approval-md 0.1.0 → 0.3.0

package/dist/src/core/attest.js

@@ -39,8 +39,10 @@ import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { basename, isAbsolute, join } from "node:path";
 import { tick } from "./clock.js";
-import { builtinProtectedPathClass, isGateOrganPath, normalizePathSpelling, } from "./command-class.js";
+import { builtinProtectedPathClass, isGateOrganPath, normalizePathSpelling, POLICY_EDIT_SUBCLASS, protectedPathClass, } from "./command-class.js";
 import { APPEND_ERROR_CODES, appendEvent, } from "./log.js";
+import { payloadHash } from "./payload.js";
+import { payloadStoreDirFor, storePayload } from "./payload-store.js";
 /**
  * Actors permitted to attest. Deliberately narrower than the event schema's
  * `^(human|agent|system):.+`: attestation is the one verb an agent must not be
@@ -170,6 +172,29 @@ export function policyBytesHash(bytes) {
  * moment, and the *latest* attestation is the one `checkAttestation` honors.
  * Passing a precondition here would only manufacture spurious failures.
  */
+/**
+ * The value a terminal attestation stores for the bytes it attests (APRV-356).
+ *
+ * One author for the shape, because two parties need it and they must agree:
+ * {@link appendAttestation} writes it, and `cli/amend.ts` has to name the file
+ * it will land in before the append happens, so the ceremony commit can carry
+ * it. A second spelling of `{ text }` anywhere would be a store file the
+ * ceremony quietly left behind.
+ *
+ * Deliberately narrower than `proposalPayloadValue` in `core/policy-proposal.ts`,
+ * which carries `policy_path` beside the text: a proposal is a prompt and names
+ * the file it is asking about, while an attestation is a binding and the bytes
+ * are the whole of it. The two therefore address different files in the store
+ * for the same policy, which costs one duplicate and keeps each record's
+ * binding meaning exactly one thing.
+ */
+export function attestedPolicyPayload(text) {
+    return { text };
+}
+/** The store hash {@link attestedPolicyPayload} addresses for these bytes. */
+export function attestedPolicyPayloadHash(text) {
+    return payloadHash(attestedPolicyPayload(text));
+}
 export function appendAttestation(logPath, policyPath, actor, options = {}) {
     if (!HUMAN_ACTOR.test(actor)) {
         return {
@@ -181,8 +206,14 @@ export function appendAttestation(logPath, policyPath, actor, options = {}) {
         };
     }
     let sha256;
+    let text;
     try {
-        sha256 = policyFileHash(policyPath);
+        // One read supplies the expected-digest check, the recorded digest AND the
+        // bytes that go to the store (APRV-356). One read and not three, because
+        // three could disagree with each other about a file being edited.
+        const bytes = readFileSync(policyPath);
+        sha256 = policyBytesHash(bytes);
+        text = bytes.toString("utf8");
     }
     catch (cause) {
         return {
@@ -193,11 +224,49 @@ export function appendAttestation(logPath, policyPath, actor, options = {}) {
             },
         };
     }
+    if (options.expectedSha256 !== undefined && sha256 !== options.expectedSha256) {
+        return {
+            ok: false,
+            error: {
+                code: "io",
+                message: `policy ${policyPath} changed after the reviewed bytes were shown; expected sha256 ${options.expectedSha256}, found ${sha256}; the log was left unchanged`,
+            },
+        };
+    }
+    // APRV-356. The attested BYTES go to the content-addressed store and the
+    // record binds their hash, so the policy in force is recoverable from any
+    // chain attested after this lands.
+    //
+    // Before it, only an attestation that answered a phone PROPOSAL left
+    // recoverable bytes (`policy.proposed` binds the whole text, SPEC.md §10.4),
+    // and a chain only ever attested at a terminal — this repository included —
+    // had none. `inForcePolicyText` then failed, and the privileged-gesture rule
+    // of APRV-324 fell back to refusing, which is safe and leaves the residual
+    // that an amendment REMOVING a sender mapping is indistinguishable from a
+    // policy that never had one.
