burnledger 0.8.1 → 0.9.1

package/dist/cjs/enclave-registration.js

@@ -0,0 +1,287 @@
+"use strict";
+/**
+ * The customer's side of ADR-025: verify the enclave, enrol a key group, rotate
+ * it, register a system under it.
+ *
+ * Request-building and response-checking for the BurnLedger client's methods of
+ * the same names, kept in a Node-only module the client imports lazily — the
+ * client is also the browser entry's, and these need node:crypto. Nothing here
+ * holds a private key: every signature comes from a {@link KeyGroupSigner} (see
+ * key-group.ts for why, and for what losing a key costs).
+ *
+ * WHAT THE CHECKS ON EACH RESPONSE ARE FOR. The API relays every byte, so the
+ * documents it returns are only worth what the client checks, and it checks two
+ * things. First, that the enclave signed them — under the signing key of an
+ * enclave the caller attested against its own pinned PCR0. Without that, a relay
+ * could hand the customer a forged enrolment and they would believe themselves
+ * registered when nothing was. The key set at /.well-known/burnledger-keys is not
+ * the anchor for this: the same API serves it, so a relay that forged a document
+ * could publish the forging key beside it. Second, that they are about what the
+ * caller asked for. ADR-025 §2 names the load-bearing comparison: the enrolment
+ * statement must name the key group the customer generated. A relay that enrolled
+ * its own group instead would hand back a genuine, enclave-signed statement
+ * naming a key the customer does not hold; this comparison is where that stops
+ * being invisible. The enrolment and the authorization must also be for the team
+ * the customer named, and the authorization must end exactly at the `not_after`
+ * the customer signed and not start in the future: a relay that replayed an
+ * older genuine answer, or another team's, would otherwise have the caller
+ * believe a fresh window exists. The registration must name this key, this
+ * system, this config digest and this connector, or it registered something
+ * else.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.attestationParams = attestationParams;
+exports.identityFromResponse = identityFromResponse;
+exports.enrollBody = enrollBody;
+exports.rotateBody = rotateBody;
+exports.checkEnrollment = checkEnrollment;
+exports.configBytes = configBytes;
+exports.registrationBody = registrationBody;
+exports.checkRegistration = checkRegistration;
+const node_crypto_1 = require("node:crypto");
+const crypto_node_js_1 = require("./crypto-node.js");
+const customer_keys_js_1 = require("./customer-keys.js");
+const enclave_seal_js_1 = require("./enclave-seal.js");
+const errors_js_1 = require("./errors.js");
+const key_group_js_1 = require("./key-group.js");
+const models_js_1 = require("./models.js");
+const verify_js_1 = require("./verify.js");
+/** Mirrors core.DefaultAuthorizationWindow, the longest window the enclave
+ * grants: a request that names no `notAfter` asks for all of it. */
+const DEFAULT_AUTHORIZATION_WINDOW_MS = 90 * 24 * 60 * 60 * 1000;
+/** How far ahead of this machine's clock an authorization may start: room for
+ * an enclave clock that runs a little ahead, as core's notAfterSkew leaves room
+ * for a customer clock that does. Not room for a document from the future. */
+const NOT_BEFORE_SKEW_MS = 5 * 60 * 1000;
+function toHex(bytes) {
+    return Buffer.from(bytes).toString("hex");
+}
+function sha256(bytes) {
+    return new Uint8Array((0, node_crypto_1.createHash)("sha256").update(bytes).digest());
+}
+function boundOf(notAfter) {
+    return notAfter ?? new Date(Date.now() + DEFAULT_AUTHORIZATION_WINDOW_MS);
+}
+// --- ATTEST_IDENTITY ----------------------------------------------------------
+/**
+ * The challenge and the query string that carries it. A nonce the checked party
+ * chose — including one the API suggested — proves nothing about when the
+ * document was produced, so it is drawn here unless the caller brings its own.
+ */
+function attestationParams(nonce) {
+    const drawn = nonce ?? node_crypto_1.webcrypto.getRandomValues(new Uint8Array(enclave_seal_js_1.IDENTITY_NONCE_SIZE));
+    return { nonce: drawn, params: { nonce: Buffer.from(drawn).toString("base64url") } };
+}
+/**
+ * Verify the document the API returned against this caller's own challenge. The
+ * `nonce` the API echoes beside the document is ignored: nothing signs it. The
+ * check is against the nonce inside the document, under AWS's signature.
+ */
+async function identityFromResponse(data, options) {
+    const raw = data?.nsm_attestation;
+    if (typeof raw !== "string") {
+        throw new errors_js_1.VerificationError("the attestation response carries no nsm_attestation");
+    }
+    return (0, enclave_seal_js_1.verifyEnclaveIdentity)(new Uint8Array(Buffer.from(raw, "base64")), options);
+}
+// --- ENROLL_KEY / ROTATE_KEY --------------------------------------------------
+function groupBody(group, signatures) {
+    return {
+        threshold: group.threshold,
+        member_keys: group.members.map(toHex),
+        signatures,
+    };
+}
+/**
+ * The ENROLL_KEY request, the key id it enrols and the `not_after` it signs.
+ * EVERY member signs.
+ */
+async function enrollBody(opts) {
+    const keyId = await (0, customer_keys_js_1.customerKeyId)(crypto_node_js_1.nodeCrypto, opts.group);
+    const bound = boundOf(opts.notAfter);
+    const payload = (0, customer_keys_js_1.buildKeyEnrollmentRequestPayload)({
+        assertedTeamId: opts.teamId,
+        customerKeyId: keyId,
+        notAfter: bound,
+    });
+    const signatures = await (0, key_group_js_1.signWithGroup)(payload, opts.group, opts.signers, opts.group.members.length);
+    const notAfter = (0, customer_keys_js_1.keyTime)(bound);
+    return {
+        body: {
+            asserted_team_id: opts.teamId.toLowerCase(),
+            not_after: notAfter,
+            ...groupBody(opts.group, signatures),
+        },
+        keyId,
+        notAfter,
+    };
+}
+/**
+ * The ROTATE_KEY request. Both groups sign the same key_rotation_request.v2: the
+ * OUTGOING group at its threshold, to spend its authority, and EVERY incoming
+ * member, to prove it holds its key.
+ */
+async function rotateBody(opts) {
+    const prevKeyId = await (0, customer_keys_js_1.customerKeyId)(crypto_node_js_1.nodeCrypto, opts.previousGroup);
+    const nextKeyId = await (0, customer_keys_js_1.customerKeyId)(crypto_node_js_1.nodeCrypto, opts.nextGroup);
+    const bound = boundOf(opts.notAfter);
+    const payload = (0, customer_keys_js_1.buildKeyRotationRequestPayload)({
+        assertedTeamId: opts.teamId,
+        prevKeyId,
+        nextKeyId,
+        notAfter: bound,
+    });
+    const signatures = await (0, key_group_js_1.signWithGroup)(payload, opts.previousGroup, opts.previousSigners, opts.previousGroup.threshold);
+    const nextSignatures = await (0, key_group_js_1.signWithGroup)(payload, opts.nextGroup, opts.nextSigners, opts.nextGroup.members.length);
+    const notAfter = (0, customer_keys_js_1.keyTime)(bound);
+    return {
+        body: {
+            asserted_team_id: opts.teamId.toLowerCase(),
+            prev_key_id: prevKeyId,
+            not_after: notAfter,
+            next_signatures: nextSignatures,
+            ...groupBody(opts.nextGroup, signatures),
+        },
+        prevKeyId,
+        nextKeyId,
+        notAfter,
+    };
+}
+/**
+ * Verify both documents ENROLL_KEY and ROTATE_KEY return under the attested
+ * enclave's signing key, then refuse them unless they name the group this caller
+ * holds and the team it asked for, link to the predecessor it expects, end
+ * exactly at the `notAfter` (whole-second UTC) it signed, and do not start in
+ * the future. `teamId` is the team the request asserted; the SDK always asserts
+ * one, so there is no request this check has no team for.
+ *
+ * The end must be EXACT. A protocol-12 enclave ends the grant at the signed
+ * bound, to the second, so any other end answers some other request -- which is
+ * what a relay replaying an older genuine response, or dropping a renewal,
+ * hands back.
+ */
+async function checkEnrollment(data, opts) {
+    const raw = (data ?? {});
+    await (0, customer_keys_js_1.verifyKeyEnrollmentStatement)(crypto_node_js_1.nodeCrypto, raw.enrollment, opts.enclave.signingKey);
+    await (0, customer_keys_js_1.verifyTeamAuthorization)(crypto_node_js_1.nodeCrypto, raw.authorization, opts.enclave.signingKey);
+    const result = (0, models_js_1.parseKeyEnrollmentResult)(raw);
+    const { enrollment, authorization } = result;
+    // One comparison covers the members and threshold too: a key id is a hash
+    // over both, and a verified statement's id is the one its own group derives.
+    if (enrollment.customerKeyId !== opts.keyId || authorization.customerKeyId !== opts.keyId) {
+        throw new errors_js_1.VerificationError(`the enclave's statement names key ${JSON.stringify(enrollment.customerKeyId)} ` +
+            `(authorization ${JSON.stringify(authorization.customerKeyId)}), not the group you ` +
+            `enrolled (${JSON.stringify(opts.keyId)}). Do not use it: this is what a substituted key looks like.`);
+    }
+    if (authorization.prevKeyId !== opts.prevKeyId) {
+        throw new errors_js_1.VerificationError(`the authorization links to predecessor ${JSON.stringify(authorization.prevKeyId ?? null)}, ` +
+            `expected ${JSON.stringify(opts.prevKeyId ?? null)}`);
+    }
+    const team = opts.teamId.toLowerCase();
+    for (const [what, named] of [
+        ["enrolment statement", enrollment.assertedTeamId],
+        ["authorization", authorization.assertedTeamId],
+    ]) {
+        if (named.toLowerCase() !== team) {
+            throw new errors_js_1.VerificationError(`the ${what} is for team ${named}, not the team you asked for (${team}). ` +
+                "Do not use it: a relay replaying another team's answer would produce exactly this.");
+        }
+    }
+    // Compared as the whole-second strings both sides sign, not as parsed
+    // dates: a Date has milliseconds, and a fraction on the wire is nobody's.
+    const granted = (0, verify_js_1.formatTimestamp)(raw.authorization.not_after, "authorization.not_after");
+    if (granted !== opts.notAfter) {
+        throw new errors_js_1.VerificationError(`the authorization ends at ${granted}, not at the not_after you signed (${opts.notAfter}). ` +
+            "The enclave ends the grant exactly there, so this answers some other request; " +
+            "a relay replaying an older response would produce exactly this.");
+    }
+    const now = opts.now ?? new Date();
+    if (!(now instanceof Date) || Number.isNaN(now.getTime())) {
+        throw new TypeError("now must be a valid Date");
+    }
+    if (authorization.notBefore.getTime() > now.getTime() + NOT_BEFORE_SKEW_MS) {
+        const starts = (0, verify_js_1.formatTimestamp)(raw.authorization.not_before, "authorization.not_before");
+        throw new errors_js_1.VerificationError(`the authorization starts at ${starts}, more than five minutes after this machine's clock ` +
+            `(${(0, customer_keys_js_1.keyTime)(now)}): the answer to a request just made cannot start in the future`);
+    }
+    return result;
+}
+// --- REGISTER_SYSTEM ----------------------------------------------------------
+/** The exact bytes sealed, and therefore the bytes `config_digest` is over. */
+function configBytes(config) {
+    return new TextEncoder().encode(JSON.stringify(config));
+}
+/**
+ * The REGISTER_SYSTEM request, its key id and the config digest it signs.
+ *
+ * `config` must be the EXACT bytes submitted when the system was created — the
+ * plaintext that was sealed, or the `connection_config` JSON text as sent. An
+ * object is refused: re-serializing it produces bytes that may differ by one
+ * space from what the enclave decrypts, and the refusal would be a 401 with no
+ * way to see why.
+ */
+async function registrationBody(opts) {
+    const config = typeof opts.config === "string" ? new TextEncoder().encode(opts.config) : opts.config;
+    if (!(config instanceof Uint8Array)) {
+        throw new TypeError("config must be the exact bytes (or text) submitted when the system was created, " +
+            "not a re-serializable object");
+    }
+    const keyId = await (0, customer_keys_js_1.customerKeyId)(crypto_node_js_1.nodeCrypto, opts.group);
+    const configDigest = sha256(config);
+    const payload = (0, customer_keys_js_1.buildSystemRegistrationRequestPayload)({
+        assertedTeamId: opts.teamId,
+        systemId: opts.systemId,
+        configDigest,
+        queryTemplateSha256: sha256(new TextEncoder().encode(opts.queryTemplate)),
+        connectorType: opts.connectorType,
+        customerKeyId: keyId,
+    });
+    const signatures = await (0, key_group_js_1.signWithGroup)(payload, opts.group, opts.signers, opts.group.threshold);
+    return {
+        body: {
+            asserted_team_id: opts.teamId.toLowerCase(),
+            system_id: opts.systemId.toLowerCase(),
+            query_template: opts.queryTemplate,
+            ...groupBody(opts.group, signatures),
+        },
+        keyId,
+        configDigest,
+    };
+}
+/** Verify the registration under the attested enclave's signing key, then refuse
+ * it unless it binds the key id, system id, config digest and connector this
+ * caller signed.
+ *
+ * Two signed fields are deliberately NOT compared here, so the binding is
+ * narrower than "everything you signed". `query_template_hash` in the answer is
+ * HashQuery over the NORMALIZED subject query, while the request signs sha256 of
+ * the RAW template; the two are not byte-equal even for an honest registration,
+ * so comparing them would reject legitimate answers (see the README's
+ * "query-template normalization" note). `registered_at` is not checked for
+ * freshness either: there is no signed bound to hold it to. A relay could
+ * therefore substitute an older genuine registration for the same system, config,
+ * connector and key but a different query template — the customer path calls this
+ * immediately after its own POST, which narrows that window but does not close it. */
+async function checkRegistration(data, opts) {
+    const raw = data?.registration;
+    await (0, customer_keys_js_1.verifySystemRegistration)(crypto_node_js_1.nodeCrypto, raw, opts.enclave.signingKey);
+    const registration = (0, models_js_1.parseSystemRegistrationCertificate)(raw);
+    const wrong = [];
+    if (registration.customerKeyId !== opts.keyId) {
+        wrong.push(`customer_key_id is ${JSON.stringify(registration.customerKeyId)}, expected ${JSON.stringify(opts.keyId)}`);
+    }
+    if (String(registration.systemId).toLowerCase() !== opts.systemId.toLowerCase()) {
+        wrong.push(`system_id is ${JSON.stringify(registration.systemId)}, expected ${JSON.stringify(opts.systemId)}`);
+    }
+    if (toHex(registration.configDigest) !== toHex(opts.configDigest)) {
+        wrong.push(`config_digest is ${toHex(registration.configDigest)}, expected ${toHex(opts.configDigest)}`);
+    }
+    if (registration.connectorType !== opts.connectorType) {
+        wrong.push(`connector_type is ${JSON.stringify(registration.connectorType)}, expected ${JSON.stringify(opts.connectorType)}`);
+    }
+    if (wrong.length > 0) {
+        throw new errors_js_1.VerificationError(`the enclave's registration does not bind what you signed: ${wrong.join(", ")}`);
+    }
+    return registration;
+}
+//# sourceMappingURL=enclave-registration.js.map

