjF,OAAO,KAAK,UAAUA,CAAQ,EAAE,MAAM,EAAGhB,EAA+B,CAC1E,CAEA,SAASa,GAAgBY,EAA+BC,EAAsB,CAC5E,IAAMC,EAAM,IAAI,IAAIF,CAAqB,EACzC,OAAAE,EAAI,SAAW,GAAGA,EAAI,SAAS,QAAQ,QAAS,EAAE,CAAC,GAAGD,CAAI,GAC1DC,EAAI,OAAS,GACNA,EAAI,SAAS,CACtB,CCzHA,eAAsBC,EACpBC,EAC0C,CAC1C,IAAMC,EAAgBC,GAA+BF,EAAO,aAAa,EACnEG,EAA2B,MAAMC,EAAuC,CAC5E,sBAAuBJ,EAAO,sBAC9B,MAAOA,EAAO,MACd,MAAOA,EAAO,MACd,OAAQA,EAAO,OACf,gBAAiBA,EAAO,gBACxB,IAAKA,EAAO,IACZ,UAAWA,EAAO,UAClB,UAAWA,EAAO,UAClB,SAAUA,EAAO,SACjB,WAAYA,EAAO,WACnB,gBAAiBA,EAAO,eAC1B,CAAC,EAED,OAAOK,EAAyD,CAC9D,sBAAuBL,EAAO,sBAC9B,KAAM,YACN,MAAOA,EAAO,MACd,eAAgB,iBAChB,UAAWA,EAAO,UAClB,KAAM,CACJ,SAAUA,EAAO,SACjB,WAAYA,EAAO,WACnB,cAAAC,EACA,yBAAAE,EACA,OAAQH,EAAO,MACjB,CACF,CAAC,CACH,CCrCA,eAAsBM,EAAuBC,EAAuE,CAClH,IAAMC,EAAkB,MAAMC,EAAsCF,CAAM,EAE1E,OAAOG,EAAgD,CACrD,sBAAuBH,EAAO,sBAC9B,KAAM,uBAAuB,mBAAmBA,EAAO,QAAQ,CAAC,GAChE,MAAOA,EAAO,MACd,eAAgB,2BAChB,UAAWA,EAAO,UAClB,KAAM,CAAE,gBAAAC,CAAgB,CAC1B,CAAC,CACH,CCPA,eAAsBG,EACpBC,EAC0C,CAC1C,IAAMC,EAA2B,MAAMC,EAAuCF,CAAM,EAEpF,OAAOG,EAAyD,CAC9D,sBAAuBH,EAAO,sBAC9B,KAAM,iBAAiB,mBAAmBA,EAAO,QAAQ,CAAC,IAAI,mBAAmBA,EAAO,UAAU,CAAC,GACnG,MAAOA,EAAO,MACd,eAAgB,qBAChB,UAAWA,EAAO,UAClB,KAAM,CACJ,yBAAAC,EACA,OAAQD,EAAO,OACf,QAASA,EAAO,QAChB,OAAQA,EAAO,MACjB,CACF,CAAC,CACH,CCFO,SAASI,GAA6BC,EAAgE,CAC3G,IAAMC,EAAsBC,GAA2BF,EAAQ,WAAW,EACpEG,EAAUH,EAAQ,uBAAyBC,EAAoB,sBAC/DG,EAAYC,EAAW,CAAE,UAAW,EAAK,EAAGL,EAAQ,KAAK,EAE/D,MAAO,CACL,uCAAyCM,GAAW,CAClD,GAAM,CACJ,sBAAAC,EACA,MAAAC,EACA,MAAAC,EACA,OAAAC,EACA,gBAAAC,EACA,IAAAC,EACA,UAAAC,EACA,UAAAC,EACA,GAAGC,CACL,EAAIT,EAEJ,OAAOU,EAA2C,CAChD,GAAGD,EACH,sBAAuBR,GAAyBJ,EAChD,MAAOE,EAAWD,EAAWI,CAAK,EAClC,MAAOC,GAAST,EAAQ,MACxB,OAAQU,GAAUV,EAAQ,OAC1B,gBAAiBW,GAAmBX,EAAQ,gBAC5C,IAAKY,GAAOZ,EAAQ,IACpB,UAAWa,GAAab,EAAQ,UAChC,UAAWc,GAAad,EAAQ,SAClC,CAAC,CACH,EACA,uCAAyCM,GAAW,CAClD,GAAM,CACJ,sBAAAC,EACA,MAAAC,EACA,MAAAC,EACA,OAAAC,EACA,gBAAAC,EACA,IAAAC,EACA,UAAAC,EACA,UAAAC,EACA,GAAGC,CACL,EAAIT,EAEJ,OAAOW,EAA2C,CAChD,GAAGF,EACH,sBAAuBR,GAAyBJ,EAChD,MAAOE,EAAWD,EAAWI,CAAK,EAClC,MAAOC,GAAST,EAAQ,MACxB,OAAQU,GAAUV,EAAQ,OAC1B,gBAAiBW,GAAmBX,EAAQ,gBAC5C,IAAKY,GAAOZ,EAAQ,IACpB,UAAWa,GAAab,EAAQ,UAChC,UAAWc,GAAad,EAAQ,SAClC,CAAC,CACH,EACA,sCAAwCM,GAAW,CACjD,GAAM,CACJ,sBAAAC,EACA,MAAAC,EACA,MAAAC,EACA,OAAAC,EACA,gBAAAC,EACA,IAAAC,EACA,UAAAC,EACA,UAAAC,EACA,GAAGI,CACL,EAAIZ,EAEJ,OAAOa,EAA0C,CAC/C,GAAGD,EACH,sBAAuBX,GAAyBJ,EAChD,MAAOE,EAAWD,EAAWI,CAAK,EAClC,MAAOC,GAAST,EAAQ,MACxB,OAAQU,GAAUV,EAAQ,OAC1B,gBAAiBW,GAAmBX,EAAQ,gBAC5C,IAAKY,GAAOZ,EAAQ,IACpB,UAAWa,GAAab,EAAQ,UAChC,UAAWc,GAAad,EAAQ,SAClC,CAAC,CACH,EACA,2BACEM,GAIOc,EAAkC,CACvC,sBAAuBd,EAAO,uBAAyBH,EACvD,MAAOE,EAAWD,EAAWE,EAAO,KAAK,EACzC,MAAOA,EAAO,OAASN,EAAQ,MAC/B,