burnledger 0.6.1 → 0.8.0

package/dist/esm/cli.js

@@ -6,7 +6,7 @@ import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { nodeCrypto } from "./crypto-node.js";
 import { CERTIFICATE_REVOKED, VerificationError } from "./errors.js";
-import { formatTimestamp, publicKeyFromHex, verifyCertificateWithStatus, verifyTransparency, VALID_REVOCATION_UNKNOWN, } from "./verify.js";
+import { formatTimestamp, publicKeyFromHex, verifyCertificateWithStatus, verifyTransparency, KNOWN_FORMAT_VERSIONS, VALID_REVOCATION_UNKNOWN, } from "./verify.js";
 import { KEY_LIST_STALE, KEY_LIST_VALID, parseKeyListDocument, verifyKeyList, } from "./keys.js";
 import { ANCHOR_INCONSISTENT, checkStatementAnchor } from "./anchor.js";
 const USAGE = "Usage: burnledger check --cert <file> --keys <file> [--online --api-url <url>]\n";
@@ -266,10 +266,57 @@ const REVOCATION_UNKNOWN_ONLINE = "no usable signed status statement — the iss
  * enclave measurement was unattributable when the signature covers it.
  * scripts/check-pcr0-signed-parity.py now pins this list to the Go function.
  */
-const ENCLAVE_PCR0_SIGNED_IN = Object.freeze(["5.0", "6.0", "7.0"]);
+const ENCLAVE_PCR0_SIGNED_IN = Object.freeze(["5.0", "6.0", "7.0", "8.0", "9.0"]);
 function signatureCoversEnclavePcr0(version) {
     return ENCLAVE_PCR0_SIGNED_IN.includes(version);
 }
+/**
+ * Per system: did the enclave check it against a customer-signed registration,
+ * and under which key?
+ *
+ * This line is the WHOLE POINT of the field. ADR-025 §2: the enclave cannot
+ * refuse a second enrollment for a team — that needs durable state — so a parent
+ * can enroll a key of its own. What stops that being useful is that the record
+ * names the key id and the customer sees a key they do not hold. A verifier that
+ * reads the field and never shows it removes the only place that happens.
+ *
+ * Absence is stated rather than left silent. Records issued before 9.0 carry no
+ * field, and ADR-025 is explicit that their absence means "issued before this
+ * existed", never a pass — a blank where a control should be is exactly how a
+ * reader concludes the control ran.
+ */
+function pushRegistrationEvidence(L, cert) {
+    const version = cert.certificate_format_version;
+    if (!KNOWN_FORMAT_VERSIONS.includes(version) || !formatAtLeastV9(version)) {
+        L.push(`  Registration: not stated (format ${version} predates the field; ` +
+            "its absence is not a pass)");
+        return;
+    }
+    for (const sys of cert.systems ?? []) {
+        const name = sys.system_name;
+        if (sys.authorization === "certified") {
+            L.push(`  Registration [${name}]: certified under ${sys.customer_key_id} — ` +
+                "the enclave checked this system against a customer-signed registration. " +
+                "If that key id is not yours, someone else authorized this verification.");
+        }
+        else if (sys.authorization === "none") {
+            L.push(`  Registration [${name}]: none — this verification was NOT checked against ` +
+                "a customer-signed registration.");
+        }
+        else {
+            // Unreachable through verifyCertificate, which rebuilds the payload and
+            // refuses an unrecognized value. Printed rather than skipped because a
+            // caller that formatted a record it never verified must not be handed a
+            // blank where a control belongs.
+            L.push(`  Registration [${name}]: unreadable (${JSON.stringify(sys.authorization ?? null)} ` +
+                "is not a value this build knows)");
+        }
+    }
+}
+/** Mirrors core.FormatAtLeast for 9.0, by POSITION: "10.0" sorts before "7.0". */
+function formatAtLeastV9(version) {
+    return KNOWN_FORMAT_VERSIONS.indexOf(version) >= KNOWN_FORMAT_VERSIONS.indexOf("9.0");
+}
 /** Byte fields arrive as number arrays (Go [N]byte) or strings; show hex. */
 function displayHash(v) {
     if (Array.isArray(v)) {
@@ -360,6 +407,7 @@ export function formatOutput(cert, sigResult, transparency, transparencyFailed,
                 `unattributable, not verified here): ${pcr0}`);
         }
     }
+    pushRegistrationEvidence(L, cert);
     if (transparency === "INCLUDED") {
         const t = cert.transparency;
         L.push(`  Transparency log: entry #${t.entry_index}, inclusion proof VALID`);

package/dist/esm/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AACA;mDACmD;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,2BAA2B,EAC3B,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,aAAa,GAGd,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAqB,MAAM,aAAa,CAAC;AAQ3F,MAAM,KAAK,GAAG,kFAAkF,CAAC;AAEjG,SAAS,GAAG,CAAC,GAAW,IAAW,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhF,SAAS,SAAS,CAAC,IAAc;IAG/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,QAAQ,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,EAAE,MAAM,GAAG,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC;IAC9D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAAC,CAAC;aAC5E,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAAC,CAAC;aACjF,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;QAAC,CAAC;aACxC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAAC,CAAC;QAC1F,2EAA2E;QAC3E,2EAA2E;QAC3E,2DAA2D;aACtD,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAAC,CAAC;;YACnF,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,GAAG,CAAC,wCAAwC,CAAC,CAAC;IAC1E,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAE,CAAW,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;gCAQgC;AAChC,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EAAE,GAAuC;IAEvD,MAAM,KAAK,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACjH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;0CAK0C;AAC1C,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,OAAmB,CAAC;IACxB,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;QACnB,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,8BAA8B;QAC9B,OAAO,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAE,CAAW,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,kBAAkB;QAClB,IAAI,CAAC,CAAC,UAAU,KAAK,aAAa,IAAI,CAAC,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACvE,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,GAAG,8DAA8D,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE;gBACrD,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,QAAQ,EAAE,CAAC,CAAC,SAAS,IAAI,SAAS;gBAClC,eAAe,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;aACjD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,uBAAwB,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,6EAA6E;QAC7E,4EAA4E;QAC5E,oDAAoD;QACpD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;YACrD,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,uCAAuC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;YACnE,GAAG,CAAC,4CAA4C,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;gFAWgF;AAChF,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAc;IAChE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,MAAM,SAAS,CAAC,CAAC;IAC1F,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,OAAO,qBAAqB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;8BAgB8B;AAC9B,MAAM,UAAU,qBAAqB,CAAC,MAAe;IACnD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,GAAG,GAAG,MAAyB,CAAC;IACpC,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1F,GAAG,GAAG,GAAG,CAAC,IAAuB,CAAC;IACpC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACxG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxF,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI;QAAE,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC9D,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC9G,2EAA2E;IAC3E,4EAA4E;IAC5E,eAAe;IACf,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IACrC,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB,EAAE,KAAa;IACzD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,kBAAkB,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAoB,EAAE,KAAa,EAAE,KAAa;IACpE,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,MAAM,CAAC,gBAAgB,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,WAAW,KAAK,eAAe,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;;;;;;iFAQiF;AACjF,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC;AAE1F;;;;;;;uCAOuC;AACvC,MAAM,OAAO,GAAG,SAAS,CAAC;AAE1B;;;;;;;;;;0DAU0D;AAC1D,MAAM,UAAU,WAAW,CACzB,SAAiB,EAAE,kBAA2B,EAAE,MAAqB;IAErE,IAAI,MAAM,EAAE,OAAO,KAAK,mBAAmB;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC;AAC/D,CAAC;AAED;;;+DAG+D;AAC/D,MAAM,iBAAiB,GAA2B;IAChD,wBAAwB,EACtB,yEAAyE;QACzE,8DAA8D;IAChE,2BAA2B,EACzB,gEAAgE;QAChE,sCAAsC;CACzC,CAAC;AAEF;;;;;;;;mEAQmE;AACnE,MAAM,0BAA0B,GAC9B,qEAAqE;IACrE,yDAAyD,CAAC;AAC5D,MAAM,yBAAyB,GAC7B,mEAAmE;IACnE,uFAAuF,CAAC;AAE1F;;;;;;;;;;;;;GAaG;AACH,MAAM,sBAAsB,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAEvF,SAAS,0BAA0B,CAAC,OAAe;IACjD,OAAO,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,OAAQ,CAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAAU,EAAE,SAAiB,EAAE,YAAoB,EAAE,kBAA2B,EAChF,MAAmC,EAAE,MAAe,EAAE,MAAqB,EAC3E,OAAyB;IAEzB,MAAM,EAAE,GAAI,IAAI,CAAC,cAAyB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,WAAW,CAAE,IAAI,CAAC,OAAmC,CAAC,eAAe,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAsC,CAAC;IACxD,MAAM,CAAC,GAAa,EAAE,CAAC;IAEvB,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,+DAA+D;IAC/D,+DAA+D;IAC/D,IAAI,MAAM,EAAE,OAAO,KAAK,mBAAmB,EAAE,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,qCAAqC,CAAC,CAAC;QAC1E,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC,wCAAwC,SAAS,6CAA6C,CAAC,CAAC;QACvG,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,0BAA0B,EAAE,KAAK,SAAS,KAAK,IAAI,KAAK,CAAC;IACxF,4EAA4E;IAC5E,gEAAgE;IAChE,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,qBAAqB,CAAC,CAAC;QAC1D,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACjC,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,0BAA0B,EAAE,cAAc,SAAS,KAAK,CAAC;IACrG,IAAI,kBAAkB;QAAE,OAAO,0BAA0B,EAAE,4BAA4B,YAAY,KAAK,CAAC;IAEzG,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,GAAG,GAAG,SAAS,KAAK,wBAAwB;QAChD,CAAC,CAAC,GAAG,wBAAwB,KAAK,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,0BAA0B,GAAG;QACpG,CAAC,CAAC,4DAA4D,CAAC;IACjE,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,0BAAoC,EAAE,CAAC,CAAC;IAEzE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,oEAAoE;IACpE,0CAA0C;IAC1C,MAAM,GAAG,GAAI,IAAI,CAAC,OAAqC,IAAI,EAAE,CAAC;IAC9D,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3G,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAI,CAAC,CAAC,cAAyB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAI,CAAC,CAAC,cAAyB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,WAAqB,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAqB,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAEV,wEAAwE;IACxE,8EAA8E;IAC9E,yCAAyC;IACzC,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,MAA6C,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,EAAE,YAAY,CAAC;IAClC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,0BAAoC,CAAC;QAC1D,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,2DAA2D,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,IAAI,CACJ,2BAA2B,OAAO,wCAAwC;gBACxE,uCAAuC,IAAI,EAAE,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,YAAuC,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,WAAqB,yBAAyB,CAAC,CAAC;IACzF,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,uBAAuB,YAAY,KAAK,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjC,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9B,mBAAmB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAC7B,CAAC;AAED;;;;;;;;+EAQ+E;AAC/E,SAAS,mBAAmB,CAAC,CAAW,EAAE,CAA8B;IACtE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO;IAC5B,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACf,CAAC,CAAC,IAAI,CAAC,mEAAmE;YACxE,qEAAqE,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YACjB,wEAAwE;YACxE,sEAAsE;YACtE,sDAAsD;YACtD,CAAC,CAAC,IAAI,CAAC,gEAAgE;gBACrE,2EAA2E,CAAC,CAAC;QACjF,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC,SAAS,KAAK;YACrF,uDAAuD,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC,MAAM,MAAM;QACzE,6CAA6C,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;+CAM+C;AAC/C,SAAS,kBAAkB,CAAC,CAAW,EAAE,MAAgC;IACvE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,CAAC,CAAC,IAAI,CAAC,2BAA2B,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;0DAS0D;AAC1D,SAAS,qBAAqB,CAAC,CAAW,EAAE,MAAmC;IAC7E