package/dist/cjs/enclave-registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enclave-registration.js","sourceRoot":"","sources":["../../src/enclave-registration.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;;;;;;;;;;AAEH,6CAAoD;AACpD,qDAA8C;AAC9C,yDAU4B;AAC5B,uDAK2B;AAC3B,2CAAgD;AAChD,iDAAoE;AACpE,2CAMqB;AACrB,2CAA8C;AAkB9C;oEACoE;AACpE,MAAM,+BAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjE;;8EAE8E;AAC9E,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,SAAS,KAAK,CAAC,KAAiB;IAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,IAAI,UAAU,CAAC,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,OAAO,CAAC,QAA0B;IACzC,OAAO,QAAQ,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,+BAA+B,CAAC,CAAC;AAC5E,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,2BAAkC,KAAkB;IAIlD,MAAM,KAAK,GAAG,KAAK,IAAI,uBAAS,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,qCAAmB,CAAC,CAAC,CAAC;IACtF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACI,KAAK,+BACV,IAAa,EACb,OAA4C;IAE5C,MAAM,GAAG,GAAI,IAAmB,EAAE,eAAe,CAAC;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,6BAAiB,CAAC,qDAAqD,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,IAAA,uCAAqB,EAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACpF,CAAC;AAED,iFAAiF;AAEjF,SAAS,SAAS,CAAC,KAAuB,EAAE,UAAkC;IAC5E,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;QACrC,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;GAGG;AACI,KAAK,qBAAqB,IAKhC;IACC,MAAM,KAAK,GAAG,MAAM,IAAA,gCAAa,EAAC,2BAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAA,mDAAgC,EAAC;QAC/C,cAAc,EAAE,IAAI,CAAC,MAAM;QAC3B,aAAa,EAAE,KAAK;QACpB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,IAAA,4BAAa,EAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrG,MAAM,QAAQ,GAAG,IAAA,0BAAO,EAAC,KAAK,CAAC,CAAC;IAChC,OAAO;QACL,IAAI,EAAE;YACJ,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;YAC3C,SAAS,EAAE,QAAQ;YACnB,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC;SACrC;QACD,KAAK;QACL,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACI,KAAK,qBAAqB,IAOhC;IACC,MAAM,SAAS,GAAG,MAAM,IAAA,gCAAa,EAAC,2BAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,IAAA,gCAAa,EAAC,2BAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAA,iDAA8B,EAAC;QAC7C,cAAc,EAAE,IAAI,CAAC,MAAM;QAC3B,SAAS;QACT,SAAS;QACT,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,IAAA,4BAAa,EACpC,OAAO,EACP,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,aAAa,CAAC,SAAS,CAC7B,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,IAAA,4BAAa,EACxC,OAAO,EACP,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAC9B,CAAC;IACF,MAAM,QAAQ,GAAG,IAAA,0BAAO,EAAC,KAAK,CAAC,CAAC;IAChC,OAAO;QACL,IAAI,EAAE;YACJ,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;YAC3C,WAAW,EAAE,SAAS;YACtB,SAAS,EAAE,QAAQ;YACnB,eAAe,EAAE,cAAc;YAC/B,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC;SACzC;QACD,SAAS;QACT,SAAS;QACT,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACI,KAAK,0BACV,IAAa,EACb,IAQC;IAED,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAQ,CAAC;IAChC,MAAM,IAAA,+CAA4B,EAAC,2BAAU,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxF,MAAM,IAAA,0CAAuB,EAAC,2BAAU,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,IAAA,oCAAwB,EAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IAC7C,0EAA0E;IAC1E,6EAA6E;IAC7E,IAAI,UAAU,CAAC,aAAa,KAAK,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,aAAa,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1F,MAAM,IAAI,6BAAiB,CACzB,qCAAqC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG;YAC9E,kBAAkB,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,aAAa,CAAC,uBAAuB;YACpF,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,8DAA8D,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,6BAAiB,CACzB,0CAA0C,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI;YAC3F,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,EAAE,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,qBAAqB,EAAE,UAAU,CAAC,cAAc,CAAC;QAClD,CAAC,eAAe,EAAE,aAAa,CAAC,cAAc,CAAC;KACvC,EAAE,CAAC;QACX,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,6BAAiB,CACzB,OAAO,IAAI,gBAAgB,KAAK,iCAAiC,IAAI,KAAK;gBACxE,oFAAoF,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,sEAAsE;IACtE,0EAA0E;IAC1E,MAAM,OAAO,GAAG,IAAA,2BAAe,EAAE,GAAG,CAAC,aAAqB,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACjG,IAAI,OAAO,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,6BAAiB,CACzB,6BAA6B,OAAO,sCAAsC,IAAI,CAAC,QAAQ,KAAK;YAC1F,gFAAgF;YAChF,iEAAiE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,CAAC,GAAG,YAAY,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,kBAAkB,EAAE,CAAC;QAC3E,MAAM,MAAM,GAAG,IAAA,2BAAe,EAAE,GAAG,CAAC,aAAqB,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;QAClG,MAAM,IAAI,6BAAiB,CACzB,+BAA+B,MAAM,sDAAsD;YACzF,IAAI,IAAA,0BAAO,EAAC,GAAG,CAAC,iEAAiE,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iFAAiF;AAEjF,+EAA+E;AAC/E,qBAA4B,MAA+B;IACzD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,2BAA2B,IAQtC;IACC,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IACxF,IAAI,CAAC,CAAC,MAAM,YAAY,UAAU,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CACjB,kFAAkF;YAChF,8BAA8B,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAA,gCAAa,EAAC,2BAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,IAAA,wDAAqC,EAAC;QACpD,cAAc,EAAE,IAAI,CAAC,MAAM;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY;QACZ,mBAAmB,EAAE,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,aAAa,EAAE,KAAK;KACrB,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,IAAA,4BAAa,EAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChG,OAAO;QACL,IAAI,EAAE;YACJ,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;YAC3C,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE;YACtC,cAAc,EAAE,IAAI,CAAC,aAAa;YAClC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC;SACrC;QACD,KAAK;QACL,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;sFAasF;AAC/E,KAAK,4BACV,IAAa,EACb,IAMC;IAED,MAAM,GAAG,GAAI,IAAmB,EAAE,YAAY,CAAC;IAC/C,MAAM,IAAA,2CAAwB,EAAC,2BAAU,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,IAAA,8CAAkC,EAAC,GAAU,CAAC,CAAC;IACpE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,YAAY,CAAC,aAAa,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,aAAa,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAChF,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,YAAY,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,aAAa,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAChI,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,6BAAiB,CACzB,6DAA6D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/cjs/enclave-seal.d.ts