OAAQM,EAAO,QAAUN,EAAQ,OACjC,gBAAiBM,EAAO,iBAAmBN,EAAQ,gBACnD,IAAKM,EAAO,KAAON,EAAQ,IAC3B,UAAWM,EAAO,WAAaN,EAAQ,UACvC,UAAWM,EAAO,WAAaN,EAAQ,UACvC,SAAUM,EAAO,SACjB,WAAYA,EAAO,WACnB,cAAeA,EAAO,cACtB,gBAAiBA,EAAO,gBACxB,OAAQA,EAAO,MACjB,CAAC,EAEH,uBAAyBA,GAAW,CAClC,GAAM,CACJ,sBAAAC,EACA,MAAAC,EACA,MAAAC,EACA,OAAAC,EACA,gBAAAC,EACA,IAAAC,EACA,UAAAC,EACA,UAAAC,EACA,GAAGI,CACL,EAAIZ,EAEJ,OAAOe,EAA2B,CAChC,GAAGH,EACH,sBAAuBX,GAAyBJ,EAChD,MAAOE,EAAWD,EAAWI,CAAK,EAClC,MAAOC,GAAST,EAAQ,MACxB,OAAQU,GAAUV,EAAQ,OAC1B,gBAAiBW,GAAmBX,EAAQ,gBAC5C,IAAKY,GAAOZ,EAAQ,IACpB,UAAWa,GAAab,EAAQ,UAChC,UAAWc,GAAad,EAAQ,SAClC,CAAC,CACH,EACA,sBACEM,GAC6C,CAC7C,IAAMgB,EAAe,CACnB,sBAAuBhB,EAAO,uBAAyBH,EACvD,MAAOE,EAAWD,EAAWE,EAAO,KAAK,EACzC,MAAOA,EAAO,OAASN,EAAQ,MAC/B,OAAQM,EAAO,QAAUN,EAAQ,OACjC,gBAAiBM,EAAO,iBAAmBN,EAAQ,gBACnD,IAAKM,EAAO,KAAON,EAAQ,IAC3B,UAAWM,EAAO,WAAaN,EAAQ,UACvC,UAAWM,EAAO,WAAaN,EAAQ,UACvC,SAAUM,EAAO,SACjB,WAAYA,EAAO,WACnB,gBAAiBA,EAAO,gBACxB,OAAQA,EAAO,OACf,QAASA,EAAO,QAChB,OAAQA,EAAO,MACjB,EAEA,OAAOiB,EAA6BD,CAAY,CAClD,EACA,0BAA2B,CAAChB,EAAS,CAAC,IACpCkB,EAA8B,CAC5B,sBAAuBlB,EAAO,uBAAyBH,EACvD,MAAOE,EAAWD,EAAWE,EAAO,KAAK,EACzC,MAAOA,EAAO,OAASN,EAAQ,MAC/B,OAAQM,EAAO,QAAUN,EAAQ,OACjC,gBAAiBM,EAAO,iBAAmBN,EAAQ,gBACnD,IAAKM,EAAO,KAAON,EAAQ,IAC3B,UAAWM,EAAO,WAAaN,EAAQ,UACvC,UAAWM,EAAO,WAAaN,EAAQ,SACzC,CAAC,EACH,+BAAgC,CAAC,CAAE,OAAAU,EAAQ,gBAAAC,EAAiB,GAAGL,CAAO,IACpEmB,EAAmC,CACjC,GAAGnB,EACH,OAAQI,GAAUV,EAAQ,OAC1B,gBAAiBW,GAAmBX,EAAQ,eAC9C,CAAC,EACH,+BAAgC,CAAC,CAAE,OAAAU,EAAQ,gBAAAC,EAAiB,GAAGL,CAAO,IACpEoB,EAAmC,CACjC,GAAGpB,EACH,OAAQI,GAAUV,EAAQ,OAC1B,gBAAiBW,GAAmBX,EAAQ,eAC9C,CAAC,EACH,8BAA+B,CAAC,CAAE,OAAAU,EAAQ,gBAAAC,EAAiB,IAAAC,EAAK,GAAGN,CAAO,IACxEqB,EAAkC,CAChC,GAAGrB,EACH,OAAQI,GAAUV,EAAQ,OAC1B,gBAAiBW,GAAmBX,EAAQ,gBAC5C,IAAKY,GAAOZ,EAAQ,GACtB,CAAC,CACL,CACF,CAEA,SAASK,EAAWuB,EAAiBC,EAA4C,CAC/E,OAAKA,EAGE,CACL,GAAGD,EACH,GAAGC,EACH,mBAAoB,CAClB,GAAGD,EAAK,mBACR,GAAGC,EAAS,kBACd,CACF,EATSD,CAUX,CC1NA,IAAAE,EAA8G,kBAKvG,IAAMC,GAAkC,CAC7C,KAAM,yBACN,QAAS,GACX,EAEaC,GAA2D,CACtE,mBAAoB,CAClB,CAAE,KAAM,aAAc,KAAM,SAAU,EACtC,CAAE,KAAM,gBAAiB,KAAM,SAAU,EACzC,CAAE,KAAM,WAAY,KAAM,SAAU,CACtC,CACF,EAEaC,GACX,gFACWC,GAA+BC,EAASF,EAA8B,EAGtEG,GAAkB,CAC7B,KAAM,wBACN,QAAS,GACX,EAEaC,GAA4D,CACvE,oBAAqB,CACnB,CAAE,KAAM,SAAU,KAAM,SAAU,EAClC,CAAE,KAAM,aAAc,KAAM,SAAU,EACtC,CAAE,KAAM,gBAAiB,KAAM,SAAU,EACzC,CAAE,KAAM,cAAe,KAAM,SAAU,EACvC,CAAE,KAAM,WAAY,KAAM,SAAU,EACpC,CAAE,KAAM,WAAY,KAAM,SAAU,EACpC,CAAE,KAAM,aAAc,KAAM,SAAU,CACxC,CACF,EAEaC,GACX,wJACWC,GAAgCJ,EAASG,EAA+B,EACxEE,GAA4B,mBAAiB,WAAWJ,EAAe,EAAE,YAAY,EAGrFK,GAAkC,CAC7C,KAAM,iCACN,QAAS,GACX,EAEaC,GAAgE,CAC3E,uBAAwB,CACtB,CAAE,KAAM,WAAY,KAAM,QAAS,EACnC,CAAE,KAAM,cAAe,KAAM,SAAU,EACvC,CAAE,KAAM,oBAAqB,KAAM,SAAU,EAC7C,CAAE,KAAM,uBAAwB,KAAM,SAAU,EAChD,CAAE,KAAM,YAAa,KAAM,SAAU,EACrC,CAAE,KAAM,iBAAkB,KAAM,QAAS,EACzC,CAAE,KAAM,wBAAyB,KAAM,QAAS,EAChD,CAAE,KAAM,sBAAuB,KAAM,QAAS,CAChD,CACF,EAEO,SAASC,GAAgCC,EAAsC,CACpF,MAAO,CACL,GAAGb,GACH,QAASa,EAAO,QAChB,qBAAmB,cAAWA,EAAO,iBAAiB,CACxD,CACF,CAEO,SAASC,EAAyCD,EAA8C,CACrG,OAAO,mBAAiB,WAAWD,GAAgCC,CAAM,CAAC,EAAE,YAAY,CAC1F,CAEO,SAAST,EAASW,EAAuB,CAC9C,SAAO,gBAAU,eAAYA,CAAK,CAAC,EAAE,YAAY,CACnD,CAEO,SAASC,GAAaC,EAAqB,CAChD,SAAO,aAAUA,CAAG,EAAE,YAAY,CACpC,CAEO,SAASC,GAAiCL,EAKtC,CACT,GAAI,CACF,IAAMM,EAAa,mBAAiB,KAAKN,EAAO,KAAK,EAAE,KAAKA,EAAO,KAAK,EAClEO,KAAS,gBAAU,UAAO,CAAC,SAAUP,EAAO,gBAAiBM,CAAU,CAAC,CAAC,EAC/E,OAAOE,KAAiB,kBAAeD,EAAQP,EAAO,SAAS,CAAC,CAClE,OAASS,EAAO,CACdC,EAAK,gCAAiC,sDAAuD,CAAE,MAAAD,CAAM,CAAC,CACxG,CACF,CAEO,SAASE,GAA6BX,EAKlC,CACT,GAAI,CACF,OAAOQ,KAAiB,mBAAgBR,EAAO,OAAQA,EAAO,MAAOA,EAAO,MAAOA,EAAO,SAAS,CAAC,CACtG,OAASS,EAAO,CACdC,EAAK,gCAAiC,yCAA0C,CAAE,MAAAD,CAAM,CAAC,CAC3F,CACF,CAEO,SAASG,GAAoBC,EAAyBC,EAA2C,CACtG,IAAMC,EAAYP,EAAiBK,CAAe,EAC5CG,EAA2B,IAAI,IAAIF,EAAe,IAAKG,GAAWT,EAAiBS,CAAM,CAAC,CAAC,EACjG,OAAKD,EAAyB,IAAID,CAAS,GACzCL,EAAK,qBAAsB,4CAA6C,CACtE,QAAS,CAAE,gBAAiBK,EAAW,eAAgB,MAAM,KAAKC,CAAwB,CAAE,CAC9F,CAAC,EAEID,CACT,CAEO,SAASG,GAA2BlB,EAIhC,CACT,IAAMe,EAAYH,GAAoBZ,EAAO,gBAAiBA,EAAO,cAAc,EAC7EmB,EAAgBX,EAAiBR,EAAO,aAAa,EAC3D,OAAImB,IAAkBJ,GACpBL,EAAK,gCAAiC,qDAAsD,CAC1F,QAAS,CAAE,cAAAS,EAAe,gBAAiBJ,CAAU,CACvD,CAAC,EAEIA,CACT,CAEO,SAASK,EAAwBC,EAAgBC,EAAkBC,EAAqB,CACzFF,EAAO,YAAY,IAAMC,EAAS,YAAY,GAChDZ,EAAK,+BAAgC,GAAGa,CAAK,gCAAiC,CAC5E,QAAS,CAAE,OAAAF,EAAQ,SAAAC,CAAS,CAC9B,CAAC,CAEL,CAEO,SAASE,GAAmBH,EAAgBC,EAAkBC,EAAqB,CACxF,IAAIE,EACAC,EACJ,GAAI,CACFD,EAAmBjB,EAAiBa,CAAM,EAC1CK,EAAqBlB,EAAiBc,CAAQ,CAChD,OAASb,EAAO,CACdC,EAAK,oBAAqB,GAAGa,CAAK,oCAAqC,CAAE,MAAAd,CAAM,CAAC,CAClF,CAEIgB,IAAqBC,GACvBhB,EAAK,+BAAgC,GAAGa,CAAK,gCAAiC,CAC5E,QAAS,CAAE,OAAAF,EAAQ,SAAAC,CAAS,CAC9B,CAAC,CAEL,CAEO,SAASK,EAAkBN,EAAgBC,EAAkBC,EAAqB,CACnFF,IAAWC,GACbZ,EAAK,+BAAgC,GAAGa,CAAK,gCAAiC,CAC5E,QAAS,CAAE,OAAAF,EAAQ,SAAAC,CAAS,CAC9B,CAAC,CAEL,CAEO,SAASM,GACdP,EACAC,EACM,CACF,KAAK,UAAUD,CAAM,IAAM,KAAK,UAAUC,CAAQ,GACpDZ,EAAK,+BAAgC,8DAA8D,CAEvG,CAEO,SAASmB,EAAsB3B,EAA2BqB,EAAuB,CACtF,OAAI,OAAOrB,GAAU,UACnBQ,EAAK,oBAAqB,GAAGa,CAAK,cAAc,EAE3CrB,CACT,CAEA,SAASM,EAAiBsB,EAAyB,CACjD,SAAO,cAAWA,CAAO,EAAE,YAAY,CACzC,CC3KO,SAASC,GACdC,EACAC,EACiC,CACjCC,EAAkBF,EAAQ,SAAUC,EAAQ,iBAAkB,UAAU,EACxEC,EAAkBF,EAAQ,WAAYC,EAAQ,mBAAoB,YAAY,EAC9EC,EAAkBF,EAAQ,cAAc,YAAa,qBAAsB,2BAA2B,EACtGG,GAA0BH,EAAQ,cAAc,MAAOI,EAAyB,EAChFC,EAAwBL,EAAQ,SAAUM,GAA8B,UAAU,EAClFD,EACEL,EAAQ,gBACRO,EAAyCN,EAAQ,cAAc,EAC/D,iBACF,EAIAI,EACEG,GAAaR,EAAQ,qBAAqB,EAC1CA,EAAQ,eAAe,SACvB,uBACF,EACAK,EACEL,EAAQ,eAAe,WACvBS,EAAsBR,EAAQ,mBAAoB,oBAAoB,EACtE,2BACF,EAEA,IAAMS,EAAkBC,GAAiC,CACvD,gBAAiBX,EAAQ,gBACzB,MAAOI,GACP,MAAO,CAAE,GAAGJ,EAAQ,cAAe,EACnC,UAAWA,EAAQ,SACrB,CAAC,EACD,OAAAY,GAA2B,CACzB,cAAeZ,EAAQ,OACvB,gBAAAU,EACA,eAAgBT,EAAQ,cAC1B,CAAC,EAEMD,CACT,CCrCA,IAAMa,GAAiC,CAAC,WAAY,aAAc,UAAW,WAAY,UAAU,EAE5F,SAASC,GACdC,EACAC,EAC8B,CAC9BC,EAAkBF,EAAQ,SAAUC,EAAQ,iBAAkB,UAAU,EACxEC,EAAkBF,EAAQ,WAAYC,EAAQ,mBAAoB,YAAY,EAC9EC,EAAkBF,EAAQ,SAAS,SAAUA,EAAQ,SAAU,mBAAmB,EAClFE,EAAkBF,EAAQ,SAAS,WAAYA,EAAQ,WAAY,qBAAqB,EACxFE,EAAkBF,EAAQ,cAAc,YAAa,sBAAuB,2BAA2B,EACvGG,GAA0BH,EAAQ,cAAc,MAAOI,EAA0B,EACjFC,EAAwBL,EAAQ,gBAAiBM,GAA2B,iBAAiB,EAC7FD,EAAwBL,EAAQ,SAAUO,GAA+B,UAAU,EACnFF,EAAwBL,EAAQ,SAAS,OAAQQ,EAASR,EAAQ,SAAS,QAAQ,EAAG,iBAAiB,EAGvGK,EAAwBL,EAAQ,SAAS,YAAaQ,EAASR,EAAQ,SAAS,OAAO,EAAG,sBAAsB,EAChHK,EAAwBL,EAAQ,eAAe,OAAQA,EAAQ,SAAS,OAAQ,uBAAuB,EACvGK,EACEL,EAAQ,eAAe,WACvBQ,EAASR,EAAQ,SAAS,UAAU,EACpC,2BACF,EACAS,GACET,EAAQ,eAAe,cACvBU,EAAsBT,EAAQ,sBAAuB,uBAAuB,EAC5E,8BACF,EACAI,EACEL,EAAQ,eAAe,YACvBA,EAAQ,SAAS,YACjB,4BACF,EACAK,EACEL,EAAQ,eAAe,YACvBU,EAAsBT,EAAQ,oBAAqB,qBAAqB,EACxE,4BACF,EACAI,EACEL,EAAQ,eAAe,SACvBW,GAAiBX,EAAQ,QAAQ,EACjC,yBACF,EACAY,GAAiBZ,EAAQ,eAAe,WAAYC,EAAQ,KAAO,KAAK,GAAG,EAE3E,IAAMY,EAAkBC,GAA6B,CACnD,OAAQC,GACR,MAAOX,GACP,MAAO,CAAE,GAAGJ,EAAQ,cAAe,EACnC,UAAWA,EAAQ,SACrB,CAAC,EACD,OAAAgB,GAA2B,CACzB,cAAehB,EAAQ,OACvB,gBAAAa,EACA,eAAgBZ,EAAQ,cAC1B,CAAC,EAEMD,EAAQ,QACjB,CAEA,SAASW,GAAiBM,EAA4C,CACpE,IAAMC,EAAkB,CACtB,SAAUD,EAAQ,SAClB,WAAYA,EAAQ,WACpB,QAASA,EAAQ,QACjB,SAAUA,EAAQ,SAClB,SAAUE,GAAaF,EAAQ,QAAQ,CACzC,EACMG,EAAY,KAAK,UACrB,OAAO,YAAYtB,GAA+B,IAAKuB,GAAU,CAACA,EAAOH,EAAgBG,CAAK,CAAC,CAAC,CAAC,CACnG,EAEA,OAAOb,EAASY,CAAS,CAC3B,CAEA,SAASD,GAAaG,EAA0D,CAC9E,OAAO,OAAO,YAAY,OAAO,QAAQA,CAAQ,EAAE,KAAK,CAAC,CAACC,CAAI,EAAG,CAACC,CAAK,IAAMD,EAAK,cAAcC,CAAK,CAAC,CAAC,CACzG,CAEA,SAASZ,GAAiBa,EAAoBC,EAAyB,CACrE,IAAMC,EAAQD,EAAI,EACd,OAAOC,CAAK,EAAI,OAAOF,CAAU,GACnCG,EAAK,sBAAuB,iDAAkD,CAC5E,QAAS,CAAE,WAAAH,EAAY,MAAAE,CAAM,CAC/B,CAAC,CAEL,CC5FO,SAASE,GACdC,EACAC,EAC8B,CAC9BC,EAAkBF,EAAO,SAAUC,EAAQ,iBAAkB,UAAU,EACvEE,EACEH,EAAO,YACPI,EAAsBH,EAAQ,oBAAqB,qBAAqB,EACxE,aACF,EACAI,GAA2BL,EAAO,oBAAqBC,EAAQ,KAAO,KAAK,GAAG,EAE9E,IAAMK,EAAkBC,GAA6B,CACnD,OAAQC,GACR,MAAOC,GACP,MAAOC,GAAiCV,CAAM,EAC9C,UAAWA,EAAO,eACpB,CAAC,EACD,OAAAW,GAAoBL,EAAiBL,EAAQ,cAAc,EAEpDD,CACT,CAEA,SAASU,GAAiCV,EAAmE,CAC3G,MAAO,CACL,SAAUA,EAAO,SACjB,YAAaA,EAAO,YACpB,kBAAmBY,EAASZ,EAAO,aAAa,EAChD,qBAAsBY,EAASZ,EAAO,gBAAgB,EACtD,UAAWY,EAASZ,EAAO,KAAK,EAChC,eAAgBA,EAAO,eACvB,sBAAuBA,EAAO,sBAC9B,oBAAqBA,EAAO,qBAAuB,EACrD,CACF,CAEA,SAASK,GAA2BQ,EAAoCC,EAAyB,CAC/F,IAAMC,EAAQD,EAAI,EACdD,IAAwB,MAAQ,OAAOE,CAAK,EAAI,OAAOF,CAAmB,GAC5EG,EAAK,sBAAuB,8DAA+D,CACzF,QAAS,CAAE,oBAAAH,EAAqB,MAAAE,CAAM,CACxC,CAAC,CAEL","names":["src_exports","__export","AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX","AWS_NITRO_ROOT_PEM","NitroAttestationError","createEncryptedBuyerTeeSessionMaterial","createEncryptedIdentitySessionMaterial","createEncryptedSellerCredentialUpload","createNitroAttestationClient","encryptBuyerTeeSessionMaterial","encryptIdentitySessionMaterial","encryptSellerCredentialUpload","fetchAndVerifyAttestation","getUnifiedPaymentVerifierDomainSeparator","hashUtf8","requestIdentityAttestation","uploadSellerCredential","verifyBuyerTeePayment","verifyBuyerTeePaymentAttestation","verifyIdentityAttestation","verifySellerCredentialBundle","__toCommonJS","NitroAttestationError","code","message","options","fail","wrapCryptoFailure","promise","cause","resolveFetch","fetchOverride","fail","resolveSubtle","subtleOverride","subtle","resolveGetRandomValues","getRandomValuesOverride","cryptoRef","out","resolveCryptoProvider","params","asCrypto","getRandomValues","randomUuidV4","bytes","hex","byte","BASE64_ALPHABET","BASE64_LOOKUP","buildLookup","alphabet","lookup","index","bytesToHex","bytes","out","byte","utf8Encode","value","bytes","index","codePoint","utf8Decode","out","first","base64Encode","second","third","triplet","BASE64_ALPHABET","base64Decode","decodeBase64","base64UrlEncode","decodeBase64","value","urlSafe","stripped","normalized","padded","bytes","index","chars","pad","a","lookupBase64","BASE64_LOOKUP","b","c","d","triplet","char","lookup","concatBytes","parts","total","sum","part","out","offset","bytesToArrayBuffer","bytes","buildSellerCredentialUploadPlaintext","params","plaintext","buildBuyerTeeSessionMaterialPlaintext","buildIdentitySessionMaterialPlaintext","stringifyUploadPlaintext","JWE_PROTECTED_HEADER","JWE_ID_PATTERN","encryptSellerCredentialUploadWithResolvedCrypto","params","issuedAtMs","jweId","randomUuidV4","assertJweId","encryptKeyBoundPlaintextWithResolvedCrypto","buildSellerCredentialUploadPlaintext","encryptBuyerTeeSessionMaterialWithResolvedCrypto","buildBuyerTeeSessionMaterialPlaintext","encryptIdentitySessionMaterialWithResolvedCrypto","buildIdentitySessionMaterialPlaintext","plaintext","utf8Encode","stringifyUploadPlaintext","cek","rsaKey","wrapCryptoFailure","bytesToArrayBuffer","encryptedKey","iv","protectedHeader","base64UrlEncode","aad","aesKey","encryptedPlaintext","ciphertext","tag","fail","getRandomValues","bytes","hex","byte","encryptBuyerTeeSessionMaterial","params","crypto","resolveCryptoProvider","encryptBuyerTeeSessionMaterialWithResolvedCrypto","import_x509","AWS_NITRO_ROOT_PEM","AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX","CERT_EXPIRY_WARNING_WINDOW_MS","verifyCertificateChain","params","crypto","asCrypto","rootCertificate","parseCertificate","AWS_NITRO_ROOT_PEM","rootFingerprint","certificateSha256","AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX","fail","leafCertificate","cabundle","der","index","allCertificates","certificate","assertCertificateTimeValid","warnNearExpiry","leafFingerprint","intermediates","fingerprint","candidates","candidate","verifyChainLinks","leafPublicKey","wrapCryptoFailure","chain","subject","issuer","raw","label","cause","subtle","bytesToHex","nowMs","onWarning","decodeCbor","bytes","reader","CborReader","value","encodeCbor","encodeTypeAndLength","encoded","utf8Encode","concatBytes","k","v","encodeCoseSigStructure1","protectedHeadersBytes","payloadBytes","majorType","length","bigintLength","head","additional","utf8Decode","out","index","chunks","chunk","key","decodeCoseSign1","attestationDocument","untagged","decoded","decodeCbor","cause","fail","protectedHeadersBytes","unprotectedHeaders","payloadBytes","signature","assertProtectedHeader","verifyCoseSignature","params","sigStructure","encodeCoseSigStructure1","wrapCryptoFailure","PCR8_HEX_LENGTH","normalizePcr8Pin","value","label","normalized","fail","parseAdvertisedPcr8","MAX_ATTESTATION_RESPONSE_BYTES","NETWORK_LAYER_FETCH_ATTEMPTS","NETWORK_LAYER_RETRY_DELAY_MS","ETH_ADDRESS_PATTERN","buildAttestationUrl","attestationServiceUrl","nonceHex","url","strippedPath","fetchAttestationEnvelope","params","response","fetchWithNetworkRetry","responseText","readResponseText","fail","body","cause","validateAttestationEnvelope","isRecord","responseObject","attestationDocument","base64Decode","parseOptionalAddress","parseOptionalAdvertisedPcr8","assertResponseSize","utf8Encode","reader","chunks","totalBytes","done","value","utf8Decode","concatBytes","label","parseAdvertisedPcr8","fetcher","timeoutMs","attempt","fetchWithTimeout","isNetworkLayerFetchFailure","sleep","controller","timeoutHandle","timeoutPromise","_","reject","NitroAttestationError","ms","resolve","NONCE_BYTE_LENGTH","generateNonceHex","getRandomValues","bytesToHex","assertNonceEcho","echoedNonce","expectedNonce","fail","decodeAttestationPayload","payloadBytes","decoded","decodeCbor","cause","fail","payload","requireMap","pcrs","userData","requireBytes","requireTimestamp","utf8Decode","optionalPcrHex","bytesToHex","requireArray","entry","index","value","label","STAGING_ATTESTATION_SERVICE_URL","PRODUCTION_ATTESTATION_SERVICE_URL","STAGING_PCR8","PRODUCTION_PCR8","PREPROD_PCR8","DEFAULT_EXPECTED_PCR8_BY_HOST","normalizePcr8Pin","DEFAULT_ENVIRONMENT_CONFIG","STAGING_ATTESTATION_SERVICE_URL","PRODUCTION_ATTESTATION_SERVICE_URL","resolveExpectedPcr8","params","trust","advertisedExpectedPcr8","onWarning","hostname","normalizePcr8Pin","hostPins","hostPin","findHostPin","bundledPin","DEFAULT_EXPECTED_PCR8_BY_HOST","fail","normalizedAdvertisedPin","configuredHost","pin","DEFAULT_FRESHNESS_WINDOW_MS","fetchAndVerifyAttestation","params","fetcher","resolveFetch","crypto","resolveCryptoProvider","now","nonceHex","generateNonceHex","response","fetchAttestationEnvelope","assertNonceEcho","protectedHeadersBytes","payloadBytes","signature","decodeCoseSign1","payload","decodeAttestationPayload","fail","freshnessWindowMs","nowMs","hostname","expectedPcr8","resolveExpectedPcr8","leafPublicKey","verifyCertificateChain","verifyCoseSignature","bytesToHex","bytesToArrayBuffer","createEncryptedBuyerTeeSessionMaterial","params","verified","fetchAndVerifyAttestation","encryptBuyerTeeSessionMaterial","encryptIdentitySessionMaterial","params","crypto","resolveCryptoProvider","encryptIdentitySessionMaterialWithResolvedCrypto","createEncryptedIdentitySessionMaterial","params","verified","fetchAndVerifyAttestation","encryptIdentitySessionMaterial","encryptSellerCredentialUpload","params","crypto","resolveCryptoProvider","encryptSellerCredentialUploadWithResolvedCrypto","createEncryptedSellerCredentialUpload","params","attestationServiceUrl","trust","fetch","onWarning","timeoutMs","encryptParams","verified","fetchAndVerifyAttestation","encryptSellerCredentialUpload","import_ethers","normalizeIdentityCallerAddress","callerAddress","cause","fail","SERVICE_RESPONSE_SNIPPET_LENGTH","postJsonServiceResponse","params","fetcher","resolveFetch","timeoutMs","controller","timeoutHandle","timeoutPromise","_","reject","response","responseText","buildServiceUrl","cause","fail","envelope","parseServiceResponseEnvelope","failWithServiceResponseEnvelope","isRecord","formatEnvelopeSnippet","failureContext","status","details","value","attestationServiceUrl","path","url","requestIdentityAttestation","params","callerAddress","normalizeIdentityCallerAddress","encryptedSessionMaterial","createEncryptedIdentitySessionMaterial","postJsonServiceResponse","uploadSellerCredential","params","encryptedUpload","createEncryptedSellerCredentialUpload","postJsonServiceResponse","verifyBuyerTeePayment","params","encryptedSessionMaterial","createEncryptedBuyerTeeSessionMaterial","postJsonServiceResponse","createNitroAttestationClient","options","environmentDefaults","DEFAULT_ENVIRONMENT_CONFIG","baseUrl","baseTrust","mergeTrust","params","attestationServiceUrl","trust","fetch","subtle","getRandomValues