+    //
+    // A store that cannot be written REFUSES the attestation, and nothing is
+    // appended. That is the fail-closed direction and it is deliberate: a record
+    // claiming a binding whose bytes are absent would be a worse artifact than no
+    // record, and the store sits beside the log, which this verb is about to
+    // write anyway. The alternative considered — append without the binding, as
+    // before — was rejected because it would make the recoverability guarantee
+    // conditional on a condition no reader of the record can see.
+    const stored = storePayload(payloadStoreDirFor(logPath), attestedPolicyPayload(text));
+    if (!stored.ok) {
+        return {
+            ok: false,
+            error: {
+                code: "io",
+                message: `the attested bytes of ${basename(policyPath)} could not be stored beside the log (${stored.message}); the log was left unchanged, because an attestation whose bytes are unrecoverable is the state this verb exists to end`,
+            },
+        };
+    }
     return appendEvent(logPath, {
         ts: tick(options),
         event: "policy.updated",
         actor,
-        payload: { policy_path: basename(policyPath), sha256 },
+        payload: { policy_path: basename(policyPath), sha256, payload_hash: stored.hash },
     }, options);
 }
 /**
@@ -212,7 +281,7 @@ export function appendAttestation(logPath, policyPath, actor, options = {}) {
  * payload-less event could *satisfy* the guard, which is exactly backwards.
  * Ignoring them means an old log reads as `not-attested` — fail closed.
  */
-function attestationSha256(record) {
+export function attestationSha256(record) {
     if (record.event !== "policy.updated")
         return null;
     const payload = record.payload;
@@ -574,4 +643,257 @@ export function latestOrganAttestation(records, organPath) {
     }
     return null;
 }
+// ===========================================================================
+// Protected-path sign-off (APRV-338, amended SPEC.md §5.2, §8 and §10.1)
+// ===========================================================================
+/**
+ * The event a protected-path SIGN-OFF is: a human's statement that they read
+ * one `policy.edit` file at these exact bytes and stand behind them.
+ *
+ * ## The hole this fills
+ *
+ * SPEC.md's amendment-provenance rule says text that reached a protected file
+ * without a grant carries `(Amended APRV-n, pending sign-off.)` until a human
+ * ratifies it, and doubt resolves to pending. Nothing recorded the
+ * ratification. A human who had read a diff and agreed with it had exactly two
+ * ways to get it past the protected-path guard: re-make the edit under a grant,
+ * or change the guard. Both are the wrong shape — the first re-does work the
+ * human has already done with their eyes, and the second edits an enforcement
+ * path to admit one change.
+ *
+ * ## Why it is not the organ record, and not a grant either
+ *
+ * It sits between them, and the ordering is the point.
+ *
+ * A grant binds the exact hunk: `{before, after}` bytes a human saw in a
+ * prompt. It is the strongest evidence in the system about a CHANGE, and
+ * nothing here weakens it — {@link findPathSignOff} is asked only after the
+ * guard's hunk search has failed, so a covered change still passes on its
+ * grants and still prints them as its reason.
+ *
+ * {@link ORGAN_ATTESTATION_EVENT} is the other end. An organ is `policy.core`,
+ * a policy may resolve `policy.core` to `human-only`, and the gate mints
+ * nothing for a human-only class (§11.1 invariant 9), so for an organ content
+ * attestation is not the weaker evidence, it is the only evidence that can
+ * exist. A protected path is not in that position: a `policy.edit` grant for it
+ * is obtainable, so this record must never be the first thing a reader reaches
+ * for. A separate type is what makes that ordering structural rather than a
+ * convention every reader has to remember, and it is why the organ verb's
+ * refusals and this one's are not merged.
+ *
+ * The `gate.` prefix is deliberate: SPEC.md §8 keys the write-boundary clock on
+ * it, and a signer who could supply the moment could place a sign-off before
+ * bytes they had not yet seen.
+ */
+export const PATH_SIGN_OFF_EVENT = "gate.path.signed_off";
+/**
+ * The payload field naming which file was signed off.