@@ -98,4 +98,47 @@ export declare function sealToKey(recipientPublicKey: Uint8Array, plaintext: Uin
  * one from an enclave the host itself booted — would pass.
  */
 export declare function verifyEnclaveConfigSealKey(attestationDocument: Uint8Array, options: SealOptions): Promise<Uint8Array>;
+/** Mirrors enclave.AttestIdentityNonceSize. */
+export declare const IDENTITY_NONCE_SIZE = 32;
+/**
+ * What an ATTEST_IDENTITY document establishes once verified: which keys, held
+ * by an enclave running which image, answering THIS caller's challenge.
+ */
+export interface EnclaveIdentity {
+    /** The X25519 key to seal connection configs to. */
+    readonly configSealKey: Uint8Array;
+    /** The enclave's Ed25519 signing key, read out of the signed document. */
+    readonly signingKey: Uint8Array;
+    /** `dp_k_` + hex(SHA-256(signingKey)) — the id /.well-known/burnledger-keys publishes. */
+    readonly signingKeyId: string;
+    /** The PCR0 the document reports, hex. Equal to the one pinned, or this would have thrown. */
+    readonly pcr0: string;
+}
+export interface IdentityOptions extends SealOptions {
+    /**
+     * The 32-byte challenge sent with the request. Draw it from your own entropy:
+     * a nonce the party being checked chose proves nothing about when the
+     * document was produced.
+     */
+    nonce: Uint8Array;
+}
+/**
+ * Verify an ATTEST_IDENTITY document (`GET /v1/enclave/attestation?nonce=`).
+ *
+ * Port of enclave.VerifyIdentityAttestation: everything
+ * {@link verifyEnclaveConfigSealKey} checks, and then that the document carries
+ * exactly the nonce this caller sent and binds a 32-byte Ed25519 signing key in
+ * `user_data`.
+ *
+ * THE NONCE CHECK IS THE POINT. The other checks pass for every document this
+ * enclave image has ever produced, including one captured months ago and
+ * replayed by a relay that has since swapped keys. Only a document carrying the
+ * challenge this caller drew, under AWS's signature, is a statement about now.
+ *
+ * What a pass means, and no more: these keys are held by an AWS Nitro Enclave
+ * running an image that measures to the pinned PCR0, and it answered this
+ * challenge within five minutes of `now`. It does not mean the image was built
+ * from any particular source.
+ */
+export declare function verifyEnclaveIdentity(attestationDocument: Uint8Array, options: IdentityOptions): Promise<EnclaveIdentity>;
 //# sourceMappingURL=enclave-seal.d.ts.map