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,CAAC,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAClF,CAAC,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,IAAI,CAAC,sBAAsB,eAAe,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM;QAC5E,GAAG,eAAe,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACrD,8EAA8E;IAC9E,4EAA4E;IAC5E,gEAAgE;IAChE,CAAC,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;QAC3E,QAAQ,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI;QAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,0BAA0B,IAAI,IAAI,EAAE,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,IAAI,IAAI,EAAE,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;mEACmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,MAAY;IAC5C,IAAI,IAAI,GAAG,MAAM,CAAC;IAClB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,IAAI,GAAG,IAAI,CAAC,IAAY,CAAC;IAClF,IACE,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QAChE,IAAI,CAAC,WAAoB,CAAC,MAAM,KAAK,SAAS,EAC/C,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,WAAmB,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAS,CAAC,CAAC;IAC3F,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAExD,8EAA8E;IAC9E,8DAA8D;IAC9D,wDAAwD;IACxD,2EAA2E;IAC3E,8EAA8E;IAC9E,6CAA6C;IAC7C,IAAI,MAAmC,CAAC;IACxC,IAAI,MAAgC,CAAC;IACrC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAwB,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0EAA0E;YAC1E,yEAAyE;YACzE,mEAAmE;YACnE,mDAAmD;YACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iDAAiD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAChG,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,SAAS;QACT,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAgB,CAAC,CAAC;YAC9C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,wEAAwE;IACxE,8EAA8E;IAC9E,mDAAmD;IACnD,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,IAAI,CAAC;QAAC,SAAS,GAAG,MAAM,2BAA2B,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC;IAAC,CAAC;IAC9F,OAAO,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,YAAY,iBAAiB,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB;YAAE,SAAS,GAAG,OAAO,CAAC;;YACrF,SAAS,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IACpE,CAAC;IAED,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,YAAY,GAAG,eAAe,CAAC;IACnC,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC;QAAC,YAAY,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IACxE,OAAO,CAAC,EAAE,CAAC;QAAC,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QAAC,kBAAkB,GAAG,IAAI,CAAC;IAAC,CAAC;IAEzG,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAEjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CACtG,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,uEAAuE;AACvE,gFAAgF;AAChF,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AACA;mDACmD;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,aAAa,GAGd,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAqB,MAAM,aAAa,CAAC;AAQ3F,MAAM,KAAK,GAAG,kFAAkF,CAAC;AAEjG,SAAS,GAAG,CAAC,GAAW,IAAW,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhF,SAAS,SAAS,CAAC,IAAc;IAG/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,QAAQ,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,EAAE,MAAM,GAAG,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC;IAC9D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAAC,CAAC;aAC5E,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAAC,CAAC;aACjF,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;QAAC,CAAC;aACxC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAAC,CAAC;QAC1F,2EAA2E;QAC3E,2EAA2E;QAC3E,2DAA2D;aACtD,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAAC,CAAC;;YACnF,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,GAAG,CAAC,wCAAwC,CAAC,CAAC;IAC1E,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAE,CAAW,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;gCAQgC;AAChC,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EAAE,GAAuC;IAEvD,MAAM,KAAK,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACjH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;0CAK0C;AAC1C,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,OAAmB,CAAC;IACxB,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;QACnB,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,8BAA8B;QAC9B,OAAO,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAE,CAAW,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,kBAAkB;QAClB,IAAI,CAAC,CAAC,UAAU,KAAK,aAAa,IAAI,CAAC,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACvE,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,GAAG,8DAA8D,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE;gBACrD,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,QAAQ,EAAE,CAAC,CAAC,SAAS,IAAI,SAAS;gBAClC,eAAe,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;aACjD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,uBAAwB,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,6EAA6E;QAC7E,4EAA4E;QAC5E,oDAAoD;QACpD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;YACrD,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,uCAAuC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;YACnE,GAAG,CAAC,4CAA4C,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;gFAWgF;AAChF,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAc;IAChE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,MAAM,SAAS,CAAC,CAAC;IAC1F,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,OAAO,qBAAqB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;8BAgB8B;AAC9B,MAAM,UAAU,qBAAqB,CAAC,MAAe;IACnD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,GAAG,GAAG,MAAyB,CAAC;IACpC,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1F,GAAG,GAAG,GAAG,CAAC,IAAuB,CAAC;IACpC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACxG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxF,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI;QAAE,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC9D,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC9G,2EAA2E;IAC3E,4EAA4E;IAC5E,eAAe;IACf,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IACrC,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB,EAAE,KAAa;IACzD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,kBAAkB,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAoB,EAAE,KAAa,EAAE,KAAa;IACpE,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,MAAM,CAAC,gBAAgB,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,WAAW,KAAK,eAAe,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;;;;;;iFAQiF;AACjF,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC;AAE1F;;;;;;;uCAOuC;AACvC,MAAM,OAAO,GAAG,SAAS,CAAC;AAE1B;;;;;;;;;;0DAU0D;AAC1D,MAAM,UAAU,WAAW,CACzB,SAAiB,EAAE,kBAA2B,EAAE,MAAqB;IAErE,IAAI,MAAM,EAAE,OAAO,KAAK,mBAAmB;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC;AAC/D,CAAC;AAED;;;+DAG+D;AAC/D,MAAM,iBAAiB,GAA2B;IAChD,wBAAwB,EACtB,yEAAyE;QACzE,8DAA8D;IAChE,2BAA2B,EACzB,gEAAgE;QAChE,sCAAsC;CACzC,CAAC;AAEF;;;;;;;;mEAQmE;AACnE,MAAM,0BAA0B,GAC9B,qEAAqE;IACrE,yDAAyD,CAAC;AAC5D,MAAM,yBAAyB,GAC7B,mEAAmE;IACnE,uFAAuF,CAAC;AAE1F;;;;;;;;;;;;;GAaG;AACH,MAAM,sBAAsB,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAErG,SAAS,0BAA0B,CAAC,OAAe;IACjD,OAAO,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,wBAAwB,CAAC,CAAW,EAAE,IAA6B;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,0BAAoC,CAAC;IAC1D,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1E,CAAC,CAAC,IAAI,CACJ,sCAAsC,OAAO,uBAAuB;YAClE,4BAA4B,CAC/B,CAAC;QACF,OAAO;IACT,CAAC;IACD,KAAK,MAAM,GAAG,IAAK,IAAI,CAAC,OAAqC,IAAI,EAAE,EAAE,CAAC;QACpE,MAAM,IAAI,GAAG,GAAG,CAAC,WAAqB,CAAC;QACvC,IAAI,GAAG,CAAC,aAAa,KAAK,WAAW,EAAE,CAAC;YACtC,CAAC,CAAC,IAAI,CACJ,mBAAmB,IAAI,sBAAsB,GAAG,CAAC,eAAyB,KAAK;gBAC7E,0EAA0E;gBAC1E,yEAAyE,CAC5E,CAAC;QACJ,CAAC;aAAM,IAAI,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CACJ,mBAAmB,IAAI,sDAAsD;gBAC3E,iCAAiC,CACpC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,iCAAiC;YACjC,CAAC,CAAC,IAAI,CACJ,mBAAmB,IAAI,kBAAkB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG;gBACnF,kCAAkC,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,OAAQ,CAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAAU,EAAE,SAAiB,EAAE,YAAoB,EAAE,kBAA2B,EAChF,MAAmC,EAAE,MAAe,EAAE,MAAqB,EAC3E,OAAyB;IAEzB,MAAM,EAAE,GAAI,IAAI,CAAC,cAAyB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,WAAW,CAAE,IAAI,CAAC,OAAmC,CAAC,eAAe,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAsC,CAAC;IACxD,MAAM,CAAC,GAAa,EAAE,CAAC;IAEvB,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,+DAA+D;IAC/D,+DAA+D;IAC/D,IAAI,MAAM,EAAE,OAAO,KAAK,mBAAmB,EAAE,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,qCAAqC,CAAC,CAAC;QAC1E,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC,wCAAwC,SAAS,6CAA6C,CAAC,CAAC;QACvG,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,0BAA0B,EAAE,KAAK,SAAS,KAAK,IAAI,KAAK,CAAC;IACxF,4EAA4E;IAC5E,gEAAgE;IAChE,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,qBAAqB,CAAC,CAAC;QAC1D,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACjC,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,0BAA0B,EAAE,cAAc,SAAS,KAAK,CAAC;IACrG,IAAI,kBAAkB;QAAE,OAAO,0BAA0B,EAAE,4BAA4B,YAAY,KAAK,CAAC;IAEzG,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,GAAG,GAAG,SAAS,KAAK,wBAAwB;QAChD,CAAC,CAAC,GAAG,wBAAwB,KAAK,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,0BAA0B,GAAG;QACpG,CAAC,CAAC,4DAA4D,CAAC;IACjE,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,0BAAoC,EAAE,CAAC,CAAC;IAEzE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,oEAAoE;IACpE,0CAA0C;IAC1C,MAAM,GAAG,GAAI,IAAI,CAAC,OAAqC,IAAI,EAAE,CAAC;IAC9D,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3G,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAI,CAAC,CAAC,cAAyB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAI,CAAC,CAAC,cAAyB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,WAAqB,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAqB,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAEV,wEAAwE;IACxE,8EAA8E;IAC9E,yCAAyC;IACzC,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,MAA6C,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,EAAE,YAAY,CAAC;IAClC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,0BAAoC,CAAC;QAC1D,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,2DAA2D,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,IAAI,CACJ,2BAA2B,OAAO,wCAAwC;gBACxE,uCAAuC,IAAI,EAAE,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wBAAwB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAElC,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,YAAuC,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,WAAqB,yBAAyB,CAAC,CAAC;IACzF,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,uBAAuB,YAAY,KAAK,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjC,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9B,mBAAmB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAC7B,CAAC;AAED;;;;;;;;+EAQ+E;AAC/E,SAAS,mBAAmB,CAAC,CAAW,EAAE,CAA8B;IACtE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO;IAC5B,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACf,CAAC,CAAC,IAAI,CAAC,mEAAmE;YACxE,qEAAqE,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YACjB,wEAAwE;YACxE,sEAAsE;YACtE,sDAAsD;YACtD,CAAC,CAAC,IAAI,CAAC,gEAAgE;gBACrE,2EAA2E,CAAC,CAAC;QACjF,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC,SAAS,KAAK;YACrF,uDAAuD,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC,MAAM,MAAM;QACzE,6CAA6C,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;+CAM+C;AAC/C,SAAS,kBAAkB,CAAC,CAAW,EAAE,MAAgC;IACvE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,CAAC,CAAC,IAAI,CAAC,2BAA2B,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;0DAS0D;AAC1D,SAAS,qBAAqB,CAAC,CAAW,EAAE,MAAmC;IAC7E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,CAAC,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAClF,CAAC,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,IAAI,CAAC,sBAAsB,eAAe,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM;QAC5E,GAAG,eAAe,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACrD,8EAA8E;IAC9E,4EAA4E;IAC5E,gEAAgE;IAChE,CAAC,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;QAC3E,QAAQ,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI;QAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,0BAA0B,IAAI,IAAI,EAAE,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,IAAI,IAAI,EAAE,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;mEACmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,MAAY;IAC5C,IAAI,IAAI,GAAG,MAAM,CAAC;IAClB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,IAAI,GAAG,IAAI,CAAC,IAAY,CAAC;IAClF,IACE,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QAChE,IAAI,CAAC,WAAoB,CAAC,MAAM,KAAK,SAAS,EAC/C,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,WAAmB,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAS,CAAC,CAAC;IAC3F,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAExD,8EAA8E;IAC9E,8DAA8D;IAC9D,wDAAwD;IACxD,2EAA2E;IAC3E,8EAA8E;IAC9E,6CAA6C;IAC7C,IAAI,MAAmC,CAAC;IACxC,IAAI,MAAgC,CAAC;IACrC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAwB,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0EAA0E;YAC1E,yEAAyE;YACzE,mEAAmE;YACnE,mDAAmD;YACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iDAAiD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAChG,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,SAAS;QACT,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAgB,CAAC,CAAC;YAC9C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,wEAAwE;IACxE,8EAA8E;IAC9E,mDAAmD;IACnD,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,IAAI,CAAC;QAAC,SAAS,GAAG,MAAM,2BAA2B,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC;IAAC,CAAC;IAC9F,OAAO,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,YAAY,iBAAiB,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB;YAAE,SAAS,GAAG,OAAO,CAAC;;YACrF,SAAS,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IACpE,CAAC;IAED,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,YAAY,GAAG,eAAe,CAAC;IACnC,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC;QAAC,YAAY,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IACxE,OAAO,CAAC,EAAE,CAAC;QAAC,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QAAC,kBAAkB,GAAG,IAAI,CAAC;IAAC,CAAC;IAEzG,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAEjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CACtG,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,uEAAuE;AACvE,gFAAgF;AAChF,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAO7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AA+C1E;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAMjD,CAAC;AA6BH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CASlD;AAYD,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAQpD;AAoCD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;AAE7D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;2DAEuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;8CAE0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,aAAa,CAAC,CAqBxB;AAED,+CAA+C;AAC/C,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAC3D,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AACzE,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAoBnE;;;sEAGsE;AACtE,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAyB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAUrF;AAiFD,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpC,+DAA+D;AAC/D,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAyH7B;AAKD,+DAA+D;AAC/D,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAwF7B;AAMD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,IAAI,GAAG,UAAU,CAK3D;AAoFD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,OAAO,GAAG,MAAM,CAMnD;AA2WD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAW9E;AAqFD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,UAAU,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC,CAwDlB;AAGD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,UAAU,CAoBZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAqB5E;AAED,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACvC,GAAG,CAAC,EAAE,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CA8FjB"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAO7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAwE1E;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAQjD,CAAC;AAqIH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CASlD;AAYD,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAQpD;AAoCD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;AAE7D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;2DAEuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;8CAE0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,aAAa,CAAC,CAqBxB;AAED,+CAA+C;AAC/C,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAC3D,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AACzE,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAoBnE;;;sEAGsE;AACtE,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAyB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAUrF;AAiFD,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpC,+DAA+D;AAC/D,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CA0H7B;AAKD,+DAA+D;AAC/D,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAwF7B;AAMD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,IAAI,GAAG,UAAU,CAK3D;AAoFD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,OAAO,GAAG,MAAM,CAMnD;AAyaD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAW9E;AAqFD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,UAAU,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC,CAwDlB;AAGD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,UAAU,CAoBZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAqB5E;AAED,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACvC,GAAG,CAAC,EAAE,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CA8FjB"}

package/dist/esm/verify.js

@@ -50,6 +50,31 @@ const FORMAT_VERSION_V6 = "6.0";
 const PAYLOAD_TYPE_ATTESTATION_V7 = "burnledger.attestation.v7";
 const PAYLOAD_TYPE_VERIFICATION_RECORD_V7 = "burnledger.verification_record.v7";
 const FORMAT_VERSION_V7 = "7.0";
+// v8 adds one per-system field, recoverable_state: whether anything checked for
+// a restorable copy of what the record certifies gone. Its tags move for the
+// reason every earlier version's did, and this time the bytes under them differ
+// by that field. Everything v7 signs, v8 still signs.
+//
+// READ-ONLY IN THIS BUILD, mirroring core: nothing here issues a v8 record. A
+// verifier that can read a format has to ship BEFORE anything signs one, or a
+// genuine record reaches a holder whose SDK rebuilds it under the wrong domain
+// and reports a forgery (runbook invariant 5).