+ *
+ * Repository-relative and `/`-separated, for the reason {@link ORGAN_PATH_FIELD}
+ * is: the log is copied and read on other machines, and an absolute path would
+ * leak the signer's home directory into a permanent record. Spelled `path`
+ * rather than `signed_path` because the record type already says what kind of
+ * statement it is, and a reader should not have to learn a second noun.
+ */
+export const SIGN_OFF_PATH_FIELD = "path";
+/**
+ * Why a sign-off was refused: the attestation codes, plus the three path rules
+ * this verb has of its own.
+ *
+ * Three and not one, because the repair differs in each case and a caller has
+ * to be able to tell them apart without reading prose:
+ *
+ * - `path-is-policy` — the policy file, whose sign-off is its attestation and
+ *   which the gate reads on every operation. A second record that looked like
+ *   a statement about the policy's bytes is exactly what the organ verb refuses
+ *   to create, for the same reason.
+ * - `path-is-core` — a `policy.core` surface or the log directory. An organ is
+ *   signed off with `--organ`, which is a different record under different
+ *   rules; the approval home and the log are the human's own ceremony surface
+ *   and are not ratified by any verb at all.
+ * - `path-not-protected` — an ordinary file, or a path that is not
+ *   repository-relative. Nothing to ratify: an unprotected file's edits are not
+ *   gated, so a record about them would assert authority over nothing.
+ */
+export const PATH_SIGN_OFF_ERROR_CODES = [
+    ...ATTEST_ERROR_CODES,
+    "path-not-protected",
+    "path-is-policy",
+    "path-is-core",
+];
+/**
+ * Append a `gate.path.signed_off` record for `target` to `logPath`.
+ *
+ * The rules, refused as structured results and never as throws, in the order
+ * they are checked — and the order is normative, because a path can break more
+ * than one of them and the caller's repair depends on which they are told:
+ *
+ * 1. `actor` MUST match `^human:.+`. This is the verb an agent must not
+ *    perform: a record the party under oversight could write would let it
+ *    ratify its own text, which is the whole of what the pending-sign-off
+ *    suffix exists to prevent (§11.1 invariants 4 and 9).
+ * 2. The path must be repository-relative: absolute paths and `..` are refused,
+ *    because the recorded identity has to mean the same file on the machine
+ *    that later reads the log.
+ * 3. The policy file is refused with its own code; it has its own attestation.
+ * 4. `policy.core` and `log.mutate` surfaces are refused with their own code.
+ * 5. What remains must classify `policy.edit` or a `policy.edit.*` sub-class.
+ *    Anything else is not a protected path, and this verb is not a general
+ *    "bless these bytes" primitive.
+ *
+ * Every one of those is decided BEFORE the file is read, so a path this verb
+ * would never sign off is refused whether or not it exists.
+ *
+ * The digest is computed by the runtime from the file's exact bytes. There is
+ * no parameter for it and none for `ts`, for the reason
+ * {@link appendOrganAttestation} has neither: a caller who could supply the
+ * hash could ratify bytes nobody read, and one who could supply the moment
+ * could backdate what they had seen when.
+ *
+ * Like the attestations this append carries no `expectedHead`: it reads nothing
+ * from the log, so it has no check-then-act window to close.