package/dist/cjs/enclave-seal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enclave-seal.d.ts","sourceRoot":"","sources":["../../src/enclave-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAIH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,yBAAmE,CAAC;AAG/F,eAAO,MAAM,WAAW,QAAoD,CAAC;AAG7E;;;GAGG;AACH,eAAO,MAAM,iBAAiB,6xBAc7B,CAAC;AAMF,+EAA+E;AAC/E,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,sEAAsE;IACtE,GAAG,CAAC,EAAE,IAAI,CAAC;IACX;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,UAAU,EACrD,mBAAmB,EAAE,UAAU,EAC/B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,kBAAkB,EAAE,UAAU,EAC9B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,UAAU,CAAC,CAuCrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,0BAA0B,CAC9C,mBAAmB,EAAE,UAAU,EAC/B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,CA8CrB"}
+{"version":3,"file":"enclave-seal.d.ts","sourceRoot":"","sources":["../../src/enclave-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAUH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,yBAAmE,CAAC;AAG/F,eAAO,MAAM,WAAW,QAAoD,CAAC;AAG7E;;;GAGG;AACH,eAAO,MAAM,iBAAiB,6xBAc7B,CAAC;AAMF,+EAA+E;AAC/E,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,sEAAsE;IACtE,GAAG,CAAC,EAAE,IAAI,CAAC;IACX;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,UAAU,EACrD,mBAAmB,EAAE,UAAU,EAC/B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,kBAAkB,EAAE,UAAU,EAC9B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,UAAU,CAAC,CAuCrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,0BAA0B,CAC9C,mBAAmB,EAAE,UAAU,EAC/B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,CAErB;AAED,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,QAAQ,CAAC,aAAa,EAAE,UAAU,CAAC;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,0FAA0F;IAC1F,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,8FAA8F;IAC9F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD;;;;OAIG;IACH,KAAK,EAAE,UAAU,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CACzC,mBAAmB,EAAE,UAAU,EAC/B,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,eAAe,CAAC,CAmC1B"}

package/dist/cjs/enclave-seal.js

@@ -35,10 +35,11 @@
  * point.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EnclaveAttestationError = exports.NITRO_ROOT_G1_PEM = exports.HEADER_SIZE = exports.ENVELOPE_MAGIC = void 0;
+exports.IDENTITY_NONCE_SIZE = exports.EnclaveAttestationError = exports.NITRO_ROOT_G1_PEM = exports.HEADER_SIZE = exports.ENVELOPE_MAGIC = void 0;
 exports.sealConnectionConfig = sealConnectionConfig;
 exports.sealToKey = sealToKey;
 exports.verifyEnclaveConfigSealKey = verifyEnclaveConfigSealKey;
+exports.verifyEnclaveIdentity = verifyEnclaveIdentity;
 const node_crypto_1 = require("node:crypto");
 /**
  * Envelope wire format (v1). Must match enclave/configsealkey.go byte for byte:
@@ -140,6 +141,62 @@ async function sealToKey(recipientPublicKey, plaintext) {
  * one from an enclave the host itself booted — would pass.
  */
 async function verifyEnclaveConfigSealKey(attestationDocument, options) {
+    return configSealKeyOf(verifyDocument(attestationDocument, options));
+}
+/** Mirrors enclave.AttestIdentityNonceSize. */
+exports.IDENTITY_NONCE_SIZE = 32;
+/**
+ * Verify an ATTEST_IDENTITY document (`GET /v1/enclave/attestation?nonce=`).
+ *
+ * Port of enclave.VerifyIdentityAttestation: everything
+ * {@link verifyEnclaveConfigSealKey} checks, and then that the document carries
+ * exactly the nonce this caller sent and binds a 32-byte Ed25519 signing key in
+ * `user_data`.
+ *
+ * THE NONCE CHECK IS THE POINT. The other checks pass for every document this
+ * enclave image has ever produced, including one captured months ago and
+ * replayed by a relay that has since swapped keys. Only a document carrying the
+ * challenge this caller drew, under AWS's signature, is a statement about now.
+ *
+ * What a pass means, and no more: these keys are held by an AWS Nitro Enclave
+ * running an image that measures to the pinned PCR0, and it answered this
+ * challenge within five minutes of `now`. It does not mean the image was built
+ * from any particular source.
+ */
+async function verifyEnclaveIdentity(attestationDocument, options) {
+    const sent = options.nonce;
+    if (!(sent instanceof Uint8Array) || sent.length !== exports.IDENTITY_NONCE_SIZE) {
+        throw new EnclaveAttestationError(`challenge nonce is ${sent instanceof Uint8Array ? sent.length : 0} bytes, want exactly ` +
+            `${exports.IDENTITY_NONCE_SIZE} (this is a bug in the caller, not a bad document)`);
+    }
+    const payload = verifyDocument(attestationDocument, options);
+    const carried = payload.get("nonce");
+    if (!(carried instanceof Uint8Array) ||
+        carried.length !== sent.length ||
+        !(0, node_crypto_1.timingSafeEqual)(carried, sent)) {
+        throw new EnclaveAttestationError(`the document answers a different challenge than the one sent (sent ${toHex(sent)}, ` +
+            `document carries ${carried instanceof Uint8Array ? toHex(carried) : "none"}) — a genuine ` +
+            "document replayed for someone else's nonce proves nothing about now");
+    }
+    const signingKey = payload.get("user_data");
+    if (!(signingKey instanceof Uint8Array) || signingKey.length !== 32) {
+        const got = signingKey instanceof Uint8Array ? signingKey.length : 0;
+        throw new EnclaveAttestationError(`the document binds ${got} bytes where an Ed25519 public key belongs, want 32`);
+    }
+    const pcr0 = payload.get("pcrs").get(0);
+    return {
+        configSealKey: configSealKeyOf(payload),
+        signingKey,
+        signingKeyId: "dp_k_" + (0, node_crypto_1.createHash)("sha256").update(signingKey).digest("hex"),
+        pcr0: toHex(pcr0),
+    };
+}
+/**
+ * The checks every enclave document gets, whatever is read out of it after:
+ * COSE structure and algorithm, the chain to the pinned root, the signature, the
+ * AWS timestamp against `now`, and the pinned PCRs. Returns the verified payload.
+ */
+function verifyDocument(attestationDocument, options) {
     if (!attestationDocument || attestationDocument.length === 0) {
         throw new EnclaveAttestationError("no attestation document (nothing to verify — this is not a pass)");
     }
@@ -168,6 +225,10 @@ async function verifyEnclaveConfigSealKey(attestationDocument, options) {
     verifyCoseSignature(leaf, protectedBytes, payloadBytes, signature);
     checkClock(payload.get("timestamp"), now);
     matchPcrs(pcrs, expected);
+    return payload;
+}
+/** The 32-byte X25519 config-seal key a verified payload binds in `public_key`. */
+function configSealKeyOf(payload) {
     const publicKey = payload.get("public_key");
     if (!(publicKey instanceof Uint8Array) || publicKey.length !== KEY_SIZE) {
         const got = publicKey instanceof Uint8Array ? publicKey.length : 0;