","now","onWarning","timeoutMs","sessionParams","createEncryptedBuyerTeeSessionMaterial","createEncryptedIdentitySessionMaterial","uploadParams","createEncryptedSellerCredentialUpload","requestIdentityAttestation","uploadSellerCredential","verifyParams","verifyBuyerTeePayment","fetchAndVerifyAttestation","encryptBuyerTeeSessionMaterial","encryptIdentitySessionMaterial","encryptSellerCredentialUpload","base","override","import_ethers","UNIFIED_PAYMENT_VERIFIER_DOMAIN","PAYMENT_ATTESTATION_TYPES","PAYMENT_ATTESTATION_TYPESTRING","PAYMENT_ATTESTATION_TYPEHASH","hashUtf8","IDENTITY_DOMAIN","IDENTITY_ATTESTATION_TYPES","IDENTITY_ATTESTATION_TYPESTRING","IDENTITY_ATTESTATION_TYPEHASH","IDENTITY_DOMAIN_SEPARATOR","SELLER_CREDENTIAL_BUNDLE_DOMAIN","SELLER_CREDENTIAL_BUNDLE_TYPES","getUnifiedPaymentVerifierDomain","params","getUnifiedPaymentVerifierDomainSeparator","value","hashHexBytes","hex","recoverSignerFromDomainSeparator","structHash","digest","normalizeAddress","cause","fail","recoverSignerFromKnownDomain","assertTrustedSigner","recoveredSigner","trustedSigners","recovered","normalizedTrustedSigners","signer","assertTrustedPayloadSigner","payloadSigner","assertLowercaseHexEqual","actual","expected","label","assertAddressEqual","normalizedActual","normalizedExpected","assertStringEqual","assertTypedDataTypesEqual","requireVerifierOption","address","verifyBuyerTeePaymentAttestation","payload","options","assertStringEqual","assertTypedDataTypesEqual","PAYMENT_ATTESTATION_TYPES","assertLowercaseHexEqual","PAYMENT_ATTESTATION_TYPEHASH","getUnifiedPaymentVerifierDomainSeparator","hashHexBytes","requireVerifierOption","recoveredSigner","recoverSignerFromDomainSeparator","assertTrustedPayloadSigner","IDENTITY_CANONICAL_FIELD_ORDER","verifyIdentityAttestation","payload","options","assertStringEqual","assertTypedDataTypesEqual","IDENTITY_ATTESTATION_TYPES","assertLowercaseHexEqual","IDENTITY_DOMAIN_SEPARATOR","IDENTITY_ATTESTATION_TYPEHASH","hashUtf8","assertAddressEqual","requireVerifierOption","hashIdentityData","assertNotExpired","recoveredSigner","recoverSignerFromKnownDomain","IDENTITY_DOMAIN","assertTrustedPayloadSigner","details","canonicalFields","sortMetadata","canonical","field","metadata","left","right","validUntil","now","nowMs","fail","verifySellerCredentialBundle","bundle","options","assertStringEqual","assertLowercaseHexEqual","requireVerifierOption","assertCredentialNotExpired","recoveredSigner","recoverSignerFromKnownDomain","SELLER_CREDENTIAL_BUNDLE_DOMAIN","SELLER_CREDENTIAL_BUNDLE_TYPES","buildSellerCredentialBundleValue","assertTrustedSigner","hashUtf8","credentialExpiresAt","now","nowMs","fail"]}