+ */
+export function appendPathSignOff(logPath, target, actor, options = {}) {
+    if (!HUMAN_ACTOR.test(actor)) {
+        return {
+            ok: false,
+            error: {
+                code: "actor-not-human",
+                message: `signing off a protected path requires a human actor matching ^human:.+, got ${JSON.stringify(actor)}; this record is what resolves the pending-sign-off suffix, so an agent that could write one could ratify its own text, and the log was left unchanged`,
+            },
+        };
+    }
+    const refusal = signOffPathRefusal(target.path, target.protectedPaths ?? []);
+    if (refusal !== null)
+        return { ok: false, error: refusal };
+    const path = normalizePathSpelling(target.path);
+    let sha256;
+    try {
+        sha256 = policyFileHash(join(target.root, path));
+    }
+    catch (cause) {
+        return {
+            ok: false,
+            error: {
+                code: "io",
+                message: `protected path ${path} could not be read under ${target.root} for sign-off: ${detail(cause)}`,
+            },
+        };
+    }
+    return appendEvent(logPath, {
+        ts: tick(options),
+        event: PATH_SIGN_OFF_EVENT,
+        actor,
+        payload: { [SIGN_OFF_PATH_FIELD]: path, sha256 },
+    }, options);
+}
+/** Rules 2 to 5 of {@link appendPathSignOff}, or `null` when the path passes. */
+function signOffPathRefusal(candidate, extra) {
+    const normalized = normalizePathSpelling(candidate);
+    if (normalized.length === 0 || isAbsolute(candidate) || normalized.split("/").includes("..")) {
+        return {
+            code: "path-not-protected",
+            message: `${JSON.stringify(candidate)} is not a repository-relative path; a sign-off records the path itself, so it must name the same file on every machine that later reads the log`,
+        };
+    }
+    const builtin = builtinProtectedPathClass(normalized);
+    if (builtin === "policy.core") {
+        const last = normalized.split("/").pop() ?? normalized;
+        if (POLICY_FILE_NAMES.includes(last)) {
+            return {
+                code: "path-is-policy",
+                message: `${normalized} is the policy file, whose sign-off is its attestation: \`approval policy attest\` with no --path, which the gate reads on every operation. A second record about those bytes would be a thing that looks like an attestation and is not one`,
+            };
+        }
+        return {
+            code: "path-is-core",
+            message: isGateOrganPath(normalized)
+                ? `${normalized} is one of the gate's organs, which is signed off by content with \`approval policy attest --organ ${normalized}\`; that is a different record under different rules, because an organ is policy.core and can have no grant at all, while a protected path can`
+                : `${normalized} is inside the approval home, which is the human's own ceremony surface and is ratified by no verb`,
+        };
+    }
+    if (builtin === "log.mutate") {
+        return {
+            code: "path-is-core",
+            message: `${normalized} is inside the log directory, which no verb of this runtime signs off: the log is append-only and its contents are evidence rather than text anyone ratifies`,
+        };
+    }
+    const routed = protectedPathClass(normalized, extra);
+    if (routed === "policy.edit" || (routed !== null && POLICY_EDIT_SUBCLASS.test(routed))) {
+        return null;
+    }
+    return {
+        code: "path-not-protected",
+        message: `${normalized} does not classify policy.edit or a policy.edit.* sub-class${extra.length === 0 ? " under the built-in protected set (no policy.protected_paths were supplied, which is the narrower reading)" : " under the built-in protected set widened by policy.protected_paths"}, so it is not a protected path and nothing about it is gated; a sign-off on it would assert authority over nothing`,
+    };
+}
+/**
+ * Is this record a protected-path sign-off, and which bytes of which file does
+ * it stand behind?
+ *
+ * A record missing either field is ignored, for the reason a `policy.updated`
+ * with no `sha256` is ignored: a record that asserts nothing about bytes must
+ * never be able to SATISFY a check about bytes. Fail closed.
+ */
+export function pathSignOffOf(record) {
+    if (record.event !== PATH_SIGN_OFF_EVENT)
+        return null;
+    const payload = record.payload;
+    if (payload === undefined)
+        return null;
+    const path = payload[SIGN_OFF_PATH_FIELD];
+    const sha256 = payload["sha256"];
+    if (typeof path !== "string" || typeof sha256 !== "string")
+        return null;
+    const normalized = normalizePathSpelling(path);
+    if (normalized.length === 0)
+        return null;
+    return { path: normalized, sha256 };
+}
+/**
+ * The record in which a human signed off THIS digest FOR THIS path, latest
+ * first, or `null`.
+ *
+ * Both halves are required and that is the whole rule, exactly as it is for an
+ * organ: a digest signed for some other file is not evidence about this one,
+ * and bytes edited after a sign-off are bytes nobody signed. Two files that
+ * happen to hash alike are still two files, and a human who read one has said
+ * nothing about the other.