package/dist/cjs/enclave-seal.js.map

@@ -1 +1 @@
-{"version":3,"file":"enclave-seal.js","sourceRoot":"","sources":["../../src/enclave-seal.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;;;;;;AAEH,6CAA+E;AAE/E;;;;;;;;;;;GAWG;AACU,QAAA,cAAc,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa;AAC7G,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,UAAU,GAAG,EAAE,CAAC;AACT,QAAA,WAAW,GAAG,QAAA,cAAc,CAAC,MAAM,GAAG,CAAC,GAAG,QAAQ,GAAG,UAAU,CAAC;AAC7E,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;AAEvE;;;GAGG;AACU,QAAA,iBAAiB,GAAG;;;;;;;;;;;;;;CAchC,CAAC;AAEF,qDAAqD;AACrD,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,cAAc,GAAG,CAAC,EAAE,CAAC;AAE3B,+EAA+E;AAC/E,6BAAqC,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;;AAgBD;;;;;;GAMG;AACI,KAAK,+BACV,MAAqD,EACrD,mBAA+B,EAC/B,OAAoB;IAEpB,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACI,KAAK,oBACV,kBAA8B,EAC9B,SAAqB;IAErB,IAAI,kBAAkB,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,uBAAuB,CAC/B,gCAAgC,kBAAkB,CAAC,MAAM,gBAAgB,QAAQ,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,IAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,uBAAS,CAAC,MAAM,CAAC,SAAS,CACrC,KAAK,EACL,YAAY,CAAC,kBAAkB,CAAC,EAChC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,KAAK,EACL,EAAE,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAAC,8BAA+B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,MAAM,uBAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;QAC9E,YAAY;KACb,CAAC,CAAuC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,UAAU,CAC3B,MAAM,uBAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,CAC/F,CAAC;IACF,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,uBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAC7D,CAAC;IAEF,MAAM,KAAK,GAAG,uBAAS,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAA,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,UAAU,CAC3B,MAAM,uBAAS,CAAC,MAAM,CAAC,OAAO,CAC5B,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,EACtD,MAAM,EACN,YAAY,CAAC,SAAS,CAAC,CACxB,CACF,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;GAYG;AACI,KAAK,qCACV,mBAA+B,EAC/B,OAAoB;IAEpB,IAAI,CAAC,mBAAmB,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,uBAAuB,CAC/B,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAA2B,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;IAC7E,IAAI,OAAO,CAAC,YAAY;QAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;IAC7D,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,uBAAuB,CAC/B,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAEtC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,GACnE,eAAe,CAAC,mBAAmB,CAAC,CAAC;IACvC,aAAa,CAAC,cAAc,CAAC,CAAC;IAE9B,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,OAAO,YAAY,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,uBAAuB,CAAC,uCAAuC,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,OAAO,YAAY,UAAU,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,uBAAuB,CAAC,yCAAyC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAAC,kCAAkC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,IAAI,QAAA,iBAAiB,CAAC,CAAC;IACtG,mBAAmB,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IACnE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1C,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE1B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxE,MAAM,GAAG,GAAG,SAAS,YAAY,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,IAAI,uBAAuB,CAC/B,wBAAwB,GAAG,4BAA4B,QAAQ,eAAe;YAC5E,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACH,SAAS,WAAW,CAClB,OAAmB,EACnB,QAAiB,EACjB,GAAS,EACT,OAAe;IAEf,IAAI,IAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,6BAAe,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAAC,oCAAqC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,uBAAuB,CAAC,0CAA0C,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAC1B,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,IAAI,6BAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,2BAA4B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACtG,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,IAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,6BAAe,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAAC,mCAAoC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;QACrD,MAAM,IAAI,uBAAuB,CAC/B,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,OAAO;QAAE,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,kCAAkC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAqB,EAAE,GAAS;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,oCAAoC,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IACxB,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,uBAAuB,CAC/B,eAAe,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,oBAAoB,GAAG,CAAC,WAAW,EAAE,GAAG;YACtF,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAAqB,EACrB,cAA0B,EAC1B,OAAmB,EACnB,SAAqB;IAErB,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,uBAAuB,CAC/B,gBAAgB,SAAS,CAAC,MAAM,8BAA8B,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5F,8EAA8E;IAC9E,MAAM,EAAE,GAAG,IAAA,oBAAU,EACnB,QAAQ,EACR,YAAY,EACZ,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,EAClD,SAAS,CACV,CAAC;IACF,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,uBAAuB,CAAC,2CAA2C,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,UAAU,CAAC,SAAkB,EAAE,GAAS;IAC/C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,uBAAuB,CAC/B,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC;IACjD,IAAI,IAAI,GAAG,iBAAiB,EAAE,CAAC;QAC7B,MAAM,IAAI,uBAAuB,CAC/B,mCAAmC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,mBAAmB;YACrF,oBAAoB,GAAG,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,kBAAkB;YACpF,eAAe,iBAAiB,GAAG,IAAI,SAAS,CACnD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAA6B,EAAE,QAAgC;IAChF,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,uBAAuB,CAAC,8BAA8B,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,uBAAuB,CAC/B,MAAM,KAAK,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,OAAO,6CAA6C,CAC/F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,MAAkB,EAClB,MAA+B;IAE/B,MAAM,GAAG,GAAG,MAAM,uBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACvF,WAAW;KACZ,CAAC,CAAC;IACH,OAAO,uBAAS,CAAC,MAAM,CAAC,SAAS,CAC/B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAC/D,GAAG,EACH,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAqD;IAExE,IAAI,MAAM,YAAY,UAAU;QAAE,OAAO,MAAM,CAAC;IAChD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,CAAa;IACjC,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,GAAG,KAAmB;IACpC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,KAAK,CAAC,CAAa;IAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,+EAA+E;AAC/E,0EAA0E;AAC1E,uEAAuE;AACvE,iCAAiC;AAEjC,SAAS,eAAe,CAAC,GAAe;IAKtC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,cAAc;IACpE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,AAAD,EAAG,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI;QACzB,CAAC,kBAAkB,EAAE,IAAI,CAAC;QAC1B,CAAC,SAAS,EAAE,OAAO,CAAC;QACpB,CAAC,WAAW,EAAE,SAAS,CAAC;KAChB,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,uBAAuB,CAAC,cAAc,IAAI,uBAAuB,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAkB;QAC7B,OAAO,EAAE,OAAqB;QAC9B,SAAS,EAAE,SAAuB;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,cAA0B;IAC/C,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,uBAAuB,CAAC,mCAAmC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAAC,eAAe,GAAG,iBAAiB,cAAc,GAAG,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAID,SAAS,UAAU,CAAC,IAAgB;IAClC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAC/B,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,sCAAsC,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,IAAgB,EAAE,KAAa;IAC/C,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,uBAAuB,CAAC,4BAA4B,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,OAAO,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAClB,IAAI,GAAW,CAAC;IAEhB,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;QACd,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;SAAM,IAAI,IAAI,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;SACnD,IAAI,IAAI,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;SACjD,IAAI,IAAI,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;SACjD,IAAI,IAAI,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;SACjD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAAC,+CAA+C,CAAC,CAAC;IACrF,CAAC;;QAAM,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;IAEzF,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,CAAC;YACJ,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAClB,KAAK,CAAC;YACJ,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACvB,KAAK,CAAC,CAAC;QACP,KAAK,CAAC,EAAE,CAAC;YACP,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;YACpB,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,uBAAuB,CAAC,4CAA4C,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9F,CAAC;QACD,KAAK,CAAC,EAAE,CAAC;YACP,MAAM,KAAK,GAAgB,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjB,CAAC,GAAG,IAAI,CAAC;YACX,CAAC;YACD,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,EAAE,CAAC;YACP,MAAM,GAAG,GAAG,IAAI,GAAG,EAAwB,CAAC;YAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7B,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC1C,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACjD,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjB,8DAA8D;oBAC9D,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7E,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAClB,CAAC,GAAG,QAAQ,CAAC;YACf,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,EAAE,qDAAqD;YAC3D,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3B,KAAK,CAAC;YACJ,IAAI,IAAI,KAAK,EAAE;gBAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACnC,IAAI,IAAI,KAAK,EAAE;gBAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,EAAE;gBAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAClC,MAAM,IAAI,uBAAuB,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;QAC7E;YACE,MAAM,IAAI,uBAAuB,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAgB,EAAE,CAAS,EAAE,KAAa;IAC1D,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,uBAAuB,CAAC,6CAA6C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;QAAE,KAAK,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAAC,6CAA6C,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,UAAU,CAAC,KAAgB;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,uBAAuB,CAAC,sBAAsB,OAAO,KAAK,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC1C,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC;IACxB,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;IAClD,IAAI,GAAG,GAAG,KAAK;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACzD,IAAI,GAAG,GAAG,OAAO;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;IAC5E,OAAO,IAAI,UAAU,CAAC;QACpB,IAAI,GAAG,EAAE;QACT,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI;QACnB,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI;QACnB,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI;QAClB,GAAG,GAAG,IAAI;KACX,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"enclave-seal.js","sourceRoot":"","sources":["../../src/enclave-seal.