+const PAYLOAD_TYPE_ATTESTATION_V8 = "burnledger.attestation.v8";
+const PAYLOAD_TYPE_VERIFICATION_RECORD_V8 = "burnledger.verification_record.v8";
+const FORMAT_VERSION_V8 = "8.0";
+// v9 adds two per-system fields, authorization and customer_key_id: whether the
+// enclave checked this system against a customer-signed registration
+// certificate (ADR-025 §4), and under which customer key group if it did.
+//
+// The attestation gains NO field at v9. Its tag still moves, because the tag
+// follows the record's version and the record's bytes changed — a v9
+// attestation rebuilt under burnledger.attestation.v8 is a different preimage.
+//
+// READ-ONLY IN THIS BUILD, mirroring core, for the same runbook-invariant-5
+// reason spelled out for v8 above.
+const PAYLOAD_TYPE_ATTESTATION_V9 = "burnledger.attestation.v9";
+const PAYLOAD_TYPE_VERIFICATION_RECORD_V9 = "burnledger.verification_record.v9";
+const FORMAT_VERSION_V9 = "9.0";
 const FORMAT_VERSION_V3 = "3.0";
 /**
  * The only signature scheme this SDK can check. A v7 record names its own
@@ -73,6 +98,8 @@ export const KNOWN_FORMAT_VERSIONS = Object.freeze([
     FORMAT_VERSION_V5,
     FORMAT_VERSION_V6,
     FORMAT_VERSION_V7,
+    FORMAT_VERSION_V8,
+    FORMAT_VERSION_V9,
 ]);
 /**
  * Returns the version, or throws if this SDK cannot read it.
@@ -89,6 +116,90 @@ function checkFormatVersion(version) {
     }
     return version;
 }
+/**
+ * Is `version` the same format as `floor`, or a later one?
+ *
+ * Ordered by position in KNOWN_FORMAT_VERSIONS, never by string comparison:
+ * "10.0" sorts before "9.0". Port of core.formatAtLeast, and it exists for the
+ * reason the Go one does — four gates there were written as `v === "7.0"`, read
+ * by everyone as "7.0 and later", and behaved as "7.0 only". Three were live
+ * defects and one silently downgraded a security property the day v8 was
+ * defined.
+ *
+ * USE THIS, not equality, whenever the question is "does this format sign X".
+ * An unknown version answers false for every floor, which is safe only because
+ * checkFormatVersion has already refused it before any payload is rebuilt.
+ */
+function formatAtLeast(version, floor) {
+    const vi = KNOWN_FORMAT_VERSIONS.indexOf(version);
+    const fi = KNOWN_FORMAT_VERSIONS.indexOf(floor);
+    return vi >= 0 && fi >= 0 && vi >= fi;
+}
+/** Ports of the core.SignatureCovers* predicates, one per signed field group. */
+function signatureCoversEnclavePcr0(version) {
+    return formatAtLeast(version, FORMAT_VERSION_V5);
+}
+function signatureCoversAlgorithm(version) {
+    return formatAtLeast(version, FORMAT_VERSION_V7);
+}
+function signatureCoversMeasuredTransport(version) {
+    return formatAtLeast(version, FORMAT_VERSION_V7);
+}
+/**
+ * Does this format sign the per-system recoverable_state?
+ *
+ * v8 only, and everything after it. Emitting the field for v7 or older would
+ * rebuild bytes no signer ever produced and reject every record already issued;
+ * omitting it for v8 rebuilds a v7-shaped subset and reports a genuine v8
+ * record as forged.
+ */
+function signatureCoversRecoverableState(version) {
+    return formatAtLeast(version, FORMAT_VERSION_V8);
+}
+/**
+ * Does this format sign the per-system authorization and customer_key_id?
+ *
+ * v9 onward. `authorization` is always present on a v9 record; `customer_key_id`
+ * only when it is certified, and OMITTED rather than empty when it is not — a
+ * key id of "" would sign as a value, and a reader comparing against their own
+ * key id must not have to know that "" means "nobody".
+ */
+function signatureCoversAuthorization(version) {
+    return formatAtLeast(version, FORMAT_VERSION_V9);
+}
+/** The two values a v9 record's per-system authorization may take. */
+const AUTHORIZATION_CERTIFIED = "certified";
+const AUTHORIZATION_NONE = "none";
+/**
+ * Read a v9 system's authorization and key id, refusing what core refuses.
+ *
+ * Port of checkAuthorization in core/payload.go. It runs on the VERIFY side
+ * too, and must: an unset or unrecognized value is not something to rebuild
+ * bytes from and report as a bad signature — the record is malformed. The two
+ * refused combinations are the ones that would be a lie rather than a shape
+ * error: certified naming nobody is ADR-025 §2's second-key attack with the
+ * evidence removed, and none naming somebody claims an authority that was
+ * never checked.
+ */
+function requireAuthorization(s, systemName) {
+    const a = s.authorization;
+    if (a !== AUTHORIZATION_CERTIFIED && a !== AUTHORIZATION_NONE) {
+        throw new VerificationError(`system ${JSON.stringify(systemName)}: authorization is ${JSON.stringify(a ?? null)}, ` +
+            `which format ${FORMAT_VERSION_V9} requires to be one of certified, none`);
+    }
+    const raw = s.customer_key_id;
+    if (raw !== undefined && raw !== null && typeof raw !== "string") {
+        throw new VerificationError(`system ${JSON.stringify(systemName)}: customer_key_id is not a string`);
+    }
+    const customerKeyId = typeof raw === "string" ? raw : "";
+    if (a === AUTHORIZATION_CERTIFIED && customerKeyId === "") {
+        throw new VerificationError(`system ${JSON.stringify(systemName)}: authorization is certified but customer_key_id is empty`);
+    }
+    if (a === AUTHORIZATION_NONE && customerKeyId !== "") {
+        throw new VerificationError(`system ${JSON.stringify(systemName)}: authorization is none but customer_key_id is set`);
+    }
+    return { authorization: a, customerKeyId };
+}
 const PAYLOAD_TYPE_TREE_HEAD = "burnledger.sth.v3";
 // The domain for a tree head that names its log. See buildTreeHeadPayload.