+ *
+ * There is no "latest wins" supersession. A sign-off stands for the bytes it
+ * names: the checker asks about a blob at a commit that may be old, and the
+ * newest sign-off of a file says nothing about whether an earlier state was
+ * once ratified.
+ */
+export function findPathSignOff(records, path, sha256) {
+    const want = normalizePathSpelling(path);
+    for (let index = records.length - 1; index >= 0; index -= 1) {
+        const record = records[index];
+        const fields = pathSignOffOf(record);
+        if (fields === null)
+            continue;
+        if (fields.path === want && fields.sha256 === sha256)
+            return record;
+    }
+    return null;
+}
+/**
+ * The most recent sign-off of `path` at ANY digest, or `null`.
+ *
+ * What a status surface needs to tell "this file was never signed off" from
+ * "this file was signed off and has been edited since". Nothing enforcing reads
+ * it: {@link findPathSignOff} is the question the guard asks.
+ */
+export function latestPathSignOff(records, path) {
+    const want = normalizePathSpelling(path);
+    for (let index = records.length - 1; index >= 0; index -= 1) {
+        const record = records[index];
+        const fields = pathSignOffOf(record);
+        if (fields === null)
+            continue;
+        if (fields.path === want)
+            return { ...fields, record };
+    }
+    return null;
+}
 //# sourceMappingURL=attest.js.map

package/dist/src/core/attest.js.map

@@ -1 +1 @@
-{"version":3,"file":"attest.js","sourceRoot":"","sources":["../../../src/core/attest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAAE,IAAI,EAAqB,MAAM,YAAY,CAAC;AACrD,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,WAAW,GAGZ,MAAM,UAAU,CAAC;AAGlB;;;;;GAKG;AACH,MAAM,WAAW,GAAG,WAAW,CAAC;AAEhC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,kBAAkB,EAAE,iBAAiB,CAAU,CAAC;AA0BtF,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,UAAkB,EAClB,KAAa,EACb,OAAO,GAAkB,EAAE;IAE3B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,8DAA8D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,yFAAyF;aACtL;SACF,CAAC;IACJ,CAAC;IAED,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,UAAU,UAAU,uCAAuC,MAAM,CAAC,KAAK,CAAC,EAAE;aACpF;SACF,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAChB,OAAO,EACP;QACE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC;QACjB,KAAK,EAAE,gBAAgB;QACvB,KAAK;QACL,OAAO,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE;KACvD,EACD,OAAO,CACR,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,iBAAiB,CAAC,MAAmB;IAC5C,IAAI,MAAM,CAAC,KAAK,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAsB,EACtB,UAAkB;IAElB,0EAA0E;IAC1E,+DAA+D;IAC/D,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,sBAAsB,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CAAC,UAAkB,EAAE,KAAa;IACtE,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,UAAU,UAAU,uBAAuB,KAAK,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAsB,EACtB,KAAiB;IAEjB,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAE1C,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAgB,CAAC;QAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAChC,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACrE,CAAC;QACD,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,cAAc,EAAE,QAAQ;YACxB,UAAU;YACV,GAAG,EAAE,MAAM,CAAC,GAAG;SAChB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAyB;IAC1D,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,UAAU;YACb,OAAO,IAAI,CAAC;QACd,KAAK,cAAc;YACjB,OAAO;gBACL,IAAI,EAAE,mBAAmB;gBACzB,MAAM,EAAE,cAAc;gBACtB,OAAO,EACL,wHAAwH;aAC3H,CAAC;QACJ,KAAK,eAAe;YAClB,OAAO;gBACL,IAAI,EAAE,mBAAmB;gBACzB,MAAM,EAAE,eAAe;gBACvB,OAAO,EAAE,4DAA4D,MAAM,CAAC,GAAG,cAAc,MAAM,CAAC,cAAc,UAAU,MAAM,CAAC,UAAU,gEAAgE;aAC9M,CAAC;QACJ,KAAK,YAAY;YACf,OAAO;gBACL,IAAI,EAAE,mBAAmB;gBACzB,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,mDAAmD;aAC9E,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAO,GAAuB,EAAE;IAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;IAC/B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAA8B,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,GAAG,kBAAkB;IACrB,gBAAgB;IAChB,gBAAgB;CACR,CAAC;AA2CX;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,MAAmB,EACnB,KAAa,EACb,OAAO,GAAkB,EAAE;IAE3B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,yEAAyE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iKAAiK;aACzQ;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAErD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,cAAc,SAAS,4BAA4B,MAAM,CAAC,IAAI,qBAAqB,MAAM,CAAC,KAAK,CAAC,EAAE;aAC5G;SACF,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAChB,OAAO,EACP;QACE