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;;;;;;;AAEH,6CAMqB;AAErB;;;;;;;;;;;GAWG;AACU,QAAA,cAAc,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa;AAC7G,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,UAAU,GAAG,EAAE,CAAC;AACT,QAAA,WAAW,GAAG,QAAA,cAAc,CAAC,MAAM,GAAG,CAAC,GAAG,QAAQ,GAAG,UAAU,CAAC;AAC7E,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;AAEvE;;;GAGG;AACU,QAAA,iBAAiB,GAAG;;;;;;;;;;;;;;CAchC,CAAC;AAEF,qDAAqD;AACrD,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,cAAc,GAAG,CAAC,EAAE,CAAC;AAE3B,+EAA+E;AAC/E,6BAAqC,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;;AAgBD;;;;;;GAMG;AACI,KAAK,+BACV,MAAqD,EACrD,mBAA+B,EAC/B,OAAoB;IAEpB,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACI,KAAK,oBACV,kBAA8B,EAC9B,SAAqB;IAErB,IAAI,kBAAkB,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,uBAAuB,CAC/B,gCAAgC,kBAAkB,CAAC,MAAM,gBAAgB,QAAQ,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,IAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,uBAAS,CAAC,MAAM,CAAC,SAAS,CACrC,KAAK,EACL,YAAY,CAAC,kBAAkB,CAAC,EAChC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,KAAK,EACL,EAAE,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAAC,8BAA+B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,MAAM,uBAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;QAC9E,YAAY;KACb,CAAC,CAAuC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,UAAU,CAC3B,MAAM,uBAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,CAC/F,CAAC;IACF,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,uBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAC7D,CAAC;IAEF,MAAM,KAAK,GAAG,uBAAS,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAA,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,UAAU,CAC3B,MAAM,uBAAS,CAAC,MAAM,CAAC,OAAO,CAC5B,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,EACtD,MAAM,EACN,YAAY,CAAC,SAAS,CAAC,CACxB,CACF,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;GAYG;AACI,KAAK,qCACV,mBAA+B,EAC/B,OAAoB;IAEpB,OAAO,eAAe,CAAC,cAAc,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,+CAA+C;AAClC,QAAA,mBAAmB,GAAG,EAAE,CAAC;AA0BtC;;;;;;;;;;;;;;;;;GAiBG;AACI,KAAK,gCACV,mBAA+B,EAC/B,OAAwB;IAExB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAA,mBAAmB,EAAE,CAAC;QACzE,MAAM,IAAI,uBAAuB,CAC/B,sBAAsB,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,uBAAuB;YACvF,GAAG,QAAA,mBAAmB,oDAAoD,CAC7E,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,IACE,CAAC,CAAC,OAAO,YAAY,UAAU,CAAC;QAChC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAC9B,CAAC,IAAA,6BAAe,EAAC,OAAO,EAAE,IAAI,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,sEAAsE,KAAK,CAAC,IAAI,CAAC,IAAI;YACnF,oBAAoB,OAAO,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,gBAAgB;YAC3F,qEAAqE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,UAAU,YAAY,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACpE,MAAM,GAAG,GAAG,UAAU,YAAY,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,IAAI,uBAAuB,CAC/B,sBAAsB,GAAG,qDAAqD,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAA2B,CAAC,GAAG,CAAC,CAAC,CAAe,CAAC;IACjF,OAAO;QACL,aAAa,EAAE,eAAe,CAAC,OAAO,CAAC;QACvC,UAAU;QACV,YAAY,EAAE,OAAO,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC7E,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;KAClB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CACrB,mBAA+B,EAC/B,OAAoB;IAEpB,IAAI,CAAC,mBAAmB,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,uBAAuB,CAC/B,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAA2B,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;IAC7E,IAAI,OAAO,CAAC,YAAY;QAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;IAC7D,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,uBAAuB,CAC/B,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAEtC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,GACnE,eAAe,CAAC,mBAAmB,CAAC,CAAC;IACvC,aAAa,CAAC,cAAc,CAAC,CAAC;IAE9B,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,OAAO,YAAY,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,uBAAuB,CAAC,uCAAuC,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,OAAO,YAAY,UAAU,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,uBAAuB,CAAC,yCAAyC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAAC,kCAAkC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,IAAI,QAAA,iBAAiB,CAAC,CAAC;IACtG,mBAAmB,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IACnE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1C,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mFAAmF;AACnF,SAAS,eAAe,CAAC,OAA8B;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxE,MAAM,GAAG,GAAG,SAAS,YAAY,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,IAAI,uBAAuB,CAC/B,wBAAwB,GAAG,4BAA4B,QAAQ,eAAe;YAC5E,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACH,SAAS,WAAW,CAClB,OAAmB,EACnB,QAAiB,EACjB,GAAS,EACT,OAAe;IAEf,IAAI,IAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,6BAAe,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAAC,oCAAqC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,uBAAuB,CAAC,0CAA0C,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAC1B,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,IAAI,6BAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,2BAA4B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACtG,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,IAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,6BAAe,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAAC,mCAAoC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;QACrD,MAAM,IAAI,uBAAuB,CAC/B,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,OAAO;QAAE,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,kCAAkC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAqB,EAAE,GAAS;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,oCAAoC,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IACxB,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,uBAAuB,CAC/B,eAAe,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,oBAAoB,GAAG,CAAC,WAAW,EAAE,GAAG;YACtF,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAAqB,EACrB,cAA0B,EAC1B,OAAmB,EACnB,SAAqB;IAErB,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,uBAAuB,CAC/B,gBAAgB,SAAS,CAAC,MAAM,8BAA8B,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5F,8EAA8E;IAC9E,MAAM,EAAE,GAAG,IAAA,oBAAU,EACnB,QAAQ,EACR,YAAY,EACZ,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,EAClD,SAAS,CACV,CAAC;IACF,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,uBAAuB,CAAC,2CAA2C,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,UAAU,CAAC,SAAkB,EAAE,GAAS;IAC/C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,uBAAuB,CAC/B,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC;IACjD,IAAI,IAAI,GAAG,iBAAiB,EAAE,CAAC;QAC7B,MAAM,IAAI,uBAAuB,CAC/B,mCAAmC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,mBAAmB;YACrF,oBAAoB,GAAG,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,kBAAkB;YACpF,eAAe,iBAAiB,GAAG,IAAI,SAAS,CACnD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAA6B,EAAE,QAAgC;IAChF,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,uBAAuB,CAAC,8BAA8B,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,uBAAuB,CAC/B,MAAM,KAAK,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,OAAO,6CAA6C,CAC/F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,MAAkB,EAClB,MAA+B;IAE/B,MAAM,GAAG,GAAG,MAAM,uBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACvF,WAAW;KACZ,CAAC,CAAC;IACH,OAAO,uBAAS,CAAC,MAAM,CAAC,SAAS,CAC/B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAC/D,GAAG,EACH,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAqD;IAExE,IAAI,MAAM,YAAY,UAAU;QAAE,OAAO,MAAM,CAAC;IAChD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,CAAa;IACjC,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,GAAG,KAAmB;IACpC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,KAAK,CAAC,CAAa;IAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,+EAA+E;AAC/E,0EAA0E;AAC1E,uEAAuE;AACvE,iCAAiC;AAEjC,SAAS,eAAe,CAAC,GAAe;IAKtC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,cAAc;IACpE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,AAAD,EAAG,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI;QACzB,CAAC,kBAAkB,EAAE,IAAI,CAAC;QAC1B,CAAC,SAAS,EAAE,OAAO,CAAC;QACpB,CAAC,WAAW,EAAE,SAAS,CAAC;KAChB,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,uBAAuB,CAAC,cAAc,IAAI,uBAAuB,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAkB;QAC7B,OAAO,EAAE,OAAqB;QAC9B,SAAS,EAAE,SAAuB;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,cAA0B;IAC/C,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,uBAAuB,CAAC,mCAAmC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAAC,eAAe,GAAG,iBAAiB,cAAc,GAAG,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAID,SAAS,UAAU,CAAC,IAAgB;IAClC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAC/B,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,sCAAsC,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,IAAgB,EAAE,KAAa;IAC/C,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,uBAAuB,CAAC,4BAA4B,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,OAAO,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAClB,IAAI,GAAW,CAAC;IAEhB,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;QACd,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;SAAM,IAAI,IAAI,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;SACnD,IAAI,IAAI,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;SACjD,IAAI,IAAI,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;SACjD,IAAI,IAAI,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;SACjD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAAC,+CAA+C,CAAC,CAAC;IACrF,CAAC;;QAAM,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;IAEzF,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,CAAC;YACJ,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAClB,KAAK,CAAC;YACJ,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACvB,KAAK,CAAC,CAAC;QACP,KAAK,CAAC,EAAE,CAAC;YACP,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;YACpB,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,uBAAuB,CAAC,4CAA4C,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9F,CAAC;QACD,KAAK,CAAC,EAAE,CAAC;YACP,MAAM,KAAK,GAAgB,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjB,CAAC,GAAG,IAAI,CAAC;YACX,CAAC;YACD,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,EAAE,CAAC;YACP,MAAM,GAAG,GAAG,IAAI,GAAG,EAAwB,CAAC;YAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7B,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC1C,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACjD,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjB,8DAA8D;oBAC9D,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7E,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAClB,CAAC,GAAG,QAAQ,CAAC;YACf,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,EAAE,qDAAqD;YAC3D,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3B,KAAK,CAAC;YACJ,IAAI,IAAI,KAAK,EAAE;gBAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACnC,IAAI,IAAI,KAAK,EAAE;gBAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,EAAE;gBAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAClC,MAAM,IAAI,uBAAuB,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;QAC7E;YACE,MAAM,IAAI,uBAAuB,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAgB,EAAE,CAAS,EAAE,KAAa;IAC1D,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,uBAAuB,CAAC,6CAA6C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;QAAE,KAAK,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAAC,6CAA6C,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,UAAU,CAAC,KAAgB;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,uBAAuB,CAAC,sBAAsB,OAAO,KAAK,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC1C,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC;IACxB,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;IAClD,IAAI,GAAG,GAAG,KAAK;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACzD,IAAI,GAAG,GAAG,OAAO;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;IAC5E,OAAO,IAAI,UAAU,CAAC;QACpB,IAAI,GAAG,EAAE;QACT,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI;QACnB,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI;QACnB,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI;QAClB,GAAG,GAAG,IAAI;KACX,CAAC,CAAC;AACL,CAAC"}