 const PAYLOAD_TYPE_TREE_HEAD_V7 = "burnledger.sth.v7";
@@ -349,8 +460,9 @@ export async function verifyCertificate(crypto, certificate, publicKeys) {
     // Step 0b: can this SDK check the algorithm the record names? Asked before
     // any signature, because verifying an Ed25519 signature over a record that
     // says it was signed with something else answers a question nobody asked.
-    // Below v7 no record names one, so there is nothing to check.
-    if (formatVersion === FORMAT_VERSION_V7 && issuer.algorithm !== ALGORITHM_ED25519) {
+    // Below v7 no record names one, so there is nothing to check; from v7 on
+    // every record does, which is why this asks "v7 or later" rather than "v7".
+    if (signatureCoversAlgorithm(formatVersion) && issuer.algorithm !== ALGORITHM_ED25519) {
         throw new VerificationError(`record names signature algorithm ${JSON.stringify(issuer.algorithm)}; ` +
             `this version of the SDK verifies ${ALGORITHM_ED25519}. ` +
             "The record may be genuine and simply signed with a scheme this library does not implement.", UNSUPPORTED_ALGORITHM);
@@ -729,10 +841,16 @@ function civilFromDays(days) {
 // ---------------------------------------------------------------------------
 function buildAttestationPayload(subject, att, certFormatVersion) {
     const attestedAt = formatTimestamp(att.attested_at);
-    // v7 signs two per-system measurements v6 leaves on a mutable row. Gated on
-    // the record's OWN version: emitting them for an older format would rebuild
-    // bytes no signer ever produced and reject every record already issued.
-    const isV7 = certFormatVersion === FORMAT_VERSION_V7;
+    // v7 signs two per-system measurements v6 leaves on a mutable row, and v8
+    // adds recoverable_state beside them. Both gated on the record's OWN version:
+    // emitting a field for an older format would rebuild bytes no signer ever
+    // produced and reject every record already issued.
+    //
+    // Predicates, not equalities. v8 signs everything v7 signs, so a `=== "7.0"`
+    // here would drop read_only_enforcement and transport_security out of a v8
+    // payload and call every genuine v8 record a forgery.
+    const coversMeasured = signatureCoversMeasuredTransport(certFormatVersion);
+    const coversRecoverable = signatureCoversRecoverableState(certFormatVersion);
     const systems = att.systems.map((s) => {
         const sys = {
             canonical_version: s.canonical_version ?? null,
@@ -748,9 +866,12 @@ function buildAttestationPayload(subject, att, certFormatVersion) {
             system_id: s.system_id,
             system_name: s.system_name,
         };
-        if (isV7) {
-            sys.read_only_enforcement = requireMeasured(s.read_only_enforcement, "read_only_enforcement", s.system_name);
-            sys.transport_security = requireMeasured(s.transport_security, "transport_security", s.system_name);
+        if (coversMeasured) {
+            sys.read_only_enforcement = requireMeasured(s.read_only_enforcement, "read_only_enforcement", s.system_name, certFormatVersion);
+            sys.transport_security = requireMeasured(s.transport_security, "transport_security", s.system_name, certFormatVersion);
+        }
+        if (coversRecoverable) {
+            sys.recoverable_state = requireMeasured(s.recoverable_state, "recoverable_state", s.system_name, certFormatVersion);
         }
         return sys;
     });
@@ -764,17 +885,21 @@ function buildAttestationPayload(subject, att, certFormatVersion) {
     return canonicalJson(payload);
 }
 /**
- * Read a v7 measured field that MUST be a non-empty string.
+ * Read a signed measured field that MUST be a non-empty string.
  *
  * A missing or non-string value cannot be turned into `""` and canonicalized:
  * the signer never emits an empty measurement, so an empty one here would
  * rebuild bytes no signature covers and be reported as forgery. Refusing with a
  * document-shape message says the true thing — this record is malformed, not
  * this record is fake.
+ *
+ * The version is passed in rather than written into the message: it was the
+ * literal "7.0" here, which would have told the holder of an incomplete v8
+ * record that their v8 document was a v7 one.
  */
-function requireMeasured(value, field, systemName) {
+function requireMeasured(value, field, systemName, version) {
     if (typeof value !== "string" || value === "") {
-        throw new VerificationError(`system ${JSON.stringify(systemName)}: ${field} is missing from a 7.0 record, ` +
+        throw new VerificationError(`system ${JSON.stringify(systemName)}: ${field} is missing from a ${version} record, ` +
             "which signs it; the document is incomplete rather than unverifiable");
     }
     return value;
@@ -782,6 +907,10 @@ function requireMeasured(value, field, systemName) {
 /** Domain separator for the record itself, by certificate format version. */
 function certificatePayloadType(version) {
     checkFormatVersion(version);
+    if (version === FORMAT_VERSION_V9)
+        return PAYLOAD_TYPE_VERIFICATION_RECORD_V9;
+    if (version === FORMAT_VERSION_V8)
+        return PAYLOAD_TYPE_VERIFICATION_RECORD_V8;
     if (version === FORMAT_VERSION_V7)
         return PAYLOAD_TYPE_VERIFICATION_RECORD_V7;
     if (version === FORMAT_VERSION_V6)
@@ -800,6 +929,13 @@ function certificatePayloadType(version) {
  */
 function attestationPayloadType(version) {
     checkFormatVersion(version);
+    // Equality here, deliberately: each format has its OWN separator, so this is
+    // a lookup rather than a "this version onward" question. v3 and v4 share one
+    // because their attestation bytes are identical.