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC;QACjB,KAAK,EAAE,uBAAuB;QAC9B,KAAK;QACL,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE;KACnD,EACD,OAAO,CACR,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,SAAiB;IACzC,MAAM,UAAU,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7F,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,2JAA2J;SACjM,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,yBAAyB,CAAC,UAAU,CAAC,KAAK,aAAa,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC;QACvD,IAAI,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,GAAG,UAAU,sJAAsJ;aAC7K,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,GAAG,UAAU,mKAAmK;SAC1L,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,GAAG,UAAU,mOAAmO;KAC1P,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAsB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;AAE7E;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAmB;IACpD,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAuB;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,UAAU,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA+B,EAC/B,SAAiB,EACjB,MAAc;IAEd,MAAM,IAAI,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC9C,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAgB,CAAC;QAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC9B,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA+B,EAC/B,SAAiB;IAEjB,MAAM,IAAI,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC9C,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAgB,CAAC;QAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC9B,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"attest.js","sourceRoot":"","sources":["../../../src/core/attest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAAE,IAAI,EAAqB,MAAM,YAAY,CAAC;AACrD,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,WAAW,GAGZ,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGtE;;;;;GAKG;AACH,MAAM,WAAW,GAAG,WAAW,CAAC;AAEhC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,kBAAkB,EAAE,iBAAiB,CAAU,CAAC;AAkCtF,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,WAAW,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,UAAkB,EAClB,KAAa,EACb,OAAO,GAAkB,EAAE;IAE3B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,8DAA8D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,yFAAyF;aACtL;SACF,CAAC;IACJ,CAAC;IAED,IAAI,MAAc,CAAC;IACnB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,2EAA2E;QAC3E,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,UAAU,UAAU,uCAAuC,MAAM,CAAC,KAAK,CAAC,EAAE;aACpF;SACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QAC9E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,UAAU,UAAU,iEAAiE,OAAO,CAAC,cAAc,WAAW,MAAM,8BAA8B;aACpK;SACF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,mCAAmC;IACnC,EAAE;IACF,qEAAqE;IACrE,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,0EAA0E;IAC1E,6BAA6B;IAC7B,EAAE;IACF,yEAAyE;IACzE,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,MAAM,GAAG,YAAY,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,yBAAyB,QAAQ,CAAC,UAAU,CAAC,wCAAwC,MAAM,CAAC,OAAO,0HAA0H;aACvO;SACF,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAChB,OAAO,EACP;QACE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC;QACjB,KAAK,EAAE,gBAAgB;QACvB,KAAK;QACL,OAAO,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE;KAClF,EACD,OAAO,CACR,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,IAAI,MAAM,CAAC,KAAK,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAsB,EACtB,UAAkB;IAElB,0EAA0E;IAC1E,+DAA+D;IAC/D,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,sBAAsB,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CAAC,UAAkB,EAAE,KAAa;IACtE,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,UAAU,UAAU,uBAAuB,KAAK,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAsB,EACtB,KAAiB;IAEjB,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAE1C,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAgB,CAAC;QAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAChC,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACrE,CAAC;QACD,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,cAAc,EAAE,QAAQ;YACxB,UAAU;YACV,GAAG,EAAE,MAAM,CAAC,GAAG;SAChB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAyB;IAC1D,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,UAAU;YACb,OAAO,IAAI,CAAC;QACd,KAAK,cAAc;YACjB,OAAO;gBACL,IAAI,EAAE,mBAAmB;gBACzB,MAAM,EAAE,cAAc;gBACtB,OAAO,EACL,wHAAwH;aAC3H,CAAC;QACJ,KAAK,eAAe;YAClB,OAAO;gBACL,IAAI,EAAE,mBAAmB;gBACzB,MAAM,EAAE,eAAe;gBACvB,OAAO,EAAE,4DAA4D,MAAM,CAAC,GAAG,cAAc,MAAM,CAAC,cAAc,UAAU,MAAM,CAAC,UAAU,gEAAgE;aAC9M,CAAC;QACJ,KAAK,YAAY;YACf,OAAO;gBACL,IAAI,EAAE,mBAAmB;gBACzB,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,