package/dist/cjs/errors.d.ts

@@ -85,6 +85,16 @@ export declare class VerificationError extends BurnLedgerError {
 }
 /** {@link VerificationError.code} for a verified statement that says REVOKED. */
 export declare const CERTIFICATE_REVOKED = "CERTIFICATE_REVOKED";
+/**
+ * {@link VerificationError.code} when a record verified but does not meet the
+ * `requireAuthorization` policy the caller asked for: a system that is not
+ * `certified`, one certified under a key the caller does not accept, a required
+ * system the record does not cover, a format that predates registration, or a
+ * record from an enclave image that could say `certified` without the customer's
+ * signature (protocol 11 or earlier, or none named). A fact about the record,
+ * not a failure to read it.
+ */
+export declare const AUTHORIZATION_POLICY_FAILED = "AUTHORIZATION_POLICY_FAILED";
 /**
  * The record is in a format this SDK does not know how to read.
  *

package/dist/cjs/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,QAAS,SAAQ,eAAe;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,YAAY,IAAI,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,EAQA;CACF;AAED,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAGrE;CACF;AAED,qBAAa,aAAc,SAAQ,QAAQ;IACzC,YAAY,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAGrE;CACF;AAED,qBAAa,aAAc,SAAQ,QAAQ;IACzC,YAAY,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAGrE;CACF;AAED,qBAAa,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAGrE;CACF;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAExC,YAAY,IAAI,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,EAIA;CACF;AAED,qBAAa,WAAY,SAAQ,QAAQ;IACvC,YAAY,IAAI,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,EAGA;CACF;AAED,qBAAa,YAAa,SAAQ,eAAe;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,YAAY,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAK7C;CACF;AAED,qBAAa,iBAAkB,SAAQ,eAAe;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB,YAAY,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAKxC;CACF;AAED,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAkB7D,uEAAuE;AACvE,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,UAAU,CAAC,EAAE,MAAM,GAClB,KAAK,CAqBP"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,QAAS,SAAQ,eAAe;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,YAAY,IAAI,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,EAQA;CACF;AAED,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAGrE;CACF;AAED,qBAAa,aAAc,SAAQ,QAAQ;IACzC,YAAY,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAGrE;CACF;AAED,qBAAa,aAAc,SAAQ,QAAQ;IACzC,YAAY,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAGrE;CACF;AAED,qBAAa,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAGrE;CACF;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAExC,YAAY,IAAI,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,EAIA;CACF;AAED,qBAAa,WAAY,SAAQ,QAAQ;IACvC,YAAY,IAAI,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,EAGA;CACF;AAED,qBAAa,YAAa,SAAQ,eAAe;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,YAAY,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAK7C;CACF;AAED,qBAAa,iBAAkB,SAAQ,eAAe;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB,YAAY,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAKxC;CACF;AAED,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAkB7D,uEAAuE;AACvE,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,UAAU,CAAC,EAAE,MAAM,GAClB,KAAK,CAqBP"}

package/dist/cjs/errors.js

@@ -5,7 +5,7 @@
  * enough context for log correlation.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UNSUPPORTED_ALGORITHM = exports.UNSUPPORTED_FORMAT_VERSION = exports.CERTIFICATE_REVOKED = exports.VerificationError = exports.TimeoutError = exports.ServerError = exports.RateLimitError = exports.ValidationError = exports.ConflictError = exports.NotFoundError = exports.AuthenticationError = exports.ApiError = exports.BurnLedgerError = void 0;
+exports.UNSUPPORTED_ALGORITHM = exports.UNSUPPORTED_FORMAT_VERSION = exports.AUTHORIZATION_POLICY_FAILED = exports.CERTIFICATE_REVOKED = exports.VerificationError = exports.TimeoutError = exports.ServerError = exports.RateLimitError = exports.ValidationError = exports.ConflictError = exports.NotFoundError = exports.AuthenticationError = exports.ApiError = exports.BurnLedgerError = void 0;
 exports.raiseForError = raiseForError;
 class BurnLedgerError extends Error {
     constructor(message) {
@@ -106,6 +106,16 @@ class VerificationError extends BurnLedgerError {
 exports.VerificationError = VerificationError;
 /** {@link VerificationError.code} for a verified statement that says REVOKED. */
 exports.CERTIFICATE_REVOKED = "CERTIFICATE_REVOKED";
+/**
+ * {@link VerificationError.code} when a record verified but does not meet the
+ * `requireAuthorization` policy the caller asked for: a system that is not
+ * `certified`, one certified under a key the caller does not accept, a required
+ * system the record does not cover, a format that predates registration, or a
+ * record from an enclave image that could say `certified` without the customer's
+ * signature (protocol 11 or earlier, or none named). A fact about the record,
+ * not a failure to read it.
+ */
+exports.AUTHORIZATION_POLICY_FAILED = "AUTHORIZATION_POLICY_FAILED";
 /**
  * The record is in a format this SDK does not know how to read.
  *