+    if (version === FORMAT_VERSION_V9)
+        return PAYLOAD_TYPE_ATTESTATION_V9;
+    if (version === FORMAT_VERSION_V8)
+        return PAYLOAD_TYPE_ATTESTATION_V8;
     if (version === FORMAT_VERSION_V7)
         return PAYLOAD_TYPE_ATTESTATION_V7;
     if (version === FORMAT_VERSION_V6)
@@ -816,7 +952,9 @@ function buildCertificatePayload(cert) {
     // and a verification list joined only on the human-editable system_name,
     // which made a partial deletion indistinguishable from a complete one.
     const version = cert.certificate_format_version;
-    const isV7 = version === FORMAT_VERSION_V7;
+    const coversMeasured = signatureCoversMeasuredTransport(version);
+    const coversRecoverable = signatureCoversRecoverableState(version);
+    const coversAuthorization = signatureCoversAuthorization(version);
     const systems = (cert.systems ?? []).map((s) => {
         const sys = {
             attested_at: formatTimestamp(s.attested_at),
@@ -831,9 +969,18 @@ function buildCertificatePayload(cert) {
             verified_at: formatTimestamp(s.verified_at),
             verified_count: s.verified_count,
         };
-        if (isV7) {
-            sys.read_only_enforcement = requireMeasured(s.read_only_enforcement, "read_only_enforcement", s.system_name);
-            sys.transport_security = requireMeasured(s.transport_security, "transport_security", s.system_name);
+        if (coversMeasured) {
+            sys.read_only_enforcement = requireMeasured(s.read_only_enforcement, "read_only_enforcement", s.system_name, version);
+            sys.transport_security = requireMeasured(s.transport_security, "transport_security", s.system_name, version);
+        }
+        if (coversRecoverable) {
+            sys.recoverable_state = requireMeasured(s.recoverable_state, "recoverable_state", s.system_name, version);
+        }
+        if (coversAuthorization) {
+            const { authorization, customerKeyId } = requireAuthorization(s, s.system_name);
+            sys.authorization = authorization;
+            if (customerKeyId !== "")
+                sys.customer_key_id = customerKeyId;
         }
         return sys;
     });
@@ -847,11 +994,12 @@ function buildCertificatePayload(cert) {
     // Fields added after v3 are gated on the certificate's OWN version. A v3
     // certificate must reconstruct to the same bytes forever; reading these
     // unconditionally would break every certificate already issued.
-    // v6 carries v5's shape exactly, so it takes every gate v5 takes. Naming
-    // these "Plus" rather than testing equality at each use is what stops a new
-    // version from silently missing one.
-    const isV5Plus = version === FORMAT_VERSION_V5 || version === FORMAT_VERSION_V6 || isV7;
-    const isV4Plus = version === FORMAT_VERSION_V4 || isV5Plus;
+    // v6 carries v5's shape exactly, so it takes every gate v5 takes. Asking
+    // "this version onward" rather than listing versions at each use is what
+    // stops a new format from silently missing one: these were a chain of
+    // equalities that had to be extended by hand for v6, then v7, then v8.
+    const isV5Plus = formatAtLeast(version, FORMAT_VERSION_V5);
+    const isV4Plus = formatAtLeast(version, FORMAT_VERSION_V4);
     const issuerObj = {
         key_id: issuer.key_id,
         name: issuer.name,
@@ -860,15 +1008,17 @@ function buildCertificatePayload(cert) {
     // v7 signs the algorithm, and does so unconditionally: unlike legal_entity
     // and enclave_pcr0, "which scheme signed this" is never unknown to a signer,
     // so a v7 record missing it is malformed rather than merely sparse.
-    if (isV7) {
-        issuerObj.algorithm = requireMeasured(issuer.algorithm, "issuer.algorithm", "issuer");
+    if (signatureCoversAlgorithm(version)) {
+        issuerObj.algorithm = requireMeasured(issuer.algorithm, "issuer.algorithm", "issuer", version);
     }
     if (isV4Plus && typeof issuer.legal_entity === "string" && issuer.legal_entity !== "") {
         issuerObj.legal_entity = issuer.legal_entity;
     }
     // Signed from v5, and omitted when absent or empty: a build with no
     // measurement signs none, and "" is a value a reader could mistake for one.
-    if (isV5Plus && typeof issuer.enclave_pcr0 === "string" && issuer.enclave_pcr0 !== "") {
+    if (signatureCoversEnclavePcr0(version) &&
+        typeof issuer.enclave_pcr0 === "string" &&
+        issuer.enclave_pcr0 !== "") {
         issuerObj.enclave_pcr0 = issuer.enclave_pcr0;
     }
     // v5 drops identifier_type_hint: signed, but always the constant "custom",
@@ -937,6 +1087,10 @@ function attestationSystems(cert) {
         // reads them.
         read_only_enforcement: s.read_only_enforcement,
         transport_security: s.transport_security,
+        // Same reasoning for v8. It is measured at attest time and carried
+        // unchanged onto the outcome, so projecting it back is a copy; dropping it
+        // here would make every genuine v8 record fail its attestation signature.
+        recoverable_state: s.recoverable_state,
     }));
 }
 /**