mDAAmD;aAC9E,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAO,GAAuB,EAAE;IAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;IAC/B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAA8B,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,GAAG,kBAAkB;IACrB,gBAAgB;IAChB,gBAAgB;CACR,CAAC;AA2CX;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,MAAmB,EACnB,KAAa,EACb,OAAO,GAAkB,EAAE;IAE3B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,yEAAyE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iKAAiK;aACzQ;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAErD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,cAAc,SAAS,4BAA4B,MAAM,CAAC,IAAI,qBAAqB,MAAM,CAAC,KAAK,CAAC,EAAE;aAC5G;SACF,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAChB,OAAO,EACP;QACE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC;QACjB,KAAK,EAAE,uBAAuB;QAC9B,KAAK;QACL,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE;KACnD,EACD,OAAO,CACR,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,SAAiB;IACzC,MAAM,UAAU,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7F,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,2JAA2J;SACjM,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,yBAAyB,CAAC,UAAU,CAAC,KAAK,aAAa,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC;QACvD,IAAI,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,GAAG,UAAU,sJAAsJ;aAC7K,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,GAAG,UAAU,mKAAmK;SAC1L,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,GAAG,UAAU,mOAAmO;KAC1P,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAsB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;AAE7E;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAmB;IACpD,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAuB;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,UAAU,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA+B,EAC/B,SAAiB,EACjB,MAAc;IAEd,MAAM,IAAI,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC9C,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAgB,CAAC;QAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC9B,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA+B,EAC/B,SAAiB;IAEjB,MAAM,IAAI,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC9C,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAgB,CAAC;QAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC9B,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAA+B,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,GAAG,kBAAkB;IACrB,oBAAoB;IACpB,gBAAgB;IAChB,cAAc;CACN,CAAC;AA+CX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,MAAqB,EACrB,KAAa,EACb,OAAO,GAAkB,EAAE;IAE3B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,+EAA+E,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,wJAAwJ;aACtQ;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAC7E,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAEhD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,kBAAkB,IAAI,4BAA4B,MAAM,CAAC,IAAI,kBAAkB,MAAM,CAAC,KAAK,CAAC,EAAE;aACxG;SACF,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAChB,OAAO,EACP;QACE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC;QACjB,KAAK,EAAE,mBAAmB;QAC1B,KAAK;QACL,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;KACjD,EACD,OAAO,CACR,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CACzB,SAAiB,EACjB,KAAoC;IAEpC,MAAM,UAAU,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7F,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,iJAAiJ;SACvL,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC;QACvD,IAAI,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,GAAG,UAAU,8OAA8O;aACrQ,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,eAAe,CAAC,UAAU,CAAC;gBAClC,CAAC,CAAC,GAAG,UAAU,sGAAsG,UAAU,gJAAgJ;gBAC/Q,CAAC,CAAC,GAAG,UAAU,oGAAoG;SACtH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,GAAG,UAAU,8JAA8J;SACrL,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,MAAM,KAAK,aAAa,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,GAAG,UAAU,8DAA8D,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,4GAA4G,CAAC,CAAC,CAAC,qEAAqE,qHAAqH;KACnZ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,MAAmB;IAC/C,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxE,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAC7B,OAA+B,EAC/B,IAAY,EACZ,MAAc;IAEd,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACzC,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAgB,CAAC;QAC7C,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA+B,EAC/B,IAAY;IAEZ,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACzC,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAgB,CAAC;QAC7C,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}