package/dist/cjs/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;AAEH,qBAA6B,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;;AAED,cAAsB,SAAQ,eAAe;IAClC,IAAI,CAAS;IACb,UAAU,CAAS;IACnB,SAAS,CAAS;IAE3B,YAAY,IAKX;QACC,KAAK,CACH,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,gBAAgB,IAAI,CAAC,SAAS,GAAG,CACpF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;CACF;;AAED,yBAAiC,SAAQ,QAAQ;IAC/C,YAAY,IAA0D;QACpE,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;;AAED,mBAA2B,SAAQ,QAAQ;IACzC,YAAY,IAA0D;QACpE,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;;AAED,mBAA2B,SAAQ,QAAQ;IACzC,YAAY,IAA0D;QACpE,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;;AAED,qBAA6B,SAAQ,QAAQ;IAC3C,YAAY,IAA0D;QACpE,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;;AAED,oBAA4B,SAAQ,QAAQ;IACjC,UAAU,CAAqB;IAExC,YAAY,IAKX;QACC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;CACF;;AAED,iBAAyB,SAAQ,QAAQ;IACvC,YAAY,IAKX;QACC,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;;AAED,kBAA0B,SAAQ,eAAe;IACtC,SAAS,CAAS;IAClB,OAAO,CAAS;IAEzB,YAAY,SAAiB,EAAE,OAAe;QAC5C,KAAK,CAAC,GAAG,SAAS,qBAAqB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;;AAED,uBAA+B,SAAQ,eAAe;IAC3C,MAAM,CAAS;IACxB;;;;;;;;;;OAUG;IACM,IAAI,CAAU;IAEvB,YAAY,MAAc,EAAE,IAAa;QACvC,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;;AAED,iFAAiF;AACpE,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD;;;;;;;;;;;GAWG;AACU,QAAA,0BAA0B,GAAG,4BAA4B,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACU,QAAA,qBAAqB,GAAG,uBAAuB,CAAC;AAE7D,MAAM,eAAe,GAQjB;IACF,GAAG,EAAE,mBAAmB;IACxB,GAAG,EAAE,aAAa;IAClB,GAAG,EAAE,aAAa;IAClB,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,cAAc;CACpB,CAAC;AAEF,uEAAuE;AACvE,uBACE,UAAkB,EAClB,IAA6B,EAC7B,UAAmB;IAEnB,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,IAAI,GAAI,GAAG,CAAC,IAAe,IAAI,SAAS,CAAC;IAC/C,MAAM,OAAO,GAAI,GAAG,CAAC,OAAkB,IAAI,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAI,GAAG,CAAC,UAAqB,IAAI,EAAE,CAAC;IAEnD,MAAM,GAAG,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAExC,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;AAEH,qBAA6B,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;;AAED,cAAsB,SAAQ,eAAe;IAClC,IAAI,CAAS;IACb,UAAU,CAAS;IACnB,SAAS,CAAS;IAE3B,YAAY,IAKX;QACC,KAAK,CACH,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,gBAAgB,IAAI,CAAC,SAAS,GAAG,CACpF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;CACF;;AAED,yBAAiC,SAAQ,QAAQ;IAC/C,YAAY,IAA0D;QACpE,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;;AAED,mBAA2B,SAAQ,QAAQ;IACzC,YAAY,IAA0D;QACpE,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;;AAED,mBAA2B,SAAQ,QAAQ;IACzC,YAAY,IAA0D;QACpE,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;;AAED,qBAA6B,SAAQ,QAAQ;IAC3C,YAAY,IAA0D;QACpE,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;;AAED,oBAA4B,SAAQ,QAAQ;IACjC,UAAU,CAAqB;IAExC,YAAY,IAKX;QACC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;CACF;;AAED,iBAAyB,SAAQ,QAAQ;IACvC,YAAY,IAKX;QACC,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;;AAED,kBAA0B,SAAQ,eAAe;IACtC,SAAS,CAAS;IAClB,OAAO,CAAS;IAEzB,YAAY,SAAiB,EAAE,OAAe;QAC5C,KAAK,CAAC,GAAG,SAAS,qBAAqB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;;AAED,uBAA+B,SAAQ,eAAe;IAC3C,MAAM,CAAS;IACxB;;;;;;;;;;OAUG;IACM,IAAI,CAAU;IAEvB,YAAY,MAAc,EAAE,IAAa;QACvC,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;;AAED,iFAAiF;AACpE,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD;;;;;;;;GAQG;AACU,QAAA,2BAA2B,GAAG,6BAA6B,CAAC;AAEzE;;;;;;;;;;;GAWG;AACU,QAAA,0BAA0B,GAAG,4BAA4B,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACU,QAAA,qBAAqB,GAAG,uBAAuB,CAAC;AAE7D,MAAM,eAAe,GAQjB;IACF,GAAG,EAAE,mBAAmB;IACxB,GAAG,EAAE,aAAa;IAClB,GAAG,EAAE,aAAa;IAClB,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,cAAc;CACpB,CAAC;AAEF,uEAAuE;AACvE,uBACE,UAAkB,EAClB,IAA6B,EAC7B,UAAmB;IAEnB,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,IAAI,GAAI,GAAG,CAAC,IAAe,IAAI,SAAS,CAAC;IAC/C,MAAM,OAAO,GAAI,GAAG,CAAC,OAAkB,IAAI,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAI,GAAG,CAAC,UAAqB,IAAI,EAAE,CAAC;IAEnD,MAAM,GAAG,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAExC,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;AAC/D,CAAC"}

package/dist/cjs/index.browser.d.ts

@@ -16,11 +16,15 @@ export { Paginator } from "./pagination.js";
 export type { CryptoOps } from "./crypto.js";
 export type { PublicKeyInfo } from "./verify.js";
 export { issuanceBytes, hexToBytes, bytesToHex } from "./verify.js";
-import type { PublicKeyInfo, PublicKeyOptions } from "./verify.js";
+import type { PublicKeyInfo, PublicKeyOptions, VerifyOptions } from "./verify.js";
 import type { VerificationResult, TransparencyResult } from "./models.js";
+export type { AuthorizationPolicy, VerifyOptions } from "./verify.js";
 type Cert = Record<string, unknown>;
-/** Verify all signatures on a deletion certificate offline. */
-export declare function verifyCertificate(certificate: Cert, publicKeys: Map<string, PublicKeyInfo>): Promise<VerificationResult>;
+/** Verify all signatures on a deletion certificate offline. Pass
+ * `{ requireAuthorization }` to refuse a record unless its systems are certified
+ * under a key id you name, by an enclave image that requires that key group's
+ * signature to register a system (ADR-025). */
+export declare function verifyCertificate(certificate: Cert, publicKeys: Map<string, PublicKeyInfo>, options?: VerifyOptions): Promise<VerificationResult>;
 /** Verify the transparency proof embedded in a certificate. */
 export declare function verifyTransparency(certificate: Cert, publicKeys: Map<string, PublicKeyInfo>): Promise<TransparencyResult>;
 /** Construct a PublicKeyInfo from a hex-encoded Ed25519 public key. */